@loomhelix/deptrail 0.1.0

package/dist/cli/cli.js

@@ -0,0 +1,227 @@
+#!/usr/bin/env node
+import { realpathSync } from 'node:fs';
+import { readFile, stat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+import { fileURLToPath } from 'node:url';
+import { createActionService } from "../actions/action-service.js";
+import { createProcessRunner, spawnRunner } from "../adapters/command-runner.js";
+import { removeResolveTempDirs } from "../adapters/resolve-today.js";
+import { serializeScan } from "../graph/serialize.js";
+import { userNpmrcPath } from "../config/npmrc.js";
+import { processSecrets } from "../config/secrets.js";
+import { createEnrichmentCache } from "../enrich/enrichment-cache.js";
+import { createEnrichmentService } from "../enrich/enrichment-service.js";
+import { createHttpClient } from "../enrich/http.js";
+import { OSV_DEFAULT_URL } from "../enrich/osv-client.js";
+import { createScanCache } from "../scan/scan-cache.js";
+import { killGitProcesses } from "../git/git-process.js";
+import { isGitRepository, openGitRepository } from "../git/git-repository.js";
+import { startScanSession } from "../scan/scan-session.js";
+import { createSourceRegistry } from "../scan/source-registry.js";
+import { createBranches } from "../server/branches.js";
+import { startServer } from "../server/server.js";
+import { createFsReader } from "../sources/file-reader.js";
+import { createGitReader } from "../sources/git-reader.js";
+import { openBrowser } from "./open-browser.js";
+import { readPackageVersion } from "./package-version.js";
+import { USAGE_HINT, USAGE_TEXT } from "./usage-text.js";
+const EXIT_OK = 0;
+const EXIT_PORT_IN_USE = 1;
+const EXIT_USAGE = 2;
+const OPTIONS = {
+    port: { type: 'string' },
+    'no-open': { type: 'boolean' },
+    json: { type: 'boolean' },
+    offline: { type: 'boolean' },
+    help: { type: 'boolean', short: 'h' },
+    version: { type: 'boolean', short: 'v' },
+};
+async function isDirectory(target) {
+    try {
+        return (await stat(target)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+async function readUserNpmrc(env) {
+    try {
+        return await readFile(userNpmrcPath(env, env.HOME ?? homedir()), 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function parsePort(raw) {
+    if (raw === undefined)
+        return undefined;
+    const port = Number(raw);
+    return Number.isInteger(port) && port >= 0 && port <= 65535 ? port : null;
+}
+function startEnrichment(setup) {
+    const abort = new AbortController();
+    return createEnrichmentService({
+        reader: setup.reader,
+        env: setup.env,
+        userNpmrc: setup.userNpmrc,
+        http: createHttpClient({ userAgent: `deptrail/${readPackageVersion()} node/${process.version}`, signal: abort.signal }),
+        osvUrl: setup.env.DEPTRAIL_OSV_URL ?? OSV_DEFAULT_URL,
+        cache: createEnrichmentCache(setup.cacheDir),
+        secrets: processSecrets,
+        offline: setup.offline,
+        abort,
+    });
+}
+async function openCommitSession(git, commit, sessionOptions, onRootPublished) {
+    if (!isGitRepository(git))
+        throw new Error(git.unavailable);
+    const index = await git.tree(commit);
+    return startScanSession({
+        ...sessionOptions,
+        reader: createGitReader(index, (blobId) => git.readBlob(blobId)),
+        useInstalled: false,
+        expandNpmrcVariables: false,
+        skippedSubmodules: index.submodules,
+        onRootPublished,
+    });
+}
+function waitForTermination(shutdown) {
+    return new Promise((resolve) => {
+        const stop = () => {
+            process.off('SIGINT', stop);
+            process.off('SIGTERM', stop);
+            shutdown().finally(resolve);
+        };
+        process.on('SIGINT', stop);
+        process.on('SIGTERM', stop);
+    });
+}
+export async function main(argv, env, io) {
+    let parsed;
+    try {
+        parsed = parseArgs({ args: argv, options: OPTIONS, allowPositionals: true });
+    }
+    catch (error) {
+        io.stderr(`${error instanceof Error ? error.message : String(error)}\n${USAGE_HINT}\n`);
+        return EXIT_USAGE;
+    }
+    if (parsed.values.help) {
+        io.stdout(USAGE_TEXT);
+        return EXIT_OK;
+    }
+    if (parsed.values.version) {
+        io.stdout(`${readPackageVersion()}\n`);
+        return EXIT_OK;
+    }
+    const port = parsePort(parsed.values.port);
+    if (port === null) {
+        io.stderr('Invalid --port: expected an integer between 0 and 65535\n');
+        return EXIT_USAGE;
+    }
+    const repoPath = path.resolve(parsed.positionals[0] ?? '.');
+    if (!(await isDirectory(repoPath))) {
+        io.stderr(`Not a directory: ${repoPath}\n`);
+        return EXIT_USAGE;
+    }
+    const reader = createFsReader(repoPath);
+    const userNpmrc = await readUserNpmrc(env);
+    const cacheDir = env.DEPTRAIL_CACHE_DIR ?? path.join(homedir(), '.cache', 'deptrail');
+    const sessionOptions = { repoPath, reader, runner: spawnRunner, cache: createScanCache(cacheDir), env, userNpmrc };
+    if (parsed.values.json) {
+        const session = await startScanSession(sessionOptions);
+        await session.ready;
+        io.stdout(`${JSON.stringify(serializeScan(session.scan))}\n`);
+        return EXIT_OK;
+    }
+    const enrichment = startEnrichment({ reader, env, userNpmrc, cacheDir, offline: parsed.values.offline === true });
+    let actions;
+    let sources;
+    const session = await startScanSession({
+        ...sessionOptions,
+        onRootPublished: (roots) => {
+            if (sources)
+                sources.rootsChanged();
+            else
+                enrichment.track(roots);
+            actions?.track(roots);
+        },
+    });
+    const git = await openGitRepository({ cwd: repoPath, env, redact: (text) => processSecrets.redact(text) });
+    const registry = createSourceRegistry({
+        working: session,
+        openSession: (commit) => openCommitSession(git, commit, sessionOptions, () => registry.rootsChanged()),
+        onRootsChanged: (roots) => enrichment.track(roots),
+    });
+    sources = registry;
+    const closeGit = () => {
+        registry.close();
+        if (isGitRepository(git))
+            git.close();
+        killGitProcesses();
+    };
+    const actionService = createActionService({
+        repoPath,
+        session,
+        enrichment,
+        runner: createProcessRunner(),
+        env,
+        offline: parsed.values.offline === true,
+        secrets: processSecrets,
+    });
+    actions = actionService;
+    actionService.track(session.scan.roots);
+    let server;
+    try {
+        server = await startServer({
+            session,
+            enrichment,
+            actions: actionService,
+            branches: createBranches(git, registry),
+            port,
+            staticDir: fileURLToPath(new URL('../ui', import.meta.url)),
+            errorStream: { write: io.stderr },
+        });
+    }
+    catch (error) {
+        enrichment.close();
+        closeGit();
+        await actionService.close();
+        if (error.code === 'EADDRINUSE' && port !== undefined && port !== 0) {
+            io.stderr(`Port ${port} is in use\n`);
+            return EXIT_PORT_IN_USE;
+        }
+        throw error;
+    }
+    io.stdout(`deptrail: ${server.url}\n`);
+    if (!parsed.values['no-open'])
+        io.openBrowser(server.url);
+    await waitForTermination(async () => {
+        enrichment.close();
+        spawnRunner.killRunning();
+        closeGit();
+        await Promise.all([removeResolveTempDirs(), server.close(), actionService.close()]);
+    });
+    return EXIT_OK;
+}
+function isInvokedDirectly() {
+    if (process.argv[1] === undefined)
+        return false;
+    try {
+        return realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+    }
+    catch {
+        return false;
+    }
+}
+if (isInvokedDirectly()) {
+    main(process.argv.slice(2), process.env, {
+        stdout: (text) => process.stdout.write(text),
+        stderr: (text) => process.stderr.write(text),
+        openBrowser,
+    }).then((code) => process.exit(code), (error) => {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.exit(1);
+    });
+}

package/dist/cli/open-browser.js

@@ -0,0 +1,14 @@
+import { spawn } from 'node:child_process';
+export function browserCommand(platform, url) {
+    if (platform === 'darwin')
+        return { command: 'open', args: [url] };
+    if (platform === 'win32')
+        return { command: 'cmd', args: ['/c', 'start', '""', url] };
+    return { command: 'xdg-open', args: [url] };
+}
+export function openBrowser(url) {
+    const { command, args } = browserCommand(process.platform, url);
+    const child = spawn(command, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => { });
+    child.unref();
+}

package/dist/cli/package-version.js

@@ -0,0 +1,6 @@
+import { readFileSync } from 'node:fs';
+const PACKAGE_MANIFEST = new URL('../../package.json', import.meta.url);
+export function readPackageVersion() {
+    const manifest = JSON.parse(readFileSync(PACKAGE_MANIFEST, 'utf8'));
+    return manifest.version;
+}

package/dist/cli/usage-text.js

@@ -0,0 +1,27 @@
+export const USAGE_HINT = 'Run deptrail --help to see the options.';
+export const USAGE_TEXT = `Usage: deptrail [path] [options]
+
+Explores the dependency trees of every JavaScript root in a repository and
+serves a local viewer of their issues, dependents and fixes.
+
+Arguments:
+  path                    Repository to scan. Defaults to the current directory.
+
+Options:
+  --port <n>              Port for the local server. Defaults to a free port.
+  --no-open               Print the viewer URL without opening a browser.
+  --json                  Print the normalized scan as JSON and exit, without
+                          starting the server or using the network.
+  --offline               Send no requests to registries or OSV.dev.
+  -h, --help              Show this help and exit.
+  -v, --version           Print the version and exit.
+
+Environment:
+  DEPTRAIL_CACHE_DIR      Cache directory instead of ~/.cache/deptrail.
+  DEPTRAIL_OSV_URL        Base URL of an OSV-compatible API instead of
+                          https://api.osv.dev.
+  npm_config_registry     Default registry, as with npm.
+  npm_config_userconfig   User config file to read instead of ~/.npmrc.
+
+Documentation: https://github.com/loomhelix/deptrail#readme
+`;

package/dist/config/glob.js

@@ -0,0 +1,119 @@
+const ANY_SEGMENTS = Symbol('any-segments');
+const PARENT_SEGMENT = '..';
+const HIDDEN_PREFIX = '.';
+const NEGATION_PREFIX = '!';
+const CLASS_NEGATIONS = new Set(['!', '^']);
+function braceGroupAt(pattern, start) {
+    const alternatives = [];
+    let depth = 0;
+    let alternativeStart = start + 1;
+    for (let index = start; index < pattern.length; index++) {
+        const character = pattern[index];
+        if (character === '{')
+            depth++;
+        if (character === ',' && depth === 1) {
+            alternatives.push(pattern.slice(alternativeStart, index));
+            alternativeStart = index + 1;
+        }
+        if (character === '}' && --depth === 0) {
+            alternatives.push(pattern.slice(alternativeStart, index));
+            return alternatives.length > 1 ? { start, end: index, alternatives } : undefined;
+        }
+    }
+    return undefined;
+}
+function firstBraceGroup(pattern) {
+    for (let start = pattern.indexOf('{'); start !== -1; start = pattern.indexOf('{', start + 1)) {
+        const group = braceGroupAt(pattern, start);
+        if (group !== undefined)
+            return group;
+    }
+    return undefined;
+}
+function expandBraces(pattern) {
+    const group = firstBraceGroup(pattern);
+    if (group === undefined)
+        return [pattern];
+    const prefix = pattern.slice(0, group.start);
+    const suffix = pattern.slice(group.end + 1);
+    return group.alternatives.flatMap((alternative) => expandBraces(`${prefix}${alternative}${suffix}`));
+}
+function expandPattern(rawPattern) {
+    const negated = rawPattern.startsWith(NEGATION_PREFIX);
+    const body = negated ? rawPattern.slice(NEGATION_PREFIX.length) : rawPattern;
+    return expandBraces(body).map((expanded) => (negated ? `${NEGATION_PREFIX}${expanded}` : expanded));
+}
+function escapeLiteral(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function classToRegExp(segment, open) {
+    const negated = CLASS_NEGATIONS.has(segment[open + 1] ?? '');
+    const bodyStart = negated ? open + 2 : open + 1;
+    const close = segment.indexOf(']', bodyStart + 1);
+    if (close === -1)
+        return undefined;
+    const body = segment.slice(bodyStart, close).replace(/[\\\]^]/g, '\\$&');
+    return { source: `[${negated ? '^' : ''}${body}]`, next: close + 1 };
+}
+function segmentToRegExp(segment) {
+    let source = '';
+    let index = 0;
+    while (index < segment.length) {
+        const character = segment[index];
+        const characterClass = character === '[' ? classToRegExp(segment, index) : undefined;
+        if (characterClass !== undefined) {
+            source += characterClass.source;
+            index = characterClass.next;
+            continue;
+        }
+        if (character === '*')
+            source += '[^/]*';
+        else if (character === '?')
+            source += '[^/]';
+        else
+            source += escapeLiteral(character);
+        index++;
+    }
+    const parentGuard = segment === PARENT_SEGMENT ? '' : '(?!\\.\\.$)';
+    const hiddenGuard = segment.startsWith(HIDDEN_PREFIX) ? '' : '(?!\\.)';
+    return new RegExp(`^${parentGuard}${hiddenGuard}${source}$`);
+}
+function compilePattern(rawPattern) {
+    const negated = rawPattern.startsWith('!');
+    const body = (negated ? rawPattern.slice(1) : rawPattern).replace(/^\.\//, '').replace(/\/+$/, '');
+    const segments = body
+        .split('/')
+        .filter((segment) => segment !== '')
+        .map((segment) => (segment === '**' ? ANY_SEGMENTS : segmentToRegExp(segment)));
+    return { negated, segments };
+}
+function matchesSegments(pattern, patternIndex, path, pathIndex) {
+    if (patternIndex === pattern.length)
+        return pathIndex === path.length;
+    const current = pattern[patternIndex];
+    if (current === ANY_SEGMENTS) {
+        for (let skipTo = pathIndex; skipTo <= path.length; skipTo++) {
+            if (matchesSegments(pattern, patternIndex + 1, path, skipTo))
+                return true;
+            if (path[skipTo]?.startsWith(HIDDEN_PREFIX))
+                return false;
+        }
+        return false;
+    }
+    if (pathIndex === path.length || !current.test(path[pathIndex]))
+        return false;
+    return matchesSegments(pattern, patternIndex + 1, path, pathIndex + 1);
+}
+export function compileWorkspacePatterns(patterns) {
+    const compiled = patterns.flatMap(expandPattern).map(compilePattern);
+    return (relPath) => {
+        const pathSegments = relPath.split('/').filter((segment) => segment !== '');
+        let included = false;
+        for (const pattern of compiled) {
+            if (pattern.negated === included && matchesSegments(pattern.segments, 0, pathSegments, 0)) {
+                included = !pattern.negated;
+            }
+        }
+        return included;
+    };
+}

package/dist/config/npmrc.js

@@ -0,0 +1,116 @@
+import { join } from 'node:path';
+const AUTH_KEY_SUFFIXES = ['_authToken', '_auth', '_password'];
+const SCOPED_REGISTRY_KEY = /^(@[^:]+):registry$/;
+const SCOPED_AUTH_KEY_PREFIX = '//';
+const NPM_CONFIG_PREFIX = 'npm_config_';
+const HOME_PREFIX = '~/';
+const COMMENT_CHARACTERS = ';#';
+const VARIABLE_REFERENCE = /\$\{[^}]+\}/;
+function expandVariables(value, env) {
+    return value.replace(/\$\{([^}]+)\}/g, (_match, name) => env[name] ?? '');
+}
+const URL_USERINFO = /^([a-z][a-z0-9+.-]*:\/\/)[^/?#]*@/i;
+const URL_USERINFO_IN_TEXT = /(?<![a-z0-9+.-])([a-z][a-z0-9+.-]*:\/\/)[^/?#\n]*@/gi;
+const PROTOCOL_RELATIVE_USERINFO = /(^|[\s'"(])\/\/[^/?#\s@]+@/g;
+const AUTH_ASSIGNMENT = /(_authToken|_auth|_password|npm_token)(\s*[=:]\s*)\S+/gi;
+const BEARER_TOKEN = /\bBearer\s+\S+/gi;
+const REDACTED = '[redacted]';
+export function stripRegistryCredentials(url) {
+    const stripped = url.replace(URL_USERINFO, '$1');
+    return { url: stripped, hadCredentials: stripped !== url };
+}
+export function redactCredentials(text) {
+    return text
+        .replace(URL_USERINFO_IN_TEXT, '$1')
+        .replace(PROTOCOL_RELATIVE_USERINFO, '$1//')
+        .replace(AUTH_ASSIGNMENT, `$1$2${REDACTED}`)
+        .replace(BEARER_TOKEN, `Bearer ${REDACTED}`);
+}
+function cutAtInlineComment(value) {
+    let kept = '';
+    for (let index = 0; index < value.length; index++) {
+        const character = value[index];
+        const next = value[index + 1];
+        if (character === '\\' && next !== undefined && COMMENT_CHARACTERS.includes(next)) {
+            kept += next;
+            index++;
+        }
+        else if (COMMENT_CHARACTERS.includes(character)) {
+            break;
+        }
+        else {
+            kept += character;
+        }
+    }
+    return kept.trim();
+}
+function unquoteValue(rawValue) {
+    const isWrappedIn = (quote) => rawValue.length >= 2 && rawValue.startsWith(quote) && rawValue.endsWith(quote);
+    if (isWrappedIn('"')) {
+        try {
+            return String(JSON.parse(rawValue));
+        }
+        catch {
+            return rawValue;
+        }
+    }
+    if (isWrappedIn("'"))
+        return rawValue.slice(1, -1);
+    return cutAtInlineComment(rawValue);
+}
+export function parseNpmrcEntries(text, env) {
+    const entries = [];
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (line === '' || line.startsWith(';') || line.startsWith('#'))
+            continue;
+        const separatorIndex = line.indexOf('=');
+        if (separatorIndex === -1)
+            continue;
+        const key = line.slice(0, separatorIndex).trim();
+        const value = expandVariables(unquoteValue(line.slice(separatorIndex + 1).trim()), env);
+        entries.push({ key, value });
+    }
+    return entries;
+}
+export function withoutVariableReferences(text) {
+    return text
+        .split(/\r?\n/)
+        .filter((line) => !VARIABLE_REFERENCE.test(line))
+        .join('\n');
+}
+export function npmConfigEnv(env, name) {
+    const exactKey = `${NPM_CONFIG_PREFIX}${name}`;
+    if (env[exactKey] !== undefined)
+        return env[exactKey];
+    const matchingKey = Object.keys(env).find((key) => key.toLowerCase() === exactKey && env[key] !== undefined);
+    return matchingKey === undefined ? undefined : env[matchingKey];
+}
+export function userNpmrcPath(env, home) {
+    const configured = npmConfigEnv(env, 'userconfig');
+    if (configured === undefined || configured === '')
+        return join(home, '.npmrc');
+    return configured.startsWith(HOME_PREFIX) ? join(home, configured.slice(HOME_PREFIX.length)) : configured;
+}
+export function parseNpmrc(text, env) {
+    const values = { scopedRegistries: {}, hasAuth: false, unscopedAuthKeys: [] };
+    for (const { key, value } of parseNpmrcEntries(text, env)) {
+        if (AUTH_KEY_SUFFIXES.some((suffix) => key.endsWith(suffix))) {
+            values.hasAuth = true;
+            if (!key.startsWith(SCOPED_AUTH_KEY_PREFIX))
+                values.unscopedAuthKeys.push(key);
+            continue;
+        }
+        const scopedMatch = SCOPED_REGISTRY_KEY.exec(key);
+        if (key !== 'registry' && !scopedMatch)
+            continue;
+        const registry = stripRegistryCredentials(value);
+        if (registry.hadCredentials)
+            values.hasAuth = true;
+        if (!scopedMatch)
+            values.registry = registry.url;
+        else if (registry.url !== '')
+            values.scopedRegistries[scopedMatch[1]] = registry.url;
+    }
+    return values;
+}

package/dist/config/root-config.js

@@ -0,0 +1,103 @@
+import { posix } from 'node:path';
+import { parse } from 'yaml';
+import { readManifest } from "../adapters/package-manifest.js";
+import { npmConfigEnv, parseNpmrc, stripRegistryCredentials, withoutVariableReferences } from "./npmrc.js";
+const DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
+const DEFAULT_CATALOG = 'default';
+const NESTED_SELF_KEY = '.';
+const USER_NPMRC_LABEL = 'user .npmrc';
+const PROJECT_NPMRC_LABEL = 'project .npmrc';
+function asRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : null;
+}
+function asStringArray(value) {
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === 'string') : [];
+}
+function stringEntries(value) {
+    const record = asRecord(value);
+    if (!record)
+        return {};
+    return Object.fromEntries(Object.entries(record).filter(([, entry]) => typeof entry === 'string'));
+}
+function flattenOverrides(value, parentSelector, flattened) {
+    const record = asRecord(value);
+    if (!record)
+        return;
+    for (const [key, entry] of Object.entries(record)) {
+        if (typeof entry === 'string') {
+            const selector = key === NESTED_SELF_KEY && parentSelector !== null ? parentSelector : joinSelector(parentSelector, key);
+            flattened[selector] = entry;
+        }
+        else {
+            flattenOverrides(entry, joinSelector(parentSelector, key), flattened);
+        }
+    }
+}
+function joinSelector(parentSelector, key) {
+    return parentSelector === null ? key : `${parentSelector} > ${key}`;
+}
+function unscopedAuthWarnings(npmrc, label) {
+    return npmrc.unscopedAuthKeys.map((key) => `${key} in ${label} is not scoped to a registry and is ignored`);
+}
+async function readWorkspaceYaml(reader, rootPath) {
+    const text = await reader.readText(posix.join(rootPath, 'pnpm-workspace.yaml'));
+    if (text === null)
+        return {};
+    try {
+        return asRecord(parse(text)) ?? {};
+    }
+    catch {
+        return {};
+    }
+}
+async function readManifestRecord(reader, rootPath) {
+    const result = await readManifest(reader, rootPath);
+    return 'manifest' in result ? result.manifest.record : {};
+}
+function workspacePatternsOf(workspaceYaml, manifest) {
+    const fromYaml = asStringArray(workspaceYaml.packages);
+    if (fromYaml.length > 0)
+        return fromYaml;
+    const workspaces = manifest.workspaces;
+    return Array.isArray(workspaces) ? asStringArray(workspaces) : asStringArray(asRecord(workspaces)?.packages);
+}
+export async function readWorkspacePatterns(reader, rootPath) {
+    const workspaceYaml = await readWorkspaceYaml(reader, rootPath);
+    const manifest = await readManifestRecord(reader, rootPath);
+    return workspacePatternsOf(workspaceYaml, manifest);
+}
+function catalogsOf(workspaceYaml) {
+    const catalogs = {};
+    const defaultCatalog = stringEntries(workspaceYaml.catalog);
+    if (Object.keys(defaultCatalog).length > 0)
+        catalogs[DEFAULT_CATALOG] = defaultCatalog;
+    for (const [name, entries] of Object.entries(asRecord(workspaceYaml.catalogs) ?? {})) {
+        catalogs[name] = stringEntries(entries);
+    }
+    return catalogs;
+}
+function overridesOf(workspaceYaml, manifest) {
+    const overrides = {};
+    flattenOverrides(workspaceYaml.overrides, null, overrides);
+    flattenOverrides(manifest.overrides, null, overrides);
+    flattenOverrides(asRecord(manifest.pnpm)?.overrides, null, overrides);
+    return overrides;
+}
+export async function readRootConfig(reader, rootPath, sources) {
+    const projectNpmrcText = await reader.readText(posix.join(rootPath, '.npmrc'));
+    const userNpmrc = parseNpmrc(sources.userNpmrc ?? '', sources.env);
+    const projectText = projectNpmrcText ?? '';
+    const projectNpmrc = parseNpmrc(sources.expandProjectVariables === false ? withoutVariableReferences(projectText) : projectText, sources.env);
+    const workspaceYaml = await readWorkspaceYaml(reader, rootPath);
+    const manifest = await readManifestRecord(reader, rootPath);
+    const envRegistry = stripRegistryCredentials(npmConfigEnv(sources.env, 'registry') ?? '');
+    return {
+        registry: envRegistry.url || projectNpmrc.registry || userNpmrc.registry || DEFAULT_REGISTRY,
+        scopedRegistries: { ...userNpmrc.scopedRegistries, ...projectNpmrc.scopedRegistries },
+        hasAuth: userNpmrc.hasAuth || projectNpmrc.hasAuth || envRegistry.hadCredentials,
+        catalogs: catalogsOf(workspaceYaml),
+        overrides: overridesOf(workspaceYaml, manifest),
+        workspacePatterns: workspacePatternsOf(workspaceYaml, manifest),
+        warnings: [...unscopedAuthWarnings(userNpmrc, USER_NPMRC_LABEL), ...unscopedAuthWarnings(projectNpmrc, PROJECT_NPMRC_LABEL)],
+    };
+}

package/dist/config/secrets.js

@@ -0,0 +1,18 @@
+import { redactCredentials } from "./npmrc.js";
+export const MIN_SECRET_LENGTH = 6;
+const REDACTED = '[redacted]';
+export function createSecretSet() {
+    const known = new Set();
+    return {
+        add(value) {
+            if (value.length >= MIN_SECRET_LENGTH)
+                known.add(value);
+        },
+        redact(text) {
+            const longestFirst = [...known].sort((left, right) => right.length - left.length);
+            const withoutKnown = longestFirst.reduce((current, secret) => current.split(secret).join(REDACTED), text);
+            return redactCredentials(withoutKnown);
+        },
+    };
+}
+export const processSecrets = createSecretSet();