pnpm-audit-hook 1.0.0

package/.pnpm-audit.yaml

@@ -0,0 +1,27 @@
+# Minimal pnpm-audit-hook configuration
+# Only essential options are included; defaults are used for everything else
+
+policy:
+  block:
+    - critical
+    - high
+  warn:
+    - medium
+    - low
+    - unknown
+
+sources:
+  github: true
+  nvd: true
+
+cache:
+  ttlSeconds: 3600
+
+# Static baseline configuration for historical vulnerabilities
+# Vulnerabilities published before the cutoff date use a static database
+# instead of making live API calls, improving performance and reliability
+#
+# staticBaseline:
+#   enabled: true              # Enable/disable static baseline (default: true)
+#   cutoffDate: "2025-12-31"   # Vulnerabilities before this use static DB (ISO date, must not be in future)
+#   dataPath: "node_modules/pnpm-audit-hook/dist/static-db/data"  # Optional custom path to static data directory

package/.pnpmfile.cjs

@@ -0,0 +1,38 @@
+/**
+ * pnpm hooks entrypoint.
+ *
+ * This file is executed by pnpm during dependency resolution.
+ * It MUST be CommonJS (pnpm loads `.pnpmfile.cjs` via require()).
+ *
+ * Implementation detail:
+ * - We keep heavy logic in the compiled JS under ./dist
+ * - This keeps the hook itself small and avoids loading TS at runtime.
+ *
+ * If you copy this hook into another repo, adjust the `require(...)` path
+ * or install this package as a pnpm "config dependency" and require it by name.
+ */
+const path = require('node:path');
+
+const distEntry = path.join(__dirname, 'dist', 'index.js');
+
+try {
+  const mod = require(distEntry);
+  if (!mod || typeof mod.createPnpmHooks !== 'function') {
+    throw new Error(`Expected an exported createPnpmHooks() from ${distEntry}`);
+  }
+  module.exports = mod.createPnpmHooks();
+} catch (err) {
+  const hint = [
+    'pnpm-audit-hook: compiled entry not found (or failed to load).',
+    `Expected: ${distEntry}`,
+    '',
+    'Fix:',
+    '  1) Run: npm run build',
+    '  2) Ensure dist/ is present',
+    '',
+    `Original error: ${err && err.message ? err.message : String(err)}`,
+    '',
+    'Docs: https://pnpm.io/pnpmfile',
+  ].join('\n');
+  throw new Error(hint);
+}

package/README.md

@@ -0,0 +1,308 @@
+# pnpm-audit-hook
+
+A pnpm hook that audits dependencies for vulnerabilities **before packages are downloaded**. It queries the GitHub Advisory Database for vulnerabilities and optionally enriches severity data from NVD, blocking installs when critical or high severity issues are found.
+
+## Installation
+
+### From npm/pnpm (Easiest)
+
+```bash
+# Install the package
+pnpm add -D pnpm-audit-hook
+
+# Run setup to create .pnpmfile.cjs in your project
+pnpm exec pnpm-audit-setup
+```
+
+That's it! Every `pnpm install` will now audit packages for vulnerabilities.
+
+### Global Setup (All Projects)
+
+To enable for all pnpm projects on your machine:
+
+```bash
+# Install globally
+pnpm add -g pnpm-audit-hook
+
+# Create global hooks directory
+mkdir -p ~/.pnpm-hooks
+cp $(pnpm root -g)/pnpm-audit-hook/dist ~/.pnpm-hooks/ -r
+cp $(pnpm root -g)/pnpm-audit-hook/.pnpmfile.cjs ~/.pnpm-hooks/
+
+# Configure pnpm to use global hooks
+pnpm config set global-pnpmfile ~/.pnpm-hooks/.pnpmfile.cjs
+```
+
+### Manual Setup
+
+```bash
+git clone https://github.com/asx8678/pnpm-audit-hook.git
+cd pnpm-audit-hook
+pnpm install && pnpm run build
+
+# Copy to your project
+cp -r dist /path/to/your/project/
+cp .pnpmfile.cjs /path/to/your/project/
+```
+
+## Quick Test
+
+```bash
+pnpm add lodash              # Safe - installs normally
+pnpm add event-stream@3.3.6  # Vulnerable - blocked!
+```
+
+If vulnerabilities are found, install fails before any packages are downloaded.
+
+## Configuration
+
+Create `.pnpm-audit.yaml` in your project root:
+
+```yaml
+policy:
+  block:
+    - critical
+    - high
+  warn:
+    - medium
+    - low
+    - unknown
+  allowlist:
+    - id: CVE-2024-12345
+      reason: "False positive"
+    - package: legacy-lib
+      expires: "2025-06-01"
+
+sources:
+  github: true
+  nvd: true
+
+performance:
+  timeoutMs: 15000
+
+cache:
+  ttlSeconds: 3600
+```
+
+All fields are optional. Set any source to `false` to disable it.
+
+### Configuration Constraints
+
+The following validation rules are applied to configuration values:
+
+| Setting | Constraint | Default |
+|---------|------------|---------|
+| `performance.timeoutMs` | 1 to 300,000 ms (5 minutes max) | 15,000 |
+| `cache.ttlSeconds` | 1 to 86,400 seconds (24 hours max) | 3,600 |
+| `staticBaseline.cutoffDate` | Valid ISO date format, must not be in the future | 2025-12-31 |
+
+Invalid values are silently replaced with defaults to ensure safe operation.
+
+## Vulnerability Sources
+
+| Source | Description | Auth |
+|--------|-------------|------|
+| **GitHub Advisory** | Primary source - GitHub Security Advisory database (GHSA) | Optional |
+| **NVD** | Severity enrichment only - NIST National Vulnerability Database | Optional |
+
+GitHub Advisory is the primary vulnerability source. NVD provides additional severity metadata but does not add new vulnerability entries.
+
+## Allowlist
+
+Suppress specific vulnerabilities or packages:
+
+```yaml
+policy:
+  allowlist:
+    - id: CVE-2024-12345
+      reason: "False positive for our use case"
+    - package: legacy-lib
+      reason: "Accepted risk"
+      expires: "2025-06-01"
+```
+
+- `id` - CVE or GHSA identifier to ignore (case-insensitive)
+- `package` - Package name to ignore entirely (case-insensitive)
+- If both `id` and `package` are set, **both must match** (scoped allowlist)
+- `reason` - Why it's allowed (for audit trail)
+- `expires` - ISO date when the allowlist entry expires
+
+## Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| `PNPM_AUDIT_CONFIG_PATH` | Override config file location |
+| `PNPM_AUDIT_DISABLE_GITHUB` | Disable GitHub Advisory source |
+| `GITHUB_TOKEN` | GitHub API token (optional) |
+| `GH_TOKEN` | Alternative to GITHUB_TOKEN |
+| `NVD_API_KEY` | NVD API key (optional) |
+| `NIST_NVD_API_KEY` | Alternative to NVD_API_KEY |
+| `PNPM_AUDIT_QUIET` | Suppress info/warn output (`true` to enable) |
+| `PNPM_AUDIT_DEBUG` | Enable debug logging (`true` to enable) |
+| `PNPM_AUDIT_JSON` | Enable JSON output format (`true` to enable) |
+
+## How It Works
+
+1. pnpm resolves the full dependency graph
+2. `.pnpmfile.cjs` hook runs `afterAllResolved()` before downloads
+3. The hook queries GitHub Advisory (and optionally NVD for severity enrichment)
+4. Findings are deduplicated and checked against the severity policy
+5. If any blocking vulnerabilities exist, pnpm aborts the install
+
+**Note:** The `.pnpmfile.cjs` file must be in your workspace root directory.
+
+## CI/CD Integration
+
+### GitHub Actions
+
+```yaml
+name: Install with Audit
+on: [push, pull_request]
+
+jobs:
+  install:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+      - run: pnpm install
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+```
+
+The hook runs automatically during `pnpm install` and will fail the job if blocking vulnerabilities are found.
+
+## Static Vulnerability Database
+
+The hook includes a bundled database of historical vulnerabilities (2020-2025) that enables faster audits and reduced API calls.
+
+### How It Works
+
+- **Historical vulnerabilities** (before the cutoff date) are served from the bundled static database
+- **New vulnerabilities** (after the cutoff date) are fetched from live APIs
+- This hybrid approach provides offline capability for historical data while ensuring fresh data for recent disclosures
+
+### Benefits
+
+- **Faster audits**: No API calls needed for known historical vulnerabilities
+- **Reduced API calls**: Only new vulnerabilities require network requests
+- **Offline capability**: Historical vulnerability checks work without internet access
+- **Rate limit friendly**: Minimizes API usage against GitHub and NVD
+
+### Configuration
+
+Enable or disable the static baseline in `.pnpm-audit.yaml`:
+
+```yaml
+staticBaseline:
+  enabled: true
+  cutoffDate: "2025-12-31"
+  dataPath: "node_modules/pnpm-audit-hook/dist/static-db/data"  # optional custom path
+```
+
+- `enabled` - Whether to use the static database (default: `true`)
+- `cutoffDate` - Vulnerabilities published before this date use the static database (must be valid ISO format, not in future)
+- `dataPath` - Optional custom path to static data directory (default: bundled data)
+
+### Updating the Database
+
+Update the bundled vulnerability database monthly to capture new disclosures:
+
+```bash
+# Full rebuild of the vulnerability database
+pnpm run update-vuln-db
+
+# Incremental update (faster, adds only new vulnerabilities)
+pnpm run update-vuln-db:incremental
+```
+
+After updating, rebuild and commit the changes:
+
+```bash
+pnpm run build
+git add src/static-db/data/ dist/static-db/data/
+git commit -m "chore: update vulnerability database"
+```
+
+### Update Workflow
+
+1. Run `pnpm run update-vuln-db:incremental` monthly
+2. Optionally extend `cutoffDate` in your config to include newer static data
+3. Commit the updated `data/` directory to your repository
+
+## Local Development with pnpm
+
+### Setup
+
+```bash
+git clone https://github.com/asx8678/pnpm-audit-hook.git
+cd pnpm-audit-hook
+pnpm install
+pnpm run build
+```
+
+### Test in Another Project (pnpm link)
+
+```bash
+# In pnpm-audit-hook directory
+pnpm link --global
+
+# In your target project
+pnpm link --global pnpm-audit-hook
+
+# Copy the hook file to your project root
+cp node_modules/pnpm-audit-hook/.pnpmfile.cjs .
+
+# Edit .pnpmfile.cjs to point to linked package
+# Change: path.join(__dirname, 'dist', 'index.js')
+# To:     path.join(__dirname, 'node_modules', 'pnpm-audit-hook', 'dist', 'index.js')
+
+# Test it
+pnpm add lodash
+```
+
+### Test Directly in This Repo
+
+The `.pnpmfile.cjs` already points to `./dist`, so you can test directly:
+
+```bash
+pnpm run build
+pnpm add lodash              # Safe package
+pnpm add event-stream@3.3.6  # Vulnerable - should be blocked
+```
+
+### Development Workflow
+
+```bash
+# Make changes to src/
+pnpm run build
+
+# Run tests
+pnpm test
+
+# Test the hook manually
+pnpm add some-package
+```
+
+### Unlink After Testing
+
+```bash
+# In your target project
+pnpm unlink pnpm-audit-hook
+rm .pnpmfile.cjs
+
+# In pnpm-audit-hook directory
+pnpm unlink --global
+```
+
+## Build
+
+```bash
+pnpm install
+pnpm run build
+```

package/bin/setup.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+const fs = require("fs");
+const path = require("path");
+
+const sourceDir = path.resolve(__dirname, "..");
+const targetDir = process.cwd();
+
+const filesToCopy = [
+  { src: ".pnpmfile.cjs", required: true },
+  { src: ".pnpm-audit.yaml", required: false },
+];
+
+console.log("Setting up pnpm-audit-hook...\n");
+
+for (const file of filesToCopy) {
+  const srcPath = path.join(sourceDir, file.src);
+  const destPath = path.join(targetDir, file.src);
+
+  if (fs.existsSync(destPath)) {
+    console.log(`  ⏭  ${file.src} already exists, skipping`);
+    continue;
+  }
+
+  if (!fs.existsSync(srcPath)) {
+    if (file.required) {
+      console.error(`  ❌ ${file.src} not found in package!`);
+      process.exit(1);
+    }
+    continue;
+  }
+
+  // Update .pnpmfile.cjs to point to node_modules
+  if (file.src === ".pnpmfile.cjs") {
+    let content = fs.readFileSync(srcPath, "utf-8");
+    content = content.replace(
+      "path.join(__dirname, 'dist', 'index.js')",
+      "path.join(__dirname, 'node_modules', 'pnpm-audit-hook', 'dist', 'index.js')"
+    );
+    fs.writeFileSync(destPath, content);
+    console.log(`  ✅ ${file.src} created`);
+  } else {
+    fs.copyFileSync(srcPath, destPath);
+    console.log(`  ✅ ${file.src} copied`);
+  }
+}
+
+console.log("\n✨ Done! The audit hook will run on every pnpm install.\n");
+console.log("Test it with: pnpm add lodash");

package/dist/audit.d.ts

@@ -0,0 +1,20 @@
+import type { PnpmLockfile, PolicyDecision, RuntimeOptions, SourceStatus, VulnerabilityFinding } from "./types";
+/** Exit codes for audit results */
+export declare const EXIT_CODES: {
+    readonly SUCCESS: 0;
+    readonly BLOCKED: 1;
+    readonly WARNINGS: 2;
+    readonly SOURCE_ERROR: 3;
+};
+export interface AuditResult {
+    blocked: boolean;
+    warnings: boolean;
+    decisions: PolicyDecision[];
+    exitCode: number;
+    findings: VulnerabilityFinding[];
+    sourceStatus: Record<string, SourceStatus>;
+    totalPackages: number;
+    durationMs: number;
+}
+export declare function runAudit(lockfile: PnpmLockfile, runtime: RuntimeOptions): Promise<AuditResult>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAsB,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAWpI,mCAAmC;AACnC,eAAO,MAAM,UAAU;;;;;CAKb,CAAC;AAEX,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CA0FpG"}

package/dist/audit.js

@@ -0,0 +1,105 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXIT_CODES = void 0;
+exports.runAudit = runAudit;
+const node_path_1 = __importDefault(require("node:path"));
+const config_1 = require("./config");
+const logger_1 = require("./utils/logger");
+const file_cache_1 = require("./cache/file-cache");
+const aggregator_1 = require("./databases/aggregator");
+const lockfile_1 = require("./utils/lockfile");
+const policy_engine_1 = require("./policies/policy-engine");
+const output_formatter_1 = require("./utils/output-formatter");
+const CACHE_DIR = ".pnpm-audit-cache";
+/** Exit codes for audit results */
+exports.EXIT_CODES = {
+    SUCCESS: 0,
+    BLOCKED: 1,
+    WARNINGS: 2,
+    SOURCE_ERROR: 3,
+};
+async function runAudit(lockfile, runtime) {
+    const startTime = Date.now();
+    const { cwd, env, registryUrl } = runtime;
+    const cfg = await (0, config_1.loadConfig)({ cwd, env });
+    const cache = new file_cache_1.FileCache({ dir: node_path_1.default.resolve(cwd, CACHE_DIR) });
+    const { packages } = (0, lockfile_1.extractPackagesFromLockfile)(lockfile);
+    if ((0, logger_1.isVerbose)()) {
+        logger_1.logger.verbose(`Starting audit of ${packages.length} packages`);
+    }
+    const agg = await (0, aggregator_1.aggregateVulnerabilities)(packages, { cfg, env, cache, registryUrl });
+    // Group findings by package
+    const findingsByPkg = new Map();
+    for (const finding of agg.findings) {
+        const key = `${finding.packageName}@${finding.packageVersion}`;
+        if (!findingsByPkg.has(key)) {
+            findingsByPkg.set(key, []);
+        }
+        findingsByPkg.get(key).push(finding);
+    }
+    // Build package results and evaluate policies
+    const decisions = [];
+    for (const p of packages) {
+        const pkgResult = {
+            pkg: p,
+            findings: findingsByPkg.get(`${p.name}@${p.version}`) ?? [],
+            decisions: [],
+        };
+        const evaluated = (0, policy_engine_1.evaluatePackagePolicies)(pkgResult, cfg);
+        decisions.push(...evaluated.decisions);
+    }
+    // Block on source failures if configured to fail-closed
+    const failedSources = Object.entries(agg.sources).filter(([, v]) => !v.ok);
+    const hasSourceError = failedSources.length > 0;
+    if (hasSourceError) {
+        const srcList = failedSources.map(([k, v]) => `${k}: ${v.error ?? "unknown"}`).join("; ");
+        const action = cfg.failOnSourceError !== false ? "block" : "warn";
+        decisions.push({
+            action,
+            reason: `Source failure: ${srcList}`,
+            source: "source",
+            at: new Date().toISOString(),
+        });
+    }
+    const blocked = decisions.some((d) => d.action === "block");
+    const warnings = decisions.some((d) => d.action === "warn");
+    const durationMs = Date.now() - startTime;
+    // Determine exit code
+    let exitCode;
+    if (hasSourceError && cfg.failOnSourceError !== false) {
+        exitCode = exports.EXIT_CODES.SOURCE_ERROR;
+    }
+    else if (blocked) {
+        exitCode = exports.EXIT_CODES.BLOCKED;
+    }
+    else if (warnings) {
+        exitCode = exports.EXIT_CODES.WARNINGS;
+    }
+    else {
+        exitCode = exports.EXIT_CODES.SUCCESS;
+    }
+    // Build summary and output results
+    const summary = (0, output_formatter_1.buildSummary)(packages.length, agg.findings, decisions, agg.sources);
+    (0, output_formatter_1.outputResults)({
+        summary,
+        findings: agg.findings,
+        decisions,
+        blocked,
+        warnings,
+        exitCode,
+    }, env);
+    return {
+        blocked,
+        warnings,
+        decisions,
+        exitCode,
+        findings: agg.findings,
+        sourceStatus: agg.sources,
+        totalPackages: packages.length,
+        durationMs,
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":";;;;;;AA+BA,4BA0FC;AAzHD,0DAA6B;AAE7B,qCAAsC;AACtC,2CAAmD;AACnD,mDAA+C;AAC/C,uDAAkE;AAClE,+CAA+D;AAC/D,4DAAmE;AACnE,+DAAuE;AAEvE,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAEtC,mCAAmC;AACtB,QAAA,UAAU,GAAG;IACxB,OAAO,EAAE,CAAC;IACV,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,CAAC;IACX,YAAY,EAAE,CAAC;CACP,CAAC;AAaJ,KAAK,UAAU,QAAQ,CAAC,QAAsB,EAAE,OAAuB;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,IAAA,mBAAU,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,sBAAS,CAAC,EAAE,GAAG,EAAE,mBAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAEnE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAA,sCAA2B,EAAC,QAAQ,CAAC,CAAC;IAE3D,IAAI,IAAA,kBAAS,GAAE,EAAE,CAAC;QAChB,eAAM,CAAC,OAAO,CAAC,qBAAqB,QAAQ,CAAC,MAAM,WAAW,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,IAAA,qCAAwB,EAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAEvF,4BAA4B;IAC5B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkC,CAAC;IAChE,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC/D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,SAAS,GAAuB;YACpC,GAAG,EAAE,CAAC;YACN,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE;YAC3D,SAAS,EAAE,EAAE;SACd,CAAC;QACF,MAAM,SAAS,GAAG,IAAA,uCAAuB,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC1D,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,wDAAwD;IACxD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAChD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAClE,SAAS,CAAC,IAAI,CAAC;YACb,MAAM;YACN,MAAM,EAAE,mBAAmB,OAAO,EAAE;YACpC,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAE1C,sBAAsB;IACtB,IAAI,QAAgB,CAAC;IACrB,IAAI,cAAc,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;QACtD,QAAQ,GAAG,kBAAU,CAAC,YAAY,CAAC;IACrC,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,QAAQ,GAAG,kBAAU,CAAC,OAAO,CAAC;IAChC,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACpB,QAAQ,GAAG,kBAAU,CAAC,QAAQ,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,kBAAU,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,mCAAmC;IACnC,MAAM,OAAO,GAAG,IAAA,+BAAY,EAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACpF,IAAA,gCAAa,EACX;QACE,OAAO;QACP,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS;QACT,OAAO;QACP,QAAQ;QACR,QAAQ;KACT,EACD,GAAG,CACJ,CAAC;IAEF,OAAO;QACL,OAAO;QACP,QAAQ;QACR,SAAS;QACT,QAAQ;QACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,GAAG,CAAC,OAAO;QACzB,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/cache/file-cache.d.ts

@@ -0,0 +1,22 @@
+import type { Cache, CacheEntry } from "./types";
+export interface FileCacheOptions {
+    dir: string;
+    /** Max entries to keep in the in-memory path cache (0 disables caching). */
+    maxPathCacheEntries?: number;
+}
+export declare class FileCache<T = unknown> implements Cache<T> {
+    private readonly dir;
+    private readonly pathCache;
+    private readonly maxPathCacheEntries;
+    constructor(opts: FileCacheOptions);
+    private filePathForKey;
+    private isSymlink;
+    get(key: string): Promise<CacheEntry<T> | null>;
+    private deleteCorruptedFile;
+    set(key: string, value: T, ttlSeconds: number): Promise<void>;
+    prune(): Promise<{
+        pruned: number;
+        failed: number;
+    }>;
+}
+//# sourceMappingURL=file-cache.d.ts.map

package/dist/cache/file-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-cache.d.ts","sourceRoot":"","sources":["../../src/cache/file-cache.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAqBD,qBAAa,SAAS,CAAC,CAAC,GAAG,OAAO,CAAE,YAAW,KAAK,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAEjC,IAAI,EAAE,gBAAgB;IAKlC,OAAO,CAAC,cAAc;YA0BR,SAAS;IASjB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YA4BvC,mBAAmB;IAW3B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuC7D,KAAK,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CA6C3D"}