@cdxgen/cdxgen 0.0.1 → 13.0.0

package/lib/third-party/arborist/lib/npm-extension.js

@@ -0,0 +1,45 @@
+// Local stub for npm-extension.  Upstream discovers a root
+// .npm-extension.{mjs,cjs} file and imports it, then calls its
+// transformManifest export against every installed package's manifest.  That
+// is arbitrary project-local code execution during what is, for cdxgen, a
+// read-only scan, so this stub reports that no extension file is present.
+//
+// The only part of the contract loadActual depends on is `present`:
+// #applyNpmExtension() returns early when it is false, before load() or
+// apply() can be reached.  Those two methods therefore throw rather than
+// return a plausible-looking result, so that an upstream change which reaches
+// them fails loudly instead of silently producing a tree that differs from
+// npm's.
+//
+// Consequence: on loadActual, a project carrying a .npm-extension file gets a
+// tree without the dependency repairs npm would apply.  loadVirtual is
+// unaffected — npm bakes the repaired edges into the lockfile, so reading the
+// lockfile already reflects them.
+
+const REFUSED = "cdxgen does not execute .npm-extension code";
+
+class NpmExtension {
+  constructor() {
+    this.present = false;
+    this.root = null;
+    this.path = null;
+    this.format = null;
+    this.hash = null;
+  }
+
+  async load() {
+    throw new Error(REFUSED);
+  }
+
+  apply() {
+    throw new Error(REFUSED);
+  }
+}
+
+const hasExtensionFile = () => false;
+
+NpmExtension.NpmExtension = NpmExtension;
+NpmExtension.hasExtensionFile = hasExtensionFile;
+
+export default NpmExtension;
+export { hasExtensionFile, NpmExtension };

package/lib/third-party/arborist/lib/override-resolves.js

@@ -0,0 +1,11 @@
+function overrideResolves(resolved, opts) {
+  const { omitLockfileRegistryResolved = false } = opts;
+
+  if (omitLockfileRegistryResolved) {
+    return undefined;
+  }
+
+  return resolved;
+}
+
+export { overrideResolves };

package/lib/third-party/arborist/lib/override-set.js

@@ -0,0 +1,319 @@
+import npa from "npm-package-arg";
+import semver from "semver";
+
+import { log } from "./proc-log.js";
+
+class OverrideSet {
+  constructor({ overrides, key, parent }) {
+    this.parent = parent;
+    this.children = new Map();
+
+    if (typeof overrides === "string") {
+      overrides = { ".": overrides };
+    }
+
+    // change a literal empty string to * so we can use truthiness checks on
+    // the value property later
+    if (overrides["."] === "") {
+      overrides["."] = "*";
+    }
+
+    if (parent) {
+      const spec = npa(key);
+      if (!spec.name) {
+        throw new Error(`Override without name: ${key}`);
+      }
+
+      this.name = spec.name;
+      spec.name = "";
+      this.key = key;
+      this.keySpec = spec.toString();
+      this.value = overrides["."] || this.keySpec;
+    }
+
+    for (const [key, childOverrides] of Object.entries(overrides)) {
+      if (key === ".") {
+        continue;
+      }
+
+      const child = new OverrideSet({
+        parent: this,
+        key,
+        overrides: childOverrides,
+      });
+
+      this.children.set(child.key, child);
+    }
+  }
+
+  childrenAreEqual(other) {
+    if (this.children.size !== other.children.size) {
+      return false;
+    }
+    for (const [key] of this.children) {
+      if (!other.children.has(key)) {
+        return false;
+      }
+      if (this.children.get(key).value !== other.children.get(key).value) {
+        return false;
+      }
+      if (!this.children.get(key).childrenAreEqual(other.children.get(key))) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  isEqual(other) {
+    if (this === other) {
+      return true;
+    }
+    if (!other) {
+      return false;
+    }
+    if (this.key !== other.key || this.value !== other.value) {
+      return false;
+    }
+    if (!this.childrenAreEqual(other)) {
+      return false;
+    }
+    if (!this.parent) {
+      return !other.parent;
+    }
+    return this.parent.isEqual(other.parent);
+  }
+
+  getEdgeRule(edge) {
+    for (const rule of this.ruleset.values()) {
+      if (rule.name !== edge.name) {
+        continue;
+      }
+
+      // if keySpec is * we found our override
+      if (rule.keySpec === "*") {
+        return rule;
+      }
+
+      // We need to use the rawSpec here, because the spec has the overrides applied to it already.
+      // rawSpec can be undefined, so we need to use the fallback value of spec if it is.
+      let spec = npa(`${edge.name}@${edge.rawSpec || edge.spec}`);
+      if (spec.type === "alias") {
+        spec = spec.subSpec;
+      }
+
+      if (spec.type === "git") {
+        if (spec.gitRange && semver.intersects(spec.gitRange, rule.keySpec)) {
+          return rule;
+        }
+
+        continue;
+      }
+
+      if (spec.type === "range" || spec.type === "version") {
+        if (semver.intersects(spec.fetchSpec, rule.keySpec)) {
+          return rule;
+        }
+
+        continue;
+      }
+
+      // if we got this far, the spec type is one of tag, directory or file
+      // which means we have no real way to make version comparisons, so we
+      // just accept the override
+      return rule;
+    }
+
+    return this;
+  }
+
+  getNodeRule(node) {
+    for (const rule of this.ruleset.values()) {
+      if (rule.name !== node.name) {
+        continue;
+      }
+
+      if (
+        semver.satisfies(node.version, rule.keySpec) ||
+        semver.satisfies(node.version, rule.value)
+      ) {
+        return rule;
+      }
+    }
+
+    return this;
+  }
+
+  getMatchingRule(node) {
+    for (const rule of this.ruleset.values()) {
+      if (rule.name !== node.name) {
+        continue;
+      }
+
+      if (
+        semver.satisfies(node.version, rule.keySpec) ||
+        semver.satisfies(node.version, rule.value)
+      ) {
+        return rule;
+      }
+    }
+
+    return null;
+  }
+
+  *ancestry() {
+    for (let ancestor = this; ancestor; ancestor = ancestor.parent) {
+      yield ancestor;
+    }
+  }
+
+  get isRoot() {
+    return !this.parent;
+  }
+
+  get ruleset() {
+    const ruleset = new Map();
+
+    for (const override of this.ancestry()) {
+      for (const kid of override.children.values()) {
+        if (!ruleset.has(kid.key)) {
+          ruleset.set(kid.key, kid);
+        }
+      }
+
+      if (!override.isRoot && !ruleset.has(override.key)) {
+        ruleset.set(override.key, override);
+      }
+    }
+
+    return ruleset;
+  }
+
+  static findSpecificOverrideSet(first, second) {
+    for (
+      let overrideSet = second;
+      overrideSet;
+      overrideSet = overrideSet.parent
+    ) {
+      if (overrideSet.isEqual(first)) {
+        return second;
+      }
+    }
+    for (
+      let overrideSet = first;
+      overrideSet;
+      overrideSet = overrideSet.parent
+    ) {
+      if (overrideSet.isEqual(second)) {
+        return first;
+      }
+    }
+
+    // The override sets are incomparable (e.g. siblings like the "react" and "react-dom" children of the root override set). Check if they have semantically conflicting rules before treating this as an error.
+    if (OverrideSet.haveConflictingRules(first, second)) {
+      log.silly("Conflicting override sets", first, second);
+      return undefined;
+    }
+
+    // The override sets are structurally incomparable but have compatible rules. Fall back to their nearest common ancestor so the node still has a valid override set.
+    return OverrideSet.findCommonAncestor(first, second);
+  }
+
+  static findCommonAncestor(first, second) {
+    const firstAncestors = [];
+    for (const ancestor of first.ancestry()) {
+      firstAncestors.push(ancestor);
+    }
+    for (const secondAnc of second.ancestry()) {
+      for (const firstAnc of firstAncestors) {
+        if (firstAnc.isEqual(secondAnc)) {
+          return firstAnc;
+        }
+      }
+    }
+    return null;
+  }
+
+  static doOverrideSetsConflict(first, second) {
+    // If override sets contain one another then we can try to use the more specific one.
+    // If neither one is more specific, check for semantic conflicts.
+    const specificSet = OverrideSet.findSpecificOverrideSet(first, second);
+    if (specificSet !== undefined) {
+      // One contains the other, so no conflict
+      return false;
+    }
+
+    // The override sets are structurally incomparable, but this doesn't necessarily
+    // mean they conflict. We need to check if they have conflicting version requirements
+    // for any package that appears in both rulesets.
+    return OverrideSet.haveConflictingRules(first, second);
+  }
+
+  static haveConflictingRules(first, second) {
+    // Get all rules from both override sets
+    const firstRules = first.ruleset;
+    const secondRules = second.ruleset;
+
+    // Check each package that appears in both rulesets
+    for (const [key, firstRule] of firstRules) {
+      const secondRule = secondRules.get(key);
+      if (!secondRule) {
+        // Package only appears in one ruleset, no conflict
+        continue;
+      }
+
+      // Same rule object means no conflict
+      if (firstRule === secondRule || firstRule.isEqual(secondRule)) {
+        continue;
+      }
+
+      // Both rulesets have rules for this package with different values.
+      // Check if the version requirements are actually incompatible.
+      const firstValue = firstRule.value;
+      const secondValue = secondRule.value;
+
+      // If either value is a reference (starts with $), we can't determine
+      // compatibility here - the reference might resolve to compatible versions.
+      // We defer to runtime resolution rather than failing early.
+      if (firstValue.startsWith("$") || secondValue.startsWith("$")) {
+        continue;
+      }
+
+      // Check if the version ranges are compatible using semver
+      // If both specify version ranges, they conflict only if they have no overlap
+      try {
+        const firstSpec = npa(`${firstRule.name}@${firstValue}`);
+        const secondSpec = npa(`${secondRule.name}@${secondValue}`);
+
+        // For range/version types, check if they intersect
+        if (
+          (firstSpec.type === "range" || firstSpec.type === "version") &&
+          (secondSpec.type === "range" || secondSpec.type === "version")
+        ) {
+          // Check if the ranges intersect
+          const firstRange = firstSpec.fetchSpec;
+          const secondRange = secondSpec.fetchSpec;
+
+          // If the ranges don't intersect, we have a real conflict
+          if (!semver.intersects(firstRange, secondRange)) {
+            log.silly("Found conflicting override rules", {
+              package: firstRule.name,
+              first: firstValue,
+              second: secondValue,
+            });
+            return true;
+          }
+        }
+        // For other types (git, file, directory, tag), we can't easily determine
+        // compatibility, so we conservatively assume no conflict
+      } catch {
+        // If we can't parse the specs, conservatively assume no conflict
+        // Real conflicts will be caught during dependency resolution
+      }
+    }
+
+    // No conflicting rules found
+    return false;
+  }
+}
+
+export default OverrideSet;

package/lib/third-party/arborist/lib/package-extensions.js

@@ -0,0 +1,289 @@
+import semver from "semver";
+import ssri from "ssri";
+
+import validateName from "./validate-npm-package-name.js";
+
+// Root-owned `packageExtensions`: declarative repairs to third-party manifests applied before Arborist reads a candidate's dependency edges.
+// See RFC: https://github.com/npm/rfcs/pull/889
+// This module is pure: it parses and validates the root rule set, matches a candidate manifest by name and version, and returns an extended manifest copy plus minimal provenance.
+// It never mutates the input manifest or any shared cache object.
+
+// The only manifest fields a package extension may add or correct, because they are the fields that affect dependency and peer resolution.
+const EXTENSION_FIELDS = [
+  "dependencies",
+  "optionalDependencies",
+  "peerDependencies",
+  "peerDependenciesMeta",
+];
+
+// The two normal dependency fields; a name may exist in only one of them.
+const NORMAL_DEP_FIELDS = ["dependencies", "optionalDependencies"];
+
+const err = (message, code, extra = {}) =>
+  Object.assign(new Error(message), { code, ...extra });
+
+// Parse a selector key into { name, range }, where range is null for a name-only key.
+// Selectors are a package name with an optional semver range; dist-tags, git, file, directory, url, and alias specs are rejected.
+const parseSelector = (key) => {
+  if (typeof key !== "string" || !key) {
+    throw err(
+      `Invalid packageExtensions selector: ${JSON.stringify(key)}`,
+      "EEXTENSIONSELECTOR",
+    );
+  }
+  // The separator @ is the first @ after a leading scope @.
+  const at = key.indexOf("@", key.startsWith("@") ? 1 : 0);
+  const name = at === -1 ? key : key.slice(0, at);
+  const range = at === -1 ? null : key.slice(at + 1);
+
+  const { validForOldPackages, validForNewPackages } = validateName(name);
+  if (!validForOldPackages && !validForNewPackages) {
+    throw err(
+      `Invalid package name in packageExtensions selector: "${key}"`,
+      "EEXTENSIONSELECTOR",
+      { selector: key },
+    );
+  }
+  // A blank range such as "foo@" is malformed; the name-only form "foo" is how you match every version.
+  if (range !== null && range.trim() === "") {
+    throw err(
+      `Invalid packageExtensions selector: "${key}". Use the name only to match every version.`,
+      "EEXTENSIONSELECTOR",
+      { selector: key },
+    );
+  }
+  // A versioned selector must be a valid semver range, which rejects dist-tags, git, file, url, and alias specs.
+  if (range !== null && semver.validRange(range, { loose: true }) === null) {
+    throw err(
+      `Invalid version range in packageExtensions selector: "${key}". Selectors accept a package name with an optional semver range only.`,
+      "EEXTENSIONSELECTOR",
+      { selector: key },
+    );
+  }
+  return { name, range };
+};
+
+// A selector matches a candidate manifest by its own name and version.
+// Name-only selectors match every version, including non-semver versions.
+// Versioned selectors only match versions that parse as semver and satisfy the range.
+const rangeMatches = (range, version) => {
+  if (range === null) {
+    return true;
+  }
+  return (
+    semver.valid(version, { loose: true }) !== null &&
+    semver.satisfies(version, range, { loose: true })
+  );
+};
+
+// Validate a single selector's extension object before it is ever applied.
+const validateExtensionObject = (key, ext) => {
+  if (ext === null || typeof ext !== "object" || Array.isArray(ext)) {
+    throw err(
+      `packageExtensions["${key}"] must be an object`,
+      "EEXTENSIONVALUE",
+      { selector: key },
+    );
+  }
+  for (const field of Object.keys(ext)) {
+    if (!EXTENSION_FIELDS.includes(field)) {
+      throw err(
+        `packageExtensions["${key}"] has unsupported field "${field}". Supported fields: ${EXTENSION_FIELDS.join(", ")}.`,
+        "EEXTENSIONFIELD",
+        { selector: key, field },
+      );
+    }
+    const val = ext[field];
+    if (val === null || typeof val !== "object" || Array.isArray(val)) {
+      throw err(
+        `packageExtensions["${key}"].${field} must be an object`,
+        "EEXTENSIONVALUE",
+        { selector: key, field },
+      );
+    }
+  }
+  // Deletion is not supported in v1, so a null, false, or "-" value is an error.
+  for (const field of [...NORMAL_DEP_FIELDS, "peerDependencies"]) {
+    for (const [name, spec] of Object.entries(ext[field] || {})) {
+      if (spec === null || spec === false || spec === "-") {
+        throw err(
+          `packageExtensions["${key}"].${field}.${name} attempts deletion, which is not supported.`,
+          "EEXTENSIONDELETE",
+          { selector: key, field, name },
+        );
+      }
+    }
+  }
+  // Each peerDependenciesMeta entry must be a non-null metadata object, never a deletion sentinel or primitive.
+  for (const [name, meta] of Object.entries(ext.peerDependenciesMeta || {})) {
+    if (meta === null || typeof meta !== "object" || Array.isArray(meta)) {
+      throw err(
+        `packageExtensions["${key}"].peerDependenciesMeta.${name} must be an object`,
+        "EEXTENSIONVALUE",
+        { selector: key, field: "peerDependenciesMeta", name },
+      );
+    }
+  }
+};
+
+// Apply a matched extension to a manifest, returning { pkg, applied } where pkg is a copy with extended fields and applied is minimal provenance.
+// The input manifest is never mutated.
+const applyExtension = (pkg, { key, ext }) => {
+  const applied = { selector: key };
+
+  // Clone only the fields we may touch; the rest of the manifest is shared by reference since it is never mutated.
+  const next = { ...pkg };
+  for (const field of EXTENSION_FIELDS) {
+    if (pkg[field] && typeof pkg[field] === "object") {
+      next[field] =
+        field === "peerDependenciesMeta"
+          ? Object.fromEntries(
+              Object.entries(pkg[field]).map(([n, m]) => [n, { ...m }]),
+            )
+          : { ...pkg[field] };
+    }
+  }
+
+  // dependencies and optionalDependencies add missing names only.
+  // A name already declared in either normal dependency field is an error, which also prevents moving a name between the fields.
+  for (const field of NORMAL_DEP_FIELDS) {
+    const adds = ext[field];
+    if (!adds) {
+      continue;
+    }
+    for (const [name, spec] of Object.entries(adds)) {
+      for (const existingField of NORMAL_DEP_FIELDS) {
+        if (next[existingField] && name in next[existingField]) {
+          throw err(
+            `packageExtensions["${key}"].${field}.${name} conflicts with the package's existing ${existingField}.${name}. Use overrides to change a dependency version; packageExtensions only adds missing dependencies.`,
+            "EEXTENSIONDUPDEP",
+            { selector: key, field, name, existingField },
+          );
+        }
+      }
+      next[field] = next[field] || {};
+      next[field][name] = spec;
+      (applied[field] = applied[field] || []).push(name);
+    }
+  }
+
+  // peerDependencies shallow-merges by peer name, and the extension value replaces an existing range.
+  if (ext.peerDependencies) {
+    next.peerDependencies = next.peerDependencies || {};
+    for (const [name, spec] of Object.entries(ext.peerDependencies)) {
+      next.peerDependencies[name] = spec;
+      (applied.peerDependencies = applied.peerDependencies || []).push(name);
+    }
+  }
+
+  // peerDependenciesMeta merges by peer name, then shallow-merges each meta object so an extension can add optional without dropping other meta keys.
+  if (ext.peerDependenciesMeta) {
+    next.peerDependenciesMeta = next.peerDependenciesMeta || {};
+    for (const [name, meta] of Object.entries(ext.peerDependenciesMeta)) {
+      next.peerDependenciesMeta[name] = {
+        ...next.peerDependenciesMeta[name],
+        ...meta,
+      };
+      (applied.peerDependenciesMeta = applied.peerDependenciesMeta || []).push(
+        name,
+      );
+      // Every peerDependenciesMeta entry an extension adds must correspond to a peerDependencies entry present after extension application.
+      if (!next.peerDependencies || !(name in next.peerDependencies)) {
+        throw err(
+          `packageExtensions["${key}"].peerDependenciesMeta.${name} has no corresponding peerDependencies.${name} after extension application.`,
+          "EEXTENSIONORPHANMETA",
+          { selector: key, name },
+        );
+      }
+    }
+  }
+
+  return { pkg: next, applied };
+};
+
+// Deterministic JSON for hashing: keys sorted lexicographically at every level, string and number values preserved exactly, no insignificant whitespace.
+const canonicalStringify = (val) => {
+  if (Array.isArray(val)) {
+    return `[${val.map(canonicalStringify).join(",")}]`;
+  }
+  if (val && typeof val === "object") {
+    return `{${Object.keys(val)
+      .sort()
+      .map((k) => `${JSON.stringify(k)}:${canonicalStringify(val[k])}`)
+      .join(",")}}`;
+  }
+  return JSON.stringify(val);
+};
+
+// Hash the canonical form of the root packageExtensions object using npm's existing lockfile digest encoding.
+const canonicalHash = (packageExtensions) =>
+  ssri
+    .fromData(canonicalStringify(packageExtensions), { algorithms: ["sha512"] })
+    .toString();
+
+class PackageExtensions {
+  constructor(raw) {
+    this.raw = raw;
+    this.present = raw !== undefined;
+    this.selectors = [];
+    this.hash = null;
+
+    if (!this.present) {
+      return;
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      throw err("packageExtensions must be an object", "EEXTENSIONROOT");
+    }
+    for (const [key, ext] of Object.entries(raw)) {
+      const { name, range } = parseSelector(key);
+      validateExtensionObject(key, ext);
+      this.selectors.push({ key, name, range, ext });
+    }
+    this.hash = canonicalHash(raw);
+  }
+
+  // Non-throwing check used for warnings: whether any selector matches the candidate.
+  wouldMatch(name, version) {
+    return this.selectors.some(
+      (s) => s.name === name && rangeMatches(s.range, version),
+    );
+  }
+
+  // Return the single selector matching a candidate manifest, or null.
+  // Throws EEXTENSIONCONFLICT when more than one selector matches the same candidate.
+  match(name, version) {
+    const matches = this.selectors.filter(
+      (s) => s.name === name && rangeMatches(s.range, version),
+    );
+    if (matches.length > 1) {
+      const keys = matches.map((s) => `"${s.key}"`).join(", ");
+      throw err(
+        `Multiple packageExtensions selectors match ${name}@${version}: ${keys}. Narrow or remove one of the overlapping rules.`,
+        "EEXTENSIONCONFLICT",
+        { name, version, selectors: matches.map((s) => s.key) },
+      );
+    }
+    return matches[0] || null;
+  }
+
+  // Apply the matching extension to a manifest copy, returning { pkg, applied } or null when no selector matches.
+  // Throws on selector conflict or invalid merge.
+  apply(pkg) {
+    if (!this.present || !this.selectors.length || !pkg || !pkg.name) {
+      return null;
+    }
+    const sel = this.match(pkg.name, pkg.version);
+    return sel ? applyExtension(pkg, sel) : null;
+  }
+}
+
+export default PackageExtensions;
+
+export {
+  canonicalHash,
+  canonicalStringify,
+  EXTENSION_FIELDS,
+  PackageExtensions,
+  parseSelector,
+  rangeMatches,
+};