@joshuafolkken/kit 1.1166.0 → 1.1229.0

package/dist/hooks/audit-provision.js

@@ -0,0 +1,346 @@
+#!/usr/bin/env tsx
+import {
+  timed_fetch
+} from "./chunk-5VNDSNG3.js";
+import {
+  error_text
+} from "./chunk-CDY4NFQG.js";
+import {
+  PROJECT_ROOT,
+  stamp_file
+} from "./chunk-ELCN5LCH.js";
+
+// scripts/security/security-audit-provision.ts
+import { chmodSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import path2 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// scripts/security/security-audit.ts
+import { accessSync, constants, statSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { execaSync } from "execa";
+
+// scripts/security/security-audit-logic.ts
+import path from "node:path";
+var BINARY_NAME = "osv-scanner";
+var LOCKFILE_PATH = "pnpm-lock.yaml";
+var MANAGED_TOOL_SEGMENTS = ["node_modules", ".cache", "josh-tools"];
+var WINDOWS_PLATFORM = "win32";
+var WINDOWS_BINARY_SUFFIX = ".exe";
+var INSTALL_INSTRUCTIONS = [
+  "",
+  "Install options:",
+  "  Managed: pnpm josh audit:provision",
+  "  macOS:  brew install osv-scanner",
+  "  Go:     go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest",
+  '  Docker: docker run --rm -v "$PWD:/src" ghcr.io/google/osv-scanner --lockfile=/src/pnpm-lock.yaml',
+  "",
+  "Docs: https://google.github.io/osv-scanner/"
+].join("\n");
+function build_scanner_arguments(lockfile_path) {
+  return [`--lockfile=${lockfile_path}`];
+}
+function build_managed_binary_path(project_root, platform) {
+  const suffix = platform === WINDOWS_PLATFORM ? WINDOWS_BINARY_SUFFIX : "";
+  return path.join(project_root, ...MANAGED_TOOL_SEGMENTS, `${BINARY_NAME}${suffix}`);
+}
+function format_missing_binary_error(binary_name) {
+  return `${binary_name} is not installed.
+${INSTALL_INSTRUCTIONS}`;
+}
+var security_audit_logic = {
+  BINARY_NAME,
+  LOCKFILE_PATH,
+  build_managed_binary_path,
+  build_scanner_arguments,
+  format_missing_binary_error
+};
+
+// scripts/security/security-audit-provision-logic.ts
+var SCANNER_VERSION = "2.6.0";
+var MINIMUM_SCANNER_VERSION = SCANNER_VERSION;
+var RELEASE_BASE_URL = "https://github.com/google/osv-scanner/releases/download";
+var WINDOWS_PLATFORM2 = "win32";
+var WINDOWS_ASSET_SUFFIX = ".exe";
+var STAGING_SUFFIX = ".download";
+var SESSION_DOWNLOAD_TIMEOUT_MS = 6e4;
+var FORCED_DOWNLOAD_TIMEOUT_MS = 6e5;
+function build_download_timeout(is_forced) {
+  return is_forced ? FORCED_DOWNLOAD_TIMEOUT_MS : SESSION_DOWNLOAD_TIMEOUT_MS;
+}
+var MS_PER_HOUR = 36e5;
+var HOURS_BEFORE_RETRY = 6;
+var RETRY_INTERVAL_MS = HOURS_BEFORE_RETRY * MS_PER_HOUR;
+var PLATFORM_NAMES = {
+  darwin: "darwin",
+  linux: "linux",
+  win32: "windows"
+};
+var ARCHITECTURE_NAMES = {
+  arm64: "arm64",
+  x64: "amd64"
+};
+var ASSET_CHECKSUMS = {
+  "osv-scanner_darwin_amd64": "60c5296637e977b28eeda5c7f13573e447659a632922737f94d11fa7e30ad6ca",
+  "osv-scanner_darwin_arm64": "98c460dcd37de25819babd757d04542045b6243113e209edcd4d89fedb0256b4",
+  "osv-scanner_linux_amd64": "ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108",
+  "osv-scanner_linux_arm64": "2c71403eb443d05891c4f268c3ad771cf4f16e5443463fd7851ef8f454d3c7e4",
+  "osv-scanner_windows_amd64.exe": "e0ed7644118b717b028c249ee9d3515024e55e8510747ca08906eb96765354d6",
+  "osv-scanner_windows_arm64.exe": "ca1379da0e408279ef2c85cde0846a903495738a91c7b065a208048437c1686c"
+};
+function build_asset_name(platform, architecture) {
+  const platform_name = PLATFORM_NAMES[platform];
+  const architecture_name = ARCHITECTURE_NAMES[architecture];
+  if (platform_name === void 0 || architecture_name === void 0) return void 0;
+  const suffix = platform === WINDOWS_PLATFORM2 ? WINDOWS_ASSET_SUFFIX : "";
+  return `${security_audit_logic.BINARY_NAME}_${platform_name}_${architecture_name}${suffix}`;
+}
+function build_download_url(asset_name) {
+  return `${RELEASE_BASE_URL}/v${SCANNER_VERSION}/${asset_name}`;
+}
+function build_staging_path(target_path, process_id) {
+  return `${target_path}.${String(process_id)}${STAGING_SUFFIX}`;
+}
+function resolve_asset(platform, architecture) {
+  const name = build_asset_name(platform, architecture);
+  if (name === void 0) return void 0;
+  const sha256 = ASSET_CHECKSUMS[name];
+  if (sha256 === void 0) return void 0;
+  return { name, sha256, url: build_download_url(name) };
+}
+function format_already_present(location) {
+  return `osv-scanner is already available (${location}); nothing to provision.`;
+}
+function format_unsupported_platform(platform, architecture) {
+  return `No pinned osv-scanner build for ${platform}/${architecture}; install it manually to run the pre-push audit.`;
+}
+function format_download_failure(url, reason) {
+  return `Could not fetch osv-scanner from ${url}: ${reason}. Run \`pnpm josh audit:provision --force\` to retry with a longer timeout; until then the pre-push audit will report the missing binary.`;
+}
+function format_checksum_mismatch(asset_name, expected, actual) {
+  return `Checksum mismatch for ${asset_name}: expected ${expected}, got ${actual}. Nothing was installed.`;
+}
+function format_installed(target_path) {
+  return `Installed osv-scanner v${SCANNER_VERSION} at ${target_path}.`;
+}
+function format_recent_failure() {
+  return `A previous attempt to provision osv-scanner failed less than ${String(HOURS_BEFORE_RETRY)} hours ago; not retrying at session start. Run \`pnpm josh audit:provision --force\` to try again now.`;
+}
+function format_provision_error(reason) {
+  return `Could not provision osv-scanner: ${reason}. The pre-push audit will report the missing binary.`;
+}
+var SCANNER_VERSION_PATTERN = /osv-scanner version:\s*(\d+\.\d+\.\d+)/u;
+function parse_scanner_version(version_output) {
+  return SCANNER_VERSION_PATTERN.exec(version_output)?.[1];
+}
+function to_version_parts(version) {
+  return version.split(".").map(Number);
+}
+function compare_versions(left, right) {
+  const left_parts = to_version_parts(left);
+  const right_parts = to_version_parts(right);
+  const length = Math.max(left_parts.length, right_parts.length);
+  for (let index = 0; index < length; index += 1) {
+    const difference = (left_parts[index] ?? 0) - (right_parts[index] ?? 0);
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
+function meets_version_floor(version) {
+  return compare_versions(version, MINIMUM_SCANNER_VERSION) >= 0;
+}
+function format_below_floor(version) {
+  return `osv-scanner ${version} is below the required v${MINIMUM_SCANNER_VERSION}; older builds parse only part of pnpm-lock.yaml, so a clean result here is not proof the lockfile is clean. Run \`pnpm josh audit:provision --force\` to install v${SCANNER_VERSION}.`;
+}
+var security_audit_provision_logic = {
+  RETRY_INTERVAL_MS,
+  SESSION_DOWNLOAD_TIMEOUT_MS,
+  SCANNER_VERSION,
+  MINIMUM_SCANNER_VERSION,
+  build_asset_name,
+  build_download_timeout,
+  build_download_url,
+  build_staging_path,
+  format_already_present,
+  format_below_floor,
+  format_checksum_mismatch,
+  format_download_failure,
+  format_installed,
+  format_provision_error,
+  format_recent_failure,
+  format_unsupported_platform,
+  meets_version_floor,
+  parse_scanner_version,
+  resolve_asset
+};
+
+// scripts/security/security-audit.ts
+var FAILURE_EXIT_CODE = 1;
+var UNKNOWN_VERSION = "unknown";
+function is_binary_available(binary_name) {
+  const result = execaSync(binary_name, ["--version"], { stdio: "ignore", reject: false });
+  return result.exitCode !== void 0;
+}
+function scanner_version(binary_or_path) {
+  const result = execaSync(binary_or_path, ["--version"], { reject: false });
+  if (result.exitCode === void 0) return void 0;
+  return security_audit_provision_logic.parse_scanner_version(result.stdout);
+}
+function meets_floor(binary_or_path) {
+  const version = scanner_version(binary_or_path);
+  return version !== void 0 && security_audit_provision_logic.meets_version_floor(version);
+}
+function is_executable_file(candidate_path) {
+  try {
+    accessSync(candidate_path, constants.X_OK);
+    const stats = statSync(candidate_path);
+    return stats.isFile() && stats.size > 0;
+  } catch {
+    return false;
+  }
+}
+function managed_scanner(project_root, platform) {
+  const managed_path = security_audit_logic.build_managed_binary_path(project_root, platform);
+  return is_executable_file(managed_path) && meets_floor(managed_path) ? managed_path : void 0;
+}
+function resolve_scanner(project_root, platform) {
+  const { BINARY_NAME: BINARY_NAME2 } = security_audit_logic;
+  const has_path_binary = is_binary_available(BINARY_NAME2);
+  if (has_path_binary && meets_floor(BINARY_NAME2)) {
+    return { path: BINARY_NAME2, is_below_floor: false };
+  }
+  const managed = managed_scanner(project_root, platform);
+  if (managed !== void 0) return { path: managed, is_below_floor: false };
+  return has_path_binary ? { path: BINARY_NAME2, is_below_floor: true } : void 0;
+}
+var FORWARDED_OUTPUT = ["inherit", "pipe"];
+function run_scanner(scanner_path) {
+  const { LOCKFILE_PATH: LOCKFILE_PATH2, build_scanner_arguments: build_scanner_arguments2 } = security_audit_logic;
+  const result = execaSync(scanner_path, [...build_scanner_arguments2(LOCKFILE_PATH2)], {
+    stdin: "inherit",
+    stdout: FORWARDED_OUTPUT,
+    stderr: FORWARDED_OUTPUT,
+    reject: false
+  });
+  return result.exitCode ?? FAILURE_EXIT_CODE;
+}
+function warn_below_floor(scanner_path) {
+  const version = scanner_version(scanner_path) ?? UNKNOWN_VERSION;
+  console.warn(security_audit_provision_logic.format_below_floor(version));
+}
+function main() {
+  const { BINARY_NAME: BINARY_NAME2, format_missing_binary_error: format_missing_binary_error2 } = security_audit_logic;
+  const choice = resolve_scanner(PROJECT_ROOT, process.platform);
+  if (choice === void 0) {
+    console.error(format_missing_binary_error2(BINARY_NAME2));
+    process.exit(FAILURE_EXIT_CODE);
+  }
+  if (choice.is_below_floor) warn_below_floor(choice.path);
+  process.exit(run_scanner(choice.path));
+}
+if (process.argv[1] === fileURLToPath(import.meta.url)) main();
+var security_audit = {
+  is_binary_available,
+  is_executable_file,
+  meets_floor,
+  resolve_scanner,
+  run_scanner
+};
+
+// scripts/security/security-audit-provision.ts
+var EXECUTABLE_MODE = 493;
+var FAILURE_STAMP_PREFIX = "josh-audit-provision-";
+var FORCE_FLAG = "--force";
+var PATH_LOCATION = "on PATH";
+var { RETRY_INTERVAL_MS: RETRY_INTERVAL_MS2 } = security_audit_provision_logic;
+async function download(url, timeout_ms) {
+  try {
+    const response = await timed_fetch(url, {}, timeout_ms);
+    if (!response.ok) return { reason: `HTTP ${String(response.status)}` };
+    return { content: Buffer.from(await response.arrayBuffer()), reason: "" };
+  } catch (error) {
+    return { reason: error_text.message_of(error) };
+  }
+}
+function install(target_path, content) {
+  const staging_path = security_audit_provision_logic.build_staging_path(target_path, process.pid);
+  mkdirSync(path2.dirname(target_path), { recursive: true });
+  try {
+    writeFileSync(staging_path, content);
+    chmodSync(staging_path, EXECUTABLE_MODE);
+    renameSync(staging_path, target_path);
+  } finally {
+    rmSync(staging_path, { force: true });
+  }
+}
+function failure_stamp_path(target_path) {
+  return stamp_file.stamp_path(FAILURE_STAMP_PREFIX, target_path);
+}
+function is_in_backoff(target_path) {
+  const recorded = Number(stamp_file.read_stamp_text(failure_stamp_path(target_path)));
+  return Number.isFinite(recorded) && Date.now() - recorded < RETRY_INTERVAL_MS2;
+}
+function record_failure(target_path, message) {
+  stamp_file.write_stamp(failure_stamp_path(target_path), Date.now());
+  return message;
+}
+async function provision(target_path, asset, timeout_ms) {
+  const { format_checksum_mismatch: format_checksum_mismatch2, format_download_failure: format_download_failure2, format_installed: format_installed2 } = security_audit_provision_logic;
+  const outcome = await download(asset.url, timeout_ms);
+  if (outcome.content === void 0) {
+    return { is_installed: false, message: format_download_failure2(asset.url, outcome.reason) };
+  }
+  const actual = stamp_file.digest(outcome.content);
+  if (actual !== asset.sha256) {
+    return {
+      is_installed: false,
+      message: format_checksum_mismatch2(asset.name, asset.sha256, actual)
+    };
+  }
+  install(target_path, outcome.content);
+  return { is_installed: true, message: format_installed2(target_path) };
+}
+async function attempt(target_path, asset, timeout_ms) {
+  try {
+    const outcome = await provision(target_path, asset, timeout_ms);
+    if (!outcome.is_installed) return record_failure(target_path, outcome.message);
+    stamp_file.remove_stamp(failure_stamp_path(target_path));
+    return outcome.message;
+  } catch (error) {
+    return record_failure(
+      target_path,
+      security_audit_provision_logic.format_provision_error(error_text.message_of(error))
+    );
+  }
+}
+function existing_scanner(target_path) {
+  const { BINARY_NAME: BINARY_NAME2 } = security_audit_logic;
+  if (security_audit.meets_floor(BINARY_NAME2)) return PATH_LOCATION;
+  const is_managed_usable = security_audit.is_executable_file(target_path) && security_audit.meets_floor(target_path);
+  return is_managed_usable ? target_path : void 0;
+}
+async function report(project_root, platform, architecture, is_forced) {
+  const logic = security_audit_provision_logic;
+  const target_path = security_audit_logic.build_managed_binary_path(project_root, platform);
+  const existing = existing_scanner(target_path);
+  if (existing !== void 0) return logic.format_already_present(existing);
+  const asset = logic.resolve_asset(platform, architecture);
+  if (asset === void 0) return logic.format_unsupported_platform(platform, architecture);
+  if (!is_forced && is_in_backoff(target_path)) return logic.format_recent_failure();
+  return await attempt(target_path, asset, logic.build_download_timeout(is_forced));
+}
+async function main2() {
+  const is_forced = process.argv.includes(FORCE_FLAG);
+  try {
+    console.info(await report(PROJECT_ROOT, process.platform, process.arch, is_forced));
+  } catch (error) {
+    console.warn(
+      security_audit_provision_logic.format_provision_error(error_text.message_of(error))
+    );
+  }
+}
+if (process.argv[1] === fileURLToPath2(import.meta.url)) await main2();
+var security_audit_provision = { attempt, provision, report };
+export {
+  security_audit_provision
+};

package/dist/hooks/batch-guard.js

@@ -9,12 +9,13 @@ import {
   load_environment_file,
   notice_refusal_path,
   refusal_path
-} from "./chunk-V2BTOZHT.js";
-import "./chunk-GYNGP7HI.js";
-import "./chunk-5KTCMCOT.js";
-import "./chunk-DYAVAM6S.js";
+} from "./chunk-RNWHN5BP.js";
+import "./chunk-VC3PZPZO.js";
+import "./chunk-6HJJXRBX.js";
+import "./chunk-55HHG5PX.js";
 import "./chunk-WPALEIRX.js";
 import "./chunk-RKUAD3I6.js";
+import "./chunk-ELCN5LCH.js";
 export {
   DISABLED_VALUES,
   SWITCH_ENV_KEY,