@pnpm/deps.graph-hasher 1100.2.18 → 1100.3.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @pnpm/calc-dep-state
 
+## 1100.3.0
+
+### Minor Changes
+
+- Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally.
+
+  Configure it with the new `remoteSideEffectsCache` setting. A workspace names the eligible `organization` and `packages`; everything describing the act of signing — `publish`, `keyId`, `builderId`, `trustedKeys`, `privateKey` and the provenance fields — is refused in `pnpm-workspace.yaml` and read from the global config file or the environment instead.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/deps.path@1101.0.1
+  - @pnpm/engine.runtime.system-version@1100.0.11
+  - @pnpm/lockfile.types@1100.1.0
+  - @pnpm/lockfile.utils@1102.1.0
+  - @pnpm/resolving.resolver-base@1101.2.0
+  - @pnpm/types@1102.1.0
+
 ## 1100.2.18
 
 ### Patch Changes

package/lib/index.d.ts

@@ -51,6 +51,31 @@ export interface DepsGraphNode<T extends string> {
 export interface DepsStateCache {
     [depPath: string]: string;
 }
+export declare const DEPENDENCY_SIDE_EFFECTS_INPUT_KEY_PREFIX = "dependency-side-effects:v1:";
+export interface CalcDepStateInputKeyOptions<T extends string> {
+    depsGraph: DepsGraph<T>;
+    depPath: T;
+    patchFileHash?: string;
+    supportedArchitectures?: SupportedArchitectures;
+}
+/**
+ * Compute the machine-independent lookup key for a remotely shareable
+ * dependency build.
+ *
+ * `depsGraph` must contain `depPath`, and every reachable node must provide
+ * either `fullPkgId` or the resolution metadata needed to derive it. The
+ * function does not mutate the graph or caller state. Each call uses an
+ * isolated cache, so the result is independent of earlier roots and platform
+ * selections.
+ *
+ * The returned key starts with {@link DEPENDENCY_SIDE_EFFECTS_INPUT_KEY_PREFIX},
+ * followed by the recursive dependency-graph hash and, when non-empty, the
+ * patch-file hash. Host identity is excluded and advertised by the artifact's
+ * signed compatibility constraints. When a resolution contains platform
+ * variations, `supportedArchitectures` selects the source integrity included
+ * in the graph hash.
+ */
+export declare function calcDepStateInputKey<T extends string>(opts: CalcDepStateInputKeyOptions<T>): string;
 export declare function calcDepState<T extends string>(depsGraph: DepsGraph<T>, cache: DepsStateCache, depPath: string, opts: {
     patchFileHash?: string;
     includeDepGraphHash: boolean;

package/lib/index.js

@@ -71,11 +71,52 @@ export function readSnapshotRuntimePin(children) {
     const ref = children?.node;
     return ref != null ? extractRuntimeNodeVersion(ref) : undefined;
 }
+export const DEPENDENCY_SIDE_EFFECTS_INPUT_KEY_PREFIX = 'dependency-side-effects:v1:';
+/**
+ * Compute the machine-independent lookup key for a remotely shareable
+ * dependency build.
+ *
+ * `depsGraph` must contain `depPath`, and every reachable node must provide
+ * either `fullPkgId` or the resolution metadata needed to derive it. The
+ * function does not mutate the graph or caller state. Each call uses an
+ * isolated cache, so the result is independent of earlier roots and platform
+ * selections.
+ *
+ * The returned key starts with {@link DEPENDENCY_SIDE_EFFECTS_INPUT_KEY_PREFIX},
+ * followed by the recursive dependency-graph hash and, when non-empty, the
+ * patch-file hash. Host identity is excluded and advertised by the artifact's
+ * signed compatibility constraints. When a resolution contains platform
+ * variations, `supportedArchitectures` selects the source integrity included
+ * in the graph hash.
+ */
+export function calcDepStateInputKey(opts) {
+    if (opts.depsGraph[opts.depPath] == null) {
+        throw new Error(`Dependency side-effects input-key root ${opts.depPath} is not present in depsGraph`);
+    }
+    const depGraphHash = calcDepGraphHash({
+        depsGraph: opts.depsGraph,
+        cache: {},
+        parents: new Set(),
+        depPath: opts.depPath,
+        context: createDepGraphHashContext(opts.supportedArchitectures),
+    });
+    let result = `${DEPENDENCY_SIDE_EFFECTS_INPUT_KEY_PREFIX}deps=${depGraphHash}`;
+    if (opts.patchFileHash) {
+        result += `;patch=${opts.patchFileHash}`;
+    }
+    return result;
+}
 export function calcDepState(depsGraph, cache, depPath, opts) {
     const ownPin = readSnapshotRuntimePin(depsGraph[depPath]?.children);
     let result = engineName(ownPin ?? opts.nodeVersion);
     if (opts.includeDepGraphHash) {
-        const depGraphHash = calcDepGraphHash(depsGraph, cache, new Set(), depPath, opts.supportedArchitectures);
+        const depGraphHash = calcDepGraphHash({
+            depsGraph,
+            cache,
+            parents: new Set(),
+            depPath: depPath,
+            context: createDepGraphHashContext(opts.supportedArchitectures),
+        });
         result += `;deps=${depGraphHash}`;
     }
     if (opts.patchFileHash) {
@@ -83,36 +124,47 @@ export function calcDepState(depsGraph, cache, depPath, opts) {
     }
     return result;
 }
-function calcDepGraphHash(depsGraph, cache, parents, depPath, supportedArchitectures) {
-    if (cache[depPath])
-        return cache[depPath];
+function calcDepGraphHash({ depsGraph, cache, parents, depPath, context, }) {
+    const cacheKey = `${context.cacheKeyPrefix}${depPath}`;
+    if (cache[cacheKey])
+        return cache[cacheKey];
     const node = depsGraph[depPath];
     if (!node)
         return '';
-    if (!node.fullPkgId) {
-        if (!node.pkgIdWithPatchHash) {
-            throw new Error(`pkgIdWithPatchHash is not defined for ${depPath} in depsGraph`);
-        }
-        if (!node.resolution) {
-            throw new Error(`resolution is not defined for ${depPath} in depsGraph`);
-        }
-        node.fullPkgId = createFullPkgId(node.pkgIdWithPatchHash, node.resolution, supportedArchitectures);
+    let fullPkgId = node.fullPkgId;
+    if (node.pkgIdWithPatchHash != null && node.resolution != null) {
+        fullPkgId = createFullPkgId(node.pkgIdWithPatchHash, node.resolution, context.supportedArchitectures);
+    }
+    else if (fullPkgId == null) {
+        throw new Error(`fullPkgId or resolution metadata is not defined for ${depPath} in depsGraph`);
     }
     const deps = {};
-    if (Object.keys(node.children).length && !parents.has(node.fullPkgId)) {
-        const nextParents = new Set([...Array.from(parents), node.fullPkgId]);
+    if (Object.keys(node.children).length && !parents.has(fullPkgId)) {
+        const nextParents = new Set([...Array.from(parents), fullPkgId]);
         for (const alias in node.children) {
             if (Object.hasOwn(node.children, alias)) {
                 const childId = node.children[alias];
-                deps[alias] = calcDepGraphHash(depsGraph, cache, nextParents, childId, supportedArchitectures);
+                deps[alias] = calcDepGraphHash({
+                    depsGraph,
+                    cache,
+                    parents: nextParents,
+                    depPath: childId,
+                    context,
+                });
             }
         }
     }
-    cache[depPath] = hashObject({
-        id: node.fullPkgId,
+    cache[cacheKey] = hashObject({
+        id: fullPkgId,
         deps,
     });
-    return cache[depPath];
+    return cache[cacheKey];
+}
+function createDepGraphHashContext(supportedArchitectures) {
+    return {
+        supportedArchitectures,
+        cacheKeyPrefix: supportedArchitectures == null ? '' : `\0architectures=${hashObject(supportedArchitectures)}\0`,
+    };
 }
 export function* iterateHashedGraphNodes(graph, pkgMetaIterator, opts = {}) {
     let builtDepPaths;
@@ -157,7 +209,13 @@ export function calcGraphNodeHash({ graph, cache, builtDepPaths, buildRequiredCa
     // to the install-wide value.
     const ownPin = readSnapshotRuntimePin(graph[depPath]?.children);
     const engine = includeEngine ? engineName(ownPin ?? nodeVersion) : null;
-    const deps = calcDepGraphHash(graph, cache, new Set(), depPath, supportedArchitectures);
+    const deps = calcDepGraphHash({
+        depsGraph: graph,
+        cache,
+        parents: new Set(),
+        depPath,
+        context: createDepGraphHashContext(supportedArchitectures),
+    });
     const isLocalDirectory = isLocalDirectoryResolution(graph[depPath]?.resolution);
     // Scoping the slot needs the project's identity; the segment only needs to
     // know that the package is a local directory, so a caller that leaves
@@ -259,14 +317,16 @@ export function lockfileToDepGraph(lockfile, supportedArchitectures, lockfileDir
     const linkTargetNodes = new Set();
     if (lockfile.packages != null) {
         for (const [depPath, pkgSnapshot] of Object.entries(lockfile.packages)) {
+            const pkgIdWithPatchHash = getPkgIdWithPatchHash(depPath);
             const children = lockfileDepsToGraphChildren({
                 ...pkgSnapshot.dependencies,
                 ...pkgSnapshot.optionalDependencies,
             }, lockfileDir, linkTargetNodes);
             graph[depPath] = {
                 children,
+                pkgIdWithPatchHash,
                 resolution: pkgSnapshot.resolution,
-                fullPkgId: createFullPkgId(getPkgIdWithPatchHash(depPath), pkgSnapshot.resolution, supportedArchitectures),
+                fullPkgId: createFullPkgId(pkgIdWithPatchHash, pkgSnapshot.resolution, supportedArchitectures),
             };
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.graph-hasher",
-  "version": "1100.2.18",
+  "version": "1100.3.0",
   "description": "Calculates the state of a dependency",
   "keywords": [
     "pnpm",
@@ -28,17 +28,17 @@
   ],
   "dependencies": {
     "@pnpm/crypto.object-hasher": "1100.0.1",
-    "@pnpm/deps.path": "1101.0.0",
-    "@pnpm/engine.runtime.system-version": "1100.0.10",
-    "@pnpm/lockfile.types": "1100.0.20",
-    "@pnpm/lockfile.utils": "1102.0.0",
-    "@pnpm/resolving.resolver-base": "1101.1.1",
-    "@pnpm/types": "1102.0.0",
+    "@pnpm/deps.path": "1101.0.1",
+    "@pnpm/engine.runtime.system-version": "1100.0.11",
+    "@pnpm/lockfile.types": "1100.1.0",
+    "@pnpm/lockfile.utils": "1102.1.0",
+    "@pnpm/resolving.resolver-base": "1101.2.0",
+    "@pnpm/types": "1102.1.0",
     "detect-libc": "^2.1.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.graph-hasher": "1100.2.18"
+    "@pnpm/deps.graph-hasher": "1100.3.0"
   },
   "engines": {
     "node": ">=22.13"