@wardby/cli 0.2.0 → 0.3.0

package/dist/coding/protocol.js

@@ -6,6 +6,26 @@ export const MAX_CODING_SUMMARY_BYTES = 8 * 1024;
 export const MAX_CODING_TESTS = 64;
 export const MAX_CODING_TEST_COMMAND_BYTES = 2 * 1024;
 export const MAX_TAG_BYTES = 32;
+/**
+ * Coding-run services (docs/coding-services.md): the catalog name and version
+ * grammar, shared by the repository's .wardby/services.yaml, the catalog, and
+ * the worker input.
+ */
+export const CODING_SERVICE_NAME = /^[a-z][a-z0-9-]{0,39}$/;
+export const CODING_SERVICE_VERSION = /^[0-9A-Za-z][0-9A-Za-z._-]{0,19}$/;
+export const MAX_CODING_SERVICES = 5;
+/** A variable a service hands the agent's shells (DATABASE_URL, PGHOST, REDIS_URL, ...). */
+export const CODING_SERVICE_ENV_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
+export const MAX_CODING_SERVICE_ENV = 16;
+export const MAX_CODING_SERVICE_ENV_VALUE_BYTES = 1024;
+/**
+ * A worker's output-schema failure, reduced to where and how it failed, never
+ * what the model wrote: `<path>:<zod issue code>`, where the path is dot-joined
+ * schema keys and array indices (`$` for the root). Unrecognized keys the model
+ * invented are carried only as the `unrecognized_keys` code, never by name.
+ */
+export const MAX_CODING_OUTPUT_ISSUES = 8;
+export const SAFE_CODING_OUTPUT_ISSUE = /^(?:\$|[a-z][A-Za-z]{0,31}(?:\.(?:[a-z][A-Za-z]{0,31}|\d{1,3})){0,7}):[a-z_]{1,32}$/;
 const MAX_REPOSITORY_INPUT_BYTES = 512;
 const MAX_REF_BYTES = 255;
 const MAX_MODEL_BYTES = 128;
@@ -13,8 +33,8 @@ const MAX_RUN_ID_BYTES = 128;
 const MAX_COST_USD = 1_000_000;
 const MAX_JSON_NESTING_DEPTH = 64;
 const INVALID_MULTILINE_CONTROL = /[\u0000\u000B\u000C\u000E-\u001F\u007F]/;
-const INVALID_SINGLE_LINE_CONTROL = /[\u0000-\u001F\u007F]/;
-function byteLength(value) {
+export const INVALID_SINGLE_LINE_CONTROL = /[\u0000-\u001F\u007F]/;
+export function byteLength(value) {
     return Buffer.byteLength(value, "utf8");
 }
 function boundedText(maxBytes, singleLine = false) {
@@ -25,6 +45,72 @@ function boundedText(maxBytes, singleLine = false) {
         .refine((value) => !invalidControl.test(value), "must not contain control characters")
         .refine((value) => value.trim().length > 0, "must not be blank");
 }
+/**
+ * Names the worker owns: its shell basics, anything that would redirect a
+ * process's loader or network proxy, and the registry proxy's and Wardby's own
+ * settings. No service may set one, whatever its catalog entry says.
+ */
+const RESERVED_SERVICE_ENV_NAMES = new Set([
+    "HOME",
+    "LANG",
+    "LC_ALL",
+    "PATH",
+    "SHELL",
+    "TMPDIR",
+    "USER",
+    "LD_PRELOAD",
+    "LD_LIBRARY_PATH",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "PYTHONPATH",
+    "PYTHONHOME",
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "ALL_PROXY",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+]);
+const RESERVED_SERVICE_ENV_PREFIXES = [
+    "WARDBY_",
+    "CODEX_",
+    "OPENAI_",
+    "ANTHROPIC_",
+    "PIP_",
+    "NPM_CONFIG_",
+    "UV_",
+    "GIT_",
+];
+export function isReservedServiceEnvName(name) {
+    return (RESERVED_SERVICE_ENV_NAMES.has(name) || RESERVED_SERVICE_ENV_PREFIXES.some((prefix) => name.startsWith(prefix)));
+}
+const serviceEnvValueSchema = z
+    .string()
+    .refine((value) => byteLength(value) <= MAX_CODING_SERVICE_ENV_VALUE_BYTES, `must be at most ${MAX_CODING_SERVICE_ENV_VALUE_BYTES} UTF-8 bytes`)
+    .refine((value) => !INVALID_SINGLE_LINE_CONTROL.test(value), "must not contain control characters");
+/** The variables one service hands the agent's shells: upper-case names wardby does not reserve. */
+export const CodingServiceTestEnvSchema = z.record(z.string(), serviceEnvValueSchema).superRefine((env, ctx) => {
+    const names = Object.keys(env);
+    if (names.length > MAX_CODING_SERVICE_ENV) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `must have at most ${MAX_CODING_SERVICE_ENV} variables` });
+    }
+    for (const name of names) {
+        if (!CODING_SERVICE_ENV_NAME.test(name) || isReservedServiceEnvName(name)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: [name],
+                message: "must be an upper-case variable name wardby does not reserve",
+            });
+        }
+    }
+});
+const workerServiceSchema = z
+    .object({
+    name: z.string().regex(CODING_SERVICE_NAME),
+    version: z.string().regex(CODING_SERVICE_VERSION),
+    testEnv: CodingServiceTestEnvSchema,
+})
+    .strict();
 function repositoryParts(value) {
     if (byteLength(value) > MAX_REPOSITORY_INPUT_BYTES || INVALID_SINGLE_LINE_CONTROL.test(value)) {
         throw new Error("invalid GitHub repository");
@@ -108,6 +194,25 @@ const repositorySchema = z
     .transform(normalizeGitHubRepository);
 export const CodingBaseRefSchema = z.string().refine(isGitRef, "must be a safe branch ref").transform(normalizeGitRef);
 export const CodingTaskOverrideSchema = boundedText(MAX_CODING_TASK_BYTES);
+/**
+ * A coding worker receives only its task text, so a coding agent's own
+ * instructions (its systemPrompt) travel inside that text, ahead of the
+ * request, followed by any note wardby generates for the run (the services it
+ * started: src/coding/services/note.ts). Blank instructions and no note leave
+ * the task unchanged. The combination must still fit MAX_CODING_TASK_BYTES;
+ * exceeding it is an error naming both parts rather than a silent truncation.
+ */
+export function composeCodingTask(instructions, task, note) {
+    const standing = [instructions?.trim(), note?.trim()].filter((part) => Boolean(part)).join("\n\n");
+    if (!standing)
+        return task;
+    const composed = `Standing instructions for this coding agent:\n${standing}\n\nRequest:\n${task}`;
+    if (byteLength(composed) > MAX_CODING_TASK_BYTES) {
+        throw new Error(`The coding agent's instructions (${byteLength(standing)} bytes) plus this task (${byteLength(task)} bytes) ` +
+            `exceed the ${MAX_CODING_TASK_BYTES}-byte coding task limit; shorten one of them.`);
+    }
+    return composed;
+}
 const runIdSchema = boundedText(MAX_RUN_ID_BYTES, true).refine((value) => /^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value), "must be an opaque identifier");
 const modelSchema = boundedText(MAX_MODEL_BYTES, true).refine((value) => /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(value), "must be a model identifier");
 const usageSchema = z
@@ -117,6 +222,30 @@ const usageSchema = z
     costUsd: z.number().finite().nonnegative().max(MAX_COST_USD),
 })
     .strict();
+const SAFE_TAG = new RegExp(`^[A-Za-z0-9][A-Za-z0-9._/-]{0,${MAX_TAG_BYTES - 1}}$`);
+/**
+ * The tag only labels a pull request title, so a model's malformed tag must not
+ * sink an otherwise finished run. A tag that already passes is kept as-is; any
+ * other string becomes a lowercase slug (runs of disallowed characters to "-",
+ * no leading or trailing punctuation, at most MAX_TAG_BYTES), and one with
+ * nothing usable left, or a non-string, becomes null. GitHub finalization still
+ * re-validates whatever survives.
+ */
+export function normalizeCodingTag(value) {
+    if (value === undefined || value === null)
+        return value;
+    if (typeof value !== "string")
+        return null;
+    if (SAFE_TAG.test(value))
+        return value;
+    const slug = value
+        .toLowerCase()
+        .replace(/[^a-z0-9._/-]+/g, "-")
+        .replace(/^[^a-z0-9]+/, "")
+        .slice(0, MAX_TAG_BYTES)
+        .replace(/[^a-z0-9]+$/, "");
+    return SAFE_TAG.test(slug) ? slug : null;
+}
 /**
  * A short, caller-visible reference (e.g. a ticket ID) surfaced in the PR title. Never free text.
  * Accepts null as well as undefined: OpenAI's strict Structured Outputs mode requires every
@@ -126,7 +255,7 @@ const usageSchema = z
  */
 const tagSchema = z
     .string()
-    .regex(new RegExp(`^[A-Za-z0-9][A-Za-z0-9._/-]{0,${MAX_TAG_BYTES - 1}}$`), "must be a short, safe tag")
+    .regex(SAFE_TAG, "must be a short, safe tag")
     .nullable()
     .optional()
     .transform((value) => value ?? undefined);
@@ -136,6 +265,8 @@ const testResultSchema = z
     outcome: z.enum(["passed", "failed", "skipped"]),
 })
     .strict();
+/** Longest line a debug-traced worker writes to its log (src/coding-worker/debug-trace.ts). */
+export const MAX_DEBUG_TRACE_LINE_BYTES = 16 * 1024;
 export const CodingTaskInputSchema = z
     .object({
     schemaVersion: z.literal(CODING_PROTOCOL_VERSION),
@@ -156,6 +287,21 @@ export const CodingTaskInputSchema = z
      * only enforces that headRef is internally consistent with it.
      */
     continuationOf: z.object({ runId: runIdSchema }).strict().optional(),
+    /**
+     * Admin-requested debug trace (CodingAgentProfile.debugTraceUntil): the
+     * worker writes its full stream trace to its own log. Absent means off;
+     * the control plane writes the key only when true, so an input for an
+     * untraced run is unchanged for workers that predate it.
+     */
+    debugTrace: z.boolean().optional(),
+    /**
+     * Coding-run services started next to this run (docs/coding-services.md):
+     * each one's catalog name and version, and the variables the agent's shells
+     * receive. Absent means none; the control plane writes the key only when a
+     * run has services, so every other input is unchanged for workers that
+     * predate it.
+     */
+    services: z.array(workerServiceSchema).min(1).max(MAX_CODING_SERVICES).optional(),
 })
     .strict()
     .superRefine((value, ctx) => {
@@ -167,6 +313,10 @@ export const CodingTaskInputSchema = z
             message: "must match wardby/run-<runId> (or wardby/run-<continuationOf.runId>)",
         });
     }
+    const names = (value.services ?? []).map((service) => service.name);
+    if (new Set(names).size !== names.length) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["services"], message: "must name each service once" });
+    }
 });
 export const CodingAgentOutputSchema = z
     .object({
@@ -175,7 +325,8 @@ export const CodingAgentOutputSchema = z
     outcome: z.enum(["changes_ready", "no_changes", "budget_exhausted"]),
     summary: boundedText(MAX_CODING_SUMMARY_BYTES),
     tests: z.array(testResultSchema).max(MAX_CODING_TESTS),
-    tag: tagSchema,
+    // Model-written, so normalized rather than rejected; see normalizeCodingTag.
+    tag: z.preprocess(normalizeCodingTag, tagSchema),
 })
     .strict()
     .transform((value) => ({

package/dist/coding/registry/adapters.d.ts

@@ -0,0 +1,2 @@
+import type { EcosystemId, RegistryAdapter } from "./types.js";
+export declare const REGISTRY_ADAPTERS: ReadonlyMap<EcosystemId, RegistryAdapter>;

package/dist/coding/registry/adapters.js

@@ -0,0 +1,9 @@
+/**
+ * The registry adapter map: every ecosystem the coding package registry
+ * proxies, keyed by its EcosystemId. Adding a new ecosystem means adding it
+ * here (and to the allowlist/profile validation that reads this map) --
+ * nothing else in the registry core hardcodes "npm" or "pypi".
+ */
+import { npmAdapter } from "./npm.js";
+import { pypiAdapter } from "./pypi.js";
+export const REGISTRY_ADAPTERS = new Map([npmAdapter, pypiAdapter].map((adapter) => [adapter.id, adapter]));

package/dist/coding/registry/allowlist.d.ts

@@ -0,0 +1,9 @@
+import type { AllowlistEntry, RegistryAdapter } from "./types.js";
+export type PackageAllowlist = Readonly<Record<string, readonly string[]>>;
+export interface PackagePolicy {
+    minReleaseAgeDays: number;
+}
+export declare const DEFAULT_MIN_RELEASE_AGE_DAYS = 3;
+export declare function resolvePolicy(value: unknown): PackagePolicy;
+export declare function parseAllowlist(allowlist: PackageAllowlist, adapters: ReadonlyMap<string, RegistryAdapter>): Map<string, AllowlistEntry[]>;
+export declare function matchRoot(entries: readonly AllowlistEntry[], normalizedName: string): AllowlistEntry | undefined;

package/dist/coding/registry/allowlist.js

@@ -0,0 +1,28 @@
+/**
+ * The per-agent package allowlist and policy model: parsing raw allowlist
+ * strings (via each ecosystem's adapter) into `AllowlistEntry` values, and
+ * matching a normalized package name against them.
+ */
+import { z } from "zod";
+export const DEFAULT_MIN_RELEASE_AGE_DAYS = 3;
+const PolicySchema = z
+    .object({ minReleaseAgeDays: z.number().int().min(0).max(30).default(DEFAULT_MIN_RELEASE_AGE_DAYS) })
+    .strict();
+export function resolvePolicy(value) {
+    return PolicySchema.parse(value ?? {});
+}
+export function parseAllowlist(allowlist, adapters) {
+    const parsed = new Map();
+    for (const [ecosystem, entries] of Object.entries(allowlist)) {
+        const adapter = adapters.get(ecosystem);
+        if (!adapter)
+            throw new Error(`unknown package ecosystem "${ecosystem}"`);
+        parsed.set(ecosystem, entries.map((entry) => adapter.parseAllowlistEntry(entry)));
+    }
+    return parsed;
+}
+export function matchRoot(entries, normalizedName) {
+    return entries.find((entry) => entry.wildcard
+        ? normalizedName.startsWith(entry.name) && normalizedName.length > entry.name.length
+        : entry.name === normalizedName);
+}

package/dist/coding/registry/json-scan.d.ts

@@ -0,0 +1,55 @@
+/**
+ * A streaming scan for one top-level member of a JSON object document,
+ * without ever holding the document: only the wanted member's value text is
+ * kept (bounded), and every other value, however large, is skipped as it
+ * streams past. Used to read an npm packument's `time` (per-version publish
+ * times), which comes after `versions` and can follow tens of MB of it.
+ *
+ * It is a tokenizer, not a validator: it tracks strings, escapes and
+ * nesting depth, which is all that locating a top-level member needs. The
+ * captured value is then parsed with JSON.parse, so a malformed value
+ * throws there. A document that is not an object, or that ends before the
+ * member closes, yields null.
+ */
+export declare class JsonMemberTooLarge extends Error {
+}
+export declare class TopLevelMemberScanner {
+    private readonly wanted;
+    private readonly maxValueLength;
+    private depth;
+    private inString;
+    private escape;
+    /** At depth 1, the next string is a key. */
+    private expectKey;
+    private collectingKey;
+    private key;
+    private lastKey;
+    /** After `"<wanted>":`, waiting for the value's first character. */
+    private pending;
+    private capturing;
+    private captured;
+    private capturedLength;
+    private finished;
+    private result;
+    private started;
+    constructor(wanted: string, maxValueLength: number);
+    /** True once the member was captured (or proven absent or not an
+     *  object), so the caller may stop reading. */
+    get done(): boolean;
+    /** The member's value, parsed; undefined while scanning or when absent. */
+    get value(): unknown;
+    /** Feeds the next decoded text. Throws JsonMemberTooLarge when the
+     *  member's value exceeds its bound. */
+    push(text: string): void;
+    private appendKey;
+    private capture;
+    private finish;
+}
+/** Reads `stream` (UTF-8 JSON) until the top-level member `wanted` has
+ *  been captured, then cancels the rest. Returns its parsed value, or
+ *  undefined when the document has no such object-valued member. At most
+ *  `maxBytes` of the stream are read; more throws JsonMemberTooLarge. */
+export declare function scanTopLevelMember(stream: ReadableStream<Uint8Array>, wanted: string, limits: {
+    maxBytes: number;
+    maxValueLength: number;
+}): Promise<unknown>;

package/dist/coding/registry/json-scan.js

@@ -0,0 +1,191 @@
+/**
+ * A streaming scan for one top-level member of a JSON object document,
+ * without ever holding the document: only the wanted member's value text is
+ * kept (bounded), and every other value, however large, is skipped as it
+ * streams past. Used to read an npm packument's `time` (per-version publish
+ * times), which comes after `versions` and can follow tens of MB of it.
+ *
+ * It is a tokenizer, not a validator: it tracks strings, escapes and
+ * nesting depth, which is all that locating a top-level member needs. The
+ * captured value is then parsed with JSON.parse, so a malformed value
+ * throws there. A document that is not an object, or that ends before the
+ * member closes, yields null.
+ */
+/** Longest top-level key compared; a longer one cannot be the wanted key. */
+const MAX_KEY_LENGTH = 256;
+export class JsonMemberTooLarge extends Error {
+}
+export class TopLevelMemberScanner {
+    wanted;
+    maxValueLength;
+    depth = 0;
+    inString = false;
+    escape = false;
+    /** At depth 1, the next string is a key. */
+    expectKey = false;
+    collectingKey = false;
+    key = "";
+    lastKey;
+    /** After `"<wanted>":`, waiting for the value's first character. */
+    pending = false;
+    capturing = false;
+    captured = [];
+    capturedLength = 0;
+    finished = false;
+    result = undefined;
+    started = false;
+    constructor(wanted, maxValueLength) {
+        this.wanted = wanted;
+        this.maxValueLength = maxValueLength;
+    }
+    /** True once the member was captured (or proven absent or not an
+     *  object), so the caller may stop reading. */
+    get done() {
+        return this.finished;
+    }
+    /** The member's value, parsed; undefined while scanning or when absent. */
+    get value() {
+        return this.result;
+    }
+    /** Feeds the next decoded text. Throws JsonMemberTooLarge when the
+     *  member's value exceeds its bound. */
+    push(text) {
+        if (this.finished)
+            return;
+        let segmentStart = this.capturing ? 0 : -1;
+        const length = text.length;
+        let i = 0;
+        while (i < length) {
+            if (this.inString) {
+                if (this.escape) {
+                    this.escape = false;
+                    if (this.collectingKey)
+                        this.appendKey(text[i]);
+                    i += 1;
+                    continue;
+                }
+                // Skip ahead to the next quote or backslash: the bulk of a
+                // packument is string content, never looked at char by char.
+                const quote = text.indexOf('"', i);
+                const backslash = text.indexOf("\\", i);
+                const stop = quote < 0 ? backslash : backslash < 0 ? quote : Math.min(quote, backslash);
+                if (stop < 0) {
+                    if (this.collectingKey)
+                        this.appendKey(text.slice(i));
+                    break;
+                }
+                if (this.collectingKey)
+                    this.appendKey(text.slice(i, stop));
+                if (stop === backslash) {
+                    this.escape = true;
+                    if (this.collectingKey)
+                        this.appendKey("\\");
+                    i = stop + 1;
+                    continue;
+                }
+                this.inString = false;
+                if (this.collectingKey) {
+                    this.collectingKey = false;
+                    this.lastKey = this.key;
+                }
+                i = stop + 1;
+                continue;
+            }
+            const c = text[i];
+            if (c === " " || c === "\n" || c === "\r" || c === "\t") {
+                i += 1;
+                continue;
+            }
+            if (!this.started) {
+                this.started = true;
+                if (c !== "{")
+                    return this.finish(undefined);
+            }
+            if (this.pending) {
+                this.pending = false;
+                if (c !== "{")
+                    return this.finish(undefined);
+                this.capturing = true;
+                segmentStart = i;
+            }
+            if (c === '"') {
+                this.inString = true;
+                if (this.depth === 1 && this.expectKey) {
+                    this.collectingKey = true;
+                    this.key = "";
+                    this.expectKey = false;
+                }
+            }
+            else if (c === "{" || c === "[") {
+                this.depth += 1;
+                if (this.depth === 1)
+                    this.expectKey = true;
+            }
+            else if (c === "}" || c === "]") {
+                this.depth -= 1;
+                if (this.capturing && this.depth === 1) {
+                    this.capture(text.slice(segmentStart, i + 1));
+                    return this.finish(JSON.parse(this.captured.join("")));
+                }
+                if (this.depth === 0)
+                    return this.finish(undefined);
+            }
+            else if (c === ":") {
+                if (this.depth === 1 && this.lastKey === this.wanted)
+                    this.pending = true;
+            }
+            else if (c === ",") {
+                if (this.depth === 1) {
+                    this.expectKey = true;
+                    this.lastKey = undefined;
+                }
+            }
+            i += 1;
+        }
+        if (this.capturing && segmentStart >= 0)
+            this.capture(text.slice(segmentStart));
+    }
+    appendKey(part) {
+        if (this.key.length <= MAX_KEY_LENGTH)
+            this.key += part.slice(0, MAX_KEY_LENGTH + 1 - this.key.length);
+    }
+    capture(part) {
+        this.capturedLength += part.length;
+        if (this.capturedLength > this.maxValueLength)
+            throw new JsonMemberTooLarge(`"${this.wanted}" is too large`);
+        this.captured.push(part);
+    }
+    finish(value) {
+        this.finished = true;
+        this.result = value;
+        this.captured = [];
+    }
+}
+/** Reads `stream` (UTF-8 JSON) until the top-level member `wanted` has
+ *  been captured, then cancels the rest. Returns its parsed value, or
+ *  undefined when the document has no such object-valued member. At most
+ *  `maxBytes` of the stream are read; more throws JsonMemberTooLarge. */
+export async function scanTopLevelMember(stream, wanted, limits) {
+    const scanner = new TopLevelMemberScanner(wanted, limits.maxValueLength);
+    const decoder = new TextDecoder("utf-8");
+    const reader = stream.getReader();
+    let bytes = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done) {
+                scanner.push(decoder.decode());
+                return scanner.value;
+            }
+            bytes += value.byteLength;
+            if (bytes > limits.maxBytes)
+                throw new JsonMemberTooLarge(`the document is larger than ${limits.maxBytes} bytes`);
+            scanner.push(decoder.decode(value, { stream: true }));
+            if (scanner.done)
+                return scanner.value;
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+}

package/dist/coding/registry/lockfiles.d.ts

@@ -0,0 +1,6 @@
+/** Normalises every recognised lockfile under `workspace`; returns the
+ *  workspace-relative paths it rewrote, sorted. */
+export declare function normalizeRegistryLockfiles(input: {
+    workspace: string;
+    proxyBaseUrl: string;
+}): Promise<string[]>;

package/dist/coding/registry/lockfiles.js

@@ -0,0 +1,89 @@
+/**
+ * Rewrites the proxy download URLs a package manager records in lockfiles
+ * back to public ones, for every adapter with a `lockfiles` hook. The driver
+ * runs this on the workspace before it is collected, so a committed lockfile
+ * never points at the sandbox-only proxy host.
+ *
+ * Best effort by design: a file that cannot be read or written safely is
+ * skipped, never a reason to fail the run. The walk never follows symlinks
+ * and skips the folders collection excludes by name (dependency and cache
+ * folders), which are never sent back anyway.
+ */
+import { constants } from "node:fs";
+import { open, readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { BUILTIN_COLLECT_EXCLUDE_NAMES } from "../collect-exclude.js";
+import { REGISTRY_ADAPTERS } from "./adapters.js";
+import { registryUrlFor } from "./worker-config.js";
+const MAX_LOCKFILE_BYTES = 64 * 1024 * 1024;
+const MAX_DEPTH = 32;
+const SKIPPED_DIRECTORIES = new Set([...BUILTIN_COLLECT_EXCLUDE_NAMES, ".git"]);
+/** Rewrites one file in place through a single descriptor (no symlinks, no
+ *  path re-resolution between the checks and the write). Returns whether it
+ *  changed; any failure leaves the file as it was found or skips it. */
+async function normalizeFile(path, normalize) {
+    let file;
+    try {
+        file = await open(path, constants.O_RDWR | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    }
+    catch {
+        return false;
+    }
+    try {
+        const metadata = await file.stat();
+        if (!metadata.isFile() || metadata.size > MAX_LOCKFILE_BYTES)
+            return false;
+        const before = (await file.readFile()).toString("utf8");
+        const after = normalize(before);
+        if (after === before)
+            return false;
+        await file.truncate(0);
+        await file.write(after, 0, "utf8");
+        return true;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        await file.close();
+    }
+}
+/** Normalises every recognised lockfile under `workspace`; returns the
+ *  workspace-relative paths it rewrote, sorted. */
+export async function normalizeRegistryLockfiles(input) {
+    const byName = new Map();
+    for (const adapter of REGISTRY_ADAPTERS.values()) {
+        const lockfiles = adapter.lockfiles;
+        if (!lockfiles)
+            continue;
+        const registryUrl = registryUrlFor(input.proxyBaseUrl, adapter.id);
+        for (const name of lockfiles.names)
+            byName.set(name, (content) => lockfiles.normalize(content, registryUrl));
+    }
+    const rewritten = [];
+    const walk = async (relative, depth) => {
+        let entries;
+        try {
+            entries = await readdir(join(input.workspace, relative), { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const path = relative ? `${relative}/${entry.name}` : entry.name;
+            // Dirent types come from lstat semantics: a symlink is neither a directory nor a file here.
+            if (entry.isDirectory()) {
+                if (depth < MAX_DEPTH && !SKIPPED_DIRECTORIES.has(entry.name))
+                    await walk(path, depth + 1);
+            }
+            else if (entry.isFile()) {
+                const normalize = byName.get(entry.name);
+                if (normalize && (await normalizeFile(join(input.workspace, path), normalize)))
+                    rewritten.push(path);
+            }
+        }
+    };
+    if (byName.size > 0)
+        await walk("", 0);
+    return rewritten.sort();
+}

package/dist/coding/registry/npm-lockfile.d.ts

@@ -0,0 +1,9 @@
+/** Same shape as the adapter's allowlist name check (scoped names are lower case). */
+export declare const PACKAGE_NAME: RegExp;
+/** `https://registry.npmjs.org/@scope/pkg/-/pkg-1.0.0.tgz` */
+export declare function publicNpmTarballUrl(name: string, version: string): string;
+export declare function normalizeNpmLockfile(content: string, registryUrl: string): string;
+export declare const npmLockfiles: {
+    readonly names: readonly ["package-lock.json", "npm-shrinkwrap.json"];
+    readonly normalize: typeof normalizeNpmLockfile;
+};