reslop 0.1.7 → 0.1.8

package/lib/deps/manifest.js

@@ -0,0 +1,145 @@
+'use strict';
+
+const path = require('node:path');
+
+const MANIFEST = 'package.json';
+const LOCKFILE = 'package-lock.json';
+const DEP_KIND = { [MANIFEST]: 'manifest', [LOCKFILE]: 'lockfile' };
+const SECTION_KEYS = [
+  'dependencies',
+  'devDependencies',
+  'optionalDependencies',
+  'peerDependencies',
+];
+
+const posixRel = (rel) => {
+  const raw = `${rel ?? ''}`;
+  return raw.replaceAll('\\', '/');
+};
+
+const depFileMeta = (rel) => {
+  const normalized = posixRel(rel);
+  if (!normalized) return null;
+  const base = path.posix.basename(normalized);
+  const kind = DEP_KIND[base];
+  if (!kind) return null;
+  const dir = path.posix.dirname(normalized);
+  return { kind, dir, base, rel: normalized };
+};
+
+const relOf = (dir, name) => (dir === '.' ? name : `${dir}/${name}`);
+
+const parseJson = (text) => {
+  if (!text || !`${text}`.trim()) return null;
+  try {
+    const data = JSON.parse(text);
+    if (!data || typeof data !== 'object' || Array.isArray(data)) return null;
+    return data;
+  } catch {
+    return null;
+  }
+};
+
+const emptySectionMaps = () => {
+  const maps = {};
+  for (const key of SECTION_KEYS) maps[key] = new Map();
+  return maps;
+};
+
+const readSectionMap = (pkg, key) => {
+  const map = new Map();
+  const raw = pkg ? pkg[key] : null;
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return map;
+  for (const name of Object.keys(raw)) {
+    const version = raw[name];
+    if (typeof version === 'string') map.set(name, version);
+  }
+  return map;
+};
+
+const readSections = (pkg) => {
+  const maps = emptySectionMaps();
+  if (!pkg) return maps;
+  for (const key of SECTION_KEYS) maps[key] = readSectionMap(pkg, key);
+  return maps;
+};
+
+const lockRootSections = (lock) => {
+  if (!lock) return emptySectionMaps();
+  const packages = lock.packages;
+  const root = packages && typeof packages === 'object' ? packages[''] : null;
+  const src = root && typeof root === 'object' ? root : lock;
+  return readSections(src);
+};
+
+const lockEntries = (lock) => {
+  const versions = new Map();
+  if (!lock) return versions;
+  const packages = lock.packages;
+  if (packages && typeof packages === 'object') {
+    for (const key of Object.keys(packages)) {
+      const entry = packages[key];
+      if (!key.startsWith('node_modules/')) continue;
+      if (key.includes('/node_modules/')) continue;
+      if (!entry || typeof entry.version !== 'string') continue;
+      const name = key.slice('node_modules/'.length);
+      versions.set(name, entry.version);
+    }
+  }
+  const deps = lock.dependencies;
+  if (!deps || typeof deps !== 'object') return versions;
+  for (const name of Object.keys(deps)) {
+    const entry = deps[name];
+    if (versions.has(name)) continue;
+    if (!entry || typeof entry.version !== 'string') continue;
+    versions.set(name, entry.version);
+  }
+  return versions;
+};
+
+const lockPackageCount = (lock) => {
+  if (!lock) return 0;
+  const packages = lock.packages;
+  if (packages && typeof packages === 'object') {
+    let count = 0;
+    for (const key of Object.keys(packages)) {
+      if (key !== '') count += 1;
+    }
+    return count;
+  }
+  const deps = lock.dependencies;
+  if (!deps || typeof deps !== 'object') return 0;
+  return Object.keys(deps).length;
+};
+
+const cloneJson = (value) => JSON.parse(JSON.stringify(value ?? null));
+
+const detectIndent = (text) => {
+  const match = /\n([ \t]+)"/.exec(text);
+  if (!match) return 2;
+  return match[1];
+};
+
+const stringifyJson = (value, original) => {
+  const indent = detectIndent(original || '');
+  const body = JSON.stringify(value, null, indent);
+  return `${body}\n`;
+};
+
+module.exports = {
+  MANIFEST,
+  LOCKFILE,
+  DEP_KIND,
+  SECTION_KEYS,
+  posixRel,
+  depFileMeta,
+  relOf,
+  parseJson,
+  emptySectionMaps,
+  readSections,
+  lockRootSections,
+  lockEntries,
+  lockPackageCount,
+  cloneJson,
+  stringifyJson,
+};

package/lib/deps/merge.js

@@ -0,0 +1,120 @@
+'use strict';
+
+const manifest = require('./manifest.js');
+const { SECTION_KEYS, parseJson, cloneJson, stringifyJson } = manifest;
+
+const parseFieldValue = (text) => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+};
+
+const setSectionEntry = (pkg, section, name, version) => {
+  if (!version) {
+    const map = pkg[section];
+    if (!map || typeof map !== 'object') return;
+    delete map[name];
+    if (!Object.keys(map).length) delete pkg[section];
+    return;
+  }
+  const map = pkg[section];
+  if (!map || typeof map !== 'object') pkg[section] = {};
+  pkg[section][name] = version;
+};
+
+const dropsEntry = (change, side) => {
+  if (side === 'new') return change.action === 'removed';
+  return change.action === 'added';
+};
+
+const applyManifestChange = (pkg, change, side) => {
+  if (change.section === 'resolved') return pkg;
+  const value = side === 'new' ? change.to : change.from;
+  if (change.section === 'field') {
+    if (value === '') {
+      delete pkg[change.name];
+      return pkg;
+    }
+    pkg[change.name] = parseFieldValue(value);
+    return pkg;
+  }
+  const version = dropsEntry(change, side) ? '' : value;
+  setSectionEntry(pkg, change.section, change.name, version);
+  return pkg;
+};
+
+const ensureLockRoot = (lock) => {
+  if (!lock.packages || typeof lock.packages !== 'object') {
+    lock.packages = {};
+  }
+  const root = lock.packages[''];
+  if (!root || typeof root !== 'object') lock.packages[''] = {};
+  return lock.packages[''];
+};
+
+const lockNodeKey = (name) => `node_modules/${name}`;
+
+const applyLegacyLockDep = (lock, change, side, src) => {
+  const deps = lock.dependencies;
+  if (!deps || typeof deps !== 'object') return;
+  if (dropsEntry(change, side)) {
+    delete deps[change.name];
+    return;
+  }
+  const srcDeps = src && src.dependencies;
+  if (!srcDeps || typeof srcDeps !== 'object') return;
+  const entry = srcDeps[change.name];
+  if (entry) deps[change.name] = cloneJson(entry);
+};
+
+const applyLockChange = (lock, change, side, oldLock, newLock) => {
+  if (change.section === 'field') return lock;
+  const src = side === 'new' ? newLock : oldLock;
+  if (change.section !== 'resolved') {
+    const root = ensureLockRoot(lock);
+    applyManifestChange(root, change, side);
+    applyLegacyLockDep(lock, change, side, src);
+  }
+  const packages = lock.packages;
+  if (!packages || typeof packages !== 'object') return lock;
+  const key = lockNodeKey(change.name);
+  if (dropsEntry(change, side)) {
+    delete packages[key];
+    return lock;
+  }
+  const srcPkgs = src && src.packages;
+  if (!srcPkgs || typeof srcPkgs !== 'object') return lock;
+  const entry = srcPkgs[key];
+  if (entry) packages[key] = cloneJson(entry);
+  return lock;
+};
+
+const seedManifest = (oldObj, newObj) => {
+  const base = cloneJson(oldObj) || {};
+  if (!newObj) return base;
+  for (const key of Object.keys(newObj)) {
+    const value = newObj[key];
+    if (SECTION_KEYS.includes(key)) continue;
+    if (Object.hasOwn(base, key)) continue;
+    base[key] = cloneJson(value);
+  }
+  return base;
+};
+
+const mergeDepFile = (baseText, oldText, newText, change, side, kind) => {
+  const oldObj = parseJson(oldText);
+  const newObj = parseJson(newText);
+  const parsedBase = parseJson(baseText);
+  let base;
+  if (parsedBase) base = cloneJson(parsedBase);
+  else if (kind === 'manifest') base = seedManifest(oldObj, newObj);
+  else base = cloneJson(oldObj) || {};
+  if (kind === 'lockfile') applyLockChange(base, change, side, oldObj, newObj);
+  else applyManifestChange(base, change, side);
+  const original = baseText || newText || oldText || '';
+  return stringifyJson(base, original);
+};
+
+module.exports = { mergeDepFile };

package/lib/deps/proposals.js

@@ -0,0 +1,164 @@
+'use strict';
+
+const { SECTION_KEYS, readSections, lockEntries } = require('./manifest.js');
+const { pkgHasExportEntry } = require('./usage.js');
+const versions = require('./versions.js');
+const { findDeclared, applyWantedRange } = versions;
+const { proposedLockVersion, proposedWanted } = versions;
+
+const depExports = (exportEntries, name) => {
+  if (!exportEntries || !exportEntries.has(name)) return true;
+  return exportEntries.get(name) === true;
+};
+
+const isAddedDep = (change) => {
+  if (change.action !== 'added') return false;
+  if (change.section === 'resolved') return false;
+  if (change.section === 'field') return false;
+  return true;
+};
+
+const unusedChangeNames = (changes, used) => {
+  const names = [];
+  if (!used || !used.size) return names;
+  for (const change of changes) {
+    if (!isAddedDep(change)) continue;
+    if (used.has(change.name)) continue;
+    names.push(change.name);
+  }
+  return names;
+};
+
+const unusedDeclaredNames = (pkg, used) => {
+  const names = [];
+  if (!pkgHasExportEntry(pkg)) return names;
+  if (!used || !used.size) return names;
+  const maps = readSections(pkg);
+  for (const section of SECTION_KEYS) {
+    if (section === 'peerDependencies') continue;
+    const keys = [...maps[section].keys()];
+    keys.sort();
+    for (const name of keys) {
+      if (used.has(name)) continue;
+      names.push(name);
+    }
+  }
+  return names;
+};
+
+const markUnusedChanges = (changes, used, pkg, exportEntries) => {
+  if (!pkgHasExportEntry(pkg)) return changes;
+  if (!used || !used.size) return changes;
+  const marked = [];
+  for (const change of changes) {
+    if (!isAddedDep(change) || used.has(change.name)) {
+      marked.push(change);
+      continue;
+    }
+    if (!depExports(exportEntries, change.name)) {
+      marked.push(change);
+      continue;
+    }
+    marked.push({ ...change, unused: true, propose: true });
+  }
+  return marked;
+};
+
+const unusedDeclaredChanges = (pkg, used, exportEntries) => {
+  const changes = [];
+  if (!pkgHasExportEntry(pkg)) return changes;
+  if (!used || !used.size) return changes;
+  const maps = readSections(pkg);
+  const taken = new Set();
+  for (const section of SECTION_KEYS) {
+    if (section === 'peerDependencies') continue;
+    const map = maps[section];
+    const names = [...map.keys()];
+    names.sort();
+    for (const name of names) {
+      if (used.has(name)) continue;
+      if (taken.has(name)) continue;
+      if (!depExports(exportEntries, name)) continue;
+      taken.add(name);
+      const version = map.get(name);
+      changes.push({
+        name,
+        section,
+        action: 'removed',
+        from: version,
+        to: '',
+        propose: true,
+        unused: true,
+      });
+    }
+  }
+  return changes;
+};
+
+const buildProposedChanges = (pkg, outdated, audit, lock, options = {}) => {
+  const used = options.used;
+  const exportEntries = options.exportEntries;
+  const names = new Set();
+  if (outdated) {
+    for (const name of outdated.keys()) names.add(name);
+  }
+  if (audit) {
+    for (const name of audit.keys()) names.add(name);
+  }
+  const listed = [...names];
+  listed.sort();
+  const resolved = lockEntries(lock);
+  const unused = unusedDeclaredChanges(pkg, used, exportEntries);
+  const taken = new Set();
+  for (const change of unused) taken.add(change.name);
+  const changes = [...unused];
+  for (const name of listed) {
+    if (taken.has(name)) continue;
+    const out = outdated ? outdated.get(name) : null;
+    const vul = audit ? audit.get(name) : null;
+    const type = out ? out.type : '';
+    const declared = findDeclared(pkg, name, type);
+    if (!declared) {
+      if (!vul) continue;
+      const version = resolved.get(name) || '';
+      if (!version) continue;
+      const to = proposedLockVersion(version, vul);
+      changes.push({
+        name,
+        section: 'resolved',
+        action: 'vulnerable',
+        from: version,
+        to,
+        propose: true,
+        audit: vul,
+      });
+      continue;
+    }
+    const wanted = proposedWanted(out, vul);
+    if (!wanted && !vul) continue;
+    let to = declared.version;
+    if (wanted) to = applyWantedRange(declared.version, wanted);
+    if (to === declared.version && !vul) continue;
+    let action = 'changed';
+    if (to === declared.version) action = 'vulnerable';
+    const change = {
+      name,
+      section: declared.section,
+      action,
+      from: declared.version,
+      to,
+      propose: true,
+    };
+    if (out) change.outdated = out;
+    if (vul) change.audit = vul;
+    changes.push(change);
+  }
+  return changes;
+};
+
+module.exports = {
+  unusedChangeNames,
+  unusedDeclaredNames,
+  markUnusedChanges,
+  buildProposedChanges,
+};

package/lib/deps/reports.js

@@ -0,0 +1,180 @@
+'use strict';
+
+const { jsonParse, isHashObject } = require('metautil');
+
+const SEVERITY_RANK = { critical: 4, high: 3, moderate: 2, low: 1, info: 0 };
+
+const namedTitle = (name, title) => {
+  if (!title) return '';
+  if (!name) return title;
+  const prefix = `${name}: `;
+  if (title.startsWith(prefix)) return title;
+  return `${prefix}${title}`;
+};
+
+const viaNotes = (via, pkgName) => {
+  if (!Array.isArray(via)) return [];
+  const notes = [];
+  for (const item of via) {
+    if (!item || typeof item !== 'object') continue;
+    const title = typeof item.title === 'string' ? item.title : '';
+    if (!title) continue;
+    const hasName = typeof item.name === 'string' && item.name;
+    const named = hasName ? item.name : pkgName;
+    const note = namedTitle(named, title);
+    if (!notes.includes(note)) notes.push(note);
+  }
+  return notes;
+};
+
+const severityRank = (severity) => SEVERITY_RANK[severity] ?? 0;
+
+const auditFix = (entry) => {
+  const available = entry.fixAvailable;
+  if (!available || typeof available !== 'object') return '';
+  if (typeof available.version !== 'string') return '';
+  return available.version;
+};
+
+const auditEntryNames = (key, entry) => {
+  const names = [];
+  const primary = entry.name || key;
+  if (primary) names.push(primary);
+  const effects = entry.effects;
+  if (!Array.isArray(effects)) return names;
+  for (const effect of effects) {
+    if (typeof effect === 'string' && effect) names.push(effect);
+  }
+  return names;
+};
+
+const keepHighestAudit = (audit, name, severity, fix, range, notes) => {
+  if (!name || !severity || severity === 'info') return;
+  const titles = [];
+  for (const note of notes) {
+    if (note && !titles.includes(note)) titles.push(note);
+  }
+  const prev = audit.get(name);
+  if (prev && severityRank(prev.severity) >= severityRank(severity)) {
+    const merged = [...prev.titles];
+    for (const note of titles) {
+      if (!merged.includes(note)) merged.push(note);
+    }
+    const next = {
+      ...prev,
+      titles: merged,
+      fix: prev.fix || fix,
+      range: prev.range || range,
+    };
+    audit.set(name, next);
+    return;
+  }
+  const title = titles[0] || '';
+  const next = { name, severity, title, titles, fix, range };
+  next.fix ||= '';
+  next.range ||= '';
+  audit.set(name, next);
+};
+
+const parseAuditReport = (text) => {
+  const audit = new Map();
+  if (!text || !`${text}`.trim()) return audit;
+  const data = jsonParse(text);
+  if (!isHashObject(data)) return audit;
+  const vulns = data.vulnerabilities;
+  if (vulns && typeof vulns === 'object') {
+    for (const key of Object.keys(vulns)) {
+      const entry = vulns[key];
+      if (!entry || typeof entry !== 'object') continue;
+      const severity = entry.severity;
+      const names = auditEntryNames(key, entry);
+      const pkgName = entry.name || key;
+      const titles = viaNotes(entry.via, pkgName);
+      const fix = auditFix(entry);
+      const range = typeof entry.range === 'string' ? entry.range : '';
+      for (const name of names) {
+        keepHighestAudit(audit, name, severity, fix, range, titles);
+      }
+    }
+  }
+  const advisories = data.advisories;
+  if (advisories && typeof advisories === 'object') {
+    for (const entry of Object.values(advisories)) {
+      if (!entry || typeof entry !== 'object') continue;
+      const name = entry.module_name || entry.name;
+      const severity = entry.severity;
+      const raw = typeof entry.title === 'string' ? entry.title : '';
+      const title = namedTitle(name, raw);
+      const titles = title ? [title] : [];
+      const fix = auditFix(entry);
+      const range = typeof entry.range === 'string' ? entry.range : '';
+      keepHighestAudit(audit, name, severity, fix, range, titles);
+    }
+  }
+  return audit;
+};
+
+const parseOutdatedReport = (text) => {
+  const outdated = new Map();
+  if (!text || !`${text}`.trim()) return outdated;
+  const data = jsonParse(text);
+  if (!isHashObject(data)) return outdated;
+  for (const name of Object.keys(data)) {
+    const entry = data[name];
+    if (!entry || typeof entry !== 'object') continue;
+    const current = typeof entry.current === 'string' ? entry.current : '';
+    const wanted = typeof entry.wanted === 'string' ? entry.wanted : '';
+    const latest = typeof entry.latest === 'string' ? entry.latest : '';
+    const type = typeof entry.type === 'string' ? entry.type : '';
+    if (!wanted) continue;
+    outdated.set(name, { current, wanted, latest, type });
+  }
+  return outdated;
+};
+
+const markAuditChanges = (changes, audit) => {
+  if (!audit) return changes;
+  const marked = [];
+  for (const change of changes) {
+    if (change.action === 'removed' || change.section === 'field') {
+      marked.push(change);
+      continue;
+    }
+    const found = audit.get(change.name);
+    if (!found) {
+      marked.push(change);
+      continue;
+    }
+    marked.push({ ...change, audit: found });
+  }
+  return marked;
+};
+
+const markOutdatedChanges = (changes, outdated) => {
+  if (!outdated) return changes;
+  const marked = [];
+  for (const change of changes) {
+    if (change.action === 'removed' || change.section === 'field') {
+      marked.push(change);
+      continue;
+    }
+    const found = outdated.get(change.name);
+    if (!found) {
+      marked.push(change);
+      continue;
+    }
+    if (found.wanted && found.wanted === found.current) {
+      marked.push(change);
+      continue;
+    }
+    marked.push({ ...change, outdated: found });
+  }
+  return marked;
+};
+
+module.exports = {
+  parseAuditReport,
+  parseOutdatedReport,
+  markAuditChanges,
+  markOutdatedChanges,
+};