@npmcli/arborist 9.1.3 → 9.1.5

package/lib/arborist/build-ideal-tree.js

@@ -1,6 +1,6 @@
 // mixin implementing the buildIdealTree method
 const localeCompare = require('@isaacs/string-locale-compare')('en')
-const rpj = require('read-package-json-fast')
+const PackageJson = require('@npmcli/package-json')
 const npa = require('npm-package-arg')
 const pacote = require('pacote')
 const cacache = require('cacache')
@@ -268,7 +268,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
       root = await this.#globalRootNode()
     } else {
       try {
-        const pkg = await rpj(this.path + '/package.json')
+        const { content: pkg } = await PackageJson.normalize(this.path)
         root = await this.#rootNodeFromPackage(pkg)
       } catch (err) {
         if (err.code === 'EJSONPARSE') {
@@ -448,7 +448,6 @@ module.exports = cls => class IdealTreeBuilder extends cls {
       const paths = await readdirScoped(nm).catch(() => [])
       for (const p of paths) {
         const name = p.replace(/\\/g, '/')
-        tree.package.dependencies = tree.package.dependencies || {}
         const updateName = this[_updateNames].includes(name)
         if (this[_updateAll] || updateName) {
           if (updateName) {
@@ -1238,15 +1237,19 @@ This is a one-time fix-up, please be patient...
       // Check if the target is within the project root
       isProjectInternalFileSpec = targetPath.startsWith(resolvedProjectRoot + sep) || targetPath === resolvedProjectRoot
     }
+
+    // When using --install-links, we need to handle transitive file dependencies specially
+    // If the parent was installed (not linked) due to --install-links, and this is a file: dep, we should also install it rather than link it
+    const parentWasInstalled = parent && !parent.isLink && parent.resolved?.startsWith('file:')
+    const isTransitiveFileDep = spec.type === 'directory' && parentWasInstalled && installLinks
+
     // Decide whether to link or copy the dependency
-    const shouldLink = isWorkspace || isProjectInternalFileSpec || !installLinks
+    const shouldLink = (isWorkspace || isProjectInternalFileSpec || !installLinks) && !isTransitiveFileDep
     if (spec.type === 'directory' && shouldLink) {
       return this.#linkFromSpec(name, spec, parent, edge)
     }
 
-    // if the spec matches a workspace name, then see if the workspace node will
-    // satisfy the edge. if it does, we return the workspace node to make sure it
-    // takes priority.
+    // if the spec matches a workspace name, then see if the workspace node will satisfy the edge. if it does, we return the workspace node to make sure it takes priority.
     if (isWorkspace) {
       const existingNode = this.idealTree.edgesOut.get(spec.name).to
       if (existingNode && existingNode.isWorkspace && existingNode.satisfies(edge)) {
@@ -1254,6 +1257,15 @@ This is a one-time fix-up, please be patient...
       }
     }
 
+    // For file: dependencies that we're installing (not linking), ensure proper resolution
+    if (isTransitiveFileDep && edge) {
+      // For transitive file deps, resolve relative to the parent's original source location
+      const parentOriginalPath = parent.resolved.slice(5) // Remove 'file:' prefix
+      const relativePath = edge.rawSpec.slice(5) // Remove 'file:' prefix
+      const absolutePath = resolve(parentOriginalPath, relativePath)
+      spec = npa.resolve(name, `file:${absolutePath}`)
+    }
+
     // spec isn't a directory, and either isn't a workspace or the workspace we have
     // doesn't satisfy the edge. try to fetch a manifest and build a node from that.
     return this.#fetchManifest(spec)
@@ -1275,14 +1287,15 @@ This is a one-time fix-up, please be patient...
       })
   }
 
-  #linkFromSpec (name, spec, parent) {
+  async #linkFromSpec (name, spec, parent) {
     const realpath = spec.fetchSpec
     const { installLinks, legacyPeerDeps } = this
-    return rpj(realpath + '/package.json').catch(() => ({})).then(pkg => {
-      const link = new Link({ name, parent, realpath, pkg, installLinks, legacyPeerDeps })
-      this.#linkNodes.add(link)
-      return link
+    const { content: pkg } = await PackageJson.normalize(realpath).catch(() => {
+      return { content: {} }
     })
+    const link = new Link({ name, parent, realpath, pkg, installLinks, legacyPeerDeps })
+    this.#linkNodes.add(link)
+    return link
   }
 
   // load all peer deps and meta-peer deps into the node's parent
@@ -1306,6 +1319,12 @@ This is a one-time fix-up, please be patient...
       .sort(({ name: a }, { name: b }) => localeCompare(a, b))
 
     for (const edge of peerEdges) {
+      // node.parent gets mutated during loop execution due to recursive #nodeFromEdge calls.
+      // When a compatible peer is found (e.g. a@1.1.0 replaces a@1.2.0), the original node loses its parent.
+      // if node is detached/removed from the tree, or has no parent, so no need to check remaining edgesOut for that node.
+      if (!node.parent) {
+        break
+      }
       // already placed this one, and we're happy with it.
       if (edge.valid && edge.to) {
         continue

package/lib/arborist/load-actual.js

@@ -1,8 +1,8 @@
 // mix-in implementing the loadActual method
 
-const { relative, dirname, resolve, join, normalize } = require('node:path')
+const { dirname, join, normalize, relative, resolve } = require('node:path')
 
-const rpj = require('read-package-json-fast')
+const PackageJson = require('@npmcli/package-json')
 const { readdirScoped } = require('@npmcli/fs')
 const { walkUp } = require('walk-up-path')
 const ancestorPath = require('common-ancestor-path')
@@ -279,12 +279,16 @@ module.exports = cls => class ActualLoader extends cls {
       }
 
       try {
-        const pkg = await rpj(join(real, 'package.json'))
+        const { content: pkg } = await PackageJson.normalize(real)
         params.pkg = pkg
         if (useRootOverrides && root.overrides) {
           params.overrides = root.overrides.getNodeRule({ name: pkg.name, version: pkg.version })
         }
       } catch (err) {
+        if (err.code === 'EJSONPARSE') {
+          // TODO @npmcli/package-json should be doing this
+          err.path = join(real, 'package.json')
+        }
         params.error = err
       }
 

package/lib/arborist/load-virtual.js

@@ -1,16 +1,15 @@
+const { resolve } = require('node:path')
 // mixin providing the loadVirtual method
 const mapWorkspaces = require('@npmcli/map-workspaces')
-
-const { resolve } = require('node:path')
-
+const PackageJson = require('@npmcli/package-json')
 const nameFromFolder = require('@npmcli/name-from-folder')
+
 const consistentResolve = require('../consistent-resolve.js')
 const Shrinkwrap = require('../shrinkwrap.js')
 const Node = require('../node.js')
 const Link = require('../link.js')
 const relpath = require('../relpath.js')
 const calcDepFlags = require('../calc-dep-flags.js')
-const rpj = require('read-package-json-fast')
 const treeCheck = require('../tree-check.js')
 
 const flagsSuspect = Symbol.for('flagsSuspect')
@@ -54,10 +53,11 @@ module.exports = cls => class VirtualLoader extends cls {
 
     // when building the ideal tree, we pass in a root node to this function
     // otherwise, load it from the root package json or the lockfile
+    const pkg = await PackageJson.normalize(this.path).then(p => p.content).catch(() => s.data.packages[''] || {})
+    // TODO clean this up
     const {
-      root = await this.#loadRoot(s),
+      root = await this[setWorkspaces](this.#loadNode('', pkg, true)),
     } = options
-
     this.#rootOptionProvided = options.root
 
     await this.#loadFromShrinkwrap(s, root)
@@ -65,12 +65,6 @@ module.exports = cls => class VirtualLoader extends cls {
     return treeCheck(this.virtualTree)
   }
 
-  async #loadRoot (s) {
-    const pj = this.path + '/package.json'
-    const pkg = await rpj(pj).catch(() => s.data.packages['']) || {}
-    return this[setWorkspaces](this.#loadNode('', pkg, true))
-  }
-
   async #loadFromShrinkwrap (s, root) {
     if (!this.#rootOptionProvided) {
       // root is never any of these things, but might be a brand new
@@ -219,11 +213,7 @@ To fix:
       // we always need to read the package.json for link targets
       // outside node_modules because they can be changed by the local user
       if (!link.target.parent) {
-        const pj = link.realpath + '/package.json'
-        const pkg = await rpj(pj).catch(() => null)
-        if (pkg) {
-          link.target.package = pkg
-        }
+        await PackageJson.normalize(link.realpath).then(p => link.target.package = p.content).catch(() => null)
       }
     }
   }

package/lib/arborist/rebuild.js

@@ -1,20 +1,19 @@
 // Arborist.rebuild({path = this.path}) will do all the binlinks and
 // bundle building needed.  Called by reify, and by `npm rebuild`.
 
+const PackageJson = require('@npmcli/package-json')
+const binLinks = require('bin-links')
 const localeCompare = require('@isaacs/string-locale-compare')('en')
-const { depth: dfwalk } = require('treeverse')
 const promiseAllRejectLate = require('promise-all-reject-late')
-const rpj = require('read-package-json-fast')
-const binLinks = require('bin-links')
 const runScript = require('@npmcli/run-script')
 const { callLimit: promiseCallLimit } = require('promise-call-limit')
-const { resolve } = require('node:path')
+const { depth: dfwalk } = require('treeverse')
 const { isNodeGypPackage, defaultGypInstallScript } = require('@npmcli/node-gyp')
 const { log, time } = require('proc-log')
+const { resolve } = require('node:path')
 
 const boolEnv = b => b ? '1' : ''
-const sortNodes = (a, b) =>
-  (a.depth - b.depth) || localeCompare(a.path, b.path)
+const sortNodes = (a, b) => (a.depth - b.depth) || localeCompare(a.path, b.path)
 
 const _checkBins = Symbol.for('checkBins')
 
@@ -250,7 +249,9 @@ module.exports = cls => class Builder extends cls {
       // add to the set then remove while we're reading the pj, so we
       // don't accidentally hit it multiple times.
       set.add(node)
-      const pkg = await rpj(node.path + '/package.json').catch(() => ({}))
+      const { content: pkg } = await PackageJson.normalize(node.path).catch(() => {
+        return { content: {} }
+      })
       set.delete(node)
 
       const { scripts = {} } = pkg

package/lib/arborist/reify.js

@@ -1,48 +1,37 @@
 // mixin implementing the reify method
-const onExit = require('../signal-handling.js')
-const pacote = require('pacote')
-const AuditReport = require('../audit-report.js')
-const { subset, intersects } = require('semver')
-const npa = require('npm-package-arg')
-const semver = require('semver')
-const debug = require('../debug.js')
-const { walkUp } = require('walk-up-path')
-const { log, time } = require('proc-log')
-const rpj = require('read-package-json-fast')
-const hgi = require('hosted-git-info')
-
-const { dirname, resolve, relative, join } = require('node:path')
-const { depth: dfwalk } = require('treeverse')
-const {
-  lstat,
-  mkdir,
-  rm,
-  symlink,
-} = require('node:fs/promises')
-const { moveFile } = require('@npmcli/fs')
 const PackageJson = require('@npmcli/package-json')
+const hgi = require('hosted-git-info')
+const npa = require('npm-package-arg')
 const packageContents = require('@npmcli/installed-package-contents')
+const pacote = require('pacote')
+const promiseAllRejectLate = require('promise-all-reject-late')
 const runScript = require('@npmcli/run-script')
+const { callLimit: promiseCallLimit } = require('promise-call-limit')
 const { checkEngine, checkPlatform } = require('npm-install-checks')
+const { depth: dfwalk } = require('treeverse')
+const { dirname, resolve, relative, join } = require('node:path')
+const { log, time } = require('proc-log')
+const { lstat, mkdir, rm, symlink } = require('node:fs/promises')
+const { moveFile } = require('@npmcli/fs')
+const { subset, intersects } = require('semver')
+const { walkUp } = require('walk-up-path')
 
-const treeCheck = require('../tree-check.js')
-const relpath = require('../relpath.js')
+const AuditReport = require('../audit-report.js')
 const Diff = require('../diff.js')
-const retirePath = require('../retire-path.js')
-const promiseAllRejectLate = require('promise-all-reject-late')
-const { callLimit: promiseCallLimit } = require('promise-call-limit')
-const optionalSet = require('../optional-set.js')
 const calcDepFlags = require('../calc-dep-flags.js')
+const debug = require('../debug.js')
+const onExit = require('../signal-handling.js')
+const optionalSet = require('../optional-set.js')
+const relpath = require('../relpath.js')
+const retirePath = require('../retire-path.js')
+const treeCheck = require('../tree-check.js')
+const { defaultLockfileVersion } = require('../shrinkwrap.js')
 const { saveTypeMap, hasSubKey } = require('../add-rm-pkg-deps.js')
 
-const Shrinkwrap = require('../shrinkwrap.js')
-const { defaultLockfileVersion } = Shrinkwrap
-
 // Part of steps (steps need refactoring before we can do anything about these)
 const _retireShallowNodes = Symbol.for('retireShallowNodes')
 const _loadBundlesAndUpdateTrees = Symbol.for('loadBundlesAndUpdateTrees')
 const _submitQuickAudit = Symbol('submitQuickAudit')
-const _addOmitsToTrashList = Symbol('addOmitsToTrashList')
 const _unpackNewModules = Symbol.for('unpackNewModules')
 const _build = Symbol.for('build')
 
@@ -85,6 +74,7 @@ module.exports = cls => class Reifier extends cls {
   #dryRun
   #nmValidated = new Set()
   #omit
+  #omitted
   #retiredPaths = {}
   #retiredUnchanged = {}
   #savePrefix
@@ -109,6 +99,7 @@ module.exports = cls => class Reifier extends cls {
     }
 
     this.#omit = new Set(options.omit)
+    this.#omitted = new Set()
 
     // start tracker block
     this.addTracker('reify')
@@ -141,6 +132,10 @@ module.exports = cls => class Reifier extends cls {
       this.idealTree = oldTree
     }
     await this[_saveIdealTree](options)
+    // clean omitted
+    for (const node of this.#omitted) {
+      node.parent = null
+    }
     // clean up any trash that is still in the tree
     for (const path of this[_trashList]) {
       const loc = relpath(this.idealTree.realpath, path)
@@ -315,7 +310,6 @@ module.exports = cls => class Reifier extends cls {
       ]],
       [_rollbackCreateSparseTree, [
         _createSparseTree,
-        _addOmitsToTrashList,
         _loadShrinkwrapsAndUpdateTrees,
         _loadBundlesAndUpdateTrees,
         _submitQuickAudit,
@@ -470,6 +464,8 @@ module.exports = cls => class Reifier extends cls {
     // find all the nodes that need to change between the actual
     // and ideal trees.
     this.diff = Diff.calculate({
+      omit: this.#omit,
+      omitted: this.#omitted,
       shrinkwrapInflated: this.#shrinkwrapInflated,
       filterNodes,
       actual: this.actualTree,
@@ -554,37 +550,6 @@ module.exports = cls => class Reifier extends cls {
       })
   }
 
-  // adding to the trash list will skip reifying, and delete them
-  // if they are currently in the tree and otherwise untouched.
-  [_addOmitsToTrashList] () {
-    if (!this.#omit.size) {
-      return
-    }
-
-    const timeEnd = time.start('reify:trashOmits')
-    for (const node of this.idealTree.inventory.values()) {
-      const { top } = node
-
-      // if the top is not the root or workspace then we do not want to omit it
-      if (!top.isProjectRoot && !top.isWorkspace) {
-        continue
-      }
-
-      // if a diff filter has been created, then we do not omit the node if the
-      // top node is not in that set
-      if (this.diff?.filterSet?.size && !this.diff.filterSet.has(top)) {
-        continue
-      }
-
-      // omit node if the dep type matches any omit flags that were set
-      if (node.shouldOmit(this.#omit)) {
-        this[_addNodeToTrashList](node)
-      }
-    }
-
-    timeEnd()
-  }
-
   [_createSparseTree] () {
     const timeEnd = time.start('reify:createSparse')
     // if we call this fn again, we look for the previous list
@@ -683,7 +648,6 @@ module.exports = cls => class Reifier extends cls {
       // reload the diff and sparse tree because the ideal tree changed
       .then(() => this[_diffTrees]())
       .then(() => this[_createSparseTree]())
-      .then(() => this[_addOmitsToTrashList]())
       .then(() => this[_loadShrinkwrapsAndUpdateTrees]())
       .then(timeEnd)
   }
@@ -691,15 +655,10 @@ module.exports = cls => class Reifier extends cls {
   // create a symlink for Links, extract for Nodes
   // return the node object, since we usually want that
   // handle optional dep failures here
-  // If node is in trash list, skip it
   // If reifying fails, and the node is optional, add it and its optionalSet
   // to the trash list
   // Always return the node.
   [_reifyNode] (node) {
-    if (this[_trashList].has(node.path)) {
-      return node
-    }
-
     const timeEnd = time.start(`reifyNode:${node.location}`)
     this.addTracker('reify', node.name, node.location)
 
@@ -803,7 +762,7 @@ module.exports = cls => class Reifier extends cls {
       })
       // store nodes don't use Node class so node.package doesn't get updated
       if (node.isInStore) {
-        const pkg = await rpj(join(node.path, 'package.json'))
+        const { content: pkg } = await PackageJson.normalize(node.path)
         node.package.scripts = pkg.scripts
       }
       return
@@ -885,6 +844,7 @@ module.exports = cls => class Reifier extends cls {
         // Replace the host with the registry host while keeping the path intact
         resolvedURL.hostname = registryURL.hostname
         resolvedURL.port = registryURL.port
+        resolvedURL.protocol = registryURL.protocol
 
         // Make sure we don't double-include the path if it's already there
         const registryPath = registryURL.pathname.replace(/\/$/, '')
@@ -1431,8 +1391,7 @@ module.exports = cls => class Reifier extends cls {
         if (options.saveType) {
           const depType = saveTypeMap.get(options.saveType)
           pkg[depType][name] = newSpec
-          // rpj will have moved it here if it was in both
-          // if it is empty it will be deleted later
+          // PackageJson.normalize will have moved it here if it was in both, if it is empty it will be deleted later
           if (options.saveType === 'prod' && pkg.optionalDependencies) {
             delete pkg.optionalDependencies[name]
           }
@@ -1473,7 +1432,7 @@ module.exports = cls => class Reifier extends cls {
     const exactVersion = node => {
       for (const edge of node.edgesIn) {
         try {
-          if (semver.subset(edge.spec, node.version)) {
+          if (subset(edge.spec, node.version)) {
             return false
           }
         } catch {

package/lib/calc-dep-flags.js

@@ -22,6 +22,7 @@ const calcDepFlagsStep = (node) => {
   // or normal dependency graphs overlap deep in the dep graph.
   // Since we're only walking through deps that are not already flagged
   // as non-dev/non-optional, it's typically a very shallow traversal
+
   node.extraneous = false
   resetParents(node, 'extraneous')
   resetParents(node, 'dev')
@@ -47,10 +48,16 @@ const calcDepFlagsStep = (node) => {
     if (!to) {
       return
     }
-
     // everything with any kind of edge into it is not extraneous
     to.extraneous = false
 
+    // If this is a peer edge, mark the target as peer
+    if (peer) {
+      to.peer = true
+    } else if (to.peer && !hasIncomingPeerEdge(to)) {
+      unsetFlag(to, 'peer')
+    }
+
     // devOptional is the *overlap* of the dev and optional tree.
     // however, for convenience and to save an extra rewalk, we leave
     // it set when we are in *either* tree, and then omit it from the
@@ -61,11 +68,6 @@ const calcDepFlagsStep = (node) => {
     // either the dev or opt trees
     const unsetDev = unsetDevOpt || !node.dev && !dev
     const unsetOpt = unsetDevOpt || !node.optional && !optional
-    const unsetPeer = !node.peer && !peer
-
-    if (unsetPeer) {
-      unsetFlag(to, 'peer')
-    }
 
     if (unsetDevOpt) {
       unsetFlag(to, 'devOptional')
@@ -83,6 +85,16 @@ const calcDepFlagsStep = (node) => {
   return node
 }
 
+const hasIncomingPeerEdge = (node) => {
+  const target = node.isLink && node.target ? node.target : node
+  for (const edge of target.edgesIn) {
+    if (edge.type === 'peer') {
+      return true
+    }
+  }
+  return false
+}
+
 const resetParents = (node, flag) => {
   if (node[flag]) {
     return
@@ -109,12 +121,19 @@ const unsetFlag = (node, flag) => {
         const children = []
         const targetNode = node.isLink && node.target ? node.target : node
         for (const edge of targetNode.edgesOut.values()) {
-          if (
-            edge.to &&
-            edge.to[flag] &&
-            ((flag !== 'peer' && edge.type === 'peer') || edge.type === 'prod')
-          ) {
-            children.push(edge.to)
+          if (edge.to?.[flag]) {
+            // For the peer flag, only follow peer edges to unset the flag
+            // Don't propagate peer flag through prod/dev/optional edges
+            if (flag === 'peer') {
+              if (edge.type === 'peer') {
+                children.push(edge.to)
+              }
+            } else {
+              // For other flags, follow prod edges (and peer edges for non-peer flags)
+              if (edge.type === 'prod' || edge.type === 'peer') {
+                children.push(edge.to)
+              }
+            }
           }
         }
         return children

package/lib/diff.js

@@ -11,7 +11,9 @@ const { existsSync } = require('node:fs')
 const ssri = require('ssri')
 
 class Diff {
-  constructor ({ actual, ideal, filterSet, shrinkwrapInflated }) {
+  constructor ({ actual, ideal, filterSet, shrinkwrapInflated, omit, omitted }) {
+    this.omit = omit
+    this.omitted = omitted
     this.filterSet = filterSet
     this.shrinkwrapInflated = shrinkwrapInflated
     this.children = []
@@ -36,6 +38,8 @@ class Diff {
     ideal,
     filterNodes = [],
     shrinkwrapInflated = new Set(),
+    omit = new Set(),
+    omitted = new Set(),
   }) {
     // if there's a filterNode, then:
     // - get the path from the root to the filterNode.  The root or
@@ -94,18 +98,28 @@ class Diff {
     }
 
     return depth({
-      tree: new Diff({ actual, ideal, filterSet, shrinkwrapInflated }),
+      tree: new Diff({ actual, ideal, filterSet, shrinkwrapInflated, omit, omitted }),
       getChildren,
       leave,
     })
   }
 }
 
-const getAction = ({ actual, ideal }) => {
+const getAction = ({ actual, ideal, omit, omitted }) => {
   if (!ideal) {
     return 'REMOVE'
   }
 
+  if (ideal.shouldOmit?.(omit)) {
+    omitted.add(ideal)
+
+    if (actual) {
+      return 'REMOVE'
+    }
+
+    return null
+  }
+
   // bundled meta-deps are copied over to the ideal tree when we visit it,
   // so they'll appear to be missing here.  There's no need to handle them
   // in the diff, though, because they'll be replaced at reify time anyway
@@ -184,6 +198,8 @@ const getChildren = diff => {
     removed,
     filterSet,
     shrinkwrapInflated,
+    omit,
+    omitted,
   } = diff
 
   // Note: we DON'T diff fsChildren themselves, because they are either
@@ -214,6 +230,8 @@ const getChildren = diff => {
       removed,
       filterSet,
       shrinkwrapInflated,
+      omit,
+      omitted,
     })
   }
 
@@ -232,12 +250,14 @@ const diffNode = ({
   removed,
   filterSet,
   shrinkwrapInflated,
+  omit,
+  omitted,
 }) => {
   if (filterSet.size && !(filterSet.has(ideal) || filterSet.has(actual))) {
     return
   }
 
-  const action = getAction({ actual, ideal })
+  const action = getAction({ actual, ideal, omit, omitted })
 
   // if it's a match, then get its children
   // otherwise, this is the child diff node
@@ -245,7 +265,7 @@ const diffNode = ({
     if (action === 'REMOVE') {
       removed.push(actual)
     }
-    children.push(new Diff({ actual, ideal, filterSet, shrinkwrapInflated }))
+    children.push(new Diff({ actual, ideal, filterSet, shrinkwrapInflated, omit, omitted }))
   } else {
     unchanged.push(ideal)
     // !*! Weird dirty hack warning !*!
@@ -285,6 +305,8 @@ const diffNode = ({
       removed,
       filterSet,
       shrinkwrapInflated,
+      omit,
+      omitted,
     }))
   }
 }

package/lib/node.js

@@ -28,22 +28,28 @@
 // where we need to quickly find all instances of a given package name within a
 // tree.
 
-const semver = require('semver')
+const PackageJson = require('@npmcli/package-json')
 const nameFromFolder = require('@npmcli/name-from-folder')
+const npa = require('npm-package-arg')
+const semver = require('semver')
+const util = require('node:util')
+const { getPaths: getBinPaths } = require('bin-links')
+const { log } = require('proc-log')
+const { resolve, relative, dirname, basename } = require('node:path')
+const { walkUp } = require('walk-up-path')
+
+const CaseInsensitiveMap = require('./case-insensitive-map.js')
 const Edge = require('./edge.js')
 const Inventory = require('./inventory.js')
 const OverrideSet = require('./override-set.js')
-const { normalize } = require('read-package-json-fast')
-const { getPaths: getBinPaths } = require('bin-links')
-const npa = require('npm-package-arg')
+const consistentResolve = require('./consistent-resolve.js')
 const debug = require('./debug.js')
 const gatherDepSet = require('./gather-dep-set.js')
+const printableTree = require('./printable.js')
+const querySelectorAll = require('./query-selector-all.js')
+const relpath = require('./relpath.js')
 const treeCheck = require('./tree-check.js')
-const { walkUp } = require('walk-up-path')
-const { log } = require('proc-log')
 
-const { resolve, relative, dirname, basename } = require('node:path')
-const util = require('node:util')
 const _package = Symbol('_package')
 const _parent = Symbol('_parent')
 const _target = Symbol.for('_target')
@@ -58,14 +64,6 @@ const _delistFromMeta = Symbol.for('_delistFromMeta')
 const _explain = Symbol('_explain')
 const _explanation = Symbol('_explanation')
 
-const relpath = require('./relpath.js')
-const consistentResolve = require('./consistent-resolve.js')
-
-const printableTree = require('./printable.js')
-const CaseInsensitiveMap = require('./case-insensitive-map.js')
-
-const querySelectorAll = require('./query-selector-all.js')
-
 class Node {
   #global
   #meta
@@ -121,14 +119,25 @@ class Node {
     // package's dependencies in a virtual root.
     this.sourceReference = sourceReference
 
-    // TODO if this came from pacote.manifest we don't have to do this,
-    // we can be told to skip this step
-    const pkg = sourceReference ? sourceReference.package
-      : normalize(options.pkg || {})
+    // have to set the internal package ref before assigning the parent, because this.package is read when adding to inventory
+    if (sourceReference) {
+      this[_package] = sourceReference.package
+    } else {
+      // TODO if this came from pacote.manifest we don't have to do this, we can be told to skip this step
+      const pkg = new PackageJson()
+      let content = {}
+      // TODO this is overly guarded.  If pkg is not an object we should not allow it at all.
+      if (options.pkg && typeof options.pkg === 'object') {
+        content = options.pkg
+      }
+      pkg.fromContent(content)
+      pkg.syncNormalize()
+      this[_package] = pkg.content
+    }
 
     this.name = name ||
-      nameFromFolder(path || pkg.name || realpath) ||
-      pkg.name ||
+      nameFromFolder(path || this.package.name || realpath) ||
+      this.package.name ||
       null
 
     // should be equal if not a link
@@ -156,13 +165,13 @@ class Node {
       // probably what we're getting from pacote, which IS trustworthy.
       //
       // Otherwise, hopefully a shrinkwrap will help us out.
-      const resolved = consistentResolve(pkg._resolved)
-      if (resolved && !(/^file:/.test(resolved) && pkg._where)) {
+      const resolved = consistentResolve(this.package._resolved)
+      if (resolved && !(/^file:/.test(resolved) && this.package._where)) {
         this.resolved = resolved
       }
     }
-    this.integrity = integrity || pkg._integrity || null
-    this.hasShrinkwrap = hasShrinkwrap || pkg._hasShrinkwrap || false
+    this.integrity = integrity || this.package._integrity || null
+    this.hasShrinkwrap = hasShrinkwrap || this.package._hasShrinkwrap || false
     this.installLinks = installLinks
     this.legacyPeerDeps = legacyPeerDeps
 
@@ -203,17 +212,13 @@ class Node {
     this.edgesIn = new Set()
     this.edgesOut = new CaseInsensitiveMap()
 
-    // have to set the internal package ref before assigning the parent,
-    // because this.package is read when adding to inventory
-    this[_package] = pkg && typeof pkg === 'object' ? pkg : {}
-
     if (overrides) {
       this.overrides = overrides
     } else if (loadOverrides) {
-      const overrides = this[_package].overrides || {}
+      const overrides = this.package.overrides || {}
       if (Object.keys(overrides).length > 0) {
         this.overrides = new OverrideSet({
-          overrides: this[_package].overrides,
+          overrides: this.package.overrides,
         })
       }
     }
@@ -314,7 +319,7 @@ class Node {
     }
 
     return getBinPaths({
-      pkg: this[_package],
+      pkg: this.package,
       path: this.path,
       global: this.global,
       top: this.globalTop,
@@ -328,11 +333,11 @@ class Node {
   }
 
   get version () {
-    return this[_package].version || ''
+    return this.package.version || ''
   }
 
   get packageName () {
-    return this[_package].name || null
+    return this.package.name || null
   }
 
   get pkgid () {
@@ -490,6 +495,18 @@ class Node {
   }
 
   shouldOmit (omitSet) {
+    if (!omitSet.size) {
+      return false
+    }
+
+    const { top } = this
+
+    // if the top is not the root or workspace then we do not want to omit it
+    if (!top.isProjectRoot && !top.isWorkspace) {
+      return false
+    }
+
+    // omit node if the dep type matches any omit flags that were set
     return (
       this.peer && omitSet.has('peer') ||
       this.dev && omitSet.has('dev') ||

package/package.json

@@ -1,38 +1,37 @@
 {
   "name": "@npmcli/arborist",
-  "version": "9.1.3",
+  "version": "9.1.5",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
     "@npmcli/fs": "^4.0.0",
     "@npmcli/installed-package-contents": "^3.0.0",
-    "@npmcli/map-workspaces": "^4.0.1",
-    "@npmcli/metavuln-calculator": "^9.0.0",
+    "@npmcli/map-workspaces": "^5.0.0",
+    "@npmcli/metavuln-calculator": "^9.0.2",
     "@npmcli/name-from-folder": "^3.0.0",
     "@npmcli/node-gyp": "^4.0.0",
-    "@npmcli/package-json": "^6.0.1",
+    "@npmcli/package-json": "^7.0.0",
     "@npmcli/query": "^4.0.0",
     "@npmcli/redact": "^3.0.0",
-    "@npmcli/run-script": "^9.0.1",
+    "@npmcli/run-script": "^10.0.0",
     "bin-links": "^5.0.0",
-    "cacache": "^19.0.1",
+    "cacache": "^20.0.1",
     "common-ancestor-path": "^1.0.1",
-    "hosted-git-info": "^8.0.0",
+    "hosted-git-info": "^9.0.0",
     "json-stringify-nice": "^1.1.4",
-    "lru-cache": "^10.2.2",
-    "minimatch": "^9.0.4",
+    "lru-cache": "^11.2.1",
+    "minimatch": "^10.0.3",
     "nopt": "^8.0.0",
     "npm-install-checks": "^7.1.0",
-    "npm-package-arg": "^12.0.0",
-    "npm-pick-manifest": "^10.0.0",
-    "npm-registry-fetch": "^18.0.1",
-    "pacote": "^21.0.0",
+    "npm-package-arg": "^13.0.0",
+    "npm-pick-manifest": "^11.0.1",
+    "npm-registry-fetch": "^19.0.0",
+    "pacote": "^21.0.2",
     "parse-conflict-json": "^4.0.0",
     "proc-log": "^5.0.0",
     "proggy": "^3.0.0",
     "promise-all-reject-late": "^1.0.0",
     "promise-call-limit": "^3.0.1",
-    "read-package-json-fast": "^4.0.0",
     "semver": "^7.3.7",
     "ssri": "^12.0.0",
     "treeverse": "^3.0.0",
@@ -41,7 +40,7 @@
   "devDependencies": {
     "@npmcli/eslint-config": "^5.0.1",
     "@npmcli/mock-registry": "^1.0.0",
-    "@npmcli/template-oss": "4.24.4",
+    "@npmcli/template-oss": "4.25.1",
     "benchmark": "^2.1.4",
     "minify-registry-metadata": "^4.0.0",
     "nock": "^13.3.3",
@@ -93,7 +92,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.24.4",
+    "version": "4.25.1",
     "content": "../../scripts/template-oss/index.js"
   }
 }