Match the bun spec before the bundled parse in vendor, with a fast path

classify_rewritable and bundled_matches now run classify first and
only parse the meta of entries that match the target. is_bundled_entry
skips the JSON parse when the meta never spells "bundled" and holds no
backslash (so an escaped key still takes the parse). Malformed meta that
mentions "bundled" still fails closed.

Refs #578, #580

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-core/src/vendor/bun_lock.rs

@@ -1092,10 +1092,10 @@ fn classify_rewritable(
     name: &str,
     target_leaf: &str,
 ) -> Option<TupleShape> {
-    if is_bundled_entry(entry) {
-        return None;
-    }
-    classify(entry, target_spec, name, target_leaf)
+    // The cheap spec match runs first; the bundled parse only for a match
+    // (#580).
+    let shape = classify(entry, target_spec, name, target_leaf)?;
+    (!is_bundled_entry(entry)).then_some(shape)
 }
 
 /// Keys of the bundled entries that resolve the target `name@version`.
@@ -1107,7 +1107,7 @@ fn bundled_matches(
 ) -> Vec<String> {
     entries
         .iter()
-        .filter(|e| is_bundled_entry(e) && classify(e, target_spec, name, target_leaf).is_some())
+        .filter(|e| classify(e, target_spec, name, target_leaf).is_some() && is_bundled_entry(e))
         .map(|e| e.key.clone())
         .collect()
 }

crates/socket-patch-core/src/vendor/bun_lock_text.rs

@@ -229,6 +229,12 @@ pub(crate) fn is_bundled_entry(entry: &BunEntry) -> bool {
     let Some(meta) = entry.elems.iter().skip(1).find(|e| e.starts_with('{')) else {
         return false;
     };
+    // Fast path (#580): a meta that never spells `bundled` cannot carry the
+    // key. A backslash could hide it behind a JSON escape, so only a meta
+    // with neither skips the parse.
+    if !meta.contains("bundled") && !meta.contains('\\') {
+        return false;
+    }
     match serde_json::from_str::<serde_json::Value>(meta) {
         Ok(value) => value.get("bundled").and_then(serde_json::Value::as_bool) == Some(true),
         Err(_) => meta.contains("\"bundled\""),
@@ -717,6 +723,26 @@ mod tests {
         ));
     }
 
+    /// The substring fast path (#580) never changes the answer: a meta that
+    /// never spells `bundled` is not bundled, a malformed meta that does
+    /// still fails closed, and a JSON-escaped key still takes the parse.
+    #[test]
+    fn bundled_fast_path_matches_the_full_parse() {
+        let bundled = |line: &str| is_bundled_entry(&parse_entry_line(line).unwrap());
+        assert!(!bundled(
+            r#"    "q": ["q@1.0.0", "", { "dependencies": { "a": "1" } }, "sha512-X=="],"#
+        ));
+        assert!(!bundled(
+            r#"    "q": ["q@1.0.0", "", { "x": , }, "sha512-X=="],"#
+        ));
+        assert!(bundled(
+            r#"    "q": ["q@1.0.0", "", { "bundled": true, "x": , }, "sha512-X=="],"#
+        ));
+        assert!(bundled(
+            r#"    "q": ["q@1.0.0", "", { "bundl\u0065d": true }, "sha512-X=="],"#
+        ));
+    }
+
     #[test]
     fn line_grammar_parses_the_fixture_shapes() {
         // Registry 4-tuple with deps and trailing comma.