@vzn/vx-lockfile 0.0.635 → 0.0.637

package/README.md

@@ -2,9 +2,9 @@
 
 Website: <https://vznjs.github.io/vx/> · this plugin: <https://vznjs.github.io/vx/plugins/vx-lockfile/> · source: <https://github.com/vznjs/vx>
 
-Lockfile plugins for [`@vzn/vx`](https://vznjs.github.io/vx/): `pnpm()`, `bun()`, `npm()` and `yarn()`. Each keys every task on its **own project's resolved dependency closure** from the package manager's lockfile, not on the whole file. `pnpm update foo` (or `bun add`, `npm install`, `yarn up`) re-keys exactly the projects that reach `foo` — through their dependencies, transitively, and through workspace links — and `vx run … --affected` selects the same projects. Zero dependencies: Bun's own YAML and JSONC parsers, and a classic-yarn reader.
+Lockfile plugins for [`@vzn/vx`](https://vznjs.github.io/vx/): `pnpm()`, `bun()`, `npm()` and `yarn()`. Each keys every task on its **own project's resolved dependency closure** from the package manager's lockfile, not on the whole file. `pnpm update foo` (or `bun add`, `npm install`, `yarn up`) re-keys exactly the projects that reach `foo` — through their dependencies, transitively, and through workspace links — and `vx run … --affected` selects the same projects. Each also gives vx the **projects, names and edges the lockfile records** (`discover`), adds each package's `package.json` to its cached tasks' inputs, and folds the manager's install settings into every task. Zero dependencies: Bun's own YAML and JSONC parsers, and a classic-yarn reader.
 
-Without a plugin, core folds the whole lockfile into the workspace fingerprint that every cache key sees, so one install invalidates every task in the workspace.
+Core keys no package file: without a plugin no lockfile, install setting or `package.json` reaches any cache key, so an install re-keys nothing and a build made against the old `node_modules` replays. A JS workspace declares one.
 
 ## Usage
 
@@ -13,7 +13,7 @@ npm install -D @vzn/vx @vzn/vx-lockfile   # or: pnpm add -D -w · yarn add -D (-
 ```
 
 ```ts
-// vx.workspace.ts
+// .vx/workspace.ts
 import { defineWorkspace } from '@vzn/vx/config'
 import { pnpm } from '@vzn/vx-lockfile' // or bun, npm, yarn
 
@@ -22,56 +22,61 @@ export default defineWorkspace({
 })
 ```
 
-That is the whole setup. The plugin **claims** its lockfile (`VxPlugin.fingerprint`), so core leaves it out of the workspace fingerprint, and its `key` hook folds one digest per project. `vx why <task>` names the material as `plugin @vzn/vx-lockfile/pnpm` (or `/bun`, `/npm`, `/yarn`).
+That is the whole setup. The plugin **claims** its lockfile and its manager's install settings (`VxPlugin.fingerprint`), and its `key` hook folds one digest per project plus each settings file present. `vx why <task>` names the material as `plugin @vzn/vx-lockfile/pnpm` (or `/bun`, `/npm`, `/yarn`) and `plugin @vzn/vx-lockfile/.npmrc` (or the settings file that moved).
 
-| Option  | Values                               | Meaning                                                                                                                                                                                        |
-| ------- | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `scope` | `'project'` (default), `'workspace'` | `project`: each task folds its own project's closure. `workspace`: the whole file, as core folds it — the coarse key through the plugin, for a workspace not yet ready to trust the precision. |
+| Option  | Values                               | Meaning                                                                                                                                                                   |
+| ------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `scope` | `'project'` (default), `'workspace'` | `project`: each task folds its own project's closure. `workspace`: the whole file into every task — the coarse key, for a workspace not yet ready to trust the precision. |
 
 ## What a project's digest covers
 
 Every package the project can reach, by resolved identity (name, version, integrity), and under bun and npm by the name it installs under, not where it sits, so a re-hoist of one version re-keys nothing, plus the install-wide material every project folds — and **the root package's own closure**. The root's `dependencies` and `devDependencies` reach every task: their bins run from the root `node_modules/.bin`, which vx puts on every task's PATH, and Node's resolution walks up to the root `node_modules` (`@types/*`, a plugin a root tool's config names). So a root devDependency bump (`pnpm add -Dw oxlint@next`) re-keys every project and `--affected` selects every project; a package only project A reaches still moves only A. A root `workspace:` dependency folds that package's closure into every project too. Per manager:
 
 - **pnpm** (`pnpm-lock.yaml`, lockfile v5, v6, v9): importers → snapshots, transitively; each package by name, version **and resolved peers** (`foo@1(react@18)` is not `foo@1(react@19)`), resolution and any `patchedDependencies` entry; `link:` folds the linked importer's reach, and a `file:` directory dependency folds its own closure (v9 keys it `name@file:…`, v5/v6 by the bare `file:…`); every other top-level field but `overrides` and the catalogs, whose effect is the snapshot an importer reaches (`settings`, `packageExtensionsChecksum`, `pnpmfileChecksum`, `ignoredOptionalDependencies`, v6's `onlyBuiltDependencies`, and any field pnpm adds later) and the lockfile version into every project. A multi-document lockfile (pnpm 10.x and 11 write the env lockfile — `configDependencies`, the package manager's own install — ahead of the project's) reads its last document as the lockfile and folds the ones before it into every project.
-- **bun** (`bun.lock`): Bun's hoisted layout — a dependency `d` of the package at path `p` is `p/d` when that key exists, else the nearest ancestor's, else the root's, so a nested version counts for the package it is nested under and no other; `workspace:` entries fold the linked package's reach; each `patchedDependencies` entry and the CONTENT of its patch file (bun.lock records only its path) with the package it patches, so a patch edit re-keys only the projects reaching it; every top-level field but `workspaces`, `packages`, the catalogs, `overrides` and `patchedDependencies` (`trustedDependencies`, and any field Bun adds later), and any patch naming no entry, into every project — a catalog bump reaches only the projects whose `catalog:` dependency resolves anew, through the `packages` entry it installs.
-- **npm** (`package-lock.json`, lockfileVersion 2 and 3): the `packages` map — `p/node_modules/d`, then each ancestor directory's (a workspace nested in another's directory resolves through the outer one's `node_modules`, as Node does), then `node_modules/d`; a `link: true` entry folds its target workspace's reach; root `overrides` reach a project through the entries they force (npm 10 does not write them to the lockfile). Version 1 (npm 6) has no `packages` map and is refused.
-- **yarn** (`yarn.lock`): berry (yarn 2+) resolves `name@npm:range` descriptors to entries, workspaces included, each entry folding every field but its dependency lists (so the root workspace's `dependenciesMeta` reaches every project), `__metadata`'s `version` and `cacheKey` into every project. A Yarn 4 catalog dependency (`catalog:`, `catalog:<name>`) is recorded as that literal and its range lives in `.yarnrc.yml`, so it reaches every entry of its package: a bump of any of them re-keys the workspace. So does a descriptor the file does not key: a root `resolutions` override (to a `patch:`, or another range) leaves the original descriptor out of `yarn.lock`, and the entry installed in its place is reached through the package's name, so a patch edit re-keys the workspaces that depend on it. A path range (`portal:`, `file:`, `link:`) reaches the entry keyed bound to the package naming it (`::locator=…`), not another workspace's of the same name. Yarn's builtin compat patches (`resolve`, `typescript`, `fsevents`) are reached too: the workspace asks for the plain descriptor, and the patched entry is the one Yarn installs. `.yarnrc.yml` itself is in core's workspace fingerprint, so a catalog edit re-keys every project, as a `pnpm-workspace.yaml` edit does. Classic (yarn 1) records no workspaces, so it yields one digest for the root that every project folds — coarse, and honest about what the file records.
+- **bun** (`bun.lock`; a `bun.lockb` alone is refused — it is binary — naming `bun install --save-text-lockfile`, which writes `bun.lock`): Bun's hoisted layout — a dependency `d` of the package at path `p` is `p/d` when that key exists, else the nearest ancestor's, else the root's, so a nested version counts for the package it is nested under and no other; `workspace:` entries fold the linked package's reach; each `patchedDependencies` entry and the CONTENT of its patch file (bun.lock records only its path) with the package it patches, so a patch edit re-keys only the projects reaching it; every top-level field but `workspaces`, `packages`, the catalogs, `overrides` and `patchedDependencies` (`trustedDependencies`, and any field Bun adds later), and any patch naming no entry, into every project — a catalog bump reaches only the projects whose `catalog:` dependency resolves anew, through the `packages` entry it installs.
+- **npm** (`npm-shrinkwrap.json` when present, as npm reads it, else `package-lock.json`; lockfileVersion 2 and 3): the `packages` map — `p/node_modules/d`, then each ancestor directory's (a workspace nested in another's directory resolves through the outer one's `node_modules`, as Node does), then `node_modules/d`; a `link: true` entry folds its target workspace's reach; root `overrides` reach a project through the entries they force (npm 10 does not write them to the lockfile). Version 1 (npm 6) has no `packages` map and is refused.
+- **yarn** (`yarn.lock`): berry (yarn 2+) resolves `name@npm:range` descriptors to entries, workspaces included, each entry folding every field but its dependency lists (so the root workspace's `dependenciesMeta` reaches every project), `__metadata`'s `version` and `cacheKey` into every project. A Yarn 4 catalog dependency (`catalog:`, `catalog:<name>`) is recorded as that literal and its range lives in `.yarnrc.yml`, so it reaches every entry of its package: a bump of any of them re-keys the workspace. So does a descriptor the file does not key: a root `resolutions` override (to a `patch:`, or another range) leaves the original descriptor out of `yarn.lock`, and the entry installed in its place is reached through the package's name, so a patch edit re-keys the workspaces that depend on it. A path range (`portal:`, `file:`, `link:`) reaches the entry keyed bound to the package naming it (`::locator=…`), not another workspace's of the same name. Yarn's builtin compat patches (`resolve`, `typescript`, `fsevents`) are reached too: the workspace asks for the plain descriptor, and the patched entry is the one Yarn installs. `yarn()` claims `.yarnrc.yml` and folds it into every task, so a catalog edit re-keys every project, as a `pnpm-workspace.yaml` edit does under `pnpm()`. Classic (yarn 1) records no workspaces, so it yields one digest for the root that every project folds — coarse, and honest about what the file records — and no project edges (below).
 
 A project the lockfile has no entry for folds the root's digest alone — the only `node_modules` it can resolve from. A phantom dependency (imported, never declared by the project or the root — a sibling's package hoisted to the root) is not in any closure; declare it.
 
 A lockfile the parser cannot read **refuses the run**, naming the file, the reason and the install that regenerates it. That is deliberate: the alternative to reading the lockfile is keying on nothing, and a key that is missing material is a stale hit waiting to happen. Under `--affected` the refusal also says which side could not be read — the working tree's copy, or the one at the base ref (a lockfile-migration commit hits the second). A lockfile holding git merge conflict markers is refused the same way: it names two installs at once, and yarn classic's format parsed one side of it without a word.
 
-## Cost
+## Install settings
 
-The claim, the per-project key, the memo and the `--affected` diff are core's `lockfileClaim`; this package is the parsers, and they are internal: it exports `pnpm`, `bun`, `npm`, `yarn` and `LockfileOptions`. A lockfile is parsed **once per content**: the digests are memoised under the cache dir (`lockfile-claims/<file>.json`) by the file's xxh3 and the claimant, so a warm run pays one read, one hash and one small JSON read — never a parse — and the read happens once per run, not per task. The digest is one hash per strongly connected component of the dependency graph (lockfiles carry cycles), children first, so a 1000-importer / 3000-package lockfile digests in ~20 ms when it does change.
+Files no lockfile records lay `node_modules` out anew under a byte-identical lockfile (pnpm's `node-linker`, bun's `linker = "isolated"`, a registry in `.npmrc`, Yarn 4's catalogs). Each plugin claims its manager's and folds each present file whole into every task; a change to one selects every project under `--affected`:
 
-## `--affected`
+| Plugin   | Settings                        |
+| -------- | ------------------------------- |
+| `pnpm()` | `pnpm-workspace.yaml`, `.npmrc` |
+| `bun()`  | `bunfig.toml`, `.npmrc`         |
+| `npm()`  | `.npmrc`                        |
+| `yarn()` | `.yarnrc.yml`                   |
 
-`vx run test --affected=origin/main` after a lockfile change used to select every project. With a plugin declared at `scope: 'project'`, core hands it the lockfile at the base ref and in the working tree; it digests both and names the projects whose digest moved. At `scope: 'workspace'` a change still selects every project. A lockfile that appeared or was deleted still selects everything — every project's `node_modules` is in question.
+A file has one claimant, so two of these plugins that share a settings file (`pnpm()` and `bun()` both claim `.npmrc`) cannot be declared together.
 
-## `vx prune`
+## `package.json` as an input
 
-Declaring any of the four plugins adds `vx prune` (the `commands` seam): the workspace cut to some projects and their transitive workspace dependencies, for a Docker build that installs and builds only what it ships — `turbo prune`.
+Every cached task of a project the lockfile lists gets its literal `package.json` appended to `cache.inputs.files` (the `project` stage), so an edit to a manifest re-keys that project's tasks and, through `^` keys, its dependants. A task with no `cache` block stays uncached; one whose inputs already name `package.json` is left alone. A task that rewrites its own `package.json` with the same bytes (tsdown) keeps its hits under `inputStability: { strategy: 'mutable' }`.
 
-```sh
-vx prune <project...> [--out-dir <dir>] [--docker] [--production]
-```
+## Project edges
 
-The out dir (default `out/`, relative to the cwd) gets the root `package.json` with `workspaces` rewritten to the subset's dirs (a glob character in a dir name bracketed, `a[1]` → `a[[]1]`, so the pattern matches that dir alone), `pnpm-workspace.yaml` with `packages` rewritten (every other key as written), each lockfile at the root **pruned** to what the subset installs, the install config (`.npmrc`, `.yarnrc.yml`, `.pnpmfile.cjs`, `bunfig.toml`, `.nvmrc`, `.node-version`, the patch files `patchedDependencies` names, Yarn's `yarnPath` and plugins), `vx.workspace.*`, the root `vx.config.*`, and each project directory less `node_modules`, `.git`, `.vx` and `.turbo`. A workspace package a copied vx config imports (a local plugin) comes along with its closure: the config loads before any task. A relative config import that leaves the subset is warned about. `--docker` writes `json/` — the root install files and each project's `package.json`, the cacheable install layer — and `full/`, everything:
+`discover` gives vx each project's edges as the lockfile records them, read from the same memo as the digests:
 
-```dockerfile
-COPY out/json/ .
-RUN bun install --frozen-lockfile
-COPY out/full/ .
-RUN bunx vx run app#build
-```
+- **deps** (order `^task`, reach `--filter …` and `--affected`): a dependency the lockfile resolves to a workspace package — pnpm `link:`, bun's `workspace:` entries (a `workspace:` path or alias, and an `npm:` alias Bun links to the workspace package, by the spec it records), npm's `link: true` entries, yarn berry's workspace entries and `link:` / `portal:` paths.
+- **peers**: a peer with no installed entry of the same name that resolves to a workspace package orders the build too, unless it would close a cycle through the order edges; then it is reach only (in project-name order, so the edge kept is stable). pnpm records an auto-installed peer under `dependencies`, so `pnpm()` asks the project's `package.json` which of those entries are peers; yarn berry resolves a peer to the workspace of its name, which Yarn hoists.
+- Each importer with a `package.json` is a project: one with no vx config joins as a project a plugin added (its tasks come from the `project` stage, else the default `build`). The root importer is the exception: it is a project only by its own vx config. An importer with no `package.json`, and an edge to one, is skipped. A project is named by its `package.json` `name` unless its config names it, or another importer's `package.json` shares the name; then its path names it.
+- A yarn classic (v1) lockfile records no workspaces: `yarn()` gives no edges and warns `yarn.lock: yarn classic (v1) records no workspaces, so yarn() gives vx no project edges — upgrade to Yarn 2+`.
 
-The pruned lockfile is the source with whole entries cut, in the package manager's own layout, so it installs with a frozen lockfile (`bun install --frozen-lockfile`, `pnpm install --frozen-lockfile`, `npm ci`, `yarn install --immutable`) and a line only another project reaches no longer busts the install layer. Kept: the root's and each kept workspace's entries and every package they reach — through Bun's and npm's hoisted walk (a package stays at the path it held; nothing is re-hoisted), pnpm's snapshots, Yarn's descriptors. Workspace-wide fields (catalogs, overrides, patches, settings, `trustedDependencies`) stay whole: the root manifest still names them. pnpm's env document stays whole. Yarn classic records no workspaces, so its walk starts at each kept manifest's dependencies.
+These edges are what was installed, so they differ from a guess over manifest ranges where the manager decided otherwise: pnpm installs a plain range (`^2.0.0`, `*`, `catalog:`) from the registry unless it is `workspace:`, yarn packs a `file:` directory as a copy, bun installs `dependencies` over a devDependency of the same key. They are the only package edges vx has: core reads none from a `package.json`, so a workspace whose tasks use `^build` declares one of these plugins (or another that returns `deps`), and without one vx refuses the `^` naming the fix. A dependency an install adds or removes reaches `--affected` as this lockfile's change.
 
-`--production` follows no `devDependencies` edge between workspace packages: a package only a dev dependency reaches is left out (`turbo prune --production`). Each kept manifest, the root's too, loses the `devDependencies` entries naming one, its field gone when it empties, and every lockfile drops the same entries: bun's and npm's workspace records, pnpm's importer (`{}` when it empties), Yarn berry's `workspace:` link in the workspace entry; Yarn classic walks the stripped manifests. A name another field also holds is installed in production and stays. Third-party dev dependencies stay in the lockfile: an install with `--production` / `--omit=dev` / `--prod` skips them. For the stage that runs a built app, not the one that builds it.
+## Cost
+
+The claim, the per-project key, the memo and the `--affected` diff are core's `lockfileClaim`; this package is the parsers, and they are internal: it exports `pnpm`, `bun`, `npm`, `yarn` and `LockfileOptions`. A lockfile is parsed **once per content**: the digests and each importer's edges are memoised under the cache dir (`lockfile-claims/<file>.json`) by the file's xxh3 and the claimant, so a warm run pays one read, one hash and one small JSON read — never a parse — and the read happens once per run, not per task. Under `scope: 'workspace'` the file is parsed for its edges alone, once per content, so an unreadable lockfile is refused there too. The settings files are read once per run. The digest is one hash per strongly connected component of the dependency graph (lockfiles carry cycles), children first, so a 1000-importer / 3000-package lockfile digests in ~20 ms when it does change.
 
-Refused, with the reason: an out dir that is or contains the root, one inside a copied project, one that already has content; a project name the workspace lacks (the root is always kept); `bun.lockb` without `bun.lock` (binary — `bun install --save-text-lockfile`). A `file:` or `link:` dependency outside every copied project is not copied. One plugin or four, there is one `prune`: it prunes every lockfile at the root.
+## `--affected`
+
+`vx run test --affected=origin/main` after a lockfile change used to select every project. With a plugin declared at `scope: 'project'`, core hands it the lockfile at the base ref and in the working tree; it digests both and names the projects whose digest moved. At `scope: 'workspace'` a change still selects every project. A lockfile that appeared or was deleted still selects everything — every project's `node_modules` is in question.
 
 ## Testing
 
-`bun test` covers each parser's digests (transitive bumps, nested versions, workspace links, peer suffixes, patches, install-wide knobs, cycles, key order, aliases, refusals) and `vx run` / `vx why` / `--affected` end to end. `vx prune` is pinned on lockfiles each package manager wrote (bun 1.4, pnpm 10, npm 10, yarn 1 and 4) and end to end: the pruned lockfile is installed frozen and offline by bun always, and by pnpm, npm and yarn 1 where they are on PATH (yarn 1's `--frozen-lockfile` passes a lockfile missing entries, so its check is an install that leaves the file byte-identical). vx's own repository declares `bun()`.
+`bun test` covers each parser's digests (transitive bumps, nested versions, workspace links, peer suffixes, patches, install-wide knobs, cycles, key order, aliases, refusals), `discover`'s edges per manager (`discover.test.ts`) and the edges core's manifest graph read over the same real installs, recorded when core stopped reading them (`discover-parity.test.ts`), the settings claims, and `vx run` / `vx why` / `--affected` end to end. vx's own repository declares `bun()`.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@vzn/vx-lockfile",
-  "version": "0.0.635",
+  "version": "0.0.637",
   "license": "MIT",
-  "description": "Lockfile plugins for vx — pnpm(), bun(), npm(), yarn(): each keys every task on its project's own resolved dependency closure from the package manager's lockfile, so a lockfile change re-keys only the projects it reaches; --affected follows the same answer; `vx prune` cuts the workspace and the lockfile to a Docker subset.",
+  "description": "Lockfile plugins for vx — pnpm(), bun(), npm(), yarn(): each keys every task on its project's own resolved dependency closure from the package manager's lockfile, so a lockfile change re-keys only the projects it reaches; --affected follows the same answer.",
   "keywords": [
     "vx",
     "vx-plugin",
@@ -11,9 +11,7 @@
     "pnpm",
     "bun",
     "npm",
-    "yarn",
-    "prune",
-    "docker"
+    "yarn"
   ],
   "type": "module",
   "main": "./src/index.ts",
@@ -37,7 +35,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@vzn/vx": "^0.0.635"
+    "@vzn/vx": "^0.0.637"
   },
   "repository": {
     "type": "git",

package/src/bun.ts

@@ -10,9 +10,9 @@
 //
 // Bun.JSONC is the parser: no dependency, and the file is Bun's own.
 
-import { reachDigests } from '@vzn/vx'
-import { depsOf, devOnly, dropDev, record, type Json } from './json.js'
-import type { PruneScope } from './scope.js'
+import { reachDigests, type LockfileImporter } from '@vzn/vx'
+import { depsOf, peerOnly, record, type Json } from './json.js'
+import { joinPosix } from './posix.js'
 
 export interface Lockfile {
   readonly version: string
@@ -20,6 +20,10 @@ export interface Lockfile {
   readonly workspaces: ReadonlyMap<string, ReadonlyMap<string, string>>
   /** workspace package name → its dir */
   readonly workspaceDirs: ReadonlyMap<string, string>
+  /** root-relative dir → its installed dependencies (`dependencies` win, as Bun 1.4 installs them) */
+  readonly workspaceInstalled: ReadonlyMap<string, ReadonlyMap<string, string>>
+  /** root-relative dir → the peers it installs no entry for */
+  readonly workspacePeers: ReadonlyMap<string, ReadonlySet<string>>
   /** node_modules path → the package there */
   readonly packages: ReadonlyMap<string, Entry>
   /** `patchedDependencies`: `name@version` (or `name`) → the patch file's path */
@@ -64,10 +68,17 @@ export function parseLockfile(text: string): Lockfile {
   }
   const workspaces = new Map<string, ReadonlyMap<string, string>>()
   const workspaceDirs = new Map<string, string>()
+  const workspaceInstalled = new Map<string, ReadonlyMap<string, string>>()
+  const workspacePeers = new Map<string, ReadonlySet<string>>()
   for (const [dir, manifest] of Object.entries(record(d['workspaces']) ?? {})) {
     const m = record(manifest) ?? {}
     const key = dir === '' ? '.' : dir
     workspaces.set(key, depsOf(m))
+    workspaceInstalled.set(
+      key,
+      depsOf(m, ['devDependencies', 'optionalDependencies', 'dependencies']),
+    )
+    workspacePeers.set(key, peerOnly(m))
     if (typeof m['name'] === 'string') workspaceDirs.set(m['name'], key)
   }
   const packages = new Map<string, Entry>()
@@ -97,6 +108,8 @@ export function parseLockfile(text: string): Lockfile {
     version: String(d['lockfileVersion']),
     workspaces,
     workspaceDirs,
+    workspaceInstalled,
+    workspacePeers,
     packages,
     patches,
     global,
@@ -134,6 +147,77 @@ function packageLevels(path: string): string[] {
   return out
 }
 
+/**
+ * Each workspace's dependencies that resolve to a `workspace:` package: an
+ * installed entry is a dep, a peer with none of the same name a peer. A
+ * `workspace:` path or alias (`workspace:../b`, `workspace:@s/b@^1`) names
+ * its target, which Bun links though `packages` holds no nested entry for
+ * it, and so does an `npm:` alias no entry installs under its own name (a
+ * satisfied one: Bun links the workspace package); anything else resolves
+ * through Bun's layout.
+ */
+export function importerLinks(lock: Lockfile): ReadonlyMap<string, LockfileImporter> {
+  const out = new Map<string, LockfileImporter>()
+  const viaLayout = (from: string, name: string): string | undefined => {
+    const key = resolve(lock, from, name)
+    const id = key === undefined ? '' : lock.packages.get(key)!.id
+    const at = id.indexOf('@workspace:')
+    return at === -1 ? undefined : id.slice(at + '@workspace:'.length) || '.'
+  }
+  for (const dir of lock.workspaces.keys()) {
+    const from = importerFrom(lock, dir)
+    const links = { deps: {} as Record<string, string>, peers: {} as Record<string, string> }
+    const add = (kind: 'deps' | 'peers', name: string, target: string | undefined): void => {
+      if (target !== undefined && target !== dir && lock.workspaces.has(target)) {
+        links[kind][name] = target
+      }
+    }
+    for (const [name, spec] of lock.workspaceInstalled.get(dir)!) {
+      add('deps', name, workspaceSpecTarget(lock, dir, from, name, spec) ?? viaLayout(from, name))
+    }
+    for (const name of lock.workspacePeers.get(dir)!) add('peers', name, viaLayout(from, name))
+    out.set(dir, links)
+  }
+  return out
+}
+
+const ALIAS = /^(@[^@/]+\/[^@/]+|[^@/.][^@/]*)(?:@.*)?$/
+
+/**
+ * The workspace dir a spec names past Bun's layout: `workspace:<path>`,
+ * `workspace:<name>@<range>`, or `npm:<name>@<range>` when the entry the
+ * dependency resolves to is not a `<name>` package.
+ */
+function workspaceSpecTarget(
+  lock: Lockfile,
+  dir: string,
+  from: string,
+  key: string,
+  spec: string,
+): string | undefined {
+  if (spec.startsWith('npm:')) {
+    const alias = ALIAS.exec(spec.slice('npm:'.length))?.[1]
+    const at = resolve(lock, from, key)
+    if (alias === undefined || lock.packages.get(at ?? '')?.id.startsWith(`${alias}@`)) {
+      return undefined
+    }
+    return lock.workspaceDirs.get(alias)
+  }
+  if (!spec.startsWith('workspace:')) return undefined
+  const rest = spec.slice('workspace:'.length)
+  if (rest.startsWith('/')) return undefined
+  if (rest.startsWith('.')) return joinPosix(dir, rest)
+  const alias = ALIAS.exec(rest)
+  return alias === null ? undefined : lock.workspaceDirs.get(alias[1]!)
+}
+
+/** The node_modules path a workspace resolves from: its own name, or the root's ''. */
+function importerFrom(lock: Lockfile, dir: string): string {
+  if (dir === '.') return ''
+  for (const [name, wsDir] of lock.workspaceDirs) if (wsDir === dir) return name
+  return ''
+}
+
 /**
  * The patch files `patchedDependencies` names. bun.lock records a patch by
  * PATH, never by a hash of its content, so an edited patch left the lockfile
@@ -205,8 +289,7 @@ export function importerDigests(
     // Its dir, as pnpm's importers fold theirs (item 1073).
     const own = node(`workspace\0${dir}`, `workspace\0${dir}`)
     importers.set(dir, own)
-    let from = ''
-    for (const [name, wsDir] of lock.workspaceDirs) if (wsDir === dir && dir !== '.') from = name
+    const from = importerFrom(lock, dir)
     for (const [name, spec] of deps) {
       const target = resolve(lock, from, name)
       if (target !== undefined) edges[own]!.push(index.get(target)!)
@@ -235,93 +318,6 @@ export function importerDigests(
   return out
 }
 
-/**
- * The lockfile cut to the workspaces at `dirs` (`.` the root) and the
- * packages they reach through Bun's hoisted walk, each where it sat: Bun
- * installs a nested key whose root counterpart is gone as written
- * (`--frozen-lockfile` passes), so nothing is re-hoisted. Every other
- * field as written — catalogs, overrides, patches and trusted
- * dependencies are the workspace's, and the root manifest still names them.
- */
-export function pruneLockfile(text: string, { dirs, dropped }: PruneScope): string {
-  const lock = parseLockfile(text)
-  const doc = Bun.JSONC.parse(text) as Json
-  const reached = new Set<string>()
-  const visit = (key: string | undefined): void => {
-    if (key === undefined || reached.has(key)) return
-    reached.add(key)
-    const entry = lock.packages.get(key)!
-    const at = entry.id.indexOf('@workspace:')
-    if (at !== -1) {
-      const dir = entry.id.slice(at + '@workspace:'.length) || '.'
-      if (!dirs.has(dir))
-        throw new Error(`bun.lock: ${key} is workspace ${dir}, which the subset leaves out`)
-      return
-    }
-    for (const name of entry.deps.keys()) visit(resolve(lock, key, name))
-  }
-  const workspaces = record(doc['workspaces']) ?? {}
-  const skip = new Map<string, Set<string>>()
-  for (const [dir, manifest] of Object.entries(workspaces)) {
-    const key = dir === '' ? '.' : dir
-    if (!dirs.has(key)) {
-      delete workspaces[dir]
-      continue
-    }
-    const names = devOnly(record(manifest), dropped)
-    skip.set(key, names)
-    dropDev(record(manifest), names)
-  }
-  for (const [dir, deps] of lock.workspaces) {
-    if (!dirs.has(dir)) continue
-    let from = ''
-    for (const [name, wsDir] of lock.workspaceDirs) if (wsDir === dir && dir !== '.') from = name
-    if (from !== '') visit(from)
-    const gone = skip.get(dir)
-    for (const name of deps.keys()) if (gone?.has(name) !== true) visit(resolve(lock, from, name))
-  }
-  const packages = record(doc['packages']) ?? {}
-  for (const key of Object.keys(packages)) if (!reached.has(key)) delete packages[key]
-  return writeLockfile(doc)
-}
-
-/**
- * Bun's own text layout, so a pruned file diffs against the source as
- * removals: two-space indent, a trailing comma after every member but the
- * document's last, each `packages` entry on one line with a blank line
- * between entries.
- */
-function writeLockfile(doc: Json): string {
-  const inline = (v: unknown): string => {
-    if (Array.isArray(v)) return `[${v.map(inline).join(', ')}]`
-    const r = record(v)
-    if (r === undefined) return JSON.stringify(v)
-    const members = Object.entries(r).map(([k, x]) => `${JSON.stringify(k)}: ${inline(x)}`)
-    return members.length === 0 ? '{}' : `{ ${members.join(', ')} }`
-  }
-  const block = (v: unknown, depth: number): string => {
-    const pad = '  '.repeat(depth + 1)
-    const end = '  '.repeat(depth)
-    if (Array.isArray(v)) {
-      return v.length === 0
-        ? '[]'
-        : `[\n${v.map((x) => `${pad}${block(x, depth + 1)},\n`).join('')}${end}]`
-    }
-    const r = record(v)
-    if (r === undefined) return JSON.stringify(v)
-    const members = Object.entries(r)
-    if (members.length === 0) return '{}'
-    return `{\n${members.map(([k, x]) => `${pad}${JSON.stringify(k)}: ${block(x, depth + 1)},\n`).join('')}${end}}`
-  }
-  const members = Object.entries(doc).map(([k, v]) => {
-    if (k !== 'packages') return `  ${JSON.stringify(k)}: ${block(v, 1)}`
-    const entries = Object.entries(record(v) ?? {})
-    if (entries.length === 0) return `  "packages": {}`
-    return `  "packages": {\n${entries.map(([p, t]) => `    ${JSON.stringify(p)}: ${inline(t)},\n`).join('\n')}  }`
-  })
-  return `{\n${members.join(',\n')}\n}\n`
-}
-
 /** The name a package key installs under: its last segment, scope included. */
 function installName(key: string): string {
   const parts = key.split('/')