@effected/lockfiles 0.6.1 → 0.6.3

package/internal/pnpm.js

@@ -14,7 +14,8 @@ const PnpmImporter = Schema.Struct({
 	dependencies: PnpmImporterDeps,
 	devDependencies: PnpmImporterDeps,
 	peerDependencies: PnpmImporterDeps,
-	optionalDependencies: PnpmImporterDeps
+	optionalDependencies: PnpmImporterDeps,
+	publishDirectory: Schema.optionalKey(Schema.String)
 });
 /**
 * The version gate's own input: `lockfileVersion` and nothing else.
@@ -89,9 +90,23 @@ const parsePnpm = (content) => Effect.gen(function* () {
 * resolution, which names no instance in this lockfile, from becoming a
 * plausible lie.
 *
+* A failed composition gets one second reading: the recorded version ITSELF as
+* an instance id. That is how pnpm spells an `npm:` alias — the dependency
+* `typescript-classic: npm:typescript@^6.0.3` is recorded as
+* `typescript-classic: typescript@6.0.3`, the referenced instance's own key,
+* peer suffix included when one applies. Still compose-then-verify, not a
+* guess: a plain version (`6.0.3`) can never be an instance id, because ids
+* always carry a name, so the reading admits exactly the alias shape.
+*
+* Unlike {@link resolveImporterEdges}, there is no `workspace:`-specifier
+* ancestor walk here — a snapshot body records no specifier, so that evidence
+* does not exist on this path. The publish-directory map needs no specifier:
+* the importer entry's own `publishDirectory` declaration is exact evidence,
+* available to both paths, and is consulted unconditionally.
+*
 * @internal
 */
-const resolveEdges = (sections, instanceIds) => {
+const resolveEdges = (sections, instanceIds, publishDirTargets) => {
 	const edges = /* @__PURE__ */ new Map();
 	const unnameable = /* @__PURE__ */ new Set();
 	for (const section of sections) {
@@ -101,11 +116,13 @@ const resolveEdges = (sections, instanceIds) => {
 			if (version.startsWith(LINK_PREFIX)) {
 				const target = resolveLinkTarget("", version.slice(LINK_PREFIX.length));
 				if (target !== void 0 && instanceIds.has(target)) edges.set(name, target);
+				else if (target !== void 0 && publishDirTargets.has(target)) edges.set(name, publishDirTargets.get(target));
 				else unnameable.add(name);
 				continue;
 			}
 			const bare = `${name}@${version}`;
 			if (instanceIds.has(bare)) edges.set(name, bare);
+			else if (instanceIds.has(version)) edges.set(name, version);
 			else unnameable.add(name);
 		}
 	}
@@ -121,6 +138,13 @@ const LINK_PREFIX = "link:";
 * workspace edge can name the workspace importer's instance id.
 * Total: a target that walks above the root yields `undefined`.
 *
+* A target that normalizes to NOTHING — `link:.` recorded root-relative —
+* also yields `undefined` rather than the root importer's ".": the root
+* importer deliberately emits no `ResolvedPackage` row (its path cannot serve
+* as a package name), so mapping the empty target to "." would hand back an id
+* no row carries, and no pnpm output recording that shape has been observed.
+* The edge stays honestly unnameable instead.
+*
 * @internal
 */
 const resolveLinkTarget = (importerPath, target) => {
@@ -167,22 +191,28 @@ const owningImporter = (target, importerPaths) => {
 * naming another importer — normalized against this importer's own path. Both
 * are checked against the lockfile's instance ids before being emitted.
 *
-* A `link:` target that is no importer gets one further chance, and only under
-* a `workspace:` SPECIFIER: pnpm resolved that edge through the workspace, so
-* the target directory is known to belong to a workspace package, and
-* {@link owningImporter} names it. The specifier is what makes this a
-* resolution rather than a guess — a hand-written `link:../vendor/stub`
-* specifier names a directory pnpm never claimed was a workspace package, and
-* attributing it to whichever importer happens to contain it would answer with
-* the wrong package's peers instead of admitting it could not name the edge.
+* A `link:` target that is no importer gets two further chances. First the
+* publish-directory map: an importer that DECLARES `publishDirectory` has told
+* the lockfile exactly which build directory its links point at, so a target
+* matching a declared publish directory names that importer on evidence, no
+* specifier required — {@link resolveEdges} consults the same map for the same
+* reason. Then, and only under a `workspace:` SPECIFIER, the ancestor walk:
+* pnpm resolved that edge through the workspace, so the target directory is
+* known to belong to a workspace package, and {@link owningImporter} names it.
+* The specifier is what makes the walk a resolution rather than a guess — a
+* hand-written `link:../vendor/stub` specifier names a directory pnpm never
+* claimed was a workspace package, and attributing it to whichever importer
+* happens to contain it would answer with the wrong package's peers instead of
+* admitting it could not name the edge. The snapshot path has no specifier and
+* therefore no walk; the publish-directory map is the evidence it does get.
 *
-* The snapshot path ({@link resolveEdges}) deliberately does NOT do this: a
-* snapshot body records `name: link:<path>` with no specifier beside it, so the
-* evidence this rule turns on is not available there.
+* A failed `name@version` composition gets the same alias reading as
+* {@link resolveEdges}: the recorded version itself as an instance id, which is
+* how pnpm spells `npm:` aliases.
 *
 * @internal
 */
-const resolveImporterEdges = (importer, importerPath, instanceIds, importerPaths) => {
+const resolveImporterEdges = (importer, importerPath, instanceIds, importerPaths, publishDirTargets) => {
 	const edges = /* @__PURE__ */ new Map();
 	const unnameable = /* @__PURE__ */ new Set();
 	for (const group of importerDepGroups(importer)) {
@@ -191,13 +221,14 @@ const resolveImporterEdges = (importer, importerPath, instanceIds, importerPaths
 			if (name === "") continue;
 			if (info.version.startsWith(LINK_PREFIX)) {
 				const target = resolveLinkTarget(importerPath, info.version.slice(5));
-				const owner = target === void 0 ? void 0 : instanceIds.has(target) ? target : info.specifier.startsWith(WORKSPACE_PREFIX) ? owningImporter(target, importerPaths) : void 0;
+				const owner = target === void 0 ? void 0 : instanceIds.has(target) ? target : publishDirTargets.get(target) ?? (info.specifier.startsWith(WORKSPACE_PREFIX) ? owningImporter(target, importerPaths) : void 0);
 				if (owner !== void 0) edges.set(name, owner);
 				else unnameable.add(name);
 				continue;
 			}
 			const bare = `${name}@${info.version}`;
 			if (instanceIds.has(bare)) edges.set(name, bare);
+			else if (instanceIds.has(info.version)) edges.set(name, info.version);
 			else unnameable.add(name);
 		}
 	}
@@ -253,6 +284,13 @@ const toFields = (raw) => Effect.gen(function* () {
 		...Object.keys(raw.importers)
 	]);
 	const importerPaths = new Set(Object.keys(raw.importers).filter((path) => path !== "." && path !== ""));
+	const publishDirTargets = /* @__PURE__ */ new Map();
+	for (const [importerPath, importer] of Object.entries(raw.importers)) {
+		if (importerPath === "") continue;
+		if (importer.publishDirectory === void 0) continue;
+		const key = resolveLinkTarget(importerPath, importer.publishDirectory);
+		if (key !== void 0) publishDirTargets.set(key, importerPath);
+	}
 	const emitted = /* @__PURE__ */ new Set();
 	for (const [importerPath, importer] of Object.entries(raw.importers)) {
 		if (importerPath === "." || importerPath === "") continue;
@@ -262,7 +300,7 @@ const toFields = (raw) => Effect.gen(function* () {
 			instanceId: importerPath,
 			isWorkspace: true,
 			relativePath: importerPath,
-			...resolveImporterEdges(importer, importerPath, instanceIds, importerPaths)
+			...resolveImporterEdges(importer, importerPath, instanceIds, importerPaths, publishDirTargets)
 		}));
 	}
 	const emit = (instanceId, meta, edges) => Effect.gen(function* () {
@@ -280,7 +318,7 @@ const toFields = (raw) => Effect.gen(function* () {
 			...integrity !== void 0 ? { integrity } : {},
 			isWorkspace: false,
 			...peerDeclarations(meta?.peerDependencies, meta?.peerDependenciesMeta),
-			...resolveEdges(edges, instanceIds)
+			...resolveEdges(edges, instanceIds, publishDirTargets)
 		}));
 	});
 	if (snapshots) for (const [key, snapshot] of Object.entries(snapshots)) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/lockfiles",
-	"version": "0.6.1",
+	"version": "0.6.3",
 	"private": false,
 	"description": "Pure lockfile parsing for bun, npm, pnpm and yarn Berry into one unified Effect schema model, with pure integrity checking against workspace manifests.",
 	"keywords": [
@@ -41,9 +41,9 @@
 	},
 	"peerDependencies": {
 		"@effected/jsonc": "^0.7.0",
-		"@effected/npm": "^0.11.0",
+		"@effected/npm": "^0.11.1",
 		"@effected/semver": "^0.5.0",
-		"@effected/yaml": "^0.10.0",
+		"@effected/yaml": "^0.11.0",
 		"effect": "4.0.0-rc.109"
 	},
 	"engines": {

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.58.12"
+      "packageVersion": "7.59.0"
     }
   ]
 }