autoremediator 0.21.2 → 0.22.0

package/dist/api/diet/scan.js

@@ -0,0 +1,357 @@
+import { parseSync } from "oxc-parser";
+import { toRootPackageName } from "../../remediation/tools/check-reachability.js";
+import { collectPackageFiles, readText } from "./files.js";
+export function emptyUsage() {
+    return {
+        references: new Map(),
+        mentions: new Map(),
+        tokens: new Map(),
+        dynamicLoadFiles: [],
+        unparsedFiles: [],
+        sourceFiles: 0,
+        configFiles: 0,
+    };
+}
+const MAX_EVIDENCE_FILES = 5;
+const isNode = (value) => typeof value === "object" &&
+    value !== null &&
+    typeof value.type === "string";
+/** `require("x")`, `import("x")` and `import "x"` all name their module with a static string. */
+function staticSpecifier(node) {
+    if (!isNode(node))
+        return undefined;
+    if (node.type === "Literal" && typeof node.value === "string")
+        return node.value;
+    if (node.type === "TemplateLiteral") {
+        const quasis = node.quasis;
+        const expressions = node.expressions;
+        if (quasis?.length === 1 && (expressions?.length ?? 0) === 0)
+            return quasis[0]?.value?.cooked ?? undefined;
+    }
+    return undefined;
+}
+/** A computed specifier that starts with `.` or `/` loads a project file, not a dependency. */
+function looksRelative(node) {
+    if (!isNode(node))
+        return false;
+    if (node.type === "TemplateLiteral") {
+        const first = node.quasis?.[0]?.value?.cooked ?? "";
+        return first.startsWith(".") || first.startsWith("/");
+    }
+    if (node.type === "BinaryExpression")
+        return looksRelative(node.left);
+    if (node.type === "Literal")
+        return typeof node.value === "string" && /^[./]/.test(node.value);
+    return false;
+}
+const isDependencySpecifier = (specifier) => specifier.length > 0 &&
+    !/^[./#]/.test(specifier) &&
+    !/^[a-z]+:/i.test(specifier) &&
+    !specifier.includes(" ");
+function addReference(usage, specifier, kind, symbols, file) {
+    if (!isDependencySpecifier(specifier))
+        return;
+    const name = toRootPackageName(specifier);
+    let reference = usage.references.get(name);
+    if (!reference) {
+        reference = { kinds: new Set(), symbols: new Set(), files: [] };
+        usage.references.set(name, reference);
+    }
+    reference.kinds.add(kind);
+    for (const symbol of symbols)
+        reference.symbols.add(symbol);
+    if (reference.files.length < MAX_EVIDENCE_FILES && !reference.files.includes(file))
+        reference.files.push(file);
+}
+function addMention(usage, name, file) {
+    const files = usage.mentions.get(name) ?? [];
+    if (files.length < MAX_EVIDENCE_FILES && !files.includes(file))
+        files.push(file);
+    usage.mentions.set(name, files);
+}
+/** Names in `import { a as b, default as c, "string name" as d }`. */
+function importedSymbols(specifiers) {
+    if (!Array.isArray(specifiers))
+        return [];
+    const symbols = [];
+    for (const specifier of specifiers) {
+        if (!isNode(specifier))
+            continue;
+        if (specifier.type === "ImportDefaultSpecifier")
+            symbols.push("default");
+        else if (specifier.type === "ImportNamespaceSpecifier")
+            symbols.push("*");
+        else if (specifier.type === "ImportSpecifier") {
+            const imported = specifier.imported;
+            symbols.push(imported?.name ?? imported?.value ?? "*");
+        }
+    }
+    return symbols;
+}
+/** Keys of `const { a, b: c, ...rest } = require("x")`; `*` when the pattern takes everything. */
+function patternSymbols(pattern) {
+    if (!isNode(pattern) || pattern.type !== "ObjectPattern")
+        return ["*"];
+    const symbols = [];
+    for (const property of pattern.properties ?? []) {
+        if (!isNode(property) || property.type !== "Property")
+            return ["*"];
+        const key = property.key;
+        const name = key?.name ?? key?.value;
+        if (property.computed || !name)
+            return ["*"];
+        symbols.push(name);
+    }
+    return symbols.length > 0 ? symbols : ["*"];
+}
+function propertyName(member) {
+    const property = member.property;
+    if (member.computed && !property?.value)
+        return undefined;
+    return property?.name ?? property?.value;
+}
+const isRequireCall = (node) => isNode(node) &&
+    node.type === "CallExpression" &&
+    isNode(node.callee) &&
+    node.callee.type === "Identifier" &&
+    node.callee.name === "require";
+const isRequireResolve = (callee) => isNode(callee) &&
+    callee.type === "MemberExpression" &&
+    isNode(callee.object) &&
+    callee.object.type === "Identifier" &&
+    callee.object.name === "require" &&
+    propertyName(callee) === "resolve";
+const isImportMetaResolve = (callee) => isNode(callee) &&
+    callee.type === "MemberExpression" &&
+    isNode(callee.object) &&
+    callee.object.type === "MetaProperty" &&
+    propertyName(callee) === "resolve";
+/**
+ * Parse one JavaScript or TypeScript file and record every way it can name a dependency. The
+ * `interesting` set is the declared dependency names, so only those strings are kept as mentions.
+ */
+export function scanSource(usage, path, content, interesting, filename = path) {
+    let program;
+    let failed = false;
+    try {
+        const result = parseSync(filename, content);
+        failed = result.errors.some((error) => error.severity === "Error");
+        program = result.program;
+    }
+    catch {
+        usage.unparsedFiles.push(path);
+        textMentions(usage, path, content, interesting);
+        return;
+    }
+    if (failed) {
+        // A partial tree can miss imports, so also search the raw text.
+        usage.unparsedFiles.push(path);
+        textMentions(usage, path, content, interesting);
+    }
+    /** Call nodes whose symbols were read from their parent, so the generic visit skips them. */
+    const handled = new WeakSet();
+    let dynamic = false;
+    const loadSymbols = (call, kind, symbols) => {
+        handled.add(call);
+        const specifier = staticSpecifier(call.arguments?.[0] ?? call.source);
+        if (specifier === undefined)
+            return;
+        addReference(usage, specifier, kind, symbols, path);
+    };
+    const visit = (node) => {
+        if (Array.isArray(node)) {
+            for (const child of node)
+                visit(child);
+            return;
+        }
+        if (!isNode(node))
+            return;
+        switch (node.type) {
+            case "ImportDeclaration": {
+                const specifier = staticSpecifier(node.source);
+                if (specifier !== undefined) {
+                    const typeOnly = node.importKind === "type";
+                    addReference(usage, specifier, typeOnly ? "type-import" : "import", importedSymbols(node.specifiers), path);
+                }
+                break;
+            }
+            case "ExportAllDeclaration":
+            case "ExportNamedDeclaration": {
+                const specifier = staticSpecifier(node.source);
+                if (specifier !== undefined) {
+                    const names = node.type === "ExportAllDeclaration"
+                        ? ["*"]
+                        : (node.specifiers ?? []).map((entry) => entry.local?.name ?? entry.local?.value ?? "*");
+                    addReference(usage, specifier, node.exportKind === "type" ? "type-import" : "import", names, path);
+                }
+                break;
+            }
+            case "TSImportEqualsDeclaration": {
+                const reference = node.moduleReference;
+                const specifier = staticSpecifier(reference?.expression);
+                if (specifier !== undefined)
+                    addReference(usage, specifier, "require", ["*"], path);
+                break;
+            }
+            case "TSImportType": {
+                const specifier = staticSpecifier(node.source ?? node.argument);
+                if (specifier !== undefined)
+                    addReference(usage, specifier, "type-import", ["*"], path);
+                break;
+            }
+            case "ImportExpression": {
+                if (!handled.has(node)) {
+                    const specifier = staticSpecifier(node.source);
+                    if (specifier === undefined) {
+                        if (!looksRelative(node.source))
+                            dynamic = true;
+                    }
+                    else
+                        addReference(usage, specifier, "dynamic-import", ["*"], path);
+                }
+                break;
+            }
+            case "VariableDeclarator": {
+                // const { a } = require("x"), const x = require("x"), const { a } = await import("x")
+                const init = isNode(node.init) && node.init.type === "AwaitExpression"
+                    ? node.init.argument
+                    : node.init;
+                if (isRequireCall(init))
+                    loadSymbols(init, "require", patternSymbols(node.id));
+                else if (isNode(init) && init.type === "ImportExpression") {
+                    handled.add(init);
+                    const specifier = staticSpecifier(init.source);
+                    if (specifier !== undefined)
+                        addReference(usage, specifier, "dynamic-import", patternSymbols(node.id), path);
+                    else if (!looksRelative(init.source))
+                        dynamic = true;
+                }
+                break;
+            }
+            case "MemberExpression": {
+                // require("x").thing
+                if (isRequireCall(node.object)) {
+                    const name = propertyName(node);
+                    loadSymbols(node.object, "require", [name ?? "*"]);
+                }
+                break;
+            }
+            case "CallExpression": {
+                if (isRequireCall(node) && !handled.has(node)) {
+                    const argument = node.arguments?.[0];
+                    const specifier = staticSpecifier(argument);
+                    if (specifier === undefined) {
+                        if (!looksRelative(argument))
+                            dynamic = true;
+                    }
+                    else
+                        addReference(usage, specifier, "require", ["*"], path);
+                }
+                else if (isRequireResolve(node.callee) || isImportMetaResolve(node.callee)) {
+                    const argument = node.arguments?.[0];
+                    const specifier = staticSpecifier(argument);
+                    if (specifier === undefined) {
+                        if (!looksRelative(argument))
+                            dynamic = true;
+                    }
+                    else
+                        addReference(usage, specifier, "resolve", ["*"], path);
+                }
+                break;
+            }
+            case "Literal": {
+                if (typeof node.value === "string" &&
+                    node.value.length < 214 &&
+                    isDependencySpecifier(node.value)) {
+                    const name = toRootPackageName(node.value);
+                    if (interesting.has(name))
+                        addMention(usage, name, path);
+                }
+                break;
+            }
+            default: {
+                break;
+            }
+        }
+        for (const key of Object.keys(node)) {
+            if (key === "parent" || key === "start" || key === "end")
+                continue;
+            const value = node[key];
+            if (value && typeof value === "object")
+                visit(value);
+        }
+    };
+    visit(program);
+    if (dynamic)
+        usage.dynamicLoadFiles.push(path);
+    // `/// <reference types="x" />` and the JSX pragma live in comments, which the tree does not hold.
+    for (const match of content.matchAll(/\/\/\/\s*<reference\s+types\s*=\s*["']([^"']+)["']/g)) {
+        if (match[1])
+            addReference(usage, match[1], "reference", ["*"], path);
+    }
+    for (const match of content.matchAll(/@jsxImportSource\s+(\S+)/g)) {
+        if (match[1])
+            addReference(usage, match[1], "import", ["*"], path);
+    }
+}
+/** Any quoted occurrence of a declared package name in raw text. */
+export function textMentions(usage, path, text, interesting) {
+    for (const name of interesting) {
+        if (!text.includes(name))
+            continue;
+        const escaped = name.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+        if (new RegExp(`["'\`]${escaped}(?:["'\`/@]|$)`).test(text))
+            addMention(usage, name, path);
+    }
+}
+/** Word-like tokens of a config, CI or script text, normalised the way a shell or loader would read them. */
+export function tokensOf(text) {
+    const tokens = new Set();
+    for (const raw of text.match(/[@\w.~/:+-]+/g) ?? []) {
+        let token = raw
+            .replace(/^(\.\/)?(node_modules\/(\.bin\/)?)+/, "")
+            .replaceAll(/^[.:+-]+|[.:+-]+$/g, "");
+        if (token.startsWith("plugin:") || token.startsWith("npm:"))
+            token = token.slice(token.indexOf(":") + 1);
+        if (!token || /^[./]/.test(token) || token.length > 214)
+            continue;
+        tokens.add(token);
+        // npx name@version
+        const at = token.lastIndexOf("@");
+        if (at > 0)
+            tokens.add(token.slice(0, at));
+    }
+    return [...tokens];
+}
+/** Scan every file of one package directory into `usage`. */
+export function scanPackage(packageDir, interesting, options = {}, into = emptyUsage()) {
+    const files = collectPackageFiles(packageDir, options);
+    for (const skipped of files.skipped)
+        into.unparsedFiles.push(`${skipped} (too large to read)`);
+    for (const file of files.files) {
+        const text = readText(file.absolute);
+        if (text === undefined) {
+            into.unparsedFiles.push(file.path);
+            continue;
+        }
+        if (file.role === "source" || file.parse) {
+            into.sourceFiles += file.role === "source" ? 1 : 0;
+            if (file.parse)
+                scanSource(into, file.path, text, interesting, file.absolute);
+        }
+        else if (file.role === "template") {
+            into.sourceFiles += 1;
+            textMentions(into, file.path, text, interesting);
+        }
+        if (file.role === "script")
+            into.sourceFiles += 1;
+        if (file.role === "config" || file.role === "script") {
+            into.configFiles += 1;
+            for (const token of tokensOf(text))
+                if (!into.tokens.has(token))
+                    into.tokens.set(token, file.path);
+        }
+    }
+    return { usage: into, files };
+}
+//# sourceMappingURL=scan.js.map

package/dist/api/diet/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/api/diet/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAqB,MAAM,YAAY,CAAC;AAkC9E,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,UAAU,EAAE,IAAI,GAAG,EAAE;QACrB,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,MAAM,EAAE,IAAI,GAAG,EAAE;QACjB,gBAAgB,EAAE,EAAE;QACpB,aAAa,EAAE,EAAE;QACjB,WAAW,EAAE,CAAC;QACd,WAAW,EAAE,CAAC;KACf,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAO7B,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoB,EAAE,CAClD,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAEzD,iGAAiG;AACjG,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACjF,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAuD,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,WAAoC,CAAC;QAC9D,IAAI,MAAM,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;YAC1D,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,SAAS,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,KAAK,GACR,IAAI,CAAC,MAAwD,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;QAC3F,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,qBAAqB,GAAG,CAAC,SAAiB,EAAW,EAAE,CAC3D,SAAS,CAAC,MAAM,GAAG,CAAC;IACpB,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;IACzB,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;IAC5B,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAE3B,SAAS,YAAY,CACnB,KAAmB,EACnB,SAAiB,EACjB,IAAmB,EACnB,OAAyB,EACzB,IAAY;IAEZ,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;QAAE,OAAO;IAC9C,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAChE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IACD,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,kBAAkB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChF,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,KAAmB,EAAE,IAAY,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjF,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,sEAAsE;AACtE,SAAS,eAAe,CAAC,UAAmB;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,SAAS;QACjC,IAAI,SAAS,CAAC,IAAI,KAAK,wBAAwB;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;aACpE,IAAI,SAAS,CAAC,IAAI,KAAK,0BAA0B;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aACrE,IAAI,SAAS,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAyD,CAAC;YACrF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,QAAQ,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kGAAkG;AAClG,SAAS,cAAc,CAAC,OAAgB;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACvE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAK,OAAO,CAAC,UAAoC,IAAI,EAAE,EAAE,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAoD,CAAC;QAC1E,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,GAAG,EAAE,KAAK,CAAC;QACrC,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAyD,CAAC;IAClF,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,KAAK;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,QAAQ,EAAE,IAAI,IAAI,QAAQ,EAAE,KAAK,CAAC;AAC3C,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,IAAa,EAAmB,EAAE,CACvD,MAAM,CAAC,IAAI,CAAC;IACZ,IAAI,CAAC,IAAI,KAAK,gBAAgB;IAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;IACnB,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;IACjC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;AAEjC,MAAM,gBAAgB,GAAG,CAAC,MAAe,EAAW,EAAE,CACpD,MAAM,CAAC,MAAM,CAAC;IACd,MAAM,CAAC,IAAI,KAAK,kBAAkB;IAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACrB,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;IACnC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;IAChC,YAAY,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC;AAErC,MAAM,mBAAmB,GAAG,CAAC,MAAe,EAAW,EAAE,CACvD,MAAM,CAAC,MAAM,CAAC;IACd,MAAM,CAAC,IAAI,KAAK,kBAAkB;IAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACrB,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc;IACrC,YAAY,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,KAAmB,EACnB,IAAY,EACZ,OAAe,EACf,WAAgC,EAChC,QAAQ,GAAW,IAAI;IAEvB,IAAI,OAAgB,CAAC;IACrB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAE,KAAK,CAAC,QAAoB,KAAK,OAAO,CAAC,CAAC;QAChF,OAAO,GAAG,MAAM,CAAC,OAA6B,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,gEAAgE;QAChE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,6FAA6F;IAC7F,MAAM,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,IAAmB,EAAE,OAAiB,EAAQ,EAAE;QAClF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,SAAS,GAAG,eAAe,CAC9B,IAAI,CAAC,SAAmC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAC9D,CAAC;QACF,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO;QACpC,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,KAAK,IAAI,IAAI;gBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO;QAE1B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,mBAAmB,EAAE,CAAC;gBACzB,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC;oBAC5C,YAAY,CACV,KAAK,EACL,SAAS,EACT,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EACnC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAChC,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,sBAAsB,CAAC;YAC5B,KAAK,wBAAwB,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC5B,MAAM,KAAK,GACT,IAAI,CAAC,IAAI,KAAK,sBAAsB;wBAClC,CAAC,CAAC,CAAC,GAAG,CAAC;wBACP,CAAC,CAAC,CACG,IAAI,CAAC,UAEQ,IAAI,EAAE,CACrB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC;oBACvE,YAAY,CACV,KAAK,EACL,SAAS,EACT,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EACrD,KAAK,EACL,IAAI,CACL,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,2BAA2B,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAsC,CAAC;gBAC9D,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;gBACzD,IAAI,SAAS,KAAK,SAAS;oBAAE,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;gBACpF,MAAM;YACR,CAAC;YACD,KAAK,cAAc,EAAE,CAAC;gBACpB,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAChE,IAAI,SAAS,KAAK,SAAS;oBAAE,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;gBACxF,MAAM;YACR,CAAC;YACD,KAAK,kBAAkB,EAAE,CAAC;gBACxB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;4BAAE,OAAO,GAAG,IAAI,CAAC;oBAClD,CAAC;;wBAAM,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;gBACvE,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,oBAAoB,EAAE,CAAC;gBAC1B,sFAAsF;gBACtF,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,iBAAiB;oBACvD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ;oBACpB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChB,IAAI,aAAa,CAAC,IAAI,CAAC;oBAAE,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;qBAC1E,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAClB,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC/C,IAAI,SAAS,KAAK,SAAS;wBACzB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;yBAC7E,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;wBAAE,OAAO,GAAG,IAAI,CAAC;gBACvD,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,kBAAkB,EAAE,CAAC;gBACxB,qBAAqB;gBACrB,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;oBAChC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;gBACrD,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,gBAAgB,EAAE,CAAC;gBACtB,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9C,MAAM,QAAQ,GAAI,IAAI,CAAC,SAAmC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAChE,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;oBAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;4BAAE,OAAO,GAAG,IAAI,CAAC;oBAC/C,CAAC;;wBAAM,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;gBAChE,CAAC;qBAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7E,MAAM,QAAQ,GAAI,IAAI,CAAC,SAAmC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAChE,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;oBAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;4BAAE,OAAO,GAAG,IAAI,CAAC;oBAC/C,CAAC;;wBAAM,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;gBAChE,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBACf,IACE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;oBAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;oBACvB,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;oBACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC3C,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM;YACR,CAAC;YACD,SAAS,CAAC;gBACR,MAAM;YACR,CAAC;QACH,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK;gBAAE,SAAS;YACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,CAAC;IAEf,IAAI,OAAO;QAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/C,mGAAmG;IACnG,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,qDAAqD,CAAC,EAAE,CAAC;QAC5F,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAClE,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAC1B,KAAmB,EACnB,IAAY,EACZ,IAAY,EACZ,WAAgC;IAEhC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC,CAAC;QACxE,IAAI,IAAI,MAAM,CAAC,SAAS,OAAO,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,KAAK,GAAG,GAAG;aACZ,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC;aAClD,UAAU,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YACzD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,SAAS;QAClE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,mBAAmB;QACnB,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,EAAE,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CACzB,UAAkB,EAClB,WAAgC,EAChC,OAAO,GAAqF,EAAE,EAC9F,IAAI,GAAiB,UAAU,EAAE;IAEjC,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACvD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,OAAO;QAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,OAAO,sBAAsB,CAAC,CAAC;IAE/F,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,IAAI,CAAC,KAAK;gBAAE,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChF,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;YACtB,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC"}

package/dist/api/diet/surface.d.ts

@@ -0,0 +1,32 @@
+import type { LockGraph } from "./lockfile.js";
+import type { AttackSurface } from "./types.js";
+/** Packages that run code when installed, and ones marked deprecated, read from what is installed. */
+export declare function inspectInstalled(graph: LockGraph): {
+    installScriptPackages: string[];
+    deprecatedPackages: string[];
+    manifestsRead: number;
+};
+export interface SurfaceInputs {
+    installedPackages: number;
+    directDependencies: number;
+    maxDepth: number;
+    installScriptPackages: string[];
+    deprecatedPackages: string[];
+    manifestsRead: number;
+    certainlyUnused: number;
+    probablyUnused: number;
+    replaceable: number;
+    extraCopies: number;
+    /** Why parts of the lockfile-derived numbers are missing. */
+    lockfileNote?: string;
+    /** The packages' installed manifests are missing, so install scripts could only come from the lockfile. */
+    installedMissing: boolean;
+}
+/**
+ * The attack-surface score, written out. Each component is a count turned into points by a stated
+ * rule, capped; the score is their sum, 0 to 100. Higher means more code you did not write runs in
+ * your project. It ranks a project against its own past, not against a threshold: it is not a
+ * probability of compromise.
+ */
+export declare function attackSurface(input: SurfaceInputs): AttackSurface;
+//# sourceMappingURL=surface.d.ts.map

package/dist/api/diet/surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../../../src/api/diet/surface.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAoB,MAAM,YAAY,CAAC;AAKlE,sGAAsG;AACtG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG;IAClD,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;CACvB,CA6BA;AAED,MAAM,WAAW,aAAa;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAID;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CA8FjE"}

package/dist/api/diet/surface.js

@@ -0,0 +1,130 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { readManifest } from "./unused.js";
+const INSTALL_SCRIPTS = ["preinstall", "install", "postinstall"];
+/** Packages that run code when installed, and ones marked deprecated, read from what is installed. */
+export function inspectInstalled(graph) {
+    const installScriptPackages = [];
+    const deprecatedPackages = [];
+    let manifestsRead = 0;
+    for (const node of graph.nodes.values()) {
+        let hasScript = node.hasInstallScript === true;
+        let deprecated = node.deprecated;
+        for (const file of node.manifestFiles) {
+            const manifest = readManifest(file);
+            if (!manifest)
+                continue;
+            manifestsRead += 1;
+            const scripts = manifest.scripts ?? {};
+            // npm also runs `node-gyp rebuild` for a package with a binding.gyp and no install script.
+            hasScript =
+                INSTALL_SCRIPTS.some((name) => typeof scripts[name] === "string") ||
+                    existsSync(join(dirname(file), "binding.gyp")) ||
+                    hasScript;
+            if (typeof manifest.deprecated === "string")
+                deprecated = manifest.deprecated;
+            break;
+        }
+        if (hasScript)
+            installScriptPackages.push(node.id);
+        if (deprecated)
+            deprecatedPackages.push(node.id);
+    }
+    return {
+        installScriptPackages: installScriptPackages.toSorted(),
+        deprecatedPackages: deprecatedPackages.toSorted(),
+        manifestsRead,
+    };
+}
+const round = (value) => Math.round(value * 10) / 10;
+/**
+ * The attack-surface score, written out. Each component is a count turned into points by a stated
+ * rule, capped; the score is their sum, 0 to 100. Higher means more code you did not write runs in
+ * your project. It ranks a project against its own past, not against a threshold: it is not a
+ * probability of compromise.
+ */
+export function attackSurface(input) {
+    const size = round(30 * Math.min(1, Math.log(1 + input.installedPackages) / Math.log(1 + 2000)));
+    const depth = round(10 * Math.min(1, Math.max(0, input.maxDepth - 1) / 9));
+    const scripts = Math.min(20, 2 * input.installScriptPackages.length);
+    const deprecated = Math.min(15, 2.5 * input.deprecatedPackages.length);
+    const wasteValue = 1.5 * input.certainlyUnused + 0.5 * input.probablyUnused + input.replaceable;
+    const waste = Math.min(15, wasteValue);
+    const duplicates = Math.min(10, 0.5 * input.extraCopies);
+    const components = [
+        {
+            id: "size",
+            label: "Installed packages",
+            value: input.installedPackages,
+            points: size,
+            maxPoints: 30,
+            formula: "30 * min(1, ln(1 + packages) / ln(2001)); reaches 30 at 2000 packages",
+        },
+        {
+            id: "depth",
+            label: "Dependency depth",
+            value: input.maxDepth,
+            points: depth,
+            maxPoints: 10,
+            formula: "10 * min(1, (depth - 1) / 9); depth is the longest shortest path from the project, in hops; reaches 10 at depth 10",
+        },
+        {
+            id: "install-scripts",
+            label: "Packages with install scripts",
+            value: input.installScriptPackages.length,
+            points: scripts,
+            maxPoints: 20,
+            formula: "2 per package that runs preinstall, install or postinstall code, up to 20",
+        },
+        {
+            id: "deprecated",
+            label: "Deprecated packages",
+            value: input.deprecatedPackages.length,
+            points: deprecated,
+            maxPoints: 15,
+            formula: "2.5 per package the lockfile marks deprecated, up to 15",
+        },
+        {
+            id: "waste",
+            label: "Unused and replaceable dependencies",
+            value: round(wasteValue),
+            points: round(waste),
+            maxPoints: 15,
+            formula: "1.5 per certainly-unused + 0.5 per probably-unused + 1 per replaceable dependency, up to 15",
+        },
+        {
+            id: "duplicates",
+            label: "Extra installed copies",
+            value: input.extraCopies,
+            points: duplicates,
+            maxPoints: 10,
+            formula: "0.5 per version beyond the first of a duplicated package, up to 10",
+        },
+    ];
+    const limits = [];
+    if (input.lockfileNote)
+        limits.push(`${input.lockfileNote}; package count, depth, install scripts, deprecations and copies are not counted, so the score is a lower bound`);
+    else if (input.installedMissing) {
+        limits.push(`only ${input.manifestsRead} of ${input.installedPackages} installed package.json files could be read (the rest are not installed here, such as optional packages for other platforms), so install scripts for those come only from lockfile flags and may be undercounted`);
+    }
+    limits.push("unmaintained packages are not detected: that needs registry data, and only the lockfile's deprecation flag is read");
+    return {
+        score: Math.round(components.reduce((total, component) => total + component.points, 0)),
+        formulaVersion: 1,
+        components,
+        facts: {
+            installedPackages: input.installedPackages,
+            directDependencies: input.directDependencies,
+            maxDepth: input.maxDepth,
+            installScriptPackages: input.installScriptPackages,
+            deprecatedPackages: input.deprecatedPackages,
+            certainlyUnused: input.certainlyUnused,
+            probablyUnused: input.probablyUnused,
+            replaceable: input.replaceable,
+            extraCopies: input.extraCopies,
+            manifestsRead: input.manifestsRead,
+        },
+        limits,
+    };
+}
+//# sourceMappingURL=surface.js.map

package/dist/api/diet/surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../../../src/api/diet/surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAI1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAU,CAAC;AAE1E,sGAAsG;AACtG,MAAM,UAAU,gBAAgB,CAAC,KAAgB;IAK/C,MAAM,qBAAqB,GAAa,EAAE,CAAC;IAC3C,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,SAAS,GAAG,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC;QAC/C,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,aAAa,IAAI,CAAC,CAAC;YACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;YACvC,2FAA2F;YAC3F,SAAS;gBACP,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC;oBACjE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;oBAC9C,SAAS,CAAC;YACZ,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;gBAAE,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;YAC9E,MAAM;QACR,CAAC;QACD,IAAI,SAAS;YAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,UAAU;YAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO;QACL,qBAAqB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;QACvD,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;QACjD,aAAa;KACd,CAAC;AACJ,CAAC;AAmBD,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AAErE;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,GAAG,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,GAAG,GAAG,KAAK,CAAC,eAAe,GAAG,GAAG,GAAG,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,WAAW,CAAC;IAChG,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IAEzD,MAAM,UAAU,GAAuB;QACrC;YACE,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,oBAAoB;YAC3B,KAAK,EAAE,KAAK,CAAC,iBAAiB;YAC9B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,uEAAuE;SACjF;QACD;YACE,EAAE,EAAE,OAAO;YACX,KAAK,EAAE,kBAAkB;YACzB,KAAK,EAAE,KAAK,CAAC,QAAQ;YACrB,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,EAAE;YACb,OAAO,EACL,oHAAoH;SACvH;QACD;YACE,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,+BAA+B;YACtC,KAAK,EAAE,KAAK,CAAC,qBAAqB,CAAC,MAAM;YACzC,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,2EAA2E;SACrF;QACD;YACE,EAAE,EAAE,YAAY;YAChB,KAAK,EAAE,qBAAqB;YAC5B,KAAK,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM;YACtC,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,yDAAyD;SACnE;QACD;YACE,EAAE,EAAE,OAAO;YACX,KAAK,EAAE,qCAAqC;YAC5C,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC;YACxB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;YACpB,SAAS,EAAE,EAAE;YACb,OAAO,EACL,6FAA6F;SAChG;QACD;YACE,EAAE,EAAE,YAAY;YAChB,KAAK,EAAE,wBAAwB;YAC/B,KAAK,EAAE,KAAK,CAAC,WAAW;YACxB,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,oEAAoE;SAC9E;KACF,CAAC;IAEF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,YAAY;QACpB,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,CAAC,YAAY,iHAAiH,CACvI,CAAC;SACC,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CACT,QAAQ,KAAK,CAAC,aAAa,OAAO,KAAK,CAAC,iBAAiB,kNAAkN,CAC5Q,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CACT,oHAAoH,CACrH,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvF,cAAc,EAAE,CAAC;QACjB,UAAU;QACV,KAAK,EAAE;YACL,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC;QACD,MAAM;KACP,CAAC;AACJ,CAAC"}