bun-nested-workspace 0.0.0-stage → 0.2.0

package/dist/workspace-BlJ1qGiO.mjs

@@ -0,0 +1,825 @@
+import JSON5 from "json5";
+import path from "node:path";
+// ../lockfile/src/parse.ts
+function isObject(value) {
+	return typeof value === "object" && value !== null;
+}
+function isGitPackageEntry(entry) {
+	return isObject(entry[1]);
+}
+function packageEntryMeta(entry) {
+	if (isGitPackageEntry(entry)) return entry[1];
+	const maybeMeta = entry[2];
+	return isObject(maybeMeta) ? maybeMeta : void 0;
+}
+/**
+* Splits Bun's resolved package spec (`name@version`) using the last `@`, so
+* scoped package names such as `@scope/name@1.0.0` are handled correctly.
+*/
+function parseResolvedSpec(spec) {
+	const atIndex = spec.lastIndexOf("@");
+	if (atIndex <= 0 || atIndex >= spec.length - 1) return null;
+	const name = spec.slice(0, atIndex);
+	const version = spec.slice(atIndex + 1);
+	if (!name || !version) return null;
+	return {
+		name,
+		version
+	};
+}
+function parseBunLock(lockText) {
+	const parsed = JSON5.parse(lockText);
+	if (!isObject(parsed)) throw new Error("bun.lock must parse to an object");
+	const overrides = parsed.overrides;
+	if (overrides !== void 0) {
+		if (!isObject(overrides) || Array.isArray(overrides)) throw new Error("bun.lock overrides must be an object");
+		for (const [name, value] of Object.entries(overrides)) if (typeof value !== "string") throw new Error(`bun.lock override for ${JSON.stringify(name)} must be a string`);
+	}
+	return parsed;
+}
+// ../lockfile/src/overrides.ts
+/**
+* Read the exact bare-name override Bun stores for a dependency.
+*
+* Bun 1.3.14 ignores selector keys and omits unsupported nested/path forms,
+* so matching those here would diverge from the package manager.
+*/
+function dependencyOverrideRange(lock, dependencyName) {
+	const overrides = lock.overrides;
+	if (!overrides) return void 0;
+	if (!Object.hasOwn(overrides, dependencyName)) return void 0;
+	return overrides[dependencyName];
+}
+/**
+* Return the range Bun actually enforces for a dependency request.
+*
+* An override remains authoritative even when it is not valid semver;
+* compatibility then stays unknown instead of falling back to the declaration.
+*/
+function effectiveDependencyRange(lock, dependencyName, declaredRange) {
+	const overrideRange = dependencyOverrideRange(lock, dependencyName);
+	return overrideRange === void 0 ? declaredRange : overrideRange;
+}
+// ../lockfile/src/render.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function renderInlineValue(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => renderInlineValue(item)).join(", ")}]`;
+	if (isRecord$1(value)) {
+		const entries = Object.entries(value).filter(([, item]) => item !== void 0).map(([key, item]) => `${JSON.stringify(key)}: ${renderInlineValue(item)}`);
+		if (entries.length === 0) return "{}";
+		return `{ ${entries.join(", ")} }`;
+	}
+	const serialized = JSON.stringify(value);
+	return serialized === void 0 ? "null" : serialized;
+}
+function renderPackagesPropertyLines(key, value, indentLevel, trailingComma) {
+	const indent = " ".repeat(indentLevel);
+	const entryIndent = " ".repeat(indentLevel + 2);
+	const lines = [`${indent}${JSON.stringify(key)}: {`];
+	const packageEntries = Object.entries(value).filter(([, packageEntry]) => packageEntry !== void 0);
+	for (const [index, [lockKey, packageEntry]] of packageEntries.entries()) {
+		lines.push(`${entryIndent}${JSON.stringify(lockKey)}: ${renderInlineValue(packageEntry)},`);
+		if (index < packageEntries.length - 1) lines.push("");
+	}
+	lines.push(`${indent}}${trailingComma ? "," : ""}`);
+	return lines;
+}
+function renderObjectLines(value, indentLevel, allowPackagesFormatting) {
+	const indent = " ".repeat(indentLevel);
+	const propertyIndent = " ".repeat(indentLevel + 2);
+	const entries = Object.entries(value).filter(([, item]) => item !== void 0);
+	if (entries.length === 0) return [`${indent}{}`];
+	const lines = [`${indent}{`];
+	for (const [index, [key, item]] of entries.entries()) {
+		const trailingComma = index < entries.length - 1;
+		if (allowPackagesFormatting && key === "packages" && isRecord$1(item)) {
+			lines.push(...renderPackagesPropertyLines(key, item, indentLevel + 2, trailingComma));
+			continue;
+		}
+		if (isRecord$1(item)) {
+			const nestedLines = renderObjectLines(item, indentLevel + 2, false);
+			if (nestedLines.length === 1) {
+				const inlineObject = nestedLines[0]?.trimStart() ?? "{}";
+				lines.push(`${propertyIndent}${JSON.stringify(key)}: ${inlineObject},`);
+				continue;
+			}
+			lines.push(`${propertyIndent}${JSON.stringify(key)}: ${nestedLines[0]?.trimStart() ?? "{"}`);
+			lines.push(...nestedLines.slice(1, -1));
+			lines.push(`${nestedLines[nestedLines.length - 1]},`);
+			continue;
+		}
+		lines.push(`${propertyIndent}${JSON.stringify(key)}: ${renderInlineValue(item)},`);
+	}
+	lines.push(`${indent}}`);
+	return lines;
+}
+/** Render Bun package tuples inline while preserving lock key order. */
+function renderBunLock(lock) {
+	return `${renderObjectLines(lock, 0, true).join("\n")}\n`;
+}
+// ../lockfile/src/resolve.ts
+/**
+* Tell nested dependency keys apart from root scoped package keys.
+*
+* For an unscoped dependency, `@scope/name` can match the `/name` suffix even
+* though it is a root package key. A real nested key has another path segment,
+* such as `@scope/requester/name`.
+*/
+function isNestedDependencyLockKey(lockKey, dependencyName) {
+	if (!lockKey.endsWith(`/${dependencyName}`)) return false;
+	return dependencyName.startsWith("@") || !/^@[^/]+\/[^/]+$/.test(lockKey);
+}
+/**
+* Resolve a dependency the way Bun lock keys are structured:
+* nearest nested `requester/dependency` wins, then the closest
+* ancestor-provided nested entry, then root `dependency`.
+*
+* This is the canonical lock-key resolution shared by graph building, update
+* planning, and update safety checks; only the lock keys matter.
+*
+* @param requesterLockKey Package lock key or workspace name that owns the
+* dependency. Use `undefined` for context-free resolution, which accepts a
+* nested entry only when it is the unique candidate.
+* @param dependencyName Real npm package name being resolved.
+*/
+function resolveDependencyLockKey(requesterLockKey, dependencyName, packagesByLockKey) {
+	if (requesterLockKey) {
+		const names = splitLockKey(requesterLockKey);
+		for (let depth = names.length; depth > 0; depth--) {
+			const nestedKey = `${names.slice(0, depth).join("/")}/${dependencyName}`;
+			if (hasLockKey(packagesByLockKey, nestedKey)) return nestedKey;
+		}
+	}
+	if (hasLockKey(packagesByLockKey, dependencyName)) return dependencyName;
+	if (!requesterLockKey) {
+		let uniqueCandidate;
+		for (const key of getLockKeys(packagesByLockKey)) {
+			if (!isNestedDependencyLockKey(key, dependencyName)) continue;
+			if (uniqueCandidate) return;
+			uniqueCandidate = key;
+		}
+		return uniqueCandidate;
+	}
+}
+/** Split a lock key into the package names of its nesting chain, keeping scoped names whole. */
+function splitLockKey(lockKey) {
+	return lockKey.match(/(?:@[^/]+\/)?[^/]+/g) ?? [];
+}
+function hasLockKey(packagesByLockKey, lockKey) {
+	return packagesByLockKey instanceof Map ? packagesByLockKey.has(lockKey) : Object.hasOwn(packagesByLockKey, lockKey);
+}
+function getLockKeys(packagesByLockKey) {
+	return packagesByLockKey instanceof Map ? packagesByLockKey.keys() : Object.keys(packagesByLockKey);
+}
+// src/errors.ts
+/** Returns the message of a thrown value, which is not necessarily an `Error`. */
+function getErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+// src/paths.ts
+/** Returns whether a POSIX path relative to the host root lies inside the nested directory. */
+function isNestedPath(file, dir) {
+	return file === dir || file.startsWith(`${dir}/`);
+}
+// src/manifest.ts
+/** All root fields in sync order; the default for `NestedWorkspaceConfig.fields`. */
+const syncedFields = [
+	"catalog",
+	"catalogs",
+	"overrides",
+	"patchedDependencies",
+	"trustedDependencies"
+];
+/** Field of the host `package.json` that holds `NestedWorkspaceConfig`. */
+const configField = "bun-nested-workspace";
+/** Reads and validates the `bun-nested-workspace` config of the host `package.json`. */
+function readConfig(manifest) {
+	const config = manifest[configField];
+	if (typeof config !== "object" || config === null) throw new Error(`package.json has no "${configField}" field with the nested directory`);
+	if (typeof config.dir !== "string" || !config.dir) throw new Error(`"${configField}.dir" must be a non-empty string`);
+	const normalized = path.posix.normalize(config.dir);
+	const dir = normalized.replace(/\/+$/, "");
+	if (path.posix.isAbsolute(normalized) || !dir || dir === "." || dir === ".." || dir.startsWith("../")) throw new Error(`"${configField}.dir" must be a directory inside the host root, got "${config.dir}"`);
+	const fields = config.fields ?? syncedFields;
+	if (!Array.isArray(fields) || fields.some((field) => !syncedFields.includes(field))) throw new Error(`"${configField}.fields" must be an array of ${syncedFields.join(", ")}, got ${JSON.stringify(fields)}`);
+	return {
+		dir,
+		fields,
+		synced: config.synced ?? {}
+	};
+}
+/**
+* Returns the catalogs of a root `package.json`.
+*
+* Bun reads catalogs either from `workspaces` or from the top level, so a field defined in both places is rejected.
+*/
+function getCatalogs(manifest) {
+	const workspaces = Array.isArray(manifest.workspaces) ? void 0 : manifest.workspaces;
+	for (const field of ["catalog", "catalogs"]) if (manifest[field] && workspaces?.[field]) throw new Error(`package.json defines both "${field}" and "workspaces.${field}"`);
+	return {
+		catalog: manifest.catalog ?? workspaces?.catalog,
+		catalogs: manifest.catalogs ?? workspaces?.catalogs
+	};
+}
+/**
+* Returns a copy of the manifest with the catalog fields replaced.
+*
+* Each catalog field stays where the manifest keeps it.
+* A new field goes to the top level when the manifest keeps the other catalog field there, and to `workspaces` otherwise.
+*/
+function setCatalogs(manifest, catalogs) {
+	const result = { ...manifest };
+	const workspaces = Array.isArray(manifest.workspaces) ? { packages: manifest.workspaces } : { ...manifest.workspaces };
+	for (const [field, other] of [["catalog", "catalogs"], ["catalogs", "catalog"]]) {
+		const target = field in manifest || !(field in workspaces) && other in manifest ? result : workspaces;
+		if (catalogs[field] !== void 0 && Object.keys(catalogs[field]).length) target[field] = catalogs[field];
+		else delete target[field];
+	}
+	if (manifest.workspaces !== void 0 || Object.keys(workspaces).length) result.workspaces = Array.isArray(manifest.workspaces) && Object.keys(workspaces).length === 1 ? workspaces.packages : workspaces;
+	return result;
+}
+/**
+* Returns the host root `package.json` with the configured root fields of the nested `package.json` merged in.
+*
+* A nested entry replaces a host entry with the same name, while the other host entries stay.
+* Entries synced earlier and dropped by the nested repository are removed.
+* Throws when the host and the nested repository patch the same package version,
+* and when either side defines `resolutions` while `overrides` are synced.
+*/
+function syncManifest(host, nested) {
+	const config = readConfig(host);
+	const overridden = [];
+	const synced = { ...config.synced };
+	let manifest = { ...host };
+	const hostCatalogs = getCatalogs(host);
+	const nestedCatalogs = getCatalogs(nested);
+	const catalogs = { ...hostCatalogs };
+	if (config.fields.includes("catalog")) {
+		const merged = mergeEntries("catalog", hostCatalogs.catalog, nestedCatalogs.catalog, synced.catalog);
+		catalogs.catalog = merged.entries;
+		synced.catalog = merged.synced;
+		overridden.push(...merged.overridden);
+	}
+	if (config.fields.includes("catalogs")) {
+		const names = /* @__PURE__ */ new Set([
+			...Object.keys(hostCatalogs.catalogs ?? {}),
+			...Object.keys(nestedCatalogs.catalogs ?? {}),
+			...Object.keys(synced.catalogs ?? {})
+		]);
+		const entries = {};
+		const syncedCatalogs = {};
+		for (const name of [...names].sort()) {
+			const merged = mergeEntries(`catalogs.${name}`, hostCatalogs.catalogs?.[name], nestedCatalogs.catalogs?.[name], synced.catalogs?.[name]);
+			entries[name] = merged.entries;
+			syncedCatalogs[name] = merged.synced;
+			overridden.push(...merged.overridden);
+		}
+		catalogs.catalogs = omitEmpty(entries);
+		synced.catalogs = omitEmpty(syncedCatalogs);
+	}
+	manifest = setCatalogs(manifest, catalogs);
+	if (config.fields.includes("overrides")) {
+		for (const [source, resolutions] of [["The host package.json", host.resolutions], [`${config.dir}/package.json`, nested.resolutions]]) if (resolutions && Object.keys(resolutions).length) throw new Error(`${source} defines "resolutions", which Bun ignores once "overrides" is defined; move its entries to "overrides"`);
+		const merged = mergeEntries("overrides", host.overrides, nested.overrides, synced.overrides);
+		manifest.overrides = merged.entries;
+		synced.overrides = merged.synced;
+		overridden.push(...merged.overridden);
+	}
+	if (config.fields.includes("patchedDependencies")) manifest.patchedDependencies = mergePatches(host.patchedDependencies, nested.patchedDependencies, config.dir);
+	if (config.fields.includes("trustedDependencies")) {
+		const toEntries = (names = []) => Object.fromEntries(names.map((name) => [name, name]));
+		const merged = mergeEntries("trustedDependencies", toEntries(host.trustedDependencies), toEntries(nested.trustedDependencies), synced.trustedDependencies);
+		if (host.trustedDependencies !== void 0 || nested.trustedDependencies !== void 0) manifest.trustedDependencies = Object.keys(merged.entries);
+		synced.trustedDependencies = merged.synced;
+	}
+	for (const field of ["overrides", "patchedDependencies"]) {
+		const value = manifest[field];
+		if (config.fields.includes(field) && value !== void 0 && !Object.keys(value).length) delete manifest[field];
+	}
+	const { synced: _, ...rest } = host[configField];
+	const syncedEntries = omitEmpty(synced);
+	manifest[configField] = Object.keys(syncedEntries).length ? {
+		...rest,
+		synced: syncedEntries
+	} : rest;
+	return {
+		manifest,
+		overridden,
+		addedTrustedDependencies: host.trustedDependencies === void 0 && manifest.trustedDependencies !== void 0
+	};
+}
+/**
+* Merges name-keyed entries of one field.
+*
+* Host entries outside `synced` are the host's own.
+* An own entry equal to the nested one stays own, so it survives if the nested repository drops it later.
+*/
+function mergeEntries(field, host = {}, nested = {}, synced = []) {
+	const own = Object.fromEntries(Object.entries(host).filter(([name]) => !synced.includes(name)));
+	const overridden = Object.entries(nested).filter(([name, value]) => name in own && own[name] !== value).map(([name, nestedValue]) => ({
+		field,
+		name,
+		hostValue: own[name],
+		nestedValue
+	}));
+	return {
+		entries: sortKeys({
+			...own,
+			...nested
+		}),
+		synced: Object.keys(nested).filter((name) => own[name] !== nested[name]).sort(),
+		overridden
+	};
+}
+/** Merges host patches with the nested patches, rewriting nested patch paths through the nested directory. */
+function mergePatches(host = {}, nested = {}, dir) {
+	const own = Object.entries(host).filter(([, patch]) => !isNestedPath(path.posix.normalize(patch), dir));
+	const relocated = Object.entries(nested).map(([key, patch]) => [key, path.posix.join(dir, patch)]);
+	const conflicts = own.filter(([key]) => key in nested).map(([key]) => key);
+	if (conflicts.length) throw new Error(`Both the host and ${dir} patch ${conflicts.join(", ")}; keep a single patch for each package version`);
+	return sortKeys(Object.fromEntries([...own, ...relocated]));
+}
+function sortKeys(record) {
+	return Object.fromEntries(Object.entries(record).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+}
+/** Drops empty arrays and objects from a record. */
+function omitEmpty(record) {
+	return Object.fromEntries(Object.entries(record).filter(([, value]) => value !== void 0 && Object.keys(value).length));
+}
+/**
+* Returns the differences of the synced root fields and the synced entry lists between two manifests.
+*
+* Key order and the order of `trustedDependencies` are ignored.
+*/
+function diffManifests(expected, actual) {
+	const { fields } = readConfig(expected);
+	const pick = (manifest) => {
+		const catalogs = getCatalogs(manifest);
+		const values = {
+			catalog: catalogs.catalog,
+			catalogs: catalogs.catalogs,
+			overrides: manifest.overrides,
+			patchedDependencies: manifest.patchedDependencies,
+			trustedDependencies: manifest.trustedDependencies && [...manifest.trustedDependencies].sort()
+		};
+		return {
+			...Object.fromEntries(fields.map((field) => [field, values[field]])),
+			[`${configField}.synced`]: manifest[configField]?.synced
+		};
+	};
+	return diffValues("", pick(expected), pick(actual));
+}
+function diffValues(prefix, expected, actual) {
+	if (isRecord(expected) && isRecord(actual)) return [.../* @__PURE__ */ new Set([...Object.keys(expected), ...Object.keys(actual)])].sort().flatMap((key) => diffValues(prefix ? `${prefix}.${key}` : key, expected[key], actual[key]));
+	if (isRecord(expected) && actual === void 0) return diffValues(prefix, expected, {});
+	if (expected === void 0 && isRecord(actual)) return diffValues(prefix, {}, actual);
+	return JSON.stringify(expected) === JSON.stringify(actual) ? [] : [{
+		path: prefix,
+		expected,
+		actual
+	}];
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+// src/lockfile.ts
+/**
+* `bun.lock` format versions this package understands.
+*
+* The format is internal to Bun, so other versions are rejected instead of being rewritten blindly.
+*/
+const supportedLockfileVersions = [1, 2];
+/** Parses `bun.lock` text and rejects lockfile versions outside `supportedLockfileVersions`. */
+function parseLockfile(text, source = "bun.lock") {
+	let lock;
+	try {
+		lock = parseBunLock(text);
+	} catch (error) {
+		throw new Error(`${source}: ${getErrorMessage(error)}`, { cause: error });
+	}
+	if (!supportedLockfileVersions.includes(lock.lockfileVersion)) throw new Error(`${source} has lockfileVersion ${lock.lockfileVersion}, supported versions: ${supportedLockfileVersions.join(", ")}`);
+	return {
+		...lock,
+		workspaces: lock.workspaces ?? {},
+		packages: lock.packages ?? {}
+	};
+}
+/** Reads and parses a `bun.lock` file. */
+async function readLockfile(file) {
+	return parseLockfile(await Bun.file(file).text(), file);
+}
+/**
+* Returns the nested lockfile with workspace and local paths relative to the host root.
+*
+* The nested root workspace is dropped, because it is not a workspace of the host.
+*/
+function relocateLockfile(lock, dir) {
+	return {
+		...lock,
+		workspaces: Object.fromEntries(Object.entries(lock.workspaces).filter(([workspacePath]) => workspacePath).map(([workspacePath, workspace]) => [path.posix.join(dir, workspacePath), workspace])),
+		packages: Object.fromEntries(Object.entries(lock.packages).map(([key, [resolution, ...rest]]) => [key, [relocateResolution(resolution, dir), ...rest]]))
+	};
+}
+/** Rewrites a root-relative `workspace:`, `file:` or `link:` resolution through the nested directory. */
+function relocateResolution(resolution, dir) {
+	const match = /^((?:@[^/]+\/)?[^@]+)@(workspace|file|link):(.*)$/.exec(resolution);
+	if (!match) return resolution;
+	const [, name, protocol, target] = match;
+	if (path.posix.isAbsolute(target)) return resolution;
+	const relocated = path.posix.join(dir, target);
+	return `${name}@${protocol}:${target.startsWith("./") ? `./${relocated}` : relocated}`;
+}
+/**
+* Returns the lockfile with root fields that affect resolution taken from the root `package.json`.
+*
+* `bun install` re-resolves dependencies whose catalog entry, override, or patch differs from the lockfile,
+* so the merged lockfile must already record the synced root fields to keep the nested resolutions.
+*/
+function applyManifestToLockfile(lock, manifest) {
+	const { catalog, catalogs } = getCatalogs(manifest);
+	const fields = {
+		catalog,
+		catalogs,
+		overrides: manifest.overrides,
+		patchedDependencies: manifest.patchedDependencies
+	};
+	const result = { ...lock };
+	for (const [field, value] of Object.entries(fields)) if (value && Object.keys(value).length) Object.assign(result, { [field]: value });
+	else delete result[field];
+	return result;
+}
+/**
+* Merges the host lockfile with the relocated nested lockfile.
+*
+* Nested entries override host entries, so the nested packages keep the versions of the nested lockfile.
+* A root entry overridden by the nested lockfile might not satisfy a dependency of a host package:
+* such a dependency gets back its previous host resolution as a nested entry, so `bun install` keeps the host version
+* instead of resolving the range again.
+* A host workspace without a name cannot have nested entries, so `bun install` resolves its dependency again.
+* When the previous host resolution does not satisfy the range either, which Bun lockfiles occasionally contain,
+* the dependency gets the highest satisfying version recorded in either lockfile.
+* Catalog dependencies are checked against the catalogs of the host lockfile, so apply the synced root fields
+* to it first.
+*/
+function mergeLockfiles(lock, nestedLock, dir) {
+	const hostPackages = Object.entries(lock.packages).filter(([key]) => !(splitPackageKey(key)[0] in nestedLock.packages));
+	const packages = {
+		...Object.fromEntries(hostPackages),
+		...nestedLock.packages
+	};
+	const hostWorkspaces = Object.entries(lock.workspaces).filter(([workspacePath]) => !isNestedPath(workspacePath, dir));
+	const dependents = [...hostWorkspaces.map(([, workspace]) => ({
+		key: workspace.name,
+		dependencies: getWorkspaceDependencies(workspace)
+	})), ...Object.keys(packages).map((key) => ({
+		key,
+		dependencies: getPackageDependencies(packages[key])
+	}))];
+	for (let index = 0; index < dependents.length; index++) {
+		const { key, dependencies } = dependents[index];
+		if (key === void 0) continue;
+		for (const [dependency, specifier] of Object.entries(dependencies)) {
+			const requirement = getRequirement(lock, dependency, specifier);
+			const resolved = resolveDependencyLockKey(key, dependency, packages);
+			if (!requirement || !resolved || satisfies(packages[resolved], requirement)) continue;
+			const previous = resolveDependencyLockKey(key, dependency, lock.packages);
+			const replacement = previous && satisfies(lock.packages[previous], requirement) ? lock.packages[previous] : findSatisfyingEntry([packages, lock.packages], requirement);
+			if (!replacement) continue;
+			const nestedKey = `${key}/${dependency}`;
+			packages[nestedKey] = replacement;
+			dependents.push({
+				key: nestedKey,
+				dependencies: getPackageDependencies(replacement)
+			});
+		}
+	}
+	return {
+		...lock,
+		lockfileVersion: Math.max(lock.lockfileVersion, nestedLock.lockfileVersion),
+		workspaces: {
+			...Object.fromEntries(hostWorkspaces),
+			...nestedLock.workspaces
+		},
+		packages
+	};
+}
+/** Returns the installed dependencies declared by a lockfile workspace. */
+function getWorkspaceDependencies(workspace) {
+	return {
+		...workspace.dependencies,
+		...workspace.devDependencies,
+		...workspace.optionalDependencies
+	};
+}
+/** Returns the dependencies declared by a lockfile package entry. */
+function getPackageDependencies(entry) {
+	const metadata = packageEntryMeta(entry);
+	return {
+		...metadata?.dependencies,
+		...metadata?.optionalDependencies
+	};
+}
+/**
+* Returns the package and version range that a dependency specifier requires.
+*
+* An override replaces the specifier, as `bun install` applies it to direct and transitive dependencies alike.
+* Returns `undefined` for specifiers that do not resolve by version, such as `workspace:` or git URLs.
+*/
+function getRequirement(lock, dependency, specifier) {
+	return parseRequirement(lock, dependency, effectiveDependencyRange(lock, dependency, specifier));
+}
+/** Resolves `catalog:` specifiers and `npm:` aliases of `getRequirement`. */
+function parseRequirement(lock, dependency, specifier) {
+	if (specifier.startsWith("catalog:")) {
+		const catalogName = specifier.slice(8);
+		const range = (catalogName && catalogName !== "default" ? lock.catalogs?.[catalogName] : lock.catalog)?.[dependency];
+		return range === void 0 ? void 0 : parseRequirement(lock, dependency, range);
+	}
+	if (specifier.startsWith("npm:")) {
+		const target = specifier.slice(4);
+		const separator = target.lastIndexOf("@");
+		return separator > 0 ? {
+			name: target.slice(0, separator),
+			range: target.slice(separator + 1)
+		} : {
+			name: target,
+			range: "*"
+		};
+	}
+	return /^[a-z+]+:|\//i.test(specifier) ? void 0 : {
+		name: dependency,
+		range: specifier
+	};
+}
+/** Returns the entry with the highest version of the required package that satisfies its range. */
+function findSatisfyingEntry(sources, requirement) {
+	let best;
+	for (const entry of sources.flatMap((packages) => Object.values(packages))) if (satisfies(entry, requirement) && (!best || Bun.semver.order(getVersion(entry), getVersion(best)) > 0)) best = entry;
+	return best;
+}
+function getVersion([resolution]) {
+	return resolution.slice(resolution.lastIndexOf("@") + 1);
+}
+/** Returns whether an entry resolves the required package to a version in its range. */
+function satisfies(entry, requirement) {
+	const spec = parseResolvedSpec(entry[0]);
+	return spec?.name === requirement.name && Bun.semver.satisfies(spec.version, requirement.range);
+}
+/**
+* Returns whether a lockfile entry satisfies the specifier of a dependency on it.
+*
+* Specifiers that do not resolve by version, such as `workspace:` or git URLs, are always satisfied.
+*/
+function satisfiesSpecifier(lock, dependency, specifier, entry) {
+	const requirement = getRequirement(lock, dependency, specifier);
+	return requirement === void 0 || satisfies(entry, requirement);
+}
+/** Splits a lockfile package key into the package names of its nesting chain. */
+function splitPackageKey(key) {
+	return key.match(/(?:@[^/]+\/)?[^/]+/g) ?? [];
+}
+/**
+* Returns the key of the entry that resolves a direct dependency of a workspace package.
+*
+* Bun nests workspace-specific entries under the workspace name, so a workspace without a name resolves at the root only.
+*/
+function resolveWorkspaceDependencyKey(packages, workspaceName, dependency) {
+	if (workspaceName) return resolveDependencyLockKey(workspaceName, dependency, packages);
+	return Object.hasOwn(packages, dependency) ? dependency : void 0;
+}
+/** Returns the resolution of a direct dependency of a workspace package, such as `name@1.2.3`. */
+function resolveDependency(lock, workspaceName, dependency) {
+	const key = resolveWorkspaceDependencyKey(lock.packages, workspaceName, dependency);
+	return key === void 0 ? void 0 : lock.packages[key][0];
+}
+// src/check.ts
+/** Returns the nested workspace paths that the host `workspaces` patterns do not include. */
+function findUncoveredWorkspaces(manifest, nestedLock) {
+	const patterns = (Array.isArray(manifest.workspaces) ? manifest.workspaces : manifest.workspaces?.packages ?? []).map((pattern) => pattern.replace(/^(!?)\.\//, "$1").replace(/\/+$/, ""));
+	const included = patterns.filter((pattern) => !pattern.startsWith("!")).map((pattern) => new Bun.Glob(pattern));
+	const excluded = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => new Bun.Glob(pattern.slice(1)));
+	return Object.keys(nestedLock.workspaces).filter((workspacePath) => !included.some((glob) => glob.match(workspacePath)) || excluded.some((glob) => glob.match(workspacePath)));
+}
+/**
+* Returns the paths of nested workspaces whose host lockfile entries differ from the relocated nested lockfile,
+* including host entries of workspaces that the nested repository no longer has.
+*/
+function findWorkspaceMismatches(lock, nestedLock, dir) {
+	return [.../* @__PURE__ */ new Set([...Object.keys(nestedLock.workspaces), ...Object.keys(lock.workspaces).filter((workspacePath) => isNestedPath(workspacePath, dir))])].sort().filter((workspacePath) => toCanonicalJson(lock.workspaces[workspacePath]) !== toCanonicalJson(nestedLock.workspaces[workspacePath]));
+}
+/**
+* Returns the direct dependencies of nested workspaces that the host lockfile resolves differently than the nested one.
+*
+* Entries are compared like `findTransitiveMismatches` compares them, so a different integrity is a mismatch too.
+*/
+function findDirectDependencyMismatches(lock, nestedLock) {
+	return Object.entries(nestedLock.workspaces).flatMap(([workspacePath, workspace]) => Object.keys(getWorkspaceDependencies(workspace)).flatMap((dependency) => {
+		const expected = getWorkspaceDependencyEntry(nestedLock, workspace.name, dependency);
+		const actual = getWorkspaceDependencyEntry(lock, workspace.name, dependency);
+		if (expected === void 0 ? actual === void 0 : isSameResolution(expected, actual)) return [];
+		return [{
+			workspace: workspace.name ?? workspacePath,
+			dependency,
+			expected: expected?.[0],
+			actual: actual?.[0]
+		}];
+	}));
+}
+/**
+* Returns the transitive dependencies of nested workspaces that the host lockfile resolves differently than the nested one.
+*
+* Walks the dependency edges from the nested workspaces through both lockfiles at once,
+* so a different hoisting layout of the same versions is not a mismatch.
+* Direct dependencies are covered by `findDirectDependencyMismatches`, and peer dependencies are not walked.
+* Edges that the nested lockfile resolves outside their range are skipped, because the merge repairs them.
+* Each mismatch is reported once, with the first dependency chain that reaches it, and its subtree is skipped.
+*/
+function findTransitiveMismatches(lock, nestedLock) {
+	const queue = [];
+	for (const [workspacePath, workspace] of Object.entries(nestedLock.workspaces)) for (const dependency of Object.keys(getWorkspaceDependencies(workspace))) {
+		const nestedKey = resolveWorkspaceDependencyKey(nestedLock.packages, workspace.name, dependency);
+		const hostKey = resolveWorkspaceDependencyKey(lock.packages, workspace.name, dependency);
+		if (nestedKey && hostKey && isSameResolution(nestedLock.packages[nestedKey], lock.packages[hostKey])) queue.push({
+			path: [workspace.name ?? workspacePath, dependency],
+			nestedKey,
+			hostKey
+		});
+	}
+	const visited = /* @__PURE__ */ new Set();
+	const mismatches = [];
+	for (let index = 0; index < queue.length; index++) {
+		const { path, nestedKey, hostKey } = queue[index];
+		const entry = nestedLock.packages[nestedKey];
+		if (entry[0].includes("@workspace:")) continue;
+		for (const [dependency, specifier] of Object.entries(getPackageDependencies(entry))) {
+			const nestedDependencyKey = resolveDependencyLockKey(nestedKey, dependency, nestedLock.packages);
+			if (!nestedDependencyKey || !satisfiesSpecifier(nestedLock, dependency, specifier, nestedLock.packages[nestedDependencyKey])) continue;
+			const hostDependencyKey = resolveDependencyLockKey(hostKey, dependency, lock.packages);
+			const pair = `${nestedDependencyKey}\0${hostDependencyKey}`;
+			if (visited.has(pair)) continue;
+			visited.add(pair);
+			const expected = nestedLock.packages[nestedDependencyKey];
+			const actual = hostDependencyKey === void 0 ? void 0 : lock.packages[hostDependencyKey];
+			if (hostDependencyKey === void 0 || !isSameResolution(expected, actual)) {
+				mismatches.push({
+					path: [...path, dependency],
+					expected: expected[0],
+					actual: actual?.[0]
+				});
+				continue;
+			}
+			queue.push({
+				path: [...path, dependency],
+				nestedKey: nestedDependencyKey,
+				hostKey: hostDependencyKey
+			});
+		}
+	}
+	return mismatches;
+}
+/**
+* Returns the external direct dependencies of host workspaces whose resolution differs between two host lockfiles.
+*
+* A dependency that changed to the root resolution of the nested lockfile is not reported, because the nested versions win,
+* unless that resolution does not satisfy the host range.
+*/
+function findOwnDependencyChanges(before, after, nestedLock, dir) {
+	return [...new Map([...Object.entries(before.workspaces), ...Object.entries(after.workspaces)].filter(([workspacePath]) => !isNestedPath(workspacePath, dir)))].flatMap(([workspacePath, workspace]) => {
+		const specifiers = {
+			...getWorkspaceDependencies(before.workspaces[workspacePath] ?? {}),
+			...getWorkspaceDependencies(after.workspaces[workspacePath] ?? {})
+		};
+		return Object.entries(specifiers).flatMap(([dependency, specifier]) => {
+			if (specifier.startsWith("workspace:")) return [];
+			const expected = resolveDependency(before, workspace.name, dependency);
+			const actual = resolveDependency(after, workspace.name, dependency);
+			const nestedEntry = nestedLock.packages[dependency];
+			if (actual === expected || actual !== void 0 && actual === nestedEntry?.[0] && satisfiesSpecifier(after, dependency, specifier, nestedEntry)) return [];
+			return [{
+				workspace: workspace.name ?? workspacePath,
+				dependency,
+				expected,
+				actual
+			}];
+		});
+	});
+}
+/** Returns the entry that resolves a direct dependency of a workspace package. */
+function getWorkspaceDependencyEntry(lock, workspaceName, dependency) {
+	const key = resolveWorkspaceDependencyKey(lock.packages, workspaceName, dependency);
+	return key === void 0 ? void 0 : lock.packages[key];
+}
+/**
+* Returns whether two lockfile entries resolve to the same package.
+*
+* Compares the resolution, registry, and integrity, but not the metadata object,
+* because Bun versions differ in the metadata they record.
+*/
+function isSameResolution(expected, actual) {
+	const strings = (entry) => entry.filter((value) => typeof value === "string");
+	return actual !== void 0 && JSON.stringify(strings(expected)) === JSON.stringify(strings(actual));
+}
+function toCanonicalJson(value) {
+	return JSON.stringify(value, (_, nested) => typeof nested === "object" && nested !== null && !Array.isArray(nested) ? Object.fromEntries(Object.entries(nested).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : nested);
+}
+// src/workspace.ts
+/** Loads the root `package.json` and `bun.lock` files of the host and of the nested checkout. */
+async function loadNestedWorkspace(root) {
+	const manifestText = await Bun.file(path.join(root, "package.json")).text();
+	const manifest = JSON.parse(manifestText);
+	const config = readConfig(manifest);
+	const nestedRoot = path.join(root, config.dir);
+	return {
+		root,
+		config,
+		manifest,
+		manifestText,
+		nestedManifest: await Bun.file(path.join(nestedRoot, "package.json")).json(),
+		lock: await readLockfile(path.join(root, "bun.lock")),
+		nestedLock: relocateLockfile(await readLockfile(path.join(nestedRoot, "bun.lock")), config.dir)
+	};
+}
+/** Returns whether a check found no differences. */
+function isInSync(result) {
+	return Object.values(result).every((list) => !list.length);
+}
+/**
+* Throws when the host `workspaces` patterns miss nested workspaces.
+*
+* Bun would drop such workspaces from the merged lockfile, so neither mode can sync or check them.
+*/
+function assertWorkspacesCovered(workspace) {
+	const uncovered = findUncoveredWorkspaces(workspace.manifest, workspace.nestedLock);
+	if (uncovered.length) throw new Error(`The host "workspaces" field does not include nested workspaces: ${uncovered.join(", ")}`);
+}
+/** Compares the host files with the nested checkout without writing anything or running `bun install`. */
+function checkNestedWorkspace(workspace) {
+	assertWorkspacesCovered(workspace);
+	const { manifest } = syncManifest(workspace.manifest, workspace.nestedManifest);
+	return {
+		manifest: diffManifests(manifest, workspace.manifest),
+		workspaces: findWorkspaceMismatches(workspace.lock, workspace.nestedLock, workspace.config.dir),
+		directDependencies: findDirectDependencyMismatches(workspace.lock, workspace.nestedLock),
+		transitiveDependencies: findTransitiveMismatches(workspace.lock, workspace.nestedLock)
+	};
+}
+/** Error thrown when `bun install` exits with a non-zero code. */
+var BunInstallError = class extends Error {
+	exitCode;
+	constructor(exitCode) {
+		super(`bun install exited with code ${exitCode}`);
+		this.exitCode = exitCode;
+		this.name = "BunInstallError";
+	}
+};
+/**
+* Runs `bun install` in the host root with inherited stdio and throws `BunInstallError` on failure.
+*
+* Uses the Bun that runs this package, such as the one `bunx` started, rather than the first `bun` on `PATH`.
+*/
+async function runBunInstall(root, args = []) {
+	const exitCode = await Bun.spawn([
+		process.execPath,
+		"install",
+		...args
+	], {
+		cwd: root,
+		stdio: [
+			"inherit",
+			"inherit",
+			"inherit"
+		]
+	}).exited;
+	if (exitCode !== 0) throw new BunInstallError(exitCode);
+}
+/**
+* Syncs the host root `package.json` and `bun.lock` with the nested checkout.
+*
+* Writes the synced `package.json`, writes the merged `bun.lock`, runs `bun install`,
+* and then compares the result with the nested checkout and with the original host resolutions.
+*/
+async function syncNestedWorkspace(root, options = {}) {
+	const workspace = await loadNestedWorkspace(root);
+	assertWorkspacesCovered(workspace);
+	const manifestSync = syncManifest(workspace.manifest, workspace.nestedManifest);
+	const { manifest } = manifestSync;
+	const manifestText = formatJson(manifest, workspace.manifestText);
+	if (manifestText !== workspace.manifestText) await Bun.write(path.join(root, "package.json"), manifestText);
+	options.onManifestSync?.(manifestSync);
+	const merged = mergeLockfiles(applyManifestToLockfile(workspace.lock, manifest), workspace.nestedLock, workspace.config.dir);
+	await Bun.write(path.join(root, "bun.lock"), renderBunLock(merged));
+	await runBunInstall(root, options.installArgs);
+	const synced = await loadNestedWorkspace(root);
+	return {
+		ownDependencyChanges: findOwnDependencyChanges(workspace.lock, synced.lock, workspace.nestedLock, workspace.config.dir),
+		check: checkNestedWorkspace(synced)
+	};
+}
+/** Serializes JSON with the indentation and final newline of the original text. */
+function formatJson(value, original) {
+	const indent = /^[ \t]+(?=")/m.exec(original)?.[0] ?? "  ";
+	return `${JSON.stringify(value, null, indent)}${original.endsWith("\n") ? "\n" : ""}`;
+}
+export { syncManifest as _, syncNestedWorkspace as a, findTransitiveMismatches as c, applyManifestToLockfile as d, mergeLockfiles as f, diffManifests as g, supportedLockfileVersions as h, loadNestedWorkspace as i, findUncoveredWorkspaces as l, relocateLockfile as m, checkNestedWorkspace as n, findDirectDependencyMismatches as o, parseLockfile as p, isInSync as r, findOwnDependencyChanges as s, BunInstallError as t, findWorkspaceMismatches as u, syncedFields as v, getErrorMessage as y };