@packall/core 0.0.1 → 0.2.0

package/src/index.ts

@@ -4,41 +4,152 @@
  * Nothing in here knows about npm specifically. Point it at any implementation
  * of the `Registry` service and it will resolve, download, verify and package
  * a dependency closure.
+ *
+ * This is the package's whole public API. Everything not named here is an
+ * implementation detail, including modules that happen to be reachable.
  */
 
-export * as Archive from "./Archive.js"
-export * as Bundle from "./Bundle.js"
-export * as DependencyRange from "./DependencyRange.js"
-export * as Download from "./Download.js"
-export * as Integrity from "./Integrity.js"
-export * as InputFile from "./InputFile.js"
-export * as Layout from "./Layout.js"
-export * as Manifest from "./Manifest.js"
-export * as Options from "./Options.js"
-export * as Platform from "./Platform.js"
-export * as Progress from "./Progress.js"
-export * as Resolve from "./Resolve.js"
-export * as Spec from "./Spec.js"
-
-// Flat re-exports of the things a consumer reaches for constantly.
-export { bundle, bundleResolved, plan, plannedOutputs, summarize, withLayout } from "./Bundle.js"
-export type { BundleArtifact, BundleContext, BundleResult, PlanSummary } from "./Bundle.js"
-export { Registry } from "./Registry.js"
-export type { Packument, PackageDist, PackageManifest, RegistryService } from "./Registry.js"
-export { Progress as ProgressTag } from "./Progress.js"
-export type { ProgressEvent } from "./Progress.js"
-export { resolve } from "./Resolve.js"
-export type { Resolution, ResolvedPackage, RootResolution } from "./Resolve.js"
-export { parseSpec, parseSpecs } from "./Spec.js"
-export type { PackageSpec, Selector } from "./Spec.js"
-export type { BundleOptions, DependencyScope, Layout as LayoutKind, ResolveOptions } from "./Options.js"
+export type * from "./errors.js";
+export {
+	ArchiveError,
+	AuthenticationError,
+	IntegrityError,
+	InvalidInputFileError,
+	InvalidSpecError,
+	LockfileError,
+	LockfileIncompleteError,
+	LockfileOutOfDateError,
+	NoMatchingVersionsError,
+	OutputError,
+	PackageNotFoundError,
+	RegistryResponseError,
+	RegistryUnreachableError,
+	VersionNotFoundError,
+} from "./errors.js";
+
+export { ArtifactKind } from "./enums/artifact-kind.js";
+export { DirectOnlyKind, EdgeKind, LockedRootKind } from "./enums/edge-kind.js";
+export { InputFileKind } from "./enums/input-file-kind.js";
+export { Layout, Layouts } from "./enums/layout.js";
+export { LockfileFormat } from "./enums/lockfile-format.js";
+export { Phase } from "./enums/phase.js";
+
+export type { ValueOf } from "./types/value-of.js";
+export { isRecord } from "./utils/is-record.js";
+
+// The tolerant decoders every boundary that reads untrusted JSON is built from
+// — registry responses here, package.json and lockfiles inside the engine.
+export {
+	OptionalFlagRecordOrAbsentSchema,
+	OptionalFlagRecordSchema,
+	OptionalStringArraySchema,
+	OptionalStringRecordSchema,
+	StringArraySchema,
+	StringRecordSchema,
+	tolerant,
+} from "./schemas/lenient.js";
+
+export type { PackageSpec, Selector } from "./spec.js";
+export { dedupeSpecs, formatSelector, formatSpec, parseSpec, parseSpecs } from "./spec.js";
+
+export type { DependencyTarget } from "./dependency-range.js";
+export { parseDependencyTarget } from "./dependency-range.js";
+
+export type { PlatformConstraints, PlatformFilter, PlatformTarget } from "./platform.js";
+export {
+	allPlatforms,
+	currentPlatform,
+	formatPlatformFilter,
+	isIncluded,
+	parsePlatformTarget,
+	platformTargets,
+} from "./platform.js";
+
+export type { BundleOptions, DependencyScope, ResolveOptions } from "./options.js";
+export { defaultBundleOptions, defaultResolveOptions, defaultScope } from "./options.js";
+
+export type { Packument, PackageDist, PackageManifest } from "./registry.js";
+// `Registry.Service` and `Progress.Service` travel with their class through
+// declaration merging, so the one name carries the tag and its shape.
+export { Registry } from "./registry.js";
+
+export type { ProgressEvent } from "./progress.js";
+// Aliased: `emit` and `layerSilent` say what they do inside `progress.ts`, and
+// nothing at all on a package's public surface.
+export {
+	emit as emitProgress,
+	layerCallback as layerCallbackProgress,
+	layerSilent as layerSilentProgress,
+	makeCollector as makeProgressCollector,
+	Progress,
+} from "./progress.js";
+
+export type { IntegrityAlgorithm, IntegrityHash, VerificationResult } from "./integrity.js";
+export { digestOf, hexDigestOf, parseIntegrity, verify as verifyIntegrity } from "./integrity.js";
+
+// The packing backend. The Node implementation is deliberately *not* re-exported
+// here — it lives behind `@packall/core/node`, because it pulls in `node-tar` and
+// reaching it has to be an explicit act so importing the engine stays safe in a
+// browser.
+export type { ArchiveResult, CreateArchiveOptions } from "./archive.js";
+export { Archiver, createArchive } from "./archive.js";
+
+export {
+	importGuide,
+	MANIFEST_FILE,
+	packagePath,
+	perSpecArchiveName,
+	README_FILE,
+	singleArchiveName,
+	splitName,
+	tarballFileName,
+} from "./layout.js";
+
+export type { BundleManifest, ManifestEntry } from "./manifest.js";
+export { buildManifest, MANIFEST_VERSION, serializeManifest } from "./manifest.js";
+
+export type {
+	PackageKey,
+	Reason,
+	Resolution,
+	ResolutionWarning,
+	ResolvedPackage,
+	RootResolution,
+} from "./resolve.js";
+export { indexPackages, packageKey, resolve, selectVersions } from "./resolve.js";
+
+export type { LockedResolveOptions } from "./locked-resolve.js";
+export { resolveLocked } from "./locked-resolve.js";
+
+export type { LockfileDetection } from "./lockfile/detect.js";
+export { detectLockfile } from "./lockfile/detect.js";
+export type {
+	LockedEdge,
+	LockedPackage,
+	LockedRoot,
+	LockedTree,
+	LockfileParseOptions,
+} from "./lockfile/types.js";
+export { formatByLockfileName, lockfileNamesFor } from "./lockfile/names.js";
+export { parseLockfile } from "./lockfile/parse.js";
+
+export type { InputFileOptions, InputFileResult } from "./input-file.js";
+export { defaultInputFileOptions, parseInputFile, readInputFile } from "./input-file.js";
+
+export type {
+	BundleArtifact,
+	BundleContext,
+	BundleResult,
+	PlannedOutput,
+	PlanSummary,
+} from "./bundle.js";
 export {
-  defaultBundleOptions,
-  defaultResolveOptions,
-  defaultScope,
-  layouts
-} from "./Options.js"
-export type { PlatformFilter, PlatformTarget } from "./Platform.js"
-export { allPlatforms, currentPlatform, parsePlatformTarget, platformTargets } from "./Platform.js"
-
-export * from "./Errors.js"
+	bundle,
+	bundleLocked,
+	bundleResolved,
+	plan,
+	planLocked,
+	plannedOutputs,
+	summarize,
+	withLayout,
+} from "./bundle.js";

package/src/input-file.ts

@@ -0,0 +1,324 @@
+/**
+ * `--file` handling.
+ *
+ * One flag, three accepted shapes, detected from the content rather than the
+ * extension so that `--file deps.json` and `--file my-packages` both do the
+ * obvious thing:
+ *
+ * - a **package.json** — bundle everything it depends on
+ * - a **lockfile** — npm, pnpm or bun; bundle the exact versions it pins
+ * - a **newline-delimited list** — one spec per line, `#` and `//` comments
+ *   allowed, blank lines ignored
+ *
+ * A lockfile is checked for first, because `package-lock.json` and
+ * `package.json` are both JSON objects and only the content tells them apart.
+ */
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
+
+import { parseDependencyTarget } from "./dependency-range.js";
+import { InputFileKind } from "./enums/input-file-kind.js";
+import type { LockfileFormat } from "./enums/lockfile-format.js";
+import type { InvalidSpecError, LockfileError } from "./errors.js";
+import { InvalidInputFileError } from "./errors.js";
+import { detectLockfile } from "./lockfile/detect.js";
+import { parseLockfile } from "./lockfile/parse.js";
+import type { LockedTree } from "./lockfile/types.js";
+import type { PackageJson } from "./schemas/package-json.js";
+import { decodePackageJson } from "./schemas/package-json.js";
+import type { PackageSpec } from "./spec.js";
+import { parseSpecs } from "./spec.js";
+
+export type InputFileResult = {
+	readonly kind: InputFileKind;
+	readonly specs: ReadonlyArray<PackageSpec>;
+	/** Entries that were recognised but cannot be bundled from a registry. */
+	readonly warnings: ReadonlyArray<string>;
+	/**
+	 * The pinned graph, set only for a lockfile.
+	 *
+	 * `specs` carries the same roots for display, but a lockfile run must resolve
+	 * from this — see `locked-resolve` for why re-resolving the roots' ranges
+	 * would quietly produce a different bundle.
+	 */
+	readonly lockfile?: LockedTree | undefined;
+	/**
+	 * Names from the blocks a package.json always installs — `dependencies` and,
+	 * unless `--prod`, `devDependencies`.
+	 *
+	 * Used to check a lockfile against the manifest beside it. Deliberately
+	 * excludes optional and peer entries: both are legitimately absent from a
+	 * lockfile (an optional dependency that failed to build, a peer the consumer
+	 * is expected to supply), so including them would turn a useful staleness
+	 * check into a false alarm.
+	 */
+	readonly required?: ReadonlyArray<string> | undefined;
+};
+
+/** Which dependency blocks of a package.json become root specs. */
+export type InputFileOptions = {
+	/**
+	 * Include `devDependencies`.
+	 *
+	 * On by default: if you are pointing this tool at a package.json, you are
+	 * almost certainly trying to make that project installable behind the
+	 * firewall, and a project without its dev tooling does not build. `--prod`
+	 * turns it off.
+	 */
+	readonly includeDev: boolean;
+	/**
+	 * For a lockfile, which workspace member's dependencies are the roots.
+	 *
+	 * Set when a package.json found its lockfile by walking up: the file then
+	 * covers the whole repository, and only one member of it was asked for.
+	 */
+	readonly importer?: string | undefined;
+};
+
+export const defaultInputFileOptions: InputFileOptions = { includeDev: true };
+
+/** Reads and parses an input file. */
+export const readInputFile = (
+	filePath: string,
+	options: InputFileOptions = defaultInputFileOptions,
+): Effect.Effect<InputFileResult, InvalidInputFileError | LockfileError, FileSystem.FileSystem> =>
+	Effect.gen(function* () {
+		const fs = yield* FileSystem.FileSystem;
+
+		const exists = yield* fs
+			.exists(filePath)
+			.pipe(
+				Effect.mapError(
+					(cause) => new InvalidInputFileError(filePath, "could not be read", { cause }),
+				),
+			);
+		if (!exists) {
+			return yield* Effect.fail(new InvalidInputFileError(filePath, "file does not exist"));
+		}
+
+		const content = yield* fs
+			.readFileString(filePath)
+			.pipe(
+				Effect.mapError(
+					(cause) => new InvalidInputFileError(filePath, "could not be read", { cause }),
+				),
+			);
+
+		return yield* Effect.try({
+			try: () => parseInputFile(filePath, content, options),
+			catch: (error) =>
+				// A LockfileError already names the file and says what is wrong with
+				// it; wrapping it would only stutter.
+				error instanceof InvalidInputFileError || isLockfileError(error)
+					? error
+					: new InvalidInputFileError(filePath, describeError(error), { cause: error }),
+		});
+	});
+
+const isLockfileError = (error: unknown): error is LockfileError =>
+	error instanceof Error && "_tag" in error && error._tag === "LockfileError";
+
+/**
+ * Parses file content that has already been read.
+ *
+ * Split out from the IO so the whole of this logic is testable with plain
+ * strings and no file system at all.
+ */
+export const parseInputFile = (
+	filePath: string,
+	content: string,
+	options: InputFileOptions = defaultInputFileOptions,
+): InputFileResult => {
+	const trimmed = content.trim();
+	if (trimmed.length === 0) {
+		throw new InvalidInputFileError(filePath, "file is empty");
+	}
+
+	// Checked first: a package-lock.json is also a JSON object whose top level
+	// looks a lot like a package.json, and reading one as the other would produce
+	// a bundle with none of the pinning that was asked for.
+	const detected = detectLockfile(trimmed);
+	if (detected._tag === "Unsupported") {
+		throw new InvalidInputFileError(filePath, `${detected.label} — ${detected.hint}`);
+	}
+	if (detected._tag === "Supported") {
+		return fromLockfile(filePath, content, detected.format, options);
+	}
+
+	return looksLikeJson(trimmed)
+		? fromPackageJson(filePath, trimmed, options)
+		: fromList(filePath, content);
+};
+
+const looksLikeJson = (trimmed: string): boolean => trimmed.startsWith("{");
+
+/* -------------------------------------------------------------------------- */
+/* Lockfile                                                                   */
+/* -------------------------------------------------------------------------- */
+
+const fromLockfile = (
+	filePath: string,
+	content: string,
+	format: LockfileFormat,
+	options: InputFileOptions,
+): InputFileResult => {
+	const lockfile = parseLockfile(filePath, content, format, { importer: options.importer });
+
+	// The same devDependency rule as a package.json, applied to the pinned roots
+	// so that `specs` shows exactly what the run will bundle.
+	const roots = lockfile.roots.filter((root) => options.includeDev || root.kind !== "dev");
+
+	return {
+		kind: InputFileKind.Lockfile,
+		specs: roots.map((root) => ({
+			name: root.name,
+			selector: { _tag: "Exact", version: root.version },
+			raw: `${root.name}@${root.version}`,
+		})),
+		warnings: lockfile.warnings,
+		lockfile,
+	};
+};
+
+/* -------------------------------------------------------------------------- */
+/* package.json                                                               */
+/* -------------------------------------------------------------------------- */
+
+const fromPackageJson = (
+	filePath: string,
+	content: string,
+	options: InputFileOptions,
+): InputFileResult => {
+	const parsed = parsePackageJson(filePath, content);
+
+	const specs: Array<PackageSpec> = [];
+	const warnings: Array<string> = [];
+	const required: Array<string> = [];
+	const seen = new Set<string>();
+
+	const collect = (
+		entries: Record<string, string> | undefined,
+		label: string,
+		skip?: (name: string) => boolean,
+	): void => {
+		if (entries === undefined) return;
+		for (const [name, raw] of Object.entries(entries)) {
+			if (skip?.(name)) continue;
+			const target = parseDependencyTarget(name, raw);
+			if (target._tag === "Unsupported") {
+				warnings.push(
+					`${label}: skipped ${name}@${target.raw} (${target.reason}) — not fetchable from a registry`,
+				);
+				continue;
+			}
+			// `target.name` rather than the key, so an `npm:` alias is recorded under
+			// the name a lockfile would actually pin it as.
+			if (label === "dependencies" || label === "devDependencies") required.push(target.name);
+			const key = `${target.name}|${JSON.stringify(target.selector)}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			specs.push({
+				name: target.name,
+				selector: target.selector,
+				raw: `${target.name}@${raw}`,
+			});
+		}
+	};
+
+	collect(parsed.dependencies, "dependencies");
+	collect(parsed.optionalDependencies, "optionalDependencies");
+	if (options.includeDev) {
+		collect(parsed.devDependencies, "devDependencies");
+	}
+	const meta = parsed.peerDependenciesMeta ?? {};
+	collect(parsed.peerDependencies, "peerDependencies", (name) => meta[name]?.optional === true);
+
+	if (specs.length === 0) {
+		throw new InvalidInputFileError(
+			filePath,
+			options.includeDev
+				? "package.json declares no dependencies to bundle"
+				: "package.json declares no non-dev dependencies to bundle (drop --prod to include devDependencies)",
+		);
+	}
+
+	return { kind: InputFileKind.PackageJson, specs, warnings, required };
+};
+
+/**
+ * Reads a package.json, or gives up on its contents rather than on the run.
+ *
+ * Invalid JSON is an error worth raising — somebody pointed `--file` at a
+ * broken file. A well-formed JSON document this schema cannot recognise is
+ * not: it decodes to no blocks, and the caller reports "declares no
+ * dependencies to bundle", which is both true and more useful.
+ */
+const parsePackageJson = (filePath: string, content: string): PackageJson => {
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(content);
+	} catch (error) {
+		throw new InvalidInputFileError(filePath, `not valid JSON — ${describeError(error)}`, {
+			cause: error,
+		});
+	}
+
+	return Option.getOrElse(decodePackageJson(parsed), (): PackageJson => ({}));
+};
+
+/* -------------------------------------------------------------------------- */
+/* Spec list                                                                  */
+/* -------------------------------------------------------------------------- */
+
+const fromList = (filePath: string, content: string): InputFileResult => {
+	const rawLines = content.split(/\r?\n/);
+	const lines = rawLines.flatMap((line) => {
+		const withoutComment = stripComment(line).trim();
+		return withoutComment.length === 0 ? [] : withoutComment;
+	});
+
+	if (lines.length === 0) {
+		throw new InvalidInputFileError(
+			filePath,
+			"no package specs found (only blank lines and comments)",
+		);
+	}
+
+	const { specs, errors } = parseSpecs(lines);
+	if (errors.length > 0) {
+		throw new InvalidInputFileError(filePath, formatSpecErrors(errors, rawLines));
+	}
+
+	return { kind: InputFileKind.List, specs, warnings: [] };
+};
+
+/**
+ * Strips `#` and `//` comments.
+ *
+ * `//` only counts when it is not part of a URL, so a future line containing
+ * `https://…` does not get silently truncated.
+ */
+const stripComment = (line: string): string => {
+	const hash = line.indexOf("#");
+	const result = hash === -1 ? line : line.slice(0, hash);
+	const slashes = result.indexOf("//");
+	if (slashes === 0) return "";
+	if (slashes > 0 && result[slashes - 1] !== ":") return result.slice(0, slashes);
+	return result;
+};
+
+const formatSpecErrors = (
+	errors: ReadonlyArray<InvalidSpecError>,
+	rawLines: ReadonlyArray<string>,
+): string => {
+	const details = errors.map((error) => {
+		const index = rawLines.findIndex((line) => stripComment(line).trim() === error.spec);
+		const where = index === -1 ? "" : ` (line ${index + 1})`;
+		return `    ${error.spec}${where}: ${error.reason}`;
+	});
+	return `${errors.length} invalid spec(s):\n${details.join("\n")}`;
+};
+
+const describeError = (error: unknown): string =>
+	error instanceof Error ? error.message : String(error);

package/src/integrity.ts

@@ -0,0 +1,165 @@
+/**
+ * Checksum verification for downloaded tarballs.
+ *
+ * A failed check discards the download rather than warning and carrying on —
+ * see `notes/requirements.md` § FR-9 for why that strictness is a requirement
+ * rather than a preference.
+ *
+ * Built on Effect's `Crypto` service rather than `node:crypto` directly. The
+ * four digests `Crypto` offers — SHA-1, SHA-256, SHA-384, SHA-512 — are exactly
+ * the four npm publishes, so nothing is given up, and the same verification
+ * then runs unchanged against WebCrypto in a browser. Parsing stays here
+ * because the subset of Subresource Integrity npm actually emits is small and
+ * entirely mechanical; `ssri` would be a dependency for a regex.
+ */
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import * as Encoding from "effect/Encoding";
+import type { PlatformError } from "effect/PlatformError";
+
+/**
+ * The digests npm publishes, mapped to what `Crypto.digest` calls them.
+ *
+ * Doubles as the supported-algorithm list: an SRI token whose algorithm is not
+ * a key here is one we cannot check, and is dropped during parsing.
+ */
+const digestAlgorithmByName = {
+	sha512: "SHA-512",
+	sha384: "SHA-384",
+	sha256: "SHA-256",
+	sha1: "SHA-1",
+} as const satisfies Record<string, Crypto.DigestAlgorithm>;
+
+/** An algorithm this module can verify against. */
+export type IntegrityAlgorithm = keyof typeof digestAlgorithmByName;
+
+const isSupported = (algorithm: string): algorithm is IntegrityAlgorithm =>
+	Object.hasOwn(digestAlgorithmByName, algorithm);
+
+/** One parsed SRI hash. */
+export type IntegrityHash = {
+	readonly algorithm: IntegrityAlgorithm;
+	/** Base64 digest, exactly as written in the SRI string. */
+	readonly digest: string;
+};
+
+/**
+ * Parses an SRI string such as `sha512-abc...==`.
+ *
+ * npm permits several space-separated hashes; we keep every one we can verify
+ * and ignore algorithms we cannot.
+ */
+export const parseIntegrity = (integrity: string): ReadonlyArray<IntegrityHash> => {
+	const hashes: Array<IntegrityHash> = [];
+	for (const token of integrity.trim().split(/\s+/)) {
+		if (token.length === 0) continue;
+		const dash = token.indexOf("-");
+		if (dash <= 0) continue;
+		const algorithm = token.slice(0, dash).toLowerCase();
+		const digest = token.slice(dash + 1);
+		if (!isSupported(algorithm) || digest.length === 0) continue;
+		hashes.push({ algorithm, digest });
+	}
+	return hashes;
+};
+
+const digestBytes = (
+	data: Uint8Array,
+	algorithm: IntegrityAlgorithm,
+): Effect.Effect<Uint8Array, PlatformError, Crypto.Crypto> =>
+	Effect.gen(function* () {
+		const crypto = yield* Crypto.Crypto;
+		return yield* crypto.digest(digestAlgorithmByName[algorithm], data);
+	});
+
+/** Computes the base64 digest of some bytes under one algorithm. */
+export const digestOf = (
+	data: Uint8Array,
+	algorithm: IntegrityAlgorithm,
+): Effect.Effect<string, PlatformError, Crypto.Crypto> =>
+	Effect.map(digestBytes(data, algorithm), Encoding.encodeBase64);
+
+/** Computes the hex digest of some bytes — the form legacy `shasum` uses. */
+export const hexDigestOf = (
+	data: Uint8Array,
+	algorithm: IntegrityAlgorithm,
+): Effect.Effect<string, PlatformError, Crypto.Crypto> =>
+	Effect.map(digestBytes(data, algorithm), Encoding.encodeHex);
+
+/** Result of checking a download. */
+export type VerificationResult =
+	/** Verified against at least one checksum. */
+	| { readonly _tag: "Verified"; readonly using: string }
+	/** The registry advertised no checksum we could use. */
+	| { readonly _tag: "Unverifiable"; readonly reason: string }
+	/** A checksum was present and did not match. */
+	| { readonly _tag: "Mismatch"; readonly expected: string; readonly actual: string };
+
+/**
+ * Constant-time comparison of two digest strings.
+ *
+ * Written by hand rather than with `node:crypto`'s `timingSafeEqual`, which
+ * needs `Buffer` and would pin this module to Node. Both digests here are
+ * public knowledge, so the timing property is close to theatre — but it costs
+ * four lines, and the alternative is explaining in a review why it was dropped.
+ */
+const digestsEqual = (a: string, b: string): boolean => {
+	if (a.length !== b.length) return false;
+	let difference = 0;
+	for (let index = 0; index < a.length; index++) {
+		difference |= a.charCodeAt(index) ^ b.charCodeAt(index);
+	}
+	return difference === 0;
+};
+
+/**
+ * Checks bytes against whichever checksums the registry supplied.
+ *
+ * SRI is preferred; `shasum` is the fallback for versions published before
+ * integrity strings existed. If the registry gave us neither, that is reported
+ * as `Unverifiable` rather than silently treated as a pass — the caller decides
+ * whether to tolerate it.
+ */
+export const verify = (
+	data: Uint8Array,
+	dist: { readonly integrity?: string | undefined; readonly shasum?: string | undefined },
+): Effect.Effect<VerificationResult, PlatformError, Crypto.Crypto> =>
+	Effect.gen(function* () {
+		if (dist.integrity !== undefined && dist.integrity.length > 0) {
+			// Strongest first, so a mismatch is reported against the best hash present.
+			const [best] = parseIntegrity(dist.integrity).toSorted(
+				(a, b) => strengthByAlgorithm[b.algorithm] - strengthByAlgorithm[a.algorithm],
+			);
+			if (best === undefined) {
+				return {
+					_tag: "Unverifiable",
+					reason: `no supported algorithm in "${dist.integrity}"`,
+				};
+			}
+
+			const actual = yield* digestOf(data, best.algorithm);
+			return digestsEqual(actual, best.digest)
+				? { _tag: "Verified", using: best.algorithm }
+				: {
+						_tag: "Mismatch",
+						expected: `${best.algorithm}-${best.digest}`,
+						actual: `${best.algorithm}-${actual}`,
+					};
+		}
+
+		if (dist.shasum !== undefined && dist.shasum.length > 0) {
+			const actual = yield* hexDigestOf(data, "sha1");
+			return digestsEqual(actual.toLowerCase(), dist.shasum.toLowerCase())
+				? { _tag: "Verified", using: "sha1" }
+				: { _tag: "Mismatch", expected: `sha1-${dist.shasum}`, actual: `sha1-${actual}` };
+		}
+
+		return { _tag: "Unverifiable", reason: "registry advertised no integrity or shasum" };
+	});
+
+const strengthByAlgorithm = {
+	sha512: 4,
+	sha384: 3,
+	sha256: 2,
+	sha1: 1,
+} as const satisfies Record<IntegrityAlgorithm, number>;