@vola-trebla/croak 0.0.0-stage → 0.1.0

package/dist/install/registry.js

@@ -0,0 +1,274 @@
+import { createHash } from "node:crypto";
+/**
+ * A minimal npm registry client: one packument per package, read with a time
+ * limit and a size limit. Package names come from untrusted lockfiles, so they
+ * are validated against npm's naming rules before they become a URL.
+ */
+export const REGISTRY = "https://registry.npmjs.org";
+// @prisma/client's package document alone is 68 MB (2026-10).
+const DEFAULT_MAX_BYTES = 200 * 1024 * 1024;
+const DEFAULT_TIMEOUT_MS = 15_000;
+// Legacy packages may contain capitals (JSONStream); new ones may not.
+const NAME = /^(?:@[a-zA-Z0-9-~][a-zA-Z0-9-._~]*\/)?[a-zA-Z0-9-~][a-zA-Z0-9-._~]*$/;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const MAX_TARBALL_BYTES = 100 * 1024 * 1024;
+const SRI_ALGORITHMS = ["sha512", "sha384", "sha256", "sha1"];
+export class RegistryError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "RegistryError";
+    }
+}
+export function packageUrl(name) {
+    if (name.length > 214 || !NAME.test(name) || name.includes("..")) {
+        throw new RegistryError(`not a valid npm package name: ${JSON.stringify(name)}`);
+    }
+    return `${REGISTRY}/${name.startsWith("@") ? name.replace("/", "%2F") : name}`;
+}
+async function readCappedBytes(response, maxBytes) {
+    const reader = response.body?.getReader();
+    if (reader === undefined)
+        return Buffer.alloc(0);
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        let chunk;
+        try {
+            chunk = await reader.read();
+        }
+        catch (error) {
+            // A timeout or a reset after the headers: the check is incomplete, not a crash.
+            throw new RegistryError(`reading the response: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const { done, value } = chunk;
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw new RegistryError(`response too large (over ${maxBytes} bytes)`);
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks);
+}
+async function readCapped(response, maxBytes) {
+    return (await readCappedBytes(response, maxBytes)).toString("utf8");
+}
+/** A JSON document from the registry, or "not-found" on 404. */
+async function getJson(url, label, options, maxBytes) {
+    const doFetch = options.fetch ?? fetch;
+    let response;
+    try {
+        response = await doFetch(url, {
+            headers: { accept: "application/json" },
+            signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        throw new RegistryError(`${label}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (response.status === 404)
+        return "not-found";
+    if (!response.ok)
+        throw new RegistryError(`${label}: registry answered ${response.status}`);
+    const text = await readCapped(response, maxBytes);
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new RegistryError(`${label}: registry response is not JSON`);
+    }
+}
+/** The package document, or "not-found" when the registry has no such package. */
+export async function fetchPackument(name, options = {}) {
+    return getJson(packageUrl(name), name, options, options.maxBytes ?? DEFAULT_MAX_BYTES);
+}
+// A provenance bundle is ~10 KB; a version has two attestations.
+const MAX_ATTESTATIONS_BYTES = 2 * 1024 * 1024;
+const VERSION = /^[0-9A-Za-z.+-]{1,256}$/;
+/**
+ * A version's SLSA provenance bundle from the registry's attestations
+ * endpoint, or "missing" when there is none. The URL is built here, never
+ * taken from the packument's dist.attestations.url.
+ */
+export async function fetchProvenanceBundle(name, version, options = {}) {
+    if (!VERSION.test(version) || version.includes(".."))
+        throw new RegistryError(`not a valid npm version: ${JSON.stringify(version)}`);
+    const path = packageUrl(name).slice(REGISTRY.length + 1);
+    const doc = await getJson(`${REGISTRY}/-/npm/v1/attestations/${path}@${version}`, `${name}@${version} attestations`, options, MAX_ATTESTATIONS_BYTES);
+    const list = isRecord(doc) && Array.isArray(doc.attestations) ? doc.attestations : [];
+    const slsa = list.find((a) => isRecord(a) &&
+        typeof a.predicateType === "string" &&
+        a.predicateType.startsWith("https://slsa.dev/provenance/"));
+    return isRecord(slsa) && slsa.bundle !== undefined ? slsa.bundle : "missing";
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const date = (value) => {
+    if (typeof value !== "string")
+        return undefined;
+    const parsed = new Date(value);
+    return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+};
+/** Days a version must have been public to count as history (D25's 7 days). */
+export const SETTLED_DAYS = 7;
+const SEMVER = /^(\d{1,15})\.(\d{1,15})\.(\d{1,15})(?:-([0-9A-Za-z.-]{1,100}))?(?:\+.*)?$/;
+/** Semver order (prereleases before their release); undefined if either is not semver. */
+export function compareVersions(a, b) {
+    const x = SEMVER.exec(a);
+    const y = SEMVER.exec(b);
+    if (x === null || y === null)
+        return undefined;
+    for (let i = 1; i <= 3; i++) {
+        const d = Number(x[i]) - Number(y[i]);
+        if (d !== 0)
+            return d;
+    }
+    const [px, py] = [x[4], y[4]];
+    if (px === py)
+        return 0;
+    if (px === undefined)
+        return 1;
+    if (py === undefined)
+        return -1;
+    return px < py ? -1 : 1;
+}
+/** The highest settled version below `version`, else the newest settled one. */
+function predecessor(version, earlier) {
+    const below = earlier.filter((v) => (compareVersions(v.version, version) ?? 1) < 0);
+    return (below.reduce((best, v) => best === undefined ||
+        (compareVersions(v.version, best.version) ?? 0) > 0
+        ? v
+        : best, undefined) ?? earlier[0]);
+}
+const INSTALL_SCRIPTS = ["preinstall", "install", "postinstall"];
+function versionInfo(meta) {
+    const record = isRecord(meta) ? meta : {};
+    const dist = isRecord(record.dist) ? record.dist : {};
+    const user = isRecord(record._npmUser) ? record._npmUser : {};
+    const scripts = isRecord(record.scripts) ? record.scripts : {};
+    const deps = [record.dependencies, record.optionalDependencies].flatMap((d) => (isRecord(d) ? Object.keys(d) : []));
+    return {
+        hasProvenance: isRecord(dist.attestations) && dist.attestations.provenance !== undefined,
+        integrity: typeof dist.integrity === "string" ? dist.integrity : undefined,
+        publisher: typeof user.name === "string" ? user.name : undefined,
+        installScripts: INSTALL_SCRIPTS.filter((name) => typeof scripts[name] === "string"),
+        installCommands: INSTALL_SCRIPTS.filter((name) => typeof scripts[name] === "string")
+            .map((name) => `${name}: ${String(scripts[name])}`)
+            .join("\n"),
+        dependencies: [...new Set(deps)].sort(),
+    };
+}
+/** What the registry says about one version, or undefined if it does not list it. */
+export function versionFacts(packument, version, now = new Date()) {
+    if (!isRecord(packument) ||
+        !isRecord(packument.versions) ||
+        !(version in packument.versions))
+        return undefined;
+    const versions = packument.versions;
+    const meta = versions[version];
+    const dist = isRecord(meta) && isRecord(meta.dist) ? meta.dist : {};
+    const time = isRecord(packument.time) ? packument.time : {};
+    const published = date(time[version]);
+    const earlier = Object.keys(versions)
+        .filter((v) => v !== version)
+        .map((v) => ({ v, at: date(time[v]) }))
+        .filter((e) => e.at !== undefined &&
+        published !== undefined &&
+        published.getTime() - e.at.getTime() >= SETTLED_DAYS * DAY_MS)
+        .sort((a, b) => b.at.getTime() - a.at.getTime())
+        .slice(0, 10)
+        .map(({ v }) => ({ version: v, ...versionInfo(versions[v]) }));
+    return {
+        created: date(time.created),
+        published,
+        ageDays: published === undefined
+            ? undefined
+            : Math.floor((now.getTime() - published.getTime()) / DAY_MS),
+        ...versionInfo(meta),
+        signatures: dist.signatures,
+        earlier,
+        previous: predecessor(version, earlier),
+    };
+}
+/** A version's tarball URL and integrity, from its packument (the LLM diff's "before"). */
+export function tarballOf(packument, version) {
+    if (!isRecord(packument) || !isRecord(packument.versions))
+        return undefined;
+    const meta = packument.versions[version];
+    const dist = isRecord(meta) && isRecord(meta.dist) ? meta.dist : undefined;
+    if (dist === undefined || typeof dist.tarball !== "string")
+        return undefined;
+    return {
+        url: dist.tarball,
+        integrity: typeof dist.integrity === "string" ? dist.integrity : undefined,
+    };
+}
+/** The downloaded tarball does not match the lockfile's integrity hash. */
+export class IntegrityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "IntegrityError";
+    }
+}
+/** Checks data against an SRI string ("sha512-…"), using the strongest algorithm it lists. */
+export function verifyIntegrity(data, integrity) {
+    const hashes = new Map(integrity
+        .trim()
+        .split(/\s+/)
+        .map((token) => [
+        token.slice(0, token.indexOf("-")),
+        token.slice(token.indexOf("-") + 1),
+    ]));
+    const algorithm = SRI_ALGORITHMS.find((alg) => hashes.has(alg));
+    if (algorithm === undefined)
+        throw new IntegrityError(`unsupported integrity format: ${integrity.slice(0, 40)}`);
+    const actual = createHash(algorithm).update(data).digest("base64");
+    if (actual !== hashes.get(algorithm))
+        throw new IntegrityError(`${algorithm} does not match the lockfile`);
+}
+/**
+ * The tarball URL if `resolved` points at the public registry over https,
+ * with no credentials or explicit port. One predicate for what croak
+ * downloads, checks online, and reports as a non-registry source, so a
+ * package can never fall between them unchecked.
+ */
+export function registryTarball(resolved) {
+    if (resolved === undefined || !URL.canParse(resolved))
+        return undefined;
+    const url = new URL(resolved);
+    return url.protocol === "https:" &&
+        url.hostname === new URL(REGISTRY).hostname &&
+        url.port === "" &&
+        url.username === "" &&
+        url.password === ""
+        ? url
+        : undefined;
+}
+/**
+ * Downloads a tarball from the public registry (https only) with a timeout
+ * and a 100 MB cap, and verifies it against the lockfile's integrity hash.
+ */
+export async function fetchTarball(url, integrity, options = {}) {
+    const tarball = registryTarball(url);
+    if (tarball === undefined)
+        throw new RegistryError(`refusing to download a tarball from outside ${REGISTRY}: ${url}`);
+    const doFetch = options.fetch ?? fetch;
+    let response;
+    try {
+        response = await doFetch(tarball.href, {
+            signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS * 4),
+        });
+    }
+    catch (error) {
+        throw new RegistryError(`${url}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!response.ok)
+        throw new RegistryError(`${url}: registry answered ${response.status}`);
+    const data = await readCappedBytes(response, options.maxBytes ?? MAX_TARBALL_BYTES);
+    if (integrity !== undefined)
+        verifyIntegrity(data, integrity);
+    return data;
+}

package/dist/install/report.js

@@ -0,0 +1,26 @@
+import { REPORT_SCHEMA, renderVerdict, safe, } from "../repo-report.js";
+import { INCOMPLETE_ICON } from "../ui.js";
+export function renderPlan(outcome, options) {
+    const title = "croak plan";
+    if (outcome.status === "incomplete") {
+        const status = options.emoji
+            ? `— ${INCOMPLETE_ICON} incomplete`
+            : "- INCOMPLETE";
+        return [
+            options.emoji ? `🐸 ${title} ${status}` : `${title} ${status}`,
+            "",
+            `  could not finish: ${safe(outcome.reason)}`,
+            "  An incomplete check is not a clean check.",
+            "",
+        ].join("\n");
+    }
+    return renderVerdict({
+        title,
+        verdict: outcome.verdict,
+        findings: outcome.findings,
+        footer: `${outcome.added} new and ${outcome.changed} updated packages checked · ${Math.round(outcome.durationMs)} ms${outcome.llm === undefined ? "" : ` · ${outcome.llm.model}: ${outcome.llm.calls} call(s), $${outcome.llm.costUsd.toFixed(4)}`}`,
+    }, options);
+}
+export function planToJson(outcome) {
+    return `${JSON.stringify({ schema: REPORT_SCHEMA, kind: "install-plan", ...outcome }, null, 2)}\n`;
+}

package/dist/install/sanitize.js

@@ -0,0 +1,88 @@
+import { stripBom } from "../signals/text.js";
+import { parseYamlDocuments } from "./yaml.js";
+/**
+ * What the planning wrapper may hand to a package manager from an untrusted
+ * project (M6, D38). Planning must run no project code, but pnpm runs code
+ * before it resolves anything: corepack downloads and runs the pnpm version a
+ * project's `packageManager` names (checked: pnpm 12 ran pnpm 9.15.0, even
+ * with manage-package-manager-versions=false), and pnpm-workspace.yaml can
+ * load pnpmfiles and config dependencies. So the root manifest loses its
+ * package-manager pins, and the workspace file keeps only settings that shape
+ * resolution. Both come out as JSON, which YAML reads too.
+ */
+export class SanitizeError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SanitizeError";
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The root package.json without the fields that make corepack fetch a package manager. */
+export function sanitizeRootManifest(text) {
+    let manifest;
+    try {
+        manifest = JSON.parse(stripBom(text));
+    }
+    catch {
+        throw new SanitizeError("package.json is not valid JSON");
+    }
+    if (!isRecord(manifest))
+        throw new SanitizeError("package.json is not an object");
+    const { packageManager: _pm, devEngines: _de, pnpm, ...rest } = manifest;
+    // pnpm 10 reads settings from the root manifest's "pnpm" field too.
+    const kept = isRecord(pnpm)
+        ? {
+            ...rest,
+            pnpm: Object.fromEntries(Object.entries(pnpm).filter(([key]) => WORKSPACE_KEYS.has(key))),
+        }
+        : rest;
+    return `${JSON.stringify(kept, null, 2)}\n`;
+}
+/** Settings that only shape what pnpm resolves; nothing that loads or runs code, or moves the registry. */
+const WORKSPACE_KEYS = new Set([
+    "packages",
+    "catalog",
+    "catalogs",
+    "overrides",
+    "packageExtensions",
+    "peerDependencyRules",
+    "autoInstallPeers",
+    "dedupePeerDependents",
+    "excludeLinksFromLockfile",
+    "resolutionMode",
+    "linkWorkspacePackages",
+    "injectWorkspacePackages",
+    "sharedWorkspaceLockfile",
+    "supportedArchitectures",
+    "ignoredOptionalDependencies",
+]);
+/** YAML scalars come back as strings; pnpm wants booleans where YAML had them. */
+function typed(value) {
+    if (value === "true" || value === "True" || value === "TRUE")
+        return true;
+    if (value === "false" || value === "False" || value === "FALSE")
+        return false;
+    if (Array.isArray(value))
+        return value.map(typed);
+    if (isRecord(value))
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, typed(v)]));
+    return value;
+}
+export function sanitizePnpmWorkspace(text) {
+    let docs;
+    try {
+        docs = parseYamlDocuments(text);
+    }
+    catch (error) {
+        throw new SanitizeError(`pnpm-workspace.yaml: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (docs.length > 1)
+        throw new SanitizeError("pnpm-workspace.yaml has more than one document");
+    const doc = docs[0] ?? {};
+    if (!isRecord(doc))
+        throw new SanitizeError("pnpm-workspace.yaml is not a mapping");
+    const kept = Object.fromEntries(Object.entries(doc).filter(([key]) => WORKSPACE_KEYS.has(key)));
+    return `${JSON.stringify(typed(kept), null, 2)}\n`;
+}

package/dist/install/scan.js

@@ -0,0 +1,302 @@
+import { performance } from "node:perf_hooks";
+import { verifyProvenance, } from "../crypto/sigstore.js";
+import { llmStep } from "../llm/plan-step.js";
+import { aggregate } from "../verdict.js";
+import { contentFindings } from "./content.js";
+import { installDetectors } from "./detectors.js";
+import { installsOn, LockfileError, parseLockfile, } from "./lockfile.js";
+import { addedDependencyFindings, metadataFindings } from "./metadata.js";
+import { diffLockfiles } from "./plan.js";
+import { applyBuildPolicy } from "./pnpm-builds.js";
+import { isPnpmLockfile, parsePnpmLockfile } from "./pnpm-lockfile.js";
+import { provenanceBaseline, provenanceFindings, } from "./provenance.js";
+import { fetchPackument, fetchProvenanceBundle, fetchTarball, IntegrityError, RegistryError, registryTarball, versionFacts, } from "./registry.js";
+import { signatureFindings } from "./signature.js";
+import { snapshotTarball, TarballError } from "./tar.js";
+/** An npm package-lock.json or a pnpm-lock.yaml, told apart by their first lines. */
+export function parseAnyLockfile(text) {
+    return isPnpmLockfile(text) ? parsePnpmLockfile(text) : parseLockfile(text);
+}
+/**
+ * Judges what an install would bring in, from the project's lockfile before
+ * and the lockfile npm planned (`--package-lock-only --ignore-scripts`).
+ * croak itself runs no package manager; it only reads the two files.
+ */
+export function planInstall(beforeText, afterText, detectors = installDetectors) {
+    const started = performance.now();
+    const parse = (text, which) => {
+        try {
+            return parseAnyLockfile(text);
+        }
+        catch (error) {
+            if (error instanceof LockfileError)
+                throw new LockfileError(`${which} lockfile: ${error.message}`);
+            throw error;
+        }
+    };
+    try {
+        const before = beforeText === undefined ? undefined : parse(beforeText, "before");
+        const changes = diffLockfiles(before, parse(afterText, "after"));
+        const findings = detectors.flatMap((detect) => detect(changes));
+        return {
+            status: "complete",
+            verdict: aggregate(findings),
+            findings,
+            added: changes.filter((c) => c.kind === "added").length,
+            changed: changes.filter((c) => c.kind === "changed").length,
+            durationMs: performance.now() - started,
+        };
+    }
+    catch (error) {
+        if (!(error instanceof LockfileError))
+            throw error;
+        return {
+            status: "incomplete",
+            reason: error.message,
+            durationMs: performance.now() - started,
+        };
+    }
+}
+const DEFAULT_MAX_DOWNLOAD_BYTES = 300 * 1024 * 1024;
+/** The plan is too large to inspect within the download budget. */
+class BudgetError extends Error {
+}
+const keyOf = (s) => `${s.name}@${s.version}`;
+/**
+ * Provenance findings (D42, D43) for planned versions the registry lists
+ * with provenance: each one's bundle, and its previous version's, fetched
+ * and verified, then compared.
+ */
+async function provenanceOf(known, options, fetchOptions) {
+    const plans = known.flatMap(({ change, facts }) => {
+        if (facts === undefined || facts === "not-found" || !facts.hasProvenance)
+            return [];
+        const subject = (version, integrity) => ({
+            name: change.entry.name,
+            version,
+            integrity: integrity ?? "",
+        });
+        const before = provenanceBaseline(facts);
+        const current = subject(change.entry.version ?? "", facts.integrity);
+        const previous = before === undefined
+            ? undefined
+            : subject(before.version, before.integrity);
+        // Both bundles are immutable for these tarballs, and so are both
+        // versions' install scripts: the findings can be remembered.
+        const label = `provenance ${keyOf(current)} after ${previous === undefined ? "none" : `${keyOf(previous)} ${previous.integrity}`}`;
+        const cached = options.cache?.get(current.integrity, label);
+        return [{ change, facts, before, current, previous, label, cached }];
+    });
+    const subjects = new Map();
+    for (const plan of plans)
+        if (plan.cached === undefined)
+            for (const s of [plan.current, plan.previous])
+                if (s !== undefined)
+                    subjects.set(keyOf(s), s);
+    const list = [...subjects.values()];
+    const bundles = await pool(list, options.concurrency ?? 8, (s) => fetchProvenanceBundle(s.name, s.version, fetchOptions));
+    const checked = new Map(list.map((s, i) => [
+        keyOf(s),
+        bundles[i] === "missing"
+            ? "missing"
+            : verifyProvenance(bundles[i], s, options.sigstore),
+    ]));
+    return plans.flatMap((plan) => {
+        if (plan.cached !== undefined)
+            return plan.cached;
+        const { change, facts, before, current, previous } = plan;
+        const now = checked.get(keyOf(current)) ?? "missing";
+        const then = previous === undefined
+            ? undefined
+            : (checked.get(keyOf(previous)) ?? "missing");
+        const findings = provenanceFindings(change, now, before === undefined || then === undefined
+            ? undefined
+            : {
+                version: before.version,
+                provenance: then,
+                installCommands: before.installCommands,
+            }, facts.installCommands);
+        // A bundle the registry did not serve may be served next time.
+        if (now !== "missing" && then !== "missing")
+            options.cache?.set(current.integrity, plan.label, findings);
+        return findings;
+    });
+}
+/** Runs `work` over `items` with at most `limit` in flight. */
+async function pool(items, limit, work) {
+    const results = new Array(items.length);
+    let next = 0;
+    const lane = async () => {
+        while (next < items.length) {
+            const index = next++;
+            results[index] = await work(items[index]);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, lane));
+    return results;
+}
+/**
+ * planInstall plus npm registry signals (D26) for every new or changed version
+ * that comes from the public registry. Any registry failure makes the whole
+ * check incomplete: an agent must not proceed on a partial answer.
+ */
+export async function planInstallOnline(beforeText, afterText, options = {}) {
+    const started = performance.now();
+    const local = planInstall(beforeText, afterText);
+    if (local.status === "incomplete")
+        return local;
+    const before = beforeText === undefined ? undefined : parseAnyLockfile(beforeText);
+    const fromRegistry = diffLockfiles(before, parseAnyLockfile(afterText)).filter((c) => !c.entry.link && registryTarball(c.entry.resolved) !== undefined);
+    // npm skips platform packages for other systems, so they are not checked.
+    const platform = options.platform ?? {
+        os: process.platform,
+        cpu: process.arch,
+    };
+    const changes = fromRegistry.filter((c) => installsOn(c.entry, platform));
+    const skipped = fromRegistry.length - changes.length;
+    const notes = skipped === 0
+        ? []
+        : [
+            {
+                ruleId: "install/other-platform",
+                severity: "info",
+                file: "package-lock.json",
+                message: `${skipped} package(s) built for other platforms not checked: the package manager will not install them on ${platform.os}-${platform.cpu}`,
+            },
+        ];
+    const names = [...new Set(changes.map((c) => c.entry.name))];
+    try {
+        const fetchOptions = options.fetch === undefined ? {} : { fetch: options.fetch };
+        const docs = await pool(names, options.concurrency ?? 8, (name) => fetchPackument(name, fetchOptions));
+        const byName = new Map(names.map((name, i) => [name, docs[i]]));
+        const now = options.now ?? new Date();
+        const created = new Map();
+        for (const [name, doc] of byName) {
+            if (doc !== "not-found")
+                created.set(name, versionFacts(doc, firstVersion(doc), now)?.created);
+        }
+        const known = changes.map((change) => {
+            const doc = byName.get(change.entry.name);
+            return {
+                change,
+                facts: doc === "not-found"
+                    ? "not-found"
+                    : versionFacts(doc, change.entry.version ?? "", now),
+            };
+        });
+        const remote = known.flatMap(({ change: c, facts }) => {
+            const deps = facts === undefined || facts === "not-found"
+                ? []
+                : addedDependencyFindings(c, facts, created, now);
+            const signature = facts === undefined || facts === "not-found"
+                ? []
+                : signatureFindings(c, facts, options.registryKeys);
+            return [...metadataFindings(c, facts, now), ...signature, ...deps];
+        });
+        // Both only read the registry; neither waits for the other.
+        const [provenance, content] = await Promise.all([
+            provenanceOf(known, options, fetchOptions),
+            options.content === false ? [] : contentOf(changes, options),
+        ]);
+        const all = [
+            ...local.findings,
+            ...notes,
+            ...remote,
+            ...provenance,
+            ...content,
+        ];
+        // Before the LLM step: a script pnpm will not run needs no second opinion.
+        const ruled = options.builds === undefined
+            ? all
+            : applyBuildPolicy(all, options.builds);
+        const step = options.llm === undefined || options.content === false
+            ? undefined
+            : await llmStep(ruled, changes, byName, options.llm, fetchOptions);
+        const findings = step?.findings ?? ruled;
+        return {
+            ...local,
+            verdict: aggregate(findings),
+            findings,
+            ...(step === undefined || options.llm === undefined
+                ? {}
+                : {
+                    llm: {
+                        model: options.llm.model,
+                        calls: step.calls,
+                        costUsd: step.costUsd,
+                    },
+                }),
+            durationMs: performance.now() - started,
+        };
+    }
+    catch (error) {
+        if (error instanceof RegistryError) {
+            return {
+                status: "incomplete",
+                reason: `npm registry: ${error.message}`,
+                durationMs: performance.now() - started,
+            };
+        }
+        if (error instanceof TarballError || error instanceof BudgetError) {
+            return {
+                status: "incomplete",
+                reason: `package contents: ${error.message}`,
+                durationMs: performance.now() - started,
+            };
+        }
+        throw error;
+    }
+}
+/** Any listed version, to read package-level facts such as the creation date. */
+function firstVersion(doc) {
+    const versions = typeof doc === "object" && doc !== null && "versions" in doc
+        ? doc.versions
+        : undefined;
+    return typeof versions === "object" && versions !== null
+        ? (Object.keys(versions)[0] ?? "")
+        : "";
+}
+/**
+ * Downloads each registry tarball (verified against the lockfile's integrity),
+ * reads it in memory, and runs the content detectors. A tampered tarball is a
+ * block; a plan over the download budget is incomplete, never partially clean.
+ */
+async function contentOf(changes, options) {
+    const budget = options.maxDownloadBytes ?? DEFAULT_MAX_DOWNLOAD_BYTES;
+    let downloaded = 0;
+    const fetchOptions = options.fetch === undefined ? {} : { fetch: options.fetch };
+    const results = await pool(changes, 4, async (change) => {
+        const { entry } = change;
+        const label = `${entry.name}@${entry.version ?? "?"}`;
+        const cached = entry.integrity === undefined
+            ? undefined
+            : options.cache?.get(entry.integrity, label);
+        if (cached !== undefined)
+            return cached;
+        let data;
+        try {
+            data = await fetchTarball(entry.resolved ?? "", entry.integrity, fetchOptions);
+        }
+        catch (error) {
+            if (!(error instanceof IntegrityError))
+                throw error;
+            return [
+                {
+                    ruleId: "install/integrity",
+                    severity: "block",
+                    file: label,
+                    message: `the downloaded tarball does not match the lockfile (${error.message}): tampered in transit or at the source`,
+                },
+            ];
+        }
+        downloaded += data.length;
+        if (downloaded > budget)
+            throw new BudgetError(`the plan downloads more than ${budget} bytes of tarballs`);
+        const findings = contentFindings(label, snapshotTarball(data));
+        // Only after the download verified against this hash and was read whole.
+        if (entry.integrity !== undefined)
+            options.cache?.set(entry.integrity, label, findings);
+        return findings;
+    });
+    return results.flat();
+}