@wardby/cli 0.6.0 → 0.7.0

package/dist/providers/coding-proxy/registry/lockfile-parse-worker.js

@@ -0,0 +1,67 @@
+/**
+ * Runs inside a worker thread spawned by lockfile-parse.ts: parses one
+ * lockfile with the ecosystem's own parser, off the proxy's event loop, and
+ * posts back a plain, structured-cloneable form of the result (entries,
+ * projects, and the edge table `resolve` answers from). `parentPort` is
+ * null when this file is merely imported, so nothing runs then.
+ */
+import { parentPort } from "node:worker_threads";
+import { REGISTRY_ADAPTERS } from "../../../coding/registry/adapters.js";
+import { RegistryError } from "../../../coding/registry/types.js";
+/** At most this many edges per entry are shipped (far above any real
+ *  package's dependency count), so a crafted entry with a huge dependency
+ *  map can't make the main thread deserialize millions of them. */
+const MAX_EDGES_PER_ENTRY = 2000;
+export function parseAndShip(request) {
+    const support = REGISTRY_ADAPTERS.get(request.ecosystem)?.lockfilePlan;
+    if (!support)
+        throw new RegistryError(404, "wardby_plan_unsupported", `no lockfile plans for ${request.ecosystem}`);
+    const parsed = support.parse(request.body, {
+        maxEntries: request.maxEntries,
+        proxyRegistryUrl: request.proxyRegistryUrl,
+    });
+    if (!parsed.dependencyKeys)
+        throw new Error("this lockfile format cannot be parsed off the event loop");
+    const index = new Map(parsed.entries.map((entry, at) => [entry, at]));
+    const edgesOf = (path, what) => {
+        let keys = parsed.dependencyKeys(path);
+        // A project's edges only label audited packages top-level (best effort):
+        // past the bound they are cut, never a reason to refuse the plan.
+        if (what === "project")
+            keys = keys.slice(0, MAX_EDGES_PER_ENTRY);
+        if (keys.length > MAX_EDGES_PER_ENTRY)
+            throw new RegistryError(413, "wardby_lockfile_too_large", `lockfile ${what} "${path}" lists ${keys.length} dependencies; at most ${MAX_EDGES_PER_ENTRY} are read`);
+        const out = [];
+        for (const key of keys) {
+            const target = parsed.resolve(path, key);
+            const at = target && index.get(target);
+            if (at !== undefined && at !== null)
+                out.push([key, at]);
+        }
+        return out;
+    };
+    return {
+        entries: parsed.entries,
+        projects: parsed.projects,
+        ...(parsed.integrity ? { integrity: parsed.integrity } : {}),
+        edges: parsed.entries.map((entry) => edgesOf(entry.path, "entry")),
+        projectEdges: parsed.projects.map((project) => edgesOf(project.path, "project")),
+    };
+}
+/** The answer for one parse: the lockfile, the parser's refusal, or (a bug,
+ *  not a verdict about the lockfile) the unexpected error's message, which
+ *  the main thread logs. */
+export function responseFor(parse) {
+    try {
+        return { ok: true, lockfile: parse() };
+    }
+    catch (error) {
+        if (error instanceof RegistryError)
+            return { ok: false, status: error.status, code: error.code, message: error.message };
+        return { ok: false, unexpected: true, message: error instanceof Error ? String(error) : "unknown error" };
+    }
+}
+if (parentPort) {
+    const port = parentPort;
+    port.on("message", (request) => port.postMessage(responseFor(() => parseAndShip(request))));
+}

package/dist/providers/coding-proxy/registry/lockfile-parse.d.ts

@@ -0,0 +1,16 @@
+import { type ParsedLockfile } from "../../../coding/registry/types.js";
+/** Time one off-thread lockfile parse may take. Real lockfiles at the
+ *  entry bound parse in well under a second. */
+export declare const DEFAULT_LOCKFILE_PARSE_TIMEOUT_MS = 15000;
+export declare function parseWorkerHeapMb(maxEntries: number): number;
+export declare function parseLockfileOffThread(ecosystem: string, body: string, options: {
+    maxEntries: number;
+    proxyRegistryUrl: string;
+}, limits?: {
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    /** Heap bound for the worker (default parseWorkerHeapMb(maxEntries)). */
+    maxOldGenerationSizeMb?: number;
+    /** Tests only: the worker script to run. */
+    workerUrl?: URL;
+}): Promise<ParsedLockfile>;

package/dist/providers/coding-proxy/registry/lockfile-parse.js

@@ -0,0 +1,110 @@
+/**
+ * Parses a lockfile in a disposable worker thread with a hard time bound,
+ * for the formats that are costly to read (pnpm's and yarn's: YAML, or
+ * yarn classic's own format). A lockfile is attacker-controlled up to the
+ * 20 MiB plan cap, and a synchronous parse can't be interrupted, so on the
+ * event loop a crafted one could stall every request the proxy serves (model
+ * traffic included) for seconds. A worker's terminate() can stop it; the
+ * event loop only deserializes the bounded result (entries and their edges).
+ *
+ * One worker per parse, never reused (the same choice as the sandbox's
+ * parser pool): plans already run at most `planConcurrency` at once.
+ */
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { Worker } from "node:worker_threads";
+import { RegistryError } from "../../../coding/registry/types.js";
+/** Time one off-thread lockfile parse may take. Real lockfiles at the
+ *  entry bound parse in well under a second. */
+export const DEFAULT_LOCKFILE_PARSE_TIMEOUT_MS = 15_000;
+/** Heap one parse worker may use before it is stopped, per 5000 entries
+ *  the plan may have (REGISTRY_PLAN_MAX_ENTRIES, at least the default's
+ *  share). A realistic 5000-entry pnpm-lock.yaml (3.4 MiB: peers, engines,
+ *  six dependencies a snapshot) needs 129 to 160 MiB of it, so 384 MiB is
+ *  about 2.5 times that; a crafted lockfile that expands further is
+ *  stopped there and refused as too large. */
+const PARSE_WORKER_HEAP_MB_PER_5000_ENTRIES = 384;
+export function parseWorkerHeapMb(maxEntries) {
+    return Math.ceil((PARSE_WORKER_HEAP_MB_PER_5000_ENTRIES * Math.max(maxEntries, 5000)) / 5000);
+}
+const compiledWorker = new URL("./lockfile-parse-worker.js", import.meta.url);
+// Under tsx/vitest only the .ts source exists, and a worker gets no TS
+// loader by inheritance (see src/sandbox/parser-worker/pool.ts).
+const WORKER_URL = existsSync(fileURLToPath(compiledWorker))
+    ? compiledWorker
+    : new URL("./lockfile-parse-worker.ts", import.meta.url);
+function incomplete(message) {
+    return new RegistryError(503, "wardby_plan_incomplete", message);
+}
+/** The ParsedLockfile a worker shipped back, with `resolve` answering from
+ *  its edge table. */
+function rebuild(shipped) {
+    const byPath = new Map();
+    shipped.entries.forEach((entry, at) => {
+        byPath.set(entry.path, new Map(shipped.edges[at].map(([key, target]) => [key, shipped.entries[target]])));
+    });
+    // A project's own dependencies (what package audit mode labels top-level);
+    // a path an entry also uses keeps the entry's, as the parser's resolve does.
+    shipped.projects.forEach((project, at) => {
+        if (byPath.has(project.path))
+            return;
+        byPath.set(project.path, new Map(shipped.projectEdges[at].map(([key, target]) => [key, shipped.entries[target]])));
+    });
+    return {
+        entries: shipped.entries,
+        projects: shipped.projects,
+        ...(shipped.integrity ? { integrity: shipped.integrity } : {}),
+        resolve: (fromPath, key) => byPath.get(fromPath)?.get(key),
+        dependencyKeys: (path) => [...(byPath.get(path)?.keys() ?? [])],
+    };
+}
+export async function parseLockfileOffThread(ecosystem, body, options, limits = {}) {
+    const timeoutMs = limits.timeoutMs ?? DEFAULT_LOCKFILE_PARSE_TIMEOUT_MS;
+    if (limits.signal?.aborted)
+        throw incomplete("the client went away before the lockfile was read");
+    const workerUrl = limits.workerUrl ?? WORKER_URL;
+    const worker = new Worker(workerUrl, {
+        resourceLimits: { maxOldGenerationSizeMb: limits.maxOldGenerationSizeMb ?? parseWorkerHeapMb(options.maxEntries) },
+        execArgv: workerUrl.pathname.endsWith(".ts") ? ["--import", "tsx/esm"] : [],
+    });
+    try {
+        const response = await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => reject(incomplete(`the lockfile was not read within ${Math.round(timeoutMs / 1000)} s`)), timeoutMs);
+            const onAbort = () => reject(incomplete("the client went away before the lockfile was read"));
+            limits.signal?.addEventListener("abort", onAbort, { once: true });
+            const settle = () => {
+                clearTimeout(timer);
+                limits.signal?.removeEventListener("abort", onAbort);
+            };
+            worker.once("message", (message) => {
+                settle();
+                resolve(message);
+            });
+            worker.once("error", (error) => {
+                settle();
+                // Out of heap: the lockfile expanded too far, a verdict about it.
+                // Anything else (the worker failed to load, crashed) is the proxy's
+                // own failure: a plain error, which the plan route logs and answers
+                // as a failure to verify, never as a refusal of the lockfile.
+                reject(error.code === "ERR_WORKER_OUT_OF_MEMORY"
+                    ? new RegistryError(413, "wardby_lockfile_too_large", "the lockfile needs too much memory to read")
+                    : new Error(`the lockfile reader failed: ${error.message}`, { cause: error }));
+            });
+            worker.once("exit", (code) => {
+                settle();
+                reject(new Error(`the lockfile reader stopped (exit code ${code})`));
+            });
+            const request = { ecosystem, body, ...options };
+            worker.postMessage(request);
+        });
+        if (!response.ok) {
+            if ("unexpected" in response)
+                throw new Error(`the lockfile reader failed: ${response.message}`);
+            throw new RegistryError(response.status, response.code, response.message);
+        }
+        return rebuild(response.lockfile);
+    }
+    finally {
+        await worker.terminate().catch(() => undefined);
+    }
+}

package/dist/providers/coding-proxy/registry/plan.d.ts

@@ -1,3 +1,4 @@
+import type { PackageAuditMode } from "../../../coding/registry/audit-mode.js";
 import { type AllowlistEntry, type LockfilePlanSupport, type ParsedLockfile, type RegistryAdapter, type UpstreamFetch } from "../../../coding/registry/types.js";
 import { type AuditedVersion, type WithheldVersions } from "./audit.js";
 import type { ApprovedVersion, StoredVersionFact } from "./store.js";
@@ -28,6 +29,8 @@ export interface PlanRefusal {
 export interface PlanResult {
     approved: ApprovedVersion[];
     refused: PlanRefusal[];
+    /** Approvals carrying an audit verdict (package audit mode only; 0 otherwise). */
+    audited: number;
 }
 export interface PlanFacts {
     getVersionFacts(versions: readonly {
@@ -49,6 +52,12 @@ export interface PlanInput {
     /** Unbuffered fetch for streamed package documents. */
     streamUpstream: UpstreamFetch;
     audit(versions: readonly AuditedVersion[], signal: AbortSignal): Promise<WithheldVersions>;
+    /** The run's accepted advisory ids (packagePolicy.acceptedAdvisories):
+     *  blocking advisories they waive do not refuse a version (see
+     *  `isWaived`; malware is never waived). Absent or empty waives nothing. */
+    accepted?: ReadonlySet<string>;
+    /** The run's package audit mode (CodingRun.packageAuditMode); absent or null = normal enforcement. */
+    auditMode?: PackageAuditMode | null;
     hostAllowed(url: string): boolean;
     signal: AbortSignal;
     factConcurrency?: number;

package/dist/providers/coding-proxy/registry/plan.js

@@ -4,24 +4,38 @@
  * lockfile claims is trusted:
  *
  * - every entry's integrity must equal the registry's own for that exact
- *   version (a per-version fact read from the registry, stored forever);
+ *   version (a per-version fact read from the registry, stored forever),
+ *   unless the format records no npm integrity at all (yarn Berry): then
+ *   the approval is the exact name@version, and the download is checked
+ *   against the registry's integrity alone;
  * - edges come from the registry too: a parent version's declared
  *   dependencies, resolved to lockfile entries by the client's own rule
  *   (npm: nearest ancestor node_modules), and kept only when the entry is
  *   the declared package at a version inside the declared range;
- * - reachability starts at the projects' dependencies that are allowlist
- *   roots (at a version inside the root's range) and follows only verified
- *   edges, through versions old enough and without a HIGH/CRITICAL advisory.
+ * - reachability starts at every lockfile entry that is an allowlist root
+ *   (at a version inside the root's range), wherever it sits and whether or
+ *   not a project declares it, and follows only verified
+ *   edges, through versions old enough and without a HIGH/CRITICAL advisory
+ *   (one the run's accepted set waives does not count; malware always does).
+ *
+ * PyPI dependency lines may be gated on extras: an entry is expanded with the
+ * extras it is installed with (a start's allowlist entry's, then those its
+ * parents' lines ask of it), and a plain install follows none.
  *
  * A refused entry refuses itself and whatever is reachable only through it;
- * everything else is approved, as exact name@version pairs. The work is
+ * everything else is approved, as exact name@version pairs (an ecosystem
+ * that `approves: "names"` turns them into name allowances). In package
+ * audit mode every registry entry is a start as well: one the allowlist does
+ * not reach is approved when it passes every other check, marked with its
+ * audit verdict (and, in `full`, a version kept only past non-malware
+ * blocking advisories is approved and marked too). The work is
  * bounded: facts are fetched only for entries reached (so a lockfile of
  * unrelated packages costs nothing upstream), with bounded concurrency and a
  * deadline.
  */
 import { matchRoot } from "../../../coding/registry/allowlist.js";
 import { RegistryError, } from "../../../coding/registry/types.js";
-import { versionKey } from "./audit.js";
+import { auditAdvisoryOf, splitWaived, versionKey } from "./audit.js";
 export const DEFAULT_PLAN_MAX_ENTRIES = 5000;
 export const DEFAULT_PLAN_TIMEOUT_MS = 120_000;
 /** Per-version documents fetched at once (each is a few KB). */
@@ -61,21 +75,29 @@ export async function verifyLockfilePlan(input) {
                 reason: entry.unsupportedReason ?? "cannot be verified against the registry",
             });
     }
-    // Starting points: what the projects themselves declare, when it is an
-    // allowlist root at a version inside the root's range.
+    // Starting points: every registry entry that is an allowlist root at a
+    // version inside the root's range, wherever it sits in the lockfile and
+    // whether or not a project declares it. An allowlisted name may be
+    // installed by name anyway (the download path allows the same name@version:
+    // `authorize` matches the name with `matchRoot`, and `keptVersions`
+    // applies the root's range, release age and advisories), so an `overrides`-forced version of it, which no parent's
+    // declared range reaches, is a start in its own right. Every start still
+    // passes the fact checks below (integrity, release age, advisories), and
+    // edges are still followed only inside declared ranges.
     const starts = new Set();
-    for (const project of lockfile.projects) {
-        for (const dependency of project.dependencies) {
-            const entry = lockfile.resolve(project.path, dependency.key);
-            if (!entry || entry.kind !== "registry" || entry.name !== dependency.name)
-                continue;
-            const root = matchRoot(input.roots, adapter.normalizeName(entry.name));
-            if (!root)
-                continue;
-            if (root.range && !safeSatisfies(adapter, entry.version, root.range))
-                continue;
-            starts.add(entry);
-        }
+    // The extras each reached entry is installed with (PyPI): a start's are its
+    // allowlist entry's, a child's those its parents' lines ask of it.
+    const extrasOf = new Map();
+    for (const entry of lockfile.entries) {
+        if (entry.kind !== "registry")
+            continue;
+        const root = matchRoot(input.roots, adapter.normalizeName(entry.name));
+        if (!root)
+            continue;
+        if (root.range && !safeSatisfies(adapter, entry.version, root.range))
+            continue;
+        starts.add(entry);
+        extrasOf.set(entry, new Set(root.extras ?? []));
     }
     // Breadth first over verified edges, fetching facts one layer at a time
     // (only for entries actually reached).
@@ -83,11 +105,28 @@ export async function verifyLockfilePlan(input) {
     const edges = new Map();
     const candidates = new Set();
     const visited = new Set(starts);
+    // Package audit mode: every other registry entry starts too, except an
+    // allowlisted name outside its entry's own range (an owner's explicit
+    // restriction, never widened by audit mode). Visited after the roots'
+    // graph, so facts load in the same bounded layers.
+    const auditStarts = input.auditMode
+        ? lockfile.entries.filter((entry) => entry.kind === "registry" &&
+            !starts.has(entry) &&
+            !outsideRootRange(input, adapter.normalizeName(entry.name), entry.version))
+        : [];
     let layer = [...starts];
-    while (layer.length > 0) {
+    let auditSeeded = false;
+    while (layer.length > 0 || (!auditSeeded && auditStarts.length > 0)) {
+        if (layer.length === 0) {
+            auditSeeded = true;
+            layer = auditStarts.filter((entry) => !visited.has(entry));
+            for (const entry of layer)
+                visited.add(entry);
+            continue;
+        }
         signal.throwIfAborted();
         await loadFacts(input, layer, outcomes);
-        const next = [];
+        const next = new Set();
         for (const entry of layer) {
             const outcome = outcomes.get(versionKey(entry.name, entry.version));
             if ("refusal" in outcome) {
@@ -95,7 +134,8 @@ export async function verifyLockfilePlan(input) {
                 continue;
             }
             const { fact } = outcome;
-            if (entry.integrity === null || entry.integrity.trim() !== fact.integrity) {
+            if (lockfile.integrity !== "registry" &&
+                (entry.integrity === null || entry.integrity.trim() !== fact.integrity)) {
                 refusals.set(entry, {
                     code: "wardby_lockfile_integrity_mismatch",
                     reason: `the lockfile's integrity is not the registry's for ${entry.name}@${entry.version}`,
@@ -113,34 +153,63 @@ export async function verifyLockfilePlan(input) {
             }
             candidates.add(entry);
             const children = [];
-            for (const dependency of fact.dependencies) {
-                const child = lockfile.resolve(entry.path, dependency.key);
-                if (!child || child.kind !== "registry" || child.name !== dependency.name)
-                    continue;
-                if (!support.edgeSatisfies(child.version, dependency.range))
-                    continue;
-                children.push(child);
-                if (!visited.has(child)) {
-                    visited.add(child);
-                    next.push(child);
+            const dependencies = support.dependenciesOf
+                ? support.dependenciesOf(fact, [...(extrasOf.get(entry) ?? [])].sort())
+                : fact.dependencies;
+            for (const dependency of dependencies) {
+                const resolved = lockfile.resolveAll
+                    ? lockfile.resolveAll(entry.path, dependency.key)
+                    : [lockfile.resolve(entry.path, dependency.key)];
+                for (const child of resolved) {
+                    if (!child || child.kind !== "registry" || child.name !== dependency.name)
+                        continue;
+                    if (!support.edgeSatisfies(child.version, dependency.range))
+                        continue;
+                    children.push(child);
+                    const asked = dependency.extras ?? [];
+                    if (!visited.has(child)) {
+                        visited.add(child);
+                        extrasOf.set(child, new Set(asked));
+                        next.add(child);
+                        continue;
+                    }
+                    // Reached again with extras it lacked: expanded again, now with them
+                    // (extras only grow, so this ends).
+                    const known = extrasOf.get(child) ?? new Set();
+                    if (asked.some((extra) => !known.has(extra))) {
+                        for (const extra of asked)
+                            known.add(extra);
+                        extrasOf.set(child, known);
+                        next.add(child);
+                    }
                 }
             }
             edges.set(entry, children);
         }
-        layer = next;
+        layer = [...next];
     }
     // One advisory lookup for every candidate version.
     const withheld = await input.audit([...new Map([...candidates].map((entry) => [versionKey(entry.name, entry.version), entry])).values()].map(({ name, version }) => ({ name, version })), signal);
+    // Advisories the run's accepted set waived, per approved name@version,
+    // and (full mode) the blocking ones served past.
+    const waivers = new Map();
+    const auditAdvisories = new Map();
     for (const entry of candidates) {
-        const ids = withheld.get(versionKey(entry.name, entry.version));
-        if (ids && ids.length > 0) {
+        const key = versionKey(entry.name, entry.version);
+        const split = splitWaived(withheld.get(key) ?? [], input.accepted, { auditAll: input.auditMode === "full" });
+        if (split.audited.length > 0)
+            auditAdvisories.set(key, split.audited.map(auditAdvisoryOf));
+        if (split.withheld.length > 0) {
             candidates.delete(entry);
             refusals.set(entry, {
                 code: "wardby_version_filtered",
-                reason: `withheld by advisory ${ids.join(", ")} (high severity or malware)`,
+                reason: `withheld by advisory ${split.withheld.map(({ id }) => id).join(", ")} (high severity or malware)`,
                 intrinsic: true,
             });
         }
+        else if (split.waived.length > 0) {
+            waivers.set(key, split.waived.map(({ id }) => id));
+        }
     }
     // Reachability again, now only through entries that passed every check:
     // a refused entry refuses whatever is reachable only through it.
@@ -157,16 +226,38 @@ export async function verifyLockfilePlan(input) {
             queue.push(child);
         }
     }
+    // Package audit mode: every other entry that passed every check is
+    // approved too, marked with how it reached the lockfile.
+    const relations = input.auditMode
+        ? auditRelations(input, approvedEntries, candidates, edges)
+        : new Map();
     const approved = new Map();
-    for (const entry of approvedEntries) {
-        const outcome = outcomes.get(versionKey(entry.name, entry.version));
-        if (outcome && "fact" in outcome)
-            approved.set(versionKey(entry.name, entry.version), {
-                name: entry.name,
-                version: entry.version,
-                integrity: outcome.fact.integrity,
-            });
-    }
+    const approve = (entry, relation) => {
+        const key = versionKey(entry.name, entry.version);
+        const outcome = outcomes.get(key);
+        if (!outcome || !("fact" in outcome) || approved.has(key))
+            return;
+        const acceptedAdvisories = waivers.get(key);
+        const advisories = auditAdvisories.get(key);
+        const audit = relation
+            ? { ...relation, ...(advisories ? { advisories } : {}) }
+            : advisories
+                ? { relation: "allowed", advisories }
+                : undefined;
+        approved.set(key, {
+            name: entry.name,
+            version: entry.version,
+            integrity: outcome.fact.integrity,
+            ...(acceptedAdvisories ? { acceptedAdvisories } : {}),
+            ...(audit ? { audit } : {}),
+        });
+    };
+    // Approvals through the allowlist first: an exact version approved both
+    // ways is not audited.
+    for (const entry of approvedEntries)
+        approve(entry, undefined);
+    for (const [entry, relation] of relations)
+        approve(entry, relation);
     const refused = new Map();
     for (const entry of lockfile.entries) {
         if (entry.kind === "bundled")
@@ -182,7 +273,59 @@ export async function verifyLockfilePlan(input) {
     }
     // An entry refused at one place in the tree but approved at another (the
     // same name@version) is approved: approvals are per exact version.
-    return { approved: [...approved.values()], refused: [...refused.values()] };
+    const approvals = [...approved.values()];
+    return {
+        approved: approvals,
+        refused: [...refused.values()],
+        audited: approvals.filter((approval) => approval.audit).length,
+    };
+}
+/** Whether `name@version` is an allowlisted name at a version its entry's range excludes. */
+function outsideRootRange(input, name, version) {
+    const root = matchRoot(input.roots, name);
+    return !!root?.range && !safeSatisfies(input.adapter, version, root.range);
+}
+/**
+ * How each candidate the allowlist does not reach came into the lockfile
+ * (package audit mode): `top-level` when a lockfile project declares it,
+ * `transitive` when an audited top-level entry reaches it over verified
+ * edges (`via` its nearest such ancestor, breadth first), otherwise
+ * `unknown`. Best effort: it decides only what a reviewer is shown.
+ */
+function auditRelations(input, approvedEntries, candidates, edges) {
+    const { lockfile } = input;
+    // An allowlisted name outside its entry's range is never audited in,
+    // even when an audited package declares it.
+    const audited = new Set([...candidates].filter((entry) => !approvedEntries.has(entry) && !outsideRootRange(input, input.adapter.normalizeName(entry.name), entry.version)));
+    const relations = new Map();
+    const declared = new Set();
+    for (const project of lockfile.projects)
+        for (const dependency of project.dependencies) {
+            const entry = lockfile.resolve(project.path, dependency.key);
+            if (entry)
+                declared.add(entry);
+        }
+    const queue = [];
+    for (const entry of audited)
+        if (declared.has(entry)) {
+            relations.set(entry, { relation: "top-level" });
+            queue.push(entry);
+        }
+    const via = new Map(queue.map((entry) => [entry, entry.name]));
+    while (queue.length > 0) {
+        const entry = queue.shift();
+        for (const child of edges.get(entry) ?? []) {
+            if (via.has(child) || !audited.has(child))
+                continue;
+            via.set(child, via.get(entry));
+            relations.set(child, { relation: "transitive", via: via.get(entry) });
+            queue.push(child);
+        }
+    }
+    for (const entry of audited)
+        if (!relations.has(entry))
+            relations.set(entry, { relation: "unknown" });
+    return relations;
 }
 function safeSatisfies(adapter, version, range) {
     try {
@@ -213,6 +356,7 @@ async function loadFacts(input, layer, outcomes) {
     if (missing.length === 0)
         return;
     const fresh = new Map();
+    const complete = [];
     await eachLimited(missing, input.factConcurrency ?? DEFAULT_PLAN_FACT_CONCURRENCY, async ({ name, version }) => {
         const key = versionKey(name, version);
         try {
@@ -227,6 +371,13 @@ async function loadFacts(input, layer, outcomes) {
                 });
                 return;
             }
+            // A registry that gives the publish time with the version (PyPI) needs no second read.
+            if (fact.publishedAt) {
+                const stored = { ...fact, publishedAt: fact.publishedAt };
+                complete.push(stored);
+                outcomes.set(key, checkedFact(input, stored));
+                return;
+            }
             fresh.set(key, fact);
         }
         catch (error) {
@@ -239,7 +390,6 @@ async function loadFacts(input, layer, outcomes) {
     const byName = new Map();
     for (const fact of fresh.values())
         byName.set(fact.name, [...(byName.get(fact.name) ?? []), fact.version]);
-    const complete = [];
     await eachLimited([...byName.entries()], input.timeConcurrency ?? DEFAULT_PLAN_TIME_CONCURRENCY, async ([name, versions]) => {
         let times;
         try {
@@ -300,5 +450,8 @@ function upstreamRefusal(error) {
         return { code: "wardby_metadata_too_large", reason: error.message };
     if (error instanceof RegistryError && error.code === "wardby_package_not_found")
         return { code: "wardby_package_not_found", reason: error.message };
+    // A release with nothing the registry may serve (PyPI: no wheel) stays so.
+    if (error instanceof RegistryError && error.code === "wardby_file_not_allowed")
+        return { code: "wardby_file_not_allowed", reason: error.message, intrinsic: true };
     return { code: "wardby_upstream_error", reason: "the registry could not be read for it; try again" };
 }

package/dist/providers/coding-proxy/registry/prisma-store.d.ts

@@ -1,12 +1,17 @@
 import type { PrismaClient } from "#prisma";
 import type { FileDependency } from "../../../coding/registry/types.js";
-import type { ApprovedVersion, PlanRefusedVersion, RegistryFetchRecord, RegistryRunContext, RegistryStore, StoredVersionFact } from "./store.js";
+import type { ApprovedDownload, ApprovedVersion, PlanRefusedVersion, RegistryAuditInsert, RegistryFetchRecord, RegistryRunContext, RegistryStore, StoredVersionFact } from "./store.js";
 export declare class PrismaRegistryStore implements RegistryStore {
     private readonly db;
     constructor(db: PrismaClient);
     findRunByRegistryTokenHash(hash: string, now: Date): Promise<RegistryRunContext | null>;
     isAllowedDependency(runId: string, ecosystem: string, name: string): Promise<boolean>;
+    findAllowance(runId: string, ecosystem: string, name: string): Promise<{
+        auditedVia: string | null;
+    } | null>;
     addAllowances(runId: string, ecosystem: string, names: readonly string[]): Promise<void>;
+    addAuditedAllowances(runId: string, ecosystem: string, names: readonly string[], auditedVia: string): Promise<void>;
+    recordAudit(record: RegistryAuditInsert): Promise<void>;
     allowedExtras(runId: string, ecosystem: string, name: string): Promise<string[]>;
     addExtraAllowances(runId: string, ecosystem: string, dependencies: readonly FileDependency[]): Promise<void>;
     recordFetch(record: RegistryFetchRecord): Promise<void>;
@@ -18,20 +23,21 @@ export declare class PrismaRegistryStore implements RegistryStore {
     listFetches(runId: string): Promise<(RegistryFetchRecord & {
         createdAt: Date;
     })[]>;
+    listRecentRefusals(runId: string, since: Date, limit: number): Promise<(RegistryFetchRecord & {
+        createdAt: Date;
+    })[]>;
     getVersionFacts(ecosystem: string, versions: readonly {
         name: string;
         version: string;
     }[]): Promise<StoredVersionFact[]>;
     putVersionFacts(ecosystem: string, facts: readonly StoredVersionFact[]): Promise<void>;
     approveVersions(runId: string, ecosystem: string, versions: readonly ApprovedVersion[]): Promise<void>;
-    findApprovedVersion(runId: string, ecosystem: string, name: string, version: string): Promise<{
-        integrity: string;
-        downloadUrl: string;
-    } | null>;
+    findApprovedVersion(runId: string, ecosystem: string, name: string, version: string): Promise<ApprovedDownload | null>;
     refusePlanVersions(runId: string, ecosystem: string, versions: readonly PlanRefusedVersion[]): Promise<void>;
     findPlanRefusal(runId: string, ecosystem: string, name: string, version: string): Promise<{
         code: string;
         reason: string;
         publishedAt: Date | null;
     } | null>;
+    recordDependencyCacheLockHash(runId: string, lockHash: string, max: number): Promise<void>;
 }