fix(test): scope sandbox dependencies for bun's isolated linker

Two failures the previous yarn flat-hoist masked:

1. vertex-ai: `version: '*'` resolves to `google-auth-library@10`, but
   every published `@google-cloud/vertexai` declares its transitive at
   `^9.0.0`. Bun's isolated linker keeps both physical copies — the test
   stubs `GoogleAuth.prototype.getAccessToken` on the @10 copy, the SDK
   loads the @9 copy at run-time, the stub never applies, and the real
   credential lookup throws `GoogleAuthError`. Pin the direct dep to
   `^9.0.0` so bun dedupes to a single `.bun/google-auth-library@9.x.y`
   entry and the prototype stub propagates to the SDK.
2. ai: `@ai-sdk/ui-utils` ranges `zod-to-json-schema` at `^3.0.0` and
   `ai@4.0.2` ranges `zod` at `^3.0.0`; bun picks `zod-to-json-schema@3.25.2`
   next to `zod@3.23.8`. `3.25.x` switched its zod imports to the `zod/v3`
   subpath, which only exists in `zod@>=3.25.32` and `zod@4`, so the sandbox
   crashes at load time with `ERR_PACKAGE_PATH_NOT_EXPORTED`. Bun does
   not honour nested overrides (oven-sh/bun#6608), so a flat
   `zod-to-json-schema: <3.25.0` override is the only shape that works;
   the only other consumer (`langchain` / `langgraph`) declares
   `>=3.0.0` and the constraint still holds.

Author: BridgeAR

packages/dd-trace/test/plugins/externals.js

@@ -23,12 +23,12 @@ module.exports = {
       versions: ['>=3.25.75'],
       // `ai@4.0.2` declares `zod` as an optional peer (`^3.0.0`) and
       // `@ai-sdk/openai@1.3.23+` declares it as a required peer. Yarn 1's flat
-      // hoist served the standalone `zod` workspace's copy from the workspace
-      // root to both sandboxes; bun's isolated linker honours each package's
-      // own manifest and skips optional peers entirely, so the `versions/ai@`
-      // sandbox lands without `zod` and `require('zod')` crashes at load time.
-      // `dep: true` injects `zod` as a direct dep of the `versions/ai@`
-      // sandbox so bun materialises it alongside `ai` in the isolated store.
+      // hoist served the workspace root's `zod` to both consumers; bun's
+      // isolated linker honours each package's own manifest and skips optional
+      // peers entirely, so without `dep: true` the `versions/ai@` sandbox
+      // lands without `zod` and `require('zod')` crashes at load time. The
+      // matching `zod-to-json-schema` override in `install_plugin_modules.js`
+      // keeps the transitive zod chain on a `zod@3`-compatible version.
       dep: true,
     },
   ],
@@ -264,12 +264,15 @@ module.exports = {
   // `google-auth-library` is a regular transitive of `@google-cloud/vertexai`,
   // so under bun's isolated linker it lives in vertexai's private store and
   // isn't reachable from the workspace root. Inject it as a direct dep of
-  // every vertexai sandbox so the test's `getExport` lookup resolves
-  // (the same shape as the bedrock-runtime fix above).
+  // every vertexai sandbox so the test's `getExport` lookup resolves.
+  // Pin to vertexai's own `^9.0.0` range (every published version still
+  // declares it) so bun dedupes the direct dep and the SDK's transitive to
+  // a single physical `.bun/google-auth-library@9.x.y` entry — the prototype
+  // stub only propagates to the SDK when both resolve to the same realpath.
   '@google-cloud/vertexai': [
     {
       name: 'google-auth-library',
-      version: '*',
+      version: '^9.0.0',
       dep: true,
       forced: true,
     },

scripts/install_plugin_modules.js

@@ -388,9 +388,25 @@ async function assertWorkspaces () {
       //   for the langchain-openai pair without affecting the
       //   `@langchain/openai@1.x.x` peer constraint resolved elsewhere in
       //   the workspace.
+      // - `zod-to-json-schema@>=3.25.0` switched its zod imports to the
+      //   `zod/v3` subpath, which only exists in `zod@>=3.25.32` and
+      //   `zod@>=4`. `@ai-sdk/ui-utils` (the `ai@4.0.2` UI helper) declares
+      //   `zod-to-json-schema: ^3.0.0` and pulls in `zod@^3.0.0` itself, so
+      //   the isolated linker lands `zod-to-json-schema@3.25.2` next to a
+      //   `zod@3.23.x` that has no `/v3` subpath, crashing at load time
+      //   with `Package subpath './v3' is not defined`. The previous
+      //   package manager hid this because its flat hoist served the
+      //   workspace root's `zod@4` to every consumer. Pin the transitive
+      //   globally to the last 3.x release that still imports from `zod`
+      //   directly so the `ai@4.x` sandbox loads; the only other consumer
+      //   (`langchain`/`langgraph`) declares `zod-to-json-schema >=3.0.0`
+      //   and `<3.25.0` satisfies that range too. Bun does not support
+      //   nested override keys (oven-sh/bun#6608), so a flat key is
+      //   required here even though only the ai sandbox needs it.
       overrides: {
         collections: '^5.0.0',
         '@langchain/openai@0.0.34/@langchain/core': '^0.2.0',
+        'zod-to-json-schema': '<3.25.0',
       },
       trustedDependencies: [...trustedDependencies].sort(),
     }, null, 2) + '\n'),