autoremediator 0.21.2 → 0.22.0

package/dist/api/guard/index.js

@@ -0,0 +1,199 @@
+import { queryOsvPackage } from "../../intelligence/sources/osv.js";
+import { readCooldown, withCooldown } from "../../platform/cooldown.js";
+import { httpClient } from "../../platform/http-client.js";
+import { detectPackageManager } from "../../platform/package-manager/index.js";
+import { loadRegistryConfig, packumentUrl } from "../../platform/registry-config.js";
+import { evaluatePackage } from "../../remediation/evaluate-package.js";
+import { judgePackument, resolveVersion, verdictOf } from "./checks.js";
+import { findLookalike } from "./popular.js";
+import { parsePackageSpec } from "./spec.js";
+export { extractInstallSpecs, parsePackageSpec } from "./spec.js";
+export const defaultGuardDeps = {
+    async fetchPackument(name, cwd) {
+        const registry = loadRegistryConfig(cwd);
+        const url = packumentUrl(registry, name);
+        // The full document: the abbreviated one carries no publish times and no scripts.
+        const res = await httpClient({
+            url,
+            headers: { Accept: "application/json", ...registry.headersFor(url) },
+            timeout: 20_000,
+        });
+        if (res.status === 404)
+            return undefined;
+        if (!res.ok)
+            throw new Error(`registry answered ${res.status}`);
+        return res.data;
+    },
+    async osvIds(name, version) {
+        return (await queryOsvPackage(name, version)).map((vuln) => vuln.id);
+    },
+    evaluate: evaluatePackage,
+    now: () => Date.now(),
+};
+/** Default minimum release age when the caller sets none. */
+export const DEFAULT_MIN_AGE_HOURS = 72;
+/**
+ * The minimum release age to enforce for one package: what the caller asked for, else the larger of
+ * the default and the project's own package manager cooldown (a version younger than that cooldown
+ * would fail to install anyway). A caller-supplied value, including 0, is used as given.
+ */
+export function minAgeHoursFor(name, options) {
+    if (options.minPublishAgeHours !== undefined)
+        return options.minPublishAgeHours;
+    const cwd = options.cwd ?? process.cwd();
+    try {
+        const cooldown = readCooldown(cwd, detectPackageManager(cwd));
+        return (withCooldown({ minPublishAgeHours: DEFAULT_MIN_AGE_HOURS }, cooldown, name)
+            ?.minPublishAgeHours ?? DEFAULT_MIN_AGE_HOURS);
+    }
+    catch {
+        return DEFAULT_MIN_AGE_HOURS;
+    }
+}
+function report(spec, findings, extra = {}, now = Date.now()) {
+    return {
+        schemaVersion: "1.0",
+        spec,
+        verdict: verdictOf(findings),
+        findings,
+        ...extra,
+        generatedAt: new Date(now).toISOString(),
+    };
+}
+/**
+ * Judge an npm package before it is installed: does it exist, is it known malware, does it imitate a
+ * popular package, is the release suspiciously new, did it gain install scripts or lose provenance,
+ * does it have known vulnerabilities. Reads the registry and OSV; installs nothing.
+ *
+ * A lookup that fails (registry or OSV unreachable) is reported as a warning, never as "all clear".
+ */
+export async function guardPackage(spec, options = {}, deps = defaultGuardDeps) {
+    const parsed = parsePackageSpec(spec);
+    const now = deps.now();
+    if (parsed.kind === "invalid") {
+        return report(spec, [{ check: "spec", severity: "block", message: parsed.reason }], {}, now);
+    }
+    if (parsed.kind === "other") {
+        return report(spec, [{ check: "spec", severity: "warn", message: parsed.reason }], {}, now);
+    }
+    const { name, range } = parsed;
+    let packument;
+    try {
+        packument = await deps.fetchPackument(name, options.cwd);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return report(spec, [
+            {
+                check: "registry",
+                severity: "warn",
+                message: `Could not read "${name}" from the registry (${message.slice(0, 120)}), so it was not checked.`,
+            },
+        ], { packageName: name }, now);
+    }
+    if (!packument) {
+        const lookalike = findLookalike(name);
+        return report(spec, [
+            {
+                check: "exists",
+                severity: "block",
+                message: `"${name}" does not exist on the registry. Assistants sometimes invent package names, and attackers register those names with malware.${lookalike ? ` Did you mean "${lookalike}"?` : ""}`,
+            },
+        ], {
+            packageName: name,
+            ...(lookalike
+                ? {
+                    alternative: {
+                        packageName: lookalike,
+                        reason: "a widely used package with a similar name",
+                    },
+                }
+                : {}),
+        }, now);
+    }
+    const version = resolveVersion(packument, range);
+    if (!version || !packument.versions?.[version]) {
+        return report(spec, [
+            {
+                check: "exists",
+                severity: "block",
+                message: `No release of "${name}" matches "${range ?? "latest"}".`,
+            },
+        ], { packageName: name }, now);
+    }
+    const judged = judgePackument({
+        packument: { ...packument, name },
+        version,
+        now,
+        minPublishAgeHours: minAgeHoursFor(name, options),
+    });
+    const findings = [...judged.findings];
+    let alternative = judged.alternative;
+    if (options.offline) {
+        findings.push({
+            check: "malware",
+            severity: "info",
+            message: "Offline: known-malware and advisory databases were not checked.",
+        });
+    }
+    else {
+        try {
+            const malware = (await deps.osvIds(name, version)).filter((id) => id.startsWith("MAL-"));
+            if (malware.length > 0) {
+                findings.push({
+                    check: "malware",
+                    severity: "block",
+                    message: `${name}@${version} is listed as malicious in the OSV malware feed (${malware.slice(0, 3).join(", ")}).`,
+                });
+            }
+        }
+        catch {
+            findings.push({
+                check: "malware",
+                severity: "warn",
+                message: "The OSV malware feed could not be reached, so malware was not checked.",
+            });
+        }
+        try {
+            const evaluation = await deps.evaluate(name, { version, cwd: options.cwd });
+            const vulns = evaluation.vulnerabilities.filter((entry) => !entry.cveId.startsWith("MAL-"));
+            if (vulns.length > 0 && evaluation.verdict !== "safe") {
+                const worst = evaluation.verdict === "actively-exploited"
+                    ? "block"
+                    : evaluation.verdict === "vulnerable"
+                        ? "warn"
+                        : "info";
+                findings.push({
+                    check: "vulnerabilities",
+                    severity: worst,
+                    message: `${name}@${version} has ${vulns.length} known ${vulns.length === 1 ? "vulnerability" : "vulnerabilities"} (${vulns
+                        .slice(0, 3)
+                        .map((v) => v.cveId)
+                        .join(", ")}${evaluation.verdict === "actively-exploited" ? "; at least one is being exploited" : ""}).`,
+                });
+                if (evaluation.recommendedVersion &&
+                    evaluation.recommendedVersion !== version &&
+                    !alternative) {
+                    alternative = {
+                        packageName: name,
+                        version: evaluation.recommendedVersion,
+                        reason: "a version without those vulnerabilities",
+                    };
+                }
+            }
+        }
+        catch {
+            findings.push({
+                check: "vulnerabilities",
+                severity: "warn",
+                message: "Known vulnerabilities could not be looked up.",
+            });
+        }
+    }
+    return report(spec, findings, { packageName: name, resolvedVersion: version, ...(alternative ? { alternative } : {}) }, now);
+}
+/** Guard several specs; reports come back in the order given. */
+export async function guardPackages(specs, options = {}) {
+    return Promise.all(specs.map((spec) => guardPackage(spec, options)));
+}
+//# sourceMappingURL=index.js.map

package/dist/api/guard/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/guard/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,EAAkB,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAWlE,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG;QAC5B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,kFAAkF;QAClF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;YAC3B,GAAG;YACH,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;YACpE,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,IAAiB,CAAC;IAC/B,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO;QACxB,OAAO,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,QAAQ,EAAE,eAAe;IACzB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;CACtB,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAqB;IAChE,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC;IAChF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,CACL,YAAY,CAAC,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC;YACzE,EAAE,kBAAkB,IAAI,qBAAqB,CAChD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qBAAqB,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CACb,IAAY,EACZ,QAAwB,EACxB,KAAK,GAAyB,EAAE,EAChC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,IAAI;QACJ,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC5B,QAAQ;QACR,GAAG,KAAK;QACR,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,OAAO,GAAiB,EAAE,EAC1B,IAAI,GAAc,gBAAgB;IAElC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAC/B,IAAI,SAAgC,CAAC;IACrC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,MAAM,CACX,IAAI,EACJ;YACE;gBACE,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,mBAAmB,IAAI,wBAAwB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,2BAA2B;aACzG;SACF,EACD,EAAE,WAAW,EAAE,IAAI,EAAE,EACrB,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,MAAM,CACX,IAAI,EACJ;YACE;gBACE,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,IAAI,IAAI,gIAAgI,SAAS,CAAC,CAAC,CAAC,kBAAkB,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;aACpM;SACF,EACD;YACE,WAAW,EAAE,IAAI;YACjB,GAAG,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,WAAW,EAAE;wBACX,WAAW,EAAE,SAAS;wBACtB,MAAM,EAAE,2CAA2C;qBACpD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,CACX,IAAI,EACJ;YACE;gBACE,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,kBAAkB,IAAI,cAAc,KAAK,IAAI,QAAQ,IAAI;aACnE;SACF,EACD,EAAE,WAAW,EAAE,IAAI,EAAE,EACrB,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC;QAC5B,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE;QACjC,OAAO;QACP,GAAG;QACH,kBAAkB,EAAE,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,WAAW,GAAiC,MAAM,CAAC,WAAW,CAAC;IAEnE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,iEAAiE;SAC3E,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACzF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,SAAS;oBAChB,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,oDAAoD,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;iBAClH,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,wEAAwE;aAClF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5F,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBACtD,MAAM,KAAK,GACT,UAAU,CAAC,OAAO,KAAK,oBAAoB;oBACzC,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,UAAU,CAAC,OAAO,KAAK,YAAY;wBACnC,CAAC,CAAC,MAAM;wBACR,CAAC,CAAC,MAAM,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,iBAAiB;oBACxB,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,GAAG,IAAI,IAAI,OAAO,QAAQ,KAAK,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,KAAK,KAAK;yBACxH,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;yBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;yBACnB,IAAI,CACH,IAAI,CACL,GAAG,UAAU,CAAC,OAAO,KAAK,oBAAoB,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,IAAI;iBACjG,CAAC,CAAC;gBACH,IACE,UAAU,CAAC,kBAAkB;oBAC7B,UAAU,CAAC,kBAAkB,KAAK,OAAO;oBACzC,CAAC,WAAW,EACZ,CAAC;oBACD,WAAW,GAAG;wBACZ,WAAW,EAAE,IAAI;wBACjB,OAAO,EAAE,UAAU,CAAC,kBAAkB;wBACtC,MAAM,EAAE,yCAAyC;qBAClD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CACX,IAAI,EACJ,QAAQ,EACR,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACxF,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAwB,EACxB,OAAO,GAAiB,EAAE;IAE1B,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/dist/api/guard/popular.d.ts

@@ -0,0 +1,7 @@
+/** Widely installed npm packages. A new package whose name sits next to one of these deserves a second look. */
+export declare const POPULAR_PACKAGES: readonly string[];
+/** Optimal string alignment distance: edits, plus swapping two neighbouring letters. */
+export declare function editDistance(a: string, b: string): number;
+/** The popular package this name imitates, if any. A popular package is never a look-alike. */
+export declare function findLookalike(name: string): string | undefined;
+//# sourceMappingURL=popular.d.ts.map

package/dist/api/guard/popular.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"popular.d.ts","sourceRoot":"","sources":["../../../src/api/guard/popular.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAsK7C,CAAC;AAIF,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAgBzD;AAID,+FAA+F;AAC/F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAU9D"}

package/dist/api/guard/popular.js

@@ -0,0 +1,206 @@
+/** Widely installed npm packages. A new package whose name sits next to one of these deserves a second look. */
+export const POPULAR_PACKAGES = [
+    "react",
+    "react-dom",
+    "react-router",
+    "react-router-dom",
+    "react-native",
+    "redux",
+    "react-redux",
+    "next",
+    "vue",
+    "vue-router",
+    "vuex",
+    "nuxt",
+    "angular",
+    "svelte",
+    "express",
+    "koa",
+    "fastify",
+    "hapi",
+    "lodash",
+    "underscore",
+    "ramda",
+    "moment",
+    "dayjs",
+    "date-fns",
+    "luxon",
+    "axios",
+    "node-fetch",
+    "got",
+    "superagent",
+    "request",
+    "chalk",
+    "colors",
+    "debug",
+    "commander",
+    "yargs",
+    "minimist",
+    "inquirer",
+    "ora",
+    "glob",
+    "rimraf",
+    "mkdirp",
+    "fs-extra",
+    "chokidar",
+    "webpack",
+    "webpack-cli",
+    "rollup",
+    "vite",
+    "esbuild",
+    "parcel",
+    "babel-core",
+    "typescript",
+    "ts-node",
+    "eslint",
+    "prettier",
+    "jest",
+    "mocha",
+    "chai",
+    "sinon",
+    "vitest",
+    "cypress",
+    "puppeteer",
+    "playwright",
+    "nodemon",
+    "dotenv",
+    "cors",
+    "body-parser",
+    "cookie-parser",
+    "express-session",
+    "helmet",
+    "morgan",
+    "passport",
+    "jsonwebtoken",
+    "bcrypt",
+    "bcryptjs",
+    "uuid",
+    "nanoid",
+    "validator",
+    "joi",
+    "yup",
+    "zod",
+    "ajv",
+    "mongoose",
+    "mongodb",
+    "mysql",
+    "mysql2",
+    "pg",
+    "redis",
+    "ioredis",
+    "sequelize",
+    "typeorm",
+    "prisma",
+    "knex",
+    "socket.io",
+    "ws",
+    "graphql",
+    "apollo-server",
+    "jquery",
+    "bootstrap",
+    "tailwindcss",
+    "postcss",
+    "autoprefixer",
+    "sass",
+    "less",
+    "styled-components",
+    "classnames",
+    "prop-types",
+    "immer",
+    "rxjs",
+    "bluebird",
+    "async",
+    "semver",
+    "yaml",
+    "js-yaml",
+    "cheerio",
+    "marked",
+    "handlebars",
+    "ejs",
+    "pug",
+    "nodemailer",
+    "winston",
+    "pino",
+    "bunyan",
+    "crypto-js",
+    "jsdom",
+    "tslib",
+    "core-js",
+    "regenerator-runtime",
+    "event-stream",
+    "left-pad",
+    "is-promise",
+    "ms",
+    "qs",
+    "cross-env",
+    "concurrently",
+    "husky",
+    "lint-staged",
+    "storybook",
+    "electron",
+    "aws-sdk",
+    "firebase",
+    "stripe",
+    "twilio",
+    "openai",
+    "langchain",
+    "anthropic",
+    "tensorflow",
+    "three",
+    "d3",
+    "chart.js",
+    "lodash-es",
+    "node-sass",
+    "sharp",
+    "multer",
+    "formidable",
+    "http-proxy",
+    "serve-static",
+    "compression",
+    "ansi-styles",
+    "strip-ansi",
+    "supports-color",
+    "readable-stream",
+    "string-width",
+    "wrap-ansi",
+    "color-convert",
+    "color-name",
+];
+const POPULAR_SET = new Set(POPULAR_PACKAGES);
+/** Optimal string alignment distance: edits, plus swapping two neighbouring letters. */
+export function editDistance(a, b) {
+    const rows = a.length + 1;
+    const cols = b.length + 1;
+    const d = Array.from({ length: rows }, () => Array.from({ length: cols }).fill(0));
+    for (let i = 0; i < rows; i += 1)
+        d[i][0] = i;
+    for (let j = 0; j < cols; j += 1)
+        d[0][j] = j;
+    for (let i = 1; i < rows; i += 1) {
+        for (let j = 1; j < cols; j += 1) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            d[i][j] = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + cost);
+            if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+                d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);
+            }
+        }
+    }
+    return d[a.length][b.length];
+}
+const squash = (name) => name.replaceAll(/[-_.]/g, "");
+/** The popular package this name imitates, if any. A popular package is never a look-alike. */
+export function findLookalike(name) {
+    if (name.startsWith("@") || POPULAR_SET.has(name))
+        return undefined;
+    for (const popular of POPULAR_PACKAGES) {
+        if (popular.length < 5)
+            continue;
+        if (squash(popular) === squash(name))
+            return popular;
+        const limit = popular.length >= 9 ? 2 : 1;
+        if (Math.abs(popular.length - name.length) <= limit && editDistance(popular, name) <= limit)
+            return popular;
+    }
+    return undefined;
+}
+//# sourceMappingURL=popular.js.map

package/dist/api/guard/popular.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"popular.js","sourceRoot":"","sources":["../../../src/api/guard/popular.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO;IACP,WAAW;IACX,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,OAAO;IACP,aAAa;IACb,MAAM;IACN,KAAK;IACL,YAAY;IACZ,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,SAAS;IACT,KAAK;IACL,SAAS;IACT,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,QAAQ;IACR,OAAO;IACP,UAAU;IACV,OAAO;IACP,OAAO;IACP,YAAY;IACZ,KAAK;IACL,YAAY;IACZ,SAAS;IACT,OAAO;IACP,QAAQ;IACR,OAAO;IACP,WAAW;IACX,OAAO;IACP,UAAU;IACV,UAAU;IACV,KAAK;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,UAAU;IACV,SAAS;IACT,aAAa;IACb,QAAQ;IACR,MAAM;IACN,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,SAAS;IACT,WAAW;IACX,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,MAAM;IACN,aAAa;IACb,eAAe;IACf,iBAAiB;IACjB,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,cAAc;IACd,QAAQ;IACR,UAAU;IACV,MAAM;IACN,QAAQ;IACR,WAAW;IACX,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,UAAU;IACV,SAAS;IACT,OAAO;IACP,QAAQ;IACR,IAAI;IACJ,OAAO;IACP,SAAS;IACT,WAAW;IACX,SAAS;IACT,QAAQ;IACR,MAAM;IACN,WAAW;IACX,IAAI;IACJ,SAAS;IACT,eAAe;IACf,QAAQ;IACR,WAAW;IACX,aAAa;IACb,SAAS;IACT,cAAc;IACd,MAAM;IACN,MAAM;IACN,mBAAmB;IACnB,YAAY;IACZ,YAAY;IACZ,OAAO;IACP,MAAM;IACN,UAAU;IACV,OAAO;IACP,QAAQ;IACR,MAAM;IACN,SAAS;IACT,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,KAAK;IACL,KAAK;IACL,YAAY;IACZ,SAAS;IACT,MAAM;IACN,QAAQ;IACR,WAAW;IACX,OAAO;IACP,OAAO;IACP,SAAS;IACT,qBAAqB;IACrB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,IAAI;IACJ,IAAI;IACJ,WAAW;IACX,cAAc;IACd,OAAO;IACP,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;IACT,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,WAAW;IACX,YAAY;IACZ,OAAO;IACP,IAAI;IACJ,UAAU;IACV,WAAW;IACX,WAAW;IACX,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,aAAa;IACb,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,cAAc;IACd,WAAW;IACX,eAAe;IACf,YAAY;CACb,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAE9C,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,CAAS;IAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;QAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC;QAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC;YACpF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACrE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC;AACjC,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEvE,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACjC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK;YACzF,OAAO,OAAO,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/api/guard/spec.d.ts

@@ -0,0 +1,22 @@
+export type ParsedSpec = {
+    kind: "registry";
+    name: string;
+    range?: string;
+} | {
+    kind: "other";
+    reason: string;
+} | {
+    kind: "invalid";
+    reason: string;
+};
+/** Split `name`, `name@range`, `@scope/name@range` and `npm:` aliases; recognise what is not a registry package. */
+export declare function parsePackageSpec(input: string): ParsedSpec;
+/**
+ * Package specs a shell command would install. Plain forms are understood, including options
+ * before or after the verb (`npm -g install a`, `pnpm -w add -D b`, `yarn workspace app add c`,
+ * `npm i --registry https://r d`). Anything cleverer (variables, subshells, scripts) is not parsed,
+ * which is why a hook built on this is a guard rail for agents and not a security boundary.
+ */
+export declare function extractInstallSpecs(command: string): string[];
+export declare function isRange(value: string): boolean;
+//# sourceMappingURL=spec.d.ts.map

package/dist/api/guard/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/api/guard/spec.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,oHAAoH;AACpH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAsB1D;AA6CD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA4C7D;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9C"}

package/dist/api/guard/spec.js

@@ -0,0 +1,124 @@
+import semver from "semver";
+const NAME = /^(?:@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
+const NON_REGISTRY = /^(?:[a-z][a-z0-9+.-]*:|\.{0,2}\/|~\/|[\w.-]+\/[\w.-]+$)/i;
+/** Split `name`, `name@range`, `@scope/name@range` and `npm:` aliases; recognise what is not a registry package. */
+export function parsePackageSpec(input) {
+    let spec = input.trim();
+    if (!spec)
+        return { kind: "invalid", reason: "empty package name" };
+    const alias = /^[^@\s]+@npm:(.+)$/.exec(spec) ?? /^npm:(.+)$/.exec(spec);
+    if (alias?.[1])
+        spec = alias[1];
+    const at = spec.lastIndexOf("@");
+    const name = at > 0 ? spec.slice(0, at) : spec;
+    const range = at > 0 ? spec.slice(at + 1) : undefined;
+    // `owner/repo` (GitHub shorthand), URLs, git and file specs bypass registry checks.
+    if (!name.startsWith("@") && NON_REGISTRY.test(spec)) {
+        return {
+            kind: "other",
+            reason: `"${spec.slice(0, 80)}" is not a registry package, so its contents cannot be checked`,
+        };
+    }
+    if (!NAME.test(name) || name.length > 214) {
+        return { kind: "invalid", reason: `"${name.slice(0, 80)}" is not a valid npm package name` };
+    }
+    return { kind: "registry", name, ...(range ? { range } : {}) };
+}
+const INSTALLERS = {
+    npm: ["install", "i", "add"],
+    pnpm: ["add", "install", "i"],
+    yarn: ["add"],
+    bun: ["add", "install", "i"],
+};
+/** Flags that take their value as the next word, per package manager (`--flag=value` carries it inline). */
+const VALUE_FLAGS = {
+    npm: new Set([
+        "--registry",
+        "--prefix",
+        "--workspace",
+        "-w",
+        "--tag",
+        "--cache",
+        "--loglevel",
+        "--userconfig",
+        "--omit",
+        "--include",
+        "--otp",
+    ]),
+    pnpm: new Set([
+        "--filter",
+        "-F",
+        "--dir",
+        "-C",
+        "--registry",
+        "--reporter",
+        "--loglevel",
+        "--workspace-concurrency",
+    ]),
+    yarn: new Set([
+        "--cwd",
+        "--registry",
+        "--cache-folder",
+        "--modules-folder",
+        "--network-timeout",
+        "--mutex",
+    ]),
+    bun: new Set(["--cwd", "-c", "--config", "--registry", "--cache-dir", "--backend"]),
+};
+/**
+ * Package specs a shell command would install. Plain forms are understood, including options
+ * before or after the verb (`npm -g install a`, `pnpm -w add -D b`, `yarn workspace app add c`,
+ * `npm i --registry https://r d`). Anything cleverer (variables, subshells, scripts) is not parsed,
+ * which is why a hook built on this is a guard rail for agents and not a security boundary.
+ */
+export function extractInstallSpecs(command) {
+    const specs = [];
+    for (const segment of command.split(/&&|\|\||;|\n|\|/)) {
+        const words = segment.trim().split(/\s+/).filter(Boolean);
+        // The package manager has to be the command itself, optionally after `sudo` or VAR=value words.
+        let at = 0;
+        while (at < words.length &&
+            (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[at]) || words[at] === "sudo")) {
+            at += 1;
+        }
+        const manager = words[at];
+        const verbs = manager === undefined ? undefined : INSTALLERS[manager];
+        if (!manager || !verbs)
+            continue;
+        const valueFlags = VALUE_FLAGS[manager] ?? new Set();
+        // Find the verb, stepping over options (and their values) and, for yarn, `workspace <name>`.
+        let i = at + 1;
+        let verb;
+        while (i < words.length) {
+            const word = words[i];
+            if (word.startsWith("-")) {
+                i += word.includes("=") || !valueFlags.has(word) ? 1 : 2;
+            }
+            else if (manager === "yarn" && word === "workspace") {
+                i += 2;
+            }
+            else {
+                verb = word;
+                break;
+            }
+        }
+        if (!verb || !verbs.includes(verb))
+            continue;
+        for (i += 1; i < words.length; i += 1) {
+            const word = words[i];
+            if (word.startsWith("-")) {
+                if (!word.includes("=") && valueFlags.has(word))
+                    i += 1;
+                continue;
+            }
+            const cleaned = word.replaceAll(/^["']|["']$/g, "");
+            if (cleaned)
+                specs.push(cleaned);
+        }
+    }
+    return [...new Set(specs)];
+}
+export function isRange(value) {
+    return semver.validRange(value) !== null;
+}
+//# sourceMappingURL=spec.js.map

package/dist/api/guard/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/api/guard/spec.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,IAAI,GAAG,0DAA0D,CAAC;AACxE,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAOhF,oHAAoH;AACpH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEpE,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;QAAE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEhC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtD,oFAAoF;IACpF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,gEAAgE;SAC9F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mCAAmC,EAAE,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,GAA6B;IAC3C,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC;IAC5B,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC;IAC7B,IAAI,EAAE,CAAC,KAAK,CAAC;IACb,GAAG,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC;CAC7B,CAAC;AAEF,4GAA4G;AAC5G,MAAM,WAAW,GAAwC;IACvD,GAAG,EAAE,IAAI,GAAG,CAAC;QACX,YAAY;QACZ,UAAU;QACV,aAAa;QACb,IAAI;QACJ,OAAO;QACP,SAAS;QACT,YAAY;QACZ,cAAc;QACd,QAAQ;QACR,WAAW;QACX,OAAO;KACR,CAAC;IACF,IAAI,EAAE,IAAI,GAAG,CAAC;QACZ,UAAU;QACV,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,YAAY;QACZ,YAAY;QACZ,YAAY;QACZ,yBAAyB;KAC1B,CAAC;IACF,IAAI,EAAE,IAAI,GAAG,CAAC;QACZ,OAAO;QACP,YAAY;QACZ,gBAAgB;QAChB,kBAAkB;QAClB,mBAAmB;QACnB,SAAS;KACV,CAAC;IACF,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;CACpF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,gGAAgG;QAChG,IAAI,EAAE,GAAG,CAAC,CAAC;QACX,OACE,EAAE,GAAG,KAAK,CAAC,MAAM;YACjB,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAE,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,EACrE,CAAC;YACD,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;YAAE,SAAS;QACjC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAE7D,6FAA6F;QAC7F,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACf,IAAI,IAAwB,CAAC;QAC7B,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACvB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC;iBAAM,IAAI,OAAO,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACtD,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,IAAI,CAAC;gBACZ,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAE7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACvB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,CAAC,IAAI,CAAC,CAAC;gBACxD,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAC3C,CAAC"}

package/dist/api/guard/types.d.ts

@@ -0,0 +1,34 @@
+export type GuardCheck = "spec" | "exists" | "malware" | "typosquat" | "cooldown" | "install-scripts" | "provenance" | "deprecated" | "vulnerabilities" | "registry";
+/** `block`: do not install. `warn`: a person should look first. `info`: worth knowing. */
+export type GuardSeverity = "block" | "warn" | "info";
+export type GuardVerdict = "allow" | "warn" | "block";
+export interface GuardFinding {
+    check: GuardCheck;
+    severity: GuardSeverity;
+    message: string;
+}
+export interface GuardAlternative {
+    packageName: string;
+    version?: string;
+    reason: string;
+}
+export interface GuardReport {
+    schemaVersion: "1.0";
+    /** What was asked about, as given. */
+    spec: string;
+    packageName?: string;
+    /** The version the spec would install. */
+    resolvedVersion?: string;
+    verdict: GuardVerdict;
+    findings: GuardFinding[];
+    alternative?: GuardAlternative;
+    generatedAt: string;
+}
+export interface GuardOptions {
+    cwd?: string;
+    /** Block releases younger than this many hours. Default 72; 0 turns the check off. */
+    minPublishAgeHours?: number;
+    /** Skip the OSV malware and advisory lookups (the verdict then says they were not checked). */
+    offline?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/api/guard/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/api/guard/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,QAAQ,GACR,SAAS,GACT,WAAW,GACX,UAAU,GACV,iBAAiB,GACjB,YAAY,GACZ,YAAY,GACZ,iBAAiB,GACjB,UAAU,CAAC;AAEf,0FAA0F;AAC1F,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,KAAK,CAAC;IACrB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB"}

package/dist/api/guard/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/api/guard/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/guard/types.ts"],"names":[],"mappings":""}