@nirvana-labs/nirvana 1.31.0 → 1.32.0

package/oidc/node_modules/npm/lib/commands/publish.js

@@ -0,0 +1,284 @@
+const { log, output } = require('proc-log')
+const semver = require('semver')
+const pack = require('libnpmpack')
+const libpub = require('libnpmpublish').publish
+const runScript = require('@npmcli/run-script')
+const pacote = require('pacote')
+const npa = require('npm-package-arg')
+const npmFetch = require('npm-registry-fetch')
+const { redactLog: replaceInfo } = require('@npmcli/redact')
+const { otplease } = require('../utils/auth.js')
+const { getContents, logTar } = require('../utils/tar.js')
+// for historical reasons, publishConfig in package.json can contain ANY config
+// keys that npm supports in .npmrc files and elsewhere.  We *may* want to
+// revisit this at some point, and have a minimal set that's a SemVer-major
+// change that ought to get a RFC written on it.
+const { flatten } = require('@npmcli/config/lib/definitions')
+const pkgJson = require('@npmcli/package-json')
+const BaseCommand = require('../base-cmd.js')
+const { oidc } = require('../../lib/utils/oidc.js')
+
+class Publish extends BaseCommand {
+  static description = 'Publish a package'
+  static name = 'publish'
+  static params = [
+    'tag',
+    'access',
+    'dry-run',
+    'otp',
+    'workspace',
+    'workspaces',
+    'include-workspace-root',
+    'provenance',
+  ]
+
+  static usage = ['<package-spec>']
+  static workspaces = true
+  static ignoreImplicitWorkspace = false
+
+  async exec (args) {
+    if (args.length === 0) {
+      args = ['.']
+    }
+    if (args.length !== 1) {
+      throw this.usageError()
+    }
+
+    await this.#publish(args)
+  }
+
+  async execWorkspaces (args) {
+    const useWorkspaces = args.length === 0 || args.includes('.')
+    if (!useWorkspaces) {
+      log.warn('Ignoring workspaces for specified package(s)')
+      return this.exec(args)
+    }
+    await this.setWorkspaces()
+
+    for (const [name, workspace] of this.workspaces.entries()) {
+      try {
+        await this.#publish([workspace], { workspace: name })
+      } catch (err) {
+        if (err.code !== 'EPRIVATE') {
+          throw err
+        }
+        log.warn('publish', `Skipping workspace ${this.npm.chalk.cyan(name)}, marked as ${this.npm.chalk.bold('private')}`)
+      }
+    }
+  }
+
+  async #publish (args, { workspace } = {}) {
+    log.verbose('publish', replaceInfo(args))
+
+    const unicode = this.npm.config.get('unicode')
+    const dryRun = this.npm.config.get('dry-run')
+    const json = this.npm.config.get('json')
+    const defaultTag = this.npm.config.get('tag')
+    const ignoreScripts = this.npm.config.get('ignore-scripts')
+    const { silent } = this.npm
+
+    if (semver.validRange(defaultTag)) {
+      throw new Error('Tag name must not be a valid SemVer range: ' + defaultTag.trim())
+    }
+
+    const opts = { ...this.npm.flatOptions, progress: false }
+
+    // you can publish name@version, ./foo.tgz, etc.
+    // even though the default is the 'file:.' cwd.
+    const spec = npa(args[0])
+    let manifest = await this.#getManifest(spec, opts)
+
+    // only run scripts for directory type publishes
+    if (spec.type === 'directory' && !ignoreScripts) {
+      await runScript({
+        event: 'prepublishOnly',
+        path: spec.fetchSpec,
+        stdio: 'inherit',
+        pkg: manifest,
+      })
+    }
+
+    // we pass dryRun: true to libnpmpack so it doesn't write the file to disk
+    const tarballData = await pack(spec, {
+      ...opts,
+      foregroundScripts: this.npm.config.isDefault('foreground-scripts')
+        ? true
+        : this.npm.config.get('foreground-scripts'),
+      dryRun: true,
+      prefix: this.npm.localPrefix,
+      workspaces: this.workspacePaths,
+    })
+    const pkgContents = await getContents(manifest, tarballData)
+    const logPkg = () => logTar(pkgContents, { unicode, json, key: workspace })
+
+    // The purpose of re-reading the manifest is in case it changed,
+    // so that we send the latest and greatest thing to the registry
+    // note that publishConfig might have changed as well!
+    manifest = await this.#getManifest(spec, opts, true)
+    const force = this.npm.config.get('force')
+    const isDefaultTag = this.npm.config.isDefault('tag') && !manifest.publishConfig?.tag
+
+    if (!force) {
+      const isPreRelease = Boolean(semver.parse(manifest.version).prerelease.length)
+      if (isPreRelease && isDefaultTag) {
+        throw new Error('You must specify a tag using --tag when publishing a prerelease version.')
+      }
+    }
+
+    // If we are not in JSON mode then we show the user the contents of the tarball
+    // before it is published so they can see it while their otp is pending
+    if (!json) {
+      logPkg()
+    }
+
+    const resolved = npa.resolve(manifest.name, manifest.version)
+
+    // make sure tag is valid, this will throw if invalid
+    npa(`${manifest.name}@${defaultTag}`)
+
+    const registry = npmFetch.pickRegistry(resolved, opts)
+
+    await oidc({ packageName: manifest.name, registry, opts, config: this.npm.config })
+
+    const creds = this.npm.config.getCredentialsByURI(registry)
+    const noCreds = !(creds.token || creds.username || creds.certfile && creds.keyfile)
+    const outputRegistry = replaceInfo(registry)
+
+    // if a workspace package is marked private then we skip it
+    if (workspace && manifest.private) {
+      throw Object.assign(
+        new Error(`This package has been marked as private
+  Remove the 'private' field from the package.json to publish it.`),
+        { code: 'EPRIVATE' }
+      )
+    }
+
+    if (noCreds) {
+      const msg = `This command requires you to be logged in to ${outputRegistry}`
+      if (dryRun) {
+        log.warn('', `${msg} (dry-run)`)
+      } else {
+        throw Object.assign(new Error(msg), { code: 'ENEEDAUTH' })
+      }
+    }
+
+    if (!force) {
+      const { highestVersion, versions } = await this.#registryVersions(resolved, registry)
+      /* eslint-disable-next-line max-len */
+      const highestVersionIsGreater = !!highestVersion && semver.gte(highestVersion, manifest.version)
+
+      if (versions.includes(manifest.version)) {
+        throw new Error(`You cannot publish over the previously published versions: ${manifest.version}.`)
+      }
+
+      if (highestVersionIsGreater && isDefaultTag) {
+        throw new Error(`Cannot implicitly apply the "latest" tag because previously published version ${highestVersion} is higher than the new version ${manifest.version}. You must specify a tag using --tag.`)
+      }
+    }
+
+    const access = opts.access === null ? 'default' : opts.access
+    let msg = `Publishing to ${outputRegistry} with tag ${defaultTag} and ${access} access`
+    if (dryRun) {
+      msg = `${msg} (dry-run)`
+    }
+
+    log.notice('', msg)
+
+    if (!dryRun) {
+      await otplease(this.npm, opts, o => libpub(manifest, tarballData, o))
+    }
+
+    // In json mode we don't log until the publish has completed as this will
+    // add it to the output only if completes successfully
+    if (json) {
+      logPkg()
+    }
+
+    if (spec.type === 'directory' && !ignoreScripts) {
+      await runScript({
+        event: 'publish',
+        path: spec.fetchSpec,
+        stdio: 'inherit',
+        pkg: manifest,
+      })
+
+      await runScript({
+        event: 'postpublish',
+        path: spec.fetchSpec,
+        stdio: 'inherit',
+        pkg: manifest,
+      })
+    }
+
+    if (!json && !silent) {
+      output.standard(`+ ${pkgContents.id}`)
+    }
+  }
+
+  async #registryVersions (spec, registry) {
+    try {
+      const packument = await pacote.packument(spec, {
+        ...this.npm.flatOptions,
+        preferOnline: true,
+        registry,
+      })
+      if (typeof packument?.versions === 'undefined') {
+        return { versions: [], highestVersion: null }
+      }
+      const ordered = Object.keys(packument?.versions)
+        .flatMap(v => {
+          const s = new semver.SemVer(v)
+          if ((s.prerelease.length > 0) || packument.versions[v].deprecated) {
+            return []
+          }
+          return s
+        })
+        .sort((a, b) => b.compare(a))
+      const highestVersion = ordered.length >= 1 ? ordered[0].version : null
+      const versions = ordered.map(v => v.version)
+      return { versions, highestVersion }
+    } catch (e) {
+      return { versions: [], highestVersion: null }
+    }
+  }
+
+  // if it's a directory, read it from the file system
+  // otherwise, get the full metadata from whatever it is
+  // XXX can't pacote read the manifest from a directory?
+  async #getManifest (spec, opts, logWarnings = false) {
+    let manifest
+    if (spec.type === 'directory') {
+      const changes = []
+      const pkg = await pkgJson.fix(spec.fetchSpec, { changes })
+      if (changes.length && logWarnings) {
+        log.warn('publish', 'npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.')
+        log.warn('publish', `errors corrected:\n${changes.join('\n')}`)
+      }
+      // Prepare is the special function for publishing, different than normalize
+      const { content } = await pkg.prepare()
+      manifest = content
+    } else {
+      manifest = await pacote.manifest(spec, {
+        ...opts,
+        fullmetadata: true,
+        fullReadJson: true,
+      })
+    }
+    if (manifest.publishConfig) {
+      const cliFlags = this.npm.config.data.get('cli').raw
+      // Filter out properties set in CLI flags to prioritize them over
+      // corresponding `publishConfig` settings
+      const filteredPublishConfig = Object.fromEntries(
+        Object.entries(manifest.publishConfig).filter(([key]) => !(key in cliFlags)))
+      if (logWarnings) {
+        for (const key in filteredPublishConfig) {
+          this.npm.config.checkUnknown('publishConfig', key)
+        }
+      }
+      flatten(filteredPublishConfig, opts)
+    }
+    return manifest
+  }
+}
+
+module.exports = Publish

package/oidc/node_modules/npm/lib/commands/query.js

@@ -0,0 +1,126 @@
+const { resolve } = require('node:path')
+const BaseCommand = require('../base-cmd.js')
+const { log, output } = require('proc-log')
+
+class QuerySelectorItem {
+  constructor (node) {
+    // all enumerable properties from the target
+    Object.assign(this, node.target.package)
+
+    // append extra info
+    this.pkgid = node.target.pkgid
+    this.location = node.target.location
+    this.path = node.target.path
+    this.realpath = node.target.realpath
+    this.resolved = node.target.resolved
+    this.from = []
+    this.to = []
+    this.dev = node.target.dev
+    this.inBundle = node.target.inBundle
+    this.deduped = this.from.length > 1
+    this.overridden = node.overridden
+    this.queryContext = node.queryContext
+    for (const edge of node.target.edgesIn) {
+      this.from.push(edge.from.location)
+    }
+    for (const [, edge] of node.target.edgesOut) {
+      if (edge.to) {
+        this.to.push(edge.to.location)
+      }
+    }
+  }
+}
+
+class Query extends BaseCommand {
+  #response = [] // response is the query response
+  #seen = new Set() // paths we've seen so we can keep response deduped
+
+  static description = 'Retrieve a filtered list of packages'
+  static name = 'query'
+  static usage = ['<selector>']
+
+  static workspaces = true
+  static ignoreImplicitWorkspace = false
+
+  static params = [
+    'global',
+    'workspace',
+    'workspaces',
+    'include-workspace-root',
+    'package-lock-only',
+    'expect-results',
+  ]
+
+  constructor (...args) {
+    super(...args)
+    this.npm.config.set('json', true)
+  }
+
+  async exec (args) {
+    const packageLock = this.npm.config.get('package-lock-only')
+    const Arborist = require('@npmcli/arborist')
+    const arb = new Arborist({
+      ...this.npm.flatOptions,
+      // one dir up from wherever node_modules lives
+      path: resolve(this.npm.dir, '..'),
+      forceActual: !packageLock,
+    })
+    let tree
+    if (packageLock) {
+      try {
+        tree = await arb.loadVirtual()
+      } catch (err) {
+        log.verbose('loadVirtual', err.stack)
+        throw this.usageError(
+          'A package lock or shrinkwrap file is required in package-lock-only mode'
+        )
+      }
+    } else {
+      tree = await arb.loadActual()
+    }
+    await this.#queryTree(tree, args[0])
+    this.#output()
+  }
+
+  async execWorkspaces (args) {
+    await this.setWorkspaces()
+    const Arborist = require('@npmcli/arborist')
+    const arb = new Arborist({
+      ...this.npm.flatOptions,
+      path: this.npm.prefix,
+    })
+    // FIXME: Workspace support in query does not work as expected so this does not
+    // do the same package-lock-only check as this.exec().
+    // https://github.com/npm/cli/pull/6732#issuecomment-1708804921
+    const tree = await arb.loadActual()
+    for (const path of this.workspacePaths) {
+      const wsTree = path === tree.root.path
+        ? tree // --includes-workspace-root
+        : await tree.querySelectorAll(`.workspace:path(${path})`).then(r => r[0].target)
+      await this.#queryTree(wsTree, args[0])
+    }
+    this.#output()
+  }
+
+  #output () {
+    this.checkExpected(this.#response.length)
+    output.buffer(this.#response)
+  }
+
+  // builds a normalized inventory
+  async #queryTree (tree, arg) {
+    const items = await tree.querySelectorAll(arg, this.npm.flatOptions)
+    for (const node of items) {
+      const { location } = node.target
+      if (!location || !this.#seen.has(location)) {
+        const item = new QuerySelectorItem(node)
+        this.#response.push(item)
+        if (location) {
+          this.#seen.add(item.location)
+        }
+      }
+    }
+  }
+}
+
+module.exports = Query

package/oidc/node_modules/npm/lib/commands/rebuild.js

@@ -0,0 +1,84 @@
+const { resolve } = require('node:path')
+const { output } = require('proc-log')
+const npa = require('npm-package-arg')
+const semver = require('semver')
+const ArboristWorkspaceCmd = require('../arborist-cmd.js')
+
+class Rebuild extends ArboristWorkspaceCmd {
+  static description = 'Rebuild a package'
+  static name = 'rebuild'
+  static params = [
+    'global',
+    'bin-links',
+    'foreground-scripts',
+    'ignore-scripts',
+    ...super.params,
+  ]
+
+  static usage = ['[<package-spec>] ...]']
+
+  // TODO
+  /* istanbul ignore next */
+  static async completion (opts, npm) {
+    const completion = require('../utils/installed-deep.js')
+    return completion(npm, opts)
+  }
+
+  async exec (args) {
+    const globalTop = resolve(this.npm.globalDir, '..')
+    const where = this.npm.global ? globalTop : this.npm.prefix
+    const Arborist = require('@npmcli/arborist')
+    const arb = new Arborist({
+      ...this.npm.flatOptions,
+      path: where,
+      // TODO when extending ReifyCmd
+      // workspaces: this.workspaceNames,
+    })
+
+    if (args.length) {
+      // get the set of nodes matching the name that we want rebuilt
+      const tree = await arb.loadActual()
+      const specs = args.map(arg => {
+        const spec = npa(arg)
+        if (spec.rawSpec === '*') {
+          return spec
+        }
+
+        if (spec.type !== 'range' && spec.type !== 'version' && spec.type !== 'directory') {
+          throw new Error('`npm rebuild` only supports SemVer version/range specifiers')
+        }
+
+        return spec
+      })
+      const nodes = tree.inventory.filter(node => this.isNode(specs, node))
+
+      await arb.rebuild({ nodes })
+    } else {
+      await arb.rebuild()
+    }
+
+    output.standard('rebuilt dependencies successfully')
+  }
+
+  isNode (specs, node) {
+    return specs.some(spec => {
+      if (spec.type === 'directory') {
+        return node.path === spec.fetchSpec
+      }
+
+      if (spec.name !== node.name) {
+        return false
+      }
+
+      if (spec.rawSpec === '' || spec.rawSpec === '*') {
+        return true
+      }
+
+      const { version } = node.package
+      // TODO: add tests for a package with missing version
+      return semver.satisfies(version, spec.fetchSpec)
+    })
+  }
+}
+
+module.exports = Rebuild

package/oidc/node_modules/npm/lib/commands/repo.js

@@ -0,0 +1,55 @@
+const { URL } = require('node:url')
+const PackageUrlCmd = require('../package-url-cmd.js')
+
+class Repo extends PackageUrlCmd {
+  static description = 'Open package repository page in the browser'
+  static name = 'repo'
+
+  getUrl (spec, mani) {
+    const r = mani.repository
+    const rurl = !r ? null
+      : typeof r === 'string' ? r
+      : typeof r === 'object' && typeof r.url === 'string' ? r.url
+      : null
+
+    if (!rurl) {
+      throw Object.assign(new Error('no repository'), {
+        pkgid: spec,
+      })
+    }
+
+    const info = this.hostedFromMani(mani)
+    const url = info ?
+      info.browse(mani.repository.directory) : unknownHostedUrl(rurl)
+
+    if (!url) {
+      throw Object.assign(new Error('no repository: could not get url'), {
+        pkgid: spec,
+      })
+    }
+    return url
+  }
+}
+
+module.exports = Repo
+
+const unknownHostedUrl = url => {
+  try {
+    const {
+      protocol,
+      hostname,
+      pathname,
+    } = new URL(url)
+
+    /* istanbul ignore next - URL ctor should prevent this */
+    if (!protocol || !hostname) {
+      return null
+    }
+
+    const proto = /(git\+)http:$/.test(protocol) ? 'http:' : 'https:'
+    const path = pathname.replace(/\.git$/, '')
+    return `${proto}//${hostname}${path}`
+  } catch {
+    return null
+  }
+}

package/oidc/node_modules/npm/lib/commands/restart.js

@@ -0,0 +1,13 @@
+const LifecycleCmd = require('../lifecycle-cmd.js')
+
+// This ends up calling run(['restart', ...args])
+class Restart extends LifecycleCmd {
+  static description = 'Restart a package'
+  static name = 'restart'
+  static params = [
+    'ignore-scripts',
+    'script-shell',
+  ]
+}
+
+module.exports = Restart

package/oidc/node_modules/npm/lib/commands/root.js

@@ -0,0 +1,14 @@
+const { output } = require('proc-log')
+const BaseCommand = require('../base-cmd.js')
+
+class Root extends BaseCommand {
+  static description = 'Display npm root'
+  static name = 'root'
+  static params = ['global']
+
+  async exec () {
+    output.standard(this.npm.dir)
+  }
+}
+
+module.exports = Root