app-builder-lib 27.0.0-alpha.2 → 27.0.0-alpha.4

package/dist/node-module-collector/nodeModulesCollector.js

@@ -1,12 +1,12 @@
 import { exists, log, retry, stripSensitiveEnvVars } from "builder-util";
-import * as childProcess from "child_process";
-import { createWriteStream } from "node:fs";
 import _fsExtra from "fs-extra";
 import { Lazy } from "lazy-val";
 import * as path from "path";
 import { hoist } from "./hoist.js";
 import { LogMessageByKey, ModuleManager } from "./moduleManager.js";
 import { getPackageManagerCommand } from "./packageManager.js";
+import { streamSpawnToFile } from "../util/streamSpawnToFile.js";
+import { isPackageCompatible } from "../util/archCompatibility.js";
 export class NodeModulesCollector {
     constructor(rootDir, tempDirManager) {
         this.rootDir = rootDir;
@@ -42,7 +42,7 @@ export class NodeModulesCollector {
      * 5. Hoisting the dependencies to their final locations
      * 6. Resolving and returning module information
      */
-    async getNodeModules({ packageName }) {
+    async getNodeModules({ packageName, archFilter }) {
         const tree = await this.getDependenciesTree(this.installOptions.manager);
         await this.collectAllDependencies(tree, packageName);
         const realTree = this.getTreeFromWorkspaces(tree, packageName);
@@ -50,7 +50,7 @@ export class NodeModulesCollector {
         const hoisterResult = hoist(this.transformToHoisterTree(this.productionGraph, packageName), {
             check: log.isDebugEnabled,
         });
-        await this._getNodeModules(hoisterResult.dependencies, this.nodeModules);
+        await this._getNodeModules(hoisterResult.dependencies, this.nodeModules, archFilter);
         log.debug({ packageName, depCount: this.nodeModules.length }, "node modules collection complete");
         return { nodeModules: this.nodeModules, logSummary: this.cache.logSummary };
     }
@@ -238,7 +238,7 @@ export class NodeModulesCollector {
         }
         return node;
     }
-    async _getNodeModules(dependencies, result) {
+    async _getNodeModules(dependencies, result, archFilter) {
         if (dependencies.size === 0) {
             return;
         }
@@ -258,15 +258,28 @@ export class NodeModulesCollector {
                 this.logMissingDependency(key);
                 continue;
             }
+            const dir = await this.cache.realPath[p];
+            // Drop packages whose declared `cpu`/`os` is incompatible with the target arch/platform (and their
+            // subtree). npm/pnpm install only the host's platform-specific optional packages, so without this an
+            // arm64-only binary (e.g. `@esbuild/darwin-arm64`) would be bundled into the x64 build too — and into
+            // both slices of a universal build, which `@electron/universal` then refuses to merge. Reuses the
+            // memoized `package.json` cache populated during collection.
+            if (archFilter != null) {
+                const pkgJson = await this.cache.json[path.join(dir, "package.json")];
+                if (pkgJson != null && !isPackageCompatible(pkgJson, archFilter.cpu, archFilter.os)) {
+                    this.cache.logSummary[LogMessageByKey.PKG_INCOMPATIBLE_PLATFORM].push(key);
+                    continue;
+                }
+            }
             const node = {
                 name: d.name,
                 version: reference,
-                dir: await this.cache.realPath[p],
+                dir,
             };
             result.push(node);
             if (d.dependencies.size > 0) {
                 node.dependencies = [];
-                await this._getNodeModules(d.dependencies, node.dependencies);
+                await this._getNodeModules(d.dependencies, node.dependencies, archFilter);
             }
         }
         result.sort((a, b) => a.name.localeCompare(b.name));
@@ -289,133 +302,50 @@ export class NodeModulesCollector {
         }
     }
     /**
-     * Executes a command and streams its output to a file.
-     *
-     * Spawns a child process to execute the specified command with arguments, capturing stdout
-     * to a file. On Windows, wraps the invocation in `powershell.exe -EncodedCommand` (UTF-16LE
-     * base64) to avoid spawning `.cmd` shims directly and to eliminate shell-injection surface area.
-     * Enables corepack strict mode by default but allows process.env overrides.
+     * Executes a package-manager command and streams its stdout to a file.
      *
-     * Special handling for `npm list` exit code 1, which is expected in certain scenarios.
+     * Delegates the spawn/stream/flush mechanics (including the Windows `powershell.exe -EncodedCommand`
+     * wrapping) to {@link streamSpawnToFile}, and layers on the collector-specific interpretation of the
+     * result: corepack is silenced for these invocations, `npm list` exit code 1 is tolerated, and any
+     * stderr is surfaced as a collector warning only when the exit code is genuinely unexpected.
      *
      * @param command - The command to execute
      * @param args - Array of command-line arguments
      * @param cwd - The working directory to execute the command in
      * @param tempOutputFile - The path to the temporary file where stdout will be written
      * @returns Promise that resolves when the command completes successfully or rejects if it fails
-     * @throws {Error} If the child process spawn fails or exits with a non-zero code
+     * @throws {Error} If the child process spawn fails or exits with a non-zero, unexpected code
      */
     async streamCollectorCommandToFile(command, args, cwd, tempOutputFile) {
         // Derive execName from the original command so the npm-list shouldIgnore check below keys off the
-        // real invocation (e.g. "npm"), not the "powershell" wrapper we spawn on Windows.
+        // real invocation (e.g. "npm"), not the "powershell" wrapper streamSpawnToFile uses on Windows.
         const execName = path.basename(command, path.extname(command));
-        // On Windows the package-manager command is typically a `.cmd` shim (npm.cmd/pnpm.cmd/yarn.cmd),
-        // which Node can no longer spawn directly (CVE-2024-27980). Rather than spawn with `shell: true` —
-        // which emits the DEP0190 "args with shell" deprecation warning and forces manual metacharacter
-        // escaping — wrap the invocation in a single PowerShell `-EncodedCommand`. The base64 (UTF-16LE)
-        // payload sidesteps every shell-quoting layer, and `powershell.exe` is a real executable we spawn
-        // directly with no shell. See buildPowerShellEncodedArgs for the UTF-8 / exit-code handling.
-        const [spawnCommand, spawnArgs] = process.platform === "win32" ? ["powershell.exe", buildPowerShellEncodedArgs(command, args)] : [command, args];
-        await new Promise((resolve, reject) => {
-            const outStream = createWriteStream(tempOutputFile);
-            const child = childProcess.spawn(spawnCommand, spawnArgs, {
-                cwd,
-                // Package manager invocations do not need signing/publishing credentials.
-                env: { COREPACK_ENABLE_STRICT: "0", ...stripSensitiveEnvVars(process.env) },
-            });
-            let stderr = "";
-            // The process can close before all piped stdout has been flushed to disk. Resolving on the
-            // child's "close" alone races the write stream and lets the caller read a TRUNCATED file
-            // (manifesting as "No JSON content found in output"). Gate the settle on BOTH the child exit
-            // (for the code/stderr) and the write stream's "finish" (all bytes flushed).
-            let exitCode = null;
-            let childClosed = false;
-            let streamFinished = false;
-            let settled = false;
-            // `pipe` ends `outStream` when stdout EOFs, which triggers its "finish" once flushed.
-            child.stdout.pipe(outStream);
-            child.stderr.on("data", chunk => {
-                stderr += chunk.toString();
-            });
-            const fail = (err) => {
-                if (settled) {
-                    return;
-                }
-                settled = true;
-                // Best-effort cleanup: stop the child and close the stream so we don't
-                // waste CPU writing to a broken fd after rejection.
-                try {
-                    child.kill();
-                }
-                catch {
-                    // ignore
-                }
-                try {
-                    outStream.destroy();
-                }
-                catch {
-                    // ignore
-                }
-                reject(err);
-            };
-            const settle = () => {
-                if (settled || !childClosed || !streamFinished) {
-                    return;
-                }
-                const code = exitCode;
-                // https://github.com/npm/npm/issues/17624
-                const shouldIgnore = code === 1 && "npm" === execName.toLowerCase() && args.includes("list");
-                if (shouldIgnore) {
-                    log.debug(null, "`npm list` returned non-zero exit code, but it MIGHT be expected (https://github.com/npm/npm/issues/17624). Check stderr for details.");
-                }
-                if (stderr.length > 0) {
-                    log.debug({ stderr }, "note: there was node module collector output on stderr");
-                    // Only surface stderr as a user-visible warning when the exit code itself is unexpected.
-                    // When shouldIgnore is true (npm list exit code 1) the stderr is an anticipated side
-                    // effect of package-manager features like yarn resolutions or npm overrides that cause
-                    // npm to report ELSPROBLEMS for aliased packages it considers "invalid".
-                    if (!shouldIgnore) {
-                        this.cache.logSummary[LogMessageByKey.PKG_COLLECTOR_OUTPUT].push(stderr);
-                    }
-                }
-                settled = true;
-                const shouldResolve = code === 0 || shouldIgnore;
-                return shouldResolve ? resolve() : reject(new Error(`Node module collector process exited with code ${code}:\n${stderr}`));
-            };
-            outStream.on("error", err => fail(new Error(`Node module collector failed writing output (${command}): ${err.message}`)));
-            outStream.on("finish", () => {
-                streamFinished = true;
-                settle();
-            });
-            child.on("error", err => {
-                fail(new Error(`Node module collector spawn (${command} ${JSON.stringify(args)}) failed: ${err.message}`));
-            });
-            child.on("close", code => {
-                exitCode = code;
-                childClosed = true;
-                settle();
-            });
+        const { code, stderr } = await streamSpawnToFile(command, args, cwd, tempOutputFile, {
+            // Package manager invocations do not need signing/publishing credentials. Silence corepack:
+            // strict=0 so a project's `packageManager` pin can't abort our read-only queries, and the
+            // download prompt/notice off so corepack doesn't flood stdout/stderr with activation chatter.
+            ...stripSensitiveEnvVars(process.env),
+            COREPACK_ENABLE_STRICT: "0",
+            COREPACK_ENABLE_DOWNLOAD_PROMPT: "0",
         });
+        // https://github.com/npm/npm/issues/17624
+        const shouldIgnore = code === 1 && "npm" === execName.toLowerCase() && args.includes("list");
+        if (shouldIgnore) {
+            log.debug(null, "`npm list` returned non-zero exit code, but it MIGHT be expected (https://github.com/npm/npm/issues/17624). Check stderr for details.");
+        }
+        if (stderr.length > 0) {
+            log.debug({ stderr }, "note: there was node module collector output on stderr");
+            // Only surface stderr as a user-visible warning when the exit code itself is unexpected.
+            // When shouldIgnore is true (npm list exit code 1) the stderr is an anticipated side
+            // effect of package-manager features like yarn resolutions or npm overrides that cause
+            // npm to report ELSPROBLEMS for aliased packages it considers "invalid".
+            if (!shouldIgnore) {
+                this.cache.logSummary[LogMessageByKey.PKG_COLLECTOR_OUTPUT].push(stderr);
+            }
+        }
+        if (code !== 0 && !shouldIgnore) {
+            throw new Error(`Node module collector process exited with code ${code}:\n${stderr}`);
+        }
     }
 }
-/**
- * Build the argv for invoking a Windows command through `powershell.exe -EncodedCommand`.
- *
- * Each token is wrapped in a PowerShell single-quoted string (with embedded single quotes doubled),
- * so no character is interpreted by a shell. The script:
- *   - pins `[Console]::OutputEncoding` to UTF-8 *without* a BOM so the JSON dependency tree is not
- *     corrupted by the console's OEM code page (and no BOM is prepended to break `JSON.parse`),
- *   - invokes the command via the call operator `&`,
- *   - re-emits the command's own exit code via `exit $LASTEXITCODE` (e.g. `npm list` returns 1 in
- *     expected scenarios, which the caller's shouldIgnore logic relies on).
- *
- * The whole script is base64-encoded as UTF-16LE per PowerShell's `-EncodedCommand` contract.
- */
-export function buildPowerShellEncodedArgs(command, args) {
-    const psQuote = (value) => `'${value.replace(/'/g, "''")}'`;
-    const invocation = ["&", psQuote(command), ...args.map(psQuote)].join(" ");
-    const script = `[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new($false); ${invocation}; exit $LASTEXITCODE`;
-    const encoded = Buffer.from(script, "utf16le").toString("base64");
-    return ["-NoProfile", "-NonInteractive", "-EncodedCommand", encoded];
-}
 //# sourceMappingURL=nodeModulesCollector.js.map

package/dist/node-module-collector/nodeModulesCollector.js.map

@@ -1 +1 @@
-{"version":3,"file":"nodeModulesCollector.js","sourceRoot":"","sources":["../../src/node-module-collector/nodeModulesCollector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAU,MAAM,cAAc,CAAA;AAChF,OAAO,KAAK,YAAY,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,KAAK,EAAwC,MAAM,YAAY,CAAA;AACxE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACnE,OAAO,EAAE,wBAAwB,EAAM,MAAM,qBAAqB,CAAA;AAGlE,MAAM,OAAgB,oBAAoB;IAsBxC,YACqB,OAAe,EACjB,cAAsB;QADpB,YAAO,GAAP,OAAO,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAQ;QAvBxB,gBAAW,GAAqB,EAAE,CAAA;QAChC,oBAAe,GAA6B,IAAI,GAAG,EAAE,CAAA;QACrD,oBAAe,GAAoB,EAAE,CAAA;QACrC,UAAK,GAAkB,IAAI,aAAa,EAAE,CAAA;QAEnD,cAAS,GAAG,IAAI,IAAI,CAAU,KAAK,IAAI,EAAE;YACjD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,CAAA;YACvC,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;YACjD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YACzE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,sFAAsF,CAAC,CAAA;gBAC9G,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACpG,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAA;gBAClD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAA;IAKC,CAAC;IAEJ;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,EAAE,WAAW,EAA2B;QAIlE,MAAM,IAAI,GAAgB,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QAErF,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAgB,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAC3E,MAAM,IAAI,CAAC,gCAAgC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QAElE,MAAM,aAAa,GAAkB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE;YACzG,KAAK,EAAE,GAAG,CAAC,cAAc;SAC1B,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;QAExE,GAAG,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAA;QAEjG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAA;IAC7E,CAAC;IAWD;;;;;;OAMG;IACO,KAAK,CAAC,mBAAmB,CAAC,EAAM;QACxC,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QAE3B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;YAC3D,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,EAAE,aAAa;SACtB,CAAC,CAAA;QAEF,OAAO,KAAK,CACV,KAAK,IAAI,EAAE;YACT,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;YACpF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YACjF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC7E,OAAO,MAAM,CAAA;QACf,CAAC,EACD;YACE,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,KAAK,EAAE,KAAU,EAAE,EAAE;gBAChC,MAAM,MAAM,GAA2B,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,CAAA;gBAEtH,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;oBACpC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAA;oBAClE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;gBACjF,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAA;gBAExD,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACpC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAA;oBAChE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,uFAAuF;gBACvF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACrC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;gBACpD,IAAI,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAC9D,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC5D,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,OAAO,GAAG,WAAW,CAAA;gBAC9B,CAAC;gBAED,+FAA+F;gBAC/F,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,8BAA8B,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,iCAAiC,CAAC,EAAE,CAAC;oBAC1H,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAA;oBAClE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAA;gBACpD,OAAO,KAAK,CAAA;YACd,CAAC;SACF,CACF,CAAA;IACH,CAAC;IAED;;;QAGI;IACM,qBAAqB,CAAC,WAAmB;QACjD,OAAO,IAAI,CAAC,6BAA6B,CAAc,WAAW,CAAC,CAAA;IACrE,CAAC;IAES,6BAA6B,CAAI,WAAmB;QAC5D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,CAAC;YACH,mHAAmH;YACnH,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,+HAA+H;QAE/H,+CAA+C;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3D,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA,CAAC,4CAA4C;QAEnG,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/C,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,mBAAmB;YACrB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,CAAC;IAES,QAAQ,CAAC,GAAmD;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QACjD,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,KAAK,GAAG,IAAI,GAAG,EAAE,CAAA;IACrD,CAAC;IAED,6EAA6E;IAC7E,iFAAiF;IACvE,uBAAuB,CAAC,GAAW,EAAE,GAAgB;QAC7D,OAAO,EAAE,EAAE,EAAE,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAA;IAC5E,CAAC;IAED;;;;;;;;;OASG;IACO,gBAAgB,CAAC,OAAe,EAAE,GAAgB;QAC1D,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,oBAAoB,EAAE,CAAA;QACrE,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;IAClC,CAAC;IAES,KAAK,CAAC,wBAAwB,CAAC,OAAuD;QAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC;YACnD,SAAS,EAAE,OAAO,CAAC,IAAI;YACvB,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,aAAa,EAAE,OAAO,CAAC,OAAO;SAC/B,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IACD;;;;;;OAMG;IACO,gBAAgB,CAAC,UAAkB;QAC3C,IAAI,EAAU,CAAA;QACd,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,uFAAuF;YACvF,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC1C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;YACjD,CAAC;YACD,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;QAC9C,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;QACD,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;QACjD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;IAC7E,CAAC;IAED;;;;;;;;;;OAUG;IACO,qBAAqB,CAAC,IAAiB,EAAE,WAAmB;QACpE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7D,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,sBAAsB,CAAC,GAAoB,EAAE,GAAW,EAAE,QAAkC,IAAI,GAAG,EAAE;QAC3G,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACzB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG;gBACL,IAAI;gBACJ,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,OAAO;gBAClB,YAAY,EAAE,IAAI,GAAG,EAAe;gBACpC,SAAS,EAAE,IAAI,GAAG,EAAU;aAC7B,CAAA;YAED,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAEpB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE,CAAA;YAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC1D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,YAAgC,EAAE,MAAwB;QACtF,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,SAAS,EAAE,CAAA;YACpC,iFAAiF;YACjF,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;YACnD,MAAM,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC9D,SAAQ;YACV,CAAC;YAED,qBAAqB;YACrB,yCAAyC;YACzC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;gBAC9B,SAAQ;YACV,CAAC;YAED,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,SAAS;gBAClB,GAAG,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;aAClC,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjB,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,GAAG,EAAE,CAAA;gBACtB,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;YAC/D,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACrD,CAAC;IAES,oBAAoB,CAAC,OAAe;QAC5C,MAAM,mBAAmB,GAAG,oGAAoG,CAAA;QAChI,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,mCAAmC,CAAC,CAAC,CAAC,eAAe,CAAC,eAAe,CAAA;QAC5I,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjD,CAAC;IAES,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,IAAc,EAAE,MAAc,IAAI,CAAC,OAAO;QACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACvF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YACjE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAClE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACtD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAA;YAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;QACrD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACO,KAAK,CAAC,4BAA4B,CAAC,OAAe,EAAE,IAAc,EAAE,GAAW,EAAE,cAAsB;QAC/G,kGAAkG;QAClG,kFAAkF;QAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;QAE9D,iGAAiG;QACjG,mGAAmG;QACnG,gGAAgG;QAChG,iGAAiG;QACjG,kGAAkG;QAClG,6FAA6F;QAC7F,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAE,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAW,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,IAAI,CAAW,CAAA;QAEtK,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,SAAS,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAA;YAEnD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE;gBACxD,GAAG;gBACH,0EAA0E;gBAC1E,GAAG,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;aAC5E,CAAC,CAAA;YAEF,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,2FAA2F;YAC3F,yFAAyF;YACzF,6FAA6F;YAC7F,6EAA6E;YAC7E,IAAI,QAAQ,GAAkB,IAAI,CAAA;YAClC,IAAI,WAAW,GAAG,KAAK,CAAA;YACvB,IAAI,cAAc,GAAG,KAAK,CAAA;YAC1B,IAAI,OAAO,GAAG,KAAK,CAAA;YAEnB,sFAAsF;YACtF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;gBAC9B,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;YAC5B,CAAC,CAAC,CAAA;YAEF,MAAM,IAAI,GAAG,CAAC,GAAU,EAAE,EAAE;gBAC1B,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAM;gBACR,CAAC;gBACD,OAAO,GAAG,IAAI,CAAA;gBACd,uEAAuE;gBACvE,oDAAoD;gBACpD,IAAI,CAAC;oBACH,KAAK,CAAC,IAAI,EAAE,CAAA;gBACd,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC;oBACH,SAAS,CAAC,OAAO,EAAE,CAAA;gBACrB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,CAAA;YACb,CAAC,CAAA;YAED,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,OAAO,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC;oBAC/C,OAAM;gBACR,CAAC;gBACD,MAAM,IAAI,GAAG,QAAQ,CAAA;gBACrB,0CAA0C;gBAC1C,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;gBAC5F,IAAI,YAAY,EAAE,CAAC;oBACjB,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,uIAAuI,CAAC,CAAA;gBAC1J,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,wDAAwD,CAAC,CAAA;oBAC/E,yFAAyF;oBACzF,qFAAqF;oBACrF,uFAAuF;oBACvF,yEAAyE;oBACzE,IAAI,CAAC,YAAY,EAAE,CAAC;wBAClB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;oBAC1E,CAAC;gBACH,CAAC;gBACD,OAAO,GAAG,IAAI,CAAA;gBACd,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,IAAI,YAAY,CAAA;gBAChD,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kDAAkD,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC,CAAA;YAC5H,CAAC,CAAA;YAED,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,gDAAgD,OAAO,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;YACzH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;gBAC1B,cAAc,GAAG,IAAI,CAAA;gBACrB,MAAM,EAAE,CAAA;YACV,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBACtB,IAAI,CAAC,IAAI,KAAK,CAAC,gCAAgC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YAC5G,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;gBACvB,QAAQ,GAAG,IAAI,CAAA;gBACf,WAAW,GAAG,IAAI,CAAA;gBAClB,MAAM,EAAE,CAAA;YACV,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe,EAAE,IAAc;IACxE,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,sEAAsE,UAAU,sBAAsB,CAAA;IACrH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACjE,OAAO,CAAC,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;AACtE,CAAC","sourcesContent":["import { exists, log, retry, stripSensitiveEnvVars, TmpDir } from \"builder-util\"\nimport * as childProcess from \"child_process\"\nimport { createWriteStream } from \"node:fs\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { hoist, type HoisterResult, type HoisterTree } from \"./hoist.js\"\nimport { LogMessageByKey, ModuleManager } from \"./moduleManager.js\"\nimport { getPackageManagerCommand, PM } from \"./packageManager.js\"\nimport type { Dependency, DependencyGraph, NodeModuleInfo, PackageJson } from \"./types.js\"\n\nexport abstract class NodeModulesCollector<ProdDepType extends Dependency<ProdDepType, OptionalDepType>, OptionalDepType> {\n  private readonly nodeModules: NodeModuleInfo[] = []\n  protected readonly allDependencies: Map<string, ProdDepType> = new Map()\n  protected readonly productionGraph: DependencyGraph = {}\n  protected readonly cache: ModuleManager = new ModuleManager()\n\n  protected isHoisted = new Lazy<boolean>(async () => {\n    const { manager } = this.installOptions\n    const command = getPackageManagerCommand(manager)\n    const config = (await this.asyncExec(command, [\"config\", \"list\"])).stdout\n    if (config == null) {\n      log.debug({ manager }, \"unable to determine node-linker setting; assuming non-hoisted (virtual store) layout\")\n      return false\n    }\n    const lines = Object.fromEntries(config.split(\"\\n\").map(line => line.split(\"=\").map(s => s.trim())))\n    if (lines[\"node-linker\"] === \"hoisted\") {\n      log.debug({ manager }, \"node_modules are hoisted\")\n      return true\n    }\n    return false\n  })\n\n  constructor(\n    protected readonly rootDir: string,\n    private readonly tempDirManager: TmpDir\n  ) {}\n\n  /**\n   * Retrieves and collects all Node.js modules for a given package.\n   *\n   * This method orchestrates the entire module collection process by:\n   * 1. Fetching the dependency tree from the package manager\n   * 2. Collecting all dependencies recursively\n   * 3. Extracting workspace references if applicable\n   * 4. Building a production dependency graph\n   * 5. Hoisting the dependencies to their final locations\n   * 6. Resolving and returning module information\n   */\n  public async getNodeModules({ packageName }: { packageName: string }): Promise<{\n    nodeModules: NodeModuleInfo[]\n    logSummary: ModuleManager[\"logSummary\"]\n  }> {\n    const tree: ProdDepType = await this.getDependenciesTree(this.installOptions.manager)\n\n    await this.collectAllDependencies(tree, packageName)\n    const realTree: ProdDepType = this.getTreeFromWorkspaces(tree, packageName)\n    await this.extractProductionDependencyGraph(realTree, packageName)\n\n    const hoisterResult: HoisterResult = hoist(this.transformToHoisterTree(this.productionGraph, packageName), {\n      check: log.isDebugEnabled,\n    })\n\n    await this._getNodeModules(hoisterResult.dependencies, this.nodeModules)\n\n    log.debug({ packageName, depCount: this.nodeModules.length }, \"node modules collection complete\")\n\n    return { nodeModules: this.nodeModules, logSummary: this.cache.logSummary }\n  }\n\n  public abstract readonly installOptions: {\n    manager: PM\n    lockfile: string\n  }\n\n  protected abstract getArgs(): string[]\n  protected abstract extractProductionDependencyGraph(tree: Dependency<ProdDepType, OptionalDepType>, dependencyId: string): Promise<void>\n  protected abstract collectAllDependencies(tree: Dependency<ProdDepType, OptionalDepType>, appPackageName: string): Promise<void>\n\n  /**\n   * Retrieves the dependency tree from the package manager.\n   *\n   * Executes the appropriate package manager command to fetch the dependency tree and writes\n   * the output to a temporary file. Includes retry logic to handle transient failures such as\n   * incomplete JSON output or missing files. Will retry up to 1 time with exponential backoff.\n   */\n  protected async getDependenciesTree(pm: PM): Promise<ProdDepType> {\n    const command = getPackageManagerCommand(pm)\n    const args = this.getArgs()\n\n    const tempOutputFile = await this.tempDirManager.getTempFile({\n      prefix: path.basename(command, path.extname(command)),\n      suffix: \"output.json\",\n    })\n\n    return retry(\n      async () => {\n        await this.streamCollectorCommandToFile(command, args, this.rootDir, tempOutputFile)\n        const shellOutput = await _fsExtra.readFile(tempOutputFile, { encoding: \"utf8\" })\n        const result = await Promise.resolve(this.parseDependenciesTree(shellOutput))\n        return result\n      },\n      {\n        retries: 1,\n        interval: 2000,\n        backoff: 2000,\n        shouldRetry: async (error: any) => {\n          const fields: Record<string, string> = { error: error.message, tempOutputFile, cwd: this.rootDir, packageManager: pm }\n\n          if (!(await exists(tempOutputFile))) {\n            log.debug(fields, \"dependency tree output file missing, retrying\")\n            return true\n          }\n\n          const fileContent = await _fsExtra.readFile(tempOutputFile, { encoding: \"utf8\" })\n          fields.fileContentLength = fileContent.length.toString()\n\n          if (fileContent.trim().length === 0) {\n            log.debug(fields, \"dependency tree output file empty, retrying\")\n            return true\n          }\n\n          // extract small start/end sample for debugging purposes (e.g. polluted console output)\n          const lines = fileContent.split(\"\\n\")\n          const lineSampleSize = Math.min(5, lines.length / 2)\n          if (2 * lineSampleSize > 5) {\n            fields.sampleStart = lines.slice(0, lineSampleSize).join(\"\\n\")\n            fields.sampleEnd = lines.slice(-lineSampleSize).join(\"\\n\")\n          } else {\n            fields.content = fileContent\n          }\n\n          // Both indicate truncated/polluted PM output (a transient that re-running the command clears).\n          if (error.message?.includes(\"Unexpected end of JSON input\") || error.message?.includes(\"No JSON content found in output\")) {\n            log.debug(fields, \"JSON parse error in dependency tree, retrying\")\n            return true\n          }\n\n          log.error(fields, \"error parsing dependencies tree\")\n          return false\n        },\n      }\n    )\n  }\n\n  /**\n   * Parses the dependencies tree from shell command output.\n   *\n   **/\n  protected parseDependenciesTree(shellOutput: string): ProdDepType | Promise<ProdDepType> {\n    return this.extractJsonFromPollutedOutput<ProdDepType>(shellOutput)\n  }\n\n  protected extractJsonFromPollutedOutput<T>(shellOutput: string): T {\n    const consoleOutput = shellOutput.trim()\n    try {\n      // Please for the love of all that is holy, this should cover 99% of cases where npm/pnpm/yarn output is clean JSON\n      return JSON.parse(consoleOutput)\n    } catch {\n      // ignore\n    }\n\n    // DEDICATED FALLBACK FOR POLLUTED OUTPUT, non-trivial to implement correctly, not needed in most cases, and highly inefficient\n\n    // Find the first index that starts with { or [\n    const bracketOpen = Math.max(consoleOutput.indexOf(\"{\"), 0)\n    const bracketOpenSquare = Math.max(consoleOutput.indexOf(\"[\"), 0)\n    const start = Math.min(bracketOpen, bracketOpenSquare) // always non-negative due to Math.max above\n\n    for (let i = start; i < consoleOutput.length; i++) {\n      const slice = consoleOutput.slice(start, i + 1)\n      try {\n        return JSON.parse(slice)\n      } catch {\n        // ignore, try next\n      }\n    }\n    throw new Error(\"No JSON content found in output\")\n  }\n\n  protected cacheKey(pkg: Pick<ProdDepType, \"name\" | \"version\" | \"path\">): string {\n    const rel = path.relative(this.rootDir, pkg.path)\n    return `${pkg.name}::${pkg.version}::${rel ?? \".\"}`\n  }\n\n  // We use the key (alias name) instead of value.name for npm aliased packages\n  // e.g., { \"foo\": { name: \"@scope/bar\", ... } } should be stored as \"foo@version\"\n  protected normalizePackageVersion(key: string, pkg: ProdDepType) {\n    return { id: `${key}@${pkg.version}`, pkgOverride: { ...pkg, name: key } }\n  }\n\n  /**\n   * Determines if a given dependency is a production dependency of a package.\n   *\n   * Checks both the dependencies and optionalDependencies of a package to see if\n   * the specified dependency name is listed.\n   *\n   * @param depName - The name of the dependency to check\n   * @param pkg - The package to search for the dependency in\n   * @returns True if the dependency is found in either dependencies or optionalDependencies, false otherwise\n   */\n  protected isProdDependency(depName: string, pkg: ProdDepType): boolean {\n    const prodDeps = { ...pkg.dependencies, ...pkg.optionalDependencies }\n    return prodDeps[depName] != null\n  }\n\n  protected async locatePackageWithVersion(depTree: Pick<ProdDepType, \"name\" | \"version\" | \"path\">): Promise<{ packageDir: string; packageJson: PackageJson } | null> {\n    const result = await this.cache.locatePackageVersion({\n      parentDir: depTree.path,\n      pkgName: depTree.name,\n      requiredRange: depTree.version,\n    })\n    return result\n  }\n  /**\n   * Parses a dependency identifier string into name and version components.\n   *\n   * Handles both scoped packages (e.g., \"@scope/pkg@1.2.3\") and regular packages (e.g., \"pkg@1.2.3\").\n   * If the identifier is malformed or cannot be parsed, defaults to treating the entire string as\n   * the package name with an \"unknown\" version.\n   */\n  protected parseNameVersion(identifier: string): { name: string; version: string } {\n    let at: number\n    if (identifier.startsWith(\"@\")) {\n      // Scoped package: find the version separator after the scope (e.g. \"@scope/pkg@1.2.3\")\n      const slashIndex = identifier.indexOf(\"/\")\n      if (slashIndex === -1) {\n        return { name: identifier, version: \"unknown\" }\n      }\n      at = identifier.indexOf(\"@\", slashIndex + 1)\n    } else {\n      at = identifier.indexOf(\"@\")\n    }\n    if (at <= 0) {\n      return { name: identifier, version: \"unknown\" }\n    }\n    return { name: identifier.slice(0, at), version: identifier.slice(at + 1) }\n  }\n\n  /**\n   * Retrieves the dependency tree and handles workspace package self-references.\n   *\n   * If the project is a workspace project, this method removes the root package's self-reference\n   * from the dependency tree to avoid circular dependencies. It promotes the root package's\n   * direct dependencies to the top level of the tree.\n   *\n   * @param tree - The original dependency tree\n   * @param packageName - The name of the package to check for and remove from the tree\n   * @returns The extracted dependency subtree\n   */\n  protected getTreeFromWorkspaces(tree: ProdDepType, packageName: string): ProdDepType {\n    if (tree.workspaces && tree.dependencies) {\n      for (const [key, value] of Object.entries(tree.dependencies)) {\n        if (key === packageName) {\n          return value\n        }\n      }\n    }\n\n    return tree\n  }\n\n  private transformToHoisterTree(obj: DependencyGraph, key: string, nodes: Map<string, HoisterTree> = new Map()): HoisterTree {\n    let node = nodes.get(key)\n    const { name, version } = this.parseNameVersion(key)\n\n    if (!node) {\n      node = {\n        name,\n        identName: name,\n        reference: version,\n        dependencies: new Set<HoisterTree>(),\n        peerNames: new Set<string>(),\n      }\n\n      nodes.set(key, node)\n\n      const deps = (obj[key] || {}).dependencies || []\n      for (const dep of deps) {\n        const child = this.transformToHoisterTree(obj, dep, nodes)\n        node.dependencies.add(child)\n      }\n    }\n\n    return node\n  }\n\n  private async _getNodeModules(dependencies: Set<HoisterResult>, result: NodeModuleInfo[]) {\n    if (dependencies.size === 0) {\n      return\n    }\n\n    for (const d of dependencies.values()) {\n      const reference = [...d.references][0]\n      const key = `${d.name}@${reference}`\n      // Normalize the path to handle mixed separators from pnpm JSON output on Windows\n      const rawPath = this.allDependencies.get(key)?.path\n      const p = rawPath != null ? path.normalize(rawPath) : undefined\n      if (p === undefined) {\n        this.cache.logSummary[LogMessageByKey.PKG_NOT_FOUND].push(key)\n        continue\n      }\n\n      // fix npm list issue\n      // https://github.com/npm/cli/issues/8535\n      if (!(await this.cache.exists[p])) {\n        this.logMissingDependency(key)\n        continue\n      }\n\n      const node: NodeModuleInfo = {\n        name: d.name,\n        version: reference,\n        dir: await this.cache.realPath[p],\n      }\n      result.push(node)\n      if (d.dependencies.size > 0) {\n        node.dependencies = []\n        await this._getNodeModules(d.dependencies, node.dependencies)\n      }\n    }\n    result.sort((a, b) => a.name.localeCompare(b.name))\n  }\n\n  protected logMissingDependency(pkgName: string) {\n    const PLATFORM_PACKAGE_RE = /(linux|win32|darwin|freebsd|android)[-_](x64|arm64|ia32|arm|ppc64|s390x|loong64|riscv64|universal)/\n    const diskLogKey = PLATFORM_PACKAGE_RE.test(pkgName) ? LogMessageByKey.PKG_OPTIONAL_PLATFORM_NOT_INSTALLED : LogMessageByKey.PKG_NOT_ON_DISK\n    this.cache.logSummary[diskLogKey].push(pkgName)\n  }\n\n  protected async asyncExec(command: string, args: string[], cwd: string = this.rootDir): Promise<{ stdout: string | undefined; stderr: string | undefined }> {\n    const file = await this.tempDirManager.getTempFile({ prefix: \"exec-\", suffix: \".txt\" })\n    try {\n      await this.streamCollectorCommandToFile(command, args, cwd, file)\n      const result = await _fsExtra.readFile(file, { encoding: \"utf8\" })\n      return { stdout: result?.trim(), stderr: undefined }\n    } catch (error: any) {\n      log.debug({ error: error.message }, \"failed to execute command\")\n      return { stdout: undefined, stderr: error.message }\n    }\n  }\n\n  /**\n   * Executes a command and streams its output to a file.\n   *\n   * Spawns a child process to execute the specified command with arguments, capturing stdout\n   * to a file. On Windows, wraps the invocation in `powershell.exe -EncodedCommand` (UTF-16LE\n   * base64) to avoid spawning `.cmd` shims directly and to eliminate shell-injection surface area.\n   * Enables corepack strict mode by default but allows process.env overrides.\n   *\n   * Special handling for `npm list` exit code 1, which is expected in certain scenarios.\n   *\n   * @param command - The command to execute\n   * @param args - Array of command-line arguments\n   * @param cwd - The working directory to execute the command in\n   * @param tempOutputFile - The path to the temporary file where stdout will be written\n   * @returns Promise that resolves when the command completes successfully or rejects if it fails\n   * @throws {Error} If the child process spawn fails or exits with a non-zero code\n   */\n  protected async streamCollectorCommandToFile(command: string, args: string[], cwd: string, tempOutputFile: string) {\n    // Derive execName from the original command so the npm-list shouldIgnore check below keys off the\n    // real invocation (e.g. \"npm\"), not the \"powershell\" wrapper we spawn on Windows.\n    const execName = path.basename(command, path.extname(command))\n\n    // On Windows the package-manager command is typically a `.cmd` shim (npm.cmd/pnpm.cmd/yarn.cmd),\n    // which Node can no longer spawn directly (CVE-2024-27980). Rather than spawn with `shell: true` —\n    // which emits the DEP0190 \"args with shell\" deprecation warning and forces manual metacharacter\n    // escaping — wrap the invocation in a single PowerShell `-EncodedCommand`. The base64 (UTF-16LE)\n    // payload sidesteps every shell-quoting layer, and `powershell.exe` is a real executable we spawn\n    // directly with no shell. See buildPowerShellEncodedArgs for the UTF-8 / exit-code handling.\n    const [spawnCommand, spawnArgs] = process.platform === \"win32\" ? ([\"powershell.exe\", buildPowerShellEncodedArgs(command, args)] as const) : ([command, args] as const)\n\n    await new Promise<void>((resolve, reject) => {\n      const outStream = createWriteStream(tempOutputFile)\n\n      const child = childProcess.spawn(spawnCommand, spawnArgs, {\n        cwd,\n        // Package manager invocations do not need signing/publishing credentials.\n        env: { COREPACK_ENABLE_STRICT: \"0\", ...stripSensitiveEnvVars(process.env) },\n      })\n\n      let stderr = \"\"\n      // The process can close before all piped stdout has been flushed to disk. Resolving on the\n      // child's \"close\" alone races the write stream and lets the caller read a TRUNCATED file\n      // (manifesting as \"No JSON content found in output\"). Gate the settle on BOTH the child exit\n      // (for the code/stderr) and the write stream's \"finish\" (all bytes flushed).\n      let exitCode: number | null = null\n      let childClosed = false\n      let streamFinished = false\n      let settled = false\n\n      // `pipe` ends `outStream` when stdout EOFs, which triggers its \"finish\" once flushed.\n      child.stdout.pipe(outStream)\n      child.stderr.on(\"data\", chunk => {\n        stderr += chunk.toString()\n      })\n\n      const fail = (err: Error) => {\n        if (settled) {\n          return\n        }\n        settled = true\n        // Best-effort cleanup: stop the child and close the stream so we don't\n        // waste CPU writing to a broken fd after rejection.\n        try {\n          child.kill()\n        } catch {\n          // ignore\n        }\n        try {\n          outStream.destroy()\n        } catch {\n          // ignore\n        }\n        reject(err)\n      }\n\n      const settle = () => {\n        if (settled || !childClosed || !streamFinished) {\n          return\n        }\n        const code = exitCode\n        // https://github.com/npm/npm/issues/17624\n        const shouldIgnore = code === 1 && \"npm\" === execName.toLowerCase() && args.includes(\"list\")\n        if (shouldIgnore) {\n          log.debug(null, \"`npm list` returned non-zero exit code, but it MIGHT be expected (https://github.com/npm/npm/issues/17624). Check stderr for details.\")\n        }\n        if (stderr.length > 0) {\n          log.debug({ stderr }, \"note: there was node module collector output on stderr\")\n          // Only surface stderr as a user-visible warning when the exit code itself is unexpected.\n          // When shouldIgnore is true (npm list exit code 1) the stderr is an anticipated side\n          // effect of package-manager features like yarn resolutions or npm overrides that cause\n          // npm to report ELSPROBLEMS for aliased packages it considers \"invalid\".\n          if (!shouldIgnore) {\n            this.cache.logSummary[LogMessageByKey.PKG_COLLECTOR_OUTPUT].push(stderr)\n          }\n        }\n        settled = true\n        const shouldResolve = code === 0 || shouldIgnore\n        return shouldResolve ? resolve() : reject(new Error(`Node module collector process exited with code ${code}:\\n${stderr}`))\n      }\n\n      outStream.on(\"error\", err => fail(new Error(`Node module collector failed writing output (${command}): ${err.message}`)))\n      outStream.on(\"finish\", () => {\n        streamFinished = true\n        settle()\n      })\n      child.on(\"error\", err => {\n        fail(new Error(`Node module collector spawn (${command} ${JSON.stringify(args)}) failed: ${err.message}`))\n      })\n      child.on(\"close\", code => {\n        exitCode = code\n        childClosed = true\n        settle()\n      })\n    })\n  }\n}\n\n/**\n * Build the argv for invoking a Windows command through `powershell.exe -EncodedCommand`.\n *\n * Each token is wrapped in a PowerShell single-quoted string (with embedded single quotes doubled),\n * so no character is interpreted by a shell. The script:\n *   - pins `[Console]::OutputEncoding` to UTF-8 *without* a BOM so the JSON dependency tree is not\n *     corrupted by the console's OEM code page (and no BOM is prepended to break `JSON.parse`),\n *   - invokes the command via the call operator `&`,\n *   - re-emits the command's own exit code via `exit $LASTEXITCODE` (e.g. `npm list` returns 1 in\n *     expected scenarios, which the caller's shouldIgnore logic relies on).\n *\n * The whole script is base64-encoded as UTF-16LE per PowerShell's `-EncodedCommand` contract.\n */\nexport function buildPowerShellEncodedArgs(command: string, args: string[]): string[] {\n  const psQuote = (value: string) => `'${value.replace(/'/g, \"''\")}'`\n  const invocation = [\"&\", psQuote(command), ...args.map(psQuote)].join(\" \")\n  const script = `[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new($false); ${invocation}; exit $LASTEXITCODE`\n  const encoded = Buffer.from(script, \"utf16le\").toString(\"base64\")\n  return [\"-NoProfile\", \"-NonInteractive\", \"-EncodedCommand\", encoded]\n}\n"]}
+{"version":3,"file":"nodeModulesCollector.js","sourceRoot":"","sources":["../../src/node-module-collector/nodeModulesCollector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAU,MAAM,cAAc,CAAA;AAChF,OAAO,QAAQ,MAAM,UAAU,CAAA;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,KAAK,EAAwC,MAAM,YAAY,CAAA;AACxE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACnE,OAAO,EAAE,wBAAwB,EAAM,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAEhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AAQlE,MAAM,OAAgB,oBAAoB;IAsBxC,YACqB,OAAe,EACjB,cAAsB;QADpB,YAAO,GAAP,OAAO,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAQ;QAvBxB,gBAAW,GAAqB,EAAE,CAAA;QAChC,oBAAe,GAA6B,IAAI,GAAG,EAAE,CAAA;QACrD,oBAAe,GAAoB,EAAE,CAAA;QACrC,UAAK,GAAkB,IAAI,aAAa,EAAE,CAAA;QAEnD,cAAS,GAAG,IAAI,IAAI,CAAU,KAAK,IAAI,EAAE;YACjD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,CAAA;YACvC,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;YACjD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YACzE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,sFAAsF,CAAC,CAAA;gBAC9G,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YACpG,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAA;gBAClD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAA;IAKC,CAAC;IAEJ;;;;;;;;;;OAUG;IACI,KAAK,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,UAAU,EAAoD;QAIvG,MAAM,IAAI,GAAgB,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QAErF,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAgB,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAC3E,MAAM,IAAI,CAAC,gCAAgC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QAElE,MAAM,aAAa,GAAkB,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE;YACzG,KAAK,EAAE,GAAG,CAAC,cAAc;SAC1B,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QAEpF,GAAG,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAA;QAEjG,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAA;IAC7E,CAAC;IAWD;;;;;;OAMG;IACO,KAAK,CAAC,mBAAmB,CAAC,EAAM;QACxC,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAA;QAE3B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;YAC3D,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,EAAE,aAAa;SACtB,CAAC,CAAA;QAEF,OAAO,KAAK,CACV,KAAK,IAAI,EAAE;YACT,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;YACpF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YACjF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC7E,OAAO,MAAM,CAAA;QACf,CAAC,EACD;YACE,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,KAAK,EAAE,KAAU,EAAE,EAAE;gBAChC,MAAM,MAAM,GAA2B,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,CAAA;gBAEtH,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;oBACpC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAA;oBAClE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;gBACjF,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAA;gBAExD,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACpC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAA;oBAChE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,uFAAuF;gBACvF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACrC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;gBACpD,IAAI,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAC9D,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC5D,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,OAAO,GAAG,WAAW,CAAA;gBAC9B,CAAC;gBAED,+FAA+F;gBAC/F,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,8BAA8B,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,iCAAiC,CAAC,EAAE,CAAC;oBAC1H,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,+CAA+C,CAAC,CAAA;oBAClE,OAAO,IAAI,CAAA;gBACb,CAAC;gBAED,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAA;gBACpD,OAAO,KAAK,CAAA;YACd,CAAC;SACF,CACF,CAAA;IACH,CAAC;IAED;;;QAGI;IACM,qBAAqB,CAAC,WAAmB;QACjD,OAAO,IAAI,CAAC,6BAA6B,CAAc,WAAW,CAAC,CAAA;IACrE,CAAC;IAES,6BAA6B,CAAI,WAAmB;QAC5D,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,CAAC;YACH,mHAAmH;YACnH,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,+HAA+H;QAE/H,+CAA+C;QAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3D,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA,CAAC,4CAA4C;QAEnG,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/C,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,mBAAmB;YACrB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,CAAC;IAES,QAAQ,CAAC,GAAmD;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QACjD,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,KAAK,GAAG,IAAI,GAAG,EAAE,CAAA;IACrD,CAAC;IAED,6EAA6E;IAC7E,iFAAiF;IACvE,uBAAuB,CAAC,GAAW,EAAE,GAAgB;QAC7D,OAAO,EAAE,EAAE,EAAE,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAA;IAC5E,CAAC;IAED;;;;;;;;;OASG;IACO,gBAAgB,CAAC,OAAe,EAAE,GAAgB;QAC1D,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,oBAAoB,EAAE,CAAA;QACrE,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;IAClC,CAAC;IAES,KAAK,CAAC,wBAAwB,CAAC,OAAuD;QAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC;YACnD,SAAS,EAAE,OAAO,CAAC,IAAI;YACvB,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,aAAa,EAAE,OAAO,CAAC,OAAO;SAC/B,CAAC,CAAA;QACF,OAAO,MAAM,CAAA;IACf,CAAC;IACD;;;;;;OAMG;IACO,gBAAgB,CAAC,UAAkB;QAC3C,IAAI,EAAU,CAAA;QACd,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,uFAAuF;YACvF,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC1C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;gBACtB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;YACjD,CAAC;YACD,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;QAC9C,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;QACD,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;QACjD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;IAC7E,CAAC;IAED;;;;;;;;;;OAUG;IACO,qBAAqB,CAAC,IAAiB,EAAE,WAAmB;QACpE,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7D,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,sBAAsB,CAAC,GAAoB,EAAE,GAAW,EAAE,QAAkC,IAAI,GAAG,EAAE;QAC3G,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACzB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG;gBACL,IAAI;gBACJ,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,OAAO;gBAClB,YAAY,EAAE,IAAI,GAAG,EAAe;gBACpC,SAAS,EAAE,IAAI,GAAG,EAAU;aAC7B,CAAA;YAED,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAEpB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE,CAAA;YAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC1D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,YAAgC,EAAE,MAAwB,EAAE,UAAuB;QAC/G,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;YACtC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,SAAS,EAAE,CAAA;YACpC,iFAAiF;YACjF,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;YACnD,MAAM,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC/D,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC9D,SAAQ;YACV,CAAC;YAED,qBAAqB;YACrB,yCAAyC;YACzC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAA;gBAC9B,SAAQ;YACV,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;YAExC,mGAAmG;YACnG,qGAAqG;YACrG,sGAAsG;YACtG,kGAAkG;YAClG,6DAA6D;YAC7D,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAA;gBACrE,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;oBACpF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBAC1E,SAAQ;gBACV,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAmB;gBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,SAAS;gBAClB,GAAG;aACJ,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjB,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,YAAY,GAAG,EAAE,CAAA;gBACtB,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;YAC3E,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACrD,CAAC;IAES,oBAAoB,CAAC,OAAe;QAC5C,MAAM,mBAAmB,GAAG,oGAAoG,CAAA;QAChI,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,mCAAmC,CAAC,CAAC,CAAC,eAAe,CAAC,eAAe,CAAA;QAC5I,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjD,CAAC;IAES,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,IAAc,EAAE,MAAc,IAAI,CAAC,OAAO;QACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QACvF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;YACjE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YAClE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACtD,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAA;YAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;QACrD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACO,KAAK,CAAC,4BAA4B,CAAC,OAAe,EAAE,IAAc,EAAE,GAAW,EAAE,cAAsB;QAC/G,kGAAkG;QAClG,gGAAgG;QAChG,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;QAE9D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE;YACnF,4FAA4F;YAC5F,0FAA0F;YAC1F,8FAA8F;YAC9F,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC;YACrC,sBAAsB,EAAE,GAAG;YAC3B,+BAA+B,EAAE,GAAG;SACrC,CAAC,CAAA;QAEF,0CAA0C;QAC1C,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC5F,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,uIAAuI,CAAC,CAAA;QAC1J,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,wDAAwD,CAAC,CAAA;YAC/E,yFAAyF;YACzF,qFAAqF;YACrF,uFAAuF;YACvF,yEAAyE;YACzE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,kDAAkD,IAAI,MAAM,MAAM,EAAE,CAAC,CAAA;QACvF,CAAC;IACH,CAAC;CACF","sourcesContent":["import { exists, log, retry, stripSensitiveEnvVars, TmpDir } from \"builder-util\"\nimport _fsExtra from \"fs-extra\"\nimport { Lazy } from \"lazy-val\"\nimport * as path from \"path\"\nimport { hoist, type HoisterResult, type HoisterTree } from \"./hoist.js\"\nimport { LogMessageByKey, ModuleManager } from \"./moduleManager.js\"\nimport { getPackageManagerCommand, PM } from \"./packageManager.js\"\nimport { streamSpawnToFile } from \"../util/streamSpawnToFile.js\"\nimport type { Dependency, DependencyGraph, NodeModuleInfo, PackageJson } from \"./types.js\"\nimport { isPackageCompatible } from \"../util/archCompatibility.js\"\n\n/** Target arch/platform used to drop `cpu`/`os`-incompatible packages while collecting. */\nexport interface ArchFilter {\n  cpu: string | null\n  os: string\n}\n\nexport abstract class NodeModulesCollector<ProdDepType extends Dependency<ProdDepType, OptionalDepType>, OptionalDepType> {\n  private readonly nodeModules: NodeModuleInfo[] = []\n  protected readonly allDependencies: Map<string, ProdDepType> = new Map()\n  protected readonly productionGraph: DependencyGraph = {}\n  protected readonly cache: ModuleManager = new ModuleManager()\n\n  protected isHoisted = new Lazy<boolean>(async () => {\n    const { manager } = this.installOptions\n    const command = getPackageManagerCommand(manager)\n    const config = (await this.asyncExec(command, [\"config\", \"list\"])).stdout\n    if (config == null) {\n      log.debug({ manager }, \"unable to determine node-linker setting; assuming non-hoisted (virtual store) layout\")\n      return false\n    }\n    const lines = Object.fromEntries(config.split(\"\\n\").map(line => line.split(\"=\").map(s => s.trim())))\n    if (lines[\"node-linker\"] === \"hoisted\") {\n      log.debug({ manager }, \"node_modules are hoisted\")\n      return true\n    }\n    return false\n  })\n\n  constructor(\n    protected readonly rootDir: string,\n    private readonly tempDirManager: TmpDir\n  ) {}\n\n  /**\n   * Retrieves and collects all Node.js modules for a given package.\n   *\n   * This method orchestrates the entire module collection process by:\n   * 1. Fetching the dependency tree from the package manager\n   * 2. Collecting all dependencies recursively\n   * 3. Extracting workspace references if applicable\n   * 4. Building a production dependency graph\n   * 5. Hoisting the dependencies to their final locations\n   * 6. Resolving and returning module information\n   */\n  public async getNodeModules({ packageName, archFilter }: { packageName: string; archFilter?: ArchFilter }): Promise<{\n    nodeModules: NodeModuleInfo[]\n    logSummary: ModuleManager[\"logSummary\"]\n  }> {\n    const tree: ProdDepType = await this.getDependenciesTree(this.installOptions.manager)\n\n    await this.collectAllDependencies(tree, packageName)\n    const realTree: ProdDepType = this.getTreeFromWorkspaces(tree, packageName)\n    await this.extractProductionDependencyGraph(realTree, packageName)\n\n    const hoisterResult: HoisterResult = hoist(this.transformToHoisterTree(this.productionGraph, packageName), {\n      check: log.isDebugEnabled,\n    })\n\n    await this._getNodeModules(hoisterResult.dependencies, this.nodeModules, archFilter)\n\n    log.debug({ packageName, depCount: this.nodeModules.length }, \"node modules collection complete\")\n\n    return { nodeModules: this.nodeModules, logSummary: this.cache.logSummary }\n  }\n\n  public abstract readonly installOptions: {\n    manager: PM\n    lockfile: string\n  }\n\n  protected abstract getArgs(): string[]\n  protected abstract extractProductionDependencyGraph(tree: Dependency<ProdDepType, OptionalDepType>, dependencyId: string): Promise<void>\n  protected abstract collectAllDependencies(tree: Dependency<ProdDepType, OptionalDepType>, appPackageName: string): Promise<void>\n\n  /**\n   * Retrieves the dependency tree from the package manager.\n   *\n   * Executes the appropriate package manager command to fetch the dependency tree and writes\n   * the output to a temporary file. Includes retry logic to handle transient failures such as\n   * incomplete JSON output or missing files. Will retry up to 1 time with exponential backoff.\n   */\n  protected async getDependenciesTree(pm: PM): Promise<ProdDepType> {\n    const command = getPackageManagerCommand(pm)\n    const args = this.getArgs()\n\n    const tempOutputFile = await this.tempDirManager.getTempFile({\n      prefix: path.basename(command, path.extname(command)),\n      suffix: \"output.json\",\n    })\n\n    return retry(\n      async () => {\n        await this.streamCollectorCommandToFile(command, args, this.rootDir, tempOutputFile)\n        const shellOutput = await _fsExtra.readFile(tempOutputFile, { encoding: \"utf8\" })\n        const result = await Promise.resolve(this.parseDependenciesTree(shellOutput))\n        return result\n      },\n      {\n        retries: 1,\n        interval: 2000,\n        backoff: 2000,\n        shouldRetry: async (error: any) => {\n          const fields: Record<string, string> = { error: error.message, tempOutputFile, cwd: this.rootDir, packageManager: pm }\n\n          if (!(await exists(tempOutputFile))) {\n            log.debug(fields, \"dependency tree output file missing, retrying\")\n            return true\n          }\n\n          const fileContent = await _fsExtra.readFile(tempOutputFile, { encoding: \"utf8\" })\n          fields.fileContentLength = fileContent.length.toString()\n\n          if (fileContent.trim().length === 0) {\n            log.debug(fields, \"dependency tree output file empty, retrying\")\n            return true\n          }\n\n          // extract small start/end sample for debugging purposes (e.g. polluted console output)\n          const lines = fileContent.split(\"\\n\")\n          const lineSampleSize = Math.min(5, lines.length / 2)\n          if (2 * lineSampleSize > 5) {\n            fields.sampleStart = lines.slice(0, lineSampleSize).join(\"\\n\")\n            fields.sampleEnd = lines.slice(-lineSampleSize).join(\"\\n\")\n          } else {\n            fields.content = fileContent\n          }\n\n          // Both indicate truncated/polluted PM output (a transient that re-running the command clears).\n          if (error.message?.includes(\"Unexpected end of JSON input\") || error.message?.includes(\"No JSON content found in output\")) {\n            log.debug(fields, \"JSON parse error in dependency tree, retrying\")\n            return true\n          }\n\n          log.error(fields, \"error parsing dependencies tree\")\n          return false\n        },\n      }\n    )\n  }\n\n  /**\n   * Parses the dependencies tree from shell command output.\n   *\n   **/\n  protected parseDependenciesTree(shellOutput: string): ProdDepType | Promise<ProdDepType> {\n    return this.extractJsonFromPollutedOutput<ProdDepType>(shellOutput)\n  }\n\n  protected extractJsonFromPollutedOutput<T>(shellOutput: string): T {\n    const consoleOutput = shellOutput.trim()\n    try {\n      // Please for the love of all that is holy, this should cover 99% of cases where npm/pnpm/yarn output is clean JSON\n      return JSON.parse(consoleOutput)\n    } catch {\n      // ignore\n    }\n\n    // DEDICATED FALLBACK FOR POLLUTED OUTPUT, non-trivial to implement correctly, not needed in most cases, and highly inefficient\n\n    // Find the first index that starts with { or [\n    const bracketOpen = Math.max(consoleOutput.indexOf(\"{\"), 0)\n    const bracketOpenSquare = Math.max(consoleOutput.indexOf(\"[\"), 0)\n    const start = Math.min(bracketOpen, bracketOpenSquare) // always non-negative due to Math.max above\n\n    for (let i = start; i < consoleOutput.length; i++) {\n      const slice = consoleOutput.slice(start, i + 1)\n      try {\n        return JSON.parse(slice)\n      } catch {\n        // ignore, try next\n      }\n    }\n    throw new Error(\"No JSON content found in output\")\n  }\n\n  protected cacheKey(pkg: Pick<ProdDepType, \"name\" | \"version\" | \"path\">): string {\n    const rel = path.relative(this.rootDir, pkg.path)\n    return `${pkg.name}::${pkg.version}::${rel ?? \".\"}`\n  }\n\n  // We use the key (alias name) instead of value.name for npm aliased packages\n  // e.g., { \"foo\": { name: \"@scope/bar\", ... } } should be stored as \"foo@version\"\n  protected normalizePackageVersion(key: string, pkg: ProdDepType) {\n    return { id: `${key}@${pkg.version}`, pkgOverride: { ...pkg, name: key } }\n  }\n\n  /**\n   * Determines if a given dependency is a production dependency of a package.\n   *\n   * Checks both the dependencies and optionalDependencies of a package to see if\n   * the specified dependency name is listed.\n   *\n   * @param depName - The name of the dependency to check\n   * @param pkg - The package to search for the dependency in\n   * @returns True if the dependency is found in either dependencies or optionalDependencies, false otherwise\n   */\n  protected isProdDependency(depName: string, pkg: ProdDepType): boolean {\n    const prodDeps = { ...pkg.dependencies, ...pkg.optionalDependencies }\n    return prodDeps[depName] != null\n  }\n\n  protected async locatePackageWithVersion(depTree: Pick<ProdDepType, \"name\" | \"version\" | \"path\">): Promise<{ packageDir: string; packageJson: PackageJson } | null> {\n    const result = await this.cache.locatePackageVersion({\n      parentDir: depTree.path,\n      pkgName: depTree.name,\n      requiredRange: depTree.version,\n    })\n    return result\n  }\n  /**\n   * Parses a dependency identifier string into name and version components.\n   *\n   * Handles both scoped packages (e.g., \"@scope/pkg@1.2.3\") and regular packages (e.g., \"pkg@1.2.3\").\n   * If the identifier is malformed or cannot be parsed, defaults to treating the entire string as\n   * the package name with an \"unknown\" version.\n   */\n  protected parseNameVersion(identifier: string): { name: string; version: string } {\n    let at: number\n    if (identifier.startsWith(\"@\")) {\n      // Scoped package: find the version separator after the scope (e.g. \"@scope/pkg@1.2.3\")\n      const slashIndex = identifier.indexOf(\"/\")\n      if (slashIndex === -1) {\n        return { name: identifier, version: \"unknown\" }\n      }\n      at = identifier.indexOf(\"@\", slashIndex + 1)\n    } else {\n      at = identifier.indexOf(\"@\")\n    }\n    if (at <= 0) {\n      return { name: identifier, version: \"unknown\" }\n    }\n    return { name: identifier.slice(0, at), version: identifier.slice(at + 1) }\n  }\n\n  /**\n   * Retrieves the dependency tree and handles workspace package self-references.\n   *\n   * If the project is a workspace project, this method removes the root package's self-reference\n   * from the dependency tree to avoid circular dependencies. It promotes the root package's\n   * direct dependencies to the top level of the tree.\n   *\n   * @param tree - The original dependency tree\n   * @param packageName - The name of the package to check for and remove from the tree\n   * @returns The extracted dependency subtree\n   */\n  protected getTreeFromWorkspaces(tree: ProdDepType, packageName: string): ProdDepType {\n    if (tree.workspaces && tree.dependencies) {\n      for (const [key, value] of Object.entries(tree.dependencies)) {\n        if (key === packageName) {\n          return value\n        }\n      }\n    }\n\n    return tree\n  }\n\n  private transformToHoisterTree(obj: DependencyGraph, key: string, nodes: Map<string, HoisterTree> = new Map()): HoisterTree {\n    let node = nodes.get(key)\n    const { name, version } = this.parseNameVersion(key)\n\n    if (!node) {\n      node = {\n        name,\n        identName: name,\n        reference: version,\n        dependencies: new Set<HoisterTree>(),\n        peerNames: new Set<string>(),\n      }\n\n      nodes.set(key, node)\n\n      const deps = (obj[key] || {}).dependencies || []\n      for (const dep of deps) {\n        const child = this.transformToHoisterTree(obj, dep, nodes)\n        node.dependencies.add(child)\n      }\n    }\n\n    return node\n  }\n\n  private async _getNodeModules(dependencies: Set<HoisterResult>, result: NodeModuleInfo[], archFilter?: ArchFilter) {\n    if (dependencies.size === 0) {\n      return\n    }\n\n    for (const d of dependencies.values()) {\n      const reference = [...d.references][0]\n      const key = `${d.name}@${reference}`\n      // Normalize the path to handle mixed separators from pnpm JSON output on Windows\n      const rawPath = this.allDependencies.get(key)?.path\n      const p = rawPath != null ? path.normalize(rawPath) : undefined\n      if (p === undefined) {\n        this.cache.logSummary[LogMessageByKey.PKG_NOT_FOUND].push(key)\n        continue\n      }\n\n      // fix npm list issue\n      // https://github.com/npm/cli/issues/8535\n      if (!(await this.cache.exists[p])) {\n        this.logMissingDependency(key)\n        continue\n      }\n\n      const dir = await this.cache.realPath[p]\n\n      // Drop packages whose declared `cpu`/`os` is incompatible with the target arch/platform (and their\n      // subtree). npm/pnpm install only the host's platform-specific optional packages, so without this an\n      // arm64-only binary (e.g. `@esbuild/darwin-arm64`) would be bundled into the x64 build too — and into\n      // both slices of a universal build, which `@electron/universal` then refuses to merge. Reuses the\n      // memoized `package.json` cache populated during collection.\n      if (archFilter != null) {\n        const pkgJson = await this.cache.json[path.join(dir, \"package.json\")]\n        if (pkgJson != null && !isPackageCompatible(pkgJson, archFilter.cpu, archFilter.os)) {\n          this.cache.logSummary[LogMessageByKey.PKG_INCOMPATIBLE_PLATFORM].push(key)\n          continue\n        }\n      }\n\n      const node: NodeModuleInfo = {\n        name: d.name,\n        version: reference,\n        dir,\n      }\n      result.push(node)\n      if (d.dependencies.size > 0) {\n        node.dependencies = []\n        await this._getNodeModules(d.dependencies, node.dependencies, archFilter)\n      }\n    }\n    result.sort((a, b) => a.name.localeCompare(b.name))\n  }\n\n  protected logMissingDependency(pkgName: string) {\n    const PLATFORM_PACKAGE_RE = /(linux|win32|darwin|freebsd|android)[-_](x64|arm64|ia32|arm|ppc64|s390x|loong64|riscv64|universal)/\n    const diskLogKey = PLATFORM_PACKAGE_RE.test(pkgName) ? LogMessageByKey.PKG_OPTIONAL_PLATFORM_NOT_INSTALLED : LogMessageByKey.PKG_NOT_ON_DISK\n    this.cache.logSummary[diskLogKey].push(pkgName)\n  }\n\n  protected async asyncExec(command: string, args: string[], cwd: string = this.rootDir): Promise<{ stdout: string | undefined; stderr: string | undefined }> {\n    const file = await this.tempDirManager.getTempFile({ prefix: \"exec-\", suffix: \".txt\" })\n    try {\n      await this.streamCollectorCommandToFile(command, args, cwd, file)\n      const result = await _fsExtra.readFile(file, { encoding: \"utf8\" })\n      return { stdout: result?.trim(), stderr: undefined }\n    } catch (error: any) {\n      log.debug({ error: error.message }, \"failed to execute command\")\n      return { stdout: undefined, stderr: error.message }\n    }\n  }\n\n  /**\n   * Executes a package-manager command and streams its stdout to a file.\n   *\n   * Delegates the spawn/stream/flush mechanics (including the Windows `powershell.exe -EncodedCommand`\n   * wrapping) to {@link streamSpawnToFile}, and layers on the collector-specific interpretation of the\n   * result: corepack is silenced for these invocations, `npm list` exit code 1 is tolerated, and any\n   * stderr is surfaced as a collector warning only when the exit code is genuinely unexpected.\n   *\n   * @param command - The command to execute\n   * @param args - Array of command-line arguments\n   * @param cwd - The working directory to execute the command in\n   * @param tempOutputFile - The path to the temporary file where stdout will be written\n   * @returns Promise that resolves when the command completes successfully or rejects if it fails\n   * @throws {Error} If the child process spawn fails or exits with a non-zero, unexpected code\n   */\n  protected async streamCollectorCommandToFile(command: string, args: string[], cwd: string, tempOutputFile: string) {\n    // Derive execName from the original command so the npm-list shouldIgnore check below keys off the\n    // real invocation (e.g. \"npm\"), not the \"powershell\" wrapper streamSpawnToFile uses on Windows.\n    const execName = path.basename(command, path.extname(command))\n\n    const { code, stderr } = await streamSpawnToFile(command, args, cwd, tempOutputFile, {\n      // Package manager invocations do not need signing/publishing credentials. Silence corepack:\n      // strict=0 so a project's `packageManager` pin can't abort our read-only queries, and the\n      // download prompt/notice off so corepack doesn't flood stdout/stderr with activation chatter.\n      ...stripSensitiveEnvVars(process.env),\n      COREPACK_ENABLE_STRICT: \"0\",\n      COREPACK_ENABLE_DOWNLOAD_PROMPT: \"0\",\n    })\n\n    // https://github.com/npm/npm/issues/17624\n    const shouldIgnore = code === 1 && \"npm\" === execName.toLowerCase() && args.includes(\"list\")\n    if (shouldIgnore) {\n      log.debug(null, \"`npm list` returned non-zero exit code, but it MIGHT be expected (https://github.com/npm/npm/issues/17624). Check stderr for details.\")\n    }\n    if (stderr.length > 0) {\n      log.debug({ stderr }, \"note: there was node module collector output on stderr\")\n      // Only surface stderr as a user-visible warning when the exit code itself is unexpected.\n      // When shouldIgnore is true (npm list exit code 1) the stderr is an anticipated side\n      // effect of package-manager features like yarn resolutions or npm overrides that cause\n      // npm to report ELSPROBLEMS for aliased packages it considers \"invalid\".\n      if (!shouldIgnore) {\n        this.cache.logSummary[LogMessageByKey.PKG_COLLECTOR_OUTPUT].push(stderr)\n      }\n    }\n    if (code !== 0 && !shouldIgnore) {\n      throw new Error(`Node module collector process exited with code ${code}:\\n${stderr}`)\n    }\n  }\n}\n"]}

package/dist/node-module-collector/pnpmNodeModulesCollector.d.ts

@@ -1,6 +1,7 @@
+import { Lazy } from "lazy-val";
 import { NodeModulesCollector } from "./nodeModulesCollector.js";
 import { PM } from "./packageManager.js";
-import { PnpmDependency } from "./types.js";
+import type { PnpmDependency } from "./types.js";
 export declare class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmDependency, PnpmDependency> {
     readonly installOptions: {
         manager: PM;
@@ -9,6 +10,21 @@ export declare class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmD
     private _allWorkspacePackages;
     private _pnpmMajorVersion;
     private readonly pnpmVersion;
+    /**
+     * Detect pnpm's installed layout from the on-disk structure rather than `pnpm config list`.
+     * pnpm 11 no longer echoes `node-linker` (from `.npmrc`) in `config list`, so the base-class
+     * config-parsing detection silently reports "not hoisted" for a hoisted install, which would
+     * disable the downward search needed to find version-conflicted nested deps.
+     *
+     * In the default isolated store every regular top-level package resolves — through a symlink
+     * on POSIX, a junction on Windows — into `node_modules/.pnpm/<name>@<ver>/node_modules/<name>`.
+     * In a hoisted layout the same package is a real directory directly under `node_modules`.
+     * `realpath` transparently follows both symlinks and junctions, so a layout is isolated iff
+     * *any* top-level package's real path routes through `.pnpm`. We scan rather than sample the
+     * first entry because `link:` packages resolve to their source (never under `.pnpm`) and could
+     * otherwise mask an isolated store.
+     */
+    protected isHoisted: Lazy<boolean>;
     /**
      * Memo for `locateFromDepOrRoot`, keyed by `name@version`. pnpm's content-addressed virtual
      * store guarantees that any given `name@version` resolves to a single location on disk, so
@@ -22,6 +38,9 @@ export declare class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmD
      * every shared subtree of the pnpm list output, exploding work in deep workspaces.
      */
     private readonly collectedDeps;
+    /** Reverse index of `allDependencies` keyed by package name (without version). Built once on
+     *  first access inside `extractProductionDependencyGraph`, after `allDependencies` is settled. */
+    private _allDepsByName;
     /**
      * Returns the workspace packages to iterate over, gated by detected pnpm version:
      * - pnpm v11+: multi-entry workspace output → return the full parsed array
@@ -29,6 +48,7 @@ export declare class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmD
      */
     private get allWorkspacePackages();
     protected getArgs(): string[];
+    private getAllDepsByName;
     /**
      * Locate a package version, preferring the dep's own reported path before falling back to rootDir.
      * This is critical for pnpm non-hoisted (virtual store) setups where each package has its own
@@ -38,7 +58,34 @@ export declare class PnpmNodeModulesCollector extends NodeModulesCollector<PnpmD
     private locateFromDepOrRoot;
     protected extractProductionDependencyGraph(tree: PnpmDependency, dependencyId: string): Promise<void>;
     protected collectAllDependencies(_tree: PnpmDependency, _appPackageName: string): Promise<void>;
+    /**
+     * Resolve a `link:` dependency to its real on-disk source directory — never the `node_modules`
+     * junction pnpm creates for it. Returns null for non-link deps.
+     *
+     * Why this matters: resolving a link: dep through `node_modules` (locateFromDepOrRoot) yields the
+     * junction, which CI cannot read across drives. CI checks out the repo on `D:` but installs the
+     * app under `C:\…\Temp`, so the junction is a cross-volume link that `realpath`/`stat` fail on,
+     * silently dropping the package from the asar. The link target is a plain directory that reads
+     * fine from any drive, so we resolve straight to it.
+     */
+    private resolveLinkTarget;
+    private readPackageJsonAt;
+    /**
+     * Visit a single dependency node, adding it and its transitive deps to allDependencies.
+     *
+     * For packages that pnpm list did NOT expand (link: packages and the synthetic entries
+     * derived from them), the tree has empty dependencies/optionalDependencies. In that case
+     * we fall back to the on-disk package.json to discover transitive deps, resolving each one
+     * from the package's own node_modules first (where pnpm placed them).
+     */
+    private visitDep;
     private collectDepsRecursively;
+    /**
+     * pnpm excludes link: packages from `pnpm list --prod` output. Read the app's package.json
+     * directly to find any link: deps that were silently omitted and visit them so their
+     * transitive deps end up in allDependencies.
+     */
+    private collectOmittedLinkPackages;
     protected getTreeFromWorkspaces(tree: PnpmDependency, packageName: string): PnpmDependency;
     protected parseDependenciesTree(jsonBlob: string): Promise<PnpmDependency>;
 }

package/dist/node-module-collector/pnpmNodeModulesCollector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pnpmNodeModulesCollector.d.ts","sourceRoot":"","sources":["../../src/node-module-collector/pnpmNodeModulesCollector.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAA4B,EAAE,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,qBAAa,wBAAyB,SAAQ,oBAAoB,CAAC,cAAc,EAAE,cAAc,CAAC;IAChG,SAAgB,cAAc;;;MAG7B;IAGD,OAAO,CAAC,qBAAqB,CAAuB;IAEpD,OAAO,CAAC,iBAAiB,CAAI;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAI1B;IAEF;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAE7E;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;IAEvD;;;;OAIG;IACH,OAAO,KAAK,oBAAoB,GAK/B;IAED,SAAS,CAAC,OAAO,IAAI,MAAM,EAAE;IAI7B;;;;;OAKG;YACW,mBAAmB;cAqCjB,gCAAgC,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM;cAsD3E,sBAAsB,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAMvF,sBAAsB;cAyBjB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc;cAYnF,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAMjF"}
+{"version":3,"file":"pnpmNodeModulesCollector.d.ts","sourceRoot":"","sources":["../../src/node-module-collector/pnpmNodeModulesCollector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAA4B,EAAE,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,KAAK,EAAe,cAAc,EAAE,MAAM,YAAY,CAAA;AAG7D,qBAAa,wBAAyB,SAAQ,oBAAoB,CAAC,cAAc,EAAE,cAAc,CAAC;IAChG,SAAgB,cAAc;;;MAG7B;IAGD,OAAO,CAAC,qBAAqB,CAAuB;IAEpD,OAAO,CAAC,iBAAiB,CAAI;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAI1B;IAEF;;;;;;;;;;;;;OAaG;IACH,UAAmB,SAAS,gBAwB1B;IAEF;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkD;IAE7E;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;IAEvD;sGACkG;IAClG,OAAO,CAAC,cAAc,CAA2C;IAEjE;;;;OAIG;IACH,OAAO,KAAK,oBAAoB,GAK/B;IAED,SAAS,CAAC,OAAO,IAAI,MAAM,EAAE;IAI7B,OAAO,CAAC,gBAAgB;IAaxB;;;;;OAKG;YACW,mBAAmB;cAwDjB,gCAAgC,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM;cAyE3E,sBAAsB,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASrG;;;;;;;;;OASG;IACH,OAAO,CAAC,iBAAiB;YAkBX,iBAAiB;IAK/B;;;;;;;OAOG;YACW,QAAQ;YA+CR,sBAAsB;IASpC;;;;OAIG;YACW,0BAA0B;cA+BrB,qBAAqB,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,cAAc;cAYnF,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAMjF"}