cabloy 5.1.220 → 5.1.222

package/zova/packages-cli/cli-set-front/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-cli-set-front",
-  "version": "1.2.114",
+  "version": "1.2.116",
   "gitHead": "6f675a8cc46d596142c591c28a40cc4d82fcc6cc",
   "description": "zova cli-set-front",
   "keywords": [
@@ -41,7 +41,7 @@
     "@babel/plugin-proposal-decorators": "^7.29.0",
     "@babel/plugin-transform-class-properties": "^7.28.6",
     "@babel/plugin-transform-typescript": "^7.28.6",
-    "@cabloy/cli": "^3.1.29",
+    "@cabloy/cli": "^3.1.30",
     "@cabloy/extend": "^3.2.8",
     "@cabloy/module-info": "^2.0.3",
     "@cabloy/openapi-typescript": "^7.9.2",

package/zova/packages-cli/cli-set-front/src/lib/common/restDependencyVersions.ts

@@ -29,7 +29,7 @@ export async function extractRestDependencyVersions(
 ): Promise<Record<string, string>> {
   const lockfilePath = path.join(projectPath, 'pnpm-lock.yaml');
   const lockfileContent = await fse.readFile(lockfilePath, 'utf8');
-  const parsedLockfile = yaml.parse(lockfileContent) as ParsedLockfile;
+  const parsedLockfile = parseWorkspaceLockfile(lockfileContent);
   const depsVersion: Record<string, string> = {};
 
   for (const dep of deps) {
@@ -66,6 +66,27 @@ export async function extractRestDependencyVersions(
   return depsVersion;
 }
 
+function parseWorkspaceLockfile(content: string): ParsedLockfile {
+  const documents = yaml.parseAllDocuments(content);
+  for (const document of documents) {
+    if (document.errors.length) throw document.errors[0];
+  }
+
+  // pnpm 12 places the workspace lock after its package-manager/config dependency lock.
+  const document = documents.findLast(({ contents }) => {
+    return (
+      contents !== null &&
+      !(yaml.isScalar(contents) && contents.value === null && contents.source === '')
+    );
+  });
+  if (!document || !yaml.isMap(document.contents) || !yaml.isMap(document.get('importers', true))) {
+    throw new Error(
+      'Invalid pnpm-lock.yaml: expected a workspace document with an importers mapping.',
+    );
+  }
+  return document.toJS() as ParsedLockfile;
+}
+
 function getPackageDependencyRangeFromLock(
   parsedLockfile: ParsedLockfile,
   packageName: string,

package/zova/packages-cli/cli-set-front/test/restDependencies.test.ts

@@ -238,6 +238,143 @@ import Alias = Existing.Value;
 });
 
 describe('extractRestDependencyVersions', () => {
+  const managementLockfile = `---
+lockfileVersion: '9.0'
+importers:
+  .:
+    configDependencies: {}
+    packageManagerDependencies:
+      pnpm:
+        specifier: 12.14.0
+        version: 12.14.0
+    dependencies:
+      root-package:
+        version: 99.0.0
+      management-only:
+        version: 99.0.0
+`;
+  const workspaceLockfile = `lockfileVersion: '9.0'
+importers:
+  .:
+    dependencies:
+      root-package:
+        version: 1.2.3
+      alias-package:
+        specifier: npm:@scope/package@^2.0.0
+        version: '@scope/package@2.0.4'
+  src/module/example:
+    dependencies:
+      owned-package:
+        version: 3.1.7(vue@3.5.42)
+`;
+
+  for (const trailingDocument of ['', '---\n# empty document\n']) {
+    it(`uses the workspace document of a pnpm 12 lockfile${trailingDocument ? ' with a trailing empty document' : ''}`, async () => {
+      await withFixture(async projectPath => {
+        await writeLockfile(
+          projectPath,
+          `${managementLockfile}---\n${workspaceLockfile}${trailingDocument}`,
+        );
+        assert.deepEqual(
+          await extractRestDependencyVersions(
+            projectPath,
+            ['root-package', 'alias-package', 'owned-package'],
+            ['src/module/example'],
+          ),
+          {
+            'root-package': '^1.2.3',
+            'alias-package': 'npm:@scope/package@^2.0.0',
+            'owned-package': '^3.1.7',
+          },
+        );
+        for (const dependency of ['management-only', 'pnpm']) {
+          await assert.rejects(
+            extractRestDependencyVersions(projectPath, [dependency]),
+            /Unable to resolve REST dependency version/,
+          );
+        }
+      });
+    });
+  }
+
+  it('accepts a single workspace document with an explicit start marker', async () => {
+    await withFixture(async projectPath => {
+      await writeLockfile(projectPath, `---\n${workspaceLockfile}`);
+      assert.deepEqual(await extractRestDependencyVersions(projectPath, ['root-package']), {
+        'root-package': '^1.2.3',
+      });
+    });
+  });
+
+  for (const [label, invalidDocument, code] of [
+    ['malformed YAML', 'importers: [\n', 'BAD_INDENT'],
+    ['duplicate keys', 'importers: {}\nimporters: {}\n', 'DUPLICATE_KEY'],
+  ]) {
+    for (const position of ['management', 'workspace']) {
+      it(`rejects ${label} in the ${position} document before installed-package fallback`, async () => {
+        await withFixture(async projectPath => {
+          const content =
+            position === 'management'
+              ? `${invalidDocument}---\n${workspaceLockfile}`
+              : `${managementLockfile}---\n${invalidDocument}`;
+          await writeLockfile(projectPath, content);
+          await writePackage(projectPath, 'node_modules/root-package', { version: '5.0.0' });
+          await assert.rejects(extractRestDependencyVersions(projectPath, ['root-package']), {
+            name: 'YAMLParseError',
+            code,
+          });
+        });
+      });
+    }
+  }
+
+  for (const [label, invalidDocument] of [
+    ['empty', ''],
+    ['comment-only', '# no lockfile\n'],
+    ['empty marked', '---\n# no lockfile\n'],
+    ['null', 'null\n'],
+    ['tilde null', '~\n'],
+    ['empty string', '""\n'],
+    ['scalar', 'invalid\n'],
+    ['sequence', '- invalid\n'],
+    ['missing importers', "lockfileVersion: '9.0'\n"],
+    ['null importers', 'importers: null\n'],
+    ['scalar importers', 'importers: invalid\n'],
+    ['sequence importers', 'importers: []\n'],
+  ]) {
+    it(`rejects a ${label} workspace document`, async () => {
+      await withFixture(async projectPath => {
+        await writePackage(projectPath, 'node_modules/root-package', { version: '5.0.0' });
+        await writeLockfile(projectPath, invalidDocument);
+        await assert.rejects(
+          extractRestDependencyVersions(projectPath, ['root-package']),
+          /Invalid pnpm-lock.yaml: expected a workspace document with an importers mapping/,
+        );
+        if (
+          invalidDocument.trim() &&
+          !invalidDocument.startsWith('#') &&
+          !invalidDocument.startsWith('---')
+        ) {
+          await writeLockfile(projectPath, `${workspaceLockfile}---\n${invalidDocument}`);
+          await assert.rejects(
+            extractRestDependencyVersions(projectPath, ['root-package']),
+            /Invalid pnpm-lock.yaml: expected a workspace document with an importers mapping/,
+          );
+        }
+      });
+    });
+  }
+
+  it('allows installed-package fallback with an empty workspace importer map', async () => {
+    await withFixture(async projectPath => {
+      await writeLockfile(projectPath, `${managementLockfile}---\nimporters: {}\n`);
+      await writePackage(projectPath, 'node_modules/root-package', { version: '5.0.0' });
+      assert.deepEqual(await extractRestDependencyVersions(projectPath, ['root-package']), {
+        'root-package': '^5.0.0',
+      });
+    });
+  });
+
   it('uses the root importer range when the dependency is declared there', async () => {
     await withFixture(async projectPath => {
       await writeLockfile(

package/zova/packages-zova/zova/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova",
-  "version": "5.1.172",
+  "version": "5.1.173",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A vue3 framework with ioc",
   "keywords": [
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "zova-core": "^5.1.93",
-    "zova-suite-a-zova": "^5.1.171"
+    "zova-suite-a-zova": "^5.1.172"
   },
   "devDependencies": {
     "clean-package": "^2.2.0",