pnpm-dedup 2.1.0

package/src/helpers/readInstalledManifest.ts

@@ -0,0 +1,202 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { stripPeerSuffix } from "./parsePnpmLockPackages.ts";
+
+export interface InstalledManifest {
+  version?: string;
+  dependencies?: Record<string, string>;
+  optionalDependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
+}
+
+export type ManifestReader = (
+  name: string,
+  version: string,
+) => InstalledManifest | undefined;
+
+export interface ManifestReaderStats {
+  found: number;
+  missed: number;
+}
+
+const readManifestFile = (path: string): InstalledManifest | undefined => {
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as InstalledManifest;
+  } catch {
+    return undefined;
+  }
+};
+
+const readdirOrEmpty = (path: string): string[] => {
+  try {
+    return readdirSync(path);
+  } catch {
+    return [];
+  }
+};
+
+// pnpm records where it put every package in `node_modules/.modules.yaml`
+// (`hoistedLocations`), keyed by dep path — `metro@0.87.0(supports-color@8.1.1)`
+// -> `["node_modules/@tamagui/metro-plugin/node_modules/metro"]`. It is written
+// as JSON by current pnpm and as YAML by older ones.
+interface ModulesState {
+  virtualStoreDir: string;
+  // dep path (peer suffix stripped) -> paths, relative to the project dir
+  hoistedLocations: Map<string, string[]>;
+}
+
+const readModulesState = (nodeModulesDir: string): ModulesState => {
+  const hoistedLocations = new Map<string, string[]>();
+
+  const parsed = ((): Record<string, unknown> | undefined => {
+    try {
+      const content = parseYaml(
+        readFileSync(join(nodeModulesDir, ".modules.yaml"), "utf8"),
+      ) as unknown;
+      return typeof content === "object" && content !== null
+        ? (content as Record<string, unknown>)
+        : undefined;
+    } catch {
+      return undefined;
+    }
+  })();
+
+  const hoisted = parsed?.hoistedLocations;
+  if (typeof hoisted === "object" && hoisted !== null) {
+    for (const [depPath, paths] of Object.entries(
+      hoisted as Record<string, unknown>,
+    )) {
+      if (!Array.isArray(paths)) continue;
+      const key = stripPeerSuffix(depPath);
+      hoistedLocations.set(key, [
+        ...(hoistedLocations.get(key) ?? []),
+        ...paths.filter((path): path is string => typeof path === "string"),
+      ]);
+    }
+  }
+
+  const virtualStoreDir = parsed?.virtualStoreDir;
+
+  return {
+    virtualStoreDir:
+      typeof virtualStoreDir === "string" ? virtualStoreDir : ".pnpm",
+    hoistedLocations,
+  };
+};
+/**
+ * Build a reader that locates an installed package's manifest, whichever
+ * node-linker the project uses:
+ *
+ * - virtual store (pnpm's default): the dep path gives the directory,
+ *   `node_modules/.pnpm/<name with / replaced by +>@<version>[(peers)|_hash]/node_modules/<name>`;
+ * - `nodeLinker: hoisted`: the layout is npm-shaped and placement is a hoisting
+ *   decision, so `node_modules/.modules.yaml` is consulted for the exact paths;
+ *   a flat `node_modules/<name>` and one level of nesting are tried as a
+ *   fallback when that file is missing.
+ *
+ * `stats` tells callers whether anything was readable at all: every declared
+ * range comes from these manifests, so a reader that finds nothing silently
+ * turns every dependent's range into an exact pin and hides every fix.
+ */
+export const createManifestReaderWithStats = (
+  projectDir: string,
+): { readManifest: ManifestReader; stats: () => ManifestReaderStats } => {
+  const nodeModulesDir = join(projectDir, "node_modules");
+  const modules = readModulesState(nodeModulesDir);
+  // `virtualStoreDir` is configurable and recorded in `.modules.yaml`, relative
+  // to node_modules unless absolute
+  const pnpmDir = isAbsolute(modules.virtualStoreDir)
+    ? modules.virtualStoreDir
+    : join(nodeModulesDir, modules.virtualStoreDir);
+  const cache = new Map<string, InstalledManifest | undefined>();
+  const stats: ManifestReaderStats = { found: 0, missed: 0 };
+
+  const virtualStoreEntries = readdirOrEmpty(pnpmDir);
+  const hoistedLocations = modules.hoistedLocations;
+  // top-level package dirs, for the nested lookup of the hoisted layout
+  const hoistedDependents = (() => {
+    let dirs: string[] | undefined;
+    return (): string[] => {
+      dirs ??= readdirOrEmpty(nodeModulesDir).flatMap((entry) =>
+        entry.startsWith("@")
+          ? readdirOrEmpty(join(nodeModulesDir, entry)).map((scoped) =>
+              join(entry, scoped),
+            )
+          : [entry],
+      );
+      return dirs;
+    };
+  })();
+
+  const fromVirtualStore = (
+    name: string,
+    version: string,
+  ): InstalledManifest | undefined => {
+    const target = `${name.replaceAll("/", "+")}@${version}`;
+    const dir = virtualStoreEntries.find(
+      (entry) =>
+        entry === target ||
+        entry.startsWith(`${target}(`) ||
+        entry.startsWith(`${target}_`),
+    );
+    return dir
+      ? readManifestFile(
+          join(pnpmDir, dir, "node_modules", name, "package.json"),
+        )
+      : undefined;
+  };
+
+  const fromHoisted = (
+    name: string,
+    version: string,
+  ): InstalledManifest | undefined => {
+    const atVersion = (path: string): InstalledManifest | undefined => {
+      const manifest = readManifestFile(path);
+      return manifest?.version === version ? manifest : undefined;
+    };
+
+    // the recorded locations are relative to the project directory
+    for (const location of hoistedLocations.get(`${name}@${version}`) ?? []) {
+      const recorded = atVersion(join(projectDir, location, "package.json"));
+      if (recorded) return recorded;
+    }
+
+    const hoisted = atVersion(join(nodeModulesDir, name, "package.json"));
+    if (hoisted) return hoisted;
+
+    // no `.modules.yaml`: a version that could not be hoisted lives under
+    // whichever dependent needed it, so try one level of nesting
+    for (const dependent of hoistedDependents()) {
+      const nested = atVersion(
+        join(nodeModulesDir, dependent, "node_modules", name, "package.json"),
+      );
+      if (nested) return nested;
+    }
+
+    return undefined;
+  };
+
+  const readManifest: ManifestReader = (name, version) => {
+    const cacheKey = `${name}@${version}`;
+    if (cache.has(cacheKey)) {
+      return cache.get(cacheKey);
+    }
+
+    const manifest =
+      fromVirtualStore(name, version) ?? fromHoisted(name, version);
+    if (manifest) {
+      stats.found += 1;
+    } else {
+      stats.missed += 1;
+    }
+
+    cache.set(cacheKey, manifest);
+    return manifest;
+  };
+
+  return { readManifest, stats: () => ({ ...stats }) };
+};
+
+export const createManifestReader = (projectDir: string): ManifestReader =>
+  createManifestReaderWithStats(projectDir).readManifest;

package/src/helpers/runPnpm.ts

@@ -0,0 +1,34 @@
+import { spawnSync } from "node:child_process";
+
+export interface PnpmRunResult {
+  status: number | null;
+  output: string;
+}
+
+export interface RunPnpmOptions {
+  cwd?: string;
+  // inherit to stream pnpm's own reporter, pipe to capture it
+  stdio?: "inherit" | "pipe";
+}
+
+export type PnpmRunner = (
+  args: string[],
+  options?: RunPnpmOptions,
+) => PnpmRunResult;
+
+export const runPnpm: PnpmRunner = (args, { cwd, stdio = "inherit" } = {}) => {
+  const result = spawnSync("pnpm", args, {
+    cwd,
+    stdio,
+    encoding: "utf8",
+  });
+
+  if (result.error) {
+    throw result.error;
+  }
+
+  return {
+    status: result.status,
+    output: stdio === "pipe" ? `${result.stdout}\n${result.stderr}` : "",
+  };
+};

package/src/helpers/tempProjects.ts

@@ -0,0 +1,94 @@
+import { mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// Scratch projects for the tests that need a real directory on disk. The
+// end-to-end ones run an actual install in theirs, so a leaked directory is
+// tens of megabytes.
+//
+// `afterEach` covers the normal path — a passing, failing or timed-out test all
+// reach it — but not a signal: on Ctrl-C the test runner exits without running
+// the remaining hooks, and on SIGKILL nothing runs at all. So cleanup does not
+// rest on it alone:
+//   - the directory name carries the pid that owns it, and every run first
+//     reaps the leftovers of pids that are gone,
+//   - SIGINT/SIGTERM clean up before the signal is allowed through.
+
+const isRunning = (pid: number): boolean => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM: alive, but owned by another user — not ours to reap either way
+    return (error as NodeJS.ErrnoException).code === "EPERM";
+  }
+};
+
+const remove = (dir: string): void => {
+  try {
+    rmSync(dir, { recursive: true, force: true });
+  } catch {
+    // a directory a still-running install is writing into can fail to unlink;
+    // the next run reaps it once that pid is gone
+  }
+};
+
+// the `${pid}-${mkdtemp suffix}` a `create` call leaves after the prefix. Names
+// that do not match are left alone: a random suffix read as a pid would reap
+// directories this helper never made.
+const ownerPidPattern = /^(?<pid>[1-9]\d*)-/u;
+
+const reapAbandoned = (prefix: string): void => {
+  const root = tmpdir();
+  for (const name of readdirSync(root)) {
+    if (!name.startsWith(prefix)) continue;
+    const owner = ownerPidPattern.exec(name.slice(prefix.length))?.groups?.pid;
+    if (!owner || isRunning(Number(owner))) continue;
+    remove(join(root, name));
+  }
+};
+
+const pendingCleanups = new Set<() => void>();
+let signalsHooked = false;
+
+const hookSignals = (): void => {
+  if (signalsHooked) return;
+  signalsHooked = true;
+  for (const signal of ["SIGINT", "SIGTERM"] as const) {
+    const handler = (): void => {
+      for (const cleanup of pendingCleanups) cleanup();
+      // a listener suppresses the default termination: drop it and re-raise so
+      // the process still dies of the signal it was sent
+      process.removeListener(signal, handler);
+      process.kill(process.pid, signal);
+    };
+    process.on(signal, handler);
+  }
+};
+
+export interface TempProjects {
+  /** A new empty directory, removed by `cleanup`. */
+  create: () => string;
+  /** Removes every directory created since the last call. */
+  cleanup: () => void;
+}
+
+export const createTempProjects = (prefix: string): TempProjects => {
+  reapAbandoned(prefix);
+  hookSignals();
+
+  const dirs: string[] = [];
+  const cleanup = (): void => {
+    for (const dir of dirs.splice(0)) remove(dir);
+  };
+  pendingCleanups.add(cleanup);
+
+  return {
+    create: (): string => {
+      const dir = mkdtempSync(join(tmpdir(), `${prefix}${process.pid}-`));
+      dirs.push(dir);
+      return dir;
+    },
+    cleanup,
+  };
+};

package/src/helpers/toLockstepGraph.test.ts

@@ -0,0 +1,98 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { fileURLToPath } from "node:url";
+import type { PnpmLockFile } from "../pnpmLockTypes.ts";
+import { readPnpmLock } from "../readPnpmLock.ts";
+import { buildPnpmPackagesMap } from "./buildPnpmPackagesMap.ts";
+import { parsePnpmLockPackages } from "./parsePnpmLockPackages.ts";
+import { toLockstepGraph } from "./toLockstepGraph.ts";
+
+const fixturesBase = (rel: string) =>
+  fileURLToPath(new URL(rel, import.meta.url));
+
+const graphOf = (lock: PnpmLockFile) =>
+  toLockstepGraph(lock, buildPnpmPackagesMap(parsePnpmLockPackages(lock)));
+
+const graphFor = (scenario: string) =>
+  graphOf(
+    readPnpmLock(
+      fixturesBase(`../../test/fixtures/${scenario}/pnpm-lock.yaml`),
+    ),
+  );
+
+describe("toLockstepGraph", () => {
+  it("strips peer suffixes, resolves aliases, and keeps every installation", () => {
+    const graph = graphOf({
+      lockfileVersion: "9.0",
+      packages: {
+        "a@1.0.0": {},
+        "b@1.0.0": {},
+        "alias-target@2.0.0": {},
+      },
+      snapshots: {
+        "a@1.0.0(peer@1.0.0)": {
+          dependencies: {
+            b: "1.0.0(peer@1.0.0)",
+            aliased: "alias-target@2.0.0",
+          },
+        },
+        "a@1.0.0(peer@2.0.0)": {
+          dependencies: { b: "1.0.0" },
+        },
+        "b@1.0.0": {},
+        "alias-target@2.0.0": {},
+      },
+    });
+
+    // one entry per peer context, both carrying the same resolved version
+    deepStrictEqual(graph.a, [
+      {
+        version: "1.0.0",
+        isNpm: true,
+        dependencies: { b: "1.0.0", "alias-target": "2.0.0" },
+      },
+      { version: "1.0.0", isNpm: true, dependencies: { b: "1.0.0" } },
+    ]);
+  });
+
+  it("maps metro's exact self-pins to co-version edges", () => {
+    const metro = graphFor("wildcard-not-reused").metro;
+    ok(metro);
+    deepStrictEqual(metro.map((resolution) => resolution.version).toSorted(), [
+      "0.84.5",
+      "0.87.0",
+    ]);
+
+    for (const resolution of metro) {
+      strictEqual(resolution.isNpm, true);
+      strictEqual(resolution.dependencies["metro-config"], resolution.version);
+      // an unrelated dependency keeps its own version line
+      ok(resolution.dependencies.debug?.startsWith("4."));
+    }
+  });
+
+  // `aliased-swapped-names`: the keys the importer uses name each other's
+  // package. The graph is keyed by npm name, so `@typescript/typescript6` has to
+  // stay its own name and `tool`'s edge has to land on the real `typescript`.
+  it("keeps swapped alias keys apart", () => {
+    const graph = graphFor("aliased-swapped-names");
+
+    deepStrictEqual(Object.keys(graph).toSorted(), [
+      "@typescript/typescript6",
+      "tool",
+      "typescript",
+    ]);
+    deepStrictEqual(graph.tool?.[0]?.dependencies, { typescript: "5.9.3" });
+    strictEqual(graph.typescript?.length, 2);
+  });
+
+  it("marks non-npm resolutions so cluster detection skips them", () => {
+    const nonNpm = Object.values(graphFor("non-npm"))
+      .flat()
+      .filter((resolution) => !resolution.isNpm);
+    ok(nonNpm.length > 0);
+    for (const resolution of nonNpm) {
+      deepStrictEqual(resolution.dependencies, {});
+    }
+  });
+});

package/src/helpers/toLockstepGraph.ts

@@ -0,0 +1,52 @@
+import type { LockstepGraph, LockstepResolution } from "pm-dedup-core";
+import type { PnpmLockFile } from "../pnpmLockTypes.ts";
+import type { PackagesMap } from "./buildPnpmPackagesMap.ts";
+import { resolveSnapshotDependency } from "./parsePnpmLockPackages.ts";
+
+const snapshotDepTypes = ["dependencies", "optionalDependencies"] as const;
+
+const snapshotDependencies = (
+  lock: PnpmLockFile,
+  snapshotKey: string,
+): Record<string, string> => {
+  const snapshot = lock.snapshots?.[snapshotKey];
+  const dependencies: Record<string, string> = {};
+
+  snapshotDepTypes.forEach((depType) => {
+    for (const [depName, depValue] of Object.entries(
+      snapshot?.[depType] ?? {},
+    )) {
+      const resolved = resolveSnapshotDependency(depName, depValue);
+      dependencies[resolved.name] = resolved.version;
+    }
+  });
+
+  return dependencies;
+};
+
+/**
+ * Adapt the pnpm lockfile model into the package-manager-neutral graph consumed
+ * by `buildLockstepClusters`. pnpm snapshots store the *resolved* version of
+ * each dependency instead of the requested range, which co-version detection
+ * handles; one entry is emitted per installation, so a resolution installed in
+ * several peer contexts contributes every context it appears in.
+ */
+export const toLockstepGraph = (
+  lock: PnpmLockFile,
+  packagesMap: PackagesMap,
+): LockstepGraph =>
+  Object.fromEntries(
+    Object.entries(packagesMap).map(([name, resolutions]) => [
+      name,
+      resolutions.flatMap((resolution): LockstepResolution[] => {
+        if (resolution.package.type !== "npm") {
+          return [{ version: "", isNpm: false, dependencies: {} }];
+        }
+        return resolution.installations.map((snapshotKey) => ({
+          version: resolution.package.version,
+          isNpm: true,
+          dependencies: snapshotDependencies(lock, snapshotKey),
+        }));
+      }),
+    ]),
+  );

package/src/helpers/versionsSnapshot.ts

@@ -0,0 +1,9 @@
+import { buildVersionsSnapshot } from "pm-dedup-core";
+import type { VersionsSnapshot } from "pm-dedup-core";
+import { readPnpmLock } from "../readPnpmLock.ts";
+import { parsePnpmLockPackages } from "./parsePnpmLockPackages.ts";
+
+export const readVersionsSnapshot = (lockPath: string): VersionsSnapshot =>
+  buildVersionsSnapshot(
+    parsePnpmLockPackages(readPnpmLock(lockPath)).packages.values(),
+  );