pnpm-dedup 2.1.0

package/dist/displayMany.test.js

@@ -0,0 +1,146 @@
+import { describe, expect, it } from "bun:test";
+import { ok } from "node:assert/strict";
+import { fileURLToPath } from "node:url";
+import { displayMany } from "./displayMany.js";
+import { buildPnpmPackagesMap, filterDuplicatesPnpmPackagesMap, } from "./helpers/buildPnpmPackagesMap.js";
+import { collectDependentRanges } from "./helpers/collectDependentRanges.js";
+import { parsePnpmLockPackages } from "./helpers/parsePnpmLockPackages.js";
+import { createManifestReader } from "./helpers/readInstalledManifest.js";
+import { identifyClusterFixes } from "./identifyClusterFixes.js";
+import { readPnpmLock } from "./readPnpmLock.js";
+const fixturesBase = (rel) => fileURLToPath(new URL(rel, import.meta.url));
+// The report layout is covered in pm-dedup-core (`renderDuplicatesReport`); these
+// only check that the pnpm lockfile model is mapped onto it correctly.
+const renderDuplicates = (scenario, clusterFixes, readManifest = () => undefined) => {
+    const lock = readPnpmLock(fixturesBase(`../test/fixtures/${scenario}/pnpm-lock.yaml`));
+    const packagesMap = buildPnpmPackagesMap(parsePnpmLockPackages(lock));
+    const duplicates = filterDuplicatesPnpmPackagesMap(packagesMap);
+    let buffer = "";
+    displayMany({
+        title: "duplicates",
+        duplicatesPackagesMap: duplicates,
+        dependents: collectDependentRanges(lock, new Set(Object.keys(duplicates)), readManifest),
+        totalDependencies: Object.keys(packagesMap).length,
+        clusterFixes,
+        details: true,
+        color: false,
+        log: (message = "") => {
+            buffer += `${message}\n`;
+        },
+    });
+    return buffer;
+};
+// `exact-pin-forces-downgrade` commits its virtual store, so the report runs on
+// the real declared ranges: an exact 3.0.3 against expo-camera's `^3.0.0`.
+const downgradeScenario = "exact-pin-forces-downgrade";
+const downgradeDir = fixturesBase(`../test/fixtures/${downgradeScenario}`);
+const renderDowngrade = () => {
+    const lock = readPnpmLock(`${downgradeDir}/pnpm-lock.yaml`);
+    const readManifest = createManifestReader(downgradeDir);
+    return renderDuplicates(downgradeScenario, identifyClusterFixes(lock, buildPnpmPackagesMap(parsePnpmLockPackages(lock)), readManifest), readManifest);
+};
+const lastLine = (output) => output.trimEnd().split("\n").at(-1);
+const clusterFix = (overrides = {}) => ({
+    members: ["metro", "metro-config"],
+    duplicatedMembers: ["metro", "metro-config"],
+    memberVersions: {
+        metro: { versions: ["0.84.5", "0.87.0"], nonNpmCount: 0 },
+        "metro-config": { versions: ["0.84.5", "0.87.0"], nonNpmCount: 0 },
+    },
+    target: "0.87.0",
+    direction: "up",
+    convergentMembers: ["metro", "metro-config"],
+    driverMembers: ["metro"],
+    excludedMembers: [],
+    anchor: null,
+    reuseFixes: [],
+    floatingMembers: [],
+    workspaceChanges: [],
+    reResolutionSet: ["metro"],
+    externalConstraints: [],
+    needsRoundTrip: true,
+    applicable: true,
+    ...overrides,
+});
+const singletonFix = (overrides = {}) => ({
+    ...clusterFix(),
+    members: ["@babel/code-frame"],
+    duplicatedMembers: ["@babel/code-frame"],
+    memberVersions: {
+        "@babel/code-frame": { versions: ["7.26.2", "7.29.7"], nonNpmCount: 0 },
+    },
+    target: "7.29.7",
+    direction: "up",
+    convergentMembers: ["@babel/code-frame"],
+    driverMembers: ["@babel/code-frame"],
+    reResolutionSet: [],
+    needsRoundTrip: false,
+    ...overrides,
+});
+describe("displayMany", () => {
+    it("groups every dependent under the version it resolved to", () => {
+        const output = renderDuplicates("duplicated-babel-frame");
+        ok(output.startsWith("Found "));
+        ok(output.includes("@babel/code-frame — 2 versions"));
+        ok(output.includes('package.json in dependencies  requires "7.26.2"'));
+        // pnpm defers the per-package merge to `pnpm dedupe`
+        ok(!output.includes("can be deduped"));
+    });
+    it("renders the printable-shell-command duplicate", () => {
+        const output = renderDuplicates("duplicated-printable-shell-command");
+        ok(output.includes("printable-shell-command — 2 versions"));
+        ok(output.includes("  5.0.7"));
+    });
+    it("reports no duplicates for a clean lockfile", () => {
+        expect(renderDuplicates("simple")).toBe("No duplicates found\n\nFound 1 dependency, 0 duplicates, 0 dedupable.\n");
+    });
+    it("maps a cluster of one to the versions that would collapse", () => {
+        const output = renderDuplicates("duplicated-babel-frame", [singletonFix()]);
+        ok(output.includes("@babel/code-frame — 2 versions, can be deduped to 7.29.7 (upgrade)"));
+        ok(output.includes("  7.26.2  can be deduped to 7.29.7 (upgrade)"));
+        // a lone package is no family, so it gets no cluster section
+        ok(!output.includes("Lockstep clusters:"));
+    });
+    it("counts the whole lockfile and names the pnpm command", () => {
+        const output = renderDuplicates("duplicated-babel-frame", [singletonFix()]);
+        ok(lastLine(output).startsWith("Found 39 dependencies, 1 duplicate, at least 1 dedupable (deduping may remove more). Run `pnpm-dedupe`"));
+    });
+    it("says nothing collapses when the cluster of one is unfixable", () => {
+        const output = renderDuplicates("duplicated-babel-frame", [
+            singletonFix({
+                target: null,
+                direction: "none",
+                convergentMembers: [],
+                driverMembers: [],
+                applicable: false,
+            }),
+        ]);
+        ok(!output.includes("can be deduped"));
+        ok(lastLine(output).includes("0 dedupable"));
+    });
+    it("files a declared range under the version it resolved to", () => {
+        const output = renderDowngrade();
+        ok(output.includes('    - expo-camera@57.0.3              requires "^3.0.0"'));
+        ok(output.includes('    - @yudiel/react-qr-scanner@2.3.1  requires "3.0.3"'));
+    });
+    it("names the downgrade a converging dependent has to take", () => {
+        const output = renderDowngrade();
+        ok(output.includes("  3.2.2  can be deduped to 3.0.3 (downgrade)"));
+        // zxing-wasm cannot converge: `^2.1.2` against an exact 3.1.3
+        ok(lastLine(output).includes("2 duplicates, at least 1 dedupable"));
+    });
+    it("forwards the cluster fixes", () => {
+        const output = renderDuplicates("duplicated-babel-frame", [clusterFix()]);
+        ok(output.includes("Lockstep clusters:"));
+        ok(output.includes("cluster 1 — metro* [2 packages, 2 duplicated, 2 fixable]:"));
+        // the family's own members are not in this lockfile's duplicates, so the
+        // count — which follows the listed packages — stays at zero
+        ok(lastLine(output).includes("0 dedupable"));
+    });
+    it("renders a cluster from a lockfile with no per-package duplicate", () => {
+        const output = renderDuplicates("simple", [clusterFix()]);
+        ok(output.startsWith("No duplicates found"));
+        ok(output.includes("Lockstep clusters:"));
+    });
+});
+//# sourceMappingURL=displayMany.test.js.map

package/dist/displayMany.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"displayMany.test.js","sourceRoot":"","sources":["../src/displayMany.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,oBAAoB,EACpB,+BAA+B,GAChC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE,CACnC,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/C,kFAAkF;AAClF,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,CACvB,QAAgB,EAChB,YAA2B,EAC3B,YAAY,GAAmB,GAAG,EAAE,CAAC,SAAS,EACtC,EAAE;IACV,MAAM,IAAI,GAAG,YAAY,CACvB,YAAY,CAAC,oBAAoB,QAAQ,iBAAiB,CAAC,CAC5D,CAAC;IACF,MAAM,WAAW,GAAG,oBAAoB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,+BAA+B,CAAC,WAAW,CAAC,CAAC;IAEhE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,WAAW,CAAC;QACV,KAAK,EAAE,YAAY;QACnB,qBAAqB,EAAE,UAAU;QACjC,UAAU,EAAE,sBAAsB,CAChC,IAAI,EACJ,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAChC,YAAY,CACb;QACD,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;QAClD,YAAY;QACZ,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,KAAK;QACZ,GAAG,EAAE,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC;QAC3B,CAAC;KACF,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AACvD,MAAM,YAAY,GAAG,YAAY,CAAC,oBAAoB,iBAAiB,EAAE,CAAC,CAAC;AAE3E,MAAM,eAAe,GAAG,GAAW,EAAE;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,YAAY,iBAAiB,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,gBAAgB,CACrB,iBAAiB,EACjB,oBAAoB,CAClB,IAAI,EACJ,oBAAoB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,EACjD,YAAY,CACb,EACD,YAAY,CACb,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE,CAC1C,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;AAEvC,MAAM,UAAU,GAAG,CAAC,SAAS,GAAwB,EAAE,EAAc,EAAE,CAAC,CAAC;IACvE,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC;IAClC,iBAAiB,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC;IAC5C,cAAc,EAAE;QACd,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;QACzD,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;KACnE;IACD,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,IAAI;IACf,iBAAiB,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC;IAC5C,aAAa,EAAE,CAAC,OAAO,CAAC;IACxB,eAAe,EAAE,EAAE;IACnB,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,EAAE;IACd,eAAe,EAAE,EAAE;IACnB,gBAAgB,EAAE,EAAE;IACpB,eAAe,EAAE,CAAC,OAAO,CAAC;IAC1B,mBAAmB,EAAE,EAAE;IACvB,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,IAAI;IAChB,GAAG,SAAS;CACb,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,SAAS,GAAwB,EAAE,EAAc,EAAE,CAAC,CAAC;IACzE,GAAG,UAAU,EAAE;IACf,OAAO,EAAE,CAAC,mBAAmB,CAAC;IAC9B,iBAAiB,EAAE,CAAC,mBAAmB,CAAC;IACxC,cAAc,EAAE;QACd,mBAAmB,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;KACxE;IACD,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,IAAI;IACf,iBAAiB,EAAE,CAAC,mBAAmB,CAAC;IACxC,aAAa,EAAE,CAAC,mBAAmB,CAAC;IACpC,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,KAAK;IACrB,GAAG,SAAS;CACb,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,MAAM,GAAG,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC,CAAC;QACtD,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,iDAAiD,CAAC,CAAC,CAAC;QACvE,qDAAqD;QACrD,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;QACtE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC,CAAC;QAC5D,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CACrC,yEAAyE,CAC1E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,gBAAgB,CAAC,wBAAwB,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAC5E,EAAE,CACA,MAAM,CAAC,QAAQ,CACb,oEAAoE,CACrE,CACF,CAAC;QACF,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACpE,6DAA6D;QAC7D,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC,wBAAwB,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAC5E,EAAE,CACA,QAAQ,CAAC,MAAM,CAAC,CAAC,UAAU,CACzB,wGAAwG,CACzG,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,MAAM,GAAG,gBAAgB,CAAC,wBAAwB,EAAE;YACxD,YAAY,CAAC;gBACX,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,MAAM;gBACjB,iBAAiB,EAAE,EAAE;gBACrB,aAAa,EAAE,EAAE;gBACjB,UAAU,EAAE,KAAK;aAClB,CAAC;SACH,CAAC,CAAC;QACH,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACvC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,EAAE,CACA,MAAM,CAAC,QAAQ,CACb,yDAAyD,CAC1D,CACF,CAAC;QACF,EAAE,CACA,MAAM,CAAC,QAAQ,CAAC,wDAAwD,CAAC,CAC1E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACpE,8DAA8D;QAC9D,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,wBAAwB,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC1E,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC1C,EAAE,CACA,MAAM,CAAC,QAAQ,CACb,2DAA2D,CAC5D,CACF,CAAC;QACF,yEAAyE;QACzE,4DAA4D;QAC5D,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC1D,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC7C,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/helpers/buildIdentifiedFixesMap.test.js

@@ -0,0 +1,27 @@
+import { describe, it } from "bun:test";
+import { ok, strictEqual } from "node:assert/strict";
+import { buildIdentifiedFixesMap } from "pm-dedup-core";
+describe("buildIdentifiedFixesMap", () => {
+    it("builds a map even when there are no fixes", () => {
+        const fakeResolution = {
+            resolution: "pkg@1.0.0",
+            package: {
+                type: "npm",
+                name: "pkg",
+                resolution: "pkg@1.0.0",
+                version: "1.0.0",
+            },
+            installations: ["pkg@1.0.0"],
+        };
+        const duplicates = {
+            pkg: [fakeResolution],
+        };
+        const dependents = new Map();
+        const map = buildIdentifiedFixesMap(duplicates, dependents);
+        ok(map instanceof Map);
+        strictEqual(map.has("pkg"), true);
+        strictEqual(Array.isArray(map.get("pkg")), true);
+        strictEqual((map.get("pkg") || []).length, 0);
+    });
+});
+//# sourceMappingURL=buildIdentifiedFixesMap.test.js.map

package/dist/helpers/buildIdentifiedFixesMap.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildIdentifiedFixesMap.test.js","sourceRoot":"","sources":["../../src/helpers/buildIdentifiedFixesMap.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAIxD,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,cAAc,GAAsB;YACxC,UAAU,EAAE,WAAW;YACvB,OAAO,EAAE;gBACP,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE,WAAW;gBACvB,OAAO,EAAE,OAAO;aACjB;YACD,aAAa,EAAE,CAAC,WAAW,CAAC;SAC7B,CAAC;QAEF,MAAM,UAAU,GAAgB;YAC9B,GAAG,EAAE,CAAC,cAAc,CAAC;SACtB,CAAC;QAEF,MAAM,UAAU,GAAkB,IAAI,GAAG,EAAE,CAAC;QAE5C,MAAM,GAAG,GAAG,uBAAuB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAE5D,EAAE,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC;QACvB,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAClC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjD,WAAW,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/helpers/buildPnpmPackagesMap.js

@@ -0,0 +1,23 @@
+// Several packages can share the same name but different versions (duplicates).
+// When a single resolution is installed in several peer contexts, every context
+// is listed in `installations`.
+export function buildPnpmPackagesMap({ packages, installationsByResolution, }) {
+    const packagesMap = {};
+    for (const pkg of packages.values()) {
+        if (!packagesMap[pkg.name]) {
+            packagesMap[pkg.name] = [];
+        }
+        packagesMap[pkg.name].push({
+            resolution: pkg.resolution,
+            package: pkg,
+            installations: installationsByResolution.get(pkg.resolution) ?? [
+                pkg.resolution,
+            ],
+        });
+    }
+    return packagesMap;
+}
+export function filterDuplicatesPnpmPackagesMap(packagesMap) {
+    return Object.fromEntries(Object.entries(packagesMap).filter(([, resolutions]) => resolutions.length > 1));
+}
+//# sourceMappingURL=buildPnpmPackagesMap.js.map

package/dist/helpers/buildPnpmPackagesMap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildPnpmPackagesMap.js","sourceRoot":"","sources":["../../src/helpers/buildPnpmPackagesMap.ts"],"names":[],"mappings":"AAkBA,gFAAgF;AAChF,gFAAgF;AAChF,gCAAgC;AAChC,MAAM,UAAU,oBAAoB,CAAC,EACnC,QAAQ,EACR,yBAAyB,GACN;IACnB,MAAM,WAAW,GAAgB,EAAE,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,CAAC;QAED,WAAW,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC;YAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG;YACZ,aAAa,EAAE,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;gBAC9D,GAAG,CAAC,UAAU;aACf;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,WAAwB;IAExB,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAC5C,CACF,CAAC;AACJ,CAAC"}

package/dist/helpers/buildPnpmPackagesMap.test.js

@@ -0,0 +1,68 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { fileURLToPath } from "node:url";
+import { readPnpmLock } from "../readPnpmLock.js";
+import { buildPnpmPackagesMap, filterDuplicatesPnpmPackagesMap, } from "./buildPnpmPackagesMap.js";
+import { parsePnpmLockPackages } from "./parsePnpmLockPackages.js";
+const fixturesBase = (rel) => fileURLToPath(new URL(rel, import.meta.url));
+const buildFor = (scenario) => buildPnpmPackagesMap(parsePnpmLockPackages(readPnpmLock(fixturesBase(`../../test/fixtures/${scenario}/pnpm-lock.yaml`))));
+const versionsOf = (packagesMap, name) => new Set((packagesMap[name] ?? []).map((resolution) => resolution.package.version));
+describe("buildPnpmPackagesMap", () => {
+    it("reports no duplicates for the simple fixture", () => {
+        const packagesMap = buildFor("simple");
+        strictEqual(packagesMap.semver?.length, 1);
+        strictEqual(Object.keys(filterDuplicatesPnpmPackagesMap(packagesMap)).length, 0);
+    });
+    it("reports no duplicates for one-dependency-of-dependency", () => {
+        const packagesMap = buildFor("one-dependency-of-dependency");
+        strictEqual(Object.keys(filterDuplicatesPnpmPackagesMap(packagesMap)).length, 0);
+    });
+    it("detects the duplicated @babel/code-frame versions", () => {
+        const duplicates = filterDuplicatesPnpmPackagesMap(buildFor("duplicated-babel-frame"));
+        const versions = versionsOf(duplicates, "@babel/code-frame");
+        strictEqual(versions.size, 2);
+        ok(versions.has("7.26.2"));
+    });
+    it("detects the duplicated printable-shell-command versions", () => {
+        const duplicates = filterDuplicatesPnpmPackagesMap(buildFor("duplicated-printable-shell-command"));
+        ok(duplicates["printable-shell-command"]);
+        strictEqual(duplicates["printable-shell-command"].length, 2);
+    });
+    it("detects the metro family a non-reused wildcard duplicated", () => {
+        // `@tamagui/metro-plugin` requests metro-config/metro-transform-worker with
+        // `*`; pnpm resolved them to 0.87.0 instead of reusing the 0.84.5 pulled by
+        // the root `metro: 0.84.5` pin, so the whole family is installed twice.
+        const duplicates = filterDuplicatesPnpmPackagesMap(buildFor("wildcard-not-reused"));
+        const family = Object.keys(duplicates).filter((name) => name === "metro" || name.startsWith("metro-"));
+        strictEqual(family.length, 14);
+        for (const name of family) {
+            deepStrictEqual(versionsOf(duplicates, name), new Set(["0.84.5", "0.87.0"]));
+        }
+    });
+    it("detects at least the known @typescript-eslint duplicates", () => {
+        const duplicates = filterDuplicatesPnpmPackagesMap(buildFor("duplicated-typescript-eslint"));
+        // Acceptance floor: the set of detected duplicates must include these.
+        const required = [
+            "@typescript-eslint/types",
+            "@typescript-eslint/scope-manager",
+            "@typescript-eslint/utils",
+            "@eslint/plugin-kit",
+        ];
+        for (const name of required) {
+            ok(duplicates[name], `expected ${name} to be detected as duplicate`);
+            strictEqual(duplicates[name].length, 2);
+        }
+        const typesVersions = versionsOf(duplicates, "@typescript-eslint/types");
+        ok(typesVersions.has("8.59.1"));
+        ok(typesVersions.has("8.61.0"));
+    });
+    // `aliased-swapped-names`: identity comes from the package id, so the two real
+    // `typescript` copies meet and the `@typescript/typescript6` the `typescript`
+    // key points at stays on its own.
+    it("identifies packages by their id when alias keys are swapped", () => {
+        const duplicates = filterDuplicatesPnpmPackagesMap(buildFor("aliased-swapped-names"));
+        deepStrictEqual(Object.keys(duplicates), ["typescript"]);
+        deepStrictEqual(versionsOf(duplicates, "typescript"), new Set(["5.9.3", "7.0.2"]));
+    });
+});
+//# sourceMappingURL=buildPnpmPackagesMap.test.js.map

package/dist/helpers/buildPnpmPackagesMap.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildPnpmPackagesMap.test.js","sourceRoot":"","sources":["../../src/helpers/buildPnpmPackagesMap.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE,CACnC,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/C,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE,CACpC,oBAAoB,CAClB,qBAAqB,CACnB,YAAY,CACV,YAAY,CAAC,uBAAuB,QAAQ,iBAAiB,CAAC,CAC/D,CACF,CACF,CAAC;AAEJ,MAAM,UAAU,GAAG,CACjB,WAAoD,EACpD,IAAY,EACC,EAAE,CACf,IAAI,GAAG,CACL,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAC1E,CAAC;AAEJ,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3C,WAAW,CACT,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAChE,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,WAAW,GAAG,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QAC7D,WAAW,CACT,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAChE,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,UAAU,GAAG,+BAA+B,CAChD,QAAQ,CAAC,wBAAwB,CAAC,CACnC,CAAC;QACF,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QAC7D,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9B,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,UAAU,GAAG,+BAA+B,CAChD,QAAQ,CAAC,oCAAoC,CAAC,CAC/C,CAAC;QACF,EAAE,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC1C,WAAW,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,UAAU,GAAG,+BAA+B,CAChD,QAAQ,CAAC,qBAAqB,CAAC,CAChC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAC3C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CACxD,CAAC;QACF,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,eAAe,CACb,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,EAC5B,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,UAAU,GAAG,+BAA+B,CAChD,QAAQ,CAAC,8BAA8B,CAAC,CACzC,CAAC;QACF,uEAAuE;QACvE,MAAM,QAAQ,GAAG;YACf,0BAA0B;YAC1B,kCAAkC;YAClC,0BAA0B;YAC1B,oBAAoB;SACrB,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,YAAY,IAAI,8BAA8B,CAAC,CAAC;YACrE,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;QACzE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,8EAA8E;IAC9E,kCAAkC;IAClC,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,UAAU,GAAG,+BAA+B,CAChD,QAAQ,CAAC,uBAAuB,CAAC,CAClC,CAAC;QAEF,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QACzD,eAAe,CACb,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,EACpC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/helpers/collectDependentRanges.js

@@ -0,0 +1,118 @@
+import { PackageDependencyDescriptorUtils, isSemverComparable, } from "pm-dedup-core";
+import { parsePackageId, resolveSnapshotDependency, } from "./parsePnpmLockPackages.js";
+const snapshotDepTypes = ["dependencies", "optionalDependencies"];
+const manifestDepTypes = [
+    "dependencies",
+    "optionalDependencies",
+    "peerDependencies",
+];
+// a declaration semver cannot read says nothing about the version; the caller
+// falls back to the version this requester actually got
+const declaredRange = (depName, declared) => {
+    const parsed = PackageDependencyDescriptorUtils.parse(depName, declared);
+    return isSemverComparable(parsed) ? parsed.selector : undefined;
+};
+const manifestRange = (manifest, depName) => {
+    if (!manifest)
+        return undefined;
+    for (const depType of manifestDepTypes) {
+        const declared = manifest[depType]?.[depName];
+        if (declared === undefined)
+            continue;
+        const range = declaredRange(depName, declared);
+        if (range === undefined)
+            return undefined;
+        return depType === "peerDependencies" ? { range, peer: true } : { range };
+    }
+    return undefined;
+};
+/**
+ * The peer range as the lockfile itself records it.
+ *
+ * pnpm resolves peers before writing the lockfile and folds each resolved peer
+ * into the snapshot's `dependencies` — which is why a peer edge is found here at
+ * all, unlike yarn's, where the fold lives only in the virtual packages the
+ * lockfile omits. But the snapshot carries the resolved *version*; the range
+ * stays behind in the `packages:` entry. Without it, seventeen plugins declaring
+ * `eslint: "^6.0.0 || ^7.0.0 || >=8.0.0"` and the like all read as exact pins of
+ * whatever got installed, and no version can satisfy them all — every merge
+ * ruled out by ranges that never said so.
+ *
+ * `packages:` keys carry no peer suffix, so the resolved id addresses the entry
+ * directly. `depName` is the key the requester declared, which is what an
+ * aliased peer sits under.
+ */
+const lockfilePeerRange = (lock, dependent, depName) => {
+    const declared = lock.packages?.[`${dependent.name}@${dependent.version}`]
+        ?.peerDependencies?.[depName];
+    if (declared === undefined)
+        return undefined;
+    const range = declaredRange(depName, declared);
+    return range === undefined ? undefined : { range, peer: true };
+};
+/**
+ * Collect, for each duplicated package, the real semver range every dependent
+ * declares. Direct (importer) dependents carry their specifier; transitive
+ * dependents' ranges are read from their installed manifest (the pnpm lockfile
+ * only stores the resolved version, not the range). When a manifest is missing
+ * (project not installed), the resolved version is used as an exact fallback.
+ */
+export const collectDependentRanges = (lock, duplicatePackageNames, readManifest) => {
+    const rangesMap = new Map();
+    const add = (name, dependent) => {
+        if (!duplicatePackageNames.has(name))
+            return;
+        let dependents = rangesMap.get(name);
+        if (!dependents) {
+            dependents = [];
+            rangesMap.set(name, dependents);
+        }
+        dependents.push(dependent);
+    };
+    for (const [importerPath, project] of Object.entries(lock.importers ?? {})) {
+        ["dependencies", "devDependencies", "optionalDependencies"].forEach((depType) => {
+            const deps = project[depType];
+            if (!deps)
+                return;
+            for (const [depName, { specifier, version }] of Object.entries(deps)) {
+                const parsed = PackageDependencyDescriptorUtils.parse(depName, specifier);
+                // `workspace:` and `catalog:` name something other than the npm package
+                // sharing this key, so they constrain no npm version
+                if (!isSemverComparable(parsed))
+                    continue;
+                add(parsed.npmName, {
+                    key: `${importerPath === "." ? "package.json" : importerPath} in ${depType}`,
+                    range: parsed.selector,
+                    // an aliased importer entry stores `realName@version`, not a version
+                    resolvedVersion: resolveSnapshotDependency(depName, version).version,
+                    ...(parsed.isAlias ? { aliasKey: parsed.key } : {}),
+                    workspace: { path: importerPath, depType },
+                });
+            }
+        });
+    }
+    for (const [snapshotKey, snapshot] of Object.entries(lock.snapshots ?? {})) {
+        const dependent = parsePackageId(snapshotKey);
+        snapshotDepTypes.forEach((depType) => {
+            const deps = snapshot[depType];
+            if (!deps)
+                return;
+            for (const [depName, depValue] of Object.entries(deps)) {
+                const { name, version } = resolveSnapshotDependency(depName, depValue);
+                if (!duplicatePackageNames.has(name))
+                    continue;
+                const source = manifestRange(readManifest(dependent.name, dependent.version), depName) ?? lockfilePeerRange(lock, dependent, depName);
+                add(name, {
+                    key: `${dependent.name}@${dependent.version}`,
+                    range: source?.range ?? version,
+                    resolvedVersion: version,
+                    requesterName: dependent.name,
+                    ...(name === depName ? {} : { aliasKey: depName }),
+                    ...(source?.peer ? { peer: source.peer } : {}),
+                });
+            }
+        });
+    }
+    return rangesMap;
+};
+//# sourceMappingURL=collectDependentRanges.js.map

package/dist/helpers/collectDependentRanges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collectDependentRanges.js","sourceRoot":"","sources":["../../src/helpers/collectDependentRanges.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,cAAc,EACd,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AA4BpC,MAAM,gBAAgB,GAAG,CAAC,cAAc,EAAE,sBAAsB,CAAU,CAAC;AAC3E,MAAM,gBAAgB,GAAG;IACvB,cAAc;IACd,sBAAsB;IACtB,kBAAkB;CACV,CAAC;AAEX,8EAA8E;AAC9E,wDAAwD;AACxD,MAAM,aAAa,GAAG,CACpB,OAAe,EACf,QAAgB,EACI,EAAE;IACtB,MAAM,MAAM,GAAG,gCAAgC,CAAC,KAAK,CACnD,OAAO,EACP,QAAQ,CACT,CAAC;IACF,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC,CAAC;AASF,MAAM,aAAa,GAAG,CACpB,QAAuC,EACvC,OAAe,EACU,EAAE;IAC3B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,OAAO,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,iBAAiB,GAAG,CACxB,IAAkB,EAClB,SAA4C,EAC5C,OAAe,EACU,EAAE;IAC3B,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACvD,EAAE,gBAAgB,EAAE,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,IAAkB,EAClB,qBAAkC,EAClC,YAA4B,EACR,EAAE;IACtB,MAAM,SAAS,GAAuB,IAAI,GAAG,EAAE,CAAC;IAEhD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,SAAyB,EAAQ,EAAE;QAC5D,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC7C,IAAI,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,EAAE,CAAC;YAChB,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAEzE,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAC3D,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,MAAM,GAAG,gCAAgC,CAAC,KAAK,CACnD,OAAO,EACP,SAAS,CACV,CAAC;gBACF,wEAAwE;gBACxE,qDAAqD;gBACrD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAC1C,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE;oBAClB,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,OAAO,OAAO,EAAE;oBAC5E,KAAK,EAAE,MAAM,CAAC,QAAQ;oBACtB,qEAAqE;oBACrE,eAAe,EAAE,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO;oBACpE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;QAC9C,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,yBAAyB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACvE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC/C,MAAM,MAAM,GACV,aAAa,CACX,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,EAC/C,OAAO,CACR,IAAI,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACnD,GAAG,CAAC,IAAI,EAAE;oBACR,GAAG,EAAE,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,OAAO,EAAE;oBAC7C,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,OAAO;oBAC/B,eAAe,EAAE,OAAO;oBACxB,aAAa,EAAE,SAAS,CAAC,IAAI;oBAC7B,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;oBAClD,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/C,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC"}

package/dist/helpers/collectDependentRanges.test.js

@@ -0,0 +1,211 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, strictEqual } from "node:assert/strict";
+import { fileURLToPath } from "node:url";
+import { readPnpmLock } from "../readPnpmLock.js";
+import { collectDependentRanges } from "./collectDependentRanges.js";
+import { createManifestReader } from "./readInstalledManifest.js";
+const fixturesBase = (rel) => fileURLToPath(new URL(rel, import.meta.url));
+const lockFor = (scenario) => readPnpmLock(fixturesBase(`../../test/fixtures/${scenario}/pnpm-lock.yaml`));
+const rangesFor = (scenario, packageNames, readManifest = () => undefined) => collectDependentRanges(lockFor(scenario), new Set(packageNames), readManifest);
+// In `wildcard-not-reused`, `@tamagui/metro-plugin@1.139.4` declares
+// `metro-config: "*"` and `metro-transform-worker: "*"`. The lockfile only
+// stores the version pnpm picked (0.87.0), so the wildcard is only visible
+// through the installed manifest.
+const wildcardScenario = "wildcard-not-reused";
+const wildcardPackages = ["metro-config", "metro-transform-worker"];
+const wildcardDependent = "@tamagui/metro-plugin@1.139.4";
+const readWildcardManifest = (name, version) => name === "@tamagui/metro-plugin" && version === "1.139.4"
+    ? { dependencies: { "metro-config": "*", "metro-transform-worker": "*" } }
+    : undefined;
+// `exact-pin-forces-downgrade` commits its virtual store, so the ranges come
+// from the real reader: `@yudiel/react-qr-scanner` pins `barcode-detector`
+// exactly at 3.0.3 while `expo-camera` declares `^3.0.0` and resolved 3.2.2.
+const downgradeScenario = "exact-pin-forces-downgrade";
+const readDowngradeManifest = createManifestReader(fixturesBase(`../../test/fixtures/${downgradeScenario}`));
+const rangeOf = (ranges, packageName, dependentKey) => ranges.get(packageName)?.find((dependent) => dependent.key === dependentKey)
+    ?.range;
+describe("collectDependentRanges", () => {
+    it("takes a direct dependency's range from the importer specifier", () => {
+        deepStrictEqual(rangesFor("simple", ["semver"]).get("semver"), [
+            {
+                key: "package.json in dependencies",
+                range: "7.7.3",
+                resolvedVersion: "7.7.3",
+                workspace: { path: ".", depType: "dependencies" },
+            },
+        ]);
+    });
+    it("ignores packages that are not in the requested set", () => {
+        deepStrictEqual([...rangesFor("duplicated-babel-frame", ["@babel/code-frame"]).keys()], ["@babel/code-frame"]);
+    });
+    it("reads a transitive dependent's declared range from its manifest", () => {
+        const ranges = rangesFor(wildcardScenario, wildcardPackages, readWildcardManifest);
+        for (const name of wildcardPackages) {
+            strictEqual(rangeOf(ranges, name, wildcardDependent), "*");
+        }
+    });
+    it("falls back to the resolved version when the manifest is unavailable", () => {
+        const ranges = rangesFor(wildcardScenario, wildcardPackages);
+        for (const name of wildcardPackages) {
+            strictEqual(rangeOf(ranges, name, wildcardDependent), "0.87.0");
+        }
+    });
+    // pnpm folds a resolved peer into the snapshot's `dependencies`, so the edge is
+    // there — but only as the version it resolved to. The range stays in the
+    // `packages:` entry, and read from there a peer constraint needs no
+    // `node_modules`: without it every one of these read as an exact pin of 10.5.0,
+    // and no version could satisfy them all.
+    it("reads a peer range from the lockfile when no manifest is available", () => {
+        const ranges = rangesFor("duplicated-typescript-eslint", ["eslint"]);
+        strictEqual(rangeOf(ranges, "eslint", "@eslint-community/eslint-utils@4.9.1"), "^6.0.0 || ^7.0.0 || >=8.0.0");
+        strictEqual(rangeOf(ranges, "eslint", "@typescript-eslint/eslint-plugin@8.61.0"), "^8.57.0 || ^9.0.0 || ^10.0.0");
+        // declared optional, and kept: pnpm only writes the edge once something
+        // provides the peer, so an edge that exists is a peer that was provided
+        strictEqual(rangeOf(ranges, "eslint", "@eslint/js@10.0.1"), "^10.0.0");
+    });
+    // pnpm resolves a peer like any other edge, so nothing in the snapshot tells a
+    // peer requester apart from one holding a copy of its own — the report has to
+    it("marks a dependent whose range came from a peer declaration", () => {
+        const dependents = rangesFor("duplicated-typescript-eslint", ["eslint"]).get("eslint") ?? [];
+        strictEqual(dependents.find((dependent) => dependent.key === "eslint-plugin-n@17.24.0")?.peer, true);
+        // a real dependency edge onto the same package stays unmarked
+        strictEqual(rangesFor("duplicated-typescript-eslint", ["@eslint/plugin-kit"])
+            .get("@eslint/plugin-kit")
+            ?.find((dependent) => dependent.key === "eslint@10.5.0")?.peer, undefined);
+    });
+    // the manifest is read first, so a name a package declares as both a
+    // dependency and a peer keeps the dependency's range
+    it("prefers a manifest declaration over the lockfile peer block", () => {
+        strictEqual(rangeOf(rangesFor("duplicated-typescript-eslint", ["eslint"], (name, version) => name === "@eslint-community/eslint-utils" && version === "4.9.1"
+            ? { dependencies: { eslint: "^10.1.0" } }
+            : undefined), "eslint", "@eslint-community/eslint-utils@4.9.1"), "^10.1.0");
+    });
+    it("separates a caret dependent's range from the version it resolved to", () => {
+        const ranges = rangesFor(downgradeScenario, ["barcode-detector"], readDowngradeManifest);
+        deepStrictEqual(ranges.get("barcode-detector"), [
+            {
+                key: "@yudiel/react-qr-scanner@2.3.1",
+                range: "3.0.3",
+                resolvedVersion: "3.0.3",
+                requesterName: "@yudiel/react-qr-scanner",
+            },
+            {
+                key: "expo-camera@57.0.3",
+                range: "^3.0.0",
+                resolvedVersion: "3.2.2",
+                requesterName: "expo-camera",
+            },
+        ]);
+    });
+    // `aliased-swapped-names`: the importer reaches the real `typescript` through
+    // the `@typescript/native` key and hands the `typescript` key to another
+    // package. The dependent has to be filed under the npm name the specifier
+    // targets, with the range and the version the alias resolved to, and the key
+    // it was declared under — that key is what makes the declaration binding
+    // rather than a range the dedupe may rewrite.
+    it("resolves an importer alias whose key names another package", () => {
+        const ranges = rangesFor("aliased-swapped-names", [
+            "typescript",
+            "@typescript/typescript6",
+        ]);
+        deepStrictEqual(ranges.get("typescript"), [
+            {
+                key: "package.json in devDependencies",
+                range: "7.0.2",
+                resolvedVersion: "7.0.2",
+                aliasKey: "@typescript/native",
+                workspace: { path: ".", depType: "devDependencies" },
+            },
+            {
+                key: "tool@1.0.0",
+                range: "5.9.3",
+                resolvedVersion: "5.9.3",
+                requesterName: "tool",
+            },
+        ]);
+        deepStrictEqual(ranges.get("@typescript/typescript6"), [
+            {
+                key: "package.json in devDependencies",
+                range: "6.0.2",
+                resolvedVersion: "6.0.2",
+                aliasKey: "typescript",
+                workspace: { path: ".", depType: "devDependencies" },
+            },
+        ]);
+    });
+    // pnpm writes an aliased importer's `version` as `realName@version`, which is
+    // not a version: carrying it through would put a string no semver call accepts
+    // where the resolved version belongs.
+    it("strips the alias target from an importer's resolved version", () => {
+        deepStrictEqual(rangesFor("mergeable-alias", ["printable-shell-command"])
+            .get("printable-shell-command")
+            ?.filter((dependent) => dependent.workspace !== undefined), [
+            {
+                key: "package.json in devDependencies",
+                range: "^5.0.0",
+                resolvedVersion: "5.3.1",
+                workspace: { path: ".", depType: "devDependencies" },
+            },
+            {
+                key: "package.json in devDependencies",
+                range: "5.0.7",
+                resolvedVersion: "5.0.7",
+                aliasKey: "printable-shell-command-pinned",
+                workspace: { path: ".", depType: "devDependencies" },
+            },
+        ]);
+    });
+    it("keeps the exact ranges a package declares for its own family", () => {
+        const ranges = rangesFor(wildcardScenario, wildcardPackages, readWildcardManifest);
+        for (const name of wildcardPackages) {
+            strictEqual(rangeOf(ranges, name, "metro@0.84.5"), "0.84.5");
+            strictEqual(rangeOf(ranges, name, "metro@0.87.0"), "0.87.0");
+        }
+    });
+    // A `workspace:`, `catalog:`, `file:` or `link:` specifier names something
+    // other than the npm package sharing its key, and a dist-tag carries no
+    // comparable range. Both would read as unsatisfiable ranges rather than as
+    // "no constraint", which suppresses merges the real dependents allow.
+    it("leaves out importer specifiers that are not npm ranges", () => {
+        const ranges = rangesFor("protocol-dependents", [
+            "helper",
+            "semver",
+            "picocolors",
+            "left-pad",
+            "kleur",
+            "chalk",
+        ]);
+        // only the snapshot dependent of `app` survives for semver; the importer
+        // declares it as `latest`
+        deepStrictEqual(ranges.get("semver"), [
+            {
+                key: "app@1.0.0",
+                range: "7.8.1",
+                resolvedVersion: "7.8.1",
+                requesterName: "app",
+            },
+        ]);
+        for (const name of ["helper", "picocolors", "left-pad", "kleur", "chalk"]) {
+            strictEqual(ranges.has(name), false);
+        }
+    });
+    // A transitive dependent whose installed manifest declares a non-npm
+    // protocol falls back to the version it actually got, rather than carrying
+    // `workspace:*` into a semver comparison.
+    it("falls back to the resolved version when the manifest range is not comparable", () => {
+        const readWorkspaceManifest = (name, version) => name === "@tamagui/metro-plugin" && version === "1.139.4"
+            ? {
+                dependencies: {
+                    "metro-config": "workspace:*",
+                    "metro-transform-worker": "*",
+                },
+            }
+            : undefined;
+        const ranges = rangesFor(wildcardScenario, wildcardPackages, readWorkspaceManifest);
+        strictEqual(rangeOf(ranges, "metro-config", wildcardDependent), 
+        // the resolved version, not `*` and not `workspace:*`
+        "0.87.0");
+        strictEqual(rangeOf(ranges, "metro-transform-worker", wildcardDependent), "*");
+    });
+});
+//# sourceMappingURL=collectDependentRanges.test.js.map