@cdxgen/cdxgen 0.0.1 → 13.0.0

package/lib/third-party/arborist/lib/arborist/load-virtual.js

@@ -0,0 +1,300 @@
+import { resolve } from "node:path";
+
+import mapWorkspaces from "@npmcli/map-workspaces";
+import nameFromFolder from "@npmcli/name-from-folder";
+import PackageJson from "@npmcli/package-json";
+
+import calcDepFlags from "../calc-dep-flags.js";
+import consistentResolve from "../consistent-resolve.js";
+import Link from "../link.js";
+import Node from "../node.js";
+import relpath from "../relpath.js";
+import Shrinkwrap from "../shrinkwrap.js";
+import treeCheck from "../tree-check.js";
+
+// mixin providing the loadVirtual method
+
+const flagsSuspect = Symbol.for("flagsSuspect");
+const setWorkspaces = Symbol.for("setWorkspaces");
+
+/** @returns {any} */
+export default (cls) =>
+  class VirtualLoader extends cls {
+    #rootOptionProvided;
+
+    // public method
+    async loadVirtual(options = {}) {
+      if (this.virtualTree) {
+        return this.virtualTree;
+      }
+
+      // allow the user to set reify options on the ctor as well.
+      // XXX: deprecate separate reify() options object.
+      options = { ...this.options, ...options };
+
+      if (options.root && options.root.meta) {
+        await this.#loadFromShrinkwrap(options.root.meta, options.root);
+        return treeCheck(this.virtualTree);
+      }
+
+      const s = await Shrinkwrap.load({
+        path: this.path,
+        lockfileVersion: this.options.lockfileVersion,
+        resolveOptions: this.options,
+      });
+      if (!s.loadedFromDisk && !options.root) {
+        const er = new Error(
+          "loadVirtual requires existing package-lock.json file",
+        );
+        throw Object.assign(er, { code: "ENOLOCK" });
+      }
+
+      // when building the ideal tree, we pass in a root node to this function
+      // otherwise, load it from the root package json or the lockfile
+      const pkg = await PackageJson.normalize(this.path)
+        .then((p) => p.content)
+        .catch(() => s.data.packages[""] || {});
+      // TODO clean this up
+      const {
+        root = await this[setWorkspaces](this.#loadNode("", pkg, true)),
+      } = options;
+      this.#rootOptionProvided = options.root;
+
+      await this.#loadFromShrinkwrap(s, root);
+      root.assertRootOverrides();
+      return treeCheck(this.virtualTree);
+    }
+
+    async #loadFromShrinkwrap(s, root) {
+      if (!this.#rootOptionProvided) {
+        // root is never any of these things, but might be a brand new
+        // baby Node object that never had its dep flags calculated.
+        root.unsetDepFlags();
+      } else {
+        this[flagsSuspect] = true;
+      }
+
+      this.#checkRootEdges(s, root);
+      root.meta = s;
+      this.virtualTree = root;
+      // separate out link metadata, and create Node objects for nodes
+      const links = new Map();
+      const nodes = new Map([["", root]]);
+      for (const [location, meta] of Object.entries(s.data.packages)) {
+        // skip the root because we already got it
+        if (!location) {
+          continue;
+        }
+
+        if (meta.link) {
+          links.set(location, meta);
+        } else {
+          nodes.set(location, this.#loadNode(location, meta));
+        }
+      }
+      await this.#resolveLinks(links, nodes);
+      if (!(s.originalLockfileVersion >= 2)) {
+        this.#assignBundles(nodes);
+      }
+      if (this[flagsSuspect]) {
+        // reset all dep flags
+        // can't use inventory here, because virtualTree might not be root
+        for (const node of nodes.values()) {
+          if (node.isRoot || node === this.#rootOptionProvided) {
+            continue;
+          }
+          node.resetDepFlags();
+        }
+        calcDepFlags(this.virtualTree, !this.#rootOptionProvided);
+      }
+      return root;
+    }
+
+    // check the lockfile deps, and see if they match.  if they do not
+    // then we have to reset dep flags at the end.  for example, if the
+    // user manually edits their package.json file, then we need to know
+    // that the idealTree is no longer entirely trustworthy.
+    #checkRootEdges(s, root) {
+      // loaded virtually from tree, no chance of being out of sync
+      // ancient lockfiles are critically damaged by this process,
+      // so we need to just hope for the best in those cases.
+      if (!s.loadedFromDisk || s.ancientLockfile) {
+        return;
+      }
+
+      const lock = s.get("");
+      const prod = lock.dependencies || {};
+      const dev = lock.devDependencies || {};
+      const optional = lock.optionalDependencies || {};
+      const peer = lock.peerDependencies || {};
+      const peerOptional = {};
+
+      if (lock.peerDependenciesMeta) {
+        for (const [name, meta] of Object.entries(lock.peerDependenciesMeta)) {
+          if (meta.optional && peer[name] !== undefined) {
+            peerOptional[name] = peer[name];
+            delete peer[name];
+          }
+        }
+      }
+
+      for (const name of Object.keys(optional)) {
+        delete prod[name];
+      }
+
+      const lockWS = {};
+      const workspaces = mapWorkspaces.virtual({
+        cwd: this.path,
+        lockfile: s.data,
+      });
+
+      for (const [name, path] of workspaces.entries()) {
+        lockWS[name] = `file:${path}`;
+      }
+
+      // Should rootNames exclude optional?
+      const rootNames = new Set(root.edgesOut.keys());
+
+      const lockByType = {
+        dev,
+        optional,
+        peer,
+        peerOptional,
+        prod,
+        workspace: lockWS,
+      };
+
+      // Find anything in shrinkwrap deps that doesn't match root's type or spec
+      for (const type in lockByType) {
+        const deps = lockByType[type];
+        for (const name in deps) {
+          const edge = root.edgesOut.get(name);
+          if (!edge || edge.type !== type || edge.spec !== deps[name]) {
+            return (this[flagsSuspect] = true);
+          }
+          rootNames.delete(name);
+        }
+      }
+      // Something was in root that's not accounted for in shrinkwrap
+      if (rootNames.size) {
+        return (this[flagsSuspect] = true);
+      }
+    }
+
+    // links is the set of metadata, and nodes is the map of non-Link nodes
+    // Set the targets to nodes in the set, if we have them (we might not)
+    // XXX build-ideal-tree also has a #resolveLinks, is there overlap?
+    async #resolveLinks(links, nodes) {
+      for (const [location, meta] of links.entries()) {
+        const targetPath = resolve(this.path, meta.resolved);
+        const targetLoc = relpath(this.path, targetPath);
+        const target = nodes.get(targetLoc);
+
+        if (!target) {
+          const err = new Error(
+            `Missing target in lock file: "${targetLoc}" is referenced by "${location}" but does not exist.
+To fix:
+1. rm package-lock.json
+2. npm install`,
+          );
+          err.code = "EMISSINGTARGET";
+          throw err;
+        }
+
+        const link = this.#loadLink(location, targetLoc, target, meta);
+        nodes.set(location, link);
+        nodes.set(targetLoc, link.target);
+
+        // we always need to read the package.json for link targets
+        // outside node_modules because they can be changed by the local user
+        if (!link.target.parent) {
+          await PackageJson.normalize(link.realpath)
+            .then((p) => (link.target.package = p.content))
+            .catch(() => null);
+        }
+      }
+    }
+
+    #assignBundles(nodes) {
+      for (const [location, node] of nodes) {
+        // Skip assignment of parentage for the root package
+        if (!location || (node.isLink && !node.target.location)) {
+          continue;
+        }
+        const {
+          name,
+          parent,
+          package: { inBundle },
+        } = node;
+
+        if (!parent) {
+          continue;
+        }
+
+        // read inBundle from package because 'package' here is
+        // actually a v2 lockfile metadata entry.
+        // If the *parent* is also bundled, though, or if the parent has
+        // no dependency on it, then we assume that it's being pulled in
+        // just by virtue of its parent or a transitive dep being bundled.
+        const { package: ppkg } = parent;
+        const { inBundle: parentBundled } = ppkg;
+        if (inBundle && !parentBundled && parent.edgesOut.has(node.name)) {
+          if (!ppkg.bundleDependencies) {
+            ppkg.bundleDependencies = [name];
+          } else {
+            ppkg.bundleDependencies.push(name);
+          }
+        }
+      }
+    }
+
+    #loadNode(location, sw, loadOverrides) {
+      const p = this.virtualTree ? this.virtualTree.realpath : this.path;
+      const path = resolve(p, location);
+      // shrinkwrap doesn't include package name unless necessary
+      if (!sw.name) {
+        sw.name = nameFromFolder(path);
+      }
+
+      const node = new Node({
+        installLinks: this.installLinks,
+        legacyPeerDeps: this.legacyPeerDeps,
+        root: this.virtualTree,
+        path,
+        realpath: path,
+        integrity: sw.integrity,
+        patched: sw.patched,
+        packageExtensionsApplied: sw.packageExtensionsApplied,
+        npmExtensionApplied: sw.npmExtensionApplied,
+        resolved: consistentResolve(sw.resolved, this.path, path),
+        pkg: sw,
+        loadOverrides,
+        // cast to boolean because they're undefined in the lock file when false
+        extraneous: !!sw.extraneous,
+        devOptional: !!(sw.devOptional || sw.dev || sw.optional),
+        peer: !!sw.peer,
+        optional: !!sw.optional,
+        dev: !!sw.dev,
+      });
+
+      return node;
+    }
+
+    #loadLink(location, targetLoc, target) {
+      const path = resolve(this.path, location);
+      const link = new Link({
+        installLinks: this.installLinks,
+        legacyPeerDeps: this.legacyPeerDeps,
+        path,
+        realpath: resolve(this.path, targetLoc),
+        target,
+        pkg: target && target.package,
+      });
+      link.extraneous = target.extraneous;
+      link.devOptional = target.devOptional;
+      link.peer = target.peer;
+      link.optional = target.optional;
+      link.dev = target.dev;
+      return link;
+    }
+  };

package/lib/third-party/arborist/lib/bin-links.js

@@ -0,0 +1,120 @@
+import { basename, dirname, extname, resolve } from "node:path";
+import process from "node:process";
+
+const isWindows = process.platform === "win32";
+
+// Memoize node_modules folder resolution to keep it fast
+const memoNodeModules = new Map();
+
+/**
+ * Returns the path to the node_modules directory under which a package is installed.
+ * Handles scoped packages correctly.
+ *
+ * @param {string} path Path to the package
+ * @returns {string} Path to the parent node_modules directory
+ */
+function getNodeModules(path) {
+  if (memoNodeModules.has(path)) {
+    return memoNodeModules.get(path);
+  }
+  const scopeOrNm = dirname(path);
+  const nm =
+    basename(scopeOrNm) === "node_modules" ? scopeOrNm : dirname(scopeOrNm);
+  memoNodeModules.set(path, nm);
+  return nm;
+}
+
+/**
+ * Resolves the parent prefix directory for the installed package.
+ *
+ * @param {string} path Path to the package
+ * @returns {string} The prefix path
+ */
+function getPrefix(path) {
+  return dirname(getNodeModules(path));
+}
+
+/**
+ * Resolves the binary target installation directory.
+ *
+ * @param {Object} options
+ * @param {boolean} options.top Is this a top-level package
+ * @param {string} options.path Path to the package
+ * @returns {string} Target binary folder path
+ */
+function binTarget({ top, path }) {
+  if (!top) {
+    return `${getNodeModules(path)}/.bin`;
+  }
+  if (isWindows) {
+    return getPrefix(path);
+  }
+  return `${dirname(getPrefix(path))}/bin`;
+}
+
+/**
+ * Resolves the manual page installation directory.
+ *
+ * @param {Object} options
+ * @param {boolean} options.top Is this a top-level package
+ * @param {string} options.path Path to the package
+ * @returns {string | null} Target manual folder path or null
+ */
+function manTarget({ top, path }) {
+  if (!top || isWindows) {
+    return null;
+  }
+  return `${dirname(getPrefix(path))}/share/man`;
+}
+
+/**
+ * Custom lightweight replacement for the bin-links getPaths function.
+ * Calculates all possible symbolic links or shims that would be created.
+ *
+ * @param {Object} options Options object
+ * @param {string} options.path Path to the package directory
+ * @param {Object} options.pkg The parsed package.json object
+ * @param {boolean} [options.global] Whether this is a global install
+ * @param {boolean} [options.top] Whether this is the top-level package being installed
+ * @returns {string[]} An array of potential link target file paths
+ */
+export default function getPaths({ path, pkg, global, top }) {
+  if (top && !global) {
+    return [];
+  }
+
+  const binSet = [];
+  const binTarg = binTarget({ path, top });
+  if (pkg.bin) {
+    const binKeys =
+      typeof pkg.bin === "string"
+        ? [pkg.name ? basename(pkg.name) : basename(path)]
+        : Object.keys(pkg.bin);
+
+    for (const bin of binKeys) {
+      const b = resolve(binTarg, bin);
+      binSet.push(b);
+      if (isWindows) {
+        binSet.push(`${b}.cmd`);
+        binSet.push(`${b}.ps1`);
+      }
+    }
+  }
+
+  const manTarg = manTarget({ path, top });
+  const manSet = [];
+  if (manTarg && pkg.man && Array.isArray(pkg.man) && pkg.man.length) {
+    for (const man of pkg.man) {
+      if (!/.\.[0-9]+(\.gz)?$/.test(man)) {
+        return binSet;
+      }
+
+      const section = extname(basename(man, ".gz")).slice(1);
+      const base = basename(man);
+
+      manSet.push(resolve(manTarg, `man${section}`, base));
+    }
+  }
+
+  return manSet.length ? [...binSet, ...manSet] : binSet;
+}

package/lib/third-party/arborist/lib/calc-dep-flags.js

@@ -0,0 +1,130 @@
+// Dep flag (dev, peer, etc.) calculation requires default or reset flags.
+// Flags are true by default and are unset to false as we walk deps.
+// We iterate outward edges looking for dep flags that can
+// be unset based on the current nodes flags and edge type.
+// Examples:
+// - a non-optional node with a non-optional edge out, the edge node should not be optional
+// - a non-peer node with a non-peer edge out, the edge node should not be peer
+// If a node is changed, we add to the queue and continue until no more changes.
+// Flags that remain after all this unsetting should be valid.
+// Examples:
+// - a node still flagged optional must only be reachable via optional edges
+// - a node still flagged peer must only be reachable via peer edges
+const calcDepFlags = (tree, resetRoot = true) => {
+  if (resetRoot) {
+    tree.unsetDepFlags();
+  }
+
+  const seen = new Set();
+  const queue = [tree];
+
+  let node;
+  while ((node = queue.pop())) {
+    seen.add(node);
+
+    // Unset extraneous from all parents to avoid removal of children.
+    if (!node.extraneous) {
+      for (let n = node.resolveParent; n?.extraneous; n = n.resolveParent) {
+        n.extraneous = false;
+      }
+    }
+
+    // for links, map their hierarchy appropriately
+    if (node.isLink) {
+      // node.target can be null, we check to ensure it's not null before proceeding
+      if (node.target == null) {
+        continue;
+      }
+      // Only unset flags, matching the edge walk below, so multiple links to one target can't clobber a correct value.
+      let changed = false;
+      if (node.target.dev && !node.dev) {
+        node.target.dev = false;
+        changed = true;
+      }
+      if (node.target.optional && !node.optional) {
+        node.target.optional = false;
+        changed = true;
+      }
+      if (node.target.devOptional && !node.devOptional) {
+        node.target.devOptional = false;
+        changed = true;
+      }
+      if (node.target.peer && !node.peer) {
+        node.target.peer = false;
+        changed = true;
+      }
+      if (node.target.extraneous && !node.extraneous) {
+        node.target.extraneous = false;
+        changed = true;
+      }
+      // queue target on first visit so its deps are walked
+      if (changed || !seen.has(node.target)) {
+        queue.push(node.target);
+      }
+      continue;
+    }
+
+    for (const { peer, optional, dev, to } of node.edgesOut.values()) {
+      // if the dep is missing, then its flags are already maximally unset
+      if (!to) {
+        continue;
+      }
+
+      let changed = false;
+
+      // only optional peer dependencies should stay extraneous
+      if (to.extraneous && !node.extraneous && !(peer && optional)) {
+        to.extraneous = false;
+        changed = true;
+      }
+
+      if (to.dev && !node.dev && !dev) {
+        to.dev = false;
+        changed = true;
+      }
+
+      if (to.optional && !node.optional && !optional) {
+        to.optional = false;
+        changed = true;
+      }
+
+      // devOptional is the *overlap* of the dev and optional tree.
+      // A node may be depended on by separate dev and optional nodes.
+      // It SHOULD NOT be removed when pruning dev OR optional.
+      // It SHOULD be removed when pruning dev AND optional.
+      // We only unset here if a node is not dev AND not optional because
+      // if we did unset, it would prevent any overlap deeper in the tree.
+      // We correct this later by removing if dev OR optional is set.
+      if (
+        to.devOptional &&
+        !node.devOptional &&
+        !node.dev &&
+        !node.optional &&
+        !dev &&
+        !optional
+      ) {
+        to.devOptional = false;
+        changed = true;
+      }
+
+      if (to.peer && !node.peer && !peer) {
+        to.peer = false;
+        changed = true;
+      }
+
+      if (changed) {
+        queue.push(to);
+      }
+    }
+  }
+
+  // Remove incorrect devOptional flags now that we have walked all deps.
+  seen.delete(tree);
+  for (const node of seen.values()) {
+    if (node.devOptional && (node.dev || node.optional)) {
+      node.devOptional = false;
+    }
+  }
+};
+
+export default calcDepFlags;

package/lib/third-party/arborist/lib/case-insensitive-map.js

@@ -0,0 +1,51 @@
+// package children are represented with a Map object, but many file systems
+// are case-insensitive and unicode-normalizing, so we need to treat
+// node.children.get('FOO') and node.children.get('foo') as the same thing.
+
+export default class CIMap extends Map {
+  #keys = new Map();
+
+  constructor(items = []) {
+    super();
+    for (const [key, val] of items) {
+      this.set(key, val);
+    }
+  }
+
+  #normKey(key) {
+    if (typeof key !== "string") {
+      return key;
+    }
+    return key.normalize("NFKD").toLowerCase();
+  }
+
+  get(key) {
+    const normKey = this.#normKey(key);
+    return this.#keys.has(normKey)
+      ? super.get(this.#keys.get(normKey))
+      : undefined;
+  }
+
+  set(key, val) {
+    const normKey = this.#normKey(key);
+    if (this.#keys.has(normKey)) {
+      super.delete(this.#keys.get(normKey));
+    }
+    this.#keys.set(normKey, key);
+    return super.set(key, val);
+  }
+
+  delete(key) {
+    const normKey = this.#normKey(key);
+    if (this.#keys.has(normKey)) {
+      const prevKey = this.#keys.get(normKey);
+      this.#keys.delete(normKey);
+      return super.delete(prevKey);
+    }
+  }
+
+  has(key) {
+    const normKey = this.#normKey(key);
+    return this.#keys.has(normKey) && super.has(this.#keys.get(normKey));
+  }
+}

package/lib/third-party/arborist/lib/consistent-resolve.js

@@ -0,0 +1,42 @@
+import npa from "npm-package-arg";
+
+import relpath from "./relpath.js";
+
+// take a path and a resolved value, and turn it into a resolution from
+// the given new path.  This is used with converting a package.json's
+// relative file: path into one suitable for a lockfile, or between
+// lockfiles, and for converting hosted git repos to a consistent url type.
+const consistentResolve = (resolved, fromPath, toPath, relPaths = false) => {
+  if (!resolved) {
+    return null;
+  }
+
+  try {
+    const hostedOpt = { noCommittish: false };
+    const { fetchSpec, saveSpec, type, hosted, rawSpec, raw } = npa(
+      resolved,
+      fromPath,
+    );
+    if (type === "file" || type === "directory") {
+      if (relPaths && toPath) {
+        return `file:${relpath(toPath, fetchSpec)}`;
+      }
+      return `file:${fetchSpec}`;
+    }
+    if (hosted) {
+      return `git+${hosted.auth || hosted.default === "https" ? hosted.https(hostedOpt) : hosted.sshurl(hostedOpt)}`;
+    }
+    if (type === "git") {
+      return saveSpec;
+    }
+    if (rawSpec === "*") {
+      return raw;
+    }
+    return rawSpec;
+  } catch (_) {
+    // whatever we passed in was not acceptable to npa.
+    // leave it 100% untouched.
+    return resolved;
+  }
+};
+export default consistentResolve;

package/lib/third-party/arborist/lib/debug.js

@@ -0,0 +1,50 @@
+// certain assertions we should do only when testing arborist itself, because
+// they are too expensive or aggressive and would break user programs if we
+// miss a situation where they are actually valid.
+//
+// call like this:
+//
+// /* istanbul ignore next - debug check */
+// debug(() => {
+//   if (someExpensiveCheck)
+//     throw new Error('expensive check should have returned false')
+// })
+// run in debug mode if explicitly requested, running arborist tests,
+// or working in the arborist project directory.
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { format } from "node:util";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+const debug =
+  process.env.ARBORIST_DEBUG !== "0" &&
+  (process.env.ARBORIST_DEBUG === "1" ||
+    /\barborist\b/.test(process.env.NODE_DEBUG || "") ||
+    (process.env.npm_package_name === "@npmcli/arborist" &&
+      ["test", "snap"].includes(process.env.npm_lifecycle_event)) ||
+    process.cwd() === resolve(__dirname, ".."));
+
+const debugFunction = debug
+  ? (fn) => fn()
+  : () => {
+      // ignore
+    };
+
+const red = process.stderr.isTTY ? (msg) => `\x1B[31m${msg}\x1B[39m` : (m) => m;
+
+debugFunction.log = (...msg) =>
+  debugFunction(() => {
+    const prefix = `\n${process.pid} ${red(format(msg.shift()))} `;
+    msg = (
+      prefix +
+      format(...msg)
+        .trim()
+        .split("\n")
+        .join(prefix)
+    ).trim();
+    /* eslint-disable-next-line no-console */
+    console.error(msg);
+  });
+
+export default debugFunction;