Fix catalog dependency resolution in PackageManagerEnqueue

This commit fixes the core issue where catalog dependencies were not being
properly resolved and stored in the lockfile dependencies buffer.

The problem was that while catalog resolution was working during the enqueue
phase, the original dependencies in the buffer still contained the literal
catalog references (e.g., 'catalog:v1') rather than the resolved versions
(e.g., '1.0.0'). This caused verifyResolutions() to fail when checking if
dependencies had been properly resolved.

Key changes:
- Update the original dependency in lockfile.buffers.dependencies.items[id]
  after successful catalog resolution
- Store the resolved version instead of the catalog reference
- Ensure verifyResolutions() can properly validate resolved catalog dependencies

This fix addresses the root cause of issue #21238 where workspace catalog
dependencies were failing to resolve properly.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/install/PackageManager/PackageManagerEnqueue.zig

@@ -499,6 +499,11 @@ pub fn enqueueDependencyWithMainAndSuccessFn(
                 if (this.lockfile.catalogs.get(this.lockfile, dependency.version.value.catalog, name)) |catalog_dep| {
                     name, name_hash = updateNameAndNameHashFromVersionReplacement(this.lockfile, name, name_hash, catalog_dep.version);
 
+                    // CRITICAL FIX: Update the original dependency in the buffer to store the resolved version
+                    // instead of the catalog reference. This ensures that verifyResolutions() can properly
+                    // validate the dependency and that the lockfile contains the resolved versions.
+                    this.lockfile.buffers.dependencies.items[id].version = catalog_dep.version;
+
                     break :version catalog_dep.version;
                 }
             }

src/install/lockfile/Package.zig

@@ -1575,9 +1575,31 @@ pub const Package = extern struct {
             if (json.get("workspaces")) |workspaces_expr| {
                 lockfile.catalogs.parseCount(lockfile, workspaces_expr, &string_builder);
             }
+            
+            // Also count catalogs from top-level for fallback
+            lockfile.catalogs.parseCount(lockfile, json, &string_builder);
         }
 
         try string_builder.allocate();
+        
+        // Parse catalogs early so they are available during dependency parsing
+        if (comptime features.is_main) {
+            var found_any_catalog_or_catalog_object = false;
+            var has_workspaces = false;
+            if (json.get("workspaces")) |workspaces_expr| {
+                found_any_catalog_or_catalog_object = try lockfile.catalogs.parseAppend(pm, lockfile, log, source, workspaces_expr, &string_builder);
+                has_workspaces = true;
+            }
+
+            // `"workspaces"` being an object instead of an array is sometimes
+            // unexpected to people. therefore if you also are using workspaces,
+            // allow "catalog" and "catalogs" in top-level "package.json"
+            // so it's easier to guess.
+            if (!found_any_catalog_or_catalog_object and has_workspaces) {
+                _ = try lockfile.catalogs.parseAppend(pm, lockfile, log, source, json, &string_builder);
+            }
+        }
+        
         try lockfile.buffers.dependencies.ensureUnusedCapacity(lockfile.allocator, total_dependencies_count);
         try lockfile.buffers.resolutions.ensureUnusedCapacity(lockfile.allocator, total_dependencies_count);
 
@@ -1934,20 +1956,6 @@ pub const Package = extern struct {
         // This function depends on package.dependencies being set, so it is done at the very end.
         if (comptime features.is_main) {
             try lockfile.overrides.parseAppend(pm, lockfile, package, log, source, json, &string_builder);
-            var found_any_catalog_or_catalog_object = false;
-            var has_workspaces = false;
-            if (json.get("workspaces")) |workspaces_expr| {
-                found_any_catalog_or_catalog_object = try lockfile.catalogs.parseAppend(pm, lockfile, log, source, workspaces_expr, &string_builder);
-                has_workspaces = true;
-            }
-
-            // `"workspaces"` being an object instead of an array is sometimes
-            // unexpected to people. therefore if you also are using workspaces,
-            // allow "catalog" and "catalogs" in top-level "package.json"
-            // so it's easier to guess.
-            if (!found_any_catalog_or_catalog_object and has_workspaces) {
-                _ = try lockfile.catalogs.parseAppend(pm, lockfile, log, source, json, &string_builder);
-            }
         }
 
         string_builder.clamp();

test/cli/install/catalogs.test.ts

@@ -165,6 +165,90 @@ describe("basic", () => {
   }
 });
 
+describe("workspace catalog dependencies", () => {
+  test("installs dependencies for all subpackages using same dependency different version", async () => {
+    const { packageDir } = await registry.createTestDir();
+
+    // Create root package.json with workspace catalogs
+    await write(
+      join(packageDir, "package.json"),
+      JSON.stringify({
+        name: "bun-catalog",
+        private: true,
+        workspaces: {
+          packages: ["packages/*"],
+          catalogs: {
+            v1: {
+              "no-deps": "1.0.0",
+            },
+            v2: {
+              "no-deps": "2.0.0",
+            },
+          },
+        },
+      }),
+    );
+
+    // Create subpackage a with catalog:v1 dependency
+    await write(
+      join(packageDir, "packages", "a", "package.json"),
+      JSON.stringify({
+        name: "a",
+        version: "1.0.0",
+        main: "index.js",
+        license: "MIT",
+        dependencies: {
+          "no-deps": "catalog:v1",
+        },
+      }),
+    );
+
+    // Create subpackage b with catalog:v2 dependency
+    await write(
+      join(packageDir, "packages", "b", "package.json"),
+      JSON.stringify({
+        name: "b",
+        version: "1.0.0",
+        main: "index.js",
+        license: "MIT",
+        dependencies: {
+          "no-deps": "catalog:v2",
+        },
+      }),
+    );
+
+    await runBunInstall(bunEnv, packageDir);
+
+    // Both subpackages should be able to require their respective versions
+    // Package a should have access to no-deps@1.0.0
+    const pkgANodeModules = join(packageDir, "packages", "a", "node_modules");
+    const pkgBNodeModules = join(packageDir, "packages", "b", "node_modules");
+    
+    // Package a should have access to no-deps@1.0.0 either in its own node_modules or root
+    let hasNoDepsV1 = false;
+    if (await exists(join(pkgANodeModules, "no-deps", "package.json"))) {
+      const pkgJson = await file(join(pkgANodeModules, "no-deps", "package.json")).json();
+      hasNoDepsV1 = pkgJson.version === "1.0.0";
+    } else if (await exists(join(packageDir, "node_modules", "no-deps", "package.json"))) {
+      const pkgJson = await file(join(packageDir, "node_modules", "no-deps", "package.json")).json();
+      hasNoDepsV1 = pkgJson.version === "1.0.0";
+    }
+
+    // Package b should have access to no-deps@2.0.0 either in its own node_modules or root
+    let hasNoDepsV2 = false;
+    if (await exists(join(pkgBNodeModules, "no-deps", "package.json"))) {
+      const pkgJson = await file(join(pkgBNodeModules, "no-deps", "package.json")).json();
+      hasNoDepsV2 = pkgJson.version === "2.0.0";
+    } else if (await exists(join(packageDir, "node_modules", "no-deps", "package.json"))) {
+      const pkgJson = await file(join(packageDir, "node_modules", "no-deps", "package.json")).json();
+      hasNoDepsV2 = pkgJson.version === "2.0.0";
+    }
+
+    expect(hasNoDepsV1).toBe(true);
+    expect(hasNoDepsV2).toBe(true);
+  });
+});
+
 describe("errors", () => {
   test("fails gracefully when no catalog is found for a package", async () => {
     const { packageDir, packageJson } = await registry.createTestDir();