pnpm.package-manager.ts

import type { CloudMain } from '@teambit/cloud';
import { extendWithComponentsFromDir, BIT_CLOUD_REGISTRY } from '@teambit/dependency-resolver';
import type {
  DependencyResolverMain,
  InstallationContext,
  PackageManager,
  PackageManagerInstallOptions,
  PackageManagerResolveRemoteVersionOptions,
  ResolvedPackageVersion,
  PackageManagerProxyConfig,
  PackageManagerNetworkConfig,
  CalcDepsGraphOptions,
} from '@teambit/dependency-resolver';
import { Registries, Registry } from '@teambit/pkg.entities.registry';
import type { Logger } from '@teambit/logger';
import { type LockfileFile } from '@pnpm/lockfile.types';
import fs from 'fs';
import { memoize, omit } from 'lodash';
import type { PeerDependencyIssuesByProjects } from '@pnpm/core';
import { filterLockfileByImporters } from '@pnpm/lockfile.filtering';
import type { Config } from '@pnpm/config';
import { type ProjectId, type ProjectManifest, type DepPath } from '@pnpm/types';
import type { Modules } from '@pnpm/modules-yaml';
import { readModulesManifest } from '@pnpm/modules-yaml';
import type { ImporterInfo } from '@pnpm/reviewing.dependencies-hierarchy';
import { buildDependentsTree } from '@pnpm/reviewing.dependencies-hierarchy';
import { renderDependentsTree } from '@pnpm/list';
import {
  readWantedLockfile,
  writeLockfileFile,
  convertToLockfileFile as convertLockfileObjectToLockfileFile,
} from '@pnpm/lockfile.fs';
import { BIT_ROOTS_DIR } from '@teambit/legacy.constants';
import { ServerSendOutStream } from '@teambit/legacy.logger';
import { join } from 'path';
import { convertLockfileToGraph, convertGraphToLockfile } from './lockfile-deps-graph-converter';
import { readConfig } from './read-config';
import { pnpmPruneModules } from './pnpm-prune-modules';
import type { RebuildFn } from './lynx';
import { generateResolverAndFetcher } from './lynx';
import { type DependenciesGraph } from '@teambit/objects';

export type { RebuildFn };

export interface InstallResult {
  dependenciesChanged: boolean;
  rebuild: RebuildFn;
  storeDir: string;
  depsRequiringBuild?: DepPath[];
}

type ReadConfigResult = Promise<{ config: Config; warnings: string[] }>;

export class PnpmPackageManager implements PackageManager {
  readonly name = 'pnpm';
  readonly modulesManifestCache: Map<string, Modules> = new Map();
  private username: string;

  private _readConfig = async (dir?: string): ReadConfigResult => {
    const { config, warnings } = await readConfig(dir);
    if (config?.fetchRetries && config?.fetchRetries < 5) {
      config.fetchRetries = 5;
      return { config, warnings };
    }

    return { config, warnings };
  };

  public readConfig: (dir?: string) => ReadConfigResult = memoize(this._readConfig);

  constructor(
    private depResolver: DependencyResolverMain,
    private logger: Logger,
    private cloud: CloudMain
  ) {}

  async dependenciesGraphToLockfile(
    dependenciesGraph: DependenciesGraph,
    opts: {
      cacheDir: string;
      manifests: Record<string, ProjectManifest>;
      rootDir: string;
      registries?: Registries;
      proxyConfig?: PackageManagerProxyConfig;
      networkConfig?: PackageManagerNetworkConfig;
    }
  ) {
    const registries = opts.registries ?? new Registries(new Registry('https://node-registry.bit.cloud', false), {});
    const { resolve } = await generateResolverAndFetcher({
      ...opts,
      registries,
    });
    const graphLockfile: LockfileFile = await convertGraphToLockfile(dependenciesGraph, {
      ...opts,
      resolve,
    });
    // Merge the graph-derived subset into any existing wanted lockfile rather than
    // overwriting. Only the importers, packages, and snapshots referenced by the
    // imported components' subgraph are re-stated here; every other workspace dep's
    // locked version must be preserved so pnpm doesn't re-resolve it to a newer
    // registry version.
    const existingLockfile = await readWantedLockfile(opts.rootDir, { ignoreIncompatible: true });
    const mergedLockfile = existingLockfile
      ? mergeGraphLockfileIntoExisting(convertLockfileObjectToLockfileFile(existingLockfile), graphLockfile)
      : graphLockfile;
    Object.assign(mergedLockfile, {
      bit: {
        ...(mergedLockfile as LockfileFile & { bit?: Record<string, unknown> }).bit,
        restoredFromModel: true,
      },
    });
    const lockfilePath = join(opts.rootDir, 'pnpm-lock.yaml');
    await writeLockfileFile(lockfilePath, mergedLockfile);
    this.logger.debug(`generated a lockfile from dependencies graph at ${lockfilePath}`);
    if (process.env.DEPS_GRAPH_LOG) {
      // eslint-disable-next-line no-console
      console.log(`generated a lockfile from dependencies graph at ${lockfilePath}`);
    }
  }

  async install(
    { rootDir, manifests }: InstallationContext,
    installOptions: PackageManagerInstallOptions = {}
  ): Promise<InstallResult> {
    // require it dynamically for performance purpose. the pnpm package require many files - do not move to static import
    // eslint-disable-next-line global-require, import/no-dynamic-require
    const { install } = require('./lynx');

    const registries = await this.depResolver.getRegistries();
    const proxyConfig = await this.depResolver.getProxyConfig();
    const networkConfig = await this.depResolver.getNetworkConfig();
    const { config } = await this.readConfig(installOptions.packageManagerConfigRootDir);
    // When dependenciesGraph is explicitly supplied (by the component writer on import, or
    // by `bit install --restore`), honor it regardless of the DEPS_GRAPH feature toggle —
    // the flag gates the *providers* that fetch graphs, so the presence of one here means
    // the caller already decided this install should be seeded from stored graphs.
    if (
      installOptions.dependenciesGraph &&
      (installOptions.rootComponents || installOptions.rootComponentsForCapsules)
    ) {
      try {
        await this.dependenciesGraphToLockfile(installOptions.dependenciesGraph, {
          manifests,
          rootDir,
          registries,
          proxyConfig,
          networkConfig,
          cacheDir: config.cacheDir,
        });
      } catch (error) {
        // If the lockfile could not be created for some reason, it will be created later during installation.
        this.logger.error((error as Error).message);
      }
    }

    this.logger.debug(`running installation in root dir ${rootDir}`);
    this.logger.debug('components manifests for installation', manifests);
    if (!installOptions.hidePackageManagerOutput) {
      // this.logger.setStatusLine('installing dependencies using pnpm');
      // turn off the logger because it interrupts the pnpm output
      // this.logger.console('-------------------------PNPM OUTPUT-------------------------');
      this.logger.off();
    }
    if (!installOptions.useNesting && installOptions.rootComponentsForCapsules) {
      manifests = await extendWithComponentsFromDir(rootDir, manifests);
    }
    if (installOptions.nmSelfReferences) {
      Object.values(manifests).forEach((manifest) => {
        if (manifest.name) {
          manifest.devDependencies = {
            [manifest.name]: 'link:.',
            ...manifest.devDependencies,
          };
        }
      });
    }
    this.modulesManifestCache.delete(rootDir);
    const { dependenciesChanged, rebuild, storeDir, depsRequiringBuild } = await install(
      rootDir,
      manifests,
      config.storeDir,
      config.cacheDir,
      registries,
      proxyConfig,
      networkConfig,
      {
        autoInstallPeers: installOptions.autoInstallPeers ?? true,
        dedupePeers: installOptions.dedupePeers ?? true,
        enableModulesDir: installOptions.enableModulesDir,
        engineStrict: installOptions.engineStrict ?? config.engineStrict,
        excludeLinksFromLockfile: installOptions.excludeLinksFromLockfile,
        lockfileOnly: installOptions.lockfileOnly,
        minimumReleaseAge: installOptions.minimumReleaseAge,
        minimumReleaseAgeExclude: installOptions.minimumReleaseAgeExclude,
        neverBuiltDependencies: installOptions.neverBuiltDependencies,
        allowScripts: installOptions.allowScripts,
        dangerouslyAllowAllScripts: installOptions.dangerouslyAllowAllScripts,
        nodeLinker: installOptions.nodeLinker,
        nodeVersion: installOptions.nodeVersion ?? config.nodeVersion,
        includeOptionalDeps: installOptions.includeOptionalDeps,
        ignorePackageManifest: installOptions.ignorePackageManifest,
        dedupeInjectedDeps: installOptions.dedupeInjectedDeps ?? false,
        dryRun: installOptions.dependenciesGraph == null && installOptions.dryRun,
        overrides: installOptions.overrides,
        hoistPattern: installOptions.hoistPatterns ?? config.hoistPattern,
        publicHoistPattern: config.shamefullyHoist
          ? ['*']
          : ['@eslint/plugin-*', '*eslint-plugin*', '@prettier/plugin-*', '*prettier-plugin-*'],
        hoistWorkspacePackages: installOptions.hoistWorkspacePackages ?? false,
        hoistInjectedDependencies: installOptions.hoistInjectedDependencies,
        packageImportMethod: installOptions.packageImportMethod ?? config.packageImportMethod,
        preferOffline: installOptions.preferOffline,
        rootComponents: installOptions.rootComponents,
        rootComponentsForCapsules: installOptions.rootComponentsForCapsules,
        sideEffectsCacheRead: installOptions.sideEffectsCache ?? true,
        sideEffectsCacheWrite: installOptions.sideEffectsCache ?? true,
        pnpmHomeDir: config.pnpmHomeDir,
        updateAll: installOptions.updateAll,
        hidePackageManagerOutput: installOptions.hidePackageManagerOutput,
        reportOptions: {
          appendOnly: installOptions.optimizeReportForNonTerminal,
          process: process.env.BIT_CLI_SERVER_NO_TTY ? { ...process, stdout: new ServerSendOutStream() } : undefined,
          throttleProgress: installOptions.throttleProgress,
          hideProgressPrefix: installOptions.hideProgressPrefix,
          hideLifecycleOutput: installOptions.hideLifecycleOutput,
          peerDependencyRules: installOptions.peerDependencyRules,
        },
        returnListOfDepsRequiringBuild: installOptions.returnListOfDepsRequiringBuild,
        forcedHarmonyVersion: installOptions.forcedHarmonyVersion,
      },
      this.logger
    );
    if (!installOptions.hidePackageManagerOutput) {
      this.logger.on();
      // Make a divider row to improve output
      // this.logger.console('-------------------------END PNPM OUTPUT-------------------------');
      // this.logger.consoleSuccess('installing dependencies using pnpm');
    }
    return { dependenciesChanged, rebuild, storeDir, depsRequiringBuild };
  }

  async getPeerDependencyIssues(
    rootDir: string,
    manifests: Record<string, ProjectManifest>,
    installOptions: PackageManagerInstallOptions = {}
  ): Promise<PeerDependencyIssuesByProjects> {
    const proxyConfig = await this.depResolver.getProxyConfig();
    const networkConfig = await this.depResolver.getNetworkConfig();
    const registries = await this.depResolver.getRegistries();
    // require it dynamically for performance purpose. the pnpm package require many files - do not move to static import
    // eslint-disable-next-line global-require, import/no-dynamic-require
    const lynx = require('./lynx');
    const { config } = await this.readConfig(installOptions.packageManagerConfigRootDir);
    return lynx.getPeerDependencyIssues(manifests, {
      storeDir: config.storeDir,
      cacheDir: config.cacheDir,
      proxyConfig,
      registries,
      rootDir,
      networkConfig,
      overrides: installOptions.overrides,
      packageImportMethod: installOptions.packageImportMethod ?? config.packageImportMethod,
    });
  }

  async resolveRemoteVersion(
    packageName: string,
    options: PackageManagerResolveRemoteVersionOptions
  ): Promise<ResolvedPackageVersion> {
    // require it dynamically for performance purpose. the pnpm package require many files - do not move to static import
    // eslint-disable-next-line global-require, import/no-dynamic-require
    const { resolveRemoteVersion } = require('./lynx');
    const registries = await this.depResolver.getRegistries();
    const proxyConfig = await this.depResolver.getProxyConfig();
    const networkConfig = await this.depResolver.getNetworkConfig();
    const { config } = await this.readConfig(options.packageManagerConfigRootDir);
    return resolveRemoteVersion(packageName, {
      rootDir: options.rootDir,
      cacheDir: config.cacheDir,
      registries,
      proxyConfig,
      networkConfig,
      fullMetadata: options.fullMetadata,
    });
  }

  async getProxyConfig?(): Promise<PackageManagerProxyConfig> {
    // eslint-disable-next-line global-require, import/no-dynamic-require
    const { getProxyConfig } = require('./get-proxy-config');
    const { config } = await this.readConfig();
    return getProxyConfig(config);
  }

  async getNetworkConfig?(): Promise<PackageManagerNetworkConfig> {
    const { config } = await this.readConfig();
    if (!this.username) {
      this.username = (await this.cloud.getCurrentUser())?.username ?? 'anonymous';
    }
    // We need to use config.rawConfig as it will only contain the settings defined by the user.
    // config contains default values of the settings when they are not defined by the user.
    const result: PackageManagerNetworkConfig = {
      userAgent: `bit user/${this.username}`,
    };
    if (config.rawConfig['max-sockets'] != null) {
      result.maxSockets = config.rawConfig['max-sockets'];
    }
    if (config.rawConfig['network-concurrency'] != null) {
      result.networkConcurrency = config.rawConfig['network-concurrency'];
    }
    if (config.rawConfig['fetch-retries'] != null) {
      result.fetchRetries = config.rawConfig['fetch-retries'];
    }
    if (config.rawConfig['fetch-timeout'] != null) {
      result.fetchTimeout = config.rawConfig['fetch-timeout'];
    }
    if (config.rawConfig['fetch-retry-maxtimeout'] != null) {
      result.fetchRetryMaxtimeout = config.rawConfig['fetch-retry-maxtimeout'];
    }
    if (config.rawConfig['fetch-retry-mintimeout'] != null) {
      result.fetchRetryMintimeout = config.rawConfig['fetch-retry-mintimeout'];
    }
    if (config.rawConfig['strict-ssl'] != null) {
      result.strictSSL = config.rawConfig['strict-ssl'];
    }
    if (config.ca != null) {
      result.ca = config.ca;
    }
    if (config.cert != null) {
      result.cert = config.cert;
    }
    if (config.key != null) {
      result.key = config.key;
    }
    return result;
  }

  async getRegistries(): Promise<Registries> {
    // eslint-disable-next-line global-require, import/no-dynamic-require
    const { getRegistries } = require('./get-registries');
    const { config } = await this.readConfig();
    const pnpmRegistry = await getRegistries(config);
    const defaultRegistry = new Registry(
      pnpmRegistry.default.uri,
      pnpmRegistry.default.alwaysAuth,
      pnpmRegistry.default.authHeaderValue,
      pnpmRegistry.default.originalAuthType,
      pnpmRegistry.default.originalAuthValue
    );

    const pnpmScoped = omit(pnpmRegistry, ['default']);
    const scopesRegistries: Record<string, Registry> = Object.keys(pnpmScoped).reduce((acc, scopedRegName) => {
      const scopedReg = pnpmScoped[scopedRegName];
      const name = scopedRegName.replace('@', '');
      acc[name] = new Registry(
        scopedReg.uri,
        scopedReg.alwaysAuth,
        scopedReg.authHeaderValue,
        scopedReg.originalAuthType,
        scopedReg.originalAuthValue
      );
      return acc;
    }, {});

    // Add bit registry server if not exist
    if (!scopesRegistries.bit) {
      scopesRegistries.bit = new Registry(BIT_CLOUD_REGISTRY, true);
    }

    return new Registries(defaultRegistry, scopesRegistries);
  }

  async getInjectedDirs(rootDir: string, componentDir: string, packageName: string): Promise<string[]> {
    const modulesState = await this._readModulesManifest(rootDir);
    if (modulesState?.injectedDeps == null) return [];
    return modulesState.injectedDeps[`node_modules/${packageName}`] ?? modulesState.injectedDeps[componentDir] ?? [];
  }

  async _readModulesManifest(lockfileDir: string): Promise<Modules | undefined> {
    if (this.modulesManifestCache.has(lockfileDir)) {
      return this.modulesManifestCache.get(lockfileDir);
    }
    const modulesManifest = await readModulesManifest(join(lockfileDir, 'node_modules'));
    if (modulesManifest) {
      this.modulesManifestCache.set(lockfileDir, modulesManifest);
    }
    return modulesManifest ?? undefined;
  }

  getWorkspaceDepsOfBitRoots(manifests: ProjectManifest[]): Record<string, string> {
    return Object.fromEntries(manifests.map((manifest) => [manifest.name, 'workspace:*']));
  }

  async pruneModules(rootDir: string): Promise<void> {
    return pnpmPruneModules(rootDir);
  }

  async findUsages(depName: string, opts: { lockfileDir: string; depth?: number }): Promise<string> {
    const lockfile = await readWantedLockfile(opts.lockfileDir, { ignoreIncompatible: false });
    if (!lockfile) return '';
    const importerIds = Object.keys(lockfile.importers ?? {}).filter((id) => !id.includes(`${BIT_ROOTS_DIR}/`));
    const projectPaths = importerIds.map((id) => join(opts.lockfileDir, id));
    const importerInfoMap = new Map<string, ImporterInfo>();
    for (const importerId of importerIds) {
      const pkgJson = tryReadPackageJson(join(opts.lockfileDir, importerId));
      importerInfoMap.set(importerId, {
        name: pkgJson?.name ?? importerId,
        version: pkgJson?.version ?? '',
      });
    }
    const trees = await buildDependentsTree([depName], projectPaths, {
      include: {
        dependencies: true,
        devDependencies: true,
        optionalDependencies: true,
      },
      lockfileDir: opts.lockfileDir,
      registries: {
        default: 'https://registry.npmjs.org',
      },
      importerInfoMap,
      lockfile,
      nameFormatter({ manifest }) {
        if ('componentId' in manifest) {
          const { scope, name } = manifest.componentId as { scope: string; name: string };
          return `${scope}/${name}`;
        }
        return manifest.name;
      },
    });
    return renderDependentsTree(trees, {
      depth: opts.depth ?? Infinity,
      long: false,
    });
  }

  /**
   * Calculating the dependencies graph of a given component using the lockfile.
   */
  async calcDependenciesGraph(opts: CalcDepsGraphOptions): Promise<void> {
    const originalLockfile = await readWantedLockfile(opts.rootDir, { ignoreIncompatible: false });
    if (!originalLockfile) {
      return;
    }
    for (const { componentRootDir, componentRelativeDir, pkgName, component } of opts.components) {
      let compRootDir: string | undefined;
      if (componentRootDir && !originalLockfile.importers[componentRootDir] && componentRootDir.includes('@')) {
        compRootDir = componentRootDir.split('@')[0];
      } else {
        compRootDir = componentRootDir;
      }
      if (!originalLockfile.importers[compRootDir as ProjectId]) {
        continue;
      }
      const filterByImporterIds = [componentRelativeDir as ProjectId];
      if (compRootDir != null) {
        filterByImporterIds.push(compRootDir as ProjectId);
      }
      // Only clone the importers that will be mutated, reuse the rest of the lockfile as-is
      const clonedImporters: Record<string, any> = {};
      for (const importerId of filterByImporterIds) {
        if (originalLockfile.importers[importerId]) {
          clonedImporters[importerId] = structuredClone(originalLockfile.importers[importerId]);
        }
      }
      const lockfile = {
        ...originalLockfile,
        importers: { ...originalLockfile.importers, ...clonedImporters },
      };
      for (const importerId of filterByImporterIds) {
        for (const depType of [
          'dependencies',
          'devDependencies',
          'optionalDependencies',
          'specifiers',
          'dependenciesMeta',
        ]) {
          for (const workspacePkgName of opts.componentIdByPkgName.keys()) {
            if (workspacePkgName !== pkgName) {
              delete lockfile.importers[importerId]?.[depType]?.[workspacePkgName];
            }
          }
        }
      }
      // Filters the lockfile so that it only includes packages related to the given component.
      const partialLockfile = convertLockfileObjectToLockfileFile(
        filterLockfileByImporters(lockfile, filterByImporterIds, {
          include: {
            dependencies: true,
            devDependencies: true,
            optionalDependencies: true,
          },
          failOnMissingDependencies: false,
          skipped: new Set(),
        })
      );
      const graph = convertLockfileToGraph(partialLockfile, {
        ...opts,
        componentRootDir: compRootDir,
        componentRelativeDir,
        pkgName,
      });
      component.state._consumer.dependenciesGraph = graph;
    }
  }
}

function tryReadPackageJson(pkgDir: string) {
  try {
    return JSON.parse(fs.readFileSync(join(pkgDir, 'package.json'), 'utf8'));
  } catch {
    return undefined;
  }
}

// Merge a graph-derived lockfile into an existing wanted lockfile. The graph lockfile is
// authoritative for keys it contains (a re-imported component can change the resolution
// of its own deps), but must not erase packages, snapshots, or importer entries that are
// only known to the existing lockfile. convertGraphToLockfile emits importer entries for
// every workspace project, but only populates deps for manifests whose keys appear in the
// graph's root edge — so per-importer overlay (instead of overwrite) is what keeps
// unrelated workspace importers intact.
//
// Packages and snapshots are deep-merged per key so that pnpm-managed metadata the graph
// doesn't round-trip (e.g. `optional`, `transitivePeerDependencies`, `dev`) survives on
// entries the graph also knows about.
function mergeGraphLockfileIntoExisting(existing: LockfileFile, graph: LockfileFile): LockfileFile {
  const importers: NonNullable<LockfileFile['importers']> = { ...existing.importers };
  for (const [importerId, graphImporter] of Object.entries(graph.importers ?? {})) {
    const existingImporter = importers[importerId];
    if (!existingImporter) {
      importers[importerId] = graphImporter;
      continue;
    }
    importers[importerId] = {
      ...existingImporter,
      dependencies: { ...existingImporter.dependencies, ...graphImporter.dependencies },
      devDependencies: { ...existingImporter.devDependencies, ...graphImporter.devDependencies },
      optionalDependencies: {
        ...existingImporter.optionalDependencies,
        ...graphImporter.optionalDependencies,
      },
    };
  }
  const existingBit = (existing as LockfileFile & { bit?: { depsRequiringBuild?: string[] } }).bit;
  const graphBit = (graph as LockfileFile & { bit?: { depsRequiringBuild?: string[] } }).bit;
  const mergedDepsRequiringBuild = Array.from(
    new Set([...(existingBit?.depsRequiringBuild ?? []), ...(graphBit?.depsRequiringBuild ?? [])])
  ).sort();
  const merged = {
    ...existing,
    // Keep the existing lockfile's schema version. convertGraphToLockfile hardcodes
    // lockfileVersion: '9.0', so preferring graph.lockfileVersion would silently
    // downgrade workspaces whose pnpm already writes a newer schema and trigger a
    // full rewrite on the next install.
    lockfileVersion: existing.lockfileVersion ?? graph.lockfileVersion,
    importers,
    packages: mergeEntryRecords(existing.packages, graph.packages),
    snapshots: mergeEntryRecords(existing.snapshots, graph.snapshots),
  };
  if (existingBit || graphBit) {
    (merged as LockfileFile & { bit?: Record<string, unknown> }).bit = {
      ...existingBit,
      ...graphBit,
      depsRequiringBuild: mergedDepsRequiringBuild,
    };
  }
  return merged;
}

function mergeEntryRecords<T extends object>(
  existing: Record<string, T> | undefined,
  graph: Record<string, T> | undefined
): Record<string, T> | undefined {
  if (!existing) return graph;
  if (!graph) return existing;
  const merged: Record<string, T> = { ...existing };
  for (const [key, graphEntry] of Object.entries(graph)) {
    const existingEntry = merged[key];
    merged[key] = existingEntry ? ({ ...existingEntry, ...graphEntry } as T) : graphEntry;
  }
  return merged;
}