Variable _internalConst

Type Declaration

• _audit: (
      graph: Graph,
      ctx: TContext,
      lockfileType: TLockfileType,
  ) => Promise<TAuditReport>

  Fetch advisories straight from the registry (npm bulk endpoint) for the parsed graph — no (yarn|npm) audit child process. Registry / scope / auth resolve from .npmrc / .yarnrc.yml / .yarnrc + env. Async: HTTP can't be done synchronously without spawning, which is exactly what we're moving away from.

• _format: (lockfile: Graph, lockfileType: TLockfileType) => string

• _parse: (
      lockfile: string,
      lockfileType: TLockfileType,
      workspaceRoot?: string,
      manifest?: Record<string, any>,
  ) => Graph

• _patch: (
      lockfile: Graph,
      report: TAuditReport,
      ctx: TContext,
      lockfileType: TLockfileType,
      overrides?: readonly OverrideConstraint[],
  ) => Promise<Graph>

• _refurbish: (
      lockfile: Graph,
      lockfileType: TLockfileType,
      ctx: TContext,
      base?: Graph,
  ) => Promise<Graph>

  Fill install-required fields the patched graph still lacks, so the written lockfile needs no reconcile yarn install. Today that's only the yarn-berry zip checksum: completeTransitives resolves new nodes' integrity from the packument, but the berry checksum is a hash of yarn's own zip, derivable only from the tarball bytes — so refurbish fetches them and recomputes (byte-identical to what yarn install would write). yarn-classic nodes are already complete (resolved + integrity), so it's a no-op there. Async (HTTP).

  Scoped to what the patch introduced (base = the pre-patch graph). A checksum missing from the INPUT lock is yarn's own doing, not a gap to close: yarn only records checksums for packages it actually fetched, so a platform-gated optional dep (conditions: os=… & cpu=…) is deliberately left bare. Filling those makes the next yarn install strip them right back out — a dirty lockfile for no gain. Omit base to refurbish every node (standalone use).