novox/mesh-catalog
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gitea: read npm lockfiles of every version and measure every version's size #128

Merged
mesh-admin merged 3 commits from fix/npm-lockfile-shapes into main 2026-10-08 14:02:58 +00:00
Conversation 4 Commits 3 Files Changed 7
+360 -31
3 Commits
Author SHA1 Message Date
jochen 10b5e8188a Refuse a yarn lockfile the scanner stopped in, and a forge answer the cap cut
mesh/merge-gate pass: builds gitea → novox; no bus step; every machine composes with the change as it did without (4 of 4 compose)
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery superseded: a newer delivery to the same trunk took over its walk
Details 
Either was read as whole and could leave a pinned version unnamed (review of #128).
 2026-10-08 14:52:06 +02:00
jochen d69c0db4fc gitea: stop a real npm retention when a file was not read whole
mesh/merge-gate pass: builds gitea → novox; no bus step; every machine composes with the change as it did without (4 of 4 compose)
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery superseded: a newer head of the same pull request
Details 
A lockfile that could not be read is one of its repository's files that
could not be read (hq ADR 0251 §4): a version only it pins would be deleted
while in use. A real run now refuses on files_not_read as it does on
repositories_unread; a dry run still reports.
 2026-10-08 13:52:07 +02:00
jochen a9960d7a1b gitea: read npm lockfiles of every version and measure every version's size
mesh/merge-gate pass: builds gitea → novox; no bus step; every machine composes with the change as it did without (4 of 4 compose)
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery superseded: a newer head of the same pull request
Details 
Retention read no package-lock.json on the forge: in lockfile v2 and v3 a
packages entry's dependencies is a map of name to range, which the reader
decoded as nested entries, so all 32 files failed whole and the versions
they pin were kept by nothing. Entries are now read one by one, tolerating
unknown fields and skipping workspace links; an entry of an unknown shape
is said, not the whole file.

A dry run measured only the versions it would delete, so every kept
version answered 0 bytes. Every version is now measured, the registry's
total is answered, and a size that cannot be read is said (hq ADR 0251 §4).
 2026-10-08 13:48:12 +02:00