@vltpkg/cli-js 1.0.0-rc.24 → 1.0.0-rc.26

package/{bugs-DIPRXK73.js → bugs-5UZKBRJ6.js}

@@ -14,36 +14,36 @@ import {
 } from "./chunk-AZLX27EM.js";
 import {
   createHostContextsMap
-} from "./chunk-WEU2II6J.js";
+} from "./chunk-ORGRCZV6.js";
 import {
   Query,
   actual
-} from "./chunk-EHD7YJKI.js";
+} from "./chunk-D3UYPLBW.js";
 import {
   SecurityArchive
-} from "./chunk-K4X2TU3S.js";
-import "./chunk-VVTZN4QQ.js";
+} from "./chunk-BRSCRAUI.js";
+import "./chunk-QI6PGM7S.js";
 import {
   commandUsage
 } from "./chunk-5E5GX4G6.js";
 import {
   PackageInfoClient
-} from "./chunk-QFA4L7SI.js";
+} from "./chunk-KSOWJE5Z.js";
 import "./chunk-FI5TUER7.js";
-import "./chunk-XBN4TEBD.js";
+import "./chunk-CEEMJNRZ.js";
 import {
   urlOpen
 } from "./chunk-D7U7KDEM.js";
-import "./chunk-Z76BQOEV.js";
+import "./chunk-R3KDJL6J.js";
 import "./chunk-BGQCUUCA.js";
 import "./chunk-E74WGW5C.js";
 import {
   Spec2 as Spec
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-45PZMAKV.js";
 import "./chunk-VCSVHRCS.js";
 import "./chunk-D27QPHKI.js";
 import "./chunk-JLJKOF75.js";
-import "./chunk-KXBF4HVG.js";
+import "./chunk-HIGHMXU7.js";
 import "./chunk-HTOTG4TS.js";
 import "./chunk-XNLSTHDK.js";
 import {

package/{build-R53AIRYP.js → build-HHRMIGWX.js}

@@ -11,22 +11,22 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   build
-} from "./chunk-EHD7YJKI.js";
-import "./chunk-K4X2TU3S.js";
-import "./chunk-VVTZN4QQ.js";
+} from "./chunk-D3UYPLBW.js";
+import "./chunk-BRSCRAUI.js";
+import "./chunk-QI6PGM7S.js";
 import {
   commandUsage
 } from "./chunk-5E5GX4G6.js";
-import "./chunk-Z76BQOEV.js";
+import "./chunk-R3KDJL6J.js";
 import "./chunk-BGQCUUCA.js";
 import "./chunk-E74WGW5C.js";
-import "./chunk-FEV5BCW7.js";
+import "./chunk-45PZMAKV.js";
 import "./chunk-VCSVHRCS.js";
 import "./chunk-D27QPHKI.js";
 import "./chunk-JLJKOF75.js";
 import {
   isErrorWithCause
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-HIGHMXU7.js";
 import "./chunk-HTOTG4TS.js";
 import "./chunk-XNLSTHDK.js";
 import {

package/{cache-PFWAIDXW.js → cache-S7AIJNAW.js}

@@ -15,29 +15,29 @@ import {
 import {
   stderr,
   stdout
-} from "./chunk-56TWRLHO.js";
+} from "./chunk-LCUNWXND.js";
 import "./chunk-TDTJOKF2.js";
 import {
   ViewClass
 } from "./chunk-RXNA2XCX.js";
 import "./chunk-WGDTG44V.js";
-import "./chunk-5WHVV7CQ.js";
+import "./chunk-5TAPASMO.js";
 import {
   commandUsage
 } from "./chunk-5E5GX4G6.js";
 import {
   CacheEntry
-} from "./chunk-XBN4TEBD.js";
+} from "./chunk-CEEMJNRZ.js";
 import "./chunk-D7U7KDEM.js";
 import "./chunk-BGQCUUCA.js";
 import "./chunk-E74WGW5C.js";
 import {
   Spec2 as Spec
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-45PZMAKV.js";
 import "./chunk-VCSVHRCS.js";
 import "./chunk-D27QPHKI.js";
 import "./chunk-JLJKOF75.js";
-import "./chunk-KXBF4HVG.js";
+import "./chunk-HIGHMXU7.js";
 import "./chunk-XNLSTHDK.js";
 import {
   error

package/{chunk-M562AXMZ.js → chunk-3PCMZMV5.js}

@@ -23,7 +23,7 @@ import {
 } from "./chunk-JLJKOF75.js";
 import {
   asError
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-HIGHMXU7.js";
 import {
   __commonJS,
   __export,

package/{chunk-PQJO2HPJ.js → chunk-3T3M5JJF.js}

@@ -12,19 +12,19 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   findCmdShimIfExists,
   install
-} from "./chunk-EHD7YJKI.js";
+} from "./chunk-D3UYPLBW.js";
 import {
   PackageInfoClient
-} from "./chunk-QFA4L7SI.js";
+} from "./chunk-KSOWJE5Z.js";
 import {
   PathScurry
-} from "./chunk-Z76BQOEV.js";
+} from "./chunk-R3KDJL6J.js";
 import {
   Spec2 as Spec
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-45PZMAKV.js";
 import {
   parseScope
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-HIGHMXU7.js";
 import {
   walkUp
 } from "./chunk-HTOTG4TS.js";

package/{chunk-FEV5BCW7.js → chunk-45PZMAKV.js}

@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   parseRange
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-HIGHMXU7.js";
 import {
   error,
   typeError

package/{chunk-5WHVV7CQ.js → chunk-5TAPASMO.js}

@@ -12,7 +12,7 @@ var require = _vlt_createRequire(import.meta.filename);
 import {
   isError,
   isObject
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-HIGHMXU7.js";
 
 // ../../src/output/src/error.ts
 var parseError = (err) => {

package/{chunk-K4X2TU3S.js → chunk-BRSCRAUI.js}

@@ -16,7 +16,7 @@ import {
   asDepID,
   baseDepID,
   splitDepID
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-45PZMAKV.js";
 import {
   L
 } from "./chunk-VCSVHRCS.js";
@@ -29,6 +29,7 @@ import {
 
 // ../../src/security-archive/src/index.ts
 import { DatabaseSync } from "node:sqlite";
+import { spawn } from "node:child_process";
 import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 
@@ -165,7 +166,7 @@ async function onAttemptFailure({ error: error2, attemptNumber, retriesConsumed,
   const finalDelay = Math.min(delayTime, remainingTime);
   options.signal?.throwIfAborted();
   if (finalDelay > 0) {
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve2, reject) => {
       const onAbort = () => {
         clearTimeout(timeoutToken);
         options.signal?.removeEventListener("abort", onAbort);
@@ -173,7 +174,7 @@ async function onAttemptFailure({ error: error2, attemptNumber, retriesConsumed,
       };
       const timeoutToken = setTimeout(() => {
         options.signal?.removeEventListener("abort", onAbort);
-        resolve();
+        resolve2();
       }, finalDelay);
       if (options.unref) {
         timeoutToken.unref?.();
@@ -242,6 +243,10 @@ var asPackageReportData = (o) => {
   return o;
 };
 
+// ../../src/security-archive/src/update-expired.ts
+import { resolve } from "node:path";
+var __CODE_SPLIT_SCRIPT_NAME = resolve(import.meta.dirname, "security-archive-src-update-expired.js");
+
 // ../../src/security-archive/src/index.ts
 var SOCKET_API_V0_URL = "https://api.socket.dev/v0/purl?alerts=true";
 var SOCKET_PUBLIC_API_TOKEN = "sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api";
@@ -262,7 +267,6 @@ var { version } = loadPackageJson(
 );
 var SecurityArchive = class _SecurityArchive extends L {
   #expired = /* @__PURE__ */ new Set();
-  #pUpdateExpired;
   #path;
   #retries;
   #nodesByName = /* @__PURE__ */ new Map();
@@ -352,28 +356,53 @@ var SecurityArchive = class _SecurityArchive extends L {
         db.prepare("DELETE FROM cache WHERE depID = ?").run(depID);
       }
     }
-    this.#pUpdateExpired = this.#updateExpired(db);
+    this.#spawnUpdateExpired();
   }
   /**
-   * Updates the database with renewed entries for expired packages.
+   * Spawns a detached child process to revalidate expired entries.
+   * The process runs independently — the main process does not wait for it.
    */
-  async #updateExpired(db) {
-    const expiredQueue = /* @__PURE__ */ new Set();
+  #spawnUpdateExpired() {
+    const expired = [];
     for (const depID of this.#expired) {
       const node = this.#nodesByID.get(baseDepID(depID));
-      if (!node?.version) {
+      if (!node?.version || !node.name) {
         continue;
       }
-      const purl = `pkg:npm/${node.name}@${node.version}`;
-      expiredQueue.add({ purl });
+      expired.push({
+        depID: baseDepID(depID),
+        name: node.name,
+        version: node.version
+      });
+    }
+    if (!expired.length) {
+      return;
     }
-    if (expiredQueue.size > 0) {
-      const res = await pRetry(
-        () => this.#retrieveRemoteData(expiredQueue),
-        { retries: this.#retries }
+    const isDeno = globalThis.Deno != void 0;
+    const payload = {
+      dbPath: this.#path,
+      retries: this.#retries,
+      ttl: _SecurityArchive.defaultTtl,
+      expired
+    };
+    const args = [];
+    const detached = !(isDeno && process.platform === "win32");
+    if (isDeno) {
+      args.push(
+        "--unstable-node-globals",
+        "--unstable-bare-node-builtins"
       );
-      const ids = this.#loadFromNDJSON(res);
-      this.#storeNewItemsToDatabase(db, ids);
+    }
+    args.push(__CODE_SPLIT_SCRIPT_NAME);
+    const proc = spawn(process.execPath, args, {
+      detached,
+      stdio: ["pipe", "ignore", "ignore"],
+      env: { ...process.env }
+    });
+    proc.stdin.write(JSON.stringify(payload));
+    proc.stdin.end();
+    if (detached) {
+      proc.unref();
     }
   }
   /**
@@ -528,18 +557,16 @@ var SecurityArchive = class _SecurityArchive extends L {
       }
       this.#validateReportData();
     } finally {
-      void this.#close(db);
+      this.#close(db);
     }
   }
   /**
    * Closes the database connection and cleans up the internal state.
    */
-  async #close(db) {
-    await this.#pUpdateExpired;
+  #close(db) {
     db.exec("PRAGMA optimize");
     db.close();
     this.#expired.clear();
-    this.#pUpdateExpired = void 0;
   }
   /**
    * Outputs the current in-memory cache as a JSON object.

package/{chunk-XBN4TEBD.js → chunk-CEEMJNRZ.js}

@@ -26,7 +26,7 @@ import {
 } from "./chunk-JLJKOF75.js";
 import {
   asError
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-HIGHMXU7.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";

package/{chunk-QRBXNJDL.js → chunk-CY225LQK.js}

@@ -11,7 +11,7 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   init
-} from "./chunk-VVTZN4QQ.js";
+} from "./chunk-QI6PGM7S.js";
 import {
   commandUsage
 } from "./chunk-5E5GX4G6.js";
@@ -19,7 +19,7 @@ import {
   asWSConfig,
   assertWSConfig,
   minimatch
-} from "./chunk-Z76BQOEV.js";
+} from "./chunk-R3KDJL6J.js";
 import {
   load,
   save

package/{chunk-EHD7YJKI.js → chunk-D3UYPLBW.js}

@@ -13,16 +13,16 @@ import {
   AbortError,
   SecurityArchive,
   pRetry
-} from "./chunk-K4X2TU3S.js";
+} from "./chunk-BRSCRAUI.js";
 import {
   init
-} from "./chunk-VVTZN4QQ.js";
+} from "./chunk-QI6PGM7S.js";
 import {
   Monorepo,
   PackageJson,
   minimatch,
   platformCheck
-} from "./chunk-Z76BQOEV.js";
+} from "./chunk-R3KDJL6J.js";
 import {
   rimraf
 } from "./chunk-BGQCUUCA.js";
@@ -49,7 +49,7 @@ import {
   joinExtra,
   splitDepID,
   splitExtra
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-45PZMAKV.js";
 import {
   promiseSpawn
 } from "./chunk-VCSVHRCS.js";
@@ -84,7 +84,7 @@ import {
   patch,
   satisfies,
   shortDependencyTypes
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-HIGHMXU7.js";
 import {
   load,
   walkUp
@@ -5376,7 +5376,7 @@ var exec = async (options) => {
       {
         ...process.env,
         ...env2,
-        FORCE_COLOR: color ? "1" : "0"
+        FORCE_COLOR: color && process.stdout.isTTY ? "1" : "0"
       },
       arg0
     ),
@@ -7865,6 +7865,8 @@ var has = async (state) => {
           edges: new Set(state.partial.edges),
           nodes: new Set(state.partial.nodes)
         },
+        diffFiles: state.diffFiles,
+        loose: state.loose,
         hostContexts: state.hostContexts,
         importers: state.importers,
         retries: state.retries,
@@ -7924,6 +7926,7 @@ var is = async (state) => {
           nodes: /* @__PURE__ */ new Set()
         },
         current: node,
+        diffFiles: state.diffFiles,
         initial: state.initial,
         loose: true,
         partial: {
@@ -7964,7 +7967,9 @@ var not = async (state) => {
           nodes: /* @__PURE__ */ new Set()
         },
         current: node,
+        diffFiles: state.diffFiles,
         initial: state.initial,
+        loose: state.loose,
         partial: {
           nodes: new Set(state.partial.nodes),
           edges: new Set(state.partial.edges)
@@ -9163,6 +9168,13 @@ var Graph = class {
       toFoundNode.detached = false;
       toFoundNode.dev &&= flags.dev;
       toFoundNode.optional &&= flags.optional;
+      if (manifest) {
+        if (!toFoundNode.manifest) {
+          toFoundNode.manifest = manifest;
+          this.manifests.set(toFoundNode.id, manifest);
+        }
+        toFoundNode.integrity ??= manifest.dist?.integrity;
+      }
       return toFoundNode;
     }
     const toNode = this.addNode(depId, manifest, spec2);

package/{chunk-267FYLJB.js → chunk-GM7VNI3N.js}

@@ -17,7 +17,7 @@ var run = async (command) => {
   if (command) {
     process.argv.splice(2, 0, command);
   }
-  const vlt = await import("./src-MQ7RJS5V.js");
+  const vlt = await import("./src-BTES32CE.js");
   await vlt.default();
 };
 

package/{chunk-KXBF4HVG.js → chunk-HIGHMXU7.js}

@@ -1001,22 +1001,27 @@ var parsePerson = (person, writeAccess, isPublisher) => {
     }
     const name = typeof person.name === "string" ? person.name : void 0;
     const email = typeof person.email === "string" ? person.email : typeof person.mail === "string" ? person.mail : void 0;
-    if (!name && !email) return void 0;
+    const url = typeof person.url === "string" ? person.url : void 0;
+    if (!name && !email && !url) return void 0;
     return {
       name,
       email,
+      ...url ? { url } : {},
       [kWriteAccess]: writeAccess ?? false,
       [kIsPublisher]: isPublisher ?? false
     };
   } else if (typeof person === "string") {
     const NAME_PATTERN = /^([^(<]+)/;
     const EMAIL_PATTERN = /<([^<>]+)>/;
+    const URL_PATTERN = /\(([^()]+)\)/;
     const name = NAME_PATTERN.exec(person)?.[0].trim() || "";
     const email = EMAIL_PATTERN.exec(person)?.[1] || "";
-    if (!name && !email) return void 0;
+    const url = URL_PATTERN.exec(person)?.[1] || "";
+    if (!name && !email && !url) return void 0;
     return {
       name: name || void 0,
       email: email || void 0,
+      ...url ? { url } : {},
       [kWriteAccess]: writeAccess ?? false,
       [kIsPublisher]: isPublisher ?? false
     };
@@ -1024,7 +1029,7 @@ var parsePerson = (person, writeAccess, isPublisher) => {
   return;
 };
 var isNormalizedContributorEntry = (o) => {
-  return isObject(o) && typeof o.name === "string" && !!o.name && typeof o.email === "string" && !!o.email && (isBoolean(o[kWriteAccess]) || isBoolean(o.writeAccess)) && (isBoolean(o[kIsPublisher]) || isBoolean(o.isPublisher));
+  return isObject(o) && (typeof o.name === "string" || typeof o.email === "string" || typeof o.url === "string") && (typeof o.name === "undefined" || typeof o.name === "string" && !!o.name) && (typeof o.email === "undefined" || typeof o.email === "string" && !!o.email) && (typeof o.url === "undefined" || typeof o.url === "string" && !!o.url) && (isBoolean(o[kWriteAccess]) || isBoolean(o.writeAccess)) && (isBoolean(o[kIsPublisher]) || isBoolean(o.isPublisher));
 };
 var isNormalizedContributors = (o) => {
   return Array.isArray(o) && o.length > 0 && o.every(isNormalizedContributorEntry);

package/chunk-J5OZBIY5.js

@@ -0,0 +1,68 @@
+var global = globalThis;
+import {Buffer} from "node:buffer";
+import {setTimeout as _vlt_setTimeout,clearTimeout as _vlt_clearTimeout,setImmediate as _vlt_setImmediate,clearImmediate as _vlt_clearImmediate,setInterval as _vlt_setInterval,clearInterval as _vlt_clearInterval} from "node:timers";
+globalThis.setTimeout = _vlt_setTimeout;
+globalThis.clearTimeout = _vlt_clearTimeout;
+globalThis.setImmediate = _vlt_setImmediate;
+globalThis.clearImmediate = _vlt_clearImmediate;
+globalThis.setInterval = _vlt_setInterval;
+globalThis.clearInterval = _vlt_clearInterval;
+import {createRequire as _vlt_createRequire} from "node:module";
+var require = _vlt_createRequire(import.meta.filename);
+import {
+  error
+} from "./chunk-WZWDS3W4.js";
+import {
+  __glob
+} from "./chunk-PZLD7RTK.js";
+
+// import("./commands/**/*.ts") in ../../src/cli-sdk/src/load-command.ts
+var globImport_commands_ts = __glob({
+  "./commands/bugs.ts": () => import("./bugs-5UZKBRJ6.js"),
+  "./commands/build.ts": () => import("./build-HHRMIGWX.js"),
+  "./commands/cache.ts": () => import("./cache-S7AIJNAW.js"),
+  "./commands/ci.ts": () => import("./ci-2U44K5HH.js"),
+  "./commands/config.ts": () => import("./config-J7A3MQFH.js"),
+  "./commands/create.ts": () => import("./create-QORFVTHP.js"),
+  "./commands/docs.ts": () => import("./docs-5X4WDWUP.js"),
+  "./commands/exec-cache.ts": () => import("./exec-cache-A6CMJUZ7.js"),
+  "./commands/exec-local.ts": () => import("./exec-local-TYAKTIYJ.js"),
+  "./commands/exec.ts": () => import("./exec-YMICUMJA.js"),
+  "./commands/help.ts": () => import("./help-OKCOEMB3.js"),
+  "./commands/init.ts": () => import("./init-VC6AG2UU.js"),
+  "./commands/install.ts": () => import("./install-P5AO6772.js"),
+  "./commands/install/reporter.ts": () => import("./reporter-WBQK75RI.js"),
+  "./commands/list.ts": () => import("./list-CIK732ED.js"),
+  "./commands/login.ts": () => import("./login-R3B4H2I2.js"),
+  "./commands/logout.ts": () => import("./logout-YUUXIVUO.js"),
+  "./commands/pack.ts": () => import("./pack-QEI3LPIQ.js"),
+  "./commands/ping.ts": () => import("./ping-QSR64W6S.js"),
+  "./commands/pkg.ts": () => import("./pkg-CNGHBNXD.js"),
+  "./commands/publish.ts": () => import("./publish-5N6MWW6E.js"),
+  "./commands/query.ts": () => import("./query-MIH452QT.js"),
+  "./commands/repo.ts": () => import("./repo-I7XLLP24.js"),
+  "./commands/run-exec.ts": () => import("./run-exec-ZJSAJPME.js"),
+  "./commands/run.ts": () => import("./run-NUQ63SUS.js"),
+  "./commands/token.ts": () => import("./token-JOS6MHEW.js"),
+  "./commands/uninstall.ts": () => import("./uninstall-A6XPKFIM.js"),
+  "./commands/update.ts": () => import("./update-FOBAWWTD.js"),
+  "./commands/version.ts": () => import("./version-AZK2MPTV.js"),
+  "./commands/view.ts": () => import("./view-PMXWE6QG.js"),
+  "./commands/whoami.ts": () => import("./whoami-OLZU4KG7.js")
+});
+
+// ../../src/cli-sdk/src/load-command.ts
+var loadCommand = async (command) => {
+  try {
+    return await globImport_commands_ts(`./commands/${command}.ts`);
+  } catch (e) {
+    throw error("Could not load command", {
+      found: command,
+      cause: e
+    });
+  }
+};
+
+export {
+  loadCommand
+};

package/{chunk-K6X4DF6U.js → chunk-JXGBASMB.js}

@@ -11,11 +11,11 @@ import {createRequire as _vlt_createRequire} from "node:module";
 var require = _vlt_createRequire(import.meta.filename);
 import {
   asDependency
-} from "./chunk-EHD7YJKI.js";
+} from "./chunk-D3UYPLBW.js";
 import {
   Spec2 as Spec,
   joinDepIDTuple
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-45PZMAKV.js";
 
 // ../../src/cli-sdk/src/parse-add-remove-args.ts
 var rootDepID = joinDepIDTuple(["file", "."]);

package/{chunk-QFA4L7SI.js → chunk-KSOWJE5Z.js}

@@ -15,7 +15,7 @@ import {
 } from "./chunk-FI5TUER7.js";
 import {
   RegistryClient
-} from "./chunk-XBN4TEBD.js";
+} from "./chunk-CEEMJNRZ.js";
 import {
   Monorepo,
   PackageJson,
@@ -23,18 +23,18 @@ import {
   pickManifest,
   resolve,
   revs
-} from "./chunk-Z76BQOEV.js";
+} from "./chunk-R3KDJL6J.js";
 import {
   rimraf
 } from "./chunk-BGQCUUCA.js";
 import {
   Spec2 as Spec
-} from "./chunk-FEV5BCW7.js";
+} from "./chunk-45PZMAKV.js";
 import {
   asError,
   asPackument,
   isIntegrity
-} from "./chunk-KXBF4HVG.js";
+} from "./chunk-HIGHMXU7.js";
 import {
   XDG
 } from "./chunk-XNLSTHDK.js";
@@ -783,7 +783,7 @@ var Pool = class {
 
 // ../../src/package-info/src/index.ts
 var import_ssri = __toESM(require_lib(), 1);
-import { randomBytes as randomBytes2 } from "node:crypto";
+import { createHash, randomBytes as randomBytes2 } from "node:crypto";
 import {
   mkdir as mkdir2,
   readFile,
@@ -869,7 +869,8 @@ var PackageInfoClient = class {
       spec = Spec.parse(spec, this.options);
     const { from = this.#projectRoot, integrity, resolved } = options;
     const f = spec.final;
-    const r = integrity && resolved ? { resolved, integrity, spec } : await this.resolve(spec, options);
+    const fromLockfile = !!(integrity && resolved);
+    const r = fromLockfile ? { resolved, integrity, spec } : await this.resolve(spec, options);
     switch (f.type) {
       case "git": {
         const {
@@ -925,8 +926,23 @@ var PackageInfoClient = class {
         if (!trustIntegrity && response.checkIntegrity({ spec, url: resolved })) {
           this.#trustedIntegrities.set(r.resolved, response.integrity);
         }
+        const buf = response.buffer();
+        if (r.integrity && !fromLockfile) {
+          const hash = createHash("sha512");
+          hash.update(buf);
+          const computed = `sha512-${hash.digest("base64")}`;
+          if (computed !== r.integrity) {
+            throw error("Tarball integrity check failed", {
+              code: "EINTEGRITY",
+              spec,
+              url: r.resolved,
+              wanted: r.integrity,
+              found: computed
+            });
+          }
+        }
         try {
-          await this.tarPool.unpack(response.buffer(), target);
+          await this.tarPool.unpack(buf, target);
         } catch (er) {
           throw this.#resolveError(
             spec,
@@ -1139,7 +1155,22 @@ var PackageInfoClient = class {
         if (!trustIntegrity && response.checkIntegrity({ spec, url: tarball })) {
           this.#trustedIntegrities.set(tarball, response.integrity);
         }
-        return response.buffer();
+        const buf = response.buffer();
+        if (integrity) {
+          const hash = createHash("sha512");
+          hash.update(buf);
+          const computed = `sha512-${hash.digest("base64")}`;
+          if (computed !== integrity) {
+            throw error("Tarball integrity check failed", {
+              code: "EINTEGRITY",
+              spec,
+              url: tarball,
+              wanted: integrity,
+              found: computed
+            });
+          }
+        }
+        return buf;
       }
       case "git": {
         const {