aube_resolver/
direct_dep_info.rs

1//! Per-direct-dep packument facts the install summary printer surfaces
2//! inline with the `+ name@version` listing — currently deprecation
3//! status and the registry `latest` dist-tag when it differs from the
4//! resolved version. The data has to be snapshotted before the resolver
5//! (which owns the packument cache) is dropped at the end of resolution.
6
7use crate::Resolver;
8use aube_lockfile::LockfileGraph;
9use std::collections::HashMap;
10
11/// Subset of packument facts the install summary printer wants to
12/// render next to a direct-dependency line. Returned only for direct
13/// deps where at least one signal is set — the printer skips the badge
14/// column when [`Resolver::direct_dep_info`]'s map has no entry.
15///
16/// Deprecation is a bare flag (not the message string) by design: the
17/// full per-version `deprecated` text already surfaces via the WARN
18/// pipeline in [`crate::deprecations`][crate-deprecations] above the
19/// summary, so the badge column just signals "this direct dep is one
20/// of the WARN lines you saw" without duplicating the message.
21///
22/// [crate-deprecations]: https://github.com/jdx/aube/blob/main/crates/aube/src/deprecations.rs
23#[derive(Debug, Clone, Default)]
24pub struct DirectDepInfo {
25    /// True when the packument marks the *resolved* version as
26    /// deprecated. The actual message is intentionally not carried
27    /// here — see the struct docs.
28    pub deprecated: bool,
29    /// The registry's `dist-tags.latest` for this package, but only
30    /// when it differs from the resolved version. `None` when latest
31    /// matches the resolved version, when the registry omits `latest`
32    /// (common on private registries), when `latest` points to a
33    /// prerelease (we don't nudge users toward betas), or when the dep
34    /// wasn't resolved from a packument (git / file / link / remote
35    /// tarball).
36    pub latest: Option<String>,
37}
38
39impl Resolver {
40    /// Snapshot per-direct-dep packument facts so the install summary
41    /// printer can render them inline after the resolver — and its
42    /// packument cache — is dropped. Keys are `DirectDep::dep_path`;
43    /// importer direct deps don't carry peer-context suffixes, so the
44    /// key matches the `LockfileGraph.packages` entry 1:1.
45    ///
46    /// Skips deps whose packument wasn't fetched (frozen-lockfile reuse,
47    /// non-registry sources) and deps whose registry didn't publish a
48    /// `latest` dist-tag. Returns only entries where at least one signal
49    /// is set so the caller's printer can use `get(dep_path)` as the
50    /// "should I render badges?" check.
51    pub fn direct_dep_info(&self, graph: &LockfileGraph) -> HashMap<String, DirectDepInfo> {
52        let mut out: HashMap<String, DirectDepInfo> = HashMap::new();
53        for deps in graph.importers.values() {
54            for dep in deps {
55                let Some(pkg) = graph.packages.get(&dep.dep_path) else {
56                    continue;
57                };
58                if pkg.local_source.is_some() {
59                    continue;
60                }
61                let Some(packument) = self.cache.get(pkg.registry_name()) else {
62                    continue;
63                };
64                let deprecated = packument
65                    .versions
66                    .get(&pkg.version)
67                    .is_some_and(|v| v.deprecated.is_some());
68                let latest = packument
69                    .dist_tags
70                    .get("latest")
71                    .filter(|l| l.as_str() != pkg.version.as_str())
72                    .filter(|l| !is_prerelease(l))
73                    .cloned();
74                if deprecated || latest.is_some() {
75                    out.insert(dep.dep_path.clone(), DirectDepInfo { deprecated, latest });
76                }
77            }
78        }
79        out
80    }
81}
82
83/// Whether a version string parses to a semver with a prerelease tag
84/// (e.g. `1.2.0-beta.3`, `2.0.0-rc.1`). Unparseable strings are treated
85/// as non-prerelease so a registry returning a non-semver `latest`
86/// (rare, but possible) still surfaces as an upgrade hint.
87fn is_prerelease(version: &str) -> bool {
88    node_semver::Version::parse(version)
89        .map(|v| !v.pre_release.is_empty())
90        .unwrap_or(false)
91}
92
93#[cfg(test)]
94mod tests {
95    use super::is_prerelease;
96
97    #[test]
98    fn detects_prerelease_versions() {
99        assert!(is_prerelease("1.0.0-beta.1"));
100        assert!(is_prerelease("2.0.0-rc.0"));
101        assert!(is_prerelease("0.1.0-alpha"));
102    }
103
104    #[test]
105    fn stable_versions_are_not_prerelease() {
106        assert!(!is_prerelease("1.0.0"));
107        assert!(!is_prerelease("0.0.1"));
108        assert!(!is_prerelease("not-a-version"));
109    }
110}
aube_resolver/direct_dep_info.rs

aube_resolver/
direct_dep_info.rs
