Lock

1// Keep a project's package-lock.json valid for `npm ci` after package.json gained dependencies.
2// `npm ci` refuses a lock whose root entry disagrees with package.json. When the dependency deploy
3// added is already in the lock's tree (pulled in by something else), declaring it in the root entry
4// too is all `npm ci` needs; a dependency the tree lacks is left for `npm install` to resolve.
5import { existsSync, readFileSync, writeFileSync } from "node:fs";
6import { join } from "node:path";
7
8const parse = (v) => {
9  const m = String(v).match(/^(\d+)\.(\d+)\.(\d+)/);
10  return m ? m.slice(1).map(Number) : null;
11};
12const cmp = (a, b) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
13
14// The ranges deploy writes: exact, ^x.y.z, ~x.y.z, >=x.y.z. Anything else is "not known to fit".
15export function satisfies(version, range) {
16  const v = parse(version);
17  const m = String(range).trim().match(/^(\^|~|>=)?\s*v?(\d+\.\d+\.\d+)/);
18  if (!v || !m) return false;
19  const r = parse(m[2]);
20  const op = m[1] ?? "";
21  if (op === "") return cmp(v, r) === 0;
22  if (cmp(v, r) < 0) return false;
23  if (op === ">=") return true;
24  if (op === "~") return v[0] === r[0] && v[1] === r[1];
25  // caret: same major; for 0.x, same minor
26  return r[0] > 0 ? v[0] === r[0] : v[0] === 0 && v[1] === r[1];
27}
28
29// Returns null when there is no lock; else {promoted, missing}. Writes the lock only when it changed.
30export function syncLockRoot(projectDir) {
31  const lockPath = join(projectDir, "package-lock.json");
32  const pkgPath = join(projectDir, "package.json");
33  if (!existsSync(lockPath) || !existsSync(pkgPath)) return null;
34  const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
35  const lock = JSON.parse(readFileSync(lockPath, "utf8"));
36  lock.packages ??= {};
37  const root = (lock.packages[""] ??= {});
38  const promoted = [], missing = [];
39  let changed = false;
40  for (const field of ["dependencies", "devDependencies"]) {
41    for (const [name, range] of Object.entries(pkg[field] ?? {})) {
42      if (root[field]?.[name] === range) continue;
43      const inTree = lock.packages[`node_modules/${name}`];
44      if (inTree && satisfies(inTree.version, range)) {
45        (root[field] ??= {})[name] = range;
46        promoted.push(name);
47        changed = true;
48      } else {
49        missing.push(name);
50      }
51    }
52  }
53  if (changed) writeFileSync(lockPath, JSON.stringify(lock, null, 2) + "\n");
54  return { promoted, missing };
55}