@yanglaofish/fishtools 0.5.2 → 0.6.0

package/node_modules/@npmcli/arborist/lib/arborist/rebuild.js

@@ -199,25 +199,18 @@ module.exports = cls => class Builder extends cls {
       const { package: { bin, scripts = {} } } = node.target
       const { preinstall, install, postinstall, prepare } = scripts
       const tests = { bin, preinstall, install, postinstall, prepare }
-      // allowScripts gate (RFC npm/rfcs#868): `true` runs lifecycle
-      // scripts; `false` and `null` (unreviewed) block. Bypassed by
-      // --dangerously-allow-all-scripts and workspaces (owner-managed).
-      // --ignore-scripts still wins (in #build); bins are never gated.
-      //
-      // Checked on node.target, not the Link: a Link's `resolved` is
-      // node_modules-relative (`file:../../dep`) so it can't match a
-      // project-root-relative policy key; the target carries the realpath
-      // and link specs that script-allowed.js matches on (npm/cli#9498).
-      // For non-links node.target === node, so registry deps are unaffected.
-      const scriptsAllowed =
-        this.options.dangerouslyAllowAllScripts ||
-        node.isWorkspace ||
-        isScriptAllowed(node.target, this.options.allowScripts) === true
+      // A denied package (allowScripts resolves to `false`) still gets its
+      // bins linked; only its lifecycle scripts are skipped, matching
+      // --ignore-scripts (npm/cli#9681). --dangerously-allow-all-scripts
+      // bypasses the gate.
+      const scriptsDenied =
+        !this.options.dangerouslyAllowAllScripts &&
+        isScriptAllowed(node, this.options.allowScripts) === false
       for (const [key, has] of Object.entries(tests)) {
         if (!has) {
           continue
         }
-        if (key !== 'bin' && !scriptsAllowed) {
+        if (key !== 'bin' && scriptsDenied) {
           continue
         }
         this.#queues[key].push(node)

package/node_modules/@npmcli/arborist/lib/arborist/reify.js

@@ -24,8 +24,6 @@ const debug = require('../debug.js')
 const onExit = require('../signal-handling.js')
 const optionalSet = require('../optional-set.js')
 const relpath = require('../relpath.js')
-const { applyPatchToDir, patchIntegrity } = require('../patch.js')
-const { readFile } = require('node:fs/promises')
 const retirePath = require('../retire-path.js')
 const treeCheck = require('../tree-check.js')
 const Shrinkwrap = require('../shrinkwrap.js')
@@ -51,6 +49,7 @@ const _checkBins = Symbol.for('checkBins')
 // TODO tests should not be this deep into internals
 const _diffTrees = Symbol.for('diffTrees')
 const _createSparseTree = Symbol.for('createSparseTree')
+const _loadShrinkwrapsAndUpdateTrees = Symbol.for('loadShrinkwrapsAndUpdateTrees')
 const _reifyNode = Symbol.for('reifyNode')
 const _updateAll = Symbol.for('updateAll')
 const _updateNames = Symbol.for('updateNames')
@@ -75,6 +74,7 @@ module.exports = cls => class Reifier extends cls {
   #omit
   #retiredPaths = {}
   #retiredUnchanged = {}
+  #shrinkwrapInflated = new Set()
   #sparseTreeDirs = new Set()
   #sparseTreeRoots = new Set()
   #linkedActualForDiff = null
@@ -337,6 +337,7 @@ module.exports = cls => class Reifier extends cls {
       ]],
       [_rollbackCreateSparseTree, [
         _createSparseTree,
+        _loadShrinkwrapsAndUpdateTrees,
         _loadBundlesAndUpdateTrees,
         _submitQuickAudit,
         _unpackNewModules,
@@ -499,6 +500,7 @@ module.exports = cls => class Reifier extends cls {
     // and ideal trees.
     this.diff = Diff.calculate({
       omit: this.#omit,
+      shrinkwrapInflated: this.#shrinkwrapInflated,
       filterNodes,
       actual: this.#linkedActualForDiff || this.actualTree,
       ideal: this.idealTree,
@@ -649,6 +651,39 @@ module.exports = cls => class Reifier extends cls {
       .then(() => this[_rollbackRetireShallowNodes](er))
   }
 
+  // shrinkwrap nodes define their dependency branches with a file, so
+  // we need to unpack them, read that shrinkwrap file, and then update
+  // the tree by calling loadVirtual with the node as the root.
+  [_loadShrinkwrapsAndUpdateTrees] () {
+    const seen = this.#shrinkwrapInflated
+    const shrinkwraps = this.diff.leaves
+      .filter(d => (d.action === 'CHANGE' || d.action === 'ADD' || !d.action) &&
+        d.ideal.hasShrinkwrap && !seen.has(d.ideal) &&
+        !this[_trashList].has(d.ideal.path))
+
+    if (!shrinkwraps.length) {
+      return
+    }
+
+    const timeEnd = time.start('reify:loadShrinkwraps')
+
+    const Arborist = this.constructor
+    return promiseAllRejectLate(shrinkwraps.map(diff => {
+      const node = diff.ideal
+      seen.add(node)
+      return diff.action ? this[_reifyNode](node) : node
+    }))
+      .then(nodes => promiseAllRejectLate(nodes.map(node => new Arborist({
+        ...this.options,
+        path: node.path,
+      }).loadVirtual({ root: node, subtreeOnly: true }))))
+      // reload the diff and sparse tree because the ideal tree changed
+      .then(() => this[_diffTrees]())
+      .then(() => this[_createSparseTree]())
+      .then(() => this[_loadShrinkwrapsAndUpdateTrees]())
+      .then(timeEnd)
+  }
+
   // create a symlink for Links, extract for Nodes
   // return the node object, since we usually want that
   // handle optional dep failures here
@@ -756,7 +791,6 @@ module.exports = cls => class Reifier extends cls {
         const { content: pkg } = await PackageJson.normalize(node.path)
         node.package.scripts = pkg.scripts
       }
-      await this.#applyPatch(node)
       return
     }
 
@@ -784,61 +818,10 @@ module.exports = cls => class Reifier extends cls {
     return symlink(rel, node.path, 'junction')
   }
 
-  // apply a registered patch to a freshly extracted node, after extract and before rebuild
-  async #applyPatch (node) {
-    if (!node.patched) {
-      return
-    }
-    const { path: patchPath, integrity } = node.patched
-
-    // validate the patch file here too, since reify can run on an ideal tree that skipped resolvePatchedDependencies
-    let contents
-    try {
-      contents = await readFile(resolve(this.path, patchPath))
-    } catch {
-      throw Object.assign(
-        new Error(`patch file not found: ${patchPath}`),
-        { code: 'EPATCHNOTFOUND', path: patchPath, node: node.name }
-      )
-    }
-    if (patchIntegrity(contents) !== integrity) {
-      throw Object.assign(
-        new Error(`patch file ${patchPath} does not match the recorded integrity`),
-        { code: 'EPATCHINTEGRITY', path: patchPath, node: node.name }
-      )
-    }
-
-    try {
-      await applyPatchToDir({ patch: contents, cwd: node.path })
-    } catch (er) {
-      if (this.options.ignorePatchFailures) {
-        // the linked side-store keys a package by its patch, so an unpatched package cannot be represented at a patched key and would be trusted on later installs
-        if (node.isInStore) {
-          throw Object.assign(
-            new Error(`Cannot skip the failed patch for ${node.name} under install-strategy=linked. ` +
-              `Fix the patch or install with a different strategy.`),
-            { code: 'EPATCHFAILED', path: patchPath, node: node.name }
-          )
-        }
-        log.warn('patch', `failed to apply ${patchPath} to ${node.name}: ${er.message}`)
-        // the patch was not applied, so do not record it in the lockfile
-        // the lockfile and package.json now disagree, so warn that npm ci will reject the tree
-        log.warn('patch', `${node.name} was installed unpatched; package.json still declares this patch, so the lockfile is out of sync and \`npm ci\` will fail until the patch is fixed or its patchedDependencies entry is removed`)
-        node.patched = null
-        return
-      }
-      throw er
-    }
-  }
-
   // if the node is optional, then the failure of the promise is nonfatal
   // just add it and its optional set to the trash list.
   [_handleOptionalFailure] (node, p) {
-    return (node.optional ? p.catch((er) => {
-      // a declared patch must apply or fail loudly, even on an optional dep
-      if (typeof er?.code === 'string' && er.code.startsWith('EPATCH')) {
-        throw er
-      }
+    return (node.optional ? p.catch(() => {
       const set = optionalSet(node)
       for (const node of set) {
         log.verbose('reify', 'failed optional dependency', node.path)
@@ -1295,6 +1278,7 @@ module.exports = cls => class Reifier extends cls {
 
         const node = diff.ideal
         const bd = this.#bundleUnpacked.has(node)
+        const sw = this.#shrinkwrapInflated.has(node)
         const bundleMissing = this.#bundleMissing.has(node)
 
         // check whether we still need to unpack this one.
@@ -1304,6 +1288,8 @@ module.exports = cls => class Reifier extends cls {
           !node.isRoot &&
           // already unpacked to read bundle
           !bd &&
+          // already unpacked to read sw
+          !sw &&
           // already unpacked by another dep's bundle
           (bundleMissing || !node.inDepBundle)
 
@@ -1847,7 +1833,7 @@ module.exports = cls => class Reifier extends cls {
           // save the git+https url if it has auth; otherwise, shortcut
           const h = req.hosted
           const opt = { noCommittish: false }
-          if (h.https && (h.auth || h.default === 'https')) {
+          if (h.https && h.auth) {
             newSpec = `git+${h.https(opt)}`
           } else {
             newSpec = h.shortcut(opt)
@@ -2002,8 +1988,6 @@ module.exports = cls => class Reifier extends cls {
           // field so defaulting this to an empty array would add that field to
           // every package.json file.
           bundleDependencies,
-          // resolvePatchedDependencies drops entries orphaned by uninstall; persist that removal
-          patchedDependencies,
         } = tree.package
 
         pkgJson.update({
@@ -2012,7 +1996,6 @@ module.exports = cls => class Reifier extends cls {
           optionalDependencies,
           peerDependencies,
           bundleDependencies,
-          patchedDependencies,
         })
         await pkgJson.save()
       }

package/node_modules/@npmcli/arborist/lib/consistent-resolve.js

@@ -26,7 +26,7 @@ const consistentResolve = (resolved, fromPath, toPath, relPaths = false) => {
       return `file:${fetchSpec}`
     }
     if (hosted) {
-      return `git+${(hosted.auth || hosted.default === 'https') ? hosted.https(hostedOpt) : hosted.sshurl(hostedOpt)}`
+      return `git+${hosted.auth ? hosted.https(hostedOpt) : hosted.sshurl(hostedOpt)}`
     }
     if (type === 'git') {
       return saveSpec

package/node_modules/@npmcli/arborist/lib/diff.js

@@ -11,9 +11,10 @@ const { existsSync } = require('node:fs')
 const ssri = require('ssri')
 
 class Diff {
-  constructor ({ actual, ideal, filterSet, omit }) {
+  constructor ({ actual, ideal, filterSet, shrinkwrapInflated, omit }) {
     this.omit = omit
     this.filterSet = filterSet
+    this.shrinkwrapInflated = shrinkwrapInflated
     this.children = []
     this.actual = actual
     this.ideal = ideal
@@ -35,6 +36,7 @@ class Diff {
     actual,
     ideal,
     filterNodes = [],
+    shrinkwrapInflated = new Set(),
     omit = new Set(),
   }) {
     // if there's a filterNode, then:
@@ -100,7 +102,7 @@ class Diff {
     }
 
     return depth({
-      tree: new Diff({ actual, ideal, filterSet, omit }),
+      tree: new Diff({ actual, ideal, filterSet, shrinkwrapInflated, omit }),
       getChildren,
       leave,
     })
@@ -130,16 +132,6 @@ const getAction = ({ actual, ideal }) => {
     return 'CHANGE'
   }
 
-  // a change in patch state requires re-extracting and re-applying
-  if ((ideal.patched?.integrity || null) !== (actual.patched?.integrity || null)) {
-    return 'CHANGE'
-  }
-
-  // a node whose patch was just removed must be re-extracted to revert the patched files
-  if (ideal.patchRemoved) {
-    return 'CHANGE'
-  }
-
   const binsExist = ideal.binPaths.every((path) => existsSync(path))
 
   // top nodes, links, and git deps won't have integrity, but do have resolved
@@ -199,16 +191,26 @@ const getChildren = diff => {
     unchanged,
     removed,
     filterSet,
+    shrinkwrapInflated,
     omit,
   } = diff
 
   // Note: we DON'T diff fsChildren themselves, because they are either
-  // included in the package contents, or part of some other project.
-  // But we _do_ include the child nodes of fsChildren, because those are
-  // nodes that we are typically responsible for installing.
+  // included in the package contents, or part of some other project, and
+  // will never appear in legacy shrinkwraps anyway.  but we _do_ include the
+  // child nodes of fsChildren, because those are nodes that we are typically
+  // responsible for installing.
   const actualKids = allChildren(actual)
   const idealKids = allChildren(ideal)
 
+  if (ideal && ideal.hasShrinkwrap && !shrinkwrapInflated.has(ideal)) {
+    // Guaranteed to get a diff.leaves here, because we always
+    // be called with a proper Diff object when ideal has a shrinkwrap
+    // that has not been inflated.
+    diff.leaves.push(diff)
+    return children
+  }
+
   const paths = new Set([...actualKids.keys(), ...idealKids.keys()])
   for (const path of paths) {
     const actual = actualKids.get(path)
@@ -220,6 +222,7 @@ const getChildren = diff => {
       unchanged,
       removed,
       filterSet,
+      shrinkwrapInflated,
       omit,
     })
   }
@@ -238,6 +241,7 @@ const diffNode = ({
   unchanged,
   removed,
   filterSet,
+  shrinkwrapInflated,
   omit,
 }) => {
   if (filterSet.size && !(filterSet.has(ideal) || filterSet.has(actual))) {
@@ -260,11 +264,11 @@ const diffNode = ({
 
   // if it's a match, then get its children
   // otherwise, this is the child diff node
-  if (action) {
+  if (action || (!shrinkwrapInflated.has(ideal) && ideal.hasShrinkwrap)) {
     if (action === 'REMOVE') {
       removed.push(actual)
     }
-    children.push(new Diff({ actual, ideal, filterSet, omit }))
+    children.push(new Diff({ actual, ideal, filterSet, shrinkwrapInflated, omit }))
   } else {
     unchanged.push(ideal)
     // !*! Weird dirty hack warning !*!
@@ -303,6 +307,7 @@ const diffNode = ({
       unchanged,
       removed,
       filterSet,
+      shrinkwrapInflated,
       omit,
     }))
   }

package/node_modules/@npmcli/arborist/lib/edge.js

@@ -109,8 +109,8 @@ class Edge {
     }
 
     // NOTE: this condition means we explicitly do not support overriding
-    // bundled dependencies
-    if (node.inDepBundle) {
+    // bundled or shrinkwrapped dependencies
+    if (node.hasShrinkwrap || node.inShrinkwrap || node.inBundle) {
       return depValid(node, this.rawSpec, this.#accept, this.#from)
     }
 
@@ -160,26 +160,6 @@ class Edge {
       }
       if (this.#from) {
         explanation.from = this.#from.explain(null, seen)
-        // note when this edge was created or changed by a root packageExtensions repair on the from node
-        const applied = this.#from.packageExtensionsApplied
-        if (applied) {
-          for (const field of ['dependencies', 'optionalDependencies', 'peerDependencies', 'peerDependenciesMeta']) {
-            if (applied[field]?.includes(this.#name)) {
-              explanation.packageExtensions = { selector: applied.selector, field }
-              break
-            }
-          }
-        }
-        // note when this edge was created or changed by a root .npm-extension transformManifest repair on the from node
-        const transformed = this.#from.npmExtensionApplied
-        if (transformed) {
-          for (const field of ['dependencies', 'optionalDependencies', 'peerDependencies', 'peerDependenciesMeta']) {
-            if (transformed[field]?.includes(this.#name)) {
-              explanation.npmExtension = { extensionPoint: transformed.extensionPoint, field }
-              break
-            }
-          }
-        }
       }
       this.#explanation = explanation
     }

package/node_modules/@npmcli/arborist/lib/index.js

@@ -4,5 +4,3 @@ module.exports.Node = require('./node.js')
 module.exports.Link = require('./link.js')
 module.exports.Edge = require('./edge.js')
 module.exports.Shrinkwrap = require('./shrinkwrap.js')
-module.exports.PackageExtensions = require('./package-extensions.js')
-module.exports.NpmExtension = require('./npm-extension.js')

package/node_modules/@npmcli/arborist/lib/isolated-classes.js

@@ -9,6 +9,7 @@ class IsolatedNode {
   edgesIn = new Set()
   edgesOut = new CaseInsensitiveMap()
   fsChildren = new Set()
+  hasShrinkwrap = false
   integrity = null
   inventory = new Map()
   isInStore = false
@@ -18,7 +19,6 @@ class IsolatedNode {
   linksIn = new Set()
   meta = { loadedFromDisk: false }
   optional = false
-  patched = null
   parent = null
   root = null
   tops = new Set()
@@ -55,9 +55,6 @@ class IsolatedNode {
     if (options.optional) {
       this.optional = true
     }
-    if (options.patched) {
-      this.patched = options.patched
-    }
   }
 
   get isRoot () {

package/node_modules/@npmcli/arborist/lib/node.js

@@ -82,6 +82,7 @@ class Node {
       fsChildren,
       fsParent,
       global = false,
+      hasShrinkwrap,
       inert = false,
       installLinks = false,
       integrity,
@@ -93,10 +94,7 @@ class Node {
       name, // allow setting name explicitly when we haven't set a path yet
       optional = true,
       overrides,
-      packageExtensionsApplied = null,
-      npmExtensionApplied = null,
       parent,
-      patched = null,
       path,
       peer = true,
       realpath,
@@ -172,14 +170,7 @@ class Node {
       }
     }
     this.integrity = integrity || this.package._integrity || null
-    // Patch record { path, integrity } or null, set from patchedDependencies or the lockfile.
-    this.patched = patched || null
-    // Provenance for a root packageExtensions repair applied to this node's manifest, or null.
-    // Shape: { selector, dependencies?, optionalDependencies?, peerDependencies?, peerDependenciesMeta? }.
-    this.packageExtensionsApplied = packageExtensionsApplied
-    // Provenance for a root .npm-extension transformManifest repair applied to this node's manifest, or null.
-    // Shape: { extensionPoint, dependencies?, optionalDependencies?, peerDependencies?, peerDependenciesMeta? }.
-    this.npmExtensionApplied = npmExtensionApplied
+    this.hasShrinkwrap = hasShrinkwrap || this.package._hasShrinkwrap || false
     this.installLinks = installLinks
     this.legacyPeerDeps = legacyPeerDeps
 
@@ -1111,8 +1102,8 @@ class Node {
   // is depending on it would be fine with the thing that they would resolve
   // to if it was removed, or nothing is depending on it in the first place.
   canDedupe (preferDedupe = false, explicitRequest = false) {
-    // not allowed to mess with bundles
-    if (this.inDepBundle) {
+    // not allowed to mess with shrinkwraps or bundles
+    if (this.inDepBundle || this.inShrinkwrap) {
       return false
     }
 
@@ -1259,6 +1250,11 @@ class Node {
     treeCheck(this)
   }
 
+  get inShrinkwrap () {
+    return this.parent &&
+      (this.parent.hasShrinkwrap || this.parent.inShrinkwrap)
+  }
+
   get parent () {
     // setter prevents _parent from being this
     return this[_parent]

package/node_modules/@npmcli/arborist/lib/place-dep.js

@@ -248,12 +248,6 @@ class PlaceDep {
       installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       error: this.dep.errors[0],
-      ...(this.dep.packageExtensionsApplied
-        ? { packageExtensionsApplied: this.dep.packageExtensionsApplied }
-        : {}),
-      ...(this.dep.npmExtensionApplied
-        ? { npmExtensionApplied: this.dep.npmExtensionApplied }
-        : {}),
       ...(this.dep.overrides ? { overrides: this.dep.overrides } : {}),
       ...(this.dep.isLink ? { target: this.dep.target, realpath: this.dep.realpath } : {}),
     })

package/node_modules/@npmcli/arborist/lib/printable.js

@@ -52,6 +52,11 @@ class ArboristNode {
     if (bd && bd.length) {
       this.bundleDependencies = bd
     }
+    if (tree.inShrinkwrap) {
+      this.inShrinkwrap = true
+    } else if (tree.hasShrinkwrap) {
+      this.hasShrinkwrap = true
+    }
     if (tree.error) {
       this.error = treeError(tree.error)
     }