@vltpkg/graph 1.3.0 → 1.3.2

package/dist/node.js

@@ -304,20 +304,22 @@ export class Node {
         const spec = hydrateTuple(tuple, this.#name, this.#options);
         const dist = this.manifest?.dist;
         const tarball = dist?.tarball || spec.conventionalRegistryTarball;
+        // Use the manifest's own reference if there is one. Otherwise build
+        // the URL the way the registry names these: the same stem as the
+        // `.tgz` with a different extension. Relying on that convention is
+        // what lets a lockfile node, which has no manifest, store one flag
+        // bit instead of a second URL.
+        const alt = this.#brotli ? brotliAlternate(dist) : undefined;
         const brotli = this.#brotli ?
-            // the manifest's own reference when there is one, and otherwise
-            // the registry's naming for it: same stem as the `.tgz`, a
-            // different extension. That convention is what lets a lockfile
-            // node -- which has no manifest -- spend one flag bit rather
-            // than a second URL.
-            (brotliAlternate(dist) ??
-                (tarball && brotliTarballName(tarball)))
+            (alt?.tarball ?? (tarball && brotliTarballName(tarball)))
             : undefined;
         if (brotli) {
             this.resolved = brotli;
-            // `dist.integrity` describes the `.tgz`. The `.tar.br` is a
-            // different artifact with a different hash, pinned by its own
-            // `Repr-Digest` on the install that first fetches it.
+            // `dist.integrity` belongs to the `.tgz`, so never copy it here.
+            // Use the alternate's own hash if the registry sent one. If not,
+            // the first fetch learns it from the Repr-Digest header.
+            if (alt?.integrity)
+                this.integrity ??= alt.integrity;
             return;
         }
         this.resolved = tarball;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.3.0",
-    "@vltpkg/dep-id": "1.3.0",
-    "@vltpkg/dss-breadcrumb": "1.3.0",
-    "@vltpkg/error-cause": "1.3.0",
-    "@vltpkg/fast-split": "1.3.0",
-    "@vltpkg/graph-run": "1.3.0",
-    "@vltpkg/init": "1.3.0",
-    "@vltpkg/output": "1.3.0",
-    "@vltpkg/package-info": "1.3.0",
-    "@vltpkg/package-json": "1.3.0",
-    "@vltpkg/pick-manifest": "1.3.0",
-    "@vltpkg/query": "1.3.0",
-    "@vltpkg/rollback-remove": "1.3.0",
-    "@vltpkg/run": "1.3.0",
-    "@vltpkg/satisfies": "1.3.0",
-    "@vltpkg/security-archive": "1.3.0",
-    "@vltpkg/spec": "1.3.0",
-    "@vltpkg/types": "1.3.0",
-    "@vltpkg/vlt-json": "1.3.0",
-    "@vltpkg/workspaces": "1.3.0",
+    "@vltpkg/cmd-shim": "1.3.2",
+    "@vltpkg/dep-id": "1.3.2",
+    "@vltpkg/dss-breadcrumb": "1.3.2",
+    "@vltpkg/error-cause": "1.3.2",
+    "@vltpkg/fast-split": "1.3.2",
+    "@vltpkg/graph-run": "1.3.2",
+    "@vltpkg/init": "1.3.2",
+    "@vltpkg/output": "1.3.2",
+    "@vltpkg/package-info": "1.3.2",
+    "@vltpkg/package-json": "1.3.2",
+    "@vltpkg/pick-manifest": "1.3.2",
+    "@vltpkg/query": "1.3.2",
+    "@vltpkg/rollback-remove": "1.3.2",
+    "@vltpkg/run": "1.3.2",
+    "@vltpkg/satisfies": "1.3.2",
+    "@vltpkg/security-archive": "1.3.2",
+    "@vltpkg/spec": "1.3.2",
+    "@vltpkg/types": "1.3.2",
+    "@vltpkg/vlt-json": "1.3.2",
+    "@vltpkg/workspaces": "1.3.2",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },