@npmcli/arborist - npm Package Compare versions

Comparing version 0.0.0-pre.7 to 0.0.0-pre.8

lib/arborist/build-ideal-tree.js

@@ -59,3 +59,3 @@ // mixin implementing the buildIdealTree method
 const _rootNodeFromPackage = Symbol('rootNodeFromPackage')
-const _addRm = Symbol('addRm')
+const _add = Symbol('add')
 const _explicitRequests = Symbol('explicitRequests')
@@ -72,2 +72,3 @@ const _queueNamedUpdates = Symbol('queueNamedUpdates')
 const _idealTreePrune = Symbol.for('idealTreePrune')
+const _resolvedAdd = Symbol.for('resolvedAdd')
 
@@ -196,15 +197,61 @@ const Virtual = require('./load-virtual.js')
   [_applyUserRequests] (options) {
+    // If we have a list of package names to update, and we know it's
+    // going to update them wherever they are, add any paths into those
+    // named nodes to the buildIdealTree queue.
+    if (this[_updateNames].length)
+      this[_queueNamedUpdates]()
+
+    if (options.rm && options.rm.length)
+      addRmPkgDeps.rm(this.idealTree.package, options.rm)
+
+    // triggers a refresh of all edgesOut
+    const after = () => this.idealTree.package = this.idealTree.package
+
     // these just add and remove to/from the root node
-    // but both mean we have to do a full walk, not just fixing problems
-    // and stopping when we no longer see any problems.
-    if (options.add || options.rm)
-      this[_addRm](options)
+    return (options.add)
+      ? this[_add](options.add).then(after)
+      : after()
+  }
 
-    // get the list of deps that we're explicitly requesting, so that
-    // 'npm install foo' will reinstall, even if we already have it.
-    if (options.add) {
-      for (const [type, specs] of Object.entries(options.add)) {
+
+  // add => might return promise
+    // might not have name, call pacote.manifest (find name)
+  [_add] (add) {
+    const promises = []
+    this[_resolvedAdd] = {}
+
+    // not going to work for:
+    // peerDepsMeta
+    // bundledDeps
+    for (const [type, specs] of Object.entries(add)) {
+      const p = Promise.all(specs.map(s => {
+        const spec = npa(s, this.path)
+        if (spec.name) {
+          return spec
+        } else {
+          return pacote.manifest(spec).then(mani => {
+            spec.name = mani.name
+            return spec
+          })
+        }
+      })).then(specs => {
+        for (const spec of specs) {
+          if (type === 'bundleDependencies') {
+            this[_resolvedAdd][type] = this[_resolvedAdd][type] || []
+            this[_resolvedAdd][type].push(spec.name)
+          } else {
+            this[_resolvedAdd][type] = this[_resolvedAdd][type] || {}
+            this[_resolvedAdd][type][spec.name] = spec.rawSpec
+          }
+        }
+      })
+      promises.push(p)
+    }
+    return Promise.all(promises).then(() => {
+      // get the list of deps that we're explicitly requesting, so that
+      // 'npm install foo' will reinstall, even if we already have it.
+      for (const [type, specs] of Object.entries(this[_resolvedAdd])) {
         if (type === 'dependencies' || type === 'devDependencies' ||
             type === 'optionalDependencies' || type === 'peerDependencies') {
-          for (const name of Object.keys(options.add[type])) {
+          for (const name of Object.keys(this[_resolvedAdd][type])) {
             this[_explicitRequests].add(name)
@@ -214,21 +261,7 @@ }
       }
-    }
 
-    // If we have a list of package names to update, and we know it's
-    // going to update them wherever they are, add any paths into those
-    // named nodes to the buildIdealTree queue.
-    if (this[_updateNames].length)
-      this[_queueNamedUpdates]()
+      addRmPkgDeps.add(this.idealTree.package, this[_resolvedAdd])
+    })
   }
 
-  [_addRm] ({ add, rm }) {
-    const pkg = this.idealTree.package
-    if (rm && rm.length)
-      addRmPkgDeps.rm(pkg, rm)
-    if (add)
-      addRmPkgDeps.add(pkg, add)
-    // triggers a refresh of all edgesOut
-    this.idealTree.package = pkg
-  }
-
   [_queueNamedUpdates] () {
@@ -235,0 +268,0 @@ const names = this[_updateNames]

lib/arborist/reify.js

@@ -88,2 +88,3 @@ // mixin implementing the reify method
 const _explicitRootInstalls = Symbol.for('explicitRootInstalls')
+const _resolvedAdd = Symbol.for('resolvedAdd')
 
@@ -715,6 +716,6 @@ module.exports = cls => class Reifier extends Ideal(cls) {
 
-    if (options.add) {
+    if (this[_resolvedAdd]) {
       const pkg = this.idealTree.package
       // need to save these more nicely, now that we know what they are
-      for (const [type, specs] of Object.entries(options.add)) {
+      for (const [type, specs] of Object.entries(this[_resolvedAdd])) {
         if (!specs || typeof specs !== 'object' || Array.isArray(specs))
@@ -721,0 +722,0 @@ continue

package.json

 {
   "name": "@npmcli/arborist",
-  "version": "0.0.0-pre.7",
+  "version": "0.0.0-pre.8",
   "description": "Manage node_modules trees",
@@ -5,0 +5,0 @@ "dependencies": {

README.md

@@ -12,3 +12,3 @@ # @npmcli/arborist
 
-```javascript
+```js
 const Arborist = require('@npmcli/arborist')
@@ -86,5 +86,5 @@
   //   - peerDependenciesMeta
-  //   Each matches what you'd find in a package.json file, but only
-  //   specifies additions/changes to the current set.  They're added
-  //   to the root node's requirements, and then the tree is built.
+  //   Each is an array of package specifiers, which would be passed to
+  //   `npm install`. They're added to the root node's requirements, and
+  //   then the tree is built.
   // update: Either `true` to just go ahead and update everything, or an
@@ -91,0 +91,0 @@ //   object with any or all of the following fields:

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

189694

increased by0.56%

Lines of code

4468

increased by0.68%

Worsened metrics

Number of medium supply chain risk alerts

1

increased byInfinity%

No dependency changes