@yanglaofish/fishtools 0.5.1 → 0.5.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yanglaofish/fishtools",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Fishtools 插件式工作流工作台",
   "type": "module",
   "license": "MIT",
@@ -20,7 +20,7 @@
     "fst": "bin/fst.js"
   },
   "engines": {
-    "node": ">=24.15.0"
+    "node": "^22.22.2 || >=24.0.0"
   },
   "files": [
     "bin",
@@ -36,57 +36,57 @@
     "require-from-string": "2.0.2",
     "@mytools/core": "0.1.0",
     "@mytools/pack": "0.1.0",
-    "@npmcli/arborist": "10.0.3",
+    "@npmcli/arborist": "9.9.2",
     "@gar/promise-retry": "1.0.3",
     "@isaacs/string-locale-compare": "1.1.0",
-    "@npmcli/fs": "6.0.0",
+    "@npmcli/fs": "5.0.0",
     "semver": "7.7.4",
-    "@npmcli/installed-package-contents": "5.0.0",
-    "npm-bundled": "6.0.0",
-    "npm-normalize-package-bin": "6.0.0",
-    "@npmcli/map-workspaces": "6.0.0",
-    "@npmcli/name-from-folder": "5.0.0",
-    "@npmcli/package-json": "8.0.0",
-    "@npmcli/git": "8.0.0",
-    "@npmcli/promise-spawn": "10.0.0",
-    "which": "7.0.0",
+    "@npmcli/installed-package-contents": "4.0.0",
+    "npm-bundled": "5.0.0",
+    "npm-normalize-package-bin": "5.0.0",
+    "@npmcli/map-workspaces": "5.0.3",
+    "@npmcli/name-from-folder": "4.0.0",
+    "@npmcli/package-json": "7.0.5",
+    "@npmcli/git": "7.0.2",
+    "@npmcli/promise-spawn": "9.0.1",
+    "which": "6.0.1",
     "isexe": "4.0.0",
-    "ini": "7.0.0",
+    "ini": "6.0.0",
     "lru-cache": "11.5.3",
-    "npm-pick-manifest": "12.0.0",
-    "npm-install-checks": "9.0.0",
-    "npm-package-arg": "14.0.0",
-    "hosted-git-info": "10.1.1",
-    "proc-log": "7.0.0",
-    "validate-npm-package-name": "8.0.0",
+    "npm-pick-manifest": "11.0.3",
+    "npm-install-checks": "8.0.0",
+    "npm-package-arg": "13.0.2",
+    "hosted-git-info": "9.0.3",
+    "proc-log": "6.1.0",
+    "validate-npm-package-name": "7.0.2",
     "glob": "13.0.6",
     "minimatch": "10.2.6",
     "brace-expansion": "5.0.12",
     "balanced-match": "4.0.4",
     "minipass": "7.1.3",
     "path-scurry": "2.0.2",
-    "json-parse-even-better-errors": "6.0.0",
+    "json-parse-even-better-errors": "5.0.0",
     "spdx-expression-parse": "4.0.0",
     "spdx-exceptions": "2.5.0",
     "spdx-license-ids": "3.0.24",
-    "@npmcli/metavuln-calculator": "10.0.0",
-    "cacache": "21.0.1",
+    "@npmcli/metavuln-calculator": "9.0.3",
+    "cacache": "20.0.4",
     "fs-minipass": "3.0.3",
     "minipass-collect": "2.0.1",
     "minipass-flush": "1.0.7",
     "yallist": "4.0.0",
     "minipass-pipeline": "1.2.4",
     "p-map": "7.0.8",
-    "ssri": "14.0.0",
-    "pacote": "22.0.0",
-    "@npmcli/run-script": "11.0.0",
-    "@npmcli/node-gyp": "6.0.0",
-    "node-gyp": "13.1.0",
+    "ssri": "13.0.1",
+    "pacote": "21.5.1",
+    "@npmcli/run-script": "10.0.4",
+    "@npmcli/node-gyp": "5.0.0",
+    "node-gyp": "12.4.0",
     "env-paths": "2.2.1",
     "exponential-backoff": "3.1.3",
     "graceful-fs": "4.2.11",
-    "nopt": "10.0.1",
-    "abbrev": "5.0.0",
+    "nopt": "9.0.0",
+    "abbrev": "4.0.0",
     "tar": "7.5.22",
     "@isaacs/fs-minipass": "4.0.1",
     "chownr": "3.0.0",
@@ -94,54 +94,52 @@
     "tinyglobby": "0.2.17",
     "fdir": "6.5.0",
     "picomatch": "4.0.7",
-    "undici": "8.11.2",
-    "npm-packlist": "11.3.0",
-    "ignore-walk": "9.0.0",
-    "npm-registry-fetch": "20.0.1",
-    "@npmcli/redact": "5.0.0",
+    "undici": "6.29.0",
+    "npm-packlist": "10.0.4",
+    "ignore-walk": "8.0.0",
+    "npm-registry-fetch": "19.1.1",
+    "@npmcli/redact": "4.0.0",
     "jsonparse": "1.3.1",
-    "make-fetch-happen": "16.0.1",
-    "@npmcli/agent": "5.0.2",
-    "agent-base": "9.0.0",
-    "http-proxy-agent": "9.1.0",
+    "make-fetch-happen": "15.0.6",
+    "@npmcli/agent": "4.0.2",
+    "agent-base": "7.1.4",
+    "http-proxy-agent": "7.0.2",
     "debug": "4.4.3",
     "ms": "2.1.3",
-    "proxy-agent-negotiate": "1.1.0",
-    "https-proxy-agent": "9.1.0",
-    "socks-proxy-agent": "10.1.0",
+    "https-proxy-agent": "7.0.6",
+    "socks-proxy-agent": "8.0.5",
     "socks": "2.8.10",
-    "ip-address": "10.7.3",
+    "ip-address": "10.7.4",
     "smart-buffer": "4.2.0",
     "http-cache-semantics": "4.3.0",
-    "minipass-fetch": "6.0.0",
+    "minipass-fetch": "5.0.2",
     "minipass-sized": "2.0.0",
     "iconv-lite": "0.7.3",
     "safer-buffer": "2.1.2",
     "negotiator": "1.1.0",
     "content-type": "2.1.0",
-    "sigstore": "5.0.0",
-    "@sigstore/bundle": "5.0.0",
+    "sigstore": "4.1.1",
+    "@sigstore/bundle": "4.0.0",
     "@sigstore/protobuf-specs": "0.5.2",
-    "@sigstore/core": "4.0.1",
-    "@sigstore/sign": "5.0.0",
-    "@sigstore/tuf": "5.0.0",
-    "tuf-js": "6.0.0",
-    "@tufjs/models": "5.0.0",
+    "@sigstore/core": "3.2.1",
+    "@sigstore/sign": "4.1.1",
+    "@sigstore/tuf": "4.0.2",
+    "tuf-js": "4.1.0",
+    "@tufjs/models": "4.1.0",
     "@tufjs/canonical-json": "2.0.0",
-    "@sigstore/verify": "4.1.2",
+    "@sigstore/verify": "3.1.1",
     "@npmcli/query": "5.0.0",
     "postcss-selector-parser": "7.1.6",
     "cssesc": "3.0.0",
     "util-deprecate": "1.0.2",
-    "bin-links": "7.0.0",
-    "cmd-shim": "9.0.2",
-    "read-cmd-shim": "7.0.1",
-    "write-file-atomic": "8.0.0",
+    "bin-links": "6.0.2",
+    "cmd-shim": "8.0.0",
+    "read-cmd-shim": "6.0.0",
+    "write-file-atomic": "7.0.1",
     "signal-exit": "4.1.0",
     "common-ancestor-path": "2.0.0",
-    "diff": "8.0.4",
     "json-stringify-nice": "1.1.4",
-    "parse-conflict-json": "6.0.0",
+    "parse-conflict-json": "5.0.1",
     "just-diff": "6.0.2",
     "just-diff-apply": "5.5.0",
     "proggy": "4.0.0",
@@ -226,6 +224,7 @@
     "cac": "6.7.14",
     "kleur": "4.1.5",
     "acorn": "8.19.0",
+    "@mytools/commands": "0.1.0",
     "@mytools/fst-logs": "0.1.0",
     "@mytools/fst-workflow": "0.1.0",
     "@mytools/fst-workspace": "0.1.0",
@@ -376,7 +375,6 @@
     "http-proxy-agent",
     "debug",
     "ms",
-    "proxy-agent-negotiate",
     "https-proxy-agent",
     "socks-proxy-agent",
     "socks",
@@ -409,7 +407,6 @@
     "write-file-atomic",
     "signal-exit",
     "common-ancestor-path",
-    "diff",
     "json-stringify-nice",
     "parse-conflict-json",
     "just-diff",
@@ -496,6 +493,7 @@
     "cac",
     "kleur",
     "acorn",
+    "@mytools/commands",
     "@mytools/fst-logs",
     "@mytools/fst-workflow",
     "@mytools/fst-workspace",

package/node_modules/@npmcli/arborist/lib/npm-extension.js

@@ -1,237 +0,0 @@
-// Root-owned `.npm-extension.{mjs,cjs}`: an imperative `transformManifest(pkg, context)` extension point that repairs third-party manifests before Arborist reads a candidate's dependency edges.
-// See RFC: https://github.com/npm/rfcs/pull/903
-// This module discovers and hashes the root extension file, loads its `transformManifest` export, and applies it to a deeply isolated manifest copy, returning an extended manifest plus minimal provenance.
-// It never mutates the input manifest or any shared cache object.
-const { resolve, sep } = require('node:path')
-const { readFileSync, existsSync } = require('node:fs')
-const { pathToFileURL } = require('node:url')
-const { isDeepStrictEqual } = require('node:util')
-const { log } = require('proc-log')
-const ssri = require('ssri')
-const { EXTENSION_FIELDS } = require('./package-extensions.js')
-
-const EXTENSION_POINT = 'transformManifest'
-
-// The two supported module formats and their default discovery filenames.
-const FORMATS = [
-  { ext: 'mjs', file: '.npm-extension.mjs' },
-  { ext: 'cjs', file: '.npm-extension.cjs' },
-]
-
-const err = (message, code, extra = {}) =>
-  Object.assign(new Error(message), { code, ...extra })
-
-// Read a file's bytes, or null when it does not exist.
-const readBytes = path => {
-  try {
-    return readFileSync(path)
-  } catch (e) {
-    if (e.code === 'ENOENT') {
-      return null
-    }
-    throw e
-  }
-}
-
-// Resolve which extension file to load, returning { path, format, bytes } or null when none is present.
-// A configured `extension-file` wins over default discovery; it must resolve inside the project root and use a `.mjs` or `.cjs` extension.
-// When both default files exist npm fails rather than choosing one implicitly.
-const discover = (root, extensionFile) => {
-  if (extensionFile) {
-    const path = resolve(root, extensionFile)
-    if (path !== root && !path.startsWith(root + sep)) {
-      throw err(`extension-file "${extensionFile}" must resolve inside the project root`, 'ENPMEXTENSIONPATH')
-    }
-    const format = FORMATS.find(f => path.endsWith(`.${f.ext}`))?.ext
-    if (!format) {
-      throw err(`extension-file "${extensionFile}" must use a .mjs or .cjs extension`, 'ENPMEXTENSIONPATH')
-    }
-    const bytes = readBytes(path)
-    if (bytes === null) {
-      throw err(`extension-file "${extensionFile}" was not found`, 'ENPMEXTENSIONPATH')
-    }
-    return { path, format, bytes }
-  }
-  const found = FORMATS
-    .map(f => ({ path: resolve(root, f.file), format: f.ext, bytes: readBytes(resolve(root, f.file)) }))
-    .filter(f => f.bytes !== null)
-  if (found.length > 1) {
-    throw err('found both .npm-extension.mjs and .npm-extension.cjs; keep only one', 'ENPMEXTENSIONDUP')
-  }
-  return found[0] || null
-}
-
-// Hash the selected extension file: a format-tagged prefix plus the raw file bytes, using npm's lockfile digest encoding.
-// The prefix keeps `.mjs` and `.cjs` files with identical bytes distinct, and excludes any path so the digest is machine-independent.
-const hashFile = (format, bytes) =>
-  ssri.fromData(
-    Buffer.concat([Buffer.from(`npm-extension:v1:${format}\n`), bytes]),
-    { algorithms: ['sha512'] }
-  ).toString()
-
-class NpmExtension {
-  #cache = new Map()
-  #transform = null
-
-  constructor ({ root, extensionFile = null } = {}) {
-    this.root = root
-    this.path = null
-    this.format = null
-    this.hash = null
-
-    const selected = root ? discover(root, extensionFile) : null
-    if (!selected) {
-      this.present = false
-      return
-    }
-    this.present = true
-    this.path = selected.path
-    this.format = selected.format
-    this.hash = hashFile(selected.format, selected.bytes)
-  }
-
-  // Import the extension module and capture its `transformManifest` export.
-  // ESM files are loaded with dynamic import; CommonJS files with require.
-  // The export must be a function; anything else fails the install.
-  async load () {
-    if (!this.present) {
-      return
-    }
-    // Key the module load by the file hash so a changed file is reloaded rather than served stale from a module cache within one process.
-    let mod
-    if (this.format === 'mjs') {
-      mod = await import(`${pathToFileURL(this.path).href}?h=${this.hash}`)
-    } else {
-      delete require.cache[require.resolve(this.path)]
-      mod = require(this.path)
-    }
-    const transform = mod?.transformManifest ?? mod?.default?.transformManifest
-    if (typeof transform !== 'function') {
-      throw err(`.npm-extension must export a transformManifest function`, 'ENPMEXTENSIONSHAPE')
-    }
-    this.#transform = transform
-  }
-
-  // Apply transformManifest to a candidate manifest, returning { pkg, applied } or null when nothing changed.
-  // Results are cached once per resolved package identity; consumers get a deeply isolated copy so they cannot mutate the cached effective manifest.
-  // Pass { memoize: false } to run without caching, e.g. a staleness probe over partial lockfile manifests that must not seed the cache used by full-manifest fetches.
-  apply (pkg, { memoize = true } = {}) {
-    if (!this.#transform || !pkg?.name) {
-      return null
-    }
-    const key = this.#identity(pkg)
-    let result
-    if (this.#cache.has(key)) {
-      result = this.#cache.get(key)
-    } else {
-      result = this.#run(pkg)
-      if (memoize) {
-        this.#cache.set(key, result)
-      }
-    }
-    return result && { pkg: structuredClone(result.pkg), applied: structuredClone(result.applied) }
-  }
-
-  // Identity key for the transform cache: package integrity when available, otherwise resolved source plus name and version.
-  #identity (pkg) {
-    return pkg._integrity || `${pkg._resolved || ''}:${pkg.name}@${pkg.version || ''}`
-  }
-
-  // Run transformManifest on a deeply isolated copy and validate the result.
-  // Returns { pkg, applied } when dependency or peer metadata changed, or null when it did not.
-  #run (pkg) {
-    const context = {
-      log: message => log.silly('npm-extension', message),
-      root: this.root,
-      extensionPoint: EXTENSION_POINT,
-    }
-    let returned
-    try {
-      returned = this.#transform(structuredClone(pkg), context)
-    } catch (e) {
-      throw err(
-        `.npm-extension transformManifest threw while processing ${pkg.name}@${pkg.version}: ${e.message}`,
-        'ENPMEXTENSIONTHROW', { pkgid: `${pkg.name}@${pkg.version}` })
-    }
-    if (returned && typeof returned.then === 'function') {
-      throw err(
-        `.npm-extension transformManifest must return a manifest synchronously, not a promise, for ${pkg.name}@${pkg.version}`,
-        'ENPMEXTENSIONRETURN', { pkgid: `${pkg.name}@${pkg.version}` })
-    }
-    if (!returned || typeof returned !== 'object' || Array.isArray(returned)) {
-      throw err(
-        `.npm-extension transformManifest must return a manifest object for ${pkg.name}@${pkg.version}`,
-        'ENPMEXTENSIONRETURN', { pkgid: `${pkg.name}@${pkg.version}` })
-    }
-    // Only dependency and peer fields may change; any other field the returned manifest explicitly alters is rejected.
-    // Fields the returned object omits are left untouched, so a handler may return a new object with only the fields it repairs.
-    for (const k of Object.keys(returned)) {
-      if (!EXTENSION_FIELDS.includes(k) && !isDeepStrictEqual(returned[k], pkg[k])) {
-        throw err(
-          `.npm-extension transformManifest changed unsupported field "${k}" on ${pkg.name}@${pkg.version}; only ${EXTENSION_FIELDS.join(', ')} may change`,
-          'ENPMEXTENSIONFIELD', { pkgid: `${pkg.name}@${pkg.version}`, field: k })
-      }
-    }
-    // Build the effective manifest from the normalized baseline plus the returned allowlisted fields.
-    // A field the handler omits is left as the baseline; delete individual entries by returning a field object without them.
-    const next = { ...pkg }
-    for (const field of EXTENSION_FIELDS) {
-      if (returned[field] === undefined) {
-        continue
-      }
-      this.#validateField(field, returned[field], pkg)
-      next[field] = returned[field]
-    }
-    const applied = this.#provenance(pkg, next)
-    return applied && { pkg: next, applied }
-  }
-
-  // Validate a returned allowlisted field and its entries, so invalid output fails with .npm-extension and package context.
-  // Dependency maps hold version strings; peerDependenciesMeta holds metadata objects.
-  #validateField (field, value, pkg) {
-    const fail = (suffix) => err(
-      `.npm-extension transformManifest set ${suffix} to an invalid value on ${pkg.name}@${pkg.version}`,
-      'ENPMEXTENSIONVALUE', { pkgid: `${pkg.name}@${pkg.version}`, field })
-    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
-      throw fail(field)
-    }
-    for (const [name, entry] of Object.entries(value)) {
-      if (field === 'peerDependenciesMeta') {
-        if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {
-          throw fail(`${field}.${name}`)
-        }
-      } else if (typeof entry !== 'string') {
-        throw fail(`${field}.${name}`)
-      }
-    }
-  }
-
-  // Minimal provenance: the extension point plus, for each changed allowlisted field, a sorted array of affected dependency names.
-  // Returns null when nothing changed.
-  #provenance (before, after) {
-    const applied = { extensionPoint: EXTENSION_POINT }
-    let changed = false
-    for (const field of EXTENSION_FIELDS) {
-      const b = before[field] || {}
-      const a = after[field] || {}
-      const names = [...new Set([...Object.keys(b), ...Object.keys(a)])]
-        .filter(n => !isDeepStrictEqual(b[n], a[n]))
-        .sort()
-      if (names.length) {
-        applied[field] = names
-        changed = true
-      }
-    }
-    return changed ? applied : null
-  }
-}
-
-// Whether a directory contains any default .npm-extension file; a non-throwing existence check used for non-root workspace warnings.
-const hasExtensionFile = dir => FORMATS.some(f => existsSync(resolve(dir, f.file)))
-
-module.exports = NpmExtension
-module.exports.NpmExtension = NpmExtension
-module.exports.discover = discover
-module.exports.hasExtensionFile = hasExtensionFile
-module.exports.hashFile = hashFile
-module.exports.EXTENSION_POINT = EXTENSION_POINT