@bobfrankston/npmglobalize 1.0.206 → 1.0.207

package/lib.d.ts

@@ -287,6 +287,26 @@ export type UnpublishedDep = {
     path: string;
     reason: 'new' | 'update';
 };
+/** Vet the casing of every `file:` dependency path, in BOTH places it is recorded:
+ *  the spec in package.json and the junction npm created in node_modules.
+ *
+ *  npm resolves a `file:` spec by string concatenation against the cwd and writes
+ *  the result as the link target — it never canonicalizes case, and never checks
+ *  that the target exists. On Windows that rots invisibly: `projects/nodejs/x`
+ *  resolves fine when the directory is really `projects/NodeJS/x`, so nothing
+ *  complains until the path reaches somewhere case matters. Two places it does:
+ *  WSL and Linux deploys can't resolve it at all, and npm's own arborist keys
+ *  nodes by path string, so one directory reached under two spellings becomes two
+ *  nodes and tree loading dies with "Cannot read properties of null".
+ *
+ *  Both records must be repaired together. Fixing only the manifest leaves the
+ *  stale junction in place (npm will not recreate a link it thinks is satisfied);
+ *  fixing only the junction lets the next `npm install` write the bad case back. */
+export declare function verifyDepPathCase(cwd: string, pkg: any): {
+    specs: string[];
+    links: string[];
+    missing: string[];
+};
 export declare function transformDeps(pkg: any, baseDir: string, verbose?: boolean, forcePublish?: boolean): {
     transformed: boolean;
     unpublished: UnpublishedDep[];

package/lib.js

@@ -1320,6 +1320,125 @@ function hasLocalChanges(packageName, version, targetPath, verbose) {
         return false;
     }
 }
+/** The canonical on-disk spelling of `target`, or null if it does not exist.
+ *  Windows answers path queries case-insensitively, so the only way to learn how
+ *  a directory is really spelled is to ask its parent to list it — a segment at a
+ *  time, from the root down. */
+function canonicalCase(target) {
+    const full = path.resolve(target);
+    if (!fs.existsSync(full))
+        return null;
+    const parsed = path.parse(full);
+    const parts = full.slice(parsed.root.length).split(/[\\/]/).filter(Boolean);
+    let cur = parsed.root.toUpperCase();
+    for (const part of parts) {
+        let entries;
+        try {
+            entries = fs.readdirSync(cur);
+        }
+        catch {
+            return null;
+        }
+        const real = entries.find(e => e.toLowerCase() === part.toLowerCase());
+        if (!real)
+            return null;
+        cur = path.join(cur, real);
+    }
+    return cur;
+}
+/** True when two paths name the same place but are spelled with different case
+ *  in a directory name. A bare drive-letter difference (`y:` vs `Y:`) doesn't
+ *  count — it resolves identically everywhere, including WSL's /mnt/y. */
+function caseDiffers(a, b) {
+    const strip = (p) => p.replace(/[\\/]+$/, '').slice(path.parse(p).root.length);
+    return strip(a) !== strip(b);
+}
+/** Vet the casing of every `file:` dependency path, in BOTH places it is recorded:
+ *  the spec in package.json and the junction npm created in node_modules.
+ *
+ *  npm resolves a `file:` spec by string concatenation against the cwd and writes
+ *  the result as the link target — it never canonicalizes case, and never checks
+ *  that the target exists. On Windows that rots invisibly: `projects/nodejs/x`
+ *  resolves fine when the directory is really `projects/NodeJS/x`, so nothing
+ *  complains until the path reaches somewhere case matters. Two places it does:
+ *  WSL and Linux deploys can't resolve it at all, and npm's own arborist keys
+ *  nodes by path string, so one directory reached under two spellings becomes two
+ *  nodes and tree loading dies with "Cannot read properties of null".
+ *
+ *  Both records must be repaired together. Fixing only the manifest leaves the
+ *  stale junction in place (npm will not recreate a link it thinks is satisfied);
+ *  fixing only the junction lets the next `npm install` write the bad case back. */
+export function verifyDepPathCase(cwd, pkg) {
+    const specs = [];
+    const links = [];
+    const missing = [];
+    for (const bucket of ['dependencies', 'devDependencies', '.dependencies']) {
+        const deps = pkg?.[bucket];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const [name, spec] of Object.entries(deps)) {
+            if (typeof spec !== 'string' || !spec.startsWith('file:'))
+                continue;
+            const abs = path.resolve(cwd, spec.slice('file:'.length));
+            const canonical = canonicalCase(abs);
+            if (!canonical) {
+                missing.push(`${name} -> ${spec} (no such directory)`);
+                continue;
+            }
+            if (!caseDiffers(abs, canonical))
+                continue;
+            // Keep the spec relative, the way it was written.
+            const rel = path.relative(cwd, canonical).split(path.sep).join('/');
+            deps[name] = `file:${rel}`;
+            specs.push(`${name}: ${spec} -> file:${rel}`);
+        }
+    }
+    // The junction npm already made from the old spelling.
+    for (const bucket of ['dependencies', 'devDependencies', '.dependencies']) {
+        const deps = pkg?.[bucket];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const [name, spec] of Object.entries(deps)) {
+            if (typeof spec !== 'string' || !spec.startsWith('file:'))
+                continue;
+            const linkPath = path.join(cwd, 'node_modules', ...name.split('/'));
+            let stat;
+            try {
+                stat = fs.lstatSync(linkPath);
+            }
+            catch {
+                continue;
+            }
+            if (!stat.isSymbolicLink())
+                continue;
+            let current;
+            try {
+                current = fs.readlinkSync(linkPath).replace(/[\\/]+$/, '');
+            }
+            catch {
+                continue;
+            }
+            const canonical = canonicalCase(current);
+            if (!canonical || !caseDiffers(current, canonical))
+                continue;
+            try {
+                // On Windows a directory junction is removed with rmdir, not unlink,
+                // and neither follows the link — which matters, because deleting
+                // through it would take the real package tree with it.
+                if (process.platform === 'win32')
+                    fs.rmdirSync(linkPath);
+                else
+                    fs.unlinkSync(linkPath);
+                fs.symlinkSync(canonical, linkPath, process.platform === 'win32' ? 'junction' : 'dir');
+                links.push(`${name}: ${current} -> ${canonical}`);
+            }
+            catch (error) {
+                missing.push(`${name}: could not repair link (${error.message})`);
+            }
+        }
+    }
+    return { specs, links, missing };
+}
 export function transformDeps(pkg, baseDir, verbose = false, forcePublish = false) {
     let transformed = false;
     const unpublished = [];
@@ -6601,6 +6720,23 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             }
         }
     }
+    // Vet file: path casing before transformDeps swaps the specs out — this is the
+    // last moment the real paths are still in hand. Repairs the manifest and the
+    // node_modules junction together; fixing either alone is undone by the other.
+    const caseCheck = verifyDepPathCase(cwd, pkg);
+    if (caseCheck.specs.length || caseCheck.links.length) {
+        for (const fix of caseCheck.specs)
+            console.log(colors.green(`  ✓ Corrected file: path case in package.json — ${fix}`));
+        for (const fix of caseCheck.links)
+            console.log(colors.green(`  ✓ Corrected node_modules link case — ${fix}`));
+        if (caseCheck.specs.length)
+            writePackageJson(cwd, pkg);
+        recordBuildIssue(pkg.name || path.basename(cwd), 'warning', `Corrected ${caseCheck.specs.length} file: path spec(s) and ${caseCheck.links.length} node_modules link(s) whose letter case did not match the directory on disk. npm does not canonicalize these, and the wrong case breaks WSL, Linux deploys, and npm's own tree loading.`);
+    }
+    for (const gone of caseCheck.missing) {
+        console.error(colors.red(`  ✗ file: dependency path does not exist — ${gone}`));
+        recordBuildIssue(pkg.name || path.basename(cwd), 'error', `file: dependency path does not exist — ${gone}`);
+    }
     // Transform dependencies
     if (verbose) {
         console.log('Transforming file: dependencies...');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.206",
+  "version": "1.0.207",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@bobfrankston/freezepak": "^0.1.9",
     "@bobfrankston/importgen": "^0.1.40",
-    "@bobfrankston/themecolors": "^0.1.8",
+    "@bobfrankston/themecolors": "^0.1.9",
     "@bobfrankston/userconfig": "^1.0.11",
     "@npmcli/package-json": "^7.0.4",
     "json5": "^2.2.3",
@@ -61,7 +61,7 @@
     "dependencies": {
       "@bobfrankston/freezepak": "^0.1.9",
       "@bobfrankston/importgen": "^0.1.40",
-      "@bobfrankston/themecolors": "^0.1.8",
+      "@bobfrankston/themecolors": "^0.1.9",
       "@bobfrankston/userconfig": "^1.0.11",
       "@npmcli/package-json": "^7.0.4",
       "json5": "^2.2.3",