@cplieger/deadset-ts 8.0.0-dev.1 → 8.0.0-dev.10

package/src/findings-pass.ts

@@ -4,8 +4,9 @@
  * verdict a report carries beside them.
  */
 
+import { EXIT_CLEAN, EXIT_FINDINGS, EXIT_PENDING } from "./contract/contract.generated.ts";
 import type { AnalysisInputs } from "./analysis.ts";
-import { fails, type Config } from "./config.ts";
+import { fails, type ResolvedConfig } from "./config.ts";
 import type { EdgeEvaluation } from "./edges.ts";
 import type { CompletedFinding, Finding } from "./finding.ts";
 import { decidedFindings, type Withheld } from "./findings/emitters.ts";
@@ -23,7 +24,8 @@ import {
   type Ledger,
 } from "./suppress.ts";
 import type { Provenance, Recorded } from "./suppress-file.ts";
-import { EXIT_CLEAN, EXIT_FINDINGS } from "./verbs/verb.ts";
+import { bytewise } from "./text/compare.ts";
+import { PRODUCT } from "./product.ts";
 
 /** The counts a report's totals carry beside its findings. */
 interface PassTotals {
@@ -49,25 +51,14 @@ export interface PassResult {
   readonly ledger: Ledger;
 }
 
-/** The exit code of a report holding at least one pending finding. */
-export const EXIT_PENDING = 4;
-
-/** Two strings ordered bytewise. */
-function compare(a: string, b: string): number {
-  if (a === b) {
-    return 0;
-  }
-  return a < b ? -1 : 1;
-}
-
 /** The canonical order: path, line, column, code, then the symbol reference. */
 function canonical(a: Finding, b: Finding): number {
   return (
-    compare(a.position.path, b.position.path) ||
+    bytewise(a.position.path, b.position.path) ||
     a.position.line - b.position.line ||
     a.position.column - b.position.column ||
-    compare(a.code, b.code) ||
-    compare(a.symbol.ref, b.symbol.ref)
+    bytewise(a.code, b.code) ||
+    bytewise(a.symbol.ref, b.symbol.ref)
   );
 }
 
@@ -118,7 +109,7 @@ export function findingsPass(inputs: AnalysisInputs): PassResult {
  * suppression is stale or a finding's severity reaches the configured failing severity;
  * clean otherwise.
  */
-export function verdictOf(result: PassResult, config: Config): number {
+export function verdictOf(result: PassResult, config: ResolvedConfig): number {
   if (result.totals.pending > 0) {
     return EXIT_PENDING;
   }
@@ -126,7 +117,7 @@ export function verdictOf(result: PassResult, config: Config): number {
     return EXIT_FINDINGS;
   }
   const failing = result.findings.some((finding) =>
-    fails(finding.severity, config.reporters.failOn),
+    fails(finding.severity, config.reporters.fail_on),
   );
   return failing ? EXIT_FINDINGS : EXIT_CLEAN;
 }
@@ -164,5 +155,5 @@ export function rowKey(row: Recorded): string {
 
 /** The analyzer identity a baseline this analyzer writes names as its rows' provenance. */
 export function analyzerProvenance(version: string): Provenance {
-  return { analyzer: "deadset-ts", version };
+  return { analyzer: PRODUCT, version };
 }

package/src/framework-lifecycle.ts

@@ -55,8 +55,8 @@ function resolveContracts<Brand>(
   contracts: readonly LifecycleContract[],
 ): readonly ResolvedContract[] {
   const entries: DeclarationEntry[] = contracts.flatMap((contract) => [
-    ...contract.components,
-    ...contract.bases,
+    ...(contract.components ?? []),
+    ...(contract.bases ?? []),
   ]);
   const resolved = resolveEntries(project, held, entries);
   let next = 0;
@@ -67,8 +67,8 @@ function resolveContracts<Brand>(
   };
   return contracts.map((contract) => ({
     contract,
-    components: take(contract.components.length),
-    bases: take(contract.bases.length),
+    components: take(contract.components?.length ?? 0),
+    bases: take(contract.bases?.length ?? 0),
   }));
 }
 
@@ -243,11 +243,11 @@ function byBases<Brand>(
  */
 export function frameworkLifecycle<Brand>(input: DetectorInput<Brand>): readonly Evidence[] {
   const { project, held, targetRoot } = input;
-  if (input.ts.lifecycleContracts.length === 0) {
+  if (input.ts.lifecycle_contracts.length === 0) {
     return [];
   }
   const chains = aliasChains(project, held);
-  const contracts = resolveContracts(project, held, input.ts.lifecycleContracts);
+  const contracts = resolveContracts(project, held, input.ts.lifecycle_contracts);
   const components = [
     ...byComponents(project, held, chains, contracts),
     ...byBases(project, held, chains, contracts),
@@ -256,7 +256,7 @@ export function frameworkLifecycle<Brand>(input: DetectorInput<Brand>): readonly
     return [];
   }
   const ids = new Set(components.map((one) => one.id));
-  const sides: readonly ClassSide[] = input.ts.lifecycleContracts.some((contract) =>
+  const sides: readonly ClassSide[] = input.ts.lifecycle_contracts.some((contract) =>
     contract.members.some((name) => name.endsWith(":static")),
   )
     ? ["instance", "static"]

package/src/fs/document.ts

@@ -0,0 +1,70 @@
+/**
+ * The one read of a document the target holds at its root, which a checkout under analysis
+ * controls: the repository configuration, the ignore file, the baseline and the edges
+ * document. The read stays inside the target root, takes a regular file alone, and holds no
+ * more of it than the Contract's document bound.
+ */
+
+import { CONFIG_MAX_BYTES } from "../contract/config.generated.ts";
+import type { Host } from "../host.ts";
+import { failureExit } from "../failure.ts";
+import { joinPath, relativePath } from "../paths.ts";
+import { message } from "../product.ts";
+import { utf8Bytes } from "../reporters/sha256.ts";
+import { UsageError } from "../usage.ts";
+
+function unreadable(label: string, reason: string): Error {
+  return failureExit(
+    "unreadable-document",
+    `${label}: ${reason}: make it a regular file inside the target root that the run can read, or remove it`,
+  );
+}
+
+/** Refuses a document past the Contract's bound with the usage code, naming it `label`. */
+export function refuseOverBound(label: string, text: string): void {
+  if (utf8Bytes(text).length > CONFIG_MAX_BYTES) {
+    throw new UsageError(`${label}: holds more than ${String(CONFIG_MAX_BYTES)} bytes`);
+  }
+}
+
+/**
+ * The text of the document `name` at the absolute `targetRoot`, undefined where nothing is
+ * there. One whose name resolves outside the target root or to anything but a regular file,
+ * or whose read fails, is refused by `refuse` naming it `label`, nothing read from it. A
+ * document past the bound is read one byte past it and refused as {@link refuseOverBound} does.
+ */
+export function readTargetDocument(
+  host: Host,
+  targetRoot: string,
+  name: string,
+  label = name,
+  refuse: (label: string, reason: string) => Error = unreadable,
+): string | undefined {
+  const attempt = <T>(read: () => T): T => {
+    try {
+      return read();
+    } catch (error: unknown) {
+      throw refuse(label, message(error));
+    }
+  };
+  const path = joinPath(targetRoot, name);
+  const kind = attempt(() => host.kindOf(path));
+  if (kind === "absent") {
+    return undefined;
+  }
+  const real = attempt(() => host.realPath(path));
+  if (
+    relativePath(
+      attempt(() => host.realPath(targetRoot)),
+      real,
+    ) === undefined
+  ) {
+    throw refuse(label, `resolves to ${real}, outside the target root`);
+  }
+  if (kind !== "file") {
+    throw refuse(label, "is not a regular file");
+  }
+  const text = attempt(() => host.readFile(real, CONFIG_MAX_BYTES + 1));
+  refuseOverBound(label, text);
+  return text;
+}

package/src/fs/manifest.ts

@@ -0,0 +1,92 @@
+import type { Host } from "../host.ts";
+import { isRecord } from "../json-document.ts";
+import { joinPath } from "../paths.ts";
+import { message } from "../product.ts";
+
+/** The file a package's manifest is read from. */
+export const MANIFEST = "package.json";
+
+/** The directory a package manager installs packages into, whose files are no project's own. */
+export const INSTALLED_PACKAGES = "node_modules";
+
+/** The manifest members a package declares the packages it depends on under. */
+export const DEPENDENCY_SECTIONS = [
+  "dependencies",
+  "devDependencies",
+  "peerDependencies",
+  "optionalDependencies",
+] as const;
+
+/** Whether one path passes through an installed-packages directory. */
+export function inInstalledPackages(path: string): boolean {
+  return path.split("/").includes(INSTALLED_PACKAGES);
+}
+
+/** One JSON file's text and decoded value, or undefined where it cannot be read or parsed. */
+export function readDocument(
+  host: Host,
+  path: string,
+): { text: string; value: unknown } | undefined {
+  let text: string;
+  try {
+    text = host.readFile(path);
+  } catch {
+    return undefined;
+  }
+  try {
+    return { text, value: JSON.parse(text) as unknown };
+  } catch {
+    return undefined;
+  }
+}
+
+/** One JSON file's decoded value, or undefined where it cannot be read or parsed. */
+export function readJSON(host: Host, path: string): unknown {
+  return readDocument(host, path)?.value;
+}
+
+/**
+ * The manifest in one directory, decoded, or undefined where none reads as an object. A
+ * manifest this program cannot read declares nothing, the same answer as an absent one:
+ * the package manager owns the refusal of a manifest it rejects.
+ */
+export function manifestAt(host: Host, dir: string): Record<string, unknown> | undefined {
+  const value = readJSON(host, joinPath(dir, MANIFEST));
+  return isRecord(value) ? value : undefined;
+}
+
+/**
+ * What one directory's manifest reads as: none, an object, a file that does not parse as one,
+ * or a file that cannot be read, with the read's error. Either of the last two still bounds
+ * the package it would declare.
+ */
+export type ManifestRead =
+  | { readonly kind: "absent" }
+  | { readonly kind: "read"; readonly manifest: Record<string, unknown> }
+  | { readonly kind: "malformed" }
+  | { readonly kind: "unread"; readonly reason: string };
+
+/** The manifest in one directory, as {@link ManifestRead} tells its states apart. */
+export function readManifestAt(host: Host, dir: string): ManifestRead {
+  if (!holdsManifest(host, dir)) {
+    return { kind: "absent" };
+  }
+  let text: string;
+  try {
+    text = host.readFile(joinPath(dir, MANIFEST));
+  } catch (error: unknown) {
+    return { kind: "unread", reason: message(error) };
+  }
+  let value: unknown;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return { kind: "malformed" };
+  }
+  return isRecord(value) ? { kind: "read", manifest: value } : { kind: "malformed" };
+}
+
+/** Whether one directory holds a manifest file. */
+export function holdsManifest(host: Host, dir: string): boolean {
+  return host.kindOf(joinPath(dir, MANIFEST)) === "file";
+}

package/src/fs/tree.ts

@@ -0,0 +1,110 @@
+import type { DirectoryEntry, Host } from "../host.ts";
+import { ancestors, joinPath, resolvePath } from "../paths.ts";
+import { LANGUAGE_ROWS } from "../contract/contract.generated.ts";
+import { LANGUAGE } from "../product.ts";
+import { bytewise } from "../text/compare.ts";
+import { globExpression } from "../text/glob.ts";
+
+/** The directories no walk of the tree enters, by the patterns the language's row names. */
+const SKIPPED_DIRECTORIES = LANGUAGE_ROWS[LANGUAGE].skippedDirectories.map(globExpression);
+
+function skipped(name: string): boolean {
+  return SKIPPED_DIRECTORIES.some((pattern) => pattern.test(name));
+}
+
+/** A git repository's working tree root, and the `info/exclude` file git reads for it. */
+interface Repository {
+  readonly root: string;
+  /** Undefined where a `.git` file names no repository directory. */
+  readonly exclude: string | undefined;
+}
+
+/** One file's text without its line ending, or undefined where it cannot be read. */
+function lineOf(host: Host, path: string): string | undefined {
+  try {
+    return host.readFile(path).replace(/\r?\n$/u, "");
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The repository whose working tree holds `dir`: the nearest directory at or above it with a
+ * `.git`. A `.git` file, which a linked worktree or a submodule holds, names the repository's
+ * directory on its `gitdir:` line; that directory's `commondir` file, where it has one, names
+ * the directory shared with the main worktree, which holds `info/exclude`:
+ * https://git-scm.com/docs/gitrepository-layout
+ */
+export function repositoryOf(host: Host, dir: string): Repository | undefined {
+  for (const root of ancestors(dir)) {
+    const dotGit = joinPath(root, ".git");
+    const kind = host.kindOf(dotGit);
+    if (kind === "directory") {
+      return { root, exclude: joinPath(dotGit, "info/exclude") };
+    }
+    if (kind === "file") {
+      const named = /^gitdir: (.+)$/u.exec(lineOf(host, dotGit) ?? "")?.[1];
+      const gitDir = named === undefined ? undefined : resolvePath(root, named);
+      const common = gitDir === undefined ? undefined : lineOf(host, joinPath(gitDir, "commondir"));
+      const shared =
+        gitDir === undefined || common === undefined ? gitDir : resolvePath(gitDir, common);
+      return { root, exclude: shared === undefined ? undefined : joinPath(shared, "info/exclude") };
+    }
+  }
+  return undefined;
+}
+
+/** The entries of one directory, none where it cannot be read. */
+export function entriesOf(host: Host, dir: string): readonly DirectoryEntry[] {
+  try {
+    return host.readDirectory(dir);
+  } catch {
+    return [];
+  }
+}
+
+/** The names of the files directly in `dir` whose name `accepts`, in bytewise order. */
+export function filesIn(
+  host: Host,
+  dir: string,
+  accepts: (name: string) => boolean,
+): readonly string[] {
+  return entriesOf(host, dir)
+    .filter((entry) => !entry.directory && accepts(entry.name))
+    .map((entry) => entry.name)
+    .sort(bytewise);
+}
+
+/** The names of the directories directly in `dir` a walk enters, in bytewise order. */
+export function directoriesIn(host: Host, dir: string): readonly string[] {
+  return entriesOf(host, dir)
+    .filter((entry) => entry.directory && !skipped(entry.name))
+    .map((entry) => entry.name)
+    .sort(bytewise);
+}
+
+/**
+ * Every file below `root` whose name `accepts`, by its path relative to `root` in bytewise
+ * order, read in no skipped directory.
+ */
+export function filesBelow(
+  host: Host,
+  root: string,
+  accepts: (name: string) => boolean,
+): readonly string[] {
+  const found: string[] = [];
+  const pending = [""];
+  for (let dir = pending.pop(); dir !== undefined; dir = pending.pop()) {
+    for (const entry of entriesOf(host, joinPath(root, dir))) {
+      const path = dir === "" ? entry.name : `${dir}/${entry.name}`;
+      if (!entry.directory) {
+        if (accepts(entry.name)) {
+          found.push(path);
+        }
+      } else if (!skipped(entry.name)) {
+        pending.push(path);
+      }
+    }
+  }
+  return found.sort(bytewise);
+}

package/src/generated-file.ts

@@ -1,11 +1,12 @@
 /**
  * The generated-file class on TypeScript: every declaration in a file that marks itself
- * generated, or below a directory an applied convention row names as generated, is
- * retained, because a generator owns the file and a deletion there is undone at the next
+ * generated, below a directory an applied convention row names as generated, or minified,
+ * is retained, because a generator owns the file and a deletion there is undone at the next
  * generation.
  */
 
 import type { DetectorInput, Evidence } from "./exempt.ts";
+import { minified } from "./javascript-file.ts";
 import type { SourceFiles } from "./source-files.ts";
 
 /** The generated-code header, matched against each line of a leading comment. */
@@ -75,7 +76,7 @@ export function generatedByComment(text: string): string | undefined {
 /**
  * Every own file of one project that is generated, by its path below the target root,
  * with the detail a retention in it names: its leading comments' mark, else the row
- * naming its directory as generated.
+ * naming its directory as generated, else its minified text.
  */
 export function generatedFilesOf(
   files: SourceFiles,
@@ -87,7 +88,9 @@ export function generatedFilesOf(
     const detail =
       generatedByComment(file.text) ??
       (row === undefined
-        ? undefined
+        ? minified(file.fileName, file.text)
+          ? "generated as a minified JavaScript file"
+          : undefined
         : `generated below a directory the convention row ${row} names`);
     if (detail !== undefined) {
       found.set(path, detail);

package/src/git-ignore.ts

@@ -1,13 +1,15 @@
 /**
- * Which files the `.gitignore` files of a tree ignore, read as git reads them:
+ * Which files git ignores below a tree's root, read as git reads its ignore files:
  * https://git-scm.com/docs/gitignore#_pattern_format
  */
 
-import { globExpression } from "./glob.ts";
 import type { Host } from "./host.ts";
-import { dirnamePath, joinPath, relativePath } from "./paths.ts";
+import { ancestors, dirnamePath, joinPath, relativePath } from "./paths.ts";
+import { message } from "./product.ts";
+import { gitignoreExpression } from "./text/glob.ts";
+import { repositoryOf } from "./fs/tree.ts";
 
-/** One pattern line of a `.gitignore` file. */
+/** One pattern line of an ignore file. */
 interface Rule {
   readonly negated: boolean;
   /** Whether the pattern ends with `/`, so it matches a directory alone. */
@@ -16,7 +18,7 @@ interface Rule {
   readonly expression: RegExp;
 }
 
-/** The rules one `.gitignore` text writes, in order. */
+/** The rules one ignore file's text writes, in order. */
 function rulesOf(text: string): readonly Rule[] {
   const rules: Rule[] = [];
   for (const raw of text.split(/\r?\n/u)) {
@@ -25,7 +27,7 @@ function rulesOf(text: string): readonly Rule[] {
       continue;
     }
     const negated = line.startsWith("!");
-    line = negated || line.startsWith("\\") ? line.slice(1) : line;
+    line = negated ? line.slice(1) : line;
     const directoryOnly = line.endsWith("/");
     line = line.replace(/\/+$/u, "");
     if (line === "") {
@@ -38,43 +40,65 @@ function rulesOf(text: string): readonly Rule[] {
     rules.push({
       negated,
       directoryOnly,
-      expression: globExpression(anchored ? pattern : `**/${pattern}`),
+      expression: gitignoreExpression(anchored ? pattern : `**/${pattern}`),
     });
   }
   return rules;
 }
 
+/** Told each ignore file that exists and cannot be read, with why. */
+type UnreadIgnoreFile = (path: string, reason: string) => void;
+
+function rulesIn(host: Host, path: string, unread: UnreadIgnoreFile): readonly Rule[] {
+  try {
+    return rulesOf(host.readFile(path));
+  } catch (error: unknown) {
+    if (host.kindOf(path) !== "absent") {
+      unread(path, message(error));
+    }
+    return [];
+  }
+}
+
 /**
- * Whether the `.gitignore` files at and below `root` ignore one absolute path. A path
- * outside `root` is not ignored, and a file below an ignored directory stays ignored
- * whatever a later pattern says, as git cannot re-include it.
+ * Whether git ignores one absolute path below `root`: by the repository's `info/exclude`, then
+ * the `.gitignore` files from its root down to the path's directory, a later pattern overriding
+ * an earlier one, though a file below an ignored directory stays ignored, as git cannot re-include
+ * it. A path outside `root` is not ignored. With no repository, the files at and below `root` are
+ * read; with one, the directories above `root` give patterns but are not tested. An unreadable
+ * ignore file ignores nothing, and `unread` is told it.
  */
-export function gitIgnored(host: Host, root: string): (path: string) => boolean {
+export function gitIgnored(
+  host: Host,
+  root: string,
+  unread: UnreadIgnoreFile = () => undefined,
+): (path: string) => boolean {
+  const found = repositoryOf(host, root);
+  const repository = found?.root;
+  const above =
+    repository === undefined ? [] : [...ancestors(dirnamePath(root), repository)].reverse();
+  const excluded = found?.exclude === undefined ? [] : rulesIn(host, found.exclude, unread);
   const read = new Map<string, readonly Rule[]>();
   const rulesAt = (dir: string): readonly Rule[] => {
     let rules = read.get(dir);
     if (rules === undefined) {
-      try {
-        rules = rulesOf(host.readFile(joinPath(dir, ".gitignore")));
-      } catch {
-        rules = [];
-      }
+      rules = rulesIn(host, joinPath(dir, ".gitignore"), unread);
       read.set(dir, rules);
     }
     return rules;
   };
-  /** Whether the rules of `root` and of each directory down to one path's own decide it ignored. */
   const decided = (path: string, directory: boolean): boolean => {
-    const dirs: string[] = [];
-    for (let at = dirnamePath(path); relativePath(root, at) !== undefined; at = dirnamePath(at)) {
-      dirs.unshift(at);
-    }
-    dirs.unshift(root);
+    const sources: [string, readonly Rule[]][] = [
+      ...(repository === undefined ? [] : [[repository, excluded] as [string, readonly Rule[]]]),
+      ...[...above, ...[...ancestors(dirnamePath(path), root)].reverse()].map(
+        (dir): [string, readonly Rule[]] => [dir, rulesAt(dir)],
+      ),
+    ];
     let ignored = false;
-    for (const dir of dirs) {
-      const below = relativePath(dir, path);
-      for (const rule of below === undefined ? [] : rulesAt(dir)) {
-        if ((directory || !rule.directoryOnly) && rule.expression.test(below ?? "")) {
+    for (const [dir, rules] of sources) {
+      const below = relativePath(dir, path) ?? "";
+      for (const rule of rules) {
+        if ((directory || !rule.directoryOnly) && rule.expression.test(below)) {
           ignored = !rule.negated;
         }
       }

package/src/graph.ts

@@ -41,9 +41,9 @@ const SWEPT: Readonly<Record<SymbolKind, boolean>> = {
  * Whether a root of each kind names a caller, which holds it live under both relations: a
  * tool reads what it loads and what its strings name, a runtime runs a test, setup or
  * worker file, a page's module script, a command, a script or a workflow step, the manifest
- * names what enters the package, an alias global stands for its export, and an entry file,
- * a configured root and a pattern assert a caller. A library's published API only supposes
- * an unseen consumer, so it is live under reachability alone.
+ * names what enters the package, an alias global stands for its export, an outside
+ * declaration names a global interface merging into it, and an entry file, a configured root
+ * and a pattern assert a caller. A published API supposes a consumer: reachability alone.
  */
 const NAMES_A_CALLER: Readonly<Record<RootKind, boolean>> = {
   "entry-file": true,
@@ -56,8 +56,10 @@ const NAMES_A_CALLER: Readonly<Record<RootKind, boolean>> = {
   pattern: true,
   "type-error": true,
   "type-query-alias": true,
+  "global-augmentation": true,
   "configuration-file": true,
   "configuration-string": true,
+  "bundler-entry": true,
   "test-runner": true,
   "browser-tests": true,
   worker: true,

package/src/host.ts

@@ -1,5 +1,5 @@
-/** What one path names. */
-export type PathKind = "file" | "directory" | "absent";
+/** What one path names: `"other"` is anything else there, a named pipe, a device or a socket. */
+export type PathKind = "file" | "directory" | "other" | "absent";
 
 /** One entry of a directory. */
 export interface DirectoryEntry {
@@ -17,11 +17,18 @@ export interface DirectoryEntry {
 export interface Host {
   /** The directory a relative path resolves against. */
   workingDirectory(): string;
-  /** The text of one file, or a throw naming why it cannot be read. */
-  readFile(path: string): string;
+  /**
+   * The text of one file, or a throw naming why it cannot be read. Given `limit`, the
+   * text of no more than the file's first `limit` bytes, so a caller bounding a document
+   * asks for one byte past its bound and never holds a larger file whole.
+   */
+  readFile(path: string, limit?: number): string;
   /** The entries of one directory, or a throw naming why it cannot be read. */
   readDirectory(path: string): readonly DirectoryEntry[];
-  /** What one path names, `"absent"` where nothing is there. */
+  /**
+   * What one path names once every symbolic link along it is followed, `"absent"` where
+   * nothing is there, or a throw naming why it cannot be known, as for a link loop.
+   */
   kindOf(path: string): PathKind;
   /**
    * The path one path names once every symbolic link along it is followed, or a throw