pnpm-dedup 2.1.0

package/src/dedupe.ts

@@ -0,0 +1,124 @@
+import {
+  countDuplicatedPackages,
+  createPackageFilter,
+  diffVersionsSnapshots,
+  renderDedupeSummary,
+} from "pm-dedup-core";
+import type { PackageFilterOptions } from "pm-dedup-core";
+import { applyClusterFixes } from "./applyClusterFixes.ts";
+import { lockPathOf, resolvePnpmProjectDir } from "./helpers/projectDir.ts";
+import { runPnpm } from "./helpers/runPnpm.ts";
+import { readVersionsSnapshot } from "./helpers/versionsSnapshot.ts";
+
+// `--dry-run` and `--check` print the same plan and write nothing; only the exit
+// code differs, so `--check` can gate CI while `--dry-run` stays informational.
+export type DedupeMode = "apply" | "check" | "dry-run";
+
+export interface DedupeOptions {
+  mode?: DedupeMode;
+  // false makes the cluster pass write plain overrides instead of convergence
+  // ones, forcing every requester onto the version rather than only the ones
+  // whose range accepts it
+  convergenceOverrides?: boolean;
+  // restricts which packages may be touched, for deduplicating a large lockfile
+  // a family at a time
+  filter?: PackageFilterOptions;
+}
+
+const residualsMessage = "`pnpm dedupe` would also change the lockfile.";
+
+// `pnpm dedupe` merges everything it can and knows nothing of the filter, so
+// running it would undo the point of a filtered run.
+const filteredResidualsMessage =
+  "`pnpm dedupe` was not run: it ignores the package filter. Run `pnpm dedupe` yourself, or this command without a filter, to finish the rest.";
+
+/**
+ * `pnpm dedupe` only merges what it can resolve to a single version on its own:
+ * it never widens a workspace range, and it never repoints an edge that resolved
+ * past a version the family already carries. Cluster fixes cover exactly that
+ * gap, so they run first and `pnpm dedupe` finishes the residuals.
+ */
+export function dedupe({
+  mode = "apply",
+  convergenceOverrides = true,
+  filter,
+}: DedupeOptions = {}): void {
+  const dryRun = mode !== "apply";
+  const projectDir = resolvePnpmProjectDir();
+  if (projectDir === null) return;
+  const lockPath = lockPathOf(projectDir);
+  const filtered = !createPackageFilter(filter).selectsEverything;
+
+  // Read before anything runs: both the cluster pass and `pnpm dedupe` rewrite
+  // the lockfile, and the summary compares the whole run against this.
+  const before = readVersionsSnapshot(lockPath);
+
+  // What the run merged, reported once the lockfile has settled — `pnpm dedupe`
+  // included, since it is part of what this command does.
+  const summarize = (): void => {
+    const after = readVersionsSnapshot(lockPath);
+    renderDedupeSummary({
+      deduped: diffVersionsSnapshots(before, after),
+      remainingDuplicates: countDuplicatedPackages(after),
+      whyCommand: "pnpm-why-duplicate",
+    });
+  };
+
+  // Read-only, so it can run before the cluster pass. It has to, for a dry run:
+  // the plan report names the residuals, and only this knows about them. A
+  // filtered run does not run `pnpm dedupe` at all, so what it would change is
+  // not this command's business.
+  const probe =
+    dryRun && !filtered
+      ? runPnpm(["dedupe", "--check"], { cwd: projectDir })
+      : null;
+
+  const residuals = ((): string | undefined => {
+    if (filtered) return filteredResidualsMessage;
+    if (probe !== null && probe.status !== 0) return residualsMessage;
+    return undefined;
+  })();
+
+  const outcome = applyClusterFixes({
+    projectDir,
+    dryRun,
+    convergenceOverrides,
+    filter,
+    packageManagerResiduals: residuals,
+  });
+
+  if (outcome.status === "kept-overrides") {
+    console.log(
+      `${outcome.stickyOverrides.length} override(s) left in pnpm-workspace.yaml — see the comment above them`,
+    );
+  }
+
+  if (mode === "check") {
+    process.exitCode =
+      outcome.plannedChangeCount > 0 || (probe !== null && probe.status !== 0)
+        ? 1
+        : 0;
+    return;
+  }
+  if (mode === "dry-run") return;
+
+  if (filtered) {
+    // Applying an override needs a real resolution, and `pnpm dedupe` is the
+    // only one that performs it — so a filtered run that changed something has
+    // already merged whatever else pnpm could reach on its own.
+    if (outcome.status === "applied" || outcome.status === "kept-overrides") {
+      console.log(
+        "`pnpm dedupe` ran to apply the fixes above and merged what it could on its own: the filter bounds the edits made here, not pnpm's resolution.",
+      );
+    }
+    console.log(filteredResidualsMessage);
+    summarize();
+    return;
+  }
+
+  const result = runPnpm(["dedupe"], { cwd: projectDir });
+  if (result.status !== null) {
+    process.exitCode = result.status;
+  }
+  summarize();
+}

package/src/dedupeCheckConsistency.test.ts

@@ -0,0 +1,218 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildIdentifiedFixesMap } from "pm-dedup-core";
+import {
+  buildPnpmPackagesMap,
+  collectPnpmDependents,
+  filterDuplicatesPnpmPackagesMap,
+  parsePnpmLockPackages,
+  readPnpmLock,
+} from "./index.ts";
+
+// These tests shell out to the real `pnpm` and require either network access or
+// a warm pnpm store; they are skipped when pnpm is not on PATH. `--lockfile-only`
+// keeps pnpm from writing node_modules, and `--frozen-lockfile` / `--check` never
+// rewrite the lockfile, so pnpm runs against the committed fixtures in place
+// without modifying them (asserted below). `pnpm dedupe --check` only flags the
+// safely-mergeable subset of duplicates, so the invariant is: everything pnpm
+// would dedupe is also reported by our listing.
+
+const pnpmAvailable =
+  spawnSync("pnpm", ["--version"], { encoding: "utf8" }).status === 0;
+
+const fixturePath = (scenario: string): string =>
+  fileURLToPath(new URL(`../test/fixtures/${scenario}`, import.meta.url));
+
+interface PnpmRun {
+  status: number | null;
+  output: string;
+}
+
+const runPnpm = (cwd: string, args: string[]): PnpmRun => {
+  const result = spawnSync(
+    "pnpm",
+    [...args, "--lockfile-only", "--prefer-offline", "--ignore-scripts"],
+    { cwd, encoding: "utf8", timeout: 120_000 },
+  );
+  if (result.error) {
+    throw result.error;
+  }
+  return {
+    status: result.status,
+    output: `${result.stdout}\n${result.stderr}`,
+  };
+};
+
+// `pnpm dedupe --check` prints a tree of changes; each merged dependency is on a
+// branch line `├── name fromVersion → toVersion`. We collect those names.
+const parseDedupedPackages = (output: string): string[] => {
+  const names = new Set<string>();
+  for (const line of output.split("\n")) {
+    if (!line.includes("→")) continue;
+    const name = line
+      .replace(/^[\s│├└─]+/u, "")
+      .trim()
+      .split(/\s+/u)[0];
+    if (name) {
+      names.add(name);
+    }
+  }
+  return [...names].toSorted();
+};
+
+const duplicateNames = (scenario: string): string[] => {
+  const lock = readPnpmLock(join(fixturePath(scenario), "pnpm-lock.yaml"));
+  const duplicates = filterDuplicatesPnpmPackagesMap(
+    buildPnpmPackagesMap(parsePnpmLockPackages(lock)),
+  );
+  return Object.keys(duplicates).toSorted();
+};
+
+const fixTargets = (scenario: string, packageName: string): string[] => {
+  const lock = readPnpmLock(join(fixturePath(scenario), "pnpm-lock.yaml"));
+  const duplicates = filterDuplicatesPnpmPackagesMap(
+    buildPnpmPackagesMap(parsePnpmLockPackages(lock)),
+  );
+  const fixes = buildIdentifiedFixesMap(
+    duplicates,
+    collectPnpmDependents(lock, Object.keys(duplicates)),
+  );
+  return (fixes.get(packageName) ?? []).map((fix) => fix.to);
+};
+
+const lockContent = (dir: string): string =>
+  readFileSync(join(dir, "pnpm-lock.yaml"), "utf8");
+
+// Defensive: `--lockfile-only` should never create node_modules, but if a future
+// pnpm version does, do not leave it in the committed fixture directory.
+const assertPristine = (dir: string, lockBefore: string): void => {
+  strictEqual(
+    lockContent(dir),
+    lockBefore,
+    "pnpm must not change the lockfile",
+  );
+  rmSync(join(dir, "node_modules"), { recursive: true, force: true });
+};
+
+const suite = pnpmAvailable ? describe : describe.skip;
+
+suite("pnpm dedupe --check vs listDuplicates", () => {
+  // `duplicated-typescript-eslint-dedupe-peers` is the same dependency with
+  // `dedupePeers: true`, which flattens the peer suffixes in the lockfile: pnpm
+  // must still merge the same packages, and we must still list them.
+  const mergeable: { scenario: string; expectedFlagged: string[] }[] = [
+    {
+      scenario: "duplicated-typescript-eslint",
+      expectedFlagged: [
+        "@typescript-eslint/tsconfig-utils",
+        "@typescript-eslint/types",
+      ],
+    },
+    {
+      scenario: "duplicated-typescript-eslint-dedupe-peers",
+      expectedFlagged: [
+        "@typescript-eslint/tsconfig-utils",
+        "@typescript-eslint/types",
+      ],
+    },
+  ];
+
+  for (const { scenario, expectedFlagged } of mergeable) {
+    it(`flags the mergeable subset of ${scenario}, all of which listDuplicates reports`, () => {
+      const dir = fixturePath(scenario);
+      const lockBefore = lockContent(dir);
+
+      const install = runPnpm(dir, ["install", "--frozen-lockfile"]);
+      strictEqual(install.status, 0, install.output);
+      assertPristine(dir, lockBefore);
+
+      const check = runPnpm(dir, ["dedupe", "--check"]);
+      ok(
+        check.status !== 0,
+        `dedupe --check should flag issues\n${check.output}`,
+      );
+      assertPristine(dir, lockBefore);
+
+      deepStrictEqual(parseDedupedPackages(check.output), expectedFlagged);
+
+      const duplicates = duplicateNames(scenario);
+      for (const name of expectedFlagged) {
+        ok(
+          duplicates.includes(name),
+          `listDuplicates should report ${name} that pnpm dedupe flags`,
+        );
+      }
+    }, 180_000);
+  }
+
+  // Duplicates pnpm does not merge: `dedupe --check` exits 0 and flags nothing,
+  // yet listDuplicates still reports the duplicate. The `mergeable-alias*`
+  // fixtures go one step further: every declared range accepts the aliased
+  // 5.0.7 pin, so we do identify a merge target — one pnpm will never apply,
+  // because merging means downgrading the range from 5.3.1.
+  // `wildcard-not-reused` is the widest case: a `*` range resolved to 0.87.0
+  // instead of the installed 0.84.5, duplicating the metro family (see
+  // wildcardNotReused.test.ts). pnpm will not undo it either.
+  const unmergeableByPnpm: {
+    scenario: string;
+    expectedDuplicate: string;
+    expectedFixTargets?: string[];
+  }[] = [
+    {
+      scenario: "duplicated-babel-frame",
+      expectedDuplicate: "@babel/code-frame",
+    },
+    {
+      scenario: "duplicated-printable-shell-command",
+      expectedDuplicate: "printable-shell-command",
+    },
+    {
+      scenario: "mergeable-alias",
+      expectedDuplicate: "printable-shell-command",
+      expectedFixTargets: ["printable-shell-command@5.0.7"],
+    },
+    {
+      scenario: "mergeable-alias-dedupe-peers",
+      expectedDuplicate: "printable-shell-command",
+      expectedFixTargets: ["printable-shell-command@5.0.7"],
+    },
+    {
+      scenario: "wildcard-not-reused",
+      expectedDuplicate: "metro-config",
+    },
+  ];
+
+  for (const {
+    scenario,
+    expectedDuplicate,
+    expectedFixTargets,
+  } of unmergeableByPnpm) {
+    it(`flags nothing for ${scenario} but still lists ${expectedDuplicate}`, () => {
+      const dir = fixturePath(scenario);
+      const lockBefore = lockContent(dir);
+
+      const install = runPnpm(dir, ["install", "--frozen-lockfile"]);
+      strictEqual(install.status, 0, install.output);
+      assertPristine(dir, lockBefore);
+
+      const check = runPnpm(dir, ["dedupe", "--check"]);
+      strictEqual(
+        check.status,
+        0,
+        `dedupe --check should find nothing to merge\n${check.output}`,
+      );
+      assertPristine(dir, lockBefore);
+
+      deepStrictEqual(parseDedupedPackages(check.output), []);
+      ok(duplicateNames(scenario).includes(expectedDuplicate));
+      deepStrictEqual(
+        fixTargets(scenario, expectedDuplicate),
+        expectedFixTargets ?? [],
+      );
+    }, 180_000);
+  }
+});

package/src/dedupeEndToEnd.test.ts

@@ -0,0 +1,168 @@
+import { afterEach, describe, it } from "bun:test";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { cpSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildPnpmPackagesMap } from "./helpers/buildPnpmPackagesMap.ts";
+import { readDuplicateSnapshot } from "./helpers/duplicateSnapshot.ts";
+import { parsePnpmLockPackages } from "./helpers/parsePnpmLockPackages.ts";
+import { createTempProjects } from "./helpers/tempProjects.ts";
+import { readPnpmLock } from "./readPnpmLock.ts";
+
+// The shipped tool against a real pnpm: a copy of the
+// `exact-pin-forces-downgrade` fixture, a real `pnpm install`, then the built
+// `pnpm-dedupe` bin as a user would run it. Every other test stubs the
+// resolution step, so this is the only one that can tell whether pnpm holds the
+// deduplicated result on its own once the transient override is removed again —
+// the step the tool takes before reporting "applied" — and pnpm is asked for its
+// own account of the tree at the end rather than only our reading of it.
+//
+// Requires network access or a warm pnpm store; skipped when pnpm is not on PATH.
+
+const pnpmAvailable =
+  spawnSync("pnpm", ["--version"], { encoding: "utf8" }).status === 0;
+
+const fixtureDir = fileURLToPath(
+  new URL("../test/fixtures/exact-pin-forces-downgrade", import.meta.url),
+);
+// the built bin, the one the `bin` field points at: from `src` it is one level
+// up, and the compiled copy of this file sits beside it
+const dedupeBin = ((): string => {
+  const built = ["../dist/bin/pnpm-dedupe.js", "./bin/pnpm-dedupe.js"]
+    .map((binPath) => fileURLToPath(new URL(binPath, import.meta.url)))
+    .find((binPath) => existsSync(binPath));
+  if (!built) {
+    throw new Error("pnpm-dedupe is not built: run `bun run build` first");
+  }
+  return built;
+})();
+
+// expo-camera's peers (expo, react-native) would drag a few hundred packages in
+// and duplicates of their own, none of which this fixture is about.
+const workspaceYamlContent = "autoInstallPeers: false\n";
+
+interface Run {
+  status: number | null;
+  output: string;
+}
+
+const projects = createTempProjects("pnpm-dedup-e2e-");
+
+afterEach(projects.cleanup);
+
+const run = (cwd: string, command: string, args: string[]): Run => {
+  const result = spawnSync(command, args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 120_000,
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  return {
+    status: result.status,
+    output: `${result.stdout}\n${result.stderr}`,
+  };
+};
+
+const install = (cwd: string, ...args: string[]): Run =>
+  run(cwd, "pnpm", [
+    "install",
+    "--prefer-offline",
+    "--ignore-scripts",
+    ...args,
+  ]);
+
+// node, as the bin's own shebang asks for
+const dedupe = (cwd: string, ...args: string[]): Run =>
+  run(cwd, "node", [dedupeBin, ...args]);
+
+const lockPath = (dir: string): string => join(dir, "pnpm-lock.yaml");
+
+const resolutionsOf = (dir: string, packageName: string): string[] => {
+  const lock = readPnpmLock(lockPath(dir));
+  const packagesMap = buildPnpmPackagesMap(parsePnpmLockPackages(lock));
+  return (packagesMap[packageName] ?? []).map(({ resolution }) => resolution);
+};
+
+const suite = pnpmAvailable ? describe : describe.skip;
+
+suite("pnpm-dedupe end to end", () => {
+  it("converges the cluster and leaves pnpm holding it without an override", () => {
+    const dir = projects.create();
+    // only the manifest: the lockfile has to be the real resolution pnpm writes
+    // here, not the trimmed one the unit-test fixture commits
+    cpSync(join(fixtureDir, "package.json"), join(dir, "package.json"));
+    writeFileSync(join(dir, "pnpm-workspace.yaml"), workspaceYamlContent);
+
+    const installed = install(dir);
+    strictEqual(installed.status, 0, installed.output);
+
+    // `@yudiel/react-qr-scanner` pins barcode-detector at exactly 3.0.3 while
+    // expo-camera's `^3.0.0` resolved to 3.2.2, and the pair drags zxing-wasm
+    // along: four resolutions for two packages.
+    const before = readDuplicateSnapshot(lockPath(dir));
+    strictEqual(before.size, 4, [...before].join(", "));
+    ok(before.has("barcode-detector@3.0.3"));
+    ok(before.has("barcode-detector@3.2.2"));
+
+    const applied = dedupe(dir);
+    strictEqual(applied.status, 0, applied.output);
+
+    // the tool's own verdict: the convergence override went in, came back out,
+    // and the result survived the re-resolution without it
+    ok(applied.output.includes('"barcode-detector@": "3.0.3"'), applied.output);
+    ok(
+      applied.output.includes(
+        "Removing the overrides and re-resolving to check the result holds",
+      ),
+      applied.output,
+    );
+    // what it deduped, named: two packages, one copy of each merged away
+    ok(
+      applied.output.includes("Deduped 2 packages, 2 copies merged:"),
+      applied.output,
+    );
+    ok(
+      applied.output.includes(
+        "barcode-detector: 2 versions (3.0.3, 3.2.2) -> 1 version (3.0.3)",
+      ),
+      applied.output,
+    );
+    ok(applied.output.includes("No duplicate left."), applied.output);
+
+    // what matters is the lockfile pnpm was left with
+    strictEqual(readDuplicateSnapshot(lockPath(dir)).size, 0);
+    deepStrictEqual(resolutionsOf(dir, "barcode-detector"), [
+      "barcode-detector@3.0.3",
+    ]);
+    // barcode-detector 3.2.2 pinned zxing-wasm at exactly 3.1.3; 3.0.3 asks for
+    // `^2.1.2`, so converging onto it has to bring the 2.x line back — a 3.1.3
+    // left standing would be a range the installed tree contradicts.
+    const zxing = resolutionsOf(dir, "zxing-wasm");
+    strictEqual(zxing.length, 1, zxing.join(", "));
+    ok(zxing[0]?.startsWith("zxing-wasm@2."), zxing.join(", "));
+
+    // no standing override is left behind, in a file otherwise untouched
+    strictEqual(
+      readFileSync(join(dir, "pnpm-workspace.yaml"), "utf8"),
+      workspaceYamlContent,
+    );
+
+    // and pnpm itself agrees, from the manifests alone
+    const frozen = install(dir, "--frozen-lockfile");
+    strictEqual(frozen.status, 0, frozen.output);
+
+    // pnpm's own account of the installed tree, not ours: one copy, reached
+    // from both dependents
+    const list = run(dir, "pnpm", ["list", "--depth", "Infinity"]);
+    strictEqual(list.status, 0, list.output);
+    ok(list.output.includes("barcode-detector@3.0.3 [deduped]"), list.output);
+    strictEqual(list.output.includes("barcode-detector@3.2.2"), false);
+
+    const check = dedupe(dir, "--check");
+    strictEqual(check.status, 0, check.output);
+    ok(check.output.includes("Nothing to dedupe."), check.output);
+  }, 180_000);
+});

package/src/dedupePeers.test.ts

@@ -0,0 +1,175 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { fileURLToPath } from "node:url";
+import { buildIdentifiedFixesMap } from "pm-dedup-core";
+import type { PackagesMap } from "./helpers/buildPnpmPackagesMap.ts";
+import { parsePackageId } from "./helpers/parsePnpmLockPackages.ts";
+import {
+  buildPnpmPackagesMap,
+  collectPnpmDependents,
+  filterDuplicatesPnpmPackagesMap,
+  parsePnpmLockPackages,
+  readPnpmLock,
+} from "./index.ts";
+
+// Both fixtures declare the same single dependency; only the `dedupePeers`
+// setting differs. With it enabled pnpm writes peer suffixes as plain
+// `name@version` instead of repeating the peer's own resolution, so snapshot
+// ids lose their nesting:
+//   default:     pkg@1(peer@2(eslint@10)(typescript@6))(eslint@10)(typescript@6)
+//   dedupePeers: pkg@1(peer@2)(eslint@10)(typescript@6)
+const defaultScenario = "duplicated-typescript-eslint";
+const dedupePeersScenario = "duplicated-typescript-eslint-dedupe-peers";
+
+// `mergeable-alias` pins the same package twice, once through an npm alias
+// (`npm:printable-shell-command@5.0.7`) and once through a range that also
+// accepts that pin. It is the same pair: identical manifests, `dedupePeers`
+// only set in `mergeable-alias-dedupe-peers`.
+const mergeableDefaultScenario = "mergeable-alias";
+const mergeableDedupePeersScenario = "mergeable-alias-dedupe-peers";
+
+const lockFor = (scenario: string) =>
+  readPnpmLock(
+    fileURLToPath(
+      new URL(`../test/fixtures/${scenario}/pnpm-lock.yaml`, import.meta.url),
+    ),
+  );
+
+const maxParenDepth = (id: string): number => {
+  let depth = 0;
+  let max = 0;
+  for (const char of id) {
+    if (char === "(") {
+      depth += 1;
+      max = Math.max(max, depth);
+    } else if (char === ")") {
+      depth -= 1;
+    }
+  }
+  return max;
+};
+
+const snapshotIds = (scenario: string): string[] =>
+  Object.keys(lockFor(scenario).snapshots ?? {});
+
+const duplicatesFor = (scenario: string): PackagesMap =>
+  filterDuplicatesPnpmPackagesMap(
+    buildPnpmPackagesMap(parsePnpmLockPackages(lockFor(scenario))),
+  );
+
+const fixesFor = (
+  scenario: string,
+): ReturnType<typeof buildIdentifiedFixesMap> => {
+  const lock = lockFor(scenario);
+  const duplicates = duplicatesFor(scenario);
+  return buildIdentifiedFixesMap(
+    duplicates,
+    collectPnpmDependents(lock, Object.keys(duplicates)),
+  );
+};
+
+describe("dedupePeers lockfiles", () => {
+  it("uses a fixture generated with the setting enabled", () => {
+    strictEqual(lockFor(dedupePeersScenario).settings?.dedupePeers, true);
+    strictEqual(lockFor(defaultScenario).settings?.dedupePeers, undefined);
+  });
+
+  it("flattens the peer suffixes the default settings nest", () => {
+    ok(
+      snapshotIds(defaultScenario).some((id) => maxParenDepth(id) > 1),
+      "the default-settings fixture should contain nested peer suffixes",
+    );
+    deepStrictEqual(
+      snapshotIds(dedupePeersScenario).filter((id) => maxParenDepth(id) > 1),
+      [],
+    );
+  });
+
+  it("parses name and version out of a flattened peer suffix", () => {
+    const suffixed = snapshotIds(dedupePeersScenario).filter((id) =>
+      id.includes("("),
+    );
+    ok(suffixed.length > 0);
+    for (const id of suffixed) {
+      const { name, version } = parsePackageId(id);
+      ok(!name.includes("("), `name should not keep the suffix: ${id}`);
+      ok(/^\d/u.test(version), `version should be resolved: ${id}`);
+    }
+  });
+
+  it("groups every peer context of a resolution into installations", () => {
+    const { packages, installationsByResolution } = parsePnpmLockPackages(
+      lockFor(dedupePeersScenario),
+    );
+    const utils = installationsByResolution.get(
+      "@typescript-eslint/utils@8.67.0",
+    );
+    ok(utils);
+    ok(utils.every((id) => id.startsWith("@typescript-eslint/utils@8.67.0")));
+    strictEqual(
+      [...installationsByResolution.keys()].every((resolution) =>
+        packages.has(resolution),
+      ),
+      true,
+    );
+  });
+
+  it("reports the same duplicated packages as the default-settings fixture", () => {
+    deepStrictEqual(
+      Object.keys(duplicatesFor(dedupePeersScenario)).toSorted(),
+      Object.keys(duplicatesFor(defaultScenario)).toSorted(),
+    );
+  });
+
+  it("resolves dependents for every duplicate, so fixes can be identified", () => {
+    const lock = lockFor(dedupePeersScenario);
+    const duplicates = duplicatesFor(dedupePeersScenario);
+    const packageNames = Object.keys(duplicates);
+    const dependents = collectPnpmDependents(lock, packageNames);
+
+    for (const name of packageNames) {
+      ok(dependents.get(name)?.length, `expected dependents for ${name}`);
+    }
+
+    // identifyResolutionFixes throws on a missing dependent, which is what a
+    // peer-suffix parsing regression would cause here.
+    const fixes = buildIdentifiedFixesMap(duplicates, dependents);
+    deepStrictEqual([...fixes.keys()].toSorted(), packageNames.toSorted());
+  });
+});
+
+describe("dedupePeers with an identified fix", () => {
+  it("flattens the peer suffixes of the pinned pair too", () => {
+    ok(
+      snapshotIds(mergeableDefaultScenario).some((id) => maxParenDepth(id) > 1),
+    );
+    deepStrictEqual(
+      snapshotIds(mergeableDedupePeersScenario).filter(
+        (id) => maxParenDepth(id) > 1,
+      ),
+      [],
+    );
+  });
+
+  it("identifies the version every declared range accepts", () => {
+    deepStrictEqual(
+      fixesFor(mergeableDedupePeersScenario).get("printable-shell-command"),
+      [
+        {
+          mergeableResolutions: [
+            "printable-shell-command@5.0.7",
+            "printable-shell-command@5.3.1",
+          ],
+          to: "printable-shell-command@5.0.7",
+        },
+      ],
+    );
+  });
+
+  it("identifies the same fixes as the default-settings fixture", () => {
+    deepStrictEqual(
+      [...fixesFor(mergeableDedupePeersScenario)],
+      [...fixesFor(mergeableDefaultScenario)],
+    );
+  });
+});