@vltpkg/graph 1.1.0 → 1.2.0

package/dist/node.d.ts

@@ -128,6 +128,11 @@ export declare class Node implements NodeLike {
      * Record of binary names to their paths in the package, if any.
      */
     bins?: Record<string, string>;
+    /**
+     * True if the package has a root binding.gyp, when known without a
+     * disk check (placed from the global store). Not persisted.
+     */
+    bindingGyp?: boolean;
     /**
      * True if this node has been built as part of the reify step.
      */

package/dist/node.js

@@ -160,6 +160,11 @@ export class Node {
      * Record of binary names to their paths in the package, if any.
      */
     bins;
+    /**
+     * True if the package has a root binding.gyp, when known without a
+     * disk check (placed from the global store). Not persisted.
+     */
+    bindingGyp;
     /**
      * True if this node has been built as part of the reify step.
      */

package/dist/reify/bin-chmod.js

@@ -1,4 +1,4 @@
-import { statSync, existsSync } from 'node:fs';
+import { statSync } from 'node:fs';
 import { chmod } from 'node:fs/promises';
 /**
  * Make all the packages' bins executable.
@@ -19,20 +19,20 @@ export const binChmod = async (node, scurry) => {
         return;
     for (const bin of Object.values(node.bins)) {
         const path = scurry.resolve(`${node.resolvedLocation(scurry)}/${bin}`);
-        // only try to make executable if the file exists
-        if (existsSync(path)) {
-            chmods.push(makeExecutable(path));
+        let mode;
+        try {
+            mode = statSync(path).mode;
         }
+        catch {
+            // missing or unreadable (ENOENT, ELOOP, EACCES): skip
+            continue;
+        }
+        // a file linked from the global store is executable already, and
+        // chmod would change the store
+        if ((mode & 0o111) === 0o111)
+            continue;
+        // `| 0o111` keeps group-writable files at 0o775
+        chmods.push(chmod(path, (mode & 0o777) | 0o111));
     }
     await Promise.all(chmods);
 };
-// 0 is "not yet set"
-// This is defined by doing `0o111 | <mode>` so that systems
-// that create files group-writable result in 0o775 instead of 0o755
-let execMode = 0;
-const makeExecutable = async (path) => {
-    if (!execMode) {
-        execMode = (statSync(path).mode & 0o777) | 0o111;
-    }
-    await chmod(path, execMode);
-};

package/dist/reify/binding-gyp.d.ts

@@ -0,0 +1,8 @@
+import type { PathScurry } from 'path-scurry';
+import type { Node } from '../node.ts';
+/**
+ * True if the package has a root binding.gyp (implicit install). Known
+ * from the global store index, else checked on disk past the path
+ * cache, which may still hold ENOENT from before the extraction.
+ */
+export declare const hasBindingGyp: (node: Node, scurry: PathScurry) => boolean;

package/dist/reify/binding-gyp.js

@@ -0,0 +1,19 @@
+import { lstatSync } from 'node:fs';
+import { join } from 'node:path';
+const onDisk = (dir) => {
+    try {
+        return !!lstatSync(join(dir, 'binding.gyp'), {
+            throwIfNoEntry: false,
+        })?.isFile();
+    }
+    catch {
+        // e.g. ENOTDIR, location is a file
+        return false;
+    }
+};
+/**
+ * True if the package has a root binding.gyp (implicit install). Known
+ * from the global store index, else checked on disk past the path
+ * cache, which may still hold ENOENT from before the extraction.
+ */
+export const hasBindingGyp = (node, scurry) => node.bindingGyp ?? onDisk(node.resolvedLocation(scurry));

package/dist/reify/build.js

@@ -1,12 +1,12 @@
 // walk the graph of added nodes, building and chmoding their bins
 // at the end, we get back to the importers, and run their prepare
 // script as well as install script.
-import { join } from 'node:path';
 import { run } from '@vltpkg/run';
 import { graphRun } from '@vltpkg/graph-run';
 import { nonEmptyList } from "../non-empty-list.js";
 import { optionalFail } from "./optional-fail.js";
 import { binChmod } from "./bin-chmod.js";
+import { hasBindingGyp } from "./binding-gyp.js";
 import { scriptsManifest } from "./scripts-manifest.js";
 export const build = async (diff, packageJson, scurry, allowScriptsNodes) => {
     const graph = diff.to;
@@ -78,10 +78,7 @@ const visit = async (packageJson, scurry, node, signal, _path) => {
     // "If there is a binding.gyp file in the root of your package and you
     // haven't defined your own install or preinstall scripts, npm will default
     // the install command to compile using node-gyp via node-gyp rebuild"
-    const hasBindingGyp = scurry
-        .lstatSync(join(node.resolvedLocation(scurry), 'binding.gyp'))
-        ?.isFile() ?? false;
-    const hasImplicitInstall = hasBindingGyp && !install && !preinstall;
+    const hasImplicitInstall = hasBindingGyp(node, scurry) && !install && !preinstall;
     // if it has install script or binding.gyp (implicit install), run it
     const runInstall = !!(install || preinstall || postinstall) || hasImplicitInstall;
     if (runInstall) {

package/dist/reify/check-needed-build.js

@@ -1,4 +1,4 @@
-import { join } from 'node:path';
+import { hasBindingGyp } from "./binding-gyp.js";
 import { scriptsManifest } from "./scripts-manifest.js";
 /**
  * Checks if a node needs to be built based on the conditions from build.ts:
@@ -38,10 +38,9 @@ const nodeNeedsBuild = (node, scurry, packageJson) => {
     // "If there is a binding.gyp file in the root of your package and you
     // haven't defined your own install or preinstall scripts, npm will default
     // the install command to compile using node-gyp via node-gyp rebuild"
-    const hasBindingGyp = scurry
-        .lstatSync(join(node.resolvedLocation(scurry), 'binding.gyp'))
-        ?.isFile() ?? false;
-    if (hasBindingGyp && !scripts.install && !scripts.preinstall)
+    if (hasBindingGyp(node, scurry) &&
+        !scripts.install &&
+        !scripts.preinstall)
         return true;
     // Check for prepare scripts on importers or git dependencies
     const prepable = node.id.startsWith('git') || node.importer || !node.inVltStore();

package/dist/reify/extract-node.js

@@ -1,5 +1,6 @@
 import { hydrate } from '@vltpkg/dep-id';
 import { platformCheck } from '@vltpkg/pick-manifest';
+import { asManifest, normalizeManifest } from '@vltpkg/types';
 import { optionalFail } from "./optional-fail.js";
 import { removeOptionalSubgraph } from "../remove-optional-subgraph.js";
 /**
@@ -38,22 +39,40 @@ export const extractNode = async (node, scurry, remover, options, packageInfo, d
             error: new Error('Platform check failed or package deprecated'),
         };
     }
+    // the registry manifest can declare install scripts that the
+    // tarball's package.json, read by the global store, lacks
+    const { scripts, hasInstallScript } = manifest;
     const extractOptions = {
         from,
         integrity,
         resolved,
         fromLockfile: node.resolvedFromLockfile,
+        installScripts: !!(hasInstallScript ||
+            scripts?.install ||
+            scripts?.preinstall ||
+            scripts?.postinstall),
+    };
+    const extracted = (r) => {
+        // Store computed integrity for git/remote deps
+        if (r.integrity && !node.integrity)
+            node.integrity = r.integrity;
+        // a global store link hands over what reify would read from disk;
+        // same result as reading it back, or left for that on failure
+        if (r.manifest && !node.manifest) {
+            try {
+                node.manifest = normalizeManifest(asManifest(JSON.parse(r.manifest)));
+            }
+            catch { }
+        }
+        if (r.bindingGyp !== undefined)
+            node.bindingGyp = r.bindingGyp;
+        return { success: true, node };
     };
     try {
         await remover.rm(target);
         if (removeOptionalFailedNode) {
             try {
-                const result = await packageInfo.extract(spec, target, extractOptions);
-                // Store computed integrity for git/remote deps
-                if (result.integrity && !node.integrity) {
-                    node.integrity = result.integrity;
-                }
-                return { success: true, node };
+                return extracted(await packageInfo.extract(spec, target, extractOptions));
             }
             catch (error) {
                 removeOptionalFailedNode();
@@ -61,12 +80,7 @@ export const extractNode = async (node, scurry, remover, options, packageInfo, d
             }
         }
         else {
-            const result = await packageInfo.extract(spec, target, extractOptions);
-            // Store computed integrity for git/remote deps
-            if (result.integrity && !node.integrity) {
-                node.integrity = result.integrity;
-            }
-            return { success: true, node };
+            return extracted(await packageInfo.extract(spec, target, extractOptions));
         }
     }
     catch (error) {

package/dist/reify/index.js

@@ -185,6 +185,16 @@ const reify_ = async (options, diff, remover, saveImportersPackageJson) => {
         await Promise.all(rmActions);
     // updates package.json files if anything was added / removed
     saveImportersPackageJson?.();
+    // an integrity first learned while extracting -- a git or remote dep,
+    // or a registry tarball verified against the digest the registry sent
+    // with it -- was not known when lfData was captured above. pin it, so
+    // the next install checks the same bytes.
+    for (const node of diff.nodes.add) {
+        const lfNode = lfData.nodes[node.id];
+        if (lfNode && node.integrity && !lfNode[2]) {
+            lfNode[2] = node.integrity;
+        }
+    }
     // write the ideal graph data to the lockfile
     saveData(lfData, scurry.resolve('vlt-lock.json'), false);
     // update the store config reference if a config file was used

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.1.0",
-    "@vltpkg/dep-id": "1.1.0",
-    "@vltpkg/dss-breadcrumb": "1.1.0",
-    "@vltpkg/error-cause": "1.1.0",
-    "@vltpkg/fast-split": "1.1.0",
-    "@vltpkg/graph-run": "1.1.0",
-    "@vltpkg/init": "1.1.0",
-    "@vltpkg/output": "1.1.0",
-    "@vltpkg/package-info": "1.1.0",
-    "@vltpkg/package-json": "1.1.0",
-    "@vltpkg/pick-manifest": "1.1.0",
-    "@vltpkg/query": "1.1.0",
-    "@vltpkg/rollback-remove": "1.1.0",
-    "@vltpkg/run": "1.1.0",
-    "@vltpkg/satisfies": "1.1.0",
-    "@vltpkg/security-archive": "1.1.0",
-    "@vltpkg/spec": "1.1.0",
-    "@vltpkg/types": "1.1.0",
-    "@vltpkg/vlt-json": "1.1.0",
-    "@vltpkg/workspaces": "1.1.0",
+    "@vltpkg/cmd-shim": "1.2.0",
+    "@vltpkg/dep-id": "1.2.0",
+    "@vltpkg/dss-breadcrumb": "1.2.0",
+    "@vltpkg/error-cause": "1.2.0",
+    "@vltpkg/fast-split": "1.2.0",
+    "@vltpkg/graph-run": "1.2.0",
+    "@vltpkg/init": "1.2.0",
+    "@vltpkg/output": "1.2.0",
+    "@vltpkg/package-info": "1.2.0",
+    "@vltpkg/package-json": "1.2.0",
+    "@vltpkg/pick-manifest": "1.2.0",
+    "@vltpkg/query": "1.2.0",
+    "@vltpkg/rollback-remove": "1.2.0",
+    "@vltpkg/run": "1.2.0",
+    "@vltpkg/satisfies": "1.2.0",
+    "@vltpkg/security-archive": "1.2.0",
+    "@vltpkg/spec": "1.2.0",
+    "@vltpkg/types": "1.2.0",
+    "@vltpkg/vlt-json": "1.2.0",
+    "@vltpkg/workspaces": "1.2.0",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },
@@ -41,7 +41,7 @@
     "@types/node": "^22.19.2",
     "eslint": "^9.39.1",
     "prettier": "^3.7.4",
-    "tap": "^21.5.0",
+    "tap": "^21.8.0",
     "tar": "^7.5.2",
     "typedoc": "~0.27.9",
     "typescript": "5.7.3",