@packall/core 0.1.0 → 0.2.0

package/src/lockfile/tree-builder.ts

@@ -4,13 +4,14 @@
  * Packages, edges and skip warnings accumulate here while a parser walks a
  * file, which is what lets each parser stay focused on its own encoding.
  */
-import semver from "semver"
-import { parseDependencyTarget } from "../dependency-range.js"
-import { LockedRootKind } from "../enums/edge-kind.js"
-import type { LockfileFormat } from "../enums/lockfile-format.js"
-import { LockfileError } from "../errors.js"
-import { packageKey } from "../resolve.js"
-import type { LockedEdge, LockedPackage, LockedRoot, LockedTree } from "./types.js"
+import semver from "semver";
+
+import { parseDependencyTarget } from "../dependency-range.js";
+import { LockedRootKind } from "../enums/edge-kind.js";
+import type { LockfileFormat } from "../enums/lockfile-format.js";
+import { LockfileError } from "../errors.js";
+import { packageKey } from "../resolve.js";
+import type { LockedEdge, LockedPackage, LockedRoot, LockedTree } from "./types.js";
 
 /**
  * Which manifest block each root kind is declared in.
@@ -20,101 +21,101 @@ import type { LockedEdge, LockedPackage, LockedRoot, LockedTree } from "./types.
  * rather than iterating this.
  */
 export const fieldByRootKind = {
-  [LockedRootKind.Prod]: "dependencies",
-  [LockedRootKind.Optional]: "optionalDependencies",
-  [LockedRootKind.Dev]: "devDependencies",
-  [LockedRootKind.Peer]: "peerDependencies"
-} as const satisfies Record<LockedRootKind, string>
+	[LockedRootKind.Prod]: "dependencies",
+	[LockedRootKind.Optional]: "optionalDependencies",
+	[LockedRootKind.Dev]: "devDependencies",
+	[LockedRootKind.Peer]: "peerDependencies",
+} as const satisfies Record<LockedRootKind, string>;
 
 export class TreeBuilder {
-  readonly packages = new Map<string, LockedPackage>()
-  readonly roots: Array<LockedRoot> = []
-  readonly warnings: Array<string> = []
-  readonly incomplete: Array<string> = []
-  /** Names dropped on purpose, so an edge into one is explained, not alarming. */
-  private readonly skipped = new Set<string>()
-  private readonly seenWarnings = new Set<string>()
+	readonly packages = new Map<string, LockedPackage>();
+	readonly roots: Array<LockedRoot> = [];
+	readonly warnings: Array<string> = [];
+	readonly incomplete: Array<string> = [];
+	/** Names dropped on purpose, so an edge into one is explained, not alarming. */
+	private readonly skipped = new Set<string>();
+	private readonly seenWarnings = new Set<string>();
 
-  add(pkg: LockedPackage): void {
-    const key = packageKey(pkg.name, pkg.version)
-    const existing = this.packages.get(key)
-    if (existing === undefined) {
-      this.packages.set(key, pkg)
-      return
-    }
-    // The same package at the same version can appear at several paths in a
-    // nested layout. They are the same bytes; merge the edge sets so a copy
-    // recorded with fewer dependencies does not lose any.
-    this.packages.set(key, {
-      ...existing,
-      dependencies: mergeEdges(existing.dependencies, pkg.dependencies)
-    })
-  }
+	add(pkg: LockedPackage): void {
+		const key = packageKey(pkg.name, pkg.version);
+		const existing = this.packages.get(key);
+		if (existing === undefined) {
+			this.packages.set(key, pkg);
+			return;
+		}
+		// The same package at the same version can appear at several paths in a
+		// nested layout. They are the same bytes; merge the edge sets so a copy
+		// recorded with fewer dependencies does not lose any.
+		this.packages.set(key, {
+			...existing,
+			dependencies: mergeEdges(existing.dependencies, pkg.dependencies),
+		});
+	}
 
-  addRoot(root: LockedRoot): void {
-    if (this.roots.some((existing) => existing.name === root.name)) return
-    this.roots.push(root)
-  }
+	addRoot(root: LockedRoot): void {
+		if (this.roots.some((existing) => existing.name === root.name)) return;
+		this.roots.push(root);
+	}
 
-  warn(message: string): void {
-    if (this.seenWarnings.has(message)) return
-    this.seenWarnings.add(message)
-    this.warnings.push(message)
-  }
+	warn(message: string): void {
+		if (this.seenWarnings.has(message)) return;
+		this.seenWarnings.add(message);
+		this.warnings.push(message);
+	}
 
-  /** Notes an entry that is real but cannot come from a registry. */
-  skip(name: string, spec: string, reason: string): void {
-    this.skipped.add(name)
-    this.warn(`skipped ${name}@${spec} (${reason}) — not fetchable from a registry`)
-  }
+	/** Notes an entry that is real but cannot come from a registry. */
+	skip(name: string, spec: string, reason: string): void {
+		this.skipped.add(name);
+		this.warn(`skipped ${name}@${spec} (${reason}) — not fetchable from a registry`);
+	}
 
-  /**
-   * Records a required edge that resolved to nothing.
-   *
-   * An edge into something skipped on purpose is expected — you cannot bundle a
-   * `workspace:` sibling from a registry — so it stays a warning. Anything else
-   * means the file does not pin what it claims to.
-   */
-  dangling(from: string, name: string): void {
-    if (this.skipped.has(name)) {
-      this.warn(`${from} requires ${name}, which is not fetchable from a registry`)
-      return
-    }
-    this.incomplete.push(`${name} (required by ${from})`)
-  }
+	/**
+	 * Records a required edge that resolved to nothing.
+	 *
+	 * An edge into something skipped on purpose is expected — you cannot bundle a
+	 * `workspace:` sibling from a registry — so it stays a warning. Anything else
+	 * means the file does not pin what it claims to.
+	 */
+	dangling(from: string, name: string): void {
+		if (this.skipped.has(name)) {
+			this.warn(`${from} requires ${name}, which is not fetchable from a registry`);
+			return;
+		}
+		this.incomplete.push(`${name} (required by ${from})`);
+	}
 
-  finish(input: {
-    readonly format: LockfileFormat
-    readonly lockfileVersion: string
-    readonly path: string
-    readonly importer?: string | undefined
-  }): LockedTree {
-    if (this.packages.size === 0) {
-      throw new LockfileError(input.path, "lockfile pins no packages that can be bundled")
-    }
-    return {
-      format: input.format,
-      lockfileVersion: input.lockfileVersion,
-      path: input.path,
-      importer: input.importer,
-      packages: this.packages,
-      roots: this.roots,
-      warnings: this.warnings,
-      incomplete: this.incomplete
-    }
-  }
+	finish(input: {
+		readonly format: LockfileFormat;
+		readonly lockfileVersion: string;
+		readonly path: string;
+		readonly importer?: string | undefined;
+	}): LockedTree {
+		if (this.packages.size === 0) {
+			throw new LockfileError(input.path, "lockfile pins no packages that can be bundled");
+		}
+		return {
+			format: input.format,
+			lockfileVersion: input.lockfileVersion,
+			path: input.path,
+			importer: input.importer,
+			packages: this.packages,
+			roots: this.roots,
+			warnings: this.warnings,
+			incomplete: this.incomplete,
+		};
+	}
 }
 
 const mergeEdges = (
-  a: ReadonlyArray<LockedEdge>,
-  b: ReadonlyArray<LockedEdge>
+	a: ReadonlyArray<LockedEdge>,
+	b: ReadonlyArray<LockedEdge>,
 ): ReadonlyArray<LockedEdge> => {
-  const merged = new Map<string, LockedEdge>()
-  for (const edge of [...a, ...b]) {
-    merged.set(`${edge.name}@${edge.version}|${edge.kind}`, edge)
-  }
-  return [...merged.values()]
-}
+	const merged = new Map<string, LockedEdge>();
+	for (const edge of [...a, ...b]) {
+		merged.set(`${edge.name}@${edge.version}|${edge.kind}`, edge);
+	}
+	return [...merged.values()];
+};
 
 /**
  * Reads the right-hand side of a locked entry as an exact version.
@@ -125,18 +126,18 @@ const mergeEdges = (
  * stays identical between the two paths.
  */
 export const asExactVersion = (
-  name: string,
-  raw: string
+	name: string,
+	raw: string,
 ):
-  | { readonly _tag: "Version"; readonly version: string }
-  | { readonly _tag: "Unsupported"; readonly reason: string } => {
-  const exact = semver.valid(raw, { loose: true })
-  if (exact !== null) return { _tag: "Version", version: exact }
+	| { readonly _tag: "Version"; readonly version: string }
+	| { readonly _tag: "Unsupported"; readonly reason: string } => {
+	const exact = semver.valid(raw, { loose: true });
+	if (exact !== null) return { _tag: "Version", version: exact };
 
-  const target = parseDependencyTarget(name, raw)
-  if (target._tag === "Unsupported") return { _tag: "Unsupported", reason: target.reason }
-  return { _tag: "Unsupported", reason: "not an exact version" }
-}
+	const target = parseDependencyTarget(name, raw);
+	if (target._tag === "Unsupported") return { _tag: "Unsupported", reason: target.reason };
+	return { _tag: "Unsupported", reason: "not an exact version" };
+};
 
 /**
  * Raised when a lockfile found by walking up turns out not to cover the
@@ -146,21 +147,20 @@ export const asExactVersion = (
  * readable, it simply belongs to a different project, and bundling it would
  * produce someone else's dependency set.
  */
-export const notCovered = (
-  path: string,
-  importer: string,
-  known: ReadonlyArray<string>
-): never => {
-  const listed = known.slice(0, 8).map((entry) => `    ${entry}`).join("\n")
-  throw new LockfileError(
-    path,
-    `it does not cover ${importer}.\n` +
-      (known.length === 0
-        ? "  It records no workspace members."
-        : `  Workspace members it does record:\n${listed}` +
-          (known.length > 8 ? `\n    … and ${known.length - 8} more` : ""))
-  )
-}
+export const notCovered = (path: string, importer: string, known: ReadonlyArray<string>): never => {
+	const listed = known
+		.slice(0, 8)
+		.map((entry) => `    ${entry}`)
+		.join("\n");
+	throw new LockfileError(
+		path,
+		`it does not cover ${importer}.\n` +
+			(known.length === 0
+				? "  It records no workspace members."
+				: `  Workspace members it does record:\n${listed}` +
+					(known.length > 8 ? `\n    … and ${known.length - 8} more` : "")),
+	);
+};
 
 /** `""` is how npm and bun spell the project at the lockfile's own level. */
-export const importerKey = (importer: string): string => (importer === "." ? "" : importer)
+export const importerKey = (importer: string): string => (importer === "." ? "" : importer);

package/src/lockfile/types.ts

@@ -5,70 +5,70 @@
  * different ways; once flattened into this graph, nothing downstream has to
  * know which manager wrote the file.
  */
-import type { EdgeKind, LockedRootKind } from "../enums/edge-kind.js"
-import type { LockfileFormat } from "../enums/lockfile-format.js"
+import type { EdgeKind, LockedRootKind } from "../enums/edge-kind.js";
+import type { LockfileFormat } from "../enums/lockfile-format.js";
 
 /** One edge out of a locked package, already pinned to an exact version. */
 export type LockedEdge = {
-  readonly name: string
-  readonly version: string
-  readonly kind: EdgeKind
-}
+	readonly name: string;
+	readonly version: string;
+	readonly kind: EdgeKind;
+};
 
 /** One package pinned by a lockfile. */
 export type LockedPackage = {
-  readonly name: string
-  readonly version: string
-  readonly dependencies: ReadonlyArray<LockedEdge>
-}
+	readonly name: string;
+	readonly version: string;
+	readonly dependencies: ReadonlyArray<LockedEdge>;
+};
 
 /** A direct dependency of the locked project. */
 export type LockedRoot = {
-  readonly name: string
-  readonly version: string
-  readonly kind: LockedRootKind
-  /** The range the manifest asked for, kept for reporting. */
-  readonly specifier?: string | undefined
-}
+	readonly name: string;
+	readonly version: string;
+	readonly kind: LockedRootKind;
+	/** The range the manifest asked for, kept for reporting. */
+	readonly specifier?: string | undefined;
+};
 
 /** Options for reading a lockfile. */
 export type LockfileParseOptions = {
-  /**
-   * Which workspace member's dependencies become the roots, as a path relative
-   * to the lockfile in POSIX form — `"packages/core"`, or `"."` for the project
-   * at the lockfile's own level.
-   *
-   * Left undefined, every workspace member in the file contributes, which is
-   * what pointing `--file` straight at a lockfile should mean. It matters when
-   * a package.json found a lockfile by walking *up*: the file then pins the
-   * whole repository, and only one member of it was asked for.
-   */
-  readonly importer?: string | undefined
-}
+	/**
+	 * Which workspace member's dependencies become the roots, as a path relative
+	 * to the lockfile in POSIX form — `"packages/core"`, or `"."` for the project
+	 * at the lockfile's own level.
+	 *
+	 * Left undefined, every workspace member in the file contributes, which is
+	 * what pointing `--file` straight at a lockfile should mean. It matters when
+	 * a package.json found a lockfile by walking *up*: the file then pins the
+	 * whole repository, and only one member of it was asked for.
+	 */
+	readonly importer?: string | undefined;
+};
 
 /** A whole lockfile, flattened. */
 export type LockedTree = {
-  readonly format: LockfileFormat
-  /** As the file declares it: `3`, `'9.0'`, `1`. */
-  readonly lockfileVersion: string
-  /** Where it was read from, for error messages. */
-  readonly path: string
-  /** The workspace member the roots came from, when one was selected. */
-  readonly importer?: string | undefined
-  /** Every pinned package, keyed by `name@version`. */
-  readonly packages: ReadonlyMap<string, LockedPackage>
-  /** The project's direct dependencies. */
-  readonly roots: ReadonlyArray<LockedRoot>
-  /** Entries that were recognised but cannot be fetched from a registry. */
-  readonly warnings: ReadonlyArray<string>
-  /**
-   * Required edges pointing at nothing the file pins.
-   *
-   * Distinct from `warnings`: a `workspace:` dependency that cannot be bundled
-   * is expected and gets a warning, while an ordinary registry dependency with
-   * no entry means the lockfile is genuinely partial and the bundle it produces
-   * would be missing a package. The caller decides what to do about it, but the
-   * two must not be confused.
-   */
-  readonly incomplete: ReadonlyArray<string>
-}
+	readonly format: LockfileFormat;
+	/** As the file declares it: `3`, `'9.0'`, `1`. */
+	readonly lockfileVersion: string;
+	/** Where it was read from, for error messages. */
+	readonly path: string;
+	/** The workspace member the roots came from, when one was selected. */
+	readonly importer?: string | undefined;
+	/** Every pinned package, keyed by `name@version`. */
+	readonly packages: ReadonlyMap<string, LockedPackage>;
+	/** The project's direct dependencies. */
+	readonly roots: ReadonlyArray<LockedRoot>;
+	/** Entries that were recognised but cannot be fetched from a registry. */
+	readonly warnings: ReadonlyArray<string>;
+	/**
+	 * Required edges pointing at nothing the file pins.
+	 *
+	 * Distinct from `warnings`: a `workspace:` dependency that cannot be bundled
+	 * is expected and gets a warning, while an ordinary registry dependency with
+	 * no entry means the lockfile is genuinely partial and the bundle it produces
+	 * would be missing a package. The caller decides what to do about it, but the
+	 * two must not be confused.
+	 */
+	readonly incomplete: ReadonlyArray<string>;
+};