@effected/lockfiles 0.1.10 → 0.2.0

package/ImporterDependency.js

@@ -12,11 +12,20 @@ import { DependencyField, DependencySpecifier } from "@effected/npm";
 *   `ClassifiedSpecifier` (`catalog:` / `workspace:` / range / dist-tag / raw),
 *   while encoding round-trips the **exact original string byte-for-byte** — the
 *   guarantee a before/after lockfile diff relies on.
-* - `version` — the concrete resolved version, **populated by pnpm only**. pnpm
-*   records `{ specifier, version }` per importer dependency; bun and npm record
-*   resolved versions on their package entries instead, so for those formats
-*   `version` is absent and a consumer joins by `name` against
-*   `Lockfile.packages`.
+* - `version` — the concrete resolved version, **populated by pnpm only**:
+*   comparable across refs and printable. pnpm records `{ specifier, version }`
+*   per importer dependency, and the parser splits pnpm's peer-disambiguation
+*   suffix off into `peerSuffix`, so `version` is always the plain version — or
+*   a non-registry resolution (`link:../utils`, `file:...`), passed through
+*   verbatim. bun and npm record resolved versions on their package entries
+*   instead, so for those formats `version` is absent and a consumer joins by
+*   `name` against `Lockfile.packages`.
+* - `peerSuffix` — pnpm's peer-disambiguation context: the raw parenthesized
+*   chain the lockfile recorded after the version, e.g.
+*   `(effect@4.0.0-beta.101)(ioredis@5.11.1(supports-color@8.1.1))`. Present
+*   only when the lockfile recorded one — never for suffix-free pnpm entries,
+*   and never for the other formats, which do not record peer context per
+*   importer dependency.
 * - `depType` — which dependency map declared it, spelled with `@effected/npm`'s
 *   kit-wide `DependencyField` vocabulary.
 *
@@ -26,6 +35,7 @@ var ImporterDependency = class extends Schema.Class("ImporterDependency")({
 	name: Schema.NonEmptyString,
 	specifier: DependencySpecifier.FromString,
 	version: Schema.optionalKey(Schema.String),
+	peerSuffix: Schema.optionalKey(Schema.String),
 	depType: DependencyField
 }) {};
 

package/index.d.ts

@@ -26,6 +26,7 @@ declare const ImporterDependency_base: Schema.Class<ImporterDependency, Schema.S
   readonly name: Schema.NonEmptyString;
   readonly specifier: Schema.Codec<import("@effected/npm").ClassifiedSpecifier, string, never, never>;
   readonly version: Schema.optionalKey<Schema.String>;
+  readonly peerSuffix: Schema.optionalKey<Schema.String>;
   readonly depType: Schema.Literals<readonly ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]>;
 }>, {}>;
 /**
@@ -38,11 +39,20 @@ declare const ImporterDependency_base: Schema.Class<ImporterDependency, Schema.S
  *   `ClassifiedSpecifier` (`catalog:` / `workspace:` / range / dist-tag / raw),
  *   while encoding round-trips the **exact original string byte-for-byte** — the
  *   guarantee a before/after lockfile diff relies on.
- * - `version` — the concrete resolved version, **populated by pnpm only**. pnpm
- *   records `{ specifier, version }` per importer dependency; bun and npm record
- *   resolved versions on their package entries instead, so for those formats
- *   `version` is absent and a consumer joins by `name` against
- *   `Lockfile.packages`.
+ * - `version` — the concrete resolved version, **populated by pnpm only**:
+ *   comparable across refs and printable. pnpm records `{ specifier, version }`
+ *   per importer dependency, and the parser splits pnpm's peer-disambiguation
+ *   suffix off into `peerSuffix`, so `version` is always the plain version — or
+ *   a non-registry resolution (`link:../utils`, `file:...`), passed through
+ *   verbatim. bun and npm record resolved versions on their package entries
+ *   instead, so for those formats `version` is absent and a consumer joins by
+ *   `name` against `Lockfile.packages`.
+ * - `peerSuffix` — pnpm's peer-disambiguation context: the raw parenthesized
+ *   chain the lockfile recorded after the version, e.g.
+ *   `(effect@4.0.0-beta.101)(ioredis@5.11.1(supports-color@8.1.1))`. Present
+ *   only when the lockfile recorded one — never for suffix-free pnpm entries,
+ *   and never for the other formats, which do not record peer context per
+ *   importer dependency.
  * - `depType` — which dependency map declared it, spelled with `@effected/npm`'s
  *   kit-wide `DependencyField` vocabulary.
  *

package/internal/pnpm.js

@@ -1,6 +1,6 @@
 import { LockfileImporter } from "../LockfileImporter.js";
 import { ResolvedPackage } from "../ResolvedPackage.js";
-import { extractWorkspaceDeps, framingFailure, importerDependencies, toIntegrityHash, validationFailure } from "./shared.js";
+import { extractWorkspaceDeps, framingFailure, importerDependencies, splitPeerSuffix, toIntegrityHash, validationFailure } from "./shared.js";
 import { PnpmExtension } from "../PnpmExtension.js";
 import { selectPnpmDocument } from "./documents.js";
 import { Effect, Schema } from "effect";
@@ -102,8 +102,7 @@ const toFields = (raw) => Effect.gen(function* () {
 		}));
 	}
 	if (raw.packages) for (const [key, pkg] of Object.entries(raw.packages)) {
-		const parenIndex = key.indexOf("(");
-		const bare = parenIndex === -1 ? key : key.slice(0, parenIndex);
+		const { plain: bare } = splitPeerSuffix(key);
 		const atIndex = bare.lastIndexOf("@");
 		if (atIndex <= 0) continue;
 		const name = bare.slice(0, atIndex);

package/internal/shared.js

@@ -42,22 +42,54 @@ const toIntegrityHash = (raw) => {
 };
 const decodeSpecifier = Schema.decodeUnknownExit(DependencySpecifier.FromString);
 /**
+* Split pnpm's peer-disambiguation suffix off a recorded string: everything
+* from the first `(` on is suffix, since package names and versions never
+* contain `(`. Handles both shapes pnpm records — a bare version
+* (`"1.0.0(effect@4.0.0)"`, importer entries) and a `name@version` snapshot key
+* (`"fdir@6.5.0(picomatch@4.0.4)"`). A string with no `(` — including
+* `link:...` / `file:...` resolutions — passes through untouched. So does a
+* protocol-bearing string (a `:` ahead of the first `(`), where a parenthesis
+* is path or URL text rather than a peer suffix: pnpm attaches suffixes to
+* registry versions only. This is the single stripping implementation — do not
+* hand-roll an `indexOf("(")` split elsewhere.
+*
+* @internal
+*/
+const splitPeerSuffix = (raw) => {
+	const parenIndex = raw.indexOf("(");
+	if (parenIndex === -1) return { plain: raw };
+	if (raw.lastIndexOf(":", parenIndex) !== -1) return { plain: raw };
+	return {
+		plain: raw.slice(0, parenIndex),
+		peerSuffix: raw.slice(parenIndex)
+	};
+};
+/**
 * Build one {@link ImporterDependency}, decoding the raw specifier string into
 * the `@effected/npm` `ClassifiedSpecifier` tagged union. Returns `undefined`
 * — a skip, never a throw — when the name is empty or the specifier does not
 * classify (e.g. an empty specifier), per the total-string-surgery discipline.
 *
+* A pnpm-recorded version is normalized through {@link splitPeerSuffix}: the
+* `version` field carries the plain version and the split-off peer chain lands
+* in `peerSuffix`. A version that is *only* a peer chain (empty plain part) is
+* treated as no concrete version — a skip of both fields, never a throw.
+*
 * @internal
 */
 const buildImporterDependency = (name, specifier, depType, version) => {
 	if (name === "") return void 0;
 	const exit = decodeSpecifier(specifier);
 	if (Exit.isFailure(exit)) return void 0;
+	const resolved = version !== void 0 && version !== "" ? splitPeerSuffix(version) : void 0;
 	return ImporterDependency.make({
 		name,
 		specifier: exit.value,
 		depType,
-		...version !== void 0 && version !== "" ? { version } : {}
+		...resolved !== void 0 && resolved.plain !== "" ? {
+			version: resolved.plain,
+			...resolved.peerSuffix !== void 0 ? { peerSuffix: resolved.peerSuffix } : {}
+		} : {}
 	});
 };
 /**
@@ -130,4 +162,4 @@ const extractWorkspaceDeps = (workspaces, workspaceNames) => {
 };
 
 //#endregion
-export { DEP_TYPES, extractWorkspaceDeps, framingFailure, importerDependencies, isWorkspaceSpecifier, syntaxFailure, toIntegrityHash, validationFailure };
+export { DEP_TYPES, extractWorkspaceDeps, framingFailure, importerDependencies, isWorkspaceSpecifier, splitPeerSuffix, syntaxFailure, toIntegrityHash, validationFailure };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/lockfiles",
-	"version": "0.1.10",
+	"version": "0.2.0",
 	"private": false,
 	"description": "Pure lockfile parsing for bun, npm, pnpm and yarn Berry into one unified Effect schema model, with pure integrity checking against workspace manifests.",
 	"keywords": [
@@ -41,9 +41,9 @@
 	},
 	"peerDependencies": {
 		"@effected/jsonc": "~0.5.1",
-		"@effected/npm": "~0.3.1",
+		"@effected/npm": "~0.4.0",
 		"@effected/semver": "~0.2.1",
-		"@effected/yaml": "~0.5.1",
+		"@effected/yaml": "~0.6.0",
 		"effect": "4.0.0-beta.101"
 	},
 	"engines": {