Fix offline peer dependency resolution by synthesizing bun's manifest cache

[typedrat]

Fixes #71 (and the offline-install portion of #77).

Note

Stacked on #101 and #102 — since PRs from a fork can't target another fork branch, this branch includes their commits; only the last nine commits are new here. I'll rebase and mark it ready once those two land.

bun needs npm package manifests to do peer dependency resolution, even with --frozen-lockfile. When a dependency graph has peers in it, the lockfile resolution comes back invalid and bun goes looking for the manifest; if it isn't in the cache, it downloads it. Our cache only ever contained the extracted packages and no *.npm manifest files, so inside the sandbox that download fails with ConnectionRefused downloading package manifest. That's why adding a peer-heavy package (the reporter's SvelteKit starter) broke builds of unrelated workspace packages while packages with no peers anywhere kept working: bun never reads a manifest for those.

There's no flag to turn this off (--offline isn't a real bun flag), and fetching the real registry documents in a fixed-output derivation isn't reproducible since they change whenever a new version is published upstream. So instead we generate bun's binary manifest cache ourselves:

• All the fields bun reads out of a manifest (dependency ranges, optional peers, bin, os/cpu) are already sitting in each bun.lock entry's inline metadata, so bun2nix now reconstructs a per-version manifest from the lockfile and writes it as a manifest attr on the entry in bun.nix. No network involved, which also means it works the same in the wasm CLI.
• At build time fetchBunDeps feeds those attrs to a new manifest subcommand of cache-entry-creator, which writes real bun-npm-manifest-cache-v0.0.7 files into the cache. The install hook now exports BUN_MANIFEST_CACHE=2 (bun ignores the on-disk cache otherwise), and the manifests get public_max_age = u32::MAX so they can't expire mid-build.
• cache-entry-creator is rewritten from Zig to Rust along the way. The manifest serializer, wyhash, and cache folder naming all have to match bun bit-for-bit on both the generation and build side, and maintaining that port twice — once in Rust for bun2nix, once in Zig — seemed like a bad time. It all lives in a shared bun2nix-core crate now; the symlink subcommand keeps the same CLI as the Zig tool and its test vectors came along as Rust tests.

Non-default registries work too. bun keys those manifests by a hash of the registry URL from its config, not from the lockfile, so bun2nix parses the project-local bunfig.toml/.npmrc next to the lockfile (npmrc wins per key, same as bun) and names the .npm files accordingly. Global config, env vars, and --registry are ignored on purpose: the sandboxed bun can't see any of them, so a registry configured only there could never resolve offline anyway, and reading them would bake machine-specific state (and auth tokens) into bun.nix.

Pre-release versions work too. bun looks a version up in the manifest's releases or prereleases map depending on whether it has a tag, and tag equality compares a hash of the pre-release span, so 3.0.1-alpha.1 has to be stored in the right map with the right hash — an earlier revision stripped the tag and stored it as 3.0.1, which bun can never find. The version parser now follows bun's Tag.parse state machine, and the os/cpu fields go through a port of bun's Negatable handling ("none", "!win32", bare strings) since bun writes those forms back into bun.lock.

Getting the full opencode repro from #77 green surfaced one more offline killer fixed here: with minimumReleaseAge configured (opencode's bunfig sets it), bun silently rejects any cached manifest that doesn't claim extended data — it demotes the entry to expired and refetches. Synthesized manifests now set has_extended_manifest; their zeroed publish timestamps read as "published at epoch", which passes every age gate, the right answer for lockfile-pinned versions. (Two hook-level killers found in the same investigation — lockfile drift forcing re-resolution, and the catalog: rewrite mangling non-registry specs — apply to master independently of the manifest work and live in #102.)

Testing: two new flake checks install fixtures with bun.lock excluded from the source, which forces bun through the manifest-cache path — without the synthesized manifests they fail with exactly the error from #71. One covers the default registry, the other uses a real alternate registry (registry.npmmirror.com). On top of that there are golden tests pinning the wyhash values and header layout, round-trip tests for the binary format, and a tripwire that fails if bun ever bumps the manifest format version, with notes on how to re-port. As an end-to-end test, the full opencode workspace — ~3,200 packages: workspaces, 330 catalog references, 15 patched deps, pre-release pins, a github dep, a pkg.pr.new tarball, vendored tarballs — installs completely offline from a cache generated by this branch, once its lockfile is refreshed to clear the drift caught by #102 (as committed upstream it fails with that PR's diagnostic instead).

Compatibility: existing bun.nix files build unchanged (no manifest attrs → empty manifest cache → old behavior); you get the fix by regenerating. The wasm export grew two optional trailing args for the config file contents. The obvious risk is the coupling to bun's manifest ABI, but it's been stable at v0.0.7 across 1.3.x, and the tripwire turns a future bump into a loud test failure instead of silently broken installs.

Not covered here: auth for private-registry tarball fetching (the cache keys are already right, since credentials aren't part of the hashed URL, but authenticating the FODs is a separate problem), and there's no end-to-end fixture for a path-style registry URL — that's unit-tested only, since I couldn't find a public registry shaped like that to commit a fixture against.

[TheRealGramdalf]

I can confirm that this PR works "in the wild" on a monorepo I'm working with at https://github.com/TheRealGramdalf/mindwtr-flake. This fixes a build failure and makes my flake possible, so I'd love to see this merged. Happy to provide more info if needed.