app-builder-lib 26.13.1 → 26.15.0

package/out/node-module-collector/moduleManager.js

@@ -214,7 +214,7 @@ class ModuleManager {
      * Looks for node_modules/\*\/node_modules/pkgName (and deeper)
      */
     async downwardSearch(parentDir, pkgName, requiredRange, maxExplored = 2000, maxDepth = 6) {
-        var _a, _b, _c, _d;
+        var _a;
         const start = path.join(path.resolve(parentDir), "node_modules");
         if (!(await this.exists[start]) || !((_a = (await this.lstat[start])) === null || _a === void 0 ? void 0 : _a.isDirectory())) {
             return null;
@@ -242,70 +242,80 @@ class ModuleManager {
                     continue;
                 }
                 const entryPath = path.join(dir, entry);
-                // handle scoped packages @scope/name
                 if (entry.startsWith("@")) {
-                    // queue the scope directory itself to explore its children
-                    if ((await this.exists[entryPath]) && ((_b = (await this.lstat[entryPath])) === null || _b === void 0 ? void 0 : _b.isDirectory())) {
-                        const scopeEntries = await fs.readdir(entryPath);
-                        for (const sc of scopeEntries) {
-                            const scPath = path.join(entryPath, sc);
-                            // check scPath/node_modules/pkgName
-                            const candidatePkgJson = path.join(scPath, "node_modules", pkgName, "package.json");
-                            if (await this.exists[candidatePkgJson]) {
-                                const json = await this.json[candidatePkgJson];
-                                if (json && this.semverSatisfies(json.version, requiredRange)) {
-                                    return { packageDir: path.dirname(candidatePkgJson), packageJson: json };
-                                }
-                            }
-                            // enqueue scPath/node_modules to explore further
-                            const scNodeModules = path.join(scPath, "node_modules");
-                            if ((await this.exists[scNodeModules]) && ((_c = (await this.lstat[scNodeModules])) === null || _c === void 0 ? void 0 : _c.isDirectory())) {
-                                if (!visited.has(scNodeModules)) {
-                                    visited.add(scNodeModules);
-                                    queue.push({ dir: scNodeModules, depth: depth + 1 });
-                                }
-                            }
-                        }
+                    const found = await this.processScope(entryPath, pkgName, requiredRange, depth, visited, queue);
+                    if (found) {
+                        return found;
                     }
                     continue;
                 }
-                // check for direct candidate: entry/node_modules/pkgName
-                try {
-                    const stat = await this.lstat[entryPath];
-                    if (!(stat === null || stat === void 0 ? void 0 : stat.isDirectory())) {
-                        continue;
-                    }
-                }
-                catch {
-                    continue;
-                }
-                const candidatePkgJson = path.join(entryPath, "node_modules", pkgName, "package.json");
-                if (await this.exists[candidatePkgJson]) {
-                    const json = await this.json[candidatePkgJson];
-                    if (json && this.semverSatisfies(json.version, requiredRange)) {
-                        return { packageDir: path.dirname(candidatePkgJson), packageJson: json };
-                    }
+                const found = await this.processEntry(entryPath, pkgName, requiredRange, depth, visited, queue);
+                if (found) {
+                    return found;
                 }
-                // also check entry/node_modules directly for pkgName (some layouts)
-                const candidateDirect = path.join(entryPath, pkgName, "package.json");
-                if (await this.exists[candidateDirect]) {
-                    const json = await this.json[candidateDirect];
-                    if (json && this.semverSatisfies(json.version, requiredRange)) {
-                        return { packageDir: path.dirname(candidateDirect), packageJson: json };
-                    }
-                }
-                // enqueue entry/node_modules for deeper traversal
-                const nextNodeModules = path.join(entryPath, "node_modules");
-                if ((await this.exists[nextNodeModules]) && ((_d = (await this.lstat[nextNodeModules])) === null || _d === void 0 ? void 0 : _d.isDirectory())) {
-                    if (!visited.has(nextNodeModules)) {
-                        visited.add(nextNodeModules);
-                        queue.push({ dir: nextNodeModules, depth: depth + 1 });
-                    }
+            }
+        }
+        return null;
+    }
+    /** Handle a non-scoped entry directory inside a node_modules folder. */
+    async processEntry(entryPath, pkgName, requiredRange, depth, visited, queue) {
+        const stat = await this.lstat[entryPath];
+        if (!(stat === null || stat === void 0 ? void 0 : stat.isDirectory())) {
+            return null;
+        }
+        // Check entry/node_modules/pkgName (nested dep under a package)
+        const nested = path.join(entryPath, "node_modules", pkgName, "package.json");
+        if (await this.exists[nested]) {
+            const json = await this.json[nested];
+            if (json && this.semverSatisfies(json.version, requiredRange)) {
+                return { packageDir: path.dirname(nested), packageJson: json };
+            }
+        }
+        // Check entry/pkgName directly (some flat layouts place pkgName as a sibling)
+        const direct = path.join(entryPath, pkgName, "package.json");
+        if (await this.exists[direct]) {
+            const json = await this.json[direct];
+            if (json && this.semverSatisfies(json.version, requiredRange)) {
+                return { packageDir: path.dirname(direct), packageJson: json };
+            }
+        }
+        await this.enqueueIfExists(path.join(entryPath, "node_modules"), depth, visited, queue);
+        return null;
+    }
+    /** Handle a scoped-package directory (@scope) inside a node_modules folder. */
+    async processScope(scopePath, pkgName, requiredRange, depth, visited, queue) {
+        var _a;
+        if (!(await this.exists[scopePath]) || !((_a = (await this.lstat[scopePath])) === null || _a === void 0 ? void 0 : _a.isDirectory())) {
+            return null;
+        }
+        let scopeEntries;
+        try {
+            scopeEntries = await fs.readdir(scopePath);
+        }
+        catch {
+            return null;
+        }
+        for (const sc of scopeEntries) {
+            const scPath = path.join(scopePath, sc);
+            const candidatePkgJson = path.join(scPath, "node_modules", pkgName, "package.json");
+            if (await this.exists[candidatePkgJson]) {
+                const json = await this.json[candidatePkgJson];
+                if (json && this.semverSatisfies(json.version, requiredRange)) {
+                    return { packageDir: path.dirname(candidatePkgJson), packageJson: json };
                 }
             }
+            await this.enqueueIfExists(path.join(scPath, "node_modules"), depth, visited, queue);
         }
         return null;
     }
+    /** Enqueue a node_modules directory for BFS only if it exists on disk and hasn't been visited. */
+    async enqueueIfExists(nmPath, depth, visited, queue) {
+        var _a;
+        if (!visited.has(nmPath) && (await this.exists[nmPath]) && ((_a = (await this.lstat[nmPath])) === null || _a === void 0 ? void 0 : _a.isDirectory())) {
+            visited.add(nmPath);
+            queue.push({ dir: nmPath, depth: depth + 1 });
+        }
+    }
 }
 exports.ModuleManager = ModuleManager;
 //# sourceMappingURL=moduleManager.js.map

package/out/node-module-collector/moduleManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"moduleManager.js","sourceRoot":"","sources":["../../src/node-module-collector/moduleManager.ts"],"names":[],"mappings":";;;AAAA,+CAAqE;AAErE,+BAA8B;AAC9B,6BAA4B;AAC5B,iCAAgC;AAEhC,IAAY,eAUX;AAVD,WAAY,eAAe;IACzB,wEAAqD,CAAA;IACrD,8FAA2E,CAAA;IAC3E,oEAAiD,CAAA;IACjD,mEAAgD,CAAA;IAChD,iEAA8C,CAAA;IAC9C,+EAA4D,CAAA;IAC5D,6PAAqO,CAAA;IACrO,mEAAgD,CAAA;IAChD,6LAAqK,CAAA;AACvK,CAAC,EAVW,eAAe,+BAAf,eAAe,QAU1B;AACY,QAAA,oBAAoB,GAAsC;IACrE,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,MAAM;IAC3C,CAAC,eAAe,CAAC,4BAA4B,CAAC,EAAE,MAAM;IACtD,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,MAAM;IACvC,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,MAAM;IACzC,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO;IACvC,CAAC,eAAe,CAAC,0BAA0B,CAAC,EAAE,MAAM;IACpD,CAAC,eAAe,CAAC,mCAAmC,CAAC,EAAE,MAAM;IAC7D,CAAC,eAAe,CAAC,oBAAoB,CAAC,EAAE,MAAM;IAC9C,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE,OAAO;CAClD,CAAA;AAYD,MAAa,aAAa;IAqBxB;QAPiB,YAAO,GAAoC,IAAI,GAAG,EAAE,CAAA;QACpD,gBAAW,GAAwB,IAAI,GAAG,EAAE,CAAA;QAC5C,cAAS,GAAyB,IAAI,GAAG,EAAE,CAAA;QAC3C,aAAQ,GAAiC,IAAI,GAAG,EAAE,CAAA;QAClD,mBAAc,GAAgC,IAAI,GAAG,EAAE,CAAA;QACvD,kBAAa,GAAmC,IAAI,GAAG,EAAE,CAAA;QAGxE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAA;QAElD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAA,qBAAM,EAAC,CAAC,CAAC,CAAC,CAAA;QAC7E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAChG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAC/F,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACxI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE;YAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YACvC,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,cAAc,EAAE,EAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;QAClE,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,yBAAyB;QAC/B,OAAO,IAAI,KAAK,CAAC,EAAqB,EAAE;YACtC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAoB,EAAE,EAAE;gBAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;gBACjC,CAAC;gBACD,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAE,CAAA;YACrC,CAAC;YACD,GAAG,EAAE,CAAC,CAAC,EAAE,GAAoB,EAAE,KAAe,EAAE,EAAE;gBAChD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAClC,OAAO,IAAI,CAAA;YACb,CAAC;YACD,GAAG,EAAE,CAAC,CAAC,EAAE,GAAoB,EAAE,EAAE;gBAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpC,CAAC;YACD,0CAA0C;YAC1C,OAAO,EAAE,CAAC,CAAC,EAAE;gBACX,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAA;YAC9C,CAAC;YACD,wBAAwB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;gBACnC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAsB,CAAC,EAAE,CAAC;oBACnD,OAAO;wBACL,UAAU,EAAE,IAAI;wBAChB,YAAY,EAAE,IAAI;qBACnB,CAAA;gBACH,CAAC;gBACD,OAAO,SAAS,CAAA;YAClB,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,iEAAiE;IACzD,gBAAgB,CAAI,GAAmB,EAAE,OAAwC;QACvF,OAAO,IAAI,KAAK,CAAC,EAAgC,EAAE;YACjD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,GAAW;gBACtB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,CAAA;gBACvC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;oBACtD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;oBACnB,OAAO,KAAK,CAAA;gBACd,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,GAAG,CAAC,CAAC,EAAE,GAAW,EAAE,KAAQ;gBAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,GAAG,CAAC,CAAC,EAAE,GAAW;gBAChB,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrB,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB,CAAC,GAAoD;QACpE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1D,CAAC;IAES,KAAK,CAAC,gCAAgC,CAAC,GAAW;QAC1D,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAA;QACjH,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAA;IAC1E,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,EAChC,SAAS,EACT,OAAO,EACP,aAAa,EACb,kBAAkB,GAAG,KAAK,GAqB3B;QACC,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAA;QAChG,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAA;QACd,CAAC;QAED,wFAAwF;QACxF,wFAAwF;QACxF,yFAAyF;QACzF,+EAA+E;QAC/E,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;YACrG,IAAI,cAAc,EAAE,CAAC;gBACnB,kBAAG,CAAC,KAAK,CACP,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,OAAO,EAAE,EACxF,6EAA6E,CAC9E,CAAA;gBACD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,OAAO,cAAc,aAAa,GAAG,CAAC,CAAA;gBAC5I,OAAO,cAAc,CAAA;YACvB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,OAAe,EAAE,aAAiC,EAAE,kBAA2B;QAC/H,oDAAoD;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;QAC1F,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpC,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;YAChE,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAA;QACf,CAAC;QACD,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,IAAI,CAAA;IAC/E,CAAC;IAEO,eAAe,CAAC,KAAa,EAAE,KAAc;QACnD,IAAI,IAAA,8BAAe,EAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACrC,4CAA4C;YAC5C,8CAA8C;YAC9C,mHAAmH;YACnH,kBAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,yDAAyD,CAAC,CAAA;YACtF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBACxB,OAAO,CAAC,KAAK,KAAK,CAAA;YACpB,CAAC;YACD,8CAA8C;YAC9C,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;YACxC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YAClC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;YACvB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,OAAe,EAAE,aAAsB;QACnF,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAA;QACrC,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;YAC7E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBACvC,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;oBAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;gBACnE,CAAC;gBACD,4EAA4E;YAC9E,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAK;YACP,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAK;YACP,CAAC;YACD,OAAO,GAAG,MAAM,CAAA;QAClB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,OAAe,EAAE,aAAsB,EAAE,WAAW,GAAG,IAAI,EAAE,QAAQ,GAAG,CAAC;;QACvH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAA;QAChE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAA,MAAA,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,0CAAE,WAAW,EAAE,CAAA,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;QACjC,MAAM,KAAK,GAA0C,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;QAC/E,IAAI,QAAQ,GAAG,CAAC,CAAA;QAEhB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAA;YACrC,IAAI,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;gBAC7B,MAAK;YACP,CAAC;YACD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,SAAQ;YACV,CAAC;YACD,IAAI,OAAiB,CAAA;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,SAAQ;gBACV,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACvC,qCAAqC;gBACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,2DAA2D;oBAC3D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAI,MAAA,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,0CAAE,WAAW,EAAE,CAAA,EAAE,CAAC;wBACnF,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;wBAChD,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;4BAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;4BACvC,oCAAoC;4BACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;4BACnF,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;gCACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;gCAC9C,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;oCAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;gCAC1E,CAAC;4BACH,CAAC;4BACD,iDAAiD;4BACjD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;4BACvD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAI,MAAA,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,0CAAE,WAAW,EAAE,CAAA,EAAE,CAAC;gCAC3F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;oCAChC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;oCAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;gCACtD,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,SAAQ;gBACV,CAAC;gBAED,yDAAyD;gBACzD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;oBACxC,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,EAAE,CAAA,EAAE,CAAC;wBACzB,SAAQ;oBACV,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAQ;gBACV,CAAC;gBAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;gBACtF,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;oBAC9C,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;wBAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;oBAC1E,CAAC;gBACH,CAAC;gBAED,oEAAoE;gBACpE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;gBACrE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;oBAC7C,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;wBAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;oBACzE,CAAC;gBACH,CAAC;gBAED,kDAAkD;gBAClD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;gBAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAI,MAAA,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,0CAAE,WAAW,EAAE,CAAA,EAAE,CAAC;oBAC/F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;wBAClC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;wBAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;oBACxD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AApVD,sCAoVC","sourcesContent":["import { exists, isEmptyOrSpaces, log, LogLevel } from \"builder-util\"\nimport { PackageJson } from \"./types\"\nimport * as fs from \"fs-extra\"\nimport * as path from \"path\"\nimport * as semver from \"semver\"\n\nexport enum LogMessageByKey {\n  PKG_DUPLICATE_REF = \"duplicate dependency references\",\n  PKG_DUPLICATE_REF_UNRESOLVED = \"unresolved duplicate dependency references\",\n  PKG_NOT_FOUND = \"cannot find path for dependency\",\n  PKG_NOT_ON_DISK = \"dependency not found on disk\",\n  PKG_SELF_REF = \"self-referential dependencies\",\n  PKG_OPTIONAL_NOT_INSTALLED = \"missing optional dependencies\",\n  PKG_OPTIONAL_PLATFORM_NOT_INSTALLED = \"platform-specific optional dependencies not bundled — add them to your project's optionalDependencies if your app requires them (pnpm 10+ does not auto-install transitive platform binaries)\",\n  PKG_COLLECTOR_OUTPUT = \"collector stderr output\",\n  PKG_VERSION_OVERRIDDEN = \"dependencies resolved to a version outside the declared range (installed version accepted — likely resolved via package manager overrides)\",\n}\nexport const logMessageLevelByKey: Record<LogMessageByKey, LogLevel> = {\n  [LogMessageByKey.PKG_DUPLICATE_REF]: \"info\",\n  [LogMessageByKey.PKG_DUPLICATE_REF_UNRESOLVED]: \"warn\",\n  [LogMessageByKey.PKG_NOT_FOUND]: \"warn\",\n  [LogMessageByKey.PKG_NOT_ON_DISK]: \"warn\",\n  [LogMessageByKey.PKG_SELF_REF]: \"debug\",\n  [LogMessageByKey.PKG_OPTIONAL_NOT_INSTALLED]: \"info\",\n  [LogMessageByKey.PKG_OPTIONAL_PLATFORM_NOT_INSTALLED]: \"warn\",\n  [LogMessageByKey.PKG_COLLECTOR_OUTPUT]: \"warn\",\n  [LogMessageByKey.PKG_VERSION_OVERRIDDEN]: \"debug\",\n}\n\nexport type Package = { packageDir: string; packageJson: PackageJson }\n\n// Type aliases for clarity\ntype JsonCache = Record<string, Promise<PackageJson | null>>\ntype RealPathCache = Record<string, Promise<string>>\ntype ExistsCache = Record<string, Promise<boolean>>\ntype LstatCache = Record<string, Promise<fs.Stats | null>>\ntype PackageCache = Record<string, Promise<Package | null>>\ntype LogSummaryCache = Record<LogMessageByKey, string[]>\n\nexport class ModuleManager {\n  /** Cache for package.json contents (readJson) */\n  readonly json: JsonCache\n  /** Cache for resolved real paths (if symlink, realpath; otherwise resolve) */\n  readonly realPath: RealPathCache\n  /** Cache for file/directory existence checks */\n  readonly exists: ExistsCache\n  /** Cache for lstat results */\n  readonly lstat: LstatCache\n  /** Cache for package lookups (key: \"packageName||fromDir||semverRange\"). Use helper function `versionedCacheKey` */\n  readonly packageData: PackageCache\n  /** For logging purposes, just track all dependencies for each key */\n  readonly logSummary: LogSummaryCache\n\n  private readonly jsonMap: Map<string, PackageJson | null> = new Map()\n  private readonly realPathMap: Map<string, string> = new Map()\n  private readonly existsMap: Map<string, boolean> = new Map()\n  private readonly lstatMap: Map<string, fs.Stats | null> = new Map()\n  private readonly packageDataMap: Map<string, Package | null> = new Map()\n  private readonly logSummaryMap: Map<LogMessageByKey, string[]> = new Map()\n\n  constructor() {\n    this.logSummary = this.createLogSummarySyncProxy()\n\n    this.exists = this.createAsyncProxy(this.existsMap, (p: string) => exists(p))\n    this.json = this.createAsyncProxy(this.jsonMap, (p: string) => fs.readJson(p).catch(() => null))\n    this.lstat = this.createAsyncProxy(this.lstatMap, (p: string) => fs.lstat(p).catch(() => null))\n    this.packageData = this.createAsyncProxy(this.packageDataMap, (p: string) => this.locatePackageVersionFromCacheKey(p).catch(() => null))\n    this.realPath = this.createAsyncProxy(this.realPathMap, async (p: string) => {\n      const filePath = path.resolve(p)\n      const stat = await this.lstat[filePath]\n      return stat?.isSymbolicLink() ? fs.realpath(filePath) : filePath\n    })\n  }\n\n  private createLogSummarySyncProxy(): LogSummaryCache {\n    return new Proxy({} as LogSummaryCache, {\n      get: (_, key: LogMessageByKey) => {\n        if (!this.logSummaryMap.has(key)) {\n          this.logSummaryMap.set(key, [])\n        }\n        return this.logSummaryMap.get(key)!\n      },\n      set: (_, key: LogMessageByKey, value: string[]) => {\n        this.logSummaryMap.set(key, value)\n        return true\n      },\n      has: (_, key: LogMessageByKey) => {\n        return this.logSummaryMap.has(key)\n      },\n      // Add these to make Object.entries() work\n      ownKeys: _ => {\n        return Array.from(this.logSummaryMap.keys())\n      },\n      getOwnPropertyDescriptor: (_, key) => {\n        if (this.logSummaryMap.has(key as LogMessageByKey)) {\n          return {\n            enumerable: true,\n            configurable: true,\n          }\n        }\n        return undefined\n      },\n    })\n  }\n\n  // this allows dot-notation access while still supporting async retrieval\n  // e.g., cache.packageJson[somePath] returns Promise<PackageJson>\n  private createAsyncProxy<T>(map: Map<string, T>, compute: (key: string) => T | Promise<T>): Record<string, Promise<T>> {\n    return new Proxy({} as Record<string, Promise<T>>, {\n      async get(_, key: string) {\n        if (map.has(key)) {\n          return Promise.resolve(map.get(key)!)\n        }\n        return await Promise.resolve(compute(key)).then(value => {\n          map.set(key, value)\n          return value\n        })\n      },\n      set(_, key: string, value: T) {\n        map.set(key, value)\n        return true\n      },\n      has(_, key: string) {\n        return map.has(key)\n      },\n    })\n  }\n\n  versionedCacheKey(pkg: { name: string; path: string; semver?: string }): string {\n    return [pkg.name, pkg.path, pkg.semver || \"\"].join(\"||\")\n  }\n\n  protected async locatePackageVersionFromCacheKey(key: string): Promise<Package | null> {\n    const [name, fromDir, semverRange] = key.split(\"||\")\n    const result = await this.locatePackageVersion({ parentDir: fromDir, pkgName: name, requiredRange: semverRange })\n    if (result == null) {\n      return null\n    }\n    return { ...result, packageDir: await this.realPath[result.packageDir] }\n  }\n\n  public async locatePackageVersion({\n    parentDir,\n    pkgName,\n    requiredRange,\n    skipDownwardSearch = false,\n  }: {\n    /**\n     * The directory to start searching from. Typed optional because pnpm JSON output can omit\n     * the `path` field at runtime even when the TypeScript type says `string`. An undefined\n     * parentDir is treated as \"package not found\" rather than a crash.\n     */\n    parentDir?: string\n    /**\n     * The package name to locate. Typed optional for the same reason as parentDir: the pnpm\n     * list JSON can omit `name`/`from` fields (e.g. when the root package.json has no name),\n     * producing an undefined pkgName at runtime despite the TypeScript type.\n     */\n    pkgName?: string\n    requiredRange?: string\n    /**\n     * When true, skip the BFS-based `downwardSearch`. Use for layouts that are guaranteed flat\n     * (e.g. pnpm's `.pnpm` virtual store), where the downward walk burns thousands of `readdir`\n     * / `lstat` calls and finds nothing.\n     */\n    skipDownwardSearch?: boolean\n  }): Promise<Package | null> {\n    if (!parentDir || !pkgName) {\n      return null\n    }\n\n    const found = await this.searchForPackage(parentDir, pkgName, requiredRange, skipDownwardSearch)\n    if (found) {\n      return found\n    }\n\n    // Second pass: find any installed version of the package when the declared-range search\n    // returns nothing. This handles package manager `overrides` (Bun, npm, pnpm, Yarn) that\n    // resolve a transitive dependency to a version intentionally outside its declared range.\n    // File-system results are already cached, so this pass costs only JS overhead.\n    if (requiredRange) {\n      const overrideResult = await this.searchForPackage(parentDir, pkgName, undefined, skipDownwardSearch)\n      if (overrideResult) {\n        log.debug(\n          { pkg: pkgName, declared: requiredRange, installed: overrideResult.packageJson.version },\n          \"accepting installed package version that doesn't satisfy the declared range\"\n        )\n        this.logSummary[LogMessageByKey.PKG_VERSION_OVERRIDDEN].push(`${pkgName}@${overrideResult.packageJson.version} (declared ${requiredRange})`)\n        return overrideResult\n      }\n    }\n\n    return null\n  }\n\n  private async searchForPackage(parentDir: string, pkgName: string, requiredRange: string | undefined, skipDownwardSearch: boolean): Promise<Package | null> {\n    // 1) check direct parent node_modules/pkgName first\n    const direct = path.join(path.resolve(parentDir), \"node_modules\", pkgName, \"package.json\")\n    if (await this.exists[direct]) {\n      const json = await this.json[direct]\n      if (json && this.semverSatisfies(json.version, requiredRange)) {\n        return { packageDir: path.dirname(direct), packageJson: json }\n      }\n    }\n\n    // 2) upward hoisted search, then 3) downward non-hoisted search\n    const upward = await this.upwardSearch(parentDir, pkgName, requiredRange)\n    if (upward) {\n      return upward\n    }\n    if (skipDownwardSearch) {\n      return null\n    }\n    return (await this.downwardSearch(parentDir, pkgName, requiredRange)) || null\n  }\n\n  private semverSatisfies(found: string, range?: string): boolean {\n    if (isEmptyOrSpaces(range) || range === \"*\") {\n      return true\n    }\n\n    if (range === found) {\n      return true\n    }\n\n    if (semver.validRange(range) == null) {\n      // ignore, we can't verify non-semver ranges\n      // e.g. git urls, file:, patch:, etc. Example:\n      // \"@ai-sdk/google\": \"patch:@ai-sdk/google@npm%3A2.0.43#~/.yarn/patches/@ai-sdk-google-npm-2.0.43-689ed559b3.patch\"\n      log.debug({ found, range }, \"unable to validate semver version range, assuming match\")\n      return true\n    }\n\n    try {\n      return semver.satisfies(found, range)\n    } catch {\n      // fallback: simple equality or basic prefix handling (^, ~)\n      if (range.startsWith(\"^\") || range.startsWith(\"~\")) {\n        const r = range.slice(1)\n        return r === found\n      }\n      // if range is like \"8.x\" or \"8.*\" match major\n      const m = range.match(/^(\\d+)[.(*|x)]*/)\n      const fm = found.match(/^(\\d+)\\./)\n      if (m && fm) {\n        return m[1] === fm[1]\n      }\n      return false\n    }\n  }\n\n  /**\n   * Upward search (hoisted)\n   */\n  private async upwardSearch(parentDir: string, pkgName: string, requiredRange?: string): Promise<Package | null> {\n    let current = path.resolve(parentDir)\n    const root = path.parse(current).root\n    while (true) {\n      const candidate = path.join(current, \"node_modules\", pkgName, \"package.json\")\n      if (await this.exists[candidate]) {\n        const json = await this.json[candidate]\n        if (json && this.semverSatisfies(json.version, requiredRange)) {\n          return { packageDir: path.dirname(candidate), packageJson: json }\n        }\n        // otherwise keep searching upward (we may find a different hoisted version)\n      }\n      if (current === root) {\n        break\n      }\n      const parent = path.dirname(current)\n      if (parent === current) {\n        break\n      }\n      current = parent\n    }\n    return null\n  }\n\n  /**\n   * Breadth-first downward search from parentDir/node_modules\n   * Looks for node_modules/\\*\\/node_modules/pkgName (and deeper)\n   */\n  private async downwardSearch(parentDir: string, pkgName: string, requiredRange?: string, maxExplored = 2000, maxDepth = 6): Promise<Package | null> {\n    const start = path.join(path.resolve(parentDir), \"node_modules\")\n    if (!(await this.exists[start]) || !(await this.lstat[start])?.isDirectory()) {\n      return null\n    }\n\n    const visited = new Set<string>()\n    const queue: Array<{ dir: string; depth: number }> = [{ dir: start, depth: 0 }]\n    let explored = 0\n\n    while (queue.length > 0) {\n      const { dir, depth } = queue.shift()!\n      if (explored++ > maxExplored) {\n        break\n      }\n      if (depth > maxDepth) {\n        continue\n      }\n      let entries: string[]\n      try {\n        entries = await fs.readdir(dir)\n      } catch {\n        continue\n      }\n      for (const entry of entries) {\n        if (entry.startsWith(\".\")) {\n          continue\n        }\n        const entryPath = path.join(dir, entry)\n        // handle scoped packages @scope/name\n        if (entry.startsWith(\"@\")) {\n          // queue the scope directory itself to explore its children\n          if ((await this.exists[entryPath]) && (await this.lstat[entryPath])?.isDirectory()) {\n            const scopeEntries = await fs.readdir(entryPath)\n            for (const sc of scopeEntries) {\n              const scPath = path.join(entryPath, sc)\n              // check scPath/node_modules/pkgName\n              const candidatePkgJson = path.join(scPath, \"node_modules\", pkgName, \"package.json\")\n              if (await this.exists[candidatePkgJson]) {\n                const json = await this.json[candidatePkgJson]\n                if (json && this.semverSatisfies(json.version, requiredRange)) {\n                  return { packageDir: path.dirname(candidatePkgJson), packageJson: json }\n                }\n              }\n              // enqueue scPath/node_modules to explore further\n              const scNodeModules = path.join(scPath, \"node_modules\")\n              if ((await this.exists[scNodeModules]) && (await this.lstat[scNodeModules])?.isDirectory()) {\n                if (!visited.has(scNodeModules)) {\n                  visited.add(scNodeModules)\n                  queue.push({ dir: scNodeModules, depth: depth + 1 })\n                }\n              }\n            }\n          }\n          continue\n        }\n\n        // check for direct candidate: entry/node_modules/pkgName\n        try {\n          const stat = await this.lstat[entryPath]\n          if (!stat?.isDirectory()) {\n            continue\n          }\n        } catch {\n          continue\n        }\n\n        const candidatePkgJson = path.join(entryPath, \"node_modules\", pkgName, \"package.json\")\n        if (await this.exists[candidatePkgJson]) {\n          const json = await this.json[candidatePkgJson]\n          if (json && this.semverSatisfies(json.version, requiredRange)) {\n            return { packageDir: path.dirname(candidatePkgJson), packageJson: json }\n          }\n        }\n\n        // also check entry/node_modules directly for pkgName (some layouts)\n        const candidateDirect = path.join(entryPath, pkgName, \"package.json\")\n        if (await this.exists[candidateDirect]) {\n          const json = await this.json[candidateDirect]\n          if (json && this.semverSatisfies(json.version, requiredRange)) {\n            return { packageDir: path.dirname(candidateDirect), packageJson: json }\n          }\n        }\n\n        // enqueue entry/node_modules for deeper traversal\n        const nextNodeModules = path.join(entryPath, \"node_modules\")\n        if ((await this.exists[nextNodeModules]) && (await this.lstat[nextNodeModules])?.isDirectory()) {\n          if (!visited.has(nextNodeModules)) {\n            visited.add(nextNodeModules)\n            queue.push({ dir: nextNodeModules, depth: depth + 1 })\n          }\n        }\n      }\n    }\n\n    return null\n  }\n}\n"]}
+{"version":3,"file":"moduleManager.js","sourceRoot":"","sources":["../../src/node-module-collector/moduleManager.ts"],"names":[],"mappings":";;;AAAA,+CAAqE;AAErE,+BAA8B;AAC9B,6BAA4B;AAC5B,iCAAgC;AAEhC,IAAY,eAUX;AAVD,WAAY,eAAe;IACzB,wEAAqD,CAAA;IACrD,8FAA2E,CAAA;IAC3E,oEAAiD,CAAA;IACjD,mEAAgD,CAAA;IAChD,iEAA8C,CAAA;IAC9C,+EAA4D,CAAA;IAC5D,6PAAqO,CAAA;IACrO,mEAAgD,CAAA;IAChD,6LAAqK,CAAA;AACvK,CAAC,EAVW,eAAe,+BAAf,eAAe,QAU1B;AACY,QAAA,oBAAoB,GAAsC;IACrE,CAAC,eAAe,CAAC,iBAAiB,CAAC,EAAE,MAAM;IAC3C,CAAC,eAAe,CAAC,4BAA4B,CAAC,EAAE,MAAM;IACtD,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,MAAM;IACvC,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,MAAM;IACzC,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,OAAO;IACvC,CAAC,eAAe,CAAC,0BAA0B,CAAC,EAAE,MAAM;IACpD,CAAC,eAAe,CAAC,mCAAmC,CAAC,EAAE,MAAM;IAC7D,CAAC,eAAe,CAAC,oBAAoB,CAAC,EAAE,MAAM;IAC9C,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE,OAAO;CAClD,CAAA;AAYD,MAAa,aAAa;IAqBxB;QAPiB,YAAO,GAAoC,IAAI,GAAG,EAAE,CAAA;QACpD,gBAAW,GAAwB,IAAI,GAAG,EAAE,CAAA;QAC5C,cAAS,GAAyB,IAAI,GAAG,EAAE,CAAA;QAC3C,aAAQ,GAAiC,IAAI,GAAG,EAAE,CAAA;QAClD,mBAAc,GAAgC,IAAI,GAAG,EAAE,CAAA;QACvD,kBAAa,GAAmC,IAAI,GAAG,EAAE,CAAA;QAGxE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAA;QAElD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAA,qBAAM,EAAC,CAAC,CAAC,CAAC,CAAA;QAC7E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAChG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QAC/F,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;QACxI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE;YAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YACvC,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,cAAc,EAAE,EAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;QAClE,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,yBAAyB;QAC/B,OAAO,IAAI,KAAK,CAAC,EAAqB,EAAE;YACtC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAoB,EAAE,EAAE;gBAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;gBACjC,CAAC;gBACD,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAE,CAAA;YACrC,CAAC;YACD,GAAG,EAAE,CAAC,CAAC,EAAE,GAAoB,EAAE,KAAe,EAAE,EAAE;gBAChD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAClC,OAAO,IAAI,CAAA;YACb,CAAC;YACD,GAAG,EAAE,CAAC,CAAC,EAAE,GAAoB,EAAE,EAAE;gBAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpC,CAAC;YACD,0CAA0C;YAC1C,OAAO,EAAE,CAAC,CAAC,EAAE;gBACX,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAA;YAC9C,CAAC;YACD,wBAAwB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;gBACnC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAsB,CAAC,EAAE,CAAC;oBACnD,OAAO;wBACL,UAAU,EAAE,IAAI;wBAChB,YAAY,EAAE,IAAI;qBACnB,CAAA;gBACH,CAAC;gBACD,OAAO,SAAS,CAAA;YAClB,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,yEAAyE;IACzE,iEAAiE;IACzD,gBAAgB,CAAI,GAAmB,EAAE,OAAwC;QACvF,OAAO,IAAI,KAAK,CAAC,EAAgC,EAAE;YACjD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,GAAW;gBACtB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,CAAA;gBACvC,CAAC;gBACD,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;oBACtD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;oBACnB,OAAO,KAAK,CAAA;gBACd,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,GAAG,CAAC,CAAC,EAAE,GAAW,EAAE,KAAQ;gBAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,GAAG,CAAC,CAAC,EAAE,GAAW;gBAChB,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrB,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED,iBAAiB,CAAC,GAAoD;QACpE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1D,CAAC;IAES,KAAK,CAAC,gCAAgC,CAAC,GAAW;QAC1D,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAA;QACjH,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAA;IAC1E,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,EAChC,SAAS,EACT,OAAO,EACP,aAAa,EACb,kBAAkB,GAAG,KAAK,GAqB3B;QACC,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAA;QAChG,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAA;QACd,CAAC;QAED,wFAAwF;QACxF,wFAAwF;QACxF,yFAAyF;QACzF,+EAA+E;QAC/E,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;YACrG,IAAI,cAAc,EAAE,CAAC;gBACnB,kBAAG,CAAC,KAAK,CACP,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,OAAO,EAAE,EACxF,6EAA6E,CAC9E,CAAA;gBACD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,cAAc,CAAC,WAAW,CAAC,OAAO,cAAc,aAAa,GAAG,CAAC,CAAA;gBAC5I,OAAO,cAAc,CAAA;YACvB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,OAAe,EAAE,aAAiC,EAAE,kBAA2B;QAC/H,oDAAoD;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;QAC1F,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpC,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;YAChE,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAA;QACf,CAAC;QACD,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,IAAI,IAAI,CAAA;IAC/E,CAAC;IAEO,eAAe,CAAC,KAAa,EAAE,KAAc;QACnD,IAAI,IAAA,8BAAe,EAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACrC,4CAA4C;YAC5C,8CAA8C;YAC9C,mHAAmH;YACnH,kBAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,yDAAyD,CAAC,CAAA;YACtF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBACxB,OAAO,CAAC,KAAK,KAAK,CAAA;YACpB,CAAC;YACD,8CAA8C;YAC9C,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;YACxC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YAClC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;YACvB,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,OAAe,EAAE,aAAsB;QACnF,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAA;QACrC,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;YAC7E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBACvC,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;oBAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;gBACnE,CAAC;gBACD,4EAA4E;YAC9E,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAK;YACP,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAK;YACP,CAAC;YACD,OAAO,GAAG,MAAM,CAAA;QAClB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,OAAe,EAAE,aAAsB,EAAE,WAAW,GAAG,IAAI,EAAE,QAAQ,GAAG,CAAC;;QACvH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAA;QAChE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAA,MAAA,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,0CAAE,WAAW,EAAE,CAAA,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;QACjC,MAAM,KAAK,GAA0C,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;QAC/E,IAAI,QAAQ,GAAG,CAAC,CAAA;QAEhB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAA;YACrC,IAAI,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;gBAC7B,MAAK;YACP,CAAC;YACD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,SAAQ;YACV,CAAC;YACD,IAAI,OAAiB,CAAA;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,SAAQ;gBACV,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACvC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;oBAC/F,IAAI,KAAK,EAAE,CAAC;wBACV,OAAO,KAAK,CAAA;oBACd,CAAC;oBACD,SAAQ;gBACV,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;gBAC/F,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wEAAwE;IAChE,KAAK,CAAC,YAAY,CACxB,SAAiB,EACjB,OAAe,EACf,aAAiC,EACjC,KAAa,EACb,OAAoB,EACpB,KAA4C;QAE5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACxC,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,EAAE,CAAA,EAAE,CAAC;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,gEAAgE;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;QAC5E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpC,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;YAChE,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;QAC5D,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACpC,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;YAChE,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACvF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+EAA+E;IACvE,KAAK,CAAC,YAAY,CACxB,SAAiB,EACjB,OAAe,EACf,aAAiC,EACjC,KAAa,EACb,OAAoB,EACpB,KAA4C;;QAE5C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAA,MAAA,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,0CAAE,WAAW,EAAE,CAAA,EAAE,CAAC;YACrF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,YAAsB,CAAA;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;YACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;YACnF,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;gBAC9C,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;oBAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;gBAC1E,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACtF,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,kGAAkG;IAC1F,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,KAAa,EAAE,OAAoB,EAAE,KAA4C;;QAC7H,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAI,MAAA,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,0CAAE,WAAW,EAAE,CAAA,EAAE,CAAC;YACrG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACnB,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;CACF;AA5WD,sCA4WC","sourcesContent":["import { exists, isEmptyOrSpaces, log, LogLevel } from \"builder-util\"\nimport { PackageJson } from \"./types\"\nimport * as fs from \"fs-extra\"\nimport * as path from \"path\"\nimport * as semver from \"semver\"\n\nexport enum LogMessageByKey {\n  PKG_DUPLICATE_REF = \"duplicate dependency references\",\n  PKG_DUPLICATE_REF_UNRESOLVED = \"unresolved duplicate dependency references\",\n  PKG_NOT_FOUND = \"cannot find path for dependency\",\n  PKG_NOT_ON_DISK = \"dependency not found on disk\",\n  PKG_SELF_REF = \"self-referential dependencies\",\n  PKG_OPTIONAL_NOT_INSTALLED = \"missing optional dependencies\",\n  PKG_OPTIONAL_PLATFORM_NOT_INSTALLED = \"platform-specific optional dependencies not bundled — add them to your project's optionalDependencies if your app requires them (pnpm 10+ does not auto-install transitive platform binaries)\",\n  PKG_COLLECTOR_OUTPUT = \"collector stderr output\",\n  PKG_VERSION_OVERRIDDEN = \"dependencies resolved to a version outside the declared range (installed version accepted — likely resolved via package manager overrides)\",\n}\nexport const logMessageLevelByKey: Record<LogMessageByKey, LogLevel> = {\n  [LogMessageByKey.PKG_DUPLICATE_REF]: \"info\",\n  [LogMessageByKey.PKG_DUPLICATE_REF_UNRESOLVED]: \"warn\",\n  [LogMessageByKey.PKG_NOT_FOUND]: \"warn\",\n  [LogMessageByKey.PKG_NOT_ON_DISK]: \"warn\",\n  [LogMessageByKey.PKG_SELF_REF]: \"debug\",\n  [LogMessageByKey.PKG_OPTIONAL_NOT_INSTALLED]: \"info\",\n  [LogMessageByKey.PKG_OPTIONAL_PLATFORM_NOT_INSTALLED]: \"warn\",\n  [LogMessageByKey.PKG_COLLECTOR_OUTPUT]: \"warn\",\n  [LogMessageByKey.PKG_VERSION_OVERRIDDEN]: \"debug\",\n}\n\nexport type Package = { packageDir: string; packageJson: PackageJson }\n\n// Type aliases for clarity\ntype JsonCache = Record<string, Promise<PackageJson | null>>\ntype RealPathCache = Record<string, Promise<string>>\ntype ExistsCache = Record<string, Promise<boolean>>\ntype LstatCache = Record<string, Promise<fs.Stats | null>>\ntype PackageCache = Record<string, Promise<Package | null>>\ntype LogSummaryCache = Record<LogMessageByKey, string[]>\n\nexport class ModuleManager {\n  /** Cache for package.json contents (readJson) */\n  readonly json: JsonCache\n  /** Cache for resolved real paths (if symlink, realpath; otherwise resolve) */\n  readonly realPath: RealPathCache\n  /** Cache for file/directory existence checks */\n  readonly exists: ExistsCache\n  /** Cache for lstat results */\n  readonly lstat: LstatCache\n  /** Cache for package lookups (key: \"packageName||fromDir||semverRange\"). Use helper function `versionedCacheKey` */\n  readonly packageData: PackageCache\n  /** For logging purposes, just track all dependencies for each key */\n  readonly logSummary: LogSummaryCache\n\n  private readonly jsonMap: Map<string, PackageJson | null> = new Map()\n  private readonly realPathMap: Map<string, string> = new Map()\n  private readonly existsMap: Map<string, boolean> = new Map()\n  private readonly lstatMap: Map<string, fs.Stats | null> = new Map()\n  private readonly packageDataMap: Map<string, Package | null> = new Map()\n  private readonly logSummaryMap: Map<LogMessageByKey, string[]> = new Map()\n\n  constructor() {\n    this.logSummary = this.createLogSummarySyncProxy()\n\n    this.exists = this.createAsyncProxy(this.existsMap, (p: string) => exists(p))\n    this.json = this.createAsyncProxy(this.jsonMap, (p: string) => fs.readJson(p).catch(() => null))\n    this.lstat = this.createAsyncProxy(this.lstatMap, (p: string) => fs.lstat(p).catch(() => null))\n    this.packageData = this.createAsyncProxy(this.packageDataMap, (p: string) => this.locatePackageVersionFromCacheKey(p).catch(() => null))\n    this.realPath = this.createAsyncProxy(this.realPathMap, async (p: string) => {\n      const filePath = path.resolve(p)\n      const stat = await this.lstat[filePath]\n      return stat?.isSymbolicLink() ? fs.realpath(filePath) : filePath\n    })\n  }\n\n  private createLogSummarySyncProxy(): LogSummaryCache {\n    return new Proxy({} as LogSummaryCache, {\n      get: (_, key: LogMessageByKey) => {\n        if (!this.logSummaryMap.has(key)) {\n          this.logSummaryMap.set(key, [])\n        }\n        return this.logSummaryMap.get(key)!\n      },\n      set: (_, key: LogMessageByKey, value: string[]) => {\n        this.logSummaryMap.set(key, value)\n        return true\n      },\n      has: (_, key: LogMessageByKey) => {\n        return this.logSummaryMap.has(key)\n      },\n      // Add these to make Object.entries() work\n      ownKeys: _ => {\n        return Array.from(this.logSummaryMap.keys())\n      },\n      getOwnPropertyDescriptor: (_, key) => {\n        if (this.logSummaryMap.has(key as LogMessageByKey)) {\n          return {\n            enumerable: true,\n            configurable: true,\n          }\n        }\n        return undefined\n      },\n    })\n  }\n\n  // this allows dot-notation access while still supporting async retrieval\n  // e.g., cache.packageJson[somePath] returns Promise<PackageJson>\n  private createAsyncProxy<T>(map: Map<string, T>, compute: (key: string) => T | Promise<T>): Record<string, Promise<T>> {\n    return new Proxy({} as Record<string, Promise<T>>, {\n      async get(_, key: string) {\n        if (map.has(key)) {\n          return Promise.resolve(map.get(key)!)\n        }\n        return await Promise.resolve(compute(key)).then(value => {\n          map.set(key, value)\n          return value\n        })\n      },\n      set(_, key: string, value: T) {\n        map.set(key, value)\n        return true\n      },\n      has(_, key: string) {\n        return map.has(key)\n      },\n    })\n  }\n\n  versionedCacheKey(pkg: { name: string; path: string; semver?: string }): string {\n    return [pkg.name, pkg.path, pkg.semver || \"\"].join(\"||\")\n  }\n\n  protected async locatePackageVersionFromCacheKey(key: string): Promise<Package | null> {\n    const [name, fromDir, semverRange] = key.split(\"||\")\n    const result = await this.locatePackageVersion({ parentDir: fromDir, pkgName: name, requiredRange: semverRange })\n    if (result == null) {\n      return null\n    }\n    return { ...result, packageDir: await this.realPath[result.packageDir] }\n  }\n\n  public async locatePackageVersion({\n    parentDir,\n    pkgName,\n    requiredRange,\n    skipDownwardSearch = false,\n  }: {\n    /**\n     * The directory to start searching from. Typed optional because pnpm JSON output can omit\n     * the `path` field at runtime even when the TypeScript type says `string`. An undefined\n     * parentDir is treated as \"package not found\" rather than a crash.\n     */\n    parentDir?: string\n    /**\n     * The package name to locate. Typed optional for the same reason as parentDir: the pnpm\n     * list JSON can omit `name`/`from` fields (e.g. when the root package.json has no name),\n     * producing an undefined pkgName at runtime despite the TypeScript type.\n     */\n    pkgName?: string\n    requiredRange?: string\n    /**\n     * When true, skip the BFS-based `downwardSearch`. Use for layouts that are guaranteed flat\n     * (e.g. pnpm's `.pnpm` virtual store), where the downward walk burns thousands of `readdir`\n     * / `lstat` calls and finds nothing.\n     */\n    skipDownwardSearch?: boolean\n  }): Promise<Package | null> {\n    if (!parentDir || !pkgName) {\n      return null\n    }\n\n    const found = await this.searchForPackage(parentDir, pkgName, requiredRange, skipDownwardSearch)\n    if (found) {\n      return found\n    }\n\n    // Second pass: find any installed version of the package when the declared-range search\n    // returns nothing. This handles package manager `overrides` (Bun, npm, pnpm, Yarn) that\n    // resolve a transitive dependency to a version intentionally outside its declared range.\n    // File-system results are already cached, so this pass costs only JS overhead.\n    if (requiredRange) {\n      const overrideResult = await this.searchForPackage(parentDir, pkgName, undefined, skipDownwardSearch)\n      if (overrideResult) {\n        log.debug(\n          { pkg: pkgName, declared: requiredRange, installed: overrideResult.packageJson.version },\n          \"accepting installed package version that doesn't satisfy the declared range\"\n        )\n        this.logSummary[LogMessageByKey.PKG_VERSION_OVERRIDDEN].push(`${pkgName}@${overrideResult.packageJson.version} (declared ${requiredRange})`)\n        return overrideResult\n      }\n    }\n\n    return null\n  }\n\n  private async searchForPackage(parentDir: string, pkgName: string, requiredRange: string | undefined, skipDownwardSearch: boolean): Promise<Package | null> {\n    // 1) check direct parent node_modules/pkgName first\n    const direct = path.join(path.resolve(parentDir), \"node_modules\", pkgName, \"package.json\")\n    if (await this.exists[direct]) {\n      const json = await this.json[direct]\n      if (json && this.semverSatisfies(json.version, requiredRange)) {\n        return { packageDir: path.dirname(direct), packageJson: json }\n      }\n    }\n\n    // 2) upward hoisted search, then 3) downward non-hoisted search\n    const upward = await this.upwardSearch(parentDir, pkgName, requiredRange)\n    if (upward) {\n      return upward\n    }\n    if (skipDownwardSearch) {\n      return null\n    }\n    return (await this.downwardSearch(parentDir, pkgName, requiredRange)) || null\n  }\n\n  private semverSatisfies(found: string, range?: string): boolean {\n    if (isEmptyOrSpaces(range) || range === \"*\") {\n      return true\n    }\n\n    if (range === found) {\n      return true\n    }\n\n    if (semver.validRange(range) == null) {\n      // ignore, we can't verify non-semver ranges\n      // e.g. git urls, file:, patch:, etc. Example:\n      // \"@ai-sdk/google\": \"patch:@ai-sdk/google@npm%3A2.0.43#~/.yarn/patches/@ai-sdk-google-npm-2.0.43-689ed559b3.patch\"\n      log.debug({ found, range }, \"unable to validate semver version range, assuming match\")\n      return true\n    }\n\n    try {\n      return semver.satisfies(found, range)\n    } catch {\n      // fallback: simple equality or basic prefix handling (^, ~)\n      if (range.startsWith(\"^\") || range.startsWith(\"~\")) {\n        const r = range.slice(1)\n        return r === found\n      }\n      // if range is like \"8.x\" or \"8.*\" match major\n      const m = range.match(/^(\\d+)[.(*|x)]*/)\n      const fm = found.match(/^(\\d+)\\./)\n      if (m && fm) {\n        return m[1] === fm[1]\n      }\n      return false\n    }\n  }\n\n  /**\n   * Upward search (hoisted)\n   */\n  private async upwardSearch(parentDir: string, pkgName: string, requiredRange?: string): Promise<Package | null> {\n    let current = path.resolve(parentDir)\n    const root = path.parse(current).root\n    while (true) {\n      const candidate = path.join(current, \"node_modules\", pkgName, \"package.json\")\n      if (await this.exists[candidate]) {\n        const json = await this.json[candidate]\n        if (json && this.semverSatisfies(json.version, requiredRange)) {\n          return { packageDir: path.dirname(candidate), packageJson: json }\n        }\n        // otherwise keep searching upward (we may find a different hoisted version)\n      }\n      if (current === root) {\n        break\n      }\n      const parent = path.dirname(current)\n      if (parent === current) {\n        break\n      }\n      current = parent\n    }\n    return null\n  }\n\n  /**\n   * Breadth-first downward search from parentDir/node_modules\n   * Looks for node_modules/\\*\\/node_modules/pkgName (and deeper)\n   */\n  private async downwardSearch(parentDir: string, pkgName: string, requiredRange?: string, maxExplored = 2000, maxDepth = 6): Promise<Package | null> {\n    const start = path.join(path.resolve(parentDir), \"node_modules\")\n    if (!(await this.exists[start]) || !(await this.lstat[start])?.isDirectory()) {\n      return null\n    }\n\n    const visited = new Set<string>()\n    const queue: Array<{ dir: string; depth: number }> = [{ dir: start, depth: 0 }]\n    let explored = 0\n\n    while (queue.length > 0) {\n      const { dir, depth } = queue.shift()!\n      if (explored++ > maxExplored) {\n        break\n      }\n      if (depth > maxDepth) {\n        continue\n      }\n      let entries: string[]\n      try {\n        entries = await fs.readdir(dir)\n      } catch {\n        continue\n      }\n      for (const entry of entries) {\n        if (entry.startsWith(\".\")) {\n          continue\n        }\n        const entryPath = path.join(dir, entry)\n        if (entry.startsWith(\"@\")) {\n          const found = await this.processScope(entryPath, pkgName, requiredRange, depth, visited, queue)\n          if (found) {\n            return found\n          }\n          continue\n        }\n        const found = await this.processEntry(entryPath, pkgName, requiredRange, depth, visited, queue)\n        if (found) {\n          return found\n        }\n      }\n    }\n\n    return null\n  }\n\n  /** Handle a non-scoped entry directory inside a node_modules folder. */\n  private async processEntry(\n    entryPath: string,\n    pkgName: string,\n    requiredRange: string | undefined,\n    depth: number,\n    visited: Set<string>,\n    queue: Array<{ dir: string; depth: number }>\n  ): Promise<Package | null> {\n    const stat = await this.lstat[entryPath]\n    if (!stat?.isDirectory()) {\n      return null\n    }\n\n    // Check entry/node_modules/pkgName (nested dep under a package)\n    const nested = path.join(entryPath, \"node_modules\", pkgName, \"package.json\")\n    if (await this.exists[nested]) {\n      const json = await this.json[nested]\n      if (json && this.semverSatisfies(json.version, requiredRange)) {\n        return { packageDir: path.dirname(nested), packageJson: json }\n      }\n    }\n\n    // Check entry/pkgName directly (some flat layouts place pkgName as a sibling)\n    const direct = path.join(entryPath, pkgName, \"package.json\")\n    if (await this.exists[direct]) {\n      const json = await this.json[direct]\n      if (json && this.semverSatisfies(json.version, requiredRange)) {\n        return { packageDir: path.dirname(direct), packageJson: json }\n      }\n    }\n\n    await this.enqueueIfExists(path.join(entryPath, \"node_modules\"), depth, visited, queue)\n    return null\n  }\n\n  /** Handle a scoped-package directory (@scope) inside a node_modules folder. */\n  private async processScope(\n    scopePath: string,\n    pkgName: string,\n    requiredRange: string | undefined,\n    depth: number,\n    visited: Set<string>,\n    queue: Array<{ dir: string; depth: number }>\n  ): Promise<Package | null> {\n    if (!(await this.exists[scopePath]) || !(await this.lstat[scopePath])?.isDirectory()) {\n      return null\n    }\n    let scopeEntries: string[]\n    try {\n      scopeEntries = await fs.readdir(scopePath)\n    } catch {\n      return null\n    }\n    for (const sc of scopeEntries) {\n      const scPath = path.join(scopePath, sc)\n      const candidatePkgJson = path.join(scPath, \"node_modules\", pkgName, \"package.json\")\n      if (await this.exists[candidatePkgJson]) {\n        const json = await this.json[candidatePkgJson]\n        if (json && this.semverSatisfies(json.version, requiredRange)) {\n          return { packageDir: path.dirname(candidatePkgJson), packageJson: json }\n        }\n      }\n      await this.enqueueIfExists(path.join(scPath, \"node_modules\"), depth, visited, queue)\n    }\n    return null\n  }\n\n  /** Enqueue a node_modules directory for BFS only if it exists on disk and hasn't been visited. */\n  private async enqueueIfExists(nmPath: string, depth: number, visited: Set<string>, queue: Array<{ dir: string; depth: number }>): Promise<void> {\n    if (!visited.has(nmPath) && (await this.exists[nmPath]) && (await this.lstat[nmPath])?.isDirectory()) {\n      visited.add(nmPath)\n      queue.push({ dir: nmPath, depth: depth + 1 })\n    }\n  }\n}\n"]}

package/out/node-module-collector/nodeModulesCollector.d.ts

@@ -106,8 +106,9 @@ export declare abstract class NodeModulesCollector<ProdDepType extends Dependenc
      * Executes a command and streams its output to a file.
      *
      * Spawns a child process to execute the specified command with arguments, capturing stdout
-     * to a file. Handles Windows-specific quirks by wrapping .cmd files in a temporary .bat file
-     * when necessary. Enables corepack strict mode by default but allows process.env overrides.
+     * to a file. On Windows, wraps the invocation in `powershell.exe -EncodedCommand` (UTF-16LE
+     * base64) to avoid spawning `.cmd` shims directly and to eliminate shell-injection surface area.
+     * Enables corepack strict mode by default but allows process.env overrides.
      *
      * Special handling for `npm list` exit code 1, which is expected in certain scenarios.
      *
@@ -119,10 +120,18 @@ export declare abstract class NodeModulesCollector<ProdDepType extends Dependenc
      * @throws {Error} If the child process spawn fails or exits with a non-zero code
      */
     protected streamCollectorCommandToFile(command: string, args: string[], cwd: string, tempOutputFile: string): Promise<void>;
-    /**
-     * Windows-only. Wraps .cmd files and executables at paths containing spaces in a temporary .bat
-     * file so that cmd.exe spawns them correctly. Returns the original command/args unchanged when
-     * no wrapping is required. Must only be called on win32.
-     */
-    private resolveWindowsCommand;
 }
+/**
+ * Build the argv for invoking a Windows command through `powershell.exe -EncodedCommand`.
+ *
+ * Each token is wrapped in a PowerShell single-quoted string (with embedded single quotes doubled),
+ * so no character is interpreted by a shell. The script:
+ *   - pins `[Console]::OutputEncoding` to UTF-8 *without* a BOM so the JSON dependency tree is not
+ *     corrupted by the console's OEM code page (and no BOM is prepended to break `JSON.parse`),
+ *   - invokes the command via the call operator `&`,
+ *   - re-emits the command's own exit code via `exit $LASTEXITCODE` (e.g. `npm list` returns 1 in
+ *     expected scenarios, which the caller's shouldIgnore logic relies on).
+ *
+ * The whole script is base64-encoded as UTF-16LE per PowerShell's `-EncodedCommand` contract.
+ */
+export declare function buildPowerShellEncodedArgs(command: string, args: string[]): string[];

package/out/node-module-collector/nodeModulesCollector.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NodeModulesCollector = void 0;
+exports.buildPowerShellEncodedArgs = buildPowerShellEncodedArgs;
 const builder_util_1 = require("builder-util");
 const childProcess = require("child_process");
-const crypto_1 = require("crypto");
 const fs = require("fs-extra");
 const fs_extra_1 = require("fs-extra");
 const lazy_val_1 = require("lazy-val");
@@ -24,7 +24,7 @@ class NodeModulesCollector {
             const command = (0, packageManager_1.getPackageManagerCommand)(manager);
             const config = (await this.asyncExec(command, ["config", "list"])).stdout;
             if (config == null) {
-                builder_util_1.log.debug({ manager }, "unable to determine if node_modules are hoisted: no config output. falling back to hoisted mode");
+                builder_util_1.log.debug({ manager }, "unable to determine node-linker setting; assuming non-hoisted (virtual store) layout");
                 return false;
             }
             const lines = Object.fromEntries(config.split("\n").map(line => line.split("=").map(s => s.trim())));
@@ -82,7 +82,7 @@ class NodeModulesCollector {
             interval: 2000,
             backoff: 2000,
             shouldRetry: async (error) => {
-                var _a;
+                var _a, _b;
                 const fields = { error: error.message, tempOutputFile, cwd: this.rootDir, packageManager: pm };
                 if (!(await (0, builder_util_1.exists)(tempOutputFile))) {
                     builder_util_1.log.debug(fields, "dependency tree output file missing, retrying");
@@ -104,7 +104,8 @@ class NodeModulesCollector {
                 else {
                     fields.content = fileContent;
                 }
-                if ((_a = error.message) === null || _a === void 0 ? void 0 : _a.includes("Unexpected end of JSON input")) {
+                // Both indicate truncated/polluted PM output (a transient that re-running the command clears).
+                if (((_a = error.message) === null || _a === void 0 ? void 0 : _a.includes("Unexpected end of JSON input")) || ((_b = error.message) === null || _b === void 0 ? void 0 : _b.includes("No JSON content found in output"))) {
                     builder_util_1.log.debug(fields, "JSON parse error in dependency tree, retrying");
                     return true;
                 }
@@ -297,8 +298,9 @@ class NodeModulesCollector {
      * Executes a command and streams its output to a file.
      *
      * Spawns a child process to execute the specified command with arguments, capturing stdout
-     * to a file. Handles Windows-specific quirks by wrapping .cmd files in a temporary .bat file
-     * when necessary. Enables corepack strict mode by default but allows process.env overrides.
+     * to a file. On Windows, wraps the invocation in `powershell.exe -EncodedCommand` (UTF-16LE
+     * base64) to avoid spawning `.cmd` shims directly and to eliminate shell-injection surface area.
+     * Enables corepack strict mode by default but allows process.env overrides.
      *
      * Special handling for `npm list` exit code 1, which is expected in certain scenarios.
      *
@@ -310,46 +312,63 @@ class NodeModulesCollector {
      * @throws {Error} If the child process spawn fails or exits with a non-zero code
      */
     async streamCollectorCommandToFile(command, args, cwd, tempOutputFile) {
-        // Capture execName from the original command before resolveWindowsCommand may rewrite it to
-        // cmd.exe — shouldIgnore must key off the original invocation (e.g. "npm", not "cmd").
+        // Derive execName from the original command so the npm-list shouldIgnore check below keys off the
+        // real invocation (e.g. "npm"), not the "powershell" wrapper we spawn on Windows.
         const execName = path.basename(command, path.extname(command));
-        if (process.platform === "win32") {
-            const resolved = await this.resolveWindowsCommand(command, args);
-            command = resolved.command;
-            args = resolved.args;
-        }
-        const isWindows = process.platform === "win32";
-        // shell: true is required on Windows — see https://github.com/electron-userland/electron-builder/issues/9488
-        // On non-Windows, shell:false means args are passed directly to the process with no shell
-        // interpretation, so the metacharacter guard is only necessary on Windows.
-        if (isWindows) {
-            // Guard against cmd.exe metacharacters. Parentheses are intentionally excluded because they
-            // appear in legitimate Windows paths (e.g. "C:\Program Files (x86)").
-            const SHELL_INJECTION_RE = /[;&|`${}[\]<>!%^]/;
-            for (const arg of args) {
-                if (SHELL_INJECTION_RE.test(arg)) {
-                    throw new Error(`Refusing to spawn "${command}": argument "${arg}" contains shell metacharacters. Possible injection attempt.`);
-                }
-            }
-        }
+        // On Windows the package-manager command is typically a `.cmd` shim (npm.cmd/pnpm.cmd/yarn.cmd),
+        // which Node can no longer spawn directly (CVE-2024-27980). Rather than spawn with `shell: true` —
+        // which emits the DEP0190 "args with shell" deprecation warning and forces manual metacharacter
+        // escaping — wrap the invocation in a single PowerShell `-EncodedCommand`. The base64 (UTF-16LE)
+        // payload sidesteps every shell-quoting layer, and `powershell.exe` is a real executable we spawn
+        // directly with no shell. See buildPowerShellEncodedArgs for the UTF-8 / exit-code handling.
+        const [spawnCommand, spawnArgs] = process.platform === "win32" ? ["powershell.exe", buildPowerShellEncodedArgs(command, args)] : [command, args];
         await new Promise((resolve, reject) => {
             const outStream = (0, fs_extra_1.createWriteStream)(tempOutputFile);
-            const child = childProcess.spawn(command, args, {
+            const child = childProcess.spawn(spawnCommand, spawnArgs, {
                 cwd,
                 // Package manager invocations do not need signing/publishing credentials.
                 env: { COREPACK_ENABLE_STRICT: "0", ...(0, builder_util_1.stripSensitiveEnvVars)(process.env) },
-                shell: isWindows, // shell: true is required on Windows — see https://github.com/electron-userland/electron-builder/issues/9488
             });
             let stderr = "";
+            // The process can close before all piped stdout has been flushed to disk. Resolving on the
+            // child's "close" alone races the write stream and lets the caller read a TRUNCATED file
+            // (manifesting as "No JSON content found in output"). Gate the settle on BOTH the child exit
+            // (for the code/stderr) and the write stream's "finish" (all bytes flushed).
+            let exitCode = null;
+            let childClosed = false;
+            let streamFinished = false;
+            let settled = false;
+            // `pipe` ends `outStream` when stdout EOFs, which triggers its "finish" once flushed.
             child.stdout.pipe(outStream);
             child.stderr.on("data", chunk => {
                 stderr += chunk.toString();
             });
-            child.on("error", err => {
-                reject(new Error(`Node module collector spawn (${command} ${JSON.stringify(args)}) failed: ${err.message}`));
-            });
-            child.on("close", code => {
-                outStream.close();
+            const fail = (err) => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                // Best-effort cleanup: stop the child and close the stream so we don't
+                // waste CPU writing to a broken fd after rejection.
+                try {
+                    child.kill();
+                }
+                catch {
+                    // ignore
+                }
+                try {
+                    outStream.destroy();
+                }
+                catch {
+                    // ignore
+                }
+                reject(err);
+            };
+            const settle = () => {
+                if (settled || !childClosed || !streamFinished) {
+                    return;
+                }
+                const code = exitCode;
                 // https://github.com/npm/npm/issues/17624
                 const shouldIgnore = code === 1 && "npm" === execName.toLowerCase() && args.includes("list");
                 if (shouldIgnore) {
@@ -365,38 +384,45 @@ class NodeModulesCollector {
                         this.cache.logSummary[moduleManager_1.LogMessageByKey.PKG_COLLECTOR_OUTPUT].push(stderr);
                     }
                 }
+                settled = true;
                 const shouldResolve = code === 0 || shouldIgnore;
                 return shouldResolve ? resolve() : reject(new Error(`Node module collector process exited with code ${code}:\n${stderr}`));
+            };
+            outStream.on("error", err => fail(new Error(`Node module collector failed writing output (${command}): ${err.message}`)));
+            outStream.on("finish", () => {
+                streamFinished = true;
+                settle();
+            });
+            child.on("error", err => {
+                fail(new Error(`Node module collector spawn (${command} ${JSON.stringify(args)}) failed: ${err.message}`));
+            });
+            child.on("close", code => {
+                exitCode = code;
+                childClosed = true;
+                settle();
             });
         });
     }
-    /**
-     * Windows-only. Wraps .cmd files and executables at paths containing spaces in a temporary .bat
-     * file so that cmd.exe spawns them correctly. Returns the original command/args unchanged when
-     * no wrapping is required. Must only be called on win32.
-     */
-    async resolveWindowsCommand(command, args) {
-        if (process.platform !== "win32") {
-            throw new Error("resolveWindowsCommand should only be called on Windows platforms");
-        }
-        const ext = path.extname(command).toLowerCase();
-        // Wrap .cmd files and any Windows executable path that contains spaces (e.g. extensionless
-        // shims from tools like Volta installed at "C:\Program Files\Volta\") to ensure the path is
-        // quoted correctly when passed to `spawn(..., { shell: true })`.
-        const needsWrap = ext === ".cmd" || command.includes(" ");
-        if (!needsWrap) {
-            return { command, args };
-        }
-        const execName = path.basename(command, ext);
-        const tempBatFile = await this.tempDirManager.getTempFile({
-            prefix: execName + "-" + (0, crypto_1.randomBytes)(8).toString("hex"),
-            suffix: ".bat",
-        });
-        const escapedCommand = command.replace(/"/g, `""`);
-        const batScript = `@echo off\r\n"${escapedCommand}" %*\r\n`; // <-- CRLF required for .bat
-        await fs.writeFile(tempBatFile, batScript, { encoding: "utf8", mode: 0o600 });
-        return { command: "cmd.exe", args: ["/c", `"${tempBatFile}"`, ...args] };
-    }
 }
 exports.NodeModulesCollector = NodeModulesCollector;
+/**
+ * Build the argv for invoking a Windows command through `powershell.exe -EncodedCommand`.
+ *
+ * Each token is wrapped in a PowerShell single-quoted string (with embedded single quotes doubled),
+ * so no character is interpreted by a shell. The script:
+ *   - pins `[Console]::OutputEncoding` to UTF-8 *without* a BOM so the JSON dependency tree is not
+ *     corrupted by the console's OEM code page (and no BOM is prepended to break `JSON.parse`),
+ *   - invokes the command via the call operator `&`,
+ *   - re-emits the command's own exit code via `exit $LASTEXITCODE` (e.g. `npm list` returns 1 in
+ *     expected scenarios, which the caller's shouldIgnore logic relies on).
+ *
+ * The whole script is base64-encoded as UTF-16LE per PowerShell's `-EncodedCommand` contract.
+ */
+function buildPowerShellEncodedArgs(command, args) {
+    const psQuote = (value) => `'${value.replace(/'/g, "''")}'`;
+    const invocation = ["&", psQuote(command), ...args.map(psQuote)].join(" ");
+    const script = `[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new($false); ${invocation}; exit $LASTEXITCODE`;
+    const encoded = Buffer.from(script, "utf16le").toString("base64");
+    return ["-NoProfile", "-NonInteractive", "-EncodedCommand", encoded];
+}
 //# sourceMappingURL=nodeModulesCollector.js.map