@teambit/pnpm 1.0.1322 → 1.0.1323

package/dist/lockfile-deps-graph-converter.d.ts

@@ -1,5 +1,5 @@
 import { type ProjectManifest } from '@pnpm/types';
-import { type LockfileFileProjectSnapshot } from '@pnpm/lockfile.types';
+import { type LockfileFile, type LockfileFileProjectSnapshot } from '@pnpm/lockfile.types';
 import { DependenciesGraph, type PackageAttributes, type DependencyEdge } from '@teambit/objects';
 import { type CalcDepsGraphOptions, type CalcDepsGraphForComponentOptions, type ComponentIdByPkgName } from '@teambit/dependency-resolver';
 import { type BitLockfileFile } from './lynx';
@@ -17,6 +17,8 @@ type ResolveFunction = (wantedDependency: {
     preferredVersions?: Record<string, unknown>;
 }) => Promise<{
     resolution?: Record<string, unknown>;
+    /** The resolved package's manifest; a registry package's carries its tarball's integrity in `dist`. */
+    manifest?: unknown;
 }>;
 export declare function init(): Promise<void>;
 export interface LockfileToGraphCache {
@@ -45,9 +47,26 @@ export declare function createFileVersionReplacer(componentIdByPkgName: Componen
  * reaches, without crossing the N-API boundary or cloning the full lockfile.
  */
 export declare function filterLockfileByImporters(lockfile: BitLockfileFile, importerIds: string[], importersOverride?: Record<string, LockfileFileProjectSnapshot>): BitLockfileFile;
-export declare function convertGraphToLockfile(_graph: DependenciesGraph, { manifests, rootDir, resolve, }: {
+export declare function convertGraphToLockfile(_graph: DependenciesGraph, { manifests, rootDir, resolve, onComponentPkgDropped, }: {
     manifests: Record<string, ProjectManifest>;
     rootDir: string;
     resolve: ResolveFunction;
+    /** Called for each workspace-component package the lockfile leaves out, with why. */
+    onComponentPkgDropped?: (pkgId: string, reason: string) => void;
 }): Promise<BitLockfileFile>;
+/**
+ * The dep path a lockfile ref under `name` points at, or `undefined` for a
+ * `link:` ref, which points at no snapshot. An aliased ref
+ * (`real-name@1.0.0` under the alias) names the real package, and a `file:`
+ * ref a workspace component's own snapshot.
+ */
+export declare function refToDepPath(ref: string, name: string): string | undefined;
+/**
+ * Set each snapshot's `optional` flag the way pnpm does: on when every path
+ * from an importer to it goes through an `optionalDependencies` edge, off
+ * otherwise. The graph does not record the flag, and an install that takes
+ * the lockfile as it is relies on it: a package reached only optionally may
+ * fail to build or to install, one reached otherwise may not.
+ */
+export declare function markOptionalOnlyEntries(lockfile: Pick<LockfileFile, 'importers' | 'snapshots'>): void;
 export {};

package/dist/lockfile-deps-graph-converter.js

@@ -9,6 +9,8 @@ exports.createFileVersionReplacer = createFileVersionReplacer;
 exports.createLockfileToGraphCache = createLockfileToGraphCache;
 exports.filterLockfileByImporters = filterLockfileByImporters;
 exports.init = init;
+exports.markOptionalOnlyEntries = markOptionalOnlyEntries;
+exports.refToDepPath = refToDepPath;
 function _path() {
   const data = _interopRequireDefault(require("path"));
   _path = function () {
@@ -23,13 +25,6 @@ function _lodash() {
   };
   return data;
 }
-function _semver() {
-  const data = _interopRequireDefault(require("semver"));
-  _semver = function () {
-    return data;
-  };
-  return data;
-}
 function _bitError() {
   const data = require("@teambit/bit-error");
   _bitError = function () {
@@ -44,6 +39,13 @@ function _componentPackageVersion() {
   };
   return data;
 }
+function _semver() {
+  const data = _interopRequireDefault(require("semver"));
+  _semver = function () {
+    return data;
+  };
+  return data;
+}
 function _objects() {
   const data = require("@teambit/objects");
   _objects = function () {
@@ -70,6 +72,23 @@ function _toPrimitive(t, r) { if ("object" != typeof t || !t) return t; var e =
  * `resolveDependency`). Only the parts this module consumes are typed.
  */
 
+/**
+ * The integrity a resolution carries: in `resolution` when the resolver
+ * reports one, else in the resolved manifest's `dist`, which is where
+ * `@pnpm/napi`'s `resolveDependency` reports a registry package's.
+ */
+function resolvedIntegrity(resolveResult) {
+  const {
+    resolution,
+    manifest
+  } = resolveResult;
+  if (resolution != null && typeof resolution.integrity === 'string' && resolution.integrity) {
+    return resolution.integrity;
+  }
+  const dist = manifest?.dist;
+  return typeof dist?.integrity === 'string' && dist.integrity ? dist.integrity : undefined;
+}
+
 // @pnpm/deps.path is ESM-only; load it through a .cjs shim so the require()
 // chain in the build capsule's mocha runner doesn't trip on the transitive ESM
 // import. Call `init()` once before invoking the public converters; helpers
@@ -563,7 +582,8 @@ function filterLockfileByImporters(lockfile, importerIds, importersOverride) {
 async function convertGraphToLockfile(_graph, {
   manifests,
   rootDir,
-  resolve
+  resolve,
+  onComponentPkgDropped
 }) {
   await init();
   const graphString = _graph.serialize();
@@ -644,6 +664,10 @@ async function convertGraphToLockfile(_graph, {
   }
   const rootEdge = graph.findRootEdge();
   if (rootEdge) {
+    const workspaceVersions = new Map(Array.from(workspaceComponentDirs(manifests, rootDir).keys()).map(pkgId => {
+      const parsed = dp.parse(pkgId);
+      return [parsed.name, parsed.version];
+    }));
     for (const [projectDir, manifest] of Object.entries(manifests)) {
       const projectId = getLockfileImporterId(rootDir, projectDir);
       lockfile.importers[projectId] = {
@@ -660,7 +684,7 @@ async function convertGraphToLockfile(_graph, {
               specifier
             };
           } else {
-            const edgeId = rootEdge.neighbours.find(directDep => directDep.name === name && (directDep.specifier === specifier || dp.removeSuffix(directDep.id) === `${name}@${specifier}`))?.id;
+            const edgeId = findImporterDepPath(graph, rootEdge, name, specifier, workspaceVersions);
             if (edgeId) {
               const parsed = dp.parse(edgeId);
               const ref = depPathToRef(parsed);
@@ -675,6 +699,10 @@ async function convertGraphToLockfile(_graph, {
     }
   }
   dedupeSnapshotDepsToRootManifest(lockfile, manifests[rootDir]);
+  linkWorkspaceComponents(lockfile, manifests, rootDir);
+  // Only what the importers reach is worth resolving: a graph holds entries
+  // no manifest here declares (an attached extension's dev dependencies, for
+  // one), and a registry lookup for them would be wasted or could fail.
   dropUnreachableLockfileEntries(lockfile);
   const pkgsToResolve = getPkgsToResolve(lockfile, manifests);
   const failedWorkspaceComponentPkgs = new Set();
@@ -701,16 +729,15 @@ async function convertGraphToLockfile(_graph, {
         // auth failures) so real install failures aren't silently masked.
         if (err.code === 'ERR_PNPM_NO_MATCHING_VERSION' && graph.packages.get(pkgToResolve.pkgId)?.component != null) {
           failedWorkspaceComponentPkgs.add(pkgToResolve.pkgId);
+          onComponentPkgDropped?.(pkgToResolve.pkgId, `the registry has no such version: ${err.message}`);
           return;
         }
         throw err;
       }
-      const {
-        resolution
-      } = resolveResult;
-      if (resolution != null && 'integrity' in resolution && resolution.integrity) {
+      const integrity = resolvedIntegrity(resolveResult);
+      if (integrity) {
         lockfile.packages[pkgToResolve.pkgId].resolution = {
-          integrity: resolution.integrity
+          integrity
         };
       }
     }
@@ -731,6 +758,9 @@ async function convertGraphToLockfile(_graph, {
   // validation below — that path means the graph itself is genuinely broken.
   for (const [pkgId, pkg] of Object.entries(lockfile.packages)) {
     if ((pkg.resolution == null || Object.keys(pkg.resolution).length === 0) && graph.packages.get(pkgId)?.component != null) {
+      if (!failedWorkspaceComponentPkgs.has(pkgId)) {
+        onComponentPkgDropped?.(pkgId, 'its resolution has no integrity');
+      }
       failedWorkspaceComponentPkgs.add(pkgId);
     }
   }
@@ -738,6 +768,7 @@ async function convertGraphToLockfile(_graph, {
     scrubPkgsFromLockfile(lockfile, failedWorkspaceComponentPkgs);
   }
   dropUnreachableLockfileEntries(lockfile);
+  markOptionalOnlyEntries(lockfile);
   // Validate the generated lockfile
   for (const [depPath, pkg] of Object.entries(lockfile.packages)) {
     if (pkg.resolution == null || Object.keys(pkg.resolution).length === 0) {
@@ -760,6 +791,67 @@ async function convertGraphToLockfile(_graph, {
     return deps;
   }
 }
+
+/**
+ * The dep path a restored importer entry for `name@specifier` points at: the
+ * root edge neighbour the manifest's dependency matches, or, when the manifest
+ * asks for a version the graph holds only deeper in the tree (an env peer a
+ * capsule manifest took from the graph), the snapshot of that version,
+ * preferring the peer variant the component's own dependencies were resolved
+ * against. Nothing when the graph holds no such version.
+ */
+function findImporterDepPath(graph, rootEdge, name, specifier, workspaceVersions) {
+  const sameName = rootEdge.neighbours.filter(directDep => directDep.name === name);
+  // A merged graph keeps one neighbour per distinct specifier of a package,
+  // so the one recorded for this very specifier or version comes first; a
+  // range is matched only when none was, and among several resolutions that
+  // satisfy it the highest version, which is what a resolution would pick.
+  const recorded = sameName.find(directDep => directDep.specifier === specifier) ?? sameName.find(directDep => dp.removeSuffix(directDep.id) === `${name}@${specifier}`);
+  if (recorded) return recorded.id;
+  const satisfying = sameName.filter(directDep => specifierMatchesDirectDep(name, specifier, directDep, workspaceVersions));
+  if (satisfying.length > 0) {
+    return satisfying.reduce((highest, directDep) => _semver().default.gt(dp.parse(directDep.id).version, dp.parse(highest.id).version) ? directDep : highest).id;
+  }
+  const pkgId = `${name}@${specifier}`;
+  const candidates = graph.edges.filter(edge => edge.id !== _objects().DependenciesGraph.ROOT_EDGE_ID && (edge.attr?.pkgId ?? dp.removeSuffix(edge.id)) === pkgId).map(edge => edge.id);
+  if (candidates.length === 0) return graph.packages.has(pkgId) ? pkgId : undefined;
+  const peerIdsOfDirectDeps = new Set();
+  const stack = rootEdge.neighbours.map(({
+    id
+  }) => id);
+  while (stack.length > 0) {
+    for (const peerId of (0, _objects().splitDependenciesGraphPeerIds)(stack.pop())) {
+      peerIdsOfDirectDeps.add(peerId);
+      stack.push(peerId);
+    }
+  }
+  return candidates.find(id => peerIdsOfDirectDeps.has(id)) ?? candidates[0];
+}
+
+/**
+ * Whether the manifest's `specifier` for `name`, which no direct dependency
+ * was recorded for, is satisfied by the direct dependency the graph recorded
+ * under another specifier: a workspace reference the graph resolved to the
+ * version of the workspace component of that name, or a range the resolved
+ * version satisfies, read the way pnpm reads ranges, so a prerelease
+ * satisfies only a range that names one.
+ */
+function specifierMatchesDirectDep(name, specifier, directDep, workspaceVersions) {
+  const {
+    version
+  } = dp.parse(directDep.id);
+  if (version == null) return false;
+  if (specifier.startsWith('workspace:')) {
+    // The entry becomes the workspace component's `file:` record, so only the
+    // version the workspace holds can stand for it, and the range, when the
+    // reference carries one, has to accept that version.
+    if (workspaceVersions.get(name) !== version) return false;
+    const range = specifier.slice('workspace:'.length);
+    if (range === '' || range === '*' || range === '^' || range === '~') return true;
+    return _semver().default.validRange(range) != null && _semver().default.satisfies(version, range);
+  }
+  return _semver().default.validRange(specifier) != null && _semver().default.satisfies(version, specifier);
+}
 function getPkgsToResolve(lockfile, manifests) {
   const pkgsToResolve = [];
   const pkgsInTheWorkspaces = new Map();
@@ -802,8 +894,8 @@ function dropUnreachableLockfileEntries(lockfile) {
       if (!snapshot) continue;
       for (const depType of ['dependencies', 'optionalDependencies']) {
         for (const [name, ref] of Object.entries(snapshot[depType] ?? {})) {
-          if (ref.startsWith('link:') || ref.startsWith('file:')) continue;
-          stack.push(`${name}@${ref}`);
+          const subDepPath = refToDepPath(ref, name);
+          if (subDepPath != null) stack.push(subDepPath);
         }
       }
     }
@@ -813,8 +905,8 @@ function dropUnreachableLockfileEntries(lockfile) {
       for (const [name, {
         version
       }] of Object.entries(importer[depType] ?? {})) {
-        if (version.startsWith('link:') || version.startsWith('file:')) continue;
-        visit(`${name}@${version}`);
+        const depPath = refToDepPath(version, name);
+        if (depPath != null) visit(depPath);
       }
     }
   }
@@ -832,6 +924,157 @@ function dropUnreachableLockfileEntries(lockfile) {
     lockfile.bit.depsRequiringBuild = lockfile.bit.depsRequiringBuild.filter(depPath => reachablePackages.has(dp.removeSuffix(depPath)));
   }
 }
+
+/**
+ * The workspace components among `manifests`, keyed by the `name@version`
+ * id the graph records them under, with the lockfile-relative directory pnpm
+ * records them at. The root project is not a component.
+ */
+function workspaceComponentDirs(manifests, rootDir) {
+  const dirs = new Map();
+  for (const [projectDir, {
+    name,
+    version
+  }] of Object.entries(manifests)) {
+    if (!name || !version) continue;
+    const relativeDir = getLockfileImporterId(rootDir, projectDir);
+    if (relativeDir === '.') continue;
+    dirs.set(`${name}@${(0, _componentPackageVersion().snapToSemver)(version)}`, relativeDir);
+  }
+  return dirs;
+}
+
+/**
+ * The inverse of `createFileVersionReplacer`: rewrites every `name@version`
+ * of a workspace component in `dirs`, wherever it stands in a package id, a
+ * dep path or a peer suffix, to the `name@file:<dir>` pnpm records for it.
+ */
+function createWorkspaceComponentReplacer(dirs) {
+  if (dirs.size === 0) return s => s;
+  const ids = Array.from(dirs.keys()).map(_lodash().escapeRegExp);
+  // An id starts a dep path or a peer suffix segment, or follows the alias in
+  // an aliased dep path, and ends where its own peer suffix or the enclosing
+  // segment does.
+  const pattern = new RegExp(`(?<=^|[(@])(${ids.join('|')})(?=[()]|$)`, 'g');
+  return s => s.replace(pattern, id => `${id.slice(0, id.lastIndexOf('@'))}@file:${dirs.get(id)}`);
+}
+
+/**
+ * Record the workspace components the graph resolved to, at the version the
+ * workspace holds them, the way pnpm does: as `file:` directory packages, with
+ * the graph's resolution of their dependencies as their snapshot. pnpm links
+ * every dependency on such a version to the workspace component
+ * (`linkWorkspacePackages: deep`), transitive ones included, so a registry
+ * entry for it would only be resolved again, and pnpm accepts the snapshot
+ * while the component's manifest still declares the dependencies it records.
+ * Other versions of the same component stay registry packages.
+ */
+function linkWorkspaceComponents(lockfile, manifests, rootDir) {
+  const dirs = workspaceComponentDirs(manifests, rootDir);
+  if (dirs.size === 0) return;
+  const replace = createWorkspaceComponentReplacer(dirs);
+  const replaceRef = (name, ref) => ref.startsWith('link:') ? ref : replace(`${name}@${ref}`).slice(name.length + 1);
+  const packages = {};
+  for (const [pkgId, pkg] of Object.entries(lockfile.packages)) {
+    const directory = dirs.get(pkgId);
+    if (directory == null) {
+      packages[pkgId] = pkg;
+      continue;
+    }
+    // The id carries the name and the version, and the directory is the
+    // resolution. The rest (peers, engines, bins, ...) describes the package
+    // either way.
+    packages[replace(pkgId)] = _objectSpread(_objectSpread({}, (0, _lodash().omit)(pkg, ['resolution', 'name', 'version'])), {}, {
+      resolution: {
+        directory,
+        type: 'directory'
+      }
+    });
+  }
+  lockfile.packages = packages;
+  const snapshots = {};
+  for (const [depPath, snapshot] of Object.entries(lockfile.snapshots ?? {})) {
+    for (const depType of ['dependencies', 'optionalDependencies']) {
+      const deps = snapshot[depType];
+      if (!deps) continue;
+      for (const [name, ref] of Object.entries(deps)) {
+        deps[name] = replaceRef(name, ref);
+      }
+    }
+    snapshots[replace(depPath)] = snapshot;
+  }
+  lockfile.snapshots = snapshots;
+  for (const importer of Object.values(lockfile.importers ?? {})) {
+    for (const depType of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+      for (const [name, dep] of Object.entries(importer[depType] ?? {})) {
+        dep.version = replaceRef(name, dep.version);
+      }
+    }
+  }
+  if (lockfile.bit?.depsRequiringBuild) {
+    lockfile.bit.depsRequiringBuild = lockfile.bit.depsRequiringBuild.map(replace);
+  }
+}
+
+/**
+ * The dep path a lockfile ref under `name` points at, or `undefined` for a
+ * `link:` ref, which points at no snapshot. An aliased ref
+ * (`real-name@1.0.0` under the alias) names the real package, and a `file:`
+ * ref a workspace component's own snapshot.
+ */
+function refToDepPath(ref, name) {
+  ensureInitialized();
+  return dp.refToRelative(ref, name) ?? undefined;
+}
+
+/**
+ * Set each snapshot's `optional` flag the way pnpm does: on when every path
+ * from an importer to it goes through an `optionalDependencies` edge, off
+ * otherwise. The graph does not record the flag, and an install that takes
+ * the lockfile as it is relies on it: a package reached only optionally may
+ * fail to build or to install, one reached otherwise may not.
+ */
+function markOptionalOnlyEntries(lockfile) {
+  const snapshots = lockfile.snapshots ?? {};
+  // Walk (dep path, reached optionally): `dependencies` edges keep the
+  // context, `optionalDependencies` edges always enter it.
+  const visited = new Set();
+  const reachedNonOptionally = new Set();
+  const reachedOptionally = new Set();
+  const queue = [];
+  for (const importer of Object.values(lockfile.importers ?? {})) {
+    for (const [depType, optional] of [['dependencies', false], ['devDependencies', false], ['optionalDependencies', true]]) {
+      for (const [name, {
+        version
+      }] of Object.entries(importer[depType] ?? {})) {
+        const depPath = refToDepPath(version, name);
+        if (depPath != null) queue.push([depPath, optional]);
+      }
+    }
+  }
+  while (queue.length > 0) {
+    const [depPath, optional] = queue.pop();
+    const visitKey = `${optional ? 'o' : 'r'}:${depPath}`;
+    if (visited.has(visitKey)) continue;
+    visited.add(visitKey);
+    (optional ? reachedOptionally : reachedNonOptionally).add(depPath);
+    const snapshot = snapshots[depPath];
+    if (!snapshot) continue;
+    for (const [depType, edgeOptional] of [['dependencies', optional], ['optionalDependencies', true]]) {
+      for (const [name, ref] of Object.entries(snapshot[depType] ?? {})) {
+        const subDepPath = refToDepPath(ref, name);
+        if (subDepPath != null) queue.push([subDepPath, edgeOptional]);
+      }
+    }
+  }
+  for (const [depPath, snapshot] of Object.entries(snapshots)) {
+    if (reachedOptionally.has(depPath) && !reachedNonOptionally.has(depPath)) {
+      snapshot.optional = true;
+    } else {
+      delete snapshot.optional;
+    }
+  }
+}
 function dedupeSnapshotDepsToRootManifest(lockfile, rootManifest) {
   const overridden = new Set(overriddenPackageNames(lockfile.overrides));
   const rootDeps = new Map(Object.entries(nonOptionalDependencies(rootManifest)).filter(([name]) => !overridden.has(name)));