chore(F6.1): verify patched runtime locks structurally

.github/workflows/f6-1-fix-runtime-deps.yml

@@ -42,11 +42,32 @@ jobs:
       - name: Verify resolved patched versions
         run: |
           set -Eeuo pipefail
-          grep -Fq '"multer": "2.3.0"' api-v3/package-lock.json
+          node <<'NODE'
-          grep -Fq '"qs": "6.16.0"' api-v3/package-lock.json
+          const api = require('./api-v3/package-lock.json');
-          grep -Fq '"maplibre-gl": "6.4.1"' web-v2/package.json
+          const web = require('./web-v2/package-lock.json');
-          grep -Fq '"node_modules/maplibre-gl"' web-v2/package-lock.json
+          const apiPackages = api.packages ?? {};
-          grep -Fq '"version": "6.4.1"' web-v2/package-lock.json
+          const webPackages = web.packages ?? {};
+
+          const versions = (packages, dependency) => Object.entries(packages)
+            .filter(([path]) => path.endsWith(`node_modules/${dependency}`))
+            .map(([, metadata]) => metadata.version);
+
+          const assertOnly = (dependency, actual, expected) => {
+            if (actual.length === 0 || actual.some((version) => version !== expected)) {
+              throw new Error(`${dependency}: expected only ${expected}, got ${JSON.stringify(actual)}`);
+            }
+            console.log(`${dependency}: ${actual.join(', ')}`);
+          };
+
+          assertOnly('multer', versions(apiPackages, 'multer'), '2.3.0');
+          assertOnly('qs', versions(apiPackages, 'qs'), '6.16.0');
+          assertOnly('maplibre-gl', versions(webPackages, 'maplibre-gl'), '6.4.1');
+
+          const webManifest = require('./web-v2/package.json');
+          if (webManifest.dependencies?.['maplibre-gl'] !== '6.4.1') {
+            throw new Error(`maplibre-gl manifest is ${webManifest.dependencies?.['maplibre-gl']}`);
+          }
+          NODE
 
       - name: Commit patched dependency locks
         run: |