@vzn/vx-lockfile 0.0.645 → 0.0.648

package/src/yarn.ts

@@ -12,9 +12,9 @@
 // one digest is the root's reach through every entry the file resolves.
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
-import { stable } from './pnpm.js'
-import { depsOf, record } from './json.js'
+import { depsOf, record, stable } from './json.js'
 import { joinPosix } from './posix.js'
+import { parseSyml } from './syml.js'
 
 export interface Lockfile {
   readonly generation: 'berry' | 'classic'
@@ -41,6 +41,9 @@ export interface Lockfile {
 }
 
 export interface Entry {
+  /** The package's own name, from the resolution (berry; '' for classic) */
+  readonly name: string
+  readonly version: string
   readonly deps: ReadonlyMap<string, string>
   /** `dependencies` alone, which a workspace entry merges its devDependencies into (berry only) */
   readonly installed: ReadonlyMap<string, string>
@@ -58,9 +61,9 @@ export function parseLockfile(text: string): Lockfile {
 }
 
 function parseBerry(text: string): Lockfile {
-  let doc: unknown
+  let doc: unknown = parseSyml(text)
   try {
-    doc = Bun.YAML.parse(text)
+    doc ??= Bun.YAML.parse(text)
   } catch (err) {
     throw new Error(`yarn.lock: ${err instanceof Error ? err.message : String(err)}`)
   }
@@ -75,15 +78,16 @@ function parseBerry(text: string): Lockfile {
     if (keys === '__metadata') continue
     const e = record(raw) ?? {}
     const resolution = typeof e['resolution'] === 'string' ? e['resolution'] : keys
-    // Every field of the entry but the dependencies it links, so a field
-    // this parser has not heard of moves what reaches the entry: reading
-    // the resolution and checksum alone dropped the root workspace's
-    // `dependenciesMeta` (`built`, `unplugged`), which governs the whole
-    // install (item 933).
-    const material = Object.fromEntries(
-      Object.entries(e).filter(([k]) => k !== 'dependencies' && k !== 'peerDependencies'),
-    )
+    // Every field of the entry, so a field this parser has not heard of
+    // moves what reaches the entry: reading the resolution and checksum
+    // alone dropped the root workspace's `dependenciesMeta` (`built`,
+    // `unplugged`), which governs the whole install (item 933). Its
+    // dependency lists too: the edges say where each lands, not under
+    // which name, and two aliases swapping targets kept the key.
+    const material = e
     entries.set(resolution, {
+      name: resolution.slice(0, resolution.indexOf('@', 1)),
+      version: typeof e['version'] === 'string' ? e['version'] : '',
       deps: depsOf(e, ['dependencies', 'peerDependencies']),
       installed: depsOf(e, ['dependencies']),
       resolution: `${resolution}\0${stable(material)}`,
@@ -102,6 +106,7 @@ function parseBerry(text: string): Lockfile {
         } catch {
           inner = patch[1]!
         }
+        inner = npmDefault(inner)
         const ids = patches.get(inner)
         if (ids === undefined) patches.set(inner, [resolution])
         else if (!ids.includes(resolution)) ids.push(resolution)
@@ -126,6 +131,15 @@ function parseBerry(text: string): Lockfile {
   }
 }
 
+// Yarn 2/3 write a patch's inner descriptor with no protocol
+// (`resolve@^1.22.0`) where Yarn 4 writes `resolve@npm:^1.22.0`; npm: is
+// Yarn's default, so both key the same plain descriptor (turborepo#4770).
+function npmDefault(descriptor: string): string {
+  const at = descriptor.indexOf('@', 1)
+  const range = descriptor.slice(at + 1)
+  return range.includes(':') ? descriptor : `${descriptor.slice(0, at)}@npm:${range}`
+}
+
 /** The classic format: an unquoted-YAML dialect with `key value` lines. */
 function parseClassic(text: string): Lockfile {
   const entries = new Map<string, Entry>()
@@ -144,6 +158,8 @@ function parseClassic(text: string): Lockfile {
     // the digest did not move (item 902). Classic has no workspace entries
     // to carry that edge, so each entry carries its own descriptors.
     entries.set(id, {
+      name: '',
+      version: fields['version'] ?? '',
       deps,
       installed: deps,
       resolution: `${fields['version'] ?? ''}\0${fields['resolved'] ?? ''}\0${fields['integrity'] ?? ''}\0${[...keys].sort().join(',')}`,
@@ -204,7 +220,8 @@ function unquote(s: string): string {
  * workspace's manifest (`manifests`: importer dir → `package.json`, `.`
  * the root). A dependency on a workspace's name is linked unless the file
  * keys its descriptor, which Yarn writes only for the registry copy it
- * fetched when the workspace's version misses the range. A peer on a
+ * fetched when the workspace's version misses the range, and a `file:`
+ * range is a copy, no link. A peer on a
  * workspace with no installed entry of that name is a peer link.
  */
 export function classicLinks(
@@ -221,6 +238,7 @@ export function classicLinks(
   }
   const workspace = (name: string): string | undefined =>
     count.get(name) === 1 ? dirOf.get(name) : undefined
+  const forced = everywhereResolutions(manifests.get('.'))
   const out = new Map<string, LockfileImporter>()
   for (const [dir, pkg] of manifests) {
     const links = { deps: {} as Record<string, string>, peers: {} as Record<string, string> }
@@ -229,7 +247,20 @@ export function classicLinks(
       for (const [name, range] of depsOf(pkg, [field])) {
         installed.add(name)
         const target = workspace(name)
-        if (target !== undefined && target !== dir && !lock.descriptors.has(`${name}@${range}`)) {
+        // A root resolution rewrites the request before the workspace is
+        // asked: Yarn keys the resolution's range, never the manifest's.
+        const asked = forced.get(name) ?? range
+        // A `file:` range is a copy packed at install, as berry's (`linkedDir`).
+        if (asked.startsWith('file:')) continue
+        // A `link:` symlinks its directory whatever the name: under another
+        // name (`"y": "link:../c"`) the name found no workspace.
+        if (asked.startsWith('link:')) {
+          const linked = joinPosix(dir, asked.slice('link:'.length))
+          if (linked !== undefined && linked !== dir && manifests.has(linked))
+            links.deps[name] = linked
+          continue
+        }
+        if (target !== undefined && target !== dir && !lock.descriptors.has(`${name}@${asked}`)) {
           links.deps[name] = target
         }
       }
@@ -243,6 +274,23 @@ export function classicLinks(
   return out
 }
 
+/**
+ * The root manifest's Yarn 1 `resolutions` that rewrite every request of a
+ * name (`ms`, `**\/ms`, `@s/x`), name → range, the first that names it
+ * winning as in Yarn. One scoped to a parent (`a/ms`, `a/**\/ms`) is left
+ * out: Yarn 1.22 keys its range and still hoists the workspace link over
+ * it, so the link stands.
+ */
+function everywhereResolutions(root: Record<string, unknown> | undefined): Map<string, string> {
+  const out = new Map<string, string>()
+  for (const [pattern, range] of depsOf(root ?? {}, ['resolutions'])) {
+    const name = pattern.replace(/^(?:\*\*\/)+/, '')
+    if (!/^(?:@[^/]+\/)?[^/@*]+$/.test(name) || out.has(name)) continue
+    out.set(name, range)
+  }
+  return out
+}
+
 /**
  * `bar` + `npm:^2` → the entry keyed `bar@npm:^2`; classic: `bar@^2`. A
  * bare range gets berry's `npm:` prefix. A `workspace:` range resolves to
@@ -266,7 +314,7 @@ function resolveDescriptor(
   // A patched descriptor reaches the patched entries Yarn installs as well
   // as the plain one it keys (item 1074).
   const withPatch = (descriptor: string, id: string): readonly string[] => {
-    const patched = lock.patches.get(descriptor)
+    const patched = lock.patches.get(npmDefault(descriptor))
     return patched === undefined ? [id] : [id, ...patched.filter((p) => p !== id)]
   }
   const direct = lock.descriptors.get(`${name}@${range}`)
@@ -392,9 +440,81 @@ function contentDirs(lock: Lockfile): Map<string, string> {
   return out
 }
 
-/** The directories `contentDirs` names, for the claim to hash. */
-export function fileDeps(lock: Lockfile): string[] {
-  return [...new Set(contentDirs(lock).values())].sort()
+/**
+ * The directories `contentDirs` names, for the claim to hash, but a
+ * classic `link:` to a directory `workspace` says is one: Yarn 1 links
+ * that workspace as it would by its name. Berry's also `.yarnrc.yml`,
+ * whose `packageExtensions` the digest reads: as an extra file it joins
+ * the memo's identity, so an extension edit under an unchanged lockfile
+ * digests anew rather than replaying the old closure.
+ */
+export function fileDeps(lock: Lockfile, workspace?: (dir: string) => boolean): string[] {
+  const out = new Set<string>()
+  for (const [id, dir] of contentDirs(lock)) {
+    if (workspace !== undefined && /^.[^@]*@link:/.test(id) && workspace(dir)) continue
+    out.add(dir)
+  }
+  const dirs = [...out].sort()
+  return lock.generation === 'berry' ? [...dirs, YARNRC] : dirs
+}
+
+export const YARNRC = '.yarnrc.yml'
+
+/** One `packageExtensions` selector (`ident@range`) and the dependencies it adds. */
+export interface Extension {
+  readonly name: string
+  readonly range: string
+  readonly deps: ReadonlyMap<string, string>
+}
+
+// Yarn's builtin list (yarnpkg-extensions) adds one dependency; the rest
+// are peers, which the parent that provides them already reaches.
+const BUILTIN: readonly Extension[] = [
+  { name: '@babel/parser', range: '*', deps: new Map([['@babel/types', '^7.8.3']]) },
+]
+
+/**
+ * Yarn's builtin extensions and `.yarnrc.yml`'s `packageExtensions`
+ * dependencies. A file Yarn itself would refuse adds none: the entries
+ * an extension installed are then reached by no one, and every workspace
+ * folds them (`importerDigests`).
+ */
+export function packageExtensions(rc: string | undefined): readonly Extension[] {
+  if (rc === undefined) return BUILTIN
+  let doc: unknown
+  try {
+    doc = Bun.YAML.parse(rc)
+  } catch {
+    return BUILTIN
+  }
+  const out = [...BUILTIN]
+  for (const [selector, raw] of Object.entries(record(record(doc)?.['packageExtensions']) ?? {})) {
+    const deps = depsOf(record(raw) ?? {}, ['dependencies'])
+    if (deps.size === 0) continue
+    const at = selector.indexOf('@', 1)
+    out.push(
+      at === -1
+        ? { name: selector, range: '*', deps }
+        : { name: selector.slice(0, at), range: selector.slice(at + 1), deps },
+    )
+  }
+  return out
+}
+
+/**
+ * Whether `version` is what the selector's range extends. Yarn matches
+ * prereleases too (`satisfiesWithPrereleases`), and a range this cannot
+ * read matches: an edge too many re-keys once too often, never too seldom.
+ */
+function matches(range: string, version: string): boolean {
+  const r = range.startsWith('npm:') ? range.slice(4) : range
+  try {
+    if (Bun.semver.satisfies(version, r)) return true
+    const release = version.replace(/[-+].*$/, '')
+    return release !== version && Bun.semver.satisfies(release, r)
+  } catch {
+    return true
+  }
 }
 
 /** The entry a descriptor the file keys resolves to: as written, bound to `from`, or with berry's `npm:` prefix. */
@@ -411,6 +531,48 @@ function keyedDescriptor(
   )
 }
 
+/**
+ * Yarn installs a `packageExtensions` dependency for each package its
+ * selector matches that does not declare one of that name, and records
+ * it on no entry (turborepo#14873): only the added package is keyed, so
+ * the extended package gets the edge here. Then every entry no workspace
+ * reaches (one an extension vx could not read installed) becomes an edge
+ * of every workspace: it is installed for one of them.
+ */
+function extend(
+  lock: Lockfile,
+  index: ReadonlyMap<string, number>,
+  edges: number[][],
+  extensions: readonly Extension[],
+): void {
+  for (const [id, e] of lock.entries) {
+    for (const ext of extensions) {
+      if (ext.name !== e.name || !matches(ext.range, e.version)) continue
+      for (const [name, range] of ext.deps) {
+        if (e.installed.has(name)) continue
+        for (const target of resolveDescriptor(lock, id, name, range)) {
+          edges[index.get(id)!]!.push(index.get(target)!)
+        }
+      }
+    }
+  }
+  const roots = [...lock.workspaces.values()].map((id) => index.get(id)!)
+  const seen = new Uint8Array(edges.length)
+  const stack = [...roots]
+  for (const r of roots) seen[r] = 1
+  while (stack.length > 0) {
+    for (const w of edges[stack.pop()!]!) {
+      if (seen[w] === 0) {
+        seen[w] = 1
+        stack.push(w)
+      }
+    }
+  }
+  const orphans: number[] = []
+  for (let i = 0; i < seen.length; i++) if (seen[i] === 0) orphans.push(i)
+  if (orphans.length > 0) for (const r of roots) edges[r]!.push(...orphans)
+}
+
 /**
  * Every workspace's digest. Berry: one node per entry, workspaces among
  * them, keyed by dir. Classic: the file has no workspace entries, so the
@@ -420,6 +582,7 @@ function keyedDescriptor(
 export function importerDigests(
   lock: Lockfile,
   files: ReadonlyMap<string, string> = new Map(),
+  extensions: readonly Extension[] = BUILTIN,
 ): ReadonlyMap<string, string> {
   const index = new Map<string, number>()
   const material: string[] = []
@@ -441,6 +604,19 @@ export function importerDigests(
       if (targets.length === 0) material[from] += `\nunresolved\0${name}\0${range}`
     }
   }
+  if (lock.generation === 'berry') {
+    // A `link:` or `portal:` to a workspace symlinks the workspace itself:
+    // its entry lists no dependencies, and as a leaf the linked
+    // workspace's bumps moved no key of the project linking it.
+    const dirOf = new Map<string, string>()
+    for (const [dir, id] of lock.workspaces) dirOf.set(id, dir)
+    for (const id of lock.entries.keys()) {
+      const target = linkedDir(lock, dirOf, id)
+      if (target !== undefined)
+        edges[index.get(id)!]!.push(index.get(lock.workspaces.get(target)!)!)
+    }
+    extend(lock, index, edges, extensions)
+  }
   const digests = reachDigests({ material, edges })
   // The global digest rides as DATA: Bun's xxHash3 reads only the low 32
   // bits of a seed, so two lockfiles' globals could share one (item 682).