@pnpm/deps.graph-builder 1100.0.21 → 1100.0.23

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @pnpm/deps.graph-builder
 
+## 1100.0.23
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/config.package-is-installable@1100.0.14
+  - @pnpm/core-loggers@1100.2.3
+  - @pnpm/fs.symlink-dependency@1100.0.12
+
+## 1100.0.22
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/config.package-is-installable@1100.0.13
+  - @pnpm/core-loggers@1100.2.2
+  - @pnpm/deps.graph-hasher@1100.2.10
+  - @pnpm/deps.path@1100.0.9
+  - @pnpm/fs.symlink-dependency@1100.0.11
+  - @pnpm/hooks.types@1100.2.1
+  - @pnpm/installing.modules-yaml@1100.0.10
+  - @pnpm/lockfile.fs@1100.1.11
+  - @pnpm/lockfile.utils@1100.1.3
+  - @pnpm/patching.config@1100.0.10
+  - @pnpm/store.controller-types@1100.1.8
+  - @pnpm/types@1101.4.0
+
 ## 1100.0.21
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.graph-builder",
-  "version": "1100.0.21",
+  "version": "1100.0.23",
   "description": "A package for building a dependency graph from a lockfile",
   "keywords": [
     "pnpm",
@@ -27,20 +27,20 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.package-is-installable": "1100.0.12",
+    "@pnpm/config.package-is-installable": "1100.0.14",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.2.1",
-    "@pnpm/deps.graph-hasher": "1100.2.9",
-    "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/fs.symlink-dependency": "1100.0.10",
-    "@pnpm/hooks.types": "1100.2.0",
-    "@pnpm/installing.modules-yaml": "1100.0.9",
-    "@pnpm/lockfile.fs": "1100.1.10",
-    "@pnpm/lockfile.utils": "1100.1.2",
-    "@pnpm/patching.config": "1100.0.9",
+    "@pnpm/core-loggers": "1100.2.3",
+    "@pnpm/deps.graph-hasher": "1100.2.10",
+    "@pnpm/deps.path": "1100.0.9",
+    "@pnpm/fs.symlink-dependency": "1100.0.12",
+    "@pnpm/hooks.types": "1100.2.1",
+    "@pnpm/installing.modules-yaml": "1100.0.10",
+    "@pnpm/lockfile.fs": "1100.1.11",
+    "@pnpm/lockfile.utils": "1100.1.3",
+    "@pnpm/patching.config": "1100.0.10",
     "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/store.controller-types": "1100.1.7",
-    "@pnpm/types": "1101.3.2",
+    "@pnpm/store.controller-types": "1100.1.8",
+    "@pnpm/types": "1101.4.0",
     "path-exists": "^5.0.0",
     "ramda": "npm:@pnpm/ramda@0.28.1"
   },
@@ -49,7 +49,7 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.graph-builder": "1100.0.21",
+    "@pnpm/deps.graph-builder": "1100.0.23",
     "@pnpm/logger": "1100.0.0",
     "@types/ramda": "0.31.1"
   },

package/lib/index.d.ts

@@ -1 +0,0 @@
-export * from './lockfileToDepGraph.js';

package/lib/iteratePkgsForVirtualStore.d.ts

@@ -1,16 +0,0 @@
-import { type PkgMetaAndSnapshot } from '@pnpm/deps.graph-hasher';
-import type { LockfileObject } from '@pnpm/lockfile.fs';
-import type { AllowBuild, SupportedArchitectures } from '@pnpm/types';
-interface PkgSnapshotWithLocation {
-    pkgMeta: PkgMetaAndSnapshot;
-    dirInVirtualStore: string;
-}
-export declare function iteratePkgsForVirtualStore(lockfile: LockfileObject, opts: {
-    allowBuild?: AllowBuild;
-    enableGlobalVirtualStore?: boolean;
-    virtualStoreDirMaxLength: number;
-    virtualStoreDir: string;
-    globalVirtualStoreDir: string;
-    supportedArchitectures?: SupportedArchitectures;
-}): IterableIterator<PkgSnapshotWithLocation>;
-export {};

package/lib/iteratePkgsForVirtualStore.js

@@ -1,65 +0,0 @@
-import path from 'node:path';
-import { calcGraphNodeHash, findRuntimeNodeVersion, iterateHashedGraphNodes, iteratePkgMeta, lockfileToDepGraph, } from '@pnpm/deps.graph-hasher';
-import * as dp from '@pnpm/deps.path';
-import { nameVerFromPkgSnapshot, } from '@pnpm/lockfile.utils';
-export function* iteratePkgsForVirtualStore(lockfile, opts) {
-    // Resolve the project's pinned runtime Node version once per
-    // invocation — the result drives every snapshot's GVS hash (or
-    // the side-effects-cache key prefix in the non-GVS runtime
-    // branch). `undefined` when no `engines.runtime` / `devEngines.runtime`
-    // pin reached the lockfile, in which case the hasher falls through
-    // to the host-detected Node.
-    const nodeVersion = findRuntimeNodeVersion(Object.keys(lockfile.packages ?? {}));
-    if (opts.enableGlobalVirtualStore) {
-        for (const { hash, pkgMeta } of hashDependencyPaths(lockfile, {
-            allowBuild: opts.allowBuild,
-            supportedArchitectures: opts.supportedArchitectures,
-            nodeVersion,
-        })) {
-            yield {
-                dirInVirtualStore: path.join(opts.globalVirtualStoreDir, hash),
-                pkgMeta,
-            };
-        }
-    }
-    else if (lockfile.packages) {
-        let graphNodeHashOpts;
-        for (const depPath in lockfile.packages) {
-            if (!Object.hasOwn(lockfile.packages, depPath)) {
-                continue;
-            }
-            const pkgSnapshot = lockfile.packages[depPath];
-            const { name, version } = nameVerFromPkgSnapshot(depPath, pkgSnapshot);
-            const pkgMeta = {
-                depPath: depPath,
-                pkgIdWithPatchHash: dp.getPkgIdWithPatchHash(depPath),
-                name,
-                version,
-                pkgSnapshot,
-            };
-            let dirInVirtualStore;
-            if (dp.isRuntimeDepPath(depPath)) {
-                graphNodeHashOpts ??= {
-                    cache: {},
-                    graph: lockfileToDepGraph(lockfile, opts.supportedArchitectures),
-                    supportedArchitectures: opts.supportedArchitectures,
-                    nodeVersion,
-                };
-                const hash = calcGraphNodeHash(graphNodeHashOpts, pkgMeta);
-                dirInVirtualStore = path.join(opts.globalVirtualStoreDir, hash);
-            }
-            else {
-                dirInVirtualStore = path.join(opts.virtualStoreDir, dp.depPathToFilename(depPath, opts.virtualStoreDirMaxLength));
-            }
-            yield {
-                dirInVirtualStore,
-                pkgMeta,
-            };
-        }
-    }
-}
-function hashDependencyPaths(lockfile, { allowBuild, supportedArchitectures, nodeVersion, }) {
-    const graph = lockfileToDepGraph(lockfile, supportedArchitectures);
-    return iterateHashedGraphNodes(graph, iteratePkgMeta(lockfile, graph), allowBuild, supportedArchitectures, nodeVersion);
-}
-//# sourceMappingURL=iteratePkgsForVirtualStore.js.map

package/lib/lockfileToDepGraph.d.ts

@@ -1,87 +0,0 @@
-import type { IncludedDependencies } from '@pnpm/installing.modules-yaml';
-import type { LockfileObject, LockfileResolution } from '@pnpm/lockfile.fs';
-import { type PatchGroupRecord } from '@pnpm/patching.config';
-import type { PatchInfo } from '@pnpm/patching.types';
-import type { PkgRequestFetchResult, StoreController } from '@pnpm/store.controller-types';
-import type { AllowBuild, DepPath, PkgIdWithPatchHash, ProjectId, Registries, SupportedArchitectures } from '@pnpm/types';
-export interface DependenciesGraphNode {
-    alias?: string;
-    hasBundledDependencies: boolean;
-    modules: string;
-    name: string;
-    version: string;
-    fetching?: () => Promise<PkgRequestFetchResult>;
-    forceImportPackage?: boolean;
-    dir: string;
-    children: Record<string, string>;
-    optionalDependencies: Set<string>;
-    optional: boolean;
-    depPath: DepPath;
-    pkgIdWithPatchHash: PkgIdWithPatchHash;
-    isBuilt?: boolean;
-    requiresBuild?: boolean;
-    hasBin: boolean;
-    filesIndexFile?: string;
-    patch?: PatchInfo;
-    resolution: LockfileResolution;
-}
-export interface DependenciesGraph {
-    [depPath: string]: DependenciesGraphNode;
-}
-export interface LockfileToDepGraphOptions {
-    allowBuild?: AllowBuild;
-    autoInstallPeers: boolean;
-    enableGlobalVirtualStore?: boolean;
-    engineStrict: boolean;
-    force: boolean;
-    importerIds: ProjectId[];
-    include: IncludedDependencies;
-    includeUnchangedDeps?: boolean;
-    ignoreScripts: boolean;
-    /**
-     * When true, skip fetching local dependencies (file: protocol pointing to directories).
-     * This is useful for `pnpm fetch` which only downloads packages from the registry
-     * and doesn't need local packages that won't be available (e.g., in Docker builds).
-     */
-    ignoreLocalPackages?: boolean;
-    lockfileDir: string;
-    nodeVersion: string;
-    pnpmVersion: string;
-    patchedDependencies?: PatchGroupRecord;
-    registries: Registries;
-    sideEffectsCacheRead: boolean;
-    skipped: Set<DepPath>;
-    storeController: StoreController;
-    storeDir: string;
-    globalVirtualStoreDir: string;
-    virtualStoreDir: string;
-    supportedArchitectures?: SupportedArchitectures;
-    virtualStoreDirMaxLength: number;
-}
-export interface DirectDependenciesByImporterId {
-    [importerId: string]: {
-        [alias: string]: string;
-    };
-}
-export interface DepHierarchy {
-    [depPath: string]: Record<string, DepHierarchy>;
-}
-export interface LockfileToDepGraphResult {
-    directDependenciesByImporterId: DirectDependenciesByImporterId;
-    graph: DependenciesGraph;
-    hierarchy?: DepHierarchy;
-    hoistedLocations?: Record<string, string[]>;
-    symlinkedDirectDependenciesByImporterId?: DirectDependenciesByImporterId;
-    prevGraph?: DependenciesGraph;
-    injectionTargetsByDepPath: Map<string, string[]>;
-}
-/**
- * Generate a dependency graph from lockfiles.
- *
- * If a current lockfile is provided, this function only includes new or changed
- * packages in the graph. In other words, the graph returned will be a set
- * subtraction of the packages in the wanted lockfile minus the current
- * lockfile. This behavior can be configured with the `includeUnchangedDeps`
- * option.
- */
-export declare function lockfileToDepGraph(lockfile: LockfileObject, currentLockfile: LockfileObject | null, opts: LockfileToDepGraphOptions): Promise<LockfileToDepGraphResult>;

package/lib/lockfileToDepGraph.js

@@ -1,229 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { packageIsInstallable } from '@pnpm/config.package-is-installable';
-import { WANTED_LOCKFILE } from '@pnpm/constants';
-import { progressLogger, } from '@pnpm/core-loggers';
-import * as dp from '@pnpm/deps.path';
-import { safeJoinModulesDir } from '@pnpm/fs.symlink-dependency';
-import { packageIdFromSnapshot, pkgSnapshotToResolution, } from '@pnpm/lockfile.utils';
-import { logger } from '@pnpm/logger';
-import { getPatchInfo } from '@pnpm/patching.config';
-import { pathExists } from 'path-exists';
-import { equals, isEmpty } from 'ramda';
-import { iteratePkgsForVirtualStore } from './iteratePkgsForVirtualStore.js';
-const brokenModulesLogger = logger('_broken_node_modules');
-/**
- * Generate a dependency graph from lockfiles.
- *
- * If a current lockfile is provided, this function only includes new or changed
- * packages in the graph. In other words, the graph returned will be a set
- * subtraction of the packages in the wanted lockfile minus the current
- * lockfile. This behavior can be configured with the `includeUnchangedDeps`
- * option.
- */
-export async function lockfileToDepGraph(lockfile, currentLockfile, opts) {
-    const { graph, locationByDepPath, injectionTargetsByDepPath, } = await buildGraphFromPackages(lockfile, currentLockfile, opts);
-    const _getChildrenPaths = getChildrenPaths.bind(null, {
-        force: opts.force,
-        graph,
-        lockfileDir: opts.lockfileDir,
-        registries: opts.registries,
-        sideEffectsCacheRead: opts.sideEffectsCacheRead,
-        skipped: opts.skipped,
-        storeController: opts.storeController,
-        storeDir: opts.storeDir,
-        virtualStoreDir: opts.virtualStoreDir,
-        virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
-        locationByDepPath,
-    });
-    for (const node of Object.values(graph)) {
-        const pkgSnapshot = lockfile.packages[node.depPath];
-        const allDeps = {
-            ...pkgSnapshot.dependencies,
-            ...(opts.include.optionalDependencies ? pkgSnapshot.optionalDependencies : {}),
-        };
-        const peerDeps = pkgSnapshot.peerDependencies ? new Set(Object.keys(pkgSnapshot.peerDependencies)) : null;
-        node.children = _getChildrenPaths(allDeps, peerDeps, '.');
-    }
-    const directDependenciesByImporterId = {};
-    for (const importerId of opts.importerIds) {
-        const projectSnapshot = lockfile.importers[importerId];
-        const rootDeps = {
-            ...(opts.include.devDependencies ? projectSnapshot.devDependencies : {}),
-            ...(opts.include.dependencies ? projectSnapshot.dependencies : {}),
-            ...(opts.include.optionalDependencies ? projectSnapshot.optionalDependencies : {}),
-        };
-        directDependenciesByImporterId[importerId] = _getChildrenPaths(rootDeps, null, importerId);
-    }
-    return { graph, directDependenciesByImporterId, injectionTargetsByDepPath };
-}
-async function buildGraphFromPackages(lockfile, currentLockfile, opts) {
-    const currentPackages = currentLockfile?.packages ?? {};
-    const graph = {};
-    const locationByDepPath = {};
-    // Only populated for directory deps (injected workspace packages)
-    const injectionTargetsByDepPath = new Map();
-    const _getPatchInfo = getPatchInfo.bind(null, opts.patchedDependencies);
-    const promises = [];
-    const pkgSnapshotsWithLocations = iteratePkgsForVirtualStore(lockfile, opts);
-    for (const { dirInVirtualStore, pkgMeta } of pkgSnapshotsWithLocations) {
-        promises.push((async () => {
-            const { pkgIdWithPatchHash, name: pkgName, version: pkgVersion, depPath, pkgSnapshot } = pkgMeta;
-            if (opts.skipped.has(depPath))
-                return;
-            const pkg = {
-                name: pkgName,
-                version: pkgVersion,
-                engines: pkgSnapshot.engines,
-                cpu: pkgSnapshot.cpu,
-                os: pkgSnapshot.os,
-                libc: pkgSnapshot.libc,
-            };
-            const packageId = packageIdFromSnapshot(depPath, pkgSnapshot);
-            if (!opts.force && packageIsInstallable(packageId, pkg, {
-                engineStrict: opts.engineStrict,
-                lockfileDir: opts.lockfileDir,
-                nodeVersion: opts.nodeVersion,
-                optional: pkgSnapshot.optional === true,
-                supportedArchitectures: opts.supportedArchitectures,
-            }) === false) {
-                opts.skipped.add(depPath);
-                return;
-            }
-            const isDirectoryDep = 'directory' in pkgSnapshot.resolution && pkgSnapshot.resolution.directory != null;
-            if (isDirectoryDep && opts.ignoreLocalPackages) {
-                logger.info({
-                    message: `Skipping local dependency ${pkgName}@${pkgVersion} (file: protocol)`,
-                    prefix: opts.lockfileDir,
-                });
-                return;
-            }
-            const depIsPresent = !isDirectoryDep &&
-                currentPackages[depPath] &&
-                equals(currentPackages[depPath].dependencies, pkgSnapshot.dependencies);
-            const depIntegrityIsUnchanged = isIntegrityEqual(pkgSnapshot.resolution, currentPackages[depPath]?.resolution);
-            const modules = path.join(dirInVirtualStore, 'node_modules');
-            // `pkgName` is reconstructed from the (attacker-controllable) lockfile
-            // depPath key via `dp.parse`, which does no validation. Contain it here so
-            // a traversal name (e.g. `../../../tmp/x`) can't make the package import
-            // escape the virtual store. Mirrors the guard on the hoisted linker.
-            const dir = safeJoinModulesDir(modules, pkgName);
-            locationByDepPath[depPath] = dir;
-            // Track directory deps for injected workspace packages
-            if (isDirectoryDep) {
-                injectionTargetsByDepPath.set(depPath, [dir]);
-            }
-            // In GVS mode, packages that are allowed to build may have a .pnpm-needs-build
-            // marker indicating a previous build failed or was interrupted. When the
-            // marker is present, skip the fast path to force a re-fetch/re-import/re-build.
-            const mightNeedBuild = opts.enableGlobalVirtualStore &&
-                opts.allowBuild?.(depPath) === true;
-            let dirExists;
-            if (depIsPresent &&
-                depIntegrityIsUnchanged &&
-                isEmpty(currentPackages[depPath].optionalDependencies ?? {}) &&
-                isEmpty(pkgSnapshot.optionalDependencies ?? {}) &&
-                !opts.includeUnchangedDeps) {
-                dirExists = await pathExists(dir);
-                if (dirExists) {
-                    if (!(mightNeedBuild && fs.existsSync(path.join(dir, '.pnpm-needs-build'))))
-                        return;
-                }
-                else {
-                    brokenModulesLogger.debug({ missing: dir });
-                }
-            }
-            let fetchResponse;
-            if (depIsPresent && depIntegrityIsUnchanged && equals(currentPackages[depPath].optionalDependencies, pkgSnapshot.optionalDependencies)) {
-                if (dirExists ?? await pathExists(dir)) {
-                    if (!(mightNeedBuild && fs.existsSync(path.join(dir, '.pnpm-needs-build')))) {
-                        fetchResponse = {};
-                    }
-                }
-                else {
-                    brokenModulesLogger.debug({ missing: dir });
-                }
-            }
-            if (!fetchResponse && opts.enableGlobalVirtualStore && !isDirectoryDep
-                && !opts.force) {
-                if (dirExists ?? await pathExists(dir)) {
-                    if (!(mightNeedBuild && fs.existsSync(path.join(dir, '.pnpm-needs-build')))) {
-                        fetchResponse = {};
-                    }
-                }
-            }
-            if (!fetchResponse) {
-                const resolution = pkgSnapshotToResolution(depPath, pkgSnapshot, opts.registries);
-                progressLogger.debug({ packageId, requester: opts.lockfileDir, status: 'resolved' });
-                try {
-                    fetchResponse = await opts.storeController.fetchPackage({
-                        allowBuild: opts.allowBuild,
-                        force: false,
-                        lockfileDir: opts.lockfileDir,
-                        ignoreScripts: opts.ignoreScripts,
-                        pkg: { name: pkgName, version: pkgVersion, id: packageId, resolution },
-                        supportedArchitectures: opts.supportedArchitectures,
-                    });
-                }
-                catch (err) {
-                    if (pkgSnapshot.optional)
-                        return;
-                    throw err;
-                }
-            }
-            graph[dir] = {
-                children: {},
-                pkgIdWithPatchHash,
-                resolution: pkgSnapshot.resolution,
-                depPath,
-                dir,
-                fetching: fetchResponse.fetching,
-                filesIndexFile: fetchResponse.filesIndexFile,
-                forceImportPackage: !depIntegrityIsUnchanged,
-                hasBin: pkgSnapshot.hasBin === true,
-                hasBundledDependencies: pkgSnapshot.bundledDependencies != null,
-                modules,
-                name: pkgName,
-                version: pkgVersion,
-                optional: !!pkgSnapshot.optional,
-                optionalDependencies: new Set(Object.keys(pkgSnapshot.optionalDependencies ?? {})),
-                patch: _getPatchInfo(pkgName, pkgVersion),
-            };
-        })());
-    }
-    await Promise.all(promises);
-    return { graph, locationByDepPath, injectionTargetsByDepPath };
-}
-function getChildrenPaths(ctx, allDeps, peerDeps, importerId) {
-    const children = {};
-    for (const [alias, ref] of Object.entries(allDeps)) {
-        const childDepPath = dp.refToRelative(ref, alias);
-        if (childDepPath === null) {
-            children[alias] = path.resolve(ctx.lockfileDir, importerId, ref.slice(5));
-            continue;
-        }
-        const childRelDepPath = dp.refToRelative(ref, alias);
-        if (ctx.locationByDepPath[childRelDepPath]) {
-            children[alias] = ctx.locationByDepPath[childRelDepPath];
-        }
-        else if (ctx.graph[childRelDepPath]) {
-            children[alias] = ctx.graph[childRelDepPath].dir;
-        }
-        else if (ref.startsWith('file:')) {
-            children[alias] = path.resolve(ctx.lockfileDir, ref.slice(5));
-        }
-        else if (!ctx.skipped.has(childRelDepPath) && ((peerDeps == null) || !peerDeps.has(alias))) {
-            throw new Error(`${childRelDepPath} not found in ${WANTED_LOCKFILE}`);
-        }
-    }
-    return children;
-}
-function isIntegrityEqual(resolutionA, resolutionB) {
-    // The LockfileResolution type is a union, but it doesn't have a "tag"
-    // field to perform a discriminant match on. Using a type assertion is
-    // required to get the integrity field.
-    const integrityA = resolutionA?.integrity;
-    const integrityB = resolutionB?.integrity;
-    return integrityA === integrityB;
-}
-//# sourceMappingURL=lockfileToDepGraph.js.map