bun-nested-workspace 0.1.0 → 0.2.1

package/README.md

@@ -4,15 +4,16 @@ Embed a checkout of another Bun workspace repository into a subdirectory of your
 
 The nested repository stays a self-contained project with its own root `package.json` and `bun.lock`.
 Its packages, such as `nested/apps/*` and `nested/packages/*`, become workspaces of the host, while its root does not.
+The host installs none of the dependencies of the nested root `package.json` and cannot run its scripts.
 Bun reads catalogs, overrides, patches, and trusted dependencies from the workspace root only, and resolves the whole workspace from a single lockfile.
 This package carries those root fields over to the host and merges the nested lockfile into the host lockfile, so the nested packages build in the host with the same dependency versions as on their own.
 
 ## Install
 
-The CLI runs before the host dependencies are installed, so run it with `bunx` and pin the version:
+The CLI runs before the host dependencies are installed, so run it with `bunx`:
 
 ```sh
-bunx bun-nested-workspace@0.1.0
+bunx bun-nested-workspace
 ```
 
 It requires Bun 1.2.19 or later, the first version that resolves `catalog:` dependencies from both catalog locations.
@@ -43,7 +44,7 @@ The config takes these fields:
 Run the CLI in the host root after switching the nested checkout to another commit:
 
 ```sh
-bunx bun-nested-workspace@0.1.0
+bunx bun-nested-workspace
 ```
 
 The sync:
@@ -55,22 +56,33 @@ The sync:
 
 Commit `package.json` and `bun.lock` after the sync.
 
-In a Docker build, run the sync with `--lockfile-only` in a stage that contains only the dependency files, before installing dependencies:
+In a Docker build, run the sync with `--lockfile-only` in a stage that contains only the dependency files, before installing dependencies.
+`bun install` also needs the patch files and the install configuration, such as `bunfig.toml` and `.npmrc`, so keep them, along with any files they reference.
+A separate stage can strip the build context down to these files, so the Dockerfile does not list every workspace package:
 
 ```dockerfile
-COPY package.json bun.lock ./
-COPY nested/package.json nested/bun.lock nested/
-COPY nested/packages/core/package.json nested/packages/core/
-RUN bunx bun-nested-workspace@0.1.0 --lockfile-only
+FROM oven/bun:1 AS manifests
+WORKDIR /app
+COPY . .
+RUN find . -type f ! -name package.json ! -name bun.lock ! -name '*.patch' ! -name bunfig.toml ! -name .npmrc -delete
+
+FROM oven/bun:1 AS deps
+WORKDIR /app
+COPY --from=manifests /app ./
+RUN bunx bun-nested-workspace --lockfile-only
 ```
 
+Exclude `node_modules` and other large directories from the build context with `.dockerignore`.
+
 ### Root fields
 
 - `catalog` and `catalogs` each stay where the host defines them; a field the host lacks goes next to the other catalog field, or into `workspaces`.
   An array `workspaces` field becomes an object when a catalog needs it.
 - `overrides` and `trustedDependencies` are merged by package name.
+- `resolutions` on either side is an error while `overrides` are synced: Bun ignores `resolutions` once `overrides` is defined, so move its entries to `overrides`.
 - `trustedDependencies` stays in the host `package.json`, even empty, when either side defines it.
   An explicit list replaces the default trusted list of Bun, so when only one side defines the field, the packages of the other side lose the default list; list the ones whose lifecycle scripts they need.
+  The sync warns when it adds the field to the host.
 - `patchedDependencies` paths are rewritten through the nested directory, such as `nested/patches/exceljs@4.4.0.patch`.
 
 A nested entry replaces a host entry with the same name, while the other host entries stay.
@@ -99,7 +111,7 @@ Only `bun.lock` with `lockfileVersion` 1 or 2 is supported, because the lockfile
 ## Check
 
 ```sh
-bunx bun-nested-workspace@0.1.0 --check
+bunx bun-nested-workspace --check
 ```
 
 The check writes nothing, does not run `bun install`, and exits with code 1 when the host files lag behind the nested checkout.
@@ -145,5 +157,6 @@ if (!isInSync(check)) {
 ```
 
 `syncNestedWorkspace` writes the files and runs `bun install` before it checks the result, so a failed sync leaves the written files for inspection.
+Its `onManifestSync` option receives the replaced host entries and whether the sync added `trustedDependencies`, as soon as `package.json` is written and even when `bun install` then fails.
 
 Lower-level functions work on parsed files without touching the disk: `syncManifest`, `diffManifests`, `parseLockfile`, `relocateLockfile`, `applyManifestToLockfile`, `mergeLockfiles`, and the `find*` checks.

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { a as syncNestedWorkspace, i as loadNestedWorkspace, n as checkNestedWorkspace, r as isInSync, t as BunInstallError, y as getErrorMessage } from "./workspace-DJ2dh3q7.mjs";
+import { a as syncNestedWorkspace, i as loadNestedWorkspace, n as checkNestedWorkspace, r as isInSync, t as BunInstallError, y as getErrorMessage } from "./workspace-DOgB-vkj.mjs";
 // src/cli.ts
 const usage = `Usage:
   bun-nested-workspace [bun install options]  Sync package.json and bun.lock, then run bun install
@@ -43,8 +43,10 @@ async function runCheck(root) {
 	return 1;
 }
 async function runSync(root, installArgs) {
-	const { overridden, ownDependencyChanges, check } = await syncNestedWorkspace(root, { installArgs });
-	if (overridden.length) console.log(["Nested entries replaced host entries:", ...overridden.map(formatOverridden)].join("\n"));
+	const { ownDependencyChanges, check } = await syncNestedWorkspace(root, {
+		installArgs,
+		onManifestSync: printManifestSync
+	});
 	let exitCode = 0;
 	if (ownDependencyChanges.length) {
 		console.error([
@@ -61,6 +63,14 @@ async function runSync(root, installArgs) {
 	}
 	return exitCode;
 }
+function printManifestSync({ overridden, addedTrustedDependencies }) {
+	if (overridden.length) console.log(["Nested entries replaced host entries:", ...overridden.map(formatOverridden)].join("\n"));
+	if (addedTrustedDependencies) console.warn([
+		"The sync added trustedDependencies to the host package.json.",
+		"Bun no longer applies its default trusted list, so host dependencies that relied on it no longer run their lifecycle scripts.",
+		"Add the ones the host needs to trustedDependencies."
+	].join("\n"));
+}
 /** Formats the differences of a failed check as indented lines grouped by kind. */
 function formatCheckResult(result) {
 	const section = (title, lines) => lines.length ? [`  ${title}:`, ...lines.map((line) => `  ${line}`)] : [];

package/dist/index.d.mts

@@ -96,6 +96,7 @@ interface PackageManifest {
   catalog?: Catalog;
   catalogs?: Record<string, Catalog>;
   overrides?: Record<string, string>;
+  resolutions?: Record<string, string>;
   patchedDependencies?: Record<string, string>;
   trustedDependencies?: string[];
   [configField]?: NestedWorkspaceConfig;
@@ -120,13 +121,21 @@ interface OverriddenEntry {
 interface ManifestSync {
   manifest: PackageManifest;
   overridden: OverriddenEntry[];
+  /**
+   * Whether the sync added `trustedDependencies` to a host that did not define it.
+   *
+   * The explicit list replaces the default trusted list of Bun,
+   * so host dependencies that relied on the default list no longer run their lifecycle scripts.
+   */
+  addedTrustedDependencies: boolean;
 }
 /**
  * Returns the host root `package.json` with the configured root fields of the nested `package.json` merged in.
  *
  * A nested entry replaces a host entry with the same name, while the other host entries stay.
  * Entries synced earlier and dropped by the nested repository are removed.
- * Throws when the host and the nested repository patch the same package version.
+ * Throws when the host and the nested repository patch the same package version,
+ * and when either side defines `resolutions` while `overrides` are synced.
  */
 export declare function syncManifest(host: PackageManifest, nested: PackageManifest): ManifestSync;
 /** Difference between the expected and the actual value at a `package.json` path. */
@@ -271,10 +280,15 @@ export declare class BunInstallError extends Error {
 interface SyncOptions {
   /** Arguments passed to `bun install`, such as `--lockfile-only`. */
   installArgs?: readonly string[];
+  /**
+   * Called with the result of `syncManifest` once the host `package.json` is written, before `bun install` runs.
+   *
+   * It reports the changes of `package.json` even when `bun install` fails and the sync throws.
+   */
+  onManifestSync?: (sync: ManifestSync) => void;
 }
 /** Result of `syncNestedWorkspace`. */
 interface SyncResult {
-  overridden: OverriddenEntry[];
   /** Own dependencies of host workspaces that the sync re-resolved; the sync failed when this is not empty. */
   ownDependencyChanges: DependencyMismatch[];
   /** Check of the synced files; the sync failed when it is not in sync. */

package/dist/index.mjs

@@ -1 +1 @@
-export { t as BunInstallError, d as applyManifestToLockfile, n as checkNestedWorkspace, g as diffManifests, o as findDirectDependencyMismatches, s as findOwnDependencyChanges, c as findTransitiveMismatches, l as findUncoveredWorkspaces, u as findWorkspaceMismatches, r as isInSync, i as loadNestedWorkspace, f as mergeLockfiles, p as parseLockfile, m as relocateLockfile, h as supportedLockfileVersions, _ as syncManifest, a as syncNestedWorkspace, v as syncedFields } from "./workspace-DJ2dh3q7.mjs";
+export { t as BunInstallError, d as applyManifestToLockfile, n as checkNestedWorkspace, g as diffManifests, o as findDirectDependencyMismatches, s as findOwnDependencyChanges, c as findTransitiveMismatches, l as findUncoveredWorkspaces, u as findWorkspaceMismatches, r as isInSync, i as loadNestedWorkspace, f as mergeLockfiles, p as parseLockfile, m as relocateLockfile, h as supportedLockfileVersions, _ as syncManifest, a as syncNestedWorkspace, v as syncedFields } from "./workspace-DOgB-vkj.mjs";

package/dist/{workspace-DJ2dh3q7.mjs → workspace-DOgB-vkj.mjs}

@@ -27,13 +27,21 @@ function parseResolvedSpec(spec) {
 		version
 	};
 }
+/** Error thrown when `bun.lock` has a structure that the tools do not support. */
+var BunLockFormatError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "BunLockFormatError";
+	}
+};
+/** Parses `bun.lock` text and throws `BunLockFormatError` on unsupported structure. */
 function parseBunLock(lockText) {
 	const parsed = JSON5.parse(lockText);
-	if (!isObject(parsed)) throw new Error("bun.lock must parse to an object");
+	if (!isObject(parsed)) throw new BunLockFormatError("bun.lock must parse to an object");
 	const overrides = parsed.overrides;
 	if (overrides !== void 0) {
-		if (!isObject(overrides) || Array.isArray(overrides)) throw new Error("bun.lock overrides must be an object");
-		for (const [name, value] of Object.entries(overrides)) if (typeof value !== "string") throw new Error(`bun.lock override for ${JSON.stringify(name)} must be a string`);
+		if (!isObject(overrides) || Array.isArray(overrides)) throw new BunLockFormatError("bun.lock overrides must be an object");
+		for (const [name, value] of Object.entries(overrides)) if (typeof value !== "string") throw new BunLockFormatError(`bun.lock override ${JSON.stringify(name)} is scoped to a parent package or a version selector; only overrides by package name are supported`);
 	}
 	return parsed;
 }
@@ -41,7 +49,8 @@ function parseBunLock(lockText) {
 /**
 * Read the exact bare-name override Bun stores for a dependency.
 *
-* Bun 1.3.14 ignores selector keys and omits unsupported nested/path forms,
+* `parseBunLock` rejects overrides scoped to a parent package or a version selector.
+* Bun versions before 1.4 keep selector keys as strings without applying them,
 * so matching those here would diverge from the package manager.
 */
 function dependencyOverrideRange(lock, dependencyName) {
@@ -245,7 +254,8 @@ function setCatalogs(manifest, catalogs) {
 *
 * A nested entry replaces a host entry with the same name, while the other host entries stay.
 * Entries synced earlier and dropped by the nested repository are removed.
-* Throws when the host and the nested repository patch the same package version.
+* Throws when the host and the nested repository patch the same package version,
+* and when either side defines `resolutions` while `overrides` are synced.
 */
 function syncManifest(host, nested) {
 	const config = readConfig(host);
@@ -280,6 +290,7 @@ function syncManifest(host, nested) {
 	}
 	manifest = setCatalogs(manifest, catalogs);
 	if (config.fields.includes("overrides")) {
+		for (const [source, resolutions] of [["The host package.json", host.resolutions], [`${config.dir}/package.json`, nested.resolutions]]) if (resolutions && Object.keys(resolutions).length) throw new Error(`${source} defines "resolutions", which Bun ignores once "overrides" is defined; move its entries to "overrides"`);
 		const merged = mergeEntries("overrides", host.overrides, nested.overrides, synced.overrides);
 		manifest.overrides = merged.entries;
 		synced.overrides = merged.synced;
@@ -304,7 +315,8 @@ function syncManifest(host, nested) {
 	} : rest;
 	return {
 		manifest,
-		overridden
+		overridden,
+		addedTrustedDependencies: host.trustedDependencies === void 0 && manifest.trustedDependencies !== void 0
 	};
 }
 /**
@@ -800,15 +812,16 @@ async function runBunInstall(root, args = []) {
 async function syncNestedWorkspace(root, options = {}) {
 	const workspace = await loadNestedWorkspace(root);
 	assertWorkspacesCovered(workspace);
-	const { manifest, overridden } = syncManifest(workspace.manifest, workspace.nestedManifest);
+	const manifestSync = syncManifest(workspace.manifest, workspace.nestedManifest);
+	const { manifest } = manifestSync;
 	const manifestText = formatJson(manifest, workspace.manifestText);
 	if (manifestText !== workspace.manifestText) await Bun.write(path.join(root, "package.json"), manifestText);
+	options.onManifestSync?.(manifestSync);
 	const merged = mergeLockfiles(applyManifestToLockfile(workspace.lock, manifest), workspace.nestedLock, workspace.config.dir);
 	await Bun.write(path.join(root, "bun.lock"), renderBunLock(merged));
 	await runBunInstall(root, options.installArgs);
 	const synced = await loadNestedWorkspace(root);
 	return {
-		overridden,
 		ownDependencyChanges: findOwnDependencyChanges(workspace.lock, synced.lock, workspace.nestedLock, workspace.config.dir),
 		check: checkNestedWorkspace(synced)
 	};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bun-nested-workspace",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Embed a checkout of another Bun workspace repository into a Bun workspace and keep the root package.json and bun.lock in sync with it",
   "keywords": [
     "bun",