@pnpm/deps.graph-hasher 1100.2.12 → 1100.2.13

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @pnpm/calc-dep-state
 
+## 1100.2.13
+
+### Patch Changes
+
+- Installing a local `file:` directory dependency with the global virtual store enabled no longer fails with `TypeError: Cannot read properties of undefined (reading 'split')` [#13335](https://github.com/pnpm/pnpm/issues/13335).
+
+  Local directory dependencies — `file:` directories and injected workspace packages — now get a global-virtual-store slot of their own per project. They used to share one slot across every project that depended on a directory of the same name, so a project could end up linked to another project's copy of the dependency.
+
+- Updated dependencies:
+  - @pnpm/deps.path@1100.0.12
+  - @pnpm/engine.runtime.system-version@1100.0.7
+  - @pnpm/lockfile.types@1100.0.17
+  - @pnpm/lockfile.utils@1100.1.6
+  - @pnpm/resolving.resolver-base@1100.5.5
+  - @pnpm/types@1101.7.0
+
 ## 1100.2.12
 
 ### Patch Changes

package/lib/index.d.ts

@@ -77,28 +77,42 @@ export interface HashedDepPath<T extends PkgMeta> {
     pkgMeta: T;
     hash: string;
 }
-export declare function iterateHashedGraphNodes<T extends PkgMeta>(graph: DepsGraph<DepPath>, pkgMetaIterator: PkgMetaIterator<T>, allowBuild?: AllowBuild, supportedArchitectures?: SupportedArchitectures, 
-/**
- * Install-wide fallback `engines.runtime` / `devEngines.runtime`
- * Node version. Used only for snapshots that don't pin their own
- * Node; pinning snapshots get resolved per-snapshot via
- * {@link readSnapshotRuntimePin} so the GVS engine hash matches
- * the Node the bin linker would actually spawn for each package
- * (see [`bins/linker/src/index.ts`](https://github.com/pnpm/pnpm/blob/29a42efc3b/bins/linker/src/index.ts)).
- * Typically obtained via {@link findRuntimeNodeVersion} over the
- * lockfile's snapshot keys. `undefined` falls back to
- * {@link engineName}'s default (system `node --version`, with
- * `process.version` as a last resort).
- */
-nodeVersion?: string): IterableIterator<HashedDepPath<T>>;
-export declare function calcGraphNodeHash<T extends PkgMeta>({ graph, cache, builtDepPaths, buildRequiredCache, supportedArchitectures, nodeVersion }: {
+export interface GraphNodeHashOptions {
+    allowBuild?: AllowBuild;
+    supportedArchitectures?: SupportedArchitectures;
+    /**
+     * Install-wide fallback `engines.runtime` / `devEngines.runtime`
+     * Node version. Used only for snapshots that don't pin their own
+     * Node; pinning snapshots get resolved per-snapshot via
+     * {@link readSnapshotRuntimePin} so the GVS engine hash matches
+     * the Node the bin linker would actually spawn for each package
+     * (see [`bins/linker/src/index.ts`](https://github.com/pnpm/pnpm/blob/29a42efc3b/bins/linker/src/index.ts)).
+     * Typically obtained via {@link findRuntimeNodeVersion} over the
+     * lockfile's snapshot keys. `undefined` falls back to
+     * {@link engineName}'s default (system `node --version`, with
+     * `process.version` as a last resort).
+     */
+    nodeVersion?: string;
+    /**
+     * Directory the lockfile lives in. Scopes the slots of local directory
+     * dependencies to the project that owns them — see
+     * {@link isLocalDirectoryResolution}. Omitting it leaves those packages on a
+     * shared slot, which is only safe for a lockfile known to have no directory
+     * dependencies.
+     */
+    lockfileDir?: string;
+}
+export declare function iterateHashedGraphNodes<T extends PkgMeta>(graph: DepsGraph<DepPath>, pkgMetaIterator: PkgMetaIterator<T>, opts?: GraphNodeHashOptions): IterableIterator<HashedDepPath<T>>;
+export declare function calcGraphNodeHash<T extends PkgMeta>({ graph, cache, builtDepPaths, buildRequiredCache, supportedArchitectures, nodeVersion, lockfileDir }: {
     graph: DepsGraph<DepPath>;
     cache: DepsStateCache;
     builtDepPaths?: Set<DepPath>;
     buildRequiredCache?: Record<string, boolean>;
     supportedArchitectures?: SupportedArchitectures;
-    /** See [`iterateHashedGraphNodes`]'s `nodeVersion` parameter. */
+    /** See {@link GraphNodeHashOptions.nodeVersion}. */
     nodeVersion?: string;
+    /** See {@link GraphNodeHashOptions.lockfileDir}. */
+    lockfileDir?: string;
 }, pkgMeta: T): string;
 export declare function calcLeafGlobalVirtualStorePath(fullPkgId: string, name: string, version: string): string;
 /**

package/lib/index.js

@@ -113,25 +113,12 @@ function calcDepGraphHash(depsGraph, cache, parents, depPath, supportedArchitect
     });
     return cache[depPath];
 }
-export function* iterateHashedGraphNodes(graph, pkgMetaIterator, allowBuild, supportedArchitectures, 
-/**
- * Install-wide fallback `engines.runtime` / `devEngines.runtime`
- * Node version. Used only for snapshots that don't pin their own
- * Node; pinning snapshots get resolved per-snapshot via
- * {@link readSnapshotRuntimePin} so the GVS engine hash matches
- * the Node the bin linker would actually spawn for each package
- * (see [`bins/linker/src/index.ts`](https://github.com/pnpm/pnpm/blob/29a42efc3b/bins/linker/src/index.ts)).
- * Typically obtained via {@link findRuntimeNodeVersion} over the
- * lockfile's snapshot keys. `undefined` falls back to
- * {@link engineName}'s default (system `node --version`, with
- * `process.version` as a last resort).
- */
-nodeVersion) {
+export function* iterateHashedGraphNodes(graph, pkgMetaIterator, opts = {}) {
     let builtDepPaths;
     let entries;
-    if (allowBuild != null) {
+    if (opts.allowBuild != null) {
         const pkgMetaList = Array.from(pkgMetaIterator);
-        builtDepPaths = computeBuiltDepPaths(pkgMetaList, allowBuild);
+        builtDepPaths = computeBuiltDepPaths(pkgMetaList, opts.allowBuild);
         entries = pkgMetaList;
     }
     else {
@@ -142,8 +129,9 @@ nodeVersion) {
         cache: {},
         builtDepPaths,
         buildRequiredCache: builtDepPaths !== undefined ? {} : undefined,
-        supportedArchitectures,
-        nodeVersion,
+        supportedArchitectures: opts.supportedArchitectures,
+        nodeVersion: opts.nodeVersion,
+        lockfileDir: opts.lockfileDir,
     };
     for (const pkgMeta of entries) {
         yield {
@@ -152,7 +140,7 @@ nodeVersion) {
         };
     }
 }
-export function calcGraphNodeHash({ graph, cache, builtDepPaths, buildRequiredCache, supportedArchitectures, nodeVersion }, pkgMeta) {
+export function calcGraphNodeHash({ graph, cache, builtDepPaths, buildRequiredCache, supportedArchitectures, nodeVersion, lockfileDir }, pkgMeta) {
     const { name, version, depPath } = pkgMeta;
     // When builtDepPaths is provided (derived from the allowBuilds config),
     // we only include the engine name for packages that are allowed to build
@@ -169,8 +157,39 @@ export function calcGraphNodeHash({ graph, cache, builtDepPaths, buildRequiredCa
     const ownPin = readSnapshotRuntimePin(graph[depPath]?.children);
     const engine = includeEngine ? engineName(ownPin ?? nodeVersion) : null;
     const deps = calcDepGraphHash(graph, cache, new Set(), depPath, supportedArchitectures);
-    const hexDigest = hashObjectWithoutSorting({ engine, deps }, { encoding: 'hex' });
-    return formatGlobalVirtualStorePath(name, version, hexDigest);
+    const isLocalDirectory = isLocalDirectoryResolution(graph[depPath]?.resolution);
+    // Scoping the slot needs the project's identity; the segment only needs to
+    // know that the package is a local directory, so a caller that leaves
+    // `lockfileDir` out still gets a well-formed path.
+    const project = isLocalDirectory ? lockfileDir : undefined;
+    const hexDigest = project == null
+        ? hashObjectWithoutSorting({ engine, deps }, { encoding: 'hex' })
+        : hashObjectWithoutSorting({ engine, deps, project }, { encoding: 'hex' });
+    return formatGlobalVirtualStorePath(name, isLocalDirectory ? LOCAL_DIRECTORY_SEGMENT : version, hexDigest);
+}
+/**
+ * Slot segment that stands in for the version of a package resolved from a
+ * local directory. pnpm omits the version from a directory snapshot, so the
+ * lockfile has none to offer — and the resolver, which does know it from the
+ * manifest, must agree with the lockfile or a re-install would relocate the
+ * package. The segment is decoration in a store listing; the digest that
+ * follows it is what identifies the slot.
+ */
+const LOCAL_DIRECTORY_SEGMENT = 'directory';
+/**
+ * Whether the package came from a local directory — a `file:` directory
+ * dependency or an injected workspace package.
+ *
+ * Such a package needs a slot of its own per project. A directory resolution is
+ * the one resolution with no integrity: it is a path relative to the lockfile,
+ * so `file:dep` hashes identically in every project that happens to depend on a
+ * directory of that name. Sharing the slot would hand one project the files of
+ * whichever project installed first, and because the source directory is
+ * mutable pnpm re-imports it on every install — so the projects would go on
+ * overwriting each other's dependency.
+ */
+function isLocalDirectoryResolution(resolution) {
+    return resolution != null && 'type' in resolution && resolution.type === 'directory';
 }
 export function calcLeafGlobalVirtualStorePath(fullPkgId, name, version) {
     const depsHash = hashObject({ id: fullPkgId, deps: {} });
@@ -244,6 +263,7 @@ export function lockfileToDepGraph(lockfile, supportedArchitectures) {
             });
             graph[depPath] = {
                 children,
+                resolution: pkgSnapshot.resolution,
                 fullPkgId: createFullPkgId(getPkgIdWithPatchHash(depPath), pkgSnapshot.resolution, supportedArchitectures),
             };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.graph-hasher",
-  "version": "1100.2.12",
+  "version": "1100.2.13",
   "description": "Calculates the state of a dependency",
   "keywords": [
     "pnpm",
@@ -28,17 +28,17 @@
   ],
   "dependencies": {
     "@pnpm/crypto.object-hasher": "1100.0.1",
-    "@pnpm/deps.path": "1100.0.11",
-    "@pnpm/engine.runtime.system-version": "1100.0.6",
-    "@pnpm/lockfile.types": "1100.0.16",
-    "@pnpm/lockfile.utils": "1100.1.5",
-    "@pnpm/resolving.resolver-base": "1100.5.4",
-    "@pnpm/types": "1101.6.0",
+    "@pnpm/deps.path": "1100.0.12",
+    "@pnpm/engine.runtime.system-version": "1100.0.7",
+    "@pnpm/lockfile.types": "1100.0.17",
+    "@pnpm/lockfile.utils": "1100.1.6",
+    "@pnpm/resolving.resolver-base": "1100.5.5",
+    "@pnpm/types": "1101.7.0",
     "detect-libc": "^2.1.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.graph-hasher": "1100.2.12"
+    "@pnpm/deps.graph-hasher": "1100.2.13"
   },
   "engines": {
     "node": ">=22.13"