@wardby/cli 0.6.0 → 0.8.0

package/dist/providers/coding-proxy/registry/audit.d.ts

@@ -16,6 +16,7 @@
  * - a version or event the comparator cannot parse counts as affected
  *   (fail closed).
  */
+import { type AuditAdvisory } from "../../../coding/registry/audit-mode.js";
 import { type RegistryAdapter, type UpstreamFetch } from "../../../coding/registry/types.js";
 export declare const DEFAULT_VULN_CACHE_ENTRIES = 10000;
 /** Exact versions whose querybatch results are cached. */
@@ -39,6 +40,7 @@ interface OsvAffected {
 }
 interface OsvVuln {
     id: string;
+    summary?: unknown;
     aliases?: string[];
     affected?: (OsvAffected & {
         database_specific?: Record<string, unknown>;
@@ -58,11 +60,50 @@ export declare function isMalware(vuln: OsvVuln): boolean;
  *  names compare, and how versions order. */
 export type AuditAdapter = Pick<RegistryAdapter, "osvEcosystem" | "normalizeName" | "compareVersions">;
 export interface AdvisoryIndex {
-    /** Advisory ids with HIGH or CRITICAL severity that affect `version`. */
-    withheld(version: string): readonly string[];
+    /** Ids of the blocking advisories (HIGH, CRITICAL or malware) that affect
+     *  `version`, minus those waived by `accepted` (see `isWaived`). Without
+     *  `accepted`, or with an empty set, every blocking advisory. With
+     *  `auditAll` (package audit mode `full`), only those that can never be
+     *  served past: malware. */
+    withheld(version: string, accepted?: ReadonlySet<string>, auditAll?: boolean): readonly string[];
+    /** Ids of the blocking advisories affecting `version` that `accepted`
+     *  waives: exactly those `withheld` subtracts. For reporting. */
+    waived(version: string, accepted: ReadonlySet<string>): readonly string[];
     /** Advisory ids of any other severity that affect `version`. */
     reported(version: string): readonly string[];
+    /** Blocking, non-malware, non-accepted advisories that `auditAll` lets
+     *  through, with detail: what a full-mode run records when it serves `version`. */
+    audited?(version: string, accepted: ReadonlySet<string>): readonly AuditAdvisory[];
 }
+/** A blocking advisory, with what deciding a waiver needs. */
+export interface WithheldAdvisory {
+    id: string;
+    /** Reports malicious code (`isMalware`): never waived. */
+    malware: boolean;
+    /** The advisory's OSV aliases (CVE ids, other GHSA ids, …). */
+    aliases: readonly string[];
+    /** OSV severity, upper-cased (HIGH, CRITICAL, …); absent when OSV gives none (malware). */
+    severity?: string;
+    /** OSV summary as plain bounded text; absent when OSV gives none. */
+    summary?: string;
+}
+/** Whether `accepted` waives a blocking advisory: it is not malware, and
+ *  its id or one of its aliases is accepted. Malware is never waived,
+ *  whatever the accepted set lists. */
+export declare function isWaived(advisory: WithheldAdvisory, accepted?: ReadonlySet<string>): boolean;
+/** Splits the blocking advisories affecting one version into those still
+ *  withholding it, those `accepted` waives, and (package audit mode `full`,
+ *  `auditAll`) those served past and recorded. Malware is always withheld.
+ *  The version is withheld while `withheld` is non-empty. */
+export declare function splitWaived<T extends WithheldAdvisory>(advisories: readonly T[], accepted?: ReadonlySet<string>, options?: {
+    auditAll?: boolean;
+}): {
+    withheld: T[];
+    waived: T[];
+    audited: T[];
+};
+/** A blocking advisory as package audit mode records it. */
+export declare function auditAdvisoryOf(advisory: WithheldAdvisory): AuditAdvisory;
 type Compare = (a: string, b: string) => number;
 /** OSV range evaluation: sort events by version, then sweep. A version or
  *  event the comparator cannot parse makes the version count as affected. */
@@ -73,9 +114,10 @@ export interface AuditedVersion {
     name: string;
     version: string;
 }
-/** `name@version` -> the HIGH/CRITICAL advisory ids affecting it; a
- *  version with none is absent. */
-export type WithheldVersions = Map<string, string[]>;
+/** `name@version` -> the blocking (HIGH/CRITICAL or malware) advisories
+ *  affecting it; a version with none is absent. Independent of any
+ *  accepted set: callers subtract waivers with `splitWaived`. */
+export type WithheldVersions = Map<string, WithheldAdvisory[]>;
 export declare const versionKey: (name: string, version: string) => string;
 export declare class OsvAudit {
     private readonly options;
@@ -85,8 +127,8 @@ export declare class OsvAudit {
     private readonly cache;
     /** Single-flight: concurrent audits of one package share one OSV query. */
     private readonly loads;
-    /** Advisory severities by id, with the OSV `modified` time they were
-     *  read at, least recently used first. */
+    /** Advisory severities (and malware flag and aliases) by id, with the
+     *  OSV `modified` time they were read at, least recently used first. */
     private readonly vulns;
     /** Advisory ids (and their `modified` time) per exact version from
      *  querybatch, for the audit TTL, least recently used first, so repeated
@@ -121,9 +163,10 @@ export declare class OsvAudit {
     auditVersions(adapter: AuditAdapter, versions: readonly AuditedVersion[], signal?: AbortSignal): Promise<WithheldVersions>;
     private loadVersions;
     private rememberBatch;
-    /** Whether an advisory is HIGH or CRITICAL, cached by id while OSV's
-     *  `modified` time for it is unchanged. */
-    private blocking;
+    /** Whether an advisory blocks (HIGH, CRITICAL or malware), whether it is
+     *  malware, and its aliases, cached by id while OSV's `modified` time for
+     *  it is unchanged. */
+    private detail;
     private remember;
     private load;
     private query;

package/dist/providers/coding-proxy/registry/audit.js

@@ -16,6 +16,7 @@
  * - a version or event the comparator cannot parse counts as affected
  *   (fail closed).
  */
+import { sanitizeAuditSummary } from "../../../coding/registry/audit-mode.js";
 import { RegistryError } from "../../../coding/registry/types.js";
 import { boundedMetadataFetch, DEFAULT_MAX_METADATA_BYTES, DEFAULT_METADATA_TIMEOUT_MS } from "./bounded-fetch.js";
 const OSV_QUERY = "https://api.osv.dev/v1/query";
@@ -52,10 +53,59 @@ export function isMalware(vuln) {
             (typeof detail.source === "string" && detail.source.includes("/malicious-packages/")));
     });
 }
+/** An advisory's OSV severity (database_specific.severity), upper-cased; "" when it has none. */
+function severityOf(vuln) {
+    const severity = vuln.database_specific?.severity;
+    return typeof severity === "string" ? severity.toUpperCase() : "";
+}
 /** Whether an advisory withholds the versions it affects. */
 function blocks(vuln) {
-    return BLOCKING.has(vuln.database_specific?.severity?.toUpperCase() ?? "") || isMalware(vuln);
+    return BLOCKING.has(severityOf(vuln)) || isMalware(vuln);
+}
+/** What package audit mode records of an advisory: its severity, and its summary bounded at the source. */
+function auditDetail(vuln) {
+    const severity = severityOf(vuln);
+    const summary = sanitizeAuditSummary(vuln.summary);
+    return { ...(severity ? { severity } : {}), ...(summary ? { summary } : {}) };
+}
+/** Whether `accepted` waives a blocking advisory: it is not malware, and
+ *  its id or one of its aliases is accepted. Malware is never waived,
+ *  whatever the accepted set lists. */
+export function isWaived(advisory, accepted) {
+    if (advisory.malware || !accepted || accepted.size === 0)
+        return false;
+    // Belt and braces for entries not built from an OSV record here.
+    if ([advisory.id, ...advisory.aliases].some((id) => id.startsWith("MAL-")))
+        return false;
+    return accepted.has(advisory.id) || advisory.aliases.some((alias) => accepted.has(alias));
+}
+/** Whether a blocking advisory reports, or may report, malicious code: never served in any mode. */
+function isMalwareAdvisory(advisory) {
+    return advisory.malware || [advisory.id, ...advisory.aliases].some((id) => id.startsWith("MAL-"));
 }
+/** Splits the blocking advisories affecting one version into those still
+ *  withholding it, those `accepted` waives, and (package audit mode `full`,
+ *  `auditAll`) those served past and recorded. Malware is always withheld.
+ *  The version is withheld while `withheld` is non-empty. */
+export function splitWaived(advisories, accepted, options = {}) {
+    const withheld = [];
+    const waived = [];
+    const audited = [];
+    for (const advisory of advisories) {
+        if (isWaived(advisory, accepted))
+            waived.push(advisory);
+        else if (options.auditAll && !isMalwareAdvisory(advisory))
+            audited.push(advisory);
+        else
+            withheld.push(advisory);
+    }
+    return { withheld, waived, audited };
+}
+/** A blocking advisory as package audit mode records it. */
+export function auditAdvisoryOf(advisory) {
+    return { id: advisory.id, severity: advisory.severity ?? "UNKNOWN", summary: advisory.summary ?? "" };
+}
+const aliasesOf = (vuln) => Array.isArray(vuln.aliases) ? vuln.aliases.filter((alias) => typeof alias === "string") : [];
 function eventVersion(event) {
     return event.introduced ?? event.fixed ?? event.last_affected ?? event.limit;
 }
@@ -122,11 +172,16 @@ function indexOf(advisories, adapter) {
     const compare = (a, b) => adapter.compareVersions(a, b);
     const matching = (version, blocking) => advisories
         .filter((advisory) => advisory.blocking === blocking)
-        .filter((advisory) => advisory.affected.some((affected) => affects(version, affected, compare)))
-        .map((advisory) => advisory.id);
-    return { withheld: (version) => matching(version, true), reported: (version) => matching(version, false) };
+        .filter((advisory) => advisory.affected.some((affected) => affects(version, affected, compare)));
+    const ids = (list) => list.map((advisory) => advisory.id);
+    return {
+        withheld: (version, accepted, auditAll) => ids(splitWaived(matching(version, true), accepted, { auditAll }).withheld),
+        waived: (version, accepted) => ids(splitWaived(matching(version, true), accepted).waived),
+        reported: (version) => ids(matching(version, false)),
+        audited: (version, accepted) => splitWaived(matching(version, true), accepted, { auditAll: true }).audited.map(auditAdvisoryOf),
+    };
 }
-const EMPTY_INDEX = { withheld: () => [], reported: () => [] };
+const EMPTY_INDEX = { withheld: () => [], waived: () => [], reported: () => [], audited: () => [] };
 export const DEFAULT_AUDIT_CACHE_ENTRIES = 5000;
 export const versionKey = (name, version) => `${name}@${version}`;
 export class OsvAudit {
@@ -137,8 +192,8 @@ export class OsvAudit {
     cache = new Map();
     /** Single-flight: concurrent audits of one package share one OSV query. */
     loads = new Map();
-    /** Advisory severities by id, with the OSV `modified` time they were
-     *  read at, least recently used first. */
+    /** Advisory severities (and malware flag and aliases) by id, with the
+     *  OSV `modified` time they were read at, least recently used first. */
     vulns = new Map();
     /** Advisory ids (and their `modified` time) per exact version from
      *  querybatch, for the audit TTL, least recently used first, so repeated
@@ -286,10 +341,18 @@ export class OsvAudit {
             while (cursor < ids.length) {
                 const id = ids[cursor++];
                 const advisory = found.get(id);
-                if (!(await this.blocking(id, advisory.modified, signal)))
+                const detail = await this.detail(id, advisory.modified, signal);
+                if (!detail.blocking)
                     continue;
+                const entry = {
+                    id,
+                    malware: detail.malware,
+                    aliases: detail.aliases,
+                    ...(detail.severity ? { severity: detail.severity } : {}),
+                    ...(detail.summary ? { summary: detail.summary } : {}),
+                };
                 for (const key of advisory.versions)
-                    withheld.set(key, [...(withheld.get(key) ?? []), id]);
+                    withheld.set(key, [...(withheld.get(key) ?? []), entry]);
             }
         };
         await Promise.all(Array.from({ length: Math.min(OSV_VULN_CONCURRENCY, ids.length) }, worker));
@@ -307,14 +370,15 @@ export class OsvAudit {
         }
         this.batchCache.set(key, { expires: now + this.ttlMs, vulns });
     }
-    /** Whether an advisory is HIGH or CRITICAL, cached by id while OSV's
-     *  `modified` time for it is unchanged. */
-    async blocking(id, modified, signal) {
+    /** Whether an advisory blocks (HIGH, CRITICAL or malware), whether it is
+     *  malware, and its aliases, cached by id while OSV's `modified` time for
+     *  it is unchanged. */
+    async detail(id, modified, signal) {
         const cached = this.vulns.get(id);
         if (cached && modified !== "" && cached.modified === modified) {
             this.vulns.delete(id);
             this.vulns.set(id, cached); // most recently used
-            return cached.blocking;
+            return cached;
         }
         const response = await this.fetch(`${OSV_VULN}${encodeURIComponent(id)}`, { accept: "application/json", signal });
         if (!response.ok)
@@ -322,7 +386,13 @@ export class OsvAudit {
         const vuln = (await response.json());
         if (typeof vuln.id !== "string")
             throw new Error("osv_vuln_invalid");
-        const blocking = blocks(vuln);
+        const detail = {
+            modified: typeof vuln.modified === "string" ? vuln.modified : modified,
+            blocking: blocks(vuln),
+            malware: isMalware(vuln),
+            aliases: aliasesOf(vuln),
+            ...auditDetail(vuln),
+        };
         this.vulns.delete(id);
         while (this.vulns.size >= (this.options.maxVulnEntries ?? DEFAULT_VULN_CACHE_ENTRIES)) {
             const oldest = this.vulns.keys().next();
@@ -330,8 +400,8 @@ export class OsvAudit {
                 break;
             this.vulns.delete(oldest.value);
         }
-        this.vulns.set(id, { modified: typeof vuln.modified === "string" ? vuln.modified : modified, blocking });
-        return blocking;
+        this.vulns.set(id, detail);
+        return detail;
     }
     remember(key, advisories) {
         const now = this.now();
@@ -356,7 +426,14 @@ export class OsvAudit {
                 adapter.normalizeName(entry.package.name) === wanted);
             if (affected.length === 0)
                 continue;
-            advisories.push({ id: vuln.id, blocking: blocks(vuln), affected });
+            advisories.push({
+                id: vuln.id,
+                blocking: blocks(vuln),
+                malware: isMalware(vuln),
+                aliases: aliasesOf(vuln),
+                ...auditDetail(vuln),
+                affected,
+            });
         }
         return advisories;
     }

package/dist/providers/coding-proxy/registry/lockfile-parse-worker.d.ts

@@ -0,0 +1,36 @@
+import { type ParsedLockfile } from "../../../coding/registry/types.js";
+export interface ParseRequest {
+    ecosystem: string;
+    body: string;
+    maxEntries: number;
+    proxyRegistryUrl: string;
+}
+/** A ParsedLockfile without its functions: `edges[i]` lists, for
+ *  `entries[i]`, each dependency key the lockfile records that resolves to
+ *  an entry, with that entry's index; `projectEdges[i]` the same for
+ *  `projects[i]`. */
+export interface ShippedLockfile {
+    entries: ParsedLockfile["entries"];
+    projects: ParsedLockfile["projects"];
+    integrity?: ParsedLockfile["integrity"];
+    edges: [key: string, target: number][][];
+    projectEdges: [key: string, target: number][][];
+}
+export type ParseResponse = {
+    ok: true;
+    lockfile: ShippedLockfile;
+} | {
+    ok: false;
+    status: number;
+    code: string;
+    message: string;
+} | {
+    ok: false;
+    unexpected: true;
+    message: string;
+};
+export declare function parseAndShip(request: ParseRequest): ShippedLockfile;
+/** The answer for one parse: the lockfile, the parser's refusal, or (a bug,
+ *  not a verdict about the lockfile) the unexpected error's message, which
+ *  the main thread logs. */
+export declare function responseFor(parse: () => ShippedLockfile): ParseResponse;

package/dist/providers/coding-proxy/registry/lockfile-parse-worker.js

@@ -0,0 +1,67 @@
+/**
+ * Runs inside a worker thread spawned by lockfile-parse.ts: parses one
+ * lockfile with the ecosystem's own parser, off the proxy's event loop, and
+ * posts back a plain, structured-cloneable form of the result (entries,
+ * projects, and the edge table `resolve` answers from). `parentPort` is
+ * null when this file is merely imported, so nothing runs then.
+ */
+import { parentPort } from "node:worker_threads";
+import { REGISTRY_ADAPTERS } from "../../../coding/registry/adapters.js";
+import { RegistryError } from "../../../coding/registry/types.js";
+/** At most this many edges per entry are shipped (far above any real
+ *  package's dependency count), so a crafted entry with a huge dependency
+ *  map can't make the main thread deserialize millions of them. */
+const MAX_EDGES_PER_ENTRY = 2000;
+export function parseAndShip(request) {
+    const support = REGISTRY_ADAPTERS.get(request.ecosystem)?.lockfilePlan;
+    if (!support)
+        throw new RegistryError(404, "wardby_plan_unsupported", `no lockfile plans for ${request.ecosystem}`);
+    const parsed = support.parse(request.body, {
+        maxEntries: request.maxEntries,
+        proxyRegistryUrl: request.proxyRegistryUrl,
+    });
+    if (!parsed.dependencyKeys)
+        throw new Error("this lockfile format cannot be parsed off the event loop");
+    const index = new Map(parsed.entries.map((entry, at) => [entry, at]));
+    const edgesOf = (path, what) => {
+        let keys = parsed.dependencyKeys(path);
+        // A project's edges only label audited packages top-level (best effort):
+        // past the bound they are cut, never a reason to refuse the plan.
+        if (what === "project")
+            keys = keys.slice(0, MAX_EDGES_PER_ENTRY);
+        if (keys.length > MAX_EDGES_PER_ENTRY)
+            throw new RegistryError(413, "wardby_lockfile_too_large", `lockfile ${what} "${path}" lists ${keys.length} dependencies; at most ${MAX_EDGES_PER_ENTRY} are read`);
+        const out = [];
+        for (const key of keys) {
+            const target = parsed.resolve(path, key);
+            const at = target && index.get(target);
+            if (at !== undefined && at !== null)
+                out.push([key, at]);
+        }
+        return out;
+    };
+    return {
+        entries: parsed.entries,
+        projects: parsed.projects,
+        ...(parsed.integrity ? { integrity: parsed.integrity } : {}),
+        edges: parsed.entries.map((entry) => edgesOf(entry.path, "entry")),
+        projectEdges: parsed.projects.map((project) => edgesOf(project.path, "project")),
+    };
+}
+/** The answer for one parse: the lockfile, the parser's refusal, or (a bug,
+ *  not a verdict about the lockfile) the unexpected error's message, which
+ *  the main thread logs. */
+export function responseFor(parse) {
+    try {
+        return { ok: true, lockfile: parse() };
+    }
+    catch (error) {
+        if (error instanceof RegistryError)
+            return { ok: false, status: error.status, code: error.code, message: error.message };
+        return { ok: false, unexpected: true, message: error instanceof Error ? String(error) : "unknown error" };
+    }
+}
+if (parentPort) {
+    const port = parentPort;
+    port.on("message", (request) => port.postMessage(responseFor(() => parseAndShip(request))));
+}

package/dist/providers/coding-proxy/registry/lockfile-parse.d.ts

@@ -0,0 +1,16 @@
+import { type ParsedLockfile } from "../../../coding/registry/types.js";
+/** Time one off-thread lockfile parse may take. Real lockfiles at the
+ *  entry bound parse in well under a second. */
+export declare const DEFAULT_LOCKFILE_PARSE_TIMEOUT_MS = 15000;
+export declare function parseWorkerHeapMb(maxEntries: number): number;
+export declare function parseLockfileOffThread(ecosystem: string, body: string, options: {
+    maxEntries: number;
+    proxyRegistryUrl: string;
+}, limits?: {
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    /** Heap bound for the worker (default parseWorkerHeapMb(maxEntries)). */
+    maxOldGenerationSizeMb?: number;
+    /** Tests only: the worker script to run. */
+    workerUrl?: URL;
+}): Promise<ParsedLockfile>;

package/dist/providers/coding-proxy/registry/lockfile-parse.js

@@ -0,0 +1,110 @@
+/**
+ * Parses a lockfile in a disposable worker thread with a hard time bound,
+ * for the formats that are costly to read (pnpm's and yarn's: YAML, or
+ * yarn classic's own format). A lockfile is attacker-controlled up to the
+ * 20 MiB plan cap, and a synchronous parse can't be interrupted, so on the
+ * event loop a crafted one could stall every request the proxy serves (model
+ * traffic included) for seconds. A worker's terminate() can stop it; the
+ * event loop only deserializes the bounded result (entries and their edges).
+ *
+ * One worker per parse, never reused (the same choice as the sandbox's
+ * parser pool): plans already run at most `planConcurrency` at once.
+ */
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { Worker } from "node:worker_threads";
+import { RegistryError } from "../../../coding/registry/types.js";
+/** Time one off-thread lockfile parse may take. Real lockfiles at the
+ *  entry bound parse in well under a second. */
+export const DEFAULT_LOCKFILE_PARSE_TIMEOUT_MS = 15_000;
+/** Heap one parse worker may use before it is stopped, per 5000 entries
+ *  the plan may have (REGISTRY_PLAN_MAX_ENTRIES, at least the default's
+ *  share). A realistic 5000-entry pnpm-lock.yaml (3.4 MiB: peers, engines,
+ *  six dependencies a snapshot) needs 129 to 160 MiB of it, so 384 MiB is
+ *  about 2.5 times that; a crafted lockfile that expands further is
+ *  stopped there and refused as too large. */
+const PARSE_WORKER_HEAP_MB_PER_5000_ENTRIES = 384;
+export function parseWorkerHeapMb(maxEntries) {
+    return Math.ceil((PARSE_WORKER_HEAP_MB_PER_5000_ENTRIES * Math.max(maxEntries, 5000)) / 5000);
+}
+const compiledWorker = new URL("./lockfile-parse-worker.js", import.meta.url);
+// Under tsx/vitest only the .ts source exists, and a worker gets no TS
+// loader by inheritance (see src/sandbox/parser-worker/pool.ts).
+const WORKER_URL = existsSync(fileURLToPath(compiledWorker))
+    ? compiledWorker
+    : new URL("./lockfile-parse-worker.ts", import.meta.url);
+function incomplete(message) {
+    return new RegistryError(503, "wardby_plan_incomplete", message);
+}
+/** The ParsedLockfile a worker shipped back, with `resolve` answering from
+ *  its edge table. */
+function rebuild(shipped) {
+    const byPath = new Map();
+    shipped.entries.forEach((entry, at) => {
+        byPath.set(entry.path, new Map(shipped.edges[at].map(([key, target]) => [key, shipped.entries[target]])));
+    });
+    // A project's own dependencies (what package audit mode labels top-level);
+    // a path an entry also uses keeps the entry's, as the parser's resolve does.
+    shipped.projects.forEach((project, at) => {
+        if (byPath.has(project.path))
+            return;
+        byPath.set(project.path, new Map(shipped.projectEdges[at].map(([key, target]) => [key, shipped.entries[target]])));
+    });
+    return {
+        entries: shipped.entries,
+        projects: shipped.projects,
+        ...(shipped.integrity ? { integrity: shipped.integrity } : {}),
+        resolve: (fromPath, key) => byPath.get(fromPath)?.get(key),
+        dependencyKeys: (path) => [...(byPath.get(path)?.keys() ?? [])],
+    };
+}
+export async function parseLockfileOffThread(ecosystem, body, options, limits = {}) {
+    const timeoutMs = limits.timeoutMs ?? DEFAULT_LOCKFILE_PARSE_TIMEOUT_MS;
+    if (limits.signal?.aborted)
+        throw incomplete("the client went away before the lockfile was read");
+    const workerUrl = limits.workerUrl ?? WORKER_URL;
+    const worker = new Worker(workerUrl, {
+        resourceLimits: { maxOldGenerationSizeMb: limits.maxOldGenerationSizeMb ?? parseWorkerHeapMb(options.maxEntries) },
+        execArgv: workerUrl.pathname.endsWith(".ts") ? ["--import", "tsx/esm"] : [],
+    });
+    try {
+        const response = await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => reject(incomplete(`the lockfile was not read within ${Math.round(timeoutMs / 1000)} s`)), timeoutMs);
+            const onAbort = () => reject(incomplete("the client went away before the lockfile was read"));
+            limits.signal?.addEventListener("abort", onAbort, { once: true });
+            const settle = () => {
+                clearTimeout(timer);
+                limits.signal?.removeEventListener("abort", onAbort);
+            };
+            worker.once("message", (message) => {
+                settle();
+                resolve(message);
+            });
+            worker.once("error", (error) => {
+                settle();
+                // Out of heap: the lockfile expanded too far, a verdict about it.
+                // Anything else (the worker failed to load, crashed) is the proxy's
+                // own failure: a plain error, which the plan route logs and answers
+                // as a failure to verify, never as a refusal of the lockfile.
+                reject(error.code === "ERR_WORKER_OUT_OF_MEMORY"
+                    ? new RegistryError(413, "wardby_lockfile_too_large", "the lockfile needs too much memory to read")
+                    : new Error(`the lockfile reader failed: ${error.message}`, { cause: error }));
+            });
+            worker.once("exit", (code) => {
+                settle();
+                reject(new Error(`the lockfile reader stopped (exit code ${code})`));
+            });
+            const request = { ecosystem, body, ...options };
+            worker.postMessage(request);
+        });
+        if (!response.ok) {
+            if ("unexpected" in response)
+                throw new Error(`the lockfile reader failed: ${response.message}`);
+            throw new RegistryError(response.status, response.code, response.message);
+        }
+        return rebuild(response.lockfile);
+    }
+    finally {
+        await worker.terminate().catch(() => undefined);
+    }
+}

package/dist/providers/coding-proxy/registry/plan.d.ts

@@ -1,3 +1,4 @@
+import type { PackageAuditMode } from "../../../coding/registry/audit-mode.js";
 import { type AllowlistEntry, type LockfilePlanSupport, type ParsedLockfile, type RegistryAdapter, type UpstreamFetch } from "../../../coding/registry/types.js";
 import { type AuditedVersion, type WithheldVersions } from "./audit.js";
 import type { ApprovedVersion, StoredVersionFact } from "./store.js";
@@ -28,6 +29,8 @@ export interface PlanRefusal {
 export interface PlanResult {
     approved: ApprovedVersion[];
     refused: PlanRefusal[];
+    /** Approvals carrying an audit verdict (package audit mode only; 0 otherwise). */
+    audited: number;
 }
 export interface PlanFacts {
     getVersionFacts(versions: readonly {
@@ -49,6 +52,12 @@ export interface PlanInput {
     /** Unbuffered fetch for streamed package documents. */
     streamUpstream: UpstreamFetch;
     audit(versions: readonly AuditedVersion[], signal: AbortSignal): Promise<WithheldVersions>;
+    /** The run's accepted advisory ids (packagePolicy.acceptedAdvisories):
+     *  blocking advisories they waive do not refuse a version (see
+     *  `isWaived`; malware is never waived). Absent or empty waives nothing. */
+    accepted?: ReadonlySet<string>;
+    /** The run's package audit mode (CodingRun.packageAuditMode); absent or null = normal enforcement. */
+    auditMode?: PackageAuditMode | null;
     hostAllowed(url: string): boolean;
     signal: AbortSignal;
     factConcurrency?: number;