@vltpkg/package-info 1.0.8 → 1.0.10

package/dist/index.js

@@ -1,5 +1,6 @@
 import { error } from '@vltpkg/error-cause';
 import { clone, resolve as gitResolve, revs } from '@vltpkg/git';
+import { logRequest } from '@vltpkg/output';
 import { PackageJson } from '@vltpkg/package-json';
 import { pickManifest } from '@vltpkg/pick-manifest';
 import { Spec } from '@vltpkg/spec';
@@ -10,8 +11,10 @@ import { XDG } from '@vltpkg/xdg';
 import { createHash, randomBytes } from 'node:crypto';
 import { mkdir, readFile, rm, stat, symlink, unlink, writeFile, } from 'node:fs/promises';
 import { basename, dirname, resolve as pathResolve, relative, } from 'node:path';
+import { debuglog } from 'node:util';
 import { create as tarC } from 'tar';
 import { rename } from "./rename.js";
+const debug = debuglog('vlt');
 const xdg = new XDG('vlt');
 export const delimiter = '~';
 // the maximum duration of a manifest cache file
@@ -23,6 +26,15 @@ const manifestCacheMaxAge = 5 * 60 * 1000;
 const noRegistryError = (spec) => error('No registry configured to resolve this spec. Set "registry" in ' +
     'vlt.json, pass --registry, or run `vlt login --registry=<url>`. ' +
     'See https://docs.vlt.sh/cli', { code: 'ECONFIG', spec });
+/**
+ * A selector that can point at a different version tomorrow: a dist tag,
+ * or a range matching anything (`*`, empty string). Manifest results for
+ * these are not cached to disk, and packument requests for them force a
+ * revalidation of the registry client's cache entry.
+ *
+ * Takes a *final* spec (`spec.final`), same as `pickManifest` sees.
+ */
+const isMovingSelector = (f) => !!(f.distTag || f.range?.isAny);
 export class PackageInfoClient {
     #registryClient;
     #projectRoot;
@@ -36,7 +48,9 @@ export class PackageInfoClient {
     #cachePath;
     // In-flight coalescing key is `${registry}${name}` — no representation
     // component. Safe only because every caller requests the same full
-    // packument (see #fetchPackument).
+    // packument (see #fetchPackument). The one thing that does vary per
+    // caller is forceRevalidate, so record it and let a moving selector
+    // reuse a forced promise but never a non-forced one (see packument()).
     #packumentPromises = new Map();
     // unique temp file names for atomic manifest cache writes
     #manifestWriteRandom = randomBytes(6).toString('hex');
@@ -129,6 +143,25 @@ export class PackageInfoClient {
                 // fallthrough if a remote tarball url present
             }
             case 'registry': {
+                // if the tarball is already on disk, unpack it straight from
+                // the cache file: it never has to be held in the client's
+                // in-memory cache. anything unexpected falls through to the
+                // fetch path, which throws its own error if the body is
+                // genuinely bad.
+                const cached = (await this.getRegistryClient()).cachedBody(r.resolved, { integrity: r.integrity });
+                if (cached) {
+                    try {
+                        await (await this.getTarPool()).unpack(cached.body, target);
+                        logRequest(r.resolved, 'cache');
+                        return r;
+                    }
+                    catch (er) {
+                        // a systematically failing fast path (every entry still
+                        // gzipped, EACCES, ENOSPC...) doubles the IO of the fetch
+                        // path, so leave a trace behind. NODE_DEBUG=vlt to see it.
+                        debug('cached tarball unpack failed: %s: %s', cached.path, er);
+                    }
+                }
                 const fetchTarball = async (useCache) => {
                     const trustIntegrity = this.#trustedIntegrities.get(r.resolved) === r.integrity;
                     const response = await (await this.getRegistryClient()).request(r.resolved, {
@@ -244,7 +277,7 @@ export class PackageInfoClient {
                 const st = await stat(path);
                 if (st.isFile()) {
                     try {
-                        await (await this.getTarPool()).unpack(await this.tarball(spec, options), target);
+                        await (await this.getTarPool()).unpackFile(path, target);
                     }
                     catch (er) {
                         throw this.#resolveError(spec, options, 'tar unpack failed', { cause: er });
@@ -311,11 +344,9 @@ export class PackageInfoClient {
         if (options.before) {
             return;
         }
-        // if the final resolved spec is either a dist tag or something that
-        // matches any range (such as a semver range of `*` or empty string)
-        // then we skip caching
+        // a moving selector's result is variable, so don't cache it
         const f = spec.final;
-        if (f.distTag || f.range?.isAny) {
+        if (isMovingSelector(f)) {
             return;
         }
         const key = this.#manifestCacheKey(f, options);
@@ -586,7 +617,7 @@ export class PackageInfoClient {
                 const s = spec;
                 return await this.#tmpdir(async (dir) => {
                     try {
-                        await (await this.getTarPool()).unpack(await readFile(path), dir);
+                        await (await this.getTarPool()).unpackFile(path, dir);
                     }
                     catch (er) {
                         throw this.#resolveError(s, options, 'tar unpack failed', { cause: er });
@@ -638,16 +669,30 @@ export class PackageInfoClient {
                     throw noRegistryError(spec);
                 // Coalescing key has no representation component (see #fetchPackument).
                 const packumentKey = `${registry}${name}`;
+                const forced = isMovingSelector(f);
                 const inflight = this.#packumentPromises.get(packumentKey);
-                if (inflight)
-                    return inflight;
+                // a moving selector must not ride along on a non-forced request:
+                // that one can settle to a fresh-but-stale cache hit, which is
+                // exactly what forceRevalidate exists to avoid. the other
+                // direction is fine -- a forced result is never staler.
+                // costs at most one extra concurrent GET for the same packument
+                // when both shapes are asked for at once.
+                if (inflight && (!forced || inflight.forced))
+                    return inflight.promise;
                 const pakuURL = new URL(name, registry);
                 const promise = this.#fetchPackument(spec, options, pakuURL);
-                this.#packumentPromises.set(packumentKey, promise);
-                // Clean up once settled so we don't leak memory.
+                const record = { promise, forced };
+                this.#packumentPromises.set(packumentKey, record);
+                // Clean up once settled so we don't leak memory, unless a forced
+                // request has since taken the slot over.
                 // Use .then/.catch instead of .finally to avoid creating
                 // an unhandled rejection from the derived promise.
-                promise.then(() => this.#packumentPromises.delete(packumentKey), () => this.#packumentPromises.delete(packumentKey));
+                const clear = () => {
+                    if (this.#packumentPromises.get(packumentKey) === record) {
+                        this.#packumentPromises.delete(packumentKey);
+                    }
+                };
+                promise.then(clear, clear);
                 return promise;
             }
         }
@@ -681,6 +726,12 @@ export class PackageInfoClient {
         const response = await (await this.getRegistryClient()).request(pakuURL, {
             headers: { accept: 'application/json' },
             ...(useCache === false ? { useCache } : {}),
+            // costs a conditional GET per moving selector on an otherwise warm
+            // cache, install included. 304s are cheap but not free; the
+            // alternative is serving a dist tag that moved (#1656).
+            ...(isMovingSelector(spec.final) ?
+                { forceRevalidate: true }
+                : {}),
         });
         if (response.statusCode !== 200) {
             throw this.#resolveError(spec, options, 'failed to fetch packument', {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/package-info",
   "description": "Resolve and fetch package metadata and tarballs",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,16 +13,17 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/error-cause": "1.0.8",
-    "@vltpkg/git": "1.0.8",
-    "@vltpkg/package-json": "1.0.8",
-    "@vltpkg/pick-manifest": "1.0.8",
-    "@vltpkg/registry-client": "1.0.8",
-    "@vltpkg/spec": "1.0.8",
-    "@vltpkg/tar": "1.0.8",
-    "@vltpkg/types": "1.0.8",
-    "@vltpkg/workspaces": "1.0.8",
-    "@vltpkg/xdg": "1.0.8",
+    "@vltpkg/error-cause": "1.0.10",
+    "@vltpkg/git": "1.0.10",
+    "@vltpkg/output": "1.0.10",
+    "@vltpkg/package-json": "1.0.10",
+    "@vltpkg/pick-manifest": "1.0.10",
+    "@vltpkg/registry-client": "1.0.10",
+    "@vltpkg/spec": "1.0.10",
+    "@vltpkg/tar": "1.0.10",
+    "@vltpkg/types": "1.0.10",
+    "@vltpkg/workspaces": "1.0.10",
+    "@vltpkg/xdg": "1.0.10",
     "ssri": "^13.0.0",
     "tar": "^7.5.2"
   },
@@ -31,8 +32,8 @@
     "@types/node": "^22.19.2",
     "@types/pacote": "^11.1.8",
     "@vltpkg/benchmark": "0.0.0",
-    "@vltpkg/cache-unzip": "1.0.8",
-    "@vltpkg/vlt-json": "1.0.8",
+    "@vltpkg/cache-unzip": "1.0.10",
+    "@vltpkg/vlt-json": "1.0.10",
     "eslint": "^9.39.1",
     "pacote": "^21.0.4",
     "prettier": "^3.7.4",