@vola-trebla/croak 0.0.0-stage → 0.1.0

package/dist/install/content-cache.js

@@ -0,0 +1,94 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+/** Only sha512 is strong enough to stand in for the tarball's content. */
+const cacheable = (integrity) => integrity !== undefined &&
+    /^sha512-[A-Za-z0-9+/]{86}==$/.test(integrity.trim());
+const SEVERITIES = new Set(["info", "warn", "block"]);
+function isFinding(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const f = value;
+    return (typeof f.ruleId === "string" &&
+        typeof f.file === "string" &&
+        typeof f.message === "string" &&
+        typeof f.severity === "string" &&
+        SEVERITIES.has(f.severity) &&
+        (f.line === undefined || typeof f.line === "number"));
+}
+/** Errors from the filesystem (not bugs): the cache degrades to a miss. */
+const isFsError = (error) => error instanceof Error &&
+    typeof error.code === "string";
+export function fileContentCache(dir, fingerprint) {
+    // One file per tarball and label: content and provenance findings for the
+    // same tarball do not overwrite each other.
+    const path = (integrity, label) => join(dir, `${createHash("sha256").update(`${fingerprint}\n${integrity.trim()}\n${label}`).digest("hex")}.json`);
+    return {
+        get(integrity, label) {
+            if (!cacheable(integrity))
+                return undefined;
+            let data;
+            try {
+                data = JSON.parse(readFileSync(path(integrity, label), "utf8"));
+            }
+            catch (error) {
+                if (error instanceof SyntaxError || isFsError(error))
+                    return undefined;
+                throw error;
+            }
+            if (typeof data !== "object" || data === null)
+                return undefined;
+            const entry = data;
+            // The same tarball under another name or version is not reused.
+            if (entry.label !== label ||
+                !Array.isArray(entry.findings) ||
+                !entry.findings.every(isFinding))
+                return undefined;
+            return entry.findings;
+        },
+        set(integrity, label, findings) {
+            if (!cacheable(integrity))
+                return;
+            const file = path(integrity, label);
+            const tmp = `${file}.${process.pid}.tmp`;
+            try {
+                mkdirSync(dir, { recursive: true, mode: 0o700 });
+                // Write then rename, so a concurrent reader never sees half a file.
+                writeFileSync(tmp, JSON.stringify({ label, findings }), {
+                    mode: 0o600,
+                });
+                renameSync(tmp, file);
+            }
+            catch (error) {
+                if (!isFsError(error))
+                    throw error;
+                try {
+                    rmSync(tmp, { force: true });
+                }
+                catch (cleanup) {
+                    // Best effort: a stray .tmp file is never read back.
+                    if (!isFsError(cleanup))
+                        throw cleanup;
+                }
+            }
+        },
+    };
+}
+/** A hash of croak's own code (the src/ or dist/ tree this module runs from). */
+export function codeFingerprint(root) {
+    const hash = createHash("sha256");
+    const walk = (dir) => {
+        for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : 1))) {
+            const full = join(dir, entry.name);
+            if (entry.isDirectory())
+                walk(full);
+            else if (/\.[jt]s$/.test(entry.name) &&
+                !/\.test\.[jt]s$/.test(entry.name)) {
+                hash.update(`${full.slice(root.length)}\n`);
+                hash.update(readFileSync(full));
+            }
+        }
+    };
+    walk(root);
+    return hash.digest("hex");
+}

package/dist/install/content.js

@@ -0,0 +1,42 @@
+import { hiddenCodeWith } from "../detectors/hidden-code.js";
+import { DEPENDENCY_INSTALL_SCRIPTS, lifecycleScriptWith, } from "../detectors/lifecycle-script.js";
+import { obfuscationWith } from "../detectors/obfuscation.js";
+import { unscannedWith } from "../detectors/unscanned.js";
+import { isSuspiciousInDependency } from "../signals/code.js";
+/**
+ * The repo detectors that make sense for a package's own files. Not
+ * ide-autorun or git-config (they do nothing inside node_modules) and not
+ * node-modules-present (bundled dependencies are normal in a tarball).
+ */
+const DEPENDENCY_DETECTORS = [
+    unscannedWith({ jsonIsData: true, downgradeInstalled: false }),
+    lifecycleScriptWith({
+        suspicious: isSuspiciousInDependency,
+        scripts: DEPENDENCY_INSTALL_SCRIPTS,
+        manifests: "package",
+    }),
+    // Bundled dependencies (node_modules inside the tarball) are code npm
+    // installs and runs: judged like the package itself, never downgraded.
+    hiddenCodeWith({ downgradeInstalled: false }),
+    obfuscationWith({ downgradeInstalled: false }),
+];
+/** Findings for one package's contents, with paths prefixed by `name@version/`. */
+export function contentFindings(label, snapshot) {
+    const findings = DEPENDENCY_DETECTORS.flatMap((detect) => detect(snapshot)).map((finding) => ({
+        ...finding,
+        file: `${label}/${finding.file}`,
+    }));
+    // Context, not a warning: prebuilt binaries are how esbuild, swc, sharp
+    // and TypeScript 7 ship. What runs them at install time is checked above.
+    const natives = snapshot.entries.filter((e) => e.path.endsWith(".node"));
+    const first = natives[0];
+    if (first !== undefined) {
+        findings.push({
+            ruleId: "install/native-binary",
+            severity: "info",
+            file: `${label}/${first.path}`,
+            message: `ships ${natives.length} prebuilt native binar${natives.length === 1 ? "y" : "ies"} (.node) that croak cannot inspect`,
+        });
+    }
+    return findings;
+}

package/dist/install/detectors.js

@@ -0,0 +1,79 @@
+import { REGISTRY, registryTarball } from "./registry.js";
+const label = (change) => `${change.entry.name}@${change.entry.version ?? "?"}`;
+const what = (change) => change.kind === "changed"
+    ? `updates ${change.entry.name} ${change.previousVersion} → ${change.entry.version}`
+    : "is new";
+/** npm records hasInstallScript for packages with preinstall/install/postinstall (or binding.gyp). */
+export const installScripts = (changes) => changes
+    .filter((c) => c.entry.hasInstallScript)
+    .map((c) => ({
+    ruleId: "install/install-script",
+    severity: "warn",
+    file: label(c),
+    message: `${what(c)} and runs code at install time (preinstall/install/postinstall or a native build)`,
+}));
+/** Why a package is not a registry download, or undefined when it is one (registryTarball). */
+function sourceProblem(resolved, name, version) {
+    const tarball = registryTarball(resolved);
+    if (tarball !== undefined) {
+        // The lockfile's name decides which registry facts croak reads: the URL
+        // must be that package's own tarball, not another package's.
+        const base = name.slice(name.lastIndexOf("/") + 1);
+        return decodeURIComponent(tarball.pathname) ===
+            `/${name}/-/${base}-${version ?? ""}.tgz`
+            ? undefined
+            : `is named ${name}@${version ?? "?"} but its tarball URL is for another package: ${tarball.pathname}`;
+    }
+    if (resolved === undefined)
+        return "has no resolved source in the lockfile";
+    if (/^(?:git\+|git:|github:|gitlab:|bitbucket:)/.test(resolved))
+        return "comes from git, not the npm registry";
+    if (resolved.startsWith("file:"))
+        return "comes from a local path, not the npm registry";
+    if (!URL.canParse(resolved))
+        return `has an unrecognized source: ${resolved}`;
+    const url = new URL(resolved);
+    if (url.protocol !== "https:")
+        return `is downloaded over ${url.protocol.replace(":", "")}, not https`;
+    return `comes from ${url.host}${url.username === "" ? "" : " with credentials in the URL"}, not ${REGISTRY}`;
+}
+/** Packages that do not come from the public npm registry over https. */
+export const source = (changes) => changes.flatMap((c) => {
+    if (c.entry.link) {
+        return [
+            {
+                ruleId: "install/source",
+                severity: "info",
+                file: label(c),
+                message: "is a workspace link, not a download",
+            },
+        ];
+    }
+    const problem = sourceProblem(c.entry.resolved, c.entry.name, c.entry.version);
+    return problem === undefined
+        ? []
+        : [
+            {
+                ruleId: "install/source",
+                severity: "warn",
+                file: label(c),
+                message: `${what(c)} and ${problem}`,
+            },
+        ];
+});
+/** A downloaded package without an integrity hash is not verified by npm. */
+export const integrity = (changes) => changes
+    .filter((c) => !c.entry.link &&
+    c.entry.resolved !== undefined &&
+    c.entry.integrity === undefined)
+    .map((c) => ({
+    ruleId: "install/integrity",
+    severity: "warn",
+    file: label(c),
+    message: `${what(c)} and has no integrity hash, so the package manager does not verify the download`,
+}));
+export const installDetectors = [
+    installScripts,
+    source,
+    integrity,
+];

package/dist/install/installed.js

@@ -0,0 +1,99 @@
+import { posix } from "node:path";
+import { stripBom } from "../signals/text.js";
+/**
+ * What is really installed in a project, as a lockfile: the entries of
+ * node_modules/.package-lock.json whose folder holds a package.json with the
+ * same name and version (M4 review, D34). npm ignores hidden-lockfile entries
+ * whose folders are missing, so a committed or stale hidden lockfile must not
+ * make croak treat the tree as installed and skip it.
+ */
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const nameFromPath = (path) => path.slice(path.lastIndexOf("node_modules/") + "node_modules/".length);
+/** The verified lockfile text, or undefined when nothing is installed. */
+export function installedLockfile(project, read) {
+    const text = read(posix.join(project, "node_modules", ".package-lock.json"));
+    if (text === undefined)
+        return undefined;
+    let data;
+    try {
+        data = JSON.parse(stripBom(text));
+    }
+    catch {
+        return undefined; // npm rebuilds an unreadable hidden lockfile from the tree
+    }
+    if (!isRecord(data) || !isRecord(data.packages))
+        return undefined;
+    const kept = {};
+    for (const [path, entry] of Object.entries(data.packages)) {
+        if (!isRecord(entry) || path === "" || !path.startsWith("node_modules/"))
+            continue;
+        let manifest;
+        try {
+            manifest = JSON.parse(stripBom(read(posix.join(project, path, "package.json")) ?? ""));
+        }
+        catch {
+            continue; // no folder, or no readable package.json: not installed
+        }
+        const name = typeof entry.name === "string" ? entry.name : nameFromPath(path);
+        if (isRecord(manifest) &&
+            manifest.name === name &&
+            manifest.version === entry.version)
+            kept[path] = entry;
+    }
+    return JSON.stringify({
+        ...data,
+        packages: { "": data.packages[""] ?? {}, ...kept },
+    });
+}
+/** "@scope/name" → "@scope+name", as pnpm names its virtual store folders. */
+const storeName = (name) => name.replace("/", "+");
+/**
+ * The same for pnpm (M6, D38): the entries of node_modules/.pnpm/lock.yaml
+ * whose virtual-store folder (name@version, or name@version_peers…) holds a
+ * package.json with that name and version, as an npm v3 lockfile so the plan
+ * diff is shared. A folder croak cannot find (pnpm shortens very long names)
+ * counts as not installed, so it is checked.
+ */
+export function installedPnpmLockfile(project, read, list, parse) {
+    const text = read(posix.join(project, "node_modules", ".pnpm", "lock.yaml"));
+    if (text === undefined)
+        return undefined;
+    let entries;
+    try {
+        entries = parse(text);
+    }
+    catch {
+        return undefined; // an unreadable hidden lockfile means nothing counts as installed
+    }
+    const store = posix.join(project, "node_modules", ".pnpm");
+    const folders = list(store);
+    const packages = { "": {} };
+    for (const entry of entries) {
+        if (entry.link || entry.version === undefined)
+            continue;
+        const base = `${storeName(entry.name)}@${entry.version}`;
+        const installed = folders
+            .filter((f) => f === base || f.startsWith(`${base}_`) || f.startsWith(`${base}(`))
+            .some((folder) => {
+            try {
+                const manifest = JSON.parse(stripBom(read(posix.join(store, folder, "node_modules", entry.name, "package.json")) ?? ""));
+                return (isRecord(manifest) &&
+                    manifest.name === entry.name &&
+                    manifest.version === entry.version);
+            }
+            catch {
+                return false;
+            }
+        });
+        if (installed)
+            packages[entry.path] = {
+                name: entry.name,
+                version: entry.version,
+                resolved: entry.resolved,
+                integrity: entry.integrity,
+            };
+    }
+    return JSON.stringify({ lockfileVersion: 3, packages });
+}

package/dist/install/lockfile.js

@@ -0,0 +1,72 @@
+import { stripBom } from "../signals/text.js";
+export class LockfileError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "LockfileError";
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const asString = (value) => typeof value === "string" ? value : undefined;
+const asStrings = (value) => Array.isArray(value)
+    ? value.filter((v) => typeof v === "string")
+    : [];
+/** npm's rule: refused by `!value`; if any value is listed without `!`, it must be one of them. */
+function accepts(list, value) {
+    if (list.includes(`!${value}`))
+        return false;
+    const allowed = list.filter((v) => !v.startsWith("!"));
+    return allowed.length === 0 || allowed.includes(value);
+}
+/** Whether npm would install this entry on the platform (platform packages for other systems are skipped). */
+export function installsOn(entry, platform) {
+    return accepts(entry.os, platform.os) && accepts(entry.cpu, platform.cpu);
+}
+/** `node_modules/a/node_modules/@s/b` → `@s/b`. */
+function nameFromPath(path) {
+    const index = path.lastIndexOf("node_modules/");
+    return index === -1 ? path : path.slice(index + "node_modules/".length);
+}
+/** Parses an npm lockfile (v2 or v3). Lockfile v1 has no `packages` map and is rejected. */
+export function parseLockfile(text) {
+    let data;
+    try {
+        data = JSON.parse(stripBom(text));
+    }
+    catch (error) {
+        throw new LockfileError(`not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!isRecord(data) || !isRecord(data.packages)) {
+        throw new LockfileError("no packages map: lockfile v1 is not supported, regenerate it with npm 7 or later");
+    }
+    return Object.entries(data.packages).flatMap(([path, raw]) => {
+        if (path === "")
+            return [];
+        if (!isRecord(raw))
+            throw new LockfileError(`entry ${path} is not an object`);
+        // Without a version croak cannot look the package up; npm always writes one.
+        if (raw.link !== true && typeof raw.version !== "string")
+            throw new LockfileError(`entry ${path} has no version`);
+        return [
+            {
+                path,
+                name: asString(raw.name) ?? nameFromPath(path),
+                version: asString(raw.version),
+                resolved: asString(raw.resolved),
+                integrity: asString(raw.integrity),
+                hasInstallScript: raw.hasInstallScript === true,
+                // A key outside node_modules is a local folder npm links (a
+                // workspace member), never a download, unless it claims a source.
+                link: raw.link === true ||
+                    (!path.startsWith("node_modules/") &&
+                        !path.includes("/node_modules/") &&
+                        raw.resolved === undefined),
+                dev: raw.dev === true,
+                optional: raw.optional === true,
+                os: asStrings(raw.os),
+                cpu: asStrings(raw.cpu),
+            },
+        ];
+    });
+}

package/dist/install/metadata.js

@@ -0,0 +1,159 @@
+import { POPULAR_PACKAGES } from "./popular.js";
+const POPULAR = new Set(POPULAR_PACKAGES);
+const RECENT_DAYS = 7;
+const NEW_PACKAGE_DAYS = 30;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const normalize = (name) => name.toLowerCase().replace(/[-_.]/g, "");
+/** Optimal string alignment distance (Levenshtein plus adjacent transpositions), capped at `cap`. */
+function distance(a, b, cap = 2) {
+    if (Math.abs(a.length - b.length) >= cap)
+        return cap;
+    const d = Array.from({ length: a.length + 1 }, (_, i) => [
+        i,
+        ...Array(b.length).fill(0),
+    ]);
+    for (let j = 0; j <= b.length; j++)
+        d[0][j] = j;
+    for (let i = 1; i <= a.length; i++) {
+        for (let j = 1; j <= b.length; j++) {
+            const row = d[i];
+            const prev = d[i - 1];
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            let best = Math.min((prev[j] ?? 0) + 1, (row[j - 1] ?? 0) + 1, (prev[j - 1] ?? 0) + cost);
+            if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+                best = Math.min(best, (d[i - 2][j - 2] ?? 0) + 1);
+            }
+            row[j] = best;
+        }
+    }
+    return Math.min(d[a.length][b.length] ?? cap, cap);
+}
+/**
+ * Popular packages a name that npm does not have might have meant (M4): up to
+ * three, nearest first, within two keystrokes or one separator. Only for
+ * names that do not exist, where a suggestion cannot be the attack itself;
+ * an existing look-alike is a finding instead (nearPopularName).
+ */
+export function suggestNames(spec) {
+    const at = spec.indexOf("@", 1);
+    const name = (at === -1 ? spec : spec.slice(0, at)).toLowerCase();
+    if (name.startsWith("@") || name.length < 4 || POPULAR.has(name))
+        return [];
+    return POPULAR_PACKAGES.map((popular) => ({
+        popular,
+        d: normalize(popular) === normalize(name) ? 0 : distance(popular, name, 3),
+    }))
+        .filter(({ d }) => d <= 2)
+        .sort((x, y) => x.d - y.d)
+        .slice(0, 3)
+        .map(({ popular }) => popular);
+}
+/** The popular package this unscoped name is one keystroke (or one separator) away from. */
+export function nearPopularName(name) {
+    if (name.startsWith("@") || POPULAR.has(name) || name.length < 5)
+        return undefined;
+    return POPULAR_PACKAGES.find((popular) => popular.length >= 5 &&
+        (normalize(popular) === normalize(name) || distance(popular, name) === 1));
+}
+/**
+ * Registry signals for one new or changed version. Each signal alone is a
+ * warning (D25), except a new publisher, which alone is context (D28); two
+ * patterns block (D26): an install script with dropped
+ * provenance or a new publisher (a hijacked maintainer account), and a
+ * typo-squat name on a brand-new package.
+ */
+export function metadataFindings(change, facts, now = new Date()) {
+    const { entry } = change;
+    const file = `${entry.name}@${entry.version ?? "?"}`;
+    const finding = (ruleId, severity, message) => ({ ruleId, severity, file, message });
+    if (facts === "not-found")
+        return [
+            finding("install/registry", "warn", "is not on the npm registry (unpublished or never published)"),
+        ];
+    if (facts === undefined)
+        return [
+            finding("install/registry", "warn", "is a version the npm registry does not list"),
+        ];
+    const findings = [];
+    const isNewPackage = facts.created !== undefined &&
+        now.getTime() - facts.created.getTime() < NEW_PACKAGE_DAYS * DAY_MS;
+    const recent = facts.earlier.slice(0, 5);
+    const provenanceDropped = !facts.hasProvenance && recent.some((v) => v.hasProvenance);
+    // With provenance, the publisher is a CI identity tied to the source repo;
+    // a different account name there is a pipeline change, not a new person.
+    const newPublisher = !facts.hasProvenance &&
+        facts.publisher !== undefined &&
+        facts.earlier.length > 0 &&
+        !facts.earlier.some((v) => v.publisher === facts.publisher);
+    // A new publisher only matters with install-time code that is new: the same
+    // install script as before (sqlite3's prebuild-install) runs files the
+    // content checks read anyway (D30).
+    const { previous } = facts;
+    const sameScript = previous !== undefined &&
+        facts.installCommands !== "" &&
+        previous.installCommands === facts.installCommands;
+    // The lockfile's hasInstallScript is the project's (or attacker's) word;
+    // the registry's manifest says it too, and either one counts.
+    const runsAtInstall = entry.hasInstallScript || facts.installScripts.length > 0;
+    const hijack = runsAtInstall && (provenanceDropped || (newPublisher && !sameScript));
+    const recentRelease = facts.ageDays !== undefined && facts.ageDays < RECENT_DAYS;
+    const pattern = hijack
+        ? "; with an install script, this is the pattern of a hijacked maintainer account"
+        : "";
+    if (recentRelease) {
+        findings.push(finding("install/recent-release", "warn", `was published ${facts.ageDays} day(s) ago; new versions of popular packages are where hijacks land first`));
+    }
+    if (provenanceDropped) {
+        findings.push(finding("install/provenance", hijack ? "block" : "warn", `has no provenance, although earlier versions were published with it${pattern}`));
+    }
+    if (newPublisher) {
+        findings.push(finding("install/publisher", 
+        // Alone it is context: maintainers rotate and orgs publish from
+        // service accounts (microsoft1es, GitHub Actions).
+        hijack ? "block" : runsAtInstall ? "warn" : "info", `was published by ${facts.publisher}, who did not publish the earlier versions${pattern}${!hijack && runsAtInstall && sameScript && previous !== undefined ? `; it runs the same install script as ${previous.version}` : ""}`));
+    }
+    const lookalike = nearPopularName(entry.name);
+    if (lookalike !== undefined) {
+        findings.push(finding("install/name", isNewPackage ? "block" : "warn", `looks like the popular package ${lookalike}${isNewPackage ? ", and the package is brand new: a typo-squat or a hallucinated name" : "; check the name"} (did you mean \`${lookalike}\`?)`));
+    }
+    if (previous !== undefined &&
+        facts.installScripts.length > 0 &&
+        previous.installScripts.length === 0) {
+        const risky = recentRelease || provenanceDropped || newPublisher;
+        findings.push(finding("install/new-install-script", risky ? "block" : "warn", `adds an install script (${facts.installScripts.join(", ")}) that ${previous.version} did not have${risky ? ", in a release that also shows a registry warning: the pattern of a hijacked release" : ""}`));
+    }
+    if (isNewPackage)
+        findings.push(finding("install/new-package", "warn", `is a brand-new package (created less than ${NEW_PACKAGE_DAYS} days ago)`));
+    return findings;
+}
+/**
+ * Dependencies this version adds compared with its previous version. A new
+ * dependency is context; a new dependency that is itself a brand-new package
+ * is how the 2026 axios release smuggled in its payload (D27), so it blocks.
+ */
+export function addedDependencyFindings(change, facts, createdByName, now = new Date()) {
+    const { previous } = facts;
+    if (previous === undefined)
+        return [];
+    const added = facts.dependencies.filter((name) => !previous.dependencies.includes(name));
+    const file = `${change.entry.name}@${change.entry.version ?? "?"}`;
+    return added.map((name) => {
+        const created = createdByName.get(name);
+        const days = created === undefined
+            ? undefined
+            : Math.floor((now.getTime() - created.getTime()) / DAY_MS);
+        return days !== undefined && days < NEW_PACKAGE_DAYS
+            ? {
+                ruleId: "install/new-dependency",
+                severity: "block",
+                file,
+                message: `adds dependency ${name}, a package created ${days} day(s) ago, that ${previous.version} did not have: how hijacked releases smuggle in a payload`,
+            }
+            : {
+                ruleId: "install/new-dependency",
+                severity: "info",
+                file,
+                message: `adds dependency ${name} (not in ${previous.version})`,
+            };
+    });
+}

package/dist/install/plan.js

@@ -0,0 +1,31 @@
+/**
+ * Same package only when it comes from the same place with the same hash: a
+ * second lodash@4.17.21 from another URL, or an installed copy whose hash
+ * differs from the plan's, is a different download and is checked.
+ */
+const key = (entry) => `${entry.name}@${entry.version ?? "?"} ${entry.resolved ?? ""} ${entry.integrity ?? ""}`;
+/**
+ * Every package version the install would bring that the project did not
+ * have — direct and transitive, each name@version, source and hash once. A changed version of
+ * an existing package is reported with the previous version.
+ */
+export function diffLockfiles(before, after) {
+    const had = new Set((before ?? []).map(key));
+    const previous = new Map();
+    for (const entry of before ?? [])
+        if (entry.version !== undefined)
+            previous.set(entry.name, entry.version);
+    const seen = new Set();
+    const changes = [];
+    for (const entry of after) {
+        const id = key(entry);
+        if (had.has(id) || seen.has(id))
+            continue;
+        seen.add(id);
+        const old = previous.get(entry.name);
+        changes.push(old === undefined
+            ? { kind: "added", entry }
+            : { kind: "changed", entry, previousVersion: old });
+    }
+    return changes;
+}