autoremediator 0.21.2 → 0.22.0

package/dist/api/guard/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../../src/api/guard/checks.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAkB7C,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;AACtB,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAU,CAAC;AAE1E,MAAM,iBAAiB,GAAG,CAAC,CAA+B,EAAW,EAAE,CACrE,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,MAAM,aAAa,GAAG,CAAC,CAA+B,EAAW,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AACnG,MAAM,SAAS,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEvF,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAC5B,SAAoB,EACpB,KAAyB;IAEzB,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IAC/B,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC;AAC9F,CAAC;AASD,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,KAAiB;IAI9C,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IAC9D,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,IAAI,WAAyC,CAAC;IAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAE5B,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACjG,MAAM,KAAK,GAAG,GAAG,GAAG,WAAW,CAAC;IAEhC,kFAAkF;IAClF,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAClC,OAAO,EAAE,IAAI,IAAI,iBAAiB,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,EAAE,4BAA4B;SAC1I,CAAC,CAAC;QACH,WAAW,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IAClG,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,kBAAkB,GAAG,CAAC,IAAI,KAAK,GAAG,kBAAkB,GAAG,IAAI,EAAE,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,kBAAkB,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,kBAAkB,oEAAoE;SAC/L,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,GAAG,kBAAkB,GAAG,IAAI,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;aAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC;aACnF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC;aAC7D,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,GAAG;gBACZ,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,uCAAuC;aAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;SAChF,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzD,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC5C,OAAO,EAAE,KAAK;gBACZ,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,8BAA8B,OAAO,WAAW,MAAM,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE,6DAA6D;gBACjL,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,0BAA0B,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;SACpH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,OAAO,4CAA4C,OAAO,sFAAsF;SAC7J,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,mBAAmB,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAiC;IACzD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7E,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AACpF,CAAC"}

package/dist/api/guard/diff.d.ts

@@ -0,0 +1,46 @@
+import type { DeltaDependencyChange } from "../../platform/types.js";
+import { type GuardDeps } from "./index.js";
+import type { GuardOptions, GuardReport, GuardVerdict } from "./types.js";
+export interface GuardDiffOptions extends GuardOptions {
+    /** Git ref to compare the working tree with. Default `HEAD`. A branch name is compared at the merge base. */
+    baseRef?: string;
+    /** Also guard packages that only the lockfile gained (transitive dependencies). Default false. */
+    includeTransitive?: boolean;
+    /** Most lookups in flight at once. Default 8. */
+    concurrency?: number;
+}
+export interface GuardDiffSkipped {
+    packageName: string;
+    /** The version or range as written in the manifest. */
+    version: string;
+    reason: string;
+}
+export interface GuardDiffResult {
+    schemaVersion: "1.0";
+    /** The ref the working tree was compared with (the merge base when one was found). */
+    baseRef: string;
+    /** Dependencies added or changed that were looked at. */
+    checked: number;
+    skipped: GuardDiffSkipped[];
+    verdict: GuardVerdict;
+    reports: GuardReport[];
+}
+/**
+ * The spec `guardPackage` should judge for a changed dependency, or why there is none.
+ * `npm:` aliases and plain ranges are registry packages; URLs, git and `owner/repo` forms are passed
+ * on as they are so the guard says it cannot check them; workspace, link, file and catalog entries
+ * are local and skipped.
+ */
+export declare function specForChange(change: DeltaDependencyChange): {
+    spec: string;
+} | {
+    skip: string;
+};
+/**
+ * Guard the dependencies a change adds: those added or changed in `package.json` since `baseRef`
+ * (and, with `includeTransitive`, those the lockfile gained). Host independent, so it fits a
+ * pre-commit hook, a pull request check, or an agent that edited a manifest instead of running an
+ * install command.
+ */
+export declare function guardGitDiff(options?: GuardDiffOptions, deps?: GuardDeps): Promise<GuardDiffResult>;
+//# sourceMappingURL=diff.d.ts.map

package/dist/api/guard/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../src/api/guard/diff.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGrE,OAAO,EAAgB,KAAK,SAAS,EAAoB,MAAM,YAAY,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1E,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,6GAA6G;IAC7G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kGAAkG;IAClG,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,KAAK,CAAC;IACrB,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAMD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAQhG;AA6BD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,OAAO,GAAE,gBAAqB,EAC9B,IAAI,GAAE,SAA4B,GACjC,OAAO,CAAC,eAAe,CAAC,CAoC1B"}

package/dist/api/guard/diff.js

@@ -0,0 +1,89 @@
+import { resolveGitCommit } from "../../platform/git-ref.js";
+import { safeExeca } from "../../platform/safe-exec.js";
+import { collectDependencyChanges } from "../../scanner/delta-scan.js";
+import { guardExitCode } from "./hook.js";
+import { guardPackage, defaultGuardDeps } from "./index.js";
+/** Version fields that name something other than a registry release: nothing to look up. */
+const LOCAL_PROTOCOL = /^(?:workspace|link|file|portal|catalog):/;
+const NON_REGISTRY = /^(?:[a-z][a-z0-9+.-]*:|\.{0,2}\/|~\/|[\w.-]+\/[\w.-]+$)/i;
+/**
+ * The spec `guardPackage` should judge for a changed dependency, or why there is none.
+ * `npm:` aliases and plain ranges are registry packages; URLs, git and `owner/repo` forms are passed
+ * on as they are so the guard says it cannot check them; workspace, link, file and catalog entries
+ * are local and skipped.
+ */
+export function specForChange(change) {
+    const version = change.newVersion?.trim();
+    if (!version)
+        return { skip: "no version" };
+    if (LOCAL_PROTOCOL.test(version))
+        return { skip: `${version.split(":")[0]}: dependencies are not registry packages` };
+    if (version.startsWith("npm:"))
+        return { spec: `${change.packageName}@${version}` };
+    if (NON_REGISTRY.test(version))
+        return { spec: version };
+    return { spec: `${change.packageName}@${version}` };
+}
+async function resolveBase(cwd, ref) {
+    const commit = await resolveGitCommit(cwd, "baseRef", ref);
+    // Compare with where this branch left the base, so work that landed on the base since does not show up as ours.
+    const base = await safeExeca("git", ["merge-base", commit, "HEAD"], { cwd, reject: false });
+    const sha = base.exitCode === 0 ? base.stdout.trim() : "";
+    return sha || commit;
+}
+async function mapLimit(items, limit, run) {
+    const results = [];
+    let next = 0;
+    const worker = async () => {
+        while (next < items.length) {
+            const index = next++;
+            results[index] = await run(items[index]);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(Math.max(1, limit), items.length) }, () => worker()));
+    return results;
+}
+/**
+ * Guard the dependencies a change adds: those added or changed in `package.json` since `baseRef`
+ * (and, with `includeTransitive`, those the lockfile gained). Host independent, so it fits a
+ * pre-commit hook, a pull request check, or an agent that edited a manifest instead of running an
+ * install command.
+ */
+export async function guardGitDiff(options = {}, deps = defaultGuardDeps) {
+    const cwd = options.cwd ?? process.cwd();
+    const baseRef = await resolveBase(cwd, options.baseRef ?? "HEAD");
+    const { dependencyChanges } = await collectDependencyChanges(cwd, baseRef);
+    const specs = new Map();
+    const skipped = [];
+    for (const change of dependencyChanges) {
+        if (change.changeType === "removed" || change.changeType === "downgraded")
+            continue;
+        if (change.dependencyType === "transitive" && !options.includeTransitive)
+            continue;
+        // A peer dependency is a range the consumer must satisfy, not something this package installs.
+        if (change.dependencyType === "peerDependencies")
+            continue;
+        const target = specForChange(change);
+        if ("skip" in target) {
+            skipped.push({
+                packageName: change.packageName,
+                version: change.newVersion ?? "",
+                reason: target.skip,
+            });
+        }
+        else {
+            specs.set(target.spec, change.packageName);
+        }
+    }
+    const reports = await mapLimit([...specs.keys()], options.concurrency ?? 8, (spec) => guardPackage(spec, { ...options, cwd }, deps));
+    const code = guardExitCode(reports);
+    return {
+        schemaVersion: "1.0",
+        baseRef,
+        checked: reports.length,
+        skipped,
+        verdict: code === 4 ? "block" : code === 3 ? "warn" : "allow",
+        reports,
+    };
+}
+//# sourceMappingURL=diff.js.map

package/dist/api/guard/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../../src/api/guard/diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAExD,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAkB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA8B5E,4FAA4F;AAC5F,MAAM,cAAc,GAAG,0CAA0C,CAAC;AAClE,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAA6B;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC5C,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,0CAA0C,EAAE,CAAC;IACtF,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,OAAO,EAAE,EAAE,CAAC;IACpF,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,OAAO,EAAE,EAAE,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IACjD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC3D,gHAAgH;IAChH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,OAAO,GAAG,IAAI,MAAM,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,KAAmB,EACnB,KAAa,EACb,GAA4B;IAE5B,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,CAAM,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CACnF,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAO,GAAqB,EAAE,EAC9B,IAAI,GAAc,gBAAgB;IAElC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IAClE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE3E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,YAAY;YAAE,SAAS;QACpF,IAAI,MAAM,CAAC,cAAc,KAAK,YAAY,IAAI,CAAC,OAAO,CAAC,iBAAiB;YAAE,SAAS;QACnF,+FAA+F;QAC/F,IAAI,MAAM,CAAC,cAAc,KAAK,kBAAkB;YAAE,SAAS;QAC3D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC;gBACX,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;gBAChC,MAAM,EAAE,MAAM,CAAC,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CACnF,YAAY,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAC9C,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,OAAO;QACP,OAAO,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QAC7D,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/api/guard/hook.d.ts

@@ -0,0 +1,59 @@
+import type { GuardReport } from "./types.js";
+/** What a coding agent's pre-tool hook should do with a command. */
+export interface HookDecision {
+    decision: "allow" | "ask" | "deny";
+    reason: string;
+}
+/**
+ * Decide on a shell command an agent wants to run. Commands that do not install packages are
+ * allowed untouched. This catches the plain forms of install commands (see `extractInstallSpecs`);
+ * it is a guard rail against an agent's mistakes, not a security boundary.
+ */
+export declare function decideForCommand(command: string, check?: (specs: string[]) => Promise<GuardReport[]>): Promise<HookDecision>;
+/** The JSON a Claude Code PreToolUse hook prints, or nothing when the command should proceed as usual. */
+export declare function claudeCodeHookOutput(decision: HookDecision): string | undefined;
+/**
+ * Handle one hook call: `stdin` is the hook's JSON input. Never throws and never blocks on its own
+ * failure: malformed input or an internal error lets the command through (lookup failures inside the
+ * guard are warnings, which ask).
+ */
+export declare function runClaudeCodeHook(stdin: string, check?: (specs: string[]) => Promise<GuardReport[]>): Promise<string | undefined>;
+/** Agent hosts whose pre-command hook `guard-hook` can answer. */
+export declare const HOOK_HOSTS: readonly ["claude-code", "cursor", "copilot"];
+export type HookHost = (typeof HOOK_HOSTS)[number];
+/**
+ * The JSON a Cursor `beforeShellExecution` hook prints. Always JSON, including for allow: Cursor
+ * blocks the action when the output is not valid JSON for its schema, and the schema is
+ * `{ permission: "allow" | "deny" | "ask", user_message?, agent_message? }`.
+ * Source: https://cursor.com/docs/agent/hooks (beforeShellExecution).
+ */
+export declare function cursorHookOutput(decision: HookDecision): string;
+/**
+ * The JSON a Copilot `preToolUse` hook prints (Copilot CLI, the cloud agent, and the Copilot
+ * harness in VS Code): `{ permissionDecision: "allow" | "deny" | "ask", permissionDecisionReason }`.
+ * Nothing is printed to allow, which leaves the normal permission flow in charge instead of
+ * pre-approving the command. Under the cloud agent and CLI autopilot `ask` becomes a deny.
+ * Source: docs.github.com/en/copilot/reference/hooks-reference (preToolUse decision control).
+ */
+export declare function copilotHookOutput(decision: HookDecision): string | undefined;
+/** What `host` expects on stdout for `decision`; `undefined` means print nothing. */
+export declare function hookOutputFor(host: HookHost, decision: HookDecision): string | undefined;
+/**
+ * The shell command a hook call is about to run, or undefined when it is not a shell call.
+ *
+ * - Claude Code: `{ tool_name: "Bash", tool_input: { command } }`
+ * - Cursor `beforeShellExecution`: `{ command, cwd }`
+ * - Copilot `preToolUse`: `{ toolName: "bash", toolArgs: "{\"command\":\"ls\"}" }` (toolArgs is a JSON
+ *   string), or for the PascalCase `PreToolUse` alias `{ tool_name: "Bash", tool_input }`.
+ */
+export declare function commandFromHookInput(host: HookHost, input: Record<string, unknown>): string | undefined;
+/**
+ * Handle one hook call for any supported host: `stdin` is the hook's JSON input, the result is what
+ * to print (or nothing). Never throws and never blocks on its own failure: malformed input or an
+ * internal error lets the command through (Cursor still gets an explicit allow, because it rejects
+ * output that is not valid JSON).
+ */
+export declare function runHostHook(host: HookHost, stdin: string, check?: (specs: string[]) => Promise<GuardReport[]>): Promise<string | undefined>;
+/** Exit code for the `guard` command: 0 clear, 3 something to check, 4 blocked. */
+export declare function guardExitCode(reports: readonly GuardReport[]): number;
+//# sourceMappingURL=hook.d.ts.map

package/dist/api/guard/hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../../src/api/guard/hook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;CAChB;AAcD;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAmC,GACnF,OAAO,CAAC,YAAY,CAAC,CA6BvB;AAED,0GAA0G;AAC1G,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAS/E;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,GAClD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED,kEAAkE;AAClE,eAAO,MAAM,UAAU,YAAI,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AACxE,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAO/D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAM5E;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAIxF;AAiBD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,GAAG,SAAS,CAWpB;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,GAClD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAGrE"}

package/dist/api/guard/hook.js

@@ -0,0 +1,179 @@
+import { guardPackages } from "./index.js";
+import { extractInstallSpecs } from "./spec.js";
+const MAX_SPECS = 10;
+function describe(report) {
+    const lines = report.findings
+        .filter((finding) => finding.severity !== "info")
+        .map((finding) => `- ${finding.message}`);
+    const alt = report.alternative
+        ? `  Instead: ${report.alternative.packageName}${report.alternative.version ? `@${report.alternative.version}` : ""} (${report.alternative.reason}).`
+        : "";
+    return `${report.spec}: ${report.verdict}\n${lines.join("\n")}${alt ? `\n${alt}` : ""}`;
+}
+/**
+ * Decide on a shell command an agent wants to run. Commands that do not install packages are
+ * allowed untouched. This catches the plain forms of install commands (see `extractInstallSpecs`);
+ * it is a guard rail against an agent's mistakes, not a security boundary.
+ */
+export async function decideForCommand(command, check = (specs) => guardPackages(specs)) {
+    const all = extractInstallSpecs(command);
+    const specs = all.slice(0, MAX_SPECS);
+    const unchecked = all.length - specs.length;
+    if (specs.length === 0)
+        return { decision: "allow", reason: "no packages are being installed" };
+    const reports = await check(specs);
+    const blocked = reports.filter((report) => report.verdict === "block");
+    const warned = reports.filter((report) => report.verdict === "warn");
+    if (blocked.length > 0) {
+        return {
+            decision: "deny",
+            reason: `Autoremediator blocked this install:\n${[...blocked, ...warned].map((entry) => describe(entry)).join("\n")}\nTell the user what was found and ask how to proceed; do not work around it.`,
+        };
+    }
+    if (warned.length > 0) {
+        return {
+            decision: "ask",
+            reason: `Autoremediator found something to check before installing:\n${warned.map((entry) => describe(entry)).join("\n")}`,
+        };
+    }
+    if (unchecked > 0) {
+        // Never wave through what was not looked at.
+        return {
+            decision: "ask",
+            reason: `Autoremediator checked the first ${specs.length} packages in this command and found no problems, but ${unchecked} more were not checked. Install them in smaller commands, or check them with \`autoremediator guard\`.`,
+        };
+    }
+    return { decision: "allow", reason: "no problems found" };
+}
+/** The JSON a Claude Code PreToolUse hook prints, or nothing when the command should proceed as usual. */
+export function claudeCodeHookOutput(decision) {
+    if (decision.decision === "allow")
+        return undefined;
+    return JSON.stringify({
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: decision.decision,
+            permissionDecisionReason: decision.reason,
+        },
+    });
+}
+/**
+ * Handle one hook call: `stdin` is the hook's JSON input. Never throws and never blocks on its own
+ * failure: malformed input or an internal error lets the command through (lookup failures inside the
+ * guard are warnings, which ask).
+ */
+export async function runClaudeCodeHook(stdin, check) {
+    try {
+        const input = JSON.parse(stdin);
+        if (input.tool_name !== undefined && input.tool_name !== "Bash")
+            return undefined;
+        const command = input.tool_input?.command;
+        if (typeof command !== "string")
+            return undefined;
+        return claudeCodeHookOutput(await decideForCommand(command, check));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Agent hosts whose pre-command hook `guard-hook` can answer. */
+export const HOOK_HOSTS = ["claude-code", "cursor", "copilot"];
+/**
+ * The JSON a Cursor `beforeShellExecution` hook prints. Always JSON, including for allow: Cursor
+ * blocks the action when the output is not valid JSON for its schema, and the schema is
+ * `{ permission: "allow" | "deny" | "ask", user_message?, agent_message? }`.
+ * Source: https://cursor.com/docs/agent/hooks (beforeShellExecution).
+ */
+export function cursorHookOutput(decision) {
+    if (decision.decision === "allow")
+        return JSON.stringify({ permission: "allow" });
+    return JSON.stringify({
+        permission: decision.decision,
+        user_message: decision.reason,
+        agent_message: decision.reason,
+    });
+}
+/**
+ * The JSON a Copilot `preToolUse` hook prints (Copilot CLI, the cloud agent, and the Copilot
+ * harness in VS Code): `{ permissionDecision: "allow" | "deny" | "ask", permissionDecisionReason }`.
+ * Nothing is printed to allow, which leaves the normal permission flow in charge instead of
+ * pre-approving the command. Under the cloud agent and CLI autopilot `ask` becomes a deny.
+ * Source: docs.github.com/en/copilot/reference/hooks-reference (preToolUse decision control).
+ */
+export function copilotHookOutput(decision) {
+    if (decision.decision === "allow")
+        return undefined;
+    return JSON.stringify({
+        permissionDecision: decision.decision,
+        permissionDecisionReason: decision.reason,
+    });
+}
+/** What `host` expects on stdout for `decision`; `undefined` means print nothing. */
+export function hookOutputFor(host, decision) {
+    if (host === "cursor")
+        return cursorHookOutput(decision);
+    if (host === "copilot")
+        return copilotHookOutput(decision);
+    return claudeCodeHookOutput(decision);
+}
+const SHELL_TOOLS = /^(?:bash|powershell)$/i;
+function objectOf(value) {
+    if (typeof value === "string") {
+        try {
+            return objectOf(JSON.parse(value));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/**
+ * The shell command a hook call is about to run, or undefined when it is not a shell call.
+ *
+ * - Claude Code: `{ tool_name: "Bash", tool_input: { command } }`
+ * - Cursor `beforeShellExecution`: `{ command, cwd }`
+ * - Copilot `preToolUse`: `{ toolName: "bash", toolArgs: "{\"command\":\"ls\"}" }` (toolArgs is a JSON
+ *   string), or for the PascalCase `PreToolUse` alias `{ tool_name: "Bash", tool_input }`.
+ */
+export function commandFromHookInput(host, input) {
+    if (host === "cursor")
+        return typeof input.command === "string" ? input.command : undefined;
+    const tool = host === "copilot" ? (input.toolName ?? input.tool_name) : input.tool_name;
+    if (tool !== undefined) {
+        const shell = host === "claude-code" ? tool === "Bash" : typeof tool === "string" && SHELL_TOOLS.test(tool);
+        if (!shell)
+            return undefined;
+    }
+    const args = host === "copilot" ? (input.toolArgs ?? input.tool_input) : input.tool_input;
+    const command = objectOf(args)?.command;
+    return typeof command === "string" ? command : undefined;
+}
+/**
+ * Handle one hook call for any supported host: `stdin` is the hook's JSON input, the result is what
+ * to print (or nothing). Never throws and never blocks on its own failure: malformed input or an
+ * internal error lets the command through (Cursor still gets an explicit allow, because it rejects
+ * output that is not valid JSON).
+ */
+export async function runHostHook(host, stdin, check) {
+    const proceed = { decision: "allow", reason: "not checked" };
+    try {
+        const input = objectOf(stdin);
+        const command = input ? commandFromHookInput(host, input) : undefined;
+        if (command === undefined)
+            return hookOutputFor(host, proceed);
+        return hookOutputFor(host, await decideForCommand(command, check));
+    }
+    catch {
+        return hookOutputFor(host, proceed);
+    }
+}
+/** Exit code for the `guard` command: 0 clear, 3 something to check, 4 blocked. */
+export function guardExitCode(reports) {
+    if (reports.some((report) => report.verdict === "block"))
+        return 4;
+    return reports.some((report) => report.verdict === "warn") ? 3 : 0;
+}
+//# sourceMappingURL=hook.js.map

package/dist/api/guard/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../../src/api/guard/hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAShD,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,SAAS,QAAQ,CAAC,MAAmB;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ;SAC1B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC;SAChD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW;QAC5B,CAAC,CAAC,cAAc,MAAM,CAAC,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI;QACrJ,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,KAAK,GAAgD,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;IAEpF,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAEhG,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,yCAAyC,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+EAA+E;SACnM,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,+DAA+D,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC3H,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,6CAA6C;QAC7C,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,oCAAoC,KAAK,CAAC,MAAM,wDAAwD,SAAS,wGAAwG;SAClO,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AAC5D,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,oBAAoB,CAAC,QAAsB;IACzD,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,QAAQ,CAAC,QAAQ;YACrC,wBAAwB,EAAE,QAAQ,CAAC,MAAM;SAC1C;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,KAAmD;IAEnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAgE,CAAC;QAC/F,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QAClF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;QAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClD,OAAO,oBAAoB,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAGxE;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAsB;IACrD,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE,QAAQ,CAAC,QAAQ;QAC7B,YAAY,EAAE,QAAQ,CAAC,MAAM;QAC7B,aAAa,EAAE,QAAQ,CAAC,MAAM;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAsB;IACtD,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,kBAAkB,EAAE,QAAQ,CAAC,QAAQ;QACrC,wBAAwB,EAAE,QAAQ,CAAC,MAAM;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,IAAc,EAAE,QAAsB;IAClE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAc,EACd,KAA8B;IAE9B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;IACxF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GACT,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAC1F,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAc,EACd,KAAa,EACb,KAAmD;IAEnD,MAAM,OAAO,GAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,OAA+B;IAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC;QAAE,OAAO,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/api/guard/index.d.ts

@@ -0,0 +1,32 @@
+import { evaluatePackage } from "../../remediation/evaluate-package.js";
+import { type Packument } from "./checks.js";
+import type { GuardOptions, GuardReport } from "./types.js";
+export { extractInstallSpecs, parsePackageSpec } from "./spec.js";
+export type { GuardFinding, GuardOptions, GuardReport, GuardVerdict } from "./types.js";
+/** Lookups the guard performs; replaceable so tests and embedders need no network. */
+export interface GuardDeps {
+    fetchPackument(name: string, cwd: string | undefined): Promise<Packument | undefined>;
+    osvIds(name: string, version: string): Promise<string[]>;
+    evaluate: typeof evaluatePackage;
+    now(): number;
+}
+export declare const defaultGuardDeps: GuardDeps;
+/** Default minimum release age when the caller sets none. */
+export declare const DEFAULT_MIN_AGE_HOURS = 72;
+/**
+ * The minimum release age to enforce for one package: what the caller asked for, else the larger of
+ * the default and the project's own package manager cooldown (a version younger than that cooldown
+ * would fail to install anyway). A caller-supplied value, including 0, is used as given.
+ */
+export declare function minAgeHoursFor(name: string, options: GuardOptions): number;
+/**
+ * Judge an npm package before it is installed: does it exist, is it known malware, does it imitate a
+ * popular package, is the release suspiciously new, did it gain install scripts or lose provenance,
+ * does it have known vulnerabilities. Reads the registry and OSV; installs nothing.
+ *
+ * A lookup that fails (registry or OSV unreachable) is reported as a warning, never as "all clear".
+ */
+export declare function guardPackage(spec: string, options?: GuardOptions, deps?: GuardDeps): Promise<GuardReport>;
+/** Guard several specs; reports come back in the order given. */
+export declare function guardPackages(specs: readonly string[], options?: GuardOptions): Promise<GuardReport[]>;
+//# sourceMappingURL=index.d.ts.map

package/dist/api/guard/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/guard/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAA6C,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxF,OAAO,KAAK,EAAkC,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5F,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAExF,sFAAsF;AACtF,MAAM,WAAW,SAAS;IACxB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACtF,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,QAAQ,EAAE,OAAO,eAAe,CAAC;IACjC,GAAG,IAAI,MAAM,CAAC;CACf;AAED,eAAO,MAAM,gBAAgB,EAAE,SAmB9B,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,MAAM,CAY1E;AAkBD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,YAAiB,EAC1B,IAAI,GAAE,SAA4B,GACjC,OAAO,CAAC,WAAW,CAAC,CAwJtB;AAED,iEAAiE;AACjE,wBAAsB,aAAa,CACjC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,EAAE,CAAC,CAExB"}