@jigging/jig 0.1.0-alpha.15 → 0.1.0-alpha.16

package/libexec/preparation/bun-native-preparation-worker.js

@@ -1,26 +1,896 @@
 // @bun
+// src/internal/bun-prepared-capture.ts
+import { lstat, opendir, readFile, realpath } from "fs/promises";
+import { join } from "path";
+
+// src/internal/bun-execution-layout.ts
+import { types as utilTypes3 } from "util";
+
+// src/diagnostics.ts
+class CheckError extends Error {
+  kind;
+  code;
+  path;
+  pointer;
+  constructor(kind, code, message, path, pointer) {
+    super(message);
+    this.name = "CheckError";
+    this.kind = kind;
+    this.code = code;
+    if (path !== undefined)
+      this.path = path;
+    if (pointer !== undefined)
+      this.pointer = pointer;
+  }
+}
+function invalid(code, message, path, pointer) {
+  throw new CheckError("invalid", code, message, path, pointer);
+}
+function unavailable(code, message, path, pointer) {
+  throw new CheckError("unavailable", code, message, path, pointer);
+}
+
+// src/package/paths.ts
+var encoder = new TextEncoder;
+var REQUIRED_UNICODE_VERSION = "15.1";
+var PACKAGE_1_MAX_PATH_BYTES = 1024;
+function isNfc15_1(value) {
+  const actual = process.versions.unicode;
+  if (actual !== REQUIRED_UNICODE_VERSION) {
+    unavailable("PACKAGE_UNICODE_UNAVAILABLE", `Package/1 requires Unicode ${REQUIRED_UNICODE_VERSION} NFC; host reports ${actual ?? "no Unicode version"}`);
+  }
+  return value === value.normalize("NFC");
+}
+function validateLogicalPath(path) {
+  if (path.length === 0 || path.startsWith("/") || path.includes("\\") || path.includes("\x00")) {
+    invalid("PACKAGE_PATH", `invalid logical path ${JSON.stringify(path)}`, path);
+  }
+  assertUnicodeScalarString(path);
+  if (!isNfc15_1(path)) {
+    invalid("PACKAGE_PATH_NFC", `logical path is not NFC: ${JSON.stringify(path)}`, path);
+  }
+  const segments = path.split("/");
+  if (segments.length > 64)
+    invalid("PACKAGE_PATH_LIMIT", `logical path exceeds 64 segments`, path);
+  if (encoder.encode(path).byteLength > PACKAGE_1_MAX_PATH_BYTES) {
+    invalid("PACKAGE_PATH_LIMIT", `logical path exceeds ${PACKAGE_1_MAX_PATH_BYTES} UTF-8 bytes`, path);
+  }
+  for (const segment of segments) {
+    if (segment.length === 0 || segment === "." || segment === "..") {
+      invalid("PACKAGE_PATH", `logical path has an invalid segment`, path);
+    }
+    if (encoder.encode(segment).byteLength > 255) {
+      invalid("PACKAGE_PATH_LIMIT", `logical path segment exceeds 255 UTF-8 bytes`, path);
+    }
+  }
+  return path;
+}
+function assertUnicodeScalarString(value) {
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343)) {
+        invalid("PACKAGE_PATH", "logical path contains a lone Unicode surrogate", value);
+      }
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      invalid("PACKAGE_PATH", "logical path contains a lone Unicode surrogate", value);
+    }
+  }
+}
+function comparePathBytes(left, right) {
+  return Buffer.compare(Buffer.from(left, "utf8"), Buffer.from(right, "utf8"));
+}
+
+// src/internal/package-aliases.ts
+import { posix } from "path";
+import { types as utilTypes2 } from "util";
+
+// src/internal/private-ordinary-json.ts
+import { types as utilTypes } from "util";
+
+// src/json.ts
+var JSON_1_LIMITS = Object.freeze({
+  bytes: 16777216,
+  depth: 128,
+  nodes: 262144,
+  containerEntries: 65536,
+  stringBytes: 8388608,
+  memberNameBytes: 1024,
+  numberTokenBytes: 128
+});
+var encoder2 = new TextEncoder;
+var decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+
+class Json1Error extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "Json1Error";
+  }
+}
+
+class Parser {
+  source;
+  position = 0;
+  nodes = 0;
+  constructor(source) {
+    this.source = source;
+  }
+  parse() {
+    this.skipWhitespace();
+    const value = this.parseValue(1);
+    this.skipWhitespace();
+    if (this.position !== this.source.length)
+      this.fail("unexpected trailing characters");
+    return value;
+  }
+  parseValue(depth) {
+    if (depth > JSON_1_LIMITS.depth)
+      this.fail("maximum value depth exceeded");
+    this.nodes += 1;
+    if (this.nodes > JSON_1_LIMITS.nodes)
+      this.fail("maximum value nodes exceeded");
+    const char = this.source[this.position];
+    if (char === '"')
+      return this.parseString(false);
+    if (char === "{")
+      return this.parseObject(depth);
+    if (char === "[")
+      return this.parseArray(depth);
+    if (char === "t")
+      return this.parseLiteral("true", true);
+    if (char === "f")
+      return this.parseLiteral("false", false);
+    if (char === "n")
+      return this.parseLiteral("null", null);
+    if (char === "-" || char !== undefined && char >= "0" && char <= "9") {
+      return this.parseNumber();
+    }
+    return this.fail("expected a JSON value");
+  }
+  parseObject(depth) {
+    this.position += 1;
+    const result = Object.create(null);
+    const keys = new Set;
+    this.skipWhitespace();
+    if (this.consume("}"))
+      return result;
+    let members = 0;
+    while (true) {
+      if (this.source[this.position] !== '"')
+        this.fail("expected an object member name");
+      const key = this.parseString(true);
+      if (keys.has(key))
+        this.fail(`duplicate object member ${key}`);
+      keys.add(key);
+      members += 1;
+      if (members > JSON_1_LIMITS.containerEntries) {
+        this.fail("maximum object members exceeded");
+      }
+      this.skipWhitespace();
+      if (!this.consume(":"))
+        this.fail("expected ':' after member name");
+      this.skipWhitespace();
+      result[key] = this.parseValue(depth + 1);
+      this.skipWhitespace();
+      if (this.consume("}"))
+        return result;
+      if (!this.consume(","))
+        this.fail("expected ',' or '}'");
+      this.skipWhitespace();
+    }
+  }
+  parseArray(depth) {
+    this.position += 1;
+    const result = [];
+    this.skipWhitespace();
+    if (this.consume("]"))
+      return result;
+    while (true) {
+      if (result.length >= JSON_1_LIMITS.containerEntries) {
+        this.fail("maximum array items exceeded");
+      }
+      result.push(this.parseValue(depth + 1));
+      this.skipWhitespace();
+      if (this.consume("]"))
+        return result;
+      if (!this.consume(","))
+        this.fail("expected ',' or ']'");
+      this.skipWhitespace();
+    }
+  }
+  parseString(memberName) {
+    this.position += 1;
+    const parts = [];
+    let segmentStart = this.position;
+    while (this.position < this.source.length) {
+      const char = this.source[this.position];
+      this.position += 1;
+      if (char === '"') {
+        parts.push(this.source.slice(segmentStart, this.position - 1));
+        const value = parts.join("");
+        const limit = memberName ? JSON_1_LIMITS.memberNameBytes : JSON_1_LIMITS.stringBytes;
+        if (encoder2.encode(value).byteLength > limit)
+          this.fail("maximum string bytes exceeded");
+        return value;
+      }
+      if (char === "\\") {
+        parts.push(this.source.slice(segmentStart, this.position - 1));
+        parts.push(this.parseEscape());
+        segmentStart = this.position;
+        continue;
+      }
+      if (char === undefined || char.charCodeAt(0) <= 31) {
+        this.fail("invalid character in string");
+      }
+      const code = char.charCodeAt(0);
+      if (code >= 55296 && code <= 57343) {
+        const next = this.source[this.position];
+        if (code > 56319 || next === undefined || next.charCodeAt(0) < 56320 || next.charCodeAt(0) > 57343)
+          this.fail("lone Unicode surrogate");
+        this.position += 1;
+      }
+    }
+    return this.fail("unterminated string");
+  }
+  parseEscape() {
+    const escape = this.source[this.position];
+    this.position += 1;
+    switch (escape) {
+      case '"':
+      case "\\":
+      case "/":
+        return escape;
+      case "b":
+        return "\b";
+      case "f":
+        return "\f";
+      case "n":
+        return `
+`;
+      case "r":
+        return "\r";
+      case "t":
+        return "\t";
+      case "u": {
+        const first = this.parseHexCodeUnit();
+        if (first >= 55296 && first <= 56319) {
+          if (this.source.slice(this.position, this.position + 2) !== "\\u") {
+            this.fail("high surrogate without low surrogate");
+          }
+          this.position += 2;
+          const second = this.parseHexCodeUnit();
+          if (second < 56320 || second > 57343) {
+            this.fail("high surrogate without low surrogate");
+          }
+          return String.fromCharCode(first, second);
+        }
+        if (first >= 56320 && first <= 57343)
+          this.fail("lone low surrogate");
+        return String.fromCharCode(first);
+      }
+      default:
+        return this.fail("invalid string escape");
+    }
+  }
+  parseHexCodeUnit() {
+    const token = this.source.slice(this.position, this.position + 4);
+    if (!/^[0-9A-Fa-f]{4}$/.test(token))
+      this.fail("invalid Unicode escape");
+    this.position += 4;
+    return Number.parseInt(token, 16);
+  }
+  parseNumber() {
+    const start = this.position;
+    this.consume("-");
+    if (this.consume("0")) {
+      const next = this.source[this.position];
+      if (next !== undefined && next >= "0" && next <= "9") {
+        this.fail("leading zero in number");
+      }
+    } else {
+      if (!this.consumeDigit("1", "9"))
+        this.fail("invalid number");
+      while (this.consumeDigit("0", "9")) {}
+    }
+    if (this.consume(".")) {
+      if (!this.consumeDigit("0", "9"))
+        this.fail("fraction requires a digit");
+      while (this.consumeDigit("0", "9")) {}
+    }
+    const exponent = this.source[this.position];
+    if (exponent === "e" || exponent === "E") {
+      this.position += 1;
+      const sign = this.source[this.position];
+      if (sign === "+" || sign === "-")
+        this.position += 1;
+      if (!this.consumeDigit("0", "9"))
+        this.fail("exponent requires a digit");
+      while (this.consumeDigit("0", "9")) {}
+    }
+    const token = this.source.slice(start, this.position);
+    if (token.length > JSON_1_LIMITS.numberTokenBytes) {
+      this.fail("maximum number token bytes exceeded");
+    }
+    const value = Number(token);
+    if (!Number.isFinite(value))
+      this.fail("non-finite number");
+    if (Number.isInteger(value) && !Number.isSafeInteger(value)) {
+      this.fail("integral number outside safe range");
+    }
+    return value;
+  }
+  parseLiteral(token, value) {
+    if (this.source.slice(this.position, this.position + token.length) !== token) {
+      this.fail(`invalid literal ${token}`);
+    }
+    this.position += token.length;
+    return value;
+  }
+  consume(expected) {
+    if (this.source[this.position] !== expected)
+      return false;
+    this.position += 1;
+    return true;
+  }
+  consumeDigit(minimum, maximum) {
+    const char = this.source[this.position];
+    if (char === undefined || char < minimum || char > maximum)
+      return false;
+    this.position += 1;
+    return true;
+  }
+  skipWhitespace() {
+    while (true) {
+      const char = this.source[this.position];
+      if (char !== " " && char !== `
+` && char !== "\r" && char !== "\t")
+        return;
+      this.position += 1;
+    }
+  }
+  fail(message) {
+    throw new Json1Error(`${message} at character ${this.position}`);
+  }
+}
+function decodeJson1(bytes) {
+  if (bytes.byteLength === 0)
+    throw new Json1Error("empty JSON/1 document");
+  if (bytes.byteLength > JSON_1_LIMITS.bytes)
+    throw new Json1Error("maximum bytes exceeded");
+  if (bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191) {
+    throw new Json1Error("UTF-8 BOM is not allowed");
+  }
+  let text;
+  try {
+    text = decoder.decode(bytes);
+  } catch {
+    throw new Json1Error("invalid UTF-8");
+  }
+  return new Parser(text).parse();
+}
+function validateJson1(value) {
+  visitJson(value, 1, { nodes: 0, encodedBytes: 0, active: new WeakSet }, false);
+}
+function visitJson(value, depth, state, memberName) {
+  if (depth > JSON_1_LIMITS.depth)
+    throw new Json1Error("maximum value depth exceeded");
+  state.nodes += 1;
+  if (state.nodes > JSON_1_LIMITS.nodes)
+    throw new Json1Error("maximum value nodes exceeded");
+  if (value === null) {
+    chargeEncodedBytes(state, 4);
+    return;
+  }
+  if (typeof value === "boolean") {
+    chargeEncodedBytes(state, value ? 4 : 5);
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      throw new Json1Error("non-finite number");
+    if (Number.isInteger(value) && !Number.isSafeInteger(value)) {
+      throw new Json1Error("integral number outside safe range");
+    }
+    chargeEncodedBytes(state, (Object.is(value, -0) ? "0" : JSON.stringify(value)).length);
+    return;
+  }
+  if (typeof value === "string") {
+    validateString(value, memberName ? JSON_1_LIMITS.memberNameBytes : JSON_1_LIMITS.stringBytes);
+    chargeEncodedBytes(state, encodedJsonStringBytes(value));
+    return;
+  }
+  if (typeof value !== "object")
+    throw new Json1Error("value is not JSON/1");
+  if (state.active.has(value))
+    throw new Json1Error("cyclic value");
+  state.active.add(value);
+  try {
+    if (Array.isArray(value)) {
+      if (value.length > JSON_1_LIMITS.containerEntries) {
+        throw new Json1Error("maximum array items exceeded");
+      }
+      chargeEncodedBytes(state, 2 + Math.max(0, value.length - 1));
+      for (const child of value)
+        visitJson(child, depth + 1, state, false);
+      return;
+    }
+    const object = value;
+    const keys = Object.keys(object);
+    if (keys.length > JSON_1_LIMITS.containerEntries) {
+      throw new Json1Error("maximum object members exceeded");
+    }
+    chargeEncodedBytes(state, 2 + keys.length + Math.max(0, keys.length - 1));
+    for (const key of keys) {
+      validateString(key, JSON_1_LIMITS.memberNameBytes);
+      chargeEncodedBytes(state, encodedJsonStringBytes(key));
+      visitJson(object[key], depth + 1, state, false);
+    }
+  } finally {
+    state.active.delete(value);
+  }
+}
+function chargeEncodedBytes(state, bytes) {
+  if (bytes > JSON_1_LIMITS.bytes - state.encodedBytes) {
+    throw new Json1Error("maximum encoded bytes exceeded");
+  }
+  state.encodedBytes += bytes;
+}
+function encodedJsonStringBytes(value) {
+  return encoder2.encode(JSON.stringify(value)).byteLength;
+}
+function validateString(value, byteLimit) {
+  if (encoder2.encode(value).byteLength > byteLimit) {
+    throw new Json1Error("maximum string bytes exceeded");
+  }
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343))
+        throw new Json1Error("lone Unicode surrogate");
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      throw new Json1Error("lone Unicode surrogate");
+    }
+  }
+}
+function canonicalJson(value) {
+  validateJson1(value);
+  return encoder2.encode(canonicalText(value));
+}
+function canonicalText(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number")
+    return Object.is(value, -0) ? "0" : JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonicalText).join(",")}]`;
+  const object = value;
+  const members = Object.keys(object).sort(compareUtf16).map((key) => `${JSON.stringify(key)}:${canonicalText(object[key])}`);
+  return `{${members.join(",")}}`;
+}
+function compareUtf16(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+// src/internal/private-ordinary-json.ts
+function snapshotPrivateOrdinaryJson(value, label, invalid2) {
+  const ordinary = cloneOrdinaryJson(value, label, invalid2, new Set);
+  let cloned;
+  try {
+    cloned = decodeJson1(canonicalJson(ordinary));
+  } catch (error) {
+    if (error instanceof Json1Error)
+      throw invalid2(`${label} is not valid JSON/1: ${error.message}`);
+    throw error;
+  }
+  deepFreeze(cloned);
+  return cloned;
+}
+function cloneOrdinaryJson(value, label, invalid2, ancestors) {
+  if (value === null || typeof value === "boolean" || typeof value === "string" || typeof value === "number") {
+    return value;
+  }
+  if (typeof value !== "object" || utilTypes.isProxy(value)) {
+    throw invalid2(`${label} must be ordinary JSON/1 data`);
+  }
+  if (ancestors.has(value)) {
+    throw invalid2(`${label} must not contain a cycle`);
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      if (Object.getPrototypeOf(value) !== Array.prototype) {
+        throw invalid2(`${label} must use ordinary arrays`);
+      }
+      const keys = Reflect.ownKeys(value);
+      if (keys.length !== value.length + 1 || keys.some((key) => typeof key !== "string" || key !== "length" && !/^(?:0|[1-9][0-9]*)$/.test(key))) {
+        throw invalid2(`${label} must not use sparse or extended arrays`);
+      }
+      const result2 = [];
+      for (let index = 0;index < value.length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        if (descriptor === undefined || !("value" in descriptor) || !descriptor.enumerable) {
+          throw invalid2(`${label} must not use array accessors`);
+        }
+        result2.push(cloneOrdinaryJson(descriptor.value, `${label}[${index}]`, invalid2, ancestors));
+      }
+      return result2;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw invalid2(`${label} must use ordinary objects`);
+    }
+    const result = Object.create(null);
+    for (const key of Reflect.ownKeys(value)) {
+      if (typeof key !== "string") {
+        throw invalid2(`${label} must not contain symbol properties`);
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (descriptor === undefined || !("value" in descriptor) || !descriptor.enumerable) {
+        throw invalid2(`${label} must contain enumerable data properties`);
+      }
+      result[key] = cloneOrdinaryJson(descriptor.value, `${label}.${key}`, invalid2, ancestors);
+    }
+    return result;
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function deepFreeze(value) {
+  if (value === null || typeof value !== "object" || Object.isFrozen(value))
+    return;
+  if (Array.isArray(value)) {
+    for (const child of value)
+      deepFreeze(child);
+  } else {
+    for (const child of Object.values(value))
+      deepFreeze(child);
+  }
+  Object.freeze(value);
+}
+
+// src/internal/package-aliases.ts
+var PRIVATE_PACKAGE_ALIAS_LIMITS = Object.freeze({ records: 4096, bytes: 1024 * 1024 });
+function normalizePrivatePackageAliases(value) {
+  if (utilTypes2.isProxy(value) || !Array.isArray(value) || value.length > PRIVATE_PACKAGE_ALIAS_LIMITS.records)
+    invalid2();
+  const aliases = snapshotPrivateOrdinaryJson(value, "package aliases", () => new TypeError("invalid package aliases"));
+  if (Buffer.byteLength(JSON.stringify(aliases)) > PRIVATE_PACKAGE_ALIAS_LIMITS.bytes)
+    invalid2();
+  let prior;
+  for (const alias of aliases) {
+    if (alias === null || typeof alias !== "object" || Array.isArray(alias) || Object.keys(alias).length !== 2 || typeof alias.path !== "string" || typeof alias.target !== "string")
+      invalid2();
+    validateLogicalPath(alias.path);
+    validateLogicalPath(alias.target);
+    if (prior !== undefined && comparePathBytes(prior, alias.path) >= 0)
+      invalid2();
+    prior = alias.path;
+  }
+  const paths = new Set(aliases.map(({ path }) => path));
+  for (const alias of aliases) {
+    for (const path of [posix.dirname(alias.path), alias.target]) {
+      const parts = path.split("/");
+      while (parts.length > 0) {
+        if (paths.has(parts.join("/")))
+          invalid2();
+        parts.pop();
+      }
+    }
+  }
+  return aliases;
+}
+function assertPrivatePackageAliasFiles(aliases, files) {
+  const paths = new Set(files.map(({ path }) => path));
+  const directories = new Set([""]);
+  for (const path of paths) {
+    const parts = path.split("/");
+    while (parts.length > 1) {
+      parts.pop();
+      directories.add(parts.join("/"));
+    }
+  }
+  for (const alias of aliases) {
+    if (!directories.has(alias.target) || paths.has(alias.path) || directories.has(alias.path))
+      invalid2();
+    const parts = alias.path.split("/");
+    while (parts.length > 1) {
+      parts.pop();
+      if (paths.has(parts.join("/")))
+        invalid2();
+    }
+  }
+}
+function invalid2() {
+  throw new TypeError("invalid package aliases");
+}
+
+// src/internal/bun-execution-layout.ts
+var PRIVATE_BUN_EXECUTION_LAYOUT_LIMITS = Object.freeze({
+  members: 256,
+  aliases: PRIVATE_PACKAGE_ALIAS_LIMITS.records,
+  bytes: 1024 * 1024
+});
+var EMPTY_PRIVATE_BUN_EXECUTION_LAYOUT = Object.freeze({
+  flowRoot: "",
+  members: Object.freeze([]),
+  aliases: Object.freeze([])
+});
+function normalizePrivateBunExecutionLayout(value) {
+  const record = exact(value, ["flowRoot", "members", "aliases"]);
+  const memberValues = array(record.members, PRIVATE_BUN_EXECUTION_LAYOUT_LIMITS.members);
+  const aliases = normalizePrivatePackageAliases(record.aliases);
+  if (typeof record.flowRoot !== "string")
+    invalid3();
+  const flowRoot = record.flowRoot;
+  if (flowRoot !== "")
+    validateLogicalPath(flowRoot);
+  const members = [];
+  for (const member of memberValues) {
+    if (typeof member !== "string")
+      invalid3();
+    validateLogicalPath(member);
+    if (member.split("/").includes("node_modules") || members.some((prior) => member.startsWith(`${prior}/`)) || members.length > 0 && comparePathBytes(members.at(-1), member) >= 0)
+      invalid3();
+    members.push(member);
+  }
+  for (const alias of aliases) {
+    if (!members.includes(alias.target) || privateBunAliasPackageName(alias.path) === undefined)
+      invalid3();
+  }
+  if (flowRoot === "") {
+    if (members.length !== 0 || aliases.length !== 0)
+      invalid3();
+  } else if (!members.includes(flowRoot))
+    invalid3();
+  const layout = Object.freeze({
+    flowRoot,
+    members: Object.freeze(members),
+    aliases: Object.freeze(aliases)
+  });
+  if (Buffer.byteLength(JSON.stringify(layout)) > PRIVATE_BUN_EXECUTION_LAYOUT_LIMITS.bytes)
+    invalid3();
+  return layout;
+}
+function assertPrivateBunExecutionLayoutFiles(layout, files) {
+  for (const member of layout.members)
+    if (!files.some(({ path }) => path === `${member}/package.json`))
+      invalid3();
+  assertPrivatePackageAliasFiles(layout.aliases, files);
+}
+function privateBunAliasPackageName(path) {
+  const match = /(?:^|\/)node_modules\/((?:@[^/]+\/)?[^/]+)$/.exec(path);
+  const name = match?.[1];
+  return name === undefined || name.startsWith(".") || name.split("/").some((part) => part === ".bin") ? undefined : name;
+}
+function exact(value, keys) {
+  if (value === null || typeof value !== "object" || utilTypes3.isProxy(value) || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    invalid3();
+  const record = value;
+  const actual = Reflect.ownKeys(record);
+  if (actual.length !== keys.length || actual.some((key) => typeof key !== "string" || !keys.includes(key)))
+    invalid3();
+  const copy = Object.create(null);
+  for (const key of keys) {
+    const descriptor = Object.getOwnPropertyDescriptor(record, key);
+    if (!descriptor || !Object.hasOwn(descriptor, "value") || !descriptor.enumerable)
+      invalid3();
+    copy[key] = descriptor.value;
+  }
+  return copy;
+}
+function array(value, maximum) {
+  if (value === null || typeof value !== "object" || utilTypes3.isProxy(value) || !Array.isArray(value))
+    invalid3();
+  const length = Object.getOwnPropertyDescriptor(value, "length")?.value;
+  if (!Number.isSafeInteger(length) || length < 0 || length > maximum || Reflect.ownKeys(value).length !== length + 1)
+    invalid3();
+  const result = [];
+  for (let index = 0;index < length; index++) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+    if (!descriptor || !Object.hasOwn(descriptor, "value") || !descriptor.enumerable)
+      invalid3();
+    result.push(descriptor.value);
+  }
+  return result;
+}
+function invalid3() {
+  throw new TypeError("invalid private Bun execution layout");
+}
+
+// src/internal/bun-native-preparation-protocol.ts
+var MIB = 1024 * 1024;
+var MAX_JSON_BYTES_PER_PATH_BYTE = 6;
+var PRIVATE_BUN_PREPARATION_LIMITS = Object.freeze({
+  sourceFiles: 4096,
+  sourceBytes: 16 * MIB,
+  preparedFiles: 4096,
+  preparedBytes: 32 * MIB
+});
+function maximumPrivateBunFileMessageBytes(type, maximumFiles, maximumContentBytes) {
+  requireNonnegativeInteger(maximumFiles, "file count");
+  requireNonnegativeInteger(maximumContentBytes, "content bytes");
+  const emptyMessageBytes = Buffer.byteLength(JSON.stringify({ type, files: [] }));
+  const emptyFileBytes = Buffer.byteLength(JSON.stringify({ path: "", content: "" }));
+  const pathBytes = maximumFiles * PACKAGE_1_MAX_PATH_BYTES * MAX_JSON_BYTES_PER_PATH_BYTE;
+  const contentBytes = 4 * (Math.ceil(maximumContentBytes / 3) + maximumFiles);
+  const separators = Math.max(0, maximumFiles - 1);
+  const result = emptyMessageBytes + maximumFiles * emptyFileBytes + pathBytes + contentBytes + separators;
+  if (!Number.isSafeInteger(result))
+    throw new RangeError("Bun preparation message bound is too large");
+  return result;
+}
+var PRIVATE_BUN_SOURCE_MESSAGE_BYTES = maximumPrivateBunFileMessageBytes("source", PRIVATE_BUN_PREPARATION_LIMITS.sourceFiles, PRIVATE_BUN_PREPARATION_LIMITS.sourceBytes);
+var PRIVATE_BUN_PREPARED_MESSAGE_BYTES = maximumPrivateBunFileMessageBytes("prepared", PRIVATE_BUN_PREPARATION_LIMITS.preparedFiles, PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes) + PRIVATE_BUN_EXECUTION_LAYOUT_LIMITS.bytes + Buffer.byteLength(',"layout":');
+function privateBunMessageFits(bytes, maximum) {
+  return Number.isSafeInteger(bytes) && bytes >= 0 && bytes <= maximum;
+}
+function encodePrivateBunMessage(value) {
+  const json = JSON.stringify(value);
+  if (json === undefined)
+    throw new TypeError("Bun preparation message is not JSON-serializable");
+  return new TextEncoder().encode(`${json}
+`);
+}
+function requireNonnegativeInteger(value, label) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new TypeError(`${label} must be a nonnegative safe integer`);
+  }
+}
+
+// src/internal/bun-prepared-capture.ts
+var PATH = /^(?!\/)(?!.*(?:^|\/)\.\.?(?:\/|$))(?!.*\/\/)[^\0]+$/;
+
+class WorkerFailure extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+async function capturePrivateBunPreparedTree(packageRoot, workspace) {
+  const files = [];
+  const aliases = [];
+  let total = 0;
+  const memberNames = new Map;
+  for (const member of workspace?.members ?? []) {
+    const manifest = JSON.parse(await readFile(join(packageRoot, member, "package.json"), "utf8"));
+    if (typeof manifest.name !== "string")
+      unsupported("workspace member name is missing");
+    memberNames.set(member, manifest.name);
+  }
+  const reserveRecord = () => {
+    if (files.length + aliases.length >= PRIVATE_BUN_PREPARATION_LIMITS.preparedFiles)
+      throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree has too many records");
+  };
+  const selectedSource = (path) => workspace === undefined || workspace.selected.some((member) => path === member || path.startsWith(`${member}/`));
+  const ancestor = (path) => workspace?.selected.some((member) => member.startsWith(`${path}/`)) ?? false;
+  const visit = async (root, prefix, installed = false) => {
+    const names = [];
+    for await (const entry of await opendir(root))
+      names.push(entry.name);
+    names.sort(compare);
+    for (const name of names) {
+      const path = prefix === "" ? name : `${prefix}/${name}`;
+      if (name === ".bin" && prefix.split("/").at(-1) === "node_modules")
+        continue;
+      requirePath(path);
+      const physical = join(root, name);
+      const information = await lstat(physical);
+      const dependencyTree = installed || name === "node_modules";
+      const retained = dependencyTree || selectedSource(path) || ancestor(path) || prefix === "" && (name === "package.json" || name === "bun.lock");
+      if (!retained)
+        continue;
+      if (information.isSymbolicLink()) {
+        if (workspace === undefined || !dependencyTree)
+          unsupported("prepared source contains an unauthorized link");
+        const packageName = privateBunAliasPackageName(path);
+        const resolved = await realpath(physical);
+        const member = workspace.members.find((value) => join(packageRoot, value) === resolved);
+        if (member === undefined || packageName === undefined || memberNames.get(member) !== packageName)
+          unsupported("prepared dependencies contain an unauthorized link");
+        if (!workspace.selected.includes(member))
+          continue;
+        reserveRecord();
+        aliases.push(Object.freeze({ path, target: member }));
+        continue;
+      }
+      if (information.isDirectory()) {
+        await visit(physical, path, dependencyTree);
+        continue;
+      }
+      if (!information.isFile() || information.nlink !== 1)
+        unsupported("prepared dependencies contain a link or special file");
+      if (!dependencyTree && !selectedSource(path) && prefix !== "")
+        continue;
+      reserveRecord();
+      if (information.size > PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes - total)
+        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree is too large");
+      const bytes = await readFile(physical);
+      total += bytes.byteLength;
+      if (total > PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes)
+        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree is too large");
+      files.push(Object.freeze({ path, content: bytes.toString("base64") }));
+    }
+  };
+  await visit(packageRoot, "");
+  files.sort((left, right) => compare(left.path, right.path));
+  aliases.sort((left, right) => compare(left.path, right.path));
+  let layout = EMPTY_PRIVATE_BUN_EXECUTION_LAYOUT;
+  try {
+    if (workspace !== undefined)
+      layout = normalizePrivateBunExecutionLayout({
+        flowRoot: workspace.target,
+        members: [...workspace.selected].sort(compare),
+        aliases
+      });
+    assertPrivateBunExecutionLayoutFiles(layout, files);
+  } catch {
+    unsupported("prepared workspace layout is invalid");
+  }
+  if (total + Buffer.byteLength(JSON.stringify(layout)) > PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes)
+    throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree and layout are too large");
+  return Object.freeze({ files: Object.freeze(files), layout });
+}
+function requirePath(path) {
+  if (!PATH.test(path) || Buffer.byteLength(path) > 1024)
+    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source path is invalid");
+}
+function compare(left, right) {
+  return Buffer.from(left).compare(Buffer.from(right));
+}
+function unsupported(message) {
+  throw new WorkerFailure("PACKAGE_BUN_OUTPUT_UNSUPPORTED", message);
+}
+
 // src/internal/bun-native-preparation-worker.ts
 import { spawn } from "child_process";
-import { copyFile, lstat, mkdir, opendir, readFile, rm, writeFile } from "fs/promises";
-import { dirname, join } from "path";
+import { copyFile, mkdir, readFile as readFile2, rm, writeFile } from "fs/promises";
+import { dirname, join as join2 } from "path";
 
 // src/internal/bun-native-lock-policy.ts
-function requirePrivateBunResolutionManifest(value) {
+function requirePrivateBunResolutionManifest(value, workspace) {
   const manifest = ordinaryRecord(value);
-  if (manifest === undefined || ["workspaces", "patchedDependencies", "overrides", "resolutions"].some((field) => manifest[field] !== undefined))
+  if (manifest === undefined || [
+    ...workspace === "root" ? [] : ["workspaces"],
+    "patchedDependencies",
+    "overrides",
+    "resolutions",
+    "catalog",
+    "catalogs"
+  ].some((field) => manifest[field] !== undefined))
     throw new TypeError("unsupported Bun resolution input");
-  requireRegistryDependencyMaps(manifest);
+  if (workspace === "member" && (typeof manifest.name !== "string" || !isPackageName(manifest.name)))
+    throw new TypeError("workspace members require valid package names");
+  requireRegistryDependencyMaps(manifest, workspace !== undefined);
 }
-function requirePrivateBunLockPolicy(value) {
+function requirePrivateBunLockPolicy(value, members) {
   const lock = ordinaryRecord(value);
   const workspaces = ordinaryRecord(lock?.workspaces);
   const rootWorkspace = ordinaryRecord(workspaces?.[""]);
   const packages = ordinaryRecord(lock?.packages);
-  if (lock?.lockfileVersion !== 1 || workspaces === undefined || rootWorkspace === undefined || packages === undefined || Object.keys(workspaces).length !== 1 || lock.patchedDependencies !== undefined) {
+  if (lock?.lockfileVersion !== 1 || workspaces === undefined || rootWorkspace === undefined || packages === undefined || (members === undefined ? Object.keys(workspaces).length !== 1 : Object.keys(workspaces).some((path) => path !== "" && !members.has(path))) || lock.patchedDependencies !== undefined) {
     throw new TypeError("unsupported Bun lock source");
   }
-  requireRegistryDependencyMaps(rootWorkspace);
+  for (const workspace of Object.values(workspaces)) {
+    const record = ordinaryRecord(workspace);
+    if (record === undefined)
+      throw new TypeError("unsupported Bun workspace lock");
+    requireRegistryDependencyMaps(record, members !== undefined);
+  }
   for (const resolution of Object.values(packages)) {
+    if (members !== undefined && Array.isArray(resolution) && resolution.length === 1 && typeof resolution[0] === "string") {
+      const separator = resolution[0].indexOf("@workspace:");
+      const name = resolution[0].slice(0, separator);
+      const path = resolution[0].slice(separator + "@workspace:".length);
+      if (separator > 0 && isPackageName(name) && members.has(path) && ordinaryRecord(workspaces[path])?.name === name)
+        continue;
+      throw new TypeError("unsupported Bun workspace resolution");
+    }
     const metadata = Array.isArray(resolution) ? ordinaryRecord(resolution[2]) : undefined;
     if (!Array.isArray(resolution) || resolution.length !== 4 || !isExactRegistryResolution(resolution[0]) || typeof resolution[1] !== "string" || resolution[1] !== "" && resolution[1] !== "https://registry.npmjs.org" && resolution[1] !== "https://registry.npmjs.org/" || metadata === undefined || !isExactIntegrity(resolution[3])) {
       throw new TypeError("unsupported Bun lock source");
@@ -34,7 +904,7 @@ var DEPENDENCY_MAPS = Object.freeze([
   "optionalDependencies",
   "peerDependencies"
 ]);
-function requireRegistryDependencyMaps(container) {
+function requireRegistryDependencyMaps(container, workspace = false) {
   for (const field of DEPENDENCY_MAPS) {
     if (container[field] === undefined)
       continue;
@@ -42,7 +912,7 @@ function requireRegistryDependencyMaps(container) {
     if (dependencies === undefined)
       throw new TypeError("unsupported Bun lock source");
     for (const [name, request] of Object.entries(dependencies)) {
-      if (!isPackageName(name) || !isRegistryRequest(request)) {
+      if (!isPackageName(name) || !(isRegistryRequest(request) || workspace && typeof request === "string" && request.startsWith("workspace:") && isRegistrySelector(request.slice("workspace:".length)))) {
         throw new TypeError("unsupported Bun lock source");
       }
     }
@@ -90,62 +960,10 @@ function ordinaryRecord(value) {
   return value;
 }
 
-// src/package/paths.ts
-var encoder = new TextEncoder;
-var PACKAGE_1_MAX_PATH_BYTES = 1024;
-
-// src/internal/bun-native-preparation-protocol.ts
-var MIB = 1024 * 1024;
-var MAX_JSON_BYTES_PER_PATH_BYTE = 6;
-var PRIVATE_BUN_PREPARATION_LIMITS = Object.freeze({
-  sourceFiles: 4096,
-  sourceBytes: 16 * MIB,
-  preparedFiles: 4096,
-  preparedBytes: 32 * MIB
-});
-function maximumPrivateBunFileMessageBytes(type, maximumFiles, maximumContentBytes) {
-  requireNonnegativeInteger(maximumFiles, "file count");
-  requireNonnegativeInteger(maximumContentBytes, "content bytes");
-  const emptyMessageBytes = Buffer.byteLength(JSON.stringify({ type, files: [] }));
-  const emptyFileBytes = Buffer.byteLength(JSON.stringify({ path: "", content: "" }));
-  const pathBytes = maximumFiles * PACKAGE_1_MAX_PATH_BYTES * MAX_JSON_BYTES_PER_PATH_BYTE;
-  const contentBytes = 4 * (Math.ceil(maximumContentBytes / 3) + maximumFiles);
-  const separators = Math.max(0, maximumFiles - 1);
-  const result = emptyMessageBytes + maximumFiles * emptyFileBytes + pathBytes + contentBytes + separators;
-  if (!Number.isSafeInteger(result))
-    throw new RangeError("Bun preparation message bound is too large");
-  return result;
-}
-var PRIVATE_BUN_SOURCE_MESSAGE_BYTES = maximumPrivateBunFileMessageBytes("source", PRIVATE_BUN_PREPARATION_LIMITS.sourceFiles, PRIVATE_BUN_PREPARATION_LIMITS.sourceBytes);
-var PRIVATE_BUN_PREPARED_MESSAGE_BYTES = maximumPrivateBunFileMessageBytes("prepared", PRIVATE_BUN_PREPARATION_LIMITS.preparedFiles, PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes);
-function privateBunMessageFits(bytes, maximum) {
-  return Number.isSafeInteger(bytes) && bytes >= 0 && bytes <= maximum;
-}
-function encodePrivateBunMessage(value) {
-  const json = JSON.stringify(value);
-  if (json === undefined)
-    throw new TypeError("Bun preparation message is not JSON-serializable");
-  return new TextEncoder().encode(`${json}
-`);
-}
-function requireNonnegativeInteger(value, label) {
-  if (!Number.isSafeInteger(value) || value < 0) {
-    throw new TypeError(`${label} must be a nonnegative safe integer`);
-  }
-}
-
 // src/internal/bun-native-preparation-worker.ts
 var PACKAGE_ROOT = "/work/package";
 var CACHE_ROOT = "/work/cache";
-var PATH = /^(?!\/)(?!.*(?:^|\/)\.\.?(?:\/|$))(?!.*\/\/)[^\0]+$/;
-
-class WorkerFailure extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-  }
-}
+var workspace;
 var outputQueue = Promise.resolve();
 var allowResolutionNetwork = process.argv.length === 3 && process.argv[2] === "--allow-resolution-network";
 try {
@@ -154,19 +972,25 @@ try {
   if (first.done)
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source is missing");
   const source = requireSource(first.value);
+  workspace = source.workspace;
   if (!(await iterator.next()).done) {
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source has trailing data");
   }
-  const inputs = source.files.filter(({ path }) => path === "package.json" || path === "bun.lock");
+  const inputPaths = new Set([
+    "package.json",
+    "bun.lock",
+    ...workspace?.members.map((path) => `${path}/package.json`) ?? []
+  ]);
+  const inputs = source.files.filter(({ path }) => inputPaths.has(path));
   await materializeSource(inputs);
   const resolving = !inputs.some(({ path }) => path === "bun.lock");
   if (resolving)
     await resolveMissingLock();
   await requireSupportedLock(resolving);
   await install();
-  await materializeSource(source.files.filter(({ path }) => path !== "package.json" && path !== "bun.lock"));
+  await materializeSource(source.files.filter(({ path }) => !inputPaths.has(path)));
   await verifySource(source.files);
-  const prepared = await capturePrepared();
+  const prepared = await capturePrivateBunPreparedTree(PACKAGE_ROOT, workspace);
   await sendPrepared(prepared);
   await outputQueue;
 } catch (error) {
@@ -183,7 +1007,7 @@ async function materializeSource(files) {
   await mkdir(PACKAGE_ROOT, { recursive: true, mode: 448 });
   for (const file of files) {
     const bytes = decodeBase64(file.content, file.path);
-    const destination = join(PACKAGE_ROOT, ...file.path.split("/"));
+    const destination = join2(PACKAGE_ROOT, ...file.path.split("/"));
     await mkdir(dirname(destination), { recursive: true, mode: 448 });
     await writeFile(destination, bytes, { mode: 384, flag: "wx" });
   }
@@ -191,7 +1015,7 @@ async function materializeSource(files) {
 async function verifySource(files) {
   for (const file of files) {
     const expected = decodeBase64(file.content, file.path);
-    const actual = new Uint8Array(await readFile(join(PACKAGE_ROOT, ...file.path.split("/"))));
+    const actual = new Uint8Array(await readFile2(join2(PACKAGE_ROOT, ...file.path.split("/"))));
     if (!Buffer.from(actual).equals(Buffer.from(expected))) {
       throw new WorkerFailure("PACKAGE_BUN_SOURCE_CHANGED", "Bun preparation changed authored package bytes");
     }
@@ -199,7 +1023,7 @@ async function verifySource(files) {
 }
 async function requireSupportedLock(resolved) {
   const lockCopy = "/work/bun-lock.jsonc";
-  await copyFile(join(PACKAGE_ROOT, "bun.lock"), lockCopy);
+  await copyFile(join2(PACKAGE_ROOT, "bun.lock"), lockCopy);
   let value;
   try {
     const result = await runChild([
@@ -220,19 +1044,41 @@ async function requireSupportedLock(resolved) {
     throw new WorkerFailure("PACKAGE_BUN_LOCK_INVALID", "bun.lock is not valid for the pinned Bun runtime");
   }
   try {
-    requirePrivateBunLockPolicy(value);
+    requirePrivateBunLockPolicy(value, workspace === undefined ? undefined : new Set(workspace.members));
   } catch {
     if (resolved) {
       throw new WorkerFailure("PACKAGE_BUN_RESOLVED_SOURCE_UNSUPPORTED", "resolved dependencies are unsupported; resolution requests may already have occurred");
     }
     unsupportedSource();
   }
+  if (workspace !== undefined) {
+    const locked = value.workspaces;
+    for (const path of ["", ...workspace.members]) {
+      const manifest = JSON.parse(await readFile2(join2(PACKAGE_ROOT, path, "package.json"), "utf8"));
+      const entry = locked[path];
+      const dependencyFields = [
+        "dependencies",
+        "devDependencies",
+        "optionalDependencies",
+        "peerDependencies"
+      ];
+      if (entry === undefined || ["name", "version"].some((field) => manifest[field] !== entry[field]) || dependencyFields.some((field) => canonical(manifest[field] ?? {}) !== canonical(entry[field] ?? {})))
+        throw new WorkerFailure("PACKAGE_BUN_LOCK_STALE", "workspace manifests and bun.lock disagree; update the workspace lock explicitly");
+    }
+  }
+}
+function canonical(value) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value))
+    return JSON.stringify(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
+  return JSON.stringify(value) ?? "";
 }
 async function resolveMissingLock() {
   if (!allowResolutionNetwork)
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "resolution permission is missing");
   try {
-    requirePrivateBunResolutionManifest(JSON.parse(await readFile(join(PACKAGE_ROOT, "package.json"), "utf8")));
+    requirePrivateBunResolutionManifest(JSON.parse(await readFile2(join2(PACKAGE_ROOT, "package.json"), "utf8")), workspace === undefined ? undefined : "root");
+    for (const member of workspace?.members ?? [])
+      requirePrivateBunResolutionManifest(JSON.parse(await readFile2(join2(PACKAGE_ROOT, member, "package.json"), "utf8")), "member");
   } catch {
     throw new WorkerFailure("PACKAGE_BUN_SOURCE_UNSUPPORTED", "package.json contains unsupported resolution inputs");
   }
@@ -248,10 +1094,15 @@ async function resolveMissingLock() {
     `--cache-dir=${CACHE_ROOT}`,
     "--registry=https://registry.npmjs.org",
     "--no-progress",
-    "--no-summary"
+    "--no-summary",
+    ...workspaceFilter()
   ], { cwd: PACKAGE_ROOT, env: { LD_LIBRARY_PATH: "/jig-runtime/lib" } }, 64 * 1024, 64 * 1024);
-  if (result.exit !== 0)
+  if (result.exit !== 0) {
+    if (/No version matching|No matching version|No matching tag/i.test(result.stderr)) {
+      throw new WorkerFailure("PACKAGE_BUN_RESOLUTION_VERSION_UNAVAILABLE", "a dependency version or tag is unavailable; resolution requests may already have occurred");
+    }
     throw new WorkerFailure("PACKAGE_BUN_RESOLUTION_FAILED", "dependency resolution failed; network requests may already have occurred");
+  }
 }
 function unsupportedSource() {
   throw new WorkerFailure("PACKAGE_BUN_SOURCE_UNSUPPORTED", "bun.lock contains a dependency source unsupported by this Jig alpha; only the default npm registry is supported");
@@ -269,7 +1120,8 @@ async function install() {
     `--cache-dir=${CACHE_ROOT}`,
     "--registry=https://registry.npmjs.org",
     "--no-progress",
-    "--no-summary"
+    "--no-summary",
+    ...workspaceFilter()
   ], {
     cwd: PACKAGE_ROOT,
     env: {
@@ -284,43 +1136,7 @@ ${result.stderr}`;
     }
     throw new WorkerFailure("PACKAGE_BUN_PREPARATION_FAILED", "the locked production dependencies could not be prepared by the pinned Bun runtime");
   }
-  await rm(join(PACKAGE_ROOT, "node_modules", ".bin"), { recursive: true, force: true });
-}
-async function capturePrepared() {
-  const files = [];
-  let total = 0;
-  const visit = async (root, prefix) => {
-    const directory = await opendir(root);
-    const names = [];
-    for await (const entry of directory)
-      names.push(entry.name);
-    names.sort((left, right) => Buffer.from(left).compare(Buffer.from(right)));
-    for (const name of names) {
-      const path = prefix === "" ? name : `${prefix}/${name}`;
-      requirePath(path);
-      const physical = join(root, name);
-      const information = await lstat(physical);
-      if (information.isDirectory() && !information.isSymbolicLink()) {
-        await visit(physical, path);
-        continue;
-      }
-      if (!information.isFile() || information.isSymbolicLink() || information.nlink !== 1) {
-        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_UNSUPPORTED", "prepared dependencies contain a link or special file");
-      }
-      if (files.length >= PRIVATE_BUN_PREPARATION_LIMITS.preparedFiles) {
-        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree has too many files");
-      }
-      const bytes = new Uint8Array(await readFile(physical));
-      total += bytes.byteLength;
-      if (total > PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes) {
-        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree is too large");
-      }
-      files.push(Object.freeze({ path, content: Buffer.from(bytes).toString("base64") }));
-    }
-  };
-  await visit(PACKAGE_ROOT, "");
-  files.sort((left, right) => Buffer.from(left.path).compare(Buffer.from(right.path)));
-  return Object.freeze(files);
+  await rm(join2(PACKAGE_ROOT, "node_modules", ".bin"), { recursive: true, force: true });
 }
 function requireSource(value) {
   const root = ordinaryRecord2(value);
@@ -350,18 +1166,40 @@ function requireSource(value) {
   if (!files.some(({ path }) => path === "package.json") || !files.some(({ path }) => path === "bun.lock") && !allowResolutionNetwork) {
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "locked Bun source is incomplete");
   }
-  return Object.freeze({ files: Object.freeze(files) });
-}
-function requirePath(path) {
-  if (!PATH.test(path) || Buffer.byteLength(path) > 1024) {
-    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source path is invalid");
+  let selectedWorkspace;
+  if (root.workspace !== undefined) {
+    const record = ordinaryRecord2(root.workspace);
+    if (record === undefined || typeof record.target !== "string" || !Array.isArray(record.members) || !Array.isArray(record.selected) || record.members.length === 0 || record.members.length > 256 || record.selected.length > record.members.length || !record.members.includes(record.target) || !record.selected.includes(record.target))
+      throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "workspace preparation metadata is invalid");
+    for (const member of record.members) {
+      if (typeof member !== "string")
+        throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "workspace path is invalid");
+      requirePath(member);
+      if (member.split("/").includes("node_modules") || !files.some(({ path }) => path === `${member}/package.json`))
+        throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "workspace manifest is missing");
+    }
+    if (new Set(record.members).size !== record.members.length || new Set(record.selected).size !== record.selected.length || record.selected.some((path) => !record.members.includes(path)))
+      throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "workspace membership is invalid");
+    selectedWorkspace = {
+      target: record.target,
+      members: record.members,
+      selected: record.selected
+    };
   }
+  return Object.freeze({
+    files: Object.freeze(files),
+    ...selectedWorkspace === undefined ? {} : { workspace: selectedWorkspace }
+  });
+}
+function workspaceFilter() {
+  return workspace === undefined ? [] : ["--filter", `./${workspace.target}`];
 }
 function decodeBase64(value, label) {
-  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+  const bytes = Buffer.from(value, "base64");
+  if (bytes.toString("base64") !== value) {
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", `${label} has invalid encoded bytes`);
   }
-  return new Uint8Array(Buffer.from(value, "base64"));
+  return new Uint8Array(bytes);
 }
 function ordinaryRecord2(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype)
@@ -378,8 +1216,8 @@ function enqueue(bytes) {
   });
   return outputQueue;
 }
-function sendPrepared(files) {
-  const bytes = encodePrivateBunMessage({ type: "prepared", files });
+function sendPrepared(prepared) {
+  const bytes = encodePrivateBunMessage({ type: "prepared", ...prepared });
   if (!privateBunMessageFits(bytes.byteLength - 1, PRIVATE_BUN_PREPARED_MESSAGE_BYTES)) {
     throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree is too large");
   }