@effected/lockfiles 0.6.0 → 0.6.2

package/internal/pnpm.js

@@ -14,7 +14,8 @@ const PnpmImporter = Schema.Struct({
 	dependencies: PnpmImporterDeps,
 	devDependencies: PnpmImporterDeps,
 	peerDependencies: PnpmImporterDeps,
-	optionalDependencies: PnpmImporterDeps
+	optionalDependencies: PnpmImporterDeps,
+	publishDirectory: Schema.optionalKey(Schema.String)
 });
 /**
 * The version gate's own input: `lockfileVersion` and nothing else.
@@ -89,9 +90,23 @@ const parsePnpm = (content) => Effect.gen(function* () {
 * resolution, which names no instance in this lockfile, from becoming a
 * plausible lie.
 *
+* A failed composition gets one second reading: the recorded version ITSELF as
+* an instance id. That is how pnpm spells an `npm:` alias — the dependency
+* `typescript-classic: npm:typescript@^6.0.3` is recorded as
+* `typescript-classic: typescript@6.0.3`, the referenced instance's own key,
+* peer suffix included when one applies. Still compose-then-verify, not a
+* guess: a plain version (`6.0.3`) can never be an instance id, because ids
+* always carry a name, so the reading admits exactly the alias shape.
+*
+* Unlike {@link resolveImporterEdges}, there is no `workspace:`-specifier
+* ancestor walk here — a snapshot body records no specifier, so that evidence
+* does not exist on this path. The publish-directory map needs no specifier:
+* the importer entry's own `publishDirectory` declaration is exact evidence,
+* available to both paths, and is consulted unconditionally.
+*
 * @internal
 */
-const resolveEdges = (sections, instanceIds) => {
+const resolveEdges = (sections, instanceIds, publishDirTargets) => {
 	const edges = /* @__PURE__ */ new Map();
 	const unnameable = /* @__PURE__ */ new Set();
 	for (const section of sections) {
@@ -101,11 +116,13 @@ const resolveEdges = (sections, instanceIds) => {
 			if (version.startsWith(LINK_PREFIX)) {
 				const target = resolveLinkTarget("", version.slice(LINK_PREFIX.length));
 				if (target !== void 0 && instanceIds.has(target)) edges.set(name, target);
+				else if (target !== void 0 && publishDirTargets.has(target)) edges.set(name, publishDirTargets.get(target));
 				else unnameable.add(name);
 				continue;
 			}
 			const bare = `${name}@${version}`;
 			if (instanceIds.has(bare)) edges.set(name, bare);
+			else if (instanceIds.has(version)) edges.set(name, version);
 			else unnameable.add(name);
 		}
 	}
@@ -121,6 +138,13 @@ const LINK_PREFIX = "link:";
 * workspace edge can name the workspace importer's instance id.
 * Total: a target that walks above the root yields `undefined`.
 *
+* A target that normalizes to NOTHING — `link:.` recorded root-relative —
+* also yields `undefined` rather than the root importer's ".": the root
+* importer deliberately emits no `ResolvedPackage` row (its path cannot serve
+* as a package name), so mapping the empty target to "." would hand back an id
+* no row carries, and no pnpm output recording that shape has been observed.
+* The edge stays honestly unnameable instead.
+*
 * @internal
 */
 const resolveLinkTarget = (importerPath, target) => {
@@ -135,6 +159,31 @@ const resolveLinkTarget = (importerPath, target) => {
 	}
 	return segments.length === 0 ? void 0 : segments.join("/");
 };
+/** The specifier protocol pnpm resolves through the workspace itself. @internal */
+const WORKSPACE_PREFIX = "workspace:";
+/**
+* The importer a `link:` target lands INSIDE, longest path first.
+*
+* pnpm's `publishConfig.linkDirectory` makes a workspace link point at the
+* package's publish directory rather than its root — `link:../bundler/dist/dev/pkg`
+* where `packages/bundler` is the importer — so the target itself is a build
+* output that is no importer and never will be. The owning importer is the
+* longest ancestor of the target that IS one; longest-first so a nested importer
+* beats its parent.
+*
+* The root importer (`"."`) is deliberately unreachable here: it is an ancestor
+* of every path in the workspace, so admitting it would resolve every stray link
+* to the root rather than leaving it unnamed.
+*
+* @internal
+*/
+const owningImporter = (target, importerPaths) => {
+	const segments = target.split("/");
+	for (let end = segments.length - 1; end > 0; end--) {
+		const candidate = segments.slice(0, end).join("/");
+		if (importerPaths.has(candidate)) return candidate;
+	}
+};
 /**
 * Resolve one importer's outgoing edges. pnpm records `{ specifier, version }`
 * per importer dependency, where the version is either a registry version (the
@@ -142,9 +191,28 @@ const resolveLinkTarget = (importerPath, target) => {
 * naming another importer — normalized against this importer's own path. Both
 * are checked against the lockfile's instance ids before being emitted.
 *
+* A `link:` target that is no importer gets two further chances. First the
+* publish-directory map: an importer that DECLARES `publishDirectory` has told
+* the lockfile exactly which build directory its links point at, so a target
+* matching a declared publish directory names that importer on evidence, no
+* specifier required — {@link resolveEdges} consults the same map for the same
+* reason. Then, and only under a `workspace:` SPECIFIER, the ancestor walk:
+* pnpm resolved that edge through the workspace, so the target directory is
+* known to belong to a workspace package, and {@link owningImporter} names it.
+* The specifier is what makes the walk a resolution rather than a guess — a
+* hand-written `link:../vendor/stub` specifier names a directory pnpm never
+* claimed was a workspace package, and attributing it to whichever importer
+* happens to contain it would answer with the wrong package's peers instead of
+* admitting it could not name the edge. The snapshot path has no specifier and
+* therefore no walk; the publish-directory map is the evidence it does get.
+*
+* A failed `name@version` composition gets the same alias reading as
+* {@link resolveEdges}: the recorded version itself as an instance id, which is
+* how pnpm spells `npm:` aliases.
+*
 * @internal
 */
-const resolveImporterEdges = (importer, importerPath, instanceIds) => {
+const resolveImporterEdges = (importer, importerPath, instanceIds, importerPaths, publishDirTargets) => {
 	const edges = /* @__PURE__ */ new Map();
 	const unnameable = /* @__PURE__ */ new Set();
 	for (const group of importerDepGroups(importer)) {
@@ -153,12 +221,14 @@ const resolveImporterEdges = (importer, importerPath, instanceIds) => {
 			if (name === "") continue;
 			if (info.version.startsWith(LINK_PREFIX)) {
 				const target = resolveLinkTarget(importerPath, info.version.slice(5));
-				if (target !== void 0 && instanceIds.has(target)) edges.set(name, target);
+				const owner = target === void 0 ? void 0 : instanceIds.has(target) ? target : publishDirTargets.get(target) ?? (info.specifier.startsWith(WORKSPACE_PREFIX) ? owningImporter(target, importerPaths) : void 0);
+				if (owner !== void 0) edges.set(name, owner);
 				else unnameable.add(name);
 				continue;
 			}
 			const bare = `${name}@${info.version}`;
 			if (instanceIds.has(bare)) edges.set(name, bare);
+			else if (instanceIds.has(info.version)) edges.set(name, info.version);
 			else unnameable.add(name);
 		}
 	}
@@ -213,6 +283,14 @@ const toFields = (raw) => Effect.gen(function* () {
 		...raw.packages ? Object.keys(raw.packages) : [],
 		...Object.keys(raw.importers)
 	]);
+	const importerPaths = new Set(Object.keys(raw.importers).filter((path) => path !== "." && path !== ""));
+	const publishDirTargets = /* @__PURE__ */ new Map();
+	for (const [importerPath, importer] of Object.entries(raw.importers)) {
+		if (importerPath === "") continue;
+		if (importer.publishDirectory === void 0) continue;
+		const key = resolveLinkTarget(importerPath, importer.publishDirectory);
+		if (key !== void 0) publishDirTargets.set(key, importerPath);
+	}
 	const emitted = /* @__PURE__ */ new Set();
 	for (const [importerPath, importer] of Object.entries(raw.importers)) {
 		if (importerPath === "." || importerPath === "") continue;
@@ -222,7 +300,7 @@ const toFields = (raw) => Effect.gen(function* () {
 			instanceId: importerPath,
 			isWorkspace: true,
 			relativePath: importerPath,
-			...resolveImporterEdges(importer, importerPath, instanceIds)
+			...resolveImporterEdges(importer, importerPath, instanceIds, importerPaths, publishDirTargets)
 		}));
 	}
 	const emit = (instanceId, meta, edges) => Effect.gen(function* () {
@@ -240,7 +318,7 @@ const toFields = (raw) => Effect.gen(function* () {
 			...integrity !== void 0 ? { integrity } : {},
 			isWorkspace: false,
 			...peerDeclarations(meta?.peerDependencies, meta?.peerDependenciesMeta),
-			...resolveEdges(edges, instanceIds)
+			...resolveEdges(edges, instanceIds, publishDirTargets)
 		}));
 	});
 	if (snapshots) for (const [key, snapshot] of Object.entries(snapshots)) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/lockfiles",
-	"version": "0.6.0",
+	"version": "0.6.2",
 	"private": false,
 	"description": "Pure lockfile parsing for bun, npm, pnpm and yarn Berry into one unified Effect schema model, with pure integrity checking against workspace manifests.",
 	"keywords": [
@@ -41,7 +41,7 @@
 	},
 	"peerDependencies": {
 		"@effected/jsonc": "^0.7.0",
-		"@effected/npm": "^0.11.0",
+		"@effected/npm": "^0.11.1",
 		"@effected/semver": "^0.5.0",
 		"@effected/yaml": "^0.10.0",
 		"effect": "4.0.0-rc.109"

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.58.12"
+      "packageVersion": "7.58.13"
     }
   ]
 }