@npmcli/arborist@0.0.11

Fix #1597

5 files changed, 85 insertions, 31 deletions

diff --git a/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js b/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
index 9d0590646..46c6a4f3c 100644
--- a/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
+++ b/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
@@ -485,13 +485,17 @@ module.exports = cls => class IdealTreeBuilder extends cls {
 
     const node = this[_depsQueue].shift()
 
+    const bd = node.package.bundleDependencies
+    const hasBundle = bd && Array.isArray(bd) && bd.length
+    const { hasShrinkwrap } = node
+
     // if the node was already visited, or has since been removed from the
     // tree, skip over it and process the rest of the queue.  If a node has
     // a shrinkwrap, also skip it, because it's going to get its deps
     // satisfied by whatever's in that file anyway.
     if (this[_depsSeen].has(node) ||
         node.root !== this.idealTree ||
-        node.hasShrinkwrap && !this[_complete])
+        hasShrinkwrap && !this[_complete])
       return this[_buildDepStep]()
 
     this[_depsSeen].add(node)
@@ -505,25 +509,24 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     // ideal tree by reading bundles/shrinkwraps in place.
     // Don't bother if the node is from the actual tree and hasn't
     // been resolved, because we can't fetch it anyway, could be anything!
-    if (this[_complete] && node !== this.idealTree && node.resolved) {
+    const crackOpen = this[_complete] &&
+      node !== this.idealTree &&
+      node.resolved &&
+      (hasBundle || hasShrinkwrap)
+    if (crackOpen) {
       const Arborist = this.constructor
-      const bd = node.package.bundleDependencies
-      const hasBundle = bd && Array.isArray(bd) && bd.length
-      const { hasShrinkwrap } = node
-      if (hasBundle || hasShrinkwrap) {
-        const opt = { ...this.options }
-        await cacache.tmp.withTmp(this.cache, opt, async path => {
-          await pacote.extract(node.resolved, path, opt)
-
-          if (hasShrinkwrap)
-            await new Arborist({ ...this.options, path })
-              .loadVirtual({ root: node })
-
-          if (hasBundle)
-            await new Arborist({ ...this.options, path })
-              .loadActual({ root: node, ignoreMissing: true })
-        })
-      }
+      const opt = { ...this.options }
+      await cacache.tmp.withTmp(this.cache, opt, async path => {
+        await pacote.extract(node.resolved, path, opt)
+
+        if (hasShrinkwrap)
+          await new Arborist({ ...this.options, path })
+            .loadVirtual({ root: node })
+
+        if (hasBundle)
+          await new Arborist({ ...this.options, path })
+            .loadActual({ root: node, ignoreMissing: true })
+      })
     }
 
     // if any deps are missing or invalid, then we fetch the manifest for
diff --git a/node_modules/@npmcli/arborist/lib/arborist/reify.js b/node_modules/@npmcli/arborist/lib/arborist/reify.js
index 1df269009..13fdd1117 100644
--- a/node_modules/@npmcli/arborist/lib/arborist/reify.js
+++ b/node_modules/@npmcli/arborist/lib/arborist/reify.js
@@ -78,7 +78,7 @@ const _scriptShell = Symbol('scriptShell')
 
 // defined by Ideal mixin
 const _force = Symbol.for('force')
-const _idealTreePrune = Symbol.for('idealTreePrune')
+const _pruneBundledMetadeps = Symbol.for('pruneBundledMetadeps')
 const _explicitRequests = Symbol.for('explicitRequests')
 const _resolvedAdd = Symbol.for('resolvedAdd')
 const _usePackageLock = Symbol.for('usePackageLock')
@@ -224,6 +224,7 @@ module.exports = cls => class Reifier extends cls {
     const paths = [ node.path, ...node.binPaths ]
     const moves = this[_retiredPaths]
     this.log.silly('reify', 'mark', retire ? 'retired' : 'deleted', paths)
+    node.parent = null
     for (const path of paths) {
       if (retire) {
         const retired = retirePath(path)
@@ -518,9 +519,8 @@ module.exports = cls => class Reifier extends cls {
     const maxBundleDepth = bundlesByDepth.get('maxBundleDepth')
     if (depth > maxBundleDepth) {
       // if we did something, then prune the tree and update the diffs
-      // XXX this is two full tree scans, find a better way to do this.
       if (maxBundleDepth !== -1) {
-        this[_idealTreePrune]()
+        this[_pruneBundledMetadeps](bundlesByDepth)
         this[_diffTrees]()
       }
       process.emit('timeEnd', 'reify:loadBundles')
@@ -577,6 +577,57 @@ module.exports = cls => class Reifier extends cls {
     return bundlesByDepth
   }
 
+  // https://github.com/npm/cli/issues/1597#issuecomment-667639545
+  [_pruneBundledMetadeps] (bundlesByDepth) {
+    const bundleShadowed = new Set()
+    // create the list of nodes shadowed by children of bundlers
+    for (const bundles of bundlesByDepth.values()) {
+      // skip the 'maxBundleDepth' item
+      if (!Array.isArray(bundles))
+        continue
+      for (const node of bundles) {
+        for (const name of node.children.keys()) {
+          const shadow = node.parent.resolve(name)
+          if (!shadow)
+            continue
+          bundleShadowed.add(shadow)
+          shadow.extraneous = true
+        }
+      }
+    }
+    let changed = true
+    let removedAll = false
+    while (changed) {
+      changed = false
+      for (const shadow of bundleShadowed) {
+        if (!shadow.extraneous) {
+          bundleShadowed.delete(shadow)
+          continue
+        }
+
+        for (const edge of shadow.edgesIn) {
+          if (!edge.from.extraneous) {
+            shadow.extraneous = false
+            bundleShadowed.delete(shadow)
+            changed = true
+          } else {
+            for (const shadDep of shadow.edgesOut.values()) {
+              /* istanbul ignore else - pretty unusual situation, just being
+               * defensive here. Would mean that a bundled dep has a dependency
+               * that is unmet. which, weird, but if you bundle it, we take
+               * whatever you put there and assume the publisher knows best. */
+              if (shadDep.to)
+                bundleShadowed.add(shadDep.to)
+            }
+          }
+        }
+      }
+    }
+    for (const shadow of bundleShadowed) {
+      this[_addNodeToTrashList](shadow)
+    }
+  }
+
   [_submitQuickAudit] () {
     if (this.options.audit === false)
       return this.auditReport = null
diff --git a/node_modules/@npmcli/arborist/package.json b/node_modules/@npmcli/arborist/package.json
index 3c4dced7e..081506cfe 100644
--- a/node_modules/@npmcli/arborist/package.json
+++ b/node_modules/@npmcli/arborist/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@npmcli/installed-package-contents": "^1.0.5",
diff --git a/package-lock.json b/package-lock.json
index ab1870362..71b037525 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -88,7 +88,7 @@
       ],
       "license": "Artistic-2.0",
       "dependencies": {
-        "@npmcli/arborist": "^0.0.10",
+        "@npmcli/arborist": "^0.0.11",
         "@npmcli/ci-detect": "^1.2.0",
         "@npmcli/run-script": "^1.4.0",
         "abbrev": "~1.1.1",
@@ -397,9 +397,9 @@
       "dev": true
     },
     "node_modules/@npmcli/arborist": {
-      "version": "0.0.10",
-      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-0.0.10.tgz",
-      "integrity": "sha512-MWHybKXLkgc1Ds4aZjwmIL6G3ItK0wvKMG8oLt5XHrsE5sII0Vb83+8xT4hRGg+H17K/JfFSLF8UPilPidLy5w==",
+      "version": "0.0.11",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-0.0.11.tgz",
+      "integrity": "sha512-7F8TnKzNNMMZoPLkJ0QizOCp6BeBZMhPy8qzV6wOvIewQlyKhsc/Lte4dxVlHjGmh2supcjwqg2PN8hQb/I/8w==",
       "inBundle": true,
       "dependencies": {
         "@npmcli/installed-package-contents": "^1.0.5",
@@ -10190,9 +10190,9 @@
       "dev": true
     },
     "@npmcli/arborist": {
-      "version": "0.0.10",
-      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-0.0.10.tgz",
-      "integrity": "sha512-MWHybKXLkgc1Ds4aZjwmIL6G3ItK0wvKMG8oLt5XHrsE5sII0Vb83+8xT4hRGg+H17K/JfFSLF8UPilPidLy5w==",
+      "version": "0.0.11",
+      "resolved": "https://registry.npmjs.org/@npmcli/arborist/-/arborist-0.0.11.tgz",
+      "integrity": "sha512-7F8TnKzNNMMZoPLkJ0QizOCp6BeBZMhPy8qzV6wOvIewQlyKhsc/Lte4dxVlHjGmh2supcjwqg2PN8hQb/I/8w==",
       "requires": {
         "@npmcli/installed-package-contents": "^1.0.5",
         "@npmcli/map-workspaces": "0.0.0-pre.1",
diff --git a/package.json b/package.json
index a6ef79bd6..6513330ed 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "npx": "bin/npx-cli.js"
   },
   "dependencies": {
-    "@npmcli/arborist": "^0.0.10",
+    "@npmcli/arborist": "^0.0.11",
     "@npmcli/ci-detect": "^1.2.0",
     "@npmcli/run-script": "^1.4.0",
     "abbrev": "~1.1.1",