@vltpkg/graph 1.1.1 → 1.3.0

package/dist/graph.js

@@ -427,7 +427,11 @@ export class Graph {
                     toFoundNode.manifest = manifest;
                     this.manifests.set(toFoundNode.id, manifest);
                 }
-                toFoundNode.integrity ??= manifest.dist?.integrity;
+                // never onto a node resolved to a `.tar.br`: `dist.integrity`
+                // is the `.tgz` hash, a different artifact's bytes
+                if (!toFoundNode.brotli) {
+                    toFoundNode.integrity ??= manifest.dist?.integrity;
+                }
             }
             return toFoundNode;
         }
@@ -455,7 +459,10 @@ export class Graph {
         toNode.optional = flags.optional;
         if (samePackage)
             copyPackageMetadata(toNode, samePackage);
-        toNode.integrity ??= manifest?.dist?.integrity;
+        // not onto a node bound for the `.tar.br`: `dist.integrity` is the
+        // `.tgz` hash, and that is a different artifact's bytes
+        if (!toNode.brotli)
+            toNode.integrity ??= manifest?.dist?.integrity;
         // split extra into modifier and peerSetHash
         if (extra) {
             const { modifier, peerSetHash } = splitExtra(extra);

package/dist/lockfile/load-nodes.js

@@ -68,10 +68,13 @@ export const loadNodes = (graph, nodes, options, actual, throwOnMissingManifest)
                 node.peerSetHash = peerSetHash;
             }
         }
-        const { dev, optional } = getBooleanFlagsFromNum(flags);
+        const { dev, optional, brotli } = getBooleanFlagsFromNum(flags);
         node.options = options;
         node.dev = dev;
         node.optional = optional;
+        // before setResolved(), which needs it to pick the extension for a
+        // node whose `resolved` the lockfile left out
+        node.brotli = brotli;
         node.integrity = integrity ?? referenceNode?.integrity;
         node.resolved =
             type === 'remote' ? filepath : ((resolved ?? referenceNode?.resolved));

package/dist/lockfile/types.d.ts

@@ -57,19 +57,30 @@ export declare const LOCKFILE_VERSION = 1;
 export declare const getFlagNumFromNode: (node: {
     optional?: boolean;
     dev?: boolean;
-}) => 1 | 0 | 2 | 3;
+    brotli?: boolean;
+}) => LockfileNodeFlags;
 export declare const getBooleanFlagsFromNum: (flags: LockfileNodeFlags) => {
     dev: boolean;
     optional: boolean;
+    brotli: boolean;
 };
 export declare const LockfileNodeFlagNone = 0;
 export declare const LockfileNodeFlagOptional = 1;
 export declare const LockfileNodeFlagDev = 2;
 export declare const LockfileNodeFlagDevOptional = 3;
 /**
- * Bit flags indicating whether a node is optional and/or dev.
+ * This node's artifact is the registry's Brotli (`.tar.br`) tarball, so
+ * `integrity` is that artifact's hash. Carried as a flag bit rather than a
+ * field because a default-registry node writes no `resolved` at all --
+ * `Node.setResolved()` rebuilds the URL, and this is what tells it which
+ * extension to rebuild.
  */
-export type LockfileNodeFlags = 0 | 1 | 2 | 3;
+export declare const LockfileNodeFlagBrotli = 4;
+/**
+ * Bit flags indicating whether a node is optional, dev, and/or served as
+ * a Brotli tarball.
+ */
+export type LockfileNodeFlags = 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
 /**
  * Build state constants for lockfile nodes
  */

package/dist/lockfile/types.js

@@ -4,18 +4,26 @@
  * Bump when making breaking format changes.
  */
 export const LOCKFILE_VERSION = 1;
-export const getFlagNumFromNode = (node) => node.optional && node.dev ? LockfileNodeFlagDevOptional
-    : node.optional ? LockfileNodeFlagOptional
-        : node.dev ? LockfileNodeFlagDev
-            : LockfileNodeFlagNone;
+export const getFlagNumFromNode = (node) => ((node.optional ? LockfileNodeFlagOptional : 0) |
+    (node.dev ? LockfileNodeFlagDev : 0) |
+    (node.brotli ? LockfileNodeFlagBrotli : 0));
 export const getBooleanFlagsFromNum = (flags) => ({
     dev: !!(flags & LockfileNodeFlagDev),
     optional: !!(flags & LockfileNodeFlagOptional),
+    brotli: !!(flags & LockfileNodeFlagBrotli),
 });
 export const LockfileNodeFlagNone = 0;
 export const LockfileNodeFlagOptional = 1;
 export const LockfileNodeFlagDev = 2;
 export const LockfileNodeFlagDevOptional = 3;
+/**
+ * This node's artifact is the registry's Brotli (`.tar.br`) tarball, so
+ * `integrity` is that artifact's hash. Carried as a flag bit rather than a
+ * field because a default-registry node writes no `resolved` at all --
+ * `Node.setResolved()` rebuilds the URL, and this is what tells it which
+ * extension to rebuild.
+ */
+export const LockfileNodeFlagBrotli = 4;
 /**
  * Build state constants for lockfile nodes
  */

package/dist/node.d.ts

@@ -7,6 +7,11 @@ import type { Graph } from './graph.ts';
 export type NodeOptions = SpecOptions & {
     projectRoot: string;
     graph: GraphLike;
+    /**
+     * Resolve to a version's Brotli (`.tar.br`) alternate when its manifest
+     * advertises one. Defaults to true; false always resolves to the `.tgz`.
+     */
+    'brotli-tarballs'?: boolean;
 };
 export declare class Node implements NodeLike {
     #private;
@@ -85,6 +90,16 @@ export declare class Node implements NodeLike {
      * The manifest this node represents in the graph.
      */
     manifest?: NormalizedManifest;
+    /**
+     * True when this node's artifact is the registry's Brotli (`.tar.br`)
+     * tarball rather than the gzip `.tgz`, which makes `integrity` that
+     * artifact's hash. `resolved` is authoritative whenever it is set, so
+     * the two can never drift; the stored bit only carries the lockfile's
+     * answer across to `setResolved()`, which has to know the extension
+     * before it can build the URL.
+     */
+    get brotli(): boolean;
+    set brotli(brotli: boolean);
     /**
      * Project where this node resides
      */
@@ -128,6 +143,11 @@ export declare class Node implements NodeLike {
      * Record of binary names to their paths in the package, if any.
      */
     bins?: Record<string, string>;
+    /**
+     * True if the package has a root binding.gyp, when known without a
+     * disk check (placed from the global store). Not persisted.
+     */
+    bindingGyp?: boolean;
     /**
      * True if this node has been built as part of the reify step.
      */

package/dist/node.js

@@ -1,8 +1,15 @@
 import { isPackageNameConfused, getId, hydrateTuple, splitDepID, } from '@vltpkg/dep-id';
 import { typeError } from '@vltpkg/error-cause';
-import { expandNormalizedManifestSymbols } from '@vltpkg/types';
+import { brotliTarballName, brotliTarballUrl, expandNormalizedManifestSymbols, tarballFormat, } from '@vltpkg/types';
 import { Edge } from "./edge.js";
 import { stringifyNode } from "./stringify-node.js";
+/**
+ * The absolute URL of a version's Brotli (`.tar.br`) tarball. `dist`
+ * arrives here with an absolute `tarball`, so the alternate's relative
+ * reference resolves against it. See {@link brotliTarballUrl} for which
+ * references this client accepts.
+ */
+const brotliAlternate = (dist) => brotliTarballUrl(dist?.tarball, dist?.alternates);
 export class Node {
     get [Symbol.toStringTag]() {
         return '@vltpkg/graph.Node';
@@ -110,6 +117,31 @@ export class Node {
      * The manifest this node represents in the graph.
      */
     manifest;
+    /**
+     * Whether this node's artifact is the `.tar.br`: from the manifest's
+     * `dist.alternates` at construction, or overwritten by the lockfile's
+     * flag bit when the node came from one (so an existing lockfile keeps
+     * whichever artifact it pinned). Only consulted while `resolved` is
+     * still unset -- once there is a URL, it is the answer (see the
+     * getter).
+     */
+    #brotli = false;
+    /**
+     * True when this node's artifact is the registry's Brotli (`.tar.br`)
+     * tarball rather than the gzip `.tgz`, which makes `integrity` that
+     * artifact's hash. `resolved` is authoritative whenever it is set, so
+     * the two can never drift; the stored bit only carries the lockfile's
+     * answer across to `setResolved()`, which has to know the extension
+     * before it can build the URL.
+     */
+    get brotli() {
+        return this.resolved ?
+            tarballFormat(this.resolved) === 'brotli'
+            : this.#brotli;
+    }
+    set brotli(brotli) {
+        this.#brotli = brotli;
+    }
     /**
      * Project where this node resides
      */
@@ -160,6 +192,11 @@ export class Node {
      * Record of binary names to their paths in the package, if any.
      */
     bins;
+    /**
+     * True if the package has a root binding.gyp, when known without a
+     * disk check (placed from the global store). Not persisted.
+     */
+    bindingGyp;
     /**
      * True if this node has been built as part of the reify step.
      */
@@ -240,6 +277,13 @@ export class Node {
         }
         this.graph = options.graph;
         this.manifest = manifest;
+        // Settled here, not in setResolved(), because `integrity` is filled
+        // in from `dist.integrity` between the two -- and that hash is the
+        // `.tgz`'s. A node whose artifact is the `.tar.br` has to be able to
+        // turn that down before it arrives.
+        this.#brotli =
+            options['brotli-tarballs'] !== false &&
+                !!brotliAlternate(manifest?.dist);
         this.#name = name || this.manifest?.name;
         this.version = version || this.manifest?.version;
     }
@@ -258,9 +302,26 @@ export class Node {
     }
     #registryNodeResolved(tuple) {
         const spec = hydrateTuple(tuple, this.#name, this.#options);
-        this.resolved =
-            this.manifest?.dist?.tarball || spec.conventionalRegistryTarball;
-        this.integrity ??= this.manifest?.dist?.integrity;
+        const dist = this.manifest?.dist;
+        const tarball = dist?.tarball || spec.conventionalRegistryTarball;
+        const brotli = this.#brotli ?
+            // the manifest's own reference when there is one, and otherwise
+            // the registry's naming for it: same stem as the `.tgz`, a
+            // different extension. That convention is what lets a lockfile
+            // node -- which has no manifest -- spend one flag bit rather
+            // than a second URL.
+            (brotliAlternate(dist) ??
+                (tarball && brotliTarballName(tarball)))
+            : undefined;
+        if (brotli) {
+            this.resolved = brotli;
+            // `dist.integrity` describes the `.tgz`. The `.tar.br` is a
+            // different artifact with a different hash, pinned by its own
+            // `Repr-Digest` on the install that first fetches it.
+            return;
+        }
+        this.resolved = tarball;
+        this.integrity ??= dist?.integrity;
     }
     get options() {
         return this.#options;

package/dist/reify/bin-chmod.js

@@ -1,4 +1,4 @@
-import { statSync, existsSync } from 'node:fs';
+import { statSync } from 'node:fs';
 import { chmod } from 'node:fs/promises';
 /**
  * Make all the packages' bins executable.
@@ -19,20 +19,20 @@ export const binChmod = async (node, scurry) => {
         return;
     for (const bin of Object.values(node.bins)) {
         const path = scurry.resolve(`${node.resolvedLocation(scurry)}/${bin}`);
-        // only try to make executable if the file exists
-        if (existsSync(path)) {
-            chmods.push(makeExecutable(path));
+        let mode;
+        try {
+            mode = statSync(path).mode;
         }
+        catch {
+            // missing or unreadable (ENOENT, ELOOP, EACCES): skip
+            continue;
+        }
+        // a file linked from the global store is executable already, and
+        // chmod would change the store
+        if ((mode & 0o111) === 0o111)
+            continue;
+        // `| 0o111` keeps group-writable files at 0o775
+        chmods.push(chmod(path, (mode & 0o777) | 0o111));
     }
     await Promise.all(chmods);
 };
-// 0 is "not yet set"
-// This is defined by doing `0o111 | <mode>` so that systems
-// that create files group-writable result in 0o775 instead of 0o755
-let execMode = 0;
-const makeExecutable = async (path) => {
-    if (!execMode) {
-        execMode = (statSync(path).mode & 0o777) | 0o111;
-    }
-    await chmod(path, execMode);
-};

package/dist/reify/binding-gyp.d.ts

@@ -0,0 +1,8 @@
+import type { PathScurry } from 'path-scurry';
+import type { Node } from '../node.ts';
+/**
+ * True if the package has a root binding.gyp (implicit install). Known
+ * from the global store index, else checked on disk past the path
+ * cache, which may still hold ENOENT from before the extraction.
+ */
+export declare const hasBindingGyp: (node: Node, scurry: PathScurry) => boolean;

package/dist/reify/binding-gyp.js

@@ -0,0 +1,19 @@
+import { lstatSync } from 'node:fs';
+import { join } from 'node:path';
+const onDisk = (dir) => {
+    try {
+        return !!lstatSync(join(dir, 'binding.gyp'), {
+            throwIfNoEntry: false,
+        })?.isFile();
+    }
+    catch {
+        // e.g. ENOTDIR, location is a file
+        return false;
+    }
+};
+/**
+ * True if the package has a root binding.gyp (implicit install). Known
+ * from the global store index, else checked on disk past the path
+ * cache, which may still hold ENOENT from before the extraction.
+ */
+export const hasBindingGyp = (node, scurry) => node.bindingGyp ?? onDisk(node.resolvedLocation(scurry));

package/dist/reify/build.js

@@ -1,12 +1,12 @@
 // walk the graph of added nodes, building and chmoding their bins
 // at the end, we get back to the importers, and run their prepare
 // script as well as install script.
-import { join } from 'node:path';
 import { run } from '@vltpkg/run';
 import { graphRun } from '@vltpkg/graph-run';
 import { nonEmptyList } from "../non-empty-list.js";
 import { optionalFail } from "./optional-fail.js";
 import { binChmod } from "./bin-chmod.js";
+import { hasBindingGyp } from "./binding-gyp.js";
 import { scriptsManifest } from "./scripts-manifest.js";
 export const build = async (diff, packageJson, scurry, allowScriptsNodes) => {
     const graph = diff.to;
@@ -78,10 +78,7 @@ const visit = async (packageJson, scurry, node, signal, _path) => {
     // "If there is a binding.gyp file in the root of your package and you
     // haven't defined your own install or preinstall scripts, npm will default
     // the install command to compile using node-gyp via node-gyp rebuild"
-    const hasBindingGyp = scurry
-        .lstatSync(join(node.resolvedLocation(scurry), 'binding.gyp'))
-        ?.isFile() ?? false;
-    const hasImplicitInstall = hasBindingGyp && !install && !preinstall;
+    const hasImplicitInstall = hasBindingGyp(node, scurry) && !install && !preinstall;
     // if it has install script or binding.gyp (implicit install), run it
     const runInstall = !!(install || preinstall || postinstall) || hasImplicitInstall;
     if (runInstall) {

package/dist/reify/check-needed-build.js

@@ -1,4 +1,4 @@
-import { join } from 'node:path';
+import { hasBindingGyp } from "./binding-gyp.js";
 import { scriptsManifest } from "./scripts-manifest.js";
 /**
  * Checks if a node needs to be built based on the conditions from build.ts:
@@ -38,10 +38,9 @@ const nodeNeedsBuild = (node, scurry, packageJson) => {
     // "If there is a binding.gyp file in the root of your package and you
     // haven't defined your own install or preinstall scripts, npm will default
     // the install command to compile using node-gyp via node-gyp rebuild"
-    const hasBindingGyp = scurry
-        .lstatSync(join(node.resolvedLocation(scurry), 'binding.gyp'))
-        ?.isFile() ?? false;
-    if (hasBindingGyp && !scripts.install && !scripts.preinstall)
+    if (hasBindingGyp(node, scurry) &&
+        !scripts.install &&
+        !scripts.preinstall)
         return true;
     // Check for prepare scripts on importers or git dependencies
     const prepable = node.id.startsWith('git') || node.importer || !node.inVltStore();

package/dist/reify/extract-node.js

@@ -1,5 +1,6 @@
 import { hydrate } from '@vltpkg/dep-id';
 import { platformCheck } from '@vltpkg/pick-manifest';
+import { asManifest, normalizeManifest } from '@vltpkg/types';
 import { optionalFail } from "./optional-fail.js";
 import { removeOptionalSubgraph } from "../remove-optional-subgraph.js";
 /**
@@ -38,22 +39,40 @@ export const extractNode = async (node, scurry, remover, options, packageInfo, d
             error: new Error('Platform check failed or package deprecated'),
         };
     }
+    // the registry manifest can declare install scripts that the
+    // tarball's package.json, read by the global store, lacks
+    const { scripts, hasInstallScript } = manifest;
     const extractOptions = {
         from,
         integrity,
         resolved,
         fromLockfile: node.resolvedFromLockfile,
+        installScripts: !!(hasInstallScript ||
+            scripts?.install ||
+            scripts?.preinstall ||
+            scripts?.postinstall),
+    };
+    const extracted = (r) => {
+        // Store computed integrity for git/remote deps
+        if (r.integrity && !node.integrity)
+            node.integrity = r.integrity;
+        // a global store link hands over what reify would read from disk;
+        // same result as reading it back, or left for that on failure
+        if (r.manifest && !node.manifest) {
+            try {
+                node.manifest = normalizeManifest(asManifest(JSON.parse(r.manifest)));
+            }
+            catch { }
+        }
+        if (r.bindingGyp !== undefined)
+            node.bindingGyp = r.bindingGyp;
+        return { success: true, node };
     };
     try {
         await remover.rm(target);
         if (removeOptionalFailedNode) {
             try {
-                const result = await packageInfo.extract(spec, target, extractOptions);
-                // Store computed integrity for git/remote deps
-                if (result.integrity && !node.integrity) {
-                    node.integrity = result.integrity;
-                }
-                return { success: true, node };
+                return extracted(await packageInfo.extract(spec, target, extractOptions));
             }
             catch (error) {
                 removeOptionalFailedNode();
@@ -61,12 +80,7 @@ export const extractNode = async (node, scurry, remover, options, packageInfo, d
             }
         }
         else {
-            const result = await packageInfo.extract(spec, target, extractOptions);
-            // Store computed integrity for git/remote deps
-            if (result.integrity && !node.integrity) {
-                node.integrity = result.integrity;
-            }
-            return { success: true, node };
+            return extracted(await packageInfo.extract(spec, target, extractOptions));
         }
     }
     catch (error) {

package/dist/reify/index.js

@@ -185,6 +185,16 @@ const reify_ = async (options, diff, remover, saveImportersPackageJson) => {
         await Promise.all(rmActions);
     // updates package.json files if anything was added / removed
     saveImportersPackageJson?.();
+    // an integrity first learned while extracting -- a git or remote dep,
+    // or a registry tarball verified against the digest the registry sent
+    // with it -- was not known when lfData was captured above. pin it, so
+    // the next install checks the same bytes.
+    for (const node of diff.nodes.add) {
+        const lfNode = lfData.nodes[node.id];
+        if (lfNode && node.integrity && !lfNode[2]) {
+            lfNode[2] = node.integrity;
+        }
+    }
     // write the ideal graph data to the lockfile
     saveData(lfData, scurry.resolve('vlt-lock.json'), false);
     // update the store config reference if a config file was used

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.1.1",
+  "version": "1.3.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.1.1",
-    "@vltpkg/dep-id": "1.1.1",
-    "@vltpkg/dss-breadcrumb": "1.1.1",
-    "@vltpkg/error-cause": "1.1.1",
-    "@vltpkg/fast-split": "1.1.1",
-    "@vltpkg/graph-run": "1.1.1",
-    "@vltpkg/init": "1.1.1",
-    "@vltpkg/output": "1.1.1",
-    "@vltpkg/package-info": "1.1.1",
-    "@vltpkg/package-json": "1.1.1",
-    "@vltpkg/pick-manifest": "1.1.1",
-    "@vltpkg/query": "1.1.1",
-    "@vltpkg/rollback-remove": "1.1.1",
-    "@vltpkg/run": "1.1.1",
-    "@vltpkg/satisfies": "1.1.1",
-    "@vltpkg/security-archive": "1.1.1",
-    "@vltpkg/spec": "1.1.1",
-    "@vltpkg/types": "1.1.1",
-    "@vltpkg/vlt-json": "1.1.1",
-    "@vltpkg/workspaces": "1.1.1",
+    "@vltpkg/cmd-shim": "1.3.0",
+    "@vltpkg/dep-id": "1.3.0",
+    "@vltpkg/dss-breadcrumb": "1.3.0",
+    "@vltpkg/error-cause": "1.3.0",
+    "@vltpkg/fast-split": "1.3.0",
+    "@vltpkg/graph-run": "1.3.0",
+    "@vltpkg/init": "1.3.0",
+    "@vltpkg/output": "1.3.0",
+    "@vltpkg/package-info": "1.3.0",
+    "@vltpkg/package-json": "1.3.0",
+    "@vltpkg/pick-manifest": "1.3.0",
+    "@vltpkg/query": "1.3.0",
+    "@vltpkg/rollback-remove": "1.3.0",
+    "@vltpkg/run": "1.3.0",
+    "@vltpkg/satisfies": "1.3.0",
+    "@vltpkg/security-archive": "1.3.0",
+    "@vltpkg/spec": "1.3.0",
+    "@vltpkg/types": "1.3.0",
+    "@vltpkg/vlt-json": "1.3.0",
+    "@vltpkg/workspaces": "1.3.0",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },
@@ -41,7 +41,7 @@
     "@types/node": "^22.19.2",
     "eslint": "^9.39.1",
     "prettier": "^3.7.4",
-    "tap": "^21.5.0",
+    "tap": "^21.8.0",
     "tar": "^7.5.2",
     "typedoc": "~0.27.9",
     "typescript": "5.7.3",