@4da/mcp-server 5.0.3 → 6.0.0

package/dist/live/osv-scanner.js

@@ -9,6 +9,7 @@
  */
 import { fetchWithTimeout, fetchJson } from "./http-utils.js";
 import { cvssBaseScore } from "./cvss.js";
+import { compareVersions, isComparable, maxVersion, samePackageName } from "./version-compare.js";
 const OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch";
 const OSV_VULN_URL = "https://api.osv.dev/v1/vulns/";
 const OSV_TIMEOUT_MS = 15_000;
@@ -36,7 +37,7 @@ export class OsvScanner {
             const cacheKey = `osv:${dep.ecosystem}:${dep.name}:${dep.version}`;
             const cached = this.cache.get(cacheKey);
             if (cached !== null) {
-                cachedVulns.push(...cached);
+                cachedVulns.push(...cached.map((v) => restampDepContext(v, dep)));
             }
             else {
                 uncached.push(dep);
@@ -60,7 +61,7 @@ export class OsvScanner {
                         const cacheKey = `osv:${dep.ecosystem}:${dep.name}:${dep.version}`;
                         const stale = this.cache.getStale(cacheKey);
                         if (stale)
-                            cachedVulns.push(...stale.data);
+                            cachedVulns.push(...stale.data.map((v) => restampDepContext(v, dep)));
                     }
                 }
             }
@@ -172,9 +173,37 @@ export class OsvScanner {
         }
     }
 }
+/**
+ * Overwrite the dep-context fields of a cached advisory entry with the CURRENT
+ * resolution's context. The advisory facts (id, severity, summary, fix version)
+ * are stable and cacheable; `platformActive`, `target`, `sourceDirs`, and the
+ * dev/direct flags are functions of TODAY's dependency resolution, not of the
+ * advisory. Serving them from cache bakes yesterday's context into today's
+ * scan — observed live 2026-08-30: a pre-platform-filter scan cached `glib`
+ * as platform-active and `sandbox` with no source dirs, and every scan for the
+ * next hour repeated both errors while the fixed resolver sat idle.
+ */
+export function restampDepContext(cached, dep) {
+    return {
+        ...cached,
+        package: dep.name,
+        currentVersion: dep.version || "unknown",
+        ecosystem: dep.ecosystem,
+        isDev: dep.isDev,
+        isDirect: dep.isDirect,
+        devScopeKnown: dep.devScopeKnown,
+        target: dep.target,
+        platformActive: dep.platformActive,
+        sourceDirs: dep.sourceDirs ?? [],
+        // Install drift is today's node_modules state, not an advisory fact:
+        // stamped from the current dep, so a cached row never carries it forward.
+        installDriftOf: dep.installDriftOf,
+        installFix: dep.installFix,
+    };
+}
 function mapVulnerability(vuln, dep) {
     const { severity, cvssScore } = deriveSeverity(vuln);
-    const fixedVersion = extractFixedVersion(vuln.affected, dep.name, dep.ecosystem);
+    const fixedVersion = extractFixedVersion(vuln.affected, dep.name, dep.ecosystem, dep.version);
     return {
         package: dep.name,
         currentVersion: dep.version || "unknown",
@@ -195,6 +224,9 @@ function mapVulnerability(vuln, dep) {
             .slice(0, 3),
         target: dep.target,
         platformActive: dep.platformActive,
+        sourceDirs: dep.sourceDirs ?? [],
+        installDriftOf: dep.installDriftOf,
+        installFix: dep.installFix,
     };
 }
 /**
@@ -260,18 +292,95 @@ function cvssToSeverity(score) {
         return "low";
     return "unknown";
 }
-function extractFixedVersion(affected, packageName, ecosystem) {
+/**
+ * Pick the fix version for the OSV range that actually CONTAINS the installed
+ * version — never another release line's fix. The old code returned the first
+ * range's first `fixed` event, so a multi-range advisory (e.g. undici fixed at
+ * 6.x on the 6 line and 7.x on the 7 line) recommended a DOWNGRADE to 6.x for
+ * an installed 7.x.
+ *
+ * Selection order:
+ * 1. The `fixed` of the interval containing installed (introduced <= installed
+ *    < fixed).
+ * 2. If that interval has no fix (or none contains installed), the smallest
+ *    published fix strictly ABOVE installed across all ranges.
+ * 3. If the installed version is unparseable, the highest published fix (it
+ *    resolves the advisory regardless of release line).
+ * 4. Otherwise null — omitting the recommendation beats emitting a downgrade.
+ *
+ * Hard guard: the returned version is never below the installed version.
+ */
+export function extractFixedVersion(affected, packageName, ecosystem, installedVersion) {
     if (!affected)
         return null;
+    const intervals = collectVulnerableIntervals(affected, packageName, ecosystem);
+    const fixes = intervals
+        .map((i) => i.fixed)
+        .filter((f) => f !== null);
+    if (fixes.length === 0)
+        return null;
+    // Ordered the ecosystem's way (PEP 440 for PyPI, `v`-less semver for Go).
+    const cmp = (a, b) => compareVersions(a, b, ecosystem);
+    if (installedVersion === null || !isComparable(installedVersion, ecosystem)) {
+        // Can't place the installed version on a release line — recommend the
+        // highest published fix so the upgrade resolves the advisory either way.
+        return maxVersion(fixes, ecosystem);
+    }
+    // The interval whose release line the installed version sits on. An
+    // unreadable bound compares as 0, which keeps those intervals eligible on
+    // the introduced side only; "0" (since inception) orders below everything.
+    const containing = intervals.find((i) => cmp(installedVersion, i.introduced) >= 0 &&
+        (i.fixed === null || cmp(installedVersion, i.fixed) < 0));
+    if (containing?.fixed && cmp(containing.fixed, installedVersion) > 0) {
+        return containing.fixed;
+    }
+    // No fix on the installed line (open interval, or installed already past
+    // every containing range): smallest fix strictly above installed, or nothing.
+    const above = fixes.filter((f) => cmp(f, installedVersion) > 0);
+    if (above.length === 0)
+        return null;
+    return above.reduce((min, v) => (cmp(v, min) < 0 ? v : min), above[0]);
+}
+/**
+ * Flatten the matching package's version ranges into [introduced, fixed)
+ * intervals. OSV sorts events within a range; each `introduced` opens an
+ * interval and the next `fixed` closes it. GIT ranges hold commit hashes,
+ * not versions, and are skipped.
+ */
+function collectVulnerableIntervals(affected, packageName, ecosystem) {
+    const intervals = [];
     for (const a of affected) {
-        if (a.package.name === packageName && a.package.ecosystem === ecosystem) {
-            for (const range of a.ranges || []) {
-                for (const event of range.events || []) {
-                    if (event.fixed)
-                        return event.fixed;
+        // Names compare the registry's way: PEP 503 for PyPI (`Jinja2` is
+        // `jinja2`), `-`/`_` folding for crates. An exact compare found no range
+        // for Jinja2 or PyYAML and reported "no fix version published" for both.
+        if (a.package.ecosystem !== ecosystem || !samePackageName(a.package.name, packageName, ecosystem))
+            continue;
+        for (const range of a.ranges || []) {
+            if (range.type === "GIT")
+                continue;
+            let open = null;
+            for (const event of range.events || []) {
+                if (event.introduced !== undefined) {
+                    if (open)
+                        intervals.push(open);
+                    open = { introduced: event.introduced, fixed: null };
+                }
+                else if (event.fixed !== undefined) {
+                    if (open) {
+                        open.fixed = event.fixed;
+                        intervals.push(open);
+                        open = null;
+                    }
+                    else {
+                        // `fixed` with no preceding `introduced` — treat as vulnerable
+                        // since inception ("0" = OSV's since-the-beginning sentinel).
+                        intervals.push({ introduced: "0", fixed: event.fixed });
+                    }
                 }
             }
+            if (open)
+                intervals.push(open);
         }
     }
-    return null;
+    return intervals;
 }

package/dist/live/package-archive.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Registry package archive reader (gzip tar), Node built-ins only.
+ *
+ * `upgrade_impact` reads the changelog a package ships INSIDE its own registry
+ * archive (npm `.tgz`, crates.io `.crate`). That keeps the privacy contract
+ * simple: the only host contacted is the package's own registry, which the
+ * agent was going to download from anyway — never GitHub or a docs site.
+ *
+ * Why a hand-rolled tar reader: adding `tar` as a dependency for the one job
+ * of pulling a few root-level text files would grow the published server's
+ * supply chain for no gain. The subset handled here is what real registry
+ * archives use: ustar headers with the `prefix` field, PAX `x` headers
+ * (`path=` for names over 100 bytes — npm's packer emits these) and GNU `L`
+ * long names (older cargo / GNU tar). Everything else is skipped, not guessed.
+ *
+ * Hard caps, because the archive is third-party input: compressed ≤ 20 MB
+ * (Content-Length AND bytes actually read — a server can lie about the
+ * former), uncompressed ≤ 80 MB (zlib `maxOutputLength`, so a gzip bomb stops
+ * inflating at the cap instead of exhausting memory), single file ≤ 2 MB.
+ */
+export declare const MAX_COMPRESSED_BYTES: number;
+export declare const MAX_UNCOMPRESSED_BYTES: number;
+export declare const MAX_FILE_BYTES: number;
+/** The fetch signature archive and registry readers go through, so tests can inject one. */
+export type FetchFn = (url: string, init?: RequestInit, timeoutMs?: number) => Promise<Response>;
+export declare const defaultFetch: FetchFn;
+/** Raised for every refusal (cap exceeded, corrupt archive) with a message fit for tool output. */
+export declare class ArchiveError extends Error {
+}
+interface TarEntry {
+    path: string;
+    type: string;
+    data: Buffer;
+}
+/** PAX records are `"<len> <key>=<value>\n"`, where len counts the whole record in BYTES. */
+export declare function parsePaxHeaders(data: Buffer): Record<string, string>;
+/** Walk an uncompressed tar buffer, yielding regular-file entries with their resolved names. */
+export declare function iterateTar(tar: Buffer): Generator<TarEntry>;
+/**
+ * Root-level text files from a gzip tar whose basename `accept` approves.
+ * "Root-level" = at most one directory deep, because registry archives wrap
+ * everything in a single top directory (`package/`, `<name>-<version>/`).
+ * Keys are the archive paths as stored. Oversized or binary (NUL-containing)
+ * files are skipped.
+ */
+export declare function readRootTextFiles(gz: Buffer, accept: (basename: string) => boolean): Map<string, string>;
+/** Download a registry archive (size-capped) and return the accepted root-level text files. */
+export declare function fetchArchiveRootFiles(url: string, accept: (basename: string) => boolean, fetchFn?: FetchFn, headers?: Record<string, string>): Promise<Map<string, string>>;
+export {};

package/dist/live/package-archive.js

@@ -0,0 +1,186 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Registry package archive reader (gzip tar), Node built-ins only.
+ *
+ * `upgrade_impact` reads the changelog a package ships INSIDE its own registry
+ * archive (npm `.tgz`, crates.io `.crate`). That keeps the privacy contract
+ * simple: the only host contacted is the package's own registry, which the
+ * agent was going to download from anyway — never GitHub or a docs site.
+ *
+ * Why a hand-rolled tar reader: adding `tar` as a dependency for the one job
+ * of pulling a few root-level text files would grow the published server's
+ * supply chain for no gain. The subset handled here is what real registry
+ * archives use: ustar headers with the `prefix` field, PAX `x` headers
+ * (`path=` for names over 100 bytes — npm's packer emits these) and GNU `L`
+ * long names (older cargo / GNU tar). Everything else is skipped, not guessed.
+ *
+ * Hard caps, because the archive is third-party input: compressed ≤ 20 MB
+ * (Content-Length AND bytes actually read — a server can lie about the
+ * former), uncompressed ≤ 80 MB (zlib `maxOutputLength`, so a gzip bomb stops
+ * inflating at the cap instead of exhausting memory), single file ≤ 2 MB.
+ */
+import { gunzipSync } from "node:zlib";
+import { fetchWithTimeout } from "./http-utils.js";
+export const MAX_COMPRESSED_BYTES = 20 * 1024 * 1024;
+export const MAX_UNCOMPRESSED_BYTES = 80 * 1024 * 1024;
+export const MAX_FILE_BYTES = 2 * 1024 * 1024;
+const BLOCK = 512;
+const ARCHIVE_TIMEOUT_MS = 30_000;
+export const defaultFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init ?? {}, timeoutMs);
+/** Raised for every refusal (cap exceeded, corrupt archive) with a message fit for tool output. */
+export class ArchiveError extends Error {
+}
+function readString(buf, start, length) {
+    const slice = buf.subarray(start, start + length);
+    const nul = slice.indexOf(0);
+    return slice.subarray(0, nul === -1 ? slice.length : nul).toString("utf8");
+}
+function readOctal(buf, start, length) {
+    if (buf[start] & 0x80) {
+        // GNU base-256 size: only needed for entries ≥ 8 GB, far over every cap here.
+        throw new ArchiveError("tar entry uses a base-256 size field (entry too large)");
+    }
+    const text = readString(buf, start, length).trim();
+    if (text === "")
+        return 0;
+    if (!/^[0-7]+$/.test(text))
+        throw new ArchiveError(`corrupt tar header: size field "${text}"`);
+    return parseInt(text, 8);
+}
+function checksumMatches(header) {
+    const stored = readString(header, 148, 8).trim();
+    if (!/^[0-7]+$/.test(stored))
+        return false;
+    let sum = 0;
+    for (let i = 0; i < BLOCK; i++)
+        sum += i >= 148 && i < 156 ? 0x20 : header[i];
+    return sum === parseInt(stored, 8);
+}
+/** PAX records are `"<len> <key>=<value>\n"`, where len counts the whole record in BYTES. */
+export function parsePaxHeaders(data) {
+    const out = {};
+    let pos = 0;
+    while (pos < data.length) {
+        const space = data.indexOf(0x20, pos);
+        if (space === -1)
+            break;
+        const len = Number(data.subarray(pos, space).toString("ascii"));
+        if (!Number.isInteger(len) || len <= 0 || pos + len > data.length)
+            break;
+        const record = data.subarray(space + 1, pos + len).toString("utf8").replace(/\n$/, "");
+        const eq = record.indexOf("=");
+        if (eq > 0)
+            out[record.slice(0, eq)] = record.slice(eq + 1);
+        pos += len;
+    }
+    return out;
+}
+/** Walk an uncompressed tar buffer, yielding regular-file entries with their resolved names. */
+export function* iterateTar(tar) {
+    let offset = 0;
+    let paxPath = null;
+    let gnuLongName = null;
+    while (offset + BLOCK <= tar.length) {
+        const header = tar.subarray(offset, offset + BLOCK);
+        if (header.every((b) => b === 0))
+            return; // end-of-archive marker
+        if (!checksumMatches(header))
+            throw new ArchiveError("corrupt tar header: checksum mismatch");
+        const size = readOctal(header, 124, 12);
+        const type = String.fromCharCode(header[156] || 0x30); // NUL typeflag = regular file
+        const dataStart = offset + BLOCK;
+        if (dataStart + size > tar.length)
+            throw new ArchiveError("truncated tar entry");
+        const data = tar.subarray(dataStart, dataStart + size);
+        offset = dataStart + Math.ceil(size / BLOCK) * BLOCK;
+        if (type === "x") {
+            paxPath = parsePaxHeaders(data).path ?? null;
+            continue;
+        }
+        if (type === "L") {
+            gnuLongName = readString(data, 0, data.length);
+            continue;
+        }
+        if (type === "g" || type === "K")
+            continue; // global PAX / GNU long link: no effect on names here
+        const name = readString(header, 0, 100);
+        const magic = readString(header, 257, 6);
+        const prefix = magic.startsWith("ustar") ? readString(header, 345, 155) : "";
+        const path = paxPath ?? gnuLongName ?? (prefix ? `${prefix}/${name}` : name);
+        paxPath = null;
+        gnuLongName = null;
+        yield { path, type, data };
+    }
+}
+/** Path segments with `./` and empty segments removed. */
+function segments(path) {
+    return path.split("/").filter((s) => s !== "" && s !== ".");
+}
+/**
+ * Root-level text files from a gzip tar whose basename `accept` approves.
+ * "Root-level" = at most one directory deep, because registry archives wrap
+ * everything in a single top directory (`package/`, `<name>-<version>/`).
+ * Keys are the archive paths as stored. Oversized or binary (NUL-containing)
+ * files are skipped.
+ */
+export function readRootTextFiles(gz, accept) {
+    if (gz.length > MAX_COMPRESSED_BYTES) {
+        throw new ArchiveError(`archive is ${gz.length} bytes compressed (cap ${MAX_COMPRESSED_BYTES})`);
+    }
+    let tar;
+    try {
+        tar = gunzipSync(gz, { maxOutputLength: MAX_UNCOMPRESSED_BYTES });
+    }
+    catch (err) {
+        if (err instanceof RangeError || err.code === "ERR_BUFFER_TOO_LARGE") {
+            throw new ArchiveError(`archive exceeds ${MAX_UNCOMPRESSED_BYTES} bytes uncompressed`);
+        }
+        throw new ArchiveError(`archive is not valid gzip: ${err.message}`);
+    }
+    const files = new Map();
+    for (const entry of iterateTar(tar)) {
+        if (entry.type !== "0" && entry.type !== "7")
+            continue;
+        const parts = segments(entry.path);
+        if (parts.length === 0 || parts.length > 2)
+            continue;
+        if (!accept(parts[parts.length - 1]))
+            continue;
+        if (entry.data.length > MAX_FILE_BYTES || entry.data.includes(0))
+            continue;
+        files.set(entry.path, entry.data.toString("utf8"));
+    }
+    return files;
+}
+/** Read a response body, refusing at `cap` bytes instead of buffering whatever the server sends. */
+async function readCapped(response, cap) {
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > cap) {
+        throw new ArchiveError(`archive is ${declared} bytes compressed (cap ${cap})`);
+    }
+    if (!response.body)
+        return Buffer.from(await response.arrayBuffer());
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > cap) {
+            await reader.cancel().catch(() => undefined);
+            throw new ArchiveError(`archive exceeds ${cap} bytes compressed`);
+        }
+        chunks.push(Buffer.from(value));
+    }
+    return Buffer.concat(chunks);
+}
+/** Download a registry archive (size-capped) and return the accepted root-level text files. */
+export async function fetchArchiveRootFiles(url, accept, fetchFn = defaultFetch, headers = {}) {
+    const response = await fetchFn(url, { headers }, ARCHIVE_TIMEOUT_MS);
+    if (!response.ok)
+        throw new ArchiveError(`archive download failed: HTTP ${response.status}`);
+    const gz = await readCapped(response, MAX_COMPRESSED_BYTES);
+    return readRootTextFiles(gz, accept);
+}

package/dist/live/pypi-registry.js

@@ -21,7 +21,9 @@ export class PyPIRegistry {
     }
     async getPackageInfo(name, currentVersion, isDev) {
         const normalizedName = name.toLowerCase().replace(/_/g, "-");
-        const cacheKey = `pypi-reg:${name.toLowerCase()}`;
+        // Keyed by the installed version too: the cached answer carries currentVersion
+        // and its distance, so a name-only key served one project's answer to another.
+        const cacheKey = `pypi-reg:${name.toLowerCase()}@${currentVersion ?? ""}:${isDev ? 1 : 0}`;
         const cached = this.cache.get(cacheKey);
         if (cached !== null)
             return cached;

package/dist/live/registry-health.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Registry health lookups for resolved dependencies (moved out of
+ * live/index.ts unchanged, so the coordinator stays within its size limit).
+ */
+import type { NpmRegistry } from "./npm-registry.js";
+import type { CratesRegistry } from "./crates-registry.js";
+import type { PyPIRegistry } from "./pypi-registry.js";
+import type { GoRegistry } from "./go-registry.js";
+import type { RegistryPackageInfo, ResolvedDependency } from "./types.js";
+export interface Registries {
+    npm: NpmRegistry;
+    crates: CratesRegistry;
+    pypi: PyPIRegistry;
+    go: GoRegistry;
+}
+export declare function fetchRegistryHealthFor(deps: ResolvedDependency[], registries: Registries, enabled: boolean): Promise<RegistryPackageInfo[]>;

package/dist/live/registry-health.js

@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Registry health lookups for resolved dependencies (moved out of
+ * live/index.ts unchanged, so the coordinator stays within its size limit).
+ */
+import { computeSemverDistance } from "./semver-utils.js";
+function unavailable(dep, fetchError) {
+    return {
+        name: dep.name, ecosystem: dep.ecosystem, currentVersion: dep.version,
+        latestVersion: null, latestStableVersion: null, versionsBehind: null,
+        deprecated: false, deprecationMessage: null, lastPublished: null,
+        license: null, weeklyDownloads: null, isDev: dep.isDev, fetchError,
+    };
+}
+export async function fetchRegistryHealthFor(deps, registries, enabled) {
+    if (!enabled)
+        return deps.map((d) => unavailable(d, "Offline mode"));
+    const registryForEcosystem = (eco) => {
+        switch (eco) {
+            case "npm": return registries.npm;
+            case "crates.io": return registries.crates;
+            case "PyPI": return registries.pypi;
+            case "Go": return registries.go;
+            default: return null;
+        }
+    };
+    const results = await Promise.all(deps.map(async (dep) => {
+        const registry = registryForEcosystem(dep.ecosystem);
+        if (!registry)
+            return unavailable(dep, `No registry fetcher for ${dep.ecosystem}`);
+        try {
+            const info = await registry.getPackageInfo(dep.name, dep.version, dep.isDev);
+            return restampRegistryContext(info, dep);
+        }
+        catch {
+            return unavailable(dep, "Registry fetch failed");
+        }
+    }));
+    // Bulk fetch npm downloads for npm deps
+    const npmDeps = deps.filter((d) => d.ecosystem === "npm");
+    if (npmDeps.length > 0) {
+        try {
+            const downloads = await registries.npm.getBulkDownloads(npmDeps.map((d) => d.name));
+            for (const result of results) {
+                if (result.ecosystem === "npm" && downloads.has(result.name)) {
+                    result.weeklyDownloads = downloads.get(result.name) || null;
+                }
+            }
+        }
+        catch {
+            // Downloads are nice-to-have, not critical
+        }
+    }
+    return results;
+}
+/**
+ * Registry caches key by package NAME, but the cached record embeds the
+ * QUERYING dependency's `currentVersion`, `versionsBehind`, and `isDev`. Two
+ * instances of one package at different versions (better-sqlite3 11.10.0 and
+ * 12.11.1 across workspaces) therefore both came back wearing the first
+ * instance's version — the upgrade planner then showed two identical rows and
+ * lost the older instance entirely. Registry facts (latest version,
+ * deprecation, downloads) are per-package and cacheable; the per-instance
+ * fields are re-stamped here from the dep actually being asked about.
+ */
+function restampRegistryContext(info, dep) {
+    const latest = info.latestStableVersion || info.latestVersion;
+    return {
+        ...info,
+        currentVersion: dep.version,
+        isDev: dep.isDev,
+        versionsBehind: dep.version && latest ? computeSemverDistance(dep.version, latest) : null,
+    };
+}

package/dist/live/release-metadata.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Per-release registry metadata, normalised across npm and crates.io.
+ *
+ * `dependency_check` judges ONE proposed version against the one installed
+ * (or, for a new dependency, against the previous release on the same line).
+ * That needs facts the version-freshness readers never kept: when each release
+ * was published, who/what published it, whether it runs install scripts, and
+ * which runtime dependencies it pulls in. Both registry readers project their
+ * raw responses into this shape so the signal logic never sees a registry's
+ * wire format.
+ *
+ * Privacy: every request behind this shape carries the package NAME only.
+ * Versions are selected locally from the full release list.
+ */
+/**
+ * Publish trust of one release.
+ * 2 = published by a registry-verified trusted publisher (npm
+ *     `_npmUser.trustedPublisher`, crates.io `trustpub_data`).
+ * 1 = carries a provenance attestation (npm `dist.attestations`).
+ * 0 = neither: a token / hand publish.
+ */
+export type TrustLevel = 0 | 1 | 2;
+export interface ReleaseRecord {
+    version: string;
+    /** ISO publish time, or null when the registry does not say. */
+    publishedAt: string | null;
+    trust: TrustLevel;
+    /** Human label for the trust evidence, e.g. "trusted publisher (github)". */
+    trustEvidence: string;
+    /** npm: install-time lifecycle scripts declared (preinstall/install/postinstall, or a gypfile). Null for crates. */
+    installScripts: string[] | null;
+    /** npm deprecation message, or null. */
+    deprecated: string | null;
+    /** crates.io: yanked. npm: unpublished (listed in `time` but gone from `versions`). */
+    withdrawn: "yanked" | "unpublished" | null;
+    /** Runtime dependency NAMES (npm dependencies + optionalDependencies; crates normal + build). Null when unknown. */
+    dependencies: string[] | null;
+}
+export interface PackageReleaseIndex {
+    ecosystem: "npm" | "crates.io";
+    name: string;
+    /** When the package itself was first published, or null. */
+    createdAt: string | null;
+    releases: Record<string, ReleaseRecord>;
+}
+/** The outcome of one registry read: data, a definite "no such package", or "could not reach it". */
+export type RegistryLookup<T> = {
+    status: "ok";
+    data: T;
+} | {
+    status: "not_found";
+    detail: string;
+} | {
+    status: "unreachable";
+    detail: string;
+};
+/** What dependency_check needs from a registry. Live readers and test fakes both implement it. */
+export interface ReleaseMetadataSource {
+    /**
+     * The package's release index. `wanted` names the versions the caller is
+     * about to read; a reader that pages (crates.io) may stop once it has them
+     * and the release just below `wanted[0]` on its line.
+     */
+    getReleases(name: string, wanted: string[]): Promise<RegistryLookup<PackageReleaseIndex>>;
+    /** When a package was first published (for a newly introduced transitive dependency). */
+    getCreatedAt(name: string): Promise<RegistryLookup<string | null>>;
+}

package/dist/live/release-metadata.js

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Per-release registry metadata, normalised across npm and crates.io.
+ *
+ * `dependency_check` judges ONE proposed version against the one installed
+ * (or, for a new dependency, against the previous release on the same line).
+ * That needs facts the version-freshness readers never kept: when each release
+ * was published, who/what published it, whether it runs install scripts, and
+ * which runtime dependencies it pulls in. Both registry readers project their
+ * raw responses into this shape so the signal logic never sees a registry's
+ * wire format.
+ *
+ * Privacy: every request behind this shape carries the package NAME only.
+ * Versions are selected locally from the full release list.
+ */
+export {};

package/dist/live/resolution.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Dependency resolution that knows when it has gone stale.
+ *
+ * Measured 2026-09-10: three `node ./mcp-4da-server/dist/index.js` processes
+ * were live and two had started before the pull that brought hono 4.13.5.
+ * `vulnerability_scan` from one of them reported hono 4.13.3 (the lockfile
+ * value when it started) with `_meta.cached: false`. The live layer resolved
+ * versions once at init and never again, and `cached` described only the OSV
+ * lookup, so nothing in the answer could reveal that it was stale.
+ *
+ * A group records every file its resolution depended on as a stat signature:
+ * each lockfile candidate (present or absent, so one appearing or vanishing
+ * counts), the manifest when the resolver fell back to it, and for npm the
+ * node_modules install state. Signatures are taken BEFORE reading, so a write
+ * that lands mid-read still registers as a change. `resolveGroup` depends
+ * only on its inputs and the filesystem, so the SAME resolution can be re-run
+ * when a signature moves. Stat calls only: no timers, no watchers.
+ */
+import { type FileSignature } from "./file-signature.js";
+import type { InstallDriftRecord, ResolutionSourceRecord, ResolvedDependency } from "./types.js";
+/** The inputs of one resolution, kept so the same resolution can be re-run. */
+export interface ResolutionGroup {
+    dir: string;
+    language: string;
+    deps: string[];
+    devDeps: string[];
+    targets: Record<string, string>;
+}
+export interface GroupResolution {
+    group: ResolutionGroup;
+    /** Direct dependencies (dependency health, upgrade planning). */
+    resolved: ResolvedDependency[];
+    /** The full lockfile set plus drift entries (vulnerability scanning). */
+    audit: ResolvedDependency[];
+    drift: InstallDriftRecord[];
+    /** The file the versions were read from, or null when the group resolved from nothing. */
+    source: ResolutionSourceRecord | null;
+    signatures: Map<string, FileSignature>;
+    resolvedAt: string;
+}
+export declare function resolveGroup(group: ResolutionGroup): GroupResolution;
+/** True when any file the resolution depended on changed, appeared, or vanished. */
+export declare function groupIsStale(result: GroupResolution): boolean;