Jorge Morais — Senior Full-Stack Developer at the intersection of AI and Industrial IoT · Remote, EU

// Pre-install guardian: the core of depguard's prevention layer
async function guard(packageName: string, options: GuardOptions): Promise<GuardResult> {
  const reasons: string[] = []
  let decision: 'allow' | 'warn' | 'block' = 'allow'

  // Step 1: Does this package even exist? (AI hallucination guard)
  const verifyResult = await verify(packageName)
  if (!verifyResult.exists) {
    return { decision: 'block', reasons: ['Package does not exist on npm'] }
  }

  // Step 2: Is it a typosquat? (Levenshtein against 100+ popular packages)
  if (verifyResult.possibleTyposquat) {
    reasons.push('Possible typosquat of: ' + verifyResult.similarTo.join(', '))
    decision = 'warn'
  }

  // Step 3: Quick audit + score
  const [auditReport, scoreReport] = await Promise.all([
    audit(packageName, targetLicense, fetcher),
    score(packageName, { targetLicense, fetcher }),
  ])

  // Critical vulns = automatic block. No exceptions.
  if (auditReport.vulnerabilities.critical > 0) {
    decision = 'block'
  }

  // Score below threshold = warn or block
  if (scoreReport.total < threshold - 20) decision = 'block'
  else if (scoreReport.total < threshold) decision = 'warn'

  return { decision, score: scoreReport.total, reasons, auditSummary }
}