@thomasminh1995/depverdict 0.6.0-alpha.1

package/src/detectors.js

@@ -0,0 +1,253 @@
+import path from 'node:path';
+
+import {
+  duplicateDependencyWarnings,
+  sortDependencies,
+  summarizeDependencies
+} from './dependencies.js';
+import { readJson, readText, relativePath } from './files.js';
+import { parseRequirementsTxt } from './python-requirements.js';
+
+const DEFINITIONS = [
+  { ecosystem: 'node', languages: ['JavaScript', 'TypeScript'], names: ['package.json'] },
+  { ecosystem: 'python', languages: ['Python'], names: ['pyproject.toml', 'requirements.txt'] },
+  { ecosystem: 'java', languages: ['Java', 'Kotlin'], names: ['pom.xml', 'build.gradle', 'build.gradle.kts', 'settings.gradle', 'settings.gradle.kts'] },
+  { ecosystem: 'dotnet', languages: ['C#', 'F#', 'Visual Basic'], extensions: ['.csproj', '.fsproj', '.vbproj', '.sln'] },
+  { ecosystem: 'go', languages: ['Go'], names: ['go.mod'] },
+  { ecosystem: 'rust', languages: ['Rust'], names: ['Cargo.toml'] },
+  { ecosystem: 'ruby', languages: ['Ruby'], names: ['Gemfile'] },
+  { ecosystem: 'php', languages: ['PHP'], names: ['composer.json'] },
+  { ecosystem: 'al', languages: ['AL'], names: ['app.json'] }
+];
+
+export function definitionForFile(filePath) {
+  const name = path.basename(filePath);
+  return DEFINITIONS.find((definition) =>
+    definition.names?.includes(name) || definition.extensions?.some((extension) => name.endsWith(extension))
+  );
+}
+
+function firstMatch(text, expressions) {
+  for (const expression of expressions) {
+    const value = text.match(expression)?.[1]?.trim();
+    if (value) return value;
+  }
+  return undefined;
+}
+
+function packageManagerFromNode(data, fileNames) {
+  if (typeof data.packageManager === 'string') {
+    const [name, ...versionParts] = data.packageManager.split('@');
+    return { name, ...(versionParts.length ? { version: versionParts.join('@') } : {}) };
+  }
+  if (fileNames.has('pnpm-lock.yaml')) return { name: 'pnpm' };
+  if (fileNames.has('yarn.lock')) return { name: 'yarn' };
+  if (fileNames.has('bun.lock') || fileNames.has('bun.lockb')) return { name: 'bun' };
+  if (fileNames.has('package-lock.json') || fileNames.has('npm-shrinkwrap.json')) return { name: 'npm' };
+  return undefined;
+}
+
+const NODE_DEPENDENCY_SECTIONS = [
+  ['dependencies', 'dependency'],
+  ['devDependencies', 'devDependency'],
+  ['peerDependencies', 'peerDependency'],
+  ['optionalDependencies', 'optionalDependency']
+];
+
+function parseNodeDependencies(data, manifest) {
+  const dependencies = [];
+  const byType = {
+    dependencies: 0,
+    devDependencies: 0,
+    peerDependencies: 0,
+    optionalDependencies: 0
+  };
+  let invalid = false;
+
+  for (const [section, type] of NODE_DEPENDENCY_SECTIONS) {
+    const declarations = data[section];
+    if (declarations === undefined) continue;
+    if (!declarations || typeof declarations !== 'object' || Array.isArray(declarations)) {
+      invalid = true;
+      continue;
+    }
+    for (const [name, declaredVersion] of Object.entries(declarations)) {
+      if (typeof declaredVersion !== 'string') {
+        invalid = true;
+        continue;
+      }
+      byType[section] += 1;
+      dependencies.push({
+        name,
+        normalizedName: name.toLowerCase(),
+        declaredVersion,
+        type,
+        manifest
+      });
+    }
+  }
+
+  if (invalid) {
+    return {
+      dependencySummary: { status: 'failed' },
+      dependencies: [],
+      warnings: [{
+        code: 'DEPENDENCY_PARSE_FAILED',
+        path: manifest,
+        message: 'Unable to parse dependency declarations in package.json.'
+      }]
+    };
+  }
+
+  const sortedDependencies = sortDependencies(dependencies);
+  return {
+    dependencySummary: summarizeDependencies(sortedDependencies, byType),
+    dependencies: sortedDependencies,
+    warnings: duplicateDependencyWarnings(sortedDependencies, manifest)
+  };
+}
+
+async function nodeMetadata(root, files, directoryEntries) {
+  const packageFile = files.find((file) => path.basename(file) === 'package.json');
+  if (!packageFile) return {};
+  const data = await readJson(packageFile);
+  const workspaces = Array.isArray(data.workspaces) ? data.workspaces : data.workspaces?.packages;
+  const dependencyMetadata = parseNodeDependencies(data, relativePath(root, packageFile));
+  return {
+    name: typeof data.name === 'string' ? data.name : undefined,
+    version: typeof data.version === 'string' ? data.version : undefined,
+    private: typeof data.private === 'boolean' ? data.private : undefined,
+    packageManager: packageManagerFromNode(data, directoryEntries),
+    ...dependencyMetadata,
+    workspacePatterns: Array.isArray(workspaces) ? workspaces.filter((item) => typeof item === 'string') : []
+  };
+}
+
+async function pythonMetadata(root, files) {
+  const fallbackName = path.basename(path.dirname(files[0]));
+  const pyprojectFile = files.find((file) => path.basename(file) === 'pyproject.toml');
+  const requirementsFile = files.find((file) => path.basename(file) === 'requirements.txt');
+  const warnings = [];
+  let name = fallbackName;
+
+  if (pyprojectFile) {
+    try {
+      const contents = await readText(pyprojectFile);
+      name = firstMatch(contents, [/^\s*name\s*=\s*["']([^"']+)["']/m]) ?? fallbackName;
+    } catch (error) {
+      warnings.push({
+        code: 'MANIFEST_UNREADABLE',
+        path: relativePath(root, pyprojectFile),
+        message: `Unable to read manifest (${error.code ?? 'unknown error'})`
+      });
+    }
+  }
+
+  if (!requirementsFile) {
+    return { name, dependencySummary: { status: 'unsupported' }, dependencies: [], warnings };
+  }
+
+  try {
+    const parsed = parseRequirementsTxt(await readText(requirementsFile));
+    if (parsed.issues.length > 0) {
+      const lines = parsed.issues.map((issue) => issue.line).join(', ');
+      warnings.push({
+        code: 'DEPENDENCY_PARSE_FAILED',
+        path: relativePath(root, requirementsFile),
+        message: `Unable to parse ${parsed.issues.length} requirement line(s): ${lines}`
+      });
+      return { name, dependencySummary: { status: 'failed' }, dependencies: [], warnings };
+    }
+    const manifest = relativePath(root, requirementsFile);
+    const dependencies = sortDependencies(parsed.dependencies.map((dependencyRecord) => ({
+      ...dependencyRecord,
+      manifest
+    })));
+    warnings.push(...duplicateDependencyWarnings(dependencies, manifest));
+    return {
+      name,
+      dependencySummary: summarizeDependencies(dependencies),
+      dependencies,
+      warnings
+    };
+  } catch (error) {
+    warnings.push({
+      code: 'DEPENDENCY_PARSE_FAILED',
+      path: relativePath(root, requirementsFile),
+      message: `Unable to read or parse requirements (${error.code ?? 'unknown error'})`
+    });
+    return { name, dependencySummary: { status: 'failed' }, dependencies: [], warnings };
+  }
+}
+
+async function alMetadata(files) {
+  const data = await readJson(files[0]);
+  const looksLikeAl = typeof data.id === 'string' && typeof data.name === 'string' && typeof data.publisher === 'string';
+  if (!looksLikeAl) return { skip: true };
+  return {
+    name: data.name,
+    version: typeof data.version === 'string' ? data.version : undefined
+  };
+}
+
+async function jsonMetadata(files, ecosystem) {
+  const data = await readJson(files[0]);
+  if (ecosystem === 'php') {
+    return {
+      name: typeof data.name === 'string' ? data.name : undefined,
+      version: typeof data.version === 'string' ? data.version : undefined
+    };
+  }
+  return {};
+}
+
+async function textMetadata(files, ecosystem) {
+  const contents = await Promise.all(files.map(readText));
+  const text = contents.join('\n');
+  const fallbackName = path.basename(path.dirname(files[0]));
+
+  switch (ecosystem) {
+    case 'java':
+      return { name: firstMatch(text, [/<artifactId>([^<]+)<\/artifactId>/, /rootProject\.name\s*=\s*["']([^"']+)["']/]) ?? fallbackName };
+    case 'dotnet':
+      return { name: firstMatch(text, [/<AssemblyName>([^<]+)<\/AssemblyName>/, /<RootNamespace>([^<]+)<\/RootNamespace>/]) ?? path.parse(files[0]).name };
+    case 'go':
+      return { name: firstMatch(text, [/^module\s+(.+)$/m]) ?? fallbackName };
+    case 'rust':
+      return { name: firstMatch(text, [/^\s*name\s*=\s*["']([^"']+)["']/m]), version: firstMatch(text, [/^\s*version\s*=\s*["']([^"']+)["']/m]) };
+    default:
+      return { name: fallbackName };
+  }
+}
+
+export async function inspectProjectGroup(root, group, directoryEntries) {
+  const { definition, directory, files } = group;
+  let metadata;
+
+  if (definition.ecosystem === 'node') metadata = await nodeMetadata(root, files, directoryEntries);
+  else if (definition.ecosystem === 'python') metadata = await pythonMetadata(root, files);
+  else if (definition.ecosystem === 'al') metadata = await alMetadata(files);
+  else if (definition.ecosystem === 'php') metadata = await jsonMetadata(files, definition.ecosystem);
+  else metadata = await textMetadata(files, definition.ecosystem);
+
+  if (metadata.skip) return undefined;
+  const projectPath = relativePath(root, directory);
+  const manifests = files.map((file) => relativePath(root, file)).sort();
+  const name = metadata.name || path.basename(directory);
+
+  const project = {
+    id: `${definition.ecosystem}:${projectPath}`,
+    name,
+    path: projectPath,
+    ecosystem: definition.ecosystem,
+    languages: definition.languages,
+    manifests,
+    ...(metadata.version ? { version: metadata.version } : {}),
+    ...(metadata.private !== undefined ? { private: metadata.private } : {}),
+    ...(metadata.packageManager ? { packageManager: metadata.packageManager } : {}),
+    dependencySummary: metadata.dependencySummary ?? { status: 'unsupported' },
+    dependencies: metadata.dependencies ?? [],
+    _workspacePatterns: metadata.workspacePatterns ?? []
+  };
+  return { project, warnings: metadata.warnings ?? [] };
+}

package/src/discovery.js

@@ -0,0 +1,234 @@
+import { readdir, readFile, realpath, stat } from 'node:fs/promises';
+import path from 'node:path';
+
+import {
+  MANIFEST_SCHEMA_VERSION,
+  ARTIFACT_GENERATOR_NAME,
+  VERSION
+} from './constants.js';
+import { createCooperativeScheduler } from './cooperative-scheduler.js';
+import { definitionForFile, inspectProjectGroup } from './detectors.js';
+import { collectCandidateFiles, relativePath } from './files.js';
+import { attachInstalledVersionBaselines } from './installed-version-baseline.js';
+
+async function assertDirectory(inputPath) {
+  const absolutePath = path.resolve(inputPath);
+  let details;
+  try {
+    details = await stat(absolutePath);
+  } catch (error) {
+    throw new Error(`Cannot access project root "${inputPath}": ${error.message}`);
+  }
+  if (!details.isDirectory()) throw new Error(`Project root is not a directory: ${inputPath}`);
+  return realpath(absolutePath);
+}
+
+async function directoryEntryNames(directory) {
+  try {
+    return new Set(await readdir(directory));
+  } catch {
+    return new Set();
+  }
+}
+
+function groupCandidateFiles(files) {
+  const groups = new Map();
+  for (const file of files) {
+    const definition = definitionForFile(file);
+    if (!definition) continue;
+    const directory = path.dirname(file);
+    const key = `${definition.ecosystem}\0${directory}`;
+    if (!groups.has(key)) groups.set(key, { definition, directory, files: [] });
+    groups.get(key).files.push(file);
+  }
+  return [...groups.values()].map((group) => ({ ...group, files: group.files.sort() }));
+}
+
+function globToRegExp(pattern) {
+  const normalized = pattern.replace(/^\.\//, '').replace(/\/$/, '');
+  let expression = '^';
+  for (let index = 0; index < normalized.length; index += 1) {
+    const character = normalized[index];
+    if (character === '*' && normalized[index + 1] === '*') {
+      expression += '.*';
+      index += 1;
+    } else if (character === '*') expression += '[^/]*';
+    else if (character === '?') expression += '[^/]';
+    else expression += character.replace(/[|\\{}()[\]^$+?.]/g, '\\$&');
+  }
+  return new RegExp(`${expression}$`);
+}
+
+function matchesWorkspace(patterns, projectPath) {
+  const positive = patterns.filter((pattern) => !pattern.startsWith('!'));
+  const negative = patterns.filter((pattern) => pattern.startsWith('!')).map((pattern) => pattern.slice(1));
+  return positive.some((pattern) => globToRegExp(pattern).test(projectPath))
+    && !negative.some((pattern) => globToRegExp(pattern).test(projectPath));
+}
+
+function parsePnpmWorkspace(contents) {
+  const patterns = [];
+  let inPackages = false;
+  for (const line of contents.split(/\r?\n/)) {
+    if (/^packages:\s*(?:#.*)?$/.test(line)) {
+      inPackages = true;
+      continue;
+    }
+    if (inPackages && /^\S/.test(line)) break;
+    if (!inPackages) continue;
+    const pattern = line.match(/^\s*-\s*(['"]?)(.+?)\1\s*(?:#.*)?$/)?.[2]?.trim();
+    if (pattern) patterns.push(pattern);
+  }
+  return patterns;
+}
+
+async function addPnpmWorkspacePatterns(root, files, projects, warnings, cooperativeScheduler) {
+  for (const file of files.filter((candidate) => path.basename(candidate) === 'pnpm-workspace.yaml')) {
+    try {
+      const projectPath = relativePath(root, path.dirname(file));
+      const project = projects.find((candidate) => candidate.ecosystem === 'node' && candidate.path === projectPath);
+      if (!project) continue;
+      try {
+        const patterns = parsePnpmWorkspace(await readFile(file, 'utf8'));
+        project._workspacePatterns = [...new Set([...project._workspacePatterns, ...patterns])];
+      } catch (error) {
+        warnings.push({
+          code: 'MANIFEST_UNREADABLE',
+          path: relativePath(root, file),
+          message: `Unable to read workspace manifest (${error.code ?? 'unknown error'})`
+        });
+      }
+    } finally {
+      await cooperativeScheduler.boundary();
+    }
+  }
+}
+
+async function addWorkspaceRelationships(projects, cooperativeScheduler) {
+  const roots = projects
+    .filter((project) => project.ecosystem === 'node' && project._workspacePatterns.some((pattern) => !pattern.startsWith('!')))
+    .sort((left, right) => right.path.length - left.path.length);
+
+  for (const project of projects) {
+    try {
+      if (project.ecosystem !== 'node') continue;
+      const workspaceRoot = roots.find((candidate) => {
+        if (candidate.id === project.id) return false;
+        const relative = path.posix.relative(candidate.path === '.' ? '' : candidate.path, project.path);
+        return matchesWorkspace(candidate._workspacePatterns, relative);
+      });
+      if (workspaceRoot) {
+        project.workspace = { root: workspaceRoot.path, role: 'member' };
+        if (!project.packageManager && workspaceRoot.packageManager) {
+          project.packageManager = { ...workspaceRoot.packageManager };
+        }
+      } else if (project._workspacePatterns.some((pattern) => !pattern.startsWith('!'))) {
+        project.workspace = { root: project.path, role: 'root' };
+      }
+    } finally {
+      await cooperativeScheduler.boundary();
+    }
+  }
+
+  for (const project of projects) {
+    delete project._workspacePatterns;
+    await cooperativeScheduler.boundary();
+  }
+}
+
+async function gitMetadata(root) {
+  const gitPath = path.join(root, '.git');
+  let gitDirectory = gitPath;
+  try {
+    const details = await stat(gitPath);
+    if (details.isFile()) {
+      const pointer = await readFile(gitPath, 'utf8');
+      const target = pointer.match(/^gitdir:\s*(.+)$/m)?.[1];
+      if (!target) return undefined;
+      gitDirectory = path.resolve(root, target);
+    }
+    const head = (await readFile(path.join(gitDirectory, 'HEAD'), 'utf8')).trim();
+    const branch = head.startsWith('ref: refs/heads/') ? head.slice('ref: refs/heads/'.length) : undefined;
+    return { type: 'git', ...(branch ? { branch } : {}) };
+  } catch {
+    return undefined;
+  }
+}
+
+function summarize(projects) {
+  const ecosystems = {};
+  for (const project of projects) ecosystems[project.ecosystem] = (ecosystems[project.ecosystem] ?? 0) + 1;
+  return {
+    projectCount: projects.length,
+    ecosystems: Object.fromEntries(Object.entries(ecosystems).sort(([left], [right]) => left.localeCompare(right))),
+    workspaceCount: projects.filter((project) => project.workspace?.role === 'root').length
+  };
+}
+
+function warningFor(error, root, group) {
+  const firstFile = group.files[0];
+  const isSyntax = error instanceof SyntaxError;
+  return {
+    code: isSyntax ? 'MANIFEST_INVALID' : 'MANIFEST_UNREADABLE',
+    path: relativePath(root, firstFile),
+    message: isSyntax ? error.message : `Unable to read manifest (${error.code ?? 'unknown error'})`
+  };
+}
+
+export async function discoverProject(inputPath = '.', options = {}) {
+  const cooperativeScheduler = options.cooperativeScheduler ?? createCooperativeScheduler({
+    signal: options.signal,
+    enabled: options.cooperativeScheduling !== false,
+    batchSize: options.cooperativeBatchSize,
+    maxIntervalMs: options.cooperativeMaxIntervalMs,
+    monotonicClock: options.monotonicClock
+  });
+  cooperativeScheduler.checkpoint();
+  const root = await assertDirectory(inputPath);
+  const { files, warnings } = await collectCandidateFiles(root, {
+    maxDepth: options.maxDepth,
+    cooperativeScheduler
+  });
+  const projects = [];
+
+  for (const group of groupCandidateFiles(files)) {
+    try {
+      const entries = await directoryEntryNames(group.directory);
+      const result = await inspectProjectGroup(root, group, entries);
+      if (result) {
+        projects.push(result.project);
+        warnings.push(...result.warnings);
+      }
+    } catch (error) {
+      warnings.push(warningFor(error, root, group));
+    } finally {
+      await cooperativeScheduler.boundary();
+    }
+  }
+
+  projects.sort((left, right) => left.id.localeCompare(right.id));
+  await addPnpmWorkspacePatterns(root, files, projects, warnings, cooperativeScheduler);
+  await addWorkspaceRelationships(projects, cooperativeScheduler);
+  await attachInstalledVersionBaselines(root, projects, {
+    ...options,
+    cooperativeScheduler
+  });
+  warnings.sort((left, right) => left.path.localeCompare(right.path) || left.code.localeCompare(right.code));
+
+  cooperativeScheduler.checkpoint();
+  const now = options.clock?.() ?? new Date();
+  const vcs = await gitMetadata(root);
+  return {
+    schemaVersion: MANIFEST_SCHEMA_VERSION,
+    generatedAt: now.toISOString(),
+    generator: { name: ARTIFACT_GENERATOR_NAME, version: VERSION },
+    repository: {
+      name: path.basename(root),
+      root: '.',
+      ...(vcs ? { vcs } : {})
+    },
+    summary: summarize(projects),
+    projects,
+    warnings
+  };
+}