shrinkwrap.js

// a module that manages a shrinkwrap file (npm-shrinkwrap.json or
// package-lock.json).

// Increment whenever the lockfile version updates
// v1 - npm <=6
// v2 - arborist v1, npm v7, backwards compatible with v1, add 'packages'
// v3 will drop the 'dependencies' field, backwards comp with v2, not v1
//
// We cannot bump to v3 until npm v6 is out of common usage, and
// definitely not before npm v8.

const lockfileVersion = 2

// for comparing nodes to yarn.lock entries
const mismatch = (a, b) => a && b && a !== b

// this.tree => the root node for the tree (ie, same path as this)
// - Set the first time we do `this.add(node)` for a path matching this.path
//
// this.add(node) =>
// - decorate the node with the metadata we have, if we have it, and it matches
// - add to the map of nodes needing to be committed, so that subsequent
// changes are captured when we commit that location's metadata.
//
// this.commit() =>
// - commit all nodes awaiting update to their metadata entries
// - re-generate this.data and this.yarnLock based on this.tree
//
// Note that between this.add() and this.commit(), `this.data` will be out of
// date!  Always call `commit()` before relying on it.
//
// After calling this.commit(), any nodes not present in the tree will have
// been removed from the shrinkwrap data as well.

const procLog = require('./proc-log.js')
const YarnLock = require('./yarn-lock.js')
const {promisify} = require('util')
const rimraf = promisify(require('rimraf'))
const fs = require('fs')
const readFile = promisify(fs.readFile)
const writeFile = promisify(fs.writeFile)
const stat = promisify(fs.stat)
const readdir_ = promisify(fs.readdir)
const readlink = promisify(fs.readlink)

// XXX remove when drop support for node v10
const lstat = promisify(fs.lstat)
/* istanbul ignore next - version specific polyfill */
const readdir = async (path, opt) => {
  if (!opt || !opt.withFileTypes)
    return readdir_(path, opt)
  const ents = await readdir_(path, opt)
  if (typeof ents[0] === 'string') {
    return Promise.all(ents.map(async ent => {
      return Object.assign(await lstat(path + '/' + ent), { name: ent })
    }))
  }
  return ents
}

const { resolve, basename } = require('path')
const specFromLock = require('./spec-from-lock.js')
const versionFromTgz = require('./version-from-tgz.js')
const npa = require('npm-package-arg')
const rpj = require('read-package-json-fast')
const parseJSON = require('parse-conflict-json')

const stringify = require('json-stringify-nice')
const swKeyOrder = [
  'name',
  'version',
  'lockfileVersion',
  'resolved',
  'integrity',
  'requires',
  'packages',
  'dependencies',
]

// used to rewrite from yarn registry to npm registry
const yarnRegRe = /^https?:\/\/registry.yarnpkg.com\//
const npmRegRe = /^https?:\/\/registry.npmjs.org\//

// sometimes resolved: is weird or broken, or something npa can't handle
const specFromResolved = resolved => {
  try {
    return npa(resolved)
  } catch (er) {
    return {}
  }
}

const relpath = require('./relpath.js')

const consistentResolve = require('./consistent-resolve.js')

const maybeReadFile = file => {
  return readFile(file, 'utf8').then(d => d, er => {
    /* istanbul ignore else - can't test without breaking module itself */
    if (er.code === 'ENOENT')
      return ''
    else
      throw er
  })
}

const maybeStatFile = file => {
  return stat(file).then(st => st.isFile(), er => {
    /* istanbul ignore else - can't test without breaking module itself */
    if (er.code === 'ENOENT')
      return null
    else
      throw er
  })
}

const pkgMetaKeys = [
  // note: name is included if necessary, for alias packages
  'version',
  'dependencies',
  'peerDependencies',
  'peerDependenciesMeta',
  'optionalDependencies',
  'bundleDependencies',
  'acceptDependencies',
  'funding',
  'engines',
  'os',
  'cpu',
  '_integrity',
  'license',
  '_hasShrinkwrap',
  'hasInstallScript',
  'bin',
  'deprecated',
  'workspaces',
]

const nodeMetaKeys = [
  'integrity',
  'inBundle',
  'hasShrinkwrap',
  'hasInstallScript',
]

const metaFieldFromPkg = (pkg, key) => {
  const val = pkg[key]
  // get the license type, not an object
  return (key === 'license' && val && typeof val === 'object' && val.type)
    ? val.type
    // skip empty objects and falsey values
    : (val && !(typeof val === 'object' && !Object.keys(val).length)) ? val
    : null
}

// check to make sure that there are no packages newer than the hidden lockfile
const assertNoNewer = async (path, data, lockTime, dir = path, seen = null) => {
  const base = basename(dir)
  const isNM = dir !== path && base === 'node_modules'
  const isScope = dir !== path && !isNM && base.charAt(0) === '@'
  const isParent = dir === path || isNM || isScope

  const rel = relpath(path, dir)
  if (dir !== path) {
    const dirTime = (await stat(dir)).mtime
    if (dirTime > lockTime)
      throw 'out of date, updated: ' + rel
    if (!isScope && !isNM && !data.packages[rel])
      throw 'missing from lockfile: ' + rel
    seen.add(rel)
  } else
    seen = new Set([rel])

  const parent = isParent ? dir : resolve(dir, 'node_modules')
  const children = dir === path
    ? Promise.resolve([{name: 'node_modules', isDirectory: () => true }])
    : readdir(parent, { withFileTypes: true })

  return children.catch(() => [])
    .then(ents => Promise.all(ents.map(async ent => {
      const child = resolve(parent, ent.name)
      if (ent.isDirectory() && !/^\./.test(ent.name))
        await assertNoNewer(path, data, lockTime, child, seen)
      else if (ent.isSymbolicLink()) {
        const target = resolve(parent, await readlink(child))
        const tstat = await stat(target).catch(() => null)
        seen.add(relpath(path, child))
        if (tstat && tstat.isDirectory() && !seen.has(relpath(path, target)))
          await assertNoNewer(path, data, lockTime, target, seen)
      }
    })))
    .then(() => {
      if (dir !== path)
        return

      // assert that all the entries in the lockfile were seen
      for (const loc of new Set(Object.keys(data.packages))) {
        if (!seen.has(loc))
          throw 'missing from node_modules: ' + loc
      }
    })
}

const _awaitingUpdate = Symbol('_awaitingUpdate')
const _updateWaitingNode = Symbol('_updateWaitingNode')
const _lockFromLoc = Symbol('_lockFromLoc')
const _pathToLoc = Symbol('_pathToLoc')
const _loadAll = Symbol('_loadAll')
const _metaFromLock = Symbol('_metaFromLock')
const _resolveMetaNode = Symbol('_resolveMetaNode')
const _fixDependencies = Symbol('_fixDependencies')
const _buildLegacyLockfile = Symbol('_buildLegacyLockfile')
const _filenameSet = Symbol('_filenameSet')
const _maybeRead = Symbol('_maybeRead')
const _maybeStat = Symbol('_maybeStat')
class Shrinkwrap {
  static load (options) {
    return new Shrinkwrap(options).load()
  }

  static get keyOrder () {
    return swKeyOrder
  }

  static reset (options) {
    // still need to know if it was loaded from the disk, but don't
    // bother reading it if we're gonna just throw it away.
    const s = new Shrinkwrap(options)
    s.reset()

    return s[_maybeStat]().then(([sw, lock]) => {
      s.filename = resolve(s.path,
        (s.hiddenLockfile ? 'node_modules/.package-lock'
        : s.shrinkwrapOnly || sw ? 'npm-shrinkwrap'
        : 'package-lock') + '.json')
      s.loadedFromDisk = !!(sw || lock)
      s.type = basename(s.filename)
      return s
    })
  }

  static metaFromNode (node, path) {
    if (node.isLink) {
      return {
        resolved: relpath(path, node.realpath),
        link: true,
      }
    }

    const meta = {}
    pkgMetaKeys.forEach(key => {
      const val = metaFieldFromPkg(node.package, key)
      if (val)
        meta[key.replace(/^_/, '')] = val
    })
    // we only include name if different from the node path name
    const pname = node.packageName
    if (pname && pname !== node.name)
      meta.name = pname

    if (node.isTop && node.package.devDependencies)
      meta.devDependencies = node.package.devDependencies

    nodeMetaKeys.forEach(key => {
      if (node[key])
        meta[key] = node[key]
    })

    const resolved = consistentResolve(node.resolved, node.path, path, true)
    if (resolved)
      meta.resolved = resolved

    if (node.extraneous)
      meta.extraneous = true
    else {
      if (node.peer)
        meta.peer = true
      if (node.dev)
        meta.dev = true
      if (node.optional)
        meta.optional = true
      if (node.devOptional && !node.dev && !node.optional)
        meta.devOptional = true
    }
    return meta
  }

  constructor (options = {}) {
    const {
      path,
      indent = 2,
      newline = '\n',
      shrinkwrapOnly = false,
      hiddenLockfile = false,
      log = procLog,
    } = options

    this.log = log
    this[_awaitingUpdate] = new Map()
    this.tree = null
    this.path = resolve(path || '.')
    this.filename = null
    this.data = null
    this.indent = indent
    this.newline = newline
    this.loadedFromDisk = false
    this.type = null
    this.yarnLock = null
    this.hiddenLockfile = hiddenLockfile
    this.loadingError = null
    // only load npm-shrinkwrap.json in dep trees, not package-lock
    this.shrinkwrapOnly = shrinkwrapOnly
  }

  // check to see if a spec is present in the yarn.lock file, and if so,
  // if we should use it, and what it should resolve to.  This is only
  // done when we did not load a shrinkwrap from disk.  Also, decorate
  // the options object if provided with the resolved and integrity that
  // we expect.
  checkYarnLock (spec, options = {}) {
    spec = npa(spec)
    const { yarnLock, loadedFromDisk } = this
    const useYarnLock = yarnLock && !loadedFromDisk
    const fromYarn = useYarnLock && yarnLock.entries.get(spec.raw)
    if (fromYarn && fromYarn.version) {
      // if it's the yarn or npm default registry, use the version as
      // our effective spec.  if it's any other kind of thing, use that.
      const {resolved, version, integrity} = fromYarn
      const isYarnReg = spec.registry && yarnRegRe.test(resolved)
      const isnpmReg = spec.registry && !isYarnReg && npmRegRe.test(resolved)
      const isReg = isnpmReg || isYarnReg
      // don't use the simple version if the "registry" url is
      // something else entirely!
      const tgz = isReg && versionFromTgz(spec.name, resolved) || {}
      const yspec = tgz.name === spec.name && tgz.version === version ? version
        : isReg && tgz.name && tgz.version ? `npm:${tgz.name}@${tgz.version}`
        : resolved
      if (yspec) {
        options.resolved = resolved.replace(yarnRegRe, 'https://registry.npmjs.org/')
        options.integrity = integrity
        return npa(`${spec.name}@${yspec}`)
      }
    }
    return spec
  }

  // throw away the shrinkwrap data so we can start fresh
  // still worth doing a load() first so we know which files to write.
  reset () {
    this.tree = null
    this[_awaitingUpdate] = new Map()
    this.data = {
      lockfileVersion,
      requires: true,
      packages: {},
      dependencies: {},
    }
  }

  [_filenameSet] () {
    return this.shrinkwrapOnly ? [
      this.path + '/npm-shrinkwrap.json',
    ] : this.hiddenLockfile ? [
      null,
      this.path + '/node_modules/.package-lock.json',
    ] : [
      this.path + '/npm-shrinkwrap.json',
      this.path + '/package-lock.json',
      this.path + '/yarn.lock',
    ]
  }

  [_maybeRead] () {
    return Promise.all(this[_filenameSet]().map(fn => fn && maybeReadFile(fn)))
  }

  [_maybeStat] () {
    // throw away yarn, we only care about lock or shrinkwrap when checking
    // this way, since we're not actually loading the full lock metadata
    return Promise.all(this[_filenameSet]().slice(0, 2)
      .map(fn => fn && maybeStatFile(fn)))
  }

  load () {
    // we don't need to load package-lock.json except for top of tree nodes,
    // only npm-shrinkwrap.json.
    return this[_maybeRead]().then(([sw, lock, yarn]) => {
      const data = sw || lock || ''

      // use shrinkwrap only for deps, otherwise prefer package-lock
      // and ignore npm-shrinkwrap if both are present.
      // TODO: emit a warning here or something if both are present.
      this.filename = resolve(this.path,
        (this.hiddenLockfile ? 'node_modules/.package-lock'
        : this.shrinkwrapOnly || sw ? 'npm-shrinkwrap'
        : 'package-lock') + '.json')

      this.type = basename(this.filename)
      this.loadedFromDisk = !!data

      if (yarn) {
        this.yarnLock = new YarnLock()
        // ignore invalid yarn data.  we'll likely clobber it later anyway.
        try {
          this.yarnLock.parse(yarn)
        } catch (_) {}
      }

      return data ? parseJSON(data) : {}
    }).then(async data => {
      // don't use detect-indent, just pick the first line.
      // if the file starts with {" then we have an indent of '', ie, none
      // which will default to 2 at save time.
      const {
        [Symbol.for('indent')]: indent,
        [Symbol.for('newline')]: newline,
      } = data
      this.indent = indent !== undefined ? indent : this.indent
      this.newline = newline !== undefined ? newline : this.newline

      if (!this.hiddenLockfile || !data.packages)
        return data

      // add a few ms just to account for jitter
      const lockTime = +(await stat(this.filename)).mtime + 10
      await assertNoNewer(this.path, data, lockTime)

      // all good!  hidden lockfile is the newest thing in here.
      return data
    }).catch(er => {
      const rel = relpath(this.path, this.filename)
      this.log.verbose('shrinkwrap', `failed to load ${rel}`, er)
      this.loadingError = er
      this.loadedFromDisk = false
      this.ancientLockfile = false
      return {}
    }).then(lock => {
      this.data = {
        ...lock,
        lockfileVersion,
        requires: true,
        packages: lock.packages || {},
        ...(this.hiddenLockfile ? {} : {dependencies: lock.dependencies || {}}),
      }
      this.originalLockfileVersion = lock.lockfileVersion
      this.ancientLockfile = this.loadedFromDisk &&
        !(lock.lockfileVersion >= 2) && !lock.requires

      // load old lockfile deps into the packages listing
      if (lock.dependencies && !lock.packages) {
        return rpj(this.path + '/package.json').then(pkg => pkg, er => ({}))
          .then(pkg => {
            this[_loadAll]('', null, this.data)
            this[_fixDependencies](pkg)
          })
      }
    })
      .then(() => this)
  }

  [_loadAll] (location, name, lock) {
    // migrate a v1 package lock to the new format.
    const meta = this[_metaFromLock](location, name, lock)
    // dependencies nested under a link are actually under the link target
    if (meta.link)
      location = meta.resolved
    if (lock.dependencies) {
      for (const [name, dep] of Object.entries(lock.dependencies)) {
        const loc = location + (location ? '/' : '') + 'node_modules/' + name
        this[_loadAll](loc, name, dep)
      }
    }
  }

  // v1 lockfiles track the optional/dev flags, but they don't tell us
  // which thing had what kind of dep on what other thing, so we need
  // to correct that now, or every link will be considered prod
  [_fixDependencies] (pkg) {
    // we need the root package.json because legacy shrinkwraps just
    // have requires:true at the root level, which is even less useful
    // than merging all dep types into one object.
    const root = this.data.packages['']
    pkgMetaKeys.forEach(key => {
      const val = metaFieldFromPkg(pkg, key)
      const k = key.replace(/^_/, '')
      if (val)
        root[k] = val
    })

    for (const [loc, meta] of Object.entries(this.data.packages)) {
      if (!meta.requires || !loc)
        continue

      // resolve each require to a meta entry
      // if this node isn't optional, but the dep is, then it's an optionalDep
      // likewise for dev deps.
      // This isn't perfect, but it's a pretty good approximation, and at
      // least gets us out of having all 'prod' edges, which throws off the
      // buildIdealTree process
      for (const [name, spec] of Object.entries(meta.requires)) {
        const dep = this[_resolveMetaNode](loc, name)
        // this overwrites the false value set above
        const depType = dep && dep.optional && !meta.optional
          ? 'optionalDependencies'
          : /* istanbul ignore next - dev deps are only for the root level */
          dep && dep.dev && !meta.dev ? 'devDependencies'
          // also land here if the dep just isn't in the tree, which maybe
          // should be an error, since it means that the shrinkwrap is
          // invalid, but we can't do much better without any info.
          : 'dependencies'
        meta[depType] = meta[depType] || {}
        meta[depType][name] = spec
      }
      delete meta.requires
    }
  }

  [_resolveMetaNode] (loc, name) {
    for (let path = loc; true; path = path.replace(/(^|\/)[^/]*$/, '')) {
      const check = `${path}${path ? '/' : ''}node_modules/${name}`
      if (this.data.packages[check])
        return this.data.packages[check]

      if (!path)
        break
    }
    return null
  }

  [_lockFromLoc] (lock, path, i = 0) {
    if (!lock)
      return null

    if (path[i] === '')
      i++

    if (i >= path.length)
      return lock

    if (!lock.dependencies)
      return null

    return this[_lockFromLoc](lock.dependencies[path[i]], path, i + 1)
  }

  // pass in a path relative to the root path, or an absolute path,
  // get back a /-normalized location based on root path.
  [_pathToLoc] (path) {
    return relpath(this.path, resolve(this.path, path))
  }

  delete (nodePath) {
    if (!this.data)
      throw new Error('run load() before getting or setting data')
    const location = this[_pathToLoc](nodePath)
    this[_awaitingUpdate].delete(location)

    delete this.data.packages[location]
    const path = location.split(/(?:^|\/)node_modules\//)
    const name = path.pop()
    const pLock = this[_lockFromLoc](this.data, path)
    if (pLock && pLock.dependencies)
      delete pLock.dependencies[name]
  }

  get (nodePath) {
    if (!this.data)
      throw new Error('run load() before getting or setting data')

    const location = this[_pathToLoc](nodePath)
    if (this[_awaitingUpdate].has(location))
      this[_updateWaitingNode](location)

    // first try to get from the newer spot, which we know has
    // all the things we need.
    if (this.data.packages[location])
      return this.data.packages[location]

    // otherwise, fall back to the legacy metadata, and hope for the best
    // get the node in the shrinkwrap corresponding to this spot
    const path = location.split(/(?:^|\/)node_modules\//)
    const name = path[path.length - 1]
    const lock = this[_lockFromLoc](this.data, path)

    return this[_metaFromLock](location, name, lock)
  }

  [_metaFromLock] (location, name, lock) {
    // This function tries as hard as it can to figure out the metadata
    // from a lockfile which may be outdated or incomplete.  Since v1
    // lockfiles used the "version" field to contain a variety of
    // different possible types of data, this gets a little complicated.
    if (!lock)
      return {}

    // try to figure out a npm-package-arg spec from the lockfile entry
    // This will return null if we could not get anything valid out of it.
    const spec = specFromLock(name, lock, this.path)

    if (spec.type === 'directory') {
      // the "version" was a file: url to a non-tarball path
      // this is a symlink dep.  We don't store much metadata
      // about symlinks, just the target.
      const target = relpath(this.path, spec.fetchSpec)
      this.data.packages[location] = {
        link: true,
        resolved: target,
      }
      // also save the link target, omitting version since we don't know
      // what it is, but we know it isn't a link to itself!
      if (!this.data.packages[target])
        this[_metaFromLock](target, name, { ...lock, version: null })
      return this.data.packages[location]
    }

    const meta = {}
    // when calling loadAll we'll change these into proper dep objects
    if (lock.requires && typeof lock.requires === 'object')
      meta.requires = lock.requires

    if (lock.optional)
      meta.optional = true
    if (lock.dev)
      meta.dev = true

    // the root will typically have a name from the root project's
    // package.json file.
    if (location === '')
      meta.name = lock.name

    // if we have integrity, save it now.
    if (lock.integrity)
      meta.integrity = lock.integrity

    if (lock.version && !lock.integrity) {
      // this is usually going to be a git url or symlink, but it could
      // also be a registry dependency that did not have integrity at
      // the time it was saved.
      // Symlinks were already handled above, so that leaves git.
      //
      // For git, always save the full SSH url.  we'll actually fetch the
      // tgz most of the time, since it's faster, but it won't work for
      // private repos, and we can't get back to the ssh from the tgz,
      // so we store the ssh instead.
      // For unknown git hosts, just resolve to the raw spec in lock.version
      if (spec.type === 'git') {
        meta.resolved = consistentResolve(spec, this.path, this.path)

        // return early because there is nothing else we can do with this
        return this.data.packages[location] = meta
      } else if (spec.registry) {
        // registry dep that didn't save integrity.  grab the version, and
        // fall through to pick up the resolved and potentially name.
        meta.version = lock.version
      }
      // only other possible case is a tarball without integrity.
      // fall through to do what we can with the filename later.
    }

    // at this point, we know that the spec is either a registry dep
    // (ie, version, because locking, which means a resolved url),
    // or a remote dep, or file: url.  Remote deps and file urls
    // have a fetchSpec equal to the fully resolved thing.
    // Registry deps, we take what's in the lockfile.
    if (lock.resolved || (spec.type && !spec.registry)) {
      if (spec.registry)
        meta.resolved = lock.resolved
      else if (spec.type === 'file')
        meta.resolved = consistentResolve(spec, this.path, this.path, true)
      else if (spec.fetchSpec)
        meta.resolved = spec.fetchSpec
    }

    // at this point, if still we don't have a version, do our best to
    // infer it from the tarball url/file.  This works a surprising
    // amount of the time, even though it's not guaranteed.
    if (!meta.version) {
      if (spec.type === 'file' || spec.type === 'remote') {
        const fromTgz = versionFromTgz(spec.name, spec.fetchSpec) ||
          versionFromTgz(spec.name, meta.resolved)
        if (fromTgz) {
          meta.version = fromTgz.version
          if (fromTgz.name !== name)
            meta.name = fromTgz.name
        }
      } else if (spec.type === 'alias') {
        meta.name = spec.subSpec.name
        meta.version = spec.subSpec.fetchSpec
      } else if (spec.type === 'version')
        meta.version = spec.fetchSpec
      // ok, I did my best!  good luck!
    }

    if (lock.bundled)
      meta.inBundle = true

    // save it for next time
    return this.data.packages[location] = meta
  }

  add (node) {
    if (!this.data)
      throw new Error('run load() before getting or setting data')

    // will be actually updated on read
    const loc = relpath(this.path, node.path)
    if (node.path === this.path)
      this.tree = node

    // if we have metadata about this node, and it's a match, then
    // try to decorate it.
    if (node.resolved === null || node.integrity === null) {
      const {
        resolved,
        integrity,
        hasShrinkwrap,
        version,
      } = this.get(node.path)

      const pathFixed = !resolved ? null
        : !/^file:/.test(resolved) ? resolved
        // resolve onto the metadata path
        : `file:${resolve(this.path, resolved.substr(5))}`

      // if we have one, only set the other if it matches
      // otherwise it could be for a completely different thing.
      const resolvedOk = !resolved || !node.resolved ||
        node.resolved === pathFixed
      const integrityOk = !integrity || !node.integrity ||
        node.integrity === integrity
      const versionOk = !version || !node.version || version === node.version

      const allOk = (resolved || integrity || version) &&
        resolvedOk && integrityOk && versionOk

      if (allOk) {
        node.resolved = node.resolved || pathFixed || null
        node.integrity = node.integrity || integrity || null
        node.hasShrinkwrap = node.hasShrinkwrap || hasShrinkwrap || false
      } else {
        // try to read off the package or node itself
        const {
          resolved,
          integrity,
          hasShrinkwrap,
        } = Shrinkwrap.metaFromNode(node, this.path)
        node.resolved = node.resolved || resolved || null
        node.integrity = node.integrity || integrity || null
        node.hasShrinkwrap = node.hasShrinkwrap || hasShrinkwrap || false
      }
    }
    this[_awaitingUpdate].set(loc, node)
  }

  addEdge (edge) {
    if (!this.yarnLock || !edge.valid)
      return

    const { to: node } = edge

    // if it's already set up, nothing to do
    if (node.resolved !== null && node.integrity !== null)
      return

    // if the yarn lock is empty, nothing to do
    if (!this.yarnLock.entries || !this.yarnLock.entries.size)
      return

    // we relativize the path here because that's how it shows up in the lock
    // XXX how is this different from pathFixed above??
    const pathFixed = !node.resolved ? null
      : !/file:/.test(node.resolved) ? node.resolved
      : consistentResolve(node.resolved, node.path, this.path, true)

    const spec = npa(`${node.name}@${edge.spec}`)
    const entry = this.yarnLock.entries.get(`${node.name}@${edge.spec}`)

    if (!entry ||
        mismatch(node.version, entry.version) ||
        mismatch(node.integrity, entry.integrity) ||
        mismatch(pathFixed, entry.resolved))
      return

    if (entry.resolved && yarnRegRe.test(entry.resolved) && spec.registry)
      entry.resolved = entry.resolved.replace(yarnRegRe, 'https://registry.npmjs.org/')

    node.integrity = node.integrity || entry.integrity || null
    node.resolved = node.resolved ||
      consistentResolve(entry.resolved, this.path, node.path) || null

    this[_awaitingUpdate].set(relpath(this.path, node.path), node)
  }

  [_updateWaitingNode] (loc) {
    const node = this[_awaitingUpdate].get(loc)
    this[_awaitingUpdate].delete(loc)
    this.data.packages[loc] = Shrinkwrap.metaFromNode(node, this.path)
  }

  commit () {
    if (this.tree) {
      if (this.yarnLock)
        this.yarnLock.fromTree(this.tree)
      const root = Shrinkwrap.metaFromNode(this.tree.target || this.tree, this.path)
      this.data.packages = {}
      if (Object.keys(root).length)
        this.data.packages[''] = root
      for (const node of this.tree.root.inventory.values()) {
        // only way this.tree is not root is if the root is a link to it
        if (node === this.tree || node.isRoot || node.location === '')
          continue
        const loc = relpath(this.path, node.path)
        this.data.packages[loc] = Shrinkwrap.metaFromNode(node, this.path)
      }
    } else if (this[_awaitingUpdate].size > 0) {
      for (const loc of this[_awaitingUpdate].keys())
        this[_updateWaitingNode](loc)
    }

    // hidden lockfiles don't include legacy metadata or a root entry
    if (this.hiddenLockfile) {
      delete this.data.packages['']
      delete this.data.dependencies
    } else if (this.tree)
      this[_buildLegacyLockfile](this.tree, this.data)

    return this.data
  }

  [_buildLegacyLockfile] (node, lock, path = []) {
    if (node === this.tree) {
      // the root node
      lock.name = node.packageName || node.name
      if (node.version)
        lock.version = node.version
    }

    // npm v6 and before tracked 'from', meaning "the request that led
    // to this package being installed".  However, that's inherently
    // racey and non-deterministic in a world where deps are deduped
    // ahead of fetch time.  In order to maintain backwards compatibility
    // with v6 in the lockfile, we do this trick where we pick a valid
    // dep link out of the edgesIn set.  Choose the edge with the fewest
    // number of `node_modules` sections in the requestor path, and then
    // lexically sort afterwards.
    const edge = [...node.edgesIn].filter(e => e.valid).sort((a, b) => {
      const aloc = a.from.location.split('node_modules')
      const bloc = b.from.location.split('node_modules')
      /* istanbul ignore next - sort calling order is indeterminate */
      return aloc.length > bloc.length ? 1
        : bloc.length > aloc.length ? -1
        : aloc[aloc.length - 1].localeCompare(bloc[bloc.length - 1], 'en')
    })[0]

    const res = consistentResolve(node.resolved, this.path, this.path, true)
    const rSpec = specFromResolved(res)

    // if we don't have anything (ie, it's extraneous) then use the resolved
    // value as if that was where we got it from, since at least it's true.
    // if we don't have either, just an empty object so nothing matches below.
    // This will effectively just save the version and resolved, as if it's
    // a standard version/range dep, which is a reasonable default.
    const spec = !edge ? rSpec
      : npa.resolve(node.name, edge.spec, edge.from.realpath)

    if (node.target)
      lock.version = `file:${relpath(this.path, node.realpath)}`
    else if (spec && (spec.type === 'file' || spec.type === 'remote'))
      lock.version = spec.saveSpec
    else if (spec && spec.type === 'git' || rSpec.type === 'git') {
      lock.version = node.resolved
      /* istanbul ignore else - don't think there are any cases where a git
       * spec (or indeed, ANY npa spec) doesn't have a .raw member */
      if (spec.raw)
        lock.from = spec.raw
    } else if (!node.isRoot &&
        node.package &&
        node.packageName &&
        node.packageName !== node.name)
      lock.version = `npm:${node.packageName}@${node.version}`
    else if (node.package && node.version)
      lock.version = node.version

    if (node.inDepBundle)
      lock.bundled = true

    // when we didn't resolve to git, file, or dir, and didn't request
    // git, file, dir, or remote, then the resolved value is necessary.
    if (node.resolved &&
        !node.target &&
        rSpec.type !== 'git' &&
        rSpec.type !== 'file' &&
        rSpec.type !== 'directory' &&
        spec.type !== 'directory' &&
        spec.type !== 'git' &&
        spec.type !== 'file' &&
        spec.type !== 'remote')
      lock.resolved = node.resolved

    if (node.integrity)
      lock.integrity = node.integrity

    if (node.extraneous)
      lock.extraneous = true
    else if (!node.isLink) {
      if (node.peer)
        lock.peer = true

      if (node.devOptional && !node.dev && !node.optional)
        lock.devOptional = true

      if (node.dev)
        lock.dev = true

      if (node.optional)
        lock.optional = true
    }

    const depender = node.target || node
    if (depender.edgesOut.size > 0) {
      if (node !== this.tree) {
        lock.requires = [...depender.edgesOut.entries()].reduce((set, [k, v]) => {
          // omit peer deps from legacy lockfile requires field, because
          // npm v6 doesn't handle peer deps, and this triggers some bad
          // behavior if the dep can't be found in the dependencies list.
          const { spec, peer } = v
          if (peer)
            return set
          if (spec.startsWith('file:')) {
            // turn absolute file: paths into relative paths from the node
            // this especially shows up with workspace edges when the root
            // node is also a workspace in the set.
            const p = resolve(node.realpath, spec.substr('file:'.length))
            set[k] = `file:${relpath(node.realpath, p)}`
          } else
            set[k] = spec
          return set
        }, {})
      } else
        lock.requires = true
    }

    // now we walk the children, putting them in the 'dependencies' object
    const {children} = node.target || node
    if (!children.size)
      delete lock.dependencies
    else {
      const kidPath = [...path, node.realpath]
      const dependencies = {}
      // skip any that are already in the descent path, so cyclical link
      // dependencies don't blow up with ELOOP.
      let found = false
      for (const [name, kid] of children.entries()) {
        if (path.includes(kid.realpath))
          continue
        dependencies[name] = this[_buildLegacyLockfile](kid, {}, kidPath)
        found = true
      }
      if (found)
        lock.dependencies = dependencies
    }
    return lock
  }

  save (options = {}) {
    if (!this.data)
      throw new Error('run load() before saving data')

    const { format = true } = options
    const defaultIndent = this.indent || 2
    const indent = format === true ? defaultIndent
      : format || 0
    const eol = format ? this.newline || '\n' : ''
    const data = this.commit()
    const json = stringify(data, swKeyOrder, indent).replace(/\n/g, eol)
    return Promise.all([
      writeFile(this.filename, json).catch(er => {
        if (this.hiddenLockfile) {
          // well, we did our best.
          // if we reify, and there's nothing there, then it might be lacking
          // a node_modules folder, but then the lockfile is not important.
          // Remove the file, so that in case there WERE deps, but we just
          // failed to update the file for some reason, it's not out of sync.
          return rimraf(this.filename)
        }
        throw er
      }),
      this.yarnLock && this.yarnLock.entries.size &&
        writeFile(this.path + '/yarn.lock', this.yarnLock.toString()),
    ])
  }
}

module.exports = Shrinkwrap