Cleanup arborist types

Author: jdalton

src/shadow/arborist/lib/arborist/diff.ts

@@ -1,29 +1,7 @@
 import constants from '../../../../constants'
 
+import type { Diff } from './types'
 import type { SafeNode } from '../node'
-import type { Diff as BaseDiff } from '@npmcli/arborist'
-
-export type SafeDiff = Omit<
-  BaseDiff,
-  | 'actual'
-  | 'children'
-  | 'filterSet'
-  | 'ideal'
-  | 'leaves'
-  | 'removed'
-  | 'shrinkwrapInflated'
-  | 'unchanged'
-> & {
-  actual: SafeNode
-  children: SafeDiff[]
-  filterSet: Set<SafeNode>
-  ideal: SafeNode
-  leaves: SafeNode[]
-  parent: SafeDiff | null
-  removed: SafeNode[]
-  shrinkwrapInflated: Set<SafeNode>
-  unchanged: SafeNode[]
-}
 
 const { LOOP_SENTINEL, NPM_REGISTRY_URL, SOCKET_CLI_FIX_PACKAGE_LOCK_FILE } =
   constants
@@ -47,7 +25,7 @@ type GetPackagesToQueryFromDiffOptions = {
 }
 
 export function getPackagesToQueryFromDiff(
-  diff_: SafeDiff | null,
+  diff_: Diff | null,
   options?: GetPackagesToQueryFromDiffOptions
 ): PackageDetail[] {
   const {
@@ -63,7 +41,7 @@ export function getPackagesToQueryFromDiff(
   if (!diff_) {
     return details
   }
-  const queue: SafeDiff[] = [...diff_.children]
+  const queue: Diff[] = [...diff_.children]
   let pos = 0
   let { length: queueLength } = queue
   while (pos < queueLength) {

src/shadow/arborist/lib/arborist/index.ts

@@ -1,50 +1,12 @@
-import { reify } from './reify'
+import { kRiskyReify, reify } from './reify'
 import { arboristClassPath } from '../../../npm-paths'
 
-import type { SafeDiff } from './diff'
+import type { ArboristClass, ArboristReifyOptions } from './types'
 import type { SafeNode } from '../node'
-import type {
-  Options as ArboristOptions,
-  Advisory as BaseAdvisory,
-  Arborist as BaseArborist,
-  AuditReport as BaseAuditReport,
-  ReifyOptions
-} from '@npmcli/arborist'
-
-export type ArboristClass = ArboristInstance & {
-  new (...args: any): ArboristInstance
-}
-
-export type ArboristInstance = Omit<
-  typeof BaseArborist,
-  'actualTree' | 'auditReport' | 'diff' | 'idealTree' | 'reify'
-> & {
-  auditReport?: AuditReportInstance | null | undefined
-  actualTree?: SafeNode | null | undefined
-  diff: SafeDiff | null
-  idealTree?: SafeNode | null | undefined
-  reify(options?: ArboristReifyOptions): Promise<SafeNode>
-}
-
-export type ArboristReifyOptions = ReifyOptions & ArboristOptions
-
-export type AuditReportInstance = Omit<BaseAuditReport, 'report'> & {
-  report: { [dependency: string]: AuditAdvisory[] }
-}
-
-export type AuditAdvisory = Omit<BaseAdvisory, 'id'> & {
-  id: number
-  cwe: string[]
-  cvss: {
-    score: number
-    vectorString: string
-  }
-  vulnerable_versions: string
-}
 
 export const Arborist: ArboristClass = require(arboristClassPath)
+
 export const kCtorArgs = Symbol('ctorArgs')
-export const kRiskyReify = Symbol('riskyReify')
 
 // Implementation code not related to our custom behavior is based on
 // https://github.com/npm/cli/blob/v11.0.0/workspaces/arborist/lib/arborist/index.js:

src/shadow/arborist/lib/arborist/types.ts

@@ -0,0 +1,62 @@
+import type { SafeNode } from '../node'
+import type {
+  Options as ArboristOptions,
+  Advisory as BaseAdvisory,
+  Arborist as BaseArborist,
+  AuditReport as BaseAuditReport,
+  Diff as BaseDiff,
+  ReifyOptions
+} from '@npmcli/arborist'
+
+export type ArboristClass = ArboristInstance & {
+  new (...args: any): ArboristInstance
+}
+
+export type ArboristInstance = Omit<
+  typeof BaseArborist,
+  'actualTree' | 'auditReport' | 'diff' | 'idealTree' | 'reify'
+> & {
+  auditReport?: AuditReportInstance | null | undefined
+  actualTree?: SafeNode | null | undefined
+  diff: Diff | null
+  idealTree?: SafeNode | null | undefined
+  reify(options?: ArboristReifyOptions): Promise<SafeNode>
+}
+
+export type ArboristReifyOptions = ReifyOptions & ArboristOptions
+
+export type AuditReportInstance = Omit<BaseAuditReport, 'report'> & {
+  report: { [dependency: string]: AuditAdvisory[] }
+}
+
+export type AuditAdvisory = Omit<BaseAdvisory, 'id'> & {
+  id: number
+  cwe: string[]
+  cvss: {
+    score: number
+    vectorString: string
+  }
+  vulnerable_versions: string
+}
+
+export type Diff = Omit<
+  BaseDiff,
+  | 'actual'
+  | 'children'
+  | 'filterSet'
+  | 'ideal'
+  | 'leaves'
+  | 'removed'
+  | 'shrinkwrapInflated'
+  | 'unchanged'
+> & {
+  actual: SafeNode
+  children: Diff[]
+  filterSet: Set<SafeNode>
+  ideal: SafeNode
+  leaves: SafeNode[]
+  parent: Diff | null
+  removed: SafeNode[]
+  shrinkwrapInflated: Set<SafeNode>
+  unchanged: SafeNode[]
+}

src/utils/alert/artifact.ts

@@ -5,6 +5,24 @@ import rl from 'node:readline'
 import constants from '../../constants'
 import { getPublicToken } from '../sdk'
 
+export type CveAlertType = 'criticalCVE' | 'cve' | 'mediumCVE' | 'mildCVE'
+
+export type ArtifactAlertCveFixable = Omit<
+  SocketArtifactAlert,
+  'props' | 'title'
+> & {
+  type: CveAlertType
+  props: {
+    firstPatchedVersionIdentifier: string
+    vulnerableVersionRange: string
+    [key: string]: any
+  }
+}
+
+export type ArtifactAlertFixable = ArtifactAlertCveFixable & {
+  type: CveAlertType | 'socketUpgradeAvailable'
+}
+
 export type SocketArtifactAlert = {
   key: string
   type: string
@@ -85,18 +103,23 @@ export async function* batchScan(
   }
 }
 
-export function isArtifactAlertCveFixable(alert: SocketArtifactAlert): boolean {
+export function isArtifactAlertCveFixable(
+  alert: SocketArtifactAlert
+): alert is ArtifactAlertCveFixable {
   const { type } = alert
   return (
     (type === 'cve' ||
       type === 'mediumCVE' ||
       type === 'mildCVE' ||
       type === 'criticalCVE') &&
-    !!alert.props?.['firstPatchedVersionIdentifier']
+    !!alert.props?.['firstPatchedVersionIdentifier'] &&
+    !!alert.props?.['vulnerableVersionRange']
   )
 }
 
-export function isArtifactAlertFixable(alert: SocketArtifactAlert): boolean {
+export function isArtifactAlertFixable(
+  alert: SocketArtifactAlert
+): alert is ArtifactAlertFixable {
   return (
     alert.type === 'socketUpgradeAvailable' || isArtifactAlertCveFixable(alert)
   )