@npmcli/arborist 2.2.7 → 2.4.0

package/bin/lib/logging.js

@@ -20,13 +20,21 @@ const levelMap = new Map(levels.reduce((set, level, index) => {
 }, []))
 
 const { inspect, format } = require('util')
+const colors = process.stderr.isTTY
+const magenta = colors ? msg => `\x1B[35m${msg}\x1B[39m` : m => m
 if (loglevel !== 'silent') {
   process.on('log', (level, ...args) => {
     if (levelMap.get(level) < levelMap.get(loglevel))
       return
-    const pref = `${process.pid} ${level} `
+    const pref = `${process.pid} ${magenta(level)} `
     if (level === 'warn' && args[0] === 'ERESOLVE')
-      args[2] = inspect(args[2], { depth: 10 })
+      args[2] = inspect(args[2], { depth: 10, colors })
+    else {
+      args = args.map(a => {
+        return typeof a === 'string' ? a
+          : inspect(a, { depth: 10, colors })
+      })
+    }
     const msg = pref + format(...args).trim().split('\n').join(`\n${pref}`)
     console.error(msg)
   })

package/bin/lib/options.js

@@ -33,7 +33,13 @@ for (const arg of process.argv.slice(2)) {
     options.omit.push(arg.substr('--omit='.length))
   } else if (/^--before=/.test(arg))
     options.before = new Date(arg.substr('--before='.length))
-  else if (/^--[^=]+=/.test(arg)) {
+  else if (/^-w.+/.test(arg)) {
+    options.workspaces = options.workspaces || []
+    options.workspaces.push(arg.replace(/^-w/, ''))
+  } else if (/^--workspace=/.test(arg)) {
+    options.workspaces = options.workspaces || []
+    options.workspaces.push(arg.replace(/^--workspace=/, ''))
+  } else if (/^--[^=]+=/.test(arg)) {
     const [key, ...v] = arg.replace(/^--/, '').split('=')
     const val = v.join('=')
     options[key] = val === 'false' ? false : val === 'true' ? true : val

package/bin/lib/timers.js

@@ -1,4 +1,5 @@
 const timers = Object.create(null)
+const { format } = require('util')
 
 process.on('time', name => {
   if (timers[name])
@@ -6,17 +7,20 @@ process.on('time', name => {
   timers[name] = process.hrtime()
 })
 
+const dim = process.stderr.isTTY ? msg => `\x1B[2m${msg}\x1B[22m` : m => m
+const red = process.stderr.isTTY ? msg => `\x1B[31m${msg}\x1B[39m` : m => m
 process.on('timeEnd', name => {
   if (!timers[name])
     throw new Error('timer not started! ' + name)
   const res = process.hrtime(timers[name])
   delete timers[name]
-  console.error(`${process.pid} ${name}`, res[0] * 1e3 + res[1] / 1e6)
+  const msg = format(`${process.pid} ${name}`, res[0] * 1e3 + res[1] / 1e6)
+  console.error(dim(msg))
 })
 
 process.on('exit', () => {
   for (const name of Object.keys(timers)) {
-    console.error('Dangling timer: ', name)
+    console.error(red('Dangling timer:'), name)
     process.exitCode = 1
   }
 })

package/bin/virtual.js

@@ -8,7 +8,8 @@ require('./lib/timers.js')
 const start = process.hrtime()
 new Arborist(options).loadVirtual().then(tree => {
   const end = process.hrtime(start)
-  print(tree)
+  if (!options.quiet)
+    print(tree)
   if (options.save)
     tree.meta.save()
   console.error(`read ${tree.inventory.size} deps in ${end[0] * 1000 + end[1] / 1e6}ms`)

package/lib/add-rm-pkg-deps.js

@@ -71,7 +71,7 @@ const addSingle = ({pkg, spec, saveBundle, saveType}) => {
       pkg.devDependencies[name] = pkg.peerDependencies[name]
   }
 
-  if (saveBundle) {
+  if (saveBundle && saveType !== 'peer' && saveType !== 'peerOptional') {
     // keep it sorted, keep it unique
     const bd = new Set(pkg.bundleDependencies || [])
     bd.add(spec.name)

package/lib/arborist/build-ideal-tree.js

@@ -44,12 +44,14 @@ const _currentDep = Symbol('currentDep')
 const _updateAll = Symbol('updateAll')
 const _mutateTree = Symbol('mutateTree')
 const _flagsSuspect = Symbol.for('flagsSuspect')
+const _workspaces = Symbol.for('workspaces')
 const _prune = Symbol('prune')
 const _preferDedupe = Symbol('preferDedupe')
 const _legacyBundling = Symbol('legacyBundling')
 const _parseSettings = Symbol('parseSettings')
 const _initTree = Symbol('initTree')
 const _applyUserRequests = Symbol('applyUserRequests')
+const _applyUserRequestsToNode = Symbol('applyUserRequestsToNode')
 const _inflateAncientLockfile = Symbol('inflateAncientLockfile')
 const _buildDeps = Symbol('buildDeps')
 const _buildDepStep = Symbol('buildDepStep')
@@ -109,7 +111,7 @@ const _peerSetSource = Symbol.for('peerSetSource')
 
 // used by Reify mixin
 const _force = Symbol.for('force')
-const _explicitRequests = Symbol.for('explicitRequests')
+const _explicitRequests = Symbol('explicitRequests')
 const _global = Symbol.for('global')
 const _idealTreePrune = Symbol.for('idealTreePrune')
 
@@ -130,8 +132,10 @@ module.exports = cls => class IdealTreeBuilder extends cls {
       force = false,
       packageLock = true,
       strictPeerDeps = false,
+      workspaces = [],
     } = options
 
+    this[_workspaces] = workspaces || []
     this[_force] = !!force
     this[_strictPeerDeps] = !!strictPeerDeps
 
@@ -143,6 +147,9 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     this[_globalStyle] = this[_global] || globalStyle
     this[_follow] = !!follow
 
+    if (this[_workspaces].length && this[_global])
+      throw new Error('Cannot operate on workspaces in global mode')
+
     this[_explicitRequests] = new Set()
     this[_preferDedupe] = false
     this[_legacyBundling] = false
@@ -157,6 +164,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     this[_manifests] = new Map()
     this[_peerConflict] = null
     this[_edgesOverridden] = new Set()
+    this[_resolvedAdd] = []
 
     // a map of each module in a peer set to the thing that depended on
     // that set of peers in the first place.  Use a WeakMap so that we
@@ -204,8 +212,8 @@ module.exports = cls => class IdealTreeBuilder extends cls {
 
     try {
       await this[_initTree]()
-      await this[_applyUserRequests](options)
       await this[_inflateAncientLockfile]()
+      await this[_applyUserRequests](options)
       await this[_buildDeps]()
       await this[_fixDepFlags]()
       await this[_pruneFailedOptional]()
@@ -266,6 +274,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     this[_preferDedupe] = !!options.preferDedupe
     this[_legacyBundling] = !!options.legacyBundling
     this[_updateNames] = update.names
+
     this[_updateAll] = update.all
     // we prune by default unless explicitly set to boolean false
     this[_prune] = options.prune !== false
@@ -387,6 +396,42 @@ module.exports = cls => class IdealTreeBuilder extends cls {
   async [_applyUserRequests] (options) {
     process.emit('time', 'idealTree:userRequests')
     const tree = this.idealTree.target || this.idealTree
+
+    if (!this[_workspaces].length) {
+      return this[_applyUserRequestsToNode](tree, options).then(() =>
+        process.emit('timeEnd', 'idealTree:userRequests'))
+    }
+
+    const wsMap = tree.workspaces
+    if (!wsMap) {
+      this.log.warn('idealTree', 'Workspace filter set, but no workspaces present')
+      return
+    }
+
+    const promises = []
+    for (const name of this[_workspaces]) {
+      const path = wsMap.get(name)
+      if (!path) {
+        this.log.warn('idealTree', `Workspace ${name} in filter set, but not in workspaces`)
+        continue
+      }
+      const loc = relpath(tree.realpath, path)
+      const node = tree.inventory.get(loc)
+
+      /* istanbul ignore if - should be impossible */
+      if (!node) {
+        this.log.warn('idealTree', `Workspace ${name} in filter set, but no workspace folder present`)
+        continue
+      }
+
+      promises.push(this[_applyUserRequestsToNode](node, options))
+    }
+
+    return Promise.all(promises).then(() =>
+      process.emit('timeEnd', 'idealTree:userRequests'))
+  }
+
+  async [_applyUserRequestsToNode] (tree, options) {
     // If we have a list of package names to update, and we know it's
     // going to update them wherever they are, add any paths into those
     // named nodes to the buildIdealTree queue.
@@ -395,38 +440,49 @@ module.exports = cls => class IdealTreeBuilder extends cls {
 
     // global updates only update the globalTop nodes, but we need to know
     // that they're there, and not reinstall the world unnecessarily.
+    const globalExplicitUpdateNames = []
     if (this[_global] && (this[_updateAll] || this[_updateNames].length)) {
       const nm = resolve(this.path, 'node_modules')
       for (const name of await readdir(nm).catch(() => [])) {
-        if (this[_updateNames].includes(name))
-          this[_explicitRequests].add(name)
         tree.package.dependencies = tree.package.dependencies || {}
-        if (this[_updateAll] || this[_updateNames].includes(name))
+        const updateName = this[_updateNames].includes(name)
+        if (this[_updateAll] || updateName) {
+          if (updateName)
+            globalExplicitUpdateNames.push(name)
           tree.package.dependencies[name] = '*'
+        }
       }
     }
 
     if (this.auditReport && this.auditReport.size > 0)
       this[_queueVulnDependents](options)
 
-    if (options.rm && options.rm.length) {
-      addRmPkgDeps.rm(tree.package, options.rm)
-      for (const name of options.rm)
-        this[_explicitRequests].add(name)
+    const { add, rm } = options
+
+    if (rm && rm.length) {
+      addRmPkgDeps.rm(tree.package, rm)
+      for (const name of rm)
+        this[_explicitRequests].add({ from: tree, name, action: 'DELETE' })
     }
 
-    if (options.add)
-      await this[_add](options)
+    if (add && add.length)
+      await this[_add](tree, options)
 
-    // triggers a refresh of all edgesOut
-    if (options.add && options.add.length || options.rm && options.rm.length || this[_global])
+    // triggers a refresh of all edgesOut.  this has to be done BEFORE
+    // adding the edges to explicitRequests, because the package setter
+    // resets all edgesOut.
+    if (add && add.length || rm && rm.length || this[_global])
       tree.package = tree.package
-    process.emit('timeEnd', 'idealTree:userRequests')
+
+    for (const spec of this[_resolvedAdd])
+      this[_explicitRequests].add(tree.edgesOut.get(spec.name))
+    for (const name of globalExplicitUpdateNames)
+      this[_explicitRequests].add(tree.edgesOut.get(name))
   }
 
   // This returns a promise because we might not have the name yet,
   // and need to call pacote.manifest to find the name.
-  [_add] ({add, saveType = null, saveBundle = false}) {
+  [_add] (tree, {add, saveType = null, saveBundle = false}) {
     // get the name for each of the specs in the list.
     // ie, doing `foo@bar` we just return foo
     // but if it's a url or git, we don't know the name until we
@@ -438,10 +494,9 @@ module.exports = cls => class IdealTreeBuilder extends cls {
         .then(add => this[_updateFilePath](add))
         .then(add => this[_followSymlinkPath](add))
     })).then(add => {
-      this[_resolvedAdd] = add
+      this[_resolvedAdd].push(...add)
       // now add is a list of spec objects with names.
       // find a home for each of them!
-      const tree = this.idealTree.target || this.idealTree
       addRmPkgDeps.add({
         pkg: tree.package,
         add,
@@ -449,8 +504,6 @@ module.exports = cls => class IdealTreeBuilder extends cls {
         saveType,
         path: this.path,
       })
-      for (const spec of add)
-        this[_explicitRequests].add(spec.name)
     })
   }
 
@@ -883,6 +936,8 @@ This is a one-time fix-up, please be patient...
     // create a virtual root node with the same deps as the node that
     // is requesting this one, so that we can get all the peer deps in
     // a context where they're likely to be resolvable.
+    // Note that the virtual root will also have virtual copies of the
+    // targets of any child Links, so that they resolve appropriately.
     const parent = parent_ || this[_virtualRoot](edge.from)
     const realParent = edge.peer ? edge.from.resolveParent : edge.from
 
@@ -936,11 +991,23 @@ This is a one-time fix-up, please be patient...
       return this[_virtualRoots].get(node)
 
     const vr = new Node({
-      path: '/virtual-root',
+      path: node.realpath,
       sourceReference: node,
       legacyPeerDeps: this.legacyPeerDeps,
     })
 
+    // also need to set up any targets from any link deps, so that
+    // they are properly reflected in the virtual environment
+    for (const child of node.children.values()) {
+      if (child.isLink) {
+        new Node({
+          path: child.realpath,
+          sourceReference: child.target,
+          root: vr,
+        })
+      }
+    }
+
     this[_virtualRoots].set(node, vr)
     return vr
   }
@@ -977,7 +1044,7 @@ This is a one-time fix-up, please be patient...
         // if it's peerOptional and not explicitly requested.
         if (!edge.to) {
           return edge.type !== 'peerOptional' ||
-            this[_explicitRequests].has(edge.name)
+            this[_explicitRequests].has(edge)
         }
 
         // If the edge has an error, there's a problem.
@@ -993,7 +1060,7 @@ This is a one-time fix-up, please be patient...
           return true
 
         // If the user has explicitly asked to install this package, it's a problem.
-        if (node.isProjectRoot && this[_explicitRequests].has(edge.name))
+        if (node.isProjectRoot && this[_explicitRequests].has(edge))
           return true
 
         // No problems!
@@ -1117,10 +1184,20 @@ This is a one-time fix-up, please be patient...
             continue
 
           // problem
-          this[_failPeerConflict](edge)
+          this[_failPeerConflict](edge, parentEdge)
         }
       }
 
+      // There is something present already, and we're not happy about it
+      // See if the thing we WOULD be happy with is also going to satisfy
+      // the other dependents on the current node.
+      const current = edge.to
+      const dep = await this[_nodeFromEdge](edge, null, null, required)
+      if (dep.canReplace(current)) {
+        await this[_nodeFromEdge](edge, node.parent, null, required)
+        continue
+      }
+
       // at this point we know that there is a dep there, and
       // we don't like it.  always fail strictly, always allow forcibly or
       // in non-strict mode if it's not our fault.  don't warn here, because
@@ -1133,17 +1210,17 @@ This is a one-time fix-up, please be patient...
         continue
 
       // ok, it's the root, or we're in unforced strict mode, so this is bad
-      this[_failPeerConflict](edge)
+      this[_failPeerConflict](edge, parentEdge)
     }
     return node
   }
 
-  [_failPeerConflict] (edge) {
-    const expl = this[_explainPeerConflict](edge)
+  [_failPeerConflict] (edge, currentEdge) {
+    const expl = this[_explainPeerConflict](edge, currentEdge)
     throw Object.assign(new Error('unable to resolve dependency tree'), expl)
   }
 
-  [_explainPeerConflict] (edge) {
+  [_explainPeerConflict] (edge, currentEdge) {
     const node = edge.from
     const curNode = node.resolve(edge.name)
     const pc = this[_peerConflict] || { peer: null, current: null }
@@ -1152,6 +1229,10 @@ This is a one-time fix-up, please be patient...
     return {
       code: 'ERESOLVE',
       current,
+      // it SHOULD be impossible to get here without a current node in place,
+      // but this at least gives us something report on when bugs creep into
+      // the tree handling logic.
+      currentEdge: currentEdge ? currentEdge.explain() : null,
       edge: edge.explain(),
       peerConflict,
       strictPeerDeps: this[_strictPeerDeps],
@@ -1176,7 +1257,7 @@ This is a one-time fix-up, please be patient...
   [_placeDep] (dep, node, edge, peerEntryEdge = null, peerPath = []) {
     if (edge.to &&
         !edge.error &&
-        !this[_explicitRequests].has(edge.name) &&
+        !this[_explicitRequests].has(edge) &&
         !this[_updateNames].includes(edge.name) &&
         !this[_isVulnerable](edge.to))
       return []
@@ -1466,9 +1547,15 @@ This is a one-time fix-up, please be patient...
     if (target.children.has(edge.name)) {
       const current = target.children.get(edge.name)
 
-      // same thing = keep
-      if (dep.matches(current))
-        return KEEP
+      // same thing = keep, UNLESS the current doesn't satisfy and new
+      // one does satisfy.  This can happen if it's a link to a matching target
+      // at a different location, which satisfies a version dep, but not a
+      // file: dep.  If neither of them satisfy, then we can replace it,
+      // because presumably it's better for a peer or something.
+      if (dep.matches(current)) {
+        if (current.satisfies(edge) || !dep.satisfies(edge))
+          return KEEP
+      }
 
       const { version: curVer } = current
       const { version: newVer } = dep

package/lib/arborist/index.js

@@ -54,7 +54,7 @@ class Arborist extends Base {
       ...options,
       path: options.path || '.',
       cache: options.cache || `${homedir()}/.npm/_cacache`,
-      packumentCache: new Map(),
+      packumentCache: options.packumentCache || new Map(),
       log: options.log || procLog,
     }
     this.cache = resolve(this.options.cache)

package/lib/arborist/load-actual.js

@@ -32,6 +32,7 @@ const _loadActual = Symbol('loadActual')
 const _loadActualVirtually = Symbol('loadActualVirtually')
 const _loadActualActually = Symbol('loadActualActually')
 const _loadWorkspaces = Symbol.for('loadWorkspaces')
+const _loadWorkspaceTargets = Symbol('loadWorkspaceTargets')
 const _actualTreePromise = Symbol('actualTreePromise')
 const _actualTree = Symbol('actualTree')
 const _transplant = Symbol('transplant')
@@ -150,18 +151,22 @@ module.exports = cls => class ActualLoader extends cls {
     await new this.constructor({...this.options}).loadVirtual({
       root: this[_actualTree],
     })
+    await this[_loadWorkspaces](this[_actualTree])
+    if (this[_actualTree].workspaces && this[_actualTree].workspaces.size)
+      calcDepFlags(this[_actualTree], !root)
     this[_transplant](root)
     return this[_actualTree]
   }
 
   async [_loadActualActually] ({ root, ignoreMissing, global }) {
     await this[_loadFSTree](this[_actualTree])
+    await this[_loadWorkspaces](this[_actualTree])
+    await this[_loadWorkspaceTargets](this[_actualTree])
     if (!ignoreMissing)
       await this[_findMissingEdges]()
     this[_findFSParents]()
     this[_transplant](root)
 
-    await this[_loadWorkspaces](this[_actualTree])
     if (global) {
       // need to depend on the children, or else all of them
       // will end up being flagged as extraneous, since the
@@ -178,16 +183,37 @@ module.exports = cls => class ActualLoader extends cls {
     return this[_actualTree]
   }
 
+  // if there are workspace targets without Link nodes created, load
+  // the targets, so that we know what they are.
+  async [_loadWorkspaceTargets] (tree) {
+    if (!tree.workspaces || !tree.workspaces.size)
+      return
+
+    const promises = []
+    for (const path of tree.workspaces.values()) {
+      if (!this[_cache].has(path)) {
+        const p = this[_loadFSNode]({ path, root: this[_actualTree] })
+          .then(node => this[_loadFSTree](node))
+        promises.push(p)
+      }
+    }
+    await Promise.all(promises)
+  }
+
   [_transplant] (root) {
     if (!root || root === this[_actualTree])
       return
+
     this[_actualTree][_changePath](root.path)
     for (const node of this[_actualTree].children.values()) {
       if (!this[_transplantFilter](node))
-        node.parent = null
+        node.root = null
     }
 
     root.replace(this[_actualTree])
+    for (const node of this[_actualTree].fsChildren)
+      node.root = this[_transplantFilter](node) ? root : null
+
     this[_actualTree] = root
   }
 

package/lib/arborist/load-virtual.js

@@ -93,7 +93,8 @@ module.exports = cls => class VirtualLoader extends cls {
     this.virtualTree = root
     const {links, nodes} = this[resolveNodes](s, root)
     await this[resolveLinks](links, nodes)
-    this[assignBundles](nodes)
+    if (!(s.originalLockfileVersion >= 2))
+      this[assignBundles](nodes)
     if (this[flagsSuspect])
       this[reCalcDepFlags](nodes.values())
     return root
@@ -220,22 +221,24 @@ module.exports = cls => class VirtualLoader extends cls {
   [assignBundles] (nodes) {
     for (const [location, node] of nodes) {
       // Skip assignment of parentage for the root package
-      if (!location)
+      if (!location || node.target && !node.target.location)
         continue
       const { name, parent, package: { inBundle }} = node
+
       if (!parent)
         continue
 
       // read inBundle from package because 'package' here is
       // actually a v2 lockfile metadata entry.
-      // If the *parent* is also bundled, though, then we assume
-      // that it's being pulled in just by virtue of that.
+      // If the *parent* is also bundled, though, or if the parent has
+      // no dependency on it, then we assume that it's being pulled in
+      // just by virtue of its parent or a transitive dep being bundled.
       const { package: ppkg } = parent
       const { inBundle: parentBundled } = ppkg
-      if (inBundle && !parentBundled) {
+      if (inBundle && !parentBundled && parent.edgesOut.has(node.name)) {
         if (!ppkg.bundleDependencies)
           ppkg.bundleDependencies = [name]
-        else if (!ppkg.bundleDependencies.includes(name))
+        else
           ppkg.bundleDependencies.push(name)
       }
     }

package/lib/arborist/rebuild.js

@@ -115,10 +115,6 @@ module.exports = cls => class Builder extends cls {
       await this[_runScripts]('preinstall')
     if (this[_binLinks] && type !== 'links')
       await this[_linkAllBins]()
-    if (!this[_ignoreScripts]) {
-      await this[_runScripts]('install')
-      await this[_runScripts]('postinstall')
-    }
 
     // links should also run prepare scripts and only link bins after that
     if (type === 'links') {
@@ -128,6 +124,11 @@ module.exports = cls => class Builder extends cls {
         await this[_linkAllBins]()
     }
 
+    if (!this[_ignoreScripts]) {
+      await this[_runScripts]('install')
+      await this[_runScripts]('postinstall')
+    }
+
     process.emit('timeEnd', `build:${type}`)
   }