codictator 0.0.0 → 0.1.2

package/dist/features/deps/npmrc.js

@@ -0,0 +1,50 @@
+// Owned `.npmrc` entry (§6.1): save-exact=true. Scoped registries name the
+// hosts config.network.registries must allow (EC-8).
+export const NPM_PUBLIC_REGISTRY_HOST = "registry.npmjs.org";
+function parseNpmrcLine(line, saveExact, registries) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#") || trimmed.startsWith(";")) {
+        return;
+    }
+    const equals = trimmed.indexOf("=");
+    if (equals < 0) {
+        return;
+    }
+    const key = trimmed.slice(0, equals).trim();
+    const value = trimmed.slice(equals + 1).trim();
+    if (key === "save-exact") {
+        saveExact.value = value === "true";
+        return;
+    }
+    const scoped = /^@([^:]+):registry$/.exec(key);
+    if (key !== "registry" && scoped === null) {
+        return;
+    }
+    let host = "";
+    try {
+        host = new URL(value).hostname.toLowerCase();
+    }
+    catch {
+        return;
+    }
+    registries.push({ scope: scoped?.[1], host, url: value });
+}
+export function parseNpmrc(text) {
+    const saveExact = { value: undefined };
+    const registries = [];
+    for (const line of text.split("\n")) {
+        parseNpmrcLine(line, saveExact, registries);
+    }
+    return { saveExact: saveExact.value, registries };
+}
+// SPEC §4.8.8 EC-8: a non-public registry host must arrive through
+// config.network.registries; otherwise CDX-E702 and block.
+export function privateRegistryHosts(config) {
+    const hosts = [];
+    for (const ref of config.registries) {
+        if (ref.host !== NPM_PUBLIC_REGISTRY_HOST && !hosts.includes(ref.host)) {
+            hosts.push(ref.host);
+        }
+    }
+    return hosts.sort();
+}

package/dist/features/deps/nuget.d.ts

@@ -0,0 +1,25 @@
+import { type Result } from "../../kernel/index.ts";
+export declare const NUGET_ECOSYSTEM = "nuget";
+export type NuGetDepKind = "prod" | "dev" | "toolchain";
+export interface NuGetDependency {
+    readonly name: string;
+    readonly version: string;
+    readonly kind: NuGetDepKind;
+}
+export type NuGetPinForm = "exact" | "range" | "floating";
+export declare function classifyNuGetRange(range: string): NuGetPinForm;
+export declare function isExactNuGetPin(range: string): boolean;
+export interface CsprojPackageRef {
+    readonly name: string;
+    readonly version: string | undefined;
+}
+export declare function parseCsprojPackageRefs(text: string): Array<CsprojPackageRef>;
+export declare function csprojInlineVersions(text: string): Array<CsprojPackageRef>;
+export declare function parseDirectoryPackagesProps(text: string): Record<string, string>;
+export interface DotnetToolchain {
+    readonly sdkVersion: string | undefined;
+    readonly rollForward: string | undefined;
+}
+export declare function parseGlobalJson(text: string): Result<DotnetToolchain>;
+export declare function isExactDotnetSdk(version: string | undefined): boolean;
+export declare function isPinnedRollForward(value: string | undefined): boolean;

package/dist/features/deps/nuget.js

@@ -0,0 +1,112 @@
+// SPEC §6.2 driver `nuget`: manifest parsing, exact-pin forms and toolchain
+// files. Lockfile sync and verdicts stay at the enforcer layer, mirroring
+// the npm driver split (manifest logic here, sync in lockfile.ts). All
+// parsing here is pure over caller-supplied text; a Driver instance that
+// reads the repo waits for gate-closure wiring with ports (SPEC §3.3).
+import { err, makeError, ok, parseJson, } from "../../kernel/index.js";
+import { isJsonRecord, recordField, stringField } from "./fields.js";
+export const NUGET_ECOSYSTEM = "nuget";
+const NUGET_EXACT = /^\d+\.\d+\.\d+(?:\.\d+)?(?:-[0-9A-Za-z.-]+)?$/;
+// The fourth numeric part is a .NET build revision, not a range, so it still pins exact.
+export function classifyNuGetRange(range) {
+    const trimmed = range.trim();
+    if (NUGET_EXACT.test(trimmed)) {
+        return "exact";
+    }
+    if (trimmed.includes("*") ||
+        trimmed.startsWith("[") ||
+        trimmed.startsWith("(")) {
+        return "floating";
+    }
+    return "range";
+}
+// SPEC §4.8.5: ranges and floating versions block core/dep-exact-pin.
+export function isExactNuGetPin(range) {
+    return classifyNuGetRange(range) === "exact";
+}
+const ATTR_PATTERN = /([\w.-]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
+function attrOf(tag, name) {
+    const matches = tag.matchAll(ATTR_PATTERN);
+    for (const match of matches) {
+        if (match[1] === name) {
+            return match[2] ?? match[3];
+        }
+    }
+    return undefined;
+}
+const PACKAGE_REF_PATTERN = /<PackageReference\b([^>]*?)(?:\/>|>([\s\S]*?)<\/PackageReference\s*>|>)/g;
+function childVersionOf(body) {
+    const match = /<Version\s*>\s*([^<]*?)\s*<\/Version\s*>/.exec(body);
+    const version = (match?.[1] ?? "").trim();
+    return version === "" ? undefined : version;
+}
+// SPEC §6.2: every PackageReference the build restores. An inline Version
+// reads from the attribute or the `<Version>` child element, so EC-6
+// rejects both XML forms; centrally managed projects carry no Version here.
+export function parseCsprojPackageRefs(text) {
+    const refs = [];
+    const tags = text.matchAll(PACKAGE_REF_PATTERN);
+    for (const tag of tags) {
+        const attrs = tag[1] ?? "";
+        const body = tag[2] ?? "";
+        const name = attrOf(attrs, "Include");
+        if (name === undefined || name === "") {
+            continue;
+        }
+        refs.push({
+            name,
+            version: attrOf(attrs, "Version") ?? childVersionOf(body),
+        });
+    }
+    // Document order is deterministic, so the scan order is the verdict
+    // order without a re-sort.
+    return refs;
+}
+// SPEC §6.4 EC-6: an inline Version on PackageReference is not centrally
+// managed; the fix names Directory.Packages.props.
+export function csprojInlineVersions(text) {
+    return parseCsprojPackageRefs(text).filter((ref) => ref.version !== undefined);
+}
+const PACKAGE_VERSION_PATTERN = /<PackageVersion\b[^>]*>/g;
+// SPEC §6.2 central package management: Directory.Packages.props pins every
+// version in one place as <PackageVersion Include Version="x.y.z" />.
+export function parseDirectoryPackagesProps(text) {
+    const versions = {};
+    const tags = text.matchAll(PACKAGE_VERSION_PATTERN);
+    for (const tag of tags) {
+        const markup = tag[0] ?? "";
+        const name = attrOf(markup, "Include");
+        const version = attrOf(markup, "Version");
+        if (name !== undefined && name !== "" && version !== undefined) {
+            versions[name] = version;
+        }
+    }
+    // Document order is deterministic, so insertion order is the verdict
+    // order without a re-sort.
+    return versions;
+}
+// SPEC §6.2 toolchain: global.json names the sdk version and its roll
+// policy; both ride the verdict path as toolchain dependencies.
+export function parseGlobalJson(text) {
+    const parsed = parseJson(text);
+    if (!parsed.ok) {
+        return err(parsed.error);
+    }
+    if (!isJsonRecord(parsed.value)) {
+        return err(makeError("CDX-E101", "global.json must hold a JSON object at its root", "Point the toolchain file at the sdk object."));
+    }
+    const sdk = recordField(parsed.value, "sdk");
+    return ok({
+        sdkVersion: sdk === undefined ? undefined : stringField(sdk, "version"),
+        rollForward: sdk === undefined ? undefined : stringField(sdk, "rollForward"),
+    });
+}
+// SPEC §6.2: the sdk version is exact like any other pin.
+export function isExactDotnetSdk(version) {
+    return version !== undefined && NUGET_EXACT.test(version.trim());
+}
+// SPEC §6.2: only a disabled roll-forward keeps the toolchain exact; any
+// other policy floats across sdk lines.
+export function isPinnedRollForward(value) {
+    return value === "disable";
+}

package/dist/features/deps/osv-ranges.d.ts

@@ -0,0 +1,12 @@
+export interface OsvEvent {
+    readonly introduced: string;
+    readonly fixed: string | undefined;
+    readonly lastAffected: string | undefined;
+}
+export interface OsvRange {
+    readonly type: string;
+    readonly events: ReadonlyArray<OsvEvent>;
+}
+export declare function narrowOsvRanges(value: unknown): ReadonlyArray<OsvRange>;
+export declare function osvRangeAffectsVersion(range: OsvRange, version: string): boolean;
+export declare function osvAdvisoryAffects(ranges: ReadonlyArray<OsvRange>, version: string): boolean;

package/dist/features/deps/osv-ranges.js

@@ -0,0 +1,83 @@
+// OSV affected-range semantics: a range hits the versions between introduced
+// (inclusive) and fixed (exclusive), or at/below last_affected when no fix is
+// recorded. Withdrawing an advisory removes it from querybatch (EC-11).
+import { field, isJsonRecord, stringField } from "./fields.js";
+import { compareNpmVersions, parseNpmVersion } from "./stable.js";
+function narrowEvents(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    const events = [];
+    for (const entry of value) {
+        if (!isJsonRecord(entry)) {
+            continue;
+        }
+        events.push({
+            introduced: stringField(entry, "introduced") ?? "0",
+            fixed: stringField(entry, "fixed"),
+            lastAffected: stringField(entry, "last_affected"),
+        });
+    }
+    return events;
+}
+export function narrowOsvRanges(value) {
+    if (!isJsonRecord(value)) {
+        return [];
+    }
+    const affected = field(value, "affected");
+    if (!Array.isArray(affected)) {
+        return [];
+    }
+    const ranges = [];
+    for (const entry of affected) {
+        if (!isJsonRecord(entry)) {
+            continue;
+        }
+        const list = field(entry, "ranges");
+        if (!Array.isArray(list)) {
+            continue;
+        }
+        for (const range of list) {
+            if (!isJsonRecord(range)) {
+                continue;
+            }
+            ranges.push({
+                type: stringField(range, "type") ?? "",
+                events: narrowEvents(field(range, "events")),
+            });
+        }
+    }
+    return ranges;
+}
+export function osvRangeAffectsVersion(range, version) {
+    const parsed = parseNpmVersion(version);
+    if (parsed === undefined) {
+        return false;
+    }
+    for (const event of range.events) {
+        const introduced = parseNpmVersion(event.introduced);
+        if (introduced !== undefined &&
+            compareNpmVersions(parsed, introduced) < 0) {
+            continue;
+        }
+        if (event.fixed !== undefined) {
+            const fixed = parseNpmVersion(event.fixed);
+            if (fixed !== undefined && compareNpmVersions(parsed, fixed) < 0) {
+                return true;
+            }
+            continue;
+        }
+        if (event.lastAffected !== undefined) {
+            const last = parseNpmVersion(event.lastAffected);
+            if (last !== undefined && compareNpmVersions(parsed, last) <= 0) {
+                return true;
+            }
+            continue;
+        }
+        return true;
+    }
+    return false;
+}
+export function osvAdvisoryAffects(ranges, version) {
+    return ranges.some((range) => osvRangeAffectsVersion(range, version));
+}

package/dist/features/deps/osv.d.ts

@@ -0,0 +1,16 @@
+import { type Net, type Result } from "../../kernel/index.ts";
+import { type OsvRange } from "./osv-ranges.ts";
+export declare const OSV_BASE_URL = "https://api.osv.dev";
+export type { OsvEvent, OsvRange } from "./osv-ranges.ts";
+export { narrowOsvRanges, osvAdvisoryAffects, osvRangeAffectsVersion, } from "./osv-ranges.ts";
+export interface OsvFetchOptions {
+    readonly baseUrl?: string;
+    readonly timeoutMs?: number;
+    readonly retries?: number;
+    readonly sleep?: (ms: number) => Promise<void>;
+}
+export declare const OSV_TIMEOUT_MS = 30000;
+export declare function isRetryableStatus(status: number): boolean;
+export declare function retryDelaysMs(): ReadonlyArray<number>;
+export declare function fetchOsvAdvisoryIds(net: Net, ecosystem: string, name: string, version: string, options?: OsvFetchOptions): Promise<Result<ReadonlyArray<string>>>;
+export declare function fetchOsvRanges(net: Net, id: string, options?: OsvFetchOptions): Promise<Result<ReadonlyArray<OsvRange>>>;

package/dist/features/deps/osv.js

@@ -0,0 +1,144 @@
+// SPEC §4.8.2: OSV advisories over the Net port. One advisory source covers
+// every ecosystem; the query goes to querybatch and affected ranges resolve
+// through the vuln detail, so withdrawn advisories clear on fresh fetch
+// (EC-11) without any stored state here.
+import { err, makeError, ok, parseJson, } from "../../kernel/index.js";
+import { field, isJsonRecord, stringField } from "./fields.js";
+import { narrowOsvRanges } from "./osv-ranges.js";
+export const OSV_BASE_URL = "https://api.osv.dev";
+export { narrowOsvRanges, osvAdvisoryAffects, osvRangeAffectsVersion, } from "./osv-ranges.js";
+function narrowIdList(value) {
+    if (!isJsonRecord(value)) {
+        return [];
+    }
+    const vulns = field(value, "vulns");
+    if (!Array.isArray(vulns)) {
+        return [];
+    }
+    const ids = [];
+    for (const entry of vulns) {
+        if (isJsonRecord(entry)) {
+            const id = stringField(entry, "id");
+            if (id !== undefined) {
+                ids.push(id);
+            }
+        }
+    }
+    return ids;
+}
+export const OSV_TIMEOUT_MS = 30_000;
+// SPEC §4.8.8 EC-5: retryable statuses retry with backoff, then CDX-E401 and
+// block (fail closed). Sleep is injected so tests never wait on the clock.
+export function isRetryableStatus(status) {
+    return status === 429 || (status >= 500 && status <= 599);
+}
+export function retryDelaysMs() {
+    return [1000, 4000];
+}
+function advisoryError(message, remediation) {
+    return err(makeError("CDX-E401", message, remediation));
+}
+async function postJson(net, url, body, options) {
+    const retries = options.retries ?? retryDelaysMs().length;
+    const delays = retryDelaysMs();
+    let attempt = 0;
+    for (;;) {
+        const sent = await net.request({
+            method: "POST",
+            url,
+            headers: { "content-type": "application/json" },
+            body,
+            timeoutMs: options.timeoutMs ?? OSV_TIMEOUT_MS,
+        });
+        if (!sent.ok) {
+            return err(sent.error);
+        }
+        const response = sent.value;
+        if (response.status === 200) {
+            return ok(response.body);
+        }
+        if (isRetryableStatus(response.status) && attempt < retries) {
+            const delay = delays[Math.min(attempt, delays.length - 1)] ?? 1000;
+            if (options.sleep !== undefined) {
+                await options.sleep(delay);
+            }
+            attempt += 1;
+            continue;
+        }
+        return advisoryError(`OSV query failed with status ${String(response.status)} for ${url}`, "Retry the sweep; if OSV stays unavailable the run blocks fail-closed.");
+    }
+}
+async function getJson(net, url, options) {
+    const retries = options.retries ?? retryDelaysMs().length;
+    const delays = retryDelaysMs();
+    let attempt = 0;
+    for (;;) {
+        const sent = await net.request({
+            method: "GET",
+            url,
+            headers: {},
+            timeoutMs: options.timeoutMs ?? OSV_TIMEOUT_MS,
+        });
+        if (!sent.ok) {
+            return err(sent.error);
+        }
+        const response = sent.value;
+        if (response.status === 200) {
+            return ok(response.body);
+        }
+        if (isRetryableStatus(response.status) && attempt < retries) {
+            const delay = delays[Math.min(attempt, delays.length - 1)] ?? 1000;
+            if (options.sleep !== undefined) {
+                await options.sleep(delay);
+            }
+            attempt += 1;
+            continue;
+        }
+        return advisoryError(`OSV fetch failed with status ${String(response.status)} for ${url}`, "Retry the sweep; if OSV stays unavailable the run blocks fail-closed.");
+    }
+}
+// SPEC §4.8.2: querybatch first, then one vuln fetch per id for the affected
+// ranges. Withdrawn ids vanish from querybatch, clearing the finding (EC-11).
+export async function fetchOsvAdvisoryIds(net, ecosystem, name, version, options = {}) {
+    const base = options.baseUrl ?? OSV_BASE_URL;
+    const queried = await postJson(net, `${base}/v1/querybatch`, JSON.stringify({
+        queries: [{ package: { name, ecosystem }, version }],
+    }), options);
+    if (!queried.ok) {
+        return err(queried.error);
+    }
+    const parsed = parseJson(queried.value);
+    if (!parsed.ok) {
+        return err(parsed.error);
+    }
+    if (!isJsonRecord(parsed.value)) {
+        return ok([]);
+    }
+    const results = field(parsed.value, "results");
+    if (!Array.isArray(results)) {
+        return ok([]);
+    }
+    const ids = [];
+    for (const entry of results) {
+        if (isJsonRecord(entry)) {
+            for (const id of narrowIdList({ vulns: field(entry, "vulns") })) {
+                if (!ids.includes(id)) {
+                    ids.push(id);
+                }
+            }
+        }
+    }
+    return ok(ids.sort());
+}
+export async function fetchOsvRanges(net, id, options = {}) {
+    const base = options.baseUrl ?? OSV_BASE_URL;
+    const fetched = await getJson(net, `${base}/v1/vulns/${id}`, options);
+    if (!fetched.ok) {
+        return err(fetched.error);
+    }
+    const parsed = parseJson(fetched.value);
+    if (!parsed.ok) {
+        return err(parsed.error);
+    }
+    return ok(narrowOsvRanges(parsed.value));
+}

package/dist/features/deps/pypi-pyproject.d.ts

@@ -0,0 +1,7 @@
+import { type Result } from "../../kernel/index.ts";
+import { type PyPiDependency } from "./pypi.ts";
+export interface PyProjectDeps {
+    readonly dependencies: ReadonlyArray<PyPiDependency>;
+    readonly requiresPython: string | undefined;
+}
+export declare function parsePyprojectDependencies(text: string): Result<PyProjectDeps>;

package/dist/features/deps/pypi-pyproject.js

@@ -0,0 +1,118 @@
+// SPEC §6.3 driver `pypi` (pyproject half): the `[project]` table of
+// pyproject.toml with its `requires-python` floor. Shares the PEP 508
+// split, pin forms and error shape with pypi.ts; everything here is pure
+// over caller-supplied text, mirroring the npm driver split across modules.
+import { err, ok } from "../../kernel/index.js";
+import { depParseError, sortByName, splitRequirement, stripComment, } from "./pypi.js";
+function sectionHeader(line) {
+    const match = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/.exec(line);
+    if (match === null) {
+        return undefined;
+    }
+    return (match[1] ?? "").trim();
+}
+function quotedStrings(chunk) {
+    const out = [];
+    const pattern = /"((?:[^"\\]|\\.)*)"|'([^']*)'/g;
+    const matches = chunk.matchAll(pattern);
+    for (const match of matches) {
+        out.push(match[1] ?? match[2] ?? "");
+    }
+    return out;
+}
+function arrayStartKey(line) {
+    const match = /^([A-Za-z0-9_.-]+)\s*=\s*\[/.exec(line);
+    return match === null ? undefined : match[1];
+}
+// Brackets inside quoted requirement strings (extras such as
+// `requests[security]`) always balance, so raw depth tracking closes the
+// array at the first `]` that returns the depth to zero.
+function isCompleteArray(chunk) {
+    let depth = 0;
+    for (const char of chunk) {
+        if (char === "[") {
+            depth += 1;
+        }
+        else if (char === "]" && depth > 0) {
+            depth -= 1;
+            if (depth === 0) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function pushChunk(deps, chunk, kind) {
+    // PEP 735 `{include-group = "..."}` entries name another group, not a
+    // package, so their quoted strings never reach the requirement split.
+    const withoutIncludes = chunk.replace(/\{[^}]*\}/g, "");
+    for (const entry of quotedStrings(withoutIncludes)) {
+        const req = splitRequirement(entry);
+        if (req === undefined) {
+            return depParseError("pyproject.toml dependency entry is not a requirement string", "Write the entry as a PEP 508 requirement string.");
+        }
+        deps.push({ name: req.name, spec: req.spec, kind });
+    }
+    return ok(undefined);
+}
+function stepHeader(chunk, header) {
+    if (chunk !== "") {
+        return depParseError("pyproject.toml dependencies array never closes", "Close the dependencies array with ].");
+    }
+    return ok(header);
+}
+function stepChunk(deps, chunk, line, kind) {
+    const next = `${chunk}${line}\n`;
+    if (!isCompleteArray(next)) {
+        return ok(next);
+    }
+    const pushed = pushChunk(deps, next, kind);
+    if (!pushed.ok) {
+        return err(pushed.error);
+    }
+    return ok("");
+}
+function readRequiresPython(section, line) {
+    if (section !== "project" || !line.startsWith("requires-python")) {
+        return undefined;
+    }
+    return quotedStrings(line)[0];
+}
+// SPEC §6.3: `[project]` dependencies with the `requires-python` floor,
+// plus PEP 735 `[dependency-groups]` (as dev; `[project.optional-...]`
+// tables ride a later change). An unclosed array fails closed instead of
+// parsing half a manifest. The sentinel header closes the file through the
+// section-change error, so a dangling array needs no second trailing check.
+export function parsePyprojectDependencies(text) {
+    const lines = [...text.split("\n"), "[__end__]"];
+    const deps = [];
+    let requiresPython;
+    let section = "";
+    let chunk = "";
+    for (const raw of lines) {
+        const line = stripComment(raw).trim();
+        const header = sectionHeader(line);
+        if (header !== undefined) {
+            const stepped = stepHeader(chunk, header);
+            if (!stepped.ok) {
+                return err(stepped.error);
+            }
+            section = stepped.value;
+            continue;
+        }
+        if (section !== "project" && section !== "dependency-groups") {
+            continue;
+        }
+        if (chunk === "" && arrayStartKey(line) === undefined) {
+            requiresPython = readRequiresPython(section, line) ?? requiresPython;
+            continue;
+        }
+        const stepped = stepChunk(deps, chunk, line, section === "dependency-groups" ? "dev" : "prod");
+        if (!stepped.ok) {
+            return err(stepped.error);
+        }
+        chunk = stepped.value;
+    }
+    sortByName(deps);
+    return ok({ dependencies: deps, requiresPython });
+}

package/dist/features/deps/pypi.d.ts

@@ -0,0 +1,29 @@
+import { type Result } from "../../kernel/index.ts";
+export declare const PYPI_ECOSYSTEM = "pypi";
+export type PyPiDepKind = "prod" | "dev" | "toolchain";
+export interface PyPiDependency {
+    readonly name: string;
+    readonly spec: string;
+    readonly kind: PyPiDepKind;
+}
+export type PyPiPinForm = "exact" | "range" | "url";
+export declare function isExactPyPiPin(spec: string): boolean;
+export declare function classifyPyPiSpec(spec: string): PyPiPinForm;
+export interface PyPiRequirement {
+    readonly name: string;
+    readonly spec: string;
+    readonly hashes: ReadonlyArray<string>;
+}
+export declare function stripComment(line: string): string;
+export declare function splitRequirement(line: string): {
+    readonly name: string;
+    readonly spec: string;
+} | undefined;
+export declare function sortByName<T extends {
+    name: string;
+}>(items: Array<T>): void;
+export declare function depParseError(message: string, fix: string): Result<never>;
+export declare function parseRequirementsText(text: string): Result<Array<PyPiRequirement>>;
+export declare function requirementsFullyPinned(reqs: ReadonlyArray<PyPiRequirement>): boolean;
+export declare function parsePythonVersionFile(text: string): string;
+export declare function isExactPythonVersion(version: string): boolean;