@pnpm/installing.env-installer 1101.0.10 → 1101.1.0

package/lib/installConfigDeps.js

@@ -1,12 +1,12 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { checkPackage } from '@pnpm/config.package-is-installable';
 import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
-import { installingConfigDepsLogger } from '@pnpm/core-loggers';
-import { calcLeafGlobalVirtualStorePath } from '@pnpm/deps.graph-hasher';
+import { installingConfigDepsLogger, skippedOptionalDependencyLogger } from '@pnpm/core-loggers';
+import { calcGlobalVirtualStorePathWithSubdeps, calcLeafGlobalVirtualStorePath } from '@pnpm/deps.graph-hasher';
 import { PnpmError } from '@pnpm/error';
 import { readModulesDir } from '@pnpm/fs.read-modules-dir';
 import { readEnvLockfile } from '@pnpm/lockfile.fs';
-import { safeReadPackageJsonFromDir } from '@pnpm/pkg-manifest.reader';
 import { rimraf } from '@zkochan/rimraf';
 import getNpmTarballUrl from 'get-npm-tarball-url';
 import { symlinkDir } from 'symlink-dir';
@@ -29,16 +29,27 @@ export async function installConfigDeps(configDepsOrLockfile, opts) {
     const installedConfigDeps = [];
     await Promise.all(Object.entries(normalizedDeps).map(async ([pkgName, pkg]) => {
         const configDepPath = path.join(configModulesDir, pkgName);
-        const existingPkgJson = existingConfigDeps.includes(pkgName)
-            ? await safeReadPackageJsonFromDir(configDepPath)
-            : null;
-        if (existingPkgJson != null && existingPkgJson.name === pkgName && existingPkgJson.version === pkg.version) {
-            return;
-        }
-        installingConfigDepsLogger.debug({ status: 'started' });
         const fullPkgId = `${pkgName}@${pkg.version}:${pkg.resolution.integrity}`;
-        const relPath = calcLeafGlobalVirtualStorePath(fullPkgId, pkgName, pkg.version);
+        // The parent's GVS hash must incorporate its optional subdeps; otherwise
+        // changing a subdep version while keeping the parent pinned would collide
+        // on the same leaf and silently overwrite the previous sibling symlinks.
+        const optionalSubdepIds = {};
+        for (const subdep of pkg.optionalSubdeps ?? []) {
+            optionalSubdepIds[subdep.name] = `${subdep.name}@${subdep.version}:${subdep.resolution.integrity}`;
+        }
+        const relPath = calcGlobalVirtualStorePathWithSubdeps(fullPkgId, pkgName, pkg.version, optionalSubdepIds);
         const pkgDirInGlobalVirtualStore = path.join(globalVirtualStoreDir, relPath, 'node_modules', pkgName);
+        // The leaf hash captures parent+subdep identities from the lockfile but
+        // not the host's `process.arch`/`process.platform` selection. So even if
+        // the symlink target is already the expected leaf, the sibling links
+        // inside that leaf may target the wrong platform binary if the host's
+        // effective arch changed between runs (e.g. Rosetta x64 vs arm64 on
+        // macOS). Short-circuit only the parent's re-import/re-symlink in that
+        // case; always run installOptionalSubdeps so platform-specific siblings
+        // get pruned and relinked.
+        const parentSymlinkAlreadyCorrect = existingConfigDeps.includes(pkgName) &&
+            await symlinkPointsTo(configDepPath, pkgDirInGlobalVirtualStore);
+        installingConfigDepsLogger.debug({ status: 'started' });
         if (!fs.existsSync(path.join(pkgDirInGlobalVirtualStore, 'package.json'))) {
             const { fetching } = await opts.store.fetchPackage({
                 force: true,
@@ -55,6 +66,22 @@ export async function installConfigDeps(configDepsOrLockfile, opts) {
                 filesResponse,
             });
         }
+        if (pkg.optionalSubdeps?.length) {
+            await installOptionalSubdeps({
+                parentName: pkgName,
+                parentVersion: pkg.version,
+                subdeps: pkg.optionalSubdeps,
+                // path.dirname would land in the scope subdir for scoped parents; use
+                // the leaf's node_modules root so sibling symlinks resolve correctly.
+                parentNodeModulesDir: path.join(globalVirtualStoreDir, relPath, 'node_modules'),
+                globalVirtualStoreDir,
+                rootDir: opts.rootDir,
+                store: opts.store,
+            });
+        }
+        if (parentSymlinkAlreadyCorrect) {
+            return;
+        }
         if (existingConfigDeps.includes(pkgName)) {
             await rimraf(configDepPath);
         }
@@ -113,14 +140,114 @@ function normalizeFromLockfile(lockfile, registries) {
             throw new PnpmError('ENV_LOCKFILE_CORRUPTED', `pnpm-lock.yaml is corrupted or incomplete: missing integrity for "${pkgKey}"`);
         }
         const registry = pickRegistryForPackage(registries, pkgName);
+        const snapshot = lockfile.snapshots[pkgKey];
+        const optionalSubdeps = snapshot?.optionalDependencies
+            ? readOptionalSubdepsFromLockfile(pkgName, snapshot.optionalDependencies, lockfile, registries)
+            : undefined;
         deps[pkgName] = {
             version,
             resolution: {
                 integrity: resolution.integrity,
                 tarball: resolution.tarball ?? getNpmTarballUrl(pkgName, version, { registry }),
             },
+            optionalSubdeps,
         };
     }
     return deps;
 }
+function readOptionalSubdepsFromLockfile(parentName, optionalDeps, lockfile, registries) {
+    const subdeps = [];
+    for (const [subdepName, subdepVersion] of Object.entries(optionalDeps)) {
+        const subdepKey = `${subdepName}@${subdepVersion}`;
+        const subdepInfo = lockfile.packages[subdepKey];
+        if (!subdepInfo) {
+            throw new PnpmError('ENV_LOCKFILE_CORRUPTED', `pnpm-lock.yaml is corrupted or incomplete: missing packages entry for "${subdepKey}" ` +
+                `referenced from optionalDependencies of config dependency "${parentName}"`);
+        }
+        const subdepResolution = subdepInfo.resolution;
+        if (!subdepResolution.integrity) {
+            throw new PnpmError('ENV_LOCKFILE_CORRUPTED', `pnpm-lock.yaml is corrupted or incomplete: missing integrity for "${subdepKey}"`);
+        }
+        const registry = pickRegistryForPackage(registries, subdepName);
+        subdeps.push({
+            name: subdepName,
+            version: subdepVersion,
+            resolution: {
+                integrity: subdepResolution.integrity,
+                tarball: subdepResolution.tarball ?? getNpmTarballUrl(subdepName, subdepVersion, { registry }),
+            },
+            os: subdepInfo.os,
+            cpu: subdepInfo.cpu,
+            libc: subdepInfo.libc,
+        });
+    }
+    return subdeps;
+}
+async function installOptionalSubdeps(opts) {
+    const parentLogInfo = { id: `${opts.parentName}@${opts.parentVersion}`, name: opts.parentName, version: opts.parentVersion };
+    const compatibleSubdeps = opts.subdeps.filter((subdep) => {
+        if (!subdep.os && !subdep.cpu && !subdep.libc)
+            return true;
+        // Use checkPackage rather than packageIsInstallable: the latter emits a
+        // user-visible warn for every incompatible variant, which would fire on
+        // every install since the env lockfile records all platform variants for
+        // portability. We log skipped subdeps at debug instead.
+        const error = checkPackage(`${subdep.name}@${subdep.version}`, { os: subdep.os, cpu: subdep.cpu, libc: subdep.libc }, {});
+        if (error == null)
+            return true;
+        skippedOptionalDependencyLogger.debug({
+            details: error.toString(),
+            package: { id: `${subdep.name}@${subdep.version}`, name: subdep.name, version: subdep.version },
+            parents: [parentLogInfo],
+            prefix: opts.rootDir,
+            reason: error.code === 'ERR_PNPM_UNSUPPORTED_ENGINE' ? 'unsupported_engine' : 'unsupported_platform',
+        });
+        return false;
+    });
+    const expectedSiblings = new Set([opts.parentName, ...compatibleSubdeps.map((s) => s.name)]);
+    const existingSiblings = await readModulesDir(opts.parentNodeModulesDir) ?? [];
+    await Promise.all(existingSiblings
+        .filter((name) => !expectedSiblings.has(name))
+        .map((name) => rimraf(path.join(opts.parentNodeModulesDir, name))));
+    await Promise.all(compatibleSubdeps.map(async (subdep) => {
+        const subdepFullPkgId = `${subdep.name}@${subdep.version}:${subdep.resolution.integrity}`;
+        const subdepRelPath = calcLeafGlobalVirtualStorePath(subdepFullPkgId, subdep.name, subdep.version);
+        const subdepDirInGlobalVirtualStore = path.join(opts.globalVirtualStoreDir, subdepRelPath, 'node_modules', subdep.name);
+        if (!fs.existsSync(path.join(subdepDirInGlobalVirtualStore, 'package.json'))) {
+            const { fetching } = await opts.store.fetchPackage({
+                force: true,
+                lockfileDir: opts.rootDir,
+                pkg: {
+                    id: `${subdep.name}@${subdep.version}`,
+                    resolution: subdep.resolution,
+                },
+            });
+            const { files: filesResponse } = await fetching();
+            await opts.store.importPackage(subdepDirInGlobalVirtualStore, {
+                force: true,
+                requiresBuild: false,
+                filesResponse,
+            });
+        }
+        const linkPath = path.join(opts.parentNodeModulesDir, subdep.name);
+        await fs.promises.mkdir(path.dirname(linkPath), { recursive: true });
+        await symlinkDir(subdepDirInGlobalVirtualStore, linkPath);
+    }));
+}
+async function symlinkPointsTo(linkPath, expectedTarget) {
+    try {
+        // Realpath both sides: the expected target itself may live under a
+        // symlinked storeDir, and on case-insensitive filesystems the literal
+        // string forms can disagree about casing even when they refer to the
+        // same inode.
+        const [linkReal, targetReal] = await Promise.all([
+            fs.promises.realpath(linkPath),
+            fs.promises.realpath(expectedTarget),
+        ]);
+        return linkReal === targetReal;
+    }
+    catch {
+        return false;
+    }
+}
 //# sourceMappingURL=installConfigDeps.js.map

package/lib/parseIntegrity.d.ts

@@ -4,6 +4,18 @@ export interface NormalizedConfigDep {
         integrity: string;
         tarball: string;
     };
+    optionalSubdeps?: NormalizedSubdep[];
+}
+export interface NormalizedSubdep {
+    name: string;
+    version: string;
+    resolution: {
+        integrity: string;
+        tarball: string;
+    };
+    os?: string[];
+    cpu?: string[];
+    libc?: string[];
 }
 export declare function parseIntegrity(pkgName: string, pkgSpec: string): {
     version: string;

package/lib/resolveAndInstallConfigDeps.js

@@ -9,6 +9,7 @@ import getNpmTarballUrl from 'get-npm-tarball-url';
 import { installConfigDeps } from './installConfigDeps.js';
 import { parseIntegrity } from './parseIntegrity.js';
 import { pruneEnvLockfile } from './pruneEnvLockfile.js';
+import { resolveOptionalSubdeps } from './resolveOptionalSubdeps.js';
 /**
  * Resolves any config dependencies that are missing from the env lockfile,
  * then installs all config dependencies.
@@ -101,7 +102,13 @@ export async function resolveAndInstallConfigDeps(configDeps, opts) {
         envLockfile.packages[pkgKey] = {
             resolution: toLockfileResolution({ name, version }, resolution.resolution, registry),
         };
-        envLockfile.snapshots[pkgKey] = {};
+        const optionalSubdeps = await resolveOptionalSubdeps(name, resolution.manifest, {
+            envLockfile,
+            lockfileDir: opts.rootDir,
+            registries: opts.registries,
+            resolveFromNpm,
+        });
+        envLockfile.snapshots[pkgKey] = optionalSubdeps ? { optionalDependencies: optionalSubdeps } : {};
     }));
     pruneEnvLockfile(envLockfile);
     await writeEnvLockfile(opts.rootDir, envLockfile);

package/lib/resolveConfigDeps.js

@@ -8,6 +8,7 @@ import { createFetchFromRegistry } from '@pnpm/network.fetch';
 import { createNpmResolver } from '@pnpm/resolving.npm-resolver';
 import { parseWantedDependency } from '@pnpm/resolving.parse-wanted-dependency';
 import { installConfigDeps } from './installConfigDeps.js';
+import { resolveOptionalSubdeps } from './resolveOptionalSubdeps.js';
 export async function resolveConfigDeps(configDeps, opts) {
     if (opts.frozenLockfile) {
         throw new PnpmError('FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE', 'Cannot resolve configDependencies with "frozen-lockfile" because the lockfile is not up to date');
@@ -45,7 +46,13 @@ export async function resolveConfigDeps(configDeps, opts) {
         envLockfile.packages[pkgKey] = {
             resolution: toLockfileResolution({ name: pkgName, version }, resolution.resolution, registry),
         };
-        envLockfile.snapshots[pkgKey] = {};
+        const optionalSubdeps = await resolveOptionalSubdeps(pkgName, resolution.manifest, {
+            envLockfile,
+            lockfileDir: opts.rootDir,
+            registries: opts.registries,
+            resolveFromNpm,
+        });
+        envLockfile.snapshots[pkgKey] = optionalSubdeps ? { optionalDependencies: optionalSubdeps } : {};
     }));
     await Promise.all([
         writeSettings({

package/lib/resolveOptionalSubdeps.d.ts

@@ -0,0 +1,13 @@
+import type { EnvLockfile } from '@pnpm/lockfile.fs';
+import type { ResolvedDependencies } from '@pnpm/lockfile.types';
+import type { createNpmResolver } from '@pnpm/resolving.npm-resolver';
+import type { DependencyManifest, Registries } from '@pnpm/types';
+type ResolveFromNpm = ReturnType<typeof createNpmResolver>['resolveFromNpm'];
+export interface ResolveOptionalSubdepsOpts {
+    envLockfile: EnvLockfile;
+    lockfileDir: string;
+    registries: Registries;
+    resolveFromNpm: ResolveFromNpm;
+}
+export declare function resolveOptionalSubdeps(parentName: string, parentManifest: DependencyManifest, opts: ResolveOptionalSubdepsOpts): Promise<ResolvedDependencies | undefined>;
+export {};

package/lib/resolveOptionalSubdeps.js

@@ -0,0 +1,84 @@
+import util from 'node:util';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { skippedOptionalDependencyLogger } from '@pnpm/core-loggers';
+import { PnpmError } from '@pnpm/error';
+import { toLockfileResolution } from '@pnpm/lockfile.utils';
+import semver from 'semver';
+export async function resolveOptionalSubdeps(parentName, parentManifest, opts) {
+    const optionalDeps = parentManifest.optionalDependencies;
+    if (!optionalDeps || Object.keys(optionalDeps).length === 0) {
+        return undefined;
+    }
+    const resolved = {};
+    await Promise.all(Object.entries(optionalDeps).map(async ([subdepName, subdepSpec]) => {
+        if (semver.valid(subdepSpec) == null) {
+            // Ranges and tags would let the resolved version drift between machines
+            // even with a stable parent integrity, breaking the lockfile's promise
+            // of reproducible config-dep installs.
+            throw new PnpmError('CONFIG_DEP_OPTIONAL_NOT_EXACT', `Cannot install "${subdepName}@${subdepSpec}" as an optionalDependency of config dependency "${parentName}": only exact versions are supported (got "${subdepSpec}")`);
+        }
+        let resolution;
+        try {
+            // `optional: true` opts into full registry metadata so the resolver
+            // returns `libc` (and any other fields the abbreviated metadata strips).
+            // See pnpm/pnpm#9950.
+            resolution = await opts.resolveFromNpm({ alias: subdepName, bareSpecifier: subdepSpec, optional: true }, {
+                lockfileDir: opts.lockfileDir,
+                preferredVersions: {},
+                projectDir: opts.lockfileDir,
+            });
+        }
+        catch (err) {
+            // Trust-downgrade is a security signal that must fail the install even
+            // for optional deps; everything else mirrors npm's optionalDependencies
+            // semantics — log and skip.
+            if (util.types.isNativeError(err) && 'code' in err && err.code === 'ERR_PNPM_TRUST_DOWNGRADE') {
+                throw err;
+            }
+            skippedOptionalDependencyLogger.debug({
+                details: util.types.isNativeError(err) ? err.toString() : String(err),
+                package: {
+                    name: subdepName,
+                    // No resolved version yet; surface the requested specifier so log
+                    // consumers that format `${name}@${version}` don't render `@undefined`.
+                    version: subdepSpec,
+                    bareSpecifier: subdepSpec,
+                },
+                parents: [{ id: `${parentName}@${parentManifest.version}`, name: parentName, version: parentManifest.version }],
+                prefix: opts.lockfileDir,
+                reason: 'resolution_failure',
+            });
+            return;
+        }
+        if (resolution?.resolution == null ||
+            !('integrity' in resolution.resolution) ||
+            typeof resolution.resolution.integrity !== 'string' ||
+            !resolution.resolution.integrity ||
+            resolution.manifest == null) {
+            throw new PnpmError('BAD_CONFIG_DEP', `Cannot resolve optionalDependency "${subdepName}" of config dependency "${parentName}" because it has no integrity`);
+        }
+        const subdepVersion = resolution.manifest.version;
+        const registry = pickRegistryForPackage(opts.registries, subdepName);
+        const subdepKey = `${subdepName}@${subdepVersion}`;
+        opts.envLockfile.packages[subdepKey] = {
+            resolution: toLockfileResolution({ name: subdepName, version: subdepVersion }, resolution.resolution, registry),
+            ...pickPlatformFields(resolution.manifest),
+        };
+        if (opts.envLockfile.snapshots[subdepKey] == null) {
+            opts.envLockfile.snapshots[subdepKey] = {};
+        }
+        resolved[subdepName] = subdepVersion;
+    }));
+    return Object.keys(resolved).length > 0 ? resolved : undefined;
+}
+function pickPlatformFields(manifest) {
+    const out = {};
+    if (manifest.os?.length)
+        out.os = manifest.os;
+    if (manifest.cpu?.length)
+        out.cpu = manifest.cpu;
+    if (manifest.libc?.length)
+        out.libc = manifest.libc;
+    return out;
+}
+//# sourceMappingURL=resolveOptionalSubdeps.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.env-installer",
-  "version": "1101.0.10",
+  "version": "1101.1.0",
   "description": "Installer for configurational dependencies",
   "keywords": [
     "pnpm",
@@ -27,40 +27,43 @@
   "dependencies": {
     "@zkochan/rimraf": "^4.0.0",
     "get-npm-tarball-url": "^2.1.0",
+    "semver": "^7.7.2",
     "symlink-dir": "^10.0.1",
-    "@pnpm/config.pick-registry-for-package": "1100.0.3",
+    "@pnpm/config.package-is-installable": "1100.0.6",
+    "@pnpm/config.writer": "1100.0.9",
+    "@pnpm/config.pick-registry-for-package": "1100.0.4",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/core-loggers": "1100.1.0",
-    "@pnpm/config.writer": "1100.0.8",
-    "@pnpm/deps.graph-hasher": "1100.2.0",
+    "@pnpm/deps.graph-hasher": "1100.2.1",
     "@pnpm/error": "1100.0.0",
+    "@pnpm/installing.deps-resolver": "1100.1.1",
     "@pnpm/fs.read-modules-dir": "1100.0.1",
-    "@pnpm/installing.deps-resolver": "1100.1.0",
-    "@pnpm/lockfile.pruner": "1100.0.6",
-    "@pnpm/lockfile.fs": "1100.1.0",
-    "@pnpm/lockfile.types": "1100.0.6",
-    "@pnpm/lockfile.utils": "1100.0.8",
-    "@pnpm/network.auth-header": "1100.0.2",
-    "@pnpm/network.fetch": "1100.0.5",
-    "@pnpm/pkg-manifest.reader": "1100.0.3",
+    "@pnpm/lockfile.fs": "1100.1.1",
+    "@pnpm/lockfile.utils": "1100.0.9",
+    "@pnpm/lockfile.types": "1100.0.7",
+    "@pnpm/lockfile.pruner": "1100.0.7",
+    "@pnpm/network.auth-header": "1100.0.3",
+    "@pnpm/network.fetch": "1100.0.6",
+    "@pnpm/pkg-manifest.reader": "1100.0.4",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/resolving.npm-resolver": "1101.2.0",
-    "@pnpm/store.controller": "1101.0.7",
-    "@pnpm/store.controller-types": "1100.1.0",
-    "@pnpm/types": "1101.1.0"
+    "@pnpm/store.controller-types": "1100.1.1",
+    "@pnpm/store.controller": "1101.0.8",
+    "@pnpm/types": "1101.1.1",
+    "@pnpm/resolving.npm-resolver": "1101.3.0",
+    "@pnpm/core-loggers": "1100.1.1"
   },
   "peerDependencies": {
     "@pnpm/logger": ">=1001.0.0 <1002.0.0",
-    "@pnpm/worker": "^1100.1.6"
+    "@pnpm/worker": "^1100.1.7"
   },
   "devDependencies": {
     "@jest/globals": "30.3.0",
     "@pnpm/registry-mock": "6.0.0",
+    "@types/semver": "7.7.1",
     "load-json-file": "^7.0.1",
     "read-yaml-file": "^3.0.0",
-    "@pnpm/installing.env-installer": "1101.0.10",
-    "@pnpm/prepare": "1100.0.9",
-    "@pnpm/testing.temp-store": "1100.1.0"
+    "@pnpm/installing.env-installer": "1101.1.0",
+    "@pnpm/prepare": "1100.0.10",
+    "@pnpm/testing.temp-store": "1100.1.1"
   },
   "engines": {
     "node": ">=22.13"