@simplysm/sd-cli 14.1.8 → 14.1.10

package/tests/capacitor/capacitor-npm-config.acc.spec.ts

@@ -1,114 +1,114 @@
-import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from "vitest";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { fsx, cpx } from "@simplysm/core-node";
-
-const mockFsxExists = vi.spyOn(fsx, "exists");
-vi.spyOn(fsx, "read");
-vi.spyOn(fsx, "write").mockResolvedValue(undefined);
-const mockFsxReadJson = vi.spyOn(fsx, "readJson");
-vi.spyOn(fsx, "writeJson").mockResolvedValue(undefined);
-vi.spyOn(fsx, "mkdir").mockResolvedValue(undefined);
-
-const execaCalls: { command: string; args: string[]; options: unknown }[] = [];
-vi.spyOn(cpx, "spawn").mockImplementation(((cmd: string, args: string[], options: unknown) => {
-  execaCalls.push({
-    command: cmd,
-    args,
-    options,
-  });
-  return { stdout: "", stderr: "", exitCode: 0 };
-}) as never);
-
-//#endregion
-
-let tmpRoot: string;
-let CAP_PATH: string;
-let PKG_PATH: string;
-
-beforeAll(() => {
-  tmpRoot = mkdtempSync(path.join(tmpdir(), "cap-npm-config-acc-"));
-  writeFileSync(path.join(tmpRoot, "pnpm-workspace.yaml"), "");
-  PKG_PATH = path.join(tmpRoot, "pkg");
-  CAP_PATH = path.join(PKG_PATH, ".capacitor");
-});
-
-afterAll(() => {
-  rmSync(tmpRoot, { recursive: true, force: true });
-});
-
-function setupDefaultMocks() {
-  mockFsxExists.mockImplementation(((p: string) => {
-    const n = p.replace(/\\/g, "/");
-    if (n.includes(".capacitor.lock")) return false;
-    return true;
-  }) as never);
-
-  mockFsxReadJson.mockImplementation(((p: string) => {
-    const normalized = p.replace(/\\/g, "/");
-    if (normalized.includes(".capacitor/package.json")) {
-      return {
-        name: "com.test.app",
-        version: "1.0.0",
-        dependencies: {
-          "@capacitor/core": "^7",
-          "@capacitor/app": "^7",
-          "@capacitor/android": "^7",
-        },
-        devDependencies: {
-          "@capacitor/cli": "^7",
-          "@capacitor/assets": "^3",
-        },
-      };
-    }
-    return { name: "test-pkg", version: "1.0.0" };
-  }) as never);
-
-  execaCalls.length = 0;
-}
-
-describe("initCapNpmProject", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    setupDefaultMocks();
-  });
-
-  it("의존성 미변경 + node_modules 존재 시 false를 반환하고 pnpm install을 실행하지 않는다", async () => {
-    const { initCapNpmProject } = await import(
-      "../../src/capacitor/capacitor-npm-config.js"
-    );
-
-    const changed = await initCapNpmProject(CAP_PATH, PKG_PATH, {
-      appId: "com.test.app",
-      appName: "Test App",
-      platform: { android: {} },
-    }, { name: "test-pkg", version: "1.0.0" }, ["android"], []);
-
-    expect(changed).toBe(false);
-  });
-
-  it("node_modules가 없으면 true를 반환하고 pnpm install을 실행한다", async () => {
-    mockFsxExists.mockImplementation(((p: string) => {
-      const n = p.replace(/\\/g, "/");
-      if (n.includes(".capacitor.lock")) return false;
-      if (n.includes("node_modules")) return false;
-      return true;
-    }) as never);
-
-    const { initCapNpmProject } = await import(
-      "../../src/capacitor/capacitor-npm-config.js"
-    );
-
-    const changed = await initCapNpmProject(CAP_PATH, PKG_PATH, {
-      appId: "com.test.app",
-      appName: "Test App",
-      platform: { android: {} },
-    }, {
-      name: "test-pkg",
-      version: "1.0.0",
-    }, ["android"], []);
-
-    expect(changed).toBe(true);
-  });
-});
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fsx, cpx } from "@simplysm/core-node";
+
+const mockFsxExists = vi.spyOn(fsx, "exists");
+vi.spyOn(fsx, "read");
+vi.spyOn(fsx, "write").mockResolvedValue(undefined);
+const mockFsxReadJson = vi.spyOn(fsx, "readJson");
+vi.spyOn(fsx, "writeJson").mockResolvedValue(undefined);
+vi.spyOn(fsx, "mkdir").mockResolvedValue(undefined);
+
+const execaCalls: { command: string; args: string[]; options: unknown }[] = [];
+vi.spyOn(cpx, "spawn").mockImplementation(((cmd: string, args: string[], options: unknown) => {
+  execaCalls.push({
+    command: cmd,
+    args,
+    options,
+  });
+  return { stdout: "", stderr: "", exitCode: 0 };
+}) as never);
+
+//#endregion
+
+let tmpRoot: string;
+let CAP_PATH: string;
+let PKG_PATH: string;
+
+beforeAll(() => {
+  tmpRoot = mkdtempSync(path.join(tmpdir(), "cap-npm-config-acc-"));
+  writeFileSync(path.join(tmpRoot, "package.json"), JSON.stringify({ private: true, workspaces: ["pkg"] }));
+  PKG_PATH = path.join(tmpRoot, "pkg");
+  CAP_PATH = path.join(PKG_PATH, ".capacitor");
+});
+
+afterAll(() => {
+  rmSync(tmpRoot, { recursive: true, force: true });
+});
+
+function setupDefaultMocks() {
+  mockFsxExists.mockImplementation(((p: string) => {
+    const n = p.replace(/\\/g, "/");
+    if (n.includes(".capacitor.lock")) return false;
+    return true;
+  }) as never);
+
+  mockFsxReadJson.mockImplementation(((p: string) => {
+    const normalized = p.replace(/\\/g, "/");
+    if (normalized.includes(".capacitor/package.json")) {
+      return {
+        name: "com.test.app",
+        version: "1.0.0",
+        dependencies: {
+          "@capacitor/core": "^7",
+          "@capacitor/app": "^7",
+          "@capacitor/android": "^7",
+        },
+        devDependencies: {
+          "@capacitor/cli": "^7",
+          "@capacitor/assets": "^3",
+        },
+      };
+    }
+    return { name: "test-pkg", version: "1.0.0" };
+  }) as never);
+
+  execaCalls.length = 0;
+}
+
+describe("initCapNpmProject", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    setupDefaultMocks();
+  });
+
+  it("의존성 미변경 + node_modules 존재 시 false를 반환하고 bun install을 실행하지 않는다", async () => {
+    const { initCapNpmProject } = await import(
+      "../../src/capacitor/capacitor-npm-config.js"
+    );
+
+    const changed = await initCapNpmProject(CAP_PATH, PKG_PATH, {
+      appId: "com.test.app",
+      appName: "Test App",
+      platform: { android: {} },
+    }, { name: "test-pkg", version: "1.0.0" }, ["android"], []);
+
+    expect(changed).toBe(false);
+  });
+
+  it("node_modules가 없으면 true를 반환하고 bun install을 실행한다", async () => {
+    mockFsxExists.mockImplementation(((p: string) => {
+      const n = p.replace(/\\/g, "/");
+      if (n.includes(".capacitor.lock")) return false;
+      if (n.includes("node_modules")) return false;
+      return true;
+    }) as never);
+
+    const { initCapNpmProject } = await import(
+      "../../src/capacitor/capacitor-npm-config.js"
+    );
+
+    const changed = await initCapNpmProject(CAP_PATH, PKG_PATH, {
+      appId: "com.test.app",
+      appName: "Test App",
+      platform: { android: {} },
+    }, {
+      name: "test-pkg",
+      version: "1.0.0",
+    }, ["android"], []);
+
+    expect(changed).toBe(true);
+  });
+});

package/tests/capacitor/capacitor-npm-config.spec.ts

@@ -1,94 +1,94 @@
-import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from "vitest";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { fsx, cpx } from "@simplysm/core-node";
-
-const mockFsxExists = vi.spyOn(fsx, "exists");
-vi.spyOn(fsx, "write").mockResolvedValue(undefined);
-const mockFsxReadJson = vi.spyOn(fsx, "readJson");
-vi.spyOn(fsx, "writeJson").mockResolvedValue(undefined);
-vi.spyOn(fsx, "mkdir").mockResolvedValue(undefined);
-vi.spyOn(fsx, "read");
-
-vi.spyOn(cpx, "spawn").mockResolvedValue({ stdout: "", stderr: "", exitCode: 0 });
-
-let tmpRoot: string;
-let CAP_PATH: string;
-let PKG_PATH: string;
-
-beforeAll(() => {
-  tmpRoot = mkdtempSync(path.join(tmpdir(), "cap-npm-config-"));
-  writeFileSync(path.join(tmpRoot, "pnpm-workspace.yaml"), "");
-  PKG_PATH = path.join(tmpRoot, "pkg");
-  CAP_PATH = path.join(PKG_PATH, ".capacitor");
-});
-
-afterAll(() => {
-  rmSync(tmpRoot, { recursive: true, force: true });
-});
-
-describe("setupCapNpmConfig", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-    mockFsxExists.mockResolvedValue(true);
-    mockFsxReadJson.mockImplementation(((p: string) => {
-      const normalized = p.replace(/\\/g, "/");
-      if (normalized.includes(".capacitor/package.json")) {
-        return {
-          name: "com.test.app",
-          version: "1.0.0",
-          dependencies: {
-            "@capacitor/core": "^7",
-            "@capacitor/app": "^7",
-            "@capacitor/android": "^7",
-          },
-          devDependencies: {
-            "@capacitor/cli": "^7",
-            "@capacitor/assets": "^3",
-          },
-        };
-      }
-      return { name: "test-pkg", version: "1.0.0" };
-    }) as never);
-  });
-
-  it("루트 package.json이 없으면 에러를 던진다", async () => {
-    mockFsxExists.mockImplementation(((p: string) => {
-      const n = p.replace(/\\/g, "/");
-      if (n.endsWith("package.json") && !n.includes(".capacitor")) return false;
-      return true;
-    }) as never);
-
-    const { setupCapNpmConfig } = await import(
-      "../../src/capacitor/capacitor-npm-config.js"
-    );
-
-    await expect(
-      setupCapNpmConfig(CAP_PATH, PKG_PATH, {
-        appId: "com.test.app",
-        appName: "Test App",
-      }, { name: "test-pkg", version: "1.0.0" }, [], []),
-    ).rejects.toThrow("루트 package.json");
-  });
-
-  it(".capacitor/package.json이 없으면 빈 설정으로 시작한다", async () => {
-    mockFsxExists.mockImplementation(((p: string) => {
-      const n = p.replace(/\\/g, "/");
-      if (n.includes(".capacitor/package.json")) return false;
-      return true;
-    }) as never);
-
-    const { setupCapNpmConfig } = await import(
-      "../../src/capacitor/capacitor-npm-config.js"
-    );
-
-    const changed = await setupCapNpmConfig(CAP_PATH, PKG_PATH, {
-      appId: "com.test.app",
-      appName: "Test App",
-    }, { name: "test-pkg", version: "1.0.0" }, [], []);
-
-    // 빈 설정에서 시작하므로 dependencies가 추가되어 변경됨
-    expect(changed).toBe(true);
-  });
-});
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fsx, cpx } from "@simplysm/core-node";
+
+const mockFsxExists = vi.spyOn(fsx, "exists");
+vi.spyOn(fsx, "write").mockResolvedValue(undefined);
+const mockFsxReadJson = vi.spyOn(fsx, "readJson");
+vi.spyOn(fsx, "writeJson").mockResolvedValue(undefined);
+vi.spyOn(fsx, "mkdir").mockResolvedValue(undefined);
+vi.spyOn(fsx, "read");
+
+vi.spyOn(cpx, "spawn").mockResolvedValue({ stdout: "", stderr: "", exitCode: 0 });
+
+let tmpRoot: string;
+let CAP_PATH: string;
+let PKG_PATH: string;
+
+beforeAll(() => {
+  tmpRoot = mkdtempSync(path.join(tmpdir(), "cap-npm-config-"));
+  writeFileSync(path.join(tmpRoot, "package.json"), JSON.stringify({ private: true, workspaces: ["pkg"] }));
+  PKG_PATH = path.join(tmpRoot, "pkg");
+  CAP_PATH = path.join(PKG_PATH, ".capacitor");
+});
+
+afterAll(() => {
+  rmSync(tmpRoot, { recursive: true, force: true });
+});
+
+describe("setupCapNpmConfig", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockFsxExists.mockResolvedValue(true);
+    mockFsxReadJson.mockImplementation(((p: string) => {
+      const normalized = p.replace(/\\/g, "/");
+      if (normalized.includes(".capacitor/package.json")) {
+        return {
+          name: "com.test.app",
+          version: "1.0.0",
+          dependencies: {
+            "@capacitor/core": "^7",
+            "@capacitor/app": "^7",
+            "@capacitor/android": "^7",
+          },
+          devDependencies: {
+            "@capacitor/cli": "^7",
+            "@capacitor/assets": "^3",
+          },
+        };
+      }
+      return { name: "test-pkg", version: "1.0.0" };
+    }) as never);
+  });
+
+  it("루트 package.json이 없으면 에러를 던진다", async () => {
+    mockFsxExists.mockImplementation(((p: string) => {
+      const n = p.replace(/\\/g, "/");
+      if (n.endsWith("package.json") && !n.includes(".capacitor")) return false;
+      return true;
+    }) as never);
+
+    const { setupCapNpmConfig } = await import(
+      "../../src/capacitor/capacitor-npm-config.js"
+    );
+
+    await expect(
+      setupCapNpmConfig(CAP_PATH, PKG_PATH, {
+        appId: "com.test.app",
+        appName: "Test App",
+      }, { name: "test-pkg", version: "1.0.0" }, [], []),
+    ).rejects.toThrow("루트 package.json");
+  });
+
+  it(".capacitor/package.json이 없으면 빈 설정으로 시작한다", async () => {
+    mockFsxExists.mockImplementation(((p: string) => {
+      const n = p.replace(/\\/g, "/");
+      if (n.includes(".capacitor/package.json")) return false;
+      return true;
+    }) as never);
+
+    const { setupCapNpmConfig } = await import(
+      "../../src/capacitor/capacitor-npm-config.js"
+    );
+
+    const changed = await setupCapNpmConfig(CAP_PATH, PKG_PATH, {
+      appId: "com.test.app",
+      appName: "Test App",
+    }, { name: "test-pkg", version: "1.0.0" }, [], []);
+
+    // 빈 설정에서 시작하므로 dependencies가 추가되어 변경됨
+    expect(changed).toBe(true);
+  });
+});

package/tests/commands/publish-manifest.acc.spec.ts

@@ -0,0 +1,67 @@
+import { afterEach, describe, expect, it } from "vitest";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { fileURLToPath } from "url";
+import { gunzipSync } from "zlib";
+import { cpx } from "@simplysm/core-node";
+
+const tmpDirs: string[] = [];
+
+function readTarEntry(tgzPath: string, entryName: string): string {
+  const tarBuffer = gunzipSync(fs.readFileSync(tgzPath));
+  let offset = 0;
+
+  while (offset + 512 <= tarBuffer.length) {
+    const header = tarBuffer.subarray(offset, offset + 512);
+    const name = header.toString("utf-8", 0, 100).replace(/\0.*$/s, "");
+    if (name === "") break;
+
+    const sizeText = header.toString("utf-8", 124, 136).replace(/\0.*$/s, "").trim();
+    const size = Number.parseInt(sizeText, 8);
+    const dataStart = offset + 512;
+    const dataEnd = dataStart + size;
+
+    if (name === entryName) {
+      return tarBuffer.toString("utf-8", dataStart, dataEnd);
+    }
+
+    offset = dataStart + Math.ceil(size / 512) * 512;
+  }
+
+  throw new Error(`tar entry not found: ${entryName}`);
+}
+
+afterEach(() => {
+  for (const dir of tmpDirs.splice(0)) {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+describe("npm package manifest", () => {
+  it("keeps CLI binary and replaces workspace dependency ranges in Bun pack output", async () => {
+    const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+    const destination = fs.mkdtempSync(path.join(os.tmpdir(), "sd-cli-pack-"));
+    tmpDirs.push(destination);
+
+    await cpx.spawn(
+      "bun",
+      ["pm", "pack", "--destination", destination, "--ignore-scripts", "--quiet"],
+      { cwd: pkgRoot },
+    );
+
+    const tarball = fs.readdirSync(destination).find((item) => item.endsWith(".tgz"));
+    if (tarball == null) throw new Error("package tarball not created");
+
+    const packedPackageJson = JSON.parse(
+      readTarEntry(path.join(destination, tarball), "package/package.json"),
+    ) as Record<string, unknown>;
+    const bin = packedPackageJson["bin"] as Record<string, unknown>;
+    const dependencies = packedPackageJson["dependencies"] as Record<string, string>;
+
+    expect(bin["sd-cli"]).toBe("./dist/sd-cli.js");
+    expect(dependencies["@simplysm/core-common"]).not.toContain("workspace:");
+    expect(dependencies["@simplysm/core-node"]).not.toContain("workspace:");
+    expect(dependencies["@simplysm/storage"]).not.toContain("workspace:");
+  }, 120_000);
+});

package/tests/deps/replace-deps/collect-deps.acc.spec.ts

@@ -5,11 +5,16 @@ import path from "path";
 import { collectDeps } from "../../../src/deps/replace-deps/collect-deps";
 import { pathx } from "@simplysm/core-node";
 
-describe("collectDeps — tests/ 패키지 제외", () => {
+describe("collectDeps — packages/ 외 워크스페이스 제외", () => {
   let tmpDir: string;
 
   beforeEach(() => {
     tmpDir = pathx.posix(fs.mkdtempSync(path.join(os.tmpdir(), "sd-cli-test-")));
+    // 워크스페이스 루트 선언 (discoverWorkspacePackages는 package.json#workspaces 기반)
+    fs.writeFileSync(
+      pathx.posix(path.join(tmpDir, "package.json")),
+      JSON.stringify({ private: true, workspaces: ["packages/*", "tests/*", "plugins/*"] }),
+    );
   });
 
   afterEach(() => {
@@ -59,4 +64,14 @@ describe("collectDeps — tests/ 패키지 제외", () => {
     expect(result.workspaceDeps).toContain("core-common");
     expect(result.workspaceDeps).not.toContain("orm");
   });
+
+  // Scenario: plugins/ 패키지도 packages/ 가 아니므로 workspaceDeps에서 제외된다
+  it("dependency에 plugins/ 패키지가 있어도 workspaceDeps에서 무시한다", () => {
+    createPkg("packages/my-lib", "@test/my-lib", { "@test/sd": "workspace:*" });
+    createPkg("plugins/sd", "@test/sd");
+
+    const result = collectDeps(pathx.posix(path.join(tmpDir, "packages/my-lib")), tmpDir);
+
+    expect(result.workspaceDeps).not.toContain("sd");
+  });
 });

package/tests/deps/replace-deps/replace-deps-resolve.acc.spec.ts

@@ -16,8 +16,8 @@ describe("resolveAllReplaceDepEntries", () => {
     projectRoot = pathx.posix(path.join(tmpDir, "project"));
     await fs.promises.mkdir(projectRoot, { recursive: true });
     await fs.promises.writeFile(
-      pathx.posix(path.join(projectRoot, "pnpm-workspace.yaml")),
-      "packages:\n",
+      pathx.posix(path.join(projectRoot, "package.json")),
+      JSON.stringify({ private: true, workspaces: [] }),
     );
   });
 
@@ -66,12 +66,16 @@ describe("resolveAllReplaceDepEntries", () => {
     const nodeModulesDir = pathx.posix(path.join(projectRoot, "node_modules"));
     await createNodeModulesPkg(nodeModulesDir, "@test/pkg");
 
-    // workspace 패키지 설정 (pnpm-workspace.yaml에 추가)
+    // workspace 패키지 설정 (package.json#workspaces에 추가)
     const workspacePkgDir = pathx.posix(path.join(projectRoot, "packages", "my-app"));
     await fs.promises.mkdir(workspacePkgDir, { recursive: true });
     await fs.promises.writeFile(
-      pathx.posix(path.join(projectRoot, "pnpm-workspace.yaml")),
-      "packages:\n  - packages/*\n",
+      pathx.posix(path.join(workspacePkgDir, "package.json")),
+      JSON.stringify({ name: "my-app" }),
+    );
+    await fs.promises.writeFile(
+      pathx.posix(path.join(projectRoot, "package.json")),
+      JSON.stringify({ private: true, workspaces: ["packages/*"] }),
     );
 
     // workspace 패키지의 node_modules에도 동일 패키지 생성

package/tests/deps/replace-deps/replace-deps-setup.acc.spec.ts

@@ -11,12 +11,12 @@ describe("setupReplaceDeps 화이트리스트 복사", () => {
   beforeEach(async () => {
     tmpDir = pathx.posix(await fs.promises.mkdtemp(path.join(os.tmpdir(), "sd-replace-deps-")));
 
-    // pnpm-workspace.yaml
+    // package.json#workspaces
     const projectRoot = pathx.posix(path.join(tmpDir, "project"));
     await fs.promises.mkdir(projectRoot, { recursive: true });
     await fs.promises.writeFile(
-      pathx.posix(path.join(projectRoot, "pnpm-workspace.yaml")),
-      "packages:\n",
+      pathx.posix(path.join(projectRoot, "package.json")),
+      JSON.stringify({ private: true, workspaces: [] }),
     );
 
     // 타겟 (node_modules에 기존 패키지)

package/tests/deps/server-externals/server-production-files.spec.ts

@@ -0,0 +1,68 @@
+import { describe, expect, it, afterEach } from "vitest";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import {
+  parseLockfileVersions,
+  resolveLockedVersions,
+} from "../../../src/deps/server-externals/server-production-files";
+
+const tmpDirs: string[] = [];
+
+function createLock(content: string): string {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "sd-bun-lock-"));
+  tmpDirs.push(dir);
+  fs.writeFileSync(path.join(dir, "bun.lock"), content);
+  return dir;
+}
+
+afterEach(() => {
+  for (const dir of tmpDirs.splice(0)) {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+describe("parseLockfileVersions", () => {
+  it("reads unscoped, scoped, alias, and optional entries from bun.lock", () => {
+    const cwd = createLock(`{
+  "lockfileVersion": 1,
+  "packages": {
+    "is-number": ["is-number@7.0.0", "", {}, "sha512-a"],
+    "@types/node": ["@types/node@24.13.2", "", {}, "sha512-b"],
+    "alias-pkg": ["is-number@6.0.0", "", {}, "sha512-c"],
+    "fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-d"],
+  }
+}`);
+
+    const map = parseLockfileVersions(cwd);
+
+    expect(map.get("is-number")).toBe("7.0.0");
+    expect(map.get("@types/node")).toBe("24.13.2");
+    expect(map.get("alias-pkg")).toBe("6.0.0");
+    expect(map.get("fsevents")).toBe("2.3.3");
+  });
+
+  it("strips peer suffix from package references", () => {
+    const cwd = createLock(`{
+  "lockfileVersion": 1,
+  "packages": {
+    "react-dom": ["react-dom@19.2.7(react@19.2.7)", "", {}, "sha512-a"],
+  }
+}`);
+
+    expect(parseLockfileVersions(cwd).get("react-dom")).toBe("19.2.7");
+  });
+});
+
+describe("resolveLockedVersions", () => {
+  it("throws when an external dependency is missing from bun.lock", () => {
+    const cwd = createLock(`{
+  "lockfileVersion": 1,
+  "packages": {
+    "is-number": ["is-number@7.0.0", "", {}, "sha512-a"],
+  }
+}`);
+
+    expect(() => resolveLockedVersions(cwd, ["missing"])).toThrow("bun.lock");
+  });
+});