@4da/mcp-server 6.1.0 → 6.2.1

package/dist/live/go-releases.js

@@ -0,0 +1,196 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Go module release index for dependency_check, from the module proxy
+ * (proxy.golang.org, the host `go get` downloads from):
+ *
+ * - `/@v/list`: the tagged versions, `+incompatible` ones included (a module
+ *   that predates modules and tags v2+ without a `/v2` path).
+ * - `/@v/<version>.info`: one release's time. The list carries no dates, so
+ *   this is read for the versions being judged only (cached; a published
+ *   version never changes). A pseudo-version (`v0.0.0-20240102150405-abcdef123456`)
+ *   is not in the list; its `.info` both confirms it exists and dates it.
+ * - The latest version's `go.mod`: its `retract` directives withdraw versions
+ *   (`go get` skips them), reported like a yank.
+ * - An untagged module: `@latest` gives its newest pseudo-version.
+ *
+ * Major versions 2+ are different module paths (`.../v5`); the proxy lists
+ * each path's own versions only.
+ *
+ * Not applicable to Go and reported so by the signals: publisher identity
+ * (integrity is checked against sum.golang.org instead), install hooks (Go
+ * runs no package code at download), per-release dependency lists.
+ */
+import { fetchWithTimeout } from "./http-utils.js";
+import { compareVersions } from "./version-compare.js";
+import { escapeGoPath } from "./upgrade-go.js";
+const GO_PROXY = "https://proxy.golang.org";
+const TIMEOUT_MS = 15_000;
+const LIST_TTL = 3600;
+const INFO_TTL = 30 * 86_400;
+/** `.info` reads per getReleases call. */
+const MAX_INFO_READS = 6;
+export const GO_NOT_APPLICABLE = "not applicable to Go modules: the proxy carries no publisher identity (downloads are checked against sum.golang.org)";
+/** A Go version: release, prerelease, pseudo-version, optional `+incompatible`. */
+export const GO_VERSION = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+incompatible)?$/;
+const PSEUDO = /(?:^v\d+\.\d+\.\d+-|[.-])(?:0\.)?(\d{14})-[0-9a-f]{12}(?:\+incompatible)?$/;
+/** `v`-prefixed spelling of a Go version ("1.2.3" -> "v1.2.3"). */
+export function goVersion(raw) {
+    const v = raw.trim();
+    return /^\d/.test(v) ? `v${v}` : v;
+}
+/** The commit time a pseudo-version embeds, as ISO, or null when `version` is not one. */
+export function pseudoVersionTime(version) {
+    const m = PSEUDO.exec(version);
+    if (!m)
+        return null;
+    const t = m[1];
+    return `${t.slice(0, 4)}-${t.slice(4, 6)}-${t.slice(6, 8)}T${t.slice(8, 10)}:${t.slice(10, 12)}:${t.slice(12, 14)}Z`;
+}
+/** `retract` directives of a go.mod: single versions, `[low, high]` intervals, and blocks of either. */
+export function parseRetractions(goMod) {
+    const out = [];
+    const entry = (text) => {
+        const [body, ...comment] = text.split("//");
+        const rationale = comment.join("//").trim() || null;
+        const interval = /^\s*\[\s*(v\S+?)\s*,\s*(v\S+?)\s*\]\s*$/.exec(body);
+        if (interval)
+            out.push({ low: interval[1], high: interval[2], rationale });
+        else {
+            const single = /^\s*(v\S+)\s*$/.exec(body);
+            if (single)
+                out.push({ low: single[1], high: single[1], rationale });
+        }
+    };
+    const lines = goMod.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const m = /^\s*retract\s+(.*)$/.exec(lines[i]);
+        if (!m)
+            continue;
+        if (m[1].trim().startsWith("(")) {
+            for (i++; i < lines.length && !/^\s*\)/.test(lines[i]); i++)
+                entry(lines[i]);
+        }
+        else {
+            entry(m[1]);
+        }
+    }
+    return out;
+}
+export class GoReleasesReader {
+    cache;
+    rateLimiter;
+    constructor(cache, rateLimiter) {
+        this.cache = cache;
+        this.rateLimiter = rateLimiter;
+    }
+    async getReleases(module, wanted) {
+        const list = await this.list(module);
+        if (list.status !== "ok")
+            return list;
+        const { versions, retractions } = list.data;
+        const releases = {};
+        for (const version of versions)
+            releases[version] = record(version, null, retractions);
+        // Dates (and existence, for a pseudo-version) of the versions being judged.
+        const want = [...new Set(wanted.map(goVersion))].filter((v) => GO_VERSION.test(v)).slice(0, MAX_INFO_READS);
+        await Promise.all(want.map(async (version) => {
+            const info = await this.info(module, version);
+            // The proxy answers `v20.10.0` with the `v20.10.0+incompatible` release: file it under its own name.
+            if (info === null || (info.Version && info.Version !== version))
+                return;
+            const time = info.Time ?? pseudoVersionTime(version);
+            releases[version] = { ...(releases[version] ?? record(version, null, retractions)), publishedAt: time ?? null };
+        }));
+        return { status: "ok", data: { ecosystem: "Go", name: module, createdAt: null, releases } };
+    }
+    async getCreatedAt() {
+        return { status: "ok", data: null };
+    }
+    async list(module) {
+        const key = `go-releases:${module}`;
+        const hit = this.cache.get(key);
+        if (hit)
+            return { status: "ok", data: hit };
+        const base = `${GO_PROXY}/${escapeGoPath(module)}`;
+        let versions;
+        try {
+            const res = await this.get(`${base}/@v/list`);
+            // The proxy answers 404 / 410 for a path it cannot resolve.
+            if (res.status === 404 || res.status === 410) {
+                return { status: "not_found", detail: `"${module}" is not a module the Go proxy can resolve` };
+            }
+            if (!res.ok)
+                return { status: "unreachable", detail: `Go module proxy answered HTTP ${res.status}` };
+            versions = (await res.text()).split("\n").map((v) => v.trim()).filter((v) => GO_VERSION.test(v));
+            if (versions.length === 0) {
+                // Untagged: the newest pseudo-version.
+                const latest = await this.get(`${base}/@latest`);
+                if (latest.ok) {
+                    const info = (await latest.json());
+                    if (info.Version && GO_VERSION.test(info.Version)) {
+                        versions = [info.Version];
+                        if (info.Time)
+                            this.cache.set(`go-info:${module}@${info.Version}`, info, "go", INFO_TTL);
+                    }
+                }
+            }
+        }
+        catch (err) {
+            return { status: "unreachable", detail: `Go module proxy: ${err instanceof Error ? err.message : String(err)}` };
+        }
+        // Retractions live in the newest version's go.mod.
+        let retractions = [];
+        let retractionsNote = null;
+        const newest = versions.reduce((max, v) => (max === null || compareVersions(v, max, "Go") > 0 ? v : max), null);
+        if (newest) {
+            try {
+                const res = await this.get(`${base}/@v/${escapeGoPath(newest)}.mod`);
+                if (res.ok)
+                    retractions = parseRetractions(await res.text());
+                else
+                    retractionsNote = `go.mod of ${newest}: HTTP ${res.status}`;
+            }
+            catch (err) {
+                retractionsNote = `go.mod of ${newest}: ${err instanceof Error ? err.message : String(err)}`;
+            }
+        }
+        const data = { versions, retractions, retractionsNote };
+        this.cache.set(key, data, "go", LIST_TTL);
+        return { status: "ok", data };
+    }
+    async info(module, version) {
+        const key = `go-info:${module}@${version}`;
+        const hit = this.cache.get(key);
+        if (hit)
+            return hit;
+        try {
+            const res = await this.get(`${GO_PROXY}/${escapeGoPath(module)}/@v/${escapeGoPath(version)}.info`);
+            if (!res.ok)
+                return null;
+            const info = (await res.json());
+            this.cache.set(key, info, "go", INFO_TTL);
+            return info;
+        }
+        catch {
+            return null;
+        }
+    }
+    async get(url) {
+        if (!this.rateLimiter.consume("go"))
+            throw new Error("Go module proxy rate limit reached for this minute");
+        return fetchWithTimeout(url, {}, TIMEOUT_MS);
+    }
+}
+function record(version, publishedAt, retractions) {
+    const hit = retractions.find((r) => compareVersions(version, r.low, "Go") >= 0 && compareVersions(version, r.high, "Go") <= 0);
+    return {
+        version,
+        publishedAt,
+        trust: 0,
+        trustEvidence: GO_NOT_APPLICABLE,
+        installScripts: null,
+        deprecated: hit?.rationale ? `retracted: ${hit.rationale}` : null,
+        withdrawn: hit ? "retracted" : null,
+        dependencies: null,
+    };
+}

package/dist/live/index.d.ts

@@ -9,7 +9,7 @@
  */
 import type { SqliteDatabase } from "../sqlite-driver.js";
 import { FixPathSources } from "./fix-paths.js";
-import type { ReleaseMetadataSource } from "./release-metadata.js";
+import type { CheckEcosystem, ReleaseMetadataSource } from "./release-metadata.js";
 import { type ResolutionGroup } from "./resolution.js";
 import type { TreeDiscovery } from "../project-tree.js";
 import type { InstallDriftRecord, ResolutionProvenance, ResolvedDependency, RegistryPackageInfo, VulnerabilityScanResult, LiveHeadline, LiveIntelligenceStatus } from "./types.js";
@@ -26,6 +26,8 @@ export declare class LiveIntelligence {
     private goRegistry;
     private npmPackuments;
     private cratesVersions;
+    private pypiReleases;
+    private goReleases;
     private fixPathSources;
     private enabled;
     private lastVulnScan;
@@ -210,10 +212,7 @@ export declare class LiveIntelligence {
     isInitialized(): boolean;
     fetchRegistryHealth(deps: ResolvedDependency[]): Promise<RegistryPackageInfo[]>;
     /** Per-release registry readers for dependency_check (name-only requests). */
-    getReleaseSources(): {
-        npm: ReleaseMetadataSource;
-        "crates.io": ReleaseMetadataSource;
-    };
+    getReleaseSources(): Record<CheckEcosystem, ReleaseMetadataSource>;
     /**
      * OSV advisories for explicit (ecosystem, name, version) triples that need
      * not be in the project, e.g. a version an agent is about to install. Same

package/dist/live/index.js

@@ -18,6 +18,8 @@ import { PyPIRegistry } from "./pypi-registry.js";
 import { GoRegistry } from "./go-registry.js";
 import { NpmPackumentReader } from "./npm-packument.js";
 import { CratesVersionsReader } from "./crates-versions.js";
+import { PypiReleasesReader } from "./pypi-releases.js";
+import { GoReleasesReader } from "./go-releases.js";
 import { FixPathSources } from "./fix-paths.js";
 import { fetchRegistryHealthFor } from "./registry-health.js";
 import { commonPathRoot, dedupeDependencies, emptyVulnResult } from "./dependency-set.js";
@@ -38,6 +40,8 @@ export class LiveIntelligence {
     goRegistry;
     npmPackuments;
     cratesVersions;
+    pypiReleases;
+    goReleases;
     fixPathSources;
     enabled;
     lastVulnScan = null;
@@ -93,6 +97,8 @@ export class LiveIntelligence {
         this.goRegistry = new GoRegistry(this.cache, this.rateLimiter);
         this.npmPackuments = new NpmPackumentReader(this.cache, this.rateLimiter);
         this.cratesVersions = new CratesVersionsReader(this.cache, this.rateLimiter);
+        this.pypiReleases = new PypiReleasesReader(this.cache, this.rateLimiter);
+        this.goReleases = new GoReleasesReader(this.cache, this.rateLimiter);
         this.fixPathSources = new FixPathSources(this.cache, this.rateLimiter);
     }
     /** Advisory, registry and parent-requirement lookups for fix paths; null when offline. */
@@ -446,7 +452,7 @@ export class LiveIntelligence {
     }
     /** Per-release registry readers for dependency_check (name-only requests). */
     getReleaseSources() {
-        return { npm: this.npmPackuments, "crates.io": this.cratesVersions };
+        return { npm: this.npmPackuments, "crates.io": this.cratesVersions, PyPI: this.pypiReleases, Go: this.goReleases };
     }
     /**
      * OSV advisories for explicit (ecosystem, name, version) triples that need

package/dist/live/osv-ranges.d.ts

@@ -25,6 +25,12 @@ export interface AdvisoryRanges {
     id: string;
     spans: AffectedSpan[];
     versions: string[];
+    /**
+     * A maintenance notice (RustSec "unmaintained" and other informational
+     * notices), not an exploitable vulnerability. Absent on entries cached
+     * before 6.2.
+     */
+    maintenance?: boolean;
 }
 /**
  * Flatten the matching package's version ranges into spans. OSV sorts events

package/dist/live/osv-ranges.js

@@ -13,6 +13,7 @@
  */
 import { compareVersions, isComparable, parsePep440, samePackageName } from "./version-compare.js";
 import { parseSemverPrecedence } from "./semver-precedence.js";
+import { isMaintenanceNotice } from "./maintenance.js";
 /**
  * Flatten the matching package's version ranges into spans. OSV sorts events
  * within a range; each `introduced` opens a span and the next `fixed` or
@@ -69,10 +70,12 @@ function listedVersions(affected, packageName, ecosystem) {
 export function advisoryRanges(vuln, packageName, ecosystem) {
     if (vuln.withdrawn)
         return null;
+    const informational = vuln.database_specific?.informational;
     return {
         id: vuln.id,
         spans: collectAffectedSpans(vuln.affected, packageName, ecosystem),
         versions: listedVersions(vuln.affected, packageName, ecosystem),
+        maintenance: isMaintenanceNotice({ summary: vuln.summary ?? "" }) || informational === "unmaintained" || informational === "notice",
     };
 }
 /** True when `version` lies in a span (or the explicit list) of this advisory. */

package/dist/live/package-archive.d.ts

@@ -44,6 +44,8 @@ export declare function iterateTar(tar: Buffer): Generator<TarEntry>;
  * files are skipped.
  */
 export declare function readRootTextFiles(gz: Buffer, accept: (basename: string) => boolean): Map<string, string>;
+/** Download a registry archive, refusing at MAX_COMPRESSED_BYTES. */
+export declare function fetchArchiveBytes(url: string, fetchFn?: FetchFn, headers?: Record<string, string>): Promise<Buffer>;
 /** Download a registry archive (size-capped) and return the accepted root-level text files. */
 export declare function fetchArchiveRootFiles(url: string, accept: (basename: string) => boolean, fetchFn?: FetchFn, headers?: Record<string, string>): Promise<Map<string, string>>;
 export {};

package/dist/live/package-archive.js

@@ -176,11 +176,14 @@ async function readCapped(response, cap) {
     }
     return Buffer.concat(chunks);
 }
-/** Download a registry archive (size-capped) and return the accepted root-level text files. */
-export async function fetchArchiveRootFiles(url, accept, fetchFn = defaultFetch, headers = {}) {
+/** Download a registry archive, refusing at MAX_COMPRESSED_BYTES. */
+export async function fetchArchiveBytes(url, fetchFn = defaultFetch, headers = {}) {
     const response = await fetchFn(url, { headers }, ARCHIVE_TIMEOUT_MS);
     if (!response.ok)
         throw new ArchiveError(`archive download failed: HTTP ${response.status}`);
-    const gz = await readCapped(response, MAX_COMPRESSED_BYTES);
-    return readRootTextFiles(gz, accept);
+    return readCapped(response, MAX_COMPRESSED_BYTES);
+}
+/** Download a registry archive (size-capped) and return the accepted root-level text files. */
+export async function fetchArchiveRootFiles(url, accept, fetchFn = defaultFetch, headers = {}) {
+    return readRootTextFiles(await fetchArchiveBytes(url, fetchFn, headers), accept);
 }

package/dist/live/pypi-releases.d.ts

@@ -0,0 +1,44 @@
+/**
+ * PyPI release index for dependency_check, from the JSON API
+ * (`GET pypi.org/pypi/<name>/json`): every release with its upload time and
+ * whether it is yanked.
+ *
+ * - A release's publish time is its EARLIEST file upload (later wheels for
+ *   new platforms do not make it newer).
+ * - A release is yanked when every one of its files is (PEP 592); pip then
+ *   skips it unless pinned with `==`.
+ * - A release with no files cannot be installed and is left out.
+ * - Versions are PEP 440 and are kept as the registry spells them.
+ *
+ * Not read, and reported as not applicable by the signals: publisher identity
+ * (the JSON API carries none), install-time hooks (PyPI exposes none in its
+ * index; an sdist-only release runs its build backend at install), and
+ * per-release dependency lists (one request per release).
+ *
+ * Privacy: the request names the package and nothing else.
+ */
+import type { LiveCache } from "./cache.js";
+import type { RateLimiter } from "./rate-limiter.js";
+import type { PackageReleaseIndex, RegistryLookup, ReleaseMetadataSource } from "./release-metadata.js";
+interface PyPIFile {
+    upload_time_iso_8601?: string;
+    yanked?: boolean;
+    yanked_reason?: string | null;
+}
+interface PyPIProject {
+    info?: {
+        name?: string;
+    };
+    releases?: Record<string, PyPIFile[] | null>;
+}
+export declare const PYPI_NOT_APPLICABLE = "not applicable on PyPI: its JSON API carries no publisher identity or install-hook metadata";
+/** The index the signals read, from one JSON API document. */
+export declare function projectPypiProject(name: string, doc: PyPIProject): PackageReleaseIndex;
+export declare class PypiReleasesReader implements ReleaseMetadataSource {
+    private cache;
+    private rateLimiter;
+    constructor(cache: LiveCache, rateLimiter: RateLimiter);
+    getReleases(name: string): Promise<RegistryLookup<PackageReleaseIndex>>;
+    getCreatedAt(name: string): Promise<RegistryLookup<string | null>>;
+}
+export {};

package/dist/live/pypi-releases.js

@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * PyPI release index for dependency_check, from the JSON API
+ * (`GET pypi.org/pypi/<name>/json`): every release with its upload time and
+ * whether it is yanked.
+ *
+ * - A release's publish time is its EARLIEST file upload (later wheels for
+ *   new platforms do not make it newer).
+ * - A release is yanked when every one of its files is (PEP 592); pip then
+ *   skips it unless pinned with `==`.
+ * - A release with no files cannot be installed and is left out.
+ * - Versions are PEP 440 and are kept as the registry spells them.
+ *
+ * Not read, and reported as not applicable by the signals: publisher identity
+ * (the JSON API carries none), install-time hooks (PyPI exposes none in its
+ * index; an sdist-only release runs its build backend at install), and
+ * per-release dependency lists (one request per release).
+ *
+ * Privacy: the request names the package and nothing else.
+ */
+import { fetchWithTimeout } from "./http-utils.js";
+import { parsePep440 } from "./version-compare.js";
+import { normalizePypiName } from "./upgrade-pypi.js";
+const PYPI_URL = "https://pypi.org/pypi";
+const TIMEOUT_MS = 30_000;
+const TTL_SECONDS = 3600;
+export const PYPI_NOT_APPLICABLE = "not applicable on PyPI: its JSON API carries no publisher identity or install-hook metadata";
+/** The index the signals read, from one JSON API document. */
+export function projectPypiProject(name, doc) {
+    const releases = {};
+    let createdAt = null;
+    for (const [version, rawFiles] of Object.entries(doc.releases ?? {})) {
+        const files = Array.isArray(rawFiles) ? rawFiles : [];
+        if (files.length === 0 || !parsePep440(version))
+            continue;
+        const times = files.map((f) => f.upload_time_iso_8601).filter((t) => typeof t === "string").sort();
+        const publishedAt = times[0] ?? null;
+        if (publishedAt && (!createdAt || publishedAt < createdAt))
+            createdAt = publishedAt;
+        const yanked = files.every((f) => f.yanked === true);
+        const reason = yanked ? files.find((f) => f.yanked_reason)?.yanked_reason ?? null : null;
+        releases[version] = {
+            version,
+            publishedAt,
+            trust: 0,
+            trustEvidence: PYPI_NOT_APPLICABLE,
+            installScripts: null,
+            deprecated: reason ? `yanked: ${reason}` : null,
+            withdrawn: yanked ? "yanked" : null,
+            dependencies: null,
+        };
+    }
+    return { ecosystem: "PyPI", name: doc.info?.name ?? name, createdAt, releases };
+}
+export class PypiReleasesReader {
+    cache;
+    rateLimiter;
+    constructor(cache, rateLimiter) {
+        this.cache = cache;
+        this.rateLimiter = rateLimiter;
+    }
+    async getReleases(name) {
+        const normalized = normalizePypiName(name);
+        const key = `pypi-releases:${normalized}`;
+        const hit = this.cache.get(key);
+        if (hit)
+            return { status: "ok", data: hit };
+        if (!this.rateLimiter.consume("pypi")) {
+            return { status: "unreachable", detail: "PyPI rate limit reached for this minute" };
+        }
+        let response;
+        try {
+            response = await fetchWithTimeout(`${PYPI_URL}/${encodeURIComponent(normalized)}/json`, { headers: { Accept: "application/json" } }, TIMEOUT_MS);
+        }
+        catch (err) {
+            return { status: "unreachable", detail: `PyPI: ${errorText(err)}` };
+        }
+        if (response.status === 404)
+            return { status: "not_found", detail: `"${name}" is not on PyPI` };
+        if (!response.ok)
+            return { status: "unreachable", detail: `PyPI answered HTTP ${response.status}` };
+        let doc;
+        try {
+            doc = (await response.json());
+        }
+        catch (err) {
+            return { status: "unreachable", detail: `PyPI: unreadable project document (${errorText(err)})` };
+        }
+        if (!doc.releases || typeof doc.releases !== "object") {
+            return { status: "unreachable", detail: `PyPI returned no release list for ${name}` };
+        }
+        const index = projectPypiProject(name, doc);
+        this.cache.set(key, index, "pypi", TTL_SECONDS);
+        return { status: "ok", data: index };
+    }
+    async getCreatedAt(name) {
+        const lookup = await this.getReleases(name);
+        return lookup.status === "ok" ? { status: "ok", data: lookup.data.createdAt } : lookup;
+    }
+}
+function errorText(err) {
+    return err instanceof Error ? err.message : String(err);
+}

package/dist/live/release-metadata.d.ts

@@ -1,5 +1,5 @@
 /**
- * Per-release registry metadata, normalised across npm and crates.io.
+ * Per-release registry metadata, normalised across npm, crates.io, PyPI and Go.
  *
  * `dependency_check` judges ONE proposed version against the one installed
  * (or, for a new dependency, against the previous release on the same line).
@@ -9,8 +9,11 @@
  * raw responses into this shape so the signal logic never sees a registry's
  * wire format.
  *
- * Privacy: every request behind this shape carries the package NAME only.
- * Versions are selected locally from the full release list.
+ * Privacy: every npm, crates.io and PyPI request behind this shape carries
+ * the package NAME only; versions are selected locally from the full release
+ * list. The Go module proxy lists versions without dates, so a Go release's
+ * date is read from its own `/@v/<version>.info` (the proxy `go get` itself
+ * downloads from), for the versions being judged only.
  */
 /**
  * Publish trust of one release.
@@ -27,17 +30,23 @@ export interface ReleaseRecord {
     trust: TrustLevel;
     /** Human label for the trust evidence, e.g. "trusted publisher (github)". */
     trustEvidence: string;
-    /** npm: install-time lifecycle scripts declared (preinstall/install/postinstall, or a gypfile). Null for crates. */
+    /** npm: install-time lifecycle scripts declared (preinstall/install/postinstall, or a gypfile). Null elsewhere. */
     installScripts: string[] | null;
     /** npm deprecation message, or null. */
     deprecated: string | null;
-    /** crates.io: yanked. npm: unpublished (listed in `time` but gone from `versions`). */
-    withdrawn: "yanked" | "unpublished" | null;
-    /** Runtime dependency NAMES (npm dependencies + optionalDependencies; crates normal + build). Null when unknown. */
+    /**
+     * crates.io / PyPI: yanked (PyPI: every file of the release). npm: unpublished
+     * (listed in `time` but gone from `versions`). Go: retracted by a `retract`
+     * directive in the module's latest go.mod.
+     */
+    withdrawn: "yanked" | "unpublished" | "retracted" | null;
+    /** Runtime dependency NAMES (npm dependencies + optionalDependencies; crates normal + build). Null when unknown or not read (PyPI, Go). */
     dependencies: string[] | null;
 }
+/** The registries dependency_check reads. */
+export type CheckEcosystem = "npm" | "crates.io" | "PyPI" | "Go";
 export interface PackageReleaseIndex {
-    ecosystem: "npm" | "crates.io";
+    ecosystem: CheckEcosystem;
     name: string;
     /** When the package itself was first published, or null. */
     createdAt: string | null;

package/dist/live/release-metadata.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Per-release registry metadata, normalised across npm and crates.io.
+ * Per-release registry metadata, normalised across npm, crates.io, PyPI and Go.
  *
  * `dependency_check` judges ONE proposed version against the one installed
  * (or, for a new dependency, against the previous release on the same line).
@@ -10,7 +10,10 @@
  * raw responses into this shape so the signal logic never sees a registry's
  * wire format.
  *
- * Privacy: every request behind this shape carries the package NAME only.
- * Versions are selected locally from the full release list.
+ * Privacy: every npm, crates.io and PyPI request behind this shape carries
+ * the package NAME only; versions are selected locally from the full release
+ * list. The Go module proxy lists versions without dates, so a Go release's
+ * date is read from its own `/@v/<version>.info` (the proxy `go get` itself
+ * downloads from), for the versions being judged only.
  */
 export {};

package/dist/live/upgrade-go.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Go modules for `upgrade_impact`, from the module proxy (proxy.golang.org):
+ * `/@v/list` for the tagged versions, `/@v/<version>.info` for a release's
+ * time and VCS origin, and `/@v/<version>.zip` as the archive a changelog is
+ * read from (the zip holds the module's files under `<module>@<version>/`).
+ *
+ * Major versions 2 and up are DIFFERENT modules: `github.com/jackc/pgx/v5`
+ * is not a newer release of `github.com/jackc/pgx/v4`, and the proxy lists
+ * each path's own versions only. `goMajorPath` gives the path a major lives
+ * at, so an upgrade across majors is read from the target module and the
+ * report can say that every import path changes.
+ *
+ * `.info` carries `Origin` (VCS URL, the tag's ref, the module's subdirectory
+ * in a multi-module repository) for versions the proxy fetched recently.
+ * That, not a guess from the import path, names the GitHub repository and tag
+ * for the opt-in release-notes fallback: `go.uber.org/zap` lives at
+ * github.com/uber-go/zap, and aws-sdk-go-v2's `service/s3` tags its releases
+ * `service/s3/v1.50.0`.
+ */
+import type { PublishedVersion, RegistryIndex, UpgradeNet } from "./upgrade-sources.js";
+/** A module path: a dotted host, then path elements (case kept; the proxy escapes capitals). */
+export declare const GO_MODULE: RegExp;
+/** Proxy escaping: each capital letter becomes `!` + lowercase. */
+export declare function escapeGoPath(path: string): string;
+export interface GoInfo {
+    Version?: string;
+    Time?: string;
+    Origin?: {
+        VCS?: string;
+        URL?: string;
+        Subdir?: string;
+        Ref?: string;
+    };
+}
+/** The major version a module path carries: `/v5` -> 5, `gopkg.in/yaml.v3` -> 3, none -> null (0 or 1). */
+export declare function goPathMajor(path: string): number | null;
+/** The module path without its major suffix. */
+export declare function goBasePath(path: string): string;
+/** The path major `major` lives at: none for 0 and 1, `/vN` (or gopkg.in's `.vN`) from 2. */
+export declare function goMajorPath(path: string, major: number): string;
+export declare function goVersionMajor(version: string): number | null;
+/** GitHub repository from a module path: `github.com/<owner>/<repo>/...`. */
+export declare function githubRepoOfGoPath(path: string): string | null;
+export declare function goInfo(net: UpgradeNet, module: string, version: string): Promise<GoInfo | null>;
+export declare function loadGoIndex(net: UpgradeNet, module: string): Promise<RegistryIndex | null>;
+/**
+ * Publish times for the versions an upgrade crosses (newest first, at most
+ * MAX_INFO_READS), and the target's VCS origin. Missing `.info` leaves a null date.
+ */
+export declare function enrichGoVersions(net: UpgradeNet, module: string, versions: PublishedVersion[], target: PublishedVersion | null, budget?: number): Promise<{
+    origin: GoInfo["Origin"] | null;
+}>;
+/**
+ * The tag prefix a module's releases carry: `service/s3` for
+ * `refs/tags/service/s3/v1.50.0`, "" for a module at the repository root.
+ * From the proxy's recorded ref when there is one; otherwise from a
+ * github.com path (the elements after owner/repo, minus a `/vN` suffix,
+ * which a major-version subdirectory does not put in its tags).
+ */
+export declare function goTagPrefix(module: string, version: string, origin: GoInfo["Origin"] | null): string;
+/** The proxy's zip of one module version. */
+export declare function goZipUrl(module: string, version: string): string;