@cdxgen/cdxgen 0.0.1 → 13.0.1

package/lib/third-party/arborist/lib/dep-valid.js

@@ -0,0 +1,190 @@
+import { relative } from "node:path";
+
+import npa from "npm-package-arg";
+import semver from "semver";
+
+import fromPath from "./from-path.js";
+
+// Do not rely on package._fields, so that we don't throw
+// false failures if a tree is generated by other clients.
+// Only relies on child.resolved, which MAY come from
+// client-specific package.json meta _fields, but most of
+// the time will be pulled out of a lockfile
+
+// A named ref (tag or branch) resolves to a commit hash, so look up the
+// committish recorded for this edge in the lockfile to detect spec changes.
+const lockedGitCommittish = (child, requestor) => {
+  const lock = requestor.root?.meta?.data?.packages?.[requestor.location];
+  const spec =
+    lock &&
+    (lock.dependencies?.[child.name] ||
+      lock.optionalDependencies?.[child.name] ||
+      lock.devDependencies?.[child.name] ||
+      lock.peerDependencies?.[child.name]);
+  if (!spec) {
+    return null;
+  }
+  try {
+    const parsed = npa.resolve(child.name, spec, requestor.realpath);
+    return parsed.type === "git" ? parsed.gitCommittish || "" : null;
+  } catch {
+    return null;
+  }
+};
+
+const depValid = (child, requested, requestor) => {
+  // NB: we don't do much to verify 'tag' type requests.
+  // Just verify that we got a remote resolution.  Presumably, it
+  // came from a registry and was tagged at some point.
+
+  if (typeof requested === "string") {
+    try {
+      // tarball/dir must have resolved to the same tgz on disk, but for
+      // file: deps that depend on other files/dirs, we must resolve the
+      // location based on the *requestor* file/dir, not where it ends up.
+      // '' is equivalent to '*'
+      requested = npa.resolve(
+        child.name,
+        requested || "*",
+        fromPath(requestor, requestor.edgesOut.get(child.name)),
+      );
+    } catch (er) {
+      // Not invalid because the child doesn't match, but because
+      // the spec itself is not supported.  Nothing would match,
+      // so the edge is definitely not valid and never can be.
+      er.dependency = child.name;
+      er.requested = requested;
+      requestor.errors.push(er);
+      return false;
+    }
+  }
+
+  // if the lockfile is super old, or hand-modified,
+  // then it's possible to hit this state.
+  if (!requested) {
+    const er = new Error("Invalid dependency specifier");
+    er.dependency = child.name;
+    er.requested = requested;
+    requestor.errors.push(er);
+    return false;
+  }
+
+  switch (requested.type) {
+    case "range":
+      if (requested.fetchSpec === "*") {
+        return true;
+      }
+    // fallthrough
+    case "version":
+      // if it's a version or a range other than '*', semver it
+      return semver.satisfies(child.version, requested.fetchSpec, true);
+
+    case "directory":
+      return linkValid(child, requested, requestor);
+
+    case "file":
+      return tarballValid(child, requested, requestor);
+
+    case "alias":
+      // check that the alias target is valid
+      return depValid(child, requested.subSpec, requestor);
+
+    case "tag":
+      // if it's a tag, we just verify that it has a tarball resolution
+      // presumably, it came from the registry and was tagged at some point
+      return child.resolved && npa(child.resolved).type === "remote";
+
+    case "remote":
+      // verify that we got it from the desired location
+      return child.resolved === requested.fetchSpec;
+
+    case "git": {
+      // if it's a git type, verify that they're the same repo
+      //
+      // if it specifies a definite commit, then it must have the
+      // same commit to be considered the same repo
+      //
+      // if it has a #semver:<range> specifier, verify that the
+      // version in the package is in the semver range
+      const resRepo = npa(child.resolved || "");
+      const resHost = resRepo.hosted;
+      const reqHost = requested.hosted;
+      const reqCommit = /^[a-fA-F0-9]{40,64}$/.test(
+        requested.gitCommittish || "",
+      );
+      const nc = { noCommittish: !reqCommit };
+      if (!resHost) {
+        if (resRepo.fetchSpec !== requested.fetchSpec) {
+          return false;
+        }
+      } else {
+        if (reqHost?.ssh(nc) !== resHost.ssh(nc)) {
+          return false;
+        }
+      }
+      if (!requested.gitRange) {
+        // a named ref can't be verified against the resolved commit offline,
+        // so re-resolve if it differs from the committish in the lockfile
+        if (!reqCommit) {
+          const locked = lockedGitCommittish(child, requestor);
+          if (locked !== null && locked !== (requested.gitCommittish || "")) {
+            return false;
+          }
+        }
+        return true;
+      }
+      return semver.satisfies(child.package.version, requested.gitRange, {
+        loose: true,
+      });
+    }
+
+    default: // impossible, just being cautious
+      break;
+  }
+
+  const er = new Error("Unsupported dependency type");
+  er.dependency = child.name;
+  er.requested = requested;
+  requestor.errors.push(er);
+  return false;
+};
+
+const linkValid = (child, requested, requestor) => {
+  const isLink = !!child.isLink;
+  // if we're installing links and the node is a link, then it's invalid because we want
+  // a real node to be there.  Except for workspaces. They are always links.
+  if (requestor.installLinks && !child.isWorkspace) {
+    return !isLink;
+  }
+
+  // directory must be a link to the specified folder
+  return isLink && relative(child.realpath, requested.fetchSpec) === "";
+};
+
+const tarballValid = (child, requested) => {
+  if (child.isLink) {
+    return false;
+  }
+
+  if (child.resolved) {
+    return (
+      child.resolved.replace(/\\/g, "/") ===
+      `file:${requested.fetchSpec.replace(/\\/g, "/")}`
+    );
+  }
+
+  // if we have a legacy mutated package.json file.  we can't be 100%
+  // sure that it resolved to the same file, but if it was the same
+  // request, that's a pretty good indicator of sameness.
+  if (child.package._requested) {
+    return child.package._requested.saveSpec === requested.saveSpec;
+  }
+
+  // ok, we're probably dealing with some legacy cruft here, not much
+  // we can do at this point unfortunately.
+  return false;
+};
+
+export default (child, requested, accept, requestor) =>
+  depValid(child, requested, requestor) ||
+  (typeof accept === "string" ? depValid(child, accept, requestor) : false);

package/lib/third-party/arborist/lib/edge.js

@@ -0,0 +1,417 @@
+import util from "node:util";
+
+import npa from "npm-package-arg";
+
+import depValid from "./dep-valid.js";
+import OverrideSet from "./override-set.js";
+
+// An edge in the dependency graph
+// Represents a dependency relationship of some kind
+
+class ArboristEdge {
+  constructor(edge) {
+    this.name = edge.name;
+    this.spec = edge.spec;
+    this.type = edge.type;
+
+    const edgeFrom = edge.from?.location;
+    const edgeTo = edge.to?.location;
+    const override = edge.overrides?.value;
+
+    if (edgeFrom != null) {
+      this.from = edgeFrom;
+    }
+    if (edgeTo) {
+      this.to = edgeTo;
+    }
+    if (edge.error) {
+      this.error = edge.error;
+    }
+    if (edge.peerConflicted) {
+      this.peerConflicted = true;
+    }
+    if (override) {
+      this.overridden = override;
+    }
+  }
+}
+
+class Edge {
+  #accept;
+  #error;
+  #explanation;
+  #from;
+  #name;
+  #spec;
+  #to;
+  #type;
+
+  static types = Object.freeze([
+    "prod",
+    "dev",
+    "optional",
+    "peer",
+    "peerOptional",
+    "workspace",
+  ]);
+
+  // XXX where is this used?
+  static errors = Object.freeze([
+    "DETACHED",
+    "MISSING",
+    "PEER LOCAL",
+    "INVALID",
+  ]);
+
+  constructor(options) {
+    const { type, name, spec, accept, from, overrides } = options;
+
+    // XXX are all of these error states even possible?
+    if (typeof spec !== "string") {
+      throw new TypeError("must provide string spec");
+    }
+    if (!Edge.types.includes(type)) {
+      throw new TypeError(
+        `invalid type: ${type}\n(valid types are: ${Edge.types.join(", ")})`,
+      );
+    }
+    if (type === "workspace" && npa(spec).type !== "directory") {
+      throw new TypeError("workspace edges must be a symlink");
+    }
+    if (typeof name !== "string") {
+      throw new TypeError("must provide dependency name");
+    }
+    if (!from) {
+      throw new TypeError('must provide "from" node');
+    }
+    if (accept !== undefined) {
+      if (typeof accept !== "string") {
+        throw new TypeError("accept field must be a string if provided");
+      }
+      this.#accept = accept || "*";
+    }
+    if (overrides !== undefined) {
+      this.overrides = overrides;
+    }
+
+    this.#name = name;
+    this.#type = type;
+    this.#spec = spec;
+    this.#explanation = null;
+    this.#from = from;
+
+    from.edgesOut.get(this.#name)?.detach();
+    from.addEdgeOut(this);
+
+    this.reload(true);
+    this.peerConflicted = false;
+  }
+
+  satisfiedBy(node) {
+    if (node.name !== this.#name || !this.#from) {
+      return false;
+    }
+
+    // NOTE: this condition means we explicitly do not support overriding
+    // bundled dependencies
+    if (node.inDepBundle) {
+      return depValid(node, this.rawSpec, this.#accept, this.#from);
+    }
+
+    // If there's no override we just use the spec.
+    if (!this.overrides?.keySpec) {
+      return depValid(node, this.spec, this.#accept, this.#from);
+    }
+    // There's some override. If the target node satisfies the overriding spec
+    // then it's okay.
+    if (depValid(node, this.spec, this.#accept, this.#from)) {
+      return true;
+    }
+    // If it doesn't, then it should at least satisfy the original spec.
+    if (!depValid(node, this.rawSpec, this.#accept, this.#from)) {
+      return false;
+    }
+    // It satisfies the original spec, not the overriding spec. We need to make
+    // sure it doesn't use the overridden spec.
+    // For example:
+    //   we might have an ^8.0.0 rawSpec, and an override that makes
+    //   keySpec=8.23.0 and the override value spec=9.0.0.
+    //   If the node is 9.0.0, then it's okay because it's consistent with spec.
+    //   If the node is 8.24.0, then it's okay because it's consistent with the rawSpec.
+    //   If the node is 8.23.0, then it's not okay because even though it's consistent
+    //   with the rawSpec, it's also consistent with the keySpec.
+    //   So we're looking for ^8.0.0 or 9.0.0 and not 8.23.0.
+    return !depValid(node, this.overrides.keySpec, this.#accept, this.#from);
+  }
+
+  // return the edge data, and an explanation of how that edge came to be here
+  explain(seen = []) {
+    if (!this.#explanation) {
+      const explanation = {
+        type: this.#type,
+        name: this.#name,
+        spec: this.spec,
+      };
+      if (this.rawSpec !== this.spec) {
+        explanation.rawSpec = this.rawSpec;
+        explanation.overridden = true;
+      }
+      if (this.bundled) {
+        explanation.bundled = this.bundled;
+      }
+      if (this.error) {
+        explanation.error = this.error;
+      }
+      if (this.#from) {
+        explanation.from = this.#from.explain(null, seen);
+        // note when this edge was created or changed by a root packageExtensions repair on the from node
+        const applied = this.#from.packageExtensionsApplied;
+        if (applied) {
+          for (const field of [
+            "dependencies",
+            "optionalDependencies",
+            "peerDependencies",
+            "peerDependenciesMeta",
+          ]) {
+            if (applied[field]?.includes(this.#name)) {
+              explanation.packageExtensions = {
+                selector: applied.selector,
+                field,
+              };
+              break;
+            }
+          }
+        }
+        // note when this edge was created or changed by a root .npm-extension transformManifest repair on the from node
+        const transformed = this.#from.npmExtensionApplied;
+        if (transformed) {
+          for (const field of [
+            "dependencies",
+            "optionalDependencies",
+            "peerDependencies",
+            "peerDependenciesMeta",
+          ]) {
+            if (transformed[field]?.includes(this.#name)) {
+              explanation.npmExtension = {
+                extensionPoint: transformed.extensionPoint,
+                field,
+              };
+              break;
+            }
+          }
+        }
+      }
+      this.#explanation = explanation;
+    }
+    return this.#explanation;
+  }
+
+  get bundled() {
+    return !!this.#from?.package?.bundleDependencies?.includes(this.#name);
+  }
+
+  get workspace() {
+    return this.#type === "workspace";
+  }
+
+  get prod() {
+    return this.#type === "prod";
+  }
+
+  get dev() {
+    return this.#type === "dev";
+  }
+
+  get optional() {
+    return this.#type === "optional" || this.#type === "peerOptional";
+  }
+
+  get peer() {
+    return this.#type === "peer" || this.#type === "peerOptional";
+  }
+
+  get type() {
+    return this.#type;
+  }
+
+  get name() {
+    return this.#name;
+  }
+
+  get rawSpec() {
+    return this.#spec;
+  }
+
+  get spec() {
+    if (
+      this.overrides?.value &&
+      this.overrides.value !== "*" &&
+      this.overrides.name === this.#name
+    ) {
+      if (this.overrides.value.startsWith("$")) {
+        const ref = this.overrides.value.slice(1);
+        let pkg = this.#from?.sourceReference
+          ? this.#from?.sourceReference.root.package
+          : this.#from?.root?.package;
+
+        let specValue = this.#calculateReferentialOverrideSpec(ref, pkg);
+
+        // If the package isn't found in the root package, fall back to the local package.
+        if (!specValue) {
+          pkg = this.#from?.package;
+          specValue = this.#calculateReferentialOverrideSpec(ref, pkg);
+        }
+
+        if (specValue) {
+          return specValue;
+        }
+        throw new Error(`Unable to resolve reference ${this.overrides.value}`);
+      }
+      return this.overrides.value;
+    }
+    return this.#spec;
+  }
+
+  #calculateReferentialOverrideSpec(ref, pkg) {
+    if (pkg.devDependencies?.[ref]) {
+      return pkg.devDependencies[ref];
+    }
+    if (pkg.optionalDependencies?.[ref]) {
+      return pkg.optionalDependencies[ref];
+    }
+    if (pkg.dependencies?.[ref]) {
+      return pkg.dependencies[ref];
+    }
+    if (pkg.peerDependencies?.[ref]) {
+      return pkg.peerDependencies[ref];
+    }
+  }
+
+  get accept() {
+    return this.#accept;
+  }
+
+  get valid() {
+    return !this.error;
+  }
+
+  get missing() {
+    return this.error === "MISSING";
+  }
+
+  get invalid() {
+    return this.error === "INVALID";
+  }
+
+  get peerLocal() {
+    return this.error === "PEER LOCAL";
+  }
+
+  get error() {
+    if (!this.#error) {
+      if (!this.#to) {
+        if (this.optional) {
+          this.#error = null;
+        } else {
+          this.#error = "MISSING";
+        }
+      } else if (
+        this.peer &&
+        this.#from === this.#to.parent &&
+        !this.#from?.isTop
+      ) {
+        this.#error = "PEER LOCAL";
+      } else if (!this.satisfiedBy(this.#to)) {
+        this.#error = "INVALID";
+      } else if (
+        this.overrides &&
+        this.#to.overrides &&
+        this.#to.edgesOut.size &&
+        OverrideSet.doOverrideSetsConflict(this.overrides, this.#to.overrides)
+      ) {
+        // Check for conflicts between the edge's override set and the target node's override set.
+        // This catches cases where different parts of the tree have genuinely incompatible
+        // version requirements for the same package.
+        // The improved conflict detection uses semantic comparison (checking for incompatible
+        // version ranges) rather than pure structural equality, avoiding false positives from:
+        // - Reference overrides ($syntax) that resolve to compatible versions
+        // - Peer dependencies with different but compatible override contexts
+        // Note: We only check if the target has dependencies (edgesOut.size > 0), since
+        // override conflicts are only relevant if the target has its own dependencies.
+        this.#error = "INVALID";
+      } else {
+        this.#error = "OK";
+      }
+    }
+    if (this.#error === "OK") {
+      return null;
+    }
+    return this.#error;
+  }
+
+  reload(hard = false) {
+    this.#explanation = null;
+
+    let needToUpdateOverrideSet = false;
+    let newOverrideSet;
+    let oldOverrideSet;
+    if (this.#from?.overrides) {
+      newOverrideSet = this.#from.overrides.getEdgeRule(this);
+      if (newOverrideSet && !newOverrideSet.isEqual(this.overrides)) {
+        // If there's a new different override set we need to propagate it to the nodes.
+        // If we're deleting the override set then there's no point propagating it right now since it will be filled with another value later.
+        needToUpdateOverrideSet = true;
+        oldOverrideSet = this.overrides;
+        this.overrides = newOverrideSet;
+      }
+    } else {
+      delete this.overrides;
+    }
+    const newTo = this.#from?.resolve(this.#name);
+    if (newTo !== this.#to) {
+      if (this.#to) {
+        this.#to.deleteEdgeIn(this);
+      }
+      this.#to = newTo;
+      this.#error = null;
+      if (this.#to) {
+        this.#to.addEdgeIn(this);
+      }
+    } else if (hard) {
+      this.#error = null;
+    } else if (needToUpdateOverrideSet && this.#to) {
+      // Propagate the new override set to the target node.
+      this.#to.updateOverridesEdgeInRemoved(oldOverrideSet);
+      this.#to.updateOverridesEdgeInAdded(newOverrideSet);
+    }
+  }
+
+  detach() {
+    this.#explanation = null;
+    if (this.#to) {
+      this.#to.deleteEdgeIn(this);
+    }
+    this.#from?.edgesOut.delete(this.#name);
+    this.#to = null;
+    this.#error = "DETACHED";
+    this.#from = null;
+  }
+
+  get from() {
+    return this.#from;
+  }
+
+  get to() {
+    return this.#to;
+  }
+
+  toJSON() {
+    return new ArboristEdge(this);
+  }
+
+  [util.inspect.custom]() {
+    return this.toJSON();
+  }
+}
+
+export default Edge;

package/lib/third-party/arborist/lib/from-path.js

@@ -0,0 +1,36 @@
+import { dirname } from "node:path";
+
+import npa from "npm-package-arg";
+
+// file dependencies need their dependencies resolved based on the location
+// where the tarball was found, not the location where they end up getting
+// installed.  directory (ie, symlink) deps also need to be resolved based on
+// their targets, but that's what realpath is
+
+const fromPath = (node, edge) => {
+  if (
+    edge &&
+    edge.overrides &&
+    edge.overrides.name === edge.name &&
+    edge.overrides.value
+  ) {
+    // fromPath could be called with a node that has a virtual root, if that
+    // happens we want to make sure we get the real root node when overrides
+    // are in use. this is to allow things like overriding a dependency with a
+    // tarball file that's a relative path from the project root
+    if (node.sourceReference) {
+      return node.sourceReference.root.realpath;
+    }
+    return node.root.realpath;
+  }
+
+  if (node.resolved) {
+    const spec = npa(node.resolved);
+    if (spec?.type === "file") {
+      return dirname(spec.fetchSpec);
+    }
+  }
+  return node.realpath;
+};
+
+export default fromPath;

package/lib/third-party/arborist/lib/gather-dep-set.js

@@ -0,0 +1,43 @@
+// Given a set of nodes in a tree, and a filter function to test
+// incoming edges to the dep set that should be ignored otherwise.
+//
+// find the set of deps that are only depended upon by nodes in the set, or
+// their dependencies, or edges that are ignored.
+//
+// Used when figuring out what to prune when replacing a node with a newer
+// version, or when an optional dep fails to install.
+
+const gatherDepSet = (set, edgeFilter) => {
+  const deps = new Set(set);
+
+  // add the full set of dependencies.  note that this loop will continue
+  // as the deps set increases in size.
+  for (const node of deps) {
+    for (const edge of node.edgesOut.values()) {
+      if (edge.to && edgeFilter(edge)) {
+        deps.add(edge.to);
+      }
+    }
+  }
+
+  // now remove all nodes in the set that have a dependent outside the set
+  // if any change is made, then re-check
+  // continue until no changes made, or deps set evaporates fully.
+  let changed = true;
+  while (changed === true && deps.size > 0) {
+    changed = false;
+    for (const dep of deps) {
+      for (const edge of dep.edgesIn) {
+        if (!deps.has(edge.from) && edgeFilter(edge)) {
+          changed = true;
+          deps.delete(dep);
+          break;
+        }
+      }
+    }
+  }
+
+  return deps;
+};
+
+export default gatherDepSet;

package/lib/third-party/arborist/lib/index.js

@@ -0,0 +1,22 @@
+// Public entry point for the vendored arborist.  Upstream's index.js uses
+// module.exports = require(...) chains that have no mechanical CJS→ESM
+// equivalent, so this file is generated from a fixed template by
+// contrib/vendor-arborist.mjs.
+
+import Arborist from "./arborist/index.js";
+import Edge from "./edge.js";
+import Link from "./link.js";
+import Node from "./node.js";
+import NpmExtension from "./npm-extension.js";
+import PackageExtensions from "./package-extensions.js";
+import Shrinkwrap from "./shrinkwrap.js";
+
+Arborist.Arborist = Arborist;
+Arborist.Node = Node;
+Arborist.Link = Link;
+Arborist.Edge = Edge;
+Arborist.Shrinkwrap = Shrinkwrap;
+Arborist.PackageExtensions = PackageExtensions;
+Arborist.NpmExtension = NpmExtension;
+
+export default Arborist;