@vltpkg/graph 1.3.7 → 1.4.0

package/dist/actual/load.js

@@ -246,6 +246,10 @@ const parseDir = (options, scurry, packageJson, depsFound, graph, fromNode, curr
             });
             // Check for active modifiers and replace spec for missing dependencies
             const { spec: modifiedSpec, queryModifier } = maybeApplyModifierToSpec(spec, name, modifierRefs);
+            // a `-` modifier removes the dependency, so it is not missing
+            if (modifiedSpec !== spec && modifiedSpec.bareSpec === '-') {
+                continue;
+            }
             spec = modifiedSpec;
             graph.placePackage(fromNode, depType, spec, undefined, undefined, joinExtra({ modifier: queryModifier }));
         }

package/dist/graph.d.ts

@@ -100,9 +100,10 @@ export declare class Graph implements GraphLike {
     /**
      * Whether the lockfile on disk no longer matches this graph even
      * though no node changed, e.g. an importer edge spec was rewritten to
-     * the value saved to `package.json`, or the config options the graph
-     * was built with differ from the ones stored in the lockfile. Reify
-     * saves the lockfiles from its no-diff early return when set.
+     * the value saved to `package.json`, a node dev/optional flag was
+     * re-derived, or the config options the graph was built with differ
+     * from the ones stored in the lockfile. Reify saves the lockfiles
+     * from its no-diff early return when set.
      */
     lockfileStale: boolean;
     /**
@@ -126,6 +127,13 @@ export declare class Graph implements GraphLike {
      * Get the next peer context index.
      */
     nextPeerContextIndex(): number;
+    /**
+     * Re-derive node `dev`/`optional` flags: a node is dev/optional only
+     * when every importer path crosses a dev/optional edge. Placement only
+     * ever lowers these flags, so removed or retyped edges leave them
+     * stale. Sets `lockfileStale` when any flag changes.
+     */
+    recomputeFlags(): void;
     /**
      * Delete all nodes and edges that are unreachable from the importers.
      * The collection of deleted nodes is returned.

package/dist/graph.js

@@ -110,9 +110,10 @@ export class Graph {
     /**
      * Whether the lockfile on disk no longer matches this graph even
      * though no node changed, e.g. an importer edge spec was rewritten to
-     * the value saved to `package.json`, or the config options the graph
-     * was built with differ from the ones stored in the lockfile. Reify
-     * saves the lockfiles from its no-diff early return when set.
+     * the value saved to `package.json`, a node dev/optional flag was
+     * re-derived, or the config options the graph was built with differ
+     * from the ones stored in the lockfile. Reify saves the lockfiles
+     * from its no-diff early return when set.
      */
     lockfileStale = false;
     /**
@@ -195,6 +196,35 @@ export class Graph {
     nextPeerContextIndex() {
         return ++this.currentPeerContextIndex;
     }
+    /**
+     * Re-derive node `dev`/`optional` flags: a node is dev/optional only
+     * when every importer path crosses a dev/optional edge. Placement only
+     * ever lowers these flags, so removed or retyped edges leave them
+     * stale. Sets `lockfileStale` when any flag changes.
+     */
+    recomputeFlags() {
+        const reach = (skip) => {
+            const seen = new Set(this.importers);
+            for (const node of seen) {
+                for (const edge of node.edgesOut.values()) {
+                    if (edge.to && !skip(edge))
+                        seen.add(edge.to);
+                }
+            }
+            return seen;
+        };
+        const nonDev = reach(edge => edge.dev);
+        const nonOptional = reach(edge => edge.optional);
+        for (const node of this.nodes.values()) {
+            const dev = !nonDev.has(node);
+            const optional = !nonOptional.has(node);
+            if (node.dev !== dev || node.optional !== optional) {
+                node.dev = dev;
+                node.optional = optional;
+                this.lockfileStale = true;
+            }
+        }
+    }
     /**
      * Delete all nodes and edges that are unreachable from the importers.
      * The collection of deleted nodes is returned.

package/dist/ideal/append-nodes.js

@@ -228,6 +228,10 @@ const fetchManifestsForDeps = async (packageInfo, graph, fromNode, deps, scurry,
             spec = activeModifier.modifier.spec;
             // bareSpec of '-' means "remove this dependency"
             if (spec.bareSpec === '-') {
+                // nothing to install or save for an explicit request
+                if (isExplicit) {
+                    throw error(`Cannot add ${originalSpec.name}: it is removed by a graph modifier`, { code: 'ECONFIG', found: queryModifier });
+                }
                 continue;
             }
         }
@@ -366,6 +370,8 @@ const fetchManifestsForDeps = async (packageInfo, graph, fromNode, deps, scurry,
                 }
                 throw er;
             });
+        // awaited below; a throw before that must not leave it unhandled
+        manifestPromise.catch(() => { });
         const fetchTask = {
             spec,
             type,
@@ -380,6 +386,8 @@ const fetchManifestsForDeps = async (packageInfo, graph, fromNode, deps, scurry,
         };
         fetchTasks.push(fetchTask);
     }
+    // fail on the first rejection, not once the ones before it settle
+    await Promise.all(fetchTasks.map(t => t.manifestPromise));
     // Create placement tasks from fetch tasks
     for (const fetchTask of fetchTasks) {
         const manifest = await fetchTask.manifestPromise;

package/dist/ideal/build-ideal-from-starting-graph.js

@@ -79,6 +79,14 @@ export const buildIdealFromStartingGraph = async (options) => {
     if (importerSpecs.staleSpecs.size) {
         options.graph.lockfileStale = true;
     }
+    // importer edges a `-` modifier now removes: drop them, gc() takes
+    // whatever only they reached
+    for (const edge of importerSpecs.removedEdges) {
+        edge.from.edgesOut.delete(edge.name);
+        edge.to?.edgesIn.delete(edge);
+        options.graph.edges.delete(edge);
+        options.graph.lockfileStale = true;
+    }
     // refreshs the current graph adding the nodes marked for addition
     // and removing the ones marked for removal, while also recalculating
     // peer dependencies and default locations
@@ -93,5 +101,6 @@ export const buildIdealFromStartingGraph = async (options) => {
         hasProvisionalPeerIds(options.graph)) {
         await movePeerStoreDirs(canonicalizePeerIds(options.graph), options);
     }
+    options.graph.recomputeFlags();
     return options.graph;
 };

package/dist/ideal/get-importer-specs.d.ts

@@ -18,6 +18,7 @@ export type GetImporterSpecsOptions = BuildIdealAddOptions & BuildIdealFromGraph
 export declare const getImporterSpecs: (options: GetImporterSpecsOptions) => {
     add: AddImportersDependenciesMap;
     remove: RemoveImportersDependenciesMap;
+    removedEdges: Set<Edge>;
     staleSpecs: Map<Edge, Dependency>;
     transientAdd: TransientAddMap;
     transientRemove: TransientRemoveMap;

package/dist/ideal/get-importer-specs.js

@@ -25,6 +25,8 @@ export const getImporterSpecs = (options) => {
     const { add, graph, remove } = options;
     const addResult = new AddImportersDependenciesMapImpl();
     const removeResult = new RemoveImportersDependenciesMapImpl();
+    // importer edges a `-` modifier now removes, package.json keeps them
+    const removedEdges = new Set();
     // traverse the list of importers in the starting graph
     for (const importer of graph.importers) {
         // uses a Map keying to the spec.name in order to easily make sure there's
@@ -71,6 +73,13 @@ export const getImporterSpecs = (options) => {
                 continue;
             }
             const spec = Spec.parse(depName, depSpec, options);
+            // a `-` modifier removes this dependency, nothing to place; an
+            // edge from before (e.g. a qualifier now matching) has to go
+            if (options.modifiers?.removesImporterEdge(importer, spec)) {
+                if (edge)
+                    removedEdges.add(edge);
+                continue;
+            }
             // if a workspace dep references a workspace that no longer exists
             // (folder was removed), mark it for removal instead of trying to
             // resolve it — the workspace can't be satisfied
@@ -212,6 +221,7 @@ export const getImporterSpecs = (options) => {
     return {
         add: addResult,
         remove: removeResult,
+        removedEdges,
         staleSpecs,
         transientAdd,
         transientRemove,

package/dist/ideal/refresh-ideal-graph.js

@@ -99,7 +99,12 @@ export const refreshIdealGraph = async ({ add, graph, modifiers, packageInfo, sc
         const modifierRefs = modifiers?.tryDependencies(importer, deps);
         // Add new nodes for packages defined in the dependencies list fetching
         // metadata from the registry manifests and updating the graph
-        await appendNodes(packageInfo, graph, importer, deps, scurry, specOptions, seen, addedDeps, modifiers, modifierRefs, extractPromises, actual, seenExtracted, remover, transientAdd, transientRemove, explicit);
+        await appendNodes(packageInfo, graph, importer, deps, scurry, specOptions, seen, addedDeps, modifiers, modifierRefs, extractPromises, actual, seenExtracted, remover, transientAdd, transientRemove, explicit).catch((er) => {
+            // extractions still in flight are moot now
+            for (const p of extractPromises ?? [])
+                p.catch(() => { });
+            throw er;
+        });
     }
     // locked resolutions only apply to the rebuild that captured them
     graph.lockedResolutions = undefined;

package/dist/install.js

@@ -7,6 +7,7 @@ import { error } from '@vltpkg/error-cause';
 import { asError } from '@vltpkg/types';
 import { getDependencies } from "./dependencies.js";
 import { RollbackRemove } from '@vltpkg/rollback-remove';
+import { joinDepIDTuple } from '@vltpkg/dep-id';
 import { existsSync, rmSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { load as loadVirtual, loadData } from "./lockfile/load.js";
@@ -109,6 +110,7 @@ export const install = async (options, add) => {
         }
         if (importerSpecs.add.modifiedDependencies ||
             importerSpecs.remove.modifiedDependencies ||
+            importerSpecs.removedEdges.size > 0 ||
             specChanges.length > 0 ||
             lockfileGraph.optionsChanged) {
             const details = [];
@@ -141,6 +143,9 @@ export const install = async (options, add) => {
                     details.push(`  ${location}: ${deps.size} ${depLabelRemove} to remove (${depNames.join(', ')})`);
                 }
             }
+            for (const edge of importerSpecs.removedEdges) {
+                details.push(`  ${edge.from.location}: ${edge.name} is removed by a graph modifier`);
+            }
             const lockfilePath = resolve(options.projectRoot, 'vlt-lock.json');
             throw error('Lockfile is out of sync with package.json. Run "vlt install" to update.\n' +
                 details.join('\n'), {
@@ -148,6 +153,23 @@ export const install = async (options, add) => {
             });
         }
     }
+    // an explicit add of a dep a `-` modifier removes fails before
+    // anything on disk is touched
+    if (modifiers && add?.modifiedDependencies) {
+        const wsIds = new Set([...(fullMonorepo?.values() ?? [])].map(ws => ws.id));
+        for (const [id, deps] of add) {
+            const mainImporter = id === joinDepIDTuple(['file', '.']);
+            // nested folders are no importers, appendNodes checks those
+            if (!mainImporter && !wsIds.has(id))
+                continue;
+            for (const { spec } of deps.values()) {
+                const found = modifiers.removesImporterEdge({ importer: true, mainImporter }, spec);
+                if (found) {
+                    throw error(`Cannot add ${spec.name}: it is removed by a graph modifier`, { code: 'ECONFIG', found });
+                }
+            }
+        }
+    }
     const remover = new RollbackRemove();
     if (options.cleanInstall) {
         const nodeModulesPath = resolve(options.projectRoot, 'node_modules');

package/dist/lockfile/load-edges.js

@@ -52,11 +52,9 @@ export const loadEdges = (graph, edges, options, cache) => {
         const [depType, valRest] = fastSplit(value, ' ', 2);
         const vrSplit = valRest?.lastIndexOf(' ') ?? -1;
         // not a valid edge record
-        /* c8 ignore start */
         if (!valRest || !depType || !fromId || !specName || vrSplit < 1) {
             continue;
         }
-        /* c8 ignore stop */
         // Validate dependency type early
         if (!isDependencyTypeShort(depType)) {
             throw error('Found unsupported dependency type in lockfile', {

package/dist/modifiers.d.ts

@@ -126,6 +126,13 @@ export declare class GraphModifier {
      * root's own b edge is still the manifest's to validate and heal.
      */
     targetsImporterEdge(importer: Node, spec: Spec): boolean;
+    /**
+     * Selector of the modifier that wins the direct `importer -> spec.name`
+     * edge, if it removes it (value `-`). Same pick as tryNewDependency:
+     * complete entries whose qualifier accepts the spec, highest
+     * specificity, importer-anchored before lone on ties.
+     */
+    removesImporterEdge(importer: Pick<Node, 'importer' | 'mainImporter'>, spec: Spec): string | undefined;
     /**
      * Loads the modifiers defined in `vlt.json` into memory.
      */

package/dist/modifiers.js

@@ -115,6 +115,30 @@ export class GraphModifier {
         }
         return false;
     }
+    /**
+     * Selector of the modifier that wins the direct `importer -> spec.name`
+     * edge, if it removes it (value `-`). Same pick as tryNewDependency:
+     * complete entries whose qualifier accepts the spec, highest
+     * specificity, importer-anchored before lone on ties.
+     */
+    removesImporterEdge(importer, spec) {
+        const anchored = [];
+        const lone = [];
+        for (const mod of this.#modifiers) {
+            const { last } = mod.breadcrumb;
+            if (last.name !== spec.name || !matchesQualifier(last, spec))
+                continue;
+            const { prev } = last;
+            if (!prev)
+                lone.push(mod);
+            else if (!prev.prev && matchesImporter(prev, importer))
+                anchored.push(mod);
+        }
+        const all = [...anchored, ...lone];
+        const [winner] = specificitySort(all.map(m => m.breadcrumb));
+        const mod = all.find(m => m.breadcrumb === winner);
+        return mod?.value === '-' ? mod.query : undefined;
+    }
     /**
      * Loads the modifiers defined in `vlt.json` into memory.
      */

package/dist/reify/index.js

@@ -89,15 +89,20 @@ export const reify = async (options) => {
     // Otherwise a first install of an optional-only tree would never extract.
     const hasLockfiles = !!scurry.lstatSync('vlt-lock.json') &&
         !!scurry.lstatSync('node_modules/.vlt-lock.json');
-    const skipOptionalOnly = noModifiedDependencies && diff.optionalOnly;
+    // a removal is never optional-only: deleting is what reify is for
+    const skipOptionalOnly = noModifiedDependencies &&
+        diff.optionalOnly &&
+        !diff.nodes.delete.size &&
+        !diff.edges.delete.size;
     const skippable = skipOptionalOnly && !options.update && hasLockfiles;
     const res = { diff };
     if (!diff.hasChanges() || skippable) {
         // Even when there are no changes to reify, ensure lockfiles
         // exist on disk. This handles the case where a project has no
         // dependencies (or only workspace importers) but still needs
-        // lockfiles written on the first install. A stale flag means an
-        // edge spec was rewritten above, which the lockfiles have to carry.
+        // lockfiles written on the first install. A stale flag means
+        // lockfile data changed w/o a node diff (edge spec/type, options,
+        // dev/optional flags), which the lockfiles have to carry.
         if (!hasLockfiles || graph.lockfileStale) {
             // with no diff at all the ideal graph is the actual graph, so the
             // hidden lockfile can be written from it; an optional-only diff

package/dist/uninstall.js

@@ -5,12 +5,18 @@ import { reify } from "./reify/index.js";
 import { lockfile } from "./index.js";
 import { updatePackageJson } from "./reify/update-importers-package-json.js";
 import { RollbackRemove } from '@vltpkg/rollback-remove';
+import { Monorepo } from '@vltpkg/workspaces';
 import { existsSync, rmSync } from 'node:fs';
 import { resolve } from 'node:path';
 export const uninstall = async (options, remove) => {
     const mainManifest = options.packageJson.read(options.projectRoot);
     const modifiers = GraphModifier.maybeLoad(options);
     const remover = new RollbackRemove();
+    // graph spans every workspace; -w only picks the `remove` targets
+    const monorepo = Monorepo.maybeLoad(options.projectRoot, {
+        packageJson: options.packageJson,
+        scurry: options.scurry,
+    });
     try {
         // Load the actual graph before building the ideal graph so that
         // manifest data from installed packages can be used to hydrate
@@ -20,16 +26,19 @@ export const uninstall = async (options, remove) => {
         // due to throwOnMissingManifest and leaving stale entries behind.
         const act = actualLoad({
             ...options,
+            monorepo,
             modifiers: undefined,
             mainManifest,
             loadManifests: true,
         });
         const graph = await idealBuild({
             ...options,
+            monorepo,
             actual: act,
             remove,
             mainManifest,
             loadManifests: true,
+            modifiers,
             remover,
         });
         // If lockfileOnly is enabled, skip reify and only save the lockfile
@@ -59,6 +68,7 @@ export const uninstall = async (options, remove) => {
             actual: act,
             graph,
             loadManifests: true,
+            modifiers,
             remover,
         });
         return { graph, diff };

package/dist/update.js

@@ -5,10 +5,45 @@ import { GraphModifier } from "./modifiers.js";
 import { init } from '@vltpkg/init';
 import { asError } from '@vltpkg/types';
 import { Graph } from "./graph.js";
+import { load as loadVirtual } from "./lockfile/load.js";
+import { isPathSecurityError } from "./path-security-error.js";
 import { graphStep } from '@vltpkg/output';
 import { RollbackRemove } from '@vltpkg/rollback-remove';
+import { Monorepo } from '@vltpkg/workspaces';
 import { existsSync, rmSync } from 'node:fs';
 import { resolve } from 'node:path';
+/**
+ * Graph to update from. `-w` filtered: the lockfile (else installed)
+ * graph minus the selected workspaces' deps, so only those re-resolve
+ * (deps shared with other workspaces stay locked). Else: empty.
+ */
+const startingGraph = (options, monorepo) => {
+    const fresh = () => new Graph({ ...options, monorepo });
+    if (!options.monorepo || !monorepo)
+        return fresh();
+    const selected = new Set([...options.monorepo.values()].map(ws => ws.id));
+    if (selected.size === monorepo.size)
+        return fresh();
+    let graph;
+    try {
+        graph = loadVirtual({ ...options, monorepo });
+    }
+    catch (err) {
+        if (isPathSecurityError(err))
+            throw err;
+        graph = actualLoad({ ...options, monorepo, loadManifests: true });
+    }
+    for (const importer of graph.importers) {
+        if (!selected.has(importer.id))
+            continue;
+        for (const edge of importer.edgesOut.values()) {
+            edge.to?.edgesIn.delete(edge);
+        }
+        importer.edgesOut.clear();
+    }
+    graph.gc();
+    return graph;
+};
 export const update = async (options) => {
     let mainManifest = undefined;
     try {
@@ -27,6 +62,10 @@ export const update = async (options) => {
     }
     const modifiers = GraphModifier.maybeLoad(options);
     const remover = new RollbackRemove();
+    const monorepo = Monorepo.maybeLoad(options.projectRoot, {
+        packageJson: options.packageJson,
+        scurry: options.scurry,
+    });
     try {
         const done = graphStep('build');
         const graph = await buildIdealFromStartingGraph({
@@ -35,13 +74,14 @@ export const update = async (options) => {
             remove: Object.assign(new Map(), {
                 modifiedDependencies: false,
             }),
-            graph: new Graph({ ...options, mainManifest }),
+            graph: startingGraph({ ...options, mainManifest, modifiers }, monorepo),
             modifiers,
             remover,
         });
         done();
         const act = actualLoad({
             ...options,
+            monorepo,
             mainManifest,
             loadManifests: true,
         });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.3.7",
+  "version": "1.4.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.3.7",
-    "@vltpkg/dep-id": "1.3.7",
-    "@vltpkg/dss-breadcrumb": "1.3.7",
-    "@vltpkg/error-cause": "1.3.7",
-    "@vltpkg/fast-split": "1.3.7",
-    "@vltpkg/graph-run": "1.3.7",
-    "@vltpkg/init": "1.3.7",
-    "@vltpkg/output": "1.3.7",
-    "@vltpkg/package-info": "1.3.7",
-    "@vltpkg/package-json": "1.3.7",
-    "@vltpkg/pick-manifest": "1.3.7",
-    "@vltpkg/query": "1.3.7",
-    "@vltpkg/rollback-remove": "1.3.7",
-    "@vltpkg/run": "1.3.7",
-    "@vltpkg/satisfies": "1.3.7",
-    "@vltpkg/security-archive": "1.3.7",
-    "@vltpkg/spec": "1.3.7",
-    "@vltpkg/types": "1.3.7",
-    "@vltpkg/vlt-json": "1.3.7",
-    "@vltpkg/workspaces": "1.3.7",
+    "@vltpkg/cmd-shim": "1.4.0",
+    "@vltpkg/dep-id": "1.4.0",
+    "@vltpkg/dss-breadcrumb": "1.4.0",
+    "@vltpkg/error-cause": "1.4.0",
+    "@vltpkg/fast-split": "1.4.0",
+    "@vltpkg/graph-run": "1.4.0",
+    "@vltpkg/init": "1.4.0",
+    "@vltpkg/output": "1.4.0",
+    "@vltpkg/package-info": "1.4.0",
+    "@vltpkg/package-json": "1.4.0",
+    "@vltpkg/pick-manifest": "1.4.0",
+    "@vltpkg/query": "1.4.0",
+    "@vltpkg/rollback-remove": "1.4.0",
+    "@vltpkg/run": "1.4.0",
+    "@vltpkg/satisfies": "1.4.0",
+    "@vltpkg/security-archive": "1.4.0",
+    "@vltpkg/spec": "1.4.0",
+    "@vltpkg/types": "1.4.0",
+    "@vltpkg/vlt-json": "1.4.0",
+    "@vltpkg/workspaces": "1.4.0",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },