autoremediator 0.21.2 → 0.22.0

package/dist/api/maintain/package-files.js

@@ -0,0 +1,156 @@
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import semver from "semver";
+import { DEFAULT_VEX_FILE, resolveVexField } from "../../platform/maintainer-vex/index.js";
+function detectIndent(text) {
+    return /^( +|\t)"/m.exec(text)?.[1] ?? "  ";
+}
+function globToRegExp(pattern) {
+    const source = pattern
+        .replaceAll(/[.+^${}()|[\]\\]/g, String.raw `\$&`)
+        .replaceAll("**", "\u0000")
+        .replaceAll("*", "[^/]*")
+        .replaceAll("?", "[^/]")
+        .replaceAll("\u0000", ".*");
+    return new RegExp(`^${source}$`);
+}
+/** Would npm pack include `path` given the `files` list? Directories include everything under them. */
+export function filesCover(files, path) {
+    for (const entry of files) {
+        if (typeof entry !== "string")
+            continue;
+        const normalized = entry.replace(/^\.\//, "").replace(/\/+$/, "");
+        if (normalized === "" || normalized.startsWith("!"))
+            continue;
+        if (normalized === path || path.startsWith(`${normalized}/`))
+            return true;
+        if (/[*?]/.test(normalized) &&
+            (globToRegExp(normalized).test(path) || globToRegExp(`${normalized}/**`).test(path))) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Declare the VEX file in `package.json` (`vex`) and make sure it ships (`files`). Keeps the
+ * author's key order and indentation, never changes a valid `vex` they already declared, and
+ * refuses a file it cannot parse or a `vex`/`files` that is not what npm expects.
+ */
+export function editPackageJson(existing, defaultPath = DEFAULT_VEX_FILE) {
+    let manifest;
+    try {
+        const parsed = JSON.parse(existing);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            return { conflict: "is not a JSON object, so it was left alone" };
+        }
+        manifest = parsed;
+    }
+    catch {
+        return { conflict: "is not valid JSON, so it was left alone" };
+    }
+    let vexPath = defaultPath;
+    const declared = Object.hasOwn(manifest, "vex");
+    if (declared) {
+        const field = resolveVexField(manifest["vex"]);
+        if ("error" in field)
+            return { conflict: `${field.error}, so it was left alone` };
+        vexPath = field.path;
+    }
+    const files = manifest["files"];
+    if (files !== undefined && !Array.isArray(files)) {
+        return { conflict: 'has a "files" that is not a list, so it was left alone' };
+    }
+    const needsFiles = Array.isArray(files) && !filesCover(files, vexPath);
+    if (declared && !needsFiles)
+        return { content: existing, vexPath };
+    const entries = [];
+    for (const [key, value] of Object.entries(manifest)) {
+        entries.push([key, key === "files" && needsFiles ? [...value, vexPath] : value]);
+        if (key === "files" && !declared)
+            entries.push(["vex", vexPath]);
+    }
+    if (!declared && !entries.some(([key]) => key === "vex"))
+        entries.push(["vex", vexPath]);
+    const trailing = existing.endsWith("\n") ? "\n" : "";
+    return {
+        content: `${JSON.stringify(Object.fromEntries(entries), null, detectIndent(existing))}${trailing}`,
+        vexPath,
+    };
+}
+const BUMP_RANK = { patch: 1, minor: 2, major: 3 };
+/** The highest bump the pending changesets ask for this package; undefined when there are none. */
+export function pendingBump(cwd, packageName) {
+    const directory = join(cwd, ".changeset");
+    let names;
+    try {
+        // Changesets that `maintain` itself wrote are patches by construction and say nothing about the author's plans.
+        names = readdirSync(directory).filter((name) => name.endsWith(".md") && name.toLowerCase() !== "readme.md" && !name.startsWith("maintain-"));
+    }
+    catch {
+        return undefined;
+    }
+    let highest;
+    for (const name of names) {
+        let text;
+        try {
+            text = readFileSync(join(directory, name), "utf8");
+        }
+        catch {
+            continue;
+        }
+        const front = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text)?.[1];
+        if (!front)
+            continue;
+        for (const line of front.split(/\r?\n/)) {
+            const match = /^\s*["']?([^"':]+)["']?\s*:\s*["']?(major|minor|patch)["']?\s*$/.exec(line);
+            if (match?.[1] === packageName) {
+                const bump = match[2];
+                if (highest === undefined || BUMP_RANK[bump] > BUMP_RANK[highest])
+                    highest = bump;
+            }
+        }
+    }
+    return highest;
+}
+/**
+ * The version the next release will carry, which the VEX document must name because consumers only
+ * use statements about the exact version they install. With changesets that is the current version
+ * plus the highest pending bump (at least a patch, which `maintain` adds); without, the next patch.
+ */
+export function nextVersionOf(cwd, packageName, current, override, usesChangesets) {
+    if (override !== undefined) {
+        if (semver.valid(override) !== override) {
+            throw new Error(`nextVersion "${override}" is not an exact semantic version.`);
+        }
+        return { version: override };
+    }
+    if (existsSync(join(cwd, ".changeset", "pre.json"))) {
+        return {
+            note: "Changesets is in pre-release mode, so the next version cannot be predicted: pass --next-version to write the OpenVEX statements.",
+        };
+    }
+    const pending = usesChangesets ? pendingBump(cwd, packageName) : undefined;
+    const bump = pending ?? "patch";
+    const version = semver.inc(current, bump);
+    if (!version)
+        return { note: `Cannot compute the next version from ${current}; pass --next-version.` };
+    const why = pending
+        ? `a ${pending} bump is already pending in .changeset`
+        : `a patch after ${current}`;
+    return {
+        version,
+        note: `Next release assumed to be ${version} (${why}); pass --next-version if that is wrong.`,
+    };
+}
+/** Deterministic changeset file name for a set of advisories, so running again updates the same file. */
+export function changesetName(advisories) {
+    const ids = advisories.toSorted().map((id) => id.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-"));
+    const readable = ids.length <= 2 ? ids.join("-and-") : `${ids[0]}-and-${ids.length - 1}-more`;
+    const digest = createHash("sha256").update(ids.join(",")).digest("hex").slice(0, 6);
+    return `maintain-${readable}-${digest}`.slice(0, 80);
+}
+export function renderChangeset(packageName, lines) {
+    return `---\n"${packageName}": patch\n---\n\n${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=package-files.js.map

package/dist/api/maintain/package-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-files.js","sourceRoot":"","sources":["../../../src/api/maintain/package-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAI3F,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,MAAM,GAAG,OAAO;SACnB,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC;SAChD,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9B,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,UAAU,CAAC,KAAyB,EAAE,IAAY;IAChE,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9D,IAAI,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,IACE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACvB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,GAAG,UAAU,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACpF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,WAAW,GAAW,gBAAgB;IAEtC,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,EAAE,QAAQ,EAAE,4CAA4C,EAAE,CAAC;QACpE,CAAC;QACD,QAAQ,GAAG,MAAiC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,yCAAyC,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,OAAO,GAAG,WAAW,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,IAAI,OAAO,IAAI,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,wBAAwB,EAAE,CAAC;QAClF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,wDAAwD,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,QAAQ,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAEnE,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,GAAI,KAAmB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAChG,IAAI,GAAG,KAAK,OAAO,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,OAAO;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,GAAG,QAAQ,EAAE;QAClG,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAW,CAAC;AAG5D,mGAAmG;AACnG,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,WAAmB;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,gHAAgH;QAChH,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAC9F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAyB,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3F,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAS,CAAC;gBAC9B,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;oBAAE,OAAO,GAAG,IAAI,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,WAAmB,EACnB,OAAe,EACf,QAA4B,EAC5B,cAAuB;IAEvB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,qCAAqC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,kIAAkI;SACzI,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,IAAI,GAAS,OAAO,IAAI,OAAO,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO;QACV,OAAO,EAAE,IAAI,EAAE,wCAAwC,OAAO,wBAAwB,EAAE,CAAC;IAC3F,MAAM,GAAG,GAAG,OAAO;QACjB,CAAC,CAAC,KAAK,OAAO,wCAAwC;QACtD,CAAC,CAAC,iBAAiB,OAAO,EAAE,CAAC;IAC/B,OAAO;QACL,OAAO;QACP,IAAI,EAAE,8BAA8B,OAAO,KAAK,GAAG,0CAA0C;KAC9F,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,aAAa,CAAC,UAA6B;IACzD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC;IAC9F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,YAAY,QAAQ,IAAI,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,KAAwB;IAC3E,OAAO,SAAS,WAAW,oBAAoB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACtE,CAAC"}

package/dist/api/maintain/types.d.ts

@@ -0,0 +1,87 @@
+import type { PackageManager } from "../../platform/types.js";
+import type { InitChangeSummary } from "../init/types.js";
+export type MaintainDecision = 
+/** The advisory's package is only a development dependency (or nothing of this project ships it): nothing to say to consumers. */
+"not-shipped"
+/** The vulnerable code is not in this package's execute path, and the author asserted it. */
+ | "not_affected"
+/** This package reaches the vulnerable dependency. */
+ | "affected"
+/** Reachability could not rule it out, or it was ruled out but not asserted. */
+ | "under_investigation"
+/** The advisory could not be looked up, so nothing was decided. */
+ | "unknown";
+export interface MaintainOptions {
+    /** The package being developed. Default: the current directory. */
+    cwd?: string;
+    /** Advisory ids (CVE-, GHSA-) to assess. Default: the package manager's audit of this project. */
+    advisories?: string[];
+    /**
+     * The author vouches for what static reachability found. Only with this are advisories whose
+     * vulnerable package no source file reaches written as `not_affected`; otherwise `under_investigation`.
+     */
+    assertNotAffected?: boolean;
+    /** A runtime trace (see `trace run`) to add to the static evidence; it can only add reachability. */
+    traceFile?: string;
+    policy?: string;
+    packageManager?: PackageManager;
+    offlineIntelligence?: boolean;
+    intelligenceSnapshotPath?: string;
+    /** The version the next release will have, for the document's product. Default: derived from pending changesets, else the next patch. */
+    nextVersion?: string;
+    /** Write the changes. Without it, only report them. */
+    yes?: boolean;
+    source?: "cli" | "sdk" | "mcp" | "openapi";
+}
+export interface MaintainPackageFinding {
+    name: string;
+    version: string;
+    scope: "production" | "development" | "unreferenced" | "unknown";
+    reachability?: "reachable" | "not-reachable" | "unknown";
+    reason?: string;
+    /** `static`, or `both` when a trace was supplied. */
+    evidenceKind?: string;
+    runtimeVerdict?: string;
+}
+export interface MaintainPlanSummary {
+    runId?: string;
+    planId?: string;
+    /** What the plan would change, never applied by `maintain`. */
+    items: Array<{
+        packageName: string;
+        fromVersion: string;
+        toVersion: string;
+    }>;
+    skipped: number;
+}
+export interface MaintainAdvisory {
+    id: string;
+    severity?: string;
+    decision: MaintainDecision;
+    reason: string;
+    packages: MaintainPackageFinding[];
+    plan?: MaintainPlanSummary;
+}
+export interface MaintainResult {
+    schemaVersion: "1.0";
+    cwd: string;
+    package: {
+        name: string;
+        version: string;
+        private: boolean;
+    };
+    /** The version the VEX statements are written for; absent when it could not be determined. */
+    nextVersion?: string;
+    usesChangesets: boolean;
+    advisories: MaintainAdvisory[];
+    changes: InitChangeSummary[];
+    /** True when at least one file would change (or did). */
+    drift: boolean;
+    /** True when files were written. */
+    applied: boolean;
+    /** Files left alone because they could not be changed safely. */
+    conflicts: string[];
+    /** Things to know: what was skipped and why. */
+    notes: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/api/maintain/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/api/maintain/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,MAAM,gBAAgB;AAC1B,kIAAkI;AAChI,aAAa;AACf,6FAA6F;GAC3F,cAAc;AAChB,sDAAsD;GACpD,UAAU;AACZ,gFAAgF;GAC9E,qBAAqB;AACvB,mEAAmE;GACjE,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,qGAAqG;IACrG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,yIAAyI;IACzI,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,GAAG,aAAa,GAAG,cAAc,GAAG,SAAS,CAAC;IACjE,YAAY,CAAC,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,CAAC;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,KAAK,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,KAAK,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7D,8FAA8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,yDAAyD;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gDAAgD;IAChD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB"}

package/dist/api/maintain/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/api/maintain/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/maintain/types.ts"],"names":[],"mappings":""}

package/dist/api/maintain/vex-file.d.ts

@@ -0,0 +1,33 @@
+/** What `maintain` decided to say about one advisory. */
+export interface DraftStatement {
+    advisory: string;
+    status: "not_affected" | "affected" | "under_investigation";
+    /** The vulnerable dependencies (production) the statement is about. */
+    subcomponents: string[];
+    statusNotes: string;
+    actionStatement?: string;
+}
+export interface VexFileInput {
+    existing: string | undefined;
+    packageName: string;
+    /** The version the next release will have. */
+    version: string;
+    author: string;
+    tooling: string;
+    statements: DraftStatement[];
+    now: Date;
+}
+export type VexFileResult = {
+    content: string;
+    kept: number;
+} | {
+    conflict: string;
+};
+/**
+ * Write or update the project's OpenVEX document for the next release. Statements for other
+ * advisories, other versions and anything the author wrote by hand are kept as they are; a
+ * statement for the same advisory and product is replaced only when what it says changed, so
+ * running again with nothing new leaves the file byte for byte as it was.
+ */
+export declare function mergeVexFile(input: VexFileInput): VexFileResult;
+//# sourceMappingURL=vex-file.d.ts.map

package/dist/api/maintain/vex-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vex-file.d.ts","sourceRoot":"","sources":["../../../src/api/maintain/vex-file.ts"],"names":[],"mappings":"AAUA,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,GAAG,UAAU,GAAG,qBAAqB,CAAC;IAC5D,uEAAuE;IACvE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,GAAG,EAAE,IAAI,CAAC;CACX;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAqDrF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,CA8C/D"}

package/dist/api/maintain/vex-file.js

@@ -0,0 +1,95 @@
+import { randomUUID } from "node:crypto";
+import { OPENVEX_CONTEXT, npmPurl, parseOpenVex, } from "../../platform/maintainer-vex/index.js";
+const productPurl = (name, version) => npmPurl(name, version);
+function buildStatement(draft, input) {
+    const purl = productPurl(input.packageName, input.version);
+    return {
+        "@id": `urn:autoremediator:${input.packageName}@${input.version}:${draft.advisory.toLowerCase()}`,
+        version: 1,
+        vulnerability: { name: draft.advisory },
+        timestamp: input.now.toISOString(),
+        products: [
+            {
+                "@id": purl,
+                identifiers: { purl },
+                subcomponents: draft.subcomponents.toSorted().map((name) => ({
+                    "@id": npmPurl(name),
+                    identifiers: { purl: npmPurl(name) },
+                })),
+            },
+        ],
+        status: draft.status,
+        status_notes: draft.statusNotes,
+        ...(draft.status === "not_affected"
+            ? { justification: "vulnerable_code_not_in_execute_path" }
+            : {}),
+        ...(draft.actionStatement ? { action_statement: draft.actionStatement } : {}),
+        ...(draft.status === "affected" && draft.actionStatement
+            ? { action_statement_timestamp: input.now.toISOString() }
+            : {}),
+    };
+}
+/** The part of a statement that says something, without the bookkeeping that changes on every write. */
+function substance(statement) {
+    const { timestamp: _t, version: _v, last_updated: _l, action_statement_timestamp: _a, ...rest } = statement;
+    return JSON.stringify(rest);
+}
+function isOurs(statement, purl, advisory) {
+    return (statement.vulnerability.name.toUpperCase() === advisory.toUpperCase() &&
+        statement.products.length === 1 &&
+        statement.products[0].identifiers?.purl === purl);
+}
+/**
+ * Write or update the project's OpenVEX document for the next release. Statements for other
+ * advisories, other versions and anything the author wrote by hand are kept as they are; a
+ * statement for the same advisory and product is replaced only when what it says changed, so
+ * running again with nothing new leaves the file byte for byte as it was.
+ */
+export function mergeVexFile(input) {
+    const purl = productPurl(input.packageName, input.version);
+    let document;
+    if (input.existing !== undefined && input.existing.trim() !== "") {
+        const parsed = parseOpenVex(input.existing);
+        if ("error" in parsed)
+            return { conflict: `${parsed.error}, so it was left alone` };
+        document = parsed.document;
+    }
+    const statements = [...(document?.statements ?? [])];
+    let changed = false;
+    for (const draft of input.statements.toSorted((a, b) => a.advisory.localeCompare(b.advisory))) {
+        const fresh = buildStatement(draft, input);
+        const at = statements.findIndex((statement) => isOurs(statement, purl, draft.advisory));
+        if (at === -1) {
+            statements.push(fresh);
+            changed = true;
+            continue;
+        }
+        const current = statements[at];
+        if (substance(current) === substance(fresh))
+            continue;
+        statements[at] = { ...fresh, version: (current.version ?? 0) + 1 };
+        changed = true;
+    }
+    if (document && !changed) {
+        // Nothing to say that is not already said: keep the author's file exactly as written.
+        return { content: input.existing, kept: statements.length };
+    }
+    const next = document
+        ? {
+            ...document,
+            version: document.version + 1,
+            last_updated: input.now.toISOString(),
+            statements,
+        }
+        : {
+            "@context": OPENVEX_CONTEXT,
+            "@id": `urn:uuid:${randomUUID()}`,
+            author: input.author,
+            timestamp: input.now.toISOString(),
+            version: 1,
+            tooling: input.tooling,
+            statements,
+        };
+    return { content: `${JSON.stringify(next, null, 2)}\n`, kept: statements.length };
+}
+//# sourceMappingURL=vex-file.js.map

package/dist/api/maintain/vex-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vex-file.js","sourceRoot":"","sources":["../../../src/api/maintain/vex-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,OAAO,EACP,YAAY,GAGb,MAAM,wCAAwC,CAAC;AAyBhD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAEtF,SAAS,cAAc,CAAC,KAAqB,EAAE,KAAmB;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO;QACL,KAAK,EAAE,sBAAsB,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE;QACjG,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE;QACvC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;QAClC,QAAQ,EAAE;YACR;gBACE,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,EAAE,IAAI,EAAE;gBACrB,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC3D,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC;oBACpB,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;iBACrC,CAAC,CAAC;aACJ;SACF;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,cAAc;YACjC,CAAC,CAAC,EAAE,aAAa,EAAE,qCAA8C,EAAE;YACnE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,eAAe;YACtD,CAAC,CAAC,EAAE,0BAA0B,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,SAAS,CAAC,SAA2B;IAC5C,MAAM,EACJ,SAAS,EAAE,EAAE,EACb,OAAO,EAAE,EAAE,EACX,YAAY,EAAE,EAAE,EAChB,0BAA0B,EAAE,EAAE,EAC9B,GAAG,IAAI,EACR,GAAG,SAAS,CAAC;IACd,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,SAA2B,EAAE,IAAY,EAAE,QAAgB;IACzE,OAAO,CACL,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE;QACrE,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,IAAI,KAAK,IAAI,CAClD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAmB;IAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,QAAqC,CAAC;IAC1C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,IAAI,MAAM;YAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,KAAK,wBAAwB,EAAE,CAAC;QACpF,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxF,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACd,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAE,CAAC;QAChC,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC;YAAE,SAAS;QACtD,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,sFAAsF;QACtF,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,QAAS,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAoB,QAAQ;QACpC,CAAC,CAAC;YACE,GAAG,QAAQ;YACX,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,CAAC;YAC7B,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;YACrC,UAAU;SACX;QACH,CAAC,CAAC;YACE,UAAU,EAAE,eAAe;YAC3B,KAAK,EAAE,YAAY,UAAU,EAAE,EAAE;YACjC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;YAClC,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU;SACX,CAAC;IACN,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AACpF,CAAC"}

package/dist/api/maintainer-vex/index.d.ts

@@ -0,0 +1,57 @@
+import { type OpenVexStatement, type VexRejection } from "../../platform/maintainer-vex/index.js";
+export interface ReadMaintainerVexOptions {
+    /** Project directory whose `node_modules` is read. Default: the current directory. */
+    cwd?: string;
+    /** Only statements that name this advisory (CVE or GHSA id, or an alias). */
+    advisory?: string;
+    /** Only documents shipped by this package. */
+    packageName?: string;
+}
+export interface MaintainerVexStatementSummary {
+    vulnerability: string;
+    aliases: string[];
+    status: OpenVexStatement["status"];
+    justification?: string;
+    impactStatement?: string;
+    statusNotes?: string;
+    actionStatement?: string;
+    /** Packages the statement is about besides the shipping package itself; empty when it is about the package. */
+    subcomponents: string[];
+    timestamp: string;
+}
+export interface ShippedVexSummary {
+    name: string;
+    version: string;
+    file: string;
+    documentId: string;
+    author: string;
+    timestamp: string;
+    statements: MaintainerVexStatementSummary[];
+}
+/** What this project's own `package.json#vex` says, so an author can check what will ship. */
+export interface OwnVexSummary {
+    declared: boolean;
+    file?: string;
+    status?: "valid" | "invalid";
+    /** Why it is invalid, or a remark on a valid one. */
+    reason?: string;
+    statements?: number;
+}
+export interface MaintainerVexReport {
+    schemaVersion: "1.0";
+    cwd: string;
+    /** Installed packages looked at. */
+    scanned: number;
+    packages: ShippedVexSummary[];
+    /** Declared documents that were not used, with the reason. Never fatal. */
+    rejected: VexRejection[];
+    own: OwnVexSummary;
+    notes: string[];
+}
+/**
+ * Read the VEX documents that installed packages ship (`package.json#vex` in `node_modules`), as
+ * validated data. Everything read is untrusted: invalid documents and declarations are listed under
+ * `rejected` and nothing in a document is ever executed or followed.
+ */
+export declare function readMaintainerVex(options?: ReadMaintainerVexOptions): MaintainerVexReport;
+//# sourceMappingURL=index.d.ts.map

package/dist/api/maintainer-vex/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/maintainer-vex/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,wCAAwC,CAAC;AAEhD,MAAM,WAAW,wBAAwB;IACvC,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+GAA+G;IAC/G,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,6BAA6B,EAAE,CAAC;CAC7C;AAED,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,KAAK,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,GAAG,EAAE,aAAa,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAuED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,GAAG,mBAAmB,CA2C7F"}

package/dist/api/maintainer-vex/index.js

@@ -0,0 +1,107 @@
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { parseOpenVex, readInstalledMaintainerVex, readVexFile, resolveVexField, statementsFor, } from "../../platform/maintainer-vex/index.js";
+function summarize(statement, subcomponents, documentTimestamp) {
+    return {
+        vulnerability: statement.vulnerability.name,
+        aliases: statement.vulnerability.aliases ?? [],
+        status: statement.status,
+        ...(statement.justification ? { justification: statement.justification } : {}),
+        ...(statement.impact_statement ? { impactStatement: statement.impact_statement } : {}),
+        ...(statement.status_notes ? { statusNotes: statement.status_notes } : {}),
+        ...(statement.action_statement ? { actionStatement: statement.action_statement } : {}),
+        subcomponents: (subcomponents ?? []).map((sub) => sub.version ? `${sub.name}@${sub.version}` : sub.name),
+        timestamp: statement.timestamp ?? documentTimestamp,
+    };
+}
+function readOwn(cwd) {
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+    }
+    catch {
+        return { declared: false };
+    }
+    if (!Object.hasOwn(manifest, "vex"))
+        return { declared: false };
+    const field = resolveVexField(manifest["vex"]);
+    if ("error" in field)
+        return { declared: true, status: "invalid", reason: field.error };
+    const file = readVexFile(cwd, field.path);
+    if ("error" in file) {
+        return {
+            declared: true,
+            file: field.path,
+            status: "invalid",
+            reason: `${field.path} ${file.error}`,
+        };
+    }
+    const parsed = parseOpenVex(file.content);
+    if ("error" in parsed) {
+        return {
+            declared: true,
+            file: field.path,
+            status: "invalid",
+            reason: `${field.path} ${parsed.error}`,
+        };
+    }
+    const name = manifest["name"];
+    const version = manifest["version"];
+    const about = typeof name === "string" && typeof version === "string"
+        ? statementsFor(parsed.document, { name, version }).length
+        : 0;
+    return {
+        declared: true,
+        file: field.path,
+        status: "valid",
+        statements: parsed.document.statements.length,
+        reason: about === 0
+            ? `none of its statements is about ${String(name)}@${String(version)}, the version in package.json; consumers only use statements about the version they install, so it must carry the version being released`
+            : undefined,
+    };
+}
+/**
+ * Read the VEX documents that installed packages ship (`package.json#vex` in `node_modules`), as
+ * validated data. Everything read is untrusted: invalid documents and declarations are listed under
+ * `rejected` and nothing in a document is ever executed or followed.
+ */
+export function readMaintainerVex(options = {}) {
+    const cwd = resolve(options.cwd ?? process.cwd());
+    const index = readInstalledMaintainerVex(cwd);
+    const wanted = options.advisory?.toUpperCase();
+    const packages = [];
+    for (const shipped of index.documents) {
+        if (options.packageName && shipped.package.name !== options.packageName)
+            continue;
+        const statements = shipped.statements
+            .filter(({ statement }) => {
+            if (!wanted)
+                return true;
+            return [statement.vulnerability.name, ...(statement.vulnerability.aliases ?? [])].some((id) => id.toUpperCase() === wanted);
+        })
+            .map(({ statement, subcomponents }) => summarize(statement, subcomponents, shipped.document.timestamp));
+        if (statements.length === 0)
+            continue;
+        packages.push({
+            name: shipped.package.name,
+            version: shipped.package.version,
+            file: shipped.file,
+            documentId: shipped.document["@id"],
+            author: shipped.document.author,
+            timestamp: shipped.document.timestamp,
+            statements,
+        });
+    }
+    return {
+        schemaVersion: "1.0",
+        cwd,
+        scanned: index.scanned,
+        packages: packages.toSorted((a, b) => `${a.name}@${a.version}`.localeCompare(`${b.name}@${b.version}`)),
+        rejected: index.rejected
+            .filter((entry) => !options.packageName || entry.package === options.packageName)
+            .toSorted((a, b) => a.package.localeCompare(b.package)),
+        own: readOwn(cwd),
+        notes: index.notes,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/api/maintainer-vex/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/maintainer-vex/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,WAAW,EACX,eAAe,EACf,aAAa,GAGd,MAAM,wCAAwC,CAAC;AAwDhD,SAAS,SAAS,CAChB,SAA2B,EAC3B,aAAoE,EACpE,iBAAyB;IAEzB,OAAO;QACL,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,IAAI;QAC3C,OAAO,EAAE,SAAS,CAAC,aAAa,CAAC,OAAO,IAAI,EAAE;QAC9C,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,aAAa,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CACtD;QACD,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,iBAAiB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAGpE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,IAAI,OAAO,IAAI,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACxF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;SACtC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE;SACxC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,KAAK,GACT,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ;QACrD,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM;QAC1D,CAAC,CAAC,CAAC,CAAC;IACR,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM;QAC7C,MAAM,EACJ,KAAK,KAAK,CAAC;YACT,CAAC,CAAC,mCAAmC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0IAA0I;YAC9M,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAO,GAA6B,EAAE;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IAE/C,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,WAAW;YAAE,SAAS;QAClF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU;aAClC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE;YACxB,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CACpF,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CACpC,CAAC;QACJ,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CACpC,SAAS,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAChE,CAAC;QACJ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;YAC/B,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;YACrC,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,GAAG;QACH,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACnC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CACjE;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACrB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC;aAChF,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzD,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC"}