@the-open-engine/zeroshot 6.28.0 → 6.29.1

package/lib/target/target-session.js

@@ -1,162 +1,75 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoginRequiredError = void 0;
+exports.TargetSessionManager = exports.LoginRequiredError = void 0;
 exports.targetLogin = targetLogin;
 exports.refreshAccessToken = refreshAccessToken;
 exports.getAccessTokenProvider = getAccessTokenProvider;
 exports.revokeAndCleanup = revokeAndCleanup;
-const device_flow_ts_1 = require("./device-flow.js");
-const credential_store_ts_1 = require("./credential-store.js");
-const target_registry_ts_1 = require("./target-registry.js");
-class LoginRequiredError extends Error {
-    targetName;
-    constructor(targetName) {
-        super(`Login required. Run: zeroshot target login ${targetName}`);
-        this.name = 'LoginRequiredError';
-        this.targetName = targetName;
-    }
+const target_session_manager_js_1 = require("./target-session-manager.js");
+var target_session_manager_js_2 = require("./target-session-manager.js");
+Object.defineProperty(exports, "LoginRequiredError", { enumerable: true, get: function () { return target_session_manager_js_2.LoginRequiredError; } });
+Object.defineProperty(exports, "TargetSessionManager", { enumerable: true, get: function () { return target_session_manager_js_2.TargetSessionManager; } });
+function transientSettings(targetName, target) {
+    const state = {
+        _targets: { [targetName]: target },
+    };
+    return {
+        load: () => state,
+        mutate: (mutator) => mutator(state),
+    };
 }
-exports.LoginRequiredError = LoginRequiredError;
-async function targetLogin(targetName, target, credentialStore, acquireLock, settings, deps) {
-    const { http, clock, browserOpener, stderr, discoveryEndpoints } = deps;
-    const { deviceAuthorizationEndpoint, tokenEndpoint, clientId } = discoveryEndpoints;
-    const codeResponse = await (0, device_flow_ts_1.requestDeviceCode)(deviceAuthorizationEndpoint, clientId, http);
-    stderr.write(`\nOpen this URL to authorize:\n  ${codeResponse.verification_uri}\n\nEnter code: ${codeResponse.user_code}\n\n`);
-    if (codeResponse.verification_uri_complete) {
-        try {
-            await browserOpener.open(codeResponse.verification_uri_complete);
-        }
-        catch {
-            // Browser open is best-effort
-        }
-    }
-    const tokenResponse = await (0, device_flow_ts_1.pollForToken)(tokenEndpoint, clientId, codeResponse.device_code, codeResponse.interval, codeResponse.expires_in, http, clock);
-    if (!tokenResponse.organization) {
-        throw new device_flow_ts_1.UnboundSessionError(codeResponse.verification_uri);
-    }
-    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
-    const release = await acquireLock();
-    try {
-        await credentialStore.set(serviceKey, credential_store_ts_1.TARGET_ACCOUNT, tokenResponse.refresh_token);
-    }
-    finally {
-        await release();
-    }
-    (0, target_registry_ts_1.updateTargetOrganization)(targetName, tokenResponse.organization, settings);
-    return { organization: tokenResponse.organization };
+function legacyManager(init) {
+    const clock = init.clock ?? init.deps.clock ?? { now: () => Date.now() };
+    return new target_session_manager_js_1.TargetSessionManager({
+        targetName: init.targetName,
+        target: init.target,
+        credentialStore: init.credentialStore,
+        acquireLock: init.acquireLock,
+        settings: init.deps.settings ?? transientSettings(init.targetName, init.target),
+        deps: {
+            http: init.deps.http,
+            clock,
+            browserOpener: { open: () => Promise.resolve() },
+            stderr: { write: () => undefined },
+            discoveryEndpoints: init.deps.discoveryEndpoints,
+        },
+    });
 }
-async function refreshAccessToken(targetName, target, credentialStore, acquireLock, deps) {
-    const { http, discoveryEndpoints } = deps;
-    const { tokenEndpoint, revocationEndpoint, clientId } = discoveryEndpoints;
-    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
-    const release = await acquireLock();
-    try {
-        const currentRefreshToken = await credentialStore.get(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-        if (!currentRefreshToken) {
-            throw new LoginRequiredError(targetName);
-        }
-        const body = new URLSearchParams({
-            grant_type: 'refresh_token',
-            refresh_token: currentRefreshToken,
-            client_id: clientId,
-        });
-        let tokenResponse;
-        const response = await http.fetch(tokenEndpoint, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: body.toString(),
-            redirect: 'error',
-        });
-        if (!response.ok) {
-            const errorBody = (await response.json().catch(() => ({ error: 'unknown' })));
-            if (errorBody.error === 'invalid_grant') {
-                await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-                throw new LoginRequiredError(targetName);
-            }
-            throw new Error(`Token refresh failed (${response.status}): ${errorBody.error}`);
-        }
-        tokenResponse = (await response.json());
-        try {
-            await credentialStore.set(serviceKey, credential_store_ts_1.TARGET_ACCOUNT, tokenResponse.refresh_token);
-        }
-        catch {
-            await bestEffortRevoke(tokenResponse.refresh_token, revocationEndpoint, clientId, http);
-            await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-            throw new LoginRequiredError(targetName);
-        }
-        return { accessToken: tokenResponse.access_token, expiresIn: tokenResponse.expires_in };
-    }
-    finally {
-        await release();
-    }
+function targetLogin(...args) {
+    const [targetName, target, credentialStore, acquireLock, settings, deps] = args;
+    return new target_session_manager_js_1.TargetSessionManager({
+        targetName,
+        target,
+        credentialStore,
+        acquireLock,
+        settings,
+        deps,
+    }).login();
 }
-async function bestEffortRevoke(token, revocationEndpoint, clientId, http) {
-    if (!revocationEndpoint)
-        return;
-    try {
-        const body = new URLSearchParams({
-            token,
-            client_id: clientId,
-            token_type_hint: 'refresh_token',
-        });
-        await http.fetch(revocationEndpoint, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: body.toString(),
-            redirect: 'error',
-        });
-    }
-    catch {
-        // Best-effort
-    }
+async function refreshAccessToken(...args) {
+    const [targetName, target, credentialStore, acquireLock, deps, clock] = args;
+    return legacyManager({
+        targetName,
+        target,
+        credentialStore,
+        acquireLock,
+        deps,
+        ...(clock === undefined ? {} : { clock }),
+    }).getAccessTokenWithLifetime('capsule');
 }
-function getAccessTokenProvider(targetName, target, credentialStore, acquireLock, deps, clock = { now: () => Date.now() }) {
-    let cachedToken = null;
-    let expiresAt = 0;
-    return {
-        async getAccessToken(_signal) {
-            if (cachedToken && clock.now() < expiresAt - 30_000) {
-                return cachedToken;
-            }
-            const result = await refreshAccessToken(targetName, target, credentialStore, acquireLock, deps);
-            cachedToken = result.accessToken;
-            expiresAt = clock.now() + result.expiresIn * 1000;
-            return result.accessToken;
-        },
-    };
+function getAccessTokenProvider(...args) {
+    const [targetName, target, credentialStore, acquireLock, deps, clock] = args;
+    return legacyManager({
+        targetName,
+        target,
+        credentialStore,
+        acquireLock,
+        deps,
+        ...(clock === undefined ? {} : { clock }),
+    }).tokenProvider('capsule');
 }
-async function revokeAndCleanup(target, credentialStore, acquireLock, deps, force) {
-    const { http, discoveryEndpoints } = deps;
-    const { revocationEndpoint, clientId } = discoveryEndpoints;
-    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
-    const release = await acquireLock();
-    try {
-        const refreshToken = await credentialStore.get(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-        if (refreshToken && revocationEndpoint) {
-            const body = new URLSearchParams({
-                token: refreshToken,
-                client_id: clientId,
-                token_type_hint: 'refresh_token',
-            });
-            try {
-                const response = await http.fetch(revocationEndpoint, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                    body: body.toString(),
-                    redirect: 'error',
-                });
-                if (!response.ok && !force) {
-                    throw new Error(`Remote revocation failed (${response.status}). Use --force to remove anyway.`);
-                }
-            }
-            catch (err) {
-                if (!force)
-                    throw err;
-            }
-        }
-        await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-    }
-    finally {
-        await release();
-    }
+function revokeAndCleanup(...args) {
+    const [target, credentialStore, acquireLock, deps, force] = args;
+    const targetName = deps.targetName ?? target.id;
+    return legacyManager({ targetName, target, credentialStore, acquireLock, deps }).revoke(force);
 }

package/lib/target/token-response.cjs

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTokenResponse = parseTokenResponse;
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_RESPONSE_FIELDS = [
+    'access_token',
+    'refresh_token',
+    'token_type',
+    'expires_in',
+    'refresh_expires_in',
+    'scope',
+];
+function boundedString(value, maxBytes) {
+    return typeof value === 'string' && value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes;
+}
+function tokenFieldsValid(token) {
+    const fields = Object.keys(token);
+    return fields.length === TOKEN_RESPONSE_FIELDS.length &&
+        fields.every((key) => TOKEN_RESPONSE_FIELDS.includes(key));
+}
+function tokenLifetimesValid(token) {
+    return Number.isSafeInteger(token.expires_in) &&
+        token.expires_in > 0 &&
+        token.expires_in <= 86_400 &&
+        Number.isSafeInteger(token.refresh_expires_in) &&
+        token.refresh_expires_in > 0 &&
+        token.refresh_expires_in <= 31_536_000;
+}
+function tokenStringsValid(token) {
+    return boundedString(token.access_token, MAX_TOKEN_BYTES) &&
+        boundedString(token.refresh_token, MAX_TOKEN_BYTES) &&
+        token.token_type === 'Bearer' &&
+        boundedString(token.scope, 512) &&
+        !/[\u0000-\u001f\u007f]/.test(token.scope);
+}
+function parseTokenResponse(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Token response is malformed');
+    }
+    const token = value;
+    if (!tokenFieldsValid(token) || !tokenLifetimesValid(token) || !tokenStringsValid(token)) {
+        throw new Error('Token response is malformed');
+    }
+    return Object.freeze({
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        token_type: 'Bearer',
+        expires_in: token.expires_in,
+    });
+}

package/lib/target/token-response.d.cts

@@ -0,0 +1,7 @@
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: 'Bearer';
+    readonly expires_in: number;
+}
+export declare function parseTokenResponse(value: unknown): TokenResponse;

package/lib/target/token-response.d.mts

@@ -0,0 +1,7 @@
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: 'Bearer';
+    readonly expires_in: number;
+}
+export declare function parseTokenResponse(value: unknown): TokenResponse;

package/lib/target/token-response.d.ts

@@ -0,0 +1,7 @@
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: 'Bearer';
+    readonly expires_in: number;
+}
+export declare function parseTokenResponse(value: unknown): TokenResponse;

package/lib/target/token-response.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTokenResponse = parseTokenResponse;
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_RESPONSE_FIELDS = [
+    'access_token',
+    'refresh_token',
+    'token_type',
+    'expires_in',
+    'refresh_expires_in',
+    'scope',
+];
+function boundedString(value, maxBytes) {
+    return typeof value === 'string' && value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes;
+}
+function tokenFieldsValid(token) {
+    const fields = Object.keys(token);
+    return fields.length === TOKEN_RESPONSE_FIELDS.length &&
+        fields.every((key) => TOKEN_RESPONSE_FIELDS.includes(key));
+}
+function tokenLifetimesValid(token) {
+    return Number.isSafeInteger(token.expires_in) &&
+        token.expires_in > 0 &&
+        token.expires_in <= 86_400 &&
+        Number.isSafeInteger(token.refresh_expires_in) &&
+        token.refresh_expires_in > 0 &&
+        token.refresh_expires_in <= 31_536_000;
+}
+function tokenStringsValid(token) {
+    return boundedString(token.access_token, MAX_TOKEN_BYTES) &&
+        boundedString(token.refresh_token, MAX_TOKEN_BYTES) &&
+        token.token_type === 'Bearer' &&
+        boundedString(token.scope, 512) &&
+        !/[\u0000-\u001f\u007f]/.test(token.scope);
+}
+function parseTokenResponse(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Token response is malformed');
+    }
+    const token = value;
+    if (!tokenFieldsValid(token) || !tokenLifetimesValid(token) || !tokenStringsValid(token)) {
+        throw new Error('Token response is malformed');
+    }
+    return Object.freeze({
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        token_type: 'Bearer',
+        expires_in: token.expires_in,
+    });
+}

package/lib/target/token-response.mjs

@@ -0,0 +1,48 @@
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_RESPONSE_FIELDS = [
+    'access_token',
+    'refresh_token',
+    'token_type',
+    'expires_in',
+    'refresh_expires_in',
+    'scope',
+];
+function boundedString(value, maxBytes) {
+    return typeof value === 'string' && value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes;
+}
+function tokenFieldsValid(token) {
+    const fields = Object.keys(token);
+    return fields.length === TOKEN_RESPONSE_FIELDS.length &&
+        fields.every((key) => TOKEN_RESPONSE_FIELDS.includes(key));
+}
+function tokenLifetimesValid(token) {
+    return Number.isSafeInteger(token.expires_in) &&
+        token.expires_in > 0 &&
+        token.expires_in <= 86_400 &&
+        Number.isSafeInteger(token.refresh_expires_in) &&
+        token.refresh_expires_in > 0 &&
+        token.refresh_expires_in <= 31_536_000;
+}
+function tokenStringsValid(token) {
+    return boundedString(token.access_token, MAX_TOKEN_BYTES) &&
+        boundedString(token.refresh_token, MAX_TOKEN_BYTES) &&
+        token.token_type === 'Bearer' &&
+        boundedString(token.scope, 512) &&
+        !/[\u0000-\u001f\u007f]/.test(token.scope);
+}
+export function parseTokenResponse(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Token response is malformed');
+    }
+    const token = value;
+    if (!tokenFieldsValid(token) || !tokenLifetimesValid(token) || !tokenStringsValid(token)) {
+        throw new Error('Token response is malformed');
+    }
+    return Object.freeze({
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        token_type: 'Bearer',
+        expires_in: token.expires_in,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.28.0",
+  "version": "6.29.1",
   "description": "Multi-agent orchestration engine for Claude, Codex, and Gemini",
   "main": "src/orchestrator.js",
   "bin": {
@@ -44,22 +44,31 @@
     "typecheck:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.json",
     "typecheck:hosted-target": "tsc --project tsconfig.hosted-target.json",
     "typecheck:hosted-session": "tsc --project tsconfig.hosted-session.json",
-    "test:hosted-target": "node --test tests/hosted-target/*.test.ts",
+    "test:hosted-target": "npm run build:cluster && node --test tests/hosted-target/*.test.ts",
     "test:target": "npm run build:agent-cli-provider && npm run build:target && node --test tests/target/*.test.ts",
     "typecheck:target": "tsc --project tsconfig.target.json",
     "typecheck:cluster": "tsc --project tsconfig.cluster.json",
     "lint:agent-cli-provider": "eslint \"src/agent-cli-provider/**/*.ts\" \"tests/agent-cli-provider/**/*.ts\"",
     "build:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.build.json",
     "build:target": "tsc --project tsconfig.target.build.json",
-    "build:cluster": "npm run protocol:generate && tsc --project tsconfig.cluster.cjs.json && tsc --project tsconfig.cluster.esm.json && tsc --project tsconfig.hosted-session.cjs.json && tsc --project tsconfig.hosted-session.esm.json && node scripts/build-cluster.js",
+    "build:cluster": "npm run protocol:generate && tsc --project tsconfig.cluster.cjs.json && tsc --project tsconfig.cluster.esm.json && tsc --project tsconfig.hosted-target.cjs.json && tsc --project tsconfig.hosted-target.esm.json && tsc --project tsconfig.hosted-session.cjs.json && tsc --project tsconfig.hosted-session.esm.json && node scripts/build-cluster.js",
     "test:agent-cli-provider": "node --test tests/agent-cli-provider/*.test.js",
     "test:omp": "npm run build:agent-cli-provider && node --test tests/agent-cli-provider/omp-*.test.js && node tests/run-tests.js tests/omp-rpc-watcher.test.js tests/omp-isolation-capability.test.js tests/omp-docker-auth.test.js tests/omp-docker-fresh-only.test.js",
     "test:providers:live": "npm run build:agent-cli-provider && node scripts/live-provider-smoke.js",
     "check:agent-cli-provider": "npm run check:agent-cli-provider:ci",
     "check:agent-cli-provider:ci": "npm run typecheck:agent-cli-provider && npm run lint:agent-cli-provider && npm run build:agent-cli-provider && npm run test:agent-cli-provider",
-    "test:cluster-client": "npm run build:cluster && node --test tests/cluster/client.test.js tests/cluster/parity.test.js tests/cluster/architecture.test.js tests/cluster/verifier-regressions.test.js tests/cluster/request-validation.test.js tests/hosted-session/coordinator.test.js",
+    "test:cluster-client": "npm run build:cluster && node --test tests/cluster/client.test.js tests/cluster/client-lifecycle.test.js tests/cluster/parity.test.js tests/cluster/architecture.test.js tests/cluster/verifier-regressions.test.js tests/cluster/request-validation.test.js tests/hosted-session/coordinator.test.js tests/hosted-session/coordinator-cancellation.test.js",
     "test:cluster-package": "npm run build:agent-cli-provider && npm run build:cluster && npm run build:target && node --test tests/cluster/package.test.js",
     "dev:link": "npm link",
+    "opcore:status": "opcore status --repo . --json",
+    "opcore:scan": "opcore --repo . --json",
+    "opcore:check": "node scripts/opcore-introduced-check.js",
+    "opcore:check:staged": "node scripts/opcore-introduced-check.js --staged",
+    "opcore:install:rust-metrics": "cargo install rust-code-analysis-cli --version 0.0.25 --locked",
+    "opcore:graph:build": "opcore graph build --repo . --json",
+    "opcore:graph:update": "opcore graph update --repo . --json",
+    "opcore:measure": "opcore measure --repo . --json",
+    "audit:production": "node scripts/audit-production-dependencies.js",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "validate:templates": "node scripts/validate-templates.js",
@@ -122,7 +131,7 @@
     "url": "https://github.com/the-open-engine/zeroshot/issues"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   },
   "publishConfig": {
     "access": "public",
@@ -169,8 +178,8 @@
     "commander": "^14.0.2",
     "node-pty": "^1.1.0",
     "omelette": "^0.4.17",
-    "pidusage": "^4.0.1",
     "open": "^10.1.0",
+    "pidusage": "^4.0.1",
     "proper-lockfile": "^4.1.2"
   },
   "optionalDependencies": {
@@ -196,6 +205,7 @@
     "jscpd": "^3.5.10",
     "lint-staged": "^16.2.7",
     "mocha": "^11.7.5",
+    "opcore": "0.2.1",
     "prettier": "^3.7.4",
     "semantic-release": "^25.0.2",
     "sinon": "^21.0.0",

package/scripts/audit-production-dependencies.js

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+'use strict';
+
+const { spawnSync } = require('node:child_process');
+
+const severityRank = new Map([
+  ['info', 0],
+  ['low', 1],
+  ['moderate', 2],
+  ['high', 3],
+  ['critical', 4],
+]);
+const approvedLeafAdvisories = new Map([
+  ['brace-expansion', new Set(['1123898', '1130591'])],
+  ['smol-toml', new Set(['1115393'])],
+]);
+const approvedLeafPaths = new Map([
+  ['brace-expansion', 'node_modules/opcore/node_modules/brace-expansion'],
+  ['smol-toml', 'node_modules/opcore/node_modules/smol-toml'],
+]);
+const approvedVersions = new Map([
+  ['node_modules/opcore', '0.2.1'],
+  ['node_modules/opcore/node_modules/brace-expansion', '5.0.6'],
+  ['node_modules/opcore/node_modules/smol-toml', '1.6.0'],
+]);
+
+function isRelevant(vulnerability) {
+  return (severityRank.get(vulnerability.severity) ?? Number.POSITIVE_INFINITY) >= 2;
+}
+
+function hasExpectedNodes(name, vulnerability) {
+  const nodes = vulnerability.nodes;
+  if (!Array.isArray(nodes) || nodes.length === 0) return false;
+  const leafPath = approvedLeafPaths.get(name);
+  if (leafPath !== undefined) return nodes.length === 1 && nodes[0] === leafPath;
+  if (name === 'opcore') return nodes.length === 1 && nodes[0] === 'node_modules/opcore';
+  return nodes.every((node) => node.startsWith('node_modules/opcore/node_modules/'));
+}
+
+function isApprovedLeaf(name, vulnerability) {
+  const approvedSources = approvedLeafAdvisories.get(name);
+  if (approvedSources === undefined || !hasExpectedNodes(name, vulnerability)) return false;
+  if (!Array.isArray(vulnerability.via) || vulnerability.via.length === 0) return false;
+  return vulnerability.via.every(
+    (advisory) =>
+      advisory !== null &&
+      typeof advisory === 'object' &&
+      approvedSources.has(String(advisory.source))
+  );
+}
+
+function isApprovedVulnerability(name, vulnerabilities, memo, active) {
+  if (memo.has(name)) return memo.get(name);
+  if (active.has(name)) return false;
+  const vulnerability = vulnerabilities[name];
+  if (vulnerability === undefined || !hasExpectedNodes(name, vulnerability)) return false;
+  if (isApprovedLeaf(name, vulnerability)) {
+    memo.set(name, true);
+    return true;
+  }
+  if (!Array.isArray(vulnerability.via) || vulnerability.via.length === 0) return false;
+  if (!vulnerability.via.every((dependency) => typeof dependency === 'string')) return false;
+
+  active.add(name);
+  const approved = vulnerability.via.every((dependency) =>
+    isApprovedVulnerability(dependency, vulnerabilities, memo, active)
+  );
+  active.delete(name);
+  memo.set(name, approved);
+  return approved;
+}
+
+function exceptionVersionsMatch(lock) {
+  if (lock?.packages?.['']?.dependencies?.opcore !== '0.2.1') return false;
+  return Array.from(approvedVersions).every(
+    ([packagePath, version]) => lock?.packages?.[packagePath]?.version === version
+  );
+}
+
+function evaluateAudit(payload, lock) {
+  if (payload === null || typeof payload !== 'object' || payload.error !== undefined) {
+    throw new Error('npm audit did not return a valid vulnerability report');
+  }
+  const vulnerabilities = payload.vulnerabilities;
+  if (vulnerabilities === null || typeof vulnerabilities !== 'object') {
+    throw new Error('npm audit report is missing vulnerabilities');
+  }
+
+  const relevant = Object.entries(vulnerabilities).filter(([, vulnerability]) =>
+    isRelevant(vulnerability)
+  );
+  const memo = new Map();
+  const allowed = relevant.filter(([name]) =>
+    isApprovedVulnerability(name, vulnerabilities, memo, new Set())
+  );
+  if (allowed.length > 0 && !exceptionVersionsMatch(lock)) {
+    return { allowed: [], blocked: relevant, versionMismatch: true };
+  }
+  const allowedNames = new Set(allowed.map(([name]) => name));
+  return {
+    allowed,
+    blocked: relevant.filter(([name]) => !allowedNames.has(name)),
+    versionMismatch: false,
+  };
+}
+
+function runAudit() {
+  const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+  const result = spawnSync(npm, ['audit', '--audit-level=moderate', '--omit=dev', '--json'], {
+    encoding: 'utf8',
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  if (result.error) throw result.error;
+
+  let payload;
+  try {
+    payload = JSON.parse(result.stdout);
+  } catch {
+    throw new Error(
+      result.stderr || result.stdout || `npm audit exited with status ${result.status}`
+    );
+  }
+  const lock = require('../package-lock.json');
+  return evaluateAudit(payload, lock);
+}
+
+function main() {
+  const result = runAudit();
+  if (result.blocked.length > 0) {
+    const suffix = result.versionMismatch ? ' (Opcore exception version mismatch)' : '';
+    console.error(
+      `Production dependency audit failed${suffix}: ${result.blocked.map(([name]) => name).join(', ')}`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  if (result.allowed.length > 0) {
+    console.warn(
+      `Production dependency audit passed with pinned Opcore advisories: ${result.allowed
+        .map(([name]) => name)
+        .join(', ')}`
+    );
+    return;
+  }
+  console.log('Production dependency audit passed');
+}
+
+if (require.main === module) main();
+
+module.exports = { evaluateAudit };