@vltpkg/package-info 1.0.1 → 1.0.2

package/dist/index.js

@@ -505,7 +505,7 @@ export class PackageInfoClient {
                         await clone(gitRemote, gitCommittish, dir, { spec: s });
                         const { path } = gitSelectorParsed ?? {};
                         const pkgDir = path !== undefined ? pathResolve(dir, path) : dir;
-                        return this.packageJson.read(pkgDir);
+                        return this.#readExtracted(pkgDir, s, options);
                     });
                 }
                 // fallthrough to remote
@@ -533,7 +533,7 @@ export class PackageInfoClient {
                         throw this.#resolveError(s, options, 'tar unpack failed', { cause: er });
                     }
                     // return manifest with computed integrity
-                    const mani = this.packageJson.read(dir);
+                    const mani = this.#readExtracted(dir, s, options);
                     mani.dist = { integrity: computed };
                     return mani;
                 });
@@ -555,7 +555,7 @@ export class PackageInfoClient {
                     catch (er) {
                         throw this.#resolveError(s, options, 'tar unpack failed', { cause: er });
                     }
-                    return this.packageJson.read(dir);
+                    return this.#readExtracted(dir, s, options);
                 });
             }
             case 'workspace': {
@@ -723,6 +723,19 @@ export class PackageInfoClient {
             }
         }
     }
+    /**
+     * Read the manifest out of a directory we cloned or unpacked. Failures are
+     * labeled with the spec, because the internal directory says nothing about
+     * which dependency is at fault.
+     */
+    #readExtracted(dir, spec, options) {
+        try {
+            return this.packageJson.read(dir);
+        }
+        catch (er) {
+            throw this.#resolveError(spec, options, 'invalid package manifest', { cause: er });
+        }
+    }
     async #tmpdir(fn) {
         const p = `package-info/${randomBytes(6).toString('hex')}`;
         const dir = xdg.runtime(p);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/package-info",
   "description": "Resolve and fetch package metadata and tarballs",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,16 +13,16 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/error-cause": "1.0.1",
-    "@vltpkg/git": "1.0.1",
-    "@vltpkg/package-json": "1.0.1",
-    "@vltpkg/pick-manifest": "1.0.1",
-    "@vltpkg/registry-client": "1.0.1",
-    "@vltpkg/spec": "1.0.1",
-    "@vltpkg/tar": "1.0.1",
-    "@vltpkg/types": "1.0.1",
-    "@vltpkg/workspaces": "1.0.1",
-    "@vltpkg/xdg": "1.0.1",
+    "@vltpkg/error-cause": "1.0.2",
+    "@vltpkg/git": "1.0.2",
+    "@vltpkg/package-json": "1.0.2",
+    "@vltpkg/pick-manifest": "1.0.2",
+    "@vltpkg/registry-client": "1.0.2",
+    "@vltpkg/spec": "1.0.2",
+    "@vltpkg/tar": "1.0.2",
+    "@vltpkg/types": "1.0.2",
+    "@vltpkg/workspaces": "1.0.2",
+    "@vltpkg/xdg": "1.0.2",
     "ssri": "^13.0.0",
     "tar": "^7.5.2"
   },
@@ -31,8 +31,8 @@
     "@types/node": "^22.19.2",
     "@types/pacote": "^11.1.8",
     "@vltpkg/benchmark": "0.0.0",
-    "@vltpkg/cache-unzip": "1.0.1",
-    "@vltpkg/vlt-json": "1.0.1",
+    "@vltpkg/cache-unzip": "1.0.2",
+    "@vltpkg/vlt-json": "1.0.2",
     "eslint": "^9.39.1",
     "pacote": "^21.0.4",
     "prettier": "^3.7.4",