@vltpkg/package-info 1.0.9 → 1.0.10

package/dist/index.js

@@ -26,6 +26,15 @@ const manifestCacheMaxAge = 5 * 60 * 1000;
 const noRegistryError = (spec) => error('No registry configured to resolve this spec. Set "registry" in ' +
     'vlt.json, pass --registry, or run `vlt login --registry=<url>`. ' +
     'See https://docs.vlt.sh/cli', { code: 'ECONFIG', spec });
+/**
+ * A selector that can point at a different version tomorrow: a dist tag,
+ * or a range matching anything (`*`, empty string). Manifest results for
+ * these are not cached to disk, and packument requests for them force a
+ * revalidation of the registry client's cache entry.
+ *
+ * Takes a *final* spec (`spec.final`), same as `pickManifest` sees.
+ */
+const isMovingSelector = (f) => !!(f.distTag || f.range?.isAny);
 export class PackageInfoClient {
     #registryClient;
     #projectRoot;
@@ -39,7 +48,9 @@ export class PackageInfoClient {
     #cachePath;
     // In-flight coalescing key is `${registry}${name}` — no representation
     // component. Safe only because every caller requests the same full
-    // packument (see #fetchPackument).
+    // packument (see #fetchPackument). The one thing that does vary per
+    // caller is forceRevalidate, so record it and let a moving selector
+    // reuse a forced promise but never a non-forced one (see packument()).
     #packumentPromises = new Map();
     // unique temp file names for atomic manifest cache writes
     #manifestWriteRandom = randomBytes(6).toString('hex');
@@ -333,11 +344,9 @@ export class PackageInfoClient {
         if (options.before) {
             return;
         }
-        // if the final resolved spec is either a dist tag or something that
-        // matches any range (such as a semver range of `*` or empty string)
-        // then we skip caching
+        // a moving selector's result is variable, so don't cache it
         const f = spec.final;
-        if (f.distTag || f.range?.isAny) {
+        if (isMovingSelector(f)) {
             return;
         }
         const key = this.#manifestCacheKey(f, options);
@@ -660,16 +669,30 @@ export class PackageInfoClient {
                     throw noRegistryError(spec);
                 // Coalescing key has no representation component (see #fetchPackument).
                 const packumentKey = `${registry}${name}`;
+                const forced = isMovingSelector(f);
                 const inflight = this.#packumentPromises.get(packumentKey);
-                if (inflight)
-                    return inflight;
+                // a moving selector must not ride along on a non-forced request:
+                // that one can settle to a fresh-but-stale cache hit, which is
+                // exactly what forceRevalidate exists to avoid. the other
+                // direction is fine -- a forced result is never staler.
+                // costs at most one extra concurrent GET for the same packument
+                // when both shapes are asked for at once.
+                if (inflight && (!forced || inflight.forced))
+                    return inflight.promise;
                 const pakuURL = new URL(name, registry);
                 const promise = this.#fetchPackument(spec, options, pakuURL);
-                this.#packumentPromises.set(packumentKey, promise);
-                // Clean up once settled so we don't leak memory.
+                const record = { promise, forced };
+                this.#packumentPromises.set(packumentKey, record);
+                // Clean up once settled so we don't leak memory, unless a forced
+                // request has since taken the slot over.
                 // Use .then/.catch instead of .finally to avoid creating
                 // an unhandled rejection from the derived promise.
-                promise.then(() => this.#packumentPromises.delete(packumentKey), () => this.#packumentPromises.delete(packumentKey));
+                const clear = () => {
+                    if (this.#packumentPromises.get(packumentKey) === record) {
+                        this.#packumentPromises.delete(packumentKey);
+                    }
+                };
+                promise.then(clear, clear);
                 return promise;
             }
         }
@@ -703,6 +726,12 @@ export class PackageInfoClient {
         const response = await (await this.getRegistryClient()).request(pakuURL, {
             headers: { accept: 'application/json' },
             ...(useCache === false ? { useCache } : {}),
+            // costs a conditional GET per moving selector on an otherwise warm
+            // cache, install included. 304s are cheap but not free; the
+            // alternative is serving a dist tag that moved (#1656).
+            ...(isMovingSelector(spec.final) ?
+                { forceRevalidate: true }
+                : {}),
         });
         if (response.statusCode !== 200) {
             throw this.#resolveError(spec, options, 'failed to fetch packument', {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/package-info",
   "description": "Resolve and fetch package metadata and tarballs",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,17 +13,17 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/error-cause": "1.0.9",
-    "@vltpkg/git": "1.0.9",
-    "@vltpkg/output": "1.0.9",
-    "@vltpkg/package-json": "1.0.9",
-    "@vltpkg/pick-manifest": "1.0.9",
-    "@vltpkg/registry-client": "1.0.9",
-    "@vltpkg/spec": "1.0.9",
-    "@vltpkg/tar": "1.0.9",
-    "@vltpkg/types": "1.0.9",
-    "@vltpkg/workspaces": "1.0.9",
-    "@vltpkg/xdg": "1.0.9",
+    "@vltpkg/error-cause": "1.0.10",
+    "@vltpkg/git": "1.0.10",
+    "@vltpkg/output": "1.0.10",
+    "@vltpkg/package-json": "1.0.10",
+    "@vltpkg/pick-manifest": "1.0.10",
+    "@vltpkg/registry-client": "1.0.10",
+    "@vltpkg/spec": "1.0.10",
+    "@vltpkg/tar": "1.0.10",
+    "@vltpkg/types": "1.0.10",
+    "@vltpkg/workspaces": "1.0.10",
+    "@vltpkg/xdg": "1.0.10",
     "ssri": "^13.0.0",
     "tar": "^7.5.2"
   },
@@ -32,8 +32,8 @@
     "@types/node": "^22.19.2",
     "@types/pacote": "^11.1.8",
     "@vltpkg/benchmark": "0.0.0",
-    "@vltpkg/cache-unzip": "1.0.9",
-    "@vltpkg/vlt-json": "1.0.9",
+    "@vltpkg/cache-unzip": "1.0.10",
+    "@vltpkg/vlt-json": "1.0.10",
     "eslint": "^9.39.1",
     "pacote": "^21.0.4",
     "prettier": "^3.7.4",