@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.10

package/dist/chunk-GXJVY6WT.js

@@ -0,0 +1,250 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  aggregateTraffic,
+  readContractFiles
+} from "./chunk-R4TBNKKC.js";
+import {
+  TRAFFIC_SOURCES
+} from "./chunk-NIXVDQVO.js";
+import {
+  ContractsFile,
+  evidenceDirOf,
+  evidenceRelOf,
+  factsDirOf,
+  factsRelOf,
+  loadOrgPack,
+  orgPackDirOf,
+  readTrafficFile,
+  require_dist,
+  trafficFileName
+} from "./chunk-577AJVRS.js";
+import {
+  writeFileAtomic
+} from "./chunk-D3PO4DOZ.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/link-evidence-files.js
+var import_yaml = __toESM(require_dist(), 1);
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readdir, readFile, rm } from "node:fs/promises";
+import { basename, join, resolve } from "node:path";
+var SHOWN = 5;
+async function repoContractsOf(root, repo, dir, facts, onRefused) {
+  const commit = facts.map((f) => f.commit).sort()[0];
+  const own = facts.flatMap((f) => f.kind === "entry" && f.entryType === "rest" ? [{ ...f.method ? { method: f.method } : {}, path: f.path }] : []);
+  const deny = await denyHashesAt(root);
+  return readContractFiles(dir, {
+    repo,
+    ...commit ? { commit } : {},
+    own,
+    ...deny.size ? { denyHashes: deny } : {},
+    ...onRefused ? { onRefused } : {}
+  });
+}
+async function writeRepoContracts(root, repo, dir, facts, onRefused) {
+  const file = await repoContractsOf(root, repo, dir, facts, onRefused);
+  const path = join(factsDirOf(root), `${repo}.contracts.yaml`);
+  if (file.entries.length)
+    await writeFileAtomic(path, (0, import_yaml.stringify)(file, { lineWidth: 0 }));
+  else
+    await rm(path, { force: true });
+  return file;
+}
+async function loadLinkEvidence(root) {
+  const problems = [];
+  const contracts = [];
+  const fRel = factsRelOf(root);
+  for (const n of (await readdir(factsDirOf(root)).catch(() => [])).sort()) {
+    if (!n.endsWith(".contracts.yaml"))
+      continue;
+    let v;
+    try {
+      v = (0, import_yaml.parse)(await readFile(join(factsDirOf(root), n), "utf8"));
+    } catch (e) {
+      problems.push(`${fRel}/${n} isn't YAML (${e.message}); it is left out.`);
+      continue;
+    }
+    const p = ContractsFile.safeParse(v);
+    if (p.success)
+      contracts.push(p.data);
+    else
+      problems.push(`${fRel}/${n} isn't a contracts file; it is left out.`);
+  }
+  const traffic = [];
+  const tDir = join(evidenceDirOf(root), "traffic");
+  const tRel = `${evidenceRelOf(root)}/traffic`;
+  for (const n of (await readdir(tDir).catch(() => [])).sort()) {
+    if (!/\.ya?ml$/.test(n))
+      continue;
+    const r = readTrafficFile(`${tRel}/${n}`, await readFile(join(tDir, n), "utf8"));
+    if (r.ok)
+      traffic.push(r.traffic);
+    else
+      problems.push(`${r.message}; it is left out.`);
+  }
+  return { contracts, traffic, problems };
+}
+function componentsOf(repo, join2) {
+  const out = /* @__PURE__ */ new Set([repo]);
+  for (const j of join2?.joins ?? []) {
+    if (j.call.repo === repo)
+      out.add(j.call.component);
+    if (j.entry.repo === repo)
+      out.add(j.entry.component);
+  }
+  return out;
+}
+function linkEvidenceAbout(repo, le, join2) {
+  const comps = componentsOf(repo, join2);
+  const touches = (l) => !!l && (comps.has(l.from) || comps.has(l.to));
+  return {
+    contracts: {
+      confirmed: le.contracts.confirmed.filter(touches),
+      findings: le.contracts.findings.filter((f) => f.repo === repo || f.links.some(touches))
+    },
+    traffic: {
+      seen: le.traffic.seen.filter(touches),
+      findings: le.traffic.findings.filter((f) => f.component && comps.has(f.component) || touches(f.link)),
+      // An app named like no component is the estate's, not one repo's: listed in every report.
+      unknownApps: le.traffic.findings.filter((f) => f.reason === "unknown-app")
+    }
+  };
+}
+function linkEvidenceLines(about, report, o = {}) {
+  const out = [];
+  const show = (lines) => {
+    const shown = o.verbose ? lines : lines.slice(0, SHOWN);
+    out.push(...shown.map((l) => `    ${l}`));
+    if (shown.length < lines.length)
+      out.push(`    ... and ${lines.length - shown.length} more (in ${report})`);
+  };
+  const c = about.contracts;
+  if (c.confirmed.length || c.findings.length) {
+    out.push(`  Contracts: ${c.confirmed.length} link${c.confirmed.length === 1 ? "" : "s"} confirmed by a consumer's contract file, ${c.findings.length} request${c.findings.length === 1 ? "" : "s"} the join doesn't bear out (under contracts in ${report}):`);
+    show(c.findings.map((f) => `${f.reason}: ${f.message}`));
+  }
+  const t = about.traffic;
+  const apps = t.unknownApps.length;
+  if (t.seen.length || t.findings.length || apps) {
+    out.push(`  Traffic: ${t.seen.length} link${t.seen.length === 1 ? "" : "s"} seen in imported traffic, ${t.findings.length} finding${t.findings.length === 1 ? "" : "s"}${apps ? `; ${apps} app${apps === 1 ? "" : "s"} in the estate's traffic named like no component (name each in its row)` : ""} (under traffic in ${report}):`);
+    show(t.findings.map((f) => `${f.reason}: ${f.message}`));
+  }
+  return out;
+}
+async function intakeTraffic(root, file, o, io) {
+  const sources = Object.keys(TRAFFIC_SOURCES).sort();
+  if (!file) {
+    io.err(`intake traffic needs an export file: atticus intake traffic <file> --source ${sources.join("|")} [--from YYYY-MM-DD --to YYYY-MM-DD]`);
+    return 2;
+  }
+  const columns = o.source ? TRAFFIC_SOURCES[o.source] : void 0;
+  if (!columns) {
+    io.err(`${o.source ? `${o.source} is no source Atticus reads` : "Say which source the export is from"}: --source ${sources.join("|")}.`);
+    return 2;
+  }
+  const path = resolve(file);
+  if (!existsSync(path)) {
+    io.err(`No file at ${file}.`);
+    return 2;
+  }
+  const bytes = new Uint8Array(await readFile(path));
+  const { templates, apps } = await estateNames(root);
+  const deny = await denyHashesAt(root);
+  const r = aggregateTraffic({
+    bytes,
+    source: o.source,
+    columns,
+    templates,
+    apps,
+    ...o.from ? { from: o.from } : {},
+    ...o.to ? { to: o.to } : {},
+    ...deny.size ? { denyHashes: deny } : {}
+  });
+  if (!r.ok) {
+    io.err(`${basename(path)}: ${r.message}`);
+    return 1;
+  }
+  const rel = `${evidenceRelOf(root)}/traffic/${trafficFileName(r.file)}`;
+  await writeFileAtomic(join(evidenceDirOf(root), "traffic", trafficFileName(r.file)), r.text);
+  if (o.json) {
+    io.out(JSON.stringify({
+      written: rel,
+      rows: r.file.rows.length,
+      read: r.read,
+      outOfRange: r.outOfRange,
+      skipped: r.skipped,
+      dropped: r.dropped,
+      from: r.file.from,
+      to: r.file.to,
+      inputSha256: r.file.inputSha256
+    }, null, 2));
+    return 0;
+  }
+  io.out(`Wrote ${rel}: ${r.file.rows.length} aggregate${r.file.rows.length === 1 ? "" : "s"} (caller app, method, path template, proxy and base path) from ${r.read} rows, ${r.file.from} to ${r.file.to}${r.outOfRange ? `; ${r.outOfRange} outside the range` : ""}${r.skipped ? `; ${r.skipped} without a method, path or count` : ""}${r.unmatched ? `; ${r.unmatched} to a path no route template of the estate matches, dropped` : ""}.`);
+  if (r.dropped.length)
+    io.out(`  Dropped before anything was written: the columns ${r.dropped.join(", ")}, every query string and matrix param, any proxy that looked like an IP, an email or a token, and every path but as a route template of the estate. No raw row is kept.`);
+  io.out(`  Review it in a pull request (an app named like no component is written as an app-<hash> label: give its row a component: line), then atticus verify <repo> --write marks the links it shows used, and lists the traffic no link carries and the links none used.`);
+  return 0;
+}
+async function estateNames(root) {
+  const { estateFacts, estateRepos } = await import("./chunk-2XM6PYQQ.js");
+  const apps = /* @__PURE__ */ new Set();
+  const tDir = join(evidenceDirOf(root), "traffic");
+  for (const n of (await readdir(tDir).catch(() => [])).sort()) {
+    if (!/\.ya?ml$/.test(n))
+      continue;
+    const r = readTrafficFile(n, await readFile(join(tDir, n), "utf8"));
+    if (r.ok) {
+      for (const row of r.traffic.file.rows)
+        if (row.component)
+          apps.add(row.app).add(row.component);
+    }
+  }
+  const op = await loadOrgPack(orgPackDirOf(root)).catch(() => void 0);
+  if (!op)
+    return { templates: [], apps: [...apps].sort() };
+  for (const m of estateRepos(op)) {
+    apps.add(m.id);
+    if (m.component)
+      apps.add(m.component);
+    for (const x of m.modules ?? [])
+      apps.add(x.component);
+  }
+  const { repos } = await estateFacts(root, op, "");
+  const out = /* @__PURE__ */ new Set();
+  for (const r of repos) {
+    apps.add(r.repo);
+    for (const f of r.facts) {
+      if (f.component)
+        apps.add(f.component);
+      if (f.kind === "entry" && f.entryType === "rest" || f.kind === "call" && f.callType === "rest") {
+        if (f.path?.startsWith("/"))
+          out.add(f.path);
+      }
+    }
+  }
+  return { templates: [...out].sort(), apps: [...apps].sort() };
+}
+async function denyHashesAt(root) {
+  const text = await readFile(join(root, ".denylist"), "utf8").catch(() => "");
+  return new Set(text.split(/\r?\n/).map((l) => l.trim()).filter((l) => /^[0-9a-f]{64}$/.test(l)));
+}
+var denyHash = (s) => createHash("sha256").update(s.trim().toLowerCase(), "utf8").digest("hex");
+
+export {
+  repoContractsOf,
+  writeRepoContracts,
+  loadLinkEvidence,
+  linkEvidenceAbout,
+  linkEvidenceLines,
+  intakeTraffic,
+  denyHashesAt,
+  denyHash
+};