(node)
| 100 | } |
| 101 | |
| 102 | const resolvedSourceSpecs = (node) => { |
| 103 | const specs = [] |
| 104 | const seen = new Set() |
| 105 | const add = (spec) => { |
| 106 | if (typeof spec !== 'string' || spec === '' || seen.has(spec)) { |
| 107 | return |
| 108 | } |
| 109 | seen.add(spec) |
| 110 | specs.push(spec) |
| 111 | } |
| 112 | |
| 113 | add(node?.resolved) |
| 114 | |
| 115 | if (!node?.resolved && node?.linksIn && typeof node.linksIn[Symbol.iterator] === 'function') { |
| 116 | let hasIncomingLink = false |
| 117 | for (const link of node.linksIn) { |
| 118 | hasIncomingLink = true |
| 119 | add(link.resolved) |
| 120 | } |
| 121 | |
| 122 | if (hasIncomingLink) { |
| 123 | // Link targets for local directory deps are separate inventory nodes |
| 124 | // whose own `resolved` is null. The incoming Link carries the saved spec |
| 125 | // (for example `file:../pkg`, relative to node_modules), while policy |
| 126 | // entries written by hand often use the dependency spec from package.json |
| 127 | // (for example `file:pkg`, resolved by npa to this target path). Include |
| 128 | // the real target paths so both forms can match the same local dep. |
| 129 | add(node.realpath) |
| 130 | add(node.path) |
| 131 | } |
| 132 | } |
| 133 | |
| 134 | return specs |
| 135 | } |
| 136 | |
| 137 | const matchRegistry = (node, parsed, failClosed) => { |
| 138 | // If this node is not a registry dep, refuse the match. A registry-style |
no test coverage detected