pnpm records the hash in patchedDependencies and again in every resolution key
that depends on the patched package. The generator only maintained the first, so
a regenerated patch left the rest stale: installs succeeded on a warm store and
the lockfile drifted on a cold one, which is CI.
Co-authored-by: Orca <help@stably.ai>
The patch carried 5.8MB of sourcemaps for bundles it rewrites, so the maps it
shipped described the wrong offsets anyway. The manifest's sourcemaps.policy was
documentation the generator never read; it is now the switch that drives this.
Deleting the maps rather than omitting their hunks is what keeps the patch
honest: omission saves the same bytes but leaves a map pointing into code that
moved. Nothing here consumes them - sourcemaps are off in every build config and
the package is a devDependency, so it never reaches a packaged app.
Also moves the .gitattributes -text rule down to the commit that introduces the
patch. It was added at the top of the stack, which left every commit in between
shipping a byte-hashed artifact that a CRLF checkout would corrupt.
Co-authored-by: Orca <help@stably.ai>
The xterm patch is 7.3 MB of diff over minified bundles with no recorded
provenance, so no one could regenerate it or tell whether the source hunks and
the bundle hunks still agree. Any IME fix that touches CompositionHelper had to
be hand-applied to four generated files.
Adds config/patches/xterm-src/ as the source of truth (832 lines over four
files), a pinned upstream manifest, and a generator that rebuilds the bundles
from that commit with the toolchain its lockfile pins, then derives the full
patch. `--check` runs it in CI as the new xterm_patch_sync job.
The committed patch is regenerated to match pnpm's own diff output (-U3 rather
than the hand-made -U6). This changes the patch bytes but no installed byte:
both patches applied to pristine tarballs produce recursively identical trees,
and all 8 patched files hash-identical to the installed package. pnpm's
patchedDependencies hash is sha256 of the patch file — verified for all five of
Orca's patches — so pnpm-lock.yaml carries the matching one-line update.
NeilandOrca