Struct LockedPackage 

pub struct LockedPackage {

    pub name: String,
    pub version: String,
    pub integrity: Option<String>,
    pub dependencies: BTreeMap<String, String>,
    pub optional_dependencies: BTreeMap<String, String>,
    pub peer_dependencies: BTreeMap<String, String>,
    pub peer_dependencies_meta: BTreeMap<String, PeerDepMeta>,
    pub dep_path: String,
    pub local_source: Option<LocalSource>,
    pub os: PlatformList,
    pub cpu: PlatformList,
    pub libc: PlatformList,
    pub bundled_dependencies: Vec<String>,
    pub tarball_url: Option<String>,
    pub registry_git_hosted: bool,
    pub alias_of: Option<String>,
    pub yarn_checksum: Option<String>,
    pub engines: BTreeMap<String, String>,
    pub bin: BTreeMap<String, String>,
    pub declared_dependencies: BTreeMap<String, String>,
    pub license: Option<String>,
    pub funding_url: Option<String>,
    pub optional: bool,
    pub transitive_peer_dependencies: Vec<String>,
    pub extra_meta: BTreeMap<String, Value>,
}

A single resolved package in the lockfile.

The dependencies map keys are dep names and values are the dependency’s dep_path tail — i.e. the string that follows <name>@. For a plain package this is just the version ("4.17.21"); for a package with its own peer context it includes the suffix ("18.2.0(prop-types@15.8.1)"). Combining the key with its value reproduces the full dep_path (which is also the key in LockfileGraph.packages).

Fields

name: String

Package name (e.g., “lodash”)

version: String

Exact resolved version (e.g., “4.17.21”)

integrity: Option<String>

Integrity hash (e.g., “sha512-…”)

dependencies: BTreeMap<String, String>

Dependencies of this package (name -> dep_path tail, see struct docs)

optional_dependencies: BTreeMap<String, String>

Optional dependency edges for this package. Active optional edges are also mirrored in dependencies so graph walks and the linker continue to see them; this separate map lets platform filtering prune optional edges without touching regular dependencies.

peer_dependencies: BTreeMap<String, String>

Peer dependency ranges as declared by the package (from its package.json / packument). These are the constraints; the resolved versions live in dependencies after the peer-context pass runs.

peer_dependencies_meta: BTreeMap<String, PeerDepMeta>

peerDependenciesMeta entries, keyed by peer name.

dep_path: String

The dep_path key used in the lockfile. For packages with resolved peer contexts this includes the suffix, e.g. "styled-components@6.1.0(react@18.2.0)".

local_source: Option<LocalSource>

Set for non-registry packages (those installed via file: or link: specifiers). None for the common case of a package resolved from an npm registry, where integrity is the full record of where the bits came from.

os: PlatformList

os / cpu / libc arrays from the package’s manifest. Used by the resolver to filter optional deps that can’t run on the current (or user-overridden) platform. Empty arrays mean no constraint.

cpu: PlatformList

libc: PlatformList

bundled_dependencies: Vec<String>

Names declared in the package’s own bundledDependencies. These ship inside the parent tarball’s node_modules/, so the resolver neither fetches nor recurses into them, and the linker avoids creating sibling symlinks that would shadow the bundled tree. An empty Vec means “no bundled deps”; None is kept as a distinct value only inside the resolver and collapsed to empty here because the lockfile round-trip doesn’t need to preserve the “unset” vs “empty list” distinction.

tarball_url: Option<String>

Full registry tarball URL for registry-sourced packages. Only populated when LockfileSettings::lockfile_include_tarball_url is active on this graph; otherwise None and the lockfile writer derives the URL at fetch time from the configured registry. local_source-backed packages (file:, link:, git:, remote tarball) already carry their own URL via LocalSource and don’t populate this field.

registry_git_hosted: bool

pnpm resolution.gitHosted for registry-keyed packages. Remote tarball sources carry the same flag on RemoteTarballSource, but registry entries keep local_source: None, so this field preserves third-party pnpm lockfiles that mark registry-shaped tarballs as hosted git.

alias_of: Option<String>

For npm-alias deps ("h3-v2": "npm:h3@2.0.1-rc.20"): the real package name on the registry ("h3"). None means the entry is not aliased and name already holds the registry name.

Install semantics when Some(real):

• name is the alias — that’s the folder under node_modules/, the symlink name for transitive deps, and the key every package that declares this dep refers to.
• alias_of is the real package name used for tarball URL lookup, store index keying, and packument fetches.
• version is the real resolved version.

registry_name() returns the right name for registry IO; every call site that talks to the registry or the CAS uses that helper.

yarn_checksum: Option<String>

Yarn berry’s checksum: field, preserved verbatim when parsing a yarn 2+ lockfile (e.g. "10c0/<blake2b-hex>"). The format is yarn-specific — it uses a yarn-chosen hash family prefixed with the cacheKey that produced it — and doesn’t share a hash algorithm with integrity (sha-512). When re-emitting a yarn berry lockfile we write this field back as-is; packages that didn’t come through a berry parse (e.g. freshly-resolved entries in a new install) leave this None and the writer omits the checksum: field, which berry tolerates at the default checksumBehavior: throw when the cache is fresh.

engines: BTreeMap<String, String>

engines: from the package’s manifest, round-tripped through the lockfile so pnpm-style writers can emit the same flow-form engines: {node: '>=8'} line pnpm writes. Empty map means “no engines declared” — the writer skips the field entirely.

bin: BTreeMap<String, String>

bin: map from the package’s manifest, normalized to name → path. An empty map means “no bins declared”.

pnpm-style writers derive hasBin: true from !bin.is_empty() (they don’t preserve the names/paths); bun’s format emits the full map on the package’s meta block. Keeping the map here lets both writers render byte-identical output without an extra tarball-level re-parse.

declared_dependencies: BTreeMap<String, String>

Dependency ranges as declared in this package’s own package.json — keyed by dep name, values are the raw specifiers ("^4.1.0", "~1.1.4", "workspace:*", …).

Distinct from Self::dependencies, which stores the resolved dep_path tail ("4.3.0"). npm / yarn / bun lockfiles preserve the declared ranges on every nested package entry — rewriting them to the resolved pins is the biggest source of round-trip churn against those formats. This map lets writers emit the declared range when available and fall back to the resolved pin otherwise (e.g. when the source lockfile was pnpm, whose snapshots: only carries pins).

Empty means “unknown” — writers should fall back to pins. Covers production and optional dependencies in one map since a package can’t declare the same name twice across those sections.

license: Option<String>

Package’s license field, collapsed to the simple string form. Round-tripped so npm’s lockfile keeps its per-entry "license": "MIT" line; pnpm / yarn / bun don’t record licenses and leave this None on parse.

funding_url: Option<String>

Package’s funding URL, extracted from whatever shape the manifest’s funding: field took (string / object / array). Round-tripped so npm’s lockfile keeps its per-entry "funding": {"url": "…"} block.

optional: bool

pnpm snapshots: optional: true flag, marking a package reachable only through optional edges (typically platform- specific binaries like @reflink/reflink-darwin-arm64). pnpm uses this on the next install to decide whether the entry should be skipped on a non-matching platform; dropping it on round-trip would let pnpm treat the package as required. Always false outside the pnpm parse/write path.

transitive_peer_dependencies: Vec<String>

pnpm snapshots: transitivePeerDependencies: list — peer names that bubble up transitively through this package. pnpm reads it during hoisting and as a resolver staleness signal (resolveDependencies.ts’s non-zero-length check); a missing list looks like a graph change and triggers needless re- resolution on the next pnpm install. Empty outside the pnpm parse/write path. Fresh resolves leave this empty too — pnpm recomputes it from the graph during resolvePeers when needed.

extra_meta: BTreeMap<String, Value>

Per-package-meta extras preserved verbatim from the source lockfile. Captures fields the typed model doesn’t yet cover (deprecated, hasInstallScript, bun’s optionalPeers, and anything a future lockfile bump adds) so a parse/write cycle doesn’t drop them. Each format’s writer re-emits what makes sense there — bun inlines the extras back on the package-entry meta object, pnpm / yarn / npm currently ignore them.

Implementations

impl LockedPackage

pub fn registry_name(&self) -> &str

The package name to use for registry / store operations — the real name behind an npm-alias when aliased, otherwise just name. Used at every site that derives a tarball URL, a packument URL, or an aube-store cache key so aliased entries hit the actual package instead of the alias-qualified name.

pub fn spec_key(&self) -> String

Canonical "name@version" key used as a handle in patches, approve-builds prompts, lockfile canonical maps, and display paths. Not the dep-path — that includes peer-context suffixes.

pub fn source_approval_key(&self) -> Option<String>

Exact approval key for non-registry package sources.

Name-wide build approvals are only trustworthy for packages fetched from a registry. Source-backed entries need to be approved by their source identity as pnpm records it in lockfile keys / allowBuilds placeholders.

pub fn peer_dependencies_with_meta_defaults(&self) -> BTreeMap<String, String>

Declared peer ranges with pnpm’s meta-only peers folded in as *.

pnpm records a peerDependencies: { x: '*' } entry for every peerDependenciesMeta key a package ships without an explicit range (debug’s optional supports-color, typescript-eslint’s optional typescript, …). This returns peer_dependencies with those meta-only keys added as * — both what the pnpm writer emits in packages: and the “declared peers” set the transitive-peer pass subtracts resolved deps from. Centralizing the rule keeps the writer and the resolver’s transitive-peer pass from drifting.

Trait Implementations

impl Clone for LockedPackage

fn clone(&self) -> LockedPackage

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LockedPackage

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LockedPackage

fn default() -> LockedPackage

Returns the “default value” for a type.