@veda-hq/pariksha 0.5.13 → 0.5.17

package/dist/pnpm-settings.js

@@ -0,0 +1,350 @@
+// pnpm-settings: pnpm settings live where pnpm reads them, and took effect.
+//
+// pnpm 11 stopped reading the `pnpm` field of package.json, silently
+// (pnpm/pnpm#11536): an `overrides` or `patchedDependencies` left there gives
+// a green install in which every security pin has reverted and every patch
+// has stopped applying. A green install proves nothing, so this reads the
+// evidence out of the resolved lockfile:
+//
+//   1. package.json carries no pnpm setting pnpm 11 ignores;
+//   2. every override in pnpm-workspace.yaml is in the lockfile, and back;
+//   3. every patch is in the lockfile and back, its file exists, and its
+//      sha256 is the one the lockfile records;
+//   4. no resolved version sits inside a range an override excludes (or, for
+//      a bare-name override, outside the range it forces);
+//   5. every `minimumReleaseAgeExclude` entry is an exact version the lockfile
+//      still resolves, under a comment that says why and `EXPIRES:` when, and
+//      that expiry has not passed. The config's own scopes are standing
+//      entries, exempt.
+//
+// Version ranges are read by semver-range.ts: a form it does not read (`^`,
+// `~`, `1.x`, a hyphen range) is reported as unchecked, never passed.
+// pnpm 12 writes the lockfile as two YAML documents, the package manager's
+// first: the last one with content is the project's.
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { CORE_SCHEMA, load, loadAll } from 'js-yaml';
+import { satisfies, validRange, validVersion } from "./semver-range.js";
+export const DEFAULT_PNPM_CONFIG = { id: 'pnpm-settings', ownScopes: [] };
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+/** `{ "id"?: "<label>", "ownScopes"?: ["@scope/*", …] }`; absent keys take the defaults, anything else throws. */
+export const parsePnpmConfig = (text) => {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (e) {
+        throw new Error(`not JSON: ${e.message}`);
+    }
+    if (!isRecord(raw))
+        throw new Error('the config must be a JSON object');
+    const unknown = Object.keys(raw).find((k) => k !== 'id' && k !== 'ownScopes');
+    if (unknown !== undefined)
+        throw new Error(`unknown key "${unknown}"`);
+    // Absent takes the default; a present `null` is refused like any other wrong value.
+    const id = 'id' in raw ? raw['id'] : DEFAULT_PNPM_CONFIG.id;
+    if (typeof id !== 'string' || id.trim() === '')
+        throw new Error('"id" must be a non-empty string');
+    const ownScopes = 'ownScopes' in raw ? raw['ownScopes'] : [];
+    if (!Array.isArray(ownScopes) || ownScopes.some((s) => typeof s !== 'string' || s === ''))
+        throw new Error('"ownScopes" must be a list of entries');
+    return { id, ownScopes: ownScopes };
+};
+/** pnpm 11 reads none of these from package.json. Leaving one there disarms it. */
+export const IGNORED_IN_V11 = [
+    'overrides',
+    'patchedDependencies',
+    'auditConfig',
+    'onlyBuiltDependencies',
+    'onlyBuiltDependenciesFile',
+    'neverBuiltDependencies',
+    'ignoredBuiltDependencies',
+    'ignoreDepScripts',
+    'packageExtensions',
+    'peerDependencyRules',
+    'allowedDeprecatedVersions',
+    'updateConfig',
+    'allowBuilds',
+];
+/** A lockfile key as name and version, split on the last `@` (scoped names hold one too). */
+export const splitNameVersion = (key) => {
+    const at = key.lastIndexOf('@');
+    if (at <= 0)
+        return null;
+    return { name: key.slice(0, at), version: key.slice(at + 1) };
+};
+/** The project document: the last one with content. Every document must still parse. */
+const projectDocument = (text) => {
+    const filled = loadAll(text, null, { schema: CORE_SCHEMA }).filter((value) => value !== null && value !== undefined);
+    return (filled.at(-1) ?? {});
+};
+/** What the lockfile records: overrides, patches (pnpm 10's `{ hash, path }` or pnpm 11's bare hash) and resolved versions. */
+export const readLockfileFacts = (text) => {
+    const doc = projectDocument(text);
+    const resolvedVersions = new Map();
+    for (const key of Object.keys(doc.packages ?? {})) {
+        const parsed = splitNameVersion(key);
+        if (!parsed)
+            continue;
+        resolvedVersions.set(parsed.name, [...(resolvedVersions.get(parsed.name) ?? []), parsed.version]);
+    }
+    const patchedDependencies = {};
+    for (const [key, entry] of Object.entries(doc.patchedDependencies ?? {})) {
+        // String(), not a typeof check: an all-digit hash parses as a number.
+        patchedDependencies[key] = entry !== null && typeof entry === 'object' ? { ...entry } : { hash: String(entry) };
+    }
+    return { overrides: doc.overrides ?? {}, patchedDependencies, resolvedVersions };
+};
+/**
+ * The comment block right above `minimumReleaseAgeExclude:`, the decision
+ * record YAML parsing drops. A blank line or a setting ends it, so a comment
+ * on another key is never read as this one's.
+ */
+export const releaseAgeExclusionComment = (workspaceText) => {
+    const lines = workspaceText.split('\n');
+    const at = lines.findIndex((line) => /^minimumReleaseAgeExclude\s*:/.test(line));
+    if (at === -1)
+        return '';
+    const collected = [];
+    for (let i = at - 1; i >= 0; i--) {
+        const line = (lines[i] ?? '').trim();
+        if (!line.startsWith('#'))
+            break;
+        collected.unshift(line.replace(/^#\s?/, ''));
+    }
+    return collected.join('\n');
+};
+/** A date, optionally a UTC time: `2026-09-02`, `2026-09-02T18:54Z`, `2026-09-02T18:54:00.000Z`. */
+const ISO_8601_DATE = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d+)?)?Z)?$/;
+/**
+ * `EXPIRES: <ISO-8601>` from a line that opens with it (a mention mid-sentence
+ * records nothing), its trailing punctuation dropped. A value that is not an
+ * ISO-8601 date, or names a day its month lacks, is invalid.
+ */
+export const parseExclusionExpiry = (comment) => {
+    const match = /^[ \t]*EXPIRES[ \t]*:[ \t]*(\S*)/im.exec(comment);
+    if (match === null)
+        return { kind: 'absent' };
+    const raw = (match[1] ?? '').replace(/[.,;:]+$/, '');
+    const at = new Date(raw);
+    if (!ISO_8601_DATE.test(raw) || Number.isNaN(at.getTime()) || at.toISOString().slice(0, 10) !== raw.slice(0, 10))
+        return { kind: 'invalid', raw };
+    return { kind: 'at', at, raw };
+};
+/** An override or exclusion selector as name and range: `tar@<=7.5.20`, `@babel/core@>=7 <8`; a bare name targets `*`. */
+export const parseSelector = (selector) => {
+    const at = selector.lastIndexOf('@');
+    if (at <= 0)
+        return { name: selector, range: '*' };
+    return { name: selector.slice(0, at), range: selector.slice(at + 1) };
+};
+/** Check 5: cooling-off exceptions are scoped to one version, still resolved, documented and unexpired. */
+export const checkReleaseAgeExclusions = (workspaceText, declared, lock, ownScopes, now) => {
+    const failures = [];
+    if (declared === undefined || declared === null)
+        return { failures, count: 0 };
+    if (!Array.isArray(declared)) {
+        return {
+            failures: [
+                `minimumReleaseAgeExclude must be a list of \`name@version\` strings, but it is ` +
+                    `\`${typeof declared}\`. pnpm cannot apply it in this shape, so the exception it ` +
+                    `was meant to record is not in force either.`,
+            ],
+            count: 0,
+        };
+    }
+    const exceptions = declared.filter((entry) => !(typeof entry === 'string' && ownScopes.includes(entry)));
+    // An empty list is the post-expiry steady state, not something to document.
+    if (exceptions.length === 0)
+        return { failures, count: 0 };
+    const comment = releaseAgeExclusionComment(workspaceText);
+    if (comment === '') {
+        failures.push(`minimumReleaseAgeExclude declares ${exceptions.length} cooling-off exception(s) with no ` +
+            `comment above the block. pnpm writes entries here on its own when ` +
+            `minimumReleaseAgeStrict is false, so an undocumented entry is a supply-chain ` +
+            `exception nobody took. Record why it was taken, what took it, and when it expires.`);
+    }
+    else {
+        const expiry = parseExclusionExpiry(comment);
+        if (expiry.kind === 'absent') {
+            failures.push(`the comment above minimumReleaseAgeExclude does not say when the exception expires. ` +
+                `Add an \`EXPIRES: <YYYY-MM-DD…>\` line — an exception with no end date is a ` +
+                `permanent hole in the cooling-off.`);
+        }
+        else if (expiry.kind === 'invalid') {
+            failures.push(`the EXPIRES value above minimumReleaseAgeExclude (\`${expiry.raw}\`) is not a date this ` +
+                `check can read, so the expiry cannot be enforced and the exception is open-ended in ` +
+                `practice. Write an ISO-8601 UTC instant, e.g. \`EXPIRES: 2026-09-02T18:54Z\`.`);
+        }
+        else if (expiry.at.getTime() <= now) {
+            failures.push(`the minimumReleaseAgeExclude exception expired at ${expiry.at.toISOString()} and is ` +
+                `still in force for ${exceptions.map((e) => `\`${String(e)}\``).join(', ')}. ` +
+                `The pinned versions have aged past minimumReleaseAge, so pnpm will not re-add them: ` +
+                `exception expired; delete the entries.`);
+        }
+    }
+    for (const entry of exceptions) {
+        if (typeof entry !== 'string') {
+            failures.push(`minimumReleaseAgeExclude entry \`${String(entry)}\` is not a string, so pnpm cannot ` + `match it against a package.`);
+            continue;
+        }
+        const { name, range } = parseSelector(entry);
+        if (!validVersion(range)) {
+            failures.push(`minimumReleaseAgeExclude entry \`${entry}\` is not pinned to an exact version. ` +
+                `Scoped this way it exempts versions nobody has reviewed from the cooling-off — ` +
+                `write \`${name}@<exact version>\`.`);
+            continue;
+        }
+        const resolved = lock.resolvedVersions.get(name) ?? [];
+        // Peer-suffixed keys, `1.2.3(react@19.0.0)`: the base version counts.
+        if (!resolved.some((version) => version.split('(')[0] === range)) {
+            failures.push(`minimumReleaseAgeExclude entry \`${entry}\` is stale: the lockfile no longer resolves ` +
+                `${name}@${range}. The exception has outlived the pin it was taken for — delete the line.`);
+        }
+    }
+    return { failures, count: exceptions.length };
+};
+const stopped = (failures, notes) => ({ failures, notes, overrideCount: 0, patchCount: 0, versionsChecked: 0, releaseAgeExclusionCount: 0 });
+/** Every check on the repository at `root`; `now` decides whether an expiry has passed. */
+export const checkPnpmSettings = (root, config, now = Date.now()) => {
+    const failures = [];
+    const notes = [];
+    const pkgPath = join(root, 'package.json');
+    const wsPath = join(root, 'pnpm-workspace.yaml');
+    const lockPath = join(root, 'pnpm-lock.yaml');
+    for (const p of [pkgPath, wsPath, lockPath]) {
+        // Fail closed: a missing input is not a pass.
+        if (!existsSync(p))
+            return stopped([`required file missing: ${p}`], notes);
+    }
+    // 1. package.json carries no setting pnpm 11 ignores.
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+    const stranded = IGNORED_IN_V11.filter((k) => pkg.pnpm?.[k] !== undefined);
+    if (stranded.length > 0) {
+        failures.push(`package.json#pnpm still declares ${stranded.map((s) => `\`${s}\``).join(', ')}. ` +
+            `pnpm 11 does not read these and will not warn. Move them to pnpm-workspace.yaml. ` +
+            `See https://github.com/pnpm/pnpm/issues/11536`);
+    }
+    let ws;
+    let wsText;
+    try {
+        wsText = readFileSync(wsPath, 'utf8');
+        ws = (load(wsText, { schema: CORE_SCHEMA }) ?? {});
+    }
+    catch (error) {
+        failures.push(`pnpm-workspace.yaml is not valid YAML, so no setting in it is being applied: ${String(error)}`);
+        return stopped(failures, notes);
+    }
+    let lock;
+    try {
+        lock = readLockfileFacts(readFileSync(lockPath, 'utf8'));
+    }
+    catch (error) {
+        failures.push(`pnpm-lock.yaml could not be parsed, so override and patch parity cannot be verified: ${String(error)}`);
+        return stopped(failures, notes);
+    }
+    // 2. Override parity, workspace and lockfile.
+    const declared = ws.overrides ?? {};
+    const declaredKeys = Object.keys(declared);
+    const lockedKeys = Object.keys(lock.overrides);
+    if (declaredKeys.length > 0 && lockedKeys.length === 0) {
+        failures.push(`pnpm-workspace.yaml declares ${declaredKeys.length} overrides but pnpm-lock.yaml records none. ` +
+            `This is the signature of pnpm ignoring the settings source entirely. ` +
+            `Re-run \`pnpm install --lockfile-only\` and confirm the lockfile's overrides: block is populated.`);
+    }
+    for (const [selector, target] of Object.entries(declared)) {
+        if (!(selector in lock.overrides)) {
+            failures.push(`override \`${selector}\` is declared in pnpm-workspace.yaml but absent from the lockfile.`);
+        }
+        else if (lock.overrides[selector] !== target) {
+            failures.push(`override \`${selector}\` disagrees: workspace says \`${target}\`, lockfile says \`${lock.overrides[selector]}\`.`);
+        }
+    }
+    for (const selector of lockedKeys) {
+        if (!(selector in declared))
+            failures.push(`override \`${selector}\` is in the lockfile but no longer declared in pnpm-workspace.yaml.`);
+    }
+    // 3. Patch parity, and the patch files exist and are the ones applied.
+    const declaredPatches = ws.patchedDependencies ?? {};
+    for (const [key, patchPath] of Object.entries(declaredPatches)) {
+        const record = lock.patchedDependencies[key];
+        if (!(key in lock.patchedDependencies) || record === undefined) {
+            failures.push(`patch \`${key}\` is declared in pnpm-workspace.yaml but absent from the lockfile — it is not being applied.`);
+            continue;
+        }
+        // pnpm 10 recorded a path, pnpm 11 only the hash: compare a path only when there is one.
+        if (record.path !== undefined && record.path !== patchPath) {
+            failures.push(`patch \`${key}\` path disagrees: workspace says \`${patchPath}\`, lockfile says \`${record.path}\`.`);
+        }
+        const absolutePatch = join(root, patchPath);
+        if (!existsSync(absolutePatch)) {
+            failures.push(`patch file for \`${key}\` does not exist on disk: ${patchPath}`);
+            continue;
+        }
+        if (record.hash !== undefined) {
+            const actual = createHash('sha256').update(readFileSync(absolutePatch)).digest('hex');
+            if (actual !== record.hash) {
+                failures.push(`patch \`${key}\` content does not match the lockfile: ${patchPath} hashes to ` +
+                    `${actual.slice(0, 16)}… but the lockfile recorded ${record.hash.slice(0, 16)}…. ` +
+                    `Re-run \`pnpm patch-commit\` so the applied patch and the committed file agree.`);
+            }
+        }
+    }
+    for (const key of Object.keys(lock.patchedDependencies)) {
+        if (!(key in declaredPatches))
+            failures.push(`patch \`${key}\` is in the lockfile but no longer declared in pnpm-workspace.yaml.`);
+    }
+    // 4. Each override took effect on every resolved version. `tar@<=7.5.20`
+    // names the vulnerable range, so no resolved version may be inside it;
+    // bare `tar` forces every version to its target, which each must satisfy.
+    let versionsChecked = 0;
+    for (const selector of declaredKeys) {
+        const { name, range } = parseSelector(selector);
+        const resolved = lock.resolvedVersions.get(name);
+        if (!resolved || resolved.length === 0)
+            continue;
+        const isBareName = !selector.slice(1).includes('@');
+        const assertion = isBareName ? declared[selector] : range;
+        if (!validRange(assertion)) {
+            notes.push(`override \`${selector}\` has no parseable semver range (\`${assertion}\`); ` + `version compliance not checked.`);
+            continue;
+        }
+        for (const version of resolved) {
+            const base = version.split('(')[0] ?? '';
+            if (!validRange(base))
+                continue;
+            versionsChecked++;
+            const inAssertedRange = satisfies(base, assertion);
+            if (isBareName && !inAssertedRange) {
+                failures.push(`override \`${selector}\` did not take effect: ${name}@${base} is resolved, ` + `but the override forces every version to \`${assertion}\`.`);
+            }
+            else if (!isBareName && inAssertedRange) {
+                failures.push(`override \`${selector}\` did not take effect: ${name}@${base} is still resolved, ` + `and it falls inside the excluded range \`${assertion}\`.`);
+            }
+        }
+    }
+    // 5. Cooling-off exceptions are scoped, live and decided.
+    const exclusions = checkReleaseAgeExclusions(wsText, ws.minimumReleaseAgeExclude, lock, config.ownScopes, now);
+    failures.push(...exclusions.failures);
+    return { failures, notes, overrideCount: declaredKeys.length, patchCount: Object.keys(declaredPatches).length, versionsChecked, releaseAgeExclusionCount: exclusions.count };
+};
+/** The report as the original printed it: notes and failures on stderr, the clean line on stdout. */
+export const formatParity = (report, id) => {
+    const err = [];
+    if (report.notes.length > 0) {
+        err.push(`⚠️  ${id}: ${report.notes.length} selector(s) not version-checked:`, ...report.notes.map((n) => `   - ${n}`));
+    }
+    if (report.failures.length > 0) {
+        err.push(`\n❌ ${id}: pnpm settings parity FAILED (${report.failures.length} problem(s))\n`, ...report.failures.map((f) => ` • ${f}\n`));
+        err.push('A successful `pnpm install` is not evidence here — pnpm 11 drops these settings without warning.\n');
+        return { ok: false, out: [], err };
+    }
+    const extra = `${report.releaseAgeExclusionCount > 0 ? `, ${report.releaseAgeExclusionCount} documented cooling-off exception(s)` : ''}` +
+        `${report.notes.length > 0 ? `, ${report.notes.length} selector(s) unchecked` : ''}`;
+    return {
+        ok: true,
+        out: [`✅ ${id}: pnpm settings parity OK — ${report.overrideCount} override(s), ${report.patchCount} patch(es), ${report.versionsChecked} resolved version(s) verified${extra}.`],
+        err,
+    };
+};

package/dist/semver-range.js

@@ -0,0 +1,320 @@
+// Ported from semver 7.8.1 (npm `semver`, https://github.com/npm/node-semver,
+// ISC licence): `classes/range.js` (Range, parseComparator, replaceCarets,
+// replaceTildes, replaceXRanges, replaceStars, replaceGTE0, hyphenReplace,
+// testSet), with the parts of `classes/comparator.js`, `classes/semver.js`,
+// `internal/re.js`, `internal/identifiers.js` and `internal/constants.js` it
+// uses. 7.8.1 is the version the replaced check ran on; later releases changed
+// tilde and caret lower bounds under includePrerelease, so this is not to be
+// "updated" to them without the check's owner. Its licence:
+//
+// The ISC License
+//
+// Copyright (c) Isaac Z. Schlueter and Contributors
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+// WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+// MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+// ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+// IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+//
+// A semver range matcher: the part of the `semver` package (strict mode)
+// that pnpm-settings needs, `satisfies` with `includePrerelease: true`,
+// `validRange` and `valid`, ported step for step so it reads every range the
+// way `semver` does.
+//
+// A range is comparator sets joined by `||` (any set matches), each set
+// comparators joined by spaces (every one matches). Before testing, `semver`
+// rewrites the sugar into plain comparators, and so does this: hyphen ranges
+// (`1.2.3 - 2.3`), carets (`^1.2.3`), tildes (`~1.2.3`, `~>1.2`), partial and
+// x-range versions (`1`, `1.2`, `1.x`, `<8`, `>=0.9`), and stars (`*`).
+// Build metadata is ignored. With includePrerelease a prerelease is just a
+// version that sorts before its release, so `7.5.20-beta.1` is inside
+// `<=7.5.20`, and a partial lower bound starts at `-0` (`>=1.2` is
+// `>=1.2.0-0`).
+//
+// Not read: `semver`'s loose mode, which pnpm-settings never asks for.
+/** semver's MAX_LENGTH: a longer version string is not one. */
+const MAX_LENGTH = 256;
+const MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6;
+const LETTER_DASH_NUMBER = '[a-zA-Z0-9-]';
+/** semver's makeSafeRegex: bounds its greedy repeats, which changes what a long input matches. */
+const bounded = (source) => {
+    let out = source;
+    for (const [token, max] of [['\\s', 1], ['\\d', MAX_LENGTH], [LETTER_DASH_NUMBER, MAX_SAFE_BUILD_LENGTH]]) {
+        out = out.split(`${token}*`).join(`${token}{0,${max}}`).split(`${token}+`).join(`${token}{1,${max}}`);
+    }
+    return out;
+};
+const re = (source, flags) => new RegExp(bounded(source), flags);
+const NUMERIC = '0|[1-9]\\d*';
+const NUMERIC_LOOSE = '\\d+';
+const NON_NUMERIC = `\\d*[a-zA-Z-]${LETTER_DASH_NUMBER}*`;
+const MAIN = `(${NUMERIC})\\.(${NUMERIC})\\.(${NUMERIC})`;
+const MAIN_LOOSE = `(${NUMERIC_LOOSE})\\.(${NUMERIC_LOOSE})\\.(${NUMERIC_LOOSE})`;
+const PRERELEASE_ID = `(?:${NON_NUMERIC}|${NUMERIC})`;
+const PRERELEASE_ID_LOOSE = `(?:${NON_NUMERIC}|${NUMERIC_LOOSE})`;
+const PRERELEASE = `(?:-(${PRERELEASE_ID}(?:\\.${PRERELEASE_ID})*))`;
+const PRERELEASE_LOOSE = `(?:-?(${PRERELEASE_ID_LOOSE}(?:\\.${PRERELEASE_ID_LOOSE})*))`;
+const BUILD_ID = `${LETTER_DASH_NUMBER}+`;
+const BUILD = `(?:\\+(${BUILD_ID}(?:\\.${BUILD_ID})*))`;
+const FULL_PLAIN = `v?${MAIN}${PRERELEASE}?${BUILD}?`;
+const LOOSE_PLAIN = `[v=\\s]*${MAIN_LOOSE}${PRERELEASE_LOOSE}?${BUILD}?`;
+const GTLT = '((?:<|>)?=?)';
+const X_ID = `${NUMERIC}|x|X|\\*`;
+const X_PLAIN = `[v=\\s]*(${X_ID})(?:\\.(${X_ID})(?:\\.(${X_ID})(?:${PRERELEASE})?${BUILD}?)?)?`;
+/** A version, as `new SemVer` reads one (after trimming). */
+const FULL = re(`^${FULL_PLAIN}$`);
+/** Build metadata anywhere in a set: `semver` strips it, with the unbounded pattern, before anything else. */
+const BUILD_STRIP = new RegExp(BUILD, 'g');
+const BUILD_ONE = re(BUILD);
+const HYPHEN_RANGE = re(`^\\s*(${X_PLAIN})\\s+-\\s+(${X_PLAIN})\\s*$`);
+/** `> 1.2.3` is `>1.2.3`. */
+const COMPARATOR_TRIM = re(`(\\s*)${GTLT}\\s*(${LOOSE_PLAIN}|${X_PLAIN})`, 'g');
+const TILDE_TRIM = re('(\\s*)(?:~>?)\\s+', 'g');
+const CARET_TRIM = re('(\\s*)(?:\\^)\\s+', 'g');
+const TILDE = re(`^(?:~>?)${X_PLAIN}$`);
+const CARET = re(`^(?:\\^)${X_PLAIN}$`);
+const X_RANGE = re(`^${GTLT}\\s*${X_PLAIN}$`);
+const STAR = re('(<|>)?=?\\s*\\*');
+/** `>=0.0.0-0` is every version, so `semver` drops it. */
+const GTE0_PRERELEASE = re('^\\s*>=\\s*0\\.0\\.0-0\\s*$');
+const COMPARATOR = re(`^${GTLT}\\s*(${FULL_PLAIN})$|^$`);
+/** A full version, or undefined; trimmed first, as `semver` does. */
+export const parseVersion = (text) => {
+    if (typeof text !== 'string' || text.length > MAX_LENGTH)
+        return undefined;
+    const m = FULL.exec(text.trim());
+    if (m === null)
+        return undefined;
+    const main = [Number(m[1]), Number(m[2]), Number(m[3])];
+    if (main.some((n) => n > Number.MAX_SAFE_INTEGER))
+        return undefined;
+    return { main, prerelease: m[4] === undefined ? [] : m[4].split('.') };
+};
+/** `semver.valid`: whether `text` is a full version. */
+export const validVersion = (text) => parseVersion(text) !== undefined;
+const NUMERIC_ID = /^[0-9]+$/;
+/** semver's compareIdentifiers: numbers numerically and before words, words in ASCII order. */
+export const compareIdentifiers = (a, b) => {
+    const aNum = NUMERIC_ID.test(a);
+    const bNum = NUMERIC_ID.test(b);
+    if (aNum && bNum) {
+        const [x, y] = [Number(a), Number(b)];
+        return x === y ? 0 : x < y ? -1 : 1;
+    }
+    if (a === b)
+        return 0;
+    if (aNum)
+        return -1;
+    if (bNum)
+        return 1;
+    return a < b ? -1 : 1;
+};
+/** Semver precedence; build metadata plays no part. */
+export const compareVersions = (a, b) => {
+    for (let i = 0; i < 3; i++) {
+        const c = compareIdentifiers(String(a.main[i]), String(b.main[i]));
+        if (c !== 0)
+            return c;
+    }
+    if (a.prerelease.length > 0 && b.prerelease.length === 0)
+        return -1;
+    if (a.prerelease.length === 0 && b.prerelease.length > 0)
+        return 1;
+    for (let i = 0;; i++) {
+        const x = a.prerelease[i];
+        const y = b.prerelease[i];
+        if (x === undefined && y === undefined)
+            return 0;
+        if (y === undefined)
+            return 1;
+        if (x === undefined)
+            return -1;
+        if (x !== y)
+            return compareIdentifiers(x, y);
+    }
+};
+/** semver's isX: a missing part, `x`, `X` or `*`. */
+const isX = (id) => id === undefined || id.toLowerCase() === 'x' || id === '*';
+const next = (id) => Number(id) + 1;
+/** `1.2 - 3.4` is `>=1.2.0-0 <3.5.0-0`; a full upper bound `3.4.5` is `<3.4.6-0`. */
+const hyphenReplace = (...g) => {
+    const [, fromText, fM, fm, fp, fpr, , toText, tM, tm, tp, tpr] = g;
+    let from;
+    if (isX(fM))
+        from = '';
+    else if (isX(fm))
+        from = `>=${fM}.0.0-0`;
+    else if (isX(fp))
+        from = `>=${fM}.${fm}.0-0`;
+    else if (fpr)
+        from = `>=${fromText}`;
+    else
+        from = `>=${fromText}-0`;
+    let to;
+    if (isX(tM))
+        to = '';
+    else if (isX(tm))
+        to = `<${next(tM)}.0.0-0`;
+    else if (isX(tp))
+        to = `<${tM}.${next(tm)}.0-0`;
+    else if (tpr)
+        to = `<=${tM}.${tm}.${tp}-${tpr}`;
+    else
+        to = `<${tM}.${tm}.${next(tp)}-0`;
+    return `${from} ${to}`.trim();
+};
+/** `^1.2.3` is `>=1.2.3-0 <2.0.0-0`; `^0.1.2` stops at `0.2.0-0`, `^0.0.1` at `0.0.2-0`. */
+const replaceCaret = (comp) => comp.replace(CARET, (...g) => {
+    const [, M, m, p, pr] = g;
+    if (isX(M))
+        return '';
+    if (isX(m))
+        return `>=${M}.0.0-0 <${next(M)}.0.0-0`;
+    if (isX(p))
+        return M === '0' ? `>=${M}.${m}.0-0 <${M}.${next(m)}.0-0` : `>=${M}.${m}.0-0 <${next(M)}.0.0-0`;
+    if (pr) {
+        if (M === '0')
+            return m === '0' ? `>=${M}.${m}.${p}-${pr} <${M}.${m}.${next(p)}-0` : `>=${M}.${m}.${p}-${pr} <${M}.${next(m)}.0-0`;
+        return `>=${M}.${m}.${p}-${pr} <${next(M)}.0.0-0`;
+    }
+    if (M === '0')
+        return m === '0' ? `>=${M}.${m}.${p}-0 <${M}.${m}.${next(p)}-0` : `>=${M}.${m}.${p}-0 <${M}.${next(m)}.0-0`;
+    return `>=${M}.${m}.${p} <${next(M)}.0.0-0`;
+});
+/** `~1.2.3` is `>=1.2.3 <1.3.0-0`; `~1` is `>=1.0.0 <2.0.0-0`. No `-0` on the lower bound, as in `semver`. */
+const replaceTilde = (comp) => comp.replace(TILDE, (...g) => {
+    const [, M, m, p, pr] = g;
+    if (isX(M))
+        return '';
+    if (isX(m))
+        return `>=${M}.0.0 <${next(M)}.0.0-0`;
+    if (isX(p))
+        return `>=${M}.${m}.0 <${M}.${next(m)}.0-0`;
+    if (pr)
+        return `>=${M}.${m}.${p}-${pr} <${M}.${next(m)}.0-0`;
+    return `>=${M}.${m}.${p} <${M}.${next(m)}.0-0`;
+});
+/** `<8` is `<8.0.0-0`, `>1.2` is `>=1.3.0-0`, `1.2` is `>=1.2.0-0 <1.3.0-0`, `>*` is nothing. */
+const replaceXRange = (comp) => comp.trim().replace(X_RANGE, (whole, gtltText, MText, mText, pText) => {
+    let gtlt = gtltText;
+    let [M, m, p] = [MText, mText, pText];
+    const xM = isX(MText);
+    const xm = xM || isX(mText);
+    const xp = xm || isX(pText);
+    if (gtlt === '=' && xp)
+        gtlt = '';
+    // includePrerelease: every bound starts at the lowest prerelease.
+    const pr = '-0';
+    if (xM)
+        return gtlt === '>' || gtlt === '<' ? '<0.0.0-0' : '*';
+    if (gtlt && xp) {
+        if (xm)
+            m = 0;
+        p = 0;
+        if (gtlt === '>') {
+            gtlt = '>=';
+            if (xm) {
+                M = next(M);
+                m = 0;
+            }
+            else
+                m = next(m);
+            p = 0;
+        }
+        else if (gtlt === '<=') {
+            gtlt = '<';
+            if (xm)
+                M = next(M);
+            else
+                m = next(m);
+        }
+        return `${gtlt}${M}.${m}.${p}${pr}`;
+    }
+    if (xm)
+        return `>=${M}.0.0${pr} <${next(M)}.0.0-0`;
+    if (xp)
+        return `>=${M}.${m}.0${pr} <${M}.${next(m)}.0-0`;
+    return whole;
+});
+/** semver's parseComparator: one space-free piece of a set to plain comparators. */
+const desugar = (piece) => {
+    let comp = piece.replace(BUILD_ONE, '');
+    comp = comp.trim().split(/\s+/).map(replaceCaret).join(' ');
+    comp = comp.trim().split(/\s+/).map(replaceTilde).join(' ');
+    comp = comp.split(/\s+/).map(replaceXRange).join(' ');
+    return comp.trim().replace(STAR, '');
+};
+/** semver's Comparator constructor, or undefined where it throws. */
+const comparator = (text) => {
+    const m = COMPARATOR.exec(text.trim().split(/\s+/).join(' '));
+    if (m === null)
+        return undefined;
+    const operator = (m[1] === undefined || m[1] === '=' ? '' : m[1]);
+    if (!m[2])
+        return { operator };
+    const version = parseVersion(m[2]);
+    return version === undefined ? undefined : { operator, version };
+};
+/** One `||` part as plain comparators, or undefined where `semver` throws. */
+const parseSet = (part) => {
+    let text = part.replace(BUILD_STRIP, '');
+    text = text.replace(HYPHEN_RANGE, hyphenReplace);
+    text = text.replace(COMPARATOR_TRIM, '$1$2$3');
+    text = text.replace(TILDE_TRIM, '$1~');
+    text = text.replace(CARET_TRIM, '$1^');
+    const pieces = text
+        .split(' ')
+        .map(desugar)
+        .join(' ')
+        .split(/\s+/)
+        .map((c) => c.trim().replace(GTE0_PRERELEASE, ''));
+    const set = pieces.map(comparator);
+    return set.every((c) => c !== undefined) ? set : undefined;
+};
+/** The range's comparator sets, or undefined when `semver` refuses it. */
+export const parseRange = (range) => {
+    if (typeof range !== 'string')
+        return undefined;
+    const sets = [];
+    for (const part of range.trim().replace(/\s+/g, ' ').split('||')) {
+        const set = parseSet(part.trim());
+        if (set === undefined)
+            return undefined;
+        sets.push(set);
+    }
+    return sets;
+};
+/** `semver.validRange`, as a yes or no. */
+export const validRange = (range) => parseRange(range) !== undefined;
+const test = (c, v) => {
+    if (c.version === undefined)
+        return true;
+    const order = compareVersions(v, c.version);
+    switch (c.operator) {
+        case '<':
+            return order < 0;
+        case '<=':
+            return order <= 0;
+        case '>':
+            return order > 0;
+        case '>=':
+            return order >= 0;
+        default:
+            return order === 0;
+    }
+};
+/** `semver.satisfies(version, range, { includePrerelease: true })`; false when either does not parse. */
+export const satisfies = (version, range) => {
+    const sets = parseRange(range);
+    const v = parseVersion(version);
+    if (sets === undefined || v === undefined)
+        return false;
+    return sets.some((set) => set.every((c) => test(c, v)));
+};