@vltpkg/graph 1.0.9 → 1.1.0

package/dist/actual/load.js

@@ -344,8 +344,14 @@ export const load = (options) => {
         }
         // Clean up any pending modifier entries that were never completed
         modifiers?.rollbackActiveEntries();
-        // caches the load result to the hidden lockfile when enabled
-        if (scurry.cwd.resolve('node_modules').lstatSync()?.isDirectory()) {
+        // caches the load result to the hidden lockfile, but only when the
+        // store exists, i.e. this node_modules was built by vlt. a walk over
+        // a node_modules installed by another client finds nothing, and
+        // must not leave a file behind that makes it look like a vlt install.
+        if (scurry.cwd
+            .resolve('node_modules/.vlt')
+            .lstatSync()
+            ?.isDirectory()) {
             saveHidden({
                 ...options,
                 graph,

package/dist/build.d.ts

@@ -23,6 +23,6 @@ export interface BuildOptions extends LoadOptions {
  * 3. Constructs a Diff object representing what needs to be built
  * 4. Filters nodes based on buildState === 'needed'
  * 5. Calls the reify build process with the constructed diff
- * 6. Persists build results to lockfile
+ * 6. Persists build results to the hidden lockfile, when the vlt store exists
  */
 export declare const build: (options: BuildOptions) => Promise<BuildResult>;

package/dist/build.js

@@ -40,7 +40,7 @@ const filterNodesByQuery = async (targetQuery, graph) => {
  * 3. Constructs a Diff object representing what needs to be built
  * 4. Filters nodes based on buildState === 'needed'
  * 5. Calls the reify build process with the constructed diff
- * 6. Persists build results to lockfile
+ * 6. Persists build results to the hidden lockfile, when the vlt store exists
  */
 export const build = async (options) => {
     const { projectRoot, packageJson, monorepo = Monorepo.maybeLoad(projectRoot), scurry, mainManifest = packageJson.read(projectRoot), target, ...loadOptions } = options;
@@ -69,10 +69,19 @@ export const build = async (options) => {
     // this will only build the nodes that need to be built
     // as part of `diff.nodes.add`
     const buildResult = await reifyBuild(diff, packageJson, scurry, targetFilteredNodes);
-    // Save hidden lockfile with updated buildState
-    saveHidden({
-        ...options,
-        graph: actualGraph,
-    });
+    // Save hidden lockfile with updated buildState, but only when the
+    // store exists, i.e. this node_modules was built by vlt. Loading a
+    // node_modules installed by another client finds nothing to build,
+    // and must not leave a file behind that makes it look like a vlt
+    // install. A dependency-less vlt install has no store either, but it
+    // also has no nodes, so there is no build state to persist.
+    if (scurry
+        .lstatSync(scurry.resolve(projectRoot, 'node_modules/.vlt'))
+        ?.isDirectory()) {
+        saveHidden({
+            ...options,
+            graph: actualGraph,
+        });
+    }
     return buildResult;
 };

package/dist/reify/build.js

@@ -7,6 +7,7 @@ import { graphRun } from '@vltpkg/graph-run';
 import { nonEmptyList } from "../non-empty-list.js";
 import { optionalFail } from "./optional-fail.js";
 import { binChmod } from "./bin-chmod.js";
+import { scriptsManifest } from "./scripts-manifest.js";
 export const build = async (diff, packageJson, scurry, allowScriptsNodes) => {
     const graph = diff.to;
     const nodes = nonEmptyList([...graph.importers]);
@@ -68,8 +69,9 @@ const visit = async (packageJson, scurry, node, signal, _path) => {
     // currently nullish, that could happen in a scenario where the ideal
     // graph is from a lockfile and there's no actual graph available
     // to hydrate the manifest data from.
-    node.manifest ??= packageJson.read(node.resolvedLocation(scurry));
-    const { manifest } = node;
+    const dir = node.resolvedLocation(scurry);
+    node.manifest ??= packageJson.read(dir);
+    const manifest = scriptsManifest(node.manifest, dir, packageJson);
     const { scripts = {} } = manifest;
     const { install, preinstall, postinstall, prepare, preprepare, postprepare, } = scripts;
     // Check for binding.gyp file (npm's implicit install detection)

package/dist/reify/check-needed-build.js

@@ -1,4 +1,5 @@
 import { join } from 'node:path';
+import { scriptsManifest } from "./scripts-manifest.js";
 /**
  * Checks if a node needs to be built based on the conditions from build.ts:
  * 1. Has install lifecycle scripts (install, preinstall, postinstall)
@@ -13,17 +14,18 @@ const nodeNeedsBuild = (node, scurry, packageJson) => {
     // If the manifest is not available on the node, read it from disk.
     // This can happen when the ideal graph is loaded from a lockfile
     // and there's no actual graph available to hydrate the manifest data from.
-    let manifest = node.manifest;
-    if (!manifest) {
-        try {
-            manifest = packageJson.read(node.resolvedLocation(scurry));
-            node.manifest = manifest;
-        }
-        catch {
-            // If the manifest cannot be read (missing/corrupted), treat as
-            // "no build needed" to avoid failing the entire reification.
-            return false;
-        }
+    // An abbreviated registry manifest carries `hasInstallScript` in place
+    // of `scripts` and is likewise resolved from disk.
+    let manifest;
+    try {
+        const dir = node.resolvedLocation(scurry);
+        node.manifest ??= packageJson.read(dir);
+        manifest = scriptsManifest(node.manifest, dir, packageJson);
+    }
+    catch {
+        // If the manifest cannot be read (missing/corrupted), treat as
+        // "no build needed" to avoid failing the entire reification.
+        return false;
     }
     const { scripts = {} } = manifest;
     // Check for install lifecycle scripts

package/dist/reify/scripts-manifest.d.ts

@@ -0,0 +1,8 @@
+import type { PackageJson } from '@vltpkg/package-json';
+import type { NormalizedManifest } from '@vltpkg/types';
+/**
+ * The manifest to consult for lifecycle scripts. An abbreviated registry
+ * manifest replaces `scripts` with `hasInstallScript`, in which case the
+ * extracted package.json at `dir` is canonical.
+ */
+export declare const scriptsManifest: (manifest: NormalizedManifest, dir: string, packageJson: PackageJson) => NormalizedManifest;

package/dist/reify/scripts-manifest.js

@@ -0,0 +1,8 @@
+/**
+ * The manifest to consult for lifecycle scripts. An abbreviated registry
+ * manifest replaces `scripts` with `hasInstallScript`, in which case the
+ * extracted package.json at `dir` is canonical.
+ */
+export const scriptsManifest = (manifest, dir, packageJson) => manifest.hasInstallScript && !manifest.scripts ?
+    packageJson.read(dir)
+    : manifest;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.0.9",
+  "version": "1.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.0.9",
-    "@vltpkg/dep-id": "1.0.9",
-    "@vltpkg/dss-breadcrumb": "1.0.9",
-    "@vltpkg/error-cause": "1.0.9",
-    "@vltpkg/fast-split": "1.0.9",
-    "@vltpkg/graph-run": "1.0.9",
-    "@vltpkg/init": "1.0.9",
-    "@vltpkg/output": "1.0.9",
-    "@vltpkg/package-info": "1.0.9",
-    "@vltpkg/package-json": "1.0.9",
-    "@vltpkg/pick-manifest": "1.0.9",
-    "@vltpkg/query": "1.0.9",
-    "@vltpkg/rollback-remove": "1.0.9",
-    "@vltpkg/run": "1.0.9",
-    "@vltpkg/satisfies": "1.0.9",
-    "@vltpkg/security-archive": "1.0.9",
-    "@vltpkg/spec": "1.0.9",
-    "@vltpkg/types": "1.0.9",
-    "@vltpkg/vlt-json": "1.0.9",
-    "@vltpkg/workspaces": "1.0.9",
+    "@vltpkg/cmd-shim": "1.1.0",
+    "@vltpkg/dep-id": "1.1.0",
+    "@vltpkg/dss-breadcrumb": "1.1.0",
+    "@vltpkg/error-cause": "1.1.0",
+    "@vltpkg/fast-split": "1.1.0",
+    "@vltpkg/graph-run": "1.1.0",
+    "@vltpkg/init": "1.1.0",
+    "@vltpkg/output": "1.1.0",
+    "@vltpkg/package-info": "1.1.0",
+    "@vltpkg/package-json": "1.1.0",
+    "@vltpkg/pick-manifest": "1.1.0",
+    "@vltpkg/query": "1.1.0",
+    "@vltpkg/rollback-remove": "1.1.0",
+    "@vltpkg/run": "1.1.0",
+    "@vltpkg/satisfies": "1.1.0",
+    "@vltpkg/security-archive": "1.1.0",
+    "@vltpkg/spec": "1.1.0",
+    "@vltpkg/types": "1.1.0",
+    "@vltpkg/vlt-json": "1.1.0",
+    "@vltpkg/workspaces": "1.1.0",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },