@c9up/ream 0.2.28 → 0.2.30

package/src/codemods/source.ts

@@ -0,0 +1,303 @@
+/**
+ * Just enough of a TypeScript scanner for the configure codemods: find a
+ * call or an object/array literal in CODE (never inside a string, a template
+ * or a comment), split a literal into its top-level entries, and append to
+ * one. Upstream does this with a full AST; ream ships no compiler, and the
+ * files these codemods edit (`start/env.ts`, `reamrc.ts`) are object and
+ * array literals.
+ *
+ * Not handled: regular-expression literals (a quote inside one reads as the
+ * start of a string). Neither file has a reason to contain one.
+ */
+
+const CLOSERS: Record<string, string> = { '{': '}', '[': ']', '(': ')' }
+
+function isIdentifierChar(char: string | undefined): boolean {
+  return char !== undefined && /[A-Za-z0-9_$]/.test(char)
+}
+
+/**
+ * The index just past the string, template or comment starting at `i`, or
+ * `i` itself when none starts there. An unterminated one runs to the end.
+ */
+function skipNonCode(src: string, i: number): number {
+  const char = src[i]
+  const next = src[i + 1]
+  if (char === '/' && next === '/') {
+    const end = src.indexOf('\n', i)
+    return end === -1 ? src.length : end
+  }
+  if (char === '/' && next === '*') {
+    const end = src.indexOf('*/', i + 2)
+    return end === -1 ? src.length : end + 2
+  }
+  if (char === "'" || char === '"') {
+    let j = i + 1
+    while (j < src.length && src[j] !== char && src[j] !== '\n') {
+      j += src[j] === '\\' ? 2 : 1
+    }
+    return j + 1
+  }
+  if (char === '`') {
+    let j = i + 1
+    while (j < src.length && src[j] !== '`') {
+      if (src[j] === '\\') {
+        j += 2
+      } else if (src[j] === '$' && src[j + 1] === '{') {
+        const close = matchClose(src, j + 1)
+        j = close === -1 ? src.length : close + 1
+      } else {
+        j += 1
+      }
+    }
+    return j + 1
+  }
+  return i
+}
+
+/** Whether the string, template or block comment starting at `i` is closed. */
+function isTerminated(src: string, i: number): boolean {
+  const char = src[i]
+  if (char === '/') return src.indexOf('*/', i + 2) !== -1
+  const end = skipNonCode(src, i)
+  return end <= src.length && end - 1 > i && src[end - 1] === char
+}
+
+/** Index of the bracket closing the one at `open`, or -1. */
+export function matchClose(src: string, open: number): number {
+  const first = CLOSERS[src[open] ?? '']
+  if (first === undefined) return -1
+  const stack = [first]
+  let i = open + 1
+  while (i < src.length) {
+    const skipped = skipNonCode(src, i)
+    if (skipped !== i) {
+      i = skipped
+      continue
+    }
+    const char = src[i] ?? ''
+    const closer = CLOSERS[char]
+    if (closer !== undefined) {
+      stack.push(closer)
+    } else if (char === stack[stack.length - 1]) {
+      stack.pop()
+      if (stack.length === 0) return i
+    } else if (char === '}' || char === ']' || char === ')') {
+      return -1
+    }
+    i += 1
+  }
+  return -1
+}
+
+/** First code character at or after `i` (before `end`), skipping whitespace and comments. */
+function firstCode(src: string, i: number, end: number): number {
+  let j = i
+  while (j < end) {
+    const char = src[j] ?? ''
+    if (/\s/.test(char)) {
+      j += 1
+      continue
+    }
+    if (char === '/' && (src[j + 1] === '/' || src[j + 1] === '*')) {
+      j = skipNonCode(src, j)
+      continue
+    }
+    return j
+  }
+  return end
+}
+
+/** One top-level entry of a literal: the text between two commas. */
+export interface Segment {
+  start: number
+  end: number
+  /** First code character, or `end` when the entry is only trivia. */
+  codeStart: number
+  /** Just past the last code character (comments and whitespace excluded). */
+  codeEnd: number
+}
+
+/** Split `src[start, end)` on its top-level commas. */
+export function segments(src: string, start: number, end: number): Segment[] {
+  const out: Segment[] = []
+  let segmentStart = start
+  let codeEnd = start
+  let depth = 0
+  let i = start
+  const close = (at: number) => {
+    const codeStart = firstCode(src, segmentStart, at)
+    out.push({ start: segmentStart, end: at, codeStart, codeEnd: Math.max(codeEnd, codeStart) })
+  }
+  while (i < end) {
+    const char = src[i] ?? ''
+    if (char === '/' && (src[i + 1] === '/' || src[i + 1] === '*')) {
+      i = skipNonCode(src, i)
+      continue
+    }
+    const skipped = skipNonCode(src, i)
+    if (skipped !== i) {
+      i = skipped
+      codeEnd = i
+      continue
+    }
+    if (char === ',' && depth === 0) {
+      close(i)
+      segmentStart = i + 1
+      codeEnd = i + 1
+      i += 1
+      continue
+    }
+    if (CLOSERS[char] !== undefined) depth += 1
+    else if (char === '}' || char === ']' || char === ')') depth -= 1
+    if (!/\s/.test(char)) codeEnd = i + 1
+    i += 1
+  }
+  close(end)
+  return out
+}
+
+/**
+ * Whether `code` is one complete expression that cannot reach outside the
+ * slot it is written into: brackets balanced and never closing past where
+ * they opened, strings and comments terminated, no top-level comma.
+ */
+export function isSingleExpression(code: string): boolean {
+  if (code.trim() === '') return false
+  let depth = 0
+  let i = 0
+  while (i < code.length) {
+    const skipped = skipNonCode(code, i)
+    if (skipped !== i) {
+      // A line comment would swallow the comma written after the value.
+      const lineComment = code[i] === '/' && code[i + 1] === '/'
+      if (lineComment || !isTerminated(code, i)) return false
+      i = skipped
+      continue
+    }
+    const char = code[i] ?? ''
+    if (CLOSERS[char] !== undefined) depth += 1
+    else if (char === '}' || char === ']' || char === ')') {
+      depth -= 1
+      if (depth < 0) return false
+    } else if (char === ',' && depth === 0) return false
+    i += 1
+  }
+  return depth === 0
+}
+
+/**
+ * Index of the `(` of the first call to `callee` in code, or -1. A mention
+ * inside a string or a comment, or as the tail of a longer name
+ * (`MyEnv.create`), does not count.
+ */
+export function findCall(src: string, callee: string): number {
+  let i = 0
+  while (i < src.length) {
+    const skipped = skipNonCode(src, i)
+    if (skipped !== i) {
+      i = skipped
+      continue
+    }
+    const before = src[i - 1]
+    if (src.startsWith(callee, i) && !isIdentifierChar(before) && before !== '.') {
+      const paren = firstCode(src, i + callee.length, src.length)
+      if (src[paren] === '(') return paren
+    }
+    i += 1
+  }
+  return -1
+}
+
+/** Index of the `{` after the first `export default` in code, or -1. */
+export function findExportDefaultObject(src: string): number {
+  let i = 0
+  while (i < src.length) {
+    const skipped = skipNonCode(src, i)
+    if (skipped !== i) {
+      i = skipped
+      continue
+    }
+    if (src.startsWith('export', i) && !isIdentifierChar(src[i - 1])) {
+      const word = firstCode(src, i + 'export'.length, src.length)
+      if (src.startsWith('default', word) && !isIdentifierChar(src[word + 'default'.length])) {
+        const brace = firstCode(src, word + 'default'.length, src.length)
+        return src[brace] === '{' ? brace : -1
+      }
+    }
+    i += 1
+  }
+  return -1
+}
+
+/** A `key: value` entry of an object literal. */
+export interface Property {
+  key: string
+  valueStart: number
+  valueEnd: number
+}
+
+/** The `key: value` entries of the object literal opening at `open`. */
+export function properties(src: string, open: number, close: number): Property[] {
+  const out: Property[] = []
+  for (const segment of segments(src, open + 1, close)) {
+    if (segment.codeStart >= segment.end) continue
+    const text = src.slice(segment.codeStart, segment.end)
+    const match = /^(?:([A-Za-z_$][\w$]*)|'([^'\\\n]*)'|"([^"\\\n]*)")\s*:/.exec(text)
+    if (match === null) continue
+    const key = match[1] ?? match[2] ?? match[3] ?? ''
+    const valueStart = firstCode(src, segment.codeStart + match[0].length, segment.end)
+    out.push({ key, valueStart, valueEnd: segment.codeEnd })
+  }
+  return out
+}
+
+/** Leading whitespace of the line holding `index`. */
+function lineIndent(src: string, index: number): string {
+  const lineStart = src.lastIndexOf('\n', index - 1) + 1
+  return /^[ \t]*/.exec(src.slice(lineStart))?.[0] ?? ''
+}
+
+/**
+ * Append entries to the literal `src[open..close]` and return the new text.
+ *
+ * `build` receives the indentation of the existing entries (or one level
+ * deeper than the closing bracket when there are none) and returns the lines
+ * to add, each already ending with its comma. `blankLine` separates the new
+ * entries from existing ones. A missing comma after the last existing entry
+ * is added.
+ */
+export function appendToLiteral(
+  src: string,
+  open: number,
+  close: number,
+  eol: string,
+  build: (indent: string) => string[],
+  blankLine = false,
+): string {
+  const all = segments(src, open + 1, close)
+  const entries = all.filter((s) => s.codeStart < s.end)
+  const first = entries[0]
+  const closeIndent = lineIndent(src, close)
+  const firstOnOwnLine =
+    first !== undefined &&
+    /^[ \t]*$/.test(src.slice(src.lastIndexOf('\n', first.codeStart - 1) + 1, first.codeStart))
+  const indent =
+    first !== undefined && firstOnOwnLine ? lineIndent(src, first.codeStart) : `${closeIndent}  `
+  const lines = build(indent)
+  const separator = blankLine && entries.length > 0 ? eol : ''
+
+  const closeLineStart = src.lastIndexOf('\n', close - 1) + 1
+  const closeOnOwnLine = /^[ \t]*$/.test(src.slice(closeLineStart, close))
+  let out = closeOnOwnLine
+    ? `${src.slice(0, closeLineStart)}${separator}${lines.join(eol)}${eol}${src.slice(closeLineStart)}`
+    : `${src.slice(0, close)}${eol}${separator}${lines.join(eol)}${eol}${closeIndent}${src.slice(close)}`
+
+  // The comma goes in last, as it sits before every insertion point above.
+  // No comma after the last entry when it is also the last segment.
+  const last = entries[entries.length - 1]
+  if (last !== undefined && all[all.length - 1] === last) {
+    out = `${out.slice(0, last.codeEnd)},${out.slice(last.codeEnd)}`
+  }
+  return out
+}

package/src/console/prompts.ts

@@ -513,7 +513,9 @@ export class Prompt {
       rl.question(query, (answer) => {
         if (masked) stdout.write('\n')
         rl.close()
-        resolve(answer.trim())
+        // A secret is returned as typed: a password may begin or end with a
+        // space, and trimming it would store or compare a different one.
+        resolve(masked ? answer : answer.trim())
       })
     })
   }

package/src/container/Container.ts

@@ -30,10 +30,23 @@ import type { Binding, ServiceFactory, ServiceToken } from './types.js'
  */
 const RESERVED_TOKEN_NAMES = new Set(['__proto__', 'constructor', 'prototype'])
 
-/** One resolution chain: the tokens on it, and a set for O(1) membership. */
+/**
+ * Where one resolution stands: the tokens above it (a list for the message, a
+ * set for O(1) membership), and what it carries down.
+ *
+ * **Never mutated once in the async context.** Every resolution, and every
+ * construction that changes the parent, runs on its OWN copy
+ * (`#chain.run({ ...chain, ... })`). The chain used to be one object pushed to
+ * and popped from in place, and a chain opened around a whole body
+ * (`container.call()` around a command's `run()`, `resolveFor`,
+ * `runWithScopedValues`) was then shared by every concurrent task inside it:
+ * two tasks asking for the same singleton at once read as `catalog → catalog`,
+ * and one task's class could stand as another's parent for a contextual
+ * binding. A copy per step costs an array and a set the depth of the chain.
+ */
 interface ResolutionChain {
-  stack: ServiceToken[]
-  set: Set<ServiceToken>
+  readonly stack: readonly ServiceToken[]
+  readonly set: ReadonlySet<ServiceToken>
   /**
    * Values bound on the {@link ContainerResolver} that opened this chain.
    *
@@ -51,8 +64,13 @@ interface ResolutionChain {
    * `HttpContext`. Comparing this counter before and after a build says whether
    * it actually read one, so a singleton that touched no request state still
    * caches exactly as before.
+   *
+   * A box, the one mutable part, so the copies a chain is walked on all count
+   * into it: a read three dependencies down is a read by the singleton being
+   * built at the top. Concurrent siblings count into it too, which can only
+   * keep a singleton out of the cache, never put a request's into it.
    */
-  scopedReads?: number
+  readonly scopedReads: { count: number }
   /**
    * The class whose dependencies are being resolved right now.
    *
@@ -60,14 +78,19 @@ interface ResolutionChain {
    * this", so the lookup needs the direct dependent. Carried on the chain for
    * the same reason the scoped values are: `#autoConstruct` knows it, and
    * every method between there and the lookup would otherwise have to pass it
-   * down. Saved and restored around each construction, so a dependency's own
+   * down. Each construction runs on a copy that names it, so a dependency's own
    * dependencies see IT as their parent, not its parent.
    */
-  parent?: abstract new (
+  readonly parent?: abstract new (
     ...args: never[]
   ) => unknown
 }
 
+/** A chain with nothing in it yet. */
+function openChain(extra: Partial<ResolutionChain> = {}): ResolutionChain {
+  return { stack: [], set: new Set(), scopedReads: { count: 0 }, ...extra }
+}
+
 export class Container {
   #bindings: Map<ServiceToken, Binding> = new Map()
   #singletons: Map<ServiceToken, unknown> = new Map()
@@ -320,9 +343,7 @@ export class Container {
     // it and nothing outside it does.
     const chain = this.#chain.getStore()
     if (chain === undefined) {
-      return this.#chain.run({ stack: [], set: new Set() }, () =>
-        this.resolve<T>(token, runtimeValues),
-      )
+      return this.#chain.run(openChain(), () => this.resolve<T>(token, runtimeValues))
     }
 
     if (chain.set.has(key)) {
@@ -332,15 +353,14 @@ export class Container {
         context: { chain: cycle },
       })
     }
-    chain.stack.push(key)
-    chain.set.add(key)
-
-    try {
-      return await this.#resolveInner<T>(key, token, runtimeValues)
-    } finally {
-      chain.stack.pop()
-      chain.set.delete(key)
+    // On a copy: see `ResolutionChain`. What this resolution triggers sees the
+    // key above it; a sibling running at the same time does not.
+    const own: ResolutionChain = {
+      ...chain,
+      stack: [...chain.stack, key],
+      set: new Set(chain.set).add(key),
     }
+    return this.#chain.run(own, () => this.#resolveInner<T>(key, token, runtimeValues))
   }
 
   /**
@@ -364,52 +384,17 @@ export class Container {
     // its own with nobody in it.
     const chain = this.#chain.getStore()
     if (chain === undefined) {
-      return this.#chain.run({ stack: [], set: new Set(), parent: target }, () =>
+      return this.#chain.run(openChain({ parent: target }), () =>
         this.call(instance, method, runtimeValues),
       )
     }
-    const outerParent = chain.parent
-    // Declared outside the try so the call below can still read it: only the
-    // RESOLUTION is guarded, because that is what can throw with the parent
-    // installed.
-    const args: unknown[] = []
-    chain.parent = target
-    try {
-      const paramTypes: unknown[] =
-        Reflect.getMetadata('design:paramtypes', target.prototype, method) ?? []
-      // `@Inject('token')` on a method parameter — a named binding the reflected
-      // type cannot express (an interface, or a class registered under a name).
-      const injectTokens = getMethodInjectTokens(target.prototype, method)
-
-      // `@Inject` counts towards the parameter span too: a method may carry named
-      // tokens without `design:paramtypes` being emitted for it, and computing the
-      // span from the reflected types alone left the loop at zero iterations —
-      // the tokens were read and then never used.
-      const injectSpan = injectTokens.size === 0 ? 0 : Math.max(...injectTokens.keys()) + 1
-      const len = Math.max(paramTypes.length, runtimeValues?.length ?? 0, injectSpan)
-      // Sequential resolution keeps the shared cycle-detection stack consistent.
-      for (let index = 0; index < len; index += 1) {
-        // Runtime values take precedence (and fill slots beyond paramTypes).
-        if (runtimeValues && index < runtimeValues.length) {
-          args.push(runtimeValues[index])
-          continue
-        }
-        const named = injectTokens.get(index)
-        if (named !== undefined) {
-          args.push(await this.resolve(named))
-          continue
-        }
-        const type = paramTypes[index]
-        args.push(isInjectableClass(type) ? await this.resolve(type) : undefined)
-      }
-    } finally {
-      // RESTORED whatever happened. Without the `finally`, a parameter that
-      // failed to resolve left the called class installed as the parent, so a
-      // caller that caught the error saw its contextual bindings applied to
-      // every later resolution — a binding meant for one handler leaking into
-      // the whole application.
-      chain.parent = outerParent
-    }
+    // The parameters are resolved with `target` as the parent, on a copy of
+    // the chain (see `ResolutionChain`), so nothing outside them sees it: not
+    // the caller once they are resolved, whatever happened, and not a task
+    // running beside them. The method itself runs on the caller's chain.
+    const args = await this.#chain.run({ ...chain, parent: target }, () =>
+      this.#methodArgs(target, method, runtimeValues),
+    )
 
     const member: unknown = instance[method]
     if (!isCallable(member)) {
@@ -418,6 +403,44 @@ export class Container {
     return member.apply(instance, args)
   }
 
+  /** The arguments `call()` passes to `target.prototype[method]`. */
+  async #methodArgs(
+    target: new (...args: never[]) => unknown,
+    method: string,
+    runtimeValues?: unknown[],
+  ): Promise<unknown[]> {
+    const args: unknown[] = []
+    const paramTypes: unknown[] =
+      Reflect.getMetadata('design:paramtypes', target.prototype, method) ?? []
+    // `@Inject('token')` on a method parameter — a named binding the reflected
+    // type cannot express (an interface, or a class registered under a name).
+    const injectTokens = getMethodInjectTokens(target.prototype, method)
+
+    // `@Inject` counts towards the parameter span too: a method may carry named
+    // tokens without `design:paramtypes` being emitted for it, and computing the
+    // span from the reflected types alone left the loop at zero iterations —
+    // the tokens were read and then never used.
+    const injectSpan = injectTokens.size === 0 ? 0 : Math.max(...injectTokens.keys()) + 1
+    const len = Math.max(paramTypes.length, runtimeValues?.length ?? 0, injectSpan)
+    // One at a time, in parameter order: a factory with side effects runs
+    // in the order the signature reads.
+    for (let index = 0; index < len; index += 1) {
+      // Runtime values take precedence (and fill slots beyond paramTypes).
+      if (runtimeValues && index < runtimeValues.length) {
+        args.push(runtimeValues[index])
+        continue
+      }
+      const named = injectTokens.get(index)
+      if (named !== undefined) {
+        args.push(await this.resolve(named))
+        continue
+      }
+      const type = paramTypes[index]
+      args.push(isInjectableClass(type) ? await this.resolve(type) : undefined)
+    }
+    return args
+  }
+
   /**
    * A resolver whose {@link ContainerResolver.bindValue} values are isolated
    * from this container (AdonisJS `container.createResolver()`).
@@ -441,10 +464,7 @@ export class Container {
     fn: () => Promise<T>,
   ): Promise<T> {
     const chain = this.#chain.getStore()
-    return this.#chain.run(
-      chain === undefined ? { stack: [], set: new Set(), values } : { ...chain, values },
-      fn,
-    )
+    return this.#chain.run(chain === undefined ? openChain({ values }) : { ...chain, values }, fn)
   }
 
   /** @internal Validate a token and hand back the value the container keys on. */
@@ -464,9 +484,8 @@ export class Container {
   ): Promise<T> {
     if (parent === null) return this.make<T>(token, runtimeValues)
     const chain = this.#chain.getStore()
-    return this.#chain.run(
-      chain === undefined ? { stack: [], set: new Set(), parent } : { ...chain, parent },
-      () => this.make<T>(token, runtimeValues),
+    return this.#chain.run(chain === undefined ? openChain({ parent }) : { ...chain, parent }, () =>
+      this.make<T>(token, runtimeValues),
     )
   }
 
@@ -588,7 +607,7 @@ export class Container {
     //    resolves in (`resolveFor`: swaps, resolver values, container values).
     //    No `resolving` hooks: the value was not constructed here.
     if (store?.values?.has(key)) {
-      store.scopedReads = (store.scopedReads ?? 0) + 1
+      store.scopedReads.count += 1
       return store.values.get(key) as T
     }
 
@@ -619,7 +638,7 @@ export class Container {
         if (this.#wasPublished(key, shared)) return shared as T
       }
 
-      const readsBefore = store?.scopedReads ?? 0
+      const readsBefore = store?.scopedReads.count ?? 0
       const building = (async (): Promise<unknown> => {
         const instance = binding.factory ? await binding.factory(this) : undefined
         // Only cache while this is still the binding that started the build.
@@ -731,7 +750,7 @@ export class Container {
 
     // Same rule as the explicit bindings: see `ResolutionChain.scopedReads`.
     const store = this.#chain.getStore()
-    const readsBefore = store?.scopedReads ?? 0
+    const readsBefore = store?.scopedReads.count ?? 0
     const building = (async (): Promise<unknown> => {
       const instance = await this.#autoConstruct(target, runtimeValues)
       await this.#runResolvingHooks(key, instance)
@@ -754,16 +773,13 @@ export class Container {
     runtimeValues?: unknown[],
   ): Promise<unknown> {
     // Everything resolved inside is a dependency OF `target`, which is what a
-    // contextual binding keys on. Restored on EVERY exit — the construction has
-    // three returns and can throw — so `target`'s own parent is back in place.
-    const store = this.#chain.getStore()
-    const outerParent = store?.parent
-    if (store !== undefined) store.parent = target
-    try {
-      return await this.#constructWithDeps(target, runtimeValues)
-    } finally {
-      if (store !== undefined) store.parent = outerParent
-    }
+    // contextual binding keys on. On a copy of the chain (see
+    // `ResolutionChain`): nothing to restore on any of the construction's
+    // exits, and a construction running beside this one keeps its own parent.
+    const store = this.#chain.getStore() ?? openChain()
+    return this.#chain.run({ ...store, parent: target }, () =>
+      this.#constructWithDeps(target, runtimeValues),
+    )
   }
 
   async #constructWithDeps(
@@ -902,7 +918,7 @@ export class Container {
     readsBefore: number,
   ): void {
     if (scope !== 'singleton') return
-    if ((store?.scopedReads ?? 0) !== readsBefore) return
+    if ((store?.scopedReads.count ?? 0) !== readsBefore) return
     this.#singletons.set(key, instance)
   }