@vzn/vx-lockfile 0.0.644 → 0.0.646

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 vx contributors
+Copyright (c) 2026 VZN
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -2,14 +2,14 @@
 
 Website: <https://vznjs.github.io/vx/> · this plugin: <https://vznjs.github.io/vx/plugins/vx-lockfile/> · source: <https://github.com/vznjs/vx>
 
-Lockfile plugins for [`@vzn/vx`](https://vznjs.github.io/vx/): `pnpm()`, `bun()`, `npm()` and `yarn()`. Each keys every task on its **own project's resolved dependency closure** from the package manager's lockfile, not on the whole file. `pnpm update foo` (or `bun add`, `npm install`, `yarn up`) re-keys exactly the projects that reach `foo` — through their dependencies, transitively, and through workspace links — and `vx run … --affected` selects the same projects. Each also gives vx the **projects, names and edges the lockfile records** (`discover`), adds each package's `package.json` to its cached tasks' inputs, and folds the manager's install settings into every task. Zero dependencies: Bun's own YAML and JSONC parsers, and a classic-yarn reader.
+Lockfile plugins for [`@vzn/vx`](https://vznjs.github.io/vx/): `bun()`, `pnpm()`, `npm()` and `yarn()`. Each keys every task on its **own project's resolved dependency closure** from the package manager's lockfile, not on the whole file. `pnpm update foo` (or `bun add`, `npm install`, `yarn up`) re-keys exactly the projects that reach `foo` — through their dependencies, transitively, and through workspace links — and `vx run … --affected` selects the same projects. Each also gives vx the **projects, names and edges the lockfile records** (`discover`), adds each package's `package.json` to its cached tasks' inputs, and folds the manager's install settings into every task. Zero dependencies: Bun's own YAML and JSONC parsers, and a classic-yarn reader.
 
 Core keys no package file: without a plugin no lockfile, install setting or `package.json` reaches any cache key, so an install re-keys nothing and a build made against the old `node_modules` replays. A JS workspace declares one.
 
 ## Usage
 
 ```sh
-npm install -D @vzn/vx @vzn/vx-lockfile   # or: pnpm add -D -w · yarn add -D (-W on Yarn 1) · bun add -d
+bun add -d @vzn/vx @vzn/vx-lockfile
 ```
 
 ```ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-lockfile",
-  "version": "0.0.644",
+  "version": "0.0.646",
   "license": "MIT",
   "description": "Lockfile plugins for vx — pnpm(), bun(), npm(), yarn(): each keys every task on its project's own resolved dependency closure from the package manager's lockfile, so a lockfile change re-keys only the projects it reaches; --affected follows the same answer.",
   "keywords": [
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.644"
+    "@vzn/vx": "^0.0.646"
   },
   "repository": {
     "type": "git",

package/src/index.ts

@@ -17,6 +17,7 @@
 // each importer's `package.json` to its tasks' inputs.
 //
 // Imports core only through the public `@vzn/vx` specifier.
+import { mkdir, rename } from 'node:fs/promises'
 import { createRequire } from 'node:module'
 import path from 'node:path'
 import {
@@ -41,6 +42,7 @@ const pnpmLock = (): typeof import('./pnpm.js') => load('./pnpm.js')
 const bunLock = (): typeof import('./bun.js') => load('./bun.js')
 const npmLock = (): typeof import('./npm.js') => load('./npm.js')
 const yarnLock = (): typeof import('./yarn.js') => load('./yarn.js')
+const pnpmSettings = (): typeof import('./pnpm-settings.js') => load('./pnpm-settings.js')
 
 export interface LockfileOptions {
   /**
@@ -112,10 +114,10 @@ const MANAGERS = {
     digest: (t, files) => pnpmLock().importerDigests(pnpmParse(t), files),
     importers: (t) => pnpmLock().importerLinks(pnpmParse(t)),
     extraFiles: (t) => pnpmLock().fileDeps(pnpmParse(t)),
-    recorded: (t) => pnpmParse(t).importers,
+    recorded: (t) => pnpmLock().recordedImporters(t),
     settings: ['pnpm-workspace.yaml', '.npmrc'],
     settingsText: (file, text) =>
-      file === 'pnpm-workspace.yaml' ? pnpmLock().workspaceSettings(text) : undefined,
+      file === 'pnpm-workspace.yaml' ? pnpmSettings().workspaceSettings(text) : undefined,
     peersInManifest: true,
   },
   bun: {
@@ -317,6 +319,11 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
     },
     async discover(ctx) {
       const manifest = manifestReader(ctx.workspaceRoot)
+      // The staleness check's walk overlaps the lockfile read.
+      const dirs = workspaceGlobs(ctx.workspaceRoot, manager.name, manifest).then((globs) =>
+        workspaceDirs(ctx.workspaceRoot, globs),
+      )
+      dirs.catch(() => {})
       const read = await readImporters(ctx, manifest)
       if (read === undefined) return []
       const { importers, file } = read
@@ -332,11 +339,8 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
         const missing = await staleness(
           ctx.workspaceRoot,
           importers,
-          manager.recorded(text),
-          await workspaceDirs(
-            ctx.workspaceRoot,
-            await workspaceGlobs(ctx.workspaceRoot, manager.name, manifest),
-          ),
+          await recordedOnce(ctx.cacheDir, file, text, manager.recorded),
+          await dirs,
           manifest,
         )
         if (missing.length > 0) {
@@ -375,6 +379,43 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
   })
 }
 
+/**
+ * The dependency names each importer records, kept per lockfile content:
+ * parsing them (pnpm's importers block, ~2 ms on solid, and the parser's
+ * load) was on every run, and only the lockfile text decides them.
+ */
+async function recordedOnce(
+  cacheDir: string,
+  file: string,
+  text: string,
+  recorded: (text: string) => ReadonlyMap<string, ReadonlyMap<string, unknown>>,
+): Promise<ReadonlyMap<string, ReadonlySet<string>>> {
+  const hash = `${RECORDED_VERSION}:${Bun.hash.xxHash3(text).toString(16)}`
+  const memo = path.join(cacheDir, 'lockfile-claims', `${file}.recorded.json`)
+  try {
+    const kept = (await Bun.file(memo).json()) as { hash: string; names: Record<string, string[]> }
+    if (kept.hash === hash) {
+      return new Map(Object.entries(kept.names).map(([i, names]) => [i, new Set(names)]))
+    }
+  } catch {
+    // None kept, or unreadable: parsed below.
+  }
+  const out = new Map([...recorded(text)].map(([i, deps]) => [i, new Set(deps.keys())]))
+  const names = Object.fromEntries([...out].map(([i, set]) => [i, [...set]]))
+  // Write-then-rename, so a concurrent run reads a whole memo or none. The
+  // memo is a speed-up: a failed write costs the next run a parse.
+  const tmp = `${memo}.tmp-${process.pid}-${Date.now()}`
+  try {
+    await mkdir(path.dirname(memo), { recursive: true })
+    await Bun.write(tmp, JSON.stringify({ hash, names }))
+    await rename(tmp, memo)
+  } catch {}
+  return out
+}
+
+/** Bumped when what `recorded` returns for the same text changes. */
+const RECORDED_VERSION = 1
+
 /** Up to five names, then a count of the rest. */
 function listed(names: readonly string[]): string {
   return names.length <= 5
@@ -513,14 +554,18 @@ async function workspaceDirs(root: string, globs: readonly unknown[]): Promise<s
 async function staleness(
   root: string,
   importers: ReadonlyMap<string, LockfileImporter>,
-  recorded: ReadonlyMap<string, ReadonlyMap<string, unknown>>,
+  recorded: ReadonlyMap<string, ReadonlySet<string>>,
   dirs: readonly string[],
   manifest: (dir: string) => Promise<Record<string, unknown> | null>,
 ): Promise<string[]> {
   const dirOf = (importer: string): string => (importer === '.' ? root : path.join(root, importer))
   const missing = dirs.filter((d) => !importers.has(d)).map((d) => `the workspace ${d}`)
   const names = new Set<string>()
-  for (const d of new Set([...importers.keys(), ...dirs])) {
+  const all = new Set([...importers.keys(), ...dirs])
+  // Read at once, then visited in order: the first unparsable one still
+  // names the refusal.
+  await Promise.allSettled([...all].map((d) => manifest(dirOf(d))))
+  for (const d of all) {
     const n = (await manifest(dirOf(d)))?.['name']
     if (typeof n === 'string') names.add(n)
   }

package/src/json.ts

@@ -29,3 +29,12 @@ export function peerOnly(e: Json): ReadonlySet<string> {
 export function record(v: unknown): Json | undefined {
   return v !== null && typeof v === 'object' && !Array.isArray(v) ? (v as Json) : undefined
 }
+
+/** JSON with sorted keys, so YAML key order cannot move a digest. */
+export function stable(v: unknown): string {
+  return JSON.stringify(v, (_k, val: unknown) =>
+    val !== null && typeof val === 'object' && !Array.isArray(val)
+      ? Object.fromEntries(Object.entries(val as Json).sort(([a], [b]) => (a < b ? -1 : 1)))
+      : val,
+  )
+}

package/src/pnpm-settings.ts

@@ -0,0 +1,26 @@
+// What every task folds from pnpm-workspace.yaml, apart from the lockfile
+// parser: a warm run reads the settings on every key, and loading pnpm.ts
+// for them cost ~1.5 ms a run.
+import { record, stable, type Json } from './json.js'
+
+/**
+ * pnpm-workspace.yaml as every task folds it: without `patchedDependencies`
+ * and `overrides`, whose effect the lockfile records per project (pnpm 10+
+ * keeps them here). Undefined for a file that does not parse to a mapping,
+ * folded whole.
+ */
+export function workspaceSettings(text: string): string | undefined {
+  let doc: unknown
+  try {
+    doc = Bun.YAML.parse(text)
+  } catch {
+    return undefined
+  }
+  const map = record(doc)
+  if (map === undefined) return undefined
+  const rest: Json = {}
+  for (const [k, v] of Object.entries(map)) {
+    if (k !== 'patchedDependencies' && k !== 'overrides') rest[k] = v
+  }
+  return `pnpm-workspace\0${stable(rest)}`
+}

package/src/pnpm.ts

@@ -12,7 +12,7 @@
 // Bun.YAML is the parser: no dependency, and the file is plain YAML.
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
-import { record } from './json.js'
+import { record, stable } from './json.js'
 import { joinPosix } from './posix.js'
 
 export interface Lockfile {
@@ -122,6 +122,34 @@ export function parseLockfile(text: string): Lockfile {
   return { version, importers, snapshots, resolutions, patches, directories, global }
 }
 
+/**
+ * The importers' dependencies alone, as `parseLockfile` reads them. The
+ * staleness check asks for them on every run, after the digest memo spared
+ * the parse: solid's 6,900-line lockfile took 8 ms to parse whole and
+ * 0.4 ms for its `importers` block. Sliced from the last document to the
+ * next top-level key; any other shape is parsed whole.
+ */
+export function recordedImporters(text: string): ReadonlyMap<string, ReadonlyMap<string, string>> {
+  const doc = Math.max(text.lastIndexOf('\n---'), 0)
+  const at = text.indexOf('\nimporters:\n', doc)
+  const block = at < 0 ? undefined : text.slice(at + 1)
+  const end = block === undefined ? null : /\n\S/.exec(block.slice('importers:\n'.length))
+  const rawImporters =
+    block === undefined
+      ? undefined
+      : record(
+          record(
+            Bun.YAML.parse(
+              end === null ? block : block.slice(0, 'importers:\n'.length + end.index + 1),
+            ),
+          )?.['importers'],
+        )
+  if (rawImporters === undefined) return parseLockfile(text).importers
+  const importers = new Map<string, ReadonlyMap<string, string>>()
+  for (const [dir, entry] of Object.entries(rawImporters)) importers.set(dir, depsOf(entry))
+  return importers
+}
+
 /** `dependencies` + `devDependencies` + `optionalDependencies` of an entry, as name → version. */
 function depsOf(entry: unknown): ReadonlyMap<string, string> {
   const out = new Map<string, string>()
@@ -153,37 +181,6 @@ function scalar(v: unknown): string {
       : ''
 }
 
-/**
- * pnpm-workspace.yaml as every task folds it: without `patchedDependencies`
- * and `overrides`, whose effect the lockfile records per project (pnpm 10+
- * keeps them here). Undefined for a file that does not parse to a mapping,
- * folded whole.
- */
-export function workspaceSettings(text: string): string | undefined {
-  let doc: unknown
-  try {
-    doc = Bun.YAML.parse(text)
-  } catch {
-    return undefined
-  }
-  const map = record(doc)
-  if (map === undefined) return undefined
-  const rest: Yaml = {}
-  for (const [k, v] of Object.entries(map)) {
-    if (k !== 'patchedDependencies' && k !== 'overrides') rest[k] = v
-  }
-  return `pnpm-workspace\0${stable(rest)}`
-}
-
-/** JSON with sorted keys, so YAML key order cannot move a digest. */
-export function stable(v: unknown): string {
-  return JSON.stringify(v, (_k, val: unknown) =>
-    val !== null && typeof val === 'object' && !Array.isArray(val)
-      ? Object.fromEntries(Object.entries(val as Yaml).sort(([a], [b]) => (a < b ? -1 : 1)))
-      : val,
-  )
-}
-
 /**
  * The snapshot key a dependency `name@version` resolves to, per lockfile
  * generation: `name@1.0.0(peer@2)` (v9), `/name@1.0.0(peer@2)` (v6),

package/src/yarn.ts

@@ -12,8 +12,7 @@
 // one digest is the root's reach through every entry the file resolves.
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
-import { stable } from './pnpm.js'
-import { depsOf, record } from './json.js'
+import { depsOf, record, stable } from './json.js'
 import { joinPosix } from './posix.js'
 
 export interface Lockfile {