@yanglaofish/fishtools 0.5.2 → 0.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yanglaofish/fishtools",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "description": "Fishtools 插件式工作流工作台",
   "type": "module",
   "license": "MIT",
@@ -20,7 +20,7 @@
     "fst": "bin/fst.js"
   },
   "engines": {
-    "node": ">=24.15.0"
+    "node": "^22.22.2 || >=24.0.0"
   },
   "files": [
     "bin",
@@ -36,57 +36,57 @@
     "require-from-string": "2.0.2",
     "@mytools/core": "0.1.0",
     "@mytools/pack": "0.1.0",
-    "@npmcli/arborist": "10.0.3",
+    "@npmcli/arborist": "9.9.2",
     "@gar/promise-retry": "1.0.3",
     "@isaacs/string-locale-compare": "1.1.0",
-    "@npmcli/fs": "6.0.0",
+    "@npmcli/fs": "5.0.0",
     "semver": "7.7.4",
-    "@npmcli/installed-package-contents": "5.0.0",
-    "npm-bundled": "6.0.0",
-    "npm-normalize-package-bin": "6.0.0",
-    "@npmcli/map-workspaces": "6.0.0",
-    "@npmcli/name-from-folder": "5.0.0",
-    "@npmcli/package-json": "8.0.0",
-    "@npmcli/git": "8.0.0",
-    "@npmcli/promise-spawn": "10.0.0",
-    "which": "7.0.0",
+    "@npmcli/installed-package-contents": "4.0.0",
+    "npm-bundled": "5.0.0",
+    "npm-normalize-package-bin": "5.0.0",
+    "@npmcli/map-workspaces": "5.0.3",
+    "@npmcli/name-from-folder": "4.0.0",
+    "@npmcli/package-json": "7.0.5",
+    "@npmcli/git": "7.0.2",
+    "@npmcli/promise-spawn": "9.0.1",
+    "which": "6.0.1",
     "isexe": "4.0.0",
-    "ini": "7.0.0",
+    "ini": "6.0.0",
     "lru-cache": "11.5.3",
-    "npm-pick-manifest": "12.0.0",
-    "npm-install-checks": "9.0.0",
-    "npm-package-arg": "14.0.0",
-    "hosted-git-info": "10.1.1",
-    "proc-log": "7.0.0",
-    "validate-npm-package-name": "8.0.0",
+    "npm-pick-manifest": "11.0.3",
+    "npm-install-checks": "8.0.0",
+    "npm-package-arg": "13.0.2",
+    "hosted-git-info": "9.0.3",
+    "proc-log": "6.1.0",
+    "validate-npm-package-name": "7.0.2",
     "glob": "13.0.6",
     "minimatch": "10.2.6",
     "brace-expansion": "5.0.12",
     "balanced-match": "4.0.4",
     "minipass": "7.1.3",
     "path-scurry": "2.0.2",
-    "json-parse-even-better-errors": "6.0.0",
+    "json-parse-even-better-errors": "5.0.0",
     "spdx-expression-parse": "4.0.0",
     "spdx-exceptions": "2.5.0",
     "spdx-license-ids": "3.0.24",
-    "@npmcli/metavuln-calculator": "10.0.0",
-    "cacache": "21.0.1",
+    "@npmcli/metavuln-calculator": "9.0.3",
+    "cacache": "20.0.4",
     "fs-minipass": "3.0.3",
     "minipass-collect": "2.0.1",
     "minipass-flush": "1.0.7",
     "yallist": "4.0.0",
     "minipass-pipeline": "1.2.4",
     "p-map": "7.0.8",
-    "ssri": "14.0.0",
-    "pacote": "22.0.0",
-    "@npmcli/run-script": "11.0.0",
-    "@npmcli/node-gyp": "6.0.0",
-    "node-gyp": "13.1.0",
+    "ssri": "13.0.1",
+    "pacote": "21.5.1",
+    "@npmcli/run-script": "10.0.4",
+    "@npmcli/node-gyp": "5.0.0",
+    "node-gyp": "12.4.0",
     "env-paths": "2.2.1",
     "exponential-backoff": "3.1.3",
     "graceful-fs": "4.2.11",
-    "nopt": "10.0.1",
-    "abbrev": "5.0.0",
+    "nopt": "9.0.0",
+    "abbrev": "4.0.0",
     "tar": "7.5.22",
     "@isaacs/fs-minipass": "4.0.1",
     "chownr": "3.0.0",
@@ -94,54 +94,52 @@
     "tinyglobby": "0.2.17",
     "fdir": "6.5.0",
     "picomatch": "4.0.7",
-    "undici": "8.11.2",
-    "npm-packlist": "11.3.0",
-    "ignore-walk": "9.0.0",
-    "npm-registry-fetch": "20.0.1",
-    "@npmcli/redact": "5.0.0",
+    "undici": "6.29.0",
+    "npm-packlist": "10.0.4",
+    "ignore-walk": "8.0.0",
+    "npm-registry-fetch": "19.1.1",
+    "@npmcli/redact": "4.0.0",
     "jsonparse": "1.3.1",
-    "make-fetch-happen": "16.0.1",
-    "@npmcli/agent": "5.0.2",
-    "agent-base": "9.0.0",
-    "http-proxy-agent": "9.1.0",
+    "make-fetch-happen": "15.0.6",
+    "@npmcli/agent": "4.0.2",
+    "agent-base": "7.1.4",
+    "http-proxy-agent": "7.0.2",
     "debug": "4.4.3",
     "ms": "2.1.3",
-    "proxy-agent-negotiate": "1.1.0",
-    "https-proxy-agent": "9.1.0",
-    "socks-proxy-agent": "10.1.0",
+    "https-proxy-agent": "7.0.6",
+    "socks-proxy-agent": "8.0.5",
     "socks": "2.8.10",
-    "ip-address": "10.7.3",
+    "ip-address": "10.7.4",
     "smart-buffer": "4.2.0",
     "http-cache-semantics": "4.3.0",
-    "minipass-fetch": "6.0.0",
+    "minipass-fetch": "5.0.2",
     "minipass-sized": "2.0.0",
     "iconv-lite": "0.7.3",
     "safer-buffer": "2.1.2",
     "negotiator": "1.1.0",
     "content-type": "2.1.0",
-    "sigstore": "5.0.0",
-    "@sigstore/bundle": "5.0.0",
+    "sigstore": "4.1.1",
+    "@sigstore/bundle": "4.0.0",
     "@sigstore/protobuf-specs": "0.5.2",
-    "@sigstore/core": "4.0.1",
-    "@sigstore/sign": "5.0.0",
-    "@sigstore/tuf": "5.0.0",
-    "tuf-js": "6.0.0",
-    "@tufjs/models": "5.0.0",
+    "@sigstore/core": "3.2.1",
+    "@sigstore/sign": "4.1.1",
+    "@sigstore/tuf": "4.0.2",
+    "tuf-js": "4.1.0",
+    "@tufjs/models": "4.1.0",
     "@tufjs/canonical-json": "2.0.0",
-    "@sigstore/verify": "4.1.2",
+    "@sigstore/verify": "3.1.1",
     "@npmcli/query": "5.0.0",
     "postcss-selector-parser": "7.1.6",
     "cssesc": "3.0.0",
     "util-deprecate": "1.0.2",
-    "bin-links": "7.0.0",
-    "cmd-shim": "9.0.2",
-    "read-cmd-shim": "7.0.1",
-    "write-file-atomic": "8.0.0",
+    "bin-links": "6.0.2",
+    "cmd-shim": "8.0.0",
+    "read-cmd-shim": "6.0.0",
+    "write-file-atomic": "7.0.1",
     "signal-exit": "4.1.0",
     "common-ancestor-path": "2.0.0",
-    "diff": "8.0.4",
     "json-stringify-nice": "1.1.4",
-    "parse-conflict-json": "6.0.0",
+    "parse-conflict-json": "5.0.1",
     "just-diff": "6.0.2",
     "just-diff-apply": "5.5.0",
     "proggy": "4.0.0",
@@ -377,7 +375,6 @@
     "http-proxy-agent",
     "debug",
     "ms",
-    "proxy-agent-negotiate",
     "https-proxy-agent",
     "socks-proxy-agent",
     "socks",
@@ -410,7 +407,6 @@
     "write-file-atomic",
     "signal-exit",
     "common-ancestor-path",
-    "diff",
     "json-stringify-nice",
     "parse-conflict-json",
     "just-diff",

package/node_modules/@npmcli/arborist/lib/npm-extension.js

@@ -1,237 +0,0 @@
-// Root-owned `.npm-extension.{mjs,cjs}`: an imperative `transformManifest(pkg, context)` extension point that repairs third-party manifests before Arborist reads a candidate's dependency edges.
-// See RFC: https://github.com/npm/rfcs/pull/903
-// This module discovers and hashes the root extension file, loads its `transformManifest` export, and applies it to a deeply isolated manifest copy, returning an extended manifest plus minimal provenance.
-// It never mutates the input manifest or any shared cache object.
-const { resolve, sep } = require('node:path')
-const { readFileSync, existsSync } = require('node:fs')
-const { pathToFileURL } = require('node:url')
-const { isDeepStrictEqual } = require('node:util')
-const { log } = require('proc-log')
-const ssri = require('ssri')
-const { EXTENSION_FIELDS } = require('./package-extensions.js')
-
-const EXTENSION_POINT = 'transformManifest'
-
-// The two supported module formats and their default discovery filenames.
-const FORMATS = [
-  { ext: 'mjs', file: '.npm-extension.mjs' },
-  { ext: 'cjs', file: '.npm-extension.cjs' },
-]
-
-const err = (message, code, extra = {}) =>
-  Object.assign(new Error(message), { code, ...extra })
-
-// Read a file's bytes, or null when it does not exist.
-const readBytes = path => {
-  try {
-    return readFileSync(path)
-  } catch (e) {
-    if (e.code === 'ENOENT') {
-      return null
-    }
-    throw e
-  }
-}
-
-// Resolve which extension file to load, returning { path, format, bytes } or null when none is present.
-// A configured `extension-file` wins over default discovery; it must resolve inside the project root and use a `.mjs` or `.cjs` extension.
-// When both default files exist npm fails rather than choosing one implicitly.
-const discover = (root, extensionFile) => {
-  if (extensionFile) {
-    const path = resolve(root, extensionFile)
-    if (path !== root && !path.startsWith(root + sep)) {
-      throw err(`extension-file "${extensionFile}" must resolve inside the project root`, 'ENPMEXTENSIONPATH')
-    }
-    const format = FORMATS.find(f => path.endsWith(`.${f.ext}`))?.ext
-    if (!format) {
-      throw err(`extension-file "${extensionFile}" must use a .mjs or .cjs extension`, 'ENPMEXTENSIONPATH')
-    }
-    const bytes = readBytes(path)
-    if (bytes === null) {
-      throw err(`extension-file "${extensionFile}" was not found`, 'ENPMEXTENSIONPATH')
-    }
-    return { path, format, bytes }
-  }
-  const found = FORMATS
-    .map(f => ({ path: resolve(root, f.file), format: f.ext, bytes: readBytes(resolve(root, f.file)) }))
-    .filter(f => f.bytes !== null)
-  if (found.length > 1) {
-    throw err('found both .npm-extension.mjs and .npm-extension.cjs; keep only one', 'ENPMEXTENSIONDUP')
-  }
-  return found[0] || null
-}
-
-// Hash the selected extension file: a format-tagged prefix plus the raw file bytes, using npm's lockfile digest encoding.
-// The prefix keeps `.mjs` and `.cjs` files with identical bytes distinct, and excludes any path so the digest is machine-independent.
-const hashFile = (format, bytes) =>
-  ssri.fromData(
-    Buffer.concat([Buffer.from(`npm-extension:v1:${format}\n`), bytes]),
-    { algorithms: ['sha512'] }
-  ).toString()
-
-class NpmExtension {
-  #cache = new Map()
-  #transform = null
-
-  constructor ({ root, extensionFile = null } = {}) {
-    this.root = root
-    this.path = null
-    this.format = null
-    this.hash = null
-
-    const selected = root ? discover(root, extensionFile) : null
-    if (!selected) {
-      this.present = false
-      return
-    }
-    this.present = true
-    this.path = selected.path
-    this.format = selected.format
-    this.hash = hashFile(selected.format, selected.bytes)
-  }
-
-  // Import the extension module and capture its `transformManifest` export.
-  // ESM files are loaded with dynamic import; CommonJS files with require.
-  // The export must be a function; anything else fails the install.
-  async load () {
-    if (!this.present) {
-      return
-    }
-    // Key the module load by the file hash so a changed file is reloaded rather than served stale from a module cache within one process.
-    let mod
-    if (this.format === 'mjs') {
-      mod = await import(`${pathToFileURL(this.path).href}?h=${this.hash}`)
-    } else {
-      delete require.cache[require.resolve(this.path)]
-      mod = require(this.path)
-    }
-    const transform = mod?.transformManifest ?? mod?.default?.transformManifest
-    if (typeof transform !== 'function') {
-      throw err(`.npm-extension must export a transformManifest function`, 'ENPMEXTENSIONSHAPE')
-    }
-    this.#transform = transform
-  }
-
-  // Apply transformManifest to a candidate manifest, returning { pkg, applied } or null when nothing changed.
-  // Results are cached once per resolved package identity; consumers get a deeply isolated copy so they cannot mutate the cached effective manifest.
-  // Pass { memoize: false } to run without caching, e.g. a staleness probe over partial lockfile manifests that must not seed the cache used by full-manifest fetches.
-  apply (pkg, { memoize = true } = {}) {
-    if (!this.#transform || !pkg?.name) {
-      return null
-    }
-    const key = this.#identity(pkg)
-    let result
-    if (this.#cache.has(key)) {
-      result = this.#cache.get(key)
-    } else {
-      result = this.#run(pkg)
-      if (memoize) {
-        this.#cache.set(key, result)
-      }
-    }
-    return result && { pkg: structuredClone(result.pkg), applied: structuredClone(result.applied) }
-  }
-
-  // Identity key for the transform cache: package integrity when available, otherwise resolved source plus name and version.
-  #identity (pkg) {
-    return pkg._integrity || `${pkg._resolved || ''}:${pkg.name}@${pkg.version || ''}`
-  }
-
-  // Run transformManifest on a deeply isolated copy and validate the result.
-  // Returns { pkg, applied } when dependency or peer metadata changed, or null when it did not.
-  #run (pkg) {
-    const context = {
-      log: message => log.silly('npm-extension', message),
-      root: this.root,
-      extensionPoint: EXTENSION_POINT,
-    }
-    let returned
-    try {
-      returned = this.#transform(structuredClone(pkg), context)
-    } catch (e) {
-      throw err(
-        `.npm-extension transformManifest threw while processing ${pkg.name}@${pkg.version}: ${e.message}`,
-        'ENPMEXTENSIONTHROW', { pkgid: `${pkg.name}@${pkg.version}` })
-    }
-    if (returned && typeof returned.then === 'function') {
-      throw err(
-        `.npm-extension transformManifest must return a manifest synchronously, not a promise, for ${pkg.name}@${pkg.version}`,
-        'ENPMEXTENSIONRETURN', { pkgid: `${pkg.name}@${pkg.version}` })
-    }
-    if (!returned || typeof returned !== 'object' || Array.isArray(returned)) {
-      throw err(
-        `.npm-extension transformManifest must return a manifest object for ${pkg.name}@${pkg.version}`,
-        'ENPMEXTENSIONRETURN', { pkgid: `${pkg.name}@${pkg.version}` })
-    }
-    // Only dependency and peer fields may change; any other field the returned manifest explicitly alters is rejected.
-    // Fields the returned object omits are left untouched, so a handler may return a new object with only the fields it repairs.
-    for (const k of Object.keys(returned)) {
-      if (!EXTENSION_FIELDS.includes(k) && !isDeepStrictEqual(returned[k], pkg[k])) {
-        throw err(
-          `.npm-extension transformManifest changed unsupported field "${k}" on ${pkg.name}@${pkg.version}; only ${EXTENSION_FIELDS.join(', ')} may change`,
-          'ENPMEXTENSIONFIELD', { pkgid: `${pkg.name}@${pkg.version}`, field: k })
-      }
-    }
-    // Build the effective manifest from the normalized baseline plus the returned allowlisted fields.
-    // A field the handler omits is left as the baseline; delete individual entries by returning a field object without them.
-    const next = { ...pkg }
-    for (const field of EXTENSION_FIELDS) {
-      if (returned[field] === undefined) {
-        continue
-      }
-      this.#validateField(field, returned[field], pkg)
-      next[field] = returned[field]
-    }
-    const applied = this.#provenance(pkg, next)
-    return applied && { pkg: next, applied }
-  }
-
-  // Validate a returned allowlisted field and its entries, so invalid output fails with .npm-extension and package context.
-  // Dependency maps hold version strings; peerDependenciesMeta holds metadata objects.
-  #validateField (field, value, pkg) {
-    const fail = (suffix) => err(
-      `.npm-extension transformManifest set ${suffix} to an invalid value on ${pkg.name}@${pkg.version}`,
-      'ENPMEXTENSIONVALUE', { pkgid: `${pkg.name}@${pkg.version}`, field })
-    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
-      throw fail(field)
-    }
-    for (const [name, entry] of Object.entries(value)) {
-      if (field === 'peerDependenciesMeta') {
-        if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) {
-          throw fail(`${field}.${name}`)
-        }
-      } else if (typeof entry !== 'string') {
-        throw fail(`${field}.${name}`)
-      }
-    }
-  }
-
-  // Minimal provenance: the extension point plus, for each changed allowlisted field, a sorted array of affected dependency names.
-  // Returns null when nothing changed.
-  #provenance (before, after) {
-    const applied = { extensionPoint: EXTENSION_POINT }
-    let changed = false
-    for (const field of EXTENSION_FIELDS) {
-      const b = before[field] || {}
-      const a = after[field] || {}
-      const names = [...new Set([...Object.keys(b), ...Object.keys(a)])]
-        .filter(n => !isDeepStrictEqual(b[n], a[n]))
-        .sort()
-      if (names.length) {
-        applied[field] = names
-        changed = true
-      }
-    }
-    return changed ? applied : null
-  }
-}
-
-// Whether a directory contains any default .npm-extension file; a non-throwing existence check used for non-root workspace warnings.
-const hasExtensionFile = dir => FORMATS.some(f => existsSync(resolve(dir, f.file)))
-
-module.exports = NpmExtension
-module.exports.NpmExtension = NpmExtension
-module.exports.discover = discover
-module.exports.hasExtensionFile = hasExtensionFile
-module.exports.hashFile = hashFile
-module.exports.EXTENSION_POINT = EXTENSION_POINT

package/node_modules/@npmcli/arborist/lib/package-extensions.js

@@ -1,236 +0,0 @@
-// Root-owned `packageExtensions`: declarative repairs to third-party manifests applied before Arborist reads a candidate's dependency edges.
-// See RFC: https://github.com/npm/rfcs/pull/889
-// This module is pure: it parses and validates the root rule set, matches a candidate manifest by name and version, and returns an extended manifest copy plus minimal provenance.
-// It never mutates the input manifest or any shared cache object.
-const semver = require('semver')
-const ssri = require('ssri')
-const validateName = require('validate-npm-package-name')
-
-// The only manifest fields a package extension may add or correct, because they are the fields that affect dependency and peer resolution.
-const EXTENSION_FIELDS = [
-  'dependencies',
-  'optionalDependencies',
-  'peerDependencies',
-  'peerDependenciesMeta',
-]
-
-// The two normal dependency fields; a name may exist in only one of them.
-const NORMAL_DEP_FIELDS = ['dependencies', 'optionalDependencies']
-
-const err = (message, code, extra = {}) =>
-  Object.assign(new Error(message), { code, ...extra })
-
-// Parse a selector key into { name, range }, where range is null for a name-only key.
-// Selectors are a package name with an optional semver range; dist-tags, git, file, directory, url, and alias specs are rejected.
-const parseSelector = key => {
-  if (typeof key !== 'string' || !key) {
-    throw err(`Invalid packageExtensions selector: ${JSON.stringify(key)}`, 'EEXTENSIONSELECTOR')
-  }
-  // The separator @ is the first @ after a leading scope @.
-  const at = key.indexOf('@', key.startsWith('@') ? 1 : 0)
-  const name = at === -1 ? key : key.slice(0, at)
-  const range = at === -1 ? null : key.slice(at + 1)
-
-  const { validForOldPackages, validForNewPackages } = validateName(name)
-  if (!validForOldPackages && !validForNewPackages) {
-    throw err(`Invalid package name in packageExtensions selector: "${key}"`, 'EEXTENSIONSELECTOR', { selector: key })
-  }
-  // A blank range such as "foo@" is malformed; the name-only form "foo" is how you match every version.
-  if (range !== null && range.trim() === '') {
-    throw err(
-      `Invalid packageExtensions selector: "${key}". Use the name only to match every version.`,
-      'EEXTENSIONSELECTOR', { selector: key })
-  }
-  // A versioned selector must be a valid semver range, which rejects dist-tags, git, file, url, and alias specs.
-  if (range !== null && semver.validRange(range, { loose: true }) === null) {
-    throw err(
-      `Invalid version range in packageExtensions selector: "${key}". Selectors accept a package name with an optional semver range only.`,
-      'EEXTENSIONSELECTOR', { selector: key })
-  }
-  return { name, range }
-}
-
-// A selector matches a candidate manifest by its own name and version.
-// Name-only selectors match every version, including non-semver versions.
-// Versioned selectors only match versions that parse as semver and satisfy the range.
-const rangeMatches = (range, version) => {
-  if (range === null) {
-    return true
-  }
-  return semver.valid(version, { loose: true }) !== null &&
-    semver.satisfies(version, range, { loose: true })
-}
-
-// Validate a single selector's extension object before it is ever applied.
-const validateExtensionObject = (key, ext) => {
-  if (ext === null || typeof ext !== 'object' || Array.isArray(ext)) {
-    throw err(`packageExtensions["${key}"] must be an object`, 'EEXTENSIONVALUE', { selector: key })
-  }
-  for (const field of Object.keys(ext)) {
-    if (!EXTENSION_FIELDS.includes(field)) {
-      throw err(
-        `packageExtensions["${key}"] has unsupported field "${field}". Supported fields: ${EXTENSION_FIELDS.join(', ')}.`,
-        'EEXTENSIONFIELD', { selector: key, field })
-    }
-    const val = ext[field]
-    if (val === null || typeof val !== 'object' || Array.isArray(val)) {
-      throw err(`packageExtensions["${key}"].${field} must be an object`, 'EEXTENSIONVALUE', { selector: key, field })
-    }
-  }
-  // Deletion is not supported in v1, so a null, false, or "-" value is an error.
-  for (const field of [...NORMAL_DEP_FIELDS, 'peerDependencies']) {
-    for (const [name, spec] of Object.entries(ext[field] || {})) {
-      if (spec === null || spec === false || spec === '-') {
-        throw err(
-          `packageExtensions["${key}"].${field}.${name} attempts deletion, which is not supported.`,
-          'EEXTENSIONDELETE', { selector: key, field, name })
-      }
-    }
-  }
-  // Each peerDependenciesMeta entry must be a non-null metadata object, never a deletion sentinel or primitive.
-  for (const [name, meta] of Object.entries(ext.peerDependenciesMeta || {})) {
-    if (meta === null || typeof meta !== 'object' || Array.isArray(meta)) {
-      throw err(
-        `packageExtensions["${key}"].peerDependenciesMeta.${name} must be an object`,
-        'EEXTENSIONVALUE', { selector: key, field: 'peerDependenciesMeta', name })
-    }
-  }
-}
-
-// Apply a matched extension to a manifest, returning { pkg, applied } where pkg is a copy with extended fields and applied is minimal provenance.
-// The input manifest is never mutated.
-const applyExtension = (pkg, { key, ext }) => {
-  const applied = { selector: key }
-
-  // Clone only the fields we may touch; the rest of the manifest is shared by reference since it is never mutated.
-  const next = { ...pkg }
-  for (const field of EXTENSION_FIELDS) {
-    if (pkg[field] && typeof pkg[field] === 'object') {
-      next[field] = field === 'peerDependenciesMeta'
-        ? Object.fromEntries(Object.entries(pkg[field]).map(([n, m]) => [n, { ...m }]))
-        : { ...pkg[field] }
-    }
-  }
-
-  // dependencies and optionalDependencies add missing names only.
-  // A name already declared in either normal dependency field is an error, which also prevents moving a name between the fields.
-  for (const field of NORMAL_DEP_FIELDS) {
-    const adds = ext[field]
-    if (!adds) {
-      continue
-    }
-    for (const [name, spec] of Object.entries(adds)) {
-      for (const existingField of NORMAL_DEP_FIELDS) {
-        if (next[existingField] && name in next[existingField]) {
-          throw err(
-            `packageExtensions["${key}"].${field}.${name} conflicts with the package's existing ${existingField}.${name}. Use overrides to change a dependency version; packageExtensions only adds missing dependencies.`,
-            'EEXTENSIONDUPDEP', { selector: key, field, name, existingField })
-        }
-      }
-      next[field] = next[field] || {}
-      next[field][name] = spec
-      ;(applied[field] = applied[field] || []).push(name)
-    }
-  }
-
-  // peerDependencies shallow-merges by peer name, and the extension value replaces an existing range.
-  if (ext.peerDependencies) {
-    next.peerDependencies = next.peerDependencies || {}
-    for (const [name, spec] of Object.entries(ext.peerDependencies)) {
-      next.peerDependencies[name] = spec
-      ;(applied.peerDependencies = applied.peerDependencies || []).push(name)
-    }
-  }
-
-  // peerDependenciesMeta merges by peer name, then shallow-merges each meta object so an extension can add optional without dropping other meta keys.
-  if (ext.peerDependenciesMeta) {
-    next.peerDependenciesMeta = next.peerDependenciesMeta || {}
-    for (const [name, meta] of Object.entries(ext.peerDependenciesMeta)) {
-      next.peerDependenciesMeta[name] = { ...next.peerDependenciesMeta[name], ...meta }
-      ;(applied.peerDependenciesMeta = applied.peerDependenciesMeta || []).push(name)
-      // Every peerDependenciesMeta entry an extension adds must correspond to a peerDependencies entry present after extension application.
-      if (!next.peerDependencies || !(name in next.peerDependencies)) {
-        throw err(
-          `packageExtensions["${key}"].peerDependenciesMeta.${name} has no corresponding peerDependencies.${name} after extension application.`,
-          'EEXTENSIONORPHANMETA', { selector: key, name })
-      }
-    }
-  }
-
-  return { pkg: next, applied }
-}
-
-// Deterministic JSON for hashing: keys sorted lexicographically at every level, string and number values preserved exactly, no insignificant whitespace.
-const canonicalStringify = val => {
-  if (Array.isArray(val)) {
-    return `[${val.map(canonicalStringify).join(',')}]`
-  }
-  if (val && typeof val === 'object') {
-    return `{${Object.keys(val).sort()
-      .map(k => `${JSON.stringify(k)}:${canonicalStringify(val[k])}`)
-      .join(',')}}`
-  }
-  return JSON.stringify(val)
-}
-
-// Hash the canonical form of the root packageExtensions object using npm's existing lockfile digest encoding.
-const canonicalHash = packageExtensions =>
-  ssri.fromData(canonicalStringify(packageExtensions), { algorithms: ['sha512'] }).toString()
-
-class PackageExtensions {
-  constructor (raw) {
-    this.raw = raw
-    this.present = raw !== undefined
-    this.selectors = []
-    this.hash = null
-
-    if (!this.present) {
-      return
-    }
-    if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
-      throw err('packageExtensions must be an object', 'EEXTENSIONROOT')
-    }
-    for (const [key, ext] of Object.entries(raw)) {
-      const { name, range } = parseSelector(key)
-      validateExtensionObject(key, ext)
-      this.selectors.push({ key, name, range, ext })
-    }
-    this.hash = canonicalHash(raw)
-  }
-
-  // Non-throwing check used for warnings: whether any selector matches the candidate.
-  wouldMatch (name, version) {
-    return this.selectors.some(s => s.name === name && rangeMatches(s.range, version))
-  }
-
-  // Return the single selector matching a candidate manifest, or null.
-  // Throws EEXTENSIONCONFLICT when more than one selector matches the same candidate.
-  match (name, version) {
-    const matches = this.selectors.filter(s => s.name === name && rangeMatches(s.range, version))
-    if (matches.length > 1) {
-      const keys = matches.map(s => `"${s.key}"`).join(', ')
-      throw err(
-        `Multiple packageExtensions selectors match ${name}@${version}: ${keys}. Narrow or remove one of the overlapping rules.`,
-        'EEXTENSIONCONFLICT', { name, version, selectors: matches.map(s => s.key) })
-    }
-    return matches[0] || null
-  }
-
-  // Apply the matching extension to a manifest copy, returning { pkg, applied } or null when no selector matches.
-  // Throws on selector conflict or invalid merge.
-  apply (pkg) {
-    if (!this.present || !this.selectors.length || !pkg || !pkg.name) {
-      return null
-    }
-    const sel = this.match(pkg.name, pkg.version)
-    return sel ? applyExtension(pkg, sel) : null
-  }
-}
-
-module.exports = PackageExtensions
-module.exports.PackageExtensions = PackageExtensions
-module.exports.parseSelector = parseSelector
-module.exports.rangeMatches = rangeMatches
-module.exports.canonicalHash = canonicalHash
-module.exports.canonicalStringify = canonicalStringify
-module.exports.EXTENSION_FIELDS = EXTENSION_FIELDS