Last commit july 5th

spa/node_modules/@npmcli/arborist/bin/actual.js

@@ -0,0 +1,19 @@
+const Arborist = require('../')
+
+const printTree = require('./lib/print-tree.js')
+
+module.exports = (options, time) => new Arborist(options)
+  .loadActual(options)
+  .then(time)
+  .then(async ({ timing, result: tree }) => {
+    printTree(tree)
+    if (options.save) {
+      await tree.meta.save()
+    }
+    if (options.saveHidden) {
+      tree.meta.hiddenLockfile = true
+      tree.meta.filename = options.path + '/node_modules/.package-lock.json'
+      await tree.meta.save()
+    }
+    return `read ${tree.inventory.size} deps in ${timing.ms}`
+  })

spa/node_modules/@npmcli/arborist/bin/audit.js

@@ -0,0 +1,51 @@
+const Arborist = require('../')
+
+const printTree = require('./lib/print-tree.js')
+const log = require('./lib/logging.js')
+
+const Vuln = require('../lib/vuln.js')
+const printReport = report => {
+  for (const vuln of report.values()) {
+    log.info(printVuln(vuln))
+  }
+  if (report.topVulns.size) {
+    log.info('\n# top-level vulnerabilities')
+    for (const vuln of report.topVulns.values()) {
+      log.info(printVuln(vuln))
+    }
+  }
+}
+
+const printVuln = vuln => {
+  return {
+    __proto__: { constructor: Vuln },
+    name: vuln.name,
+    issues: [...vuln.advisories].map(a => printAdvisory(a)),
+    range: vuln.simpleRange,
+    nodes: [...vuln.nodes].map(node => `${node.name} ${node.location || '#ROOT'}`),
+    ...(vuln.topNodes.size === 0 ? {} : {
+      topNodes: [...vuln.topNodes].map(node => `${node.location || '#ROOT'}`),
+    }),
+  }
+}
+
+const printAdvisory = a => `${a.title}${a.url ? ' ' + a.url : ''}`
+
+module.exports = (options, time) => {
+  const arb = new Arborist(options)
+  return arb
+    .audit(options)
+    .then(time)
+    .then(async ({ timing, result: tree }) => {
+      if (options.fix) {
+        printTree(tree)
+      }
+      printReport(arb.auditReport)
+      if (tree.meta && options.save) {
+        await tree.meta.save()
+      }
+      return options.fix
+        ? `resolved ${tree.inventory.size} deps in ${timing.seconds}`
+        : `done in ${timing.seconds}`
+    })
+}

spa/node_modules/@npmcli/arborist/bin/funding.js

@@ -0,0 +1,38 @@
+const Arborist = require('../')
+
+const log = require('./lib/logging.js')
+
+module.exports = (options, time) => {
+  const query = options._.shift()
+  const a = new Arborist(options)
+  return a
+    .loadVirtual()
+    .then(tree => {
+      // only load the actual tree if the virtual one doesn't have modern metadata
+      if (!tree.meta || !(tree.meta.originalLockfileVersion >= 2)) {
+        log.error('old metadata, load actual')
+        throw 'load actual'
+      } else {
+        log.error('meta ok, return virtual tree')
+        return tree
+      }
+    })
+    .catch(() => a.loadActual())
+    .then(time)
+    .then(({ timing, result: tree }) => {
+      if (!query) {
+        for (const node of tree.inventory.values()) {
+          if (node.package.funding) {
+            log.info(node.name, node.location, node.package.funding)
+          }
+        }
+      } else {
+        for (const node of tree.inventory.query('name', query)) {
+          if (node.package.funding) {
+            log.info(node.name, node.location, node.package.funding)
+          }
+        }
+      }
+      return `read ${tree.inventory.size} deps in ${timing.ms}`
+    })
+}

spa/node_modules/@npmcli/arborist/bin/ideal.js

@@ -0,0 +1,14 @@
+const Arborist = require('../')
+
+const printTree = require('./lib/print-tree.js')
+
+module.exports = (options, time) => new Arborist(options)
+  .buildIdealTree(options)
+  .then(time)
+  .then(async ({ timing, result: tree }) => {
+    printTree(tree)
+    if (tree.meta && options.save) {
+      await tree.meta.save()
+    }
+    return `resolved ${tree.inventory.size} deps in ${timing.seconds}`
+  })

spa/node_modules/@npmcli/arborist/bin/index.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+
+const fs = require('fs')
+const path = require('path')
+
+const { bin, arb: options } = require('./lib/options')
+const version = require('../package.json').version
+
+const usage = (message = '') => `Arborist - the npm tree doctor
+
+Version: ${version}
+${message && '\n' + message + '\n'}
+# USAGE
+  arborist <cmd> [path] [options...]
+
+# COMMANDS
+
+  * reify: reify ideal tree to node_modules (install, update, rm, ...)
+  * prune: prune the ideal tree and reify (like npm prune)
+  * ideal: generate and print the ideal tree
+  * actual: read and print the actual tree in node_modules
+  * virtual: read and print the virtual tree in the local shrinkwrap file
+  * shrinkwrap: load a local shrinkwrap and print its data
+  * audit: perform a security audit on project dependencies
+  * funding: query funding information in the local package tree.  A second
+    positional argument after the path name can limit to a package name.
+  * license: query license information in the local package tree.  A second
+    positional argument after the path name can limit to a license type.
+  * help: print this text
+  * version: print the version
+
+# OPTIONS
+
+  Most npm options are supported, but in camelCase rather than css-case.  For
+  example, instead of '--dry-run', use '--dryRun'.
+
+  Additionally:
+
+  * --loglevel=warn|--quiet will supppress the printing of package trees
+  * --logfile <file|bool> will output logs to a file
+  * --timing will show timing information
+  * Instead of 'npm install <pkg>', use 'arborist reify --add=<pkg>'.
+    The '--add=<pkg>' option can be specified multiple times.
+  * Instead of 'npm rm <pkg>', use 'arborist reify --rm=<pkg>'.
+    The '--rm=<pkg>' option can be specified multiple times.
+  * Instead of 'npm update', use 'arborist reify --update-all'.
+  * 'npm audit fix' is 'arborist audit --fix'
+`
+
+const commands = {
+  version: () => console.log(version),
+  help: () => console.log(usage()),
+  exit: () => {
+    process.exitCode = 1
+    console.error(
+      usage(`Error: command '${bin.command}' does not exist.`)
+    )
+  },
+}
+
+const commandFiles = fs.readdirSync(__dirname).filter((f) => path.extname(f) === '.js' && f !== __filename)
+
+for (const file of commandFiles) {
+  const command = require(`./${file}`)
+  const name = path.basename(file, '.js')
+  const totalTime = `bin:${name}:init`
+  const scriptTime = `bin:${name}:script`
+
+  commands[name] = () => {
+    const timers = require('./lib/timers')
+    const log = require('./lib/logging')
+
+    log.info(name, options)
+
+    process.emit('time', totalTime)
+    process.emit('time', scriptTime)
+
+    return command(options, (result) => {
+      process.emit('timeEnd', scriptTime)
+      return {
+        result,
+        timing: {
+          seconds: `${timers.get(scriptTime) / 1e9}s`,
+          ms: `${timers.get(scriptTime) / 1e6}ms`,
+        },
+      }
+    })
+      .then((result) => {
+        log.info(result)
+        return result
+      })
+      .catch((err) => {
+        process.exitCode = 1
+        log.error(err)
+        return err
+      })
+      .then((r) => {
+        process.emit('timeEnd', totalTime)
+        if (bin.loglevel !== 'silent') {
+          console[process.exitCode ? 'error' : 'log'](r)
+        }
+        return r
+      })
+  }
+}
+
+if (commands[bin.command]) {
+  commands[bin.command]()
+} else {
+  commands.exit()
+}

spa/node_modules/@npmcli/arborist/bin/lib/logging.js

@@ -0,0 +1,77 @@
+const log = require('proc-log')
+const fs = require('fs')
+const { dirname } = require('path')
+const os = require('os')
+const { inspect, format } = require('util')
+
+const { bin: options } = require('./options.js')
+
+// add a meta method to proc-log for passing optional
+// metadata through to log handlers
+const META = Symbol('meta')
+const parseArgs = (...args) => {
+  const { [META]: isMeta } = args[args.length - 1] || {}
+  return isMeta
+    ? [args[args.length - 1], ...args.slice(0, args.length - 1)]
+    : [{}, ...args]
+}
+log.meta = (meta = {}) => ({ [META]: true, ...meta })
+
+const levels = new Map([
+  'silly',
+  'verbose',
+  'info',
+  'http',
+  'notice',
+  'warn',
+  'error',
+  'silent',
+].map((level, index) => [level, index]))
+
+const addLogListener = (write, { eol = os.EOL, loglevel = 'silly', colors = false } = {}) => {
+  const levelIndex = levels.get(loglevel)
+
+  const magenta = m => colors ? `\x1B[35m${m}\x1B[39m` : m
+  const dim = m => colors ? `\x1B[2m${m}\x1B[22m` : m
+  const red = m => colors ? `\x1B[31m${m}\x1B[39m` : m
+
+  const formatter = (level, ...args) => {
+    const depth = level === 'error' && args[0] && args[0].code === 'ERESOLVE' ? Infinity : 10
+
+    if (level === 'info' && args[0] === 'timeEnd') {
+      args[1] = dim(args[1])
+    } else if (level === 'error' && args[0] === 'timeError') {
+      args[1] = red(args[1])
+    }
+
+    const messages = args.map(a => typeof a === 'string' ? a : inspect(a, { depth, colors }))
+    const pref = `${process.pid} ${magenta(level)} `
+
+    return pref + format(...messages).trim().split('\n').join(`${eol}${pref}`) + eol
+  }
+
+  process.on('log', (...args) => {
+    const [meta, level, ...logArgs] = parseArgs(...args)
+
+    if (levelIndex <= levels.get(level) || meta.force) {
+      write(formatter(level, ...logArgs))
+    }
+  })
+}
+
+if (options.loglevel !== 'silent') {
+  addLogListener((v) => process.stderr.write(v), {
+    eol: '\n',
+    colors: options.colors,
+    loglevel: options.loglevel,
+  })
+}
+
+if (options.logfile) {
+  log.silly('logfile', options.logfile)
+  fs.mkdirSync(dirname(options.logfile), { recursive: true })
+  const fd = fs.openSync(options.logfile, 'a')
+  addLogListener((str) => fs.writeSync(fd, str))
+}
+
+module.exports = log

spa/node_modules/@npmcli/arborist/bin/lib/options.js

@@ -0,0 +1,123 @@
+const nopt = require('nopt')
+const path = require('path')
+
+const has = (o, k) => Object.prototype.hasOwnProperty.call(o, k)
+
+const cleanPath = (val) => {
+  const k = Symbol('key')
+  const data = {}
+  nopt.typeDefs.path.validate(data, k, val)
+  return data[k]
+}
+
+const parse = (...noptArgs) => {
+  const binOnlyOpts = {
+    command: String,
+    loglevel: String,
+    colors: Boolean,
+    timing: ['always', Boolean],
+    logfile: String,
+  }
+
+  const arbOpts = {
+    add: Array,
+    rm: Array,
+    omit: Array,
+    update: Array,
+    workspaces: Array,
+    global: Boolean,
+    force: Boolean,
+    'global-style': Boolean,
+    'prefer-dedupe': Boolean,
+    'legacy-peer-deps': Boolean,
+    'update-all': Boolean,
+    before: Date,
+    path: path,
+    cache: path,
+    ...binOnlyOpts,
+  }
+
+  const short = {
+    quiet: ['--loglevel', 'warn'],
+    logs: ['--logfile', 'true'],
+    w: '--workspaces',
+    g: '--global',
+    f: '--force',
+  }
+
+  const defaults = {
+    // key order is important for command and path
+    // since they shift positional args
+    // command is 1st, path is 2nd
+    command: (o) => o.argv.remain.shift(),
+    path: (o) => cleanPath(o.argv.remain.shift() || '.'),
+    colors: has(process.env, 'NO_COLOR') ? false : !!process.stderr.isTTY,
+    loglevel: 'silly',
+    timing: (o) => o.loglevel === 'silly',
+    cache: `${process.env.HOME}/.npm/_cacache`,
+  }
+
+  const derived = [
+    // making update either `all` or an array of names but not both
+    ({ updateAll: all, update: names, ...o }) => {
+      if (all || names) {
+        o.update = all != null ? { all } : { names }
+      }
+      return o
+    },
+    ({ logfile, ...o }) => {
+      // logfile is parsed as a string so if its true or set but empty
+      // then set the default logfile
+      if (logfile === 'true' || logfile === '') {
+        logfile = `arb-log-${new Date().toISOString().replace(/[.:]/g, '_')}.log`
+      }
+      // then parse it the same as nopt parses other paths
+      if (logfile) {
+        o.logfile = cleanPath(logfile)
+      }
+      return o
+    },
+  ]
+
+  const transforms = [
+    // Camelcase all top level keys
+    (o) => {
+      const entries = Object.entries(o).map(([k, v]) => [
+        k.replace(/-./g, s => s[1].toUpperCase()),
+        v,
+      ])
+      return Object.fromEntries(entries)
+    },
+    // Set defaults on unset keys
+    (o) => {
+      for (const [k, v] of Object.entries(defaults)) {
+        if (!has(o, k)) {
+          o[k] = typeof v === 'function' ? v(o) : v
+        }
+      }
+      return o
+    },
+    // Set/unset derived values
+    ...derived.map((derive) => (o) => derive(o) || o),
+    // Separate bin and arborist options
+    ({ argv: { remain: _ }, ...o }) => {
+      const bin = { _ }
+      for (const k of Object.keys(binOnlyOpts)) {
+        if (has(o, k)) {
+          bin[k] = o[k]
+          delete o[k]
+        }
+      }
+      return { bin, arb: o }
+    },
+  ]
+
+  let options = nopt(arbOpts, short, ...noptArgs)
+  for (const t of transforms) {
+    options = t(options)
+  }
+
+  return options
+}
+
+module.exports = parse()

spa/node_modules/@npmcli/arborist/bin/lib/print-tree.js

@@ -0,0 +1,4 @@
+const { inspect } = require('util')
+const log = require('./logging.js')
+
+module.exports = tree => log.info(inspect(tree.toJSON(), { depth: Infinity }))

spa/node_modules/@npmcli/arborist/bin/lib/timers.js

@@ -0,0 +1,33 @@
+const { bin: options } = require('./options.js')
+const log = require('./logging.js')
+
+const timers = new Map()
+const finished = new Map()
+
+process.on('time', name => {
+  if (timers.has(name)) {
+    throw new Error('conflicting timer! ' + name)
+  }
+  timers.set(name, process.hrtime.bigint())
+})
+
+process.on('timeEnd', name => {
+  if (!timers.has(name)) {
+    throw new Error('timer not started! ' + name)
+  }
+  const elapsed = Number(process.hrtime.bigint() - timers.get(name))
+  timers.delete(name)
+  finished.set(name, elapsed)
+  if (options.timing) {
+    log.info('timeEnd', `${name} ${elapsed / 1e9}s`, log.meta({ force: options.timing === 'always' }))
+  }
+})
+
+process.on('exit', () => {
+  for (const name of timers.keys()) {
+    log.error('timeError', 'Dangling timer:', name)
+    process.exitCode = 1
+  }
+})
+
+module.exports = finished

spa/node_modules/@npmcli/arborist/bin/license.js

@@ -0,0 +1,48 @@
+const localeCompare = require('@isaacs/string-locale-compare')('en')
+const Arborist = require('../')
+const log = require('./lib/logging.js')
+
+module.exports = (options, time) => {
+  const query = options._.shift()
+  const a = new Arborist(options)
+  return a
+    .loadVirtual()
+    .then(tree => {
+      // only load the actual tree if the virtual one doesn't have modern metadata
+      if (!tree.meta || !(tree.meta.originalLockfileVersion >= 2)) {
+        throw 'load actual'
+      } else {
+        return tree
+      }
+    }).catch((er) => {
+      log.error('loading actual tree', er)
+      return a.loadActual()
+    })
+    .then(time)
+    .then(({ result: tree }) => {
+      const output = []
+      if (!query) {
+        const set = []
+        for (const license of tree.inventory.query('license')) {
+          set.push([tree.inventory.query('license', license).size, license])
+        }
+
+        for (const [count, license] of set.sort((a, b) =>
+          a[1] && b[1] ? b[0] - a[0] || localeCompare(a[1], b[1])
+          : a[1] ? -1
+          : b[1] ? 1
+          : 0)) {
+          output.push(`${count} ${license}`)
+          log.info(count, license)
+        }
+      } else {
+        for (const node of tree.inventory.query('license', query === 'undefined' ? undefined : query)) {
+          const msg = `${node.name} ${node.location} ${node.package.description || ''}`
+          output.push(msg)
+          log.info(msg)
+        }
+      }
+
+      return output.join('\n')
+    })
+}

spa/node_modules/@npmcli/arborist/bin/prune.js

@@ -0,0 +1,48 @@
+const Arborist = require('../')
+
+const printTree = require('./lib/print-tree.js')
+const log = require('./lib/logging.js')
+
+const printDiff = diff => {
+  const { depth } = require('treeverse')
+  depth({
+    tree: diff,
+    visit: d => {
+      if (d.location === '') {
+        return
+      }
+      switch (d.action) {
+        case 'REMOVE':
+          log.info('REMOVE', d.actual.location)
+          break
+        case 'ADD':
+          log.info('ADD', d.ideal.location, d.ideal.resolved)
+          break
+        case 'CHANGE':
+          log.info('CHANGE', d.actual.location, {
+            from: d.actual.resolved,
+            to: d.ideal.resolved,
+          })
+          break
+      }
+    },
+    getChildren: d => d.children,
+  })
+}
+
+module.exports = (options, time) => {
+  const arb = new Arborist(options)
+  return arb
+    .prune(options)
+    .then(time)
+    .then(async ({ timing, result: tree }) => {
+      printTree(tree)
+      if (options.dryRun) {
+        printDiff(arb.diff)
+      }
+      if (tree.meta && options.save) {
+        await tree.meta.save()
+      }
+      return `resolved ${tree.inventory.size} deps in ${timing.seconds}`
+    })
+}

spa/node_modules/@npmcli/arborist/bin/reify.js

@@ -0,0 +1,48 @@
+const Arborist = require('../')
+
+const printTree = require('./lib/print-tree.js')
+const log = require('./lib/logging.js')
+
+const printDiff = diff => {
+  const { depth } = require('treeverse')
+  depth({
+    tree: diff,
+    visit: d => {
+      if (d.location === '') {
+        return
+      }
+      switch (d.action) {
+        case 'REMOVE':
+          log.info('REMOVE', d.actual.location)
+          break
+        case 'ADD':
+          log.info('ADD', d.ideal.location, d.ideal.resolved)
+          break
+        case 'CHANGE':
+          log.info('CHANGE', d.actual.location, {
+            from: d.actual.resolved,
+            to: d.ideal.resolved,
+          })
+          break
+      }
+    },
+    getChildren: d => d.children,
+  })
+}
+
+module.exports = (options, time) => {
+  const arb = new Arborist(options)
+  return arb
+    .reify(options)
+    .then(time)
+    .then(async ({ timing, result: tree }) => {
+      printTree(tree)
+      if (options.dryRun) {
+        printDiff(arb.diff)
+      }
+      if (tree.meta && options.save) {
+        await tree.meta.save()
+      }
+      return `resolved ${tree.inventory.size} deps in ${timing.seconds}`
+    })
+}

spa/node_modules/@npmcli/arborist/bin/shrinkwrap.js

@@ -0,0 +1,7 @@
+const Shrinkwrap = require('../lib/shrinkwrap.js')
+
+module.exports = (options, time) => Shrinkwrap
+  .load(options)
+  .then((s) => s.commit())
+  .then(time)
+  .then(({ result: s }) => JSON.stringify(s, 0, 2))

spa/node_modules/@npmcli/arborist/bin/virtual.js

@@ -0,0 +1,14 @@
+const Arborist = require('../')
+
+const printTree = require('./lib/print-tree.js')
+
+module.exports = (options, time) => new Arborist(options)
+  .loadVirtual()
+  .then(time)
+  .then(async ({ timing, result: tree }) => {
+    printTree(tree)
+    if (options.save) {
+      await tree.meta.save()
+    }
+    return `read ${tree.inventory.size} deps in ${timing.ms}`
+  })