bun-nested-workspace 0.2.1 → 0.3.0

package/README.md

@@ -3,8 +3,7 @@
 Embed a checkout of another Bun workspace repository into a subdirectory of your Bun workspace, and keep the root `package.json` and `bun.lock` of the host in sync with it.
 
 The nested repository stays a self-contained project with its own root `package.json` and `bun.lock`.
-Its packages, such as `nested/apps/*` and `nested/packages/*`, become workspaces of the host, while its root does not.
-The host installs none of the dependencies of the nested root `package.json` and cannot run its scripts.
+Its root and its packages, such as `nested/apps/*` and `nested/packages/*`, become workspaces of the host.
 Bun reads catalogs, overrides, patches, and trusted dependencies from the workspace root only, and resolves the whole workspace from a single lockfile.
 This package carries those root fields over to the host and merges the nested lockfile into the host lockfile, so the nested packages build in the host with the same dependency versions as on their own.
 
@@ -16,22 +15,22 @@ The CLI runs before the host dependencies are installed, so run it with `bunx`:
 bunx bun-nested-workspace
 ```
 
-It requires Bun 1.2.19 or later, the first version that resolves `catalog:` dependencies from both catalog locations.
+It requires Bun 1.4.4 or later, the first version that keeps a dependency of the host root package at its own version when the nested lockfile resolves the same package to another version.
 
 ## Setup
 
-Add the nested packages to the host workspaces and name the nested directory in the `bun-nested-workspace` field of the host `package.json`:
+Add the nested directory and its packages to the host workspaces and name the nested directory in the `bun-nested-workspace` field of the host `package.json`:
 
 ```json
 {
-  "workspaces": ["apps/*", "nested/apps/*", "nested/packages/*"],
+  "workspaces": ["apps/*", "nested", "nested/apps/*", "nested/packages/*"],
   "bun-nested-workspace": {
     "dir": "nested"
   }
 }
 ```
 
-Both modes fail when the host `workspaces` patterns miss a workspace package of the nested repository.
+Both modes fail when the host `workspaces` patterns miss the nested root or a nested workspace package, or when the nested root `package.json` has no `name`.
 
 The config takes these fields:
 
@@ -39,6 +38,24 @@ The config takes these fields:
 - `fields`: the root fields to sync, a subset of `catalog`, `catalogs`, `overrides`, `patchedDependencies`, and `trustedDependencies`; all of them when omitted.
 - `synced`: the names of entries that came from the nested repository, maintained by the sync; commit it and do not edit it by hand.
 
+## Nested checkout
+
+`bun install` in the host installs the dependencies of the nested root `package.json` in the versions of the nested lockfile, so the scripts and Git hooks of the nested repository work in the checkout.
+It also runs the `prepare` script of the nested root.
+
+Change the dependencies of the nested repository by editing its `package.json` files.
+Then update the nested lockfile with `bun install --lockfile-only` in the directory of any nested workspace package, and run the sync in the host:
+
+```sh
+(cd nested/packages/core && bun install --lockfile-only)
+bunx bun-nested-workspace
+```
+
+Do not run other `bun install`, `bun add`, or `bun remove` commands in the nested directory or in its package directories:
+
+- In the nested root, Bun runs them for the host: it writes the host lockfile and leaves the nested one stale.
+- In a nested package directory, Bun installs a separate `node_modules` of the nested repository over the host install.
+
 ## Sync
 
 Run the CLI in the host root after switching the nested checkout to another commit:
@@ -57,6 +74,7 @@ The sync:
 Commit `package.json` and `bun.lock` after the sync.
 
 In a Docker build, run the sync with `--lockfile-only` in a stage that contains only the dependency files, before installing dependencies.
+The dependency install runs the `prepare` script of the nested root unless it gets `--ignore-scripts`.
 `bun install` also needs the patch files and the install configuration, such as `bunfig.toml` and `.npmrc`, so keep them, along with any files they reference.
 A separate stage can strip the build context down to these files, so the Dockerfile does not list every workspace package:
 
@@ -91,8 +109,6 @@ A host entry equal to the nested one stays the host's own, so it survives when t
 An entry that came from the nested repository and is no longer there is removed; for patches, these are the patches inside the nested directory.
 A package version patched by both the host and the nested repository is an error.
 
-Bun warns when a nested patch targets a package version that the host does not install, such as a patched tool used only by the nested root.
-
 ### Lockfile
 
 The nested lockfile entries replace the host entries, so the nested packages keep their versions.
@@ -102,7 +118,7 @@ Ranges are checked as `bun install` applies them: an override replaces the decla
 `bun install` then resolves new dependencies of host packages and drops unused entries.
 
 After the install, the sync compares the direct dependencies of host packages with the original host lockfile.
-A dependency may only change to the version that the nested lockfile resolves at its root, and only within the host range.
+A dependency may only change to the version that the nested lockfile hoists to its top level, and only within the host range.
 Any other change means either that the host lockfile did not pin the host dependencies, for example after an edit of a host `package.json` without `bun install`, or that the lockfile cannot record the host version next to the nested one.
 The latter happens to a host workspace without a name, because Bun records workspace-specific versions under the workspace name; name the workspace or align its range with the nested version.
 
@@ -115,7 +131,7 @@ bunx bun-nested-workspace --check
 ```
 
 The check writes nothing, does not run `bun install`, and exits with code 1 when the host files lag behind the nested checkout.
-It reads the root `package.json` and `bun.lock` of the host and of the nested checkout only, so it relies on the nested `bun.lock` being up to date with the nested packages; `bun install --frozen-lockfile` in the nested directory verifies that.
+It reads the root `package.json` and `bun.lock` of the host and of the nested checkout only, so it relies on the nested `bun.lock` being up to date with the nested packages; `bun install --frozen-lockfile` in the CI of the nested repository verifies that.
 Use it in a non-blocking CI job that signals when a sync commit is due.
 
 It reports:

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { a as syncNestedWorkspace, i as loadNestedWorkspace, n as checkNestedWorkspace, r as isInSync, t as BunInstallError, y as getErrorMessage } from "./workspace-DOgB-vkj.mjs";
+import { a as syncNestedWorkspace, i as loadNestedWorkspace, n as checkNestedWorkspace, r as isInSync, t as BunInstallError, y as getErrorMessage } from "./workspace-DfVz3A2J.mjs";
 // src/cli.ts
 const usage = `Usage:
   bun-nested-workspace [bun install options]  Sync package.json and bun.lock, then run bun install
@@ -52,7 +52,7 @@ async function runSync(root, installArgs) {
 		console.error([
 			"The sync changed own dependencies of host packages.",
 			"Either the host bun.lock did not pin them: restore bun.lock, run bun install, commit bun.lock, and sync again.",
-			"Or the nested root resolves them outside the host range: align the host range with the nested version.",
+			"Or the nested lockfile resolves them outside the host range: align the host range with the nested version.",
 			...ownDependencyChanges.map(({ workspace, dependency, expected, actual }) => formatChange(`${workspace} > ${dependency}`, expected, actual))
 		].join("\n"));
 		exitCode = 1;

package/dist/index.d.mts

@@ -92,6 +92,10 @@ interface ResolvedConfig {
 type Catalog = Record<string, string>;
 /** Root `package.json` fields this package reads or rewrites; other fields are preserved as is. */
 interface PackageManifest {
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
+  optionalDependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
   workspaces?: string[] | WorkspacesConfig;
   catalog?: Catalog;
   catalogs?: Record<string, Catalog>;
@@ -135,7 +139,8 @@ interface ManifestSync {
  * A nested entry replaces a host entry with the same name, while the other host entries stay.
  * Entries synced earlier and dropped by the nested repository are removed.
  * Throws when the host and the nested repository patch the same package version,
- * and when either side defines `resolutions` while `overrides` are synced.
+ * when either side defines `resolutions` while `overrides` are synced,
+ * and when a synced `$name` override would refer to another range in the host root than in the nested root.
  */
 export declare function syncManifest(host: PackageManifest, nested: PackageManifest): ManifestSync;
 /** Difference between the expected and the actual value at a `package.json` path. */
@@ -168,7 +173,7 @@ export declare function parseLockfile(text: string, source?: string): Lockfile;
 /**
  * Returns the nested lockfile with workspace and local paths relative to the host root.
  *
- * The nested root workspace is dropped, because it is not a workspace of the host.
+ * The nested root workspace moves to the nested directory, where it is a workspace of the host.
  */
 export declare function relocateLockfile(lock: Lockfile, dir: string): Lockfile;
 /**
@@ -176,6 +181,7 @@ export declare function relocateLockfile(lock: Lockfile, dir: string): Lockfile;
  *
  * `bun install` re-resolves dependencies whose catalog entry, override, or patch differs from the lockfile,
  * so the merged lockfile must already record the synced root fields to keep the nested resolutions.
+ * Records `$name` overrides with the range they refer to, as Bun does, and throws when `resolveOverrideValue` does.
  */
 export declare function applyManifestToLockfile(lock: Lockfile, manifest: PackageManifest): Lockfile;
 /**

package/dist/index.mjs

@@ -1 +1 @@
-export { t as BunInstallError, d as applyManifestToLockfile, n as checkNestedWorkspace, g as diffManifests, o as findDirectDependencyMismatches, s as findOwnDependencyChanges, c as findTransitiveMismatches, l as findUncoveredWorkspaces, u as findWorkspaceMismatches, r as isInSync, i as loadNestedWorkspace, f as mergeLockfiles, p as parseLockfile, m as relocateLockfile, h as supportedLockfileVersions, _ as syncManifest, a as syncNestedWorkspace, v as syncedFields } from "./workspace-DOgB-vkj.mjs";
+export { t as BunInstallError, d as applyManifestToLockfile, n as checkNestedWorkspace, g as diffManifests, o as findDirectDependencyMismatches, s as findOwnDependencyChanges, c as findTransitiveMismatches, l as findUncoveredWorkspaces, u as findWorkspaceMismatches, r as isInSync, i as loadNestedWorkspace, f as mergeLockfiles, p as parseLockfile, m as relocateLockfile, h as supportedLockfileVersions, _ as syncManifest, a as syncNestedWorkspace, v as syncedFields } from "./workspace-DfVz3A2J.mjs";

package/dist/{workspace-DOgB-vkj.mjs → workspace-DfVz3A2J.mjs}

@@ -1,4 +1,5 @@
 import JSON5 from "json5";
+import semver from "semver";
 import path from "node:path";
 // ../lockfile/src/parse.ts
 function isObject(value) {
@@ -13,11 +14,14 @@ function packageEntryMeta(entry) {
 	return isObject(maybeMeta) ? maybeMeta : void 0;
 }
 /**
-* Splits Bun's resolved package spec (`name@version`) using the last `@`, so
-* scoped package names such as `@scope/name@1.0.0` are handled correctly.
+* Splits Bun's resolved package spec (`name@version`) at the first `@` after
+* the leading `@` of a scoped name, as Bun does.
+*
+* The version part may contain `@` itself, as in a git, tarball, or workspace
+* source such as `pkg@git+ssh://git@host/repo.git#sha`.
 */
 function parseResolvedSpec(spec) {
-	const atIndex = spec.lastIndexOf("@");
+	const atIndex = spec.indexOf("@", 1);
 	if (atIndex <= 0 || atIndex >= spec.length - 1) return null;
 	const name = spec.slice(0, atIndex);
 	const version = spec.slice(atIndex + 1);
@@ -47,17 +51,67 @@ function parseBunLock(lockText) {
 }
 // ../lockfile/src/overrides.ts
 /**
-* Read the exact bare-name override Bun stores for a dependency.
+* Return the package and range that an `npm:` alias specifier installs, or `undefined` for any other specifier.
+*
+* Follows Bun: `npm:<name>@<version>` always names a package.
+* Without a version, a target with a range operator or an exact version, such as `npm:^1.0.0`, `npm:1.0.0`, or
+* `npm:v1.0.0`, is a range of the dependency itself; any other target, such as `npm:x`, `npm:1`, or `npm:1.x`, is a
+* package name.
+*/
+function npmAliasTarget(specifier) {
+	if (!specifier.startsWith("npm:")) return void 0;
+	const target = specifier.slice(4);
+	const separator = target.indexOf("@", 1);
+	if (separator !== -1) return {
+		name: target.slice(0, separator),
+		range: target.slice(separator + 1)
+	};
+	const isRange = /[\^~><=*| ]/.test(target) || /^v?\d+\.\d+\.\d+(?:[-+][\w.+-]*)?$/i.test(target);
+	return target && !isRange ? {
+		name: target,
+		range: "*"
+	} : void 0;
+}
+/**
+* Return the package and version range that a dependency specifier requires.
+*
+* An `npm:` alias requires the aliased package, and `npm:<range>` is a range of the dependency itself.
+*/
+function dependencyRequirement(dependencyName, specifier) {
+	const alias = npmAliasTarget(specifier);
+	if (alias) return alias;
+	return {
+		name: dependencyName,
+		range: specifier.startsWith("npm:") ? specifier.slice(4) : specifier
+	};
+}
+/**
+* Read the bare-name override that Bun applies to a dependency declaration.
 *
+* Bun never overrides an `npm:` alias of a semver range.
+* It overrides an alias of a dist-tag, such as `npm:debug@latest`, by the name of the aliased package,
+* so the override is returned as an alias of that package.
 * `parseBunLock` rejects overrides scoped to a parent package or a version selector.
 * Bun versions before 1.4 keep selector keys as strings without applying them,
 * so matching those here would diverge from the package manager.
 */
-function dependencyOverrideRange(lock, dependencyName) {
+function dependencyOverrideRange(lock, dependencyName, declaredRange) {
+	const alias = npmAliasTarget(declaredRange);
+	if (!alias) return bareNameOverride(lock, dependencyName);
+	if (!isDistTag(alias.range)) return void 0;
+	const override = bareNameOverride(lock, alias.name);
+	if (override === void 0) return void 0;
+	const requirement = dependencyRequirement(alias.name, override);
+	return requirement.name !== alias.name || requirement.range.includes(":") ? override : `npm:${alias.name}@${requirement.range}`;
+}
+function bareNameOverride(lock, name) {
 	const overrides = lock.overrides;
-	if (!overrides) return void 0;
-	if (!Object.hasOwn(overrides, dependencyName)) return void 0;
-	return overrides[dependencyName];
+	if (!overrides || !Object.hasOwn(overrides, name)) return void 0;
+	return overrides[name];
+}
+/** Whether a version of an `npm:` alias is a dist-tag, such as `latest`, rather than a range or a source. */
+function isDistTag(version) {
+	return /^[^\s:/#@]+$/.test(version) && semver.validRange(version) === null;
 }
 /**
 * Return the range Bun actually enforces for a dependency request.
@@ -66,7 +120,7 @@ function dependencyOverrideRange(lock, dependencyName) {
 * compatibility then stays unknown instead of falling back to the declaration.
 */
 function effectiveDependencyRange(lock, dependencyName, declaredRange) {
-	const overrideRange = dependencyOverrideRange(lock, dependencyName);
+	const overrideRange = dependencyOverrideRange(lock, dependencyName, declaredRange);
 	return overrideRange === void 0 ? declaredRange : overrideRange;
 }
 // ../lockfile/src/render.ts
@@ -130,15 +184,14 @@ function renderBunLock(lock) {
 }
 // ../lockfile/src/resolve.ts
 /**
-* Tell nested dependency keys apart from root scoped package keys.
+* Tell whether a lock key is a nested entry of a dependency: the last of several package names in the key.
 *
-* For an unscoped dependency, `@scope/name` can match the `/name` suffix even
-* though it is a root package key. A real nested key has another path segment,
-* such as `@scope/requester/name`.
+* A suffix match is not enough: `@scope/name` is a root package key, and `app/@alias/name` is a nested entry
+* of the dependency `@alias/name`, such as an `npm:` alias.
 */
 function isNestedDependencyLockKey(lockKey, dependencyName) {
-	if (!lockKey.endsWith(`/${dependencyName}`)) return false;
-	return dependencyName.startsWith("@") || !/^@[^/]+\/[^/]+$/.test(lockKey);
+	const names = splitLockKey(lockKey);
+	return names.length > 1 && names.at(-1) === dependencyName;
 }
 /**
 * Resolve a dependency the way Bun lock keys are structured:
@@ -249,13 +302,39 @@ function setCatalogs(manifest, catalogs) {
 	if (manifest.workspaces !== void 0 || Object.keys(workspaces).length) result.workspaces = Array.isArray(manifest.workspaces) && Object.keys(workspaces).length === 1 ? workspaces.packages : workspaces;
 	return result;
 }
+/** Returns the distinct ranges that the root `package.json` declares for a package across its dependency groups. */
+function getDeclaredRanges(manifest, name) {
+	const groups = [
+		manifest.dependencies,
+		manifest.devDependencies,
+		manifest.optionalDependencies,
+		manifest.peerDependencies
+	];
+	return [...new Set(groups.flatMap((group) => group && Object.hasOwn(group, name) ? [group[name]] : []))];
+}
+/**
+* Returns the range that a `$name` override value refers to, or the value itself when it is not a reference.
+*
+* Bun replaces `$name` with the range that the root `package.json` declares for `name`, as written.
+* Resolves only references to the root's own declarations: throws when the reference names another package,
+* which Bun versions resolve differently, and when the dependency groups declare no range or different ranges for it.
+*/
+function resolveOverrideValue(manifest, name, value, source = "package.json") {
+	if (!value.startsWith("$")) return value;
+	const entry = `${source} override ${JSON.stringify(name)}: ${JSON.stringify(value)}`;
+	if (value.slice(1) !== name) throw new Error(`${entry} refers to another package, which Bun versions resolve differently; replace it with an explicit range`);
+	const ranges = getDeclaredRanges(manifest, name);
+	if (ranges.length !== 1) throw new Error(`${entry} refers to ${ranges.length ? "different ranges in the dependency groups" : "a dependency that the root does not declare"}; replace it with an explicit range`);
+	return ranges[0];
+}
 /**
 * Returns the host root `package.json` with the configured root fields of the nested `package.json` merged in.
 *
 * A nested entry replaces a host entry with the same name, while the other host entries stay.
 * Entries synced earlier and dropped by the nested repository are removed.
 * Throws when the host and the nested repository patch the same package version,
-* and when either side defines `resolutions` while `overrides` are synced.
+* when either side defines `resolutions` while `overrides` are synced,
+* and when a synced `$name` override would refer to another range in the host root than in the nested root.
 */
 function syncManifest(host, nested) {
 	const config = readConfig(host);
@@ -291,6 +370,11 @@ function syncManifest(host, nested) {
 	manifest = setCatalogs(manifest, catalogs);
 	if (config.fields.includes("overrides")) {
 		for (const [source, resolutions] of [["The host package.json", host.resolutions], [`${config.dir}/package.json`, nested.resolutions]]) if (resolutions && Object.keys(resolutions).length) throw new Error(`${source} defines "resolutions", which Bun ignores once "overrides" is defined; move its entries to "overrides"`);
+		for (const [name, value] of Object.entries(nested.overrides ?? {})) {
+			const nestedRange = resolveOverrideValue(nested, name, value, `${config.dir}/package.json`);
+			const hostRanges = getDeclaredRanges(host, name);
+			if (value.startsWith("$") && (hostRanges.length !== 1 || hostRanges[0] !== nestedRange)) throw new Error(`${config.dir}/package.json override ${JSON.stringify(name)}: ${JSON.stringify(value)} refers to ${JSON.stringify(nestedRange)} in the nested root, but the host root ${hostRanges.length ? `declares ${hostRanges.map((range) => JSON.stringify(range)).join(", ")}` : "does not declare it"}; replace it with an explicit range`);
+		}
 		const merged = mergeEntries("overrides", host.overrides, nested.overrides, synced.overrides);
 		manifest.overrides = merged.entries;
 		synced.overrides = merged.synced;
@@ -422,12 +506,12 @@ async function readLockfile(file) {
 /**
 * Returns the nested lockfile with workspace and local paths relative to the host root.
 *
-* The nested root workspace is dropped, because it is not a workspace of the host.
+* The nested root workspace moves to the nested directory, where it is a workspace of the host.
 */
 function relocateLockfile(lock, dir) {
 	return {
 		...lock,
-		workspaces: Object.fromEntries(Object.entries(lock.workspaces).filter(([workspacePath]) => workspacePath).map(([workspacePath, workspace]) => [path.posix.join(dir, workspacePath), workspace])),
+		workspaces: Object.fromEntries(Object.entries(lock.workspaces).map(([workspacePath, workspace]) => [path.posix.join(dir, workspacePath), workspace])),
 		packages: Object.fromEntries(Object.entries(lock.packages).map(([key, [resolution, ...rest]]) => [key, [relocateResolution(resolution, dir), ...rest]]))
 	};
 }
@@ -445,13 +529,14 @@ function relocateResolution(resolution, dir) {
 *
 * `bun install` re-resolves dependencies whose catalog entry, override, or patch differs from the lockfile,
 * so the merged lockfile must already record the synced root fields to keep the nested resolutions.
+* Records `$name` overrides with the range they refer to, as Bun does, and throws when `resolveOverrideValue` does.
 */
 function applyManifestToLockfile(lock, manifest) {
 	const { catalog, catalogs } = getCatalogs(manifest);
 	const fields = {
 		catalog,
 		catalogs,
-		overrides: manifest.overrides,
+		overrides: manifest.overrides && Object.fromEntries(Object.entries(manifest.overrides).map(([name, value]) => [name, resolveOverrideValue(manifest, name, value)])),
 		patchedDependencies: manifest.patchedDependencies
 	};
 	const result = { ...lock };
@@ -473,7 +558,8 @@ function applyManifestToLockfile(lock, manifest) {
 * to it first.
 */
 function mergeLockfiles(lock, nestedLock, dir) {
-	const hostPackages = Object.entries(lock.packages).filter(([key]) => !(splitPackageKey(key)[0] in nestedLock.packages));
+	const nestedNames = /* @__PURE__ */ new Set([...Object.keys(nestedLock.packages), ...Object.values(nestedLock.workspaces).flatMap((workspace) => workspace.name ?? [])]);
+	const hostPackages = Object.entries(lock.packages).filter(([key]) => !nestedNames.has(splitPackageKey(key)[0]));
 	const packages = {
 		...Object.fromEntries(hostPackages),
 		...nestedLock.packages
@@ -546,21 +632,8 @@ function parseRequirement(lock, dependency, specifier) {
 		const range = (catalogName && catalogName !== "default" ? lock.catalogs?.[catalogName] : lock.catalog)?.[dependency];
 		return range === void 0 ? void 0 : parseRequirement(lock, dependency, range);
 	}
-	if (specifier.startsWith("npm:")) {
-		const target = specifier.slice(4);
-		const separator = target.lastIndexOf("@");
-		return separator > 0 ? {
-			name: target.slice(0, separator),
-			range: target.slice(separator + 1)
-		} : {
-			name: target,
-			range: "*"
-		};
-	}
-	return /^[a-z+]+:|\//i.test(specifier) ? void 0 : {
-		name: dependency,
-		range: specifier
-	};
+	const requirement = dependencyRequirement(dependency, specifier);
+	return /^[a-z+]+:|\//i.test(requirement.range) ? void 0 : requirement;
 }
 /** Returns the entry with the highest version of the required package that satisfies its range. */
 function findSatisfyingEntry(sources, requirement) {
@@ -569,7 +642,7 @@ function findSatisfyingEntry(sources, requirement) {
 	return best;
 }
 function getVersion([resolution]) {
-	return resolution.slice(resolution.lastIndexOf("@") + 1);
+	return parseResolvedSpec(resolution)?.version;
 }
 /** Returns whether an entry resolves the required package to a version in its range. */
 function satisfies(entry, requirement) {
@@ -616,7 +689,9 @@ function findUncoveredWorkspaces(manifest, nestedLock) {
 * including host entries of workspaces that the nested repository no longer has.
 */
 function findWorkspaceMismatches(lock, nestedLock, dir) {
-	return [.../* @__PURE__ */ new Set([...Object.keys(nestedLock.workspaces), ...Object.keys(lock.workspaces).filter((workspacePath) => isNestedPath(workspacePath, dir))])].sort().filter((workspacePath) => toCanonicalJson(lock.workspaces[workspacePath]) !== toCanonicalJson(nestedLock.workspaces[workspacePath]));
+	const paths = /* @__PURE__ */ new Set([...Object.keys(nestedLock.workspaces), ...Object.keys(lock.workspaces).filter((workspacePath) => isNestedPath(workspacePath, dir))]);
+	const comparable = (workspacePath, workspace) => workspacePath === dir && workspace ? Object.fromEntries(Object.entries(workspace).filter(([key]) => key !== "version" && key !== "bin")) : workspace;
+	return [...paths].sort().filter((workspacePath) => toCanonicalJson(comparable(workspacePath, lock.workspaces[workspacePath])) !== toCanonicalJson(comparable(workspacePath, nestedLock.workspaces[workspacePath])));
 }
 /**
 * Returns the direct dependencies of nested workspaces that the host lockfile resolves differently than the nested one.
@@ -755,11 +830,13 @@ function isInSync(result) {
 	return Object.values(result).every((list) => !list.length);
 }
 /**
-* Throws when the host `workspaces` patterns miss nested workspaces.
+* Throws when the host `workspaces` patterns miss nested workspaces or the nested root has no name.
 *
 * Bun would drop such workspaces from the merged lockfile, so neither mode can sync or check them.
+* Bun skips a workspace package without a name, or fails on it in versions before 1.4.
 */
 function assertWorkspacesCovered(workspace) {
+	if (typeof workspace.nestedManifest.name !== "string" || !workspace.nestedManifest.name) throw new Error(`${workspace.config.dir}/package.json needs a "name" field to be a workspace of the host`);
 	const uncovered = findUncoveredWorkspaces(workspace.manifest, workspace.nestedLock);
 	if (uncovered.length) throw new Error(`The host "workspaces" field does not include nested workspaces: ${uncovered.join(", ")}`);
 }
@@ -814,10 +891,10 @@ async function syncNestedWorkspace(root, options = {}) {
 	assertWorkspacesCovered(workspace);
 	const manifestSync = syncManifest(workspace.manifest, workspace.nestedManifest);
 	const { manifest } = manifestSync;
+	const merged = mergeLockfiles(applyManifestToLockfile(workspace.lock, manifest), workspace.nestedLock, workspace.config.dir);
 	const manifestText = formatJson(manifest, workspace.manifestText);
 	if (manifestText !== workspace.manifestText) await Bun.write(path.join(root, "package.json"), manifestText);
 	options.onManifestSync?.(manifestSync);
-	const merged = mergeLockfiles(applyManifestToLockfile(workspace.lock, manifest), workspace.nestedLock, workspace.config.dir);
 	await Bun.write(path.join(root, "bun.lock"), renderBunLock(merged));
 	await runBunInstall(root, options.installArgs);
 	const synced = await loadNestedWorkspace(root);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bun-nested-workspace",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Embed a checkout of another Bun workspace repository into a Bun workspace and keep the root package.json and bun.lock in sync with it",
   "keywords": [
     "bun",
@@ -43,7 +43,8 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "json5": "^2.2.3"
+    "json5": "^2.2.3",
+    "semver": "^7.7.4"
   },
   "devDependencies": {
     "@arethetypeswrong/core": "catalog:",
@@ -54,6 +55,6 @@
     "tsdown": "catalog:"
   },
   "engines": {
-    "bun": ">=1.2.19"
+    "bun": ">=1.4.4"
   }
 }