bun-nested-workspace 0.4.0 → 0.5.0

package/README.md

@@ -99,7 +99,9 @@ Exclude `node_modules` and other large directories from the build context with `
 
 - `catalog` and `catalogs` each stay where the host defines them; a field the host lacks goes next to the other catalog field, or into `workspaces`.
   An array `workspaces` field becomes an object when a catalog needs it.
-- `overrides` and `trustedDependencies` are merged by package name.
+- `overrides` are merged by their keys, so a group such as `"micromatch": { "picomatch": "^2.3.2" }` replaces the host group with the same key as a whole.
+  The sync requires each `bun.lock` to be up to date with the overrides of its `package.json`.
+- `trustedDependencies` are merged by package name.
 - `resolutions` on either side is an error while `overrides` are synced: Bun ignores `resolutions` once `overrides` is defined, so move its entries to `overrides`.
 - `trustedDependencies` stays in the host `package.json`, even empty, when either side defines it.
   An explicit list replaces the default trusted list of Bun, so when only one side defines the field, the packages of the other side lose the default list; list the ones whose lifecycle scripts they need.
@@ -107,7 +109,7 @@ Exclude `node_modules` and other large directories from the build context with `
 - `patchedDependencies` paths are rewritten through the nested directory, such as `nested/patches/exceljs@4.4.0.patch`.
   Bun warns on every install that it ignores `patchedDependencies` of the nested root package; keep them there, because the host applies the synced copies.
 
-A nested entry replaces a host entry with the same name, while the other host entries stay.
+A nested entry replaces a host entry with the same key, while the other host entries stay.
 The sync lists the host entries it replaced.
 A host entry equal to the nested one stays the host's own, so it survives when the nested repository drops it.
 An entry that came from the nested repository and is no longer there is removed; for patches, these are the patches inside the nested directory.
@@ -126,7 +128,7 @@ A dependency may only change to the version that the nested lockfile hoists to i
 Any other change means either that the host lockfile did not pin the host dependencies, for example after an edit of a host `package.json` without `bun install`, or that the lockfile cannot record the host version next to the nested one.
 The latter happens to a host workspace other than the root without a name, because Bun records workspace-specific versions under the workspace name; name the workspace or align its range with the nested version.
 
-Only `bun.lock` with `lockfileVersion` 1 or 2 is supported, because the lockfile format is internal to Bun.
+Only `bun.lock` with `lockfileVersion` 1, 2, or 3 is supported, because the lockfile format is internal to Bun.
 
 ## Check
 

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { a as isNestedWorkspace, i as isInSync, n as checkNestedWorkspace, o as loadNestedWorkspace, r as findNestedPackageDir, s as syncNestedWorkspace, t as BunInstallError, x as getErrorMessage } from "./workspace-DOwKm8pX.mjs";
+import { a as isNestedWorkspace, i as isInSync, n as checkNestedWorkspace, o as loadNestedWorkspace, r as findNestedPackageDir, s as syncNestedWorkspace, t as BunInstallError, x as getErrorMessage } from "./workspace-CC5KeN8i.mjs";
 // src/cli.ts
 const usage = `Usage:
   bun-nested-workspace [bun install options]  Sync package.json and bun.lock, then run bun install

package/dist/index.d.mts

@@ -1,3 +1,4 @@
+import semver from "semver";
 type DependencyMap = Record<string, string>;
 type BunLockWorkspace = {
   /**
@@ -5,6 +6,8 @@ type BunLockWorkspace = {
    * context for workspace-scoped lock keys.
    */
   name?: string;
+  /** Version of a workspace package; Bun leaves it out for the root workspace. */
+  version?: string;
   dependencies?: DependencyMap;
   devDependencies?: DependencyMap;
   optionalDependencies?: DependencyMap;
@@ -48,8 +51,12 @@ type BunLockFile = {
   catalog?: DependencyMap;
   /** Named catalogs of the root `package.json`. */
   catalogs?: Record<string, DependencyMap>;
-  /** Canonical map Bun writes for package.json overrides and resolutions. */
-  overrides?: DependencyMap;
+  /**
+   * Canonical map Bun writes for package.json overrides and resolutions.
+   *
+   * A string value overrides a package by name; an object value groups the rules scoped to a package or its range.
+   */
+  overrides?: Record<string, string | DependencyMap>;
   /** Package specs whose local patches may change their dependency declarations. */
   patchedDependencies?: Record<string, string>;
   packages?: Record<string, BunPackageEntry>;
@@ -90,6 +97,8 @@ interface ResolvedConfig {
   synced: SyncedEntries;
 }
 type Catalog = Record<string, string>;
+/** Value of an `overrides` entry: a version spec, or a group of rules keyed by `"."` and dependency selectors. */
+type OverrideValue = string | Record<string, string>;
 /** Root `package.json` fields this package reads or rewrites; other fields are preserved as is. */
 interface PackageManifest {
   dependencies?: Record<string, string>;
@@ -99,7 +108,7 @@ interface PackageManifest {
   workspaces?: string[] | WorkspacesConfig;
   catalog?: Catalog;
   catalogs?: Record<string, Catalog>;
-  overrides?: Record<string, string>;
+  overrides?: Record<string, OverrideValue>;
   resolutions?: Record<string, string>;
   patchedDependencies?: Record<string, string>;
   trustedDependencies?: string[];
@@ -118,8 +127,8 @@ interface OverriddenEntry {
   /** Field path, such as `catalog`, `catalogs.testing`, or `overrides`. */
   field: string;
   name: string;
-  hostValue: string;
-  nestedValue: string;
+  hostValue: OverrideValue;
+  nestedValue: OverrideValue;
 }
 /** Result of `syncManifest`. */
 interface ManifestSync {
@@ -136,11 +145,13 @@ interface ManifestSync {
 /**
  * Returns the host root `package.json` with the configured root fields of the nested `package.json` merged in.
  *
- * A nested entry replaces a host entry with the same name, while the other host entries stay.
+ * A nested entry replaces a host entry with the same key, while the other host entries stay.
  * Entries synced earlier and dropped by the nested repository are removed.
  * Throws when the host and the nested repository patch the same package version,
  * when either side defines `resolutions` while `overrides` are synced,
- * and when a synced `$name` override would refer to another range in the host root than in the nested root.
+ * when an override is one that `readManifestOverrides` rejects, when two overrides select the same packages,
+ * when a synced `$name` override would refer to another range in the host root than in the nested root,
+ * and when a synced override selects the nested root by a range that its version satisfies.
  */
 export declare function syncManifest(host: PackageManifest, nested: PackageManifest): ManifestSync;
 /** Difference between the expected and the actual value at a `package.json` path. */
@@ -184,7 +195,7 @@ export declare function relocateLockfile(lock: Lockfile, dir: string, rootName?:
  *
  * `bun install` re-resolves dependencies whose catalog entry, override, or patch differs from the lockfile,
  * so the merged lockfile must already record the synced root fields to keep the nested resolutions.
- * Records `$name` overrides with the range they refer to, as Bun does, and throws when `resolveOverrideValue` does.
+ * Records overrides in the form that Bun writes to `bun.lock`, with `$name` values replaced by the range they refer to.
  */
 export declare function applyManifestToLockfile(lock: Lockfile, manifest: PackageManifest): Lockfile;
 /**
@@ -199,8 +210,9 @@ export declare function applyManifestToLockfile(lock: Lockfile, manifest: Packag
  * so `bun install` resolves its dependency again.
  * When the previous host resolution does not satisfy the range either, which Bun lockfiles occasionally contain,
  * the dependency gets the highest satisfying version recorded in either lockfile.
- * Catalog dependencies are checked against the catalogs of the host lockfile, so apply the synced root fields
+ * Dependencies are checked against the catalogs and overrides of the host lockfile, so apply the synced root fields
  * to it first.
+ * The result has the higher `lockfileVersion` of the two, or version 1 when it has an entry that needs that version.
  */
 export declare function mergeLockfiles(lock: Lockfile, nestedLock: Lockfile, dir: string): Lockfile;
 /** Dependency of a workspace package resolved differently than expected. */

package/dist/index.mjs

@@ -1 +1 @@
-export { t as BunInstallError, p as applyManifestToLockfile, n as checkNestedWorkspace, v as diffManifests, c as findDirectDependencyMismatches, l as findOwnDependencyChanges, u as findTransitiveMismatches, d as findUncoveredWorkspaces, f as findWorkspaceMismatches, i as isInSync, o as loadNestedWorkspace, m as mergeLockfiles, h as parseLockfile, g as relocateLockfile, _ as supportedLockfileVersions, y as syncManifest, s as syncNestedWorkspace, b as syncedFields } from "./workspace-DOwKm8pX.mjs";
+export { t as BunInstallError, p as applyManifestToLockfile, n as checkNestedWorkspace, v as diffManifests, c as findDirectDependencyMismatches, l as findOwnDependencyChanges, u as findTransitiveMismatches, d as findUncoveredWorkspaces, f as findWorkspaceMismatches, i as isInSync, o as loadNestedWorkspace, m as mergeLockfiles, h as parseLockfile, g as relocateLockfile, _ as supportedLockfileVersions, y as syncManifest, s as syncNestedWorkspace, b as syncedFields } from "./workspace-CC5KeN8i.mjs";

package/dist/{workspace-DOwKm8pX.mjs → workspace-CC5KeN8i.mjs}

@@ -1,6 +1,197 @@
 import path from "node:path";
 import JSON5 from "json5";
 import semver from "semver";
+// ../lockfile/src/selector-ranges.ts
+/** The lowest version: an interval without a lower bound starts there. */
+const lowestVersion = new semver.SemVer("0.0.0-0");
+const zeroVersion = new semver.SemVer("0.0.0");
+/** Remove the leading whitespace that Bun's `trim_literal` removes from a specifier before reading it. */
+function trimSpecifier(specifier) {
+	return specifier.replace(/^[ \t\n\r]+/, "");
+}
+/** Prefixes of specifiers that Bun reads as a path, a URL, or another protocol, never as a version range. */
+const nonRangePrefixes = [
+	"./",
+	"../",
+	"/",
+	"~/",
+	"file:",
+	"link:",
+	"workspace:",
+	"catalog:",
+	"npm:",
+	"git+",
+	"git:",
+	"github:",
+	"http:",
+	"https:",
+	"ssh:"
+];
+/** Whether Bun reads a specifier as a tarball by its file extension. */
+function isTarballSpecifier(specifier) {
+	const lowerCase = specifier.toLowerCase();
+	return [
+		".tgz",
+		".tar.gz",
+		".tar"
+	].some((extension) => lowerCase.endsWith(extension));
+}
+/**
+* Tell whether Bun reads a specifier as an npm version range, following the branches of its `Tag::infer`.
+*
+* Returns `undefined` when the answer depends on details that are not ported.
+*/
+function isNpmRangeSpecifier(specifier) {
+	const text = trimSpecifier(specifier);
+	if (!text) return false;
+	const first = text[0];
+	if ("=><^*|".includes(first)) return true;
+	if (first === "~") return !text.startsWith("~/");
+	if ((first === "x" || first === "X") && (text.length === 1 || text[1] === ".")) return true;
+	if (text.startsWith("patch:")) return true;
+	if (/^v?\d/.test(text)) {
+		if (isTarballSpecifier(text)) return false;
+		return parseBunRange(text) ? true : void 0;
+	}
+	if (first === "v" || first === ".") return false;
+	if (nonRangePrefixes.some((prefix) => text.startsWith(prefix))) return false;
+	if (/^[a-z]:\//i.test(text)) return false;
+	if (!text.includes("|")) return false;
+	if (isTarballSpecifier(text) || text.includes("/") || text.includes(":")) return void 0;
+	return true;
+}
+/**
+* Parse a semver range for override selectors, or return `undefined` when node-semver cannot parse it,
+* although Bun may read it, such as `01.2.3`.
+*
+* Bun expands comparators as node-semver does, but it evaluates every `||` alternative on its own, so node-semver's
+* normalizations across alternatives are avoided, and it skips an empty alternative.
+*/
+function parseBunRange(text) {
+	const alternatives = [];
+	for (const alternativeText of text.split("||").filter((part) => part.trim())) {
+		let range;
+		try {
+			range = new semver.Range(alternativeText);
+		} catch {
+			return;
+		}
+		alternatives.push({
+			range,
+			comparators: range.set[0],
+			isSingle: countComparatorTokens(alternativeText) === 1
+		});
+	}
+	return alternatives.length ? { alternatives } : void 0;
+}
+/** Count the comparators written in an alternative, such as 2 in `>=1.0.0 <2.0.0`. */
+function countComparatorTokens(alternativeText) {
+	return alternativeText.trim().replace(/(^|\s)([<>]=?|=|~>?|\^|v)\s+/g, "$1$2").replace(/\s+-\s+/g, "-").split(/\s+/).length;
+}
+/**
+* Bun keeps a lower bound `>=0.0.0` that node-semver drops while parsing, such as the one of `0.x`.
+* Adding that bound to an alternative only narrows it, so an answer computed both without it and with it in every
+* alternative is Bun's answer when the two agree, and is unknown otherwise.
+*/
+function evaluateWithZeroFloor(evaluate) {
+	const withoutFloor = evaluate(false);
+	return withoutFloor === evaluate(true) ? withoutFloor : void 0;
+}
+/** Tell whether a version satisfies a range, as Bun's `Group::satisfies` does, or `undefined` when unknown. */
+function rangeIncludes(range, version) {
+	return evaluateWithZeroFloor((hasZeroFloor) => range.alternatives.some((alternative) => alternativeIncludes(alternative, version, hasZeroFloor)));
+}
+function alternativeIncludes(alternative, version, hasZeroFloor) {
+	return alternative.range.test(version) && (!hasZeroFloor || semver.compare(version, zeroVersion) >= 0);
+}
+/**
+* Tell whether some version satisfies both ranges, as Bun 1.4.4 matches a scoped override key `name@range`
+* against a declared range, or `undefined` when unknown.
+*
+* Ports Bun's `Group::intersects`: an exact version goes through `satisfies`, where `*` admits a prerelease too,
+* and two ranges compare only their bounds, so `>=1.0.0 <2.0.0` intersects `>=2.0.0-alpha <2.0.0`.
+*/
+function rangesIntersect(left, right) {
+	return evaluateWithZeroFloor((hasZeroFloor) => {
+		if (admitsExactVersionOf(left, right, hasZeroFloor) || admitsExactVersionOf(right, left, hasZeroFloor)) return true;
+		const isRange = (alternative) => exactVersion(alternative) === void 0;
+		for (const leftAlternative of left.alternatives.filter(isRange)) {
+			const base = narrow({}, leftAlternative, hasZeroFloor);
+			if (!isNonEmpty(base)) continue;
+			for (const rightAlternative of right.alternatives.filter(isRange)) if (isNonEmpty(narrow(base, rightAlternative, hasZeroFloor))) return true;
+		}
+		return false;
+	});
+}
+function isAny(comparator) {
+	return comparator.value === "";
+}
+function exactVersion({ comparators, isSingle }) {
+	const [comparator] = comparators;
+	return isSingle && comparators.length === 1 && !isAny(comparator) && (comparator.operator === "" || comparator.operator === "=") ? comparator.semver : void 0;
+}
+/** Whether an alternative is `*`, which Bun reads as a lone `>=0.0.0`. */
+function isStar({ comparators, isSingle }) {
+	return isSingle && comparators.length === 1 && isAny(comparators[0]);
+}
+function admitsExactVersionOf(range, other, hasZeroFloor) {
+	return other.alternatives.some((alternative) => {
+		const version = exactVersion(alternative);
+		return version !== void 0 && (range.alternatives.some((candidate) => alternativeIncludes(candidate, version, hasZeroFloor)) || version.prerelease.length > 0 && range.alternatives.some(isStar));
+	});
+}
+function narrow(interval, alternative, hasZeroFloor) {
+	const result = { ...interval };
+	if (hasZeroFloor) raise(result, {
+		version: zeroVersion,
+		inclusive: true
+	});
+	for (const comparator of alternative.comparators) {
+		if (isAny(comparator)) {
+			raise(result, {
+				version: zeroVersion,
+				inclusive: true
+			});
+			continue;
+		}
+		const { operator, semver: version } = comparator;
+		if (operator === "" || operator === "=") {
+			raise(result, {
+				version,
+				inclusive: true
+			});
+			cap(result, {
+				version,
+				inclusive: true
+			});
+		} else if (operator.startsWith(">")) raise(result, {
+			version,
+			inclusive: operator === ">="
+		});
+		else cap(result, {
+			version,
+			inclusive: operator === "<="
+		});
+	}
+	return result;
+}
+function raise(interval, bound) {
+	const order = interval.lower ? semver.compare(bound.version, interval.lower.version) : 1;
+	if (order > 0 || order === 0 && !bound.inclusive) interval.lower = bound;
+}
+function cap(interval, bound) {
+	const order = interval.upper ? semver.compare(bound.version, interval.upper.version) : -1;
+	if (order < 0 || order === 0 && !bound.inclusive) interval.upper = bound;
+}
+function isNonEmpty({ lower, upper }) {
+	if (!upper) return true;
+	const from = lower ?? {
+		version: lowestVersion,
+		inclusive: true
+	};
+	const order = semver.compare(from.version, upper.version);
+	return order < 0 || order === 0 && from.inclusive && upper.inclusive;
+}
 // ../lockfile/src/parse.ts
 function isObject(value) {
 	return typeof value === "object" && value !== null;
@@ -8,6 +199,48 @@ function isObject(value) {
 function isGitPackageEntry(entry) {
 	return isObject(entry[1]);
 }
+/**
+* Return whether a package entry needs `lockfileVersion` 1, because Bun 1.4.4 rejects it in a lockfile of a later version.
+*
+* Version 2 adds checks on reading: an npm integrity is a hash that Bun supports or empty,
+* an npm package from a tarball outside the default registry has a supported integrity,
+* and the checkout tag of a git package is a single safe path component.
+* Bun writes version 1 when an entry fails them, and discards a lockfile of a later version that has such an entry.
+* An entry that Bun rejects at every version, such as a GitHub package with an unsafe tag, does not need version 1.
+*/
+function needsLockfileVersion1(entry) {
+	if (isGitPackageEntry(entry)) {
+		const tag = entry[2];
+		return (parseResolvedSpec(entry[0])?.version.startsWith("git+") ?? false) && tag !== void 0 && !isSafeGitTag(tag);
+	}
+	const [, url = "", , integrity = ""] = entry;
+	if (isSupportedIntegrity(integrity)) return false;
+	return Boolean(integrity) || Boolean(url) && !isUnderDefaultRegistry(url);
+}
+const defaultRegistry = "https://registry.npmjs.org";
+function isUnderDefaultRegistry(url) {
+	return url.startsWith(defaultRegistry) && (url.length === 26 || url[26] === "/");
+}
+const digestLengths = {
+	sha1: 20,
+	sha256: 32,
+	sha384: 48,
+	sha512: 64
+};
+/** Return whether an integrity has a hash that Bun supports, as Bun's `Integrity::parse` reads it. */
+function isSupportedIntegrity(integrity) {
+	return integrity.split(/\s/).some((hash) => {
+		const separator = hash.slice(0, 7).indexOf("-");
+		if (hash.length < 7 || separator === -1 || hash.length <= separator + 1) return false;
+		const digestLength = digestLengths[hash.slice(0, separator)];
+		const encoded = hash.slice(separator + 1).split("?")[0].replace(/=+$/, "");
+		return digestLength !== void 0 && /^[A-Za-z0-9+/]*$/.test(encoded) && encoded.length % 4 !== 1 && Math.floor(encoded.length * 3 / 4) <= digestLength;
+	});
+}
+/** Return whether a git checkout tag is a single safe path component, as Bun's `is_safe_resolved_tag` checks it. */
+function isSafeGitTag(tag) {
+	return tag.length <= 256 && tag !== "." && tag !== ".." && /^[A-Za-z0-9_.][A-Za-z0-9_.-]*$/.test(tag);
+}
 function packageEntryMeta(entry) {
 	if (isGitPackageEntry(entry)) return entry[1];
 	const maybeMeta = entry[2];
@@ -31,25 +264,13 @@ function parseResolvedSpec(spec) {
 		version
 	};
 }
-/** Error thrown when `bun.lock` has a structure that the tools do not support. */
+/** Error thrown when `bun.lock` has a structure that the tools do not support, or an override they cannot evaluate. */
 var BunLockFormatError = class extends Error {
 	constructor(message) {
 		super(message);
 		this.name = "BunLockFormatError";
 	}
 };
-/** Parses `bun.lock` text and throws `BunLockFormatError` on unsupported structure. */
-function parseBunLock(lockText) {
-	const parsed = JSON5.parse(lockText);
-	if (!isObject(parsed)) throw new BunLockFormatError("bun.lock must parse to an object");
-	const overrides = parsed.overrides;
-	if (overrides !== void 0) {
-		if (!isObject(overrides) || Array.isArray(overrides)) throw new BunLockFormatError("bun.lock overrides must be an object");
-		for (const [name, value] of Object.entries(overrides)) if (typeof value !== "string") throw new BunLockFormatError(`bun.lock override ${JSON.stringify(name)} is scoped to a parent package or a version selector; only overrides by package name are supported`);
-	}
-	return parsed;
-}
-// ../lockfile/src/overrides.ts
 /**
 * Return the package and range that an `npm:` alias specifier installs, or `undefined` for any other specifier.
 *
@@ -72,6 +293,359 @@ function npmAliasTarget(specifier) {
 		range: "*"
 	} : void 0;
 }
+const overrideRulesCache = /* @__PURE__ */ new WeakMap();
+/**
+* Return the rules of the `bun.lock` `overrides` section, read once per section object.
+*
+* Throws `BunLockFormatError` when the section has a shape or a key that Bun does not read or the tools cannot evaluate.
+*/
+function getOverrideRules(overrides) {
+	if (overrides === void 0) return void 0;
+	if (!isObject(overrides) || Array.isArray(overrides)) throw new BunLockFormatError("bun.lock overrides must be an object");
+	let rules = overrideRulesCache.get(overrides);
+	if (!rules) {
+		rules = readOverrideRules(overrides);
+		overrideRulesCache.set(overrides, rules);
+	}
+	return rules;
+}
+/**
+* Read the rules of the `bun.lock` `overrides` section, as Bun 1.4.4 does.
+*
+* A string value is an override by name.
+* An object value is a group under the key `name` or `name@range`: its `"."` child overrides that package itself,
+* and any other child `dep` or `dep@range` overrides a dependency of it.
+*/
+function readOverrideRules(overrides) {
+	const rules = {
+		flat: /* @__PURE__ */ new Map(),
+		scopedByName: /* @__PURE__ */ new Map()
+	};
+	const addScoped = (name, rule) => {
+		const scoped = rules.scopedByName.get(name) ?? [];
+		const index = scoped.findIndex((existing) => existing.parent?.name === rule.parent?.name && existing.parent?.rangeText === rule.parent?.rangeText && existing.targetRangeText === rule.targetRangeText);
+		if (index === -1) scoped.push(rule);
+		else scoped[index] = rule;
+		rules.scopedByName.set(name, scoped);
+	};
+	for (const [key, value] of Object.entries(overrides)) {
+		if (typeof value === "string") {
+			rules.flat.set(key, value);
+			continue;
+		}
+		if (!isObject(value) || Array.isArray(value)) throw new BunLockFormatError(`bun.lock override ${JSON.stringify(key)} must be a string or an object of strings`);
+		const group = parseOverrideKey(key);
+		for (const [childKey, childValue] of Object.entries(value)) {
+			if (typeof childValue !== "string") throw new BunLockFormatError(`bun.lock override ${JSON.stringify(key)} must be a string or an object of strings`);
+			if (childKey === "." && !group.range) {
+				rules.flat.set(group.name, childValue);
+				continue;
+			}
+			const target = childKey === "." ? group : parseOverrideKey(childKey);
+			const parent = childKey === "." ? void 0 : group;
+			if (parent && !isParentSegment(parent)) throw unsupportedKey(key);
+			addScoped(target.name, {
+				key: childKey === "." ? JSON.stringify(key) : `${JSON.stringify(key)} > ${JSON.stringify(childKey)}`,
+				parent: parent && {
+					name: parent.name,
+					range: parent.selector?.kind === "semver" ? parent.selector.range : void 0,
+					rangeText: parent.range
+				},
+				targetRangeText: target.range,
+				targetRange: target.selector,
+				value: childValue
+			});
+		}
+	}
+	return rules;
+}
+/**
+* Split an override key segment into a package name and a range, as Bun's `parse_package_segment` does.
+*
+* `npm:` before a range is dropped, while `npm:other` and `npm:other@range` stay aliases.
+* Returns `undefined` for a segment that Bun rejects and for a range other than a semver range or a catalog,
+* which the tools cannot evaluate.
+*/
+function parseOverrideSegment(segment) {
+	const separator = segment.indexOf("@", 1);
+	const name = separator === -1 ? segment : segment.slice(0, separator);
+	let range = separator === -1 ? "" : segment.slice(separator + 1);
+	if (range.startsWith("npm:")) {
+		const rest = range.slice(4);
+		if (!rest || isNpmRangeSpecifier(rest) === true) range = rest;
+	}
+	if (!name || name.startsWith("@") && !name.includes("/") || separator !== -1 && !range) return;
+	if (!range) return {
+		name,
+		range
+	};
+	const selector = toSelectorRange(range);
+	if (!selector || selector.kind === "unparsed") return void 0;
+	return {
+		name,
+		range,
+		selector
+	};
+}
+/** Return whether a parent segment has no range or a range that Bun matches against the installed version. */
+function isParentSegment({ selector }) {
+	return !selector || selector.kind === "semver" && selector.alias === void 0;
+}
+function parseOverrideKey(key) {
+	const segment = parseOverrideSegment(key);
+	if (!segment) throw unsupportedKey(key);
+	return segment;
+}
+function unsupportedKey(key) {
+	return new BunLockFormatError(`bun.lock override key ${JSON.stringify(key)} is not a package name with an optional semver range`);
+}
+/**
+* Read a range in an override key, or a declared range, as Bun compares them.
+*
+* Returns `undefined` for a specifier that no selector range matches, such as a dist-tag or a git URL.
+*/
+function toSelectorRange(specifier) {
+	const text = trimSpecifier(specifier);
+	if (text.startsWith("catalog:")) return {
+		kind: "catalog",
+		catalog: text.slice(8)
+	};
+	const alias = npmAliasTarget(text);
+	const range = alias ? alias.range : text.startsWith("npm:") ? text.slice(4) : text;
+	const isNpmRange = isNpmRangeSpecifier(range);
+	if (isNpmRange === false) return void 0;
+	const parsed = isNpmRange && parseBunRange(range);
+	return parsed ? {
+		kind: "semver",
+		range: parsed,
+		alias: alias?.name
+	} : {
+		kind: "unparsed",
+		alias: alias?.name
+	};
+}
+/** Parses `bun.lock` text and throws `BunLockFormatError` on unsupported structure. */
+function parseBunLock(lockText) {
+	const parsed = JSON5.parse(lockText);
+	if (!isObject(parsed)) throw new BunLockFormatError("bun.lock must parse to an object");
+	getOverrideRules(parsed.overrides);
+	return parsed;
+}
+// ../lockfile/src/manifest-overrides.ts
+/**
+* Read the rules of a `package.json` `overrides` field, as Bun 1.4.4 does.
+*
+* A string value is a rule under a selector key: `name`, `name@range`, `parent>name`, or `parent/name`.
+* An object value is a group under the key `name` or `name@range`: its `"."` child overrides that package itself,
+* and any other child `dep` or `dep@range` overrides a dependency of it.
+* `resolveValue` returns the spec that a `$name` value refers to; the rule stays under its key.
+* Throws on a rule that Bun skips with a warning for its key, its nesting, or its value type,
+* on the values `""`, `-`, and `patch:…`, which Bun skips too, and on a range the tools cannot evaluate.
+* Does not detect a value that Bun skips because it cannot parse it as a dependency spec, such as a malformed git URL.
+*/
+function readManifestOverrides(overrides, resolveValue, source = "package.json") {
+	const rules = [];
+	const fail = (key, problem) => /* @__PURE__ */ new Error(`${source} override ${key} ${problem}`);
+	const failSelector = (key) => fail(key, "is not a package name with an optional semver range or a parent>name selector");
+	const failDepth = (key) => fail(key, "nests deeper than one level, which Bun ignores");
+	const addRule = (key, parent, target, value) => {
+		if (typeof value !== "string") throw fail(key, "must be a string");
+		if (parent && !isParentSegment(parent)) throw failSelector(key);
+		if (!value || value === "-" || value.startsWith("patch:")) throw fail(key, `has the value ${JSON.stringify(value)}, which Bun ignores`);
+		rules.push({
+			key,
+			parent: parent && {
+				name: parent.name,
+				range: parent.range
+			},
+			target: target.name,
+			range: target.range,
+			value: resolveValue(target.name, value)
+		});
+	};
+	for (const [key, value] of Object.entries(overrides)) {
+		if (isCommentKey(key)) continue;
+		const label = JSON.stringify(key);
+		if (!isRecord$2(value)) {
+			if (typeof value !== "string") throw fail(label, "must be a string or an object of strings");
+			const selector = parseSelector(key);
+			if (selector === "too-deep") throw failDepth(label);
+			if (!selector) throw failSelector(label);
+			addRule(label, selector.parent, selector.target, value);
+			continue;
+		}
+		const group = parseOverrideSegment(key);
+		if (!group || !isParentSegment(group)) throw failSelector(label);
+		for (const [childKey, childValue] of Object.entries(value)) {
+			if (isCommentKey(childKey)) continue;
+			const childLabel = `${label} > ${JSON.stringify(childKey)}`;
+			if (isRecord$2(childValue)) throw failDepth(childLabel);
+			if (childKey === ".") {
+				addRule(childLabel, void 0, group, childValue);
+				continue;
+			}
+			const selector = parseSelector(childKey);
+			if (selector === "too-deep" || selector?.parent) throw failDepth(childLabel);
+			if (!selector) throw failSelector(childLabel);
+			addRule(childLabel, group, selector.target, childValue);
+		}
+	}
+	return rules;
+}
+/**
+* Return the pairs of rules where a later rule replaces an earlier one, because both select the same packages.
+*
+* Bun keeps the later rule of such a pair, so the result depends on the order of the keys.
+*/
+function findReplacedOverrideRules(rules) {
+	const seen = /* @__PURE__ */ new Map();
+	const pairs = [];
+	for (const rule of rules) {
+		const identity = getRuleIdentity(rule);
+		const earlier = seen.get(identity);
+		if (earlier) pairs.push([earlier, rule]);
+		seen.set(identity, rule);
+	}
+	return pairs;
+}
+/**
+* Return the `bun.lock` `overrides` section for the rules, as Bun 1.4.4 writes it.
+*
+* Without scoped rules, every rule is a string by package name.
+* Otherwise rules are grouped under `name` or `name@range` keys:
+* a rule without a parent is the `"."` of its group, and a rule with a parent is a child of the parent's group.
+* A rule by name stays a string unless its package has an unranged group.
+*/
+function renderLockfileOverrides(rules) {
+	const flat = /* @__PURE__ */ new Map();
+	const scoped = /* @__PURE__ */ new Map();
+	for (const rule of rules) if (!rule.parent && !rule.range) flat.set(rule.target, rule.value);
+	else scoped.set(getRuleIdentity(rule), rule);
+	if (!scoped.size) return Object.fromEntries([...flat].sort(([a], [b]) => compareText$1(a, b)));
+	const groups = /* @__PURE__ */ new Map();
+	const getGroup = (name, range) => {
+		const id = JSON.stringify([name, range]);
+		let group = groups.get(id);
+		if (!group) {
+			group = {
+				name,
+				range,
+				children: []
+			};
+			groups.set(id, group);
+		}
+		return group;
+	};
+	for (const rule of scoped.values()) if (rule.parent) getGroup(rule.parent.name, rule.parent.range).children.push(rule);
+	else getGroup(rule.target, rule.range).dot = rule.value;
+	const entries = [];
+	for (const [name, value] of flat) {
+		const group = groups.get(JSON.stringify([name, ""]));
+		if (group) group.dot = value;
+		else entries.push({
+			name,
+			range: "",
+			value
+		});
+	}
+	for (const { name, range, dot, children } of groups.values()) {
+		children.sort((a, b) => compareText$1(a.target, b.target) || compareText$1(a.range, b.range));
+		const value = Object.fromEntries([...dot === void 0 ? [] : [[".", dot]], ...children.map((child) => [toSelectorKey(child.target, child.range), child.value])]);
+		entries.push({
+			name,
+			range,
+			value
+		});
+	}
+	entries.sort((a, b) => compareText$1(a.name, b.name) || compareText$1(a.range, b.range));
+	return Object.fromEntries(entries.map((entry) => [toSelectorKey(entry.name, entry.range), entry.value]));
+}
+/** Return the key that Bun matches a rule by when it replaces an earlier rule. */
+function getRuleIdentity({ parent, target, range }) {
+	return JSON.stringify([
+		target,
+		range,
+		parent?.name,
+		parent?.range
+	]);
+}
+function toSelectorKey(name, range) {
+	return range ? `${name}@${range}` : name;
+}
+function compareText$1(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function isCommentKey(key) {
+	return key.startsWith("//");
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Parse the selector key of a string rule, as Bun's `parse_selector` does.
+*
+* Returns `"too-deep"` for a selector with more than one parent, which Bun skips,
+* and `undefined` for any other selector that Bun skips or the tools cannot evaluate.
+*/
+function parseSelector(key) {
+	const delimiter = findPnpmDelimiter(key);
+	if (delimiter !== void 0) {
+		const parentText = key.slice(0, delimiter).trim();
+		const targetText = key.slice(delimiter + 1).trim();
+		if (!targetText) return void 0;
+		if (findPnpmDelimiter(targetText) !== void 0) return "too-deep";
+		const parent = parseOverrideSegment(parentText);
+		const target = parseOverrideSegment(targetText);
+		return parent && target && {
+			parent,
+			target
+		};
+	}
+	const segments = splitYarnPath(key);
+	if (typeof segments === "string" || !segments) return segments;
+	const parsed = segments.map((segment) => parseOverrideSegment(segment));
+	if (parsed.some((segment) => !segment)) return void 0;
+	const [first, second] = parsed;
+	return second ? {
+		parent: first,
+		target: second
+	} : { target: first };
+}
+/**
+* Return the position of the pnpm `parent>name` delimiter: the first `>` that does not follow a space, `|`, `@`, or `:`.
+*
+* Those characters put the `>` into a range, such as `name@>=1` or `name@npm:>=1`.
+*/
+function findPnpmDelimiter(key) {
+	for (let index = key.indexOf(">", 1); index !== -1; index = key.indexOf(">", index + 1)) if (!" |@:".includes(key[index - 1])) return index;
+}
+/**
+* Split a yarn `parent/name` path into at most two segments, as Bun's `parse_yarn_path` does.
+*
+* `**` segments are skipped, a scope joins the name after it, and the alias target in `name@npm:@scope/other`
+* stays in its segment.
+*/
+function splitYarnPath(key) {
+	const tokens = key.split("/");
+	const segments = [];
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens[index];
+		const isLast = index === tokens.length - 1;
+		if (!token || token === "**" && isLast) return void 0;
+		if (token === "**") continue;
+		let segment = token;
+		if (token.startsWith("@")) {
+			const name = tokens[++index];
+			if (!name) return void 0;
+			segment += `/${name}`;
+		}
+		if (segment.includes("@npm:@") && index < tokens.length - 1) segment += `/${tokens[++index]}`;
+		if (segments.length === 2) return "too-deep";
+		segments.push(segment);
+	}
+	return segments.length ? segments : void 0;
+}
+// ../lockfile/src/overrides.ts
 /**
 * Return the package and version range that a dependency specifier requires.
 *
@@ -86,32 +660,101 @@ function dependencyRequirement(dependencyName, specifier) {
 	};
 }
 /**
-* Read the bare-name override that Bun applies to a dependency declaration.
+* Read the override that Bun applies to a dependency declaration, following Bun 1.4.4.
+*
+* A rule scoped to a parent applies to the direct dependencies of that parent only.
+* Among the matching scoped rules, a parent with a range wins over a parent without one,
+* which wins over no parent; within each of these, a rule whose target range matches wins.
+* An override by name applies when no scoped rule does.
 *
-* Bun never overrides an `npm:` alias of a semver range.
+* Bun never overrides an `npm:` alias of a semver range, unless a target range spells out the alias.
 * It overrides an alias of a dist-tag, such as `npm:debug@latest`, by the name of the aliased package,
 * so the override is returned as an alias of that package.
-* `parseBunLock` rejects overrides scoped to a parent package or a version selector.
-* Bun versions before 1.4 keep selector keys as strings without applying them,
-* so matching those here would diverge from the package manager.
 */
-function dependencyOverrideRange(lock, dependencyName, declaredRange) {
-	const alias = npmAliasTarget(declaredRange);
-	if (!alias) return bareNameOverride(lock, dependencyName);
-	if (!isDistTag(alias.range)) return void 0;
-	const override = bareNameOverride(lock, alias.name);
+function dependencyOverrideRange(lock, requester, dependencyName, declaredRange) {
+	const rules = getOverrideRules(lock.overrides);
+	if (!rules) return void 0;
+	const alias = npmAliasTarget(trimSpecifier(declaredRange));
+	if (!alias || !isDistTag(alias.range)) return findOverride(rules, requester, dependencyName, declaredRange, alias !== void 0);
+	const override = findOverride(rules, requester, alias.name, declaredRange, false);
 	if (override === void 0) return void 0;
 	const requirement = dependencyRequirement(alias.name, override);
 	return requirement.name !== alias.name || requirement.range.includes(":") ? override : `npm:${alias.name}@${requirement.range}`;
 }
-function bareNameOverride(lock, name) {
-	const overrides = lock.overrides;
-	if (!overrides || !Object.hasOwn(overrides, name)) return void 0;
-	return overrides[name];
+/**
+* Return the value of the rule that Bun picks for a dependency looked up under `name`, if any.
+*
+* Throws `BunLockFormatError` when a rule that would outrank the picked one may apply,
+* but the tools cannot tell whether its ranges match.
+*
+* @param declaredRange The declared range, which an `npm:` alias of a dist-tag never lets a target range match.
+* @param isAlias Whether the declaration is an `npm:` alias that only a target range naming it can override.
+*/
+function findOverride(rules, requester, name, declaredRange, isAlias) {
+	const scoped = rules.scopedByName.get(name) ?? [];
+	const declared = scoped.length ? toSelectorRange(declaredRange) : void 0;
+	let best;
+	let undecided;
+	for (const rule of scoped) {
+		if (!rule.targetRange && isAlias) continue;
+		let tier = 0;
+		let isDecided = true;
+		if (rule.parent) {
+			if (requester?.name === void 0 || requester.name !== rule.parent.name) continue;
+			if (rule.parent.range) {
+				if (requester.version === void 0) continue;
+				const includes = rangeIncludes(rule.parent.range, requester.version);
+				if (includes === false) continue;
+				isDecided &&= includes === true;
+				tier = 4;
+			} else tier = 2;
+		}
+		if (rule.targetRange) {
+			const selects = declared ? rangeSelects(rule.targetRange, declared) : false;
+			if (selects === false) continue;
+			isDecided &&= selects === true;
+			tier += 1;
+		}
+		const ranked = {
+			rule,
+			tier
+		};
+		if (!isDecided) {
+			if (!undecided || outranks(ranked, undecided)) undecided = ranked;
+		} else if (!best || outranks(ranked, best)) best = ranked;
+	}
+	if (undecided && (!best || outranks(undecided, best))) throw new BunLockFormatError(`Cannot tell whether bun.lock override ${undecided.rule.key} applies to ${name} declared as ${JSON.stringify(declaredRange)}; this tool cannot compare these ranges as Bun does, so change the override in package.json so that no range comparison is needed, such as by removing the range from its key or adding a rule scoped to the parent package, and run bun install`);
+	if (best) return best.rule.value;
+	return isAlias ? void 0 : rules.flat.get(name);
+}
+/** Whether a rule wins over another as Bun decides: by tier, then by the parent range text, then by the target range text. */
+function outranks(left, right) {
+	if (left.tier !== right.tier) return left.tier > right.tier;
+	const leftParent = left.rule.parent?.range && left.rule.parent.rangeText;
+	const rightParent = right.rule.parent?.range && right.rule.parent.rangeText;
+	return ((leftParent && rightParent ? compareText(leftParent, rightParent) : 0) || compareText(left.rule.targetRangeText, right.rule.targetRangeText)) < 0;
+}
+function compareText(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+/**
+* Whether an override key `name@range` selects a declaration, as npm and pnpm do: the two ranges overlap.
+*
+* Returns `undefined` when the tools cannot tell.
+*/
+function rangeSelects(range, declared) {
+	if (range.kind === "catalog" || declared.kind === "catalog") return range.kind === "catalog" && declared.kind === "catalog" && isSameCatalog(range, declared);
+	if (range.kind !== "semver" || range.alias !== declared.alias) return false;
+	return declared.kind === "semver" ? rangesIntersect(range.range, declared.range) : void 0;
+}
+/** Whether two catalog references name the same catalog; `catalog:` and `catalog:default` are the default one. */
+function isSameCatalog(left, right) {
+	const isDefault = (catalog) => catalog === "" || catalog === "default";
+	return left.catalog === right.catalog || isDefault(left.catalog) && isDefault(right.catalog);
 }
 /** Whether a version of an `npm:` alias is a dist-tag, such as `latest`, rather than a range or a source. */
 function isDistTag(version) {
-	return /^[^\s:/#@]+$/.test(version) && semver.validRange(version) === null;
+	return /^[^\s:/#@|]+$/.test(version) && isNpmRangeSpecifier(version) === false;
 }
 /**
 * Return the range Bun actually enforces for a dependency request.
@@ -119,10 +762,18 @@ function isDistTag(version) {
 * An override remains authoritative even when it is not valid semver;
 * compatibility then stays unknown instead of falling back to the declaration.
 */
-function effectiveDependencyRange(lock, dependencyName, declaredRange) {
-	const overrideRange = dependencyOverrideRange(lock, dependencyName, declaredRange);
+function effectiveDependencyRange(lock, requester, dependencyName, declaredRange) {
+	const overrideRange = dependencyOverrideRange(lock, requester, dependencyName, declaredRange);
 	return overrideRange === void 0 ? declaredRange : overrideRange;
 }
+/**
+* Tell whether the range of an override parent selector `parent@range` selects a package version, as Bun 1.4.4 matches it,
+* or `undefined` when the tools cannot tell.
+*/
+function overrideParentRangeIncludes(range, version) {
+	const parsed = parseBunRange(range);
+	return parsed && rangeIncludes(parsed, version);
+}
 // ../lockfile/src/render.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -182,6 +833,36 @@ function renderObjectLines(value, indentLevel, allowPackagesFormatting) {
 function renderBunLock(lock) {
 	return `${renderObjectLines(lock, 0, true).join("\n")}\n`;
 }
+// ../lockfile/src/requester.ts
+/**
+* Return the override requester for a package entry with the given spec.
+*
+* As in Bun, only a registry package and a workspace other than the root have a version;
+* a git, tarball, or local package has none, so a parent selector with a range never matches it.
+*/
+function packageOverrideRequester(lock, spec) {
+	const resolved = parseResolvedSpec(spec);
+	if (!resolved) return {};
+	if (resolved.version.startsWith("workspace:")) {
+		const workspace = Object.entries(lock.workspaces ?? {}).find(([workspacePath, { name }]) => workspacePath !== "" && name === resolved.name);
+		return {
+			name: resolved.name,
+			version: workspace?.[1].version
+		};
+	}
+	return {
+		name: resolved.name,
+		version: semver.valid(resolved.version) ?? void 0
+	};
+}
+/** Return the override requester for the workspace at the given path; the root workspace has no version. */
+function workspaceOverrideRequester(lock, workspacePath) {
+	const workspace = lock.workspaces?.[workspacePath];
+	return {
+		name: workspace?.name,
+		version: workspacePath === "" ? void 0 : workspace?.version
+	};
+}
 // ../lockfile/src/resolve.ts
 /**
 * Tell whether a lock key is a nested entry of a dependency: the last of several package names in the key.
@@ -330,11 +1011,13 @@ function resolveOverrideValue(manifest, name, value, source = "package.json") {
 /**
 * Returns the host root `package.json` with the configured root fields of the nested `package.json` merged in.
 *
-* A nested entry replaces a host entry with the same name, while the other host entries stay.
+* A nested entry replaces a host entry with the same key, while the other host entries stay.
 * Entries synced earlier and dropped by the nested repository are removed.
 * Throws when the host and the nested repository patch the same package version,
 * when either side defines `resolutions` while `overrides` are synced,
-* and when a synced `$name` override would refer to another range in the host root than in the nested root.
+* when an override is one that `readManifestOverrides` rejects, when two overrides select the same packages,
+* when a synced `$name` override would refer to another range in the host root than in the nested root,
+* and when a synced override selects the nested root by a range that its version satisfies.
 */
 function syncManifest(host, nested) {
 	const config = readConfig(host);
@@ -370,12 +1053,17 @@ function syncManifest(host, nested) {
 	manifest = setCatalogs(manifest, catalogs);
 	if (config.fields.includes("overrides")) {
 		for (const [source, resolutions] of [["The host package.json", host.resolutions], [`${config.dir}/package.json`, nested.resolutions]]) if (resolutions && Object.keys(resolutions).length) throw new Error(`${source} defines "resolutions", which Bun ignores once "overrides" is defined; move its entries to "overrides"`);
-		for (const [name, value] of Object.entries(nested.overrides ?? {})) {
-			const nestedRange = resolveOverrideValue(nested, name, value, `${config.dir}/package.json`);
+		const nestedSource = `${config.dir}/package.json`;
+		const nestedRules = readManifestOverrides(nested.overrides ?? {}, (name, value) => {
+			const nestedRange = resolveOverrideValue(nested, name, value, nestedSource);
 			const hostRanges = getDeclaredRanges(host, name);
-			if (value.startsWith("$") && (hostRanges.length !== 1 || hostRanges[0] !== nestedRange)) throw new Error(`${config.dir}/package.json override ${JSON.stringify(name)}: ${JSON.stringify(value)} refers to ${JSON.stringify(nestedRange)} in the nested root, but the host root ${hostRanges.length ? `declares ${hostRanges.map((range) => JSON.stringify(range)).join(", ")}` : "does not declare it"}; replace it with an explicit range`);
-		}
+			if (value.startsWith("$") && (hostRanges.length !== 1 || hostRanges[0] !== nestedRange)) throw new Error(`${nestedSource} override ${JSON.stringify(name)}: ${JSON.stringify(value)} refers to ${JSON.stringify(nestedRange)} in the nested root, but the host root ${hostRanges.length ? `declares ${hostRanges.map((range) => JSON.stringify(range)).join(", ")}` : "does not declare it"}; replace it with an explicit range`);
+			return nestedRange;
+		}, nestedSource);
+		for (const { key, parent } of nestedRules) if (parent?.range && parent.name === nested.name && typeof nested.version === "string" && overrideParentRangeIncludes(parent.range, nested.version) !== false) throw new Error(`${nestedSource} override ${key} selects the nested root ${parent.name}@${nested.version} by a version range, which applies in the host but not in the nested repository; remove the range`);
 		const merged = mergeEntries("overrides", host.overrides, nested.overrides, synced.overrides);
+		const [replaced] = findReplacedOverrideRules(readManifestOverrides(merged.entries, (_, value) => value));
+		if (replaced) throw new Error(`The overrides ${replaced[0].key} and ${replaced[1].key} select the same packages, so Bun applies one of them depending on the order of the keys; keep one of them`);
 		manifest.overrides = merged.entries;
 		synced.overrides = merged.synced;
 		overridden.push(...merged.overridden);
@@ -404,14 +1092,15 @@ function syncManifest(host, nested) {
 	};
 }
 /**
-* Merges name-keyed entries of one field.
+* Merges the entries of one field by their keys.
 *
 * Host entries outside `synced` are the host's own.
 * An own entry equal to the nested one stays own, so it survives if the nested repository drops it later.
 */
 function mergeEntries(field, host = {}, nested = {}, synced = []) {
 	const own = Object.fromEntries(Object.entries(host).filter(([name]) => !synced.includes(name)));
-	const overridden = Object.entries(nested).filter(([name, value]) => name in own && own[name] !== value).map(([name, nestedValue]) => ({
+	const isOwn = (name) => name in own && isSameValue(own[name], nested[name]);
+	const overridden = Object.entries(nested).filter(([name]) => name in own && !isOwn(name)).map(([name, nestedValue]) => ({
 		field,
 		name,
 		hostValue: own[name],
@@ -422,10 +1111,15 @@ function mergeEntries(field, host = {}, nested = {}, synced = []) {
 			...own,
 			...nested
 		}),
-		synced: Object.keys(nested).filter((name) => own[name] !== nested[name]).sort(),
+		synced: Object.keys(nested).filter((name) => !isOwn(name)).sort(),
 		overridden
 	};
 }
+/** Returns whether two entry values are equal, ignoring the key order of groups. */
+function isSameValue(left, right) {
+	const toText = (value) => typeof value === "string" ? value : JSON.stringify(sortKeys(value));
+	return typeof left === typeof right && toText(left) === toText(right);
+}
 /** Merges host patches with the nested patches, rewriting nested patch paths through the nested directory. */
 function mergePatches(host = {}, nested = {}, dir) {
 	const own = Object.entries(host).filter(([, patch]) => !isNestedPath(path.posix.normalize(patch), dir));
@@ -483,7 +1177,11 @@ function isRecord(value) {
 *
 * The format is internal to Bun, so other versions are rejected instead of being rewritten blindly.
 */
-const supportedLockfileVersions = [1, 2];
+const supportedLockfileVersions = [
+	1,
+	2,
+	3
+];
 /** Parses `bun.lock` text and rejects lockfile versions outside `supportedLockfileVersions`. */
 function parseLockfile(text, source = "bun.lock") {
 	let lock;
@@ -535,14 +1233,14 @@ function relocateResolution(resolution, dir) {
 *
 * `bun install` re-resolves dependencies whose catalog entry, override, or patch differs from the lockfile,
 * so the merged lockfile must already record the synced root fields to keep the nested resolutions.
-* Records `$name` overrides with the range they refer to, as Bun does, and throws when `resolveOverrideValue` does.
+* Records overrides in the form that Bun writes to `bun.lock`, with `$name` values replaced by the range they refer to.
 */
 function applyManifestToLockfile(lock, manifest) {
 	const { catalog, catalogs } = getCatalogs(manifest);
 	const fields = {
 		catalog,
 		catalogs,
-		overrides: manifest.overrides && Object.fromEntries(Object.entries(manifest.overrides).map(([name, value]) => [name, resolveOverrideValue(manifest, name, value)])),
+		overrides: manifest.overrides && toLockfileOverrides(manifest),
 		patchedDependencies: manifest.patchedDependencies
 	};
 	const result = { ...lock };
@@ -551,6 +1249,34 @@ function applyManifestToLockfile(lock, manifest) {
 	return result;
 }
 /**
+* Returns the `bun.lock` `overrides` section for the overrides of a root `package.json`, as Bun writes it.
+*
+* Replaces `$name` values with the range they refer to, and throws when `readManifestOverrides` or `resolveOverrideValue` does.
+*/
+function toLockfileOverrides(manifest, source = "package.json") {
+	return renderLockfileOverrides(readManifestOverrides(manifest.overrides ?? {}, (target, value) => resolveOverrideValue(manifest, target, value, source), source));
+}
+/**
+* Throws when a lockfile does not record the `overrides` of its root `package.json` as Bun reads them.
+*
+* Bun skips with a warning an override whose value is not a dependency spec it can parse, such as a malformed git URL,
+* and it resolves every dependency again when it finds such an override in the lockfile.
+* The lockfile that Bun wrote tells which overrides it read; a difference can also mean that the lockfile is outdated.
+* Checks nothing when `package.json` has no `overrides` field, because Bun then records `resolutions` there.
+*/
+function assertOverridesRecorded(manifest, lock, sources) {
+	if (!manifest.overrides) return;
+	const expected = toLockfileOverrides(manifest, sources.manifest);
+	const recorded = lock.overrides ?? {};
+	const toText = (overrides, key) => {
+		if (!Object.hasOwn(overrides, key)) return void 0;
+		const value = overrides[key];
+		return JSON.stringify(typeof value === "string" ? value : Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
+	};
+	const differences = [.../* @__PURE__ */ new Set([...Object.keys(expected), ...Object.keys(recorded)])].filter((key) => toText(expected, key) !== toText(recorded, key)).sort();
+	if (differences.length) throw new Error(`${sources.lock} does not record the overrides of ${sources.manifest} as Bun reads them: ${differences.map((key) => JSON.stringify(key)).join(", ")}. Either Bun skipped an override that it cannot parse, which it warns about on install, or the lockfile is outdated; fix the override and update the lockfile with bun install`);
+}
+/**
 * Merges the host lockfile with the relocated nested lockfile.
 *
 * Nested entries override host entries, so the nested packages keep the versions of the nested lockfile.
@@ -562,8 +1288,9 @@ function applyManifestToLockfile(lock, manifest) {
 * so `bun install` resolves its dependency again.
 * When the previous host resolution does not satisfy the range either, which Bun lockfiles occasionally contain,
 * the dependency gets the highest satisfying version recorded in either lockfile.
-* Catalog dependencies are checked against the catalogs of the host lockfile, so apply the synced root fields
+* Dependencies are checked against the catalogs and overrides of the host lockfile, so apply the synced root fields
 * to it first.
+* The result has the higher `lockfileVersion` of the two, or version 1 when it has an entry that needs that version.
 */
 function mergeLockfiles(lock, nestedLock, dir) {
 	const nestedNames = /* @__PURE__ */ new Set([...Object.keys(nestedLock.packages), ...Object.values(nestedLock.workspaces).flatMap((workspace) => workspace.name ?? [])]);
@@ -573,18 +1300,25 @@ function mergeLockfiles(lock, nestedLock, dir) {
 		...nestedLock.packages
 	};
 	const hostWorkspaces = Object.entries(lock.workspaces).filter(([workspacePath]) => !isNestedPath(workspacePath, dir));
+	const workspaces = {
+		...Object.fromEntries(hostWorkspaces),
+		...nestedLock.workspaces
+	};
 	if (lock.workspaces[""]) keepHostRootResolutions(lock, nestedLock, packages);
+	const toPackageDependent = (key, entry) => ({
+		key,
+		requester: packageOverrideRequester({ workspaces }, entry[0]),
+		dependencies: getPackageDependencies(entry)
+	});
 	const dependents = [...hostWorkspaces.flatMap(([workspacePath, workspace]) => workspacePath && workspace.name ? [{
 		key: workspace.name,
+		requester: workspaceOverrideRequester({ workspaces }, workspacePath),
 		dependencies: getWorkspaceDependencies(workspace)
-	}] : []), ...Object.keys(packages).map((key) => ({
-		key,
-		dependencies: getPackageDependencies(packages[key])
-	}))];
+	}] : []), ...Object.keys(packages).map((key) => toPackageDependent(key, packages[key]))];
 	for (let index = 0; index < dependents.length; index++) {
-		const { key, dependencies } = dependents[index];
+		const { key, requester, dependencies } = dependents[index];
 		for (const [dependency, specifier] of Object.entries(dependencies)) {
-			const requirement = getRequirement(lock, dependency, specifier);
+			const requirement = getRequirement(lock, requester, dependency, specifier);
 			const resolved = resolveDependencyLockKey(key, dependency, packages);
 			if (!requirement || !resolved || satisfies(packages[resolved], requirement)) continue;
 			const previous = resolveDependencyLockKey(key, dependency, lock.packages);
@@ -592,19 +1326,14 @@ function mergeLockfiles(lock, nestedLock, dir) {
 			if (!replacement) continue;
 			const nestedKey = `${key}/${dependency}`;
 			packages[nestedKey] = replacement;
-			dependents.push({
-				key: nestedKey,
-				dependencies: getPackageDependencies(replacement)
-			});
+			dependents.push(toPackageDependent(nestedKey, replacement));
 		}
 	}
+	const version = Math.max(lock.lockfileVersion, nestedLock.lockfileVersion);
 	return {
 		...lock,
-		lockfileVersion: Math.max(lock.lockfileVersion, nestedLock.lockfileVersion),
-		workspaces: {
-			...Object.fromEntries(hostWorkspaces),
-			...nestedLock.workspaces
-		},
+		lockfileVersion: version > 1 && Object.values(packages).some(needsLockfileVersion1) ? 1 : version,
+		workspaces,
 		packages
 	};
 }
@@ -620,8 +1349,9 @@ function mergeLockfiles(lock, nestedLock, dir) {
 */
 function keepHostRootResolutions(lock, nestedLock, packages) {
 	const replaced = /* @__PURE__ */ new Set();
+	const rootRequester = workspaceOverrideRequester(lock, "");
 	for (const [dependency, specifier] of Object.entries(getWorkspaceDependencies(lock.workspaces[""]))) {
-		const requirement = getRequirement(lock, dependency, specifier);
+		const requirement = getRequirement(lock, rootRequester, dependency, specifier);
 		const nestedEntry = Object.hasOwn(nestedLock.packages, dependency) ? nestedLock.packages[dependency] : void 0;
 		if (!requirement || !nestedEntry || satisfies(nestedEntry, requirement)) continue;
 		const previous = Object.hasOwn(lock.packages, dependency) ? lock.packages[dependency] : void 0;
@@ -684,11 +1414,12 @@ function getPackageDependencies(entry) {
 /**
 * Returns the package and version range that a dependency specifier requires.
 *
-* An override replaces the specifier, as `bun install` applies it to direct and transitive dependencies alike.
+* An override replaces the specifier, as `bun install` applies it to direct and transitive dependencies alike;
+* `requester` is the package that declares the dependency.
 * Returns `undefined` for specifiers that do not resolve by version, such as `workspace:` or git URLs.
 */
-function getRequirement(lock, dependency, specifier) {
-	return parseRequirement(lock, dependency, effectiveDependencyRange(lock, dependency, specifier));
+function getRequirement(lock, requester, dependency, specifier) {
+	return parseRequirement(lock, dependency, effectiveDependencyRange(lock, requester, dependency, specifier));
 }
 /** Resolves `catalog:` specifiers and `npm:` aliases of `getRequirement`. */
 function parseRequirement(lock, dependency, specifier) {
@@ -715,12 +1446,12 @@ function satisfies(entry, requirement) {
 	return spec?.name === requirement.name && Bun.semver.satisfies(spec.version, requirement.range);
 }
 /**
-* Returns whether a lockfile entry satisfies the specifier of a dependency on it.
+* Returns whether a lockfile entry satisfies the specifier of a dependency on it, declared by `requester`.
 *
 * Specifiers that do not resolve by version, such as `workspace:` or git URLs, are always satisfied.
 */
-function satisfiesSpecifier(lock, dependency, specifier, entry) {
-	const requirement = getRequirement(lock, dependency, specifier);
+function satisfiesSpecifier(lock, requester, dependency, specifier, entry) {
+	const requirement = getRequirement(lock, requester, dependency, specifier);
 	return requirement === void 0 || satisfies(entry, requirement);
 }
 /** Splits a lockfile package key into the package names of its nesting chain. */
@@ -830,9 +1561,10 @@ function findTransitiveMismatches(lock, nestedLock) {
 		const { path, nestedKey, hostKey } = queue[index];
 		const entry = nestedLock.packages[nestedKey];
 		if (entry[0].includes("@workspace:")) continue;
+		const requester = packageOverrideRequester(nestedLock, entry[0]);
 		for (const [dependency, specifier] of Object.entries(getPackageDependencies(entry))) {
 			const nestedDependencyKey = resolveDependencyLockKey(nestedKey, dependency, nestedLock.packages);
-			if (!nestedDependencyKey || !satisfiesSpecifier(nestedLock, dependency, specifier, nestedLock.packages[nestedDependencyKey])) continue;
+			if (!nestedDependencyKey || !satisfiesSpecifier(nestedLock, requester, dependency, specifier, nestedLock.packages[nestedDependencyKey])) continue;
 			const hostDependencyKey = resolveDependencyLockKey(hostKey, dependency, lock.packages);
 			const pair = `${nestedDependencyKey}\0${hostDependencyKey}`;
 			if (visited.has(pair)) continue;
@@ -864,6 +1596,7 @@ function findTransitiveMismatches(lock, nestedLock) {
 */
 function findOwnDependencyChanges(before, after, nestedLock, dir) {
 	return [...new Map([...Object.entries(before.workspaces), ...Object.entries(after.workspaces)].filter(([workspacePath]) => !isNestedPath(workspacePath, dir)))].flatMap(([workspacePath, workspace]) => {
+		const requester = workspaceOverrideRequester(Object.hasOwn(after.workspaces, workspacePath) ? after : before, workspacePath);
 		const specifiers = {
 			...getWorkspaceDependencies(before.workspaces[workspacePath] ?? {}),
 			...getWorkspaceDependencies(after.workspaces[workspacePath] ?? {})
@@ -873,7 +1606,7 @@ function findOwnDependencyChanges(before, after, nestedLock, dir) {
 			const expected = resolveDependency(before, workspace.name, dependency);
 			const actual = resolveDependency(after, workspace.name, dependency);
 			const nestedEntry = nestedLock.packages[dependency];
-			if (actual === expected || actual !== void 0 && actual === nestedEntry?.[0] && satisfiesSpecifier(after, dependency, specifier, nestedEntry)) return [];
+			if (actual === expected || actual !== void 0 && actual === nestedEntry?.[0] && satisfiesSpecifier(after, requester, dependency, specifier, nestedEntry)) return [];
 			return [{
 				workspace: workspace.name ?? workspacePath,
 				dependency,
@@ -1015,6 +1748,15 @@ async function syncNestedWorkspace(root, options = {}) {
 	assertWorkspacesCovered(workspace);
 	const manifestSync = syncManifest(workspace.manifest, workspace.nestedManifest);
 	const { manifest } = manifestSync;
+	const { dir, fields } = workspace.config;
+	assertOverridesRecorded(workspace.manifest, workspace.lock, {
+		manifest: "package.json",
+		lock: "bun.lock"
+	});
+	if (fields.includes("overrides")) assertOverridesRecorded(workspace.nestedManifest, workspace.nestedLock, {
+		manifest: `${dir}/package.json`,
+		lock: `${dir}/bun.lock`
+	});
 	const merged = mergeLockfiles(applyManifestToLockfile(workspace.lock, manifest), workspace.nestedLock, workspace.config.dir);
 	const manifestPath = path.join(root, "package.json");
 	const lockPath = path.join(root, "bun.lock");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bun-nested-workspace",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Embed a checkout of another Bun workspace repository into a Bun workspace and keep the root package.json and bun.lock in sync with it",
   "keywords": [
     "bun",