dsh-plugin-compat-check 0.1.6 → 0.1.7

package/kernel/lib/source-graph.mjs

@@ -1,6 +1,13 @@
 import fs from "node:fs";
 import path from "node:path";
+import { patchMounts } from "./patch-mounts.mjs";
 import { localImports } from "./syntax.mjs";
+import {
+  readStaticFile,
+  readStaticDirectory,
+  inputError,
+  lowerInputLimits,
+} from "./static-input.mjs";
 
 const sourceFile = (file) =>
   /\.[cm]?[jt]sx?$/.test(file) && !file.endsWith(".d.ts");
@@ -8,25 +15,98 @@ const portable = (file) => file.split(path.sep).join("/");
 const inside = (root, file) =>
   file === root || file.startsWith(root + path.sep);
 
-function hostEntry(meta) {
-  const exp = meta.exports;
-  const value = typeof exp === "string" ? exp : exp?.["."];
-  if (typeof value === "string") return value;
-  if (value && typeof value === "object")
-    for (const key of ["import", "node", "default", "require"]) {
-      if (typeof value[key] === "string") return value[key];
-      if (value[key] && typeof value[key] === "object")
-        for (const v of Object.values(value[key]))
-          if (typeof v === "string") return v;
+/** DSH imports host plugins with Node's normal ESM conditions, never types. */
+function hostEntry(meta, uncertain) {
+  if (meta.exports == null)
+    return typeof meta.main === "string" ? meta.main : "index.js";
+  let steps = 0;
+  const active = new Set([
+    "node",
+    "import",
+    "node-addons",
+    "module-sync",
+    "default",
+  ]);
+  const inactive = new Set(["types", "browser", "require"]);
+  const invalid = (message, code) => {
+    throw Object.assign(new Error(message), { code });
+  };
+  const select = (value, depth = 0) => {
+    if (++steps > 128 || depth > 32)
+      return invalid("Export resolution budget exceeded");
+    if (value === null) return null;
+    if (typeof value === "string") {
+      if (
+        !value.startsWith("./") ||
+        value
+          .slice(2)
+          .split("/")
+          .some((p) => p === "." || p === ".." || p === "node_modules")
+      )
+        return invalid(
+          "Unsupported or invalid export target",
+          "INVALID_EXPORT_TARGET",
+        );
+      if (/[%?#\\]/.test(value))
+        return invalid(
+          "URL-style export target cannot be mapped to source with certainty",
+        );
+      return value;
+    }
+    if (Array.isArray(value)) {
+      let error;
+      for (const entry of value) {
+        try {
+          const target = select(entry, depth + 1);
+          if (target != null) return target;
+        } catch (cause) {
+          if (cause.code !== "INVALID_EXPORT_TARGET") throw cause;
+          error = cause;
+        }
+      }
+      if (error) throw error;
+      return null;
+    }
+    if (!value || typeof value !== "object")
+      return invalid("Unsupported export value", "INVALID_EXPORT_TARGET");
+    for (const [condition, target] of Object.entries(value)) {
+      if (/^\d+$/.test(condition) || condition.startsWith("."))
+        return invalid("Invalid export condition");
+      if (active.has(condition)) {
+        const result = select(target, depth + 1);
+        if (result !== undefined) return result;
+      } else if (!inactive.has(condition))
+        return invalid(
+          "Custom export conditions are not established for this host",
+        );
+    }
+    return undefined;
+  };
+  try {
+    let value = meta.exports;
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const keys = Object.keys(value);
+      if (keys.some((k) => k.startsWith("."))) {
+        if (keys.some((k) => !k.startsWith(".")) || !Object.hasOwn(value, "."))
+          return invalid("Package root export is unavailable or invalid");
+        value = value["."];
+      }
     }
-  return typeof meta.main === "string" ? meta.main : "index.js";
+    const target = select(value);
+    if (!target) return invalid("No host import target can be established");
+    return target;
+  } catch (error) {
+    uncertain(error.message);
+    return null;
+  }
 }
 export function clientEntry(meta) {
+  // client-modules at all three reviewed tags uses its own one-level loader
+  // contract, not Node/browser conditional export resolution.
   const value = meta.exports?.["./client"];
   if (typeof value === "string") return value;
-  if (value && typeof value === "object")
-    for (const key of ["browser", "import", "default"])
-      if (typeof value[key] === "string") return value[key];
+  if (value && typeof value === "object" && typeof value.default === "string")
+    return value.default;
   return null;
 }
 
@@ -39,14 +119,21 @@ export function collectPackageSources(pkg, meta, options = {}) {
     files = [],
     buckets = new Map(),
     fileSides = {};
-  const limits = {
-    files: 2000,
-    bytes: 32 * 1024 * 1024,
-    fileBytes: 2 * 1024 * 1024,
-    directories: 10000,
-    timeMs: 5000,
-    ...options.limits,
-  };
+  const limits = lowerInputLimits(
+    {
+      files: 2000,
+      bytes: 32 * 1024 * 1024,
+      fileBytes: 2 * 1024 * 1024,
+      directories: 10000,
+      entries: 10000,
+      timeMs: 5000,
+      yamlNodes: 10000,
+      yamlDepth: 32,
+      yamlFiles: 64,
+      yamlBytes: 65536,
+    },
+    options.limits,
+  );
   const texts = new Map(),
     resolvedFiles = new Map(),
     moduleLinks = new Map();
@@ -54,7 +141,30 @@ export function collectPackageSources(pkg, meta, options = {}) {
   const note = (kind, file, message) => {
     if (diagnostics.length < 100) diagnostics.push({ kind, file, message });
   };
+  let hostResolved = false,
+    hostTarget;
+  const hostEntryFor = () => {
+    if (!hostResolved) {
+      hostResolved = true;
+      hostTarget = hostEntry(meta, (message) =>
+        note("entry-resolution-uncertain", "package.json", message),
+      );
+      if (hostTarget) {
+        // Only legacy package main resolution has extension/index fallbacks.
+        // An exports target, like an explicit import URL, is an exact file.
+        hostTarget =
+          meta.exports == null
+            ? resolveLegacyMain(hostTarget)
+            : resolveFile(hostTarget, true);
+      }
+    }
+    return hostTarget;
+  };
   const expired = () => Date.now() - started > limits.timeMs;
+  const checkTime = () => {
+    if (expired())
+      throw inputError("STATIC_INPUT_BUDGET", "Source time budget exceeded");
+  };
   const resolveFile = (rel, required = false) => {
     if (typeof rel !== "string") return null;
     const abs = path.resolve(root, rel);
@@ -66,24 +176,9 @@ export function collectPackageSources(pkg, meta, options = {}) {
       );
       return null;
     }
-    for (const name of [
-      abs,
-      ...[
-        ".js",
-        ".mjs",
-        ".cjs",
-        ".ts",
-        ".tsx",
-        ".jsx",
-        ".mts",
-        ".cts",
-        "/index.js",
-        "/index.mjs",
-        "/index.ts",
-      ].map((e) => abs + e),
-    ]) {
+    if (!rel.endsWith("/") && !rel.endsWith(path.sep)) {
       try {
-        const canonical = fs.realpathSync(name);
+        const canonical = fs.realpathSync(abs);
         if (!inside(root, canonical)) {
           note(
             "path-outside-package",
@@ -95,7 +190,7 @@ export function collectPackageSources(pkg, meta, options = {}) {
         if (fs.statSync(canonical).isFile())
           return portable(path.relative(root, canonical));
       } catch {
-        /* try next supported resolution */
+        /* The caller decides whether a different resolution mode may try more. */
       }
     }
     if (required)
@@ -106,24 +201,117 @@ export function collectPackageSources(pkg, meta, options = {}) {
       );
     return null;
   };
-  const read = (rel) => {
+  const nodeFile = (rel) => {
+    if (rel.endsWith("/") || rel.endsWith(path.sep)) return null;
+    for (const suffix of ["", ".js", ".json", ".node"]) {
+      const found = resolveFile(rel + suffix);
+      if (found) return found;
+    }
+    return null;
+  };
+  const directoryIndex = (rel) => {
+    for (const suffix of [".js", ".json", ".node"]) {
+      const found = resolveFile(path.join(rel, "index" + suffix));
+      if (found) return found;
+    }
+    return null;
+  };
+  const unresolved = (rel) => {
+    note(
+      "source-unresolved",
+      portable(rel),
+      "Node entry or relative module cannot be resolved",
+    );
+    return null;
+  };
+  const resolveLegacyMain = (rel) =>
+    nodeFile(rel) ||
+    directoryIndex(rel) ||
+    directoryIndex(".") ||
+    unresolved(rel);
+  const resolveRequire = (rel) => {
+    checkTime();
+    const found = nodeFile(rel);
+    if (found) return found;
+    const abs = path.resolve(root, rel);
+    if (!inside(root, abs)) return resolveFile(rel, true);
+    let directory;
+    try {
+      directory = fs.realpathSync(abs);
+      if (!inside(root, directory)) return resolveFile(rel, true);
+      if (!fs.statSync(directory).isDirectory()) return null;
+    } catch {
+      return null;
+    }
+    let manifest;
+    try {
+      // A present but unsafe manifest is not equivalent to a missing one.
+      const candidate = path.join(rel, "package.json");
+      fs.lstatSync(path.join(root, candidate));
+      manifest = portable(candidate);
+    } catch (error) {
+      if (!["ENOENT", "ENOTDIR"].includes(error.code)) {
+        note(
+          "source-unreadable",
+          portable(rel),
+          "CommonJS package metadata cannot be inspected",
+        );
+        return null;
+      }
+    }
+    if (manifest) {
+      const text = read(manifest, 65536);
+      if (text === null) return null;
+      try {
+        const metadata = JSON.parse(text);
+        if (
+          !metadata ||
+          typeof metadata !== "object" ||
+          Array.isArray(metadata)
+        )
+          throw new Error("Invalid CommonJS package object");
+        if (typeof metadata?.main === "string" && metadata.main) {
+          const main = path.join(rel, metadata.main);
+          // Node LOAD_AS_DIRECTORY tries main as file, then main/index;
+          // it does not recursively read another directory's package.json.
+          const resolved = nodeFile(main) || directoryIndex(main);
+          if (resolved) return resolved;
+        }
+      } catch {
+        note(
+          "entry-resolution-uncertain",
+          manifest,
+          "Invalid CommonJS package metadata",
+        );
+        return null;
+      }
+    }
+    return directoryIndex(rel);
+  };
+  const read = (rel, fileLimit = limits.fileBytes) => {
     if (texts.has(rel)) return texts.get(rel);
     if (expired() || texts.size >= limits.files) {
       note("scan-budget-exceeded", rel, "File/time limit reached");
       return null;
     }
     try {
-      const stat = fs.statSync(path.join(root, rel));
-      if (stat.size > limits.fileBytes || bytes + stat.size > limits.bytes) {
-        note("scan-budget-exceeded", rel, "Source byte limit reached");
-        return null;
-      }
-      const text = fs.readFileSync(path.join(root, rel), "utf8");
-      bytes += stat.size;
+      const data = readStaticFile(
+        path.join(root, rel),
+        Math.min(fileLimit, limits.fileBytes, limits.bytes - bytes),
+        checkTime,
+      );
+      const text = data.toString("utf8");
+      bytes += data.length;
       texts.set(rel, text);
       return text;
     } catch (error) {
-      note("source-unreadable", rel, error.message);
+      note(
+        error.code === "STATIC_INPUT_BUDGET"
+          ? "scan-budget-exceeded"
+          : "source-unreadable",
+        rel,
+        error.message,
+      );
       return null;
     }
   };
@@ -136,18 +324,50 @@ export function collectPackageSources(pkg, meta, options = {}) {
         break;
       }
       const rel = resolveFile(queue.pop(), true);
-      if (!rel || seen.has(rel) || !sourceFile(rel)) continue;
+      if (!rel || seen.has(rel)) continue;
+      if (!sourceFile(rel)) {
+        note(
+          "source-format-uncertain",
+          rel,
+          "Resolved module is not supported JavaScript/TypeScript source",
+        );
+        continue;
+      }
       seen.add(rel);
       const text = read(rel);
       if (text === null) continue;
-      const parsed = localImports(text, rel);
+      let parsed;
+      try {
+        parsed = localImports(text, rel, checkTime);
+      } catch (error) {
+        if (error.code !== "STATIC_INPUT_BUDGET") throw error;
+        note("scan-budget-exceeded", rel, error.message);
+        break;
+      }
+      for (const diagnostic of parsed.diagnostics)
+        note(diagnostic.kind, rel, diagnostic.message);
       if (parsed.error) note("parse-error", rel, parsed.error.message);
-      for (const spec of parsed.imports) {
+      for (const { source: spec, kind, start } of parsed.edges) {
         if (!moduleLinks.has(rel)) moduleLinks.set(rel, new Map());
+        const local = path.join(path.dirname(rel), spec);
+        let target;
+        try {
+          if (kind === "require")
+            target = resolveRequire(local) || unresolved(local);
+          else if (/[%?#\\]/.test(spec)) target = unresolved(local);
+          else target = resolveFile(local, true);
+        } catch (error) {
+          if (error.code !== "STATIC_INPUT_BUDGET") throw error;
+          note("scan-budget-exceeded", rel, error.message);
+          break;
+        }
+        // The same spelling may resolve for require but fail for import.
         moduleLinks
           .get(rel)
-          .set(spec, resolveFile(path.join(path.dirname(rel), spec)));
-        queue.push(path.join(path.dirname(rel), spec));
+          .set(kind === "require" ? "require:" + spec : spec, target);
+        if (kind === "require")
+          moduleLinks.get(rel).set("require@" + start, target);
+        if (target) queue.push(target);
       }
     }
     return seen;
@@ -156,6 +376,7 @@ export function collectPackageSources(pkg, meta, options = {}) {
     const out = [],
       queue = [root],
       visited = new Set();
+    let entriesSeen = 0;
     while (queue.length) {
       if (
         expired() ||
@@ -184,19 +405,33 @@ export function collectPackageSources(pkg, meta, options = {}) {
       visited.add(real);
       let entries;
       try {
-        entries = fs.readdirSync(real, { withFileTypes: true });
+        entries = readStaticDirectory(
+          real,
+          limits.entries - entriesSeen,
+          checkTime,
+        );
+        entriesSeen += entries.length;
       } catch (error) {
         note(
-          "source-unreadable",
+          error.code === "STATIC_INPUT_BUDGET"
+            ? "scan-budget-exceeded"
+            : "source-unreadable",
           portable(path.relative(root, real)),
           error.message,
         );
+        if (error.code === "STATIC_INPUT_BUDGET") break;
         continue;
       }
-      for (const entry of entries.sort((a, b) =>
-        a.name < b.name ? -1 : a.name > b.name ? 1 : 0,
-      )) {
-        const file = path.join(real, entry.name);
+      for (const entry of entries) {
+        if (expired()) {
+          note(
+            "scan-budget-exceeded",
+            null,
+            "Directory walk time limit reached",
+          );
+          return out;
+        }
+        const file = path.join(real, entry);
         try {
           const resolved = fs.realpathSync(file);
           if (!inside(root, resolved)) {
@@ -218,20 +453,63 @@ export function collectPackageSources(pkg, meta, options = {}) {
     }
     return [...new Set(out)].sort();
   };
-  const mounted = [];
   const patch = meta.dsh?.bundle?.patch;
-  if (typeof patch === "string") {
-    const rel = resolveFile(patch);
-    if (rel)
-      try {
-        const txt = fs.readFileSync(path.join(root, rel), "utf8");
-        for (const m of txt.matchAll(/^\s*-\s*name:\s*['"]?([^\s'"]+)/gm))
-          mounted.push(m[1].startsWith(".") ? m[1] : hostEntry(meta));
-      } catch (error) {
-        note("patch-unreadable", rel, error.message);
-      }
-  }
-  const hostSeeds = mounted.length ? mounted : [hostEntry(meta)];
+  let hostSeeds,
+    patchComplete = false;
+  if (patch !== undefined) {
+    const patchFiles = typeof patch === "string" ? [patch] : patch;
+    if (
+      !Array.isArray(patchFiles) ||
+      !patchFiles.every((file) => typeof file === "string")
+    ) {
+      note(
+        "patch-unreadable",
+        "package.json",
+        "Patch declaration must be a path or path list",
+      );
+      hostSeeds = [];
+    } else {
+      const result = patchMounts(patchFiles, {
+        root,
+        limits,
+        check: checkTime,
+        note,
+        read(file) {
+          const rel = resolveFile(file, true);
+          if (!rel) throw Error("Declared patch is missing or outside package");
+          const data = readStaticFile(
+            path.join(root, rel),
+            Math.min(limits.fileBytes, limits.yamlBytes, limits.bytes - bytes),
+            checkTime,
+          );
+          bytes += data.length;
+          return data.toString("utf8");
+        },
+      });
+      patchComplete = result.complete;
+      hostSeeds = result.mounts.map((name) => {
+        if (name.startsWith(".") || path.isAbsolute(name))
+          return resolveFile(name, true);
+        if (name === meta.name) return hostEntryFor();
+        if (typeof meta.name === "string" && name.startsWith(meta.name + "/")) {
+          const subpath = name.slice(meta.name.length + 1);
+          if (meta.exports == null) return resolveFile(subpath, true);
+          const target = hostEntry(
+            { exports: { ".": meta.exports?.["./" + subpath] } },
+            (message) =>
+              note("entry-resolution-uncertain", "package.json", message),
+          );
+          return target ? resolveFile(target, true) : null;
+        }
+        note(
+          "patch-resolution-uncertain",
+          name,
+          "Mount belongs to another package; cannot use this package root",
+        );
+        return null;
+      });
+    }
+  } else hostSeeds = [hostEntryFor()];
   const entryFiles = [
     ...new Set(
       [...hostSeeds, clientEntry(meta)]
@@ -241,7 +519,7 @@ export function collectPackageSources(pkg, meta, options = {}) {
     ),
   ];
   const host = graph(hostSeeds);
-  const fallback = host.size === 0;
+  const fallback = host.size === 0 && (!patchComplete || hostSeeds.length > 0);
   const all = walk();
   const add = (rel, bucket, side) => {
     const text = read(rel);
@@ -256,7 +534,7 @@ export function collectPackageSources(pkg, meta, options = {}) {
   if (fallback) {
     note(
       "entry-fallback",
-      hostEntry(meta),
+      hostTarget ?? null,
       "No resolved host entry; candidate source coverage is uncertain",
     );
     for (const rel of all)