@farthershore/cli 0.3.10 → 0.3.12

package/node_modules/@pinojs/redact/test/prototype-pollution.test.js

@@ -1,223 +0,0 @@
-const { test } = require('node:test')
-const { strict: assert } = require('node:assert')
-const slowRedact = require('../index.js')
-
-/* eslint-disable no-proto */
-
-test('prototype pollution: __proto__ path should not pollute Object prototype', () => {
-  const obj = {
-    user: { name: 'john' },
-    __proto__: { isAdmin: true }
-  }
-
-  const redact = slowRedact({
-    paths: ['__proto__.isAdmin'],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Should not pollute Object.prototype
-  assert.strictEqual(Object.prototype.isAdmin, undefined)
-  assert.strictEqual({}.isAdmin, undefined)
-
-  // Should redact the __proto__ property if it exists as a regular property
-  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
-})
-
-test('prototype pollution: constructor.prototype path should not pollute', () => {
-  const obj = {
-    user: { name: 'john' },
-    constructor: {
-      prototype: { isAdmin: true }
-    }
-  }
-
-  const redact = slowRedact({
-    paths: ['constructor.prototype.isAdmin'],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Should not pollute Object.prototype
-  assert.strictEqual(Object.prototype.isAdmin, undefined)
-  assert.strictEqual({}.isAdmin, undefined)
-
-  // Should redact the constructor.prototype property if it exists as a regular property
-  assert.strictEqual(result.constructor.prototype.isAdmin, '[REDACTED]')
-})
-
-test('prototype pollution: nested __proto__ should not pollute', () => {
-  const obj = {
-    user: {
-      settings: {
-        __proto__: { isAdmin: true }
-      }
-    }
-  }
-
-  const redact = slowRedact({
-    paths: ['user.settings.__proto__.isAdmin'],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Should not pollute Object.prototype
-  assert.strictEqual(Object.prototype.isAdmin, undefined)
-  assert.strictEqual({}.isAdmin, undefined)
-
-  // Should redact the nested __proto__ property
-  assert.strictEqual(result.user.settings.__proto__.isAdmin, '[REDACTED]')
-})
-
-test('prototype pollution: bracket notation __proto__ should not pollute', () => {
-  const obj = {
-    user: { name: 'john' },
-    __proto__: { isAdmin: true }
-  }
-
-  const redact = slowRedact({
-    paths: ['["__proto__"]["isAdmin"]'],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Should not pollute Object.prototype
-  assert.strictEqual(Object.prototype.isAdmin, undefined)
-  assert.strictEqual({}.isAdmin, undefined)
-
-  // Should redact the __proto__ property when accessed via bracket notation
-  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
-})
-
-test('prototype pollution: wildcard with __proto__ should not pollute', () => {
-  const obj = {
-    users: {
-      __proto__: { isAdmin: true },
-      user1: { name: 'john' },
-      user2: { name: 'jane' }
-    }
-  }
-
-  const redact = slowRedact({
-    paths: ['users.*'],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Should not pollute Object.prototype
-  assert.strictEqual(Object.prototype.isAdmin, undefined)
-  assert.strictEqual({}.isAdmin, undefined)
-
-  // Should redact only own properties
-  assert.strictEqual(result.users.user1, '[REDACTED]')
-  assert.strictEqual(result.users.user2, '[REDACTED]')
-
-  // __proto__ should only be redacted if it's an own property, not inherited
-  if (Object.prototype.hasOwnProperty.call(obj.users, '__proto__')) {
-    assert.strictEqual(result.users.__proto__, '[REDACTED]')
-  }
-})
-
-test('prototype pollution: malicious JSON payload should not pollute', () => {
-  // Simulate a malicious payload that might come from JSON.parse
-  const maliciousObj = JSON.parse('{"user": {"name": "john"}, "__proto__": {"isAdmin": true}}')
-
-  const redact = slowRedact({
-    paths: ['__proto__.isAdmin'],
-    serialize: false
-  })
-
-  const result = redact(maliciousObj)
-
-  // Should not pollute Object.prototype
-  assert.strictEqual(Object.prototype.isAdmin, undefined)
-  assert.strictEqual({}.isAdmin, undefined)
-
-  // The malicious payload should have been redacted
-  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
-})
-
-test('prototype pollution: verify prototype chain is preserved', () => {
-  function CustomClass () {
-    this.data = 'test'
-  }
-  CustomClass.prototype.method = function () { return 'original' }
-
-  const obj = new CustomClass()
-
-  const redact = slowRedact({
-    paths: ['data'],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Should redact the data property
-  assert.strictEqual(result.data, '[REDACTED]')
-
-  // Should preserve the original prototype chain
-  assert.strictEqual(result.method(), 'original')
-  assert.strictEqual(Object.getPrototypeOf(result), CustomClass.prototype)
-})
-
-test('prototype pollution: setValue should not create prototype pollution', () => {
-  const obj = { user: { name: 'john' } }
-
-  // Try to pollute via non-existent path that could create __proto__
-  const redact = slowRedact({
-    paths: ['__proto__.isAdmin'],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Should not pollute Object.prototype
-  assert.strictEqual(Object.prototype.isAdmin, undefined)
-  assert.strictEqual({}.isAdmin, undefined)
-
-  // Should not create the path if it doesn't exist
-  // The __proto__ property may exist due to Object.create, but should not contain our redacted value
-  if (result.__proto__) {
-    assert.strictEqual(result.__proto__.isAdmin, undefined)
-  }
-})
-
-test('prototype pollution: deep nested prototype properties should not pollute', () => {
-  const obj = {
-    level1: {
-      level2: {
-        level3: {
-          __proto__: { isAdmin: true },
-          constructor: {
-            prototype: { isEvil: true }
-          }
-        }
-      }
-    }
-  }
-
-  const redact = slowRedact({
-    paths: [
-      'level1.level2.level3.__proto__.isAdmin',
-      'level1.level2.level3.constructor.prototype.isEvil'
-    ],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Should not pollute Object.prototype
-  assert.strictEqual(Object.prototype.isAdmin, undefined)
-  assert.strictEqual(Object.prototype.isEvil, undefined)
-  assert.strictEqual({}.isAdmin, undefined)
-  assert.strictEqual({}.isEvil, undefined)
-
-  // Should redact the deep nested properties
-  assert.strictEqual(result.level1.level2.level3.__proto__.isAdmin, '[REDACTED]')
-  assert.strictEqual(result.level1.level2.level3.constructor.prototype.isEvil, '[REDACTED]')
-})

package/node_modules/@pinojs/redact/test/selective-clone.test.js

@@ -1,115 +0,0 @@
-const { test } = require('node:test')
-const { strict: assert } = require('node:assert')
-const slowRedact = require('../index.js')
-
-test('selective cloning shares references for non-redacted paths', () => {
-  const sharedObject = { unchanged: 'data' }
-  const obj = {
-    toRedact: 'secret',
-    shared: sharedObject,
-    nested: {
-      toRedact: 'secret2',
-      shared: sharedObject
-    }
-  }
-
-  const redact = slowRedact({
-    paths: ['toRedact', 'nested.toRedact'],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Redacted values should be different
-  assert.strictEqual(result.toRedact, '[REDACTED]')
-  assert.strictEqual(result.nested.toRedact, '[REDACTED]')
-
-  // Non-redacted references should be shared (same object reference)
-  assert.strictEqual(result.shared, obj.shared)
-  assert.strictEqual(result.nested.shared, obj.nested.shared)
-
-  // The shared object should be the exact same reference
-  assert.strictEqual(result.shared, sharedObject)
-  assert.strictEqual(result.nested.shared, sharedObject)
-})
-
-test('selective cloning works with arrays', () => {
-  const sharedItem = { unchanged: 'data' }
-  const obj = {
-    items: [
-      { secret: 'hidden1', shared: sharedItem },
-      { secret: 'hidden2', shared: sharedItem },
-      sharedItem
-    ]
-  }
-
-  const redact = slowRedact({
-    paths: ['items.*.secret'],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Secrets should be redacted
-  assert.strictEqual(result.items[0].secret, '[REDACTED]')
-  assert.strictEqual(result.items[1].secret, '[REDACTED]')
-
-  // Shared references should be preserved where possible
-  // Note: array items with secrets will be cloned, but their shared properties should still reference the original
-  assert.strictEqual(result.items[0].shared, sharedItem)
-  assert.strictEqual(result.items[1].shared, sharedItem)
-
-  // The third item gets cloned due to wildcard, but should have the same content
-  assert.deepStrictEqual(result.items[2], sharedItem)
-  // Note: Due to wildcard '*', all array items are cloned, even if they don't need redaction
-  // This is still a significant optimization for object properties that aren't in wildcard paths
-})
-
-test('selective cloning with no paths returns original object', () => {
-  const obj = { data: 'unchanged' }
-  const redact = slowRedact({
-    paths: [],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Should return the exact same object reference
-  assert.strictEqual(result, obj)
-})
-
-test('selective cloning performance - large objects with minimal redaction', () => {
-  // Create a large object with mostly shared data
-  const sharedData = { large: 'data'.repeat(1000) }
-  const obj = {
-    secret: 'hidden',
-    shared1: sharedData,
-    shared2: sharedData,
-    nested: {
-      secret: 'hidden2',
-      shared3: sharedData,
-      deep: {
-        shared4: sharedData,
-        moreShared: sharedData
-      }
-    }
-  }
-
-  const redact = slowRedact({
-    paths: ['secret', 'nested.secret'],
-    serialize: false
-  })
-
-  const result = redact(obj)
-
-  // Verify redaction worked
-  assert.strictEqual(result.secret, '[REDACTED]')
-  assert.strictEqual(result.nested.secret, '[REDACTED]')
-
-  // Verify shared references are preserved
-  assert.strictEqual(result.shared1, sharedData)
-  assert.strictEqual(result.shared2, sharedData)
-  assert.strictEqual(result.nested.shared3, sharedData)
-  assert.strictEqual(result.nested.deep.shared4, sharedData)
-  assert.strictEqual(result.nested.deep.moreShared, sharedData)
-})

package/node_modules/@pinojs/redact/tsconfig.json

@@ -1,19 +0,0 @@
-{
-    "compilerOptions": {
-        "module": "commonjs",
-        "lib": [
-            "es6"
-        ],
-        "noImplicitAny": true,
-        "noImplicitThis": true,
-        "strictFunctionTypes": true,
-        "strictNullChecks": true,
-        "types": [],
-        "noEmit": true,
-        "forceConsistentCasingInFileNames": true
-    },
-    "files": [
-        "index.d.ts",
-        "index.test-d.ts"
-    ]
-}

package/node_modules/atomic-sleep/.travis.yml

@@ -1,11 +0,0 @@
-language: node_js
-sudo: false
-node_js:
-  - 6
-  - 8
-  - 10
-  - 11
-  - 12
-  - 13
-script:
-  - npm run ci

package/node_modules/atomic-sleep/LICENSE

@@ -1,22 +0,0 @@
-The MIT License (MIT)
-Copyright (c) 2020 David Mark Clements
-
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
-OR OTHER DEALINGS IN THE SOFTWARE.
-

package/node_modules/atomic-sleep/index.js

@@ -1,38 +0,0 @@
-'use strict'
-
-/* global SharedArrayBuffer, Atomics */
-
-if (typeof SharedArrayBuffer !== 'undefined' && typeof Atomics !== 'undefined') {
-  const nil = new Int32Array(new SharedArrayBuffer(4))
-
-  function sleep (ms) {
-    // also filters out NaN, non-number types, including empty strings, but allows bigints
-    const valid = ms > 0 && ms < Infinity 
-    if (valid === false) {
-      if (typeof ms !== 'number' && typeof ms !== 'bigint') {
-        throw TypeError('sleep: ms must be a number')
-      }
-      throw RangeError('sleep: ms must be a number that is greater than 0 but less than Infinity')
-    }
-
-    Atomics.wait(nil, 0, 0, Number(ms))
-  }
-  module.exports = sleep
-} else {
-
-  function sleep (ms) {
-    // also filters out NaN, non-number types, including empty strings, but allows bigints
-    const valid = ms > 0 && ms < Infinity 
-    if (valid === false) {
-      if (typeof ms !== 'number' && typeof ms !== 'bigint') {
-        throw TypeError('sleep: ms must be a number')
-      }
-      throw RangeError('sleep: ms must be a number that is greater than 0 but less than Infinity')
-    }
-    const target = Date.now() + Number(ms)
-    while (target > Date.now()){}
-  }
-
-  module.exports = sleep
-
-}

package/node_modules/atomic-sleep/package.json

@@ -1,37 +0,0 @@
-{
-  "name": "atomic-sleep",
-  "version": "1.0.0",
-  "description": "Zero CPU overhead, zero dependency, true event-loop blocking sleep",
-  "main": "index.js",
-  "scripts": {
-    "test": "tap -R classic- -j1 test",
-    "lint": "standard",
-    "ci": "npm run lint && npm test"
-  },
-  "keywords": [
-    "sleep",
-    "pause",
-    "wait",
-    "performance",
-    "atomics"
-  ],
-  "engines": {
-    "node": ">=8.0.0"
-  },
-  "author": "David Mark Clements (@davidmarkclem)",
-  "license": "MIT",
-  "devDependencies": {
-    "standard": "^14.3.1",
-    "tap": "^14.10.6",
-    "tape": "^4.13.2"
-  },
-  "dependencies": {},
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/davidmarkclements/atomic-sleep.git"
-  },
-  "bugs": {
-    "url": "https://github.com/davidmarkclements/atomic-sleep/issues"
-  },
-  "homepage": "https://github.com/davidmarkclements/atomic-sleep#readme"
-}

package/node_modules/atomic-sleep/readme.md

@@ -1,58 +0,0 @@
-<h1 align="center">Welcome to atomic-sleep ⏱️</h1>
-<p>
-  <img alt="Version" src="https://img.shields.io/badge/version-1.0.0-blue.svg?cacheSeconds=2592000" />
-  <a href="#" target="_blank">
-    <img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-yellow.svg" />
-  </a>
-  <a href="https://twitter.com/davidmarkclem" target="_blank">
-    <img alt="Twitter: davidmarkclem" src="https://img.shields.io/twitter/follow/davidmarkclem.svg?style=social" />
-  </a>
-</p>
-
-> Zero CPU overhead, zero dependency, true event-loop blocking sleep
-
-## Usage
-
-```js
-const sleep = require('atomic-sleep')
-
-console.time('sleep')
-setTimeout(() => { console.timeEnd('sleep') }, 100) 
-sleep(1000)
-```
-
-The `console.time` will report a time of just over 1000ms despite the `setTimeout`
-being 100ms. This is because the event loop is paused for 1000ms and the setTimeout
-fires immediately after the event loop is no longer blocked (as more than 100ms have passed).
-
-## Install
-
-```sh
-npm install
-```
-
-## Run tests
-
-```sh
-npm test
-```
-
-## Support
-
-Node and Browser versions that support both `SharedArrayBuffer` and `Atomics` will have (virtually) zero CPU overhead sleep. 
-
-For Node, Atomic Sleep can provide zero CPU overhead sleep from Node 8 and up.
-
-For browser support see https://caniuse.com/#feat=sharedarraybuffer and https://caniuse.com/#feat=mdn-javascript_builtins_atomics.
-
-
-For older Node versions and olders browsers we fall back to blocking the event loop in a way that will cause a CPU spike. 
-
-
-
-## Author
-
-👤 **David Mark Clements (@davidmarkclem)**
-
-* Twitter: [@davidmarkclem](https://twitter.com/davidmarkclem)
-* Github: [@davidmarkclements](https://github.com/davidmarkclements)

package/node_modules/atomic-sleep/test.js

@@ -1,47 +0,0 @@
-'use strict'
-const test = require('tape')
-const sleep = require('.')
-
-test('blocks event loop for given amount of milliseconds', ({ is, end }) => {
-  const now = Date.now()
-  setTimeout(() => {
-    const delta = Date.now() - now
-    const fuzzyDelta = Math.floor(delta / 10) * 10 // allow up to 10ms of execution lag
-    is(fuzzyDelta, 1000)
-    end()
-  }, 100)
-  sleep(1000)
-})
-
-if (typeof BigInt !== 'undefined') {
-
-  test('allows ms to be supplied as a BigInt number', ({ is, end }) => {
-    const now = Date.now()
-    setTimeout(() => {
-      const delta = Date.now() - now
-      const fuzzyDelta = Math.floor(delta / 10) * 10 // allow up to 10ms of execution lag
-      is(fuzzyDelta, 1000)
-      end()
-    }, 100)
-    sleep(BigInt(1000)) // avoiding n notation as this will error on legacy node/browsers
-  })
-
-}
-
-test('throws range error if ms less than 0', ({ throws, end }) => {
-  throws(() => sleep(-1), RangeError('sleep: ms must be a number that is greater than 0 but less than Infinity'))
-  end()
-})
-
-test('throws range error if ms is Infinity', ({ throws, end }) => {
-  throws(() => sleep(Infinity), RangeError('sleep: ms must be a number that is greater than 0 but less than Infinity'))
-  end()
-})
-
-test('throws range error if ms is not a number or bigint', ({ throws, end }) => {
-  throws(() => sleep('Infinity'), TypeError('sleep: ms must be a number'))
-  throws(() => sleep('foo'), TypeError('sleep: ms must be a number'))
-  throws(() => sleep({a: 1}), TypeError('sleep: ms must be a number'))
-  throws(() => sleep([1,2,3]), TypeError('sleep: ms must be a number'))
-  end()
-})

package/node_modules/on-exit-leak-free/.github/dependabot.yml

@@ -1,12 +0,0 @@
-version: 2
-updates:
-- package-ecosystem: github-actions
-  directory: '/'
-  schedule:
-    interval: daily
-  open-pull-requests-limit: 10
-- package-ecosystem: npm
-  directory: '/'
-  schedule:
-    interval: daily
-  open-pull-requests-limit: 10

package/node_modules/on-exit-leak-free/.github/workflows/ci.yml

@@ -1,46 +0,0 @@
-name: CI
-on:
-  push:
-    paths-ignore:
-        - 'docs/**'
-        - '*.md'
-  pull_request:
-    paths-ignore:
-        - 'docs/**'
-        - '*.md'
-jobs:
-  test:
-    runs-on: ${{ matrix.os }}
-
-    strategy:
-      matrix:
-        node-version: [14, 16, 18, 20]
-        os: [macos-latest, ubuntu-latest, windows-latest]
-        exclude:
-          - node-version: 14
-            os: windows-latest
-
-    steps:
-
-      - uses: actions/checkout@v4
-
-      - name: Use Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: ${{ matrix.node-version }}
-
-      - name: Install
-        run: |
-          npm install --ignore-scripts
-
-      - name: Run tests
-        run: |
-          npm run test
-
-  automerge:
-    needs: test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: fastify/github-action-merge-dependabot@v3.9
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}

package/node_modules/on-exit-leak-free/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2021 Matteo Collina
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.