fca-rqzax-remake 0.0.1-security → 8.19.2

package/.config/npm/node_global/lib/node_modules/npm/lib/commands/cache.js

@@ -0,0 +1,215 @@
+const cacache = require('cacache')
+const Arborist = require('@npmcli/arborist')
+const pacote = require('pacote')
+const fs = require('fs/promises')
+const { join } = require('path')
+const semver = require('semver')
+const BaseCommand = require('../base-command.js')
+const npa = require('npm-package-arg')
+const jsonParse = require('json-parse-even-better-errors')
+const localeCompare = require('@isaacs/string-locale-compare')('en')
+const log = require('../utils/log-shim')
+
+const searchCachePackage = async (path, parsed, cacheKeys) => {
+  /* eslint-disable-next-line max-len */
+  const searchMFH = new RegExp(`^make-fetch-happen:request-cache:.*(?<!/[@a-zA-Z]+)/${parsed.name}/-/(${parsed.name}[^/]+.tgz)$`)
+  const searchPack = new RegExp(`^make-fetch-happen:request-cache:.*/${parsed.escapedName}$`)
+  const results = new Set()
+  cacheKeys = new Set(cacheKeys)
+  for (const key of cacheKeys) {
+    // match on the public key registry url format
+    if (searchMFH.test(key)) {
+      // extract the version from the filename
+      const filename = key.match(searchMFH)[1]
+      const noExt = filename.slice(0, -4)
+      const noScope = `${parsed.name.split('/').pop()}-`
+      const ver = noExt.slice(noScope.length)
+      if (semver.satisfies(ver, parsed.rawSpec)) {
+        results.add(key)
+      }
+      continue
+    }
+    // is this key a packument?
+    if (!searchPack.test(key)) {
+      continue
+    }
+
+    results.add(key)
+    let packument, details
+    try {
+      details = await cacache.get(path, key)
+      packument = jsonParse(details.data)
+    } catch (_) {
+      // if we couldn't parse the packument, abort
+      continue
+    }
+    if (!packument.versions || typeof packument.versions !== 'object') {
+      continue
+    }
+
+    // assuming this is a packument
+    for (const ver of Object.keys(packument.versions)) {
+      if (semver.satisfies(ver, parsed.rawSpec)) {
+        if (packument.versions[ver].dist &&
+          typeof packument.versions[ver].dist === 'object' &&
+          packument.versions[ver].dist.tarball !== undefined &&
+          cacheKeys.has(`make-fetch-happen:request-cache:${packument.versions[ver].dist.tarball}`)
+        ) {
+          results.add(`make-fetch-happen:request-cache:${packument.versions[ver].dist.tarball}`)
+        }
+      }
+    }
+  }
+  return results
+}
+
+class Cache extends BaseCommand {
+  static description = 'Manipulates packages cache'
+  static name = 'cache'
+  static params = ['cache']
+  static usage = [
+    'add <package-spec>',
+    'clean [<key>]',
+    'ls [<name>@<version>]',
+    'verify',
+  ]
+
+  async completion (opts) {
+    const argv = opts.conf.argv.remain
+    if (argv.length === 2) {
+      return ['add', 'clean', 'verify', 'ls', 'delete']
+    }
+
+    // TODO - eventually...
+    switch (argv[2]) {
+      case 'verify':
+      case 'clean':
+      case 'add':
+      case 'ls':
+      case 'delete':
+        return []
+    }
+  }
+
+  async exec (args) {
+    const cmd = args.shift()
+    switch (cmd) {
+      case 'rm': case 'clear': case 'clean':
+        return await this.clean(args)
+      case 'add':
+        return await this.add(args)
+      case 'verify': case 'check':
+        return await this.verify()
+      case 'ls':
+        return await this.ls(args)
+      default:
+        throw this.usageError()
+    }
+  }
+
+  // npm cache clean [pkg]*
+  async clean (args) {
+    const cachePath = join(this.npm.cache, '_cacache')
+    if (args.length === 0) {
+      if (!this.npm.config.get('force')) {
+        throw new Error(`As of npm@5, the npm cache self-heals from corruption issues
+  by treating integrity mismatches as cache misses.  As a result,
+  data extracted from the cache is guaranteed to be valid.  If you
+  want to make sure everything is consistent, use \`npm cache verify\`
+  instead.  Deleting the cache can only make npm go slower, and is
+  not likely to correct any problems you may be encountering!
+
+  On the other hand, if you're debugging an issue with the installer,
+  or race conditions that depend on the timing of writing to an empty
+  cache, you can use \`npm install --cache /tmp/empty-cache\` to use a
+  temporary cache instead of nuking the actual one.
+
+  If you're sure you want to delete the entire cache, rerun this command
+  with --force.`)
+      }
+      return fs.rm(cachePath, { recursive: true, force: true })
+    }
+    for (const key of args) {
+      let entry
+      try {
+        entry = await cacache.get(cachePath, key)
+      } catch (err) {
+        log.warn(`Not Found: ${key}`)
+        break
+      }
+      this.npm.output(`Deleted: ${key}`)
+      await cacache.rm.entry(cachePath, key)
+      // XXX this could leave other entries without content!
+      await cacache.rm.content(cachePath, entry.integrity)
+    }
+  }
+
+  // npm cache add <tarball-url>...
+  // npm cache add <pkg> <ver>...
+  // npm cache add <tarball>...
+  // npm cache add <folder>...
+  async add (args) {
+    log.silly('cache add', 'args', args)
+    if (args.length === 0) {
+      throw this.usageError('First argument to `add` is required')
+    }
+
+    return Promise.all(args.map(spec => {
+      log.silly('cache add', 'spec', spec)
+      // we ask pacote for the thing, and then just throw the data
+      // away so that it tee-pipes it into the cache like it does
+      // for a normal request.
+      return pacote.tarball.stream(spec, stream => {
+        stream.resume()
+        return stream.promise()
+      }, { ...this.npm.flatOptions, Arborist })
+    }))
+  }
+
+  async verify () {
+    const cache = join(this.npm.cache, '_cacache')
+    const prefix = cache.indexOf(process.env.HOME) === 0
+      ? `~${cache.slice(process.env.HOME.length)}`
+      : cache
+    const stats = await cacache.verify(cache)
+    this.npm.output(`Cache verified and compressed (${prefix})`)
+    this.npm.output(`Content verified: ${stats.verifiedContent} (${stats.keptSize} bytes)`)
+    if (stats.badContentCount) {
+      this.npm.output(`Corrupted content removed: ${stats.badContentCount}`)
+    }
+    if (stats.reclaimedCount) {
+      /* eslint-disable-next-line max-len */
+      this.npm.output(`Content garbage-collected: ${stats.reclaimedCount} (${stats.reclaimedSize} bytes)`)
+    }
+    if (stats.missingContent) {
+      this.npm.output(`Missing content: ${stats.missingContent}`)
+    }
+    this.npm.output(`Index entries: ${stats.totalEntries}`)
+    this.npm.output(`Finished in ${stats.runTime.total / 1000}s`)
+  }
+
+  // npm cache ls [--package <spec> ...]
+  async ls (specs) {
+    const cachePath = join(this.npm.cache, '_cacache')
+    const cacheKeys = Object.keys(await cacache.ls(cachePath))
+    if (specs.length > 0) {
+      // get results for each package spec specified
+      const results = new Set()
+      for (const spec of specs) {
+        const parsed = npa(spec)
+        if (parsed.rawSpec !== '' && parsed.type === 'tag') {
+          throw this.usageError('Cannot list cache keys for a tagged package.')
+        }
+        const keySet = await searchCachePackage(cachePath, parsed, cacheKeys)
+        for (const key of keySet) {
+          results.add(key)
+        }
+      }
+      [...results].sort(localeCompare).forEach(key => this.npm.output(key))
+      return
+    }
+    cacheKeys.sort(localeCompare).forEach(key => this.npm.output(key))
+  }
+}
+
+module.exports = Cache

package/.config/npm/node_global/lib/node_modules/npm/lib/commands/ci.js

@@ -0,0 +1,103 @@
+const Arborist = require('@npmcli/arborist')
+const reifyFinish = require('../utils/reify-finish.js')
+const runScript = require('@npmcli/run-script')
+const fs = require('fs/promises')
+const log = require('../utils/log-shim.js')
+const validateLockfile = require('../utils/validate-lockfile.js')
+
+const ArboristWorkspaceCmd = require('../arborist-cmd.js')
+const Install = require('./install.js')
+
+class CI extends ArboristWorkspaceCmd {
+  static description = 'Clean install a project'
+  static name = 'ci'
+
+  static params = Install.params
+
+  async exec () {
+    if (this.npm.global) {
+      throw Object.assign(new Error('`npm ci` does not work for global packages'), {
+        code: 'ECIGLOBAL',
+      })
+    }
+
+    const where = this.npm.prefix
+    const opts = {
+      ...this.npm.flatOptions,
+      packageLock: true, // npm ci should never skip lock files
+      path: where,
+      save: false, // npm ci should never modify the lockfile or package.json
+      workspaces: this.workspaceNames,
+    }
+
+    const arb = new Arborist(opts)
+    await arb.loadVirtual().catch(er => {
+      log.verbose('loadVirtual', er.stack)
+      const msg =
+        'The `npm ci` command can only install with an existing package-lock.json or\n' +
+        'npm-shrinkwrap.json with lockfileVersion >= 1. Run an install with npm@5 or\n' +
+        'later to generate a package-lock.json file, then try again.'
+      throw this.usageError(msg)
+    })
+
+    // retrieves inventory of packages from loaded virtual tree (lock file)
+    const virtualInventory = new Map(arb.virtualTree.inventory)
+
+    // build ideal tree step needs to come right after retrieving the virtual
+    // inventory since it's going to erase the previous ref to virtualTree
+    await arb.buildIdealTree()
+
+    // verifies that the packages from the ideal tree will match
+    // the same versions that are present in the virtual tree (lock file)
+    // throws a validation error in case of mismatches
+    const errors = validateLockfile(virtualInventory, arb.idealTree.inventory)
+    if (errors.length) {
+      throw this.usageError(
+        '`npm ci` can only install packages when your package.json and ' +
+        'package-lock.json or npm-shrinkwrap.json are in sync. Please ' +
+        'update your lock file with `npm install` ' +
+        'before continuing.\n\n' +
+        errors.join('\n')
+      )
+    }
+
+    // Only remove node_modules after we've successfully loaded the virtual
+    // tree and validated the lockfile
+    await this.npm.time('npm-ci:rm', async () => {
+      const path = `${where}/node_modules`
+      // get the list of entries so we can skip the glob for performance
+      const entries = await fs.readdir(path, null).catch(er => [])
+      return Promise.all(entries.map(f => fs.rm(`${path}/${f}`, { force: true, recursive: true })))
+    })
+
+    await arb.reify(opts)
+
+    const ignoreScripts = this.npm.config.get('ignore-scripts')
+    // run the same set of scripts that `npm install` runs.
+    if (!ignoreScripts) {
+      const scripts = [
+        'preinstall',
+        'install',
+        'postinstall',
+        'prepublish', // XXX should we remove this finally??
+        'preprepare',
+        'prepare',
+        'postprepare',
+      ]
+      const scriptShell = this.npm.config.get('script-shell') || undefined
+      for (const event of scripts) {
+        await runScript({
+          path: where,
+          args: [],
+          scriptShell,
+          stdio: 'inherit',
+          banner: !this.npm.silent,
+          event,
+        })
+      }
+    }
+    await reifyFinish(this.npm, arb)
+  }
+}
+
+module.exports = CI

package/.config/npm/node_global/lib/node_modules/npm/lib/commands/completion.js

@@ -0,0 +1,279 @@
+// Each command has a completion function that takes an options object and a cb
+// The callback gets called with an error and an array of possible completions.
+// The options object is built up based on the environment variables set by
+// zsh or bash when calling a function for completion, based on the cursor
+// position and the command line thus far.  These are:
+// COMP_CWORD: the index of the "word" in the command line being completed
+// COMP_LINE: the full command line thusfar as a string
+// COMP_POINT: the cursor index at the point of triggering completion
+//
+// We parse the command line with nopt, like npm does, and then create an
+// options object containing:
+// words: array of words in the command line
+// w: the index of the word being completed (ie, COMP_CWORD)
+// word: the word being completed
+// line: the COMP_LINE
+// lineLength
+// point: the COMP_POINT, usually equal to line length, but not always, eg if
+// the user has pressed the left-arrow to complete an earlier word
+// partialLine: the line up to the point
+// partialWord: the word being completed (which might be ''), up to the point
+// conf: a nopt parse of the command line
+//
+// When the implementation completion method returns its list of strings,
+// and arrays of strings, we filter that by any that start with the
+// partialWord, since only those can possibly be valid matches.
+//
+// Matches are wrapped with ' to escape them, if necessary, and then printed
+// one per line for the shell completion method to consume in IFS=$'\n' mode
+// as an array.
+//
+
+const fs = require('fs/promises')
+const nopt = require('nopt')
+const { resolve } = require('path')
+
+const { definitions, shorthands } = require('../utils/config/index.js')
+const { aliases, commands, plumbing } = require('../utils/cmd-list.js')
+const aliasNames = Object.keys(aliases)
+const fullList = commands.concat(aliasNames).filter(c => !plumbing.includes(c))
+const configNames = Object.keys(definitions)
+const shorthandNames = Object.keys(shorthands)
+const allConfs = configNames.concat(shorthandNames)
+const { isWindowsShell } = require('../utils/is-windows.js')
+const fileExists = (file) => fs.stat(file).then(s => s.isFile()).catch(() => false)
+
+const BaseCommand = require('../base-command.js')
+
+class Completion extends BaseCommand {
+  static description = 'Tab Completion for npm'
+  static name = 'completion'
+
+  // completion for the completion command
+  async completion (opts) {
+    if (opts.w > 2) {
+      return
+    }
+
+    const [bashExists, zshExists] = await Promise.all([
+      fileExists(resolve(process.env.HOME, '.bashrc')),
+      fileExists(resolve(process.env.HOME, '.zshrc')),
+    ])
+    const out = []
+    if (zshExists) {
+      out.push(['>>', '~/.zshrc'])
+    }
+
+    if (bashExists) {
+      out.push(['>>', '~/.bashrc'])
+    }
+
+    return out
+  }
+
+  async exec (args) {
+    if (isWindowsShell) {
+      const msg = 'npm completion supported only in MINGW / Git bash on Windows'
+      throw Object.assign(new Error(msg), {
+        code: 'ENOTSUP',
+      })
+    }
+
+    const { COMP_CWORD, COMP_LINE, COMP_POINT, COMP_FISH } = process.env
+
+    // if the COMP_* isn't in the env, then just dump the script.
+    if (COMP_CWORD === undefined || COMP_LINE === undefined || COMP_POINT === undefined) {
+      return dumpScript(resolve(this.npm.npmRoot, 'lib', 'utils', 'completion.sh'))
+    }
+
+    // ok we're actually looking at the envs and outputting the suggestions
+    // get the partial line and partial word,
+    // if the point isn't at the end.
+    // ie, tabbing at: npm foo b|ar
+    const w = +COMP_CWORD
+    const words = args.map(unescape)
+    const word = words[w]
+    const line = COMP_LINE
+    const point = +COMP_POINT
+    const partialLine = line.slice(0, point)
+    const partialWords = words.slice(0, w)
+
+    // figure out where in that last word the point is.
+    const partialWordRaw = args[w]
+    let i = partialWordRaw.length
+    while (partialWordRaw.slice(0, i) !== partialLine.slice(-1 * i) && i > 0) {
+      i--
+    }
+
+    const partialWord = unescape(partialWordRaw.slice(0, i))
+    partialWords.push(partialWord)
+
+    const opts = {
+      isFish: COMP_FISH === 'true',
+      words,
+      w,
+      word,
+      line,
+      lineLength: line.length,
+      point,
+      partialLine,
+      partialWords,
+      partialWord,
+      raw: args,
+    }
+
+    if (partialWords.slice(0, -1).indexOf('--') === -1) {
+      if (word.charAt(0) === '-') {
+        return this.wrap(opts, configCompl(opts))
+      }
+
+      if (words[w - 1] &&
+        words[w - 1].charAt(0) === '-' &&
+        !isFlag(words[w - 1])) {
+        // awaiting a value for a non-bool config.
+        // don't even try to do this for now
+        return this.wrap(opts, configValueCompl(opts))
+      }
+    }
+
+    // try to find the npm command.
+    // it's the first thing after all the configs.
+    // take a little shortcut and use npm's arg parsing logic.
+    // don't have to worry about the last arg being implicitly
+    // boolean'ed, since the last block will catch that.
+    const types = Object.entries(definitions).reduce((acc, [key, def]) => {
+      acc[key] = def.type
+      return acc
+    }, {})
+    const parsed = opts.conf =
+      nopt(types, shorthands, partialWords.slice(0, -1), 0)
+    // check if there's a command already.
+    const cmd = parsed.argv.remain[1]
+    if (!cmd) {
+      return this.wrap(opts, cmdCompl(opts, this.npm))
+    }
+
+    Object.keys(parsed).forEach(k => this.npm.config.set(k, parsed[k]))
+
+    // at this point, if words[1] is some kind of npm command,
+    // then complete on it.
+    // otherwise, do nothing
+    const impl = await this.npm.cmd(cmd)
+    if (impl.completion) {
+      const comps = await impl.completion(opts)
+      return this.wrap(opts, comps)
+    }
+  }
+
+  // The command should respond with an array.  Loop over that,
+  // wrapping quotes around any that have spaces, and writing
+  // them to stdout.
+  // If any of the items are arrays, then join them with a space.
+  // Ie, returning ['a', 'b c', ['d', 'e']] would allow it to expand
+  // to: 'a', 'b c', or 'd' 'e'
+  wrap (opts, compls) {
+    // TODO this was dead code, leaving it in case we find some command we
+    // forgot that requires this. if so *that command should fix its
+    // completions*
+    // compls = compls.map(w => !/\s+/.test(w) ? w : '\'' + w + '\'')
+
+    if (opts.partialWord) {
+      compls = compls.filter(c => c.startsWith(opts.partialWord))
+    }
+
+    if (compls.length > 0) {
+      this.npm.output(compls.join('\n'))
+    }
+  }
+}
+
+const dumpScript = async (p) => {
+  const d = (await fs.readFile(p, 'utf8')).replace(/^#!.*?\n/, '')
+  await new Promise((res, rej) => {
+    let done = false
+    process.stdout.on('error', er => {
+      if (done) {
+        return
+      }
+
+      done = true
+
+      // Darwin is a pain sometimes.
+      //
+      // This is necessary because the "source" or "." program in
+      // bash on OS X closes its file argument before reading
+      // from it, meaning that you get exactly 1 write, which will
+      // work most of the time, and will always raise an EPIPE.
+      //
+      // Really, one should not be tossing away EPIPE errors, or any
+      // errors, so casually.  But, without this, `. <(npm completion)`
+      // can never ever work on OS X.
+      // TODO Ignoring coverage, see 'non EPIPE errors cause failures' test.
+      /* istanbul ignore next */
+      if (er.errno === 'EPIPE') {
+        res()
+      } else {
+        rej(er)
+      }
+    })
+
+    process.stdout.write(d, () => {
+      if (done) {
+        return
+      }
+
+      done = true
+      res()
+    })
+  })
+}
+
+const unescape = w => w.charAt(0) === '\'' ? w.replace(/^'|'$/g, '')
+  : w.replace(/\\ /g, ' ')
+
+// the current word has a dash.  Return the config names,
+// with the same number of dashes as the current word has.
+const configCompl = opts => {
+  const word = opts.word
+  const split = word.match(/^(-+)((?:no-)*)(.*)$/)
+  const dashes = split[1]
+  const no = split[2]
+  const flags = configNames.filter(isFlag)
+  return allConfs.map(c => dashes + c)
+    .concat(flags.map(f => dashes + (no || 'no-') + f))
+}
+
+// expand with the valid values of various config values.
+// not yet implemented.
+const configValueCompl = opts => []
+
+// check if the thing is a flag or not.
+const isFlag = word => {
+  // shorthands never take args.
+  const split = word.match(/^(-*)((?:no-)+)?(.*)$/)
+  const no = split[2]
+  const conf = split[3]
+  const { type } = definitions[conf]
+  return no ||
+    type === Boolean ||
+    (Array.isArray(type) && type.includes(Boolean)) ||
+    shorthands[conf]
+}
+
+// complete against the npm commands
+// if they all resolve to the same thing, just return the thing it already is
+const cmdCompl = (opts, npm) => {
+  const matches = fullList.filter(c => c.startsWith(opts.partialWord))
+  if (!matches.length) {
+    return matches
+  }
+
+  const derefs = new Set([...matches.map(c => npm.deref(c))])
+  if (derefs.size === 1) {
+    return [...derefs]
+  }
+
+  return fullList
+}
+
+module.exports = Completion