@davidwells/extract-deps 0.0.5 → 0.0.7

package/src/vendor/inspect-parameters-declaration.js

@@ -0,0 +1,282 @@
+// Vendored from inspect-parameters-declaration@0.1.0 to avoid vulnerable transitive deps
+// Original packages: split-skip, unpack-string, stringify-parameters, inspect-parameters-declaration
+
+'use strict'
+
+// split-skip@0.0.2
+function splitSkip(str, separator, skipState) {
+  const result = []
+
+  if (!str) {
+    return [str]
+  }
+
+  let indexStart = 0
+  let indexEnd = 0
+  let state = { skip: 0 }
+
+  for (let i = 0; i < str.length; i++) {
+    const char = separator.length === 1 ? str[i] : str.substr(i, separator.length)
+
+    state = skipState ? skipState(state, char, i) : state
+    const compareSeparator = char === separator
+
+    if ((!state.skip && compareSeparator) || i === str.length - 1) {
+      indexEnd = i === str.length - 1 ? i + 1 : i
+      result.push(str.substring(indexStart, indexEnd))
+      indexStart = indexEnd + separator.length
+    }
+  }
+
+  return result
+}
+
+// unpack-string@0.0.2
+function unpackString(str, openingChar, closingChar) {
+  let knownOpeningChars = '([{<'
+  let knownClosingChars = ')]}>'
+
+  let indexStart
+  let indexEnd
+  let skip = 0
+
+  for (let i = 0; i < str.length; i++) {
+    const char = str[i]
+
+    if (!openingChar) {
+      if (knownOpeningChars.indexOf(char) < 0) {
+        continue
+      }
+      openingChar = char
+    }
+
+    closingChar = closingChar || knownClosingChars[knownOpeningChars.indexOf(openingChar)]
+
+    let matchOpeningChar = char === openingChar
+    let matchClosingChar = char === closingChar
+
+    if (typeof(indexStart) === 'undefined' && matchOpeningChar) {
+      indexStart = i
+      continue
+    }
+
+    if (matchOpeningChar) {
+      skip += 1
+      continue
+    }
+
+    if (skip && matchClosingChar) {
+      skip -= 1
+      continue
+    }
+
+    if (matchClosingChar) {
+      indexEnd = i
+      break
+    }
+  }
+
+  return str.substring(indexStart + 1, indexEnd)
+}
+
+// stringify-parameters@0.0.7
+function stringifyParameters(fn) {
+  const asyncFunctionConstructor = Object.getPrototypeOf(async function(){}).constructor
+  if (!fn || (fn.constructor !== String && fn.constructor !== Function && fn.constructor !== asyncFunctionConstructor)) {
+    return
+  }
+
+  let fnString = fn.toString().replace(/^\s+|\s+$/g, '')
+  if (!fnString) {
+    return
+  }
+
+  const isDeclaredWithFunctionKeyword = /^function/i
+  const isNotArrowFunction = /^[^\s=>]+\(/i
+
+  // Arrow function with param declared without parenthesis and no default value
+  if (!isDeclaredWithFunctionKeyword.test(fnString) && !isNotArrowFunction.test(fnString)) {
+    let arrowWithoutParenthesis = fnString.match(/^(.*?)=>/)
+    if (arrowWithoutParenthesis) {
+      return unpackString(arrowWithoutParenthesis[1]).replace(/^\s+|\s+$/g, '')
+    }
+  }
+
+  return unpackString(fnString).replace(/^\s+|\s+$/g, '')
+}
+
+// inspect-parameters-declaration@0.1.0
+const isArrayLike = p => p.match(/^\[+/)
+const isObjectLike = p => p.match(/^{+/)
+const matchObjectProperty = p => p.match(/^([^{]+):(.*)/)
+
+function splitSkipBrackets(string, delimiter) {
+  return splitSkip(string, delimiter, (state, char, i) => {
+    if ('{[('.indexOf(char) >= 0) {
+      state.skip += 1
+    }
+    if ('}])'.indexOf(char) >= 0) {
+      state.skip -= 1
+    }
+    return state
+  })
+}
+
+function getParameterSpec(param) {
+  if (!param) {
+    return
+  }
+
+  const [parameter, defaultValue] = splitSkipBrackets(param, '=').map(item => item.trim().replace(/^["']|["']$/g, ''))
+  const parameterSpec = { parameter }
+
+  if (defaultValue) {
+    parameterSpec.defaultValue = defaultValue
+  }
+
+  const expectsDestructuring = !!isArrayLike(param) || !!isObjectLike(param)
+  if (expectsDestructuring) {
+    parameterSpec.expectsDestructuring = true
+  }
+
+  const isRestParameter = parameterSpec.parameter.match(/^\.{3}/)
+  if (isRestParameter) {
+    parameterSpec.parameter = parameterSpec.parameter.replace(/^\.{3}/, '')
+    parameterSpec.isRestParameter = true
+  }
+
+  parameterSpec.declaration = param
+  return parameterSpec
+}
+
+function getParametersArray(paramsString) {
+  if (!paramsString) {
+    return []
+  }
+
+  paramsString = paramsString.trim()
+  const result = splitSkipBrackets(paramsString, ',')
+  return result.map(item => item.trim()).filter(item => !!item)
+}
+
+function destructureParametersFromArray(param, parameters = []) {
+  let parametersArray = getParametersArray(unpackString(param))
+
+  parametersArray.forEach(param => {
+    if (isArrayLike(param) || isObjectLike(param)) {
+      return destructureParameter(param, parameters)
+    }
+    parameters.push(getParameterSpec(param))
+  })
+
+  return parameters
+}
+
+function destructureParametersFromObject(param, parameters = []) {
+  let parametersArray = getParametersArray(unpackString(param))
+
+  parametersArray.forEach(param => {
+    let objectProperty = matchObjectProperty(param)
+    if (objectProperty) {
+      let [, key, value] = objectProperty.map(v => v.trim())
+      if (isArrayLike(value) || isObjectLike(value)) {
+        return destructureParameter(value, parameters)
+      }
+    }
+    parameters.push(getParameterSpec(param))
+  })
+
+  return parameters
+}
+
+function destructureParameter(parameter, parameters) {
+  if (isArrayLike(parameter)) {
+    return destructureParametersFromArray(parameter, parameters)
+  }
+  if (isObjectLike(parameter)) {
+    return destructureParametersFromObject(parameter, parameters)
+  }
+}
+
+function destructureParameters(param) {
+  const parametersArray = getParametersArray(param)
+
+  return parametersArray.reduce((parameters, parameter) => {
+    if (isArrayLike(parameter)) {
+      return parameters.concat(destructureParametersFromArray(parameter))
+    }
+    if (isObjectLike(parameter)) {
+      return parameters.concat(destructureParametersFromObject(parameter))
+    }
+    return parameters.concat(getParameterSpec(parameter))
+  }, [])
+}
+
+function inspectParameterFromString(parameter) {
+  const parameterSpec = getParameterSpec(parameter)
+  if (!parameterSpec || (!parameterSpec.parameter && !parameterSpec.declaration)) {
+    return
+  }
+
+  if (parameterSpec.expectsDestructuring) {
+    parameterSpec.destructuredParameters = destructureParameters(parameter)
+  }
+
+  return parameterSpec
+}
+
+function inspectParametersFromString(parameters) {
+  const parametersArray = getParametersArray(parameters)
+
+  const inspectedParameters = parametersArray.reduce((result, parameter) => {
+    const parameterSpec = inspectParameterFromString(parameter)
+    return result.concat(parameterSpec)
+  }, [])
+
+  return inspectedParameters
+}
+
+function inspectParametersFromFunction(fn) {
+  const parametersStringified = stringifyParameters(fn)
+  return inspectParametersFromString(parametersStringified)
+}
+
+function getAllInspectedParametersNames(inspectedParameters) {
+  if (!inspectedParameters) {
+    return []
+  }
+
+  inspectedParameters = inspectedParameters.constructor === Array ? inspectedParameters : [inspectedParameters]
+  return inspectedParameters.reduce((result, item) => {
+    if (item.expectsDestructuring) {
+      return result.concat(item.destructuredParameters.map(item => item.parameter))
+    }
+    return result.concat(item.parameter)
+  }, [])
+}
+
+function getParametersNames(source) {
+  const inspectedParameters = inspectParameters(source)
+  return getAllInspectedParametersNames(inspectedParameters)
+}
+
+function getParametersNamesFromInspection(inspectedParameters) {
+  return getAllInspectedParametersNames(inspectedParameters)
+}
+
+function inspectParameters(source) {
+  if (!source) {
+    return
+  }
+
+  const asyncFunctionConstructor = Object.getPrototypeOf(async function(){}).constructor
+  if (source.constructor === Function || source.constructor === asyncFunctionConstructor) {
+    return inspectParametersFromFunction(source)
+  }
+
+  if (source.constructor === String) {
+    return inspectParametersFromString(source)
+  }
+}
+
+module.exports = { inspectParameters, getParametersNames, getParametersNamesFromInspection }

package/src/verify-package-entries.js

@@ -0,0 +1,228 @@
+// Verify package.json entry points and their dependencies
+const path = require('path')
+const fs = require('fs')
+const { depGraph, resolveDepPaths } = require('./dep-graph')
+
+/**
+ * Extract all entry points from package.json
+ * @param {string} packageJsonPath - Path to package.json
+ * @returns {Array<{field: string, path: string, resolvedPath: string}>} - Array of entry point objects
+ */
+function getPackageEntryPoints(packageJsonPath) {
+  const packageDir = path.dirname(packageJsonPath)
+  const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))
+
+  return collectEntryPoints(packageJson, packageDir)
+}
+
+function collectEntryPoints(packageJson, packageDir) {
+  const entryPoints = []
+
+  /**
+   * Add entry point if it's a valid JS file
+   * @param {string} field - Field name from package.json
+   * @param {string} filePath - Relative file path
+   */
+  function addEntryPoint(field, filePath) {
+    if (!filePath) return
+
+    // Skip .d.ts files
+    if (filePath.endsWith('.d.ts')) return
+
+    // Skip .json files
+    if (filePath.endsWith('.json')) return
+
+    const resolvedPath = path.resolve(packageDir, filePath)
+    entryPoints.push({
+      field,
+      path: filePath,
+      resolvedPath
+    })
+  }
+
+  // Handle main, module, browser, types
+  if (packageJson.main) {
+    addEntryPoint('main', packageJson.main)
+  }
+  if (packageJson.module) {
+    addEntryPoint('module', packageJson.module)
+  }
+  if (packageJson.browser) {
+    if (typeof packageJson.browser === 'string') {
+      addEntryPoint('browser', packageJson.browser)
+    }
+    // browser can also be an object mapping, skip for now
+  }
+  if (packageJson.types) {
+    // Skip .d.ts files
+    if (!packageJson.types.endsWith('.d.ts')) {
+      addEntryPoint('types', packageJson.types)
+    }
+  }
+
+  // Handle bin
+  if (packageJson.bin) {
+    if (typeof packageJson.bin === 'string') {
+      addEntryPoint('bin', packageJson.bin)
+    } else if (typeof packageJson.bin === 'object') {
+      for (const [binName, binPath] of Object.entries(packageJson.bin)) {
+        addEntryPoint(`bin.${binName}`, binPath)
+      }
+    }
+  }
+
+  // Handle exports
+  if (packageJson.exports) {
+    extractExportsEntryPoints(packageJson.exports, 'exports', addEntryPoint)
+  }
+
+  return entryPoints
+}
+
+/**
+ * Recursively extract entry points from exports field
+ * @param {any} exportsValue - Value from exports field
+ * @param {string} fieldPrefix - Current field path
+ * @param {Function} addEntryPoint - Callback to add entry point
+ */
+function extractExportsEntryPoints(exportsValue, fieldPrefix, addEntryPoint) {
+  if (typeof exportsValue === 'string') {
+    addEntryPoint(fieldPrefix, exportsValue)
+  } else if (typeof exportsValue === 'object' && exportsValue !== null) {
+    for (const [key, value] of Object.entries(exportsValue)) {
+      // Build field name with bracket notation for paths that start with . or contain special chars
+      const needsBrackets = key.startsWith('.') || key.startsWith('/')
+      const newFieldPrefix = needsBrackets ? `${fieldPrefix}["${key}"]` : `${fieldPrefix}.${key}`
+
+      // Handle conditional exports (import, require, browser, types, etc.)
+      if (key === 'import' || key === 'require' || key === 'browser' || key === 'default') {
+        if (typeof value === 'string') {
+          addEntryPoint(newFieldPrefix, value)
+        }
+      } else if (key === 'types') {
+        // Skip .d.ts files
+        if (typeof value === 'string' && !value.endsWith('.d.ts')) {
+          addEntryPoint(newFieldPrefix, value)
+        }
+      } else {
+        // Recurse for nested exports
+        extractExportsEntryPoints(value, newFieldPrefix, addEntryPoint)
+      }
+    }
+  }
+}
+
+/**
+ * Verify all package.json entry points and collect dependencies
+ * @param {string} packagePath - Path to package.json
+ * @param {object} options - Options
+ * @param {boolean} [options.collectDeps] - If true, collect dependency paths for each entry point. Default: true
+ * @param {boolean} [options.verifyGraph] - If true, verify imports/exports. Default: true
+ * @param {boolean} [options.throwIfErrors] - If true, throw an error if there are any errors. Default: false
+ * @returns {{entryPoints: Array, sourceFiles: Set, errors: Array}} - Verification results
+ */
+function verifyPackageEntries(packagePath, options = {}) {
+  const { collectDeps = true, verifyGraph = true } = options
+
+  const entryPoints = getPackageEntryPoints(packagePath)
+  const sourceFilesSet = new Set()
+  const allErrors = []
+  const results = []
+
+  for (const entryPoint of entryPoints) {
+    const result = {
+      field: entryPoint.field,
+      path: entryPoint.path,
+      resolvedPath: entryPoint.resolvedPath,
+      valid: false,
+      sourceFiles: [],
+      error: undefined
+    }
+
+    try {
+      // Check if file exists
+      if (!fs.existsSync(entryPoint.resolvedPath)) {
+        throw new Error(
+          `package.json "${entryPoint.field}" points to non-existent file: "${entryPoint.resolvedPath}"`
+        )
+      }
+
+      if (collectDeps) {
+        // Collect dependencies using resolveDepPaths
+        const relativeDeps = resolveDepPaths(entryPoint.resolvedPath, { verifyGraph, verifyNodeModules: true })
+        result.sourceFiles = relativeDeps
+
+        // Add to sourceFiles set
+        relativeDeps.forEach(dep => sourceFilesSet.add(dep))
+      } else if (verifyGraph) {
+        // Just verify without collecting deps
+        depGraph(entryPoint.resolvedPath, { buildGraph: false, verifyGraph: true })
+      }
+
+      result.valid = true
+    } catch (error) {
+      result.error = error
+      allErrors.push({
+        packagePath,
+        field: entryPoint.field,
+        path: entryPoint.path,
+        errorMsg: error.message,
+        error: error
+      })
+    }
+
+    results.push(result)
+  }
+
+  if (options.throwIfErrors && allErrors.length) {
+    throw new Error(
+      `Found ${allErrors.length} validation error${allErrors.length === 1 ? '' : 's'}: 
+${JSON.stringify(allErrors, null, 2)}`
+    )
+  }
+
+  return {
+    entryPoints: results,
+    sourceFiles: sourceFilesSet,
+    errors: allErrors
+  }
+}
+
+if (require.main === module) {
+  let pkgPath = path.resolve(__dirname, '../tests/fixtures/esm-broken-fixture/package.json')
+  //pkgPath = path.resolve(__dirname, '../tests/fixtures/cjs-broken-example/package.json')
+  console.log('=== Package Entry Points ===\n')
+  const entryPoints = getPackageEntryPoints(pkgPath)
+  entryPoints.forEach(ep => {
+    console.log(`${ep.field}: ${ep.path}`)
+  })
+
+  console.log('\n=== Verification Results ===\n')
+  const throwIfErrors = false
+  const results = verifyPackageEntries(pkgPath, { throwIfErrors })
+  console.log('results', results)
+
+  results.entryPoints.forEach(ep => {
+
+    console.log(`\nField "${ep.field}": ${ep.valid ? '' : ''}`)
+    if (ep.sourceFiles) {
+      console.log(` - Dependencies: ${ep.sourceFiles.length} files`)
+      ep.sourceFiles.forEach(sf => {
+        console.log(`- ${sf}`)
+      })
+    }
+    if (ep.error) {
+      console.log(`- Error: ${ep.error.message}`)
+    }
+    console.log('───────────────────────────────')
+  })
+
+  console.log(`\nTotal unique dependencies: ${results.sourceFiles.size}`)
+  console.log(`Total errors: ${results.errors.length}`)
+}
+
+module.exports = {
+  getPackageEntryPoints,
+  verifyPackageEntries,
+  collectEntryPoints
+}

package/tests/dep-graph.test.js

@@ -210,4 +210,176 @@ test('resolveDepPaths should pass options to depGraph', () => {
   assert.ok(deps.length > 0, 'Should return dependencies')
 })
 
+// verifyNodeModules tests
+test('verifyNodeModules should default to false', () => {
+  // CJS_DEEP_FIXTURE_PATH requires 'lodash' but without verifyNodeModules
+  // it should not check if lodash is installed
+  assert.not.throws(() => {
+    depGraph(CJS_DEEP_FIXTURE_PATH)
+  }, 'Should not verify node_modules by default')
+})
+
+test('verifyNodeModules: false should skip node_modules verification', () => {
+  const graph = depGraph(CJS_DEEP_FIXTURE_PATH, { verifyNodeModules: false })
+
+  assert.ok(graph instanceof Map, 'Should return a Map')
+  assert.ok(graph.size > 0, 'Graph should not be empty')
+})
+
+test('verifyNodeModules: true should verify installed packages', () => {
+  // CJS_DEEP_FIXTURE_PATH requires 'lodash' which should be installed
+  assert.not.throws(() => {
+    depGraph(CJS_DEEP_FIXTURE_PATH, { verifyNodeModules: true })
+  }, 'Should verify and find installed packages')
+})
+
+test('verifyNodeModules: true should build graph successfully with valid packages', () => {
+  const graph = depGraph(CJS_DEEP_FIXTURE_PATH, { verifyNodeModules: true })
+
+  assert.ok(graph instanceof Map, 'Should return a Map')
+  assert.ok(graph.size > 0, 'Graph should not be empty')
+})
+
+test('verifyNodeModules: true should throw error for missing packages', () => {
+  const fs = require('fs')
+  const testFile = path.resolve(__dirname, 'fixtures/test-missing-pkg.js')
+
+  // Create temporary test file with missing package
+  fs.writeFileSync(testFile, `const fake = require('this-package-does-not-exist-xyz-12345')\nmodule.exports = { fake }`)
+
+  try {
+    assert.throws(() => {
+      depGraph(testFile, { verifyNodeModules: true })
+    }, 'Should throw error for missing package')
+  } finally {
+    fs.unlinkSync(testFile)
+  }
+})
+
+test('verifyNodeModules: true error message should be helpful', () => {
+  const fs = require('fs')
+  const testFile = path.resolve(__dirname, 'fixtures/test-missing-pkg-2.js')
+  const missingPkg = 'nonexistent-package-xyz'
+
+  fs.writeFileSync(testFile, `const fake = require('${missingPkg}')\nmodule.exports = { fake }`)
+
+  try {
+    let errorMessage = ''
+    try {
+      depGraph(testFile, { verifyNodeModules: true })
+    } catch (error) {
+      errorMessage = error.message
+    }
+
+    assert.ok(errorMessage.includes(missingPkg), 'Error should mention the missing package name')
+    assert.ok(errorMessage.includes('could not be resolved'), 'Error should say it could not be resolved')
+  } finally {
+    fs.unlinkSync(testFile)
+  }
+})
+
+test('verifyNodeModules: true should work with both CJS and ESM', () => {
+  // Both fixtures should work (they only have relative imports)
+  assert.not.throws(() => {
+    depGraph(CJS_FIXTURE_PATH, { verifyNodeModules: true })
+  }, 'Should work with CJS')
+
+  assert.not.throws(() => {
+    depGraph(ESM_FIXTURE_PATH, { verifyNodeModules: true })
+  }, 'Should work with ESM')
+})
+
+test('verifyNodeModules should work with all other options', () => {
+  const graph = depGraph(CJS_DEEP_FIXTURE_PATH, {
+    buildGraph: true,
+    verifyGraph: true,
+    verifyNodeModules: true,
+    throwOnFirstError: false
+  })
+
+  assert.ok(graph instanceof Map, 'Should return a Map')
+  assert.ok(graph.size > 0, 'Graph should not be empty')
+})
+
+test('verifyNodeModules with throwOnFirstError: true should throw immediately', () => {
+  const fs = require('fs')
+  const testFile = path.resolve(__dirname, 'fixtures/test-throw-first.js')
+
+  fs.writeFileSync(testFile, `
+const missing1 = require('missing-package-1')
+const missing2 = require('missing-package-2')
+module.exports = { missing1, missing2 }
+`)
+
+  try {
+    let errorThrown = false
+
+    try {
+      depGraph(testFile, { verifyNodeModules: true, throwOnFirstError: true })
+    } catch (error) {
+      errorThrown = true
+      // When throwOnFirstError is true, should throw immediately on first error
+      assert.ok(error.message.includes('missing-package-1'), 'Should throw on first missing package')
+    }
+
+    assert.ok(errorThrown, 'Should throw an error')
+  } finally {
+    fs.unlinkSync(testFile)
+  }
+})
+
+test('verifyNodeModules with throwOnFirstError: false should collect all errors', () => {
+  const fs = require('fs')
+  const testFile = path.resolve(__dirname, 'fixtures/test-collect-errors.js')
+
+  fs.writeFileSync(testFile, `
+const missing1 = require('missing-package-1')
+const missing2 = require('missing-package-2')
+module.exports = { missing1, missing2 }
+`)
+
+  try {
+    let errorMessage = ''
+
+    try {
+      depGraph(testFile, { verifyNodeModules: true, throwOnFirstError: false })
+    } catch (error) {
+      errorMessage = error.message
+    }
+
+    assert.ok(errorMessage.includes('missing-package-1'), 'Should include first error')
+    assert.ok(errorMessage.includes('missing-package-2'), 'Should include second error')
+    assert.ok(errorMessage.includes('2 validation error'), 'Should mention 2 errors')
+  } finally {
+    fs.unlinkSync(testFile)
+  }
+})
+
+// Directory to index.js resolution tests
+const DIR_INDEX_FIXTURE_PATH = path.resolve(__dirname, './fixtures/dir-index-example/entry.js')
+
+test('should resolve directory import to index.js', () => {
+  const graph = depGraph(DIR_INDEX_FIXTURE_PATH)
+
+  assert.ok(graph instanceof Map, 'Should return a Map')
+  assert.ok(graph.size === 2, 'Graph should have 2 files (entry.js and shared-pkg/index.js)')
+
+  const entries = Array.from(graph.keys())
+  const hasEntry = entries.some(key => key.includes('entry.js'))
+  const hasIndex = entries.some(key => key.includes('shared-pkg/index.js'))
+
+  assert.ok(hasEntry, 'Graph should include entry.js')
+  assert.ok(hasIndex, 'Graph should resolve directory to index.js')
+})
+
+test('resolveDepPaths should work with directory imports', () => {
+  const deps = resolveDepPaths(DIR_INDEX_FIXTURE_PATH)
+
+  assert.ok(Array.isArray(deps), 'Should return an array')
+  assert.is(deps.length, 2, 'Should have 2 files')
+
+  assert.ok(deps.some(p => p.includes('shared-pkg/index.js')), 'Should include resolved index.js')
+  assert.ok(deps.some(p => p.includes('entry.js')), 'Should include entry.js')
+})
+
 test.run()

package/tests/fixtures/cjs-broken-example/index.js

@@ -0,0 +1,8 @@
+const lodash = require('lodash')
+const { one, two, three, fake } = require('./one')
+
+module.exports = {
+  one,
+  two,
+  three
+}

package/tests/fixtures/cjs-broken-example/one.js

@@ -0,0 +1,9 @@
+const { two, three } = require('./sub-folder/two')
+
+const one = 'one'
+
+module.exports = {
+  one,
+  two,
+  three
+}