@pnpm/deps.graph-hasher 1100.2.18 → 1100.3.1

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @pnpm/calc-dep-state
 
+## 1100.3.1
+
+### Patch Changes
+
+- Fixed global virtual store hashes for dependency cycles. Every package that transitively depends on an allowed build now includes the engine in its store path, independent of traversal order [pnpm/pnpm#14341](https://github.com/pnpm/pnpm/issues/14341).
+
+- Updated dependencies:
+  - @pnpm/lockfile.types@1100.1.1
+  - @pnpm/lockfile.utils@1102.1.1
+
+## 1100.3.0
+
+### Minor Changes
+
+- Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally.
+
+  Configure it with the new `remoteSideEffectsCache` setting. A workspace names the eligible `organization` and `packages`; everything describing the act of signing — `publish`, `keyId`, `builderId`, `trustedKeys`, `privateKey` and the provenance fields — is refused in `pnpm-workspace.yaml` and read from the global config file or the environment instead.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/deps.path@1101.0.1
+  - @pnpm/engine.runtime.system-version@1100.0.11
+  - @pnpm/lockfile.types@1100.1.0
+  - @pnpm/lockfile.utils@1102.1.0
+  - @pnpm/resolving.resolver-base@1101.2.0
+  - @pnpm/types@1102.1.0
+
 ## 1100.2.18
 
 ### Patch Changes

package/lib/index.d.ts

@@ -51,6 +51,31 @@ export interface DepsGraphNode<T extends string> {
 export interface DepsStateCache {
     [depPath: string]: string;
 }
+export declare const DEPENDENCY_SIDE_EFFECTS_INPUT_KEY_PREFIX = "dependency-side-effects:v1:";
+export interface CalcDepStateInputKeyOptions<T extends string> {
+    depsGraph: DepsGraph<T>;
+    depPath: T;
+    patchFileHash?: string;
+    supportedArchitectures?: SupportedArchitectures;
+}
+/**
+ * Compute the machine-independent lookup key for a remotely shareable
+ * dependency build.
+ *
+ * `depsGraph` must contain `depPath`, and every reachable node must provide
+ * either `fullPkgId` or the resolution metadata needed to derive it. The
+ * function does not mutate the graph or caller state. Each call uses an
+ * isolated cache, so the result is independent of earlier roots and platform
+ * selections.
+ *
+ * The returned key starts with {@link DEPENDENCY_SIDE_EFFECTS_INPUT_KEY_PREFIX},
+ * followed by the recursive dependency-graph hash and, when non-empty, the
+ * patch-file hash. Host identity is excluded and advertised by the artifact's
+ * signed compatibility constraints. When a resolution contains platform
+ * variations, `supportedArchitectures` selects the source integrity included
+ * in the graph hash.
+ */
+export declare function calcDepStateInputKey<T extends string>(opts: CalcDepStateInputKeyOptions<T>): string;
 export declare function calcDepState<T extends string>(depsGraph: DepsGraph<T>, cache: DepsStateCache, depPath: string, opts: {
     patchFileHash?: string;
     includeDepGraphHash: boolean;
@@ -101,11 +126,11 @@ export interface GraphNodeHashOptions {
     lockfileDir?: string;
 }
 export declare function iterateHashedGraphNodes<T extends PkgMeta>(graph: DepsGraph<DepPath>, pkgMetaIterator: PkgMetaIterator<T>, opts?: GraphNodeHashOptions): IterableIterator<HashedDepPath<T>>;
-export declare function calcGraphNodeHash<T extends PkgMeta>({ graph, cache, builtDepPaths, buildRequiredCache, supportedArchitectures, nodeVersion, lockfileDir }: {
+export declare function calcGraphNodeHash<T extends PkgMeta>({ graph, cache, buildRequiredDepPaths, supportedArchitectures, nodeVersion, lockfileDir }: {
     graph: DepsGraph<DepPath>;
     cache: DepsStateCache;
-    builtDepPaths?: Set<DepPath>;
-    buildRequiredCache?: Record<string, boolean>;
+    /** See {@link computeBuildRequiredDepPaths}. */
+    buildRequiredDepPaths?: Set<DepPath>;
     supportedArchitectures?: SupportedArchitectures;
     /** See {@link GraphNodeHashOptions.nodeVersion}. */
     nodeVersion?: string;
@@ -127,3 +152,18 @@ export interface PkgMetaAndSnapshot extends PkgMeta {
 }
 export declare function iteratePkgMeta(lockfile: LockfileObject, graph: DepsGraph<DepPath>): PkgMetaIterator<PkgMetaAndSnapshot>;
 export declare function lockfileToDepGraph(lockfile: LockfileObject, supportedArchitectures?: SupportedArchitectures, lockfileDir?: string): DepsGraph<DepPath>;
+/**
+ * Expand `builtDepPaths` to every node that is, or transitively depends
+ * on, one of them.
+ *
+ * The result gates the engine string in {@link calcGraphNodeHash}: only a
+ * package that may run a build script — or that depends on one — keeps the
+ * engine in its GVS hash. It is computed as one graph-wide reverse closure,
+ * so a package inside a dependency cycle gets the same answer no matter
+ * which node the hasher reaches it from.
+ *
+ * A path with no node in `graph` is kept and still marks whatever depends on
+ * it: the built set comes from the allowBuild policy rather than the graph,
+ * so the two can disagree.
+ */
+export declare function computeBuildRequiredDepPaths(graph: DepsGraph<DepPath>, builtDepPaths: Set<DepPath>): Set<DepPath>;

package/lib/index.js

@@ -71,11 +71,52 @@ export function readSnapshotRuntimePin(children) {
     const ref = children?.node;
     return ref != null ? extractRuntimeNodeVersion(ref) : undefined;
 }
+export const DEPENDENCY_SIDE_EFFECTS_INPUT_KEY_PREFIX = 'dependency-side-effects:v1:';
+/**
+ * Compute the machine-independent lookup key for a remotely shareable
+ * dependency build.
+ *
+ * `depsGraph` must contain `depPath`, and every reachable node must provide
+ * either `fullPkgId` or the resolution metadata needed to derive it. The
+ * function does not mutate the graph or caller state. Each call uses an
+ * isolated cache, so the result is independent of earlier roots and platform
+ * selections.
+ *
+ * The returned key starts with {@link DEPENDENCY_SIDE_EFFECTS_INPUT_KEY_PREFIX},
+ * followed by the recursive dependency-graph hash and, when non-empty, the
+ * patch-file hash. Host identity is excluded and advertised by the artifact's
+ * signed compatibility constraints. When a resolution contains platform
+ * variations, `supportedArchitectures` selects the source integrity included
+ * in the graph hash.
+ */
+export function calcDepStateInputKey(opts) {
+    if (opts.depsGraph[opts.depPath] == null) {
+        throw new Error(`Dependency side-effects input-key root ${opts.depPath} is not present in depsGraph`);
+    }
+    const depGraphHash = calcDepGraphHash({
+        depsGraph: opts.depsGraph,
+        cache: {},
+        parents: new Set(),
+        depPath: opts.depPath,
+        context: createDepGraphHashContext(opts.supportedArchitectures),
+    });
+    let result = `${DEPENDENCY_SIDE_EFFECTS_INPUT_KEY_PREFIX}deps=${depGraphHash}`;
+    if (opts.patchFileHash) {
+        result += `;patch=${opts.patchFileHash}`;
+    }
+    return result;
+}
 export function calcDepState(depsGraph, cache, depPath, opts) {
     const ownPin = readSnapshotRuntimePin(depsGraph[depPath]?.children);
     let result = engineName(ownPin ?? opts.nodeVersion);
     if (opts.includeDepGraphHash) {
-        const depGraphHash = calcDepGraphHash(depsGraph, cache, new Set(), depPath, opts.supportedArchitectures);
+        const depGraphHash = calcDepGraphHash({
+            depsGraph,
+            cache,
+            parents: new Set(),
+            depPath: depPath,
+            context: createDepGraphHashContext(opts.supportedArchitectures),
+        });
         result += `;deps=${depGraphHash}`;
     }
     if (opts.patchFileHash) {
@@ -83,43 +124,54 @@ export function calcDepState(depsGraph, cache, depPath, opts) {
     }
     return result;
 }
-function calcDepGraphHash(depsGraph, cache, parents, depPath, supportedArchitectures) {
-    if (cache[depPath])
-        return cache[depPath];
+function calcDepGraphHash({ depsGraph, cache, parents, depPath, context, }) {
+    const cacheKey = `${context.cacheKeyPrefix}${depPath}`;
+    if (cache[cacheKey])
+        return cache[cacheKey];
     const node = depsGraph[depPath];
     if (!node)
         return '';
-    if (!node.fullPkgId) {
-        if (!node.pkgIdWithPatchHash) {
-            throw new Error(`pkgIdWithPatchHash is not defined for ${depPath} in depsGraph`);
-        }
-        if (!node.resolution) {
-            throw new Error(`resolution is not defined for ${depPath} in depsGraph`);
-        }
-        node.fullPkgId = createFullPkgId(node.pkgIdWithPatchHash, node.resolution, supportedArchitectures);
+    let fullPkgId = node.fullPkgId;
+    if (node.pkgIdWithPatchHash != null && node.resolution != null) {
+        fullPkgId = createFullPkgId(node.pkgIdWithPatchHash, node.resolution, context.supportedArchitectures);
+    }
+    else if (fullPkgId == null) {
+        throw new Error(`fullPkgId or resolution metadata is not defined for ${depPath} in depsGraph`);
     }
     const deps = {};
-    if (Object.keys(node.children).length && !parents.has(node.fullPkgId)) {
-        const nextParents = new Set([...Array.from(parents), node.fullPkgId]);
+    if (Object.keys(node.children).length && !parents.has(fullPkgId)) {
+        const nextParents = new Set([...Array.from(parents), fullPkgId]);
         for (const alias in node.children) {
             if (Object.hasOwn(node.children, alias)) {
                 const childId = node.children[alias];
-                deps[alias] = calcDepGraphHash(depsGraph, cache, nextParents, childId, supportedArchitectures);
+                deps[alias] = calcDepGraphHash({
+                    depsGraph,
+                    cache,
+                    parents: nextParents,
+                    depPath: childId,
+                    context,
+                });
             }
         }
     }
-    cache[depPath] = hashObject({
-        id: node.fullPkgId,
+    cache[cacheKey] = hashObject({
+        id: fullPkgId,
         deps,
     });
-    return cache[depPath];
+    return cache[cacheKey];
+}
+function createDepGraphHashContext(supportedArchitectures) {
+    return {
+        supportedArchitectures,
+        cacheKeyPrefix: supportedArchitectures == null ? '' : `\0architectures=${hashObject(supportedArchitectures)}\0`,
+    };
 }
 export function* iterateHashedGraphNodes(graph, pkgMetaIterator, opts = {}) {
-    let builtDepPaths;
+    let buildRequiredDepPaths;
     let entries;
     if (opts.allowBuild != null) {
         const pkgMetaList = Array.from(pkgMetaIterator);
-        builtDepPaths = computeBuiltDepPaths(pkgMetaList, opts.allowBuild);
+        buildRequiredDepPaths = computeBuildRequiredDepPaths(graph, computeBuiltDepPaths(pkgMetaList, opts.allowBuild));
         entries = pkgMetaList;
     }
     else {
@@ -128,8 +180,7 @@ export function* iterateHashedGraphNodes(graph, pkgMetaIterator, opts = {}) {
     const ctx = {
         graph,
         cache: {},
-        builtDepPaths,
-        buildRequiredCache: builtDepPaths !== undefined ? {} : undefined,
+        buildRequiredDepPaths,
         supportedArchitectures: opts.supportedArchitectures,
         nodeVersion: opts.nodeVersion,
         lockfileDir: opts.lockfileDir,
@@ -141,15 +192,14 @@ export function* iterateHashedGraphNodes(graph, pkgMetaIterator, opts = {}) {
         };
     }
 }
-export function calcGraphNodeHash({ graph, cache, builtDepPaths, buildRequiredCache, supportedArchitectures, nodeVersion, lockfileDir }, pkgMeta) {
+export function calcGraphNodeHash({ graph, cache, buildRequiredDepPaths, supportedArchitectures, nodeVersion, lockfileDir }, pkgMeta) {
     const { name, version, depPath } = pkgMeta;
-    // When builtDepPaths is provided (derived from the allowBuilds config),
-    // we only include the engine name for packages that are allowed to build
-    // or transitively depend on a package that is allowed to build.
+    // When buildRequiredDepPaths is provided (derived from the allowBuilds
+    // config), we only include the engine name for packages that are allowed
+    // to build or transitively depend on a package that is allowed to build.
     // This makes GVS hashes engine-agnostic for pure-JS packages,
     // so they survive Node.js upgrades and architecture changes.
-    const includeEngine = builtDepPaths === undefined ||
-        transitivelyRequiresBuild(graph, builtDepPaths, buildRequiredCache ??= {}, depPath, new Set());
+    const includeEngine = buildRequiredDepPaths === undefined || buildRequiredDepPaths.has(depPath);
     // A snapshot that declares `engines.runtime` carries the desugared
     // `node@runtime:<version>` pin as a child; that's the Node the bin
     // linker spawns for its lifecycle scripts, so it has to drive the
@@ -157,7 +207,13 @@ export function calcGraphNodeHash({ graph, cache, builtDepPaths, buildRequiredCa
     // to the install-wide value.
     const ownPin = readSnapshotRuntimePin(graph[depPath]?.children);
     const engine = includeEngine ? engineName(ownPin ?? nodeVersion) : null;
-    const deps = calcDepGraphHash(graph, cache, new Set(), depPath, supportedArchitectures);
+    const deps = calcDepGraphHash({
+        depsGraph: graph,
+        cache,
+        parents: new Set(),
+        depPath,
+        context: createDepGraphHashContext(supportedArchitectures),
+    });
     const isLocalDirectory = isLocalDirectoryResolution(graph[depPath]?.resolution);
     // Scoping the slot needs the project's identity; the segment only needs to
     // know that the package is a local directory, so a caller that leaves
@@ -259,14 +315,16 @@ export function lockfileToDepGraph(lockfile, supportedArchitectures, lockfileDir
     const linkTargetNodes = new Set();
     if (lockfile.packages != null) {
         for (const [depPath, pkgSnapshot] of Object.entries(lockfile.packages)) {
+            const pkgIdWithPatchHash = getPkgIdWithPatchHash(depPath);
             const children = lockfileDepsToGraphChildren({
                 ...pkgSnapshot.dependencies,
                 ...pkgSnapshot.optionalDependencies,
             }, lockfileDir, linkTargetNodes);
             graph[depPath] = {
                 children,
+                pkgIdWithPatchHash,
                 resolution: pkgSnapshot.resolution,
-                fullPkgId: createFullPkgId(getPkgIdWithPatchHash(depPath), pkgSnapshot.resolution, supportedArchitectures),
+                fullPkgId: createFullPkgId(pkgIdWithPatchHash, pkgSnapshot.resolution, supportedArchitectures),
             };
         }
     }
@@ -287,30 +345,47 @@ function computeBuiltDepPaths(entries, allowBuild) {
     }
     return builtDepPaths;
 }
-function transitivelyRequiresBuild(graph, builtDepPaths, cache, depPath, parents) {
-    if (depPath in cache)
-        return cache[depPath];
-    if (builtDepPaths.has(depPath)) {
-        cache[depPath] = true;
-        return true;
-    }
-    const node = graph[depPath];
-    if (!node) {
-        cache[depPath] = false;
-        return false;
-    }
-    if (parents.has(depPath)) {
-        return false;
+/**
+ * Expand `builtDepPaths` to every node that is, or transitively depends
+ * on, one of them.
+ *
+ * The result gates the engine string in {@link calcGraphNodeHash}: only a
+ * package that may run a build script — or that depends on one — keeps the
+ * engine in its GVS hash. It is computed as one graph-wide reverse closure,
+ * so a package inside a dependency cycle gets the same answer no matter
+ * which node the hasher reaches it from.
+ *
+ * A path with no node in `graph` is kept and still marks whatever depends on
+ * it: the built set comes from the allowBuild policy rather than the graph,
+ * so the two can disagree.
+ */
+export function computeBuildRequiredDepPaths(graph, builtDepPaths) {
+    const buildRequiredDepPaths = new Set(builtDepPaths);
+    if (builtDepPaths.size === 0)
+        return buildRequiredDepPaths;
+    const parentsByChild = new Map();
+    for (const parent of Object.keys(graph)) {
+        for (const child of Object.values(graph[parent].children)) {
+            const parents = parentsByChild.get(child);
+            if (parents == null) {
+                parentsByChild.set(child, [parent]);
+            }
+            else {
+                parents.push(parent);
+            }
+        }
     }
-    const nextParents = new Set([...parents, depPath]);
-    for (const childDepPath of Object.values(node.children)) {
-        if (transitivelyRequiresBuild(graph, builtDepPaths, cache, childDepPath, nextParents)) {
-            cache[depPath] = true;
-            return true;
+    const pending = Array.from(builtDepPaths);
+    while (pending.length > 0) {
+        const child = pending.pop();
+        for (const parent of parentsByChild.get(child) ?? []) {
+            if (!buildRequiredDepPaths.has(parent)) {
+                buildRequiredDepPaths.add(parent);
+                pending.push(parent);
+            }
         }
     }
-    cache[depPath] = false;
-    return false;
+    return buildRequiredDepPaths;
 }
 function lockfileDepsToGraphChildren(deps, lockfileDir, linkTargetNodes) {
     const children = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.graph-hasher",
-  "version": "1100.2.18",
+  "version": "1100.3.1",
   "description": "Calculates the state of a dependency",
   "keywords": [
     "pnpm",
@@ -28,17 +28,17 @@
   ],
   "dependencies": {
     "@pnpm/crypto.object-hasher": "1100.0.1",
-    "@pnpm/deps.path": "1101.0.0",
-    "@pnpm/engine.runtime.system-version": "1100.0.10",
-    "@pnpm/lockfile.types": "1100.0.20",
-    "@pnpm/lockfile.utils": "1102.0.0",
-    "@pnpm/resolving.resolver-base": "1101.1.1",
-    "@pnpm/types": "1102.0.0",
+    "@pnpm/deps.path": "1101.0.1",
+    "@pnpm/engine.runtime.system-version": "1100.0.11",
+    "@pnpm/lockfile.types": "1100.1.1",
+    "@pnpm/lockfile.utils": "1102.1.1",
+    "@pnpm/resolving.resolver-base": "1101.2.0",
+    "@pnpm/types": "1102.1.0",
     "detect-libc": "^2.1.2"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.graph-hasher": "1100.2.18"
+    "@pnpm/deps.graph-hasher": "1100.3.1"
   },
   "engines": {
     "node": ">=22.13"