@pnpm/deps.graph-hasher 1100.2.11 → 1100.2.13

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @pnpm/calc-dep-state
 
+## 1100.2.13
+
+### Patch Changes
+
+- Installing a local `file:` directory dependency with the global virtual store enabled no longer fails with `TypeError: Cannot read properties of undefined (reading 'split')` [#13335](https://github.com/pnpm/pnpm/issues/13335).
+
+  Local directory dependencies — `file:` directories and injected workspace packages — now get a global-virtual-store slot of their own per project. They used to share one slot across every project that depended on a directory of the same name, so a project could end up linked to another project's copy of the dependency.
+
+- Updated dependencies:
+  - @pnpm/deps.path@1100.0.12
+  - @pnpm/engine.runtime.system-version@1100.0.7
+  - @pnpm/lockfile.types@1100.0.17
+  - @pnpm/lockfile.utils@1100.1.6
+  - @pnpm/resolving.resolver-base@1100.5.5
+  - @pnpm/types@1101.7.0
+
+## 1100.2.12
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/crypto.object-hasher@1100.0.1
+  - @pnpm/deps.path@1100.0.11
+  - @pnpm/engine.runtime.system-version@1100.0.6
+  - @pnpm/lockfile.types@1100.0.16
+  - @pnpm/lockfile.utils@1100.1.5
+  - @pnpm/resolving.resolver-base@1100.5.4
+  - @pnpm/types@1101.6.0
+
 ## 1100.2.11
 
 ### Patch Changes

package/lib/index.d.ts

@@ -0,0 +1,131 @@
+import type { LockfileObject, LockfileResolution, PackageSnapshot } from '@pnpm/lockfile.types';
+import type { AllowBuild, DepPath, PkgIdWithPatchHash, SupportedArchitectures } from '@pnpm/types';
+/**
+ * Scan an iterable of lockfile snapshot keys for the resolved
+ * `engines.runtime` / `devEngines.runtime` Node version and return
+ * its bare version string (e.g. `"22.11.0"`), or `undefined` when
+ * no snapshot pins a runtime.
+ *
+ * Pnpm's runtime resolver writes the pinned Node into the lockfile as
+ * a snapshot with key `node@runtime:<version>[(<peers>)]`
+ * (see [`engine/runtime/node-resolver/src/index.ts`](https://github.com/pnpm/pnpm/blob/29a42efc3b/engine/runtime/node-resolver/src/index.ts)).
+ * The first such key found is treated as authoritative. This is fine
+ * as an install-wide fallback (project-pin in the typical case), but
+ * snapshots that pin their own Node still need
+ * {@link readSnapshotRuntimePin} to get a per-snapshot result.
+ *
+ * Callers typically pass `Object.keys(lockfile.packages ?? {})` — the
+ * in-memory `LockfileObject` merges the on-disk `packages:` and
+ * `snapshots:` sections under a single `packages` field, so its keys
+ * include every snapshot key the install will hash.
+ */
+export declare function findRuntimeNodeVersion(snapshotKeys: Iterable<string>): string | undefined;
+/**
+ * Read a single graph node's own `engines.runtime` Node pin from its
+ * `children` map. The resolver desugars `engines.runtime` declared on
+ * a dependency's manifest into `dependencies.node: 'runtime:<version>'`
+ * (see [`installing/deps-resolver/src/resolveDependencies.ts`](https://github.com/pnpm/pnpm/blob/29a42efc3b/installing/deps-resolver/src/resolveDependencies.ts)),
+ * which then becomes a `children.node` entry pointing at the
+ * `node@runtime:<version>[(peers)]` snapshot key.
+ *
+ * Returns the bare version (e.g. `"22.11.0"`) when this snapshot pins
+ * its own Node — or `undefined` when it doesn't and the caller should
+ * fall back to the install-wide pin / host probe.
+ *
+ * Per-snapshot resolution matters because the bin linker routes
+ * lifecycle-script spawns for a pinning package through *that
+ * package's* downloaded Node — anchoring the snapshot's GVS engine
+ * hash to an install-wide value would produce the wrong
+ * side-effects-cache key for cross-pinning installs.
+ */
+export declare function readSnapshotRuntimePin(children: Record<string, string> | undefined): string | undefined;
+export type DepsGraph<T extends string> = Record<T, DepsGraphNode<T>>;
+export interface DepsGraphNode<T extends string> {
+    children: {
+        [alias: string]: T;
+    };
+    pkgIdWithPatchHash?: PkgIdWithPatchHash;
+    resolution?: LockfileResolution;
+    fullPkgId?: string;
+}
+export interface DepsStateCache {
+    [depPath: string]: string;
+}
+export declare function calcDepState<T extends string>(depsGraph: DepsGraph<T>, cache: DepsStateCache, depPath: string, opts: {
+    patchFileHash?: string;
+    includeDepGraphHash: boolean;
+    supportedArchitectures?: SupportedArchitectures;
+    /**
+     * Install-wide fallback `engines.runtime` / `devEngines.runtime`
+     * Node version (e.g. `"22.11.0"`). Used only when the snapshot at
+     * `depPath` doesn't itself pin a Node: per-snapshot pins take
+     * precedence so the side-effects-cache key reflects the actual
+     * script-runner Node the bin linker would spawn for the package
+     * (see {@link readSnapshotRuntimePin}). Typically computed once
+     * per install via {@link findRuntimeNodeVersion} over the
+     * lockfile's snapshot keys.
+     */
+    nodeVersion?: string;
+}): string;
+export interface PkgMeta {
+    depPath: DepPath;
+    name: string;
+    version: string;
+}
+export type PkgMetaIterator<T extends PkgMeta> = IterableIterator<T>;
+export interface HashedDepPath<T extends PkgMeta> {
+    pkgMeta: T;
+    hash: string;
+}
+export interface GraphNodeHashOptions {
+    allowBuild?: AllowBuild;
+    supportedArchitectures?: SupportedArchitectures;
+    /**
+     * Install-wide fallback `engines.runtime` / `devEngines.runtime`
+     * Node version. Used only for snapshots that don't pin their own
+     * Node; pinning snapshots get resolved per-snapshot via
+     * {@link readSnapshotRuntimePin} so the GVS engine hash matches
+     * the Node the bin linker would actually spawn for each package
+     * (see [`bins/linker/src/index.ts`](https://github.com/pnpm/pnpm/blob/29a42efc3b/bins/linker/src/index.ts)).
+     * Typically obtained via {@link findRuntimeNodeVersion} over the
+     * lockfile's snapshot keys. `undefined` falls back to
+     * {@link engineName}'s default (system `node --version`, with
+     * `process.version` as a last resort).
+     */
+    nodeVersion?: string;
+    /**
+     * Directory the lockfile lives in. Scopes the slots of local directory
+     * dependencies to the project that owns them — see
+     * {@link isLocalDirectoryResolution}. Omitting it leaves those packages on a
+     * shared slot, which is only safe for a lockfile known to have no directory
+     * dependencies.
+     */
+    lockfileDir?: string;
+}
+export declare function iterateHashedGraphNodes<T extends PkgMeta>(graph: DepsGraph<DepPath>, pkgMetaIterator: PkgMetaIterator<T>, opts?: GraphNodeHashOptions): IterableIterator<HashedDepPath<T>>;
+export declare function calcGraphNodeHash<T extends PkgMeta>({ graph, cache, builtDepPaths, buildRequiredCache, supportedArchitectures, nodeVersion, lockfileDir }: {
+    graph: DepsGraph<DepPath>;
+    cache: DepsStateCache;
+    builtDepPaths?: Set<DepPath>;
+    buildRequiredCache?: Record<string, boolean>;
+    supportedArchitectures?: SupportedArchitectures;
+    /** See {@link GraphNodeHashOptions.nodeVersion}. */
+    nodeVersion?: string;
+    /** See {@link GraphNodeHashOptions.lockfileDir}. */
+    lockfileDir?: string;
+}, pkgMeta: T): string;
+export declare function calcLeafGlobalVirtualStorePath(fullPkgId: string, name: string, version: string): string;
+/**
+ * `subdepIds` maps each direct child's alias to its full pkg id
+ * (`${name}@${version}:${integrity}`). Each child contributes a leaf hash
+ * (no transitive walk) to the parent's hash, so the resulting path differs
+ * whenever the set or versions of children change. One level deep only —
+ * use {@link calcGraphNodeHash} when full graph traversal is needed.
+ */
+export declare function calcGlobalVirtualStorePathWithSubdeps(fullPkgId: string, name: string, version: string, subdepIds: Record<string, string>): string;
+export interface PkgMetaAndSnapshot extends PkgMeta {
+    pkgSnapshot: PackageSnapshot;
+    pkgIdWithPatchHash: PkgIdWithPatchHash;
+}
+export declare function iteratePkgMeta(lockfile: LockfileObject, graph: DepsGraph<DepPath>): PkgMetaIterator<PkgMetaAndSnapshot>;
+export declare function lockfileToDepGraph(lockfile: LockfileObject, supportedArchitectures?: SupportedArchitectures): DepsGraph<DepPath>;

package/lib/index.js

@@ -113,25 +113,12 @@ function calcDepGraphHash(depsGraph, cache, parents, depPath, supportedArchitect
     });
     return cache[depPath];
 }
-export function* iterateHashedGraphNodes(graph, pkgMetaIterator, allowBuild, supportedArchitectures, 
-/**
- * Install-wide fallback `engines.runtime` / `devEngines.runtime`
- * Node version. Used only for snapshots that don't pin their own
- * Node; pinning snapshots get resolved per-snapshot via
- * {@link readSnapshotRuntimePin} so the GVS engine hash matches
- * the Node the bin linker would actually spawn for each package
- * (see [`bins/linker/src/index.ts`](https://github.com/pnpm/pnpm/blob/29a42efc3b/bins/linker/src/index.ts)).
- * Typically obtained via {@link findRuntimeNodeVersion} over the
- * lockfile's snapshot keys. `undefined` falls back to
- * {@link engineName}'s default (system `node --version`, with
- * `process.version` as a last resort).
- */
-nodeVersion) {
+export function* iterateHashedGraphNodes(graph, pkgMetaIterator, opts = {}) {
     let builtDepPaths;
     let entries;
-    if (allowBuild != null) {
+    if (opts.allowBuild != null) {
         const pkgMetaList = Array.from(pkgMetaIterator);
-        builtDepPaths = computeBuiltDepPaths(pkgMetaList, allowBuild);
+        builtDepPaths = computeBuiltDepPaths(pkgMetaList, opts.allowBuild);
         entries = pkgMetaList;
     }
     else {
@@ -142,8 +129,9 @@ nodeVersion) {
         cache: {},
         builtDepPaths,
         buildRequiredCache: builtDepPaths !== undefined ? {} : undefined,
-        supportedArchitectures,
-        nodeVersion,
+        supportedArchitectures: opts.supportedArchitectures,
+        nodeVersion: opts.nodeVersion,
+        lockfileDir: opts.lockfileDir,
     };
     for (const pkgMeta of entries) {
         yield {
@@ -152,7 +140,7 @@ nodeVersion) {
         };
     }
 }
-export function calcGraphNodeHash({ graph, cache, builtDepPaths, buildRequiredCache, supportedArchitectures, nodeVersion }, pkgMeta) {
+export function calcGraphNodeHash({ graph, cache, builtDepPaths, buildRequiredCache, supportedArchitectures, nodeVersion, lockfileDir }, pkgMeta) {
     const { name, version, depPath } = pkgMeta;
     // When builtDepPaths is provided (derived from the allowBuilds config),
     // we only include the engine name for packages that are allowed to build
@@ -169,8 +157,39 @@ export function calcGraphNodeHash({ graph, cache, builtDepPaths, buildRequiredCa
     const ownPin = readSnapshotRuntimePin(graph[depPath]?.children);
     const engine = includeEngine ? engineName(ownPin ?? nodeVersion) : null;
     const deps = calcDepGraphHash(graph, cache, new Set(), depPath, supportedArchitectures);
-    const hexDigest = hashObjectWithoutSorting({ engine, deps }, { encoding: 'hex' });
-    return formatGlobalVirtualStorePath(name, version, hexDigest);
+    const isLocalDirectory = isLocalDirectoryResolution(graph[depPath]?.resolution);
+    // Scoping the slot needs the project's identity; the segment only needs to
+    // know that the package is a local directory, so a caller that leaves
+    // `lockfileDir` out still gets a well-formed path.
+    const project = isLocalDirectory ? lockfileDir : undefined;
+    const hexDigest = project == null
+        ? hashObjectWithoutSorting({ engine, deps }, { encoding: 'hex' })
+        : hashObjectWithoutSorting({ engine, deps, project }, { encoding: 'hex' });
+    return formatGlobalVirtualStorePath(name, isLocalDirectory ? LOCAL_DIRECTORY_SEGMENT : version, hexDigest);
+}
+/**
+ * Slot segment that stands in for the version of a package resolved from a
+ * local directory. pnpm omits the version from a directory snapshot, so the
+ * lockfile has none to offer — and the resolver, which does know it from the
+ * manifest, must agree with the lockfile or a re-install would relocate the
+ * package. The segment is decoration in a store listing; the digest that
+ * follows it is what identifies the slot.
+ */
+const LOCAL_DIRECTORY_SEGMENT = 'directory';
+/**
+ * Whether the package came from a local directory — a `file:` directory
+ * dependency or an injected workspace package.
+ *
+ * Such a package needs a slot of its own per project. A directory resolution is
+ * the one resolution with no integrity: it is a path relative to the lockfile,
+ * so `file:dep` hashes identically in every project that happens to depend on a
+ * directory of that name. Sharing the slot would hand one project the files of
+ * whichever project installed first, and because the source directory is
+ * mutable pnpm re-imports it on every install — so the projects would go on
+ * overwriting each other's dependency.
+ */
+function isLocalDirectoryResolution(resolution) {
+    return resolution != null && 'type' in resolution && resolution.type === 'directory';
 }
 export function calcLeafGlobalVirtualStorePath(fullPkgId, name, version) {
     const depsHash = hashObject({ id: fullPkgId, deps: {} });
@@ -244,6 +263,7 @@ export function lockfileToDepGraph(lockfile, supportedArchitectures) {
             });
             graph[depPath] = {
                 children,
+                resolution: pkgSnapshot.resolution,
                 fullPkgId: createFullPkgId(getPkgIdWithPatchHash(depPath), pkgSnapshot.resolution, supportedArchitectures),
             };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.graph-hasher",
-  "version": "1100.2.11",
+  "version": "1100.2.13",
   "description": "Calculates the state of a dependency",
   "keywords": [
     "pnpm",
@@ -27,18 +27,18 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/crypto.object-hasher": "1100.0.0",
-    "@pnpm/deps.path": "1100.0.10",
-    "@pnpm/engine.runtime.system-version": "1100.0.5",
-    "@pnpm/lockfile.types": "1100.0.15",
-    "@pnpm/lockfile.utils": "1100.1.4",
-    "@pnpm/resolving.resolver-base": "1100.5.3",
-    "@pnpm/types": "1101.5.0",
+    "@pnpm/crypto.object-hasher": "1100.0.1",
+    "@pnpm/deps.path": "1100.0.12",
+    "@pnpm/engine.runtime.system-version": "1100.0.7",
+    "@pnpm/lockfile.types": "1100.0.17",
+    "@pnpm/lockfile.utils": "1100.1.6",
+    "@pnpm/resolving.resolver-base": "1100.5.5",
+    "@pnpm/types": "1101.7.0",
     "detect-libc": "^2.1.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.graph-hasher": "1100.2.11"
+    "@pnpm/deps.graph-hasher": "1100.2.13"
   },
   "engines": {
     "node": ">=22.13"