reslop 0.1.9 → 0.2.0

package/lib/deps/reports.js

@@ -1,180 +0,0 @@
-'use strict';
-
-const { jsonParse, isHashObject } = require('metautil');
-
-const SEVERITY_RANK = { critical: 4, high: 3, moderate: 2, low: 1, info: 0 };
-
-const namedTitle = (name, title) => {
-  if (!title) return '';
-  if (!name) return title;
-  const prefix = `${name}: `;
-  if (title.startsWith(prefix)) return title;
-  return `${prefix}${title}`;
-};
-
-const viaNotes = (via, pkgName) => {
-  if (!Array.isArray(via)) return [];
-  const notes = [];
-  for (const item of via) {
-    if (!item || typeof item !== 'object') continue;
-    const title = typeof item.title === 'string' ? item.title : '';
-    if (!title) continue;
-    const hasName = typeof item.name === 'string' && item.name;
-    const named = hasName ? item.name : pkgName;
-    const note = namedTitle(named, title);
-    if (!notes.includes(note)) notes.push(note);
-  }
-  return notes;
-};
-
-const severityRank = (severity) => SEVERITY_RANK[severity] ?? 0;
-
-const auditFix = (entry) => {
-  const available = entry.fixAvailable;
-  if (!available || typeof available !== 'object') return '';
-  if (typeof available.version !== 'string') return '';
-  return available.version;
-};
-
-const auditEntryNames = (key, entry) => {
-  const names = [];
-  const primary = entry.name || key;
-  if (primary) names.push(primary);
-  const effects = entry.effects;
-  if (!Array.isArray(effects)) return names;
-  for (const effect of effects) {
-    if (typeof effect === 'string' && effect) names.push(effect);
-  }
-  return names;
-};
-
-const keepHighestAudit = (audit, name, severity, fix, range, notes) => {
-  if (!name || !severity || severity === 'info') return;
-  const titles = [];
-  for (const note of notes) {
-    if (note && !titles.includes(note)) titles.push(note);
-  }
-  const prev = audit.get(name);
-  if (prev && severityRank(prev.severity) >= severityRank(severity)) {
-    const merged = [...prev.titles];
-    for (const note of titles) {
-      if (!merged.includes(note)) merged.push(note);
-    }
-    const next = {
-      ...prev,
-      titles: merged,
-      fix: prev.fix || fix,
-      range: prev.range || range,
-    };
-    audit.set(name, next);
-    return;
-  }
-  const title = titles[0] || '';
-  const next = { name, severity, title, titles, fix, range };
-  next.fix ||= '';
-  next.range ||= '';
-  audit.set(name, next);
-};
-
-const parseAuditReport = (text) => {
-  const audit = new Map();
-  if (!text || !`${text}`.trim()) return audit;
-  const data = jsonParse(text);
-  if (!isHashObject(data)) return audit;
-  const vulns = data.vulnerabilities;
-  if (vulns && typeof vulns === 'object') {
-    for (const key of Object.keys(vulns)) {
-      const entry = vulns[key];
-      if (!entry || typeof entry !== 'object') continue;
-      const severity = entry.severity;
-      const names = auditEntryNames(key, entry);
-      const pkgName = entry.name || key;
-      const titles = viaNotes(entry.via, pkgName);
-      const fix = auditFix(entry);
-      const range = typeof entry.range === 'string' ? entry.range : '';
-      for (const name of names) {
-        keepHighestAudit(audit, name, severity, fix, range, titles);
-      }
-    }
-  }
-  const advisories = data.advisories;
-  if (advisories && typeof advisories === 'object') {
-    for (const entry of Object.values(advisories)) {
-      if (!entry || typeof entry !== 'object') continue;
-      const name = entry.module_name || entry.name;
-      const severity = entry.severity;
-      const raw = typeof entry.title === 'string' ? entry.title : '';
-      const title = namedTitle(name, raw);
-      const titles = title ? [title] : [];
-      const fix = auditFix(entry);
-      const range = typeof entry.range === 'string' ? entry.range : '';
-      keepHighestAudit(audit, name, severity, fix, range, titles);
-    }
-  }
-  return audit;
-};
-
-const parseOutdatedReport = (text) => {
-  const outdated = new Map();
-  if (!text || !`${text}`.trim()) return outdated;
-  const data = jsonParse(text);
-  if (!isHashObject(data)) return outdated;
-  for (const name of Object.keys(data)) {
-    const entry = data[name];
-    if (!entry || typeof entry !== 'object') continue;
-    const current = typeof entry.current === 'string' ? entry.current : '';
-    const wanted = typeof entry.wanted === 'string' ? entry.wanted : '';
-    const latest = typeof entry.latest === 'string' ? entry.latest : '';
-    const type = typeof entry.type === 'string' ? entry.type : '';
-    if (!wanted) continue;
-    outdated.set(name, { current, wanted, latest, type });
-  }
-  return outdated;
-};
-
-const markAuditChanges = (changes, audit) => {
-  if (!audit) return changes;
-  const marked = [];
-  for (const change of changes) {
-    if (change.action === 'removed' || change.section === 'field') {
-      marked.push(change);
-      continue;
-    }
-    const found = audit.get(change.name);
-    if (!found) {
-      marked.push(change);
-      continue;
-    }
-    marked.push({ ...change, audit: found });
-  }
-  return marked;
-};
-
-const markOutdatedChanges = (changes, outdated) => {
-  if (!outdated) return changes;
-  const marked = [];
-  for (const change of changes) {
-    if (change.action === 'removed' || change.section === 'field') {
-      marked.push(change);
-      continue;
-    }
-    const found = outdated.get(change.name);
-    if (!found) {
-      marked.push(change);
-      continue;
-    }
-    if (found.wanted && found.wanted === found.current) {
-      marked.push(change);
-      continue;
-    }
-    marked.push({ ...change, outdated: found });
-  }
-  return marked;
-};
-
-module.exports = {
-  parseAuditReport,
-  parseOutdatedReport,
-  markAuditChanges,
-  markOutdatedChanges,
-};

package/lib/deps/rows.js

@@ -1,176 +0,0 @@
-'use strict';
-
-const { countSides, isCtxType } = require('../diff.js');
-
-const DEP_CAPTION = 'Dependencies in package.json & package-lock.json';
-
-const changeMarks = (change) => {
-  const marks = [];
-  if (change.unused) marks.push('unused');
-  if (change.outdated && !change.propose) marks.push('outdated');
-  if (change.audit) marks.push(change.audit.severity);
-  return marks;
-};
-
-const changeSources = (change) => {
-  const sources = [];
-  if (change.unused) {
-    sources.push('npm uninstall');
-    return sources;
-  }
-  if (change.propose && change.outdated) sources.push('npm outdated');
-  if (change.audit) sources.push('npm audit');
-  return sources;
-};
-
-const sectionTitle = (section, action, marks, sources) => {
-  const title = action === 'changed' ? 'version changed' : action;
-  const kind = section.replace(/ies$/, 'y');
-  let label = `${kind} ${title}`;
-  if (section === 'field') label = `package.json ${title}`;
-  if (section === 'resolved' && action === 'vulnerable') {
-    label = 'lockfile vulnerable';
-  } else if (section === 'resolved') {
-    label = `lockfile resolved ${title}`;
-  }
-  if (marks.includes('unused')) {
-    label = `${kind} unused`;
-    const extra = [];
-    for (const mark of marks) {
-      if (mark !== 'unused') extra.push(mark);
-    }
-    if (extra.length) label = `${label}, ${extra.join(', ')}`;
-  } else if (marks.length) {
-    label = `${label}, ${marks.join(', ')}`;
-  }
-  if (!sources.length) return label;
-  return `${sources.join(', ')}: ${label}`;
-};
-
-const entryText = (change, side) => {
-  const version = side === 'old' ? change.from : change.to;
-  return `"${change.name}": "${version}"`;
-};
-
-const ctxLine = (text) => {
-  const type = 'ctx';
-  return { type, text };
-};
-
-const warnLine = (text) => {
-  const type = 'warn';
-  return { type, text };
-};
-
-const noteLine = (text) => {
-  const type = 'note';
-  return { type, text };
-};
-
-const noteSepLine = () => {
-  const type = 'noteSep';
-  const text = '';
-  return { type, text };
-};
-
-const changeLine = (type, change, side) => {
-  const text = entryText(change, side);
-  return { type, text };
-};
-
-const pushChangeLines = (rows, change) => {
-  if (change.unused) {
-    const side = change.action === 'added' ? 'new' : 'old';
-    rows.push(changeLine('del', change, side));
-    return;
-  }
-  if (change.action === 'added') {
-    rows.push(changeLine('add', change, 'new'));
-    return;
-  }
-  if (change.action === 'removed') {
-    rows.push(changeLine('del', change, 'old'));
-    return;
-  }
-  if (change.from === change.to) {
-    rows.push(changeLine('ctx', change, 'old'));
-    return;
-  }
-  rows.push(changeLine('del', change, 'old'));
-  rows.push(changeLine('add', change, 'new'));
-};
-
-const lockCountText = (oldCount, newCount) => {
-  if (oldCount === newCount) return '';
-  return `lockfile packages  ${oldCount} → ${newCount}`;
-};
-
-const auditNoteTexts = (audit) => {
-  if (!audit) return [];
-  const notes = [];
-  if (Array.isArray(audit.titles)) {
-    for (const note of audit.titles) {
-      if (note && !notes.includes(note)) notes.push(note);
-    }
-  } else if (audit.title) {
-    notes.push(audit.title);
-  }
-  const severity = audit.severity;
-  if (!notes.length) return [`npm audit  ${severity}`];
-  const texts = [];
-  for (const note of notes) {
-    texts.push(`npm audit  ${severity}  ${note}`);
-  }
-  return texts;
-};
-
-const pushAuditNotes = (rows, audit) => {
-  const texts = auditNoteTexts(audit);
-  if (!texts.length) return;
-  rows.push(ctxLine(''));
-  let first = true;
-  for (const text of texts) {
-    if (!first) rows.push(noteSepLine());
-    first = false;
-    rows.push(noteLine(text));
-  }
-};
-
-const buildRows = (change, oldCount, newCount) => {
-  const rows = [ctxLine(DEP_CAPTION), ctxLine('')];
-  if (change) {
-    const marks = changeMarks(change);
-    const sources = changeSources(change);
-    const title = sectionTitle(change.section, change.action, marks, sources);
-    const audited = sources.includes('npm audit');
-    rows.push(audited ? warnLine(title) : ctxLine(title));
-    rows.push(ctxLine(''));
-    pushChangeLines(rows, change);
-    pushAuditNotes(rows, change.audit);
-  }
-  const countLine = lockCountText(oldCount, newCount);
-  if (countLine) {
-    if (rows.at(-1).text !== '') rows.push(ctxLine(''));
-    rows.push(ctxLine(countLine));
-  }
-  return rows;
-};
-
-const toHunkLine = (row, blockId) => {
-  const type = row.type;
-  const text = row.text;
-  const noNl = false;
-  const id = isCtxType(type) ? null : blockId;
-  return { type, text, noNl, blockId: id };
-};
-
-const makeHunk = (rows, blockId) => {
-  const lines = rows.map((row) => toHunkLine(row, blockId));
-  const counts = countSides(lines);
-  const oldCount = counts.oldCount;
-  const newCount = counts.newCount;
-  const header = `@@ -1,${oldCount} +1,${newCount} @@`;
-  return { oldStart: 1, oldCount, newStart: 1, newCount, header, lines };
-};
-
-module.exports = { DEP_CAPTION, buildRows, makeHunk };

package/lib/deps/scan.js

@@ -1,138 +0,0 @@
-'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const manifest = require('./manifest.js');
-const { MANIFEST, SECTION_KEYS, parseJson, readSections } = manifest;
-
-const usage = require('./usage.js');
-const { SOURCE_EXT, collectUsedFromText, collectUsedFromScripts } = usage;
-const { pkgHasExportEntry } = usage;
-
-const SKIP_WALK = ['node_modules', '.git', '.review', 'coverage', 'dist'];
-
-const collectUsedFromManifest = (used, rel) => {
-  let text;
-  try {
-    text = fs.readFileSync(rel, 'utf8');
-  } catch {
-    return;
-  }
-  const pkg = parseJson(text);
-  if (!pkg) return;
-  collectUsedFromScripts(used, pkg.scripts);
-};
-
-const walkUsedNames = (used, dir) => {
-  let entries;
-  try {
-    entries = fs.readdirSync(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (entry.isSymbolicLink()) continue;
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      if (SKIP_WALK.includes(entry.name)) continue;
-      if (entry.name.startsWith('.')) continue;
-      walkUsedNames(used, full);
-      continue;
-    }
-    if (entry.name === MANIFEST) {
-      collectUsedFromManifest(used, full);
-      continue;
-    }
-    const ext = path.extname(entry.name);
-    if (!SOURCE_EXT.includes(ext)) continue;
-    let text;
-    try {
-      text = fs.readFileSync(full, 'utf8');
-    } catch {
-      continue;
-    }
-    collectUsedFromText(used, text);
-  }
-};
-
-const collectUsedNames = (root) => {
-  const used = new Set();
-  if (!root) return used;
-  walkUsedNames(used, root);
-  return used;
-};
-
-const depModuleParts = (name) => {
-  if (!name.startsWith('@')) return [name];
-  const parts = name.split('/');
-  if (parts.length < 2) return [];
-  return parts.slice(0, 2);
-};
-
-const readDepPkg = (root, pkgDir, name) => {
-  if (!root || !name) return null;
-  const parts = depModuleParts(name);
-  if (!parts.length) return null;
-  const nested = pkgDir && pkgDir !== '.' ? pkgDir : '';
-  let dir = nested ? path.join(root, nested) : root;
-  while (true) {
-    const file = path.join(dir, 'node_modules', ...parts, MANIFEST);
-    let text = '';
-    try {
-      text = fs.readFileSync(file, 'utf8');
-    } catch {
-      // Missing node_modules copy; try a parent directory.
-    }
-    if (text) return parseJson(text);
-    const parent = path.dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-};
-
-const depHasExportEntry = (root, pkgDir, name) => {
-  const pkg = readDepPkg(root, pkgDir, name);
-  if (!pkg) return true;
-  return pkgHasExportEntry(pkg);
-};
-
-const collectExportEntries = (root, pkgDir, names) => {
-  const entries = new Map();
-  if (!root) return entries;
-  for (const name of names) {
-    const hasExport = depHasExportEntry(root, pkgDir, name);
-    entries.set(name, hasExport);
-  }
-  return entries;
-};
-
-const declaredDepNames = (root, pkgDir) => {
-  const nested = pkgDir && pkgDir !== '.' ? pkgDir : '';
-  const file = path.join(root, nested, MANIFEST);
-  let text;
-  try {
-    text = fs.readFileSync(file, 'utf8');
-  } catch {
-    return [];
-  }
-  const maps = readSections(parseJson(text));
-  const names = [];
-  for (const key of SECTION_KEYS) {
-    for (const name of maps[key].keys()) names.push(name);
-  }
-  return names;
-};
-
-const collectExportMeta = (root, extra = {}) => {
-  if (extra.exportEntries !== undefined) return extra.exportEntries;
-  const pkgDir = extra.dir ?? '.';
-  const names = extra.names ?? declaredDepNames(root, pkgDir);
-  return collectExportEntries(root, pkgDir, names);
-};
-
-module.exports = {
-  collectUsedNames,
-  collectExportEntries,
-  collectExportMeta,
-};

package/lib/deps/usage.js

@@ -1,68 +0,0 @@
-'use strict';
-
-const SOURCE_EXT = ['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts'];
-const REQUIRE_SPEC = /require\(\s*['"]([^'"]+)['"]\s*\)/g;
-const FROM_SPEC = /\bfrom\s+['"]([^'"]+)['"]/g;
-const IMPORT_FILE = /import\s+['"]([^'"]+)['"]/g;
-const IMPORT_CALL = /import\(\s*['"]([^'"]+)['"]\s*\)/g;
-
-const toPackageName = (spec) => {
-  if (!spec || spec.startsWith('.') || spec.startsWith('/')) return '';
-  if (spec.startsWith('node:')) return '';
-  if (spec.startsWith('@')) {
-    const parts = spec.split('/');
-    if (parts.length < 2) return '';
-    return `${parts[0]}/${parts[1]}`;
-  }
-  return spec.split('/')[0];
-};
-
-const addSpec = (used, spec) => {
-  const name = toPackageName(spec);
-  if (name) used.add(name);
-};
-
-const addMatches = (used, text, pattern) => {
-  const matches = text.matchAll(pattern);
-  for (const match of matches) addSpec(used, match[1]);
-};
-
-const collectUsedFromText = (used, text) => {
-  addMatches(used, text, REQUIRE_SPEC);
-  addMatches(used, text, FROM_SPEC);
-  addMatches(used, text, IMPORT_FILE);
-  addMatches(used, text, IMPORT_CALL);
-};
-
-const collectUsedFromScripts = (used, scripts) => {
-  if (!scripts || typeof scripts !== 'object') return;
-  for (const script of Object.values(scripts)) {
-    const tokens = `${script}`.split(/[\s;&|]+/);
-    for (const token of tokens) {
-      if (!token || token.startsWith('-')) continue;
-      if (token === 'npx' || token === 'npm' || token === 'node') continue;
-      addSpec(used, token);
-    }
-  }
-};
-
-const pkgHasExportEntry = (pkg) => {
-  if (!pkg || typeof pkg !== 'object') return false;
-  const main = pkg.main;
-  if (typeof main === 'string' && main) return true;
-  const esm = pkg.module;
-  if (typeof esm === 'string' && esm) return true;
-  const exported = pkg.exports;
-  if (typeof exported === 'string' && exported) return true;
-  if (!exported || typeof exported !== 'object') return false;
-  if (Array.isArray(exported)) return exported.length > 0;
-  return Object.keys(exported).length > 0;
-};
-
-module.exports = {
-  SOURCE_EXT,
-  toPackageName,
-  collectUsedFromText,
-  collectUsedFromScripts,
-  pkgHasExportEntry,
-};

package/lib/deps/versions.js

@@ -1,119 +0,0 @@
-'use strict';
-
-const { SECTION_KEYS } = require('./manifest.js');
-
-const applyWantedRange = (declared, wanted) => {
-  if (!wanted) return declared ?? '';
-  if (!declared) return wanted;
-  if (/^(file:|git[+@:]|workspace:|https?:|npm:)/.test(declared)) {
-    return declared;
-  }
-  if (declared.includes(' ') || declared.includes('|')) return declared;
-  if (declared.includes('<') || declared.includes('>')) return declared;
-  const prefix = declared.startsWith('^') || declared.startsWith('~');
-  const mark = prefix ? declared[0] : '';
-  return `${mark}${wanted}`;
-};
-
-const findDeclared = (pkg, name, type) => {
-  if (type && SECTION_KEYS.includes(type)) {
-    const map = pkg[type];
-    if (map && typeof map[name] === 'string') {
-      return { section: type, version: map[name] };
-    }
-  }
-  for (const section of SECTION_KEYS) {
-    const map = pkg[section];
-    if (map && typeof map[name] === 'string') {
-      return { section, version: map[name] };
-    }
-  }
-  return null;
-};
-
-const VER_CORE = /^(\d+)\.(\d+)\.(\d+)/;
-
-const parseVer = (text) => {
-  const match = `${text}`.match(VER_CORE);
-  if (!match) return null;
-  const major = Number(match[1]);
-  const minor = Number(match[2]);
-  const patch = Number(match[3]);
-  return [major, minor, patch];
-};
-
-const fmtVer = (parts) => `${parts[0]}.${parts[1]}.${parts[2]}`;
-
-const cmpVer = (left, right) => {
-  if (left[0] !== right[0]) return left[0] - right[0];
-  if (left[1] !== right[1]) return left[1] - right[1];
-  return left[2] - right[2];
-};
-
-const bumpPatch = (parts) => {
-  const major = parts[0];
-  const minor = parts[1];
-  const patch = parts[2] + 1;
-  return [major, minor, patch];
-};
-
-const clauseUpper = (clause) => {
-  const pattern = /(<=?)\s*(\d+\.\d+\.\d+)/g;
-  const matches = clause.matchAll(pattern);
-  let best = null;
-  for (const match of matches) {
-    const op = match[1];
-    const parsed = parseVer(match[2]);
-    if (!parsed) continue;
-    if (best && cmpVer(parsed, best.ver) >= 0) continue;
-    best = { op, ver: parsed };
-  }
-  return best;
-};
-
-const patchedFromRange = (current, range) => {
-  if (!current || !range) return '';
-  const now = parseVer(current);
-  if (!now) return '';
-  const clauses = `${range}`.split('||');
-  for (const clause of clauses) {
-    const upper = clauseUpper(clause);
-    if (!upper) continue;
-    if (now[0] !== upper.ver[0]) continue;
-    if (cmpVer(now, upper.ver) > 0) continue;
-    if (upper.op === '<') return fmtVer(upper.ver);
-    return fmtVer(bumpPatch(upper.ver));
-  }
-  return '';
-};
-
-const sameMajor = (from, to) => {
-  const left = parseVer(from);
-  const right = parseVer(to);
-  if (!left || !right) return false;
-  return left[0] === right[0];
-};
-
-const proposedLockVersion = (current, vul) => {
-  if (!current) return '';
-  if (!vul) return current;
-  const fix = vul.fix;
-  if (fix && sameMajor(current, fix) && fix !== current) return fix;
-  const patched = patchedFromRange(current, vul.range);
-  if (patched && patched !== current) return patched;
-  return current;
-};
-
-const proposedWanted = (out, vul) => {
-  if (out && out.wanted && out.wanted !== out.current) return out.wanted;
-  if (vul && vul.fix) return vul.fix;
-  return '';
-};
-
-module.exports = {
-  applyWantedRange,
-  findDeclared,
-  patchedFromRange,
-  proposedLockVersion,
-  proposedWanted,
-};