@vzn/vx-lockfile 0.0.636 → 0.0.637

package/src/pnpm.ts

@@ -11,10 +11,9 @@
 //
 // Bun.YAML is the parser: no dependency, and the file is plain YAML.
 
-import { reachDigests } from '@vzn/vx'
-import { pruneEntries, pruneSections, yamlKey } from './blocks.js'
-import { devOnly, record } from './json.js'
-import type { PruneScope } from './scope.js'
+import { reachDigests, type LockfileImporter } from '@vzn/vx'
+import { record } from './json.js'
+import { joinPosix } from './posix.js'
 
 export interface Lockfile {
   readonly version: string
@@ -257,7 +256,8 @@ function buildGraph(lock: Lockfile): Graph {
   const link = (from: number, dir: string, name: string, version: string): void => {
     if (version.startsWith('link:')) {
       const target = joinPosix(dir, version.slice('link:'.length))
-      if (lock.importers.has(target)) edges[from]!.push(index.get(importerNode(target))!)
+      if (target !== undefined && lock.importers.has(target))
+        edges[from]!.push(index.get(importerNode(target))!)
       else material[from] += `\nlink\0${name}\0${version}`
       return
     }
@@ -278,113 +278,23 @@ function buildGraph(lock: Lockfile): Graph {
 }
 
 /**
- * The lockfile cut to the importers at `dirs` (`.` the root) and the
- * packages they reach; every other section as written — catalogs, patches,
- * overrides and settings are the workspace's, and the subset's manifests
- * still name them. A multi-document lockfile keeps the env document whole.
+ * Each importer's `link:` dependencies on other importers. pnpm records
+ * an auto-installed peer (`autoInstallPeers`, the default) under
+ * `dependencies` like any other, so `peers` is empty here: the plugin
+ * asks the importer's manifest which of these are peers.
  */
-export function pruneLockfile(text: string, { dirs, dropped }: PruneScope): string {
-  const marker = [...text.matchAll(/^---[ \t]*$/gm)].at(-1)
-  const cut = marker === undefined ? 0 : marker.index + marker[0].length
-  const lock = parseLockfile(text)
-  // What production struck from each kept importer's manifest.
-  const skip = new Map<string, Set<string>>()
-  if (dropped.size > 0) {
-    const docs: unknown = Bun.YAML.parse(text)
-    const doc = record(Array.isArray(docs) ? docs.at(-1) : docs)
-    for (const [dir, entry] of Object.entries(record(doc?.['importers']) ?? {})) {
-      if (dirs.has(dir)) skip.set(dir, devOnly(record(entry), dropped))
-    }
-  }
-  const reached = new Set<string>()
-  const visit = (dir: string, deps: ReadonlyMap<string, string>, importer = false): void => {
+export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImporter> {
+  const out = new Map<string, LockfileImporter>()
+  for (const [dir, deps] of lock.importers) {
+    const links: Record<string, string> = {}
     for (const [name, version] of deps) {
-      if (importer && skip.get(dir)?.has(name) === true) continue
-      if (version.startsWith('link:')) {
-        const target = joinPosix(dir, version.slice('link:'.length))
-        if (lock.importers.has(target) && !dirs.has(target)) {
-          throw new Error(`pnpm-lock.yaml: ${dir} links ${target}, which the subset leaves out`)
-        }
-        continue
-      }
-      const key = snapshotKey(lock, name, version)
-      if (reached.has(key)) continue
-      reached.add(key)
-      visit('.', lock.snapshots.get(key) ?? new Map())
-    }
-  }
-  for (const [dir, deps] of lock.importers) if (dirs.has(dir)) visit(dir, deps, true)
-  const v9 = Number.parseInt(lock.version, 10) >= 9
-  const packages = new Set([...reached].map((key) => (v9 ? packageKey(key) : key)))
-  return (
-    text.slice(0, cut) +
-    dropImporterDev(
-      pruneSections(text.slice(cut), {
-        importers: (dir) => dirs.has(dir),
-        packages: (key) => packages.has(key),
-        snapshots: (key) => reached.has(key),
-      }),
-      skip,
-    )
-  )
-}
-
-/**
- * Each importer's `devDependencies` without the `dropped` names, cut as
- * lines like every other prune: the subsection goes when it empties, and
- * an importer left with nothing is `{}`, as pnpm writes one.
- */
-function dropImporterDev(text: string, skip: ReadonlyMap<string, ReadonlySet<string>>): string {
-  if (![...skip.values()].some((s) => s.size > 0)) return text
-  const lines = text.split('\n')
-  const start = lines.findIndex((l) => /^importers:\s*$/.test(l))
-  if (start === -1) return text
-  let end = start + 1
-  while (end < lines.length && !/^\S/.test(lines[end]!)) end++
-  const indented = (l: string, n: number): boolean =>
-    l.startsWith(' '.repeat(n)) && /^[^\s#]/.test(l.slice(n))
-  const out = lines.slice(0, start + 1)
-  let i = start + 1
-  while (i < end) {
-    if (!indented(lines[i]!, 2)) {
-      out.push(lines[i++]!)
-      continue
-    }
-    const key = i
-    const dropped = skip.get(yamlKey(lines[key]!)) ?? new Set<string>()
-    let stop = i + 1
-    while (stop < end && !indented(lines[stop]!, 2)) stop++
-    const body: string[] = []
-    for (let j = key + 1; j < stop;) {
-      if (lines[j] !== '    devDependencies:') {
-        body.push(lines[j++]!)
-        continue
+      if (!version.startsWith('link:')) continue
+      const target = joinPosix(dir, version.slice('link:'.length))
+      if (target !== undefined && target !== dir && lock.importers.has(target)) {
+        links[name] = target
       }
-      let sub = j + 1
-      while (sub < stop && (lines[sub]!.trim() === '' || /^ {5,}/.test(lines[sub]!))) sub++
-      const kept = pruneEntries(lines, j + 1, sub, 6, (l) => !dropped.has(yamlKey(l)))
-      if (kept.some((l) => indented(l, 6))) body.push(lines[j]!, ...kept)
-      else body.push(...kept.filter((l) => l.trim() === ''))
-      j = sub
     }
-    const emptied = !body.some((l) => indented(l, 4)) && stop - key - 1 > body.length
-    const entry = !emptied
-      ? [lines[key]!, ...body]
-      : [`${lines[key]!.replace(/:\s*$/, '')}: {}`, ...body.filter((l) => l.trim() === '')]
-    out.push(...entry)
-    i = stop
+    out.set(dir, { deps: links, peers: {} })
   }
-  out.push(...lines.slice(end))
-  return out.join('\n')
-}
-
-/** `packages/a` + `../b` → `packages/b`; `.` + `packages/a` → `packages/a`. POSIX, as the lockfile writes paths. */
-function joinPosix(base: string, rel: string): string {
-  const parts: string[] = []
-  for (const seg of `${base}/${rel}`.split('/')) {
-    if (seg === '' || seg === '.') continue
-    if (seg === '..') parts.pop()
-    else parts.push(seg)
-  }
-  return parts.length === 0 ? '.' : parts.join('/')
+  return out
 }

package/src/posix.ts

@@ -0,0 +1,14 @@
+/**
+ * `packages/a` + `../b` → `packages/b`; `.` + `packages/a` → `packages/a`.
+ * POSIX, as lockfiles write paths. Undefined for a path above the root: it
+ * dropped each `..` past it, so `link:../ext` from the root named `ext`.
+ */
+export function joinPosix(base: string, rel: string): string | undefined {
+  const parts: string[] = []
+  for (const seg of `${base}/${rel}`.split('/')) {
+    if (seg === '' || seg === '.') continue
+    if (seg !== '..') parts.push(seg)
+    else if (parts.pop() === undefined) return undefined
+  }
+  return parts.length === 0 ? '.' : parts.join('/')
+}

package/src/yarn.ts

@@ -11,12 +11,14 @@
 // lockfile's root descriptors only, so a workspace's digest is the root's
 // reach through the descriptors the file resolves.
 
-import path from 'node:path'
-import { reachDigests } from '@vzn/vx'
+import { reachDigests, type LockfileImporter } from '@vzn/vx'
 import { stable } from './pnpm.js'
-import { pruneEntries, yamlKey } from './blocks.js'
 import { depsOf, record } from './json.js'
-import type { PruneScope } from './scope.js'
+import { joinPosix } from './posix.js'
+
+/** What yarn() warns of a classic lockfile, after its name: the static part a test holds. */
+export const CLASSIC_EDGES =
+  ': yarn classic (v1) records no workspaces, so yarn() gives vx no project edges — upgrade to Yarn 2+ (`yarn set version stable`)'
 
 export interface Lockfile {
   readonly generation: 'berry' | 'classic'
@@ -40,8 +42,8 @@ export interface Lockfile {
 
 export interface Entry {
   readonly deps: ReadonlyMap<string, string>
-  /** What the entry installs: `deps` less berry's peers, which its parent provides. */
-  readonly installs: ReadonlyMap<string, string>
+  /** `dependencies` alone, which a workspace entry merges its devDependencies into (berry only) */
+  readonly installed: ReadonlyMap<string, string>
   /** resolution + checksum / version + resolved + integrity */
   readonly resolution: string
 }
@@ -83,7 +85,7 @@ function parseBerry(text: string): Lockfile {
     )
     entries.set(resolution, {
       deps: depsOf(e, ['dependencies', 'peerDependencies']),
-      installs: depsOf(e, ['dependencies']),
+      installed: depsOf(e, ['dependencies']),
       resolution: `${resolution}\0${stable(material)}`,
     })
     // Yarn joins a key's descriptors with ', '; a range's own trailing
@@ -141,7 +143,7 @@ function parseClassic(text: string): Lockfile {
     // to carry that edge, so each entry carries its own descriptors.
     entries.set(id, {
       deps,
-      installs: deps,
+      installed: deps,
       resolution: `${fields['version'] ?? ''}\0${fields['resolved'] ?? ''}\0${fields['integrity'] ?? ''}\0${[...keys].sort().join(',')}`,
     })
     for (const k of keys) descriptors.set(k, id)
@@ -247,6 +249,88 @@ function resolveDescriptor(
   return lock.names.get(name) ?? []
 }
 
+/**
+ * Each berry workspace's dependencies whose descriptor the file resolves
+ * to a workspace entry (a `workspace:` range, or a range Yarn's
+ * transparent workspaces satisfied with one), and its peers on a
+ * workspace of that name, which Yarn hoists whatever the range. Only a
+ * descriptor the file keys counts: the name fallbacks the digest takes
+ * (a catalog, an override) name no link. Classic records no workspaces,
+ * so it has none.
+ */
+export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImporter> {
+  const out = new Map<string, LockfileImporter>()
+  const dirOf = new Map<string, string>()
+  const byName = new Map<string, string>()
+  for (const [dir, id] of lock.workspaces) {
+    dirOf.set(id, dir)
+    byName.set(id.slice(0, id.indexOf('@workspace:')), dir)
+  }
+  for (const [dir, id] of lock.workspaces) {
+    const entry = lock.entries.get(id)!
+    const links = { deps: {} as Record<string, string>, peers: {} as Record<string, string> }
+    const add = (kind: 'deps' | 'peers', name: string, target: string | undefined): void => {
+      if (target !== undefined && target !== dir) links[kind][name] = target
+    }
+    for (const [name, range] of entry.installed) {
+      const keyed = keyedDescriptor(lock, id, name, range)
+      add(
+        'deps',
+        name,
+        keyed === undefined
+          ? range.startsWith('workspace:')
+            ? byName.get(name)
+            : undefined
+          : (dirOf.get(keyed) ?? linkedDir(lock, dirOf, keyed)),
+      )
+    }
+    for (const name of entry.deps.keys()) {
+      if (!entry.installed.has(name)) add('peers', name, byName.get(name))
+    }
+    out.set(dir, links)
+  }
+  return out
+}
+
+/**
+ * The workspace a `link:` or `portal:` entry symlinks, from its resolution
+ * (`b@link:../b::locator=a%40workspace%3Apackages%2Fa`): the path, from the
+ * locating workspace's dir. A `file:` entry is a copy packed at install,
+ * no link to the workspace's build.
+ */
+function linkedDir(
+  lock: Lockfile,
+  dirOf: ReadonlyMap<string, string>,
+  id: string,
+): string | undefined {
+  const m = /^(?:@[^@/]+\/)?[^@]+@(?:link|portal):([^:]*)::locator=([^&]+)/.exec(id)
+  if (m === null) return undefined
+  let locator: string
+  try {
+    locator = decodeURIComponent(m[2]!)
+  } catch {
+    return undefined
+  }
+  const from = dirOf.get(locator)
+  if (from === undefined) return undefined
+  const target = joinPosix(from, m[1]!)
+  return target !== undefined && lock.workspaces.has(target) ? target : undefined
+}
+
+/** The entry a descriptor the file keys resolves to: as written, bound to `from`, or with berry's `npm:` prefix. */
+function keyedDescriptor(
+  lock: Lockfile,
+  from: string,
+  name: string,
+  range: string,
+): string | undefined {
+  return (
+    lock.descriptors.get(`${name}@${range}`) ??
+    lock.descriptors.get(`${name}@${range}::locator=${encodeURIComponent(from)}`) ??
+    (range.includes(':') ? undefined : lock.descriptors.get(`${name}@npm:${range}`))
+  )
+}
+
 /**
  * Every workspace's digest. Berry: one node per entry, workspaces among
  * them, keyed by dir. Classic: the file has no workspace entries, so the
@@ -284,88 +368,3 @@ export function importerDigests(lock: Lockfile): ReadonlyMap<string, string> {
   for (const [dir, id] of lock.workspaces) out.set(dir, fold(digests[index.get(id)!]!))
   return out
 }
-
-/**
- * The lockfile cut to the entries the workspaces at `dirs` install, each
- * entry's text as written. Berry walks from the kept workspace entries;
- * classic records no workspaces, so its walk starts at each kept
- * manifest's dependencies (a workspace sibling has no entry and is
- * skipped).
- */
-export function pruneLockfile(text: string, scope: PruneScope): string {
-  const { dirs, members, manifests, dropped } = scope
-  // Berry merges a workspace's dev dependencies into its entry's
-  // `dependencies`, so a struck name is told by its link: a dropped
-  // workspace package is reached through a `workspace:` range.
-  const isDropped = (name: string, range: string): boolean =>
-    dropped.has(name) && range.startsWith('workspace:')
-  const lock = parseLockfile(text)
-  const reached = new Set<string>()
-  const visit = (id: string | undefined): void => {
-    if (id === undefined || reached.has(id)) return
-    const ws = id.indexOf('@workspace:')
-    const dir = ws === -1 ? undefined : id.slice(ws + '@workspace:'.length)
-    if (dir !== undefined && members.has(dir) && !dirs.has(dir)) {
-      throw new Error(`yarn.lock: ${id} is a workspace the subset leaves out`)
-    }
-    reached.add(id)
-    const kept = dir !== undefined && dirs.has(dir)
-    for (const [name, range] of lock.entries.get(id)!.installs) {
-      if (kept && isDropped(name, range)) continue
-      for (const target of resolveDescriptor(lock, id, name, range)) visit(target)
-    }
-  }
-  const berry = lock.generation === 'berry'
-  // Berry records a workspace's dev dependencies in its entry's
-  // `dependencies`; classic records no workspace, and its manifests are
-  // already stripped.
-  const keptWorkspaces = new Set<string>()
-  if (berry) {
-    for (const [dir, id] of lock.workspaces) {
-      if (!dirs.has(dir)) continue
-      keptWorkspaces.add(id)
-      visit(id)
-    }
-  } else {
-    for (const [dir, deps] of manifests) {
-      if (!dirs.has(dir)) continue
-      for (const [name, range] of deps) {
-        // Classic keys a workspace's `file:` / `link:` path from the root:
-        // `file:./vendor/x` in packages/a is `file:./packages/a/vendor/x`.
-        const local = /^(file|link):(?!\/)(.*)$/.exec(range)
-        const keyed =
-          local === null || dir === '.' ? range : `${local[1]}:./${path.posix.join(dir, local[2]!)}`
-        visit(lock.descriptors.get(`${name}@${keyed}`))
-      }
-    }
-  }
-  const lines = text.split('\n')
-  const first = (line: string): string =>
-    berry
-      ? yamlKey(line).split(',')[0]!.trimStart()
-      : unquote(line.replace(/:\s*$/, '').split(',')[0]!.trim())
-  const pruned = pruneEntries(lines, 0, lines.length, 0, (line) => {
-    if (line.startsWith('__metadata:')) return true
-    const id = lock.descriptors.get(first(line))
-    return id !== undefined && reached.has(id)
-  })
-  if (!berry || dropped.size === 0) return pruned.join('\n')
-  const out: string[] = []
-  let inKept = false
-  for (let i = 0; i < pruned.length; i++) {
-    const line = pruned[i]!
-    if (/^\S/.test(line)) inKept = keptWorkspaces.has(lock.descriptors.get(first(line)) ?? '')
-    if (!inKept || line !== '  dependencies:') {
-      out.push(line)
-      continue
-    }
-    const deps: string[] = []
-    while (i + 1 < pruned.length && pruned[i + 1]!.startsWith('    ')) deps.push(pruned[++i]!)
-    const kept = deps.filter((l) => {
-      const [name, range] = Object.entries(record(Bun.YAML.parse(l.trim())) ?? {})[0] ?? []
-      return name === undefined || !isDropped(name, String(range))
-    })
-    if (kept.length > 0) out.push(line, ...kept)
-  }
-  return out.join('\n')
-}

package/src/blocks.ts

@@ -1,83 +0,0 @@
-// Line-level pruning for the YAML-shaped lockfiles (pnpm-lock.yaml, yarn.lock
-// berry and classic). Rewriting the parsed document would drop the package
-// manager's own layout — its quoting, its blank lines, its key order — so a
-// pruned file is the original with whole entries cut out, and a pruned
-// lockfile diffs against the source as removals only.
-
-/**
- * `lines` with every entry at `indent` spaces between `from` and `to` that
- * `keep` refuses cut out. An entry is its key line and every line after it
- * up to the next key line at that indent; the blank lines separating
- * entries are kept as they were between the survivors, and those after
- * the last entry stay after the last survivor.
- */
-export function pruneEntries(
-  lines: readonly string[],
-  from: number,
-  to: number,
-  indent: number,
-  keep: (keyLine: string) => boolean,
-): string[] {
-  const pad = ' '.repeat(indent)
-  const isKey = (l: string): boolean => l.startsWith(pad) && /^[^\s#]/.test(l.slice(indent))
-  const head: string[] = []
-  let i = from
-  while (i < to && !isKey(lines[i]!)) head.push(lines[i++]!)
-  const entries: string[][] = []
-  let separator: string[] | undefined
-  while (i < to) {
-    const entry = [lines[i++]!]
-    while (i < to && !isKey(lines[i]!)) entry.push(lines[i++]!)
-    entries.push(entry)
-  }
-  const blanks = (e: string[]): string[] => {
-    let n = e.length
-    while (n > 1 && e[n - 1]!.trim() === '') n--
-    return e.splice(n)
-  }
-  const tail = entries.length === 0 ? [] : blanks(entries.at(-1)!)
-  for (const e of entries.slice(0, -1)) {
-    const gap = blanks(e)
-    separator ??= gap
-  }
-  const kept = entries.filter((e) => keep(e[0]!))
-  const out = [...head]
-  for (const [n, e] of kept.entries()) {
-    if (n > 0) out.push(...(separator ?? []))
-    out.push(...e)
-  }
-  out.push(...tail)
-  return out
-}
-
-/** The key a YAML mapping line opens: `  'a@1': {}` → `a@1`, `  .:` → `.`. */
-export function yamlKey(line: string): string {
-  const parsed: unknown = Bun.YAML.parse(line.trim())
-  return parsed !== null && typeof parsed === 'object' ? (Object.keys(parsed)[0] ?? '') : ''
-}
-
-/**
- * `text` with each top-level section named in `sections` pruned to the
- * entries its predicate keeps; every other line as it was.
- */
-export function pruneSections(
-  text: string,
-  sections: Readonly<Record<string, (key: string) => boolean>>,
-): string {
-  const lines = text.split('\n')
-  const out: string[] = []
-  let i = 0
-  while (i < lines.length) {
-    const line = lines[i]!
-    out.push(line)
-    i++
-    const name = /^([A-Za-z]+):\s*$/.exec(line)?.[1]
-    const keep = name === undefined ? undefined : sections[name]
-    if (keep === undefined) continue
-    let end = i
-    while (end < lines.length && !/^\S/.test(lines[end]!)) end++
-    out.push(...pruneEntries(lines, i, end, 2, (l) => keep(yamlKey(l))))
-    i = end
-  }
-  return out.join('\n')
-}