@npmcli/arborist 5.0.6 → 5.2.0

package/lib/arborist/build-ideal-tree.js

@@ -124,6 +124,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
       globalStyle = false,
       idealTree = null,
       includeWorkspaceRoot = false,
+      installLinks = false,
       legacyPeerDeps = false,
       packageLock = true,
       strictPeerDeps = false,
@@ -135,6 +136,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     this[_strictPeerDeps] = !!strictPeerDeps
 
     this.idealTree = idealTree
+    this.installLinks = installLinks
     this.legacyPeerDeps = legacyPeerDeps
 
     this[_usePackageLock] = packageLock
@@ -327,6 +329,7 @@ Try using the package name instead, e.g:
         ? Shrinkwrap.reset({
           path: this.path,
           lockfileVersion: this.options.lockfileVersion,
+          resolveOptions: this.options,
         }).then(meta => Object.assign(root, { meta }))
         : this.loadVirtual({ root }))
 
@@ -386,6 +389,7 @@ Try using the package name instead, e.g:
     const meta = new Shrinkwrap({
       path: this.path,
       lockfileVersion: this.options.lockfileVersion,
+      resolveOptions: this.options,
     })
     meta.reset()
     root.meta = meta
@@ -410,6 +414,7 @@ Try using the package name instead, e.g:
       peer: false,
       optional: false,
       global: this[_global],
+      installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       loadOverrides: true,
     })
@@ -424,6 +429,7 @@ Try using the package name instead, e.g:
         peer: false,
         optional: false,
         global: this[_global],
+        installLinks: this.installLinks,
         legacyPeerDeps: this.legacyPeerDeps,
         root,
       })
@@ -992,6 +998,7 @@ This is a one-time fix-up, please be patient...
         preferDedupe: this[_preferDedupe],
         legacyBundling: this[_legacyBundling],
         strictPeerDeps: this[_strictPeerDeps],
+        installLinks: this.installLinks,
         legacyPeerDeps: this.legacyPeerDeps,
         globalStyle: this[_globalStyle],
       }))
@@ -1151,6 +1158,7 @@ This is a one-time fix-up, please be patient...
     const vr = new Node({
       path: node.realpath,
       sourceReference: node,
+      installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       overrides: node.overrides,
     })
@@ -1268,17 +1276,18 @@ This is a one-time fix-up, please be patient...
     // the object so it doesn't get mutated.
     // Don't bother to load the manifest for link deps, because the target
     // might be within another package that doesn't exist yet.
-    const { legacyPeerDeps } = this
+    const { installLinks, legacyPeerDeps } = this
+    const isWorkspace = this.idealTree.workspaces && this.idealTree.workspaces.has(spec.name)
 
-    // spec is a directory, link it
-    if (spec.type === 'directory') {
+    // spec is a directory, link it unless installLinks is set or it's a workspace
+    if (spec.type === 'directory' && (isWorkspace || !installLinks)) {
       return this[_linkFromSpec](name, spec, parent, edge)
     }
 
     // if the spec matches a workspace name, then see if the workspace node will
     // satisfy the edge. if it does, we return the workspace node to make sure it
     // takes priority.
-    if (this.idealTree.workspaces && this.idealTree.workspaces.has(spec.name)) {
+    if (isWorkspace) {
       const existingNode = this.idealTree.edgesOut.get(spec.name).to
       if (existingNode && existingNode.isWorkspace && existingNode.satisfies(edge)) {
         return edge.to
@@ -1288,7 +1297,7 @@ This is a one-time fix-up, please be patient...
     // spec isn't a directory, and either isn't a workspace or the workspace we have
     // doesn't satisfy the edge. try to fetch a manifest and build a node from that.
     return this[_fetchManifest](spec)
-      .then(pkg => new Node({ name, pkg, parent, legacyPeerDeps }), error => {
+      .then(pkg => new Node({ name, pkg, parent, installLinks, legacyPeerDeps }), error => {
         error.requiredBy = edge.from.location || '.'
 
         // failed to load the spec, either because of enotarget or
@@ -1298,6 +1307,7 @@ This is a one-time fix-up, please be patient...
           name,
           parent,
           error,
+          installLinks,
           legacyPeerDeps,
         })
         this[_loadFailures].add(n)
@@ -1307,9 +1317,9 @@ This is a one-time fix-up, please be patient...
 
   [_linkFromSpec] (name, spec, parent, edge) {
     const realpath = spec.fetchSpec
-    const { legacyPeerDeps } = this
+    const { installLinks, legacyPeerDeps } = this
     return rpj(realpath + '/package.json').catch(() => ({})).then(pkg => {
-      const link = new Link({ name, parent, realpath, pkg, legacyPeerDeps })
+      const link = new Link({ name, parent, realpath, pkg, installLinks, legacyPeerDeps })
       this[_linkNodes].add(link)
       return link
     })

package/lib/arborist/load-actual.js

@@ -147,6 +147,7 @@ module.exports = cls => class ActualLoader extends cls {
     const meta = await Shrinkwrap.load({
       path: this[_actualTree].path,
       hiddenLockfile: true,
+      resolveOptions: this.options,
     })
     if (meta.loadedFromDisk) {
       this[_actualTree].meta = meta
@@ -155,6 +156,7 @@ module.exports = cls => class ActualLoader extends cls {
       const meta = await Shrinkwrap.load({
         path: this[_actualTree].path,
         lockfileVersion: this.options.lockfileVersion,
+        resolveOptions: this.options,
       })
       this[_actualTree].meta = meta
       return this[_loadActualActually]({ root, ignoreMissing })
@@ -283,6 +285,7 @@ module.exports = cls => class ActualLoader extends cls {
       .then(pkg => [pkg, null], error => [null, error])
       .then(([pkg, error]) => {
         return this[normalize(path) === real ? _newNode : _newLink]({
+          installLinks: this.installLinks,
           legacyPeerDeps: this.legacyPeerDeps,
           path,
           realpath: real,

package/lib/arborist/load-virtual.js

@@ -57,6 +57,7 @@ module.exports = cls => class VirtualLoader extends cls {
     const s = await Shrinkwrap.load({
       path: this.path,
       lockfileVersion: this.options.lockfileVersion,
+      resolveOptions: this.options,
     })
     if (!s.loadedFromDisk && !options.root) {
       const er = new Error('loadVirtual requires existing shrinkwrap file')
@@ -278,6 +279,7 @@ module.exports = cls => class VirtualLoader extends cls {
     const peer = sw.peer
 
     const node = new Node({
+      installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       root: this.virtualTree,
       path,
@@ -304,6 +306,7 @@ module.exports = cls => class VirtualLoader extends cls {
   [loadLink] (location, targetLoc, target, meta) {
     const path = resolve(this.path, location)
     const link = new Link({
+      installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       path,
       realpath: resolve(this.path, targetLoc),

package/lib/arborist/rebuild.js

@@ -21,6 +21,8 @@ const sortNodes = (a, b) =>
 
 const _workspaces = Symbol.for('workspaces')
 const _build = Symbol('build')
+const _loadDefaultNodes = Symbol('loadDefaultNodes')
+const _retrieveNodesByType = Symbol('retrieveNodesByType')
 const _resetQueues = Symbol('resetQueues')
 const _rebuildBundle = Symbol('rebuildBundle')
 const _ignoreScripts = Symbol('ignoreScripts')
@@ -39,6 +41,7 @@ const _includeWorkspaceRoot = Symbol.for('includeWorkspaceRoot')
 const _workspacesEnabled = Symbol.for('workspacesEnabled')
 
 const _force = Symbol.for('force')
+const _global = Symbol.for('global')
 
 // defined by reify mixin
 const _handleOptionalFailure = Symbol.for('handleOptionalFailure')
@@ -75,36 +78,60 @@ module.exports = cls => class Builder extends cls {
     // running JUST a rebuild, we treat optional failures as real fails
     this[_doHandleOptionalFailure] = handleOptionalFailure
 
-    // if we don't have a set of nodes, then just rebuild
-    // the actual tree on disk.
     if (!nodes) {
-      const tree = await this.loadActual()
-      let filterSet
-      if (!this[_workspacesEnabled]) {
-        filterSet = this.excludeWorkspacesDependencySet(tree)
-        nodes = tree.inventory.filter(node =>
-          filterSet.has(node) || node.isProjectRoot
-        )
-      } else if (this[_workspaces] && this[_workspaces].length) {
-        filterSet = this.workspaceDependencySet(
-          tree,
-          this[_workspaces],
-          this[_includeWorkspaceRoot]
-        )
-        nodes = tree.inventory.filter(node => filterSet.has(node))
-      } else {
-        nodes = tree.inventory.values()
-      }
+      nodes = await this[_loadDefaultNodes]()
     }
 
     // separates links nodes so that it can run
     // prepare scripts and link bins in the expected order
     process.emit('time', 'build')
+
+    const {
+      depNodes,
+      linkNodes,
+    } = this[_retrieveNodesByType](nodes)
+
+    // build regular deps
+    await this[_build](depNodes, {})
+
+    // build link deps
+    if (linkNodes.size) {
+      this[_resetQueues]()
+      await this[_build](linkNodes, { type: 'links' })
+    }
+
+    process.emit('timeEnd', 'build')
+  }
+
+  // if we don't have a set of nodes, then just rebuild
+  // the actual tree on disk.
+  async [_loadDefaultNodes] () {
+    let nodes
+    const tree = await this.loadActual()
+    let filterSet
+    if (!this[_workspacesEnabled]) {
+      filterSet = this.excludeWorkspacesDependencySet(tree)
+      nodes = tree.inventory.filter(node =>
+        filterSet.has(node) || node.isProjectRoot
+      )
+    } else if (this[_workspaces] && this[_workspaces].length) {
+      filterSet = this.workspaceDependencySet(
+        tree,
+        this[_workspaces],
+        this[_includeWorkspaceRoot]
+      )
+      nodes = tree.inventory.filter(node => filterSet.has(node))
+    } else {
+      nodes = tree.inventory.values()
+    }
+    return nodes
+  }
+
+  [_retrieveNodesByType] (nodes) {
     const depNodes = new Set()
     const linkNodes = new Set()
+
     for (const node of nodes) {
-      // we skip the target nodes to that workspace in order to make sure
-      // we only run lifecycle scripts / place bin links once per workspace
       if (node.isLink) {
         linkNodes.add(node)
       } else {
@@ -112,14 +139,22 @@ module.exports = cls => class Builder extends cls {
       }
     }
 
-    await this[_build](depNodes, {})
-
-    if (linkNodes.size) {
-      this[_resetQueues]()
-      await this[_build](linkNodes, { type: 'links' })
+    // deduplicates link nodes and their targets, avoids
+    // calling lifecycle scripts twice when running `npm rebuild`
+    // ref: https://github.com/npm/cli/issues/2905
+    //
+    // we avoid doing so if global=true since `bin-links` relies
+    // on having the target nodes available in global mode.
+    if (!this[_global]) {
+      for (const node of linkNodes) {
+        depNodes.delete(node.target)
+      }
     }
 
-    process.emit('timeEnd', 'build')
+    return {
+      depNodes,
+      linkNodes,
+    }
   }
 
   [_resetQueues] () {
@@ -136,24 +171,22 @@ module.exports = cls => class Builder extends cls {
     process.emit('time', `build:${type}`)
 
     await this[_buildQueues](nodes)
+
+    if (!this[_ignoreScripts]) {
+      await this[_runScripts]('preinstall')
+    }
+
     // links should run prepare scripts and only link bins after that
-    if (type !== 'links') {
-      if (!this[_ignoreScripts]) {
-        await this[_runScripts]('preinstall')
-      }
-      if (this[_binLinks]) {
-        await this[_linkAllBins]()
-      }
-      if (!this[_ignoreScripts]) {
-        await this[_runScripts]('install')
-        await this[_runScripts]('postinstall')
-      }
-    } else {
+    if (type === 'links') {
       await this[_runScripts]('prepare')
+    }
+    if (this[_binLinks]) {
+      await this[_linkAllBins]()
+    }
 
-      if (this[_binLinks]) {
-        await this[_linkAllBins]()
-      }
+    if (!this[_ignoreScripts]) {
+      await this[_runScripts]('install')
+      await this[_runScripts]('postinstall')
     }
 
     process.emit('timeEnd', `build:${type}`)

package/lib/arborist/reify.js

@@ -1105,7 +1105,8 @@ module.exports = cls => class Reifier extends cls {
       // skip links that only live within node_modules as they are most
       // likely managed by packages we installed, we only want to rebuild
       // unchanged links we directly manage
-      if (node.isLink && node.target.fsTop === tree) {
+      const linkedFromRoot = node.parent === tree || node.target.fsTop === tree
+      if (node.isLink && linkedFromRoot) {
         nodes.push(node)
       }
     }

package/lib/dep-valid.js

@@ -53,9 +53,7 @@ const depValid = (child, requested, requestor) => {
       return semver.satisfies(child.version, requested.fetchSpec, true)
 
     case 'directory':
-      // directory must be a link to the specified folder
-      return !!child.isLink &&
-        relative(child.realpath, requested.fetchSpec) === ''
+      return linkValid(child, requested, requestor)
 
     case 'file':
       return tarballValid(child, requested, requestor)
@@ -108,6 +106,18 @@ const depValid = (child, requested, requestor) => {
   return false
 }
 
+const linkValid = (child, requested, requestor) => {
+  const isLink = !!child.isLink
+  // if we're installing links and the node is a link, then it's invalid because we want
+  // a real node to be there
+  if (requestor.installLinks) {
+    return !isLink
+  }
+
+  // directory must be a link to the specified folder
+  return isLink && relative(child.realpath, requested.fetchSpec) === ''
+}
+
 const tarballValid = (child, requested, requestor) => {
   if (child.isLink) {
     return false

package/lib/node.js

@@ -86,6 +86,7 @@ class Node {
       name,
       children,
       fsChildren,
+      installLinks = false,
       legacyPeerDeps = false,
       linksIn,
       hasShrinkwrap,
@@ -152,6 +153,7 @@ class Node {
     }
     this.integrity = integrity || pkg._integrity || null
     this.hasShrinkwrap = hasShrinkwrap || pkg._hasShrinkwrap || false
+    this.installLinks = installLinks
     this.legacyPeerDeps = legacyPeerDeps
 
     this.children = new CaseInsensitiveMap()
@@ -522,6 +524,18 @@ class Node {
     return this === this.root || this === this.root.target
   }
 
+  get isRegistryDependency () {
+    if (this.edgesIn.size === 0) {
+      return false
+    }
+    for (const edge of this.edgesIn) {
+      if (!npa(edge.spec).registry) {
+        return false
+      }
+    }
+    return true
+  }
+
   * ancestry () {
     for (let anc = this; anc; anc = anc.resolveParent) {
       yield anc
@@ -1149,6 +1163,9 @@ class Node {
       for (const kid of node.children.values()) {
         kid.parent = this
       }
+      if (node.isLink && node.target) {
+        node.target.root = null
+      }
     }
 
     if (!node.isRoot) {

package/lib/override-resolves.js

@@ -0,0 +1,11 @@
+function overrideResolves (resolved, opts = {}) {
+  const { omitLockfileRegistryResolved = false } = opts
+
+  if (omitLockfileRegistryResolved) {
+    return undefined
+  }
+
+  return resolved
+}
+
+module.exports = { overrideResolves }

package/lib/place-dep.js

@@ -45,6 +45,7 @@ class PlaceDep {
       auditReport,
       legacyBundling,
       strictPeerDeps,
+      installLinks,
       legacyPeerDeps,
       globalStyle,
     } = parent || options
@@ -56,6 +57,7 @@ class PlaceDep {
       auditReport,
       legacyBundling,
       strictPeerDeps,
+      installLinks,
       legacyPeerDeps,
       globalStyle,
     })
@@ -293,6 +295,7 @@ class PlaceDep {
       pkg: dep.package,
       resolved: dep.resolved,
       integrity: dep.integrity,
+      installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       error: dep.errors[0],
       ...(dep.overrides ? { overrides: dep.overrides } : {}),

package/lib/shrinkwrap.js

@@ -95,6 +95,7 @@ const specFromResolved = resolved => {
 const relpath = require('./relpath.js')
 
 const consistentResolve = require('./consistent-resolve.js')
+const { overrideResolves } = require('./override-resolves.js')
 
 const maybeReadFile = file => {
   return readFile(file, 'utf8').then(d => d, er => {
@@ -265,7 +266,7 @@ class Shrinkwrap {
     return s
   }
 
-  static metaFromNode (node, path) {
+  static metaFromNode (node, path, options = {}) {
     if (node.isLink) {
       return {
         resolved: relpath(path, node.realpath),
@@ -299,7 +300,12 @@ class Shrinkwrap {
     })
 
     const resolved = consistentResolve(node.resolved, node.path, path, true)
-    if (resolved) {
+    // hide resolved from registry dependencies.
+    if (!resolved) {
+      // no-op
+    } else if (node.isRegistryDependency) {
+      meta.resolved = overrideResolves(resolved, options)
+    } else {
       meta.resolved = resolved
     }
 
@@ -330,6 +336,7 @@ class Shrinkwrap {
       shrinkwrapOnly = false,
       hiddenLockfile = false,
       lockfileVersion,
+      resolveOptions = {},
     } = options
 
     this.lockfileVersion = hiddenLockfile ? 3
@@ -347,6 +354,7 @@ class Shrinkwrap {
     this.yarnLock = null
     this.hiddenLockfile = hiddenLockfile
     this.loadingError = null
+    this.resolveOptions = resolveOptions
     // only load npm-shrinkwrap.json in dep trees, not package-lock
     this.shrinkwrapOnly = shrinkwrapOnly
   }
@@ -830,7 +838,7 @@ class Shrinkwrap {
           resolved,
           integrity,
           hasShrinkwrap,
-        } = Shrinkwrap.metaFromNode(node, this.path)
+        } = Shrinkwrap.metaFromNode(node, this.path, this.resolveOptions)
         node.resolved = node.resolved || resolved || null
         node.integrity = node.integrity || integrity || null
         node.hasShrinkwrap = node.hasShrinkwrap || hasShrinkwrap || false
@@ -886,7 +894,10 @@ class Shrinkwrap {
   [_updateWaitingNode] (loc) {
     const node = this[_awaitingUpdate].get(loc)
     this[_awaitingUpdate].delete(loc)
-    this.data.packages[loc] = Shrinkwrap.metaFromNode(node, this.path)
+    this.data.packages[loc] = Shrinkwrap.metaFromNode(
+      node,
+      this.path,
+      this.resolveOptions)
   }
 
   commit () {
@@ -894,7 +905,10 @@ class Shrinkwrap {
       if (this.yarnLock) {
         this.yarnLock.fromTree(this.tree)
       }
-      const root = Shrinkwrap.metaFromNode(this.tree.target, this.path)
+      const root = Shrinkwrap.metaFromNode(
+        this.tree.target,
+        this.path,
+        this.resolveOptions)
       this.data.packages = {}
       if (Object.keys(root).length) {
         this.data.packages[''] = root
@@ -905,7 +919,10 @@ class Shrinkwrap {
           continue
         }
         const loc = relpath(this.path, node.path)
-        this.data.packages[loc] = Shrinkwrap.metaFromNode(node, this.path)
+        this.data.packages[loc] = Shrinkwrap.metaFromNode(
+          node,
+          this.path,
+          this.resolveOptions)
       }
     } else if (this[_awaitingUpdate].size > 0) {
       for (const loc of this[_awaitingUpdate].keys()) {
@@ -1013,7 +1030,7 @@ class Shrinkwrap {
         spec.type !== 'git' &&
         spec.type !== 'file' &&
         spec.type !== 'remote') {
-      lock.resolved = node.resolved
+      lock.resolved = overrideResolves(node.resolved, this.resolveOptions)
     }
 
     if (node.integrity) {

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@npmcli/arborist",
-  "version": "5.0.6",
+  "version": "5.2.0",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
     "@npmcli/installed-package-contents": "^1.0.7",
-    "@npmcli/map-workspaces": "^2.0.0",
+    "@npmcli/map-workspaces": "^2.0.3",
     "@npmcli/metavuln-calculator": "^3.0.1",
     "@npmcli/move-file": "^2.0.0",
     "@npmcli/name-from-folder": "^1.0.1",
@@ -13,7 +13,7 @@
     "@npmcli/package-json": "^2.0.0",
     "@npmcli/run-script": "^3.0.0",
     "bin-links": "^3.0.0",
-    "cacache": "^16.0.0",
+    "cacache": "^16.0.6",
     "common-ancestor-path": "^1.0.1",
     "json-parse-even-better-errors": "^2.3.1",
     "json-stringify-nice": "^1.1.4",
@@ -24,7 +24,7 @@
     "npm-package-arg": "^9.0.0",
     "npm-pick-manifest": "^7.0.0",
     "npm-registry-fetch": "^13.0.0",
-    "npmlog": "^6.0.1",
+    "npmlog": "^6.0.2",
     "pacote": "^13.0.5",
     "parse-conflict-json": "^2.0.1",
     "proc-log": "^2.0.0",
@@ -33,14 +33,14 @@
     "read-package-json-fast": "^2.0.2",
     "readdir-scoped-modules": "^1.1.0",
     "rimraf": "^3.0.2",
-    "semver": "^7.3.5",
+    "semver": "^7.3.7",
     "ssri": "^9.0.0",
     "treeverse": "^2.0.0",
     "walk-up-path": "^1.0.0"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.3.2",
+    "@npmcli/template-oss": "3.4.2",
     "benchmark": "^2.1.4",
     "chalk": "^4.1.0",
     "minify-registry-metadata": "^2.1.0",
@@ -101,6 +101,6 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.3.2"
+    "version": "3.4.2"
   }
 }