@npmcli/arborist 2.2.5 → 2.2.9

package/lib/add-rm-pkg-deps.js

@@ -71,7 +71,7 @@ const addSingle = ({pkg, spec, saveBundle, saveType}) => {
       pkg.devDependencies[name] = pkg.peerDependencies[name]
   }
 
-  if (saveBundle) {
+  if (saveBundle && saveType !== 'peer' && saveType !== 'peerOptional') {
     // keep it sorted, keep it unique
     const bd = new Set(pkg.bundleDependencies || [])
     bd.add(spec.name)

package/lib/arborist/build-ideal-tree.js

@@ -431,11 +431,13 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     // ie, doing `foo@bar` we just return foo
     // but if it's a url or git, we don't know the name until we
     // fetch it and look in its manifest.
-    return Promise.all(add.map(rawSpec =>
-      this[_retrieveSpecName](npa(rawSpec))
+    return Promise.all(add.map(rawSpec => {
+      // We do NOT provide the path here, because user-additions need
+      // to be resolved relative to the CWD the user is in.
+      return this[_retrieveSpecName](npa(rawSpec))
         .then(add => this[_updateFilePath](add))
         .then(add => this[_followSymlinkPath](add))
-    )).then(add => {
+    })).then(add => {
       this[_resolvedAdd] = add
       // now add is a list of spec objects with names.
       // find a home for each of them!
@@ -881,6 +883,8 @@ This is a one-time fix-up, please be patient...
     // create a virtual root node with the same deps as the node that
     // is requesting this one, so that we can get all the peer deps in
     // a context where they're likely to be resolvable.
+    // Note that the virtual root will also have virtual copies of the
+    // targets of any child Links, so that they resolve appropriately.
     const parent = parent_ || this[_virtualRoot](edge.from)
     const realParent = edge.peer ? edge.from.resolveParent : edge.from
 
@@ -934,11 +938,23 @@ This is a one-time fix-up, please be patient...
       return this[_virtualRoots].get(node)
 
     const vr = new Node({
-      path: '/virtual-root',
+      path: node.realpath,
       sourceReference: node,
       legacyPeerDeps: this.legacyPeerDeps,
     })
 
+    // also need to set up any targets from any link deps, so that
+    // they are properly reflected in the virtual environment
+    for (const child of node.children.values()) {
+      if (child.isLink) {
+        new Node({
+          path: child.realpath,
+          sourceReference: child.target,
+          root: vr,
+        })
+      }
+    }
+
     this[_virtualRoots].set(node, vr)
     return vr
   }

package/lib/arborist/reify.js

@@ -6,6 +6,7 @@ const rpj = require('read-package-json-fast')
 const { updateDepSpec } = require('../dep-spec.js')
 const AuditReport = require('../audit-report.js')
 const {subset} = require('semver')
+const npa = require('npm-package-arg')
 
 const {dirname, resolve, relative} = require('path')
 const {depth: dfwalk} = require('treeverse')
@@ -881,11 +882,17 @@ module.exports = cls => class Reifier extends cls {
 
     process.emit('time', 'reify:save')
 
+    // resolvedAdd is the list of user add requests, but with names added
+    // to things like git repos and tarball file/urls.  However, if the
+    // user requested 'foo@', and we have a foo@file:../foo, then we should
+    // end up saving the spec we actually used, not whatever they gave us.
     if (this[_resolvedAdd]) {
       const root = this.idealTree
       const pkg = root.package
-      for (const req of this[_resolvedAdd]) {
-        const {name, rawSpec, subSpec} = req
+      for (const { name } of this[_resolvedAdd]) {
+        const req = npa.resolve(name, root.edgesOut.get(name).spec, root.realpath)
+        const {rawSpec, subSpec} = req
+
         const spec = subSpec ? subSpec.rawSpec : rawSpec
         const child = root.children.get(name)
 
@@ -910,6 +917,15 @@ module.exports = cls => class Reifier extends cls {
           const save = h.https && h.auth ? `git+${h.https(opt)}`
             : h.shortcut(opt)
           updateDepSpec(pkg, name, save)
+        } else if (req.type === 'directory' || req.type === 'file') {
+          // save the relative path in package.json
+          // Normally saveSpec is updated with the proper relative
+          // path already, but it's possible to specify a full absolute
+          // path initially, in which case we can end up with the wrong
+          // thing, so just get the ultimate fetchSpec and relativize it.
+          const p = req.fetchSpec.replace(/^file:/, '')
+          const rel = relpath(root.realpath, p)
+          updateDepSpec(pkg, name, `file:${rel}`)
         } else
           updateDepSpec(pkg, name, req.saveSpec)
       }

package/lib/edge.js

@@ -87,16 +87,24 @@ class Edge {
 
   // return the edge data, and an explanation of how that edge came to be here
   [_explain] (seen) {
-    const { error, from } = this
+    const { error, from, bundled } = this
     return {
       type: this.type,
       name: this.name,
       spec: this.spec,
+      ...(bundled ? { bundled } : {}),
       ...(error ? { error } : {}),
       ...(from ? { from: from.explain(null, seen) } : {}),
     }
   }
 
+  get bundled () {
+    if (!this.from)
+      return false
+    const { package: { bundleDependencies = [] } } = this.from
+    return bundleDependencies.includes(this.name)
+  }
+
   get workspace () {
     return this[_type] === 'workspace'
   }

package/lib/printable.js

@@ -63,6 +63,13 @@ class ArboristNode {
   }
 }
 
+class ArboristVirtualNode extends ArboristNode {
+  constructor (tree, path) {
+    super(tree, path)
+    this.sourceReference = printableTree(tree.sourceReference, path)
+  }
+}
+
 class ArboristLink extends ArboristNode {
   constructor (tree, path) {
     super(tree, path)
@@ -119,10 +126,14 @@ class EdgeIn extends Edge {
 }
 
 const printableTree = (tree, path = []) => {
-  if (path.includes(tree))
-    return { location: tree.location }
+  const Cls = tree.isLink ? ArboristLink
+    : tree.sourceReference ? ArboristVirtualNode
+    : ArboristNode
+  if (path.includes(tree)) {
+    const obj = Object.create(Cls.prototype)
+    return Object.assign(obj, { location: tree.location })
+  }
   path.push(tree)
-  const Cls = tree.isLink ? ArboristLink : ArboristNode
   return new Cls(tree, path)
 }
 

package/lib/shrinkwrap.js

@@ -41,6 +41,7 @@ const readFile = promisify(fs.readFile)
 const writeFile = promisify(fs.writeFile)
 const stat = promisify(fs.stat)
 const readdir_ = promisify(fs.readdir)
+const readlink = promisify(fs.readlink)
 
 // XXX remove when drop support for node v10
 const lstat = promisify(fs.lstat)
@@ -176,10 +177,19 @@ const assertNoNewer = async (path, data, lockTime, dir = path, seen = null) => {
     : readdir(parent, { withFileTypes: true })
 
   return children.catch(() => [])
-    .then(ents => Promise.all(
-      ents.filter(ent => ent.isDirectory() && !/^\./.test(ent.name))
-        .map(ent => assertNoNewer(path, data, lockTime, resolve(parent, ent.name), seen))
-    )).then(() => {
+    .then(ents => Promise.all(ents.map(async ent => {
+      const child = resolve(parent, ent.name)
+      if (ent.isDirectory() && !/^\./.test(ent.name))
+        await assertNoNewer(path, data, lockTime, child, seen)
+      else if (ent.isSymbolicLink()) {
+        const target = resolve(parent, await readlink(child))
+        const tstat = await stat(target).catch(() => null)
+        seen.add(relpath(path, child))
+        if (tstat && tstat.isDirectory() && !seen.has(relpath(path, target)))
+          await assertNoNewer(path, data, lockTime, target, seen)
+      }
+    })))
+    .then(() => {
       if (dir !== path)
         return
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "2.2.5",
+  "version": "2.2.9",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@npmcli/installed-package-contents": "^1.0.7",
@@ -26,7 +26,7 @@
     "promise-call-limit": "^1.0.1",
     "read-package-json-fast": "^2.0.2",
     "readdir-scoped-modules": "^1.1.0",
-    "semver": "^7.3.4",
+    "semver": "^7.3.5",
     "tar": "^6.1.0",
     "treeverse": "^1.0.4",
     "walk-up-path": "^1.0.0"