@loomhelix/deptrail 0.1.0

package/dist/adapters/node-modules.js

@@ -0,0 +1,148 @@
+import { posix } from 'node:path';
+import { IMPORTER_PREFIX } from "../model.js";
+import { IMPORTER_BLOCKS, PACKAGE_BLOCKS, declaredDependencies, importerKeyOf, isNonRegistrySpec, readManifest, } from "./package-manifest.js";
+const MODULES_DIRECTORY = 'node_modules';
+const REPO_ROOT = '.';
+export async function walkNodeModules(reader, root, builder) {
+    if (!(await anyImporterHasModules(reader, root)))
+        return false;
+    const walker = new InstalledWalker(reader, root, builder);
+    await walker.walkFromImporters();
+    return true;
+}
+async function anyImporterHasModules(reader, root) {
+    const checks = await Promise.all(root.importerPaths.map((importerPath) => reader.exists(posix.join(importerPath, MODULES_DIRECTORY))));
+    return checks.some(Boolean);
+}
+function ancestorsOf(directory) {
+    const ancestors = [];
+    let current = directory;
+    while (current !== REPO_ROOT && current !== '') {
+        ancestors.push(current);
+        current = posix.dirname(current);
+    }
+    ancestors.push(REPO_ROOT);
+    return ancestors;
+}
+class InstalledWalker {
+    reader;
+    root;
+    builder;
+    importerKeyByDirectory = new Map();
+    nodeIdByDirectory = new Map();
+    resolutionCache = new Map();
+    directoryListings = new Map();
+    pending = [];
+    constructor(reader, root, builder) {
+        this.reader = reader;
+        this.root = root;
+        this.builder = builder;
+    }
+    async walkFromImporters() {
+        for (const importerPath of this.root.importerPaths) {
+            this.importerKeyByDirectory.set(importerPath, importerKeyOf(this.root, importerPath));
+        }
+        for (const importerPath of this.root.importerPaths)
+            await this.enqueueImporter(importerPath);
+        for (let dependent = this.pending.pop(); dependent; dependent = this.pending.pop()) {
+            await this.linkDependencies(dependent);
+        }
+    }
+    async enqueueImporter(importerPath) {
+        const importerKey = importerKeyOf(this.root, importerPath);
+        const read = await readManifest(this.reader, importerPath);
+        if ('problem' in read) {
+            this.builder.warn(read.problem);
+            this.builder.addImporter(importerKey, importerKey);
+            return;
+        }
+        const id = this.builder.addImporter(importerKey, read.manifest.name ?? importerKey);
+        this.pending.push({ id, directory: importerPath, manifest: read.manifest, blocks: IMPORTER_BLOCKS });
+    }
+    async linkDependencies(dependent) {
+        for (const declared of declaredDependencies(dependent.manifest, dependent.blocks)) {
+            const target = await this.resolveTarget(dependent.directory, declared);
+            if (target !== undefined)
+                this.builder.addEdge(dependent.id, { to: target, kind: declared.kind, range: declared.range });
+        }
+    }
+    async resolveTarget(fromDirectory, declared) {
+        const resolution = await this.resolve(fromDirectory, declared.name);
+        if (resolution === null)
+            return this.unresolvedTarget(declared);
+        if ('warning' in resolution) {
+            this.builder.warn(resolution.warning);
+            return this.unresolvedTarget(declared);
+        }
+        const importerKey = this.importerKeyByDirectory.get(resolution.directory);
+        if (importerKey !== undefined)
+            return IMPORTER_PREFIX + importerKey;
+        return this.registerPackage(resolution.directory, declared);
+    }
+    unresolvedTarget(declared) {
+        return declared.kind === 'prod' ? `${declared.name}@${declared.range}` : undefined;
+    }
+    async registerPackage(directory, declared) {
+        const known = this.nodeIdByDirectory.get(directory);
+        if (known !== undefined)
+            return known;
+        const read = await readManifest(this.reader, directory);
+        if ('problem' in read) {
+            this.builder.warn(read.problem);
+            return this.unresolvedTarget(declared);
+        }
+        const name = read.manifest.name ?? declared.name;
+        const version = read.manifest.version ?? '';
+        const id = `${name}@${version}`;
+        this.builder.addPackage(id, name, version);
+        if (isNonRegistrySpec(declared.range))
+            this.builder.markNonRegistry(id);
+        this.nodeIdByDirectory.set(directory, id);
+        this.pending.push({ id, directory, manifest: read.manifest, blocks: PACKAGE_BLOCKS });
+        return id;
+    }
+    async resolve(fromDirectory, name) {
+        const cacheKey = `${fromDirectory}\0${name}`;
+        const cached = this.resolutionCache.get(cacheKey);
+        if (cached !== undefined)
+            return cached;
+        const resolution = await this.search(fromDirectory, name);
+        this.resolutionCache.set(cacheKey, resolution);
+        return resolution;
+    }
+    async search(fromDirectory, name) {
+        const realDirectory = await this.reader.realpath(fromDirectory);
+        if (realDirectory === null)
+            return { warning: `Could not resolve ${fromDirectory} inside the repository` };
+        for (const ancestor of ancestorsOf(realDirectory)) {
+            if (posix.basename(ancestor) === MODULES_DIRECTORY)
+                continue;
+            const modulesDirectory = posix.join(ancestor, MODULES_DIRECTORY);
+            if (!(await this.hasEntry(modulesDirectory, name)))
+                continue;
+            const candidate = posix.join(modulesDirectory, name);
+            const realCandidate = await this.reader.realpath(candidate);
+            if (realCandidate === null)
+                return { warning: `Skipped ${candidate}: broken link, looping link or link outside the repository` };
+            return { directory: realCandidate };
+        }
+        return null;
+    }
+    async hasEntry(modulesDirectory, name) {
+        const slash = name.indexOf('/');
+        if (slash === -1)
+            return (await this.listing(modulesDirectory)).has(name);
+        const scope = name.slice(0, slash);
+        if (!(await this.listing(modulesDirectory)).has(scope))
+            return false;
+        return (await this.listing(posix.join(modulesDirectory, scope))).has(name.slice(slash + 1));
+    }
+    listing(directory) {
+        let listing = this.directoryListings.get(directory);
+        if (listing === undefined) {
+            listing = this.reader.listDir(directory).then((entries) => new Set(entries.map((entry) => entry.name)));
+            this.directoryListings.set(directory, listing);
+        }
+        return listing;
+    }
+}

package/dist/adapters/npm-lock.js

@@ -0,0 +1,149 @@
+import { IMPORTER_PREFIX } from "../model.js";
+const ROOT_IMPORTER_PATH = '.';
+const ROOT_KEY = '';
+const FIRST_SUPPORTED_VERSION = 2;
+const LATEST_SUPPORTED_VERSION = 3;
+const MODULES_DIRECTORY = 'node_modules/';
+const NESTED_MODULES_DIRECTORY = '/node_modules/';
+const OPTIONAL_KINDS = new Set(['optional', 'peer']);
+const IMPORTER_BLOCKS = [
+    ['dependencies', 'prod'],
+    ['devDependencies', 'dev'],
+    ['optionalDependencies', 'optional'],
+    ['peerDependencies', 'peer'],
+];
+const PACKAGE_BLOCKS = [
+    ['dependencies', 'prod'],
+    ['optionalDependencies', 'optional'],
+    ['peerDependencies', 'peer'],
+];
+export function parseNpmLock(text, builder) {
+    const document = recordOf(JSON.parse(text));
+    if (!isSupportedVersion(document.lockfileVersion)) {
+        builder.warn(`npm lockfile version ${String(document.lockfileVersion)} is not supported`);
+        return { supported: false };
+    }
+    if (isNewerThanSupported(document.lockfileVersion)) {
+        builder.warn(`npm lockfile version ${String(document.lockfileVersion)} is newer than supported; results may be incomplete`);
+    }
+    const { importers, packages, index } = readLockContents(recordOf(document.packages));
+    for (const importer of importers)
+        builder.addImporter(importer.path, importer.name);
+    for (const record of packages) {
+        builder.addPackage(record.id, record.name, record.version);
+        if (isNonRegistryResolution(record.entry.resolved))
+            builder.markNonRegistry(record.id);
+    }
+    for (const importer of importers)
+        addDependencyEdges(builder, index, importer, IMPORTER_BLOCKS);
+    for (const record of packages)
+        addDependencyEdges(builder, index, record, PACKAGE_BLOCKS);
+    return { supported: true };
+}
+function isNonRegistryResolution(resolved) {
+    return typeof resolved === 'string' && !resolved.startsWith('http://') && !resolved.startsWith('https://');
+}
+function isSupportedVersion(lockfileVersion) {
+    const version = Number.parseFloat(String(lockfileVersion));
+    return Number.isFinite(version) && version >= FIRST_SUPPORTED_VERSION;
+}
+function isNewerThanSupported(lockfileVersion) {
+    return Number.parseFloat(String(lockfileVersion)) > LATEST_SUPPORTED_VERSION;
+}
+function readLockContents(packagesBlock) {
+    const importers = [];
+    const packages = [];
+    const nodeIdByKey = new Map();
+    const importerKeys = new Set();
+    for (const [key, value] of Object.entries(packagesBlock)) {
+        const entry = recordOf(value);
+        if (!isInstallPath(key)) {
+            importers.push(toImporterRecord(key, entry));
+            importerKeys.add(key);
+        }
+        else if (entry.link === true) {
+            if (typeof entry.resolved === 'string')
+                nodeIdByKey.set(key, IMPORTER_PREFIX + entry.resolved);
+        }
+        else {
+            const record = toPackageRecord(key, entry);
+            packages.push(record);
+            nodeIdByKey.set(key, record.id);
+        }
+    }
+    return { importers, packages, index: { nodeIdByKey, importerKeys } };
+}
+function isInstallPath(key) {
+    return key.startsWith(MODULES_DIRECTORY) || key.includes(NESTED_MODULES_DIRECTORY);
+}
+function toImporterRecord(key, entry) {
+    const path = key === ROOT_KEY ? ROOT_IMPORTER_PATH : key;
+    return { id: IMPORTER_PREFIX + path, key, entry, path, name: typeof entry.name === 'string' ? entry.name : path };
+}
+function toPackageRecord(key, entry) {
+    const name = typeof entry.name === 'string' ? entry.name : nameFromInstallPath(key);
+    const version = typeof entry.version === 'string' ? entry.version : '';
+    return { id: `${name}@${version}`, key, entry, name, version };
+}
+function nameFromInstallPath(key) {
+    const nestedStart = key.lastIndexOf(NESTED_MODULES_DIRECTORY);
+    const nameStart = nestedStart === -1 ? MODULES_DIRECTORY.length : nestedStart + NESTED_MODULES_DIRECTORY.length;
+    return key.slice(nameStart);
+}
+function addDependencyEdges(builder, index, record, blocks) {
+    let lookupPrefixes;
+    for (const [blockName, kind] of blocks) {
+        const declared = record.entry[blockName];
+        if (!isRecord(declared))
+            continue;
+        lookupPrefixes ??= modulesPrefixesFrom(record.key, index.importerKeys);
+        for (const [name, range] of Object.entries(declared)) {
+            if (typeof range !== 'string')
+                continue;
+            const to = findInstalled(index.nodeIdByKey, lookupPrefixes, name) ?? unresolvedTarget(kind, name, range);
+            if (to !== undefined)
+                builder.addEdge(record.id, { to, kind, range });
+        }
+    }
+}
+function modulesPrefixesFrom(key, importerKeys) {
+    const prefixes = [];
+    for (let scope = key; scope !== ROOT_KEY; scope = parentScope(scope, importerKeys)) {
+        prefixes.push(scope + NESTED_MODULES_DIRECTORY);
+    }
+    prefixes.push(MODULES_DIRECTORY);
+    return prefixes;
+}
+function parentScope(scope, importerKeys) {
+    const nestedStart = scope.lastIndexOf(NESTED_MODULES_DIRECTORY);
+    if (nestedStart !== -1)
+        return scope.slice(0, nestedStart);
+    if (scope.startsWith(MODULES_DIRECTORY))
+        return ROOT_KEY;
+    return nearestEnclosingImporter(scope, importerKeys);
+}
+function nearestEnclosingImporter(path, importerKeys) {
+    for (let end = path.lastIndexOf('/'); end > 0; end = path.lastIndexOf('/', end - 1)) {
+        const candidate = path.slice(0, end);
+        if (importerKeys.has(candidate))
+            return candidate;
+    }
+    return ROOT_KEY;
+}
+function findInstalled(nodeIdByKey, prefixes, name) {
+    for (const prefix of prefixes) {
+        const nodeId = nodeIdByKey.get(prefix + name);
+        if (nodeId !== undefined)
+            return nodeId;
+    }
+    return undefined;
+}
+function unresolvedTarget(kind, name, range) {
+    return OPTIONAL_KINDS.has(kind) ? undefined : `${name}@${range}`;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function recordOf(value) {
+    return isRecord(value) ? value : {};
+}

package/dist/adapters/package-manifest.js

@@ -0,0 +1,57 @@
+import { posix } from 'node:path';
+const MANIFEST_FILE = 'package.json';
+const NON_REGISTRY_PREFIXES = ['git+', 'git:', 'github:', 'gitlab:', 'bitbucket:', 'gist:', 'file:', 'link:', 'workspace:', 'http:', 'https:'];
+const GITHUB_SHORTHAND_PATTERN = /^[\w.-]+\/[\w.-]+(#.+)?$/;
+export const IMPORTER_BLOCKS = [
+    ['dependencies', 'prod'],
+    ['devDependencies', 'dev'],
+    ['optionalDependencies', 'optional'],
+    ['peerDependencies', 'peer'],
+];
+export const PACKAGE_BLOCKS = [
+    ['dependencies', 'prod'],
+    ['optionalDependencies', 'optional'],
+    ['peerDependencies', 'peer'],
+];
+export async function readManifest(reader, directory) {
+    const manifestPath = posix.join(directory, MANIFEST_FILE);
+    const text = await reader.readText(manifestPath);
+    if (text === null)
+        return { problem: `Could not read ${manifestPath}` };
+    try {
+        const record = JSON.parse(text);
+        if (typeof record !== 'object' || record === null || Array.isArray(record)) {
+            return { problem: `${manifestPath} is not a JSON object` };
+        }
+        const fields = record;
+        return {
+            manifest: {
+                record: fields,
+                name: typeof fields.name === 'string' ? fields.name : undefined,
+                version: typeof fields.version === 'string' ? fields.version : undefined,
+            },
+        };
+    }
+    catch {
+        return { problem: `Could not parse ${manifestPath}` };
+    }
+}
+export function declaredDependencies(manifest, blocks) {
+    const declared = [];
+    for (const [blockName, kind] of blocks) {
+        const block = manifest.record[blockName];
+        if (typeof block !== 'object' || block === null || Array.isArray(block))
+            continue;
+        for (const [name, range] of Object.entries(block)) {
+            if (typeof range === 'string')
+                declared.push({ name, range, kind });
+        }
+    }
+    return declared;
+}
+export function isNonRegistrySpec(spec) {
+    return NON_REGISTRY_PREFIXES.some((prefix) => spec.startsWith(prefix)) || GITHUB_SHORTHAND_PATTERN.test(spec);
+}
+export function importerKeyOf(root, importerPath) {
+    return posix.relative(root.path, importerPath) || '.';
+}

package/dist/adapters/pnpm-lock.js

@@ -0,0 +1,177 @@
+import { posix } from 'node:path';
+import { valid } from 'semver';
+import { parse } from 'yaml';
+import { IMPORTER_PREFIX } from "../model.js";
+const ROOT_IMPORTER_PATH = '.';
+const LINK_PREFIX = 'link:';
+const FIRST_SUPPORTED_VERSION = 6;
+const FIRST_SNAPSHOT_VERSION = 9;
+const LATEST_SUPPORTED_MAJOR_VERSION = 9;
+const ALIAS_PATTERN = /^(?:@[^/@]+\/)?[^/@(]+@/;
+const NON_REGISTRY_RESOLUTION_TYPES = new Set(['git', 'directory']);
+const DOCUMENT_START = '---\n';
+const DOCUMENT_SEPARATOR = '\n---\n';
+const SKIP_DUPLICATE_KEY_CHECK = { uniqueKeys: false };
+const IMPORTER_BLOCKS = [
+    ['dependencies', 'prod'],
+    ['devDependencies', 'dev'],
+    ['optionalDependencies', 'optional'],
+];
+const PACKAGE_BLOCKS = [
+    ['dependencies', 'prod'],
+    ['optionalDependencies', 'optional'],
+];
+const SNAPSHOT_LAYOUT = {
+    toNodeId(dependencyName, value) {
+        return ALIAS_PATTERN.test(value) ? value : `${dependencyName}@${value}`;
+    },
+    readPackageRecords(document) {
+        const metadata = recordOf(document.packages);
+        return Object.entries(recordOf(document.snapshots)).map(([id, entry]) => {
+            const packageMetadata = recordOf(metadata[withoutPeerSuffix(id)]);
+            return {
+                id,
+                identity: identityOf(id, packageMetadata),
+                entry: recordOf(entry),
+                peerRanges: recordOf(packageMetadata.peerDependencies),
+            };
+        });
+    },
+};
+const PACKAGES_LAYOUT = {
+    toNodeId(dependencyName, value, knownPackages) {
+        if (knownPackages.has(value))
+            return value;
+        const slashedValue = value.startsWith('/') ? value : `/${value}`;
+        if (knownPackages.has(slashedValue))
+            return slashedValue;
+        if (value.startsWith('/') || ALIAS_PATTERN.test(value))
+            return slashedValue;
+        return `/${dependencyName}@${value}`;
+    },
+    readPackageRecords(document) {
+        return Object.entries(recordOf(document.packages)).map(([id, entry]) => {
+            const record = recordOf(entry);
+            return { id, identity: identityOf(id, record), entry: record, peerRanges: recordOf(record.peerDependencies) };
+        });
+    },
+};
+export function parsePnpmLock(text, builder) {
+    const document = recordOf(parse(extractMainDocument(text), SKIP_DUPLICATE_KEY_CHECK));
+    const layout = selectLayout(document.lockfileVersion);
+    if (!layout) {
+        builder.warn(`pnpm lockfile version ${String(document.lockfileVersion)} is not supported`);
+        return { supported: false };
+    }
+    if (isNewerThanSupported(document.lockfileVersion)) {
+        builder.warn(`pnpm lockfile version ${String(document.lockfileVersion)} is newer than supported; results may be incomplete`);
+    }
+    const importerSections = readImporterSections(document);
+    const packageRecords = layout.readPackageRecords(document);
+    const resolution = {
+        layout,
+        knownPackages: new Map(packageRecords.map((record) => [record.id, record.identity])),
+    };
+    for (const importerPath of Object.keys(importerSections))
+        builder.addImporter(importerPath, importerPath);
+    for (const record of packageRecords) {
+        builder.addPackage(record.id, record.identity.name, record.identity.version, record.identity.peerSuffix);
+        if (isNonRegistryRecord(record))
+            builder.markNonRegistry(record.id);
+    }
+    for (const [importerPath, section] of Object.entries(importerSections)) {
+        addImporterEdges(builder, resolution, importerPath, recordOf(section));
+    }
+    for (const record of packageRecords)
+        addPackageEdges(builder, resolution, record);
+    return { supported: true };
+}
+function isNonRegistryRecord(record) {
+    const resolutionType = recordOf(record.entry.resolution).type;
+    return valid(parsePackageKey(record.id).version) === null || NON_REGISTRY_RESOLUTION_TYPES.has(resolutionType);
+}
+function extractMainDocument(text) {
+    const normalized = text.replace(/\r\n/g, '\n');
+    if (!normalized.startsWith(DOCUMENT_START))
+        return normalized;
+    const separatorStart = normalized.indexOf(DOCUMENT_SEPARATOR);
+    return separatorStart === -1 ? normalized : normalized.slice(separatorStart + DOCUMENT_SEPARATOR.length);
+}
+function selectLayout(lockfileVersion) {
+    const version = Number.parseFloat(String(lockfileVersion));
+    if (!Number.isFinite(version) || version < FIRST_SUPPORTED_VERSION)
+        return undefined;
+    return version >= FIRST_SNAPSHOT_VERSION ? SNAPSHOT_LAYOUT : PACKAGES_LAYOUT;
+}
+function isNewerThanSupported(lockfileVersion) {
+    return Math.trunc(Number.parseFloat(String(lockfileVersion))) > LATEST_SUPPORTED_MAJOR_VERSION;
+}
+function readImporterSections(document) {
+    return isRecord(document.importers) ? document.importers : { [ROOT_IMPORTER_PATH]: document };
+}
+function addImporterEdges(builder, resolution, importerPath, section) {
+    const from = IMPORTER_PREFIX + importerPath;
+    for (const [blockName, kind] of IMPORTER_BLOCKS) {
+        for (const [name, dependency] of Object.entries(recordOf(section[blockName]))) {
+            const { specifier, version } = recordOf(dependency);
+            if (typeof version !== 'string')
+                continue;
+            const to = resolveTargetId(resolution, name, version, importerPath);
+            builder.addEdge(from, { to, kind, range: typeof specifier === 'string' ? specifier : version });
+        }
+    }
+}
+function addPackageEdges(builder, resolution, record) {
+    for (const [blockName, blockKind] of PACKAGE_BLOCKS) {
+        for (const [name, value] of Object.entries(recordOf(record.entry[blockName]))) {
+            if (typeof value !== 'string')
+                continue;
+            builder.addEdge(record.id, toPackageEdge(resolution, record.peerRanges, blockKind, name, value));
+        }
+    }
+}
+function toPackageEdge(resolution, peerRanges, blockKind, name, value) {
+    const to = resolveTargetId(resolution, name, value, ROOT_IMPORTER_PATH);
+    const peerRange = peerRanges[name];
+    if (typeof peerRange === 'string')
+        return { to, kind: 'peer', range: peerRange };
+    return { to, kind: blockKind, range: resolvedVersionOf(resolution, to, value) };
+}
+function resolvedVersionOf(resolution, targetId, value) {
+    if (targetId.startsWith(IMPORTER_PREFIX))
+        return value;
+    return (resolution.knownPackages.get(targetId) ?? parsePackageKey(targetId)).version;
+}
+function resolveTargetId(resolution, name, value, ownerPath) {
+    if (!value.startsWith(LINK_PREFIX))
+        return resolution.layout.toNodeId(name, value, resolution.knownPackages);
+    return IMPORTER_PREFIX + posix.join(ownerPath, value.slice(LINK_PREFIX.length));
+}
+function identityOf(key, declared) {
+    const parsed = parsePackageKey(key);
+    return {
+        ...parsed,
+        name: typeof declared.name === 'string' ? declared.name : parsed.name,
+        version: typeof declared.version === 'string' ? declared.version : parsed.version,
+    };
+}
+function parsePackageKey(key) {
+    const unprefixed = key.startsWith('/') ? key.slice(1) : key;
+    const head = withoutPeerSuffix(unprefixed);
+    const versionSeparator = head.indexOf('@', 1);
+    const name = versionSeparator === -1 ? head : head.slice(0, versionSeparator);
+    const version = versionSeparator === -1 ? '' : head.slice(versionSeparator + 1);
+    if (head.length === unprefixed.length)
+        return { name, version };
+    return { name, version, peerSuffix: unprefixed.slice(head.length) };
+}
+function withoutPeerSuffix(key) {
+    const suffixStart = key.indexOf('(');
+    return suffixStart === -1 ? key : key.slice(0, suffixStart);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function recordOf(value) {
+    return isRecord(value) ? value : {};
+}

package/dist/adapters/resolve-today.js

@@ -0,0 +1,93 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path, { posix } from 'node:path';
+import { processSecrets } from "../config/secrets.js";
+const STDERR_TAIL_LENGTH = 400;
+const activeTempDirs = new Set();
+const INSTALL_COMMANDS = {
+    pnpm: { args: ['install', '--lockfile-only', '--ignore-scripts'], lockfile: 'pnpm-lock.yaml' },
+    npm: { args: ['install', '--package-lock-only', '--ignore-scripts'], lockfile: 'package-lock.json' },
+};
+function describeFailure(command, args, detail) {
+    const text = `${command} ${args.join(' ')} failed`;
+    return detail ? `${text}: ${detail}` : text;
+}
+function stderrTail(stderr) {
+    return processSecrets.redact(stderr).trim().slice(-STDERR_TAIL_LENGTH);
+}
+async function copyFromReader(reader, repoPath, tempDir, rootRelativePath) {
+    const text = await reader.readText(repoPath);
+    if (text === null)
+        return;
+    const target = path.join(tempDir, ...rootRelativePath.split('/'));
+    await mkdir(path.dirname(target), { recursive: true });
+    await writeFile(target, text);
+}
+async function stageRoot(reader, root, tempDir) {
+    const manifestPaths = root.importerPaths.map((importerPath) => {
+        const rootRelative = posix.relative(root.path, importerPath) || '.';
+        return {
+            repoPath: posix.join(importerPath, 'package.json'),
+            rootRelativePath: posix.join(rootRelative, 'package.json'),
+        };
+    });
+    const rootFiles = ['.npmrc', 'pnpm-workspace.yaml'].map((name) => ({
+        repoPath: posix.join(root.path, name),
+        rootRelativePath: name,
+    }));
+    for (const file of [...manifestPaths, ...rootFiles]) {
+        await copyFromReader(reader, file.repoPath, tempDir, file.rootRelativePath);
+    }
+}
+async function pnpmIsAvailable(runner, cwd) {
+    try {
+        return (await runner('pnpm', ['--version'], cwd)).code === 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function chooseManager(root, runner, cwd) {
+    if (root.manager === 'pnpm')
+        return 'pnpm';
+    if (root.manager === 'npm')
+        return 'npm';
+    return (await pnpmIsAvailable(runner, cwd)) ? 'pnpm' : 'npm';
+}
+async function runInstall(manager, runner, tempDir) {
+    const { args, lockfile } = INSTALL_COMMANDS[manager];
+    try {
+        const result = await runner(manager, args, tempDir);
+        if (result.code !== 0)
+            return { error: describeFailure(manager, args, stderrTail(result.stderr)) };
+    }
+    catch (failure) {
+        const code = failure.code;
+        return { error: describeFailure(manager, args, code === 'ENOENT' ? `${manager} was not found` : 'could not be started') };
+    }
+    try {
+        return { manager, lockfileText: await readFile(path.join(tempDir, lockfile), 'utf8') };
+    }
+    catch {
+        return { error: describeFailure(manager, args, `${lockfile} was not produced`) };
+    }
+}
+function removeTempDir(tempDir) {
+    activeTempDirs.delete(tempDir);
+    return rm(tempDir, { recursive: true, force: true });
+}
+export async function removeResolveTempDirs() {
+    await Promise.all([...activeTempDirs].map(removeTempDir));
+}
+export async function resolveToday(reader, root, runner) {
+    const tempDir = await mkdtemp(path.join(tmpdir(), 'deptrail-'));
+    activeTempDirs.add(tempDir);
+    try {
+        await stageRoot(reader, root, tempDir);
+        const manager = await chooseManager(root, runner, tempDir);
+        return await runInstall(manager, runner, tempDir);
+    }
+    finally {
+        await removeTempDir(tempDir);
+    }
+}