It would be useful to have events for each resolved package. This would allow the CLI to start immediately downloading packages and maybe partially setup the local node_modules directory.

When a NpmPackageVersionDistInfo doesn't have integrity, we return the integrity based on the shasum variable.
The issue is that the integrity is calculated and then encoded with base64 encoding, although the shasum is shown with a hex representation of the sha1 hash.

I am trying to an npm package that has a dependency antlr4ts@^0.5.0-alpha.4. 0.5.0-alpha.4 is marked as latest, but Deno pulls [email protected].

This doesn't work for me - as [email protected] has breaking changes from [email protected].

I do agree that 0.5.0-dev comes after 0.5.0-alpha.4 - even, node semver confirms this.

$ deno run npm:semver -h
Usage: semver [options] <version> [<version> [...]]
Prints valid versions sorted by SemVer precedence
$ deno run npm:semver ^0.5.0-alpha.4 0.5.0-beta
0.5.0-beta

But somehow pacote (used inside npm) resolves antlr4ts@^0.5.0-alpha.4 to 0.5.0-alpha.4.

$ deno run -A npm:pacote resolve antlr4ts@^0.5.0-alpha.4
http fetch GET 200 https://registry.npmjs.org/antlr4ts 1ms (cache revalidated)
https://registry.npmjs.org/antlr4ts/-/antlr4ts-0.5.0-alpha.4.tgz

So I did some digging and realized that pacote uses npm-pick-manifest, that has a particular logic, which indicates that if a given tag (defaults to latest) matches with the given version requirement, npm uses the tagged version directly - it doesn't iterate over the versions array.

So in my case, npm-pick-manifest was using the default latest tag and matching with ^0.5.0-alpha.4 and returning early. Whereas Deno npm resolver was going through the version array and picking the latest by semver spec i.e. 0.5.0-dev.

The code here is wrong. It should instead select the lowest value copy package for each nv in case there are multiple copy packages. Not a big deal because this scenario is probably super rare and it only leads to more disk space being used in some scenarios.

Having the following imports

import AdminJS from "npm:adminjs";
import AdminJSExpress from "npm:@adminjs/express";
import express from "npm:express";

Deno ends up in an infinite loop. Debug output for the looping part is the following:

DEBUG RS - deno::npm::resolution::graph:1336 - Resolved peer dependency for @tiptap/core in @tiptap/[email protected]_@[email protected]__@[email protected][email protected][email protected][email protected][email protected][email protected][email protected]_@[email protected]__@[email protected]___@[email protected][email protected][email protected][email protected]__@[email protected]___@[email protected]____@[email protected][email protected][email protected][email protected][email protected][email protected][email protected] to @tiptap/[email protected]_@[email protected]__@[email protected][email protected][email protected][email protected]_@[email protected]__@[email protected]___@[email protected][email protected][email protected][email protected][email protected][email protected][email protected]
DEBUG RS - deno::npm::resolution::graph:1336 - Resolved peer dependency for @tiptap/pm in @tiptap/[email protected]_@[email protected]__@[email protected][email protected][email protected][email protected]_@[email protected]__@[email protected]___@[email protected][email protected][email protected][email protected][email protected][email protected][email protected] to @tiptap/[email protected]_@[email protected]__@[email protected][email protected][email protected][email protected][email protected][email protected][email protected]
DEBUG RS - deno::npm::resolution::graph:1336 - Resolved peer dependency for prosemirror-model in [email protected][email protected][email protected][email protected] to [email protected]
DEBUG RS - deno::npm::resolution::graph:1336 - Resolved peer dependency for prosemirror-state in [email protected][email protected][email protected][email protected] to [email protected]
DEBUG RS - deno::npm::resolution::graph:1336 - Resolved peer dependency for prosemirror-view in [email protected][email protected][email protected][email protected] to [email protected]

Using:
deno 1.31.3 (release, aarch64-apple-darwin)
v8 11.0.226.19
typescript 4.9.4

For Deploy and for creating this more easily.

For example:

https://www.npmjs.com/package/@swc/core-linux-arm64-musl?activeTab=code
https://registry.npmjs.org/@swc/core-linux-arm64-musl
https://registry.npmjs.org/@swc/core-linux-arm64-gnu