@effected/lockfiles 0.12.0 → 0.13.0

package/ImporterDependency.js

@@ -16,8 +16,10 @@ import { DependencyField, DependencySpecifier } from "@effected/npm";
 *   comparable across refs and printable. pnpm records `{ specifier, version }`
 *   per importer dependency, and the parser splits pnpm's peer-disambiguation
 *   suffix off into `peerSuffix`, so `version` is always the plain version — or
-*   a non-registry resolution (`link:../utils`, `file:...`), passed through
-*   verbatim. bun and npm record resolved versions on their package entries
+*   a non-registry resolution (`link:../utils`, `file:...`). A `file:`
+*   resolution is suffixed like a registry version when the package declares
+*   peers and is split the same way; a `link:` is never suffixed and passes
+*   through verbatim. bun and npm record resolved versions on their package entries
 *   instead, so for those formats `version` is absent and a consumer joins by
 *   `name` against `Lockfile.packages`.
 * - `peerSuffix` — pnpm's peer-disambiguation context: the raw parenthesized

package/Lockfile.js

@@ -44,9 +44,10 @@ var LockfileParseError = class extends Schema.TaggedError()("LockfileParseError"
 * lockfile document could be located in it.
 *
 * @remarks
-* `pnpm-lock.yaml` is a YAML **stream**. pnpm 11 writes a
-* config-dependencies preamble document ahead of the lockfile whenever the
-* workspace uses `configDependencies`, so the file holds two documents. The
+* `pnpm-lock.yaml` is a YAML **stream**. pnpm 11 and 12 write an env
+* preamble document ahead of the lockfile whenever the workspace declares
+* `configDependencies` or `devEngines.packageManager`, so the file holds two
+* documents. The
 * lockfile is the last one — pnpm composes the preamble as a prefix — and a
 * parser that reads only the first document gets the preamble: a document
 * that *validates*, and yields a lockfile with an empty workspace. This error
@@ -55,20 +56,24 @@ var LockfileParseError = class extends Schema.TaggedError()("LockfileParseError"
 * - `format` — which format was being parsed.
 * - `documents` — how many YAML documents the stream carried.
 * - `reason`:
-*   - `"noLockfileDocument"` — the stream carries no lockfile document. An
-*     env-only `pnpm-lock.yaml` (a config-dependencies preamble and nothing
-*     after it) reads this way, as does empty content. pnpm itself treats
-*     such a file as having no lockfile.
+*   - `"noLockfileDocument"` — the stream carries no lockfile document:
+*     empty content, or a pnpm stream whose lockfile position is empty. That
+*     includes an env preamble followed by an empty document unless the
+*     caller passes `configOnly`: pnpm writes those same bytes for a
+*     config-dependency-only workspace with no root `package.json` *and* for
+*     a workspace whose first install failed after its config dependencies
+*     were installed, so only the caller can say which it is. With
+*     `configOnly`, `Lockfile.parse` reads that stream as an empty lockfile
+*     versioned by the preamble; an empty lockfile position with no preamble
+*     fails either way.
 *   - `"noImporters"` — the located document declares no importers, so it
 *     describes no workspace. pnpm always records at least the root importer.
 *   - `"unexpectedDocuments"` — the stream carries more documents than the
 *     format's framing defines: several in a format that defines none
-*     (yarn), or more than the env preamble and the lockfile when reading a
-*     pnpm env preamble. Rather than silently picking one, parsing refuses to
-*     guess. For pnpm the limit is the env reader's alone:
-*     `PnpmEnvLockfile` enforces at most two documents, while
-*     `Lockfile.parse` reads the last document of a stream of any count and
-*     never fails with this reason.
+*     (yarn), or more than the env preamble and the lockfile in a pnpm
+*     stream. Rather than silently picking one, parsing refuses to guess.
+*     `Lockfile.parse` and `PnpmEnvLockfile` share one pnpm splitter, so
+*     both enforce the same at-most-two limit.
 *
 * It carries typed fields rather than a `cause`: unlike
 * {@link LockfileParseError}, there is no underlying engine failure to wrap —
@@ -107,11 +112,11 @@ const materializeFailure = (format, failure) => failure.stage === "framing" ? ne
 	stage: failure.stage,
 	cause: failure.cause
 });
-const dispatch = (format, content) => {
+const dispatch = (format, content, configOnly) => {
 	switch (format) {
 		case "bun": return parseBun(content);
 		case "npm": return parseNpm(content);
-		case "pnpm": return parsePnpm(content);
+		case "pnpm": return parsePnpm(content, configOnly);
 		case "yarn": return parseYarn(content);
 	}
 };
@@ -158,7 +163,14 @@ var Lockfile = class Lockfile extends Schema.Class("Lockfile")({
 	*
 	* @param content - The lockfile text (this package does no IO; the caller
 	*   reads the file).
-	* @param options - The lockfile format to parse as.
+	* @param options - `format` is the lockfile format to parse as.
+	*   `configOnly` is the caller's assertion that the workspace has **no root
+	*   `package.json`**, so a pnpm env preamble followed by an empty main
+	*   document is a config-dependency-only workspace and reads as an empty
+	*   lockfile versioned by the preamble. Without it that stream fails
+	*   {@link LockfileFramingError} with `noLockfileDocument`, because the same
+	*   bytes are also what an interrupted first install leaves behind. It
+	*   loosens nothing else, and is ignored for non-pnpm formats.
 	* @returns An `Effect` succeeding with the {@link Lockfile}, or failing
 	*   with {@link LockfileParseError} (malformed text or the wrong shape) or
 	*   {@link LockfileFramingError} (the text parsed, but no lockfile document
@@ -166,7 +178,7 @@ var Lockfile = class Lockfile extends Schema.Class("Lockfile")({
 	*   multi-document `pnpm-lock.yaml` needs it).
 	*/
 	static parse = Effect.fn("Lockfile.parse")(function* (content, options) {
-		const fields = yield* dispatch(options.format, content).pipe(Effect.mapError((failure) => materializeFailure(options.format, failure)));
+		const fields = yield* dispatch(options.format, content, options.configOnly === true).pipe(Effect.mapError((failure) => materializeFailure(options.format, failure)));
 		return Lockfile.make({
 			format: options.format,
 			lockfileVersion: fields.lockfileVersion,

package/index.d.ts

@@ -77,8 +77,10 @@ declare const ImporterDependency_base: Schema.Class<ImporterDependency, Schema.S
  *   comparable across refs and printable. pnpm records `{ specifier, version }`
  *   per importer dependency, and the parser splits pnpm's peer-disambiguation
  *   suffix off into `peerSuffix`, so `version` is always the plain version — or
- *   a non-registry resolution (`link:../utils`, `file:...`), passed through
- *   verbatim. bun and npm record resolved versions on their package entries
+ *   a non-registry resolution (`link:../utils`, `file:...`). A `file:`
+ *   resolution is suffixed like a registry version when the package declares
+ *   peers and is split the same way; a `link:` is never suffixed and passes
+ *   through verbatim. bun and npm record resolved versions on their package entries
  *   instead, so for those formats `version` is absent and a consumer joins by
  *   `name` against `Lockfile.packages`.
  * - `peerSuffix` — pnpm's peer-disambiguation context: the raw parenthesized
@@ -388,9 +390,10 @@ declare const LockfileFramingError_base: Schema.Class<LockfileFramingError, Sche
  * lockfile document could be located in it.
  *
  * @remarks
- * `pnpm-lock.yaml` is a YAML **stream**. pnpm 11 writes a
- * config-dependencies preamble document ahead of the lockfile whenever the
- * workspace uses `configDependencies`, so the file holds two documents. The
+ * `pnpm-lock.yaml` is a YAML **stream**. pnpm 11 and 12 write an env
+ * preamble document ahead of the lockfile whenever the workspace declares
+ * `configDependencies` or `devEngines.packageManager`, so the file holds two
+ * documents. The
  * lockfile is the last one — pnpm composes the preamble as a prefix — and a
  * parser that reads only the first document gets the preamble: a document
  * that *validates*, and yields a lockfile with an empty workspace. This error
@@ -399,20 +402,24 @@ declare const LockfileFramingError_base: Schema.Class<LockfileFramingError, Sche
  * - `format` — which format was being parsed.
  * - `documents` — how many YAML documents the stream carried.
  * - `reason`:
- *   - `"noLockfileDocument"` — the stream carries no lockfile document. An
- *     env-only `pnpm-lock.yaml` (a config-dependencies preamble and nothing
- *     after it) reads this way, as does empty content. pnpm itself treats
- *     such a file as having no lockfile.
+ *   - `"noLockfileDocument"` — the stream carries no lockfile document:
+ *     empty content, or a pnpm stream whose lockfile position is empty. That
+ *     includes an env preamble followed by an empty document unless the
+ *     caller passes `configOnly`: pnpm writes those same bytes for a
+ *     config-dependency-only workspace with no root `package.json` *and* for
+ *     a workspace whose first install failed after its config dependencies
+ *     were installed, so only the caller can say which it is. With
+ *     `configOnly`, `Lockfile.parse` reads that stream as an empty lockfile
+ *     versioned by the preamble; an empty lockfile position with no preamble
+ *     fails either way.
  *   - `"noImporters"` — the located document declares no importers, so it
  *     describes no workspace. pnpm always records at least the root importer.
  *   - `"unexpectedDocuments"` — the stream carries more documents than the
  *     format's framing defines: several in a format that defines none
- *     (yarn), or more than the env preamble and the lockfile when reading a
- *     pnpm env preamble. Rather than silently picking one, parsing refuses to
- *     guess. For pnpm the limit is the env reader's alone:
- *     `PnpmEnvLockfile` enforces at most two documents, while
- *     `Lockfile.parse` reads the last document of a stream of any count and
- *     never fails with this reason.
+ *     (yarn), or more than the env preamble and the lockfile in a pnpm
+ *     stream. Rather than silently picking one, parsing refuses to guess.
+ *     `Lockfile.parse` and `PnpmEnvLockfile` share one pnpm splitter, so
+ *     both enforce the same at-most-two limit.
  *
  * It carries typed fields rather than a `cause`: unlike
  * {@link LockfileParseError}, there is no underlying engine failure to wrap —
@@ -462,7 +469,14 @@ export declare class Lockfile extends Lockfile_base {
    *
    * @param content - The lockfile text (this package does no IO; the caller
    *   reads the file).
-   * @param options - The lockfile format to parse as.
+   * @param options - `format` is the lockfile format to parse as.
+   *   `configOnly` is the caller's assertion that the workspace has **no root
+   *   `package.json`**, so a pnpm env preamble followed by an empty main
+   *   document is a config-dependency-only workspace and reads as an empty
+   *   lockfile versioned by the preamble. Without it that stream fails
+   *   {@link LockfileFramingError} with `noLockfileDocument`, because the same
+   *   bytes are also what an interrupted first install leaves behind. It
+   *   loosens nothing else, and is ignored for non-pnpm formats.
    * @returns An `Effect` succeeding with the {@link Lockfile}, or failing
    *   with {@link LockfileParseError} (malformed text or the wrong shape) or
    *   {@link LockfileFramingError} (the text parsed, but no lockfile document
@@ -471,6 +485,7 @@ export declare class Lockfile extends Lockfile_base {
    */
   static readonly parse: (content: string, options: {
     readonly format: LockfileFormat;
+    readonly configOnly?: boolean | undefined;
   }) => Effect.Effect<Lockfile, LockfileFramingError | LockfileParseError, never>;
   /**
    * Rewrite pnpm importer-path names to real package names — the explicit

package/internal/bun.js

@@ -1,7 +1,7 @@
 import { BunExtension } from "../BunExtension.js";
 import { LockfileImporter } from "../LockfileImporter.js";
 import { ResolvedPackage } from "../ResolvedPackage.js";
-import { extractWorkspaceDeps, importerDependencies, peerDeclarations, syntaxFailure, toIntegrityHash, validationFailure } from "./shared.js";
+import { extractWorkspaceDeps, importerDependencies, peerDeclarations, splitNameVersion, syntaxFailure, toIntegrityHash, validationFailure } from "./shared.js";
 import { Effect, Exit, Schema } from "effect";
 import { Jsonc } from "@effected/jsonc";
 
@@ -149,10 +149,9 @@ const toFields = (raw) => Effect.gen(function* () {
 		if (tuple.length < 1) continue;
 		const first = tuple[0];
 		if (typeof first !== "string") continue;
-		const atIdx = first.lastIndexOf("@");
-		if (atIdx <= 0) continue;
-		const name = first.slice(0, atIdx);
-		const version = first.slice(atIdx + 1);
+		const split = splitNameVersion(first);
+		if (split === void 0) continue;
+		const { name, version } = split;
 		if (workspaceNames.has(name)) continue;
 		const integrity = yield* toIntegrityHash(tuple.length >= 4 && typeof tuple[3] === "string" ? tuple[3] : void 0);
 		const info = tuple.length >= 3 ? readBunPackageInfo(tuple[2]) : void 0;

package/internal/documents.js

@@ -13,41 +13,59 @@ import { Yaml } from "@effected/yaml";
 */
 const isEmptyDocument = (document) => document === null || document === void 0;
 /**
-* Select the lockfile document from a `pnpm-lock.yaml` YAML stream.
+* The number of documents pnpm's env-lockfile writer can compose: the env
+* preamble and the main lockfile. See {@link splitPnpmStream}.
 *
-* @remarks
-* pnpm 11 writes `pnpm-lock.yaml` as **up to two YAML documents** when the
-* workspace uses `configDependencies`: an optional config-dependencies
-* ("env") preamble, then the lockfile proper. The rule for picking the right
-* one is **deterministic, not a heuristic** — it is pnpm's own writer
-* contract. `writeEnvLockfile` emits `${env}---${main}`, composing the
-* preamble as a *prefix*, and `extractMainDocument` reads back everything
-* after the first separator. So the preamble is always first and the lockfile
-* is always **last**.
+* @internal
+*/
+const MAX_PNPM_DOCUMENTS = 2;
+/**
+* Split a `pnpm-lock.yaml` YAML stream into its env preamble and its main
+* lockfile document. This is the one place pnpm's document framing is
+* decided: `Lockfile.parse` projects the main document out of it and
+* `PnpmEnvLockfile` the preamble, so the two readers cannot disagree about
+* which document is which or how many a stream may carry.
 *
-* Both documents declare `lockfileVersion`, `importers` and `packages`, so
-* they are not told apart by which keys they carry — only by position. That
-* is exactly why the previous single-document assumption failed *silently*:
-* the preamble validates against the pnpm schema, yielding a `Lockfile`
-* reporting one package and an empty workspace instead of an error.
+* @remarks
+* pnpm 11 and 12 write `pnpm-lock.yaml` as **up to two YAML documents** when
+* the workspace declares `configDependencies` or `devEngines.packageManager`:
+* an env preamble, then the lockfile proper. The rule for telling them apart
+* is **deterministic, not a heuristic**. It is pnpm's own writer contract:
+* `writeEnvLockfile` emits `${env}---${main}`, composing the preamble as a
+* *prefix*, so the preamble is the **first** of two documents and the
+* lockfile is always the **last**. Both documents declare `lockfileVersion`,
+* `importers` and `packages`, so position is the only discriminator. Content
+* cannot tell them apart, which is how a single-document parse once read the
+* preamble as the lockfile and reported an empty workspace.
 *
-* An env-only lockfile (`---` preamble `---` and nothing after it, which
-* pnpm writes when there is no main lockfile yet) has an **empty** trailing
-* document. pnpm reads that as "no lockfile"; so do we, through the typed
-* framing failure — never by silently falling back to the preamble.
+* - One document: no preamble; that document is the lockfile.
+* - Two documents: the first is the preamble, the second the lockfile.
+* - More than two: outside the writer contract, so no position identifies
+*   either document. Rather than guess (the preamble feeds integrity
+*   verification, where a guess is a trust decision), it fails through the
+*   typed framing channel with `unexpectedDocuments`.
 *
-* It takes the last document of a stream of **any** count and never fails
-* with `unexpectedDocuments`; only {@link selectPnpmEnvDocument}, the env
-* reader's selector, enforces the at-most-two limit.
+* An empty document composes to `null` and occupies its position as
+* `undefined`. pnpm writes an empty *main* document after a preamble both for
+* a workspace with no root `package.json` and only `configDependencies`, and
+* for a workspace whose first install failed after its config dependencies
+* were installed (measured against pnpm 11.28.0 and 12.7.0; the bytes are
+* identical). Whether that is a lockfile is the caller's decision, not the
+* splitter's.
 *
 * @internal
 */
-const selectPnpmDocument = (content) => Effect.gen(function* () {
+const splitPnpmStream = (content) => Effect.gen(function* () {
 	const documents = yield* Yaml.parseAll(content).pipe(Effect.mapError(syntaxFailure));
-	const document = documents.at(-1);
-	if (documents.length === 0 || isEmptyDocument(document)) return yield* Effect.fail(framingFailure("noLockfileDocument", documents.length));
-	return {
-		document,
+	if (documents.length > MAX_PNPM_DOCUMENTS) return yield* Effect.fail(framingFailure("unexpectedDocuments", documents.length));
+	const present = (document) => isEmptyDocument(document) ? void 0 : document;
+	return documents.length === MAX_PNPM_DOCUMENTS ? {
+		preamble: present(documents[0]),
+		main: present(documents[1]),
+		documents: documents.length
+	} : {
+		preamble: void 0,
+		main: present(documents[0]),
 		documents: documents.length
 	};
 });
@@ -75,46 +93,6 @@ const selectSoleDocument = (content) => Effect.gen(function* () {
 		documents: documents.length
 	};
 });
-/**
-* The number of documents pnpm's env-lockfile writer can compose: the env
-* preamble and the main lockfile. See {@link selectPnpmEnvDocument}.
-*
-* @internal
-*/
-const MAX_PNPM_DOCUMENTS = 2;
-/**
-* Select the env ("preamble") document from a `pnpm-lock.yaml` YAML stream,
-* or `undefined` when the stream carries none.
-*
-* @remarks
-* The same position rule as {@link selectPnpmDocument}, read from the other
-* end: pnpm's `writeEnvLockfile` composes `${env}---${main}`, so the preamble
-* is the **first** of exactly two documents. A single-document stream has no
-* preamble — that is how pnpm writes a lockfile for a workspace that declares
-* neither `configDependencies` nor `devEngines.packageManager` — and neither
-* does an empty one. An empty first document is no preamble either: there is
-* nothing in it to read.
-*
-* A stream carrying **more** than two documents is outside the writer
-* contract, so no position identifies the preamble in it. Rather than guess —
-* this selection feeds integrity verification, where a guess is a trust
-* decision — it fails through the typed framing channel. That limit is this
-* selector's alone: {@link selectPnpmDocument}, behind `Lockfile.parse`, takes
-* the last document of a stream of any count.
-*
-* @internal
-*/
-const selectPnpmEnvDocument = (content) => Effect.gen(function* () {
-	const documents = yield* Yaml.parseAll(content).pipe(Effect.mapError(syntaxFailure));
-	if (documents.length > MAX_PNPM_DOCUMENTS) return yield* Effect.fail(framingFailure("unexpectedDocuments", documents.length));
-	if (documents.length < MAX_PNPM_DOCUMENTS) return void 0;
-	const document = documents.at(0);
-	if (isEmptyDocument(document)) return void 0;
-	return {
-		document,
-		documents: documents.length
-	};
-});
 
 //#endregion
-export { selectPnpmDocument, selectPnpmEnvDocument, selectSoleDocument };
+export { selectSoleDocument, splitPnpmStream };

package/internal/pnpm.js

@@ -1,8 +1,8 @@
 import { LockfileImporter } from "../LockfileImporter.js";
 import { ResolvedPackage } from "../ResolvedPackage.js";
-import { extractWorkspaceDeps, framingFailure, gatePnpmVersion, importerDependencies, peerDeclarations, splitPeerSuffix, toIntegrityHash, validationFailure } from "./shared.js";
+import { extractWorkspaceDeps, framingFailure, gatePnpmVersion, importerDependencies, peerDeclarations, splitNameVersion, splitPeerSuffix, toIntegrityHash, validationFailure } from "./shared.js";
 import { PnpmExtension } from "../PnpmExtension.js";
-import { selectPnpmDocument } from "./documents.js";
+import { splitPnpmStream } from "./documents.js";
 import { Effect, Schema } from "effect";
 
 //#region src/internal/pnpm.ts
@@ -46,10 +46,22 @@ const PnpmLockfileRaw = Schema.Struct({
 *
 * `pnpm-lock.yaml` is a YAML *stream*, not a single document: a workspace
 * using `configDependencies` gets a config-dependencies preamble document
-* ahead of the lockfile. {@link selectPnpmDocument} locates the lockfile
-* deterministically (it is the last document); a stream carrying no lockfile
-* document fails through the typed framing channel rather than silently
-* reporting the preamble as an empty workspace.
+* ahead of the lockfile. {@link splitPnpmStream} locates the lockfile
+* deterministically (it is the last document); the preamble is never read as
+* the lockfile.
+*
+* An empty main document after a preamble is **ambiguous**: pnpm 11 and 12
+* write exactly those bytes both for a config-dependency-only workspace with
+* no root `package.json` and for a workspace whose first install failed after
+* its config dependencies were installed. The bytes cannot tell the two apart,
+* so the parser does not decide: only when the caller asserts `configOnly`
+* (it knows the root has no `package.json`) does the stream read as an empty
+* lockfile — no packages, importers or workspace edges, versioned by the
+* preamble's `lockfileVersion` after the preamble passes the same version
+* gate. The preamble's own packages are config dependencies, not the
+* workspace's, so none of them is reported. Without the assertion, and always
+* when there is no preamble to vouch for the stream, an empty main document
+* fails `noLockfileDocument`. The flag loosens nothing else.
 *
 * Workspace packages are keyed by importer *path* with version `"0.0.0"`;
 * `Lockfile#withImporterNames` is the explicit second stage that rewrites
@@ -57,8 +69,18 @@ const PnpmLockfileRaw = Schema.Struct({
 *
 * @internal
 */
-const parsePnpm = (content) => Effect.gen(function* () {
-	const { document, documents } = yield* selectPnpmDocument(content);
+const parsePnpm = (content, configOnly) => Effect.gen(function* () {
+	const { preamble, main: document, documents } = yield* splitPnpmStream(content);
+	if (document === void 0) {
+		if (preamble === void 0 || !configOnly) return yield* Effect.fail(framingFailure("noLockfileDocument", documents));
+		return {
+			lockfileVersion: yield* gatePnpmVersion(preamble),
+			packages: [],
+			workspaceDependencies: [],
+			importers: [],
+			extension: PnpmExtension.make({})
+		};
+	}
 	yield* gatePnpmVersion(document);
 	const validated = yield* Schema.decodeUnknownEffect(PnpmLockfileRaw)(document).pipe(Effect.mapError(validationFailure));
 	if (Object.keys(validated.importers).length === 0) return yield* Effect.fail(framingFailure("noImporters", documents));
@@ -291,11 +313,9 @@ const toFields = (raw) => Effect.gen(function* () {
 		}));
 	}
 	const emit = (instanceId, meta, edges) => Effect.gen(function* () {
-		const { plain: bare } = splitPeerSuffix(instanceId);
-		const atIndex = bare.lastIndexOf("@");
-		if (atIndex <= 0) return;
-		const name = bare.slice(0, atIndex);
-		const version = bare.slice(atIndex + 1);
+		const split = splitNameVersion(splitPeerSuffix(instanceId).plain);
+		if (split === void 0) return;
+		const { name, version } = split;
 		const integrity = yield* toIntegrityHash(meta?.resolution?.integrity);
 		emitted.add(instanceId);
 		packages.push(ResolvedPackage.make({

package/internal/pnpmEnv.js

@@ -1,6 +1,6 @@
 import { ConfigDependencyLock } from "../ConfigDependencyLock.js";
 import { gatePnpmVersion, validationFailure } from "./shared.js";
-import { selectPnpmEnvDocument } from "./documents.js";
+import { splitPnpmStream } from "./documents.js";
 import { PackageManagerLock } from "../PackageManagerLock.js";
 import { Effect, Schema } from "effect";
 import { IntegrityHash } from "@effected/npm";
@@ -59,10 +59,10 @@ const recordedIntegrity = (raw, subject, name, version) => version === "" ? Effe
 * cannot disagree about which document is the preamble or what shape it has.
 */
 const decodePreamble = (content) => Effect.gen(function* () {
-	const selected = yield* selectPnpmEnvDocument(content);
-	if (selected === void 0) return void 0;
-	yield* gatePnpmVersion(selected.document);
-	return yield* Schema.decodeUnknownEffect(PnpmEnvRaw)(selected.document).pipe(Effect.mapError(validationFailure));
+	const { preamble } = yield* splitPnpmStream(content);
+	if (preamble === void 0) return void 0;
+	yield* gatePnpmVersion(preamble);
+	return yield* Schema.decodeUnknownEffect(PnpmEnvRaw)(preamble).pipe(Effect.mapError(validationFailure));
 });
 /**
 * Read the package manager pinned by a `pnpm-lock.yaml`'s env preamble.

package/internal/shared.js

@@ -42,26 +42,66 @@ const toIntegrityHash = (raw) => {
 };
 const decodeSpecifier = Schema.decodeUnknownExit(DependencySpecifier.FromString);
 /**
-* Split pnpm's peer-disambiguation suffix off a recorded string: everything
-* from the first `(` on is suffix, since package names and versions never
-* contain `(`. Handles both shapes pnpm records — a bare version
-* (`"1.0.0(effect@4.0.0)"`, importer entries) and a `name@version` snapshot key
-* (`"fdir@6.5.0(picomatch@4.0.4)"`). A string with no `(` — including
-* `link:...` / `file:...` resolutions — passes through untouched. So does a
-* protocol-bearing string (a `:` ahead of the first `(`), where a parenthesis
-* is path or URL text rather than a peer suffix: pnpm attaches suffixes to
-* registry versions only. This is the single stripping implementation — do not
-* hand-roll an `indexOf("(")` split elsewhere.
+* Split pnpm's peer-disambiguation suffix off a recorded string: the suffix is
+* the maximal TRAILING run of balanced parenthesized groups, found by scanning
+* back from the end, which is `@pnpm/dependency-path`'s own
+* `indexOfDepPathSuffix` rule. Handles both shapes pnpm records — a bare
+* version (`"1.0.0(effect@4.0.0)"`, importer entries) and a `name@version`
+* snapshot key (`"fdir@6.5.0(picomatch@4.0.4)"`) — and nested chains
+* (`"(a@1(b@2))(c@3)"`) as one suffix.
+*
+* pnpm suffixes a `file:` resolution exactly as it suffixes a registry
+* version whenever the package declares peers, directory and tarball alike
+* (`file:vendor/lib(react@18.3.1)`, measured against pnpm 12.6.0), so the rule
+* applies to protocol versions too. The one exception is `link:`, which pnpm
+* never suffixes, even when the target declares peers: a trailing group there
+* is path text and the string passes through untouched.
+*
+* A parenthesis INSIDE a path is followed by more path, so it is never part of
+* the trailing run (`file:vendor/a(b)/c(react@1.0.0)` splits after `c`). A path
+* that itself ENDS in a group is ambiguous, and it is read the way pnpm reads
+* it: pnpm writes `file:vendor/paren(lib)`'s `packages:` key as
+* `parenlib@file:vendor/paren`, so taking the group as suffix is what keeps the
+* snapshot joined to its own metadata. A string that is nothing but groups
+* yields an empty `plain`, and an unbalanced one passes through untouched.
+*
+* This is the single stripping implementation — do not hand-roll a
+* parenthesis split elsewhere.
 *
 * @internal
 */
 const splitPeerSuffix = (raw) => {
-	const parenIndex = raw.indexOf("(");
-	if (parenIndex === -1) return { plain: raw };
-	if (raw.lastIndexOf(":", parenIndex) !== -1) return { plain: raw };
+	if (raw.startsWith("link:") || !raw.endsWith(")")) return { plain: raw };
+	let open = 1;
+	for (let i = raw.length - 2; i >= 0; i--) {
+		const char = raw[i];
+		if (char === "(") open--;
+		else if (char === ")") open++;
+		else if (open === 0) return {
+			plain: raw.slice(0, i + 1),
+			peerSuffix: raw.slice(i + 1)
+		};
+	}
+	return open === 0 ? {
+		plain: "",
+		peerSuffix: raw
+	} : { plain: raw };
+};
+/**
+* Split a `name@version` key at the separator: the first `@` after a scoped
+* name's leading one. A package name holds no other `@`, while the version
+* part may (`file:../@scope/lib`), so the LAST `@` is the wrong boundary.
+* Returns `undefined` for a key with no separator after its first character
+* (`"@"`, `"@scope/"`, a bare name).
+*
+* @internal
+*/
+const splitNameVersion = (key) => {
+	const at = key.indexOf("@", 1);
+	if (at === -1) return void 0;
 	return {
-		plain: raw.slice(0, parenIndex),
-		peerSuffix: raw.slice(parenIndex)
+		name: key.slice(0, at),
+		version: key.slice(at + 1)
 	};
 };
 /**
@@ -204,9 +244,13 @@ const PnpmVersionProbe = Schema.Struct({ lockfileVersion: Schema.Union([Schema.S
 * version: decode {@link PnpmVersionProbe}, then {@link requireLockfileVersion}.
 * Call it BEFORE the shape decode, for the reason the probe documents.
 *
+* Succeeds with the gated version as the model spells it (`String` of the
+* recorded value), for a caller that reports a version without decoding the
+* rest of the document.
+*
 * @internal
 */
-const gatePnpmVersion = (document) => Schema.decodeUnknownEffect(PnpmVersionProbe)(document).pipe(Effect.mapError(validationFailure), Effect.flatMap((probe) => requireLockfileVersion("pnpm", probe.lockfileVersion)));
+const gatePnpmVersion = (document) => Schema.decodeUnknownEffect(PnpmVersionProbe)(document).pipe(Effect.mapError(validationFailure), Effect.flatMap((probe) => requireLockfileVersion("pnpm", probe.lockfileVersion).pipe(Effect.as(String(probe.lockfileVersion)))));
 /** @internal */
 const syntaxFailure = (cause) => ({
 	stage: "syntax",
@@ -255,4 +299,4 @@ const extractWorkspaceDeps = (workspaces, workspaceNames) => {
 };
 
 //#endregion
-export { DEP_TYPES, MINIMUM_LOCKFILE_VERSION, extractWorkspaceDeps, framingFailure, gatePnpmVersion, importerDependencies, isWorkspaceSpecifier, peerDeclarations, requireLockfileVersion, splitPeerSuffix, syntaxFailure, toIntegrityHash, validationFailure };
+export { DEP_TYPES, MINIMUM_LOCKFILE_VERSION, extractWorkspaceDeps, framingFailure, gatePnpmVersion, importerDependencies, isWorkspaceSpecifier, peerDeclarations, requireLockfileVersion, splitNameVersion, splitPeerSuffix, syntaxFailure, toIntegrityHash, validationFailure };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/lockfiles",
-	"version": "0.12.0",
+	"version": "0.13.0",
 	"private": false,
 	"description": "Pure lockfile parsing for bun, npm, pnpm and yarn Berry into one unified Effect schema model, with pure integrity checking against workspace manifests.",
 	"keywords": [
@@ -41,7 +41,7 @@
 	},
 	"peerDependencies": {
 		"@effected/jsonc": "^0.13.0",
-		"@effected/npm": "^0.17.0",
+		"@effected/npm": "^0.18.0",
 		"@effected/semver": "^0.9.0",
 		"@effected/yaml": "^0.17.0",
 		"effect": "4.0.0-rc.117"