@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/scripts/check-vendor-currency.js

@@ -0,0 +1,349 @@
+"use strict";
+/**
+ * Vendor-currency gate.
+ *
+ * Reads lib/vendor/MANIFEST.json and asserts that every npm-mapped
+ * vendored package matches the latest release on the public npm
+ * registry. Intended to fire as a CI gate so a stale vendored bundle
+ * (a security-relevant transitive bumped its version while we sat
+ * pinned) becomes a release blocker, not a quietly-aging tarball.
+ *
+ * Run locally:
+ *   node scripts/check-vendor-currency.js
+ *   node scripts/check-vendor-currency.js --json     // structured output
+ *   node scripts/check-vendor-currency.js --warn     // exit 0, print only
+ *
+ * Run in CI:
+ *   set BLAMEJS_VENDOR_CURRENCY_REQUIRED=1 in the workflow env to
+ *   convert "stale" findings into a non-zero exit. Default behaviour
+ *   is fail-on-stale; the env var is for operators who want to gate
+ *   on a transient-network registry response (CI sometimes hangs on
+ *   registry mirrors) without losing the signal — pair with --warn
+ *   for advisory-only mode.
+ *
+ * Out-of-band packages (SecLists corpus is a GitHub raw download,
+ * peculiar-pki is a meta-bundle composed of multiple npm packages)
+ * are checked against their declared upstream sources where
+ * possible, otherwise reported as "skipped" with a reason. Skipped
+ * packages do NOT trip the gate by design — the gate is for
+ * version drift on packages we COULD have shipped fresh.
+ */
+
+var fs   = require("fs");
+var path = require("path");
+var https = require("https");
+
+var MANIFEST_PATH = path.join(__dirname, "..", "lib", "vendor", "MANIFEST.json");
+var REGISTRY_BASE = "https://registry.npmjs.org/";
+
+// Operator overrides via env. Both default off.
+var WARN_ONLY      = process.argv.indexOf("--warn") !== -1;
+var JSON_OUT       = process.argv.indexOf("--json") !== -1;
+var TIMEOUT_MS     = 10000;
+
+// Per-package mapping table. Keys are MANIFEST.json keys; values
+// describe how to currency-check the entry. Missing entries are
+// treated as "the manifest key is the npm name verbatim" — the
+// common case for scoped packages like @noble/ciphers.
+//
+// shape:
+//   { type: "npm", name: "<npm-package>" }     — query registry, compare version
+//   { type: "npm-meta", components: [...] }    — meta-bundle: each component must be current
+//   { type: "github-raw", note: "..." }        — GitHub raw download (no version semantics)
+//   { type: "skip", reason: "..." }            — skip with documented reason
+var SPECIAL_MAP = {
+  "SecLists-common-passwords-top-10000": {
+    type: "github-master",
+    owner: "danielmiessler",
+    repo:  "SecLists",
+    branch: "master",
+    path:  "Passwords/Common-Credentials/10k-most-common.txt"
+  },
+  "peculiar-pki": {
+    type: "npm-meta",
+    components: [
+      { manifestField: "components.@peculiar/x509", npm: "@peculiar/x509", versionRe: /(\d+\.\d+\.\d+)/ },
+      { manifestField: "components.pkijs",           npm: "pkijs",           versionRe: /pkijs-(\d+\.\d+\.\d+)/ }
+    ]
+  }
+};
+
+function _githubLatestCommit(owner, repo, branch, filePath) {
+  // GitHub Commits API: most recent commit touching <filePath> on
+  // <branch>. Returns ISO8601 commit date string. Unauthenticated
+  // requests are limited to 60/hour per IP — fine for the framework's
+  // single-digit vendored entry count, even on a busy CI runner.
+  return new Promise(function (resolve, reject) {
+    var qp = "?path=" + encodeURIComponent(filePath) + "&sha=" + encodeURIComponent(branch) + "&per_page=1";
+    var url = "https://api.github.com/repos/" + owner + "/" + repo + "/commits" + qp;
+    var req = https.get(url, { timeout: TIMEOUT_MS,
+      headers: {
+        "User-Agent": "blamejs-vendor-currency/1",
+        "Accept":     "application/vnd.github+json"
+      }
+    }, function (res) {
+      if (res.statusCode !== 200) {
+        res.resume();
+        return reject(new Error("github " + owner + "/" + repo + " status " + res.statusCode));
+      }
+      var chunks = [];
+      res.on("data", function (c) { chunks.push(c); });
+      res.on("end", function () {
+        try {
+          var doc = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+          if (!Array.isArray(doc) || doc.length === 0 || !doc[0].commit) {
+            return reject(new Error("github " + owner + "/" + repo + " no commits on " + branch + " touching " + filePath));
+          }
+          resolve({
+            sha:  doc[0].sha,
+            date: doc[0].commit.author && doc[0].commit.author.date,
+          });
+        } catch (e) { reject(e); }
+      });
+    });
+    req.on("timeout", function () { req.destroy(new Error("github " + owner + "/" + repo + " timed out")); });
+    req.on("error", reject);
+  });
+}
+
+function _registryFetch(name) {
+  // Direct node:https for portability — does NOT route through
+  // b.httpClient because the gate runs from scripts/ before any
+  // framework state exists. node:https with TLS 1.3 is sufficient
+  // for a public-registry GET — no SSRF / cert-pin posture needed
+  // to talk to registry.npmjs.org over public DNS.
+  return new Promise(function (resolve, reject) {
+    var url = REGISTRY_BASE + encodeURIComponent(name).replace("%40", "@") + "/latest";
+    var req = https.get(url, { timeout: TIMEOUT_MS,
+      headers: { "User-Agent": "blamejs-vendor-currency/1", "Accept": "application/json" }
+    }, function (res) {
+      if (res.statusCode !== 200) {
+        res.resume();
+        return reject(new Error("registry " + name + " status " + res.statusCode));
+      }
+      var chunks = [];
+      res.on("data", function (c) { chunks.push(c); });
+      res.on("end", function () {
+        try {
+          var doc = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+          if (!doc || typeof doc.version !== "string") {
+            return reject(new Error("registry " + name + " returned no .version"));
+          }
+          resolve(doc.version);
+        } catch (e) { reject(e); }
+      });
+    });
+    req.on("timeout", function () { req.destroy(new Error("registry " + name + " timed out after " + TIMEOUT_MS + "ms")); });
+    req.on("error", reject);
+  });
+}
+
+function _semverParse(v) {
+  // Strip leading "v" + any pre-release tail. Returns [maj, min, pat]
+  // as numbers, or null if not parseable.
+  var m = String(v).match(/^v?(\d+)\.(\d+)\.(\d+)/);
+  if (!m) return null;
+  return [parseInt(m[1], 10), parseInt(m[2], 10), parseInt(m[3], 10)];
+}
+
+function _semverCompare(a, b) {
+  if (!a || !b) return 0;
+  for (var i = 0; i < 3; i++) {
+    if (a[i] > b[i]) return  1;
+    if (a[i] < b[i]) return -1;
+  }
+  return 0;
+}
+
+function _walkDots(obj, dotPath) {
+  var parts = dotPath.split(".");
+  var node = obj;
+  for (var i = 0; i < parts.length; i++) {
+    if (node == null || typeof node !== "object") return undefined;
+    node = node[parts[i]];
+  }
+  return node;
+}
+
+async function _checkOne(key, manifestEntry) {
+  var special = SPECIAL_MAP[key];
+  if (special && special.type === "skip") {
+    return { key: key, status: "skipped", reason: special.reason };
+  }
+  if (special && special.type === "github-master") {
+    // Compare upstream master/main commit date against the manifest's
+    // bundledAt date. If upstream has commits newer than bundledAt,
+    // the vendored copy is stale even though no semver bumped.
+    try {
+      var commit = await _githubLatestCommit(special.owner, special.repo, special.branch, special.path);
+      var bundledAt = manifestEntry.bundledAt;
+      // Both are ISO date strings — Date.parse for comparison.
+      var upstreamMs = Date.parse(commit.date);
+      var bundledMs  = Date.parse(bundledAt);
+      var stale = isFinite(upstreamMs) && isFinite(bundledMs) && upstreamMs > bundledMs;
+      return {
+        key:        key,
+        upstream:   special.owner + "/" + special.repo + "@" + special.branch + ":" + special.path,
+        bundledAt:  bundledAt,
+        upstreamAt: commit.date,
+        upstreamSha: commit.sha,
+        status:     stale ? "stale" : "current",
+      };
+    } catch (e) {
+      return {
+        key:    key,
+        status: "registry-error",
+        error:  (e && e.message) || String(e),
+      };
+    }
+  }
+  if (special && special.type === "npm-meta") {
+    // Check each component independently. Aggregate results.
+    var componentResults = [];
+    for (var i = 0; i < special.components.length; i++) {
+      var comp = special.components[i];
+      var raw = _walkDots(manifestEntry, comp.manifestField);
+      // The component field value may be a URL (current shape) or a
+      // version string (operator-promoted shape). Either way we try to
+      // pull a x.y.z out of it.
+      var current = null;
+      if (typeof raw === "string") {
+        var m = raw.match(comp.versionRe || /(\d+\.\d+\.\d+)/);
+        if (m) current = m[1];
+      }
+      // Also try the manifest's top-level "version" string for the
+      // composite — peculiar-pki ships "2.0.0+pkijs-3.4.0".
+      if (!current && typeof manifestEntry.version === "string") {
+        var m2 = manifestEntry.version.match(comp.versionRe || /(\d+\.\d+\.\d+)/);
+        if (m2) current = m2[1];
+      }
+      try {
+        var latest = await _registryFetch(comp.npm);
+        var cmp = _semverCompare(_semverParse(current), _semverParse(latest));
+        componentResults.push({
+          component: comp.npm,
+          current:   current || "(unparseable)",
+          latest:    latest,
+          status:    cmp === 0 ? "current" : (cmp < 0 ? "stale" : "ahead"),
+        });
+      } catch (e) {
+        componentResults.push({
+          component: comp.npm,
+          current:   current || "(unparseable)",
+          status:    "registry-error",
+          error:     (e && e.message) || String(e),
+        });
+      }
+    }
+    var anyStale = componentResults.some(function (r) { return r.status === "stale"; });
+    var anyError = componentResults.some(function (r) { return r.status === "registry-error"; });
+    return {
+      key:      key,
+      status:   anyStale ? "stale" : (anyError ? "registry-error" : "current"),
+      components: componentResults,
+    };
+  }
+  // Default: manifest key IS the npm package name.
+  var npmName = (special && special.type === "npm" && special.name) || key;
+  var npmCurrent = manifestEntry.version;
+  try {
+    var npmLatest = await _registryFetch(npmName);
+    var npmCmp = _semverCompare(_semverParse(npmCurrent), _semverParse(npmLatest));
+    return {
+      key:     key,
+      npm:     npmName,
+      current: npmCurrent,
+      latest:  npmLatest,
+      status:  npmCmp === 0 ? "current" : (npmCmp < 0 ? "stale" : "ahead"),
+    };
+  } catch (e) {
+    return {
+      key:     key,
+      npm:     npmName,
+      current: npmCurrent,
+      status:  "registry-error",
+      error:   (e && e.message) || String(e),
+    };
+  }
+}
+
+async function main() {
+  var raw = fs.readFileSync(MANIFEST_PATH, "utf8");
+  var manifest = JSON.parse(raw);
+  var pkgs = manifest.packages || {};
+  var keys = Object.keys(pkgs);
+  var results = [];
+  // Sequential — npm registry is fine with serial polite traffic, and
+  // the total package count is small (single digits). Parallel would
+  // burn open sockets for no measurable gain.
+  for (var i = 0; i < keys.length; i++) {
+    results.push(await _checkOne(keys[i], pkgs[keys[i]]));
+  }
+
+  if (JSON_OUT) {
+    process.stdout.write(JSON.stringify({ results: results }, null, 2) + "\n");
+  } else {
+    process.stdout.write("[vendor-currency] " + keys.length + " vendored package(s) inspected:\n");
+    for (var j = 0; j < results.length; j++) {
+      var r = results[j];
+      var label = r.status === "current"      ? "OK"
+                : r.status === "stale"        ? "STALE"
+                : r.status === "ahead"        ? "AHEAD"
+                : r.status === "registry-error" ? "ERR"
+                : r.status === "skipped"      ? "skip"
+                :                                r.status;
+      var line = "  [" + label + "] " + r.key;
+      if (r.current && r.latest) line += "  " + r.current + " -> " + r.latest;
+      else if (r.current)        line += "  " + r.current;
+      else if (r.bundledAt && r.upstreamAt) line += "  bundled " + r.bundledAt + " -> upstream " + r.upstreamAt;
+      if (r.reason) line += "  (" + r.reason + ")";
+      if (r.error)  line += "  (registry: " + r.error + ")";
+      process.stdout.write(line + "\n");
+      if (Array.isArray(r.components)) {
+        for (var k = 0; k < r.components.length; k++) {
+          var c = r.components[k];
+          var clabel = c.status === "current" ? "OK"
+                     : c.status === "stale"   ? "STALE"
+                     : c.status === "ahead"   ? "AHEAD"
+                     : c.status === "registry-error" ? "ERR"
+                     :                          c.status;
+          var cline = "    [" + clabel + "] " + c.component + "  " + (c.current || "?") + " -> " + (c.latest || "?");
+          if (c.error) cline += "  (" + c.error + ")";
+          process.stdout.write(cline + "\n");
+        }
+      }
+    }
+  }
+
+  // Failure policy: any "stale" result fails the gate. registry-error
+  // results are advisory unless BLAMEJS_VENDOR_CURRENCY_STRICT=1 is
+  // set (which converts them into hard fails too). --warn flips the
+  // whole exit policy to "always 0" — useful for opt-in advisory
+  // runs locally.
+  var stale = results.filter(function (r) {
+    if (r.status === "stale") return true;
+    if (Array.isArray(r.components)) {
+      return r.components.some(function (c) { return c.status === "stale"; });
+    }
+    return false;
+  });
+  var errored = results.filter(function (r) { return r.status === "registry-error"; });
+
+  if (WARN_ONLY) {
+    if (stale.length || errored.length) process.stdout.write("[vendor-currency] --warn: " + stale.length + " stale, " + errored.length + " errored — exit 0 anyway\n");
+    process.exit(0);
+  }
+
+  var strictErrors = process.env.BLAMEJS_VENDOR_CURRENCY_STRICT === "1";
+  if (stale.length > 0 || (strictErrors && errored.length > 0)) {
+    process.stdout.write("[vendor-currency] FAIL — " + stale.length + " stale, " + errored.length + " registry-error(s)\n");
+    process.exit(1);
+  }
+  process.stdout.write("[vendor-currency] OK — every checked package matches the latest registry version\n");
+  process.exit(0);
+}
+
+main().catch(function (e) {
+  process.stderr.write("[vendor-currency] script crashed: " + (e && e.stack || e) + "\n");
+  process.exit(2);
+});

package/lib/vendor/blamejs/scripts/consolidate-release-notes.js

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Roll up per-patch `release-notes/v<X>.<Y>.<Z>.json` files for any
+ * MINOR line OTHER than the current one into a single consolidated
+ * `release-notes/v<X>.<Y>.x.json` file. The current minor (derived
+ * from `package.json#version`) stays as per-patch files so the
+ * release-flow generator can edit a single small JSON for the live
+ * line.
+ *
+ * Operate it as a MAINTAINER-SIDE step, NOT inside the release flow.
+ * Reorganising release-notes/ mid-release would shift the tarball's
+ * file set after the SHA-256 / SHA3-512 / ML-DSA digests were
+ * computed. Run consolidation only between releases.
+ *
+ * Consolidated file shape:
+ *   {
+ *     "$schema": "../scripts/release-notes-consolidated-schema.json",
+ *     "minor":   "0.10",
+ *     "releases": [
+ *       { ...same shape as a single v<V>.json... },
+ *       ...                    // newest first
+ *     ]
+ *   }
+ *
+ * The `generate-changelog-entry.js` lookup falls back to the
+ * consolidated file when the per-patch file is absent, so deleting
+ * per-patch files after rollup (via `--prune`) keeps the generator
+ * working for the historical line.
+ *
+ * Usage:
+ *   node scripts/consolidate-release-notes.js              # preview — writes consolidated files but keeps per-patch
+ *   node scripts/consolidate-release-notes.js --prune      # also delete per-patch files after writing consolidated
+ *   node scripts/consolidate-release-notes.js --check      # exit non-zero if any rollup is needed (CI use)
+ *
+ * Idempotent: re-running is safe. If a previous run consolidated
+ * with `--prune`, the next run sees the consolidated file in place
+ * and the per-patch files absent, and reports "already consolidated".
+ */
+
+var fs   = require("node:fs");
+var path = require("node:path");
+
+var ROOT         = path.resolve(__dirname, "..");
+var NOTES_DIR    = path.join(ROOT, "release-notes");
+var PACKAGE_JSON = path.join(ROOT, "package.json");
+
+function _exit(msg) {
+  process.stderr.write("[consolidate-release-notes] " + msg + "\n");
+  process.exit(1);
+}
+
+function _readJson(filePath, label) {
+  var raw;
+  try { raw = fs.readFileSync(filePath, "utf8"); }
+  catch (e) { _exit("cannot read " + label + " (" + filePath + "): " + (e && e.message || e)); }
+  try { return JSON.parse(raw); }
+  catch (e) { _exit("malformed JSON in " + label + " (" + filePath + "): " + (e && e.message || e)); }
+}
+
+function _currentMinor() {
+  var pkg = _readJson(PACKAGE_JSON, "package.json");
+  var m = String(pkg.version || "").match(/^(\d+\.\d+)\.\d+$/);
+  if (!m) _exit("could not parse minor line from package.json#version: " + JSON.stringify(pkg.version));
+  return m[1];
+}
+
+function _compareVersionsDesc(a, b) {
+  var ap = a.split(".").map(Number);
+  var bp = b.split(".").map(Number);
+  for (var i = 0; i < 3; i += 1) {
+    if (ap[i] !== bp[i]) return bp[i] - ap[i];
+  }
+  return 0;
+}
+
+function _scan() {
+  // Returns {
+  //   perPatchByMinor: { "0.10": [ { version, file, payload }, ... ], ... },
+  //   consolidatedByMinor: { "0.10": file, ... },
+  // }
+  var perPatchByMinor    = {};
+  var consolidatedByMinor = {};
+  var entries = fs.readdirSync(NOTES_DIR);
+  for (var i = 0; i < entries.length; i += 1) {
+    var name = entries[i];
+    if (!/\.json$/.test(name)) continue;
+    var conMatch = name.match(/^v(\d+\.\d+)\.x\.json$/);
+    if (conMatch) {
+      consolidatedByMinor[conMatch[1]] = name;
+      continue;
+    }
+    var verMatch = name.match(/^v(\d+)\.(\d+)\.(\d+)\.json$/);
+    if (!verMatch) continue;
+    var minor   = verMatch[1] + "." + verMatch[2];
+    var version = verMatch[1] + "." + verMatch[2] + "." + verMatch[3];
+    var payload = _readJson(path.join(NOTES_DIR, name),
+      "release-notes/" + name);
+    if (!perPatchByMinor[minor]) perPatchByMinor[minor] = [];
+    perPatchByMinor[minor].push({ version: version, file: name, payload: payload });
+  }
+  Object.keys(perPatchByMinor).forEach(function (minor) {
+    perPatchByMinor[minor].sort(function (a, b) {
+      return _compareVersionsDesc(a.version, b.version);
+    });
+  });
+  return { perPatchByMinor: perPatchByMinor, consolidatedByMinor: consolidatedByMinor };
+}
+
+function _stripTopSchema(obj) {
+  // The inner release objects don't carry their own $schema —
+  // the wrapper carries it for the consolidated file.
+  if (obj && typeof obj === "object" && !Array.isArray(obj)) {
+    var keys = Object.keys(obj);
+    var out  = {};
+    for (var i = 0; i < keys.length; i += 1) {
+      if (keys[i] === "$schema") continue;
+      out[keys[i]] = obj[keys[i]];
+    }
+    return out;
+  }
+  return obj;
+}
+
+function main() {
+  var prune    = process.argv.indexOf("--prune") !== -1;
+  var checkOnly = process.argv.indexOf("--check") !== -1;
+  if (prune && checkOnly) _exit("--prune and --check are mutually exclusive");
+
+  // Probe NOTES_DIR via readdirSync directly — no existsSync race.
+  try { fs.readdirSync(NOTES_DIR); }
+  catch (e) {
+    if (e && e.code === "ENOENT") _exit("release-notes/ does not exist");
+    _exit("cannot read release-notes/: " + (e && e.message || e));
+  }
+
+  var current = _currentMinor();
+  var scan    = _scan();
+  var minors  = Object.keys(scan.perPatchByMinor).sort();
+
+  if (minors.length === 0 &&
+      Object.keys(scan.consolidatedByMinor).length === 0) {
+    _exit("no per-version OR consolidated release notes found in " +
+      path.relative(ROOT, NOTES_DIR));
+  }
+
+  var wouldRollup = [];
+  var rolledUp   = [];
+  var pruned     = 0;
+  var skipped    = [];
+
+  for (var i = 0; i < minors.length; i += 1) {
+    var minor    = minors[i];
+    var releases = scan.perPatchByMinor[minor];
+    if (minor === current) {
+      skipped.push(minor + ".x (current minor — " + releases.length + " per-patch files preserved)");
+      continue;
+    }
+    wouldRollup.push({ minor: minor, count: releases.length });
+    if (checkOnly) continue;
+
+    var consolidated = {
+      "$schema":  "../scripts/release-notes-consolidated-schema.json",
+      "minor":    minor,
+      "releases": releases.map(function (e) { return _stripTopSchema(e.payload); }),
+    };
+    var outPath = path.join(NOTES_DIR, "v" + minor + ".x.json");
+    fs.writeFileSync(outPath, JSON.stringify(consolidated, null, 2) + "\n");
+    rolledUp.push(minor + ".x (" + releases.length + " releases → v" + minor + ".x.json)");
+
+    if (prune) {
+      for (var j = 0; j < releases.length; j += 1) {
+        fs.unlinkSync(path.join(NOTES_DIR, releases[j].file));
+        pruned += 1;
+      }
+    }
+  }
+
+  // Sanity-check existing consolidated files for the current minor —
+  // if the current minor accidentally has a v<minor>.x.json, that's a
+  // mistake (consolidation should NEVER apply to the active line),
+  // and the operator should hand-fix.
+  if (scan.consolidatedByMinor[current]) {
+    process.stderr.write("[consolidate-release-notes] WARN — release-notes/" +
+      scan.consolidatedByMinor[current] + " exists for the CURRENT minor (" +
+      current + "). The current minor is supposed to stay per-patch. " +
+      "Hand-merge any unique releases back into per-patch files, then delete the consolidated file.\n");
+  }
+
+  if (checkOnly) {
+    if (wouldRollup.length > 0) {
+      process.stderr.write("[consolidate-release-notes] CHECK FAIL — " +
+        wouldRollup.length + " non-current minor line(s) still in per-patch shape:\n");
+      for (var c = 0; c < wouldRollup.length; c += 1) {
+        process.stderr.write("  " + wouldRollup[c].minor + ".x (" + wouldRollup[c].count + " per-patch files)\n");
+      }
+      process.stderr.write("[consolidate-release-notes] Run `node scripts/consolidate-release-notes.js --prune` to roll them up.\n");
+      process.exit(1);
+    }
+    process.stderr.write("[consolidate-release-notes] OK — every non-current minor is already consolidated.\n");
+    return;
+  }
+
+  for (var s = 0; s < skipped.length; s += 1) {
+    process.stderr.write("[consolidate-release-notes] SKIP   " + skipped[s] + "\n");
+  }
+  for (var r = 0; r < rolledUp.length; r += 1) {
+    process.stderr.write("[consolidate-release-notes] WROTE  " + rolledUp[r] + "\n");
+  }
+  process.stderr.write("[consolidate-release-notes] DONE — wrote " + rolledUp.length +
+    " consolidated file(s), skipped " + skipped.length +
+    " (current minor), pruned " + pruned + " per-patch file(s)" +
+    (prune ? "" : " — pass `--prune` to delete per-patch files after consolidation") + "\n");
+}
+
+main();