@opengsd/gsd-core 1.3.1 → 1.4.0-rc.1

package/gsd-core/bin/lib/core.cjs

@@ -506,6 +506,7 @@ function loadConfig(cwd, options = {}) {
             effort: (parsed['effort']) || null,
             fast_mode: (parsed['fast_mode']) || null,
             agent_skills: (parsed['agent_skills']) || {},
+            agent_skills_security: (parsed['agent_skills_security']) || null,
             manager: (parsed['manager']) || {},
             response_language: get('response_language') || null,
             claude_md_path: get('claude_md_path') || null,
@@ -994,35 +995,38 @@ function extractCurrentMilestone(content, cwd) {
     const firstMatch = allMatches[0];
     const selected = allMatches.find((m) => !isClosed(m[1])) || firstMatch;
     const sectionStart = selected.index;
-    const sectionMatch = selected;
-    const headingLevel = (sectionMatch[1].match(/^(#{1,3})\s/) ?? ['', '#'])[1].length;
-    const restContent = content.slice(sectionStart + sectionMatch[0].length);
-    const nextMilestonePattern = new RegExp(`^#{1,${headingLevel}}\\s+(?!Phase\\s+\\S)(?:.*v\\d+\\.\\d+|✅|📋|🚧)`, 'i');
-    let sectionEnd = content.length;
-    let fenceChar = null;
-    let fenceLen = 0;
-    let charOffset = 0;
-    for (const line of restContent.split('\n')) {
-        const fenceMatch = line.match(/^\s{0,3}((?:`{3,}|~{3,}))(.*)/);
-        if (fenceMatch) {
-            const char = fenceMatch[1][0];
-            const len = fenceMatch[1].length;
-            const trailing = fenceMatch[2] || '';
-            if (!fenceChar) {
-                fenceChar = char;
-                fenceLen = len;
+    const computeSectionEnd = (headingText, headingStart) => {
+        const level = (headingText.match(/^(#{1,3})\s/) ?? ['', '#'])[1].length;
+        const rest = content.slice(headingStart + headingText.length);
+        const stopPattern = new RegExp(`^#{1,${level}}\\s+(?!Phase\\s+\\S)(?:.*v\\d+\\.\\d+|✅|📋|🚧)`, 'i');
+        let end = content.length;
+        let fc = null;
+        let fl = 0;
+        let off = 0;
+        for (const line of rest.split('\n')) {
+            const fm = line.match(/^\s{0,3}((?:`{3,}|~{3,}))(.*)/);
+            if (fm) {
+                const ch = fm[1][0];
+                const ln = fm[1].length;
+                const trailing = fm[2] || '';
+                if (!fc) {
+                    fc = ch;
+                    fl = ln;
+                }
+                else if (ch === fc && ln >= fl && /^\s*$/.test(trailing)) {
+                    fc = null;
+                    fl = 0;
+                }
             }
-            else if (char === fenceChar && len >= fenceLen && /^\s*$/.test(trailing)) {
-                fenceChar = null;
-                fenceLen = 0;
+            else if (!fc && stopPattern.test(line)) {
+                end = headingStart + headingText.length + off;
+                break;
             }
+            off += line.length + 1;
         }
-        else if (!fenceChar && nextMilestonePattern.test(line)) {
-            sectionEnd = sectionStart + sectionMatch[0].length + charOffset;
-            break;
-        }
-        charOffset += line.length + 1;
-    }
+        return end;
+    };
+    const sectionEnd = computeSectionEnd(selected[0], sectionStart);
     const anyMilestonePattern = /^#{1,3}\s+(?!Phase\s+\S)(?:.*v\d+\.\d+|✅|📋|🚧)/im;
     const firstMilestoneMatch = content.match(anyMilestonePattern);
     const preambleCutoff = firstMilestoneMatch
@@ -1030,11 +1034,36 @@ function extractCurrentMilestone(content, cwd) {
         : firstMatch.index;
     const beforeMilestones = content.slice(0, preambleCutoff);
     const currentSection = content.slice(sectionStart, sectionEnd);
+    // Multi-milestone roadmaps split each added milestone across two version-bearing
+    // headings: a `## Phases` checklist subsection (early) and a dedicated
+    // `## Milestone … (Phase Details)` section (late) holding the `### Phase N:`
+    // detail headers. The scope window above stops at the next version-bearing
+    // heading — the current milestone's OWN Phase Details heading — leaving those
+    // detail headers outside `currentSection`. Append that section so phase
+    // resolution and counting see the current milestone's phases. Anchor the lookup
+    // to the SELECTED heading's specific version token (boundary-aware, so a
+    // `v3.0` state does not match a `v3.0-A` sub-milestone) so sibling milestones
+    // that share a version prefix do not cross-pollinate. (#730)
+    const selectedVersionToken = selected[1].match(/v\d+(?:\.\d+)+(?:[-.][A-Za-z0-9]+)*/i)?.[0];
+    const detailsVersionBoundary = selectedVersionToken
+        ? new RegExp(`${escapeRegex(selectedVersionToken)}(?![\\w.-])`, 'i')
+        : null;
+    let detailsSection = '';
+    const detailsMatch = allMatches.find((m) => /\(Phase\s+Details\)/i.test(m[1]) &&
+        !isClosed(m[1]) &&
+        (!detailsVersionBoundary || detailsVersionBoundary.test(m[1])) &&
+        (m.index ?? 0) >= sectionEnd);
+    if (detailsMatch) {
+        const detailsStart = detailsMatch.index ?? 0;
+        detailsSection = content.slice(detailsStart, computeSectionEnd(detailsMatch[0], detailsStart));
+    }
     const preamble = beforeMilestones
         .replace(/<details>[\s\S]*?<\/details>/gi, '')
         .replace(/^#{2,4}\s*Phase\s+[\w][\w.-]*\s*:[^\n]*(?:\n(?!#{1,6}\s)[^\n]*)*\n?/gim, '')
         .replace(/^#{1,4}\s*Phase Details\b[^\n]*\n?/gim, '');
-    return preamble + currentSection;
+    return detailsSection
+        ? preamble + currentSection + '\n' + detailsSection
+        : preamble + currentSection;
 }
 /**
  * Replace a pattern only in the current milestone section of ROADMAP.md.
@@ -1399,7 +1428,12 @@ const VALID_GRANULARITIES = new Set(['coarse', 'standard', 'fine']);
 /**
  * Resolve the planning granularity for a phase type (#68).
  */
-function resolveGranularityInternal(cwd, phaseType) {
+function resolveGranularityInternal(cwd, phaseType, override) {
+    if (override !== undefined && override !== null && override !== '') {
+        if (VALID_GRANULARITIES.has(override)) {
+            return override;
+        }
+    }
     const config = loadConfig(cwd);
     const configGranularities = config['granularities'];
     const perPhase = (phaseType && configGranularities && typeof configGranularities === 'object')
@@ -1418,6 +1452,15 @@ function resolveGranularityInternal(cwd, phaseType) {
     }
     return 'standard';
 }
+/**
+ * Validate a CLI granularity override at the command boundary. Empty/null/undefined
+ * are treated as "no override" (no-op). An invalid non-empty value calls `fail`.
+ */
+function assertValidGranularityOverride(override, fail) {
+    if (override !== undefined && override !== null && override !== '' && !VALID_GRANULARITIES.has(override)) {
+        fail(`invalid granularity '${override}' (valid: ${[...VALID_GRANULARITIES].join(', ')})`);
+    }
+}
 /**
  * #3024 — Resolve a model for a specific dynamic-routing attempt.
  */
@@ -1956,6 +1999,7 @@ module.exports = {
     resolveModelForTier,
     resolveGranularityInternal,
     VALID_GRANULARITIES,
+    assertValidGranularityOverride,
     resolveEffortInternal,
     resolveFastModeInternal,
     resolveEffortForTier,

package/gsd-core/bin/lib/graphify.cjs

@@ -35,7 +35,7 @@ function isGraphifyEnabled(planningDir) {
             return true;
         return false;
     }
-    catch (_e) {
+    catch {
         return false;
     }
 }
@@ -157,7 +157,7 @@ function safeReadJson(filePath) {
             return null;
         return JSON.parse(node_fs_1.default.readFileSync(filePath, 'utf8'));
     }
-    catch (_e) {
+    catch {
         return null;
     }
 }

package/gsd-core/bin/lib/init-command-router.cjs

@@ -34,8 +34,8 @@ function routeInitCommand({ init, args, cwd, raw, error }) {
                 init.cmdInitExecutePhase(cwd, args[2], raw, { validate: namedArgs['validate'], tdd: namedArgs['tdd'] });
             },
             'plan-phase': () => {
-                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, [], ['validate', 'tdd']);
-                init.cmdInitPlanPhase(cwd, args[2], raw, { validate: namedArgs['validate'], tdd: namedArgs['tdd'] });
+                const namedArgs = (0, command_arg_projection_cjs_1.parseNamedArgs)(args, ['granularity'], ['validate', 'tdd']);
+                init.cmdInitPlanPhase(cwd, args[2], raw, { validate: namedArgs['validate'], tdd: namedArgs['tdd'], granularity: namedArgs['granularity'] });
             },
             'new-project': () => init.cmdInitNewProject(cwd, raw),
             'new-milestone': () => init.cmdInitNewMilestone(cwd, raw),

package/gsd-core/bin/lib/init.cjs

@@ -28,7 +28,7 @@ const security_cjs_1 = require("./security.cjs");
 const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- frontmatter.cjs is an export= CommonJS module
 const frontmatterMod = require("./frontmatter.cjs");
-const { loadConfig, resolveModelInternal, findPhaseInternal, getRoadmapPhaseInternal, pathExistsInternal, gitWorktreeInfoInternal, generateSlugInternal, getMilestoneInfo, getMilestonePhaseFilter, stripShippedMilestones, extractCurrentMilestone, normalizePhaseName, toPosixPath, output, error, checkAgentsInstalled, phaseTokenMatches, } = core;
+const { loadConfig, resolveModelInternal, resolveGranularityInternal, assertValidGranularityOverride, findPhaseInternal, getRoadmapPhaseInternal, pathExistsInternal, gitWorktreeInfoInternal, generateSlugInternal, getMilestoneInfo, getMilestonePhaseFilter, stripShippedMilestones, extractCurrentMilestone, normalizePhaseName, toPosixPath, output, error, checkAgentsInstalled, phaseTokenMatches, } = core;
 const { planningPaths, planningDir, planningRoot, findContextMdIn, } = planningWorkspace;
 const { determinePhaseStatus } = commandsMod;
 const { extractFrontmatter } = frontmatterMod;
@@ -297,11 +297,15 @@ function cmdInitPlanPhase(cwd, phase, raw, options = {}) {
             expectedPhaseDirPlan = toPosixPath(node_path_1.default.relative(cwd, node_path_1.default.join(planningPaths(cwd).phases, dirName)));
         }
     }
+    const granularityOverride = options['granularity'];
+    assertValidGranularityOverride(granularityOverride, error);
+    const granularity = resolveGranularityInternal(cwd, 'planning', granularityOverride || undefined);
     const result = {
         researcher_model: resolveModelInternal(cwd, 'gsd-phase-researcher'),
         planner_model: resolveModelInternal(cwd, 'gsd-planner'),
         checker_model: resolveModelInternal(cwd, 'gsd-plan-checker'),
         tdd_mode: options['tdd'] || config.tdd_mode || false,
+        granularity,
         research_enabled: config.research,
         plan_checker_enabled: config.plan_checker,
         nyquist_validation_enabled: config.nyquist_validation,
@@ -1521,6 +1525,11 @@ function buildAgentSkillsBlock(config, agentType, projectRoot) {
         skillPaths = [skillPaths];
     if (!Array.isArray(skillPaths) || skillPaths.length === 0)
         return '';
+    // Hoist trusted roots computation before the loop: loadTrustedGlobalRoots does
+    // realpathSync I/O and should run at most once per call, not once per failing skill.
+    // It returns [] cheaply when no roots are configured, so the realpath cost only
+    // occurs when the caller has actually set trusted_global_roots.
+    const trustedGlobalRoots = (0, security_cjs_1.loadTrustedGlobalRoots)(config);
     const validPaths = [];
     for (const skillPath of skillPaths) {
         if (typeof skillPath !== 'string')
@@ -1548,8 +1557,15 @@ function buildAgentSkillsBlock(config, agentType, projectRoot) {
             }
             const pathCheck = (0, security_cjs_1.validatePath)(globalSkillMd, globalSkillsBase, { allowAbsolute: true });
             if (!pathCheck['safe']) {
-                process.stderr.write(`[agent-skills] WARNING: Global skill "${skillName}" failed path check (symlink escape?) — skipping\n`);
-                continue;
+                const acceptedViaTrustedRoot = trustedGlobalRoots.some((root) => {
+                    const rootCheck = (0, security_cjs_1.validatePath)(globalSkillMd, root, { allowAbsolute: true });
+                    return Boolean(rootCheck['safe']);
+                });
+                if (!acceptedViaTrustedRoot) {
+                    process.stderr.write(`[agent-skills] WARNING: Global skill "${skillName}" failed path check (symlink escape?) — skipping\n`);
+                    continue;
+                }
+                process.stderr.write(`[agent-skills] NOTE: Global skill "${skillName}" accepted via trusted_global_roots (resolves outside the default skills dir)\n`);
             }
             validPaths.push({ ref: `${globalSkillDir}/SKILL.md`, display: displayPath });
             continue;

package/gsd-core/bin/lib/intel.cjs

@@ -59,7 +59,7 @@ function isIntelEnabled(planningDir) {
             return true;
         return false;
     }
-    catch (_e) {
+    catch {
         return false;
     }
 }
@@ -86,7 +86,7 @@ function safeReadJson(filePath) {
             return null;
         return JSON.parse(raw);
     }
-    catch (_e) {
+    catch {
         return null;
     }
 }
@@ -101,7 +101,7 @@ function hashFile(filePath) {
             return null;
         return node_crypto_1.default.createHash('sha256').update(content).digest('hex');
     }
-    catch (_e) {
+    catch {
         return null;
     }
 }
@@ -147,23 +147,6 @@ function matchesInValue(value, lowerTerm) {
     }
     return false;
 }
-/**
- * Search for a term in arch.md text content.
- * Returns matching lines.
- */
-function searchArchMd(filePath, term) {
-    try {
-        const content = (0, shell_command_projection_cjs_1.platformReadSync)(filePath);
-        if (content === null)
-            return [];
-        const lowerTerm = term.toLowerCase();
-        const lines = content.split(/\r?\n/);
-        return lines.filter(line => line.toLowerCase().includes(lowerTerm));
-    }
-    catch (_e) {
-        return [];
-    }
-}
 /**
  * Query intel files for a search term.
  * Searches across all JSON intel files (keys and values) and arch.md (text lines).

package/gsd-core/bin/lib/package-legitimacy.cjs

@@ -0,0 +1,368 @@
+"use strict";
+/**
+ * Package Legitimacy Module
+ *
+ * Replaces the bolt-on prose slopcheck gate (which pip-installed `slopcheck`
+ * and degraded ALL packages to [ASSUMED] when pip failed) with registry-API
+ * verdicts computed in code.
+ *
+ * Public interface:
+ *   DEFAULT_THRESHOLDS  — baseline thresholds
+ *   classifyPackage     — pure function: signals → { verdict, reasons }
+ *   checkPackages       — async: resolves registry signals and classifies
+ *   _setHttpGet         — test seam: override the HTTP transport (pass null to restore)
+ *
+ * All network IO is injected via a `registry` client option so that tests
+ * never touch the real network (same seam pattern as clock injection).
+ *
+ * ADR-457 build-at-publish: authored as TypeScript .cts → emits .cjs via tsc.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+const https = __importStar(require("node:https"));
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const DEFAULT_THRESHOLDS = {
+    minAgeDays: 30,
+    minWeeklyDownloads: 1000,
+    requireRepo: true,
+};
+// Matches common dangerous postinstall execution patterns.
+// Deliberately EXCLUDES bare https?:// (over-fires on legit packages like
+// esbuild/sharp/node-gyp that reference download URLs without executing them).
+// Shell-execution / download-and-exec signatures only:
+const SUSPICIOUS_POSTINSTALL_RE = /(curl |wget |\|\s*(ba)?sh|bash -c|sh -c|node -e|eval|base64 -d|\/etc\/|\.\.\/|~\/|nc |>\s*\/)/i;
+// ---------------------------------------------------------------------------
+// Severity ordering for verdict merging (SLOP > SUS > OK)
+// ---------------------------------------------------------------------------
+const SEVERITY = { OK: 0, SUS: 1, SLOP: 2 };
+function moreSevereVerdict(a, b) {
+    return SEVERITY[a] >= SEVERITY[b] ? a : b;
+}
+// ---------------------------------------------------------------------------
+// classifyPackage — pure, no IO
+// ---------------------------------------------------------------------------
+function classifyPackage(signals, { thresholds = DEFAULT_THRESHOLDS, clock = Date } = {}) {
+    const reasons = [];
+    // Terminal: package does not exist
+    if (signals.exists === false) {
+        return { verdict: 'SLOP', reasons: ['does-not-exist'] };
+    }
+    // Age check
+    if (signals.publishedAt == null) {
+        reasons.push('unknown-age');
+    }
+    else {
+        const parsed = Date.parse(String(signals.publishedAt));
+        if (!Number.isFinite(parsed)) {
+            // Unparseable date — treat as unknown
+            reasons.push('unknown-age');
+        }
+        else {
+            const ageDays = Math.floor((clock.now() - parsed) / 86_400_000);
+            if (ageDays < thresholds.minAgeDays) {
+                reasons.push('too-new');
+            }
+        }
+    }
+    // Downloads check
+    const downloads = signals.weeklyDownloads;
+    if (downloads == null) {
+        reasons.push('unknown-downloads');
+    }
+    else if (typeof downloads !== 'number' || !Number.isFinite(downloads)) {
+        // Odd type / NaN — treat as unknown
+        reasons.push('unknown-downloads');
+    }
+    else if (downloads < thresholds.minWeeklyDownloads) {
+        reasons.push('low-downloads');
+    }
+    // Repository check
+    if (thresholds.requireRepo && !signals.repoUrl) {
+        reasons.push('no-repository');
+    }
+    // Deprecated check
+    if (signals.deprecated === true) {
+        reasons.push('deprecated');
+    }
+    // Suspicious postinstall (npm only — but apply whenever postinstall is present)
+    if (signals.postinstall != null && typeof signals.postinstall === 'string') {
+        if (SUSPICIOUS_POSTINSTALL_RE.test(signals.postinstall)) {
+            reasons.push('suspicious-postinstall');
+        }
+    }
+    // Terminal: suspicious postinstall is a slopsquatting execution risk
+    if (reasons.includes('suspicious-postinstall')) {
+        return { verdict: 'SLOP', reasons };
+    }
+    const verdict = reasons.length > 0 ? 'SUS' : 'OK';
+    return { verdict, reasons };
+}
+// ---------------------------------------------------------------------------
+// Injectable HTTP transport (test seam — W1)
+// ---------------------------------------------------------------------------
+/** The real HTTPS transport — resolves { statusCode, body } */
+function realHttpsGet(url, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const req = https.get(url, { headers: { 'User-Agent': 'gsd-core-package-legitimacy/1.0' } }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => resolve({
+                statusCode: res.statusCode ?? 0,
+                body: Buffer.concat(chunks).toString('utf8'),
+            }));
+            res.on('error', reject);
+        });
+        req.setTimeout(timeoutMs, () => {
+            req.destroy(new Error(`timeout after ${timeoutMs}ms`));
+        });
+        req.on('error', reject);
+    });
+}
+/** Module-level transport pointer — overrideable via _setHttpGet for tests */
+let httpsGet = realHttpsGet;
+/**
+ * Test seam: replace the HTTP transport. Pass null to restore the real transport.
+ * Tests call this before exercising a real-adapter code path; always restore in finally.
+ */
+function _setHttpGet(fn) {
+    httpsGet = fn ?? realHttpsGet;
+}
+// ---------------------------------------------------------------------------
+// Real registry adapters (not exercised by tests — tests inject fakes)
+// ---------------------------------------------------------------------------
+function degradedSignals() {
+    return {
+        exists: null,
+        publishedAt: null,
+        weeklyDownloads: null,
+        repoUrl: null,
+        deprecated: false,
+        postinstall: null,
+    };
+}
+async function lookupNpm(name, version) {
+    try {
+        const resp = await httpsGet(`https://registry.npmjs.org/${encodeURIComponent(name)}`, 5000);
+        if (resp.statusCode === 404)
+            return { ...degradedSignals(), exists: false };
+        if (resp.statusCode < 200 || resp.statusCode >= 300)
+            return degradedSignals();
+        const data = JSON.parse(resp.body);
+        if (data.error)
+            return { ...degradedSignals(), exists: false };
+        const time = data.time ?? {};
+        const allVersions = data.versions ?? {};
+        // I3: when a specific version is requested, verify it exists
+        if (version !== undefined) {
+            if (!(version in allVersions)) {
+                return { ...degradedSignals(), exists: false };
+            }
+        }
+        const latestVersion = data['dist-tags']?.latest ?? '';
+        const resolvedVersion = version !== undefined ? version : latestVersion;
+        const versionMeta = allVersions[resolvedVersion] ?? {};
+        const scripts = versionMeta.scripts ??
+            {};
+        const postinstall = scripts.postinstall ?? null;
+        const repoField = versionMeta.repository;
+        let repoUrl = null;
+        if (typeof repoField === 'string')
+            repoUrl = repoField;
+        else if (repoField && typeof repoField.url === 'string') {
+            repoUrl = repoField.url;
+        }
+        const deprecated = typeof versionMeta.deprecated === 'string' ? true : false;
+        // Fetch weekly download count from the npm downloads API
+        let weeklyDownloads = null;
+        try {
+            const dlResp = await httpsGet(`https://api.npmjs.org/downloads/point/last-week/${encodeURIComponent(name)}`, 5000);
+            if (dlResp.statusCode >= 200 && dlResp.statusCode < 300) {
+                const dlData = JSON.parse(dlResp.body);
+                if (typeof dlData.downloads === 'number') {
+                    weeklyDownloads = dlData.downloads;
+                }
+            }
+        }
+        catch {
+            // Degraded: leave weeklyDownloads as null, never throw
+        }
+        return {
+            exists: true,
+            publishedAt: time[resolvedVersion] ?? time.created ?? null,
+            weeklyDownloads,
+            repoUrl,
+            deprecated,
+            postinstall,
+            ecosystem: 'npm',
+        };
+    }
+    catch {
+        return degradedSignals();
+    }
+}
+async function lookupPypi(name, version) {
+    try {
+        const resp = await httpsGet(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`, 5000);
+        if (resp.statusCode === 404)
+            return { ...degradedSignals(), exists: false };
+        if (resp.statusCode < 200 || resp.statusCode >= 300)
+            return degradedSignals();
+        const data = JSON.parse(resp.body);
+        const info = data.info ?? {};
+        // I3: when a specific version is requested, verify it exists in releases
+        const releases = data.releases ?? {};
+        if (version !== undefined) {
+            if (!(version in releases)) {
+                return { ...degradedSignals(), exists: false };
+            }
+        }
+        // Finding 2: when version is provided, derive publishedAt from the
+        // version-specific release record rather than the package-level urls[] array
+        // (which reflects the latest release, not the requested version).
+        let uploadTime = null;
+        if (version !== undefined) {
+            const versionFiles = releases[version] ?? [];
+            uploadTime =
+                versionFiles.length > 0
+                    ? versionFiles[0].upload_time_iso_8601 ?? null
+                    : null;
+        }
+        else {
+            const urls = data.urls ?? [];
+            uploadTime =
+                urls.length > 0 ? urls[0].upload_time_iso_8601 ?? null : null;
+        }
+        const projectUrls = info.project_urls;
+        const repoUrl = projectUrls?.['Source'] ??
+            projectUrls?.['Homepage'] ??
+            info.home_page ??
+            null;
+        return {
+            exists: true,
+            publishedAt: uploadTime,
+            weeklyDownloads: null, // PyPI weekly downloads require a separate API
+            repoUrl: repoUrl || null,
+            deprecated: false, // PyPI doesn't have a first-class deprecated field
+            postinstall: null, // Not applicable for PyPI
+            ecosystem: 'pypi',
+        };
+    }
+    catch {
+        return degradedSignals();
+    }
+}
+async function lookupCrates(name, version) {
+    try {
+        const resp = await httpsGet(`https://crates.io/api/v1/crates/${encodeURIComponent(name)}`, 5000);
+        if (resp.statusCode === 404)
+            return { ...degradedSignals(), exists: false };
+        if (resp.statusCode < 200 || resp.statusCode >= 300)
+            return degradedSignals();
+        const data = JSON.parse(resp.body);
+        const krate = data.crate ?? {};
+        // I3: when a specific version is requested, verify it exists in versions list
+        const versions = data.versions ?? [];
+        if (version !== undefined) {
+            const found = versions.some((v) => v.num === version);
+            if (!found) {
+                return { ...degradedSignals(), exists: false };
+            }
+        }
+        const repoUrl = krate.repository ?? null;
+        // Finding 2: when version is provided, use the version-specific created_at
+        // rather than the package-level crate.created_at (first-ever publish date).
+        let created;
+        if (version !== undefined) {
+            const versionObj = versions.find((v) => v.num === version);
+            created = versionObj?.created_at ?? null;
+        }
+        else {
+            created = krate.created_at ?? null;
+        }
+        // recent_downloads is a 90-day count; normalize to a weekly figure for comparison
+        // against minWeeklyDownloads (which is a weekly threshold).
+        const rawDownloads = krate.recent_downloads;
+        const downloads = (rawDownloads != null && typeof Number(rawDownloads) === 'number' && !isNaN(Number(rawDownloads)))
+            ? Math.round(Number(rawDownloads) * 7 / 90)
+            : null;
+        return {
+            exists: true,
+            publishedAt: created,
+            weeklyDownloads: downloads,
+            repoUrl,
+            deprecated: false,
+            postinstall: null,
+            ecosystem: 'crates',
+        };
+    }
+    catch {
+        return degradedSignals();
+    }
+}
+const realRegistry = {
+    async lookup(ecosystem, name, version) {
+        switch (ecosystem) {
+            case 'npm':
+                return lookupNpm(name, version);
+            case 'pypi':
+                return lookupPypi(name, version);
+            case 'crates':
+                return lookupCrates(name, version);
+            default:
+                return degradedSignals();
+        }
+    },
+};
+// ---------------------------------------------------------------------------
+// checkPackages — orchestrates lookup + classify + slopcheck merge
+// ---------------------------------------------------------------------------
+async function checkPackages({ ecosystem, packages, version }, { registry = realRegistry, clock = Date, thresholds = DEFAULT_THRESHOLDS, slopcheck = null, } = {}) {
+    const results = [];
+    for (const name of packages) {
+        const signals = await registry.lookup(ecosystem, name, version);
+        const { verdict: registryVerdict, reasons } = classifyPackage(signals, { thresholds, clock });
+        let finalVerdict = registryVerdict;
+        if (slopcheck != null) {
+            const slopVerdict = await slopcheck.check(ecosystem, name);
+            if (slopVerdict != null) {
+                finalVerdict = moreSevereVerdict(finalVerdict, slopVerdict);
+            }
+        }
+        results.push({ name, verdict: finalVerdict, signals, reasons });
+    }
+    return results;
+}
+module.exports = { DEFAULT_THRESHOLDS, classifyPackage, checkPackages, _setHttpGet };