mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-20 20:52:33 -04:00
c8d8fde6ca
Extends `configDependencies` to resolve and install one level of `optionalDependencies`, with `os` / `cpu` / `libc` platform filtering applied at install time. Closes the prerequisite called out in #11723: this is what makes the esbuild/swc-style platform-binary pattern viable for config dependencies (e.g. shipping pacquet as a config dep with native binaries via `optionalDependencies`). ### What lands - **Resolution** (`resolveOptionalSubdeps.ts`, wired into `resolveConfigDeps` and `resolveAndInstallConfigDeps`): after each top-level config dep resolves, walks one level of `optionalDependencies`, resolves each, and records them in the env lockfile with `os`/`cpu`/`libc` preserved. The parent's snapshot gets `optionalDependencies: { … }`. All variants are recorded regardless of host platform, so the env lockfile stays portable across machines. - **Install** (`installConfigDeps.ts`): after the parent is installed into its GVS leaf, fetches each platform-compatible subdep into its own GVS leaf and creates a sibling symlink inside the parent leaf's `node_modules/`. Node's `realpath`-based resolution then makes `require('pkg-platform-arch')` from inside the parent resolve correctly. Stale siblings are pruned, so platform changes between runs produce a clean layout. - **GVS hash** (new `calcGlobalVirtualStorePathWithSubdeps` in `graph-hasher`): the parent's GVS leaf hash now folds in the optional subdeps' full pkg ids. Without this, changing a subdep version while keeping the parent pinned would land in the same leaf and silently overwrite the sibling symlinks. The leaf function keeps its original "no children" contract; the new function is a separate entry point that pacquet can mirror cleanly. - **Re-install detection**: the "skip if already installed" check compares the existing `.pnpm-config/{name}` symlink's `realpath` against the expected GVS leaf, not the package.json's name/version. With subdep versions now feeding the leaf hash, name/version alone isn't sufficient. The check only short-circuits the parent's re-import and re-symlink — `installOptionalSubdeps` always runs so platform-specific siblings get pruned and relinked when the host's effective platform changes (Rosetta x64 ↔ arm64, etc.). - **Exact versions only**: subdep specifiers must be valid semver exact versions (e.g. `"1.2.3"`). Ranges (`"^1.0.0"`) and tags (`"latest"`) are rejected up-front with a `CONFIG_DEP_OPTIONAL_NOT_EXACT` error. With the parent pinned by integrity, the subdep's resolved version mustn't drift between machines. - **Error handling**: optional-subdep resolution failures are logged via `skippedOptionalDependencyLogger` with `reason: 'resolution_failure'` (same shape as `installing/deps-resolver`) and the install continues — except for `ERR_PNPM_TRUST_DOWNGRADE`, which is a security signal that must still abort the install. ### Scope Only one level deep. Transitive `dependencies` and lifecycle scripts remain unsupported — pacquet doesn't need them yet, and they carry meaningful security and complexity tradeoffs that deserve a separate discussion. The env lockfile schema needs no changes: `LockfilePackageInfo` already carries `os`/`cpu`/`libc`, and `LockfilePackageSnapshot.optionalDependencies` already exists for recording the parent→child edge. ## Known limitation If a workspace already had a resolved config dep in the env lockfile (`snapshots[pkgKey] = {}`) before this PR, optional subdeps won't be retroactively discovered on subsequent installs. Workaround: `pnpm update <pkg>` (or remove + re-add). In practice no published package today relies on `optionalDependencies` in a config dep — they couldn't, since the feature didn't exist — so the practical exposure is narrow. See the inline review thread for the design rationale.
86 lines
1.4 KiB
JSON
86 lines
1.4 KiB
JSON
{
|
|
"extends": "@pnpm/tsconfig",
|
|
"compilerOptions": {
|
|
"outDir": "lib",
|
|
"rootDir": "src"
|
|
},
|
|
"include": [
|
|
"src/**/*.ts",
|
|
"../../__typings__/**/*.d.ts"
|
|
],
|
|
"references": [
|
|
{
|
|
"path": "../../__utils__/prepare"
|
|
},
|
|
{
|
|
"path": "../../config/package-is-installable"
|
|
},
|
|
{
|
|
"path": "../../config/pick-registry-for-package"
|
|
},
|
|
{
|
|
"path": "../../config/writer"
|
|
},
|
|
{
|
|
"path": "../../core/constants"
|
|
},
|
|
{
|
|
"path": "../../core/core-loggers"
|
|
},
|
|
{
|
|
"path": "../../core/error"
|
|
},
|
|
{
|
|
"path": "../../core/types"
|
|
},
|
|
{
|
|
"path": "../../deps/graph-hasher"
|
|
},
|
|
{
|
|
"path": "../../fs/read-modules-dir"
|
|
},
|
|
{
|
|
"path": "../../lockfile/fs"
|
|
},
|
|
{
|
|
"path": "../../lockfile/pruner"
|
|
},
|
|
{
|
|
"path": "../../lockfile/types"
|
|
},
|
|
{
|
|
"path": "../../lockfile/utils"
|
|
},
|
|
{
|
|
"path": "../../network/auth-header"
|
|
},
|
|
{
|
|
"path": "../../network/fetch"
|
|
},
|
|
{
|
|
"path": "../../pkg-manifest/reader"
|
|
},
|
|
{
|
|
"path": "../../resolving/npm-resolver"
|
|
},
|
|
{
|
|
"path": "../../resolving/parse-wanted-dependency"
|
|
},
|
|
{
|
|
"path": "../../store/controller"
|
|
},
|
|
{
|
|
"path": "../../store/controller-types"
|
|
},
|
|
{
|
|
"path": "../../testing/temp-store"
|
|
},
|
|
{
|
|
"path": "../../worker"
|
|
},
|
|
{
|
|
"path": "../deps-resolver"
|
|
}
|
|
]
|
|
}
|