{"record":{"id":"3b56483a2240081d","repo":"paperclipai/paperclip","slug":"migrator-shared-dependency-mismatch","errorCode":null,"errorMessage":"Migrator shared dependency mismatch.","messagePattern":"Migrator shared dependency mismatch\\.","errorType":"console","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/cloud-migrator-artifacts.mjs","lineNumber":48,"sourceCode":"  }\n}\n\nexport function assertManifest(manifest, sha) {\n  if (manifest?.version !== 1 || manifest.sourceSha !== sha || manifest.packageVersion !== versionFor(sha)) throw new Error(\"Artifact source identity mismatch.\");\n  for (const name of names) assertDescriptor(manifest.packages?.[name], \"tgz\");\n  assertDescriptor(manifest.lockfile, \"json\");\n}\n\nexport function assertLockfile(lock, manifest) {\n  const version = manifest.packageVersion;\n  if (lock?.lockfileVersion !== 3 || !lock.packages || Array.isArray(lock.packages) ||\n      JSON.stringify(lock.packages[\"\"]?.dependencies) !== JSON.stringify({ \"@paperclipai/db\": version })) throw new Error(\"Invalid migrator lockfile root.\");\n  for (const name of names) {\n    const pin = lock.packages[`node_modules/@paperclipai/${name}`];\n    const expected = manifest.packages[name];\n    if (pin?.version !== version || pin.integrity !== expected.integrity || pin.resolved !== expected.url || pin.link || pin.inBundle) throw new Error(\"Migrator lockfile package pin mismatch.\");\n  }\n  if (lock.packages[\"node_modules/@paperclipai/db\"].dependencies?.[\"@paperclipai/shared\"] !== version) throw new Error(\"Migrator shared dependency mismatch.\");\n  for (const [key, entry] of Object.entries(lock.packages)) {\n    if (key === \"\") continue;\n    if (!entry || typeof entry !== \"object\" || entry.link) throw new Error(\"Invalid migrator lockfile entry.\");\n    if (/(?:^|\\/)node_modules\\/@paperclipai\\/[^/]+$/.test(key) && !names.some((name) => key === `node_modules/@paperclipai/${name}`)) throw new Error(\"Unexpected internal migrator dependency.\");\n    if (entry.inBundle === true) {\n      if (!key.startsWith(\"node_modules/@paperclipai/db/node_modules/\")) throw new Error(\"Unexpected bundled dependency.\");\n      continue;\n    }\n    if (!/^sha512-[A-Za-z0-9+/]{86}==$/.test(entry.integrity ?? \"\")) throw new Error(\"Migrator dependency has no strong integrity pin.\");\n    if (names.some((name) => key === `node_modules/@paperclipai/${name}`)) continue;\n    const url = new URL(entry.resolved);\n    if (url.origin !== \"https://registry.npmjs.org\" || url.username || url.password || url.search || url.hash) throw new Error(\"Migrator dependency must resolve to npm.\");\n  }\n}\n\nexport function buildBundle(directory, sha, { exec = execFileSync } = {}) {\n  versionFor(sha);\n  directory = path.resolve(directory);","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/paperclipai/paperclip/blob/3f1d897a7c018d76563a21c6e39c3c9b03933622/scripts/cloud-migrator-artifacts.mjs#L30-L66","documentation":"assertLockfile requires the @paperclipai/db lockfile entry to declare an exact-version dependency on @paperclipai/shared, equal to manifest.packageVersion. This keeps the two internal packages co-pinned so a migrator install can never mix package versions. The error fires when that nested dependency pin is missing or differs from the manifest version.","triggerScenarios":"assertLockfile(lock, manifest) sees lock.packages[\"node_modules/@paperclipai/db\"].dependencies[\"@paperclipai/shared\"] !== manifest.packageVersion (missing, a range like ^0.4.2, or an older exact version).","commonSituations":"The db package.json's dependency on @paperclipai/shared was a semver range or stale version when npm generated the lockfile; someone hand-edited the lockfile; packages were bumped independently without a rebuild.","solutions":["Ensure @paperclipai/db's package.json depends on @paperclipai/shared at the same exact version, then re-run the `build` command to regenerate the lockfile","Bump both packages together so their versions match the manifest packageVersion","Verify the db package.json included in the tgz (checked via tarManifest) declares the pinned shared dependency"],"exampleFix":"// before (db package.json)\n\"dependencies\": { \"@paperclipai/shared\": \"^0.4.1\" }\n// after\n\"dependencies\": { \"@paperclipai/shared\": \"0.4.2\" }","handlingStrategy":"validation","validationCode":"const dbEntry = lock.packages?.[\"node_modules/@paperclipai/db\"];\nconst pinned = dbEntry?.dependencies?.[\"@paperclipai/shared\"];\nif (pinned !== manifest.packageVersion) throw new Error(`@paperclipai/shared pin is ${pinned}, expected ${manifest.packageVersion}`);","typeGuard":"const sharedPinOk = (lock, manifest) =>\n  lock?.packages?.[\"node_modules/@paperclipai/db\"]?.dependencies?.[\"@paperclipai/shared\"] === manifest.packageVersion;","tryCatchPattern":"try {\n  assertLockfile(lock, manifest);\n} catch (err) {\n  if (err.message === \"Migrator shared dependency mismatch.\") throw new Error(\"Rebuild the bundle: db must depend on shared at the exact manifest version\");\n  throw err;\n}","preventionTips":["Keep @paperclipai/db's dependency on @paperclipai/shared an exact version, never a range","Bump both packages in lockstep so their versions always match","Rebuild the lockfile after any package.json dependency change","Run `validate` on the bundle before publishing"],"tags":["supply-chain","lockfile","versioning","dependency-pinning"],"backgroundTag":"version-pin-mismatch","analyzedSha":"3f1d897a7c018d76563a21c6e39c3c9b03933622","analyzedAt":"2026-09-18T08:03:59.046Z","contentChangedAt":"2026-09-18T08:03:59.046Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}