Struct VersionMetadata 

pub struct VersionMetadata {

    pub name: String,
    pub version: String,
    pub dependencies: BTreeMap<String, String>,
    pub dev_dependencies: BTreeMap<String, String>,
    pub peer_dependencies: BTreeMap<String, String>,
    pub peer_dependencies_meta: BTreeMap<String, PeerDepMeta>,
    pub optional_dependencies: BTreeMap<String, String>,
    pub bundled_dependencies: Option<BundledDependencies>,
    pub dist: Option<Dist>,
    pub os: Vec<String>,
    pub cpu: Vec<String>,
    pub libc: Vec<String>,
    pub engines: BTreeMap<String, String>,
    pub license: Option<String>,
    pub funding_url: Option<String>,
    pub bin: BTreeMap<String, String>,
    pub has_install_script: bool,
    pub deprecated: Option<String>,
    pub approver: Option<Value>,
    pub npm_user: Option<NpmUser>,
}

Metadata for a specific version of a package.

Deserializes via VersionMetadataRaw (#[serde(from = ...)]) so that publishes carrying both bundledDependencies (canonical) and bundleDependencies (deprecated alias) parse cleanly. serde’s plain #[serde(alias = ...)] rejects that as a duplicate field, which blocks installs of every version of every package that ships both keys (e.g. @lingui/message-utils@>=5.2.0).

Fields

name: String

version: String

dependencies: BTreeMap<String, String>

dev_dependencies: BTreeMap<String, String>

peer_dependencies: BTreeMap<String, String>

peer_dependencies_meta: BTreeMap<String, PeerDepMeta>

optional_dependencies: BTreeMap<String, String>

bundled_dependencies: Option<BundledDependencies>

bundledDependencies from the packument. Either a list of dep names or true (meaning “bundle every dependencies entry”). Packages listed here are shipped inside the parent tarball, so the resolver must not recurse into them. npm serializes this under both bundledDependencies and bundleDependencies; on deserialize we accept either, and prefer the canonical when both are present (handled in VersionMetadataRaw).

dist: Option<Dist>

os: Vec<String>

cpu: Vec<String>

libc: Vec<String>

engines: BTreeMap<String, String>

engines: from the package manifest (e.g. {node: ">=8"}). Round-tripped into the lockfile so pnpm-compatible output can emit engines: {node: '>=8'} on package entries without a packument re-fetch.

Uses aube_manifest::engines_tolerant so the legacy pre-npm-2.x array shape (e.g. madge@0.0.1 and html-entities@1.x ship "engines": ["node >= 0.8.0"]) doesn’t blow up the whole packument — one such version would otherwise block install of any range that touches the packument, even when the user’s selector doesn’t pick that version. Array normalizes to an empty map, matching the manifest and lockfile parsers.

license: Option<String>

license: field from the package manifest. npm’s lockfile keeps this per-package; other formats don’t. Stored as Option<String> because packuments can emit a bare string ("MIT"), an SPDX object, or nothing at all — we only keep the simple case for lockfile round-trip. Non-string shapes degrade to None rather than failing to parse the packument.

funding_url: Option<String>

funding: URL extracted from the manifest’s funding field. The field is documented as a string or an object with a url: key or an array of either — npm’s lockfile normalizes to {url: …}, so we only keep the URL and let the writer emit the wrapping object. Serde rename because rename_all = "camelCase" would otherwise look for fundingUrl in the JSON.

bin: BTreeMap<String, String>

bin: map from the packument, normalized to name → path.

npm records bin in two shapes on a manifest: a string ("bin": "cli.js" — implicitly named after the package) or a map ("bin": {"foo": "cli.js"} — explicitly named). We normalize to the map form at parse time so downstream callers don’t have to branch: an empty map means “no bins”.

pnpm collapses this to hasBin: true on its package entries; bun preserves the full map on its per-package meta. Keeping the map lets us feed both writers without an extra tarball-level re-parse.

has_install_script: bool

deprecated: Option<String>

Deprecation message from the registry, if this version is deprecated.

approver: Option<Value>

npm staged-publish approval metadata. When present, the resolver treats it as the strongest trust evidence because the publish went through a registry-side approval flow.

npm_user: Option<NpmUser>

_npmUser block from the packument, when present. The trust-policy check reads _npmUser.trustedPublisher as the strongest trust-evidence signal (npm’s “trusted publishers” feature, OIDC-backed). Some old packuments emit _npmUser as a "name <email>" string rather than an object — that shape degrades to None instead of failing the whole packument.

Trait Implementations

impl Clone for VersionMetadata

fn clone(&self) -> VersionMetadata

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VersionMetadata

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for VersionMetadata

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for VersionMetadata

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.