feat(unstable): single checksum per JSR package in the lockfile (#22421)

This changes the lockfile to not store JSR specifiers in the "remote"
section. Instead a single JSR integrity is stored per package in the
lockfile, which is a hash of the version's `x.x.x_meta.json` file, which
contains hashes for every file in the package. The hashes in this file
are then compared against when loading.

Additionally, when using `{ "vendor": true }` in a deno.json, the files
can be modified without causing lockfile errors—the checksum is only
checked when copying into the vendor folder and not afterwards
(eventually we should add this behaviour for non-jsr specifiers as
well). As part of this change, the `vendor` folder creation is not
always automatic in the LSP and running an explicit cache command is
necessary. The code required to track checksums in the LSP would have
been too complex for this PR, so that all goes through deno_graph now.
The vendoring is still automatic when running from the CLI.

Cargo.toml

@@ -46,7 +46,7 @@ deno_ast = { version = "0.33.2", features = ["transpiling"] }
 deno_core = { version = "0.262.0" }
 
 deno_bench_util = { version = "0.132.0", path = "./bench_util" }
-deno_lockfile = "0.18.2"
+deno_lockfile = "0.19.0"
 deno_media_type = { version = "0.1.1", features = ["module_specifier"] }
 deno_runtime = { version = "0.146.0", path = "./runtime" }
 deno_terminal = "0.1.1"
@@ -97,7 +97,7 @@ chrono = { version = "0.4", default-features = false, features = ["std", "serde"
 console_static_text = "=0.8.1"
 data-encoding = "2.3.3"
 data-url = "=0.3.0"
-deno_cache_dir = "=0.6.1"
+deno_cache_dir = "=0.7.1"
 dlopen2 = "0.6.1"
 ecb = "=0.1.2"
 elliptic-curve = { version = "0.13.4", features = ["alloc", "arithmetic", "ecdh", "std", "pem"] }

cli/Cargo.toml

@@ -66,17 +66,17 @@ deno_ast = { workspace = true, features = ["bundler", "cjs", "codegen", "proposa
 deno_cache_dir = { workspace = true }
 deno_config = "=0.9.2"
 deno_core = { workspace = true, features = ["include_js_files_for_snapshotting"] }
-deno_doc = { version = "=0.103.0", features = ["html"] }
-deno_emit = "=0.36.0"
-deno_graph = "=0.65.3"
+deno_doc = { version = "=0.107.0", features = ["html"] }
+deno_emit = "=0.37.0"
+deno_graph = "=0.66.0"
 deno_lint = { version = "=0.56.0", features = ["docs"] }
 deno_lockfile.workspace = true
-deno_npm = "=0.16.0"
+deno_npm = "=0.17.0"
 deno_runtime = { workspace = true, features = ["include_js_files_for_snapshotting"] }
 deno_semver = "=0.5.4"
 deno_task_shell = "=0.14.3"
 deno_terminal.workspace = true
-eszip = "=0.62.0"
+eszip = "=0.63.0"
 napi_sym.workspace = true
 
 async-trait.workspace = true

cli/cache/mod.rs

@@ -196,8 +196,7 @@ impl Loader for FetchCacher {
   fn load(
     &mut self,
     specifier: &ModuleSpecifier,
-    _is_dynamic: bool,
-    cache_setting: deno_graph::source::CacheSetting,
+    options: deno_graph::source::LoadOptions,
   ) -> LoadFuture {
     use deno_graph::source::CacheSetting as LoaderCacheSetting;
 
@@ -222,7 +221,7 @@ impl Loader for FetchCacher {
     let specifier = specifier.clone();
 
     async move {
-      let maybe_cache_setting = match cache_setting {
+      let maybe_cache_setting = match options.cache_setting {
         LoaderCacheSetting::Use => None,
         LoaderCacheSetting::Reload => {
           if matches!(file_fetcher.cache_setting(), CacheSetting::Only) {
@@ -240,6 +239,7 @@ impl Loader for FetchCacher {
           permissions,
           maybe_accept: None,
           maybe_cache_setting: maybe_cache_setting.as_ref(),
+          maybe_checksum: options.maybe_checksum,
         })
         .await
         .map(|file| {
@@ -269,7 +269,7 @@ impl Loader for FetchCacher {
           let error_class_name = get_error_class_name(&err);
           match error_class_name {
             "NotFound" => Ok(None),
-            "NotCached" if cache_setting == LoaderCacheSetting::Only => Ok(None),
+            "NotCached" if options.cache_setting == LoaderCacheSetting::Only => Ok(None),
             _ => Err(err),
           }
         })

cli/factory.rs

@@ -66,7 +66,6 @@ use deno_runtime::deno_node::NodeResolver;
 use deno_runtime::deno_tls::RootCertStoreProvider;
 use deno_runtime::deno_web::BlobStore;
 use deno_runtime::inspector_server::InspectorServer;
-use deno_semver::package::PackageNv;
 use import_map::ImportMap;
 use log::warn;
 use std::future::Future;
@@ -381,16 +380,6 @@ impl CliFactory {
             no_npm,
             no_config: self.options.no_config(),
             config,
-            nv_to_jsr_url: |nv| {
-              let nv = PackageNv::from_str(nv).ok()?;
-              Some(
-                deno_graph::source::recommended_registry_package_url(
-                  crate::args::jsr_url(),
-                  &nv,
-                )
-                .to_string(),
-              )
-            },
           },
         );
       }