fix: Arborist code cleanup (#7237)

A bunch of tiny tweaks to Arborist, in service of eventually cleaning it up and removing the mixin approach.

Most of the fixes are like before: removing symbols in favor of private attributes so we can easily find where state is being shared. There is also some shuffling of single-use methods into larger classes.

Author: wraithgar

workspaces/arborist/lib/arborist/audit.js

@@ -38,22 +38,15 @@ const resetDepFlags = require('../reset-dep-flags.js')
 // them with unit tests and reuse them across mixins
 const _updateAll = Symbol.for('updateAll')
 const _flagsSuspect = Symbol.for('flagsSuspect')
-const _workspaces = Symbol.for('workspaces')
 const _setWorkspaces = Symbol.for('setWorkspaces')
 const _updateNames = Symbol.for('updateNames')
 const _resolvedAdd = Symbol.for('resolvedAdd')
 const _usePackageLock = Symbol.for('usePackageLock')
 const _rpcache = Symbol.for('realpathCache')
 const _stcache = Symbol.for('statCache')
-const _includeWorkspaceRoot = Symbol.for('includeWorkspaceRoot')
-
-// exposed symbol for unit testing the placeDep method directly
-const _peerSetSource = Symbol.for('peerSetSource')
 
 // used by Reify mixin
-const _force = Symbol.for('force')
-const _global = Symbol.for('global')
-const _idealTreePrune = Symbol.for('idealTreePrune')
+const _addNodeToTrashList = Symbol.for('addNodeToTrashList')
 
 // Push items in, pop them sorted by depth and then path
 // Sorts physically shallower deps up to the front of the queue, because
@@ -117,6 +110,10 @@ module.exports = cls => class IdealTreeBuilder extends cls {
   #loadFailures = new Set()
   #manifests = new Map()
   #mutateTree = false
+  // a map of each module in a peer set to the thing that depended on
+  // that set of peers in the first place.  Use a WeakMap so that we
+  // don't hold onto references for nodes that are garbage collected.
+  #peerSetSource = new WeakMap()
   #preferDedupe = false
   #prune
   #strictPeerDeps
@@ -131,45 +128,33 @@ module.exports = cls => class IdealTreeBuilder extends cls {
 
     const {
       follow = false,
-      force = false,
-      global = false,
       installStrategy = 'hoisted',
       idealTree = null,
-      includeWorkspaceRoot = false,
       installLinks = false,
       legacyPeerDeps = false,
       packageLock = true,
       strictPeerDeps = false,
-      workspaces = [],
+      workspaces,
+      global,
     } = options
 
-    this[_workspaces] = workspaces || []
-    this[_force] = !!force
     this.#strictPeerDeps = !!strictPeerDeps
 
     this.idealTree = idealTree
     this.installLinks = installLinks
     this.legacyPeerDeps = legacyPeerDeps
 
     this[_usePackageLock] = packageLock
-    this[_global] = !!global
     this.#installStrategy = global ? 'shallow' : installStrategy
     this.#follow = !!follow
 
-    if (this[_workspaces].length && this[_global]) {
+    if (workspaces?.length && global) {
       throw new Error('Cannot operate on workspaces in global mode')
     }
 
     this[_updateAll] = false
     this[_updateNames] = []
     this[_resolvedAdd] = []
-
-    // a map of each module in a peer set to the thing that depended on
-    // that set of peers in the first place.  Use a WeakMap so that we
-    // don't hold onto references for nodes that are garbage collected.
-    this[_peerSetSource] = new WeakMap()
-
-    this[_includeWorkspaceRoot] = includeWorkspaceRoot
   }
 
   get explicitRequests () {
@@ -196,7 +181,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
 
     process.emit('time', 'idealTree')
 
-    if (!options.add && !options.rm && !options.update && this[_global]) {
+    if (!options.add && !options.rm && !options.update && this.options.global) {
       throw new Error('global requires add, rm, or update option')
     }
 
@@ -232,7 +217,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     for (const node of this.idealTree.inventory.values()) {
       if (!node.optional) {
         try {
-          checkEngine(node.package, npmVersion, nodeVersion, this[_force])
+          checkEngine(node.package, npmVersion, nodeVersion, this.options.force)
         } catch (err) {
           if (engineStrict) {
             throw err
@@ -243,7 +228,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
             current: err.current,
           })
         }
-        checkPlatform(node.package, this[_force])
+        checkPlatform(node.package, this.options.force)
       }
     }
   }
@@ -295,7 +280,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
   async #initTree () {
     process.emit('time', 'idealTree:init')
     let root
-    if (this[_global]) {
+    if (this.options.global) {
       root = await this.#globalRootNode()
     } else {
       try {
@@ -313,7 +298,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
       // When updating all, we load the shrinkwrap, but don't bother
       // to build out the full virtual tree from it, since we'll be
       // reconstructing it anyway.
-      .then(root => this[_global] ? root
+      .then(root => this.options.global ? root
       : !this[_usePackageLock] || this[_updateAll]
         ? Shrinkwrap.reset({
           path: this.path,
@@ -329,7 +314,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
       // Load on a new Arborist object, so the Nodes aren't the same,
       // or else it'll get super confusing when we change them!
       .then(async root => {
-        if ((!this[_updateAll] && !this[_global] && !root.meta.loadedFromDisk) || (this[_global] && this[_updateNames].length)) {
+        if ((!this[_updateAll] && !this.options.global && !root.meta.loadedFromDisk) || (this.options.global && this[_updateNames].length)) {
           await new this.constructor(this.options).loadActual({ root })
           const tree = root.target
           // even though we didn't load it from a package-lock.json FILE,
@@ -408,7 +393,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
       devOptional: false,
       peer: false,
       optional: false,
-      global: this[_global],
+      global: this.options.global,
       installLinks: this.installLinks,
       legacyPeerDeps: this.legacyPeerDeps,
       loadOverrides: true,
@@ -423,7 +408,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
         devOptional: false,
         peer: false,
         optional: false,
-        global: this[_global],
+        global: this.options.global,
         installLinks: this.installLinks,
         legacyPeerDeps: this.legacyPeerDeps,
         root,
@@ -438,11 +423,11 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     process.emit('time', 'idealTree:userRequests')
     const tree = this.idealTree.target
 
-    if (!this[_workspaces].length) {
+    if (!this.options.workspaces.length) {
       await this.#applyUserRequestsToNode(tree, options)
     } else {
-      const nodes = this.workspaceNodes(tree, this[_workspaces])
-      if (this[_includeWorkspaceRoot]) {
+      const nodes = this.workspaceNodes(tree, this.options.workspaces)
+      if (this.options.includeWorkspaceRoot) {
         nodes.push(tree)
       }
       const appliedRequests = nodes.map(
@@ -458,14 +443,14 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     // If we have a list of package names to update, and we know it's
     // going to update them wherever they are, add any paths into those
     // named nodes to the buildIdealTree queue.
-    if (!this[_global] && this[_updateNames].length) {
+    if (!this.options.global && this[_updateNames].length) {
       this.#queueNamedUpdates()
     }
 
     // global updates only update the globalTop nodes, but we need to know
     // that they're there, and not reinstall the world unnecessarily.
     const globalExplicitUpdateNames = []
-    if (this[_global] && (this[_updateAll] || this[_updateNames].length)) {
+    if (this.options.global && (this[_updateAll] || this[_updateNames].length)) {
       const nm = resolve(this.path, 'node_modules')
       const paths = await readdirScoped(nm).catch(() => [])
       for (const p of paths) {
@@ -510,7 +495,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     // triggers a refresh of all edgesOut.  this has to be done BEFORE
     // adding the edges to explicitRequests, because the package setter
     // resets all edgesOut.
-    if (add && add.length || rm && rm.length || this[_global]) {
+    if (add && add.length || rm && rm.length || this.options.global) {
       tree.package = tree.package
     }
 
@@ -616,7 +601,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     //
     // XXX: how to handle top nodes that aren't the root?  Maybe the report
     // just tells the user to cd into that directory and fix it?
-    if (this[_force] && this.auditReport && this.auditReport.topVulns.size) {
+    if (this.options.force && this.auditReport && this.auditReport.topVulns.size) {
       options.add = options.add || []
       options.rm = options.rm || []
       const nodesTouched = new Set()
@@ -900,7 +885,7 @@ This is a one-time fix-up, please be patient...
     // dep if allowed.
 
     const tasks = []
-    const peerSource = this[_peerSetSource].get(node) || node
+    const peerSource = this.#peerSetSource.get(node) || node
     for (const edge of this.#problemEdges(node)) {
       if (edge.peerConflicted) {
         continue
@@ -958,7 +943,7 @@ This is a one-time fix-up, please be patient...
 
         auditReport: this.auditReport,
         explicitRequest: this.#explicitRequests.has(edge),
-        force: this[_force],
+        force: this.options.force,
         installLinks: this.installLinks,
         installStrategy: this.#installStrategy,
         legacyPeerDeps: this.legacyPeerDeps,
@@ -1099,13 +1084,13 @@ This is a one-time fix-up, please be patient...
 
     // keep track of the thing that caused this node to be included.
     const src = parent.sourceReference
-    this[_peerSetSource].set(node, src)
+    this.#peerSetSource.set(node, src)
 
     // do not load the peers along with the set if this is a global top pkg
     // otherwise we'll be tempted to put peers as other top-level installed
     // things, potentially clobbering what's there already, which is not
     // what we want.  the missing edges will be picked up on the next pass.
-    if (this[_global] && edge.from.isProjectRoot) {
+    if (this.options.global && edge.from.isProjectRoot) {
       return node
     }
 
@@ -1328,7 +1313,7 @@ This is a one-time fix-up, please be patient...
       const parentEdge = node.parent.edgesOut.get(edge.name)
       const { isProjectRoot, isWorkspace } = node.parent.sourceReference
       const isMine = isProjectRoot || isWorkspace
-      const conflictOK = this[_force] || !isMine && !this.#strictPeerDeps
+      const conflictOK = this.options.force || !isMine && !this.#strictPeerDeps
 
       if (!edge.to) {
         if (!parentEdge) {
@@ -1415,7 +1400,7 @@ This is a one-time fix-up, please be patient...
       currentEdge: currentEdge ? currentEdge.explain() : null,
       edge: edge.explain(),
       strictPeerDeps: this.#strictPeerDeps,
-      force: this[_force],
+      force: this.options.force,
     }
   }
 
@@ -1503,7 +1488,7 @@ This is a one-time fix-up, please be patient...
     // otherwise, don't bother.
     const needPrune = metaFromDisk && (mutateTree || flagsSuspect)
     if (this.#prune && needPrune) {
-      this[_idealTreePrune]()
+      this.#idealTreePrune()
       for (const node of this.idealTree.inventory.values()) {
         if (node.extraneous) {
           node.parent = null
@@ -1514,7 +1499,7 @@ This is a one-time fix-up, please be patient...
     process.emit('timeEnd', 'idealTree:fixDepFlags')
   }
 
-  [_idealTreePrune] () {
+  #idealTreePrune () {
     for (const node of this.idealTree.inventory.values()) {
       if (node.extraneous) {
         node.parent = null
@@ -1534,4 +1519,29 @@ This is a one-time fix-up, please be patient...
       }
     }
   }
+
+  async prune (options = {}) {
+    // allow the user to set options on the ctor as well.
+    // XXX: deprecate separate method options objects.
+    options = { ...this.options, ...options }
+
+    await this.buildIdealTree(options)
+
+    this.#idealTreePrune()
+
+    if (!this.options.workspacesEnabled) {
+      const excludeNodes = this.excludeWorkspacesDependencySet(this.idealTree)
+      for (const node of this.idealTree.inventory.values()) {
+        if (
+          node.parent !== null
+          && !node.isProjectRoot
+          && !excludeNodes.has(node)
+        ) {
+          this[_addNodeToTrashList](node)
+        }
+      }
+    }
+
+    return this.reify(options)
+  }
 }

workspaces/arborist/lib/arborist/build-ideal-tree.js

@@ -29,25 +29,25 @@
 const { resolve } = require('path')
 const { homedir } = require('os')
 const { depth } = require('treeverse')
+const mapWorkspaces = require('@npmcli/map-workspaces')
+const log = require('proc-log')
+
 const { saveTypeMap } = require('../add-rm-pkg-deps.js')
+const AuditReport = require('../audit-report.js')
+const relpath = require('../relpath.js')
 
 const mixins = [
   require('../tracker.js'),
-  require('./pruner.js'),
-  require('./deduper.js'),
-  require('./audit.js'),
   require('./build-ideal-tree.js'),
-  require('./set-workspaces.js'),
   require('./load-actual.js'),
   require('./load-virtual.js'),
   require('./rebuild.js'),
   require('./reify.js'),
   require('./isolated-reifier.js'),
 ]
 
-const _workspacesEnabled = Symbol.for('workspacesEnabled')
+const _setWorkspaces = Symbol.for('setWorkspaces')
 const Base = mixins.reduce((a, b) => b(a), require('events'))
-const getWorkspaceNodes = require('../get-workspace-nodes.js')
 
 // if it's 1, 2, or 3, set it explicitly that.
 // if undefined or null, set it null
@@ -72,20 +72,26 @@ class Arborist extends Base {
       nodeVersion: process.version,
       ...options,
       Arborist: this.constructor,
-      path: options.path || '.',
+      binLinks: 'binLinks' in options ? !!options.binLinks : true,
       cache: options.cache || `${homedir()}/.npm/_cacache`,
+      force: !!options.force,
+      global: !!options.global,
+      ignoreScripts: !!options.ignoreScripts,
+      installStrategy: options.global ? 'shallow' : (options.installStrategy ? options.installStrategy : 'hoisted'),
+      lockfileVersion: lockfileVersion(options.lockfileVersion),
       packumentCache: options.packumentCache || new Map(),
-      workspacesEnabled: options.workspacesEnabled !== false,
+      path: options.path || '.',
+      rebuildBundle: 'rebuildBundle' in options ? !!options.rebuildBundle : true,
       replaceRegistryHost: options.replaceRegistryHost,
-      lockfileVersion: lockfileVersion(options.lockfileVersion),
-      installStrategy: options.global ? 'shallow' : (options.installStrategy ? options.installStrategy : 'hoisted'),
+      scriptShell: options.scriptShell,
+      workspaces: options.workspaces || [],
+      workspacesEnabled: options.workspacesEnabled !== false,
     }
+    // TODO is this even used? If not is that a bug?
     this.replaceRegistryHost = this.options.replaceRegistryHost =
       (!this.options.replaceRegistryHost || this.options.replaceRegistryHost === 'npmjs') ?
         'registry.npmjs.org' : this.options.replaceRegistryHost
 
-    this[_workspacesEnabled] = this.options.workspacesEnabled
-
     if (options.saveType && !saveTypeMap.get(options.saveType)) {
       throw new Error(`Invalid saveType ${options.saveType}`)
     }
@@ -97,12 +103,40 @@ class Arborist extends Base {
   // TODO: We should change these to static functions instead
   //   of methods for the next major version
 
-  // returns an array of the actual nodes for all the workspaces
+  // Get the actual nodes corresponding to a root node's child workspaces,
+  // given a list of workspace names.
   workspaceNodes (tree, workspaces) {
-    return getWorkspaceNodes(tree, workspaces)
+    const wsMap = tree.workspaces
+    if (!wsMap) {
+      log.warn('workspaces', 'filter set, but no workspaces present')
+      return []
+    }
+
+    const nodes = []
+    for (const name of workspaces) {
+      const path = wsMap.get(name)
+      if (!path) {
+        log.warn('workspaces', `${name} in filter set, but not in workspaces`)
+        continue
+      }
+
+      const loc = relpath(tree.realpath, path)
+      const node = tree.inventory.get(loc)
+
+      if (!node) {
+        log.warn('workspaces', `${name} in filter set, but no workspace folder present`)
+        continue
+      }
+
+      nodes.push(node)
+    }
+
+    return nodes
   }
 
   // returns a set of workspace nodes and all their deps
+  // TODO why is includeWorkspaceRoot a param?
+  // TODO why is workspaces a param?
   workspaceDependencySet (tree, workspaces, includeWorkspaceRoot) {
     const wsNodes = this.workspaceNodes(tree, workspaces)
     if (includeWorkspaceRoot) {
@@ -162,6 +196,60 @@ class Arborist extends Base {
     })
     return rootDepSet
   }
+
+  async [_setWorkspaces] (node) {
+    const workspaces = await mapWorkspaces({
+      cwd: node.path,
+      pkg: node.package,
+    })
+
+    if (node && workspaces.size) {
+      node.workspaces = workspaces
+    }
+
+    return node
+  }
+
+  async audit (options = {}) {
+    this.addTracker('audit')
+    if (this.options.global) {
+      throw Object.assign(
+        new Error('`npm audit` does not support testing globals'),
+        { code: 'EAUDITGLOBAL' }
+      )
+    }
+
+    // allow the user to set options on the ctor as well.
+    // XXX: deprecate separate method options objects.
+    options = { ...this.options, ...options }
+
+    process.emit('time', 'audit')
+    let tree
+    if (options.packageLock === false) {
+      // build ideal tree
+      await this.loadActual(options)
+      await this.buildIdealTree()
+      tree = this.idealTree
+    } else {
+      tree = await this.loadVirtual()
+    }
+    if (this.options.workspaces.length) {
+      options.filterSet = this.workspaceDependencySet(
+        tree,
+        this.options.workspaces,
+        this.options.includeWorkspaceRoot
+      )
+    }
+    if (!options.workspacesEnabled) {
+      options.filterSet =
+        this.excludeWorkspacesDependencySet(tree)
+    }
+    this.auditReport = await AuditReport.load(tree, options)
+    const ret = options.fix ? this.reify(options) : this.auditReport
+    process.emit('timeEnd', 'audit')
+    this.finishTracker('audit')
+    return ret
+  }
 }
 
 module.exports = Arborist

workspaces/arborist/lib/arborist/deduper.js

@@ -16,7 +16,6 @@ const realpath = require('../realpath.js')
 
 // public symbols
 const _changePath = Symbol.for('_changePath')
-const _global = Symbol.for('global')
 const _setWorkspaces = Symbol.for('setWorkspaces')
 const _rpcache = Symbol.for('realpathCache')
 const _stcache = Symbol.for('statCache')
@@ -45,8 +44,6 @@ module.exports = cls => class ActualLoader extends cls {
   constructor (options) {
     super(options)
 
-    this[_global] = !!options.global
-
     // the tree of nodes on disk
     this.actualTree = options.actualTree
 
@@ -58,6 +55,7 @@ module.exports = cls => class ActualLoader extends cls {
   }
 
   // public method
+  // TODO remove options param in next semver major
   async loadActual (options = {}) {
     // In the past this.actualTree was set as a promise that eventually
     // resolved, and overwrite this.actualTree with the resolved value.  This
@@ -100,7 +98,7 @@ module.exports = cls => class ActualLoader extends cls {
   async #loadActual (options) {
     // mostly realpath to throw if the root doesn't exist
     const {
-      global = false,
+      global,
       filter = () => true,
       root = null,
       transplantFilter = () => true,

workspaces/arborist/lib/arborist/index.js

@@ -19,67 +19,37 @@ const boolEnv = b => b ? '1' : ''
 const sortNodes = (a, b) =>
   (a.depth - b.depth) || localeCompare(a.path, b.path)
 
-const _workspaces = Symbol.for('workspaces')
-const _build = Symbol('build')
-const _loadDefaultNodes = Symbol('loadDefaultNodes')
-const _retrieveNodesByType = Symbol('retrieveNodesByType')
-const _resetQueues = Symbol('resetQueues')
-const _rebuildBundle = Symbol('rebuildBundle')
-const _ignoreScripts = Symbol('ignoreScripts')
-const _binLinks = Symbol('binLinks')
-const _oldMeta = Symbol('oldMeta')
-const _createBinLinks = Symbol('createBinLinks')
-const _doHandleOptionalFailure = Symbol('doHandleOptionalFailure')
-const _linkAllBins = Symbol('linkAllBins')
-const _runScripts = Symbol('runScripts')
-const _buildQueues = Symbol('buildQueues')
-const _addToBuildSet = Symbol('addToBuildSet')
 const _checkBins = Symbol.for('checkBins')
-const _queues = Symbol('queues')
-const _scriptShell = Symbol('scriptShell')
-const _includeWorkspaceRoot = Symbol.for('includeWorkspaceRoot')
-const _workspacesEnabled = Symbol.for('workspacesEnabled')
-
-const _force = Symbol.for('force')
-const _global = Symbol.for('global')
 
 // defined by reify mixin
 const _handleOptionalFailure = Symbol.for('handleOptionalFailure')
 const _trashList = Symbol.for('trashList')
 
 module.exports = cls => class Builder extends cls {
+  #doHandleOptionalFailure
+  #oldMeta = null
+  #queues
+
   constructor (options) {
     super(options)
 
-    const {
-      ignoreScripts = false,
-      scriptShell,
-      binLinks = true,
-      rebuildBundle = true,
-    } = options
-
     this.scriptsRun = new Set()
-    this[_binLinks] = binLinks
-    this[_ignoreScripts] = !!ignoreScripts
-    this[_scriptShell] = scriptShell
-    this[_rebuildBundle] = !!rebuildBundle
-    this[_resetQueues]()
-    this[_oldMeta] = null
+    this.#resetQueues()
   }
 
   async rebuild ({ nodes, handleOptionalFailure = false } = {}) {
     // nothing to do if we're not building anything!
-    if (this[_ignoreScripts] && !this[_binLinks]) {
+    if (this.options.ignoreScripts && !this.options.binLinks) {
       return
     }
 
     // when building for the first time, as part of reify, we ignore
     // failures in optional nodes, and just delete them.  however, when
     // running JUST a rebuild, we treat optional failures as real fails
-    this[_doHandleOptionalFailure] = handleOptionalFailure
+    this.#doHandleOptionalFailure = handleOptionalFailure
 
     if (!nodes) {
-      nodes = await this[_loadDefaultNodes]()
+      nodes = await this.#loadDefaultNodes()
     }
 
     // separates links nodes so that it can run
@@ -89,36 +59,36 @@ module.exports = cls => class Builder extends cls {
     const {
       depNodes,
       linkNodes,
-    } = this[_retrieveNodesByType](nodes)
+    } = this.#retrieveNodesByType(nodes)
 
     // build regular deps
-    await this[_build](depNodes, {})
+    await this.#build(depNodes, {})
 
     // build link deps
     if (linkNodes.size) {
-      this[_resetQueues]()
-      await this[_build](linkNodes, { type: 'links' })
+      this.#resetQueues()
+      await this.#build(linkNodes, { type: 'links' })
     }
 
     process.emit('timeEnd', 'build')
   }
 
   // if we don't have a set of nodes, then just rebuild
   // the actual tree on disk.
-  async [_loadDefaultNodes] () {
+  async #loadDefaultNodes () {
     let nodes
     const tree = await this.loadActual()
     let filterSet
-    if (!this[_workspacesEnabled]) {
+    if (!this.options.workspacesEnabled) {
       filterSet = this.excludeWorkspacesDependencySet(tree)
       nodes = tree.inventory.filter(node =>
         filterSet.has(node) || node.isProjectRoot
       )
-    } else if (this[_workspaces] && this[_workspaces].length) {
+    } else if (this.options.workspaces.length) {
       filterSet = this.workspaceDependencySet(
         tree,
-        this[_workspaces],
-        this[_includeWorkspaceRoot]
+        this.options.workspaces,
+        this.options.includeWorkspaceRoot
       )
       nodes = tree.inventory.filter(node => filterSet.has(node))
     } else {
@@ -127,7 +97,7 @@ module.exports = cls => class Builder extends cls {
     return nodes
   }
 
-  [_retrieveNodesByType] (nodes) {
+  #retrieveNodesByType (nodes) {
     const depNodes = new Set()
     const linkNodes = new Set()
     const storeNodes = new Set()
@@ -154,7 +124,7 @@ module.exports = cls => class Builder extends cls {
     //
     // we avoid doing so if global=true since `bin-links` relies
     // on having the target nodes available in global mode.
-    if (!this[_global]) {
+    if (!this.options.global) {
       for (const node of linkNodes) {
         depNodes.delete(node.target)
       }
@@ -166,8 +136,8 @@ module.exports = cls => class Builder extends cls {
     }
   }
 
-  [_resetQueues] () {
-    this[_queues] = {
+  #resetQueues () {
+    this.#queues = {
       preinstall: [],
       install: [],
       postinstall: [],
@@ -176,46 +146,46 @@ module.exports = cls => class Builder extends cls {
     }
   }
 
-  async [_build] (nodes, { type = 'deps' }) {
+  async #build (nodes, { type = 'deps' }) {
     process.emit('time', `build:${type}`)
 
-    await this[_buildQueues](nodes)
+    await this.#buildQueues(nodes)
 
-    if (!this[_ignoreScripts]) {
-      await this[_runScripts]('preinstall')
+    if (!this.options.ignoreScripts) {
+      await this.#runScripts('preinstall')
     }
 
     // links should run prepare scripts and only link bins after that
     if (type === 'links') {
-      await this[_runScripts]('prepare')
+      await this.#runScripts('prepare')
     }
-    if (this[_binLinks]) {
-      await this[_linkAllBins]()
+    if (this.options.binLinks) {
+      await this.#linkAllBins()
     }
 
-    if (!this[_ignoreScripts]) {
-      await this[_runScripts]('install')
-      await this[_runScripts]('postinstall')
+    if (!this.options.ignoreScripts) {
+      await this.#runScripts('install')
+      await this.#runScripts('postinstall')
     }
 
     process.emit('timeEnd', `build:${type}`)
   }
 
-  async [_buildQueues] (nodes) {
+  async #buildQueues (nodes) {
     process.emit('time', 'build:queue')
     const set = new Set()
 
     const promises = []
     for (const node of nodes) {
-      promises.push(this[_addToBuildSet](node, set))
+      promises.push(this.#addToBuildSet(node, set))
 
       // if it has bundle deps, add those too, if rebuildBundle
-      if (this[_rebuildBundle] !== false) {
+      if (this.options.rebuildBundle !== false) {
         const bd = node.package.bundleDependencies
         if (bd && bd.length) {
           dfwalk({
             tree: node,
-            leave: node => promises.push(this[_addToBuildSet](node, set)),
+            leave: node => promises.push(this.#addToBuildSet(node, set)),
             getChildren: node => [...node.children.values()],
             filter: node => node.inBundle,
           })
@@ -236,7 +206,7 @@ module.exports = cls => class Builder extends cls {
       const tests = { bin, preinstall, install, postinstall, prepare }
       for (const [key, has] of Object.entries(tests)) {
         if (has) {
-          this[_queues][key].push(node)
+          this.#queues[key].push(node)
         }
       }
     }
@@ -249,21 +219,21 @@ module.exports = cls => class Builder extends cls {
     // the node path.  Otherwise a package can have a preinstall script
     // that unlinks something, to allow them to silently overwrite system
     // binaries, which is unsafe and insecure.
-    if (!node.globalTop || this[_force]) {
+    if (!node.globalTop || this.options.force) {
       return
     }
     const { path, package: pkg } = node
     await binLinks.checkBins({ pkg, path, top: true, global: true })
   }
 
-  async [_addToBuildSet] (node, set, refreshed = false) {
+  async #addToBuildSet (node, set, refreshed = false) {
     if (set.has(node)) {
       return
     }
 
-    if (this[_oldMeta] === null) {
+    if (this.#oldMeta === null) {
       const { root: { meta } } = node
-      this[_oldMeta] = meta && meta.loadedFromDisk &&
+      this.#oldMeta = meta && meta.loadedFromDisk &&
         !(meta.originalLockfileVersion >= 2)
     }
 
@@ -272,7 +242,7 @@ module.exports = cls => class Builder extends cls {
 
     const { preinstall, install, postinstall, prepare } = scripts
     const anyScript = preinstall || install || postinstall || prepare
-    if (!refreshed && !anyScript && (hasInstallScript || this[_oldMeta])) {
+    if (!refreshed && !anyScript && (hasInstallScript || this.#oldMeta)) {
       // we either have an old metadata (and thus might have scripts)
       // or we have an indication that there's install scripts (but
       // don't yet know what they are) so we have to load the package.json
@@ -286,7 +256,7 @@ module.exports = cls => class Builder extends cls {
 
       const { scripts = {} } = pkg
       node.package.scripts = scripts
-      return this[_addToBuildSet](node, set, true)
+      return this.#addToBuildSet(node, set, true)
     }
 
     // Rebuild node-gyp dependencies lacking an install or preinstall script
@@ -309,8 +279,8 @@ module.exports = cls => class Builder extends cls {
     }
   }
 
-  async [_runScripts] (event) {
-    const queue = this[_queues][event]
+  async #runScripts (event) {
+    const queue = this.#queues[event]
 
     if (!queue.length) {
       return
@@ -358,7 +328,7 @@ module.exports = cls => class Builder extends cls {
         pkg,
         stdio,
         env,
-        scriptShell: this[_scriptShell],
+        scriptShell: this.options.scriptShell,
       }
       const p = runScript(runOpts).catch(er => {
         const { code, signal } = er
@@ -382,7 +352,7 @@ module.exports = cls => class Builder extends cls {
         log.info('run', pkg._id, event, { code, signal })
       })
 
-      await (this[_doHandleOptionalFailure]
+      await (this.#doHandleOptionalFailure
         ? this[_handleOptionalFailure](node, p)
         : p)
 
@@ -391,8 +361,8 @@ module.exports = cls => class Builder extends cls {
     process.emit('timeEnd', `build:run:${event}`)
   }
 
-  async [_linkAllBins] () {
-    const queue = this[_queues].bin
+  async #linkAllBins () {
+    const queue = this.#queues.bin
     if (!queue.length) {
       return
     }
@@ -402,14 +372,15 @@ module.exports = cls => class Builder extends cls {
     // sort the queue by node path, so that the module-local collision
     // detector in bin-links will always resolve the same way.
     for (const node of queue.sort(sortNodes)) {
-      promises.push(this[_createBinLinks](node))
+      // TODO these run before they're awaited
+      promises.push(this.#createBinLinks(node))
     }
 
     await promiseAllRejectLate(promises)
     process.emit('timeEnd', 'build:link')
   }
 
-  async [_createBinLinks] (node) {
+  async #createBinLinks (node) {
     if (this[_trashList].has(node.path)) {
       return
     }
@@ -420,11 +391,11 @@ module.exports = cls => class Builder extends cls {
       pkg: node.package,
       path: node.path,
       top: !!(node.isTop || node.globalTop),
-      force: this[_force],
+      force: this.options.force,
       global: !!node.globalTop,
     })
 
-    await (this[_doHandleOptionalFailure]
+    await (this.#doHandleOptionalFailure
       ? this[_handleOptionalFailure](node, p)
       : p)
 

workspaces/arborist/lib/arborist/load-actual.js

@@ -24,7 +24,6 @@ const PackageJson = require('@npmcli/package-json')
 const packageContents = require('@npmcli/installed-package-contents')
 const runScript = require('@npmcli/run-script')
 const { checkEngine, checkPlatform } = require('npm-install-checks')
-const _force = Symbol.for('force')
 
 const treeCheck = require('../tree-check.js')
 const relpath = require('../relpath.js')
@@ -48,8 +47,6 @@ const _retireShallowNodes = Symbol.for('retireShallowNodes')
 const _getBundlesByDepth = Symbol('getBundlesByDepth')
 const _registryResolved = Symbol('registryResolved')
 const _addNodeToTrashList = Symbol.for('addNodeToTrashList')
-const _workspaces = Symbol.for('workspaces')
-const _workspacesEnabled = Symbol.for('workspacesEnabled')
 
 // shared by rebuild mixin
 const _trashList = Symbol.for('trashList')
@@ -91,14 +88,11 @@ const _validateNodeModules = Symbol('validateNodeModules')
 const _nmValidated = Symbol('nmValidated')
 const _validatePath = Symbol('validatePath')
 const _reifyPackages = Symbol.for('reifyPackages')
-const _includeWorkspaceRoot = Symbol.for('includeWorkspaceRoot')
 
 const _omitDev = Symbol('omitDev')
 const _omitOptional = Symbol('omitOptional')
 const _omitPeer = Symbol('omitPeer')
 
-const _global = Symbol.for('global')
-
 const _pruneBundledMetadeps = Symbol('pruneBundledMetadeps')
 
 // defined by Ideal mixin
@@ -142,7 +136,7 @@ module.exports = cls => class Reifier extends cls {
   async reify (options = {}) {
     const linked = (options.installStrategy || this.options.installStrategy) === 'linked'
 
-    if (this[_packageLockOnly] && this[_global]) {
+    if (this[_packageLockOnly] && this.options.global) {
       const er = new Error('cannot generate lockfile for global packages')
       er.code = 'ESHRINKWRAPGLOBAL'
       throw er
@@ -287,7 +281,7 @@ module.exports = cls => class Reifier extends cls {
         .then(() => process.emit('timeEnd', 'reify:loadTrees'))
     }
 
-    const actualOpt = this[_global] ? {
+    const actualOpt = this.options.global ? {
       ignoreMissing: true,
       global: true,
       filter: (node, kid) => {
@@ -314,7 +308,7 @@ module.exports = cls => class Reifier extends cls {
       },
     } : { ignoreMissing: true }
 
-    if (!this[_global]) {
+    if (!this.options.global) {
       return Promise.all([
         this.loadActual(actualOpt),
         this.buildIdealTree(bitOpt),
@@ -341,12 +335,12 @@ module.exports = cls => class Reifier extends cls {
     // to just invalidate the parts that changed, but avoid walking the
     // whole tree again.
 
-    const includeWorkspaces = this[_workspacesEnabled]
-    const includeRootDeps = !this[_workspacesEnabled]
-      || this[_includeWorkspaceRoot] && this[_workspaces].length > 0
+    const includeWorkspaces = this.options.workspacesEnabled
+    const includeRootDeps = !includeWorkspaces
+      || this.options.includeWorkspaceRoot && this.options.workspaces.length > 0
 
     const filterNodes = []
-    if (this[_global] && this.explicitRequests.size) {
+    if (this.options.global && this.explicitRequests.size) {
       const idealTree = this.idealTree.target
       const actualTree = this.actualTree.target
       // we ONLY are allowed to make changes in the global top-level
@@ -364,7 +358,7 @@ module.exports = cls => class Reifier extends cls {
     } else {
       if (includeWorkspaces) {
         // add all ws nodes to filterNodes
-        for (const ws of this[_workspaces]) {
+        for (const ws of this.options.workspaces) {
           const ideal = this.idealTree.children.get(ws)
           if (ideal) {
             filterNodes.push(ideal)
@@ -656,7 +650,7 @@ module.exports = cls => class Reifier extends cls {
 
   // do not allow node_modules to be a symlink
   async [_validateNodeModules] (nm) {
-    if (this[_force] || this[_nmValidated].has(nm)) {
+    if (this.options.force || this[_nmValidated].has(nm)) {
       return
     }
     const st = await lstat(nm).catch(() => null)
@@ -992,11 +986,11 @@ module.exports = cls => class Reifier extends cls {
     const tree = this.idealTree
 
     // if we're operating on a workspace, only audit the workspace deps
-    if (this[_workspaces] && this[_workspaces].length) {
+    if (this.options.workspaces.length) {
       options.filterSet = this.workspaceDependencySet(
         tree,
-        this[_workspaces],
-        this[_includeWorkspaceRoot]
+        this.options.workspaces,
+        this.options.includeWorkspaceRoot
       )
     }
 
@@ -1220,7 +1214,7 @@ module.exports = cls => class Reifier extends cls {
     // saveIdealTree to be able to write the lockfile by default.
     const saveIdealTree = !(
       (!save && !hasUpdates)
-      || this[_global]
+      || this.options.global
       || this[_dryRun]
     )
 
@@ -1566,7 +1560,7 @@ module.exports = cls => class Reifier extends cls {
     this.actualTree = this.idealTree
     this.idealTree = null
 
-    if (!this[_global]) {
+    if (!this.options.global) {
       await this.actualTree.meta.save()
       const ignoreScripts = !!this.options.ignoreScripts
       // if we aren't doing a dry run or ignoring scripts and we actually made changes to the dep
@@ -1593,4 +1587,22 @@ module.exports = cls => class Reifier extends cls {
       }
     }
   }
+
+  async dedupe (options = {}) {
+    // allow the user to set options on the ctor as well.
+    // XXX: deprecate separate method options objects.
+    options = { ...this.options, ...options }
+    const tree = await this.loadVirtual().catch(() => this.loadActual())
+    const names = []
+    for (const name of tree.inventory.query('name')) {
+      if (tree.inventory.query('name', name).size > 1) {
+        names.push(name)
+      }
+    }
+    return this.reify({
+      ...options,
+      preferDedupe: true,
+      update: { names },
+    })
+  }
 }

workspaces/arborist/lib/arborist/pruner.js

@@ -2,49 +2,49 @@
 // are case-insensitive and unicode-normalizing, so we need to treat
 // node.children.get('FOO') and node.children.get('foo') as the same thing.
 
-const _keys = Symbol('keys')
-const _normKey = Symbol('normKey')
-const normalize = s => s.normalize('NFKD').toLowerCase()
-const OGMap = Map
-module.exports = class Map extends OGMap {
+module.exports = class CIMap extends Map {
+  #keys = new Map()
+
   constructor (items = []) {
     super()
-    this[_keys] = new OGMap()
     for (const [key, val] of items) {
       this.set(key, val)
     }
   }
 
-  [_normKey] (key) {
-    return typeof key === 'string' ? normalize(key) : key
+  #normKey (key) {
+    if (typeof key !== 'string') {
+      return key
+    }
+    return key.normalize('NFKD').toLowerCase()
   }
 
   get (key) {
-    const normKey = this[_normKey](key)
-    return this[_keys].has(normKey) ? super.get(this[_keys].get(normKey))
+    const normKey = this.#normKey(key)
+    return this.#keys.has(normKey) ? super.get(this.#keys.get(normKey))
       : undefined
   }
 
   set (key, val) {
-    const normKey = this[_normKey](key)
-    if (this[_keys].has(normKey)) {
-      super.delete(this[_keys].get(normKey))
+    const normKey = this.#normKey(key)
+    if (this.#keys.has(normKey)) {
+      super.delete(this.#keys.get(normKey))
     }
-    this[_keys].set(normKey, key)
+    this.#keys.set(normKey, key)
     return super.set(key, val)
   }
 
   delete (key) {
-    const normKey = this[_normKey](key)
-    if (this[_keys].has(normKey)) {
-      const prevKey = this[_keys].get(normKey)
-      this[_keys].delete(normKey)
+    const normKey = this.#normKey(key)
+    if (this.#keys.has(normKey)) {
+      const prevKey = this.#keys.get(normKey)
+      this.#keys.delete(normKey)
       return super.delete(prevKey)
     }
   }
 
   has (key) {
-    const normKey = this[_normKey](key)
-    return this[_keys].has(normKey) && super.has(this[_keys].get(normKey))
+    const normKey = this.#normKey(key)
+    return this.#keys.has(normKey) && super.has(this.#keys.get(normKey))
   }
 }

workspaces/arborist/lib/arborist/rebuild.js

@@ -4,5 +4,3 @@ module.exports.Node = require('./node.js')
 module.exports.Link = require('./link.js')
 module.exports.Edge = require('./edge.js')
 module.exports.Shrinkwrap = require('./shrinkwrap.js')
-// XXX export the other classes, too.  shrinkwrap, diff, etc.
-// they're handy!

workspaces/arborist/lib/arborist/reify.js

@@ -919,8 +919,6 @@ const retrieveNodesFromParsedAst = async (opts) => {
   return results.collect(rootAstNode)
 }
 
-// We are keeping this async in the event that we do add async operators, we
-// won't have to have a breaking change on this function signature.
 const querySelectorAll = async (targetNode, query, flatOptions) => {
   // This never changes ever we just pass it around. But we can't scope it to
   // this whole file if we ever want to support concurrent calls to this

workspaces/arborist/lib/arborist/set-workspaces.js

@@ -1,47 +1,46 @@
-const _progress = Symbol('_progress')
-const _onError = Symbol('_onError')
-const _setProgress = Symbol('_setProgess')
 const npmlog = require('npmlog')
 
 module.exports = cls => class Tracker extends cls {
+  #progress = new Map()
+  #setProgress
+
   constructor (options = {}) {
     super(options)
-    this[_setProgress] = !!options.progress
-    this[_progress] = new Map()
+    this.#setProgress = !!options.progress
   }
 
   addTracker (section, subsection = null, key = null) {
     if (section === null || section === undefined) {
-      this[_onError](`Tracker can't be null or undefined`)
+      this.#onError(`Tracker can't be null or undefined`)
     }
 
     if (key === null) {
       key = subsection
     }
 
-    const hasTracker = this[_progress].has(section)
-    const hasSubtracker = this[_progress].has(`${section}:${key}`)
+    const hasTracker = this.#progress.has(section)
+    const hasSubtracker = this.#progress.has(`${section}:${key}`)
 
     if (hasTracker && subsection === null) {
       // 0. existing tracker, no subsection
-      this[_onError](`Tracker "${section}" already exists`)
+      this.#onError(`Tracker "${section}" already exists`)
     } else if (!hasTracker && subsection === null) {
       // 1. no existing tracker, no subsection
       // Create a new tracker from npmlog
       // starts progress bar
-      if (this[_setProgress] && this[_progress].size === 0) {
+      if (this.#setProgress && this.#progress.size === 0) {
         npmlog.enableProgress()
       }
 
-      this[_progress].set(section, npmlog.newGroup(section))
+      this.#progress.set(section, npmlog.newGroup(section))
     } else if (!hasTracker && subsection !== null) {
       // 2. no parent tracker and subsection
-      this[_onError](`Parent tracker "${section}" does not exist`)
+      this.#onError(`Parent tracker "${section}" does not exist`)
     } else if (!hasTracker || !hasSubtracker) {
       // 3. existing parent tracker, no subsection tracker
-      // Create a new subtracker in this[_progress] from parent tracker
-      this[_progress].set(`${section}:${key}`,
-        this[_progress].get(section).newGroup(`${section}:${subsection}`)
+      // Create a new subtracker in this.#progress from parent tracker
+      this.#progress.set(`${section}:${key}`,
+        this.#progress.get(section).newGroup(`${section}:${subsection}`)
       )
     }
     // 4. existing parent tracker, existing subsection tracker
@@ -50,51 +49,51 @@ module.exports = cls => class Tracker extends cls {
 
   finishTracker (section, subsection = null, key = null) {
     if (section === null || section === undefined) {
-      this[_onError](`Tracker can't be null or undefined`)
+      this.#onError(`Tracker can't be null or undefined`)
     }
 
     if (key === null) {
       key = subsection
     }
 
-    const hasTracker = this[_progress].has(section)
-    const hasSubtracker = this[_progress].has(`${section}:${key}`)
+    const hasTracker = this.#progress.has(section)
+    const hasSubtracker = this.#progress.has(`${section}:${key}`)
 
     // 0. parent tracker exists, no subsection
-    // Finish parent tracker and remove from this[_progress]
+    // Finish parent tracker and remove from this.#progress
     if (hasTracker && subsection === null) {
       // check if parent tracker does
       // not have any remaining children
-      const keys = this[_progress].keys()
+      const keys = this.#progress.keys()
       for (const key of keys) {
         if (key.match(new RegExp(section + ':'))) {
           this.finishTracker(section, key)
         }
       }
 
       // remove parent tracker
-      this[_progress].get(section).finish()
-      this[_progress].delete(section)
+      this.#progress.get(section).finish()
+      this.#progress.delete(section)
 
       // remove progress bar if all
       // trackers are finished
-      if (this[_setProgress] && this[_progress].size === 0) {
+      if (this.#setProgress && this.#progress.size === 0) {
         npmlog.disableProgress()
       }
     } else if (!hasTracker && subsection === null) {
       // 1. no existing parent tracker, no subsection
-      this[_onError](`Tracker "${section}" does not exist`)
+      this.#onError(`Tracker "${section}" does not exist`)
     } else if (!hasTracker || hasSubtracker) {
       // 2. subtracker exists
-      // Finish subtracker and remove from this[_progress]
-      this[_progress].get(`${section}:${key}`).finish()
-      this[_progress].delete(`${section}:${key}`)
+      // Finish subtracker and remove from this.#progress
+      this.#progress.get(`${section}:${key}`).finish()
+      this.#progress.delete(`${section}:${key}`)
     }
     // 3. existing parent tracker, no subsection
   }
 
-  [_onError] (msg) {
-    if (this[_setProgress]) {
+  #onError (msg) {
+    if (this.#setProgress) {
       npmlog.disableProgress()
     }
     throw new Error(msg)

workspaces/arborist/lib/case-insensitive-map.js

@@ -1,22 +1,21 @@
-/* eslint node/no-deprecated-api: "off" */
 const semver = require('semver')
 const { basename } = require('path')
-const { parse } = require('url')
+const { URL } = require('url')
 module.exports = (name, tgz) => {
   const base = basename(tgz)
   if (!base.endsWith('.tgz')) {
     return null
   }
 
-  const u = parse(tgz)
-  if (/^https?:/.test(u.protocol)) {
+  if (tgz.startsWith('http:/') || tgz.startsWith('https:/')) {
+    const u = new URL(tgz)
     // registry url?  check for most likely pattern.
     // either /@foo/bar/-/bar-1.2.3.tgz or
     // /foo/-/foo-1.2.3.tgz, and fall through to
     // basename checking.  Note that registries can
     // be mounted below the root url, so /a/b/-/x/y/foo/-/foo-1.2.3.tgz
     // is a potential option.
-    const tfsplit = u.path.slice(1).split('/-/')
+    const tfsplit = u.pathname.slice(1).split('/-/')
     if (tfsplit.length > 1) {
       const afterTF = tfsplit.pop()
       if (afterTF === base) {

workspaces/arborist/lib/get-workspace-nodes.js

@@ -16,48 +16,42 @@ const semverOpt = { loose: true, includePrerelease: true }
 
 const localeCompare = require('@isaacs/string-locale-compare')('en')
 const npa = require('npm-package-arg')
-const _range = Symbol('_range')
-const _simpleRange = Symbol('_simpleRange')
-const _fixAvailable = Symbol('_fixAvailable')
 
 const severities = new Map([
-  ['info', 0],
-  ['low', 1],
-  ['moderate', 2],
-  ['high', 3],
-  ['critical', 4],
-  [null, -1],
+  ['info', 0], [0, 'info'],
+  ['low', 1], [1, 'low'],
+  ['moderate', 2], [2, 'moderate'],
+  ['high', 3], [3, 'high'],
+  ['critical', 4], [4, 'critical'],
+  [null, -1], [-1, null],
 ])
 
-for (const [name, val] of severities.entries()) {
-  severities.set(val, name)
-}
-
 class Vuln {
+  #range = null
+  #simpleRange = null
+  // assume a fix is available unless it hits a top node
+  // that locks it in place, setting this false or {isSemVerMajor, version}.
+  #fixAvailable = true
+
   constructor ({ name, advisory }) {
     this.name = name
     this.via = new Set()
     this.advisories = new Set()
     this.severity = null
     this.effects = new Set()
     this.topNodes = new Set()
-    this[_range] = null
-    this[_simpleRange] = null
     this.nodes = new Set()
-    // assume a fix is available unless it hits a top node
-    // that locks it in place, setting this false or {isSemVerMajor, version}.
-    this[_fixAvailable] = true
     this.addAdvisory(advisory)
     this.packument = advisory.packument
     this.versions = advisory.versions
   }
 
   get fixAvailable () {
-    return this[_fixAvailable]
+    return this.#fixAvailable
   }
 
   set fixAvailable (f) {
-    this[_fixAvailable] = f
+    this.#fixAvailable = f
     // if there's a fix available for this at the top level, it means that
     // it will also fix the vulns that led to it being there.  to get there,
     // we set the vias to the most "strict" of fix availables.
@@ -131,7 +125,7 @@ class Vuln {
       effects: [...this.effects].map(v => v.name).sort(localeCompare),
       range: this.simpleRange,
       nodes: [...this.nodes].map(n => n.location).sort(localeCompare),
-      fixAvailable: this[_fixAvailable],
+      fixAvailable: this.#fixAvailable,
     }
   }
 
@@ -151,8 +145,8 @@ class Vuln {
     this.advisories.delete(advisory)
     // make sure we have the max severity of all the vulns causing this one
     this.severity = null
-    this[_range] = null
-    this[_simpleRange] = null
+    this.#range = null
+    this.#simpleRange = null
     // refresh severity
     for (const advisory of this.advisories) {
       this.addAdvisory(advisory)
@@ -170,27 +164,30 @@ class Vuln {
   addAdvisory (advisory) {
     this.advisories.add(advisory)
     const sev = severities.get(advisory.severity)
-    this[_range] = null
-    this[_simpleRange] = null
+    this.#range = null
+    this.#simpleRange = null
     if (sev > severities.get(this.severity)) {
       this.severity = advisory.severity
     }
   }
 
   get range () {
-    return this[_range] ||
-      (this[_range] = [...this.advisories].map(v => v.range).join(' || '))
+    if (!this.#range) {
+      this.#range = [...this.advisories].map(v => v.range).join(' || ')
+    }
+    return this.#range
   }
 
   get simpleRange () {
-    if (this[_simpleRange] && this[_simpleRange] === this[_range]) {
-      return this[_simpleRange]
+    if (this.#simpleRange && this.#simpleRange === this.#range) {
+      return this.#simpleRange
     }
 
     const versions = [...this.advisories][0].versions
     const range = this.range
-    const simple = simplifyRange(versions, range, semverOpt)
-    return this[_simpleRange] = this[_range] = simple
+    this.#simpleRange = simplifyRange(versions, range, semverOpt)
+    this.#range = this.#simpleRange
+    return this.#simpleRange
   }
 
   isVulnerable (node) {

workspaces/arborist/lib/index.js

@@ -11,7 +11,7 @@ Link {
   "devOptional": true,
   "dummy": false,
   "edgesIn": Set {},
-  "edgesOut": Map {},
+  "edgesOut": CIMap {},
   "errors": Array [],
   "extraneous": true,
   "fsChildren": Set {},
@@ -41,7 +41,7 @@ exports[`test/link.js TAP > instantiate without providing target 1`] = `
   "devOptional": true,
   "dummy": false,
   "edgesIn": Set {},
-  "edgesOut": Map {},
+  "edgesOut": CIMap {},
   "errors": Array [],
   "extraneous": true,
   "fsChildren": Set {},
@@ -51,12 +51,12 @@ exports[`test/link.js TAP > instantiate without providing target 1`] = `
   "inventory": Inventory {
     "../../../../../some/other/path" => <*ref_1>,
     "" => Node {
-      "children": Map {},
+      "children": CIMap {},
       "dev": true,
       "devOptional": true,
       "dummy": false,
       "edgesIn": Set {},
-      "edgesOut": Map {},
+      "edgesOut": CIMap {},
       "errors": Array [],
       "extraneous": true,
       "fsChildren": Set {},
@@ -95,12 +95,12 @@ exports[`test/link.js TAP > instantiate without providing target 1`] = `
   "sourceReference": null,
   "tops": Set {
     Node {
-      "children": Map {},
+      "children": CIMap {},
       "dev": true,
       "devOptional": true,
       "dummy": false,
       "edgesIn": Set {},
-      "edgesOut": Map {},
+      "edgesOut": CIMap {},
       "errors": Array [],
       "extraneous": true,
       "fsChildren": Set {},

workspaces/arborist/lib/query-selector-all.js

@@ -1,8 +1,8 @@
 const t = require('tap')
-const getWorkspaceNodes = require('../lib/get-workspace-nodes.js')
 const Arborist = require('../lib/arborist/index.js')
 const { resolve } = require('path')
 const path = resolve(__dirname, './fixtures/workspaces-shared-deps-virtual')
+const arb = new Arborist({ path })
 
 const warningTracker = () => {
   const list = []
@@ -16,12 +16,12 @@ const warningTracker = () => {
 
 let tree
 t.before(async () => {
-  tree = await new Arborist({ path }).loadVirtual()
+  tree = await arb.loadVirtual()
 })
 
 t.test('basic behavior', t => {
   const getLogs = warningTracker()
-  const wsNodes = getWorkspaceNodes(tree, ['a'])
+  const wsNodes = arb.workspaceNodes(tree, ['a'])
   t.equal(wsNodes.length, 1)
   t.equal(wsNodes[0], tree.children.get('a').target)
   t.same(getLogs(), [])
@@ -30,7 +30,7 @@ t.test('basic behavior', t => {
 
 t.test('filter set, but no workspaces present', t => {
   const getLogs = warningTracker()
-  const wsNodes = getWorkspaceNodes(tree.children.get('b').target, ['xyz'])
+  const wsNodes = arb.workspaceNodes(tree.children.get('b').target, ['xyz'])
   t.same(wsNodes, [])
   t.same(getLogs(), [
     ['warn', 'workspaces', 'filter set, but no workspaces present'],
@@ -40,7 +40,7 @@ t.test('filter set, but no workspaces present', t => {
 
 t.test('name in filter set, but not in workspaces', t => {
   const getLogs = warningTracker()
-  const wsNodes = getWorkspaceNodes(tree, ['xyz'])
+  const wsNodes = arb.workspaceNodes(tree, ['xyz'])
   t.same(wsNodes, [])
   t.same(getLogs(), [
     ['warn', 'workspaces', 'xyz in filter set, but not in workspaces'],
@@ -55,7 +55,7 @@ t.test('name in filter set, but no workspace folder present', t => {
   // but if we start moving things around and make a mistake, it's
   // possible to get there.
   tree.children.get('c').target.root = null
-  const wsNodes = getWorkspaceNodes(tree, ['c'])
+  const wsNodes = arb.workspaceNodes(tree, ['c'])
   t.same(wsNodes, [])
   t.same(getLogs(), [
     ['warn', 'workspaces', 'c in filter set, but no workspace folder present'],