Twice Shell

[ EDITING: dep-valid.js ]

// Do not rely on package._fields, so that we don't throw
// false failures if a tree is generated by other clients.
// Only relies on child.resolved, which MAY come from
// client-specific package.json meta _fields, but most of
// the time will be pulled out of a lockfile

const semver = require('semver')
const npa = require('npm-package-arg')
const { relative } = require('node:path')
const fromPath = require('./from-path.js')

const depValid = (child, requested, requestor) => {
  // NB: we don't do much to verify 'tag' type requests.
  // Just verify that we got a remote resolution.  Presumably, it
  // came from a registry and was tagged at some point.

if (typeof requested === 'string') {
    try {
      // tarball/dir must have resolved to the same tgz on disk, but for
      // file: deps that depend on other files/dirs, we must resolve the
      // location based on the *requestor* file/dir, not where it ends up.
      // '' is equivalent to '*'
      requested = npa.resolve(child.name, requested || '*', fromPath(requestor, requestor.edgesOut.get(child.name)))
    } catch (er) {
      // Not invalid because the child doesn't match, but because
      // the spec itself is not supported.  Nothing would match,
      // so the edge is definitely not valid and never can be.
      er.dependency = child.name
      er.requested = requested
      requestor.errors.push(er)
      return false
    }
  }

// if the lockfile is super old, or hand-modified,
  // then it's possible to hit this state.
  if (!requested) {
    const er = new Error('Invalid dependency specifier')
    er.dependency = child.name
    er.requested = requested
    requestor.errors.push(er)
    return false
  }

switch (requested.type) {
    case 'range':
      if (requested.fetchSpec === '*') {
        return true
      }
      // fallthrough
    case 'version':
      // if it's a version or a range other than '*', semver it
      return semver.satisfies(child.version, requested.fetchSpec, true)

case 'directory':
      return linkValid(child, requested, requestor)

case 'file':
      return tarballValid(child, requested, requestor)

case 'alias':
      // check that the alias target is valid
      return depValid(child, requested.subSpec, requestor)

case 'tag':
      // if it's a tag, we just verify that it has a tarball resolution
      // presumably, it came from the registry and was tagged at some point
      return child.resolved && npa(child.resolved).type === 'remote'

case 'remote':
      // verify that we got it from the desired location
      return child.resolved === requested.fetchSpec

case 'git': {
      // if it's a git type, verify that they're the same repo
      //
      // if it specifies a definite commit, then it must have the
      // same commit to be considered the same repo
      //
      // if it has a #semver:<range> specifier, verify that the
      // version in the package is in the semver range
      const resRepo = npa(child.resolved || '')
      const resHost = resRepo.hosted
      const reqHost = requested.hosted
      const reqCommit = /^[a-fA-F0-9]{40}$/.test(requested.gitCommittish || '')
      const nc = { noCommittish: !reqCommit }
      if (!resHost) {
        if (resRepo.fetchSpec !== requested.fetchSpec) {
          return false
        }
      } else {
        if (reqHost?.ssh(nc) !== resHost.ssh(nc)) {
          return false
        }
      }
      if (!requested.gitRange) {
        return true
      }
      return semver.satisfies(child.package.version, requested.gitRange, {
        loose: true,
      })
    }

default: // unpossible, just being cautious
      break
  }

const er = new Error('Unsupported dependency type')
  er.dependency = child.name
  er.requested = requested
  requestor.errors.push(er)
  return false
}

const linkValid = (child, requested, requestor) => {
  const isLink = !!child.isLink
  // if we're installing links and the node is a link, then it's invalid because we want
  // a real node to be there.  Except for workspaces. They are always links.
  if (requestor.installLinks && !child.isWorkspace) {
    return !isLink
  }

// directory must be a link to the specified folder
  return isLink && relative(child.realpath, requested.fetchSpec) === ''
}

const tarballValid = (child, requested) => {
  if (child.isLink) {
    return false
  }

if (child.resolved) {
    return child.resolved.replace(/\\/g, '/') === `file:${requested.fetchSpec.replace(/\\/g, '/')}`
  }

// if we have a legacy mutated package.json file.  we can't be 100%
  // sure that it resolved to the same file, but if it was the same
  // request, that's a pretty good indicator of sameness.
  if (child.package._requested) {
    return child.package._requested.saveSpec === requested.saveSpec
  }

// ok, we're probably dealing with some legacy cruft here, not much
  // we can do at this point unfortunately.
  return false
}

module.exports = (child, requested, accept, requestor) =>
  depValid(child, requested, requestor) ||
  (typeof accept === 'string' ? depValid(child, accept, requestor) : false)

[ CLOSE ]

Name	Size	Attr	Date	Action
[DIR] arborist	-	----	25-03-05 02:48	REN ATTR DEL
[FILE] add-rm-pkg-deps.js	5.03 KB	---A	24-11-07 15:32	DL REN ATTR DEL
[FILE] audit-report.js	12.35 KB	---A	24-11-07 15:32	DL REN ATTR DEL
[FILE] calc-dep-flags.js	3.55 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] can-place-dep.js	14.36 KB	---A	24-11-07 15:29	DL REN ATTR DEL
[FILE] case-insensitive-map.js	1.26 KB	---A	24-11-07 15:31	DL REN ATTR DEL
[FILE] consistent-resolve.js	1.33 KB	---A	24-11-07 15:31	DL REN ATTR DEL
[FILE] debug.js	1.28 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] deepest-nesting-target.js	709 B	---A	24-11-07 15:29	DL REN ATTR DEL
[FILE] dep-valid.js	5.15 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] diff.js	9.87 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] edge.js	6.92 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] from-path.js	1.10 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] gather-dep-set.js	1.30 KB	---A	24-11-07 15:29	DL REN ATTR DEL
[FILE] index.js	279 B	---A	24-11-07 15:31	DL REN ATTR DEL
[FILE] inventory.js	3.38 KB	---A	24-11-07 15:32	DL REN ATTR DEL
[FILE] link.js	3.18 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] node.js	44.41 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] optional-set.js	1.36 KB	---A	24-11-07 15:29	DL REN ATTR DEL
[FILE] override-resolves.js	236 B	---A	24-11-07 15:31	DL REN ATTR DEL
[FILE] override-set.js	3.26 KB	---A	24-11-07 15:31	DL REN ATTR DEL
[FILE] packument-cache.js	2.57 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] peer-entry-sets.js	2.65 KB	---A	24-11-07 15:29	DL REN ATTR DEL
[FILE] place-dep.js	20.31 KB	---A	24-11-07 15:32	DL REN ATTR DEL
[FILE] printable.js	5.29 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] query-selector-all.js	29.76 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] realpath.js	2.69 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] relpath.js	139 B	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] reset-dep-flags.js	653 B	---A	24-11-07 15:29	DL REN ATTR DEL
[FILE] retire-path.js	520 B	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] shrinkwrap.js	38.04 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] signal-handling.js	2.26 KB	---A	24-11-07 15:30	DL REN ATTR DEL
[FILE] signals.js	1.41 KB	---A	24-11-07 15:29	DL REN ATTR DEL
[FILE] spec-from-lock.js	908 B	---A	24-11-07 15:30	DL REN ATTR DEL
[FILE] tracker.js	3.00 KB	---A	24-11-07 15:32	DL REN ATTR DEL
[FILE] tree-check.js	4.20 KB	---A	24-11-07 15:31	DL REN ATTR DEL
[FILE] version-from-tgz.js	1.50 KB	---A	24-11-07 15:33	DL REN ATTR DEL
[FILE] vuln.js	6.03 KB	---A	24-11-07 15:31	DL REN ATTR DEL
[FILE] yarn-lock.js	10.93 KB	---A	24-11-07 15:33	DL REN ATTR DEL

TWICE

[ EDITING: dep-valid.js ]