@vzn/vx-lockfile 0.0.645 → 0.0.648

package/src/json.ts

@@ -29,3 +29,12 @@ export function peerOnly(e: Json): ReadonlySet<string> {
 export function record(v: unknown): Json | undefined {
   return v !== null && typeof v === 'object' && !Array.isArray(v) ? (v as Json) : undefined
 }
+
+/** JSON with sorted keys, so YAML key order cannot move a digest. */
+export function stable(v: unknown): string {
+  return JSON.stringify(v, (_k, val: unknown) =>
+    val !== null && typeof val === 'object' && !Array.isArray(val)
+      ? Object.fromEntries(Object.entries(val as Json).sort(([a], [b]) => (a < b ? -1 : 1)))
+      : val,
+  )
+}

package/src/npm.ts

@@ -16,58 +16,68 @@ export interface Lockfile {
   readonly packages: ReadonlyMap<string, Entry>
   /** Material every workspace folds. */
   readonly global: string
-  /** Directories `file:` dependencies link to: not the root, not a workspace. */
+  /** Directories `file:` dependencies link to or copy: not the root, not a workspace. */
   readonly fileDirs: readonly string[]
 }
 
 export interface Entry {
   readonly deps: ReadonlyMap<string, string>
-  /** version + resolved + integrity — whatever pins the bytes; '' for a link */
+  /** version + resolved + integrity — whatever pins the bytes; '' for a link, the root, a workspace */
   readonly resolution: string
   /** the path a `link: true` entry points at */
   readonly link: string | undefined
+  /** the `file:` directory an entry is a copy of (`install-links=true`) */
+  readonly copyOf: string | undefined
   readonly isWorkspace: boolean
   /** the peers it installs no entry for */
   readonly peers: ReadonlySet<string>
 }
 
 export function parseLockfile(text: string): Lockfile {
-  let doc: unknown
-  try {
-    doc = JSON.parse(text)
-  } catch (err) {
-    throw new Error(`package-lock.json: ${err instanceof Error ? err.message : String(err)}`)
-  }
+  // The claim names the file: npm-shrinkwrap.json or package-lock.json.
+  const doc: unknown = JSON.parse(text)
   const d = record(doc)
   const version = d === undefined ? undefined : d['lockfileVersion']
   if (typeof version !== 'number') {
-    throw new Error('package-lock.json: not an npm lockfile (no lockfileVersion)')
+    throw new Error('not an npm lockfile (no lockfileVersion)')
   }
   if (version < 2) {
     throw new Error(
-      `package-lock.json: lockfileVersion ${version} has no \`packages\` map — npm 7+ writes version 2 or 3`,
+      `lockfileVersion ${version} has no \`packages\` map — npm 7+ writes version 2 or 3`,
     )
   }
   const raws = record(d!['packages']) ?? {}
-  const globs = workspaceGlobs(raws[''])
+  const isMember = workspaceMatcher(raws[''])
   const packages = new Map<string, Entry>()
   for (const [p, raw] of Object.entries(raws)) {
     const e = record(raw) ?? {}
     const link = e['link'] === true && typeof e['resolved'] === 'string' ? e['resolved'] : undefined
+    // A tarball carries its integrity; a directory npm packed and copied
+    // (`install-links=true`) carries none, only its path.
+    const resolved = e['resolved']
+    const copyOf =
+      link === undefined &&
+      typeof resolved === 'string' &&
+      resolved.startsWith('file:') &&
+      typeof e['integrity'] !== 'string'
+        ? resolved.slice('file:'.length)
+        : undefined
+    const isWorkspace =
+      p !== '' && !p.startsWith('node_modules/') && !p.includes('/node_modules/') && isMember(p)
     packages.set(p, {
       deps: depsOf(e),
+      // The root's and a workspace's `version` is their own package.json's,
+      // not what npm installed: a release bump of the root re-keyed every
+      // task with node_modules unchanged.
       resolution:
-        link === undefined
+        link === undefined && p !== '' && !isWorkspace
           ? [e['version'], e['resolved'], e['integrity']]
               .map((v) => (typeof v === 'string' ? v : ''))
               .join('\0')
           : '',
       link,
-      isWorkspace:
-        p !== '' &&
-        !p.startsWith('node_modules/') &&
-        !p.includes('/node_modules/') &&
-        (globs === undefined || globs.some((g) => g.match(p))),
+      copyOf,
+      isWorkspace,
       peers: peerOnly(e),
     })
   }
@@ -79,23 +89,34 @@ export function parseLockfile(text: string): Lockfile {
     if (e.link !== undefined && e.link !== '' && packages.get(e.link)?.isWorkspace !== true) {
       fileDirs.add(e.link)
     }
+    if (e.copyOf !== undefined) fileDirs.add(e.copyOf)
   }
   return { version, packages, global, fileDirs: [...fileDirs].sort() }
 }
 
 /**
- * The root's `workspaces` globs: what tells a workspace from a `file:`
- * directory, both entries outside node_modules that a link resolves to.
- * Taking every such entry for a workspace made `vendor/dep` a project, so
- * an edit under it selected nothing. `undefined` when the root names none.
+ * Whether a path is a member by the root's `workspaces` globs: what tells
+ * a workspace from a `file:` directory, both entries outside node_modules
+ * that a link resolves to. Taking every such entry for a workspace made
+ * `vendor/dep` a project, so an edit under it selected nothing. A root
+ * that names none has no workspace, and every such entry is a `file:`
+ * directory (taken for workspaces, their content was never hashed). A
+ * `!` glob excludes, as npm reads it: as a glob of its own it matched
+ * every other path.
  */
-function workspaceGlobs(root: unknown): Bun.Glob[] | undefined {
+function workspaceMatcher(root: unknown): (p: string) => boolean {
   const ws = record(root)?.['workspaces']
   const list = Array.isArray(ws) ? ws : record(ws)?.['packages']
-  if (!Array.isArray(list)) return undefined
-  return list
-    .filter((g): g is string => typeof g === 'string')
-    .map((g) => new Bun.Glob(g.replace(/^\.\//, '').replace(/\/+$/, '')))
+  if (!Array.isArray(list)) return () => false
+  // Matched against the manifest's path, as npm globs `<pattern>/package.json`.
+  const glob = (g: string): Bun.Glob =>
+    new Bun.Glob(`${g.replace(/^\.\//, '').replace(/\/+$/, '')}/package.json`)
+  const strings = list.filter((g): g is string => typeof g === 'string')
+  const include = strings.filter((g) => !g.startsWith('!')).map(glob)
+  const exclude = strings.filter((g) => g.startsWith('!')).map((g) => glob(g.slice(1)))
+  return (p) =>
+    include.some((g) => g.match(`${p}/package.json`)) &&
+    !exclude.some((g) => g.match(`${p}/package.json`))
 }
 
 /**
@@ -141,13 +162,16 @@ export function importerDigests(
     material.push(`${p === '' || e.isWorkspace ? p : installName(p)}\0${e.resolution}`)
     edges.push([])
   }
-  // npm links a `file:` directory, so what a task reads is its content now,
-  // which the lockfile does not record: an edit to it replayed a stale hit.
+  // npm links a `file:` directory, or with `install-links=true` copies it,
+  // so what a task reads is its content now, which the lockfile does not
+  // record: an edit to it replayed a stale hit.
   for (const dir of lock.fileDirs) {
     const own = `\nfile\0${files.get(dir) ?? ''}`
     const i = index.get(dir)
+    for (const [p, e] of lock.packages) {
+      if (e.copyOf === dir || (i === undefined && e.link === dir)) material[index.get(p)!] += own
+    }
     if (i !== undefined) material[i] += own
-    else for (const [p, e] of lock.packages) if (e.link === dir) material[index.get(p)!] += own
   }
   for (const [p, e] of lock.packages) {
     const from = index.get(p)!

package/src/pnpm-settings.ts

@@ -0,0 +1,71 @@
+// What every task folds from pnpm-workspace.yaml, apart from the lockfile
+// parser: a warm run reads the settings on every key, and loading pnpm.ts
+// for them cost ~1.5 ms a run.
+import { record, stable, type Json } from './json.js'
+
+/** What pnpm-lock.yaml records per project: its effect keys through the snapshots a project reaches. */
+const RECORDED = new Set(['patchedDependencies', 'overrides', 'catalog', 'catalogs'])
+
+/**
+ * pnpm-workspace.yaml as every task folds it: without `patchedDependencies`,
+ * `overrides` and the catalogs, whose effect the lockfile records per
+ * project (pnpm 10+ keeps them here). Undefined for a file that does not
+ * parse to a mapping, folded whole.
+ */
+export function workspaceSettings(text: string): string | undefined {
+  let doc: unknown
+  try {
+    doc = Bun.YAML.parse(text)
+  } catch {
+    return undefined
+  }
+  const map = record(doc)
+  if (map === undefined) return undefined
+  const rest: Json = {}
+  for (const [k, v] of Object.entries(map)) {
+    if (!RECORDED.has(k)) rest[k] = v
+  }
+  return `pnpm-workspace\0${stable(rest)}`
+}
+
+/**
+ * pnpm's `shared-workspace-lockfile`, true unless set: pnpm-workspace.yaml's
+ * `sharedWorkspaceLockfile` when a boolean (pnpm 10.8+ reads it first; a
+ * quoted "false" installs shared), else `.npmrc`'s.
+ */
+export function sharedWorkspaceLockfile(
+  workspaceYaml: string | null,
+  npmrc: string | null,
+): boolean {
+  if (workspaceYaml !== null) {
+    try {
+      const set = record(Bun.YAML.parse(workspaceYaml))?.['sharedWorkspaceLockfile']
+      if (typeof set === 'boolean') return set
+    } catch {}
+  }
+  return npmrc?.match(/^[ \t]*shared-workspace-lockfile[ \t]*=[ \t]*(\S*)/m)?.[1] !== 'false'
+}
+
+/**
+ * The root package.json as every task folds it: only its `pnpm` field,
+ * which pnpm reads install settings from (`onlyBuiltDependencies`,
+ * `supportedArchitectures`, …) and the lockfile records none of, without
+ * the patches and overrides it does record. Its dependencies are the
+ * lockfile's to record. Undefined for a file that does not parse to a
+ * mapping, folded whole.
+ */
+export function packageSettings(text: string): string | undefined {
+  let doc: unknown
+  try {
+    doc = JSON.parse(text)
+  } catch {
+    return undefined
+  }
+  const map = record(doc)
+  if (map === undefined) return undefined
+  const rest: Json = {}
+  for (const [k, v] of Object.entries(record(map['pnpm']) ?? {})) {
+    if (k !== 'patchedDependencies' && k !== 'overrides') rest[k] = v
+  }
+  return `pnpm-package\0${stable(rest)}`
+}

package/src/pnpm.ts

@@ -12,7 +12,7 @@
 // Bun.YAML is the parser: no dependency, and the file is plain YAML.
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
-import { record } from './json.js'
+import { record, stable } from './json.js'
 import { joinPosix } from './posix.js'
 
 export interface Lockfile {
@@ -29,6 +29,8 @@ export interface Lockfile {
   readonly directories: ReadonlyMap<string, string>
   /** Material every importer folds: the lockfile version and the install-wide knobs. */
   readonly global: string
+  /** `settings.excludeLinksFromLockfile`: no importer records its `link:` dependencies. */
+  readonly excludesLinks: boolean
 }
 
 type Yaml = Record<string, unknown>
@@ -119,7 +121,85 @@ export function parseLockfile(text: string): Lockfile {
       ? { lockfileVersion: version, rest }
       : { lockfileVersion: version, rest, leading },
   )
-  return { version, importers, snapshots, resolutions, patches, directories, global }
+  const excludesLinks = record(doc['settings'])?.['excludeLinksFromLockfile'] === true
+  return { version, importers, snapshots, resolutions, patches, directories, global, excludesLinks }
+}
+
+/**
+ * Whether pnpm drops a manifest's dependency `name` from the install:
+ * one of its `optionalDependencies` the lockfile's
+ * `ignoredOptionalDependencies` names (pnpm also drops it from
+ * `dependencies`, and records it nowhere), matched as `@pnpm/matcher`
+ * does: `*` any run, a leading `!` excludes.
+ */
+export function ignoredOptional(
+  text: string,
+): (name: string, pkg: Record<string, unknown>) => boolean {
+  const list = topLevel(text, 'ignoredOptionalDependencies')
+  const patterns = Array.isArray(list) ? list.filter((p) => typeof p === 'string') : []
+  if (patterns.length === 0) return () => false
+  const matchers = patterns.map((p) => {
+    const ignore = p.startsWith('!')
+    const pattern = ignore ? p.slice(1) : p
+    const re = new RegExp(`^${pattern.replace(/[|\\{}()[\]^$+?.]/g, '\\$&').replace(/\*/g, '.*')}$`)
+    return { ignore, match: (s: string) => re.test(s) }
+  })
+  const hasInclude = matchers.some((m) => !m.ignore)
+  const hasIgnore = matchers.some((m) => m.ignore)
+  const matches = (name: string): boolean => {
+    if (!hasIgnore) return matchers.some((m) => m.match(name))
+    if (!hasInclude) return !matchers.some((m) => m.match(name))
+    let matched = false
+    for (const m of matchers) {
+      if (m.ignore) {
+        if (m.match(name)) matched = false
+      } else if (!matched && m.match(name)) matched = true
+    }
+    return matched
+  }
+  return (name, pkg) => {
+    const optional = record(pkg['optionalDependencies'])
+    return optional !== undefined && Object.hasOwn(optional, name) && matches(name)
+  }
+}
+
+/**
+ * The importers' dependencies alone, as `parseLockfile` reads them. The
+ * staleness check asks for them on every run, after the digest memo spared
+ * the parse: solid's 6,900-line lockfile took 8 ms to parse whole and
+ * 0.4 ms for its `importers` block. Sliced from the last document to the
+ * next top-level key; any other shape is parsed whole.
+ */
+export function recordedImporters(text: string): ReadonlyMap<string, ReadonlyMap<string, string>> {
+  const rawImporters = record(topLevel(text, 'importers'))
+  if (rawImporters === undefined) return parseLockfile(text).importers
+  const importers = new Map<string, ReadonlyMap<string, string>>()
+  for (const [dir, entry] of Object.entries(rawImporters)) importers.set(dir, depsOf(entry))
+  return importers
+}
+
+/** `settings.excludeLinksFromLockfile`, read from its block alone as `recordedImporters` reads. */
+export function excludesLinks(text: string): boolean {
+  return record(topLevel(text, 'settings'))?.['excludeLinksFromLockfile'] === true
+}
+
+/**
+ * The last document's top-level `key`, parsed from its block alone (to
+ * the next top-level key); undefined where pnpm wrote no such block. A
+ * CRLF file (a Windows checkout) heads it `key:\r\n`: found by `\n`
+ * alone, the block read as absent though the whole parse has it.
+ */
+function topLevel(text: string, key: string): unknown {
+  const doc = Math.max(text.lastIndexOf('\n---'), 0)
+  // The first line's ending says which: a second scan cost every LF run.
+  const head = text.charCodeAt(text.indexOf('\n') - 1) === 13 ? `\n${key}:\r\n` : `\n${key}:\n`
+  const at = text.indexOf(head, doc)
+  if (at < 0) return undefined
+  const block = text.slice(at + 1)
+  const end = /\n\S/.exec(block.slice(head.length - 1))
+  return record(
+    Bun.YAML.parse(end === null ? block : block.slice(0, head.length - 1 + end.index + 1)),
+  )?.[key]
 }
 
 /** `dependencies` + `devDependencies` + `optionalDependencies` of an entry, as name → version. */
@@ -153,37 +233,6 @@ function scalar(v: unknown): string {
       : ''
 }
 
-/**
- * pnpm-workspace.yaml as every task folds it: without `patchedDependencies`
- * and `overrides`, whose effect the lockfile records per project (pnpm 10+
- * keeps them here). Undefined for a file that does not parse to a mapping,
- * folded whole.
- */
-export function workspaceSettings(text: string): string | undefined {
-  let doc: unknown
-  try {
-    doc = Bun.YAML.parse(text)
-  } catch {
-    return undefined
-  }
-  const map = record(doc)
-  if (map === undefined) return undefined
-  const rest: Yaml = {}
-  for (const [k, v] of Object.entries(map)) {
-    if (k !== 'patchedDependencies' && k !== 'overrides') rest[k] = v
-  }
-  return `pnpm-workspace\0${stable(rest)}`
-}
-
-/** JSON with sorted keys, so YAML key order cannot move a digest. */
-export function stable(v: unknown): string {
-  return JSON.stringify(v, (_k, val: unknown) =>
-    val !== null && typeof val === 'object' && !Array.isArray(val)
-      ? Object.fromEntries(Object.entries(val as Yaml).sort(([a], [b]) => (a < b ? -1 : 1)))
-      : val,
-  )
-}
-
 /**
  * The snapshot key a dependency `name@version` resolves to, per lockfile
  * generation: `name@1.0.0(peer@2)` (v9), `/name@1.0.0(peer@2)` (v6),
@@ -240,8 +289,15 @@ export function importerDigests(
   // The global digest rides as DATA: Bun's xxHash3 reads only the low 32
   // bits of a seed, so two lockfiles' globals could share one (item 682).
   const global = Bun.hash.xxHash3(lock.global).toString(16).padStart(16, '0')
+  const reachOf = (dir: string): string => hashes[g.index.get(importerNode(dir))!]!
+  // With its links left out, the file does not say which importer links
+  // which, so each folds them all: keyed by its own reach, a project
+  // linking another missed a bump in the linked one's dependencies.
+  const all = lock.excludesLinks
+    ? [...lock.importers.keys()].sort().map(reachOf).join('\0')
+    : undefined
   for (const dir of lock.importers.keys()) {
-    const h = Bun.hash.xxHash3(`${global}\0${hashes[g.index.get(importerNode(dir))!]!}`)
+    const h = Bun.hash.xxHash3(`${global}\0${all ?? reachOf(dir)}`)
     out.set(dir, h.toString(16).padStart(16, '0'))
   }
   return out
@@ -268,12 +324,17 @@ function importerNode(dir: string): string {
  */
 export function fileDeps(lock: Lockfile): string[] {
   const out = new Set(lock.directories.values())
-  for (const [dir, deps] of lock.importers) {
+  const add = (dir: string, deps: ReadonlyMap<string, string>): void => {
     for (const version of deps.values()) {
       const target = linkTarget(lock, dir, version)
       if (target !== undefined && !lock.importers.has(target)) out.add(target)
     }
   }
+  for (const [dir, deps] of lock.importers) add(dir, deps)
+  // An override to a `link:` directory reaches a package's own
+  // dependencies, written root-relative in its snapshot: one no importer
+  // names was never read, so an edit in it moved no key.
+  for (const deps of lock.snapshots.values()) add('.', deps)
   return [...out].sort()
 }
 
@@ -324,19 +385,52 @@ function buildGraph(lock: Lockfile, files: ReadonlyMap<string, string>): Graph {
     // is a node of its own, so its version still counts.
     edges[from]!.push(node(key, `${key}\0${lock.resolutions.get(packageKey(key)) ?? ''}\0`))
   }
+  // A node folds the names it asks for as well as where they land: by
+  // its edges alone, two aliases swapping targets (`foo: npm:x`, `bar:
+  // npm:y` → the reverse) reached the same packages and kept the key,
+  // while `require('foo')` loads another package.
+  const named = (from: number, deps: ReadonlyMap<string, string>): void => {
+    material[from] += `\nnames\0${[...deps]
+      .map(([n, v]) => `${n}\0${v}`)
+      .sort()
+      .join('\0')}`
+  }
   for (const [dir, deps] of lock.importers) {
     const from = index.get(importerNode(dir))!
+    named(from, deps)
     for (const [name, version] of deps) link(from, dir, name, version)
   }
   for (const [key, deps] of lock.snapshots) {
     const from = index.get(key)!
+    named(from, deps)
     for (const [name, version] of deps) link(from, '.', name, version)
   }
   return { index, material, edges }
 }
 
 /**
- * Each importer's `link:` dependencies on other importers. pnpm records
+ * The root-relative directory a `file:` version installs from: v9 and v6
+ * append resolved peers as `(peer@1)`, v5 as `_peer@1`.
+ */
+function fileTarget(lock: Lockfile, version: string): string | undefined {
+  let rel = version.slice('file:'.length)
+  const paren = rel.indexOf('(')
+  if (paren !== -1) rel = rel.slice(0, paren)
+  else if (Number.parseInt(lock.version, 10) < 6) {
+    const underscore = rel.indexOf('_', rel.lastIndexOf('/') + 1)
+    if (underscore !== -1 && rel.includes('@', underscore)) rel = rel.slice(0, underscore)
+  }
+  return joinPosix('.', rel)
+}
+
+/**
+ * Each importer's `link:` dependencies on other importers, and its
+ * `file:` ones that install an importer's directory: an injected
+ * workspace package (`dependenciesMeta.<name>.injected`, or pnpm 10
+ * `injectWorkspacePackages` with `dedupeInjectedDeps: false`). pnpm
+ * hard-links that copy and re-syncs it after the package's own scripts,
+ * so it is the workspace package and `^build` waits for it; yarn's
+ * packed `file:` copy is not. pnpm records
  * an auto-installed peer (`autoInstallPeers`, the default) under
  * `dependencies` like any other, so `peers` is empty here: the plugin
  * asks the importer's manifest which of these are peers.
@@ -346,8 +440,11 @@ export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImpor
   for (const [dir, deps] of lock.importers) {
     const links: Record<string, string> = {}
     for (const [name, version] of deps) {
-      if (!version.startsWith('link:')) continue
-      const target = joinPosix(dir, version.slice('link:'.length))
+      const target = version.startsWith('link:')
+        ? joinPosix(dir, version.slice('link:'.length))
+        : version.startsWith('file:')
+          ? fileTarget(lock, version)
+          : undefined
       if (target !== undefined && target !== dir && lock.importers.has(target)) {
         links[name] = target
       }

package/src/syml.ts

@@ -0,0 +1,91 @@
+// Berry's yarn.lock as Yarn reads it: every scalar is its source text.
+// Yarn writes a plain scalar unquoted (`stream-source: 0.10`, `p: ~`), and
+// a YAML parser reads it as a number or null: `0.10` became `0.1`, which
+// keys a sibling range's entry (turborepo#6296). Yarn's own writer emits a
+// fixed shape — `key:` opening a map indented under it, `key: value`,
+// a key or value double-quoted as JSON, `#` comment lines — so this reads
+// that shape and nothing more. Anything else (a list, a flow collection, a
+// single-quoted or block scalar: a hand edit) returns undefined, and the
+// caller reads the file as YAML.
+
+type Doc = Record<string, unknown>
+
+export function parseSyml(text: string): Doc | undefined {
+  const root: Doc = {}
+  const stack: { indent: number; map: Doc }[] = [{ indent: 0, map: root }]
+  let open: Doc | undefined
+  let at = 0
+  while (at < text.length) {
+    let end = text.indexOf('\n', at)
+    if (end === -1) end = text.length
+    let line = text.slice(at, end)
+    at = end + 1
+    if (line.endsWith('\r')) line = line.slice(0, -1)
+    let indent = 0
+    while (line.charCodeAt(indent) === 32) indent++
+    if (indent === line.length || line[indent] === '#') continue
+    if (line[indent] === '\t') return undefined
+    if (open !== undefined) {
+      if (indent > stack.at(-1)!.indent) stack.push({ indent, map: open })
+      open = undefined
+    }
+    while (indent < stack.at(-1)!.indent) stack.pop()
+    if (indent !== stack.at(-1)!.indent) return undefined
+    const map = stack.at(-1)!.map
+    let key: string
+    let rest: number
+    if (line[indent] === '"') {
+      const close = closingQuote(line, indent)
+      if (close === -1 || line[close + 1] !== ':') return undefined
+      const k = json(line.slice(indent, close + 1))
+      if (k === undefined) return undefined
+      key = k
+      rest = close + 2
+    } else {
+      const colon = line.indexOf(':', indent)
+      if (colon === -1 || PLAIN_START.includes(line[indent]!)) return undefined
+      key = line.slice(indent, colon).trimEnd()
+      rest = colon + 1
+    }
+    const value = line.slice(rest).trim()
+    if (value === '') {
+      open = {}
+      map[key] = open
+      continue
+    }
+    if (line[rest] !== ' ') return undefined
+    if (value[0] === '"') {
+      const v = json(value)
+      if (v === undefined) return undefined
+      map[key] = v
+    } else if (value === '{}') {
+      map[key] = {}
+    } else if (PLAIN_START.includes(value[0]!)) {
+      return undefined
+    } else {
+      map[key] = value
+    }
+  }
+  return root
+}
+
+/** A character no plain scalar of Yarn's writer starts with. */
+const PLAIN_START = `-?:,[]{}#&*!|>'"%@\``
+
+/** The index of the `"` closing the JSON string opened at `from`, or -1. */
+function closingQuote(line: string, from: number): number {
+  for (let i = from + 1; i < line.length; i++) {
+    if (line[i] === '\\') i++
+    else if (line[i] === '"') return i
+  }
+  return -1
+}
+
+function json(quoted: string): string | undefined {
+  try {
+    const v: unknown = JSON.parse(quoted)
+    return typeof v === 'string' ? v : undefined
+  } catch {
+    return undefined
+  }
+}

package/src/yarn-settings.ts

@@ -0,0 +1,26 @@
+// What every task folds from the root package.json under yarn(), apart
+// from the lockfile parser, which a warm run need not load for it.
+import { record, stable, type Json } from './json.js'
+
+/**
+ * The root package.json as every task folds it: `workspaces.nohoist`
+ * (Yarn 1 lays node_modules out by it) and `installConfig`, which
+ * yarn.lock records neither of. Its dependencies are the lockfile's to
+ * record. Undefined for a file that does not parse to a mapping, folded
+ * whole.
+ */
+export function packageSettings(text: string): string | undefined {
+  let doc: unknown
+  try {
+    doc = JSON.parse(text)
+  } catch {
+    return undefined
+  }
+  const map = record(doc)
+  if (map === undefined) return undefined
+  const kept: Json = {}
+  const nohoist = record(map['workspaces'])?.['nohoist']
+  if (nohoist !== undefined) kept['nohoist'] = nohoist
+  if (map['installConfig'] !== undefined) kept['installConfig'] = map['installConfig']
+  return `yarn-package\0${stable(kept)}`
+}