internal/

Package audit writes and reads the append-only JSONL log of every install check installwall has run.

Package checker runs the detection rules against one package name and produces a verdict: allow it, warn and allow it, or block it.

Package cli implements the installwall command line: install/uninstall the shims, check a single package, run a shimmed tool, and read the audit log.

Package registry adapts the four package registries installwall watches (npm, PyPI, RubyGems, crates.io) to one interface: does this package exist, and when was it first published.

Package shim generates the PATH-shadowing wrapper scripts for npm, pip, gem and cargo, and extracts the package names an install-like command line would actually install.