Record runtime dependency inventory without dev checks

Author: Arbousier1

.github/workflows/phase2-packet-capture.yml

@@ -211,6 +211,6 @@ jobs:
             phase2-dependencies/protocol-client/client-build-manifest.json
             phase2-dependencies/protocol-client/client-files.sha256
             phase2-dependencies/protocol-client/node-minecraft-protocol/package-lock.json
-            phase2-dependencies/protocol-client/node-minecraft-protocol/dependency-tree.json
+            phase2-dependencies/protocol-client/node-minecraft-protocol/production-lock-inventory.json
           if-no-files-found: warn
           retention-days: 30

.github/workflows/phase2-runtime-ab.yml

@@ -181,6 +181,6 @@ jobs:
             phase2-dependencies/protocol-client/client-build-manifest.json
             phase2-dependencies/protocol-client/client-files.sha256
             phase2-dependencies/protocol-client/node-minecraft-protocol/package-lock.json
-            phase2-dependencies/protocol-client/node-minecraft-protocol/dependency-tree.json
+            phase2-dependencies/protocol-client/node-minecraft-protocol/production-lock-inventory.json
           if-no-files-found: warn
           retention-days: 30

docs/phase2-performance-validation.md

@@ -512,7 +512,7 @@ Pktmon 只能证明传输行为，不能证明朝向、高度、遮挡、动画
 
 协议客户端只用于让 Paper/Sparrow 经过真实 tracker、chunk 与 TCP 路径，不渲染画面。准备步骤固定
 `node-minecraft-protocol`、wrapper 和协议数据的三个 40 位提交，在无 secret 的只读 job 中禁用 npm
-lifecycle scripts，并保存完整 lockfile、依赖树和逐文件 SHA-256。该依赖仍来自尚未合并的上游 PR，
+lifecycle scripts，并保存完整 lockfile、由 lockfile 派生的生产依赖清单和逐文件 SHA-256。该依赖仍来自尚未合并的上游 PR，
 因此自动结果是性能/协议回归证据，不替代原版客户端、Leaf、Via/代理/Geyser 的真人兼容性勾选。
 
 正式结论必须使用默认 12 runs、120 秒预热、20 秒稳定和 180 秒 clean 采样。4/8 runs 仅用于验证

tools/perf/prepare-phase2-protocol-client.sh

@@ -77,17 +77,52 @@ packageJson.dependencies['minecraft-data'] = 'file:../node-minecraft-data'
 fs.writeFileSync('package.json', `${JSON.stringify(packageJson, null, 2)}\n`, 'utf8')
 NODE
   npm install --omit=dev --ignore-scripts --package-lock=true --no-audit --no-fund
-  npm ls --omit=dev --all --json > dependency-tree.json
+  # npm ls recursively validates dependencies declared by the linked data
+  # source package, including its generator/test toolchain. Those packages are
+  # intentionally absent from this runtime-only install, so derive a stable
+  # production inventory from the authoritative lockfile instead.
+  node <<'NODE'
+const fs = require('fs')
+const lock = JSON.parse(fs.readFileSync('package-lock.json', 'utf8'))
+if (lock.lockfileVersion !== 3 || lock.packages == null) {
+  throw new Error(`Unsupported package-lock schema: ${lock.lockfileVersion}`)
+}
+const compareText = (a, b) => a < b ? -1 : a > b ? 1 : 0
+const sortedObject = value => Object.fromEntries(Object.entries(value || {}).sort(([a], [b]) => compareText(a, b)))
+const packages = Object.entries(lock.packages)
+  .filter(([, metadata]) => metadata.dev !== true)
+  .sort(([a], [b]) => compareText(a, b))
+  .map(([location, metadata]) => ({
+    location: location || '.',
+    name: metadata.name || null,
+    version: metadata.version || null,
+    resolved: metadata.resolved || null,
+    integrity: metadata.integrity || null,
+    link: metadata.link === true,
+    optional: metadata.optional === true,
+    dependencies: sortedObject(metadata.dependencies),
+    optionalDependencies: sortedObject(metadata.optionalDependencies),
+    peerDependencies: sortedObject(metadata.peerDependencies)
+  }))
+const inventory = {
+  schemaVersion: 1,
+  source: 'package-lock.json production entries',
+  lockfileVersion: lock.lockfileVersion,
+  packageCount: packages.length,
+  packages
+}
+fs.writeFileSync('production-lock-inventory.json', `${JSON.stringify(inventory, null, 2)}\n`, 'utf8')
+NODE
 )
 
 mkdir -p "$output_directory"
 mv "$nmp_directory" "$output_directory/node-minecraft-protocol"
 mv "$wrapper_directory" "$output_directory/node-minecraft-data"
 
 lock_path="$output_directory/node-minecraft-protocol/package-lock.json"
-tree_path="$output_directory/node-minecraft-protocol/dependency-tree.json"
+inventory_path="$output_directory/node-minecraft-protocol/production-lock-inventory.json"
 test -s "$lock_path"
-test -s "$tree_path"
+test -s "$inventory_path"
 
 sha256_file() {
   sha256sum "$1" | awk '{print $1}'
@@ -112,7 +147,7 @@ cat > "$output_directory/client-build-manifest.json" <<EOF
   },
   "installScriptsEnabled": false,
   "packageLockSha256": "$(sha256_file "$lock_path")",
-  "dependencyTreeSha256": "$(sha256_file "$tree_path")"
+  "productionLockInventorySha256": "$(sha256_file "$inventory_path")"
 }
 EOF