Allow workspace packages to omit version field - #171
Open
exo-nikita wants to merge 1 commit into
Open
Conversation
A package defined in the local workspace outside node_modules (private/ unpublished) may legitimately lack a version in its package.json, but State#locateModule required name+version on the walk up from the closest manifest, so such a package tripped the pure-type-marker assert. Its name alone now claims the bucket, with version left undefined; node_modules buckets still require both. Kept consistent across the toolchain: - findPackageMetadata (stasis add / stasis bundle) stops at the same named manifest outside node_modules, so static and runtime bucketing agree instead of splitting the same file across different buckets. - Bundle.parse accepts a version-less workspace sources bucket (the serializer already omitted the undefined field). - The no-lockfile bundle absorb seeds a version-less workspace bucket's identity; v0 partial metadata (nameless buckets, version-less node_modules buckets) stays skipped. Lockfile serialize/parse, diff, sbom, audit, why and prune already tolerate a missing version. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013KtXt8ccBU9WLHNKe1CEkp
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This change enables stasis to handle workspace packages that omit the
versionfield, which is common for private/unpublished packages. The version field is now optional for packages outsidenode_modules, while remaining required for packages withinnode_modules.Key Changes
bundle-util.js: Updated
findPackageMetadata()to accept workspace packages with only anamefield (no version required), while still requiring bothnameandversionfornode_modulespackages.state.js: Modified package resolution logic to allow workspace packages to claim buckets with just a
name, without requiring aversion. The assertion message was updated to reflect this change.bundle.js: Relaxed the assertion when parsing bundle metadata to allow workspace buckets without a
versionfield, while still requiringnameandfiles.Test fixtures: Added test fixtures for edge cases:
partial/- workspace package with name but no versionunnamed/- workspace package with no name (should fail)node_modules/noversion/- node_modules package without version (should fail)New comprehensive test suite (
state-versionless-workspace.test.js): Added 7 tests covering:stasis addcommand handlingUpdated existing tests (
state-nested-pkg.test.js): Modified tests to reflect the new behavior and added tests for the stricter node_modules requirements.Implementation Details
The key distinction is that workspace packages (outside
node_modules) can now use just thenamefield to claim a bucket, matching howState#locateModuleidentifies packages. This allows private/unpublished workspace packages to work seamlessly through the entire artifact round-trip (lockfile → bundle → reload). However, packages withinnode_modulesstill require bothnameandversionto maintain strict identity verification and prevent accidental bucket collisions.https://claude.ai/code/session_013KtXt8ccBU9WLHNKe1CEkp