dsh-standards 1.0.3 → 1.2.0

package/40-checker/test/remediation.test.mjs

@@ -0,0 +1,300 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import remediationSpec from '../../spec/remediation.json' with { type: 'json' }
+import packageJson from '../../package.json' with { type: 'json' }
+import { DOCS_BASE, joinAdvice } from '../src/remediation.mjs'
+import { buildReport } from '../src/report.mjs'
+import { runManifestChecks } from '../src/manifest.mjs'
+import { checkCapabilities, checkCredentials, checkImportTimeAdvisory, checkLabels } from '../src/declarations.mjs'
+import { readSources } from '../src/util.mjs'
+
+const here = path.dirname(fileURLToPath(import.meta.url))
+const srcDir = path.join(here, '..', 'src')
+const fixturesDir = path.join(here, '..', 'fixtures')
+const guideDocs = process.env.DSH_GUIDE_DOCS
+  ? path.resolve(process.env.DSH_GUIDE_DOCS)
+  : path.resolve(here, '..', '..', '..', 'dsh-plugin-guide', 'docs')
+const RULES = remediationSpec
+
+function slugify(text) {
+  return String(text)
+    .trim()
+    .toLowerCase()
+    .replace(/[^\p{L}\p{N}\s_-]/gu, '')
+    .replace(/\s+/g, '-')
+}
+
+function headingSlugs(text) {
+  const slugs = new Set()
+  let fence = null
+  for (const line of text.split(/\r?\n/)) {
+    const fenceMatch = /^\s*(```+|~~~+)/.exec(line)
+    if (fenceMatch) {
+      if (fence === null) fence = fenceMatch[1][0]
+      else if (fence === fenceMatch[1][0]) fence = null
+      continue
+    }
+    if (fence !== null) continue
+    // Explicit HTML anchors are valid targets too (older docs predate heading-only slugs).
+    const explicit = /<a\s+id="([^"]+)"/.exec(line)
+    if (explicit) slugs.add(explicit[1])
+    const match = /^(#{1,6})\s+(.+?)\s*#*\s*$/.exec(line)
+    if (match) slugs.add(slugify(match[2]))
+  }
+  return slugs
+}
+
+/** The key set the checker can emit: C-x[.y] literals, clause values, G0-G4. */
+function checkerUniverse() {
+  const keys = new Set()
+  for (const file of fs.readdirSync(srcDir).filter(name => name.endsWith('.mjs'))) {
+    const text = fs.readFileSync(path.join(srcDir, file), 'utf8')
+    for (const match of text.matchAll(/'((?:C-\d+)(?:\.\d+)*)'/g)) keys.add(match[1])
+    for (const match of text.matchAll(/item:\s*'(G[0-4])'/g)) keys.add(match[1])
+  }
+  for (const gate of ['G0', 'G1', 'G2', 'G3', 'G4']) keys.add(gate)
+  return keys
+}
+
+function runtimeNotRun() {
+  const meta = {
+    'DSC-04': ['C-4', 'L1'], 'DSC-05': ['C-5', 'L1'], 'DSC-06': ['C-6', 'L1+L2'],
+    'DSC-07': ['C-7', 'L2'], 'DSC-08': ['C-8', 'L3'], 'DSC-09': ['C-9', 'L1'],
+  }
+  return Object.entries(meta).map(([id, [clause, layer]]) => ({
+    id, clause, layer, method: 'M', advisory: false,
+    result: 'ERROR', coverage: 'not-run', reason: 'test: runtime not run', details: [], evidence: [],
+  }))
+}
+
+function staticReportFor(dir) {
+  const result = runManifestChecks(dir)
+  const sources = readSources(dir)
+  const declaration = result.manifest
+    ? [
+        checkCapabilities(result.manifest, sources, result.patch),
+        checkCredentials(result.manifest, sources),
+        checkLabels(result.manifest, sources),
+      ].map(item => (item.result === 'WARN' && ['DSC-11', 'DSC-13'].includes(item.id) ? { ...item, advisory: true } : item))
+    : [
+        { id: 'DSC-11', clause: 'C-11', layer: 'L0', method: 'M', advisory: false, result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [] },
+        { id: 'DSC-12', clause: 'C-12', layer: 'L0', method: 'M', advisory: false, result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [] },
+        { id: 'DSC-13', clause: 'C-13', layer: 'L0', method: 'M', advisory: false, result: 'ERROR', coverage: 'not-run', reason: 'manifest unavailable', details: [], evidence: [] },
+      ]
+  const checks = [
+    ...result.checks,
+    ...runtimeNotRun(),
+    { id: 'DSC-14', clause: 'C-14', layer: 'L1', method: 'M', advisory: false, result: 'ERROR', coverage: 'not-run', reason: 'test: runtime not run', details: [], evidence: [] },
+    checkImportTimeAdvisory(sources, result.entry?.relative),
+    ...declaration,
+  ]
+  if (result.g4?.result === 'FAIL') {
+    const dsc01 = checks.find(item => item.id === 'DSC-01')
+    if (dsc01 && dsc01.result !== 'FAIL') {
+      dsc01.result = 'FAIL'
+      dsc01.reason = dsc01.reason ? `${dsc01.reason}; ${result.g4.reason}` : result.g4.reason
+      dsc01.details = [...(dsc01.details ?? []), { item: 'G4', result: 'FAIL', reason: result.g4.reason }]
+    }
+  }
+  return buildReport({
+    subject: {
+      mode: 'package', profile: 'package', kind: result.kind, kindInferred: true,
+      name: result.manifest?.name ?? null, version: result.manifest?.version ?? null, path: dir,
+    },
+    anchor: { repo: 'test', commit: '0'.repeat(40), scanner: 'test', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks,
+    g4: result.g4,
+    scope: 'ds-c',
+    profile: 'package',
+    kind: result.kind,
+  })
+}
+
+test('remediation table covers every checker key exactly', () => {
+  const universe = checkerUniverse()
+  const keys = new Set(Object.keys(RULES))
+  const missing = [...universe].filter(key => !keys.has(key)).sort()
+  const extra = [...keys].filter(key => !universe.has(key)).sort()
+  assert.deepEqual(missing, [], `missing remediation rules: ${missing.join(', ')}`)
+  assert.deepEqual(extra, [], `stale remediation rules: ${extra.join(', ')}`)
+  assert.ok(universe.size > 0)
+})
+
+test('remediation rules have the required shape', () => {
+  assert.equal(DOCS_BASE, 'https://github.com/PerryLink/dsh-plugin-guide/blob/v0.4.4/')
+  assert.equal(packageJson.version, '1.2.0')
+  assert.ok(Object.keys(RULES).length > 0)
+  for (const [key, rule] of Object.entries(RULES)) {
+    assert.match(key, /^(?:C-\d+(?:\.\d+)*|G[0-4])$/)
+    for (const field of ['title', 'why', 'fix']) {
+      assert.equal(typeof rule[field], 'string', `${key}.${field}`)
+      assert.ok(rule[field].trim().length > 0, `${key}.${field} is empty`)
+    }
+    assert.match(rule.docs, /^docs\/[a-z]+\.md#[a-z0-9-]+$/, `${key}.docs`)
+    assert.ok(['fail', 'warn', 'advisory'].includes(rule.severityHint), `${key}.severityHint`)
+  }
+})
+
+test('advice on every fixture has a rule (no ruleMissing)', () => {
+  const dirs = fs.readdirSync(fixturesDir, { withFileTypes: true })
+    .filter(entry => entry.isDirectory())
+    .map(entry => path.join(fixturesDir, entry.name))
+    .filter(dir => fs.existsSync(path.join(dir, 'package.json')))
+  assert.ok(dirs.length >= 20, `expected fixture packages, got ${dirs.length}`)
+  let total = 0
+  for (const dir of dirs) {
+    const report = staticReportFor(dir)
+    assert.ok(Array.isArray(report.advice), `${path.basename(dir)}: advice is not an array`)
+    const missing = report.advice.filter(item => item.ruleMissing)
+    assert.deepEqual(missing.map(item => `${item.source}:${item.key}`), [], `${path.basename(dir)}: ruleMissing`)
+    for (const item of report.advice) {
+      assert.ok(item.docsUrl, `${path.basename(dir)}: ${item.key} has no docsUrl`)
+      assert.equal(item.docsUrl, `${DOCS_BASE}${RULES[item.key].docs}`, `${path.basename(dir)}: ${item.key} docsUrl`)
+      assert.equal(item.version, packageJson.version)
+      assert.ok(['FAIL', 'WARN'].includes(item.severity))
+    }
+    total += report.advice.length
+  }
+  assert.ok(total > 0, 'fixtures produced no advice; the test would be vacuous')
+})
+
+test('runtime FAIL without details falls back to check.clause', () => {
+  const checks = [
+    {
+      id: 'DSC-04', clause: 'C-4', layer: 'L1', result: 'FAIL', coverage: 'full',
+      reason: 'load failed: boom', details: [], evidence: ['index.mjs:1'], method: 'M', advisory: false,
+    },
+    {
+      id: 'DSC-14', clause: 'C-14', layer: 'L1', result: 'FAIL', coverage: 'full',
+      reason: 'runtime failed', details: [], evidence: ['index.mjs:1'], method: 'M', advisory: false,
+    },
+  ]
+  const report = buildReport({
+    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
+    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks,
+    scope: 'ds-c',
+    profile: 'package',
+    kind: 'plugin',
+  })
+  const c4 = report.advice.find(item => item.source === 'DSC-04')
+  const c14 = report.advice.find(item => item.source === 'DSC-14')
+  assert.equal(c4.key, 'C-4')
+  assert.equal(c4.severity, 'FAIL')
+  assert.equal(c4.version, '1.2.0')
+  assert.deepEqual(c4.evidence, ['index.mjs:1'])
+  assert.equal(c4.docsUrl, `${DOCS_BASE}docs/levels.md#entry`)
+  assert.equal(c14.key, 'C-14')
+  assert.equal(c14.docsUrl, `${DOCS_BASE}docs/entry.md#the-two-claims`)
+})
+
+test('advice uses detail severity even when the check was adjusted to WARN', () => {
+  const checks = [
+    { id: 'DSC-01', clause: 'C-1', layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
+    {
+      id: 'DSC-02', clause: 'C-2', layer: 'L0', result: 'FAIL', coverage: 'full', reason: '',
+      details: [{ item: 'C-2.1', result: 'FAIL', reason: 'no engines', evidence: ['package.json#engines'] }],
+      evidence: [], advisory: false,
+    },
+    { id: 'DSC-11', clause: 'C-11', layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
+    { id: 'DSC-12', clause: 'C-12', layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
+    { id: 'DSC-13', clause: 'C-13', layer: 'L0', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
+    { id: 'DSC-14', clause: 'C-14', layer: 'L1', result: 'PASS', coverage: 'full', reason: '', details: [], evidence: [] },
+  ]
+  const report = buildReport({
+    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
+    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks,
+    scope: 'entry',
+    profile: 'package',
+    kind: 'plugin',
+  })
+  assert.equal(report.checks.find(item => item.id === 'DSC-02').result, 'WARN')
+  const item = report.advice.find(entry => entry.key === 'C-2.1')
+  assert.equal(item.severity, 'FAIL')
+  assert.equal(item.source, 'DSC-02')
+  assert.match(item.reason, /no engines/)
+})
+
+test('duplicate details merge evidence and count once per check and key', () => {
+  const checks = [{
+    id: 'DSC-11', clause: 'C-11', layer: 'L0', result: 'WARN', coverage: 'full', reason: '',
+    details: [
+      { item: 'C-11.2', result: 'WARN', reason: 'trigger tools', evidence: ['a.mjs:1'] },
+      { item: 'C-11.1', result: 'WARN', reason: 'missing capabilities', evidence: ['package.json#dsh.capabilities'] },
+      { item: 'C-11.2', result: 'WARN', reason: 'trigger web', evidence: ['b.mjs:2'] },
+    ],
+    evidence: [], advisory: true,
+  }]
+  const report = buildReport({
+    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
+    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks,
+    scope: 'ds-c',
+    profile: 'package',
+    kind: 'plugin',
+  })
+  const merged = report.advice.find(item => item.key === 'C-11.2')
+  assert.ok(merged)
+  assert.equal(merged.occurrences, 2)
+  assert.deepEqual(merged.evidence, ['a.mjs:1', 'b.mjs:2'])
+  assert.equal(merged.advisory, true)
+  assert.equal(report.advice.filter(item => item.source === 'DSC-11').length, 2)
+})
+
+test('buildReport includes advice by default and omits it on advice:false', () => {
+  const base = {
+    subject: { mode: 'package', profile: 'package', kind: 'plugin', kindInferred: false, name: 'x', version: '1.0.0', path: here },
+    anchor: { repo: 'x', commit: '0'.repeat(40), scanner: 'x', dsh: '0.2.2-alpha.2', cordis: '4.0.6-alpha.1', runtime: null },
+    checks: [],
+    scope: 'ds-c',
+    profile: 'package',
+    kind: 'plugin',
+  }
+  const on = buildReport(base)
+  const off = buildReport({ ...base, advice: false })
+  assert.ok(Array.isArray(on.advice))
+  assert.equal(on.advice.length, 0)
+  assert.equal(Object.hasOwn(off, 'advice'), false)
+})
+
+test('every rule docs anchor exists in the local guide repository', t => {
+  if (!fs.existsSync(guideDocs)) {
+    t.skip(`guide docs not checked out at ${guideDocs}`)
+    return
+  }
+  const cache = new Map()
+  for (const [key, rule] of Object.entries(RULES)) {
+    const hash = rule.docs.indexOf('#')
+    const file = rule.docs.slice(0, hash)
+    const anchor = rule.docs.slice(hash + 1)
+    assert.ok(hash > 0 && !anchor.includes('#'), `${key}: docs must be <file>#<anchor>`)
+    const relative = file.replace(/^docs\//, '')
+    const absolute = path.join(guideDocs, relative)
+    assert.ok(fs.existsSync(absolute), `${key}: missing guide file ${file}`)
+    if (!cache.has(file)) cache.set(file, headingSlugs(fs.readFileSync(absolute, 'utf8')))
+    assert.ok(cache.get(file).has(anchor), `${key}: missing anchor ${rule.docs}`)
+  }
+})
+
+test('joinAdvice is pure and leaves the report untouched', () => {
+  const checks = [{
+    id: 'DSC-04', clause: 'C-4', layer: 'L1', result: 'FAIL', coverage: 'full',
+    reason: 'load failed', details: [], evidence: ['index.mjs'], method: 'M', advisory: false,
+  }]
+  const report = {
+    checks,
+    standard: { id: 'DS-C', version: '1.0.0' },
+  }
+  const snapshot = JSON.stringify(report)
+  const advice = joinAdvice(report, remediationSpec, DOCS_BASE)
+  assert.equal(JSON.stringify(report), snapshot)
+  assert.equal(advice.length, 1)
+  assert.equal(advice[0].key, 'C-4')
+  // A flat rule map (no version metadata) still gets the package version.
+  const bare = joinAdvice(report, RULES, DOCS_BASE)
+  assert.equal(bare[0].version, packageJson.version)
+})

package/40-checker/vendor/babel/README.md

@@ -0,0 +1,10 @@
+# Vendored @babel/parser
+
+- Package: `@babel/parser` 8.1.0 (MIT), with `@babel/types`,
+  `@babel/helper-string-parser`, `@babel/helper-validator-identifier`.
+- Why: the checker needs a real AST for TypeScript/JSX as well as JS. acorn
+  alone cannot parse `.ts`/`.tsx`; Babel can.
+- Layout: `node_modules/@babel/*` so `@babel/parser` resolves its own deps
+  without network access. `index.cjs` is the only entry the checker imports.
+- Licenses: `node_modules/@babel/parser/LICENSE` and the sibling packages.
+- Update: copy the four packages from a fresh `npm install @babel/parser@8.1.0`.

package/40-checker/vendor/babel/index.cjs

@@ -0,0 +1,3 @@
+// Vendored @babel/parser (MIT). Keeps the checker zero-install: no runtime npm
+// dependency, and the GitHub Action can run from a codeload checkout.
+module.exports = require('@babel/parser')

package/40-checker/vendor/babel/node_modules/@babel/helper-string-parser/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2014-present Sebastian McKenzie and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/40-checker/vendor/babel/node_modules/@babel/helper-string-parser/README.md

@@ -0,0 +1,19 @@
+# @babel/helper-string-parser
+
+> A utility package to parse strings
+
+See our website [@babel/helper-string-parser](https://babeljs.io/docs/babel-helper-string-parser) for more information.
+
+## Install
+
+Using npm:
+
+```sh
+npm install --save @babel/helper-string-parser
+```
+
+or using yarn:
+
+```sh
+yarn add @babel/helper-string-parser
+```

package/40-checker/vendor/babel/node_modules/@babel/helper-string-parser/lib/index.d.ts

@@ -0,0 +1,41 @@
+type StringContentsErrorHandlers = EscapedCharErrorHandlers & {
+    unterminated(initialPos: number, initialLineStart: number, initialCurLine: number): void;
+};
+declare function readStringContents(type: "single" | "double" | "template", input: string, pos: number, lineStart: number, curLine: number, errors: StringContentsErrorHandlers): {
+    pos: number;
+    str: string;
+    firstInvalidLoc: {
+        pos: number;
+        lineStart: number;
+        curLine: number;
+    } | null;
+    lineStart: number;
+    curLine: number;
+};
+type EscapedCharErrorHandlers = HexCharErrorHandlers & CodePointErrorHandlers & {
+    strictNumericEscape(pos: number, lineStart: number, curLine: number): void;
+};
+type HexCharErrorHandlers = IntErrorHandlers & {
+    invalidEscapeSequence(pos: number, lineStart: number, curLine: number): void;
+};
+type IntErrorHandlers = {
+    numericSeparatorInEscapeSequence(pos: number, lineStart: number, curLine: number): void;
+    unexpectedNumericSeparator(pos: number, lineStart: number, curLine: number): void;
+    invalidDigit(pos: number, lineStart: number, curLine: number, radix: number): void;
+};
+declare function readInt(input: string, pos: number, lineStart: number, curLine: number, radix: number, len: number | undefined, forceLen: boolean, allowNumSeparator: boolean | "bail", errors: IntErrorHandlers, bailOnError: boolean): {
+    n: null;
+    pos: number;
+} | {
+    n: number;
+    pos: number;
+};
+type CodePointErrorHandlers = HexCharErrorHandlers & {
+    invalidCodePoint(pos: number, lineStart: number, curLine: number): void;
+};
+declare function readCodePoint(input: string, pos: number, lineStart: number, curLine: number, throwOnInvalid: boolean, errors: CodePointErrorHandlers): {
+    code: number | null;
+    pos: number;
+};
+
+export { type CodePointErrorHandlers, type IntErrorHandlers, type StringContentsErrorHandlers, readCodePoint, readInt, readStringContents };

package/40-checker/vendor/babel/node_modules/@babel/helper-string-parser/lib/index.js

@@ -0,0 +1,286 @@
+var _isDigit = function isDigit(code) {
+  return code >= 48 && code <= 57;
+};
+const forbiddenNumericSeparatorSiblings = {
+  decBinOct: new Set([46, 66, 69, 79, 95, 98, 101, 111, 43, 45]),
+  hex: new Set([46, 88, 95, 120])
+};
+const isAllowedNumericSeparatorSibling = {
+  bin: ch => ch === 48 || ch === 49,
+  oct: ch => ch >= 48 && ch <= 55,
+  dec: ch => ch >= 48 && ch <= 57,
+  hex: ch => ch >= 48 && ch <= 57 || ch >= 65 && ch <= 70 || ch >= 97 && ch <= 102
+};
+function readStringContents(type, input, pos, lineStart, curLine, errors) {
+  const initialPos = pos;
+  const initialLineStart = lineStart;
+  const initialCurLine = curLine;
+  let out = "";
+  let firstInvalidLoc = null;
+  let chunkStart = pos;
+  const {
+    length
+  } = input;
+  for (;;) {
+    if (pos >= length) {
+      errors.unterminated(initialPos, initialLineStart, initialCurLine);
+      out += input.slice(chunkStart, pos);
+      break;
+    }
+    const ch = input.charCodeAt(pos);
+    if (isStringEnd(type, ch, input, pos)) {
+      out += input.slice(chunkStart, pos);
+      break;
+    }
+    if (ch === 92) {
+      out += input.slice(chunkStart, pos);
+      const res = readEscapedChar(input, pos, lineStart, curLine, type === "template", errors);
+      if (res.ch === null && !firstInvalidLoc) {
+        firstInvalidLoc = {
+          pos,
+          lineStart,
+          curLine
+        };
+      } else {
+        out += res.ch;
+      }
+      ({
+        pos,
+        lineStart,
+        curLine
+      } = res);
+      chunkStart = pos;
+    } else if (ch === 8232 || ch === 8233) {
+      ++pos;
+      ++curLine;
+      lineStart = pos;
+    } else if (ch === 10 || ch === 13) {
+      if (type === "template") {
+        out += input.slice(chunkStart, pos) + "\n";
+        ++pos;
+        if (ch === 13 && input.charCodeAt(pos) === 10) {
+          ++pos;
+        }
+        ++curLine;
+        chunkStart = lineStart = pos;
+      } else {
+        errors.unterminated(initialPos, initialLineStart, initialCurLine);
+      }
+    } else {
+      ++pos;
+    }
+  }
+  return {
+    pos,
+    str: out,
+    firstInvalidLoc,
+    lineStart,
+    curLine
+  };
+}
+function isStringEnd(type, ch, input, pos) {
+  if (type === "template") {
+    return ch === 96 || ch === 36 && input.charCodeAt(pos + 1) === 123;
+  }
+  return ch === (type === "double" ? 34 : 39);
+}
+function readEscapedChar(input, pos, lineStart, curLine, inTemplate, errors) {
+  const throwOnInvalid = !inTemplate;
+  pos++;
+  const res = ch => ({
+    pos,
+    ch,
+    lineStart,
+    curLine
+  });
+  const ch = input.charCodeAt(pos++);
+  switch (ch) {
+    case 110:
+      return res("\n");
+    case 114:
+      return res("\r");
+    case 120:
+      {
+        let code;
+        ({
+          code,
+          pos
+        } = readHexChar(input, pos, lineStart, curLine, 2, false, throwOnInvalid, errors));
+        return res(code === null ? null : String.fromCharCode(code));
+      }
+    case 117:
+      {
+        let code;
+        ({
+          code,
+          pos
+        } = readCodePoint(input, pos, lineStart, curLine, throwOnInvalid, errors));
+        return res(code === null ? null : String.fromCodePoint(code));
+      }
+    case 116:
+      return res("\t");
+    case 98:
+      return res("\b");
+    case 118:
+      return res("\u000b");
+    case 102:
+      return res("\f");
+    case 13:
+      if (input.charCodeAt(pos) === 10) {
+        ++pos;
+      }
+    case 10:
+      lineStart = pos;
+      ++curLine;
+    case 8232:
+    case 8233:
+      return res("");
+    case 56:
+    case 57:
+      if (inTemplate) {
+        return res(null);
+      } else {
+        errors.strictNumericEscape(pos - 1, lineStart, curLine);
+      }
+    default:
+      if (ch >= 48 && ch <= 55) {
+        const startPos = pos - 1;
+        const match = /^[0-7]+/.exec(input.slice(startPos, pos + 2));
+        let octalStr = match[0];
+        let octal = parseInt(octalStr, 8);
+        if (octal > 255) {
+          octalStr = octalStr.slice(0, -1);
+          octal = parseInt(octalStr, 8);
+        }
+        pos += octalStr.length - 1;
+        const next = input.charCodeAt(pos);
+        if (octalStr !== "0" || next === 56 || next === 57) {
+          if (inTemplate) {
+            return res(null);
+          } else {
+            errors.strictNumericEscape(startPos, lineStart, curLine);
+          }
+        }
+        return res(String.fromCharCode(octal));
+      }
+      return res(String.fromCharCode(ch));
+  }
+}
+function readHexChar(input, pos, lineStart, curLine, len, forceLen, throwOnInvalid, errors) {
+  const initialPos = pos;
+  let n;
+  ({
+    n,
+    pos
+  } = readInt(input, pos, lineStart, curLine, 16, len, forceLen, false, errors, !throwOnInvalid));
+  if (n === null) {
+    if (throwOnInvalid) {
+      errors.invalidEscapeSequence(initialPos, lineStart, curLine);
+    } else {
+      pos = initialPos - 1;
+    }
+  }
+  return {
+    code: n,
+    pos
+  };
+}
+function readInt(input, pos, lineStart, curLine, radix, len, forceLen, allowNumSeparator, errors, bailOnError) {
+  const start = pos;
+  const forbiddenSiblings = radix === 16 ? forbiddenNumericSeparatorSiblings.hex : forbiddenNumericSeparatorSiblings.decBinOct;
+  const isAllowedSibling = radix === 16 ? isAllowedNumericSeparatorSibling.hex : radix === 10 ? isAllowedNumericSeparatorSibling.dec : radix === 8 ? isAllowedNumericSeparatorSibling.oct : isAllowedNumericSeparatorSibling.bin;
+  let invalid = false;
+  let total = 0;
+  for (let i = 0, e = len == null ? Infinity : len; i < e; ++i) {
+    const code = input.charCodeAt(pos);
+    let val;
+    if (code === 95 && allowNumSeparator !== "bail") {
+      const prev = input.charCodeAt(pos - 1);
+      const next = input.charCodeAt(pos + 1);
+      if (!allowNumSeparator) {
+        if (bailOnError) return {
+          n: null,
+          pos
+        };
+        errors.numericSeparatorInEscapeSequence(pos, lineStart, curLine);
+      } else if (Number.isNaN(next) || !isAllowedSibling(next) || forbiddenSiblings.has(prev)) {
+        if (bailOnError) return {
+          n: null,
+          pos
+        };
+        errors.unexpectedNumericSeparator(pos, lineStart, curLine);
+      }
+      ++pos;
+      continue;
+    }
+    if (code >= 97) {
+      val = code - 97 + 10;
+    } else if (code >= 65) {
+      val = code - 65 + 10;
+    } else if (_isDigit(code)) {
+      val = code - 48;
+    } else {
+      val = Infinity;
+    }
+    if (val >= radix) {
+      if (val <= 9) {
+        if (bailOnError) return {
+          n: null,
+          pos
+        };
+        errors.invalidDigit(pos, lineStart, curLine, radix);
+        val = 0;
+      } else if (forceLen) {
+        val = 0;
+        invalid = true;
+      } else {
+        break;
+      }
+    }
+    ++pos;
+    total = total * radix + val;
+  }
+  if (pos === start || len != null && pos - start !== len || invalid) {
+    return {
+      n: null,
+      pos
+    };
+  }
+  return {
+    n: total,
+    pos
+  };
+}
+function readCodePoint(input, pos, lineStart, curLine, throwOnInvalid, errors) {
+  const ch = input.charCodeAt(pos);
+  let code;
+  if (ch === 123) {
+    ++pos;
+    ({
+      code,
+      pos
+    } = readHexChar(input, pos, lineStart, curLine, input.indexOf("}", pos) - pos, true, throwOnInvalid, errors));
+    ++pos;
+    if (code !== null && code > 0x10ffff) {
+      if (throwOnInvalid) {
+        errors.invalidCodePoint(pos, lineStart, curLine);
+      } else {
+        return {
+          code: null,
+          pos
+        };
+      }
+    }
+  } else {
+    ({
+      code,
+      pos
+    } = readHexChar(input, pos, lineStart, curLine, 4, false, throwOnInvalid, errors));
+  }
+  return {
+    code,
+    pos
+  };
+}
+
+export { readCodePoint, readInt, readStringContents };