@vltpkg/graph 1.0.0-rc.9 → 1.0.2

package/dist/{esm/lockfile → lockfile}/save.js

@@ -1,8 +1,8 @@
 import { expandNormalizedManifestSymbols, isRecordStringString, } from '@vltpkg/types';
-import { defaultGitHostArchives, defaultGitHosts, defaultJsrRegistries, defaultRegistries, defaultRegistry, defaultScopeRegistries, } from '@vltpkg/spec';
+import { defaultGitHostArchives, defaultGitHosts, defaultJsrRegistries, defaultRegistries, defaultRegistryName, defaultScopeRegistries, } from '@vltpkg/spec';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
-import { getFlagNumFromNode, getBuildStateFromNode } from "./types.js";
+import { getFlagNumFromNode, getBuildStateFromNode, LOCKFILE_VERSION, } from "./types.js";
 import { error } from '@vltpkg/error-cause';
 const formatNodes = (nodes, saveManifests, saveBuildData, registry, throwOnMissingManifest) => {
     // we do not store importers in the lockfile, though we do store
@@ -12,7 +12,10 @@ const formatNodes = (nodes, saveManifests, saveBuildData, registry, throwOnMissi
     const orderedNodes = arr.sort((a, b) => a.id.localeCompare(b.id, 'en'));
     const res = {};
     for (const node of orderedNodes) {
-        const customRegistry = node.resolved && registry && !node.resolved.startsWith(registry);
+        // when no registry is configured, nothing can be reconstructed on
+        // load, so every resolved value has to be persisted
+        const customRegistry = node.resolved &&
+            (!registry || !node.resolved.startsWith(registry));
         const resolved = customRegistry ? node.resolved : undefined;
         // if it's in a location other than the default, stash that
         const location = node.id.startsWith('file') || node.inVltStore() ?
@@ -23,7 +26,9 @@ const formatNodes = (nodes, saveManifests, saveBuildData, registry, throwOnMissi
         if (node.integrity) {
             lockfileNode[2] = node.integrity;
         }
-        if (resolved) {
+        // skip resolved for remote nodes since
+        // these are already part of the dep id
+        if (resolved && !node.id.startsWith('remote')) {
             lockfileNode[3] = resolved;
         }
         if (location) {
@@ -80,7 +85,7 @@ const removeDefaultItems = (defaultItems, items) => {
     }
     return res;
 };
-export const lockfileData = ({ graph, catalog, catalogs, 'git-hosts': gitHosts, 'git-host-archives': gitHostArchives, modifiers, registry, registries, saveManifests, saveBuildData, 'scope-registries': scopeRegistries, 'jsr-registries': jsrRegistries, throwOnMissingManifest, }) => {
+export const lockfileData = ({ graph, catalog, catalogs, 'git-hosts': gitHosts, 'git-host-archives': gitHostArchives, modifiers, registry, registries, 'default-registry-alias': defaultRegistryAlias, saveManifests, saveBuildData, 'scoped-registries': scopeRegistries, 'jsr-registries': jsrRegistries, throwOnMissingManifest, }) => {
     const cleanGitHosts = isRecordStringString(gitHosts) ?
         removeDefaultItems(defaultGitHosts, gitHosts)
         : undefined;
@@ -101,7 +106,7 @@ export const lockfileData = ({ graph, catalog, catalogs, 'git-hosts': gitHosts,
         : undefined;
     const hasItems = (clean) => clean && Object.keys(clean).length;
     return {
-        lockfileVersion: 0,
+        lockfileVersion: LOCKFILE_VERSION,
         options: {
             ...(hasItems(cleanModifiers) ?
                 { modifiers: cleanModifiers }
@@ -109,15 +114,17 @@ export const lockfileData = ({ graph, catalog, catalogs, 'git-hosts': gitHosts,
             ...(hasItems(catalog) ? { catalog } : {}),
             ...(hasItems(catalogs) ? { catalogs } : {}),
             ...(hasItems(cleanScopeRegistries) ?
-                { 'scope-registries': cleanScopeRegistries }
+                { 'scoped-registries': cleanScopeRegistries }
                 : undefined),
             ...(hasItems(cleanJsrRegistries) ?
                 { 'jsr-registries': cleanJsrRegistries }
                 : undefined),
-            ...(registry !== undefined && registry !== defaultRegistry ?
-                { registry }
+            ...(registry !== undefined ? { registry } : undefined),
+            ...((defaultRegistryAlias !== undefined &&
+                defaultRegistryAlias !== defaultRegistryName) ?
+                { 'default-registry-alias': defaultRegistryAlias }
                 : undefined),
-            ...(hasItems(registries) ?
+            ...(hasItems(cleanRegistries) ?
                 { registries: cleanRegistries }
                 : undefined),
             ...(hasItems(cleanGitHosts) ?
@@ -170,4 +177,3 @@ export const saveHidden = (options) => {
     mkdirSync(dirname(fileName), { recursive: true });
     saveData(data, fileName, true);
 };
-//# sourceMappingURL=save.js.map

package/dist/{esm/lockfile → lockfile}/types.d.ts

@@ -8,6 +8,7 @@ export type LockfilePlatform = {
     engines?: Record<string, string>;
     os?: string[] | string;
     cpu?: string[] | string;
+    libc?: string[] | string;
 };
 /**
  * This is the main type definition for the contents of the
@@ -24,6 +25,12 @@ export type LockfileData = {
     nodes: Record<DepID, LockfileNode>;
     edges: LockfileEdges;
 };
+/**
+ * Current lockfile format version.
+ * Only lockfiles with matching version are considered valid.
+ * Bump when making breaking format changes.
+ */
+export declare const LOCKFILE_VERSION = 1;
 export declare const getFlagNumFromNode: (node: {
     optional?: boolean;
     dev?: boolean;
@@ -86,4 +93,3 @@ export type LockfileEdges = {
 export type LockfileEdgeKey = `${DepID} ${string}`;
 /** `${type} ${spec} ${to}` */
 export type LockfileEdgeValue = `${DependencyTypeShort} ${Spec['bareSpec']} ${DepID | 'MISSING'}`;
-//# sourceMappingURL=types.d.ts.map

package/dist/{esm/lockfile → lockfile}/types.js

@@ -1,3 +1,9 @@
+/**
+ * Current lockfile format version.
+ * Only lockfiles with matching version are considered valid.
+ * Bump when making breaking format changes.
+ */
+export const LOCKFILE_VERSION = 1;
 export const getFlagNumFromNode = (node) => node.optional && node.dev ? LockfileNodeFlagDevOptional
     : node.optional ? LockfileNodeFlagOptional
         : node.dev ? LockfileNodeFlagDev
@@ -41,4 +47,3 @@ export const getBuildStateFromNum = (state) => {
             return 'none';
     }
 };
-//# sourceMappingURL=types.js.map

package/dist/{esm/modifiers.d.ts → modifiers.d.ts}

@@ -186,4 +186,3 @@ export declare class GraphModifier {
      */
     static load(options: SpecOptions): GraphModifier;
 }
-//# sourceMappingURL=modifiers.d.ts.map

package/dist/{esm/modifiers.js → modifiers.js}

@@ -327,4 +327,3 @@ export class GraphModifier {
         return new GraphModifier(options);
     }
 }
-//# sourceMappingURL=modifiers.js.map

package/dist/{esm/node.d.ts → node.d.ts}

@@ -117,6 +117,7 @@ export declare class Node implements NodeLike {
         engines?: Record<string, string>;
         os?: string[] | string;
         cpu?: string[] | string;
+        libc?: string[] | string;
     };
     /**
      * Record of binary names to their paths in the package, if any.
@@ -223,6 +224,7 @@ export declare class Node implements NodeLike {
             engines?: Record<string, string>;
             os?: string[] | string;
             cpu?: string[] | string;
+            libc?: string[] | string;
         } | undefined;
         buildState: "none" | "needed" | "built" | "failed";
     };
@@ -230,4 +232,3 @@ export declare class Node implements NodeLike {
 }
 export declare const isNode: (value: unknown) => value is Node;
 export declare const asNode: (value: unknown) => Node;
-//# sourceMappingURL=node.d.ts.map

package/dist/{esm/node.js → node.js}

@@ -284,6 +284,11 @@ export class Node {
         const tuple = splitDepID(this.id);
         const [type, resolved] = tuple;
         switch (type) {
+            case 'remote': {
+                this.resolved = resolved;
+                this.integrity ??= this.manifest?.dist?.integrity;
+                break;
+            }
             case 'registry':
                 this.#registryNodeResolved(tuple);
                 break;
@@ -381,4 +386,3 @@ export const asNode = (value) => {
     }
     return value;
 };
-//# sourceMappingURL=node.js.map

package/dist/{esm/non-empty-list.d.ts → non-empty-list.d.ts}

@@ -1,3 +1,2 @@
 export declare const isNonEmptyList: <T>(list: T[]) => list is [first: T, ...rest: T[]];
 export declare const nonEmptyList: <T>(nodes: T[]) => [first: T, ...rest: T[]] | undefined;
-//# sourceMappingURL=non-empty-list.d.ts.map

package/dist/{esm/non-empty-list.js → non-empty-list.js}

@@ -1,3 +1,2 @@
 export const isNonEmptyList = (list) => !!list.length;
 export const nonEmptyList = (nodes) => isNonEmptyList(nodes) ? nodes : undefined;
-//# sourceMappingURL=non-empty-list.js.map

package/dist/path-security-error.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Is this error a path-safety verdict? Walks the cause chain, because
+ * lower layers (eg `PackageJson.read`) re-wrap what they throw.
+ */
+export declare const isPathSecurityError: (er: unknown) => boolean;

package/dist/path-security-error.js

@@ -0,0 +1,13 @@
+const codes = new Set(['EINVALIDNAME']);
+/**
+ * Is this error a path-safety verdict? Walks the cause chain, because
+ * lower layers (eg `PackageJson.read`) re-wrap what they throw.
+ */
+export const isPathSecurityError = (er) => {
+    for (let e = er; e && typeof e === 'object'; e = e.cause) {
+        const { code } = e;
+        if (typeof code === 'string' && codes.has(code))
+            return true;
+    }
+    return false;
+};

package/dist/{esm/reify → reify}/add-edge.d.ts

@@ -7,4 +7,3 @@ import type { Edge } from '../edge.ts';
  * until scripts are run, in the case of non-store deps like workspaces
  */
 export declare const addEdge: (edge: Edge, scurry: PathScurry, remover: RollbackRemove, bins?: Record<string, string>) => Promise<void>;
-//# sourceMappingURL=add-edge.d.ts.map

package/dist/{esm/reify → reify}/add-edge.js

@@ -1,10 +1,17 @@
 import { cmdShimIfExists } from '@vltpkg/cmd-shim';
 import { mkdir, symlink } from 'node:fs/promises';
-import { dirname, relative } from 'node:path';
+import { dirname, relative, resolve } from 'node:path';
 const clobberSymlink = async (target, link, remover, type = 'file') => {
+    // On Windows, directory symlinks require elevated privileges.
+    // Use junctions instead, which work without special permissions.
+    // Junctions require absolute target paths, so resolve relative targets.
+    const symlinkType = type === 'dir' && process.platform === 'win32' ? 'junction' : type;
+    const symlinkTarget = symlinkType === 'junction' ?
+        resolve(dirname(link), target)
+        : target;
     await mkdir(dirname(link), { recursive: true });
     try {
-        await symlink(target, link, type);
+        await symlink(symlinkTarget, link, symlinkType);
     }
     catch (er) {
         /* c8 ignore start */
@@ -16,7 +23,7 @@ const clobberSymlink = async (target, link, remover, type = 'file') => {
         await remover.rm(link);
         try {
             // then try to create it again
-            await symlink(target, link, type);
+            await symlink(symlinkTarget, link, symlinkType);
             /* c8 ignore start */
         }
         catch (er) {
@@ -62,4 +69,3 @@ export const addEdge = async (edge, scurry, remover, bins) => {
     if (promises.length)
         await Promise.all(promises);
 };
-//# sourceMappingURL=add-edge.js.map

package/dist/{esm/reify → reify}/add-edges.d.ts

@@ -2,4 +2,3 @@ import type { RollbackRemove } from '@vltpkg/rollback-remove';
 import type { PathScurry } from 'path-scurry';
 import type { Diff } from '../diff.ts';
 export declare const addEdges: (diff: Diff, scurry: PathScurry, remover: RollbackRemove) => (() => Promise<unknown>)[];
-//# sourceMappingURL=add-edges.d.ts.map

package/dist/{esm/reify → reify}/add-edges.js

@@ -10,4 +10,3 @@ export const addEdges = (diff, scurry, remover) => {
     }
     return actions;
 };
-//# sourceMappingURL=add-edges.js.map

package/dist/{esm/reify → reify}/add-nodes.d.ts

@@ -4,4 +4,3 @@ import type { SpecOptions } from '@vltpkg/spec';
 import type { PathScurry } from 'path-scurry';
 import type { Diff } from '../diff.ts';
 export declare const addNodes: (diff: Diff, scurry: PathScurry, remover: RollbackRemove, options: SpecOptions, packageInfo: PackageInfoClient) => (() => Promise<unknown>)[];
-//# sourceMappingURL=add-nodes.d.ts.map

package/dist/{esm/reify → reify}/add-nodes.js

@@ -14,4 +14,3 @@ export const addNodes = (diff, scurry, remover, options, packageInfo) => {
     }
     return actions;
 };
-//# sourceMappingURL=add-nodes.js.map

package/dist/{esm/reify → reify}/bin-chmod.d.ts

@@ -8,4 +8,3 @@ export declare const binChmodAll: (nodes: Iterable<Node>, scurry: PathScurry) =>
  * Make all the package's bins executable.
  */
 export declare const binChmod: (node: Node, scurry: PathScurry) => Promise<void>;
-//# sourceMappingURL=bin-chmod.d.ts.map

package/dist/{esm/reify → reify}/bin-chmod.js

@@ -36,4 +36,3 @@ const makeExecutable = async (path) => {
     }
     await chmod(path, execMode);
 };
-//# sourceMappingURL=bin-chmod.js.map

package/dist/{esm/reify → reify}/build.d.ts

@@ -11,4 +11,3 @@ export type BuildResult = {
     failure: Node[];
 };
 export declare const build: (diff: Diff, packageJson: PackageJson, scurry: PathScurry, allowScriptsNodes: Set<DepID>) => Promise<BuildResult>;
-//# sourceMappingURL=build.d.ts.map

package/dist/{esm/reify → reify}/build.js

@@ -1,8 +1,9 @@
 // walk the graph of added nodes, building and chmoding their bins
 // at the end, we get back to the importers, and run their prepare
 // script as well as install script.
+import { join } from 'node:path';
 import { run } from '@vltpkg/run';
-import { graphRun } from 'graph-run';
+import { graphRun } from '@vltpkg/graph-run';
 import { nonEmptyList } from "../non-empty-list.js";
 import { optionalFail } from "./optional-fail.js";
 import { binChmod } from "./bin-chmod.js";
@@ -71,8 +72,16 @@ const visit = async (packageJson, scurry, node, signal, _path) => {
     const { manifest } = node;
     const { scripts = {} } = manifest;
     const { install, preinstall, postinstall, prepare, preprepare, postprepare, } = scripts;
-    // if it has install script, run it
-    const runInstall = !!(install || preinstall || postinstall);
+    // Check for binding.gyp file (npm's implicit install detection)
+    // "If there is a binding.gyp file in the root of your package and you
+    // haven't defined your own install or preinstall scripts, npm will default
+    // the install command to compile using node-gyp via node-gyp rebuild"
+    const hasBindingGyp = scurry
+        .lstatSync(join(node.resolvedLocation(scurry), 'binding.gyp'))
+        ?.isFile() ?? false;
+    const hasImplicitInstall = hasBindingGyp && !install && !preinstall;
+    // if it has install script or binding.gyp (implicit install), run it
+    const runInstall = !!(install || preinstall || postinstall) || hasImplicitInstall;
     if (runInstall) {
         await run({
             signal,
@@ -100,4 +109,3 @@ const visit = async (packageJson, scurry, node, signal, _path) => {
     }
     await binChmod(node, scurry);
 };
-//# sourceMappingURL=build.js.map

package/dist/{esm/reify → reify}/calculate-save-value.d.ts

@@ -1,3 +1,2 @@
 import type { Spec } from '@vltpkg/spec';
-export declare const calculateSaveValue: (nodeType: string, spec: Spec, existing: string | undefined, nodeVersion: string | undefined) => string;
-//# sourceMappingURL=calculate-save-value.d.ts.map
+export declare const calculateSaveValue: (nodeType: string, spec: Spec, existing: string | undefined, nodeVersion: string | undefined, saveExact?: boolean, savePrefix?: string) => string;

package/dist/{esm/reify → reify}/calculate-save-value.js

@@ -1,5 +1,11 @@
-const SAVE_PREFIX = '^';
-export const calculateSaveValue = (nodeType, spec, existing, nodeVersion) => {
+const DEFAULT_SAVE_PREFIX = '^';
+export const calculateSaveValue = (nodeType, spec, existing, nodeVersion, saveExact, savePrefix) => {
+    // Catalog specs should always be preserved as-is in package.json.
+    // The catalog reference (e.g. "catalog:dev") is the user's intent;
+    // the resolved version is tracked in the lockfile.
+    if (spec.type === 'catalog') {
+        return spec.bareSpec;
+    }
     if (
     // if not from the registry, save whatever we requested
     nodeType === 'registry' &&
@@ -19,8 +25,9 @@ export const calculateSaveValue = (nodeType, spec, existing, nodeVersion) => {
             return existing;
         }
         else {
-            const finalRange = (spec.final.semver && spec.final.bareSpec) ||
-                `${SAVE_PREFIX}${nodeVersion}`;
+            const prefix = saveExact ? '' : (savePrefix ?? DEFAULT_SAVE_PREFIX);
+            const finalRange = (spec.final.semver && !saveExact && spec.final.bareSpec) ||
+                `${prefix}${nodeVersion}`;
             // didn't have dep previously, or depended on a different thing
             // than what was requested. Update with the ^ range based on
             // the node that landed in the graph, but preserve alias prefix
@@ -42,4 +49,3 @@ export const calculateSaveValue = (nodeType, spec, existing, nodeVersion) => {
     }
     return spec.bareSpec;
 };
-//# sourceMappingURL=calculate-save-value.js.map

package/dist/{esm/reify → reify}/check-needed-build.d.ts

@@ -1,3 +1,5 @@
+import type { PathScurry } from 'path-scurry';
+import type { PackageJson } from '@vltpkg/package-json';
 import type { Diff } from '../diff.ts';
 import type { Node } from '../node.ts';
 /**
@@ -14,6 +16,14 @@ export type CheckNeededBuildOptions = {
      * The diff object containing nodes to process
      */
     diff: Diff;
+    /**
+     * PathScurry instance for filesystem access
+     */
+    scurry: PathScurry;
+    /**
+     * PackageJson instance for reading manifests from disk
+     */
+    packageJson: PackageJson;
 };
 /**
  * Check which nodes need to be built and set buildState accordingly
@@ -22,4 +32,3 @@ export type CheckNeededBuildOptions = {
  * @returns {BuildData} The BuildData object containing Node objects that need building
  */
 export declare const checkNeededBuild: (options: CheckNeededBuildOptions) => BuildData;
-//# sourceMappingURL=check-needed-build.d.ts.map

package/dist/reify/check-needed-build.js

@@ -0,0 +1,71 @@
+import { join } from 'node:path';
+/**
+ * Checks if a node needs to be built based on the conditions from build.ts:
+ * 1. Has install lifecycle scripts (install, preinstall, postinstall)
+ * 2. Has binding.gyp file with no install/preinstall scripts (implicit install)
+ * 3. Is an importer or git dependency with prepare scripts (prepare, preprepare, postprepare)
+ * 4. Has binary files that need to be linked
+ */
+const nodeNeedsBuild = (node, scurry, packageJson) => {
+    // If the node has already been built during reify, no need to build again
+    if (node.built)
+        return false;
+    // If the manifest is not available on the node, read it from disk.
+    // This can happen when the ideal graph is loaded from a lockfile
+    // and there's no actual graph available to hydrate the manifest data from.
+    let manifest = node.manifest;
+    if (!manifest) {
+        try {
+            manifest = packageJson.read(node.resolvedLocation(scurry));
+            node.manifest = manifest;
+        }
+        catch {
+            // If the manifest cannot be read (missing/corrupted), treat as
+            // "no build needed" to avoid failing the entire reification.
+            return false;
+        }
+    }
+    const { scripts = {} } = manifest;
+    // Check for install lifecycle scripts
+    const runInstall = !!(scripts.install ||
+        scripts.preinstall ||
+        scripts.postinstall);
+    if (runInstall)
+        return true;
+    // Check for binding.gyp file (npm's implicit install detection)
+    // "If there is a binding.gyp file in the root of your package and you
+    // haven't defined your own install or preinstall scripts, npm will default
+    // the install command to compile using node-gyp via node-gyp rebuild"
+    const hasBindingGyp = scurry
+        .lstatSync(join(node.resolvedLocation(scurry), 'binding.gyp'))
+        ?.isFile() ?? false;
+    if (hasBindingGyp && !scripts.install && !scripts.preinstall)
+        return true;
+    // Check for prepare scripts on importers or git dependencies
+    const prepable = node.id.startsWith('git') || node.importer || !node.inVltStore();
+    const runPrepare = !!(scripts.prepare || scripts.preprepare || scripts.postprepare
+    /* c8 ignore next 2 */
+    ) && prepable;
+    if (runPrepare)
+        return true;
+    return false;
+};
+/**
+ * Check which nodes need to be built and set buildState accordingly
+ * Marks nodes with buildState = 'needed' for those that require
+ * install lifecycle scripts as part of `vlt build`
+ * @returns {BuildData} The BuildData object containing Node objects that need building
+ */
+export const checkNeededBuild = (options) => {
+    const { diff, scurry, packageJson } = options;
+    // Filter nodes to only include those that actually need to be built
+    const nodesToBuild = [...diff.nodes.add].filter(node => nodeNeedsBuild(node, scurry, packageJson));
+    // Set buildState = 'needed' on all nodes that require building
+    for (const node of nodesToBuild) {
+        node.buildState = 'needed';
+    }
+    const buildData = {
+        needsBuildNodes: nodesToBuild,
+    };
+    return buildData;
+};

package/dist/{esm/reify → reify}/delete-edge.d.ts

@@ -2,4 +2,3 @@ import type { RollbackRemove } from '@vltpkg/rollback-remove';
 import type { PathScurry } from 'path-scurry';
 import type { Edge } from '../edge.ts';
 export declare const deleteEdge: (edge: Edge, scurry: PathScurry, remover: RollbackRemove) => Promise<void>;
-//# sourceMappingURL=delete-edge.d.ts.map

package/dist/{esm/reify → reify}/delete-edge.js

@@ -25,4 +25,3 @@ export const deleteEdge = async (edge, scurry, remover) => {
     }
     await Promise.all(promises);
 };
-//# sourceMappingURL=delete-edge.js.map

package/dist/{esm/reify → reify}/delete-edges.d.ts

@@ -2,4 +2,3 @@ import type { RollbackRemove } from '@vltpkg/rollback-remove';
 import type { PathScurry } from 'path-scurry';
 import type { Diff } from '../diff.ts';
 export declare const deleteEdges: (diff: Diff, scurry: PathScurry, remover: RollbackRemove) => (() => Promise<unknown>)[];
-//# sourceMappingURL=delete-edges.d.ts.map

package/dist/{esm/reify → reify}/delete-edges.js

@@ -11,4 +11,3 @@ export const deleteEdges = (diff, scurry, remover) => {
     }
     return promises;
 };
-//# sourceMappingURL=delete-edges.js.map

package/dist/{esm/reify → reify}/delete-nodes.d.ts

@@ -2,4 +2,3 @@ import type { RollbackRemove } from '@vltpkg/rollback-remove';
 import type { PathScurry } from 'path-scurry';
 import type { Diff } from '../diff.ts';
 export declare const deleteNodes: (diff: Diff, remover: RollbackRemove, scurry: PathScurry) => Promise<unknown>[];
-//# sourceMappingURL=delete-nodes.d.ts.map

package/dist/{esm/reify → reify}/delete-nodes.js

@@ -13,4 +13,3 @@ export const deleteNodes = (diff, remover, scurry) => {
     }
     return rmActions;
 };
-//# sourceMappingURL=delete-nodes.js.map

package/dist/{esm/reify → reify}/extract-node.d.ts

@@ -21,4 +21,3 @@ export type ExtractResult = {
  * Returns a promise that resolves when the extraction is complete.
  */
 export declare const extractNode: (node: Node, scurry: PathScurry, remover: RollbackRemove, options: SpecOptions, packageInfo: PackageInfoClient, diff?: Diff) => Promise<ExtractResult>;
-//# sourceMappingURL=extract-node.d.ts.map

package/dist/{esm/reify → reify}/extract-node.js

@@ -42,11 +42,15 @@ export const extractNode = async (node, scurry, remover, options, packageInfo, d
         await remover.rm(target);
         if (removeOptionalFailedNode) {
             try {
-                await packageInfo.extract(spec, target, {
+                const result = await packageInfo.extract(spec, target, {
                     from,
                     integrity,
                     resolved,
                 });
+                // Store computed integrity for git/remote deps
+                if (result.integrity && !node.integrity) {
+                    node.integrity = result.integrity;
+                }
                 return { success: true, node };
             }
             catch (error) {
@@ -55,11 +59,15 @@ export const extractNode = async (node, scurry, remover, options, packageInfo, d
             }
         }
         else {
-            await packageInfo.extract(spec, target, {
+            const result = await packageInfo.extract(spec, target, {
                 from,
                 integrity,
                 resolved,
             });
+            // Store computed integrity for git/remote deps
+            if (result.integrity && !node.integrity) {
+                node.integrity = result.integrity;
+            }
             return { success: true, node };
         }
     }
@@ -73,4 +81,3 @@ export const extractNode = async (node, scurry, remover, options, packageInfo, d
         throw error;
     }
 };
-//# sourceMappingURL=extract-node.js.map

package/dist/{esm/reify → reify}/index.d.ts

@@ -15,6 +15,9 @@ export type ReifyOptions = LoadOptions & {
     packageInfo: PackageInfoClient;
     modifiers?: GraphModifier;
     remover: RollbackRemove;
+    update?: boolean;
+    saveExact?: boolean;
+    savePrefix?: string;
 };
 export type ReifyResult = {
     /**
@@ -31,4 +34,3 @@ export type ReifyResult = {
  * Make the current project match the supplied graph.
  */
 export declare const reify: (options: ReifyOptions) => Promise<ReifyResult>;
-//# sourceMappingURL=index.d.ts.map

package/dist/{esm/reify → reify}/index.js

@@ -67,9 +67,28 @@ export const reify = async (options) => {
     const noModifiedDependencies = !options.add?.modifiedDependencies &&
         !options.remove?.modifiedDependencies;
     const skipOptionalOnly = noModifiedDependencies && diff.optionalOnly;
+    const skippable = skipOptionalOnly && !options.update;
     const res = { diff };
-    if (!diff.hasChanges() || skipOptionalOnly) {
-        // nothing to do, so just return the diff
+    if (!diff.hasChanges() || skippable) {
+        // Even when there are no changes to reify, ensure lockfiles
+        // exist on disk. This handles the case where a project has no
+        // dependencies (or only workspace importers) but still needs
+        // lockfiles written on the first install.
+        if (!scurry.lstatSync('vlt-lock.json') ||
+            !scurry.lstatSync('node_modules/.vlt-lock.json')) {
+            saveHidden(options);
+            const lfData = lockfileData(options);
+            saveData(lfData, scurry.resolve('vlt-lock.json'), false);
+        }
+        // Even with no reify changes, report nodes that still need building.
+        // Build state is persisted in the hidden lockfile and loaded into the
+        // actual graph, so check there for pending builds.
+        const pending = [...actual.nodes.values()]
+            .filter(n => n.buildState === 'needed')
+            .map(n => n.id);
+        if (pending.length) {
+            res.buildQueue = pending;
+        }
         done();
         return res;
     }
@@ -92,7 +111,7 @@ export const reify = async (options) => {
 };
 const reify_ = async (options, diff, remover) => {
     const res = {};
-    const { add, remove, packageInfo, packageJson, scurry, allowScripts, } = options;
+    const { add, remove, packageInfo, packageJson, scurry, allowScripts, saveExact, savePrefix, } = options;
     const saveImportersPackageJson = 
     /* c8 ignore next */
     add?.modifiedDependencies || remove?.modifiedDependencies ?
@@ -101,6 +120,8 @@ const reify_ = async (options, diff, remover) => {
             remove,
             graph: options.graph,
             packageJson,
+            saveExact,
+            savePrefix,
         })
         : undefined;
     // before anything else happens, grab the ideal tree as it was resolved
@@ -119,7 +140,7 @@ const reify_ = async (options, diff, remover) => {
     await internalHoist(diff.to, options, remover);
     // looks up all nodes setting buildState = 'needed'
     // on nodes that require building
-    checkNeededBuild({ diff });
+    checkNeededBuild({ diff, scurry, packageJson });
     // Filter nodes allowed to run scripts if allowScripts query is provided
     const allowScriptsNodes = await filterNodesByQuery(diff.to, allowScripts);
     // ensure that all added bins are chmod +x
@@ -158,4 +179,3 @@ const reify_ = async (options, diff, remover) => {
     // returns the result object
     return res;
 };
-//# sourceMappingURL=index.js.map

package/dist/{esm/reify → reify}/internal-hoist.d.ts

@@ -6,4 +6,3 @@ type InternalHoistOptions = Pick<ReifyOptions, 'projectRoot' | 'scurry'>;
 export declare const pickNodeToHoist: (nodes: Set<Node>) => Node | undefined;
 export declare const internalHoist: (graph: Graph, options: InternalHoistOptions, remover: RollbackRemove) => Promise<void>;
 export {};
-//# sourceMappingURL=internal-hoist.d.ts.map

package/dist/{esm/reify → reify}/internal-hoist.js

@@ -131,4 +131,3 @@ const checkExisting = async (name, entry, links, removes, scurry, remover) => {
         links.delete(name);
     }
 };
-//# sourceMappingURL=internal-hoist.js.map

package/dist/{esm/reify → reify}/optional-fail.d.ts

@@ -13,4 +13,3 @@ export declare function optionalFail(diff: Diff, node: Node & {
     optional: false;
 }): undefined;
 export declare function optionalFail(diff: Diff, node: Node): (() => void) | undefined;
-//# sourceMappingURL=optional-fail.d.ts.map

package/dist/{esm/reify → reify}/optional-fail.js

@@ -13,4 +13,3 @@ const del = (diff, node) => {
     diff.nodes.add.delete(node);
     diff.nodes.delete.add(node);
 };
-//# sourceMappingURL=optional-fail.js.map