@vltpkg/graph 1.3.3 → 1.3.5

package/dist/ideal/append-nodes.d.ts

@@ -18,7 +18,7 @@ import type { ExplicitAddMap, TransientAddMap, TransientRemoveMap } from './type
  *
  * 1. Process all deps at the current level in parallel
  * 2. After each level, run `postPlacementPeerCheck` to handle peer contexts
- * 3. Collect child deps for the next level
+ * 3. Collect child deps for the next level, each node once
  * 4. Repeat until no more deps to process
  *
  * **Peer Context Isolation**: Each workspace importer gets its own peer context

package/dist/ideal/append-nodes.js

@@ -621,7 +621,7 @@ const processPlacementTasks = async (graph, options, placementTasks, add, modifi
  *
  * 1. Process all deps at the current level in parallel
  * 2. After each level, run `postPlacementPeerCheck` to handle peer contexts
- * 3. Collect child deps for the next level
+ * 3. Collect child deps for the next level, each node once
  * 4. Repeat until no more deps to process
  *
  * **Peer Context Isolation**: Each workspace importer gets its own peer context
@@ -680,8 +680,6 @@ export const appendNodes = async (packageInfo, graph, fromNode, deps, scurry, op
         // Fetch all manifests at this level in parallel without mutating the graph.
         // This phase is read-only to avoid race conditions from network timing.
         const fetchResults = await Promise.all(currentLevelDeps.map(async ({ node, deps: nodeDeps, modifierRefs: nodeModifierRefs, peerContext, depth, }) => {
-            // Cycle prevention: mark as seen when starting to process
-            seen.add(node.id);
             // Fetch manifests and collect tasks (no graph mutations)
             const result = await fetchManifestsForDeps(packageInfo, graph, node, 
             // Sort by name for deterministic ordering (reproducible builds)
@@ -740,17 +738,16 @@ export const appendNodes = async (packageInfo, graph, fromNode, deps, scurry, op
         // ============================================================
         // STEP 3: COLLECT CHILD DEPS FOR NEXT LEVEL
         // ============================================================
+        /* c8 ignore next */
+        const nextDepth = (currentLevelDeps[0]?.depth ?? 0) + 1;
         for (const childDepsToProcess of levelResults) {
             for (const childDep of childDepsToProcess) {
-                // Skip already-seen nodes (cycle prevention)
-                if (!seen.has(childDep.node.id)) {
-                    /* c8 ignore next */
-                    const currentDepth = currentLevelDeps[0]?.depth ?? 0;
-                    nextLevelDeps.push({
-                        ...childDep,
-                        depth: currentDepth + 1,
-                    });
-                }
+                // seen at enqueue: skips cycles and same-level duplicates
+                // (first in sorted order wins)
+                if (seen.has(childDep.node.id))
+                    continue;
+                seen.add(childDep.node.id);
+                nextLevelDeps.push({ ...childDep, depth: nextDepth });
             }
         }
         // Advance to next BFS level

package/dist/ideal/build.js

@@ -3,6 +3,7 @@ import { graphStep } from '@vltpkg/output';
 import { load as loadActual } from "../actual/load.js";
 import { load as loadVirtual } from "../lockfile/load.js";
 import { buildIdealFromStartingGraph } from "./build-ideal-from-starting-graph.js";
+import { prefetchResolve } from "./prefetch-resolve.js";
 import { isPathSecurityError } from "../path-security-error.js";
 import { splitDepID } from '@vltpkg/dep-id';
 const getMap = (m) => m ?? new Map();
@@ -60,15 +61,25 @@ export const build = async (options) => {
             monorepo,
         });
     }
-    const res = await buildIdealFromStartingGraph({
-        ...options,
-        scurry,
-        add: getMap(options.add),
-        graph,
-        packageInfo,
-        remove: getMap(options.remove),
-        actual: options.actual,
-    });
+    // Start resolving the importers' dependencies server-side, one request
+    // to the default registry. manifest() picks the answers up as they land,
+    // and nothing reads them once the ideal graph is built.
+    const releaseResolve = prefetchResolve(graph, packageInfo, options);
+    let res;
+    try {
+        res = await buildIdealFromStartingGraph({
+            ...options,
+            scurry,
+            add: getMap(options.add),
+            graph,
+            packageInfo,
+            remove: getMap(options.remove),
+            actual: options.actual,
+        });
+    }
+    finally {
+        releaseResolve();
+    }
     done();
     // when adding or removing a new dependency from a file dep,
     // validate the receiver node was present in the graph

package/dist/ideal/prefetch-resolve.d.ts

@@ -0,0 +1,20 @@
+import type { PackageInfoClient } from '@vltpkg/package-info';
+import type { SpecOptions } from '@vltpkg/spec';
+import type { Graph } from '../graph.ts';
+/**
+ * Start a server-side resolve for the importers' dependencies the starting
+ * graph does not already satisfy, one request to the default registry,
+ * without waiting for it: the request overlaps whatever the build does
+ * before it asks for its first manifest. A graph loaded whole from a
+ * lockfile or node_modules sends nothing.
+ *
+ * Returns the function that releases the request, for the build to call
+ * once it has placed its last node.
+ *
+ * Fails soft in every direction: a registry that does not serve the
+ * endpoint, a request that errors, and a spec it does not resolve all
+ * leave the per-name path to handle it, exactly as before.
+ */
+export declare const prefetchResolve: (graph: Graph, packageInfo: PackageInfoClient, options: SpecOptions & {
+    modifiers?: unknown;
+}) => (() => void);

package/dist/ideal/prefetch-resolve.js

@@ -0,0 +1,85 @@
+import { detectLibc } from '@vltpkg/pick-manifest';
+const nothing = () => { };
+/**
+ * Start a server-side resolve for the importers' dependencies the starting
+ * graph does not already satisfy, one request to the default registry,
+ * without waiting for it: the request overlaps whatever the build does
+ * before it asks for its first manifest. A graph loaded whole from a
+ * lockfile or node_modules sends nothing.
+ *
+ * Returns the function that releases the request, for the build to call
+ * once it has placed its last node.
+ *
+ * Fails soft in every direction: a registry that does not serve the
+ * endpoint, a request that errors, and a spec it does not resolve all
+ * leave the per-name path to handle it, exactly as before.
+ */
+export const prefetchResolve = (graph, packageInfo, options) => {
+    // a modifier can swap any spec mid-graph, taking the server's whole
+    // closure off the client's real one; those installs resolve locally
+    if (options.modifiers)
+        return nothing;
+    const registry = options.registry;
+    if (!registry)
+        return nothing;
+    const scopes = Object.keys(options['scoped-registries'] ?? {});
+    // a name under a scoped registry is that registry's; it is not sent to
+    // this one at all, and `stop` keeps the server from walking into it
+    const scoped = (name) => scopes.some(scope => name.startsWith(`${scope}/`));
+    const roots = [];
+    const seen = new Set();
+    for (const importer of graph.importers) {
+        const manifest = importer.manifest;
+        if (!manifest)
+            continue;
+        for (const field of [
+            'dependencies',
+            'devDependencies',
+            'optionalDependencies',
+        ]) {
+            const deps = manifest[field];
+            if (!deps)
+                continue;
+            for (const [name, spec] of Object.entries(deps)) {
+                if (typeof spec !== 'string')
+                    continue;
+                // protocols, workspace and file specs are the client's to resolve
+                if (spec.includes(':') || scoped(name))
+                    continue;
+                // an edge the starting graph already resolves to a node that
+                // satisfies this very spec is settled; the build keeps it as is
+                const edge = importer.edgesOut.get(name);
+                if (edge?.to && edge.spec.bareSpec === spec && edge.valid())
+                    continue;
+                const key = `${name}@${spec}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                roots.push({ name, spec });
+            }
+        }
+    }
+    if (!roots.length)
+        return nothing;
+    const have = [];
+    for (const node of graph.nodes.values()) {
+        if (node.manifest &&
+            node.name &&
+            node.version &&
+            !scoped(node.name)) {
+            have.push(`${node.name}@${node.version}`);
+        }
+    }
+    return packageInfo.prefetchResolve(registry, {
+        roots,
+        have,
+        ...(scopes.length ? { stop: { scopes } } : {}),
+        platform: {
+            os: process.platform,
+            cpu: process.arch,
+            node: process.versions.node,
+            // undefined never serializes, so no libc means the field is absent
+            libc: detectLibc(),
+        },
+    });
+};

package/dist/reify/build.js

@@ -8,6 +8,7 @@ import { optionalFail } from "./optional-fail.js";
 import { binChmod } from "./bin-chmod.js";
 import { hasBindingGyp } from "./binding-gyp.js";
 import { scriptsManifest } from "./scripts-manifest.js";
+import { unshare } from "./unshare.js";
 export const build = async (diff, packageJson, scurry, allowScriptsNodes) => {
     const graph = diff.to;
     const nodes = nonEmptyList([...graph.importers]);
@@ -81,27 +82,30 @@ const visit = async (packageJson, scurry, node, signal, _path) => {
     const hasImplicitInstall = hasBindingGyp(node, scurry) && !install && !preinstall;
     // if it has install script or binding.gyp (implicit install), run it
     const runInstall = !!(install || preinstall || postinstall) || hasImplicitInstall;
+    // if it's an importer or git, run prepare
+    const prepable = node.id.startsWith('git') || node.importer || !node.inVltStore();
+    const runPrepare = !!(prepare || preprepare || postprepare) && prepable;
+    // store links share inodes with the global store
+    if ((runInstall || runPrepare) && node.inVltStore())
+        await unshare(dir);
     if (runInstall) {
         await run({
             signal,
             arg0: 'install',
             ignoreMissing: true,
             packageJson,
-            cwd: node.resolvedLocation(scurry),
+            cwd: dir,
             projectRoot: node.projectRoot,
             manifest,
         });
     }
-    // if it's an importer or git, run prepare
-    const prepable = node.id.startsWith('git') || node.importer || !node.inVltStore();
-    const runPrepare = !!(prepare || preprepare || postprepare) && prepable;
     if (runPrepare) {
         await run({
             signal,
             arg0: 'prepare',
             ignoreMissing: true,
             packageJson,
-            cwd: node.resolvedLocation(scurry),
+            cwd: dir,
             projectRoot: node.projectRoot,
             manifest,
         });

package/dist/reify/extract-node.js

@@ -20,7 +20,6 @@ const getOptionalFailedNodeRemover = (node, diff) => {
  */
 export const extractNode = async (node, scurry, remover, options, packageInfo, diff) => {
     node.extracted = true;
-    const { manifest = {} } = node;
     const target = node.resolvedLocation(scurry);
     const from = scurry.resolve('');
     const spec = hydrate(node.id, node.name, options);
@@ -35,18 +34,11 @@ export const extractNode = async (node, scurry, remover, options, packageInfo, d
             error: new Error('Platform check failed or package deprecated'),
         };
     }
-    // the registry manifest can declare install scripts that the
-    // tarball's package.json, read by the global store, lacks
-    const { scripts, hasInstallScript } = manifest;
     const extractOptions = {
         from,
         integrity,
         resolved,
         fromLockfile: node.resolvedFromLockfile,
-        installScripts: !!(hasInstallScript ||
-            scripts?.install ||
-            scripts?.preinstall ||
-            scripts?.postinstall),
     };
     const extracted = (r) => {
         // Store computed integrity for git/remote deps

package/dist/reify/unshare.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Replace every file of `dir` that is hardlinked (e.g. from the global
+ * store) by a private copy, so a script run in it cannot write into
+ * the store. package.json goes last: a private package.json means
+ * nothing is shared, which the global store link keeps true.
+ */
+export declare const unshare: (dir: string) => Promise<void>;

package/dist/reify/unshare.js

@@ -0,0 +1,59 @@
+import { randomBytes } from 'node:crypto';
+import { lstatSync, readdirSync, rmSync } from 'node:fs';
+import { chmod, readFile, rename, rm, writeFile, } from 'node:fs/promises';
+import { join } from 'node:path';
+import { callLimit } from 'promise-call-limit';
+const TMP = '.vlt-unshare-';
+const own = async (p, mode, tmp) => {
+    const body = await readFile(p);
+    try {
+        await writeFile(tmp, body, { mode: mode & 0o777, flag: 'wx' });
+        // same modes as a copy from the store
+        if (mode & 0o111)
+            await chmod(tmp, mode & 0o777);
+        // atomic: p is never missing
+        await rename(tmp, p);
+    }
+    catch (er) {
+        await rm(tmp, { force: true });
+        throw er;
+    }
+};
+/**
+ * Replace every file of `dir` that is hardlinked (e.g. from the global
+ * store) by a private copy, so a script run in it cannot write into
+ * the store. package.json goes last: a private package.json means
+ * nothing is shared, which the global store link keeps true.
+ */
+export const unshare = async (dir) => {
+    const pjPath = join(dir, 'package.json');
+    const pj = lstatSync(pjPath, { throwIfNoEntry: false });
+    if (!pj || pj.nlink < 2)
+        return;
+    // random per call: never clashes with another run's tmp
+    const tag = `${TMP}${randomBytes(4).toString('hex')}-`;
+    let n = 0;
+    const shared = [];
+    // by hand: a recursive readdir follows dir symlinks
+    const walk = (d) => {
+        for (const ent of readdirSync(d, { withFileTypes: true })) {
+            const p = join(d, ent.name);
+            if (ent.isDirectory())
+                walk(p);
+            else if (ent.isFile() && p !== pjPath) {
+                const { mode, nlink } = lstatSync(p);
+                if (nlink > 1) {
+                    const tmp = join(d, `${tag}${n++}`);
+                    shared.push(() => own(p, mode, tmp));
+                }
+                else if (ent.name.startsWith(TMP)) {
+                    // a killed run's tmp copy
+                    rmSync(p);
+                }
+            }
+        }
+    };
+    walk(dir);
+    await callLimit(shared, { limit: 16, rejectLate: true });
+    await own(pjPath, pj.mode, join(dir, `${tag}${n}`));
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.3.3",
-    "@vltpkg/dep-id": "1.3.3",
-    "@vltpkg/dss-breadcrumb": "1.3.3",
-    "@vltpkg/error-cause": "1.3.3",
-    "@vltpkg/fast-split": "1.3.3",
-    "@vltpkg/graph-run": "1.3.3",
-    "@vltpkg/init": "1.3.3",
-    "@vltpkg/output": "1.3.3",
-    "@vltpkg/package-info": "1.3.3",
-    "@vltpkg/package-json": "1.3.3",
-    "@vltpkg/pick-manifest": "1.3.3",
-    "@vltpkg/query": "1.3.3",
-    "@vltpkg/rollback-remove": "1.3.3",
-    "@vltpkg/run": "1.3.3",
-    "@vltpkg/satisfies": "1.3.3",
-    "@vltpkg/security-archive": "1.3.3",
-    "@vltpkg/spec": "1.3.3",
-    "@vltpkg/types": "1.3.3",
-    "@vltpkg/vlt-json": "1.3.3",
-    "@vltpkg/workspaces": "1.3.3",
+    "@vltpkg/cmd-shim": "1.3.5",
+    "@vltpkg/dep-id": "1.3.5",
+    "@vltpkg/dss-breadcrumb": "1.3.5",
+    "@vltpkg/error-cause": "1.3.5",
+    "@vltpkg/fast-split": "1.3.5",
+    "@vltpkg/graph-run": "1.3.5",
+    "@vltpkg/init": "1.3.5",
+    "@vltpkg/output": "1.3.5",
+    "@vltpkg/package-info": "1.3.5",
+    "@vltpkg/package-json": "1.3.5",
+    "@vltpkg/pick-manifest": "1.3.5",
+    "@vltpkg/query": "1.3.5",
+    "@vltpkg/rollback-remove": "1.3.5",
+    "@vltpkg/run": "1.3.5",
+    "@vltpkg/satisfies": "1.3.5",
+    "@vltpkg/security-archive": "1.3.5",
+    "@vltpkg/spec": "1.3.5",
+    "@vltpkg/types": "1.3.5",
+    "@vltpkg/vlt-json": "1.3.5",
+    "@vltpkg/workspaces": "1.3.5",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },