lurqrun 0.1.6 → 0.1.8

package/dist/chunk-QSL6QN5X.js

@@ -0,0 +1,115 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/security/verdict.ts
+init_esm_shims();
+var SEVERE = /* @__PURE__ */ new Set(["critical", "high"]);
+function describeScope(i) {
+  if (!i.exists) return "this name";
+  if (!i.subjectVersion) {
+    return i.subjectInstalled ? "the installed version" : "the latest published version";
+  }
+  return i.subjectInstalled ? `the installed ${i.subjectVersion}` : `${i.subjectVersion} (latest)`;
+}
+function hasSevereAdvisory(advisories) {
+  return advisories.some((a) => SEVERE.has(a.severity));
+}
+function assessVerdict(i) {
+  const reasons = [];
+  const unknowns = [];
+  if (!i.exists) {
+    return {
+      level: "invalid",
+      reasons: [
+        i.typosquatOf ? `no such package on npm \u2014 the name closely mimics "${i.typosquatOf}", which is what a typosquat looks like. Do not install it; check the spelling you meant.` : "no such package on npm. This name does not exist, so there is nothing to assess \u2014 check the spelling, or that you are not recalling a package that was never published."
+      ],
+      unknowns: [],
+      complete: true,
+      reassuring: false,
+      advisoryCount: null,
+      scope: describeScope(i)
+    };
+  }
+  const analysed = i.advisories !== null;
+  const advisories = i.advisories ?? [];
+  if (!analysed) {
+    unknowns.push("advisories have not been checked for this package yet");
+  }
+  if (i.vulnLookupComplete === false) {
+    unknowns.push("the vulnerability lookup did not complete, so results are partial");
+  }
+  const severe = hasSevereAdvisory(advisories);
+  const versionVulns = i.versionVulns ?? [];
+  if (i.typosquatOf) {
+    reasons.push(`name closely mimics "${i.typosquatOf}" \u2014 possible typosquat`);
+  }
+  if (versionVulns.length) {
+    reasons.push(
+      `the installed version is affected by ${versionVulns.length} advisory(ies): ${versionVulns.slice(0, 4).join(", ")}`
+    );
+  }
+  if (severe) {
+    const worst = advisories.filter((a) => SEVERE.has(a.severity));
+    reasons.push(`${worst.length} critical/high advisory(ies) recorded against this package`);
+  }
+  const malwarePattern = Boolean(i.installScripts && i.brandNew && i.lowTrust);
+  if (malwarePattern) {
+    reasons.push(
+      "published within the last 7 days, runs install scripts, and has almost no adoption \u2014 the shape of a malicious package"
+    );
+  }
+  if (i.typosquatOf || versionVulns.length || severe || malwarePattern) {
+    return {
+      level: "high",
+      reasons,
+      unknowns,
+      complete: analysed && i.vulnLookupComplete !== false,
+      reassuring: false,
+      advisoryCount: analysed ? advisories.length : null,
+      scope: describeScope(i)
+    };
+  }
+  if (advisories.length > 0) {
+    reasons.push(
+      `${advisories.length} advisory(ies) recorded against this package (none critical or high)`
+    );
+  }
+  if (i.deprecated) reasons.push("the publisher has marked this package deprecated");
+  if (i.archived) reasons.push("the source repository is archived");
+  if (i.installScripts && (i.lowTrust || i.brandNew)) {
+    reasons.push("runs install scripts and has little adoption or history");
+  }
+  if (i.lowTrust && i.singleMaintainer) {
+    reasons.push("a single maintainer and very low adoption");
+  }
+  if (reasons.length > 0) {
+    return {
+      level: "medium",
+      reasons,
+      unknowns,
+      complete: analysed && i.vulnLookupComplete !== false,
+      reassuring: false,
+      advisoryCount: analysed ? advisories.length : null,
+      scope: describeScope(i)
+    };
+  }
+  const complete = analysed && i.vulnLookupComplete !== false;
+  return {
+    level: "low",
+    reasons: [],
+    unknowns,
+    complete,
+    // The only path that produces a green tick, and it requires the evidence to
+    // be complete. An unanalysed package reads as "not checked yet", never as
+    // "nothing wrong with it".
+    reassuring: complete,
+    advisoryCount: analysed ? advisories.length : null,
+    scope: describeScope(i)
+  };
+}
+
+export {
+  assessVerdict
+};

package/dist/chunk-QUIMQ7YL.js

@@ -0,0 +1,73 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  httpRequest
+} from "./chunk-KYKSZ3XZ.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/ingestion/sources/osv.ts
+init_esm_shims();
+var HOST = "api.osv.dev";
+var URL = `https://${HOST}/v1/querybatch`;
+var BATCH = 250;
+var CONCURRENCY = 4;
+function installKey(name, version) {
+  return `${name}@${version}`;
+}
+async function queryVulnerableInstalls(installs, fetchImpl) {
+  const affected = /* @__PURE__ */ new Map();
+  if (installs.length === 0) return { affected, complete: true };
+  const unique = [...new Map(installs.map((i) => [installKey(i.name, i.version), i])).values()];
+  const batches = [];
+  for (let i = 0; i < unique.length; i += BATCH) batches.push(unique.slice(i, i + BATCH));
+  let complete = true;
+  let cursor = 0;
+  const worker = async () => {
+    for (let i = cursor++; i < batches.length; i = cursor++) {
+      const batch = batches[i];
+      try {
+        const { data } = await httpRequest(URL, {
+          host: HOST,
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            queries: batch.map((q) => ({
+              version: q.version,
+              package: { name: q.name, ecosystem: "npm" }
+            }))
+          }),
+          // Uncached on purpose. The shared cache keys on the URL, and every
+          // batch here posts to the same one with a different body — a cache hit
+          // would answer one tree's question with another tree's vulnerabilities.
+          ttlMs: 0,
+          // Best-effort by contract: the caller keeps its coarser answer when
+          // this fails, so exhausting the default retry ladder would only stall
+          // a scheduled scan behind an outage nobody is waiting on.
+          retries: 1,
+          fetchImpl
+        });
+        const results = data?.results ?? [];
+        if (results.length !== batch.length) {
+          complete = false;
+          continue;
+        }
+        results.forEach((result, j) => {
+          const ids = (result?.vulns ?? []).map((v) => v?.id).filter((id) => typeof id === "string");
+          if (ids.length === 0) return;
+          const q = batch[j];
+          affected.set(installKey(q.name, q.version), ids);
+        });
+      } catch {
+        complete = false;
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(CONCURRENCY, batches.length) }, worker));
+  return { affected, complete };
+}
+
+export {
+  installKey,
+  queryVulnerableInstalls
+};

package/dist/chunk-RG3YLU6E.js

@@ -0,0 +1,49 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  LocalSandbox
+} from "./chunk-C6GLE626.js";
+import {
+  getConfig
+} from "./chunk-GRJXQBQZ.js";
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/sandbox/index.ts
+init_esm_shims();
+var SandboxIsolationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SandboxIsolationError";
+  }
+};
+var localSandboxAllowed = (env = process.env) => env.LURQ_ALLOW_LOCAL_SANDBOX === "1";
+function isolationGate(opts) {
+  if (opts.hasE2BKey) return { ok: true, driver: "e2b" };
+  if (opts.allowLocal) return { ok: true, driver: "local" };
+  return {
+    ok: false,
+    reason: "no VM isolation available: E2B_API_KEY is not set, so this would install and import an untrusted package in this process's own container. Set E2B_API_KEY, or set LURQ_ALLOW_LOCAL_SANDBOX=1 to accept local execution deliberately."
+  };
+}
+var isolationAvailable = (env) => isolationGate({
+  hasE2BKey: Boolean(getConfig().E2B_API_KEY),
+  allowLocal: localSandboxAllowed(env)
+}).ok;
+async function getSandbox(opts = {}) {
+  const hasE2BKey = Boolean(getConfig().E2B_API_KEY);
+  if (opts.isolated) {
+    const gate = isolationGate({ hasE2BKey, allowLocal: localSandboxAllowed() });
+    if (!gate.ok) throw new SandboxIsolationError(gate.reason);
+  }
+  if (hasE2BKey) {
+    const { E2BSandbox } = await import("./e2b-FVPHDULZ.js");
+    return new E2BSandbox();
+  }
+  return new LocalSandbox();
+}
+
+export {
+  isolationAvailable,
+  getSandbox
+};

package/dist/chunk-SHCEBP3J.js

@@ -0,0 +1,107 @@
+import { createRequire as __lurqCreateRequire } from 'node:module'; const require = __lurqCreateRequire(import.meta.url);
+import {
+  init_esm_shims
+} from "./chunk-I3M2KJXB.js";
+
+// src/surface/types.ts
+init_esm_shims();
+function runtimeSymbols(surface) {
+  return surface.symbols.filter((s) => s.kind !== "type_only" && s.origin === "local");
+}
+function starReExports(surface) {
+  return surface.externalReExports.filter(
+    (spec) => !surface.symbols.some((s) => s.origin === `external:${spec}`)
+  );
+}
+
+// src/surface/diff.ts
+init_esm_shims();
+var empty = (from, to, reason) => ({
+  package: from.package,
+  fromVersion: from.version,
+  toVersion: to.version,
+  tier: from.tier,
+  removed: [],
+  added: [],
+  arityChanged: [],
+  signatureChanged: [],
+  typeOnlyRemoved: [],
+  deprecated: [],
+  renamed: [],
+  inconclusive: reason
+});
+function diffSurfaces(from, to) {
+  if (from.tier !== to.tier) {
+    return empty(from, to, `cross-tier comparison refused: ${from.tier} vs ${to.tier}`);
+  }
+  if (from.symbols.length === 0) {
+    return empty(from, to, "source surface is empty, extraction failed, not a removal");
+  }
+  if (to.symbols.length === 0) {
+    return empty(from, to, "target surface is empty, extraction failed, not a removal");
+  }
+  const fromRuntime = new Map(runtimeSymbols(from).map((s) => [s.path, s]));
+  const toRuntime = new Map(runtimeSymbols(to).map((s) => [s.path, s]));
+  const toPresent = new Set(to.symbols.filter((s) => s.kind !== "type_only").map((s) => s.path));
+  const removed = [...fromRuntime.values()].filter((s) => !toPresent.has(s.path));
+  const added = [...toRuntime.values()].filter((s) => !fromRuntime.has(s.path));
+  const arityChanged = [];
+  for (const [path, a] of fromRuntime) {
+    const b = toRuntime.get(path);
+    if (!b) continue;
+    const requiredChanged = a.arity !== null && b.arity !== null && a.arity !== b.arity;
+    const measured = a.maxArity !== void 0 && b.maxArity !== void 0;
+    const maxShrank = typeof a.maxArity === "number" && typeof b.maxArity === "number" && b.maxArity < a.maxArity;
+    if (requiredChanged || maxShrank) {
+      arityChanged.push({
+        path,
+        from: a.arity,
+        to: b.arity,
+        ...measured ? { fromMax: a.maxArity, toMax: b.maxArity } : {}
+      });
+    }
+  }
+  const typeOnlyFrom = from.symbols.filter((s) => s.kind === "type_only");
+  const toPaths = new Set(to.symbols.map((s) => s.path));
+  const typeOnlyRemoved = typeOnlyFrom.filter((s) => !toPaths.has(s.path));
+  const signatureChanged = [];
+  if (from.tier === "bundled_dts") {
+    const fromAll = new Map(from.symbols.map((s) => [s.path, s]));
+    for (const b of to.symbols) {
+      const a = fromAll.get(b.path);
+      if (a?.signature && b.signature && a.signature !== b.signature) {
+        signatureChanged.push({ path: b.path, from: a.signature, to: b.signature });
+      }
+    }
+  }
+  const deprecated = [...toRuntime.values()].filter(
+    (s) => s.deprecated && !fromRuntime.get(s.path)?.deprecated
+  );
+  const declKey = (s) => s.sourceRef?.offset === void 0 ? null : `${s.sourceRef.file}#${s.sourceRef.offset}`;
+  const renamed = [];
+  for (const r of removed) {
+    const key = declKey(r);
+    if (key === null) continue;
+    const survivors = [...fromRuntime.values()].filter((s) => s.path !== r.path && toRuntime.has(s.path) && declKey(s) === key).map((s) => s.path);
+    if (survivors.length) renamed.push({ path: r.path, to: survivors });
+  }
+  return {
+    package: from.package,
+    fromVersion: from.version,
+    toVersion: to.version,
+    tier: from.tier,
+    removed,
+    added,
+    arityChanged,
+    signatureChanged,
+    typeOnlyRemoved,
+    deprecated,
+    renamed
+  };
+}
+
+export {
+  runtimeSymbols,
+  starReExports,
+  diffSurfaces
+};