@packall/core 0.0.1 → 0.1.0

package/dist/index.js

@@ -1,26 +1,18 @@
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
-import { create } from "tar";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import * as Getter from "effect/SchemaGetter";
+import semver from "semver";
 import * as Context from "effect/Context";
 import * as Layer from "effect/Layer";
 import * as Ref from "effect/Ref";
-import * as Path from "effect/Path";
 import { createHash, timingSafeEqual } from "node:crypto";
-import semver from "semver";
-
-//#region rolldown:runtime
-var __defProp = Object.defineProperty;
-var __export = (all) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	return target;
-};
+import { parse } from "yaml";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { create } from "tar";
 
-//#endregion
-//#region src/Errors.ts
+//#region src/errors.ts
 var BundlerErrorBase = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -49,6 +41,61 @@ var InvalidInputFileError = class extends BundlerErrorBase {
 		this.reason = reason;
 	}
 };
+/** A lockfile could not be read, or is in a format we do not support. */
+var LockfileError = class extends BundlerErrorBase {
+	_tag = "LockfileError";
+	path;
+	reason;
+	constructor(path, reason, options) {
+		super(`Lockfile ${path}: ${reason}`, options);
+		this.path = path;
+		this.reason = reason;
+	}
+};
+/**
+* The lockfile parsed, but does not pin everything the bundle needs.
+*
+* Falling back to a range here would defeat the entire point of reading a
+* lockfile — you would get a bundle that is *mostly* what CI installed, with no
+* indication of which parts were guessed. So this is fatal, and it names every
+* gap at once so one `npm install` fixes all of them.
+*/
+var LockfileIncompleteError = class extends BundlerErrorBase {
+	_tag = "LockfileIncompleteError";
+	path;
+	missing;
+	constructor(path, missing, detail, remedy) {
+		const shown = missing.slice(0, 10).map((entry) => `    ${entry}`).join("\n");
+		const rest = missing.length > 10 ? `\n    … and ${missing.length - 10} more` : "";
+		super(`${path} is incomplete — ${detail}:\n${shown}${rest}\n  ${remedy}\n  Or pass --lockfile off to resolve version ranges fresh instead.`);
+		this.path = path;
+		this.missing = missing;
+	}
+};
+/**
+* The lockfile pins versions the registry no longer serves.
+*
+* Unpublished, or never mirrored into a private registry. Either way the
+* bundle cannot be built as specified, and quietly substituting a nearby
+* version would produce exactly the mismatch this feature exists to prevent.
+*/
+var LockfileOutOfDateError = class extends BundlerErrorBase {
+	_tag = "LockfileOutOfDateError";
+	path;
+	registry;
+	missing;
+	constructor(path, registry, missing) {
+		const shown = missing.slice(0, 10).map((entry) => `    ${entry.name}@${entry.version} — ${entry.detail}`).join("\n");
+		const rest = missing.length > 10 ? `\n    … and ${missing.length - 10} more` : "";
+		super(`${path} pins ${missing.length} version${missing.length === 1 ? "" : "s"} that ${registry} does not serve:\n${shown}${rest}\n  Refresh the lockfile against this registry, or pass --lockfile off to\n  resolve version ranges fresh instead.`);
+		this.path = path;
+		this.registry = registry;
+		this.missing = missing.map(({ name, version }) => ({
+			name,
+			version
+		}));
+	}
+};
 /**
 * The registry could not be reached at all — DNS failure, refused connection,
 * proxy blackhole, or a preflight that timed out.
@@ -59,11 +106,11 @@ var InvalidInputFileError = class extends BundlerErrorBase {
 var RegistryUnreachableError = class extends BundlerErrorBase {
 	_tag = "RegistryUnreachableError";
 	registry;
-	timeoutMillis;
+	timeoutMs;
 	constructor(registry, detail, options) {
 		super(`Cannot reach registry ${registry}: ${detail}.\n  Check your network connection, VPN, and the proxy settings in your .npmrc.`, options);
 		this.registry = registry;
-		this.timeoutMillis = options?.timeoutMillis;
+		this.timeoutMs = options?.timeoutMs;
 	}
 };
 /** The registry answered, but has never heard of this package. */
@@ -175,1148 +222,2463 @@ const safeHost = (registry) => {
 };
 
 //#endregion
-//#region src/Progress.ts
-var Progress_exports = /* @__PURE__ */ __export({
-	Progress: () => Progress,
-	emit: () => emit,
-	layerCallback: () => layerCallback,
-	layerSilent: () => layerSilent,
-	makeCollector: () => makeCollector
-});
-/** Service tag for progress reporting. */
-var Progress = class extends Context.Service()("@packall/core/Progress") {};
-/** Emits an event to whichever reporter is installed. */
-const emit = (event) => Effect.gen(function* () {
-	yield* (yield* Progress).emit(event);
-});
+//#region src/enums/artifact-kind.ts
+/** What a bundle run wrote to the output directory. */
+const ArtifactKind = {
+	Archive: "archive",
+	Directory: "directory"
+};
+
+//#endregion
+//#region src/enums/edge-kind.ts
 /**
-* Discards every event.
+* Why one package depends on another.
 *
-* The default for library consumers and for tests that do not care about
-* progress — silence should never require ceremony.
+* `EdgeKind` and `LockedRootKind` are one concept in two parts, which is why
+* they share a file: `Dev` exists only at the top level, because lockfiles
+* record dev dependencies for the project alone — a transitive devDependency is
+* never installed, so it is never locked.
 */
-const layerSilent = Layer.succeed(Progress)({ emit: () => Effect.void });
-/** Sends every event to a callback. Used by the CLI renderer. */
-const layerCallback = (onEvent) => Layer.succeed(Progress)({ emit: (event) => Effect.sync(() => onEvent(event)) });
+const EdgeKind = {
+	Prod: "prod",
+	Optional: "optional",
+	Peer: "peer"
+};
+/** The kind that only a direct dependency of the locked project can have. */
+const DirectOnlyKind = { Dev: "dev" };
+/** Why a direct dependency of the locked project is a root. */
+const LockedRootKind = {
+	...EdgeKind,
+	...DirectOnlyKind
+};
+
+//#endregion
+//#region src/enums/input-file-kind.ts
+/** Which of the three shapes a `--file` input turned out to be. */
+const InputFileKind = {
+	PackageJson: "package.json",
+	Lockfile: "lockfile",
+	List: "list"
+};
+
+//#endregion
+//#region src/enums/layout.ts
+/** How the resulting tarball(s) are shaped. */
+const Layout = {
+	PerSpec: "per-spec",
+	Single: "single",
+	Dir: "dir"
+};
+const Layouts = Object.values(Layout);
+
+//#endregion
+//#region src/enums/lockfile-format.ts
+/** Which package manager wrote a lockfile. */
+const LockfileFormat = {
+	Npm: "npm",
+	Pnpm: "pnpm",
+	Bun: "bun"
+};
+
+//#endregion
+//#region src/enums/phase.ts
+/** The phases a bundle run moves through, in order. */
+const Phase = {
+	Preflight: "preflight",
+	Resolve: "resolve",
+	Download: "download",
+	Archive: "archive",
+	Done: "done"
+};
+
+//#endregion
+//#region src/utils/is-record.ts
 /**
-* Accumulates every event into a `Ref`, for assertions.
+* Narrows an unknown value to a plain object.
 *
-* Returned as `[layer, ref]` so a test can provide the layer and then read the
-* transcript afterwards.
+* The entry point for reading anything the tool does not control — lockfiles,
+* package.json files, registry responses — without reaching for a cast.
 */
-const makeCollector = Effect.gen(function* () {
-	const ref = yield* Ref.make([]);
-	return {
-		layer: Layer.succeed(Progress)({ emit: (event) => Ref.update(ref, (events) => [...events, event]) }),
-		events: Ref.get(ref)
-	};
-});
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 
 //#endregion
-//#region src/Archive.ts
-var Archive_exports = /* @__PURE__ */ __export({ createArchive: () => createArchive });
+//#region src/schemas/lenient.ts
 /**
-* Packs `entries` (paths relative to `cwd`) into a gzipped tar at `outPath`.
+* An optional field that goes *absent* rather than failing when it is
+* malformed.
 *
-* `portable` normalises uid/gid/mtime so the same inputs produce byte-identical
-* output — which matters when a security team wants to diff two bundles or
-* re-derive one from a manifest.
+* This is the difference between "we do not understand this field" and "we do
+* not understand this document". An `os: "linux"` where an array was expected
+* costs the platform filter one signal; it should not cost the run the package.
 */
-const createArchive = (options) => Effect.gen(function* () {
-	const fs = yield* FileSystem.FileSystem;
-	yield* emit({
-		_tag: "ArchiveStarted",
-		path: options.outPath,
-		entryCount: options.entries.length
-	});
-	yield* Effect.tryPromise({
-		try: () => create({
-			gzip: options.gzipLevel === void 0 ? true : { level: options.gzipLevel },
-			file: options.outPath,
-			cwd: options.cwd,
-			portable: true,
-			onWriteEntry: (entry) => {
-				entry.path = entry.path.replace(/^\.\//, "");
-			}
-		}, [...options.entries].sort().map(dotSlash)),
-		catch: (cause) => new ArchiveError(options.outPath, describe$1(cause), { cause })
-	});
-	const info = yield* fs.stat(options.outPath);
-	const bytes = Number(info.size);
-	yield* emit({
-		_tag: "ArchiveCompleted",
-		path: options.outPath,
-		bytes
-	});
-	return {
-		path: options.outPath,
-		bytes
-	};
-});
+const tolerant = (schema) => Schema.optional(Schema.UndefinedOr(schema).pipe(Schema.catchDecoding(() => Effect.succeed(Option.some(void 0)))));
 /**
-* Guards every entry against tar's `@` convention.
-*
-* In a tar file list, a leading `@` means "splice in the entries of this other
-* archive" — a GNU convention `node-tar` implements by stripping the `@` and
-* looking for what is left. Every scoped package is a top-level entry starting
-* with `@`, so this hit the bundler in both possible ways:
-*
-* - `@oxc-project` became `oxc-project`, which does not exist, and the run died
-*   with an ENOENT naming a path that appears nowhere in the staging tree.
-* - `@esbuild` became `esbuild`, which *does* exist — the unscoped package of
-*   the same name sitting right next to it. No error, and every scoped tarball
-*   silently missing from a bundle that reported success. That is the dangerous
-*   one: you would not find out until the install failed behind the firewall.
+* Keeps only the string-valued members of an untyped object.
 *
-* `./@scope` is not subject to the convention and resolves identically.
+* `{ "lodash": "^4.0.0", "broken": 3 }` decodes to `{ "lodash": "^4.0.0" }`.
+* Per-entry rather than whole-record tolerance, because one unreadable edge in
+* a dependency block is no reason to forget the others.
 */
-const dotSlash = (entry) => entry.startsWith("./") ? entry : `./${entry}`;
-const describe$1 = (cause) => cause instanceof Error ? cause.message : String(cause);
-
-//#endregion
-//#region src/Integrity.ts
-var Integrity_exports = /* @__PURE__ */ __export({
-	digestOf: () => digestOf,
-	hexDigestOf: () => hexDigestOf,
-	parseIntegrity: () => parseIntegrity,
-	verify: () => verify
-});
-const SUPPORTED = new Set([
-	"sha512",
-	"sha384",
-	"sha256",
-	"sha1"
-]);
+const StringRecordSchema = Schema.Record(Schema.String, Schema.Unknown).pipe(Schema.decodeTo(Schema.Record(Schema.String, Schema.String), {
+	decode: Getter.transform((raw) => {
+		const out = {};
+		for (const [key, value] of Object.entries(raw)) if (typeof value === "string") out[key] = value;
+		return out;
+	}),
+	encode: Getter.passthroughSubtype()
+}));
+/** The same per-entry tolerance for a list: `["linux", 7]` decodes to `["linux"]`. */
+const StringArraySchema = Schema.Array(Schema.Unknown).pipe(Schema.decodeTo(Schema.Array(Schema.String), {
+	decode: Getter.transform((raw) => raw.flatMap((entry) => typeof entry === "string" ? entry : [])),
+	encode: Getter.passthroughSubtype()
+}));
 /**
-* Parses an SRI string such as `sha512-abc...==`.
+* `peerDependenciesMeta`, normalised.
 *
-* npm permits several space-separated hashes; we keep every one we can verify
-* and ignore algorithms Node does not implement.
+* Only `optional` is read, and only its `true` is meaningful — npm writes the
+* flag as a boolean, a hand-edited file may carry anything, and every other
+* value means "not optional".
 */
-const parseIntegrity = (integrity) => {
-	const hashes = [];
-	for (const token of integrity.trim().split(/\s+/)) {
-		if (token.length === 0) continue;
-		const dash = token.indexOf("-");
-		if (dash <= 0) continue;
-		const algorithm = token.slice(0, dash).toLowerCase();
-		const digest = token.slice(dash + 1);
-		if (!SUPPORTED.has(algorithm) || digest.length === 0) continue;
-		hashes.push({
-			algorithm,
-			digest
-		});
+const OptionalFlagRecordSchema = Schema.Record(Schema.String, Schema.Unknown).pipe(Schema.decodeTo(Schema.Record(Schema.String, Schema.Struct({ optional: Schema.Boolean })), {
+	decode: Getter.transform((raw) => {
+		const out = {};
+		for (const [key, value] of Object.entries(raw)) if (isRecord(value)) out[key] = { optional: value["optional"] === true };
+		return out;
+	}),
+	encode: Getter.passthroughSubtype()
+}));
+const absentWhenEmpty = (value) => Object.keys(value).length > 0 ? value : void 0;
+const OptionalStringRecordSchema = StringRecordSchema.pipe(Schema.decodeTo(Schema.UndefinedOr(Schema.Record(Schema.String, Schema.String)), {
+	decode: Getter.transform(absentWhenEmpty),
+	encode: Getter.transform((value) => value ?? {})
+}));
+const OptionalStringArraySchema = StringArraySchema.pipe(Schema.decodeTo(Schema.UndefinedOr(Schema.Array(Schema.String)), {
+	decode: Getter.transform((value) => value.length > 0 ? value : void 0),
+	encode: Getter.transform((value) => value ?? [])
+}));
+const OptionalFlagRecordOrAbsentSchema = OptionalFlagRecordSchema.pipe(Schema.decodeTo(Schema.UndefinedOr(Schema.Record(Schema.String, Schema.Struct({ optional: Schema.Boolean }))), {
+	decode: Getter.transform(absentWhenEmpty),
+	encode: Getter.transform((value) => value ?? {})
+}));
+
+//#endregion
+//#region src/spec.ts
+const MAX_NAME_LENGTH = 214;
+const SEGMENT_RE = /^[a-z0-9\-._~]+$/;
+const DIST_TAG_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+/** Renders a spec back into the canonical `name@selector` form. */
+const formatSpec = (spec) => `${spec.name}@${formatSelector(spec.selector)}`;
+/** Human-readable form of just the selector part. */
+const formatSelector = (selector) => {
+	switch (selector._tag) {
+		case "Exact": return selector.version;
+		case "Range": return selector.range;
+		case "Tag": return selector.tag;
 	}
-	return hashes;
-};
-/** Computes the base64 digest of some bytes under one algorithm. */
-const digestOf = (data, algorithm) => createHash(algorithm).update(data).digest("base64");
-/** Computes the hex digest of some bytes — the form legacy `shasum` uses. */
-const hexDigestOf = (data, algorithm) => createHash(algorithm).update(data).digest("hex");
-/** Constant-time comparison of two digest strings of equal length. */
-const digestsEqual = (a, b) => {
-	const left = Buffer.from(a);
-	const right = Buffer.from(b);
-	return left.length === right.length && timingSafeEqual(left, right);
 };
 /**
-* Checks bytes against whichever checksums the registry supplied.
-*
-* SRI is preferred; `shasum` is the fallback for versions published before
-* integrity strings existed. If the registry gave us neither, that is reported
-* as `Unverifiable` rather than silently treated as a pass — the caller decides
-* whether to tolerate it.
+* Validates an npm package name against the rules the registry actually
+* enforces. Returns `null` when valid, or the reason it is not.
 */
-const verify = (data, dist) => {
-	if (dist.integrity !== void 0 && dist.integrity.length > 0) {
-		const hashes = parseIntegrity(dist.integrity);
-		if (hashes.length === 0) return {
-			_tag: "Unverifiable",
-			reason: `no supported algorithm in "${dist.integrity}"`
-		};
-		const best = [...hashes].sort((a, b) => strength(b.algorithm) - strength(a.algorithm))[0];
-		const actual = digestOf(data, best.algorithm);
-		return digestsEqual(actual, best.digest) ? {
-			_tag: "Verified",
-			using: best.algorithm
-		} : {
-			_tag: "Mismatch",
-			expected: `${best.algorithm}-${best.digest}`,
-			actual: `${best.algorithm}-${actual}`
-		};
-	}
-	if (dist.shasum !== void 0 && dist.shasum.length > 0) {
-		const actual = hexDigestOf(data, "sha1");
-		return digestsEqual(actual.toLowerCase(), dist.shasum.toLowerCase()) ? {
-			_tag: "Verified",
-			using: "sha1"
-		} : {
-			_tag: "Mismatch",
-			expected: `sha1-${dist.shasum}`,
-			actual: `sha1-${actual}`
-		};
-	}
-	return {
-		_tag: "Unverifiable",
-		reason: "registry advertised no integrity or shasum"
-	};
-};
-const strength = (algorithm) => {
-	switch (algorithm) {
-		case "sha512": return 4;
-		case "sha384": return 3;
-		case "sha256": return 2;
-		default: return 1;
+const validatePackageName = (name) => {
+	if (name.length === 0) return "name is empty";
+	if (name.length > MAX_NAME_LENGTH) return `name is longer than ${MAX_NAME_LENGTH} characters`;
+	if (name.trim() !== name) return "name has leading or trailing whitespace";
+	if (name.startsWith(".")) return "name cannot start with a period";
+	if (name.startsWith("_")) return "name cannot start with an underscore";
+	if (name !== name.toLowerCase()) return "name cannot contain capital letters";
+	if (name.startsWith("@")) {
+		const slash = name.indexOf("/");
+		if (slash === -1) return "scoped name is missing the '/name' part";
+		const scope = name.slice(1, slash);
+		const rest = name.slice(slash + 1);
+		if (scope.length === 0) return "scope is empty";
+		if (rest.length === 0) return "name after the scope is empty";
+		if (rest.includes("/")) return "name contains more than one '/'";
+		if (!SEGMENT_RE.test(scope)) return `scope "${scope}" contains illegal characters`;
+		if (!SEGMENT_RE.test(rest)) return `name "${rest}" contains illegal characters`;
+		return null;
 	}
+	if (name.includes("/")) return "unscoped name cannot contain '/'";
+	if (!SEGMENT_RE.test(name)) return "name contains illegal characters";
+	return null;
 };
-
-//#endregion
-//#region src/Layout.ts
-var Layout_exports = /* @__PURE__ */ __export({
-	MANIFEST_FILE: () => MANIFEST_FILE,
-	README_FILE: () => README_FILE,
-	importGuide: () => importGuide,
-	packagePath: () => packagePath,
-	perSpecArchiveName: () => perSpecArchiveName,
-	singleArchiveName: () => singleArchiveName,
-	splitName: () => splitName,
-	tarballFileName: () => tarballFileName
-});
 /**
-* The on-disk shape of a bundle.
-*
-* Everything is laid out exactly the way a registry serves it:
-*
-*     lodash/-/lodash-4.17.21.tgz
-*     @babel/core/-/core-7.24.0.tgz
+* Parses a single spec string.
 *
-* That is not an Artifactory convention — it is the path structure in every
-* `dist.tarball` URL npm publishes, which is why the same tree imports into
+* Splitting on `@` is the fiddly part: a scoped name *starts* with `@`, so we
+* look for the last `@` that is not at index 0.
+*/
+const parseSpec = (raw) => {
+	const input = raw.trim();
+	if (input.length === 0) throw new InvalidSpecError(raw, "spec is empty");
+	const at = input.lastIndexOf("@");
+	const hasSelector = at > 0;
+	const name = hasSelector ? input.slice(0, at) : input;
+	const selectorText = hasSelector ? input.slice(at + 1) : "";
+	const nameProblem = validatePackageName(name);
+	if (nameProblem !== null) throw new InvalidSpecError(raw, nameProblem);
+	if (!hasSelector || selectorText.length === 0) return {
+		name,
+		selector: {
+			_tag: "Tag",
+			tag: "latest"
+		},
+		raw: input
+	};
+	return {
+		name,
+		selector: parseSelector(raw, selectorText),
+		raw: input
+	};
+};
+/** Classifies the part after the `@` as an exact version, a range, or a dist-tag. */
+const parseSelector = (raw, text) => {
+	const exact = semver.valid(text, { loose: false });
+	if (exact !== null) return {
+		_tag: "Exact",
+		version: exact
+	};
+	if (semver.validRange(text, { loose: false }) !== null) return {
+		_tag: "Range",
+		range: text
+	};
+	if (!DIST_TAG_RE.test(text)) throw new InvalidSpecError(raw, `"${text}" is not a valid version, semver range, or dist-tag`);
+	return {
+		_tag: "Tag",
+		tag: text
+	};
+};
+/**
+* Parses many specs, collecting *every* failure rather than stopping at the
+* first. Somebody bundling forty packages should be told about all four typos
+* in one go, not made to re-run four times.
+*/
+const parseSpecs = (inputs) => {
+	const specs = [];
+	const errors = [];
+	for (const input of inputs) try {
+		specs.push(parseSpec(input));
+	} catch (error) {
+		if (error instanceof InvalidSpecError) errors.push(error);
+		else throw error;
+	}
+	return {
+		specs,
+		errors
+	};
+};
+/**
+* Collapses duplicate specs, keeping the first occurrence.
+*
+* `npmb react react@latest` is a plausible thing to type and should not
+* download React twice.
+*/
+const dedupeSpecs = (specs) => {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const spec of specs) {
+		const key = formatSpec(spec);
+		if (seen.has(key)) continue;
+		seen.add(key);
+		out.push(spec);
+	}
+	return out;
+};
+
+//#endregion
+//#region src/dependency-range.ts
+const UNSUPPORTED_PROTOCOLS = [
+	["file:", "local file path"],
+	["link:", "local link"],
+	["workspace:", "workspace protocol"],
+	["portal:", "portal protocol"],
+	["patch:", "patch protocol"],
+	["git:", "git dependency"],
+	["git+", "git dependency"],
+	["github:", "GitHub shorthand"],
+	["gitlab:", "GitLab shorthand"],
+	["bitbucket:", "Bitbucket shorthand"],
+	["http:", "remote tarball URL"],
+	["https:", "remote tarball URL"]
+];
+/**
+* Classifies one `name -> range` entry.
+*
+* An empty range, `*`, and `latest` all mean "any published version"; npm
+* treats them interchangeably and so do we.
+*/
+const parseDependencyTarget = (name, raw) => {
+	const text = raw.trim();
+	if (text.length === 0 || text === "*" || text === "x" || text === "latest") return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Range",
+			range: "*"
+		}
+	};
+	if (text.startsWith("npm:")) return parseAlias(name, text);
+	for (const [prefix, reason] of UNSUPPORTED_PROTOCOLS) if (text.startsWith(prefix)) return {
+		_tag: "Unsupported",
+		name,
+		raw: text,
+		reason
+	};
+	if (semver.validRange(text, { loose: true }) === null && /^[\w.-]+\/[\w.-]+/.test(text)) return {
+		_tag: "Unsupported",
+		name,
+		raw: text,
+		reason: "git shorthand"
+	};
+	const exact = semver.valid(text, { loose: true });
+	if (exact !== null) return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Exact",
+			version: exact
+		}
+	};
+	if (semver.validRange(text, { loose: true }) !== null) return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Range",
+			range: text
+		}
+	};
+	if (/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(text)) return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Tag",
+			tag: text
+		}
+	};
+	return {
+		_tag: "Unsupported",
+		name,
+		raw: text,
+		reason: "unrecognised version specifier"
+	};
+};
+/**
+* Parses `npm:<name>[@<range>]`.
+*
+* The nested name may itself be scoped, so the `@` split has the same
+* "not at index 0" caveat as top-level spec parsing.
+*/
+const parseAlias = (key, text) => {
+	const body = text.slice(4);
+	if (body.length === 0) return {
+		_tag: "Unsupported",
+		name: key,
+		raw: text,
+		reason: "empty npm: alias"
+	};
+	const at = body.lastIndexOf("@");
+	const target = at > 0 ? body.slice(0, at) : body;
+	const rangeText = at > 0 ? body.slice(at + 1) : "";
+	if (target.length === 0) return {
+		_tag: "Unsupported",
+		name: key,
+		raw: text,
+		reason: "empty npm: alias target"
+	};
+	const inner = parseDependencyTarget(target, rangeText);
+	if (inner._tag === "Unsupported") return {
+		...inner,
+		name: key,
+		raw: text
+	};
+	return {
+		_tag: "Registry",
+		name: target,
+		selector: inner.selector,
+		aliasOf: key
+	};
+};
+
+//#endregion
+//#region src/platform.ts
+const allPlatforms = { _tag: "All" };
+const platformTargets = (targets) => ({
+	_tag: "Targets",
+	targets
+});
+/** The machine we are currently running on. */
+const currentPlatform = () => ({
+	os: process.platform,
+	cpu: process.arch
+});
+/**
+* npm's documented `os` values, plus the names people actually type.
+*
+* An OS on its own is a valid target, so a typo has to be caught here — the
+* whole failure mode this tool exists to prevent is a bundle that looks fine
+* and installs nothing. `--platform windows` silently matching no binding at
+* all would be precisely that, so it is corrected rather than accepted.
+*/
+const osByAlias = {
+	win: "win32",
+	windows: "win32",
+	mac: "darwin",
+	macos: "darwin",
+	osx: "darwin"
+};
+const KNOWN_OS = new Set([
+	"aix",
+	"android",
+	"cygwin",
+	"darwin",
+	"freebsd",
+	"haiku",
+	"linux",
+	"netbsd",
+	"openbsd",
+	"sunos",
+	"win32"
+]);
+const LIBC = new Set(["musl", "glibc"]);
+/**
+* Parses `linux`, `linux-x64`, `darwin-arm64`, `win32-x64`, `linux-x64-musl`,
+* `linux-musl`.
+*
+* An OS on its own means every architecture for that OS, which is almost always
+* what you want: "the Windows and Linux bindings" is a far more natural way to
+* describe a target set than enumerating four `os-arch` pairs, and it keeps
+* working when a package adds an arm64 build.
+*
+* Returns `null` rather than throwing so the CLI can report every bad value at
+* once alongside the list of accepted forms.
+*/
+const parsePlatformTarget = (input) => {
+	const parts = input.trim().toLowerCase().split("-").filter((part) => part.length > 0);
+	const [rawOs, second, third] = parts;
+	if (rawOs === void 0 || parts.length > 3) return null;
+	const os = osByAlias[rawOs] ?? rawOs;
+	if (!KNOWN_OS.has(os)) return null;
+	if (second === void 0) return { os };
+	if (third === void 0) return LIBC.has(second) ? {
+		os,
+		libc: second
+	} : {
+		os,
+		cpu: second
+	};
+	if (!LIBC.has(third)) return null;
+	return {
+		os,
+		cpu: second,
+		libc: third
+	};
+};
+/**
+* npm's `os`/`cpu`/`libc` fields use a list of allowed values, where a leading
+* `!` negates. An empty or absent list means "no constraint".
+*
+* The semantics npm implements: if any negated entry matches, reject. Otherwise
+* if there are any positive entries, at least one must match.
+*/
+const listAllows = (list, value) => {
+	if (list === void 0 || list.length === 0) return true;
+	let hasPositive = false;
+	let positiveMatched = false;
+	for (const entry of list) {
+		const normalized = entry.trim().toLowerCase();
+		if (normalized.length === 0) continue;
+		if (normalized === "any" || normalized === "*") return true;
+		if (normalized.startsWith("!")) {
+			if (normalized.slice(1) === value) return false;
+		} else {
+			hasPositive = true;
+			if (normalized === value) positiveMatched = true;
+		}
+	}
+	return hasPositive ? positiveMatched : true;
+};
+/** Would this package install on this specific target? */
+const matchesTarget = (constraints, target) => {
+	if (!listAllows(constraints.os, target.os)) return false;
+	if (target.cpu !== void 0 && !listAllows(constraints.cpu, target.cpu)) return false;
+	if (target.libc !== void 0 && !listAllows(constraints.libc, target.libc)) return false;
+	return true;
+};
+/**
+* Should this package be included, given the active filter?
+*
+* Under `All` this is unconditionally `true` — that is the whole point.
+*/
+const isIncluded = (constraints, filter) => {
+	if (filter._tag === "All") return true;
+	return filter.targets.some((target) => matchesTarget(constraints, target));
+};
+/** Renders a filter for the manifest and for `--dry-run` output. */
+const formatPlatformFilter = (filter) => {
+	if (filter._tag === "All") return "all";
+	return filter.targets.map((target) => [
+		target.os,
+		target.cpu,
+		target.libc
+	].filter((part) => part !== void 0).join("-")).join(",");
+};
+
+//#endregion
+//#region src/options.ts
+const defaultScope = {
+	optional: true,
+	peer: true,
+	platforms: allPlatforms
+};
+const defaultResolveOptions = {
+	scope: defaultScope,
+	allVersions: false,
+	includePrerelease: false,
+	concurrency: 10
+};
+const defaultBundleOptions = {
+	...defaultResolveOptions,
+	layout: Layout.PerSpec,
+	dryRun: false,
+	verifyIntegrity: true,
+	force: false
+};
+
+//#endregion
+//#region src/registry.ts
+/**
+* Service tag for the registry backend.
+*
+* @example
+* ```ts
+* import { Effect } from "effect"
+* import { Registry } from "@packall/core"
+*
+* const program = Effect.gen(function*() {
+*   const registry = yield* Registry
+*   return yield* registry.packument("lodash")
+* })
+* ```
+*/
+var Registry = class extends Context.Service()("@packall/core/Registry") {};
+
+//#endregion
+//#region src/progress.ts
+/** Service tag for progress reporting. */
+var Progress = class extends Context.Service()("@packall/core/Progress") {};
+/** Emits an event to whichever reporter is installed. */
+const emit = (event) => Effect.gen(function* () {
+	yield* (yield* Progress).emit(event);
+});
+/**
+* Discards every event.
+*
+* The default for library consumers and for tests that do not care about
+* progress — silence should never require ceremony.
+*/
+const layerSilent = Layer.succeed(Progress)({ emit: () => Effect.void });
+/** Sends every event to a callback. Used by the CLI renderer. */
+const layerCallback = (onEvent) => Layer.succeed(Progress)({ emit: (event) => Effect.sync(() => onEvent(event)) });
+/**
+* Accumulates every event into a `Ref`, for assertions.
+*
+* Returned as `{ layer, events }` so a test can provide the layer and then read
+* the transcript afterwards.
+*/
+const makeCollector = Effect.gen(function* () {
+	const ref = yield* Ref.make([]);
+	return {
+		layer: Layer.succeed(Progress)({ emit: (event) => Ref.update(ref, (events) => [...events, event]) }),
+		events: Ref.get(ref)
+	};
+});
+
+//#endregion
+//#region src/integrity.ts
+const SUPPORTED = new Set([
+	"sha512",
+	"sha384",
+	"sha256",
+	"sha1"
+]);
+/**
+* Parses an SRI string such as `sha512-abc...==`.
+*
+* npm permits several space-separated hashes; we keep every one we can verify
+* and ignore algorithms Node does not implement.
+*/
+const parseIntegrity = (integrity) => {
+	const hashes = [];
+	for (const token of integrity.trim().split(/\s+/)) {
+		if (token.length === 0) continue;
+		const dash = token.indexOf("-");
+		if (dash <= 0) continue;
+		const algorithm = token.slice(0, dash).toLowerCase();
+		const digest = token.slice(dash + 1);
+		if (!SUPPORTED.has(algorithm) || digest.length === 0) continue;
+		hashes.push({
+			algorithm,
+			digest
+		});
+	}
+	return hashes;
+};
+/** Computes the base64 digest of some bytes under one algorithm. */
+const digestOf = (data, algorithm) => createHash(algorithm).update(data).digest("base64");
+/** Computes the hex digest of some bytes — the form legacy `shasum` uses. */
+const hexDigestOf = (data, algorithm) => createHash(algorithm).update(data).digest("hex");
+/** Constant-time comparison of two digest strings of equal length. */
+const digestsEqual = (a, b) => {
+	const left = Buffer.from(a);
+	const right = Buffer.from(b);
+	return left.length === right.length && timingSafeEqual(left, right);
+};
+/**
+* Checks bytes against whichever checksums the registry supplied.
+*
+* SRI is preferred; `shasum` is the fallback for versions published before
+* integrity strings existed. If the registry gave us neither, that is reported
+* as `Unverifiable` rather than silently treated as a pass — the caller decides
+* whether to tolerate it.
+*/
+const verify = (data, dist) => {
+	if (dist.integrity !== void 0 && dist.integrity.length > 0) {
+		const [best] = parseIntegrity(dist.integrity).toSorted((a, b) => strength(b.algorithm) - strength(a.algorithm));
+		if (best === void 0) return {
+			_tag: "Unverifiable",
+			reason: `no supported algorithm in "${dist.integrity}"`
+		};
+		const actual = digestOf(data, best.algorithm);
+		return digestsEqual(actual, best.digest) ? {
+			_tag: "Verified",
+			using: best.algorithm
+		} : {
+			_tag: "Mismatch",
+			expected: `${best.algorithm}-${best.digest}`,
+			actual: `${best.algorithm}-${actual}`
+		};
+	}
+	if (dist.shasum !== void 0 && dist.shasum.length > 0) {
+		const actual = hexDigestOf(data, "sha1");
+		return digestsEqual(actual.toLowerCase(), dist.shasum.toLowerCase()) ? {
+			_tag: "Verified",
+			using: "sha1"
+		} : {
+			_tag: "Mismatch",
+			expected: `sha1-${dist.shasum}`,
+			actual: `sha1-${actual}`
+		};
+	}
+	return {
+		_tag: "Unverifiable",
+		reason: "registry advertised no integrity or shasum"
+	};
+};
+const strength = (algorithm) => {
+	switch (algorithm) {
+		case "sha512": return 4;
+		case "sha384": return 3;
+		case "sha256": return 2;
+		default: return 1;
+	}
+};
+
+//#endregion
+//#region src/layout.ts
+/**
+* The on-disk shape of a bundle.
+*
+* Everything is laid out exactly the way a registry serves it:
+*
+*     lodash/-/lodash-4.17.21.tgz
+*     @babel/core/-/core-7.24.0.tgz
+*
+* That is not an Artifactory convention — it is the path structure in every
+* `dist.tarball` URL npm publishes, which is why the same tree imports into
 * Artifactory, Nexus and Verdaccio without translation. Note that a scoped
 * package's file name drops the scope: `@babel/core` becomes `core-7.24.0.tgz`
 * under an `@babel/core/-/` directory.
 */
-/** Splits `@scope/name` into its parts. `scope` is undefined when unscoped. */
-const splitName = (name) => {
-	if (!name.startsWith("@")) return {
-		scope: void 0,
-		bare: name
+/** Splits `@scope/name` into its parts. `scope` is undefined when unscoped. */
+const splitName = (name) => {
+	if (!name.startsWith("@")) return {
+		scope: void 0,
+		bare: name
+	};
+	const slash = name.indexOf("/");
+	if (slash === -1) return {
+		scope: void 0,
+		bare: name
+	};
+	return {
+		scope: name.slice(0, slash),
+		bare: name.slice(slash + 1)
+	};
+};
+/** `@babel/core` + `7.24.0` -> `core-7.24.0.tgz` */
+const tarballFileName = (name, version) => {
+	const { bare } = splitName(name);
+	return `${bare}-${version}.tgz`;
+};
+/**
+* The path of one package tarball within a bundle, using `/` separators
+* regardless of host platform — these become tar entry names, and tar entries
+* are always POSIX.
+*/
+const packagePath = (name, version) => `${name}/-/${tarballFileName(name, version)}`;
+/** File name of the manifest that ships inside every bundle. */
+const MANIFEST_FILE = "bundle-manifest.json";
+/** File name of the short import guide that ships inside every bundle. */
+const README_FILE = "IMPORT.md";
+/**
+* Name of the archive produced for one root spec in `per-spec` layout.
+*
+* Scoped names are flattened (`@babel/core` -> `babel-core`) because a `/` in a
+* file name is not a thing, and `@` confuses enough shells and web UIs to be
+* worth avoiding.
+*/
+const perSpecArchiveName = (name, version) => {
+	const { scope, bare } = splitName(name);
+	return `${scope === void 0 ? bare : `${scope.slice(1)}-${bare}`}-${version}.tgz`;
+};
+/** Name of the archive produced in `single` layout. */
+const singleArchiveName = (base = "bundle") => `${base}.tgz`;
+/**
+* The import guide written into each bundle.
+*
+* Kept short and copy-pasteable on purpose: whoever opens this is mid-task on a
+* restricted network and does not want prose.
+*/
+const importGuide = (options) => `# Importing this bundle
+
+${options.packageCount} package tarball(s), laid out exactly as an npm registry serves them:
+
+    <package-name>/-/<file>.tgz
+    @<scope>/<name>/-/<file>.tgz
+
+Created ${options.createdAt} by packall ${options.toolVersion}.
+See ${MANIFEST_FILE} for the full list with checksums.
+
+## JFrog Artifactory
+
+Unpack, then upload the tree into a **local npm** repository. The layout already
+matches what Artifactory expects, so no path rewriting is needed:
+
+    tar -xzf <this-bundle>.tgz -C ./bundle
+    jf rt upload "bundle/(**)" "<npm-local-repo>/{1}" --flat=false
+
+## Verdaccio / Nexus / any npm registry
+
+Publish each tarball individually:
+
+    find ./bundle -name '*.tgz' -exec npm publish --registry <url> {} \\;
+
+## Verifying before import
+
+    node -e "const m=require('./bundle/${MANIFEST_FILE}');console.log(m.packages.length+' packages')"
+
+Every entry in ${MANIFEST_FILE} carries the integrity string the source registry
+advertised, and each tarball was checked against it at download time.
+`;
+
+//#endregion
+//#region src/manifest.ts
+/** Schema version, bumped when the shape changes incompatibly. */
+const MANIFEST_VERSION = 1;
+/** Renders a package's reasons into short, greppable strings. */
+const formatReasons = (pkg) => pkg.reasons.map((reason) => reason._tag === "Root" ? `root:${reason.spec}` : `${reason.kind}:${reason.from}`);
+/** Builds the manifest for a completed (or dry) run. */
+const buildManifest = (input) => {
+	const includedNames = new Set(input.included.map((pkg) => `${pkg.name}@${pkg.version}`));
+	const packages = input.included.map((pkg) => {
+		const key = `${pkg.name}@${pkg.version}`;
+		return {
+			name: pkg.name,
+			version: pkg.version,
+			path: packagePath(pkg.name, pkg.version),
+			tarball: pkg.manifest.dist.tarball,
+			integrity: pkg.manifest.dist.integrity,
+			shasum: pkg.manifest.dist.shasum,
+			bytes: input.sizes.get(key),
+			reasons: formatReasons(pkg)
+		};
+	});
+	const totalBytes = packages.reduce((sum, entry) => sum + (entry.bytes ?? 0), 0);
+	return {
+		manifestVersion: MANIFEST_VERSION,
+		tool: {
+			name: "packall",
+			version: input.toolVersion
+		},
+		createdAt: (input.createdAt ?? /* @__PURE__ */ new Date()).toISOString(),
+		registry: input.registry,
+		requested: input.resolution.roots.map((root) => formatSpec(root.spec)),
+		roots: input.resolution.roots.map((root) => ({
+			spec: formatSpec(root.spec),
+			versions: root.versions,
+			packageCount: root.closure.filter((key) => includedNames.has(key)).length
+		})),
+		options: {
+			layout: input.options.layout,
+			optionalDependencies: input.options.scope.optional,
+			peerDependencies: input.options.scope.peer,
+			platforms: formatPlatformFilter(input.options.scope.platforms),
+			allVersions: input.options.allVersions,
+			includePrerelease: input.options.includePrerelease,
+			integrityVerified: input.options.verifyIntegrity
+		},
+		packages,
+		warnings: input.resolution.warnings.map((warning) => warning.from === void 0 ? warning.message : `${warning.from}: ${warning.message}`),
+		totals: {
+			packages: packages.length,
+			bytes: totalBytes
+		}
+	};
+};
+/** Serialises a manifest with stable key order and a trailing newline. */
+const serializeManifest = (manifest) => `${JSON.stringify(manifest, null, 2)}\n`;
+
+//#endregion
+//#region src/resolve.ts
+const packageKey = (name, version) => `${name}@${version}`;
+/** Index of a resolution by `name@version`, for lookups during bundling. */
+const indexPackages = (resolution) => new Map(resolution.packages.map((pkg) => [packageKey(pkg.name, pkg.version), pkg]));
+/**
+* Turns a selector into the concrete version(s) it names.
+*
+* `all` controls whether a range collapses to its best match — npm's behaviour,
+* and what you always want for a transitive dependency — or expands to every
+* satisfying published version, which is what `--all-versions` is for.
+*/
+const selectVersions = (packument, selector, options) => {
+	const available = Object.keys(packument.versions);
+	switch (selector._tag) {
+		case "Exact":
+			if (!Object.hasOwn(packument.versions, selector.version)) throw new VersionNotFoundError(packument.name, selector.version, sortVersions(available));
+			return [selector.version];
+		case "Tag": {
+			const version = packument.distTags[selector.tag];
+			if (version === void 0 || !Object.hasOwn(packument.versions, version)) throw new NoMatchingVersionsError(packument.name, selector.tag, sortVersions(available));
+			return [version];
+		}
+		case "Range": {
+			const satisfying = available.filter((version) => semver.satisfies(version, selector.range, {
+				loose: true,
+				includePrerelease: options.includePrerelease
+			})).toSorted(semver.rcompare);
+			const [best] = satisfying;
+			if (best === void 0) throw new NoMatchingVersionsError(packument.name, selector.range, sortVersions(available));
+			if (!options.all) return [best];
+			return options.maxVersions !== void 0 && options.maxVersions > 0 ? satisfying.slice(0, options.maxVersions) : satisfying;
+		}
+	}
+};
+const sortVersions = (versions) => versions.toSorted((a, b) => semver.valid(a) && semver.valid(b) ? semver.compare(a, b) : a.localeCompare(b));
+const makeWalkState = () => ({
+	resolved: /* @__PURE__ */ new Map(),
+	edges: /* @__PURE__ */ new Map(),
+	packuments: /* @__PURE__ */ new Map(),
+	warnings: [],
+	warningKeys: /* @__PURE__ */ new Set()
+});
+const addWarning = (state, warning) => {
+	const key = `${warning.from ?? ""}|${warning.message}`;
+	if (state.warningKeys.has(key)) return;
+	state.warningKeys.add(key);
+	state.warnings.push(warning);
+};
+/**
+* Fetches a packument, reusing anything already seen in this run.
+*
+* Two fibers in the same wave can race here and both fetch. That is one
+* duplicated GET at worst, and de-racing it would cost more complexity than it
+* saves.
+*/
+const getPackument = (state, name) => Effect.gen(function* () {
+	const cached = state.packuments.get(name);
+	if (cached !== void 0) return cached;
+	const packument = yield* (yield* Registry).packument(name);
+	state.packuments.set(name, packument);
+	return packument;
+});
+/**
+* Re-fails a thrown selection error into the Effect error channel.
+*
+* `selectVersions` throws `BundlerError` subclasses and nothing else, so this
+* narrows rather than casting; anything unexpected is rethrown as a defect,
+* which is what an unexpected exception actually is.
+*/
+const asBundlerError = (error) => {
+	if (error instanceof VersionNotFoundError || error instanceof NoMatchingVersionsError) return error;
+	throw error;
+};
+/** Expands one resolved manifest into the edges that follow from it. */
+const edgesOf$3 = (manifest, options) => {
+	const from = packageKey(manifest.name, manifest.version);
+	const tasks = [];
+	const warnings = [];
+	const add = (entries, kind, tolerateFailure, skip) => {
+		if (entries === void 0) return;
+		for (const [name, raw] of Object.entries(entries)) {
+			if (skip?.(name)) continue;
+			const target = parseDependencyTarget(name, raw);
+			if (target._tag === "Unsupported") {
+				warnings.push({
+					from,
+					message: `Skipped ${name}@${target.raw} (${target.reason}) — it cannot be fetched from a registry. Vendor it separately if the offline install needs it.`
+				});
+				continue;
+			}
+			tasks.push({
+				name: target.name,
+				selector: target.selector,
+				reason: {
+					_tag: "Edge",
+					from,
+					kind
+				},
+				tolerateFailure
+			});
+		}
+	};
+	add(manifest.dependencies, EdgeKind.Prod, false);
+	if (options.scope.optional) add(manifest.optionalDependencies, EdgeKind.Optional, true);
+	if (options.scope.peer) {
+		const meta = manifest.peerDependenciesMeta ?? {};
+		add(manifest.peerDependencies, EdgeKind.Peer, false, (name) => meta[name]?.optional === true);
+	}
+	return {
+		tasks,
+		warnings
+	};
+};
+/** Edges for a package, computed once and cached. */
+const edgesFor = (state, manifest, options) => {
+	const key = packageKey(manifest.name, manifest.version);
+	const cached = state.edges.get(key);
+	if (cached !== void 0) return cached;
+	const { tasks, warnings } = edgesOf$3(manifest, options);
+	for (const warning of warnings) addWarning(state, warning);
+	state.edges.set(key, tasks);
+	return tasks;
+};
+/**
+* Resolves everything reachable from `seeds`, returning the closure.
+*
+* `state` is mutated with newly resolved packages and warnings; the returned
+* array is scoped to *this* walk, which is what makes per-root-version
+* closures possible.
+*/
+const walk = (state, seeds, options) => Effect.gen(function* () {
+	const discovered = /* @__PURE__ */ new Set();
+	const attempted = /* @__PURE__ */ new Set();
+	let frontier = seeds;
+	while (frontier.length > 0) {
+		const wave = [];
+		for (const task of frontier) {
+			const id = `${task.name} ${formatSelector(task.selector)}`;
+			if (attempted.has(id)) continue;
+			attempted.add(id);
+			wave.push(task);
+		}
+		if (wave.length === 0) break;
+		const results = yield* Effect.forEach(wave, (task) => resolveTask(state, task, options), { concurrency: options.concurrency });
+		const next = [];
+		for (const result of results) {
+			if (result === null) continue;
+			for (const { manifest, reason } of result) {
+				const key = packageKey(manifest.name, manifest.version);
+				const existing = state.resolved.get(key);
+				if (existing === void 0) {
+					state.resolved.set(key, {
+						name: manifest.name,
+						version: manifest.version,
+						manifest,
+						reasons: [reason]
+					});
+					yield* emit({
+						_tag: "PackageResolved",
+						name: manifest.name,
+						version: manifest.version,
+						resolvedCount: state.resolved.size,
+						pendingCount: next.length
+					});
+					if (manifest.deprecated !== void 0 && manifest.deprecated !== "") addWarning(state, {
+						from: key,
+						message: `${key} is deprecated: ${manifest.deprecated}`
+					});
+				} else if (!hasReason$1(existing.reasons, reason)) state.resolved.set(key, {
+					...existing,
+					reasons: [...existing.reasons, reason]
+				});
+				if (!discovered.has(key)) {
+					discovered.add(key);
+					next.push(...edgesFor(state, manifest, options));
+				}
+			}
+		}
+		frontier = next;
+	}
+	return [...discovered];
+});
+const hasReason$1 = (reasons, candidate) => reasons.some((reason) => {
+	if (reason._tag === "Root" && candidate._tag === "Root") return reason.spec === candidate.spec;
+	if (reason._tag === "Edge" && candidate._tag === "Edge") return reason.from === candidate.from && reason.kind === candidate.kind;
+	return false;
+});
+/**
+* Resolves one task to its manifest(s).
+*
+* Returns `null` when an optional edge could not be resolved — the caller
+* treats that as "skip quietly", which is what npm does for
+* `optionalDependencies`.
+*/
+const resolveTask = (state, task, options) => Effect.gen(function* () {
+	const packument = yield* getPackument(state, task.name);
+	return (yield* Effect.try({
+		try: () => selectVersions(packument, task.selector, {
+			all: false,
+			includePrerelease: options.includePrerelease
+		}),
+		catch: asBundlerError
+	})).flatMap((version) => {
+		const manifest = packument.versions[version];
+		if (manifest === void 0) return [];
+		if (task.reason._tag === "Edge" && task.reason.kind === EdgeKind.Optional && !isIncluded(manifest, options.scope.platforms)) return [];
+		return {
+			manifest,
+			reason: task.reason
+		};
+	});
+}).pipe(Effect.catch((error) => {
+	if (!task.tolerateFailure) return Effect.fail(error);
+	return Effect.sync(() => {
+		addWarning(state, { message: `Optional dependency ${task.name}@${formatSelector(task.selector)} could not be resolved and was skipped: ${error.message}` });
+		return null;
+	});
+}));
+/**
+* Resolves every requested spec.
+*
+* Each selected root *version* is walked separately so `per-spec` layout has an
+* exact closure per tarball, while all walks share one cache, so a package
+* reached from twenty roots is fetched once.
+*/
+const resolve = (specs, options) => Effect.gen(function* () {
+	yield* emit({
+		_tag: "PhaseStarted",
+		phase: Phase.Resolve,
+		total: specs.length
+	});
+	const state = makeWalkState();
+	const roots = [];
+	for (const spec of specs) {
+		const packument = yield* getPackument(state, spec.name);
+		const versions = yield* Effect.try({
+			try: () => selectVersions(packument, spec.selector, {
+				all: options.allVersions,
+				maxVersions: options.maxVersions,
+				includePrerelease: options.includePrerelease
+			}),
+			catch: asBundlerError
+		});
+		const closures = /* @__PURE__ */ new Map();
+		const union = /* @__PURE__ */ new Set();
+		for (const version of versions) {
+			const closure = yield* walk(state, [{
+				name: spec.name,
+				selector: {
+					_tag: "Exact",
+					version
+				},
+				reason: {
+					_tag: "Root",
+					spec: formatSpec(spec)
+				},
+				tolerateFailure: false
+			}], options);
+			closures.set(version, closure);
+			for (const key of closure) union.add(key);
+		}
+		roots.push({
+			spec,
+			versions,
+			closures,
+			closure: [...union]
+		});
+	}
+	yield* emit({
+		_tag: "PhaseCompleted",
+		phase: Phase.Resolve
+	});
+	return {
+		roots,
+		packages: [...state.resolved.values()].toSorted(compareResolved$1),
+		warnings: state.warnings
 	};
-	const slash = name.indexOf("/");
-	if (slash === -1) return {
-		scope: void 0,
-		bare: name
+});
+const compareResolved$1 = (a, b) => {
+	if (a.name !== b.name) return a.name < b.name ? -1 : 1;
+	return semver.valid(a.version) && semver.valid(b.version) ? semver.compare(a.version, b.version) : a.version.localeCompare(b.version);
+};
+
+//#endregion
+//#region src/locked-resolve.ts
+/** Turns a parsed lockfile into a resolution, pinning every version. */
+const resolveLocked = (lock, options) => Effect.gen(function* () {
+	const roots = selectRoots(lock, options);
+	yield* emit({
+		_tag: "PhaseStarted",
+		phase: Phase.Resolve,
+		total: roots.length
+	});
+	const gap = findGaps(lock, roots, options.declared);
+	if (gap !== null) return yield* Effect.fail(gap);
+	const manifests = yield* fetchManifests(lock, reachableKeys(lock, roots, options), options);
+	const warnings = lock.warnings.map((message) => ({ message }));
+	const resolved = /* @__PURE__ */ new Map();
+	const seenWarnings = /* @__PURE__ */ new Set();
+	const addWarning$1 = (warning) => {
+		const key = `${warning.from ?? ""}|${warning.message}`;
+		if (seenWarnings.has(key)) return;
+		seenWarnings.add(key);
+		warnings.push(warning);
 	};
+	const rootResolutions = [];
+	for (const root of roots) {
+		const key = packageKey(root.name, root.version);
+		if (!manifests.has(key)) continue;
+		const spec = {
+			name: root.name,
+			selector: {
+				_tag: "Exact",
+				version: root.version
+			},
+			raw: `${root.name}@${root.version}`
+		};
+		if (root.kind === LockedRootKind.Optional && !platformAllows(manifests, key, options)) continue;
+		const closure = walkLocked({
+			lock,
+			manifests,
+			options,
+			seed: key,
+			rootSpec: formatSpec(spec),
+			resolved,
+			addWarning: addWarning$1
+		});
+		rootResolutions.push({
+			spec,
+			versions: [root.version],
+			closures: new Map([[root.version, closure]]),
+			closure
+		});
+	}
+	for (const pkg of resolved.values()) {
+		const deprecated = pkg.manifest.deprecated;
+		if (deprecated !== void 0 && deprecated !== "") addWarning$1({
+			from: packageKey(pkg.name, pkg.version),
+			message: `${packageKey(pkg.name, pkg.version)} is deprecated: ${deprecated}`
+		});
+	}
+	yield* emit({
+		_tag: "PhaseCompleted",
+		phase: Phase.Resolve
+	});
 	return {
-		scope: name.slice(0, slash),
-		bare: name.slice(slash + 1)
+		roots: rootResolutions,
+		packages: [...resolved.values()].toSorted(compareResolved),
+		warnings
 	};
-};
-/** `@babel/core` + `7.24.0` -> `core-7.24.0.tgz` */
-const tarballFileName = (name, version) => {
-	const { bare } = splitName(name);
-	return `${bare}-${version}.tgz`;
-};
+});
+/** Which of the project's direct dependencies this run should bundle. */
+const selectRoots = (lock, options) => lock.roots.filter((root) => {
+	if (root.kind === LockedRootKind.Dev) return options.includeDev;
+	if (root.kind === LockedRootKind.Optional) return options.scope.optional;
+	if (root.kind === LockedRootKind.Peer) return options.scope.peer;
+	return true;
+}).toSorted((a, b) => a.name === b.name ? 0 : a.name < b.name ? -1 : 1);
 /**
-* The path of one package tarball within a bundle, using `/` separators
-* regardless of host platform — these become tar entry names, and tar entries
-* are always POSIX.
+* The two ways a lockfile can be partial, checked before anything is fetched.
+*
+* Both mean the same thing to whoever is waiting on the bundle — a package they
+* expected will not be in it — and both are invisible unless something says so,
+* because the run otherwise succeeds and simply produces less.
 */
-const packagePath = (name, version) => `${name}/-/${tarballFileName(name, version)}`;
-/** File name of the manifest that ships inside every bundle. */
-const MANIFEST_FILE = "bundle-manifest.json";
-/** File name of the short import guide that ships inside every bundle. */
-const README_FILE = "IMPORT.md";
+const findGaps = (lock, roots, declared) => {
+	const remedy = `Run \`${lock.format} install\` to bring the lockfile up to date.`;
+	if (declared !== void 0 && declared.length > 0) {
+		const locked = /* @__PURE__ */ new Set();
+		for (const pkg of lock.packages.values()) locked.add(pkg.name);
+		for (const root of roots) locked.add(root.name);
+		const missing = declared.filter((name) => !locked.has(name));
+		if (missing.length > 0) return new LockfileIncompleteError(lock.path, missing, `the package.json declares ${missing.length} dependenc${missing.length === 1 ? "y" : "ies"} it does not pin`, remedy);
+	}
+	if (lock.incomplete.length > 0) return new LockfileIncompleteError(lock.path, lock.incomplete, `${lock.incomplete.length} required dependenc${lock.incomplete.length === 1 ? "y is" : "ies are"} not pinned`, remedy);
+	return null;
+};
 /**
-* Name of the archive produced for one root spec in `per-spec` layout.
+* Every package the roots can reach through the locked edges.
 *
-* Scoped names are flattened (`@babel/core` -> `babel-core`) because a `/` in a
-* file name is not a thing, and `@` confuses enough shells and web UIs to be
-* worth avoiding.
+* Scope filters apply here — `--no-optional` genuinely removes a subtree — but
+* the platform filter does not, because deciding it needs the `os`/`cpu` fields
+* that only the registry has.
 */
-const perSpecArchiveName = (name, version) => {
-	const { scope, bare } = splitName(name);
-	return `${scope === void 0 ? bare : `${scope.slice(1)}-${bare}`}-${version}.tgz`;
+const reachableKeys = (lock, roots, options) => {
+	const seen = /* @__PURE__ */ new Set();
+	const queue = roots.map((root) => packageKey(root.name, root.version));
+	while (queue.length > 0) {
+		const key = queue.pop();
+		if (key === void 0 || seen.has(key)) continue;
+		seen.add(key);
+		for (const edge of lock.packages.get(key)?.dependencies ?? []) {
+			if (!followsEdge(edge.kind, options)) continue;
+			queue.push(packageKey(edge.name, edge.version));
+		}
+	}
+	return seen;
+};
+const followsEdge = (kind, options) => {
+	if (kind === LockedRootKind.Optional) return options.scope.optional;
+	if (kind === LockedRootKind.Peer) return options.scope.peer;
+	return true;
 };
-/** Name of the archive produced in `single` layout. */
-const singleArchiveName = (base = "bundle") => `${base}.tgz`;
 /**
-* The import guide written into each bundle.
+* Fetches the published manifest for every pinned version.
 *
-* Kept short and copy-pasteable on purpose: whoever opens this is mid-task on a
-* restricted network and does not want prose.
+* One packument per distinct *name*, not per version — a lockfile holding four
+* versions of `tslib` costs one request. Every pinned version that the registry
+* does not serve is collected and reported together, because "refresh your
+* lockfile" is a single action and finding out about the gaps one run at a time
+* would be miserable.
 */
-const importGuide = (options) => `# Importing this bundle
-
-${options.packageCount} package tarball(s), laid out exactly as an npm registry serves them:
-
-    <package-name>/-/<file>.tgz
-    @<scope>/<name>/-/<file>.tgz
-
-Created ${options.createdAt} by packall ${options.toolVersion}.
-See ${MANIFEST_FILE} for the full list with checksums.
-
-## JFrog Artifactory
-
-Unpack, then upload the tree into a **local npm** repository. The layout already
-matches what Artifactory expects, so no path rewriting is needed:
-
-    tar -xzf <this-bundle>.tgz -C ./bundle
-    jf rt upload "bundle/(**)" "<npm-local-repo>/{1}" --flat=false
-
-## Verdaccio / Nexus / any npm registry
-
-Publish each tarball individually:
-
-    find ./bundle -name '*.tgz' -exec npm publish --registry <url> {} \\;
-
-## Verifying before import
-
-    node -e "const m=require('./bundle/${MANIFEST_FILE}');console.log(m.packages.length+' packages')"
-
-Every entry in ${MANIFEST_FILE} carries the integrity string the source registry
-advertised, and each tarball was checked against it at download time.
-`;
-
-//#endregion
-//#region src/Registry.ts
+const fetchManifests = (lock, reachable, options) => Effect.gen(function* () {
+	const registry = yield* Registry;
+	const wanted = /* @__PURE__ */ new Map();
+	for (const key of reachable) {
+		const pkg = lock.packages.get(key);
+		if (pkg === void 0) continue;
+		const versions = wanted.get(pkg.name);
+		if (versions === void 0) wanted.set(pkg.name, [pkg.version]);
+		else versions.push(pkg.version);
+	}
+	const manifests = /* @__PURE__ */ new Map();
+	const missing = [];
+	const fetched = yield* Effect.forEach([...wanted.entries()], ([name, versions]) => registry.packument(name).pipe(Effect.map((packument) => ({
+		name,
+		versions,
+		packument
+	})), Effect.catch((error) => error._tag === "PackageNotFoundError" ? Effect.succeed({
+		name,
+		versions,
+		packument: null
+	}) : Effect.fail(error))), { concurrency: options.concurrency });
+	for (const { name, versions, packument } of fetched) for (const version of versions) {
+		if (packument === null) {
+			missing.push({
+				name,
+				version,
+				detail: "package not found"
+			});
+			continue;
+		}
+		const manifest = packument.versions[version];
+		if (manifest === void 0) {
+			missing.push({
+				name,
+				version,
+				detail: describeAvailable(Object.keys(packument.versions))
+			});
+			continue;
+		}
+		manifests.set(packageKey(name, version), manifest);
+		yield* emit({
+			_tag: "PackageResolved",
+			name,
+			version,
+			resolvedCount: manifests.size,
+			pendingCount: reachable.size - manifests.size
+		});
+	}
+	if (missing.length > 0) return yield* Effect.fail(new LockfileOutOfDateError(lock.path, registry.registryFor(missing[0]?.name ?? ""), missing));
+	return manifests;
+});
+const describeAvailable = (available) => {
+	const recent = available.toSorted((a, b) => semver.valid(a) && semver.valid(b) ? semver.compare(a, b) : a.localeCompare(b)).slice(-3);
+	return recent.length === 0 ? "no published versions" : `no longer published (latest: ${recent.join(", ")})`;
+};
 /**
-* Service tag for the registry backend.
-*
-* @example
-* ```ts
-* import { Effect } from "effect"
-* import { Registry } from "@packall/core"
+* Collects one root's closure by following locked edges.
 *
-* const program = Effect.gen(function*() {
-*   const registry = yield* Registry
-*   return yield* registry.packument("lodash")
-* })
-* ```
+* Pure and synchronous — every manifest is already in hand — so a per-root
+* closure costs nothing beyond the traversal, which is what makes `per-spec`
+* layout as cheap here as it is for a range-resolved run.
 */
-var Registry = class extends Context.Service()("@packall/core/Registry") {};
+const walkLocked = (input) => {
+	const closure = /* @__PURE__ */ new Set();
+	const queue = [{
+		key: input.seed,
+		reason: {
+			_tag: "Root",
+			spec: input.rootSpec
+		}
+	}];
+	while (queue.length > 0) {
+		const next = queue.pop();
+		if (next === void 0) continue;
+		const manifest = input.manifests.get(next.key);
+		const locked = input.lock.packages.get(next.key);
+		if (manifest === void 0 || locked === void 0) continue;
+		record(input.resolved, next.key, manifest, locked, next.reason);
+		if (closure.has(next.key)) continue;
+		closure.add(next.key);
+		for (const edge of locked.dependencies) {
+			if (!followsEdge(edge.kind, input.options)) continue;
+			const target = packageKey(edge.name, edge.version);
+			if (!input.manifests.has(target)) continue;
+			if (edge.kind === LockedRootKind.Optional && !platformAllows(input.manifests, target, input.options)) {
+				input.addWarning({
+					from: next.key,
+					message: `Skipped optional ${target} — it does not build for the selected platforms.`
+				});
+				continue;
+			}
+			queue.push({
+				key: target,
+				reason: {
+					_tag: "Edge",
+					from: next.key,
+					kind: edge.kind
+				}
+			});
+		}
+	}
+	return [...closure];
+};
+/** Adds a package, or merges one more justification into an existing entry. */
+const record = (resolved, key, manifest, locked, reason) => {
+	const existing = resolved.get(key);
+	if (existing === void 0) {
+		resolved.set(key, {
+			name: locked.name,
+			version: locked.version,
+			manifest,
+			reasons: [reason]
+		});
+		return;
+	}
+	if (hasReason(existing.reasons, reason)) return;
+	resolved.set(key, {
+		...existing,
+		reasons: [...existing.reasons, reason]
+	});
+};
+const hasReason = (reasons, candidate) => reasons.some((reason) => {
+	if (reason._tag === "Root" && candidate._tag === "Root") return reason.spec === candidate.spec;
+	if (reason._tag === "Edge" && candidate._tag === "Edge") return reason.from === candidate.from && reason.kind === candidate.kind;
+	return false;
+});
+const platformAllows = (manifests, key, options) => {
+	const manifest = manifests.get(key);
+	if (manifest === void 0) return false;
+	return isIncluded(manifest, options.scope.platforms);
+};
+const compareResolved = (a, b) => {
+	if (a.name !== b.name) return a.name < b.name ? -1 : 1;
+	return semver.valid(a.version) && semver.valid(b.version) ? semver.compare(a.version, b.version) : a.version.localeCompare(b.version);
+};
 
 //#endregion
-//#region src/Download.ts
-var Download_exports = /* @__PURE__ */ __export({ downloadAll: () => downloadAll });
+//#region src/lockfile/json.ts
+const stringOr = (value, fallback) => typeof value === "string" ? value : fallback;
+const decodeStringRecord = Schema.decodeUnknownOption(StringRecordSchema);
+/** Keeps only the string-valued members of an untyped object. */
+const stringRecord = (value) => Option.getOrElse(decodeStringRecord(value), () => ({}));
+const decodeOptionalFlags = Schema.decodeUnknownOption(OptionalFlagRecordSchema);
+/** Names a package marked its peers optional with. */
+const optionalPeerNames = (value) => {
+	const flags = Option.getOrElse(decodeOptionalFlags(value), () => ({}));
+	return new Set(Object.entries(flags).flatMap(([name, meta]) => meta.optional ? name : []));
+};
+const parseJsonObject = (path, content) => {
+	const parsed = tryParseJsonc(content);
+	if (parsed === void 0) throw new LockfileError(path, "not valid JSON");
+	if (!isRecord(parsed)) throw new LockfileError(path, "top level is not an object");
+	return parsed;
+};
 /**
-* Downloads every package into `destDir`, laid out the way a registry serves
-* them.
+* Parses JSON, tolerating the comments and trailing commas bun writes.
 *
-* `verifyIntegrity` defaulting to on is deliberate: a corrupt tarball that
-* makes it into a corporate registry is far more expensive than a failed run.
+* `bun.lock` is JSONC by design — bun puts explanatory comments in it — so
+* plain `JSON.parse` rejects real lockfiles. Returns `undefined` rather than
+* throwing so detection can use it as a probe.
 */
-const downloadAll = (packages, destDir, options) => Effect.gen(function* () {
-	const fs = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	const registry = yield* Registry;
-	yield* emit({
-		_tag: "PhaseStarted",
-		phase: "download",
-		total: packages.length
-	});
-	let completed = 0;
-	const sizes = /* @__PURE__ */ new Map();
-	const unverified = [];
-	const results = yield* Effect.forEach(packages, (pkg) => Effect.gen(function* () {
-		const key = `${pkg.name}@${pkg.version}`;
-		yield* emit({
-			_tag: "DownloadStarted",
-			name: pkg.name,
-			version: pkg.version
-		});
-		const bytes = yield* registry.download(pkg.manifest);
-		if (options.verifyIntegrity) {
-			const result = verify(bytes, pkg.manifest.dist);
-			if (result._tag === "Mismatch") return yield* Effect.fail(new IntegrityError(pkg.name, pkg.version, result.expected, result.actual));
-			if (result._tag === "Unverifiable") yield* emit({
-				_tag: "Warning",
-				message: `${key} could not be verified (${result.reason})`
-			});
+const tryParseJsonc = (content) => {
+	try {
+		return JSON.parse(content);
+	} catch {
+		try {
+			return JSON.parse(stripJsonc(content));
+		} catch {
+			return;
 		}
-		const verifiable = (pkg.manifest.dist.integrity?.length ?? 0) > 0 || (pkg.manifest.dist.shasum?.length ?? 0) > 0;
-		const relative = packagePath(pkg.name, pkg.version);
-		const target = path.join(destDir, ...relative.split("/"));
-		yield* fs.makeDirectory(path.dirname(target), { recursive: true }).pipe(Effect.mapError((cause) => new OutputError(path.dirname(target), "could not create directory", { cause })));
-		yield* fs.writeFile(target, bytes).pipe(Effect.mapError((cause) => new OutputError(target, "could not write tarball", { cause })));
-		completed += 1;
-		yield* emit({
-			_tag: "DownloadCompleted",
-			name: pkg.name,
-			version: pkg.version,
-			bytes: bytes.byteLength,
-			completedCount: completed,
-			totalCount: packages.length
-		});
-		return {
-			key,
-			bytes: bytes.byteLength,
-			verifiable
-		};
-	}), { concurrency: options.concurrency });
-	for (const result of results) {
-		sizes.set(result.key, result.bytes);
-		if (!result.verifiable) unverified.push(result.key);
 	}
-	yield* emit({
-		_tag: "PhaseCompleted",
-		phase: "download"
-	});
-	return {
-		sizes,
-		unverified,
-		totalBytes: results.reduce((sum, r) => sum + r.bytes, 0)
+};
+/**
+* Removes comments and trailing commas.
+*
+* String-aware, because a `//` inside a tarball URL is not a comment and an
+* escaped quote does not end a string. Both appear in every real lockfile.
+*/
+const stripJsonc = (content) => {
+	let out = "";
+	let index = 0;
+	let inString = false;
+	while (index < content.length) {
+		const char = content[index];
+		if (inString) {
+			out += char;
+			if (char === "\\") {
+				out += content[index + 1] ?? "";
+				index += 2;
+				continue;
+			}
+			if (char === "\"") inString = false;
+			index += 1;
+			continue;
+		}
+		if (char === "\"") {
+			inString = true;
+			out += char;
+			index += 1;
+			continue;
+		}
+		if (char === "/" && content[index + 1] === "/") {
+			const end = content.indexOf("\n", index);
+			index = end === -1 ? content.length : end;
+			continue;
+		}
+		if (char === "/" && content[index + 1] === "*") {
+			const end = content.indexOf("*/", index + 2);
+			index = end === -1 ? content.length : end + 2;
+			continue;
+		}
+		if (char === ",") {
+			const next = content.slice(index + 1).search(/\S/);
+			const following = next === -1 ? "" : content[index + 1 + next];
+			if (following === "}" || following === "]") {
+				index += 1;
+				continue;
+			}
+		}
+		out += char;
+		index += 1;
+	}
+	return out;
+};
+const describeError$1 = (error) => error instanceof Error ? error.message : String(error);
+
+//#endregion
+//#region src/lockfile/detect.ts
+/**
+* Deliberately cheap and total: it never throws, so `--file` can try this
+* first and fall through to its other shapes when the answer is `NotALockfile`.
+*/
+const detectLockfile = (content) => {
+	const trimmed = content.trimStart();
+	if (trimmed.startsWith("bun-lockfile-format-v0")) return {
+		_tag: "Unsupported",
+		label: "a binary bun lockfile (bun.lockb)",
+		hint: "Run `bun install --save-text-lockfile` to produce a bun.lock, and pass that instead."
 	};
-});
+	if (/^__metadata:/m.test(trimmed) || /^# yarn lockfile v\d/m.test(trimmed)) return {
+		_tag: "Unsupported",
+		label: "a yarn lockfile",
+		hint: "yarn is not supported yet. Point --file at the package.json instead, or pass --lockfile off."
+	};
+	if (trimmed.startsWith("{")) return detectJsonLockfile(trimmed);
+	if (/^lockfileVersion:/m.test(trimmed) || /^(importers|snapshots):/m.test(trimmed)) return {
+		_tag: "Supported",
+		format: LockfileFormat.Pnpm
+	};
+	return { _tag: "NotALockfile" };
+};
+/**
+* Separates the two JSON lockfiles from each other and from a package.json.
+*
+* Both npm and bun write a numeric `lockfileVersion`, so that field alone
+* cannot decide it. bun is the one that carries a `workspaces` map keyed by the
+* empty string; npm keeps the root project under `packages[""]` instead.
+*/
+const detectJsonLockfile = (trimmed) => {
+	const parsed = tryParseJsonc(trimmed);
+	if (!isRecord(parsed)) return { _tag: "NotALockfile" };
+	const workspaces = parsed["workspaces"];
+	if (isRecord(workspaces) && Object.hasOwn(workspaces, "")) return {
+		_tag: "Supported",
+		format: LockfileFormat.Bun
+	};
+	if (typeof parsed["lockfileVersion"] === "number") return {
+		_tag: "Supported",
+		format: LockfileFormat.Npm
+	};
+	return { _tag: "NotALockfile" };
+};
 
 //#endregion
-//#region src/Platform.ts
-var Platform_exports = /* @__PURE__ */ __export({
-	allPlatforms: () => allPlatforms,
-	currentPlatform: () => currentPlatform,
-	formatPlatformFilter: () => formatPlatformFilter,
-	isIncluded: () => isIncluded,
-	matchesTarget: () => matchesTarget,
-	parsePlatformTarget: () => parsePlatformTarget,
-	platformTargets: () => platformTargets
-});
-const allPlatforms = { _tag: "All" };
-const platformTargets = (targets) => ({
-	_tag: "Targets",
-	targets
-});
-/** The machine we are currently running on. */
-const currentPlatform = () => ({
-	os: process.platform,
-	cpu: process.arch
-});
+//#region src/lockfile/names.ts
 /**
-* npm's documented `os` values, plus the names people actually type.
+* The file name each supported manager writes, in detection order.
 *
-* An OS on its own is a valid target, so a typo has to be caught here — the
-* whole failure mode this tool exists to prevent is a bundle that looks fine
-* and installs nothing. `--platform windows` silently matching no binding at
-* all would be precisely that, so it is corrected rather than accepted.
+* Ordered: `package-lock.json` before `npm-shrinkwrap.json` before pnpm's and
+* bun's, so a directory holding several is searched the way npm itself would.
 */
-const OS_ALIASES = {
-	win: "win32",
-	windows: "win32",
-	mac: "darwin",
-	macos: "darwin",
-	osx: "darwin"
+const formatByLockfileName = {
+	"package-lock.json": LockfileFormat.Npm,
+	"npm-shrinkwrap.json": LockfileFormat.Npm,
+	"pnpm-lock.yaml": LockfileFormat.Pnpm,
+	"bun.lock": LockfileFormat.Bun
 };
-const KNOWN_OS = new Set([
-	"aix",
-	"android",
-	"cygwin",
-	"darwin",
-	"freebsd",
-	"haiku",
-	"linux",
-	"netbsd",
-	"openbsd",
-	"sunos",
-	"win32"
-]);
-const LIBC = new Set(["musl", "glibc"]);
+/** The names a given manager writes. */
+const lockfileNamesFor = (format) => Object.entries(formatByLockfileName).flatMap(([name, candidate]) => candidate === format ? name : []);
+
+//#endregion
+//#region src/lockfile/tree-builder.ts
 /**
-* Parses `linux`, `linux-x64`, `darwin-arm64`, `win32-x64`, `linux-x64-musl`,
-* `linux-musl`.
+* Which manifest block each root kind is declared in.
 *
-* An OS on its own means every architecture for that OS, which is almost always
-* what you want: "the Windows and Linux bindings" is a far more natural way to
-* describe a target set than enumerating four `os-arch` pairs, and it keeps
-* working when a package adds an arm64 build.
+* The block names are the same across npm, pnpm and bun; only which of them a
+* given format writes differs, which is why each parser supplies its own order
+* rather than iterating this.
+*/
+const fieldByRootKind = {
+	[LockedRootKind.Prod]: "dependencies",
+	[LockedRootKind.Optional]: "optionalDependencies",
+	[LockedRootKind.Dev]: "devDependencies",
+	[LockedRootKind.Peer]: "peerDependencies"
+};
+var TreeBuilder = class {
+	packages = /* @__PURE__ */ new Map();
+	roots = [];
+	warnings = [];
+	incomplete = [];
+	/** Names dropped on purpose, so an edge into one is explained, not alarming. */
+	skipped = /* @__PURE__ */ new Set();
+	seenWarnings = /* @__PURE__ */ new Set();
+	add(pkg) {
+		const key = packageKey(pkg.name, pkg.version);
+		const existing = this.packages.get(key);
+		if (existing === void 0) {
+			this.packages.set(key, pkg);
+			return;
+		}
+		this.packages.set(key, {
+			...existing,
+			dependencies: mergeEdges(existing.dependencies, pkg.dependencies)
+		});
+	}
+	addRoot(root) {
+		if (this.roots.some((existing) => existing.name === root.name)) return;
+		this.roots.push(root);
+	}
+	warn(message) {
+		if (this.seenWarnings.has(message)) return;
+		this.seenWarnings.add(message);
+		this.warnings.push(message);
+	}
+	/** Notes an entry that is real but cannot come from a registry. */
+	skip(name, spec, reason) {
+		this.skipped.add(name);
+		this.warn(`skipped ${name}@${spec} (${reason}) — not fetchable from a registry`);
+	}
+	/**
+	* Records a required edge that resolved to nothing.
+	*
+	* An edge into something skipped on purpose is expected — you cannot bundle a
+	* `workspace:` sibling from a registry — so it stays a warning. Anything else
+	* means the file does not pin what it claims to.
+	*/
+	dangling(from, name) {
+		if (this.skipped.has(name)) {
+			this.warn(`${from} requires ${name}, which is not fetchable from a registry`);
+			return;
+		}
+		this.incomplete.push(`${name} (required by ${from})`);
+	}
+	finish(input) {
+		if (this.packages.size === 0) throw new LockfileError(input.path, "lockfile pins no packages that can be bundled");
+		return {
+			format: input.format,
+			lockfileVersion: input.lockfileVersion,
+			path: input.path,
+			importer: input.importer,
+			packages: this.packages,
+			roots: this.roots,
+			warnings: this.warnings,
+			incomplete: this.incomplete
+		};
+	}
+};
+const mergeEdges = (a, b) => {
+	const merged = /* @__PURE__ */ new Map();
+	for (const edge of [...a, ...b]) merged.set(`${edge.name}@${edge.version}|${edge.kind}`, edge);
+	return [...merged.values()];
+};
+/**
+* Reads the right-hand side of a locked entry as an exact version.
 *
-* Returns `null` rather than throwing so the CLI can report every bad value at
-* once alongside the list of accepted forms.
+* Returns the version when it is one, or the reason it is not — `file:../x`,
+* `workspace:*`, a git URL. `parseDependencyTarget` already classifies every
+* one of those for package.json parsing, so the vocabulary of skip reasons
+* stays identical between the two paths.
 */
-const parsePlatformTarget = (input) => {
-	const parts = input.trim().toLowerCase().split("-").filter((p) => p.length > 0);
-	if (parts.length === 0 || parts.length > 3) return null;
-	const rawOs = parts[0];
-	const os = OS_ALIASES[rawOs] ?? rawOs;
-	if (!KNOWN_OS.has(os)) return null;
-	if (parts.length === 1) return { os };
-	if (parts.length === 2 && LIBC.has(parts[1])) return {
-		os,
-		libc: parts[1]
+const asExactVersion = (name, raw) => {
+	const exact = semver.valid(raw, { loose: true });
+	if (exact !== null) return {
+		_tag: "Version",
+		version: exact
 	};
-	const cpu = parts[1];
-	if (parts.length === 2) return {
-		os,
-		cpu
+	const target = parseDependencyTarget(name, raw);
+	if (target._tag === "Unsupported") return {
+		_tag: "Unsupported",
+		reason: target.reason
 	};
-	const libc = parts[2];
-	if (!LIBC.has(libc)) return null;
 	return {
-		os,
-		cpu,
-		libc
+		_tag: "Unsupported",
+		reason: "not an exact version"
 	};
 };
 /**
-* npm's `os`/`cpu`/`libc` fields use a list of allowed values, where a leading
-* `!` negates. An empty or absent list means "no constraint".
+* Raised when a lockfile found by walking up turns out not to cover the
+* package.json that went looking for it.
 *
-* The semantics npm implements: if any negated entry matches, reject. Otherwise
-* if there are any positive entries, at least one must match.
+* Worth distinguishing from "no lockfile at all": the file exists and is
+* readable, it simply belongs to a different project, and bundling it would
+* produce someone else's dependency set.
 */
-const listAllows = (list, value) => {
-	if (list === void 0 || list.length === 0) return true;
-	let hasPositive = false;
-	let positiveMatched = false;
-	for (const entry of list) {
-		const normalized = entry.trim().toLowerCase();
-		if (normalized.length === 0) continue;
-		if (normalized === "any" || normalized === "*") return true;
-		if (normalized.startsWith("!")) {
-			if (normalized.slice(1) === value) return false;
-		} else {
-			hasPositive = true;
-			if (normalized === value) positiveMatched = true;
-		}
-	}
-	return hasPositive ? positiveMatched : true;
+const notCovered = (path, importer, known) => {
+	const listed = known.slice(0, 8).map((entry) => `    ${entry}`).join("\n");
+	throw new LockfileError(path, `it does not cover ${importer}.\n` + (known.length === 0 ? "  It records no workspace members." : `  Workspace members it does record:\n${listed}` + (known.length > 8 ? `\n    … and ${known.length - 8} more` : "")));
 };
-/** Would this package install on this specific target? */
-const matchesTarget = (constraints, target) => {
-	if (!listAllows(constraints.os, target.os)) return false;
-	if (target.cpu !== void 0 && !listAllows(constraints.cpu, target.cpu)) return false;
-	if (target.libc !== void 0 && !listAllows(constraints.libc, target.libc)) return false;
-	return true;
+/** `""` is how npm and bun spell the project at the lockfile's own level. */
+const importerKey = (importer) => importer === "." ? "" : importer;
+
+//#endregion
+//#region src/lockfile/bun.ts
+/** Root blocks in bun's precedence order — the first mention of a name wins. */
+const ROOT_KINDS$2 = [
+	LockedRootKind.Prod,
+	LockedRootKind.Optional,
+	LockedRootKind.Dev,
+	LockedRootKind.Peer
+];
+const parseBunLockfile = (path, content, importer) => {
+	const root = parseJsonObject(path, content);
+	const version = String(root["lockfileVersion"] ?? "?");
+	const builder = new TreeBuilder();
+	const packages = root["packages"];
+	const entries = isRecord(packages) ? collectEntries$1(builder, packages) : /* @__PURE__ */ new Map();
+	const keys = new Set(entries.keys());
+	for (const entry of entries.values()) builder.add({
+		name: entry.name,
+		version: entry.version,
+		dependencies: edgesOf$2(builder, entries, keys, entry)
+	});
+	collectRoots$2(builder, entries, keys, root["workspaces"], path, importer);
+	return builder.finish({
+		format: LockfileFormat.Bun,
+		lockfileVersion: version,
+		path,
+		importer
+	});
 };
 /**
-* Should this package be included, given the active filter?
+* Narrows bun's tuple entries.
 *
-* Under `All` this is unconditionally `true` — that is the whole point.
+* The value is a positional array whose shape depends on where the package came
+* from. A registry package is `[id, registry, info, integrity]`; a workspace
+* member or a git dependency is shorter and its `id` carries the protocol.
 */
-const isIncluded = (constraints, filter) => {
-	if (filter._tag === "All") return true;
-	return filter.targets.some((target) => matchesTarget(constraints, target));
+const collectEntries$1 = (builder, packages) => {
+	const entries = /* @__PURE__ */ new Map();
+	for (const [key, raw] of Object.entries(packages)) {
+		if (!Array.isArray(raw)) continue;
+		const [id, , info] = raw;
+		if (typeof id !== "string") continue;
+		const at = id.lastIndexOf("@");
+		if (at <= 0) continue;
+		const name = id.slice(0, at);
+		const spec = id.slice(at + 1);
+		const version = asExactVersion(name, spec);
+		if (version._tag === "Unsupported") {
+			builder.skip(name, spec, version.reason);
+			continue;
+		}
+		const details = isRecord(info) ? info : {};
+		entries.set(key, {
+			key,
+			name,
+			version: version.version,
+			dependencies: stringRecord(details["dependencies"]),
+			optionalDependencies: stringRecord(details["optionalDependencies"]),
+			peerDependencies: stringRecord(details["peerDependencies"]),
+			optionalPeers: collectOptionalPeers(details)
+		});
+	}
+	return entries;
 };
-/** Renders a filter for the manifest and for `--dry-run` output. */
-const formatPlatformFilter = (filter) => {
-	if (filter._tag === "All") return "all";
-	return filter.targets.map((t) => [
-		t.os,
-		t.cpu,
-		t.libc
-	].filter((part) => part !== void 0).join("-")).join(",");
+/** bun lists optional peers as a name array rather than npm's metadata object. */
+const collectOptionalPeers = (details) => {
+	const listed = details["optionalPeers"];
+	const names = Array.isArray(listed) ? listed.flatMap((entry) => typeof entry === "string" ? entry : []) : [];
+	return new Set([...names, ...optionalPeerNames(details["peerDependenciesMeta"])]);
 };
-
-//#endregion
-//#region src/Spec.ts
-var Spec_exports = /* @__PURE__ */ __export({
-	dedupeSpecs: () => dedupeSpecs,
-	formatSelector: () => formatSelector,
-	formatSpec: () => formatSpec,
-	parseSelector: () => parseSelector,
-	parseSpec: () => parseSpec,
-	parseSpecs: () => parseSpecs,
-	validatePackageName: () => validatePackageName
-});
-/** Renders a spec back into the canonical `name@selector` form. */
-const formatSpec = (spec) => {
-	switch (spec.selector._tag) {
-		case "Exact": return `${spec.name}@${spec.selector.version}`;
-		case "Range": return `${spec.name}@${spec.selector.range}`;
-		case "Tag": return `${spec.name}@${spec.selector.tag}`;
+const edgesOf$2 = (builder, entries, keys, entry) => {
+	const edges = [];
+	const add = (names, kind) => {
+		for (const name of names) {
+			const target = findEntry(entries, keys, entry.key, name);
+			if (target === void 0) {
+				if (kind === EdgeKind.Prod) builder.dangling(`${entry.name}@${entry.version}`, name);
+				continue;
+			}
+			edges.push({
+				name: target.name,
+				version: target.version,
+				kind
+			});
+		}
+	};
+	add(Object.keys(entry.dependencies), EdgeKind.Prod);
+	add(Object.keys(entry.optionalDependencies), EdgeKind.Optional);
+	add(Object.keys(entry.peerDependencies).filter((name) => !entry.optionalPeers.has(name)), EdgeKind.Peer);
+	return edges;
+};
+const collectRoots$2 = (builder, entries, keys, workspaces, path, member) => {
+	if (!isRecord(workspaces)) return;
+	const selected = member === void 0 ? Object.values(workspaces) : Object.hasOwn(workspaces, importerKey(member)) ? [workspaces[importerKey(member)]] : notCovered(path, member, workspacePaths$1(workspaces));
+	for (const workspace of selected) {
+		if (!isRecord(workspace)) continue;
+		for (const kind of ROOT_KINDS$2) {
+			const declared = stringRecord(workspace[fieldByRootKind[kind]]);
+			for (const [name, specifier] of Object.entries(declared)) {
+				const target = findEntry(entries, keys, "", name);
+				if (target === void 0) continue;
+				builder.addRoot({
+					name: target.name,
+					version: target.version,
+					kind,
+					specifier
+				});
+			}
+		}
 	}
 };
-/** Human-readable form of just the selector part. */
-const formatSelector = (selector) => {
-	switch (selector._tag) {
-		case "Exact": return selector.version;
-		case "Range": return selector.range;
-		case "Tag": return selector.tag;
+const workspacePaths$1 = (workspaces) => Object.keys(workspaces).map((key) => key === "" ? "." : key);
+/**
+* bun nests with a plain `/`, and package names contain `/` too, so a parent
+* key cannot be found by string-splitting alone — `@babel/core` would split
+* into a scope that is not a key. `parentKey` only accepts a prefix that is
+* itself an entry, which resolves the ambiguity.
+*/
+const findEntry = (entries, keys, fromKey, name) => {
+	let scope = fromKey;
+	for (;;) {
+		const found = entries.get(scope === "" ? name : `${scope}/${name}`);
+		if (found !== void 0) return found;
+		if (scope === "") return void 0;
+		scope = parentKey(keys, scope);
 	}
 };
-const MAX_NAME_LENGTH = 214;
+const parentKey = (keys, key) => {
+	for (let at = key.lastIndexOf("/"); at > 0; at = key.lastIndexOf("/", at - 1)) {
+		const prefix = key.slice(0, at);
+		if (keys.has(prefix)) return prefix;
+	}
+	return "";
+};
+
+//#endregion
+//#region src/lockfile/npm.ts
+/** Root blocks in npm's precedence order — the first mention of a name wins. */
+const ROOT_KINDS$1 = [
+	LockedRootKind.Prod,
+	LockedRootKind.Optional,
+	LockedRootKind.Dev,
+	LockedRootKind.Peer
+];
 /**
-* Validates an npm package name against the rules the registry actually
-* enforces. Returns `null` when valid, or the reason it is not.
+* The node resolution walk-up, over a flat map of install paths.
+*
+* A package at `node_modules/a/node_modules/b` depending on `c` gets, in order,
+* `node_modules/a/node_modules/b/node_modules/c`, then
+* `node_modules/a/node_modules/c`, then `node_modules/c`. This is what makes a
+* range on an edge unambiguous: the nesting already recorded which copy won.
 */
-const validatePackageName = (name) => {
-	if (name.length === 0) return "name is empty";
-	if (name.length > MAX_NAME_LENGTH) return `name is longer than ${MAX_NAME_LENGTH} characters`;
-	if (name.trim() !== name) return "name has leading or trailing whitespace";
-	if (name.startsWith(".")) return "name cannot start with a period";
-	if (name.startsWith("_")) return "name cannot start with an underscore";
-	if (name !== name.toLowerCase()) return "name cannot contain capital letters";
-	if (name.startsWith("@")) {
-		const slash = name.indexOf("/");
-		if (slash === -1) return "scoped name is missing the '/name' part";
-		const scope = name.slice(1, slash);
-		const rest = name.slice(slash + 1);
-		if (scope.length === 0) return "scope is empty";
-		if (rest.length === 0) return "name after the scope is empty";
-		if (rest.includes("/")) return "name contains more than one '/'";
-		if (!SEGMENT_RE.test(scope)) return `scope "${scope}" contains illegal characters`;
-		if (!SEGMENT_RE.test(rest)) return `name "${rest}" contains illegal characters`;
-		return null;
+const NESTING = "/node_modules/";
+const parseNpmLockfile = (path, content, importer) => {
+	const root = parseJsonObject(path, content);
+	const version = String(root["lockfileVersion"] ?? "?");
+	const builder = new TreeBuilder();
+	const packages = root["packages"];
+	const entries = isRecord(packages) ? collectEntries(builder, packages) : collectLegacyEntries(builder, root);
+	for (const entry of entries.values()) builder.add({
+		name: entry.realName,
+		version: entry.version,
+		dependencies: edgesOf$1(builder, entries, entry)
+	});
+	collectRoots$1(builder, entries, isRecord(packages) ? packages : root, path, importer);
+	return builder.finish({
+		format: LockfileFormat.Npm,
+		lockfileVersion: version,
+		path,
+		importer
+	});
+};
+/** Narrows the v2/v3 `packages` map, dropping what cannot be bundled. */
+const collectEntries = (builder, packages) => {
+	const entries = /* @__PURE__ */ new Map();
+	for (const [entryPath, raw] of Object.entries(packages)) {
+		const installName = installNameFromPath(entryPath);
+		if (installName === null) continue;
+		if (!isRecord(raw)) continue;
+		if (raw["link"] === true) {
+			builder.skip(installName, stringOr(raw["resolved"], "link"), "workspace link");
+			continue;
+		}
+		const rawVersion = raw["version"];
+		if (typeof rawVersion !== "string") {
+			builder.warn(`skipped ${installName} — its lockfile entry records no version, so there is nothing to pin`);
+			continue;
+		}
+		const resolvedName = typeof raw["name"] === "string" ? raw["name"] : installName;
+		const version = asExactVersion(resolvedName, rawVersion);
+		if (version._tag === "Unsupported") {
+			builder.skip(resolvedName, rawVersion, version.reason);
+			continue;
+		}
+		const resolvedUrl = raw["resolved"];
+		if (typeof resolvedUrl === "string" && !isRegistryUrl(resolvedUrl)) {
+			builder.skip(resolvedName, resolvedUrl, "not a registry tarball");
+			continue;
+		}
+		entries.set(entryPath, {
+			path: entryPath,
+			version: version.version,
+			realName: resolvedName,
+			dependencies: stringRecord(raw["dependencies"]),
+			optionalDependencies: stringRecord(raw["optionalDependencies"]),
+			peerDependencies: stringRecord(raw["peerDependencies"]),
+			optionalPeers: optionalPeerNames(raw["peerDependenciesMeta"])
+		});
 	}
-	if (name.includes("/")) return "unscoped name cannot contain '/'";
-	if (!SEGMENT_RE.test(name)) return "name contains illegal characters";
-	return null;
+	return entries;
 };
-const SEGMENT_RE = /^[a-z0-9\-._~]+$/;
 /**
-* Parses a single spec string.
+* Flattens a v1 lockfile's nested `dependencies` tree into the same
+* path-keyed shape v2 uses.
 *
-* Splitting on `@` is the fiddly part: a scoped name *starts* with `@`, so we
-* look for the last `@` that is not at index 0.
+* v1 is old — npm 6 — but it is exactly the vintage still pinned inside a lot
+* of the locked-down environments this tool exists for, so it is worth the
+* thirty lines rather than an error telling somebody to upgrade npm.
 */
-const parseSpec = (raw) => {
-	const input = raw.trim();
-	if (input.length === 0) throw new InvalidSpecError(raw, "spec is empty");
-	const at = input.lastIndexOf("@");
-	const hasSelector = at > 0;
-	const name = hasSelector ? input.slice(0, at) : input;
-	const selectorText = hasSelector ? input.slice(at + 1) : "";
-	const nameProblem = validatePackageName(name);
-	if (nameProblem !== null) throw new InvalidSpecError(raw, nameProblem);
-	if (!hasSelector || selectorText.length === 0) return {
-		name,
-		selector: {
-			_tag: "Tag",
-			tag: "latest"
-		},
-		raw: input
-	};
-	return {
-		name,
-		selector: parseSelector(raw, selectorText),
-		raw: input
+const collectLegacyEntries = (builder, root) => {
+	const entries = /* @__PURE__ */ new Map();
+	const visit = (tree, prefix) => {
+		if (!isRecord(tree)) return;
+		for (const [name, raw] of Object.entries(tree)) {
+			if (!isRecord(raw)) continue;
+			const entryPath = prefix === "" ? `node_modules/${name}` : `${prefix}/node_modules/${name}`;
+			const rawVersion = raw["version"];
+			if (typeof rawVersion === "string") {
+				const version = asExactVersion(name, rawVersion);
+				if (version._tag === "Unsupported") builder.skip(name, rawVersion, version.reason);
+				else entries.set(entryPath, {
+					path: entryPath,
+					version: version.version,
+					realName: name,
+					dependencies: stringRecord(raw["requires"]),
+					optionalDependencies: {},
+					peerDependencies: {},
+					optionalPeers: /* @__PURE__ */ new Set()
+				});
+			}
+			visit(raw["dependencies"], entryPath);
+		}
 	};
+	visit(root["dependencies"], "");
+	return entries;
 };
-/** Classifies the part after the `@` as an exact version, a range, or a dist-tag. */
-const parseSelector = (raw, text) => {
-	const exact = semver.valid(text, { loose: false });
-	if (exact !== null) return {
-		_tag: "Exact",
-		version: exact
-	};
-	if (semver.validRange(text, { loose: false }) !== null) return {
-		_tag: "Range",
-		range: text
-	};
-	if (!DIST_TAG_RE.test(text)) throw new InvalidSpecError(raw, `"${text}" is not a valid version, semver range, or dist-tag`);
-	return {
-		_tag: "Tag",
-		tag: text
+/** Turns one entry's ranges into edges, resolved through the directory nesting. */
+const edgesOf$1 = (builder, entries, entry) => {
+	const edges = [];
+	const add = (names, kind) => {
+		for (const name of names) {
+			const targetPath = resolveNestedEdge(entries, entry.path, name);
+			const target = targetPath === null ? void 0 : entries.get(targetPath);
+			if (target === void 0) {
+				if (kind === EdgeKind.Prod) builder.dangling(`${entry.realName}@${entry.version}`, name);
+				continue;
+			}
+			edges.push({
+				name: target.realName,
+				version: target.version,
+				kind
+			});
+		}
 	};
+	const optionalNames = Object.keys(entry.optionalDependencies);
+	const optional = new Set(optionalNames);
+	add(Object.keys(entry.dependencies).filter((name) => !optional.has(name)), EdgeKind.Prod);
+	add(optionalNames, EdgeKind.Optional);
+	add(Object.keys(entry.peerDependencies).filter((name) => !entry.optionalPeers.has(name)), EdgeKind.Peer);
+	return edges;
 };
-const DIST_TAG_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
 /**
-* Parses many specs, collecting *every* failure rather than stopping at the
-* first. Somebody bundling forty packages should be told about all four typos
-* in one go, not made to re-run four times.
+* Reads the root project's direct dependencies.
+*
+* The lockfile records these under `packages[""]` for v2/v3. v1 has no such
+* entry, so every top-level `node_modules/x` is treated as direct — which
+* over-counts roots slightly on v1 and is the best that file can support.
 */
-const parseSpecs = (inputs) => {
-	const specs = [];
-	const errors = [];
-	for (const input of inputs) try {
-		specs.push(parseSpec(input));
-	} catch (error) {
-		if (error instanceof InvalidSpecError) errors.push(error);
-		else throw error;
-	}
-	return {
-		specs,
-		errors
+const collectRoots$1 = (builder, entries, source, path, importer) => {
+	const collectFrom = (from, project) => {
+		for (const kind of ROOT_KINDS$1) {
+			const field = fieldByRootKind[kind];
+			for (const [name, specifier] of Object.entries(stringRecord(project[field]))) {
+				const targetPath = resolveNestedEdge(entries, from, name);
+				const target = targetPath === null ? void 0 : entries.get(targetPath);
+				if (target === void 0) continue;
+				builder.addRoot({
+					name: target.realName,
+					version: target.version,
+					kind,
+					specifier
+				});
+			}
+		}
 	};
+	if (importer !== void 0) {
+		const key = importerKey(importer);
+		const project = source[key];
+		if (!isRecord(project)) notCovered(path, importer, workspacePaths(source));
+		else collectFrom(key, project);
+		return;
+	}
+	const projects = Object.entries(source).flatMap(([key, value]) => isRecord(value) && !key.includes("node_modules/") ? [[key, value]] : []);
+	if (projects.length > 0) {
+		for (const [key, project] of projects) collectFrom(key, project);
+		return;
+	}
+	for (const entry of entries.values()) {
+		if (entry.path.includes(NESTING)) continue;
+		builder.addRoot({
+			name: entry.realName,
+			version: entry.version,
+			kind: LockedRootKind.Prod
+		});
+	}
 };
+/** The workspace paths a v2/v3 lockfile records, for a "does not cover" message. */
+const workspacePaths = (source) => Object.keys(source).flatMap((key) => key === "" ? "." : key.includes("node_modules/") ? [] : key);
 /**
-* Collapses duplicate specs, keeping the first occurrence.
-*
-* `npmb react react@latest` is a plausible thing to type and should not
-* download React twice.
+* npm records non-registry sources as a URL in `resolved`. Registry tarballs
+* are ordinary http(s); anything with a `git+`, `file:` or bare path form is
+* something we cannot fetch.
 */
-const dedupeSpecs = (specs) => {
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const spec of specs) {
-		const key = formatSpec(spec);
-		if (seen.has(key)) continue;
-		seen.add(key);
-		out.push(spec);
+const isRegistryUrl = (url) => url.startsWith("http://") || url.startsWith("https://");
+const resolveNestedEdge = (entries, fromPath, name) => {
+	let scope = fromPath;
+	for (;;) {
+		const candidate = scope === "" ? `node_modules/${name}` : `${scope}${NESTING}${name}`;
+		if (entries.has(candidate)) return candidate;
+		if (scope === "") return null;
+		const at = scope.lastIndexOf(NESTING);
+		scope = at === -1 ? "" : scope.slice(0, at);
 	}
-	return out;
+};
+/** `node_modules/@babel/core` -> `@babel/core`; a workspace path -> `null`. */
+const installNameFromPath = (entryPath) => {
+	const at = entryPath.lastIndexOf("node_modules/");
+	if (at === -1) return null;
+	const name = entryPath.slice(at + 13);
+	return name.length === 0 ? null : name;
 };
 
 //#endregion
-//#region src/Manifest.ts
-var Manifest_exports = /* @__PURE__ */ __export({
-	MANIFEST_VERSION: () => MANIFEST_VERSION,
-	buildManifest: () => buildManifest,
-	formatReasons: () => formatReasons,
-	serializeManifest: () => serializeManifest
-});
-/** Schema version, bumped when the shape changes incompatibly. */
-const MANIFEST_VERSION = 1;
-/** Renders a package's reasons into short, greppable strings. */
-const formatReasons = (pkg) => pkg.reasons.map((reason) => reason._tag === "Root" ? `root:${reason.spec}` : `${reason.kind}:${reason.from}`);
-/** Builds the manifest for a completed (or dry) run. */
-const buildManifest = (input) => {
-	const includedNames = new Set(input.included.map((p) => `${p.name}@${p.version}`));
-	const packages = input.included.map((pkg) => {
-		const key = `${pkg.name}@${pkg.version}`;
-		return {
-			name: pkg.name,
-			version: pkg.version,
-			path: packagePath(pkg.name, pkg.version),
-			tarball: pkg.manifest.dist.tarball,
-			integrity: pkg.manifest.dist.integrity,
-			shasum: pkg.manifest.dist.shasum,
-			bytes: input.sizes.get(key),
-			reasons: formatReasons(pkg)
-		};
+//#region src/lockfile/pnpm.ts
+/** pnpm never records peer dependencies against an importer. */
+const ROOT_KINDS = [
+	LockedRootKind.Prod,
+	LockedRootKind.Optional,
+	LockedRootKind.Dev
+];
+const parsePnpmLockfile = (path, content, importer) => {
+	let root;
+	try {
+		root = parse(content);
+	} catch (error) {
+		throw new LockfileError(path, `not valid YAML — ${describeError$1(error)}`, { cause: error });
+	}
+	if (!isRecord(root)) throw new LockfileError(path, "top level is not a mapping");
+	const version = String(root["lockfileVersion"] ?? "?");
+	const builder = new TreeBuilder();
+	const packages = isRecord(root["packages"]) ? root["packages"] : {};
+	const snapshots = isRecord(root["snapshots"]) ? root["snapshots"] : packages;
+	const known = /* @__PURE__ */ new Map();
+	for (const key of Object.keys(packages)) {
+		const parsed = parsePnpmKey(key);
+		if (parsed === null) continue;
+		known.set(key, parsed);
+	}
+	for (const [key, raw] of Object.entries(snapshots)) {
+		const parsed = parsePnpmKey(key) ?? known.get(key);
+		if (parsed === void 0 || parsed === null) {
+			const described = describeKey(key);
+			if (described !== null) builder.skip(described.name, described.spec, described.reason);
+			continue;
+		}
+		builder.add({
+			name: parsed.name,
+			version: parsed.version,
+			dependencies: edgesOf(builder, parsed, isRecord(raw) ? raw : {})
+		});
+	}
+	collectRoots(builder, root, path, importer);
+	return builder.finish({
+		format: LockfileFormat.Pnpm,
+		lockfileVersion: version,
+		path,
+		importer
 	});
-	const totalBytes = packages.reduce((sum, entry) => sum + (entry.bytes ?? 0), 0);
-	return {
-		manifestVersion: MANIFEST_VERSION,
-		tool: {
-			name: "packall",
-			version: input.toolVersion
-		},
-		createdAt: (input.createdAt ?? /* @__PURE__ */ new Date()).toISOString(),
-		registry: input.registry,
-		requested: input.resolution.roots.map((root) => formatSpec(root.spec)),
-		roots: input.resolution.roots.map((root) => ({
-			spec: formatSpec(root.spec),
-			versions: root.versions,
-			packageCount: root.closure.filter((key) => includedNames.has(key)).length
-		})),
-		options: {
-			layout: input.options.layout,
-			optionalDependencies: input.options.scope.optional,
-			peerDependencies: input.options.scope.peer,
-			platforms: formatPlatformFilter(input.options.scope.platforms),
-			allVersions: input.options.allVersions,
-			includePrerelease: input.options.includePrerelease,
-			integrityVerified: input.options.verifyIntegrity
-		},
-		packages,
-		warnings: input.resolution.warnings.map((warning) => warning.from === void 0 ? warning.message : `${warning.from}: ${warning.message}`),
-		totals: {
-			packages: packages.length,
-			bytes: totalBytes
+};
+const edgesOf = (builder, from, snapshot) => {
+	const edges = [];
+	const add = (field, kind) => {
+		const entries = snapshot[field];
+		if (!isRecord(entries)) return;
+		for (const [name, raw] of Object.entries(entries)) {
+			if (typeof raw !== "string") continue;
+			const target = parsePnpmReference(name, raw);
+			if (target === null) {
+				if (kind === EdgeKind.Prod) builder.dangling(`${from.name}@${from.version}`, name);
+				continue;
+			}
+			edges.push({
+				...target,
+				kind
+			});
 		}
 	};
+	add(fieldByRootKind[LockedRootKind.Prod], EdgeKind.Prod);
+	add(fieldByRootKind[LockedRootKind.Optional], EdgeKind.Optional);
+	add(fieldByRootKind[LockedRootKind.Peer], EdgeKind.Peer);
+	return edges;
 };
-/** Serialises a manifest with stable key order and a trailing newline. */
-const serializeManifest = (manifest) => `${JSON.stringify(manifest, null, 2)}\n`;
-
-//#endregion
-//#region src/DependencyRange.ts
-var DependencyRange_exports = /* @__PURE__ */ __export({ parseDependencyTarget: () => parseDependencyTarget });
-const UNSUPPORTED_PROTOCOLS = [
-	["file:", "local file path"],
-	["link:", "local link"],
-	["workspace:", "workspace protocol"],
-	["portal:", "portal protocol"],
-	["patch:", "patch protocol"],
-	["git:", "git dependency"],
-	["git+", "git dependency"],
-	["github:", "GitHub shorthand"],
-	["gitlab:", "GitLab shorthand"],
-	["bitbucket:", "Bitbucket shorthand"],
-	["http:", "remote tarball URL"],
-	["https:", "remote tarball URL"]
-];
 /**
-* Classifies one `name -> range` entry.
+* The importers' direct dependencies become the roots.
 *
-* An empty range, `*`, and `latest` all mean "any published version"; npm
-* treats them interchangeably and so do we.
+* pnpm is the format that makes this easy: `importers` is already keyed by the
+* path each package.json sits at, so scoping to one member is a lookup rather
+* than a reconstruction.
 */
-const parseDependencyTarget = (name, raw) => {
-	const text = raw.trim();
-	if (text.length === 0 || text === "*" || text === "x" || text === "latest") return {
-		_tag: "Registry",
-		name,
-		selector: {
-			_tag: "Range",
-			range: "*"
+const collectRoots = (builder, root, path, member) => {
+	const importers = isRecord(root["importers"]) ? root["importers"] : { ".": root };
+	const selected = member === void 0 ? Object.values(importers) : Object.hasOwn(importers, member) ? [importers[member]] : notCovered(path, member, Object.keys(importers));
+	for (const importer of selected) {
+		if (!isRecord(importer)) continue;
+		for (const kind of ROOT_KINDS) {
+			const entries = importer[fieldByRootKind[kind]];
+			if (!isRecord(entries)) continue;
+			for (const [name, raw] of Object.entries(entries)) {
+				const value = typeof raw === "string" ? raw : isRecord(raw) ? raw["version"] : void 0;
+				if (typeof value !== "string") continue;
+				const target = parsePnpmReference(name, value);
+				if (target === null) continue;
+				const specifier = isRecord(raw) && typeof raw["specifier"] === "string" ? raw["specifier"] : void 0;
+				builder.addRoot({
+					...target,
+					kind,
+					specifier
+				});
+			}
 		}
-	};
-	if (text.startsWith("npm:")) return parseAlias(name, text);
-	for (const [prefix, reason] of UNSUPPORTED_PROTOCOLS) if (text.startsWith(prefix)) return {
-		_tag: "Unsupported",
-		name,
-		raw: text,
-		reason
-	};
-	if (semver.validRange(text, { loose: true }) === null && /^[\w.-]+\/[\w.-]+/.test(text)) return {
-		_tag: "Unsupported",
-		name,
-		raw: text,
-		reason: "git shorthand"
-	};
-	const exact = semver.valid(text, { loose: true });
+	}
+};
+/**
+* Reads a dependency value from a snapshot or importer.
+*
+* The value is either a bare version (`1.4.0`) or a full package key
+* (`/lodash@4.17.21`, used when the install name is an alias of another
+* package). Both may carry a peer-resolution suffix in parentheses.
+*/
+const parsePnpmReference = (name, raw) => {
+	const value = stripSuffix(raw);
+	const exact = semver.valid(value, { loose: true });
 	if (exact !== null) return {
-		_tag: "Registry",
-		name,
-		selector: {
-			_tag: "Exact",
-			version: exact
-		}
-	};
-	if (semver.validRange(text, { loose: true }) !== null) return {
-		_tag: "Registry",
 		name,
-		selector: {
-			_tag: "Range",
-			range: text
-		}
-	};
-	if (/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(text)) return {
-		_tag: "Registry",
-		name,
-		selector: {
-			_tag: "Tag",
-			tag: text
-		}
-	};
-	return {
-		_tag: "Unsupported",
-		name,
-		raw: text,
-		reason: "unrecognised version specifier"
+		version: exact
 	};
+	return parsePnpmKey(raw);
 };
 /**
-* Parses `npm:<name>[@<range>]`.
+* Splits a package key into name and version.
 *
-* The nested name may itself be scoped, so the `@` split has the same
-* "not at index 0" caveat as top-level spec parsing.
+* Three encodings across the versions still in the wild:
+*   v5  `/@babel/core/7.0.0`
+*   v6  `/@babel/core@7.0.0`
+*   v9  `@babel/core@7.0.0`
+*
+* plus an optional `(peer@1.0.0)` or `(patch_hash=…)` suffix on any of them.
 */
-const parseAlias = (key, text) => {
-	const body = text.slice(4);
-	if (body.length === 0) return {
-		_tag: "Unsupported",
-		name: key,
-		raw: text,
-		reason: "empty npm: alias"
-	};
+const parsePnpmKey = (key) => {
+	const body = stripSuffix(key.startsWith("/") ? key.slice(1) : key);
 	const at = body.lastIndexOf("@");
-	const target = at > 0 ? body.slice(0, at) : body;
-	const rangeText = at > 0 ? body.slice(at + 1) : "";
-	if (target.length === 0) return {
-		_tag: "Unsupported",
-		name: key,
-		raw: text,
-		reason: "empty npm: alias target"
-	};
-	const inner = parseDependencyTarget(target, rangeText);
-	if (inner._tag === "Unsupported") return {
-		...inner,
-		name: key,
-		raw: text
-	};
+	const cut = at > 0 ? at : body.lastIndexOf("/");
+	if (cut <= 0) return null;
+	const name = body.slice(0, cut);
+	const version = semver.valid(body.slice(cut + 1), { loose: true });
+	if (version === null || name.length === 0) return null;
 	return {
-		_tag: "Registry",
-		name: target,
-		selector: inner.selector,
-		aliasOf: key
+		name,
+		version
 	};
 };
-
-//#endregion
-//#region src/Resolve.ts
-var Resolve_exports = /* @__PURE__ */ __export({
-	edgesOf: () => edgesOf,
-	indexPackages: () => indexPackages,
-	packageKey: () => packageKey,
-	resolve: () => resolve,
-	selectVersions: () => selectVersions
-});
-const packageKey = (name, version) => `${name}@${version}`;
-/** Index of a resolution by `name@version`, for lookups during bundling. */
-const indexPackages = (resolution) => new Map(resolution.packages.map((p) => [packageKey(p.name, p.version), p]));
-/**
-* Turns a selector into the concrete version(s) it names.
-*
-* `all` controls whether a range collapses to its best match — npm's behaviour,
-* and what you always want for a transitive dependency — or expands to every
-* satisfying published version, which is what `--all-versions` is for.
-*/
-const selectVersions = (packument, selector, options) => {
-	const available = Object.keys(packument.versions);
-	switch (selector._tag) {
-		case "Exact":
-			if (!Object.hasOwn(packument.versions, selector.version)) throw new VersionNotFoundError(packument.name, selector.version, sortVersions(available));
-			return [selector.version];
-		case "Tag": {
-			const version = packument.distTags[selector.tag];
-			if (version === void 0 || !Object.hasOwn(packument.versions, version)) throw new NoMatchingVersionsError(packument.name, selector.tag, sortVersions(available));
-			return [version];
-		}
-		case "Range": {
-			const satisfying = available.filter((v) => semver.satisfies(v, selector.range, {
-				loose: true,
-				includePrerelease: options.includePrerelease
-			})).sort(semver.rcompare);
-			if (satisfying.length === 0) throw new NoMatchingVersionsError(packument.name, selector.range, sortVersions(available));
-			if (!options.all) return [satisfying[0]];
-			return options.maxVersions !== void 0 && options.maxVersions > 0 ? satisfying.slice(0, options.maxVersions) : satisfying;
-		}
-	}
+/** Describes a key we cannot pin, so the skip warning can say why. */
+const describeKey = (key) => {
+	const body = key.startsWith("/") ? key.slice(1) : key;
+	const at = body.lastIndexOf("@");
+	if (at <= 0) return null;
+	const name = body.slice(0, at);
+	const spec = body.slice(at + 1);
+	const target = parseDependencyTarget(name, spec);
+	return {
+		name,
+		spec,
+		reason: target._tag === "Unsupported" ? target.reason : "not an exact version"
+	};
 };
-const sortVersions = (versions) => [...versions].sort((a, b) => semver.valid(a) && semver.valid(b) ? semver.compare(a, b) : a.localeCompare(b));
-const makeWalkState = () => ({
-	resolved: /* @__PURE__ */ new Map(),
-	edges: /* @__PURE__ */ new Map(),
-	packuments: /* @__PURE__ */ new Map(),
-	warnings: [],
-	warningKeys: /* @__PURE__ */ new Set()
-});
-const addWarning = (state, warning) => {
-	const key = `${warning.from ?? ""}|${warning.message}`;
-	if (state.warningKeys.has(key)) return;
-	state.warningKeys.add(key);
-	state.warnings.push(warning);
+/**
+* Drops the parenthesised peer-resolution suffix.
+*
+* pnpm distinguishes the same version installed against different peers —
+* `react-dom@18.3.1(react@18.3.1)`. Those are the same published tarball, which
+* is all this tool downloads, so the suffix is noise here.
+*/
+const stripSuffix = (value) => {
+	const open = value.indexOf("(");
+	return open === -1 ? value : value.slice(0, open);
 };
+
+//#endregion
+//#region src/lockfile/parse.ts
 /**
-* Fetches a packument, reusing anything already seen in this run.
+* Parses lockfile content into a flat graph.
 *
-* Two fibers in the same wave can race here and both fetch. That is one
-* duplicated GET at worst, and de-racing it would cost more complexity than it
-* saves.
+* Throws `LockfileError`; the caller is expected to be inside an `Effect.try`.
 */
-const getPackument = (state, name) => Effect.gen(function* () {
-	const cached = state.packuments.get(name);
-	if (cached !== void 0) return cached;
-	const packument = yield* (yield* Registry).packument(name);
-	state.packuments.set(name, packument);
-	return packument;
+const parseLockfile = (path, content, format, options = {}) => {
+	const resolved = format ?? resolveFormat(path, content);
+	const importer = options.importer;
+	switch (resolved) {
+		case LockfileFormat.Npm: return parseNpmLockfile(path, content, importer);
+		case LockfileFormat.Pnpm: return parsePnpmLockfile(path, content, importer);
+		case LockfileFormat.Bun: return parseBunLockfile(path, content, importer);
+	}
+};
+const resolveFormat = (path, content) => {
+	const detected = detectLockfile(content);
+	if (detected._tag === "Supported") return detected.format;
+	if (detected._tag === "Unsupported") throw new LockfileError(path, `${detected.label} — ${detected.hint}`);
+	throw new LockfileError(path, "content does not look like a package-lock.json, pnpm-lock.yaml or bun.lock");
+};
+
+//#endregion
+//#region src/schemas/package-json.ts
+const PackageJsonSchema = Schema.Struct({
+	dependencies: tolerant(StringRecordSchema),
+	devDependencies: tolerant(StringRecordSchema),
+	optionalDependencies: tolerant(StringRecordSchema),
+	peerDependencies: tolerant(StringRecordSchema),
+	peerDependenciesMeta: tolerant(OptionalFlagRecordSchema)
 });
-/** Expands one resolved manifest into the edges that follow from it. */
-const edgesOf = (manifest, options) => {
-	const from = packageKey(manifest.name, manifest.version);
-	const tasks = [];
+const decodePackageJson = Schema.decodeUnknownOption(PackageJsonSchema);
+
+//#endregion
+//#region src/input-file.ts
+const defaultInputFileOptions = { includeDev: true };
+/** Reads and parses an input file. */
+const readInputFile = (filePath, options = defaultInputFileOptions) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	if (!(yield* fs.exists(filePath).pipe(Effect.mapError((cause) => new InvalidInputFileError(filePath, "could not be read", { cause }))))) return yield* Effect.fail(new InvalidInputFileError(filePath, "file does not exist"));
+	const content = yield* fs.readFileString(filePath).pipe(Effect.mapError((cause) => new InvalidInputFileError(filePath, "could not be read", { cause })));
+	return yield* Effect.try({
+		try: () => parseInputFile(filePath, content, options),
+		catch: (error) => error instanceof InvalidInputFileError || isLockfileError(error) ? error : new InvalidInputFileError(filePath, describeError(error), { cause: error })
+	});
+});
+const isLockfileError = (error) => error instanceof Error && "_tag" in error && error._tag === "LockfileError";
+/**
+* Parses file content that has already been read.
+*
+* Split out from the IO so the whole of this logic is testable with plain
+* strings and no file system at all.
+*/
+const parseInputFile = (filePath, content, options = defaultInputFileOptions) => {
+	const trimmed = content.trim();
+	if (trimmed.length === 0) throw new InvalidInputFileError(filePath, "file is empty");
+	const detected = detectLockfile(trimmed);
+	if (detected._tag === "Unsupported") throw new InvalidInputFileError(filePath, `${detected.label} — ${detected.hint}`);
+	if (detected._tag === "Supported") return fromLockfile(filePath, content, detected.format, options);
+	return looksLikeJson(trimmed) ? fromPackageJson(filePath, trimmed, options) : fromList(filePath, content);
+};
+const looksLikeJson = (trimmed) => trimmed.startsWith("{");
+const fromLockfile = (filePath, content, format, options) => {
+	const lockfile = parseLockfile(filePath, content, format, { importer: options.importer });
+	const roots = lockfile.roots.filter((root) => options.includeDev || root.kind !== "dev");
+	return {
+		kind: InputFileKind.Lockfile,
+		specs: roots.map((root) => ({
+			name: root.name,
+			selector: {
+				_tag: "Exact",
+				version: root.version
+			},
+			raw: `${root.name}@${root.version}`
+		})),
+		warnings: lockfile.warnings,
+		lockfile
+	};
+};
+const fromPackageJson = (filePath, content, options) => {
+	const parsed = parsePackageJson(filePath, content);
+	const specs = [];
 	const warnings = [];
-	const add = (entries, kind, tolerateFailure, skip) => {
+	const required = [];
+	const seen = /* @__PURE__ */ new Set();
+	const collect = (entries, label, skip) => {
 		if (entries === void 0) return;
 		for (const [name, raw] of Object.entries(entries)) {
 			if (skip?.(name)) continue;
 			const target = parseDependencyTarget(name, raw);
 			if (target._tag === "Unsupported") {
-				warnings.push({
-					from,
-					message: `Skipped ${name}@${target.raw} (${target.reason}) — it cannot be fetched from a registry. Vendor it separately if the offline install needs it.`
-				});
+				warnings.push(`${label}: skipped ${name}@${target.raw} (${target.reason}) — not fetchable from a registry`);
 				continue;
 			}
-			tasks.push({
+			if (label === "dependencies" || label === "devDependencies") required.push(target.name);
+			const key = `${target.name}|${JSON.stringify(target.selector)}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			specs.push({
 				name: target.name,
 				selector: target.selector,
-				reason: {
-					_tag: "Edge",
-					from,
-					kind
-				},
-				tolerateFailure
+				raw: `${target.name}@${raw}`
 			});
 		}
 	};
-	add(manifest.dependencies, "prod", false);
-	if (options.scope.optional) add(manifest.optionalDependencies, "optional", true);
-	if (options.scope.peer) {
-		const meta = manifest.peerDependenciesMeta ?? {};
-		add(manifest.peerDependencies, "peer", false, (name) => meta[name]?.optional === true);
-	}
+	collect(parsed.dependencies, "dependencies");
+	collect(parsed.optionalDependencies, "optionalDependencies");
+	if (options.includeDev) collect(parsed.devDependencies, "devDependencies");
+	const meta = parsed.peerDependenciesMeta ?? {};
+	collect(parsed.peerDependencies, "peerDependencies", (name) => meta[name]?.optional === true);
+	if (specs.length === 0) throw new InvalidInputFileError(filePath, options.includeDev ? "package.json declares no dependencies to bundle" : "package.json declares no non-dev dependencies to bundle (drop --prod to include devDependencies)");
 	return {
-		tasks,
-		warnings
+		kind: InputFileKind.PackageJson,
+		specs,
+		warnings,
+		required
 	};
 };
-/** Edges for a package, computed once and cached. */
-const edgesFor = (state, manifest, options) => {
-	const key = packageKey(manifest.name, manifest.version);
-	const cached = state.edges.get(key);
-	if (cached !== void 0) return cached;
-	const { tasks, warnings } = edgesOf(manifest, options);
-	for (const warning of warnings) addWarning(state, warning);
-	state.edges.set(key, tasks);
-	return tasks;
-};
 /**
-* Resolves everything reachable from `seeds`, returning the closure.
+* Reads a package.json, or gives up on its contents rather than on the run.
 *
-* `state` is mutated with newly resolved packages and warnings; the returned
-* array is scoped to *this* walk, which is what makes per-root-version
-* closures possible.
+* Invalid JSON is an error worth raising — somebody pointed `--file` at a
+* broken file. A well-formed JSON document this schema cannot recognise is
+* not: it decodes to no blocks, and the caller reports "declares no
+* dependencies to bundle", which is both true and more useful.
 */
-const walk = (state, seeds, options) => Effect.gen(function* () {
-	const discovered = /* @__PURE__ */ new Set();
-	const attempted = /* @__PURE__ */ new Set();
-	let frontier = seeds;
-	while (frontier.length > 0) {
-		const wave = [];
-		for (const task of frontier) {
-			const id = `${task.name} ${formatSelector(task.selector)}`;
-			if (attempted.has(id)) continue;
-			attempted.add(id);
-			wave.push(task);
-		}
-		if (wave.length === 0) break;
-		const results = yield* Effect.forEach(wave, (task) => resolveTask(state, task, options), { concurrency: options.concurrency });
-		const next = [];
-		for (const result of results) {
-			if (result === null) continue;
-			for (const { manifest, reason } of result) {
-				const key = packageKey(manifest.name, manifest.version);
-				if (!state.resolved.has(key)) {
-					state.resolved.set(key, {
-						name: manifest.name,
-						version: manifest.version,
-						manifest,
-						reasons: [reason]
-					});
-					yield* emit({
-						_tag: "PackageResolved",
-						name: manifest.name,
-						version: manifest.version,
-						resolvedCount: state.resolved.size,
-						pendingCount: next.length
-					});
-					if (manifest.deprecated !== void 0 && manifest.deprecated !== "") addWarning(state, {
-						from: key,
-						message: `${key} is deprecated: ${manifest.deprecated}`
-					});
-				} else {
-					const existing = state.resolved.get(key);
-					if (!hasReason(existing.reasons, reason)) state.resolved.set(key, {
-						...existing,
-						reasons: [...existing.reasons, reason]
-					});
-				}
-				if (!discovered.has(key)) {
-					discovered.add(key);
-					next.push(...edgesFor(state, manifest, options));
-				}
-			}
-		}
-		frontier = next;
+const parsePackageJson = (filePath, content) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(content);
+	} catch (error) {
+		throw new InvalidInputFileError(filePath, `not valid JSON — ${describeError(error)}`, { cause: error });
 	}
-	return [...discovered];
-});
-const hasReason = (reasons, candidate) => reasons.some((reason) => {
-	if (reason._tag === "Root" && candidate._tag === "Root") return reason.spec === candidate.spec;
-	if (reason._tag === "Edge" && candidate._tag === "Edge") return reason.from === candidate.from && reason.kind === candidate.kind;
-	return false;
-});
+	return Option.getOrElse(decodePackageJson(parsed), () => ({}));
+};
+const fromList = (filePath, content) => {
+	const rawLines = content.split(/\r?\n/);
+	const lines = rawLines.flatMap((line) => {
+		const withoutComment = stripComment(line).trim();
+		return withoutComment.length === 0 ? [] : withoutComment;
+	});
+	if (lines.length === 0) throw new InvalidInputFileError(filePath, "no package specs found (only blank lines and comments)");
+	const { specs, errors } = parseSpecs(lines);
+	if (errors.length > 0) throw new InvalidInputFileError(filePath, formatSpecErrors(errors, rawLines));
+	return {
+		kind: InputFileKind.List,
+		specs,
+		warnings: []
+	};
+};
 /**
-* Resolves one task to its manifest(s).
+* Strips `#` and `//` comments.
 *
-* Returns `null` when an optional edge could not be resolved — the caller
-* treats that as "skip quietly", which is what npm does for
-* `optionalDependencies`.
+* `//` only counts when it is not part of a URL, so a future line containing
+* `https://…` does not get silently truncated.
 */
-const resolveTask = (state, task, options) => Effect.gen(function* () {
-	const packument = yield* getPackument(state, task.name);
-	const versions = yield* Effect.try({
-		try: () => selectVersions(packument, task.selector, {
-			all: false,
-			includePrerelease: options.includePrerelease
-		}),
-		catch: (error) => error
+const stripComment = (line) => {
+	const hash = line.indexOf("#");
+	const result = hash === -1 ? line : line.slice(0, hash);
+	const slashes = result.indexOf("//");
+	if (slashes === 0) return "";
+	if (slashes > 0 && result[slashes - 1] !== ":") return result.slice(0, slashes);
+	return result;
+};
+const formatSpecErrors = (errors, rawLines) => {
+	const details = errors.map((error) => {
+		const index = rawLines.findIndex((line) => stripComment(line).trim() === error.spec);
+		const where = index === -1 ? "" : ` (line ${index + 1})`;
+		return `    ${error.spec}${where}: ${error.reason}`;
 	});
-	const out = [];
-	for (const version of versions) {
-		const manifest = packument.versions[version];
-		if (manifest === void 0) continue;
-		if (task.reason._tag === "Edge" && task.reason.kind === "optional" && !isIncluded(manifest, options.scope.platforms)) continue;
-		out.push({
-			manifest,
-			reason: task.reason
-		});
-	}
-	return out;
-}).pipe(Effect.catch((error) => {
-	if (!task.tolerateFailure) return Effect.fail(error);
-	return Effect.sync(() => {
-		addWarning(state, { message: `Optional dependency ${task.name}@${formatSelector(task.selector)} could not be resolved and was skipped: ${error.message}` });
-		return null;
+	return `${errors.length} invalid spec(s):\n${details.join("\n")}`;
+};
+const describeError = (error) => error instanceof Error ? error.message : String(error);
+
+//#endregion
+//#region src/archive.ts
+/**
+* Packs `entries` (paths relative to `cwd`) into a gzipped tar at `outPath`.
+*
+* `portable` normalises uid/gid/mtime so the same inputs produce byte-identical
+* output — which matters when a security team wants to diff two bundles or
+* re-derive one from a manifest.
+*/
+const createArchive = (options) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	yield* emit({
+		_tag: "ArchiveStarted",
+		path: options.outPath,
+		entryCount: options.entries.length
 	});
-}));
+	yield* Effect.tryPromise({
+		try: () => create({
+			gzip: options.gzipLevel === void 0 ? true : { level: options.gzipLevel },
+			file: options.outPath,
+			cwd: options.cwd,
+			portable: true,
+			onWriteEntry: (entry) => {
+				entry.path = entry.path.replace(/^\.\//, "");
+			}
+		}, options.entries.toSorted().map(dotSlash)),
+		catch: (cause) => new ArchiveError(options.outPath, describe(cause), { cause })
+	});
+	const info = yield* fs.stat(options.outPath);
+	const bytes = Number(info.size);
+	yield* emit({
+		_tag: "ArchiveCompleted",
+		path: options.outPath,
+		bytes
+	});
+	return {
+		path: options.outPath,
+		bytes
+	};
+});
+/**
+* Guards every entry against tar's `@` convention.
+*
+* In a tar file list, a leading `@` means "splice in the entries of this other
+* archive" — a GNU convention `node-tar` implements by stripping the `@` and
+* looking for what is left. Every scoped package is a top-level entry starting
+* with `@`, so this hit the bundler in both possible ways:
+*
+* - `@oxc-project` became `oxc-project`, which does not exist, and the run died
+*   with an ENOENT naming a path that appears nowhere in the staging tree.
+* - `@esbuild` became `esbuild`, which *does* exist — the unscoped package of
+*   the same name sitting right next to it. No error, and every scoped tarball
+*   silently missing from a bundle that reported success. That is the dangerous
+*   one: you would not find out until the install failed behind the firewall.
+*
+* `./@scope` is not subject to the convention and resolves identically.
+*/
+const dotSlash = (entry) => entry.startsWith("./") ? entry : `./${entry}`;
+const describe = (cause) => cause instanceof Error ? cause.message : String(cause);
+
+//#endregion
+//#region src/download.ts
 /**
-* Resolves every requested spec.
+* Downloads every package into `destDir`, laid out the way a registry serves
+* them.
 *
-* Each selected root *version* is walked separately so `per-spec` layout has an
-* exact closure per tarball, while all walks share one cache, so a package
-* reached from twenty roots is fetched once.
+* `verifyIntegrity` defaulting to on is deliberate: a corrupt tarball that
+* makes it into a corporate registry is far more expensive than a failed run.
 */
-const resolve = (specs, options) => Effect.gen(function* () {
+const downloadAll = (packages, destDir, options) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const registry = yield* Registry;
 	yield* emit({
 		_tag: "PhaseStarted",
-		phase: "resolve",
-		total: specs.length
+		phase: Phase.Download,
+		total: packages.length
 	});
-	const state = makeWalkState();
-	const roots = [];
-	for (const spec of specs) {
-		const packument = yield* getPackument(state, spec.name);
-		const versions = yield* Effect.try({
-			try: () => selectVersions(packument, spec.selector, {
-				all: options.allVersions,
-				maxVersions: options.maxVersions,
-				includePrerelease: options.includePrerelease
-			}),
-			catch: (error) => error
+	let completed = 0;
+	const sizes = /* @__PURE__ */ new Map();
+	const unverified = [];
+	const results = yield* Effect.forEach(packages, (pkg) => Effect.gen(function* () {
+		const key = `${pkg.name}@${pkg.version}`;
+		yield* emit({
+			_tag: "DownloadStarted",
+			name: pkg.name,
+			version: pkg.version
 		});
-		const closures = /* @__PURE__ */ new Map();
-		const union = /* @__PURE__ */ new Set();
-		for (const version of versions) {
-			const closure = yield* walk(state, [{
-				name: spec.name,
-				selector: {
-					_tag: "Exact",
-					version
-				},
-				reason: {
-					_tag: "Root",
-					spec: formatSpec(spec)
-				},
-				tolerateFailure: false
-			}], options);
-			closures.set(version, closure);
-			for (const key of closure) union.add(key);
+		const bytes = yield* registry.download(pkg.manifest);
+		if (options.verifyIntegrity) {
+			const result = verify(bytes, pkg.manifest.dist);
+			if (result._tag === "Mismatch") return yield* Effect.fail(new IntegrityError(pkg.name, pkg.version, result.expected, result.actual));
+			if (result._tag === "Unverifiable") yield* emit({
+				_tag: "Warning",
+				message: `${key} could not be verified (${result.reason})`
+			});
 		}
-		roots.push({
-			spec,
-			versions,
-			closures,
-			closure: [...union]
+		const verifiable = (pkg.manifest.dist.integrity?.length ?? 0) > 0 || (pkg.manifest.dist.shasum?.length ?? 0) > 0;
+		const relative = packagePath(pkg.name, pkg.version);
+		const target = path.join(destDir, ...relative.split("/"));
+		yield* fs.makeDirectory(path.dirname(target), { recursive: true }).pipe(Effect.mapError((cause) => new OutputError(path.dirname(target), "could not create directory", { cause })));
+		yield* fs.writeFile(target, bytes).pipe(Effect.mapError((cause) => new OutputError(target, "could not write tarball", { cause })));
+		completed += 1;
+		yield* emit({
+			_tag: "DownloadCompleted",
+			name: pkg.name,
+			version: pkg.version,
+			bytes: bytes.byteLength,
+			completedCount: completed,
+			totalCount: packages.length
 		});
+		return {
+			key,
+			bytes: bytes.byteLength,
+			verifiable
+		};
+	}), { concurrency: options.concurrency });
+	for (const result of results) {
+		sizes.set(result.key, result.bytes);
+		if (!result.verifiable) unverified.push(result.key);
 	}
 	yield* emit({
 		_tag: "PhaseCompleted",
-		phase: "resolve"
+		phase: Phase.Download
 	});
 	return {
-		roots,
-		packages: [...state.resolved.values()].sort(compareResolved),
-		warnings: state.warnings
+		sizes,
+		unverified,
+		totalBytes: results.reduce((sum, result) => sum + result.bytes, 0)
 	};
 });
-const compareResolved = (a, b) => {
-	if (a.name !== b.name) return a.name < b.name ? -1 : 1;
-	return semver.valid(a.version) && semver.valid(b.version) ? semver.compare(a.version, b.version) : a.version.localeCompare(b.version);
-};
 
 //#endregion
-//#region src/Bundle.ts
-var Bundle_exports = /* @__PURE__ */ __export({
-	bundle: () => bundle,
-	bundleResolved: () => bundleResolved,
-	plan: () => plan,
-	plannedOutputs: () => plannedOutputs,
-	summarize: () => summarize,
-	withLayout: () => withLayout
-});
+//#region src/bundle.ts
 /** Computes the plan summary for a resolution. */
 const summarize = (resolution) => {
 	let perSpecArchives = 0;
@@ -1345,17 +2707,33 @@ const withLayout = (options, layout) => ({
 * expected.
 */
 const plan = (specs, options) => Effect.gen(function* () {
+	yield* preflight;
+	return yield* resolve(specs, options);
+});
+/**
+* The lockfile counterpart of `plan`.
+*
+* Same preflight, same `Resolution` out; the difference is entirely in how the
+* package set is arrived at. Kept as a separate entry point rather than an
+* option on `plan` because the two take genuinely different inputs — a set of
+* specs to satisfy versus a graph to reproduce — and blurring that is how a
+* "pinned" run quietly starts resolving ranges again.
+*/
+const planLocked = (lockfile, options) => Effect.gen(function* () {
+	yield* preflight;
+	return yield* resolveLocked(lockfile, options);
+});
+const preflight = Effect.gen(function* () {
 	const registry = yield* Registry;
 	yield* emit({
 		_tag: "PhaseStarted",
-		phase: "preflight"
+		phase: Phase.Preflight
 	});
 	yield* registry.preflight;
 	yield* emit({
 		_tag: "PhaseCompleted",
-		phase: "preflight"
+		phase: Phase.Preflight
 	});
-	return yield* resolve(specs, options);
 });
 /**
 * Resolves, downloads and packages a set of specs.
@@ -1367,6 +2745,10 @@ const plan = (specs, options) => Effect.gen(function* () {
 const bundle = (specs, options) => Effect.gen(function* () {
 	return yield* bundleResolved(yield* plan(specs, options), options);
 });
+/** `bundle`, pinned to a lockfile. */
+const bundleLocked = (lockfile, options) => Effect.gen(function* () {
+	return yield* bundleResolved(yield* planLocked(lockfile, options), options);
+});
 /**
 * Downloads and packages an already-computed resolution.
 *
@@ -1384,6 +2766,21 @@ const bundleResolved = (resolution, options) => Effect.gen(function* () {
 	};
 	return yield* Effect.scoped(runBundle(resolution, options));
 });
+/**
+* The files a run will write.
+*
+* Computed before anything is downloaded, so a collision is reported in the
+* first second rather than after a twenty-minute transfer.
+*/
+const plannedOutputs = (resolution, options) => {
+	if (options.layout === Layout.Dir) return [{ file: MANIFEST_FILE }, { file: README_FILE }];
+	if (options.layout === Layout.Single) return [{ file: singleArchiveName(options.archiveName ?? "bundle") }];
+	return resolution.roots.flatMap((root) => root.versions.map((version) => ({
+		file: perSpecArchiveName(root.spec.name, version),
+		name: root.spec.name,
+		version
+	})));
+};
 const runBundle = (resolution, options) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -1398,42 +2795,25 @@ const runBundle = (resolution, options) => Effect.gen(function* () {
 	});
 	yield* emit({
 		_tag: "PhaseStarted",
-		phase: "archive"
+		phase: Phase.Archive
 	});
-	const registryInfo = {
-		kind: registry.kind,
-		url: registry.registryFor(resolution.roots[0]?.spec.name ?? "")
-	};
-	const index = indexPackages(resolution);
-	const artifacts = options.layout === "single" ? yield* emitSingle({
-		resolution,
-		options,
-		staging,
-		packagesDir,
-		report,
-		registryInfo
-	}) : options.layout === "dir" ? yield* emitDirectory({
-		resolution,
-		options,
-		packagesDir,
-		report,
-		registryInfo
-	}) : yield* emitPerSpec({
+	const artifacts = yield* emit$1({
 		resolution,
 		options,
-		staging,
 		packagesDir,
 		report,
-		registryInfo,
-		index
-	});
+		registryInfo: {
+			kind: registry.kind,
+			url: registry.registryFor(resolution.roots[0]?.spec.name ?? "")
+		}
+	}, staging);
 	yield* emit({
 		_tag: "PhaseCompleted",
-		phase: "archive"
+		phase: Phase.Archive
 	});
 	yield* emit({
 		_tag: "PhaseStarted",
-		phase: "done"
+		phase: Phase.Done
 	});
 	return {
 		resolution,
@@ -1443,6 +2823,13 @@ const runBundle = (resolution, options) => Effect.gen(function* () {
 		dryRun: false
 	};
 });
+const emit$1 = (input, staging) => {
+	switch (input.options.layout) {
+		case Layout.Single: return emitSingle(input);
+		case Layout.Dir: return emitDirectory(input);
+		case Layout.PerSpec: return emitPerSpec(input, staging);
+	}
+};
 /** One tarball containing the deduplicated union of every closure. */
 const emitSingle = (input) => Effect.gen(function* () {
 	const path = yield* Path.Path;
@@ -1463,7 +2850,7 @@ const emitSingle = (input) => Effect.gen(function* () {
 		outPath
 	});
 	return [{
-		kind: "archive",
+		kind: ArtifactKind.Archive,
 		path: result.path,
 		bytes: result.bytes,
 		packageCount: input.resolution.packages.length
@@ -1483,7 +2870,7 @@ const emitDirectory = (input) => Effect.gen(function* () {
 	yield* fs.copy(input.packagesDir, input.options.outDir, { overwrite: true }).pipe(Effect.mapError((cause) => new OutputError(input.options.outDir, "could not write output tree", { cause })));
 	const bytes = [...input.report.sizes.values()].reduce((a, b) => a + b, 0);
 	return [{
-		kind: "directory",
+		kind: ArtifactKind.Directory,
 		path: input.options.outDir,
 		bytes,
 		packageCount: input.resolution.packages.length
@@ -1496,15 +2883,16 @@ const emitDirectory = (input) => Effect.gen(function* () {
 * `react-18.1.0.tgz` and so on, each independently importable — which is the
 * whole reason to prefer this layout.
 */
-const emitPerSpec = (input) => Effect.gen(function* () {
+const emitPerSpec = (input, staging) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
+	const index = indexPackages(input.resolution);
 	const artifacts = [];
 	let counter = 0;
 	for (const root of input.resolution.roots) for (const version of root.versions) {
 		if (input.options.skipExisting?.has(perSpecArchiveName(root.spec.name, version)) === true) continue;
-		const included = (root.closures.get(version) ?? []).map((key) => input.index.get(key)).filter((pkg) => pkg !== void 0);
-		const rootDir = path.join(input.staging, "roots", String(counter++));
+		const included = includedPackages(index, root.closures.get(version) ?? []);
+		const rootDir = path.join(staging, "roots", String(counter++));
 		yield* fs.makeDirectory(rootDir, { recursive: true });
 		for (const pkg of included) {
 			const parts = packagePath(pkg.name, pkg.version).split("/");
@@ -1534,7 +2922,7 @@ const emitPerSpec = (input) => Effect.gen(function* () {
 			outPath
 		});
 		artifacts.push({
-			kind: "archive",
+			kind: ArtifactKind.Archive,
 			path: result.path,
 			bytes: result.bytes,
 			packageCount: included.length,
@@ -1544,6 +2932,7 @@ const emitPerSpec = (input) => Effect.gen(function* () {
 	}
 	return artifacts;
 });
+const includedPackages = (index, closure) => closure.flatMap((key) => index.get(key) ?? []);
 /**
 * Hard-links a file, falling back to a copy.
 *
@@ -1578,17 +2967,8 @@ const writeBundleMetadata = (input) => Effect.gen(function* () {
 });
 /** Sorted top-level entries of a directory, used as the tar entry list. */
 const topLevelEntries = (dir) => Effect.gen(function* () {
-	return [...yield* (yield* FileSystem.FileSystem).readDirectory(dir)].sort();
+	return (yield* (yield* FileSystem.FileSystem).readDirectory(dir)).toSorted();
 });
-const plannedOutputs = (resolution, options) => {
-	if (options.layout === "dir") return [{ file: MANIFEST_FILE }, { file: README_FILE }];
-	if (options.layout === "single") return [{ file: singleArchiveName(options.archiveName ?? "bundle") }];
-	return resolution.roots.flatMap((root) => root.versions.map((version) => ({
-		file: perSpecArchiveName(root.spec.name, version),
-		name: root.spec.name,
-		version
-	})));
-};
 /**
 * Fails if the run would overwrite something, unless `--force`.
 *
@@ -1618,149 +2998,5 @@ const prepareOutputDir = (resolution, options) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region src/InputFile.ts
-var InputFile_exports = /* @__PURE__ */ __export({
-	defaultInputFileOptions: () => defaultInputFileOptions,
-	parseInputFile: () => parseInputFile,
-	readInputFile: () => readInputFile
-});
-const defaultInputFileOptions = { includeDev: true };
-/** Reads and parses an input file. */
-const readInputFile = (filePath, options = defaultInputFileOptions) => Effect.gen(function* () {
-	const fs = yield* FileSystem.FileSystem;
-	if (!(yield* fs.exists(filePath).pipe(Effect.mapError((cause) => new InvalidInputFileError(filePath, "could not be read", { cause }))))) return yield* Effect.fail(new InvalidInputFileError(filePath, "file does not exist"));
-	const content = yield* fs.readFileString(filePath).pipe(Effect.mapError((cause) => new InvalidInputFileError(filePath, "could not be read", { cause })));
-	return yield* Effect.try({
-		try: () => parseInputFile(filePath, content, options),
-		catch: (error) => error instanceof InvalidInputFileError ? error : new InvalidInputFileError(filePath, describe(error), { cause: error })
-	});
-});
-/**
-* Parses file content that has already been read.
-*
-* Split out from the IO so the whole of this logic is testable with plain
-* strings and no file system at all.
-*/
-const parseInputFile = (filePath, content, options = defaultInputFileOptions) => {
-	const trimmed = content.trim();
-	if (trimmed.length === 0) throw new InvalidInputFileError(filePath, "file is empty");
-	return looksLikeJson(trimmed) ? fromPackageJson(filePath, trimmed, options) : fromList(filePath, content);
-};
-const looksLikeJson = (trimmed) => trimmed.startsWith("{");
-const fromPackageJson = (filePath, content, options) => {
-	let parsed;
-	try {
-		parsed = JSON.parse(content);
-	} catch (error) {
-		throw new InvalidInputFileError(filePath, `not valid JSON — ${describe(error)}`, { cause: error });
-	}
-	const specs = [];
-	const warnings = [];
-	const seen = /* @__PURE__ */ new Set();
-	const collect = (entries, label, skip) => {
-		if (entries === void 0) return;
-		for (const [name, raw] of Object.entries(entries)) {
-			if (skip?.(name)) continue;
-			const target = parseDependencyTarget(name, raw);
-			if (target._tag === "Unsupported") {
-				warnings.push(`${label}: skipped ${name}@${target.raw} (${target.reason}) — not fetchable from a registry`);
-				continue;
-			}
-			const key = `${target.name}|${JSON.stringify(target.selector)}`;
-			if (seen.has(key)) continue;
-			seen.add(key);
-			specs.push({
-				name: target.name,
-				selector: target.selector,
-				raw: `${target.name}@${raw}`
-			});
-		}
-	};
-	collect(parsed.dependencies, "dependencies");
-	collect(parsed.optionalDependencies, "optionalDependencies");
-	if (options.includeDev) collect(parsed.devDependencies, "devDependencies");
-	const meta = parsed.peerDependenciesMeta ?? {};
-	collect(parsed.peerDependencies, "peerDependencies", (name) => meta[name]?.optional === true);
-	if (specs.length === 0) throw new InvalidInputFileError(filePath, options.includeDev ? "package.json declares no dependencies to bundle" : "package.json declares no non-dev dependencies to bundle (drop --prod to include devDependencies)");
-	return {
-		kind: "package.json",
-		specs,
-		warnings
-	};
-};
-const fromList = (filePath, content) => {
-	const lines = [];
-	const rawLines = content.split(/\r?\n/);
-	for (const line of rawLines) {
-		const withoutComment = stripComment(line).trim();
-		if (withoutComment.length === 0) continue;
-		lines.push(withoutComment);
-	}
-	if (lines.length === 0) throw new InvalidInputFileError(filePath, "no package specs found (only blank lines and comments)");
-	const { specs, errors } = parseSpecs(lines);
-	if (errors.length > 0) throw new InvalidInputFileError(filePath, formatSpecErrors(errors, rawLines));
-	return {
-		kind: "list",
-		specs,
-		warnings: []
-	};
-};
-/**
-* Strips `#` and `//` comments.
-*
-* `//` only counts when it is not part of a URL, so a future line containing
-* `https://…` does not get silently truncated.
-*/
-const stripComment = (line) => {
-	const hash = line.indexOf("#");
-	let result = hash === -1 ? line : line.slice(0, hash);
-	const slashes = result.indexOf("//");
-	if (slashes > 0 && result[slashes - 1] !== ":") result = result.slice(0, slashes);
-	else if (slashes === 0) result = "";
-	return result;
-};
-const formatSpecErrors = (errors, rawLines) => {
-	const details = errors.map((error) => {
-		const index = rawLines.findIndex((line) => stripComment(line).trim() === error.spec);
-		const where = index === -1 ? "" : ` (line ${index + 1})`;
-		return `    ${error.spec}${where}: ${error.reason}`;
-	});
-	return `${errors.length} invalid spec(s):\n${details.join("\n")}`;
-};
-const describe = (error) => error instanceof Error ? error.message : String(error);
-
-//#endregion
-//#region src/Options.ts
-var Options_exports = /* @__PURE__ */ __export({
-	defaultBundleOptions: () => defaultBundleOptions,
-	defaultResolveOptions: () => defaultResolveOptions,
-	defaultScope: () => defaultScope,
-	layouts: () => layouts
-});
-const layouts = [
-	"per-spec",
-	"single",
-	"dir"
-];
-const defaultScope = {
-	optional: true,
-	peer: true,
-	platforms: allPlatforms
-};
-const defaultResolveOptions = {
-	scope: defaultScope,
-	allVersions: false,
-	includePrerelease: false,
-	concurrency: 10
-};
-const defaultBundleOptions = {
-	...defaultResolveOptions,
-	layout: "per-spec",
-	dryRun: false,
-	verifyIntegrity: true,
-	force: false
-};
-
-//#endregion
-export { Archive_exports as Archive, ArchiveError, AuthenticationError, Bundle_exports as Bundle, DependencyRange_exports as DependencyRange, Download_exports as Download, InputFile_exports as InputFile, Integrity_exports as Integrity, IntegrityError, InvalidInputFileError, InvalidSpecError, Layout_exports as Layout, Manifest_exports as Manifest, NoMatchingVersionsError, Options_exports as Options, OutputError, PackageNotFoundError, Platform_exports as Platform, Progress_exports as Progress, Progress as ProgressTag, Registry, RegistryResponseError, RegistryUnreachableError, Resolve_exports as Resolve, Spec_exports as Spec, VersionNotFoundError, allPlatforms, bundle, bundleResolved, currentPlatform, defaultBundleOptions, defaultResolveOptions, defaultScope, layouts, parsePlatformTarget, parseSpec, parseSpecs, plan, plannedOutputs, platformTargets, resolve, summarize, withLayout };
+export { ArchiveError, ArtifactKind, AuthenticationError, DirectOnlyKind, EdgeKind, InputFileKind, IntegrityError, InvalidInputFileError, InvalidSpecError, Layout, Layouts, LockedRootKind, LockfileError, LockfileFormat, LockfileIncompleteError, LockfileOutOfDateError, MANIFEST_FILE, MANIFEST_VERSION, NoMatchingVersionsError, OptionalFlagRecordOrAbsentSchema, OptionalFlagRecordSchema, OptionalStringArraySchema, OptionalStringRecordSchema, OutputError, PackageNotFoundError, Phase, Progress, README_FILE, Registry, RegistryResponseError, RegistryUnreachableError, StringArraySchema, StringRecordSchema, VersionNotFoundError, allPlatforms, buildManifest, bundle, bundleLocked, bundleResolved, currentPlatform, dedupeSpecs, defaultBundleOptions, defaultInputFileOptions, defaultResolveOptions, defaultScope, detectLockfile, digestOf, emit as emitProgress, formatByLockfileName, formatPlatformFilter, formatSelector, formatSpec, hexDigestOf, importGuide, indexPackages, isIncluded, isRecord, layerCallback as layerCallbackProgress, layerSilent as layerSilentProgress, lockfileNamesFor, makeCollector as makeProgressCollector, packageKey, packagePath, parseDependencyTarget, parseInputFile, parseIntegrity, parseLockfile, parsePlatformTarget, parseSpec, parseSpecs, perSpecArchiveName, plan, planLocked, plannedOutputs, platformTargets, readInputFile, resolve, resolveLocked, selectVersions, serializeManifest, singleArchiveName, splitName, summarize, tarballFileName, tolerant, verify as verifyIntegrity, withLayout };
 //# sourceMappingURL=index.js.map