reslop 0.1.7 → 0.1.9

package/lib/deps/merge.js

@@ -0,0 +1,120 @@
+'use strict';
+
+const manifest = require('./manifest.js');
+const { SECTION_KEYS, parseJson, cloneJson, stringifyJson } = manifest;
+
+const parseFieldValue = (text) => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+};
+
+const setSectionEntry = (pkg, section, name, version) => {
+  if (!version) {
+    const map = pkg[section];
+    if (!map || typeof map !== 'object') return;
+    delete map[name];
+    if (!Object.keys(map).length) delete pkg[section];
+    return;
+  }
+  const map = pkg[section];
+  if (!map || typeof map !== 'object') pkg[section] = {};
+  pkg[section][name] = version;
+};
+
+const dropsEntry = (change, side) => {
+  if (side === 'new') return change.action === 'removed';
+  return change.action === 'added';
+};
+
+const applyManifestChange = (pkg, change, side) => {
+  if (change.section === 'resolved') return pkg;
+  const value = side === 'new' ? change.to : change.from;
+  if (change.section === 'field') {
+    if (value === '') {
+      delete pkg[change.name];
+      return pkg;
+    }
+    pkg[change.name] = parseFieldValue(value);
+    return pkg;
+  }
+  const version = dropsEntry(change, side) ? '' : value;
+  setSectionEntry(pkg, change.section, change.name, version);
+  return pkg;
+};
+
+const ensureLockRoot = (lock) => {
+  if (!lock.packages || typeof lock.packages !== 'object') {
+    lock.packages = {};
+  }
+  const root = lock.packages[''];
+  if (!root || typeof root !== 'object') lock.packages[''] = {};
+  return lock.packages[''];
+};
+
+const lockNodeKey = (name) => `node_modules/${name}`;
+
+const applyLegacyLockDep = (lock, change, side, src) => {
+  const deps = lock.dependencies;
+  if (!deps || typeof deps !== 'object') return;
+  if (dropsEntry(change, side)) {
+    delete deps[change.name];
+    return;
+  }
+  const srcDeps = src && src.dependencies;
+  if (!srcDeps || typeof srcDeps !== 'object') return;
+  const entry = srcDeps[change.name];
+  if (entry) deps[change.name] = cloneJson(entry);
+};
+
+const applyLockChange = (lock, change, side, oldLock, newLock) => {
+  if (change.section === 'field') return lock;
+  const src = side === 'new' ? newLock : oldLock;
+  if (change.section !== 'resolved') {
+    const root = ensureLockRoot(lock);
+    applyManifestChange(root, change, side);
+    applyLegacyLockDep(lock, change, side, src);
+  }
+  const packages = lock.packages;
+  if (!packages || typeof packages !== 'object') return lock;
+  const key = lockNodeKey(change.name);
+  if (dropsEntry(change, side)) {
+    delete packages[key];
+    return lock;
+  }
+  const srcPkgs = src && src.packages;
+  if (!srcPkgs || typeof srcPkgs !== 'object') return lock;
+  const entry = srcPkgs[key];
+  if (entry) packages[key] = cloneJson(entry);
+  return lock;
+};
+
+const seedManifest = (oldObj, newObj) => {
+  const base = cloneJson(oldObj) || {};
+  if (!newObj) return base;
+  for (const key of Object.keys(newObj)) {
+    const value = newObj[key];
+    if (SECTION_KEYS.includes(key)) continue;
+    if (Object.hasOwn(base, key)) continue;
+    base[key] = cloneJson(value);
+  }
+  return base;
+};
+
+const mergeDepFile = (baseText, oldText, newText, change, side, kind) => {
+  const oldObj = parseJson(oldText);
+  const newObj = parseJson(newText);
+  const parsedBase = parseJson(baseText);
+  let base;
+  if (parsedBase) base = cloneJson(parsedBase);
+  else if (kind === 'manifest') base = seedManifest(oldObj, newObj);
+  else base = cloneJson(oldObj) || {};
+  if (kind === 'lockfile') applyLockChange(base, change, side, oldObj, newObj);
+  else applyManifestChange(base, change, side);
+  const original = baseText || newText || oldText || '';
+  return stringifyJson(base, original);
+};
+
+module.exports = { mergeDepFile };

package/lib/deps/proposals.js

@@ -0,0 +1,164 @@
+'use strict';
+
+const { SECTION_KEYS, readSections, lockEntries } = require('./manifest.js');
+const { pkgHasExportEntry } = require('./usage.js');
+const versions = require('./versions.js');
+const { findDeclared, applyWantedRange } = versions;
+const { proposedLockVersion, proposedWanted } = versions;
+
+const depExports = (exportEntries, name) => {
+  if (!exportEntries || !exportEntries.has(name)) return true;
+  return exportEntries.get(name) === true;
+};
+
+const isAddedDep = (change) => {
+  if (change.action !== 'added') return false;
+  if (change.section === 'resolved') return false;
+  if (change.section === 'field') return false;
+  return true;
+};
+
+const unusedChangeNames = (changes, used) => {
+  const names = [];
+  if (!used || !used.size) return names;
+  for (const change of changes) {
+    if (!isAddedDep(change)) continue;
+    if (used.has(change.name)) continue;
+    names.push(change.name);
+  }
+  return names;
+};
+
+const unusedDeclaredNames = (pkg, used) => {
+  const names = [];
+  if (!pkgHasExportEntry(pkg)) return names;
+  if (!used || !used.size) return names;
+  const maps = readSections(pkg);
+  for (const section of SECTION_KEYS) {
+    if (section === 'peerDependencies') continue;
+    const keys = [...maps[section].keys()];
+    keys.sort();
+    for (const name of keys) {
+      if (used.has(name)) continue;
+      names.push(name);
+    }
+  }
+  return names;
+};
+
+const markUnusedChanges = (changes, used, pkg, exportEntries) => {
+  if (!pkgHasExportEntry(pkg)) return changes;
+  if (!used || !used.size) return changes;
+  const marked = [];
+  for (const change of changes) {
+    if (!isAddedDep(change) || used.has(change.name)) {
+      marked.push(change);
+      continue;
+    }
+    if (!depExports(exportEntries, change.name)) {
+      marked.push(change);
+      continue;
+    }
+    marked.push({ ...change, unused: true, propose: true });
+  }
+  return marked;
+};
+
+const unusedDeclaredChanges = (pkg, used, exportEntries) => {
+  const changes = [];
+  if (!pkgHasExportEntry(pkg)) return changes;
+  if (!used || !used.size) return changes;
+  const maps = readSections(pkg);
+  const taken = new Set();
+  for (const section of SECTION_KEYS) {
+    if (section === 'peerDependencies') continue;
+    const map = maps[section];
+    const names = [...map.keys()];
+    names.sort();
+    for (const name of names) {
+      if (used.has(name)) continue;
+      if (taken.has(name)) continue;
+      if (!depExports(exportEntries, name)) continue;
+      taken.add(name);
+      const version = map.get(name);
+      changes.push({
+        name,
+        section,
+        action: 'removed',
+        from: version,
+        to: '',
+        propose: true,
+        unused: true,
+      });
+    }
+  }
+  return changes;
+};
+
+const buildProposedChanges = (pkg, outdated, audit, lock, options = {}) => {
+  const used = options.used;
+  const exportEntries = options.exportEntries;
+  const names = new Set();
+  if (outdated) {
+    for (const name of outdated.keys()) names.add(name);
+  }
+  if (audit) {
+    for (const name of audit.keys()) names.add(name);
+  }
+  const listed = [...names];
+  listed.sort();
+  const resolved = lockEntries(lock);
+  const unused = unusedDeclaredChanges(pkg, used, exportEntries);
+  const taken = new Set();
+  for (const change of unused) taken.add(change.name);
+  const changes = [...unused];
+  for (const name of listed) {
+    if (taken.has(name)) continue;
+    const out = outdated ? outdated.get(name) : null;
+    const vul = audit ? audit.get(name) : null;
+    const type = out ? out.type : '';
+    const declared = findDeclared(pkg, name, type);
+    if (!declared) {
+      if (!vul) continue;
+      const version = resolved.get(name) || '';
+      if (!version) continue;
+      const to = proposedLockVersion(version, vul);
+      changes.push({
+        name,
+        section: 'resolved',
+        action: 'vulnerable',
+        from: version,
+        to,
+        propose: true,
+        audit: vul,
+      });
+      continue;
+    }
+    const wanted = proposedWanted(out, vul);
+    if (!wanted && !vul) continue;
+    let to = declared.version;
+    if (wanted) to = applyWantedRange(declared.version, wanted);
+    if (to === declared.version && !vul) continue;
+    let action = 'changed';
+    if (to === declared.version) action = 'vulnerable';
+    const change = {
+      name,
+      section: declared.section,
+      action,
+      from: declared.version,
+      to,
+      propose: true,
+    };
+    if (out) change.outdated = out;
+    if (vul) change.audit = vul;
+    changes.push(change);
+  }
+  return changes;
+};
+
+module.exports = {
+  unusedChangeNames,
+  unusedDeclaredNames,
+  markUnusedChanges,
+  buildProposedChanges,
+};

package/lib/deps/reports.js

@@ -0,0 +1,180 @@
+'use strict';
+
+const { jsonParse, isHashObject } = require('metautil');
+
+const SEVERITY_RANK = { critical: 4, high: 3, moderate: 2, low: 1, info: 0 };
+
+const namedTitle = (name, title) => {
+  if (!title) return '';
+  if (!name) return title;
+  const prefix = `${name}: `;
+  if (title.startsWith(prefix)) return title;
+  return `${prefix}${title}`;
+};
+
+const viaNotes = (via, pkgName) => {
+  if (!Array.isArray(via)) return [];
+  const notes = [];
+  for (const item of via) {
+    if (!item || typeof item !== 'object') continue;
+    const title = typeof item.title === 'string' ? item.title : '';
+    if (!title) continue;
+    const hasName = typeof item.name === 'string' && item.name;
+    const named = hasName ? item.name : pkgName;
+    const note = namedTitle(named, title);
+    if (!notes.includes(note)) notes.push(note);
+  }
+  return notes;
+};
+
+const severityRank = (severity) => SEVERITY_RANK[severity] ?? 0;
+
+const auditFix = (entry) => {
+  const available = entry.fixAvailable;
+  if (!available || typeof available !== 'object') return '';
+  if (typeof available.version !== 'string') return '';
+  return available.version;
+};
+
+const auditEntryNames = (key, entry) => {
+  const names = [];
+  const primary = entry.name || key;
+  if (primary) names.push(primary);
+  const effects = entry.effects;
+  if (!Array.isArray(effects)) return names;
+  for (const effect of effects) {
+    if (typeof effect === 'string' && effect) names.push(effect);
+  }
+  return names;
+};
+
+const keepHighestAudit = (audit, name, severity, fix, range, notes) => {
+  if (!name || !severity || severity === 'info') return;
+  const titles = [];
+  for (const note of notes) {
+    if (note && !titles.includes(note)) titles.push(note);
+  }
+  const prev = audit.get(name);
+  if (prev && severityRank(prev.severity) >= severityRank(severity)) {
+    const merged = [...prev.titles];
+    for (const note of titles) {
+      if (!merged.includes(note)) merged.push(note);
+    }
+    const next = {
+      ...prev,
+      titles: merged,
+      fix: prev.fix || fix,
+      range: prev.range || range,
+    };
+    audit.set(name, next);
+    return;
+  }
+  const title = titles[0] || '';
+  const next = { name, severity, title, titles, fix, range };
+  next.fix ||= '';
+  next.range ||= '';
+  audit.set(name, next);
+};
+
+const parseAuditReport = (text) => {
+  const audit = new Map();
+  if (!text || !`${text}`.trim()) return audit;
+  const data = jsonParse(text);
+  if (!isHashObject(data)) return audit;
+  const vulns = data.vulnerabilities;
+  if (vulns && typeof vulns === 'object') {
+    for (const key of Object.keys(vulns)) {
+      const entry = vulns[key];
+      if (!entry || typeof entry !== 'object') continue;
+      const severity = entry.severity;
+      const names = auditEntryNames(key, entry);
+      const pkgName = entry.name || key;
+      const titles = viaNotes(entry.via, pkgName);
+      const fix = auditFix(entry);
+      const range = typeof entry.range === 'string' ? entry.range : '';
+      for (const name of names) {
+        keepHighestAudit(audit, name, severity, fix, range, titles);
+      }
+    }
+  }
+  const advisories = data.advisories;
+  if (advisories && typeof advisories === 'object') {
+    for (const entry of Object.values(advisories)) {
+      if (!entry || typeof entry !== 'object') continue;
+      const name = entry.module_name || entry.name;
+      const severity = entry.severity;
+      const raw = typeof entry.title === 'string' ? entry.title : '';
+      const title = namedTitle(name, raw);
+      const titles = title ? [title] : [];
+      const fix = auditFix(entry);
+      const range = typeof entry.range === 'string' ? entry.range : '';
+      keepHighestAudit(audit, name, severity, fix, range, titles);
+    }
+  }
+  return audit;
+};
+
+const parseOutdatedReport = (text) => {
+  const outdated = new Map();
+  if (!text || !`${text}`.trim()) return outdated;
+  const data = jsonParse(text);
+  if (!isHashObject(data)) return outdated;
+  for (const name of Object.keys(data)) {
+    const entry = data[name];
+    if (!entry || typeof entry !== 'object') continue;
+    const current = typeof entry.current === 'string' ? entry.current : '';
+    const wanted = typeof entry.wanted === 'string' ? entry.wanted : '';
+    const latest = typeof entry.latest === 'string' ? entry.latest : '';
+    const type = typeof entry.type === 'string' ? entry.type : '';
+    if (!wanted) continue;
+    outdated.set(name, { current, wanted, latest, type });
+  }
+  return outdated;
+};
+
+const markAuditChanges = (changes, audit) => {
+  if (!audit) return changes;
+  const marked = [];
+  for (const change of changes) {
+    if (change.action === 'removed' || change.section === 'field') {
+      marked.push(change);
+      continue;
+    }
+    const found = audit.get(change.name);
+    if (!found) {
+      marked.push(change);
+      continue;
+    }
+    marked.push({ ...change, audit: found });
+  }
+  return marked;
+};
+
+const markOutdatedChanges = (changes, outdated) => {
+  if (!outdated) return changes;
+  const marked = [];
+  for (const change of changes) {
+    if (change.action === 'removed' || change.section === 'field') {
+      marked.push(change);
+      continue;
+    }
+    const found = outdated.get(change.name);
+    if (!found) {
+      marked.push(change);
+      continue;
+    }
+    if (found.wanted && found.wanted === found.current) {
+      marked.push(change);
+      continue;
+    }
+    marked.push({ ...change, outdated: found });
+  }
+  return marked;
+};
+
+module.exports = {
+  parseAuditReport,
+  parseOutdatedReport,
+  markAuditChanges,
+  markOutdatedChanges,
+};

package/lib/deps/rows.js

@@ -0,0 +1,176 @@
+'use strict';
+
+const { countSides, isCtxType } = require('../diff.js');
+
+const DEP_CAPTION = 'Dependencies in package.json & package-lock.json';
+
+const changeMarks = (change) => {
+  const marks = [];
+  if (change.unused) marks.push('unused');
+  if (change.outdated && !change.propose) marks.push('outdated');
+  if (change.audit) marks.push(change.audit.severity);
+  return marks;
+};
+
+const changeSources = (change) => {
+  const sources = [];
+  if (change.unused) {
+    sources.push('npm uninstall');
+    return sources;
+  }
+  if (change.propose && change.outdated) sources.push('npm outdated');
+  if (change.audit) sources.push('npm audit');
+  return sources;
+};
+
+const sectionTitle = (section, action, marks, sources) => {
+  const title = action === 'changed' ? 'version changed' : action;
+  const kind = section.replace(/ies$/, 'y');
+  let label = `${kind} ${title}`;
+  if (section === 'field') label = `package.json ${title}`;
+  if (section === 'resolved' && action === 'vulnerable') {
+    label = 'lockfile vulnerable';
+  } else if (section === 'resolved') {
+    label = `lockfile resolved ${title}`;
+  }
+  if (marks.includes('unused')) {
+    label = `${kind} unused`;
+    const extra = [];
+    for (const mark of marks) {
+      if (mark !== 'unused') extra.push(mark);
+    }
+    if (extra.length) label = `${label}, ${extra.join(', ')}`;
+  } else if (marks.length) {
+    label = `${label}, ${marks.join(', ')}`;
+  }
+  if (!sources.length) return label;
+  return `${sources.join(', ')}: ${label}`;
+};
+
+const entryText = (change, side) => {
+  const version = side === 'old' ? change.from : change.to;
+  return `"${change.name}": "${version}"`;
+};
+
+const ctxLine = (text) => {
+  const type = 'ctx';
+  return { type, text };
+};
+
+const warnLine = (text) => {
+  const type = 'warn';
+  return { type, text };
+};
+
+const noteLine = (text) => {
+  const type = 'note';
+  return { type, text };
+};
+
+const noteSepLine = () => {
+  const type = 'noteSep';
+  const text = '';
+  return { type, text };
+};
+
+const changeLine = (type, change, side) => {
+  const text = entryText(change, side);
+  return { type, text };
+};
+
+const pushChangeLines = (rows, change) => {
+  if (change.unused) {
+    const side = change.action === 'added' ? 'new' : 'old';
+    rows.push(changeLine('del', change, side));
+    return;
+  }
+  if (change.action === 'added') {
+    rows.push(changeLine('add', change, 'new'));
+    return;
+  }
+  if (change.action === 'removed') {
+    rows.push(changeLine('del', change, 'old'));
+    return;
+  }
+  if (change.from === change.to) {
+    rows.push(changeLine('ctx', change, 'old'));
+    return;
+  }
+  rows.push(changeLine('del', change, 'old'));
+  rows.push(changeLine('add', change, 'new'));
+};
+
+const lockCountText = (oldCount, newCount) => {
+  if (oldCount === newCount) return '';
+  return `lockfile packages  ${oldCount} → ${newCount}`;
+};
+
+const auditNoteTexts = (audit) => {
+  if (!audit) return [];
+  const notes = [];
+  if (Array.isArray(audit.titles)) {
+    for (const note of audit.titles) {
+      if (note && !notes.includes(note)) notes.push(note);
+    }
+  } else if (audit.title) {
+    notes.push(audit.title);
+  }
+  const severity = audit.severity;
+  if (!notes.length) return [`npm audit  ${severity}`];
+  const texts = [];
+  for (const note of notes) {
+    texts.push(`npm audit  ${severity}  ${note}`);
+  }
+  return texts;
+};
+
+const pushAuditNotes = (rows, audit) => {
+  const texts = auditNoteTexts(audit);
+  if (!texts.length) return;
+  rows.push(ctxLine(''));
+  let first = true;
+  for (const text of texts) {
+    if (!first) rows.push(noteSepLine());
+    first = false;
+    rows.push(noteLine(text));
+  }
+};
+
+const buildRows = (change, oldCount, newCount) => {
+  const rows = [ctxLine(DEP_CAPTION), ctxLine('')];
+  if (change) {
+    const marks = changeMarks(change);
+    const sources = changeSources(change);
+    const title = sectionTitle(change.section, change.action, marks, sources);
+    const audited = sources.includes('npm audit');
+    rows.push(audited ? warnLine(title) : ctxLine(title));
+    rows.push(ctxLine(''));
+    pushChangeLines(rows, change);
+    pushAuditNotes(rows, change.audit);
+  }
+  const countLine = lockCountText(oldCount, newCount);
+  if (countLine) {
+    if (rows.at(-1).text !== '') rows.push(ctxLine(''));
+    rows.push(ctxLine(countLine));
+  }
+  return rows;
+};
+
+const toHunkLine = (row, blockId) => {
+  const type = row.type;
+  const text = row.text;
+  const noNl = false;
+  const id = isCtxType(type) ? null : blockId;
+  return { type, text, noNl, blockId: id };
+};
+
+const makeHunk = (rows, blockId) => {
+  const lines = rows.map((row) => toHunkLine(row, blockId));
+  const counts = countSides(lines);
+  const oldCount = counts.oldCount;
+  const newCount = counts.newCount;
+  const header = `@@ -1,${oldCount} +1,${newCount} @@`;
+  return { oldStart: 1, oldCount, newStart: 1, newCount, header, lines };
+};
+
+module.exports = { DEP_CAPTION, buildRows, makeHunk };