
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
inline-codegen
Advanced tools
(perhaps a better name would be living-snippets?)
Generates code and places the result directly inline in the source code file.
under normal conditions INSERT_SNIPPET_ABOVE just noops
I am prototyping an idea I have. I have to generate a lot of boilerplate code to get typescript to not explode due to https://github.com/Microsoft/TypeScript/issues/25023
I was able to encode a solution as a snippet but it's about a dozen+ plus lines of code per use. So it starts to get pretty hard to maintain all that boilerplate.
So instead I wrote this module to see if:
per h-mst:
export const MSTModelSnippet = (name: string) => {
return `
type ${name}ModelTypeOf = typeof ${name}Model
type ${name}TypeTypeOf = typeof ${name}Model.Type
export interface ${name}Type extends ${name}TypeTypeOf {}
type ${name}SnapshotTypeTypeOf = typeof ${name}Model.SnapshotType
export interface ${name}SnapshotType extends ${name}SnapshotTypeTypeOf {}
type ${name}CreationTypeTypeOf = typeof ${name}Model.CreationType
export interface ${name}CreationType extends ${name}CreationTypeTypeOf {}
export interface ${name} extends ${name}ModelTypeOf {
Type: ${name}Type
CreationType: ${name}CreationType
SnapshotType: ${name}SnapshotType
}
export const ${name}: ${name} = ${name}Model
`
}
source code where the expansion occurs:
import {types} from "mobx-state-tree"
const M1Model = types.model("M1", {})
INSERT_SNIPPET_ABOVE(import("h-mst").MSTModelSnippet, M1Model.name)
which transforms into
const M1Model = types.model("M1", {})
//#region ISA_START Automatically Generated Code (Do not edit)
type M1ModelTypeOf = typeof M1Model
type M1TypeTypeOf = typeof M1Model.Type
export interface M1Type extends M1TypeTypeOf {}
type M1SnapshotTypeTypeOf = typeof M1Model.SnapshotType
export interface M1SnapshotType extends M1SnapshotTypeTypeOf {}
type M1CreationTypeTypeOf = typeof M1Model.CreationType
export interface M1CreationType extends M1CreationTypeTypeOf {}
export interface M1 extends M1ModelTypeOf {
Type: M1Type
CreationType: M1CreationType
SnapshotType: M1SnapshotType
}
export const M1: M1 = M1Model
//#endregion ISA_END Automatically Generated Code (Do not edit)
INSERT_SNIPPET_ABOVE(MSTModelSnippet, M1Model.name)
Would work... and so far it looks promising (if obviously a bit less than ideal)
(Also notice the use of a #region this allows vcode to collapse and hide the codegen fairly seamlessly)
I believe this approach may have applications in other areas and be a good general compromise to waiting for macros to be added to typescript.
I have several additional ideas I would like to try out to further enhance the power of this tool.
Imagine the simplest possible implementation and that's what's done here, no fancy parsing (probably not a good idea anyhow in the long run since the snippets may need to be able to run for the rest of the file to compile).
Currently the way it works is to actually execute the file with the codegen
in it, then capture the result and then re-insert it. This allows for the trick
of pulling the M1Model.name. However if there are multiple codegens that depend
on each other then it can cause a catch-22.
FAQs
Insert code inline next to the statement that generates it
The npm package inline-codegen receives a total of 1 weekly downloads. As such, inline-codegen popularity was classified as not popular.
We found that inline-codegen demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.