fix(sign): persist dependency graph from capsules

[zkochan]

Summary

• detect capsules whose dependency graph is missing and regenerate only those graphs after install
• persist the generated capsule dependency graph back to the component instances that are saved to the model
• support pnpm dependency graph extraction from capsule lockfile importers when no root component importer exists
• add e2e coverage for isolating components when only part of the model graph exists

Validation

• ./node_modules/.bin/prettier --check e2e/harmony/deps-graph.e2e.ts scopes/component/isolator/isolator.main.runtime.ts scopes/dependencies/pnpm/pnpm.package-manager.ts
• ./node_modules/.bin/oxlint --deny-warnings e2e/harmony/deps-graph.e2e.ts scopes/component/isolator/isolator.main.runtime.ts scopes/dependencies/pnpm/pnpm.package-manager.ts
• git diff --check
• pre-fix verification: reversed 4ece3199d, recompiled teambit.component/isolator and teambit.dependencies/pnpm, then the focused e2e failed with comp2 should have a dependencies graph after isolation: expected undefined to exist and expected undefined to be a string
• fixed verification: NODE_PATH=/Users/zoltan/.bvm/links/bit/node_modules npm_config_bit_bin="/Users/zoltan/Library/pnpm/bin/node /Volumes/src/teambit/bit/bin/bit.js" NODE_OPTIONS=--no-warnings ./node_modules/.bin/mocha --require ./babel-register e2e/harmony/deps-graph.e2e.ts --grep "isolating components when only some model graphs exist" — 2 passing
• bit compile teambit.component/isolator teambit.dependencies/pnpm --verbose
• BIT_FEATURES=deps-graph bit test --unmodified in a reproduced teambit.dot-cli/sign workspace, focused on the failing dependency-graph block: 5 passing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0)

1. Duplicate graph model lookups 🐞 Bug ➹ Performance

Description

When useDependenciesGraph is enabled, createCapsules() now loads dependency graphs twice: once via
getDependenciesGraphByComponentIds() and again per capsule via
getCapsulesWithoutDependenciesGraph(), doubling model reads for isolated components. This adds
avoidable overhead for large isolations and can noticeably slow down capsule creation/install.

Code

scopes/component/isolator/isolator.main.runtime.ts[R753-758]

        const dependenciesGraph = opts.useDependenciesGraph
          ? await legacyScope?.getDependenciesGraphByComponentIds(capsuleList.getAllComponentIDs())
          : undefined;
+        const capsulesWithoutDependenciesGraph = opts.useDependenciesGraph
+          ? await this.getCapsulesWithoutDependenciesGraph(capsuleList, legacyScope)
+          : CapsuleList.fromArray([]);

Evidence

The isolator now always performs a second per-capsule lookup pass
(getCapsulesWithoutDependenciesGraph) right after the existing batch fetch. The legacy scope batch
fetch already calls the per-component fetch internally, so the second pass repeats those lookups.

scopes/component/isolator/isolator.main.runtime.ts[753-771]
scopes/component/isolator/isolator.main.runtime.ts[811-825]
components/legacy/scope/scope.ts[763-782]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`IsolatorMain.createCapsules()` fetches dependency graphs from the model twice when `opts.useDependenciesGraph` is true: first by calling `legacyScope.getDependenciesGraphByComponentIds(...)`, then again by calling `getCapsulesWithoutDependenciesGraph(...)`, which itself calls `legacyScope.getDependenciesGraphByComponentId(...)` per capsule.

This duplicates IO and object loading and can slow down isolations with many components.

### Issue Context
- `Scope.getDependenciesGraphByComponentIds()` already iterates component IDs and calls `getDependenciesGraphByComponentId()` for each, merging graphs.
- The new missing-graph detection needs per-component presence info, but it can be derived in the same pass as the initial fetch rather than re-querying.

### Fix Focus Areas
- scopes/component/isolator/isolator.main.runtime.ts[753-771]
- scopes/component/isolator/isolator.main.runtime.ts[811-825]
- components/legacy/scope/scope.ts[763-782]

### Suggested fix approach
- Perform a single per-component lookup pass and derive both:
 1) the merged `dependenciesGraph` to feed into `installInCapsules`, and
 2) the `CapsuleList` of components missing/empty graphs.

Implementation options:
- Add a new legacy-scope API that returns `{ mergedGraph, missingIds }` or `{ mergedGraph, graphsById }`.
- Or in isolator, replace `getDependenciesGraphByComponentIds` + `getCapsulesWithoutDependenciesGraph` with one `pMap` over capsules that:
 - loads graph once per capsule id,
 - accumulates a merged graph (clone-on-first like current code), and
 - collects missing capsules.

Keep the existing behavior of regenerating graphs only for missing components.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---