File Explorer

1// a module that manages a shrinkwrap file (npm-shrinkwrap.json or2// package-lock.json).3 4// Increment whenever the lockfile version updates5// v1 - npm <=66// v2 - arborist v1, npm v7, backwards compatible with v1, add 'packages'7// v3 will drop the 'dependencies' field, backwards comp with v2, not v18//9// We cannot bump to v3 until npm v6 is out of common usage, and10// definitely not before npm v8.11 12const localeCompare = require('@isaacs/string-locale-compare')('en')13const defaultLockfileVersion = 314 15// for comparing nodes to yarn.lock entries16const mismatch = (a, b) => a && b && a !== b17 18// this.tree => the root node for the tree (ie, same path as this)19// - Set the first time we do `this.add(node)` for a path matching this.path20//21// this.add(node) =>22// - decorate the node with the metadata we have, if we have it, and it matches23// - add to the map of nodes needing to be committed, so that subsequent24// changes are captured when we commit that location's metadata.25//26// this.commit() =>27// - commit all nodes awaiting update to their metadata entries28// - re-generate this.data and this.yarnLock based on this.tree29//30// Note that between this.add() and this.commit(), `this.data` will be out of31// date!  Always call `commit()` before relying on it.32//33// After calling this.commit(), any nodes not present in the tree will have34// been removed from the shrinkwrap data as well.35 36const { log } = require('proc-log')37const YarnLock = require('./yarn-lock.js')38const {39  readFile,40  readdir,41  readlink,42  rm,43  stat,44  writeFile,45} = require('node:fs/promises')46 47const { resolve, basename, relative } = require('node:path')48const specFromLock = require('./spec-from-lock.js')49const versionFromTgz = require('./version-from-tgz.js')50const npa = require('npm-package-arg')51const pkgJson = require('@npmcli/package-json')52const parseJSON = require('parse-conflict-json')53const nameFromFolder = require('@npmcli/name-from-folder')54 55const stringify = require('json-stringify-nice')56const swKeyOrder = [57  'name',58  'version',59  'lockfileVersion',60  'resolved',61  'integrity',62  'requires',63  'packages',64  'dependencies',65]66 67// used to rewrite from yarn registry to npm registry68const yarnRegRe = /^https?:\/\/registry\.yarnpkg\.com\//69const npmRegRe = /^https?:\/\/registry\.npmjs\.org\//70 71// sometimes resolved: is weird or broken, or something npa can't handle72const specFromResolved = resolved => {73  try {74    return npa(resolved)75  } catch (er) {76    return {}77  }78}79 80const relpath = require('./relpath.js')81 82const consistentResolve = require('./consistent-resolve.js')83const { overrideResolves } = require('./override-resolves.js')84 85const pkgMetaKeys = [86  // note: name is included if necessary, for alias packages87  'version',88  'dependencies',89  'peerDependencies',90  'peerDependenciesMeta',91  'optionalDependencies',92  'bundleDependencies',93  'acceptDependencies',94  'funding',95  'engines',96  'os',97  'cpu',98  'libc',99  '_integrity',100  'license',101  '_hasShrinkwrap',102  'hasInstallScript',103  'bin',104  'deprecated',105  'workspaces',106]107 108const nodeMetaKeys = [109  'integrity',110  'inBundle',111  'hasShrinkwrap',112  'hasInstallScript',113]114 115const metaFieldFromPkg = (pkg, key) => {116  const val = pkg[key]117  if (val) {118    // get only the license type, not the full object119    if (key === 'license' && typeof val === 'object' && val.type) {120      return val.type121    }122    // skip empty objects and falsey values123    if (typeof val !== 'object' || Object.keys(val).length) {124      return val125    }126  }127  return null128}129 130// check to make sure that there are no packages newer than or missing from the hidden lockfile131const assertNoNewer = async (path, data, lockTime, dir, seen) => {132  const base = basename(dir)133  const isNM = dir !== path && base === 'node_modules'134  const isScope = dir !== path && base.startsWith('@')135  const isParent = (dir === path) || isNM || isScope136 137  const parent = isParent ? dir : resolve(dir, 'node_modules')138  const rel = relpath(path, dir)139  seen.add(rel)140  let entries141  if (dir === path) {142    entries = [{ name: 'node_modules', isDirectory: () => true }]143  } else {144    const { mtime: dirTime } = await stat(dir)145    if (dirTime > lockTime) {146      throw new Error(`out of date, updated: ${rel}`)147    }148    if (!isScope && !isNM && !data.packages[rel]) {149      throw new Error(`missing from lockfile: ${rel}`)150    }151    entries = await readdir(parent, { withFileTypes: true }).catch(() => [])152  }153 154  // TODO limit concurrency here, this is recursive155  await Promise.all(entries.map(async dirent => {156    const child = resolve(parent, dirent.name)157    if (dirent.isDirectory() && !dirent.name.startsWith('.')) {158      await assertNoNewer(path, data, lockTime, child, seen)159    } else if (dirent.isSymbolicLink()) {160      const target = resolve(parent, await readlink(child))161      const tstat = await stat(target).catch(162        /* istanbul ignore next - windows */ () => null)163      seen.add(relpath(path, child))164      /* istanbul ignore next - windows cannot do this */165      if (tstat?.isDirectory() && !seen.has(relpath(path, target))) {166        await assertNoNewer(path, data, lockTime, target, seen)167      }168    }169  }))170 171  if (dir !== path) {172    return173  }174 175  // The walk above can't reach two linked-strategy layouts: a store package's sibling deps under .store/<key>/node_modules (.store is a skipped dot-dir), and an undeclared workspace not symlinked into root node_modules. Walk those dirs, derived from the lockfile entries.176  // A dir reachable through a link entry is skipped: it was already reached (or, if the symlink is stale, correctly stays unseen so the lockfile is rejected). This keeps the hoisted strategy's stale-symlink detection intact, since there every workspace is a link target.177  const linkTargets = new Set()178  for (const loc in data.packages) {179    const { link, resolved } = data.packages[loc]180    if (link && resolved) {181      linkTargets.add(resolved.replace(/\\/g, '/'))182    }183  }184  const extraDirs = new Set()185  for (const loc in data.packages) {186    const store = loc.match(/^(.*\/\.store\/.+?)\/node_modules\//)187    if (store) {188      // .store/<key> is never walked but has no entry, so mark it seen.189      seen.add(store[1])190      extraDirs.add(`${store[1]}/node_modules`)191      continue192    }193    // A workspace/fsChild dir outside node_modules, e.g. packages/a.194    const i = loc.indexOf('/node_modules/')195    const root = i === -1 ? loc : loc.slice(0, i)196    if (root && !/(^|\/)node_modules(\/|$)/.test(root) && !linkTargets.has(root)) {197      extraDirs.add(root)198    }199  }200  for (const rel of extraDirs) {201    await assertNoNewer(path, data, lockTime, resolve(path, rel), seen)202  }203 204  // assert that all the entries in the lockfile were seen205  for (const loc in data.packages) {206    if (!seen.has(loc)) {207      throw new Error(`missing from node_modules: ${loc}`)208    }209  }210}211 212class Shrinkwrap {213  static get defaultLockfileVersion () {214    return defaultLockfileVersion215  }216 217  static load (options) {218    return new Shrinkwrap(options).load()219  }220 221  static get keyOrder () {222    return swKeyOrder223  }224 225  static async reset (options) {226    // still need to know if it was loaded from the disk, but don't227    // bother reading it if we're gonna just throw it away.228    const s = new Shrinkwrap(options)229    s.reset()230 231    const [sw, lock] = await s.resetFiles232 233    // XXX this is duplicated in this.load(), but using loadFiles instead of resetFiles234    if (s.hiddenLockfile) {235      s.filename = resolve(s.path, 'node_modules/.package-lock.json')236    } else if (s.shrinkwrapOnly || sw) {237      s.filename = resolve(s.path, 'npm-shrinkwrap.json')238    } else {239      s.filename = resolve(s.path, 'package-lock.json')240    }241    s.loadedFromDisk = !!(sw || lock)242    // TODO what uses this?243    s.type = basename(s.filename)244 245    return s246  }247 248  static metaFromNode (node, path, options = {}) {249    if (node.isLink) {250      return {251        resolved: relpath(path, node.realpath),252        link: true,253      }254    }255 256    const meta = {}257    for (const key of pkgMetaKeys) {258      const val = metaFieldFromPkg(node.package, key)259      if (val) {260        meta[key.replace(/^_/, '')] = val261      }262    }263    // we only include name if different from the node path name, and for the264    // root to help prevent churn based on the name of the directory the265    // project is in266    const pname = node.packageName267    // when Target package name and Target node share the same name, we include the name, target node should have name as per realpath.268    if (pname && (node === node.root || pname !== node.name || nameFromFolder(node.realpath) !== pname)) {269      meta.name = pname270    }271 272    if (node.isTop && node.package.devDependencies) {273      meta.devDependencies = node.package.devDependencies274    }275 276    for (const key of nodeMetaKeys) {277      if (node[key]) {278        meta[key] = node[key]279      }280    }281 282    const resolved = consistentResolve(node.resolved, node.path, path, true)283    // hide resolved from registry dependencies.284    if (!resolved) {285      // no-op286    } else if (node.isRegistryDependency) {287      meta.resolved = overrideResolves(resolved, options)288    } else {289      meta.resolved = resolved290    }291 292    if (node.extraneous) {293      meta.extraneous = true294    } else {295      if (node.peer) {296        meta.peer = true297      }298      if (node.dev) {299        meta.dev = true300      }301      if (node.optional) {302        meta.optional = true303      }304      if (node.devOptional && !node.dev && !node.optional) {305        meta.devOptional = true306      }307    }308    return meta309  }310 311  #awaitingUpdate = new Map()312 313  constructor (options = {}) {314    const {315      path,316      indent = 2,317      newline = '\n',318      shrinkwrapOnly = false,319      hiddenLockfile = false,320      lockfileVersion,321      resolveOptions = {},322    } = options323 324    if (hiddenLockfile) {325      this.lockfileVersion = 3326    } else if (lockfileVersion) {327      this.lockfileVersion = parseInt(lockfileVersion, 10)328    } else {329      this.lockfileVersion = null330    }331 332    this.tree = null333    this.path = resolve(path || '.')334    this.filename = null335    this.data = null336    this.indent = indent337    this.newline = newline338    this.loadedFromDisk = false339    this.type = null340    this.yarnLock = null341    this.hiddenLockfile = hiddenLockfile342    this.loadingError = null343    this.resolveOptions = resolveOptions344    // only load npm-shrinkwrap.json in dep trees, not package-lock345    this.shrinkwrapOnly = shrinkwrapOnly346  }347 348  // check to see if a spec is present in the yarn.lock file, and if so,349  // if we should use it, and what it should resolve to.  This is only350  // done when we did not load a shrinkwrap from disk.  Also, decorate351  // the options object if provided with the resolved and integrity that352  // we expect.353  checkYarnLock (spec, options = {}) {354    spec = npa(spec)355    const { yarnLock, loadedFromDisk } = this356    const useYarnLock = yarnLock && !loadedFromDisk357    const fromYarn = useYarnLock && yarnLock.entries.get(spec.raw)358    if (fromYarn && fromYarn.version) {359      // if it's the yarn or npm default registry, use the version as360      // our effective spec.  if it's any other kind of thing, use that.361      const { resolved, version, integrity } = fromYarn362      const isYarnReg = spec.registry && yarnRegRe.test(resolved)363      const isnpmReg = spec.registry && !isYarnReg && npmRegRe.test(resolved)364      const isReg = isnpmReg || isYarnReg365      // don't use the simple version if the "registry" url is366      // something else entirely!367      const tgz = isReg && versionFromTgz(spec.name, resolved) || {}368      let yspec = resolved369      if (tgz.name === spec.name && tgz.version === version) {370        yspec = version371      } else if (isReg && tgz.name && tgz.version) {372        yspec = `npm:${tgz.name}@${tgz.version}`373      }374      if (yspec) {375        options.resolved = resolved.replace(yarnRegRe, 'https://registry.npmjs.org/')376        options.integrity = integrity377        return npa(`${spec.name}@${yspec}`)378      }379    }380    return spec381  }382 383  // throw away the shrinkwrap data so we can start fresh384  // still worth doing a load() first so we know which files to write.385  reset () {386    this.tree = null387    this.#awaitingUpdate = new Map()388    const lockfileVersion = this.lockfileVersion || defaultLockfileVersion389    this.originalLockfileVersion = lockfileVersion390 391    this.data = {392      lockfileVersion,393      requires: true,394      packages: {},395      dependencies: {},396    }397  }398 399  // files to potentially read from and write to, in order of priority400  get #filenameSet () {401    if (this.shrinkwrapOnly) {402      return [`${this.path}/npm-shrinkwrap.json`]403    }404    if (this.hiddenLockfile) {405      return [`${this.path}/node_modules/.package-lock.json`]406    }407    return [408      `${this.path}/npm-shrinkwrap.json`,409      `${this.path}/package-lock.json`,410      `${this.path}/yarn.lock`,411    ]412  }413 414  get loadFiles () {415    return Promise.all(416      this.#filenameSet.map(file => file && readFile(file, 'utf8').then(d => d, er => {417        /* istanbul ignore else - can't test without breaking module itself */418        if (er.code === 'ENOENT') {419          return ''420        } else {421          throw er422        }423      }))424    )425  }426 427  get resetFiles () {428    // slice out yarn, we only care about lock or shrinkwrap when checking429    // this way, since we're not actually loading the full lock metadata430    return Promise.all(this.#filenameSet.slice(0, 2)431      .map(file => file && stat(file).then(st => st.isFile(), er => {432        /* istanbul ignore else - can't test without breaking module itself */433        if (er.code === 'ENOENT') {434          return null435        } else {436          throw er437        }438      })439      )440    )441  }442 443  inferFormattingOptions (packageJSONData) {444    const {445      [Symbol.for('indent')]: indent,446      [Symbol.for('newline')]: newline,447    } = packageJSONData448    if (indent !== undefined) {449      this.indent = indent450    }451    if (newline !== undefined) {452      this.newline = newline453    }454  }455 456  async load () {457    // we don't need to load package-lock.json except for top of tree nodes,458    // only npm-shrinkwrap.json.459    let data460    try {461      const [sw, lock, yarn] = await this.loadFiles462      data = sw || lock || '{}'463 464      // use shrinkwrap only for deps; otherwise, prefer package-lock465      // and ignore npm-shrinkwrap if both are present.466      // TODO: emit a warning here or something if both are present.467      if (this.hiddenLockfile) {468        this.filename = resolve(this.path, 'node_modules/.package-lock.json')469      } else if (this.shrinkwrapOnly || sw) {470        this.filename = resolve(this.path, 'npm-shrinkwrap.json')471      } else {472        this.filename = resolve(this.path, 'package-lock.json')473      }474      this.type = basename(this.filename)475      this.loadedFromDisk = Boolean(sw || lock)476 477      if (yarn) {478        this.yarnLock = new YarnLock()479        // ignore invalid yarn data.  we'll likely clobber it later anyway.480        try {481          this.yarnLock.parse(yarn)482        } catch {483          // ignore errors484        }485      }486 487      data = parseJSON(data)488      this.inferFormattingOptions(data)489 490      if (this.hiddenLockfile && data.packages) {491        // add a few ms just to account for jitter492        const lockTime = +(await stat(this.filename)).mtime + 10493        await assertNoNewer(this.path, data, lockTime, this.path, new Set())494      }495 496      // all good!  hidden lockfile is the newest thing in here.497    } catch (er) {498      /* istanbul ignore else */499      if (typeof this.filename === 'string') {500        const rel = relpath(this.path, this.filename)501        log.verbose('shrinkwrap', `failed to load ${rel}`, er.message)502      } else {503        log.verbose('shrinkwrap', `failed to load ${this.path}`, er.message)504      }505      this.loadingError = er506      this.loadedFromDisk = false507      this.ancientLockfile = false508      data = {}509    }510    // auto convert v1 lockfiles to v3511    // leave v2 in place unless configured512    // v3 by default513    let lockfileVersion = defaultLockfileVersion514    if (this.lockfileVersion) {515      lockfileVersion = this.lockfileVersion516    } else if (data.lockfileVersion && data.lockfileVersion !== 1) {517      lockfileVersion = data.lockfileVersion518    }519 520    this.data = {521      ...data,522      lockfileVersion,523      requires: true,524      packages: data.packages || {},525      dependencies: data.dependencies || {},526    }527 528    this.originalLockfileVersion = data.lockfileVersion529 530    // use default if it wasn't explicitly set, and the current file is531    // less than our default.  otherwise, keep whatever is in the file,532    // unless we had an explicit setting already.533    if (!this.lockfileVersion) {534      this.lockfileVersion = this.data.lockfileVersion = lockfileVersion535    }536    this.ancientLockfile = this.loadedFromDisk &&537      !(data.lockfileVersion >= 2) && !data.requires538 539    // load old lockfile deps into the packages listing540    if (data.dependencies && !data.packages) {541      let pkg542      try {543        pkg = await pkgJson.normalize(this.path)544        pkg = pkg.content545      } catch {546        pkg = {}547      }548      this.#loadAll('', null, this.data)549      this.#fixDependencies(pkg)550    }551    return this552  }553 554  #loadAll (location, name, lock) {555    // migrate a v1 package lock to the new format.556    const meta = this.#metaFromLock(location, name, lock)557    // dependencies nested under a link are actually under the link target558    if (meta.link) {559      location = meta.resolved560    }561    if (lock.dependencies) {562      for (const name in lock.dependencies) {563        const loc = location + (location ? '/' : '') + 'node_modules/' + name564        this.#loadAll(loc, name, lock.dependencies[name])565      }566    }567  }568 569  // v1 lockfiles track the optional/dev flags, but they don't tell us570  // which thing had what kind of dep on what other thing, so we need571  // to correct that now, or every link will be considered prod572  #fixDependencies (pkg) {573    // we need the root package.json because legacy shrinkwraps just574    // have requires:true at the root level, which is even less useful575    // than merging all dep types into one object.576    const root = this.data.packages['']577    for (const key of pkgMetaKeys) {578      const val = metaFieldFromPkg(pkg, key)579      if (val) {580        root[key.replace(/^_/, '')] = val581      }582    }583 584    for (const loc in this.data.packages) {585      const meta = this.data.packages[loc]586      if (!meta.requires || !loc) {587        continue588      }589 590      // resolve each require to a meta entry591      // if this node isn't optional, but the dep is, then it's an optionalDep592      // likewise for dev deps.593      // This isn't perfect, but it's a pretty good approximation, and at594      // least gets us out of having all 'prod' edges, which throws off the595      // buildIdealTree process596      for (const name in meta.requires) {597        const dep = this.#resolveMetaNode(loc, name)598        // this overwrites the false value set above599        // default to dependencies if the dep just isn't in the tree, which600        // maybe should be an error, since it means that the shrinkwrap is601        // invalid, but we can't do much better without any info.602        let depType = 'dependencies'603        /* istanbul ignore else - dev deps are only for the root level */604        if (dep?.optional && !meta.optional) {605          depType = 'optionalDependencies'606        } else if (dep?.dev && !meta.dev) {607          // XXX is this even reachable?608          depType = 'devDependencies'609        }610        if (!meta[depType]) {611          meta[depType] = {}612        }613        meta[depType][name] = meta.requires[name]614      }615      delete meta.requires616    }617  }618 619  #resolveMetaNode (loc, name) {620    for (let path = loc; true; path = path.replace(/(^|\/)[^/]*$/, '')) {621      const check = `${path}${path ? '/' : ''}node_modules/${name}`622      if (this.data.packages[check]) {623        return this.data.packages[check]624      }625 626      if (!path) {627        break628      }629    }630    return null631  }632 633  #lockFromLoc (lock, path, i = 0) {634    if (!lock) {635      return null636    }637 638    if (path[i] === '') {639      i++640    }641 642    if (i >= path.length) {643      return lock644    }645 646    if (!lock.dependencies) {647      return null648    }649 650    return this.#lockFromLoc(lock.dependencies[path[i]], path, i + 1)651  }652 653  // pass in a path relative to the root path, or an absolute path,654  // get back a /-normalized location based on root path.655  #pathToLoc (path) {656    return relpath(this.path, resolve(this.path, path))657  }658 659  delete (nodePath) {660    if (!this.data) {661      throw new Error('run load() before getting or setting data')662    }663    const location = this.#pathToLoc(nodePath)664    this.#awaitingUpdate.delete(location)665 666    delete this.data.packages[location]667    const path = location.split(/(?:^|\/)node_modules\//)668    const name = path.pop()669    const pLock = this.#lockFromLoc(this.data, path)670    if (pLock && pLock.dependencies) {671      delete pLock.dependencies[name]672    }673  }674 675  get (nodePath) {676    if (!this.data) {677      throw new Error('run load() before getting or setting data')678    }679 680    const location = this.#pathToLoc(nodePath)681    if (this.#awaitingUpdate.has(location)) {682      this.#updateWaitingNode(location)683    }684 685    // first try to get from the newer spot, which we know has686    // all the things we need.687    if (this.data.packages[location]) {688      return this.data.packages[location]689    }690 691    // otherwise, fall back to the legacy metadata, and hope for the best692    // get the node in the shrinkwrap corresponding to this spot693    const path = location.split(/(?:^|\/)node_modules\//)694    const name = path[path.length - 1]695    const lock = this.#lockFromLoc(this.data, path)696 697    return this.#metaFromLock(location, name, lock)698  }699 700  #metaFromLock (location, name, lock) {701    // This function tries as hard as it can to figure out the metadata702    // from a lockfile which may be outdated or incomplete.  Since v1703    // lockfiles used the "version" field to contain a variety of704    // different possible types of data, this gets a little complicated.705    if (!lock) {706      return {}707    }708 709    // try to figure out a npm-package-arg spec from the lockfile entry710    // This will return null if we could not get anything valid out of it.711    const spec = specFromLock(name, lock, this.path)712 713    if (spec.type === 'directory') {714      // the "version" was a file: url to a non-tarball path715      // this is a symlink dep.  We don't store much metadata716      // about symlinks, just the target.717      const target = relpath(this.path, spec.fetchSpec)718      this.data.packages[location] = {719        link: true,720        resolved: target,721      }722      // also save the link target, omitting version since we don't know723      // what it is, but we know it isn't a link to itself!724      if (!this.data.packages[target]) {725        this.#metaFromLock(target, name, { ...lock, version: null })726      }727      return this.data.packages[location]728    }729 730    const meta = {}731    // when calling loadAll we'll change these into proper dep objects732    if (lock.requires && typeof lock.requires === 'object') {733      meta.requires = lock.requires734    }735 736    if (lock.optional) {737      meta.optional = true738    }739    if (lock.dev) {740      meta.dev = true741    }742 743    // the root will typically have a name from the root project's744    // package.json file.745    if (location === '') {746      meta.name = lock.name747    }748 749    // if we have integrity, save it now.750    if (lock.integrity) {751      meta.integrity = lock.integrity752    }753 754    if (lock.version && !lock.integrity) {755      // this is usually going to be a git url or symlink, but it could756      // also be a registry dependency that did not have integrity at757      // the time it was saved.758      // Symlinks were already handled above, so that leaves git.759      //760      // For git, always save the full SSH url.  we'll actually fetch the761      // tgz most of the time, since it's faster, but it won't work for762      // private repos, and we can't get back to the ssh from the tgz,763      // so we store the ssh instead.764      // For unknown git hosts, just resolve to the raw spec in lock.version765      if (spec.type === 'git') {766        meta.resolved = consistentResolve(spec, this.path, this.path)767 768        // return early because there is nothing else we can do with this769        return this.data.packages[location] = meta770      } else if (spec.registry) {771        // registry dep that didn't save integrity.  grab the version, and772        // fall through to pick up the resolved and potentially name.773        meta.version = lock.version774      }775      // only other possible case is a tarball without integrity.776      // fall through to do what we can with the filename later.777    }778 779    // at this point, we know that the spec is either a registry dep780    // (ie, version, because locking, which means a resolved url),781    // or a remote dep, or file: url.  Remote deps and file urls782    // have a fetchSpec equal to the fully resolved thing.783    // Registry deps, we take what's in the lockfile.784    if (lock.resolved || (spec.type && !spec.registry)) {785      if (spec.registry) {786        meta.resolved = lock.resolved787      } else if (spec.type === 'file') {788        meta.resolved = consistentResolve(spec, this.path, this.path, true)789      } else if (spec.fetchSpec) {790        meta.resolved = spec.fetchSpec791      }792    }793 794    // at this point, if still we don't have a version, do our best to795    // infer it from the tarball url/file.  This works a surprising796    // amount of the time, even though it's not guaranteed.797    if (!meta.version) {798      if (spec.type === 'file' || spec.type === 'remote') {799        const fromTgz = versionFromTgz(spec.name, spec.fetchSpec) ||800          versionFromTgz(spec.name, meta.resolved)801        if (fromTgz) {802          meta.version = fromTgz.version803          if (fromTgz.name !== name) {804            meta.name = fromTgz.name805          }806        }807      } else if (spec.type === 'alias') {808        meta.name = spec.subSpec.name809        meta.version = spec.subSpec.fetchSpec810      } else if (spec.type === 'version') {811        meta.version = spec.fetchSpec812      }813      // ok, I did my best!  good luck!814    }815 816    if (lock.bundled) {817      meta.inBundle = true818    }819 820    // save it for next time821    return this.data.packages[location] = meta822  }823 824  add (node) {825    if (!this.data) {826      throw new Error('run load() before getting or setting data')827    }828 829    // will be actually updated on read830    const loc = relpath(this.path, node.path)831    if (node.path === this.path) {832      this.tree = node833    }834 835    // if we have metadata about this node, and it's a match, then836    // try to decorate it.837    if (node.resolved === null || node.integrity === null) {838      const {839        resolved,840        integrity,841        hasShrinkwrap,842        version,843      } = this.get(node.path)844 845      let pathFixed = null846      if (resolved) {847        if (!/^file:/.test(resolved)) {848          pathFixed = resolved849        } else {850          pathFixed = `file:${resolve(this.path, resolved.slice(5))}`851        }852      }853 854      // if we have one, only set the other if it matches855      // otherwise it could be for a completely different thing.856      const resolvedOk = !resolved || !node.resolved ||857        node.resolved === pathFixed858      const integrityOk = !integrity || !node.integrity ||859        node.integrity === integrity860      const versionOk = !version || !node.version || version === node.version861 862      const allOk = (resolved || integrity || version) &&863        resolvedOk && integrityOk && versionOk864 865      if (allOk) {866        node.resolved = node.resolved || pathFixed || null867        node.integrity = node.integrity || integrity || null868        node.hasShrinkwrap = node.hasShrinkwrap || hasShrinkwrap || false869      } else {870        // try to read off the package or node itself871        const {872          resolved,873          integrity,874          hasShrinkwrap,875        } = Shrinkwrap.metaFromNode(node, this.path, this.resolveOptions)876        node.resolved = node.resolved || resolved || null877        node.integrity = node.integrity || integrity || null878        node.hasShrinkwrap = node.hasShrinkwrap || hasShrinkwrap || false879      }880    }881    this.#awaitingUpdate.set(loc, node)882  }883 884  addEdge (edge) {885    if (!this.yarnLock || !edge.valid) {886      return887    }888 889    const { to: node } = edge890 891    // if it's already set up, nothing to do892    if (node.resolved !== null && node.integrity !== null) {893      return894    }895 896    // if the yarn lock is empty, nothing to do897    if (!this.yarnLock.entries || !this.yarnLock.entries.size) {898      return899    }900 901    // we relativize the path here because that's how it shows up in the lock902    // XXX why is this different from pathFixed in this.add??903    let pathFixed = null904    if (node.resolved) {905      if (!/file:/.test(node.resolved)) {906        pathFixed = node.resolved907      } else {908        pathFixed = consistentResolve(node.resolved, node.path, this.path, true)909      }910    }911 912    const spec = npa(`${node.name}@${edge.spec}`)913    const entry = this.yarnLock.entries.get(`${node.name}@${edge.spec}`)914 915    if (!entry ||916        mismatch(node.version, entry.version) ||917        mismatch(node.integrity, entry.integrity) ||918        mismatch(pathFixed, entry.resolved)) {919      return920    }921 922    if (entry.resolved && yarnRegRe.test(entry.resolved) && spec.registry) {923      entry.resolved = entry.resolved.replace(yarnRegRe, 'https://registry.npmjs.org/')924    }925 926    node.integrity = node.integrity || entry.integrity || null927    node.resolved = node.resolved ||928      consistentResolve(entry.resolved, this.path, node.path) || null929 930    this.#awaitingUpdate.set(relpath(this.path, node.path), node)931  }932 933  #updateWaitingNode (loc) {934    const node = this.#awaitingUpdate.get(loc)935    this.#awaitingUpdate.delete(loc)936    this.data.packages[loc] = Shrinkwrap.metaFromNode(937      node,938      this.path,939      this.resolveOptions)940  }941 942  commit () {943    if (this.tree) {944      if (this.yarnLock) {945        this.yarnLock.fromTree(this.tree)946      }947      const root = Shrinkwrap.metaFromNode(948        this.tree.target,949        this.path,950        this.resolveOptions)951      this.data.packages = {}952      if (Object.keys(root).length) {953        this.data.packages[''] = root954      }955      for (const node of this.tree.root.inventory.values()) {956        // only way this.tree is not root is if the root is a link to it957        if (node === this.tree || node.isRoot || node.location === '') {958          continue959        }960        const loc = relpath(this.path, node.path)961        // Drop lockfile entries for extraneous nodes outside node_modules that962        // are direct fsChildren of the root (or detached link targets). These963        // are stale top-level entries: a workspace or file: dep removed from964        // the root manifest, or whose directory was deleted. Extraneous965        // fsChildren nested under another package (e.g. a file: dep of another966        // file: dep) are kept so `npm ci` can resolve the parent's dependency.967        if (node.extraneous && !/(^|\/)node_modules\//.test(loc) && loc !== 'node_modules' &&968          (!node.fsParent || node.fsParent.isRoot)) {969          continue970        }971        const meta = Shrinkwrap.metaFromNode(972          node,973          this.path,974          this.resolveOptions)975        // Skip inert nodes — these are optional deps that failed to load976        // (e.g. 404 from a proxy registry that hasn't cached the package,977        // or incomplete manifest missing version field).978        // #pruneFailedOptional marks them inert so they won't be reified;979        // writing them to the lockfile produces invalid entries like980        // {"optional": true} that cause "Invalid Version:" errors.981        if (node.inert && !node.package.version) {982          continue983        }984        this.data.packages[loc] = meta985      }986    } else if (this.#awaitingUpdate.size > 0) {987      for (const loc of this.#awaitingUpdate.keys()) {988        this.#updateWaitingNode(loc)989      }990    }991 992    // if we haven't set it by now, use the default993    if (!this.lockfileVersion) {994      this.lockfileVersion = defaultLockfileVersion995    }996    this.data.lockfileVersion = this.lockfileVersion997 998    // hidden lockfiles don't include legacy metadata or a root entry999    if (this.hiddenLockfile) {1000      delete this.data.packages['']1001      delete this.data.dependencies1002    } else if (this.tree && this.lockfileVersion <= 3) {1003      this.#buildLegacyLockfile(this.tree, this.data)1004    }1005 1006    // lf version 1 = dependencies only1007    // lf version 2 = dependencies and packages1008    // lf version 3 = packages only1009    if (this.lockfileVersion >= 3) {1010      const { dependencies, ...data } = this.data1011      return data1012    } else if (this.lockfileVersion < 2) {1013      const { packages, ...data } = this.data1014      return data1015    } else {1016      return { ...this.data }1017    }1018  }1019 1020  #buildLegacyLockfile (node, lock, path = []) {1021    if (node === this.tree) {1022      // the root node1023      lock.name = node.packageName || node.name1024      if (node.version) {1025        lock.version = node.version1026      }1027    }1028 1029    // npm v6 and before tracked 'from', meaning "the request that led1030    // to this package being installed".  However, that's inherently1031    // racy and non-deterministic in a world where deps are deduped1032    // ahead of fetch time.  In order to maintain backwards compatibility1033    // with v6 in the lockfile, we do this trick where we pick a valid1034    // dep link out of the edgesIn set.  Choose the edge with the fewest1035    // number of `node_modules` sections in the requestor path, and then1036    // lexically sort afterwards.1037    const edge = [...node.edgesIn].filter(e => e.valid).sort((a, b) => {1038      const aloc = a.from.location.split('node_modules')1039      const bloc = b.from.location.split('node_modules')1040      /* istanbul ignore next - sort calling order is indeterminate */1041      if (aloc.length > bloc.length) {1042        return 11043      }1044      if (bloc.length > aloc.length) {1045        return -11046      }1047      return localeCompare(aloc[aloc.length - 1], bloc[bloc.length - 1])1048    })[0]1049 1050    const res = consistentResolve(node.resolved, this.path, this.path, true)1051    const rSpec = specFromResolved(res)1052 1053    // if we don't have anything (ie, it's extraneous) then use the resolved1054    // value as if that was where we got it from, since at least it's true.1055    // if we don't have either, just an empty object so nothing matches below.1056    // This will effectively just save the version and resolved, as if it's1057    // a standard version/range dep, which is a reasonable default.1058    let spec = rSpec1059    if (edge) {1060      spec = npa.resolve(node.name, edge.spec, edge.from.realpath)1061    }1062 1063    if (node.isLink) {1064      lock.version = `file:${relpath(this.path, node.realpath)}`1065    } else if (spec && (spec.type === 'file' || spec.type === 'remote')) {1066      lock.version = spec.saveSpec1067    } else if (spec && spec.type === 'git' || rSpec.type === 'git') {1068      lock.version = node.resolved1069      /* istanbul ignore else - don't think there are any cases where a git1070       * spec (or indeed, ANY npa spec) doesn't have a .raw member */1071      if (spec.raw) {1072        lock.from = spec.raw1073      }1074    } else if (!node.isRoot &&1075        node.package &&1076        node.packageName &&1077        node.packageName !== node.name) {1078      lock.version = `npm:${node.packageName}@${node.version}`1079    } else if (node.package && node.version) {1080      lock.version = node.version1081    }1082 1083    if (node.inDepBundle) {1084      lock.bundled = true1085    }1086 1087    // when we didn't resolve to git, file, or dir, and didn't request1088    // git, file, dir, or remote, then the resolved value is necessary.1089    if (node.resolved &&1090        !node.isLink &&1091        rSpec.type !== 'git' &&1092        rSpec.type !== 'file' &&1093        rSpec.type !== 'directory' &&1094        spec.type !== 'directory' &&1095        spec.type !== 'git' &&1096        spec.type !== 'file' &&1097        spec.type !== 'remote') {1098      lock.resolved = overrideResolves(node.resolved, this.resolveOptions)1099    }1100 1101    if (node.integrity) {1102      lock.integrity = node.integrity1103    }1104 1105    if (node.extraneous) {1106      lock.extraneous = true1107    } else if (!node.isLink) {1108      if (node.peer) {1109        lock.peer = true1110      }1111 1112      if (node.devOptional && !node.dev && !node.optional) {1113        lock.devOptional = true1114      }1115 1116      if (node.dev) {1117        lock.dev = true1118      }1119 1120      if (node.optional) {1121        lock.optional = true1122      }1123    }1124 1125    const depender = node.target1126    if (depender.edgesOut.size > 0) {1127      if (node !== this.tree) {1128        const entries = [...depender.edgesOut.entries()]1129        lock.requires = entries.reduce((set, [k, v]) => {1130          // omit peer deps from legacy lockfile requires field, because1131          // npm v6 doesn't handle peer deps, and this triggers some bad1132          // behavior if the dep can't be found in the dependencies list.1133          const { spec, peer } = v1134          if (peer) {1135            return set1136          }1137          if (spec.startsWith('file:')) {1138            // turn absolute file: paths into relative paths from the node1139            // this especially shows up with workspace edges when the root1140            // node is also a workspace in the set.1141            const p = resolve(node.realpath, spec.slice('file:'.length))1142            set[k] = `file:${relpath(node.realpath, p)}`1143          } else {1144            set[k] = spec1145          }1146          return set1147        }, {})1148      } else {1149        lock.requires = true1150      }1151    }1152 1153    // now we walk the children, putting them in the 'dependencies' object1154    const { children } = node.target1155    if (!children.size) {1156      delete lock.dependencies1157    } else {1158      const kidPath = [...path, node.realpath]1159      const dependencies = {}1160      // skip any that are already in the descent path, so cyclical link1161      // dependencies don't blow up with ELOOP.1162      let found = false1163      for (const [name, kid] of children.entries()) {1164        if (path.includes(kid.realpath)) {1165          continue1166        }1167        dependencies[name] = this.#buildLegacyLockfile(kid, {}, kidPath)1168        found = true1169      }1170      if (found) {1171        lock.dependencies = dependencies1172      }1173    }1174    return lock1175  }1176 1177  toJSON () {1178    if (!this.data) {1179      throw new Error('run load() before getting or setting data')1180    }1181 1182    return this.commit()1183  }1184 1185  toString (options = {}) {1186    const data = this.toJSON()1187    const { format = true } = options1188    const defaultIndent = this.indent || 21189    const indent = format === true ? defaultIndent1190      : format || 01191    const eol = format ? this.newline || '\n' : ''1192    return stringify(data, swKeyOrder, indent).replace(/\n/g, eol)1193  }1194 1195  save (options = {}) {1196    if (!this.data) {1197      throw new Error('run load() before saving data')1198    }1199 1200    // This must be called before the lockfile conversion check below since it sets properties as part of `commit()`1201    const json = this.toString(options)1202    if (1203      !this.hiddenLockfile1204      && this.originalLockfileVersion !== undefined1205      && this.originalLockfileVersion !== this.lockfileVersion1206    ) {1207      log.warn(1208        'shrinkwrap',1209        `Converting lock file (${relative(process.cwd(), this.filename)}) from v${this.originalLockfileVersion} -> v${this.lockfileVersion}`1210      )1211    }1212 1213    return Promise.all([1214      writeFile(this.filename, json).catch(er => {1215        if (this.hiddenLockfile) {1216          // well, we did our best.1217          // if we reify, and there's nothing there, then it might be lacking1218          // a node_modules folder, but then the lockfile is not important.1219          // Remove the file, so that in case there WERE deps, but we just1220          // failed to update the file for some reason, it's not out of sync.1221          return rm(this.filename, { recursive: true, force: true })1222        }1223        throw er1224      }),1225      this.yarnLock && this.yarnLock.entries.size &&1226        writeFile(this.path + '/yarn.lock', this.yarnLock.toString()),1227    ])1228  }1229}1230 1231module.exports = Shrinkwrap1232