@vltpkg/graph 1.3.2 → 1.3.4

package/dist/ideal/append-nodes.d.ts

@@ -18,7 +18,7 @@ import type { ExplicitAddMap, TransientAddMap, TransientRemoveMap } from './type
  *
  * 1. Process all deps at the current level in parallel
  * 2. After each level, run `postPlacementPeerCheck` to handle peer contexts
- * 3. Collect child deps for the next level
+ * 3. Collect child deps for the next level, each node once
  * 4. Repeat until no more deps to process
  *
  * **Peer Context Isolation**: Each workspace importer gets its own peer context

package/dist/ideal/append-nodes.js

@@ -349,7 +349,10 @@ const fetchManifestsForDeps = async (packageInfo, graph, fromNode, deps, scurry,
             // this is the entry point to fetch calls to retrieve manifests
             // from the build ideal graph point of view
             : packageInfo
-                .manifest(spec, { from })
+                // an explicit tag add revalidates before use
+                .manifest(spec, isExplicit ?
+                { from }
+                : { from, backgroundRevalidate: true })
                 .then(manifest => manifest)
                 .catch((er) => {
                 // optional deps ignored if inaccessible, but a dep that tried
@@ -618,7 +621,7 @@ const processPlacementTasks = async (graph, options, placementTasks, add, modifi
  *
  * 1. Process all deps at the current level in parallel
  * 2. After each level, run `postPlacementPeerCheck` to handle peer contexts
- * 3. Collect child deps for the next level
+ * 3. Collect child deps for the next level, each node once
  * 4. Repeat until no more deps to process
  *
  * **Peer Context Isolation**: Each workspace importer gets its own peer context
@@ -677,8 +680,6 @@ export const appendNodes = async (packageInfo, graph, fromNode, deps, scurry, op
         // Fetch all manifests at this level in parallel without mutating the graph.
         // This phase is read-only to avoid race conditions from network timing.
         const fetchResults = await Promise.all(currentLevelDeps.map(async ({ node, deps: nodeDeps, modifierRefs: nodeModifierRefs, peerContext, depth, }) => {
-            // Cycle prevention: mark as seen when starting to process
-            seen.add(node.id);
             // Fetch manifests and collect tasks (no graph mutations)
             const result = await fetchManifestsForDeps(packageInfo, graph, node, 
             // Sort by name for deterministic ordering (reproducible builds)
@@ -737,17 +738,16 @@ export const appendNodes = async (packageInfo, graph, fromNode, deps, scurry, op
         // ============================================================
         // STEP 3: COLLECT CHILD DEPS FOR NEXT LEVEL
         // ============================================================
+        /* c8 ignore next */
+        const nextDepth = (currentLevelDeps[0]?.depth ?? 0) + 1;
         for (const childDepsToProcess of levelResults) {
             for (const childDep of childDepsToProcess) {
-                // Skip already-seen nodes (cycle prevention)
-                if (!seen.has(childDep.node.id)) {
-                    /* c8 ignore next */
-                    const currentDepth = currentLevelDeps[0]?.depth ?? 0;
-                    nextLevelDeps.push({
-                        ...childDep,
-                        depth: currentDepth + 1,
-                    });
-                }
+                // seen at enqueue: skips cycles and same-level duplicates
+                // (first in sorted order wins)
+                if (seen.has(childDep.node.id))
+                    continue;
+                seen.add(childDep.node.id);
+                nextLevelDeps.push({ ...childDep, depth: nextDepth });
             }
         }
         // Advance to next BFS level

package/dist/ideal/build.js

@@ -3,6 +3,7 @@ import { graphStep } from '@vltpkg/output';
 import { load as loadActual } from "../actual/load.js";
 import { load as loadVirtual } from "../lockfile/load.js";
 import { buildIdealFromStartingGraph } from "./build-ideal-from-starting-graph.js";
+import { prefetchResolve } from "./prefetch-resolve.js";
 import { isPathSecurityError } from "../path-security-error.js";
 import { splitDepID } from '@vltpkg/dep-id';
 const getMap = (m) => m ?? new Map();
@@ -60,6 +61,9 @@ export const build = async (options) => {
             monorepo,
         });
     }
+    // Start resolving the importers' dependencies server-side, one request
+    // to the default registry. manifest() picks the answers up as they land.
+    prefetchResolve(graph, packageInfo, options);
     const res = await buildIdealFromStartingGraph({
         ...options,
         scurry,

package/dist/ideal/prefetch-resolve.d.ts

@@ -0,0 +1,15 @@
+import type { PackageInfoClient } from '@vltpkg/package-info';
+import type { SpecOptions } from '@vltpkg/spec';
+import type { Graph } from '../graph.ts';
+/**
+ * Start a server-side resolve for the importers' dependencies, one request
+ * to the default registry, without waiting for it: the request overlaps
+ * whatever the build does before it asks for its first manifest.
+ *
+ * Fails soft in every direction: a registry that does not serve the
+ * endpoint, a request that errors, and a spec it does not resolve all
+ * leave the per-name path to handle it, exactly as before.
+ */
+export declare const prefetchResolve: (graph: Graph, packageInfo: PackageInfoClient, options: SpecOptions & {
+    modifiers?: unknown;
+}) => number;

package/dist/ideal/prefetch-resolve.js

@@ -0,0 +1,75 @@
+import { detectLibc } from '@vltpkg/pick-manifest';
+/**
+ * Start a server-side resolve for the importers' dependencies, one request
+ * to the default registry, without waiting for it: the request overlaps
+ * whatever the build does before it asks for its first manifest.
+ *
+ * Fails soft in every direction: a registry that does not serve the
+ * endpoint, a request that errors, and a spec it does not resolve all
+ * leave the per-name path to handle it, exactly as before.
+ */
+export const prefetchResolve = (graph, packageInfo, options) => {
+    // a modifier can swap any spec mid-graph, taking the server's whole
+    // closure off the client's real one; those installs resolve locally
+    if (options.modifiers)
+        return 0;
+    const registry = options.registry;
+    if (!registry)
+        return 0;
+    const scopes = Object.keys(options['scoped-registries'] ?? {});
+    // a name under a scoped registry is that registry's; it is not sent to
+    // this one at all, and `stop` keeps the server from walking into it
+    const scoped = (name) => scopes.some(scope => name.startsWith(`${scope}/`));
+    const roots = [];
+    const seen = new Set();
+    for (const importer of graph.importers) {
+        const manifest = importer.manifest;
+        if (!manifest)
+            continue;
+        for (const field of [
+            'dependencies',
+            'devDependencies',
+            'optionalDependencies',
+        ]) {
+            const deps = manifest[field];
+            if (!deps)
+                continue;
+            for (const [name, spec] of Object.entries(deps)) {
+                if (typeof spec !== 'string')
+                    continue;
+                // protocols, workspace and file specs are the client's to resolve
+                if (spec.includes(':') || scoped(name))
+                    continue;
+                const key = `${name}@${spec}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                roots.push({ name, spec });
+            }
+        }
+    }
+    if (!roots.length)
+        return 0;
+    const have = [];
+    for (const node of graph.nodes.values()) {
+        if (node.manifest &&
+            node.name &&
+            node.version &&
+            !scoped(node.name)) {
+            have.push(`${node.name}@${node.version}`);
+        }
+    }
+    packageInfo.prefetchResolve(registry, {
+        roots,
+        have,
+        ...(scopes.length ? { stop: { scopes } } : {}),
+        platform: {
+            os: process.platform,
+            cpu: process.arch,
+            node: process.versions.node,
+            // undefined never serializes, so no libc means the field is absent
+            libc: detectLibc(),
+        },
+    });
+    return roots.length;
+};

package/dist/node.d.ts

@@ -180,6 +180,7 @@ export declare class Node implements NodeLike {
     set location(location: string);
     /**
      * The resolved location of the node in the file system.
+     * Memoized per location and scurry cwd.
      */
     resolvedLocation(scurry: PathScurry): string;
     /**

package/dist/node.js

@@ -16,6 +16,7 @@ export class Node {
     }
     #options;
     #location;
+    #resolvedLoc;
     #rawManifest;
     #optional = false;
     /**
@@ -243,9 +244,17 @@ export class Node {
     }
     /**
      * The resolved location of the node in the file system.
+     * Memoized per location and scurry cwd.
      */
     resolvedLocation(scurry) {
-        return scurry.cwd.resolve(this.location).fullpath();
+        const loc = this.location;
+        const { cwd } = scurry;
+        const m = this.#resolvedLoc;
+        if (m?.loc === loc && m.cwd === cwd)
+            return m.path;
+        const path = cwd.resolve(loc).fullpath();
+        this.#resolvedLoc = { loc, cwd, path };
+        return path;
     }
     /**
      * The location of the node_modules folder where this node's edgesOut
@@ -257,9 +266,11 @@ export class Node {
      */
     nodeModules(scurry) {
         const loc = this.resolvedLocation(scurry);
-        return this.inVltStore() ?
-            loc.substring(0, loc.length - this.name.length - 1)
-            : scurry.resolve(loc, 'node_modules');
+        if (this.inVltStore()) {
+            return loc.substring(0, loc.length - this.name.length - 1);
+        }
+        const { sep } = scurry.cwd;
+        return (loc.endsWith(sep) ? loc : loc + sep) + 'node_modules';
     }
     constructor(options, id, manifest, spec, name, version) {
         this.#options = options;

package/dist/reify/add-edge.js

@@ -1,6 +1,7 @@
 import { cmdShimIfExists } from '@vltpkg/cmd-shim';
-import { mkdir, symlink } from 'node:fs/promises';
+import { symlinkSync } from 'node:fs';
 import { dirname, relative, resolve } from 'node:path';
+import { symlinkSyncMkdirp } from "./symlink-sync.js";
 const clobberSymlink = async (target, link, remover, type = 'file') => {
     // On Windows, directory symlinks require elevated privileges.
     // Use junctions instead, which work without special permissions.
@@ -9,9 +10,8 @@ const clobberSymlink = async (target, link, remover, type = 'file') => {
     const symlinkTarget = symlinkType === 'junction' ?
         resolve(dirname(link), target)
         : target;
-    await mkdir(dirname(link), { recursive: true });
     try {
-        await symlink(symlinkTarget, link, symlinkType);
+        symlinkSyncMkdirp(symlinkTarget, link, symlinkType);
     }
     catch (er) {
         /* c8 ignore start */
@@ -23,7 +23,7 @@ const clobberSymlink = async (target, link, remover, type = 'file') => {
         await remover.rm(link);
         try {
             // then try to create it again
-            await symlink(symlinkTarget, link, symlinkType);
+            symlinkSync(symlinkTarget, link, symlinkType);
             /* c8 ignore start */
         }
         catch (er) {
@@ -44,8 +44,10 @@ const clobberSymlink = async (target, link, remover, type = 'file') => {
 export const addEdge = async (edge, scurry, remover, bins) => {
     if (!edge.to)
         return;
-    const binRoot = scurry.resolve(edge.from.nodeModules(scurry), '.bin');
-    const path = scurry.resolve(edge.from.nodeModules(scurry), edge.spec.name);
+    const { sep } = scurry.cwd;
+    const nm = edge.from.nodeModules(scurry);
+    const binRoot = nm + sep + '.bin';
+    const path = nm + sep + edge.spec.name.replace('/', sep);
     const promises = [];
     const target = relative(dirname(path), edge.to.resolvedLocation(scurry));
     // can only parallelize this on posix, because the win32 shims
@@ -57,8 +59,8 @@ export const addEdge = async (edge, scurry, remover, bins) => {
         promises.push(p);
     if (bins) {
         for (const [key, val] of Object.entries(bins)) {
-            const link = scurry.resolve(binRoot, key);
-            const absTarget = scurry.resolve(path, val);
+            const link = resolve(binRoot, key);
+            const absTarget = resolve(path, val);
             const target = relative(binRoot, absTarget);
             // TODO: bash/cmd/ps1 shims on Windows
             promises.push(process.platform === 'win32' ?

package/dist/reify/bin-chmod.js

@@ -1,5 +1,6 @@
 import { statSync } from 'node:fs';
 import { chmod } from 'node:fs/promises';
+import { join } from 'node:path';
 /**
  * Make all the packages' bins executable.
  */
@@ -18,7 +19,7 @@ export const binChmod = async (node, scurry) => {
     if (!node.bins)
         return;
     for (const bin of Object.values(node.bins)) {
-        const path = scurry.resolve(`${node.resolvedLocation(scurry)}/${bin}`);
+        const path = join(node.resolvedLocation(scurry), bin);
         let mode;
         try {
             mode = statSync(path).mode;

package/dist/reify/build.js

@@ -8,6 +8,7 @@ import { optionalFail } from "./optional-fail.js";
 import { binChmod } from "./bin-chmod.js";
 import { hasBindingGyp } from "./binding-gyp.js";
 import { scriptsManifest } from "./scripts-manifest.js";
+import { unshare } from "./unshare.js";
 export const build = async (diff, packageJson, scurry, allowScriptsNodes) => {
     const graph = diff.to;
     const nodes = nonEmptyList([...graph.importers]);
@@ -81,27 +82,30 @@ const visit = async (packageJson, scurry, node, signal, _path) => {
     const hasImplicitInstall = hasBindingGyp(node, scurry) && !install && !preinstall;
     // if it has install script or binding.gyp (implicit install), run it
     const runInstall = !!(install || preinstall || postinstall) || hasImplicitInstall;
+    // if it's an importer or git, run prepare
+    const prepable = node.id.startsWith('git') || node.importer || !node.inVltStore();
+    const runPrepare = !!(prepare || preprepare || postprepare) && prepable;
+    // store links share inodes with the global store
+    if ((runInstall || runPrepare) && node.inVltStore())
+        await unshare(dir);
     if (runInstall) {
         await run({
             signal,
             arg0: 'install',
             ignoreMissing: true,
             packageJson,
-            cwd: node.resolvedLocation(scurry),
+            cwd: dir,
             projectRoot: node.projectRoot,
             manifest,
         });
     }
-    // if it's an importer or git, run prepare
-    const prepable = node.id.startsWith('git') || node.importer || !node.inVltStore();
-    const runPrepare = !!(prepare || preprepare || postprepare) && prepable;
     if (runPrepare) {
         await run({
             signal,
             arg0: 'prepare',
             ignoreMissing: true,
             packageJson,
-            cwd: node.resolvedLocation(scurry),
+            cwd: dir,
             projectRoot: node.projectRoot,
             manifest,
         });

package/dist/reify/delete-edge.js

@@ -1,3 +1,4 @@
+import { resolve } from 'node:path';
 const rmBinPosix = (remover, bin) => {
     return [remover.rm(bin)];
 };
@@ -11,15 +12,16 @@ const rmBinWin32 = (remover, bin) => {
 const rmBin = process.platform === 'win32' ? rmBinWin32 : rmBinPosix;
 export const deleteEdge = async (edge, scurry, remover) => {
     const { spec: { name }, to, } = edge;
+    const { sep } = scurry.cwd;
     const nm = edge.from.nodeModules(scurry);
-    const path = scurry.resolve(nm, name);
-    const binRoot = scurry.cwd.resolve(`${nm}/.bin`);
+    const path = nm + sep + name.replace('/', sep);
+    const binRoot = nm + sep + '.bin';
     const promises = [];
     promises.push(remover.rm(path));
     const bins = to?.bins;
     if (bins) {
         for (const key of Object.keys(bins)) {
-            const bin = binRoot.resolve(key).fullpath();
+            const bin = resolve(binRoot, key);
             promises.push(...rmBin(remover, bin));
         }
     }

package/dist/reify/delete-nodes.js

@@ -1,12 +1,13 @@
 import { deleteEdge } from "./delete-edge.js";
 export const deleteNodes = (diff, remover, scurry) => {
     const store = scurry.resolve('node_modules/.vlt');
+    const { sep } = scurry.cwd;
     const rmActions = [];
     for (const node of diff.nodes.delete) {
         // do not delete workspaces or link targets
         if (!node.inVltStore())
             continue;
-        rmActions.push(remover.rm(scurry.resolve(store, node.id)));
+        rmActions.push(remover.rm(store + sep + node.id));
         for (const edge of node.edgesIn) {
             rmActions.push(deleteEdge(edge, scurry, remover));
         }

package/dist/reify/extract-node.js

@@ -1,7 +1,7 @@
 import { hydrate } from '@vltpkg/dep-id';
-import { platformCheck } from '@vltpkg/pick-manifest';
 import { asManifest, normalizeManifest } from '@vltpkg/types';
-import { optionalFail } from "./optional-fail.js";
+import { lstatSync } from 'node:fs';
+import { isUnsupported, optionalFail } from "./optional-fail.js";
 import { removeOptionalSubgraph } from "../remove-optional-subgraph.js";
 /**
  * Returns a function that handles removing
@@ -20,18 +20,13 @@ const getOptionalFailedNodeRemover = (node, diff) => {
  */
 export const extractNode = async (node, scurry, remover, options, packageInfo, diff) => {
     node.extracted = true;
-    const { manifest = {} } = node;
     const target = node.resolvedLocation(scurry);
     const from = scurry.resolve('');
     const spec = hydrate(node.id, node.name, options);
     const removeOptionalFailedNode = getOptionalFailedNodeRemover(node, diff);
     const { integrity, resolved } = node;
-    // Use platform data from node if available (from lockfile), otherwise fall back to manifest
-    const platformData = node.platform ?? manifest;
-    // Check if we should skip this node due to platform incompatibility or deprecation
-    if (removeOptionalFailedNode &&
-        (manifest.deprecated ||
-            !platformCheck(platformData, process.version, process.platform, process.arch))) {
+    // skip optional nodes that are deprecated or can't run here
+    if (removeOptionalFailedNode && isUnsupported(node)) {
         removeOptionalFailedNode();
         return {
             success: false,
@@ -39,18 +34,11 @@ export const extractNode = async (node, scurry, remover, options, packageInfo, d
             error: new Error('Platform check failed or package deprecated'),
         };
     }
-    // the registry manifest can declare install scripts that the
-    // tarball's package.json, read by the global store, lacks
-    const { scripts, hasInstallScript } = manifest;
     const extractOptions = {
         from,
         integrity,
         resolved,
         fromLockfile: node.resolvedFromLockfile,
-        installScripts: !!(hasInstallScript ||
-            scripts?.install ||
-            scripts?.preinstall ||
-            scripts?.postinstall),
     };
     const extracted = (r) => {
         // Store computed integrity for git/remote deps
@@ -69,7 +57,10 @@ export const extractNode = async (node, scurry, remover, options, packageInfo, d
         return { success: true, node };
     };
     try {
-        await remover.rm(target);
+        // nothing to move away on a fresh tree
+        if (lstatSync(target, { throwIfNoEntry: false })) {
+            await remover.rm(target);
+        }
         if (removeOptionalFailedNode) {
             try {
                 return extracted(await packageInfo.extract(spec, target, extractOptions));

package/dist/reify/index.js

@@ -11,6 +11,7 @@ import { deleteEdges } from "./delete-edges.js";
 import { checkNeededBuild } from "./check-needed-build.js";
 import { deleteNodes } from "./delete-nodes.js";
 import { internalHoist } from "./internal-hoist.js";
+import { pruneUnsupportedOptional } from "./optional-fail.js";
 import { rollback } from "./rollback.js";
 import { updatePackageJson } from "./update-importers-package-json.js";
 import { copyFileSync } from 'node:fs';
@@ -144,6 +145,9 @@ const reify_ = async (options, diff, remover, saveImportersPackageJson) => {
     // any failed/removed optional deps are not reflected in the lockfile
     // data as it is saved.
     const lfData = lockfileData(options);
+    // unsupported optional deps are dropped only after that, so the
+    // lockfile keeps them for other platforms
+    pruneUnsupportedOptional(diff);
     const actions = addNodes(diff, scurry, remover, options, packageInfo).concat(deleteEdges(diff, scurry, remover));
     // need to wait, so that the nodes exist to link to
     if (actions.length)

package/dist/reify/internal-hoist.js

@@ -1,7 +1,8 @@
 import { splitDepID } from '@vltpkg/dep-id';
 import { Version } from '@vltpkg/semver';
-import { mkdir, symlink } from 'node:fs/promises';
+import { mkdir } from 'node:fs/promises';
 import { dirname, relative } from 'node:path';
+import { symlinkSyncMkdirp } from "./symlink-sync.js";
 export const pickNodeToHoist = (nodes) => {
     let pick = undefined;
     let pickNode = undefined;
@@ -107,16 +108,15 @@ export const internalHoist = async (graph, options, remover) => {
         }
     }
     await Promise.all(removes);
-    const symlinks = [];
+    const hoistPath = hoistDir.fullpath();
+    const vlt = scurry.resolve('node_modules/.vlt');
+    const { sep } = scurry.cwd;
+    const native = (n) => n.replace('/', sep);
     for (const [name, { name: nodeName, id }] of links) {
-        const target = scurry.resolve(`node_modules/.vlt/${id}/node_modules/${nodeName}`);
-        const path = scurry.resolve(`node_modules/.vlt/node_modules/${name}`);
-        if (name.includes('/')) {
-            await mkdir(dirname(path), { recursive: true });
-        }
-        symlinks.push(symlink(relative(dirname(path), target), path, 'dir'));
+        const target = vlt + sep + id + sep + 'node_modules' + sep + native(nodeName);
+        const path = hoistPath + sep + native(name);
+        symlinkSyncMkdirp(relative(dirname(path), target), path, 'dir');
     }
-    await Promise.all(symlinks);
 };
 const checkExisting = async (name, entry, links, removes, scurry, remover) => {
     const target = await entry.readlink();

package/dist/reify/optional-fail.d.ts

@@ -13,3 +13,14 @@ export declare function optionalFail(diff: Diff, node: Node & {
     optional: false;
 }): undefined;
 export declare function optionalFail(diff: Diff, node: Node): (() => void) | undefined;
+/**
+ * True if the node is deprecated or can't run on this platform.
+ * Uses lockfile platform data when present, else the manifest.
+ */
+export declare const isUnsupported: (node: Node) => boolean;
+/**
+ * Drop optional adds that can't install here, and deps only they
+ * need, before anything is extracted. Lockfile data must be taken
+ * first, so it keeps them for other platforms.
+ */
+export declare const pruneUnsupportedOptional: (diff: Diff) => void;

package/dist/reify/optional-fail.js

@@ -1,3 +1,4 @@
+import { platformCheck } from '@vltpkg/pick-manifest';
 import { removeOptionalSubgraph } from "../remove-optional-subgraph.js";
 export function optionalFail(diff, node) {
     return node.isOptional() ? () => del(diff, node) : undefined;
@@ -13,3 +14,38 @@ const del = (diff, node) => {
     diff.nodes.add.delete(node);
     diff.nodes.delete.add(node);
 };
+/**
+ * True if the node is deprecated or can't run on this platform.
+ * Uses lockfile platform data when present, else the manifest.
+ */
+export const isUnsupported = (node) => !!node.manifest?.deprecated ||
+    !platformCheck(node.platform ?? node.manifest ?? {}, process.version, process.platform, process.arch);
+/**
+ * Drop optional adds that can't install here, and deps only they
+ * need, before anything is extracted. Lockfile data must be taken
+ * first, so it keeps them for other platforms.
+ */
+export const pruneUnsupportedOptional = (diff) => {
+    let pruned = false;
+    for (const node of diff.nodes.add) {
+        if (node.inVltStore() &&
+            !node.extracted &&
+            node.isOptional() &&
+            isUnsupported(node)) {
+            del(diff, node);
+            pruned = true;
+        }
+    }
+    if (!pruned)
+        return;
+    for (const node of diff.to.gc().values()) {
+        diff.nodes.add.delete(node);
+        diff.nodes.delete.add(node);
+    }
+    // edges out of removed nodes keep their `to`; never link them
+    for (const edge of diff.edges.add) {
+        if (diff.to.nodes.get(edge.from.id) !== edge.from) {
+            diff.edges.add.delete(edge);
+        }
+    }
+};

package/dist/reify/symlink-sync.d.ts

@@ -0,0 +1,5 @@
+import type { symlink } from 'node:fs';
+/**
+ * `symlinkSync`, creating the parent dir on ENOENT.
+ */
+export declare const symlinkSyncMkdirp: (target: string, link: string, type?: symlink.Type) => void;

package/dist/reify/symlink-sync.js

@@ -0,0 +1,16 @@
+import { mkdirSync, symlinkSync } from 'node:fs';
+import { dirname } from 'node:path';
+/**
+ * `symlinkSync`, creating the parent dir on ENOENT.
+ */
+export const symlinkSyncMkdirp = (target, link, type) => {
+    try {
+        symlinkSync(target, link, type);
+    }
+    catch (er) {
+        if (er.code !== 'ENOENT')
+            throw er;
+        mkdirSync(dirname(link), { recursive: true });
+        symlinkSync(target, link, type);
+    }
+};

package/dist/reify/unshare.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Replace every file of `dir` that is hardlinked (e.g. from the global
+ * store) by a private copy, so a script run in it cannot write into
+ * the store. package.json goes last: a private package.json means
+ * nothing is shared, which the global store link keeps true.
+ */
+export declare const unshare: (dir: string) => Promise<void>;

package/dist/reify/unshare.js

@@ -0,0 +1,59 @@
+import { randomBytes } from 'node:crypto';
+import { lstatSync, readdirSync, rmSync } from 'node:fs';
+import { chmod, readFile, rename, rm, writeFile, } from 'node:fs/promises';
+import { join } from 'node:path';
+import { callLimit } from 'promise-call-limit';
+const TMP = '.vlt-unshare-';
+const own = async (p, mode, tmp) => {
+    const body = await readFile(p);
+    try {
+        await writeFile(tmp, body, { mode: mode & 0o777, flag: 'wx' });
+        // same modes as a copy from the store
+        if (mode & 0o111)
+            await chmod(tmp, mode & 0o777);
+        // atomic: p is never missing
+        await rename(tmp, p);
+    }
+    catch (er) {
+        await rm(tmp, { force: true });
+        throw er;
+    }
+};
+/**
+ * Replace every file of `dir` that is hardlinked (e.g. from the global
+ * store) by a private copy, so a script run in it cannot write into
+ * the store. package.json goes last: a private package.json means
+ * nothing is shared, which the global store link keeps true.
+ */
+export const unshare = async (dir) => {
+    const pjPath = join(dir, 'package.json');
+    const pj = lstatSync(pjPath, { throwIfNoEntry: false });
+    if (!pj || pj.nlink < 2)
+        return;
+    // random per call: never clashes with another run's tmp
+    const tag = `${TMP}${randomBytes(4).toString('hex')}-`;
+    let n = 0;
+    const shared = [];
+    // by hand: a recursive readdir follows dir symlinks
+    const walk = (d) => {
+        for (const ent of readdirSync(d, { withFileTypes: true })) {
+            const p = join(d, ent.name);
+            if (ent.isDirectory())
+                walk(p);
+            else if (ent.isFile() && p !== pjPath) {
+                const { mode, nlink } = lstatSync(p);
+                if (nlink > 1) {
+                    const tmp = join(d, `${tag}${n++}`);
+                    shared.push(() => own(p, mode, tmp));
+                }
+                else if (ent.name.startsWith(TMP)) {
+                    // a killed run's tmp copy
+                    rmSync(p);
+                }
+            }
+        }
+    };
+    walk(dir);
+    await callLimit(shared, { limit: 16, rejectLate: true });
+    await own(pjPath, pj.mode, join(dir, `${tag}${n}`));
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.3.2",
-    "@vltpkg/dep-id": "1.3.2",
-    "@vltpkg/dss-breadcrumb": "1.3.2",
-    "@vltpkg/error-cause": "1.3.2",
-    "@vltpkg/fast-split": "1.3.2",
-    "@vltpkg/graph-run": "1.3.2",
-    "@vltpkg/init": "1.3.2",
-    "@vltpkg/output": "1.3.2",
-    "@vltpkg/package-info": "1.3.2",
-    "@vltpkg/package-json": "1.3.2",
-    "@vltpkg/pick-manifest": "1.3.2",
-    "@vltpkg/query": "1.3.2",
-    "@vltpkg/rollback-remove": "1.3.2",
-    "@vltpkg/run": "1.3.2",
-    "@vltpkg/satisfies": "1.3.2",
-    "@vltpkg/security-archive": "1.3.2",
-    "@vltpkg/spec": "1.3.2",
-    "@vltpkg/types": "1.3.2",
-    "@vltpkg/vlt-json": "1.3.2",
-    "@vltpkg/workspaces": "1.3.2",
+    "@vltpkg/cmd-shim": "1.3.4",
+    "@vltpkg/dep-id": "1.3.4",
+    "@vltpkg/dss-breadcrumb": "1.3.4",
+    "@vltpkg/error-cause": "1.3.4",
+    "@vltpkg/fast-split": "1.3.4",
+    "@vltpkg/graph-run": "1.3.4",
+    "@vltpkg/init": "1.3.4",
+    "@vltpkg/output": "1.3.4",
+    "@vltpkg/package-info": "1.3.4",
+    "@vltpkg/package-json": "1.3.4",
+    "@vltpkg/pick-manifest": "1.3.4",
+    "@vltpkg/query": "1.3.4",
+    "@vltpkg/rollback-remove": "1.3.4",
+    "@vltpkg/run": "1.3.4",
+    "@vltpkg/satisfies": "1.3.4",
+    "@vltpkg/security-archive": "1.3.4",
+    "@vltpkg/spec": "1.3.4",
+    "@vltpkg/types": "1.3.4",
+    "@vltpkg/vlt-json": "1.3.4",
+    "@vltpkg/workspaces": "1.3.4",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },