@ohos-ports/nx 23.2.1-beta.0 → 23.2.1-beta.1

package/dist/src/utils/min-release-age/behavior/yarn.js

@@ -0,0 +1,314 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readYarnPolicy = readYarnPolicy;
+exports.pickYarnVersion = pickYarnVersion;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const minimatch_1 = require("minimatch");
+const semver_1 = require("semver");
+const constants_1 = require("../constants");
+const errors_1 = require("../errors");
+const pick_1 = require("../pick");
+// yarn 4.15.0+ default gate is `1d` (1440 minutes); the lockfile-migration
+// escape only fires for the default-only window.
+const DEFAULT_WINDOW_MINUTES = 1440;
+/**
+ * Reads yarn berry's effective cooldown config. yarn resolves its own rc chain
+ * (project + home .yarnrc.yml), env (`YARN_NPM_MINIMAL_AGE_GATE`) and defaults,
+ * so we ask it for the resolved values via `yarn config get ... --json` rather
+ * than merging rc files ourselves. The returned `npmMinimalAgeGate` is already
+ * normalized to minutes (DURATION >=4.11; parseInt minutes on 4.10.x). On 4.15+
+ * we still mirror yarn's first-install migration that opts old lockfiles out of
+ * the new default gate.
+ */
+async function readYarnPolicy(root, pmVersion) {
+    let gateMinutes;
+    let preapproved;
+    try {
+        gateMinutes = readGateMinutes(root);
+        preapproved = readPreapprovedPackages(root);
+    }
+    catch {
+        // `yarn config get` itself throws on an unparseable duration (>=4.11) or
+        // when yarn cannot load; let callers fall back to a real install.
+        return {
+            outcome: 'ambiguous',
+            reason: 'Unable to read the effective yarn configuration.',
+        };
+    }
+    // NaN comes back as JSON null (4.10.x parseInt of a non-numeric value);
+    // yarn's falsy guard treats it as no gate.
+    if (gateMinutes === null || !Number.isFinite(gateMinutes)) {
+        return { outcome: 'inactive' };
+    }
+    // 0 disables; negative pushes the cutoff into the future (everything passes).
+    if (gateMinutes <= 0) {
+        return { outcome: 'inactive' };
+    }
+    if (isDefaultLockfileMigrationEscape(root, pmVersion, gateMinutes, preapproved)) {
+        return { outcome: 'inactive' };
+    }
+    const windowMs = gateMinutes * constants_1.MS_PER_MINUTE;
+    const cutoffMs = Date.now() - windowMs;
+    const matcher = compileExcludeMatchers(preapproved);
+    // 4.10.0-4.10.1 pass a version with no time entry; >=4.10.2 quarantines it.
+    const missingVersionTime = (0, semver_1.lt)(pmVersion, '4.10.2') ? 'pass' : 'quarantine';
+    return {
+        outcome: 'active',
+        policy: {
+            packageManagerVersion: pmVersion,
+            cutoffMs,
+            windowMs,
+            sourceDescription: `yarn npmMinimalAgeGate (${gateMinutes} min)`,
+            isExcluded: (name, version) => matcher(name, version),
+            behavior: { packageManager: 'yarn', missingVersionTime },
+        },
+    };
+}
+function readGateMinutes(root) {
+    const raw = (0, child_process_1.execSync)('yarn config get npmMinimalAgeGate --json', {
+        cwd: root,
+        encoding: 'utf-8',
+        windowsHide: true,
+    }).trim();
+    if (!raw) {
+        return null;
+    }
+    const parsed = JSON.parse(raw);
+    return typeof parsed === 'number' ? parsed : null;
+}
+function readPreapprovedPackages(root) {
+    const raw = (0, child_process_1.execSync)('yarn config get npmPreapprovedPackages --json', {
+        cwd: root,
+        encoding: 'utf-8',
+        windowsHide: true,
+    }).trim();
+    if (!raw) {
+        return [];
+    }
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed)
+        ? parsed.filter((entry) => typeof entry === 'string')
+        : [];
+}
+/**
+ * On 4.15.0+ yarn's first `install` writes `npmMinimalAgeGate: 0` into the
+ * project .yarnrc.yml for pre-v10 lockfiles when the key is unset, so existing
+ * projects permanently opt out of the new default gate. We mirror that: the
+ * default-only window does not apply to a project whose lockfile predates v10
+ * and that has not explicitly set the gate. A missing lockfile means a fresh
+ * project, where the default does apply.
+ */
+function isDefaultLockfileMigrationEscape(root, pmVersion, gateMinutes, preapproved) {
+    if ((0, semver_1.lt)(pmVersion, '4.15.0')) {
+        return false;
+    }
+    if (gateMinutes !== DEFAULT_WINDOW_MINUTES) {
+        return false;
+    }
+    if (isGateExplicitlySet(root)) {
+        return false;
+    }
+    const lockfileVersion = readLockfileMetadataVersion(root);
+    // Missing lockfile -> fresh project -> default applies (no escape).
+    if (lockfileVersion === null) {
+        return false;
+    }
+    return lockfileVersion < 10;
+}
+/**
+ * Explicitness check only (NOT value merging): the migration gate is
+ * `configuration.sources.get('npmMinimalAgeGate') === undefined`, so the gate
+ * counts as explicitly set when the key appears in ANY rc file yarn would load
+ * (every ancestor .yarnrc.yml from root up to the filesystem root, plus home -
+ * mirroring Configuration.findRcFiles) or the `YARN_NPM_MINIMAL_AGE_GATE` env
+ * var is present.
+ */
+function isGateExplicitlySet(root) {
+    if (process.env.YARN_NPM_MINIMAL_AGE_GATE !== undefined) {
+        return true;
+    }
+    let dir = root;
+    let prev = null;
+    while (dir !== prev) {
+        if (yarnrcHasGateKey((0, path_1.join)(dir, '.yarnrc.yml'))) {
+            return true;
+        }
+        prev = dir;
+        dir = (0, path_1.dirname)(dir);
+    }
+    return yarnrcHasGateKey((0, path_1.join)((0, os_1.homedir)(), '.yarnrc.yml'));
+}
+function yarnrcHasGateKey(file) {
+    if (!(0, fs_1.existsSync)(file)) {
+        return false;
+    }
+    try {
+        // A top-level scalar key in .yarnrc.yml; a simple line check avoids pulling
+        // a YAML parser for an explicitness probe.
+        return (0, fs_1.readFileSync)(file, 'utf-8')
+            .split('\n')
+            .some((line) => /^\s*npmMinimalAgeGate\s*:/.test(line));
+    }
+    catch {
+        return false;
+    }
+}
+function readLockfileMetadataVersion(root) {
+    const file = (0, path_1.join)(root, 'yarn.lock');
+    if (!(0, fs_1.existsSync)(file)) {
+        return null;
+    }
+    try {
+        const content = (0, fs_1.readFileSync)(file, 'utf-8');
+        // yarn.lock encodes `__metadata:\n  version: N`; read just that field.
+        const match = content.match(/^__metadata:\s*\n(?:\s+.*\n)*?\s+version:\s*(\d+)/m);
+        if (match) {
+            return Number(match[1]);
+        }
+        // A legacy yarn-classic v1 lockfile has no __metadata; Project sets
+        // lockfileLastVersion = -1, which the `v => v < 10` migration selector
+        // matches (escape applies), distinct from a missing lockfile (null).
+        return content.includes('yarn lockfile v1') ? -1 : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Compiles `npmPreapprovedPackages` descriptors into a name/version matcher:
+ * bare ident bypasses any version, `name@<range>` bypasses matching versions,
+ * and a glob on the name (with or without a range) bypasses matching packages.
+ * Case-sensitive; an unparseable entry yields no bypass.
+ */
+function compileExcludeMatchers(entries) {
+    const matchers = entries
+        .map(parseExcludeEntry)
+        .filter((m) => m !== null);
+    if (matchers.length === 0) {
+        return () => false;
+    }
+    return (name, version) => matchers.some((m) => m(name, version));
+}
+function parseExcludeEntry(entry) {
+    const { name, range } = splitDescriptor(entry);
+    if (!name) {
+        return null;
+    }
+    // checkIdent matches the ident first (exact identHash OR an unconditional
+    // micromatch) and only then applies the range, so run minimatch on every
+    // entry - no isGlob gate - to catch extglobs (`+(...)`, `@(...)`) yarn would
+    // glob-match. Residual: minimatch and micromatch disagree on `!(foo)`
+    // negation, which cannot be reconciled without micromatch (not an allowed
+    // dep).
+    const nameMatches = (pkg) => pkg === name || (0, minimatch_1.minimatch)(pkg, name);
+    if (range) {
+        if (!(0, semver_1.validRange)(range)) {
+            // yarn parses the version part as a semver range; an invalid one bypasses
+            // nothing.
+            return null;
+        }
+        // Plain semver Range.test (no includePrerelease): a stable range does not
+        // pre-approve a prerelease.
+        return (pkg, version) => nameMatches(pkg) && (0, semver_1.satisfies)(version, range);
+    }
+    // Bare ident or name glob: any version of a name-matching package.
+    return (pkg) => nameMatches(pkg);
+}
+/**
+ * Splits a descriptor into name and optional range, honoring scoped names where
+ * the leading `@` is part of the package name rather than a version separator.
+ */
+function splitDescriptor(entry) {
+    const { name, versionPart } = (0, pick_1.splitPackageDescriptor)(entry);
+    return { name, range: versionPart || null };
+}
+/**
+ * yarn resolution under an active cooldown. Exact pins and ranges mirror yarn
+ * berry's NpmSemverResolver gate; dist-tag degrade uses the shared cross-PM rule:
+ * - exact/range: newest approved match; none approved -> violation (YN0016
+ *   wording >=4.13, YN0082 wording <4.13).
+ * - dist-tag too new -> degrade via the shared channel-aware rule (see
+ *   `degradeTagToCompliant` for the ordering); none compliant -> violation.
+ */
+function pickYarnVersion(spec, metadata, policy) {
+    const type = (0, pick_1.classifySpec)(spec);
+    if (type === 'exact') {
+        if (isApproved(metadata, policy, spec)) {
+            return { version: spec, unconstrained: spec };
+        }
+        throw quarantined(metadata, policy, spec, [spec]);
+    }
+    if (type === 'tag') {
+        return pickTag(spec, metadata, policy);
+    }
+    return pickRange(spec, metadata, policy, (0, pick_1.newestInRange)(metadata, spec));
+}
+function pickTag(spec, metadata, policy) {
+    const target = metadata.distTags[spec];
+    if (!target) {
+        throw quarantined(metadata, policy, spec, []);
+    }
+    const unconstrained = target;
+    if (isApproved(metadata, policy, target)) {
+        return { version: target, unconstrained };
+    }
+    const degraded = (0, pick_1.degradeTagToCompliant)(target, metadata, (v) => isApproved(metadata, policy, v));
+    if (degraded) {
+        return { version: degraded, unconstrained };
+    }
+    throw quarantined(metadata, policy, spec, [target]);
+}
+function pickRange(spec, metadata, policy, unconstrained) {
+    const inRange = metadata.versions
+        .filter((v) => (0, semver_1.satisfies)(v, spec, { includePrerelease: false }))
+        .sort(semver_1.rcompare);
+    const approved = inRange.filter((v) => isApproved(metadata, policy, v));
+    if (approved.length > 0) {
+        return {
+            version: approved[0],
+            unconstrained,
+        };
+    }
+    throw quarantined(metadata, policy, spec, inRange);
+}
+/**
+ * yarn approval combines the maturity test with its missing-time policy: a
+ * version with no time entry passes on 4.10.0-4.10.1 but is quarantined on
+ * >=4.10.2, and a whole missing time map quarantines everything (>=4.10.2).
+ * Excludes bypass the gate regardless.
+ */
+function isApproved(metadata, policy, version) {
+    if (policy.isExcluded(metadata.name, version)) {
+        return true;
+    }
+    const behavior = policy.behavior;
+    if (behavior.packageManager !== 'yarn') {
+        throw new Error('isApproved received a non-yarn policy.');
+    }
+    const hasTime = !!metadata.time && metadata.time[version] !== undefined;
+    if (!hasTime) {
+        return behavior.missingVersionTime === 'pass';
+    }
+    return Date.parse(metadata.time[version]) <= policy.cutoffMs;
+}
+function quarantined(metadata, policy, spec, blockedVersions) {
+    // YN0016 wording landed in 4.13.0; earlier versions surface the generic
+    // YN0082 "No candidates found" shape.
+    const detail = (0, semver_1.lt)(policy.packageManagerVersion, '4.13.0')
+        ? `${metadata.name}@${spec}: No candidates found`
+        : `All versions satisfying "${spec}" are quarantined`;
+    return new errors_1.MinReleaseAgeViolationError({
+        packageManager: 'yarn',
+        packageName: metadata.name,
+        spec,
+        pmShapedDetail: detail,
+        blocked: (0, pick_1.blockedVersionsFrom)(metadata, blockedVersions),
+        remediation: [remediationHint(metadata, policy)],
+    });
+}
+function remediationHint(metadata, policy) {
+    return `Wait until a matching version is older than the configured window, lower ${policy.sourceDescription}, or add ${metadata.name} to npmPreapprovedPackages in .yarnrc.yml.`;
+}

package/dist/src/utils/min-release-age/constants.d.ts

@@ -0,0 +1,3 @@
+export declare const MS_PER_SECOND = 1000;
+export declare const MS_PER_MINUTE = 60000;
+export declare const MS_PER_DAY = 86400000;

package/dist/src/utils/min-release-age/constants.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MS_PER_DAY = exports.MS_PER_MINUTE = exports.MS_PER_SECOND = void 0;
+// Shared time constants. The window UNIT differs per PM (npm: days, pnpm/yarn:
+// minutes, bun: seconds); each reader converts its value to ms using these.
+exports.MS_PER_SECOND = 1_000;
+exports.MS_PER_MINUTE = 60_000;
+exports.MS_PER_DAY = 86_400_000;

package/dist/src/utils/min-release-age/errors.d.ts

@@ -0,0 +1,28 @@
+import type { PackageManager } from '../package-manager';
+export interface BlockedVersion {
+    version: string;
+    publishedAt: string;
+}
+export interface MinReleaseAgeViolationErrorOptions {
+    packageManager: PackageManager;
+    packageName: string;
+    spec: string;
+    pmShapedDetail: string;
+    blocked: BlockedVersion[];
+    remediation: string[];
+}
+/**
+ * Raised when the user's package manager, at its detected version, would refuse
+ * to resolve a version because it falls inside the minimum-release-age window.
+ * Carries the PM-shaped detail and the blocked candidates so the migrate layer
+ * can surface a friendly message or a PM-specific prompt.
+ */
+export declare class MinReleaseAgeViolationError extends Error {
+    readonly packageManager: PackageManager;
+    readonly packageName: string;
+    readonly spec: string;
+    readonly pmShapedDetail: string;
+    readonly blocked: BlockedVersion[];
+    readonly remediation: string[];
+    constructor(opts: MinReleaseAgeViolationErrorOptions);
+}

package/dist/src/utils/min-release-age/errors.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MinReleaseAgeViolationError = void 0;
+/**
+ * Raised when the user's package manager, at its detected version, would refuse
+ * to resolve a version because it falls inside the minimum-release-age window.
+ * Carries the PM-shaped detail and the blocked candidates so the migrate layer
+ * can surface a friendly message or a PM-specific prompt.
+ */
+class MinReleaseAgeViolationError extends Error {
+    constructor(opts) {
+        super(opts.pmShapedDetail);
+        this.name = 'MinReleaseAgeViolationError';
+        this.packageManager = opts.packageManager;
+        this.packageName = opts.packageName;
+        this.spec = opts.spec;
+        this.pmShapedDetail = opts.pmShapedDetail;
+        this.blocked = opts.blocked;
+        this.remediation = opts.remediation;
+    }
+}
+exports.MinReleaseAgeViolationError = MinReleaseAgeViolationError;

package/dist/src/utils/min-release-age/packument.d.ts

@@ -0,0 +1,13 @@
+export interface RegistryMetadata {
+    name: string;
+    versions: string[];
+    time: Record<string, string> | null;
+    distTags: Record<string, string>;
+}
+/**
+ * Fetches the full packument for a package and normalizes the quirks of
+ * `npm view --json`: `versions` may be a scalar when a single version exists,
+ * `time` may be absent (third-party registries) and is exposed as null,
+ * `dist-tags` carries a hyphen.
+ */
+export declare function fetchRegistryMetadata(pkg: string): Promise<RegistryMetadata>;

package/dist/src/utils/min-release-age/packument.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchRegistryMetadata = fetchRegistryMetadata;
+const package_manager_1 = require("../package-manager");
+// `npm view <pkg> --json` collapses single-element fields to scalars.
+function toArray(value) {
+    if (value === undefined) {
+        return [];
+    }
+    return Array.isArray(value) ? value : [value];
+}
+/**
+ * Fetches the full packument for a package and normalizes the quirks of
+ * `npm view --json`: `versions` may be a scalar when a single version exists,
+ * `time` may be absent (third-party registries) and is exposed as null,
+ * `dist-tags` carries a hyphen.
+ */
+async function fetchRegistryMetadata(pkg) {
+    const raw = await (0, package_manager_1.packageRegistryView)(pkg, '', ['--json']);
+    const parsed = JSON.parse(raw);
+    const time = parsed.time ?? null;
+    if (time) {
+        // The time map carries 'created'/'modified' alongside versions; they are
+        // harmless to keep but never referenced as versions.
+        delete time.created;
+        delete time.modified;
+    }
+    return {
+        name: parsed.name ?? pkg,
+        versions: toArray(parsed.versions),
+        time,
+        distTags: parsed['dist-tags'] ?? {},
+    };
+}

package/dist/src/utils/min-release-age/pick.d.ts

@@ -0,0 +1,72 @@
+import type { BlockedVersion } from './errors';
+import type { RegistryMetadata } from './packument';
+import type { MinReleaseAgePolicy } from './policy';
+export type VersionSpecType = 'exact' | 'range' | 'tag';
+export interface PickOutcome {
+    version: string;
+    unconstrained: string;
+    immature?: boolean;
+}
+/**
+ * Classifies a version spec the way the package managers do: an exact semver is
+ * a pin, a valid range is a range, anything else (latest, hot, canary, ...) is
+ * a dist-tag. Catalog refs are dereferenced before this layer.
+ */
+export declare function classifySpec(spec: string): VersionSpecType;
+/**
+ * Splits an npm package descriptor into its name and the raw version part after
+ * the separating `@`, honoring scoped names where the leading `@` is part of the
+ * name. `versionPart` is null when there is no separator (bare name) and an
+ * empty string for a trailing `@`; callers interpret the version part.
+ */
+export declare function splitPackageDescriptor(entry: string): {
+    name: string;
+    versionPart: string | null;
+};
+/**
+ * Shared maturity test: a version passes when its publish time is at or before
+ * the cutoff (inclusive), or when it is explicitly excluded.
+ */
+export declare function isVersionMature(name: string, version: string, metadata: RegistryMetadata, policy: MinReleaseAgePolicy): boolean;
+/**
+ * Newest version satisfying the range, ignoring the cooldown gate. Used only to
+ * compute PickOutcome.unconstrained (messaging); never gates a pick. Falls back
+ * to the raw range when nothing matches.
+ */
+export declare function newestInRange(metadata: RegistryMetadata, range: string): string;
+/**
+ * Degrades a too-new dist-tag target to a cooldown-compliant version "of the
+ * same kind", shared by every package manager.
+ *
+ * The candidate pool is every version at or below the resolved target that is
+ * stable, in the target's prerelease channel, or on a lower rung of the
+ * channel ladder (alpha < beta < rc). It is ordered so that prereleases of
+ * the target's exact release line come first - own channel, then lower rungs -
+ * then everything else; within each group the most recently published version
+ * comes first (semver breaks ties and orders versions with no publish time).
+ * The first compliant version in that order wins.
+ *
+ * So a stable target degrades to the newest compliant stable, and a prerelease
+ * target keeps a compliant prerelease of the release it points at when one
+ * exists (an rc may fall to a same-line beta), otherwise drops to the newest
+ * compliant version below it - never crossing into a channel with no place on
+ * the ladder (e.g. an internal `pr` build) and never climbing up it. Returns
+ * null when nothing in the pool is compliant; callers turn that into their
+ * package manager's violation.
+ *
+ * `isCompliant` is the caller's per-PM maturity test (package managers differ
+ * on missing publish times and excludes).
+ */
+export declare function degradeTagToCompliant(target: string, metadata: RegistryMetadata, isCompliant: (version: string) => boolean): string | null;
+/**
+ * Maps a list of held-back versions to the blocked-candidate shape carried by
+ * MinReleaseAgeViolationError, keeping only versions the registry has a publish
+ * time for.
+ */
+export declare function blockedVersionsFrom(metadata: RegistryMetadata, versions: string[]): BlockedVersion[];
+/**
+ * Resolves a spec to a version that complies with the effective cooldown
+ * policy, dispatching to the per-PM pick rules. Throws
+ * MinReleaseAgeViolationError when the PM at this version would fail.
+ */
+export declare function pickMinReleaseAgeCompliantVersion(spec: string, metadata: RegistryMetadata, policy: MinReleaseAgePolicy): PickOutcome;