@wardby/cli 0.6.0 → 0.8.0

package/dist/coding/registry/audit-mode.js

@@ -0,0 +1,304 @@
+/**
+ * Package audit mode (docs/coding-packages.md#package-audit-mode): a timed,
+ * owner-set mode in which a coding run's registry serves packages outside the
+ * agent's allowlist (`audit`) and, in `full`, versions withheld only by
+ * non-malware blocking advisories, recording each one for approval
+ * afterwards. Pure (no provider imports): the MCP tools, dispatch, the proxy,
+ * the PR body, the status comment and Slack all read this one model.
+ */
+import { ACCEPTED_ADVISORY_ID } from "./allowlist.js";
+import { codeSpan } from "./refusal-wording.js";
+export const PACKAGE_AUDIT_MODES = ["audit", "full"];
+/** The window `packageAuditMode` opens when `packageAuditMinutes` is omitted: 24 hours. */
+export const DEFAULT_PACKAGE_AUDIT_MINUTES = 24 * 60;
+/** The longest window one update may open: 7 days. */
+export const MAX_PACKAGE_AUDIT_MINUTES = 7 * 24 * 60;
+const RELATIONS = ["top-level", "unknown", "transitive", "allowed"];
+export class PackageAuditPatchError extends Error {
+}
+export function isPackageAuditMode(value) {
+    return typeof value === "string" && PACKAGE_AUDIT_MODES.includes(value);
+}
+/** Whether a stored mode is in force: set, and its window has not ended. */
+export function isPackageAuditActive(mode, until, now) {
+    return isPackageAuditMode(mode) && !!until && until.getTime() > now.getTime();
+}
+/** The get_agent / update_agent warning while a mode is in force. */
+export function packageAuditActiveWarning(mode, until) {
+    return `Package audit mode (\`${mode}\`) is on until ${until.toISOString()}: this agent's coding runs install packages outside the allowlist.`;
+}
+/**
+ * update_agent's packageAuditMode / packageAuditMinutes semantics: a mode
+ * opens a window of the given minutes (24 hours by default), minutes alone
+ * re-arm the stored mode, and null clears both. Returns undefined when the
+ * patch names neither field; throws PackageAuditPatchError for a 400.
+ */
+export function resolvePackageAuditPatch(stored, patch, now) {
+    const { packageAuditMode: mode, packageAuditMinutes: minutes } = patch;
+    if (mode === undefined && minutes === undefined)
+        return undefined;
+    if (minutes !== undefined && (!Number.isInteger(minutes) || minutes < 1 || minutes > MAX_PACKAGE_AUDIT_MINUTES)) {
+        throw new PackageAuditPatchError(`packageAuditMinutes must be a whole number from 1 to ${MAX_PACKAGE_AUDIT_MINUTES} (7 days).`);
+    }
+    if (mode === null) {
+        if (minutes !== undefined) {
+            throw new PackageAuditPatchError("packageAuditMinutes cannot be set while turning packageAuditMode off (null).");
+        }
+        return { mode: null, until: null };
+    }
+    const effective = mode ?? stored.mode;
+    if (!effective) {
+        throw new PackageAuditPatchError('packageAuditMinutes needs a package audit mode: set packageAuditMode to "audit" or "full" as well.');
+    }
+    return { mode: effective, until: new Date(now.getTime() + (minutes ?? DEFAULT_PACKAGE_AUDIT_MINUTES) * 60_000) };
+}
+const SEVERITIES = new Set(["CRITICAL", "HIGH", "MODERATE", "LOW", "UNKNOWN"]);
+const MAX_AUDIT_ADVISORIES = 16;
+export const MAX_AUDIT_SUMMARY_CHARS = 200;
+/** An advisory summary (OSV free text) as plain, single-line, bounded text. */
+export function sanitizeAuditSummary(value) {
+    if (typeof value !== "string")
+        return "";
+    return (value
+        // eslint-disable-next-line no-control-regex -- stripping untrusted control characters.
+        .replace(/[`\u0000-\u001f\u007f<>]/g, " ")
+        .replace(/\s+/g, " ")
+        .trim()
+        .slice(0, MAX_AUDIT_SUMMARY_CHARS));
+}
+/** Untrusted advisory JSON reduced to well-formed, non-malware entries (at most 16, distinct ids). */
+export function sanitizeAuditAdvisories(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = new Map();
+    for (const item of value) {
+        if (out.size >= MAX_AUDIT_ADVISORIES)
+            break;
+        if (!item || typeof item !== "object")
+            continue;
+        const { id, severity, summary } = item;
+        // Malware is never served in any mode, so a MAL- id here is malformed data.
+        if (typeof id !== "string" || id.startsWith("MAL-") || !ACCEPTED_ADVISORY_ID.test(id) || out.has(id))
+            continue;
+        const level = typeof severity === "string" ? severity.toUpperCase() : "";
+        out.set(id, { id, severity: SEVERITIES.has(level) ? level : "UNKNOWN", summary: sanitizeAuditSummary(summary) });
+    }
+    return [...out.values()];
+}
+/** A stored verdict (RegistryApprovedVersion.audit, untrusted JSON) read back; null when absent or malformed. */
+export function parsePackageAuditVerdict(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const { relation, via, advisories } = value;
+    if (typeof relation !== "string" || !RELATIONS.includes(relation))
+        return null;
+    const list = sanitizeAuditAdvisories(advisories);
+    return {
+        relation: relation,
+        ...(relation === "transitive" && typeof via === "string" && via !== "" ? { via } : {}),
+        ...(list.length > 0 ? { advisories: list } : {}),
+    };
+}
+/**
+ * A run's (or a PR's runs') audit rows deduplicated on ecosystem + name +
+ * version (advisories unioned) and ordered top-level, unknown, transitive,
+ * allowed. An unrecognised relation reads as `unknown`, so it is listed to
+ * approve rather than hidden.
+ */
+export function summarizePackageAudit(rows) {
+    const byKey = new Map();
+    for (const row of rows) {
+        const key = `${row.ecosystem}\0${row.name}\0${row.version}`;
+        const advisories = sanitizeAuditAdvisories(row.advisories);
+        const existing = byKey.get(key);
+        if (existing) {
+            if (advisories.length > 0) {
+                const merged = new Map((existing.advisories ?? []).map((a) => [a.id, a]));
+                for (const advisory of advisories)
+                    if (!merged.has(advisory.id))
+                        merged.set(advisory.id, advisory);
+                existing.advisories = [...merged.values()].slice(0, MAX_AUDIT_ADVISORIES);
+            }
+            continue;
+        }
+        const relation = RELATIONS.includes(row.relation)
+            ? row.relation
+            : "unknown";
+        byKey.set(key, {
+            ecosystem: row.ecosystem,
+            name: row.name,
+            version: row.version,
+            size: row.sizeBytes,
+            relation,
+            ...(relation === "transitive" && row.via ? { via: row.via } : {}),
+            ...(advisories.length > 0 ? { advisories } : {}),
+        });
+    }
+    const entries = [...byKey.values()].sort((a, b) => RELATIONS.indexOf(a.relation) - RELATIONS.indexOf(b.relation));
+    const toApprove = new Map();
+    const unknown = new Map();
+    // Entries are ordered top-level first, so a name recorded both ways is listed to approve.
+    for (const entry of entries) {
+        if (entry.relation !== "top-level" && entry.relation !== "unknown")
+            continue;
+        const key = `${entry.ecosystem}\0${entry.name}`;
+        if (toApprove.has(key) || unknown.has(key))
+            continue;
+        (entry.relation === "top-level" ? toApprove : unknown).set(key, {
+            ecosystem: entry.ecosystem,
+            name: entry.name,
+            dependencies: 0,
+        });
+    }
+    const counted = new Set();
+    for (const entry of entries) {
+        if (entry.relation !== "transitive" || !entry.via)
+            continue;
+        const parentKey = `${entry.ecosystem}\0${entry.via}`;
+        const parent = toApprove.get(parentKey) ?? unknown.get(parentKey);
+        const key = `${entry.ecosystem}\0${entry.via}\0${entry.name}`;
+        if (!parent || counted.has(key))
+            continue;
+        counted.add(key);
+        parent.dependencies += 1;
+    }
+    const advisoryRows = entries.flatMap((entry) => (entry.advisories ?? []).map((advisory) => ({
+        ecosystem: entry.ecosystem,
+        name: entry.name,
+        version: entry.version,
+        advisory,
+    })));
+    return { entries, toApprove: [...toApprove.values()], unknown: [...unknown.values()], advisoryRows };
+}
+/** How a name recorded with relation `unknown` is labelled wherever it is listed. */
+export const UNKNOWN_RELATION_LABEL = "Relation unknown — may be a dependency; approve only if needed directly";
+/** At most this many names in a status comment or Slack message, and table rows in a PR body. */
+const MAX_STATUS_NAMES = 10;
+const MAX_PR_AUDIT_LINES = 50;
+function dependencies(count) {
+    return count === 0 ? "" : ` (and ${count} ${count === 1 ? "dependency" : "dependencies"})`;
+}
+/**
+ * The package audit block for a PR body (`format: "pr"`, a `[!CAUTION]`
+ * banner plus the names to approve and, in full mode, the advisories served
+ * past), a status comment (`format: "status"`, short), or Slack mrkdwn
+ * (`slack`, already escaped). Control-plane text only: names, versions and
+ * ids pass through codeSpan.
+ */
+export function packageAuditWording(mode, summary, opts = {}) {
+    return opts.format === "pr" && !opts.slack ? prWording(mode, summary) : statusWording(mode, summary, !!opts.slack);
+}
+function prWording(mode, summary) {
+    const nothing = summary.entries.length === 0;
+    const banner = [
+        "> [!CAUTION]",
+        nothing
+            ? `> **Package audit mode (\`${mode}\`) was on for this run:** nothing outside the allowlist was installed${mode === "full" ? " and no advisory was served past" : ""}.`
+            : `> **Package audit mode (\`${mode}\`) was on for this run.** Wardby's registry installed packages outside this agent's allowlist${mode === "full" ? " and, in `full` mode, versions with high or critical advisories" : ""}. Review them before merging. Malware and the release-age limit were still enforced.`,
+    ];
+    const sections = [banner.join("\n")];
+    if (summary.toApprove.length > 0) {
+        const lines = summary.toApprove.map((pkg) => `- ${codeSpan(pkg.ecosystem).slice(1, -1)} ${codeSpan(pkg.name)}${dependencies(pkg.dependencies)}`);
+        sections.push([
+            "**Packages outside the allowlist** (add to `codingProfile.packageAllowlist` to keep using them):",
+            ...capped(lines),
+        ].join("\n"));
+    }
+    if (summary.unknown.length > 0) {
+        const lines = summary.unknown.map((pkg) => `- ${codeSpan(pkg.ecosystem).slice(1, -1)} ${codeSpan(pkg.name)}${dependencies(pkg.dependencies)}`);
+        sections.push([`**Relation unknown** — may be a dependency; approve only if needed directly:`, ...capped(lines)].join("\n"));
+    }
+    if (!nothing &&
+        summary.toApprove.length === 0 &&
+        summary.unknown.length === 0 &&
+        summary.entries.some((e) => e.relation === "transitive")) {
+        // Every audited package came in as a dependency whose parent was not itself recorded.
+        sections.push(`**Packages outside the allowlist:** ${summary.entries.filter((e) => e.relation === "transitive").length} dependencies of audited packages.`);
+    }
+    if (mode === "full" && summary.advisoryRows.length > 0) {
+        const rows = summary.advisoryRows.map((row) => `| ${codeSpan(row.ecosystem).slice(1, -1)} ${codeSpan(row.name)} | ${codeSpan(row.version)} | ${codeSpan(row.advisory.id)} | ${row.advisory.severity} |`);
+        sections.push(["**Served despite advisories:**", "| Package | Version | Advisory | Severity |", "| --- | --- | --- | --- |"]
+            .concat(rows.slice(0, MAX_PR_AUDIT_LINES))
+            .concat(rows.length > MAX_PR_AUDIT_LINES
+            ? [`\n…and ${rows.length - MAX_PR_AUDIT_LINES} more — see get_run for the full list`]
+            : [])
+            .join("\n"));
+    }
+    return sections.join("\n\n");
+}
+function capped(lines) {
+    return lines.length > MAX_PR_AUDIT_LINES
+        ? [
+            ...lines.slice(0, MAX_PR_AUDIT_LINES),
+            `- …and ${lines.length - MAX_PR_AUDIT_LINES} more — see get_run for the full list`,
+        ]
+        : [...lines];
+}
+function statusWording(mode, summary, slack) {
+    return packageAuditStatusText(mode, packageAuditDigest(mode, summary), slack);
+}
+export function packageAuditDigest(mode, summary) {
+    const listed = summary.toApprove.slice(0, MAX_STATUS_NAMES);
+    return {
+        toApprove: listed.map(({ ecosystem, name }) => ({ ecosystem, name })),
+        moreToApprove: summary.toApprove.length - listed.length,
+        unknown: summary.unknown.slice(0, MAX_STATUS_NAMES).map(({ ecosystem, name }) => ({ ecosystem, name })),
+        moreUnknown: Math.max(0, summary.unknown.length - MAX_STATUS_NAMES),
+        transitive: summary.entries.filter((e) => e.relation === "transitive").length,
+        advisories: mode === "full" ? summary.advisoryRows.length : 0,
+    };
+}
+/** The short audit notice as GitHub/Jira Markdown or, with `slack`, Slack mrkdwn (already escaped). */
+export function packageAuditStatusText(mode, digest, slack) {
+    const bold = (text) => (slack ? `*${text}*` : `**${text}**`);
+    const head = `🔎 ${bold(`Package audit mode (\`${mode}\`) was on:`)}`;
+    const advisoryText = digest.advisories > 0 ? ` ${digest.advisories} served despite advisories.` : "";
+    let text;
+    // Older stored payloads (before unknown names were listed apart) have no `unknown`.
+    const unknown = digest.unknown ?? [];
+    const nameList = (list, more) => list
+        .slice(0, MAX_STATUS_NAMES)
+        .map((pkg) => `${codeSpan(pkg.name)} (${codeSpan(pkg.ecosystem).slice(1, -1)})`)
+        .join(", ") + (more > 0 ? ` and ${more} more` : "");
+    if (digest.toApprove.length === 0 && unknown.length === 0 && digest.transitive === 0) {
+        text = `${head} nothing outside the allowlist was installed.${advisoryText}`;
+    }
+    else {
+        const listed = digest.toApprove.length > 0 ? nameList(digest.toApprove, digest.moreToApprove) : "no top-level names";
+        const transitive = digest.transitive;
+        const unknownText = unknown.length > 0 ? ` ${UNKNOWN_RELATION_LABEL}: ${nameList(unknown, digest.moreUnknown ?? 0)}.` : "";
+        text =
+            `${head} installed outside the allowlist: ${listed}` +
+                `${transitive > 0 ? ` (plus ${transitive} ${transitive === 1 ? "dependency" : "dependencies"})` : ""}.` +
+                `${unknownText}${advisoryText} Keep them with \`approve_audited_packages\` (adds them to codingProfile.packageAllowlist).`;
+    }
+    // Slack's three control characters; codeSpan already removed < and > from names.
+    return slack ? text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;") : text;
+}
+/** Entries back as rows, so several runs' entries summarize (dedup, order) like one run's. */
+export function packageAuditRows(entries) {
+    return entries.map((entry) => ({
+        ecosystem: entry.ecosystem,
+        name: entry.name,
+        version: entry.version,
+        relation: entry.relation,
+        via: entry.via ?? null,
+        sizeBytes: entry.size,
+        advisories: entry.advisories ?? [],
+    }));
+}
+/**
+ * Several runs' audit reports as one (a pull request's runs): entries merged
+ * on ecosystem + name + version with advisories unioned, and the strongest
+ * mode seen (`full` over `audit`). Undefined when no run had the mode.
+ */
+export function mergePackageAuditReports(reports) {
+    const present = reports.filter((report) => !!report && isPackageAuditMode(report.mode));
+    if (present.length === 0)
+        return undefined;
+    const mode = present.some((report) => report.mode === "full") ? "full" : "audit";
+    return {
+        mode,
+        entries: summarizePackageAudit(present.flatMap((report) => packageAuditRows(report.entries))).entries,
+    };
+}

package/dist/coding/registry/lockfile-shared.d.ts

@@ -0,0 +1,36 @@
+import { RegistryError, type LockfileEntry, type ParsedLockfile } from "./types.js";
+/** yarn classic's default registry host, which it writes into `resolved`. */
+export declare const YARN_CLASSIC_REGISTRY = "https://registry.yarnpkg.com/";
+export declare function badRequest(message: string): RegistryError;
+export declare function tooLarge(count: number, maxEntries: number): RegistryError;
+/** `name@range` split at the `@` that ends the name (a scope's `@` is the
+ *  first character). */
+export declare function splitDescriptor(descriptor: string): {
+    name: string;
+    range: string;
+};
+export declare function isLocal(range: string): boolean;
+export declare function fromRegistry(url: string, proxyRegistryUrl: string): boolean;
+export declare function entryOf(path: string, name: string, version: string, integrity: string | null, source: "registry" | "elsewhere"): LockfileEntry;
+/** What a descriptor names: an entry, or a local package (null). */
+export type Target = LockfileEntry | null;
+/** The client's resolution rule (`resolve`) and, for each entry, the
+ *  dependency keys the lockfile lists for it (`dependencyKeys`): `resolve`
+ *  answers only for those keys, which is what lets a parse made in a
+ *  worker thread be shipped back as a plain edge table. */
+export declare function buildResolve(byPath: ReadonlyMap<string, {
+    dependencies: ReadonlyMap<string, string>;
+}>, byDescriptor: ReadonlyMap<string, Target>, candidates: (key: string, range: string) => string[]): Required<Pick<ParsedLockfile, "resolve" | "dependencyKeys">>;
+/** A rough upper bound on a YAML lockfile's entries, read without parsing
+ *  it: the number of lines that open a two-space-indented mapping key
+ *  (each package, snapshot and importer is one). Lets a lockfile far over
+ *  the entry bound be refused before the parser builds its whole tree. */
+export declare function yamlEntryLines(body: string): number;
+/** The lockfile as plain objects and strings. Throws a 400
+ *  `wardby_bad_request` RegistryError for anything that is not a single
+ *  valid YAML mapping without aliases. */
+export declare function parseLockfileYaml(body: string): Record<string, unknown>;
+/** `value` as a string-keyed object, or an empty one. */
+export declare function mapOf(value: unknown): Record<string, unknown>;
+/** `value` when it is a string, else undefined. */
+export declare function stringOf(value: unknown): string | undefined;

package/dist/coding/registry/lockfile-shared.js

@@ -0,0 +1,128 @@
+/**
+ * What the pnpm and yarn lockfile parsers (pnpm-lockfile.ts,
+ * yarn-lockfile.ts) share: entry classification, descriptor-based
+ * resolution, and bounded YAML reading for the lockfiles pnpm and yarn
+ * Berry write (`pnpm-lock.yaml`, a Berry `yarn.lock`). Every scalar is read as a string
+ * (the failsafe schema: no type coercion, no custom or language tags), merge
+ * keys are off, and any alias or anchor is refused: no lockfile those
+ * clients write uses one, and refusing them rules out alias expansion
+ * ("billion laughs"). Nothing in a lockfile is ever executed.
+ */
+import semver from "semver";
+import { parseDocument } from "yaml";
+import { PACKAGE_NAME } from "./npm-lockfile.js";
+import { RegistryError } from "./types.js";
+/** yarn classic's default registry host, which it writes into `resolved`. */
+export const YARN_CLASSIC_REGISTRY = "https://registry.yarnpkg.com/";
+/** Where a registry entry may say it was downloaded from (besides the proxy). */
+const PUBLIC_REGISTRIES = [YARN_CLASSIC_REGISTRY, "https://registry.npmjs.org/"];
+/** Specs and resolutions that are never fetched from the registry. */
+const LOCAL_PROTOCOLS = ["file:", "link:", "portal:", "workspace:", "exec:", "patch:"];
+export function badRequest(message) {
+    return new RegistryError(400, "wardby_bad_request", message);
+}
+export function tooLarge(count, maxEntries) {
+    return new RegistryError(413, "wardby_lockfile_too_large", `the lockfile has ${count} entries; at most ${maxEntries} are verified (REGISTRY_PLAN_MAX_ENTRIES)`);
+}
+/** `name@range` split at the `@` that ends the name (a scope's `@` is the
+ *  first character). */
+export function splitDescriptor(descriptor) {
+    const at = descriptor.indexOf("@", 1);
+    return at < 0 ? { name: descriptor, range: "" } : { name: descriptor.slice(0, at), range: descriptor.slice(at + 1) };
+}
+export function isLocal(range) {
+    return LOCAL_PROTOCOLS.some((protocol) => range.startsWith(protocol));
+}
+export function fromRegistry(url, proxyRegistryUrl) {
+    return [...PUBLIC_REGISTRIES, proxyRegistryUrl].some((base) => url.startsWith(base));
+}
+export function entryOf(path, name, version, integrity, source) {
+    if (!PACKAGE_NAME.test(name) || semver.valid(version) !== version)
+        return {
+            path,
+            name,
+            version,
+            integrity,
+            kind: "unsupported",
+            unsupportedReason: "not a registry package name and exact version",
+        };
+    if (source !== "registry")
+        return {
+            path,
+            name,
+            version,
+            integrity,
+            kind: "unsupported",
+            unsupportedReason: "installed from outside the npm registry",
+        };
+    return { path, name, version, integrity, kind: "registry" };
+}
+/** The client's resolution rule (`resolve`) and, for each entry, the
+ *  dependency keys the lockfile lists for it (`dependencyKeys`): `resolve`
+ *  answers only for those keys, which is what lets a parse made in a
+ *  worker thread be shipped back as a plain edge table. */
+export function buildResolve(byPath, byDescriptor, candidates) {
+    return {
+        resolve: (fromPath, key) => {
+            const range = byPath.get(fromPath)?.dependencies.get(key);
+            if (range === undefined)
+                return undefined;
+            for (const descriptor of candidates(key, range)) {
+                const target = byDescriptor.get(descriptor);
+                if (target !== undefined)
+                    return target ?? undefined;
+            }
+            return undefined;
+        },
+        dependencyKeys: (path) => [...(byPath.get(path)?.dependencies.keys() ?? [])],
+    };
+}
+/** A rough upper bound on a YAML lockfile's entries, read without parsing
+ *  it: the number of lines that open a two-space-indented mapping key
+ *  (each package, snapshot and importer is one). Lets a lockfile far over
+ *  the entry bound be refused before the parser builds its whole tree. */
+export function yamlEntryLines(body) {
+    let count = 0;
+    let at = body.indexOf("\n  ");
+    while (at >= 0) {
+        const next = body[at + 3];
+        if (next !== " " && next !== "\n" && next !== "\r" && next !== undefined)
+            count += 1;
+        at = body.indexOf("\n  ", at + 3);
+    }
+    return count;
+}
+/** The lockfile as plain objects and strings. Throws a 400
+ *  `wardby_bad_request` RegistryError for anything that is not a single
+ *  valid YAML mapping without aliases. */
+export function parseLockfileYaml(body) {
+    const document = parseDocument(body, {
+        schema: "failsafe",
+        merge: false,
+        // The duplicate-key check is quadratic in a mapping's size (seconds for
+        // a large lockfile); a duplicate only means the later value is read,
+        // and nothing parsed here is trusted anyway.
+        uniqueKeys: false,
+        logLevel: "silent",
+    });
+    if (document.errors.length > 0)
+        throw badRequest("the lockfile is not valid YAML");
+    let value;
+    try {
+        value = document.toJS({ maxAliasCount: 0 });
+    }
+    catch {
+        throw badRequest("the lockfile uses YAML aliases, which no supported client writes");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw badRequest("the lockfile is not a YAML mapping");
+    return value;
+}
+/** `value` as a string-keyed object, or an empty one. */
+export function mapOf(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+/** `value` when it is a string, else undefined. */
+export function stringOf(value) {
+    return typeof value === "string" ? value : undefined;
+}

package/dist/coding/registry/lockfiles.js

@@ -58,7 +58,7 @@ export async function normalizeRegistryLockfiles(input) {
             continue;
         const registryUrl = registryUrlFor(input.proxyBaseUrl, adapter.id);
         for (const name of lockfiles.names)
-            byName.set(name, (content) => lockfiles.normalize(content, registryUrl));
+            byName.set(name, (content) => lockfiles.normalize(content, registryUrl, name));
     }
     const rewritten = [];
     const walk = async (relative, depth) => {

package/dist/coding/registry/npm-lockfile-formats.d.ts

@@ -0,0 +1,11 @@
+import { type LockfilePlanSupport, type ParsedLockfile } from "./types.js";
+/** Parses whichever supported lockfile `body` is. */
+export declare function parseNpmClientLockfile(body: string, options: {
+    maxEntries: number;
+    proxyRegistryUrl: string;
+}): ParsedLockfile;
+export declare const npmClientLockfilePlan: LockfilePlanSupport;
+export declare const npmClientLockfiles: {
+    readonly names: readonly ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock"];
+    readonly normalize: (content: string, registryUrl: string, name: string) => string;
+};

package/dist/coding/registry/npm-lockfile-formats.js

@@ -0,0 +1,41 @@
+/**
+ * Every lockfile the npm registry route verifies and rewrites: npm's own
+ * (package-lock.json, npm-shrinkwrap.json), pnpm's (pnpm-lock.yaml) and
+ * yarn's (yarn.lock, classic and Berry). They all install from the same
+ * registry, so they share one plan route (`POST /registry/npm/-/plan`),
+ * which tells them apart by content, and one set of registry reads.
+ *
+ * Kept free of imports from npm.ts, which imports this module.
+ */
+import { normalizeNpmLockfile } from "./npm-lockfile.js";
+import { npmLockfilePlan, parseNpmLockfile } from "./npm-plan.js";
+import { isPnpmLockfile, normalizePnpmLockfile, parsePnpmLockfile } from "./pnpm-lockfile.js";
+import { RegistryError } from "./types.js";
+import { isYarnBerryLockfile, isYarnClassicLockfile, normalizeYarnLockfile, parseYarnLockfile, } from "./yarn-lockfile.js";
+/** Parses whichever supported lockfile `body` is. */
+export function parseNpmClientLockfile(body, options) {
+    if (body.trimStart().startsWith("{"))
+        return parseNpmLockfile(body, options);
+    if (isYarnClassicLockfile(body) || isYarnBerryLockfile(body))
+        return parseYarnLockfile(body, options);
+    if (isPnpmLockfile(body))
+        return parsePnpmLockfile(body, options);
+    throw new RegistryError(400, "wardby_lockfile_unsupported", "not a lockfile this registry verifies: send a package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml or yarn.lock");
+}
+export const npmClientLockfilePlan = {
+    ...npmLockfilePlan,
+    parse: parseNpmClientLockfile,
+    // npm's JSON parses in milliseconds on the event loop; pnpm's and yarn's
+    // formats go to a worker thread (registry/lockfile-parse.ts).
+    parsesOffThread: (body) => !body.trimStart().startsWith("{"),
+};
+export const npmClientLockfiles = {
+    names: ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock"],
+    normalize(content, registryUrl, name) {
+        if (name === "pnpm-lock.yaml")
+            return normalizePnpmLockfile(content, registryUrl);
+        if (name === "yarn.lock")
+            return normalizeYarnLockfile(content, registryUrl);
+        return normalizeNpmLockfile(content, registryUrl);
+    },
+};

package/dist/coding/registry/npm-lockfile.d.ts

@@ -1,9 +1,13 @@
 /** Same shape as the adapter's allowlist name check (scoped names are lower case). */
 export declare const PACKAGE_NAME: RegExp;
+/** The package and version a path under the proxy's npm base downloads:
+ *  `-/tarball/<encoded name>/<version>` (the proxy's own route) or the
+ *  standard `<name>/-/<unscoped>-<version>.tgz`, with the scope separator
+ *  literal or percent-encoded. Null for anything else. */
+export declare function parseProxyPath(path: string): {
+    name: string;
+    version: string;
+} | null;
 /** `https://registry.npmjs.org/@scope/pkg/-/pkg-1.0.0.tgz` */
 export declare function publicNpmTarballUrl(name: string, version: string): string;
 export declare function normalizeNpmLockfile(content: string, registryUrl: string): string;
-export declare const npmLockfiles: {
-    readonly names: readonly ["package-lock.json", "npm-shrinkwrap.json"];
-    readonly normalize: typeof normalizeNpmLockfile;
-};

package/dist/coding/registry/npm-lockfile.js

@@ -31,7 +31,7 @@ function unscoped(name) {
  *  `-/tarball/<encoded name>/<version>` (the proxy's own route) or the
  *  standard `<name>/-/<unscoped>-<version>.tgz`, with the scope separator
  *  literal or percent-encoded. Null for anything else. */
-function parseProxyPath(path) {
+export function parseProxyPath(path) {
     let name;
     let version;
     const own = path.match(/^-\/tarball\/([^/]+)\/([^/]+)$/);
@@ -50,7 +50,9 @@ function parseProxyPath(path) {
         const prefix = `${unscoped(name)}-`;
         version = file.startsWith(prefix) ? file.slice(prefix.length) : null;
     }
-    if (!name || !version || !PACKAGE_NAME.test(name) || semver.valid(version) !== version)
+    // A valid semver version, build metadata allowed (the proxy serves such a
+    // version on its own route), made only of version characters.
+    if (!name || !version || !PACKAGE_NAME.test(name) || !semver.valid(version) || !/^[0-9A-Za-z.+-]+$/.test(version))
         return null;
     return { name, version };
 }
@@ -67,7 +69,3 @@ export function normalizeNpmLockfile(content, registryUrl) {
         return target ? `${open}${publicNpmTarballUrl(target.name, target.version)}${close}` : match;
     });
 }
-export const npmLockfiles = {
-    names: ["package-lock.json", "npm-shrinkwrap.json"],
-    normalize: normalizeNpmLockfile,
-};