border-customs 0.8.1 → 0.8.2

package/dist/assets/package-lock.json

@@ -1,20 +1,19 @@
 {
   "name": "border-customs",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "border-customs",
-      "version": "0.8.1",
+      "version": "0.8.2",
       "license": "MIT",
       "dependencies": {
-        "@opencode-ai/plugin": "^1.17.4",
         "@secretlint/core": "13.0.5",
         "@secretlint/secretlint-rule-no-dotenv": "13.0.5",
         "@secretlint/secretlint-rule-no-homedir": "13.0.5",
-        "@secretlint/secretlint-rule-pattern": "13.0.5",
         "@secretlint/secretlint-rule-preset-recommend": "13.0.5",
+        "@textlint/regexp-string-matcher": "2.0.2",
         "publint": "0.3.24",
         "yaml": "2.9.0",
         "zod": "4.5.4"
@@ -23,6 +22,8 @@
         "border": "dist/index.js"
       },
       "devDependencies": {
+        "@opencode-ai/plugin": "^1.19.4",
+        "@secretlint/secretlint-rule-pattern": "13.0.5",
         "@types/node": "22.19.0",
         "esbuild": "0.25.12",
         "secretlint": "13.0.5",
@@ -30,13 +31,14 @@
         "verdaccio": "6.10.2"
       },
       "engines": {
-        "node": ">=22.0.0"
+        "node": ">=22.22.2"
       }
     },
     "node_modules/@ai-sdk/provider": {
       "version": "3.0.8",
       "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-3.0.8.tgz",
       "integrity": "sha512-oGMAgGoQdBXbZqNG0Ze56CHjDZ1IDYOwGYxYjO5KLSlz5HiNQ9udIXsPZ61VWaHGZ5XW/jyjmr6t2xz2jGVwbQ==",
+      "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
         "json-schema": "^0.4.0"
@@ -572,6 +574,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -585,6 +588,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -598,6 +602,7 @@
       "cpu": [
         "arm"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -611,6 +616,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -624,6 +630,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -637,6 +644,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -682,13 +690,14 @@
       }
     },
     "node_modules/@opencode-ai/plugin": {
-      "version": "1.18.30",
-      "resolved": "https://registry.npmjs.org/@opencode-ai/plugin/-/plugin-1.18.30.tgz",
-      "integrity": "sha512-bXWcA2VD478PXXke1qAYANTq58fCcbgY0GAUqZIFZqPpo48FoG8RH37nNZ78eHtz+ddiKIhFTBZJRaHF3IgFqw==",
+      "version": "1.19.4",
+      "resolved": "https://registry.npmjs.org/@opencode-ai/plugin/-/plugin-1.19.4.tgz",
+      "integrity": "sha512-VN71q/OmfggxIhiDbuzYDYmZcQMsNyVSw1o91e7LD6WUn/9jx4usI9ZpoPbC5p/Prpo/Umzpd+38+EuLoKRr+A==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@ai-sdk/provider": "3.0.8",
-        "@opencode-ai/sdk": "1.18.30",
+        "@opencode-ai/sdk": "1.19.4",
         "effect": "4.0.0-beta.83",
         "zod": "4.1.8"
       },
@@ -713,15 +722,17 @@
       "version": "4.1.8",
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.1.8.tgz",
       "integrity": "sha512-5R1P+WwQqmmMIEACyzSvo4JXHY5WiAFHRMg+zBZKgKS+Q1viRa0C1hmUKtHltoIFKtIdki3pRxkmpP74jnNYHQ==",
+      "dev": true,
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
     },
     "node_modules/@opencode-ai/sdk": {
-      "version": "1.18.30",
-      "resolved": "https://registry.npmjs.org/@opencode-ai/sdk/-/sdk-1.18.30.tgz",
-      "integrity": "sha512-uviJ+PZLc/D1szt33WGzzt/rqJ+IaNmRGBb+UcOXrcQANl8XXKJrp4CNQQ2UAnUJ3Ek+VqcamIwjtKHUW/OjOQ==",
+      "version": "1.19.4",
+      "resolved": "https://registry.npmjs.org/@opencode-ai/sdk/-/sdk-1.19.4.tgz",
+      "integrity": "sha512-3Wuc4t8gEuWKHbX1Na9oDK6PgOveid70l4Ks5RCjRIo2RcP8FQN3NS6Mg3XWc2+WiUfpfrmvBWlh5u1zeQfDQw==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "cross-spawn": "7.0.6"
@@ -773,6 +784,7 @@
       "version": "13.0.5",
       "resolved": "https://registry.npmjs.org/@secretlint/config-loader/-/config-loader-13.0.5.tgz",
       "integrity": "sha512-3hZ6xweL5kuRPqm4YTn9TE8yVkZVjwchtTqaSntT4C35kyrKohVMMTi9lPp6bgMDD/lzXKlwwRUuSn/dcPZq3Q==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@secretlint/profiler": "13.0.5",
@@ -854,6 +866,7 @@
       "version": "13.0.5",
       "resolved": "https://registry.npmjs.org/@secretlint/resolver/-/resolver-13.0.5.tgz",
       "integrity": "sha512-6V3PfSKJTafCMLbPMVZkP1d43Ot9y4hB8tmtA10NEybnV2gqgO8hMrWe2SsZUPBugjUPTise7efs9BFPsO9M6A==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/@secretlint/secretlint-rule-no-dotenv": {
@@ -886,6 +899,7 @@
       "version": "13.0.5",
       "resolved": "https://registry.npmjs.org/@secretlint/secretlint-rule-pattern/-/secretlint-rule-pattern-13.0.5.tgz",
       "integrity": "sha512-O5FasZpXq8WZ6GPcqiPYDxyJTr1Bx+WjXC3lXd3mpbYb1abEuETDLNuu3AWOtp2Bh39TXQVvj40lX+NcWzus6Q==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@secretlint/tester": "13.0.5",
@@ -910,6 +924,7 @@
       "version": "13.0.5",
       "resolved": "https://registry.npmjs.org/@secretlint/source-creator/-/source-creator-13.0.5.tgz",
       "integrity": "sha512-Y1edWpqit4Ai9fM4LU+v3s0JcCW6rSzOisDcxKBKfrg6ynFPX8n+JwEr5Bk+zGA0RnwlngJbmqjS+/CxDNl56A==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@secretlint/types": "13.0.5",
@@ -923,6 +938,7 @@
       "version": "13.0.5",
       "resolved": "https://registry.npmjs.org/@secretlint/tester/-/tester-13.0.5.tgz",
       "integrity": "sha512-gc/SEhYgcd6ghaRxRxasb/FX+jb6TY9DpduXVqNQ+CPZYydMIkordnw0Ac3MTYr7J3ETFh/vCb6u3HGge6I3IA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@secretlint/config-loader": "13.0.5",
@@ -997,6 +1013,7 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
       "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/@textlint/ast-node-types": {
@@ -1564,6 +1581,7 @@
       "version": "8.20.0",
       "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
       "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
@@ -1635,6 +1653,7 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
       "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true,
       "license": "Python-2.0"
     },
     "node_modules/array-flatten": {
@@ -1877,6 +1896,7 @@
       "version": "6.11.0",
       "resolved": "https://registry.npmjs.org/binaryextensions/-/binaryextensions-6.11.0.tgz",
       "integrity": "sha512-sXnYK/Ij80TO3lcqZVV2YgfKN5QjUWIRk/XSm2J/4bd/lPko3lvk0O4ZppH6m+6hB2/GTu+ptNwVFe1xh+QLQw==",
+      "dev": true,
       "license": "Artistic-2.0",
       "dependencies": {
         "editions": "^6.21.0"
@@ -1970,6 +1990,7 @@
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
       "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "fill-range": "^7.1.1"
@@ -2317,6 +2338,7 @@
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
@@ -2415,6 +2437,7 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
       "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
       "license": "Apache-2.0",
       "optional": true,
       "engines": {
@@ -2487,6 +2510,7 @@
       "version": "6.22.0",
       "resolved": "https://registry.npmjs.org/editions/-/editions-6.22.0.tgz",
       "integrity": "sha512-UgGlf8IW75je7HZjNDpJdCv4cGJWIi6yumFdZ0R7A8/CIhQiWUjyGLCxdHpd8bmyD1gnkfUNK0oeOXqUS2cpfQ==",
+      "dev": true,
       "license": "Artistic-2.0",
       "dependencies": {
         "version-range": "^4.15.0"
@@ -2510,6 +2534,7 @@
       "version": "4.0.0-beta.83",
       "resolved": "https://registry.npmjs.org/effect/-/effect-4.0.0-beta.83.tgz",
       "integrity": "sha512-0wsak8RtgGAr9UWSbVDgJHZcUqMSvicHcvaZv1MbMM7MCGgW4Rn/137J1MHQbwYPcwYGxT/IqehFd+UbYuj78w==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
@@ -2836,6 +2861,7 @@
       "version": "4.10.0",
       "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-4.10.0.tgz",
       "integrity": "sha512-hhqQL+IJllZi3aM4TKvmCj3bywLEcycNTTLZeLhA9ttMxBrCqM07q7Di4kl+j9EWSTXvJH1+EpIgsDbF/+8H5Q==",
+      "dev": true,
       "funding": [
         {
           "type": "individual",
@@ -2858,6 +2884,7 @@
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
       "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-fifo": {
@@ -2888,6 +2915,7 @@
       "version": "3.1.7",
       "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
       "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
+      "dev": true,
       "funding": [
         {
           "type": "github",
@@ -2914,6 +2942,7 @@
       "version": "7.1.1",
       "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
       "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "to-regex-range": "^5.0.1"
@@ -2962,6 +2991,7 @@
       "version": "0.1.6",
       "resolved": "https://registry.npmjs.org/find-my-way-ts/-/find-my-way-ts-0.1.6.tgz",
       "integrity": "sha512-a85L9ZoXtNAey3Y6Z+eBWW658kO/MwR7zIafkIUPUMf3isZG0NCs2pjW2wtjxAKuJPxMAsHUIP4ZPGv0o5gyTA==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/forever-agent": {
@@ -3446,6 +3476,7 @@
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/ini/-/ini-7.0.0.tgz",
       "integrity": "sha512-ifK0CgjALofS5bkrcTy4RaQ9Vx2Knf/eLeIO+NaswQEpH1UblrtTSCIvN71qQDMq0PeQ/SSPojvEJp9vvvfr+w==",
+      "dev": true,
       "license": "ISC",
       "engines": {
         "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
@@ -3515,6 +3546,7 @@
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
       "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.12.0"
@@ -3558,6 +3590,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true,
       "license": "ISC"
     },
     "node_modules/isstream": {
@@ -3571,6 +3604,7 @@
       "version": "9.5.0",
       "resolved": "https://registry.npmjs.org/istextorbinary/-/istextorbinary-9.5.0.tgz",
       "integrity": "sha512-5mbUj3SiZXCuRf9fT3ibzbSSEWiy63gFfksmGfdOzujPjW3k+z8WvIBxcJHBoQNlaZaiyB25deviif2+osLmLw==",
+      "dev": true,
       "license": "Artistic-2.0",
       "dependencies": {
         "binaryextensions": "^6.11.0",
@@ -3625,12 +3659,14 @@
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/json-schema/-/json-schema-0.4.0.tgz",
       "integrity": "sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==",
+      "dev": true,
       "license": "(AFL-2.1 OR BSD-3-Clause)"
     },
     "node_modules/json-schema-traverse": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
       "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/json-stringify-safe": {
@@ -3644,6 +3680,7 @@
       "version": "2.2.3",
       "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
       "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true,
       "license": "MIT",
       "bin": {
         "json5": "lib/cli.js"
@@ -3755,6 +3792,7 @@
       "version": "1.30.0",
       "resolved": "https://registry.npmjs.org/kubernetes-types/-/kubernetes-types-1.30.0.tgz",
       "integrity": "sha512-Dew1okvhM/SQcIa2rcgujNndZwU8VnSapDgdxlYoB84ZlpAD43U6KLAFqYo17ykSFGHNPrg0qry0bP+GJd9v7Q==",
+      "dev": true,
       "license": "Apache-2.0"
     },
     "node_modules/lockfile": {
@@ -3942,6 +3980,7 @@
       "version": "4.0.8",
       "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
       "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "braces": "^3.0.3",
@@ -4068,6 +4107,7 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-2.1.0.tgz",
       "integrity": "sha512-p/pBCVO63CsvvpkomUnNNag6+n38rULuDA6HHe70o2gtC8ODI52foF/4ko2qQcp6OiErJXTmrZeXmsGGHsIQNQ==",
+      "dev": true,
       "license": "MIT",
       "optionalDependencies": {
         "msgpackr-extract": "^3.0.4"
@@ -4077,6 +4117,7 @@
       "version": "3.0.4",
       "resolved": "https://registry.npmjs.org/msgpackr-extract/-/msgpackr-extract-3.0.4.tgz",
       "integrity": "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw==",
+      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -4099,6 +4140,7 @@
       "version": "0.2.8",
       "resolved": "https://registry.npmjs.org/multipasta/-/multipasta-0.2.8.tgz",
       "integrity": "sha512-ZPWuMKyv0cSO29f7hozp+k6+crZbQijV8ipMvxNxRf2SwtYGTX1ZX89Kd20VV4H9Znonx+EQn+iy1wGQsJ+b+Q==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/negotiator": {
@@ -4143,6 +4185,7 @@
       "version": "5.2.2",
       "resolved": "https://registry.npmjs.org/node-gyp-build-optional-packages/-/node-gyp-build-optional-packages-5.2.2.tgz",
       "integrity": "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -4319,6 +4362,7 @@
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
       "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -4370,6 +4414,7 @@
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
       "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8.6"
@@ -4589,6 +4634,7 @@
       "version": "8.4.2",
       "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-8.4.2.tgz",
       "integrity": "sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng==",
+      "dev": true,
       "funding": [
         {
           "type": "individual",
@@ -4689,6 +4735,7 @@
       "version": "4.1.4",
       "resolved": "https://registry.npmjs.org/rc-config-loader/-/rc-config-loader-4.1.4.tgz",
       "integrity": "sha512-3GiwEzklkbXTDp52UR5nT8iXgYAx1V9ZG/kDZT7p60u2GCv2XTwQq4NzinMoMpNtXhmt3WkhYXcj6HH8HdwCEQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "debug": "^4.4.3",
@@ -4701,6 +4748,7 @@
       "version": "4.3.2",
       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
       "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
+      "dev": true,
       "funding": [
         {
           "type": "github",
@@ -4776,6 +4824,7 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
       "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -5030,6 +5079,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
       "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -5042,6 +5092,7 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -5513,6 +5564,7 @@
       "version": "6.11.0",
       "resolved": "https://registry.npmjs.org/textextensions/-/textextensions-6.11.0.tgz",
       "integrity": "sha512-tXJwSr9355kFJI3lbCkPpUH5cP8/M0GGy2xLO34aZCjMXBaK3SoPnZwr/oWmo1FdCnELcs4npdCIOFtq9W3ruQ==",
+      "dev": true,
       "license": "Artistic-2.0",
       "dependencies": {
         "editions": "^6.21.0"
@@ -5585,6 +5637,7 @@
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
       "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "is-number": "^7.0.0"
@@ -5607,6 +5660,7 @@
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/toml/-/toml-4.3.0.tgz",
       "integrity": "sha512-lVb8X9BsPVuH0M4BKeS91tXAmJvCjQ5UIyAbQFaxkKGyUFK2RPkhwaFSQH8vbpl1d23eu/IBH+dwVMHWaq9A5A==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=20"
@@ -5808,6 +5862,7 @@
       "version": "14.0.2",
       "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.2.tgz",
       "integrity": "sha512-xZe/16rV4aa+HGSOCiY2YeLT1OybRLrrkL/Rqaq7p7GMVXjFh+6wN4oMYgjFmnSnhY8t6Xpdl2l9qmnHYuMHwQ==",
+      "dev": true,
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
@@ -5967,6 +6022,7 @@
       "version": "4.15.0",
       "resolved": "https://registry.npmjs.org/version-range/-/version-range-4.15.0.tgz",
       "integrity": "sha512-Ck0EJbAGxHwprkzFO966t4/5QkRuzh+/I1RxhLgUKKwEn+Cd8NwM60mE3AqBZg5gYODoXW0EFsQvbZjRlvdqbg==",
+      "dev": true,
       "license": "Artistic-2.0",
       "engines": {
         "node": ">=4"
@@ -5997,6 +6053,7 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
       "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"

package/dist/assets/residue-src/crates.ts

@@ -28,6 +28,8 @@ import { cratesCoherenceFindings } from "../rules/releaseCoherence.ts";
 import { scanTree } from "../engines/gitleaks.ts";
 import { scanPaths, type SecretlintMode } from "../engines/secretlint.ts";
 import { EngineMissingError, EngineRunError, type EngineOptions } from "../engines/support.ts";
+import { sandboxRun } from "./sandbox.ts";
+import { realDockerExec, type DockerExec } from "../roundtrip/docker.ts";
 import type { TextSanitizer } from "../redact.ts";
 
 /** Native-finding target label shared across the artifact-stage scans. */
@@ -50,6 +52,8 @@ export type CrateStageOptions = {
   readonly secretlintMode?: SecretlintMode;
   /** Exact cargo binary seam (tests / pinned toolchains); default "cargo" on PATH. */
   readonly cargoBinPath?: string;
+  /** W4 sandbox seam (only consulted when targets.crates.sandboxImage is set). */
+  readonly sandboxExec?: DockerExec;
   /** shared engine/extract timeout. */
   readonly timeoutMs?: number;
   readonly cargoTimeoutMs?: number;
@@ -58,6 +62,8 @@ export type CrateStageOptions = {
 export type CrateStageResult = {
   readonly findings: readonly Finding[];
   readonly artifact: CrateArtifactRecord | null;
+  /** Observed in-image toolchain versions (sandbox runs only) — record binding. */
+  readonly toolchain?: string;
 };
 
 function scopeFindingPath(f: Finding, extractDir: string): Finding {
@@ -123,15 +129,18 @@ export async function runCargoArtifactStage(o: CrateStageOptions): Promise<Crate
   const identity = manifestIdentity(repoDir, o.cfg);
   const crateName = `${identity.name}-${identity.version}.crate`;
 
-  const versionCheck = spawnSync(bin, ["--version"], {
-    encoding: "utf8",
-    stdio: "ignore",
-    ...(o.env === undefined ? {} : { env: { ...o.env } }),
-  });
-  if (versionCheck.error !== undefined || versionCheck.status !== 0) {
-    throw new EngineMissingError(
-      `cargo is not available (\`${bin} --version\` failed) — install Rust via rustup (https://rustup.rs) or pass cargoBinPath before running border check (border exit 2)`,
-    );
+  const sandboxImage = o.cfg.targets.crates.sandboxImage;
+  if (sandboxImage === undefined) {
+    const versionCheck = spawnSync(bin, ["--version"], {
+      encoding: "utf8",
+      stdio: "ignore",
+      ...(o.env === undefined ? {} : { env: { ...o.env } }),
+    });
+    if (versionCheck.error !== undefined || versionCheck.status !== 0) {
+      throw new EngineMissingError(
+        `cargo is not available (\`\${bin} --version\` failed) — install Rust via rustup (https://rustup.rs) or pass cargoBinPath before running border check (border exit 2)`,
+      );
+    }
   }
 
   ensureStateDir(repoDir);
@@ -142,31 +151,50 @@ export async function runCargoArtifactStage(o: CrateStageOptions): Promise<Crate
   rmSync(targetDir, { recursive: true, force: true }); // stale build output from an interrupted run
   mkdirSync(targetDir, { recursive: true });
 
+  const dist = join(distDir, crateName);
   try {
-    const result = spawnSync(bin, ["package", "--allow-dirty", "--no-verify"], {
-      cwd: repoDir,
-      encoding: "utf8",
-      timeout: o.cargoTimeoutMs ?? 120_000,
-      env: {
-        ...(o.env === undefined ? process.env : { ...o.env }),
-        CARGO_TARGET_DIR: targetDir,
-      },
-    });
-    if (result.error !== undefined || result.status !== 0) {
-      throw new EngineRunError(
-        `cargo package failed (exit ${String(result.status)}) — nothing to gate: ${(result.stderr ?? "").trim().slice(0, 400)}`,
-        result.status,
-      );
+    let stageToolchain: string | undefined;
+    if (sandboxImage !== undefined) {
+      const cacheDir = join(repoDir, BORDER_STATE_DIR, "cache");
+      mkdirSync(cacheDir, { recursive: true });
+      const run = sandboxRun({
+        spec: { image: sandboxImage, docker: o.sandboxExec ?? realDockerExec() },
+        repoDir,
+        outDir: distDir,
+        laneProbes: ["cargo", "rustc"],
+        cargoCacheHostDir: cacheDir,
+        laneScript:
+          "cargo package --allow-dirty --no-verify\n"
+          + "find target/package -maxdepth 1 -name '*.crate' -exec cp {} /audit/out/ ;",
+      });
+      stageToolchain = run.toolchain;
+    } else {
+      const result = spawnSync(bin, ["package", "--allow-dirty", "--no-verify"], {
+        cwd: repoDir,
+        encoding: "utf8",
+        timeout: o.cargoTimeoutMs ?? 120_000,
+        env: {
+          ...(o.env === undefined ? process.env : { ...o.env }),
+          CARGO_TARGET_DIR: targetDir,
+        },
+      });
+      if (result.error !== undefined || result.status !== 0) {
+        throw new EngineRunError(
+          `cargo package failed (exit ${String(result.status)}) — nothing to gate: ${(result.stderr ?? "").trim().slice(0, 400)}`,
+          result.status,
+        );
+      }
+      // cargo writes the crate to <target-dir>/package/<name>-<version>.crate
+      const packedDir = join(targetDir, "package");
+      const packed = join(packedDir, crateName);
+      if (!existsSync(packed)) {
+        throw new EngineRunError(`cargo package produced no ${crateName} in ${relative(repoDir, packedDir)} — failing closed`, null);
+      }
+      renameSync(packed, dist);
     }
-
-    // cargo writes the crate to <target-dir>/package/<name>-<version>.crate
-    const packedDir = join(targetDir, "package");
-    const packed = join(packedDir, crateName);
-    if (!existsSync(packed)) {
-      throw new EngineRunError(`cargo package produced no ${crateName} in ${relative(repoDir, packedDir)} — failing closed`, null);
+    if (!existsSync(dist)) {
+      throw new EngineRunError(`cargo package produced no ${crateName} in ${relative(repoDir, distDir)} — failing closed`, null);
     }
-    const dist = join(distDir, crateName);
-    renameSync(packed, dist);
 
     const bytes = readFileSync(dist);
     const sha256 = createHash("sha256").update(bytes).digest("hex");
@@ -234,6 +262,7 @@ export async function runCargoArtifactStage(o: CrateStageOptions): Promise<Crate
     return {
       findings,
       artifact: { file: `${BORDER_STATE_DIR}/dist/${crateName}`, sha256, bytes: bytes.length },
+      ...(stageToolchain !== undefined ? { toolchain: stageToolchain } : {}),
     };
   } finally {
     rmSync(targetDir, { recursive: true, force: true });