@openrewrite/rewrite 8.70.3 → 8.70.4

package/src/javascript/package-json-parser.ts

@@ -29,6 +29,8 @@ import * as fsp from "fs/promises";
 import * as path from "path";
 import * as YAML from "yaml";
 import {getLockFileDetectionConfig, runList} from "./package-manager";
+import picomatch from "picomatch";
+import {DEFAULT_DIR_EXCLUSIONS, walkDirs} from "../path-utils";
 
 /**
  * Bun.lock package entry metadata.
@@ -140,52 +142,42 @@ export class PackageJsonParser extends Parser {
     }
 
     async *parse(...inputs: ParserInput[]): AsyncGenerator<SourceFile> {
-        // Group inputs by directory to share NodeResolutionResult markers
-        const inputsByDir = new Map<string, ParserInput[]>();
+        // Cache markers by directory to share NodeResolutionResult markers
+        // but maintain input order for output
+        const markersByDir = new Map<string, NodeResolutionResult | null>();
 
+        // Process each input in order, caching markers per directory
         for (const input of inputs) {
             const filePath = parserInputFile(input);
             const dir = path.dirname(filePath);
 
-            if (!inputsByDir.has(dir)) {
-                inputsByDir.set(dir, []);
-            }
-            inputsByDir.get(dir)!.push(input);
-        }
-
-        // Process each directory's package.json files
-        for (const [dir, dirInputs] of inputsByDir) {
-            // Create a shared marker for this directory
-            let marker: NodeResolutionResult | null = null;
-
-            for (const input of dirInputs) {
-                // Parse as JSON first
-                const jsonGenerator = this.jsonParser.parse(input);
-                const jsonResult = await jsonGenerator.next();
-
-                if (jsonResult.done || !jsonResult.value) {
-                    continue;
-                }
+            // Parse as JSON first
+            const jsonGenerator = this.jsonParser.parse(input);
+            const jsonResult = await jsonGenerator.next();
 
-                const jsonDoc = jsonResult.value as Json.Document;
+            if (jsonResult.done || !jsonResult.value) {
+                continue;
+            }
 
-                // Create NodeResolutionResult marker if not already created for this directory
-                if (!marker) {
-                    marker = await this.createMarker(input, dir);
-                }
+            const jsonDoc = jsonResult.value as Json.Document;
 
-                // Attach the marker to the JSON document
-                if (marker) {
-                    yield {
-                        ...jsonDoc,
-                        markers: {
-                            ...jsonDoc.markers,
-                            markers: [...jsonDoc.markers.markers, marker]
-                        }
-                    };
-                } else {
-                    yield jsonDoc;
-                }
+            // Create NodeResolutionResult marker if not already created for this directory
+            if (!markersByDir.has(dir)) {
+                markersByDir.set(dir, await this.createMarker(input, dir));
+            }
+            const marker = markersByDir.get(dir)!;
+
+            // Attach the marker to the JSON document
+            if (marker) {
+                yield {
+                    ...jsonDoc,
+                    markers: {
+                        ...jsonDoc.markers,
+                        markers: [...jsonDoc.markers.markers, marker]
+                    }
+                };
+            } else {
+                yield jsonDoc;
             }
         }
     }
@@ -222,11 +214,24 @@ export class PackageJsonParser extends Parser {
             const projectDir = this.relativeTo || dir;
             const npmrcConfigs = await readNpmrcConfigs(projectDir);
 
+            // Detect workspace member paths if this is a workspace root
+            let workspacePackagePaths: string[] | undefined;
+            if (packageJson.workspaces) {
+                const absoluteDir = this.relativeTo && !path.isAbsolute(dir)
+                    ? path.resolve(this.relativeTo, dir)
+                    : dir;
+                workspacePackagePaths = await this.resolveWorkspacePackagePaths(
+                    packageJson.workspaces,
+                    absoluteDir,
+                    this.relativeTo
+                );
+            }
+
             return createNodeResolutionResultMarker(
                 relativePath,
                 packageJson,
                 lockContent,
-                undefined,
+                workspacePackagePaths,
                 packageManager,
                 npmrcConfigs.length > 0 ? npmrcConfigs : undefined
             );
@@ -236,6 +241,131 @@ export class PackageJsonParser extends Parser {
         }
     }
 
+    /**
+     * Resolves workspace glob patterns to actual package.json paths.
+     *
+     * Workspaces can be specified as:
+     * - Array of globs: ["packages/*", "apps/*", "packages/**", "{apps,libs}/*"]
+     * - Object with packages array: { packages: ["packages/*"] }
+     * - Negation patterns: ["packages/*", "!packages/internal"]
+     *
+     * @param workspaces The workspaces field from package.json
+     * @param projectDir The absolute path to the project directory
+     * @param relativeTo Optional base path for creating relative paths
+     * @returns Array of relative paths to workspace member package.json files
+     */
+    private async resolveWorkspacePackagePaths(
+        workspaces: string[] | { packages?: string[] },
+        projectDir: string,
+        relativeTo?: string
+    ): Promise<string[] | undefined> {
+        // Normalize workspaces to array format
+        const patterns = Array.isArray(workspaces)
+            ? workspaces
+            : workspaces.packages;
+
+        if (!patterns || patterns.length === 0) {
+            return undefined;
+        }
+
+        // Separate include and exclude patterns
+        const includePatterns = patterns.filter(p => !p.startsWith('!'));
+        const excludePatterns = patterns.filter(p => p.startsWith('!')).map(p => p.slice(1));
+
+        // Create picomatch matchers
+        const isIncluded = includePatterns.length > 0
+            ? picomatch(includePatterns, { dot: false })
+            : () => false;
+        const isExcluded = excludePatterns.length > 0
+            ? picomatch(excludePatterns, { dot: false })
+            : () => false;
+
+        // Collect all candidate directories by walking the project
+        const candidateDirs = await this.collectCandidateWorkspaceDirs(projectDir, includePatterns);
+
+        const memberPaths: string[] = [];
+        const basePath = relativeTo || projectDir;
+
+        for (const candidateDir of candidateDirs) {
+            // Get relative path from project root for pattern matching
+            const relativeDir = path.relative(projectDir, candidateDir);
+
+            // Check if directory matches include patterns and not exclude patterns
+            if (isIncluded(relativeDir) && !isExcluded(relativeDir)) {
+                const packageJsonPath = path.join(candidateDir, 'package.json');
+                if (fs.existsSync(packageJsonPath)) {
+                    const relativePath = path.relative(basePath, packageJsonPath);
+                    memberPaths.push(relativePath);
+                }
+            }
+        }
+
+        return memberPaths.length > 0 ? memberPaths : undefined;
+    }
+
+    /**
+     * Collects candidate directories that might match workspace patterns.
+     * Uses the patterns to determine how deep to scan.
+     */
+    private async collectCandidateWorkspaceDirs(
+        projectDir: string,
+        patterns: string[]
+    ): Promise<string[]> {
+        const candidates: string[] = [];
+
+        // Determine the maximum depth we need to scan based on patterns
+        // "packages/*" -> depth 1 under packages/
+        // "packages/**" -> unlimited depth under packages/
+        // "{apps,libs}/*" -> depth 1 under apps/ and libs/
+
+        for (const pattern of patterns) {
+            // Extract base directories from pattern (before any wildcards)
+            const baseDirs = this.extractBaseDirs(pattern);
+            const hasRecursive = pattern.includes('**');
+
+            for (const baseDir of baseDirs) {
+                const absoluteBaseDir = path.join(projectDir, baseDir);
+
+                if (!fs.existsSync(absoluteBaseDir)) {
+                    continue;
+                }
+
+                // Use walkDirs with appropriate depth limit
+                const dirs = await walkDirs(absoluteBaseDir, {
+                    maxDepth: hasRecursive ? undefined : 0,
+                    excludeDirs: DEFAULT_DIR_EXCLUSIONS
+                });
+
+                candidates.push(...dirs);
+            }
+        }
+
+        return candidates;
+    }
+
+    /**
+     * Extracts base directory paths from a glob pattern.
+     * Handles brace expansion like "{apps,libs}/*" -> ["apps", "libs"]
+     */
+    private extractBaseDirs(pattern: string): string[] {
+        // Find the first wildcard character
+        const wildcardIndex = pattern.search(/[*?]/);
+        const beforeWildcard = wildcardIndex >= 0 ? pattern.slice(0, wildcardIndex) : pattern;
+
+        // Remove trailing slash if present
+        const basePath = beforeWildcard.replace(/\/$/, '');
+
+        // Handle brace expansion at the end of basePath: "dir/{a,b}" or "{a,b}"
+        const braceMatch = basePath.match(/^(.*?)(?:\{([^}]+)\})?$/);
+        if (braceMatch && braceMatch[2]) {
+            const prefix = braceMatch[1];
+            const options = braceMatch[2].split(',').map(s => s.trim());
+            return options.map(opt => prefix + opt);
+        }
+
+        return basePath ? [basePath] : ['.'];
+    }
+
     /**
      * Attempts to find and read a lock file by walking up the directory tree.
      * Starts from the directory containing the package.json and walks up toward

package/src/javascript/package-manager.ts

@@ -19,8 +19,7 @@ import {
     findNodeResolutionResult,
     PackageJsonContent,
     PackageLockContent,
-    PackageManager,
-    readNpmrcConfigs
+    PackageManager
 } from "./node-resolution-result";
 import {replaceMarkerByKind} from "../markers";
 import {Json, JsonParser, JsonVisitor} from "../json";
@@ -59,35 +58,37 @@ interface PackageManagerConfig {
 const PACKAGE_MANAGER_CONFIGS: Record<PackageManager, PackageManagerConfig> = {
     [PackageManager.Npm]: {
         lockFile: 'package-lock.json',
-        installLockOnlyCommand: ['npm', 'install', '--package-lock-only'],
-        installCommand: ['npm', 'install'],
+        // --ignore-scripts prevents prepublish/prepare scripts from running in temp directory
+        installLockOnlyCommand: ['npm', 'install', '--package-lock-only', '--ignore-scripts'],
+        installCommand: ['npm', 'install', '--ignore-scripts'],
         listCommand: ['npm', 'list', '--json', '--all'],
     },
     [PackageManager.YarnClassic]: {
         lockFile: 'yarn.lock',
-        // Yarn Classic doesn't have a lock-only mode
+        // Yarn Classic doesn't have a lock-only mode; --ignore-scripts prevents lifecycle scripts
         installLockOnlyCommand: ['yarn', 'install', '--ignore-scripts'],
-        installCommand: ['yarn', 'install'],
+        installCommand: ['yarn', 'install', '--ignore-scripts'],
         listCommand: ['yarn', 'list', '--json'],
     },
     [PackageManager.YarnBerry]: {
         lockFile: 'yarn.lock',
-        // Yarn Berry's mode skip-build skips post-install scripts
+        // --mode skip-build skips post-install scripts in Yarn Berry
         installLockOnlyCommand: ['yarn', 'install', '--mode', 'skip-build'],
-        installCommand: ['yarn', 'install'],
+        installCommand: ['yarn', 'install', '--mode', 'skip-build'],
         listCommand: ['yarn', 'info', '--all', '--json'],
     },
     [PackageManager.Pnpm]: {
         lockFile: 'pnpm-lock.yaml',
-        installLockOnlyCommand: ['pnpm', 'install', '--lockfile-only'],
-        installCommand: ['pnpm', 'install'],
+        // --ignore-scripts prevents lifecycle scripts from running in temp directory
+        installLockOnlyCommand: ['pnpm', 'install', '--lockfile-only', '--ignore-scripts'],
+        installCommand: ['pnpm', 'install', '--ignore-scripts'],
         listCommand: ['pnpm', 'list', '--json', '--depth=Infinity'],
     },
     [PackageManager.Bun]: {
         lockFile: 'bun.lock',
-        // Bun doesn't have a lock-only mode, but is very fast anyway
+        // Bun doesn't have a lock-only mode; --ignore-scripts prevents lifecycle scripts
         installLockOnlyCommand: ['bun', 'install', '--ignore-scripts'],
-        installCommand: ['bun', 'install'],
+        installCommand: ['bun', 'install', '--ignore-scripts'],
     },
 };
 
@@ -447,8 +448,6 @@ export async function parseLockFileContent(
  * Recipes extend this with additional fields specific to their needs.
  */
 export interface BaseProjectUpdateInfo {
-    /** Absolute path to the project directory */
-    projectDir: string;
     /** Relative path to package.json (from source root) */
     packageJsonPath: string;
     /** The package manager used by this project */
@@ -559,17 +558,15 @@ export async function updateNodeResolutionMarker<T extends BaseProjectUpdateInfo
         }
     }
 
-    // Read npmrc configs from the project directory
-    const npmrcConfigs = await readNpmrcConfigs(updateInfo.projectDir);
-
-    // Create new marker
+    // Create new marker, preserving existing npmrc configs from the parser
+    // (recipes don't have filesystem access to re-read them)
     const newMarker = createNodeResolutionResultMarker(
         existingMarker.path,
         packageJsonContent,
         lockContent,
         existingMarker.workspacePackagePaths,
         existingMarker.packageManager,
-        npmrcConfigs.length > 0 ? npmrcConfigs : undefined
+        existingMarker.npmrcConfigs
     );
 
     // Replace the marker in the document
@@ -591,52 +588,72 @@ export interface TempInstallOptions {
      * Default: true (lock-only is faster and sufficient for most cases)
      */
     lockOnly?: boolean;
+    /**
+     * Original lock file content to use. If provided, this content will be written
+     * to the temp directory instead of copying from projectDir.
+     * This allows recipes to work with in-memory SourceFiles without filesystem access.
+     */
+    originalLockFileContent?: string;
+    /**
+     * Config file contents to use. Keys are filenames (e.g., '.npmrc'), values are content.
+     * If provided, these will be written to the temp directory instead of copying from projectDir.
+     */
+    configFiles?: Record<string, string>;
 }
 
 /**
- * Runs package manager install in a temporary directory.
- *
- * This function:
- * 1. Creates a temp directory
- * 2. Writes the provided package.json content
- * 3. Copies the existing lock file (if present)
- * 4. Copies config files (.npmrc, .yarnrc, etc.)
- * 5. Runs the package manager install
- * 6. Returns the updated lock file content
- * 7. Cleans up the temp directory
- *
- * @param projectDir The original project directory (for copying lock file and configs)
- * @param pm The package manager to use
- * @param modifiedPackageJson The modified package.json content to use
- * @param options Optional settings for timeout and lock-only mode
- * @returns Result containing success status and lock file content or error
+ * Options for running install in a temporary directory with workspace support.
  */
-export async function runInstallInTempDir(
-    projectDir: string,
+export interface WorkspaceTempInstallOptions extends TempInstallOptions {
+    /**
+     * Workspace package.json files. Keys are relative paths from the project root
+     * (e.g., "packages/foo/package.json"), values are the package.json content.
+     * The root package.json should have a "workspaces" field pointing to these packages.
+     */
+    workspacePackages?: Record<string, string>;
+}
+
+/**
+ * Internal implementation for running package manager install in a temporary directory.
+ * Supports both simple projects and workspaces.
+ */
+async function runInstallInTempDirCore(
     pm: PackageManager,
-    modifiedPackageJson: string,
-    options: TempInstallOptions = {}
+    rootPackageJson: string,
+    options: WorkspaceTempInstallOptions = {}
 ): Promise<TempInstallResult> {
-    const {timeout = 120000, lockOnly = true} = options;
+    const {
+        timeout = 120000,
+        lockOnly = true,
+        originalLockFileContent,
+        configFiles: configFileContents,
+        workspacePackages
+    } = options;
     const lockFileName = getLockFileName(pm);
     const tempDir = await fsp.mkdtemp(path.join(os.tmpdir(), 'openrewrite-pm-'));
 
     try {
-        // Write modified package.json to temp directory
-        await fsp.writeFile(path.join(tempDir, 'package.json'), modifiedPackageJson);
+        // Write root package.json to temp directory
+        await fsp.writeFile(path.join(tempDir, 'package.json'), rootPackageJson);
+
+        // Write workspace package.json files (creating subdirectories as needed)
+        if (workspacePackages) {
+            for (const [relativePath, content] of Object.entries(workspacePackages)) {
+                const fullPath = path.join(tempDir, relativePath);
+                await fsp.mkdir(path.dirname(fullPath), {recursive: true});
+                await fsp.writeFile(fullPath, content);
+            }
+        }
 
-        // Copy existing lock file if present
-        const originalLockPath = path.join(projectDir, lockFileName);
-        if (fs.existsSync(originalLockPath)) {
-            await fsp.copyFile(originalLockPath, path.join(tempDir, lockFileName));
+        // Write lock file if provided
+        if (originalLockFileContent !== undefined) {
+            await fsp.writeFile(path.join(tempDir, lockFileName), originalLockFileContent);
         }
 
-        // Copy config files if present (for registry configuration and workspace setup)
-        const configFiles = ['.npmrc', '.yarnrc', '.yarnrc.yml', '.pnpmfile.cjs', 'pnpm-workspace.yaml'];
-        for (const configFile of configFiles) {
-            const configPath = path.join(projectDir, configFile);
-            if (fs.existsSync(configPath)) {
-                await fsp.copyFile(configPath, path.join(tempDir, configFile));
+        // Write config files if provided
+        if (configFileContents) {
+            for (const [configFile, content] of Object.entries(configFileContents)) {
+                await fsp.writeFile(path.join(tempDir, configFile), content);
             }
         }
 
@@ -688,6 +705,57 @@ export async function runInstallInTempDir(
     }
 }
 
+/**
+ * Runs package manager install in a temporary directory.
+ *
+ * This function:
+ * 1. Creates a temp directory
+ * 2. Writes the provided package.json content
+ * 3. Writes the lock file content (if provided)
+ * 4. Writes config files (if provided)
+ * 5. Runs the package manager install
+ * 6. Returns the updated lock file content
+ * 7. Cleans up the temp directory
+ *
+ * @param pm The package manager to use
+ * @param modifiedPackageJson The modified package.json content to use
+ * @param options Optional settings for timeout, lock-only mode, and file contents
+ * @returns Result containing success status and lock file content or error
+ */
+export async function runInstallInTempDir(
+    pm: PackageManager,
+    modifiedPackageJson: string,
+    options: TempInstallOptions = {}
+): Promise<TempInstallResult> {
+    return runInstallInTempDirCore(pm, modifiedPackageJson, options);
+}
+
+/**
+ * Runs package manager install in a temporary directory with workspace support.
+ *
+ * This function:
+ * 1. Creates a temp directory
+ * 2. Writes the root package.json content
+ * 3. Writes workspace package.json files (creating subdirectories as needed)
+ * 4. Writes the lock file content (if provided)
+ * 5. Writes config files (if provided)
+ * 6. Runs the package manager install at the root
+ * 7. Returns the updated lock file content
+ * 8. Cleans up the temp directory
+ *
+ * @param pm The package manager to use
+ * @param rootPackageJson The root package.json content (should contain "workspaces" field)
+ * @param options Optional settings including workspace packages, timeout, lock-only mode, and file contents
+ * @returns Result containing success status and lock file content or error
+ */
+export async function runWorkspaceInstallInTempDir(
+    pm: PackageManager,
+    rootPackageJson: string,
+    options: WorkspaceTempInstallOptions = {}
+): Promise<TempInstallResult> {
+    return runInstallInTempDirCore(pm, rootPackageJson, options);
+}
+
 /**
  * Creates a lock file visitor that handles updating YAML lock files (pnpm-lock.yaml).
  * This is a reusable component for dependency recipes.