chore: fix dependencies script for circular workspace deps

Author: wraithgar

DEPENDENCIES.json

@@ -2,15 +2,10 @@
  [
  "npm"
  ],
- [
- "@npmcli/smoke-tests",
- "libnpmaccess",
- "libnpmexec",
- "libnpmpublish"
- ],
  [
  "@npmcli/mock-registry",
  "libnpmdiff",
+ "libnpmexec",
  "libnpmfund",
  "libnpmpack"
  ],
@@ -28,7 +23,9 @@
  [
  "@npmcli/map-workspaces",
  "@npmcli/run-script",
+ "libnpmaccess",
  "libnpmorg",
+ "libnpmpublish",
  "libnpmsearch",
  "libnpmteam",
  "init-package-json",
@@ -50,6 +47,7 @@
  ],
  [
  "@npmcli/docs",
+ "@npmcli/smoke-tests",
  "@npmcli/fs",
  "npm-bundled",
  "npm-install-checks",

DEPENDENCIES.md

@@ -166,6 +166,7 @@ graph LR;
  npmcli-arborist-->npmcli-installed-package-contents["@npmcli/installed-package-contents"];
  npmcli-arborist-->npmcli-map-workspaces["@npmcli/map-workspaces"];
  npmcli-arborist-->npmcli-metavuln-calculator["@npmcli/metavuln-calculator"];
+ npmcli-arborist-->npmcli-mock-registry["@npmcli/mock-registry"];
  npmcli-arborist-->npmcli-name-from-folder["@npmcli/name-from-folder"];
  npmcli-arborist-->npmcli-node-gyp["@npmcli/node-gyp"];
  npmcli-arborist-->npmcli-package-json["@npmcli/package-json"];
@@ -578,6 +579,7 @@ graph LR;
  npmcli-arborist-->npmcli-installed-package-contents["@npmcli/installed-package-contents"];
  npmcli-arborist-->npmcli-map-workspaces["@npmcli/map-workspaces"];
  npmcli-arborist-->npmcli-metavuln-calculator["@npmcli/metavuln-calculator"];
+ npmcli-arborist-->npmcli-mock-registry["@npmcli/mock-registry"];
  npmcli-arborist-->npmcli-name-from-folder["@npmcli/name-from-folder"];
  npmcli-arborist-->npmcli-node-gyp["@npmcli/node-gyp"];
  npmcli-arborist-->npmcli-package-json["@npmcli/package-json"];
@@ -777,14 +779,13 @@ Each group depends on packages lower down the chain, nothing depends on
 packages higher up the chain.
 
  - npm
- - @npmcli/smoke-tests, libnpmaccess, libnpmexec, libnpmpublish
- - @npmcli/mock-registry, libnpmdiff, libnpmfund, libnpmpack
+ - @npmcli/mock-registry, libnpmdiff, libnpmexec, libnpmfund, libnpmpack
  - @npmcli/arborist
  - @npmcli/metavuln-calculator
  - pacote, @npmcli/config, libnpmversion
- - @npmcli/map-workspaces, @npmcli/run-script, libnpmorg, libnpmsearch, libnpmteam, init-package-json, npm-profile
+ - @npmcli/map-workspaces, @npmcli/run-script, libnpmaccess, libnpmorg, libnpmpublish, libnpmsearch, libnpmteam, init-package-json, npm-profile
  - @npmcli/package-json, npm-registry-fetch
  - @npmcli/git, make-fetch-happen
  - @npmcli/installed-package-contents, npm-pick-manifest, cacache, promzard
- - @npmcli/docs, @npmcli/fs, npm-bundled, npm-install-checks, npm-package-arg, normalize-package-data, unique-filename, npm-packlist, bin-links, nopt, parse-conflict-json, read-package-json-fast, @npmcli/mock-globals, read
+ - @npmcli/docs, @npmcli/smoke-tests, @npmcli/fs, npm-bundled, npm-install-checks, npm-package-arg, normalize-package-data, unique-filename, npm-packlist, bin-links, nopt, parse-conflict-json, read-package-json-fast, @npmcli/mock-globals, read
  - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, @npmcli/promise-spawn, ini, hosted-git-info, proc-log, validate-npm-package-name, json-parse-even-better-errors, fs-minipass, ssri, unique-slug, @npmcli/node-gyp, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate

scripts/dependency-graph.js

@@ -11,6 +11,31 @@ const { run, CWD, pkg, fs, EOL } = require('./util.js')
 // npx -p @npmcli/stafftools gh repos --json | json -a name | sort > scripts/npm-cli-repos.txt
 const repos = readFileSync(join(CWD, 'scripts', 'npm-cli-repos.txt'), 'utf-8').trim().split(os.EOL)
 
+// Packages with known circular dependencies. This is typically something with arborist as a dependency which is also in arborist's dev dependencies. Not a problem if they're workspaces so we ignore repeats
+const circular = new Set(['@npmcli/mock-registry'])
+
+// TODO Set.intersection/difference was added in node 22.11.0, once we're above that line we can use the builtin
+// https://node.green/#ES2025-features-Set-methods-Set-prototype-intersection--
+function intersection (set1, set2) {
+ const result = new Set()
+ for (const item of set1) {
+ if (set2.has(item)) {
+ result.add(item)
+ }
+ }
+ return result
+}
+
+function difference (set1, set2) {
+ const result = new Set()
+ for (const item of set1) {
+ if (!set2.has(item)) {
+ result.add(item)
+ }
+ }
+ return result
+}
+
 // these have a different package name than the repo name, and are ours.
 const aliases = {
  semver: 'node-semver',
@@ -29,6 +54,7 @@ const namespaced = [
  'git',
  'installed-package-contents',
  'lint',
+ 'mock-registry',
  'map-workspaces',
  'metavuln-calculator',
  'move-file',
@@ -140,7 +166,11 @@ const walk = function (tree, onlyOurs) {
  log.silly(dep, '::', [...dependedBy[dep]].join(', '))
  log.silly('-'.repeat(80))
 
- if (!dependedBy[dep].size) {
+ // things that depend on us that are at the same level
+ const both = intersection(allDeps, dependedBy[dep])
+ // ... minus the known circular dependencies
+ const neither = difference(both, circular)
+ if (!dependedBy[dep].size || !neither.size) {
  level.push(dep)
  foundDeps.add(dep)
  }
@@ -177,9 +207,7 @@ const iterate = function (node, dependedBy, annotations, onlyOurs) {
  dependedBy[node.packageName] = new Set()
  }
  for (const [name, edge] of node.edgesOut) {
- if (
- (!onlyOurs || isOurs(name)) && !node.dev
- ) {
+ if ((!onlyOurs || isOurs(name)) && !node.dev) {
  if (!dependedBy[node.packageName].has(edge.name)) {
  dependedBy[node.packageName].add(edge.name)
  annotations.push(` ${stripName(node.packageName)}-->${escapeName(edge.name)};`)