pnpm-dedup 2.1.0

package/src/helpers/duplicateSnapshot.ts

@@ -0,0 +1,18 @@
+import type { DuplicateSnapshot } from "pm-dedup-core";
+import { readPnpmLock } from "../readPnpmLock.ts";
+import {
+  buildPnpmPackagesMap,
+  filterDuplicatesPnpmPackagesMap,
+} from "./buildPnpmPackagesMap.ts";
+import { parsePnpmLockPackages } from "./parsePnpmLockPackages.ts";
+
+export const readDuplicateSnapshot = (lockPath: string): DuplicateSnapshot =>
+  new Set(
+    Object.values(
+      filterDuplicatesPnpmPackagesMap(
+        buildPnpmPackagesMap(parsePnpmLockPackages(readPnpmLock(lockPath))),
+      ),
+    ).flatMap((resolutions) =>
+      resolutions.map((resolution) => resolution.resolution),
+    ),
+  );

package/src/helpers/parsePnpmLockPackages.test.ts

@@ -0,0 +1,93 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { fileURLToPath } from "node:url";
+import { readPnpmLock } from "../readPnpmLock.ts";
+import {
+  parsePackageId,
+  parsePnpmLockPackages,
+} from "./parsePnpmLockPackages.ts";
+
+const fixturesBase = (rel: string) =>
+  fileURLToPath(new URL(rel, import.meta.url));
+
+const readFixture = (scenario: string) =>
+  readPnpmLock(fixturesBase(`../../test/fixtures/${scenario}/pnpm-lock.yaml`));
+
+describe("parsePackageId", () => {
+  it("parses an unscoped id", () => {
+    deepStrictEqual(parsePackageId("semver@7.7.3"), {
+      name: "semver",
+      version: "7.7.3",
+    });
+  });
+
+  it("parses a scoped id", () => {
+    deepStrictEqual(parsePackageId("@babel/code-frame@7.26.2"), {
+      name: "@babel/code-frame",
+      version: "7.26.2",
+    });
+  });
+
+  it("strips the peer-dependency suffix", () => {
+    deepStrictEqual(
+      parsePackageId(
+        "@typescript-eslint/utils@8.61.0(eslint@10.5.0)(typescript@6.0.3)",
+      ),
+      { name: "@typescript-eslint/utils", version: "8.61.0" },
+    );
+  });
+
+  it("keeps a non-registry url as the version", () => {
+    const parsed = parsePackageId(
+      "zod@https://codeload.github.com/colinhacks/zod/tar.gz/ca42965df46b2f7e2747db29c40a26bcb32a51d5",
+    );
+    strictEqual(parsed.name, "zod");
+    strictEqual(parsed.version.startsWith("https://"), true);
+  });
+});
+
+describe("parsePnpmLockPackages", () => {
+  it("parses the simple fixture (single npm package)", () => {
+    const { packages } = parsePnpmLockPackages(readFixture("simple"));
+    strictEqual(packages.size, 1);
+    const semver = packages.get("semver@7.7.3");
+    strictEqual(semver?.type, "npm");
+    strictEqual(semver.name, "semver");
+    strictEqual(semver.version, "7.7.3");
+  });
+
+  it("parses both duplicated @babel/code-frame versions as npm", () => {
+    const { packages } = parsePnpmLockPackages(
+      readFixture("duplicated-babel-frame"),
+    );
+    const codeFrames = [...packages.values()].filter(
+      (pkg) => pkg.name === "@babel/code-frame",
+    );
+    strictEqual(codeFrames.length, 2);
+    ok(codeFrames.every((pkg) => pkg.type === "npm"));
+    const versions = new Set(codeFrames.map((pkg) => pkg.version));
+    ok(versions.has("7.26.2"));
+    ok(versions.size === 2);
+  });
+
+  it("classifies non-registry resolutions as other, registry tarballs as npm", () => {
+    const { packages } = parsePnpmLockPackages(readFixture("non-npm"));
+    const byName = new Map(
+      [...packages.values()].map((pkg) => [pkg.name, pkg]),
+    );
+    strictEqual(byName.get("react")?.type, "npm");
+    strictEqual(byName.get("zod")?.type, "other");
+  });
+
+  it("groups peer-context snapshots into installations", () => {
+    const { installationsByResolution } = parsePnpmLockPackages(
+      readFixture("duplicated-typescript-eslint"),
+    );
+    const utils = installationsByResolution.get(
+      "@typescript-eslint/utils@8.61.0",
+    );
+    ok(utils);
+    ok(utils.length > 0);
+    ok(utils.every((key) => key.startsWith("@typescript-eslint/utils@8.61.0")));
+  });
+});

package/src/helpers/parsePnpmLockPackages.ts

@@ -0,0 +1,99 @@
+import type { PnpmLockFile } from "../pnpmLockTypes.ts";
+
+export interface NpmPackage {
+  type: "npm";
+  name: string;
+  version: string;
+  resolution: string;
+}
+
+export interface OtherPackage {
+  type: "other";
+  name: string;
+  version: string;
+  resolution: string;
+}
+
+export type Package = NpmPackage | OtherPackage;
+
+export type PnpmLockPackages = Map<string, Package>;
+
+export interface ParsedPnpmPackages {
+  packages: PnpmLockPackages;
+  installationsByResolution: Map<string, string[]>;
+}
+
+/**
+ * Strip a pnpm peer-dependency suffix (everything from the first `(`).
+ *
+ * eg `@scope/name@1.2.3(eslint@9)(typescript@5)` -> `@scope/name@1.2.3`
+ */
+export const stripPeerSuffix = (id: string): string => {
+  const parenPos = id.indexOf("(");
+  return parenPos === -1 ? id : id.slice(0, parenPos);
+};
+
+/**
+ * Parse a pnpm package id (`name@version`, optionally peer-suffixed) into its
+ * name and version. Handles scoped names (`@scope/name@1.2.3`).
+ */
+export const parsePackageId = (
+  id: string,
+): { name: string; version: string } => {
+  const base = stripPeerSuffix(id);
+  const atPos = base.lastIndexOf("@");
+  if (atPos <= 0) {
+    return { name: base, version: "" };
+  }
+  return { name: base.slice(0, atPos), version: base.slice(atPos + 1) };
+};
+
+const isNpmVersion = (version: string): boolean => {
+  return /^\d/.test(version);
+};
+
+/**
+ * Resolve a snapshot dependency entry. The value is either a resolved version
+ * (`1.2.3`, possibly peer-suffixed) for which the key is the real npm name, or
+ * an aliased `realName@version` form when the key is a local alias.
+ */
+export const resolveSnapshotDependency = (
+  depName: string,
+  depValue: string,
+): { name: string; version: string } => {
+  const stripped = stripPeerSuffix(depValue);
+  if (isNpmVersion(stripped)) {
+    return { name: depName, version: stripped };
+  }
+  const { name, version } = parsePackageId(stripped);
+  return { name: name || depName, version };
+};
+
+export const parsePnpmLockPackages = (
+  lock: PnpmLockFile,
+): ParsedPnpmPackages => {
+  const packages: PnpmLockPackages = new Map();
+
+  for (const resolution of Object.keys(lock.packages ?? {})) {
+    const { name, version } = parsePackageId(resolution);
+    packages.set(resolution, {
+      type: isNpmVersion(version) ? "npm" : "other",
+      name,
+      version,
+      resolution,
+    });
+  }
+
+  const installationsByResolution = new Map<string, string[]>();
+  for (const snapshotKey of Object.keys(lock.snapshots ?? {})) {
+    const baseId = stripPeerSuffix(snapshotKey);
+    const installations = installationsByResolution.get(baseId);
+    if (installations) {
+      installations.push(snapshotKey);
+    } else {
+      installationsByResolution.set(baseId, [snapshotKey]);
+    }
+  }
+
+  return { packages, installationsByResolution };
+};

package/src/helpers/pnpmProtocol.ts

@@ -0,0 +1,12 @@
+export type PnpmProtocol =
+  | "catalog"
+  | "file"
+  | "git"
+  | "git+file"
+  | "git+https"
+  | "git+ssh"
+  | "github"
+  | "https"
+  | "link"
+  | "npm"
+  | "workspace";

package/src/helpers/pnpmVersion.ts

@@ -0,0 +1,28 @@
+import semver from "semver";
+import { runPnpm } from "./runPnpm.ts";
+import type { PnpmRunner } from "./runPnpm.ts";
+
+/**
+ * Convergence overrides (`overrides: { "pkg@": "1.2.3" }`, empty range selector)
+ * landed in pnpm 11.13.0. They rewrite a dependency edge only when the declared
+ * range accepts the exact version, which is what lets a cluster converge without
+ * forcing the members a third-party range legitimately pins elsewhere.
+ */
+export const convergenceOverridesMinVersion = "11.13.0";
+
+export const readPnpmVersion = (run: PnpmRunner = runPnpm): string | null => {
+  const result = run(["--version"], { stdio: "pipe" });
+  if (result.status !== 0) return null;
+  // pnpm prints its warnings (a `workspaces` field in package.json, an update
+  // notice) into the same captured output, so the version is the last line that
+  // is one, not the last line.
+  return (
+    result.output
+      .split("\n")
+      .map((line) => line.trim())
+      .findLast((line) => semver.valid(line) !== null) ?? null
+  );
+};
+
+export const supportsConvergenceOverrides = (version: string): boolean =>
+  semver.gte(version, convergenceOverridesMinVersion);

package/src/helpers/pnpmWorkspaceYaml.test.ts

@@ -0,0 +1,140 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, strictEqual } from "node:assert/strict";
+import {
+  addOverrides,
+  overrideKey,
+  readConvergenceOverrides,
+} from "./pnpmWorkspaceYaml.ts";
+
+const overrides = (entries: [string, string][]) => new Map(entries);
+
+describe("pnpmWorkspaceYaml", () => {
+  it("uses the empty range selector pnpm reads as a convergence override", () => {
+    strictEqual(overrideKey("metro-config", true), "metro-config@");
+    strictEqual(
+      overrideKey("@react-native/metro-config", true),
+      "@react-native/metro-config@",
+    );
+    strictEqual(overrideKey("metro-config", false), "metro-config");
+  });
+
+  it("creates the file content when there is none", () => {
+    strictEqual(
+      addOverrides(undefined, overrides([["metro-config", "0.87.0"]])),
+      'overrides:\n  "metro-config@": "0.87.0"\n',
+    );
+  });
+
+  it("keeps comments, sibling keys and formatting", () => {
+    const content = [
+      "# why this repo pins its resolution mode",
+      "resolutionMode: time-based # inline",
+      "",
+      "packages:",
+      "  - packages/*",
+      "",
+      "# trailing note",
+      "",
+    ].join("\n");
+
+    strictEqual(
+      addOverrides(content, overrides([["metro", "0.84.5"]])),
+      [
+        "# why this repo pins its resolution mode",
+        "resolutionMode: time-based # inline",
+        "",
+        "packages:",
+        "  - packages/*",
+        "overrides:",
+        '  "metro@": "0.84.5"',
+        "",
+        "# trailing note",
+        "",
+      ].join("\n"),
+    );
+  });
+
+  it("adds to an existing overrides block without touching its entries", () => {
+    const content = [
+      "overrides:",
+      "  # a decision taken elsewhere",
+      '  "foo@": "1.0.0"',
+      "resolutionMode: time-based",
+      "",
+    ].join("\n");
+
+    strictEqual(
+      addOverrides(content, overrides([["bar", "2.0.0"]])),
+      [
+        "overrides:",
+        "  # a decision taken elsewhere",
+        '  "foo@": "1.0.0"',
+        '  "bar@": "2.0.0"',
+        "resolutionMode: time-based",
+        "",
+      ].join("\n"),
+    );
+  });
+
+  it("quotes the scoped keys and the versions yaml would read as numbers", () => {
+    strictEqual(
+      addOverrides(
+        undefined,
+        overrides([
+          ["@react-native/metro-config", "0.87.0"],
+          ["single-digit", "4"],
+        ]),
+      ),
+      [
+        "overrides:",
+        '  "@react-native/metro-config@": "0.87.0"',
+        '  "single-digit@": "4"',
+        "",
+      ].join("\n"),
+    );
+  });
+
+  it("puts the comment above the first entry it adds, not above the block", () => {
+    strictEqual(
+      addOverrides(
+        'overrides:\n  # a decision taken elsewhere\n  "foo@": "1.0.0"\n',
+        overrides([
+          ["leaf", "2.0.0"],
+          ["other", "1.0.0"],
+        ]),
+        { comment: "Added by pnpm-dedup.\nsee https://example.test/issues" },
+      ),
+      [
+        "overrides:",
+        "  # a decision taken elsewhere",
+        '  "foo@": "1.0.0"',
+        "  # Added by pnpm-dedup.",
+        "  # see https://example.test/issues",
+        '  "leaf@": "2.0.0"',
+        '  "other@": "1.0.0"',
+        "",
+      ].join("\n"),
+    );
+  });
+
+  it("writes plain keys when convergence is disabled", () => {
+    strictEqual(
+      addOverrides(undefined, overrides([["metro", "0.84.5"]]), {
+        convergence: false,
+      }),
+      'overrides:\n  "metro": "0.84.5"\n',
+    );
+  });
+
+  it("reads back only the convergence overrides", () => {
+    const content = addOverrides(
+      'overrides:\n  "plain-override": "1.0.0"\n',
+      overrides([["metro", "0.84.5"]]),
+    );
+
+    deepStrictEqual(
+      [...readConvergenceOverrides(content)],
+      [["metro", "0.84.5"]],
+    );
+  });
+});

package/src/helpers/pnpmWorkspaceYaml.ts

@@ -0,0 +1,77 @@
+import { Scalar, parseDocument } from "yaml";
+
+/**
+ * A convergence override (pnpm >= 11.13.0) is an override key with an empty
+ * range selector. It repoints a dependency edge only when the edge's declared
+ * range accepts the exact version, so the members a third-party range
+ * legitimately pins elsewhere keep their own resolution instead of being forced.
+ * The plain key is the unconditional one: every requester gets the version.
+ */
+export const overrideKey = (
+  packageName: string,
+  convergence: boolean,
+): string => (convergence ? `${packageName}@` : packageName);
+
+// `yaml` writes `commentBefore` straight after the `#`, so the leading space
+// that makes it read as prose has to be part of every line.
+const spaced = (comment: string): string =>
+  comment
+    .split("\n")
+    .map((line) => (line.startsWith(" ") ? line : ` ${line}`))
+    .join("\n");
+
+const quoted = (value: string): Scalar<string> => {
+  const scalar = new Scalar(value);
+  scalar.type = Scalar.QUOTE_DOUBLE;
+  return scalar;
+};
+
+export interface AddOverridesOptions {
+  // false writes plain keys, which pnpm applies to every requester
+  convergence?: boolean;
+  comment?: string;
+}
+
+/**
+ * Add overrides to a `pnpm-workspace.yaml`, editing the document rather than
+ * reserializing it: the user's comments, key order and formatting have to
+ * survive. Pass `undefined` for a file that does not exist yet.
+ *
+ * `comment` is attached above the first entry added, not above the `overrides`
+ * key, so an existing block and whatever the user wrote about it stay untouched.
+ */
+export const addOverrides = (
+  content: string | undefined,
+  overrides: Map<string, string>,
+  { convergence = true, comment }: AddOverridesOptions = {},
+): string => {
+  const doc = parseDocument(content ?? "");
+  let isFirst = true;
+
+  for (const [packageName, version] of overrides) {
+    const key = quoted(overrideKey(packageName, convergence));
+    if (isFirst && comment !== undefined) {
+      key.commentBefore = spaced(comment);
+    }
+    doc.setIn(["overrides", key], quoted(version));
+    isFirst = false;
+  }
+
+  return doc.toString();
+};
+
+export const readConvergenceOverrides = (
+  content: string,
+): Map<string, string> => {
+  const parsed = parseDocument(content).toJS() as {
+    overrides?: Record<string, unknown>;
+  } | null;
+
+  return new Map(
+    Object.entries(parsed?.overrides ?? {}).flatMap(([key, value]) =>
+      key.endsWith("@") && typeof value === "string"
+        ? [[key.slice(0, -1), value] as [string, string]]
+        : [],
+    ),
+  );
+};

package/src/helpers/projectDir.ts

@@ -0,0 +1,14 @@
+import { join } from "node:path";
+import { resolveProjectDir } from "pm-dedup-core";
+
+const lockfileName = "pnpm-lock.yaml";
+
+export const lockPathOf = (projectDir: string): string =>
+  join(projectDir, lockfileName);
+
+// The project the run operates on, found by walking up from the working
+// directory, so the bins work from any subdirectory of it. Null when no
+// pnpm-lock.yaml was found: the reason is printed and the exit code set, as
+// `parseBinArgs` does.
+export const resolvePnpmProjectDir = (): string | null =>
+  resolveProjectDir({ lockfileName });

package/src/helpers/readInstalledManifest.test.ts

@@ -0,0 +1,124 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, strictEqual } from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createManifestReaderWithStats } from "./readInstalledManifest.ts";
+
+const hoistedFixture = fileURLToPath(
+  new URL("../../test/fixtures/hoisted-node-linker", import.meta.url),
+);
+
+describe("createManifestReaderWithStats", () => {
+  it("reads a hoisted layout, top-level and nested", () => {
+    const { readManifest, stats } =
+      createManifestReaderWithStats(hoistedFixture);
+
+    // hoisted at the top of node_modules
+    deepStrictEqual(readManifest("mini-metro", "0.84.5")?.dependencies, {
+      "mini-metro-config": "0.84.5",
+    });
+    // the version that lost the hoist, nested under its dependent
+    deepStrictEqual(readManifest("mini-metro", "0.87.0")?.dependencies, {
+      "mini-metro-config": "0.87.0",
+    });
+    // the open range this whole scenario turns on
+    deepStrictEqual(readManifest("mini-plugin", "1.0.0")?.dependencies, {
+      "mini-metro-config": "*",
+    });
+
+    deepStrictEqual(stats(), { found: 3, missed: 0 });
+  });
+
+  it("resolves a location only pnpm's own index knows", () => {
+    const { readManifest } = createManifestReaderWithStats(hoistedFixture);
+
+    // three levels down: reachable from `.modules.yaml`'s hoistedLocations,
+    // not from scanning node_modules one level deep
+    deepStrictEqual(readManifest("mini-deep", "2.0.0")?.dependencies, {
+      "mini-metro-config": "*",
+    });
+  });
+
+  it("does not return a manifest whose version differs", () => {
+    const { readManifest, stats } =
+      createManifestReaderWithStats(hoistedFixture);
+
+    strictEqual(readManifest("mini-metro", "9.9.9"), undefined);
+    deepStrictEqual(stats(), { found: 0, missed: 1 });
+  });
+
+  it("reads pnpm's virtual store layout, peer suffix included", () => {
+    const dir = mkdtempSync(join(tmpdir(), "pnpm-dedup-virtual-store-"));
+    try {
+      const packageDir = join(
+        dir,
+        "node_modules",
+        ".pnpm",
+        "@scope+pkg@1.2.3(react@19.0.0)",
+        "node_modules",
+        "@scope",
+        "pkg",
+      );
+      mkdirSync(packageDir, { recursive: true });
+      writeFileSync(
+        join(packageDir, "package.json"),
+        JSON.stringify({
+          name: "@scope/pkg",
+          version: "1.2.3",
+          peerDependencies: { react: "*" },
+        }),
+      );
+
+      const { readManifest, stats } = createManifestReaderWithStats(dir);
+      deepStrictEqual(readManifest("@scope/pkg", "1.2.3")?.peerDependencies, {
+        react: "*",
+      });
+      deepStrictEqual(stats(), { found: 1, missed: 0 });
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("honors a relocated virtual store", () => {
+    const dir = mkdtempSync(join(tmpdir(), "pnpm-dedup-relocated-store-"));
+    try {
+      const packageDir = join(
+        dir,
+        "node_modules",
+        ".pnpm-store",
+        "pkg@1.0.0",
+        "node_modules",
+        "pkg",
+      );
+      mkdirSync(packageDir, { recursive: true });
+      writeFileSync(
+        join(packageDir, "package.json"),
+        JSON.stringify({ name: "pkg", version: "1.0.0", dependencies: {} }),
+      );
+      writeFileSync(
+        join(dir, "node_modules", ".modules.yaml"),
+        JSON.stringify({
+          nodeLinker: "isolated",
+          virtualStoreDir: ".pnpm-store",
+        }),
+      );
+
+      const { readManifest } = createManifestReaderWithStats(dir);
+      strictEqual(readManifest("pkg", "1.0.0")?.version, "1.0.0");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("reports every read as missed when nothing is installed", () => {
+    const { readManifest, stats } = createManifestReaderWithStats(
+      join(tmpdir(), "pnpm-dedup-not-installed"),
+    );
+
+    strictEqual(readManifest("mini-metro", "0.84.5"), undefined);
+    strictEqual(readManifest("mini-plugin", "1.0.0"), undefined);
+    deepStrictEqual(stats(), { found: 0, missed: 2 });
+  });
+});