@jigging/jig 0.1.0-alpha.2 → 0.1.0-alpha.21

package/libexec/preparation/bun-native-preparation-worker.js

@@ -1,32 +1,166 @@
 // @bun
 // src/internal/bun-native-preparation-worker.ts
 import { spawn } from "child_process";
-import {
-  copyFile,
-  lstat,
-  mkdir,
-  opendir,
-  readFile,
-  rm,
-  writeFile
-} from "fs/promises";
-import { dirname, join } from "path";
+import { copyFile, mkdir, readFile as readFile2, rm, writeFile } from "fs/promises";
+import { dirname, join as join2 } from "path";
+
+// src/diagnostics.ts
+class CheckError extends Error {
+  kind;
+  code;
+  path;
+  pointer;
+  typeMismatch;
+  constructor(kind, code, message, path, pointer, typeMismatch) {
+    super(message);
+    this.name = "CheckError";
+    this.kind = kind;
+    this.code = code;
+    if (path !== undefined)
+      this.path = path;
+    if (pointer !== undefined)
+      this.pointer = pointer;
+    if (typeMismatch !== undefined)
+      this.typeMismatch = typeMismatch;
+  }
+}
+function invalid(code, message, path, pointer) {
+  throw new CheckError("invalid", code, message, path, pointer);
+}
+function unavailable(code, message, path, pointer) {
+  throw new CheckError("unavailable", code, message, path, pointer);
+}
 
 // src/internal/bun-native-lock-policy.ts
-function requirePrivateBunLockPolicy(value) {
+var MANIFEST_REASONS = {
+  SHAPE: "the manifest must be an object",
+  FIELD: "this manifest field is unsupported for dependency preparation",
+  DEPENDENCIES: "dependency declarations must be objects",
+  NAME: "package names must be valid npm names",
+  SOURCE: "the dependency request must select the default npm registry or a declared workspace member",
+  PATCH: "patch declarations require exact registry versions and bounded relative .patch paths"
+};
+
+class PrivateBunManifestError extends CheckError {
+  reason;
+  projectRelative;
+  constructor(reason, pointer, path = "package.json", projectRelative = false) {
+    super("invalid", `PACKAGE_BUN_MANIFEST_${reason}`, MANIFEST_REASONS[reason], path, pointer);
+    this.reason = reason;
+    this.projectRelative = projectRelative;
+  }
+  atProjectPath(path) {
+    return new PrivateBunManifestError(this.reason, this.pointer, path, true);
+  }
+}
+function requirePrivateBunResolutionManifest(value, workspace) {
+  const manifest = ordinaryRecord(value);
+  if (manifest === undefined)
+    throw new PrivateBunManifestError("SHAPE", "");
+  for (const field of [
+    ...workspace === "root" ? [] : ["workspaces"],
+    ...workspace === "root" ? [] : ["patchedDependencies"],
+    "overrides",
+    "resolutions",
+    "catalog",
+    "catalogs"
+  ]) {
+    if (manifest[field] !== undefined)
+      throw new PrivateBunManifestError("FIELD", `/${field}`);
+  }
+  if (workspace === "member" && (typeof manifest.name !== "string" || !isPackageName(manifest.name)))
+    throw new PrivateBunManifestError("NAME", "/name");
+  requireRegistryDependencyMaps(manifest, workspace !== undefined, true);
+  if (workspace === "root") {
+    try {
+      requirePrivateBunPatches(manifest.patchedDependencies);
+    } catch {
+      throw new PrivateBunManifestError("PATCH", "/patchedDependencies");
+    }
+  }
+}
+function requirePrivateBunPatches(value) {
+  if (value === undefined)
+    return Object.freeze({});
+  const patches = ordinaryRecord(value);
+  if (patches === undefined || Object.keys(patches).length > 256)
+    throw new TypeError("unsupported Bun patch declarations");
+  for (const [target, path] of Object.entries(patches)) {
+    if (!isExactRegistryResolution(target) || typeof path !== "string" || Buffer.byteLength(path) > 1024 || !path.endsWith(".patch") || /[\\\x00-\x1f\x7f]/.test(path) || path.split("/").some((part) => ["", ".", "..", ".git", ".jig", "node_modules"].includes(part)))
+      throw new TypeError("unsupported Bun patch declarations");
+  }
+  return Object.freeze({ ...patches });
+}
+function requirePrivateBunLockPolicy(value, members) {
   const lock = ordinaryRecord(value);
   const workspaces = ordinaryRecord(lock?.workspaces);
   const rootWorkspace = ordinaryRecord(workspaces?.[""]);
   const packages = ordinaryRecord(lock?.packages);
-  if (lock?.lockfileVersion !== 1 || workspaces === undefined || rootWorkspace === undefined || packages === undefined || Object.keys(workspaces).length !== 1 || lock.patchedDependencies !== undefined) {
+  if (lock?.lockfileVersion !== 1 || workspaces === undefined || rootWorkspace === undefined || packages === undefined || (members === undefined ? Object.keys(workspaces).length !== 1 : Object.keys(workspaces).some((path) => path !== "" && !members.has(path))) || members === undefined && lock.patchedDependencies !== undefined) {
     throw new TypeError("unsupported Bun lock source");
   }
+  requirePrivateBunPatches(lock.patchedDependencies);
+  for (const workspace of Object.values(workspaces)) {
+    const record = ordinaryRecord(workspace);
+    if (record === undefined)
+      throw new TypeError("unsupported Bun workspace lock");
+    requireRegistryDependencyMaps(record, members !== undefined);
+  }
   for (const resolution of Object.values(packages)) {
-    if (!Array.isArray(resolution) || resolution.length !== 4 || !isExactRegistryResolution(resolution[0]) || typeof resolution[1] !== "string" || resolution[1] !== "" && resolution[1] !== "https://registry.npmjs.org" && resolution[1] !== "https://registry.npmjs.org/" || ordinaryRecord(resolution[2]) === undefined || !isExactIntegrity(resolution[3])) {
+    if (members !== undefined && Array.isArray(resolution) && resolution.length === 1 && typeof resolution[0] === "string") {
+      const separator = resolution[0].indexOf("@workspace:");
+      const name = resolution[0].slice(0, separator);
+      const path = resolution[0].slice(separator + "@workspace:".length);
+      if (separator > 0 && isPackageName(name) && members.has(path) && ordinaryRecord(workspaces[path])?.name === name)
+        continue;
+      throw new TypeError("unsupported Bun workspace resolution");
+    }
+    const metadata = Array.isArray(resolution) ? ordinaryRecord(resolution[2]) : undefined;
+    if (!Array.isArray(resolution) || resolution.length !== 4 || !isExactRegistryResolution(resolution[0]) || typeof resolution[1] !== "string" || resolution[1] !== "" && resolution[1] !== "https://registry.npmjs.org" && resolution[1] !== "https://registry.npmjs.org/" || metadata === undefined || !isExactIntegrity(resolution[3])) {
       throw new TypeError("unsupported Bun lock source");
     }
+    requireRegistryDependencyMaps(metadata);
   }
 }
+var DEPENDENCY_MAPS = Object.freeze([
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+  "peerDependencies"
+]);
+function requireRegistryDependencyMaps(container, workspace = false, manifest = false) {
+  function reject(reason, pointer) {
+    if (manifest)
+      throw new PrivateBunManifestError(reason, pointer);
+    throw new TypeError("unsupported Bun lock source");
+  }
+  for (const field of DEPENDENCY_MAPS) {
+    if (container[field] === undefined)
+      continue;
+    const dependencies = ordinaryRecord(container[field]);
+    if (dependencies === undefined)
+      reject("DEPENDENCIES", `/${field}`);
+    for (const [name, request] of Object.entries(dependencies)) {
+      if (!isPackageName(name))
+        reject("NAME", `/${field}`);
+      if (!(isRegistryRequest(request) || workspace && typeof request === "string" && request.startsWith("workspace:") && isRegistrySelector(request.slice("workspace:".length)))) {
+        reject("SOURCE", `/${field}/${name.replaceAll("~", "~0").replaceAll("/", "~1")}`);
+      }
+    }
+  }
+}
+function isRegistryRequest(value) {
+  if (typeof value !== "string" || Buffer.byteLength(value) > 512)
+    return false;
+  if (!value.startsWith("npm:"))
+    return isRegistrySelector(value);
+  const target = value.slice(4);
+  const separator = target.lastIndexOf("@");
+  return separator > 0 && isPackageName(target.slice(0, separator)) && isRegistrySelector(target.slice(separator + 1));
+}
+function isRegistrySelector(value) {
+  return value.length > 0 && /^[0-9A-Za-z._+*<>=~^| -]+$/.test(value);
+}
 function isExactRegistryResolution(value) {
   if (typeof value !== "string")
     return false;
@@ -35,8 +169,11 @@ function isExactRegistryResolution(value) {
     return false;
   const name = value.slice(0, separator);
   const version = value.slice(separator + 1);
-  const packageName = name.startsWith("@") ? /^@[a-z0-9][a-z0-9._~-]*\/[a-z0-9][a-z0-9._~-]*$/.test(name) : /^[a-z0-9][a-z0-9._~-]*$/.test(name);
-  return packageName && Buffer.byteLength(name) <= 214 && /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(version);
+  return isPackageName(name) && /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(version);
+}
+function isPackageName(value) {
+  const valid = value.startsWith("@") ? /^@[a-z0-9][a-z0-9._~-]*\/[a-z0-9][a-z0-9._~-]*$/.test(value) : /^[a-z0-9][a-z0-9._~-]*$/.test(value);
+  return valid && Buffer.byteLength(value) <= 214;
 }
 function isExactIntegrity(value) {
   if (typeof value !== "string")
@@ -56,7 +193,678 @@ function ordinaryRecord(value) {
 
 // src/package/paths.ts
 var encoder = new TextEncoder;
+var REQUIRED_UNICODE_VERSION = "15.1";
 var PACKAGE_1_MAX_PATH_BYTES = 1024;
+function isNfc15_1(value) {
+  const actual = process.versions.unicode;
+  if (actual !== REQUIRED_UNICODE_VERSION) {
+    unavailable("PACKAGE_UNICODE_UNAVAILABLE", `Package/0 requires Unicode ${REQUIRED_UNICODE_VERSION} NFC; host reports ${actual ?? "no Unicode version"}`);
+  }
+  return value === value.normalize("NFC");
+}
+function validateLogicalPath(path) {
+  if (path.length === 0 || path.startsWith("/") || path.includes("\\") || path.includes("\x00")) {
+    invalid("PACKAGE_PATH", `invalid logical path ${JSON.stringify(path)}`, path);
+  }
+  assertUnicodeScalarString(path);
+  if (!isNfc15_1(path)) {
+    invalid("PACKAGE_PATH_NFC", `logical path is not NFC: ${JSON.stringify(path)}`, path);
+  }
+  const segments = path.split("/");
+  if (segments.length > 64)
+    invalid("PACKAGE_PATH_LIMIT", `logical path exceeds 64 segments`, path);
+  if (encoder.encode(path).byteLength > PACKAGE_1_MAX_PATH_BYTES) {
+    invalid("PACKAGE_PATH_LIMIT", `logical path exceeds ${PACKAGE_1_MAX_PATH_BYTES} UTF-8 bytes`, path);
+  }
+  for (const segment of segments) {
+    if (segment.length === 0 || segment === "." || segment === "..") {
+      invalid("PACKAGE_PATH", `logical path has an invalid segment`, path);
+    }
+    if (encoder.encode(segment).byteLength > 255) {
+      invalid("PACKAGE_PATH_LIMIT", `logical path segment exceeds 255 UTF-8 bytes`, path);
+    }
+  }
+  return path;
+}
+function assertUnicodeScalarString(value) {
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343)) {
+        invalid("PACKAGE_PATH", "logical path contains a lone Unicode surrogate", value);
+      }
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      invalid("PACKAGE_PATH", "logical path contains a lone Unicode surrogate", value);
+    }
+  }
+}
+function comparePathBytes(left, right) {
+  return Buffer.compare(Buffer.from(left, "utf8"), Buffer.from(right, "utf8"));
+}
+
+// src/internal/bun-execution-layout.ts
+import { types as utilTypes3 } from "util";
+
+// src/internal/package-aliases.ts
+import { posix } from "path";
+import { types as utilTypes2 } from "util";
+
+// src/internal/private-ordinary-json.ts
+import { types as utilTypes } from "util";
+
+// src/json.ts
+var JSON_1_LIMITS = Object.freeze({
+  bytes: 16777216,
+  depth: 128,
+  nodes: 262144,
+  containerEntries: 65536,
+  stringBytes: 8388608,
+  memberNameBytes: 1024,
+  numberTokenBytes: 128
+});
+var encoder2 = new TextEncoder;
+var decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+
+class Json1Error extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "Json1Error";
+  }
+}
+
+class Parser {
+  source;
+  position = 0;
+  nodes = 0;
+  constructor(source) {
+    this.source = source;
+  }
+  parse() {
+    this.skipWhitespace();
+    const value = this.parseValue(1);
+    this.skipWhitespace();
+    if (this.position !== this.source.length)
+      this.fail("unexpected trailing characters");
+    return value;
+  }
+  parseValue(depth) {
+    if (depth > JSON_1_LIMITS.depth)
+      this.fail("maximum value depth exceeded");
+    this.nodes += 1;
+    if (this.nodes > JSON_1_LIMITS.nodes)
+      this.fail("maximum value nodes exceeded");
+    const char = this.source[this.position];
+    if (char === '"')
+      return this.parseString(false);
+    if (char === "{")
+      return this.parseObject(depth);
+    if (char === "[")
+      return this.parseArray(depth);
+    if (char === "t")
+      return this.parseLiteral("true", true);
+    if (char === "f")
+      return this.parseLiteral("false", false);
+    if (char === "n")
+      return this.parseLiteral("null", null);
+    if (char === "-" || char !== undefined && char >= "0" && char <= "9") {
+      return this.parseNumber();
+    }
+    return this.fail("expected a JSON value");
+  }
+  parseObject(depth) {
+    this.position += 1;
+    const result = Object.create(null);
+    const keys = new Set;
+    this.skipWhitespace();
+    if (this.consume("}"))
+      return result;
+    let members = 0;
+    while (true) {
+      if (this.source[this.position] !== '"')
+        this.fail("expected an object member name");
+      const key = this.parseString(true);
+      if (keys.has(key))
+        this.fail(`duplicate object member ${key}`);
+      keys.add(key);
+      members += 1;
+      if (members > JSON_1_LIMITS.containerEntries) {
+        this.fail("maximum object members exceeded");
+      }
+      this.skipWhitespace();
+      if (!this.consume(":"))
+        this.fail("expected ':' after member name");
+      this.skipWhitespace();
+      result[key] = this.parseValue(depth + 1);
+      this.skipWhitespace();
+      if (this.consume("}"))
+        return result;
+      if (!this.consume(","))
+        this.fail("expected ',' or '}'");
+      this.skipWhitespace();
+    }
+  }
+  parseArray(depth) {
+    this.position += 1;
+    const result = [];
+    this.skipWhitespace();
+    if (this.consume("]"))
+      return result;
+    while (true) {
+      if (result.length >= JSON_1_LIMITS.containerEntries) {
+        this.fail("maximum array items exceeded");
+      }
+      result.push(this.parseValue(depth + 1));
+      this.skipWhitespace();
+      if (this.consume("]"))
+        return result;
+      if (!this.consume(","))
+        this.fail("expected ',' or ']'");
+      this.skipWhitespace();
+    }
+  }
+  parseString(memberName) {
+    this.position += 1;
+    const parts = [];
+    let segmentStart = this.position;
+    while (this.position < this.source.length) {
+      const char = this.source[this.position];
+      this.position += 1;
+      if (char === '"') {
+        parts.push(this.source.slice(segmentStart, this.position - 1));
+        const value = parts.join("");
+        const limit = memberName ? JSON_1_LIMITS.memberNameBytes : JSON_1_LIMITS.stringBytes;
+        if (encoder2.encode(value).byteLength > limit)
+          this.fail("maximum string bytes exceeded");
+        return value;
+      }
+      if (char === "\\") {
+        parts.push(this.source.slice(segmentStart, this.position - 1));
+        parts.push(this.parseEscape());
+        segmentStart = this.position;
+        continue;
+      }
+      if (char === undefined || char.charCodeAt(0) <= 31) {
+        this.fail("invalid character in string");
+      }
+      const code = char.charCodeAt(0);
+      if (code >= 55296 && code <= 57343) {
+        const next = this.source[this.position];
+        if (code > 56319 || next === undefined || next.charCodeAt(0) < 56320 || next.charCodeAt(0) > 57343)
+          this.fail("lone Unicode surrogate");
+        this.position += 1;
+      }
+    }
+    return this.fail("unterminated string");
+  }
+  parseEscape() {
+    const escape = this.source[this.position];
+    this.position += 1;
+    switch (escape) {
+      case '"':
+      case "\\":
+      case "/":
+        return escape;
+      case "b":
+        return "\b";
+      case "f":
+        return "\f";
+      case "n":
+        return `
+`;
+      case "r":
+        return "\r";
+      case "t":
+        return "\t";
+      case "u": {
+        const first = this.parseHexCodeUnit();
+        if (first >= 55296 && first <= 56319) {
+          if (this.source.slice(this.position, this.position + 2) !== "\\u") {
+            this.fail("high surrogate without low surrogate");
+          }
+          this.position += 2;
+          const second = this.parseHexCodeUnit();
+          if (second < 56320 || second > 57343) {
+            this.fail("high surrogate without low surrogate");
+          }
+          return String.fromCharCode(first, second);
+        }
+        if (first >= 56320 && first <= 57343)
+          this.fail("lone low surrogate");
+        return String.fromCharCode(first);
+      }
+      default:
+        return this.fail("invalid string escape");
+    }
+  }
+  parseHexCodeUnit() {
+    const token = this.source.slice(this.position, this.position + 4);
+    if (!/^[0-9A-Fa-f]{4}$/.test(token))
+      this.fail("invalid Unicode escape");
+    this.position += 4;
+    return Number.parseInt(token, 16);
+  }
+  parseNumber() {
+    const start = this.position;
+    this.consume("-");
+    if (this.consume("0")) {
+      const next = this.source[this.position];
+      if (next !== undefined && next >= "0" && next <= "9") {
+        this.fail("leading zero in number");
+      }
+    } else {
+      if (!this.consumeDigit("1", "9"))
+        this.fail("invalid number");
+      while (this.consumeDigit("0", "9")) {}
+    }
+    if (this.consume(".")) {
+      if (!this.consumeDigit("0", "9"))
+        this.fail("fraction requires a digit");
+      while (this.consumeDigit("0", "9")) {}
+    }
+    const exponent = this.source[this.position];
+    if (exponent === "e" || exponent === "E") {
+      this.position += 1;
+      const sign = this.source[this.position];
+      if (sign === "+" || sign === "-")
+        this.position += 1;
+      if (!this.consumeDigit("0", "9"))
+        this.fail("exponent requires a digit");
+      while (this.consumeDigit("0", "9")) {}
+    }
+    const token = this.source.slice(start, this.position);
+    if (token.length > JSON_1_LIMITS.numberTokenBytes) {
+      this.fail("maximum number token bytes exceeded");
+    }
+    const value = Number(token);
+    if (!Number.isFinite(value))
+      this.fail("non-finite number");
+    if (Number.isInteger(value) && !Number.isSafeInteger(value)) {
+      this.fail("integral number outside safe range");
+    }
+    return value;
+  }
+  parseLiteral(token, value) {
+    if (this.source.slice(this.position, this.position + token.length) !== token) {
+      this.fail(`invalid literal ${token}`);
+    }
+    this.position += token.length;
+    return value;
+  }
+  consume(expected) {
+    if (this.source[this.position] !== expected)
+      return false;
+    this.position += 1;
+    return true;
+  }
+  consumeDigit(minimum, maximum) {
+    const char = this.source[this.position];
+    if (char === undefined || char < minimum || char > maximum)
+      return false;
+    this.position += 1;
+    return true;
+  }
+  skipWhitespace() {
+    while (true) {
+      const char = this.source[this.position];
+      if (char !== " " && char !== `
+` && char !== "\r" && char !== "\t")
+        return;
+      this.position += 1;
+    }
+  }
+  fail(message) {
+    throw new Json1Error(`${message} at character ${this.position}`);
+  }
+}
+function decodeJson1(bytes) {
+  if (bytes.byteLength === 0)
+    throw new Json1Error("empty JSON/0 document");
+  if (bytes.byteLength > JSON_1_LIMITS.bytes)
+    throw new Json1Error("maximum bytes exceeded");
+  if (bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191) {
+    throw new Json1Error("UTF-8 BOM is not allowed");
+  }
+  let text;
+  try {
+    text = decoder.decode(bytes);
+  } catch {
+    throw new Json1Error("invalid UTF-8");
+  }
+  return new Parser(text).parse();
+}
+function validateJson1(value) {
+  visitJson(value, 1, { nodes: 0, encodedBytes: 0, active: new WeakSet }, false);
+}
+function visitJson(value, depth, state, memberName) {
+  if (depth > JSON_1_LIMITS.depth)
+    throw new Json1Error("maximum value depth exceeded");
+  state.nodes += 1;
+  if (state.nodes > JSON_1_LIMITS.nodes)
+    throw new Json1Error("maximum value nodes exceeded");
+  if (value === null) {
+    chargeEncodedBytes(state, 4);
+    return;
+  }
+  if (typeof value === "boolean") {
+    chargeEncodedBytes(state, value ? 4 : 5);
+    return;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value))
+      throw new Json1Error("non-finite number");
+    if (Number.isInteger(value) && !Number.isSafeInteger(value)) {
+      throw new Json1Error("integral number outside safe range");
+    }
+    chargeEncodedBytes(state, (Object.is(value, -0) ? "0" : JSON.stringify(value)).length);
+    return;
+  }
+  if (typeof value === "string") {
+    validateString(value, memberName ? JSON_1_LIMITS.memberNameBytes : JSON_1_LIMITS.stringBytes);
+    chargeEncodedBytes(state, encodedJsonStringBytes(value));
+    return;
+  }
+  if (typeof value !== "object")
+    throw new Json1Error("value is not JSON/0");
+  if (state.active.has(value))
+    throw new Json1Error("cyclic value");
+  state.active.add(value);
+  try {
+    if (Array.isArray(value)) {
+      if (value.length > JSON_1_LIMITS.containerEntries) {
+        throw new Json1Error("maximum array items exceeded");
+      }
+      chargeEncodedBytes(state, 2 + Math.max(0, value.length - 1));
+      for (const child of value)
+        visitJson(child, depth + 1, state, false);
+      return;
+    }
+    const object = value;
+    const keys = Object.keys(object);
+    if (keys.length > JSON_1_LIMITS.containerEntries) {
+      throw new Json1Error("maximum object members exceeded");
+    }
+    chargeEncodedBytes(state, 2 + keys.length + Math.max(0, keys.length - 1));
+    for (const key of keys) {
+      validateString(key, JSON_1_LIMITS.memberNameBytes);
+      chargeEncodedBytes(state, encodedJsonStringBytes(key));
+      visitJson(object[key], depth + 1, state, false);
+    }
+  } finally {
+    state.active.delete(value);
+  }
+}
+function chargeEncodedBytes(state, bytes) {
+  if (bytes > JSON_1_LIMITS.bytes - state.encodedBytes) {
+    throw new Json1Error("maximum encoded bytes exceeded");
+  }
+  state.encodedBytes += bytes;
+}
+function encodedJsonStringBytes(value) {
+  return encoder2.encode(JSON.stringify(value)).byteLength;
+}
+function validateString(value, byteLimit) {
+  if (encoder2.encode(value).byteLength > byteLimit) {
+    throw new Json1Error("maximum string bytes exceeded");
+  }
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343))
+        throw new Json1Error("lone Unicode surrogate");
+      index += 1;
+    } else if (code >= 56320 && code <= 57343) {
+      throw new Json1Error("lone Unicode surrogate");
+    }
+  }
+}
+function canonicalJson(value) {
+  validateJson1(value);
+  return encoder2.encode(canonicalText(value));
+}
+function canonicalText(value) {
+  if (value === null || typeof value === "boolean" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number")
+    return Object.is(value, -0) ? "0" : JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonicalText).join(",")}]`;
+  const object = value;
+  const members = Object.keys(object).sort(compareUtf16).map((key) => `${JSON.stringify(key)}:${canonicalText(object[key])}`);
+  return `{${members.join(",")}}`;
+}
+function compareUtf16(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+// src/internal/private-ordinary-json.ts
+function snapshotPrivateOrdinaryJson(value, label, invalid2) {
+  const ordinary = cloneOrdinaryJson(value, label, invalid2, new Set);
+  let cloned;
+  try {
+    cloned = decodeJson1(canonicalJson(ordinary));
+  } catch (error) {
+    if (error instanceof Json1Error)
+      throw invalid2(`${label} is not valid JSON/0: ${error.message}`);
+    throw error;
+  }
+  deepFreeze(cloned);
+  return cloned;
+}
+function cloneOrdinaryJson(value, label, invalid2, ancestors) {
+  if (value === null || typeof value === "boolean" || typeof value === "string" || typeof value === "number") {
+    return value;
+  }
+  if (typeof value !== "object" || utilTypes.isProxy(value)) {
+    throw invalid2(`${label} must be ordinary JSON/0 data`);
+  }
+  if (ancestors.has(value)) {
+    throw invalid2(`${label} must not contain a cycle`);
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      if (Object.getPrototypeOf(value) !== Array.prototype) {
+        throw invalid2(`${label} must use ordinary arrays`);
+      }
+      const keys = Reflect.ownKeys(value);
+      if (keys.length !== value.length + 1 || keys.some((key) => typeof key !== "string" || key !== "length" && !/^(?:0|[1-9][0-9]*)$/.test(key))) {
+        throw invalid2(`${label} must not use sparse or extended arrays`);
+      }
+      const result2 = [];
+      for (let index = 0;index < value.length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        if (descriptor === undefined || !("value" in descriptor) || !descriptor.enumerable) {
+          throw invalid2(`${label} must not use array accessors`);
+        }
+        result2.push(cloneOrdinaryJson(descriptor.value, `${label}[${index}]`, invalid2, ancestors));
+      }
+      return result2;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw invalid2(`${label} must use ordinary objects`);
+    }
+    const result = Object.create(null);
+    for (const key of Reflect.ownKeys(value)) {
+      if (typeof key !== "string") {
+        throw invalid2(`${label} must not contain symbol properties`);
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (descriptor === undefined || !("value" in descriptor) || !descriptor.enumerable) {
+        throw invalid2(`${label} must contain enumerable data properties`);
+      }
+      result[key] = cloneOrdinaryJson(descriptor.value, `${label}.${key}`, invalid2, ancestors);
+    }
+    return result;
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function deepFreeze(value) {
+  if (value === null || typeof value !== "object" || Object.isFrozen(value))
+    return;
+  if (Array.isArray(value)) {
+    for (const child of value)
+      deepFreeze(child);
+  } else {
+    for (const child of Object.values(value))
+      deepFreeze(child);
+  }
+  Object.freeze(value);
+}
+
+// src/internal/package-aliases.ts
+var PRIVATE_PACKAGE_ALIAS_LIMITS = Object.freeze({ records: 4096, bytes: 1024 * 1024 });
+function normalizePrivatePackageAliases(value) {
+  if (utilTypes2.isProxy(value) || !Array.isArray(value) || value.length > PRIVATE_PACKAGE_ALIAS_LIMITS.records)
+    invalid2();
+  const aliases = snapshotPrivateOrdinaryJson(value, "package aliases", () => new TypeError("invalid package aliases"));
+  if (Buffer.byteLength(JSON.stringify(aliases)) > PRIVATE_PACKAGE_ALIAS_LIMITS.bytes)
+    invalid2();
+  let prior;
+  for (const alias of aliases) {
+    if (alias === null || typeof alias !== "object" || Array.isArray(alias) || Object.keys(alias).length !== 2 || typeof alias.path !== "string" || typeof alias.target !== "string")
+      invalid2();
+    validateLogicalPath(alias.path);
+    validateLogicalPath(alias.target);
+    if (prior !== undefined && comparePathBytes(prior, alias.path) >= 0)
+      invalid2();
+    prior = alias.path;
+  }
+  const paths = new Set(aliases.map(({ path }) => path));
+  for (const alias of aliases) {
+    for (const path of [posix.dirname(alias.path), alias.target]) {
+      const parts = path.split("/");
+      while (parts.length > 0) {
+        if (paths.has(parts.join("/")))
+          invalid2();
+        parts.pop();
+      }
+    }
+  }
+  return aliases;
+}
+function assertPrivatePackageAliasFiles(aliases, files) {
+  const paths = new Set(files.map(({ path }) => path));
+  const directories = new Set([""]);
+  for (const path of paths) {
+    const parts = path.split("/");
+    while (parts.length > 1) {
+      parts.pop();
+      directories.add(parts.join("/"));
+    }
+  }
+  for (const alias of aliases) {
+    if (!directories.has(alias.target) || paths.has(alias.path) || directories.has(alias.path))
+      invalid2();
+    const parts = alias.path.split("/");
+    while (parts.length > 1) {
+      parts.pop();
+      if (paths.has(parts.join("/")))
+        invalid2();
+    }
+  }
+}
+function invalid2() {
+  throw new TypeError("invalid package aliases");
+}
+
+// src/internal/bun-execution-layout.ts
+var PRIVATE_BUN_EXECUTION_LAYOUT_LIMITS = Object.freeze({
+  members: 256,
+  aliases: PRIVATE_PACKAGE_ALIAS_LIMITS.records,
+  bytes: 1024 * 1024
+});
+var EMPTY_PRIVATE_BUN_EXECUTION_LAYOUT = Object.freeze({
+  flowRoot: "",
+  members: Object.freeze([]),
+  aliases: Object.freeze([])
+});
+function normalizePrivateBunExecutionLayout(value) {
+  const record = exact(value, ["flowRoot", "members", "aliases"]);
+  const memberValues = array(record.members, PRIVATE_BUN_EXECUTION_LAYOUT_LIMITS.members);
+  const aliases = normalizePrivatePackageAliases(record.aliases);
+  if (typeof record.flowRoot !== "string")
+    invalid3();
+  const flowRoot = record.flowRoot;
+  if (flowRoot !== "")
+    validateLogicalPath(flowRoot);
+  const members = [];
+  for (const member of memberValues) {
+    if (typeof member !== "string")
+      invalid3();
+    validateLogicalPath(member);
+    if (member.split("/").includes("node_modules") || members.some((prior) => member.startsWith(`${prior}/`)) || members.length > 0 && comparePathBytes(members.at(-1), member) >= 0)
+      invalid3();
+    members.push(member);
+  }
+  for (const alias of aliases) {
+    if (!members.includes(alias.target) || privateBunAliasPackageName(alias.path) === undefined)
+      invalid3();
+  }
+  if (flowRoot !== "" && !members.includes(flowRoot) && privateBunAliasPackageName(flowRoot) === undefined)
+    invalid3();
+  const layout = Object.freeze({
+    flowRoot,
+    members: Object.freeze(members),
+    aliases: Object.freeze(aliases)
+  });
+  if (Buffer.byteLength(JSON.stringify(layout)) > PRIVATE_BUN_EXECUTION_LAYOUT_LIMITS.bytes)
+    invalid3();
+  return layout;
+}
+function assertPrivateBunExecutionLayoutFiles(layout, files) {
+  if (layout.flowRoot !== "" && !files.some(({ path }) => path === `${layout.flowRoot}/package.json`))
+    invalid3();
+  for (const member of layout.members)
+    if (!files.some(({ path }) => path === `${member}/package.json`))
+      invalid3();
+  assertPrivatePackageAliasFiles(layout.aliases, files);
+}
+function privateBunAliasPackageName(path) {
+  const match = /(?:^|\/)node_modules\/((?:@[^/]+\/)?[^/]+)$/.exec(path);
+  const name = match?.[1];
+  return name === undefined || name.startsWith(".") || name.split("/").some((part) => part === ".bin") ? undefined : name;
+}
+function exact(value, keys, optional = []) {
+  if (value === null || typeof value !== "object" || utilTypes3.isProxy(value) || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    invalid3();
+  const record = value;
+  const actual = Reflect.ownKeys(record);
+  keys = [...keys, ...optional.filter((key) => actual.includes(key))];
+  if (actual.length !== keys.length || actual.some((key) => typeof key !== "string" || !keys.includes(key)))
+    invalid3();
+  const copy = Object.create(null);
+  for (const key of keys) {
+    const descriptor = Object.getOwnPropertyDescriptor(record, key);
+    if (!descriptor || !Object.hasOwn(descriptor, "value") || !descriptor.enumerable)
+      invalid3();
+    copy[key] = descriptor.value;
+  }
+  return copy;
+}
+function array(value, maximum) {
+  if (value === null || typeof value !== "object" || utilTypes3.isProxy(value) || !Array.isArray(value))
+    invalid3();
+  const length = Object.getOwnPropertyDescriptor(value, "length")?.value;
+  if (!Number.isSafeInteger(length) || length < 0 || length > maximum || Reflect.ownKeys(value).length !== length + 1)
+    invalid3();
+  const result = [];
+  for (let index = 0;index < length; index++) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+    if (!descriptor || !Object.hasOwn(descriptor, "value") || !descriptor.enumerable)
+      invalid3();
+    result.push(descriptor.value);
+  }
+  return result;
+}
+function invalid3() {
+  throw new TypeError("invalid private Bun execution layout");
+}
 
 // src/internal/bun-native-preparation-protocol.ts
 var MIB = 1024 * 1024;
@@ -81,7 +889,7 @@ function maximumPrivateBunFileMessageBytes(type, maximumFiles, maximumContentByt
   return result;
 }
 var PRIVATE_BUN_SOURCE_MESSAGE_BYTES = maximumPrivateBunFileMessageBytes("source", PRIVATE_BUN_PREPARATION_LIMITS.sourceFiles, PRIVATE_BUN_PREPARATION_LIMITS.sourceBytes);
-var PRIVATE_BUN_PREPARED_MESSAGE_BYTES = maximumPrivateBunFileMessageBytes("prepared", PRIVATE_BUN_PREPARATION_LIMITS.preparedFiles, PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes);
+var PRIVATE_BUN_PREPARED_MESSAGE_BYTES = maximumPrivateBunFileMessageBytes("prepared", PRIVATE_BUN_PREPARATION_LIMITS.preparedFiles, PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes) + PRIVATE_BUN_EXECUTION_LAYOUT_LIMITS.bytes + Buffer.byteLength(',"layout":');
 function privateBunMessageFits(bytes, maximum) {
   return Number.isSafeInteger(bytes) && bytes >= 0 && bytes <= maximum;
 }
@@ -98,38 +906,177 @@ function requireNonnegativeInteger(value, label) {
   }
 }
 
-// src/internal/bun-native-preparation-worker.ts
-var PACKAGE_ROOT = "/work/package";
-var CACHE_ROOT = "/work/cache";
+// src/internal/bun-prepared-capture.ts
+import { lstat, opendir, readFile, realpath } from "fs/promises";
+import { join } from "path";
 var PATH = /^(?!\/)(?!.*(?:^|\/)\.\.?(?:\/|$))(?!.*\/\/)[^\0]+$/;
 
 class WorkerFailure extends Error {
   code;
-  constructor(code, message) {
+  location;
+  constructor(code, message, location) {
     super(message);
     this.code = code;
+    this.location = location;
+  }
+}
+async function capturePrivateBunPreparedTree(packageRoot, workspace, patchPaths = []) {
+  const files = [];
+  const aliases = [];
+  let total = 0;
+  const memberNames = new Map;
+  for (const member of workspace?.members ?? []) {
+    const manifest = JSON.parse(await readFile(join(packageRoot, member, "package.json"), "utf8"));
+    if (typeof manifest.name !== "string")
+      unsupported("workspace member name is missing");
+    memberNames.set(member, manifest.name);
+  }
+  const reserveRecord = () => {
+    if (files.length + aliases.length >= PRIVATE_BUN_PREPARATION_LIMITS.preparedFiles)
+      throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree has too many records");
+  };
+  const selectedSource = (path) => workspace === undefined || workspace.selected.some((member) => path === member || path.startsWith(`${member}/`));
+  const ancestor = (path) => (workspace?.selected.some((member) => member.startsWith(`${path}/`)) ?? false) || patchPaths.some((patch) => patch.startsWith(`${path}/`));
+  const visit = async (root, prefix, installed = false) => {
+    const names = [];
+    for await (const entry of await opendir(root))
+      names.push(entry.name);
+    names.sort(compare);
+    for (const name of names) {
+      const path = prefix === "" ? name : `${prefix}/${name}`;
+      if (name === ".bin" && prefix.split("/").at(-1) === "node_modules")
+        continue;
+      requirePath(path);
+      const physical = join(root, name);
+      const information = await lstat(physical);
+      const dependencyTree = installed || name === "node_modules";
+      const retained = dependencyTree || selectedSource(path) || ancestor(path) || patchPaths.includes(path) || prefix === "" && (name === "package.json" || name === "bun.lock");
+      if (!retained)
+        continue;
+      if (information.isSymbolicLink()) {
+        if (workspace === undefined || !dependencyTree)
+          unsupported("prepared source contains an unauthorized link");
+        const packageName = privateBunAliasPackageName(path);
+        const resolved = await realpath(physical);
+        const member = workspace.members.find((value) => join(packageRoot, value) === resolved);
+        if (member === undefined || packageName === undefined || memberNames.get(member) !== packageName)
+          unsupported("prepared dependencies contain an unauthorized link");
+        if (!workspace.selected.includes(member))
+          continue;
+        reserveRecord();
+        aliases.push(Object.freeze({ path, target: member }));
+        continue;
+      }
+      if (information.isDirectory()) {
+        await visit(physical, path, dependencyTree);
+        continue;
+      }
+      if (!information.isFile() || information.nlink !== 1)
+        unsupported("prepared dependencies contain a link or special file");
+      if (!dependencyTree && !selectedSource(path) && prefix !== "" && !patchPaths.includes(path))
+        continue;
+      reserveRecord();
+      if (information.size > PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes - total)
+        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree is too large");
+      const bytes = await readFile(physical);
+      total += bytes.byteLength;
+      if (total > PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes)
+        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree is too large");
+      files.push(Object.freeze({ path, content: bytes.toString("base64") }));
+    }
+  };
+  await visit(packageRoot, "");
+  files.sort((left, right) => compare(left.path, right.path));
+  aliases.sort((left, right) => compare(left.path, right.path));
+  let layout = EMPTY_PRIVATE_BUN_EXECUTION_LAYOUT;
+  try {
+    if (workspace !== undefined)
+      layout = normalizePrivateBunExecutionLayout({
+        flowRoot: workspace.target,
+        members: [...workspace.selected].sort(compare),
+        aliases
+      });
+    assertPrivateBunExecutionLayoutFiles(layout, files);
+  } catch {
+    unsupported("prepared workspace layout is invalid");
   }
+  if (total + Buffer.byteLength(JSON.stringify(layout)) > PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes)
+    throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree and layout are too large");
+  return Object.freeze({ files: Object.freeze(files), layout });
+}
+function requirePath(path) {
+  if (!PATH.test(path) || Buffer.byteLength(path) > 1024)
+    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source path is invalid");
+}
+function compare(left, right) {
+  return Buffer.from(left).compare(Buffer.from(right));
 }
+function unsupported(message) {
+  throw new WorkerFailure("PACKAGE_BUN_OUTPUT_UNSUPPORTED", message);
+}
+
+// src/internal/bun-native-preparation-worker.ts
+var PACKAGE_ROOT = "/work/package";
+var CACHE_ROOT = "/work/cache";
+var workspace;
 var outputQueue = Promise.resolve();
+var allowResolutionNetwork = process.argv.length === 3 && process.argv[2] === "--allow-resolution-network";
 try {
   const iterator = jsonLines(process.stdin, PRIVATE_BUN_SOURCE_MESSAGE_BYTES)[Symbol.asyncIterator]();
   const first = await iterator.next();
   if (first.done)
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source is missing");
   const source = requireSource(first.value);
+  workspace = source.workspace;
   if (!(await iterator.next()).done) {
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source has trailing data");
   }
-  await materializeSource(source.files);
-  await requireSupportedLock();
+  const inputPaths = new Set([
+    "package.json",
+    "bun.lock",
+    ...workspace?.members.map((path) => `${path}/package.json`) ?? []
+  ]);
+  let patches = {};
+  try {
+    for (const path of [
+      "package.json",
+      ...workspace?.members.map((path2) => `${path2}/package.json`) ?? []
+    ]) {
+      const file = source.files.find((file2) => file2.path === path);
+      const manifest = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64(file.content, path)));
+      requirePrivateBunResolutionManifest(manifest, workspace === undefined ? undefined : path === "package.json" ? "root" : "member");
+      if (path === "package.json")
+        patches = requirePrivateBunPatches(manifest.patchedDependencies);
+    }
+    for (const path of Object.values(patches)) {
+      const file = source.files.find((file2) => file2.path === path);
+      if (file === undefined || decodeBase64(file.content, path).byteLength > 1024 * 1024)
+        throw new TypeError("missing or oversized captured patch");
+      inputPaths.add(path);
+    }
+  } catch {
+    throw new WorkerFailure("PACKAGE_BUN_SOURCE_UNSUPPORTED", "native manifests or declared patch inputs are unsupported or incomplete");
+  }
+  const inputs = source.files.filter(({ path }) => inputPaths.has(path));
+  await materializeSource(inputs);
+  const resolving = !inputs.some(({ path }) => path === "bun.lock");
+  if (resolving)
+    await resolveMissingLock();
+  await requireSupportedLock(resolving, patches);
   await install();
+  await materializeSource(source.files.filter(({ path }) => !inputPaths.has(path)));
   await verifySource(source.files);
-  const prepared = await capturePrepared();
+  const prepared = await capturePrivateBunPreparedTree(PACKAGE_ROOT, workspace, Object.values(patches));
   await sendPrepared(prepared);
   await outputQueue;
 } catch (error) {
   const failure = error instanceof WorkerFailure ? error : new WorkerFailure("PACKAGE_BUN_PREPARATION_FAILED", "locked Bun dependency preparation failed");
-  await send({ type: "failure", code: failure.code, message: failure.message }).catch(() => {
+  await send({
+    type: "failure",
+    code: failure.code,
+    message: failure.message,
+    ...failure.location === undefined ? {} : { location: failure.location }
+  }).catch(() => {
     return;
   });
   await outputQueue.catch(() => {
@@ -141,7 +1088,7 @@ async function materializeSource(files) {
   await mkdir(PACKAGE_ROOT, { recursive: true, mode: 448 });
   for (const file of files) {
     const bytes = decodeBase64(file.content, file.path);
-    const destination = join(PACKAGE_ROOT, ...file.path.split("/"));
+    const destination = join2(PACKAGE_ROOT, ...file.path.split("/"));
     await mkdir(dirname(destination), { recursive: true, mode: 448 });
     await writeFile(destination, bytes, { mode: 384, flag: "wx" });
   }
@@ -149,15 +1096,15 @@ async function materializeSource(files) {
 async function verifySource(files) {
   for (const file of files) {
     const expected = decodeBase64(file.content, file.path);
-    const actual = new Uint8Array(await readFile(join(PACKAGE_ROOT, ...file.path.split("/"))));
+    const actual = new Uint8Array(await readFile2(join2(PACKAGE_ROOT, ...file.path.split("/"))));
     if (!Buffer.from(actual).equals(Buffer.from(expected))) {
       throw new WorkerFailure("PACKAGE_BUN_SOURCE_CHANGED", "Bun preparation changed authored package bytes");
     }
   }
 }
-async function requireSupportedLock() {
+async function requireSupportedLock(resolved, patches) {
   const lockCopy = "/work/bun-lock.jsonc";
-  await copyFile(join(PACKAGE_ROOT, "bun.lock"), lockCopy);
+  await copyFile(join2(PACKAGE_ROOT, "bun.lock"), lockCopy);
   let value;
   try {
     const result = await runChild([
@@ -178,10 +1125,91 @@ async function requireSupportedLock() {
     throw new WorkerFailure("PACKAGE_BUN_LOCK_INVALID", "bun.lock is not valid for the pinned Bun runtime");
   }
   try {
-    requirePrivateBunLockPolicy(value);
+    requirePrivateBunLockPolicy(value, workspace === undefined ? undefined : new Set(workspace.members));
   } catch {
+    if (resolved) {
+      throw new WorkerFailure("PACKAGE_BUN_RESOLVED_SOURCE_UNSUPPORTED", "resolved dependencies are unsupported; resolution requests may already have occurred");
+    }
     unsupportedSource();
   }
+  if (workspace !== undefined) {
+    if (canonical(requirePrivateBunPatches(value.patchedDependencies)) !== canonical(patches))
+      throw new WorkerFailure("PACKAGE_BUN_LOCK_STALE", "workspace patch declarations and bun.lock disagree; update the workspace lock explicitly");
+    const locked = value.workspaces;
+    const packages = value.packages;
+    for (const path of ["", ...workspace.members]) {
+      const manifest = JSON.parse(await readFile2(join2(PACKAGE_ROOT, path, "package.json"), "utf8"));
+      const entry = locked[path];
+      const dependencyFields = [
+        "dependencies",
+        "devDependencies",
+        "optionalDependencies",
+        "peerDependencies"
+      ];
+      const field = entry === undefined ? "workspace entry" : ["name", "version"].find((field2) => manifest[field2] !== entry[field2]) ?? dependencyFields.find((field2) => !workspaceDependencyMapMatches(manifest[field2] ?? {}, entry[field2] ?? {}, locked, packages));
+      if (field !== undefined)
+        throw new WorkerFailure("PACKAGE_BUN_LOCK_STALE", `${path === "" ? "package.json" : `${path}/package.json`}: ${field} differs from bun.lock; update the workspace lock explicitly`, {
+          path: path === "" ? "package.json" : `${path}/package.json`,
+          pointer: field === "workspace entry" ? "" : `/${field}`
+        });
+    }
+  }
+}
+function workspaceDependencyMapMatches(manifestValue, lockValue, workspaces, packages) {
+  if (canonical(manifestValue) === canonical(lockValue))
+    return true;
+  const manifest = ordinaryRecord2(manifestValue);
+  const locked = ordinaryRecord2(lockValue);
+  if (manifest === undefined || locked === undefined)
+    return false;
+  const names = Object.keys(manifest);
+  if (names.length !== Object.keys(locked).length || names.some((name) => !(name in locked)))
+    return false;
+  return names.every((name) => {
+    const request = manifest[name];
+    if (request === locked[name])
+      return true;
+    if (typeof request !== "string" || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(request) || typeof locked[name] !== "string" || !locked[name].startsWith("workspace:"))
+      return false;
+    const resolution = packages[name];
+    if (!Array.isArray(resolution) || resolution.length !== 1 || typeof resolution[0] !== "string")
+      return false;
+    const prefix = `${name}@workspace:`;
+    if (!resolution[0].startsWith(prefix))
+      return false;
+    const member = workspaces[resolution[0].slice(prefix.length)];
+    return member?.name === name && member.version === request;
+  });
+}
+function canonical(value) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value))
+    return JSON.stringify(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
+  return JSON.stringify(value) ?? "";
+}
+async function resolveMissingLock() {
+  if (!allowResolutionNetwork)
+    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "resolution permission is missing");
+  const result = await runChild([
+    "--no-env-file",
+    "--config=/dev/null",
+    "install",
+    "--lockfile-only",
+    "--production",
+    "--ignore-scripts",
+    "--backend=copyfile",
+    "--linker=hoisted",
+    `--cache-dir=${CACHE_ROOT}`,
+    "--registry=https://registry.npmjs.org",
+    "--no-progress",
+    "--no-summary",
+    ...workspaceFilter()
+  ], { cwd: PACKAGE_ROOT, env: { LD_LIBRARY_PATH: "/jig-runtime/lib" } }, 64 * 1024, 64 * 1024);
+  if (result.exit !== 0) {
+    if (/No version matching|No matching version|No matching tag/i.test(result.stderr)) {
+      throw new WorkerFailure("PACKAGE_BUN_RESOLUTION_VERSION_UNAVAILABLE", "a dependency version or tag is unavailable; resolution requests may already have occurred");
+    }
+    throw new WorkerFailure("PACKAGE_BUN_RESOLUTION_FAILED", "dependency resolution failed; network requests may already have occurred");
+  }
 }
 function unsupportedSource() {
   throw new WorkerFailure("PACKAGE_BUN_SOURCE_UNSUPPORTED", "bun.lock contains a dependency source unsupported by this Jig alpha; only the default npm registry is supported");
@@ -199,7 +1227,8 @@ async function install() {
     `--cache-dir=${CACHE_ROOT}`,
     "--registry=https://registry.npmjs.org",
     "--no-progress",
-    "--no-summary"
+    "--no-summary",
+    ...workspaceFilter()
   ], {
     cwd: PACKAGE_ROOT,
     env: {
@@ -214,43 +1243,7 @@ ${result.stderr}`;
     }
     throw new WorkerFailure("PACKAGE_BUN_PREPARATION_FAILED", "the locked production dependencies could not be prepared by the pinned Bun runtime");
   }
-  await rm(join(PACKAGE_ROOT, "node_modules", ".bin"), { recursive: true, force: true });
-}
-async function capturePrepared() {
-  const files = [];
-  let total = 0;
-  const visit = async (root, prefix) => {
-    const directory = await opendir(root);
-    const names = [];
-    for await (const entry of directory)
-      names.push(entry.name);
-    names.sort((left, right) => Buffer.from(left).compare(Buffer.from(right)));
-    for (const name of names) {
-      const path = prefix === "" ? name : `${prefix}/${name}`;
-      requirePath(path);
-      const physical = join(root, name);
-      const information = await lstat(physical);
-      if (information.isDirectory() && !information.isSymbolicLink()) {
-        await visit(physical, path);
-        continue;
-      }
-      if (!information.isFile() || information.isSymbolicLink() || information.nlink !== 1) {
-        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_UNSUPPORTED", "prepared dependencies contain a link or special file");
-      }
-      if (files.length >= PRIVATE_BUN_PREPARATION_LIMITS.preparedFiles) {
-        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree has too many files");
-      }
-      const bytes = new Uint8Array(await readFile(physical));
-      total += bytes.byteLength;
-      if (total > PRIVATE_BUN_PREPARATION_LIMITS.preparedBytes) {
-        throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree is too large");
-      }
-      files.push(Object.freeze({ path, content: Buffer.from(bytes).toString("base64") }));
-    }
-  };
-  await visit(PACKAGE_ROOT, "");
-  files.sort((left, right) => Buffer.from(left.path).compare(Buffer.from(right.path)));
-  return Object.freeze(files);
+  await rm(join2(PACKAGE_ROOT, "node_modules", ".bin"), { recursive: true, force: true });
 }
 function requireSource(value) {
   const root = ordinaryRecord2(value);
@@ -277,21 +1270,43 @@ function requireSource(value) {
     }
     files.push(Object.freeze({ path: file.path, content: file.content }));
   }
-  if (!files.some(({ path }) => path === "package.json") || !files.some(({ path }) => path === "bun.lock")) {
+  if (!files.some(({ path }) => path === "package.json") || !files.some(({ path }) => path === "bun.lock") && !allowResolutionNetwork) {
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "locked Bun source is incomplete");
   }
-  return Object.freeze({ files: Object.freeze(files) });
-}
-function requirePath(path) {
-  if (!PATH.test(path) || Buffer.byteLength(path) > 1024) {
-    throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "preparation source path is invalid");
+  let selectedWorkspace;
+  if (root.workspace !== undefined) {
+    const record = ordinaryRecord2(root.workspace);
+    if (record === undefined || typeof record.target !== "string" || !Array.isArray(record.members) || !Array.isArray(record.selected) || record.members.length === 0 && record.target !== "" || record.members.length > 256 || record.selected.length > record.members.length || record.target !== "" && (!record.members.includes(record.target) || !record.selected.includes(record.target)))
+      throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "workspace preparation metadata is invalid");
+    for (const member of record.members) {
+      if (typeof member !== "string")
+        throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "workspace path is invalid");
+      requirePath(member);
+      if (member.split("/").includes("node_modules") || !files.some(({ path }) => path === `${member}/package.json`))
+        throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "workspace manifest is missing");
+    }
+    if (new Set(record.members).size !== record.members.length || new Set(record.selected).size !== record.selected.length || record.selected.some((path) => !record.members.includes(path)))
+      throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", "workspace membership is invalid");
+    selectedWorkspace = {
+      target: record.target,
+      members: record.members,
+      selected: record.selected
+    };
   }
+  return Object.freeze({
+    files: Object.freeze(files),
+    ...selectedWorkspace === undefined ? {} : { workspace: selectedWorkspace }
+  });
+}
+function workspaceFilter() {
+  return workspace === undefined ? [] : ["--filter", `./${workspace.target}`];
 }
 function decodeBase64(value, label) {
-  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+  const bytes = Buffer.from(value, "base64");
+  if (bytes.toString("base64") !== value) {
     throw new WorkerFailure("PACKAGE_BUN_PROTOCOL", `${label} has invalid encoded bytes`);
   }
-  return new Uint8Array(Buffer.from(value, "base64"));
+  return new Uint8Array(bytes);
 }
 function ordinaryRecord2(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype)
@@ -308,8 +1323,8 @@ function enqueue(bytes) {
   });
   return outputQueue;
 }
-function sendPrepared(files) {
-  const bytes = encodePrivateBunMessage({ type: "prepared", files });
+function sendPrepared(prepared) {
+  const bytes = encodePrivateBunMessage({ type: "prepared", ...prepared });
   if (!privateBunMessageFits(bytes.byteLength - 1, PRIVATE_BUN_PREPARED_MESSAGE_BYTES)) {
     throw new WorkerFailure("PACKAGE_BUN_OUTPUT_LIMIT", "prepared dependency tree is too large");
   }