fix(lockfile): error if a referenced package id doesn't exist in list of packages

[dsherret]

Co-authored-by: bartlomieju [email protected]

[dsherret]

Another bug fix here.

[dsherret]

I had more code here initially, but deleted it because it would be a lot more to maintain and maybe not desirable. Let's look into it maybe after peer deps are added (as it creates some complications with that too).

      // ensure the dependencies align with the lockfile dependencies
      if package.dependencies.len() != version_info.dependencies.len() {
        bail!(
          "the lockfile ({}) had {} dependencies for {}, but the npm registry said there were {}",
          lockfile.lock().filename.display(),
          package.dependencies.len(),
          package.id,
          version_info.dependencies.len(),
        );
      }
      for entry in version_info.dependencies_as_entries()? {
        match package.dependencies.get(&entry.name) {
          Some(dep) => {
            if !entry.version_req.satisfies(&dep.version) {
              bail!(
                "the lockfile ({}) had a dependency requirement of {} for {}, but this didn't satisfy the npm registry's version requirement",
                lockfile.lock().filename.display(),
                // todo...
              );
            }
          }
          None => {
            // todo...better error
            bail!(
              "the lockfile ({}) is corrupt. Recreate it or run again with --no-lock",
              lockfile.lock().filename.display(),
            );
          }
        }
      }

[dsherret]

This code change uses less memory and won't cause unresolved_tasks to re-allocate.

[bartlomieju]

LGTM 🙏