[mwolson]

Summary

New package-lock.json entries written by aube now carry the metadata npm
writes: hasInstallScript even when aube resolved from full packuments, plus
normalized bin and full funding. A later real npm ci therefore runs the
packages' install scripts. aube's internal npm metadata also stays out of
bun.lock. Upstream
#1846 npm-lock-new-entry-install-script
records the abbreviated packument's flag,
#1858 npm-lock-new-entry-bin-deprecated
writes deprecated, and
#1874 npm-libc-rule decides when
libc is written; this layer covers full packuments, the remaining fields and
small additions to that libc rule.

Problem and Fix

Problem and Why it Happened	Fix
With the default minimumReleaseAge, aube resolves from full packuments, which carry scripts and no hasInstallScript, so new entries still lacked the flag and npm ci skipped install scripts (core-js, msw).	The registry metadata derives the flag from a non-empty preinstall, install or postinstall script, including npm's implicit node-gyp rebuild, and upstream's insertion writes it.
New entries wrote a scoped package's string bin as ./cli.js (npm writes {"metadata": "cli.js"}) and kept only the first funding URL.	npm bin normalization runs only in the npm writer (other lockfile formats keep upstream's shape), and funding is kept as published.
A registry package that bundles an optional dependency got __aube_npm_bundled_optional in its bun.lock metadata slot, which Bun never writes and drops on its next install.	The bun writer skips aube's internal npm metadata.
Upstream's libc rule ignores an existing libc field that is empty or a scalar, and accepts a loose version in packageManager.	On top of upstream's rule, any existing libc field counts as the lockfile using it, only a plain semver pin selects npm's convention, and existing libc fields stay as written.

Validation

• Repros npm-lock-new-entry-install-script and
  bun-lock-npm-bundled-optional-meta pass (both fail on upstream v2.8.4), and
  npm-lock-new-entry-libc passes.
• aube add of a package with libc is byte-identical to npm with
  packageManager pins 11.20.0, 11.6.2 and none.
• A local-registry comparison where every field matches npm 11.6.2.
• A private React frontend: all 48 new entries match npm 10.8.2, and npm ci
  runs msw's postinstall.
• Full-metadata cost, measured 2026-10-25: no difference when adding one
  dependency to an existing npm lockfile, and 0 to 7 percent on medians for a
  whole-tree update --lockfile-only, within network noise.