aube add rewrites every existing package-lock.json entry and truncates funding arrays

[mwolson]

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-lock-entry-rewrite
• aube: 2.8.1 linux-x64 (2026-10-20)

This splits out the remaining parts of #1774, where you noted that the field reordering and funding.type weren't addressed yet. With ajv@8.17.1 as the only dev dependency, aube add is-number@7.0.0 changes all 5 existing entries. npm 10.8.2 and 11.19.1 leave them untouched on the same add. Aube moves "dev": true after license and funding, drops type from funding, and reduces fast-uri's funding array to its first URL:

before: [{"type":"github","url":"https://github.com/sponsors/fastify"},{"type":"opencollective","url":"https://opencollective.com/fastify"}]
after:  {"url":"https://github.com/sponsors/fastify"}

NPM_BIN=/path/to/real/npm ./repro.sh

npm ci accepts the result, so nothing breaks, but in a real project a two-package dev add changed 2,663 lockfile lines where npm changed 843.

[jdx]

Thanks for the detailed repro. #1814 fixes this: existing package-lock.json entries now keep npm's key order (so "dev": true stays put) and their full funding (type and arrays), and a read → write round trip of an npm-written lockfile is byte-identical.

One remaining gap: a newly resolved package with funding is still written as {"url": ...}, because the resolver only carries the URL. Existing entries are unaffected.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[github-actions[bot]]

Implemented in #1814: fix(lockfile): preserve package-lock.json entry key order and funding

[mwolson]

Retested with aube 2.8.2 linux-x64 (2026-10-23):

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: npm-lock-entry-rewrite

NPM_BIN=/path/to/real/npm ./repro.sh

It now exits 0 with native npm 11.6.2 as the control. aube add is-number@7.0.0 leaves all 5 existing entries as npm wrote them, including fast-uri's key order and both funding entries with their type.

Fix shipped in aube 2.8.2 via #1814. Marking your reply as the answer.