banhaten 0.1.3 → 0.2.0

package/src/cli/package-manager.js

@@ -0,0 +1,238 @@
+import fs from "node:fs/promises"
+import path from "node:path"
+import { minimatch } from "minimatch"
+import { parse as parseYaml } from "yaml"
+
+const LOCKFILES = [
+  { manager: "pnpm", name: "pnpm-lock.yaml" },
+  { manager: "yarn", name: "yarn.lock" },
+  { manager: "bun", name: "bun.lockb" },
+  { manager: "bun", name: "bun.lock" },
+  { manager: "npm", name: "npm-shrinkwrap.json" },
+  { manager: "npm", name: "package-lock.json" },
+]
+
+export function packageManagerStatePaths(root) {
+  return [
+    path.join(root, "package.json"),
+    path.join(root, "pnpm-workspace.yaml"),
+    ...LOCKFILES.map(({ name }) => path.join(root, name)),
+  ]
+}
+
+export async function inspectPackageManagerContext(cwd) {
+  const context = await resolvePackageManagerContext(cwd)
+  const paths = new Set(
+    context.evidenceRoots.flatMap((root) => packageManagerStatePaths(root))
+  )
+  const evidence = await Promise.all(
+    [...paths].map(async (filePath) => {
+      try {
+        return { path: filePath, source: await fs.readFile(filePath) }
+      } catch (error) {
+        if (error.code === "ENOENT") return { path: filePath, source: null }
+        throw error
+      }
+    })
+  )
+  const confirmedContext = await resolvePackageManagerContext(cwd)
+  if (!samePackageManagerContext(context, confirmedContext)) {
+    throw new Error("package-manager context changed while preparing the install plan")
+  }
+
+  return { context, evidence }
+}
+
+export async function resolvePackageManagerContext(cwd) {
+  const projectRoot = path.resolve(cwd)
+  const localContext = await inspectPackageManagerRoot(projectRoot)
+  const workspace = await findWorkspaceRoot(projectRoot)
+  if (workspace.root) {
+    const workspaceContext = await inspectPackageManagerRoot(workspace.root)
+    if (workspaceContext) {
+      if (
+        localContext &&
+        localContext.manager !== workspaceContext.manager
+      ) {
+        throw new Error(
+          `${projectRoot} declares packageManager "${localContext.manager}", ` +
+            `but its workspace root uses "${workspaceContext.manager}".`
+        )
+      }
+      return withEvidenceRoots(workspaceContext, workspace.evidenceRoots)
+    }
+  }
+
+  if (localContext) {
+    return withEvidenceRoots(localContext, workspace.evidenceRoots)
+  }
+
+  return {
+    evidenceRoots: workspace.evidenceRoots,
+    lockfilePath: null,
+    manager: "npm",
+    root: projectRoot,
+  }
+}
+
+async function inspectPackageManagerRoot(root) {
+  const packageJson = await readJsonIfValid(path.join(root, "package.json"))
+  const declaredManager = parsePackageManager(packageJson?.packageManager)
+
+  if (declaredManager) {
+    const lockfile = await findManagerLockfile(root, declaredManager)
+    return {
+      lockfilePath: lockfile ? path.join(root, lockfile.name) : null,
+      manager: declaredManager,
+      root,
+    }
+  }
+
+  const lockfiles = []
+  for (const lockfile of LOCKFILES) {
+    if (await exists(path.join(root, lockfile.name))) lockfiles.push(lockfile)
+  }
+
+  const managers = new Set(lockfiles.map(({ manager }) => manager))
+  if (managers.size > 1) {
+    throw new Error(
+      `${root} contains lockfiles for multiple package managers. ` +
+        "Remove stale lockfiles or declare packageManager in package.json."
+    )
+  }
+
+  if (lockfiles.length > 0) {
+    return {
+      lockfilePath: path.join(root, lockfiles[0].name),
+      manager: lockfiles[0].manager,
+      root,
+    }
+  }
+
+  return null
+}
+
+async function findWorkspaceRoot(projectRoot) {
+  let directory = projectRoot
+  const evidenceRoots = []
+
+  while (true) {
+    evidenceRoots.push(directory)
+    if (directory !== projectRoot) {
+      if (await isWorkspaceRoot(directory, projectRoot)) {
+        return { evidenceRoots, root: directory }
+      }
+    }
+
+    if (await exists(path.join(directory, ".git"))) {
+      return { evidenceRoots, root: null }
+    }
+
+    const parent = path.dirname(directory)
+    if (parent === directory) return { evidenceRoots, root: null }
+    directory = parent
+  }
+}
+
+function withEvidenceRoots(context, evidenceRoots) {
+  return { ...context, evidenceRoots }
+}
+
+function samePackageManagerContext(left, right) {
+  return left.manager === right.manager &&
+    left.root === right.root &&
+    left.lockfilePath === right.lockfilePath &&
+    left.evidenceRoots.join("\0") === right.evidenceRoots.join("\0")
+}
+
+async function isWorkspaceRoot(candidate, projectRoot) {
+  const relativeProject = path.relative(candidate, projectRoot).replaceAll("\\", "/")
+  const pnpmPatterns = await readPnpmWorkspacePatterns(
+    path.join(candidate, "pnpm-workspace.yaml")
+  )
+  if (pnpmPatterns && workspacePatternsMatch(pnpmPatterns, relativeProject)) {
+    return true
+  }
+
+  const packageJson = await readJsonIfValid(path.join(candidate, "package.json"))
+  const patterns = Array.isArray(packageJson?.workspaces)
+    ? packageJson.workspaces
+    : packageJson?.workspaces?.packages
+
+  if (!Array.isArray(patterns)) return false
+  return workspacePatternsMatch(patterns, relativeProject)
+}
+
+function workspacePatternsMatch(patterns, value) {
+  const validPatterns = patterns.filter(
+    (pattern) => typeof pattern === "string" && pattern.length <= 512
+  )
+  const included = validPatterns
+    .filter((pattern) => !pattern.startsWith("!"))
+    .some((pattern) => workspacePatternMatches(pattern, value))
+  const excluded = validPatterns
+    .filter((pattern) => pattern.startsWith("!"))
+    .some((pattern) => workspacePatternMatches(pattern.slice(1), value))
+
+  return included && !excluded
+}
+
+function workspacePatternMatches(pattern, value) {
+  try {
+    return minimatch(value, pattern.replace(/^\.\//, "").replace(/\/$/, ""), {
+      dot: true,
+      nocomment: true,
+      nonegate: true,
+    })
+  } catch {
+    return false
+  }
+}
+
+async function readPnpmWorkspacePatterns(filePath) {
+  try {
+    const workspace = parseYaml(await fs.readFile(filePath, "utf8"))
+    return Array.isArray(workspace?.packages) ? workspace.packages : null
+  } catch (error) {
+    if (error.code === "ENOENT" || error.name === "YAMLParseError") return null
+    throw error
+  }
+}
+
+async function findManagerLockfile(root, manager) {
+  for (const lockfile of LOCKFILES) {
+    if (
+      lockfile.manager === manager &&
+      await exists(path.join(root, lockfile.name))
+    ) {
+      return lockfile
+    }
+  }
+
+  return null
+}
+
+async function readJsonIfValid(filePath) {
+  try {
+    return JSON.parse(await fs.readFile(filePath, "utf8"))
+  } catch (error) {
+    if (error.code === "ENOENT" || error instanceof SyntaxError) return null
+    throw error
+  }
+}
+
+async function exists(filePath) {
+  try {
+    await fs.access(filePath)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function parsePackageManager(packageManager) {
+  if (typeof packageManager !== "string") return null
+
+  const name = packageManager.split("@")[0]
+  return ["npm", "pnpm", "yarn", "bun"].includes(name) ? name : null
+}

package/src/cli/package-plan.js

@@ -0,0 +1,185 @@
+import {
+  findPackageDependencies,
+  reconcileDependencyRange,
+} from "./package-version.js"
+
+const DEPENDENCY_SECTIONS = [
+  "dependencies",
+  "devDependencies",
+  "peerDependencies",
+  "optionalDependencies",
+]
+
+export function createPackageDependencyPlan(packageJson, changes) {
+  if (!packageJson || typeof packageJson !== "object" || Array.isArray(packageJson)) {
+    throw new Error("package.json root must be an object.")
+  }
+  validatePackageDependencySections(packageJson)
+  const requirements = collectPackageRequirements(changes)
+  const operations = []
+
+  for (const requirement of requirements.values()) {
+    const declarations = findPackageDependencies(packageJson, requirement.name)
+
+    if (declarations.length === 0) {
+      operations.push({
+        kind: "add",
+        name: requirement.name,
+        range: requirement.range,
+        section: requirement.section,
+      })
+      continue
+    }
+
+    for (const declaration of declarations) {
+      const resolution = reconcileDependencyRange(
+        declaration.version,
+        requirement.range
+      )
+      assertDependencyResolution(
+        requirement.name,
+        declaration,
+        requirement.range,
+        resolution
+      )
+
+      if (resolution.status === "strengthened") {
+        operations.push({
+          kind: "strengthen",
+          name: requirement.name,
+          range: resolution.range,
+          section: declaration.section,
+        })
+      }
+    }
+  }
+
+  return {
+    operations,
+    requirements: [...requirements.values()],
+  }
+}
+
+export function applyPackageDependencyPlan(packageJson, operations) {
+  const touchedSections = new Set()
+
+  for (const operation of operations) {
+    const dependencies = packageJson[operation.section] || {}
+    dependencies[operation.name] = operation.range
+    packageJson[operation.section] = dependencies
+    touchedSections.add(operation.section)
+  }
+
+  for (const section of touchedSections) {
+    packageJson[section] = sortObject(packageJson[section])
+  }
+}
+
+export function mergeDependencyRequirements(target, incoming, source) {
+  for (const [name, range] of Object.entries(incoming)) {
+    if (!Object.hasOwn(target, name)) {
+      target[name] = range
+      continue
+    }
+
+    const resolution = reconcileDependencyRange(target[name], range)
+    if (resolution.status === "satisfied") continue
+    if (resolution.status === "strengthened") {
+      target[name] = resolution.range
+      continue
+    }
+
+    throw new Error(
+      `${source} declares dependency "${name}" as "${range}", which cannot be combined safely with "${target[name]}".`
+    )
+  }
+}
+
+function collectPackageRequirements(changes) {
+  const requirements = new Map()
+
+  for (const section of ["dependencies", "devDependencies"]) {
+    for (const [name, range] of Object.entries(changes[section] || {})) {
+      const validation = reconcileDependencyRange(range, range)
+      if (validation.status === "invalid-required") {
+        throw new Error(
+          `Banhaten declares an invalid semantic version range for "${name}": "${range}".`
+        )
+      }
+
+      const current = requirements.get(name)
+      if (!current) {
+        requirements.set(name, { name, range, section })
+        continue
+      }
+
+      if (section === "dependencies") current.section = section
+
+      const resolution = reconcileDependencyRange(current.range, range)
+      if (resolution.status === "satisfied") continue
+      if (resolution.status === "strengthened") {
+        current.range = resolution.range
+        continue
+      }
+
+      throw new Error(
+        `Banhaten registry dependency conflict for "${name}": ` +
+          `"${current.range}" and "${range}" cannot be combined safely.`
+      )
+    }
+  }
+
+  return requirements
+}
+
+function validatePackageDependencySections(packageJson) {
+  for (const section of DEPENDENCY_SECTIONS) {
+    const dependencies = packageJson[section]
+    if (
+      dependencies !== undefined &&
+      (!dependencies ||
+        typeof dependencies !== "object" ||
+        Array.isArray(dependencies))
+    ) {
+      throw new Error(`package.json ${section} must be an object.`)
+    }
+  }
+}
+
+function assertDependencyResolution(name, declaration, requiredRange, resolution) {
+  if (resolution.status === "satisfied" || resolution.status === "strengthened") {
+    return
+  }
+
+  if (resolution.status === "unsupported") {
+    throw new Error(
+      `dependency version conflict for "${name}": ${declaration.section} declares unsupported non-semver spec ` +
+        `"${declaration.version}", but Banhaten requires "${requiredRange}".`
+    )
+  }
+
+  if (resolution.status === "partial-overlap") {
+    throw new Error(
+      `dependency range conflict for "${name}": ${declaration.section} declares "${declaration.version}", ` +
+        `which only partially overlaps Banhaten's required "${requiredRange}". ` +
+        "Declare a range contained by both requirements."
+    )
+  }
+
+  if (resolution.status === "invalid-required") {
+    throw new Error(
+      `Banhaten declares an invalid semantic version range for "${name}": "${requiredRange}".`
+    )
+  }
+
+  throw new Error(
+    `dependency version conflict for "${name}": ${declaration.section} declares "${declaration.version}", ` +
+      `but Banhaten requires "${requiredRange}".`
+  )
+}
+
+function sortObject(value) {
+  return Object.fromEntries(
+    Object.entries(value).sort(([left], [right]) => left.localeCompare(right))
+  )
+}

package/src/cli/package-version.js

@@ -0,0 +1,97 @@
+import semver from "semver"
+
+const DEPENDENCY_SECTIONS = [
+  "dependencies",
+  "devDependencies",
+  "peerDependencies",
+  "optionalDependencies",
+]
+
+export function findPackageDependencies(packageJson, name) {
+  const declarations = []
+
+  for (const section of DEPENDENCY_SECTIONS) {
+    const dependencies = packageJson[section]
+    if (
+      dependencies &&
+      typeof dependencies === "object" &&
+      !Array.isArray(dependencies) &&
+      Object.hasOwn(dependencies, name)
+    ) {
+      declarations.push({
+        section,
+        version: dependencies[name],
+      })
+    }
+  }
+
+  return declarations
+}
+
+export function reconcileDependencyRange(declaredRange, requiredRange) {
+  const required = parseRange(requiredRange)
+  if (required.status !== "valid") {
+    return {
+      status: "invalid-required",
+      range: requiredRange,
+    }
+  }
+
+  const declared = parseRange(declaredRange)
+  if (declared.status === "invalid") {
+    return {
+      status: "unsupported",
+      range: declaredRange,
+    }
+  }
+  if (declared.status === "empty") {
+    return {
+      status: "conflict",
+      range: declaredRange,
+    }
+  }
+
+  if (semver.subset(declared.range, required.range)) {
+    return {
+      status: "satisfied",
+      range: declaredRange,
+    }
+  }
+
+  if (semver.subset(required.range, declared.range)) {
+    return {
+      status: "strengthened",
+      range: requiredRange.trim(),
+    }
+  }
+
+  if (semver.intersects(declared.range, required.range)) {
+    return {
+      status: "partial-overlap",
+      range: declaredRange,
+    }
+  }
+
+  return {
+    status: "conflict",
+    range: declaredRange,
+  }
+}
+
+export function dependencyVersionSatisfies(version, requiredRange) {
+  if (typeof version !== "string" || semver.valid(version) === null) return false
+  const required = parseRange(requiredRange)
+  if (required.status !== "valid") return false
+  return semver.satisfies(version, required.range)
+}
+
+function parseRange(value) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    return { status: "invalid" }
+  }
+  if (semver.validRange(value) === null) return { status: "invalid" }
+
+  const range = new semver.Range(value)
+  if (semver.minVersion(range) === null) return { status: "empty" }
+  return { range, status: "valid" }
+}