@cplieger/deadset-ts 8.0.0-dev.12 → 8.0.0-dev.14

package/README.md

@@ -116,3 +116,5 @@ This project was built with AI-assisted tooling using [Claude](https://claude.co
 ## License
 
 GPL-3.0-or-later. See [LICENSE](LICENSE).
+
+Third-party attributions are in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,27 @@
+# Third-party notices
+
+deadset-ts includes source code from the following project.
+
+## unbash
+
+- Source: <https://github.com/webpro-nl/unbash>, release 6.0.0, commit `968c14992a43dc06ce29c9f51858abd4a87851ea`
+- Location: `src/vendor/unbash/` (see `VENDORED.md` there)
+- License: ISC
+
+```text
+ISC License
+
+Copyright (c) Lars Kappert
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+```

package/dist/src/build-scripts.js

@@ -8,11 +8,11 @@ import { isArrayBindingPattern, isArrayLiteralExpression, isArrowFunction, isCal
 import { filesNamedBy } from "./configuration-files.js";
 import { ancestors, dirnamePath, relativePath, resolvePath } from "./paths.js";
 import { bytewise } from "./text/compare.js";
-import { isRecord } from "./json-document.js";
 import { unwrapped } from "./unwrap.js";
 import { holdsManifest, inInstalledPackages, manifestAt } from "./fs/manifest.js";
 import { globExpression } from "./text/glob.js";
-import { scriptTokens } from "./text/shell.js";
+import { pathsNamed, readCommands } from "./commands/read.js";
+import { manifestCommands } from "./manifest.js";
 /**
  * The bundlers whose build call names its entries: esbuild resolves `entryPoints` against
  * `absWorkingDir` (https://esbuild.github.io/api/#working-directory), webpack `entry`
@@ -362,19 +362,12 @@ function scriptEntries(file, dir, files) {
     });
     return found;
 }
-/** The modules one manifest's scripts run, by absolute path, each below the target root. */
+/** The modules one manifest's command strings run or name, by absolute path, each below the target root. */
 function scriptModules(host, root, dir) {
-    const scripts = manifestAt(host, dir)?.["scripts"];
-    if (!isRecord(scripts)) {
-        return [];
-    }
+    const manifest = manifestAt(host, dir);
     const found = new Set();
-    for (const command of Object.values(scripts)) {
-        if (typeof command !== "string") {
-            continue;
-        }
-        for (const token of scriptTokens(command)) {
-            const path = resolvePath(dir, token);
+    for (const { command } of manifest === undefined ? [] : manifestCommands(host, dir, manifest)) {
+        for (const { path } of pathsNamed(readCommands(command, dir))) {
             if (MODULE_EXTENSION.test(path) &&
                 relativePath(root, path) !== undefined &&
                 !inInstalledPackages(path) &&

package/dist/src/commands/read.js

@@ -0,0 +1,156 @@
+/**
+ * The one reader of every command string the analysis reads. Layer 3, the holding rule
+ * `roots.ts` applies through `text/named-files.ts`, reads all of the string's text whatever
+ * the other two layers make of it; layer 1 parses the string and layer 2 reads each simple
+ * command a tool's reader understands, and they only add the files and modules it runs.
+ */
+import { joinPath, resolvePath } from "../paths.js";
+import { shellLine } from "./shell.js";
+import { configurationsOf, preloadTarget, readBuiltin, readTool, } from "./tools.js";
+/**
+ * The outcomes of one pipeline run in `dir`: those of the builtin that is its one member, as
+ * `readBuiltin` gives them, a directory the analysis does not know after a part layer 1 does
+ * not read, and either status in `dir` otherwise, a pipeline of several members included,
+ * whose members each run in a subshell.
+ */
+function outcomesOf(pipeline, dir) {
+    const [only] = pipeline.alone ? pipeline.commands : [];
+    const outcomes = pipeline.opaque
+        ? [
+            { dir: undefined, ok: true },
+            { dir: undefined, ok: false },
+        ]
+        : ((only === undefined ? undefined : readBuiltin(only, dir)) ?? [
+            { dir, ok: true },
+            { dir, ok: false },
+        ]);
+    return outcomes.map((one) => ({ dir: one.dir, ok: one.ok !== pipeline.negated }));
+}
+/** The one directory every outcome is in, or `undefined` where they differ or none is known. */
+function oneDirectory(outcomes) {
+    const dirs = new Set(outcomes.map((one) => one.dir));
+    return dirs.size === 1 ? [...dirs][0] : undefined;
+}
+/**
+ * What `text`, run in `dir`, `undefined` where not known, runs. A pipeline is read where every
+ * way its and-or list reaches it leaves the shell in one known directory, none after an `exit`;
+ * a background list moves and ends no later one. The words and configuration files of every
+ * simple command of the string's own line are read in `dir` as well, wherever they run.
+ */
+export function readCommands(text, dir) {
+    const runs = [];
+    const commands = [];
+    const configurations = [];
+    const readCommand = (words, at) => {
+        commands.push({ dir: at, words: words.map((word) => word.value) });
+        let handed = words;
+        let reading = readTool(handed);
+        while (reading?.kind === "command") {
+            handed = reading.words;
+            reading = readTool(handed);
+        }
+        if (reading?.kind === "line") {
+            readLine(reading.text, at);
+            return;
+        }
+        configurations.push(...configurationsOf(handed).map((written) => ({ dir: at, written })));
+        if (reading !== undefined && (reading.entry !== undefined || reading.preloads.length > 0)) {
+            runs.push({
+                dir: at,
+                entry: reading.entry,
+                preloads: reading.preloads,
+                runtime: reading.runtime,
+            });
+        }
+    };
+    const readLine = (source, start) => {
+        let at = start;
+        for (const list of shellLine(source)) {
+            let outcomes = [{ dir: at, ok: true }];
+            for (const pipeline of list.pipelines) {
+                const { operator } = pipeline;
+                const reached = outcomes.filter((one) => operator === undefined || one.ok === (operator === "&&"));
+                const where = reached.length === 0 ? undefined : oneDirectory(reached);
+                if (where !== undefined) {
+                    pipeline.commands.forEach((words) => {
+                        readCommand(words, where);
+                    });
+                }
+                const next = reached.flatMap((one) => outcomesOf(pipeline, one.dir));
+                const passed = outcomes.filter((one) => !reached.includes(one));
+                outcomes = [
+                    ...new Map([...passed, ...next].map((one) => [`${String(one.ok)}\u0000${one.dir ?? ""}`, one])).values(),
+                ];
+            }
+            if (!list.background) {
+                at = oneDirectory(outcomes);
+            }
+        }
+    };
+    readLine(text, dir);
+    if (dir !== undefined) {
+        for (const words of shellLine(text).flatMap((list) => list.pipelines.flatMap((pipeline) => pipeline.commands))) {
+            commands.push({ dir, words: words.map((word) => word.value) });
+            configurations.push(...configurationsOf(words).map((written) => ({ dir, written })));
+        }
+    }
+    const unique = (all) => [
+        ...new Map(all.map((one) => [JSON.stringify(one), one])).values(),
+    ];
+    return {
+        runs,
+        commands: unique(commands),
+        configurations: unique(configurations),
+        held: text,
+    };
+}
+/** The extensions a runtime or a loader tries after a path written without one. */
+const TRIED_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+/**
+ * The files `run` loads: its entry, and each preload written as a path. Each may be at its
+ * path, with each extension tried, and as a directory's `index` file.
+ */
+export function loadsOf(run) {
+    const written = [
+        ...(run.entry === undefined
+            ? []
+            : [{ written: run.entry, path: resolvePath(run.dir, run.entry) }]),
+        ...run.preloads.flatMap((preload) => {
+            const target = preloadTarget(preload, run.dir);
+            return target !== undefined && "path" in target
+                ? [{ written: preload.specifier, path: target.path }]
+                : [];
+        }),
+    ];
+    return written.map(({ written: one, path }) => ({
+        written: one,
+        paths: [
+            path,
+            ...TRIED_EXTENSIONS.map((extension) => `${path}${extension}`),
+            ...TRIED_EXTENSIONS.map((extension) => joinPath(path, `index${extension}`)),
+        ],
+    }));
+}
+/** The module specifiers `run` preloads that name a package rather than a path. */
+export function preloadedPackages(run) {
+    return run.preloads.flatMap((preload) => {
+        const target = preloadTarget(preload, run.dir);
+        return target !== undefined && "package" in target ? [target.package] : [];
+    });
+}
+/**
+ * Every path `reading` names: each static word of its commands read against the directory the
+ * command runs in, a word holding `*` aside, which a tool reads as a pattern, and every path a
+ * file a read command runs or preloads may be at.
+ */
+export function pathsNamed(reading) {
+    const named = [
+        ...reading.commands.flatMap(({ dir, words }) => words.flatMap((word) => word === undefined || word.includes("*")
+            ? []
+            : [{ path: resolvePath(dir, word), written: word }])),
+        ...reading.runs
+            .flatMap(loadsOf)
+            .flatMap(({ written, paths }) => paths.map((path) => ({ path, written }))),
+    ];
+    return [...new Map(named.map((one) => [`${one.path}\u0000${one.written}`, one])).values()];
+}

package/dist/src/commands/shell.js

@@ -0,0 +1,75 @@
+/**
+ * Layer 1 of the command reader: one command line, parsed by the vendored shell parser, as
+ * its and-or lists, their pipelines and the words of each simple command. Nothing here
+ * tokenizes, unquotes or splits text.
+ */
+import { parse, } from "../vendor/unbash/parser.js";
+/** Whether one part of a word has a value the line states: a literal, quoted or escaped text. */
+function isStatic(part) {
+    switch (part.type) {
+        case "Literal":
+        case "SingleQuoted":
+        case "AnsiCQuoted":
+            return true;
+        case "DoubleQuoted":
+            return part.parts.every((child) => child.type === "Literal");
+        default:
+            return false;
+    }
+}
+/**
+ * One word as layer 1 reads it. A tilde that starts the word unquoted is the parser's literal
+ * text but the shell's home directory, so it makes the word dynamic too.
+ */
+function wordOf(word) {
+    const [first] = word.parts ?? [];
+    const lead = word.parts === undefined ? word.text : first?.type === "Literal" ? first.text : "";
+    const known = (word.parts ?? []).every(isStatic) && !lead.startsWith("~");
+    return { value: known ? word.value : undefined, text: word.text };
+}
+/**
+ * Whether one member of a pipeline, run in the line's own shell, may change that shell's
+ * directory without being a simple command: POSIX XCU 2.9.4 runs every compound command but
+ * `( )` in the current environment, and a function body runs there when called.
+ */
+function isOpaque(node) {
+    switch (node.type) {
+        case "Command":
+        case "Subshell":
+        case "Coproc":
+        case "TestCommand":
+        case "ArithmeticCommand":
+            return false;
+        case "Redirected":
+            return isOpaque(node.command);
+        default:
+            return true;
+    }
+}
+function pipelineOf(node, operator) {
+    const members = node.type === "Pipeline" ? node.commands : [node];
+    const negated = node.type === "Pipeline" && node.prefixes.some((prefix) => prefix.type === "Negation");
+    const commands = members.flatMap((member) => member.type === "Command" && member.name !== undefined
+        ? [[member.name, ...member.suffix.filter((part) => part.type === "Word")].map(wordOf)]
+        : []);
+    const alone = members.length === 1;
+    return { operator, negated, commands, alone, opaque: alone && members.some(isOpaque) };
+}
+/**
+ * The and-or lists one command line runs, or none where any of it does not parse. A simple
+ * command's assignments and redirections are no words; a part that is no simple command
+ * gives no words, and marks its pipeline where it may change the line's directory.
+ */
+export function shellLine(source) {
+    const script = parse(source);
+    if ((script.errors ?? []).length > 0) {
+        return [];
+    }
+    return script.commands.map((statement) => {
+        const { command } = statement;
+        const pipelines = command.type === "AndOr"
+            ? command.commands.map((one, at) => pipelineOf(one, at === 0 ? undefined : command.operators[at - 1]))
+            : [pipelineOf(command, undefined)];
+        return { background: statement.background === true, pipelines };
+    });
+}