be more careful

9 files changed, 178 insertions, 88 deletions

diff --git a/src/install/bin.zig b/src/install/bin.zig
index 4cc529f6a..09b7201d5 100644
--- a/src/install/bin.zig
+++ b/src/install/bin.zig
@@ -20,7 +20,30 @@ pub const Bin = extern struct {
     tag: Tag = Tag.none,
     value: Value = Value{ .none = {} },
 
-    pub fn count(this: Bin, buf: []const u8, extern_strings: []const ExternalString, comptime StringBuilder: type, builder: StringBuilder) u32 {
+    pub fn verify(this: *const Bin, extern_strings: []const ExternalString) void {
+        if (comptime !Environment.allow_assert)
+            return;
+
+        switch (this.tag) {
+            .file => this.value.file.assertDefined(),
+            .named_file => {
+                this.value.named_file[0].assertDefined();
+                this.value.named_file[1].assertDefined();
+            },
+            .dir => {
+                this.value.dir.assertDefined();
+            },
+            .map => {
+                const list = this.value.map.get(extern_strings);
+                for (list) |*extern_string| {
+                    extern_string.value.assertDefined();
+                }
+            },
+            else => {},
+        }
+    }
+
+    pub fn count(this: *const Bin, buf: []const u8, extern_strings: []const ExternalString, comptime StringBuilder: type, builder: StringBuilder) u32 {
         switch (this.tag) {
             .file => builder.count(this.value.file.slice(buf)),
             .named_file => {
@@ -29,10 +52,11 @@ pub const Bin = extern struct {
             },
             .dir => builder.count(this.value.dir.slice(buf)),
             .map => {
-                for (this.value.map.get(extern_strings)) |extern_string| {
+                const list = this.value.map.get(extern_strings);
+                for (list) |*extern_string| {
                     builder.count(extern_string.slice(buf));
                 }
-                return this.value.map.len;
+                return @truncate(u32, list.len);
             },
             else => {},
         }
@@ -40,7 +64,7 @@ pub const Bin = extern struct {
         return 0;
     }
 
-    pub fn clone(this: Bin, buf: []const u8, prev_external_strings: []const ExternalString, all_extern_strings: []ExternalString, extern_strings_slice: []ExternalString, comptime StringBuilder: type, builder: StringBuilder) Bin {
+    pub fn clone(this: *const Bin, buf: []const u8, prev_external_strings: []const ExternalString, all_extern_strings: []ExternalString, extern_strings_slice: []ExternalString, comptime StringBuilder: type, builder: StringBuilder) Bin {
         return switch (this.tag) {
             .none => Bin{ .tag = .none, .value = .{ .none = {} } },
             .file => Bin{
diff --git a/src/install/dependency.zig b/src/install/dependency.zig
index a9c2fa108..405363001 100644
--- a/src/install/dependency.zig
+++ b/src/install/dependency.zig
@@ -178,7 +178,7 @@ pub const Version = struct {
     pub const zeroed = Version{};
 
     pub fn clone(
-        this: Version,
+        this: *const Version,
         buf: []const u8,
         comptime StringBuilder: type,
         builder: StringBuilder,
@@ -223,8 +223,8 @@ pub const Version = struct {
     }
 
     pub inline fn eql(
-        lhs: Version,
-        rhs: Version,
+        lhs: *const Version,
+        rhs: *const Version,
         lhs_buf: []const u8,
         rhs_buf: []const u8,
     ) bool {
@@ -238,7 +238,7 @@ pub const Version = struct {
             .npm => strings.eql(lhs.literal.slice(lhs_buf), rhs.literal.slice(rhs_buf)) or
                 lhs.value.npm.eql(rhs.value.npm, lhs_buf, rhs_buf),
             .folder, .dist_tag => lhs.literal.eql(rhs.literal, lhs_buf, rhs_buf),
-            .github => lhs.value.github.eql(rhs.value.github, lhs_buf, rhs_buf),
+            .github => lhs.value.github.eql(&rhs.value.github, lhs_buf, rhs_buf),
             .tarball => lhs.value.tarball.eql(rhs.value.tarball, lhs_buf, rhs_buf),
             .symlink => lhs.value.symlink.eql(rhs.value.symlink, lhs_buf, rhs_buf),
             .workspace => lhs.value.workspace.eql(rhs.value.workspace, lhs_buf, rhs_buf),
@@ -513,15 +513,15 @@ pub const Version = struct {
 };
 
 pub fn eql(
-    a: Dependency,
-    b: Dependency,
+    a: *const Dependency,
+    b: *const Dependency,
     lhs_buf: []const u8,
     rhs_buf: []const u8,
 ) bool {
-    return a.name_hash == b.name_hash and a.name.len() == b.name.len() and a.version.eql(b.version, lhs_buf, rhs_buf);
+    return a.name_hash == b.name_hash and a.name.len() == b.name.len() and a.version.eql(&b.version, lhs_buf, rhs_buf);
 }
 
-pub fn eqlResolved(a: Dependency, b: Dependency) bool {
+pub fn eqlResolved(a: *const Dependency, b: *const Dependency) bool {
     if (a.isNPM() and b.tag.isNPM()) {
         return a.resolution == b.resolution;
     }
diff --git a/src/install/install.zig b/src/install/install.zig
index 16943ae33..f938b66c4 100644
--- a/src/install/install.zig
+++ b/src/install/install.zig
@@ -321,7 +321,7 @@ const NetworkTask = struct {
                 },
             );
             header_builder.header_count = 1;
-            header_builder.content = GlobalStringBuilder{ .ptr = @intToPtr([*]u8, @ptrToInt(std.mem.span(default_headers_buf).ptr)), .len = default_headers_buf.len, .cap = default_headers_buf.len };
+            header_builder.content = GlobalStringBuilder{ .ptr = @intToPtr([*]u8, @ptrToInt(bun.span(default_headers_buf).ptr)), .len = default_headers_buf.len, .cap = default_headers_buf.len };
         }
 
         this.response_buffer = try MutableString.init(allocator, 0);
@@ -751,7 +751,7 @@ const PackageInstall = struct {
         // If it's not long enough to have {"name": "foo", "version": "1.2.0"}, there's no way it's valid
         if (total < "{\"name\":\"\",\"version\":\"\"}".len + this.package_name.len + this.package_version.len) return false;
 
-        const source = logger.Source.initPathString(std.mem.span(package_json_path), mutable.list.items[0..total]);
+        const source = logger.Source.initPathString(bun.span(package_json_path), mutable.list.items[0..total]);
         var log = logger.Log.init(allocator);
         defer log.deinit();
 
@@ -866,7 +866,7 @@ const PackageInstall = struct {
             }
         };
 
-        var subdir = this.destination_dir.dir.makeOpenPathIterable(std.mem.span(this.destination_dir_subpath), .{}) catch |err| return Result{
+        var subdir = this.destination_dir.dir.makeOpenPathIterable(bun.span(this.destination_dir_subpath), .{}) catch |err| return Result{
             .fail = .{ .err = err, .step = .opening_cache_dir },
         };
 
@@ -889,7 +889,7 @@ const PackageInstall = struct {
         if (comptime !Environment.isMac) @compileError("clonefileat() is macOS only.");
 
         if (this.package_name[0] == '@') {
-            const current = std.mem.span(this.destination_dir_subpath);
+            const current = bun.span(this.destination_dir_subpath);
             if (strings.indexOfChar(current, std.fs.path.sep)) |slash| {
                 this.destination_dir_subpath_buf[slash] = 0;
                 var subdir = this.destination_dir_subpath_buf[0..slash :0];
@@ -981,7 +981,7 @@ const PackageInstall = struct {
             }
         };
 
-        var subdir = this.destination_dir.dir.makeOpenPathIterable(std.mem.span(this.destination_dir_subpath), .{}) catch |err| return Result{
+        var subdir = this.destination_dir.dir.makeOpenPathIterable(bun.span(this.destination_dir_subpath), .{}) catch |err| return Result{
             .fail = .{ .err = err, .step = .opening_cache_dir },
         };
 
@@ -1036,7 +1036,7 @@ const PackageInstall = struct {
             }
         };
 
-        var subdir = this.destination_dir.dir.makeOpenPathIterable(std.mem.span(this.destination_dir_subpath), .{}) catch |err| return Result{
+        var subdir = this.destination_dir.dir.makeOpenPathIterable(bun.span(this.destination_dir_subpath), .{}) catch |err| return Result{
             .fail = .{ .err = err, .step = .opening_cache_dir },
         };
 
@@ -1129,7 +1129,7 @@ const PackageInstall = struct {
             }
         };
 
-        var subdir = this.destination_dir.dir.makeOpenPathIterable(std.mem.span(this.destination_dir_subpath), .{}) catch |err| return Result{
+        var subdir = this.destination_dir.dir.makeOpenPathIterable(bun.span(this.destination_dir_subpath), .{}) catch |err| return Result{
             .fail = .{ .err = err, .step = .opening_cache_dir },
         };
 
@@ -1153,7 +1153,7 @@ const PackageInstall = struct {
     }
 
     pub fn uninstall(this: *PackageInstall) !void {
-        try this.destination_dir.dir.deleteTree(std.mem.span(this.destination_dir_subpath));
+        try this.destination_dir.dir.deleteTree(bun.span(this.destination_dir_subpath));
     }
 
     fn isDanglingSymlink(path: [:0]const u8) bool {
@@ -1504,7 +1504,7 @@ pub const PackageManager = struct {
         this: *PackageManager,
         name: []const u8,
         version_buf: []const u8,
-        version: Dependency.Version,
+        version: *const Dependency.Version,
         behavior: Dependency.Behavior,
         is_main: bool,
     ) DependencyToEnqueue {
@@ -1531,7 +1531,7 @@ pub const PackageManager = struct {
         const dependency = Dependency{
             .name = String.init(name, name),
             .name_hash = String.Builder.stringHash(name),
-            .version = version,
+            .version = version.*,
             .behavior = behavior,
         };
         dependency.countWithDifferentBuffers(name, version_buf, @TypeOf(&builder), &builder);
@@ -1805,7 +1805,7 @@ pub const PackageManager = struct {
         return this.allocator.create(NetworkTask) catch @panic("Memory allocation failure creating NetworkTask!");
     }
 
-    fn allocGitHubURL(this: *const PackageManager, repository: Repository) !string {
+    fn allocGitHubURL(this: *const PackageManager, repository: *const Repository) !string {
         var github_api_domain: string = "api.github.com";
         if (this.env_loader.map.get("GITHUB_API_DOMAIN")) |api_domain| {
             if (api_domain.len > 0) {
@@ -1828,7 +1828,7 @@ pub const PackageManager = struct {
         return std.fmt.bufPrintZ(buf, "@GH@{s}", .{resolved}) catch unreachable;
     }
 
-    pub fn cachedGitHubFolderName(this: *const PackageManager, repository: Repository) stringZ {
+    pub fn cachedGitHubFolderName(this: *const PackageManager, repository: *const Repository) stringZ {
         return cachedGitHubFolderNamePrint(&cached_package_folder_name_buf, this.lockfile.str(&repository.resolved));
     }
 
@@ -1842,7 +1842,7 @@ pub const PackageManager = struct {
             return basename;
         }
 
-        const spanned = std.mem.span(basename);
+        const spanned = bun.span(basename);
         var available = buf[spanned.len..];
         var end: []u8 = undefined;
         if (scope.url.hostname.len > 32 or available.len < 64) {
@@ -2019,7 +2019,7 @@ pub const PackageManager = struct {
         var allocator = stack_fallback.get();
         var tags_buf = std.ArrayList(u8).init(allocator);
         var installed_versions = this.getInstalledVersionsFromDiskCache(&tags_buf, package_name, allocator) catch |err| {
-            Output.debug("error getting installed versions from disk cache: {s}", .{std.mem.span(@errorName(err))});
+            Output.debug("error getting installed versions from disk cache: {s}", .{bun.span(@errorName(err))});
             return null;
         };
 
@@ -2034,7 +2034,7 @@ pub const PackageManager = struct {
             if (version.value.npm.version.satisfies(installed_version)) {
                 var buf: [bun.MAX_PATH_BYTES]u8 = undefined;
                 var npm_package_path = this.pathForCachedNPMPath(&buf, package_name, installed_version) catch |err| {
-                    Output.debug("error getting path for cached npm path: {s}", .{std.mem.span(@errorName(err))});
+                    Output.debug("error getting path for cached npm path: {s}", .{bun.span(@errorName(err))});
                     return null;
                 };
                 const dependency = Dependency.Version{
@@ -2056,7 +2056,7 @@ pub const PackageManager = struct {
                         return id;
                     },
                     .err => |err| {
-                        Output.debug("error getting or putting folder resolution: {s}", .{std.mem.span(@errorName(err))});
+                        Output.debug("error getting or putting folder resolution: {s}", .{bun.span(@errorName(err))});
                         return null;
                     },
                 }
@@ -2093,7 +2093,7 @@ pub const PackageManager = struct {
         if (this.lockfile.getPackageID(
             name_hash,
             if (behavior.isPeer()) version else null,
-            .{
+            &.{
                 .tag = .npm,
                 .value = .{
                     .npm = .{
@@ -2696,27 +2696,31 @@ pub const PackageManager = struct {
                 return;
             },
             .github => {
-                if (dependency.behavior.isPeer()) return;
-                const dep = dependency.version.value.github;
-                const res = Resolution{
-                    .tag = .github,
-                    .value = .{
-                        .github = dep,
-                    },
+                const package: Lockfile.Package = brk: {
+                    if (dependency.behavior.isPeer()) return;
+                    const dep = &dependency.version.value.github;
+                    const res = Resolution{
+                        .tag = .github,
+                        .value = .{
+                            .github = dep.*,
+                        },
+                    };
+                    if (this.lockfile.getPackageID(name_hash, null, &res)) |pkg_id| {
+                        successFn(this, id, pkg_id);
+                        return;
+                    }
+                    break :brk try this.lockfile.appendPackage(.{
+                        .name = name,
+                        .name_hash = name_hash,
+                        .resolution = res,
+                    });
                 };
-                if (this.lockfile.getPackageID(name_hash, null, res)) |pkg_id| {
-                    successFn(this, id, pkg_id);
-                    return;
-                }
-                const package = try this.lockfile.appendPackage(.{
-                    .name = name,
-                    .name_hash = name_hash,
-                    .resolution = res,
-                });
-                const url = try this.allocGitHubURL(dep);
+
+                const url = this.allocGitHubURL(&package.resolution.value.github) catch unreachable;
                 const task_id = Task.Id.forTarball(url);
                 if (try this.generateNetworkTaskForTarball(task_id, url, package)) |network_task| {
                     network_task.callback.extract.dependency_id = id;
+
                     this.setPreinstallState(package.meta.id, this.lockfile, .extracting);
                     this.enqueueNetworkTask(network_task);
                 }
@@ -2938,7 +2942,7 @@ pub const PackageManager = struct {
                 }
             }
 
-            if (comptime @TypeOf(callbacks.onResolve) != void) {
+            if (comptime @TypeOf(callbacks) != void and @TypeOf(callbacks.onResolve) != void) {
                 if (any_root) {
                     callbacks.onResolve(ctx);
                 }
@@ -2957,10 +2961,10 @@ pub const PackageManager = struct {
         var package = manager.lockfile.packages.get(package_id);
         switch (package.resolution.tag) {
             .github => {
-                defer {
-                    manager.allocator.free(data.resolved);
-                    manager.allocator.free(data.json_buf);
-                }
+                // defer {
+                //     manager.allocator.free(data.resolved);
+                //     manager.allocator.free(data.json_buf);
+                // }
                 const package_name = package.name;
                 const package_name_hash = package.name_hash;
                 const package_json_source = logger.Source.initPathString(
@@ -3099,7 +3103,7 @@ pub const PackageManager = struct {
                             );
                         } else if (comptime log_level != .silent) {
                             const fmt = "\n<r><red>error<r>: {s} downloading package manifest <b>{s}<r>\n";
-                            const error_name: string = std.mem.span(@errorName(err));
+                            const error_name: string = bun.span(@errorName(err));
                             const args = .{ error_name, name.slice() };
                             if (comptime log_level.showProgress()) {
                                 Output.prettyWithPrinterFn(fmt, args, Progress.log, &manager.progress);
@@ -3279,7 +3283,7 @@ pub const PackageManager = struct {
                             );
                         } else {
                             const fmt = "\n<r><red>error<r>: {s} downloading tarball <b>{s}@{s}<r>\n";
-                            const error_name: string = std.mem.span(@errorName(err));
+                            const error_name: string = bun.span(@errorName(err));
                             const args = .{ error_name, extract.name.slice(), extract.resolution.fmt(manager.lockfile.buffers.string_bytes.items) };
 
                             if (comptime log_level != .silent) {
@@ -3567,7 +3571,7 @@ pub const PackageManager = struct {
             // must be absolute
             if (this.bin_path[0] != std.fs.path.sep) return false;
             var tokenizer = std.mem.split(bun.getenvZ("PATH") orelse "", ":");
-            const spanned = std.mem.span(this.bin_path);
+            const spanned = bun.span(this.bin_path);
             while (tokenizer.next()) |token| {
                 if (strings.eql(token, spanned)) return true;
             }
@@ -4317,7 +4321,7 @@ pub const PackageManager = struct {
                     var chdir = cwd_buf[0..parent.len :0];
 
                     std.os.chdirZ(chdir) catch |err| {
-                        Output.prettyErrorln("Error {s} while chdir - {s}", .{ @errorName(err), std.mem.span(chdir) });
+                        Output.prettyErrorln("Error {s} while chdir - {s}", .{ @errorName(err), bun.span(chdir) });
                         Output.flush();
                         return err;
                     };
@@ -5684,7 +5688,7 @@ pub const PackageManager = struct {
             comptime log_level: Options.LogLevel,
         ) void {
             const name = this.lockfile.str(&this.names[package_id]);
-            const resolution = this.resolutions[package_id];
+            const resolution = &this.resolutions[package_id];
             const task_id = switch (resolution.tag) {
                 .github => Task.Id.forTarball(data.url),
                 .npm => Task.Id.forNPMPackage(Task.Tag.extract, name, resolution.value.npm.version),
@@ -5709,7 +5713,7 @@ pub const PackageManager = struct {
             package_id: PackageID,
             comptime log_level: Options.LogLevel,
             name: string,
-            resolution: Resolution,
+            resolution: *const Resolution,
         ) void {
             const buf = this.lockfile.buffers.string_bytes.items;
 
@@ -5748,7 +5752,7 @@ pub const PackageManager = struct {
                     installer.cache_dir = this.manager.getCacheDirectory();
                 },
                 .github => {
-                    installer.cache_dir_subpath = this.manager.cachedGitHubFolderName(resolution.value.github);
+                    installer.cache_dir_subpath = this.manager.cachedGitHubFolderName(&resolution.value.github);
                     installer.cache_dir = this.manager.getCacheDirectory();
                 },
                 .folder => {
@@ -5917,7 +5921,7 @@ pub const PackageManager = struct {
                                 .github => {
                                     this.manager.enqueueTarballForDownload(
                                         package_id,
-                                        resolution.value.github,
+                                        &resolution.value.github,
                                         .{
                                             .node_modules_folder = @intCast(u32, this.node_modules_folder.dir.fd),
                                         },
@@ -5979,7 +5983,7 @@ pub const PackageManager = struct {
             }
 
             const name = this.lockfile.str(&this.names[package_id]);
-            const resolution = this.resolutions[package_id];
+            const resolution = &this.resolutions[package_id];
 
             this.installPackageWithNameAndResolution(package_id, log_level, name, resolution);
         }
@@ -6017,7 +6021,7 @@ pub const PackageManager = struct {
     pub fn enqueueTarballForDownload(
         this: *PackageManager,
         package_id: PackageID,
-        repository: Repository,
+        repository: *const Repository,
         task_context: TaskCallbackContext,
     ) void {
         const url = this.allocGitHubURL(repository) catch unreachable;
@@ -6145,7 +6149,7 @@ pub const PackageManager = struct {
             const cwd = std.fs.cwd();
 
             while (iterator.nextNodeModulesFolder()) |node_modules| {
-                try cwd.makePath(std.mem.span(node_modules.relative_path));
+                try cwd.makePath(bun.span(node_modules.relative_path));
                 // We deliberately do not close this folder.
                 // If the package hasn't been downloaded, we will need to install it later
                 // We use this file descriptor to know where to put it.
diff --git a/src/install/lockfile.zig b/src/install/lockfile.zig
index 32576751e..74c467cb8 100644
--- a/src/install/lockfile.zig
+++ b/src/install/lockfile.zig
@@ -1271,9 +1271,9 @@ pub const Printer = struct {
                     const always_needs_quote = name[0] == '@';
                     var prev_dependency_version: ?Dependency.Version = null;
                     var needs_comma = false;
-                    for (dependency_versions) |dependency_version| {
+                    for (dependency_versions) |*dependency_version| {
                         if (needs_comma) {
-                            if (prev_dependency_version) |prev| {
+                            if (prev_dependency_version) |*prev| {
                                 if (prev.eql(dependency_version, string_buf, string_buf)) {
                                     continue;
                                 }
@@ -1295,7 +1295,7 @@ pub const Printer = struct {
                         if (needs_quote) {
                             try writer.writeByte('"');
                         }
-                        prev_dependency_version = dependency_version;
+                        prev_dependency_version = dependency_version.*;
                         needs_comma = true;
                     }
 
@@ -1516,7 +1516,7 @@ pub fn getPackageID(
     name_hash: u64,
     // if it's a peer dependency, a folder, or a symlink
     version: ?Dependency.Version,
-    resolution: Resolution,
+    resolution: *const Resolution,
 ) ?PackageID {
     const entry = this.package_index.get(name_hash) orelse return null;
     const resolutions: []const Resolution = this.packages.items(.resolution);
@@ -1638,7 +1638,7 @@ pub fn appendPackage(this: *Lockfile, package_: Lockfile.Package) !Lockfile.Pack
 fn appendPackageWithID(this: *Lockfile, package_: Lockfile.Package, id: PackageID) !Lockfile.Package {
     defer {
         if (comptime Environment.isDebug) {
-            std.debug.assert(this.getPackageID(package_.name_hash, null, package_.resolution) != null);
+            std.debug.assert(this.getPackageID(package_.name_hash, null, &package_.resolution) != null);
         }
     }
     var package = package_;
@@ -1853,6 +1853,16 @@ pub const Package = extern struct {
     meta: Meta = Meta{},
     bin: Bin = Bin{},
 
+    pub fn verify(this: *const Package, externs: []const ExternalString) void {
+        if (comptime !Environment.allow_assert)
+            return;
+
+        this.name.assertDefined();
+        this.resolution.verify();
+        this.meta.man_dir.assertDefined();
+        this.bin.verify(externs);
+    }
+
     pub const DependencyGroup = struct {
         prop: string,
         field: string,
@@ -1903,8 +1913,8 @@ pub const Package = extern struct {
         this.meta.count(old_string_buf, *Lockfile.StringBuilder, builder);
         const new_extern_string_count = this.bin.count(old_string_buf, old_extern_string_buf, *Lockfile.StringBuilder, builder);
 
-        if (old.alias_map.get(this.meta.id)) |alias| {
-            builder.count(old.str(&alias));
+        if (old.alias_map.get(this.meta.id)) |*alias| {
+            builder.count(old.str(alias));
         }
 
         const old_dependencies: []const Dependency = this.dependencies.get(old.buffers.dependencies.items);
@@ -1960,11 +1970,12 @@ pub const Package = extern struct {
             },
             id,
         );
+        defer new_package.verify(new.buffers.extern_strings.items);
 
         package_id_mapping[this.meta.id] = new_package.meta.id;
 
-        if (old.alias_map.get(this.meta.id)) |alias| {
-            try new.alias_map.put(new.allocator, new_package.meta.id, builder.append(String, old.str(&alias)));
+        if (old.alias_map.get(this.meta.id)) |*alias| {
+            try new.alias_map.put(new.allocator, new_package.meta.id, builder.append(String, old.str(alias)));
         }
 
         for (old_dependencies) |dependency, i| {
@@ -2325,7 +2336,7 @@ pub const Package = extern struct {
             const to_deps = to.dependencies.get(to_lockfile.buffers.dependencies.items);
             const from_deps = from.dependencies.get(from_lockfile.buffers.dependencies.items);
 
-            for (from_deps) |from_dep, i| {
+            for (from_deps) |*from_dep, i| {
                 // common case: dependency is present in both versions and in the same position
                 const to_i = if (to_deps.len > i and to_deps[i].name_hash == from_dep.name_hash)
                     i
diff --git a/src/install/npm.zig b/src/install/npm.zig
index 3301b2653..79dea81ce 100644
--- a/src/install/npm.zig
+++ b/src/install/npm.zig
@@ -407,6 +407,13 @@ pub const PackageVersion = extern struct {
     os: OperatingSystem = OperatingSystem.all,
     /// `"cpu"` field in package.json
     cpu: Architecture = Architecture.all,
+
+    pub fn verify(this: *const PackageVersion) void {
+        if (comptime !Environment.allow_assert)
+            return;
+
+        this.man_dir.value.assertDefined();
+    }
 };
 
 pub const NpmPackage = extern struct {
@@ -440,6 +447,23 @@ pub const PackageManifest = struct {
     package_versions: []const PackageVersion = &[_]PackageVersion{},
     extern_strings_bin_entries: []const ExternalString = &[_]ExternalString{},
 
+    pub fn verify(this: *const PackageManifest) void {
+        if (comptime !Environment.allow_assert)
+            return;
+
+        for (this.extern_strings_bin_entries) |*entry| {
+            entry.value.assertDefined();
+        }
+
+        for (this.external_strings_for_versions) |entry| {
+            entry.value.assertDefined();
+        }
+
+        for (this.package_versions) |package| {
+            package.tarball_url.value.assertDefined();
+        }
+    }
+
     pub inline fn name(this: *const PackageManifest) string {
         return this.pkg.name.slice(this.string_buf);
     }
@@ -617,6 +641,8 @@ pub const PackageManifest = struct {
                 }
             }
 
+            package_manifest.verify();
+
             return package_manifest;
         }
     };
diff --git a/src/install/repository.zig b/src/install/repository.zig
index a3e8dcf38..cb7ded6d8 100644
--- a/src/install/repository.zig
+++ b/src/install/repository.zig
@@ -13,6 +13,13 @@ pub const Repository = extern struct {
     committish: GitSHA = GitSHA{},
     resolved: String = String{},
 
+    pub fn verify(this: *const Repository) void {
+        this.owner.assertDefined();
+        this.repo.assertDefined();
+        this.committish.assertDefined();
+        this.resolved.assertDefined();
+    }
+
     pub fn order(lhs: *const Repository, rhs: *const Repository, lhs_buf: []const u8, rhs_buf: []const u8) std.math.Order {
         const owner_order = lhs.owner.order(&rhs.owner, lhs_buf, rhs_buf);
         if (owner_order != .eq) return owner_order;
@@ -22,14 +29,14 @@ pub const Repository = extern struct {
         return lhs.committish.order(&rhs.committish, lhs_buf, rhs_buf);
     }
 
-    pub fn count(this: Repository, buf: []const u8, comptime StringBuilder: type, builder: StringBuilder) void {
+    pub fn count(this: *const Repository, buf: []const u8, comptime StringBuilder: type, builder: StringBuilder) void {
         builder.count(this.owner.slice(buf));
         builder.count(this.repo.slice(buf));
         builder.count(this.committish.slice(buf));
         builder.count(this.resolved.slice(buf));
     }
 
-    pub fn clone(this: Repository, buf: []const u8, comptime StringBuilder: type, builder: StringBuilder) Repository {
+    pub fn clone(this: *const Repository, buf: []const u8, comptime StringBuilder: type, builder: StringBuilder) Repository {
         return Repository{
             .owner = builder.append(String, this.owner.slice(buf)),
             .repo = builder.append(String, this.repo.slice(buf)),
@@ -38,13 +45,13 @@ pub const Repository = extern struct {
         };
     }
 
-    pub fn eql(lhs: Repository, rhs: Repository, lhs_buf: []const u8, rhs_buf: []const u8) bool {
+    pub fn eql(lhs: *const Repository, rhs: *const Repository, lhs_buf: []const u8, rhs_buf: []const u8) bool {
         return lhs.owner.eql(rhs.owner, lhs_buf, rhs_buf) and
             lhs.repo.eql(rhs.repo, lhs_buf, rhs_buf) and
             lhs.committish.eql(rhs.committish, lhs_buf, rhs_buf);
     }
 
-    pub fn formatAs(this: Repository, label: string, buf: []const u8, comptime layout: []const u8, opts: std.fmt.FormatOptions, writer: anytype) !void {
+    pub fn formatAs(this: *const Repository, label: string, buf: []const u8, comptime layout: []const u8, opts: std.fmt.FormatOptions, writer: anytype) !void {
         const formatter = Formatter{ .label = label, .repository = this, .buf = buf };
         return try formatter.format(layout, opts, writer);
     }
@@ -52,7 +59,7 @@ pub const Repository = extern struct {
     pub const Formatter = struct {
         label: []const u8 = "",
         buf: []const u8,
-        repository: Repository,
+        repository: *const Repository,
         pub fn format(formatter: Formatter, comptime _: []const u8, _: std.fmt.FormatOptions, writer: anytype) !void {
             if (Environment.allow_assert) std.debug.assert(formatter.label.len > 0);
 
diff --git a/src/install/resolution.zig b/src/install/resolution.zig
index a6861b825..265dc402d 100644
--- a/src/install/resolution.zig
+++ b/src/install/resolution.zig
@@ -39,6 +39,24 @@ pub const Resolution = extern struct {
         };
     }
 
+    pub fn verify(this: *const Resolution) void {
+        switch (this.tag) {
+            .npm => {
+                this.value.npm.url.assertDefined();
+            },
+            .local_tarball => this.value.local_tarball.assertDefined(),
+            .git_ssh => this.value.git_ssh.assertDefined(),
+            .git_http => this.value.git_http.assertDefined(),
+            .folder => this.value.folder.assertDefined(),
+            .remote_tarball => this.value.remote_tarball.assertDefined(),
+            .workspace => this.value.workspace.assertDefined(),
+            .symlink => this.value.symlink.assertDefined(),
+            .github => this.value.github.verify(),
+            .gitlab => this.value.gitlab.verify(),
+            else => {},
+        }
+    }
+
     pub fn count(this: *const Resolution, buf: []const u8, comptime Builder: type, builder: Builder) void {
         switch (this.tag) {
             .npm => this.value.npm.count(buf, Builder, builder),
@@ -56,7 +74,7 @@ pub const Resolution = extern struct {
         }
     }
 
-    pub fn clone(this: Resolution, buf: []const u8, comptime Builder: type, builder: Builder) Resolution {
+    pub fn clone(this: *const Resolution, buf: []const u8, comptime Builder: type, builder: Builder) Resolution {
         return Resolution{
             .tag = this.tag,
             .value = switch (this.tag) {
@@ -99,17 +117,17 @@ pub const Resolution = extern struct {
         };
     }
 
-    pub fn fmt(this: Resolution, buf: []const u8) Formatter {
+    pub fn fmt(this: *const Resolution, buf: []const u8) Formatter {
         return Formatter{ .resolution = this, .buf = buf };
     }
 
-    pub fn fmtURL(this: Resolution, options: *const PackageManager.Options, name: string, buf: []const u8) URLFormatter {
+    pub fn fmtURL(this: *const Resolution, options: *const PackageManager.Options, name: string, buf: []const u8) URLFormatter {
         return URLFormatter{ .resolution = this, .buf = buf, .package_name = name, .options = options };
     }
 
     pub fn eql(
-        lhs: Resolution,
-        rhs: Resolution,
+        lhs: *const Resolution,
+        rhs: *const Resolution,
         lhs_string_buf: []const u8,
         rhs_string_buf: []const u8,
     ) bool {
@@ -159,12 +177,12 @@ pub const Resolution = extern struct {
                 rhs_string_buf,
             ),
             .github => lhs.value.github.eql(
-                rhs.value.github,
+                &rhs.value.github,
                 lhs_string_buf,
                 rhs_string_buf,
             ),
             .gitlab => lhs.value.gitlab.eql(
-                rhs.value.gitlab,
+                &rhs.value.gitlab,
                 lhs_string_buf,
                 rhs_string_buf,
             ),
@@ -173,7 +191,7 @@ pub const Resolution = extern struct {
     }
 
     pub const URLFormatter = struct {
-        resolution: Resolution,
+        resolution: *const Resolution,
         options: *const PackageManager.Options,
         package_name: string,
 
@@ -198,7 +216,7 @@ pub const Resolution = extern struct {
     };
 
     pub const Formatter = struct {
-        resolution: Resolution,
+        resolution: *const Resolution,
         buf: []const u8,
 
         pub fn format(formatter: Formatter, comptime layout: []const u8, opts: std.fmt.FormatOptions, writer: anytype) !void {
diff --git a/src/install/resolvers/folder_resolver.zig b/src/install/resolvers/folder_resolver.zig
index 4ba315163..f525ee613 100644
--- a/src/install/resolvers/folder_resolver.zig
+++ b/src/install/resolvers/folder_resolver.zig
@@ -160,7 +160,7 @@ pub const FolderResolution = union(Tag) {
             features,
         );
 
-        if (manager.lockfile.getPackageID(package.name_hash, version, package.resolution)) |existing_id| {
+        if (manager.lockfile.getPackageID(package.name_hash, version, &package.resolution)) |existing_id| {
             return manager.lockfile.packages.get(existing_id);
         }
 
diff --git a/src/resolver/resolver.zig b/src/resolver/resolver.zig
index 62f5dbe32..21b4df14f 100644
--- a/src/resolver/resolver.zig
+++ b/src/resolver/resolver.zig
@@ -1963,7 +1963,7 @@ pub const Resolver = struct {
 
             // All packages are enqueued to the root
             // because we download all the npm package dependencies
-            switch (pm.enqueueDependencyToRoot(esm.name, esm.version, version, behavior, is_main)) {
+            switch (pm.enqueueDependencyToRoot(esm.name, esm.version, &version, behavior, is_main)) {
                 .resolution => |result| {
                     input_package_id_.* = result.package_id;
                     return .{ .resolution = result.resolution };