feat(install): create node_modules for workspace members (#34970)

When installing a workspace, `deno install` previously created only a
single `node_modules` directory at the workspace root. Native Node.js
tooling run from within a workspace member (for example `svelte-check`,
`astro`, or `eslint` plugins) expects a local `node_modules` containing
the member's dependencies, the way npm and pnpm lay workspaces out, and
fails without it. Sharing only the root `node_modules` also hides
missing dependencies, since a member can resolve a package that only a
sibling declares.

This makes both linker modes create a `node_modules` directory inside
each workspace member and symlink that member's direct dependencies into
it: npm dependencies point at their resolved location (the shared
`node_modules/.deno` store for the isolated linker, or the package's
top-level or nested directory for the hoisted linker) and sibling
workspace members are linked to their directories. Each member's
`node_modules/.bin` is also populated with its direct dependencies'
executables, so a tool invoked as `node_modules/.bin/<tool>` from within
a member (eslint, svelte-check, astro, ...) resolves the member's own
copy. The workspace root is left untouched and members without
dependencies get no directory.

Stale links are pruned on reinstall the same way the root `node_modules`
prunes them: when a member drops a dependency (or a sibling member is
removed), its link is removed from the member's `node_modules` before
re-linking so the dropped dependency stops being resolvable. The
member's `.bin` is likewise rebuilt from its current dependencies so a
dropped dependency's executable stops resolving. Only symlinks and
junctions are touched, so real files a user placed in the member's
`node_modules` are left alone.

Known limitations (left for follow-ups):

- Sibling workspace members are not npm packages, so they do not yet
  contribute executables to a member's `node_modules/.bin`.
- In the hoisted linker, when two members depend on different versions
  of the same package the higher version is hoisted to the root and the
  lower one is not placed in the layout, so the member declaring the
  lower version does not get it linked into its own `node_modules` and
  resolves the hoisted version instead. The skip is logged at debug
  level.

Closes #26743
Closes #27550

Author: bartlomieju

libs/npm_installer/hoisted.rs

@@ -594,6 +594,119 @@ impl<
       }
     }
 
+    // 7. Create a `node_modules` directory inside each workspace member and
+    // symlink that member's direct dependencies into it. This mirrors how npm
+    // and pnpm lay out workspaces so that native Node.js tooling run from
+    // within a member resolves the member's dependencies and sibling workspace
+    // members. Each dependency is linked to its actual location in the hoisted
+    // layout (a top-level package, or a nested one in case of conflicts).
+    {
+      let workspace_member_dirs: HashMap<&PackageNv, &Path> = self
+        .npm_install_deps_provider
+        .workspace_pkgs()
+        .iter()
+        .map(|pkg| (&pkg.nv, pkg.target_dir.as_path()))
+        .collect();
+      for workspace_pkg in self.npm_install_deps_provider.workspace_pkgs() {
+        // The workspace root's `node_modules` is already fully set up above.
+        // (Comparing paths here is unreliable: `root_node_modules_path` is
+        // canonicalized while `target_dir` is not, so on Windows they can
+        // differ by 8.3 short names or casing for the same directory.)
+        if workspace_pkg.is_root {
+          continue;
+        }
+        let member_node_modules = workspace_pkg.target_dir.join("node_modules");
+        // Remove links to dependencies the member no longer declares (or to
+        // sibling members that were removed) so they stop being resolvable,
+        // mirroring how the root `node_modules` prunes stale links. This also
+        // covers a member that dropped all of its dependencies, which is why it
+        // runs before the `deps.is_empty()` short-circuit.
+        let keep_aliases: HashSet<&str> = workspace_pkg
+          .deps
+          .iter()
+          .map(|dep| dep.alias().as_str())
+          .collect();
+        crate::local::remove_stale_member_symlinks(
+          sys.as_ref(),
+          &member_node_modules,
+          &keep_aliases,
+        );
+        // The member's direct npm dependencies that ship executables, gathered
+        // while linking so their bins can be set up in the member's `.bin` once
+        // every alias link exists.
+        let mut bin_deps: Vec<crate::local::MemberBinDep> = Vec::new();
+        if !workspace_pkg.deps.is_empty() {
+          let mut created_dir = false;
+          for dep in &workspace_pkg.deps {
+            let (alias, target_path) = match dep {
+              InstallWorkspacePkgDep::Remote { alias, req } => {
+                let Some(id) = resolve_remote_pkg_id(snapshot, req) else {
+                  continue;
+                };
+                let Some(target_path) = hoisted_package_path(
+                  &layout,
+                  &self.root_node_modules_path,
+                  &id.nv,
+                ) else {
+                  // The resolved version isn't placed anywhere in the hoisted
+                  // layout (a version-conflict corner case where no package pins
+                  // this exact version), so there's nothing to link it to. Skip
+                  // it rather than fail, but log it: the member will resolve this
+                  // dependency via the hoisted top-level version instead, which
+                  // may differ from the version it declared. See
+                  // https://github.com/denoland/deno/pull/34970.
+                  log::debug!(
+                    "workspace member {} dependency {} ({}) is not present in the hoisted layout; skipping its node_modules link",
+                    workspace_pkg.nv,
+                    alias,
+                    id.nv,
+                  );
+                  continue;
+                };
+                if let Some(package) = snapshot.package_from_id(&id)
+                  && package.has_bin
+                {
+                  // The shim reads the package's `package.json` from its real
+                  // hoisted location but points at the member's own alias link.
+                  bin_deps.push(crate::local::MemberBinDep {
+                    package,
+                    read_path: target_path.clone(),
+                    link_path: member_node_modules.join(alias.as_str()),
+                  });
+                }
+                (alias, target_path)
+              }
+              InstallWorkspacePkgDep::Workspace { alias, nv } => {
+                let Some(target_dir) = workspace_member_dirs.get(nv) else {
+                  continue;
+                };
+                (alias, target_dir.to_path_buf())
+              }
+            };
+            if !created_dir {
+              sys.fs_create_dir_all(&member_node_modules)?;
+              created_dir = true;
+            }
+            crate::local::symlink_package_dir(
+              sys.as_ref(),
+              &target_path,
+              &member_node_modules.join(alias.as_str()),
+            )?;
+          }
+        }
+        // Populate (and prune) the member's `node_modules/.bin`. Runs even when
+        // the member has no dependencies so a dropped last bin is cleaned up.
+        crate::local::setup_member_bin_entries(
+          sys,
+          snapshot,
+          &extra_info_provider,
+          &member_node_modules,
+          &bin_deps,
+        )
+        .await?;
+      }
+    }
+
     for package in &workspace_lifecycle_packages {
       lifecycle_scripts.borrow_mut().add(
         &package.package,
@@ -872,6 +985,38 @@ struct WorkspaceLifecyclePackage {
   scripts: HashMap<deno_semver::SmallStackString, String>,
 }
 
+/// Resolves the on-disk location of a package version in the hoisted layout,
+/// either as a top-level package or a nested one. Returns `None` if the version
+/// isn't placed anywhere (for example a conflicting version that no package
+/// depends on).
+fn hoisted_package_path(
+  layout: &HoistedLayout,
+  root_node_modules_path: &Path,
+  nv: &PackageNv,
+) -> Option<PathBuf> {
+  if let Some(top) = layout.top_level.get(&nv.name)
+    && top.id.nv == *nv
+  {
+    return Some(join_package_name(
+      Cow::Borrowed(root_node_modules_path),
+      &nv.name,
+    ));
+  }
+  for nested in &layout.nested {
+    if nested.dep.id.nv == *nv {
+      return Some(join_package_name(
+        Cow::Owned(
+          root_node_modules_path
+            .join(&nested.parent_path)
+            .join("node_modules"),
+        ),
+        &nv.name,
+      ));
+    }
+  }
+  None
+}
+
 fn resolve_remote_pkg_id(
   snapshot: &NpmResolutionSnapshot,
   req: &deno_semver::package::PackageReq,