dsh-standards 1.0.2 → 1.1.2

package/40-checker/test/checks.test.mjs

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { runManifestChecks } from '../src/manifest.mjs'
-import { checkCapabilities, checkCredentials, checkLabels } from '../src/declarations.mjs'
+import { checkCapabilities, checkCredentials, checkImportTimeAdvisory, checkLabels } from '../src/declarations.mjs'
 import { readSources } from '../src/util.mjs'
 import { buildReport } from '../src/report.mjs'
 import { parseInstallSpec } from '../src/install-spec.mjs'
@@ -21,6 +21,14 @@ test('good fixture passes manifest and version checks', () => {
   assert.equal(result.checks[2].result, 'NA')
 })
 
+test('patch-only bundle reports C-1.2 as NA, not WARN', () => {
+  const result = runManifestChecks(path.join(here, '..', 'fixtures', 'bundle-patch-only'))
+  const dsc01 = result.checks.find((check) => check.id === 'DSC-01')
+  const entry = dsc01.details.find((detail) => detail.item === 'C-1.2')
+  assert.equal(entry.result, 'NA')
+  assert.match(entry.reason, /patch-only bundle/)
+})
+
 test('bad fixture fails version and warns licence', () => {
   const result = runManifestChecks(bad)
   assert.equal(result.checks[0].result, 'WARN')
@@ -170,3 +178,237 @@ test('entry: static claim recognizes without runtime', () => {
   assert.equal(report.conclusion.level, 'DSH-ENTRY recognized')
   assert.equal(report.conclusion.exitCode, 0)
 })
+
+test('DSC-10.4: flags a module-scope fs mutation in the entry module', () => {
+  const dir = path.join(here, '..', 'fixtures', 'import-side-effect')
+  const result = runManifestChecks(dir)
+  const check = checkImportTimeAdvisory(readSources(dir), result.entry?.relative)
+  assert.equal(check.result, 'WARN', check.reason)
+  assert.ok(check.details.some((detail) => /top-level fs mutation/.test(detail.reason)), JSON.stringify(check.details))
+})
+
+test('DSC-10.4: ignores a module-scope fs mutation outside the entry module', () => {
+  const dir = path.join(here, '..', 'fixtures', 'import-side-effect-nonentry')
+  const result = runManifestChecks(dir)
+  const check = checkImportTimeAdvisory(readSources(dir), result.entry?.relative)
+  assert.equal(check.result, 'PASS', check.reason)
+})
+
+test('DSC-10.4: a clean entry module still passes', () => {
+  const result = runManifestChecks(good)
+  const check = checkImportTimeAdvisory(readSources(good), result.entry?.relative)
+  assert.equal(check.result, 'PASS', check.reason)
+})
+
+test('DSC-10.1/2: the existing patterns are entry-scoped too', () => {
+  const dir = path.join(here, '..', 'fixtures', 'import-side-effect-nonentry')
+  const result = runManifestChecks(dir)
+  const check = checkImportTimeAdvisory(readSources(dir), result.entry?.relative)
+  assert.equal(check.result, 'PASS', check.reason)
+})
+
+test('DSC-10.4: a read-only openSync is not a write mutation', () => {
+  const dir = path.join(here, '..', 'fixtures', 'import-open-readonly')
+  const result = runManifestChecks(dir)
+  const check = checkImportTimeAdvisory(readSources(dir), result.entry?.relative)
+  assert.equal(check.result, 'PASS', check.reason)
+})
+
+test('DSC-10: no source files is NA, not WARN', () => {
+  const dir = path.join(here, '..', 'fixtures', 'no-source')
+  const check = checkImportTimeAdvisory(readSources(dir), 'index.mjs')
+  assert.equal(check.result, 'NA', check.reason)
+  assert.match(check.reason, /no source/)
+})
+
+test('DSC-10.2: flags an immediate module-scope void main()', () => {
+  const dir = path.join(here, '..', 'fixtures', 'import-void-main')
+  const result = runManifestChecks(dir)
+  const check = checkImportTimeAdvisory(readSources(dir), result.entry?.relative)
+  assert.equal(check.result, 'WARN', check.reason)
+  assert.ok(check.details.some((detail) => /immediate main/.test(detail.reason)), JSON.stringify(check.details))
+})
+
+test('DSC-10.1/2: AST catches top-level await, timer, process hooks and globals', () => {
+  const text = [
+    "await Promise.resolve()",
+    'for await (const item of []) {}',
+    "setInterval(() => {}, 1000)",
+    "process.on('SIGINT', () => {})",
+    "process.env.DSH_FIXTURE = '1'",
+    'globalThis.__dshFixture = true',
+  ].join('\n')
+  const check = checkImportTimeAdvisory([{ relative: 'index.mjs', text }], 'index.mjs')
+  assert.equal(check.result, 'WARN', check.reason)
+  assert.equal(check.details.filter((detail) => /top-level await/.test(detail.reason)).length, 2)
+  for (const pattern of ['top-level setInterval', 'top-level process.on', 'top-level process.env assignment', 'top-level globalThis assignment']) {
+    assert.ok(check.details.some((detail) => detail.reason.includes(pattern)), `${pattern}: ${JSON.stringify(check.details)}`)
+  }
+})
+
+test('DSC-10.4: member fs writes and module-scope control flow count', () => {
+  const text = [
+    "import * as fs from 'node:fs'",
+    'if (process.env.DSH_FIXTURE) {',
+    "  fs.writeFileSync('/tmp/dsh-fixture-member-write.txt', 'x')",
+    '}',
+  ].join('\n')
+  const check = checkImportTimeAdvisory([{ relative: 'index.mjs', text }], 'index.mjs')
+  assert.equal(check.result, 'WARN', check.reason)
+  assert.ok(check.details.some((detail) => /top-level fs mutation/.test(detail.reason)), JSON.stringify(check.details))
+})
+
+test('DSC-10: function, arrow and class-method bodies are not module-scope side effects', () => {
+  const text = [
+    "function a() { writeFileSync('/tmp/a', 'x') }",
+    "const b = () => spawnSync('cmd')",
+    "class C { m() { process.on('x', () => {}) } }",
+    'const d = { n() { setInterval(() => {}, 1) } }',
+  ].join('\n')
+  const check = checkImportTimeAdvisory([{ relative: 'index.mjs', text }], 'index.mjs')
+  assert.equal(check.result, 'PASS', check.reason)
+})
+
+test('DSC-12 C-12.4: ignores comment-only literals', () => {
+  const dir = path.join(here, '..', 'fixtures', 'c12-comment')
+  const check = checkCredentials({}, readSources(dir))
+  assert.equal(check.result, 'PASS', check.reason)
+})
+
+test('DSC-12 C-12.4: ignores equality comparisons', () => {
+  const dir = path.join(here, '..', 'fixtures', 'c12-compare')
+  const check = checkCredentials({}, readSources(dir))
+  assert.equal(check.result, 'PASS', check.reason)
+})
+
+test('DSC-12 C-12.4: still flags an actual set() grant', () => {
+  const dir = path.join(here, '..', 'fixtures', 'c12-grant')
+  const check = checkCredentials({}, readSources(dir))
+  assert.equal(check.result, 'WARN', check.reason)
+  assert.ok(check.details.some((detail) => detail.item === 'C-12.4'), JSON.stringify(check.details))
+})
+
+test('DSC-12 C-12.4: console-only documentation string is not a grant', () => {
+  const dir = path.join(here, '..', 'fixtures', 'c12-string')
+  const check = checkCredentials({}, readSources(dir))
+  assert.equal(check.result, 'PASS', check.reason)
+  assert.ok(!check.details.some((detail) => detail.item === 'C-12.4'), JSON.stringify(check.details))
+})
+
+test('DSC-12 C-12.4: console/desc documentation strings are not grants', () => {
+  const dir = path.join(here, '..', 'fixtures', 'c12-doc-string')
+  const check = checkCredentials({}, readSources(dir))
+  assert.equal(check.result, 'PASS', check.reason)
+  assert.ok(!check.details.some((detail) => detail.item === 'C-12.4'), JSON.stringify(check.details))
+})
+
+test('DSC-11 C-11.4: console/desc documentation strings are not danger literals', () => {
+  const dir = path.join(here, '..', 'fixtures', 'c12-doc-string')
+  const check = checkCapabilities({}, readSources(dir))
+  assert.ok(!check.details.some((detail) => detail.item === 'C-11.4'), JSON.stringify(check.details))
+})
+
+test('DSC-11 C-11.4: --add-dir alone is a C-12.4 concern, not C-11.4', () => {
+  const sources = [{ relative: 'index.mjs', text: "spawn('dsh', ['--add-dir', './docs'])\n" }]
+  const check = checkCapabilities({}, sources)
+  assert.ok(!check.details.some((detail) => detail.item === 'C-11.4'), JSON.stringify(check.details))
+})
+
+test('DSC-12 C-12.4: spawn args with --add-dir are a real command string', () => {
+  const dir = path.join(here, '..', 'fixtures', 'c12-command-arg')
+  const check = checkCredentials({}, readSources(dir))
+  assert.equal(check.result, 'WARN', check.reason)
+  assert.ok(check.details.some((detail) => detail.item === 'C-12.4'), JSON.stringify(check.details))
+})
+
+test('DSC-12 C-12.4: set/resolve/mode/switch contexts are real grants', () => {
+  const text = [
+    "svc.set(session, 'danger-full-access')",
+    "svc.resolve('danger-full-access')",
+    "const policy = { sandboxPolicy: { mode: 'danger-full-access' } }",
+    "switch (mode) { case 'danger-full-access': break }",
+  ].join('\n')
+  const check = checkCredentials({}, [{ relative: 'index.mjs', text }])
+  assert.equal(check.result, 'WARN', check.reason)
+  const detail = check.details.find((item) => item.item === 'C-12.4')
+  assert.ok(detail, JSON.stringify(check.details))
+  assert.match(detail.reason, /\b4\b/)
+})
+
+test('DSC-12 C-12.4: nested command properties outrank documentation keys', () => {
+  const check = checkCredentials({}, [{ relative: 'index.mjs', text: "const policy = { sandboxPolicy: { description: 'danger-full-access' } }\n" }])
+  assert.equal(check.result, 'WARN', check.reason)
+})
+
+test('DSC-12 C-12.4: an unknown context stays a conservative warning', () => {
+  const check = checkCredentials({}, [{ relative: 'index.mjs', text: "const mode = 'danger-full-access'\n" }])
+  assert.equal(check.result, 'WARN', check.reason)
+})
+
+test('DSC-12 C-12.4: an unparsable source is not-run, not PASS', () => {
+  const check = checkCredentials({}, [{ relative: 'index.mjs', text: 'const broken = {\n' }])
+  assert.equal(check.result, 'ERROR', check.reason)
+  assert.equal(check.coverage, 'not-run')
+  assert.ok(check.details.some((detail) => detail.item === 'C-12.4' && /not-run/.test(detail.reason)), JSON.stringify(check.details))
+})
+
+test('DSC-10.3: follows a local relative import and flags its top-level fs mutation', () => {
+  const dir = path.join(here, '..', 'fixtures', 'import-local-side-effect')
+  const result = runManifestChecks(dir)
+  const check = checkImportTimeAdvisory(readSources(dir), result.entry?.relative)
+  assert.equal(check.result, 'WARN', check.reason)
+  assert.ok(check.details.some((detail) => /top-level fs mutation/.test(detail.reason) && /side-effectful\.mjs/.test(detail.reason)), JSON.stringify(check.details))
+})
+
+test('DSC-10.3: a package-only entry is PASS with a C-10.3 not-run coverage note', () => {
+  const dir = path.join(here, '..', 'fixtures', 'import-package-only')
+  const result = runManifestChecks(dir)
+  const check = checkImportTimeAdvisory(readSources(dir), result.entry?.relative)
+  assert.equal(check.result, 'PASS', check.reason)
+  const note = check.details.find((detail) => detail.item === 'C-10.3')
+  assert.ok(note, JSON.stringify(check.details))
+  assert.match(note.reason, /not-run/)
+  assert.match(note.reason, /node:path/)
+})
+
+test('DSC-10.3: an unresolved local import records not-run without becoming a WARN', () => {
+  const sources = [{ relative: 'index.mjs', text: "import './missing-module.mjs'\n" }]
+  const check = checkImportTimeAdvisory(sources, 'index.mjs')
+  assert.equal(check.result, 'PASS', check.reason)
+  assert.ok(check.details.some((detail) => detail.item === 'C-10.3' && /not-run/.test(detail.reason)), JSON.stringify(check.details))
+})
+
+test('DSC-10.3: a require inside a function is not an import-time edge', () => {
+  const sources = [
+    { relative: 'index.mjs', text: "function load() { return require('./side-effectful.mjs') }\n" },
+    { relative: 'side-effectful.mjs', text: "writeFileSync('/tmp/x', 'x')\n" },
+  ]
+  const check = checkImportTimeAdvisory(sources, 'index.mjs')
+  assert.equal(check.result, 'PASS', check.reason)
+  assert.ok(!check.details.some((detail) => /side-effectful/.test(detail.reason)), JSON.stringify(check.details))
+})
+
+test('DSC-10: an unparsable entry is ERROR/not-run, not PASS', () => {
+  const dir = path.join(here, '..', 'fixtures', 'import-parse-error')
+  const result = runManifestChecks(dir)
+  const check = checkImportTimeAdvisory(readSources(dir), result.entry?.relative)
+  assert.equal(check.result, 'ERROR', check.reason)
+  assert.equal(check.coverage, 'not-run')
+})
+
+test('DSC-10/DSC-12: a broken .d.ts is skipped, not ERROR', () => {
+  const dir = path.join(here, '..', 'fixtures', 'declaration-file')
+  const result = runManifestChecks(dir)
+  const c10 = checkImportTimeAdvisory(readSources(dir), result.entry?.relative)
+  const c12 = checkCredentials({}, readSources(dir))
+  assert.equal(c10.result, 'PASS', c10.reason)
+  assert.equal(c12.result, 'PASS', c12.reason)
+})
+
+test('DSC-12 C-12.4: one unparsable non-entry file is partial, not ERROR', () => {
+  const dir = path.join(here, '..', 'fixtures', 'parse-error-nonentry')
+  const check = checkCredentials({}, readSources(dir))
+  assert.notEqual(check.result, 'ERROR', check.reason)
+  assert.equal(check.coverage, 'partial')
+  assert.ok(check.details.some((detail) => detail.item === 'C-12.4' && /not-run/.test(detail.reason)), JSON.stringify(check.details))
+})

package/40-checker/vendor/babel/README.md

@@ -0,0 +1,10 @@
+# Vendored @babel/parser
+
+- Package: `@babel/parser` 8.1.0 (MIT), with `@babel/types`,
+  `@babel/helper-string-parser`, `@babel/helper-validator-identifier`.
+- Why: the checker needs a real AST for TypeScript/JSX as well as JS. acorn
+  alone cannot parse `.ts`/`.tsx`; Babel can.
+- Layout: `node_modules/@babel/*` so `@babel/parser` resolves its own deps
+  without network access. `index.cjs` is the only entry the checker imports.
+- Licenses: `node_modules/@babel/parser/LICENSE` and the sibling packages.
+- Update: copy the four packages from a fresh `npm install @babel/parser@8.1.0`.

package/40-checker/vendor/babel/index.cjs

@@ -0,0 +1,3 @@
+// Vendored @babel/parser (MIT). Keeps the checker zero-install: no runtime npm
+// dependency, and the GitHub Action can run from a codeload checkout.
+module.exports = require('@babel/parser')

package/40-checker/vendor/babel/node_modules/@babel/helper-string-parser/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2014-present Sebastian McKenzie and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/40-checker/vendor/babel/node_modules/@babel/helper-string-parser/README.md

@@ -0,0 +1,19 @@
+# @babel/helper-string-parser
+
+> A utility package to parse strings
+
+See our website [@babel/helper-string-parser](https://babeljs.io/docs/babel-helper-string-parser) for more information.
+
+## Install
+
+Using npm:
+
+```sh
+npm install --save @babel/helper-string-parser
+```
+
+or using yarn:
+
+```sh
+yarn add @babel/helper-string-parser
+```

package/40-checker/vendor/babel/node_modules/@babel/helper-string-parser/lib/index.d.ts

@@ -0,0 +1,41 @@
+type StringContentsErrorHandlers = EscapedCharErrorHandlers & {
+    unterminated(initialPos: number, initialLineStart: number, initialCurLine: number): void;
+};
+declare function readStringContents(type: "single" | "double" | "template", input: string, pos: number, lineStart: number, curLine: number, errors: StringContentsErrorHandlers): {
+    pos: number;
+    str: string;
+    firstInvalidLoc: {
+        pos: number;
+        lineStart: number;
+        curLine: number;
+    } | null;
+    lineStart: number;
+    curLine: number;
+};
+type EscapedCharErrorHandlers = HexCharErrorHandlers & CodePointErrorHandlers & {
+    strictNumericEscape(pos: number, lineStart: number, curLine: number): void;
+};
+type HexCharErrorHandlers = IntErrorHandlers & {
+    invalidEscapeSequence(pos: number, lineStart: number, curLine: number): void;
+};
+type IntErrorHandlers = {
+    numericSeparatorInEscapeSequence(pos: number, lineStart: number, curLine: number): void;
+    unexpectedNumericSeparator(pos: number, lineStart: number, curLine: number): void;
+    invalidDigit(pos: number, lineStart: number, curLine: number, radix: number): void;
+};
+declare function readInt(input: string, pos: number, lineStart: number, curLine: number, radix: number, len: number | undefined, forceLen: boolean, allowNumSeparator: boolean | "bail", errors: IntErrorHandlers, bailOnError: boolean): {
+    n: null;
+    pos: number;
+} | {
+    n: number;
+    pos: number;
+};
+type CodePointErrorHandlers = HexCharErrorHandlers & {
+    invalidCodePoint(pos: number, lineStart: number, curLine: number): void;
+};
+declare function readCodePoint(input: string, pos: number, lineStart: number, curLine: number, throwOnInvalid: boolean, errors: CodePointErrorHandlers): {
+    code: number | null;
+    pos: number;
+};
+
+export { type CodePointErrorHandlers, type IntErrorHandlers, type StringContentsErrorHandlers, readCodePoint, readInt, readStringContents };

package/40-checker/vendor/babel/node_modules/@babel/helper-string-parser/lib/index.js

@@ -0,0 +1,286 @@
+var _isDigit = function isDigit(code) {
+  return code >= 48 && code <= 57;
+};
+const forbiddenNumericSeparatorSiblings = {
+  decBinOct: new Set([46, 66, 69, 79, 95, 98, 101, 111, 43, 45]),
+  hex: new Set([46, 88, 95, 120])
+};
+const isAllowedNumericSeparatorSibling = {
+  bin: ch => ch === 48 || ch === 49,
+  oct: ch => ch >= 48 && ch <= 55,
+  dec: ch => ch >= 48 && ch <= 57,
+  hex: ch => ch >= 48 && ch <= 57 || ch >= 65 && ch <= 70 || ch >= 97 && ch <= 102
+};
+function readStringContents(type, input, pos, lineStart, curLine, errors) {
+  const initialPos = pos;
+  const initialLineStart = lineStart;
+  const initialCurLine = curLine;
+  let out = "";
+  let firstInvalidLoc = null;
+  let chunkStart = pos;
+  const {
+    length
+  } = input;
+  for (;;) {
+    if (pos >= length) {
+      errors.unterminated(initialPos, initialLineStart, initialCurLine);
+      out += input.slice(chunkStart, pos);
+      break;
+    }
+    const ch = input.charCodeAt(pos);
+    if (isStringEnd(type, ch, input, pos)) {
+      out += input.slice(chunkStart, pos);
+      break;
+    }
+    if (ch === 92) {
+      out += input.slice(chunkStart, pos);
+      const res = readEscapedChar(input, pos, lineStart, curLine, type === "template", errors);
+      if (res.ch === null && !firstInvalidLoc) {
+        firstInvalidLoc = {
+          pos,
+          lineStart,
+          curLine
+        };
+      } else {
+        out += res.ch;
+      }
+      ({
+        pos,
+        lineStart,
+        curLine
+      } = res);
+      chunkStart = pos;
+    } else if (ch === 8232 || ch === 8233) {
+      ++pos;
+      ++curLine;
+      lineStart = pos;
+    } else if (ch === 10 || ch === 13) {
+      if (type === "template") {
+        out += input.slice(chunkStart, pos) + "\n";
+        ++pos;
+        if (ch === 13 && input.charCodeAt(pos) === 10) {
+          ++pos;
+        }
+        ++curLine;
+        chunkStart = lineStart = pos;
+      } else {
+        errors.unterminated(initialPos, initialLineStart, initialCurLine);
+      }
+    } else {
+      ++pos;
+    }
+  }
+  return {
+    pos,
+    str: out,
+    firstInvalidLoc,
+    lineStart,
+    curLine
+  };
+}
+function isStringEnd(type, ch, input, pos) {
+  if (type === "template") {
+    return ch === 96 || ch === 36 && input.charCodeAt(pos + 1) === 123;
+  }
+  return ch === (type === "double" ? 34 : 39);
+}
+function readEscapedChar(input, pos, lineStart, curLine, inTemplate, errors) {
+  const throwOnInvalid = !inTemplate;
+  pos++;
+  const res = ch => ({
+    pos,
+    ch,
+    lineStart,
+    curLine
+  });
+  const ch = input.charCodeAt(pos++);
+  switch (ch) {
+    case 110:
+      return res("\n");
+    case 114:
+      return res("\r");
+    case 120:
+      {
+        let code;
+        ({
+          code,
+          pos
+        } = readHexChar(input, pos, lineStart, curLine, 2, false, throwOnInvalid, errors));
+        return res(code === null ? null : String.fromCharCode(code));
+      }
+    case 117:
+      {
+        let code;
+        ({
+          code,
+          pos
+        } = readCodePoint(input, pos, lineStart, curLine, throwOnInvalid, errors));
+        return res(code === null ? null : String.fromCodePoint(code));
+      }
+    case 116:
+      return res("\t");
+    case 98:
+      return res("\b");
+    case 118:
+      return res("\u000b");
+    case 102:
+      return res("\f");
+    case 13:
+      if (input.charCodeAt(pos) === 10) {
+        ++pos;
+      }
+    case 10:
+      lineStart = pos;
+      ++curLine;
+    case 8232:
+    case 8233:
+      return res("");
+    case 56:
+    case 57:
+      if (inTemplate) {
+        return res(null);
+      } else {
+        errors.strictNumericEscape(pos - 1, lineStart, curLine);
+      }
+    default:
+      if (ch >= 48 && ch <= 55) {
+        const startPos = pos - 1;
+        const match = /^[0-7]+/.exec(input.slice(startPos, pos + 2));
+        let octalStr = match[0];
+        let octal = parseInt(octalStr, 8);
+        if (octal > 255) {
+          octalStr = octalStr.slice(0, -1);
+          octal = parseInt(octalStr, 8);
+        }
+        pos += octalStr.length - 1;
+        const next = input.charCodeAt(pos);
+        if (octalStr !== "0" || next === 56 || next === 57) {
+          if (inTemplate) {
+            return res(null);
+          } else {
+            errors.strictNumericEscape(startPos, lineStart, curLine);
+          }
+        }
+        return res(String.fromCharCode(octal));
+      }
+      return res(String.fromCharCode(ch));
+  }
+}
+function readHexChar(input, pos, lineStart, curLine, len, forceLen, throwOnInvalid, errors) {
+  const initialPos = pos;
+  let n;
+  ({
+    n,
+    pos
+  } = readInt(input, pos, lineStart, curLine, 16, len, forceLen, false, errors, !throwOnInvalid));
+  if (n === null) {
+    if (throwOnInvalid) {
+      errors.invalidEscapeSequence(initialPos, lineStart, curLine);
+    } else {
+      pos = initialPos - 1;
+    }
+  }
+  return {
+    code: n,
+    pos
+  };
+}
+function readInt(input, pos, lineStart, curLine, radix, len, forceLen, allowNumSeparator, errors, bailOnError) {
+  const start = pos;
+  const forbiddenSiblings = radix === 16 ? forbiddenNumericSeparatorSiblings.hex : forbiddenNumericSeparatorSiblings.decBinOct;
+  const isAllowedSibling = radix === 16 ? isAllowedNumericSeparatorSibling.hex : radix === 10 ? isAllowedNumericSeparatorSibling.dec : radix === 8 ? isAllowedNumericSeparatorSibling.oct : isAllowedNumericSeparatorSibling.bin;
+  let invalid = false;
+  let total = 0;
+  for (let i = 0, e = len == null ? Infinity : len; i < e; ++i) {
+    const code = input.charCodeAt(pos);
+    let val;
+    if (code === 95 && allowNumSeparator !== "bail") {
+      const prev = input.charCodeAt(pos - 1);
+      const next = input.charCodeAt(pos + 1);
+      if (!allowNumSeparator) {
+        if (bailOnError) return {
+          n: null,
+          pos
+        };
+        errors.numericSeparatorInEscapeSequence(pos, lineStart, curLine);
+      } else if (Number.isNaN(next) || !isAllowedSibling(next) || forbiddenSiblings.has(prev)) {
+        if (bailOnError) return {
+          n: null,
+          pos
+        };
+        errors.unexpectedNumericSeparator(pos, lineStart, curLine);
+      }
+      ++pos;
+      continue;
+    }
+    if (code >= 97) {
+      val = code - 97 + 10;
+    } else if (code >= 65) {
+      val = code - 65 + 10;
+    } else if (_isDigit(code)) {
+      val = code - 48;
+    } else {
+      val = Infinity;
+    }
+    if (val >= radix) {
+      if (val <= 9) {
+        if (bailOnError) return {
+          n: null,
+          pos
+        };
+        errors.invalidDigit(pos, lineStart, curLine, radix);
+        val = 0;
+      } else if (forceLen) {
+        val = 0;
+        invalid = true;
+      } else {
+        break;
+      }
+    }
+    ++pos;
+    total = total * radix + val;
+  }
+  if (pos === start || len != null && pos - start !== len || invalid) {
+    return {
+      n: null,
+      pos
+    };
+  }
+  return {
+    n: total,
+    pos
+  };
+}
+function readCodePoint(input, pos, lineStart, curLine, throwOnInvalid, errors) {
+  const ch = input.charCodeAt(pos);
+  let code;
+  if (ch === 123) {
+    ++pos;
+    ({
+      code,
+      pos
+    } = readHexChar(input, pos, lineStart, curLine, input.indexOf("}", pos) - pos, true, throwOnInvalid, errors));
+    ++pos;
+    if (code !== null && code > 0x10ffff) {
+      if (throwOnInvalid) {
+        errors.invalidCodePoint(pos, lineStart, curLine);
+      } else {
+        return {
+          code: null,
+          pos
+        };
+      }
+    }
+  } else {
+    ({
+      code,
+      pos
+    } = readHexChar(input, pos, lineStart, curLine, 4, false, throwOnInvalid, errors));
+  }
+  return {
+    code,
+    pos
+  };
+}
+
+export { readCodePoint, readInt, readStringContents };