pnpm-dedup 2.1.0

package/src/displayMany.test.ts

@@ -0,0 +1,208 @@
+import { describe, expect, it } from "bun:test";
+import { ok } from "node:assert/strict";
+import { fileURLToPath } from "node:url";
+import type { ClusterFix } from "pm-dedup-core";
+import { displayMany } from "./displayMany.ts";
+import {
+  buildPnpmPackagesMap,
+  filterDuplicatesPnpmPackagesMap,
+} from "./helpers/buildPnpmPackagesMap.ts";
+import { collectDependentRanges } from "./helpers/collectDependentRanges.ts";
+import { parsePnpmLockPackages } from "./helpers/parsePnpmLockPackages.ts";
+import type { ManifestReader } from "./helpers/readInstalledManifest.ts";
+import { createManifestReader } from "./helpers/readInstalledManifest.ts";
+import { identifyClusterFixes } from "./identifyClusterFixes.ts";
+import { readPnpmLock } from "./readPnpmLock.ts";
+
+const fixturesBase = (rel: string) =>
+  fileURLToPath(new URL(rel, import.meta.url));
+
+// The report layout is covered in pm-dedup-core (`renderDuplicatesReport`); these
+// only check that the pnpm lockfile model is mapped onto it correctly.
+const renderDuplicates = (
+  scenario: string,
+  clusterFixes?: ClusterFix[],
+  readManifest: ManifestReader = () => undefined,
+): string => {
+  const lock = readPnpmLock(
+    fixturesBase(`../test/fixtures/${scenario}/pnpm-lock.yaml`),
+  );
+  const packagesMap = buildPnpmPackagesMap(parsePnpmLockPackages(lock));
+  const duplicates = filterDuplicatesPnpmPackagesMap(packagesMap);
+
+  let buffer = "";
+  displayMany({
+    title: "duplicates",
+    duplicatesPackagesMap: duplicates,
+    dependents: collectDependentRanges(
+      lock,
+      new Set(Object.keys(duplicates)),
+      readManifest,
+    ),
+    totalDependencies: Object.keys(packagesMap).length,
+    clusterFixes,
+    details: true,
+    color: false,
+    log: (message = "") => {
+      buffer += `${message}\n`;
+    },
+  });
+  return buffer;
+};
+
+// `exact-pin-forces-downgrade` commits its virtual store, so the report runs on
+// the real declared ranges: an exact 3.0.3 against expo-camera's `^3.0.0`.
+const downgradeScenario = "exact-pin-forces-downgrade";
+const downgradeDir = fixturesBase(`../test/fixtures/${downgradeScenario}`);
+
+const renderDowngrade = (): string => {
+  const lock = readPnpmLock(`${downgradeDir}/pnpm-lock.yaml`);
+  const readManifest = createManifestReader(downgradeDir);
+  return renderDuplicates(
+    downgradeScenario,
+    identifyClusterFixes(
+      lock,
+      buildPnpmPackagesMap(parsePnpmLockPackages(lock)),
+      readManifest,
+    ),
+    readManifest,
+  );
+};
+
+const lastLine = (output: string): string =>
+  output.trimEnd().split("\n").at(-1)!;
+
+const clusterFix = (overrides: Partial<ClusterFix> = {}): ClusterFix => ({
+  members: ["metro", "metro-config"],
+  duplicatedMembers: ["metro", "metro-config"],
+  memberVersions: {
+    metro: { versions: ["0.84.5", "0.87.0"], nonNpmCount: 0 },
+    "metro-config": { versions: ["0.84.5", "0.87.0"], nonNpmCount: 0 },
+  },
+  target: "0.87.0",
+  direction: "up",
+  convergentMembers: ["metro", "metro-config"],
+  driverMembers: ["metro"],
+  excludedMembers: [],
+  anchor: null,
+  reuseFixes: [],
+  floatingMembers: [],
+  workspaceChanges: [],
+  reResolutionSet: ["metro"],
+  externalConstraints: [],
+  needsRoundTrip: true,
+  applicable: true,
+  ...overrides,
+});
+
+const singletonFix = (overrides: Partial<ClusterFix> = {}): ClusterFix => ({
+  ...clusterFix(),
+  members: ["@babel/code-frame"],
+  duplicatedMembers: ["@babel/code-frame"],
+  memberVersions: {
+    "@babel/code-frame": { versions: ["7.26.2", "7.29.7"], nonNpmCount: 0 },
+  },
+  target: "7.29.7",
+  direction: "up",
+  convergentMembers: ["@babel/code-frame"],
+  driverMembers: ["@babel/code-frame"],
+  reResolutionSet: [],
+  needsRoundTrip: false,
+  ...overrides,
+});
+
+describe("displayMany", () => {
+  it("groups every dependent under the version it resolved to", () => {
+    const output = renderDuplicates("duplicated-babel-frame");
+    ok(output.startsWith("Found "));
+    ok(output.includes("@babel/code-frame — 2 versions"));
+    ok(output.includes('package.json in dependencies  requires "7.26.2"'));
+    // pnpm defers the per-package merge to `pnpm dedupe`
+    ok(!output.includes("can be deduped"));
+  });
+
+  it("renders the printable-shell-command duplicate", () => {
+    const output = renderDuplicates("duplicated-printable-shell-command");
+    ok(output.includes("printable-shell-command — 2 versions"));
+    ok(output.includes("  5.0.7"));
+  });
+
+  it("reports no duplicates for a clean lockfile", () => {
+    expect(renderDuplicates("simple")).toBe(
+      "No duplicates found\n\nFound 1 dependency, 0 duplicates, 0 dedupable.\n",
+    );
+  });
+
+  it("maps a cluster of one to the versions that would collapse", () => {
+    const output = renderDuplicates("duplicated-babel-frame", [singletonFix()]);
+    ok(
+      output.includes(
+        "@babel/code-frame — 2 versions, can be deduped to 7.29.7 (upgrade)",
+      ),
+    );
+    ok(output.includes("  7.26.2  can be deduped to 7.29.7 (upgrade)"));
+    // a lone package is no family, so it gets no cluster section
+    ok(!output.includes("Lockstep clusters:"));
+  });
+
+  it("counts the whole lockfile and names the pnpm command", () => {
+    const output = renderDuplicates("duplicated-babel-frame", [singletonFix()]);
+    ok(
+      lastLine(output).startsWith(
+        "Found 39 dependencies, 1 duplicate, at least 1 dedupable (deduping may remove more). Run `pnpm-dedupe`",
+      ),
+    );
+  });
+
+  it("says nothing collapses when the cluster of one is unfixable", () => {
+    const output = renderDuplicates("duplicated-babel-frame", [
+      singletonFix({
+        target: null,
+        direction: "none",
+        convergentMembers: [],
+        driverMembers: [],
+        applicable: false,
+      }),
+    ]);
+    ok(!output.includes("can be deduped"));
+    ok(lastLine(output).includes("0 dedupable"));
+  });
+
+  it("files a declared range under the version it resolved to", () => {
+    const output = renderDowngrade();
+    ok(
+      output.includes(
+        '    - expo-camera@57.0.3              requires "^3.0.0"',
+      ),
+    );
+    ok(
+      output.includes('    - @yudiel/react-qr-scanner@2.3.1  requires "3.0.3"'),
+    );
+  });
+
+  it("names the downgrade a converging dependent has to take", () => {
+    const output = renderDowngrade();
+    ok(output.includes("  3.2.2  can be deduped to 3.0.3 (downgrade)"));
+    // zxing-wasm cannot converge: `^2.1.2` against an exact 3.1.3
+    ok(lastLine(output).includes("2 duplicates, at least 1 dedupable"));
+  });
+
+  it("forwards the cluster fixes", () => {
+    const output = renderDuplicates("duplicated-babel-frame", [clusterFix()]);
+    ok(output.includes("Lockstep clusters:"));
+    ok(
+      output.includes(
+        "cluster 1 — metro* [2 packages, 2 duplicated, 2 fixable]:",
+      ),
+    );
+    // the family's own members are not in this lockfile's duplicates, so the
+    // count — which follows the listed packages — stays at zero
+    ok(lastLine(output).includes("0 dedupable"));
+  });
+
+  it("renders a cluster from a lockfile with no per-package duplicate", () => {
+    const output = renderDuplicates("simple", [clusterFix()]);
+    ok(output.startsWith("No duplicates found"));
+    ok(output.includes("Lockstep clusters:"));
+  });
+});

package/src/displayMany.ts

@@ -0,0 +1,104 @@
+import { renderDuplicatesReport } from "pm-dedup-core";
+import type {
+  ClusterFix,
+  DuplicateDedupeView,
+  DuplicatePackageView,
+  DuplicatesReportTitle,
+} from "pm-dedup-core";
+import type { PackagesMap } from "./helpers/buildPnpmPackagesMap.ts";
+import type { DependentRangesMap } from "./helpers/collectDependentRanges.ts";
+
+export interface DisplayManyOptions {
+  title: DuplicatesReportTitle;
+  // headline for a report whose packages are not duplicates
+  notice?: string;
+  duplicatesPackagesMap: PackagesMap;
+  // the declared ranges, not the lockfile's resolved versions: the report has
+  // to show what every requester asked for, which is what the fixes reason on
+  dependents: DependentRangesMap;
+  totalDependencies: number;
+  clusterFixes?: ClusterFix[];
+  details?: boolean;
+  color?: boolean;
+  log?: (message?: string) => void;
+}
+
+// A cluster of one is the package's own fix: nothing else converges with it, so
+// it is rendered in the package's block instead of the cluster section.
+const isSingleton = (fix: ClusterFix): boolean => fix.members.length === 1;
+
+const toDedupeViews = (
+  packageName: string,
+  clusterFixes: ClusterFix[],
+): DuplicateDedupeView[] =>
+  clusterFixes
+    .filter(
+      (fix) =>
+        isSingleton(fix) &&
+        fix.members[0] === packageName &&
+        fix.applicable &&
+        fix.target !== null,
+    )
+    .map((fix) => ({
+      // the target is what the copies merge into; the other installed versions
+      // are what goes away
+      from: (fix.memberVersions[packageName]?.versions ?? []).filter(
+        (version) => version !== fix.target,
+      ),
+      to: fix.target!,
+      direction: fix.direction,
+    }))
+    .filter((view) => view.from.length > 0);
+
+const toPackageViews = ({
+  duplicatesPackagesMap,
+  dependents,
+  clusterFixes = [],
+}: DisplayManyOptions): DuplicatePackageView[] =>
+  Object.entries(duplicatesPackagesMap).map(([packageName, resolutions]) => {
+    if (!resolutions) {
+      throw new Error(
+        `Unexpected error: no resolutions found for package ${packageName}`,
+      );
+    }
+
+    return {
+      packageName,
+      resolutions: resolutions.map(
+        ({ resolution, package: pnpmPackage, installations }) => ({
+          resolution,
+          version: pnpmPackage.type === "npm" ? pnpmPackage.version : undefined,
+          installations,
+        }),
+      ),
+      dependents: (dependents.get(packageName) ?? []).map((dependent) => ({
+        // the range alone does not say which declaration it comes from when the
+        // requester reaches the package through a key of another name
+        requester:
+          dependent.aliasKey === undefined
+            ? dependent.key
+            : `${dependent.key} (as "${dependent.aliasKey}")`,
+        range: dependent.range,
+        resolvedVersion: dependent.resolvedVersion,
+        peer: dependent.peer,
+      })),
+      dedupe: toDedupeViews(packageName, clusterFixes),
+    };
+  });
+
+export const displayMany = (options: DisplayManyOptions): void => {
+  renderDuplicatesReport({
+    title: options.title,
+    notice: options.notice,
+    packages: toPackageViews(options),
+    totalDependencies: options.totalDependencies,
+    clusterFixes: (options.clusterFixes ?? []).filter(
+      (fix) => !isSingleton(fix),
+    ),
+    dedupeCommand: "pnpm-dedupe",
+    whyCommand: "pnpm-why-duplicate",
+    details: options.details,
+    color: options.color,
+    log: options.log,
+  });
+};

package/src/helpers/buildIdentifiedFixesMap.test.ts

@@ -0,0 +1,33 @@
+import { describe, it } from "bun:test";
+import { ok, strictEqual } from "node:assert/strict";
+import { buildIdentifiedFixesMap } from "pm-dedup-core";
+import type { PackageResolution, PackagesMap } from "./buildPnpmPackagesMap.ts";
+import type { DependentsMap } from "./collectPnpmDependents.ts";
+
+describe("buildIdentifiedFixesMap", () => {
+  it("builds a map even when there are no fixes", () => {
+    const fakeResolution: PackageResolution = {
+      resolution: "pkg@1.0.0",
+      package: {
+        type: "npm",
+        name: "pkg",
+        resolution: "pkg@1.0.0",
+        version: "1.0.0",
+      },
+      installations: ["pkg@1.0.0"],
+    };
+
+    const duplicates: PackagesMap = {
+      pkg: [fakeResolution],
+    };
+
+    const dependents: DependentsMap = new Map();
+
+    const map = buildIdentifiedFixesMap(duplicates, dependents);
+
+    ok(map instanceof Map);
+    strictEqual(map.has("pkg"), true);
+    strictEqual(Array.isArray(map.get("pkg")), true);
+    strictEqual((map.get("pkg") || []).length, 0);
+  });
+});

package/src/helpers/buildPnpmPackagesMap.test.ts

@@ -0,0 +1,119 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { fileURLToPath } from "node:url";
+import { readPnpmLock } from "../readPnpmLock.ts";
+import {
+  buildPnpmPackagesMap,
+  filterDuplicatesPnpmPackagesMap,
+} from "./buildPnpmPackagesMap.ts";
+import { parsePnpmLockPackages } from "./parsePnpmLockPackages.ts";
+
+const fixturesBase = (rel: string) =>
+  fileURLToPath(new URL(rel, import.meta.url));
+
+const buildFor = (scenario: string) =>
+  buildPnpmPackagesMap(
+    parsePnpmLockPackages(
+      readPnpmLock(
+        fixturesBase(`../../test/fixtures/${scenario}/pnpm-lock.yaml`),
+      ),
+    ),
+  );
+
+const versionsOf = (
+  packagesMap: ReturnType<typeof buildPnpmPackagesMap>,
+  name: string,
+): Set<string> =>
+  new Set(
+    (packagesMap[name] ?? []).map((resolution) => resolution.package.version),
+  );
+
+describe("buildPnpmPackagesMap", () => {
+  it("reports no duplicates for the simple fixture", () => {
+    const packagesMap = buildFor("simple");
+    strictEqual(packagesMap.semver?.length, 1);
+    strictEqual(
+      Object.keys(filterDuplicatesPnpmPackagesMap(packagesMap)).length,
+      0,
+    );
+  });
+
+  it("reports no duplicates for one-dependency-of-dependency", () => {
+    const packagesMap = buildFor("one-dependency-of-dependency");
+    strictEqual(
+      Object.keys(filterDuplicatesPnpmPackagesMap(packagesMap)).length,
+      0,
+    );
+  });
+
+  it("detects the duplicated @babel/code-frame versions", () => {
+    const duplicates = filterDuplicatesPnpmPackagesMap(
+      buildFor("duplicated-babel-frame"),
+    );
+    const versions = versionsOf(duplicates, "@babel/code-frame");
+    strictEqual(versions.size, 2);
+    ok(versions.has("7.26.2"));
+  });
+
+  it("detects the duplicated printable-shell-command versions", () => {
+    const duplicates = filterDuplicatesPnpmPackagesMap(
+      buildFor("duplicated-printable-shell-command"),
+    );
+    ok(duplicates["printable-shell-command"]);
+    strictEqual(duplicates["printable-shell-command"].length, 2);
+  });
+
+  it("detects the metro family a non-reused wildcard duplicated", () => {
+    // `@tamagui/metro-plugin` requests metro-config/metro-transform-worker with
+    // `*`; pnpm resolved them to 0.87.0 instead of reusing the 0.84.5 pulled by
+    // the root `metro: 0.84.5` pin, so the whole family is installed twice.
+    const duplicates = filterDuplicatesPnpmPackagesMap(
+      buildFor("wildcard-not-reused"),
+    );
+    const family = Object.keys(duplicates).filter(
+      (name) => name === "metro" || name.startsWith("metro-"),
+    );
+    strictEqual(family.length, 14);
+    for (const name of family) {
+      deepStrictEqual(
+        versionsOf(duplicates, name),
+        new Set(["0.84.5", "0.87.0"]),
+      );
+    }
+  });
+
+  it("detects at least the known @typescript-eslint duplicates", () => {
+    const duplicates = filterDuplicatesPnpmPackagesMap(
+      buildFor("duplicated-typescript-eslint"),
+    );
+    // Acceptance floor: the set of detected duplicates must include these.
+    const required = [
+      "@typescript-eslint/types",
+      "@typescript-eslint/scope-manager",
+      "@typescript-eslint/utils",
+      "@eslint/plugin-kit",
+    ];
+    for (const name of required) {
+      ok(duplicates[name], `expected ${name} to be detected as duplicate`);
+      strictEqual(duplicates[name].length, 2);
+    }
+    const typesVersions = versionsOf(duplicates, "@typescript-eslint/types");
+    ok(typesVersions.has("8.59.1"));
+    ok(typesVersions.has("8.61.0"));
+  });
+
+  // `aliased-swapped-names`: identity comes from the package id, so the two real
+  // `typescript` copies meet and the `@typescript/typescript6` the `typescript`
+  // key points at stays on its own.
+  it("identifies packages by their id when alias keys are swapped", () => {
+    const duplicates = filterDuplicatesPnpmPackagesMap(
+      buildFor("aliased-swapped-names"),
+    );
+
+    deepStrictEqual(Object.keys(duplicates), ["typescript"]);
+    deepStrictEqual(
+      versionsOf(duplicates, "typescript"),
+      new Set(["5.9.3", "7.0.2"]),
+    );
+  });
+});

package/src/helpers/buildPnpmPackagesMap.ts

@@ -0,0 +1,53 @@
+import type {
+  NpmPackage,
+  Package,
+  ParsedPnpmPackages,
+} from "./parsePnpmLockPackages.ts";
+
+export interface PackageResolution {
+  resolution: string;
+  package: Package;
+  installations: string[];
+}
+
+export interface NpmPackageResolution extends PackageResolution {
+  package: NpmPackage;
+}
+
+export type PackagesMap = Record<string, PackageResolution[]>;
+
+// Several packages can share the same name but different versions (duplicates).
+// When a single resolution is installed in several peer contexts, every context
+// is listed in `installations`.
+export function buildPnpmPackagesMap({
+  packages,
+  installationsByResolution,
+}: ParsedPnpmPackages): PackagesMap {
+  const packagesMap: PackagesMap = {};
+
+  for (const pkg of packages.values()) {
+    if (!packagesMap[pkg.name]) {
+      packagesMap[pkg.name] = [];
+    }
+
+    packagesMap[pkg.name]!.push({
+      resolution: pkg.resolution,
+      package: pkg,
+      installations: installationsByResolution.get(pkg.resolution) ?? [
+        pkg.resolution,
+      ],
+    });
+  }
+
+  return packagesMap;
+}
+
+export function filterDuplicatesPnpmPackagesMap(
+  packagesMap: PackagesMap,
+): PackagesMap {
+  return Object.fromEntries(
+    Object.entries(packagesMap).filter(
+      ([, resolutions]) => resolutions.length > 1,
+    ),
+  );
+}