@oxy.so/doctor 1.6.0 → 1.7.0

package/README.md

@@ -15,8 +15,8 @@ bunx @oxy.so/doctor --ci --grace-days=7
 ```
 
 It checks direct dependencies under the canonical `@oxy.so/*` scope against
-npm, reports duplicate versions in `bun.lock`, and fails clearly when the
-lockfile is missing.
+npm, fails on duplicate copies of a package in `bun.lock` or `node_modules`
+(below), and fails clearly when the lockfile is missing.
 
 It reads the manifests Bun installs from: the root `package.json` and the
 workspaces its `workspaces` patterns match. A `catalog:` dependency is checked
@@ -29,8 +29,55 @@ A range that doesn't include the newest published `@oxy.so/*` release is a
 changes the window), and an **error** after that. `--ci` exits 1 on errors
 only, so publishing a new major never turns every app's CI, and every deploy
 gated on it, red at once; each app still has to upgrade inside the window.
-Duplicate locked versions and a missing lockfile are always errors.
-Operational failures use status 2. Default mode is informational.
+A missing lockfile is always an error. Operational failures use status 2.
+Default mode is informational.
+
+## Duplicate copies
+
+Each copy of a module is its own module instance: two `@oxy.so/contracts` are
+two schema sets, two `@oxy.so/bloom` two theme contexts (a provider from one
+copy is invisible to a consumer of the other), two `react` an invalid-hook
+crash, two native modules a build that links one and runs the other. OxyOS's
+packager refuses a duplicate module outright.
+
+Doctor reads every copy `bun.lock` installs and who pulls each one (the
+workspaces and packages whose dependency resolves to it), and reports:
+
+- **`duplicate-copy`** (error, any package): the newest locked copy satisfies
+  every range that pulls a copy, so one would do. Bun reuses an existing copy
+  only when it satisfies a range, so after an SDK release moves the hoisted copy
+  forward, a dependent's older nested copy stays locked: Dropsea once held
+  `@oxy.so/protocol/@oxy.so/contracts@6.8.0` beside the hoisted 6.9.0, though
+  protocol's `^6.5.0` accepts 6.9.0. Fix: `bun update -r <pkg>` (`-r` so a
+  workspace's own declaration moves too) and commit `bun.lock`.
+- **`duplicate-pinned`**: every range accepts one older locked version, but a
+  dependent pins below the newest, and Bun resolves the wider ranges to the
+  newest, so `bun update` keeps both. An **error** for a single-copy package
+  (fix: a release of the pinning dependent, or a root `overrides` entry); a
+  **warning** for any other.
+- **`duplicate-hoisted`** (error, zod): the Oxy packages agree on one
+  version, but each holds its own nested copy because the hoisted copy is a
+  version they reject (a workspace or tool still on zod 3). Fix: declare their
+  version in the root `package.json`, or move the hoisted copy's users to it.
+- **`duplicate-conflict`** (error, single-copy packages): no one version
+  satisfies every range. No update can fix it; it names the dependents whose
+  ranges reject the version the rest use, and they need a release (or, for a
+  workspace, a wider range in its `package.json`).
+- **`installed-duplicate`** (error): a single-copy package installed more than
+  once under `node_modules` (hoisted, nested, or Bun's isolated `.bun` store,
+  by real path) although `bun.lock` names one copy: a stale install, fixed by
+  `bun install --frozen-lockfile`. Without `node_modules` only `bun.lock` is
+  checked, and the CLI says so.
+
+Single-copy packages: every `@oxy.so/*`, `react`, `react-dom`, `react-native`,
+`expo`, `expo-modules-core`, `react-native-reanimated`,
+`react-native-gesture-handler`, `react-native-safe-area-context`,
+`react-native-screens`, `socket.io-client`, and `zod` among the copies
+`@oxy.so/*` packages use (`@oxy.so/contracts` and an app's own
+`@oxy.so/*-contracts` build schemas with it; a build tool's private zod may
+differ). Copies of an ordinary package forced by incompatible ranges (two
+majors of a utility) are normal and not reported. A copy bundled inside its
+dependent's tarball is that dependent's own unless the package is single-copy.
 
 It also checks that every app (a manifest on `@oxy.so/services` and on `expo`
 or `react-native`) declares each REQUIRED native peer of the services it has

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/doctor",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Read-only health checks for Oxy ecosystem repositories",
   "repository": {
     "type": "git",
@@ -25,6 +25,9 @@
   "scripts": {
     "test": "bun test tests"
   },
+  "dependencies": {
+    "semver": "^7.7.4"
+  },
   "publishConfig": {
     "access": "public"
   },

package/src/checks.mjs

@@ -1,6 +1,18 @@
 import { readFile, readdir } from 'node:fs/promises';
 import { existsSync, readdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
+import { duplicateFindings, installedDuplicateFindings, parseBunLock } from './duplicates.mjs';
+
+export {
+  duplicateFindings,
+  installedCopies,
+  installedDuplicateFindings,
+  lockfileCopies,
+  mustBeSingle,
+  parseBunLock,
+  SHARED_WITH_OXY_PACKAGES,
+  SINGLE_COPY_PACKAGES,
+} from './duplicates.mjs';
 
 export const FIRST_PARTY_SCOPES = ['@oxy.so/'];
 
@@ -277,6 +289,14 @@ export async function inspectRepository(
   const lockfile = existsSync(lockPath) ? await readFile(lockPath, 'utf8') : null;
   if (!lockfile)
     findings.push({ severity: 'error', code: 'missing-lockfile', message: 'bun.lock is missing' });
+  const duplicates = lockfile ? duplicateFindings(parseBunLock(lockfile)) : [];
+  findings.push(...duplicates);
+  const installed = installedDuplicateFindings(
+    root,
+    manifestPaths.map((path) => dirname(path)),
+    new Set(duplicates.map((finding) => finding.package)),
+  );
+  findings.push(...installed.findings);
   await Promise.all(
     [...usages].map(async ([name, rows]) => {
       const { version: latest, publishedAt } = await fetchLatest(name);
@@ -285,15 +305,6 @@ export async function inspectRepository(
         throw new Error(`Registry returned no publish time for ${name}@${latest}`);
       const deadline = new Date(published.getTime() + graceDays * DAY_MS);
       const overdue = now >= deadline;
-      const installed = lockfile ? [...new Set(lockfileVersions(lockfile, name))] : [];
-      if (installed.length > 1)
-        findings.push({
-          severity: 'error',
-          code: 'duplicate-version',
-          package: name,
-          installed,
-          message: `${name} has multiple locked versions: ${installed.join(', ')}`,
-        });
       for (const row of rows) {
         if (rangeIncludesVersion(row.range, latest)) continue;
         const due = deadline.toISOString().slice(0, 10);
@@ -327,6 +338,7 @@ export async function inspectRepository(
     packages: usages.size,
     findings,
     nativePeersUnverified: unverified,
+    installedTreeChecked: installed.checked,
   };
 }
 

package/src/cli.mjs

@@ -10,7 +10,7 @@ const argv = process.argv.slice(2);
 const args = new Set(argv);
 if (args.has('--help') || args.has('-h')) {
   console.log(
-    `oxy-doctor [--ci] [--json] [--grace-days=N]\n\nRead-only checks for Oxy ecosystem dependency health.\nA newer @oxy.so release is a warning for N days after it is published (default ${DEFAULT_GRACE_DAYS}), then an error.\n--ci exits 1 on errors only.`,
+    `oxy-doctor [--ci] [--json] [--grace-days=N]\n\nRead-only checks for Oxy ecosystem dependency health.\nA newer @oxy.so release is a warning for N days after it is published (default ${DEFAULT_GRACE_DAYS}), then an error.\nMore than one copy of a package bun could serve with one (\`bun update <pkg>\`), or of a package that must be single (@oxy.so/*, react, expo, ...), is an error.\n--ci exits 1 on errors only.`,
   );
   process.exit(0);
 }
@@ -35,6 +35,10 @@ try {
       console.log(
         `? ${manifest}: @oxy.so/services is not installed, so its native peers were not checked (run bun install first)`,
       );
+    if (!report.installedTreeChecked)
+      console.log(
+        '? node_modules is not installed, so only bun.lock was checked for duplicate copies (run bun install first)',
+      );
     for (const finding of report.findings)
       console.log(`${finding.severity === 'error' ? '✗' : '!'} ${finding.message}`);
   }

package/src/duplicates.mjs

@@ -0,0 +1,475 @@
+import { existsSync, readdirSync, readFileSync, realpathSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import semver from 'semver';
+
+/**
+ * Packages an app must hold exactly one copy of. Each copy of a module is its
+ * own module instance: two `@oxy.so/contracts` are two schema sets, two
+ * `@oxy.so/bloom` two theme contexts (a provider from one copy is invisible to
+ * a consumer of the other), two `react` an invalid-hook crash, two native
+ * modules a build that links one and runs the other. OxyOS's packager refuses
+ * a duplicate module outright. Every `@oxy.so/*` package is on this list too.
+ */
+export const SINGLE_COPY_PACKAGES = [
+  'expo',
+  'expo-modules-core',
+  'react',
+  'react-dom',
+  'react-native',
+  'react-native-gesture-handler',
+  'react-native-reanimated',
+  'react-native-safe-area-context',
+  'react-native-screens',
+  'socket.io-client',
+];
+
+/**
+ * Single only among the copies Oxy packages use: `@oxy.so/contracts` and an
+ * app's own `@oxy.so/*-contracts` build schemas with zod, and a schema from one
+ * zod copy cannot be composed into, or parsed by, another. A build tool
+ * carrying its own zod for its own config is not shared and may differ.
+ */
+export const SHARED_WITH_OXY_PACKAGES = ['zod'];
+
+const isOxyPackage = (name) => name.startsWith('@oxy.so/');
+export const mustBeSingle = (name) => isOxyPackage(name) || SINGLE_COPY_PACKAGES.includes(name);
+
+/**
+ * `bun.lock` is JSON with trailing commas. Drop every comma that closes an
+ * object or array (outside strings) and parse the rest as JSON.
+ */
+export function parseBunLock(text) {
+  let out = '';
+  let inString = false;
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (inString) {
+      out += char;
+      if (char === '\\') {
+        out += text[index + 1] ?? '';
+        index += 1;
+      } else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') inString = true;
+    else if (char === ',') {
+      let next = index + 1;
+      while (/\s/.test(text[next] ?? '')) next += 1;
+      if (text[next] === '}' || text[next] === ']') continue;
+    }
+    out += char;
+  }
+  return JSON.parse(out);
+}
+
+/** `@scope/name@1.2.3` → { name, spec }. */
+function splitIdent(ident) {
+  const at = ident.indexOf('@', ident.startsWith('@') ? 1 : 0);
+  return at === -1
+    ? { name: ident, spec: '' }
+    : { name: ident.slice(0, at), spec: ident.slice(at + 1) };
+}
+
+/** The package names a lockfile key nests: `a/@s/b/c` → ['a', '@s/b', 'c']. */
+function keyNames(key) {
+  const segments = key.split('/');
+  const names = [];
+  for (let index = 0; index < segments.length; index += 1) {
+    if (segments[index].startsWith('@')) {
+      names.push(`${segments[index]}/${segments[index + 1]}`);
+      index += 1;
+    } else names.push(segments[index]);
+  }
+  return names;
+}
+
+const DEPENDENCY_SECTIONS = ['dependencies', 'optionalDependencies', 'devDependencies'];
+
+/**
+ * Every copy of every package `bun.lock` installs, and who pulls each copy:
+ * the workspaces and packages whose dependency on it resolves to that copy
+ * (Node's walk: the dependent's own nested entry first, then each ancestor's,
+ * then the hoisted one).
+ *
+ * @returns {Map<string, Array<{ key: string, version: string, pulledBy: Array<{ by: string, range: string, peer: boolean, oxy: boolean, workspace: boolean }> }>>}
+ */
+export function lockfileCopies(lock) {
+  const packages = lock.packages ?? {};
+  const workspaces = lock.workspaces ?? {};
+  const catalog = lock.catalog ?? {};
+  const catalogs = lock.catalogs ?? {};
+  const copies = new Map();
+  const byKey = new Map();
+  for (const [key, entry] of Object.entries(packages)) {
+    if (!Array.isArray(entry) || typeof entry[0] !== 'string') continue;
+    const { name, spec } = splitIdent(entry[0]);
+    let version = spec;
+    if (spec.startsWith('workspace:')) {
+      const path = spec.slice('workspace:'.length);
+      version = workspaces[path]?.version ?? spec;
+    }
+    const meta =
+      entry.find((part) => part && typeof part === 'object' && !Array.isArray(part)) ?? {};
+    const copy = {
+      key,
+      name,
+      version,
+      meta,
+      workspace: spec.startsWith('workspace:'),
+      bundled: meta.bundled === true,
+      pulledBy: [],
+    };
+    byKey.set(key, copy);
+    const list = copies.get(name) ?? [];
+    list.push(copy);
+    copies.set(name, list);
+  }
+  const resolveFrom = (chain, dependency) => {
+    for (let depth = chain.length; depth >= 0; depth -= 1) {
+      const key = [...chain.slice(0, depth), dependency].join('/');
+      if (byKey.has(key)) return byKey.get(key);
+    }
+    return null;
+  };
+  const record = (chain, dependency, range, edge) => {
+    const target = resolveFrom(chain, dependency);
+    if (target) target.pulledBy.push({ range, ...edge });
+  };
+  for (const [path, workspace] of Object.entries(workspaces)) {
+    const chain = path === '' || !workspace.name ? [] : [workspace.name];
+    const by = path === '' ? 'package.json' : `${path}/package.json`;
+    for (const section of [...DEPENDENCY_SECTIONS, 'peerDependencies'])
+      for (const [dependency, range] of Object.entries(workspace[section] ?? {})) {
+        let resolved = range;
+        if (range.startsWith('catalog:')) {
+          const named = range.slice('catalog:'.length);
+          resolved =
+            (named && named !== 'default' ? catalogs[named] : catalog)?.[dependency] ?? range;
+        }
+        record(chain, dependency, resolved, {
+          by,
+          peer: section === 'peerDependencies',
+          oxy: typeof workspace.name === 'string' && isOxyPackage(workspace.name),
+          workspace: true,
+        });
+      }
+  }
+  for (const copy of byKey.values()) {
+    if (copy.workspace) continue;
+    const chain = keyNames(copy.key);
+    const by = `${copy.name}@${copy.version}`;
+    for (const section of ['dependencies', 'optionalDependencies', 'peerDependencies'])
+      for (const [dependency, range] of Object.entries(copy.meta[section] ?? {})) {
+        record(chain, dependency, range, {
+          by,
+          peer: section === 'peerDependencies',
+          oxy: isOxyPackage(copy.name),
+          workspace: false,
+        });
+      }
+  }
+  return copies;
+}
+
+/** The package at one lockfile key, for naming it. */
+function lockCopy(lock, key) {
+  const entry = lock.packages?.[key];
+  if (!Array.isArray(entry) || typeof entry[0] !== 'string') return null;
+  const { name, spec } = splitIdent(entry[0]);
+  return { name, version: spec };
+}
+
+/** The semver range in a dependency spec, or null when it is not one (git, file, link, tag). */
+function semverRange(range) {
+  const spec = range.startsWith('npm:') ? splitIdent(range.slice(4)).spec : range;
+  return semver.validRange(spec) === null ? null : spec;
+}
+
+/** Workspaces install what they declare; packages install their dependencies, never their peers. */
+function pullers(copy) {
+  const installing = copy.pulledBy.filter((edge) => !edge.peer || edge.workspace);
+  return installing.length > 0 ? installing : copy.pulledBy;
+}
+
+const LIST_LIMIT = 4;
+function describeEdges(edges) {
+  const unique = [...new Map(edges.map((edge) => [`${edge.by} ${edge.range}`, edge])).values()];
+  const shown = unique
+    .slice(0, LIST_LIMIT)
+    .map((edge) => `${edge.by} (${edge.range})`)
+    .join(', ');
+  return unique.length > LIST_LIMIT ? `${shown} and ${unique.length - LIST_LIMIT} more` : shown;
+}
+
+/** "6.8.0 (pulled by …); 6.9.0 (3 copies, pulled by …)": one clause per version. */
+function describeCopies(copies) {
+  const byVersion = new Map();
+  for (const copy of copies) {
+    const rows = byVersion.get(copy.version) ?? [];
+    rows.push(copy);
+    byVersion.set(copy.version, rows);
+  }
+  return [...byVersion]
+    .map(([version, rows]) => {
+      const count = rows.length === 1 ? '' : `${rows.length} copies, `;
+      const edges = describeEdges(rows.flatMap(pullers));
+      return `${version} (${count}pulled by ${edges || 'nothing that declares it'})`;
+    })
+    .join('; ');
+}
+
+/**
+ * Duplicate copies in a parsed `bun.lock`. Bun resolves each range to the
+ * newest version it accepts and reuses an existing copy only when that copy
+ * satisfies the range, so after an SDK bump moves the hoisted copy forward a
+ * dependent's older nested copy can stay locked although the new one would do.
+ *
+ * - `duplicate-copy` (error, any package): the newest locked copy satisfies
+ *   every range that pulls a copy. `bun update -r <name>` re-resolves them all
+ *   (`-r`: a workspace's own declaration too) to
+ *   it.
+ * - `duplicate-pinned`: every range accepts one OLDER locked version, but a
+ *   dependent pins below the newest, so the resolver's newest-first choice
+ *   splits them and `bun update` cannot. An error for a single-copy package
+ *   (fix: a release of the pinning dependent, or a root `overrides` entry); a
+ *   warning for any other package.
+ * - `duplicate-hoisted` (error, zod): the Oxy packages agree on one version
+ *   but each holds its own nested copy, because the hoisted copy is a version
+ *   they reject (another workspace's or tool's). Fix: declare their version at
+ *   the root, or move the hoisted copy's users to it.
+ * - `duplicate-conflict` (error, single-copy packages): no one version
+ *   satisfies every range. No update or override is correct; the dependent
+ *   whose range is too narrow needs a release.
+ *
+ * Copies of an ordinary package forced by incompatible ranges (two majors of
+ * a utility) are normal and not reported.
+ */
+export function duplicateFindings(lock) {
+  const findings = [];
+  const overrides = lock.overrides ?? {};
+  for (const [name, all] of lockfileCopies(lock)) {
+    if (all.length < 2) continue;
+    const shared = SHARED_WITH_OXY_PACKAGES.includes(name);
+    const single = mustBeSingle(name) || shared;
+    // A bundled copy ships inside its dependent's tarball: no resolver can
+    // collapse it, so it counts only where a second copy is never acceptable.
+    const copies = all.filter(
+      (copy) => (single || !copy.bundled) && (!shared || copy.pulledBy.some((edge) => edge.oxy)),
+    );
+    if (copies.length < 2) continue;
+    const edges = copies.flatMap(pullers);
+    const ranges = edges.map((edge) => edge.range);
+    if (overrides[name]) ranges.push(overrides[name]);
+    const checkable = ranges.map(semverRange).filter((range) => range !== null);
+    const acceptsAll = (version) => checkable.every((range) => semver.satisfies(version, range));
+    const versions = [...new Set(copies.map((copy) => copy.version))]
+      .filter((version) => semver.valid(version) !== null)
+      .sort(semver.rcompare);
+    const newest = versions[0];
+    const bundled = copies.some((copy) => copy.bundled);
+    const common = bundled ? undefined : versions.find(acceptsAll);
+    const base = {
+      package: name,
+      installed: [...new Set(copies.map((copy) => copy.version))],
+      copies: copies.map((copy) => ({
+        key: copy.key,
+        version: copy.version,
+        pulledBy: pullers(copy).map(({ by, range }) => ({ by, range })),
+      })),
+    };
+    const listing = describeCopies(copies);
+    const rejecting = (version) =>
+      edges.filter((edge) => {
+        const range = semverRange(edge.range);
+        return range !== null && !semver.satisfies(version, range);
+      });
+    const remedyFor = (version) => {
+      const blockers = rejecting(version);
+      const releases = [
+        ...new Set(blockers.filter((edge) => !edge.workspace).map((edge) => edge.by)),
+      ];
+      const manifests = [
+        ...new Set(blockers.filter((edge) => edge.workspace).map((edge) => edge.by)),
+      ];
+      const bundlers = copies
+        .filter((copy) => copy.bundled)
+        .map((copy) => {
+          const owner = lockCopy(lock, keyNames(copy.key).slice(0, -1).join('/'));
+          return owner ? `${owner.name}@${owner.version}` : copy.key;
+        });
+      const plural = (list, word) => `${word}${list.length === 1 ? 's' : ''}`;
+      return {
+        blockers: blockers.map(({ by, range }) => ({ by, range })),
+        text:
+          [
+            bundlers.length > 0 &&
+              `${bundlers.join(', ')} ${plural(bundlers, 'bundle')} a private copy and ${plural(bundlers, 'need')} a release that does not`,
+            releases.length > 0 &&
+              `${releases.join(', ')} ${plural(releases, 'need')} a release whose range accepts ${version}`,
+            manifests.length > 0 &&
+              `widen the range in ${manifests.join(', ')} to accept ${version}`,
+          ]
+            .filter(Boolean)
+            .join('; ') || 'the ranges that pull these copies must be made compatible',
+      };
+    };
+    // The hoisted copy can be left out of `copies` only for a shared package:
+    // the Oxy packages' copies are then all nested, one per dependent, because
+    // the hoisted slot holds a version their ranges reject. No update moves it.
+    const hoisted = all.find((copy) => copy.key === name);
+    const hoistedRejects =
+      hoisted !== undefined &&
+      !copies.includes(hoisted) &&
+      common !== undefined &&
+      pullers(hoisted).some((edge) => {
+        const range = semverRange(edge.range);
+        return range !== null && !semver.satisfies(common, range);
+      });
+    if (hoistedRejects) {
+      const holders = pullers(hoisted).filter((edge) => {
+        const range = semverRange(edge.range);
+        return range !== null && !semver.satisfies(common, range);
+      });
+      findings.push({
+        severity: 'error',
+        code: 'duplicate-hoisted',
+        ...base,
+        target: common,
+        hoisted: {
+          version: hoisted.version,
+          pulledBy: holders.map(({ by, range }) => ({ by, range })),
+        },
+        message: `${name}: the Oxy packages hold ${copies.length} separate copies (${listing}) because the hoisted ${name} is ${hoisted.version}, pulled by ${describeEdges(holders)}, which rejects ${common}. \`bun update\` cannot move it: declare \`"${name}": "^${common}"\` in the root package.json so they share one hoisted copy (the ${hoisted.version} users then get their own nested one), or move ${describeEdges(holders)} to ${common}`,
+      });
+    } else if (common !== undefined && common === newest) {
+      findings.push({
+        severity: 'error',
+        code: 'duplicate-copy',
+        ...base,
+        target: common,
+        message: `${name}: ${copies.length} copies in bun.lock where one would do: ${listing}. Every range accepts ${common}: run \`bun update -r ${name}\` and commit bun.lock`,
+      });
+    } else if (common !== undefined) {
+      if (!single && newest === undefined) continue;
+      const remedy = remedyFor(newest);
+      findings.push({
+        severity: single ? 'error' : 'warning',
+        code: 'duplicate-pinned',
+        ...base,
+        target: common,
+        newest,
+        blockers: remedy.blockers,
+        message: `${name}: ${copies.length} copies in bun.lock: ${listing}. Every range accepts ${common}, but Bun resolves the wider ranges to ${newest}, so \`bun update\` keeps both: ${remedy.text}, or pin it with \`"overrides": { "${name}": "${common}" }\` in the root package.json`,
+      });
+    } else if (single) {
+      const target =
+        [...versions].sort((left, right) => rejecting(left).length - rejecting(right).length)[0] ??
+        newest;
+      const remedy = remedyFor(target);
+      findings.push({
+        severity: 'error',
+        code: 'duplicate-conflict',
+        ...base,
+        target,
+        blockers: remedy.blockers,
+        message: `${name} must be a single copy, but bun.lock has ${copies.length} and no one version satisfies every range: ${listing}. A real conflict that \`bun update\` cannot fix: ${remedy.text}`,
+      });
+    }
+  }
+  return findings.sort((left, right) => left.package.localeCompare(right.package));
+}
+
+/**
+ * Every installed copy of a single-copy package under the repository's
+ * node_modules trees (hoisted or Bun's isolated `.bun` store), by real path, so
+ * a symlink is one copy and a stale nested directory the lockfile no longer
+ * names is another.
+ *
+ * @param {string} root
+ * @param {string[]} workspaceDirs
+ * @returns {Map<string, Array<{ path: string, version: string }>> | null} null when nothing is installed
+ */
+export function installedCopies(root, workspaceDirs = []) {
+  const pending = [root, ...workspaceDirs]
+    .map((directory) => join(directory, 'node_modules'))
+    .filter((directory) => existsSync(directory));
+  if (pending.length === 0) return null;
+  const seen = new Set();
+  const found = new Map();
+  const real = (path) => {
+    try {
+      return realpathSync(path);
+    } catch {
+      return null;
+    }
+  };
+  const list = (directory) => {
+    try {
+      return readdirSync(directory);
+    } catch {
+      return [];
+    }
+  };
+  const visitPackage = (directory) => {
+    const resolved = real(directory);
+    if (!resolved || seen.has(resolved)) return;
+    seen.add(resolved);
+    const manifestPath = join(resolved, 'package.json');
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        if (typeof manifest.name === 'string' && mustBeSingle(manifest.name)) {
+          const rows = found.get(manifest.name) ?? [];
+          rows.push({ path: relative(root, resolved) || '.', version: String(manifest.version) });
+          found.set(manifest.name, rows);
+        }
+      } catch {
+        // A package.json that does not parse is not a package this check can name.
+      }
+    }
+    const nested = join(resolved, 'node_modules');
+    if (existsSync(nested)) pending.push(nested);
+  };
+  while (pending.length > 0) {
+    const modules = pending.pop();
+    const resolved = real(modules);
+    if (!resolved || seen.has(`modules:${resolved}`)) continue;
+    seen.add(`modules:${resolved}`);
+    for (const entry of list(resolved)) {
+      if (entry === '.bin' || entry === '.cache') continue;
+      if (entry === '.bun') {
+        for (const store of list(join(resolved, entry))) {
+          const storeModules = join(resolved, entry, store, 'node_modules');
+          if (existsSync(storeModules)) pending.push(storeModules);
+        }
+        continue;
+      }
+      if (entry.startsWith('.')) continue;
+      if (entry.startsWith('@')) {
+        for (const scoped of list(join(resolved, entry)))
+          visitPackage(join(resolved, entry, scoped));
+      } else visitPackage(join(resolved, entry));
+    }
+  }
+  return found;
+}
+
+/** `installed-duplicate` errors for single-copy packages installed more than once. */
+export function installedDuplicateFindings(root, workspaceDirs, alreadyReported = new Set()) {
+  const copies = installedCopies(root, workspaceDirs);
+  if (copies === null) return { checked: false, findings: [] };
+  const findings = [];
+  for (const [name, rows] of [...copies].sort(([left], [right]) => left.localeCompare(right))) {
+    if (rows.length < 2 || alreadyReported.has(name)) continue;
+    rows.sort((left, right) => left.path.localeCompare(right.path));
+    findings.push({
+      severity: 'error',
+      code: 'installed-duplicate',
+      package: name,
+      installed: [...new Set(rows.map((row) => row.version))],
+      paths: rows,
+      message: `${name} is installed ${rows.length} times: ${rows.map((row) => `${row.path} (${row.version})`).join(', ')}. bun.lock names one copy, so the install is stale: run \`bun install --frozen-lockfile\` (after a hoisted-linker churn, \`rm -rf node_modules packages/*/node_modules\` first)`,
+    });
+  }
+  return { checked: true, findings };
+}

package/src/i18n.mjs

@@ -110,14 +110,25 @@ const isLeaf = (value) =>
 const PLURAL_FORM = /_(?:zero|one|two|few|many|other)$/;
 const PLURAL_CATEGORIES = ['zero', 'one', 'two', 'few', 'many', 'other'];
 
-/** Whether `node` holds another plural form of the same base as `segment`. */
+const isPluralCategory = (segment) => PLURAL_CATEGORIES.includes(segment);
+
+/** An i18n-js plural object, `{ one, other }`: every key a CLDR category, `other` among them. */
+const isPluralObject = (node) =>
+  'other' in node && Object.keys(node).every((segment) => isPluralCategory(segment));
+
+/**
+ * Whether `node` holds another plural form of the same base as `segment`:
+ * i18next's suffixed siblings (`count_one` / `count_many`) or i18n-js's nested
+ * plural object (`count.one` / `count.many`).
+ */
 function hasPluralSibling(node, segment) {
+  if (isPluralCategory(segment)) return isPluralObject(node);
   if (!PLURAL_FORM.test(segment)) return false;
   const base = segment.replace(PLURAL_FORM, '');
   return PLURAL_CATEGORIES.some((category) => `${base}_${category}` in node);
 }
 
-const SINGULAR_PLURAL = /_(?:zero|one|two)$/;
+const SINGULAR_PLURAL = /[._](?:zero|one|two)$/;
 
 /**
  * The placeholders a string interpolates. A singular plural form may spell its
@@ -198,7 +209,7 @@ export function checkCatalogs({ locales }, sourceLocale = DEFAULT_SOURCE_LOCALE)
       for (const [segment, value] of Object.entries(node)) {
         const key = path ? `${path}.${segment}` : segment;
         if (!(segment in sourceNode)) {
-          // Another CLDR plural form of a source key: `_few` / `_many` exist in
+          // Another CLDR plural form of a source key: `few` / `many` exist in
           // languages English has no form for.
           if (hasPluralSibling(sourceNode, segment)) continue;
           errors.push({