@effected/lockfiles 0.1.0

package/internal/bun.js

@@ -0,0 +1,102 @@
+import { BunExtension } from "../BunExtension.js";
+import { LockfileImporter } from "../LockfileImporter.js";
+import { ResolvedPackage } from "../ResolvedPackage.js";
+import { extractWorkspaceDeps, importerDependencies, syntaxFailure, toIntegrityHash, validationFailure } from "./shared.js";
+import { Effect, Schema } from "effect";
+import { Jsonc } from "@effected/jsonc";
+
+//#region src/internal/bun.ts
+const DepRecord = Schema.optionalKey(Schema.Record(Schema.String, Schema.String));
+const BunWorkspaceEntry = Schema.Struct({
+	name: Schema.optionalKey(Schema.String),
+	version: Schema.optionalKey(Schema.String),
+	dependencies: DepRecord,
+	devDependencies: DepRecord,
+	peerDependencies: DepRecord,
+	optionalDependencies: DepRecord
+});
+const BunLockfileRaw = Schema.Struct({
+	lockfileVersion: Schema.Number,
+	workspaces: Schema.optionalKey(Schema.Record(Schema.String, BunWorkspaceEntry)),
+	packages: Schema.optionalKey(Schema.Record(Schema.String, Schema.Array(Schema.Unknown))),
+	catalog: Schema.optionalKey(Schema.Record(Schema.String, Schema.Unknown)),
+	catalogs: Schema.optionalKey(Schema.Record(Schema.String, Schema.Record(Schema.String, Schema.Unknown))),
+	overrides: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	trustedDependencies: Schema.optionalKey(Schema.Array(Schema.String))
+});
+/**
+* Parse bun `bun.lock` (JSONC) content into the unified field bundle.
+* Resolved packages are tuples whose first element is `"name@version"`;
+* the integrity hash is assumed at tuple index 3 (the permissive v3
+* reading of an under-documented upstream shape).
+*
+* @internal
+*/
+const parseBun = (content) => Effect.gen(function* () {
+	const parsed = yield* Jsonc.parse(content).pipe(Effect.mapError(syntaxFailure));
+	const validated = yield* Schema.decodeUnknownEffect(BunLockfileRaw)(parsed).pipe(Effect.mapError(validationFailure));
+	return yield* toFields(validated);
+});
+const toFields = (raw) => Effect.gen(function* () {
+	const packages = [];
+	const workspaceNames = /* @__PURE__ */ new Set();
+	const workspaceEntries = /* @__PURE__ */ new Map();
+	const importers = [];
+	if (raw.workspaces) {
+		for (const [wsPath, wsEntry] of Object.entries(raw.workspaces)) importers.push(LockfileImporter.make({
+			path: wsPath === "" ? "." : wsPath,
+			dependencies: importerDependencies(wsEntry, (specifier) => ({ specifier }))
+		}));
+		for (const [wsPath, wsEntry] of Object.entries(raw.workspaces)) {
+			if (wsPath === "") continue;
+			const name = wsEntry.name === void 0 || wsEntry.name === "" ? wsPath : wsEntry.name;
+			workspaceNames.add(name);
+			packages.push(ResolvedPackage.make({
+				name,
+				version: wsEntry.version ?? "0.0.0",
+				isWorkspace: true,
+				relativePath: wsPath
+			}));
+			workspaceEntries.set(name, {
+				...wsEntry.dependencies ? { dependencies: wsEntry.dependencies } : {},
+				...wsEntry.devDependencies ? { devDependencies: wsEntry.devDependencies } : {},
+				...wsEntry.peerDependencies ? { peerDependencies: wsEntry.peerDependencies } : {},
+				...wsEntry.optionalDependencies ? { optionalDependencies: wsEntry.optionalDependencies } : {}
+			});
+		}
+	}
+	if (raw.packages) for (const tuple of Object.values(raw.packages)) {
+		if (tuple.length < 1) continue;
+		const first = tuple[0];
+		if (typeof first !== "string") continue;
+		const atIdx = first.lastIndexOf("@");
+		if (atIdx <= 0) continue;
+		const name = first.slice(0, atIdx);
+		const version = first.slice(atIdx + 1);
+		if (workspaceNames.has(name)) continue;
+		const integrity = yield* toIntegrityHash(tuple.length >= 4 && typeof tuple[3] === "string" ? tuple[3] : void 0);
+		packages.push(ResolvedPackage.make({
+			name,
+			version,
+			...integrity !== void 0 ? { integrity } : {},
+			isWorkspace: false
+		}));
+	}
+	const workspaceDependencies = extractWorkspaceDeps(workspaceEntries, workspaceNames);
+	const extension = BunExtension.make({
+		...raw.catalog !== void 0 ? { catalog: raw.catalog } : {},
+		...raw.catalogs !== void 0 ? { catalogs: raw.catalogs } : {},
+		...raw.overrides !== void 0 ? { overrides: raw.overrides } : {},
+		...raw.trustedDependencies !== void 0 ? { trustedDependencies: raw.trustedDependencies } : {}
+	});
+	return {
+		lockfileVersion: String(raw.lockfileVersion),
+		packages,
+		workspaceDependencies,
+		importers,
+		extension
+	};
+});
+
+//#endregion
+export { parseBun };

package/internal/documents.js

@@ -0,0 +1,76 @@
+import { framingFailure, syntaxFailure } from "./shared.js";
+import { Effect } from "effect";
+import { Yaml } from "@effected/yaml";
+
+//#region src/internal/documents.ts
+/**
+* An empty YAML document composes to `null` (`Yaml.parseAll("")` is `[null]`,
+* and the trailing document of an env-only `pnpm-lock.yaml` is `null` too).
+* A *present* scalar — `42` — is not empty; it is a shape error, and must
+* reach validation rather than be reported as a framing failure.
+*
+* @internal
+*/
+const isEmptyDocument = (document) => document === null || document === void 0;
+/**
+* Select the lockfile document from a `pnpm-lock.yaml` YAML stream.
+*
+* @remarks
+* pnpm 11 writes `pnpm-lock.yaml` as **up to two YAML documents** when the
+* workspace uses `configDependencies`: an optional config-dependencies
+* ("env") preamble, then the lockfile proper. The rule for picking the right
+* one is **deterministic, not a heuristic** — it is pnpm's own writer
+* contract. `writeEnvLockfile` emits `${env}---${main}`, composing the
+* preamble as a *prefix*, and `extractMainDocument` reads back everything
+* after the first separator. So the preamble is always first and the lockfile
+* is always **last**.
+*
+* Both documents declare `lockfileVersion`, `importers` and `packages`, so
+* they are not told apart by which keys they carry — only by position. That
+* is exactly why the previous single-document assumption failed *silently*:
+* the preamble validates against the pnpm schema, yielding a `Lockfile`
+* reporting one package and an empty workspace instead of an error.
+*
+* An env-only lockfile (`---` preamble `---` and nothing after it, which
+* pnpm writes when there is no main lockfile yet) has an **empty** trailing
+* document. pnpm reads that as "no lockfile"; so do we, through the typed
+* framing failure — never by silently falling back to the preamble.
+*
+* @internal
+*/
+const selectPnpmDocument = (content) => Effect.gen(function* () {
+	const documents = yield* Yaml.parseAll(content).pipe(Effect.mapError(syntaxFailure));
+	const document = documents.at(-1);
+	if (documents.length === 0 || isEmptyDocument(document)) return yield* Effect.fail(framingFailure("noLockfileDocument", documents.length));
+	return {
+		document,
+		documents: documents.length
+	};
+});
+/**
+* Select the sole document of a YAML lockfile format that defines **no**
+* document framing — yarn Berry's `yarn.lock`.
+*
+* @remarks
+* yarn never writes a multi-document `yarn.lock`, so there is no writer
+* contract to read a "main" document out of one. Rather than silently taking
+* the first document (which is what a single-document parse does, and how the
+* pnpm bug stayed invisible), a stream carrying more than one document fails
+* through the typed framing channel: we refuse to guess where the format
+* defines no rule.
+*
+* @internal
+*/
+const selectSoleDocument = (content) => Effect.gen(function* () {
+	const documents = yield* Yaml.parseAll(content).pipe(Effect.mapError(syntaxFailure));
+	if (documents.length > 1) return yield* Effect.fail(framingFailure("unexpectedDocuments", documents.length));
+	const document = documents.at(0);
+	if (documents.length === 0 || isEmptyDocument(document)) return yield* Effect.fail(framingFailure("noLockfileDocument", documents.length));
+	return {
+		document,
+		documents: documents.length
+	};
+});
+
+//#endregion
+export { selectPnpmDocument, selectSoleDocument };

package/internal/npm.js

@@ -0,0 +1,105 @@
+import { LockfileImporter } from "../LockfileImporter.js";
+import { ResolvedPackage } from "../ResolvedPackage.js";
+import { extractWorkspaceDeps, importerDependencies, syntaxFailure, toIntegrityHash, validationFailure } from "./shared.js";
+import { Effect, Schema } from "effect";
+
+//#region src/internal/npm.ts
+const DepRecord = Schema.optionalKey(Schema.Record(Schema.String, Schema.String));
+const NpmPackageEntry = Schema.Struct({
+	name: Schema.optionalKey(Schema.String),
+	version: Schema.optionalKey(Schema.String),
+	resolved: Schema.optionalKey(Schema.String),
+	integrity: Schema.optionalKey(Schema.String),
+	link: Schema.optionalKey(Schema.Boolean),
+	dev: Schema.optionalKey(Schema.Boolean),
+	dependencies: DepRecord,
+	devDependencies: DepRecord,
+	peerDependencies: DepRecord,
+	optionalDependencies: DepRecord
+});
+const NpmLockfileRaw = Schema.Struct({
+	name: Schema.optionalKey(Schema.String),
+	version: Schema.optionalKey(Schema.String),
+	lockfileVersion: Schema.Union([Schema.Number, Schema.String]),
+	requires: Schema.optionalKey(Schema.Boolean),
+	packages: Schema.Record(Schema.String, NpmPackageEntry)
+});
+const NODE_MODULES_PREFIX = "node_modules/";
+/**
+* Parse npm `package-lock.json` (v2/v3) content into the unified field
+* bundle. Native `JSON.parse` inside `Effect.try` — its throw on hostile
+* input (including V8's `RangeError` on pathological depth) lands typed as
+* `stage: "syntax"`.
+*
+* @internal
+*/
+const parseNpm = (content) => Effect.gen(function* () {
+	const raw = yield* Effect.try({
+		try: () => JSON.parse(content),
+		catch: syntaxFailure
+	});
+	const validated = yield* Schema.decodeUnknownEffect(NpmLockfileRaw)(raw).pipe(Effect.mapError(validationFailure));
+	return yield* toFields(validated);
+});
+const toFields = (raw) => Effect.gen(function* () {
+	const packages = [];
+	const workspaceNames = /* @__PURE__ */ new Set();
+	const workspaceEntries = /* @__PURE__ */ new Map();
+	const importers = [];
+	const rootEntry = raw.packages[""];
+	if (rootEntry) importers.push(LockfileImporter.make({
+		path: ".",
+		dependencies: importerDependencies(rootEntry, (s) => ({ specifier: s }))
+	}));
+	for (const [key, entry] of Object.entries(raw.packages)) if (key.startsWith(NODE_MODULES_PREFIX) && entry.link === true) {
+		const name = (entry.resolved !== void 0 ? raw.packages[entry.resolved] : void 0)?.name ?? entry.name ?? key.slice(13);
+		if (name !== "") workspaceNames.add(name);
+	}
+	for (const [key, entry] of Object.entries(raw.packages)) {
+		if (key === "") continue;
+		if (key.startsWith(NODE_MODULES_PREFIX) && entry.link === true) {
+			const resolved = entry.resolved;
+			const wsEntry = resolved !== void 0 ? raw.packages[resolved] : void 0;
+			const name = wsEntry?.name ?? entry.name ?? key.slice(13);
+			if (name === "") continue;
+			packages.push(ResolvedPackage.make({
+				name,
+				version: wsEntry?.version ?? "0.0.0",
+				isWorkspace: true,
+				...resolved !== void 0 ? { relativePath: resolved } : {}
+			}));
+			if (wsEntry) workspaceEntries.set(name, {
+				...wsEntry.dependencies ? { dependencies: wsEntry.dependencies } : {},
+				...wsEntry.devDependencies ? { devDependencies: wsEntry.devDependencies } : {},
+				...wsEntry.peerDependencies ? { peerDependencies: wsEntry.peerDependencies } : {},
+				...wsEntry.optionalDependencies ? { optionalDependencies: wsEntry.optionalDependencies } : {}
+			});
+			if (resolved !== void 0 && resolved !== "") importers.push(LockfileImporter.make({
+				path: resolved,
+				dependencies: wsEntry ? importerDependencies(wsEntry, (s) => ({ specifier: s })) : []
+			}));
+		} else if (key.startsWith(NODE_MODULES_PREFIX)) {
+			const name = key.slice(13);
+			if (name !== "" && entry.version !== void 0) {
+				const integrity = yield* toIntegrityHash(entry.integrity);
+				packages.push(ResolvedPackage.make({
+					name,
+					version: entry.version,
+					...integrity !== void 0 ? { integrity } : {},
+					isWorkspace: false,
+					dependencies: entry.dependencies ?? {}
+				}));
+			}
+		}
+	}
+	const workspaceDependencies = extractWorkspaceDeps(workspaceEntries, workspaceNames);
+	return {
+		lockfileVersion: String(raw.lockfileVersion),
+		packages,
+		workspaceDependencies,
+		importers
+	};
+});
+
+//#endregion
+export { parseNpm };

package/internal/pnpm.js

@@ -0,0 +1,135 @@
+import { LockfileImporter } from "../LockfileImporter.js";
+import { ResolvedPackage } from "../ResolvedPackage.js";
+import { extractWorkspaceDeps, framingFailure, importerDependencies, toIntegrityHash, validationFailure } from "./shared.js";
+import { PnpmExtension } from "../PnpmExtension.js";
+import { selectPnpmDocument } from "./documents.js";
+import { Effect, Schema } from "effect";
+
+//#region src/internal/pnpm.ts
+const PnpmImporterDeps = Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({
+	specifier: Schema.String,
+	version: Schema.String
+})));
+const PnpmImporter = Schema.Struct({
+	dependencies: PnpmImporterDeps,
+	devDependencies: PnpmImporterDeps,
+	peerDependencies: PnpmImporterDeps,
+	optionalDependencies: PnpmImporterDeps
+});
+const PnpmLockfileRaw = Schema.Struct({
+	lockfileVersion: Schema.Union([Schema.String, Schema.Number]),
+	settings: Schema.optionalKey(Schema.Struct({
+		autoInstallPeers: Schema.optionalKey(Schema.Boolean),
+		excludeLinksFromLockfile: Schema.optionalKey(Schema.Boolean)
+	})),
+	overrides: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	catalogs: Schema.optionalKey(Schema.Record(Schema.String, Schema.Record(Schema.String, Schema.Union([Schema.String, Schema.Struct({
+		specifier: Schema.String,
+		version: Schema.String
+	})])))),
+	importers: Schema.Record(Schema.String, PnpmImporter),
+	packages: Schema.optionalKey(Schema.Record(Schema.String, Schema.Struct({ resolution: Schema.optionalKey(Schema.Struct({ integrity: Schema.optionalKey(Schema.String) })) })))
+});
+/**
+* Parse pnpm `pnpm-lock.yaml` content into the unified field bundle.
+*
+* `pnpm-lock.yaml` is a YAML *stream*, not a single document: a workspace
+* using `configDependencies` gets a config-dependencies preamble document
+* ahead of the lockfile. {@link selectPnpmDocument} locates the lockfile
+* deterministically (it is the last document); a stream carrying no lockfile
+* document fails through the typed framing channel rather than silently
+* reporting the preamble as an empty workspace.
+*
+* Workspace packages are keyed by importer *path* with version `"0.0.0"`;
+* `Lockfile#withImporterNames` is the explicit second stage that rewrites
+* them to real names.
+*
+* @internal
+*/
+const parsePnpm = (content) => Effect.gen(function* () {
+	const { document, documents } = yield* selectPnpmDocument(content);
+	const validated = yield* Schema.decodeUnknownEffect(PnpmLockfileRaw)(document).pipe(Effect.mapError(validationFailure));
+	if (Object.keys(validated.importers).length === 0) return yield* Effect.fail(framingFailure("noImporters", documents));
+	return yield* toFields(validated);
+});
+const toVersionMap = (deps) => {
+	if (!deps) return void 0;
+	return Object.fromEntries(Object.entries(deps).map(([name, info]) => [name, info.specifier]));
+};
+const importerDepGroups = (importer) => [
+	importer.dependencies,
+	importer.devDependencies,
+	importer.peerDependencies,
+	importer.optionalDependencies
+];
+const toFields = (raw) => Effect.gen(function* () {
+	const workspaceEntries = /* @__PURE__ */ new Map();
+	const workspaceNames = /* @__PURE__ */ new Set();
+	const importers = [];
+	for (const [importerPath, importer] of Object.entries(raw.importers)) {
+		if (importerPath === "") continue;
+		importers.push(LockfileImporter.make({
+			path: importerPath,
+			dependencies: importerDependencies(importer, (info) => ({
+				specifier: info.specifier,
+				version: info.version
+			}))
+		}));
+		const deps = toVersionMap(importer.dependencies);
+		const devDeps = toVersionMap(importer.devDependencies);
+		const peerDeps = toVersionMap(importer.peerDependencies);
+		const optDeps = toVersionMap(importer.optionalDependencies);
+		workspaceEntries.set(importerPath, {
+			...deps ? { dependencies: deps } : {},
+			...devDeps ? { devDependencies: devDeps } : {},
+			...peerDeps ? { peerDependencies: peerDeps } : {},
+			...optDeps ? { optionalDependencies: optDeps } : {}
+		});
+		for (const group of importerDepGroups(importer)) {
+			if (!group) continue;
+			for (const [name, info] of Object.entries(group)) if (name !== "" && info.version.startsWith("link:")) workspaceNames.add(name);
+		}
+	}
+	for (const path of Object.keys(raw.importers)) if (path !== "." && path !== "") workspaceNames.add(path);
+	const packages = [];
+	for (const importerPath of Object.keys(raw.importers)) {
+		if (importerPath === "." || importerPath === "") continue;
+		packages.push(ResolvedPackage.make({
+			name: importerPath,
+			version: "0.0.0",
+			isWorkspace: true,
+			relativePath: importerPath
+		}));
+	}
+	if (raw.packages) for (const [key, pkg] of Object.entries(raw.packages)) {
+		const parenIndex = key.indexOf("(");
+		const bare = parenIndex === -1 ? key : key.slice(0, parenIndex);
+		const atIndex = bare.lastIndexOf("@");
+		if (atIndex <= 0) continue;
+		const name = bare.slice(0, atIndex);
+		const version = bare.slice(atIndex + 1);
+		const integrity = yield* toIntegrityHash(pkg.resolution?.integrity);
+		packages.push(ResolvedPackage.make({
+			name,
+			version,
+			...integrity !== void 0 ? { integrity } : {},
+			isWorkspace: false
+		}));
+	}
+	const workspaceDependencies = extractWorkspaceDeps(workspaceEntries, workspaceNames);
+	const extension = PnpmExtension.make({
+		...raw.catalogs !== void 0 ? { catalogs: raw.catalogs } : {},
+		...raw.overrides !== void 0 ? { overrides: raw.overrides } : {},
+		...raw.settings !== void 0 ? { settings: raw.settings } : {}
+	});
+	return {
+		lockfileVersion: String(raw.lockfileVersion),
+		packages,
+		workspaceDependencies,
+		importers,
+		extension
+	};
+});
+
+//#endregion
+export { parsePnpm };

package/internal/shared.js

@@ -0,0 +1,133 @@
+import { ImporterDependency } from "../ImporterDependency.js";
+import { WorkspaceDependency } from "../WorkspaceDependency.js";
+import { Effect, Exit, Schema } from "effect";
+import { DependencySpecifier, IntegrityHash } from "@effected/npm";
+
+//#region src/internal/shared.ts
+/**
+* The four dependency sections of a manifest, in a stable order — the shared
+* dependency-sections table (v3's `DEP_SECTIONS`). Each entry is both the
+* manifest field name to read and the `@effected/npm` `DependencyField` it maps
+* to, since the two coincide. Consumed by `extractWorkspaceDeps` and by the
+* pnpm/bun/npm importer builders.
+*
+* @internal
+*/
+const DEP_TYPES = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies"
+];
+/**
+* Coerce a raw lockfile integrity string to the `@effected/npm` `IntegrityHash`
+* brand, which recognizes the SRI (`<algo>-<base64>`), corepack (`<algo>.<hex>`)
+* and yarn (`<cachekey>/<hex>`) textual forms.
+*
+* Absence and corruption are treated differently, and the distinction is the
+* point. An *absent* integrity (input `undefined`) succeeds with `undefined`,
+* so the caller omits the field — a lockfile that records no integrity is
+* legitimate. A *present but unparseable* integrity fails through the same
+* validation channel the shape checks use ({@link validationFailure}), so
+* `Lockfile.parse` surfaces it as a `LockfileParseError` with
+* `stage: "validation"` rather than silently dropping a corrupt value. Never a
+* defect. yarn's `10c0/<hex>` cache checksums are a recognized form, so real
+* yarn/npm/pnpm/bun integrity all still parses; only genuine corruption fails.
+*
+* @internal
+*/
+const toIntegrityHash = (raw) => {
+	if (raw === void 0) return Effect.succeed(void 0);
+	return Schema.decodeUnknownEffect(IntegrityHash)(raw).pipe(Effect.mapError(validationFailure));
+};
+const decodeSpecifier = Schema.decodeUnknownExit(DependencySpecifier.FromString);
+/**
+* Build one {@link ImporterDependency}, decoding the raw specifier string into
+* the `@effected/npm` `ClassifiedSpecifier` tagged union. Returns `undefined`
+* — a skip, never a throw — when the name is empty or the specifier does not
+* classify (e.g. an empty specifier), per the total-string-surgery discipline.
+*
+* @internal
+*/
+const buildImporterDependency = (name, specifier, depType, version) => {
+	if (name === "") return void 0;
+	const exit = decodeSpecifier(specifier);
+	if (Exit.isFailure(exit)) return void 0;
+	return ImporterDependency.make({
+		name,
+		specifier: exit.value,
+		depType,
+		...version !== void 0 && version !== "" ? { version } : {}
+	});
+};
+/**
+* Collect an importer's declared dependencies off the shared dependency-sections
+* table. Iterates {@link DEP_TYPES} in order, projecting each section value with
+* `read`; malformed rows are skipped (never thrown). Key-bearing intermediates
+* are the schema-decoded records, whose own-property `Object.entries` iteration
+* neither pollutes nor drops a `__proto__` key.
+*
+* @internal
+*/
+const importerDependencies = (entry, read) => {
+	const deps = [];
+	for (const field of DEP_TYPES) {
+		const section = entry[field];
+		if (!section) continue;
+		for (const [name, value] of Object.entries(section)) {
+			const { specifier, version } = read(value);
+			const dep = buildImporterDependency(name, specifier, field, version);
+			if (dep !== void 0) deps.push(dep);
+		}
+	}
+	return deps;
+};
+/** @internal */
+const syntaxFailure = (cause) => ({
+	stage: "syntax",
+	cause
+});
+/** @internal */
+const validationFailure = (cause) => ({
+	stage: "validation",
+	cause
+});
+/** @internal */
+const framingFailure = (reason, documents) => ({
+	stage: "framing",
+	reason,
+	documents
+});
+/**
+* Whether the specifier is a workspace, link or file reference
+* (`"workspace:*"`, `"link:../foo"`, `"file:../bar"`).
+*
+* @internal
+*/
+const isWorkspaceSpecifier = (specifier) => specifier.startsWith("workspace:") || specifier.startsWith("link:") || specifier.startsWith("file:");
+/**
+* Extract inter-workspace dependency edges: for every workspace entry and
+* dependency type, emit an edge for each dependency whose name is itself a
+* workspace. Key-bearing intermediates are `Map`/`Set` — lockfile keys are
+* attacker-adjacent strings (`__proto__`, `constructor`) and must never be
+* assigned onto plain objects here.
+*
+* @internal
+*/
+const extractWorkspaceDeps = (workspaces, workspaceNames) => {
+	const deps = [];
+	for (const [from, entry] of workspaces) for (const depType of DEP_TYPES) {
+		const depMap = entry[depType];
+		if (!depMap) continue;
+		for (const [name, constraint] of Object.entries(depMap)) if (workspaceNames.has(name)) deps.push(WorkspaceDependency.make({
+			from,
+			to: name,
+			depType,
+			constraint
+		}));
+	}
+	return deps;
+};
+
+//#endregion
+export { DEP_TYPES, extractWorkspaceDeps, framingFailure, importerDependencies, isWorkspaceSpecifier, syntaxFailure, toIntegrityHash, validationFailure };

package/internal/yarn.js

@@ -0,0 +1,130 @@
+import { ResolvedPackage } from "../ResolvedPackage.js";
+import { extractWorkspaceDeps, toIntegrityHash, validationFailure } from "./shared.js";
+import { selectSoleDocument } from "./documents.js";
+import { Effect, Schema } from "effect";
+
+//#region src/internal/yarn.ts
+const YarnLockfileRaw = Schema.Record(Schema.String, Schema.Unknown);
+const DepRecord = Schema.optionalKey(Schema.Record(Schema.String, Schema.String));
+const YarnEntry = Schema.Struct({
+	version: Schema.optionalKey(Schema.String),
+	resolution: Schema.optionalKey(Schema.String),
+	dependencies: DepRecord,
+	devDependencies: DepRecord,
+	peerDependencies: DepRecord,
+	optionalDependencies: DepRecord,
+	checksum: Schema.optionalKey(Schema.String),
+	languageName: Schema.optionalKey(Schema.String),
+	linkType: Schema.optionalKey(Schema.String),
+	bin: Schema.optionalKey(Schema.Unknown)
+});
+const YarnMetadata = Schema.Struct({ version: Schema.optionalKey(Schema.Union([Schema.String, Schema.Number])) });
+/**
+* Parse yarn Berry `yarn.lock` content into the unified field bundle.
+*
+* Yarn Berry lockfiles are YAML with a flat key structure where each key
+* encodes package name + resolution descriptor(s) (e.g.
+* `"@scope/name@npm:^1.0.0"`); workspace entries carry `linkType: "soft"`.
+*
+* @internal
+*/
+const parseYarn = (content) => Effect.gen(function* () {
+	const { document } = yield* selectSoleDocument(content);
+	const raw = yield* Schema.decodeUnknownEffect(YarnLockfileRaw)(document).pipe(Effect.mapError(validationFailure));
+	const metadata = raw.__metadata === void 0 ? void 0 : yield* Schema.decodeUnknownEffect(YarnMetadata)(raw.__metadata).pipe(Effect.mapError(validationFailure));
+	const lockfileVersion = metadata?.version === void 0 ? "unknown" : String(metadata.version);
+	const decoded = /* @__PURE__ */ new Map();
+	for (const [key, value] of Object.entries(raw)) {
+		if (key === "__metadata") continue;
+		const entry = yield* Schema.decodeUnknownEffect(YarnEntry)(value).pipe(Effect.mapError(validationFailure));
+		decoded.set(key, entry);
+	}
+	return yield* toFields(lockfileVersion, decoded);
+});
+const toFields = (lockfileVersion, decoded) => Effect.gen(function* () {
+	const packages = [];
+	const workspaceNames = /* @__PURE__ */ new Set();
+	const workspaceEntries = /* @__PURE__ */ new Map();
+	for (const [key, entry] of decoded) if (entry.linkType === "soft") {
+		const name = extractYarnPackageName(key);
+		if (name !== void 0) workspaceNames.add(name);
+	}
+	for (const [key, entry] of decoded) {
+		const name = extractYarnPackageName(key);
+		if (name === void 0) continue;
+		const isWorkspace = entry.linkType === "soft";
+		const relativePath = isWorkspace ? extractYarnWorkspacePath(key) : void 0;
+		const integrity = yield* toIntegrityHash(entry.checksum);
+		packages.push(ResolvedPackage.make({
+			name,
+			version: entry.version ?? "0.0.0",
+			...integrity !== void 0 ? { integrity } : {},
+			isWorkspace,
+			...relativePath !== void 0 ? { relativePath } : {}
+		}));
+		if (isWorkspace) {
+			const deps = cleanYarnDeps(entry.dependencies);
+			const devDeps = cleanYarnDeps(entry.devDependencies);
+			const peerDeps = cleanYarnDeps(entry.peerDependencies);
+			const optDeps = cleanYarnDeps(entry.optionalDependencies);
+			workspaceEntries.set(name, {
+				...deps ? { dependencies: deps } : {},
+				...devDeps ? { devDependencies: devDeps } : {},
+				...peerDeps ? { peerDependencies: peerDeps } : {},
+				...optDeps ? { optionalDependencies: optDeps } : {}
+			});
+		}
+	}
+	return {
+		lockfileVersion,
+		packages,
+		workspaceDependencies: extractWorkspaceDeps(workspaceEntries, workspaceNames),
+		importers: []
+	};
+});
+/**
+* Extract the package name from a yarn lockfile key. Handles compound keys
+* (`"a@workspace:*, a@workspace:packages/a"`) via the first descriptor and
+* `@patch:` descriptors (which embed `@npm:` inside). Total: malformed keys
+* yield `undefined`.
+*
+* @internal
+*/
+const extractYarnPackageName = (key) => {
+	const commaIdx = key.indexOf(", ");
+	const descriptor = commaIdx === -1 ? key : key.slice(0, commaIdx);
+	const patchIdx = descriptor.indexOf("@patch:");
+	if (patchIdx > 0) return descriptor.slice(0, patchIdx);
+	const npmIdx = descriptor.lastIndexOf("@npm:");
+	const wsIdx = descriptor.lastIndexOf("@workspace:");
+	const idx = Math.max(npmIdx, wsIdx);
+	if (idx <= 0) return void 0;
+	return descriptor.slice(0, idx);
+};
+/**
+* Extract the workspace-relative path from a yarn lockfile key: the segment
+* after `@workspace:` in the first descriptor carrying a non-`*` path.
+*
+* @internal
+*/
+const extractYarnWorkspacePath = (key) => {
+	for (const desc of key.split(", ")) {
+		const wsIdx = desc.lastIndexOf("@workspace:");
+		if (wsIdx >= 0) {
+			const path = desc.slice(wsIdx + 11);
+			if (path !== "" && path !== "*") return path;
+		}
+	}
+};
+/**
+* Strip the `"npm:"` prefix from yarn dependency specifiers.
+*
+* @internal
+*/
+const cleanYarnDeps = (deps) => {
+	if (!deps) return void 0;
+	return Object.fromEntries(Object.entries(deps).map(([name, value]) => [name, value.startsWith("npm:") ? value.slice(4) : value]));
+};
+
+//#endregion
+export { parseYarn };