@vltpkg/graph 1.3.6 → 1.3.7

package/dist/lockfile/load-nodes.js

@@ -1,6 +1,7 @@
 import { error } from '@vltpkg/error-cause';
 import { asDepID, splitDepID, splitExtra, } from '@vltpkg/dep-id/browser';
 import { getBooleanFlagsFromNum, getBuildStateFromNum, } from "./types.js";
+import { tarballFormat } from '@vltpkg/types';
 export const loadNodes = (graph, nodes, options, actual, throwOnMissingManifest) => {
     const entries = Object.entries(nodes);
     const nodeCount = entries.length;
@@ -76,8 +77,15 @@ export const loadNodes = (graph, nodes, options, actual, throwOnMissingManifest)
         // node whose `resolved` the lockfile left out
         node.brotli = brotli;
         node.integrity = integrity ?? referenceNode?.integrity;
+        // `integrity` is the hash of the artifact `resolved` points at, so a
+        // reference url only stands in for an elided one when it names the
+        // kind of tarball the flag bit says the lockfile's own hash is for
+        const refResolved = referenceNode?.resolved;
+        const refResolvedUsable = !integrity ||
+            !refResolved ||
+            (tarballFormat(refResolved) === 'brotli') === brotli;
         node.resolved =
-            type === 'remote' ? filepath : ((resolved ?? referenceNode?.resolved));
+            type === 'remote' ? filepath : ((resolved ?? (refResolvedUsable ? refResolved : undefined)));
         node.resolvedFromLockfile = !!(node.integrity && node.resolved);
         node.projectRoot = graph.projectRoot;
         if (!node.resolved)

package/dist/node.d.ts

@@ -263,9 +263,13 @@ export declare class Node implements NodeLike {
 }
 /**
  * Copy the tarball metadata `to` is missing from another node for the
- * same package version. Lockfile provenance only carries over once both
- * `integrity` and `resolved` are set, since that pair is what makes it
- * usable without refetching.
+ * same package version. `integrity` is one artifact's hash, so it never
+ * crosses onto a node bound for the other kind of tarball: a node with
+ * no metadata of its own takes `from`'s kind along with it, one that
+ * already has a url or a hash only fills in what matches its own.
+ * Lockfile provenance only carries over once both `integrity` and
+ * `resolved` are set, since that pair is what makes it usable without
+ * refetching.
  */
 export declare const copyPackageMetadata: (to: Node, from: Node) => void;
 export declare const isNode: (value: unknown) => value is Node;

package/dist/node.js

@@ -483,11 +483,21 @@ export class Node {
 }
 /**
  * Copy the tarball metadata `to` is missing from another node for the
- * same package version. Lockfile provenance only carries over once both
- * `integrity` and `resolved` are set, since that pair is what makes it
- * usable without refetching.
+ * same package version. `integrity` is one artifact's hash, so it never
+ * crosses onto a node bound for the other kind of tarball: a node with
+ * no metadata of its own takes `from`'s kind along with it, one that
+ * already has a url or a hash only fills in what matches its own.
+ * Lockfile provenance only carries over once both `integrity` and
+ * `resolved` are set, since that pair is what makes it usable without
+ * refetching.
  */
 export const copyPackageMetadata = (to, from) => {
+    if (!from.integrity && !from.resolved)
+        return;
+    if (!to.integrity && !to.resolved)
+        to.brotli = from.brotli;
+    if (to.brotli !== from.brotli)
+        return;
     to.integrity ??= from.integrity;
     to.resolved ??= from.resolved;
     if (from.resolvedFromLockfile && to.integrity && to.resolved) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.3.6",
-    "@vltpkg/dep-id": "1.3.6",
-    "@vltpkg/dss-breadcrumb": "1.3.6",
-    "@vltpkg/error-cause": "1.3.6",
-    "@vltpkg/fast-split": "1.3.6",
-    "@vltpkg/graph-run": "1.3.6",
-    "@vltpkg/init": "1.3.6",
-    "@vltpkg/output": "1.3.6",
-    "@vltpkg/package-info": "1.3.6",
-    "@vltpkg/package-json": "1.3.6",
-    "@vltpkg/pick-manifest": "1.3.6",
-    "@vltpkg/query": "1.3.6",
-    "@vltpkg/rollback-remove": "1.3.6",
-    "@vltpkg/run": "1.3.6",
-    "@vltpkg/satisfies": "1.3.6",
-    "@vltpkg/security-archive": "1.3.6",
-    "@vltpkg/spec": "1.3.6",
-    "@vltpkg/types": "1.3.6",
-    "@vltpkg/vlt-json": "1.3.6",
-    "@vltpkg/workspaces": "1.3.6",
+    "@vltpkg/cmd-shim": "1.3.7",
+    "@vltpkg/dep-id": "1.3.7",
+    "@vltpkg/dss-breadcrumb": "1.3.7",
+    "@vltpkg/error-cause": "1.3.7",
+    "@vltpkg/fast-split": "1.3.7",
+    "@vltpkg/graph-run": "1.3.7",
+    "@vltpkg/init": "1.3.7",
+    "@vltpkg/output": "1.3.7",
+    "@vltpkg/package-info": "1.3.7",
+    "@vltpkg/package-json": "1.3.7",
+    "@vltpkg/pick-manifest": "1.3.7",
+    "@vltpkg/query": "1.3.7",
+    "@vltpkg/rollback-remove": "1.3.7",
+    "@vltpkg/run": "1.3.7",
+    "@vltpkg/satisfies": "1.3.7",
+    "@vltpkg/security-archive": "1.3.7",
+    "@vltpkg/spec": "1.3.7",
+    "@vltpkg/types": "1.3.7",
+    "@vltpkg/vlt-json": "1.3.7",
+    "@vltpkg/workspaces": "1.3.7",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },