pnpm-dedup 2.1.0

package/dist/helpers/readInstalledManifest.js

@@ -0,0 +1,139 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { stripPeerSuffix } from "./parsePnpmLockPackages.js";
+const readManifestFile = (path) => {
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+};
+const readdirOrEmpty = (path) => {
+    try {
+        return readdirSync(path);
+    }
+    catch {
+        return [];
+    }
+};
+const readModulesState = (nodeModulesDir) => {
+    const hoistedLocations = new Map();
+    const parsed = (() => {
+        try {
+            const content = parseYaml(readFileSync(join(nodeModulesDir, ".modules.yaml"), "utf8"));
+            return typeof content === "object" && content !== null
+                ? content
+                : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    const hoisted = parsed?.hoistedLocations;
+    if (typeof hoisted === "object" && hoisted !== null) {
+        for (const [depPath, paths] of Object.entries(hoisted)) {
+            if (!Array.isArray(paths))
+                continue;
+            const key = stripPeerSuffix(depPath);
+            hoistedLocations.set(key, [
+                ...(hoistedLocations.get(key) ?? []),
+                ...paths.filter((path) => typeof path === "string"),
+            ]);
+        }
+    }
+    const virtualStoreDir = parsed?.virtualStoreDir;
+    return {
+        virtualStoreDir: typeof virtualStoreDir === "string" ? virtualStoreDir : ".pnpm",
+        hoistedLocations,
+    };
+};
+/**
+ * Build a reader that locates an installed package's manifest, whichever
+ * node-linker the project uses:
+ *
+ * - virtual store (pnpm's default): the dep path gives the directory,
+ *   `node_modules/.pnpm/<name with / replaced by +>@<version>[(peers)|_hash]/node_modules/<name>`;
+ * - `nodeLinker: hoisted`: the layout is npm-shaped and placement is a hoisting
+ *   decision, so `node_modules/.modules.yaml` is consulted for the exact paths;
+ *   a flat `node_modules/<name>` and one level of nesting are tried as a
+ *   fallback when that file is missing.
+ *
+ * `stats` tells callers whether anything was readable at all: every declared
+ * range comes from these manifests, so a reader that finds nothing silently
+ * turns every dependent's range into an exact pin and hides every fix.
+ */
+export const createManifestReaderWithStats = (projectDir) => {
+    const nodeModulesDir = join(projectDir, "node_modules");
+    const modules = readModulesState(nodeModulesDir);
+    // `virtualStoreDir` is configurable and recorded in `.modules.yaml`, relative
+    // to node_modules unless absolute
+    const pnpmDir = isAbsolute(modules.virtualStoreDir)
+        ? modules.virtualStoreDir
+        : join(nodeModulesDir, modules.virtualStoreDir);
+    const cache = new Map();
+    const stats = { found: 0, missed: 0 };
+    const virtualStoreEntries = readdirOrEmpty(pnpmDir);
+    const hoistedLocations = modules.hoistedLocations;
+    // top-level package dirs, for the nested lookup of the hoisted layout
+    const hoistedDependents = (() => {
+        let dirs;
+        return () => {
+            dirs ??= readdirOrEmpty(nodeModulesDir).flatMap((entry) => entry.startsWith("@")
+                ? readdirOrEmpty(join(nodeModulesDir, entry)).map((scoped) => join(entry, scoped))
+                : [entry]);
+            return dirs;
+        };
+    })();
+    const fromVirtualStore = (name, version) => {
+        const target = `${name.replaceAll("/", "+")}@${version}`;
+        const dir = virtualStoreEntries.find((entry) => entry === target ||
+            entry.startsWith(`${target}(`) ||
+            entry.startsWith(`${target}_`));
+        return dir
+            ? readManifestFile(join(pnpmDir, dir, "node_modules", name, "package.json"))
+            : undefined;
+    };
+    const fromHoisted = (name, version) => {
+        const atVersion = (path) => {
+            const manifest = readManifestFile(path);
+            return manifest?.version === version ? manifest : undefined;
+        };
+        // the recorded locations are relative to the project directory
+        for (const location of hoistedLocations.get(`${name}@${version}`) ?? []) {
+            const recorded = atVersion(join(projectDir, location, "package.json"));
+            if (recorded)
+                return recorded;
+        }
+        const hoisted = atVersion(join(nodeModulesDir, name, "package.json"));
+        if (hoisted)
+            return hoisted;
+        // no `.modules.yaml`: a version that could not be hoisted lives under
+        // whichever dependent needed it, so try one level of nesting
+        for (const dependent of hoistedDependents()) {
+            const nested = atVersion(join(nodeModulesDir, dependent, "node_modules", name, "package.json"));
+            if (nested)
+                return nested;
+        }
+        return undefined;
+    };
+    const readManifest = (name, version) => {
+        const cacheKey = `${name}@${version}`;
+        if (cache.has(cacheKey)) {
+            return cache.get(cacheKey);
+        }
+        const manifest = fromVirtualStore(name, version) ?? fromHoisted(name, version);
+        if (manifest) {
+            stats.found += 1;
+        }
+        else {
+            stats.missed += 1;
+        }
+        cache.set(cacheKey, manifest);
+        return manifest;
+    };
+    return { readManifest, stats: () => ({ ...stats }) };
+};
+export const createManifestReader = (projectDir) => createManifestReaderWithStats(projectDir).readManifest;
+//# sourceMappingURL=readInstalledManifest.js.map

package/dist/helpers/readInstalledManifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readInstalledManifest.js","sourceRoot":"","sources":["../../src/helpers/readInstalledManifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAmB7D,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAiC,EAAE;IACvE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAY,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAYF,MAAM,gBAAgB,GAAG,CAAC,cAAsB,EAAgB,EAAE;IAChE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAErD,MAAM,MAAM,GAAG,CAAC,GAAwC,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,SAAS,CACvB,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CACjD,CAAC;YACb,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;gBACpD,CAAC,CAAE,OAAmC;gBACtC,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,OAAO,GAAG,MAAM,EAAE,gBAAgB,CAAC;IACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAC3C,OAAkC,CACnC,EAAE,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACrC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;gBACxB,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACpC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;aACpE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,EAAE,eAAe,CAAC;IAEhD,OAAO;QACL,eAAe,EACb,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO;QACjE,gBAAgB;KACjB,CAAC;AACJ,CAAC,CAAC;AACF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,UAAkB,EACkD,EAAE;IACtE,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACjD,8EAA8E;IAC9E,kCAAkC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;QACjD,CAAC,CAAC,OAAO,CAAC,eAAe;QACzB,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC/D,MAAM,KAAK,GAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAE3D,MAAM,mBAAmB,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAClD,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE;QAC9B,IAAI,IAA0B,CAAC;QAC/B,OAAO,GAAa,EAAE;YACpB,IAAI,KAAK,cAAc,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACxD,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBACnB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACzD,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CACpB;gBACH,CAAC,CAAC,CAAC,KAAK,CAAC,CACZ,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;IACJ,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,gBAAgB,GAAG,CACvB,IAAY,EACZ,OAAe,EACgB,EAAE;QACjC,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAClC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,MAAM;YAChB,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;YAC9B,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACjC,CAAC;QACF,OAAO,GAAG;YACR,CAAC,CAAC,gBAAgB,CACd,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,CACzD;YACH,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAClB,IAAY,EACZ,OAAe,EACgB,EAAE;QACjC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAiC,EAAE;YAChE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,CAAC,CAAC;QAEF,+DAA+D;QAC/D,KAAK,MAAM,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;YACvE,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;QACtE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,sEAAsE;QACtE,6DAA6D;QAC7D,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,SAAS,CACtB,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,CACtE,CAAC;YACF,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,QAAQ,GACZ,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAkB,EAAkB,EAAE,CACzE,6BAA6B,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC"}

package/dist/helpers/readInstalledManifest.test.js

@@ -0,0 +1,83 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, strictEqual } from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createManifestReaderWithStats } from "./readInstalledManifest.js";
+const hoistedFixture = fileURLToPath(new URL("../../test/fixtures/hoisted-node-linker", import.meta.url));
+describe("createManifestReaderWithStats", () => {
+    it("reads a hoisted layout, top-level and nested", () => {
+        const { readManifest, stats } = createManifestReaderWithStats(hoistedFixture);
+        // hoisted at the top of node_modules
+        deepStrictEqual(readManifest("mini-metro", "0.84.5")?.dependencies, {
+            "mini-metro-config": "0.84.5",
+        });
+        // the version that lost the hoist, nested under its dependent
+        deepStrictEqual(readManifest("mini-metro", "0.87.0")?.dependencies, {
+            "mini-metro-config": "0.87.0",
+        });
+        // the open range this whole scenario turns on
+        deepStrictEqual(readManifest("mini-plugin", "1.0.0")?.dependencies, {
+            "mini-metro-config": "*",
+        });
+        deepStrictEqual(stats(), { found: 3, missed: 0 });
+    });
+    it("resolves a location only pnpm's own index knows", () => {
+        const { readManifest } = createManifestReaderWithStats(hoistedFixture);
+        // three levels down: reachable from `.modules.yaml`'s hoistedLocations,
+        // not from scanning node_modules one level deep
+        deepStrictEqual(readManifest("mini-deep", "2.0.0")?.dependencies, {
+            "mini-metro-config": "*",
+        });
+    });
+    it("does not return a manifest whose version differs", () => {
+        const { readManifest, stats } = createManifestReaderWithStats(hoistedFixture);
+        strictEqual(readManifest("mini-metro", "9.9.9"), undefined);
+        deepStrictEqual(stats(), { found: 0, missed: 1 });
+    });
+    it("reads pnpm's virtual store layout, peer suffix included", () => {
+        const dir = mkdtempSync(join(tmpdir(), "pnpm-dedup-virtual-store-"));
+        try {
+            const packageDir = join(dir, "node_modules", ".pnpm", "@scope+pkg@1.2.3(react@19.0.0)", "node_modules", "@scope", "pkg");
+            mkdirSync(packageDir, { recursive: true });
+            writeFileSync(join(packageDir, "package.json"), JSON.stringify({
+                name: "@scope/pkg",
+                version: "1.2.3",
+                peerDependencies: { react: "*" },
+            }));
+            const { readManifest, stats } = createManifestReaderWithStats(dir);
+            deepStrictEqual(readManifest("@scope/pkg", "1.2.3")?.peerDependencies, {
+                react: "*",
+            });
+            deepStrictEqual(stats(), { found: 1, missed: 0 });
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    it("honors a relocated virtual store", () => {
+        const dir = mkdtempSync(join(tmpdir(), "pnpm-dedup-relocated-store-"));
+        try {
+            const packageDir = join(dir, "node_modules", ".pnpm-store", "pkg@1.0.0", "node_modules", "pkg");
+            mkdirSync(packageDir, { recursive: true });
+            writeFileSync(join(packageDir, "package.json"), JSON.stringify({ name: "pkg", version: "1.0.0", dependencies: {} }));
+            writeFileSync(join(dir, "node_modules", ".modules.yaml"), JSON.stringify({
+                nodeLinker: "isolated",
+                virtualStoreDir: ".pnpm-store",
+            }));
+            const { readManifest } = createManifestReaderWithStats(dir);
+            strictEqual(readManifest("pkg", "1.0.0")?.version, "1.0.0");
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    it("reports every read as missed when nothing is installed", () => {
+        const { readManifest, stats } = createManifestReaderWithStats(join(tmpdir(), "pnpm-dedup-not-installed"));
+        strictEqual(readManifest("mini-metro", "0.84.5"), undefined);
+        strictEqual(readManifest("mini-plugin", "1.0.0"), undefined);
+        deepStrictEqual(stats(), { found: 0, missed: 2 });
+    });
+});
+//# sourceMappingURL=readInstalledManifest.test.js.map

package/dist/helpers/readInstalledManifest.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readInstalledManifest.test.js","sourceRoot":"","sources":["../../src/helpers/readInstalledManifest.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,cAAc,GAAG,aAAa,CAClC,IAAI,GAAG,CAAC,yCAAyC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CACpE,CAAC;AAEF,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAC3B,6BAA6B,CAAC,cAAc,CAAC,CAAC;QAEhD,qCAAqC;QACrC,eAAe,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE;YAClE,mBAAmB,EAAE,QAAQ;SAC9B,CAAC,CAAC;QACH,8DAA8D;QAC9D,eAAe,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE;YAClE,mBAAmB,EAAE,QAAQ;SAC9B,CAAC,CAAC;QACH,8CAA8C;QAC9C,eAAe,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE;YAClE,mBAAmB,EAAE,GAAG;SACzB,CAAC,CAAC;QAEH,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,EAAE,YAAY,EAAE,GAAG,6BAA6B,CAAC,cAAc,CAAC,CAAC;QAEvE,wEAAwE;QACxE,gDAAgD;QAChD,eAAe,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE;YAChE,mBAAmB,EAAE,GAAG;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAC3B,6BAA6B,CAAC,cAAc,CAAC,CAAC;QAEhD,WAAW,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;QAC5D,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CACrB,GAAG,EACH,cAAc,EACd,OAAO,EACP,gCAAgC,EAChC,cAAc,EACd,QAAQ,EACR,KAAK,CACN,CAAC;YACF,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,aAAa,CACX,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAChC,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,OAAO;gBAChB,gBAAgB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;aACjC,CAAC,CACH,CAAC;YAEF,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;YACnE,eAAe,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,gBAAgB,EAAE;gBACrE,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;YACH,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CACrB,GAAG,EACH,cAAc,EACd,aAAa,EACb,WAAW,EACX,cAAc,EACd,KAAK,CACN,CAAC;YACF,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,aAAa,CACX,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAChC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CACpE,CAAC;YACF,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,eAAe,CAAC,EAC1C,IAAI,CAAC,SAAS,CAAC;gBACb,UAAU,EAAE,UAAU;gBACtB,eAAe,EAAE,aAAa;aAC/B,CAAC,CACH,CAAC;YAEF,MAAM,EAAE,YAAY,EAAE,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC;YAC5D,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,6BAA6B,CAC3D,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAC3C,CAAC;QAEF,WAAW,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7D,WAAW,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7D,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/helpers/runPnpm.js

@@ -0,0 +1,16 @@
+import { spawnSync } from "node:child_process";
+export const runPnpm = (args, { cwd, stdio = "inherit" } = {}) => {
+    const result = spawnSync("pnpm", args, {
+        cwd,
+        stdio,
+        encoding: "utf8",
+    });
+    if (result.error) {
+        throw result.error;
+    }
+    return {
+        status: result.status,
+        output: stdio === "pipe" ? `${result.stdout}\n${result.stderr}` : "",
+    };
+};
+//# sourceMappingURL=runPnpm.js.map

package/dist/helpers/runPnpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runPnpm.js","sourceRoot":"","sources":["../../src/helpers/runPnpm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAkB/C,MAAM,CAAC,MAAM,OAAO,GAAe,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,GAAG,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE;IAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;QACrC,GAAG;QACH,KAAK;QACL,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;KACrE,CAAC;AACJ,CAAC,CAAC"}

package/dist/helpers/tempProjects.js

@@ -0,0 +1,85 @@
+import { mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+// Scratch projects for the tests that need a real directory on disk. The
+// end-to-end ones run an actual install in theirs, so a leaked directory is
+// tens of megabytes.
+//
+// `afterEach` covers the normal path — a passing, failing or timed-out test all
+// reach it — but not a signal: on Ctrl-C the test runner exits without running
+// the remaining hooks, and on SIGKILL nothing runs at all. So cleanup does not
+// rest on it alone:
+//   - the directory name carries the pid that owns it, and every run first
+//     reaps the leftovers of pids that are gone,
+//   - SIGINT/SIGTERM clean up before the signal is allowed through.
+const isRunning = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM: alive, but owned by another user — not ours to reap either way
+        return error.code === "EPERM";
+    }
+};
+const remove = (dir) => {
+    try {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    catch {
+        // a directory a still-running install is writing into can fail to unlink;
+        // the next run reaps it once that pid is gone
+    }
+};
+// the `${pid}-${mkdtemp suffix}` a `create` call leaves after the prefix. Names
+// that do not match are left alone: a random suffix read as a pid would reap
+// directories this helper never made.
+const ownerPidPattern = /^(?<pid>[1-9]\d*)-/u;
+const reapAbandoned = (prefix) => {
+    const root = tmpdir();
+    for (const name of readdirSync(root)) {
+        if (!name.startsWith(prefix))
+            continue;
+        const owner = ownerPidPattern.exec(name.slice(prefix.length))?.groups?.pid;
+        if (!owner || isRunning(Number(owner)))
+            continue;
+        remove(join(root, name));
+    }
+};
+const pendingCleanups = new Set();
+let signalsHooked = false;
+const hookSignals = () => {
+    if (signalsHooked)
+        return;
+    signalsHooked = true;
+    for (const signal of ["SIGINT", "SIGTERM"]) {
+        const handler = () => {
+            for (const cleanup of pendingCleanups)
+                cleanup();
+            // a listener suppresses the default termination: drop it and re-raise so
+            // the process still dies of the signal it was sent
+            process.removeListener(signal, handler);
+            process.kill(process.pid, signal);
+        };
+        process.on(signal, handler);
+    }
+};
+export const createTempProjects = (prefix) => {
+    reapAbandoned(prefix);
+    hookSignals();
+    const dirs = [];
+    const cleanup = () => {
+        for (const dir of dirs.splice(0))
+            remove(dir);
+    };
+    pendingCleanups.add(cleanup);
+    return {
+        create: () => {
+            const dir = mkdtempSync(join(tmpdir(), `${prefix}${process.pid}-`));
+            dirs.push(dir);
+            return dir;
+        },
+        cleanup,
+    };
+};
+//# sourceMappingURL=tempProjects.js.map

package/dist/helpers/tempProjects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tempProjects.js","sourceRoot":"","sources":["../../src/helpers/tempProjects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,yEAAyE;AACzE,4EAA4E;AAC5E,qBAAqB;AACrB,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,oBAAoB;AACpB,2EAA2E;AAC3E,iDAAiD;AACjD,oEAAoE;AAEpE,MAAM,SAAS,GAAG,CAAC,GAAW,EAAW,EAAE;IACzC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,GAAW,EAAQ,EAAE;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,8CAA8C;IAChD,CAAC;AACH,CAAC,CAAC;AAEF,gFAAgF;AAChF,6EAA6E;AAC7E,sCAAsC;AACtC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C,MAAM,aAAa,GAAG,CAAC,MAAc,EAAQ,EAAE;IAC7C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QACvC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC;QAC3E,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QACjD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAc,CAAC;AAC9C,IAAI,aAAa,GAAG,KAAK,CAAC;AAE1B,MAAM,WAAW,GAAG,GAAS,EAAE;IAC7B,IAAI,aAAa;QAAE,OAAO;IAC1B,aAAa,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,KAAK,MAAM,OAAO,IAAI,eAAe;gBAAE,OAAO,EAAE,CAAC;YACjD,yEAAyE;YACzE,mDAAmD;YACnD,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAgB,EAAE;IACjE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC;IAEd,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC;IACF,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,GAAW,EAAE;YACnB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO;KACR,CAAC;AACJ,CAAC,CAAC"}

package/dist/helpers/toLockstepGraph.js

@@ -0,0 +1,34 @@
+import { resolveSnapshotDependency } from "./parsePnpmLockPackages.js";
+const snapshotDepTypes = ["dependencies", "optionalDependencies"];
+const snapshotDependencies = (lock, snapshotKey) => {
+    const snapshot = lock.snapshots?.[snapshotKey];
+    const dependencies = {};
+    snapshotDepTypes.forEach((depType) => {
+        for (const [depName, depValue] of Object.entries(snapshot?.[depType] ?? {})) {
+            const resolved = resolveSnapshotDependency(depName, depValue);
+            dependencies[resolved.name] = resolved.version;
+        }
+    });
+    return dependencies;
+};
+/**
+ * Adapt the pnpm lockfile model into the package-manager-neutral graph consumed
+ * by `buildLockstepClusters`. pnpm snapshots store the *resolved* version of
+ * each dependency instead of the requested range, which co-version detection
+ * handles; one entry is emitted per installation, so a resolution installed in
+ * several peer contexts contributes every context it appears in.
+ */
+export const toLockstepGraph = (lock, packagesMap) => Object.fromEntries(Object.entries(packagesMap).map(([name, resolutions]) => [
+    name,
+    resolutions.flatMap((resolution) => {
+        if (resolution.package.type !== "npm") {
+            return [{ version: "", isNpm: false, dependencies: {} }];
+        }
+        return resolution.installations.map((snapshotKey) => ({
+            version: resolution.package.version,
+            isNpm: true,
+            dependencies: snapshotDependencies(lock, snapshotKey),
+        }));
+    }),
+]));
+//# sourceMappingURL=toLockstepGraph.js.map

package/dist/helpers/toLockstepGraph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toLockstepGraph.js","sourceRoot":"","sources":["../../src/helpers/toLockstepGraph.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,MAAM,gBAAgB,GAAG,CAAC,cAAc,EAAE,sBAAsB,CAAU,CAAC;AAE3E,MAAM,oBAAoB,GAAG,CAC3B,IAAkB,EAClB,WAAmB,EACK,EAAE;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,YAAY,GAA2B,EAAE,CAAC;IAEhD,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAC9C,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAC1B,EAAE,CAAC;YACF,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC9D,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,IAAkB,EAClB,WAAwB,EACT,EAAE,CACjB,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;IACvD,IAAI;IACJ,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAwB,EAAE;QACvD,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACtC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACpD,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO;YACnC,KAAK,EAAE,IAAI;YACX,YAAY,EAAE,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC;SACtD,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;CACH,CAAC,CACH,CAAC"}

package/dist/helpers/toLockstepGraph.test.js

@@ -0,0 +1,81 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { fileURLToPath } from "node:url";
+import { readPnpmLock } from "../readPnpmLock.js";
+import { buildPnpmPackagesMap } from "./buildPnpmPackagesMap.js";
+import { parsePnpmLockPackages } from "./parsePnpmLockPackages.js";
+import { toLockstepGraph } from "./toLockstepGraph.js";
+const fixturesBase = (rel) => fileURLToPath(new URL(rel, import.meta.url));
+const graphOf = (lock) => toLockstepGraph(lock, buildPnpmPackagesMap(parsePnpmLockPackages(lock)));
+const graphFor = (scenario) => graphOf(readPnpmLock(fixturesBase(`../../test/fixtures/${scenario}/pnpm-lock.yaml`)));
+describe("toLockstepGraph", () => {
+    it("strips peer suffixes, resolves aliases, and keeps every installation", () => {
+        const graph = graphOf({
+            lockfileVersion: "9.0",
+            packages: {
+                "a@1.0.0": {},
+                "b@1.0.0": {},
+                "alias-target@2.0.0": {},
+            },
+            snapshots: {
+                "a@1.0.0(peer@1.0.0)": {
+                    dependencies: {
+                        b: "1.0.0(peer@1.0.0)",
+                        aliased: "alias-target@2.0.0",
+                    },
+                },
+                "a@1.0.0(peer@2.0.0)": {
+                    dependencies: { b: "1.0.0" },
+                },
+                "b@1.0.0": {},
+                "alias-target@2.0.0": {},
+            },
+        });
+        // one entry per peer context, both carrying the same resolved version
+        deepStrictEqual(graph.a, [
+            {
+                version: "1.0.0",
+                isNpm: true,
+                dependencies: { b: "1.0.0", "alias-target": "2.0.0" },
+            },
+            { version: "1.0.0", isNpm: true, dependencies: { b: "1.0.0" } },
+        ]);
+    });
+    it("maps metro's exact self-pins to co-version edges", () => {
+        const metro = graphFor("wildcard-not-reused").metro;
+        ok(metro);
+        deepStrictEqual(metro.map((resolution) => resolution.version).toSorted(), [
+            "0.84.5",
+            "0.87.0",
+        ]);
+        for (const resolution of metro) {
+            strictEqual(resolution.isNpm, true);
+            strictEqual(resolution.dependencies["metro-config"], resolution.version);
+            // an unrelated dependency keeps its own version line
+            ok(resolution.dependencies.debug?.startsWith("4."));
+        }
+    });
+    // `aliased-swapped-names`: the keys the importer uses name each other's
+    // package. The graph is keyed by npm name, so `@typescript/typescript6` has to
+    // stay its own name and `tool`'s edge has to land on the real `typescript`.
+    it("keeps swapped alias keys apart", () => {
+        const graph = graphFor("aliased-swapped-names");
+        deepStrictEqual(Object.keys(graph).toSorted(), [
+            "@typescript/typescript6",
+            "tool",
+            "typescript",
+        ]);
+        deepStrictEqual(graph.tool?.[0]?.dependencies, { typescript: "5.9.3" });
+        strictEqual(graph.typescript?.length, 2);
+    });
+    it("marks non-npm resolutions so cluster detection skips them", () => {
+        const nonNpm = Object.values(graphFor("non-npm"))
+            .flat()
+            .filter((resolution) => !resolution.isNpm);
+        ok(nonNpm.length > 0);
+        for (const resolution of nonNpm) {
+            deepStrictEqual(resolution.dependencies, {});
+        }
+    });
+});
+//# sourceMappingURL=toLockstepGraph.test.js.map

package/dist/helpers/toLockstepGraph.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toLockstepGraph.test.js","sourceRoot":"","sources":["../../src/helpers/toLockstepGraph.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE,CACnC,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/C,MAAM,OAAO,GAAG,CAAC,IAAkB,EAAE,EAAE,CACrC,eAAe,CAAC,IAAI,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE3E,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE,CACpC,OAAO,CACL,YAAY,CACV,YAAY,CAAC,uBAAuB,QAAQ,iBAAiB,CAAC,CAC/D,CACF,CAAC;AAEJ,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,KAAK,GAAG,OAAO,CAAC;YACpB,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE;gBACR,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;gBACb,oBAAoB,EAAE,EAAE;aACzB;YACD,SAAS,EAAE;gBACT,qBAAqB,EAAE;oBACrB,YAAY,EAAE;wBACZ,CAAC,EAAE,mBAAmB;wBACtB,OAAO,EAAE,oBAAoB;qBAC9B;iBACF;gBACD,qBAAqB,EAAE;oBACrB,YAAY,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE;iBAC7B;gBACD,SAAS,EAAE,EAAE;gBACb,oBAAoB,EAAE,EAAE;aACzB;SACF,CAAC,CAAC;QAEH,sEAAsE;QACtE,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE;YACvB;gBACE,OAAO,EAAE,OAAO;gBAChB,KAAK,EAAE,IAAI;gBACX,YAAY,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE;aACtD;YACD,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;SAChE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC;QACpD,EAAE,CAAC,KAAK,CAAC,CAAC;QACV,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YACxE,QAAQ;YACR,QAAQ;SACT,CAAC,CAAC;QAEH,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;YAC/B,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACpC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;YACzE,qDAAqD;YACrD,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,+EAA+E;IAC/E,4EAA4E;IAC5E,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QAEhD,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC7C,yBAAyB;YACzB,MAAM;YACN,YAAY;SACb,CAAC,CAAC;QACH,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;aAC9C,IAAI,EAAE;aACN,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7C,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtB,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;YAChC,eAAe,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/helpers/versionsSnapshot.js

@@ -0,0 +1,5 @@
+import { buildVersionsSnapshot } from "pm-dedup-core";
+import { readPnpmLock } from "../readPnpmLock.js";
+import { parsePnpmLockPackages } from "./parsePnpmLockPackages.js";
+export const readVersionsSnapshot = (lockPath) => buildVersionsSnapshot(parsePnpmLockPackages(readPnpmLock(lockPath)).packages.values());
+//# sourceMappingURL=versionsSnapshot.js.map

package/dist/helpers/versionsSnapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"versionsSnapshot.js","sourceRoot":"","sources":["../../src/helpers/versionsSnapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAgB,EAAoB,EAAE,CACzE,qBAAqB,CACnB,qBAAqB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAChE,CAAC"}

package/dist/identifyClusterFixes.js

@@ -0,0 +1,53 @@
+import { buildLockstepClusters, identifyLockstepClusterFixes, } from "pm-dedup-core";
+import { collectDependentRanges } from "./helpers/collectDependentRanges.js";
+import { toLockstepGraph } from "./helpers/toLockstepGraph.js";
+// A lone duplicated package is a cluster of one: nothing co-versions with it,
+// but it converges through the same mechanism — the dependents that hold its
+// copies apart — and it is applied the same way, by an override the resolver
+// then has to confirm.
+const singletonClusters = (packagesMap, clustered) => Object.entries(packagesMap)
+    .filter(([name, resolutions]) => !clustered.has(name) &&
+    resolutions.filter((resolution) => resolution.package.type === "npm")
+        .length > 1)
+    .map(([name]) => [name]);
+const toClusterMembers = (packagesMap, memberNames) => Object.fromEntries(memberNames.map((name) => {
+    const resolutions = packagesMap[name] ?? [];
+    return [
+        name,
+        {
+            npmVersions: resolutions
+                .filter((resolution) => resolution.package.type === "npm")
+                .map((resolution) => resolution.package.version),
+            resolutionCount: resolutions.length,
+        },
+    ];
+}));
+// The pnpm lockfile stores resolved versions, not requested ranges, so the
+// constraints have to come from `collectDependentRanges`, which recovers the
+// declared range from each requester's installed manifest.
+const toClusterDependents = (lock, memberNames, readManifest) => {
+    const ranges = collectDependentRanges(lock, new Set(memberNames), readManifest);
+    return new Map([...ranges].map(([name, dependents]) => [
+        name,
+        dependents.map((dependent) => ({
+            requester: dependent.key,
+            requesterName: dependent.requesterName,
+            range: dependent.range,
+            isAlias: dependent.aliasKey !== undefined,
+            resolvedVersion: dependent.resolvedVersion,
+            workspace: dependent.workspace,
+        })),
+    ]));
+};
+export const identifyClusterFixes = (lock, packagesMap, readManifest) => {
+    const lockstepClusters = buildLockstepClusters(toLockstepGraph(lock, packagesMap));
+    const clusters = [
+        ...lockstepClusters,
+        ...singletonClusters(packagesMap, new Set(lockstepClusters.flat())),
+    ];
+    if (clusters.length === 0)
+        return [];
+    const memberNames = [...new Set(clusters.flat())];
+    return identifyLockstepClusterFixes(clusters, toClusterMembers(packagesMap, memberNames), toClusterDependents(lock, memberNames, readManifest)).filter((fix) => fix.members.length > 1 || fix.workspaceChanges.length === 0);
+};
+//# sourceMappingURL=identifyClusterFixes.js.map

package/dist/identifyClusterFixes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifyClusterFixes.js","sourceRoot":"","sources":["../src/identifyClusterFixes.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAS/D,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,uBAAuB;AACvB,MAAM,iBAAiB,GAAG,CACxB,WAAwB,EACxB,SAAsB,EACV,EAAE,CACd,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;KACxB,MAAM,CACL,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,CACtB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;IACpB,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC;SAClE,MAAM,GAAG,CAAC,CAChB;KACA,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7B,MAAM,gBAAgB,GAAG,CACvB,WAAwB,EACxB,WAAqB,EACF,EAAE,CACrB,MAAM,CAAC,WAAW,CAChB,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;IACvB,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO;QACL,IAAI;QACJ;YACE,WAAW,EAAE,WAAW;iBACrB,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC;iBACzD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC;YAClD,eAAe,EAAE,WAAW,CAAC,MAAM;SACpC;KACF,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,2EAA2E;AAC3E,6EAA6E;AAC7E,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,CAC1B,IAAkB,EAClB,WAAqB,EACrB,YAA4B,EACN,EAAE;IACxB,MAAM,MAAM,GAAG,sBAAsB,CACnC,IAAI,EACJ,IAAI,GAAG,CAAC,WAAW,CAAC,EACpB,YAAY,CACb,CAAC;IAEF,OAAO,IAAI,GAAG,CACZ,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI;QACJ,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC7B,SAAS,EAAE,SAAS,CAAC,GAAG;YACxB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,OAAO,EAAE,SAAS,CAAC,QAAQ,KAAK,SAAS;YACzC,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAC,CAAC;KACJ,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,IAAkB,EAClB,WAAwB,EACxB,YAA4B,EACd,EAAE;IAChB,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,CACnC,CAAC;IACF,MAAM,QAAQ,GAAG;QACf,GAAG,gBAAgB;QACnB,GAAG,iBAAiB,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;KACpE,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAElD,OAAO,4BAA4B,CACjC,QAAQ,EACR,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC1C,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,CAKrD,CAAC,MAAM,CACN,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,CACrE,CAAC;AACJ,CAAC,CAAC"}