use super::{jsonc::strip_jsonc, parse, raw::is_integrity_hash, source::split_ident, write};
use crate::{DepType, DirectDep, LocalSource, LockedPackage, LockfileGraph};
use std::collections::BTreeMap;
use std::path::{Path, PathBuf};
#[test]
fn test_split_ident() {
assert_eq!(
split_ident("foo@1.2.3"),
Some(("foo".to_string(), "1.2.3".to_string()))
);
assert_eq!(
split_ident("@scope/pkg@1.0.0"),
Some(("@scope/pkg".to_string(), "1.0.0".to_string()))
);
}
#[test]
fn test_is_integrity_hash() {
// Real SRI hashes at their exact base64 lengths.
assert!(is_integrity_hash(&format!("sha512-{}", "A".repeat(88))));
assert!(is_integrity_hash(&format!("sha256-{}", "A".repeat(44))));
assert!(is_integrity_hash(&format!("sha1-{}", "A".repeat(28))));
// base64 body with +, /, and = padding is still valid.
let mixed = format!("{}+/==", "A".repeat(84));
assert_eq!(mixed.len(), 88);
assert!(is_integrity_hash(&format!("sha512-{mixed}")));
// Github dir-id whose owner is literally a hash algo name —
// the extra `-` and the wrong length must disqualify it.
assert!(!is_integrity_hash("sha1-myrepo-abc123"));
assert!(!is_integrity_hash("sha256-owner-repo-deadbee"));
// Unknown algo prefix.
assert!(!is_integrity_hash("foo-bar"));
// Correct algo prefix but the wrong body length.
assert!(!is_integrity_hash("sha512-tooshort"));
// Right length but contains a forbidden `-` (base64 has no `-`).
let with_dash = format!("sha512-{}-{}", "A".repeat(43), "A".repeat(44));
assert_eq!(with_dash.len(), "sha512-".len() + 88);
assert!(!is_integrity_hash(&with_dash));
// No dash at all.
assert!(!is_integrity_hash("opaquestring"));
}
#[test]
fn test_strip_jsonc_trailing_comma() {
let input = r#"{ "a": 1, "b": 2, }"#;
let out = strip_jsonc(input);
let v: serde_json::Value = serde_json::from_str(&out).unwrap();
assert_eq!(v["a"], 1);
assert_eq!(v["b"], 2);
}
#[test]
fn test_strip_jsonc_line_comment() {
let input = "{ // comment\n \"a\": 1 }";
let out = strip_jsonc(input);
let v: serde_json::Value = serde_json::from_str(&out).unwrap();
assert_eq!(v["a"], 1);
}
#[test]
fn test_strip_jsonc_respects_strings() {
// Make sure we don't strip things that look like comments inside strings
let input = r#"{ "url": "http://example.com/path" }"#;
let out = strip_jsonc(input);
let v: serde_json::Value = serde_json::from_str(&out).unwrap();
assert_eq!(v["url"], "http://example.com/path");
}
#[test]
fn strip_jsonc_preserves_utf8_string_value() {
let input = "{ \"name\": \"café\" }";
let out = strip_jsonc(input);
assert_eq!(out.len(), input.len());
let v: serde_json::Value = serde_json::from_str(&out).unwrap();
assert_eq!(v["name"], "café");
}
#[test]
fn strip_jsonc_preserves_offsets_for_nonascii_in_comments() {
let input = "{ // café\n \"a\": 1 }";
let out = strip_jsonc(input);
assert_eq!(out.len(), input.len());
}
/// `strip_jsonc` must preserve byte offsets so a `serde_json` error
/// on the stripped buffer maps 1:1 onto the original file — that's
/// the only reason `parse()` can hand `raw_content` to miette's
/// `NamedSource` and trust the span.
#[test]
fn test_strip_jsonc_preserves_byte_offsets() {
let cases = [
"{ \"a\": 1 }", // no-op
"{ // line\n \"a\": 1 }", // line comment
"{ /* block */ \"a\": 1 }", // block comment
"{ /* multi\nline */ \"a\": 1 }", // block spans newline
"{ \"a\": 1, \"b\": 2, }", // trailing comma
"{ \"a\": \"// not a comment\" }", // comment inside string
"{ \"a\": 1 /* trailing", // unterminated block
];
for input in cases {
let out = strip_jsonc(input);
assert_eq!(
out.len(),
input.len(),
"length mismatch stripping {input:?} -> {out:?}"
);
// Every `\n` must land at the same byte offset so line
// numbers stay stable between the raw and cleaned buffers.
let raw_nls: Vec<usize> = input.match_indices('\n').map(|(i, _)| i).collect();
let out_nls: Vec<usize> = out.match_indices('\n').map(|(i, _)| i).collect();
assert_eq!(raw_nls, out_nls, "newline drift stripping {input:?}");
}
}
/// Build a placeholder SRI hash of the right shape (88-char base64
/// body for sha512). Tests need real SRI lengths now that
/// `is_integrity_hash` validates them — bogus stand-ins like
/// `sha512-aaa` would be rejected and integrity dropped.
fn fake_sri(tag: char) -> String {
format!("sha512-{}", tag.to_string().repeat(88))
}
#[test]
fn test_parse_simple() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri_foo = fake_sri('a');
let sri_nested = fake_sri('b');
let sri_bar = fake_sri('c');
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": {
"name": "test",
"dependencies": {
"foo": "^1.0.0",
},
"devDependencies": {
"bar": "^2.0.0",
},
},
},
"packages": {
"foo": ["foo@1.2.3", "", { "dependencies": { "nested": "^3.0.0" } }, "SRI_FOO"],
"nested": ["nested@3.1.0", "", {}, "SRI_NESTED"],
"bar": ["bar@2.5.0", "", {}, "SRI_BAR"],
}
}"#
.replace("SRI_FOO", &sri_foo)
.replace("SRI_NESTED", &sri_nested)
.replace("SRI_BAR", &sri_bar);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
assert_eq!(graph.packages.len(), 3);
assert!(graph.packages.contains_key("foo@1.2.3"));
assert!(graph.packages.contains_key("nested@3.1.0"));
assert!(graph.packages.contains_key("bar@2.5.0"));
let foo = &graph.packages["foo@1.2.3"];
assert_eq!(foo.integrity.as_deref(), Some(sri_foo.as_str()));
assert_eq!(
foo.dependencies.get("nested").map(String::as_str),
Some("3.1.0")
);
let root = graph.importers.get(".").unwrap();
assert_eq!(root.len(), 2);
assert!(
root.iter()
.any(|d| d.name == "foo" && d.dep_type == DepType::Production)
);
assert!(
root.iter()
.any(|d| d.name == "bar" && d.dep_type == DepType::Dev)
);
}
#[test]
fn test_parse_bun_lifecycle_deps_as_dep_path_tails() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri_bufferutil = fake_sri('a');
let sri_node_gyp_build = fake_sri('b');
let sri_electron = fake_sri('c');
let sri_electron_get = fake_sri('d');
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": {
"dependencies": {
"bufferutil": "4.0.9",
"electron": "39.2.7"
}
}
},
"packages": {
"bufferutil": ["bufferutil@4.0.9", "", { "dependencies": { "node-gyp-build": "^4.3.0" } }, "SRI_BUFFERUTIL"],
"node-gyp-build": ["node-gyp-build@4.8.4", "", { "bin": { "node-gyp-build": "bin.js" } }, "SRI_NODE_GYP_BUILD"],
"electron": ["electron@39.2.7", "", { "dependencies": { "@electron/get": "^2.0.0" } }, "SRI_ELECTRON"],
"@electron/get": ["@electron/get@2.0.3", "", {}, "SRI_ELECTRON_GET"]
}
}"#
.replace("SRI_BUFFERUTIL", &sri_bufferutil)
.replace("SRI_NODE_GYP_BUILD", &sri_node_gyp_build)
.replace("SRI_ELECTRON", &sri_electron)
.replace("SRI_ELECTRON_GET", &sri_electron_get);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
let bufferutil = &graph.packages["bufferutil@4.0.9"];
assert_eq!(
bufferutil
.dependencies
.get("node-gyp-build")
.map(String::as_str),
Some("4.8.4")
);
let electron = &graph.packages["electron@39.2.7"];
assert_eq!(
electron
.dependencies
.get("@electron/get")
.map(String::as_str),
Some("2.0.3")
);
let root = graph.importers.get(".").unwrap();
assert!(
root.iter()
.any(|d| d.name == "bufferutil" && d.dep_path == "bufferutil@4.0.9")
);
assert!(
root.iter()
.any(|d| d.name == "electron" && d.dep_path == "electron@39.2.7")
);
}
#[test]
fn test_parse_multi_version_nested() {
// bun keys nested packages using "parent/child" paths.
// Here `bar` exists hoisted at 2.0.0 and nested under `foo` at 1.0.0.
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri_top_bar = fake_sri('a');
let sri_foo = fake_sri('b');
let sri_nested_bar = fake_sri('c');
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": {
"dependencies": { "foo": "^1.0.0", "bar": "^2.0.0" }
}
},
"packages": {
"bar": ["bar@2.0.0", "", {}, "SRI_TOP_BAR"],
"foo": ["foo@1.0.0", "", { "dependencies": { "bar": "^1.0.0" } }, "SRI_FOO"],
"foo/bar": ["bar@1.0.0", "", {}, "SRI_NESTED_BAR"]
}
}"#
.replace("SRI_TOP_BAR", &sri_top_bar)
.replace("SRI_FOO", &sri_foo)
.replace("SRI_NESTED_BAR", &sri_nested_bar);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
assert!(graph.packages.contains_key("bar@2.0.0"));
assert!(graph.packages.contains_key("bar@1.0.0"));
assert!(graph.packages.contains_key("foo@1.0.0"));
// foo's transitive must be the nested bar@1.0.0
let foo = &graph.packages["foo@1.0.0"];
assert_eq!(
foo.dependencies.get("bar").map(String::as_str),
Some("1.0.0")
);
// Root direct bar is the hoisted 2.0.0
let root = graph.importers.get(".").unwrap();
let bar = root.iter().find(|d| d.name == "bar").unwrap();
assert_eq!(bar.dep_path, "bar@2.0.0");
}
#[test]
fn test_parse_scoped() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri = fake_sri('s');
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": {
"dependencies": { "@scope/pkg": "^1.0.0" }
}
},
"packages": {
"@scope/pkg": ["@scope/pkg@1.0.0", "", {}, "SRI"]
}
}"#
.replace("SRI", &sri);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
assert!(graph.packages.contains_key("@scope/pkg@1.0.0"));
let root = graph.importers.get(".").unwrap();
assert_eq!(root[0].name, "@scope/pkg");
}
/// bun.lock uses a 3-tuple `[ident, { meta }, "owner-repo-commit"]`
/// for GitHub / git deps (no `resolved` slot and no integrity). A
/// naive positional parse would mistake the trailing commit-id
/// string for the metadata object — make sure we recognize the
/// object by type rather than position.
#[test]
fn test_parse_github_dep() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri_dep = fake_sri('d');
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": {
"dependencies": { "vfs": "github:collinstevens/vfs#0b6ea53" }
}
},
"packages": {
"vfs": ["vfs@github:collinstevens/vfs#0b6ea53abcdef", { "dependencies": { "dep": "^1.0.0" } }, "collinstevens-vfs-0b6ea53"],
"dep": ["dep@1.0.0", "", {}, "SRI_DEP"]
}
}"#
.replace("SRI_DEP", &sri_dep);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
// The vfs package parsed with its github: version and picked up
// the transitive dep declared in the metadata slot.
let vfs_key = "vfs@github:collinstevens/vfs#0b6ea53abcdef";
assert!(graph.packages.contains_key(vfs_key));
let vfs = &graph.packages[vfs_key];
assert_eq!(
vfs.dependencies.get("dep").map(String::as_str),
Some("1.0.0")
);
// No SRI-shaped hash on the github entry → integrity stays None.
assert!(vfs.integrity.is_none());
// The adjacent registry dep's integrity must still round-trip —
// proves the type-based introspection doesn't break the normal
// 4-tuple path when mixed with a 3-tuple github entry.
let dep = &graph.packages["dep@1.0.0"];
assert_eq!(dep.integrity.as_deref(), Some(sri_dep.as_str()));
let root = graph.importers.get(".").unwrap();
assert!(root.iter().any(|d| d.name == "vfs"));
}
#[test]
fn test_parse_prefixless_local_tarball() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri = fake_sri('t');
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": {
"dependencies": { "local-helper": "file:tarballs/local-helper-1.0.0.tgz" }
}
},
"packages": {
"local-helper": ["local-helper@tarballs/local-helper-1.0.0.tgz", {}, "SRI"]
}
}"#
.replace("SRI", &sri);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
let pkg = &graph.packages["local-helper@tarballs/local-helper-1.0.0.tgz"];
assert!(
matches!(pkg.local_source, Some(LocalSource::Tarball(_))),
"prefixless bun tarball ident must be LocalSource::Tarball, got {:?}",
pkg.local_source
);
}
/// Round-trip the same multi-version shape the npm writer test
/// uses: two versions of `bar`, one hoisted, one nested under
/// `foo`. The writer's bun-key form (`foo/bar` instead of
/// `node_modules/foo/node_modules/bar`) must round-trip through
/// the bun parser without losing the nested version.
#[test]
fn test_write_roundtrip_multi_version() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri_top = fake_sri('t');
let sri_foo = fake_sri('f');
let sri_nested = fake_sri('n');
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": {
"dependencies": { "foo": "^1.0.0", "bar": "^2.0.0" }
}
},
"packages": {
"bar": ["bar@2.0.0", "", {}, "SRI_TOP"],
"foo": ["foo@1.0.0", "", { "dependencies": { "bar": "^1.0.0" } }, "SRI_FOO"],
"foo/bar": ["bar@1.0.0", "", {}, "SRI_NESTED"]
}
}"#
.replace("SRI_TOP", &sri_top)
.replace("SRI_FOO", &sri_foo)
.replace("SRI_NESTED", &sri_nested);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
let manifest = aube_manifest::PackageJson {
name: Some("test".to_string()),
version: Some("1.0.0".to_string()),
dependencies: [
("foo".to_string(), "^1.0.0".to_string()),
("bar".to_string(), "^2.0.0".to_string()),
]
.into_iter()
.collect(),
..Default::default()
};
let out = tempfile::NamedTempFile::new().unwrap();
write(out.path(), &graph, &manifest).unwrap();
let reparsed = parse(out.path()).unwrap();
assert!(reparsed.packages.contains_key("bar@2.0.0"));
assert!(reparsed.packages.contains_key("bar@1.0.0"));
assert!(reparsed.packages.contains_key("foo@1.0.0"));
assert_eq!(
reparsed.packages["bar@2.0.0"].integrity.as_deref(),
Some(sri_top.as_str())
);
assert_eq!(
reparsed.packages["bar@1.0.0"].integrity.as_deref(),
Some(sri_nested.as_str())
);
// foo's nested bar dep still resolves to 1.0.0 (nested)
// rather than snapping to the hoisted 2.0.0.
assert_eq!(
reparsed.packages["foo@1.0.0"]
.dependencies
.get("bar")
.map(String::as_str),
Some("1.0.0")
);
}
/// Byte-parity with a real `bun install`-generated lockfile — the
/// fixture at `tests/fixtures/bun-native.lock` was produced by
/// bun 1.3 against a `{ chalk, picocolors, semver }` manifest. A
/// parse → write round-trip must reproduce the exact bytes;
/// anything less means `aube install --no-frozen-lockfile` churns
/// someone's bun.lock in git when nothing in the graph moved.
/// Covers the format fixes (`configVersion`, no workspace
/// `version`, trailing commas, single-line package arrays) plus
/// the data-model fixes that ride with them (declared-range
/// preservation in `declared_dependencies`, `bin:` map
/// round-trip).
#[test]
fn test_write_byte_identical_to_native_bun() {
let fixture = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/bun-native.lock");
// Normalize line endings — Windows' `core.autocrlf=true` can
// rewrite the checked-out fixture to CRLF even with
// `.gitattributes eol=lf`; compare against LF form explicitly.
let original = std::fs::read_to_string(&fixture)
.unwrap()
.replace("\r\n", "\n");
let graph = parse(&fixture).unwrap();
let manifest = aube_manifest::PackageJson {
name: Some("aube-lockfile-stability".to_string()),
version: Some("1.0.0".to_string()),
dependencies: [
("chalk".to_string(), "^4.1.2".to_string()),
("picocolors".to_string(), "^1.1.1".to_string()),
("semver".to_string(), "^7.6.3".to_string()),
]
.into_iter()
.collect(),
..Default::default()
};
let tmp = tempfile::NamedTempFile::new().unwrap();
write(tmp.path(), &graph, &manifest).unwrap();
let written = std::fs::read_to_string(tmp.path()).unwrap();
if written != original {
panic!(
"bun writer drifted from native bun output.\n\n--- expected ---\n{original}\n--- got ---\n{written}"
);
}
}
/// `configVersion` must echo back whatever was parsed, not a
/// hardcoded `1`. Regression guard for a future bun release that
/// bumps the field — without this, aube would silently downgrade
/// every re-emit and drift against bun's own output.
#[test]
fn test_write_roundtrips_config_version() {
let project = tempfile::TempDir::new().unwrap();
let pj = project.path().join("package.json");
std::fs::write(&pj, r#"{"name":"root","dependencies":{}}"#).unwrap();
let lock_path = project.path().join("bun.lock");
std::fs::write(
&lock_path,
r#"{
"lockfileVersion": 1,
"configVersion": 42,
"workspaces": {
"": { "name": "root" }
},
"packages": {}
}"#,
)
.unwrap();
let graph = parse(&lock_path).unwrap();
assert_eq!(graph.bun_config_version, Some(42));
let manifest = aube_manifest::PackageJson::from_path(&pj).unwrap();
write(&lock_path, &graph, &manifest).unwrap();
let written = std::fs::read_to_string(&lock_path).unwrap();
assert!(
written.contains("\"configVersion\": 42,"),
"configVersion must round-trip verbatim, got:\n{written}"
);
}
/// Hand-authored bun.lock with two workspace entries (root and
/// `packages/app`) round-trips through the parser with both
/// importers populated, and the writer regenerates both
/// workspace entries from the on-disk manifests.
#[test]
fn test_parse_and_write_multi_workspace() {
use tempfile::TempDir;
let sri_foo = fake_sri('a');
let sri_bar = fake_sri('b');
let project = TempDir::new().unwrap();
let project_dir = project.path();
std::fs::write(
project_dir.join("package.json"),
r#"{"name":"root","version":"1.0.0","dependencies":{"foo":"^1.0.0"}}"#,
)
.unwrap();
std::fs::create_dir_all(project_dir.join("packages/app")).unwrap();
std::fs::write(
project_dir.join("packages/app/package.json"),
r#"{"name":"app","version":"2.0.0","dependencies":{"bar":"^3.0.0"}}"#,
)
.unwrap();
let lock_path = project_dir.join("bun.lock");
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": {
"name": "root",
"version": "1.0.0",
"dependencies": { "foo": "^1.0.0" }
},
"packages/app": {
"name": "app",
"version": "2.0.0",
"dependencies": { "bar": "^3.0.0" }
}
},
"packages": {
"foo": ["foo@1.2.3", "", {}, "SRI_FOO"],
"bar": ["bar@3.1.0", "", {}, "SRI_BAR"]
}
}"#
.replace("SRI_FOO", &sri_foo)
.replace("SRI_BAR", &sri_bar);
std::fs::write(&lock_path, content).unwrap();
let graph = parse(&lock_path).unwrap();
// Both importers are populated with their own direct deps.
let root = graph.importers.get(".").expect("root importer");
assert_eq!(root.len(), 1);
assert_eq!(root[0].name, "foo");
assert_eq!(root[0].dep_path, "foo@1.2.3");
let app = graph
.importers
.get("packages/app")
.expect("packages/app importer");
assert_eq!(app.len(), 1);
assert_eq!(app[0].name, "bar");
assert_eq!(app[0].dep_path, "bar@3.1.0");
// Now write the graph back out and re-parse. The non-root
// workspace entry must survive the round-trip. Write into the
// same project dir so the writer can find
// `packages/app/package.json` alongside the lockfile.
let manifest =
aube_manifest::PackageJson::from_path(&project_dir.join("package.json")).unwrap();
std::fs::remove_file(&lock_path).unwrap();
write(&lock_path, &graph, &manifest).unwrap();
let reparsed = parse(&lock_path).unwrap();
assert!(reparsed.importers.contains_key("."));
assert!(reparsed.importers.contains_key("packages/app"));
let app = &reparsed.importers["packages/app"];
assert_eq!(app.len(), 1);
assert_eq!(app[0].name, "bar");
assert_eq!(app[0].dep_path, "bar@3.1.0");
// And the raw text keeps the workspace block by key.
let raw = std::fs::read_to_string(&lock_path).unwrap();
assert!(raw.contains("\"packages/app\""));
assert!(raw.contains("\"name\": \"app\""));
}
/// Non-root workspace entries must carry `version`, `bin`, and
/// `optionalPeers` (bun's compact form of
/// `peerDependenciesMeta[name].optional`). Root stays minimal —
/// bun's own output omits those three on the root entry because
/// the adjacent project `package.json` is authoritative.
#[test]
fn test_write_workspace_entry_carries_version_bin_and_optional_peers() {
use tempfile::TempDir;
let project = TempDir::new().unwrap();
let project_dir = project.path();
std::fs::write(
project_dir.join("package.json"),
r#"{"name":"root","version":"1.0.0"}"#,
)
.unwrap();
std::fs::create_dir_all(project_dir.join("packages/drifti")).unwrap();
std::fs::write(
project_dir.join("packages/drifti/package.json"),
r#"{
"name": "@redact/drifti",
"version": "0.0.1",
"bin": { "drifti": "./dist/cli/bin.mjs" },
"peerDependencies": {
"@electric-sql/pglite": "*",
"kysely": "*"
},
"peerDependenciesMeta": {
"kysely": { "optional": true },
"@electric-sql/pglite": { "optional": true },
"not-optional": { "optional": false }
}
}"#,
)
.unwrap();
let mut importers = BTreeMap::new();
importers.insert(".".to_string(), vec![]);
importers.insert("packages/drifti".to_string(), vec![]);
let graph = LockfileGraph {
importers,
..Default::default()
};
let manifest =
aube_manifest::PackageJson::from_path(&project_dir.join("package.json")).unwrap();
let lock_path = project_dir.join("bun.lock");
write(&lock_path, &graph, &manifest).unwrap();
let raw = std::fs::read_to_string(&lock_path).unwrap();
let v: serde_json::Value = serde_json::from_str(&strip_jsonc(&raw)).unwrap();
let drifti = &v["workspaces"]["packages/drifti"];
assert_eq!(drifti["name"], "@redact/drifti");
assert_eq!(drifti["version"], "0.0.1");
assert_eq!(drifti["bin"]["drifti"], "./dist/cli/bin.mjs");
// Sorted alphabetically even though package.json lists keys
// out of order, and the `optional: false` entry is excluded.
let optional_peers: Vec<&str> = drifti["optionalPeers"]
.as_array()
.unwrap()
.iter()
.map(|x| x.as_str().unwrap())
.collect();
assert_eq!(optional_peers, vec!["@electric-sql/pglite", "kysely"]);
// `bin` must render inline — bun's own output puts it on one
// line (`"bin": { "drifti": "./dist/cli/bin.mjs" }`). A
// multi-line render here would produce the exact diff the
// writer is trying to avoid.
assert!(
raw.contains(r#""bin": { "drifti": "./dist/cli/bin.mjs" },"#),
"bin rendered multi-line or unexpected shape:\n{raw}"
);
// Root entry stays minimal: no version/bin/optionalPeers.
let root = &v["workspaces"][""];
assert!(
root.get("version").is_none(),
"root carried version: {root}"
);
assert!(root.get("bin").is_none(), "root carried bin: {root}");
assert!(
root.get("optionalPeers").is_none(),
"root carried optionalPeers: {root}"
);
}
/// Workspace-link packages must appear in `packages:` as
/// `[name@workspace:path]` so `bun install --frozen-lockfile`
/// can wire up the workspace dep without re-reading every
/// workspace package.json. Dropping them produces a lockfile
/// that errors with "Cannot find package" on the next install.
#[test]
fn test_write_emits_workspace_link_packages() {
use crate::LocalSource;
use std::path::PathBuf;
let tmp_dir = tempfile::TempDir::new().unwrap();
let project_dir = tmp_dir.path();
std::fs::write(
project_dir.join("package.json"),
r#"{"name":"root","version":"1.0.0"}"#,
)
.unwrap();
std::fs::create_dir_all(project_dir.join("packages/app")).unwrap();
std::fs::write(
project_dir.join("packages/app/package.json"),
r#"{"name":"my-app","version":"0.1.0"}"#,
)
.unwrap();
let mut packages = BTreeMap::new();
packages.insert(
"my-app@0.1.0".to_string(),
LockedPackage {
name: "my-app".to_string(),
version: "0.1.0".to_string(),
dep_path: "my-app@0.1.0".to_string(),
local_source: Some(LocalSource::Link(PathBuf::from("packages/app"))),
..Default::default()
},
);
let mut importers = BTreeMap::new();
importers.insert(".".to_string(), vec![]);
importers.insert("packages/app".to_string(), vec![]);
let graph = LockfileGraph {
importers,
packages,
..Default::default()
};
let manifest =
aube_manifest::PackageJson::from_path(&project_dir.join("package.json")).unwrap();
let lock_path = project_dir.join("bun.lock");
write(&lock_path, &graph, &manifest).unwrap();
let raw = std::fs::read_to_string(&lock_path).unwrap();
let v: serde_json::Value = serde_json::from_str(&strip_jsonc(&raw)).unwrap();
let pkgs = v["packages"].as_object().unwrap();
let entry = pkgs
.get("my-app")
.expect("workspace-link package missing from `packages`");
let arr = entry.as_array().expect("entry must be a JSON array");
assert_eq!(arr.len(), 1, "no-deps workspace entry must be `[ident]`");
assert_eq!(arr[0].as_str(), Some("my-app@workspace:packages/app"));
let ws = v["workspaces"].as_object().unwrap();
assert!(ws.contains_key("packages/app"));
}
/// Workspace-to-workspace deps must survive emission. When `app`
/// depends on `lib` via `workspace:*`, `app`'s `packages:` entry
/// has to carry that dep edge in its meta or bun's frozen-install
/// pass can't wire it up. The dep target is another `LocalSource::Link`
/// package, not a registry one, so the membership check has to
/// accept workspace dep_paths in addition to canonical entries.
#[test]
fn test_write_preserves_workspace_to_workspace_dep_edge() {
use crate::LocalSource;
use std::path::PathBuf;
use tempfile::TempDir;
let project = TempDir::new().unwrap();
let project_dir = project.path();
std::fs::write(
project_dir.join("package.json"),
r#"{"name":"root","version":"1.0.0"}"#,
)
.unwrap();
std::fs::create_dir_all(project_dir.join("packages/app")).unwrap();
std::fs::create_dir_all(project_dir.join("packages/lib")).unwrap();
std::fs::write(
project_dir.join("packages/app/package.json"),
r#"{"name":"app","version":"0.1.0","dependencies":{"lib":"workspace:*"}}"#,
)
.unwrap();
std::fs::write(
project_dir.join("packages/lib/package.json"),
r#"{"name":"lib","version":"0.1.0"}"#,
)
.unwrap();
let mut packages = BTreeMap::new();
packages.insert(
"app@workspace:packages/app".to_string(),
LockedPackage {
name: "app".to_string(),
version: "workspace:packages/app".to_string(),
dep_path: "app@workspace:packages/app".to_string(),
local_source: Some(LocalSource::Link(PathBuf::from("packages/app"))),
dependencies: [("lib".to_string(), "workspace:packages/lib".to_string())].into(),
declared_dependencies: [("lib".to_string(), "workspace:*".to_string())].into(),
..Default::default()
},
);
packages.insert(
"lib@workspace:packages/lib".to_string(),
LockedPackage {
name: "lib".to_string(),
version: "workspace:packages/lib".to_string(),
dep_path: "lib@workspace:packages/lib".to_string(),
local_source: Some(LocalSource::Link(PathBuf::from("packages/lib"))),
..Default::default()
},
);
let mut importers = BTreeMap::new();
importers.insert(".".to_string(), vec![]);
importers.insert("packages/app".to_string(), vec![]);
importers.insert("packages/lib".to_string(), vec![]);
let graph = LockfileGraph {
importers,
packages,
..Default::default()
};
let manifest =
aube_manifest::PackageJson::from_path(&project_dir.join("package.json")).unwrap();
let lock_path = project_dir.join("bun.lock");
write(&lock_path, &graph, &manifest).unwrap();
let raw = std::fs::read_to_string(&lock_path).unwrap();
let v: serde_json::Value = serde_json::from_str(&strip_jsonc(&raw)).unwrap();
let app_entry = v["packages"]["app"].as_array().unwrap();
assert_eq!(
app_entry.len(),
2,
"workspace entry with deps must be `[ident, {{ meta }}]`"
);
assert_eq!(app_entry[0].as_str(), Some("app@workspace:packages/app"));
assert_eq!(
app_entry[1]["dependencies"]["lib"].as_str(),
Some("workspace:*"),
"workspace-to-workspace dep edge dropped"
);
}
/// Parse → write → parse round-trip preserves a workspace entry
/// in `packages:`. Bun emits `[ident]` (and optionally `[ident,
/// { meta }]` when the workspace declares deps); both shapes must
/// survive without churning to the registry-package 4-tuple form.
#[test]
fn test_roundtrip_workspace_entry_in_packages_section() {
use tempfile::TempDir;
let project = TempDir::new().unwrap();
let project_dir = project.path();
std::fs::write(
project_dir.join("package.json"),
r#"{"name":"root","version":"1.0.0"}"#,
)
.unwrap();
std::fs::create_dir_all(project_dir.join("packages/app")).unwrap();
std::fs::write(
project_dir.join("packages/app/package.json"),
r#"{"name":"app","version":"0.1.0"}"#,
)
.unwrap();
let lock_path = project_dir.join("bun.lock");
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": { "name": "root", "version": "1.0.0" },
"packages/app": { "name": "app", "version": "0.1.0" }
},
"packages": {
"app": ["app@workspace:packages/app"]
}
}"#;
std::fs::write(&lock_path, content).unwrap();
let graph = parse(&lock_path).unwrap();
let manifest =
aube_manifest::PackageJson::from_path(&project_dir.join("package.json")).unwrap();
std::fs::remove_file(&lock_path).unwrap();
write(&lock_path, &graph, &manifest).unwrap();
let raw = std::fs::read_to_string(&lock_path).unwrap();
let v: serde_json::Value = serde_json::from_str(&strip_jsonc(&raw)).unwrap();
let arr = v["packages"]["app"]
.as_array()
.expect("workspace entry survived as array");
assert_eq!(arr.len(), 1);
assert_eq!(arr[0].as_str(), Some("app@workspace:packages/app"));
}
/// When the root and a non-root workspace declare the same dep
/// name at *different* versions, the writer must emit a
/// consistent top-level `packages` entry and still walk the
/// chosen version's transitive deps. Regression test for a
/// corruption in `build_hoist_tree`'s root-seeding loop: without
/// name-dedupe, the second version would overwrite the first in
/// `placed` but never get queued, so neither version's
/// transitive deps were walked correctly and the top-level entry
/// pointed at a package whose deps were never expanded.
#[test]
fn test_write_dedupes_duplicate_direct_deps_across_workspaces() {
use tempfile::TempDir;
let project = TempDir::new().unwrap();
let project_dir = project.path();
std::fs::write(
project_dir.join("package.json"),
r#"{"name":"root","dependencies":{"foo":"^1.0.0"}}"#,
)
.unwrap();
std::fs::create_dir_all(project_dir.join("packages/app")).unwrap();
std::fs::write(
project_dir.join("packages/app/package.json"),
r#"{"name":"app","dependencies":{"foo":"^2.0.0"}}"#,
)
.unwrap();
let mut packages = BTreeMap::new();
packages.insert(
"foo@1.0.0".to_string(),
LockedPackage {
name: "foo".to_string(),
version: "1.0.0".to_string(),
dep_path: "foo@1.0.0".to_string(),
dependencies: [("bar".to_string(), "2.0.0".to_string())]
.into_iter()
.collect(),
..Default::default()
},
);
packages.insert(
"foo@2.0.0".to_string(),
LockedPackage {
name: "foo".to_string(),
version: "2.0.0".to_string(),
dep_path: "foo@2.0.0".to_string(),
..Default::default()
},
);
packages.insert(
"bar@2.0.0".to_string(),
LockedPackage {
name: "bar".to_string(),
version: "2.0.0".to_string(),
dep_path: "bar@2.0.0".to_string(),
..Default::default()
},
);
let mut importers = BTreeMap::new();
importers.insert(
".".to_string(),
vec![DirectDep {
name: "foo".to_string(),
dep_path: "foo@1.0.0".to_string(),
dep_type: DepType::Production,
specifier: None,
}],
);
importers.insert(
"packages/app".to_string(),
vec![DirectDep {
name: "foo".to_string(),
dep_path: "foo@2.0.0".to_string(),
dep_type: DepType::Production,
specifier: None,
}],
);
let graph = LockfileGraph {
importers,
packages,
..Default::default()
};
let manifest =
aube_manifest::PackageJson::from_path(&project_dir.join("package.json")).unwrap();
let lock_path = project_dir.join("bun.lock");
write(&lock_path, &graph, &manifest).unwrap();
let reparsed = parse(&lock_path).unwrap();
// The root's version wins the hoisted `foo` slot (BTreeMap
// iteration puts `.` before `packages/app`), and `bar` — only
// reachable by walking root-foo's transitive deps — must be
// present. Before the fix, `foo@2.0.0` would overwrite
// `foo@1.0.0` in `placed` but never get queued, and neither
// version's transitive deps (including `bar`) would make it
// into the output.
let foo = reparsed.packages.get("foo@1.0.0").expect("foo@1.0.0");
assert_eq!(foo.version, "1.0.0");
assert!(
reparsed.packages.contains_key("bar@2.0.0"),
"root foo's transitive `bar` was dropped: {:?}",
reparsed.packages.keys().collect::<Vec<_>>()
);
}
/// When a workspace directory path (e.g. `packages/app`) happens
/// to share its first segment with a literal npm package name,
/// the parser must not wrongly resolve a workspace dep to that
/// package's nested entry. Here there's an npm package literally
/// named `packages` with a nested `bar@9.9.9`, and the workspace
/// `packages/app` depends on `bar`. The workspace's `bar` must
/// resolve to the hoisted `bar@1.0.0`, not to `packages/bar`'s
/// `9.9.9`.
#[test]
fn test_parse_workspace_path_does_not_alias_npm_package() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri = fake_sri('a');
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": { "dependencies": { "packages": "^1.0.0" } },
"packages/app": {
"name": "app",
"dependencies": { "bar": "^1.0.0" }
}
},
"packages": {
"bar": ["bar@1.0.0", "", {}, "SRI"],
"packages": ["packages@1.0.0", "", { "dependencies": { "bar": "^9.0.0" } }, "SRI"],
"packages/bar": ["bar@9.9.9", "", {}, "SRI"]
}
}"#
.replace("SRI", &sri);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
let app = graph
.importers
.get("packages/app")
.expect("packages/app importer");
let bar = app.iter().find(|d| d.name == "bar").expect("bar dep");
assert_eq!(
bar.dep_path, "bar@1.0.0",
"workspace `bar` must resolve to hoisted 1.0.0, not packages/bar@9.9.9"
);
}
/// Bun scopes non-hoisted direct deps under the workspace package
/// name, not the workspace directory path. A workspace at
/// `packages/z-app` named `z-app` can therefore depend on
/// `z-app/tslib` while another workspace gets the hoisted `tslib`.
#[test]
fn test_parse_workspace_dep_prefers_workspace_name_scope() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri = fake_sri('a');
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": { "name": "root" },
"packages/a-other": {
"name": "a-other",
"dependencies": { "tslib": "2.8.1" }
},
"packages/z-app": {
"name": "z-app",
"dependencies": { "tslib": "2.4.0" }
}
},
"packages": {
"a-other": ["a-other@workspace:packages/a-other"],
"tslib": ["tslib@2.8.1", "", {}, "SRI"],
"z-app": ["z-app@workspace:packages/z-app"],
"z-app/tslib": ["tslib@2.4.0", "", {}, "SRI"]
}
}"#
.replace("SRI", &sri);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
let other = graph
.importers
.get("packages/a-other")
.expect("packages/a-other importer");
let hoisted_tslib = other.iter().find(|d| d.name == "tslib").expect("tslib dep");
assert_eq!(
hoisted_tslib.dep_path, "tslib@2.8.1",
"sibling workspace must still resolve to the hoisted tslib"
);
let app = graph
.importers
.get("packages/z-app")
.expect("packages/z-app importer");
let tslib = app.iter().find(|d| d.name == "tslib").expect("tslib dep");
assert_eq!(
tslib.dep_path, "tslib@2.4.0",
"workspace dep must resolve to z-app/tslib, not hoisted tslib"
);
}
#[test]
fn test_parse_rebases_workspace_scoped_local_tarball() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri = fake_sri('a');
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": { "name": "root" },
"packages/app": {
"name": "app",
"dependencies": { "local-tar": "file:../../vendor/local-tar-1.0.0.tgz" }
}
},
"packages": {
"app": ["app@workspace:packages/app"],
"app/local-tar": ["local-tar@../../vendor/local-tar-1.0.0.tgz", {}, "SRI"]
}
}"#
.replace("SRI", &sri);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
let local_tar = graph
.packages
.values()
.find(|p| p.name == "local-tar")
.expect("local-tar package");
assert_eq!(local_tar.version, "../../vendor/local-tar-1.0.0.tgz");
assert_eq!(
local_tar.local_source,
Some(LocalSource::Tarball(PathBuf::from(
"vendor/local-tar-1.0.0.tgz"
)))
);
}
/// Top-level `overrides` / `patchedDependencies` / `trustedDependencies`
/// and the unnamed `catalog` / named `catalogs` blocks must round-trip
/// verbatim — bun preserves all five on re-emit, so aube dropping any
/// of them is a real-repo churn source on every install. Keep this
/// test format-agnostic (no SRI hashes, no packages) so it only
/// exercises the metadata-preservation path.
#[test]
fn test_roundtrip_top_level_metadata() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": { "name": "root" }
},
"overrides": {
"lodash": "^4.17.21",
"lodash>debug": "^4.0.0"
},
"patchedDependencies": {
"lodash@4.17.21": "patches/lodash@4.17.21.patch"
},
"trustedDependencies": ["sharp", "esbuild"],
"catalog": {
"react": "^18.2.0"
},
"catalogs": {
"evens": { "date-fns": "^2.30.0" }
},
"packages": {}
}"#;
std::fs::write(tmp.path(), content).unwrap();
let graph = parse(tmp.path()).unwrap();
assert_eq!(
graph.overrides.get("lodash").map(String::as_str),
Some("^4.17.21")
);
assert_eq!(
graph.overrides.get("lodash>debug").map(String::as_str),
Some("^4.0.0")
);
assert_eq!(
graph
.patched_dependencies
.get("lodash@4.17.21")
.map(String::as_str),
Some("patches/lodash@4.17.21.patch")
);
assert_eq!(
graph.trusted_dependencies,
vec!["sharp".to_string(), "esbuild".to_string()],
"trustedDependencies must preserve bun's original order on parse"
);
assert_eq!(graph.catalogs["default"]["react"].specifier, "^18.2.0");
assert_eq!(graph.catalogs["evens"]["date-fns"].specifier, "^2.30.0");
let manifest = aube_manifest::PackageJson {
name: Some("root".to_string()),
..Default::default()
};
let out = tempfile::NamedTempFile::new().unwrap();
write(out.path(), &graph, &manifest).unwrap();
let written = std::fs::read_to_string(out.path()).unwrap();
// Every round-tripped block must appear in the re-emitted
// lockfile — the exact rendering is implementation-defined
// but a substring check is enough to catch regression.
assert!(
written.contains("\"overrides\""),
"overrides dropped:\n{written}"
);
assert!(
written.contains("\"patchedDependencies\""),
"patchedDependencies dropped:\n{written}"
);
assert!(
written.contains("\"trustedDependencies\""),
"trustedDependencies dropped:\n{written}"
);
// trustedDependencies must round-trip in insertion order
// (bun writes [sharp, esbuild] — alphabetized emit would
// produce a gratuitous diff against bun's own output).
let sharp_at = written
.find("\"sharp\"")
.expect("sharp in trustedDependencies");
let esbuild_at = written
.find("\"esbuild\"")
.expect("esbuild in trustedDependencies");
assert!(
sharp_at < esbuild_at,
"trustedDependencies reordered on write — expected sharp before esbuild:\n{written}"
);
assert!(
written.contains("\"catalog\""),
"catalog dropped:\n{written}"
);
assert!(
written.contains("\"catalogs\""),
"catalogs dropped:\n{written}"
);
let reparsed = parse(out.path()).unwrap();
assert_eq!(reparsed.overrides, graph.overrides);
assert_eq!(reparsed.patched_dependencies, graph.patched_dependencies);
assert_eq!(reparsed.trusted_dependencies, graph.trusted_dependencies);
assert_eq!(reparsed.catalogs["default"]["react"].specifier, "^18.2.0");
}
/// Non-registry specifier classes (github:, file:, link:, https:,
/// workspace:) must parse into `LocalSource` rather than fall
/// through as registry pins. The installer routes by
/// `LocalSource`, so mis-classification here sends the package
/// through the default registry and either 404s or downloads the
/// wrong tarball — bug class #1 in the parity report.
#[test]
fn test_parse_routes_non_registry_specs_to_localsource() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": {
"dependencies": {
"vfs": "github:collinstevens/vfs#0b6ea53",
"localdir": "file:./vendor/localdir",
"localtgz": "file:./vendor/thing.tgz",
"sibling": "link:../sibling",
"remote": "https://example.com/thing.tgz"
}
}
},
"packages": {
"vfs": ["vfs@github:collinstevens/vfs#0b6ea53abcdef", {}, "collinstevens-vfs-0b6ea53abcdef"],
"localdir": ["localdir@file:./vendor/localdir", {}],
"localtgz": ["localtgz@file:./vendor/thing.tgz", {}],
"sibling": ["sibling@link:../sibling", {}],
"remote": ["remote@https://example.com/thing.tgz", {}]
}
}"#;
std::fs::write(tmp.path(), content).unwrap();
let graph = parse(tmp.path()).unwrap();
let vfs = graph
.packages
.values()
.find(|p| p.name == "vfs")
.expect("vfs package");
assert!(
matches!(vfs.local_source, Some(LocalSource::Git(_))),
"github dep must be LocalSource::Git, got {:?}",
vfs.local_source
);
let localdir = graph
.packages
.values()
.find(|p| p.name == "localdir")
.expect("localdir package");
assert!(
matches!(localdir.local_source, Some(LocalSource::Directory(_))),
"file:./dir must be LocalSource::Directory, got {:?}",
localdir.local_source
);
let localtgz = graph
.packages
.values()
.find(|p| p.name == "localtgz")
.expect("localtgz package");
assert!(
matches!(localtgz.local_source, Some(LocalSource::Tarball(_))),
"file:./*.tgz must be LocalSource::Tarball, got {:?}",
localtgz.local_source
);
let sibling = graph
.packages
.values()
.find(|p| p.name == "sibling")
.expect("sibling package");
assert!(
matches!(sibling.local_source, Some(LocalSource::Link(_))),
"link: must be LocalSource::Link, got {:?}",
sibling.local_source
);
let remote = graph
.packages
.values()
.find(|p| p.name == "remote")
.expect("remote package");
assert!(
matches!(remote.local_source, Some(LocalSource::RemoteTarball(_))),
"https://*.tgz must be LocalSource::RemoteTarball, got {:?}",
remote.local_source
);
}
#[test]
fn test_parse_bun_workspace_package_path_as_link_target() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": { "name": "root" },
"packages/app": {
"name": "app",
"dependencies": { "lib": "workspace:*" }
},
"packages/lib": { "name": "lib" }
},
"packages": {
"app": ["app@workspace:packages/app"],
"lib": ["lib@workspace:packages/lib"]
}
}"#;
std::fs::write(tmp.path(), content).unwrap();
let graph = parse(tmp.path()).unwrap();
let lib = graph.packages.get("lib@workspace:packages/lib").unwrap();
assert_eq!(
lib.local_source.as_ref().and_then(LocalSource::path),
Some(Path::new("packages/lib"))
);
let app_deps = graph.importers.get("packages/app").unwrap();
assert_eq!(app_deps[0].dep_path, "lib@workspace:packages/lib");
}
/// npm-alias ident: bun writes `<real>@<version>` as the ident
/// string while using the alias name as the `packages[]` hoist
/// key. Aube's earlier writer emitted `<alias>@<version>` and
/// produced a gratuitous diff against bun's own output. Cover
/// both parse (populates `alias_of`) and write (emits real name
/// in ident).
#[test]
fn test_parse_and_write_npm_alias() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri = fake_sri('a');
let content = r#"{
"lockfileVersion": 1,
"workspaces": {
"": { "dependencies": { "h3-v2": "npm:h3@2.0.1" } }
},
"packages": {
"h3-v2": ["h3@2.0.1", "", {}, "SRI"]
}
}"#
.replace("SRI", &sri);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
let h3 = graph
.packages
.values()
.find(|p| p.name == "h3-v2")
.expect("h3-v2 package");
assert_eq!(h3.alias_of.as_deref(), Some("h3"));
assert_eq!(h3.version, "2.0.1");
let manifest = aube_manifest::PackageJson {
name: Some("root".to_string()),
dependencies: [("h3-v2".to_string(), "npm:h3@2.0.1".to_string())]
.into_iter()
.collect(),
..Default::default()
};
let out = tempfile::NamedTempFile::new().unwrap();
write(out.path(), &graph, &manifest).unwrap();
let written = std::fs::read_to_string(out.path()).unwrap();
// Ident reads `h3@2.0.1` (registry identity), not `h3-v2@...`.
assert!(
written.contains("\"h3@2.0.1\""),
"expected ident `h3@2.0.1`, got:\n{written}"
);
assert!(
!written.contains("\"h3-v2@2.0.1\""),
"alias-name ident leaked into packages entry:\n{written}"
);
}
/// Per-entry meta blocks bun preserves that aube historically
/// dropped: `peerDependencies`, `optionalPeers`, `os`, `cpu`,
/// `libc`. Round-trip through a single package entry and confirm
/// every field survives re-parse.
#[test]
fn test_roundtrip_peer_and_platform_metadata() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri = fake_sri('a');
let content = r#"{
"lockfileVersion": 1,
"workspaces": { "": { "dependencies": { "foo": "^1.0.0" } } },
"packages": {
"foo": ["foo@1.0.0", "", {
"peerDependencies": { "react": "^18.0.0" },
"optionalPeers": ["react"],
"os": ["darwin", "linux"],
"cpu": ["arm64", "x64"],
"libc": ["glibc"]
}, "SRI"]
}
}"#
.replace("SRI", &sri);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
let foo = &graph.packages["foo@1.0.0"];
assert_eq!(
foo.peer_dependencies.get("react").map(String::as_str),
Some("^18.0.0")
);
assert!(
foo.peer_dependencies_meta
.get("react")
.is_some_and(|m| m.optional)
);
assert_eq!(
foo.os.as_slice(),
&["darwin".to_string(), "linux".to_string()]
);
assert_eq!(
foo.cpu.as_slice(),
&["arm64".to_string(), "x64".to_string()]
);
assert_eq!(foo.libc.as_slice(), &["glibc".to_string()]);
let manifest = aube_manifest::PackageJson {
name: Some("root".to_string()),
dependencies: [("foo".to_string(), "^1.0.0".to_string())]
.into_iter()
.collect(),
..Default::default()
};
let out = tempfile::NamedTempFile::new().unwrap();
write(out.path(), &graph, &manifest).unwrap();
let reparsed = parse(out.path()).unwrap();
let foo2 = &reparsed.packages["foo@1.0.0"];
assert_eq!(foo2.peer_dependencies, foo.peer_dependencies);
assert_eq!(foo2.os, foo.os);
assert_eq!(foo2.cpu, foo.cpu);
assert_eq!(foo2.libc, foo.libc);
}
#[test]
fn test_parse_scalar_platform_metadata() {
let tmp = tempfile::NamedTempFile::new().unwrap();
let sri = fake_sri('a');
let content = r#"{
"lockfileVersion": 1,
"workspaces": { "": { "dependencies": { "@esbuild/darwin-arm64": "0.27.2" } } },
"packages": {
"@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.27.2", "", {
"os": "darwin",
"cpu": "arm64",
"libc": "glibc"
}, "SRI"]
}
}"#
.replace("SRI", &sri);
std::fs::write(tmp.path(), &content).unwrap();
let graph = parse(tmp.path()).unwrap();
let pkg = &graph.packages["@esbuild/darwin-arm64@0.27.2"];
assert_eq!(pkg.os.as_slice(), &["darwin".to_string()]);
assert_eq!(pkg.cpu.as_slice(), &["arm64".to_string()]);
assert_eq!(pkg.libc.as_slice(), &["glibc".to_string()]);
}
/// Workspace-level `peerDependencies` must survive round-trip
/// through the serde-flatten `extra` map even though aube's
/// typed workspace model doesn't claim the field directly. The
/// prior revision had a typed slot that silently drained bun's
/// peer block without plumbing it anywhere — regression guard.
#[test]
fn test_roundtrip_workspace_peer_dependencies() {
use tempfile::TempDir;
let project = TempDir::new().unwrap();
let project_dir = project.path();
std::fs::write(
project_dir.join("package.json"),
r#"{"name":"root","version":"1.0.0"}"#,
)
.unwrap();
std::fs::create_dir_all(project_dir.join("packages/app")).unwrap();
// Non-root workspace's package.json deliberately omits
// peerDependencies; the lockfile is the only place they live.
std::fs::write(
project_dir.join("packages/app/package.json"),
r#"{"name":"app","version":"2.0.0"}"#,
)
.unwrap();
let lock_path = project_dir.join("bun.lock");
std::fs::write(
&lock_path,
r#"{
"lockfileVersion": 1,
"workspaces": {
"": { "name": "root" },
"packages/app": {
"name": "app",
"version": "2.0.0",
"peerDependencies": { "react": "^18.0.0" }
}
},
"packages": {}
}"#,
)
.unwrap();
let graph = parse(&lock_path).unwrap();
let app_extras = graph
.workspace_extra_fields
.get("packages/app")
.expect("packages/app workspace_extra_fields entry");
let peers = app_extras
.get("peerDependencies")
.and_then(serde_json::Value::as_object)
.expect("peerDependencies captured in extras");
assert_eq!(peers.get("react").and_then(|v| v.as_str()), Some("^18.0.0"));
let manifest =
aube_manifest::PackageJson::from_path(&project_dir.join("package.json")).unwrap();
write(&lock_path, &graph, &manifest).unwrap();
let written = std::fs::read_to_string(&lock_path).unwrap();
assert!(
written.contains("\"peerDependencies\""),
"workspace peerDependencies dropped on re-emit:\n{written}"
);
assert!(
written.contains("\"react\""),
"workspace peerDependencies.react dropped on re-emit:\n{written}"
);
}