@wardby/cli 0.6.0 → 0.8.0

package/dist/providers/coding-proxy/registry/plan.js

@@ -4,24 +4,38 @@
  * lockfile claims is trusted:
  *
  * - every entry's integrity must equal the registry's own for that exact
- *   version (a per-version fact read from the registry, stored forever);
+ *   version (a per-version fact read from the registry, stored forever),
+ *   unless the format records no npm integrity at all (yarn Berry): then
+ *   the approval is the exact name@version, and the download is checked
+ *   against the registry's integrity alone;
  * - edges come from the registry too: a parent version's declared
  *   dependencies, resolved to lockfile entries by the client's own rule
  *   (npm: nearest ancestor node_modules), and kept only when the entry is
  *   the declared package at a version inside the declared range;
- * - reachability starts at the projects' dependencies that are allowlist
- *   roots (at a version inside the root's range) and follows only verified
- *   edges, through versions old enough and without a HIGH/CRITICAL advisory.
+ * - reachability starts at every lockfile entry that is an allowlist root
+ *   (at a version inside the root's range), wherever it sits and whether or
+ *   not a project declares it, and follows only verified
+ *   edges, through versions old enough and without a HIGH/CRITICAL advisory
+ *   (one the run's accepted set waives does not count; malware always does).
+ *
+ * PyPI dependency lines may be gated on extras: an entry is expanded with the
+ * extras it is installed with (a start's allowlist entry's, then those its
+ * parents' lines ask of it), and a plain install follows none.
  *
  * A refused entry refuses itself and whatever is reachable only through it;
- * everything else is approved, as exact name@version pairs. The work is
+ * everything else is approved, as exact name@version pairs (an ecosystem
+ * that `approves: "names"` turns them into name allowances). In package
+ * audit mode every registry entry is a start as well: one the allowlist does
+ * not reach is approved when it passes every other check, marked with its
+ * audit verdict (and, in `full`, a version kept only past non-malware
+ * blocking advisories is approved and marked too). The work is
  * bounded: facts are fetched only for entries reached (so a lockfile of
  * unrelated packages costs nothing upstream), with bounded concurrency and a
  * deadline.
  */
 import { matchRoot } from "../../../coding/registry/allowlist.js";
 import { RegistryError, } from "../../../coding/registry/types.js";
-import { versionKey } from "./audit.js";
+import { auditAdvisoryOf, splitWaived, versionKey } from "./audit.js";
 export const DEFAULT_PLAN_MAX_ENTRIES = 5000;
 export const DEFAULT_PLAN_TIMEOUT_MS = 120_000;
 /** Per-version documents fetched at once (each is a few KB). */
@@ -61,21 +75,29 @@ export async function verifyLockfilePlan(input) {
                 reason: entry.unsupportedReason ?? "cannot be verified against the registry",
             });
     }
-    // Starting points: what the projects themselves declare, when it is an
-    // allowlist root at a version inside the root's range.
+    // Starting points: every registry entry that is an allowlist root at a
+    // version inside the root's range, wherever it sits in the lockfile and
+    // whether or not a project declares it. An allowlisted name may be
+    // installed by name anyway (the download path allows the same name@version:
+    // `authorize` matches the name with `matchRoot`, and `keptVersions`
+    // applies the root's range, release age and advisories), so an `overrides`-forced version of it, which no parent's
+    // declared range reaches, is a start in its own right. Every start still
+    // passes the fact checks below (integrity, release age, advisories), and
+    // edges are still followed only inside declared ranges.
     const starts = new Set();
-    for (const project of lockfile.projects) {
-        for (const dependency of project.dependencies) {
-            const entry = lockfile.resolve(project.path, dependency.key);
-            if (!entry || entry.kind !== "registry" || entry.name !== dependency.name)
-                continue;
-            const root = matchRoot(input.roots, adapter.normalizeName(entry.name));
-            if (!root)
-                continue;
-            if (root.range && !safeSatisfies(adapter, entry.version, root.range))
-                continue;
-            starts.add(entry);
-        }
+    // The extras each reached entry is installed with (PyPI): a start's are its
+    // allowlist entry's, a child's those its parents' lines ask of it.
+    const extrasOf = new Map();
+    for (const entry of lockfile.entries) {
+        if (entry.kind !== "registry")
+            continue;
+        const root = matchRoot(input.roots, adapter.normalizeName(entry.name));
+        if (!root)
+            continue;
+        if (root.range && !safeSatisfies(adapter, entry.version, root.range))
+            continue;
+        starts.add(entry);
+        extrasOf.set(entry, new Set(root.extras ?? []));
     }
     // Breadth first over verified edges, fetching facts one layer at a time
     // (only for entries actually reached).
@@ -83,11 +105,28 @@ export async function verifyLockfilePlan(input) {
     const edges = new Map();
     const candidates = new Set();
     const visited = new Set(starts);
+    // Package audit mode: every other registry entry starts too, except an
+    // allowlisted name outside its entry's own range (an owner's explicit
+    // restriction, never widened by audit mode). Visited after the roots'
+    // graph, so facts load in the same bounded layers.
+    const auditStarts = input.auditMode
+        ? lockfile.entries.filter((entry) => entry.kind === "registry" &&
+            !starts.has(entry) &&
+            !outsideRootRange(input, adapter.normalizeName(entry.name), entry.version))
+        : [];
     let layer = [...starts];
-    while (layer.length > 0) {
+    let auditSeeded = false;
+    while (layer.length > 0 || (!auditSeeded && auditStarts.length > 0)) {
+        if (layer.length === 0) {
+            auditSeeded = true;
+            layer = auditStarts.filter((entry) => !visited.has(entry));
+            for (const entry of layer)
+                visited.add(entry);
+            continue;
+        }
         signal.throwIfAborted();
         await loadFacts(input, layer, outcomes);
-        const next = [];
+        const next = new Set();
         for (const entry of layer) {
             const outcome = outcomes.get(versionKey(entry.name, entry.version));
             if ("refusal" in outcome) {
@@ -95,7 +134,8 @@ export async function verifyLockfilePlan(input) {
                 continue;
             }
             const { fact } = outcome;
-            if (entry.integrity === null || entry.integrity.trim() !== fact.integrity) {
+            if (lockfile.integrity !== "registry" &&
+                (entry.integrity === null || entry.integrity.trim() !== fact.integrity)) {
                 refusals.set(entry, {
                     code: "wardby_lockfile_integrity_mismatch",
                     reason: `the lockfile's integrity is not the registry's for ${entry.name}@${entry.version}`,
@@ -113,34 +153,63 @@ export async function verifyLockfilePlan(input) {
             }
             candidates.add(entry);
             const children = [];
-            for (const dependency of fact.dependencies) {
-                const child = lockfile.resolve(entry.path, dependency.key);
-                if (!child || child.kind !== "registry" || child.name !== dependency.name)
-                    continue;
-                if (!support.edgeSatisfies(child.version, dependency.range))
-                    continue;
-                children.push(child);
-                if (!visited.has(child)) {
-                    visited.add(child);
-                    next.push(child);
+            const dependencies = support.dependenciesOf
+                ? support.dependenciesOf(fact, [...(extrasOf.get(entry) ?? [])].sort())
+                : fact.dependencies;
+            for (const dependency of dependencies) {
+                const resolved = lockfile.resolveAll
+                    ? lockfile.resolveAll(entry.path, dependency.key)
+                    : [lockfile.resolve(entry.path, dependency.key)];
+                for (const child of resolved) {
+                    if (!child || child.kind !== "registry" || child.name !== dependency.name)
+                        continue;
+                    if (!support.edgeSatisfies(child.version, dependency.range))
+                        continue;
+                    children.push(child);
+                    const asked = dependency.extras ?? [];
+                    if (!visited.has(child)) {
+                        visited.add(child);
+                        extrasOf.set(child, new Set(asked));
+                        next.add(child);
+                        continue;
+                    }
+                    // Reached again with extras it lacked: expanded again, now with them
+                    // (extras only grow, so this ends).
+                    const known = extrasOf.get(child) ?? new Set();
+                    if (asked.some((extra) => !known.has(extra))) {
+                        for (const extra of asked)
+                            known.add(extra);
+                        extrasOf.set(child, known);
+                        next.add(child);
+                    }
                 }
             }
             edges.set(entry, children);
         }
-        layer = next;
+        layer = [...next];
     }
     // One advisory lookup for every candidate version.
     const withheld = await input.audit([...new Map([...candidates].map((entry) => [versionKey(entry.name, entry.version), entry])).values()].map(({ name, version }) => ({ name, version })), signal);
+    // Advisories the run's accepted set waived, per approved name@version,
+    // and (full mode) the blocking ones served past.
+    const waivers = new Map();
+    const auditAdvisories = new Map();
     for (const entry of candidates) {
-        const ids = withheld.get(versionKey(entry.name, entry.version));
-        if (ids && ids.length > 0) {
+        const key = versionKey(entry.name, entry.version);
+        const split = splitWaived(withheld.get(key) ?? [], input.accepted, { auditAll: input.auditMode === "full" });
+        if (split.audited.length > 0)
+            auditAdvisories.set(key, split.audited.map(auditAdvisoryOf));
+        if (split.withheld.length > 0) {
             candidates.delete(entry);
             refusals.set(entry, {
                 code: "wardby_version_filtered",
-                reason: `withheld by advisory ${ids.join(", ")} (high severity or malware)`,
+                reason: `withheld by advisory ${split.withheld.map(({ id }) => id).join(", ")} (high severity or malware)`,
                 intrinsic: true,
             });
         }
+        else if (split.waived.length > 0) {
+            waivers.set(key, split.waived.map(({ id }) => id));
+        }
     }
     // Reachability again, now only through entries that passed every check:
     // a refused entry refuses whatever is reachable only through it.
@@ -157,16 +226,38 @@ export async function verifyLockfilePlan(input) {
             queue.push(child);
         }
     }
+    // Package audit mode: every other entry that passed every check is
+    // approved too, marked with how it reached the lockfile.
+    const relations = input.auditMode
+        ? auditRelations(input, approvedEntries, candidates, edges)
+        : new Map();
     const approved = new Map();
-    for (const entry of approvedEntries) {
-        const outcome = outcomes.get(versionKey(entry.name, entry.version));
-        if (outcome && "fact" in outcome)
-            approved.set(versionKey(entry.name, entry.version), {
-                name: entry.name,
-                version: entry.version,
-                integrity: outcome.fact.integrity,
-            });
-    }
+    const approve = (entry, relation) => {
+        const key = versionKey(entry.name, entry.version);
+        const outcome = outcomes.get(key);
+        if (!outcome || !("fact" in outcome) || approved.has(key))
+            return;
+        const acceptedAdvisories = waivers.get(key);
+        const advisories = auditAdvisories.get(key);
+        const audit = relation
+            ? { ...relation, ...(advisories ? { advisories } : {}) }
+            : advisories
+                ? { relation: "allowed", advisories }
+                : undefined;
+        approved.set(key, {
+            name: entry.name,
+            version: entry.version,
+            integrity: outcome.fact.integrity,
+            ...(acceptedAdvisories ? { acceptedAdvisories } : {}),
+            ...(audit ? { audit } : {}),
+        });
+    };
+    // Approvals through the allowlist first: an exact version approved both
+    // ways is not audited.
+    for (const entry of approvedEntries)
+        approve(entry, undefined);
+    for (const [entry, relation] of relations)
+        approve(entry, relation);
     const refused = new Map();
     for (const entry of lockfile.entries) {
         if (entry.kind === "bundled")
@@ -182,7 +273,59 @@ export async function verifyLockfilePlan(input) {
     }
     // An entry refused at one place in the tree but approved at another (the
     // same name@version) is approved: approvals are per exact version.
-    return { approved: [...approved.values()], refused: [...refused.values()] };
+    const approvals = [...approved.values()];
+    return {
+        approved: approvals,
+        refused: [...refused.values()],
+        audited: approvals.filter((approval) => approval.audit).length,
+    };
+}
+/** Whether `name@version` is an allowlisted name at a version its entry's range excludes. */
+function outsideRootRange(input, name, version) {
+    const root = matchRoot(input.roots, name);
+    return !!root?.range && !safeSatisfies(input.adapter, version, root.range);
+}
+/**
+ * How each candidate the allowlist does not reach came into the lockfile
+ * (package audit mode): `top-level` when a lockfile project declares it,
+ * `transitive` when an audited top-level entry reaches it over verified
+ * edges (`via` its nearest such ancestor, breadth first), otherwise
+ * `unknown`. Best effort: it decides only what a reviewer is shown.
+ */
+function auditRelations(input, approvedEntries, candidates, edges) {
+    const { lockfile } = input;
+    // An allowlisted name outside its entry's range is never audited in,
+    // even when an audited package declares it.
+    const audited = new Set([...candidates].filter((entry) => !approvedEntries.has(entry) && !outsideRootRange(input, input.adapter.normalizeName(entry.name), entry.version)));
+    const relations = new Map();
+    const declared = new Set();
+    for (const project of lockfile.projects)
+        for (const dependency of project.dependencies) {
+            const entry = lockfile.resolve(project.path, dependency.key);
+            if (entry)
+                declared.add(entry);
+        }
+    const queue = [];
+    for (const entry of audited)
+        if (declared.has(entry)) {
+            relations.set(entry, { relation: "top-level" });
+            queue.push(entry);
+        }
+    const via = new Map(queue.map((entry) => [entry, entry.name]));
+    while (queue.length > 0) {
+        const entry = queue.shift();
+        for (const child of edges.get(entry) ?? []) {
+            if (via.has(child) || !audited.has(child))
+                continue;
+            via.set(child, via.get(entry));
+            relations.set(child, { relation: "transitive", via: via.get(entry) });
+            queue.push(child);
+        }
+    }
+    for (const entry of audited)
+        if (!relations.has(entry))
+            relations.set(entry, { relation: "unknown" });
+    return relations;
 }
 function safeSatisfies(adapter, version, range) {
     try {
@@ -213,6 +356,7 @@ async function loadFacts(input, layer, outcomes) {
     if (missing.length === 0)
         return;
     const fresh = new Map();
+    const complete = [];
     await eachLimited(missing, input.factConcurrency ?? DEFAULT_PLAN_FACT_CONCURRENCY, async ({ name, version }) => {
         const key = versionKey(name, version);
         try {
@@ -227,6 +371,13 @@ async function loadFacts(input, layer, outcomes) {
                 });
                 return;
             }
+            // A registry that gives the publish time with the version (PyPI) needs no second read.
+            if (fact.publishedAt) {
+                const stored = { ...fact, publishedAt: fact.publishedAt };
+                complete.push(stored);
+                outcomes.set(key, checkedFact(input, stored));
+                return;
+            }
             fresh.set(key, fact);
         }
         catch (error) {
@@ -239,7 +390,6 @@ async function loadFacts(input, layer, outcomes) {
     const byName = new Map();
     for (const fact of fresh.values())
         byName.set(fact.name, [...(byName.get(fact.name) ?? []), fact.version]);
-    const complete = [];
     await eachLimited([...byName.entries()], input.timeConcurrency ?? DEFAULT_PLAN_TIME_CONCURRENCY, async ([name, versions]) => {
         let times;
         try {
@@ -300,5 +450,8 @@ function upstreamRefusal(error) {
         return { code: "wardby_metadata_too_large", reason: error.message };
     if (error instanceof RegistryError && error.code === "wardby_package_not_found")
         return { code: "wardby_package_not_found", reason: error.message };
+    // A release with nothing the registry may serve (PyPI: no wheel) stays so.
+    if (error instanceof RegistryError && error.code === "wardby_file_not_allowed")
+        return { code: "wardby_file_not_allowed", reason: error.message, intrinsic: true };
     return { code: "wardby_upstream_error", reason: "the registry could not be read for it; try again" };
 }

package/dist/providers/coding-proxy/registry/prisma-store.d.ts

@@ -1,12 +1,17 @@
 import type { PrismaClient } from "#prisma";
 import type { FileDependency } from "../../../coding/registry/types.js";
-import type { ApprovedVersion, PlanRefusedVersion, RegistryFetchRecord, RegistryRunContext, RegistryStore, StoredVersionFact } from "./store.js";
+import type { ApprovedDownload, ApprovedVersion, PlanRefusedVersion, RegistryAuditInsert, RegistryFetchRecord, RegistryRunContext, RegistryStore, StoredVersionFact } from "./store.js";
 export declare class PrismaRegistryStore implements RegistryStore {
     private readonly db;
     constructor(db: PrismaClient);
     findRunByRegistryTokenHash(hash: string, now: Date): Promise<RegistryRunContext | null>;
     isAllowedDependency(runId: string, ecosystem: string, name: string): Promise<boolean>;
+    findAllowance(runId: string, ecosystem: string, name: string): Promise<{
+        auditedVia: string | null;
+    } | null>;
     addAllowances(runId: string, ecosystem: string, names: readonly string[]): Promise<void>;
+    addAuditedAllowances(runId: string, ecosystem: string, names: readonly string[], auditedVia: string): Promise<void>;
+    recordAudit(record: RegistryAuditInsert): Promise<void>;
     allowedExtras(runId: string, ecosystem: string, name: string): Promise<string[]>;
     addExtraAllowances(runId: string, ecosystem: string, dependencies: readonly FileDependency[]): Promise<void>;
     recordFetch(record: RegistryFetchRecord): Promise<void>;
@@ -18,20 +23,21 @@ export declare class PrismaRegistryStore implements RegistryStore {
     listFetches(runId: string): Promise<(RegistryFetchRecord & {
         createdAt: Date;
     })[]>;
+    listRecentRefusals(runId: string, since: Date, limit: number): Promise<(RegistryFetchRecord & {
+        createdAt: Date;
+    })[]>;
     getVersionFacts(ecosystem: string, versions: readonly {
         name: string;
         version: string;
     }[]): Promise<StoredVersionFact[]>;
     putVersionFacts(ecosystem: string, facts: readonly StoredVersionFact[]): Promise<void>;
     approveVersions(runId: string, ecosystem: string, versions: readonly ApprovedVersion[]): Promise<void>;
-    findApprovedVersion(runId: string, ecosystem: string, name: string, version: string): Promise<{
-        integrity: string;
-        downloadUrl: string;
-    } | null>;
+    findApprovedVersion(runId: string, ecosystem: string, name: string, version: string): Promise<ApprovedDownload | null>;
     refusePlanVersions(runId: string, ecosystem: string, versions: readonly PlanRefusedVersion[]): Promise<void>;
     findPlanRefusal(runId: string, ecosystem: string, name: string, version: string): Promise<{
         code: string;
         reason: string;
         publishedAt: Date | null;
     } | null>;
+    recordDependencyCacheLockHash(runId: string, lockHash: string, max: number): Promise<void>;
 }

package/dist/providers/coding-proxy/registry/prisma-store.js

@@ -1,3 +1,4 @@
+import { isPackageAuditMode, parsePackageAuditVerdict } from "../../../coding/registry/audit-mode.js";
 import { extraAllowanceName, extraOfAllowanceName } from "./store.js";
 /** Versions looked up per query, so a 5000-entry lockfile is a handful of
  *  bounded queries rather than one enormous OR. */
@@ -14,7 +15,17 @@ export class PrismaRegistryStore {
                 runId: true,
                 status: true,
                 deadlineAt: true,
-                run: { select: { packageAllowlist: true, packagePolicy: true } },
+                run: {
+                    select: {
+                        packageAllowlist: true,
+                        packagePolicy: true,
+                        repository: true,
+                        workerImage: true,
+                        toolImage: true,
+                        dependencyCache: true,
+                        packageAuditMode: true,
+                    },
+                },
             },
         });
         if (!session || session.status !== "active" || session.deadlineAt <= now)
@@ -24,6 +35,10 @@ export class PrismaRegistryStore {
             deadlineAt: session.deadlineAt,
             allowlist: (session.run.packageAllowlist ?? {}),
             policy: session.run.packagePolicy,
+            repository: session.run.repository,
+            cacheImage: session.run.toolImage ?? session.run.workerImage,
+            dependencyCache: session.run.dependencyCache,
+            packageAudit: isPackageAuditMode(session.run.packageAuditMode) ? session.run.packageAuditMode : null,
         };
     }
     async isAllowedDependency(runId, ecosystem, name) {
@@ -36,6 +51,15 @@ export class PrismaRegistryStore {
         });
         return row !== null;
     }
+    async findAllowance(runId, ecosystem, name) {
+        // An extra's row (`name[extra]`) is never a package allowance.
+        if (name.includes("["))
+            return null;
+        return this.db.registryAllowance.findUnique({
+            where: { runId_ecosystem_name: { runId, ecosystem, name } },
+            select: { auditedVia: true },
+        });
+    }
     async addAllowances(runId, ecosystem, names) {
         if (names.length === 0)
             return;
@@ -44,6 +68,32 @@ export class PrismaRegistryStore {
             skipDuplicates: true,
         });
     }
+    async addAuditedAllowances(runId, ecosystem, names, auditedVia) {
+        if (names.length === 0)
+            return;
+        // Insert-only (the proxy has no UPDATE): an existing row keeps its first writer.
+        await this.db.registryAllowance.createMany({
+            data: [...new Set(names)].map((name) => ({ runId, ecosystem, name, auditedVia })),
+            skipDuplicates: true,
+        });
+    }
+    async recordAudit(record) {
+        await this.db.registryAuditRecord.createMany({
+            data: [
+                {
+                    runId: record.runId,
+                    ecosystem: record.ecosystem,
+                    name: record.name,
+                    version: record.version,
+                    relation: record.relation,
+                    via: record.via ?? null,
+                    sizeBytes: record.sizeBytes ?? null,
+                    advisories: record.advisories.map(({ id, severity, summary }) => ({ id, severity, summary })),
+                },
+            ],
+            skipDuplicates: true,
+        });
+    }
     async allowedExtras(runId, ecosystem, name) {
         const rows = await this.db.registryAllowance.findMany({
             where: { runId, ecosystem, name: { startsWith: `${name}[` } },
@@ -73,18 +123,15 @@ export class PrismaRegistryStore {
     }
     async listFetches(runId) {
         const rows = await this.db.registryFetch.findMany({ where: { runId }, orderBy: { createdAt: "asc" } });
-        return rows.map((row) => ({
-            runId: row.runId,
-            ecosystem: row.ecosystem,
-            name: row.name,
-            version: row.version ?? undefined,
-            filename: row.filename ?? undefined,
-            integrity: row.integrity ?? undefined,
-            sizeBytes: row.sizeBytes ?? undefined,
-            outcome: row.outcome,
-            reason: row.reason ?? undefined,
-            createdAt: row.createdAt,
-        }));
+        return rows.map(fetchRecordOf);
+    }
+    async listRecentRefusals(runId, since, limit) {
+        const rows = await this.db.registryFetch.findMany({
+            where: { runId, outcome: "refused", createdAt: { gte: since } },
+            orderBy: { createdAt: "desc" },
+            take: limit,
+        });
+        return rows.map(fetchRecordOf);
     }
     async getVersionFacts(ecosystem, versions) {
         const facts = [];
@@ -117,7 +164,13 @@ export class PrismaRegistryStore {
                 publishedAt: fact.publishedAt,
                 integrity: fact.integrity,
                 downloadUrl: fact.downloadUrl,
-                dependencies: fact.dependencies.map(({ key, name, range }) => ({ key, name, range })),
+                dependencies: fact.dependencies.map(({ key, name, range, extras, when }) => ({
+                    key,
+                    name,
+                    range,
+                    ...(extras ? { extras: [...extras] } : {}),
+                    ...(when ? { when: [...when] } : {}),
+                })),
             })),
             skipDuplicates: true,
         });
@@ -126,14 +179,32 @@ export class PrismaRegistryStore {
         if (versions.length === 0)
             return;
         await this.db.registryApprovedVersion.createMany({
-            data: versions.map(({ name, version, integrity }) => ({ runId, ecosystem, name, version, integrity })),
+            data: versions.map(({ name, version, integrity, acceptedAdvisories, audit }) => ({
+                runId,
+                ecosystem,
+                name,
+                version,
+                integrity,
+                acceptedAdvisories: [...(acceptedAdvisories ?? [])],
+                ...(audit
+                    ? {
+                        audit: {
+                            relation: audit.relation,
+                            ...(audit.via ? { via: audit.via } : {}),
+                            ...(audit.advisories?.length
+                                ? { advisories: audit.advisories.map(({ id, severity, summary }) => ({ id, severity, summary })) }
+                                : {}),
+                        },
+                    }
+                    : {}),
+            })),
             skipDuplicates: true,
         });
     }
     async findApprovedVersion(runId, ecosystem, name, version) {
         const approval = await this.db.registryApprovedVersion.findUnique({
             where: { runId_ecosystem_name_version: { runId, ecosystem, name, version } },
-            select: { integrity: true },
+            select: { integrity: true, acceptedAdvisories: true, audit: true },
         });
         if (!approval)
             return null;
@@ -141,7 +212,15 @@ export class PrismaRegistryStore {
             where: { ecosystem_name_version: { ecosystem, name, version } },
             select: { downloadUrl: true },
         });
-        return fact ? { integrity: approval.integrity, downloadUrl: fact.downloadUrl } : null;
+        const audit = parsePackageAuditVerdict(approval.audit);
+        return fact
+            ? {
+                integrity: approval.integrity,
+                downloadUrl: fact.downloadUrl,
+                acceptedAdvisories: approval.acceptedAdvisories,
+                ...(audit ? { audit } : {}),
+            }
+            : null;
     }
     async refusePlanVersions(runId, ecosystem, versions) {
         if (versions.length === 0)
@@ -165,4 +244,28 @@ export class PrismaRegistryStore {
             select: { code: true, reason: true, publishedAt: true },
         });
     }
+    async recordDependencyCacheLockHash(runId, lockHash, max) {
+        // One statement, so a concurrent seal or plan can never slip past a check.
+        await this.db.$executeRaw `
+      UPDATE "CodingProxySession"
+      SET "dependencyCacheLockHashes" = array_append("dependencyCacheLockHashes", ${lockHash})
+      WHERE "runId" = ${runId}
+        AND "dependencyCacheSealedAt" IS NULL
+        AND NOT (${lockHash} = ANY("dependencyCacheLockHashes"))
+        AND cardinality("dependencyCacheLockHashes") < ${max}`;
+    }
+}
+function fetchRecordOf(row) {
+    return {
+        runId: row.runId,
+        ecosystem: row.ecosystem,
+        name: row.name,
+        version: row.version ?? undefined,
+        filename: row.filename ?? undefined,
+        integrity: row.integrity ?? undefined,
+        sizeBytes: row.sizeBytes ?? undefined,
+        outcome: row.outcome,
+        reason: row.reason ?? undefined,
+        createdAt: row.createdAt,
+    };
 }