checkly 8.22.0 → 8.23.0

package/dist/services/check-parser/bundler.js

@@ -5,12 +5,24 @@ import { tmpdir } from 'node:os';
 import path from 'node:path';
 import Debug from 'debug';
 import * as uuid from 'uuid';
+import { createHash } from 'node:crypto';
 import { checklyStorage } from '../../rest/api.js';
 import { PayloadTooLargeError } from '../../rest/errors.js';
 import { EMBEDDED_PACKAGES_ARCHIVE_DIR } from '../embedded-packages/materializer.js';
-import { computeWorkspaceCacheHash } from './cache-hash.js';
+import { filterTarballsByLockfile } from '../embedded-packages/lockfile-filter.js';
+import { composeWorkspaceCacheHash, canonicalizePackageJson, loadWorkspaceCacheHashInputs, PACKAGE_JSON_EXCLUDED_FIELDS, } from './cache-hash.js';
+import { lockfileArchivePath, manifestArchivePath, pruneBundledLockfile } from './lockfile-pruner.js';
+import { normalizePackagePrune, prunePackageJson, } from './package-prune.js';
+import { findUnrepairedPatchKeys, isRemovablePatchPath, planPatchFilter, } from './patched-dependencies.js';
+import { REGISTRIES_ARCHIVE_PATH, serializeRegistries, validateRegistries } from '../runner/registries.js';
 import { pathToPosix } from '../util.js';
 const debug = Debug('checkly:cli:services:check-parser:bundler');
+/**
+ * The files pnpm accepts `patchedDependencies` in, which are also their
+ * archive paths: both live at the workspace root, and the workspace root is
+ * the bundle's strip prefix (see {@link Bundler.createForWorkspace}).
+ */
+const PATCH_CONFIG_KINDS = ['pnpm-workspace.yaml', 'package.json'];
 /**
  * Where a file goes in the archive. A file usually lands at its own path
  * relative to the bundle root, but a file bundled at the path of a symlink that
@@ -305,35 +317,100 @@ export class RemoteBundleArchive {
         return this.#key;
     }
 }
+/**
+ * Maps planned tarballs to cache-hash records. yarn.lock plans carry no SRI
+ * tarball integrity (it is resolved from registry metadata only at
+ * materialization time), so their records use the lockfile's own checksum —
+ * an equally stable content pin that is known at plan time, keeping the
+ * eager placeholder hash and the finalize hash consistent. The parsers
+ * guarantee one of the two hashes is always present; the empty-string
+ * fallback only satisfies the type.
+ */
+export function embeddedPackageHashInputs(tarballs) {
+    return tarballs?.map(({ name, version, integrity, lockfileChecksum }) => ({
+        name,
+        version,
+        integrity: integrity ?? lockfileChecksum ?? '',
+    }));
+}
 export class Bundler {
     #id;
     #marker;
-    #cacheHash;
+    #cacheHashMarker;
     #tempDir;
     #stripPrefix;
+    #workspaceContext;
     #files = new Map();
+    /**
+     * Archive paths of manifests a finalize-time rewrite replaced — package
+     * pruning (`bundle.packages.prune`) or the patch filtering. Unlike a
+     * synthesized member manifest, a rewritten manifest has an on-disk original,
+     * so it is hashed the way on-disk manifests are — with `version` stripped —
+     * rather than verbatim. Hashing the raw bytes would make a release bump
+     * alone change the dependency cache key even though no install input did.
+     */
+    #rewrittenManifests = new Set();
     constructor(options) {
-        const { tempDir, cacheHash, stripPrefix, } = options;
+        const { tempDir, cacheHash, stripPrefix, workspaceContext, } = options;
         this.#id = uuid.v4();
         this.#marker = new BundlePathMarker(`bundle:${this.#id}`);
-        this.#cacheHash = cacheHash;
+        this.#cacheHashMarker = new CacheHashMarker(cacheHash);
         this.#stripPrefix = stripPrefix;
         this.#tempDir = tempDir;
+        this.#workspaceContext = workspaceContext;
     }
+    /**
+     * Creates a bundler without a workspace context. Workspace-dependent
+     * finalize() behavior — lockfile pruning, embedded package
+     * materialization (`bundle.packages.embed`) and the cache-hash recompute
+     * — only happens for bundlers built with {@link createForWorkspace}; a
+     * plain bundler archives exactly the files registered into it.
+     */
     // eslint-disable-next-line require-await
     static async create(options) {
         debug(`Creating bundler`);
         return new Bundler(options);
     }
-    static async createForWorkspace(workspace, options = {}) {
+    static async createForWorkspace(workspace, options) {
         debug(`Creating bundler for workspace`);
-        const { tempDir, dependencyCacheVersion, embeddedPackagesMaterializer, } = options;
+        const { tempDir, dependencyCacheVersion, embeddedPackagesMaterializer, packageManager, packagePrune, runnerRegistries, } = options;
         const embeddedPackages = (await embeddedPackagesMaterializer?.plan())?.tarballs;
-        const cacheHash = await computeWorkspaceCacheHash(workspace, { dependencyCacheVersion, embeddedPackages });
+        // Serialized once so the eager cache hash below, the finalize()
+        // recompute and the registered bundle file all agree on the exact
+        // bytes. Re-validated on entry like `normalizePackagePrune` is — the
+        // config loader has already validated config-sourced values, but
+        // programmatic callers reach this constructor directly.
+        const runnerRegistriesContent = runnerRegistries !== undefined
+            ? serializeRegistries(validateRegistries(runnerRegistries))
+            : undefined;
+        const runnerRegistriesDigest = runnerRegistriesContent !== undefined
+            ? createHash('sha256').update(runnerRegistriesContent, 'utf8').digest()
+            : undefined;
+        // The composition is captured so finalize() can recompute the hash with
+        // bundle-time additions (faux manifests, a pruned lockfile) from the
+        // same workspace inputs, loaded once. The eager value below is only a
+        // placeholder for the window before finalize() runs — finalize() always
+        // recomputes it.
+        const cacheHashInputs = await loadWorkspaceCacheHashInputs(workspace);
+        const composeCacheHash = (extra) => {
+            return composeWorkspaceCacheHash(cacheHashInputs, {
+                dependencyCacheVersion,
+                runnerRegistries: runnerRegistriesDigest,
+                ...extra,
+            });
+        };
         return new Bundler({
             tempDir,
-            cacheHash,
+            cacheHash: composeCacheHash({ embeddedPackages: embeddedPackageHashInputs(embeddedPackages) }),
             stripPrefix: workspace?.root.path,
+            workspaceContext: {
+                workspace,
+                packageManager,
+                embeddedPackagesMaterializer,
+                packagePrune: normalizePackagePrune(packagePrune),
+                runnerRegistriesContent,
+                composeCacheHash,
+            },
         });
     }
     get marker() {
@@ -342,8 +419,15 @@ export class Bundler {
     updateMarker(newValue) {
         this.#marker.updateValue(newValue);
     }
+    /**
+     * The dependency cache hash. A mutable holder rather than a plain string:
+     * consumers copy it into check payloads during bundle(), but the final
+     * value — reflecting faux manifests and a possibly pruned lockfile — is
+     * only known once finalize() has run, the same ordering problem
+     * {@link BundlePathMarker} solves for the archive path.
+     */
     get cacheHash() {
-        return this.#cacheHash;
+        return this.#cacheHashMarker;
     }
     /**
      * Whether any files have been registered for bundling. Only Playwright check
@@ -369,7 +453,460 @@ export class Bundler {
             this.#files.set(key, newFile);
         }
     }
+    /**
+     * Prunes the bundled lockfile to match the bundle's final file set,
+     * materializes the embedded package tarballs the (possibly pruned)
+     * lockfile still references, and recomputes the cache hash from the
+     * bundle's actual install inputs (faux manifests, the pruned lockfile and
+     * the shipped embedded set). Runs at finalize time because all of it
+     * depends on the complete file set, which only exists once every check
+     * has registered its files — and because materializing after pruning is
+     * what keeps pruned-away tarballs from ever being downloaded.
+     */
+    async #refreshWorkspaceBundle() {
+        const context = this.#workspaceContext;
+        if (context === undefined) {
+            return;
+        }
+        const prunedManifestOriginals = await this.#pruneManifestPackages(context);
+        const lockfilePrune = await this.#pruneLockfile(context);
+        const pruned = await this.#dropUnusedPatches(context, lockfilePrune.pruned);
+        // Pruned manifests must never ship alongside an unpruned lockfile: the
+        // lockfile's importer sections would declare dependencies the shipped
+        // manifests lack, failing the runner's frozen install. When lockfile
+        // pruning skipped or failed for any reason, roll the manifest rewrite
+        // back — unless the skip itself proved the original lockfile already
+        // matches the pruned manifests (a byte-identical regeneration), or the
+        // bundle ships no lockfile at all, in which case the manifests are the
+        // install's only input and nothing can fall out of sync.
+        if (pruned === undefined
+            && !lockfilePrune.consistent
+            && prunedManifestOriginals.size > 0
+            && this.#bundledLockfilePath(context) !== undefined) {
+            for (const [manifestPath, original] of prunedManifestOriginals) {
+                this.#files.set(manifestPath, original);
+                this.#rewrittenManifests.delete(manifestPath);
+            }
+            process.stderr.write(`Warning: bundle.packages.prune was not applied because the bundled lockfile could `
+                + `not be pruned to match; the original manifests ship unchanged.\n`);
+        }
+        const embeddedPackages = await this.#materializeEmbeddedPackages(context, pruned);
+        this.#registerRunnerRegistries(context);
+        const fauxPackageJsons = [];
+        for (const [archivePath, file] of this.#files) {
+            if (file.physical || path.posix.basename(archivePath) !== 'package.json') {
+                continue;
+            }
+            const raw = Buffer.from(file.content, 'utf8');
+            fauxPackageJsons.push({
+                path: archivePath,
+                raw: this.#rewrittenManifests.has(archivePath)
+                    ? canonicalizePackageJson(raw, PACKAGE_JSON_EXCLUDED_FIELDS)
+                    : raw,
+            });
+        }
+        // Unconditional: with no faux manifests, no pruned lockfile and an
+        // unfiltered embedded set this reproduces the exact digest computed in
+        // createForWorkspace (empty record groups write nothing).
+        this.#cacheHashMarker.updateValue(context.composeCacheHash({
+            fauxPackageJsons,
+            prunedLockfile: pruned,
+            embeddedPackages: embeddedPackageHashInputs(embeddedPackages),
+        }));
+    }
+    /**
+     * Registers the serialized `runner.registries` configuration into the
+     * bundle at {@link REGISTRIES_ARCHIVE_PATH}. The path is CLI-managed:
+     * runners honor whatever lands there, so a pre-existing entry — a
+     * hand-written file an `include` glob dragged in, which has passed no
+     * validation and contributes nothing to the cache hash — is dropped
+     * rather than shipped, whether or not the option is set. Set directly
+     * rather than through `registerFiles`, whose prefer-physical rule
+     * would keep such a file. Skipped when the bundle is empty: the
+     * project then has no Playwright Check Suite, nothing is uploaded, and
+     * registering the file would make `isEmpty` misreport.
+     */
+    #registerRunnerRegistries(context) {
+        if (this.#files.delete(REGISTRIES_ARCHIVE_PATH)) {
+            process.stderr.write(`Warning: ${REGISTRIES_ARCHIVE_PATH} is generated from the 'runner.registries' config `
+                + `field and cannot be supplied as a project file; the included file was dropped.\n`);
+        }
+        const content = context.runnerRegistriesContent;
+        if (content === undefined || this.isEmpty) {
+            return;
+        }
+        this.#files.set(REGISTRIES_ARCHIVE_PATH, {
+            // A virtual file's archive path is derived from its filePath
+            // relative to the strip prefix, so the filePath must sit under it.
+            filePath: path.join(this.#stripPrefix ?? '', REGISTRIES_ARCHIVE_PATH),
+            physical: false,
+            content,
+        });
+    }
+    /**
+     * Applies `bundle.packages.prune` to the workspace manifests in the
+     * bundle — the root's and every bundled member's — replacing each
+     * affected entry with a rewritten virtual copy. Runs before lockfile
+     * pruning so the lockfile-only install resolves against the reduced
+     * manifests and the removed dependencies fall out of the pruned lockfile.
+     * Only manifests at the workspace's own locations are touched: a
+     * package.json an `include` glob dragged in is not an install input.
+     *
+     * Returns the replaced original entries, keyed by archive path, so
+     * {@link Bundler.refreshWorkspaceBundle} can roll the rewrite back when
+     * the bundled lockfile cannot be pruned to match.
+     */
+    async #pruneManifestPackages(context) {
+        const replaced = new Map();
+        const prune = context.packagePrune;
+        if (prune === undefined) {
+            return replaced;
+        }
+        const { workspace } = context;
+        for (const pkg of [workspace.root, ...workspace.packages]) {
+            const manifestPath = manifestArchivePath(workspace, pkg);
+            const file = this.#files.get(manifestPath);
+            if (file === undefined) {
+                continue;
+            }
+            if (!file.physical) {
+                // The only virtual member manifests are synthesized ones (faux
+                // shims), which carry no dependency classes — and only a rewrite
+                // of a physical original may join #rewrittenManifests, whose
+                // consumers rely on the rewritten content being the real manifest.
+                debug(`Not pruning ${manifestPath}: not a physical manifest`);
+                continue;
+            }
+            if (file.symlinkTarget !== undefined) {
+                this.#warnManifestPruneFailure(manifestPath, `the manifest is bundled as a symlink`);
+                continue;
+            }
+            // A virtual entry's archive name is always derived from its filePath,
+            // so a replacement can only stand in for an entry that already
+            // archives at that derived path (same rule as #readPatchConfigs).
+            const replacementArchivePath = pathToPosix(path.relative(this.#stripPrefix ?? '', file.filePath));
+            if (replacementArchivePath !== manifestPath) {
+                this.#warnManifestPruneFailure(manifestPath, `the rewritten manifest would move to ${replacementArchivePath}`);
+                continue;
+            }
+            let content;
+            try {
+                content = await fs.readFile(file.filePath, 'utf8');
+            }
+            catch (err) {
+                this.#warnManifestPruneFailure(manifestPath, `the bundled manifest could not be read (${err})`);
+                continue;
+            }
+            const result = prunePackageJson(content, prune);
+            if (result === undefined) {
+                this.#warnManifestPruneFailure(manifestPath, `the manifest could not be rewritten safely`);
+                continue;
+            }
+            if (!result.changed) {
+                // Left physical: the entry hashes and ships exactly as before, and
+                // an untouched manifest must not force lockfile pruning.
+                continue;
+            }
+            replaced.set(manifestPath, file);
+            this.#files.set(manifestPath, {
+                // The archive name is derived from filePath, so the rewritten entry
+                // has to keep the original's.
+                filePath: file.filePath,
+                physical: false,
+                content: result.content,
+            });
+            this.#rewrittenManifests.add(manifestPath);
+            debug(`Pruned ${manifestPath}: ${result.removed.join(', ') || '(structural cleanup only)'}`);
+        }
+        return replaced;
+    }
+    #warnManifestPruneFailure(manifestPath, reason) {
+        // A stderr warning rather than a debug line: pruning is a user-requested
+        // transformation, and silently shipping the original manifest
+        // reintroduces the exact lockfile bloat the user configured it to
+        // remove.
+        process.stderr.write(`Warning: could not apply bundle.packages.prune to ${manifestPath}: ${reason}; `
+            + `its original contents ship unchanged.\n`);
+    }
+    /**
+     * The archive path of the workspace's lockfile when the bundle ships it,
+     * mirroring the checks lockfile pruning performs before running.
+     */
+    #bundledLockfilePath(context) {
+        const archivePath = lockfileArchivePath(context.workspace);
+        if (archivePath === undefined || !this.#files.has(archivePath)) {
+            return undefined;
+        }
+        return archivePath;
+    }
+    /**
+     * Materializes the embedded package tarballs into the bundle: the full
+     * planned set, or — when the bundled lockfile was pruned — only the
+     * tarballs the pruned lockfile still references, so pruned-away packages
+     * are never downloaded. Returns the shipped set for the cache hash.
+     */
+    async #materializeEmbeddedPackages(context, pruned) {
+        const materializer = context.embeddedPackagesMaterializer;
+        if (materializer === undefined) {
+            return undefined;
+        }
+        // plan() is memoized and was already awaited in createForWorkspace, so
+        // this resolves the same promise without extra work.
+        const { tarballs: embeddedPackages } = await materializer.plan();
+        // The empty-bundle arm is load-bearing: every command calls finalize()
+        // unconditionally, including on bundles no check registered files into,
+        // and an empty bundle must not trigger downloads (nor the materializer's
+        // plan-issues backstop, which validation never ran for a project
+        // without Playwright checks). Nothing ships from an empty bundle, so
+        // nothing reaches the hash either.
+        if (this.isEmpty) {
+            return undefined;
+        }
+        let kept = embeddedPackages;
+        if (pruned !== undefined) {
+            const filtered = filterTarballsByLockfile(embeddedPackages, pruned.content, pruned.name);
+            kept = filtered.kept;
+            if (filtered.dropped.length > 0) {
+                debug(`Embedded packages dropped with the pruned lockfile: ${filtered.dropped.map(tarball => `${tarball.name}@${tarball.version}`).join(', ')}`);
+            }
+        }
+        // Debug rather than user-facing output for now: a bare stderr line has
+        // no good home in the current CLI output UX. Revisit when finalize-time
+        // work gets proper progress reporting.
+        if (kept.length > 0) {
+            debug(`Preparing ${kept.length} embedded package tarball(s)`);
+        }
+        // Deliberately called even for an empty kept set: the materializer's
+        // plan-issues backstop must still reject a plan whose specs all failed
+        // to resolve.
+        const materialized = await materializer.materializeTarballs(kept);
+        this.registerFiles(...materialized.map(tarball => ({
+            filePath: tarball.filePath,
+            physical: true,
+            archivePath: tarball.archivePath,
+        })));
+        return kept;
+    }
+    /**
+     * Filters the bundle's pnpm patch declarations down to the ones the pruned
+     * lockfile shows still apply, dropping the matching patch files and lockfile
+     * entries with them.
+     *
+     * A bundle carries the workspace's whole `patchedDependencies` map but only
+     * a subset of its members, so a patch whose package belongs to an unbundled
+     * member ends up applying to nothing. pnpm rejects that outright when it
+     * re-resolves, which is why the prune install tolerates it (see
+     * PNpmDetector.lockfileOnlyInstallCommand) and the leftovers are cleaned up
+     * here instead — the pruned lockfile is the first point at which the bundle's
+     * real dependency graph is known.
+     *
+     * Every failure mode leaves the bundle exactly as pruning produced it, which
+     * installs correctly today; the reporting below covers the case where that
+     * fallback is nonetheless a bundle the runner would reject.
+     */
+    async #dropUnusedPatches(context, pruned) {
+        if (pruned === undefined || context.packageManager.name !== 'pnpm') {
+            return pruned;
+        }
+        let configs = [];
+        let result = pruned;
+        try {
+            // `replaceable` is about whether the filtering may edit these files;
+            // whatever could be READ still feeds the diagnostic below, so a bundle
+            // this step declines to touch is not also a bundle it stays quiet about.
+            const read = await this.#readPatchConfigs();
+            configs = read.configs;
+            if (read.replaceable) {
+                const plan = planPatchFilter({
+                    configs,
+                    originalLockfileContent: pruned.originalContent,
+                    prunedLockfileContent: pruned.content,
+                });
+                if (plan !== undefined) {
+                    const applied = this.#applyPatchFilter(context, pruned, plan);
+                    if (applied !== undefined) {
+                        result = applied;
+                        // The diagnostic below must see what actually ships, so the config
+                        // is swapped for its rewritten bytes only once the apply took.
+                        configs = configs.map(config => config.archivePath === plan.rewrittenConfig.archivePath
+                            ? { ...config, content: plan.rewrittenConfig.content }
+                            : config);
+                        debug(`Dropped unused patch declarations: ${plan.unusedKeys.join(', ')}`);
+                    }
+                }
+            }
+        }
+        catch (err) {
+            debug(`Could not filter the bundle's patch declarations: ${err}`);
+        }
+        // Evaluated on every path, including the ones that changed nothing: a
+        // config declaring a patch the shipped lockfile does not record is what
+        // makes the runner's install fail, and silently shipping that is the
+        // failure this step exists to prevent.
+        if (configs.length > 0) {
+            const unrepaired = findUnrepairedPatchKeys({
+                configs,
+                originalLockfileContent: pruned.originalContent,
+                shippedLockfileContent: result.content,
+            });
+            if (unrepaired.length > 0) {
+                process.stderr.write(`Note: the bundled pnpm config declares patches that the bundled lockfile does not `
+                    + `record (${unrepaired.join(', ')}), which can fail the remote install. Your own lockfile `
+                    + `does record them, so run your package manager's install to refresh it rather than `
+                    + `removing the entries; set CHECKLY_LOCKFILE_PRUNE=0 to opt out of pruning entirely.\n`);
+            }
+        }
+        return result;
+    }
+    /**
+     * Reads the bundle's copies of the two files pnpm accepts
+     * `patchedDependencies` in.
+     *
+     * `replaceable` is false when a candidate exists but cannot be read or
+     * cannot be swapped for a rewritten copy; filtering one declaring config
+     * while leaving the other would manufacture the very config/lockfile
+     * mismatch this step removes. Whatever *could* be read is still returned, so
+     * the caller can report on a bundle it declines to edit.
+     */
+    async #readPatchConfigs() {
+        const configs = [];
+        let replaceable = true;
+        // The archive path and the kind are the same string here; see
+        // PATCH_CONFIG_KINDS for why.
+        for (const archivePath of PATCH_CONFIG_KINDS) {
+            const file = this.#files.get(archivePath);
+            if (file === undefined) {
+                continue;
+            }
+            // A virtual entry's archive name is always derived from its filePath,
+            // so a replacement can only stand in for an entry that already archives
+            // at that derived path. An entry bundled somewhere other than its own
+            // path — reached through a symlink, and carrying an explicit
+            // archivePath — cannot be replaced without moving it.
+            const replacementArchivePath = pathToPosix(path.relative(this.#stripPrefix ?? '', file.filePath));
+            if (replacementArchivePath !== archivePath) {
+                debug(`Bundled ${archivePath} would move to ${replacementArchivePath} if rewritten;`
+                    + ` leaving patches alone`);
+                replaceable = false;
+            }
+            try {
+                const content = file.physical
+                    ? await fs.readFile(file.filePath, 'utf8')
+                    : file.content;
+                configs.push({ archivePath, kind: archivePath, content });
+            }
+            catch (err) {
+                debug(`Could not read bundled ${archivePath}: ${err}`);
+                replaceable = false;
+            }
+        }
+        return { configs, replaceable };
+    }
+    /**
+     * Applies a patch filter plan. Deliberately pure map mutation over
+     * already-computed content: a throw partway through would ship a bundle
+     * whose config, patch files and lockfile disagree, which fails the runner's
+     * install either way it lands.
+     */
+    #applyPatchFilter(context, pruned, plan) {
+        // Resolved before anything is mutated: the config entry is what the plan
+        // was computed from, and rewriting the lockfile without it would ship the
+        // mismatch this step exists to remove.
+        const existing = this.#files.get(plan.rewrittenConfig.archivePath);
+        if (existing === undefined) {
+            return undefined;
+        }
+        this.#files.set(plan.rewrittenConfig.archivePath, {
+            // The archive name is derived from filePath, so the rewritten entry has
+            // to keep the original's.
+            filePath: existing.filePath,
+            physical: false,
+            content: plan.rewrittenConfig.content,
+        });
+        if (path.posix.basename(plan.rewrittenConfig.archivePath) === 'package.json') {
+            this.#rewrittenManifests.add(plan.rewrittenConfig.archivePath);
+        }
+        for (const patchPath of plan.droppedPatchPaths) {
+            // Defense in depth, as an allow-list rather than a list of things not to
+            // delete: a declared patch path is user input reaching a delete, and it
+            // can name any bundled file — an .npmrc carrying registry auth, a
+            // pnpmfile the lockfile records a checksum for, or a `.patch` fixture
+            // that a check's own `include` glob put in the bundle. Only the
+            // conventional location the auto-include adds patches from is removable;
+            // a patch kept elsewhere simply stays, inert, exactly as an
+            // unreferenced one does.
+            if (!isRemovablePatchPath(patchPath)) {
+                debug(`Refusing to drop ${patchPath}: outside the conventional patches directory`);
+                continue;
+            }
+            this.#files.delete(patchPath);
+        }
+        this.#files.set(pruned.archivePath, {
+            filePath: context.workspace.lockfile.unwrap(),
+            physical: false,
+            content: plan.lockfileContent,
+        });
+        return {
+            ...pruned,
+            content: plan.lockfileContent,
+            hash: createHash('sha256').update(plan.lockfileContent).digest(),
+        };
+    }
+    async #pruneLockfile(context) {
+        const result = await pruneBundledLockfile({
+            workspace: context.workspace,
+            packageManager: context.packageManager,
+            files: this.#files,
+            rewrittenManifests: this.#rewrittenManifests,
+        });
+        if (result.status === 'failed') {
+            process.stderr.write(`Warning: could not prune the bundled lockfile: ${result.reason}. `
+                + `Falling back to the original lockfile; it may reference workspace packages and `
+                + `dependencies that are not part of the bundle. If the lockfile is out of date, `
+                + `run your package manager's install to refresh it; set CHECKLY_LOCKFILE_PRUNE=0 `
+                + `to disable pruning.\n`);
+            return {};
+        }
+        if (result.status === 'skipped') {
+            if (result.notable) {
+                // The bundle is a partial workspace, so the unpruned lockfile
+                // over-describes it — say so instead of failing silently on the
+                // remote install.
+                process.stderr.write(`Note: the bundled lockfile was not pruned (${result.reason}); it may reference `
+                    + `workspace packages and dependencies that are not part of the bundle. If this `
+                    + `setup cannot be pruned, set CHECKLY_LOCKFILE_PRUNE=0 to opt out of pruning `
+                    + `(and this note) entirely.\n`);
+            }
+            else {
+                debug(`Lockfile pruning skipped: ${result.reason}`);
+            }
+            return { consistent: result.consistent };
+        }
+        // Set entries directly rather than through registerFiles: its
+        // prefer-physical dedup would keep the original lockfile, and would drop
+        // a backfilled manifest whose path is occupied by a symlink entry —
+        // desyncing the bundle from the lockfile the prune was computed against.
+        for (const manifest of result.backfilledManifests) {
+            this.#files.set(archivePath(manifest, this.#stripPrefix), manifest);
+        }
+        this.#files.set(result.archivePath, {
+            filePath: context.workspace.lockfile.unwrap(),
+            physical: false,
+            content: result.content,
+        });
+        debug(`Pruned bundled lockfile ${result.archivePath}`);
+        return {
+            pruned: {
+                name: path.posix.basename(result.archivePath),
+                hash: createHash('sha256').update(result.content).digest(),
+                content: result.content,
+                archivePath: result.archivePath,
+                originalContent: result.originalContent,
+            },
+        };
+    }
     async finalize() {
+        await this.#refreshWorkspaceBundle();
         const archive = await BundleArchive.create({
             tempDir: this.#tempDir,
             stripPrefix: this.#stripPrefix,
@@ -407,4 +944,25 @@ export class BundlePathMarker {
         return this.#value;
     }
 }
+/**
+ * Mutable holder for the dependency cache hash, serialized as a plain
+ * string. See {@link Bundler.cacheHash} for why a holder is needed.
+ *
+ * Deliberately a standalone class rather than a subclass of
+ * {@link BundlePathMarker}: the own `#value` field makes the two marker
+ * types nominally incompatible, so a bundle path cannot be passed where the
+ * cache hash is expected (or vice versa) without a compile error.
+ */
+export class CacheHashMarker {
+    #value;
+    constructor(initialValue) {
+        this.#value = initialValue;
+    }
+    updateValue(newValue) {
+        this.#value = newValue;
+    }
+    toJSON() {
+        return this.#value;
+    }
+}
 //# sourceMappingURL=bundler.js.map