autoremediator 0.21.2 → 0.22.0

package/dist/remediation/impact/tarball.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.d.ts","sourceRoot":"","sources":["../../../src/remediation/impact/tarball.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,gBAAgB,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,sBAAsB,EAAE,aAMpC,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,8FAA8F;IAC9F,IAAI,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,KAAK,EAAE;QACL,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,qBAAa,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAGlD;CACF;AAiDD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAWtD;AAOD,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,yFAAyF;AACzF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,MAAM,GAAE,aAAsC,EAC9C,OAAO,GAAE,kBAAuB,GAC/B,YAAY,CA6Hd"}

package/dist/remediation/impact/tarball.js

@@ -0,0 +1,216 @@
+/**
+ * Read an npm tarball into memory without ever writing it to disk.
+ *
+ * Nothing is extracted, so a hostile archive cannot write outside a directory, plant a symlink or
+ * be executed. The reader still refuses what no real package contains: absolute or `..` paths,
+ * corrupt headers, unreasonable sizes and entry counts (zip bombs). Links and device entries are
+ * skipped and counted, never followed.
+ */
+import { gunzipSync } from "node:zlib";
+export const DEFAULT_TARBALL_LIMITS = {
+    maxUnpackedBytes: 256 * 1024 * 1024,
+    maxEntries: 50_000,
+    maxFileBytes: 4 * 1024 * 1024,
+    maxRetainedBytes: 48 * 1024 * 1024,
+    maxRetainedFiles: 6000,
+};
+export class TarballError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "TarballError";
+    }
+}
+const BLOCK = 512;
+const SOURCE_PATTERN = /\.(?:[cm]?[jt]sx?|d\.[cm]?ts)$/i;
+const MINIFIED_PATTERN = /\.min\.[cm]?js$/i;
+function readString(buffer, start, length) {
+    const slice = buffer.subarray(start, start + length);
+    const end = slice.indexOf(0);
+    return slice.subarray(0, end === -1 ? slice.length : end).toString("utf8");
+}
+function readOctal(buffer, start, length, field) {
+    // A set high bit means base-256 encoding, used only for sizes beyond 8 GiB.
+    if (((buffer[start] ?? 0) & 0x80) !== 0) {
+        throw new TarballError(`Tarball entry has an oversized ${field}`);
+    }
+    const text = readString(buffer, start, length).trim();
+    if (text === "")
+        return 0;
+    if (!/^[0-7]+$/.test(text))
+        throw new TarballError(`Tarball header has a corrupt ${field}`);
+    return Number.parseInt(text, 8);
+}
+function verifyChecksum(header) {
+    let sum = 0;
+    for (let index = 0; index < BLOCK; index++) {
+        sum += index >= 148 && index < 156 ? 0x20 : (header[index] ?? 0);
+    }
+    if (sum !== readOctal(header, 148, 8, "checksum")) {
+        throw new TarballError("Tarball header checksum mismatch (corrupt or malicious archive)");
+    }
+}
+function parsePax(data) {
+    const result = {};
+    let offset = 0;
+    while (offset < data.length) {
+        const space = data.indexOf(0x20, offset);
+        if (space === -1)
+            break;
+        const length = Number.parseInt(data.subarray(offset, space).toString("utf8"), 10);
+        if (!Number.isFinite(length) || length <= 0 || offset + length > data.length)
+            break;
+        const record = data.subarray(space + 1, offset + length - 1).toString("utf8");
+        const equals = record.indexOf("=");
+        if (equals > 0)
+            result[record.slice(0, equals)] = record.slice(equals + 1);
+        offset += length;
+    }
+    return result;
+}
+/**
+ * Validate an entry path and strip the leading directory (`package/`) the way npm does.
+ * Throws for a path that is absolute, contains `..`, a NUL byte or a drive letter.
+ */
+export function normalizeEntryPath(raw) {
+    if (raw.includes("\0"))
+        throw new TarballError("Tarball entry path contains a NUL byte");
+    const unified = raw.replaceAll("\\", "/");
+    if (unified.startsWith("/") || /^[a-zA-Z]:/.test(unified)) {
+        throw new TarballError(`Tarball entry has an absolute path: ${JSON.stringify(raw)}`);
+    }
+    const segments = unified.split("/").filter((segment) => segment !== "" && segment !== ".");
+    if (segments.includes("..")) {
+        throw new TarballError(`Tarball entry escapes the package directory: ${JSON.stringify(raw)}`);
+    }
+    return segments.slice(1).join("/");
+}
+/** Root-level files that hold release history (`CHANGELOG.md`, `HISTORY`, `RELEASES.txt`, …). */
+const DOC_PATTERN = /^(?:changelog|changes|history|releases?|news|release[-_ ]?notes)(?:\.(?:md|markdown|txt|rst))?$/i;
+const MAX_DOC_BYTES = 2 * 1024 * 1024;
+/** Decompress and read a package tarball; see the module comment for what is refused. */
+export function readPackageTarball(bytes, limits = DEFAULT_TARBALL_LIMITS, options = {}) {
+    let archive;
+    try {
+        archive = gunzipSync(bytes, { maxOutputLength: limits.maxUnpackedBytes });
+    }
+    catch (error) {
+        const tooLarge = error instanceof RangeError ||
+            error?.code === "ERR_BUFFER_TOO_LARGE";
+        throw new TarballError(tooLarge
+            ? `Tarball expands beyond ${limits.maxUnpackedBytes} bytes (refusing a possible zip bomb)`
+            : "Tarball is not a valid gzip archive", { cause: error });
+    }
+    const files = new Map();
+    const docs = new Map();
+    const stats = {
+        entries: 0,
+        unpackedBytes: archive.length,
+        skippedLinks: 0,
+        skippedLarge: 0,
+        skippedOther: 0,
+    };
+    let manifestText;
+    let retainedBytes = 0;
+    let paxNext = {};
+    let longName;
+    let offset = 0;
+    while (offset + BLOCK <= archive.length) {
+        const header = archive.subarray(offset, offset + BLOCK);
+        if (header.every((byte) => byte === 0))
+            break;
+        verifyChecksum(header);
+        let size = readOctal(header, 124, 12, "size");
+        const type = String.fromCodePoint(header[156] || 0x30);
+        // A pax `size` record overrides the header's for the entry it describes, as it does for npm's own
+        // extractor. Ignoring it would make this reader and npm disagree about where entries start, so a
+        // package could hide a file from the radar and the agent's view.
+        if (!["x", "g", "K", "L"].includes(type) && paxNext["size"] !== undefined) {
+            const declared = Number(paxNext["size"]);
+            if (!Number.isSafeInteger(declared) || declared < 0)
+                throw new TarballError("Tarball has an invalid pax size");
+            size = declared;
+        }
+        const dataStart = offset + BLOCK;
+        const dataEnd = dataStart + size;
+        if (dataEnd > archive.length)
+            throw new TarballError("Tarball is truncated");
+        offset = dataStart + Math.ceil(size / BLOCK) * BLOCK;
+        if (type === "x") {
+            paxNext = parsePax(archive.subarray(dataStart, dataEnd));
+            continue;
+        }
+        if (type === "g" || type === "K")
+            continue;
+        if (type === "L") {
+            longName = readString(archive, dataStart, size);
+            continue;
+        }
+        stats.entries++;
+        if (stats.entries > limits.maxEntries) {
+            throw new TarballError(`Tarball has more than ${limits.maxEntries} entries`);
+        }
+        const prefix = readString(header, 345, 155);
+        const baseName = readString(header, 0, 100);
+        const rawPath = paxNext.path ?? longName ?? (prefix ? `${prefix}/${baseName}` : baseName);
+        paxNext = {};
+        longName = undefined;
+        // Validated for every entry type, so a hostile name is refused even on a link or directory.
+        const path = normalizeEntryPath(rawPath);
+        if (type === "1" || type === "2") {
+            stats.skippedLinks++;
+            continue;
+        }
+        if (type === "5")
+            continue;
+        if (type !== "0") {
+            stats.skippedOther++;
+            continue;
+        }
+        if (path === "")
+            continue;
+        if (path.split("/").includes("node_modules"))
+            continue;
+        const isManifest = path === "package.json";
+        if (options.includeDocs && DOC_PATTERN.test(path) && size <= MAX_DOC_BYTES) {
+            docs.set(path, archive.subarray(dataStart, dataEnd).toString("utf8"));
+            continue;
+        }
+        if (!isManifest && (!SOURCE_PATTERN.test(path) || MINIFIED_PATTERN.test(path)))
+            continue;
+        if (size > limits.maxFileBytes) {
+            stats.skippedLarge++;
+            continue;
+        }
+        if (!isManifest) {
+            if (files.size >= limits.maxRetainedFiles || retainedBytes + size > limits.maxRetainedBytes) {
+                stats.skippedLarge++;
+                continue;
+            }
+            retainedBytes += size;
+        }
+        const text = archive.subarray(dataStart, dataEnd).toString("utf8");
+        if (isManifest)
+            manifestText = text;
+        else
+            files.set(path, text);
+    }
+    if (manifestText === undefined)
+        throw new TarballError("Tarball has no root package.json");
+    let manifest;
+    try {
+        manifest = JSON.parse(manifestText);
+    }
+    catch (error) {
+        throw new TarballError("Tarball package.json is not valid JSON", { cause: error });
+    }
+    if (typeof manifest !== "object" || manifest === null || Array.isArray(manifest)) {
+        throw new TarballError("Tarball package.json is not an object");
+    }
+    return {
+        files,
+        manifest: manifest,
+        stats,
+        ...(options.includeDocs ? { docs } : {}),
+    };
+}
+//# sourceMappingURL=tarball.js.map

package/dist/remediation/impact/tarball.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.js","sourceRoot":"","sources":["../../../src/remediation/impact/tarball.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAevC,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,gBAAgB,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IACnC,UAAU,EAAE,MAAM;IAClB,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IAC7B,gBAAgB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAClC,gBAAgB,EAAE,IAAI;CACvB,CAAC;AAkBF,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,KAAK,GAAG,GAAG,CAAC;AAClB,MAAM,cAAc,GAAG,iCAAiC,CAAC;AACzD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C,SAAS,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc,EAAE,KAAa;IAC7E,4EAA4E;IAC5E,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,YAAY,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,YAAY,CAAC,iEAAiE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,wCAAwC,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,YAAY,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,gDAAgD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,iGAAiG;AACjG,MAAM,WAAW,GACf,kGAAkG,CAAC;AACrG,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAOtC,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,MAAM,GAAkB,sBAAsB,EAC9C,OAAO,GAAuB,EAAE;IAEhC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GACZ,KAAK,YAAY,UAAU;YAC1B,KAA2C,EAAE,IAAI,KAAK,sBAAsB,CAAC;QAChF,MAAM,IAAI,YAAY,CACpB,QAAQ;YACN,CAAC,CAAC,0BAA0B,MAAM,CAAC,gBAAgB,uCAAuC;YAC1F,CAAC,CAAC,qCAAqC,EACzC,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,KAAK,GAA0B;QACnC,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,YAAY,EAAE,CAAC;QACf,YAAY,EAAE,CAAC;QACf,YAAY,EAAE,CAAC;KAChB,CAAC;IACF,IAAI,YAAgC,CAAC;IACrC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,OAAO,GAA2B,EAAE,CAAC;IACzC,IAAI,QAA4B,CAAC;IACjC,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM;QAC9C,cAAc,CAAC,MAAM,CAAC,CAAC;QAEvB,IAAI,IAAI,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QACvD,kGAAkG;QAClG,iGAAiG;QACjG,iEAAiE;QACjE,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;YAC1E,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;gBACjD,MAAM,IAAI,YAAY,CAAC,iCAAiC,CAAC,CAAC;YAC5D,IAAI,GAAG,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,GAAG,KAAK,CAAC;QACjC,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;QACjC,IAAI,OAAO,GAAG,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAC7E,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;QAErD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC3C,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,IAAI,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,YAAY,CAAC,yBAAyB,MAAM,CAAC,UAAU,UAAU,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC1F,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,SAAS,CAAC;QACrB,4FAA4F;QAC5F,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAEzC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,KAAK,CAAC,YAAY,EAAE,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC3B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,CAAC,YAAY,EAAE,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QAEvD,MAAM,UAAU,GAAG,IAAI,KAAK,cAAc,CAAC;QAC3C,IAAI,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,aAAa,EAAE,CAAC;YAC3E,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QACzF,IAAI,IAAI,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/B,KAAK,CAAC,YAAY,EAAE,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,gBAAgB,IAAI,aAAa,GAAG,IAAI,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC5F,KAAK,CAAC,YAAY,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,aAAa,IAAI,IAAI,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,UAAU;YAAE,YAAY,GAAG,IAAI,CAAC;;YAC/B,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,kCAAkC,CAAC,CAAC;IAC3F,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,wCAAwC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,YAAY,CAAC,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,QAAmC;QAC7C,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;AACJ,CAAC"}

package/dist/remediation/impact/types.d.ts

@@ -0,0 +1,42 @@
+/** Types shared by the fix-diff and upgrade-impact analyses and exposed through the SDK. */
+export interface ParamInfo {
+    name: string;
+    optional: boolean;
+    rest: boolean;
+    /** Type annotation as source text (declaration files only). */
+    type?: string;
+}
+export interface ClassMemberInfo {
+    name: string;
+    static: boolean;
+    kind: "method" | "getter" | "setter" | "field" | "constructor";
+    params?: ParamInfo[];
+    /** Fingerprint of the member body (JavaScript analysis). */
+    fingerprint: string;
+}
+/** A package version's analysable files. */
+export interface PackageSource {
+    name: string;
+    version: string;
+    files: Map<string, string>;
+    manifest: Record<string, unknown>;
+    /** `true` when the registry's integrity digest was available and matched. */
+    integrityVerified: boolean;
+}
+export type CallSiteKind = "import" | "require" | "dynamic-import" | "reexport" | "call" | "new" | "member" | "reference" | "type-reference";
+/** A place in the project's own source that uses something from the package. */
+export interface CallSite {
+    file: string;
+    line: number;
+    kind: CallSiteKind;
+    /** The source line, trimmed and shortened. */
+    text: string;
+    /** Arguments passed, when the site is a call without spread arguments. */
+    argCount?: number;
+    /**
+     * `exact`: the project's binding to the package is followed to this site.
+     * `name-match`: only the member name matches (class members cannot be resolved without types).
+     */
+    confidence: "exact" | "name-match";
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/remediation/impact/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/remediation/impact/types.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAE5F,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IAC/D,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACrB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,6EAA6E;IAC7E,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,SAAS,GACT,gBAAgB,GAChB,UAAU,GACV,MAAM,GACN,KAAK,GACL,QAAQ,GACR,WAAW,GACX,gBAAgB,CAAC;AAErB,gFAAgF;AAChF,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,YAAY,CAAC;IACnB,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,EAAE,OAAO,GAAG,YAAY,CAAC;CACpC"}

package/dist/remediation/impact/types.js

@@ -0,0 +1,3 @@
+/** Types shared by the fix-diff and upgrade-impact analyses and exposed through the SDK. */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/remediation/impact/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/remediation/impact/types.ts"],"names":[],"mappings":"AAAA,4FAA4F"}

package/dist/remediation/impact/usage-index.d.ts

@@ -0,0 +1,28 @@
+import type { CallSite } from "./types.js";
+export interface UsageIndex {
+    packageName: string;
+    filesScanned: number;
+    filesUsingPackage: number;
+    /** Specifiers the project imports: `pkg`, `pkg/sub`. */
+    specifiers: Set<string>;
+    /** specifier -> export name (`default` for the module object itself) -> sites. */
+    exportUses: Map<string, Map<string, CallSite[]>>;
+    /** specifier -> exported class or namespace name -> member name -> sites (static members). */
+    staticMemberUses: Map<string, Map<string, Map<string, CallSite[]>>>;
+    /** specifier -> sites where the module object is used in a way that cannot be followed. */
+    opaque: Map<string, CallSite[]>;
+    /** specifier -> every `require()` and dynamic `import()` of it. */
+    requireSites: Map<string, CallSite[]>;
+    /** specifier -> every static `import` / `export from` of it. */
+    importSites: Map<string, CallSite[]>;
+    /** `.name` accesses in files that use the package, for matching class members by name only. */
+    memberNameUses: Map<string, CallSite[]>;
+}
+/** Map an import source to `pkg` or `pkg/sub`, or undefined when it is another package. */
+export declare function specifierOfSource(source: string, packageName: string): string | undefined;
+export declare function buildUsageIndex(cwd: string, packageName: string): UsageIndex;
+/** Sites using an export of a specifier; `default` and `module.exports` are the same thing. */
+export declare function sitesForExport(index: UsageIndex, specifier: string, exportName: string): CallSite[];
+export declare function sitesForStaticMember(index: UsageIndex, specifier: string, exportName: string, member: string): CallSite[];
+export declare function isUsed(index: UsageIndex, specifier: string): boolean;
+//# sourceMappingURL=usage-index.d.ts.map

package/dist/remediation/impact/usage-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-index.d.ts","sourceRoot":"","sources":["../../../src/remediation/impact/usage-index.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,QAAQ,EAAgB,MAAM,YAAY,CAAC;AAEzD,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,kFAAkF;IAClF,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACjD,8FAA8F;IAC9F,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,2FAA2F;IAC3F,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChC,mEAAmE;IACnE,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtC,gEAAgE;IAChE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrC,+FAA+F;IAC/F,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;CACzC;AAiCD,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQzF;AA0BD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,CA6B5E;AA4SD,+FAA+F;AAC/F,wBAAgB,cAAc,CAC5B,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,QAAQ,EAAE,CAMZ;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,QAAQ,EAAE,CAEZ;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAEpE"}