@vzn/vx-lockfile 0.0.650 → 0.0.652

package/README.md

@@ -22,7 +22,7 @@ export default defineWorkspace({
 })
 ```
 
-That is the whole setup. The plugin **owns** its lockfile and its manager's install settings (`VxPlugin.fingerprint`), and its `key` hook hashes one digest per project plus each settings file present into the key. `vx why <task>` names the material as `plugin @vzn/vx-lockfile/pnpm` (or `/bun`, `/npm`, `/yarn`) and `plugin @vzn/vx-lockfile/.npmrc` (or the settings file that moved).
+That is the whole setup. The plugin **owns** its lockfile and its manager's install settings (`VxPlugin.fingerprint`), and its `key` hook hashes one digest per project plus each settings file present into the key. `vx lock` records the digests in `.vx/dependencies.lock.json` and a run keys from that record, so after an install run `vx lock` and commit it: a run whose lockfile changed since refuses until you do. An edit in a `link:` or `file:` directory (or a patch) the lockfile names needs no `vx lock`: the run sees it moved since the record and digests anew. `vx why <task>` names the material as `plugin @vzn/vx-lockfile/pnpm` (or `/bun`, `/npm`, `/yarn`) and `plugin @vzn/vx-lockfile/.npmrc` (or the settings file that moved).
 
 With no lockfile at the workspace root (before the first install), it warns and keys no package's dependencies; a `^build` then has no edges to follow, and the run refuses it.
 
@@ -34,11 +34,13 @@ With no lockfile at the workspace root (before the first install), it warns and
 
 Every package the project can reach, by resolved identity (name, version, integrity), and under bun and npm by the name it installs under, not where it sits, so a re-hoist of one version re-keys nothing, plus the install-wide material every project hashes — and **the root package's own closure**. The root's `dependencies` and `devDependencies` reach every task: their bins run from the root `node_modules/.bin`, which vx puts on every task's PATH, and Node's resolution walks up to the root `node_modules` (`@types/*`, a plugin a root tool's config names). So a root devDependency bump (`pnpm add -Dw oxlint@next`) re-keys every project and `--affected` selects every project; a package only project A reaches still moves only A. A root `workspace:` dependency hashes that package's closure into every project too. Per manager:
 
-- **pnpm** (`pnpm-lock.yaml`, lockfile v5, v6, v9): importers → snapshots, transitively, each dependency by the name it is installed under as well as what it resolves to (two aliases swapping targets re-key); each package by name, version **and resolved peers** (`foo@1(react@18)` is not `foo@1(react@19)`), resolution and any `patchedDependencies` entry; `link:` hashes the linked importer's reach, or the CONTENT of a linked directory that is no importer (an importer's or, under an override, a package's), and a `file:` directory dependency hashes its own closure (v9 keys it `name@file:…`, v5/v6 by the bare `file:…`) and the CONTENT of the directory (pnpm copies it at install and records only its path; its `node_modules` and `.git` aside), so an edit in it re-keys the projects reaching it; every other top-level field but `overrides` and the catalogs, whose effect is the snapshot an importer reaches (`settings`, `packageExtensionsChecksum`, `pnpmfileChecksum`, `ignoredOptionalDependencies`, v6's `onlyBuiltDependencies`, and any field pnpm adds later) and the lockfile version into every project. A multi-document lockfile (pnpm 10.x and 11 write the env lockfile — `configDependencies`, the package manager's own install — ahead of the project's) reads its last document as the lockfile and hashes the ones before it into every project. A CRLF file (a Windows checkout) reads as its LF form, `settings` and `ignoredOptionalDependencies` included.
+- **pnpm** (`pnpm-lock.yaml`, lockfile v5, v6, v9): importers → snapshots, transitively, each dependency by the name it is installed under as well as what it resolves to (two aliases swapping targets re-key); each package by name, version **and resolved peers** (`foo@1(react@18)` is not `foo@1(react@19)`), resolution and the `patchedDependencies` entry pnpm applies to it (keyed `name@version`, a version range such as `name@<=7.0.0`, or `name`, in that precedence); `link:` hashes the linked importer's reach, or the CONTENT of a linked directory that is no importer (an importer's or, under an override, a package's), and a `file:` directory dependency hashes its own closure (v9 keys it `name@file:…`, v5/v6 by the bare `file:…`) and the CONTENT of the directory (pnpm copies it at install and records only its path; its `node_modules` and `.git` aside), so an edit in it re-keys the projects reaching it; every other top-level field but `overrides` and the catalogs, whose effect is the snapshot an importer reaches (`settings`, `packageExtensionsChecksum`, `pnpmfileChecksum`, `ignoredOptionalDependencies`, v6's `onlyBuiltDependencies`, and any field pnpm adds later) and the lockfile version into every project. A multi-document lockfile (pnpm 10.x and 11 write the env lockfile — `configDependencies`, the package manager's own install — ahead of the project's) reads its last document as the lockfile and hashes the ones before it into every project. A CRLF file (a Windows checkout) reads as its LF form, `settings` and `ignoredOptionalDependencies` included.
 - **bun** (`bun.lock`; a `bun.lockb` alone is refused — it is binary — naming `bun install --save-text-lockfile`, which writes `bun.lock`): Bun's hoisted layout — a dependency `d` of the package at path `p` is `p/d` when that key exists, else the nearest ancestor's, else the root's, so a nested version counts for the package it is nested under and no other, and a workspace resolves from its own name, or from `./<name>` when a root package holds that name (Bun nests that workspace's own dependencies there); `workspace:` entries, the root package's `name@root:` and a `link:` to a workspace's directory (`b@link:./packages/b`, which symlinks the workspace) hash the linked package's reach and are its project edge; each `patchedDependencies` entry and the CONTENT of its patch file (bun.lock records only its path) with the package it patches, so a patch edit re-keys only the projects reaching it; a `file:` directory dependency, and a `link:` to a directory that is no workspace, with the CONTENT of the directory (Bun copies the first and links the second, recording only the path), as under pnpm; every top-level field but `workspaces`, `packages`, the catalogs, `overrides` and `patchedDependencies` (`trustedDependencies`, and any field Bun adds later, keys sorted so the order Bun writes them in moves nothing), and any patch naming no entry, into every project — a catalog bump reaches only the projects whose `catalog:` dependency resolves anew, through the `packages` entry it installs.
-- **npm** (`npm-shrinkwrap.json` when present, as npm reads it, else `package-lock.json`; lockfileVersion 2 and 3): the `packages` map — `p/node_modules/d`, then each ancestor directory's (a workspace nested in another's directory resolves through the outer one's `node_modules`, as Node does), then `node_modules/d`; a `link: true` entry hashes its target workspace's reach, and one to a `file:` directory (an entry outside the root's `workspaces` globs, `!` exclusions honoured, or any entry outside `node_modules` when the root names none) the CONTENT of the directory, as under pnpm, since npm links it, and so does an entry npm copied from one (`install-links=true`: `resolved: "file:…"` with no integrity); root `overrides` reach a project through the entries they force (npm 10 does not write them to the lockfile); the root's and a workspace's own `version` is its package.json's, not an install, and is not in the key. Version 1 (npm 6) has no `packages` map and is refused.
+- **npm** (`npm-shrinkwrap.json` when present, as npm reads it, else `package-lock.json`; lockfileVersion 2 and 3): the `packages` map — `p/node_modules/d`, then each ancestor directory's (a workspace nested in another's directory resolves through the outer one's `node_modules`, as Node does), then `node_modules/d`; a `link: true` entry hashes its target workspace's reach, and one to a `file:` directory (an entry outside the root's `workspaces` globs, `!` exclusions honoured, or any entry outside `node_modules` when the root names none) the CONTENT of the directory, as under pnpm, since npm links it, and so does an entry npm copied from one (`install-links=true`: `resolved: "file:…"` with no integrity); root `overrides` reach a project through the entries they force (npm 10 does not write them to the lockfile); the root's and a workspace's own `version` is its package.json's, not an install, and is not in the key. Version 1 (npm 6) has no `packages` map and is refused, as is a later version whose packages are only in the legacy `dependencies` tree.
 - **yarn** (`yarn.lock`): berry (yarn 2+) resolves `name@npm:range` descriptors to entries, workspaces included, each entry hashing every field, its dependency lists included (so the root workspace's `dependenciesMeta` reaches every project, and two aliases swapping targets re-key), `__metadata`'s `version` and `cacheKey` into every project. A Yarn 4 catalog dependency (`catalog:`, `catalog:<name>`) is recorded as that literal and its range lives in `.yarnrc.yml`, so it reaches every entry of its package: a bump of any of them re-keys the workspace. So does a descriptor the file does not key, as when a root `resolutions` override rewrote it to another range: the entry installed in its place is reached through the package's name, so changing it re-keys the workspaces that depend on it. A path range (`portal:`, `file:`, `link:`) reaches the entry keyed bound to the package naming it (`::locator=…`), not another workspace's of the same name; a `portal:` or `link:` to a workspace reaches that workspace's closure, as `workspace:` does (Yarn symlinks the workspace itself, and its entry lists no dependencies); a `portal:` or `link:` to a directory that is no workspace also hashes the CONTENT of the directory (Yarn symlinks it and records no hash; berry's `file:` carries its own `::hash=`). Every `patch:` entry is reached by the plain descriptor it patches: Yarn's builtin compat patches (`resolve`, `typescript`, `fsevents`), in Yarn 2/3's spelling (`resolve@^1.22.0`) as in Yarn 4's (`resolve@npm%3A^1.22.0`), and a root `resolutions` patch over a descriptor the file still keys (what `yarn patch-commit -s` writes). The workspace asks for the plain descriptor, and the patched entry is the one Yarn installs, so adding or editing the patch re-keys it. A `packageExtensions` dependency (`.yarnrc.yml`'s, and Yarn's builtin `@babel/parser` → `@babel/types`) is installed for each matching package that does not declare it, yet its lockfile entry lists none: `yarn()` adds the edge, so a lockfile-only bump of the added package re-keys the packages that reach the extended one, and an entry no workspace reaches (an extension it cannot read) re-keys every project. `yarn()` owns `.yarnrc.yml` and hashes it into every task, so a catalog edit re-keys every project (pnpm-lock.yaml records a catalog's resolution, so under `pnpm()` it re-keys only the projects naming it). Classic (yarn 1) records no workspaces, so it yields one digest for the root that every project hashes — coarse, and honest about what the file records — and no project edges (below); a `file:` directory, which classic copies with no hash, and a `link:` one, which it symlinks, hash their CONTENT into that digest, but a `link:` to a workspace the root `workspaces` globs name (a `!` glob aside: Yarn 1 takes none and links the directory anyway): Yarn 1 links that workspace as it does by its name.
 
+A `file:` or `link:` directory outside the repository (`"dep": "link:../../../vendor/dep"`) is hashed by its CONTENT too, under every manager: an edit in it re-keys the projects reaching it. Git holds no base for it, so `--affected` does not see that edit unless the lockfile changes.
+
 A project the lockfile has no entry for hashes the digest of the nearest package that encloses it, with the root's (`packages/a/e2e` resolves from `packages/a/node_modules` first), or the root's alone outside every package — the only `node_modules` it can resolve from. A phantom dependency (imported, never declared by the project or the root — a sibling's package hoisted to the root) is not in any closure; declare it.
 
 A lockfile the parser cannot read **refuses the run**, naming the file, the reason and the install that regenerates it. That is deliberate: the alternative to reading the lockfile is keying on nothing, and a key that is missing material is a stale hit waiting to happen. Under `--affected` the refusal also says which side could not be read — the working tree's copy, or the one at the base ref (a lockfile-migration commit hits the second). A lockfile holding git merge conflict markers is refused the same way: it names two installs at once, and yarn classic's format parsed one side of it without a word.
@@ -47,20 +49,22 @@ A lockfile the parser cannot read **refuses the run**, naming the file, the reas
 
 Files no lockfile records lay `node_modules` out anew under a byte-identical lockfile (pnpm's `node-linker`, bun's `linker = "isolated"`, a registry in `.npmrc`, Yarn 4's catalogs). Each plugin owns its manager's and hashes each present file whole into every task; a change to one selects every project under `--affected`:
 
-| Plugin   | Settings                                                                                                           |
-| -------- | ------------------------------------------------------------------------------------------------------------------ |
-| `pnpm()` | `pnpm-workspace.yaml`, `.npmrc`, the root `package.json`'s `pnpm` field                                            |
-| `bun()`  | `bunfig.toml`, `.npmrc`                                                                                            |
-| `npm()`  | `.npmrc`                                                                                                           |
-| `yarn()` | `.yarnrc.yml`, `.yarnrc` and `.npmrc` (yarn 1), the root `package.json`'s `workspaces.nohoist` and `installConfig` |
+| Plugin   | Settings                                                                                                                          |
+| -------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| `pnpm()` | `pnpm-workspace.yaml`, `.npmrc`, the root `package.json`'s `pnpm` field                                                           |
+| `bun()`  | `bunfig.toml`, `.npmrc`                                                                                                           |
+| `npm()`  | `.npmrc`                                                                                                                          |
+| `yarn()` | `.yarnrc.yml`, `.yarnrc` and `.npmrc` (yarn 1), the root `package.json`'s `workspaces.nohoist`, `installConfig` and `resolutions` |
 
 `pnpm()` hashes `pnpm-workspace.yaml` without `patchedDependencies`, `overrides`, `catalog` and `catalogs`, which pnpm 10+ keeps there: the lockfile records what each one did, per project, so a patch, an override or a catalog bump re-keys only the projects that reach the package it changes, and `--affected` selects them through the lockfile. Any other setting in the file re-keys every project, and a file that does not parse is hashed whole. The root `package.json` adds only its `pnpm` field (`onlyBuiltDependencies` and the rest pnpm reads there and the lockfile does not record), its `overrides` and `patchedDependencies` aside: a root dependency edit is the lockfile's.
 
+`yarn()` reads the root `package.json`'s `resolutions` because yarn.lock does not record where one applies: a parent-scoped one (`"is-odd/is-number"`) leaves the parent's entry on the range it declares, so adding one whose range another package already keys changes the install under a byte-identical yarn.lock. Berry's overrides also become edges: each entry a `resolutions` key reaches (any entry depending on the name, or only the named parent's for a scoped one; a parent's range or a `**` counts as any parent) gets an edge to the entry the override's range names, so a lockfile-only bump of that entry (`yarn up -R is-number`) re-keys the parent's workspaces too, not only the package that keys the range itself. An unreadable scope over-keys, never under-keys.
+
 A file has one owner, so two of these plugins that share a settings file (`pnpm()` and `bun()` both own `.npmrc`) cannot be declared together.
 
 ## `package.json` as an input
 
-Every task with `inputs` of a project the lockfile lists, cached or not, gets its literal `package.json` appended to `inputs.files` (the `project` stage), so an edit to a manifest re-keys that project's tasks and, through `^` keys, its dependants. A task with no `inputs` stays keyless; one whose inputs already name `package.json` is left alone. A task that rewrites its own `package.json` with the same bytes (tsdown) keeps its hits under `inputStability: { strategy: 'mutable' }`.
+Every task with `inputs` of a project the lockfile lists, cached or not, gets its literal `package.json` appended to `inputs.files` (the `project` stage), so an edit to a manifest re-keys that project's tasks and, through `^` keys, its dependants. A task with no `inputs` stays keyless; one whose inputs already name `package.json` is left alone. A task that rewrites its own `package.json` with the same bytes (tsdown) keeps its hits under `inputs.stability: { strategy: 'mutable' }`.
 
 ## Project edges
 
@@ -80,7 +84,7 @@ These edges are what was installed, so they differ from a guess over manifest ra
 
 ## Cost
 
-Owning the file, the per-project key, the memo and the `--affected` diff are core's `lockfileClaim`; this package is the parsers, and they are internal: it exports `pnpm`, `bun`, `npm`, `yarn` and `LockfileOptions`. A lockfile is parsed **once per content**: the digests, each importer's edges and the dependency names it records are memoised in core's cache.db (`lockfile_memos`, one row per file and claimant) by the file's xxh3 and the plugin, its parsers' source and what core's digest step answers on a fixed probe graph included (an upgrade that changes how a digest is built never replays an old digest), so a warm run pays one read, one hash and one row read — never a parse — and the read happens once per run, not per task. `--affected` reads which files the lockfile names from the same memo. Under `scope: 'workspace'` the file is parsed for its edges alone, once per content, so an unreadable lockfile is refused there too. The settings files are read once per run. The digest is one hash per strongly connected component of the dependency graph (lockfiles carry cycles), children first, so a 1000-importer / 3000-package lockfile digests in ~20 ms when it does change.
+Owning the file, the per-project key, the memo and the `--affected` diff are core's `lockfileClaim`; this package is the parsers, and they are internal: it exports `pnpm`, `bun`, `npm`, `yarn` and `LockfileOptions`. A run's key never parses the lockfile: it reads each project's digest from `.vx/dependencies.lock.json`, which core holds to the lockfile's hash (unless a file the lockfile names moved since, as above). The rest is parsed **once per content**: each importer's edges and the dependency names it records (what `discover` reads), and the digests `vx lock` asks for, are memoised in core's cache.db (`lockfile_memos`, one row per file and claimant) by the file's xxh3 and the plugin, its parsers' source and what core's digest step answers on a fixed probe graph included (an upgrade that changes how a digest is built never replays an old digest), so a warm run pays one read, one hash and one row read — never a parse. A run's own parse (a fresh cache) leaves the digests out, most of a parse's cost. `--affected` reads which files the lockfile names from the same memo. Under `scope: 'workspace'` the file is parsed for its edges alone, once per content, so an unreadable lockfile is refused there too. The settings files are read once per run. The digest is one hash per strongly connected component of the dependency graph (lockfiles carry cycles), children first, so a 1000-importer / 3000-package lockfile digests in ~20 ms when it does change.
 
 ## `--affected`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vzn/vx-lockfile",
-  "version": "0.0.650",
+  "version": "0.0.652",
   "license": "MIT",
   "description": "Lockfile plugins for vx — pnpm(), bun(), npm(), yarn(): each keys every task on its project's own resolved dependency closure from the package manager's lockfile, so a lockfile change re-keys only the projects it reaches; --affected follows the same answer.",
   "keywords": [
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.650"
+    "@vzn/vx": "^0.0.652"
   },
   "repository": {
     "type": "git",

package/src/bun.ts

@@ -12,7 +12,7 @@
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
 import { depsOf, peerOnly, record, stable, type Json } from './json.js'
-import { joinPosix } from './posix.js'
+import { joinPosix, resolvePosix } from './posix.js'
 
 export interface Lockfile {
   readonly version: string
@@ -278,8 +278,8 @@ function fileDir(lock: Lockfile, id: string): string | undefined {
   if (file !== -1) return id.slice(file + '@file:'.length)
   const link = id.indexOf('@link:', 1)
   if (link === -1) return undefined
-  const dir = joinPosix('.', id.slice(link + '@link:'.length))
-  return dir === undefined || lock.workspaces.has(dir) ? undefined : dir
+  const dir = resolvePosix('.', id.slice(link + '@link:'.length))
+  return lock.workspaces.has(dir) ? undefined : dir
 }
 
 /**

package/src/index.ts

@@ -230,7 +230,12 @@ const MANAGERS = {
       // changed one is a settings change, which selects every project.
       const rc =
         lock.generation === 'berry' ? readText(path.join(root, yarnLock().YARNRC)) : undefined
-      return yarnLock().importerDigests(lock, files, yarnLock().packageExtensions(rc))
+      // Root `resolutions` Yarn 4 records on no entry: the edges they add.
+      const resolutions =
+        lock.generation === 'berry'
+          ? yarnLock().resolutionsOf(readText(path.join(root, 'package.json')))
+          : []
+      return yarnLock().importerDigests(lock, files, yarnLock().packageExtensions(rc), resolutions)
     },
     importers: (t) => yarnLock().importerLinks(yarnParse(t)),
     extraFiles: (t, root) => {
@@ -414,6 +419,11 @@ function plugin(manager: Manager, options: LockfileOptions): VxPlugin {
         const before = folded(change.before)
         return before !== undefined && before === folded(change.after) ? [] : undefined
       },
+      // A settings file folds into every key alike: nothing per project.
+      digests: (file, ctx) =>
+        claimsAt(ctx.workspaceRoot)
+          .find((c) => c.file === file)
+          ?.claim.fingerprint.digests?.(file, ctx),
       // The files the key hashes, so the key's own claim answers, from its
       // memo when it holds these bytes: `--affected` asks about every
       // changed path, and a classic `link:` to a workspace named without

package/src/npm.ts

@@ -47,6 +47,12 @@ export function parseLockfile(text: string): Lockfile {
     )
   }
   const raws = record(d!['packages']) ?? {}
+  // Read as no packages, a bump there moved no key.
+  if (Object.keys(raws).length === 0 && Object.keys(record(d!['dependencies']) ?? {}).length > 0) {
+    throw new Error(
+      `lockfileVersion ${version} lists its packages only in the legacy \`dependencies\` tree — npm 7+ writes them under \`packages\``,
+    )
+  }
   const isMember = workspaceMatcher(raws[''])
   const packages = new Map<string, Entry>()
   for (const [p, raw] of Object.entries(raws)) {

package/src/pnpm.ts

@@ -13,7 +13,7 @@
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
 import { record, stable } from './json.js'
-import { joinPosix } from './posix.js'
+import { joinPosix, resolvePosix } from './posix.js'
 
 export interface Lockfile {
   readonly version: string
@@ -271,6 +271,26 @@ function packageName(lock: Lockfile, snapshot: string): string {
   return slash === -1 ? s : s.slice(0, slash)
 }
 
+/**
+ * The patch pnpm applies to a snapshot, by its precedence: `name@version`,
+ * then a range key (`name@<=7.0.0`), then `name`. A range key matched
+ * nothing here, so a patch edit re-keyed no project (vercel/turborepo#13307).
+ */
+function patchOf(lock: Lockfile, snapshot: string): string {
+  const exact = lock.patches.get(packageKey(snapshot))
+  if (exact !== undefined) return exact
+  const name = packageName(lock, snapshot)
+  const id = packageKey(snapshot)
+  const version = id.slice(id.indexOf(name) + name.length + 1)
+  for (const [key, hash] of lock.patches) {
+    if (key.length > name.length + 1 && key.startsWith(`${name}@`)) {
+      const range = key.slice(name.length + 1)
+      if (Bun.semver.satisfies(version, range)) return hash
+    }
+  }
+  return lock.patches.get(name) ?? ''
+}
+
 /**
  * Every importer's digest: the lockfile as one graph (importers and
  * snapshots alike), each node's material its identity, and core's
@@ -339,7 +359,7 @@ export function fileDeps(lock: Lockfile): string[] {
 }
 
 function linkTarget(lock: Lockfile, dir: string, version: string): string | undefined {
-  return version.startsWith('link:') ? joinPosix(dir, version.slice('link:'.length)) : undefined
+  return version.startsWith('link:') ? resolvePosix(dir, version.slice('link:'.length)) : undefined
 }
 
 function buildGraph(lock: Lockfile, files: ReadonlyMap<string, string>): Graph {
@@ -358,8 +378,7 @@ function buildGraph(lock: Lockfile, files: ReadonlyMap<string, string>): Graph {
   }
   for (const key of lock.snapshots.keys()) {
     const resolution = lock.resolutions.get(key) ?? lock.resolutions.get(packageKey(key)) ?? ''
-    const patch =
-      lock.patches.get(packageKey(key)) ?? lock.patches.get(packageName(lock, key)) ?? ''
+    const patch = patchOf(lock, key)
     const dir = lock.directories.get(key) ?? lock.directories.get(packageKey(key))
     const content = dir === undefined ? '' : `\0file\0${files.get(dir) ?? ''}`
     node(key, `${key}\0${resolution}\0${patch}${content}`)

package/src/posix.ts

@@ -12,3 +12,18 @@ export function joinPosix(base: string, rel: string): string | undefined {
   }
   return parts.length === 0 ? '.' : parts.join('/')
 }
+
+/**
+ * `joinPosix`, but a path above the root keeps its leading `..`
+ * (`packages/a` + `../../../ext` → `../ext`): a local directory dependency
+ * beside the repository, whose content the claim hashes.
+ */
+export function resolvePosix(base: string, rel: string): string {
+  const parts: string[] = []
+  for (const seg of `${base}/${rel}`.split('/')) {
+    if (seg === '' || seg === '.') continue
+    if (seg === '..' && parts.length > 0 && parts.at(-1) !== '..') parts.pop()
+    else parts.push(seg)
+  }
+  return parts.length === 0 ? '.' : parts.join('/')
+}

package/src/yarn-settings.ts

@@ -4,9 +4,12 @@ import { record, stable, type Json } from './json.js'
 
 /**
  * The root package.json as every task folds it: `workspaces.nohoist`
- * (Yarn 1 lays node_modules out by it) and `installConfig`, which
- * yarn.lock records neither of. Its dependencies are the lockfile's to
- * record. Undefined for a file that does not parse to a mapping, folded
+ * (Yarn 1 lays node_modules out by it), `installConfig` and
+ * `resolutions`. yarn.lock records none of them: one scoped to a parent
+ * (`"is-odd/is-number"`) leaves the parent's entry on the range it
+ * declares, so adding one whose range another package already keys
+ * changes the install with yarn.lock byte for byte (turborepo#14499).
+ * Its dependencies are the lockfile's to record. Undefined for a file that does not parse to a mapping, folded
  * whole.
  */
 export function packageSettings(text: string): string | undefined {
@@ -22,5 +25,6 @@ export function packageSettings(text: string): string | undefined {
   const nohoist = record(map['workspaces'])?.['nohoist']
   if (nohoist !== undefined) kept['nohoist'] = nohoist
   if (map['installConfig'] !== undefined) kept['installConfig'] = map['installConfig']
+  if (map['resolutions'] !== undefined) kept['resolutions'] = map['resolutions']
   return `yarn-package\0${stable(kept)}`
 }

package/src/yarn.ts

@@ -13,7 +13,7 @@
 
 import { reachDigests, type LockfileImporter } from '@vzn/vx'
 import { depsOf, record, stable } from './json.js'
-import { joinPosix } from './posix.js'
+import { joinPosix, resolvePosix } from './posix.js'
 import { parseSyml } from './syml.js'
 
 export interface Lockfile {
@@ -412,7 +412,7 @@ function linkPath(dirOf: ReadonlyMap<string, string>, id: string): string | unde
     return undefined
   }
   const from = dirOf.get(locator)
-  return from === undefined ? undefined : joinPosix(from, m[1]!)
+  return from === undefined ? undefined : resolvePosix(from, m[1]!)
 }
 
 /**
@@ -573,6 +573,72 @@ function extend(
   if (orphans.length > 0) for (const r of roots) edges[r]!.push(...orphans)
 }
 
+/** A root `resolutions` entry: the dependency it overrides, of `parent` alone when scoped. */
+export interface Resolution {
+  readonly parent: string | undefined
+  readonly name: string
+  readonly range: string
+}
+
+/**
+ * The root manifest's berry `resolutions` (`is-number`, `is-odd/is-number`,
+ * `is-odd@3/is-number`, `a/**\/b`), each as the dependency it overrides and
+ * the parent it is scoped to. A parent's range and a `**` are read as any
+ * parent: an edge too many re-keys once too often, never too seldom.
+ */
+export function resolutionsOf(manifest: string | undefined): Resolution[] {
+  let raw: unknown
+  try {
+    raw = manifest === undefined ? undefined : JSON.parse(manifest)
+  } catch {
+    return []
+  }
+  const out: Resolution[] = []
+  for (const [pattern, range] of depsOf((raw ?? {}) as Record<string, unknown>, ['resolutions'])) {
+    const parts = pattern.split('/')
+    const tokens: string[] = []
+    for (let i = 0; i < parts.length; i++) {
+      tokens.push(
+        parts[i]!.startsWith('@') && i + 1 < parts.length ? `${parts[i]}/${parts[++i]}` : parts[i]!,
+      )
+    }
+    const bare = (t: string) => {
+      const at = t.indexOf('@', 1)
+      return at === -1 ? t : t.slice(0, at)
+    }
+    const name = bare(tokens.at(-1) ?? '')
+    if (name === '' || name === '**') continue
+    const parent = tokens.length < 2 || tokens.includes('**') ? undefined : bare(tokens.at(-2)!)
+    out.push({ parent, name, range })
+  }
+  return out
+}
+
+/**
+ * Each entry a root `resolutions` override reaches gets an edge to the
+ * entry its range names. Yarn 4 writes a parent-scoped override nowhere in
+ * the file: is-odd's entry keeps `is-number: "npm:^6.0.0"` while is-odd
+ * installs the ^7 entry another package keys, so a lockfile-only bump of
+ * that entry moved only the other package's key, and is-odd's dependents
+ * replayed a stale output. The override's own text is a settings fold
+ * (yarn-settings.ts); this is where it lands.
+ */
+function override(
+  lock: Lockfile,
+  index: ReadonlyMap<string, number>,
+  edges: number[][],
+  resolutions: readonly Resolution[],
+): void {
+  for (const r of resolutions) {
+    for (const [id, e] of lock.entries) {
+      if (!e.deps.has(r.name) || (r.parent !== undefined && e.name !== r.parent)) continue
+      for (const target of resolveDescriptor(lock, id, r.name, r.range)) {
+        edges[index.get(id)!]!.push(index.get(target)!)
+      }
+    }
+  }
+}
+
 /**
  * Every workspace's digest. Berry: one node per entry, workspaces among
  * them, keyed by dir. Classic: the file has no workspace entries, so the
@@ -583,6 +649,7 @@ export function importerDigests(
   lock: Lockfile,
   files: ReadonlyMap<string, string> = new Map(),
   extensions: readonly Extension[] = BUILTIN,
+  resolutions: readonly Resolution[] = [],
 ): ReadonlyMap<string, string> {
   const index = new Map<string, number>()
   const material: string[] = []
@@ -615,6 +682,7 @@ export function importerDigests(
       if (target !== undefined)
         edges[index.get(id)!]!.push(index.get(lock.workspaces.get(target)!)!)
     }
+    override(lock, index, edges, resolutions)
     extend(lock, index, edges, extensions)
   }
   const digests = reachDigests({ material, edges })