@westbayberry/dg 2.0.11 → 2.2.0

package/dist/util/tty-prompt.js

@@ -1,5 +1,16 @@
 import { closeSync, openSync, readSync } from "node:fs";
 export function promptYesNo(question, defaultYes, out = process.stderr) {
+    const answer = promptLine(`${question} ${defaultYes ? "[Y/n]" : "[y/N]"} `, out);
+    if (answer === null) {
+        return null;
+    }
+    const normalized = answer.trim().toLowerCase();
+    if (normalized === "") {
+        return defaultYes;
+    }
+    return normalized === "y" || normalized === "yes";
+}
+export function promptLine(question, out = process.stderr) {
     let tty;
     try {
         tty = openSync("/dev/tty", "rs");
@@ -8,7 +19,7 @@ export function promptYesNo(question, defaultYes, out = process.stderr) {
         return null;
     }
     try {
-        out.write(`${question} ${defaultYes ? "[Y/n]" : "[y/N]"} `);
+        out.write(question);
         const byte = Buffer.alloc(1);
         let answer = "";
         for (;;) {
@@ -31,11 +42,7 @@ export function promptYesNo(question, defaultYes, out = process.stderr) {
             }
             answer += char;
         }
-        const normalized = answer.trim().toLowerCase();
-        if (normalized === "") {
-            return defaultYes;
-        }
-        return normalized === "y" || normalized === "yes";
+        return answer;
     }
     finally {
         closeSync(tty);

package/dist/verify/local.js

@@ -8,6 +8,10 @@ const MAX_UNPACKED_BYTES = 250 * 1024 * 1024;
 const MAX_ARCHIVE_ENTRIES = 20000;
 const MAX_ARCHIVE_PATH_LENGTH = 240;
 const TAR_BLOCK_SIZE = 512;
+const GNU_LONGNAME_TYPE = 0x4c;
+const GNU_LONGLINK_TYPE = 0x4b;
+const PAX_EXTENDED_TYPE = 0x78;
+const PAX_GLOBAL_TYPE = 0x67;
 export function verifyLocalTarget(targetPath, cwd = process.cwd()) {
     const absoluteTarget = resolve(cwd, targetPath);
     if (!existsSync(absoluteTarget)) {
@@ -115,23 +119,73 @@ function scanTarball(bytes, path) {
     const entries = [];
     let offset = 0;
     let unpackedSizeBytes = 0;
+    let pendingLongName = null;
+    let pendingPax = null;
+    let globalPax = null;
     while (offset + TAR_BLOCK_SIZE <= tarBytes.length) {
         const header = tarBytes.subarray(offset, offset + TAR_BLOCK_SIZE);
         if (header.every((byte) => byte === 0)) {
             break;
         }
-        const name = tarEntryName(header);
+        const rawName = tarEntryName(header);
         const size = tarEntrySize(header);
+        if (size === null) {
+            errors.push("tar archive has an unparseable entry size");
+            break;
+        }
         const bodyOffset = offset + TAR_BLOCK_SIZE;
         const nextOffset = bodyOffset + Math.ceil(size / TAR_BLOCK_SIZE) * TAR_BLOCK_SIZE;
-        if (name.length === 0 || nextOffset > tarBytes.length) {
+        if (rawName.length === 0 || nextOffset > tarBytes.length) {
             errors.push("tar archive has a malformed entry header");
             break;
         }
+        const body = tarBytes.subarray(bodyOffset, bodyOffset + size);
+        const typeflag = header.readUInt8(156);
+        if (typeflag === GNU_LONGNAME_TYPE) {
+            pendingLongName = readNullTerminated(body, 0, body.length);
+            if (pendingLongName.length === 0) {
+                errors.push("tar archive has an empty long-name header");
+                break;
+            }
+            offset = nextOffset;
+            continue;
+        }
+        if (typeflag === GNU_LONGLINK_TYPE) {
+            offset = nextOffset;
+            continue;
+        }
+        if (typeflag === PAX_EXTENDED_TYPE || typeflag === PAX_GLOBAL_TYPE) {
+            const records = parsePaxRecords(body);
+            if (records === null) {
+                errors.push("tar archive has an unparseable PAX extended header");
+                break;
+            }
+            if (typeflag === PAX_EXTENDED_TYPE) {
+                pendingPax = mergePaxRecords(pendingPax, records);
+            }
+            else {
+                globalPax = mergePaxRecords(globalPax, records);
+            }
+            offset = nextOffset;
+            continue;
+        }
+        const paxPath = pendingPax?.get("path") ?? globalPax?.get("path") ?? null;
+        if (paxPath !== null && pendingLongName !== null && paxPath !== pendingLongName) {
+            errors.push("tar entry name metadata is contradictory");
+            break;
+        }
+        const paxSize = pendingPax?.get("size") ?? null;
+        if (paxSize !== null && Number.parseInt(paxSize, 10) !== size) {
+            errors.push("tar entry size metadata is contradictory");
+            break;
+        }
+        const name = paxPath ?? pendingLongName ?? rawName;
+        pendingLongName = null;
+        pendingPax = null;
         unpackedSizeBytes += size;
         entries.push({
             name,
-            body: tarBytes.subarray(bodyOffset, bodyOffset + size)
+            body
         });
         findings.push(...pathSafetyFindings(name));
         if (entries.length > MAX_ARCHIVE_ENTRIES) {
@@ -144,6 +198,9 @@ function scanTarball(bytes, path) {
         }
         offset = nextOffset;
     }
+    if (errors.length === 0 && (pendingLongName !== null || pendingPax !== null)) {
+        errors.push("tar archive ends with an unapplied extended header");
+    }
     findings.push(...packageManifestFindings(entries));
     return {
         findings,
@@ -155,56 +212,41 @@ function scanTarball(bytes, path) {
         }
     };
 }
+const ZIP_LOCAL_HEADER_SIG = 0x04034b50;
+const ZIP_CENTRAL_HEADER_SIG = 0x02014b50;
+const ZIP_EOCD_SIG = 0x06054b50;
+const ZIP_DATA_DESCRIPTOR_SIG = 0x08074b50;
+const ZIP_EOCD_MIN_BYTES = 22;
+const ZIP_EOCD_SEARCH_BYTES = ZIP_EOCD_MIN_BYTES + 0xffff;
 function scanZipLike(bytes, path) {
+    const central = readZipCentralDirectory(bytes);
+    if ("error" in central) {
+        return archiveError(`${basename(path)}: ${central.error}`);
+    }
+    const mismatch = zipLocalHeaderMismatch(bytes, central);
+    if (mismatch) {
+        return archiveError(`${basename(path)}: ${mismatch}`);
+    }
     const findings = [];
     const errors = [];
     const entries = [];
-    let offset = 0;
     let unpackedSizeBytes = 0;
-    while (offset + 30 <= bytes.length) {
-        const signature = bytes.readUInt32LE(offset);
-        if (signature !== 0x04034b50) {
-            break;
-        }
-        const flags = bytes.readUInt16LE(offset + 6);
-        const method = bytes.readUInt16LE(offset + 8);
-        const compressedSize = bytes.readUInt32LE(offset + 18);
-        const uncompressedSize = bytes.readUInt32LE(offset + 22);
-        const fileNameLength = bytes.readUInt16LE(offset + 26);
-        const extraLength = bytes.readUInt16LE(offset + 28);
-        const nameStart = offset + 30;
-        const dataStart = nameStart + fileNameLength + extraLength;
-        const dataEnd = dataStart + compressedSize;
-        if (dataEnd > bytes.length) {
-            errors.push(`${basename(path)} has a malformed zip entry`);
-            break;
-        }
-        const name = bytes.subarray(nameStart, nameStart + fileNameLength).toString("utf8");
-        findings.push(...pathSafetyFindings(name));
-        if ((flags & 0x1) !== 0) {
+    for (const entry of central.entries) {
+        findings.push(...pathSafetyFindings(entry.name));
+        if ((entry.flags & 0x1) !== 0) {
             findings.push({
                 id: "encrypted-archive-entry",
                 severity: "block",
                 title: "Encrypted archive entry",
                 message: "encrypted archive entries cannot be inspected locally",
-                location: name
+                location: entry.name
             });
         }
-        const body = readZipBody(bytes.subarray(dataStart, dataEnd), method, name, errors);
-        unpackedSizeBytes += uncompressedSize;
+        unpackedSizeBytes += entry.uncompressedSize;
         entries.push({
-            name,
-            body
+            name: entry.name,
+            body: readZipEntryBody(bytes, entry, errors)
         });
-        if ((flags & 0x8) !== 0) {
-            findings.push({
-                id: "zip-data-descriptor",
-                severity: "warn",
-                title: "Zip data descriptor",
-                message: "zip entry uses a data descriptor, so byte-size validation is conservative",
-                location: name
-            });
-        }
         if (entries.length > MAX_ARCHIVE_ENTRIES) {
             findings.push(limitFinding("archive has too many entries"));
             break;
@@ -213,7 +255,6 @@ function scanZipLike(bytes, path) {
             findings.push(limitFinding("archive expands beyond the local verification limit"));
             break;
         }
-        offset = dataEnd;
     }
     findings.push(...packageManifestFindings(entries));
     return {
@@ -226,6 +267,121 @@ function scanZipLike(bytes, path) {
         }
     };
 }
+function readZipCentralDirectory(bytes) {
+    const eocdOffset = findZipEndOfCentralDirectory(bytes);
+    if (eocdOffset === null) {
+        return { error: "zip end of central directory record not found" };
+    }
+    const entryCount = bytes.readUInt16LE(eocdOffset + 10);
+    const centralDirectorySize = bytes.readUInt32LE(eocdOffset + 12);
+    const centralDirectoryOffset = bytes.readUInt32LE(eocdOffset + 16);
+    if (entryCount === 0xffff || centralDirectorySize === 0xffffffff || centralDirectoryOffset === 0xffffffff) {
+        return { error: "zip64 archives are not supported by local verification" };
+    }
+    if (centralDirectoryOffset + centralDirectorySize > eocdOffset) {
+        return { error: "zip central directory extends past its end record" };
+    }
+    const entries = [];
+    let offset = centralDirectoryOffset;
+    for (let index = 0; index < entryCount; index += 1) {
+        if (offset + 46 > eocdOffset || bytes.readUInt32LE(offset) !== ZIP_CENTRAL_HEADER_SIG) {
+            return { error: "zip central directory is truncated or malformed" };
+        }
+        const nameLength = bytes.readUInt16LE(offset + 28);
+        const extraLength = bytes.readUInt16LE(offset + 30);
+        const commentLength = bytes.readUInt16LE(offset + 32);
+        if (offset + 46 + nameLength + extraLength + commentLength > eocdOffset) {
+            return { error: "zip central directory is truncated or malformed" };
+        }
+        entries.push({
+            name: bytes.subarray(offset + 46, offset + 46 + nameLength).toString("utf8"),
+            flags: bytes.readUInt16LE(offset + 8),
+            method: bytes.readUInt16LE(offset + 10),
+            compressedSize: bytes.readUInt32LE(offset + 20),
+            uncompressedSize: bytes.readUInt32LE(offset + 24),
+            localHeaderOffset: bytes.readUInt32LE(offset + 42)
+        });
+        offset += 46 + nameLength + extraLength + commentLength;
+    }
+    if (offset !== centralDirectoryOffset + centralDirectorySize) {
+        return { error: "zip central directory size disagrees with its entries" };
+    }
+    return { entries, centralDirectoryOffset };
+}
+function findZipEndOfCentralDirectory(bytes) {
+    const searchStart = Math.max(0, bytes.length - ZIP_EOCD_SEARCH_BYTES);
+    for (let offset = bytes.length - ZIP_EOCD_MIN_BYTES; offset >= searchStart; offset -= 1) {
+        if (bytes.readUInt32LE(offset) === ZIP_EOCD_SIG) {
+            const commentLength = bytes.readUInt16LE(offset + 20);
+            if (offset + ZIP_EOCD_MIN_BYTES + commentLength === bytes.length) {
+                return offset;
+            }
+        }
+    }
+    return null;
+}
+function zipLocalHeaderMismatch(bytes, central) {
+    const { entries, centralDirectoryOffset } = central;
+    const claimed = new Map();
+    for (const entry of entries) {
+        if (claimed.has(entry.localHeaderOffset)) {
+            return "zip central directory lists overlapping local entries";
+        }
+        claimed.set(entry.localHeaderOffset, entry);
+    }
+    for (const entry of entries) {
+        const offset = entry.localHeaderOffset;
+        if (offset + 30 > centralDirectoryOffset || bytes.readUInt32LE(offset) !== ZIP_LOCAL_HEADER_SIG) {
+            return "zip central directory points at a missing local file header";
+        }
+        const flags = bytes.readUInt16LE(offset + 6);
+        const compressedSize = bytes.readUInt32LE(offset + 18);
+        const nameLength = bytes.readUInt16LE(offset + 26);
+        const name = bytes.subarray(offset + 30, offset + 30 + nameLength).toString("utf8");
+        if (name !== entry.name) {
+            return "zip local file header name disagrees with the central directory";
+        }
+        if ((flags & 0x8) === 0 && compressedSize !== entry.compressedSize) {
+            return "zip local file header size disagrees with the central directory";
+        }
+    }
+    let offset = bytes.length >= 4 && bytes.readUInt32LE(0) === ZIP_LOCAL_HEADER_SIG
+        ? 0
+        : entries.length > 0
+            ? Math.min(...entries.map((entry) => entry.localHeaderOffset))
+            : centralDirectoryOffset;
+    while (offset + 4 <= centralDirectoryOffset && bytes.readUInt32LE(offset) === ZIP_LOCAL_HEADER_SIG) {
+        const entry = claimed.get(offset);
+        if (!entry) {
+            return "zip has a local file entry the central directory does not list";
+        }
+        const nameLength = bytes.readUInt16LE(offset + 26);
+        const extraLength = bytes.readUInt16LE(offset + 28);
+        let next = offset + 30 + nameLength + extraLength + entry.compressedSize;
+        if ((entry.flags & 0x8) !== 0) {
+            next += next + 4 <= centralDirectoryOffset && bytes.readUInt32LE(next) === ZIP_DATA_DESCRIPTOR_SIG ? 16 : 12;
+        }
+        if (next > centralDirectoryOffset) {
+            return "zip local entry data extends into the central directory";
+        }
+        offset = next;
+    }
+    return null;
+}
+function readZipEntryBody(bytes, entry, errors) {
+    if ((entry.flags & 0x1) !== 0) {
+        return Buffer.alloc(0);
+    }
+    const headerOffset = entry.localHeaderOffset;
+    const nameLength = bytes.readUInt16LE(headerOffset + 26);
+    const extraLength = bytes.readUInt16LE(headerOffset + 28);
+    const dataStart = headerOffset + 30 + nameLength + extraLength;
+    if (dataStart + entry.compressedSize > bytes.length) {
+        errors.push(`${entry.name}: zip entry data is truncated`);
+        return Buffer.alloc(0);
+    }
+    return readZipBody(bytes.subarray(dataStart, dataStart + entry.compressedSize), entry.method, entry.name, errors);
+}
 function readZipBody(data, method, name, errors) {
     if (method === 0) {
         return data;
@@ -375,9 +531,51 @@ function tarEntryName(header) {
     return prefix.length > 0 ? `${prefix}/${name}` : name;
 }
 function tarEntrySize(header) {
+    if ((header.readUInt8(124) & 0x80) !== 0) {
+        return null;
+    }
     const value = readNullTerminated(header, 124, 12).trim();
-    const parsed = Number.parseInt(value || "0", 8);
-    return Number.isFinite(parsed) ? parsed : 0;
+    if (value.length === 0) {
+        return 0;
+    }
+    if (!/^[0-7]+$/u.test(value)) {
+        return null;
+    }
+    return Number.parseInt(value, 8);
+}
+function parsePaxRecords(body) {
+    const records = new Map();
+    let offset = 0;
+    while (offset < body.length) {
+        const space = body.indexOf(0x20, offset);
+        if (space === -1 || space === offset) {
+            return null;
+        }
+        const lengthText = body.subarray(offset, space).toString("ascii");
+        if (!/^\d+$/u.test(lengthText)) {
+            return null;
+        }
+        const length = Number.parseInt(lengthText, 10);
+        const recordEnd = offset + length;
+        if (length <= space - offset + 1 || recordEnd > body.length || body.readUInt8(recordEnd - 1) !== 0x0a) {
+            return null;
+        }
+        const text = body.subarray(space + 1, recordEnd - 1).toString("utf8");
+        const equals = text.indexOf("=");
+        if (equals <= 0) {
+            return null;
+        }
+        records.set(text.slice(0, equals), text.slice(equals + 1));
+        offset = recordEnd;
+    }
+    return records;
+}
+function mergePaxRecords(existing, incoming) {
+    const merged = new Map(existing ?? []);
+    for (const [key, value] of incoming) {
+        merged.set(key, value);
+    }
+    return merged;
 }
 function readNullTerminated(buffer, start, length) {
     const slice = buffer.subarray(start, start + length);

package/dist/verify/package-check.js

@@ -2,10 +2,12 @@ import { existsSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { analyzePackages, AnalyzeError } from "../api/analyze.js";
 import { createTheme } from "../presentation/theme.js";
+import { provenanceLabel, provenanceDowngradeLine } from "../presentation/provenance.js";
+import { packagePageUrl } from "../presentation/package-page.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { isRemotePackageSpec, isSupportedLockfilePath } from "./preflight.js";
 import { authStatus } from "../auth/store.js";
-import { EXIT_TOOL_ERROR, EXIT_UNAVAILABLE } from "../commands/types.js";
+import { EXIT_TOOL_ERROR, EXIT_UNAVAILABLE, EXIT_USAGE_VERDICT } from "../commands/types.js";
 const REGISTRIES = { npm: "npm", pypi: "pypi" };
 const DEEP_VERIFY_HINT = "deep verify supports npm and pypi: dg verify npm:<package> or pypi:<package>";
 function parseSpec(target) {
@@ -37,10 +39,10 @@ function parseSpec(target) {
     const version = rest.slice(at + separator.length).trim() || null;
     return { ecosystem, name, version };
 }
-async function resolveLatest(ecosystem, name, fetchImpl) {
+export async function resolveLatest(ecosystem, name, fetchImpl) {
     try {
         if (ecosystem === "npm") {
-            const response = await fetchImpl(`https://registry.npmjs.org/${name.replace("/", "%2F")}`);
+            const response = await fetchImpl(`https://registry.npmjs.org/${encodeNpmPackagePath(name)}`);
             if (!response.ok) {
                 return null;
             }
@@ -58,14 +60,31 @@ async function resolveLatest(ecosystem, name, fetchImpl) {
         return null;
     }
 }
+function provenanceLines(version, result, theme, withPredicate) {
+    if (!result.provenance) {
+        return [];
+    }
+    const label = withPredicate && result.provenance.predicateType
+        ? `provenance ${provenanceLabel(result.provenance)} · ${result.provenance.predicateType}`
+        : `provenance ${provenanceLabel(result.provenance)}`;
+    const lines = [`  ${theme.paint("muted", label)}`];
+    const downgrade = provenanceDowngradeLine(version, result.provenance);
+    if (downgrade) {
+        lines.push(`  ${theme.paint("warn", `⚠ ${downgrade}`)}`);
+    }
+    return lines;
+}
+function reasonGlyph(action, theme) {
+    return action === "block" ? theme.paint("block", "✘") : action === "warn" ? theme.paint("warn", "⚠") : theme.paint("muted", "·");
+}
 function renderResult(spec, version, result, theme, verbose) {
     const action = result.action ?? "pass";
     const badge = theme.badge(action);
     const lines = [`${badge}  ${result.name}@${version} (${spec.ecosystem})  ${theme.paint("muted", `score ${result.score}`)}`];
+    lines.push(...provenanceLines(version, result, theme, verbose));
     const reasons = verbose ? result.reasons : result.reasons.slice(0, 6);
     for (const reason of reasons) {
-        const glyph = action === "block" ? theme.paint("block", "✘") : action === "warn" ? theme.paint("warn", "⚠") : theme.paint("muted", "·");
-        lines.push(`  ${glyph} ${reason}`);
+        lines.push(`  ${reasonGlyph(action, theme)} ${reason}`);
     }
     if (!verbose && result.reasons.length > reasons.length) {
         lines.push(`  ${theme.paint("muted", `… ${result.reasons.length - reasons.length} more — rerun with --verbose`)}`);
@@ -81,8 +100,43 @@ function renderResult(spec, version, result, theme, verbose) {
     if (result.recommendation) {
         lines.push(`  ${theme.paint("muted", result.recommendation)}`);
     }
+    const page = packagePageUrl(spec.ecosystem, result.name);
+    if (page) {
+        lines.push(`  ${theme.paint("muted", `→ ${page}`)}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+const FREE_REASON_CAP = 3;
+const FREE_SCANS_FOOTER_THRESHOLD = 5_000;
+function renderFreeResult(spec, version, result, theme, freeScansRemaining) {
+    const action = result.action ?? "pass";
+    const lines = [`${theme.badge(action)}  ${result.name}@${version} (${spec.ecosystem})`];
+    lines.push(...provenanceLines(version, result, theme, false));
+    if (action === "pass") {
+        lines.push(`  ${theme.paint("muted", result.reasons[0] ?? "no risk signals")}`);
+    }
+    else {
+        const reasons = result.reasons.slice(0, FREE_REASON_CAP);
+        for (const reason of reasons) {
+            lines.push(`  ${reasonGlyph(action, theme)} ${reason}`);
+        }
+        if (result.reasons.length > reasons.length) {
+            lines.push(`  ${theme.paint("muted", `… ${result.reasons.length - reasons.length} more — sign in to see all:`)} ${theme.paint("accent", "dg login")}`);
+        }
+    }
+    const page = packagePageUrl(spec.ecosystem, result.name);
+    if (page) {
+        lines.push(`  ${theme.paint("muted", `→ ${page}`)}`);
+    }
+    lines.push(`  ${theme.paint("muted", "full findings, license, JSON output:")} ${theme.paint("accent", "dg login")}`);
+    if (freeScansRemaining !== undefined && freeScansRemaining < FREE_SCANS_FOOTER_THRESHOLD) {
+        lines.push(`  ${theme.paint("muted", `${freeScansRemaining.toLocaleString()} free package checks left this month`)}`);
+    }
     return `${lines.join("\n")}\n`;
 }
+function encodeNpmPackagePath(name) {
+    return name.split("/").map((segment) => encodeURIComponent(segment)).join("%2f");
+}
 function exitCodeFor(action) {
     if (action === "block") {
         return 2;
@@ -98,39 +152,41 @@ function exitCodeFor(action) {
 export async function runPackageCheck(target, io = {}, options = {}) {
     const fetchImpl = io.fetchImpl ?? fetch;
     const theme = createTheme(resolvePresentation().color);
-    if (!authStatus(io.env).authenticated) {
-        const accent = (text) => theme.paint("accent", text);
-        const muted = (text) => theme.paint("muted", text);
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    const authenticated = authStatus(io.env).authenticated;
+    if (!authenticated && (options.format === "json" || options.outputPath)) {
         return {
             exitCode: EXIT_UNAVAILABLE,
             stdout: "",
-            stderr: `\n  ${theme.paint("warn", "⚠")} Checking a package before you install it requires ${accent("sign-in")}.\n` +
+            stderr: `\n  ${theme.paint("warn", "⚠")} ${muted("--json and --output for registry checks require sign-in.")}\n` +
                 `  ${accent("dg login")}${muted("  ·  see plans at")} ${accent("westbayberry.com/pricing")}\n\n`
         };
     }
     const parsed = parseSpec(target);
     if (parsed === null) {
         return {
-            exitCode: 2,
+            exitCode: EXIT_USAGE_VERDICT,
             stdout: "",
             stderr: `dg verify: add a registry, e.g. dg verify npm:${target} or dg verify pypi:${target}\n`
         };
     }
     if ("error" in parsed) {
-        return { exitCode: 2, stdout: "", stderr: `dg verify: ${parsed.error}\n` };
+        return { exitCode: EXIT_USAGE_VERDICT, stdout: "", stderr: `dg verify: ${parsed.error}\n` };
     }
     let version = parsed.version;
     if (!version) {
         version = await resolveLatest(parsed.ecosystem, parsed.name, fetchImpl);
         if (!version) {
             return {
-                exitCode: 1,
+                exitCode: exitCodeFor("analysis_incomplete"),
                 stdout: "",
                 stderr: `dg verify: could not resolve the latest version of ${parsed.name} on ${parsed.ecosystem}\n`
             };
         }
     }
     let result;
+    let freeScansRemaining;
     try {
         const response = await analyzePackages([{ name: parsed.name, version }], {
             ecosystem: parsed.ecosystem,
@@ -138,13 +194,22 @@ export async function runPackageCheck(target, io = {}, options = {}) {
             ...(io.env ? { env: io.env } : {})
         });
         result = response.packages.find((entry) => entry.name === parsed.name) ?? response.packages[0];
+        freeScansRemaining = response.freeScansRemaining;
     }
     catch (error) {
+        if (error instanceof AnalyzeError && error.code === "quota_exceeded") {
+            const loginLine = authenticated ? "" : `  ${muted("Run")} ${accent("dg login")} ${muted("to connect your account.")}\n`;
+            return {
+                exitCode: exitCodeFor("analysis_incomplete"),
+                stdout: "",
+                stderr: `dg verify: ${error.message}\n${loginLine}  ${muted("see plans at")} ${accent("westbayberry.com/pricing")}\n`
+            };
+        }
         const message = error instanceof AnalyzeError ? error.message : error instanceof Error ? error.message : "could not reach the scanner";
-        return { exitCode: 1, stdout: "", stderr: `dg verify: ${message}\n` };
+        return { exitCode: exitCodeFor("analysis_incomplete"), stdout: "", stderr: `dg verify: ${message}\n` };
     }
     if (!result) {
-        return { exitCode: 1, stdout: "", stderr: `dg verify: scanner returned no result for ${parsed.name}\n` };
+        return { exitCode: exitCodeFor("analysis_incomplete"), stdout: "", stderr: `dg verify: scanner returned no result for ${parsed.name}\n` };
     }
     const action = result.action ?? "pass";
     const rendered = options.format === "json"
@@ -157,9 +222,12 @@ export async function runPackageCheck(target, io = {}, options = {}) {
             score: result.score,
             reasons: result.reasons,
             findings: result.findings,
+            ...(result.provenance ? { provenance: result.provenance } : {}),
             ...(result.recommendation ? { recommendation: result.recommendation } : {})
         }, null, 2)}\n`
-        : renderResult(parsed, version, result, theme, options.verbose ?? false);
+        : authenticated
+            ? renderResult(parsed, version, result, theme, options.verbose ?? false)
+            : renderFreeResult(parsed, version, result, theme, freeScansRemaining);
     if (options.outputPath) {
         try {
             writeFileSync(resolve(options.outputPath), rendered, "utf8");
@@ -236,20 +304,20 @@ export async function maybeVerifyPackage(args) {
     if (outputFlagMissingPath) {
         return {
             handled: true,
-            result: { exitCode: 2, stdout: "", stderr: `dg verify: ${outputFlagMissingPath} requires a path. Run 'dg verify --help'.\n` }
+            result: { exitCode: EXIT_USAGE_VERDICT, stdout: "", stderr: `dg verify: ${outputFlagMissingPath} requires a path. Run 'dg verify --help'.\n` }
         };
     }
     if (unknownFlag) {
         return {
             handled: true,
-            result: { exitCode: 2, stdout: "", stderr: `dg verify: unknown option '${unknownFlag}'. Run 'dg verify --help'.\n` }
+            result: { exitCode: EXIT_USAGE_VERDICT, stdout: "", stderr: `dg verify: unknown option '${unknownFlag}'. Run 'dg verify --help'.\n` }
         };
     }
     if (sarif) {
         return {
             handled: true,
             result: {
-                exitCode: 2,
+                exitCode: EXIT_USAGE_VERDICT,
                 stdout: "",
                 stderr: "dg verify: --sarif applies to local artifacts and lockfiles; registry package checks support --json.\n"
             }