#13701 Support Bun catalogs when packaging external esbuild dependencies

Is there an existing issue for this?

I have searched existing issues, and it has not been reported for Serverless Framework v4's built-in esbuild integration.

The closest result is floydspace/serverless-esbuild#501, which requested Bun packager support for the separate plugin and was closed without an implementation. This request concerns the built-in esbuild integration in Serverless Framework v4.

Use case description

A Serverless v4 service in a Bun workspace can use Bun catalogs for dependency versions:

{
  "dependencies": {
    "sharp": "catalog:"
  }
}

{
  "workspaces": {
    "catalog": {
      "sharp": "0.35.2"
    }
  }
}

When the dependency must remain external to esbuild—for example, Sharp because it loads a native .node binding—the service config includes:

build:
  esbuild:
    external:
      - sharp

Running serverless package or serverless deploy fails:

Failed to install dependencies with the "npm" packager.
npm error code EUNSUPPORTEDPROTOCOL
npm error Unsupported URL Type "catalog:": catalog:

The built-in esbuild integration writes a temporary .serverless/build/package.json containing the literal catalog specifier and then selects a package manager by checking for yarn.lock or pnpm-lock.yaml; otherwise it falls back to npm. It does not recognize bun.lock, and npm cannot resolve Bun's catalog: protocol.

This means ordinary bundled dependencies work, while external native dependencies fail unless their catalog version is duplicated as an exact version in the service package.

Tested with:

Serverless Framework 4.39.0
Bun 1.3.14
Node.js 24
build.esbuild.external with Sharp 0.35.2

Proposed solution

Add Bun support to the built-in esbuild external-dependency packaging flow:

Detect bun.lock and select Bun as the packager.
Run the external dependency install with Bun instead of falling back to npm.
Preserve enough workspace/catalog context for Bun to resolve catalog: dependencies, or resolve catalog specifiers to their concrete versions when generating .serverless/build/package.json.
Include the relevant Bun lock/workspace metadata in the temporary build directory when required.

A configurable package-manager option would also be useful when automatic detection is ambiguous.