@vltpkg/graph 1.0.7 → 1.0.9

package/dist/install.js

@@ -10,6 +10,7 @@ import { RollbackRemove } from '@vltpkg/rollback-remove';
 import { existsSync, rmSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { load as loadVirtual, loadData } from "./lockfile/load.js";
+import { formatOptionsChange } from "./lockfile/format-options-change.js";
 import { getImporterSpecs } from "./ideal/get-importer-specs.js";
 import { lockfile } from "./index.js";
 import { updatePackageJson } from "./reify/update-importers-package-json.js";
@@ -52,6 +53,10 @@ export const install = async (options, add) => {
     });
     const specCache = new Map();
     const lockfileData = options.frozenLockfile ? loadData(options.projectRoot) : undefined;
+    // loaded before the frozen check so that the lockfile options compare
+    // against a config that includes them, and so that the check knows
+    // which dependency specs the modifiers govern
+    const modifiers = GraphModifier.maybeLoad(options);
     if (options.frozenLockfile) {
         // validates no add/remove operations are requested
         if (add?.modifiedDependencies) {
@@ -66,6 +71,7 @@ export const install = async (options, add) => {
         const lockfileGraph = loadVirtual({
             ...options,
             mainManifest,
+            modifiers,
             monorepo: fullMonorepo,
             specCache,
             lockfileData,
@@ -79,12 +85,17 @@ export const install = async (options, add) => {
             add: emptyAdd,
             remove: emptyRemove,
             ...options,
+            modifiers,
         });
         // Check for spec changes by comparing package.json specs with lockfile edges
         const specChanges = [];
         for (const importer of lockfileGraph.importers) {
             const deps = getDependencies(importer, options);
             for (const [depName, dep] of deps) {
+                // the edge text of a governed dependency is the modifier value,
+                // never the manifest range; a change to it is an options change
+                if (modifiers?.targetsImporterEdge(importer, dep.spec))
+                    continue;
                 const edge = importer.edgesOut.get(depName);
                 if (edge?.spec) {
                     if (edge.spec.toString() !== dep.spec.toString()) {
@@ -102,7 +113,10 @@ export const install = async (options, add) => {
             lockfileGraph.optionsChanged) {
             const details = [];
             if (lockfileGraph.optionsChanged) {
-                details.push('  Configuration options have changed (e.g. modifiers, registries, catalogs)');
+                details.push('  Configuration options have changed:');
+                for (const change of lockfileGraph.optionsChanges) {
+                    details.push(`    ${formatOptionsChange(change)}`);
+                }
             }
             if (specChanges.length > 0) {
                 details.push(...specChanges);
@@ -146,7 +160,6 @@ export const install = async (options, add) => {
         const remove = Object.assign(new Map(), {
             modifiedDependencies: false,
         });
-        const modifiers = GraphModifier.maybeLoad(options);
         let act = actualLoad({
             ...options,
             mainManifest,
@@ -182,7 +195,8 @@ export const install = async (options, add) => {
             // through the lockfile - otherwise subsequent installs lose
             // the configured registry and rewrite node/edge DepIDs back
             // to the default npm registry. (See vltpkg/vltpkg#1580.)
-            lockfile.save({ ...options, graph, modifiers });
+            // normalise importer edge specs before saving, so the lockfile
+            // carries the same value package.json gets
             const saveImportersPackageJson = 
             /* c8 ignore next */
             add?.modifiedDependencies || remove.modifiedDependencies ?
@@ -193,7 +207,12 @@ export const install = async (options, add) => {
                     remove,
                 })
                 : undefined;
+            lockfile.save({ ...options, graph, modifiers });
             saveImportersPackageJson?.();
+            // nothing is extracted or moved on this path, so nothing should be
+            // parked; confirm anyway so an early return can never leave
+            // `.VLT.DELETE.*` behind
+            remover.confirm();
             return { graph, diff: undefined };
         }
         const { diff, buildQueue } = await reify({

package/dist/lockfile/format-options-change.d.ts

@@ -0,0 +1,5 @@
+import type { OptionsChange } from './types.ts';
+/**
+ * Renders an {@link OptionsChange} as a single diagnostic line.
+ */
+export declare const formatOptionsChange: ({ section, key, from, to, }: OptionsChange) => string;

package/dist/lockfile/format-options-change.js

@@ -0,0 +1,20 @@
+/**
+ * Replaces the userinfo of a URL value with `***`. These messages end up
+ * in CI logs, and a registry alias can carry a token.
+ */
+const redactUserinfo = (value) => {
+    if (!URL.canParse(value))
+        return value;
+    const url = new URL(value);
+    if (!url.username && !url.password)
+        return value;
+    url.username = '';
+    url.password = '';
+    return url.href.replace('://', '://***@');
+};
+/**
+ * Renders an {@link OptionsChange} as a single diagnostic line.
+ */
+export const formatOptionsChange = ({ section, key, from, to, }) => `${section}:${key === undefined ? '' : ` ${key}`} ` +
+    (from === undefined ? '(missing)' : `"${redactUserinfo(from)}"`) +
+    ` -> ${to === undefined ? '(removed)' : `"${redactUserinfo(to)}"`}`;

package/dist/lockfile/load-nodes.js

@@ -31,9 +31,11 @@ export const loadNodes = (graph, nodes, options, actual, throwOnMissingManifest)
         }
         // Optimize registry version extraction with caching for large graphs
         let version;
+        // scoped names start with '@', so look for the version separator
+        // past the first character
         if (type === 'registry' &&
             registrySpec &&
-            registrySpec.indexOf('@') > 0) {
+            registrySpec.indexOf('@', 1) > 0) {
             if (registryVersionCache) {
                 const seenVersion = registryVersionCache.get(registrySpec);
                 /* c8 ignore start */

package/dist/lockfile/load.d.ts

@@ -4,7 +4,7 @@ import { Graph } from '../graph.ts';
 import type { PathScurry } from 'path-scurry';
 import type { NormalizedManifest } from '@vltpkg/types';
 import type { SpecOptions } from '@vltpkg/spec';
-import type { LockfileData, SpecCache } from './types.ts';
+import type { LockfileData, OptionsChange, SpecCache } from './types.ts';
 import type { GraphModifier } from '../modifiers.ts';
 export type LoadOptions = SpecOptions & {
     /**
@@ -51,4 +51,10 @@ export type LoadOptions = SpecOptions & {
 export declare const loadData: (projectRoot: string, lockfilePath?: string) => LockfileData;
 export declare const load: (options: LoadOptions) => Graph;
 export declare const loadHidden: (options: LoadOptions) => Graph;
+/**
+ * Compares the current config against the `options` block of a lockfile
+ * and returns the entries that differ. The comparison is per entry, so
+ * reordering keys in `vlt.json` is not a change.
+ */
+export declare const diffLockfileOptions: (options: LoadOptions, lockfileOptions?: LockfileData["options"]) => OptionsChange[];
 export declare const loadObject: (options: LoadOptions, lockfileData: Omit<LockfileData, "options" | "lockfileVersion"> & Partial<Pick<LockfileData, "options" | "lockfileVersion">>) => Graph;

package/dist/lockfile/load.js

@@ -37,13 +37,13 @@ const removeDefaultItems = (defaultItems, items) => {
     }
     return res;
 };
+const hasItems = (o) => !!o && Object.keys(o).length > 0;
 /**
  * Builds a normalized options object from the current runtime config
  * using the same cleaning logic as `lockfile/save.ts` so that it can
  * be compared directly against the options stored in a lockfile.
  */
 const buildCurrentOptions = (options) => {
-    const hasItems = (o) => o && Object.keys(o).length > 0;
     const cleanModifiers = (options.modifiers &&
         isRecordStringString(options.modifiers.config)) ?
         options.modifiers.config
@@ -97,6 +97,52 @@ const buildCurrentOptions = (options) => {
             : undefined),
     };
 };
+const asRecord = (o) => o;
+const unionKeys = (a = {}, b = {}) => [...new Set([...Object.keys(a), ...Object.keys(b)])].sort();
+const diffRecords = (section, from = {}, to = {}, changes, prefix) => {
+    for (const key of unionKeys(from, to)) {
+        if (from[key] !== to[key]) {
+            changes.push({
+                section,
+                key: prefix === undefined ? key : `${prefix} ${key}`,
+                from: from[key],
+                to: to[key],
+            });
+        }
+    }
+};
+/**
+ * Compares the current config against the `options` block of a lockfile
+ * and returns the entries that differ. The comparison is per entry, so
+ * reordering keys in `vlt.json` is not a change.
+ */
+export const diffLockfileOptions = (options, lockfileOptions = {}) => {
+    const current = asRecord(buildCurrentOptions(options));
+    const stored = asRecord(lockfileOptions);
+    const changes = [];
+    for (const section of unionKeys(stored, current)) {
+        const from = stored[section];
+        const to = current[section];
+        if (typeof from === 'string' || typeof to === 'string') {
+            if (from !== to) {
+                changes.push({
+                    section,
+                    from: from,
+                    to: to,
+                });
+            }
+        }
+        else if (section === 'catalogs') {
+            for (const name of unionKeys(from, to)) {
+                diffRecords(section, from?.[name], to?.[name], changes, name);
+            }
+        }
+        else {
+            diffRecords(section, from, to, changes);
+        }
+    }
+    return changes;
+};
 export const loadObject = (options, lockfileData) => {
     const version = lockfileData.lockfileVersion;
     // Lockfile version is required, likely a corrupted lockfile if missing
@@ -130,15 +176,19 @@ export const loadObject = (options, lockfileData) => {
     // Detect whether the current config options differ from those
     // stored in the lockfile.  When they do the ideal builder must
     // reset edges and rebuild the graph.
-    const currentOptions = buildCurrentOptions(options);
     /* c8 ignore next */
     const lockfileOptions = lockfileData.options ?? {};
-    const optionsChanged = JSON.stringify(currentOptions) !== JSON.stringify(lockfileOptions);
+    const optionsChanges = diffLockfileOptions(options, lockfileOptions);
     // Optimize options merging - only create new objects when needed
     const mergedOptions = {
         ...options,
-        catalog,
-        catalogs,
+        // catalog entries are indirections resolved at parse time: prefer
+        // the current config so loading a lockfile (e.g. the hidden
+        // lockfile cache) yields the same edge specs as a fresh scan of
+        // the project; fall back to the stored values so a standalone
+        // lockfile still parses when the config no longer defines them
+        catalog: hasItems(options.catalog) ? options.catalog : catalog,
+        catalogs: hasItems(options.catalogs) ? options.catalogs : catalogs,
         'scoped-registries': scopeRegistries ?
             { ...options['scoped-registries'], ...scopeRegistries }
             : options['scoped-registries'],
@@ -159,14 +209,19 @@ export const loadObject = (options, lockfileData) => {
         mainManifest,
         monorepo,
     });
-    graph.optionsChanged = optionsChanged;
+    graph.optionsChanges = optionsChanges;
+    graph.optionsChanged = optionsChanges.length > 0;
     loadNodes(graph, lockfileData.nodes, mergedOptions, options.actual, options.throwOnMissingManifest);
     // Skip interning when modifiers are active — they mutate Spec.overridden
     const specCache = options.modifiers || !options.specCache ?
         undefined
         : {
             specCache: options.specCache,
-            prefix: JSON.stringify(lockfileOptions),
+            prefix: JSON.stringify([
+                lockfileOptions,
+                mergedOptions.catalog,
+                mergedOptions.catalogs,
+            ]),
         };
     loadEdges(graph, lockfileData.edges, mergedOptions, specCache);
     // hydrate missing node-level registry data
@@ -176,5 +231,6 @@ export const loadObject = (options, lockfileData) => {
             node.registry = firstEdge.spec.registry;
         }
     }
+    graph.sortNodes();
     return graph;
 };

package/dist/lockfile/types.d.ts

@@ -25,6 +25,23 @@ export type LockfileData = {
     nodes: Record<DepID, LockfileNode>;
     edges: LockfileEdges;
 };
+/**
+ * A single difference between the config a graph was built with and the
+ * `options` block stored in the lockfile it was loaded from.
+ */
+export type OptionsChange = {
+    /** the `options` key the difference was found in, e.g. `catalog` */
+    section: string;
+    /**
+     * the entry inside that section, e.g. the catalog name. Absent for
+     * scalar sections; `<catalog> <dep>` for `catalogs`.
+     */
+    key?: string;
+    /** the value stored in the lockfile, absent when the entry is new */
+    from?: string;
+    /** the current value, absent when the entry is gone */
+    to?: string;
+};
 /**
  * Per-install intern cache for parsed lockfile specs. Shared across
  * hidden + main lockfile loads so identical (name, bareSpec) pairs

package/dist/modifiers.d.ts

@@ -116,6 +116,16 @@ export declare class GraphModifier {
      * converting the result into a GraphModifierConfigObject
      */
     get config(): GraphModifierConfigObject;
+    /**
+     * Whether a modifier governs the direct `importer -> spec.name` edge,
+     * i.e. whether its value comes from config rather than from the
+     * manifest that declares it. Only a breadcrumb whose whole scope is
+     * that edge counts, and only if its qualifier accepts the spec:
+     * `:root > #a > #b` names b but governs an edge under a, and
+     * `#b:semver(^1)` leaves a `^2` edge alone, so in both cases the
+     * root's own b edge is still the manifest's to validate and heal.
+     */
+    targetsImporterEdge(importer: Node, spec: Spec): boolean;
     /**
      * Loads the modifiers defined in `vlt.json` into memory.
      */

package/dist/modifiers.js

@@ -3,6 +3,19 @@ import { error } from '@vltpkg/error-cause';
 import { Spec } from '@vltpkg/spec';
 import { asNormalizedManifest, assertRecordStringString, normalizeManifest, } from '@vltpkg/types';
 import { load } from '@vltpkg/vlt-json';
+/**
+ * Does this breadcrumb item select the given importer?
+ */
+const matchesImporter = (item, importer) => item.importer &&
+    (item.value === ':project' ||
+        (item.value === ':root' && importer.mainImporter) ||
+        (item.value === ':workspace' && importer.importer));
+/**
+ * Does this item's qualifier (e.g. `:semver(^1)`, `:v(^1)`) accept the
+ * given spec? Shared by traversal matching and by the frozen / healing
+ * exemption, so both agree on what a modifier actually governs.
+ */
+const matchesQualifier = (item, spec) => !!item?.comparator({ semver: spec.semver });
 /**
  * Class representing loaded modifiers configuration for a project.
  *
@@ -73,6 +86,35 @@ export class GraphModifier {
         return (this.#config =
             load('modifiers', assertRecordStringString) ?? {});
     }
+    /**
+     * Whether a modifier governs the direct `importer -> spec.name` edge,
+     * i.e. whether its value comes from config rather than from the
+     * manifest that declares it. Only a breadcrumb whose whole scope is
+     * that edge counts, and only if its qualifier accepts the spec:
+     * `:root > #a > #b` names b but governs an edge under a, and
+     * `#b:semver(^1)` leaves a `^2` edge alone, so in both cases the
+     * root's own b edge is still the manifest's to validate and heal.
+     */
+    targetsImporterEdge(importer, spec) {
+        for (const { breadcrumb } of this.#modifiers) {
+            const { last } = breadcrumb;
+            if (last.name !== spec.name)
+                continue;
+            // a qualifier that rejects the spec means the modifier never
+            // applies to this edge, so it stays the manifest's to validate
+            if (!matchesQualifier(last, spec))
+                continue;
+            const { prev } = last;
+            // a lone `#b` matches an edge to b anywhere, importers included
+            if (!prev)
+                return true;
+            if (prev.prev)
+                continue;
+            if (matchesImporter(prev, importer))
+                return true;
+        }
+        return false;
+    }
     /**
      * Loads the modifiers defined in `vlt.json` into memory.
      */
@@ -132,11 +174,7 @@ export class GraphModifier {
         for (const modifier of this.#modifiers) {
             // if the first item in the breadcrumb is an importer and it matches
             // any of the valid top-level selectors, then register the modifier
-            const { first } = modifier.breadcrumb;
-            const matchRoot = first.value === ':root' && importer.mainImporter;
-            const matchWorkspace = first.value === ':workspace' && importer.importer;
-            const matchAny = first.value === ':project' || matchRoot || matchWorkspace;
-            if (first.importer && matchAny) {
+            if (matchesImporter(modifier.breadcrumb.first, importer)) {
                 const active = this.newModifier(importer, modifier);
                 const single = active.modifier.breadcrumb.single;
                 // only the importers will update the active entry right after
@@ -165,7 +203,7 @@ export class GraphModifier {
      * iteration.
      */
     tryNewDependency(from, spec) {
-        const { name, semver } = spec;
+        const { name } = spec;
         // here we use a map instead of a set so that we can associate each
         // modifier active entry with its breadcrumb so that it's easier to
         // pick the correct entry when we sort breadcrbumbs by specificity
@@ -210,9 +248,7 @@ export class GraphModifier {
         return all.get(specificitySort(entries
             // here we filter out any entries that do not match the
             // pseudo selector comparators used in the breadcrumb item
-            .filter(i => i.interactiveBreadcrumb.current?.comparator({
-            semver,
-        }))
+            .filter(i => matchesQualifier(i.interactiveBreadcrumb.current, spec))
             .map(i => i.modifier.breadcrumb))[0]);
     }
     /**

package/dist/node.d.ts

@@ -191,6 +191,11 @@ export declare class Node implements NodeLike {
      * example the lockfile that might have already have this info.
      */
     setResolved(): void;
+    /**
+     * Update this node's DepID and peer suffix after canonicalization.
+     * Resets name/location memos that were derived from the previous id.
+     */
+    setPeerIdentity(id: DepID, peerSetHash: string): void;
     setDefaultLocation(): void;
     /**
      * Add an edge from this node connecting it to a direct dependency.
@@ -235,5 +240,12 @@ export declare class Node implements NodeLike {
     };
     toString(): string;
 }
+/**
+ * Copy the tarball metadata `to` is missing from another node for the
+ * same package version. Lockfile provenance only carries over once both
+ * `integrity` and `resolved` are set, since that pair is what makes it
+ * usable without refetching.
+ */
+export declare const copyPackageMetadata: (to: Node, from: Node) => void;
 export declare const isNode: (value: unknown) => value is Node;
 export declare const asNode: (value: unknown) => Node;

package/dist/node.js

@@ -302,6 +302,35 @@ export class Node {
                 break;
         }
     }
+    /**
+     * Update this node's DepID and peer suffix after canonicalization.
+     * Resets name/location memos that were derived from the previous id.
+     */
+    setPeerIdentity(id, peerSetHash) {
+        const prevId = this.id;
+        const prevName = this.name;
+        const nameWasId = this.#name === prevId;
+        const prevDefault = `./node_modules/.vlt/${prevId}/node_modules/${prevName}`;
+        const locWasDefault = !this.#location || this.#location === prevDefault;
+        this.id = id;
+        this.peerSetHash = peerSetHash;
+        if (nameWasId)
+            this.#name = undefined;
+        const nextName = this.name;
+        if (prevName !== nextName) {
+            const oldSet = this.graph.nodesByName.get(prevName);
+            oldSet?.delete(this);
+            if (oldSet?.size === 0) {
+                this.graph.nodesByName.delete(prevName);
+            }
+            const nbn = this.graph.nodesByName.get(nextName) ?? new Set();
+            nbn.add(this);
+            this.graph.nodesByName.set(nextName, nbn);
+        }
+        if (locWasDefault) {
+            this.location = `./node_modules/.vlt/${id}/node_modules/${nextName}`;
+        }
+    }
     setDefaultLocation() {
         const def = `./node_modules/.vlt/${this.id}/node_modules/${this.name}`;
         // only relocate if the location is in node_modules already
@@ -378,6 +407,19 @@ export class Node {
         return stringifyNode(this);
     }
 }
+/**
+ * Copy the tarball metadata `to` is missing from another node for the
+ * same package version. Lockfile provenance only carries over once both
+ * `integrity` and `resolved` are set, since that pair is what makes it
+ * usable without refetching.
+ */
+export const copyPackageMetadata = (to, from) => {
+    to.integrity ??= from.integrity;
+    to.resolved ??= from.resolved;
+    if (from.resolvedFromLockfile && to.integrity && to.resolved) {
+        to.resolvedFromLockfile = true;
+    }
+};
 export const isNode = (value) => {
     return (typeof value === 'object' &&
         value != null &&

package/dist/reify/index.js

@@ -64,6 +64,24 @@ export const reify = async (options) => {
             loadManifests: true,
         });
     const diff = new Diff(actual, graph);
+    // normalise importer edge specs and compute the package.json changes
+    // before deciding whether anything needs reifying: an add whose target
+    // is already in place has no node diff but still has a saved value to
+    // persist. `Diff` compares edge targets only, so the rewrite is safe
+    // after it was built.
+    const saveImportersPackageJson = 
+    /* c8 ignore next */
+    (options.add?.modifiedDependencies ||
+        options.remove?.modifiedDependencies) ?
+        updatePackageJson({
+            add: options.add,
+            remove: options.remove,
+            graph,
+            packageJson: options.packageJson,
+            saveExact: options.saveExact,
+            savePrefix: options.savePrefix,
+        })
+        : undefined;
     const noModifiedDependencies = !options.add?.modifiedDependencies &&
         !options.remove?.modifiedDependencies;
     // Skip optional-only diffs only after a prior reify wrote lockfiles.
@@ -77,12 +95,18 @@ export const reify = async (options) => {
         // Even when there are no changes to reify, ensure lockfiles
         // exist on disk. This handles the case where a project has no
         // dependencies (or only workspace importers) but still needs
-        // lockfiles written on the first install.
-        if (!hasLockfiles) {
-            saveHidden(options);
+        // lockfiles written on the first install. A stale flag means an
+        // edge spec was rewritten above, which the lockfiles have to carry.
+        if (!hasLockfiles || graph.lockfileStale) {
+            // with no diff at all the ideal graph is the actual graph, so the
+            // hidden lockfile can be written from it; an optional-only diff
+            // being skipped may only refresh the main lockfile
+            if (!hasLockfiles || !diff.hasChanges())
+                saveHidden(options);
             const lfData = lockfileData(options);
             saveData(lfData, scurry.resolve('vlt-lock.json'), false);
         }
+        saveImportersPackageJson?.();
         // Even with no reify changes, report nodes that still need building.
         // Build state is persisted in the hidden lockfile and loaded into the
         // actual graph, so check there for pending builds.
@@ -97,7 +121,7 @@ export const reify = async (options) => {
     }
     let success = false;
     try {
-        const { buildQueue } = await reify_(options, diff, remover);
+        const { buildQueue } = await reify_(options, diff, remover, saveImportersPackageJson);
         remover.confirm();
         success = true;
         res.buildQueue = buildQueue;
@@ -112,21 +136,9 @@ export const reify = async (options) => {
     done();
     return res;
 };
-const reify_ = async (options, diff, remover) => {
+const reify_ = async (options, diff, remover, saveImportersPackageJson) => {
     const res = {};
-    const { add, remove, packageInfo, packageJson, scurry, allowScripts, saveExact, savePrefix, } = options;
-    const saveImportersPackageJson = 
-    /* c8 ignore next */
-    add?.modifiedDependencies || remove?.modifiedDependencies ?
-        updatePackageJson({
-            add,
-            remove,
-            graph: options.graph,
-            packageJson,
-            saveExact,
-            savePrefix,
-        })
-        : undefined;
+    const { packageInfo, packageJson, scurry, allowScripts } = options;
     // before anything else happens, grab the ideal tree as it was resolved
     // so that we can store it in the lockfile. We do this here so that
     // any failed/removed optional deps are not reflected in the lockfile

package/dist/reify/update-importers-package-json.js

@@ -1,5 +1,6 @@
 import { splitDepID } from '@vltpkg/dep-id';
 import { error } from '@vltpkg/error-cause';
+import { Spec } from '@vltpkg/spec';
 import { longDependencyTypes } from '@vltpkg/types';
 import { resolveSaveType } from "../resolve-save-type.js";
 import { calculateSaveValue } from "./calculate-save-value.js";
@@ -57,10 +58,11 @@ const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix) => {
                     found: dep.type,
                 });
             }
-            const n = node.edgesOut.get(name)?.to;
-            if (!n) {
+            const edge = node.edgesOut.get(name);
+            if (!edge?.to) {
                 throw error('Dependency node could not be found');
             }
+            const n = edge.to;
             const [nodeType] = splitDepID(n.id);
             for (const dtype of longDependencyTypes) {
                 if (dtype === depType || !manifest[dtype])
@@ -89,6 +91,14 @@ const addOrRemoveDeps = (nodeId, graph, addOrRemove, saveExact, savePrefix) => {
             const saveValue = calculateSaveValue(nodeType, dep.spec, existing, n.version, saveExact, savePrefix);
             dependencies[name] = saveValue;
             manifestChanged = manifestChanged || saveValue !== existing;
+            // the lockfile has to carry the value package.json carries, or a
+            // later install reads back `latest` where the manifest says
+            // `^1.2.3`. anything keyed by the old spec from here on must be
+            // invalidated at this point.
+            if (saveValue !== edge.spec.bareSpec) {
+                edge.spec = Spec.parse(name, saveValue, dep.spec.options);
+                graph.lockfileStale = true;
+            }
         }
     }
     return manifestChanged ? manifest : undefined;

package/dist/transfer-data/load.js

@@ -1,5 +1,5 @@
 import { error } from '@vltpkg/error-cause';
-import { SecurityArchive } from '@vltpkg/security-archive/browser';
+import { SecurityArchive, usesNpmRegistry, } from '@vltpkg/security-archive/browser';
 import { defaultGitHostArchives, defaultGitHosts, defaultRegistries, defaultRegistryName, defaultScopeRegistries, } from '@vltpkg/spec/browser';
 import { stringifyNode } from "../stringify-node.js";
 import { loadEdges } from "../lockfile/load-edges.js";
@@ -161,11 +161,11 @@ export const load = (transfered) => {
     loadNodes(graph, transfered.lockfile.nodes, specOptions, graph);
     loadEdges(graph, transfered.lockfile.edges, specOptions);
     const securityArchive = SecurityArchive.load(transfered.securityArchive);
-    // validates that all nodes have a security archive entry
+    // validates that all npm-ecosystem nodes have a security archive entry
     if (securityArchive) {
         securityArchive.ok = true;
         for (const node of graph.nodes.values()) {
-            if (!securityArchive.has(node.id)) {
+            if (usesNpmRegistry(node) && !securityArchive.has(node.id)) {
                 securityArchive.ok = false;
                 break;
             }

package/dist/uninstall.js

@@ -49,6 +49,8 @@ export const uninstall = async (options, remove) => {
                 })
                 : undefined;
             saveImportersPackageJson?.();
+            // see install.ts: never leave `.VLT.DELETE.*` behind
+            remover.confirm();
             return { graph, diff: undefined };
         }
         const diff = await reify({