feat(install): add --restore flag to rebuild the lockfile from component graphs

bit install does not normally use the per-component dependency graphs stored on
each Version object. If a user deletes pnpm-lock.yaml and runs bit install, pnpm
re-resolves every dep from the manifest specifiers and drifts to whatever the
registry now considers latest — losing the tag-time version pins that the graph
feature is supposed to guarantee.

--restore opts into the same code path bit import uses: fetch the dep graph for
every component in the bitmap, merge them, and hand the merged graph to the
package manager, which then seeds pnpm-lock.yaml from it. If no workspace
component has a stored graph, we fall back to a regular install with a warning.

Adds e2e coverage that deletes the lockfile + node_modules, bumps the registry
so fresh resolve would drift, runs bit install --restore, and asserts the
components stay locked to their graph versions.

Author: zkochan

e2e/harmony/deps-graph.e2e.ts

@@ -543,4 +543,68 @@ chai.use(chaiFs);
       expect(lockfile.packages).to.have.property('@pnpm.e2e/bar@100.0.0');
     });
   });
+  // `bit install --restore` seeds the lockfile from the dependency graphs stored on
+  // every bitmap entry, the same way `bit import` does for the components it writes.
+  // This lets a user recover from a deleted pnpm-lock.yaml without re-resolving from
+  // manifest specifiers (which would drift to whatever the registry considers latest).
+  describe('bit install --restore rebuilds the lockfile from workspace component graphs', function () {
+    let randomStr: string;
+    let lockfileAfterRestore: any;
+    before(async () => {
+      randomStr = generateRandomStr(4);
+      const name = `@ci/${randomStr}.{name}`;
+      helper.scopeHelper.setWorkspaceWithRemoteScope();
+      npmCiRegistry = new NpmCiRegistry(helper);
+      npmCiRegistry.configureCustomNameInPackageJsonHarmony(name);
+      await npmCiRegistry.init();
+      helper.command.setConfig('registry', npmCiRegistry.getRegistryUrl());
+      helper.env.setCustomNewEnv(
+        undefined,
+        undefined,
+        { policy: { peers: [] } },
+        false,
+        'custom-env/env',
+        'custom-env/env'
+      );
+      helper.fs.createFile('comp1', 'comp1.js', 'require("@pnpm.e2e/foo"); // eslint-disable-line');
+      helper.command.addComponent('comp1');
+      helper.extensions.addExtensionToVariant('comp1', `${helper.scopes.remote}/custom-env/env`, {});
+      helper.fs.createFile('comp2', 'comp2.js', 'require("@pnpm.e2e/bar"); // eslint-disable-line');
+      helper.command.addComponent('comp2');
+      helper.extensions.addExtensionToVariant('comp2', `${helper.scopes.remote}/custom-env/env`, {});
+      helper.extensions.workspaceJsonc.addKeyValToDependencyResolver('rootComponents', true);
+      await addDistTag({ package: '@pnpm.e2e/foo', version: '100.0.0', distTag: 'latest' });
+      await addDistTag({ package: '@pnpm.e2e/bar', version: '100.0.0', distTag: 'latest' });
+      helper.command.install('--add-missing-deps');
+      helper.command.tagAllComponents('--skip-tests');
+      helper.command.export();
+
+      helper.scopeHelper.reInitWorkspace();
+      helper.scopeHelper.addRemoteScope();
+      helper.extensions.workspaceJsonc.addKeyValToDependencyResolver('rootComponents', true);
+      helper.command.import(`${helper.scopes.remote}/comp1@latest ${helper.scopes.remote}/comp2@latest`);
+
+      // bump registry and blow away the lockfile + node_modules, then restore from graphs.
+      await addDistTag({ package: '@pnpm.e2e/foo', version: '100.1.0', distTag: 'latest' });
+      await addDistTag({ package: '@pnpm.e2e/bar', version: '100.1.0', distTag: 'latest' });
+      helper.fs.deletePath('pnpm-lock.yaml');
+      helper.fs.deletePath('node_modules');
+      helper.command.runCmd('bit install --restore');
+      lockfileAfterRestore = yaml.load(fs.readFileSync(path.join(helper.scopes.localPath, 'pnpm-lock.yaml'), 'utf8'));
+    });
+    after(() => {
+      npmCiRegistry.destroy();
+      helper.command.delConfig('registry');
+      helper.scopeHelper.destroy();
+    });
+    it('should mark the regenerated lockfile as restoredFromModel', () => {
+      expect(lockfileAfterRestore.bit.restoredFromModel).to.eq(true);
+    });
+    it('should keep both components locked to the versions stored in their graphs', () => {
+      expect(lockfileAfterRestore.packages).to.have.property('@pnpm.e2e/foo@100.0.0');
+      expect(lockfileAfterRestore.packages).to.have.property('@pnpm.e2e/bar@100.0.0');
+      expect(lockfileAfterRestore.packages).to.not.have.property('@pnpm.e2e/foo@100.1.0');
+      expect(lockfileAfterRestore.packages).to.not.have.property('@pnpm.e2e/bar@100.1.0');
+    });
+  });
 });

scopes/workspace/install/install.cmd.tsx

@@ -22,6 +22,7 @@ type InstallCmdOptions = {
   noOptional: boolean;
   recurringInstall: boolean;
   lockfileOnly: boolean;
+  restore: boolean;
   allowScripts?: string;
   disallowScripts?: string;
 };
@@ -69,6 +70,11 @@ automatically imports components, compiles components, links to node_modules, an
     ],
     ['', 'no-optional [noOptional]', 'do not install optional dependencies (works with pnpm only)'],
     ['', 'lockfile-only', 'dependencies are not written to node_modules. Only the lockfile is updated'],
+    [
+      '',
+      'restore',
+      'reconstruct the lockfile from each workspace component\'s stored dependency graph before installing',
+    ],
     ['', 'allow-scripts [pkgNames]', 'a comma separated list of package names that are allowed to run installation scripts'],
     ['', 'disallow-scripts [pkgNames]', 'a comma separated list of package names that are NOT allowed to run installation scripts'],
   ] as CommandOptions;
@@ -134,6 +140,7 @@ automatically imports components, compiles components, links to node_modules, an
       updateAll: options.update,
       recurringInstall: options.recurringInstall,
       lockfileOnly: options.lockfileOnly,
+      restoreFromDependenciesGraph: options.restore,
       showExternalPackageManagerPrompt: true,
       allowScripts: this._parseAllowScriptsFlags(options.allowScripts, options.disallowScripts),
     };

scopes/workspace/install/install.main.runtime.ts

@@ -108,6 +108,13 @@ export type WorkspaceInstallOptions = {
   writeConfigFiles?: boolean;
   skipPrune?: boolean;
   dependenciesGraph?: DependenciesGraph;
+  /**
+   * When true, attempt to reconstruct the lockfile from each workspace component's
+   * stored dependency graph before running the package manager. Graphs are fetched for
+   * every component listed in the bitmap, merged, and handed to the package manager the
+   * same way `bit import` does for the components it writes.
+   */
+  restoreFromDependenciesGraph?: boolean;
   allowScripts?: Record<string, boolean>;
 };
 
@@ -392,11 +399,12 @@ export class InstallMain {
       }
     );
 
+    const dependenciesGraph = await this.resolveDependenciesGraph(options);
     const pmInstallOptions: PackageManagerInstallOptions = {
       ...calcManifestsOpts,
       autoInstallPeers: this.dependencyResolver.config.autoInstallPeers,
       dedupePeers: this.dependencyResolver.config.dedupePeers,
-      dependenciesGraph: options?.dependenciesGraph,
+      dependenciesGraph,
       includeOptionalDeps: options?.includeOptionalDeps,
       neverBuiltDependencies: this.dependencyResolver.config.neverBuiltDependencies,
       allowScripts: this.dependencyResolver.getAllowedScripts(),
@@ -516,6 +524,22 @@ export class InstallMain {
     return nonLoadedEnvs.length > 0;
   }
 
+  private async resolveDependenciesGraph(
+    options?: ModulesInstallOptions
+  ): Promise<DependenciesGraph | undefined> {
+    if (options?.dependenciesGraph) return options.dependenciesGraph;
+    if (!options?.restoreFromDependenciesGraph) return undefined;
+    const graph = await this.workspace.scope.getDependenciesGraphByComponentIds(this.workspace.listIds());
+    if (!graph) {
+      this.logger.console(
+        chalk.yellow(
+          '--restore was requested but no workspace component has a stored dependency graph. Falling back to a regular install.'
+        )
+      );
+    }
+    return graph;
+  }
+
   /**
    * This function is very important to fix some issues that might happen during the installation process.
    * The case is the following: