fulmine.js 5.19.9 → 5.20.0

package/src/verify.js

@@ -29,6 +29,7 @@ limitations under the License.
 
 const fs = require("fs");
 const path = require("path");
+const { detectManager, UWS_SPEC, UWS_OVERRIDE } = require("./adopt.js");
 
 // The oldest glibc the pinned uWS binaries are built against. A runtime older than this loads the
 // file and then fails on a symbol, which is a worse error than not finding it at all.
@@ -251,6 +252,20 @@ function checkDockerfiles(dir) {
     return results;
 }
 
+/**
+ * The project's package.json, or nothing where there is none to read.
+ *
+ * @param {string} dir
+ * @returns {any}
+ */
+function readPackage(dir) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+    } catch {
+        return undefined;
+    }
+}
+
 /**
  * The dependencies that need a different API here. Read from package.json rather than from
  * node_modules, so a project is answered before it installs anything.
@@ -261,12 +276,8 @@ function checkDockerfiles(dir) {
 function checkDependencies(dir) {
     /** @type {ReturnType<typeof result>[]} */
     const results = [];
-    let pkg;
-    try {
-        pkg = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
-    } catch {
-        return results;
-    }
+    const pkg = readPackage(dir);
+    if (!pkg) return results;
     const installed = { ...pkg.dependencies, ...pkg.devDependencies };
     for (const name of Object.keys(NEEDS_A_LOOK)) {
         if (installed[name]) {
@@ -276,6 +287,83 @@ function checkDependencies(dir) {
     return results;
 }
 
+// pnpm refuses a git dependency of a dependency since this version, and µWebSockets.js is one
+const PNPM_BLOCKS_GIT_SUBDEPS = [10, 26];
+
+/**
+ * Whether the package manager will install this at all. pnpm 10.26 and later refuse a dependency
+ * of a dependency that comes from git, which µWebSockets.js does, so `pnpm add fulmine.js` fails
+ * before anything runs. What lets it through is readable from the project: the two lines
+ * `npx fulmine.js pnpm` writes, the setting turned off, or an override taking µWebSockets.js from
+ * a registry. pnpm 11 reads its settings from pnpm-workspace.yaml only, so that is what is read.
+ *
+ * @param {string} dir
+ * @param {any} pkg the parsed package.json
+ * @returns {ReturnType<typeof result>|undefined} nothing to say for npm and yarn
+ */
+function checkPackageManager(dir, pkg) {
+    const { manager, why } = detectManager(dir, pkg);
+    if (manager !== "pnpm") return undefined;
+
+    const declared = /^pnpm@(\d+)\.(\d+)/.exec(pkg.packageManager ?? "");
+    if (declared) {
+        const [major, minor] = [Number(declared[1]), Number(declared[2])];
+        const [blockMajor, blockMinor] = PNPM_BLOCKS_GIT_SUBDEPS;
+        if (major < blockMajor || (major === blockMajor && minor < blockMinor)) {
+            return result("ok", `pnpm ${declared[1]}.${declared[2]} installs a git dependency of a dependency`);
+        }
+    }
+
+    let workspace = "";
+    try {
+        workspace = fs.readFileSync(path.join(dir, "pnpm-workspace.yaml"), "utf8");
+    } catch {
+        // no workspace file, so every setting is at its default
+    }
+
+    // the recipe: the project owns the git dependency, and the copy this package asks for is dropped
+    const dropped = new RegExp(`^\\s*["']?${UWS_OVERRIDE.replace(/\./g, "\\.")}["']?:\\s*["']?-["']?\\s*$`, "m").test(
+        workspace
+    );
+    const own = pkg.dependencies?.["uWebSockets.js"];
+    if (dropped && typeof own === "string") {
+        if (own === UWS_SPEC) {
+            return result(
+                "ok",
+                "pnpm, with µWebSockets.js as the project's own dependency at the pin this package uses"
+            );
+        }
+        return result(
+            "note",
+            `pnpm, with µWebSockets.js as the project's own dependency at ${own}`,
+            `this package pins ${UWS_SPEC} and was tested against it. \`npx fulmine.js pnpm\` writes the pin.`
+        );
+    }
+    if (dropped) {
+        return result(
+            "no",
+            "pnpm-workspace.yaml drops µWebSockets.js from this package, and the project does not declare it",
+            `nothing would install it. \`npx fulmine.js pnpm\` adds "uWebSockets.js": "${UWS_SPEC}" to dependencies.`
+        );
+    }
+
+    if (/^\s*blockExoticSubdeps:\s*false\s*$/m.test(workspace)) {
+        return result("ok", "pnpm, with blockExoticSubdeps off in pnpm-workspace.yaml");
+    }
+    const registry = /^\s*["']?uWebSockets\.js["']?:\s*["']?([~^]?\d[^"'\s]*)/m.exec(workspace);
+    if (registry) {
+        return result("ok", `pnpm, with µWebSockets.js overridden to ${registry[1]} from a registry`);
+    }
+
+    return result(
+        "no",
+        `pnpm (${why}) will refuse to install this`,
+        "pnpm 10.26 and later block a git dependency of a dependency, and µWebSockets.js is one:\n" +
+            "        pnpm add fulmine.js fails with ERR_PNPM_EXOTIC_SUBDEP. `npx fulmine.js pnpm` writes the two\n" +
+            "        lines that let it through, see docs/deployment.md."
+    );
+}
+
 /**
  * Runs every check and prints the report. Anything that would stop the application from starting
  * is a failure and the command exits non-zero, so it can be a step in a pipeline.
@@ -292,6 +380,10 @@ function verify(argv) {
         results.push(libc);
     }
     results.push(checkBinary(), ...checkDockerfiles(dir), ...checkDependencies(dir));
+    const manager = checkPackageManager(dir, readPackage(dir) ?? {});
+    if (manager) {
+        results.push(manager);
+    }
 
     console.log(`\nWhether this machine and this project can run fulmine.js\n`);
     const label = { ok: "ok  ", note: "note", no: "NO  " };
@@ -312,4 +404,13 @@ function verify(argv) {
     return blocking === 0 ? 0 : 1;
 }
 
-module.exports = { verify, checkNode, checkLibc, currentGlibc, checkBinary, checkDockerfiles, checkDependencies };
+module.exports = {
+    verify,
+    checkNode,
+    checkLibc,
+    currentGlibc,
+    checkBinary,
+    checkDockerfiles,
+    checkDependencies,
+    checkPackageManager
+};