reslop 0.2.4 → 0.2.6

package/lib/deps.js

@@ -6,31 +6,43 @@ const metautil = require('metautil');
 const { jsonParse, isHashObject } = metautil;
 const files = require('./files.js');
 const { itemPath } = files;
+const utilities = require('./utilities.js');
+const { asText } = utilities;
 const manifest = require('./manifest.js');
-const { MANIFEST, LOCKFILE, SECTION_KEYS, depFileMeta, relOf } = manifest;
-const { listFilePath, readSections, lockEntries, lockPackageCount } = manifest;
-const { mergeDepFile, findDeclared, applyWantedRange } = manifest;
-const { patchedFromRange, proposedLockVersion, proposedWanted } = manifest;
+const { MANIFEST, LOCKFILE, SECTION_KEYS, isObject } = manifest;
+const { depFileMeta, relOf, listFilePath, readSections } = manifest;
+const { lockEntries, findDeclared, applyWantedRange } = manifest;
+const { proposedLockVersion, proposedWanted } = manifest;
 const depDiff = require('./deps-diff.js');
-const { diffSections, mergeResolved, summarizeGroup, collectGroups } = depDiff;
-const { takeManifestItems, foldedDepNames, stripFoldedDepItem } = depDiff;
+const { summarizeGroup, collectGroups, takeManifestItems } = depDiff;
+const { foldedDepNames, stripFoldedDepItem } = depDiff;
 const { makeDepItems, stubFileItem } = depDiff;
 
 const SOURCE_EXT = ['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts'];
-const REQUIRE_SPEC = /require\(\s*['"]([^'"]+)['"]\s*\)/g;
-const FROM_SPEC = /\bfrom\s+['"]([^'"]+)['"]/g;
-const IMPORT_FILE = /import\s+['"]([^'"]+)['"]/g;
-const IMPORT_CALL = /import\(\s*['"]([^'"]+)['"]\s*\)/g;
+const SPEC_PATTERNS = [
+  /require\(\s*['"]([^'"]+)['"]\s*\)/g,
+  /\bfrom\s+['"]([^'"]+)['"]/g,
+  /import\s+['"]([^'"]+)['"]/g,
+  /import\(\s*['"]([^'"]+)['"]\s*\)/g,
+];
+const SCRIPT_RUNNERS = ['npx', 'npm', 'node'];
+const SKIP_WALK = ['node_modules', '.git', '.review', 'coverage', 'dist'];
+const SEVERITY_RANK = { critical: 4, high: 3, moderate: 2, low: 1, info: 0 };
+
+const readText = (file) => {
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return '';
+  }
+};
 
 const toPackageName = (spec) => {
   if (!spec || spec.startsWith('.') || spec.startsWith('/')) return '';
   if (spec.startsWith('node:')) return '';
-  if (spec.startsWith('@')) {
-    const parts = spec.split('/');
-    if (parts.length < 2) return '';
-    return `${parts[0]}/${parts[1]}`;
-  }
-  return spec.split('/')[0];
+  const parts = spec.split('/');
+  if (!spec.startsWith('@')) return parts[0];
+  return parts.length < 2 ? '' : `${parts[0]}/${parts[1]}`;
 };
 
 const addSpec = (used, spec) => {
@@ -38,54 +50,39 @@ const addSpec = (used, spec) => {
   if (name) used.add(name);
 };
 
-const addMatches = (used, text, pattern) => {
-  const matches = text.matchAll(pattern);
-  for (const match of matches) addSpec(used, match[1]);
-};
-
 const collectUsedFromText = (used, text) => {
-  addMatches(used, text, REQUIRE_SPEC);
-  addMatches(used, text, FROM_SPEC);
-  addMatches(used, text, IMPORT_FILE);
-  addMatches(used, text, IMPORT_CALL);
+  for (const pattern of SPEC_PATTERNS) {
+    for (const match of text.matchAll(pattern)) addSpec(used, match[1]);
+  }
 };
 
 const collectUsedFromScripts = (used, scripts) => {
-  if (!scripts || typeof scripts !== 'object') return;
+  if (!isObject(scripts)) return;
   for (const script of Object.values(scripts)) {
-    const tokens = `${script}`.split(/[\s;&|]+/);
-    for (const token of tokens) {
+    for (const token of `${script}`.split(/[\s;&|]+/)) {
       if (!token || token.startsWith('-')) continue;
-      if (token === 'npx' || token === 'npm' || token === 'node') continue;
-      addSpec(used, token);
+      if (!SCRIPT_RUNNERS.includes(token)) addSpec(used, token);
     }
   }
 };
 
+const hasText = (value) => typeof value === 'string' && value !== '';
+
 const pkgHasExportEntry = (pkg) => {
-  if (!pkg || typeof pkg !== 'object') return false;
-  const main = pkg.main;
-  if (typeof main === 'string' && main) return true;
-  const esm = pkg.module;
-  if (typeof esm === 'string' && esm) return true;
+  if (!isObject(pkg)) return false;
+  if (hasText(pkg.main) || hasText(pkg.module)) return true;
   const exported = pkg.exports;
-  if (typeof exported === 'string' && exported) return true;
-  if (!exported || typeof exported !== 'object') return false;
-  if (Array.isArray(exported)) return exported.length > 0;
-  return Object.keys(exported).length > 0;
+  if (hasText(exported)) return true;
+  return isObject(exported) && Object.keys(exported).length > 0;
 };
 
-const isRuntimeFile = (value) => {
-  if (typeof value !== 'string' || !value) return false;
-  return !value.endsWith('.d.ts');
-};
+const isRuntimeFile = (value) => hasText(value) && !value.endsWith('.d.ts');
 
 const hasRuntimeExport = (value) => {
   if (isRuntimeFile(value)) return true;
   if (Array.isArray(value)) return value.some(hasRuntimeExport);
-  if (!value || typeof value !== 'object') return false;
-  const keys = Object.keys(value);
-  for (const key of keys) {
+  if (!isObject(value)) return false;
+  for (const key of Object.keys(value)) {
     if (key === 'types' || key === 'typings') continue;
     if (hasRuntimeExport(value[key])) return true;
   }
@@ -93,35 +90,17 @@ const hasRuntimeExport = (value) => {
 };
 
 const pkgHasBin = (pkg) => {
-  if (!pkg || typeof pkg !== 'object') return false;
   const bin = pkg.bin;
   if (typeof bin === 'string') return !!bin;
-  if (!bin || typeof bin !== 'object' || Array.isArray(bin)) return false;
-  return Object.keys(bin).length > 0;
+  return isHashObject(bin) && Object.keys(bin).length > 0;
 };
 
 const pkgExportsLibrary = (pkg) => {
-  if (!pkg || typeof pkg !== 'object') return false;
-  if (pkgHasBin(pkg)) return false;
-  if (isRuntimeFile(pkg.main)) return true;
-  if (isRuntimeFile(pkg.module)) return true;
+  if (!isObject(pkg) || pkgHasBin(pkg)) return false;
+  if (isRuntimeFile(pkg.main) || isRuntimeFile(pkg.module)) return true;
   return hasRuntimeExport(pkg.exports);
 };
 
-const SKIP_WALK = ['node_modules', '.git', '.review', 'coverage', 'dist'];
-
-const collectUsedFromManifest = (used, rel) => {
-  let text;
-  try {
-    text = fs.readFileSync(rel, 'utf8');
-  } catch {
-    return;
-  }
-  const pkg = jsonParse(text);
-  if (!pkg) return;
-  collectUsedFromScripts(used, pkg.scripts);
-};
-
 const walkUsedNames = (used, dir) => {
   let entries;
   try {
@@ -133,55 +112,36 @@ const walkUsedNames = (used, dir) => {
     if (entry.isSymbolicLink()) continue;
     const full = path.join(dir, entry.name);
     if (entry.isDirectory()) {
-      if (SKIP_WALK.includes(entry.name)) continue;
-      if (entry.name.startsWith('.')) continue;
-      walkUsedNames(used, full);
-      continue;
-    }
-    if (entry.name === MANIFEST) {
-      collectUsedFromManifest(used, full);
-      continue;
+      const skip = SKIP_WALK.includes(entry.name) || entry.name.startsWith('.');
+      if (!skip) walkUsedNames(used, full);
+    } else if (entry.name === MANIFEST) {
+      collectUsedFromScripts(used, jsonParse(readText(full))?.scripts);
+    } else if (SOURCE_EXT.includes(path.extname(entry.name))) {
+      collectUsedFromText(used, readText(full));
     }
-    const ext = path.extname(entry.name);
-    if (!SOURCE_EXT.includes(ext)) continue;
-    let text;
-    try {
-      text = fs.readFileSync(full, 'utf8');
-    } catch {
-      continue;
-    }
-    collectUsedFromText(used, text);
   }
 };
 
 const collectUsedNames = (root) => {
   const used = new Set();
-  if (!root) return used;
-  walkUsedNames(used, root);
+  if (root) walkUsedNames(used, root);
   return used;
 };
 
 const depModuleParts = (name) => {
   if (!name.startsWith('@')) return [name];
   const parts = name.split('/');
-  if (parts.length < 2) return [];
-  return parts.slice(0, 2);
+  return parts.length < 2 ? [] : parts.slice(0, 2);
 };
 
 const readDepPkg = (root, pkgDir, name) => {
-  if (!root || !name) return null;
+  if (!name) return null;
   const parts = depModuleParts(name);
   if (!parts.length) return null;
-  const nested = pkgDir && pkgDir !== '.' ? pkgDir : '';
-  let dir = nested ? path.join(root, nested) : root;
+  let dir = path.join(root, pkgDir || '.');
   while (true) {
     const file = path.join(dir, 'node_modules', ...parts, MANIFEST);
-    let text = '';
-    try {
-      text = fs.readFileSync(file, 'utf8');
-    } catch {
-      // Missing node_modules copy; try a parent directory.
-    }
+    const text = readText(file);
     if (text) return jsonParse(text);
     const parent = path.dirname(dir);
     if (parent === dir) return null;
@@ -189,61 +149,37 @@ const readDepPkg = (root, pkgDir, name) => {
   }
 };
 
-const depHasExportEntry = (root, pkgDir, name) => {
-  const pkg = readDepPkg(root, pkgDir, name);
-  if (!pkg) return false;
-  return pkgExportsLibrary(pkg);
-};
-
 const collectExportEntries = (root, pkgDir, names) => {
   const entries = new Map();
   if (!root) return entries;
   for (const name of names) {
-    const hasExport = depHasExportEntry(root, pkgDir, name);
-    entries.set(name, hasExport);
+    const pkg = readDepPkg(root, pkgDir, name);
+    entries.set(name, !!pkg && pkgExportsLibrary(pkg));
   }
   return entries;
 };
 
-const declaredDepNames = (root, pkgDir) => {
-  const nested = pkgDir && pkgDir !== '.' ? pkgDir : '';
-  const file = path.join(root, nested, MANIFEST);
-  let text;
-  try {
-    text = fs.readFileSync(file, 'utf8');
-  } catch {
-    return [];
-  }
-  const maps = readSections(jsonParse(text));
-  return SECTION_KEYS.flatMap((key) => [...maps[key].keys()]);
-};
-
-const collectExportMeta = (root, extra = {}) => {
-  if (extra.exportEntries !== undefined) return extra.exportEntries;
-  const pkgDir = extra.dir ?? '.';
-  const names = extra.names ?? declaredDepNames(root, pkgDir);
-  return collectExportEntries(root, pkgDir, names);
+const collectExportMeta = (root) => {
+  const pkg = jsonParse(readText(path.join(root, MANIFEST)));
+  const maps = readSections(pkg);
+  const names = SECTION_KEYS.flatMap((key) => [...maps[key].keys()]);
+  return collectExportEntries(root, '.', names);
 };
 
-const SEVERITY_RANK = { critical: 4, high: 3, moderate: 2, low: 1, info: 0 };
-
 const namedTitle = (name, title) => {
   if (!title) return '';
   if (!name) return title;
   const prefix = `${name}: `;
-  if (title.startsWith(prefix)) return title;
-  return `${prefix}${title}`;
+  return title.startsWith(prefix) ? title : `${prefix}${title}`;
 };
 
 const viaNotes = (via, pkgName) => {
   if (!Array.isArray(via)) return [];
   const notes = [];
   for (const item of via) {
-    if (!item || typeof item !== 'object') continue;
-    const title = typeof item.title === 'string' ? item.title : '';
-    if (!title) continue;
-    const hasName = typeof item.name === 'string' && item.name;
-    const named = hasName ? item.name : pkgName;
+    const title = asText(item?.title);
+    if (!isObject(item) || !title) continue;
+    const named = hasText(item.name) ? item.name : pkgName;
     const note = namedTitle(named, title);
     if (!notes.includes(note)) notes.push(note);
   }
@@ -252,104 +188,87 @@ const viaNotes = (via, pkgName) => {
 
 const severityRank = (severity) => SEVERITY_RANK[severity] ?? 0;
 
-const auditFix = (entry) => {
-  const available = entry.fixAvailable;
-  if (!available || typeof available !== 'object') return '';
-  if (typeof available.version !== 'string') return '';
-  return available.version;
-};
+const auditFix = (entry) => asText(entry.fixAvailable?.version);
 
 const auditEntryNames = (key, entry) => {
-  const names = [];
+  const effects = Array.isArray(entry.effects) ? entry.effects : [];
+  const names = effects.filter(hasText);
   const primary = entry.name || key;
-  if (primary) names.push(primary);
-  const effects = entry.effects;
-  if (!Array.isArray(effects)) return names;
-  for (const effect of effects) {
-    if (typeof effect === 'string' && effect) names.push(effect);
-  }
-  return names;
+  return primary ? [primary, ...names] : names;
 };
 
-const keepHighestAudit = (audit, name, severity, fix, range, notes) => {
+const uniqueTexts = (list) => [...new Set(list.filter(Boolean))];
+
+const keepHighestAudit = (audit, found) => {
+  const { name, severity } = found;
   if (!name || !severity || severity === 'info') return;
-  const titles = [];
-  for (const note of notes) {
-    if (note && !titles.includes(note)) titles.push(note);
-  }
+  const titles = uniqueTexts(found.titles);
   const prev = audit.get(name);
   if (prev && severityRank(prev.severity) >= severityRank(severity)) {
-    const merged = [...prev.titles];
-    for (const note of titles) {
-      if (!merged.includes(note)) merged.push(note);
-    }
-    const next = {
+    audit.set(name, {
       ...prev,
-      titles: merged,
-      fix: prev.fix || fix,
-      range: prev.range || range,
-    };
-    audit.set(name, next);
+      titles: uniqueTexts([...prev.titles, ...titles]),
+      fix: prev.fix || found.fix,
+      range: prev.range || found.range,
+    });
     return;
   }
   const title = titles[0] || '';
-  const next = { name, severity, title, titles, fix, range };
-  next.fix ||= '';
-  next.range ||= '';
-  audit.set(name, next);
+  const fix = found.fix || '';
+  const range = found.range || '';
+  audit.set(name, { name, severity, title, titles, fix, range });
+};
+
+const vulnFindings = (vulns) => {
+  const found = [];
+  for (const key of Object.keys(vulns)) {
+    const entry = vulns[key];
+    if (!isObject(entry)) continue;
+    const { severity } = entry;
+    const titles = viaNotes(entry.via, entry.name || key);
+    const fix = auditFix(entry);
+    const range = asText(entry.range);
+    for (const name of auditEntryNames(key, entry)) {
+      found.push({ name, severity, fix, range, titles });
+    }
+  }
+  return found;
+};
+
+const advisoryFinding = (entry) => {
+  const name = entry.module_name || entry.name;
+  const title = namedTitle(name, asText(entry.title));
+  const titles = title ? [title] : [];
+  const fix = auditFix(entry);
+  const range = asText(entry.range);
+  return { name, severity: entry.severity, fix, range, titles };
 };
 
 const parseAuditReport = (text) => {
   const audit = new Map();
-  if (!text || !`${text}`.trim()) return audit;
-  const data = jsonParse(text);
+  const data = text ? jsonParse(text) : null;
   if (!isHashObject(data)) return audit;
-  const vulns = data.vulnerabilities;
-  if (vulns && typeof vulns === 'object') {
-    for (const key of Object.keys(vulns)) {
-      const entry = vulns[key];
-      if (!entry || typeof entry !== 'object') continue;
-      const severity = entry.severity;
-      const names = auditEntryNames(key, entry);
-      const pkgName = entry.name || key;
-      const titles = viaNotes(entry.via, pkgName);
-      const fix = auditFix(entry);
-      const range = typeof entry.range === 'string' ? entry.range : '';
-      for (const name of names) {
-        keepHighestAudit(audit, name, severity, fix, range, titles);
-      }
-    }
-  }
-  const advisories = data.advisories;
-  if (advisories && typeof advisories === 'object') {
-    for (const entry of Object.values(advisories)) {
-      if (!entry || typeof entry !== 'object') continue;
-      const name = entry.module_name || entry.name;
-      const severity = entry.severity;
-      const raw = typeof entry.title === 'string' ? entry.title : '';
-      const title = namedTitle(name, raw);
-      const titles = title ? [title] : [];
-      const fix = auditFix(entry);
-      const range = typeof entry.range === 'string' ? entry.range : '';
-      keepHighestAudit(audit, name, severity, fix, range, titles);
-    }
+  const { vulnerabilities, advisories } = data;
+  const found = isObject(vulnerabilities) ? vulnFindings(vulnerabilities) : [];
+  if (isObject(advisories)) {
+    const listed = Object.values(advisories).filter(isObject);
+    found.push(...listed.map(advisoryFinding));
   }
+  for (const entry of found) keepHighestAudit(audit, entry);
   return audit;
 };
 
 const parseOutdatedReport = (text) => {
   const outdated = new Map();
-  if (!text || !`${text}`.trim()) return outdated;
-  const data = jsonParse(text);
+  const data = text ? jsonParse(text) : null;
   if (!isHashObject(data)) return outdated;
   for (const name of Object.keys(data)) {
     const entry = data[name];
-    if (!entry || typeof entry !== 'object') continue;
-    const current = typeof entry.current === 'string' ? entry.current : '';
-    const wanted = typeof entry.wanted === 'string' ? entry.wanted : '';
-    const latest = typeof entry.latest === 'string' ? entry.latest : '';
-    const type = typeof entry.type === 'string' ? entry.type : '';
-    if (!wanted) continue;
+    const wanted = asText(entry?.wanted);
+    if (!isObject(entry) || !wanted) continue;
+    const current = asText(entry.current);
+    const latest = asText(entry.latest);
+    const type = asText(entry.type);
     outdated.set(name, { current, wanted, latest, type });
   }
   return outdated;
@@ -358,53 +277,40 @@ const parseOutdatedReport = (text) => {
 const markChanges = (changes, report, kind) => {
   if (!report) return changes;
   return changes.map((change) => {
-    if (change.action === 'removed' || change.section === 'field') {
-      return change;
-    }
+    if (change.action === 'removed') return change;
     const found = report.get(change.name);
     if (!found) return change;
-    if (kind === 'outdated' && found.wanted && found.wanted === found.current) {
-      return change;
-    }
+    const isCurrent = found.wanted && found.wanted === found.current;
+    if (kind === 'outdated' && isCurrent) return change;
     return { ...change, [kind]: found };
   });
 };
 
 const depExports = (exportEntries, name) => exportEntries?.get(name) === true;
 
-const isAddedDep = (change) => {
-  if (change.action !== 'added') return false;
-  if (change.section === 'resolved') return false;
-  if (change.section === 'field') return false;
-  return true;
-};
+const isAddedDep = (change) =>
+  change.action === 'added' && change.section !== 'resolved';
 
 const unusedChangeNames = (changes, used) => {
-  const names = [];
-  if (!used || !used.size) return names;
-  for (const change of changes) {
-    if (!isAddedDep(change)) continue;
-    if (used.has(change.name)) continue;
-    names.push(change.name);
-  }
-  return names;
+  if (!used || !used.size) return [];
+  const unused = changes.filter(
+    (change) => isAddedDep(change) && !used.has(change.name),
+  );
+  return unused.map((change) => change.name);
 };
 
-const unusedDeclaredNames = (pkg, used) => {
-  const names = [];
-  if (!pkgHasExportEntry(pkg)) return names;
-  if (!used || !used.size) return names;
+const unusedDeclared = (pkg, used) => {
+  const found = [];
+  if (!pkgHasExportEntry(pkg) || !used?.size) return found;
   const maps = readSections(pkg);
   for (const section of SECTION_KEYS) {
     if (section === 'peerDependencies') continue;
-    const keys = [...maps[section].keys()];
-    keys.sort();
-    for (const name of keys) {
-      if (used.has(name)) continue;
-      names.push(name);
+    const map = maps[section];
+    for (const name of [...map.keys()].sort()) {
+      if (!used.has(name)) found.push({ name, section, from: map.get(name) });
     }
   }
-  return names;
+  return found;
 };
 
 const markUnusedChanges = (changes, used, pkg, exportEntries) => {
@@ -418,147 +324,118 @@ const markUnusedChanges = (changes, used, pkg, exportEntries) => {
 
 const unusedDeclaredChanges = (pkg, used, exportEntries) => {
   const changes = [];
-  if (!pkgHasExportEntry(pkg)) return changes;
-  if (!used || !used.size) return changes;
-  const maps = readSections(pkg);
   const taken = new Set();
-  for (const section of SECTION_KEYS) {
-    if (section === 'peerDependencies') continue;
-    const map = maps[section];
-    const names = [...map.keys()];
-    names.sort();
-    for (const name of names) {
-      if (used.has(name)) continue;
-      if (taken.has(name)) continue;
-      if (!depExports(exportEntries, name)) continue;
-      taken.add(name);
-      const version = map.get(name);
-      changes.push({
-        name,
-        section,
-        action: 'removed',
-        from: version,
-        to: '',
-        propose: true,
-        unused: true,
-      });
-    }
+  for (const { name, section, from } of unusedDeclared(pkg, used)) {
+    if (taken.has(name) || !depExports(exportEntries, name)) continue;
+    taken.add(name);
+    const action = 'removed';
+    const to = '';
+    changes.push({
+      name,
+      section,
+      action,
+      from,
+      to,
+      propose: true,
+      unused: true,
+    });
   }
   return changes;
 };
 
-const buildProposedChanges = (pkg, outdated, audit, lock, options = {}) => {
-  const used = options.used;
-  const exportEntries = options.exportEntries;
-  const names = new Set();
-  if (outdated) {
-    for (const name of outdated.keys()) names.add(name);
-  }
-  if (audit) {
-    for (const name of audit.keys()) names.add(name);
-  }
-  const listed = [...names];
+const resolvedChange = (name, vul, resolved) => {
+  const from = resolved.get(name) || '';
+  if (!vul || !from) return null;
+  const to = proposedLockVersion(from, vul);
+  const section = 'resolved';
+  const action = 'vulnerable';
+  return { name, section, action, from, to, propose: true, audit: vul };
+};
+
+const declaredChange = (name, declared, out, vul) => {
+  const wanted = proposedWanted(out, vul);
+  if (!wanted && !vul) return null;
+  const from = declared.version;
+  const to = wanted ? applyWantedRange(from, wanted) : from;
+  if (to === from && !vul) return null;
+  const action = to === from ? 'vulnerable' : 'changed';
+  const { section } = declared;
+  const change = { name, section, action, from, to, propose: true };
+  if (out) change.outdated = out;
+  if (vul) change.audit = vul;
+  return change;
+};
+
+const mapKeys = (map) => (map ? [...map.keys()] : []);
+
+const buildProposedChanges = (pkg, outdated, audit, lock, options) => {
+  const listed = [...new Set([...mapKeys(outdated), ...mapKeys(audit)])];
   listed.sort();
   const resolved = lockEntries(lock);
-  const unused = unusedDeclaredChanges(pkg, used, exportEntries);
-  const taken = new Set();
-  for (const change of unused) taken.add(change.name);
-  const changes = [...unused];
+  const { used, exportEntries } = options;
+  const changes = unusedDeclaredChanges(pkg, used, exportEntries);
+  const taken = new Set(changes.map((change) => change.name));
   for (const name of listed) {
     if (taken.has(name)) continue;
     const out = outdated ? outdated.get(name) : null;
     const vul = audit ? audit.get(name) : null;
-    const type = out ? out.type : '';
-    const declared = findDeclared(pkg, name, type);
-    if (!declared) {
-      if (!vul) continue;
-      const version = resolved.get(name) || '';
-      if (!version) continue;
-      const to = proposedLockVersion(version, vul);
-      changes.push({
-        name,
-        section: 'resolved',
-        action: 'vulnerable',
-        from: version,
-        to,
-        propose: true,
-        audit: vul,
-      });
-      continue;
-    }
-    const wanted = proposedWanted(out, vul);
-    if (!wanted && !vul) continue;
-    let to = declared.version;
-    if (wanted) to = applyWantedRange(declared.version, wanted);
-    if (to === declared.version && !vul) continue;
-    let action = 'changed';
-    if (to === declared.version) action = 'vulnerable';
-    const change = {
-      name,
-      section: declared.section,
-      action,
-      from: declared.version,
-      to,
-      propose: true,
-    };
-    if (out) change.outdated = out;
-    if (vul) change.audit = vul;
-    changes.push(change);
+    const declared = findDeclared(pkg, name, out ? out.type : '');
+    const change = declared
+      ? declaredChange(name, declared, out, vul)
+      : resolvedChange(name, vul, resolved);
+    if (change) changes.push(change);
   }
   return changes;
 };
 
-const loadExportEntries = (names, extra = {}, pkgDir) => {
+const loadExportEntries = (names, extra, dir) => {
   const supplied = extra.exportEntries;
   if (supplied === null) return new Map();
-  const dir = pkgDir ?? extra.dir;
-  const missing = [];
-  for (const name of names) {
-    if (!supplied || !supplied.has(name)) missing.push(name);
-  }
+  const missing = names.filter((name) => !supplied || !supplied.has(name));
   if (!missing.length) return supplied ?? new Map();
   const found = collectExportEntries(extra.root, dir, missing);
-  if (!supplied) return found;
-  return new Map([...supplied, ...found]);
+  return supplied ? new Map([...supplied, ...found]) : found;
 };
 
-const groupedSynthetics = (synthetic) => {
+const spliceAtSlots = (out, synthetic, slot) => {
   const byPath = new Map();
-  for (const [key, items] of synthetic) {
-    const dir = key.slice(key.indexOf('\0') + 1);
-    const rel = relOf(dir, MANIFEST);
+  for (const key of synthetic.keys()) {
+    const rel = relOf(key.slice(key.indexOf('\0') + 1), MANIFEST);
     const list = byPath.get(rel) ?? [];
-    for (const item of items) list.push(item);
+    list.push(...synthetic.get(key));
     byPath.set(rel, list);
   }
-  return byPath;
-};
-
-const spliceAtSlots = (out, synthetic, slot) => {
-  const byPath = groupedSynthetics(synthetic);
-  const inserts = [...byPath].map(([rel, items]) => ({
+  const inserts = [...byPath.keys()].map((rel) => ({
     at: slot.get(rel) ?? out.length,
-    items,
+    items: byPath.get(rel),
   }));
   inserts.sort((left, right) => right.at - left.at);
-  for (const insert of inserts) {
-    out.splice(insert.at, 0, ...insert.items);
-  }
+  for (const insert of inserts) out.splice(insert.at, 0, ...insert.items);
   return out;
 };
 
-const lastPathIndex = (items, rel) => {
-  let at = -1;
-  for (let i = 0; i < items.length; i++) {
-    if (listFilePath(itemPath(items[i])) === rel) at = i;
+const placeFolded = (items, { folded, synthetic, leftoverNames }) => {
+  const out = [];
+  const slot = new Map();
+  for (const item of items) {
+    const meta = depFileMeta(itemPath(item));
+    const pkgRel = meta ? relOf(meta.dir, MANIFEST) : '';
+    const key = meta ? `${item.origin}\0${meta.dir}` : '';
+    if (meta && synthetic.has(key) && !slot.has(pkgRel)) {
+      slot.set(pkgRel, out.length);
+    }
+    if (folded.has(item)) continue;
+    if (!meta || meta.kind !== 'manifest') {
+      out.push(item);
+      continue;
+    }
+    const names = leftoverNames.get(key);
+    const kept = names ? stripFoldedDepItem(item, names) : item;
+    if (!kept) continue;
+    out.push(kept);
+    slot.set(pkgRel, out.length);
   }
-  return at;
-};
-
-const insertAfterPath = (items, added, rel) => {
-  const at = lastPathIndex(items, rel);
-  if (at < 0) return [...items, ...added];
-  return [...items.slice(0, at + 1), ...added, ...items.slice(at + 1)];
+  return spliceAtSlots(out, synthetic, slot);
 };
 
 const foldDepItems = (
@@ -578,51 +455,22 @@ const foldDepItems = (
     const summary = summarizeGroup(group, readSides);
     const unusedNames = unusedChangeNames(summary.changes, usedNames);
     const exportEntries = loadExportEntries(unusedNames, extra, group.dir);
-    const unused = markUnusedChanges(
-      summary.changes,
-      usedNames,
-      summary.pkg,
-      exportEntries,
-    );
-    const audited = markChanges(unused, audit, 'audit');
-    const changes = markChanges(audited, outdated, 'outdated');
+    const { pkg } = summary;
+    let changes = summary.changes;
+    changes = markUnusedChanges(changes, usedNames, pkg, exportEntries);
+    changes = markChanges(changes, audit, 'audit');
+    changes = markChanges(changes, outdated, 'outdated');
     const next = { ...summary, changes };
-    leftoverNames.set(key, foldedDepNames(next.changes));
+    leftoverNames.set(key, foldedDepNames(changes));
     const taken = takeManifestItems(next);
-    if (next.foldLock) {
-      for (const item of next.lockItems) taken.push(item);
-    }
-    if (!taken.length && !next.changes.length) continue;
+    if (next.foldLock) taken.push(...next.lockItems);
+    if (!taken.length && !changes.length) continue;
     const made = makeDepItems(group.origin, group.items, taken, next);
     if (made.length) synthetic.set(key, made);
     for (const item of taken) folded.add(item);
   }
   if (!synthetic.size && !folded.size) return items;
-  const out = [];
-  const slot = new Map();
-  for (const item of items) {
-    const rel = itemPath(item);
-    const meta = depFileMeta(rel);
-    if (meta) {
-      const pkgRel = relOf(meta.dir, MANIFEST);
-      const key = `${item.origin}\0${meta.dir}`;
-      if (synthetic.has(key) && !slot.has(pkgRel)) {
-        slot.set(pkgRel, out.length);
-      }
-    }
-    if (folded.has(item)) continue;
-    if (meta && meta.kind === 'manifest') {
-      const names = leftoverNames.get(`${item.origin}\0${meta.dir}`);
-      const kept = names ? stripFoldedDepItem(item, names) : item;
-      if (kept) {
-        out.push(kept);
-        slot.set(relOf(meta.dir, MANIFEST), out.length);
-      }
-      continue;
-    }
-    out.push(item);
-  }
-  return spliceAtSlots(out, synthetic, slot);
+  return placeFolded(items, { folded, synthetic, leftoverNames });
 };
 
 const proposeDepItems = (pkgText, outdated, audit, extra = {}) => {
@@ -630,7 +478,7 @@ const proposeDepItems = (pkgText, outdated, audit, extra = {}) => {
   if (!pkg) return [];
   const lock = jsonParse(extra.lockText ?? '');
   const used = extra.usedNames;
-  const names = unusedDeclaredNames(pkg, used);
+  const names = unusedDeclared(pkg, used).map((dep) => dep.name);
   const exportEntries = loadExportEntries(names, extra, extra.dir);
   const options = { used, exportEntries };
   const changes = buildProposedChanges(pkg, outdated, audit, lock, options);
@@ -645,39 +493,32 @@ const proposeDepItems = (pkgText, outdated, audit, extra = {}) => {
 
 const mergeProposedItems = (items, pkgText, outdated, audit, extra = {}) => {
   const proposed = proposeDepItems(pkgText, outdated, audit, extra);
-  if (!proposed.length) return items;
   const taken = new Set();
   for (const item of items) {
-    const change = item.dep && item.dep.change;
+    const change = item.dep?.change;
     if (change) taken.add(change.name);
   }
-  const added = [];
-  for (const item of proposed) {
-    const change = item.dep && item.dep.change;
-    if (!change || taken.has(change.name)) continue;
-    added.push(item);
-  }
+  const added = proposed.filter((item) => {
+    const change = item.dep?.change;
+    return change && !taken.has(change.name);
+  });
   if (!added.length) return items;
   const rel = relOf(extra.dir ?? '.', MANIFEST);
-  return insertAfterPath(items, added, rel);
+  const at = items.findLastIndex(
+    (item) => listFilePath(itemPath(item)) === rel,
+  );
+  if (at < 0) return [...items, ...added];
+  return [...items.slice(0, at + 1), ...added, ...items.slice(at + 1)];
 };
 
 module.exports = {
   MANIFEST,
   LOCKFILE,
   depFileMeta,
-  readSections,
-  lockEntries,
-  lockPackageCount,
-  diffSections,
-  mergeDepFile,
-  mergeResolved,
   collectUsedNames,
   collectExportMeta,
   parseAuditReport,
   parseOutdatedReport,
-  applyWantedRange,
-  patchedFromRange,
   proposeDepItems,
   foldDepItems,
   mergeProposedItems,