@neuxnet/neux-cli 0.2.3

package/src/core/proxy-security.js

@@ -0,0 +1,141 @@
+import dns from 'node:dns'
+import net from 'node:net'
+
+const blockedAddresses = new net.BlockList()
+
+for (const [address, prefix] of [
+	['0.0.0.0', 8],
+	['10.0.0.0', 8],
+	['100.64.0.0', 10],
+	['127.0.0.0', 8],
+	['169.254.0.0', 16],
+	['172.16.0.0', 12],
+	['192.0.0.0', 24],
+	['192.0.2.0', 24],
+	['192.168.0.0', 16],
+	['198.18.0.0', 15],
+	['198.51.100.0', 24],
+	['203.0.113.0', 24],
+	['224.0.0.0', 4],
+	['240.0.0.0', 4],
+]) {
+	blockedAddresses.addSubnet(address, prefix, 'ipv4')
+}
+
+for (const [address, prefix] of [
+	['::', 128],
+	['::1', 128],
+	['64:ff9b:1::', 48],
+	['100::', 64],
+	['2001:db8::', 32],
+	['fc00::', 7],
+	['fe80::', 10],
+	['ff00::', 8],
+]) {
+	blockedAddresses.addSubnet(address, prefix, 'ipv6')
+}
+
+const BLOCKED_REQUEST_HEADERS = new Set([
+	'connection', 'content-length', 'forwarded', 'host', 'origin',
+	'proxy-authenticate', 'proxy-authorization', 'referer', 'te',
+	'trailer', 'transfer-encoding', 'upgrade', 'via',
+])
+
+function unsafeTargetError(message) {
+	const error = new Error(message)
+	error.code = 'DIMINA_UNSAFE_TARGET'
+	return error
+}
+
+function normalizeHostname(hostname) {
+	const value = hostname.startsWith('[') && hostname.endsWith(']')
+		? hostname.slice(1, -1)
+		: hostname
+	return value.replace(/\.$/, '').toLowerCase()
+}
+
+export function isPublicAddress(address) {
+	if (address.toLowerCase().startsWith('::ffff:')) return false
+	const family = net.isIP(address)
+	return family !== 0 && !blockedAddresses.check(address, family === 4 ? 'ipv4' : 'ipv6')
+}
+
+function assertPublicAddresses(addresses) {
+	if (!Array.isArray(addresses) || addresses.length === 0) {
+		throw unsafeTargetError('Target hostname did not resolve')
+	}
+	for (const entry of addresses) {
+		if (!isPublicAddress(entry.address)) {
+			throw unsafeTargetError('Requests to private or reserved networks are not allowed')
+		}
+	}
+}
+
+export async function assertSafeTarget(rawUrl, lookup = dns.promises.lookup) {
+	if (typeof rawUrl !== 'string' || rawUrl.trim() === '') {
+		throw unsafeTargetError('URL is required')
+	}
+
+	let target
+	try {
+		target = new URL(rawUrl)
+	}
+	catch {
+		throw unsafeTargetError('Invalid URL')
+	}
+	if (!['http:', 'https:'].includes(target.protocol)) {
+		throw unsafeTargetError('Only HTTP and HTTPS URLs are allowed')
+	}
+	if (target.username || target.password) {
+		throw unsafeTargetError('Credentials in target URLs are not allowed')
+	}
+
+	const hostname = normalizeHostname(target.hostname)
+	const family = net.isIP(hostname)
+	const addresses = family
+		? [{ address: hostname, family }]
+		: await lookup(hostname, { all: true, verbatim: true })
+	assertPublicAddresses(addresses)
+	return target
+}
+
+export function createSafeLookup(lookup = dns.lookup) {
+	return (hostname, options, callback) => {
+		const normalizedOptions = typeof options === 'number' ? { family: options } : { ...(options ?? {}) }
+		lookup(hostname, { ...normalizedOptions, all: true, verbatim: true }, (error, addresses) => {
+			if (error) return callback(error)
+			try {
+				assertPublicAddresses(addresses)
+			}
+			catch (validationError) {
+				return callback(validationError)
+			}
+			if (normalizedOptions.all) return callback(null, addresses)
+			const [{ address, family }] = addresses
+			return callback(null, address, family)
+		})
+	}
+}
+
+export function isAllowedBrowserOrigin(origin, configuredOrigins = '') {
+	if (!origin) return true
+	const explicitOrigins = new Set(String(configuredOrigins).split(',').map(value => value.trim()).filter(Boolean))
+	if (explicitOrigins.has(origin)) return true
+	try {
+		const parsed = new URL(origin)
+		const hostname = normalizeHostname(parsed.hostname)
+		return ['http:', 'https:'].includes(parsed.protocol)
+			&& ['localhost', '127.0.0.1', '::1'].includes(hostname)
+	}
+	catch {
+		return false
+	}
+}
+
+export function sanitizeRequestHeaders(headers) {
+	if (!headers || typeof headers !== 'object' || Array.isArray(headers)) return {}
+	return Object.fromEntries(Object.entries(headers).filter(([name]) => {
+		const normalizedName = name.toLowerCase()
+		return !BLOCKED_REQUEST_HEADERS.has(normalizedName) && !normalizedName.startsWith('proxy-')
+	}))
+}

package/src/core/proxy.js

@@ -0,0 +1,156 @@
+import http from 'node:http'
+import https from 'node:https'
+import { assertSafeTarget, createSafeLookup, isAllowedBrowserOrigin, sanitizeRequestHeaders } from './proxy-security.js'
+
+const MAX_REQUEST_BODY_BYTES = 1024 * 1024
+const MAX_RESPONSE_BODY_BYTES = 10 * 1024 * 1024
+const ALLOWED_METHODS = new Set(['GET', 'POST', 'PUT', 'DELETE', 'PATCH'])
+const ALLOWED_RESPONSE_TYPES = new Set(['json', 'text', 'arraybuffer'])
+
+function writeJson(res, statusCode, body) {
+	res.writeHead(statusCode, {
+		'Content-Type': 'application/json; charset=utf-8',
+		'Cache-Control': 'no-store',
+	})
+	res.end(JSON.stringify(body))
+}
+
+function setCorsHeaders(res, origin, allowedOrigins) {
+	if (!origin || !isAllowedBrowserOrigin(origin, allowedOrigins)) return false
+	if (origin) res.setHeader('Access-Control-Allow-Origin', origin)
+	res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS')
+	res.setHeader('Access-Control-Allow-Headers', 'Content-Type')
+	res.setHeader('Vary', 'Origin')
+	return true
+}
+
+async function readBody(req) {
+	const chunks = []
+	let size = 0
+	for await (const chunk of req) {
+		size += chunk.length
+		if (size > MAX_REQUEST_BODY_BYTES) {
+			const error = new Error('Request body is too large')
+			error.code = 'DIMINA_PROXY_REQUEST_TOO_LARGE'
+			throw error
+		}
+		chunks.push(chunk)
+	}
+	if (chunks.length === 0) return {}
+	try {
+		return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+	}
+	catch {
+		const error = new Error('Request body must be valid JSON')
+		error.code = 'DIMINA_PROXY_INVALID_JSON'
+		throw error
+	}
+}
+
+function requestTarget(target, options) {
+	return new Promise((resolve, reject) => {
+		const transport = target.protocol === 'https:' ? https : http
+		const request = transport.request(target, {
+			method: options.method,
+			headers: options.headers,
+			agent: target.protocol === 'https:' ? options.httpsAgent : options.httpAgent,
+			timeout: options.timeout,
+			lookup: options.lookup,
+		}, response => {
+			const chunks = []
+			let size = 0
+			response.on('data', chunk => {
+				size += chunk.length
+				if (size > MAX_RESPONSE_BODY_BYTES) {
+					request.destroy(Object.assign(new Error('Response body is too large'), {
+						code: 'DIMINA_PROXY_RESPONSE_TOO_LARGE',
+					}))
+					return
+				}
+				chunks.push(chunk)
+			})
+			response.on('end', () => resolve({
+				statusCode: response.statusCode || 502,
+				headers: response.headers,
+				body: Buffer.concat(chunks),
+			}))
+		})
+		request.on('timeout', () => request.destroy(Object.assign(new Error('Proxy request timed out'), {
+			code: 'DIMINA_PROXY_TIMEOUT',
+		})))
+		request.on('error', reject)
+		if (options.body) request.write(options.body)
+		request.end()
+	})
+}
+
+function parseTimeout(value) {
+	const parsed = Number.parseInt(value, 10)
+	return Number.isFinite(parsed) ? Math.min(Math.max(parsed, 1), 30000) : 30000
+}
+
+export function createProxyHandler({
+	allowedOrigins = process.env.DIMINA_PROXY_ALLOWED_ORIGINS,
+	lookup = createSafeLookup(),
+	assertTarget = assertSafeTarget,
+	httpAgent = new http.Agent({ lookup }),
+	httpsAgent = new https.Agent({ lookup }),
+} = {}) {
+	return async function handleProxy(req, res) {
+		const origin = req.headers.origin
+		if (!setCorsHeaders(res, origin, allowedOrigins)) {
+			writeJson(res, 403, { error: 'Browser origin is not allowed' })
+			return
+		}
+		if (req.method === 'OPTIONS') {
+			res.writeHead(204)
+			res.end()
+			return
+		}
+		if (req.method !== 'POST') {
+			writeJson(res, 405, { error: 'Proxy only accepts POST requests' })
+			return
+		}
+
+		try {
+			const { url, data, header = {}, timeout = 30000, method = 'GET', responseType = 'json' } = await readBody(req)
+			const normalizedMethod = String(method).toUpperCase()
+			if (!ALLOWED_METHODS.has(normalizedMethod)) return writeJson(res, 400, { error: 'Invalid HTTP method' })
+			if (!ALLOWED_RESPONSE_TYPES.has(responseType)) return writeJson(res, 400, { error: 'Invalid response type' })
+
+			const target = await assertTarget(url)
+			if (normalizedMethod === 'GET' && data && typeof data === 'object') {
+				for (const [key, value] of Object.entries(data)) {
+					if (value !== undefined && value !== null) target.searchParams.set(key, String(value))
+				}
+			}
+			const body = normalizedMethod === 'GET' ? null : JSON.stringify(data ?? {})
+			const response = await requestTarget(target, {
+				method: normalizedMethod,
+				headers: {
+					'Content-Type': 'application/json',
+					...(body ? { 'Content-Length': Buffer.byteLength(body) } : {}),
+					...sanitizeRequestHeaders(header),
+				},
+				body,
+				timeout: parseTimeout(timeout),
+				lookup,
+				httpAgent,
+				httpsAgent,
+			})
+
+			const contentType = response.headers['content-type']
+				|| (responseType === 'json' ? 'application/json' : responseType === 'text' ? 'text/plain; charset=utf-8' : 'application/octet-stream')
+			res.writeHead(response.statusCode, { 'Content-Type': contentType, 'Cache-Control': 'no-store' })
+			res.end(response.body)
+		}
+		catch (error) {
+			const statusCode = error.code === 'DIMINA_UNSAFE_TARGET' ? 403
+				: error.code === 'DIMINA_PROXY_INVALID_JSON' || error.code === 'DIMINA_PROXY_REQUEST_TOO_LARGE' ? 400
+					: error.code === 'DIMINA_PROXY_RESPONSE_TOO_LARGE' ? 502
+						: error.code === 'DIMINA_PROXY_TIMEOUT' ? 504
+							: 502
+			writeJson(res, statusCode, { error: error.message || 'Proxy request failed', status: statusCode })
+		}
+	}
+}

package/src/core/qr.js

@@ -0,0 +1,41 @@
+export function createPreviewLaunchParams(options = {}) {
+  return {
+    pagePath: options.pagePath || options.page_path || options.miniappPath || options.miniapp_path,
+    query: options.query || options.miniappQuery || options.miniapp_query,
+    scene: options.scene || options.miniappScene || options.miniapp_scene,
+    launchFrom: options.launchFrom || options.launch_from || options.miniappLaunchFrom || options.miniapp_launch_from,
+    location: options.location || options.miniappLocation || options.miniapp_location,
+  }
+}
+
+export function createDebugPreviewDeepLink({ appId, name, download, version, ...launchOptions }) {
+  const launchParams = createPreviewLaunchParams(launchOptions)
+  const params = new URLSearchParams({
+    appId: String(appId || ''),
+    name: String(name || ''),
+    download: String(download || ''),
+    appVerType: '1',
+    version: String(version || ''),
+  })
+  for (const [key, value] of Object.entries(launchParams)) {
+    if (value !== undefined && value !== null && value !== '') params.set(key, String(value))
+  }
+  return `neuminiapp://miniapp/?${params.toString()}`
+}
+
+export function createLocalPreviewDeepLink({ appId, download, version, ...launchOptions }) {
+  return createDebugPreviewDeepLink({
+    appId,
+    name: appId,
+    download,
+    version,
+    ...launchOptions,
+  })
+}
+
+export function createQrPayloadResult(payload) {
+  return {
+    qrPayload: payload,
+    deepLink: payload,
+  }
+}

package/src/core/terminal-qr.js

@@ -0,0 +1,72 @@
+import QRCode from 'qrcode'
+
+const DEFAULT_QR_OPTIONS = Object.freeze({
+  errorCorrectionLevel: 'M',
+  margin: 4,
+})
+
+const DEFAULT_PNG_OPTIONS = Object.freeze({
+  type: 'png',
+  ...DEFAULT_QR_OPTIONS,
+  scale: 8,
+  color: {
+    dark: '#000000ff',
+    light: '#ffffffff',
+  },
+})
+
+const ANSI_BLACK_FOREGROUND = 30
+const ANSI_WHITE_FOREGROUND = 97
+const ANSI_BLACK_BACKGROUND = 40
+const ANSI_WHITE_BACKGROUND = 107
+const ANSI_RESET = '\u001B[0m'
+const UPPER_HALF_BLOCK = '\u2580'
+
+function terminalCellStyle(topDark, bottomDark) {
+  const foreground = topDark ? ANSI_BLACK_FOREGROUND : ANSI_WHITE_FOREGROUND
+  const background = bottomDark ? ANSI_BLACK_BACKGROUND : ANSI_WHITE_BACKGROUND
+  return `\u001B[${foreground};${background}m`
+}
+
+export function renderTerminalQr(payload, options = {}) {
+  const margin = Number.isInteger(options.margin) && options.margin >= 0
+    ? options.margin
+    : DEFAULT_QR_OPTIONS.margin
+  const qr = QRCode.create(String(payload || ''), {
+    errorCorrectionLevel: options.errorCorrectionLevel || DEFAULT_QR_OPTIONS.errorCorrectionLevel,
+  })
+  const lines = []
+
+  const isDark = (row, column) => row >= 0
+    && row < qr.modules.size
+    && column >= 0
+    && column < qr.modules.size
+    && qr.modules.get(row, column) === 1
+
+  for (let row = -margin; row < qr.modules.size + margin; row += 2) {
+    let activeStyle = ''
+    let line = ''
+    for (let column = -margin; column < qr.modules.size + margin; column += 1) {
+      const style = terminalCellStyle(isDark(row, column), isDark(row + 1, column))
+      if (style !== activeStyle) {
+        line += style
+        activeStyle = style
+      }
+      line += UPPER_HALF_BLOCK
+    }
+    lines.push(`${line}${ANSI_RESET}`)
+  }
+
+  return `${lines.join('\n')}\n`
+}
+
+export function renderQrPng(payload, options = {}) {
+  return QRCode.toBuffer(String(payload || ''), {
+    ...DEFAULT_PNG_OPTIONS,
+    ...options,
+    color: {
+      ...DEFAULT_PNG_OPTIONS.color,
+      ...options.color,
+    },
+  })
+}

package/src/core/update.js

@@ -0,0 +1,278 @@
+import http from 'node:http'
+import https from 'node:https'
+import { spawnSync } from 'node:child_process'
+import { DiminaCliError } from './errors.js'
+import { brand } from './brand.js'
+import { getCliPackageInfo, getCliVersion } from './package-info.js'
+
+const DEFAULT_REGISTRY = 'https://registry.npmjs.org'
+const AUTO_UPDATE_VALUES = new Set(['1', 'true', 'yes', 'on'])
+
+export async function checkCliUpdate(options = {}) {
+  const result = await createCliUpdateCheck(options)
+  return toPublicCheckResult(result)
+}
+
+export async function updateCli(options = {}) {
+  const check = await createCliUpdateCheck(options)
+  const publicCheck = toPublicCheckResult(check)
+  if (options.check || options.dryRun || !check.updateAvailable) {
+    return {
+      ...publicCheck,
+      installed: false,
+      reason: check.updateAvailable ? 'check-only' : 'already-current',
+    }
+  }
+
+  const target = `${check.packageName}@${check.latestVersion}`
+  const npmArgs = ['install', '-g', target]
+  if (shouldPassRegistryToInstall(check.registrySource)) {
+    npmArgs.push('--registry', check.registry)
+  }
+  const npmCommand = resolveNpmCommand(options)
+  const install = options.install || defaultInstall
+  const installResult = await install(npmCommand, npmArgs, options)
+  if (installResult.status !== 0) {
+    throw new DiminaCliError('NEUX_CLI_UPDATE_FAILED', `Failed to update ${check.packageName} to ${check.latestVersion}`, {
+      packageName: check.packageName,
+      version: check.latestVersion,
+      npmCommand,
+      npmArgs,
+      status: installResult.status,
+      stderr: installResult.stderr,
+    })
+  }
+
+  return {
+    ...publicCheck,
+    installed: true,
+    target,
+    npmCommand,
+    npmArgs,
+  }
+}
+
+async function createCliUpdateCheck(options = {}) {
+  const packageName = options.packageName || brand.packageName
+  const currentVersion = options.currentVersion || await getCliVersion()
+  const { registry, registrySource } = await resolveRegistry(packageName, options)
+  const latest = await fetchLatestPackageInfo(packageName, registry, options)
+  const latestVersion = latest.version
+  const updateAvailable = compareVersions(latestVersion, currentVersion) > 0
+
+  return {
+    ok: true,
+    command: 'update',
+    packageName,
+    registry,
+    registrySource,
+    currentVersion,
+    latestVersion,
+    updateAvailable,
+    latest,
+  }
+}
+
+export async function maybeAutoUpdateCli(options = {}) {
+  if (!isAutoUpdateEnabled(options)) return null
+  return await updateCli({
+    ...options,
+    auto: true,
+  })
+}
+
+export function isAutoUpdateEnabled(options = {}) {
+  if (options.autoUpdate === false || options.no_auto_update) return false
+  if (options.autoUpdate === true || options.auto_update === true) return true
+  return AUTO_UPDATE_VALUES.has(String(process.env.NEUX_CLI_AUTO_UPDATE || '').trim().toLowerCase())
+}
+
+function normalizeRegistry(value) {
+  return String(value || DEFAULT_REGISTRY).trim().replace(/\/+$/, '')
+}
+
+export { getCliPackageInfo, getCliVersion }
+
+function resolveNpmCommand(options = {}) {
+  return options.npmCommand || process.env.NEUX_CLI_NPM || 'npm'
+}
+
+async function resolveRegistry(packageName, options = {}) {
+  if (options.registry) {
+    return {
+      registry: normalizeRegistry(options.registry),
+      registrySource: 'explicit',
+    }
+  }
+  if (process.env.NEUX_CLI_REGISTRY) {
+    return {
+      registry: normalizeRegistry(process.env.NEUX_CLI_REGISTRY),
+      registrySource: 'env',
+    }
+  }
+
+  const configured = await resolveRegistryFromNpmConfig(packageName, options)
+  if (configured) return configured
+
+  return {
+    registry: DEFAULT_REGISTRY,
+    registrySource: 'default',
+  }
+}
+
+async function resolveRegistryFromNpmConfig(packageName, options = {}) {
+  const getNpmConfig = options.getNpmConfig || getNpmConfigValue
+  const scope = packageName.startsWith('@') ? packageName.split('/')[0] : ''
+  if (scope) {
+    const scopeRegistry = await getNpmConfig(`${scope}:registry`, options)
+    if (isConfiguredRegistry(scopeRegistry)) {
+      return {
+        registry: normalizeRegistry(scopeRegistry),
+        registrySource: 'npm-scope',
+      }
+    }
+  }
+
+  const registry = await getNpmConfig('registry', options)
+  if (isConfiguredRegistry(registry)) {
+    return {
+      registry: normalizeRegistry(registry),
+      registrySource: 'npm',
+    }
+  }
+
+  return null
+}
+
+async function getNpmConfigValue(key, options = {}) {
+  const result = spawnSync(resolveNpmCommand(options), ['config', 'get', key], {
+    cwd: options.cwd || process.cwd(),
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  if (result.error || result.status !== 0) return null
+  return result.stdout.trim()
+}
+
+function isConfiguredRegistry(value) {
+  if (!value) return false
+  const normalized = String(value).trim()
+  return normalized !== '' && normalized !== 'undefined' && normalized !== 'null'
+}
+
+function shouldPassRegistryToInstall(registrySource) {
+  return registrySource !== 'npm-scope'
+}
+
+function toPublicCheckResult(result) {
+  const { registrySource, ...publicResult } = result
+  return publicResult
+}
+
+async function fetchLatestPackageInfo(packageName, registry, options = {}) {
+  if (options.fetchLatest) return await options.fetchLatest(packageName, registry)
+  const encoded = packageName.startsWith('@')
+    ? `@${encodeURIComponent(packageName.slice(1))}`
+    : encodeURIComponent(packageName)
+  const latestUrl = `${registry}/${encoded}/latest`
+  try {
+    const payload = await fetchJson(latestUrl, options)
+    if (!payload?.version) {
+      throw new DiminaCliError('NEUX_CLI_UPDATE_METADATA_INVALID', `Registry latest metadata is missing version for ${packageName}`, {
+        packageName,
+        registry,
+        url: latestUrl,
+      })
+    }
+    return payload
+  }
+  catch (error) {
+    if (!shouldFallbackToPackageDocument(error)) throw error
+  }
+
+  const packageUrl = `${registry}/${encoded}`
+  const payload = await fetchJson(packageUrl, options)
+  const latestVersion = payload?.['dist-tags']?.latest
+  const latest = latestVersion && payload?.versions?.[latestVersion]
+  if (!latestVersion || !latest?.version) {
+    throw new DiminaCliError('NEUX_CLI_UPDATE_METADATA_INVALID', `Registry package metadata is missing dist-tags.latest for ${packageName}`, {
+      packageName,
+      registry,
+      url: packageUrl,
+    })
+  }
+  return latest
+}
+
+function shouldFallbackToPackageDocument(error) {
+  return error instanceof DiminaCliError
+    && error.code === 'NEUX_CLI_UPDATE_METADATA_FAILED'
+    && (error.details?.statusCode === 400 || error.details?.statusCode === 404)
+}
+
+function fetchJson(url, options = {}) {
+  return new Promise((resolve, reject) => {
+    const client = url.startsWith('http://') ? http : https
+    const request = client.get(url, {
+      timeout: Number.parseInt(options.timeout || process.env.NEUX_CLI_UPDATE_TIMEOUT || 10000, 10),
+      headers: {
+        'Accept': 'application/json',
+        'User-Agent': `${brand.packageName}`,
+      },
+    }, (response) => {
+      const chunks = []
+      response.on('data', chunk => chunks.push(chunk))
+      response.on('end', () => {
+        const body = Buffer.concat(chunks).toString('utf8')
+        if (response.statusCode < 200 || response.statusCode >= 300) {
+          reject(new DiminaCliError('NEUX_CLI_UPDATE_METADATA_FAILED', `Failed to fetch CLI update metadata: HTTP ${response.statusCode}`, {
+            url,
+            statusCode: response.statusCode,
+            body,
+          }))
+          return
+        }
+        try {
+          resolve(JSON.parse(body))
+        }
+        catch (error) {
+          reject(new DiminaCliError('NEUX_CLI_UPDATE_METADATA_INVALID', `Failed to parse CLI update metadata: ${error.message}`, {
+            url,
+          }))
+        }
+      })
+    })
+    request.on('timeout', () => request.destroy(new Error('update metadata request timed out')))
+    request.on('error', reject)
+  })
+}
+
+function defaultInstall(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    stdio: options.silent ? 'pipe' : 'inherit',
+    encoding: 'utf8',
+  })
+  return {
+    status: result.status,
+    stderr: result.stderr,
+  }
+}
+
+function compareVersions(left, right) {
+  const a = parseVersion(left)
+  const b = parseVersion(right)
+  for (let i = 0; i < 3; i++) {
+    if (a.core[i] !== b.core[i]) return a.core[i] > b.core[i] ? 1 : -1
+  }
+  if (a.pre === b.pre) return 0
+  if (!a.pre) return 1
+  if (!b.pre) return -1
+  return a.pre > b.pre ? 1 : a.pre < b.pre ? -1 : 0
+}
+
+function parseVersion(value) {
+  const [coreValue, pre = ''] = String(value || '0.0.0').split('-', 2)
+  const core = coreValue.split('.').map(part => Number.parseInt(part, 10) || 0)
+  while (core.length < 3) core.push(0)
+  return { core: core.slice(0, 3), pre }
+}