autoremediator 0.21.2 → 0.22.0

package/dist/platform/http-security.js

@@ -0,0 +1,102 @@
+export class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "HttpError";
+    }
+}
+const DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
+function getMaxBodyBytes() {
+    const parsed = Number.parseInt(process.env.AUTOREMEDIATOR_MAX_BODY_BYTES ?? "", 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_MAX_BODY_BYTES;
+}
+/**
+ * Read and parse a JSON request body.
+ *
+ * Requires `Content-Type: application/json`: a browser cannot send that cross-origin without a
+ * CORS preflight (which this server never grants), so it blocks drive-by form/text POSTs.
+ */
+export function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const contentType = req.headers["content-type"] ?? "";
+        if (!/^application\/json\s*(;|$)/i.test(contentType)) {
+            reject(new HttpError(415, "Content-Type must be application/json"));
+            return;
+        }
+        const limit = getMaxBodyBytes();
+        const declared = Number.parseInt(req.headers["content-length"] ?? "", 10);
+        if (Number.isFinite(declared) && declared > limit) {
+            reject(new HttpError(413, `Request body exceeds ${limit} bytes`));
+            return;
+        }
+        let raw = "";
+        let received = 0;
+        let failed = false;
+        req.setEncoding("utf8");
+        req.on("data", (chunk) => {
+            if (failed)
+                return;
+            received += Buffer.byteLength(chunk);
+            if (received > limit) {
+                failed = true;
+                raw = "";
+                reject(new HttpError(413, `Request body exceeds ${limit} bytes`));
+                return;
+            }
+            raw += chunk;
+        });
+        req.on("end", () => {
+            if (failed)
+                return;
+            let parsed;
+            try {
+                parsed = raw ? JSON.parse(raw) : {};
+            }
+            catch {
+                reject(new HttpError(400, "Invalid JSON body"));
+                return;
+            }
+            resolve(parsed);
+        });
+        req.on("error", reject);
+    });
+}
+/**
+ * The text of an error that is safe to hand to an HTTP caller: the first line of its message,
+ * capped in length. Never a stack trace, never the object's own string form (which can carry one).
+ */
+export function publicErrorMessage(error) {
+    const message = error instanceof Error ? error.message : typeof error === "string" ? error : "Request failed";
+    const [firstLine = ""] = message.split(/\r?\n/, 1);
+    const trimmed = firstLine.trim().slice(0, 500);
+    return trimmed === "" ? "Request failed" : trimmed;
+}
+export function sendJson(res, status, body) {
+    if (res.headersSent)
+        return;
+    const payload = JSON.stringify(body);
+    res.writeHead(status, {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(payload),
+    });
+    res.end(payload);
+}
+/**
+ * Whether the request's Host header names this machine: the loopback names, plus any in
+ * `AUTOREMEDIATOR_ALLOWED_HOSTS`. Rejecting anything else stops a DNS-rebinding page from
+ * reaching a server that listens on loopback.
+ */
+export function isHostAllowed(req, env = process.env) {
+    const configured = env["AUTOREMEDIATOR_ALLOWED_HOSTS"]
+        ?.split(",")
+        .map((h) => h.trim().toLowerCase())
+        .filter(Boolean);
+    const allowed = configured && configured.length > 0 ? configured : ["127.0.0.1", "localhost", "[::1]"];
+    const host = (req.headers.host ?? "").toLowerCase();
+    const name = host.startsWith("[")
+        ? host.slice(0, host.indexOf("]") + 1)
+        : (host.split(":")[0] ?? "");
+    return allowed.includes(name);
+}
+//# sourceMappingURL=http-security.js.map

package/dist/platform/http-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-security.js","sourceRoot":"","sources":["../../src/platform/http-security.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,SAAS,eAAe;IACtB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAyB;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,wBAAwB,KAAK,QAAQ,CAAC,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,MAAM;gBAAE,OAAO;YACnB,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,QAAQ,GAAG,KAAK,EAAE,CAAC;gBACrB,MAAM,GAAG,IAAI,CAAC;gBACd,GAAG,GAAG,EAAE,CAAC;gBACT,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,wBAAwB,KAAK,QAAQ,CAAC,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,GAAG,IAAI,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,MAAM;gBAAE,OAAO;YACnB,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAChG,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAwB,EAAE,MAAc,EAAE,IAAa;IAC9E,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;KAC7C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAyB,EACzB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,8BAA8B,CAAC;QACpD,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,OAAO,GACX,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC"}

package/dist/platform/maintainer-vex/find.d.ts

@@ -0,0 +1,25 @@
+import type { MaintainerVexEvidence, MaintainerVexIgnored } from "../types.js";
+import { type MaintainerVexIndex } from "./read.js";
+export interface MaintainerVexMatch {
+    /** Accepted `not_affected` statements with a justification. */
+    evidence: MaintainerVexEvidence[];
+    /** Statements that named this advisory but were not accepted, and why. */
+    ignored: MaintainerVexIgnored[];
+}
+/**
+ * Which installed packages vouch that the advisory does not affect them, for this vulnerable copy.
+ *
+ * A statement counts only when all of these hold:
+ *  - it comes from a package other than the vulnerable one (a package cannot declare itself not
+ *    affected by an advisory about itself: that claim is made by the party it concerns),
+ *  - the maintaining package depends, through installed packages, on the vulnerable one,
+ *  - if it lists subcomponents, one is the vulnerable package (any version, or this exact version),
+ *  - it is the newest statement on this advisory from that document for that product, and says
+ *    `not_affected` with a justification from the OpenVEX list.
+ * Anything else that named the advisory is returned under `ignored` with the reason.
+ */
+export declare function findMaintainerVex(index: MaintainerVexIndex, advisoryId: string, vulnerable: {
+    name: string;
+    version: string;
+}, now?: Date): MaintainerVexMatch;
+//# sourceMappingURL=find.d.ts.map

package/dist/platform/maintainer-vex/find.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find.d.ts","sourceRoot":"","sources":["../../../src/platform/maintainer-vex/find.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE/E,OAAO,EAAa,KAAK,kBAAkB,EAAyB,MAAM,WAAW,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAClC,0EAA0E;IAC1E,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAeD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,kBAAkB,EACzB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,GAAG,GAAE,IAAiB,GACrB,kBAAkB,CAsGpB"}

package/dist/platform/maintainer-vex/find.js

@@ -0,0 +1,109 @@
+import { dependsOn } from "./read.js";
+const FUTURE_SKEW_MS = 24 * 60 * 60 * 1000;
+function names(statement) {
+    const all = new Set([statement.vulnerability.name.toUpperCase()]);
+    for (const alias of statement.vulnerability.aliases ?? [])
+        all.add(alias.toUpperCase());
+    return all;
+}
+function stamp(statement, documentTimestamp) {
+    const parsed = Date.parse(statement.timestamp ?? documentTimestamp);
+    return Number.isNaN(parsed) ? 0 : parsed;
+}
+/**
+ * Which installed packages vouch that the advisory does not affect them, for this vulnerable copy.
+ *
+ * A statement counts only when all of these hold:
+ *  - it comes from a package other than the vulnerable one (a package cannot declare itself not
+ *    affected by an advisory about itself: that claim is made by the party it concerns),
+ *  - the maintaining package depends, through installed packages, on the vulnerable one,
+ *  - if it lists subcomponents, one is the vulnerable package (any version, or this exact version),
+ *  - it is the newest statement on this advisory from that document for that product, and says
+ *    `not_affected` with a justification from the OpenVEX list.
+ * Anything else that named the advisory is returned under `ignored` with the reason.
+ */
+export function findMaintainerVex(index, advisoryId, vulnerable, now = new Date()) {
+    const wanted = advisoryId.toUpperCase();
+    const evidence = [];
+    const ignored = [];
+    for (const shipped of index.documents) {
+        const maintainer = shipped.package;
+        const candidates = shipped.statements.filter((entry) => names(entry.statement).has(wanted));
+        if (candidates.length === 0)
+            continue;
+        const skip = (reason) => ignored.push({ maintainer, reason });
+        // A package nested inside the vulnerable one's own tree is part of it: it can bundle a helper that
+        // "depends on" its host and vouches for it, so its claim is no more independent than the host's.
+        const inside = `/node_modules/${vulnerable.name}/`;
+        if (shipped.dir.replaceAll("\\", "/").includes(inside)) {
+            skip(`${maintainer.name}@${maintainer.version} is shipped inside ${vulnerable.name} itself, so it is not an independent maintainer`);
+            continue;
+        }
+        if (maintainer.name === vulnerable.name) {
+            skip(`${maintainer.name}@${maintainer.version} declares itself not affected by an advisory about ${vulnerable.name}; a package's own claim about itself is never accepted`);
+            continue;
+        }
+        if (!dependsOn(index, maintainer.name, vulnerable.name)) {
+            skip(`${maintainer.name} does not depend on ${vulnerable.name}`);
+            continue;
+        }
+        const about = candidates.filter((entry) => entry.subcomponents === undefined ||
+            entry.subcomponents.some((sub) => sub.name === vulnerable.name &&
+                (sub.version === undefined || sub.version === vulnerable.version)));
+        // Statements about a different subcomponent concern something else; not worth reporting.
+        if (about.length === 0)
+            continue;
+        const dated = about.filter((entry) => stamp(entry.statement, shipped.document.timestamp) <= now.getTime() + FUTURE_SKEW_MS);
+        if (dated.length === 0) {
+            skip(`${maintainer.name}@${maintainer.version} dates its statement in the future`);
+            continue;
+        }
+        // Newest statement wins; on a tie, a statement that is not `not_affected` wins, then the higher version.
+        const latest = dated.toSorted((a, b) => {
+            const byTime = stamp(b.statement, shipped.document.timestamp) -
+                stamp(a.statement, shipped.document.timestamp);
+            if (byTime !== 0)
+                return byTime;
+            const aOk = a.statement.status === "not_affected" ? 1 : 0;
+            const bOk = b.statement.status === "not_affected" ? 1 : 0;
+            if (aOk !== bOk)
+                return aOk - bOk;
+            return (b.statement.version ?? 0) - (a.statement.version ?? 0);
+        })[0];
+        const { statement } = latest;
+        if (statement.status !== "not_affected") {
+            skip(`${maintainer.name}@${maintainer.version} says ${statement.status}, not not_affected`);
+            continue;
+        }
+        if (statement.justification === undefined) {
+            skip(`${maintainer.name}@${maintainer.version} gives only a free-text impact statement, no OpenVEX justification`);
+            continue;
+        }
+        evidence.push({
+            maintainer,
+            file: shipped.file,
+            documentId: shipped.document["@id"],
+            author: shipped.document.author,
+            ...(statement["@id"] ? { statementId: statement["@id"] } : {}),
+            status: "not_affected",
+            justification: statement.justification,
+            ...(statement.impact_statement ? { impactStatement: statement.impact_statement } : {}),
+            ...(statement.status_notes ? { statusNotes: statement.status_notes } : {}),
+            timestamp: statement.timestamp ?? shipped.document.timestamp,
+            subcomponent: latest.subcomponents !== undefined,
+        });
+    }
+    // One maintainer saying the advisory affects the package outweighs another saying it does not:
+    // acting on "not affected" needs nobody installed to disagree.
+    const disagreement = ignored.find((entry) => /says (affected|under_investigation|fixed)\b/.test(entry.reason));
+    if (disagreement && evidence.length > 0) {
+        for (const claim of evidence.splice(0)) {
+            ignored.push({
+                maintainer: claim.maintainer,
+                reason: `${claim.maintainer.name}@${claim.maintainer.version} says not_affected, but ${disagreement.maintainer.name}@${disagreement.maintainer.version} says otherwise, so neither is acted on`,
+            });
+        }
+    }
+    return { evidence, ignored };
+}
+//# sourceMappingURL=find.js.map

package/dist/platform/maintainer-vex/find.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find.js","sourceRoot":"","sources":["../../../src/platform/maintainer-vex/find.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAkD,MAAM,WAAW,CAAC;AAStF,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C,SAAS,KAAK,CAAC,SAA2B;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,aAAa,CAAC,OAAO,IAAI,EAAE;QAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,SAA2B,EAAE,iBAAyB;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,IAAI,iBAAiB,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAyB,EACzB,UAAkB,EAClB,UAA6C,EAC7C,GAAG,GAAS,IAAI,IAAI,EAAE;IAEtB,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;QACnC,MAAM,UAAU,GAAuB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACzE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CACnC,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtE,mGAAmG;QACnG,iGAAiG;QACjG,MAAM,MAAM,GAAG,iBAAiB,UAAU,CAAC,IAAI,GAAG,CAAC;QACnD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CACF,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,sBAAsB,UAAU,CAAC,IAAI,iDAAiD,CAC/H,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CACF,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,sDAAsD,UAAU,CAAC,IAAI,wDAAwD,CACtK,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,uBAAuB,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAC7B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,SAAS;YACjC,KAAK,CAAC,aAAa,CAAC,IAAI,CACtB,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;gBAC5B,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,CACpE,CACJ,CAAC;QACF,yFAAyF;QACzF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEjC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CACvF,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,oCAAoC,CAAC,CAAC;YACnF,SAAS;QACX,CAAC;QACD,yGAAyG;QACzG,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACrC,MAAM,MAAM,GACV,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC9C,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC;YAChC,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,GAAG,KAAK,GAAG;gBAAE,OAAO,GAAG,GAAG,GAAG,CAAC;YAClC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QACP,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC7B,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,SAAS,SAAS,CAAC,MAAM,oBAAoB,CAAC,CAAC;YAC5F,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,CACF,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,oEAAoE,CAC7G,CAAC;YACF,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,UAAU;YACV,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;YAC/B,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,cAAc;YACtB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS;YAC5D,YAAY,EAAE,MAAM,CAAC,aAAa,KAAK,SAAS;SACjD,CAAC,CAAC;IACL,CAAC;IACD,+FAA+F;IAC/F,+DAA+D;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,6CAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CACjE,CAAC;IACF,IAAI,YAAY,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,2BAA2B,YAAY,CAAC,UAAU,CAAC,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,OAAO,yCAAyC;aAChM,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/platform/maintainer-vex/index.d.ts

@@ -0,0 +1,5 @@
+export { findMaintainerVex, type MaintainerVexMatch } from "./find.js";
+export { MAX_VEX_BYTES, OPENVEX_CONTEXT, OPENVEX_JUSTIFICATIONS, OPENVEX_STATUSES, parseOpenVex, type OpenVexDocument, type OpenVexJustification, type OpenVexStatement, type OpenVexStatus, type ParsedOpenVex, } from "./openvex.js";
+export { isValidPackageName, npmPurl, parseNpmPurl, type NpmPurl } from "./purl.js";
+export { DEFAULT_VEX_FILE, dependsOn, readInstalledMaintainerVex, readVexFile, resolveVexField, statementsFor, type MaintainerVexIndex, type ShippedStatement, type ShippedVexDocument, type VexRejection, } from "./read.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/platform/maintainer-vex/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/platform/maintainer-vex/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EACL,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,0BAA0B,EAC1B,WAAW,EACX,eAAe,EACf,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,WAAW,CAAC"}

package/dist/platform/maintainer-vex/index.js

@@ -0,0 +1,5 @@
+export { findMaintainerVex } from "./find.js";
+export { MAX_VEX_BYTES, OPENVEX_CONTEXT, OPENVEX_JUSTIFICATIONS, OPENVEX_STATUSES, parseOpenVex, } from "./openvex.js";
+export { isValidPackageName, npmPurl, parseNpmPurl } from "./purl.js";
+export { DEFAULT_VEX_FILE, dependsOn, readInstalledMaintainerVex, readVexFile, resolveVexField, statementsFor, } from "./read.js";
+//# sourceMappingURL=index.js.map

package/dist/platform/maintainer-vex/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/platform/maintainer-vex/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA2B,MAAM,WAAW,CAAC;AACvE,OAAO,EACL,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,YAAY,GAMb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,YAAY,EAAgB,MAAM,WAAW,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,0BAA0B,EAC1B,WAAW,EACX,eAAe,EACf,aAAa,GAKd,MAAM,WAAW,CAAC"}

package/dist/platform/maintainer-vex/openvex.d.ts

@@ -0,0 +1,91 @@
+import { z } from "zod";
+/**
+ * OpenVEX v0.2.0 (https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md), as far as consuming
+ * and writing it needs. Validation is strict on purpose: documents shipped inside installed
+ * packages are untrusted input, so an unknown key, a wrong type or a bad enum value rejects the
+ * whole document instead of being guessed at.
+ */
+export declare const OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
+export declare const OPENVEX_STATUSES: readonly ["not_affected", "affected", "fixed", "under_investigation"];
+export type OpenVexStatus = (typeof OPENVEX_STATUSES)[number];
+export declare const OPENVEX_JUSTIFICATIONS: readonly ["component_not_present", "vulnerable_code_not_present", "vulnerable_code_not_in_execute_path", "vulnerable_code_cannot_be_controlled_by_adversary", "inline_mitigations_already_exist"];
+export type OpenVexJustification = (typeof OPENVEX_JUSTIFICATIONS)[number];
+/** Limits that bound what a hostile document can cost. */
+export declare const MAX_VEX_BYTES: number;
+export declare const MAX_VEX_DEPTH = 12;
+export declare const MAX_STATEMENTS = 2000;
+export declare const openVexDocumentSchema: z.ZodObject<{
+    "@context": z.ZodLiteral<"https://openvex.dev/ns/v0.2.0">;
+    "@id": z.ZodString;
+    author: z.ZodString;
+    role: z.ZodOptional<z.ZodString>;
+    timestamp: z.ZodISODateTime;
+    last_updated: z.ZodOptional<z.ZodISODateTime>;
+    version: z.ZodNumber;
+    tooling: z.ZodOptional<z.ZodString>;
+    statements: z.ZodArray<z.ZodObject<{
+        "@id": z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodNumber>;
+        vulnerability: z.ZodObject<{
+            "@id": z.ZodOptional<z.ZodString>;
+            name: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            aliases: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>;
+        timestamp: z.ZodOptional<z.ZodISODateTime>;
+        last_updated: z.ZodOptional<z.ZodISODateTime>;
+        products: z.ZodArray<z.ZodObject<{
+            "@id": z.ZodOptional<z.ZodString>;
+            identifiers: z.ZodOptional<z.ZodObject<{
+                purl: z.ZodOptional<z.ZodString>;
+                cpe22: z.ZodOptional<z.ZodString>;
+                cpe23: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            hashes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            subcomponents: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                "@id": z.ZodOptional<z.ZodString>;
+                identifiers: z.ZodOptional<z.ZodObject<{
+                    purl: z.ZodOptional<z.ZodString>;
+                    cpe22: z.ZodOptional<z.ZodString>;
+                    cpe23: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+                hashes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+        status: z.ZodEnum<{
+            affected: "affected";
+            fixed: "fixed";
+            not_affected: "not_affected";
+            under_investigation: "under_investigation";
+        }>;
+        supplier: z.ZodOptional<z.ZodString>;
+        status_notes: z.ZodOptional<z.ZodString>;
+        justification: z.ZodOptional<z.ZodEnum<{
+            component_not_present: "component_not_present";
+            inline_mitigations_already_exist: "inline_mitigations_already_exist";
+            vulnerable_code_cannot_be_controlled_by_adversary: "vulnerable_code_cannot_be_controlled_by_adversary";
+            vulnerable_code_not_in_execute_path: "vulnerable_code_not_in_execute_path";
+            vulnerable_code_not_present: "vulnerable_code_not_present";
+        }>>;
+        impact_statement: z.ZodOptional<z.ZodString>;
+        action_statement: z.ZodOptional<z.ZodString>;
+        action_statement_timestamp: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type OpenVexDocument = z.infer<typeof openVexDocumentSchema>;
+export type OpenVexStatement = OpenVexDocument["statements"][number];
+export type OpenVexProduct = OpenVexStatement["products"][number];
+/**
+ * Reject structure a legitimate VEX document never has: object keys that are used to attack
+ * prototypes, and nesting deeper than the format can need. Iterative so a deeply nested file cannot
+ * overflow the stack.
+ */
+export declare function findHostileStructure(value: unknown): string | undefined;
+export type ParsedOpenVex = {
+    document: OpenVexDocument;
+} | {
+    error: string;
+};
+/** Parse and validate document text. Never throws. */
+export declare function parseOpenVex(content: string): ParsedOpenVex;
+//# sourceMappingURL=openvex.d.ts.map

package/dist/platform/maintainer-vex/openvex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openvex.d.ts","sourceRoot":"","sources":["../../../src/platform/maintainer-vex/openvex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAE/D,eAAO,MAAM,gBAAgB,YAC3B,cAAc,EACd,UAAU,EACV,OAAO,EACP,qBAAqB,CACb,CAAC;AACX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,eAAO,MAAM,sBAAsB,YACjC,uBAAuB,EACvB,6BAA6B,EAC7B,qCAAqC,EACrC,mDAAmD,EACnD,kCAAkC,CAC1B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,0DAA0D;AAC1D,eAAO,MAAM,aAAa,QAAc,CAAC;AACzC,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,eAAO,MAAM,cAAc,OAAO,CAAC;AAuEnC,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAYvB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAIlE;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAmBvE;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAuB3D"}

package/dist/platform/maintainer-vex/openvex.js

@@ -0,0 +1,154 @@
+import { z } from "zod";
+/**
+ * OpenVEX v0.2.0 (https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md), as far as consuming
+ * and writing it needs. Validation is strict on purpose: documents shipped inside installed
+ * packages are untrusted input, so an unknown key, a wrong type or a bad enum value rejects the
+ * whole document instead of being guessed at.
+ */
+export const OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
+export const OPENVEX_STATUSES = [
+    "not_affected",
+    "affected",
+    "fixed",
+    "under_investigation",
+];
+export const OPENVEX_JUSTIFICATIONS = [
+    "component_not_present",
+    "vulnerable_code_not_present",
+    "vulnerable_code_not_in_execute_path",
+    "vulnerable_code_cannot_be_controlled_by_adversary",
+    "inline_mitigations_already_exist",
+];
+/** Limits that bound what a hostile document can cost. */
+export const MAX_VEX_BYTES = 1024 * 1024;
+export const MAX_VEX_DEPTH = 12;
+export const MAX_STATEMENTS = 2000;
+const MAX_LIST = 200;
+const text = (max) => z.string().min(1).max(max);
+const longText = z.string().max(8000);
+const iri = text(2048);
+const timestamp = z.iso.datetime({ offset: true });
+const identifiers = z
+    .object({
+    purl: text(512).optional(),
+    cpe22: text(1024).optional(),
+    cpe23: text(1024).optional(),
+})
+    .strict();
+const hashes = z.record(text(64), text(256)).refine((value) => Object.keys(value).length <= 20, {
+    message: "at most 20 hashes",
+});
+const component = z
+    .object({
+    "@id": iri.optional(),
+    identifiers: identifiers.optional(),
+    hashes: hashes.optional(),
+})
+    .strict();
+const product = z
+    .object({
+    "@id": iri.optional(),
+    identifiers: identifiers.optional(),
+    hashes: hashes.optional(),
+    subcomponents: z.array(component).max(MAX_LIST).optional(),
+})
+    .strict();
+const vulnerability = z
+    .object({
+    "@id": iri.optional(),
+    name: text(256),
+    description: longText.optional(),
+    aliases: z.array(text(256)).max(MAX_LIST).optional(),
+})
+    .strict();
+const statement = z
+    .object({
+    "@id": iri.optional(),
+    version: z.number().int().min(0).optional(),
+    vulnerability,
+    timestamp: timestamp.optional(),
+    last_updated: timestamp.optional(),
+    products: z.array(product).min(1).max(MAX_LIST),
+    status: z.enum(OPENVEX_STATUSES),
+    supplier: text(512).optional(),
+    status_notes: longText.optional(),
+    justification: z.enum(OPENVEX_JUSTIFICATIONS).optional(),
+    impact_statement: longText.optional(),
+    action_statement: longText.optional(),
+    action_statement_timestamp: timestamp.optional(),
+})
+    .strict()
+    .refine((value) => value.status !== "not_affected" ||
+    value.justification !== undefined ||
+    (value.impact_statement !== undefined && value.impact_statement.trim() !== ""), { message: "a not_affected statement needs a justification or an impact_statement" });
+export const openVexDocumentSchema = z
+    .object({
+    "@context": z.literal(OPENVEX_CONTEXT),
+    "@id": iri,
+    author: text(512),
+    role: text(512).optional(),
+    timestamp,
+    last_updated: timestamp.optional(),
+    version: z.number().int().min(1),
+    tooling: text(512).optional(),
+    statements: z.array(statement).max(MAX_STATEMENTS),
+})
+    .strict();
+const FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+/**
+ * Reject structure a legitimate VEX document never has: object keys that are used to attack
+ * prototypes, and nesting deeper than the format can need. Iterative so a deeply nested file cannot
+ * overflow the stack.
+ */
+export function findHostileStructure(value) {
+    const stack = [{ node: value, depth: 0 }];
+    let visited = 0;
+    while (stack.length > 0) {
+        const { node, depth } = stack.pop();
+        if (typeof node !== "object" || node === null)
+            continue;
+        visited += 1;
+        if (visited > 200_000)
+            return "has too many nested values";
+        if (depth > MAX_VEX_DEPTH)
+            return `is nested deeper than ${MAX_VEX_DEPTH} levels`;
+        if (Array.isArray(node)) {
+            for (const child of node)
+                stack.push({ node: child, depth: depth + 1 });
+            continue;
+        }
+        for (const [key, child] of Object.entries(node)) {
+            if (FORBIDDEN_KEYS.has(key))
+                return `has a "${key}" key`;
+            stack.push({ node: child, depth: depth + 1 });
+        }
+    }
+    return undefined;
+}
+/** Parse and validate document text. Never throws. */
+export function parseOpenVex(content) {
+    if (Buffer.byteLength(content, "utf8") > MAX_VEX_BYTES) {
+        return { error: `is larger than ${MAX_VEX_BYTES / 1024} KiB` };
+    }
+    let raw;
+    try {
+        raw = JSON.parse(content);
+    }
+    catch {
+        return { error: "is not valid JSON" };
+    }
+    const hostile = findHostileStructure(raw);
+    if (hostile)
+        return { error: hostile };
+    const parsed = openVexDocumentSchema.safeParse(raw);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        const where = issue && issue.path.length > 0 ? issue.path.join(".") : "(root)";
+        const reason = issue?.code === "unrecognized_keys"
+            ? `unknown field(s) ${issue.keys.map((key) => `"${key}"`).join(", ")}`
+            : (issue?.message ?? "does not match the schema");
+        return { error: `is not an OpenVEX v0.2.0 document: ${where}: ${reason}` };
+    }
+    return { document: parsed.data };
+}
+//# sourceMappingURL=openvex.js.map

package/dist/platform/maintainer-vex/openvex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openvex.js","sourceRoot":"","sources":["../../../src/platform/maintainer-vex/openvex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,cAAc;IACd,UAAU;IACV,OAAO;IACP,qBAAqB;CACb,CAAC;AAGX,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,uBAAuB;IACvB,6BAA6B;IAC7B,qCAAqC;IACrC,mDAAmD;IACnD,kCAAkC;CAC1B,CAAC;AAGX,0DAA0D;AAC1D,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC;AACzC,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AACnC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACzD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACtC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;AACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEnD,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE;IAC9F,OAAO,EAAE,mBAAmB;CAC7B,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE;IACrB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,OAAO,GAAG,CAAC;KACd,MAAM,CAAC;IACN,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE;IACrB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;IACzB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE;IACrB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IACf,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,aAAa;IACb,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAChC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9B,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IACxD,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACrC,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE;IACrC,0BAA0B,EAAE,SAAS,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,MAAM,KAAK,cAAc;IAC/B,KAAK,CAAC,aAAa,KAAK,SAAS;IACjC,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAChF,EAAE,OAAO,EAAE,uEAAuE,EAAE,CACrF,CAAC;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtC,KAAK,EAAE,GAAG;IACV,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1B,SAAS;IACT,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;CACnD,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,KAAK,GAA4C,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QACxD,OAAO,IAAI,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,OAAO;YAAE,OAAO,4BAA4B,CAAC;QAC3D,IAAI,KAAK,GAAG,aAAa;YAAE,OAAO,yBAAyB,aAAa,SAAS,CAAC;QAClF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,KAAK,IAAI,IAAiB;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YACrF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,UAAU,GAAG,OAAO,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAID,sDAAsD;AACtD,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,kBAAkB,aAAa,GAAG,IAAI,MAAM,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/E,MAAM,MAAM,GACV,KAAK,EAAE,IAAI,KAAK,mBAAmB;YACjC,CAAC,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACtE,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,2BAA2B,CAAC,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,sCAAsC,KAAK,KAAK,MAAM,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC"}

package/dist/platform/maintainer-vex/purl.d.ts

@@ -0,0 +1,16 @@
+/** An npm package URL (`pkg:npm/...`) reduced to what matching needs. */
+export interface NpmPurl {
+    name: string;
+    /** Absent when the purl names the package without a version. */
+    version?: string;
+}
+export declare function isValidPackageName(name: unknown): name is string;
+/**
+ * Parse an npm purl. Deliberately strict: anything with qualifiers, a subpath, another ecosystem, a
+ * name that is not a valid npm package name or a version that is not exact semver is not a match,
+ * because a loose parse is how a document ends up vouching for a package it was not written about.
+ */
+export declare function parseNpmPurl(value: unknown): NpmPurl | undefined;
+/** The purl for a package, with the scope's `@` encoded as the purl specification asks. */
+export declare function npmPurl(name: string, version?: string): string;
+//# sourceMappingURL=purl.d.ts.map

package/dist/platform/maintainer-vex/purl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purl.d.ts","sourceRoot":"","sources":["../../../src/platform/maintainer-vex/purl.ts"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAqBhE;AAED,2FAA2F;AAC3F,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAG9D"}

package/dist/platform/maintainer-vex/purl.js

@@ -0,0 +1,46 @@
+import semver from "semver";
+const PACKAGE_NAME = /^(?:@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
+export function isValidPackageName(name) {
+    return typeof name === "string" && name.length <= 214 && PACKAGE_NAME.test(name);
+}
+/**
+ * Parse an npm purl. Deliberately strict: anything with qualifiers, a subpath, another ecosystem, a
+ * name that is not a valid npm package name or a version that is not exact semver is not a match,
+ * because a loose parse is how a document ends up vouching for a package it was not written about.
+ */
+export function parseNpmPurl(value) {
+    if (typeof value !== "string" || value.length > 512)
+        return undefined;
+    if (!value.startsWith("pkg:npm/"))
+        return undefined;
+    if (/[?#\s]/.test(value))
+        return undefined;
+    // The purl specification encodes a scope's `@` as `%40`; plain `@scope/name` is common and equivalent.
+    let rest = value.slice("pkg:npm/".length);
+    if (rest.startsWith("%40"))
+        rest = `@${rest.slice(3)}`;
+    const at = rest.lastIndexOf("@");
+    const rawName = at > 0 ? rest.slice(0, at) : rest;
+    const rawVersion = at > 0 ? rest.slice(at + 1) : undefined;
+    const name = rawName.toLowerCase();
+    if (!isValidPackageName(name))
+        return undefined;
+    if (rawVersion === undefined)
+        return { name };
+    let version;
+    try {
+        version = decodeURIComponent(rawVersion);
+    }
+    catch {
+        return undefined;
+    }
+    if (semver.valid(version) !== version)
+        return undefined;
+    return { name, version };
+}
+/** The purl for a package, with the scope's `@` encoded as the purl specification asks. */
+export function npmPurl(name, version) {
+    const encoded = name.startsWith("@") ? `%40${name.slice(1)}` : name;
+    return version === undefined ? `pkg:npm/${encoded}` : `pkg:npm/${encoded}@${version}`;
+}
+//# sourceMappingURL=purl.js.map

package/dist/platform/maintainer-vex/purl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purl.js","sourceRoot":"","sources":["../../../src/platform/maintainer-vex/purl.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAS5B,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAEhF,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,uGAAuG;IACvG,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAgB;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,OAAO,IAAI,OAAO,EAAE,CAAC;AACxF,CAAC"}