fca-rqzax-remake 0.0.1-security → 8.19.2

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/promise-spawn/lib/escape.js

@@ -0,0 +1,68 @@
+'use strict'
+
+// eslint-disable-next-line max-len
+// this code adapted from: https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/
+const cmd = (input, doubleEscape) => {
+  if (!input.length) {
+    return '""'
+  }
+
+  let result
+  if (!/[ \t\n\v"]/.test(input)) {
+    result = input
+  } else {
+    result = '"'
+    for (let i = 0; i <= input.length; ++i) {
+      let slashCount = 0
+      while (input[i] === '\\') {
+        ++i
+        ++slashCount
+      }
+
+      if (i === input.length) {
+        result += '\\'.repeat(slashCount * 2)
+        break
+      }
+
+      if (input[i] === '"') {
+        result += '\\'.repeat(slashCount * 2 + 1)
+        result += input[i]
+      } else {
+        result += '\\'.repeat(slashCount)
+        result += input[i]
+      }
+    }
+    result += '"'
+  }
+
+  // and finally, prefix shell meta chars with a ^
+  result = result.replace(/[ !%^&()<>|"]/g, '^$&')
+  if (doubleEscape) {
+    result = result.replace(/[ !%^&()<>|"]/g, '^$&')
+  }
+
+  return result
+}
+
+const sh = (input) => {
+  if (!input.length) {
+    return `''`
+  }
+
+  if (!/[\t\n\r "#$&'()*;<>?\\`|~]/.test(input)) {
+    return input
+  }
+
+  // replace single quotes with '\'' and wrap the whole result in a fresh set of quotes
+  const result = `'${input.replace(/'/g, `'\\''`)}'`
+    // if the input string already had single quotes around it, clean those up
+    .replace(/^(?:'')+(?!$)/, '')
+    .replace(/\\'''/g, `\\'`)
+
+  return result
+}
+
+module.exports = {
+  cmd,
+  sh,
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/promise-spawn/lib/index.js

@@ -0,0 +1,195 @@
+'use strict'
+
+const { spawn } = require('child_process')
+const os = require('os')
+const which = require('which')
+
+const escape = require('./escape.js')
+
+// 'extra' object is for decorating the error a bit more
+const promiseSpawn = (cmd, args, opts = {}, extra = {}) => {
+  if (opts.shell) {
+    return spawnWithShell(cmd, args, opts, extra)
+  }
+
+  let proc
+
+  const p = new Promise((res, rej) => {
+    proc = spawn(cmd, args, opts)
+
+    const stdout = []
+    const stderr = []
+
+    const reject = er => rej(Object.assign(er, {
+      cmd,
+      args,
+      ...stdioResult(stdout, stderr, opts),
+      ...extra,
+    }))
+
+    proc.on('error', reject)
+
+    if (proc.stdout) {
+      proc.stdout.on('data', c => stdout.push(c)).on('error', reject)
+      proc.stdout.on('error', er => reject(er))
+    }
+
+    if (proc.stderr) {
+      proc.stderr.on('data', c => stderr.push(c)).on('error', reject)
+      proc.stderr.on('error', er => reject(er))
+    }
+
+    proc.on('close', (code, signal) => {
+      const result = {
+        cmd,
+        args,
+        code,
+        signal,
+        ...stdioResult(stdout, stderr, opts),
+        ...extra,
+      }
+
+      if (code || signal) {
+        rej(Object.assign(new Error('command failed'), result))
+      } else {
+        res(result)
+      }
+    })
+  })
+
+  p.stdin = proc.stdin
+  p.process = proc
+  return p
+}
+
+const spawnWithShell = (cmd, args, opts, extra) => {
+  let command = opts.shell
+  // if shell is set to true, we use a platform default. we can't let the core
+  // spawn method decide this for us because we need to know what shell is in use
+  // ahead of time so that we can escape arguments properly. we don't need coverage here.
+  if (command === true) {
+    // istanbul ignore next
+    command = process.platform === 'win32' ? process.env.ComSpec : 'sh'
+  }
+
+  const options = { ...opts, shell: false }
+  const realArgs = []
+  let script = cmd
+
+  // first, determine if we're in windows because if we are we need to know if we're
+  // running an .exe or a .cmd/.bat since the latter requires extra escaping
+  const isCmd = /(?:^|\\)cmd(?:\.exe)?$/i.test(command)
+  if (isCmd) {
+    let doubleEscape = false
+
+    // find the actual command we're running
+    let initialCmd = ''
+    let insideQuotes = false
+    for (let i = 0; i < cmd.length; ++i) {
+      const char = cmd.charAt(i)
+      if (char === ' ' && !insideQuotes) {
+        break
+      }
+
+      initialCmd += char
+      if (char === '"' || char === "'") {
+        insideQuotes = !insideQuotes
+      }
+    }
+
+    let pathToInitial
+    try {
+      pathToInitial = which.sync(initialCmd, {
+        path: (options.env && options.env.PATH) || process.env.PATH,
+        pathext: (options.env && options.env.PATHEXT) || process.env.PATHEXT,
+      }).toLowerCase()
+    } catch (err) {
+      pathToInitial = initialCmd.toLowerCase()
+    }
+
+    doubleEscape = pathToInitial.endsWith('.cmd') || pathToInitial.endsWith('.bat')
+    for (const arg of args) {
+      script += ` ${escape.cmd(arg, doubleEscape)}`
+    }
+    realArgs.push('/d', '/s', '/c', script)
+    options.windowsVerbatimArguments = true
+  } else {
+    for (const arg of args) {
+      script += ` ${escape.sh(arg)}`
+    }
+    realArgs.push('-c', script)
+  }
+
+  return promiseSpawn(command, realArgs, options, extra)
+}
+
+// open a file with the default application as defined by the user's OS
+const open = (_args, opts = {}, extra = {}) => {
+  const options = { ...opts, shell: true }
+  const args = [].concat(_args)
+
+  let platform = process.platform
+  // process.platform === 'linux' may actually indicate WSL, if that's the case
+  // we want to treat things as win32 anyway so the host can open the argument
+  if (platform === 'linux' && os.release().toLowerCase().includes('microsoft')) {
+    platform = 'win32'
+  }
+
+  let command = options.command
+  if (!command) {
+    if (platform === 'win32') {
+      // spawnWithShell does not do the additional os.release() check, so we
+      // have to force the shell here to make sure we treat WSL as windows.
+      options.shell = process.env.ComSpec
+      // also, the start command accepts a title so to make sure that we don't
+      // accidentally interpret the first arg as the title, we stick an empty
+      // string immediately after the start command
+      command = 'start ""'
+    } else if (platform === 'darwin') {
+      command = 'open'
+    } else {
+      command = 'xdg-open'
+    }
+  }
+
+  return spawnWithShell(command, args, options, extra)
+}
+promiseSpawn.open = open
+
+const isPipe = (stdio = 'pipe', fd) => {
+  if (stdio === 'pipe' || stdio === null) {
+    return true
+  }
+
+  if (Array.isArray(stdio)) {
+    return isPipe(stdio[fd], fd)
+  }
+
+  return false
+}
+
+const stdioResult = (stdout, stderr, { stdioString = true, stdio }) => {
+  const result = {
+    stdout: null,
+    stderr: null,
+  }
+
+  // stdio is [stdin, stdout, stderr]
+  if (isPipe(stdio, 1)) {
+    result.stdout = Buffer.concat(stdout)
+    if (stdioString) {
+      result.stdout = result.stdout.toString().trim()
+    }
+  }
+
+  if (isPipe(stdio, 2)) {
+    result.stderr = Buffer.concat(stderr)
+    if (stdioString) {
+      result.stderr = result.stderr.toString().trim()
+    }
+  }
+
+  return result
+}
+
+module.exports = promiseSpawn

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/promise-spawn/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@npmcli/promise-spawn",
+  "version": "6.0.2",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "main": "./lib/index.js",
+  "description": "spawn processes the way the npm cli likes to do",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/promise-spawn.git"
+  },
+  "author": "GitHub Inc.",
+  "license": "ISC",
+  "scripts": {
+    "test": "tap",
+    "snap": "tap",
+    "lint": "eslint \"**/*.js\"",
+    "lintfix": "npm run lint -- --fix",
+    "posttest": "npm run lint",
+    "postsnap": "npm run lintfix --",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force"
+  },
+  "tap": {
+    "check-coverage": true,
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.11.0",
+    "minipass": "^4.0.0",
+    "spawk": "^1.7.1",
+    "tap": "^16.0.1"
+  },
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.11.0"
+  },
+  "dependencies": {
+    "which": "^3.0.0"
+  }
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/query/LICENSE

@@ -0,0 +1,20 @@
+<!-- This file is automatically added by @npmcli/template-oss. Do not edit. -->
+
+ISC License
+
+Copyright npm, Inc.
+
+Permission to use, copy, modify, and/or distribute this
+software for any purpose with or without fee is hereby
+granted, provided that the above copyright notice and this
+permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NPM DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO
+EVENT SHALL NPM BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+USE OR PERFORMANCE OF THIS SOFTWARE.

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/query/lib/index.js

@@ -0,0 +1,189 @@
+'use strict'
+
+const parser = require('postcss-selector-parser')
+
+const arrayDelimiter = Symbol('arrayDelimiter')
+
+const escapeSlashes = str =>
+  str.replace(/\//g, '\\/')
+
+const unescapeSlashes = str =>
+  str.replace(/\\\//g, '/')
+
+// recursively fixes up any :attr pseudo-class found
+const fixupAttr = astNode => {
+  const properties = []
+  const matcher = {}
+  for (const selectorAstNode of astNode.nodes) {
+    const [firstAstNode] = selectorAstNode.nodes
+    if (firstAstNode.type === 'tag') {
+      properties.push(firstAstNode.value)
+    }
+  }
+
+  const lastSelectorAstNode = astNode.nodes.pop()
+  const [attributeAstNode] = lastSelectorAstNode.nodes
+
+  if (attributeAstNode.value === ':attr') {
+    const appendParts = fixupAttr(attributeAstNode)
+    properties.push(arrayDelimiter, ...appendParts.lookupProperties)
+    matcher.qualifiedAttribute = appendParts.attributeMatcher.qualifiedAttribute
+    matcher.operator = appendParts.attributeMatcher.operator
+    matcher.value = appendParts.attributeMatcher.value
+
+    // backwards compatibility
+    matcher.attribute = appendParts.attributeMatcher.attribute
+
+    if (appendParts.attributeMatcher.insensitive) {
+      matcher.insensitive = true
+    }
+  } else {
+    if (attributeAstNode.type !== 'attribute') {
+      throw Object.assign(
+        new Error('`:attr` pseudo-class expects an attribute matcher as the last value'),
+        { code: 'EQUERYATTR' }
+      )
+    }
+
+    matcher.qualifiedAttribute = unescapeSlashes(attributeAstNode.qualifiedAttribute)
+    matcher.operator = attributeAstNode.operator
+    matcher.value = attributeAstNode.value
+
+    // backwards compatibility
+    matcher.attribute = matcher.qualifiedAttribute
+
+    if (attributeAstNode.insensitive) {
+      matcher.insensitive = true
+    }
+  }
+
+  astNode.lookupProperties = properties
+  astNode.attributeMatcher = matcher
+  astNode.nodes.length = 0
+  return astNode
+}
+
+// fixed up nested pseudo nodes will have their internal selectors moved
+// to a new root node that will be referenced by the `nestedNode` property,
+// this tweak makes it simpler to reuse `retrieveNodesFromParsedAst` to
+// recursively parse and extract results from the internal selectors
+const fixupNestedPseudo = astNode => {
+  // create a new ast root node and relocate any children
+  // selectors of the current ast node to this new root
+  const newRootNode = parser.root()
+  astNode.nestedNode = newRootNode
+  newRootNode.nodes = [...astNode.nodes]
+
+  // clean up the ast by removing the children nodes from the
+  // current ast node while also cleaning up their `parent` refs
+  astNode.nodes.length = 0
+  for (const currAstNode of newRootNode.nodes) {
+    currAstNode.parent = newRootNode
+  }
+
+  // recursively fixup nodes of any nested selector
+  transformAst(newRootNode)
+}
+
+// :semver(<version|range>, [selector], [function])
+const fixupSemverSpecs = astNode => {
+  // the first child node contains the version or range, most likely as a tag and a series of
+  // classes. we combine them into a single string here. this is the only required input.
+  const children = astNode.nodes.shift().nodes
+  const value = children.reduce((res, i) => `${res}${String(i)}`, '')
+
+  // next, if we have 2 nodes left then the user called us with a total of 3. that means the
+  // last one tells us what specific semver function the user is requesting, so we pull that out
+  let semverFunc
+  if (astNode.nodes.length === 2) {
+    const funcNode = astNode.nodes.pop().nodes[0]
+    if (funcNode.type === 'tag') {
+      semverFunc = funcNode.value
+    }
+  }
+
+  // now if there's a node left, that node is our selector. since that is the last remaining
+  // child node, we call fixupAttr on ourselves so that the attribute selectors get parsed
+  if (astNode.nodes.length === 1) {
+    fixupAttr(astNode)
+  } else {
+    // we weren't provided a selector, so we default to `[version]`. note, there's no default
+    // operator here. that's because we don't know yet if the user has provided us a version
+    // or range to assert against
+    astNode.attributeMatcher = {
+      insensitive: false,
+      attribute: 'version',
+      qualifiedAttribute: 'version',
+    }
+    astNode.lookupProperties = []
+  }
+
+  astNode.semverFunc = semverFunc
+  astNode.semverValue = value
+  astNode.nodes.length = 0
+}
+
+const fixupTypes = astNode => {
+  const [valueAstNode] = astNode.nodes[0].nodes
+  const { value } = valueAstNode || {}
+  astNode.typeValue = value
+  astNode.nodes.length = 0
+}
+
+const fixupPaths = astNode => {
+  astNode.pathValue = unescapeSlashes(String(astNode.nodes[0]))
+  astNode.nodes.length = 0
+}
+
+const fixupOutdated = astNode => {
+  if (astNode.nodes.length) {
+    astNode.outdatedKind = String(astNode.nodes[0])
+    astNode.nodes.length = 0
+  }
+}
+
+// a few of the supported ast nodes need to be tweaked in order to properly be
+// interpreted as proper arborist query selectors, namely semver ranges from
+// both ids and :semver pseudo-class selectors need to be translated from what
+// are usually multiple ast nodes, such as: tag:1, class:.0, class:.0 to a
+// single `1.0.0` value, other pseudo-class selectors also get preprocessed in
+// order to make it simpler to execute later when traversing each ast node
+// using rootNode.walk(), such as :path, :type, etc. transformAst handles all
+// these modifications to the parsed ast by doing an extra, initial traversal
+// of the parsed ast from the query and modifying the parsed nodes accordingly
+const transformAst = selector => {
+  selector.walk((nextAstNode) => {
+    switch (nextAstNode.value) {
+      case ':attr':
+        return fixupAttr(nextAstNode)
+      case ':is':
+      case ':has':
+      case ':not':
+        return fixupNestedPseudo(nextAstNode)
+      case ':path':
+        return fixupPaths(nextAstNode)
+      case ':semver':
+        return fixupSemverSpecs(nextAstNode)
+      case ':type':
+        return fixupTypes(nextAstNode)
+      case ':outdated':
+        return fixupOutdated(nextAstNode)
+    }
+  })
+}
+
+const queryParser = (query) => {
+  // if query is an empty string or any falsy
+  // value, just returns an empty result
+  if (!query) {
+    return []
+  }
+
+  return parser(transformAst)
+    .astSync(escapeSlashes(query), { lossless: false })
+}
+
+module.exports = {
+  parser: queryParser,
+  arrayDelimiter,
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/query/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@npmcli/query",
+  "version": "3.0.0",
+  "description": "npm query parser and tools",
+  "main": "lib/index.js",
+  "scripts": {
+    "test": "tap",
+    "lint": "eslint \"**/*.js\"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "snap": "tap",
+    "posttest": "npm run lint"
+  },
+  "contributors": [
+    {
+      "name": "Ruy Adorno",
+      "url": "https://ruyadorno.com",
+      "twitter": "ruyadorno"
+    }
+  ],
+  "keywords": [
+    "ast",
+    "npm",
+    "npmcli",
+    "parser",
+    "postcss",
+    "postcss-selector-parser",
+    "query"
+  ],
+  "author": "GitHub Inc.",
+  "license": "ISC",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "engines": {
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.5.1"
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^3.0.1",
+    "@npmcli/template-oss": "4.5.1",
+    "tap": "^16.2.0"
+  },
+  "dependencies": {
+    "postcss-selector-parser": "^6.0.10"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/npm/query.git"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  }
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/run-script/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) npm, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/is-server-package.js

@@ -0,0 +1,12 @@
+const util = require('util')
+const fs = require('fs')
+const { stat } = fs.promises || { stat: util.promisify(fs.stat) }
+const { resolve } = require('path')
+module.exports = async path => {
+  try {
+    const st = await stat(resolve(path, 'server.js'))
+    return st.isFile()
+  } catch (er) {
+    return false
+  }
+}

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/is-windows.js

@@ -0,0 +1,2 @@
+const platform = process.env.__FAKE_TESTING_PLATFORM__ || process.platform
+module.exports = platform === 'win32'

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/make-spawn-args.js

@@ -0,0 +1,40 @@
+/* eslint camelcase: "off" */
+const setPATH = require('./set-path.js')
+const { resolve } = require('path')
+const npm_config_node_gyp = require.resolve('node-gyp/bin/node-gyp.js')
+
+const makeSpawnArgs = options => {
+  const {
+    event,
+    path,
+    scriptShell = true,
+    binPaths,
+    env = {},
+    stdio,
+    cmd,
+    args = [],
+    stdioString,
+  } = options
+
+  const spawnEnv = setPATH(path, binPaths, {
+    // we need to at least save the PATH environment var
+    ...process.env,
+    ...env,
+    npm_package_json: resolve(path, 'package.json'),
+    npm_lifecycle_event: event,
+    npm_lifecycle_script: cmd,
+    npm_config_node_gyp,
+  })
+
+  const spawnOpts = {
+    env: spawnEnv,
+    stdioString,
+    stdio,
+    cwd: path,
+    shell: scriptShell,
+  }
+
+  return [cmd, args, spawnOpts]
+}
+
+module.exports = makeSpawnArgs

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp

@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+node "$npm_config_node_gyp" "$@"

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp.cmd

@@ -0,0 +1 @@
+@node "%npm_config_node_gyp%" %*

package/.config/npm/node_global/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/package-envs.js

@@ -0,0 +1,26 @@
+// https://github.com/npm/rfcs/pull/183
+
+const envVal = val => Array.isArray(val) ? val.map(v => envVal(v)).join('\n\n')
+  : val === null || val === false ? ''
+  : String(val)
+
+const packageEnvs = (env, vals, prefix) => {
+  for (const [key, val] of Object.entries(vals)) {
+    if (val === undefined) {
+      continue
+    } else if (val && !Array.isArray(val) && typeof val === 'object') {
+      packageEnvs(env, val, `${prefix}${key}_`)
+    } else {
+      env[`${prefix}${key}`] = envVal(val)
+    }
+  }
+  return env
+}
+
+module.exports = (env, pkg) => packageEnvs({ ...env }, {
+  name: pkg.name,
+  version: pkg.version,
+  config: pkg.config,
+  engines: pkg.engines,
+  bin: pkg.bin,
+}, 'npm_package_')