@packall/core 0.1.0 → 0.3.0

package/src/lockfile/parse.ts

@@ -12,13 +12,13 @@
  * version. Once that is done, nothing downstream has to know which manager
  * wrote the file.
  */
-import { LockfileFormat } from "../enums/lockfile-format.js"
-import { LockfileError } from "../errors.js"
-import { parseBunLockfile } from "./bun.js"
-import { detectLockfile } from "./detect.js"
-import { parseNpmLockfile } from "./npm.js"
-import { parsePnpmLockfile } from "./pnpm.js"
-import type { LockedTree, LockfileParseOptions } from "./types.js"
+import { LockfileFormat } from "../enums/lockfile-format.js";
+import { LockfileError } from "../errors.js";
+import { parseBunLockfile } from "./bun.js";
+import { detectLockfile } from "./detect.js";
+import { parseNpmLockfile } from "./npm.js";
+import { parsePnpmLockfile } from "./pnpm.js";
+import type { LockedTree, LockfileParseOptions } from "./types.js";
 
 /**
  * Parses lockfile content into a flat graph.
@@ -26,31 +26,31 @@ import type { LockedTree, LockfileParseOptions } from "./types.js"
  * Throws `LockfileError`; the caller is expected to be inside an `Effect.try`.
  */
 export const parseLockfile = (
-  path: string,
-  content: string,
-  format?: LockfileFormat,
-  options: LockfileParseOptions = {}
+	path: string,
+	content: string,
+	format?: LockfileFormat,
+	options: LockfileParseOptions = {},
 ): LockedTree => {
-  const resolved = format ?? resolveFormat(path, content)
-  const importer = options.importer
-  switch (resolved) {
-    case LockfileFormat.Npm:
-      return parseNpmLockfile(path, content, importer)
-    case LockfileFormat.Pnpm:
-      return parsePnpmLockfile(path, content, importer)
-    case LockfileFormat.Bun:
-      return parseBunLockfile(path, content, importer)
-  }
-}
+	const resolved = format ?? resolveFormat(path, content);
+	const importer = options.importer;
+	switch (resolved) {
+		case LockfileFormat.Npm:
+			return parseNpmLockfile(path, content, importer);
+		case LockfileFormat.Pnpm:
+			return parsePnpmLockfile(path, content, importer);
+		case LockfileFormat.Bun:
+			return parseBunLockfile(path, content, importer);
+	}
+};
 
 const resolveFormat = (path: string, content: string): LockfileFormat => {
-  const detected = detectLockfile(content)
-  if (detected._tag === "Supported") return detected.format
-  if (detected._tag === "Unsupported") {
-    throw new LockfileError(path, `${detected.label} — ${detected.hint}`)
-  }
-  throw new LockfileError(
-    path,
-    "content does not look like a package-lock.json, pnpm-lock.yaml or bun.lock"
-  )
-}
+	const detected = detectLockfile(content);
+	if (detected._tag === "Supported") return detected.format;
+	if (detected._tag === "Unsupported") {
+		throw new LockfileError(path, `${detected.label} — ${detected.hint}`);
+	}
+	throw new LockfileError(
+		path,
+		"content does not look like a package-lock.json, pnpm-lock.yaml or bun.lock",
+	);
+};

package/src/lockfile/pnpm.ts

@@ -1,225 +1,230 @@
-/**
- * `pnpm-lock.yaml`.
- *
- * The easy one: pnpm's snapshots already name exact versions, so there is no
- * nesting walk-up to reimplement. The fiddly parts are the three package-key
- * encodings still in the wild and the parenthesised peer-resolution suffix.
- */
-import semver from "semver"
-import { parse as parseYaml } from "yaml"
-import { parseDependencyTarget } from "../dependency-range.js"
-import { EdgeKind, LockedRootKind } from "../enums/edge-kind.js"
-import { LockfileFormat } from "../enums/lockfile-format.js"
-import { LockfileError } from "../errors.js"
-import { describeError } from "./json.js"
-import { isRecord } from "../utils/is-record.js"
-import { fieldByRootKind, notCovered, TreeBuilder } from "./tree-builder.js"
-import type { LockedEdge, LockedTree } from "./types.js"
-
-/** `name@version`, as a snapshot or importer entry resolves to. */
-type PnpmReference = {
-  readonly name: string
-  readonly version: string
-}
-
-/** pnpm never records peer dependencies against an importer. */
-const ROOT_KINDS = [
-  LockedRootKind.Prod,
-  LockedRootKind.Optional,
-  LockedRootKind.Dev
-] as const
-
-export const parsePnpmLockfile = (
-  path: string,
-  content: string,
-  importer: string | undefined
-): LockedTree => {
-  let root: unknown
-  try {
-    root = parseYaml(content)
-  } catch (error) {
-    throw new LockfileError(path, `not valid YAML — ${describeError(error)}`, { cause: error })
-  }
-  if (!isRecord(root)) {
-    throw new LockfileError(path, "top level is not a mapping")
-  }
-
-  const version = String(root["lockfileVersion"] ?? "?")
-  const builder = new TreeBuilder()
-
-  // v9 split the graph in two: `packages` keeps resolution metadata, and
-  // `snapshots` keeps the edges. Before that both lived in `packages`.
-  const packages = isRecord(root["packages"]) ? root["packages"] : {}
-  const snapshots = isRecord(root["snapshots"]) ? root["snapshots"] : packages
-
-  const known = new Map<string, PnpmReference>()
-  for (const key of Object.keys(packages)) {
-    const parsed = parsePnpmKey(key)
-    if (parsed === null) continue
-    known.set(key, parsed)
-  }
-
-  for (const [key, raw] of Object.entries(snapshots)) {
-    const parsed = parsePnpmKey(key) ?? known.get(key)
-    if (parsed === undefined || parsed === null) {
-      const described = describeKey(key)
-      if (described !== null) builder.skip(described.name, described.spec, described.reason)
-      continue
-    }
-    builder.add({
-      name: parsed.name,
-      version: parsed.version,
-      dependencies: edgesOf(builder, parsed, isRecord(raw) ? raw : {})
-    })
-  }
-
-  collectRoots(builder, root, path, importer)
-
-  return builder.finish({ format: LockfileFormat.Pnpm, lockfileVersion: version, path, importer })
-}
-
-const edgesOf = (
-  builder: TreeBuilder,
-  from: PnpmReference,
-  snapshot: Record<string, unknown>
-): ReadonlyArray<LockedEdge> => {
-  const edges: Array<LockedEdge> = []
-
-  const add = (field: string, kind: EdgeKind): void => {
-    const entries = snapshot[field]
-    if (!isRecord(entries)) return
-    for (const [name, raw] of Object.entries(entries)) {
-      if (typeof raw !== "string") continue
-      const target = parsePnpmReference(name, raw)
-      if (target === null) {
-        if (kind === EdgeKind.Prod) builder.dangling(`${from.name}@${from.version}`, name)
-        continue
-      }
-      edges.push({ ...target, kind })
-    }
-  }
-
-  add(fieldByRootKind[LockedRootKind.Prod], EdgeKind.Prod)
-  add(fieldByRootKind[LockedRootKind.Optional], EdgeKind.Optional)
-  add(fieldByRootKind[LockedRootKind.Peer], EdgeKind.Peer)
-
-  return edges
-}
-
-/**
- * The importers' direct dependencies become the roots.
- *
- * pnpm is the format that makes this easy: `importers` is already keyed by the
- * path each package.json sits at, so scoping to one member is a lookup rather
- * than a reconstruction.
- */
-const collectRoots = (
-  builder: TreeBuilder,
-  root: Record<string, unknown>,
-  path: string,
-  member: string | undefined
-): void => {
-  // A single-project lockfile has no `importers` block; its dependencies sit at
-  // the top level, which is the same thing as an importer called ".".
-  const importers = isRecord(root["importers"]) ? root["importers"] : { ".": root }
-
-  const selected =
-    member === undefined
-      ? Object.values(importers)
-      : Object.hasOwn(importers, member)
-        ? [importers[member]]
-        : notCovered(path, member, Object.keys(importers))
-
-  for (const importer of selected) {
-    if (!isRecord(importer)) continue
-    for (const kind of ROOT_KINDS) {
-      const entries = importer[fieldByRootKind[kind]]
-      if (!isRecord(entries)) continue
-
-      for (const [name, raw] of Object.entries(entries)) {
-        // v5 wrote a bare version string; v6 and v9 write
-        // `{specifier, version}`.
-        const value = typeof raw === "string" ? raw : isRecord(raw) ? raw["version"] : undefined
-        if (typeof value !== "string") continue
-
-        const target = parsePnpmReference(name, value)
-        if (target === null) continue
-
-        const specifier =
-          isRecord(raw) && typeof raw["specifier"] === "string" ? raw["specifier"] : undefined
-        builder.addRoot({ ...target, kind, specifier })
-      }
-    }
-  }
-}
-
-/**
- * Reads a dependency value from a snapshot or importer.
- *
- * The value is either a bare version (`1.4.0`) or a full package key
- * (`/lodash@4.17.21`, used when the install name is an alias of another
- * package). Both may carry a peer-resolution suffix in parentheses.
- */
-const parsePnpmReference = (name: string, raw: string): PnpmReference | null => {
-  const value = stripSuffix(raw)
-
-  const exact = semver.valid(value, { loose: true })
-  if (exact !== null) return { name, version: exact }
-
-  return parsePnpmKey(raw)
-}
-
-/**
- * Splits a package key into name and version.
- *
- * Three encodings across the versions still in the wild:
- *   v5  `/@babel/core/7.0.0`
- *   v6  `/@babel/core@7.0.0`
- *   v9  `@babel/core@7.0.0`
- *
- * plus an optional `(peer@1.0.0)` or `(patch_hash=…)` suffix on any of them.
- */
-export const parsePnpmKey = (key: string): PnpmReference | null => {
-  const body = stripSuffix(key.startsWith("/") ? key.slice(1) : key)
-
-  // A scoped name's own `@` sits at index 0, so only a later one separates the
-  // version. When there is none, this is the v5 form and the last `/` does it.
-  const at = body.lastIndexOf("@")
-  const cut = at > 0 ? at : body.lastIndexOf("/")
-  if (cut <= 0) return null
-
-  const name = body.slice(0, cut)
-  const version = semver.valid(body.slice(cut + 1), { loose: true })
-  if (version === null || name.length === 0) return null
-
-  return { name, version }
-}
-
-/** Describes a key we cannot pin, so the skip warning can say why. */
-const describeKey = (
-  key: string
-): { readonly name: string; readonly spec: string; readonly reason: string } | null => {
-  const body = key.startsWith("/") ? key.slice(1) : key
-  const at = body.lastIndexOf("@")
-  if (at <= 0) return null
-  const name = body.slice(0, at)
-  const spec = body.slice(at + 1)
-  const target = parseDependencyTarget(name, spec)
-  return {
-    name,
-    spec,
-    reason: target._tag === "Unsupported" ? target.reason : "not an exact version"
-  }
-}
-
-/**
- * Drops the parenthesised peer-resolution suffix.
- *
- * pnpm distinguishes the same version installed against different peers —
- * `react-dom@18.3.1(react@18.3.1)`. Those are the same published tarball, which
- * is all this tool downloads, so the suffix is noise here.
- */
-const stripSuffix = (value: string): string => {
-  const open = value.indexOf("(")
-  return open === -1 ? value : value.slice(0, open)
-}
+/**
+ * `pnpm-lock.yaml`.
+ *
+ * The easy one: pnpm's snapshots already name exact versions, so there is no
+ * nesting walk-up to reimplement. The fiddly parts are the three package-key
+ * encodings still in the wild and the parenthesised peer-resolution suffix.
+ */
+import semver from "semver";
+import { parse as parseYaml } from "yaml";
+
+import { parseDependencyTarget } from "../dependency-range.js";
+import { EdgeKind, LockedRootKind } from "../enums/edge-kind.js";
+import { LockfileFormat } from "../enums/lockfile-format.js";
+import { LockfileError } from "../errors.js";
+import { isRecord } from "../utils/is-record.js";
+import { describeError } from "./json.js";
+import { fieldByRootKind, notCovered, TreeBuilder } from "./tree-builder.js";
+import type { LockedEdge, LockedTree } from "./types.js";
+
+/** `name@version`, as a snapshot or importer entry resolves to. */
+type PnpmReference = {
+	readonly name: string;
+	readonly version: string;
+};
+
+/** pnpm never records peer dependencies against an importer. */
+const ROOT_KINDS = [LockedRootKind.Prod, LockedRootKind.Optional, LockedRootKind.Dev] as const;
+
+export const parsePnpmLockfile = (
+	path: string,
+	content: string,
+	importer: string | undefined,
+): LockedTree => {
+	let root: unknown;
+	try {
+		root = parseYaml(content);
+	} catch (error) {
+		throw new LockfileError(path, `not valid YAML — ${describeError(error)}`, { cause: error });
+	}
+	if (!isRecord(root)) {
+		throw new LockfileError(path, "top level is not a mapping");
+	}
+
+	const version = String(root["lockfileVersion"] ?? "?");
+	const builder = new TreeBuilder();
+
+	// v9 split the graph in two: `packages` keeps resolution metadata, and
+	// `snapshots` keeps the edges. Before that both lived in `packages`.
+	const packages = isRecord(root["packages"]) ? root["packages"] : {};
+	const snapshots = isRecord(root["snapshots"]) ? root["snapshots"] : packages;
+
+	const known = new Map<string, PnpmReference>();
+	for (const key of Object.keys(packages)) {
+		const parsed = parsePnpmKey(key);
+		if (parsed === null) continue;
+		known.set(key, parsed);
+	}
+
+	for (const [key, raw] of Object.entries(snapshots)) {
+		const parsed = parsePnpmKey(key) ?? known.get(key);
+		if (parsed === undefined || parsed === null) {
+			const described = describeKey(key);
+			if (described !== null) builder.skip(described.name, described.spec, described.reason);
+			continue;
+		}
+		builder.add({
+			name: parsed.name,
+			version: parsed.version,
+			dependencies: edgesOf(builder, parsed, isRecord(raw) ? raw : {}),
+		});
+	}
+
+	collectRoots(builder, root, path, importer);
+
+	return builder.finish({
+		format: LockfileFormat.Pnpm,
+		lockfileVersion: version,
+		path,
+		importer,
+	});
+};
+
+const edgesOf = (
+	builder: TreeBuilder,
+	from: PnpmReference,
+	snapshot: Record<string, unknown>,
+): ReadonlyArray<LockedEdge> => {
+	const edges: Array<LockedEdge> = [];
+
+	const add = (field: string, kind: EdgeKind): void => {
+		const entries = snapshot[field];
+		if (!isRecord(entries)) return;
+		for (const [name, raw] of Object.entries(entries)) {
+			if (typeof raw !== "string") continue;
+			const target = parsePnpmReference(name, raw);
+			if (target === null) {
+				if (kind === EdgeKind.Prod) builder.dangling(`${from.name}@${from.version}`, name);
+				continue;
+			}
+			edges.push({ ...target, kind });
+		}
+	};
+
+	add(fieldByRootKind[LockedRootKind.Prod], EdgeKind.Prod);
+	add(fieldByRootKind[LockedRootKind.Optional], EdgeKind.Optional);
+	add(fieldByRootKind[LockedRootKind.Peer], EdgeKind.Peer);
+
+	return edges;
+};
+
+/**
+ * The importers' direct dependencies become the roots.
+ *
+ * pnpm is the format that makes this easy: `importers` is already keyed by the
+ * path each package.json sits at, so scoping to one member is a lookup rather
+ * than a reconstruction.
+ */
+const collectRoots = (
+	builder: TreeBuilder,
+	root: Record<string, unknown>,
+	path: string,
+	member: string | undefined,
+): void => {
+	// A single-project lockfile has no `importers` block; its dependencies sit at
+	// the top level, which is the same thing as an importer called ".".
+	const importers = isRecord(root["importers"]) ? root["importers"] : { ".": root };
+
+	const selected =
+		member === undefined
+			? Object.values(importers)
+			: Object.hasOwn(importers, member)
+				? [importers[member]]
+				: notCovered(path, member, Object.keys(importers));
+
+	for (const importer of selected) {
+		if (!isRecord(importer)) continue;
+		for (const kind of ROOT_KINDS) {
+			const entries = importer[fieldByRootKind[kind]];
+			if (!isRecord(entries)) continue;
+
+			for (const [name, raw] of Object.entries(entries)) {
+				// v5 wrote a bare version string; v6 and v9 write
+				// `{specifier, version}`.
+				const value =
+					typeof raw === "string" ? raw : isRecord(raw) ? raw["version"] : undefined;
+				if (typeof value !== "string") continue;
+
+				const target = parsePnpmReference(name, value);
+				if (target === null) continue;
+
+				const specifier =
+					isRecord(raw) && typeof raw["specifier"] === "string"
+						? raw["specifier"]
+						: undefined;
+				builder.addRoot({ ...target, kind, specifier });
+			}
+		}
+	}
+};
+
+/**
+ * Reads a dependency value from a snapshot or importer.
+ *
+ * The value is either a bare version (`1.4.0`) or a full package key
+ * (`/lodash@4.17.21`, used when the install name is an alias of another
+ * package). Both may carry a peer-resolution suffix in parentheses.
+ */
+const parsePnpmReference = (name: string, raw: string): PnpmReference | null => {
+	const value = stripSuffix(raw);
+
+	const exact = semver.valid(value, { loose: true });
+	if (exact !== null) return { name, version: exact };
+
+	return parsePnpmKey(raw);
+};
+
+/**
+ * Splits a package key into name and version.
+ *
+ * Three encodings across the versions still in the wild:
+ *   v5  `/@babel/core/7.0.0`
+ *   v6  `/@babel/core@7.0.0`
+ *   v9  `@babel/core@7.0.0`
+ *
+ * plus an optional `(peer@1.0.0)` or `(patch_hash=…)` suffix on any of them.
+ */
+export const parsePnpmKey = (key: string): PnpmReference | null => {
+	const body = stripSuffix(key.startsWith("/") ? key.slice(1) : key);
+
+	// A scoped name's own `@` sits at index 0, so only a later one separates the
+	// version. When there is none, this is the v5 form and the last `/` does it.
+	const at = body.lastIndexOf("@");
+	const cut = at > 0 ? at : body.lastIndexOf("/");
+	if (cut <= 0) return null;
+
+	const name = body.slice(0, cut);
+	const version = semver.valid(body.slice(cut + 1), { loose: true });
+	if (version === null || name.length === 0) return null;
+
+	return { name, version };
+};
+
+/** Describes a key we cannot pin, so the skip warning can say why. */
+const describeKey = (
+	key: string,
+): { readonly name: string; readonly spec: string; readonly reason: string } | null => {
+	const body = key.startsWith("/") ? key.slice(1) : key;
+	const at = body.lastIndexOf("@");
+	if (at <= 0) return null;
+	const name = body.slice(0, at);
+	const spec = body.slice(at + 1);
+	const target = parseDependencyTarget(name, spec);
+	return {
+		name,
+		spec,
+		reason: target._tag === "Unsupported" ? target.reason : "not an exact version",
+	};
+};
+
+/**
+ * Drops the parenthesised peer-resolution suffix.
+ *
+ * pnpm distinguishes the same version installed against different peers —
+ * `react-dom@18.3.1(react@18.3.1)`. Those are the same published tarball, which
+ * is all this tool downloads, so the suffix is noise here.
+ */
+const stripSuffix = (value: string): string => {
+	const open = value.indexOf("(");
+	return open === -1 ? value : value.slice(0, open);
+};