@antongolub/lockfile 0.0.0-snapshot.55 → 0.0.0-snapshot.58

package/dist/{_npm-flat-types-DnyApcb5.d.ts → _npm-flat-types-C6TSaidU.d.ts}

@@ -1,4 +1,4 @@
-import { D as Diagnostic, O as OverrideConstraint } from './graph-hx9HLuBV.js';
+import { D as Diagnostic, O as OverrideConstraint } from './graph-B_G4OKqF.js';
 
 interface NpmFamilyParseOptions {
 }

package/dist/{_pnpm-flat-core-CTAPp1B_.d.ts → _pnpm-flat-core-NEg8x-yf.d.ts}

@@ -1,4 +1,4 @@
-import { D as Diagnostic, O as OverrideConstraint } from './graph-hx9HLuBV.js';
+import { D as Diagnostic, O as OverrideConstraint } from './graph-B_G4OKqF.js';
 
 interface PnpmFamilyParseOptions {
     /**

package/dist/{_yarn-berry-core-BX8m074X.d.ts → _yarn-berry-core-CLT-3m_j.d.ts}

@@ -1,4 +1,4 @@
-import { O as OverrideConstraint, D as Diagnostic } from './graph-hx9HLuBV.js';
+import { O as OverrideConstraint, D as Diagnostic } from './graph-B_G4OKqF.js';
 
 interface YarnBerryFamilyParseOptions {
     workspaceRoot?: string;

package/dist/complete.d.ts

@@ -1,5 +1,5 @@
-import { N as NodeId, D as Diagnostic, G as Graph, E as EdgeTriple, a as Node, b as EdgeKind } from './graph-hx9HLuBV.js';
-import { R as RegistryAdapter } from './types-D-9ZZM6k.js';
+import { N as NodeId, D as Diagnostic, G as Graph, E as EdgeTriple, a as Node, b as EdgeKind } from './graph-B_G4OKqF.js';
+import { R as RegistryAdapter } from './types-CGeGAM7Z.js';
 
 interface CompletionSeed {
     /** NodeIds the modifier added in the just-completed mutate phase. */

package/dist/complete.js

@@ -5,7 +5,7 @@ import semver from 'semver';
 // src/main/ts/errors.ts
 
 // src/main/ts/graph.ts
-function serializeNodeId(name, version, peerContext, patch) {
+function serializeNodeId(name, version, peerContext, patch, source) {
   const base = toTarballKey({ name, version});
   if (peerContext.length === 0) return base;
   return base + peerContext.map((p) => `(${p})`).join("");

package/dist/formats/bun-text.d.ts

@@ -1,4 +1,4 @@
-import { D as Diagnostic, G as Graph } from '../graph-hx9HLuBV.js';
+import { D as Diagnostic, G as Graph } from '../graph-B_G4OKqF.js';
 
 interface BunTextParseOptions {
 }

package/dist/formats/bun-text.js

@@ -33,15 +33,15 @@ var GraphError = class extends Error {
     this.code = code;
   }
 };
-function serializeNodeId(name, version, peerContext, patch) {
-  const base = toTarballKey({ name, version, patch });
+function serializeNodeId(name, version, peerContext, patch, source) {
+  const base = toTarballKey({ name, version, patch, source });
   if (peerContext.length === 0) return base;
   return base + peerContext.map((p) => `(${p})`).join("");
 }
 function acceptedNodeIds(node) {
-  const bare = serializeNodeId(node.name, node.version, node.peerContext);
+  const bare = serializeNodeId(node.name, node.version, node.peerContext, void 0, node.source);
   if (node.patch === void 0) return [bare];
-  const patched = serializeNodeId(node.name, node.version, node.peerContext, node.patch);
+  const patched = serializeNodeId(node.name, node.version, node.peerContext, node.patch, node.source);
   return bare === patched ? [bare] : [bare, patched];
 }
 function carriesPatchInNodeId(node) {
@@ -49,7 +49,8 @@ function carriesPatchInNodeId(node) {
   return stripPeerContextFromNodeId(node.id) === toTarballKey({
     name: node.name,
     version: node.version,
-    patch: node.patch
+    patch: node.patch,
+    source: node.source
   });
 }
 function stripPeerContextFromNodeId(id) {
@@ -87,19 +88,39 @@ function refuseSentinelMutation(patch, opName, subject) {
     });
   }
 }
+var SRC_TOKEN_RE = /^[0-9a-f]{16}$/;
+function validateSourceToken(source) {
+  if (source.length === 0) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must not be empty` });
+  }
+  if (source.includes("+")) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must not contain '+'` });
+  }
+  if (/\s/.test(source)) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must not contain whitespace` });
+  }
+  if (!SRC_TOKEN_RE.test(source)) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must be 16 lowercase-hex chars` });
+  }
+}
 function toTarballKey(inputs) {
   const slots = [];
   if (inputs.patch !== void 0) {
     validatePatchToken(inputs.patch);
     slots.push(`patch=${inputs.patch}`);
   }
+  if (inputs.source !== void 0) {
+    validateSourceToken(inputs.source);
+    slots.push(`src=${inputs.source}`);
+  }
   return slots.length === 0 ? `${inputs.name}@${inputs.version}` : `${inputs.name}@${inputs.version}+${slots.sort(cmpStr).join("+")}`;
 }
 function tarballKeyInputsOfNode(node) {
   return {
     name: node.name,
     version: node.version,
-    patch: node.patch
+    patch: node.patch,
+    source: node.source
   };
 }
 var cmpStr = (a, b) => a < b ? -1 : a > b ? 1 : 0;
@@ -498,7 +519,7 @@ var GraphImpl = class _GraphImpl {
           }
           rebindNodeId(next, id, newNode.id, newNode);
         }
-        applied.push({ kind: "node-replaced", subject: newNode.id });
+        applied.push(newNode.id === id ? { kind: "node-replaced", subject: newNode.id } : { kind: "node-replaced", subject: newNode.id, oldSubject: id });
       },
       addEdge(src, dst, kind, attrs) {
         if (!next.nodes.has(src)) throw new GraphError("PATCH_REJECTED", `addEdge: src ${src} missing`);
@@ -534,7 +555,7 @@ var GraphImpl = class _GraphImpl {
         for (const p of peers) {
           if (!next.nodes.has(p)) throw new GraphError("PATCH_REJECTED", `replacePeerContext: peer ${p} missing`);
         }
-        const newId = carriesPatchInNodeId(old) ? serializeNodeId(old.name, old.version, peers, old.patch) : serializeNodeId(old.name, old.version, peers);
+        const newId = carriesPatchInNodeId(old) ? serializeNodeId(old.name, old.version, peers, old.patch, old.source) : serializeNodeId(old.name, old.version, peers, void 0, old.source);
         if (newId !== id && next.nodes.has(newId)) {
           throw new GraphError("PATCH_REJECTED", `replacePeerContext: target id ${newId} already exists`);
         }
@@ -555,7 +576,7 @@ var GraphImpl = class _GraphImpl {
           pushTo(next.outgoing, newId, e);
           pushTo(next.incoming, p, e);
         }
-        applied.push({ kind: "peer-context-replaced", subject: newId });
+        applied.push(newId === id ? { kind: "peer-context-replaced", subject: newId } : { kind: "peer-context-replaced", subject: newId, oldSubject: id });
       },
       setTarball(inputs, payload) {
         const key = toTarballKey(inputs);

package/dist/formats/npm-1.d.ts

@@ -1,4 +1,4 @@
-import { D as Diagnostic, G as Graph } from '../graph-hx9HLuBV.js';
+import { D as Diagnostic, G as Graph } from '../graph-B_G4OKqF.js';
 
 interface Npm1ParseOptions {
 }

package/dist/formats/npm-1.js

@@ -1,4 +1,4 @@
-import 'crypto';
+import { createHash } from 'crypto';
 import 'buffer';
 import semver from 'semver';
 
@@ -34,15 +34,15 @@ var GraphError = class extends Error {
     this.code = code;
   }
 };
-function serializeNodeId(name, version, peerContext, patch) {
-  const base = toTarballKey({ name, version, patch });
+function serializeNodeId(name, version, peerContext, patch, source) {
+  const base = toTarballKey({ name, version, patch, source });
   if (peerContext.length === 0) return base;
   return base + peerContext.map((p) => `(${p})`).join("");
 }
 function acceptedNodeIds(node) {
-  const bare = serializeNodeId(node.name, node.version, node.peerContext);
+  const bare = serializeNodeId(node.name, node.version, node.peerContext, void 0, node.source);
   if (node.patch === void 0) return [bare];
-  const patched = serializeNodeId(node.name, node.version, node.peerContext, node.patch);
+  const patched = serializeNodeId(node.name, node.version, node.peerContext, node.patch, node.source);
   return bare === patched ? [bare] : [bare, patched];
 }
 function carriesPatchInNodeId(node) {
@@ -50,7 +50,8 @@ function carriesPatchInNodeId(node) {
   return stripPeerContextFromNodeId(node.id) === toTarballKey({
     name: node.name,
     version: node.version,
-    patch: node.patch
+    patch: node.patch,
+    source: node.source
   });
 }
 function stripPeerContextFromNodeId(id) {
@@ -88,19 +89,39 @@ function refuseSentinelMutation(patch, opName, subject) {
     });
   }
 }
+var SRC_TOKEN_RE = /^[0-9a-f]{16}$/;
+function validateSourceToken(source) {
+  if (source.length === 0) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must not be empty` });
+  }
+  if (source.includes("+")) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must not contain '+'` });
+  }
+  if (/\s/.test(source)) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must not contain whitespace` });
+  }
+  if (!SRC_TOKEN_RE.test(source)) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must be 16 lowercase-hex chars` });
+  }
+}
 function toTarballKey(inputs) {
   const slots = [];
   if (inputs.patch !== void 0) {
     validatePatchToken(inputs.patch);
     slots.push(`patch=${inputs.patch}`);
   }
+  if (inputs.source !== void 0) {
+    validateSourceToken(inputs.source);
+    slots.push(`src=${inputs.source}`);
+  }
   return slots.length === 0 ? `${inputs.name}@${inputs.version}` : `${inputs.name}@${inputs.version}+${slots.sort(cmpStr).join("+")}`;
 }
 function tarballKeyInputsOfNode(node) {
   return {
     name: node.name,
     version: node.version,
-    patch: node.patch
+    patch: node.patch,
+    source: node.source
   };
 }
 var cmpStr = (a, b) => a < b ? -1 : a > b ? 1 : 0;
@@ -499,7 +520,7 @@ var GraphImpl = class _GraphImpl {
           }
           rebindNodeId(next, id, newNode.id, newNode);
         }
-        applied.push({ kind: "node-replaced", subject: newNode.id });
+        applied.push(newNode.id === id ? { kind: "node-replaced", subject: newNode.id } : { kind: "node-replaced", subject: newNode.id, oldSubject: id });
       },
       addEdge(src, dst, kind, attrs) {
         if (!next.nodes.has(src)) throw new GraphError("PATCH_REJECTED", `addEdge: src ${src} missing`);
@@ -535,7 +556,7 @@ var GraphImpl = class _GraphImpl {
         for (const p of peers) {
           if (!next.nodes.has(p)) throw new GraphError("PATCH_REJECTED", `replacePeerContext: peer ${p} missing`);
         }
-        const newId = carriesPatchInNodeId(old) ? serializeNodeId(old.name, old.version, peers, old.patch) : serializeNodeId(old.name, old.version, peers);
+        const newId = carriesPatchInNodeId(old) ? serializeNodeId(old.name, old.version, peers, old.patch, old.source) : serializeNodeId(old.name, old.version, peers, void 0, old.source);
         if (newId !== id && next.nodes.has(newId)) {
           throw new GraphError("PATCH_REJECTED", `replacePeerContext: target id ${newId} already exists`);
         }
@@ -556,7 +577,7 @@ var GraphImpl = class _GraphImpl {
           pushTo(next.outgoing, newId, e);
           pushTo(next.incoming, p, e);
         }
-        applied.push({ kind: "peer-context-replaced", subject: newId });
+        applied.push(newId === id ? { kind: "peer-context-replaced", subject: newId } : { kind: "peer-context-replaced", subject: newId, oldSubject: id });
       },
       setTarball(inputs, payload) {
         const key = toTarballKey(inputs);
@@ -697,8 +718,6 @@ function emitDropped(nodeId, feature, reason, onDiagnostic) {
     message: `${feature} dropped on emit: ${reason}`
   });
 }
-
-// src/main/ts/recipe/resolution.ts
 var HEX40_RE = /^[0-9a-f]{40}$/i;
 var SHA_FRAG_RE = /^[0-9a-f]{7,64}$/i;
 var GITHUB_HOST = "github.com";
@@ -884,6 +903,36 @@ function normaliseDirectoryPath(raw) {
   if (p === "./") return ".";
   return p;
 }
+var REGISTRY_HOSTS = /* @__PURE__ */ new Set([
+  "registry.npmjs.org",
+  "registry.yarnpkg.com"
+]);
+function hostOfTarballUrl(url) {
+  if (!url.startsWith("http://") && !url.startsWith("https://")) return void 0;
+  const noScheme = url.replace(/^https?:\/\//, "");
+  const host = noScheme.split("/")[0];
+  return host === void 0 || host.length === 0 ? void 0 : host;
+}
+function sourceDiscriminatorOf(resolution) {
+  const sourceString = canonicalSourceStringOf(resolution);
+  return sourceString === void 0 ? void 0 : sha256Prefix16(sourceString);
+}
+function canonicalSourceStringOf(resolution) {
+  switch (resolution.type) {
+    case "git":
+      return `git\0${resolution.url}\0${resolution.sha}`;
+    case "tarball": {
+      const host = hostOfTarballUrl(resolution.url);
+      return host !== void 0 && REGISTRY_HOSTS.has(host) ? void 0 : `tarball\0${host ?? resolution.url}`;
+    }
+    case "directory":
+    case "unknown":
+      return void 0;
+  }
+}
+function sha256Prefix16(input) {
+  return createHash("sha256").update(input, "utf8").digest("hex").slice(0, 16);
+}
 function stringifyForNpm(can) {
   switch (can.type) {
     case "tarball":
@@ -996,7 +1045,9 @@ function parse2(input, _options = {}) {
         });
         continue;
       }
-      const id = `${declaredName}@${version}`;
+      const resolved = entry.resolved ?? (isUrlLikeVersion(version) ? version : void 0);
+      const source = resolved !== void 0 ? sourceDiscriminatorOf(parse(resolved, { sourceKind: "npm-resolved" })) : void 0;
+      const id = serializeNodeId(declaredName, version, [], void 0, source);
       const installPath = parentPath === "" ? `node_modules/${declaredName}` : `${parentPath}/node_modules/${declaredName}`;
       if (!seenIds.has(id)) {
         seenIds.add(id);
@@ -1006,8 +1057,8 @@ function parse2(input, _options = {}) {
           version,
           peerContext: []
         };
-        const resolved = entry.resolved ?? (isUrlLikeVersion(version) ? version : void 0);
         if (resolved !== void 0) node.resolution = resolved;
+        if (source !== void 0) node.source = source;
         builder.addNode(node);
         const payload = {};
         if (entry.integrity !== void 0) {
@@ -1027,7 +1078,7 @@ function parse2(input, _options = {}) {
           payload.resolution = canonical;
         }
         if (Object.keys(payload).length > 0) {
-          builder.setTarball({ name: declaredName, version }, payload);
+          builder.setTarball({ name: declaredName, version, source }, payload);
         }
       }
       const sc = ensureSidecar(nodeSidecar, id);
@@ -1275,7 +1326,7 @@ function optimize(graph, _options = {}) {
     (a, b) => cmpStr2(`${a.src} ${a.kind} ${a.dst}`, `${b.src} ${b.kind} ${b.dst}`)
   );
   for (const node of graph.nodes()) {
-    const inputs = { name: node.name, version: node.version, patch: node.patch };
+    const inputs = { name: node.name, version: node.version, patch: node.patch, source: node.source };
     const key = toTarballKey(inputs);
     if (unreachable.has(node.id)) {
       tarballsToRemove.set(key, inputs);
@@ -1631,7 +1682,7 @@ function planManifestEnrich(graph, sidecar, manifests) {
     const member = memberByName.get(node.name);
     if (member === void 0) continue;
     if (member.manifest.version !== void 0 && node.version !== member.manifest.version) continue;
-    if (graph.tarball({ name: node.name, version: node.version }) !== void 0) continue;
+    if (graph.tarballOf(node.id) !== void 0) continue;
     memberNodeReplacements.push({ ...node, workspacePath: member.path });
   }
   for (const [name, { path, manifest }] of memberByName) {

package/dist/formats/npm-2.d.ts

@@ -1,5 +1,5 @@
-import { G as Graph, D as Diagnostic } from '../graph-hx9HLuBV.js';
-import { N as NpmFamilyEnrichOptions, a as NpmFamilyOptimizeOptions, b as NpmFamilyParseOptions, c as NpmFamilyStringifyOptions } from '../_npm-flat-types-DnyApcb5.js';
+import { G as Graph, D as Diagnostic } from '../graph-B_G4OKqF.js';
+import { N as NpmFamilyEnrichOptions, a as NpmFamilyOptimizeOptions, b as NpmFamilyParseOptions, c as NpmFamilyStringifyOptions } from '../_npm-flat-types-C6TSaidU.js';
 
 interface Npm2ParseOptions extends NpmFamilyParseOptions {
 }

package/dist/formats/npm-2.js

@@ -1,5 +1,5 @@
 import semver from 'semver';
-import 'crypto';
+import { createHash } from 'crypto';
 import 'buffer';
 
 // src/main/ts/formats/_npm-core.ts
@@ -47,15 +47,15 @@ function nameOf(id) {
   }
   return lastAt < 0 ? id : id.slice(0, lastAt);
 }
-function serializeNodeId(name, version, peerContext, patch) {
-  const base = toTarballKey({ name, version, patch });
+function serializeNodeId(name, version, peerContext, patch, source) {
+  const base = toTarballKey({ name, version, patch, source });
   if (peerContext.length === 0) return base;
   return base + peerContext.map((p) => `(${p})`).join("");
 }
 function acceptedNodeIds(node) {
-  const bare = serializeNodeId(node.name, node.version, node.peerContext);
+  const bare = serializeNodeId(node.name, node.version, node.peerContext, void 0, node.source);
   if (node.patch === void 0) return [bare];
-  const patched = serializeNodeId(node.name, node.version, node.peerContext, node.patch);
+  const patched = serializeNodeId(node.name, node.version, node.peerContext, node.patch, node.source);
   return bare === patched ? [bare] : [bare, patched];
 }
 function carriesPatchInNodeId(node) {
@@ -63,7 +63,8 @@ function carriesPatchInNodeId(node) {
   return stripPeerContextFromNodeId(node.id) === toTarballKey({
     name: node.name,
     version: node.version,
-    patch: node.patch
+    patch: node.patch,
+    source: node.source
   });
 }
 function stripPeerContextFromNodeId(id) {
@@ -101,19 +102,39 @@ function refuseSentinelMutation(patch, opName, subject) {
     });
   }
 }
+var SRC_TOKEN_RE = /^[0-9a-f]{16}$/;
+function validateSourceToken(source) {
+  if (source.length === 0) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must not be empty` });
+  }
+  if (source.includes("+")) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must not contain '+'` });
+  }
+  if (/\s/.test(source)) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must not contain whitespace` });
+  }
+  if (!SRC_TOKEN_RE.test(source)) {
+    throw new LockfileError({ code: "INVALID_INPUT", message: `source slot must be 16 lowercase-hex chars` });
+  }
+}
 function toTarballKey(inputs) {
   const slots = [];
   if (inputs.patch !== void 0) {
     validatePatchToken(inputs.patch);
     slots.push(`patch=${inputs.patch}`);
   }
+  if (inputs.source !== void 0) {
+    validateSourceToken(inputs.source);
+    slots.push(`src=${inputs.source}`);
+  }
   return slots.length === 0 ? `${inputs.name}@${inputs.version}` : `${inputs.name}@${inputs.version}+${slots.sort(cmpStr).join("+")}`;
 }
 function tarballKeyInputsOfNode(node) {
   return {
     name: node.name,
     version: node.version,
-    patch: node.patch
+    patch: node.patch,
+    source: node.source
   };
 }
 var cmpStr = (a, b) => a < b ? -1 : a > b ? 1 : 0;
@@ -512,7 +533,7 @@ var GraphImpl = class _GraphImpl {
           }
           rebindNodeId(next, id, newNode.id, newNode);
         }
-        applied.push({ kind: "node-replaced", subject: newNode.id });
+        applied.push(newNode.id === id ? { kind: "node-replaced", subject: newNode.id } : { kind: "node-replaced", subject: newNode.id, oldSubject: id });
       },
       addEdge(src, dst, kind, attrs) {
         if (!next.nodes.has(src)) throw new GraphError("PATCH_REJECTED", `addEdge: src ${src} missing`);
@@ -548,7 +569,7 @@ var GraphImpl = class _GraphImpl {
         for (const p of peers) {
           if (!next.nodes.has(p)) throw new GraphError("PATCH_REJECTED", `replacePeerContext: peer ${p} missing`);
         }
-        const newId = carriesPatchInNodeId(old) ? serializeNodeId(old.name, old.version, peers, old.patch) : serializeNodeId(old.name, old.version, peers);
+        const newId = carriesPatchInNodeId(old) ? serializeNodeId(old.name, old.version, peers, old.patch, old.source) : serializeNodeId(old.name, old.version, peers, void 0, old.source);
         if (newId !== id && next.nodes.has(newId)) {
           throw new GraphError("PATCH_REJECTED", `replacePeerContext: target id ${newId} already exists`);
         }
@@ -569,7 +590,7 @@ var GraphImpl = class _GraphImpl {
           pushTo(next.outgoing, newId, e);
           pushTo(next.incoming, p, e);
         }
-        applied.push({ kind: "peer-context-replaced", subject: newId });
+        applied.push(newId === id ? { kind: "peer-context-replaced", subject: newId } : { kind: "peer-context-replaced", subject: newId, oldSubject: id });
       },
       setTarball(inputs, payload) {
         const key = toTarballKey(inputs);
@@ -751,8 +772,6 @@ function overrideParentRefDropped(pkg, to) {
     message: `override ${pkg}=${to}: npm $name self-ref has no yarn/pnpm equivalent; emitted verbatim`
   };
 }
-
-// src/main/ts/recipe/resolution.ts
 var HEX40_RE = /^[0-9a-f]{40}$/i;
 var SHA_FRAG_RE = /^[0-9a-f]{7,64}$/i;
 var GITHUB_HOST = "github.com";
@@ -938,6 +957,36 @@ function normaliseDirectoryPath(raw) {
   if (p === "./") return ".";
   return p;
 }
+var REGISTRY_HOSTS = /* @__PURE__ */ new Set([
+  "registry.npmjs.org",
+  "registry.yarnpkg.com"
+]);
+function hostOfTarballUrl(url) {
+  if (!url.startsWith("http://") && !url.startsWith("https://")) return void 0;
+  const noScheme = url.replace(/^https?:\/\//, "");
+  const host = noScheme.split("/")[0];
+  return host === void 0 || host.length === 0 ? void 0 : host;
+}
+function sourceDiscriminatorOf(resolution) {
+  const sourceString = canonicalSourceStringOf(resolution);
+  return sourceString === void 0 ? void 0 : sha256Prefix16(sourceString);
+}
+function canonicalSourceStringOf(resolution) {
+  switch (resolution.type) {
+    case "git":
+      return `git\0${resolution.url}\0${resolution.sha}`;
+    case "tarball": {
+      const host = hostOfTarballUrl(resolution.url);
+      return host !== void 0 && REGISTRY_HOSTS.has(host) ? void 0 : `tarball\0${host ?? resolution.url}`;
+    }
+    case "directory":
+    case "unknown":
+      return void 0;
+  }
+}
+function sha256Prefix16(input) {
+  return createHash("sha256").update(input, "utf8").digest("hex").slice(0, 16);
+}
 function stringifyForNpm(can) {
   switch (can.type) {
     case "tarball":
@@ -1268,19 +1317,22 @@ function parseFamily(input, _options, config) {
     if (version === void 0) {
       throw parseFailed(config, `entry ${JSON.stringify(path)} missing version`);
     }
-    const id = `${tailName}@${version}`;
+    const source = sourceDiscriminatorOfNpmEntry(entry);
+    const id = serializeNodeId(tailName, version, [], void 0, source);
     pathToId.set(path, id);
     const existing = idToEntry.get(id);
     if (existing === void 0) {
       idToEntry.set(id, entry);
-      builder.addNode({
+      const node = {
         id,
         name: tailName,
         version,
         peerContext: []
-      });
+      };
+      if (source !== void 0) node.source = source;
+      builder.addNode(node);
       if (entry.integrity !== void 0 || hasTarballPayload(entry)) {
-        builder.setTarball({ name: tailName, version }, tarballPayloadOf(entry, id, diagnostics));
+        builder.setTarball({ name: tailName, version, source }, tarballPayloadOf(entry, id, diagnostics));
       }
     }
   }
@@ -1530,7 +1582,7 @@ function optimizeFamily(graph, config, _options = {}) {
     (a, b) => cmpStr2(`${a.src} ${a.kind} ${a.dst}`, `${b.src} ${b.kind} ${b.dst}`)
   );
   for (const node of graph.nodes()) {
-    const inputs = { name: node.name, version: node.version, patch: node.patch };
+    const inputs = { name: node.name, version: node.version, patch: node.patch, source: node.source };
     const key = toTarballKey(inputs);
     if (unreachable.has(node.id)) {
       tarballsToRemove.set(key, inputs);
@@ -1639,6 +1691,10 @@ function nameFromInstallPath(config, path, entry) {
 function hasTarballPayload(entry) {
   return entry.integrity !== void 0 || entry.engines !== void 0 || entry.funding !== void 0 || entry.license !== void 0 || entry.bin !== void 0 || entry.deprecated !== void 0 || entry.cpu !== void 0 || entry.os !== void 0 || entry.libc !== void 0 || entry.resolved !== void 0;
 }
+function sourceDiscriminatorOfNpmEntry(entry) {
+  if (typeof entry.resolved !== "string" || entry.link) return void 0;
+  return sourceDiscriminatorOf(parse(entry.resolved, { sourceKind: "npm-resolved" }));
+}
 function tarballPayloadOf(entry, subject, diagnostics) {
   const payload = {};
   if (entry.integrity !== void 0) {

package/dist/formats/npm-3.d.ts

@@ -1,5 +1,5 @@
-import { G as Graph, D as Diagnostic } from '../graph-hx9HLuBV.js';
-import { N as NpmFamilyEnrichOptions, a as NpmFamilyOptimizeOptions, b as NpmFamilyParseOptions, c as NpmFamilyStringifyOptions } from '../_npm-flat-types-DnyApcb5.js';
+import { G as Graph, D as Diagnostic } from '../graph-B_G4OKqF.js';
+import { N as NpmFamilyEnrichOptions, a as NpmFamilyOptimizeOptions, b as NpmFamilyParseOptions, c as NpmFamilyStringifyOptions } from '../_npm-flat-types-C6TSaidU.js';
 
 interface Npm3ParseOptions extends NpmFamilyParseOptions {
 }