@vltpkg/graph 1.3.6 → 1.3.8

package/dist/graph.d.ts

@@ -100,9 +100,10 @@ export declare class Graph implements GraphLike {
     /**
      * Whether the lockfile on disk no longer matches this graph even
      * though no node changed, e.g. an importer edge spec was rewritten to
-     * the value saved to `package.json`, or the config options the graph
-     * was built with differ from the ones stored in the lockfile. Reify
-     * saves the lockfiles from its no-diff early return when set.
+     * the value saved to `package.json`, a node dev/optional flag was
+     * re-derived, or the config options the graph was built with differ
+     * from the ones stored in the lockfile. Reify saves the lockfiles
+     * from its no-diff early return when set.
      */
     lockfileStale: boolean;
     /**
@@ -126,6 +127,13 @@ export declare class Graph implements GraphLike {
      * Get the next peer context index.
      */
     nextPeerContextIndex(): number;
+    /**
+     * Re-derive node `dev`/`optional` flags: a node is dev/optional only
+     * when every importer path crosses a dev/optional edge. Placement only
+     * ever lowers these flags, so removed or retyped edges leave them
+     * stale. Sets `lockfileStale` when any flag changes.
+     */
+    recomputeFlags(): void;
     /**
      * Delete all nodes and edges that are unreachable from the importers.
      * The collection of deleted nodes is returned.

package/dist/graph.js

@@ -110,9 +110,10 @@ export class Graph {
     /**
      * Whether the lockfile on disk no longer matches this graph even
      * though no node changed, e.g. an importer edge spec was rewritten to
-     * the value saved to `package.json`, or the config options the graph
-     * was built with differ from the ones stored in the lockfile. Reify
-     * saves the lockfiles from its no-diff early return when set.
+     * the value saved to `package.json`, a node dev/optional flag was
+     * re-derived, or the config options the graph was built with differ
+     * from the ones stored in the lockfile. Reify saves the lockfiles
+     * from its no-diff early return when set.
      */
     lockfileStale = false;
     /**
@@ -195,6 +196,35 @@ export class Graph {
     nextPeerContextIndex() {
         return ++this.currentPeerContextIndex;
     }
+    /**
+     * Re-derive node `dev`/`optional` flags: a node is dev/optional only
+     * when every importer path crosses a dev/optional edge. Placement only
+     * ever lowers these flags, so removed or retyped edges leave them
+     * stale. Sets `lockfileStale` when any flag changes.
+     */
+    recomputeFlags() {
+        const reach = (skip) => {
+            const seen = new Set(this.importers);
+            for (const node of seen) {
+                for (const edge of node.edgesOut.values()) {
+                    if (edge.to && !skip(edge))
+                        seen.add(edge.to);
+                }
+            }
+            return seen;
+        };
+        const nonDev = reach(edge => edge.dev);
+        const nonOptional = reach(edge => edge.optional);
+        for (const node of this.nodes.values()) {
+            const dev = !nonDev.has(node);
+            const optional = !nonOptional.has(node);
+            if (node.dev !== dev || node.optional !== optional) {
+                node.dev = dev;
+                node.optional = optional;
+                this.lockfileStale = true;
+            }
+        }
+    }
     /**
      * Delete all nodes and edges that are unreachable from the importers.
      * The collection of deleted nodes is returned.

package/dist/ideal/build-ideal-from-starting-graph.js

@@ -93,5 +93,6 @@ export const buildIdealFromStartingGraph = async (options) => {
         hasProvisionalPeerIds(options.graph)) {
         await movePeerStoreDirs(canonicalizePeerIds(options.graph), options);
     }
+    options.graph.recomputeFlags();
     return options.graph;
 };

package/dist/lockfile/load-nodes.js

@@ -1,6 +1,7 @@
 import { error } from '@vltpkg/error-cause';
 import { asDepID, splitDepID, splitExtra, } from '@vltpkg/dep-id/browser';
 import { getBooleanFlagsFromNum, getBuildStateFromNum, } from "./types.js";
+import { tarballFormat } from '@vltpkg/types';
 export const loadNodes = (graph, nodes, options, actual, throwOnMissingManifest) => {
     const entries = Object.entries(nodes);
     const nodeCount = entries.length;
@@ -76,8 +77,15 @@ export const loadNodes = (graph, nodes, options, actual, throwOnMissingManifest)
         // node whose `resolved` the lockfile left out
         node.brotli = brotli;
         node.integrity = integrity ?? referenceNode?.integrity;
+        // `integrity` is the hash of the artifact `resolved` points at, so a
+        // reference url only stands in for an elided one when it names the
+        // kind of tarball the flag bit says the lockfile's own hash is for
+        const refResolved = referenceNode?.resolved;
+        const refResolvedUsable = !integrity ||
+            !refResolved ||
+            (tarballFormat(refResolved) === 'brotli') === brotli;
         node.resolved =
-            type === 'remote' ? filepath : ((resolved ?? referenceNode?.resolved));
+            type === 'remote' ? filepath : ((resolved ?? (refResolvedUsable ? refResolved : undefined)));
         node.resolvedFromLockfile = !!(node.integrity && node.resolved);
         node.projectRoot = graph.projectRoot;
         if (!node.resolved)

package/dist/node.d.ts

@@ -263,9 +263,13 @@ export declare class Node implements NodeLike {
 }
 /**
  * Copy the tarball metadata `to` is missing from another node for the
- * same package version. Lockfile provenance only carries over once both
- * `integrity` and `resolved` are set, since that pair is what makes it
- * usable without refetching.
+ * same package version. `integrity` is one artifact's hash, so it never
+ * crosses onto a node bound for the other kind of tarball: a node with
+ * no metadata of its own takes `from`'s kind along with it, one that
+ * already has a url or a hash only fills in what matches its own.
+ * Lockfile provenance only carries over once both `integrity` and
+ * `resolved` are set, since that pair is what makes it usable without
+ * refetching.
  */
 export declare const copyPackageMetadata: (to: Node, from: Node) => void;
 export declare const isNode: (value: unknown) => value is Node;

package/dist/node.js

@@ -483,11 +483,21 @@ export class Node {
 }
 /**
  * Copy the tarball metadata `to` is missing from another node for the
- * same package version. Lockfile provenance only carries over once both
- * `integrity` and `resolved` are set, since that pair is what makes it
- * usable without refetching.
+ * same package version. `integrity` is one artifact's hash, so it never
+ * crosses onto a node bound for the other kind of tarball: a node with
+ * no metadata of its own takes `from`'s kind along with it, one that
+ * already has a url or a hash only fills in what matches its own.
+ * Lockfile provenance only carries over once both `integrity` and
+ * `resolved` are set, since that pair is what makes it usable without
+ * refetching.
  */
 export const copyPackageMetadata = (to, from) => {
+    if (!from.integrity && !from.resolved)
+        return;
+    if (!to.integrity && !to.resolved)
+        to.brotli = from.brotli;
+    if (to.brotli !== from.brotli)
+        return;
     to.integrity ??= from.integrity;
     to.resolved ??= from.resolved;
     if (from.resolvedFromLockfile && to.integrity && to.resolved) {

package/dist/reify/index.js

@@ -96,8 +96,9 @@ export const reify = async (options) => {
         // Even when there are no changes to reify, ensure lockfiles
         // exist on disk. This handles the case where a project has no
         // dependencies (or only workspace importers) but still needs
-        // lockfiles written on the first install. A stale flag means an
-        // edge spec was rewritten above, which the lockfiles have to carry.
+        // lockfiles written on the first install. A stale flag means
+        // lockfile data changed w/o a node diff (edge spec/type, options,
+        // dev/optional flags), which the lockfiles have to carry.
         if (!hasLockfiles || graph.lockfileStale) {
             // with no diff at all the ideal graph is the actual graph, so the
             // hidden lockfile can be written from it; an optional-only diff

package/dist/uninstall.js

@@ -5,12 +5,18 @@ import { reify } from "./reify/index.js";
 import { lockfile } from "./index.js";
 import { updatePackageJson } from "./reify/update-importers-package-json.js";
 import { RollbackRemove } from '@vltpkg/rollback-remove';
+import { Monorepo } from '@vltpkg/workspaces';
 import { existsSync, rmSync } from 'node:fs';
 import { resolve } from 'node:path';
 export const uninstall = async (options, remove) => {
     const mainManifest = options.packageJson.read(options.projectRoot);
     const modifiers = GraphModifier.maybeLoad(options);
     const remover = new RollbackRemove();
+    // graph spans every workspace; -w only picks the `remove` targets
+    const monorepo = Monorepo.maybeLoad(options.projectRoot, {
+        packageJson: options.packageJson,
+        scurry: options.scurry,
+    });
     try {
         // Load the actual graph before building the ideal graph so that
         // manifest data from installed packages can be used to hydrate
@@ -20,12 +26,14 @@ export const uninstall = async (options, remove) => {
         // due to throwOnMissingManifest and leaving stale entries behind.
         const act = actualLoad({
             ...options,
+            monorepo,
             modifiers: undefined,
             mainManifest,
             loadManifests: true,
         });
         const graph = await idealBuild({
             ...options,
+            monorepo,
             actual: act,
             remove,
             mainManifest,

package/dist/update.js

@@ -5,10 +5,45 @@ import { GraphModifier } from "./modifiers.js";
 import { init } from '@vltpkg/init';
 import { asError } from '@vltpkg/types';
 import { Graph } from "./graph.js";
+import { load as loadVirtual } from "./lockfile/load.js";
+import { isPathSecurityError } from "./path-security-error.js";
 import { graphStep } from '@vltpkg/output';
 import { RollbackRemove } from '@vltpkg/rollback-remove';
+import { Monorepo } from '@vltpkg/workspaces';
 import { existsSync, rmSync } from 'node:fs';
 import { resolve } from 'node:path';
+/**
+ * Graph to update from. `-w` filtered: the lockfile (else installed)
+ * graph minus the selected workspaces' deps, so only those re-resolve
+ * (deps shared with other workspaces stay locked). Else: empty.
+ */
+const startingGraph = (options, monorepo) => {
+    const fresh = () => new Graph({ ...options, monorepo });
+    if (!options.monorepo || !monorepo)
+        return fresh();
+    const selected = new Set([...options.monorepo.values()].map(ws => ws.id));
+    if (selected.size === monorepo.size)
+        return fresh();
+    let graph;
+    try {
+        graph = loadVirtual({ ...options, monorepo });
+    }
+    catch (err) {
+        if (isPathSecurityError(err))
+            throw err;
+        graph = actualLoad({ ...options, monorepo, loadManifests: true });
+    }
+    for (const importer of graph.importers) {
+        if (!selected.has(importer.id))
+            continue;
+        for (const edge of importer.edgesOut.values()) {
+            edge.to?.edgesIn.delete(edge);
+        }
+        importer.edgesOut.clear();
+    }
+    graph.gc();
+    return graph;
+};
 export const update = async (options) => {
     let mainManifest = undefined;
     try {
@@ -27,6 +62,10 @@ export const update = async (options) => {
     }
     const modifiers = GraphModifier.maybeLoad(options);
     const remover = new RollbackRemove();
+    const monorepo = Monorepo.maybeLoad(options.projectRoot, {
+        packageJson: options.packageJson,
+        scurry: options.scurry,
+    });
     try {
         const done = graphStep('build');
         const graph = await buildIdealFromStartingGraph({
@@ -35,13 +74,14 @@ export const update = async (options) => {
             remove: Object.assign(new Map(), {
                 modifiedDependencies: false,
             }),
-            graph: new Graph({ ...options, mainManifest }),
+            graph: startingGraph({ ...options, mainManifest, modifiers }, monorepo),
             modifiers,
             remover,
         });
         done();
         const act = actualLoad({
             ...options,
+            monorepo,
             mainManifest,
             loadManifests: true,
         });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.3.6",
+  "version": "1.3.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.3.6",
-    "@vltpkg/dep-id": "1.3.6",
-    "@vltpkg/dss-breadcrumb": "1.3.6",
-    "@vltpkg/error-cause": "1.3.6",
-    "@vltpkg/fast-split": "1.3.6",
-    "@vltpkg/graph-run": "1.3.6",
-    "@vltpkg/init": "1.3.6",
-    "@vltpkg/output": "1.3.6",
-    "@vltpkg/package-info": "1.3.6",
-    "@vltpkg/package-json": "1.3.6",
-    "@vltpkg/pick-manifest": "1.3.6",
-    "@vltpkg/query": "1.3.6",
-    "@vltpkg/rollback-remove": "1.3.6",
-    "@vltpkg/run": "1.3.6",
-    "@vltpkg/satisfies": "1.3.6",
-    "@vltpkg/security-archive": "1.3.6",
-    "@vltpkg/spec": "1.3.6",
-    "@vltpkg/types": "1.3.6",
-    "@vltpkg/vlt-json": "1.3.6",
-    "@vltpkg/workspaces": "1.3.6",
+    "@vltpkg/cmd-shim": "1.3.8",
+    "@vltpkg/dep-id": "1.3.8",
+    "@vltpkg/dss-breadcrumb": "1.3.8",
+    "@vltpkg/error-cause": "1.3.8",
+    "@vltpkg/fast-split": "1.3.8",
+    "@vltpkg/graph-run": "1.3.8",
+    "@vltpkg/init": "1.3.8",
+    "@vltpkg/output": "1.3.8",
+    "@vltpkg/package-info": "1.3.8",
+    "@vltpkg/package-json": "1.3.8",
+    "@vltpkg/pick-manifest": "1.3.8",
+    "@vltpkg/query": "1.3.8",
+    "@vltpkg/rollback-remove": "1.3.8",
+    "@vltpkg/run": "1.3.8",
+    "@vltpkg/satisfies": "1.3.8",
+    "@vltpkg/security-archive": "1.3.8",
+    "@vltpkg/spec": "1.3.8",
+    "@vltpkg/types": "1.3.8",
+    "@vltpkg/vlt-json": "1.3.8",
+    "@vltpkg/workspaces": "1.3.8",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },