fix: Bun lockfile pruner adjustment (#11092)

### Description

Fixes #11074.

### Testing Instructions

Verified that the snapshot changes are desirable using the reproductions
that created them.

Author: anthonyshew

crates/turborepo-lockfiles/src/bun/mod.rs

@@ -1361,9 +1361,36 @@ impl BunLockfile {
                     .flat_map(|closure| closure.iter().map(|p| p.key.clone()))
                     .collect();
 
+                // Also keep track of reachable lockfile keys for nested package detection
+                let reachable_lockfile_keys: HashSet<String> = recomputed_closures
+                    .values()
+                    .flat_map(|closure| {
+                        closure
+                            .iter()
+                            .filter_map(|p| temp_lockfile.key_to_entry.get(&p.key).cloned())
+                    })
+                    .collect();
+
                 // Remove unreachable packages
-                pruned_data.packages.retain(|_key, entry| {
-                    reachable_idents.contains(&entry.ident) || entry.ident.contains("@workspace:")
+                pruned_data.packages.retain(|key, entry| {
+                    // Keep if the ident is reachable
+                    if reachable_idents.contains(&entry.ident)
+                        || entry.ident.contains("@workspace:")
+                    {
+                        return true;
+                    }
+
+                    // Keep nested packages if their parent is reachable
+                    // E.g., keep "@hatchet-dev/typescript-sdk/zod" if "@hatchet-dev/typescript-sdk"
+                    // is reachable
+                    if let Some(slash_pos) = key.rfind('/') {
+                        let parent_key = &key[..slash_pos];
+                        if reachable_lockfile_keys.contains(parent_key) {
+                            return true;
+                        }
+                    }
+
+                    false
                 });
             }
             Err(_e) => {}
@@ -1526,6 +1553,7 @@ mod test {
         include_str!("./snapshots/original-issue-11007-1.lock");
     const PRUNE_ISSUE_11007_ORIGINAL_2: &str =
         include_str!("./snapshots/original-issue-11007-2.lock");
+    const PRUNE_ISSUE_11074_ORIGINAL: &str = include_str!("./snapshots/original-issue-11074.lock");
 
     #[test_case("", "turbo", "^2.3.3", "[email protected]" ; "root")]
     #[test_case("apps/docs", "is-odd", "3.0.1", "[email protected]" ; "docs is odd")]
@@ -3004,6 +3032,28 @@ mod test {
             }
         }
 
+        // Add nested package entries (e.g., "parent/dep") for any packages we've
+        // collected This handles cases where a package has a nested version of
+        // a dependency (e.g., @hatchet-dev/typescript-sdk/zod for a different
+        // zod version)
+        let collected_packages: Vec<String> = packages.iter().cloned().collect();
+        for pkg_ident in &collected_packages {
+            // Convert ident to lockfile key using key_to_entry
+            if let Some(lockfile_key) = lockfile.key_to_entry.get(pkg_ident) {
+                let prefix = format!("{}/", lockfile_key);
+                for nested_key in lockfile.data.packages.keys() {
+                    if nested_key.starts_with(&prefix) {
+                        // Add the nested key directly (it's a lockfile key, not an ident)
+                        // We need to add both the key itself and its ident
+                        packages.insert(nested_key.clone());
+                        if let Some(nested_entry) = lockfile.data.packages.get(nested_key) {
+                            packages.insert(nested_entry.ident.clone());
+                        }
+                    }
+                }
+            }
+        }
+
         let packages: Vec<String> = packages.into_iter().collect();
 
         // Call internal subgraph method
@@ -3125,4 +3175,12 @@ mod test {
         let pruned_str = String::from_utf8(pruned.encode().unwrap()).unwrap();
         insta::assert_snapshot!(pruned_str);
     }
+
+    #[test]
+    fn test_prune_issue_11074() {
+        let lockfile = BunLockfile::from_str(PRUNE_ISSUE_11074_ORIGINAL).unwrap();
+        let pruned = prune_for_workspace(&lockfile, "apps/app-a");
+        let pruned_str = String::from_utf8(pruned.encode().unwrap()).unwrap();
+        insta::assert_snapshot!(pruned_str);
+    }
 }

crates/turborepo-lockfiles/src/bun/snapshots/original-issue-11074.lock

@@ -329,5 +329,11 @@ expression: pruned_str
     "word-wrap": ["[email protected]", "", {}, "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA=="],
 
     "yocto-queue": ["[email protected]", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
+
+    "@eslint-community/eslint-utils/eslint-visitor-keys": ["[email protected]", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
+
+    "@eslint/eslintrc/globals": ["[email protected]", "", {}, "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ=="],
+
+    "sharp/semver": ["[email protected]", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q=="],
   }
 }

crates/turborepo-lockfiles/src/bun/snapshots/turborepo_lockfiles__bun__test__prune_basic_docs.snap

@@ -329,5 +329,11 @@ expression: pruned_str
     "word-wrap": ["[email protected]", "", {}, "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA=="],
 
     "yocto-queue": ["[email protected]", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="],
+
+    "@eslint-community/eslint-utils/eslint-visitor-keys": ["[email protected]", "", {}, "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag=="],
+
+    "@eslint/eslintrc/globals": ["[email protected]", "", {}, "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ=="],
+
+    "sharp/semver": ["[email protected]", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q=="],
   }
 }