@loomhelix/deptrail 0.1.0

package/dist/discovery/find-roots.js

@@ -0,0 +1,107 @@
+import { posix } from 'node:path';
+import { readManifest } from "../adapters/package-manifest.js";
+import { compileWorkspacePatterns } from "../config/glob.js";
+import { readWorkspacePatterns } from "../config/root-config.js";
+const ALWAYS_SKIPPED_DIRECTORIES = new Set(['node_modules', '.git']);
+const GITIGNORE_FILE = '.gitignore';
+const PNPM_LOCKFILE = 'pnpm-lock.yaml';
+const NPM_LOCKFILES = ['package-lock.json', 'npm-shrinkwrap.json'];
+const PNPM_WORKSPACE_FILE = 'pnpm-workspace.yaml';
+const MANIFEST_FILE = 'package.json';
+const NO_MEMBERS = () => false;
+function createIgnoreMatcher(gitignoreText) {
+    const names = new Set();
+    const anchoredPaths = new Set();
+    for (const rawLine of (gitignoreText ?? '').split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (line === '' || line.startsWith('#') || line.startsWith('!') || /[*?[\\]/.test(line))
+            continue;
+        const withoutTrailingSlash = line.replace(/\/+$/, '');
+        if (withoutTrailingSlash.startsWith('/')) {
+            anchoredPaths.add(withoutTrailingSlash.slice(1));
+        }
+        else if (withoutTrailingSlash.includes('/')) {
+            anchoredPaths.add(withoutTrailingSlash);
+        }
+        else if (withoutTrailingSlash !== '') {
+            names.add(withoutTrailingSlash);
+        }
+    }
+    return (path) => anchoredPaths.has(path) || names.has(posix.basename(path));
+}
+function isIgnoredBy(rules, path) {
+    return rules.some((rule) => isInside(path, rule.directory) && rule.matches(posix.relative(rule.directory, path)));
+}
+function packageManagerFromField(field) {
+    if (typeof field !== 'string')
+        return 'unknown';
+    const name = field.split('@')[0];
+    return name === 'pnpm' || name === 'npm' ? name : 'unknown';
+}
+async function describeRoot(reader, facts) {
+    const { path, files } = facts;
+    const inDirectory = (name) => posix.join(path, name);
+    const base = { id: path, path, importerPaths: [path] };
+    if (files.has(PNPM_LOCKFILE))
+        return { ...base, manager: 'pnpm', lockfile: inDirectory(PNPM_LOCKFILE) };
+    const npmLockfile = NPM_LOCKFILES.find((name) => files.has(name));
+    if (npmLockfile)
+        return { ...base, manager: 'npm', lockfile: inDirectory(npmLockfile) };
+    if (files.has(PNPM_WORKSPACE_FILE))
+        return { ...base, manager: 'pnpm' };
+    if (!files.has(MANIFEST_FILE))
+        return null;
+    const result = await readManifest(reader, path);
+    const record = 'manifest' in result ? result.manifest.record : {};
+    if (record.workspaces !== undefined)
+        return { ...base, manager: 'npm' };
+    return { ...base, manager: packageManagerFromField(record.packageManager) };
+}
+async function createMemberMatcher(reader, root) {
+    const patterns = await readWorkspacePatterns(reader, root.path);
+    if (patterns.length === 0)
+        return NO_MEMBERS;
+    const matchesPatterns = compileWorkspacePatterns(patterns);
+    return (path) => path !== root.path && matchesPatterns(posix.relative(root.path, path));
+}
+function isInside(directory, ancestor) {
+    return ancestor === '.' || directory.startsWith(`${ancestor}/`);
+}
+export async function findRoots(reader, startPath = '.') {
+    const ignoreRules = [{ directory: '.', matches: createIgnoreMatcher(await reader.readText(GITIGNORE_FILE)) }];
+    const foundRoots = [];
+    const manifestDirectories = [];
+    const queue = [posix.normalize(startPath)];
+    for (let index = 0; index < queue.length; index++) {
+        const directory = queue[index];
+        const entries = await reader.listDir(directory);
+        const files = new Set(entries.filter((entry) => entry.kind === 'file').map((entry) => entry.name));
+        if (directory !== '.' && files.has(GITIGNORE_FILE)) {
+            ignoreRules.push({ directory, matches: createIgnoreMatcher(await reader.readText(posix.join(directory, GITIGNORE_FILE))) });
+        }
+        const subdirectories = entries
+            .filter((entry) => entry.kind === 'dir' && !ALWAYS_SKIPPED_DIRECTORIES.has(entry.name))
+            .map((entry) => posix.join(directory, entry.name))
+            .filter((path) => !isIgnoredBy(ignoreRules, path))
+            .sort();
+        queue.push(...subdirectories);
+        if (files.has(MANIFEST_FILE))
+            manifestDirectories.push(directory);
+        const enclosing = foundRoots.some((root) => isInside(directory, root.descriptor.path) && root.isMember(directory));
+        if (enclosing && files.has(MANIFEST_FILE))
+            continue;
+        const descriptor = await describeRoot(reader, { path: directory, files });
+        if (descriptor)
+            foundRoots.push({ descriptor, isMember: await createMemberMatcher(reader, descriptor) });
+    }
+    for (const root of foundRoots) {
+        const members = manifestDirectories
+            .filter((path) => isInside(path, root.descriptor.path) && root.isMember(path))
+            .filter((path) => !isOwnedByOtherRoot(path, root, foundRoots));
+        root.descriptor.importerPaths = [root.descriptor.path, ...members.sort()];
+    }
+    return foundRoots.map((root) => root.descriptor).sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+}
+function isOwnedByOtherRoot(path, candidate, allRoots) {
+    return allRoots.some((other) => other !== candidate && other.descriptor.path === path);
+}

package/dist/enrich/credentials.js

@@ -0,0 +1,143 @@
+import { npmConfigEnv, parseNpmrcEntries } from "../config/npmrc.js";
+const CREDENTIAL_FIELDS = ['_authToken', '_auth', '_password', 'username'];
+const UNSCOPED_SECRET_FIELDS = ['_authToken', '_auth', '_password'];
+const WEB_PROTOCOLS = ['http:', 'https:'];
+const SCOPED_REGISTRY_KEY = /^@[^:]+:registry$/;
+function splitCredentialKey(key) {
+    if (!key.startsWith('//'))
+        return undefined;
+    const separatorIndex = key.lastIndexOf(':');
+    const prefix = key.slice(0, separatorIndex);
+    const field = key.slice(separatorIndex + 1);
+    const knownField = CREDENTIAL_FIELDS.find((candidate) => candidate === field);
+    if (separatorIndex === -1 || knownField === undefined)
+        return undefined;
+    return { prefix: prefix.endsWith('/') ? prefix : `${prefix}/`, field: knownField };
+}
+function encodeBasic(username, password) {
+    return `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`;
+}
+function decodeBase64(value) {
+    return Buffer.from(value, 'base64').toString('utf8');
+}
+function addFieldSecrets(fields, secrets) {
+    for (const value of Object.values(fields))
+        secrets.add(value);
+    if (fields._auth !== undefined) {
+        const decodedAuth = decodeBase64(fields._auth);
+        secrets.add(decodedAuth);
+        secrets.add(decodedAuth.slice(decodedAuth.indexOf(':') + 1));
+    }
+    if (fields._password !== undefined)
+        secrets.add(decodeBase64(fields._password));
+}
+function authorizationFromFields(fields, secrets) {
+    addFieldSecrets(fields, secrets);
+    const decodedPassword = fields._password === undefined ? undefined : decodeBase64(fields._password);
+    if (fields._authToken !== undefined)
+        return `Bearer ${fields._authToken}`;
+    if (fields._auth !== undefined)
+        return `Basic ${fields._auth}`;
+    if (fields.username !== undefined && decodedPassword !== undefined)
+        return encodeBasic(fields.username, decodedPassword);
+    return undefined;
+}
+function decodeUserinfo(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function userinfoAuthorization(registry, secrets) {
+    let parsed;
+    try {
+        parsed = new URL(registry);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.username === '')
+        return undefined;
+    const password = decodeUserinfo(parsed.password);
+    secrets.add(password);
+    const path = parsed.pathname.endsWith('/') ? parsed.pathname : `${parsed.pathname}/`;
+    return { prefix: `//${parsed.host}${path}`, authorization: encodeBasic(decodeUserinfo(parsed.username), password) };
+}
+function addUnscopedSecrets(entries, secrets) {
+    for (const { key, value } of entries) {
+        const field = UNSCOPED_SECRET_FIELDS.find((candidate) => candidate === key);
+        if (field !== undefined && value !== '')
+            addFieldSecrets({ [field]: value }, secrets);
+    }
+}
+function collectFields(entries, fieldsByPrefix) {
+    for (const { key, value } of entries) {
+        const credentialKey = splitCredentialKey(key);
+        if (credentialKey === undefined)
+            continue;
+        if (value === '')
+            continue;
+        const fields = fieldsByPrefix.get(credentialKey.prefix) ?? {};
+        fields[credentialKey.field] = value;
+        fieldsByPrefix.set(credentialKey.prefix, fields);
+    }
+}
+function registryValues(entries, env) {
+    const fromEntries = entries
+        .filter(({ key }) => key === 'registry' || SCOPED_REGISTRY_KEY.test(key))
+        .map(({ value }) => value);
+    const fromEnv = npmConfigEnv(env, 'registry');
+    return fromEnv === undefined ? fromEntries : [...fromEntries, fromEnv];
+}
+function candidatePrefixes(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return [];
+    }
+    if (!WEB_PROTOCOLS.includes(parsed.protocol) || !parsed.pathname.startsWith('/'))
+        return [];
+    const rootPrefix = `//${parsed.host}/`;
+    const candidates = [`//${parsed.host}${parsed.pathname}`];
+    let current = candidates[0];
+    while (current !== rootPrefix) {
+        const withoutTrailingSlash = current.endsWith('/') ? current.slice(0, -1) : current;
+        current = withoutTrailingSlash.slice(0, withoutTrailingSlash.lastIndexOf('/') + 1);
+        candidates.push(current);
+    }
+    return candidates;
+}
+export function readRegistryCredentials(sources, secrets) {
+    const entries = [
+        ...parseNpmrcEntries(sources.userNpmrc ?? '', sources.env),
+        ...parseNpmrcEntries(sources.projectNpmrc ?? '', sources.env),
+    ];
+    addUnscopedSecrets(entries, secrets);
+    const fieldsByPrefix = new Map();
+    collectFields(entries, fieldsByPrefix);
+    const authorizationByPrefix = new Map();
+    for (const registry of registryValues(entries, sources.env)) {
+        const fromUserinfo = userinfoAuthorization(registry, secrets);
+        if (fromUserinfo !== undefined)
+            authorizationByPrefix.set(fromUserinfo.prefix, fromUserinfo.authorization);
+    }
+    for (const [prefix, fields] of fieldsByPrefix) {
+        const authorization = authorizationFromFields(fields, secrets);
+        if (authorization !== undefined)
+            authorizationByPrefix.set(prefix, authorization);
+    }
+    return {
+        authorizationFor: (url) => {
+            for (const candidate of candidatePrefixes(url)) {
+                const authorization = authorizationByPrefix.get(candidate);
+                if (authorization !== undefined)
+                    return authorization;
+            }
+            return undefined;
+        },
+    };
+}

package/dist/enrich/enrichment-cache.js

@@ -0,0 +1,42 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+export const ENRICHMENT_CACHE_FORMAT = 1;
+export const ENRICHMENT_TTL_MS = 43_200_000;
+const KEY_SEPARATOR = '\0';
+const DIRECTORY_SEGMENTS_BY_KIND = {
+    registry: ['registry'],
+    'osv-matches': ['osv', 'matches'],
+    'osv-packages': ['osv', 'packages'],
+    'registry-versions': ['registry-versions'],
+};
+export function createEnrichmentCache(dir) {
+    const directoryOf = (kind) => path.join(dir, ...DIRECTORY_SEGMENTS_BY_KIND[kind]);
+    const fileOf = (kind, keyParts) => {
+        const hash = createHash('sha256')
+            .update([String(ENRICHMENT_CACHE_FORMAT), ...keyParts].join(KEY_SEPARATOR))
+            .digest('hex');
+        return path.join(directoryOf(kind), `${hash}.json`);
+    };
+    return {
+        async read(kind, keyParts) {
+            try {
+                return JSON.parse(await readFile(fileOf(kind, keyParts), 'utf8'));
+            }
+            catch {
+                return null;
+            }
+        },
+        async write(kind, keyParts, value) {
+            await mkdir(directoryOf(kind), { recursive: true });
+            const file = fileOf(kind, keyParts);
+            const temporaryFile = `${file}.${randomUUID()}.tmp`;
+            await writeFile(temporaryFile, JSON.stringify(value));
+            await rename(temporaryFile, file);
+        },
+    };
+}
+export function isFresh(fetchedAt, now, ttlMs = ENRICHMENT_TTL_MS) {
+    const fetchedAtMs = Date.parse(fetchedAt);
+    return Number.isFinite(fetchedAtMs) && now - fetchedAtMs < ttlMs;
+}

package/dist/enrich/enrichment-keys.js

@@ -0,0 +1,71 @@
+import semver from 'semver';
+import { PLACEHOLDER_PREFIX } from "../model.js";
+import { versionKey } from "./osv-client.js";
+const KEY_SEPARATOR = '\0';
+export function isTrackable(root) {
+    return root.status === 'ready' && root.config !== undefined;
+}
+export function isPlaceholder(node) {
+    return node.id.startsWith(PLACEHOLDER_PREFIX);
+}
+export function isRegistryPackage(node) {
+    return node.nonRegistry !== true && !isPlaceholder(node);
+}
+function scopeOf(name) {
+    const slash = name.indexOf('/');
+    return name.startsWith('@') && slash > 0 ? name.slice(0, slash) : undefined;
+}
+export function inPrivateScope(name, privateScopes) {
+    const scope = scopeOf(name);
+    return scope !== undefined && privateScopes.has(scope);
+}
+export function hasKnownVersion(version) {
+    return semver.valid(version) !== null;
+}
+export function registryUrlOf(config, name) {
+    const scope = scopeOf(name);
+    const configured = (scope === undefined ? undefined : config.scopedRegistries[scope]) ?? config.registry;
+    return configured.endsWith('/') ? configured : `${configured}/`;
+}
+export function registryKeyOf(registryUrl, name) {
+    return `${registryUrl}${KEY_SEPARATOR}${name}`;
+}
+function addRegistryTarget(registry, root, node) {
+    const registryUrl = registryUrlOf(root.config, node.name);
+    const key = registryKeyOf(registryUrl, node.name);
+    const existing = registry.get(key);
+    if (existing !== undefined) {
+        existing.versionsInUse.add(node.version);
+        return;
+    }
+    registry.set(key, { key, registryUrl, name: node.name, versionsInUse: new Set([node.version]), credentialsRoot: root });
+}
+export function planKeys(roots, privateScopesSoFar) {
+    const trackable = roots.filter(isTrackable);
+    const privateScopes = new Set([...privateScopesSoFar, ...trackable.flatMap((root) => Object.keys(root.config.scopedRegistries))]);
+    const registry = new Map();
+    const versions = new Map();
+    const skipped = new Set();
+    for (const root of trackable) {
+        for (const node of root.packages.values()) {
+            if (!isRegistryPackage(node))
+                continue;
+            addRegistryTarget(registry, root, node);
+            const key = versionKey(node.name, node.version);
+            if (versions.has(key) || skipped.has(key))
+                continue;
+            if (inPrivateScope(node.name, privateScopes) || !hasKnownVersion(node.version))
+                skipped.add(key);
+            else
+                versions.set(key, { key, name: node.name, version: node.version });
+        }
+    }
+    return {
+        roots: trackable,
+        registry,
+        versions,
+        skippedVersions: skipped.size,
+        privateScopes,
+        waitsForScanningRoots: roots.some((root) => root.status === 'scanning'),
+    };
+}