@npmcli/arborist 6.2.7 → 6.2.9

package/lib/arborist/load-virtual.js

@@ -1,5 +1,4 @@
 // mixin providing the loadVirtual method
-const localeCompare = require('@isaacs/string-locale-compare')('en')
 const mapWorkspaces = require('@npmcli/map-workspaces')
 
 const { resolve } = require('path')
@@ -14,23 +13,12 @@ const calcDepFlags = require('../calc-dep-flags.js')
 const rpj = require('read-package-json-fast')
 const treeCheck = require('../tree-check.js')
 
-const loadFromShrinkwrap = Symbol('loadFromShrinkwrap')
-const resolveNodes = Symbol('resolveNodes')
-const resolveLinks = Symbol('resolveLinks')
-const assignBundles = Symbol('assignBundles')
-const loadRoot = Symbol('loadRoot')
-const loadNode = Symbol('loadVirtualNode')
-const loadLink = Symbol('loadVirtualLink')
-const loadWorkspaces = Symbol.for('loadWorkspaces')
 const flagsSuspect = Symbol.for('flagsSuspect')
-const reCalcDepFlags = Symbol('reCalcDepFlags')
-const checkRootEdges = Symbol('checkRootEdges')
-const rootOptionProvided = Symbol('rootOptionProvided')
-
-const depsToEdges = (type, deps) =>
-  Object.entries(deps).map(d => [type, ...d])
+const setWorkspaces = Symbol.for('setWorkspaces')
 
 module.exports = cls => class VirtualLoader extends cls {
+  #rootOptionProvided
+
   constructor (options) {
     super(options)
 
@@ -50,7 +38,7 @@ module.exports = cls => class VirtualLoader extends cls {
     options = { ...this.options, ...options }
 
     if (options.root && options.root.meta) {
-      await this[loadFromShrinkwrap](options.root.meta, options.root)
+      await this.#loadFromShrinkwrap(options.root.meta, options.root)
       return treeCheck(this.virtualTree)
     }
 
@@ -67,24 +55,24 @@ module.exports = cls => class VirtualLoader extends cls {
     // when building the ideal tree, we pass in a root node to this function
     // otherwise, load it from the root package json or the lockfile
     const {
-      root = await this[loadRoot](s),
+      root = await this.#loadRoot(s),
     } = options
 
-    this[rootOptionProvided] = options.root
+    this.#rootOptionProvided = options.root
 
-    await this[loadFromShrinkwrap](s, root)
+    await this.#loadFromShrinkwrap(s, root)
     root.assertRootOverrides()
     return treeCheck(this.virtualTree)
   }
 
-  async [loadRoot] (s) {
+  async #loadRoot (s) {
     const pj = this.path + '/package.json'
     const pkg = await rpj(pj).catch(() => s.data.packages['']) || {}
-    return this[loadWorkspaces](this[loadNode]('', pkg, true))
+    return this[setWorkspaces](this.#loadNode('', pkg, true))
   }
 
-  async [loadFromShrinkwrap] (s, root) {
-    if (!this[rootOptionProvided]) {
+  async #loadFromShrinkwrap (s, root) {
+    if (!this.#rootOptionProvided) {
       // root is never any of these things, but might be a brand new
       // baby Node object that never had its dep flags calculated.
       root.extraneous = false
@@ -96,41 +84,37 @@ module.exports = cls => class VirtualLoader extends cls {
       this[flagsSuspect] = true
     }
 
-    this[checkRootEdges](s, root)
+    this.#checkRootEdges(s, root)
     root.meta = s
     this.virtualTree = root
-    const { links, nodes } = this[resolveNodes](s, root)
-    await this[resolveLinks](links, nodes)
+    const { links, nodes } = this.#resolveNodes(s, root)
+    await this.#resolveLinks(links, nodes)
     if (!(s.originalLockfileVersion >= 2)) {
-      this[assignBundles](nodes)
+      this.#assignBundles(nodes)
     }
     if (this[flagsSuspect]) {
-      this[reCalcDepFlags](nodes.values())
-    }
-    return root
-  }
-
-  [reCalcDepFlags] (nodes) {
-    // reset all dep flags
-    // can't use inventory here, because virtualTree might not be root
-    for (const node of nodes) {
-      if (node.isRoot || node === this[rootOptionProvided]) {
-        continue
+      // reset all dep flags
+      // can't use inventory here, because virtualTree might not be root
+      for (const node of nodes.values()) {
+        if (node.isRoot || node === this.#rootOptionProvided) {
+          continue
+        }
+        node.extraneous = true
+        node.dev = true
+        node.optional = true
+        node.devOptional = true
+        node.peer = true
       }
-      node.extraneous = true
-      node.dev = true
-      node.optional = true
-      node.devOptional = true
-      node.peer = true
+      calcDepFlags(this.virtualTree, !this.#rootOptionProvided)
     }
-    calcDepFlags(this.virtualTree, !this[rootOptionProvided])
+    return root
   }
 
   // check the lockfile deps, and see if they match.  if they do not
   // then we have to reset dep flags at the end.  for example, if the
   // user manually edits their package.json file, then we need to know
   // that the idealTree is no longer entirely trustworthy.
-  [checkRootEdges] (s, root) {
+  #checkRootEdges (s, root) {
     // loaded virtually from tree, no chance of being out of sync
     // ancient lockfiles are critically damaged by this process,
     // so we need to just hope for the best in those cases.
@@ -144,6 +128,7 @@ module.exports = cls => class VirtualLoader extends cls {
     const optional = lock.optionalDependencies || {}
     const peer = lock.peerDependencies || {}
     const peerOptional = {}
+
     if (lock.peerDependenciesMeta) {
       for (const [name, meta] of Object.entries(lock.peerDependenciesMeta)) {
         if (meta.optional && peer[name] !== undefined) {
@@ -152,50 +137,45 @@ module.exports = cls => class VirtualLoader extends cls {
         }
       }
     }
+
     for (const name of Object.keys(optional)) {
       delete prod[name]
     }
 
-    const lockWS = []
+    const lockWS = {}
     const workspaces = mapWorkspaces.virtual({
       cwd: this.path,
       lockfile: s.data,
     })
+
     for (const [name, path] of workspaces.entries()) {
-      lockWS.push(['workspace', name, `file:${path.replace(/#/g, '%23')}`])
+      lockWS[name] = `file:${path.replace(/#/g, '%23')}`
     }
 
-    const lockEdges = [
-      ...depsToEdges('prod', prod),
-      ...depsToEdges('dev', dev),
-      ...depsToEdges('optional', optional),
-      ...depsToEdges('peer', peer),
-      ...depsToEdges('peerOptional', peerOptional),
-      ...lockWS,
-    ].sort(([atype, aname], [btype, bname]) =>
-      localeCompare(atype, btype) || localeCompare(aname, bname))
-
-    const rootEdges = [...root.edgesOut.values()]
-      .map(e => [e.type, e.name, e.spec])
-      .sort(([atype, aname], [btype, bname]) =>
-        localeCompare(atype, btype) || localeCompare(aname, bname))
-
-    if (rootEdges.length !== lockEdges.length) {
-      // something added or removed
-      return this[flagsSuspect] = true
-    }
+    // Should rootNames exclude optional?
+    const rootNames = new Set(root.edgesOut.keys())
 
-    for (let i = 0; i < lockEdges.length; i++) {
-      if (rootEdges[i][0] !== lockEdges[i][0] ||
-          rootEdges[i][1] !== lockEdges[i][1] ||
-          rootEdges[i][2] !== lockEdges[i][2]) {
-        return this[flagsSuspect] = true
+    const lockByType = ({ dev, optional, peer, peerOptional, prod, workspace: lockWS })
+
+    // Find anything in shrinkwrap deps that doesn't match root's type or spec
+    for (const type in lockByType) {
+      const deps = lockByType[type]
+      for (const name in deps) {
+        const edge = root.edgesOut.get(name)
+        if (!edge || edge.type !== type || edge.spec !== deps[name]) {
+          return this[flagsSuspect] = true
+        }
+        rootNames.delete(name)
       }
     }
+    // Something was in root that's not accounted for in shrinkwrap
+    if (rootNames.size) {
+      return this[flagsSuspect] = true
+    }
   }
 
   // separate out link metadatas, and create Node objects for nodes
-  [resolveNodes] (s, root) {
+  #resolveNodes (s, root) {
     const links = new Map()
     const nodes = new Map([['', root]])
     for (const [location, meta] of Object.entries(s.data.packages)) {
@@ -207,7 +187,7 @@ module.exports = cls => class VirtualLoader extends cls {
       if (meta.link) {
         links.set(location, meta)
       } else {
-        nodes.set(location, this[loadNode](location, meta))
+        nodes.set(location, this.#loadNode(location, meta))
       }
     }
     return { links, nodes }
@@ -215,12 +195,12 @@ module.exports = cls => class VirtualLoader extends cls {
 
   // links is the set of metadata, and nodes is the map of non-Link nodes
   // Set the targets to nodes in the set, if we have them (we might not)
-  async [resolveLinks] (links, nodes) {
+  async #resolveLinks (links, nodes) {
     for (const [location, meta] of links.entries()) {
       const targetPath = resolve(this.path, meta.resolved)
       const targetLoc = relpath(this.path, targetPath)
       const target = nodes.get(targetLoc)
-      const link = this[loadLink](location, targetLoc, target, meta)
+      const link = this.#loadLink(location, targetLoc, target, meta)
       nodes.set(location, link)
       nodes.set(targetLoc, link.target)
 
@@ -236,7 +216,7 @@ module.exports = cls => class VirtualLoader extends cls {
     }
   }
 
-  [assignBundles] (nodes) {
+  #assignBundles (nodes) {
     for (const [location, node] of nodes) {
       // Skip assignment of parentage for the root package
       if (!location || node.isLink && !node.target.location) {
@@ -265,7 +245,7 @@ module.exports = cls => class VirtualLoader extends cls {
     }
   }
 
-  [loadNode] (location, sw, loadOverrides) {
+  #loadNode (location, sw, loadOverrides) {
     const p = this.virtualTree ? this.virtualTree.realpath : this.path
     const path = resolve(p, location)
     // shrinkwrap doesn't include package name unless necessary
@@ -303,7 +283,7 @@ module.exports = cls => class VirtualLoader extends cls {
     return node
   }
 
-  [loadLink] (location, targetLoc, target, meta) {
+  #loadLink (location, targetLoc, target, meta) {
     const path = resolve(this.path, location)
     const link = new Link({
       installLinks: this.installLinks,

package/lib/arborist/reify.js

@@ -6,7 +6,7 @@ const { subset, intersects } = require('semver')
 const npa = require('npm-package-arg')
 const semver = require('semver')
 const debug = require('../debug.js')
-const walkUp = require('walk-up-path')
+const { walkUp } = require('walk-up-path')
 const log = require('proc-log')
 const hgi = require('hosted-git-info')
 const rpj = require('read-package-json-fast')
@@ -702,7 +702,6 @@ module.exports = cls => class Reifier extends cls {
       })
       await pacote.extract(res, node.path, {
         ...this.options,
-        Arborist: this.constructor,
         resolved: node.resolved,
         integrity: node.integrity,
       })

package/lib/arborist/{load-workspaces.js → set-workspaces.js}

@@ -1,10 +1,10 @@
 const mapWorkspaces = require('@npmcli/map-workspaces')
 
 // shared ref used by other mixins/Arborist
-const _loadWorkspaces = Symbol.for('loadWorkspaces')
+const _setWorkspaces = Symbol.for('setWorkspaces')
 
 module.exports = cls => class MapWorkspaces extends cls {
-  async [_loadWorkspaces] (node) {
+  async [_setWorkspaces] (node) {
     const workspaces = await mapWorkspaces({
       cwd: node.path,
       pkg: node.package,

package/lib/calc-dep-flags.js

@@ -51,14 +51,12 @@ const calcDepFlagsStep = (node) => {
     // however, for convenience and to save an extra rewalk, we leave
     // it set when we are in *either* tree, and then omit it from the
     // package-lock if either dev or optional are set.
-    const unsetDevOpt = !node.devOptional && !node.dev && !node.optional &&
-      !dev && !optional
+    const unsetDevOpt = !node.devOptional && !node.dev && !node.optional && !dev && !optional
 
     // if we are not in the devOpt tree, then we're also not in
     // either the dev or opt trees
     const unsetDev = unsetDevOpt || !node.dev && !dev
-    const unsetOpt = unsetDevOpt ||
-      !node.optional && !optional
+    const unsetOpt = unsetDevOpt || !node.optional && !optional
     const unsetPeer = !node.peer && !peer
 
     if (unsetPeer) {
@@ -91,8 +89,7 @@ const resetParents = (node, flag) => {
   }
 }
 
-// typically a short walk, since it only traverses deps that
-// have the flag set.
+// typically a short walk, since it only traverses deps that have the flag set.
 const unsetFlag = (node, flag) => {
   if (node[flag]) {
     node[flag] = false
@@ -104,10 +101,17 @@ const unsetFlag = (node, flag) => {
           node.target.extraneous = node.target[flag] = false
         }
       },
-      getChildren: node => [...node.target.edgesOut.values()]
-        .filter(edge => edge.to && edge.to[flag] &&
-          (flag !== 'peer' && edge.type === 'peer' || edge.type === 'prod'))
-        .map(edge => edge.to),
+      getChildren: node => {
+        const children = []
+        for (const edge of node.target.edgesOut.values()) {
+          if (edge.to && edge.to[flag] &&
+            (flag !== 'peer' && edge.type === 'peer' || edge.type === 'prod')
+          ) {
+            children.push(edge.to)
+          }
+        }
+        return children
+      },
     })
   }
 }

package/lib/dep-valid.js

@@ -84,15 +84,21 @@ const depValid = (child, requested, requestor) => {
       const reqHost = requested.hosted
       const reqCommit = /^[a-fA-F0-9]{40}$/.test(requested.gitCommittish || '')
       const nc = { noCommittish: !reqCommit }
-      const sameRepo =
-        resHost ? reqHost && reqHost.ssh(nc) === resHost.ssh(nc)
-        : resRepo.fetchSpec === requested.fetchSpec
-
-      return !sameRepo ? false
-        : !requested.gitRange ? true
-        : semver.satisfies(child.package.version, requested.gitRange, {
-          loose: true,
-        })
+      if (!resHost) {
+        if (resRepo.fetchSpec !== requested.fetchSpec) {
+          return false
+        }
+      } else {
+        if (reqHost?.ssh(nc) !== resHost.ssh(nc)) {
+          return false
+        }
+      }
+      if (!requested.gitRange) {
+        return true
+      }
+      return semver.satisfies(child.package.version, requested.gitRange, {
+        loose: true,
+      })
     }
 
     default: // unpossible, just being cautious