@effected/workspaces 0.23.0 → 0.24.0

package/internal/configDependencyResolution.js

@@ -0,0 +1,307 @@
+import { Array, Duration, Effect, Exit, Option, Predicate, Result } from "effect";
+import { CatalogAssemblyError, PackageManagerCache } from "@effected/npm";
+import { Yaml } from "@effected/yaml";
+import { readFile, readdir, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+
+//#region src/internal/configDependencyResolution.ts
+/** The pnpmfile filenames a config dependency may ship, in the order pnpm tries them. */
+const PNPMFILE_CANDIDATES = [
+	"pnpmfile.mjs",
+	"pnpmfile.cjs",
+	"pnpmfile.js"
+];
+/**
+* The version part of a `configDependencies` spec: the text before the first
+* `+` (`0.9.0+sha512-…` → `0.9.0`); a bare `0.9.0` is returned whole.
+*/
+const declaredVersionOf = (spec) => {
+	const plus = spec.indexOf("+");
+	return plus === -1 ? spec : spec.slice(0, plus);
+};
+/**
+* Whether a config-dependency `name` carries a `..` path segment. A scoped name
+* legitimately contains `/` (`@scope/pkg`), so only a `..` *segment* is rejected —
+* it would traverse out of `.pnpm-config` and feed an attacker-chosen path to the
+* dynamic `import()`.
+*/
+const hasTraversalSegment = (name) => name.split(/[/\\]/).includes("..");
+/** The typed `hooks`-source failure every rung of the ladder reports through. */
+const hooksError = (path, cause) => new CatalogAssemblyError({
+	source: "hooks",
+	path,
+	cause
+});
+/**
+* The declared `(name, version)` pairs of a `configDependencies` map, in
+* declaration order, with EVERY name validated before any path is built from
+* one: a `..` segment fails typed. Shared by both resolvers so the refusal and
+* the version split cannot drift between them.
+*/
+const declaredEntries = (configDependencies) => {
+	const entries = Object.entries(configDependencies).map(([name, spec]) => ({
+		name,
+		version: declaredVersionOf(spec)
+	}));
+	const traversal = entries.find((entry) => hasTraversalSegment(entry.name));
+	return traversal === void 0 ? Effect.succeed(entries) : Effect.fail(hooksError(traversal.name, /* @__PURE__ */ new Error(`config dependency name has a '..' path segment: ${traversal.name}`)));
+};
+/** Whether a `node:fs` rejection means "nothing there" (as opposed to a real IO failure). */
+const isAbsent = (cause) => Predicate.isObject(cause) && (cause.code === "ENOENT" || cause.code === "ENOTDIR");
+/**
+* Run a `node:fs/promises` call, mapping an absent target to `Option.none()`
+* and ANY other rejection (`EACCES`, `EIO`, …) to a typed `hooks` error
+* attributed to `path` — never a silent skip.
+*/
+const ioOrNone = (path, run) => Effect.tryPromise({
+	try: run,
+	catch: (cause) => cause
+}).pipe(Effect.map(Option.some), Effect.catch((cause) => isAbsent(cause) ? Effect.succeed(Option.none()) : Effect.fail(hooksError(path, cause))));
+/**
+* The `version` of the `package.json` in `dir`: `None` when the manifest is
+* absent, `Some("")` when present but carrying no string version (so it can
+* never match a declared version), typed on any other IO failure or on
+* unparseable JSON — a manifest that exists but cannot be read is not
+* evidence of absence.
+*/
+const manifestVersion = (name, dir) => ioOrNone(name, () => readFile(join(dir, "package.json"), "utf8")).pipe(Effect.flatMap((text) => {
+	if (Option.isNone(text)) return Effect.succeed(Option.none());
+	return Effect.try({
+		try: () => JSON.parse(text.value),
+		catch: (cause) => hooksError(name, cause)
+	}).pipe(Effect.map((parsed) => Option.some(Predicate.isObject(parsed) && typeof parsed.version === "string" ? parsed.version : "")));
+}));
+/** Directory entries of `dir`, or `[]` when it is absent; typed on any other failure. */
+const entriesOf = (path, dir) => ioOrNone(path, () => readdir(dir)).pipe(Effect.map(Option.getOrElse(() => [])));
+/** The `<root>/node_modules/.pnpm-config` directory. */
+const pnpmConfigDir = (root) => join(root, "node_modules", ".pnpm-config");
+/**
+* The store directory a realpath'd `.pnpm-config` entry lives under: the
+* parent of the ancestor directory named `links`. `None` when the resolved
+* path is not under a `links` tree (a non-store installation).
+*/
+const storeOfLinkedPath = (resolved) => {
+	let current = resolved;
+	for (;;) {
+		const parent = dirname(current);
+		if (parent === current) return Option.none();
+		if (basename(current) === "links") return Option.some(parent);
+		current = parent;
+	}
+};
+/**
+* Rung 1 of store discovery: the `storeDir` key of
+* `<root>/node_modules/.modules.yaml`. Absent in a config-only install; a
+* malformed file or a missing key contributes nothing (discovery is
+* best-effort — the final error lists what was searched); a non-absent IO
+* failure is typed.
+*/
+const storeFromModulesYaml = (root) => ioOrNone(root, () => readFile(join(root, "node_modules", ".modules.yaml"), "utf8")).pipe(Effect.map((text) => {
+	if (Option.isNone(text)) return [];
+	const parsed = Yaml.parseResult(text.value);
+	if (Result.isFailure(parsed)) return [];
+	const document = parsed.success;
+	return Predicate.isObject(document) && typeof document.storeDir === "string" && document.storeDir.length > 0 ? [document.storeDir] : [];
+}));
+/**
+* Rung 2 of store discovery: the realpath of every `.pnpm-config` entry,
+* each walked up to its `links` ancestor. Scoped entries (`@scope/pkg`) are
+* one level deeper.
+*/
+const storesFromLinks = (root) => Effect.gen(function* () {
+	const base = pnpmConfigDir(root);
+	const candidates = [];
+	for (const entry of yield* entriesOf(root, base)) if (entry.startsWith("@")) for (const inner of yield* entriesOf(root, join(base, entry))) candidates.push(`${entry}/${inner}`);
+	else candidates.push(entry);
+	const stores = [];
+	for (const candidate of candidates) {
+		const resolved = yield* ioOrNone(root, () => realpath(join(base, candidate)));
+		if (Option.isNone(resolved)) continue;
+		const store = storeOfLinkedPath(resolved.value);
+		if (Option.isSome(store)) stores.push(store.value);
+	}
+	return stores;
+});
+/**
+* Rung 3 of store discovery: the conventional store roots — `$PNPM_HOME/store`,
+* `$XDG_DATA_HOME/pnpm/store`, `%LOCALAPPDATA%\pnpm\store` on Windows, then
+* the platform default from `@effected/npm`'s cache table — each expanded to
+* its `v*` subdirectories (a store root holds one directory per store
+* version, `v11` today).
+*/
+const storesFromEnvironment = (root) => Effect.gen(function* () {
+	const env = process.env;
+	const platform = process.platform;
+	const roots = [];
+	if (env.PNPM_HOME) roots.push(join(env.PNPM_HOME, "store"));
+	if (env.XDG_DATA_HOME) roots.push(join(env.XDG_DATA_HOME, "pnpm", "store"));
+	if (platform === "win32" && env.LOCALAPPDATA) roots.push(join(env.LOCALAPPDATA, "pnpm", "store"));
+	const home = homedir();
+	roots.push(PackageManagerCache.defaultDirectory("pnpm", {
+		platform,
+		home
+	}));
+	if (platform !== "win32") roots.push(join(home, ".local", "share", "pnpm", "store"));
+	const stores = [];
+	for (const storeRoot of roots) {
+		const versions = (yield* entriesOf(root, storeRoot)).filter((entry) => /^v\d+$/.test(entry)).sort((a, b) => Number(b.slice(1)) - Number(a.slice(1)));
+		for (const version of versions) stores.push(join(storeRoot, version));
+	}
+	return stores;
+});
+/**
+* Every store directory the ladder searches, in discovery order,
+* deduplicated. IO failures during discovery are attributed to the workspace
+* root, since discovery serves every dependency of one `resolvePnpmfiles`
+* call rather than any single one.
+*/
+const discoverStores = (root) => Effect.gen(function* () {
+	const [fromYaml, fromLinks, fromEnvironment] = yield* Effect.all([
+		storeFromModulesYaml(root),
+		storesFromLinks(root),
+		storesFromEnvironment(root)
+	]);
+	const canonical = [];
+	for (const store of [
+		...fromYaml,
+		...fromLinks,
+		...fromEnvironment
+	]) {
+		const resolved = yield* ioOrNone(root, () => realpath(store));
+		if (Option.isSome(resolved) && !canonical.includes(resolved.value)) canonical.push(resolved.value);
+	}
+	return canonical;
+});
+/**
+* The `<store>/links/<name>/<declared>/<hash>/node_modules/<name>` directories
+* whose manifest carries exactly `declared`, from the FIRST store (in
+* discovery order) that holds any — `[]` when none does.
+*
+* @remarks
+* The `<hash>` segment is pnpm's, and it is NOT derivable from the declared
+* integrity (sha256/sha512 of the integrity string, its decoded bytes, the
+* `name@version` dep path and the tarball URL were all tried and none match),
+* and the store keeps no integrity metadata beside the entry — so the
+* manifest version is the only identity this rung can check.
+*
+* Two rules follow. The decision is scoped to ONE store: discovery order
+* already encodes authority (`.modules.yaml` names the store this workspace
+* installed from, the environment rungs are guesses), so a version held by
+* several distinct stores — `store/v10` beside `store/v11`, a workspace store
+* beside the platform default — resolves from the first, exactly as the rung
+* order intends. Within that store every match is returned rather than the
+* first taken, because the CALLER must fail closed when more than one hash
+* directory carries the version: two honest copies of one version (a
+* same-version re-publish, a private mirror, a hand-populated store) cannot be
+* told apart here, and importing whichever `readdir` listed first would
+* execute code the ref's own integrity pin was written to exclude. The stores
+* are already deduplicated by realpath, so two matches here are two entries,
+* never one entry reached by two spellings.
+*/
+const findInStores = (name, declared, stores) => Effect.gen(function* () {
+	for (const store of stores) {
+		const versionDir = join(store, "links", name, declared);
+		const matches = [];
+		for (const hash of yield* entriesOf(name, versionDir)) {
+			const dir = join(versionDir, hash, "node_modules", name);
+			const version = yield* manifestVersion(name, dir);
+			if (Option.isSome(version) && version.value === declared) matches.push(dir);
+		}
+		if (matches.length > 0) return {
+			store,
+			matches
+		};
+	}
+	return {
+		store: "",
+		matches: []
+	};
+});
+/** The fail-closed message for a version ONE store holds more than once: which store, which copies, how to disambiguate. */
+const ambiguousMessage = (name, declared, store, matches) => `config dependency ${name}@${declared} is ambiguous: the pnpm store at ${store} holds ${matches.length} copies of that version (${matches.join(", ")}) and the store records no integrity to tell them apart, so none is replayed. Remove the stale copies, or install ${name}@${declared} in this workspace so node_modules/.pnpm-config answers instead.`;
+/** The fail-closed message: what was declared, what is installed, where we looked, and how to fix it. */
+const notInstalledMessage = (name, declared, installed, stores) => {
+	return `config dependency ${name}@${declared} is not installed: node_modules/.pnpm-config/${name} holds ${Option.match(installed, {
+		onNone: () => "nothing",
+		onSome: (version) => version === "" ? "a package with no version" : `version ${version}`
+	})}, and no store copy of ${name}@${declared} was found (${stores.length === 0 ? "no pnpm store directory could be located" : `searched ${stores.join(", ")}`}). Run \`pnpm add --config ${name}@${declared}\` in a throwaway workspace to populate the store, then retry.`;
+};
+/**
+* The first pnpmfile candidate present in `dir`, from ONE directory listing.
+* `None` when the dependency ships none. Presence is settled by the listing
+* alone: a listed-but-unreadable file (`EACCES`, say) is returned and fails
+* typed at `import()` time — it never reads as "this dependency ships no
+* hook".
+*/
+const pnpmfileIn = (name, dir) => entriesOf(name, dir).pipe(Effect.map((entries) => Option.map(Array.findFirst(PNPMFILE_CANDIDATES, (candidate) => entries.includes(candidate)), (filename) => join(dir, filename))));
+/**
+* Resolve one declared config dependency to the directory holding its
+* declared version: `.pnpm-config` when it holds exactly that version, else
+* the store, else a typed fail-closed error. `stores` is the memoized
+* discovery, run at most once per {@link resolvePnpmfiles} call and only on
+* the first `.pnpm-config` miss.
+*/
+const resolveDirectory = (root, name, declared, stores) => Effect.gen(function* () {
+	const installedDir = join(pnpmConfigDir(root), name);
+	const installed = yield* manifestVersion(name, installedDir);
+	if (Option.isSome(installed) && installed.value === declared) return {
+		dir: installedDir,
+		source: "installed"
+	};
+	const searched = yield* stores;
+	const { store, matches } = yield* findInStores(name, declared, searched);
+	const [only, ...rest] = matches;
+	if (only !== void 0 && rest.length === 0) return {
+		dir: only,
+		source: "store"
+	};
+	if (only !== void 0) return yield* Effect.fail(hooksError(name, new Error(ambiguousMessage(name, declared, store, matches))));
+	return yield* Effect.fail(hooksError(name, new Error(notInstalledMessage(name, declared, installed, searched))));
+});
+/**
+* Resolve every declared config dependency at its declared version, in
+* declaration order. A dependency that ships no pnpmfile is still returned
+* (resolved, `path` undefined — the one legitimate skip at replay time); a
+* `..` segment in a name, an unresolvable declared version, or any
+* non-absent IO failure fails typed as a `hooks`-source
+* `CatalogAssemblyError`.
+*/
+const resolvePnpmfiles = (root, configDependencies) => Effect.gen(function* () {
+	const entries = yield* declaredEntries(configDependencies);
+	const [discoverOnce, invalidate] = yield* Effect.cachedInvalidateWithTTL(discoverStores(root), Duration.infinity);
+	const stores = Effect.onExit(discoverOnce, (exit) => Exit.isSuccess(exit) ? Effect.void : invalidate);
+	return yield* Effect.forEach(entries, ({ name, version }) => Effect.gen(function* () {
+		const { dir, source } = yield* resolveDirectory(root, name, version, stores);
+		const pnpmfile = yield* pnpmfileIn(name, dir);
+		return {
+			name,
+			version,
+			source,
+			path: Option.getOrUndefined(pnpmfile)
+		};
+	}), { concurrency: "unbounded" });
+});
+/**
+* The `layerFrom` counterpart of {@link resolvePnpmfiles}: look each declared
+* `(name, version)` up in a caller-supplied `"<name>@<version>" → path` map.
+* Same order, same `..` refusal, same fail-closed shape for a missing entry
+* — no filesystem is consulted, so it is safe under any `FileSystem` layer.
+*/
+const lookupPnpmfiles = (entries, configDependencies) => Effect.flatMap(declaredEntries(configDependencies), (declared) => Effect.forEach(declared, ({ name, version }) => {
+	const key = `${name}@${version}`;
+	const path = entries[key];
+	if (path === void 0) {
+		const known = Object.keys(entries);
+		return Effect.fail(hooksError(name, /* @__PURE__ */ new Error(`config dependency ${key} has no entry in the supplied pnpmfile map (known: ${known.length === 0 ? "none" : known.join(", ")})`)));
+	}
+	return Effect.succeed({
+		name,
+		version,
+		source: "supplied",
+		path
+	});
+}));
+
+//#endregion
+export { lookupPnpmfiles, resolvePnpmfiles };

package/internal/patterns.js

@@ -2,6 +2,7 @@ import { Effect, FileSystem, Path } from "effect";
 import { Yaml } from "@effected/yaml";
 
 //#region src/internal/patterns.ts
+/** The string entries of `value` when it is an array, else `undefined`. */
 const stringsOf = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : void 0;
 /** The `packages:` list of a `pnpm-workspace.yaml` document. Total on a parsed document. */
 const pnpmPatternsOf = (document) => {
@@ -59,4 +60,4 @@ const readPatterns = (root) => Effect.gen(function* () {
 });
 
 //#endregion
-export { manifestPatternsOf, pnpmPatternsOf, readPatterns };
+export { manifestPatternsOf, pnpmPatternsOf, readPatterns, stringsOf };

package/internal/peerPatterns.js

@@ -0,0 +1,35 @@
+import { ReleaseAgeGate } from "@effected/npm";
+
+//#region src/internal/peerPatterns.ts
+/** One pattern (negation stripped) as a predicate, on the shared single-pattern grammar. */
+const matcherFromPattern = (pattern) => (name) => ReleaseAgeGate.matchesExclude(name, [pattern]);
+const isNegation = (pattern) => pattern.startsWith("!");
+/**
+* Compile one `ignoreMissing` / `allowAny` list into a predicate over peer
+* names, with `@pnpm/matcher`'s composition rules (see the module header).
+*
+* @internal
+*/
+const peerNameMatcher = (patterns) => {
+	if (patterns.length === 0) return () => false;
+	const compiled = patterns.map((pattern) => isNegation(pattern) ? {
+		negation: true,
+		match: matcherFromPattern(pattern.slice(1))
+	} : {
+		negation: false,
+		match: matcherFromPattern(pattern)
+	});
+	const negations = compiled.filter((entry) => entry.negation);
+	if (negations.length === 0) return (name) => compiled.some((entry) => entry.match(name));
+	if (negations.length === compiled.length) return (name) => !negations.some((entry) => entry.match(name));
+	return (name) => {
+		let matched = false;
+		for (const entry of compiled) if (entry.negation) {
+			if (entry.match(name)) matched = false;
+		} else if (!matched && entry.match(name)) matched = true;
+		return matched;
+	};
+};
+
+//#endregion
+export { peerNameMatcher };

package/internal/workspaceYaml.js

@@ -0,0 +1,44 @@
+import { stringsOf } from "./patterns.js";
+import { NoPeerDependencyRules } from "../ConfigDependencyHooks.js";
+import { Predicate } from "effect";
+
+//#region src/internal/workspaceYaml.ts
+/** The `configDependencies` map (name → version+integrity) of a parsed pnpm-workspace document. */
+const configDependenciesOf = (document) => {
+	if (!Predicate.isObject(document) || !Predicate.isObject(document.configDependencies)) return {};
+	const out = {};
+	for (const [name, spec] of Object.entries(document.configDependencies)) if (typeof spec === "string") out[name] = spec;
+	return out;
+};
+/**
+* The `peerDependencyRules` a `pnpm-workspace.yaml` declares inline — the half
+* `pnpm:export` materializes into the file, as opposed to the half a config
+* dependency injects at replay time.
+*
+* @remarks
+* **Tolerant, unlike the catalog blocks**, and the asymmetry is deliberate: a
+* malformed catalog block must hard-fail because a silently-empty catalog makes
+* every dependency look newly added, whereas a malformed rules block costs only
+* suppression — the failure mode is reporting a peer pnpm would have hidden,
+* which is visible and safe. Failing the whole assembly over it would take the
+* catalogs down with it.
+*
+* Every axis is read independently, so a malformed `ignoreMissing` does not
+* discard a well-formed `allowedVersions`.
+*/
+const inlinePeerDependencyRules = (document) => {
+	if (!Predicate.isObject(document) || !Predicate.isObject(document.peerDependencyRules)) return NoPeerDependencyRules;
+	const block = document.peerDependencyRules;
+	const allowedVersions = {};
+	if (Predicate.isObject(block.allowedVersions)) {
+		for (const [key, value] of Object.entries(block.allowedVersions)) if (typeof value === "string") allowedVersions[key] = value;
+	}
+	return {
+		allowedVersions,
+		ignoreMissing: stringsOf(block.ignoreMissing) ?? [],
+		allowAny: stringsOf(block.allowAny) ?? []
+	};
+};
+
+//#endregion
+export { configDependenciesOf, inlinePeerDependencyRules };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/workspaces",
-	"version": "0.23.0",
+	"version": "0.24.0",
 	"private": false,
 	"description": "Monorepo workspace tooling as Effect services — root discovery, package enumeration, the dependency graph, package-manager detection, pnpm catalog resolution, lockfile IO and git-based change detection.",
 	"keywords": [