@nirvana-labs/nirvana-mcp 1.31.1 → 1.33.0

package/oidc/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/load-virtual.js

@@ -0,0 +1,305 @@
+const { resolve } = require('node:path')
+// mixin providing the loadVirtual method
+const mapWorkspaces = require('@npmcli/map-workspaces')
+const PackageJson = require('@npmcli/package-json')
+const nameFromFolder = require('@npmcli/name-from-folder')
+
+const consistentResolve = require('../consistent-resolve.js')
+const Shrinkwrap = require('../shrinkwrap.js')
+const Node = require('../node.js')
+const Link = require('../link.js')
+const relpath = require('../relpath.js')
+const calcDepFlags = require('../calc-dep-flags.js')
+const treeCheck = require('../tree-check.js')
+
+const flagsSuspect = Symbol.for('flagsSuspect')
+const setWorkspaces = Symbol.for('setWorkspaces')
+
+module.exports = cls => class VirtualLoader extends cls {
+  #rootOptionProvided
+
+  constructor (options) {
+    super(options)
+
+    // the virtual tree we load from a shrinkwrap
+    this.virtualTree = options.virtualTree
+    this[flagsSuspect] = false
+  }
+
+  // public method
+  async loadVirtual (options = {}) {
+    if (this.virtualTree) {
+      return this.virtualTree
+    }
+
+    // allow the user to set reify options on the ctor as well.
+    // XXX: deprecate separate reify() options object.
+    options = { ...this.options, ...options }
+
+    if (options.root && options.root.meta) {
+      await this.#loadFromShrinkwrap(options.root.meta, options.root)
+      return treeCheck(this.virtualTree)
+    }
+
+    const s = await Shrinkwrap.load({
+      path: this.path,
+      lockfileVersion: this.options.lockfileVersion,
+      resolveOptions: this.options,
+    })
+    if (!s.loadedFromDisk && !options.root) {
+      const er = new Error('loadVirtual requires existing shrinkwrap file')
+      throw Object.assign(er, { code: 'ENOLOCK' })
+    }
+
+    // when building the ideal tree, we pass in a root node to this function
+    // otherwise, load it from the root package json or the lockfile
+    const pkg = await PackageJson.normalize(this.path).then(p => p.content).catch(() => s.data.packages[''] || {})
+    // TODO clean this up
+    const {
+      root = await this[setWorkspaces](this.#loadNode('', pkg, true)),
+    } = options
+    this.#rootOptionProvided = options.root
+
+    await this.#loadFromShrinkwrap(s, root)
+    root.assertRootOverrides()
+    return treeCheck(this.virtualTree)
+  }
+
+  async #loadFromShrinkwrap (s, root) {
+    if (!this.#rootOptionProvided) {
+      // root is never any of these things, but might be a brand new
+      // baby Node object that never had its dep flags calculated.
+      root.extraneous = false
+      root.dev = false
+      root.optional = false
+      root.devOptional = false
+      root.peer = false
+    } else {
+      this[flagsSuspect] = true
+    }
+
+    this.#checkRootEdges(s, root)
+    root.meta = s
+    this.virtualTree = root
+    const { links, nodes } = this.#resolveNodes(s, root)
+    await this.#resolveLinks(links, nodes)
+    if (!(s.originalLockfileVersion >= 2)) {
+      this.#assignBundles(nodes)
+    }
+    if (this[flagsSuspect]) {
+      // reset all dep flags
+      // can't use inventory here, because virtualTree might not be root
+      for (const node of nodes.values()) {
+        if (node.isRoot || node === this.#rootOptionProvided) {
+          continue
+        }
+        node.extraneous = true
+        node.dev = true
+        node.optional = true
+        node.devOptional = true
+        node.peer = true
+      }
+      calcDepFlags(this.virtualTree, !this.#rootOptionProvided)
+    }
+    return root
+  }
+
+  // check the lockfile deps, and see if they match.  if they do not
+  // then we have to reset dep flags at the end.  for example, if the
+  // user manually edits their package.json file, then we need to know
+  // that the idealTree is no longer entirely trustworthy.
+  #checkRootEdges (s, root) {
+    // loaded virtually from tree, no chance of being out of sync
+    // ancient lockfiles are critically damaged by this process,
+    // so we need to just hope for the best in those cases.
+    if (!s.loadedFromDisk || s.ancientLockfile) {
+      return
+    }
+
+    const lock = s.get('')
+    const prod = lock.dependencies || {}
+    const dev = lock.devDependencies || {}
+    const optional = lock.optionalDependencies || {}
+    const peer = lock.peerDependencies || {}
+    const peerOptional = {}
+
+    if (lock.peerDependenciesMeta) {
+      for (const [name, meta] of Object.entries(lock.peerDependenciesMeta)) {
+        if (meta.optional && peer[name] !== undefined) {
+          peerOptional[name] = peer[name]
+          delete peer[name]
+        }
+      }
+    }
+
+    for (const name of Object.keys(optional)) {
+      delete prod[name]
+    }
+
+    const lockWS = {}
+    const workspaces = mapWorkspaces.virtual({
+      cwd: this.path,
+      lockfile: s.data,
+    })
+
+    for (const [name, path] of workspaces.entries()) {
+      lockWS[name] = `file:${path}`
+    }
+
+    // Should rootNames exclude optional?
+    const rootNames = new Set(root.edgesOut.keys())
+
+    const lockByType = ({ dev, optional, peer, peerOptional, prod, workspace: lockWS })
+
+    // Find anything in shrinkwrap deps that doesn't match root's type or spec
+    for (const type in lockByType) {
+      const deps = lockByType[type]
+      for (const name in deps) {
+        const edge = root.edgesOut.get(name)
+        if (!edge || edge.type !== type || edge.spec !== deps[name]) {
+          return this[flagsSuspect] = true
+        }
+        rootNames.delete(name)
+      }
+    }
+    // Something was in root that's not accounted for in shrinkwrap
+    if (rootNames.size) {
+      return this[flagsSuspect] = true
+    }
+  }
+
+  // separate out link metadata, and create Node objects for nodes
+  #resolveNodes (s, root) {
+    const links = new Map()
+    const nodes = new Map([['', root]])
+    for (const [location, meta] of Object.entries(s.data.packages)) {
+      // skip the root because we already got it
+      if (!location) {
+        continue
+      }
+
+      if (meta.link) {
+        links.set(location, meta)
+      } else {
+        nodes.set(location, this.#loadNode(location, meta))
+      }
+    }
+    return { links, nodes }
+  }
+
+  // links is the set of metadata, and nodes is the map of non-Link nodes
+  // Set the targets to nodes in the set, if we have them (we might not)
+  async #resolveLinks (links, nodes) {
+    for (const [location, meta] of links.entries()) {
+      const targetPath = resolve(this.path, meta.resolved)
+      const targetLoc = relpath(this.path, targetPath)
+      const target = nodes.get(targetLoc)
+
+      if (!target) {
+        const err = new Error(
+`Missing target in lock file: "${targetLoc}" is referenced by "${location}" but does not exist.
+To fix:
+1. rm package-lock.json
+2. npm install`
+        )
+        err.code = 'EMISSINGTARGET'
+        throw err
+      }
+
+      const link = this.#loadLink(location, targetLoc, target, meta)
+      nodes.set(location, link)
+      nodes.set(targetLoc, link.target)
+
+      // we always need to read the package.json for link targets
+      // outside node_modules because they can be changed by the local user
+      if (!link.target.parent) {
+        await PackageJson.normalize(link.realpath).then(p => link.target.package = p.content).catch(() => null)
+      }
+    }
+  }
+
+  #assignBundles (nodes) {
+    for (const [location, node] of nodes) {
+      // Skip assignment of parentage for the root package
+      if (!location || node.isLink && !node.target.location) {
+        continue
+      }
+      const { name, parent, package: { inBundle } } = node
+
+      if (!parent) {
+        continue
+      }
+
+      // read inBundle from package because 'package' here is
+      // actually a v2 lockfile metadata entry.
+      // If the *parent* is also bundled, though, or if the parent has
+      // no dependency on it, then we assume that it's being pulled in
+      // just by virtue of its parent or a transitive dep being bundled.
+      const { package: ppkg } = parent
+      const { inBundle: parentBundled } = ppkg
+      if (inBundle && !parentBundled && parent.edgesOut.has(node.name)) {
+        if (!ppkg.bundleDependencies) {
+          ppkg.bundleDependencies = [name]
+        } else {
+          ppkg.bundleDependencies.push(name)
+        }
+      }
+    }
+  }
+
+  #loadNode (location, sw, loadOverrides) {
+    const p = this.virtualTree ? this.virtualTree.realpath : this.path
+    const path = resolve(p, location)
+    // shrinkwrap doesn't include package name unless necessary
+    if (!sw.name) {
+      sw.name = nameFromFolder(path)
+    }
+
+    const dev = sw.dev
+    const optional = sw.optional
+    const devOptional = dev || optional || sw.devOptional
+    const peer = sw.peer
+
+    const node = new Node({
+      installLinks: this.installLinks,
+      legacyPeerDeps: this.legacyPeerDeps,
+      root: this.virtualTree,
+      path,
+      realpath: path,
+      integrity: sw.integrity,
+      resolved: consistentResolve(sw.resolved, this.path, path),
+      pkg: sw,
+      hasShrinkwrap: sw.hasShrinkwrap,
+      dev,
+      optional,
+      devOptional,
+      peer,
+      loadOverrides,
+    })
+    // cast to boolean because they're undefined in the lock file when false
+    node.extraneous = !!sw.extraneous
+    node.devOptional = !!(sw.devOptional || sw.dev || sw.optional)
+    node.peer = !!sw.peer
+    node.optional = !!sw.optional
+    node.dev = !!sw.dev
+    return node
+  }
+
+  #loadLink (location, targetLoc, target) {
+    const path = resolve(this.path, location)
+    const link = new Link({
+      installLinks: this.installLinks,
+      legacyPeerDeps: this.legacyPeerDeps,
+      path,
+      realpath: resolve(this.path, targetLoc),
+      target,
+      pkg: target && target.package,
+    })
+    link.extraneous = target.extraneous
+    link.devOptional = target.devOptional
+    link.peer = target.peer
+    link.optional = target.optional
+    link.dev = target.dev
+    return link
+  }
+}

package/oidc/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/rebuild.js

@@ -0,0 +1,403 @@
+// Arborist.rebuild({path = this.path}) will do all the binlinks and
+// bundle building needed.  Called by reify, and by `npm rebuild`.
+
+const PackageJson = require('@npmcli/package-json')
+const binLinks = require('bin-links')
+const localeCompare = require('@isaacs/string-locale-compare')('en')
+const promiseAllRejectLate = require('promise-all-reject-late')
+const runScript = require('@npmcli/run-script')
+const { callLimit: promiseCallLimit } = require('promise-call-limit')
+const { depth: dfwalk } = require('treeverse')
+const { isNodeGypPackage, defaultGypInstallScript } = require('@npmcli/node-gyp')
+const { log, time } = require('proc-log')
+const { resolve } = require('node:path')
+
+const boolEnv = b => b ? '1' : ''
+const sortNodes = (a, b) => (a.depth - b.depth) || localeCompare(a.path, b.path)
+
+const _checkBins = Symbol.for('checkBins')
+
+// defined by reify mixin
+const _handleOptionalFailure = Symbol.for('handleOptionalFailure')
+const _trashList = Symbol.for('trashList')
+
+module.exports = cls => class Builder extends cls {
+  #doHandleOptionalFailure
+  #oldMeta = null
+  #queues
+
+  constructor (options) {
+    super(options)
+
+    this.scriptsRun = new Set()
+    this.#resetQueues()
+  }
+
+  async rebuild ({ nodes, handleOptionalFailure = false } = {}) {
+    // nothing to do if we're not building anything!
+    if (this.options.ignoreScripts && !this.options.binLinks) {
+      return
+    }
+
+    // when building for the first time, as part of reify, we ignore
+    // failures in optional nodes, and just delete them.  however, when
+    // running JUST a rebuild, we treat optional failures as real fails
+    this.#doHandleOptionalFailure = handleOptionalFailure
+
+    if (!nodes) {
+      nodes = await this.#loadDefaultNodes()
+    }
+
+    // separates links nodes so that it can run
+    // prepare scripts and link bins in the expected order
+    const timeEnd = time.start('build')
+
+    const {
+      depNodes,
+      linkNodes,
+    } = this.#retrieveNodesByType(nodes)
+
+    // build regular deps
+    await this.#build(depNodes, {})
+
+    // build link deps
+    if (linkNodes.size) {
+      this.#resetQueues()
+      await this.#build(linkNodes, { type: 'links' })
+    }
+
+    timeEnd()
+  }
+
+  // if we don't have a set of nodes, then just rebuild
+  // the actual tree on disk.
+  async #loadDefaultNodes () {
+    let nodes
+    const tree = await this.loadActual()
+    let filterSet
+    if (!this.options.workspacesEnabled) {
+      filterSet = this.excludeWorkspacesDependencySet(tree)
+      nodes = tree.inventory.filter(node =>
+        filterSet.has(node) || node.isProjectRoot
+      )
+    } else if (this.options.workspaces.length) {
+      filterSet = this.workspaceDependencySet(
+        tree,
+        this.options.workspaces,
+        this.options.includeWorkspaceRoot
+      )
+      nodes = tree.inventory.filter(node => filterSet.has(node))
+    } else {
+      nodes = tree.inventory.values()
+    }
+    return nodes
+  }
+
+  #retrieveNodesByType (nodes) {
+    const depNodes = new Set()
+    const linkNodes = new Set()
+    const storeNodes = new Set()
+
+    for (const node of nodes) {
+      if (node.isStoreLink) {
+        storeNodes.add(node)
+      } else if (node.isLink) {
+        linkNodes.add(node)
+      } else {
+        depNodes.add(node)
+      }
+    }
+    // Make sure that store linked nodes are processed last.
+    // We can't process store links separately or else lifecycle scripts on
+    // standard nodes might not have bin links yet.
+    for (const node of storeNodes) {
+      depNodes.add(node)
+    }
+
+    // deduplicates link nodes and their targets, avoids
+    // calling lifecycle scripts twice when running `npm rebuild`
+    // ref: https://github.com/npm/cli/issues/2905
+    //
+    // we avoid doing so if global=true since `bin-links` relies
+    // on having the target nodes available in global mode.
+    if (!this.options.global) {
+      for (const node of linkNodes) {
+        depNodes.delete(node.target)
+      }
+    }
+
+    return {
+      depNodes,
+      linkNodes,
+    }
+  }
+
+  #resetQueues () {
+    this.#queues = {
+      preinstall: [],
+      install: [],
+      postinstall: [],
+      prepare: [],
+      bin: [],
+    }
+  }
+
+  async #build (nodes, { type = 'deps' }) {
+    const timeEnd = time.start(`build:${type}`)
+
+    await this.#buildQueues(nodes)
+
+    if (!this.options.ignoreScripts) {
+      await this.#runScripts('preinstall')
+    }
+
+    // links should run prepare scripts and only link bins after that
+    if (type === 'links') {
+      if (!this.options.ignoreScripts) {
+        await this.#runScripts('prepare')
+      }
+    }
+    if (this.options.binLinks) {
+      await this.#linkAllBins()
+    }
+
+    if (!this.options.ignoreScripts) {
+      await this.#runScripts('install')
+      await this.#runScripts('postinstall')
+    }
+
+    timeEnd()
+  }
+
+  async #buildQueues (nodes) {
+    const timeEnd = time.start('build:queue')
+    const set = new Set()
+
+    const promises = []
+    for (const node of nodes) {
+      promises.push(this.#addToBuildSet(node, set))
+
+      // if it has bundle deps, add those too, if rebuildBundle
+      if (this.options.rebuildBundle !== false) {
+        const bd = node.package.bundleDependencies
+        if (bd && bd.length) {
+          dfwalk({
+            tree: node,
+            leave: node => promises.push(this.#addToBuildSet(node, set)),
+            getChildren: node => [...node.children.values()],
+            filter: node => node.inBundle,
+          })
+        }
+      }
+    }
+    await promiseAllRejectLate(promises)
+
+    // now sort into the queues for the 4 things we have to do
+    // run in the same predictable order that buildIdealTree uses
+    // there's no particular reason for doing it in this order rather
+    // than another, but sorting *somehow* makes it consistent.
+    const queue = [...set].sort(sortNodes)
+
+    for (const node of queue) {
+      const { package: { bin, scripts = {} } } = node.target
+      const { preinstall, install, postinstall, prepare } = scripts
+      const tests = { bin, preinstall, install, postinstall, prepare }
+      for (const [key, has] of Object.entries(tests)) {
+        if (has) {
+          this.#queues[key].push(node)
+        }
+      }
+    }
+    timeEnd()
+  }
+
+  async [_checkBins] (node) {
+    // if the node is a global top, and we're not in force mode, then
+    // any existing bins need to either be missing, or a symlink into
+    // the node path.  Otherwise a package can have a preinstall script
+    // that unlinks something, to allow them to silently overwrite system
+    // binaries, which is unsafe and insecure.
+    if (!node.globalTop || this.options.force) {
+      return
+    }
+    const { path, package: pkg } = node
+    await binLinks.checkBins({ pkg, path, top: true, global: true })
+  }
+
+  async #addToBuildSet (node, set, refreshed = false) {
+    if (set.has(node)) {
+      return
+    }
+
+    if (this.#oldMeta === null) {
+      const { root: { meta } } = node
+      this.#oldMeta = meta && meta.loadedFromDisk &&
+        !(meta.originalLockfileVersion >= 2)
+    }
+
+    const { package: pkg, hasInstallScript } = node.target
+    const { gypfile, bin, scripts = {} } = pkg
+
+    const { preinstall, install, postinstall, prepare } = scripts
+    const anyScript = preinstall || install || postinstall || prepare
+    if (!refreshed && !anyScript && (hasInstallScript || this.#oldMeta)) {
+      // we either have an old metadata (and thus might have scripts)
+      // or we have an indication that there's install scripts (but
+      // don't yet know what they are) so we have to load the package.json
+      // from disk to see what the deal is.  Failure here just means
+      // no scripts to add, probably borked package.json.
+      // add to the set then remove while we're reading the pj, so we
+      // don't accidentally hit it multiple times.
+      set.add(node)
+      const { content: pkg } = await PackageJson.normalize(node.path).catch(() => {
+        return { content: {} }
+      })
+      set.delete(node)
+
+      const { scripts = {} } = pkg
+      node.package.scripts = scripts
+      return this.#addToBuildSet(node, set, true)
+    }
+
+    // Rebuild node-gyp dependencies lacking an install or preinstall script
+    // note that 'scripts' might be missing entirely, and the package may
+    // set gypfile:false to avoid this automatic detection.
+    const isGyp = gypfile !== false &&
+      !install &&
+      !preinstall &&
+      await isNodeGypPackage(node.path)
+
+    if (bin || preinstall || install || postinstall || prepare || isGyp) {
+      if (bin) {
+        await this[_checkBins](node)
+      }
+      if (isGyp) {
+        scripts.install = defaultGypInstallScript
+        node.package.scripts = scripts
+      }
+      set.add(node)
+    }
+  }
+
+  async #runScripts (event) {
+    const queue = this.#queues[event]
+
+    if (!queue.length) {
+      return
+    }
+
+    const timeEnd = time.start(`build:run:${event}`)
+    const stdio = this.options.foregroundScripts ? 'inherit' : 'pipe'
+    const limit = this.options.foregroundScripts ? 1 : undefined
+    await promiseCallLimit(queue.map(node => async () => {
+      const {
+        path,
+        integrity,
+        resolved,
+        optional,
+        peer,
+        dev,
+        devOptional,
+        package: pkg,
+        location,
+        isStoreLink,
+      } = node.target
+
+      // skip any that we know we'll be deleting
+      // or storeLinks
+      if (this[_trashList].has(path) || isStoreLink) {
+        return
+      }
+
+      const timeEndLocation = time.start(`build:run:${event}:${location}`)
+      log.info('run', pkg._id, event, location, pkg.scripts[event])
+      const env = {
+        npm_package_resolved: resolved,
+        npm_package_integrity: integrity,
+        npm_package_json: resolve(path, 'package.json'),
+        npm_package_optional: boolEnv(optional),
+        npm_package_dev: boolEnv(dev),
+        npm_package_peer: boolEnv(peer),
+        npm_package_dev_optional:
+          boolEnv(devOptional && !dev && !optional),
+      }
+      const runOpts = {
+        event,
+        path,
+        pkg,
+        stdio,
+        env,
+        scriptShell: this.options.scriptShell,
+      }
+      const p = runScript(runOpts).catch(er => {
+        const { code, signal } = er
+        log.info('run', pkg._id, event, { code, signal })
+        throw er
+      }).then(({ args, code, signal, stdout, stderr }) => {
+        this.scriptsRun.add({
+          pkg,
+          path,
+          event,
+          // I do not know why this needs to be on THIS line but refactoring
+          // this function would be quite a process
+          // eslint-disable-next-line promise/always-return
+          cmd: args && args[args.length - 1],
+          env,
+          code,
+          signal,
+          stdout,
+          stderr,
+        })
+        log.info('run', pkg._id, event, { code, signal })
+      })
+
+      await (this.#doHandleOptionalFailure
+        ? this[_handleOptionalFailure](node, p)
+        : p)
+
+      timeEndLocation()
+    }), { limit })
+    timeEnd()
+  }
+
+  async #linkAllBins () {
+    const queue = this.#queues.bin
+    if (!queue.length) {
+      return
+    }
+
+    const timeEnd = time.start('build:link')
+    const promises = []
+    // sort the queue by node path, so that the module-local collision
+    // detector in bin-links will always resolve the same way.
+    for (const node of queue.sort(sortNodes)) {
+      // TODO these run before they're awaited
+      promises.push(this.#createBinLinks(node))
+    }
+
+    await promiseAllRejectLate(promises)
+    timeEnd()
+  }
+
+  async #createBinLinks (node) {
+    if (this[_trashList].has(node.path)) {
+      return
+    }
+
+    const timeEnd = time.start(`build:link:${node.location}`)
+
+    const p = binLinks({
+      pkg: node.package,
+      path: node.path,
+      top: !!(node.isTop || node.globalTop),
+      force: this.options.force,
+      global: !!node.globalTop,
+    })
+
+    await (this.#doHandleOptionalFailure
+      ? this[_handleOptionalFailure](node, p)
+      : p)
+
+    timeEnd()
+  }
+}