@vltpkg/security-archive 0.0.0-8 → 0.0.0-9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/esm/types.d.ts +34 -4
- package/dist/esm/types.d.ts.map +1 -1
- package/dist/esm/types.js +1 -0
- package/dist/esm/types.js.map +1 -1
- package/package.json +7 -7
package/dist/esm/types.d.ts
CHANGED
|
@@ -33,8 +33,8 @@ export declare const asSecurityArchiveLike: (o: unknown) => SecurityArchiveLike;
|
|
|
33
33
|
*/
|
|
34
34
|
export type PackageAlertProps = {
|
|
35
35
|
lastPublish: string;
|
|
36
|
-
cveId
|
|
37
|
-
cwes
|
|
36
|
+
cveId?: `CVE-${string}`;
|
|
37
|
+
cwes?: {
|
|
38
38
|
id: `CWE-${string}`;
|
|
39
39
|
}[];
|
|
40
40
|
};
|
|
@@ -44,9 +44,38 @@ export type PackageAlertProps = {
|
|
|
44
44
|
export type PackageAlert = {
|
|
45
45
|
key: string;
|
|
46
46
|
type: string;
|
|
47
|
-
severity: 'low' | '
|
|
47
|
+
severity: 'low' | 'medium' | 'high' | 'critical';
|
|
48
48
|
category: string;
|
|
49
|
-
props
|
|
49
|
+
props?: PackageAlertProps;
|
|
50
|
+
};
|
|
51
|
+
/**
|
|
52
|
+
* The scores for a given package
|
|
53
|
+
*/
|
|
54
|
+
export type PackageScore = {
|
|
55
|
+
/**
|
|
56
|
+
* The average of all score factors. (0-1)
|
|
57
|
+
*/
|
|
58
|
+
overall: number;
|
|
59
|
+
/**
|
|
60
|
+
* Score factors relating to package licensing (0-1)
|
|
61
|
+
*/
|
|
62
|
+
license: number;
|
|
63
|
+
/**
|
|
64
|
+
* Score factors relating to package maintenance (0-1)
|
|
65
|
+
*/
|
|
66
|
+
maintenance: number;
|
|
67
|
+
/**
|
|
68
|
+
* Score factors relating to code quality (0-1)
|
|
69
|
+
*/
|
|
70
|
+
quality: number;
|
|
71
|
+
/**
|
|
72
|
+
* Score factors relating to supply chain security (0-1)
|
|
73
|
+
*/
|
|
74
|
+
supplyChain: number;
|
|
75
|
+
/**
|
|
76
|
+
* Score factors relating to package vulnerabilities (0-1)
|
|
77
|
+
*/
|
|
78
|
+
vulnerability: number;
|
|
50
79
|
};
|
|
51
80
|
/**
|
|
52
81
|
* The report data for a given package.
|
|
@@ -61,6 +90,7 @@ export type PackageReportData = {
|
|
|
61
90
|
version: string;
|
|
62
91
|
license: string;
|
|
63
92
|
alerts: PackageAlert[];
|
|
93
|
+
score: PackageScore;
|
|
64
94
|
};
|
|
65
95
|
export declare const isPackageReportData: (o: unknown) => o is PackageReportData;
|
|
66
96
|
export declare const asPackageReportData: (o: unknown) => PackageReportData;
|
package/dist/esm/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C;;;OAGG;IACH,KAAK,EAAE,SAAS,CAAA;IAChB;;OAEG;IACH,WAAW,EAAE,WAAW,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,iBAAiB,GAAG,SAAS,CAAA;IACpD,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAA;IACpD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;IAC9B,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAA;IAC9B,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,EAAE,CAAC,EAAE,OAAO,CAAA;CACb;AAED,eAAO,MAAM,qBAAqB,MAC7B,OAAO,KACT,CAAC,IAAI,mBAOM,CAAA;AAEd,eAAO,MAAM,qBAAqB,MAC7B,OAAO,KACT,mBAKF,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,OAAO,MAAM,EAAE,CAAA;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C;;;OAGG;IACH,KAAK,EAAE,SAAS,CAAA;IAChB;;OAEG;IACH,WAAW,EAAE,WAAW,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,iBAAiB,GAAG,SAAS,CAAA;IACpD,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAA;IACpD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;IAC9B,GAAG,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAA;IAC9B,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,EAAE,CAAC,EAAE,OAAO,CAAA;CACb;AAED,eAAO,MAAM,qBAAqB,MAC7B,OAAO,KACT,CAAC,IAAI,mBAOM,CAAA;AAEd,eAAO,MAAM,qBAAqB,MAC7B,OAAO,KACT,mBAKF,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,OAAO,MAAM,EAAE,CAAA;IACvB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,MAAM,EAAE,CAAA;KAAE,EAAE,CAAA;CACjC,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;IAChD,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAC1B,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,KAAK,CAAA;IACX,SAAS,CAAC,EAAE,IAAI,MAAM,EAAE,CAAA;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,KAAK,EAAE,YAAY,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,mBAAmB,MAC3B,OAAO,KACT,CAAC,IAAI,iBASU,CAAA;AAElB,eAAO,MAAM,mBAAmB,MAC3B,OAAO,KACT,iBAKF,CAAA"}
|
package/dist/esm/types.js
CHANGED
package/dist/esm/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAgC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,CAAU,EACgB,EAAE,CAC5B,OAAO,CAAC,KAAK,QAAQ;IACrB,CAAC,IAAI,IAAI;IACT,KAAK,IAAI,CAAC;IACV,KAAK,IAAI,CAAC;IACV,QAAQ,IAAI,CAAC;IACb,KAAK,IAAI,CAAC;IACV,OAAO,IAAI,CAAC,CAAA;AAEd,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,CAAU,EACW,EAAE;IACvB,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAgC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,CAAU,EACgB,EAAE,CAC5B,OAAO,CAAC,KAAK,QAAQ;IACrB,CAAC,IAAI,IAAI;IACT,KAAK,IAAI,CAAC;IACV,KAAK,IAAI,CAAC;IACV,QAAQ,IAAI,CAAC;IACb,KAAK,IAAI,CAAC;IACV,OAAO,IAAI,CAAC,CAAA;AAEd,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,CAAU,EACW,EAAE;IACvB,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAoED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,CAAU,EACc,EAAE,CAC1B,OAAO,CAAC,KAAK,QAAQ;IACrB,CAAC,IAAI,IAAI;IACT,IAAI,IAAI,CAAC;IACT,MAAM,IAAI,CAAC;IACX,MAAM,IAAI,CAAC;IACX,SAAS,IAAI,CAAC;IACd,QAAQ,IAAI,CAAC;IACb,OAAO,IAAI,CAAC;IACZ,CAAC,CAAC,IAAI,KAAK,KAAK,CAAA;AAElB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,CAAU,EACS,EAAE;IACrB,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC,CAAA","sourcesContent":["import { error } from '@vltpkg/error-cause'\nimport type { DepID } from '@vltpkg/dep-id'\nimport type { GraphLike } from '@vltpkg/graph'\nimport type { SpecOptions } from '@vltpkg/spec'\n\n/**\n * Parameter options for initializing a security archive.\n */\nexport type SecurityArchiveRefreshOptions = {\n /**\n * A @link{GraphLike} instance to find what packages the\n * security archive should have.\n */\n graph: GraphLike\n /**\n * A @link{SpecOptions} instance to use for resolving dependencies.\n */\n specOptions: SpecOptions\n}\n\n/**\n * An interface for interacting with a security archive.\n */\nexport interface SecurityArchiveLike {\n get: (depId: DepID) => PackageReportData | undefined\n set: (depId: DepID, data: PackageReportData) => void\n delete: (depId: DepID) => void\n has: (depId: DepID) => boolean\n clear: () => void\n ok?: boolean\n}\n\nexport const isSecurityArchiveLike = (\n o: unknown,\n): o is SecurityArchiveLike =>\n typeof o === 'object' &&\n o != null &&\n 'get' in o &&\n 'set' in o &&\n 'delete' in o &&\n 'has' in o &&\n 'clear' in o\n\nexport const asSecurityArchiveLike = (\n o: unknown,\n): SecurityArchiveLike => {\n if (!isSecurityArchiveLike(o)) {\n throw error('Invalid security archive like', { found: o })\n }\n return o\n}\n\n/**\n * Package alert extra information.\n */\nexport type PackageAlertProps = {\n lastPublish: string\n cveId?: `CVE-${string}`\n cwes?: { id: `CWE-${string}` }[]\n}\n\n/**\n * A known alert for a given package.\n */\nexport type PackageAlert = {\n key: string\n type: string\n severity: 'low' | 'medium' | 'high' | 'critical'\n category: string\n props?: PackageAlertProps\n}\n\n/**\n * The scores for a given package\n */\nexport type PackageScore = {\n /**\n * The average of all score factors. (0-1)\n */\n overall: number\n /**\n * Score factors relating to package licensing (0-1)\n */\n license: number\n /**\n * Score factors relating to package maintenance (0-1)\n */\n maintenance: number\n /**\n * Score factors relating to code quality (0-1)\n */\n quality: number\n /**\n * Score factors relating to supply chain security (0-1)\n */\n supplyChain: number\n /**\n * Score factors relating to package vulnerabilities (0-1)\n */\n vulnerability: number\n}\n\n/**\n * The report data for a given package.\n */\nexport type PackageReportData = {\n id: string\n author: string[]\n size: number\n type: 'npm'\n namespace?: `@${string}`\n name: string\n version: string\n license: string\n alerts: PackageAlert[]\n score: PackageScore\n}\n\nexport const isPackageReportData = (\n o: unknown,\n): o is PackageReportData =>\n typeof o === 'object' &&\n o != null &&\n 'id' in o &&\n 'type' in o &&\n 'name' in o &&\n 'version' in o &&\n 'alerts' in o &&\n 'score' in o &&\n o.type === 'npm'\n\nexport const asPackageReportData = (\n o: unknown,\n): PackageReportData => {\n if (!isPackageReportData(o)) {\n throw error('Invalid package report data', { found: o })\n }\n return o\n}\n"]}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vltpkg/security-archive",
|
|
3
3
|
"description": "A database of security information of packages",
|
|
4
|
-
"version": "0.0.0-
|
|
4
|
+
"version": "0.0.0-9",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
7
7
|
"url": "git+https://github.com/vltpkg/vltpkg.git",
|
|
@@ -23,12 +23,12 @@
|
|
|
23
23
|
"lru-cache": "^11.0.2",
|
|
24
24
|
"p-retry": "^6.2.1",
|
|
25
25
|
"package-json-from-dist": "^1.0.0",
|
|
26
|
-
"@vltpkg/dep-id": "0.0.0-
|
|
27
|
-
"@vltpkg/graph": "0.0.0-
|
|
28
|
-
"@vltpkg/spec": "0.0.0-
|
|
29
|
-
"@vltpkg/
|
|
30
|
-
"@vltpkg/
|
|
31
|
-
"@vltpkg/
|
|
26
|
+
"@vltpkg/dep-id": "0.0.0-9",
|
|
27
|
+
"@vltpkg/graph": "0.0.0-9",
|
|
28
|
+
"@vltpkg/spec": "0.0.0-9",
|
|
29
|
+
"@vltpkg/error-cause": "0.0.0-9",
|
|
30
|
+
"@vltpkg/types": "0.0.0-9",
|
|
31
|
+
"@vltpkg/xdg": "0.0.0-9"
|
|
32
32
|
},
|
|
33
33
|
"devDependencies": {
|
|
34
34
|
"@eslint/js": "^9.20.0",
|