@effected/package-json 0.12.0 → 0.13.0

package/Funding.js

@@ -0,0 +1,146 @@
+import { Effect, Schema, SchemaTransformation } from "effect";
+
+//#region src/Funding.ts
+const entryWires = /* @__PURE__ */ new WeakMap();
+/**
+* Entries that were the WHOLE field, written bare rather than inside an array.
+*
+* Keyed by the ENTRY, not by the decoded array: `Schema.Array` rebuilds the
+* array on the way out of the transform, so an array-keyed WeakMap is empty by
+* the time `encode` runs — verified by the arity round trip failing under it.
+* Arity provenance therefore rides the one instance that was the field, and
+* the replay is guarded on that instance still being alone.
+*/
+const bareEntries = /* @__PURE__ */ new WeakSet();
+const KNOWN_FUNDING_KEYS = /* @__PURE__ */ new Set(["type", "url"]);
+const FundingFields = Schema.Struct({
+	type: Schema.optionalKey(Schema.String),
+	url: Schema.String
+});
+const decodeFundingFields = Schema.decodeUnknownEffect(FundingFields);
+const restOf = (raw) => {
+	const rest = {};
+	for (const [key, value] of Object.entries(raw)) if (!KNOWN_FUNDING_KEYS.has(key)) rest[key] = value;
+	return rest;
+};
+/**
+* Whether the remembered object still describes this entry. Guarding the
+* replay is load-bearing: `Schema.Class` instances are not frozen, so an entry
+* mutated in place keeps a provenance entry that no longer describes it, and
+* an unguarded replay would write the ORIGINAL object back — silently
+* discarding the edit.
+*/
+const isFaithfulObject = (wire, funding) => {
+	if (wire.url !== funding.url) return false;
+	if ((typeof wire.type === "string" ? wire.type : void 0) !== funding.type) return false;
+	for (const [key, value] of Object.entries(funding.rest ?? {})) if (wire[key] !== value) return false;
+	return true;
+};
+/** Whether the bare string form can still carry everything this entry holds. */
+const isStringExpressible = (funding) => funding.type === void 0 && Object.keys(funding.rest ?? {}).length === 0;
+const encodeEntry = (funding) => {
+	const wire = entryWires.get(funding);
+	if (typeof wire === "string" && isStringExpressible(funding)) return funding.url;
+	if (wire !== void 0 && typeof wire !== "string" && isFaithfulObject(wire, funding)) return wire;
+	return {
+		...funding.type !== void 0 && { type: funding.type },
+		url: funding.url,
+		...funding.rest
+	};
+};
+const decodeEntry = (input) => {
+	if (typeof input === "string") {
+		const funding = Funding.make({ url: input });
+		entryWires.set(funding, input);
+		return Effect.succeed(funding);
+	}
+	return decodeFundingFields(input).pipe(Effect.mapError((error) => error.issue), Effect.map((fields) => {
+		const rest = restOf(input);
+		const funding = Funding.make({
+			...fields,
+			...Object.keys(rest).length > 0 ? { rest } : {}
+		});
+		entryWires.set(funding, input);
+		return funding;
+	}));
+};
+const EntryValue = Schema.Union([Schema.Record(Schema.String, Schema.Unknown), Schema.String]);
+const FieldValue = Schema.Union([EntryValue, Schema.Array(EntryValue)]);
+/**
+* Where to send money for a package: one funding entry.
+*
+* @remarks
+* npm's `funding` field accepts a bare URL string, this object form, or an
+* array of either. `url` is **required** — it is the only thing the field
+* actually says — so an object without one fails to decode rather than
+* producing a half-populated entry. `type` (`"individual"`, `"github"`, …) is
+* caller data and is kept **verbatim**, never normalized.
+*
+* @example
+* ```ts
+* import { Funding } from "@effected/package-json";
+* import { Effect, Schema } from "effect";
+*
+* const program = Effect.gen(function* () {
+*   // Always an array, whichever encoding the manifest used.
+*   const entries = yield* Schema.decodeUnknownEffect(Funding.FromField)("https://example.com/sponsor");
+*   console.log(entries[0]?.url); // "https://example.com/sponsor"
+* });
+* ```
+*
+* @public
+*/
+var Funding = class Funding extends Schema.Class("Funding")({
+	/** The funding platform, when the object form carried one (`"github"`, …). */
+	type: Schema.optionalKey(Schema.String),
+	/** Where the money goes, exactly as the manifest wrote it. */
+	url: Schema.String,
+	/** Keys outside the documented set, preserved so encoding does not drop them. */
+	rest: Schema.optionalKey(Schema.Record(Schema.String, Schema.Unknown))
+}) {
+	/**
+	* A single `funding` entry: the bare URL string or the object form, always
+	* decoded to a {@link Funding} and always re-encoded in the form it was read
+	* from.
+	*
+	* @remarks
+	* Provenance belongs to the instance, so an entry that is *rebuilt* rather
+	* than carried through has none and encodes in the canonical object form.
+	*/
+	static FromValue = EntryValue.pipe(Schema.decodeTo(Schema.instanceOf(Funding), SchemaTransformation.transformOrFail({
+		decode: (input) => decodeEntry(input),
+		encode: (funding) => Effect.succeed(encodeEntry(funding))
+	})));
+	/**
+	* The `funding` field: a lone entry or an array of them, **always** decoded
+	* to an array so a consumer never branches on arity.
+	*
+	* @remarks
+	* The normalization is one-directional. A field written bare re-encodes
+	* bare, not as a one-element array — the arity is remembered against the
+	* single entry that WAS the field, and the replay is guarded on that entry
+	* still being alone, so pushing a second entry into the decoded array in
+	* place upgrades the field to the array form instead of silently dropping
+	* the addition. An entry built by hand has no provenance, so an array of
+	* such entries encodes as an array.
+	*/
+	static FromField = FieldValue.pipe(Schema.decodeTo(Schema.Array(Schema.instanceOf(Funding)), SchemaTransformation.transformOrFail({
+		decode: (input) => {
+			const bare = !Array.isArray(input);
+			const values = bare ? [input] : input;
+			return Effect.map(Effect.forEach(values, decodeEntry), (entries) => {
+				const only = entries[0];
+				if (bare && only !== void 0) bareEntries.add(only);
+				return entries;
+			});
+		},
+		encode: (entries) => {
+			const only = entries.length === 1 ? entries[0] : void 0;
+			if (only !== void 0 && bareEntries.has(only)) return Effect.succeed(encodeEntry(only));
+			return Effect.succeed(entries.map(encodeEntry));
+		}
+	})));
+};
+
+//#endregion
+export { Funding };

package/LenientManifest.js

@@ -60,6 +60,10 @@ const FIELD_GUARDS = /* @__PURE__ */ new Map([
 	}],
 	["repository", stringOrRecordGuard],
 	["bugs", stringOrRecordGuard],
+	["funding", {
+		expected: "a string, an object, or an array of either",
+		test: (value) => isStringOrRecord(value) || isStringOrRecordArray(value)
+	}],
 	["homepage", stringGuard],
 	["dependencies", stringRecordGuard],
 	["devDependencies", stringRecordGuard],
@@ -163,6 +167,7 @@ var LenientManifest = class LenientManifest extends Schema.Class("LenientManifes
 	keywords: Schema.optionalKey(Schema.Array(Schema.String)),
 	repository: Schema.optionalKey(StringOrRecord),
 	bugs: Schema.optionalKey(StringOrRecord),
+	funding: Schema.optionalKey(Schema.Union([StringOrRecord, Schema.Array(StringOrRecord)])),
 	homepage: Schema.optionalKey(Schema.String),
 	dependencies: Schema.optionalKey(StringRecord),
 	devDependencies: Schema.optionalKey(StringRecord),

package/License.js

@@ -1,5 +1,5 @@
-import { Schema } from "effect";
-import { isValidExpression } from "@effected/spdx";
+import { Result, Schema } from "effect";
+import { SpdxExpression, isValidExpression } from "@effected/spdx";
 
 //#region src/License.ts
 /**
@@ -32,9 +32,54 @@ const isValidSpdx = (value) => {
 * A valid SPDX license identifier, expression, `UNLICENSED`, or
 * `SEE LICENSE IN <file>`.
 *
+* @remarks
+* **A branded value here is not necessarily parseable as SPDX.** npm's
+* `license` field admits two strings that the SPDX grammar does not —
+* `UNLICENSED` and `SEE LICENSE IN <file>` — and this brand accepts both,
+* because it models what a manifest may legally carry, not what SPDX defines.
+* Feeding a branded value straight to `SpdxExpression.parse` therefore fails
+* on exactly those two forms. Do not hand-screen for them — reach for
+* {@link licenseExpressionOf}, which answers "what expression is this, if any"
+* and yields `Option.none()` for a spelling that is not one. Reach for
+* {@link isValidSpdx} when the question is instead "may a manifest carry this".
+*
 * @public
 */
 const SpdxLicense = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => isValidSpdx(value) ? void 0 : "Expected a valid SPDX license expression")), Schema.brand("SpdxLicense"));
+/**
+* The parsed SPDX expression a manifest's `license` denotes, or `Option.none()`
+* when it denotes no expression at all.
+*
+* @remarks
+* This is the accessor to reach for whenever a branded `SpdxLicense` has
+* to become an actual expression — a license URL, a badge, structured data, a
+* policy check. It exists because the brand and the grammar disagree, and that
+* disagreement is knowledge these two packages jointly own rather than
+* something each consumer should rediscover.
+*
+* `UNLICENSED` and `SEE LICENSE IN <file>` are legal in a manifest and are not
+* SPDX expressions, so they yield `Option.none()`. Everything else parses.
+* A consumer screening for those two spellings by hand gets it wrong the day
+* npm admits a third — this accessor is the mechanism that prose could not be,
+* and it needs no change on that day, because "not an expression" is answered
+* by the grammar rather than by a list of spellings kept in step with npm.
+*
+* @example
+* ```ts
+* import { licenseExpressionOf } from "@effected/package-json";
+* import { SpdxExpression } from "@effected/spdx";
+*
+* // "MIT"          => Option.some(<LicenseNode MIT>)
+* // "UNLICENSED"   => Option.none()
+* // "SEE LICENSE IN LICENSE.txt" => Option.none()
+* ```
+*
+* @param license - a branded manifest license value
+* @returns the parsed expression, or none for a spelling that is not one
+*
+* @public
+*/
+const licenseExpressionOf = (license) => Result.getSuccess(SpdxExpression.parseResult(license));
 
 //#endregion
-export { InvalidSpdxLicenseError, SpdxLicense, isValidSpdx };
+export { InvalidSpdxLicenseError, SpdxLicense, isValidSpdx, licenseExpressionOf };

package/Package.js

@@ -1,5 +1,6 @@
 import { Dependency } from "./Dependency.js";
 import { DevEnginesSchema } from "./DevEngines.js";
+import { Funding } from "./Funding.js";
 import { renderJson, resolveFormatOptions } from "./internal/format.js";
 import { makeWire } from "./internal/wire.js";
 import { InvalidSpdxLicenseError, SpdxLicense, isValidSpdx } from "./License.js";
@@ -121,6 +122,7 @@ var Package = class Package extends Schema.Class("Package")({
 	keywords: Schema.optionalKey(Schema.Array(Schema.String)),
 	repository: Schema.optionalKey(Repository.FromValue),
 	bugs: Schema.optionalKey(Bugs.FromValue),
+	funding: Schema.optionalKey(Funding.FromField),
 	homepage: Schema.optionalKey(Schema.String),
 	dependencies: DependencyMapField,
 	devDependencies: DependencyMapField,

package/README.md

@@ -264,7 +264,10 @@ Every failure is a `Schema.TaggedError` routed with `Effect.catchTag`. Causes ar
 - `resolveEntryPoint` — the pure, `Result`-returning entry-point resolver over a manifest's `exports`/`main`, honoring `exports` encapsulation rather than falling through to `main`, with `EntryPointManifest` as its tolerant input shape.
 - `LenientManifest` — the shape-lenient discovery tier below `PackageManifest`: malformed known fields degrade to absence, are preserved verbatim in `rest` and reported on `issues`, rather than failing the document; `decodeResult`/`decode` and `parseResult`/`parse` in the package's usual `Result`/`Effect` pairing.
 - `Package.resolve` — `catalog:` and `workspace:` expansion over the `@effected/npm` contracts with pnpm's publish-time projection (alias form included), as an explicit step that `write` never performs for you.
-- `PackageName`, `DependencySpecifier`, `Dependency`, `SpdxLicense`, `PackageManager`, `Person`, `Repository`, `Bugs`, `DevEngine` — the leaf concepts, each owning its own statics, brand and error, usable independently of `Package`. `Repository` and `Bugs` decode the `repository` and `bugs` fields from either their shorthand or object form, the same way `Person` does for `author`, `contributors` and `maintainers`; `Repository` also exposes `browseUrl` and `gitUrl` getters that normalize a shorthand or SSH form to `https://`.
+- `PackageName`, `DependencySpecifier`, `Dependency`, `SpdxLicense`, `PackageManager`, `Person`, `Repository`, `Bugs`, `Funding`, `DevEngine` — the leaf concepts, each owning its own statics, brand and error, usable independently of `Package`. `Repository` and `Bugs` decode the `repository` and `bugs` fields from either their shorthand or object form, the same way `Person` does for `author`, `contributors` and `maintainers`; `Repository` also exposes `browseUrl` and `gitUrl` getters that normalize a shorthand or SSH form to `https://`.
+- `Repository.directoryUrl` — the browse URL of a monorepo member's own subdirectory, built from `repository.directory` against the host's path convention on GitHub, GitLab and Bitbucket. `none` for a host whose convention is unknown, or for a `directory` that climbs out of the repository — a guessed path would resolve to nothing while looking authoritative. With no `directory`, it is `browseUrl`.
+- `Funding` — the `funding` field, decoded from a bare URL string, an object, or an array of either, and **always** to an array so a consumer never branches on arity. Each entry re-encodes in the form it was read from, and unrecognized keys survive in `rest`.
+- `licenseExpressionOf` — a `SpdxLicense` as an `Option<SpdxExpression>` from `@effected/spdx`, for a caller that wants the parsed expression rather than the string. `none` for the `SEE LICENSE IN …` and `UNLICENSED` forms, which are valid `license` values but not license expressions.
 - `Package` also types `keywords`, `maintainers` and `homepage` directly, alongside the existing `author` and `contributors`.
 - Field schemas (`DependencyMapField`, `BinField`, `ExportsField`, `PublishConfigField`, `PeerDependenciesMetaField`, `StringMapField`) exported for subclasses that extend the model. `RepositoryField` is exported too but deprecated: `Package.repository` now decodes through `Repository.FromValue`, which round-trips the original shorthand or object form; `RepositoryField` remains only for consumers still matching on the raw union.
 

package/Repository.js

@@ -13,6 +13,16 @@ const BARE_SHORTHAND = /^[\w.-]+\/[\w.-]+$/;
 const PREFIXED_SHORTHAND = /^([a-z]+):(.+)$/;
 /** The scp-like form git accepts: `git@host:owner/name.git`. */
 const SCP_LIKE = /^(?:([\w.-]+)@)?([\w.-]+):(.+)$/;
+/**
+* How each known forge spells "browse this subdirectory". `HEAD` is used
+* rather than a branch name because the default branch is not knowable from a
+* manifest, and every one of these hosts resolves `HEAD` to it.
+*/
+const DIRECTORY_PATHS = /* @__PURE__ */ new Map([
+	["github.com", "tree/HEAD"],
+	["gitlab.com", "-/tree/HEAD"],
+	["bitbucket.org", "src/HEAD"]
+]);
 const stripGitSuffix = (value) => value.endsWith(".git") ? value.slice(0, -4) : value;
 /**
 * The browsable `https://host/path` form of a repository reference, or none
@@ -53,6 +63,34 @@ const KNOWN_REPOSITORY_KEYS = /* @__PURE__ */ new Set([
 	"directory"
 ]);
 const KNOWN_BUGS_KEYS = /* @__PURE__ */ new Set(["url", "email"]);
+const sameRest = (a, b) => JSON.stringify(a ?? {}) === JSON.stringify(b ?? {});
+/** The keys of `wire` outside the documented set, which is what `rest` holds. */
+const restOf = (wire, known) => {
+	const rest = {};
+	for (const [key, value] of Object.entries(wire)) if (!known.has(key)) rest[key] = value;
+	return rest;
+};
+/**
+* Whether the shorthand string can still carry everything this value holds.
+*
+* @remarks
+* A shorthand is only a `url` — it has no syntax for `type`, `directory` or an
+* unknown key. So a repository decoded from a string that later GAINS one of
+* those is no longer described by the wire it remembers, and replaying that
+* wire drops the addition silently. This is the same stale-provenance class the
+* object branch guards, reached through the one field the shorthand cannot
+* express, and `Person.isShorthandExpressible` / `Funding.isStringExpressible`
+* already gate their own string branches this way.
+*
+* `directory` is the live case: this package ships `Repository.directoryUrl`,
+* so a consumer reading a bare-string `repository` and making it a monorepo
+* member is the natural mutator.
+*/
+const isStringExpressibleRepository = (repository) => repository.type === void 0 && repository.directory === void 0 && Object.keys(repository.rest ?? {}).length === 0;
+/** Whether the bare URL string can still carry everything this `bugs` entry holds. */
+const isStringExpressibleBugs = (bugs) => bugs.email === void 0 && Object.keys(bugs.rest ?? {}).length === 0;
+const isFaithfulRepository = (wire, repository) => wire.url === repository.url && wire.type === repository.type && wire.directory === repository.directory && sameRest(restOf(wire, KNOWN_REPOSITORY_KEYS), repository.rest);
+const isFaithfulBugs = (wire, bugs) => wire.url === bugs.url && wire.email === bugs.email && sameRest(restOf(wire, KNOWN_BUGS_KEYS), bugs.rest);
 /**
 * Where a package's source lives.
 *
@@ -92,6 +130,60 @@ var Repository = class Repository extends Schema.Class("Repository")({
 		return Option.map(this.browseUrl, (url) => `${url}.git`);
 	}
 	/**
+	* The browsable URL of **this package** — {@link Repository.browseUrl}
+	* descended into `directory` when the package is a monorepo
+	* member.
+	*
+	* @remarks
+	* Prefer this over `browseUrl` whenever the question is "where does this
+	* package live". For a monorepo, `browseUrl` answers with the repository
+	* root, so every member of the repository reports the same location — which
+	* matters because that URL is exactly what a consumer (a docs site's
+	* structured data, say) uses to tell two packages apart.
+	*
+	* The three outcomes are deliberately distinct:
+	*
+	* - **No `directory`** — the package *is* the repository root, so this is
+	*   `browseUrl`. A correct answer, not a missing one.
+	* - **`directory` on a host this model knows** (GitHub, GitLab, Bitbucket) —
+	*   the descended URL.
+	* - **`directory` on any other host** — `Option.none()`. The path convention
+	*   for browsing a subdirectory is per-forge and cannot be guessed, and
+	*   fabricating one would produce a URL that resolves to nothing while
+	*   looking authoritative.
+	*
+	* What to do with that `none` is a policy this getter deliberately leaves to
+	* the caller, because it depends on what is being filled in. Falling back to
+	* {@link Repository.browseUrl} is reasonable wherever a less precise answer
+	* beats no answer — the repository root is a *true* location for the package,
+	* merely one that does not distinguish it from its siblings. Omit the value
+	* instead wherever that lack of distinction is the whole point. What is never
+	* reasonable is inventing a subdirectory path for a host this model does not
+	* recognize, which is the case this `none` exists to prevent.
+	*
+	* A `directory` that escapes the repository (any `..` segment) is refused the
+	* same way. One that resolves to the root itself (`"."`, `"/"`) is the root.
+	*
+	* @example
+	* ```ts
+	* // { url: "effected/kit", directory: "packages/spdx" }
+	* // => https://github.com/effected/kit/tree/HEAD/packages/spdx
+	* ```
+	*/
+	get directoryUrl() {
+		const directory = this.directory;
+		if (directory === void 0) return this.browseUrl;
+		const segments = directory.split("/").map((segment) => segment.trim()).filter((segment) => segment !== "" && segment !== ".");
+		if (segments.some((segment) => segment === "..")) return Option.none();
+		if (segments.length === 0) return this.browseUrl;
+		return Option.flatMap(this.browseUrl, (url) => {
+			const host = /^https:\/\/([^/]+)/.exec(url)?.[1];
+			const path = host === void 0 ? void 0 : DIRECTORY_PATHS.get(host);
+			if (path === void 0) return Option.none();
+			return Option.some(`${url}/${path}/${segments.map((segment) => encodeURIComponent(segment)).join("/")}`);
+		});
+	}
+	/**
 	* The `repository` field: the shorthand string or the object form, always
 	* decoded to a {@link Repository}, and always re-encoded in the form it was
 	* read from.
@@ -116,8 +208,8 @@ var Repository = class Repository extends Schema.Class("Repository")({
 		},
 		encode: (repository) => {
 			const wire = repositoryWires.get(repository);
-			if (typeof wire === "string" && wire === repository.url) return wire;
-			if (wire !== void 0 && typeof wire !== "string") return wire;
+			if (typeof wire === "string" && wire === repository.url && isStringExpressibleRepository(repository)) return wire;
+			if (wire !== void 0 && typeof wire !== "string" && isFaithfulRepository(wire, repository)) return wire;
 			return {
 				...repository.type !== void 0 && { type: repository.type },
 				url: repository.url,
@@ -164,8 +256,8 @@ var Bugs = class Bugs extends Schema.Class("Bugs")({
 		},
 		encode: (bugs) => {
 			const wire = bugsWires.get(bugs);
-			if (typeof wire === "string" && wire === bugs.url && bugs.email === void 0) return wire;
-			if (wire !== void 0 && typeof wire !== "string") return wire;
+			if (typeof wire === "string" && wire === bugs.url && isStringExpressibleBugs(bugs)) return wire;
+			if (wire !== void 0 && typeof wire !== "string" && isFaithfulBugs(wire, bugs)) return wire;
 			return {
 				...bugs.url !== void 0 && { url: bugs.url },
 				...bugs.email !== void 0 && { email: bugs.email },

package/index.d.ts

@@ -2,6 +2,7 @@ import { JsoncEdit, JsoncEdit as JsoncEdit$1, JsoncPath, JsoncPath as JsoncPath$
 import { CatalogResolver, DependencyKind, DependencyProtocol, DependencyProtocol as DependencyProtocol$1, DependencySpecifier, DependencySpecifierBrand, InvalidDependencySpecifierError, WorkspaceResolver, isValidDependencySpecifier } from "@effected/npm";
 import { InvalidVersionError, Range, SemVer } from "@effected/semver";
 import { Brand, Context, Effect, FileSystem, HashMap, Layer, Option, Path, Result, Schema } from "effect";
+import { SpdxExpression } from "@effected/spdx";
 //#region src/Dependency.d.ts
 declare const Dependency_base: Schema.Class<Dependency, Schema.Struct<{
   /** The package name. */
@@ -224,6 +225,72 @@ interface EntryPointManifest {
  */
 declare const resolveEntryPoint: (manifest: EntryPointManifest, options?: ResolveEntryPointOptions) => Result.Result<string, UnresolvedEntryPointError>;
 //#endregion
+//#region src/Funding.d.ts
+declare const Funding_base: Schema.Class<Funding, Schema.Struct<{
+  /** The funding platform, when the object form carried one (`"github"`, …). */
+  readonly type: Schema.optionalKey<Schema.String>;
+  /** Where the money goes, exactly as the manifest wrote it. */
+  readonly url: Schema.String;
+  /** Keys outside the documented set, preserved so encoding does not drop them. */
+  readonly rest: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>, {}>;
+/**
+ * Where to send money for a package: one funding entry.
+ *
+ * @remarks
+ * npm's `funding` field accepts a bare URL string, this object form, or an
+ * array of either. `url` is **required** — it is the only thing the field
+ * actually says — so an object without one fails to decode rather than
+ * producing a half-populated entry. `type` (`"individual"`, `"github"`, …) is
+ * caller data and is kept **verbatim**, never normalized.
+ *
+ * @example
+ * ```ts
+ * import { Funding } from "@effected/package-json";
+ * import { Effect, Schema } from "effect";
+ *
+ * const program = Effect.gen(function* () {
+ *   // Always an array, whichever encoding the manifest used.
+ *   const entries = yield* Schema.decodeUnknownEffect(Funding.FromField)("https://example.com/sponsor");
+ *   console.log(entries[0]?.url); // "https://example.com/sponsor"
+ * });
+ * ```
+ *
+ * @public
+ */
+declare class Funding extends Funding_base {
+  /**
+   * A single `funding` entry: the bare URL string or the object form, always
+   * decoded to a {@link Funding} and always re-encoded in the form it was read
+   * from.
+   *
+   * @remarks
+   * Provenance belongs to the instance, so an entry that is *rebuilt* rather
+   * than carried through has none and encodes in the canonical object form.
+   */
+  static readonly FromValue: Schema.Codec<Funding, string | {
+    readonly [k: string]: unknown;
+  }>;
+  /**
+   * The `funding` field: a lone entry or an array of them, **always** decoded
+   * to an array so a consumer never branches on arity.
+   *
+   * @remarks
+   * The normalization is one-directional. A field written bare re-encodes
+   * bare, not as a one-element array — the arity is remembered against the
+   * single entry that WAS the field, and the replay is guarded on that entry
+   * still being alone, so pushing a second entry into the decoded array in
+   * place upgrades the field to the array form instead of silently dropping
+   * the addition. An entry built by hand has no provenance, so an array of
+   * such entries encodes as an array.
+   */
+  static readonly FromField: Schema.Codec<ReadonlyArray<Funding>, string | {
+    readonly [k: string]: unknown;
+  } | ReadonlyArray<string | {
+    readonly [k: string]: unknown;
+  }>>;
+}
+//#endregion
 //#region src/License.d.ts
 declare const InvalidSpdxLicenseError_base: Schema.Class<InvalidSpdxLicenseError, Schema.TaggedStruct<"InvalidSpdxLicenseError", {
   /** The raw input string that failed validation. */
@@ -251,6 +318,17 @@ declare const isValidSpdx: (value: string) => boolean;
  * A valid SPDX license identifier, expression, `UNLICENSED`, or
  * `SEE LICENSE IN <file>`.
  *
+ * @remarks
+ * **A branded value here is not necessarily parseable as SPDX.** npm's
+ * `license` field admits two strings that the SPDX grammar does not —
+ * `UNLICENSED` and `SEE LICENSE IN <file>` — and this brand accepts both,
+ * because it models what a manifest may legally carry, not what SPDX defines.
+ * Feeding a branded value straight to `SpdxExpression.parse` therefore fails
+ * on exactly those two forms. Do not hand-screen for them — reach for
+ * {@link licenseExpressionOf}, which answers "what expression is this, if any"
+ * and yields `Option.none()` for a spelling that is not one. Reach for
+ * {@link isValidSpdx} when the question is instead "may a manifest carry this".
+ *
  * @public
  */
 declare const SpdxLicense: Schema.brand<Schema.String, "SpdxLicense">;
@@ -260,6 +338,40 @@ declare const SpdxLicense: Schema.brand<Schema.String, "SpdxLicense">;
  * @public
  */
 type SpdxLicense = string & Brand.Brand<"SpdxLicense">;
+/**
+ * The parsed SPDX expression a manifest's `license` denotes, or `Option.none()`
+ * when it denotes no expression at all.
+ *
+ * @remarks
+ * This is the accessor to reach for whenever a branded `SpdxLicense` has
+ * to become an actual expression — a license URL, a badge, structured data, a
+ * policy check. It exists because the brand and the grammar disagree, and that
+ * disagreement is knowledge these two packages jointly own rather than
+ * something each consumer should rediscover.
+ *
+ * `UNLICENSED` and `SEE LICENSE IN <file>` are legal in a manifest and are not
+ * SPDX expressions, so they yield `Option.none()`. Everything else parses.
+ * A consumer screening for those two spellings by hand gets it wrong the day
+ * npm admits a third — this accessor is the mechanism that prose could not be,
+ * and it needs no change on that day, because "not an expression" is answered
+ * by the grammar rather than by a list of spellings kept in step with npm.
+ *
+ * @example
+ * ```ts
+ * import { licenseExpressionOf } from "@effected/package-json";
+ * import { SpdxExpression } from "@effected/spdx";
+ *
+ * // "MIT"          => Option.some(<LicenseNode MIT>)
+ * // "UNLICENSED"   => Option.none()
+ * // "SEE LICENSE IN LICENSE.txt" => Option.none()
+ * ```
+ *
+ * @param license - a branded manifest license value
+ * @returns the parsed expression, or none for a spelling that is not one
+ *
+ * @public
+ */
+declare const licenseExpressionOf: (license: SpdxLicense) => Option.Option<SpdxExpression>;
 //#endregion
 //#region src/PackageManager.d.ts
 declare const PackageManager_base: Schema.Class<PackageManager, Schema.Struct<{
@@ -505,6 +617,48 @@ declare class Repository extends Repository_base {
   get browseUrl(): Option.Option<string>;
   /** The canonical https clone URL, or none when it cannot be derived. */
   get gitUrl(): Option.Option<string>;
+  /**
+   * The browsable URL of **this package** — {@link Repository.browseUrl}
+   * descended into `directory` when the package is a monorepo
+   * member.
+   *
+   * @remarks
+   * Prefer this over `browseUrl` whenever the question is "where does this
+   * package live". For a monorepo, `browseUrl` answers with the repository
+   * root, so every member of the repository reports the same location — which
+   * matters because that URL is exactly what a consumer (a docs site's
+   * structured data, say) uses to tell two packages apart.
+   *
+   * The three outcomes are deliberately distinct:
+   *
+   * - **No `directory`** — the package *is* the repository root, so this is
+   *   `browseUrl`. A correct answer, not a missing one.
+   * - **`directory` on a host this model knows** (GitHub, GitLab, Bitbucket) —
+   *   the descended URL.
+   * - **`directory` on any other host** — `Option.none()`. The path convention
+   *   for browsing a subdirectory is per-forge and cannot be guessed, and
+   *   fabricating one would produce a URL that resolves to nothing while
+   *   looking authoritative.
+   *
+   * What to do with that `none` is a policy this getter deliberately leaves to
+   * the caller, because it depends on what is being filled in. Falling back to
+   * {@link Repository.browseUrl} is reasonable wherever a less precise answer
+   * beats no answer — the repository root is a *true* location for the package,
+   * merely one that does not distinguish it from its siblings. Omit the value
+   * instead wherever that lack of distinction is the whole point. What is never
+   * reasonable is inventing a subdirectory path for a host this model does not
+   * recognize, which is the case this `none` exists to prevent.
+   *
+   * A `directory` that escapes the repository (any `..` segment) is refused the
+   * same way. One that resolves to the root itself (`"."`, `"/"`) is the root.
+   *
+   * @example
+   * ```ts
+   * // { url: "effected/kit", directory: "packages/spdx" }
+   * // => https://github.com/effected/kit/tree/HEAD/packages/spdx
+   * ```
+   */
+  get directoryUrl(): Option.Option<string>;
   /**
    * The `repository` field: the shorthand string or the object form, always
    * decoded to a {@link Repository}, and always re-encoded in the form it was
@@ -681,6 +835,11 @@ declare const Package_base: Schema.Class<Package, Schema.Struct<{
   readonly bugs: Schema.optionalKey<Schema.Codec<Bugs, string | {
     readonly [k: string]: unknown;
   }, never, never>>;
+  readonly funding: Schema.optionalKey<Schema.Codec<readonly Funding[], string | readonly (string | {
+    readonly [k: string]: unknown;
+  })[] | {
+    readonly [k: string]: unknown;
+  }, never, never>>;
   readonly homepage: Schema.optionalKey<Schema.String>;
   readonly dependencies: Schema.decodeTo<Schema.HashMap<Schema.String, Schema.String>, Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.String>, never>, never, never>;
   readonly devDependencies: Schema.decodeTo<Schema.HashMap<Schema.String, Schema.String>, Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.String>, never>, never, never>;
@@ -1112,6 +1271,7 @@ declare const LenientManifest_base: Schema.Class<LenientManifest, Schema.Struct<
   readonly keywords: Schema.optionalKey<Schema.$Array<Schema.String>>;
   readonly repository: Schema.optionalKey<Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Unknown>]>>;
   readonly bugs: Schema.optionalKey<Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Unknown>]>>;
+  readonly funding: Schema.optionalKey<Schema.Union<readonly [Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Unknown>]>, Schema.$Array<Schema.Union<readonly [Schema.String, Schema.$Record<Schema.String, Schema.Unknown>]>>]>>;
   readonly homepage: Schema.optionalKey<Schema.String>;
   readonly dependencies: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
   readonly devDependencies: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
@@ -1343,6 +1503,11 @@ declare const PackageManifest_base: Schema.Class<PackageManifest, Schema.Struct<
   readonly bugs: Schema.optionalKey<Schema.Codec<Bugs, string | {
     readonly [k: string]: unknown;
   }, never, never>>;
+  readonly funding: Schema.optionalKey<Schema.Codec<readonly Funding[], string | readonly (string | {
+    readonly [k: string]: unknown;
+  })[] | {
+    readonly [k: string]: unknown;
+  }, never, never>>;
   readonly homepage: Schema.optionalKey<Schema.String>;
   readonly dependencies: Schema.decodeTo<Schema.HashMap<Schema.String, Schema.String>, Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.String>, never>, never, never>;
   readonly devDependencies: Schema.decodeTo<Schema.HashMap<Schema.String, Schema.String>, Schema.withDecodingDefaultKey<Schema.$Record<Schema.String, Schema.String>, never>, never, never>;
@@ -1700,5 +1865,5 @@ declare class PackageValidator extends PackageValidator_base {
   }): Layer.Layer<PackageValidator>;
 }
 //#endregion
-export { BinField, Bugs, Dependency, type DependencyKind, DependencyMapField, type DependencyProtocol, DependencySpecifier, type DependencySpecifierBrand, DevEngine, DevEngineOrArray, type DevEngines, DevEnginesSchema, type EntryPointManifest, ExportsField, InvalidDependencySpecifierError, InvalidPackageNameError, InvalidSpdxLicenseError, JsoncEdit, type JsoncPath, type LenientFieldIssue, LenientManifest, Package, PackageDecodeError, type PackageFieldEdit, type PackageFormatOptions, type PackageFormatTextOptions, type PackageIndent, PackageJsonFile, type PackageJsonFileShape, PackageJsonFormat, PackageJsonModifyError, PackageJsonNotFoundError, PackageJsonParseError, PackageJsonReadError, PackageJsonSyntaxError, PackageJsonWriteError, PackageManager, PackageManagerRange, PackageManifest, PackageName, type PackagePatch, PackageValidationError, PackageValidator, PeerDependenciesMetaField, Person, PublishConfigField, Repository, RepositoryField, type ResolveEntryPointOptions, type RuleFailure, ScopedPackageName, SpdxLicense, StringMapField, type UnresolvedDependency, UnresolvedEntryPointError, UnscopedPackageName, type ValidationRule, defaultRules, isUnresolvedDependency, isValidDependencySpecifier, isValidSpdx, noLocalDepsRule, noUnresolvedDepsRule, resolveEntryPoint };
+export { BinField, Bugs, Dependency, type DependencyKind, DependencyMapField, type DependencyProtocol, DependencySpecifier, type DependencySpecifierBrand, DevEngine, DevEngineOrArray, type DevEngines, DevEnginesSchema, type EntryPointManifest, ExportsField, Funding, InvalidDependencySpecifierError, InvalidPackageNameError, InvalidSpdxLicenseError, JsoncEdit, type JsoncPath, type LenientFieldIssue, LenientManifest, Package, PackageDecodeError, type PackageFieldEdit, type PackageFormatOptions, type PackageFormatTextOptions, type PackageIndent, PackageJsonFile, type PackageJsonFileShape, PackageJsonFormat, PackageJsonModifyError, PackageJsonNotFoundError, PackageJsonParseError, PackageJsonReadError, PackageJsonSyntaxError, PackageJsonWriteError, PackageManager, PackageManagerRange, PackageManifest, PackageName, type PackagePatch, PackageValidationError, PackageValidator, PeerDependenciesMetaField, Person, PublishConfigField, Repository, RepositoryField, type ResolveEntryPointOptions, type RuleFailure, ScopedPackageName, SpdxLicense, StringMapField, type UnresolvedDependency, UnresolvedEntryPointError, UnscopedPackageName, type ValidationRule, defaultRules, isUnresolvedDependency, isValidDependencySpecifier, isValidSpdx, licenseExpressionOf, noLocalDepsRule, noUnresolvedDepsRule, resolveEntryPoint };
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -1,7 +1,8 @@
 import { Dependency, isUnresolvedDependency } from "./Dependency.js";
 import { DevEngine, DevEngineOrArray, DevEnginesSchema } from "./DevEngines.js";
 import { UnresolvedEntryPointError, resolveEntryPoint } from "./EntryPoint.js";
-import { InvalidSpdxLicenseError, SpdxLicense, isValidSpdx } from "./License.js";
+import { Funding } from "./Funding.js";
+import { InvalidSpdxLicenseError, SpdxLicense, isValidSpdx, licenseExpressionOf } from "./License.js";
 import { PackageManager } from "./PackageManager.js";
 import { InvalidPackageNameError, PackageName, ScopedPackageName, UnscopedPackageName } from "./PackageName.js";
 import { Person } from "./Person.js";
@@ -16,4 +17,4 @@ import { PackageValidationError, PackageValidator, defaultRules, noLocalDepsRule
 import { JsoncEdit } from "@effected/jsonc";
 import { DependencySpecifier, InvalidDependencySpecifierError, isValidDependencySpecifier } from "@effected/npm";
 
-export { BinField, Bugs, Dependency, DependencyMapField, DependencySpecifier, DevEngine, DevEngineOrArray, DevEnginesSchema, ExportsField, InvalidDependencySpecifierError, InvalidPackageNameError, InvalidSpdxLicenseError, JsoncEdit, LenientManifest, Package, PackageDecodeError, PackageJsonFile, PackageJsonFormat, PackageJsonModifyError, PackageJsonNotFoundError, PackageJsonParseError, PackageJsonReadError, PackageJsonSyntaxError, PackageJsonWriteError, PackageManager, PackageManagerRange, PackageManifest, PackageName, PackageValidationError, PackageValidator, PeerDependenciesMetaField, Person, PublishConfigField, Repository, RepositoryField, ScopedPackageName, SpdxLicense, StringMapField, UnresolvedEntryPointError, UnscopedPackageName, defaultRules, isUnresolvedDependency, isValidDependencySpecifier, isValidSpdx, noLocalDepsRule, noUnresolvedDepsRule, resolveEntryPoint };
+export { BinField, Bugs, Dependency, DependencyMapField, DependencySpecifier, DevEngine, DevEngineOrArray, DevEnginesSchema, ExportsField, Funding, InvalidDependencySpecifierError, InvalidPackageNameError, InvalidSpdxLicenseError, JsoncEdit, LenientManifest, Package, PackageDecodeError, PackageJsonFile, PackageJsonFormat, PackageJsonModifyError, PackageJsonNotFoundError, PackageJsonParseError, PackageJsonReadError, PackageJsonSyntaxError, PackageJsonWriteError, PackageManager, PackageManagerRange, PackageManifest, PackageName, PackageValidationError, PackageValidator, PeerDependenciesMetaField, Person, PublishConfigField, Repository, RepositoryField, ScopedPackageName, SpdxLicense, StringMapField, UnresolvedEntryPointError, UnscopedPackageName, defaultRules, isUnresolvedDependency, isValidDependencySpecifier, isValidSpdx, licenseExpressionOf, noLocalDepsRule, noUnresolvedDepsRule, resolveEntryPoint };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/package-json",
-	"version": "0.12.0",
+	"version": "0.13.0",
 	"private": false,
 	"description": "package.json parsing, editing, validation and file IO as Effect schemas.",
 	"keywords": [
@@ -39,9 +39,9 @@
 	},
 	"dependencies": {
 		"@effected/jsonc": "^0.8.0",
-		"@effected/npm": "^0.12.0",
+		"@effected/npm": "^0.12.1",
 		"@effected/semver": "^0.5.0",
-		"@effected/spdx": "^0.4.0"
+		"@effected/spdx": "^0.5.0"
 	},
 	"peerDependencies": {
 		"effect": "4.0.0-rc.109"