@antongolub/lockfile 0.0.0-snapshot.44 → 0.0.0-snapshot.46

package/SCHEMAS.md

@@ -33,6 +33,7 @@ berry's `__metadata`.
 | `yarn-berry-v6`   | `__metadata.version: 6`      | yarn `>=3.2 <4`      | yarn `>=3.2` |
 | `yarn-berry-v8`   | `__metadata.version: 8`      | yarn `>=4.0 <4.14`   | yarn `>=4` |
 | `yarn-berry-v9`   | `__metadata.version: 9`      | yarn `>=4.14`        | yarn `>=4.14` |
+| `yarn-berry-v10`  | `__metadata.version: 10`     | yarn 5 (dev branch)  | yarn 5+ (preview — reverse-engineered from yarnpkg/berry master) |
 
 **Schema numbers that don't exist:**
 - `__metadata.version: 1` and `2` were never used by berry.

package/dist/{_npm-flat-types-DwOV4BpV.d.ts → _npm-flat-types-C3oOIC0o.d.ts}

@@ -1,4 +1,4 @@
-import { D as Diagnostic } from './graph-BzsItuAI.js';
+import { D as Diagnostic } from './graph-XpDkFSjz.js';
 
 interface NpmFamilyParseOptions {
 }

package/dist/{_pnpm-flat-core-_4KM9kQj.d.ts → _pnpm-flat-core-C5VUToQP.d.ts}

@@ -1,4 +1,4 @@
-import { D as Diagnostic } from './graph-BzsItuAI.js';
+import { D as Diagnostic } from './graph-XpDkFSjz.js';
 
 interface PnpmFamilyParseOptions {
     /**

package/dist/{_yarn-berry-core-EKBJ_ohM.d.ts → _yarn-berry-core-sjtp6At6.d.ts}

@@ -1,4 +1,4 @@
-import { D as Diagnostic } from './graph-BzsItuAI.js';
+import { D as Diagnostic } from './graph-XpDkFSjz.js';
 
 interface YarnBerryFamilyParseOptions {
     workspaceRoot?: string;

package/dist/complete.d.ts

@@ -0,0 +1,68 @@
+import { N as NodeId, D as Diagnostic, G as Graph, E as EdgeTriple, a as Node, b as EdgeKind } from './graph-XpDkFSjz.js';
+import { R as RegistryAdapter } from './types-Ci06KZkZ.js';
+
+interface CompletionSeed {
+    /** NodeIds the modifier added in the just-completed mutate phase. */
+    recentlyAdded: Set<NodeId>;
+    /** NodeIds the mutate phase orphaned. The completion frontier excludes
+     *  these — optimize phase collects. */
+    recentlyOrphaned: Set<NodeId>;
+}
+interface CompletionResult {
+    graph: Graph;
+    added: NodeId[];
+    wired: EdgeTriple[];
+    unresolved: Diagnostic[];
+}
+interface CompletionOptions {
+    seed?: CompletionSeed;
+    onDiagnostic?: (d: Diagnostic) => void;
+}
+/**
+ * Walk graph, query registry for missing transitive deps, wire edges.
+ * Monotone-additive: returned graph ⊇ input graph (no removals).
+ */
+declare function completeTransitives(graph: Graph, registry: RegistryAdapter, options?: CompletionOptions): Promise<CompletionResult>;
+
+/**
+ * Walk consumer → root via incoming-edge BFS.
+ * Returns nodes in BFS order: consumer first, deeper ancestors last.
+ * Cycles tolerated via `seen`.
+ */
+declare function ancestorsOf(graph: Graph, consumer: NodeId): Node[];
+/**
+ * Find-up resolve per ADR-0023 §5.1.
+ *
+ * Returns the closest-ancestor satisfying node, or undefined if either
+ * (a) no ancestor declares `name` at all → caller may install nested at the
+ *     consumer's level, or
+ * (b) the closest ancestor that declares `name` does so with a conflicting
+ *     range → "block hoist", caller installs nested fallback (npm-3 style).
+ *
+ * Tiebreaker:
+ *   1. Highest semver-comparable version wins (`semver.rcompare`).
+ *   2. On version tie, lowest NodeId lex order wins.
+ *
+ * `depKind` is part of the §5.1 normative signature but does NOT affect the
+ * algorithm body in v1: every dep-kind (dep / dev / optional / peer) follows
+ * the same closest-ancestor reuse + block-hoist contract. The parameter is
+ * carried verbatim so future kind-filtered hoist policies (e.g. peer-deps
+ * needing a stricter find-up, or optional-deps allowed to silently fail
+ * differently from regular deps) can branch on it without a signature
+ * migration. Per the ADR §5.1 pseudocode body and the v1 normative scope, no
+ * kind-specific branch is taken yet.
+ */
+declare function resolveFindUp(graph: Graph, consumerId: NodeId, name: string, range: string, depKind: EdgeKind): NodeId | undefined;
+
+type CompletionDiagnosticCode = 'COMPLETION_NODE_ADDED' | 'COMPLETION_EDGE_RESOLVED' | 'COMPLETION_UNRESOLVED' | 'COMPLETION_NODE_UNKNOWN' | 'COMPLETION_VERSION_UNKNOWN' | 'COMPLETION_PEER_CONTEXT_INCOMPLETE';
+interface CompletionDiagnostic extends Diagnostic {
+    code: CompletionDiagnosticCode;
+}
+declare function completionNodeAdded(nodeId: NodeId): CompletionDiagnostic;
+declare function completionEdgeResolved(triple: EdgeTriple): CompletionDiagnostic;
+declare function completionUnresolved(consumer: NodeId, depName: string, depRange: string): CompletionDiagnostic;
+declare function completionNodeUnknown(nodeId: NodeId): CompletionDiagnostic;
+declare function completionVersionUnknown(nodeId: NodeId): CompletionDiagnostic;
+declare function completionPeerContextIncomplete(nodeId: NodeId, peerName: string, peerRange: string): CompletionDiagnostic;
+
+export { type CompletionDiagnostic, type CompletionDiagnosticCode, type CompletionOptions, type CompletionResult, type CompletionSeed, ancestorsOf, completeTransitives, completionEdgeResolved, completionNodeAdded, completionNodeUnknown, completionPeerContextIncomplete, completionUnresolved, completionVersionUnknown, resolveFindUp };

package/dist/complete.js

@@ -0,0 +1,298 @@
+import 'crypto';
+import 'buffer';
+import semver from 'semver';
+
+// src/main/ts/errors.ts
+
+// src/main/ts/graph.ts
+function serializeNodeId(name, version, peerContext, patch) {
+  const base = toTarballKey({ name, version});
+  if (peerContext.length === 0) return base;
+  return base + peerContext.map((p) => `(${p})`).join("");
+}
+function toTarballKey(inputs) {
+  const slots = [];
+  return slots.length === 0 ? `${inputs.name}@${inputs.version}` : `${inputs.name}@${inputs.version}+${slots.sort(cmpStr).join("+")}`;
+}
+var cmpStr = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var cmpStr2 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function ancestorsOf(graph, consumer) {
+  const consumerNode = graph.getNode(consumer);
+  if (consumerNode === void 0) return [];
+  const result = [consumerNode];
+  const seen = /* @__PURE__ */ new Set([consumer]);
+  const queue = [consumer];
+  while (queue.length > 0) {
+    const cur = queue.shift();
+    for (const edge of graph.in(cur)) {
+      if (seen.has(edge.src)) continue;
+      const srcNode = graph.getNode(edge.src);
+      if (srcNode === void 0) continue;
+      seen.add(edge.src);
+      result.push(srcNode);
+      queue.push(edge.src);
+    }
+  }
+  return result;
+}
+function resolveFindUp(graph, consumerId, name, range, depKind) {
+  const path = ancestorsOf(graph, consumerId);
+  for (const ancestor of path) {
+    const candidates = [];
+    for (const edge of graph.out(ancestor.id)) {
+      const dst = graph.getNode(edge.dst);
+      if (dst === void 0) continue;
+      if (dst.name === name) candidates.push(dst);
+    }
+    if (candidates.length === 0) continue;
+    const satisfying = candidates.filter((c) => safeSatisfies(c.version, range));
+    if (satisfying.length === 0) {
+      return void 0;
+    }
+    satisfying.sort((a, b) => {
+      const v = semverRcompareSafe(a.version, b.version);
+      if (v !== 0) return v;
+      return cmpStr2(a.id, b.id);
+    });
+    return satisfying[0].id;
+  }
+  return void 0;
+}
+function safeSatisfies(version, range) {
+  try {
+    return semver.satisfies(version, range);
+  } catch {
+    return false;
+  }
+}
+function semverRcompareSafe(a, b) {
+  const va = semver.valid(a);
+  const vb = semver.valid(b);
+  if (va !== null && vb !== null) return semver.rcompare(a, b);
+  return cmpStr2(b, a);
+}
+
+// src/main/ts/complete/diagnostics.ts
+function completionNodeAdded(nodeId) {
+  return {
+    code: "COMPLETION_NODE_ADDED",
+    severity: "info",
+    subject: nodeId,
+    message: `completion added ${nodeId}`
+  };
+}
+function completionEdgeResolved(triple) {
+  return {
+    code: "COMPLETION_EDGE_RESOLVED",
+    severity: "info",
+    subject: triple,
+    message: `wired ${triple.src} \u2192${triple.kind} ${triple.dst} via find-up reuse`
+  };
+}
+function completionUnresolved(consumer, depName, depRange) {
+  return {
+    code: "COMPLETION_UNRESOLVED",
+    severity: "warning",
+    subject: consumer,
+    message: `cannot resolve ${depName}@${depRange} for consumer ${consumer}`
+  };
+}
+function completionNodeUnknown(nodeId) {
+  return {
+    code: "COMPLETION_NODE_UNKNOWN",
+    severity: "warning",
+    subject: nodeId,
+    message: `registry has no packument for ${nodeId}`
+  };
+}
+function completionVersionUnknown(nodeId) {
+  return {
+    code: "COMPLETION_VERSION_UNKNOWN",
+    severity: "warning",
+    subject: nodeId,
+    message: `packument lacks version for ${nodeId}`
+  };
+}
+function completionPeerContextIncomplete(nodeId, peerName, peerRange) {
+  return {
+    code: "COMPLETION_PEER_CONTEXT_INCOMPLETE",
+    severity: "warning",
+    subject: nodeId,
+    message: `peer ${peerName}@${peerRange} unresolved at completion for ${nodeId}`
+  };
+}
+
+// src/main/ts/complete/tree-complete.ts
+var EMPTY_SEED = {
+  recentlyAdded: /* @__PURE__ */ new Set(),
+  recentlyOrphaned: /* @__PURE__ */ new Set()
+};
+async function completeTransitives(graph, registry, options = {}) {
+  const seed = options.seed ?? EMPTY_SEED;
+  const onDiagnostic = options.onDiagnostic;
+  const visited = /* @__PURE__ */ new Set();
+  const added = [];
+  const wired = [];
+  const unresolved = [];
+  let currentGraph = graph;
+  const emit = (d) => {
+    unresolved.push(d);
+    if (onDiagnostic !== void 0) onDiagnostic(d);
+  };
+  const emitAndLand = (d) => {
+    emit(d);
+    currentGraph = currentGraph.mutate((m) => {
+      m.diagnostic(d);
+    }).graph;
+  };
+  const frontier = [];
+  for (const root of currentGraph.roots()) {
+    if (!seed.recentlyOrphaned.has(root)) frontier.push(root);
+  }
+  for (const id of seed.recentlyAdded) {
+    if (!seed.recentlyOrphaned.has(id)) frontier.push(id);
+  }
+  while (frontier.length > 0) {
+    const nodeId = frontier.shift();
+    if (visited.has(nodeId)) continue;
+    visited.add(nodeId);
+    const node = currentGraph.getNode(nodeId);
+    if (node === void 0) continue;
+    if (node.workspacePath !== void 0) {
+      for (const edge of currentGraph.out(nodeId)) {
+        if (!visited.has(edge.dst)) frontier.push(edge.dst);
+      }
+      continue;
+    }
+    const packument = await registry.packument(node.name);
+    if (packument === void 0) {
+      for (const edge of currentGraph.out(nodeId)) {
+        if (!visited.has(edge.dst)) frontier.push(edge.dst);
+      }
+      emitAndLand(completionNodeUnknown(nodeId));
+      continue;
+    }
+    const pv = packument.versions[node.version];
+    if (pv === void 0) {
+      for (const edge of currentGraph.out(nodeId)) {
+        if (!visited.has(edge.dst)) frontier.push(edge.dst);
+      }
+      emitAndLand(completionVersionUnknown(nodeId));
+      continue;
+    }
+    const depBuckets = [
+      { deps: pv.dependencies, kind: "dep" },
+      { deps: pv.devDependencies, kind: "dev" },
+      { deps: pv.optionalDependencies, kind: "optional" },
+      { deps: pv.peerDependencies, kind: "peer" }
+    ];
+    for (const { deps, kind } of depBuckets) {
+      if (deps === void 0) continue;
+      const depNames = Object.keys(deps).sort(cmpStr3);
+      for (const depName of depNames) {
+        const depRange = deps[depName];
+        if (alreadyWired(currentGraph, nodeId, depName, kind)) continue;
+        const targetId = resolveFindUp(currentGraph, nodeId, depName, depRange);
+        if (targetId !== void 0) {
+          if (kind === "peer") {
+            emitAndLand(completionPeerContextIncomplete(nodeId, depName, depRange));
+            continue;
+          }
+          const triple2 = { src: nodeId, dst: targetId, kind };
+          const resolvedDiag = completionEdgeResolved(triple2);
+          const result2 = currentGraph.mutate((m) => {
+            m.addEdge(nodeId, targetId, kind, { range: depRange });
+            m.diagnostic(resolvedDiag);
+          });
+          currentGraph = result2.graph;
+          wired.push(triple2);
+          emit(resolvedDiag);
+          if (!visited.has(targetId)) frontier.push(targetId);
+          continue;
+        }
+        const resolved = await registry.resolve(depName, depRange);
+        if (resolved === void 0) {
+          if (kind === "peer") {
+            emitAndLand(completionPeerContextIncomplete(nodeId, depName, depRange));
+          } else {
+            emitAndLand(completionUnresolved(nodeId, depName, depRange));
+          }
+          continue;
+        }
+        const newId = serializeNodeId(resolved.name, resolved.version, []);
+        const newNode = {
+          id: newId,
+          name: resolved.name,
+          version: resolved.version,
+          peerContext: []
+        };
+        const { inputs, payload } = projectPackumentVersion(resolved);
+        if (kind === "peer") {
+          emitAndLand(completionPeerContextIncomplete(nodeId, depName, depRange));
+          continue;
+        }
+        let alreadyAdded = false;
+        const nodeAddedDiag = completionNodeAdded(newId);
+        const result = currentGraph.mutate((m) => {
+          if (currentGraph.getNode(newId) === void 0) {
+            m.addNode(newNode);
+            m.setTarball(inputs, payload);
+            m.diagnostic(nodeAddedDiag);
+          } else {
+            alreadyAdded = true;
+          }
+          m.addEdge(nodeId, newId, kind, { range: depRange });
+        });
+        currentGraph = result.graph;
+        if (!alreadyAdded) {
+          added.push(newId);
+          emit(nodeAddedDiag);
+        }
+        const triple = { src: nodeId, dst: newId, kind };
+        wired.push(triple);
+        if (!visited.has(newId)) frontier.push(newId);
+      }
+    }
+    for (const edge of currentGraph.out(nodeId)) {
+      if (!visited.has(edge.dst)) frontier.push(edge.dst);
+    }
+  }
+  return {
+    graph: currentGraph,
+    added,
+    wired,
+    unresolved
+  };
+}
+function alreadyWired(graph, src, depName, kind) {
+  for (const edge of graph.out(src, kind)) {
+    const dst = graph.getNode(edge.dst);
+    if (dst !== void 0 && dst.name === depName) return true;
+  }
+  return false;
+}
+function projectPackumentVersion(pv) {
+  return {
+    inputs: {
+      name: pv.name,
+      version: pv.version
+      // patch is always undefined per §4.2 — completion does not synthesise patches.
+    },
+    payload: {
+      integrity: pv.integrity,
+      engines: pv.engines,
+      os: pv.os,
+      cpu: pv.cpu,
+      libc: pv.libc,
+      bin: pv.bin,
+      bundledDependencies: pv.bundledDependencies,
+      deprecated: pv.deprecated,
+      resolution: pv.tarball === void 0 ? void 0 : { type: "tarball", url: pv.tarball }
+      // license intentionally undefined — not carried on PackumentVersion;
+      // recipe-layer enrich may refine later per §4.2 footnote.
+    }
+  };
+}
+var cmpStr3 = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+
+export { ancestorsOf, completeTransitives, completionEdgeResolved, completionNodeAdded, completionNodeUnknown, completionPeerContextIncomplete, completionUnresolved, completionVersionUnknown, resolveFindUp };

package/dist/formats/bun-text.d.ts

@@ -1,4 +1,4 @@
-import { D as Diagnostic, G as Graph } from '../graph-BzsItuAI.js';
+import { D as Diagnostic, G as Graph } from '../graph-XpDkFSjz.js';
 
 interface BunTextParseOptions {
 }

package/dist/formats/bun-text.js

@@ -98,9 +98,13 @@ function tarballKeyInputsOfNode(node) {
   };
 }
 var cmpStr = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var cmpAlias = (a, b) => a === b ? 0 : a === void 0 ? -1 : b === void 0 ? 1 : cmpStr(a, b);
 var cmpEdgeBy = (end) => (a, b) => {
   const c = cmpStr(end === "dst" ? a.dst : a.src, end === "dst" ? b.dst : b.src);
-  return c !== 0 ? c : cmpStr(a.kind, b.kind);
+  if (c !== 0) return c;
+  const k = cmpStr(a.kind, b.kind);
+  if (k !== 0) return k;
+  return cmpAlias(a.attrs?.alias, b.attrs?.alias);
 };
 function emptyState() {
   return {
@@ -136,7 +140,7 @@ function removeMatching(arr, pred) {
   arr.splice(i, 1);
   return true;
 }
-var tripleKey = (e) => `${e.src}\0${e.kind}\0${e.dst}`;
+var tripleKey = (e) => `${e.src}\0${e.kind}\0${e.dst}\0${e.attrs?.alias ?? ""}`;
 function rebindNodeId(s, oldId, newId, newNode) {
   s.nodes.set(newId, newNode);
   s.nodes.delete(oldId);
@@ -146,7 +150,9 @@ function rebindNodeId(s, oldId, newId, newNode) {
   for (const e of outs) {
     const peerInc = s.incoming.get(e.dst);
     if (peerInc) {
-      const idx = peerInc.findIndex((x) => x.src === oldId && x.kind === e.kind && x.dst === e.dst);
+      const idx = peerInc.findIndex(
+        (x) => x.src === oldId && x.kind === e.kind && x.dst === e.dst && x.attrs?.alias === e.attrs?.alias
+      );
       if (idx >= 0) peerInc[idx] = e;
     }
   }
@@ -156,11 +162,25 @@ function rebindNodeId(s, oldId, newId, newNode) {
   for (const e of ins) {
     const peerOut = s.outgoing.get(e.src);
     if (peerOut) {
-      const idx = peerOut.findIndex((x) => x.src === e.src && x.kind === e.kind && x.dst === oldId);
+      const idx = peerOut.findIndex(
+        (x) => x.src === e.src && x.kind === e.kind && x.dst === oldId && x.attrs?.alias === e.attrs?.alias
+      );
       if (idx >= 0) peerOut[idx] = e;
     }
   }
 }
+function protocolOf(range) {
+  const colonIdx = range.indexOf(":");
+  if (colonIdx <= 0) return void 0;
+  const prefix = range.slice(0, colonIdx);
+  return /^[a-z][a-z0-9+.-]*$/i.test(prefix) ? prefix : void 0;
+}
+function isPublishedSelfLink(edge) {
+  const range = edge.attrs?.range;
+  if (range === void 0) return false;
+  const proto = protocolOf(range);
+  return proto === void 0 || proto === "npm";
+}
 function validate(s) {
   for (const d of s.diagnostics) {
     if (d.severity === "error") {
@@ -178,16 +198,26 @@ function validate(s) {
       }
       const k = tripleKey(e);
       if (seen.has(k)) {
-        throw new GraphError("INVARIANT_VIOLATION", `duplicate edge: ${e.src} \u2192${e.kind} ${e.dst}`);
+        const aliasSuffix = e.attrs?.alias !== void 0 ? ` (alias=${e.attrs.alias})` : "";
+        throw new GraphError("INVARIANT_VIOLATION", `duplicate edge: ${e.src} \u2192${e.kind} ${e.dst}${aliasSuffix}`);
       }
       seen.add(k);
     }
   }
   for (const [id, node] of s.nodes) {
     if (node.workspacePath !== void 0) {
-      const inc = s.incoming.get(id);
-      const hasNonWorkspaceIncoming = inc?.some((edge) => s.nodes.get(edge.src)?.workspacePath === void 0) ?? false;
-      if (hasNonWorkspaceIncoming) {
+      const inc = s.incoming.get(id) ?? [];
+      for (const edge of inc) {
+        if (s.nodes.get(edge.src)?.workspacePath !== void 0) continue;
+        if (isPublishedSelfLink(edge)) {
+          s.diagnostics.push({
+            code: "SEAL_PUBLISHED_SELF_LINK",
+            subject: id,
+            severity: "info",
+            message: `published self-link: ${edge.src} \u2192${edge.kind} ${id} (range ${edge.attrs?.range}) \u2014 published dependency resolved to co-located workspace`
+          });
+          continue;
+        }
         throw new GraphError("INVARIANT_VIOLATION", `workspace node has incoming edges: ${id}`);
       }
     }
@@ -468,8 +498,10 @@ var GraphImpl = class _GraphImpl {
         if (!next.nodes.has(src)) throw new GraphError("PATCH_REJECTED", `addEdge: src ${src} missing`);
         if (!next.nodes.has(dst)) throw new GraphError("PATCH_REJECTED", `addEdge: dst ${dst} missing`);
         const existing = next.outgoing.get(src) ?? [];
-        if (existing.some((e2) => e2.dst === dst && e2.kind === kind)) {
-          throw new GraphError("PATCH_REJECTED", `addEdge: duplicate ${src} \u2192${kind} ${dst}`);
+        const newAlias = attrs?.alias;
+        if (existing.some((e2) => e2.dst === dst && e2.kind === kind && e2.attrs?.alias === newAlias)) {
+          const aliasSuffix = newAlias !== void 0 ? ` (alias=${newAlias})` : "";
+          throw new GraphError("PATCH_REJECTED", `addEdge: duplicate ${src} \u2192${kind} ${dst}${aliasSuffix}`);
         }
         const e = attrs ? { src, dst, kind, attrs } : { src, dst, kind };
         pushTo(next.outgoing, src, e);
@@ -478,11 +510,15 @@ var GraphImpl = class _GraphImpl {
       },
       removeEdge(src, dst, kind) {
         const outs = next.outgoing.get(src);
-        if (!outs || !removeMatching(outs, (e) => e.dst === dst && e.kind === kind)) {
+        let removedAlias;
+        const found = outs?.findIndex((e) => e.dst === dst && e.kind === kind) ?? -1;
+        if (!outs || found < 0) {
           throw new GraphError("PATCH_REJECTED", `removeEdge: ${src} \u2192${kind} ${dst} missing`);
         }
+        removedAlias = outs[found]?.attrs?.alias;
+        outs.splice(found, 1);
         const ins = next.incoming.get(dst);
-        if (ins) removeMatching(ins, (e) => e.src === src && e.kind === kind);
+        if (ins) removeMatching(ins, (e) => e.src === src && e.kind === kind && e.attrs?.alias === removedAlias);
         applied.push({ kind: "edge-removed", subject: { src, dst, kind } });
       },
       replacePeerContext(id, peers) {
@@ -527,6 +563,12 @@ var GraphImpl = class _GraphImpl {
           throw new GraphError("PATCH_REJECTED", `removeTarball: ${key} missing`);
         }
         applied.push({ kind: "tarball-removed", subject: key });
+      },
+      // ADR-0023 §8.6 — write-side diagnostic emit. Append to the staged
+      // diagnostics list; the resulting Graph.diagnostics() surfaces it
+      // once mutate() settles. Same append semantics as Builder.diagnostic.
+      diagnostic(d) {
+        next.diagnostics.push(d);
       }
     };
     transaction(m);

package/dist/formats/npm-1.d.ts

@@ -1,4 +1,4 @@
-import { D as Diagnostic, G as Graph } from '../graph-BzsItuAI.js';
+import { D as Diagnostic, G as Graph } from '../graph-XpDkFSjz.js';
 
 interface Npm1ParseOptions {
 }

package/dist/formats/npm-1.js

@@ -99,9 +99,13 @@ function tarballKeyInputsOfNode(node) {
   };
 }
 var cmpStr = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var cmpAlias = (a, b) => a === b ? 0 : a === void 0 ? -1 : b === void 0 ? 1 : cmpStr(a, b);
 var cmpEdgeBy = (end) => (a, b) => {
   const c = cmpStr(end === "dst" ? a.dst : a.src, end === "dst" ? b.dst : b.src);
-  return c !== 0 ? c : cmpStr(a.kind, b.kind);
+  if (c !== 0) return c;
+  const k = cmpStr(a.kind, b.kind);
+  if (k !== 0) return k;
+  return cmpAlias(a.attrs?.alias, b.attrs?.alias);
 };
 function emptyState() {
   return {
@@ -137,7 +141,7 @@ function removeMatching(arr, pred) {
   arr.splice(i, 1);
   return true;
 }
-var tripleKey = (e) => `${e.src}\0${e.kind}\0${e.dst}`;
+var tripleKey = (e) => `${e.src}\0${e.kind}\0${e.dst}\0${e.attrs?.alias ?? ""}`;
 function rebindNodeId(s, oldId, newId, newNode) {
   s.nodes.set(newId, newNode);
   s.nodes.delete(oldId);
@@ -147,7 +151,9 @@ function rebindNodeId(s, oldId, newId, newNode) {
   for (const e of outs) {
     const peerInc = s.incoming.get(e.dst);
     if (peerInc) {
-      const idx = peerInc.findIndex((x) => x.src === oldId && x.kind === e.kind && x.dst === e.dst);
+      const idx = peerInc.findIndex(
+        (x) => x.src === oldId && x.kind === e.kind && x.dst === e.dst && x.attrs?.alias === e.attrs?.alias
+      );
       if (idx >= 0) peerInc[idx] = e;
     }
   }
@@ -157,11 +163,25 @@ function rebindNodeId(s, oldId, newId, newNode) {
   for (const e of ins) {
     const peerOut = s.outgoing.get(e.src);
     if (peerOut) {
-      const idx = peerOut.findIndex((x) => x.src === e.src && x.kind === e.kind && x.dst === oldId);
+      const idx = peerOut.findIndex(
+        (x) => x.src === e.src && x.kind === e.kind && x.dst === oldId && x.attrs?.alias === e.attrs?.alias
+      );
       if (idx >= 0) peerOut[idx] = e;
     }
   }
 }
+function protocolOf(range) {
+  const colonIdx = range.indexOf(":");
+  if (colonIdx <= 0) return void 0;
+  const prefix = range.slice(0, colonIdx);
+  return /^[a-z][a-z0-9+.-]*$/i.test(prefix) ? prefix : void 0;
+}
+function isPublishedSelfLink(edge) {
+  const range = edge.attrs?.range;
+  if (range === void 0) return false;
+  const proto = protocolOf(range);
+  return proto === void 0 || proto === "npm";
+}
 function validate(s) {
   for (const d of s.diagnostics) {
     if (d.severity === "error") {
@@ -179,16 +199,26 @@ function validate(s) {
       }
       const k = tripleKey(e);
       if (seen.has(k)) {
-        throw new GraphError("INVARIANT_VIOLATION", `duplicate edge: ${e.src} \u2192${e.kind} ${e.dst}`);
+        const aliasSuffix = e.attrs?.alias !== void 0 ? ` (alias=${e.attrs.alias})` : "";
+        throw new GraphError("INVARIANT_VIOLATION", `duplicate edge: ${e.src} \u2192${e.kind} ${e.dst}${aliasSuffix}`);
       }
       seen.add(k);
     }
   }
   for (const [id, node] of s.nodes) {
     if (node.workspacePath !== void 0) {
-      const inc = s.incoming.get(id);
-      const hasNonWorkspaceIncoming = inc?.some((edge) => s.nodes.get(edge.src)?.workspacePath === void 0) ?? false;
-      if (hasNonWorkspaceIncoming) {
+      const inc = s.incoming.get(id) ?? [];
+      for (const edge of inc) {
+        if (s.nodes.get(edge.src)?.workspacePath !== void 0) continue;
+        if (isPublishedSelfLink(edge)) {
+          s.diagnostics.push({
+            code: "SEAL_PUBLISHED_SELF_LINK",
+            subject: id,
+            severity: "info",
+            message: `published self-link: ${edge.src} \u2192${edge.kind} ${id} (range ${edge.attrs?.range}) \u2014 published dependency resolved to co-located workspace`
+          });
+          continue;
+        }
         throw new GraphError("INVARIANT_VIOLATION", `workspace node has incoming edges: ${id}`);
       }
     }
@@ -469,8 +499,10 @@ var GraphImpl = class _GraphImpl {
         if (!next.nodes.has(src)) throw new GraphError("PATCH_REJECTED", `addEdge: src ${src} missing`);
         if (!next.nodes.has(dst)) throw new GraphError("PATCH_REJECTED", `addEdge: dst ${dst} missing`);
         const existing = next.outgoing.get(src) ?? [];
-        if (existing.some((e2) => e2.dst === dst && e2.kind === kind)) {
-          throw new GraphError("PATCH_REJECTED", `addEdge: duplicate ${src} \u2192${kind} ${dst}`);
+        const newAlias = attrs?.alias;
+        if (existing.some((e2) => e2.dst === dst && e2.kind === kind && e2.attrs?.alias === newAlias)) {
+          const aliasSuffix = newAlias !== void 0 ? ` (alias=${newAlias})` : "";
+          throw new GraphError("PATCH_REJECTED", `addEdge: duplicate ${src} \u2192${kind} ${dst}${aliasSuffix}`);
         }
         const e = attrs ? { src, dst, kind, attrs } : { src, dst, kind };
         pushTo(next.outgoing, src, e);
@@ -479,11 +511,15 @@ var GraphImpl = class _GraphImpl {
       },
       removeEdge(src, dst, kind) {
         const outs = next.outgoing.get(src);
-        if (!outs || !removeMatching(outs, (e) => e.dst === dst && e.kind === kind)) {
+        let removedAlias;
+        const found = outs?.findIndex((e) => e.dst === dst && e.kind === kind) ?? -1;
+        if (!outs || found < 0) {
           throw new GraphError("PATCH_REJECTED", `removeEdge: ${src} \u2192${kind} ${dst} missing`);
         }
+        removedAlias = outs[found]?.attrs?.alias;
+        outs.splice(found, 1);
         const ins = next.incoming.get(dst);
-        if (ins) removeMatching(ins, (e) => e.src === src && e.kind === kind);
+        if (ins) removeMatching(ins, (e) => e.src === src && e.kind === kind && e.attrs?.alias === removedAlias);
         applied.push({ kind: "edge-removed", subject: { src, dst, kind } });
       },
       replacePeerContext(id, peers) {
@@ -528,6 +564,12 @@ var GraphImpl = class _GraphImpl {
           throw new GraphError("PATCH_REJECTED", `removeTarball: ${key} missing`);
         }
         applied.push({ kind: "tarball-removed", subject: key });
+      },
+      // ADR-0023 §8.6 — write-side diagnostic emit. Append to the staged
+      // diagnostics list; the resulting Graph.diagnostics() surfaces it
+      // once mutate() settles. Same append semantics as Builder.diagnostic.
+      diagnostic(d) {
+        next.diagnostics.push(d);
       }
     };
     transaction(m);