@loomhelix/deptrail 0.1.0

package/dist/actions/overrides-location.js

@@ -0,0 +1,59 @@
+import { coerce, gte } from 'semver';
+import { parse } from 'yaml';
+const PNPM_FIELD_IGNORED_WARNING = 'pnpm 11 ignores the pnpm field of package.json, so the override goes to pnpm-workspace.yaml';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseYamlRecord(text) {
+    if (text === null)
+        return undefined;
+    try {
+        const parsed = parse(text);
+        return isRecord(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseJsonRecord(text) {
+    if (text === null)
+        return undefined;
+    try {
+        const parsed = JSON.parse(text);
+        return isRecord(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function parseManagerVersion(output) {
+    return coerce(output.trim())?.version;
+}
+export function declaredOverridesFiles(files) {
+    const declared = [];
+    const workspace = parseYamlRecord(files.workspaceYaml);
+    const workspaceOverrides = workspace?.overrides;
+    if (isRecord(workspaceOverrides) && Object.keys(workspaceOverrides).length > 0)
+        declared.push('pnpm-workspace.yaml');
+    const manifest = parseJsonRecord(files.rootManifest);
+    if (isRecord(manifest?.pnpm) && isRecord(manifest.pnpm.overrides))
+        declared.push('package.json#pnpm.overrides');
+    if (isRecord(manifest?.overrides))
+        declared.push('package.json#overrides');
+    return declared;
+}
+function atLeast(version, minimum) {
+    const coerced = coerce(version);
+    return coerced !== null && gte(coerced, minimum);
+}
+export function overridesLocation(manager, declared) {
+    if (manager.name === 'npm')
+        return { file: 'package.json#overrides' };
+    const pnpmDeclared = declared.find((file) => file === 'pnpm-workspace.yaml' || file === 'package.json#pnpm.overrides');
+    if (pnpmDeclared === 'package.json#pnpm.overrides' && atLeast(manager.version, '11.0.0')) {
+        return { file: 'pnpm-workspace.yaml', warning: PNPM_FIELD_IGNORED_WARNING };
+    }
+    if (pnpmDeclared !== undefined)
+        return { file: pnpmDeclared };
+    return { file: atLeast(manager.version, '10.0.0') ? 'pnpm-workspace.yaml' : 'package.json#pnpm.overrides' };
+}

package/dist/actions/parent-chain.js

@@ -0,0 +1,210 @@
+import semver from 'semver';
+import { IMPORTER_PREFIX } from "../model.js";
+import { ParentLinkResolver } from "../query/dependents.js";
+import { nodeMeta, requestedRange } from "../query/enrichment-lookup.js";
+import { findNode } from "../query/lookup.js";
+import { normalizeRange } from "../query/versions.js";
+import { acceptedClause, fieldOf, importerLabel } from "./labels.js";
+import { catalogNameOf } from "./range-style.js";
+import { compareText, setRangeStep } from "./set-range.js";
+export const CHAIN_MAX_DEPTH = 5;
+export const CHAIN_MAX_LOADS = 20;
+class ChainUnavailableError extends Error {
+}
+function isImporter(node) {
+    return node.id.startsWith(IMPORTER_PREFIX);
+}
+function admitsAny(range, versions) {
+    return versions.some((version) => semver.satisfies(version, range));
+}
+function versionsAbove(versions, current) {
+    if (semver.valid(current) === null)
+        return [];
+    return versions.filter((version) => semver.gt(version, current));
+}
+function intersect(known, incoming) {
+    const accepted = new Set(incoming);
+    return known.filter((version) => accepted.has(version));
+}
+function withClimbedFrom(climbedFrom) {
+    return climbedFrom === undefined ? {} : { climbedFrom };
+}
+function compareRelocks(left, right) {
+    return left.depth - right.depth || compareText(left.node.name, right.node.name) || compareText(left.node.version, right.node.version);
+}
+function compareSetRanges(left, right) {
+    return compareText(left.importer.path, right.importer.path) || compareText(left.node.name, right.node.name);
+}
+function setRangeKey(entry) {
+    const catalog = catalogNameOf(entry.specifier);
+    return catalog === undefined ? `${entry.importer.id}\0${entry.node.name}` : `catalog:${catalog}\0${entry.node.name}`;
+}
+class ChainSearch {
+    view;
+    root;
+    start;
+    safe;
+    links;
+    loadVersions;
+    loaded = new Map();
+    path = new Set();
+    relocks = new Map();
+    setRanges = new Map();
+    constructor(input) {
+        this.view = input.view;
+        this.root = input.root;
+        this.start = input.node;
+        this.safe = input.safe.filter((version) => semver.valid(version) !== null).sort(semver.compare);
+        this.links = new ParentLinkResolver(input.root, new Set([...input.kinds].filter((kind) => kind !== 'peer')));
+        this.loadVersions = input.loadVersions;
+    }
+    async run() {
+        this.path.add(this.start.id);
+        await this.visit({ node: this.start, acceptable: this.safe, depth: 0 });
+        const relockSteps = [...this.relocks.values()].sort(compareRelocks).map((entry) => this.relockStep(entry));
+        const setRangeSteps = [...this.setRanges.values()].sort(compareSetRanges).map((entry) => this.setRangeStep(entry));
+        const steps = [...relockSteps, ...setRangeSteps];
+        if (steps.length === 0)
+            throw new ChainUnavailableError('no parent path reaches a workspace package');
+        return steps;
+    }
+    async visit(visit) {
+        for (const link of this.links.of(visit.node)) {
+            const parent = findNode(this.root, link.id);
+            if (parent === undefined)
+                continue;
+            const requested = requestedRange(this.view, this.root, parent, link.range, visit.node).range;
+            const range = this.normalized(visit.node, requested);
+            if (range !== undefined && admitsAny(range, visit.acceptable)) {
+                this.addRequester(visit, { label: this.requesterLabel(parent, requested, visit.depth), range });
+                continue;
+            }
+            if (isImporter(parent)) {
+                this.addRaisedRange(visit, parent, link);
+                continue;
+            }
+            if (this.path.has(parent.id))
+                continue;
+            await this.climb(parent, visit);
+        }
+    }
+    async climb(parent, from) {
+        if (from.depth + 1 > CHAIN_MAX_DEPTH)
+            throw new ChainUnavailableError(`the chain is deeper than ${CHAIN_MAX_DEPTH} levels`);
+        const meta = await this.publishedMeta(parent.name);
+        const acceptable = this.acceptableVersions(parent, meta, from);
+        if (acceptable.length === 0)
+            throw new ChainUnavailableError(`${parent.name} has no version that accepts a safe ${from.node.name}`);
+        this.path.add(parent.id);
+        await this.visit({ node: parent, acceptable, depth: from.depth + 1, climbedFrom: from.node });
+        this.path.delete(parent.id);
+    }
+    async publishedMeta(name) {
+        let published = this.loaded.get(name);
+        if (published === undefined) {
+            if (this.loaded.size >= CHAIN_MAX_LOADS)
+                throw new ChainUnavailableError(`the search needs more than ${CHAIN_MAX_LOADS} packument loads`);
+            published = await this.loadVersions(name);
+            this.loaded.set(name, published);
+        }
+        if (published.state === 'failed')
+            throw new ChainUnavailableError(`could not load the versions of ${name}: ${published.reason}`);
+        return published.meta;
+    }
+    acceptableVersions(parent, meta, from) {
+        const newer = versionsAbove(meta.versions.filter((version) => semver.valid(version) !== null && semver.prerelease(version) === null), parent.version);
+        return newer.filter((version) => this.acceptsSafeChild(meta.manifests[version], from)).sort(semver.compare);
+    }
+    acceptsSafeChild(manifest, from) {
+        if (manifest === undefined)
+            return false;
+        const declared = manifest[from.node.name];
+        if (declared === undefined)
+            return true;
+        const range = this.normalized(from.node, declared);
+        return range !== undefined && admitsAny(range, from.acceptable);
+    }
+    metaOf(node) {
+        const published = this.loaded.get(node.name);
+        return published?.state === 'ok' ? published.meta : nodeMeta(this.view, this.root, node);
+    }
+    normalized(child, range) {
+        return normalizeRange(range, { name: child.name, catalogs: this.root.config?.catalogs ?? {}, distTags: this.metaOf(child)?.distTags });
+    }
+    requesterLabel(parent, requested, depth) {
+        const name = isImporter(parent) ? importerLabel(parent.id) : parent.name;
+        return depth === 0 ? name : `${name} ${requested}`;
+    }
+    addRequester(visit, requester) {
+        const key = `${visit.node.name}@${visit.node.version}`;
+        const entry = this.relocks.get(key);
+        if (entry === undefined) {
+            this.relocks.set(key, {
+                node: visit.node,
+                depth: visit.depth,
+                requesters: [requester],
+                acceptable: [...visit.acceptable],
+                ...withClimbedFrom(visit.climbedFrom),
+            });
+            return;
+        }
+        if (!entry.requesters.some((known) => known.label === requester.label && known.range === requester.range))
+            entry.requesters.push(requester);
+        entry.acceptable = intersect(entry.acceptable, visit.acceptable);
+    }
+    addRaisedRange(visit, importer, link) {
+        const field = fieldOf(link.kind);
+        if (field === undefined)
+            return;
+        const raised = {
+            importer,
+            field,
+            specifier: link.range,
+            node: visit.node,
+            acceptable: versionsAbove(visit.acceptable, visit.node.version),
+            ...withClimbedFrom(visit.climbedFrom),
+        };
+        const key = setRangeKey(raised);
+        const known = this.setRanges.get(key);
+        if (known === undefined) {
+            this.setRanges.set(key, raised);
+            return;
+        }
+        const kept = compareText(raised.importer.path, known.importer.path) < 0 ? raised : known;
+        this.setRanges.set(key, { ...kept, acceptable: intersect(known.acceptable, raised.acceptable) });
+    }
+    dependencyNote(node, to, child) {
+        const declared = this.metaOf(node)?.manifests[to]?.[child.name];
+        return declared === undefined ? `${to} no longer depends on ${child.name}` : `${to} requires ${child.name} ${declared}`;
+    }
+    relockStep(entry) {
+        const { node, requesters, climbedFrom } = entry;
+        const to = entry.acceptable.filter((version) => requesters.every((requester) => semver.satisfies(version, requester.range))).at(-1);
+        if (to === undefined)
+            throw new ChainUnavailableError(`${node.name} ${node.version} has no fixed version that all its parents accept`);
+        const clause = acceptedClause(requesters.map((requester) => requester.label));
+        const reason = climbedFrom === undefined ? clause : `${this.dependencyNote(node, to, climbedFrom)}; ${clause}`;
+        return { kind: 'relock', name: node.name, from: node.version, to, reason };
+    }
+    setRangeStep(entry) {
+        const { node, climbedFrom } = entry;
+        const to = entry.acceptable[0];
+        if (to === undefined)
+            throw new ChainUnavailableError(`no safe version of ${node.name} above ${node.version}`);
+        const reason = climbedFrom === undefined ? `${to} is the lowest safe ${node.name} above ${node.version}` : this.dependencyNote(node, to, climbedFrom);
+        const result = setRangeStep(this.root, { importer: entry.importer.id, field: entry.field, dependency: node.name, specifier: entry.specifier, target: to, reason });
+        if ('unavailable' in result)
+            throw new ChainUnavailableError(result.unavailable);
+        return result.step;
+    }
+}
+export async function parentChain(input) {
+    try {
+        return { steps: await new ChainSearch(input).run() };
+    }
+    catch (error) {
+        if (error instanceof ChainUnavailableError)
+            return { unavailable: error.message };
+        throw error;
+    }
+}

package/dist/actions/range-style.js

@@ -0,0 +1,38 @@
+import { valid, validRange } from 'semver';
+import { isNonRegistrySpec } from "../adapters/package-manifest.js";
+const CARET_PATTERN = /^\^\d+(\.\d+){0,2}$/;
+const TILDE_PATTERN = /^~\d+(\.\d+){0,2}$/;
+const ALIAS_PREFIX = 'npm:';
+export function catalogNameOf(specifier) {
+    if (!specifier.startsWith('catalog:'))
+        return undefined;
+    return specifier.slice('catalog:'.length) || 'default';
+}
+function rewriteAlias(specifier, target) {
+    const separator = specifier.lastIndexOf('@');
+    if (separator <= ALIAS_PREFIX.length)
+        return { editable: false, reason: `${specifier} has no version range` };
+    const rewritten = rewriteRange(specifier.slice(separator + 1), target);
+    if (!rewritten.editable)
+        return rewritten;
+    return { ...rewritten, specifier: `${specifier.slice(0, separator + 1)}${rewritten.specifier}` };
+}
+export function rewriteRange(specifier, target) {
+    if (specifier.startsWith('workspace:'))
+        return { editable: false, reason: 'workspace: specifiers are not edited' };
+    if (specifier.startsWith('catalog:'))
+        return { editable: false, reason: 'catalog entries are edited in pnpm-workspace.yaml' };
+    if (specifier.startsWith(ALIAS_PREFIX))
+        return rewriteAlias(specifier, target);
+    if (isNonRegistrySpec(specifier))
+        return { editable: false, reason: `${specifier} is not a registry range` };
+    if (CARET_PATTERN.test(specifier))
+        return { editable: true, specifier: `^${target}`, formChanged: false };
+    if (TILDE_PATTERN.test(specifier))
+        return { editable: true, specifier: `~${target}`, formChanged: false };
+    if (valid(specifier) !== null)
+        return { editable: true, specifier: target, formChanged: false };
+    if (validRange(specifier) !== null)
+        return { editable: true, specifier: `^${target}`, formChanged: true };
+    return { editable: false, reason: `dist-tag ${specifier} is not edited` };
+}

package/dist/actions/recipes.js

@@ -0,0 +1,31 @@
+import { parseManagerVersion } from "./overrides-location.js";
+export const SANDBOX_TIMEOUT_MS = 300_000;
+export const INSTALL_TIMEOUT_MS = 900_000;
+export const PROBE_TIMEOUT_MS = 60_000;
+const STDERR_TAIL_LENGTH = 400;
+export const LOCKFILE_ONLY_ARGS = {
+    pnpm: ['install', '--lockfile-only', '--ignore-scripts'],
+    npm: ['install', '--package-lock-only', '--ignore-scripts', '--no-audit', '--no-fund'],
+};
+export const FROZEN_INSTALL_ARGS = {
+    pnpm: ['install', '--frozen-lockfile'],
+    npm: ['ci'],
+};
+export function commandText(manager, args) {
+    return [manager, ...args].join(' ');
+}
+export async function probeManager(runner, manager, cwd, env, secrets) {
+    try {
+        const result = await runner.run({ command: manager, args: ['--version'], cwd, env, timeoutMs: PROBE_TIMEOUT_MS });
+        if (result.code !== 0) {
+            const tail = secrets.redact(result.stderr).trim().slice(-STDERR_TAIL_LENGTH);
+            return { ok: false, reason: `${manager} --version failed: ${tail}` };
+        }
+        const version = parseManagerVersion(result.stdout);
+        return version ? { ok: true, version } : { ok: false, reason: `${manager} --version printed no version` };
+    }
+    catch (failure) {
+        const code = failure.code;
+        return { ok: false, reason: code === 'ENOENT' ? `${manager} was not found` : `${manager} could not be started` };
+    }
+}

package/dist/actions/root-files.js

@@ -0,0 +1,30 @@
+import { access, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { ROOT_MANIFEST, WORKSPACE_FILE } from "./edit-plan.js";
+import { declaredOverridesFiles, overridesLocation } from "./overrides-location.js";
+const PNPM_LOCKFILE = 'pnpm-lock.yaml';
+const NPM_SHRINKWRAP = 'npm-shrinkwrap.json';
+const NPM_LOCKFILE = 'package-lock.json';
+export function rootDirOf(repoPath, root) {
+    return path.join(repoPath, root.path);
+}
+export async function pathExists(target) {
+    return access(target).then(() => true, () => false);
+}
+export async function readTextOrNull(target) {
+    try {
+        return await readFile(target, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+export async function lockfileNameOf(rootDir, manager) {
+    if (manager === 'pnpm')
+        return PNPM_LOCKFILE;
+    return (await pathExists(path.join(rootDir, NPM_SHRINKWRAP))) ? NPM_SHRINKWRAP : NPM_LOCKFILE;
+}
+export async function overridesLocationOf(rootDir, manager) {
+    const [workspaceYaml, rootManifest] = await Promise.all([readTextOrNull(path.join(rootDir, WORKSPACE_FILE)), readTextOrNull(path.join(rootDir, ROOT_MANIFEST))]);
+    return overridesLocation(manager, declaredOverridesFiles({ workspaceYaml, rootManifest }));
+}

package/dist/actions/sandbox.js

@@ -0,0 +1,175 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path, { posix } from 'node:path';
+import { parse } from 'yaml';
+import { leavesRoot, readInScope, sha256Hex } from "./file-scope.js";
+const WORKSPACE_FILE = 'pnpm-workspace.yaml';
+const ROOT_MANIFEST = 'package.json';
+const ROOT_COPY_DIR = 'root';
+const PRIVATE_DIR_MODE = 0o700;
+const PNPMFILE_NAMES = ['.pnpmfile.cjs', '.pnpmfile.mjs'];
+const activeSandboxDirs = new Set();
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseYamlRecord(text) {
+    if (text === null)
+        return undefined;
+    try {
+        const parsed = parse(text);
+        return isRecord(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseJsonRecord(text) {
+    if (text === null)
+        return undefined;
+    try {
+        const parsed = JSON.parse(text);
+        return isRecord(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function stringValues(value) {
+    return isRecord(value) ? Object.values(value).filter((entry) => typeof entry === 'string') : [];
+}
+function pnpmfileFromNpmrc(text) {
+    if (text === null)
+        return [];
+    const values = [];
+    for (const line of text.split(/\r?\n/)) {
+        const separator = line.indexOf('=');
+        if (separator < 0)
+            continue;
+        if (line.slice(0, separator).trim() === 'pnpmfile')
+            values.push(line.slice(separator + 1).trim());
+    }
+    return values.filter((value) => value !== '');
+}
+function isConsidered(scope, normalized) {
+    if (posix.isAbsolute(normalized))
+        return false;
+    if (leavesRoot(normalized))
+        return scope.outsideManifests.includes(normalized);
+    return true;
+}
+async function readRootText(scope, relative) {
+    return (await readInScope(scope, relative))?.toString('utf8') ?? null;
+}
+async function consideredPaths(request) {
+    const manifests = request.importerPaths.map((importerPath) => posix.join(importerPath, 'package.json'));
+    const paths = [...manifests, '.npmrc', WORKSPACE_FILE, request.lockfile];
+    if (request.manager.name === 'pnpm') {
+        const [workspaceText, npmrcText, rootManifestText] = await Promise.all([
+            readRootText(request.scope, WORKSPACE_FILE),
+            readRootText(request.scope, '.npmrc'),
+            readRootText(request.scope, ROOT_MANIFEST),
+        ]);
+        const workspace = parseYamlRecord(workspaceText);
+        const rootManifest = parseJsonRecord(rootManifestText);
+        const pnpmSection = isRecord(rootManifest?.pnpm) ? rootManifest.pnpm : undefined;
+        paths.push(...PNPMFILE_NAMES);
+        if (typeof workspace?.pnpmfile === 'string')
+            paths.push(workspace.pnpmfile);
+        paths.push(...pnpmfileFromNpmrc(npmrcText));
+        paths.push(...stringValues(workspace?.patchedDependencies), ...stringValues(pnpmSection?.patchedDependencies));
+    }
+    const seen = new Set();
+    for (const candidate of paths) {
+        const normalized = posix.normalize(candidate);
+        if (isConsidered(request.scope, normalized))
+            seen.add(normalized);
+    }
+    return [...seen];
+}
+function sandboxFile(layout, relative) {
+    const normalized = posix.join(layout.offset, relative);
+    if (posix.isAbsolute(relative) || leavesRoot(normalized)) {
+        throw new Error(`Path leaves the sandbox: ${relative}`);
+    }
+    return path.join(layout.dir, ...normalized.split('/'));
+}
+async function copyIntoSandbox(scope, layout, relative) {
+    const content = await readInScope(scope, relative);
+    if (content === null)
+        return null;
+    const target = sandboxFile(layout, relative);
+    await mkdir(path.dirname(target), { recursive: true });
+    await writeFile(target, content);
+    return sha256Hex(content);
+}
+function removeSandboxDir(dir) {
+    activeSandboxDirs.delete(dir);
+    return rm(dir, { recursive: true, force: true });
+}
+export async function removeActionSandboxes() {
+    await Promise.all([...activeSandboxDirs].map(removeSandboxDir));
+}
+async function pinManagerUnlessNamed(request, tempDir) {
+    const manifest = parseJsonRecord(await readRootText(request.scope, ROOT_MANIFEST));
+    if (manifest?.packageManager !== undefined)
+        return;
+    const pin = { private: true, packageManager: `${request.manager.name}@${request.manager.version}` };
+    await writeFile(path.join(tempDir, ROOT_MANIFEST), `${JSON.stringify(pin, null, 2)}\n`);
+}
+function leadingParentCount(manifest) {
+    const segments = manifest.split('/');
+    const firstOther = segments.findIndex((segment) => segment !== '..');
+    return firstOther === -1 ? segments.length : firstOther;
+}
+function outsideDepth(scope) {
+    return Math.max(0, ...scope.outsideManifests.map(leadingParentCount));
+}
+function rootOffset(scope) {
+    const segments = path.relative(scope.repoDir, scope.rootDir).split(path.sep).filter((segment) => segment !== '');
+    const depth = outsideDepth(scope);
+    if (depth > segments.length)
+        throw new Error(`Path leaves the sandbox: ${scope.outsideManifests.join(', ')}`);
+    return segments.slice(segments.length - depth).join('/');
+}
+export async function createSandbox(request) {
+    const tempDir = await mkdtemp(path.join(tmpdir(), 'deptrail-action-'));
+    activeSandboxDirs.add(tempDir);
+    try {
+        const offset = rootOffset(request.scope);
+        const copyBase = path.join(tempDir, ROOT_COPY_DIR);
+        await mkdir(copyBase, { mode: PRIVATE_DIR_MODE });
+        const dir = path.join(copyBase, ...offset.split('/').filter((segment) => segment !== ''));
+        await mkdir(dir, { recursive: true });
+        const layout = { dir: copyBase, offset };
+        await pinManagerUnlessNamed(request, tempDir);
+        const sources = new Map();
+        for (const relative of await consideredPaths(request)) {
+            sources.set(relative, await copyIntoSandbox(request.scope, layout, relative));
+        }
+        return {
+            dir,
+            sources,
+            async readText(relative) {
+                try {
+                    return await readFile(sandboxFile(layout, relative), 'utf8');
+                }
+                catch {
+                    return null;
+                }
+            },
+            async writeText(relative, text) {
+                const target = sandboxFile(layout, relative);
+                await mkdir(path.dirname(target), { recursive: true });
+                await writeFile(target, text);
+            },
+            deleteFile(relative) {
+                return rm(sandboxFile(layout, relative), { force: true });
+            },
+            remove: () => removeSandboxDir(tempDir),
+        };
+    }
+    catch (failure) {
+        await removeSandboxDir(tempDir);
+        throw failure;
+    }
+}

package/dist/actions/set-range.js

@@ -0,0 +1,59 @@
+import { findNode } from "../query/lookup.js";
+import { importerLabel } from "./labels.js";
+import { catalogNameOf, rewriteRange } from "./range-style.js";
+const DEFAULT_CATALOG = 'default';
+export function compareText(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function formNote(from, formChanged) {
+    return formChanged ? ` (the range form changes from ${from})` : '';
+}
+function catalogUsers(root, catalog, dependency) {
+    return root.importers
+        .filter((importer) => importer.deps.some((edge) => catalogNameOf(edge.range) === catalog && findNode(root, edge.to)?.name === dependency))
+        .sort((left, right) => compareText(left.path, right.path))
+        .map((importer) => importerLabel(importer.id));
+}
+function manifestStep(input) {
+    const rewritten = rewriteRange(input.specifier, input.target);
+    if (!rewritten.editable)
+        return { unavailable: `${importerLabel(input.importer)}: ${rewritten.reason}` };
+    return {
+        step: {
+            kind: 'set-range',
+            importer: input.importer,
+            dependency: input.dependency,
+            field: input.field,
+            place: 'manifest',
+            from: input.specifier,
+            to: rewritten.specifier,
+            reason: `${input.reason}${formNote(input.specifier, rewritten.formChanged)}`,
+        },
+    };
+}
+function catalogStep(root, input, catalog) {
+    const entry = root.config?.catalogs[catalog]?.[input.dependency];
+    if (entry === undefined)
+        return { unavailable: `${importerLabel(input.importer)}: the ${catalog} catalog has no entry for ${input.dependency}` };
+    const rewritten = rewriteRange(entry, input.target);
+    if (!rewritten.editable)
+        return { unavailable: `${importerLabel(input.importer)}: ${rewritten.reason}` };
+    const users = catalogUsers(root, catalog, input.dependency).join(', ');
+    return {
+        step: {
+            kind: 'set-range',
+            importer: input.importer,
+            dependency: input.dependency,
+            field: input.field,
+            place: 'catalog',
+            ...(catalog === DEFAULT_CATALOG ? {} : { catalog }),
+            from: entry,
+            to: rewritten.specifier,
+            reason: `${input.reason} (catalog entry used by ${users})${formNote(entry, rewritten.formChanged)}`,
+        },
+    };
+}
+export function setRangeStep(root, input) {
+    const catalog = catalogNameOf(input.specifier);
+    return catalog === undefined ? manifestStep(input) : catalogStep(root, input, catalog);
+}

package/dist/actions/shared-packages.js

@@ -0,0 +1,50 @@
+import { manifestPathOf } from "./edit-plan.js";
+const SHARING_MANAGERS = ['pnpm', 'npm'];
+const NAMED_FILES_LIMIT = 3;
+const REPOSITORY_ROOT_ID = '.';
+function canShare(root) {
+    return root.source === 'lockfile' && SHARING_MANAGERS.includes(root.manager);
+}
+function importerPaths(root) {
+    return new Set(root.importers.map((importer) => importer.path));
+}
+export function sharesWorkspacePackage(left, right) {
+    if (left.id === right.id)
+        return false;
+    const rightPaths = importerPaths(right);
+    return left.importers.some((importer) => rightPaths.has(importer.path));
+}
+export function sharingRoots(root, roots) {
+    const others = roots.filter((other) => other.id !== root.id && canShare(other)).sort((left, right) => (left.id < right.id ? -1 : left.id > right.id ? 1 : 0));
+    const shared = new Map();
+    for (const importer of root.importers) {
+        const sharing = others.filter((other) => importerPaths(other).has(importer.path)).map((other) => ({ id: other.id, manager: other.manager }));
+        if (sharing.length > 0)
+            shared.set(manifestPathOf(importer.id), sharing);
+    }
+    return shared;
+}
+function filesText(paths) {
+    const named = paths.slice(0, NAMED_FILES_LIMIT).join(', ');
+    const rest = paths.length - NAMED_FILES_LIMIT;
+    if (rest <= 0)
+        return named;
+    return `${named}, and ${rest} more file${rest === 1 ? '' : 's'}`;
+}
+export function sharedRootWarnings(paths, shared) {
+    const filesByRoot = new Map();
+    for (const path of paths) {
+        for (const sharing of shared.get(path) ?? []) {
+            const entry = filesByRoot.get(sharing.id) ?? { manager: sharing.manager, files: [] };
+            entry.files.push(path);
+            filesByRoot.set(sharing.id, entry);
+        }
+    }
+    return [...filesByRoot.keys()]
+        .sort()
+        .map((id) => {
+        const { manager, files } = filesByRoot.get(id);
+        const isRepositoryRoot = id === REPOSITORY_ROOT_ID;
+        return `${isRepositoryRoot ? 'The repository root' : id} also uses ${filesText(files)}: its lockfile is not updated; run ${manager} install in ${isRepositoryRoot ? 'the repository root' : id}`;
+    });
+}