@patchstack/connect 0.5.19 → 0.5.20

package/dist/cli.js

@@ -8391,6 +8391,234 @@ function pathFromTainted(node, ts, rootPath, trailing = []) {
   return { path: normalizePath([base.path, ...segs].filter(Boolean).join(".")), space, ...request, ...accessor, ...reassigned };
 }
 
+// src/map/budget.ts
+var INGEST_LIMITS = {
+  bytes: 2 * 1024 * 1024,
+  nodes: 5e4,
+  depth: 12,
+  endpoints: 2e3,
+  fileLength: 512,
+  inputsPerEndpoint: 500,
+  sinksPerEndpoint: 500,
+  flowsPerEndpoint: 2e3,
+  dependencyInputFlowsPerEndpoint: 100
+};
+var RESERVE = { nodes: 8, bytes: 256 };
+function nodeCount(value) {
+  if (value === null || typeof value !== "object") return 0;
+  let n = 0;
+  for (const item of Object.values(value)) n += 1 + nodeCount(item);
+  return n;
+}
+function depthOf(value, depth = 0) {
+  if (value === null || typeof value !== "object") return depth;
+  let deepest = depth;
+  for (const item of Object.values(value)) deepest = Math.max(deepest, depthOf(item, depth + 1));
+  return deepest;
+}
+var encoder = new TextEncoder();
+var byteLength = (value) => encoder.encode(JSON.stringify(value)).length;
+function ingestProblems(map, limits = INGEST_LIMITS) {
+  const problems = [];
+  const bytes = byteLength(map);
+  const nodes = nodeCount(map);
+  const depth = depthOf(map);
+  if (bytes > limits.bytes - RESERVE.bytes) problems.push(`${bytes} bytes, over the ${limits.bytes - RESERVE.bytes} the upload can carry`);
+  if (nodes > limits.nodes - RESERVE.nodes) problems.push(`${nodes} nodes, over the ${limits.nodes - RESERVE.nodes} the upload can carry`);
+  if (depth > limits.depth) problems.push(`nesting ${depth} levels deep, over ${limits.depth}`);
+  if (map.endpoints.length > limits.endpoints) problems.push(`${map.endpoints.length} endpoints, over ${limits.endpoints}`);
+  map.endpoints.forEach((e, i) => {
+    const at = `endpoint ${i}`;
+    if (typeof e.file !== "string" || e.file.length > limits.fileLength) problems.push(`${at} has a file path over ${limits.fileLength} characters`);
+    if (e.inputs.length > limits.inputsPerEndpoint) problems.push(`${at} has ${e.inputs.length} inputs, over ${limits.inputsPerEndpoint}`);
+    if (e.sinks.length > limits.sinksPerEndpoint) problems.push(`${at} has ${e.sinks.length} sinks, over ${limits.sinksPerEndpoint}`);
+    if (e.flows.length > limits.flowsPerEndpoint) problems.push(`${at} has ${e.flows.length} flows, over ${limits.flowsPerEndpoint}`);
+    if ((e.dependencyInputFlows?.length ?? 0) > limits.dependencyInputFlowsPerEndpoint) problems.push(`${at} has ${e.dependencyInputFlows.length} dependency input links, over ${limits.dependencyInputFlowsPerEndpoint}`);
+  });
+  return problems;
+}
+function keepPriority(flow) {
+  if (flow.confidence === "exact-local") return flow.ruleGeneratable ? 3 : 2;
+  if (flow.confidence === "transformed-local") return 1;
+  return 0;
+}
+var STAGES = ["unproven", "invocation", "dependency", "transformed", "exact", "generatable", "import"];
+function budgetDocument(input, limits = INGEST_LIMITS) {
+  let endpointsOmitted = 0;
+  let endpoints = input.endpoints.filter((e) => {
+    const ok = typeof e.file === "string" && e.file.length <= limits.fileLength;
+    if (!ok) endpointsOmitted++;
+    return ok;
+  });
+  if (endpoints.length > limits.endpoints) {
+    endpointsOmitted += endpoints.length - limits.endpoints;
+    endpoints = endpoints.slice(0, limits.endpoints);
+  }
+  endpoints = endpoints.map((e) => capEndpoint(e, limits));
+  let map = { ...input, endpoints };
+  if (endpointsOmitted > 0) map = { ...map, coverage: { ...map.coverage, endpointsOmitted } };
+  const removals = [];
+  map.endpoints.forEach((e, s) => {
+    e.flows.forEach((f, i) => {
+      const p = keepPriority(f);
+      const stage = p === 3 ? "generatable" : p === 2 ? "exact" : p === 1 ? "transformed" : "unproven";
+      removals.push({ stage, section: s, item: i, nodes: 1 + nodeCount(f), bytes: byteLength(f) + 1 });
+    });
+    (e.dependencyInputFlows ?? []).forEach((d, i) => removals.push({ stage: "dependency", section: s, item: i, nodes: 1 + nodeCount(d), bytes: byteLength(d) + 1 }));
+  });
+  (map.apiInvocations ?? []).forEach((v, i) => removals.push({ stage: "invocation", section: -1, item: i, nodes: 1 + nodeCount(v), bytes: byteLength(v) + 1 }));
+  (map.imports ?? []).forEach((v, i) => removals.push({ stage: "import", section: -1, item: i, nodes: 1 + nodeCount(v), bytes: byteLength(v) + 1 }));
+  removals.sort((a, b) => STAGES.indexOf(a.stage) - STAGES.indexOf(b.stage) || b.section - a.section || b.item - a.item);
+  const removed = /* @__PURE__ */ new Set();
+  const key = (r) => `${r.stage === "unproven" || r.stage === "transformed" || r.stage === "exact" || r.stage === "generatable" ? "flow" : r.stage}:${r.section}:${r.item}`;
+  const fitsSize = (doc2) => nodeCount(doc2) <= limits.nodes - RESERVE.nodes && byteLength(doc2) <= limits.bytes - RESERVE.bytes;
+  let doc = withNote(applyRemovals(map, removed));
+  let nodes = nodeCount(doc);
+  let bytes = byteLength(doc);
+  for (const r of removals) {
+    if (nodes <= limits.nodes - RESERVE.nodes && bytes <= limits.bytes - RESERVE.bytes) {
+      doc = withNote(applyRemovals(map, removed));
+      nodes = nodeCount(doc);
+      bytes = byteLength(doc);
+      if (fitsSize(doc)) break;
+    }
+    removed.add(key(r));
+    nodes -= r.nodes;
+    bytes -= r.bytes;
+  }
+  doc = withNote(applyRemovals(map, removed));
+  const problems = ingestProblems(doc, limits);
+  if (problems.length === 0) return doc;
+  return {
+    ...doc,
+    coverage: {
+      ...doc.coverage,
+      notes: [...doc.coverage.notes, `This map cannot be fitted to the size the Patchstack API accepts (${problems.join("; ")}), even after leaving out everything that may be left out. It must not be uploaded.`]
+    }
+  };
+}
+function capEndpoint(e, limits) {
+  let flows = e.flows;
+  let droppedProven = 0;
+  let droppedUnproven = 0;
+  const drop = (keep) => {
+    flows = flows.filter((f) => {
+      if (keep(f)) return true;
+      if (isProvenFlow(f.confidence)) droppedProven++;
+      else droppedUnproven++;
+      return false;
+    });
+  };
+  if (flows.length > limits.flowsPerEndpoint) {
+    const kept = new Set(
+      flows.map((f, i) => ({ f, i, p: keepPriority(f) })).sort((a, b) => b.p - a.p || a.i - b.i).slice(0, limits.flowsPerEndpoint).map(({ i }) => i)
+    );
+    const byIndex = new Map(flows.map((f, i) => [f, i]));
+    drop((f) => kept.has(byIndex.get(f)));
+  }
+  const ranked = [...flows].sort((a, b) => keepPriority(b) - keepPriority(a));
+  const pick = (items, limit, idOf) => {
+    if (items.length <= limit) return { kept: items, omitted: 0 };
+    const wanted = /* @__PURE__ */ new Set();
+    for (const f of ranked) {
+      const id = idOf(f);
+      if (id !== void 0 && wanted.size < limit) wanted.add(id);
+    }
+    const chosen = new Set(items.filter((it) => it.id !== void 0 && wanted.has(it.id)));
+    for (const it of items) if (chosen.size < limit) chosen.add(it);
+    return { kept: items.filter((it) => chosen.has(it)), omitted: items.length - chosen.size };
+  };
+  const inputs = pick(e.inputs, limits.inputsPerEndpoint, (f) => f.inputId);
+  const sinks = pick(e.sinks, limits.sinksPerEndpoint, (f) => f.sink?.id);
+  if (inputs.omitted > 0 || sinks.omitted > 0) {
+    const inputIds = new Set(inputs.kept.map((i) => i.id));
+    const sinkIds = new Set(sinks.kept.map((s) => s.id));
+    drop((f) => (f.inputId === void 0 || inputIds.has(f.inputId)) && (f.sink?.id === void 0 || sinkIds.has(f.sink.id)));
+  }
+  let links = e.dependencyInputFlows;
+  let linksTruncated = e.dependencyInputFlowsTruncated === true;
+  if (links !== void 0 && links.length > limits.dependencyInputFlowsPerEndpoint) {
+    links = links.slice(0, limits.dependencyInputFlowsPerEndpoint);
+    linksTruncated = true;
+  }
+  if (flows === e.flows && inputs.omitted === 0 && sinks.omitted === 0 && links === e.dependencyInputFlows) return e;
+  return {
+    ...e,
+    inputs: inputs.kept,
+    sinks: sinks.kept,
+    flows,
+    ...links !== void 0 ? { dependencyInputFlows: links } : {},
+    ...linksTruncated ? { dependencyInputFlowsTruncated: true } : {},
+    ...droppedUnproven > 0 ? { flowsTruncated: true } : {},
+    ...droppedProven > 0 ? { provenFlowsOmitted: (e.provenFlowsOmitted ?? 0) + droppedProven } : {},
+    ...inputs.omitted > 0 ? { inputsOmitted: inputs.omitted } : {},
+    ...sinks.omitted > 0 ? { sinksOmitted: sinks.omitted } : {}
+  };
+}
+function applyRemovals(map, removed) {
+  if (removed.size === 0) return map;
+  const endpoints = map.endpoints.map((e, s) => {
+    let proven = 0;
+    let unproven = 0;
+    const flows = e.flows.filter((f, i) => {
+      if (!removed.has(`flow:${s}:${i}`)) return true;
+      if (isProvenFlow(f.confidence)) proven++;
+      else unproven++;
+      return false;
+    });
+    const links = e.dependencyInputFlows?.filter((_, i) => !removed.has(`dependency:${s}:${i}`));
+    const linksDropped = (e.dependencyInputFlows?.length ?? 0) - (links?.length ?? 0);
+    if (proven === 0 && unproven === 0 && linksDropped === 0) return e;
+    return {
+      ...e,
+      flows,
+      ...links !== void 0 ? { dependencyInputFlows: links } : {},
+      ...unproven > 0 ? { flowsTruncated: true } : {},
+      ...proven > 0 ? { provenFlowsOmitted: (e.provenFlowsOmitted ?? 0) + proven } : {},
+      ...linksDropped > 0 ? { dependencyInputFlowsTruncated: true } : {}
+    };
+  });
+  const invocations = map.apiInvocations?.filter((_, i) => !removed.has(`invocation:-1:${i}`));
+  const imports = map.imports?.filter((_, i) => !removed.has(`import:-1:${i}`));
+  const invocationsOmitted = (map.apiInvocations?.length ?? 0) - (invocations?.length ?? 0);
+  const importsOmitted = (map.imports?.length ?? 0) - (imports?.length ?? 0);
+  return {
+    ...map,
+    endpoints,
+    ...invocations !== void 0 ? { apiInvocations: invocations } : {},
+    ...imports !== void 0 ? { imports } : {},
+    coverage: {
+      ...map.coverage,
+      ...invocationsOmitted > 0 ? { apiInvocationsOmitted: invocationsOmitted } : {},
+      // A package missing from a trimmed inventory may still be imported, so the inventory stops licensing
+      // any "not imported" conclusion.
+      ...importsOmitted > 0 ? { importsComplete: false, importCoverageGaps: { ...map.coverage.importCoverageGaps, omittedForSize: importsOmitted } } : {}
+    }
+  };
+}
+function withNote(doc) {
+  const parts = [];
+  const proven = doc.endpoints.reduce((n, e) => n + (e.provenFlowsOmitted ?? 0), 0);
+  const marked = doc.endpoints.filter((e) => e.provenFlowsOmitted || e.inputsOmitted || e.sinksOmitted).length;
+  if (proven > 0) parts.push(`${proven} proven flow(s)`);
+  const inputs = doc.endpoints.reduce((n, e) => n + (e.inputsOmitted ?? 0), 0);
+  const sinks = doc.endpoints.reduce((n, e) => n + (e.sinksOmitted ?? 0), 0);
+  if (inputs > 0) parts.push(`${inputs} input(s)`);
+  if (sinks > 0) parts.push(`${sinks} sink(s)`);
+  if (doc.coverage.apiInvocationsOmitted) parts.push(`${doc.coverage.apiInvocationsOmitted} API invocation(s)`);
+  if (doc.coverage.importCoverageGaps?.omittedForSize) parts.push(`${doc.coverage.importCoverageGaps.omittedForSize} import(s)`);
+  if (doc.coverage.endpointsOmitted) parts.push(`${doc.coverage.endpointsOmitted} endpoint(s)`);
+  const links = doc.endpoints.filter((e) => e.dependencyInputFlowsTruncated).length;
+  if (parts.length === 0) return doc;
+  return {
+    ...doc,
+    coverage: {
+      ...doc.coverage,
+      notes: [...doc.coverage.notes, `To stay within the size the Patchstack API accepts, this map left out ${parts.join(", ")}${marked > 0 ? ` (${marked} endpoint(s) marked provenFlowsOmitted, inputsOmitted or sinksOmitted)` : ""}${links > 0 ? `; ${links} endpoint(s) have dependencyInputFlowsTruncated` : ""}. What is listed is true; what was left out is unknown, not absent.`]
+    }
+  };
+}
+
 // src/map/module-graph.ts
 import { readFileSync as readFileSync14, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
 import { dirname as dirname8, join as join16, relative as relative5, resolve as resolvePath } from "path";
@@ -9221,7 +9449,7 @@ async function extractInputMap(cwd, ts, options = {}) {
   notes.push(deploymentShapes.length === 0 ? "`deploymentShapes` is EMPTY: no deployment artifact was recognized. That is not evidence the app has no server-side runtime \u2014 a serverless handler this analysis cannot parse produces no endpoint and looks identical to an app that has none, and entry-point recognition has no completeness flag (coverage.importsComplete covers the import inventory only). A definitive answer needs deployment or build attestation, which source analysis cannot supply." : `\`deploymentShapes\` records ${deploymentShapes.length} deployment artifact(s) the project declares (${deploymentShapes.map((s) => s.shape).join(", ")}). POSITIVE EVIDENCE ONLY, and findings differ in strength: only \`runtime-entry\` (a worker entry, or a provider function directory with source) shows something that serves. \`deployment-config\` means the project deploys to a platform \u2014 a static site on Netlify has a \`netlify.toml\` \u2014 and \`layout\` (a root \`api/\` or \`functions/\` folder) is an ordinary application folder. Neither may on its own be read as a server runtime.`);
   const serverSurface = classifyServerSurface(cwd, endpoints.length, deploymentShapes, ts);
   notes.push(surfaceNote(serverSurface));
-  return {
+  return budgetDocument({
     version: 3,
     framework: detectFramework(cwd),
     deploymentShapes,
@@ -9261,7 +9489,7 @@ async function extractInputMap(cwd, ts, options = {}) {
       roots: ["."],
       notes
     }
-  };
+  });
 }
 
 // src/map/index.ts
@@ -9562,6 +9790,11 @@ async function runMap(flags) {
     console.log(json);
   }
   if (flags.get("upload") === true) {
+    const problems = ingestProblems(map);
+    if (problems.length > 0) {
+      console.error(`patchstack: did not upload the attack surface \u2014 it cannot be fitted to the size Patchstack accepts (${problems.join("; ")}).`);
+      return 0;
+    }
     if (map.endpoints.length === 0) {
       console.error(
         "patchstack: no server entry points were recognized \u2014 uploading the import inventory and coverage notes anyway, so a vulnerability can still be judged imported or not. Nothing here can decide whether a request reaches it."