bun-nested-workspace 0.3.2 → 0.5.0

package/dist/{workspace-ChlHn5I8.mjs → workspace-CC5KeN8i.mjs}

@@ -1,6 +1,197 @@
+import path from "node:path";
 import JSON5 from "json5";
 import semver from "semver";
-import path from "node:path";
+// ../lockfile/src/selector-ranges.ts
+/** The lowest version: an interval without a lower bound starts there. */
+const lowestVersion = new semver.SemVer("0.0.0-0");
+const zeroVersion = new semver.SemVer("0.0.0");
+/** Remove the leading whitespace that Bun's `trim_literal` removes from a specifier before reading it. */
+function trimSpecifier(specifier) {
+	return specifier.replace(/^[ \t\n\r]+/, "");
+}
+/** Prefixes of specifiers that Bun reads as a path, a URL, or another protocol, never as a version range. */
+const nonRangePrefixes = [
+	"./",
+	"../",
+	"/",
+	"~/",
+	"file:",
+	"link:",
+	"workspace:",
+	"catalog:",
+	"npm:",
+	"git+",
+	"git:",
+	"github:",
+	"http:",
+	"https:",
+	"ssh:"
+];
+/** Whether Bun reads a specifier as a tarball by its file extension. */
+function isTarballSpecifier(specifier) {
+	const lowerCase = specifier.toLowerCase();
+	return [
+		".tgz",
+		".tar.gz",
+		".tar"
+	].some((extension) => lowerCase.endsWith(extension));
+}
+/**
+* Tell whether Bun reads a specifier as an npm version range, following the branches of its `Tag::infer`.
+*
+* Returns `undefined` when the answer depends on details that are not ported.
+*/
+function isNpmRangeSpecifier(specifier) {
+	const text = trimSpecifier(specifier);
+	if (!text) return false;
+	const first = text[0];
+	if ("=><^*|".includes(first)) return true;
+	if (first === "~") return !text.startsWith("~/");
+	if ((first === "x" || first === "X") && (text.length === 1 || text[1] === ".")) return true;
+	if (text.startsWith("patch:")) return true;
+	if (/^v?\d/.test(text)) {
+		if (isTarballSpecifier(text)) return false;
+		return parseBunRange(text) ? true : void 0;
+	}
+	if (first === "v" || first === ".") return false;
+	if (nonRangePrefixes.some((prefix) => text.startsWith(prefix))) return false;
+	if (/^[a-z]:\//i.test(text)) return false;
+	if (!text.includes("|")) return false;
+	if (isTarballSpecifier(text) || text.includes("/") || text.includes(":")) return void 0;
+	return true;
+}
+/**
+* Parse a semver range for override selectors, or return `undefined` when node-semver cannot parse it,
+* although Bun may read it, such as `01.2.3`.
+*
+* Bun expands comparators as node-semver does, but it evaluates every `||` alternative on its own, so node-semver's
+* normalizations across alternatives are avoided, and it skips an empty alternative.
+*/
+function parseBunRange(text) {
+	const alternatives = [];
+	for (const alternativeText of text.split("||").filter((part) => part.trim())) {
+		let range;
+		try {
+			range = new semver.Range(alternativeText);
+		} catch {
+			return;
+		}
+		alternatives.push({
+			range,
+			comparators: range.set[0],
+			isSingle: countComparatorTokens(alternativeText) === 1
+		});
+	}
+	return alternatives.length ? { alternatives } : void 0;
+}
+/** Count the comparators written in an alternative, such as 2 in `>=1.0.0 <2.0.0`. */
+function countComparatorTokens(alternativeText) {
+	return alternativeText.trim().replace(/(^|\s)([<>]=?|=|~>?|\^|v)\s+/g, "$1$2").replace(/\s+-\s+/g, "-").split(/\s+/).length;
+}
+/**
+* Bun keeps a lower bound `>=0.0.0` that node-semver drops while parsing, such as the one of `0.x`.
+* Adding that bound to an alternative only narrows it, so an answer computed both without it and with it in every
+* alternative is Bun's answer when the two agree, and is unknown otherwise.
+*/
+function evaluateWithZeroFloor(evaluate) {
+	const withoutFloor = evaluate(false);
+	return withoutFloor === evaluate(true) ? withoutFloor : void 0;
+}
+/** Tell whether a version satisfies a range, as Bun's `Group::satisfies` does, or `undefined` when unknown. */
+function rangeIncludes(range, version) {
+	return evaluateWithZeroFloor((hasZeroFloor) => range.alternatives.some((alternative) => alternativeIncludes(alternative, version, hasZeroFloor)));
+}
+function alternativeIncludes(alternative, version, hasZeroFloor) {
+	return alternative.range.test(version) && (!hasZeroFloor || semver.compare(version, zeroVersion) >= 0);
+}
+/**
+* Tell whether some version satisfies both ranges, as Bun 1.4.4 matches a scoped override key `name@range`
+* against a declared range, or `undefined` when unknown.
+*
+* Ports Bun's `Group::intersects`: an exact version goes through `satisfies`, where `*` admits a prerelease too,
+* and two ranges compare only their bounds, so `>=1.0.0 <2.0.0` intersects `>=2.0.0-alpha <2.0.0`.
+*/
+function rangesIntersect(left, right) {
+	return evaluateWithZeroFloor((hasZeroFloor) => {
+		if (admitsExactVersionOf(left, right, hasZeroFloor) || admitsExactVersionOf(right, left, hasZeroFloor)) return true;
+		const isRange = (alternative) => exactVersion(alternative) === void 0;
+		for (const leftAlternative of left.alternatives.filter(isRange)) {
+			const base = narrow({}, leftAlternative, hasZeroFloor);
+			if (!isNonEmpty(base)) continue;
+			for (const rightAlternative of right.alternatives.filter(isRange)) if (isNonEmpty(narrow(base, rightAlternative, hasZeroFloor))) return true;
+		}
+		return false;
+	});
+}
+function isAny(comparator) {
+	return comparator.value === "";
+}
+function exactVersion({ comparators, isSingle }) {
+	const [comparator] = comparators;
+	return isSingle && comparators.length === 1 && !isAny(comparator) && (comparator.operator === "" || comparator.operator === "=") ? comparator.semver : void 0;
+}
+/** Whether an alternative is `*`, which Bun reads as a lone `>=0.0.0`. */
+function isStar({ comparators, isSingle }) {
+	return isSingle && comparators.length === 1 && isAny(comparators[0]);
+}
+function admitsExactVersionOf(range, other, hasZeroFloor) {
+	return other.alternatives.some((alternative) => {
+		const version = exactVersion(alternative);
+		return version !== void 0 && (range.alternatives.some((candidate) => alternativeIncludes(candidate, version, hasZeroFloor)) || version.prerelease.length > 0 && range.alternatives.some(isStar));
+	});
+}
+function narrow(interval, alternative, hasZeroFloor) {
+	const result = { ...interval };
+	if (hasZeroFloor) raise(result, {
+		version: zeroVersion,
+		inclusive: true
+	});
+	for (const comparator of alternative.comparators) {
+		if (isAny(comparator)) {
+			raise(result, {
+				version: zeroVersion,
+				inclusive: true
+			});
+			continue;
+		}
+		const { operator, semver: version } = comparator;
+		if (operator === "" || operator === "=") {
+			raise(result, {
+				version,
+				inclusive: true
+			});
+			cap(result, {
+				version,
+				inclusive: true
+			});
+		} else if (operator.startsWith(">")) raise(result, {
+			version,
+			inclusive: operator === ">="
+		});
+		else cap(result, {
+			version,
+			inclusive: operator === "<="
+		});
+	}
+	return result;
+}
+function raise(interval, bound) {
+	const order = interval.lower ? semver.compare(bound.version, interval.lower.version) : 1;
+	if (order > 0 || order === 0 && !bound.inclusive) interval.lower = bound;
+}
+function cap(interval, bound) {
+	const order = interval.upper ? semver.compare(bound.version, interval.upper.version) : -1;
+	if (order < 0 || order === 0 && !bound.inclusive) interval.upper = bound;
+}
+function isNonEmpty({ lower, upper }) {
+	if (!upper) return true;
+	const from = lower ?? {
+		version: lowestVersion,
+		inclusive: true
+	};
+	const order = semver.compare(from.version, upper.version);
+	return order < 0 || order === 0 && from.inclusive && upper.inclusive;
+}
 // ../lockfile/src/parse.ts
 function isObject(value) {
 	return typeof value === "object" && value !== null;
@@ -8,6 +199,48 @@ function isObject(value) {
 function isGitPackageEntry(entry) {
 	return isObject(entry[1]);
 }
+/**
+* Return whether a package entry needs `lockfileVersion` 1, because Bun 1.4.4 rejects it in a lockfile of a later version.
+*
+* Version 2 adds checks on reading: an npm integrity is a hash that Bun supports or empty,
+* an npm package from a tarball outside the default registry has a supported integrity,
+* and the checkout tag of a git package is a single safe path component.
+* Bun writes version 1 when an entry fails them, and discards a lockfile of a later version that has such an entry.
+* An entry that Bun rejects at every version, such as a GitHub package with an unsafe tag, does not need version 1.
+*/
+function needsLockfileVersion1(entry) {
+	if (isGitPackageEntry(entry)) {
+		const tag = entry[2];
+		return (parseResolvedSpec(entry[0])?.version.startsWith("git+") ?? false) && tag !== void 0 && !isSafeGitTag(tag);
+	}
+	const [, url = "", , integrity = ""] = entry;
+	if (isSupportedIntegrity(integrity)) return false;
+	return Boolean(integrity) || Boolean(url) && !isUnderDefaultRegistry(url);
+}
+const defaultRegistry = "https://registry.npmjs.org";
+function isUnderDefaultRegistry(url) {
+	return url.startsWith(defaultRegistry) && (url.length === 26 || url[26] === "/");
+}
+const digestLengths = {
+	sha1: 20,
+	sha256: 32,
+	sha384: 48,
+	sha512: 64
+};
+/** Return whether an integrity has a hash that Bun supports, as Bun's `Integrity::parse` reads it. */
+function isSupportedIntegrity(integrity) {
+	return integrity.split(/\s/).some((hash) => {
+		const separator = hash.slice(0, 7).indexOf("-");
+		if (hash.length < 7 || separator === -1 || hash.length <= separator + 1) return false;
+		const digestLength = digestLengths[hash.slice(0, separator)];
+		const encoded = hash.slice(separator + 1).split("?")[0].replace(/=+$/, "");
+		return digestLength !== void 0 && /^[A-Za-z0-9+/]*$/.test(encoded) && encoded.length % 4 !== 1 && Math.floor(encoded.length * 3 / 4) <= digestLength;
+	});
+}
+/** Return whether a git checkout tag is a single safe path component, as Bun's `is_safe_resolved_tag` checks it. */
+function isSafeGitTag(tag) {
+	return tag.length <= 256 && tag !== "." && tag !== ".." && /^[A-Za-z0-9_.][A-Za-z0-9_.-]*$/.test(tag);
+}
 function packageEntryMeta(entry) {
 	if (isGitPackageEntry(entry)) return entry[1];
 	const maybeMeta = entry[2];
@@ -31,25 +264,13 @@ function parseResolvedSpec(spec) {
 		version
 	};
 }
-/** Error thrown when `bun.lock` has a structure that the tools do not support. */
+/** Error thrown when `bun.lock` has a structure that the tools do not support, or an override they cannot evaluate. */
 var BunLockFormatError = class extends Error {
 	constructor(message) {
 		super(message);
 		this.name = "BunLockFormatError";
 	}
 };
-/** Parses `bun.lock` text and throws `BunLockFormatError` on unsupported structure. */
-function parseBunLock(lockText) {
-	const parsed = JSON5.parse(lockText);
-	if (!isObject(parsed)) throw new BunLockFormatError("bun.lock must parse to an object");
-	const overrides = parsed.overrides;
-	if (overrides !== void 0) {
-		if (!isObject(overrides) || Array.isArray(overrides)) throw new BunLockFormatError("bun.lock overrides must be an object");
-		for (const [name, value] of Object.entries(overrides)) if (typeof value !== "string") throw new BunLockFormatError(`bun.lock override ${JSON.stringify(name)} is scoped to a parent package or a version selector; only overrides by package name are supported`);
-	}
-	return parsed;
-}
-// ../lockfile/src/overrides.ts
 /**
 * Return the package and range that an `npm:` alias specifier installs, or `undefined` for any other specifier.
 *
@@ -72,6 +293,359 @@ function npmAliasTarget(specifier) {
 		range: "*"
 	} : void 0;
 }
+const overrideRulesCache = /* @__PURE__ */ new WeakMap();
+/**
+* Return the rules of the `bun.lock` `overrides` section, read once per section object.
+*
+* Throws `BunLockFormatError` when the section has a shape or a key that Bun does not read or the tools cannot evaluate.
+*/
+function getOverrideRules(overrides) {
+	if (overrides === void 0) return void 0;
+	if (!isObject(overrides) || Array.isArray(overrides)) throw new BunLockFormatError("bun.lock overrides must be an object");
+	let rules = overrideRulesCache.get(overrides);
+	if (!rules) {
+		rules = readOverrideRules(overrides);
+		overrideRulesCache.set(overrides, rules);
+	}
+	return rules;
+}
+/**
+* Read the rules of the `bun.lock` `overrides` section, as Bun 1.4.4 does.
+*
+* A string value is an override by name.
+* An object value is a group under the key `name` or `name@range`: its `"."` child overrides that package itself,
+* and any other child `dep` or `dep@range` overrides a dependency of it.
+*/
+function readOverrideRules(overrides) {
+	const rules = {
+		flat: /* @__PURE__ */ new Map(),
+		scopedByName: /* @__PURE__ */ new Map()
+	};
+	const addScoped = (name, rule) => {
+		const scoped = rules.scopedByName.get(name) ?? [];
+		const index = scoped.findIndex((existing) => existing.parent?.name === rule.parent?.name && existing.parent?.rangeText === rule.parent?.rangeText && existing.targetRangeText === rule.targetRangeText);
+		if (index === -1) scoped.push(rule);
+		else scoped[index] = rule;
+		rules.scopedByName.set(name, scoped);
+	};
+	for (const [key, value] of Object.entries(overrides)) {
+		if (typeof value === "string") {
+			rules.flat.set(key, value);
+			continue;
+		}
+		if (!isObject(value) || Array.isArray(value)) throw new BunLockFormatError(`bun.lock override ${JSON.stringify(key)} must be a string or an object of strings`);
+		const group = parseOverrideKey(key);
+		for (const [childKey, childValue] of Object.entries(value)) {
+			if (typeof childValue !== "string") throw new BunLockFormatError(`bun.lock override ${JSON.stringify(key)} must be a string or an object of strings`);
+			if (childKey === "." && !group.range) {
+				rules.flat.set(group.name, childValue);
+				continue;
+			}
+			const target = childKey === "." ? group : parseOverrideKey(childKey);
+			const parent = childKey === "." ? void 0 : group;
+			if (parent && !isParentSegment(parent)) throw unsupportedKey(key);
+			addScoped(target.name, {
+				key: childKey === "." ? JSON.stringify(key) : `${JSON.stringify(key)} > ${JSON.stringify(childKey)}`,
+				parent: parent && {
+					name: parent.name,
+					range: parent.selector?.kind === "semver" ? parent.selector.range : void 0,
+					rangeText: parent.range
+				},
+				targetRangeText: target.range,
+				targetRange: target.selector,
+				value: childValue
+			});
+		}
+	}
+	return rules;
+}
+/**
+* Split an override key segment into a package name and a range, as Bun's `parse_package_segment` does.
+*
+* `npm:` before a range is dropped, while `npm:other` and `npm:other@range` stay aliases.
+* Returns `undefined` for a segment that Bun rejects and for a range other than a semver range or a catalog,
+* which the tools cannot evaluate.
+*/
+function parseOverrideSegment(segment) {
+	const separator = segment.indexOf("@", 1);
+	const name = separator === -1 ? segment : segment.slice(0, separator);
+	let range = separator === -1 ? "" : segment.slice(separator + 1);
+	if (range.startsWith("npm:")) {
+		const rest = range.slice(4);
+		if (!rest || isNpmRangeSpecifier(rest) === true) range = rest;
+	}
+	if (!name || name.startsWith("@") && !name.includes("/") || separator !== -1 && !range) return;
+	if (!range) return {
+		name,
+		range
+	};
+	const selector = toSelectorRange(range);
+	if (!selector || selector.kind === "unparsed") return void 0;
+	return {
+		name,
+		range,
+		selector
+	};
+}
+/** Return whether a parent segment has no range or a range that Bun matches against the installed version. */
+function isParentSegment({ selector }) {
+	return !selector || selector.kind === "semver" && selector.alias === void 0;
+}
+function parseOverrideKey(key) {
+	const segment = parseOverrideSegment(key);
+	if (!segment) throw unsupportedKey(key);
+	return segment;
+}
+function unsupportedKey(key) {
+	return new BunLockFormatError(`bun.lock override key ${JSON.stringify(key)} is not a package name with an optional semver range`);
+}
+/**
+* Read a range in an override key, or a declared range, as Bun compares them.
+*
+* Returns `undefined` for a specifier that no selector range matches, such as a dist-tag or a git URL.
+*/
+function toSelectorRange(specifier) {
+	const text = trimSpecifier(specifier);
+	if (text.startsWith("catalog:")) return {
+		kind: "catalog",
+		catalog: text.slice(8)
+	};
+	const alias = npmAliasTarget(text);
+	const range = alias ? alias.range : text.startsWith("npm:") ? text.slice(4) : text;
+	const isNpmRange = isNpmRangeSpecifier(range);
+	if (isNpmRange === false) return void 0;
+	const parsed = isNpmRange && parseBunRange(range);
+	return parsed ? {
+		kind: "semver",
+		range: parsed,
+		alias: alias?.name
+	} : {
+		kind: "unparsed",
+		alias: alias?.name
+	};
+}
+/** Parses `bun.lock` text and throws `BunLockFormatError` on unsupported structure. */
+function parseBunLock(lockText) {
+	const parsed = JSON5.parse(lockText);
+	if (!isObject(parsed)) throw new BunLockFormatError("bun.lock must parse to an object");
+	getOverrideRules(parsed.overrides);
+	return parsed;
+}
+// ../lockfile/src/manifest-overrides.ts
+/**
+* Read the rules of a `package.json` `overrides` field, as Bun 1.4.4 does.
+*
+* A string value is a rule under a selector key: `name`, `name@range`, `parent>name`, or `parent/name`.
+* An object value is a group under the key `name` or `name@range`: its `"."` child overrides that package itself,
+* and any other child `dep` or `dep@range` overrides a dependency of it.
+* `resolveValue` returns the spec that a `$name` value refers to; the rule stays under its key.
+* Throws on a rule that Bun skips with a warning for its key, its nesting, or its value type,
+* on the values `""`, `-`, and `patch:…`, which Bun skips too, and on a range the tools cannot evaluate.
+* Does not detect a value that Bun skips because it cannot parse it as a dependency spec, such as a malformed git URL.
+*/
+function readManifestOverrides(overrides, resolveValue, source = "package.json") {
+	const rules = [];
+	const fail = (key, problem) => /* @__PURE__ */ new Error(`${source} override ${key} ${problem}`);
+	const failSelector = (key) => fail(key, "is not a package name with an optional semver range or a parent>name selector");
+	const failDepth = (key) => fail(key, "nests deeper than one level, which Bun ignores");
+	const addRule = (key, parent, target, value) => {
+		if (typeof value !== "string") throw fail(key, "must be a string");
+		if (parent && !isParentSegment(parent)) throw failSelector(key);
+		if (!value || value === "-" || value.startsWith("patch:")) throw fail(key, `has the value ${JSON.stringify(value)}, which Bun ignores`);
+		rules.push({
+			key,
+			parent: parent && {
+				name: parent.name,
+				range: parent.range
+			},
+			target: target.name,
+			range: target.range,
+			value: resolveValue(target.name, value)
+		});
+	};
+	for (const [key, value] of Object.entries(overrides)) {
+		if (isCommentKey(key)) continue;
+		const label = JSON.stringify(key);
+		if (!isRecord$2(value)) {
+			if (typeof value !== "string") throw fail(label, "must be a string or an object of strings");
+			const selector = parseSelector(key);
+			if (selector === "too-deep") throw failDepth(label);
+			if (!selector) throw failSelector(label);
+			addRule(label, selector.parent, selector.target, value);
+			continue;
+		}
+		const group = parseOverrideSegment(key);
+		if (!group || !isParentSegment(group)) throw failSelector(label);
+		for (const [childKey, childValue] of Object.entries(value)) {
+			if (isCommentKey(childKey)) continue;
+			const childLabel = `${label} > ${JSON.stringify(childKey)}`;
+			if (isRecord$2(childValue)) throw failDepth(childLabel);
+			if (childKey === ".") {
+				addRule(childLabel, void 0, group, childValue);
+				continue;
+			}
+			const selector = parseSelector(childKey);
+			if (selector === "too-deep" || selector?.parent) throw failDepth(childLabel);
+			if (!selector) throw failSelector(childLabel);
+			addRule(childLabel, group, selector.target, childValue);
+		}
+	}
+	return rules;
+}
+/**
+* Return the pairs of rules where a later rule replaces an earlier one, because both select the same packages.
+*
+* Bun keeps the later rule of such a pair, so the result depends on the order of the keys.
+*/
+function findReplacedOverrideRules(rules) {
+	const seen = /* @__PURE__ */ new Map();
+	const pairs = [];
+	for (const rule of rules) {
+		const identity = getRuleIdentity(rule);
+		const earlier = seen.get(identity);
+		if (earlier) pairs.push([earlier, rule]);
+		seen.set(identity, rule);
+	}
+	return pairs;
+}
+/**
+* Return the `bun.lock` `overrides` section for the rules, as Bun 1.4.4 writes it.
+*
+* Without scoped rules, every rule is a string by package name.
+* Otherwise rules are grouped under `name` or `name@range` keys:
+* a rule without a parent is the `"."` of its group, and a rule with a parent is a child of the parent's group.
+* A rule by name stays a string unless its package has an unranged group.
+*/
+function renderLockfileOverrides(rules) {
+	const flat = /* @__PURE__ */ new Map();
+	const scoped = /* @__PURE__ */ new Map();
+	for (const rule of rules) if (!rule.parent && !rule.range) flat.set(rule.target, rule.value);
+	else scoped.set(getRuleIdentity(rule), rule);
+	if (!scoped.size) return Object.fromEntries([...flat].sort(([a], [b]) => compareText$1(a, b)));
+	const groups = /* @__PURE__ */ new Map();
+	const getGroup = (name, range) => {
+		const id = JSON.stringify([name, range]);
+		let group = groups.get(id);
+		if (!group) {
+			group = {
+				name,
+				range,
+				children: []
+			};
+			groups.set(id, group);
+		}
+		return group;
+	};
+	for (const rule of scoped.values()) if (rule.parent) getGroup(rule.parent.name, rule.parent.range).children.push(rule);
+	else getGroup(rule.target, rule.range).dot = rule.value;
+	const entries = [];
+	for (const [name, value] of flat) {
+		const group = groups.get(JSON.stringify([name, ""]));
+		if (group) group.dot = value;
+		else entries.push({
+			name,
+			range: "",
+			value
+		});
+	}
+	for (const { name, range, dot, children } of groups.values()) {
+		children.sort((a, b) => compareText$1(a.target, b.target) || compareText$1(a.range, b.range));
+		const value = Object.fromEntries([...dot === void 0 ? [] : [[".", dot]], ...children.map((child) => [toSelectorKey(child.target, child.range), child.value])]);
+		entries.push({
+			name,
+			range,
+			value
+		});
+	}
+	entries.sort((a, b) => compareText$1(a.name, b.name) || compareText$1(a.range, b.range));
+	return Object.fromEntries(entries.map((entry) => [toSelectorKey(entry.name, entry.range), entry.value]));
+}
+/** Return the key that Bun matches a rule by when it replaces an earlier rule. */
+function getRuleIdentity({ parent, target, range }) {
+	return JSON.stringify([
+		target,
+		range,
+		parent?.name,
+		parent?.range
+	]);
+}
+function toSelectorKey(name, range) {
+	return range ? `${name}@${range}` : name;
+}
+function compareText$1(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function isCommentKey(key) {
+	return key.startsWith("//");
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Parse the selector key of a string rule, as Bun's `parse_selector` does.
+*
+* Returns `"too-deep"` for a selector with more than one parent, which Bun skips,
+* and `undefined` for any other selector that Bun skips or the tools cannot evaluate.
+*/
+function parseSelector(key) {
+	const delimiter = findPnpmDelimiter(key);
+	if (delimiter !== void 0) {
+		const parentText = key.slice(0, delimiter).trim();
+		const targetText = key.slice(delimiter + 1).trim();
+		if (!targetText) return void 0;
+		if (findPnpmDelimiter(targetText) !== void 0) return "too-deep";
+		const parent = parseOverrideSegment(parentText);
+		const target = parseOverrideSegment(targetText);
+		return parent && target && {
+			parent,
+			target
+		};
+	}
+	const segments = splitYarnPath(key);
+	if (typeof segments === "string" || !segments) return segments;
+	const parsed = segments.map((segment) => parseOverrideSegment(segment));
+	if (parsed.some((segment) => !segment)) return void 0;
+	const [first, second] = parsed;
+	return second ? {
+		parent: first,
+		target: second
+	} : { target: first };
+}
+/**
+* Return the position of the pnpm `parent>name` delimiter: the first `>` that does not follow a space, `|`, `@`, or `:`.
+*
+* Those characters put the `>` into a range, such as `name@>=1` or `name@npm:>=1`.
+*/
+function findPnpmDelimiter(key) {
+	for (let index = key.indexOf(">", 1); index !== -1; index = key.indexOf(">", index + 1)) if (!" |@:".includes(key[index - 1])) return index;
+}
+/**
+* Split a yarn `parent/name` path into at most two segments, as Bun's `parse_yarn_path` does.
+*
+* `**` segments are skipped, a scope joins the name after it, and the alias target in `name@npm:@scope/other`
+* stays in its segment.
+*/
+function splitYarnPath(key) {
+	const tokens = key.split("/");
+	const segments = [];
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens[index];
+		const isLast = index === tokens.length - 1;
+		if (!token || token === "**" && isLast) return void 0;
+		if (token === "**") continue;
+		let segment = token;
+		if (token.startsWith("@")) {
+			const name = tokens[++index];
+			if (!name) return void 0;
+			segment += `/${name}`;
+		}
+		if (segment.includes("@npm:@") && index < tokens.length - 1) segment += `/${tokens[++index]}`;
+		if (segments.length === 2) return "too-deep";
+		segments.push(segment);
+	}
+	return segments.length ? segments : void 0;
+}
+// ../lockfile/src/overrides.ts
 /**
 * Return the package and version range that a dependency specifier requires.
 *
@@ -86,32 +660,101 @@ function dependencyRequirement(dependencyName, specifier) {
 	};
 }
 /**
-* Read the bare-name override that Bun applies to a dependency declaration.
+* Read the override that Bun applies to a dependency declaration, following Bun 1.4.4.
+*
+* A rule scoped to a parent applies to the direct dependencies of that parent only.
+* Among the matching scoped rules, a parent with a range wins over a parent without one,
+* which wins over no parent; within each of these, a rule whose target range matches wins.
+* An override by name applies when no scoped rule does.
 *
-* Bun never overrides an `npm:` alias of a semver range.
+* Bun never overrides an `npm:` alias of a semver range, unless a target range spells out the alias.
 * It overrides an alias of a dist-tag, such as `npm:debug@latest`, by the name of the aliased package,
 * so the override is returned as an alias of that package.
-* `parseBunLock` rejects overrides scoped to a parent package or a version selector.
-* Bun versions before 1.4 keep selector keys as strings without applying them,
-* so matching those here would diverge from the package manager.
-*/
-function dependencyOverrideRange(lock, dependencyName, declaredRange) {
-	const alias = npmAliasTarget(declaredRange);
-	if (!alias) return bareNameOverride(lock, dependencyName);
-	if (!isDistTag(alias.range)) return void 0;
-	const override = bareNameOverride(lock, alias.name);
+*/
+function dependencyOverrideRange(lock, requester, dependencyName, declaredRange) {
+	const rules = getOverrideRules(lock.overrides);
+	if (!rules) return void 0;
+	const alias = npmAliasTarget(trimSpecifier(declaredRange));
+	if (!alias || !isDistTag(alias.range)) return findOverride(rules, requester, dependencyName, declaredRange, alias !== void 0);
+	const override = findOverride(rules, requester, alias.name, declaredRange, false);
 	if (override === void 0) return void 0;
 	const requirement = dependencyRequirement(alias.name, override);
 	return requirement.name !== alias.name || requirement.range.includes(":") ? override : `npm:${alias.name}@${requirement.range}`;
 }
-function bareNameOverride(lock, name) {
-	const overrides = lock.overrides;
-	if (!overrides || !Object.hasOwn(overrides, name)) return void 0;
-	return overrides[name];
+/**
+* Return the value of the rule that Bun picks for a dependency looked up under `name`, if any.
+*
+* Throws `BunLockFormatError` when a rule that would outrank the picked one may apply,
+* but the tools cannot tell whether its ranges match.
+*
+* @param declaredRange The declared range, which an `npm:` alias of a dist-tag never lets a target range match.
+* @param isAlias Whether the declaration is an `npm:` alias that only a target range naming it can override.
+*/
+function findOverride(rules, requester, name, declaredRange, isAlias) {
+	const scoped = rules.scopedByName.get(name) ?? [];
+	const declared = scoped.length ? toSelectorRange(declaredRange) : void 0;
+	let best;
+	let undecided;
+	for (const rule of scoped) {
+		if (!rule.targetRange && isAlias) continue;
+		let tier = 0;
+		let isDecided = true;
+		if (rule.parent) {
+			if (requester?.name === void 0 || requester.name !== rule.parent.name) continue;
+			if (rule.parent.range) {
+				if (requester.version === void 0) continue;
+				const includes = rangeIncludes(rule.parent.range, requester.version);
+				if (includes === false) continue;
+				isDecided &&= includes === true;
+				tier = 4;
+			} else tier = 2;
+		}
+		if (rule.targetRange) {
+			const selects = declared ? rangeSelects(rule.targetRange, declared) : false;
+			if (selects === false) continue;
+			isDecided &&= selects === true;
+			tier += 1;
+		}
+		const ranked = {
+			rule,
+			tier
+		};
+		if (!isDecided) {
+			if (!undecided || outranks(ranked, undecided)) undecided = ranked;
+		} else if (!best || outranks(ranked, best)) best = ranked;
+	}
+	if (undecided && (!best || outranks(undecided, best))) throw new BunLockFormatError(`Cannot tell whether bun.lock override ${undecided.rule.key} applies to ${name} declared as ${JSON.stringify(declaredRange)}; this tool cannot compare these ranges as Bun does, so change the override in package.json so that no range comparison is needed, such as by removing the range from its key or adding a rule scoped to the parent package, and run bun install`);
+	if (best) return best.rule.value;
+	return isAlias ? void 0 : rules.flat.get(name);
+}
+/** Whether a rule wins over another as Bun decides: by tier, then by the parent range text, then by the target range text. */
+function outranks(left, right) {
+	if (left.tier !== right.tier) return left.tier > right.tier;
+	const leftParent = left.rule.parent?.range && left.rule.parent.rangeText;
+	const rightParent = right.rule.parent?.range && right.rule.parent.rangeText;
+	return ((leftParent && rightParent ? compareText(leftParent, rightParent) : 0) || compareText(left.rule.targetRangeText, right.rule.targetRangeText)) < 0;
+}
+function compareText(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+/**
+* Whether an override key `name@range` selects a declaration, as npm and pnpm do: the two ranges overlap.
+*
+* Returns `undefined` when the tools cannot tell.
+*/
+function rangeSelects(range, declared) {
+	if (range.kind === "catalog" || declared.kind === "catalog") return range.kind === "catalog" && declared.kind === "catalog" && isSameCatalog(range, declared);
+	if (range.kind !== "semver" || range.alias !== declared.alias) return false;
+	return declared.kind === "semver" ? rangesIntersect(range.range, declared.range) : void 0;
+}
+/** Whether two catalog references name the same catalog; `catalog:` and `catalog:default` are the default one. */
+function isSameCatalog(left, right) {
+	const isDefault = (catalog) => catalog === "" || catalog === "default";
+	return left.catalog === right.catalog || isDefault(left.catalog) && isDefault(right.catalog);
 }
 /** Whether a version of an `npm:` alias is a dist-tag, such as `latest`, rather than a range or a source. */
 function isDistTag(version) {
-	return /^[^\s:/#@]+$/.test(version) && semver.validRange(version) === null;
+	return /^[^\s:/#@|]+$/.test(version) && isNpmRangeSpecifier(version) === false;
 }
 /**
 * Return the range Bun actually enforces for a dependency request.
@@ -119,10 +762,18 @@ function isDistTag(version) {
 * An override remains authoritative even when it is not valid semver;
 * compatibility then stays unknown instead of falling back to the declaration.
 */
-function effectiveDependencyRange(lock, dependencyName, declaredRange) {
-	const overrideRange = dependencyOverrideRange(lock, dependencyName, declaredRange);
+function effectiveDependencyRange(lock, requester, dependencyName, declaredRange) {
+	const overrideRange = dependencyOverrideRange(lock, requester, dependencyName, declaredRange);
 	return overrideRange === void 0 ? declaredRange : overrideRange;
 }
+/**
+* Tell whether the range of an override parent selector `parent@range` selects a package version, as Bun 1.4.4 matches it,
+* or `undefined` when the tools cannot tell.
+*/
+function overrideParentRangeIncludes(range, version) {
+	const parsed = parseBunRange(range);
+	return parsed && rangeIncludes(parsed, version);
+}
 // ../lockfile/src/render.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -182,6 +833,36 @@ function renderObjectLines(value, indentLevel, allowPackagesFormatting) {
 function renderBunLock(lock) {
 	return `${renderObjectLines(lock, 0, true).join("\n")}\n`;
 }
+// ../lockfile/src/requester.ts
+/**
+* Return the override requester for a package entry with the given spec.
+*
+* As in Bun, only a registry package and a workspace other than the root have a version;
+* a git, tarball, or local package has none, so a parent selector with a range never matches it.
+*/
+function packageOverrideRequester(lock, spec) {
+	const resolved = parseResolvedSpec(spec);
+	if (!resolved) return {};
+	if (resolved.version.startsWith("workspace:")) {
+		const workspace = Object.entries(lock.workspaces ?? {}).find(([workspacePath, { name }]) => workspacePath !== "" && name === resolved.name);
+		return {
+			name: resolved.name,
+			version: workspace?.[1].version
+		};
+	}
+	return {
+		name: resolved.name,
+		version: semver.valid(resolved.version) ?? void 0
+	};
+}
+/** Return the override requester for the workspace at the given path; the root workspace has no version. */
+function workspaceOverrideRequester(lock, workspacePath) {
+	const workspace = lock.workspaces?.[workspacePath];
+	return {
+		name: workspace?.name,
+		version: workspacePath === "" ? void 0 : workspace?.version
+	};
+}
 // ../lockfile/src/resolve.ts
 /**
 * Tell whether a lock key is a nested entry of a dependency: the last of several package names in the key.
@@ -330,11 +1011,13 @@ function resolveOverrideValue(manifest, name, value, source = "package.json") {
 /**
 * Returns the host root `package.json` with the configured root fields of the nested `package.json` merged in.
 *
-* A nested entry replaces a host entry with the same name, while the other host entries stay.
+* A nested entry replaces a host entry with the same key, while the other host entries stay.
 * Entries synced earlier and dropped by the nested repository are removed.
 * Throws when the host and the nested repository patch the same package version,
 * when either side defines `resolutions` while `overrides` are synced,
-* and when a synced `$name` override would refer to another range in the host root than in the nested root.
+* when an override is one that `readManifestOverrides` rejects, when two overrides select the same packages,
+* when a synced `$name` override would refer to another range in the host root than in the nested root,
+* and when a synced override selects the nested root by a range that its version satisfies.
 */
 function syncManifest(host, nested) {
 	const config = readConfig(host);
@@ -370,12 +1053,17 @@ function syncManifest(host, nested) {
 	manifest = setCatalogs(manifest, catalogs);
 	if (config.fields.includes("overrides")) {
 		for (const [source, resolutions] of [["The host package.json", host.resolutions], [`${config.dir}/package.json`, nested.resolutions]]) if (resolutions && Object.keys(resolutions).length) throw new Error(`${source} defines "resolutions", which Bun ignores once "overrides" is defined; move its entries to "overrides"`);
-		for (const [name, value] of Object.entries(nested.overrides ?? {})) {
-			const nestedRange = resolveOverrideValue(nested, name, value, `${config.dir}/package.json`);
+		const nestedSource = `${config.dir}/package.json`;
+		const nestedRules = readManifestOverrides(nested.overrides ?? {}, (name, value) => {
+			const nestedRange = resolveOverrideValue(nested, name, value, nestedSource);
 			const hostRanges = getDeclaredRanges(host, name);
-			if (value.startsWith("$") && (hostRanges.length !== 1 || hostRanges[0] !== nestedRange)) throw new Error(`${config.dir}/package.json override ${JSON.stringify(name)}: ${JSON.stringify(value)} refers to ${JSON.stringify(nestedRange)} in the nested root, but the host root ${hostRanges.length ? `declares ${hostRanges.map((range) => JSON.stringify(range)).join(", ")}` : "does not declare it"}; replace it with an explicit range`);
-		}
+			if (value.startsWith("$") && (hostRanges.length !== 1 || hostRanges[0] !== nestedRange)) throw new Error(`${nestedSource} override ${JSON.stringify(name)}: ${JSON.stringify(value)} refers to ${JSON.stringify(nestedRange)} in the nested root, but the host root ${hostRanges.length ? `declares ${hostRanges.map((range) => JSON.stringify(range)).join(", ")}` : "does not declare it"}; replace it with an explicit range`);
+			return nestedRange;
+		}, nestedSource);
+		for (const { key, parent } of nestedRules) if (parent?.range && parent.name === nested.name && typeof nested.version === "string" && overrideParentRangeIncludes(parent.range, nested.version) !== false) throw new Error(`${nestedSource} override ${key} selects the nested root ${parent.name}@${nested.version} by a version range, which applies in the host but not in the nested repository; remove the range`);
 		const merged = mergeEntries("overrides", host.overrides, nested.overrides, synced.overrides);
+		const [replaced] = findReplacedOverrideRules(readManifestOverrides(merged.entries, (_, value) => value));
+		if (replaced) throw new Error(`The overrides ${replaced[0].key} and ${replaced[1].key} select the same packages, so Bun applies one of them depending on the order of the keys; keep one of them`);
 		manifest.overrides = merged.entries;
 		synced.overrides = merged.synced;
 		overridden.push(...merged.overridden);
@@ -404,14 +1092,15 @@ function syncManifest(host, nested) {
 	};
 }
 /**
-* Merges name-keyed entries of one field.
+* Merges the entries of one field by their keys.
 *
 * Host entries outside `synced` are the host's own.
 * An own entry equal to the nested one stays own, so it survives if the nested repository drops it later.
 */
 function mergeEntries(field, host = {}, nested = {}, synced = []) {
 	const own = Object.fromEntries(Object.entries(host).filter(([name]) => !synced.includes(name)));
-	const overridden = Object.entries(nested).filter(([name, value]) => name in own && own[name] !== value).map(([name, nestedValue]) => ({
+	const isOwn = (name) => name in own && isSameValue(own[name], nested[name]);
+	const overridden = Object.entries(nested).filter(([name]) => name in own && !isOwn(name)).map(([name, nestedValue]) => ({
 		field,
 		name,
 		hostValue: own[name],
@@ -422,10 +1111,15 @@ function mergeEntries(field, host = {}, nested = {}, synced = []) {
 			...own,
 			...nested
 		}),
-		synced: Object.keys(nested).filter((name) => own[name] !== nested[name]).sort(),
+		synced: Object.keys(nested).filter((name) => !isOwn(name)).sort(),
 		overridden
 	};
 }
+/** Returns whether two entry values are equal, ignoring the key order of groups. */
+function isSameValue(left, right) {
+	const toText = (value) => typeof value === "string" ? value : JSON.stringify(sortKeys(value));
+	return typeof left === typeof right && toText(left) === toText(right);
+}
 /** Merges host patches with the nested patches, rewriting nested patch paths through the nested directory. */
 function mergePatches(host = {}, nested = {}, dir) {
 	const own = Object.entries(host).filter(([, patch]) => !isNestedPath(path.posix.normalize(patch), dir));
@@ -483,7 +1177,11 @@ function isRecord(value) {
 *
 * The format is internal to Bun, so other versions are rejected instead of being rewritten blindly.
 */
-const supportedLockfileVersions = [1, 2];
+const supportedLockfileVersions = [
+	1,
+	2,
+	3
+];
 /** Parses `bun.lock` text and rejects lockfile versions outside `supportedLockfileVersions`. */
 function parseLockfile(text, source = "bun.lock") {
 	let lock;
@@ -535,14 +1233,14 @@ function relocateResolution(resolution, dir) {
 *
 * `bun install` re-resolves dependencies whose catalog entry, override, or patch differs from the lockfile,
 * so the merged lockfile must already record the synced root fields to keep the nested resolutions.
-* Records `$name` overrides with the range they refer to, as Bun does, and throws when `resolveOverrideValue` does.
+* Records overrides in the form that Bun writes to `bun.lock`, with `$name` values replaced by the range they refer to.
 */
 function applyManifestToLockfile(lock, manifest) {
 	const { catalog, catalogs } = getCatalogs(manifest);
 	const fields = {
 		catalog,
 		catalogs,
-		overrides: manifest.overrides && Object.fromEntries(Object.entries(manifest.overrides).map(([name, value]) => [name, resolveOverrideValue(manifest, name, value)])),
+		overrides: manifest.overrides && toLockfileOverrides(manifest),
 		patchedDependencies: manifest.patchedDependencies
 	};
 	const result = { ...lock };
@@ -551,6 +1249,34 @@ function applyManifestToLockfile(lock, manifest) {
 	return result;
 }
 /**
+* Returns the `bun.lock` `overrides` section for the overrides of a root `package.json`, as Bun writes it.
+*
+* Replaces `$name` values with the range they refer to, and throws when `readManifestOverrides` or `resolveOverrideValue` does.
+*/
+function toLockfileOverrides(manifest, source = "package.json") {
+	return renderLockfileOverrides(readManifestOverrides(manifest.overrides ?? {}, (target, value) => resolveOverrideValue(manifest, target, value, source), source));
+}
+/**
+* Throws when a lockfile does not record the `overrides` of its root `package.json` as Bun reads them.
+*
+* Bun skips with a warning an override whose value is not a dependency spec it can parse, such as a malformed git URL,
+* and it resolves every dependency again when it finds such an override in the lockfile.
+* The lockfile that Bun wrote tells which overrides it read; a difference can also mean that the lockfile is outdated.
+* Checks nothing when `package.json` has no `overrides` field, because Bun then records `resolutions` there.
+*/
+function assertOverridesRecorded(manifest, lock, sources) {
+	if (!manifest.overrides) return;
+	const expected = toLockfileOverrides(manifest, sources.manifest);
+	const recorded = lock.overrides ?? {};
+	const toText = (overrides, key) => {
+		if (!Object.hasOwn(overrides, key)) return void 0;
+		const value = overrides[key];
+		return JSON.stringify(typeof value === "string" ? value : Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+	};
+	const differences = [.../* @__PURE__ */ new Set([...Object.keys(expected), ...Object.keys(recorded)])].filter((key) => toText(expected, key) !== toText(recorded, key)).sort();
+	if (differences.length) throw new Error(`${sources.lock} does not record the overrides of ${sources.manifest} as Bun reads them: ${differences.map((key) => JSON.stringify(key)).join(", ")}. Either Bun skipped an override that it cannot parse, which it warns about on install, or the lockfile is outdated; fix the override and update the lockfile with bun install`);
+}
+/**
 * Merges the host lockfile with the relocated nested lockfile.
 *
 * Nested entries override host entries, so the nested packages keep the versions of the nested lockfile.
@@ -562,8 +1288,9 @@ function applyManifestToLockfile(lock, manifest) {
 * so `bun install` resolves its dependency again.
 * When the previous host resolution does not satisfy the range either, which Bun lockfiles occasionally contain,
 * the dependency gets the highest satisfying version recorded in either lockfile.
-* Catalog dependencies are checked against the catalogs of the host lockfile, so apply the synced root fields
+* Dependencies are checked against the catalogs and overrides of the host lockfile, so apply the synced root fields
 * to it first.
+* The result has the higher `lockfileVersion` of the two, or version 1 when it has an entry that needs that version.
 */
 function mergeLockfiles(lock, nestedLock, dir) {
 	const nestedNames = /* @__PURE__ */ new Set([...Object.keys(nestedLock.packages), ...Object.values(nestedLock.workspaces).flatMap((workspace) => workspace.name ?? [])]);
@@ -573,18 +1300,25 @@ function mergeLockfiles(lock, nestedLock, dir) {
 		...nestedLock.packages
 	};
 	const hostWorkspaces = Object.entries(lock.workspaces).filter(([workspacePath]) => !isNestedPath(workspacePath, dir));
+	const workspaces = {
+		...Object.fromEntries(hostWorkspaces),
+		...nestedLock.workspaces
+	};
 	if (lock.workspaces[""]) keepHostRootResolutions(lock, nestedLock, packages);
+	const toPackageDependent = (key, entry) => ({
+		key,
+		requester: packageOverrideRequester({ workspaces }, entry[0]),
+		dependencies: getPackageDependencies(entry)
+	});
 	const dependents = [...hostWorkspaces.flatMap(([workspacePath, workspace]) => workspacePath && workspace.name ? [{
 		key: workspace.name,
+		requester: workspaceOverrideRequester({ workspaces }, workspacePath),
 		dependencies: getWorkspaceDependencies(workspace)
-	}] : []), ...Object.keys(packages).map((key) => ({
-		key,
-		dependencies: getPackageDependencies(packages[key])
-	}))];
+	}] : []), ...Object.keys(packages).map((key) => toPackageDependent(key, packages[key]))];
 	for (let index = 0; index < dependents.length; index++) {
-		const { key, dependencies } = dependents[index];
+		const { key, requester, dependencies } = dependents[index];
 		for (const [dependency, specifier] of Object.entries(dependencies)) {
-			const requirement = getRequirement(lock, dependency, specifier);
+			const requirement = getRequirement(lock, requester, dependency, specifier);
 			const resolved = resolveDependencyLockKey(key, dependency, packages);
 			if (!requirement || !resolved || satisfies(packages[resolved], requirement)) continue;
 			const previous = resolveDependencyLockKey(key, dependency, lock.packages);
@@ -592,19 +1326,14 @@ function mergeLockfiles(lock, nestedLock, dir) {
 			if (!replacement) continue;
 			const nestedKey = `${key}/${dependency}`;
 			packages[nestedKey] = replacement;
-			dependents.push({
-				key: nestedKey,
-				dependencies: getPackageDependencies(replacement)
-			});
+			dependents.push(toPackageDependent(nestedKey, replacement));
 		}
 	}
+	const version = Math.max(lock.lockfileVersion, nestedLock.lockfileVersion);
 	return {
 		...lock,
-		lockfileVersion: Math.max(lock.lockfileVersion, nestedLock.lockfileVersion),
-		workspaces: {
-			...Object.fromEntries(hostWorkspaces),
-			...nestedLock.workspaces
-		},
+		lockfileVersion: version > 1 && Object.values(packages).some(needsLockfileVersion1) ? 1 : version,
+		workspaces,
 		packages
 	};
 }
@@ -620,8 +1349,9 @@ function mergeLockfiles(lock, nestedLock, dir) {
 */
 function keepHostRootResolutions(lock, nestedLock, packages) {
 	const replaced = /* @__PURE__ */ new Set();
+	const rootRequester = workspaceOverrideRequester(lock, "");
 	for (const [dependency, specifier] of Object.entries(getWorkspaceDependencies(lock.workspaces[""]))) {
-		const requirement = getRequirement(lock, dependency, specifier);
+		const requirement = getRequirement(lock, rootRequester, dependency, specifier);
 		const nestedEntry = Object.hasOwn(nestedLock.packages, dependency) ? nestedLock.packages[dependency] : void 0;
 		if (!requirement || !nestedEntry || satisfies(nestedEntry, requirement)) continue;
 		const previous = Object.hasOwn(lock.packages, dependency) ? lock.packages[dependency] : void 0;
@@ -684,11 +1414,12 @@ function getPackageDependencies(entry) {
 /**
 * Returns the package and version range that a dependency specifier requires.
 *
-* An override replaces the specifier, as `bun install` applies it to direct and transitive dependencies alike.
+* An override replaces the specifier, as `bun install` applies it to direct and transitive dependencies alike;
+* `requester` is the package that declares the dependency.
 * Returns `undefined` for specifiers that do not resolve by version, such as `workspace:` or git URLs.
 */
-function getRequirement(lock, dependency, specifier) {
-	return parseRequirement(lock, dependency, effectiveDependencyRange(lock, dependency, specifier));
+function getRequirement(lock, requester, dependency, specifier) {
+	return parseRequirement(lock, dependency, effectiveDependencyRange(lock, requester, dependency, specifier));
 }
 /** Resolves `catalog:` specifiers and `npm:` aliases of `getRequirement`. */
 function parseRequirement(lock, dependency, specifier) {
@@ -715,12 +1446,12 @@ function satisfies(entry, requirement) {
 	return spec?.name === requirement.name && Bun.semver.satisfies(spec.version, requirement.range);
 }
 /**
-* Returns whether a lockfile entry satisfies the specifier of a dependency on it.
+* Returns whether a lockfile entry satisfies the specifier of a dependency on it, declared by `requester`.
 *
 * Specifiers that do not resolve by version, such as `workspace:` or git URLs, are always satisfied.
 */
-function satisfiesSpecifier(lock, dependency, specifier, entry) {
-	const requirement = getRequirement(lock, dependency, specifier);
+function satisfiesSpecifier(lock, requester, dependency, specifier, entry) {
+	const requirement = getRequirement(lock, requester, dependency, specifier);
 	return requirement === void 0 || satisfies(entry, requirement);
 }
 /** Splits a lockfile package key into the package names of its nesting chain. */
@@ -742,12 +1473,40 @@ function resolveDependency(lock, workspaceName, dependency) {
 	return key === void 0 ? void 0 : lock.packages[key][0];
 }
 // src/check.ts
+/** Returns the `workspaces` patterns of a root `package.json`. */
+function getWorkspacePatterns(manifest) {
+	const patterns = (Array.isArray(manifest.workspaces) ? manifest.workspaces : manifest.workspaces?.packages ?? []).map((pattern) => pattern.replace(/^(!?)\.\//, "$1").replace(/\/+$/, ""));
+	return {
+		included: patterns.filter((pattern) => !pattern.startsWith("!")),
+		excluded: patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => pattern.slice(1))
+	};
+}
+/**
+* Returns whether the patterns include a directory relative to their root, as `bun install` decides it.
+*
+* The root itself is never included.
+* A pattern without glob syntax includes its exact path regardless of exclusions.
+* A glob pattern matches the `package.json` path of the directory, so `dir/**` includes `dir` itself,
+* and skips `node_modules`, `.git`, and `CMakeFiles` directories.
+* An exclusion `dir/**` also excludes `dir` itself.
+*/
+function matchesWorkspacePatterns(patterns, dir) {
+	const isGlob = (pattern) => /[*?[\]{}]/.test(pattern);
+	const matches = (pattern) => new Bun.Glob(pattern).match(dir);
+	const matchesManifest = (pattern) => new Bun.Glob(path.posix.join(pattern, "package.json")).match(path.posix.join(dir, "package.json"));
+	if (path.posix.normalize(dir) === ".") return false;
+	if (patterns.included.some((pattern) => !isGlob(pattern) && path.posix.normalize(pattern) === dir)) return true;
+	return !dir.split("/").some((part) => ignoredGlobDirs.has(part)) && patterns.included.some((pattern) => isGlob(pattern) && matchesManifest(pattern)) && !patterns.excluded.some((pattern) => matches(pattern) || pattern.endsWith("/**") && matches(pattern.slice(0, -3)));
+}
+const ignoredGlobDirs = /* @__PURE__ */ new Set([
+	"node_modules",
+	".git",
+	"CMakeFiles"
+]);
 /** Returns the nested workspace paths that the host `workspaces` patterns do not include. */
 function findUncoveredWorkspaces(manifest, nestedLock) {
-	const patterns = (Array.isArray(manifest.workspaces) ? manifest.workspaces : manifest.workspaces?.packages ?? []).map((pattern) => pattern.replace(/^(!?)\.\//, "$1").replace(/\/+$/, ""));
-	const included = patterns.filter((pattern) => !pattern.startsWith("!")).map((pattern) => new Bun.Glob(pattern));
-	const excluded = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => new Bun.Glob(pattern.slice(1)));
-	return Object.keys(nestedLock.workspaces).filter((workspacePath) => !included.some((glob) => glob.match(workspacePath)) || excluded.some((glob) => glob.match(workspacePath)));
+	const patterns = getWorkspacePatterns(manifest);
+	return Object.keys(nestedLock.workspaces).filter((workspacePath) => !matchesWorkspacePatterns(patterns, workspacePath));
 }
 /**
 * Returns the paths of nested workspaces whose host lockfile entries differ from the relocated nested lockfile,
@@ -802,9 +1561,10 @@ function findTransitiveMismatches(lock, nestedLock) {
 		const { path, nestedKey, hostKey } = queue[index];
 		const entry = nestedLock.packages[nestedKey];
 		if (entry[0].includes("@workspace:")) continue;
+		const requester = packageOverrideRequester(nestedLock, entry[0]);
 		for (const [dependency, specifier] of Object.entries(getPackageDependencies(entry))) {
 			const nestedDependencyKey = resolveDependencyLockKey(nestedKey, dependency, nestedLock.packages);
-			if (!nestedDependencyKey || !satisfiesSpecifier(nestedLock, dependency, specifier, nestedLock.packages[nestedDependencyKey])) continue;
+			if (!nestedDependencyKey || !satisfiesSpecifier(nestedLock, requester, dependency, specifier, nestedLock.packages[nestedDependencyKey])) continue;
 			const hostDependencyKey = resolveDependencyLockKey(hostKey, dependency, lock.packages);
 			const pair = `${nestedDependencyKey}\0${hostDependencyKey}`;
 			if (visited.has(pair)) continue;
@@ -836,6 +1596,7 @@ function findTransitiveMismatches(lock, nestedLock) {
 */
 function findOwnDependencyChanges(before, after, nestedLock, dir) {
 	return [...new Map([...Object.entries(before.workspaces), ...Object.entries(after.workspaces)].filter(([workspacePath]) => !isNestedPath(workspacePath, dir)))].flatMap(([workspacePath, workspace]) => {
+		const requester = workspaceOverrideRequester(Object.hasOwn(after.workspaces, workspacePath) ? after : before, workspacePath);
 		const specifiers = {
 			...getWorkspaceDependencies(before.workspaces[workspacePath] ?? {}),
 			...getWorkspaceDependencies(after.workspaces[workspacePath] ?? {})
@@ -845,7 +1606,7 @@ function findOwnDependencyChanges(before, after, nestedLock, dir) {
 			const expected = resolveDependency(before, workspace.name, dependency);
 			const actual = resolveDependency(after, workspace.name, dependency);
 			const nestedEntry = nestedLock.packages[dependency];
-			if (actual === expected || actual !== void 0 && actual === nestedEntry?.[0] && satisfiesSpecifier(after, dependency, specifier, nestedEntry)) return [];
+			if (actual === expected || actual !== void 0 && actual === nestedEntry?.[0] && satisfiesSpecifier(after, requester, dependency, specifier, nestedEntry)) return [];
 			return [{
 				workspace: workspace.name ?? workspacePath,
 				dependency,
@@ -891,6 +1652,33 @@ async function loadNestedWorkspace(root) {
 		nestedLock: relocateLockfile(await readLockfile(path.join(nestedRoot, "bun.lock")), config.dir, typeof nestedManifest.name === "string" ? nestedManifest.name : void 0)
 	};
 }
+/**
+* Returns whether a workspace path of the host lockfile is a workspace of the nested repository:
+* its root, a workspace of the nested lockfile, or a directory that the nested `workspaces` patterns include.
+*/
+function isNestedWorkspace(workspace, workspacePath) {
+	const { dir } = workspace.config;
+	return workspacePath === dir || workspacePath in workspace.nestedLock.workspaces || isNestedPath(workspacePath, dir) && matchesWorkspacePatterns(getWorkspacePatterns(workspace.nestedManifest), workspacePath.slice(dir.length + 1));
+}
+/**
+* Returns the first directory with a named package that the nested `workspaces` patterns include, relative to the host root.
+*
+* `bun install` treats the nested root as the workspace root there and writes the nested lockfile,
+* while in the nested root itself it writes the host lockfile.
+*/
+async function findNestedPackageDir(workspace) {
+	const nestedRoot = path.join(workspace.root, workspace.config.dir);
+	const patterns = getWorkspacePatterns(workspace.nestedManifest);
+	const dirs = /* @__PURE__ */ new Set();
+	for (const pattern of patterns.included) for await (const file of new Bun.Glob(`${pattern}/package.json`).scan(nestedRoot)) {
+		const dir = path.posix.normalize(path.posix.dirname(file.split(path.sep).join("/")));
+		if (matchesWorkspacePatterns(patterns, dir)) dirs.add(dir);
+	}
+	for (const dir of [...dirs].sort()) {
+		const manifest = await Bun.file(path.join(nestedRoot, dir, "package.json")).json();
+		if (typeof manifest.name === "string" && manifest.name) return `${workspace.config.dir}/${dir}`;
+	}
+}
 /** Returns whether a check found no differences. */
 function isInSync(result) {
 	return Object.values(result).every((list) => !list.length);
@@ -951,27 +1739,75 @@ async function runBunInstall(root, args = []) {
 *
 * Writes the synced `package.json`, writes the merged `bun.lock`, runs `bun install`,
 * and then compares the result with the nested checkout and with the original host resolutions.
+* When `bun install` fails or the result differs, restores both files before it throws or returns,
+* so that the next sync starts from the original host resolutions.
+* Throws an error that says so when it cannot restore them.
 */
 async function syncNestedWorkspace(root, options = {}) {
 	const workspace = await loadNestedWorkspace(root);
 	assertWorkspacesCovered(workspace);
 	const manifestSync = syncManifest(workspace.manifest, workspace.nestedManifest);
 	const { manifest } = manifestSync;
+	const { dir, fields } = workspace.config;
+	assertOverridesRecorded(workspace.manifest, workspace.lock, {
+		manifest: "package.json",
+		lock: "bun.lock"
+	});
+	if (fields.includes("overrides")) assertOverridesRecorded(workspace.nestedManifest, workspace.nestedLock, {
+		manifest: `${dir}/package.json`,
+		lock: `${dir}/bun.lock`
+	});
 	const merged = mergeLockfiles(applyManifestToLockfile(workspace.lock, manifest), workspace.nestedLock, workspace.config.dir);
-	const manifestText = formatJson(manifest, workspace.manifestText);
-	if (manifestText !== workspace.manifestText) await Bun.write(path.join(root, "package.json"), manifestText);
-	options.onManifestSync?.(manifestSync);
-	await Bun.write(path.join(root, "bun.lock"), renderBunLock(merged));
-	await runBunInstall(root, options.installArgs);
-	const synced = await loadNestedWorkspace(root);
-	return {
-		ownDependencyChanges: findOwnDependencyChanges(workspace.lock, synced.lock, workspace.nestedLock, workspace.config.dir),
-		check: checkNestedWorkspace(synced)
+	const manifestPath = path.join(root, "package.json");
+	const lockPath = path.join(root, "bun.lock");
+	const originals = /* @__PURE__ */ new Map([[manifestPath, workspace.manifestText], [lockPath, await Bun.file(lockPath).text()]]);
+	const restore = async () => {
+		const failures = await restoreFiles(originals);
+		if (failures.length) throw new Error([
+			"The sync failed and could not restore the host files:",
+			...failures.map(({ file, error }) => `  ${path.basename(file)}: ${getErrorMessage(error)}`),
+			"Restore them before running the sync again."
+		].join("\n"));
 	};
+	let result;
+	try {
+		const manifestText = formatJson(manifest, workspace.manifestText);
+		if (manifestText !== workspace.manifestText) await Bun.write(manifestPath, manifestText);
+		options.onManifestSync?.(manifestSync);
+		await Bun.write(lockPath, renderBunLock(merged));
+		await runBunInstall(root, options.installArgs);
+		const synced = await loadNestedWorkspace(root);
+		result = {
+			ownDependencyChanges: findOwnDependencyChanges(workspace.lock, synced.lock, workspace.nestedLock, workspace.config.dir),
+			check: checkNestedWorkspace(synced)
+		};
+	} catch (error) {
+		await restore();
+		throw error;
+	}
+	if (result.ownDependencyChanges.length || !isInSync(result.check)) await restore();
+	return result;
+}
+/**
+* Writes back the original texts of files whose contents differ from them and returns the files it could not restore.
+*
+* Restores each file separately, so that a failure does not keep the other files changed.
+*/
+async function restoreFiles(originals) {
+	const failures = [];
+	for (const [file, text] of originals) try {
+		if (await Bun.file(file).text().catch(() => void 0) !== text) await Bun.write(file, text);
+	} catch (error) {
+		failures.push({
+			file,
+			error
+		});
+	}
+	return failures;
 }
 /** Serializes JSON with the indentation and final newline of the original text. */
 function formatJson(value, original) {
 	const indent = /^[ \t]+(?=")/m.exec(original)?.[0] ?? "  ";
 	return `${JSON.stringify(value, null, indent)}${original.endsWith("\n") ? "\n" : ""}`;
 }
-export { syncManifest as _, syncNestedWorkspace as a, findTransitiveMismatches as c, applyManifestToLockfile as d, mergeLockfiles as f, diffManifests as g, supportedLockfileVersions as h, loadNestedWorkspace as i, findUncoveredWorkspaces as l, relocateLockfile as m, checkNestedWorkspace as n, findDirectDependencyMismatches as o, parseLockfile as p, isInSync as r, findOwnDependencyChanges as s, BunInstallError as t, findWorkspaceMismatches as u, syncedFields as v, getErrorMessage as y };
+export { supportedLockfileVersions as _, isNestedWorkspace as a, syncedFields as b, findDirectDependencyMismatches as c, findUncoveredWorkspaces as d, findWorkspaceMismatches as f, relocateLockfile as g, parseLockfile as h, isInSync as i, findOwnDependencyChanges as l, mergeLockfiles as m, checkNestedWorkspace as n, loadNestedWorkspace as o, applyManifestToLockfile as p, findNestedPackageDir as r, syncNestedWorkspace as s, BunInstallError as t, findTransitiveMismatches as u, diffManifests as v, getErrorMessage as x, syncManifest as y };