[ARI-2162] CLI → Ship a bundled TypeScript build under MIT

[revett]

Resolves ARI-2162

Problem

• npm lists the package licence as "none"
• The package ships its raw src folder rather than a build, and nothing checks what gets published
• The CLI is JavaScript while team-plain/sdk is TypeScript

Changes

• Add the MIT licence, matching team-plain/sdk
• Rewrite the CLI and its tests in TypeScript, with a typecheck step in CI
• Bundle with tsdown into a single ESM file with no sourcemaps, and publish only dist
• Check the bundle in CI the way the sdk does: a size limit, publint --strict, and installing the packed CLI on Node.js 22.12.0, 22 and 24
• Run the tests against the built CLI rather than the source, so they cover what ships
• Hold @types/node at the major that matches engines.node

Why

• With trusted publishing the build is signed, so the published output should be a deliberate, checked artefact
• No change to commands, flags or output, so this releases as a patch

---

Note

Low Risk
Packaging and toolchain changes only; commands and API usage are unchanged, with CI validating the published bundle on multiple Node versions.

Overview
The CLI is now TypeScript and publishes a single bundled ESM artefact (dist/index.mjs) via tsdown, instead of shipping raw src. The package adds an MIT licence, points bin and files at dist, and release/test scripts build before pack or publish.

CI gains typecheck, build, size-limit (5 kB on the bundle), and publint --strict. Tests run TypeScript with node --experimental-strip-types, exercise the built CLI (including global install of the packed tarball on Node 22.12, 22, and 24). Dependabot ignores semver-major @types/node updates so types stay aligned with engines.node.

Runtime behaviour for index-url / index-sitemap is unchanged aside from stricter typing and safer unknown-error handling in createKnowledgeSource.

^{Reviewed by Cursor Bugbot for commit eeac3cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​size-limit/​file@​14.1.0
	@​types/​node@​22.20.4
	publint@​0.3.24
	size-limit@​14.1.0
	tsdown@​0.23.0
	typescript@​7.0.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm typescript under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package.json → npm/typescript@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-aix-ppc64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-aix-ppc64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-aix-ppc64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-darwin-arm64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-darwin-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-darwin-x64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-darwin-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-freebsd-arm64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-freebsd-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-freebsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-freebsd-x64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-freebsd-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-freebsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-arm under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-arm@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-arm@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-arm64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-loong64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-loong64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-loong64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-mips64el under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-mips64el@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-mips64el@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-ppc64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-ppc64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-ppc64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-riscv64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-riscv64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-riscv64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-s390x under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-s390x@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-s390x@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-linux-x64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-linux-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-netbsd-arm64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-netbsd-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-netbsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-netbsd-x64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-netbsd-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-netbsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-openbsd-arm64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-openbsd-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-openbsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-openbsd-x64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-openbsd-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-openbsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-sunos-x64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-sunos-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-sunos-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-win32-arm64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-win32-arm64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-win32-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm @typescript/typescript-win32-x64 under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pnpm-lock.yaml → npm/typescript@7.0.2 → npm/@typescript/typescript-win32-x64@7.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-win32-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds build tooling and changes the published package format.

The PR appears safe to merge; no blocking failure was found.

What we checked:

• Publishing without a build: The release script runs pnpm build before publishing. CI also builds before packing.

_{Reviews (1) · Last reviewed commit: "Implement" · Reviewed by Greptile}