@vltpkg/graph 1.0.0-rc.29 → 1.0.0-rc.30

package/dist/actual/load.js

@@ -180,7 +180,10 @@ const parseDir = (options, scurry, packageJson, depsFound, graph, fromNode, curr
             const depType = shorten(type, alias, fromNode.manifest);
             let spec = Spec.parse(alias, bareSpec, {
                 ...options,
-                registry: fromNode.registry,
+                // fall back to options.registry (which the lockfile merges into)
+                // so importer-level edges don't silently revert to the default
+                // npm registry. see vltpkg/vltpkg#1580.
+                registry: fromNode.registry ?? options.registry,
             });
             // Check for active modifiers and replace spec if a modifier is complete
             const { spec: modifiedSpec, queryModifier } = maybeApplyModifierToSpec(spec, alias, modifierRefs);
@@ -239,7 +242,7 @@ const parseDir = (options, scurry, packageJson, depsFound, graph, fromNode, curr
             const depType = shorten(type, name, fromNode.manifest);
             let spec = Spec.parse(name, bareSpec, {
                 ...options,
-                registry: fromNode.registry,
+                registry: fromNode.registry ?? options.registry,
             });
             // Check for active modifiers and replace spec for missing dependencies
             const { spec: modifiedSpec, queryModifier } = maybeApplyModifierToSpec(spec, name, modifierRefs);

package/dist/install.js

@@ -165,8 +165,13 @@ export const install = async (options, add) => {
         });
         // If lockfileOnly is enabled, skip reify and only save the lockfile
         if (options.lockfileOnly) {
-            // Save only the main lockfile, skip all filesystem operations
-            lockfile.save({ graph, modifiers });
+            // Save only the main lockfile, skip all filesystem operations.
+            // Spread `options` so that spec-level config (registry,
+            // scoped-registries, git-hosts, catalogs, etc.) round-trips
+            // through the lockfile - otherwise subsequent installs lose
+            // the configured registry and rewrite node/edge DepIDs back
+            // to the default npm registry. (See vltpkg/vltpkg#1580.)
+            lockfile.save({ ...options, graph, modifiers });
             const saveImportersPackageJson = 
             /* c8 ignore next */
             add?.modifiedDependencies || remove.modifiedDependencies ?

package/dist/lockfile/load-edges.js

@@ -78,11 +78,14 @@ export const loadEdges = (graph, edges, options) => {
                 toNode = graph.nodes.get(asDepID(toId));
             }
         }
-        // Parse spec once we know the nodes are valid
-        const spec = Spec.parse(specName, valRest.substring(0, vrSplit), {
-            ...options,
-            registry: fromNode.registry,
-        });
+        // Use the merged options directly — they already carry the
+        // correct registry from the lockfile's `options` + caller config.
+        // `fromNode.registry` is not populated yet at this point (the
+        // post-load hydration loop in load.ts sets it *after* edges are
+        // loaded), so overriding here would always inject `undefined`
+        // and silently revert to the default npm registry.
+        // See vltpkg/vltpkg#1580.
+        const spec = Spec.parse(specName, valRest.substring(0, vrSplit), options);
         if (useOptimizations) {
             edgeProcessingQueue.push({
                 fromNode,

package/dist/uninstall.js

@@ -34,8 +34,11 @@ export const uninstall = async (options, remove) => {
         });
         // If lockfileOnly is enabled, skip reify and only save the lockfile
         if (options.lockfileOnly) {
-            // Save only the main lockfile, skip all filesystem operations
-            lockfile.save({ graph, modifiers });
+            // Save only the main lockfile, skip all filesystem operations.
+            // Spread `options` so that spec-level config (registry,
+            // scoped-registries, git-hosts, catalogs, etc.) round-trips
+            // through the lockfile. See vltpkg/vltpkg#1580.
+            lockfile.save({ ...options, graph, modifiers });
             const saveImportersPackageJson = 
             /* c8 ignore next */
             remove?.modifiedDependencies ?

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.0.0-rc.29",
+  "version": "1.0.0-rc.30",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.0.0-rc.29",
-    "@vltpkg/dep-id": "1.0.0-rc.29",
-    "@vltpkg/dss-breadcrumb": "1.0.0-rc.29",
-    "@vltpkg/error-cause": "1.0.0-rc.29",
-    "@vltpkg/fast-split": "1.0.0-rc.29",
-    "@vltpkg/graph-run": "1.0.0-rc.29",
-    "@vltpkg/init": "1.0.0-rc.29",
-    "@vltpkg/output": "1.0.0-rc.29",
-    "@vltpkg/package-info": "1.0.0-rc.29",
-    "@vltpkg/package-json": "1.0.0-rc.29",
-    "@vltpkg/pick-manifest": "1.0.0-rc.29",
-    "@vltpkg/query": "1.0.0-rc.29",
-    "@vltpkg/rollback-remove": "1.0.0-rc.29",
-    "@vltpkg/run": "1.0.0-rc.29",
-    "@vltpkg/satisfies": "1.0.0-rc.29",
-    "@vltpkg/security-archive": "1.0.0-rc.29",
-    "@vltpkg/spec": "1.0.0-rc.29",
-    "@vltpkg/types": "1.0.0-rc.29",
-    "@vltpkg/vlt-json": "1.0.0-rc.29",
-    "@vltpkg/workspaces": "1.0.0-rc.29",
+    "@vltpkg/cmd-shim": "1.0.0-rc.30",
+    "@vltpkg/dep-id": "1.0.0-rc.30",
+    "@vltpkg/dss-breadcrumb": "1.0.0-rc.30",
+    "@vltpkg/error-cause": "1.0.0-rc.30",
+    "@vltpkg/fast-split": "1.0.0-rc.30",
+    "@vltpkg/graph-run": "1.0.0-rc.30",
+    "@vltpkg/init": "1.0.0-rc.30",
+    "@vltpkg/output": "1.0.0-rc.30",
+    "@vltpkg/package-info": "1.0.0-rc.30",
+    "@vltpkg/package-json": "1.0.0-rc.30",
+    "@vltpkg/pick-manifest": "1.0.0-rc.30",
+    "@vltpkg/query": "1.0.0-rc.30",
+    "@vltpkg/rollback-remove": "1.0.0-rc.30",
+    "@vltpkg/run": "1.0.0-rc.30",
+    "@vltpkg/satisfies": "1.0.0-rc.30",
+    "@vltpkg/security-archive": "1.0.0-rc.30",
+    "@vltpkg/spec": "1.0.0-rc.30",
+    "@vltpkg/types": "1.0.0-rc.30",
+    "@vltpkg/vlt-json": "1.0.0-rc.30",
+    "@vltpkg/workspaces": "1.0.0-rc.30",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },