@effected/package-json 0.11.0 → 0.12.0

package/LenientManifest.js

@@ -0,0 +1,256 @@
+import { ExportsField, PackageDecodeError, PublishConfigField } from "./Package.js";
+import { PackageJsonSyntaxError } from "./PackageJsonFormat.js";
+import { Cause, Effect, Exit, Result, Schema } from "effect";
+
+//#region src/LenientManifest.ts
+const LenientFieldIssueSchema = Schema.Struct({
+	field: Schema.String,
+	expected: Schema.String,
+	value: Schema.Unknown
+});
+const StringRecord = Schema.Record(Schema.String, Schema.String);
+const UnknownRecord = Schema.Record(Schema.String, Schema.Unknown);
+const StringOrRecord = Schema.Union([Schema.String, UnknownRecord]);
+const isString = (value) => typeof value === "string";
+const isBoolean = (value) => typeof value === "boolean";
+const isPlainRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isStringRecord = (value) => isPlainRecord(value) && Object.values(value).every(isString);
+const isStringArray = (value) => Array.isArray(value) && value.every(isString);
+const isStringOrRecord = (value) => isString(value) || isPlainRecord(value);
+const isStringOrRecordArray = (value) => Array.isArray(value) && value.every(isStringOrRecord);
+const stringGuard = {
+	expected: "a string",
+	test: isString
+};
+const stringRecordGuard = {
+	expected: "an object of string values",
+	test: isStringRecord
+};
+const stringOrRecordGuard = {
+	expected: "a string or an object",
+	test: isStringOrRecord
+};
+const recordGuard = {
+	expected: "an object",
+	test: isPlainRecord
+};
+const FIELD_GUARDS = /* @__PURE__ */ new Map([
+	["name", stringGuard],
+	["version", stringGuard],
+	["description", stringGuard],
+	["private", {
+		expected: "a boolean",
+		test: isBoolean
+	}],
+	["type", stringGuard],
+	["main", stringGuard],
+	["license", stringGuard],
+	["author", stringOrRecordGuard],
+	["contributors", {
+		expected: "an array of strings or objects",
+		test: isStringOrRecordArray
+	}],
+	["maintainers", {
+		expected: "an array of strings or objects",
+		test: isStringOrRecordArray
+	}],
+	["keywords", {
+		expected: "an array of strings",
+		test: isStringArray
+	}],
+	["repository", stringOrRecordGuard],
+	["bugs", stringOrRecordGuard],
+	["homepage", stringGuard],
+	["dependencies", stringRecordGuard],
+	["devDependencies", stringRecordGuard],
+	["peerDependencies", stringRecordGuard],
+	["optionalDependencies", stringRecordGuard],
+	["peerDependenciesMeta", recordGuard],
+	["scripts", stringRecordGuard],
+	["bin", {
+		expected: "a string or an object of string values",
+		test: (v) => isString(v) || isStringRecord(v)
+	}],
+	["engines", stringRecordGuard],
+	["exports", stringOrRecordGuard],
+	["publishConfig", recordGuard],
+	["packageManager", stringGuard],
+	["devEngines", recordGuard]
+]);
+const sift = (raw) => {
+	const known = {};
+	const rest = Object.create(null);
+	const issues = [];
+	for (const [key, value] of Object.entries(raw)) {
+		const guard = FIELD_GUARDS.get(key);
+		if (guard === void 0) rest[key] = value;
+		else if (guard.test(value)) known[key] = value;
+		else {
+			rest[key] = value;
+			issues.push({
+				field: key,
+				expected: guard.expected,
+				value
+			});
+		}
+	}
+	return LenientManifest.make({
+		...known,
+		rest,
+		issues
+	});
+};
+const decodeRecord = Schema.decodeUnknownExit(UnknownRecord);
+/**
+* The shape-lenient view of a package.json document, for discovery and
+* sniffing — probing a fetched tarball's manifest, walking a `node_modules`
+* tree, listing candidate packages — where the document is other people's
+* data and one malformed field must not fail the read.
+*
+* @remarks
+* **This is the discovery tier, not a validation bypass.** Every field shares
+* its name with the strict `Package` model, but is typed as its plain permissive JSON
+* shape: `name` and `version` are any string (a legacy uppercase name or a
+* non-semver `"1.0"` is recovered, not rejected), `license` is any string (no
+* SPDX check), the dependency maps and `scripts` are plain string→string
+* records rather than `HashMap`s. A present field that is not even that shape
+* **degrades to absence** rather than failing the document: the raw value is
+* preserved verbatim in `rest` and the degradation is reported on `issues`,
+* so callers can surface what was ignored. Degradation granularity is the
+* top-level field — one junk entry degrades its whole map, with the raw map
+* still in `rest`.
+*
+* Leniency is per-field, never per-syntax: text that is not valid JSON fails
+* {@link LenientManifest.parseResult} as a typed
+* {@link PackageJsonSyntaxError}, and a value that is not a JSON object fails
+* {@link LenientManifest.decodeResult} as a typed {@link PackageDecodeError}.
+*
+* An empty `issues` array does **not** mean the strict tiers would accept the
+* document — the permissive shapes check JSON shape, not npm semantics. The
+* upgrade path is to decode the *original* input through
+* `PackageManifest.decode` (presence-lenient, shape-strict) or
+* `Package.decode` (strict, publishable) when validation is actually
+* wanted. This class deliberately carries no mutation statics and no write
+* path; editing belongs to the strict tiers and to
+* `PackageJsonFormat.modifyToString` / `PackageJsonFile.modify`.
+*
+* @example
+* ```ts
+* import { LenientManifest } from "@effected/package-json";
+* import { Effect } from "effect";
+*
+* const program = Effect.gen(function* () {
+*   const sniffed = yield* LenientManifest.decode({ name: "JSONStream", version: "1.0", license: 42 });
+*   console.log(sniffed.name, sniffed.version); // "JSONStream" "1.0"
+*   console.log(sniffed.issues); // [{ field: "license", expected: "a string", value: 42 }]
+*   console.log(sniffed.rest?.license); // 42 — degraded, preserved verbatim
+* });
+* ```
+*
+* @public
+*/
+var LenientManifest = class LenientManifest extends Schema.Class("LenientManifest")({
+	name: Schema.optionalKey(Schema.String),
+	version: Schema.optionalKey(Schema.String),
+	description: Schema.optionalKey(Schema.String),
+	private: Schema.optionalKey(Schema.Boolean),
+	type: Schema.optionalKey(Schema.String),
+	main: Schema.optionalKey(Schema.String),
+	license: Schema.optionalKey(Schema.String),
+	author: Schema.optionalKey(StringOrRecord),
+	contributors: Schema.optionalKey(Schema.Array(StringOrRecord)),
+	maintainers: Schema.optionalKey(Schema.Array(StringOrRecord)),
+	keywords: Schema.optionalKey(Schema.Array(Schema.String)),
+	repository: Schema.optionalKey(StringOrRecord),
+	bugs: Schema.optionalKey(StringOrRecord),
+	homepage: Schema.optionalKey(Schema.String),
+	dependencies: Schema.optionalKey(StringRecord),
+	devDependencies: Schema.optionalKey(StringRecord),
+	peerDependencies: Schema.optionalKey(StringRecord),
+	optionalDependencies: Schema.optionalKey(StringRecord),
+	peerDependenciesMeta: Schema.optionalKey(UnknownRecord),
+	scripts: Schema.optionalKey(StringRecord),
+	bin: Schema.optionalKey(Schema.Union([Schema.String, StringRecord])),
+	engines: Schema.optionalKey(StringRecord),
+	exports: Schema.optionalKey(ExportsField),
+	publishConfig: Schema.optionalKey(PublishConfigField),
+	packageManager: Schema.optionalKey(Schema.String),
+	devEngines: Schema.optionalKey(UnknownRecord),
+	/**
+	* Unknown top-level keys, plus every degraded known field's raw value,
+	* verbatim. Always present after a lenient decode (possibly empty).
+	*/
+	rest: Schema.optionalKey(UnknownRecord),
+	/** The degradations collected by the decode — empty when nothing degraded. */
+	issues: Schema.Array(LenientFieldIssueSchema)
+}) {
+	/**
+	* Decode an unknown JSON value leniently, degrading malformed fields instead
+	* of failing the document. The sync primitive backing
+	* {@link LenientManifest.decode}.
+	*
+	* @param input - the parsed package.json JSON value (e.g. from `JSON.parse`)
+	* @returns the lenient manifest, or a {@link PackageDecodeError} when
+	* `input` is not a JSON object at all (`null`, an array or a scalar) — the
+	* one failure leniency does not cover
+	*/
+	static decodeResult(input) {
+		const exit = decodeRecord(input);
+		if (Exit.isFailure(exit)) return Result.fail(new PackageDecodeError({ cause: Cause.squash(exit.cause) }));
+		return Result.succeed(sift(exit.value));
+	}
+	/**
+	* Decode an unknown JSON value leniently, degrading malformed fields instead
+	* of failing the document. The `Effect` form of
+	* {@link LenientManifest.decodeResult}, adding the tracing span.
+	*
+	* @param input - the parsed package.json JSON value (e.g. from `JSON.parse`)
+	* @returns an Effect resolving to the decoded {@link LenientManifest}
+	* @throws (typed) `PackageDecodeError` when `input` is not a JSON object
+	*/
+	static decode = Effect.fn("LenientManifest.decode")((input) => Effect.fromResult(LenientManifest.decodeResult(input)));
+	/**
+	* Parse package.json text and decode it leniently. The sync primitive
+	* backing {@link LenientManifest.parse}.
+	*
+	* @param text - the package.json source text
+	* @returns the lenient manifest, or a {@link PackageJsonSyntaxError} when
+	* the text is not valid JSON (`"invalid-json"`) or parses to something
+	* other than a JSON object (`"not-an-object"`) — leniency is per-field,
+	* never per-syntax
+	*/
+	static parseResult(text) {
+		let raw;
+		try {
+			raw = JSON.parse(text);
+		} catch (cause) {
+			return Result.fail(new PackageJsonSyntaxError({
+				reason: "invalid-json",
+				cause
+			}));
+		}
+		if (!isPlainRecord(raw)) return Result.fail(new PackageJsonSyntaxError({ reason: "not-an-object" }));
+		return Result.succeed(sift(raw));
+	}
+	/**
+	* Parse package.json text and decode it leniently. The `Effect` form of
+	* {@link LenientManifest.parseResult}, adding the tracing span.
+	*
+	* @param text - the package.json source text
+	* @returns an Effect resolving to the decoded {@link LenientManifest}
+	* @throws (typed) `PackageJsonSyntaxError` when the text is not valid JSON
+	* or is not a JSON object
+	*/
+	static parse = Effect.fn("LenientManifest.parse")((text) => Effect.fromResult(LenientManifest.parseResult(text)));
+	/** Whether the manifest is marked private. */
+	get isPrivate() {
+		return this.private ?? false;
+	}
+	/** Whether the manifest declares ESM (`"type": "module"`, exact comparison). */
+	get isESM() {
+		return this.type === "module";
+	}
+};
+
+//#endregion
+export { LenientManifest };

package/Package.js

@@ -1,8 +1,8 @@
 import { Dependency } from "./Dependency.js";
 import { DevEnginesSchema } from "./DevEngines.js";
-import { InvalidSpdxLicenseError, SpdxLicense, isValidSpdx } from "./License.js";
 import { renderJson, resolveFormatOptions } from "./internal/format.js";
 import { makeWire } from "./internal/wire.js";
+import { InvalidSpdxLicenseError, SpdxLicense, isValidSpdx } from "./License.js";
 import { PackageManager } from "./PackageManager.js";
 import { InvalidPackageNameError, PackageName } from "./PackageName.js";
 import { Person } from "./Person.js";

package/PackageManifest.js

@@ -23,10 +23,12 @@ import { SemVer } from "@effected/semver";
 * typed), a present `name` must still satisfy the npm grammar, a present
 * `packageManager` must still parse — though here the version position may be
 * a semver range (`pnpm@^11.20.0`), decoded as {@link PackageManagerRange}.
-* For total tolerance of malformed fields, use the decode-free
-* {@link PackageJsonFormat} text path (or `@effected/npm`'s shape-blind
-* `Manifest`) — silently carrying a value the type claims to have validated
-* would be a lie, and silently dropping it would break round-trip fidelity.
+* For tolerance of malformed fields, use the shape-lenient `LenientManifest`
+* discovery tier — which degrades them to absence, preserved in `rest` and
+* reported on `issues` — or the decode-free {@link PackageJsonFormat} text
+* path (or `@effected/npm`'s shape-blind `Manifest`); here, silently carrying
+* a value the type claims to have validated would be a lie, and silently
+* dropping it would break round-trip fidelity.
 *
 * The model is deliberately lean — fields, the `rest` catch-all wire codec,
 * {@link PackageManifest.decode} and {@link PackageManifest.toJsonString} —

package/README.md

@@ -184,6 +184,32 @@ console.log(Effect.runSync(program));
 
 The `workspace:` range modifier is honored: `workspace:*` takes the bare version, `workspace:^` and `workspace:~` prefix it, and an explicit modifier is used as-is. The projection is `@effected/npm`'s `DependencySpecifier` statics with full pnpm publish semantics: the alias form `workspace:<name>@<range>` resolves the *target* package's version and becomes the `npm:<name>@<range>` alias pnpm publishes, and a blank catalog name selects the default catalog. A failed catalog assembly surfaces typed as `@effected/npm`'s `CatalogAssemblyError`, alongside the contracts' `DependencyResolutionError`.
 
+## Lenient discovery
+
+`Package.decode` and `PackageManifest` are strict: a malformed field fails the whole document. That is the right behavior for a manifest you are about to write or publish, and the wrong one for a manifest you are only sniffing — a fetched tarball, a `node_modules` walk, a registry response — where the document is someone else's data and one bad field should not sink the read. `LenientManifest` is that discovery tier: every `Package` field decodes to its plain permissive JSON shape (`name` and `version` accept any string, not the branded npm grammar; `license` accepts any string, no SPDX check; the dependency maps are plain records, not `HashMap`s). A field present but not even that shape degrades to absence instead of failing the document, its raw value is preserved verbatim in `rest` (a malformed known field is treated exactly like an unknown one), and the degradation is reported on `issues`:
+
+```ts
+import { LenientManifest } from "@effected/package-json";
+import { Effect } from "effect";
+
+const program = Effect.gen(function* () {
+  const sniffed = yield* LenientManifest.decode({ name: "JSONStream", version: "1.0", license: 42 });
+  return [sniffed.name, sniffed.version, sniffed.issues, sniffed.rest?.license] as const;
+});
+
+console.log(Effect.runSync(program));
+// [
+//   "JSONStream",
+//   "1.0",
+//   [{ field: "license", expected: "a string", value: 42 }],
+//   42,
+// ]
+```
+
+Leniency is per-field, never per-syntax: `decodeResult`/`decode` still fail typed with `PackageDecodeError` when the input is not a JSON object at all (`null`, an array, a scalar), and `parseResult`/`parse` — the pair that also handles the raw `JSON.parse` — fail typed with `PackageJsonSyntaxError` when the text is not valid JSON or does not parse to an object. Each pair follows the package's usual shape: `decodeResult`/`parseResult` are the synchronous `Result` primitives, `decode`/`parse` are their `Effect` forms with a tracing span.
+
+An empty `issues` array is not a validity guarantee — the permissive shapes check JSON shape, not npm semantics, so a `LenientManifest` with no issues can still fail `Package.decode`. `LenientManifest` carries no mutation statics and no write path; once you need to validate or edit, re-decode the *original* input through `PackageManifest.decode` (presence-lenient, shape-on-presence strict) or `Package.decode` (strict, publishable).
+
 ## Resolving an entry point
 
 `resolveEntryPoint` answers one question about a manifest — which file is the package's `"."` entry — and it is pure, IO-free and `Result`-returning, so it works against a plain object with no package on disk:
@@ -236,6 +262,7 @@ Every failure is a `Schema.TaggedError` routed with `Effect.catchTag`. Causes ar
 - `PackageJsonFile` — the IO surface: `read` and `write` over core `FileSystem` / `Path`, with the platform implementation supplied at the edge.
 - `PackageValidator` — rule-based validation aggregating every failure, with the default rule set, a parameterized `layerRules` factory, and the publish-gate rules `noUnresolvedDepsRule` and `noLocalDepsRule`.
 - `resolveEntryPoint` — the pure, `Result`-returning entry-point resolver over a manifest's `exports`/`main`, honoring `exports` encapsulation rather than falling through to `main`, with `EntryPointManifest` as its tolerant input shape.
+- `LenientManifest` — the shape-lenient discovery tier below `PackageManifest`: malformed known fields degrade to absence, are preserved verbatim in `rest` and reported on `issues`, rather than failing the document; `decodeResult`/`decode` and `parseResult`/`parse` in the package's usual `Result`/`Effect` pairing.
 - `Package.resolve` — `catalog:` and `workspace:` expansion over the `@effected/npm` contracts with pnpm's publish-time projection (alias form included), as an explicit step that `write` never performs for you.
 - `PackageName`, `DependencySpecifier`, `Dependency`, `SpdxLicense`, `PackageManager`, `Person`, `Repository`, `Bugs`, `DevEngine` — the leaf concepts, each owning its own statics, brand and error, usable independently of `Package`. `Repository` and `Bugs` decode the `repository` and `bugs` fields from either their shorthand or object form, the same way `Person` does for `author`, `contributors` and `maintainers`; `Repository` also exposes `browseUrl` and `gitUrl` getters that normalize a shorthand or SSH form to `https://`.
 - `Package` also types `keywords`, `maintainers` and `homepage` directly, alongside the existing `author` and `contributors`.

package/index.d.ts

@@ -1078,6 +1078,162 @@ declare class PackageJsonFormat {
   static readonly modifyToString: (source: string, path: JsoncPath$1, value: unknown) => Effect.Effect<string, PackageJsonModifyError | PackageJsonSyntaxError, never>;
 }
 //#endregion
+//#region src/LenientManifest.d.ts
+/**
+ * One degraded field from a lenient decode: the top-level `field` that did not
+ * match its permissive shape, a human-readable description of the `expected`
+ * shape, and the raw `value` found there (also preserved verbatim under
+ * `LenientManifest.rest[field]`).
+ *
+ * A value, not an error — the decode still succeeds; issues exist so callers
+ * can report what degraded.
+ *
+ * @public
+ */
+interface LenientFieldIssue {
+  /** The top-level field name that degraded, e.g. `"name"`. */
+  readonly field: string;
+  /** A human-readable description of the permissive shape the field required. */
+  readonly expected: string;
+  /** The raw value found on the wire, preserved for reporting. */
+  readonly value: unknown;
+}
+declare const LenientManifest_base: Schema.Class<LenientManifest, Schema.Struct<{
+  readonly name: Schema.optionalKey<Schema.String>;
+  readonly version: Schema.optionalKey<Schema.String>;
+  readonly description: Schema.optionalKey<Schema.String>;
+  readonly private: Schema.optionalKey<Schema.Boolean>;
+  readonly type: Schema.optionalKey<Schema.String>;
+  readonly main: Schema.optionalKey<Schema.String>;
+  readonly license: Schema.optionalKey<Schema.String>;
+  readonly author: Schema.optionalKey<Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Unknown>]>>;
+  readonly contributors: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Unknown>]>>>;
+  readonly maintainers: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Unknown>]>>>;
+  readonly keywords: Schema.optionalKey<Schema.$Array<Schema.String>>;
+  readonly repository: Schema.optionalKey<Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Unknown>]>>;
+  readonly bugs: Schema.optionalKey<Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Unknown>]>>;
+  readonly homepage: Schema.optionalKey<Schema.String>;
+  readonly dependencies: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+  readonly devDependencies: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+  readonly peerDependencies: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+  readonly optionalDependencies: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+  readonly peerDependenciesMeta: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Unknown>>;
+  readonly scripts: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+  readonly bin: Schema.optionalKey<Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.String>]>>;
+  readonly engines: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+  readonly exports: Schema.optionalKey<Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Unknown>]>>;
+  readonly publishConfig: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Unknown>>;
+  readonly packageManager: Schema.optionalKey<Schema.String>;
+  readonly devEngines: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Unknown>>;
+  /**
+   * Unknown top-level keys, plus every degraded known field's raw value,
+   * verbatim. Always present after a lenient decode (possibly empty).
+   */
+  readonly rest: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Unknown>>;
+  /** The degradations collected by the decode — empty when nothing degraded. */
+  readonly issues: Schema.$Array<Schema.Struct<{
+    readonly field: Schema.String;
+    readonly expected: Schema.String;
+    readonly value: Schema.Unknown;
+  }>>;
+}>, {}>;
+/**
+ * The shape-lenient view of a package.json document, for discovery and
+ * sniffing — probing a fetched tarball's manifest, walking a `node_modules`
+ * tree, listing candidate packages — where the document is other people's
+ * data and one malformed field must not fail the read.
+ *
+ * @remarks
+ * **This is the discovery tier, not a validation bypass.** Every field shares
+ * its name with the strict `Package` model, but is typed as its plain permissive JSON
+ * shape: `name` and `version` are any string (a legacy uppercase name or a
+ * non-semver `"1.0"` is recovered, not rejected), `license` is any string (no
+ * SPDX check), the dependency maps and `scripts` are plain string→string
+ * records rather than `HashMap`s. A present field that is not even that shape
+ * **degrades to absence** rather than failing the document: the raw value is
+ * preserved verbatim in `rest` and the degradation is reported on `issues`,
+ * so callers can surface what was ignored. Degradation granularity is the
+ * top-level field — one junk entry degrades its whole map, with the raw map
+ * still in `rest`.
+ *
+ * Leniency is per-field, never per-syntax: text that is not valid JSON fails
+ * {@link LenientManifest.parseResult} as a typed
+ * {@link PackageJsonSyntaxError}, and a value that is not a JSON object fails
+ * {@link LenientManifest.decodeResult} as a typed {@link PackageDecodeError}.
+ *
+ * An empty `issues` array does **not** mean the strict tiers would accept the
+ * document — the permissive shapes check JSON shape, not npm semantics. The
+ * upgrade path is to decode the *original* input through
+ * `PackageManifest.decode` (presence-lenient, shape-strict) or
+ * `Package.decode` (strict, publishable) when validation is actually
+ * wanted. This class deliberately carries no mutation statics and no write
+ * path; editing belongs to the strict tiers and to
+ * `PackageJsonFormat.modifyToString` / `PackageJsonFile.modify`.
+ *
+ * @example
+ * ```ts
+ * import { LenientManifest } from "@effected/package-json";
+ * import { Effect } from "effect";
+ *
+ * const program = Effect.gen(function* () {
+ *   const sniffed = yield* LenientManifest.decode({ name: "JSONStream", version: "1.0", license: 42 });
+ *   console.log(sniffed.name, sniffed.version); // "JSONStream" "1.0"
+ *   console.log(sniffed.issues); // [{ field: "license", expected: "a string", value: 42 }]
+ *   console.log(sniffed.rest?.license); // 42 — degraded, preserved verbatim
+ * });
+ * ```
+ *
+ * @public
+ */
+declare class LenientManifest extends LenientManifest_base {
+  /**
+   * Decode an unknown JSON value leniently, degrading malformed fields instead
+   * of failing the document. The sync primitive backing
+   * {@link LenientManifest.decode}.
+   *
+   * @param input - the parsed package.json JSON value (e.g. from `JSON.parse`)
+   * @returns the lenient manifest, or a {@link PackageDecodeError} when
+   * `input` is not a JSON object at all (`null`, an array or a scalar) — the
+   * one failure leniency does not cover
+   */
+  static decodeResult(input: unknown): Result.Result<LenientManifest, PackageDecodeError>;
+  /**
+   * Decode an unknown JSON value leniently, degrading malformed fields instead
+   * of failing the document. The `Effect` form of
+   * {@link LenientManifest.decodeResult}, adding the tracing span.
+   *
+   * @param input - the parsed package.json JSON value (e.g. from `JSON.parse`)
+   * @returns an Effect resolving to the decoded {@link LenientManifest}
+   * @throws (typed) `PackageDecodeError` when `input` is not a JSON object
+   */
+  static readonly decode: (input: unknown) => Effect.Effect<LenientManifest, PackageDecodeError, never>;
+  /**
+   * Parse package.json text and decode it leniently. The sync primitive
+   * backing {@link LenientManifest.parse}.
+   *
+   * @param text - the package.json source text
+   * @returns the lenient manifest, or a {@link PackageJsonSyntaxError} when
+   * the text is not valid JSON (`"invalid-json"`) or parses to something
+   * other than a JSON object (`"not-an-object"`) — leniency is per-field,
+   * never per-syntax
+   */
+  static parseResult(text: string): Result.Result<LenientManifest, PackageJsonSyntaxError>;
+  /**
+   * Parse package.json text and decode it leniently. The `Effect` form of
+   * {@link LenientManifest.parseResult}, adding the tracing span.
+   *
+   * @param text - the package.json source text
+   * @returns an Effect resolving to the decoded {@link LenientManifest}
+   * @throws (typed) `PackageJsonSyntaxError` when the text is not valid JSON
+   * or is not a JSON object
+   */
+  static readonly parse: (text: string) => Effect.Effect<LenientManifest, PackageJsonSyntaxError, never>;
+  /** Whether the manifest is marked private. */
+  get isPrivate(): boolean;
+  /** Whether the manifest declares ESM (`"type": "module"`, exact comparison). */
+  get isESM(): boolean;
+}
+//#endregion
 //#region src/PackageManagerRange.d.ts
 declare const PackageManagerRange_base: Schema.Class<PackageManagerRange, Schema.Struct<{
   /** The package-manager name (e.g. `pnpm`). Any lowercase name — the same latitude as {@link PackageManager}, for the same evidence. */
@@ -1233,10 +1389,12 @@ declare const PackageManifest_base: Schema.Class<PackageManifest, Schema.Struct<
  * typed), a present `name` must still satisfy the npm grammar, a present
  * `packageManager` must still parse — though here the version position may be
  * a semver range (`pnpm@^11.20.0`), decoded as {@link PackageManagerRange}.
- * For total tolerance of malformed fields, use the decode-free
- * {@link PackageJsonFormat} text path (or `@effected/npm`'s shape-blind
- * `Manifest`) — silently carrying a value the type claims to have validated
- * would be a lie, and silently dropping it would break round-trip fidelity.
+ * For tolerance of malformed fields, use the shape-lenient `LenientManifest`
+ * discovery tier — which degrades them to absence, preserved in `rest` and
+ * reported on `issues` — or the decode-free {@link PackageJsonFormat} text
+ * path (or `@effected/npm`'s shape-blind `Manifest`); here, silently carrying
+ * a value the type claims to have validated would be a lie, and silently
+ * dropping it would break round-trip fidelity.
  *
  * The model is deliberately lean — fields, the `rest` catch-all wire codec,
  * {@link PackageManifest.decode} and {@link PackageManifest.toJsonString} —
@@ -1542,5 +1700,5 @@ declare class PackageValidator extends PackageValidator_base {
   }): Layer.Layer<PackageValidator>;
 }
 //#endregion
-export { BinField, Bugs, Dependency, type DependencyKind, DependencyMapField, type DependencyProtocol, DependencySpecifier, type DependencySpecifierBrand, DevEngine, DevEngineOrArray, type DevEngines, DevEnginesSchema, type EntryPointManifest, ExportsField, InvalidDependencySpecifierError, InvalidPackageNameError, InvalidSpdxLicenseError, JsoncEdit, type JsoncPath, Package, PackageDecodeError, type PackageFieldEdit, type PackageFormatOptions, type PackageFormatTextOptions, type PackageIndent, PackageJsonFile, type PackageJsonFileShape, PackageJsonFormat, PackageJsonModifyError, PackageJsonNotFoundError, PackageJsonParseError, PackageJsonReadError, PackageJsonSyntaxError, PackageJsonWriteError, PackageManager, PackageManagerRange, PackageManifest, PackageName, type PackagePatch, PackageValidationError, PackageValidator, PeerDependenciesMetaField, Person, PublishConfigField, Repository, RepositoryField, type ResolveEntryPointOptions, type RuleFailure, ScopedPackageName, SpdxLicense, StringMapField, type UnresolvedDependency, UnresolvedEntryPointError, UnscopedPackageName, type ValidationRule, defaultRules, isUnresolvedDependency, isValidDependencySpecifier, isValidSpdx, noLocalDepsRule, noUnresolvedDepsRule, resolveEntryPoint };
+export { BinField, Bugs, Dependency, type DependencyKind, DependencyMapField, type DependencyProtocol, DependencySpecifier, type DependencySpecifierBrand, DevEngine, DevEngineOrArray, type DevEngines, DevEnginesSchema, type EntryPointManifest, ExportsField, InvalidDependencySpecifierError, InvalidPackageNameError, InvalidSpdxLicenseError, JsoncEdit, type JsoncPath, type LenientFieldIssue, LenientManifest, Package, PackageDecodeError, type PackageFieldEdit, type PackageFormatOptions, type PackageFormatTextOptions, type PackageIndent, PackageJsonFile, type PackageJsonFileShape, PackageJsonFormat, PackageJsonModifyError, PackageJsonNotFoundError, PackageJsonParseError, PackageJsonReadError, PackageJsonSyntaxError, PackageJsonWriteError, PackageManager, PackageManagerRange, PackageManifest, PackageName, type PackagePatch, PackageValidationError, PackageValidator, PeerDependenciesMetaField, Person, PublishConfigField, Repository, RepositoryField, type ResolveEntryPointOptions, type RuleFailure, ScopedPackageName, SpdxLicense, StringMapField, type UnresolvedDependency, UnresolvedEntryPointError, UnscopedPackageName, type ValidationRule, defaultRules, isUnresolvedDependency, isValidDependencySpecifier, isValidSpdx, noLocalDepsRule, noUnresolvedDepsRule, resolveEntryPoint };
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -8,6 +8,7 @@ import { Person } from "./Person.js";
 import { Bugs, Repository } from "./Repository.js";
 import { BinField, DependencyMapField, ExportsField, Package, PackageDecodeError, PeerDependenciesMetaField, PublishConfigField, RepositoryField, StringMapField } from "./Package.js";
 import { PackageJsonFormat, PackageJsonModifyError, PackageJsonSyntaxError } from "./PackageJsonFormat.js";
+import { LenientManifest } from "./LenientManifest.js";
 import { PackageManagerRange } from "./PackageManagerRange.js";
 import { PackageManifest } from "./PackageManifest.js";
 import { PackageJsonFile, PackageJsonNotFoundError, PackageJsonParseError, PackageJsonReadError, PackageJsonWriteError } from "./PackageJsonFile.js";
@@ -15,4 +16,4 @@ import { PackageValidationError, PackageValidator, defaultRules, noLocalDepsRule
 import { JsoncEdit } from "@effected/jsonc";
 import { DependencySpecifier, InvalidDependencySpecifierError, isValidDependencySpecifier } from "@effected/npm";
 
-export { BinField, Bugs, Dependency, DependencyMapField, DependencySpecifier, DevEngine, DevEngineOrArray, DevEnginesSchema, ExportsField, InvalidDependencySpecifierError, InvalidPackageNameError, InvalidSpdxLicenseError, JsoncEdit, Package, PackageDecodeError, PackageJsonFile, PackageJsonFormat, PackageJsonModifyError, PackageJsonNotFoundError, PackageJsonParseError, PackageJsonReadError, PackageJsonSyntaxError, PackageJsonWriteError, PackageManager, PackageManagerRange, PackageManifest, PackageName, PackageValidationError, PackageValidator, PeerDependenciesMetaField, Person, PublishConfigField, Repository, RepositoryField, ScopedPackageName, SpdxLicense, StringMapField, UnresolvedEntryPointError, UnscopedPackageName, defaultRules, isUnresolvedDependency, isValidDependencySpecifier, isValidSpdx, noLocalDepsRule, noUnresolvedDepsRule, resolveEntryPoint };
+export { BinField, Bugs, Dependency, DependencyMapField, DependencySpecifier, DevEngine, DevEngineOrArray, DevEnginesSchema, ExportsField, InvalidDependencySpecifierError, InvalidPackageNameError, InvalidSpdxLicenseError, JsoncEdit, LenientManifest, Package, PackageDecodeError, PackageJsonFile, PackageJsonFormat, PackageJsonModifyError, PackageJsonNotFoundError, PackageJsonParseError, PackageJsonReadError, PackageJsonSyntaxError, PackageJsonWriteError, PackageManager, PackageManagerRange, PackageManifest, PackageName, PackageValidationError, PackageValidator, PeerDependenciesMetaField, Person, PublishConfigField, Repository, RepositoryField, ScopedPackageName, SpdxLicense, StringMapField, UnresolvedEntryPointError, UnscopedPackageName, defaultRules, isUnresolvedDependency, isValidDependencySpecifier, isValidSpdx, noLocalDepsRule, noUnresolvedDepsRule, resolveEntryPoint };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/package-json",
-	"version": "0.11.0",
+	"version": "0.12.0",
 	"private": false,
 	"description": "package.json parsing, editing, validation and file IO as Effect schemas.",
 	"keywords": [
@@ -38,7 +38,7 @@
 		"./package.json": "./package.json"
 	},
 	"dependencies": {
-		"@effected/jsonc": "^0.7.0",
+		"@effected/jsonc": "^0.8.0",
 		"@effected/npm": "^0.12.0",
 		"@effected/semver": "^0.5.0",
 		"@effected/spdx": "^0.4.0"