@packall/core 0.0.1 → 0.2.0

package/dist/index.js

@@ -1,585 +1,396 @@
+import { _ as OutputError, a as layerCallback, b as RegistryUnreachableError, c as ArchiveError, d as InvalidInputFileError, f as InvalidSpecError, g as NoMatchingVersionsError, h as LockfileOutOfDateError, i as emit, l as AuthenticationError, m as LockfileIncompleteError, n as createArchive, o as layerSilent, p as LockfileError, r as Progress, s as makeCollector, t as Archiver, u as IntegrityError, v as PackageNotFoundError, x as VersionNotFoundError, y as RegistryResponseError } from "./archive-6sqTn1C4.js";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
-import { create } from "tar";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import * as Getter from "effect/SchemaGetter";
+import semver from "semver";
 import * as Context from "effect/Context";
-import * as Layer from "effect/Layer";
-import * as Ref from "effect/Ref";
+import * as Crypto from "effect/Crypto";
+import * as Encoding from "effect/Encoding";
+import { parse } from "yaml";
+import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
-import { createHash, timingSafeEqual } from "node:crypto";
-import semver from "semver";
 
-//#region rolldown:runtime
-var __defProp = Object.defineProperty;
-var __export = (all) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	return target;
+//#region src/enums/artifact-kind.ts
+/** What a bundle run wrote to the output directory. */
+const ArtifactKind = {
+	Archive: "archive",
+	Directory: "directory"
 };
 
 //#endregion
-//#region src/Errors.ts
-var BundlerErrorBase = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = new.target.name;
-	}
-};
-/** A package spec on the command line or in an input file could not be parsed. */
-var InvalidSpecError = class extends BundlerErrorBase {
-	_tag = "InvalidSpecError";
-	spec;
-	reason;
-	constructor(spec, reason) {
-		super(`Invalid package spec ${JSON.stringify(spec)}: ${reason}`);
-		this.spec = spec;
-		this.reason = reason;
-	}
-};
-/** `--file` pointed at something that is neither a usable package.json nor a spec list. */
-var InvalidInputFileError = class extends BundlerErrorBase {
-	_tag = "InvalidInputFileError";
-	path;
-	reason;
-	constructor(path, reason, options) {
-		super(`Cannot read specs from ${path}: ${reason}`, options);
-		this.path = path;
-		this.reason = reason;
-	}
-};
+//#region src/enums/edge-kind.ts
 /**
-* The registry could not be reached at all — DNS failure, refused connection,
-* proxy blackhole, or a preflight that timed out.
+* Why one package depends on another.
 *
-* This is the error that fixes "hangs forever with no network": we surface it
-* quickly and say which host we could not reach.
+* `EdgeKind` and `LockedRootKind` are one concept in two parts, which is why
+* they share a file: `Dev` exists only at the top level, because lockfiles
+* record dev dependencies for the project alone — a transitive devDependency is
+* never installed, so it is never locked.
 */
-var RegistryUnreachableError = class extends BundlerErrorBase {
-	_tag = "RegistryUnreachableError";
-	registry;
-	timeoutMillis;
-	constructor(registry, detail, options) {
-		super(`Cannot reach registry ${registry}: ${detail}.\n  Check your network connection, VPN, and the proxy settings in your .npmrc.`, options);
-		this.registry = registry;
-		this.timeoutMillis = options?.timeoutMillis;
-	}
-};
-/** The registry answered, but has never heard of this package. */
-var PackageNotFoundError = class extends BundlerErrorBase {
-	_tag = "PackageNotFoundError";
-	packageName;
-	registry;
-	constructor(packageName, registry) {
-		super(`Package "${packageName}" was not found on ${registry}`);
-		this.packageName = packageName;
-		this.registry = registry;
-	}
-};
-/** The package exists but the exact version requested does not. */
-var VersionNotFoundError = class extends BundlerErrorBase {
-	_tag = "VersionNotFoundError";
-	packageName;
-	version;
-	available;
-	constructor(packageName, version, available) {
-		const tail = available.slice(-5).join(", ");
-		super(`${packageName}@${version} does not exist.` + (tail.length > 0 ? ` Most recent published versions: ${tail}` : ""));
-		this.packageName = packageName;
-		this.version = version;
-		this.available = available;
-	}
+const EdgeKind = {
+	Prod: "prod",
+	Optional: "optional",
+	Peer: "peer"
 };
-/** A range (or dist-tag) matched nothing that is actually published. */
-var NoMatchingVersionsError = class extends BundlerErrorBase {
-	_tag = "NoMatchingVersionsError";
-	packageName;
-	selector;
-	available;
-	constructor(packageName, selector, available) {
-		const tail = available.slice(-5).join(", ");
-		super(`No published version of ${packageName} satisfies "${selector}".` + (tail.length > 0 ? ` Most recent published versions: ${tail}` : ""));
-		this.packageName = packageName;
-		this.selector = selector;
-		this.available = available;
-	}
-};
-/** The registry responded, but with something we cannot use. */
-var RegistryResponseError = class extends BundlerErrorBase {
-	_tag = "RegistryResponseError";
-	url;
-	status;
-	constructor(url, detail, options) {
-		super(`Unexpected response from ${url}: ${detail}`, options);
-		this.url = url;
-		this.status = options?.status;
-	}
-};
-/** 401/403 — almost always a missing or stale token in `.npmrc`. */
-var AuthenticationError = class extends BundlerErrorBase {
-	_tag = "AuthenticationError";
-	registry;
-	status;
-	constructor(registry, status, packageName) {
-		super(`Registry ${registry} rejected the request with HTTP ${status}` + (packageName ? ` while fetching "${packageName}"` : "") + `.\n  Add credentials to your .npmrc, e.g.\n    //${safeHost(registry)}/:_authToken=\${NPM_TOKEN}`);
-		this.registry = registry;
-		this.status = status;
-	}
+/** The kind that only a direct dependency of the locked project can have. */
+const DirectOnlyKind = { Dev: "dev" };
+/** Why a direct dependency of the locked project is a root. */
+const LockedRootKind = {
+	...EdgeKind,
+	...DirectOnlyKind
 };
-/**
-* A downloaded tarball did not match the checksum the registry advertised.
-*
-* Never soft-fail this: a bundle is a supply-chain artifact and a corrupt or
-* substituted tarball is exactly what integrity checking exists to catch.
-*/
-var IntegrityError = class extends BundlerErrorBase {
-	_tag = "IntegrityError";
-	packageName;
-	version;
-	expected;
-	actual;
-	constructor(packageName, version, expected, actual) {
-		super(`Integrity check failed for ${packageName}@${version}.\n  expected: ${expected}\n  actual:   ${actual}\n  The download was discarded. This is either corruption in transit or a tampered artifact.`);
-		this.packageName = packageName;
-		this.version = version;
-		this.expected = expected;
-		this.actual = actual;
-	}
+
+//#endregion
+//#region src/enums/input-file-kind.ts
+/** Which of the three shapes a `--file` input turned out to be. */
+const InputFileKind = {
+	PackageJson: "package.json",
+	Lockfile: "lockfile",
+	List: "list"
 };
-/** Something went wrong writing the `.tgz`. */
-var ArchiveError = class extends BundlerErrorBase {
-	_tag = "ArchiveError";
-	path;
-	constructor(path, detail, options) {
-		super(`Failed to create archive ${path}: ${detail}`, options);
-		this.path = path;
-	}
+
+//#endregion
+//#region src/enums/layout.ts
+/** How the resulting tarball(s) are shaped. */
+const Layout = {
+	PerSpec: "per-spec",
+	Single: "single",
+	Dir: "dir"
 };
-/** Something went wrong preparing or writing to the output directory. */
-var OutputError = class extends BundlerErrorBase {
-	_tag = "OutputError";
-	path;
-	constructor(path, detail, options) {
-		super(`Output error at ${path}: ${detail}`, options);
-		this.path = path;
-	}
+const Layouts = Object.values(Layout);
+
+//#endregion
+//#region src/enums/lockfile-format.ts
+/** Which package manager wrote a lockfile. */
+const LockfileFormat = {
+	Npm: "npm",
+	Pnpm: "pnpm",
+	Bun: "bun"
 };
-const safeHost = (registry) => {
-	try {
-		const url = new URL(registry);
-		return url.host + url.pathname.replace(/\/+$/, "");
-	} catch {
-		return registry;
-	}
+
+//#endregion
+//#region src/enums/phase.ts
+/** The phases a bundle run moves through, in order. */
+const Phase = {
+	Preflight: "preflight",
+	Resolve: "resolve",
+	Download: "download",
+	Archive: "archive",
+	Done: "done"
 };
 
 //#endregion
-//#region src/Progress.ts
-var Progress_exports = /* @__PURE__ */ __export({
-	Progress: () => Progress,
-	emit: () => emit,
-	layerCallback: () => layerCallback,
-	layerSilent: () => layerSilent,
-	makeCollector: () => makeCollector
-});
-/** Service tag for progress reporting. */
-var Progress = class extends Context.Service()("@packall/core/Progress") {};
-/** Emits an event to whichever reporter is installed. */
-const emit = (event) => Effect.gen(function* () {
-	yield* (yield* Progress).emit(event);
-});
+//#region src/utils/is-record.ts
 /**
-* Discards every event.
+* Narrows an unknown value to a plain object.
 *
-* The default for library consumers and for tests that do not care about
-* progress — silence should never require ceremony.
+* The entry point for reading anything the tool does not control — lockfiles,
+* package.json files, registry responses — without reaching for a cast.
 */
-const layerSilent = Layer.succeed(Progress)({ emit: () => Effect.void });
-/** Sends every event to a callback. Used by the CLI renderer. */
-const layerCallback = (onEvent) => Layer.succeed(Progress)({ emit: (event) => Effect.sync(() => onEvent(event)) });
-/**
-* Accumulates every event into a `Ref`, for assertions.
-*
-* Returned as `[layer, ref]` so a test can provide the layer and then read the
-* transcript afterwards.
-*/
-const makeCollector = Effect.gen(function* () {
-	const ref = yield* Ref.make([]);
-	return {
-		layer: Layer.succeed(Progress)({ emit: (event) => Ref.update(ref, (events) => [...events, event]) }),
-		events: Ref.get(ref)
-	};
-});
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 
 //#endregion
-//#region src/Archive.ts
-var Archive_exports = /* @__PURE__ */ __export({ createArchive: () => createArchive });
+//#region src/schemas/lenient.ts
 /**
-* Packs `entries` (paths relative to `cwd`) into a gzipped tar at `outPath`.
+* An optional field that goes *absent* rather than failing when it is
+* malformed.
 *
-* `portable` normalises uid/gid/mtime so the same inputs produce byte-identical
-* output — which matters when a security team wants to diff two bundles or
-* re-derive one from a manifest.
+* This is the difference between "we do not understand this field" and "we do
+* not understand this document". An `os: "linux"` where an array was expected
+* costs the platform filter one signal; it should not cost the run the package.
 */
-const createArchive = (options) => Effect.gen(function* () {
-	const fs = yield* FileSystem.FileSystem;
-	yield* emit({
-		_tag: "ArchiveStarted",
-		path: options.outPath,
-		entryCount: options.entries.length
-	});
-	yield* Effect.tryPromise({
-		try: () => create({
-			gzip: options.gzipLevel === void 0 ? true : { level: options.gzipLevel },
-			file: options.outPath,
-			cwd: options.cwd,
-			portable: true,
-			onWriteEntry: (entry) => {
-				entry.path = entry.path.replace(/^\.\//, "");
-			}
-		}, [...options.entries].sort().map(dotSlash)),
-		catch: (cause) => new ArchiveError(options.outPath, describe$1(cause), { cause })
-	});
-	const info = yield* fs.stat(options.outPath);
-	const bytes = Number(info.size);
-	yield* emit({
-		_tag: "ArchiveCompleted",
-		path: options.outPath,
-		bytes
-	});
-	return {
-		path: options.outPath,
-		bytes
-	};
-});
+const tolerant = (schema) => Schema.optional(Schema.UndefinedOr(schema).pipe(Schema.catchDecoding(() => Effect.succeed(Option.some(void 0)))));
 /**
-* Guards every entry against tar's `@` convention.
+* Keeps only the string-valued members of an untyped object.
 *
-* In a tar file list, a leading `@` means "splice in the entries of this other
-* archive" — a GNU convention `node-tar` implements by stripping the `@` and
-* looking for what is left. Every scoped package is a top-level entry starting
-* with `@`, so this hit the bundler in both possible ways:
-*
-* - `@oxc-project` became `oxc-project`, which does not exist, and the run died
-*   with an ENOENT naming a path that appears nowhere in the staging tree.
-* - `@esbuild` became `esbuild`, which *does* exist — the unscoped package of
-*   the same name sitting right next to it. No error, and every scoped tarball
-*   silently missing from a bundle that reported success. That is the dangerous
-*   one: you would not find out until the install failed behind the firewall.
+* `{ "lodash": "^4.0.0", "broken": 3 }` decodes to `{ "lodash": "^4.0.0" }`.
+* Per-entry rather than whole-record tolerance, because one unreadable edge in
+* a dependency block is no reason to forget the others.
+*/
+const StringRecordSchema = Schema.Record(Schema.String, Schema.Unknown).pipe(Schema.decodeTo(Schema.Record(Schema.String, Schema.String), {
+	decode: Getter.transform((raw) => {
+		const out = {};
+		for (const [key, value] of Object.entries(raw)) if (typeof value === "string") out[key] = value;
+		return out;
+	}),
+	encode: Getter.passthroughSubtype()
+}));
+/** The same per-entry tolerance for a list: `["linux", 7]` decodes to `["linux"]`. */
+const StringArraySchema = Schema.Array(Schema.Unknown).pipe(Schema.decodeTo(Schema.Array(Schema.String), {
+	decode: Getter.transform((raw) => raw.flatMap((entry) => typeof entry === "string" ? entry : [])),
+	encode: Getter.passthroughSubtype()
+}));
+/**
+* `peerDependenciesMeta`, normalised.
 *
-* `./@scope` is not subject to the convention and resolves identically.
+* Only `optional` is read, and only its `true` is meaningful — npm writes the
+* flag as a boolean, a hand-edited file may carry anything, and every other
+* value means "not optional".
 */
-const dotSlash = (entry) => entry.startsWith("./") ? entry : `./${entry}`;
-const describe$1 = (cause) => cause instanceof Error ? cause.message : String(cause);
+const OptionalFlagRecordSchema = Schema.Record(Schema.String, Schema.Unknown).pipe(Schema.decodeTo(Schema.Record(Schema.String, Schema.Struct({ optional: Schema.Boolean })), {
+	decode: Getter.transform((raw) => {
+		const out = {};
+		for (const [key, value] of Object.entries(raw)) if (isRecord(value)) out[key] = { optional: value["optional"] === true };
+		return out;
+	}),
+	encode: Getter.passthroughSubtype()
+}));
+const absentWhenEmpty = (value) => Object.keys(value).length > 0 ? value : void 0;
+const OptionalStringRecordSchema = StringRecordSchema.pipe(Schema.decodeTo(Schema.UndefinedOr(Schema.Record(Schema.String, Schema.String)), {
+	decode: Getter.transform(absentWhenEmpty),
+	encode: Getter.transform((value) => value ?? {})
+}));
+const OptionalStringArraySchema = StringArraySchema.pipe(Schema.decodeTo(Schema.UndefinedOr(Schema.Array(Schema.String)), {
+	decode: Getter.transform((value) => value.length > 0 ? value : void 0),
+	encode: Getter.transform((value) => value ?? [])
+}));
+const OptionalFlagRecordOrAbsentSchema = OptionalFlagRecordSchema.pipe(Schema.decodeTo(Schema.UndefinedOr(Schema.Record(Schema.String, Schema.Struct({ optional: Schema.Boolean }))), {
+	decode: Getter.transform(absentWhenEmpty),
+	encode: Getter.transform((value) => value ?? {})
+}));
 
 //#endregion
-//#region src/Integrity.ts
-var Integrity_exports = /* @__PURE__ */ __export({
-	digestOf: () => digestOf,
-	hexDigestOf: () => hexDigestOf,
-	parseIntegrity: () => parseIntegrity,
-	verify: () => verify
-});
-const SUPPORTED = new Set([
-	"sha512",
-	"sha384",
-	"sha256",
-	"sha1"
-]);
+//#region src/spec.ts
+const MAX_NAME_LENGTH = 214;
+const SEGMENT_RE = /^[a-z0-9\-._~]+$/;
+const DIST_TAG_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+/** Renders a spec back into the canonical `name@selector` form. */
+const formatSpec = (spec) => `${spec.name}@${formatSelector(spec.selector)}`;
+/** Human-readable form of just the selector part. */
+const formatSelector = (selector) => {
+	switch (selector._tag) {
+		case "Exact": return selector.version;
+		case "Range": return selector.range;
+		case "Tag": return selector.tag;
+	}
+};
 /**
-* Parses an SRI string such as `sha512-abc...==`.
-*
-* npm permits several space-separated hashes; we keep every one we can verify
-* and ignore algorithms Node does not implement.
+* Validates an npm package name against the rules the registry actually
+* enforces. Returns `null` when valid, or the reason it is not.
 */
-const parseIntegrity = (integrity) => {
-	const hashes = [];
-	for (const token of integrity.trim().split(/\s+/)) {
-		if (token.length === 0) continue;
-		const dash = token.indexOf("-");
-		if (dash <= 0) continue;
-		const algorithm = token.slice(0, dash).toLowerCase();
-		const digest = token.slice(dash + 1);
-		if (!SUPPORTED.has(algorithm) || digest.length === 0) continue;
-		hashes.push({
-			algorithm,
-			digest
-		});
+const validatePackageName = (name) => {
+	if (name.length === 0) return "name is empty";
+	if (name.length > MAX_NAME_LENGTH) return `name is longer than ${MAX_NAME_LENGTH} characters`;
+	if (name.trim() !== name) return "name has leading or trailing whitespace";
+	if (name.startsWith(".")) return "name cannot start with a period";
+	if (name.startsWith("_")) return "name cannot start with an underscore";
+	if (name !== name.toLowerCase()) return "name cannot contain capital letters";
+	if (name.startsWith("@")) {
+		const slash = name.indexOf("/");
+		if (slash === -1) return "scoped name is missing the '/name' part";
+		const scope = name.slice(1, slash);
+		const rest = name.slice(slash + 1);
+		if (scope.length === 0) return "scope is empty";
+		if (rest.length === 0) return "name after the scope is empty";
+		if (rest.includes("/")) return "name contains more than one '/'";
+		if (!SEGMENT_RE.test(scope)) return `scope "${scope}" contains illegal characters`;
+		if (!SEGMENT_RE.test(rest)) return `name "${rest}" contains illegal characters`;
+		return null;
 	}
-	return hashes;
-};
-/** Computes the base64 digest of some bytes under one algorithm. */
-const digestOf = (data, algorithm) => createHash(algorithm).update(data).digest("base64");
-/** Computes the hex digest of some bytes — the form legacy `shasum` uses. */
-const hexDigestOf = (data, algorithm) => createHash(algorithm).update(data).digest("hex");
-/** Constant-time comparison of two digest strings of equal length. */
-const digestsEqual = (a, b) => {
-	const left = Buffer.from(a);
-	const right = Buffer.from(b);
-	return left.length === right.length && timingSafeEqual(left, right);
+	if (name.includes("/")) return "unscoped name cannot contain '/'";
+	if (!SEGMENT_RE.test(name)) return "name contains illegal characters";
+	return null;
 };
 /**
-* Checks bytes against whichever checksums the registry supplied.
+* Parses a single spec string.
 *
-* SRI is preferred; `shasum` is the fallback for versions published before
-* integrity strings existed. If the registry gave us neither, that is reported
-* as `Unverifiable` rather than silently treated as a pass — the caller decides
-* whether to tolerate it.
+* Splitting on `@` is the fiddly part: a scoped name *starts* with `@`, so we
+* look for the last `@` that is not at index 0.
 */
-const verify = (data, dist) => {
-	if (dist.integrity !== void 0 && dist.integrity.length > 0) {
-		const hashes = parseIntegrity(dist.integrity);
-		if (hashes.length === 0) return {
-			_tag: "Unverifiable",
-			reason: `no supported algorithm in "${dist.integrity}"`
-		};
-		const best = [...hashes].sort((a, b) => strength(b.algorithm) - strength(a.algorithm))[0];
-		const actual = digestOf(data, best.algorithm);
-		return digestsEqual(actual, best.digest) ? {
-			_tag: "Verified",
-			using: best.algorithm
-		} : {
-			_tag: "Mismatch",
-			expected: `${best.algorithm}-${best.digest}`,
-			actual: `${best.algorithm}-${actual}`
-		};
-	}
-	if (dist.shasum !== void 0 && dist.shasum.length > 0) {
-		const actual = hexDigestOf(data, "sha1");
-		return digestsEqual(actual.toLowerCase(), dist.shasum.toLowerCase()) ? {
-			_tag: "Verified",
-			using: "sha1"
-		} : {
-			_tag: "Mismatch",
-			expected: `sha1-${dist.shasum}`,
-			actual: `sha1-${actual}`
-		};
-	}
+const parseSpec = (raw) => {
+	const input = raw.trim();
+	if (input.length === 0) throw new InvalidSpecError(raw, "spec is empty");
+	const at = input.lastIndexOf("@");
+	const hasSelector = at > 0;
+	const name = hasSelector ? input.slice(0, at) : input;
+	const selectorText = hasSelector ? input.slice(at + 1) : "";
+	const nameProblem = validatePackageName(name);
+	if (nameProblem !== null) throw new InvalidSpecError(raw, nameProblem);
+	if (!hasSelector || selectorText.length === 0) return {
+		name,
+		selector: {
+			_tag: "Tag",
+			tag: "latest"
+		},
+		raw: input
+	};
 	return {
-		_tag: "Unverifiable",
-		reason: "registry advertised no integrity or shasum"
+		name,
+		selector: parseSelector(raw, selectorText),
+		raw: input
 	};
 };
-const strength = (algorithm) => {
-	switch (algorithm) {
-		case "sha512": return 4;
-		case "sha384": return 3;
-		case "sha256": return 2;
-		default: return 1;
-	}
-};
-
-//#endregion
-//#region src/Layout.ts
-var Layout_exports = /* @__PURE__ */ __export({
-	MANIFEST_FILE: () => MANIFEST_FILE,
-	README_FILE: () => README_FILE,
-	importGuide: () => importGuide,
-	packagePath: () => packagePath,
-	perSpecArchiveName: () => perSpecArchiveName,
-	singleArchiveName: () => singleArchiveName,
-	splitName: () => splitName,
-	tarballFileName: () => tarballFileName
-});
-/**
-* The on-disk shape of a bundle.
-*
-* Everything is laid out exactly the way a registry serves it:
-*
-*     lodash/-/lodash-4.17.21.tgz
-*     @babel/core/-/core-7.24.0.tgz
-*
-* That is not an Artifactory convention — it is the path structure in every
-* `dist.tarball` URL npm publishes, which is why the same tree imports into
-* Artifactory, Nexus and Verdaccio without translation. Note that a scoped
-* package's file name drops the scope: `@babel/core` becomes `core-7.24.0.tgz`
-* under an `@babel/core/-/` directory.
-*/
-/** Splits `@scope/name` into its parts. `scope` is undefined when unscoped. */
-const splitName = (name) => {
-	if (!name.startsWith("@")) return {
-		scope: void 0,
-		bare: name
+/** Classifies the part after the `@` as an exact version, a range, or a dist-tag. */
+const parseSelector = (raw, text) => {
+	const exact = semver.valid(text, { loose: false });
+	if (exact !== null) return {
+		_tag: "Exact",
+		version: exact
 	};
-	const slash = name.indexOf("/");
-	if (slash === -1) return {
-		scope: void 0,
-		bare: name
+	if (semver.validRange(text, { loose: false }) !== null) return {
+		_tag: "Range",
+		range: text
 	};
+	if (!DIST_TAG_RE.test(text)) throw new InvalidSpecError(raw, `"${text}" is not a valid version, semver range, or dist-tag`);
 	return {
-		scope: name.slice(0, slash),
-		bare: name.slice(slash + 1)
+		_tag: "Tag",
+		tag: text
 	};
 };
-/** `@babel/core` + `7.24.0` -> `core-7.24.0.tgz` */
-const tarballFileName = (name, version) => {
-	const { bare } = splitName(name);
-	return `${bare}-${version}.tgz`;
-};
-/**
-* The path of one package tarball within a bundle, using `/` separators
-* regardless of host platform — these become tar entry names, and tar entries
-* are always POSIX.
-*/
-const packagePath = (name, version) => `${name}/-/${tarballFileName(name, version)}`;
-/** File name of the manifest that ships inside every bundle. */
-const MANIFEST_FILE = "bundle-manifest.json";
-/** File name of the short import guide that ships inside every bundle. */
-const README_FILE = "IMPORT.md";
 /**
-* Name of the archive produced for one root spec in `per-spec` layout.
-*
-* Scoped names are flattened (`@babel/core` -> `babel-core`) because a `/` in a
-* file name is not a thing, and `@` confuses enough shells and web UIs to be
-* worth avoiding.
+* Parses many specs, collecting *every* failure rather than stopping at the
+* first. Somebody bundling forty packages should be told about all four typos
+* in one go, not made to re-run four times.
 */
-const perSpecArchiveName = (name, version) => {
-	const { scope, bare } = splitName(name);
-	return `${scope === void 0 ? bare : `${scope.slice(1)}-${bare}`}-${version}.tgz`;
+const parseSpecs = (inputs) => {
+	const specs = [];
+	const errors = [];
+	for (const input of inputs) try {
+		specs.push(parseSpec(input));
+	} catch (error) {
+		if (error instanceof InvalidSpecError) errors.push(error);
+		else throw error;
+	}
+	return {
+		specs,
+		errors
+	};
 };
-/** Name of the archive produced in `single` layout. */
-const singleArchiveName = (base = "bundle") => `${base}.tgz`;
 /**
-* The import guide written into each bundle.
+* Collapses duplicate specs, keeping the first occurrence.
 *
-* Kept short and copy-pasteable on purpose: whoever opens this is mid-task on a
-* restricted network and does not want prose.
+* `npmb react react@latest` is a plausible thing to type and should not
+* download React twice.
 */
-const importGuide = (options) => `# Importing this bundle
-
-${options.packageCount} package tarball(s), laid out exactly as an npm registry serves them:
-
-    <package-name>/-/<file>.tgz
-    @<scope>/<name>/-/<file>.tgz
-
-Created ${options.createdAt} by packall ${options.toolVersion}.
-See ${MANIFEST_FILE} for the full list with checksums.
-
-## JFrog Artifactory
-
-Unpack, then upload the tree into a **local npm** repository. The layout already
-matches what Artifactory expects, so no path rewriting is needed:
-
-    tar -xzf <this-bundle>.tgz -C ./bundle
-    jf rt upload "bundle/(**)" "<npm-local-repo>/{1}" --flat=false
-
-## Verdaccio / Nexus / any npm registry
-
-Publish each tarball individually:
-
-    find ./bundle -name '*.tgz' -exec npm publish --registry <url> {} \\;
-
-## Verifying before import
-
-    node -e "const m=require('./bundle/${MANIFEST_FILE}');console.log(m.packages.length+' packages')"
-
-Every entry in ${MANIFEST_FILE} carries the integrity string the source registry
-advertised, and each tarball was checked against it at download time.
-`;
+const dedupeSpecs = (specs) => {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const spec of specs) {
+		const key = formatSpec(spec);
+		if (seen.has(key)) continue;
+		seen.add(key);
+		out.push(spec);
+	}
+	return out;
+};
 
 //#endregion
-//#region src/Registry.ts
+//#region src/dependency-range.ts
+const UNSUPPORTED_PROTOCOLS = [
+	["file:", "local file path"],
+	["link:", "local link"],
+	["workspace:", "workspace protocol"],
+	["portal:", "portal protocol"],
+	["patch:", "patch protocol"],
+	["git:", "git dependency"],
+	["git+", "git dependency"],
+	["github:", "GitHub shorthand"],
+	["gitlab:", "GitLab shorthand"],
+	["bitbucket:", "Bitbucket shorthand"],
+	["http:", "remote tarball URL"],
+	["https:", "remote tarball URL"]
+];
 /**
-* Service tag for the registry backend.
-*
-* @example
-* ```ts
-* import { Effect } from "effect"
-* import { Registry } from "@packall/core"
+* Classifies one `name -> range` entry.
 *
-* const program = Effect.gen(function*() {
-*   const registry = yield* Registry
-*   return yield* registry.packument("lodash")
-* })
-* ```
+* An empty range, `*`, and `latest` all mean "any published version"; npm
+* treats them interchangeably and so do we.
 */
-var Registry = class extends Context.Service()("@packall/core/Registry") {};
-
-//#endregion
-//#region src/Download.ts
-var Download_exports = /* @__PURE__ */ __export({ downloadAll: () => downloadAll });
+const parseDependencyTarget = (name, raw) => {
+	const text = raw.trim();
+	if (text.length === 0 || text === "*" || text === "x" || text === "latest") return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Range",
+			range: "*"
+		}
+	};
+	if (text.startsWith("npm:")) return parseAlias(name, text);
+	for (const [prefix, reason] of UNSUPPORTED_PROTOCOLS) if (text.startsWith(prefix)) return {
+		_tag: "Unsupported",
+		name,
+		raw: text,
+		reason
+	};
+	if (semver.validRange(text, { loose: true }) === null && /^[\w.-]+\/[\w.-]+/.test(text)) return {
+		_tag: "Unsupported",
+		name,
+		raw: text,
+		reason: "git shorthand"
+	};
+	const exact = semver.valid(text, { loose: true });
+	if (exact !== null) return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Exact",
+			version: exact
+		}
+	};
+	if (semver.validRange(text, { loose: true }) !== null) return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Range",
+			range: text
+		}
+	};
+	if (/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(text)) return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Tag",
+			tag: text
+		}
+	};
+	return {
+		_tag: "Unsupported",
+		name,
+		raw: text,
+		reason: "unrecognised version specifier"
+	};
+};
 /**
-* Downloads every package into `destDir`, laid out the way a registry serves
-* them.
+* Parses `npm:<name>[@<range>]`.
 *
-* `verifyIntegrity` defaulting to on is deliberate: a corrupt tarball that
-* makes it into a corporate registry is far more expensive than a failed run.
+* The nested name may itself be scoped, so the `@` split has the same
+* "not at index 0" caveat as top-level spec parsing.
 */
-const downloadAll = (packages, destDir, options) => Effect.gen(function* () {
-	const fs = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
-	const registry = yield* Registry;
-	yield* emit({
-		_tag: "PhaseStarted",
-		phase: "download",
-		total: packages.length
-	});
-	let completed = 0;
-	const sizes = /* @__PURE__ */ new Map();
-	const unverified = [];
-	const results = yield* Effect.forEach(packages, (pkg) => Effect.gen(function* () {
-		const key = `${pkg.name}@${pkg.version}`;
-		yield* emit({
-			_tag: "DownloadStarted",
-			name: pkg.name,
-			version: pkg.version
-		});
-		const bytes = yield* registry.download(pkg.manifest);
-		if (options.verifyIntegrity) {
-			const result = verify(bytes, pkg.manifest.dist);
-			if (result._tag === "Mismatch") return yield* Effect.fail(new IntegrityError(pkg.name, pkg.version, result.expected, result.actual));
-			if (result._tag === "Unverifiable") yield* emit({
-				_tag: "Warning",
-				message: `${key} could not be verified (${result.reason})`
-			});
-		}
-		const verifiable = (pkg.manifest.dist.integrity?.length ?? 0) > 0 || (pkg.manifest.dist.shasum?.length ?? 0) > 0;
-		const relative = packagePath(pkg.name, pkg.version);
-		const target = path.join(destDir, ...relative.split("/"));
-		yield* fs.makeDirectory(path.dirname(target), { recursive: true }).pipe(Effect.mapError((cause) => new OutputError(path.dirname(target), "could not create directory", { cause })));
-		yield* fs.writeFile(target, bytes).pipe(Effect.mapError((cause) => new OutputError(target, "could not write tarball", { cause })));
-		completed += 1;
-		yield* emit({
-			_tag: "DownloadCompleted",
-			name: pkg.name,
-			version: pkg.version,
-			bytes: bytes.byteLength,
-			completedCount: completed,
-			totalCount: packages.length
-		});
-		return {
-			key,
-			bytes: bytes.byteLength,
-			verifiable
-		};
-	}), { concurrency: options.concurrency });
-	for (const result of results) {
-		sizes.set(result.key, result.bytes);
-		if (!result.verifiable) unverified.push(result.key);
-	}
-	yield* emit({
-		_tag: "PhaseCompleted",
-		phase: "download"
-	});
+const parseAlias = (key, text) => {
+	const body = text.slice(4);
+	if (body.length === 0) return {
+		_tag: "Unsupported",
+		name: key,
+		raw: text,
+		reason: "empty npm: alias"
+	};
+	const at = body.lastIndexOf("@");
+	const target = at > 0 ? body.slice(0, at) : body;
+	const rangeText = at > 0 ? body.slice(at + 1) : "";
+	if (target.length === 0) return {
+		_tag: "Unsupported",
+		name: key,
+		raw: text,
+		reason: "empty npm: alias target"
+	};
+	const inner = parseDependencyTarget(target, rangeText);
+	if (inner._tag === "Unsupported") return {
+		...inner,
+		name: key,
+		raw: text
+	};
 	return {
-		sizes,
-		unverified,
-		totalBytes: results.reduce((sum, r) => sum + r.bytes, 0)
+		_tag: "Registry",
+		name: target,
+		selector: inner.selector,
+		aliasOf: key
 	};
-});
+};
 
 //#endregion
-//#region src/Platform.ts
-var Platform_exports = /* @__PURE__ */ __export({
-	allPlatforms: () => allPlatforms,
-	currentPlatform: () => currentPlatform,
-	formatPlatformFilter: () => formatPlatformFilter,
-	isIncluded: () => isIncluded,
-	matchesTarget: () => matchesTarget,
-	parsePlatformTarget: () => parsePlatformTarget,
-	platformTargets: () => platformTargets
-});
+//#region src/platform.ts
 const allPlatforms = { _tag: "All" };
 const platformTargets = (targets) => ({
 	_tag: "Targets",
@@ -598,7 +409,7 @@ const currentPlatform = () => ({
 * and installs nothing. `--platform windows` silently matching no binding at
 * all would be precisely that, so it is corrected rather than accepted.
 */
-const OS_ALIASES = {
+const osByAlias = {
 	win: "win32",
 	windows: "win32",
 	mac: "darwin",
@@ -632,27 +443,24 @@ const LIBC = new Set(["musl", "glibc"]);
 * once alongside the list of accepted forms.
 */
 const parsePlatformTarget = (input) => {
-	const parts = input.trim().toLowerCase().split("-").filter((p) => p.length > 0);
-	if (parts.length === 0 || parts.length > 3) return null;
-	const rawOs = parts[0];
-	const os = OS_ALIASES[rawOs] ?? rawOs;
+	const parts = input.trim().toLowerCase().split("-").filter((part) => part.length > 0);
+	const [rawOs, second, third] = parts;
+	if (rawOs === void 0 || parts.length > 3) return null;
+	const os = osByAlias[rawOs] ?? rawOs;
 	if (!KNOWN_OS.has(os)) return null;
-	if (parts.length === 1) return { os };
-	if (parts.length === 2 && LIBC.has(parts[1])) return {
+	if (second === void 0) return { os };
+	if (third === void 0) return LIBC.has(second) ? {
 		os,
-		libc: parts[1]
-	};
-	const cpu = parts[1];
-	if (parts.length === 2) return {
+		libc: second
+	} : {
 		os,
-		cpu
+		cpu: second
 	};
-	const libc = parts[2];
-	if (!LIBC.has(libc)) return null;
+	if (!LIBC.has(third)) return null;
 	return {
 		os,
-		cpu,
-		libc
+		cpu: second,
+		libc: third
 	};
 };
 /**
@@ -698,168 +506,299 @@ const isIncluded = (constraints, filter) => {
 /** Renders a filter for the manifest and for `--dry-run` output. */
 const formatPlatformFilter = (filter) => {
 	if (filter._tag === "All") return "all";
-	return filter.targets.map((t) => [
-		t.os,
-		t.cpu,
-		t.libc
+	return filter.targets.map((target) => [
+		target.os,
+		target.cpu,
+		target.libc
 	].filter((part) => part !== void 0).join("-")).join(",");
 };
 
 //#endregion
-//#region src/Spec.ts
-var Spec_exports = /* @__PURE__ */ __export({
-	dedupeSpecs: () => dedupeSpecs,
-	formatSelector: () => formatSelector,
-	formatSpec: () => formatSpec,
-	parseSelector: () => parseSelector,
-	parseSpec: () => parseSpec,
-	parseSpecs: () => parseSpecs,
-	validatePackageName: () => validatePackageName
-});
-/** Renders a spec back into the canonical `name@selector` form. */
-const formatSpec = (spec) => {
-	switch (spec.selector._tag) {
-		case "Exact": return `${spec.name}@${spec.selector.version}`;
-		case "Range": return `${spec.name}@${spec.selector.range}`;
-		case "Tag": return `${spec.name}@${spec.selector.tag}`;
-	}
+//#region src/options.ts
+const defaultScope = {
+	optional: true,
+	peer: true,
+	platforms: allPlatforms
 };
-/** Human-readable form of just the selector part. */
-const formatSelector = (selector) => {
-	switch (selector._tag) {
-		case "Exact": return selector.version;
-		case "Range": return selector.range;
-		case "Tag": return selector.tag;
-	}
+const defaultResolveOptions = {
+	scope: defaultScope,
+	allVersions: false,
+	includePrerelease: false,
+	concurrency: 10
 };
-const MAX_NAME_LENGTH = 214;
+const defaultBundleOptions = {
+	...defaultResolveOptions,
+	layout: Layout.PerSpec,
+	dryRun: false,
+	verifyIntegrity: true,
+	force: false
+};
+
+//#endregion
+//#region src/registry.ts
 /**
-* Validates an npm package name against the rules the registry actually
-* enforces. Returns `null` when valid, or the reason it is not.
-*/
-const validatePackageName = (name) => {
-	if (name.length === 0) return "name is empty";
-	if (name.length > MAX_NAME_LENGTH) return `name is longer than ${MAX_NAME_LENGTH} characters`;
-	if (name.trim() !== name) return "name has leading or trailing whitespace";
-	if (name.startsWith(".")) return "name cannot start with a period";
-	if (name.startsWith("_")) return "name cannot start with an underscore";
-	if (name !== name.toLowerCase()) return "name cannot contain capital letters";
-	if (name.startsWith("@")) {
-		const slash = name.indexOf("/");
-		if (slash === -1) return "scoped name is missing the '/name' part";
-		const scope = name.slice(1, slash);
-		const rest = name.slice(slash + 1);
-		if (scope.length === 0) return "scope is empty";
-		if (rest.length === 0) return "name after the scope is empty";
-		if (rest.includes("/")) return "name contains more than one '/'";
-		if (!SEGMENT_RE.test(scope)) return `scope "${scope}" contains illegal characters`;
-		if (!SEGMENT_RE.test(rest)) return `name "${rest}" contains illegal characters`;
-		return null;
+* Service tag for the registry backend.
+*
+* @example
+* ```ts
+* import { Effect } from "effect"
+* import { Registry } from "@packall/core"
+*
+* const program = Effect.gen(function*() {
+*   const registry = yield* Registry
+*   return yield* registry.packument("lodash")
+* })
+* ```
+*/
+var Registry = class extends Context.Service()("@packall/core/Registry") {};
+
+//#endregion
+//#region src/integrity.ts
+/**
+* The digests npm publishes, mapped to what `Crypto.digest` calls them.
+*
+* Doubles as the supported-algorithm list: an SRI token whose algorithm is not
+* a key here is one we cannot check, and is dropped during parsing.
+*/
+const digestAlgorithmByName = {
+	sha512: "SHA-512",
+	sha384: "SHA-384",
+	sha256: "SHA-256",
+	sha1: "SHA-1"
+};
+const isSupported = (algorithm) => Object.hasOwn(digestAlgorithmByName, algorithm);
+/**
+* Parses an SRI string such as `sha512-abc...==`.
+*
+* npm permits several space-separated hashes; we keep every one we can verify
+* and ignore algorithms we cannot.
+*/
+const parseIntegrity = (integrity) => {
+	const hashes = [];
+	for (const token of integrity.trim().split(/\s+/)) {
+		if (token.length === 0) continue;
+		const dash = token.indexOf("-");
+		if (dash <= 0) continue;
+		const algorithm = token.slice(0, dash).toLowerCase();
+		const digest = token.slice(dash + 1);
+		if (!isSupported(algorithm) || digest.length === 0) continue;
+		hashes.push({
+			algorithm,
+			digest
+		});
 	}
-	if (name.includes("/")) return "unscoped name cannot contain '/'";
-	if (!SEGMENT_RE.test(name)) return "name contains illegal characters";
-	return null;
+	return hashes;
 };
-const SEGMENT_RE = /^[a-z0-9\-._~]+$/;
+const digestBytes = (data, algorithm) => Effect.gen(function* () {
+	return yield* (yield* Crypto.Crypto).digest(digestAlgorithmByName[algorithm], data);
+});
+/** Computes the base64 digest of some bytes under one algorithm. */
+const digestOf = (data, algorithm) => Effect.map(digestBytes(data, algorithm), Encoding.encodeBase64);
+/** Computes the hex digest of some bytes — the form legacy `shasum` uses. */
+const hexDigestOf = (data, algorithm) => Effect.map(digestBytes(data, algorithm), Encoding.encodeHex);
 /**
-* Parses a single spec string.
+* Constant-time comparison of two digest strings.
 *
-* Splitting on `@` is the fiddly part: a scoped name *starts* with `@`, so we
-* look for the last `@` that is not at index 0.
+* Written by hand rather than with `node:crypto`'s `timingSafeEqual`, which
+* needs `Buffer` and would pin this module to Node. Both digests here are
+* public knowledge, so the timing property is close to theatre — but it costs
+* four lines, and the alternative is explaining in a review why it was dropped.
 */
-const parseSpec = (raw) => {
-	const input = raw.trim();
-	if (input.length === 0) throw new InvalidSpecError(raw, "spec is empty");
-	const at = input.lastIndexOf("@");
-	const hasSelector = at > 0;
-	const name = hasSelector ? input.slice(0, at) : input;
-	const selectorText = hasSelector ? input.slice(at + 1) : "";
-	const nameProblem = validatePackageName(name);
-	if (nameProblem !== null) throw new InvalidSpecError(raw, nameProblem);
-	if (!hasSelector || selectorText.length === 0) return {
-		name,
-		selector: {
-			_tag: "Tag",
-			tag: "latest"
-		},
-		raw: input
-	};
+const digestsEqual = (a, b) => {
+	if (a.length !== b.length) return false;
+	let difference = 0;
+	for (let index = 0; index < a.length; index++) difference |= a.charCodeAt(index) ^ b.charCodeAt(index);
+	return difference === 0;
+};
+/**
+* Checks bytes against whichever checksums the registry supplied.
+*
+* SRI is preferred; `shasum` is the fallback for versions published before
+* integrity strings existed. If the registry gave us neither, that is reported
+* as `Unverifiable` rather than silently treated as a pass — the caller decides
+* whether to tolerate it.
+*/
+const verify = (data, dist) => Effect.gen(function* () {
+	if (dist.integrity !== void 0 && dist.integrity.length > 0) {
+		const [best] = parseIntegrity(dist.integrity).toSorted((a, b) => strengthByAlgorithm[b.algorithm] - strengthByAlgorithm[a.algorithm]);
+		if (best === void 0) return {
+			_tag: "Unverifiable",
+			reason: `no supported algorithm in "${dist.integrity}"`
+		};
+		const actual = yield* digestOf(data, best.algorithm);
+		return digestsEqual(actual, best.digest) ? {
+			_tag: "Verified",
+			using: best.algorithm
+		} : {
+			_tag: "Mismatch",
+			expected: `${best.algorithm}-${best.digest}`,
+			actual: `${best.algorithm}-${actual}`
+		};
+	}
+	if (dist.shasum !== void 0 && dist.shasum.length > 0) {
+		const actual = yield* hexDigestOf(data, "sha1");
+		return digestsEqual(actual.toLowerCase(), dist.shasum.toLowerCase()) ? {
+			_tag: "Verified",
+			using: "sha1"
+		} : {
+			_tag: "Mismatch",
+			expected: `sha1-${dist.shasum}`,
+			actual: `sha1-${actual}`
+		};
+	}
 	return {
-		name,
-		selector: parseSelector(raw, selectorText),
-		raw: input
+		_tag: "Unverifiable",
+		reason: "registry advertised no integrity or shasum"
 	};
+});
+const strengthByAlgorithm = {
+	sha512: 4,
+	sha384: 3,
+	sha256: 2,
+	sha1: 1
 };
-/** Classifies the part after the `@` as an exact version, a range, or a dist-tag. */
-const parseSelector = (raw, text) => {
-	const exact = semver.valid(text, { loose: false });
-	if (exact !== null) return {
-		_tag: "Exact",
-		version: exact
+
+//#endregion
+//#region src/layout.ts
+/**
+* The on-disk shape of a bundle.
+*
+* Everything is laid out exactly the way a registry serves it:
+*
+*     lodash/-/lodash-4.17.21.tgz
+*     @babel/core/-/core-7.24.0.tgz
+*
+* That is not an Artifactory convention — it is the path structure in every
+* `dist.tarball` URL npm publishes. See `notes/requirements.md` § FR-12 for
+* what that buys.
+*
+* The one shape worth noticing before editing anything here: a scoped
+* package's file name drops the scope, so `@babel/core` becomes
+* `core-7.24.0.tgz` under an `@babel/core/-/` directory.
+*/
+/** Splits `@scope/name` into its parts. `scope` is undefined when unscoped. */
+const splitName = (name) => {
+	if (!name.startsWith("@")) return {
+		scope: void 0,
+		bare: name
 	};
-	if (semver.validRange(text, { loose: false }) !== null) return {
-		_tag: "Range",
-		range: text
+	const slash = name.indexOf("/");
+	if (slash === -1) return {
+		scope: void 0,
+		bare: name
 	};
-	if (!DIST_TAG_RE.test(text)) throw new InvalidSpecError(raw, `"${text}" is not a valid version, semver range, or dist-tag`);
 	return {
-		_tag: "Tag",
-		tag: text
+		scope: name.slice(0, slash),
+		bare: name.slice(slash + 1)
 	};
 };
-const DIST_TAG_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+/** `@babel/core` + `7.24.0` -> `core-7.24.0.tgz` */
+const tarballFileName = (name, version) => {
+	const { bare } = splitName(name);
+	return `${bare}-${version}.tgz`;
+};
 /**
-* Parses many specs, collecting *every* failure rather than stopping at the
-* first. Somebody bundling forty packages should be told about all four typos
-* in one go, not made to re-run four times.
+* The path of one package tarball within a bundle, using `/` separators
+* regardless of host platform — these become tar entry names, and tar entries
+* are always POSIX.
 */
-const parseSpecs = (inputs) => {
-	const specs = [];
-	const errors = [];
-	for (const input of inputs) try {
-		specs.push(parseSpec(input));
-	} catch (error) {
-		if (error instanceof InvalidSpecError) errors.push(error);
-		else throw error;
-	}
-	return {
-		specs,
-		errors
-	};
-};
+const packagePath = (name, version) => `${name}/-/${tarballFileName(name, version)}`;
+/** File name of the manifest that ships inside every bundle. */
+const MANIFEST_FILE = "bundle-manifest.json";
+/** File name of the short import guide that ships inside every bundle. */
+const README_FILE = "IMPORT.md";
 /**
-* Collapses duplicate specs, keeping the first occurrence.
+* Name of the archive produced for one root spec in `per-spec` layout.
 *
-* `npmb react react@latest` is a plausible thing to type and should not
-* download React twice.
+* It is the spec, with the one character a file name cannot hold taken out:
+* `@types/react@19.2.18` becomes `@types-react@19.2.18.tgz`. So the name of the
+* file answers the question somebody has when they are looking at a directory
+* of them — which package, and which version — in the notation they would have
+* typed to ask for it.
+*
+* The version is joined with `@` rather than `-` for the same reason. A
+* hyphen made `foo-bar-1.0.0` ambiguous by eye: package `foo` at `bar-1.0.0`,
+* or `foo-bar` at `1.0.0`? npm's own syntax has no such problem, because a
+* package name may not contain `@` beyond its scope.
+*
+* **The scope's `@` stays**, and it is the difference between a correct bundle
+* and a quietly incomplete one.
+*
+* Dropping it — which this did, matching what `npm pack` produces — meant
+* `@something/somewhat` and `something-somewhat` were both
+* `something-somewhat-1.0.0.tgz`. Two different packages, one path: the second
+* landed on the first, and the run reported two artifacts for the one file that
+* survived. A bundle short a package, called complete, found at the far end of
+* an air gap.
+*
+* Keeping the `@` makes that impossible by construction rather than by a check,
+* because an unscoped npm name may not begin with one. It is also the more
+* honest name: the scope is part of what the package *is*, and a directory of
+* archives that has forgotten which ones were scoped is a directory somebody
+* has to cross-reference against a manifest.
+*
+* It does not make every collision impossible — `@a/b-c` and `@a-b/c` still
+* meet — so `assertDistinctOutputs` still runs. That pair is pathological; the
+* scoped-against-unscoped one is `@babel/core` beside `babel-core`, which is a
+* real migration somebody could be bundling.
+*
+* The leading `@` is safe here in a way it is not inside the archive: tar's
+* splice convention applies to the *file list* it is given, which is what
+* `archive.ts` guards with `./`. This is the output path, not an entry.
 */
-const dedupeSpecs = (specs) => {
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const spec of specs) {
-		const key = formatSpec(spec);
-		if (seen.has(key)) continue;
-		seen.add(key);
-		out.push(spec);
-	}
-	return out;
+const perSpecArchiveName = (name, version) => {
+	const { scope, bare } = splitName(name);
+	return `${scope === void 0 ? bare : `${scope}-${bare}`}@${version}.tgz`;
 };
+/** Name of the archive produced in `single` layout. */
+const singleArchiveName = (base = "bundle") => `${base}.tgz`;
+/**
+* The import guide written into each bundle.
+*
+* Kept short and copy-pasteable on purpose: whoever opens this is mid-task on a
+* restricted network and does not want prose.
+*/
+const importGuide = (options) => `# Importing this bundle
+
+${options.packageCount} package tarball(s), laid out exactly as an npm registry serves them:
+
+    <package-name>/-/<file>.tgz
+    @<scope>/<name>/-/<file>.tgz
+
+Created ${options.createdAt} by packall ${options.toolVersion}.
+See ${MANIFEST_FILE} for the full list with checksums.
+
+## JFrog Artifactory
+
+Unpack, then upload the tree into a **local npm** repository. The layout already
+matches what Artifactory expects, so no path rewriting is needed:
+
+    tar -xzf <this-bundle>.tgz -C ./bundle
+    jf rt upload "bundle/(**)" "<npm-local-repo>/{1}" --flat=false
+
+## Verdaccio / Nexus / any npm registry
+
+Publish each tarball individually:
+
+    find ./bundle -name '*.tgz' -exec npm publish --registry <url> {} \\;
+
+## Verifying before import
+
+    node -e "const m=require('./bundle/${MANIFEST_FILE}');console.log(m.packages.length+' packages')"
+
+Every entry in ${MANIFEST_FILE} carries the integrity string the source registry
+advertised, and each tarball was checked against it at download time.
+`;
 
 //#endregion
-//#region src/Manifest.ts
-var Manifest_exports = /* @__PURE__ */ __export({
-	MANIFEST_VERSION: () => MANIFEST_VERSION,
-	buildManifest: () => buildManifest,
-	formatReasons: () => formatReasons,
-	serializeManifest: () => serializeManifest
-});
+//#region src/manifest.ts
 /** Schema version, bumped when the shape changes incompatibly. */
 const MANIFEST_VERSION = 1;
 /** Renders a package's reasons into short, greppable strings. */
 const formatReasons = (pkg) => pkg.reasons.map((reason) => reason._tag === "Root" ? `root:${reason.spec}` : `${reason.kind}:${reason.from}`);
 /** Builds the manifest for a completed (or dry) run. */
 const buildManifest = (input) => {
-	const includedNames = new Set(input.included.map((p) => `${p.name}@${p.version}`));
+	const includedNames = new Set(input.included.map((pkg) => `${pkg.name}@${pkg.version}`));
 	const packages = input.included.map((pkg) => {
 		const key = `${pkg.name}@${pkg.version}`;
 		return {
@@ -909,132 +848,10 @@ const buildManifest = (input) => {
 const serializeManifest = (manifest) => `${JSON.stringify(manifest, null, 2)}\n`;
 
 //#endregion
-//#region src/DependencyRange.ts
-var DependencyRange_exports = /* @__PURE__ */ __export({ parseDependencyTarget: () => parseDependencyTarget });
-const UNSUPPORTED_PROTOCOLS = [
-	["file:", "local file path"],
-	["link:", "local link"],
-	["workspace:", "workspace protocol"],
-	["portal:", "portal protocol"],
-	["patch:", "patch protocol"],
-	["git:", "git dependency"],
-	["git+", "git dependency"],
-	["github:", "GitHub shorthand"],
-	["gitlab:", "GitLab shorthand"],
-	["bitbucket:", "Bitbucket shorthand"],
-	["http:", "remote tarball URL"],
-	["https:", "remote tarball URL"]
-];
-/**
-* Classifies one `name -> range` entry.
-*
-* An empty range, `*`, and `latest` all mean "any published version"; npm
-* treats them interchangeably and so do we.
-*/
-const parseDependencyTarget = (name, raw) => {
-	const text = raw.trim();
-	if (text.length === 0 || text === "*" || text === "x" || text === "latest") return {
-		_tag: "Registry",
-		name,
-		selector: {
-			_tag: "Range",
-			range: "*"
-		}
-	};
-	if (text.startsWith("npm:")) return parseAlias(name, text);
-	for (const [prefix, reason] of UNSUPPORTED_PROTOCOLS) if (text.startsWith(prefix)) return {
-		_tag: "Unsupported",
-		name,
-		raw: text,
-		reason
-	};
-	if (semver.validRange(text, { loose: true }) === null && /^[\w.-]+\/[\w.-]+/.test(text)) return {
-		_tag: "Unsupported",
-		name,
-		raw: text,
-		reason: "git shorthand"
-	};
-	const exact = semver.valid(text, { loose: true });
-	if (exact !== null) return {
-		_tag: "Registry",
-		name,
-		selector: {
-			_tag: "Exact",
-			version: exact
-		}
-	};
-	if (semver.validRange(text, { loose: true }) !== null) return {
-		_tag: "Registry",
-		name,
-		selector: {
-			_tag: "Range",
-			range: text
-		}
-	};
-	if (/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(text)) return {
-		_tag: "Registry",
-		name,
-		selector: {
-			_tag: "Tag",
-			tag: text
-		}
-	};
-	return {
-		_tag: "Unsupported",
-		name,
-		raw: text,
-		reason: "unrecognised version specifier"
-	};
-};
-/**
-* Parses `npm:<name>[@<range>]`.
-*
-* The nested name may itself be scoped, so the `@` split has the same
-* "not at index 0" caveat as top-level spec parsing.
-*/
-const parseAlias = (key, text) => {
-	const body = text.slice(4);
-	if (body.length === 0) return {
-		_tag: "Unsupported",
-		name: key,
-		raw: text,
-		reason: "empty npm: alias"
-	};
-	const at = body.lastIndexOf("@");
-	const target = at > 0 ? body.slice(0, at) : body;
-	const rangeText = at > 0 ? body.slice(at + 1) : "";
-	if (target.length === 0) return {
-		_tag: "Unsupported",
-		name: key,
-		raw: text,
-		reason: "empty npm: alias target"
-	};
-	const inner = parseDependencyTarget(target, rangeText);
-	if (inner._tag === "Unsupported") return {
-		...inner,
-		name: key,
-		raw: text
-	};
-	return {
-		_tag: "Registry",
-		name: target,
-		selector: inner.selector,
-		aliasOf: key
-	};
-};
-
-//#endregion
-//#region src/Resolve.ts
-var Resolve_exports = /* @__PURE__ */ __export({
-	edgesOf: () => edgesOf,
-	indexPackages: () => indexPackages,
-	packageKey: () => packageKey,
-	resolve: () => resolve,
-	selectVersions: () => selectVersions
-});
+//#region src/resolve.ts
 const packageKey = (name, version) => `${name}@${version}`;
 /** Index of a resolution by `name@version`, for lookups during bundling. */
-const indexPackages = (resolution) => new Map(resolution.packages.map((p) => [packageKey(p.name, p.version), p]));
+const indexPackages = (resolution) => new Map(resolution.packages.map((pkg) => [packageKey(pkg.name, pkg.version), pkg]));
 /**
 * Turns a selector into the concrete version(s) it names.
 *
@@ -1054,17 +871,18 @@ const selectVersions = (packument, selector, options) => {
 			return [version];
 		}
 		case "Range": {
-			const satisfying = available.filter((v) => semver.satisfies(v, selector.range, {
+			const satisfying = available.filter((version) => semver.satisfies(version, selector.range, {
 				loose: true,
 				includePrerelease: options.includePrerelease
-			})).sort(semver.rcompare);
-			if (satisfying.length === 0) throw new NoMatchingVersionsError(packument.name, selector.range, sortVersions(available));
-			if (!options.all) return [satisfying[0]];
+			})).toSorted(semver.rcompare);
+			const [best] = satisfying;
+			if (best === void 0) throw new NoMatchingVersionsError(packument.name, selector.range, sortVersions(available));
+			if (!options.all) return [best];
 			return options.maxVersions !== void 0 && options.maxVersions > 0 ? satisfying.slice(0, options.maxVersions) : satisfying;
 		}
 	}
 };
-const sortVersions = (versions) => [...versions].sort((a, b) => semver.valid(a) && semver.valid(b) ? semver.compare(a, b) : a.localeCompare(b));
+const sortVersions = (versions) => versions.toSorted((a, b) => semver.valid(a) && semver.valid(b) ? semver.compare(a, b) : a.localeCompare(b));
 const makeWalkState = () => ({
 	resolved: /* @__PURE__ */ new Map(),
 	edges: /* @__PURE__ */ new Map(),
@@ -1092,8 +910,19 @@ const getPackument = (state, name) => Effect.gen(function* () {
 	state.packuments.set(name, packument);
 	return packument;
 });
+/**
+* Re-fails a thrown selection error into the Effect error channel.
+*
+* `selectVersions` throws `BundlerError` subclasses and nothing else, so this
+* narrows rather than casting; anything unexpected is rethrown as a defect,
+* which is what an unexpected exception actually is.
+*/
+const asBundlerError = (error) => {
+	if (error instanceof VersionNotFoundError || error instanceof NoMatchingVersionsError) return error;
+	throw error;
+};
 /** Expands one resolved manifest into the edges that follow from it. */
-const edgesOf = (manifest, options) => {
+const edgesOf$3 = (manifest, options) => {
 	const from = packageKey(manifest.name, manifest.version);
 	const tasks = [];
 	const warnings = [];
@@ -1121,11 +950,11 @@ const edgesOf = (manifest, options) => {
 			});
 		}
 	};
-	add(manifest.dependencies, "prod", false);
-	if (options.scope.optional) add(manifest.optionalDependencies, "optional", true);
+	add(manifest.dependencies, EdgeKind.Prod, false);
+	if (options.scope.optional) add(manifest.optionalDependencies, EdgeKind.Optional, true);
 	if (options.scope.peer) {
 		const meta = manifest.peerDependenciesMeta ?? {};
-		add(manifest.peerDependencies, "peer", false, (name) => meta[name]?.optional === true);
+		add(manifest.peerDependencies, EdgeKind.Peer, false, (name) => meta[name]?.optional === true);
 	}
 	return {
 		tasks,
@@ -1137,7 +966,7 @@ const edgesFor = (state, manifest, options) => {
 	const key = packageKey(manifest.name, manifest.version);
 	const cached = state.edges.get(key);
 	if (cached !== void 0) return cached;
-	const { tasks, warnings } = edgesOf(manifest, options);
+	const { tasks, warnings } = edgesOf$3(manifest, options);
 	for (const warning of warnings) addWarning(state, warning);
 	state.edges.set(key, tasks);
 	return tasks;
@@ -1168,7 +997,8 @@ const walk = (state, seeds, options) => Effect.gen(function* () {
 			if (result === null) continue;
 			for (const { manifest, reason } of result) {
 				const key = packageKey(manifest.name, manifest.version);
-				if (!state.resolved.has(key)) {
+				const existing = state.resolved.get(key);
+				if (existing === void 0) {
 					state.resolved.set(key, {
 						name: manifest.name,
 						version: manifest.version,
@@ -1186,13 +1016,10 @@ const walk = (state, seeds, options) => Effect.gen(function* () {
 						from: key,
 						message: `${key} is deprecated: ${manifest.deprecated}`
 					});
-				} else {
-					const existing = state.resolved.get(key);
-					if (!hasReason(existing.reasons, reason)) state.resolved.set(key, {
-						...existing,
-						reasons: [...existing.reasons, reason]
-					});
-				}
+				} else if (!hasReason$1(existing.reasons, reason)) state.resolved.set(key, {
+					...existing,
+					reasons: [...existing.reasons, reason]
+				});
 				if (!discovered.has(key)) {
 					discovered.add(key);
 					next.push(...edgesFor(state, manifest, options));
@@ -1203,7 +1030,7 @@ const walk = (state, seeds, options) => Effect.gen(function* () {
 	}
 	return [...discovered];
 });
-const hasReason = (reasons, candidate) => reasons.some((reason) => {
+const hasReason$1 = (reasons, candidate) => reasons.some((reason) => {
 	if (reason._tag === "Root" && candidate._tag === "Root") return reason.spec === candidate.spec;
 	if (reason._tag === "Edge" && candidate._tag === "Edge") return reason.from === candidate.from && reason.kind === candidate.kind;
 	return false;
@@ -1217,24 +1044,21 @@ const hasReason = (reasons, candidate) => reasons.some((reason) => {
 */
 const resolveTask = (state, task, options) => Effect.gen(function* () {
 	const packument = yield* getPackument(state, task.name);
-	const versions = yield* Effect.try({
+	return (yield* Effect.try({
 		try: () => selectVersions(packument, task.selector, {
 			all: false,
 			includePrerelease: options.includePrerelease
 		}),
-		catch: (error) => error
-	});
-	const out = [];
-	for (const version of versions) {
+		catch: asBundlerError
+	})).flatMap((version) => {
 		const manifest = packument.versions[version];
-		if (manifest === void 0) continue;
-		if (task.reason._tag === "Edge" && task.reason.kind === "optional" && !isIncluded(manifest, options.scope.platforms)) continue;
-		out.push({
+		if (manifest === void 0) return [];
+		if (task.reason._tag === "Edge" && task.reason.kind === EdgeKind.Optional && !isIncluded(manifest, options.scope.platforms)) return [];
+		return {
 			manifest,
 			reason: task.reason
-		});
-	}
-	return out;
+		};
+	});
 }).pipe(Effect.catch((error) => {
 	if (!task.tolerateFailure) return Effect.fail(error);
 	return Effect.sync(() => {
@@ -1252,76 +1076,1395 @@ const resolveTask = (state, task, options) => Effect.gen(function* () {
 const resolve = (specs, options) => Effect.gen(function* () {
 	yield* emit({
 		_tag: "PhaseStarted",
-		phase: "resolve",
-		total: specs.length
+		phase: Phase.Resolve,
+		total: specs.length
+	});
+	const state = makeWalkState();
+	const roots = [];
+	for (const spec of specs) {
+		const packument = yield* getPackument(state, spec.name);
+		const versions = yield* Effect.try({
+			try: () => selectVersions(packument, spec.selector, {
+				all: options.allVersions,
+				maxVersions: options.maxVersions,
+				includePrerelease: options.includePrerelease
+			}),
+			catch: asBundlerError
+		});
+		const closures = /* @__PURE__ */ new Map();
+		const union = /* @__PURE__ */ new Set();
+		for (const version of versions) {
+			const closure = yield* walk(state, [{
+				name: spec.name,
+				selector: {
+					_tag: "Exact",
+					version
+				},
+				reason: {
+					_tag: "Root",
+					spec: formatSpec(spec)
+				},
+				tolerateFailure: false
+			}], options);
+			closures.set(version, closure);
+			for (const key of closure) union.add(key);
+		}
+		roots.push({
+			spec,
+			versions,
+			closures,
+			closure: [...union]
+		});
+	}
+	yield* emit({
+		_tag: "PhaseCompleted",
+		phase: Phase.Resolve
+	});
+	return {
+		roots,
+		packages: [...state.resolved.values()].toSorted(compareResolved$1),
+		warnings: state.warnings
+	};
+});
+const compareResolved$1 = (a, b) => {
+	if (a.name !== b.name) return a.name < b.name ? -1 : 1;
+	return semver.valid(a.version) && semver.valid(b.version) ? semver.compare(a.version, b.version) : a.version.localeCompare(b.version);
+};
+
+//#endregion
+//#region src/locked-resolve.ts
+/** Turns a parsed lockfile into a resolution, pinning every version. */
+const resolveLocked = (lock, options) => Effect.gen(function* () {
+	const roots = selectRoots(lock, options);
+	yield* emit({
+		_tag: "PhaseStarted",
+		phase: Phase.Resolve,
+		total: roots.length
+	});
+	const gap = findGaps(lock, roots, options.declared);
+	if (gap !== null) return yield* Effect.fail(gap);
+	const manifests = yield* fetchManifests(lock, reachableKeys(lock, roots, options), options);
+	const warnings = lock.warnings.map((message) => ({ message }));
+	const resolved = /* @__PURE__ */ new Map();
+	const seenWarnings = /* @__PURE__ */ new Set();
+	const addWarning$1 = (warning) => {
+		const key = `${warning.from ?? ""}|${warning.message}`;
+		if (seenWarnings.has(key)) return;
+		seenWarnings.add(key);
+		warnings.push(warning);
+	};
+	const rootResolutions = [];
+	for (const root of roots) {
+		const key = packageKey(root.name, root.version);
+		if (!manifests.has(key)) continue;
+		const spec = {
+			name: root.name,
+			selector: {
+				_tag: "Exact",
+				version: root.version
+			},
+			raw: `${root.name}@${root.version}`
+		};
+		if (root.kind === LockedRootKind.Optional && !platformAllows(manifests, key, options)) continue;
+		const closure = walkLocked({
+			lock,
+			manifests,
+			options,
+			seed: key,
+			rootSpec: formatSpec(spec),
+			resolved,
+			addWarning: addWarning$1
+		});
+		rootResolutions.push({
+			spec,
+			versions: [root.version],
+			closures: new Map([[root.version, closure]]),
+			closure
+		});
+	}
+	for (const pkg of resolved.values()) {
+		const deprecated = pkg.manifest.deprecated;
+		if (deprecated !== void 0 && deprecated !== "") addWarning$1({
+			from: packageKey(pkg.name, pkg.version),
+			message: `${packageKey(pkg.name, pkg.version)} is deprecated: ${deprecated}`
+		});
+	}
+	yield* emit({
+		_tag: "PhaseCompleted",
+		phase: Phase.Resolve
+	});
+	return {
+		roots: rootResolutions,
+		packages: [...resolved.values()].toSorted(compareResolved),
+		warnings
+	};
+});
+/** Which of the project's direct dependencies this run should bundle. */
+const selectRoots = (lock, options) => lock.roots.filter((root) => {
+	if (root.kind === LockedRootKind.Dev) return options.includeDev;
+	if (root.kind === LockedRootKind.Optional) return options.scope.optional;
+	if (root.kind === LockedRootKind.Peer) return options.scope.peer;
+	return true;
+}).toSorted((a, b) => a.name === b.name ? 0 : a.name < b.name ? -1 : 1);
+/**
+* The two ways a lockfile can be partial, checked before anything is fetched.
+*
+* Both mean the same thing to whoever is waiting on the bundle — a package they
+* expected will not be in it — and both are invisible unless something says so,
+* because the run otherwise succeeds and simply produces less.
+*/
+const findGaps = (lock, roots, declared) => {
+	const remedy = `Run \`${lock.format} install\` to bring the lockfile up to date.`;
+	if (declared !== void 0 && declared.length > 0) {
+		const locked = /* @__PURE__ */ new Set();
+		for (const pkg of lock.packages.values()) locked.add(pkg.name);
+		for (const root of roots) locked.add(root.name);
+		const missing = declared.filter((name) => !locked.has(name));
+		if (missing.length > 0) return new LockfileIncompleteError(lock.path, missing, `the package.json declares ${missing.length} dependenc${missing.length === 1 ? "y" : "ies"} it does not pin`, remedy);
+	}
+	if (lock.incomplete.length > 0) return new LockfileIncompleteError(lock.path, lock.incomplete, `${lock.incomplete.length} required dependenc${lock.incomplete.length === 1 ? "y is" : "ies are"} not pinned`, remedy);
+	return null;
+};
+/**
+* Every package the roots can reach through the locked edges.
+*
+* Scope filters apply here — `--no-optional` genuinely removes a subtree — but
+* the platform filter does not, because deciding it needs the `os`/`cpu` fields
+* that only the registry has.
+*/
+const reachableKeys = (lock, roots, options) => {
+	const seen = /* @__PURE__ */ new Set();
+	const queue = roots.map((root) => packageKey(root.name, root.version));
+	while (queue.length > 0) {
+		const key = queue.pop();
+		if (key === void 0 || seen.has(key)) continue;
+		seen.add(key);
+		for (const edge of lock.packages.get(key)?.dependencies ?? []) {
+			if (!followsEdge(edge.kind, options)) continue;
+			queue.push(packageKey(edge.name, edge.version));
+		}
+	}
+	return seen;
+};
+const followsEdge = (kind, options) => {
+	if (kind === LockedRootKind.Optional) return options.scope.optional;
+	if (kind === LockedRootKind.Peer) return options.scope.peer;
+	return true;
+};
+/**
+* Fetches the published manifest for every pinned version.
+*
+* One packument per distinct *name*, not per version — a lockfile holding four
+* versions of `tslib` costs one request. Every pinned version that the registry
+* does not serve is collected and reported together, because "refresh your
+* lockfile" is a single action and finding out about the gaps one run at a time
+* would be miserable.
+*/
+const fetchManifests = (lock, reachable, options) => Effect.gen(function* () {
+	const registry = yield* Registry;
+	const wanted = /* @__PURE__ */ new Map();
+	for (const key of reachable) {
+		const pkg = lock.packages.get(key);
+		if (pkg === void 0) continue;
+		const versions = wanted.get(pkg.name);
+		if (versions === void 0) wanted.set(pkg.name, [pkg.version]);
+		else versions.push(pkg.version);
+	}
+	const manifests = /* @__PURE__ */ new Map();
+	const missing = [];
+	const fetched = yield* Effect.forEach([...wanted.entries()], ([name, versions]) => registry.packument(name).pipe(Effect.map((packument) => ({
+		name,
+		versions,
+		packument
+	})), Effect.catch((error) => error._tag === "PackageNotFoundError" ? Effect.succeed({
+		name,
+		versions,
+		packument: null
+	}) : Effect.fail(error))), { concurrency: options.concurrency });
+	for (const { name, versions, packument } of fetched) for (const version of versions) {
+		if (packument === null) {
+			missing.push({
+				name,
+				version,
+				detail: "package not found"
+			});
+			continue;
+		}
+		const manifest = packument.versions[version];
+		if (manifest === void 0) {
+			missing.push({
+				name,
+				version,
+				detail: describeAvailable(Object.keys(packument.versions))
+			});
+			continue;
+		}
+		manifests.set(packageKey(name, version), manifest);
+		yield* emit({
+			_tag: "PackageResolved",
+			name,
+			version,
+			resolvedCount: manifests.size,
+			pendingCount: reachable.size - manifests.size
+		});
+	}
+	if (missing.length > 0) return yield* Effect.fail(new LockfileOutOfDateError(lock.path, registry.registryFor(missing[0]?.name ?? ""), missing));
+	return manifests;
+});
+const describeAvailable = (available) => {
+	const recent = available.toSorted((a, b) => semver.valid(a) && semver.valid(b) ? semver.compare(a, b) : a.localeCompare(b)).slice(-3);
+	return recent.length === 0 ? "no published versions" : `no longer published (latest: ${recent.join(", ")})`;
+};
+/**
+* Collects one root's closure by following locked edges.
+*
+* Pure and synchronous — every manifest is already in hand — so a per-root
+* closure costs nothing beyond the traversal, which is what makes `per-spec`
+* layout as cheap here as it is for a range-resolved run.
+*/
+const walkLocked = (input) => {
+	const closure = /* @__PURE__ */ new Set();
+	const queue = [{
+		key: input.seed,
+		reason: {
+			_tag: "Root",
+			spec: input.rootSpec
+		}
+	}];
+	while (queue.length > 0) {
+		const next = queue.pop();
+		if (next === void 0) continue;
+		const manifest = input.manifests.get(next.key);
+		const locked = input.lock.packages.get(next.key);
+		if (manifest === void 0 || locked === void 0) continue;
+		record(input.resolved, next.key, manifest, locked, next.reason);
+		if (closure.has(next.key)) continue;
+		closure.add(next.key);
+		for (const edge of locked.dependencies) {
+			if (!followsEdge(edge.kind, input.options)) continue;
+			const target = packageKey(edge.name, edge.version);
+			if (!input.manifests.has(target)) continue;
+			if (edge.kind === LockedRootKind.Optional && !platformAllows(input.manifests, target, input.options)) {
+				input.addWarning({
+					from: next.key,
+					message: `Skipped optional ${target} — it does not build for the selected platforms.`
+				});
+				continue;
+			}
+			queue.push({
+				key: target,
+				reason: {
+					_tag: "Edge",
+					from: next.key,
+					kind: edge.kind
+				}
+			});
+		}
+	}
+	return [...closure];
+};
+/** Adds a package, or merges one more justification into an existing entry. */
+const record = (resolved, key, manifest, locked, reason) => {
+	const existing = resolved.get(key);
+	if (existing === void 0) {
+		resolved.set(key, {
+			name: locked.name,
+			version: locked.version,
+			manifest,
+			reasons: [reason]
+		});
+		return;
+	}
+	if (hasReason(existing.reasons, reason)) return;
+	resolved.set(key, {
+		...existing,
+		reasons: [...existing.reasons, reason]
+	});
+};
+const hasReason = (reasons, candidate) => reasons.some((reason) => {
+	if (reason._tag === "Root" && candidate._tag === "Root") return reason.spec === candidate.spec;
+	if (reason._tag === "Edge" && candidate._tag === "Edge") return reason.from === candidate.from && reason.kind === candidate.kind;
+	return false;
+});
+const platformAllows = (manifests, key, options) => {
+	const manifest = manifests.get(key);
+	if (manifest === void 0) return false;
+	return isIncluded(manifest, options.scope.platforms);
+};
+const compareResolved = (a, b) => {
+	if (a.name !== b.name) return a.name < b.name ? -1 : 1;
+	return semver.valid(a.version) && semver.valid(b.version) ? semver.compare(a.version, b.version) : a.version.localeCompare(b.version);
+};
+
+//#endregion
+//#region src/lockfile/json.ts
+const stringOr = (value, fallback) => typeof value === "string" ? value : fallback;
+const decodeStringRecord = Schema.decodeUnknownOption(StringRecordSchema);
+/** Keeps only the string-valued members of an untyped object. */
+const stringRecord = (value) => Option.getOrElse(decodeStringRecord(value), () => ({}));
+const decodeOptionalFlags = Schema.decodeUnknownOption(OptionalFlagRecordSchema);
+/** Names a package marked its peers optional with. */
+const optionalPeerNames = (value) => {
+	const flags = Option.getOrElse(decodeOptionalFlags(value), () => ({}));
+	return new Set(Object.entries(flags).flatMap(([name, meta]) => meta.optional ? name : []));
+};
+const parseJsonObject = (path, content) => {
+	const parsed = tryParseJsonc(content);
+	if (parsed === void 0) throw new LockfileError(path, "not valid JSON");
+	if (!isRecord(parsed)) throw new LockfileError(path, "top level is not an object");
+	return parsed;
+};
+/**
+* Parses JSON, tolerating the comments and trailing commas bun writes.
+*
+* `bun.lock` is JSONC by design — bun puts explanatory comments in it — so
+* plain `JSON.parse` rejects real lockfiles. Returns `undefined` rather than
+* throwing so detection can use it as a probe.
+*/
+const tryParseJsonc = (content) => {
+	try {
+		return JSON.parse(content);
+	} catch {
+		try {
+			return JSON.parse(stripJsonc(content));
+		} catch {
+			return;
+		}
+	}
+};
+/**
+* Removes comments and trailing commas.
+*
+* String-aware, because a `//` inside a tarball URL is not a comment and an
+* escaped quote does not end a string. Both appear in every real lockfile.
+*/
+const stripJsonc = (content) => {
+	let out = "";
+	let index = 0;
+	let inString = false;
+	while (index < content.length) {
+		const char = content[index];
+		if (inString) {
+			out += char;
+			if (char === "\\") {
+				out += content[index + 1] ?? "";
+				index += 2;
+				continue;
+			}
+			if (char === "\"") inString = false;
+			index += 1;
+			continue;
+		}
+		if (char === "\"") {
+			inString = true;
+			out += char;
+			index += 1;
+			continue;
+		}
+		if (char === "/" && content[index + 1] === "/") {
+			const end = content.indexOf("\n", index);
+			index = end === -1 ? content.length : end;
+			continue;
+		}
+		if (char === "/" && content[index + 1] === "*") {
+			const end = content.indexOf("*/", index + 2);
+			index = end === -1 ? content.length : end + 2;
+			continue;
+		}
+		if (char === ",") {
+			const next = content.slice(index + 1).search(/\S/);
+			const following = next === -1 ? "" : content[index + 1 + next];
+			if (following === "}" || following === "]") {
+				index += 1;
+				continue;
+			}
+		}
+		out += char;
+		index += 1;
+	}
+	return out;
+};
+const describeError$1 = (error) => error instanceof Error ? error.message : String(error);
+
+//#endregion
+//#region src/lockfile/detect.ts
+/**
+* Deliberately cheap and total: it never throws, so `--file` can try this
+* first and fall through to its other shapes when the answer is `NotALockfile`.
+*/
+const detectLockfile = (content) => {
+	const trimmed = content.trimStart();
+	if (trimmed.startsWith("bun-lockfile-format-v0")) return {
+		_tag: "Unsupported",
+		label: "a binary bun lockfile (bun.lockb)",
+		hint: "Run `bun install --save-text-lockfile` to produce a bun.lock, and pass that instead."
+	};
+	if (/^__metadata:/m.test(trimmed) || /^# yarn lockfile v\d/m.test(trimmed)) return {
+		_tag: "Unsupported",
+		label: "a yarn lockfile",
+		hint: "yarn is not supported yet. Point --file at the package.json instead, or pass --lockfile off."
+	};
+	if (trimmed.startsWith("{")) return detectJsonLockfile(trimmed);
+	if (/^lockfileVersion:/m.test(trimmed) || /^(importers|snapshots):/m.test(trimmed)) return {
+		_tag: "Supported",
+		format: LockfileFormat.Pnpm
+	};
+	return { _tag: "NotALockfile" };
+};
+/**
+* Separates the two JSON lockfiles from each other and from a package.json.
+*
+* Both npm and bun write a numeric `lockfileVersion`, so that field alone
+* cannot decide it. bun is the one that carries a `workspaces` map keyed by the
+* empty string; npm keeps the root project under `packages[""]` instead.
+*/
+const detectJsonLockfile = (trimmed) => {
+	const parsed = tryParseJsonc(trimmed);
+	if (!isRecord(parsed)) return { _tag: "NotALockfile" };
+	const workspaces = parsed["workspaces"];
+	if (isRecord(workspaces) && Object.hasOwn(workspaces, "")) return {
+		_tag: "Supported",
+		format: LockfileFormat.Bun
+	};
+	if (typeof parsed["lockfileVersion"] === "number") return {
+		_tag: "Supported",
+		format: LockfileFormat.Npm
+	};
+	return { _tag: "NotALockfile" };
+};
+
+//#endregion
+//#region src/lockfile/names.ts
+/**
+* The file name each supported manager writes, in detection order.
+*
+* Ordered: `package-lock.json` before `npm-shrinkwrap.json` before pnpm's and
+* bun's, so a directory holding several is searched the way npm itself would.
+*/
+const formatByLockfileName = {
+	"package-lock.json": LockfileFormat.Npm,
+	"npm-shrinkwrap.json": LockfileFormat.Npm,
+	"pnpm-lock.yaml": LockfileFormat.Pnpm,
+	"bun.lock": LockfileFormat.Bun
+};
+/** The names a given manager writes. */
+const lockfileNamesFor = (format) => Object.entries(formatByLockfileName).flatMap(([name, candidate]) => candidate === format ? name : []);
+
+//#endregion
+//#region src/lockfile/tree-builder.ts
+/**
+* Which manifest block each root kind is declared in.
+*
+* The block names are the same across npm, pnpm and bun; only which of them a
+* given format writes differs, which is why each parser supplies its own order
+* rather than iterating this.
+*/
+const fieldByRootKind = {
+	[LockedRootKind.Prod]: "dependencies",
+	[LockedRootKind.Optional]: "optionalDependencies",
+	[LockedRootKind.Dev]: "devDependencies",
+	[LockedRootKind.Peer]: "peerDependencies"
+};
+var TreeBuilder = class {
+	packages = /* @__PURE__ */ new Map();
+	roots = [];
+	warnings = [];
+	incomplete = [];
+	/** Names dropped on purpose, so an edge into one is explained, not alarming. */
+	skipped = /* @__PURE__ */ new Set();
+	seenWarnings = /* @__PURE__ */ new Set();
+	add(pkg) {
+		const key = packageKey(pkg.name, pkg.version);
+		const existing = this.packages.get(key);
+		if (existing === void 0) {
+			this.packages.set(key, pkg);
+			return;
+		}
+		this.packages.set(key, {
+			...existing,
+			dependencies: mergeEdges(existing.dependencies, pkg.dependencies)
+		});
+	}
+	addRoot(root) {
+		if (this.roots.some((existing) => existing.name === root.name)) return;
+		this.roots.push(root);
+	}
+	warn(message) {
+		if (this.seenWarnings.has(message)) return;
+		this.seenWarnings.add(message);
+		this.warnings.push(message);
+	}
+	/** Notes an entry that is real but cannot come from a registry. */
+	skip(name, spec, reason) {
+		this.skipped.add(name);
+		this.warn(`skipped ${name}@${spec} (${reason}) — not fetchable from a registry`);
+	}
+	/**
+	* Records a required edge that resolved to nothing.
+	*
+	* An edge into something skipped on purpose is expected — you cannot bundle a
+	* `workspace:` sibling from a registry — so it stays a warning. Anything else
+	* means the file does not pin what it claims to.
+	*/
+	dangling(from, name) {
+		if (this.skipped.has(name)) {
+			this.warn(`${from} requires ${name}, which is not fetchable from a registry`);
+			return;
+		}
+		this.incomplete.push(`${name} (required by ${from})`);
+	}
+	finish(input) {
+		if (this.packages.size === 0) throw new LockfileError(input.path, "lockfile pins no packages that can be bundled");
+		return {
+			format: input.format,
+			lockfileVersion: input.lockfileVersion,
+			path: input.path,
+			importer: input.importer,
+			packages: this.packages,
+			roots: this.roots,
+			warnings: this.warnings,
+			incomplete: this.incomplete
+		};
+	}
+};
+const mergeEdges = (a, b) => {
+	const merged = /* @__PURE__ */ new Map();
+	for (const edge of [...a, ...b]) merged.set(`${edge.name}@${edge.version}|${edge.kind}`, edge);
+	return [...merged.values()];
+};
+/**
+* Reads the right-hand side of a locked entry as an exact version.
+*
+* Returns the version when it is one, or the reason it is not — `file:../x`,
+* `workspace:*`, a git URL. `parseDependencyTarget` already classifies every
+* one of those for package.json parsing, so the vocabulary of skip reasons
+* stays identical between the two paths.
+*/
+const asExactVersion = (name, raw) => {
+	const exact = semver.valid(raw, { loose: true });
+	if (exact !== null) return {
+		_tag: "Version",
+		version: exact
+	};
+	const target = parseDependencyTarget(name, raw);
+	if (target._tag === "Unsupported") return {
+		_tag: "Unsupported",
+		reason: target.reason
+	};
+	return {
+		_tag: "Unsupported",
+		reason: "not an exact version"
+	};
+};
+/**
+* Raised when a lockfile found by walking up turns out not to cover the
+* package.json that went looking for it.
+*
+* Worth distinguishing from "no lockfile at all": the file exists and is
+* readable, it simply belongs to a different project, and bundling it would
+* produce someone else's dependency set.
+*/
+const notCovered = (path, importer, known) => {
+	const listed = known.slice(0, 8).map((entry) => `    ${entry}`).join("\n");
+	throw new LockfileError(path, `it does not cover ${importer}.\n` + (known.length === 0 ? "  It records no workspace members." : `  Workspace members it does record:\n${listed}` + (known.length > 8 ? `\n    … and ${known.length - 8} more` : "")));
+};
+/** `""` is how npm and bun spell the project at the lockfile's own level. */
+const importerKey = (importer) => importer === "." ? "" : importer;
+
+//#endregion
+//#region src/lockfile/bun.ts
+/** Root blocks in bun's precedence order — the first mention of a name wins. */
+const ROOT_KINDS$2 = [
+	LockedRootKind.Prod,
+	LockedRootKind.Optional,
+	LockedRootKind.Dev,
+	LockedRootKind.Peer
+];
+const parseBunLockfile = (path, content, importer) => {
+	const root = parseJsonObject(path, content);
+	const version = String(root["lockfileVersion"] ?? "?");
+	const builder = new TreeBuilder();
+	const packages = root["packages"];
+	const entries = isRecord(packages) ? collectEntries$1(builder, packages) : /* @__PURE__ */ new Map();
+	const keys = new Set(entries.keys());
+	for (const entry of entries.values()) builder.add({
+		name: entry.name,
+		version: entry.version,
+		dependencies: edgesOf$2(builder, entries, keys, entry)
+	});
+	collectRoots$2(builder, entries, keys, root["workspaces"], path, importer);
+	return builder.finish({
+		format: LockfileFormat.Bun,
+		lockfileVersion: version,
+		path,
+		importer
+	});
+};
+/**
+* Narrows bun's tuple entries.
+*
+* The value is a positional array whose shape depends on where the package came
+* from. A registry package is `[id, registry, info, integrity]`; a workspace
+* member or a git dependency is shorter and its `id` carries the protocol.
+*/
+const collectEntries$1 = (builder, packages) => {
+	const entries = /* @__PURE__ */ new Map();
+	for (const [key, raw] of Object.entries(packages)) {
+		if (!Array.isArray(raw)) continue;
+		const [id, , info] = raw;
+		if (typeof id !== "string") continue;
+		const at = id.lastIndexOf("@");
+		if (at <= 0) continue;
+		const name = id.slice(0, at);
+		const spec = id.slice(at + 1);
+		const version = asExactVersion(name, spec);
+		if (version._tag === "Unsupported") {
+			builder.skip(name, spec, version.reason);
+			continue;
+		}
+		const details = isRecord(info) ? info : {};
+		entries.set(key, {
+			key,
+			name,
+			version: version.version,
+			dependencies: stringRecord(details["dependencies"]),
+			optionalDependencies: stringRecord(details["optionalDependencies"]),
+			peerDependencies: stringRecord(details["peerDependencies"]),
+			optionalPeers: collectOptionalPeers(details)
+		});
+	}
+	return entries;
+};
+/** bun lists optional peers as a name array rather than npm's metadata object. */
+const collectOptionalPeers = (details) => {
+	const listed = details["optionalPeers"];
+	const names = Array.isArray(listed) ? listed.flatMap((entry) => typeof entry === "string" ? entry : []) : [];
+	return new Set([...names, ...optionalPeerNames(details["peerDependenciesMeta"])]);
+};
+const edgesOf$2 = (builder, entries, keys, entry) => {
+	const edges = [];
+	const add = (names, kind) => {
+		for (const name of names) {
+			const target = findEntry(entries, keys, entry.key, name);
+			if (target === void 0) {
+				if (kind === EdgeKind.Prod) builder.dangling(`${entry.name}@${entry.version}`, name);
+				continue;
+			}
+			edges.push({
+				name: target.name,
+				version: target.version,
+				kind
+			});
+		}
+	};
+	add(Object.keys(entry.dependencies), EdgeKind.Prod);
+	add(Object.keys(entry.optionalDependencies), EdgeKind.Optional);
+	add(Object.keys(entry.peerDependencies).filter((name) => !entry.optionalPeers.has(name)), EdgeKind.Peer);
+	return edges;
+};
+const collectRoots$2 = (builder, entries, keys, workspaces, path, member) => {
+	if (!isRecord(workspaces)) return;
+	const selected = member === void 0 ? Object.values(workspaces) : Object.hasOwn(workspaces, importerKey(member)) ? [workspaces[importerKey(member)]] : notCovered(path, member, workspacePaths$1(workspaces));
+	for (const workspace of selected) {
+		if (!isRecord(workspace)) continue;
+		for (const kind of ROOT_KINDS$2) {
+			const declared = stringRecord(workspace[fieldByRootKind[kind]]);
+			for (const [name, specifier] of Object.entries(declared)) {
+				const target = findEntry(entries, keys, "", name);
+				if (target === void 0) continue;
+				builder.addRoot({
+					name: target.name,
+					version: target.version,
+					kind,
+					specifier
+				});
+			}
+		}
+	}
+};
+const workspacePaths$1 = (workspaces) => Object.keys(workspaces).map((key) => key === "" ? "." : key);
+/**
+* bun nests with a plain `/`, and package names contain `/` too, so a parent
+* key cannot be found by string-splitting alone — `@babel/core` would split
+* into a scope that is not a key. `parentKey` only accepts a prefix that is
+* itself an entry, which resolves the ambiguity.
+*/
+const findEntry = (entries, keys, fromKey, name) => {
+	let scope = fromKey;
+	for (;;) {
+		const found = entries.get(scope === "" ? name : `${scope}/${name}`);
+		if (found !== void 0) return found;
+		if (scope === "") return void 0;
+		scope = parentKey(keys, scope);
+	}
+};
+const parentKey = (keys, key) => {
+	for (let at = key.lastIndexOf("/"); at > 0; at = key.lastIndexOf("/", at - 1)) {
+		const prefix = key.slice(0, at);
+		if (keys.has(prefix)) return prefix;
+	}
+	return "";
+};
+
+//#endregion
+//#region src/lockfile/npm.ts
+/** Root blocks in npm's precedence order — the first mention of a name wins. */
+const ROOT_KINDS$1 = [
+	LockedRootKind.Prod,
+	LockedRootKind.Optional,
+	LockedRootKind.Dev,
+	LockedRootKind.Peer
+];
+/**
+* The node resolution walk-up, over a flat map of install paths.
+*
+* A package at `node_modules/a/node_modules/b` depending on `c` gets, in order,
+* `node_modules/a/node_modules/b/node_modules/c`, then
+* `node_modules/a/node_modules/c`, then `node_modules/c`. This is what makes a
+* range on an edge unambiguous: the nesting already recorded which copy won.
+*/
+const NESTING = "/node_modules/";
+const parseNpmLockfile = (path, content, importer) => {
+	const root = parseJsonObject(path, content);
+	const version = String(root["lockfileVersion"] ?? "?");
+	const builder = new TreeBuilder();
+	const packages = root["packages"];
+	const entries = isRecord(packages) ? collectEntries(builder, packages) : collectLegacyEntries(builder, root);
+	for (const entry of entries.values()) builder.add({
+		name: entry.realName,
+		version: entry.version,
+		dependencies: edgesOf$1(builder, entries, entry)
+	});
+	collectRoots$1(builder, entries, isRecord(packages) ? packages : root, path, importer);
+	return builder.finish({
+		format: LockfileFormat.Npm,
+		lockfileVersion: version,
+		path,
+		importer
+	});
+};
+/** Narrows the v2/v3 `packages` map, dropping what cannot be bundled. */
+const collectEntries = (builder, packages) => {
+	const entries = /* @__PURE__ */ new Map();
+	for (const [entryPath, raw] of Object.entries(packages)) {
+		const installName = installNameFromPath(entryPath);
+		if (installName === null) continue;
+		if (!isRecord(raw)) continue;
+		if (raw["link"] === true) {
+			builder.skip(installName, stringOr(raw["resolved"], "link"), "workspace link");
+			continue;
+		}
+		const rawVersion = raw["version"];
+		if (typeof rawVersion !== "string") {
+			builder.warn(`skipped ${installName} — its lockfile entry records no version, so there is nothing to pin`);
+			continue;
+		}
+		const resolvedName = typeof raw["name"] === "string" ? raw["name"] : installName;
+		const version = asExactVersion(resolvedName, rawVersion);
+		if (version._tag === "Unsupported") {
+			builder.skip(resolvedName, rawVersion, version.reason);
+			continue;
+		}
+		const resolvedUrl = raw["resolved"];
+		if (typeof resolvedUrl === "string" && !isRegistryUrl(resolvedUrl)) {
+			builder.skip(resolvedName, resolvedUrl, "not a registry tarball");
+			continue;
+		}
+		entries.set(entryPath, {
+			path: entryPath,
+			version: version.version,
+			realName: resolvedName,
+			dependencies: stringRecord(raw["dependencies"]),
+			optionalDependencies: stringRecord(raw["optionalDependencies"]),
+			peerDependencies: stringRecord(raw["peerDependencies"]),
+			optionalPeers: optionalPeerNames(raw["peerDependenciesMeta"])
+		});
+	}
+	return entries;
+};
+/**
+* Flattens a v1 lockfile's nested `dependencies` tree into the same
+* path-keyed shape v2 uses.
+*
+* v1 is old — npm 6 — but it is exactly the vintage still pinned inside a lot
+* of the locked-down environments this tool exists for, so it is worth the
+* thirty lines rather than an error telling somebody to upgrade npm.
+*/
+const collectLegacyEntries = (builder, root) => {
+	const entries = /* @__PURE__ */ new Map();
+	const visit = (tree, prefix) => {
+		if (!isRecord(tree)) return;
+		for (const [name, raw] of Object.entries(tree)) {
+			if (!isRecord(raw)) continue;
+			const entryPath = prefix === "" ? `node_modules/${name}` : `${prefix}/node_modules/${name}`;
+			const rawVersion = raw["version"];
+			if (typeof rawVersion === "string") {
+				const version = asExactVersion(name, rawVersion);
+				if (version._tag === "Unsupported") builder.skip(name, rawVersion, version.reason);
+				else entries.set(entryPath, {
+					path: entryPath,
+					version: version.version,
+					realName: name,
+					dependencies: stringRecord(raw["requires"]),
+					optionalDependencies: {},
+					peerDependencies: {},
+					optionalPeers: /* @__PURE__ */ new Set()
+				});
+			}
+			visit(raw["dependencies"], entryPath);
+		}
+	};
+	visit(root["dependencies"], "");
+	return entries;
+};
+/** Turns one entry's ranges into edges, resolved through the directory nesting. */
+const edgesOf$1 = (builder, entries, entry) => {
+	const edges = [];
+	const add = (names, kind) => {
+		for (const name of names) {
+			const targetPath = resolveNestedEdge(entries, entry.path, name);
+			const target = targetPath === null ? void 0 : entries.get(targetPath);
+			if (target === void 0) {
+				if (kind === EdgeKind.Prod) builder.dangling(`${entry.realName}@${entry.version}`, name);
+				continue;
+			}
+			edges.push({
+				name: target.realName,
+				version: target.version,
+				kind
+			});
+		}
+	};
+	const optionalNames = Object.keys(entry.optionalDependencies);
+	const optional = new Set(optionalNames);
+	add(Object.keys(entry.dependencies).filter((name) => !optional.has(name)), EdgeKind.Prod);
+	add(optionalNames, EdgeKind.Optional);
+	add(Object.keys(entry.peerDependencies).filter((name) => !entry.optionalPeers.has(name)), EdgeKind.Peer);
+	return edges;
+};
+/**
+* Reads the root project's direct dependencies.
+*
+* The lockfile records these under `packages[""]` for v2/v3. v1 has no such
+* entry, so every top-level `node_modules/x` is treated as direct — which
+* over-counts roots slightly on v1 and is the best that file can support.
+*/
+const collectRoots$1 = (builder, entries, source, path, importer) => {
+	const collectFrom = (from, project) => {
+		for (const kind of ROOT_KINDS$1) {
+			const field = fieldByRootKind[kind];
+			for (const [name, specifier] of Object.entries(stringRecord(project[field]))) {
+				const targetPath = resolveNestedEdge(entries, from, name);
+				const target = targetPath === null ? void 0 : entries.get(targetPath);
+				if (target === void 0) continue;
+				builder.addRoot({
+					name: target.realName,
+					version: target.version,
+					kind,
+					specifier
+				});
+			}
+		}
+	};
+	if (importer !== void 0) {
+		const key = importerKey(importer);
+		const project = source[key];
+		if (!isRecord(project)) notCovered(path, importer, workspacePaths(source));
+		else collectFrom(key, project);
+		return;
+	}
+	const projects = Object.entries(source).flatMap(([key, value]) => isRecord(value) && !key.includes("node_modules/") ? [[key, value]] : []);
+	if (projects.length > 0) {
+		for (const [key, project] of projects) collectFrom(key, project);
+		return;
+	}
+	for (const entry of entries.values()) {
+		if (entry.path.includes(NESTING)) continue;
+		builder.addRoot({
+			name: entry.realName,
+			version: entry.version,
+			kind: LockedRootKind.Prod
+		});
+	}
+};
+/** The workspace paths a v2/v3 lockfile records, for a "does not cover" message. */
+const workspacePaths = (source) => Object.keys(source).flatMap((key) => key === "" ? "." : key.includes("node_modules/") ? [] : key);
+/**
+* npm records non-registry sources as a URL in `resolved`. Registry tarballs
+* are ordinary http(s); anything with a `git+`, `file:` or bare path form is
+* something we cannot fetch.
+*/
+const isRegistryUrl = (url) => url.startsWith("http://") || url.startsWith("https://");
+const resolveNestedEdge = (entries, fromPath, name) => {
+	let scope = fromPath;
+	for (;;) {
+		const candidate = scope === "" ? `node_modules/${name}` : `${scope}${NESTING}${name}`;
+		if (entries.has(candidate)) return candidate;
+		if (scope === "") return null;
+		const at = scope.lastIndexOf(NESTING);
+		scope = at === -1 ? "" : scope.slice(0, at);
+	}
+};
+/** `node_modules/@babel/core` -> `@babel/core`; a workspace path -> `null`. */
+const installNameFromPath = (entryPath) => {
+	const at = entryPath.lastIndexOf("node_modules/");
+	if (at === -1) return null;
+	const name = entryPath.slice(at + 13);
+	return name.length === 0 ? null : name;
+};
+
+//#endregion
+//#region src/lockfile/pnpm.ts
+/** pnpm never records peer dependencies against an importer. */
+const ROOT_KINDS = [
+	LockedRootKind.Prod,
+	LockedRootKind.Optional,
+	LockedRootKind.Dev
+];
+const parsePnpmLockfile = (path, content, importer) => {
+	let root;
+	try {
+		root = parse(content);
+	} catch (error) {
+		throw new LockfileError(path, `not valid YAML — ${describeError$1(error)}`, { cause: error });
+	}
+	if (!isRecord(root)) throw new LockfileError(path, "top level is not a mapping");
+	const version = String(root["lockfileVersion"] ?? "?");
+	const builder = new TreeBuilder();
+	const packages = isRecord(root["packages"]) ? root["packages"] : {};
+	const snapshots = isRecord(root["snapshots"]) ? root["snapshots"] : packages;
+	const known = /* @__PURE__ */ new Map();
+	for (const key of Object.keys(packages)) {
+		const parsed = parsePnpmKey(key);
+		if (parsed === null) continue;
+		known.set(key, parsed);
+	}
+	for (const [key, raw] of Object.entries(snapshots)) {
+		const parsed = parsePnpmKey(key) ?? known.get(key);
+		if (parsed === void 0 || parsed === null) {
+			const described = describeKey(key);
+			if (described !== null) builder.skip(described.name, described.spec, described.reason);
+			continue;
+		}
+		builder.add({
+			name: parsed.name,
+			version: parsed.version,
+			dependencies: edgesOf(builder, parsed, isRecord(raw) ? raw : {})
+		});
+	}
+	collectRoots(builder, root, path, importer);
+	return builder.finish({
+		format: LockfileFormat.Pnpm,
+		lockfileVersion: version,
+		path,
+		importer
+	});
+};
+const edgesOf = (builder, from, snapshot) => {
+	const edges = [];
+	const add = (field, kind) => {
+		const entries = snapshot[field];
+		if (!isRecord(entries)) return;
+		for (const [name, raw] of Object.entries(entries)) {
+			if (typeof raw !== "string") continue;
+			const target = parsePnpmReference(name, raw);
+			if (target === null) {
+				if (kind === EdgeKind.Prod) builder.dangling(`${from.name}@${from.version}`, name);
+				continue;
+			}
+			edges.push({
+				...target,
+				kind
+			});
+		}
+	};
+	add(fieldByRootKind[LockedRootKind.Prod], EdgeKind.Prod);
+	add(fieldByRootKind[LockedRootKind.Optional], EdgeKind.Optional);
+	add(fieldByRootKind[LockedRootKind.Peer], EdgeKind.Peer);
+	return edges;
+};
+/**
+* The importers' direct dependencies become the roots.
+*
+* pnpm is the format that makes this easy: `importers` is already keyed by the
+* path each package.json sits at, so scoping to one member is a lookup rather
+* than a reconstruction.
+*/
+const collectRoots = (builder, root, path, member) => {
+	const importers = isRecord(root["importers"]) ? root["importers"] : { ".": root };
+	const selected = member === void 0 ? Object.values(importers) : Object.hasOwn(importers, member) ? [importers[member]] : notCovered(path, member, Object.keys(importers));
+	for (const importer of selected) {
+		if (!isRecord(importer)) continue;
+		for (const kind of ROOT_KINDS) {
+			const entries = importer[fieldByRootKind[kind]];
+			if (!isRecord(entries)) continue;
+			for (const [name, raw] of Object.entries(entries)) {
+				const value = typeof raw === "string" ? raw : isRecord(raw) ? raw["version"] : void 0;
+				if (typeof value !== "string") continue;
+				const target = parsePnpmReference(name, value);
+				if (target === null) continue;
+				const specifier = isRecord(raw) && typeof raw["specifier"] === "string" ? raw["specifier"] : void 0;
+				builder.addRoot({
+					...target,
+					kind,
+					specifier
+				});
+			}
+		}
+	}
+};
+/**
+* Reads a dependency value from a snapshot or importer.
+*
+* The value is either a bare version (`1.4.0`) or a full package key
+* (`/lodash@4.17.21`, used when the install name is an alias of another
+* package). Both may carry a peer-resolution suffix in parentheses.
+*/
+const parsePnpmReference = (name, raw) => {
+	const value = stripSuffix(raw);
+	const exact = semver.valid(value, { loose: true });
+	if (exact !== null) return {
+		name,
+		version: exact
+	};
+	return parsePnpmKey(raw);
+};
+/**
+* Splits a package key into name and version.
+*
+* Three encodings across the versions still in the wild:
+*   v5  `/@babel/core/7.0.0`
+*   v6  `/@babel/core@7.0.0`
+*   v9  `@babel/core@7.0.0`
+*
+* plus an optional `(peer@1.0.0)` or `(patch_hash=…)` suffix on any of them.
+*/
+const parsePnpmKey = (key) => {
+	const body = stripSuffix(key.startsWith("/") ? key.slice(1) : key);
+	const at = body.lastIndexOf("@");
+	const cut = at > 0 ? at : body.lastIndexOf("/");
+	if (cut <= 0) return null;
+	const name = body.slice(0, cut);
+	const version = semver.valid(body.slice(cut + 1), { loose: true });
+	if (version === null || name.length === 0) return null;
+	return {
+		name,
+		version
+	};
+};
+/** Describes a key we cannot pin, so the skip warning can say why. */
+const describeKey = (key) => {
+	const body = key.startsWith("/") ? key.slice(1) : key;
+	const at = body.lastIndexOf("@");
+	if (at <= 0) return null;
+	const name = body.slice(0, at);
+	const spec = body.slice(at + 1);
+	const target = parseDependencyTarget(name, spec);
+	return {
+		name,
+		spec,
+		reason: target._tag === "Unsupported" ? target.reason : "not an exact version"
+	};
+};
+/**
+* Drops the parenthesised peer-resolution suffix.
+*
+* pnpm distinguishes the same version installed against different peers —
+* `react-dom@18.3.1(react@18.3.1)`. Those are the same published tarball, which
+* is all this tool downloads, so the suffix is noise here.
+*/
+const stripSuffix = (value) => {
+	const open = value.indexOf("(");
+	return open === -1 ? value : value.slice(0, open);
+};
+
+//#endregion
+//#region src/lockfile/parse.ts
+/**
+* Parses lockfile content into a flat graph.
+*
+* Throws `LockfileError`; the caller is expected to be inside an `Effect.try`.
+*/
+const parseLockfile = (path, content, format, options = {}) => {
+	const resolved = format ?? resolveFormat(path, content);
+	const importer = options.importer;
+	switch (resolved) {
+		case LockfileFormat.Npm: return parseNpmLockfile(path, content, importer);
+		case LockfileFormat.Pnpm: return parsePnpmLockfile(path, content, importer);
+		case LockfileFormat.Bun: return parseBunLockfile(path, content, importer);
+	}
+};
+const resolveFormat = (path, content) => {
+	const detected = detectLockfile(content);
+	if (detected._tag === "Supported") return detected.format;
+	if (detected._tag === "Unsupported") throw new LockfileError(path, `${detected.label} — ${detected.hint}`);
+	throw new LockfileError(path, "content does not look like a package-lock.json, pnpm-lock.yaml or bun.lock");
+};
+
+//#endregion
+//#region src/schemas/package-json.ts
+const PackageJsonSchema = Schema.Struct({
+	dependencies: tolerant(StringRecordSchema),
+	devDependencies: tolerant(StringRecordSchema),
+	optionalDependencies: tolerant(StringRecordSchema),
+	peerDependencies: tolerant(StringRecordSchema),
+	peerDependenciesMeta: tolerant(OptionalFlagRecordSchema)
+});
+const decodePackageJson = Schema.decodeUnknownOption(PackageJsonSchema);
+
+//#endregion
+//#region src/input-file.ts
+const defaultInputFileOptions = { includeDev: true };
+/** Reads and parses an input file. */
+const readInputFile = (filePath, options = defaultInputFileOptions) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	if (!(yield* fs.exists(filePath).pipe(Effect.mapError((cause) => new InvalidInputFileError(filePath, "could not be read", { cause }))))) return yield* Effect.fail(new InvalidInputFileError(filePath, "file does not exist"));
+	const content = yield* fs.readFileString(filePath).pipe(Effect.mapError((cause) => new InvalidInputFileError(filePath, "could not be read", { cause })));
+	return yield* Effect.try({
+		try: () => parseInputFile(filePath, content, options),
+		catch: (error) => error instanceof InvalidInputFileError || isLockfileError(error) ? error : new InvalidInputFileError(filePath, describeError(error), { cause: error })
+	});
+});
+const isLockfileError = (error) => error instanceof Error && "_tag" in error && error._tag === "LockfileError";
+/**
+* Parses file content that has already been read.
+*
+* Split out from the IO so the whole of this logic is testable with plain
+* strings and no file system at all.
+*/
+const parseInputFile = (filePath, content, options = defaultInputFileOptions) => {
+	const trimmed = content.trim();
+	if (trimmed.length === 0) throw new InvalidInputFileError(filePath, "file is empty");
+	const detected = detectLockfile(trimmed);
+	if (detected._tag === "Unsupported") throw new InvalidInputFileError(filePath, `${detected.label} — ${detected.hint}`);
+	if (detected._tag === "Supported") return fromLockfile(filePath, content, detected.format, options);
+	return looksLikeJson(trimmed) ? fromPackageJson(filePath, trimmed, options) : fromList(filePath, content);
+};
+const looksLikeJson = (trimmed) => trimmed.startsWith("{");
+const fromLockfile = (filePath, content, format, options) => {
+	const lockfile = parseLockfile(filePath, content, format, { importer: options.importer });
+	const roots = lockfile.roots.filter((root) => options.includeDev || root.kind !== "dev");
+	return {
+		kind: InputFileKind.Lockfile,
+		specs: roots.map((root) => ({
+			name: root.name,
+			selector: {
+				_tag: "Exact",
+				version: root.version
+			},
+			raw: `${root.name}@${root.version}`
+		})),
+		warnings: lockfile.warnings,
+		lockfile
+	};
+};
+const fromPackageJson = (filePath, content, options) => {
+	const parsed = parsePackageJson(filePath, content);
+	const specs = [];
+	const warnings = [];
+	const required = [];
+	const seen = /* @__PURE__ */ new Set();
+	const collect = (entries, label, skip) => {
+		if (entries === void 0) return;
+		for (const [name, raw] of Object.entries(entries)) {
+			if (skip?.(name)) continue;
+			const target = parseDependencyTarget(name, raw);
+			if (target._tag === "Unsupported") {
+				warnings.push(`${label}: skipped ${name}@${target.raw} (${target.reason}) — not fetchable from a registry`);
+				continue;
+			}
+			if (label === "dependencies" || label === "devDependencies") required.push(target.name);
+			const key = `${target.name}|${JSON.stringify(target.selector)}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			specs.push({
+				name: target.name,
+				selector: target.selector,
+				raw: `${target.name}@${raw}`
+			});
+		}
+	};
+	collect(parsed.dependencies, "dependencies");
+	collect(parsed.optionalDependencies, "optionalDependencies");
+	if (options.includeDev) collect(parsed.devDependencies, "devDependencies");
+	const meta = parsed.peerDependenciesMeta ?? {};
+	collect(parsed.peerDependencies, "peerDependencies", (name) => meta[name]?.optional === true);
+	if (specs.length === 0) throw new InvalidInputFileError(filePath, options.includeDev ? "package.json declares no dependencies to bundle" : "package.json declares no non-dev dependencies to bundle (drop --prod to include devDependencies)");
+	return {
+		kind: InputFileKind.PackageJson,
+		specs,
+		warnings,
+		required
+	};
+};
+/**
+* Reads a package.json, or gives up on its contents rather than on the run.
+*
+* Invalid JSON is an error worth raising — somebody pointed `--file` at a
+* broken file. A well-formed JSON document this schema cannot recognise is
+* not: it decodes to no blocks, and the caller reports "declares no
+* dependencies to bundle", which is both true and more useful.
+*/
+const parsePackageJson = (filePath, content) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(content);
+	} catch (error) {
+		throw new InvalidInputFileError(filePath, `not valid JSON — ${describeError(error)}`, { cause: error });
+	}
+	return Option.getOrElse(decodePackageJson(parsed), () => ({}));
+};
+const fromList = (filePath, content) => {
+	const rawLines = content.split(/\r?\n/);
+	const lines = rawLines.flatMap((line) => {
+		const withoutComment = stripComment(line).trim();
+		return withoutComment.length === 0 ? [] : withoutComment;
+	});
+	if (lines.length === 0) throw new InvalidInputFileError(filePath, "no package specs found (only blank lines and comments)");
+	const { specs, errors } = parseSpecs(lines);
+	if (errors.length > 0) throw new InvalidInputFileError(filePath, formatSpecErrors(errors, rawLines));
+	return {
+		kind: InputFileKind.List,
+		specs,
+		warnings: []
+	};
+};
+/**
+* Strips `#` and `//` comments.
+*
+* `//` only counts when it is not part of a URL, so a future line containing
+* `https://…` does not get silently truncated.
+*/
+const stripComment = (line) => {
+	const hash = line.indexOf("#");
+	const result = hash === -1 ? line : line.slice(0, hash);
+	const slashes = result.indexOf("//");
+	if (slashes === 0) return "";
+	if (slashes > 0 && result[slashes - 1] !== ":") return result.slice(0, slashes);
+	return result;
+};
+const formatSpecErrors = (errors, rawLines) => {
+	const details = errors.map((error) => {
+		const index = rawLines.findIndex((line) => stripComment(line).trim() === error.spec);
+		const where = index === -1 ? "" : ` (line ${index + 1})`;
+		return `    ${error.spec}${where}: ${error.reason}`;
+	});
+	return `${errors.length} invalid spec(s):\n${details.join("\n")}`;
+};
+const describeError = (error) => error instanceof Error ? error.message : String(error);
+
+//#endregion
+//#region src/download.ts
+/**
+* Downloads every package into `destDir`, laid out the way a registry serves
+* them.
+*
+* `verifyIntegrity` defaulting to on is deliberate: a corrupt tarball that
+* makes it into a corporate registry is far more expensive than a failed run.
+*/
+const downloadAll = (packages, destDir, options) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const registry = yield* Registry;
+	yield* emit({
+		_tag: "PhaseStarted",
+		phase: Phase.Download,
+		total: packages.length
 	});
-	const state = makeWalkState();
-	const roots = [];
-	for (const spec of specs) {
-		const packument = yield* getPackument(state, spec.name);
-		const versions = yield* Effect.try({
-			try: () => selectVersions(packument, spec.selector, {
-				all: options.allVersions,
-				maxVersions: options.maxVersions,
-				includePrerelease: options.includePrerelease
-			}),
-			catch: (error) => error
+	let completed = 0;
+	const sizes = /* @__PURE__ */ new Map();
+	const unverified = [];
+	const results = yield* Effect.forEach(packages, (pkg) => Effect.gen(function* () {
+		const key = `${pkg.name}@${pkg.version}`;
+		yield* emit({
+			_tag: "DownloadStarted",
+			name: pkg.name,
+			version: pkg.version
 		});
-		const closures = /* @__PURE__ */ new Map();
-		const union = /* @__PURE__ */ new Set();
-		for (const version of versions) {
-			const closure = yield* walk(state, [{
-				name: spec.name,
-				selector: {
-					_tag: "Exact",
-					version
-				},
-				reason: {
-					_tag: "Root",
-					spec: formatSpec(spec)
-				},
-				tolerateFailure: false
-			}], options);
-			closures.set(version, closure);
-			for (const key of closure) union.add(key);
+		const bytes = yield* registry.download(pkg.manifest);
+		if (options.verifyIntegrity) {
+			const result = yield* verify(bytes, pkg.manifest.dist);
+			if (result._tag === "Mismatch") return yield* Effect.fail(new IntegrityError(pkg.name, pkg.version, result.expected, result.actual));
+			if (result._tag === "Unverifiable") yield* emit({
+				_tag: "Warning",
+				message: `${key} could not be verified (${result.reason})`
+			});
 		}
-		roots.push({
-			spec,
-			versions,
-			closures,
-			closure: [...union]
+		const verifiable = (pkg.manifest.dist.integrity?.length ?? 0) > 0 || (pkg.manifest.dist.shasum?.length ?? 0) > 0;
+		const relative = packagePath(pkg.name, pkg.version);
+		const target = path.join(destDir, ...relative.split("/"));
+		yield* fs.makeDirectory(path.dirname(target), { recursive: true }).pipe(Effect.mapError((cause) => new OutputError(path.dirname(target), "could not create directory", { cause })));
+		yield* fs.writeFile(target, bytes).pipe(Effect.mapError((cause) => new OutputError(target, "could not write tarball", { cause })));
+		completed += 1;
+		yield* emit({
+			_tag: "DownloadCompleted",
+			name: pkg.name,
+			version: pkg.version,
+			bytes: bytes.byteLength,
+			completedCount: completed,
+			totalCount: packages.length
 		});
+		return {
+			key,
+			bytes: bytes.byteLength,
+			verifiable
+		};
+	}), { concurrency: options.concurrency });
+	for (const result of results) {
+		sizes.set(result.key, result.bytes);
+		if (!result.verifiable) unverified.push(result.key);
 	}
 	yield* emit({
 		_tag: "PhaseCompleted",
-		phase: "resolve"
+		phase: Phase.Download
 	});
 	return {
-		roots,
-		packages: [...state.resolved.values()].sort(compareResolved),
-		warnings: state.warnings
+		sizes,
+		unverified,
+		totalBytes: results.reduce((sum, result) => sum + result.bytes, 0)
 	};
 });
-const compareResolved = (a, b) => {
-	if (a.name !== b.name) return a.name < b.name ? -1 : 1;
-	return semver.valid(a.version) && semver.valid(b.version) ? semver.compare(a.version, b.version) : a.version.localeCompare(b.version);
-};
 
 //#endregion
-//#region src/Bundle.ts
-var Bundle_exports = /* @__PURE__ */ __export({
-	bundle: () => bundle,
-	bundleResolved: () => bundleResolved,
-	plan: () => plan,
-	plannedOutputs: () => plannedOutputs,
-	summarize: () => summarize,
-	withLayout: () => withLayout
-});
+//#region src/bundle.ts
+/**
+* The archives `per-spec` emits — one per distinct root package version.
+*
+* Roots are *specs*, and several specs can name one package: `react`,
+* `react@latest` and `react@19.2.8` are three ways of asking for the same
+* thing, and after resolution they are indistinguishable. Without this they
+* were three archives — the same bytes, under the same file name, written over
+* each other. The run then reported three artifacts and three times the size
+* for one file on disk, and the duplication ratio it computes to decide whether
+* to ask about the layout counted them too, so the tool would offer to
+* deduplicate a bundle it had duplicated itself.
+*
+* Keyed by name and version rather than by the archive's file name. A scoped
+* name is flattened to make a file name, so `@foo/bar` and `foo-bar` can spell
+* the same one — and those are two different packages, which should collide
+* loudly rather than being merged here.
+*
+* Roots only. The packages *inside* an archive were deduplicated by resolution
+* long before this, which is why the same closure fetched from twenty specs is
+* fetched once.
+*/
+const perSpecTargets = (resolution) => {
+	const seen = /* @__PURE__ */ new Set();
+	return resolution.roots.flatMap((root) => root.versions.flatMap((version) => {
+		const key = `${root.spec.name}@${version}`;
+		if (seen.has(key)) return [];
+		seen.add(key);
+		return {
+			root,
+			version
+		};
+	}));
+};
 /** Computes the plan summary for a resolution. */
 const summarize = (resolution) => {
 	let perSpecArchives = 0;
 	let perSpecEntries = 0;
-	for (const root of resolution.roots) for (const version of root.versions) {
+	for (const { root, version } of perSpecTargets(resolution)) {
 		perSpecArchives += 1;
 		perSpecEntries += (root.closures.get(version) ?? []).length;
 	}
@@ -1345,17 +2488,33 @@ const withLayout = (options, layout) => ({
 * expected.
 */
 const plan = (specs, options) => Effect.gen(function* () {
+	yield* preflight;
+	return yield* resolve(specs, options);
+});
+/**
+* The lockfile counterpart of `plan`.
+*
+* Same preflight, same `Resolution` out; the difference is entirely in how the
+* package set is arrived at. Kept as a separate entry point rather than an
+* option on `plan` because the two take genuinely different inputs — a set of
+* specs to satisfy versus a graph to reproduce — and blurring that is how a
+* "pinned" run quietly starts resolving ranges again.
+*/
+const planLocked = (lockfile, options) => Effect.gen(function* () {
+	yield* preflight;
+	return yield* resolveLocked(lockfile, options);
+});
+const preflight = Effect.gen(function* () {
 	const registry = yield* Registry;
 	yield* emit({
 		_tag: "PhaseStarted",
-		phase: "preflight"
+		phase: Phase.Preflight
 	});
 	yield* registry.preflight;
 	yield* emit({
 		_tag: "PhaseCompleted",
-		phase: "preflight"
+		phase: Phase.Preflight
 	});
-	return yield* resolve(specs, options);
 });
 /**
 * Resolves, downloads and packages a set of specs.
@@ -1367,6 +2526,10 @@ const plan = (specs, options) => Effect.gen(function* () {
 const bundle = (specs, options) => Effect.gen(function* () {
 	return yield* bundleResolved(yield* plan(specs, options), options);
 });
+/** `bundle`, pinned to a lockfile. */
+const bundleLocked = (lockfile, options) => Effect.gen(function* () {
+	return yield* bundleResolved(yield* planLocked(lockfile, options), options);
+});
 /**
 * Downloads and packages an already-computed resolution.
 *
@@ -1384,6 +2547,21 @@ const bundleResolved = (resolution, options) => Effect.gen(function* () {
 	};
 	return yield* Effect.scoped(runBundle(resolution, options));
 });
+/**
+* The files a run will write.
+*
+* Computed before anything is downloaded, so a collision is reported in the
+* first second rather than after a twenty-minute transfer.
+*/
+const plannedOutputs = (resolution, options) => {
+	if (options.layout === Layout.Dir) return [{ file: MANIFEST_FILE }, { file: README_FILE }];
+	if (options.layout === Layout.Single) return [{ file: singleArchiveName(options.archiveName ?? "bundle") }];
+	return perSpecTargets(resolution).map(({ root, version }) => ({
+		file: perSpecArchiveName(root.spec.name, version),
+		name: root.spec.name,
+		version
+	}));
+};
 const runBundle = (resolution, options) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
@@ -1398,42 +2576,25 @@ const runBundle = (resolution, options) => Effect.gen(function* () {
 	});
 	yield* emit({
 		_tag: "PhaseStarted",
-		phase: "archive"
+		phase: Phase.Archive
 	});
-	const registryInfo = {
-		kind: registry.kind,
-		url: registry.registryFor(resolution.roots[0]?.spec.name ?? "")
-	};
-	const index = indexPackages(resolution);
-	const artifacts = options.layout === "single" ? yield* emitSingle({
-		resolution,
-		options,
-		staging,
-		packagesDir,
-		report,
-		registryInfo
-	}) : options.layout === "dir" ? yield* emitDirectory({
-		resolution,
-		options,
-		packagesDir,
-		report,
-		registryInfo
-	}) : yield* emitPerSpec({
+	const artifacts = yield* emit$1({
 		resolution,
 		options,
-		staging,
 		packagesDir,
 		report,
-		registryInfo,
-		index
-	});
+		registryInfo: {
+			kind: registry.kind,
+			url: registry.registryFor(resolution.roots[0]?.spec.name ?? "")
+		}
+	}, staging);
 	yield* emit({
 		_tag: "PhaseCompleted",
-		phase: "archive"
+		phase: Phase.Archive
 	});
 	yield* emit({
 		_tag: "PhaseStarted",
-		phase: "done"
+		phase: Phase.Done
 	});
 	return {
 		resolution,
@@ -1443,6 +2604,13 @@ const runBundle = (resolution, options) => Effect.gen(function* () {
 		dryRun: false
 	};
 });
+const emit$1 = (input, staging) => {
+	switch (input.options.layout) {
+		case Layout.Single: return emitSingle(input);
+		case Layout.Dir: return emitDirectory(input);
+		case Layout.PerSpec: return emitPerSpec(input, staging);
+	}
+};
 /** One tarball containing the deduplicated union of every closure. */
 const emitSingle = (input) => Effect.gen(function* () {
 	const path = yield* Path.Path;
@@ -1463,7 +2631,7 @@ const emitSingle = (input) => Effect.gen(function* () {
 		outPath
 	});
 	return [{
-		kind: "archive",
+		kind: ArtifactKind.Archive,
 		path: result.path,
 		bytes: result.bytes,
 		packageCount: input.resolution.packages.length
@@ -1483,7 +2651,7 @@ const emitDirectory = (input) => Effect.gen(function* () {
 	yield* fs.copy(input.packagesDir, input.options.outDir, { overwrite: true }).pipe(Effect.mapError((cause) => new OutputError(input.options.outDir, "could not write output tree", { cause })));
 	const bytes = [...input.report.sizes.values()].reduce((a, b) => a + b, 0);
 	return [{
-		kind: "directory",
+		kind: ArtifactKind.Directory,
 		path: input.options.outDir,
 		bytes,
 		packageCount: input.resolution.packages.length
@@ -1496,15 +2664,16 @@ const emitDirectory = (input) => Effect.gen(function* () {
 * `react-18.1.0.tgz` and so on, each independently importable — which is the
 * whole reason to prefer this layout.
 */
-const emitPerSpec = (input) => Effect.gen(function* () {
+const emitPerSpec = (input, staging) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
+	const index = indexPackages(input.resolution);
 	const artifacts = [];
 	let counter = 0;
-	for (const root of input.resolution.roots) for (const version of root.versions) {
+	for (const { root, version } of perSpecTargets(input.resolution)) {
 		if (input.options.skipExisting?.has(perSpecArchiveName(root.spec.name, version)) === true) continue;
-		const included = (root.closures.get(version) ?? []).map((key) => input.index.get(key)).filter((pkg) => pkg !== void 0);
-		const rootDir = path.join(input.staging, "roots", String(counter++));
+		const included = includedPackages(index, root.closures.get(version) ?? []);
+		const rootDir = path.join(staging, "roots", String(counter++));
 		yield* fs.makeDirectory(rootDir, { recursive: true });
 		for (const pkg of included) {
 			const parts = packagePath(pkg.name, pkg.version).split("/");
@@ -1534,7 +2703,7 @@ const emitPerSpec = (input) => Effect.gen(function* () {
 			outPath
 		});
 		artifacts.push({
-			kind: "archive",
+			kind: ArtifactKind.Archive,
 			path: result.path,
 			bytes: result.bytes,
 			packageCount: included.length,
@@ -1544,6 +2713,7 @@ const emitPerSpec = (input) => Effect.gen(function* () {
 	}
 	return artifacts;
 });
+const includedPackages = (index, closure) => closure.flatMap((key) => index.get(key) ?? []);
 /**
 * Hard-links a file, falling back to a copy.
 *
@@ -1578,17 +2748,50 @@ const writeBundleMetadata = (input) => Effect.gen(function* () {
 });
 /** Sorted top-level entries of a directory, used as the tar entry list. */
 const topLevelEntries = (dir) => Effect.gen(function* () {
-	return [...yield* (yield* FileSystem.FileSystem).readDirectory(dir)].sort();
+	return (yield* (yield* FileSystem.FileSystem).readDirectory(dir)).toSorted();
+});
+/**
+* Two different packages must not want the same file name.
+*
+* Most of what this used to catch is now impossible: an archive is named for
+* the spec, `@types-react@19.2.18.tgz`, and an unscoped npm name may not begin
+* with `@`, so it cannot spell a scoped one. What survives is **two scoped
+* packages whose scope boundary falls in a different place**, because that
+* boundary is the one character the file name drops:
+*
+*     @a/b-c  ->  @a-b-c@1.0.0.tgz
+*     @a-b/c  ->  @a-b-c@1.0.0.tgz
+*
+* Pathological rather than plausible — it needs somebody to hold the `@a-b`
+* scope as well as `@a`, and both packages in one run at one version. It is
+* kept anyway because of what it costs to be wrong: they are *different
+* packages*, so deduplicating them would be wrong, and writing both is worse —
+* the second lands on the first and the run reports two artifacts for the one
+* file that survived. A bundle short a package, called complete, found at the
+* far end of an air gap by somebody who cannot go and fetch the missing one.
+*
+* Nothing else would catch it. The overwrite check below compares this run's
+* planned files against what is *already on disk*, and both of these are new.
+*
+* So it refuses, and names both specs. Not silently renamed: an archive whose
+* name nobody chose is a file somebody has to identify later.
+*
+* Unconditional, unlike the overwrite check: `--force` is permission to replace
+* what was already in the directory, not to let one run overwrite itself.
+*/
+const assertDistinctOutputs = (resolution, options) => Effect.gen(function* () {
+	const owners = /* @__PURE__ */ new Map();
+	for (const planned of plannedOutputs(resolution, options)) {
+		const claimed = owners.get(planned.file);
+		const spec = planned.name === void 0 ? planned.file : `${planned.name}@${planned.version}`;
+		if (claimed === void 0) owners.set(planned.file, [spec]);
+		else claimed.push(spec);
+	}
+	const collisions = [...owners].filter(([, specs]) => specs.length > 1);
+	if (collisions.length === 0) return;
+	const described = collisions.map(([file, specs]) => `${specs.join(" and ")} would both be ${file}`).join("; ");
+	return yield* Effect.fail(new OutputError(options.outDir, `two packages want the same archive name — ${described}. The \`/\` in a scope becomes a \`-\` to make a file name, so \`@a/b-c\` and \`@a-b/c\` meet. Use --layout single, or bundle them into separate --out directories.`));
 });
-const plannedOutputs = (resolution, options) => {
-	if (options.layout === "dir") return [{ file: MANIFEST_FILE }, { file: README_FILE }];
-	if (options.layout === "single") return [{ file: singleArchiveName(options.archiveName ?? "bundle") }];
-	return resolution.roots.flatMap((root) => root.versions.map((version) => ({
-		file: perSpecArchiveName(root.spec.name, version),
-		name: root.spec.name,
-		version
-	})));
-};
 /**
 * Fails if the run would overwrite something, unless `--force`.
 *
@@ -1599,12 +2802,14 @@ const plannedOutputs = (resolution, options) => {
 * default `.` unusable.
 *
 * Checked before anything is downloaded. Discovering the collision *after* a
-* twenty-minute download would be a uniquely irritating way to fail.
+* twenty-minute download would be a uniquely irritating way to fail — which is
+* also why `assertDistinctOutputs` runs from here rather than at emit time.
 */
 const prepareOutputDir = (resolution, options) => Effect.gen(function* () {
 	const fs = yield* FileSystem.FileSystem;
 	const path = yield* Path.Path;
 	const outDir = options.outDir;
+	yield* assertDistinctOutputs(resolution, options);
 	if (!options.force) {
 		const clashes = [];
 		for (const planned of plannedOutputs(resolution, options)) {
@@ -1618,149 +2823,5 @@ const prepareOutputDir = (resolution, options) => Effect.gen(function* () {
 });
 
 //#endregion
-//#region src/InputFile.ts
-var InputFile_exports = /* @__PURE__ */ __export({
-	defaultInputFileOptions: () => defaultInputFileOptions,
-	parseInputFile: () => parseInputFile,
-	readInputFile: () => readInputFile
-});
-const defaultInputFileOptions = { includeDev: true };
-/** Reads and parses an input file. */
-const readInputFile = (filePath, options = defaultInputFileOptions) => Effect.gen(function* () {
-	const fs = yield* FileSystem.FileSystem;
-	if (!(yield* fs.exists(filePath).pipe(Effect.mapError((cause) => new InvalidInputFileError(filePath, "could not be read", { cause }))))) return yield* Effect.fail(new InvalidInputFileError(filePath, "file does not exist"));
-	const content = yield* fs.readFileString(filePath).pipe(Effect.mapError((cause) => new InvalidInputFileError(filePath, "could not be read", { cause })));
-	return yield* Effect.try({
-		try: () => parseInputFile(filePath, content, options),
-		catch: (error) => error instanceof InvalidInputFileError ? error : new InvalidInputFileError(filePath, describe(error), { cause: error })
-	});
-});
-/**
-* Parses file content that has already been read.
-*
-* Split out from the IO so the whole of this logic is testable with plain
-* strings and no file system at all.
-*/
-const parseInputFile = (filePath, content, options = defaultInputFileOptions) => {
-	const trimmed = content.trim();
-	if (trimmed.length === 0) throw new InvalidInputFileError(filePath, "file is empty");
-	return looksLikeJson(trimmed) ? fromPackageJson(filePath, trimmed, options) : fromList(filePath, content);
-};
-const looksLikeJson = (trimmed) => trimmed.startsWith("{");
-const fromPackageJson = (filePath, content, options) => {
-	let parsed;
-	try {
-		parsed = JSON.parse(content);
-	} catch (error) {
-		throw new InvalidInputFileError(filePath, `not valid JSON — ${describe(error)}`, { cause: error });
-	}
-	const specs = [];
-	const warnings = [];
-	const seen = /* @__PURE__ */ new Set();
-	const collect = (entries, label, skip) => {
-		if (entries === void 0) return;
-		for (const [name, raw] of Object.entries(entries)) {
-			if (skip?.(name)) continue;
-			const target = parseDependencyTarget(name, raw);
-			if (target._tag === "Unsupported") {
-				warnings.push(`${label}: skipped ${name}@${target.raw} (${target.reason}) — not fetchable from a registry`);
-				continue;
-			}
-			const key = `${target.name}|${JSON.stringify(target.selector)}`;
-			if (seen.has(key)) continue;
-			seen.add(key);
-			specs.push({
-				name: target.name,
-				selector: target.selector,
-				raw: `${target.name}@${raw}`
-			});
-		}
-	};
-	collect(parsed.dependencies, "dependencies");
-	collect(parsed.optionalDependencies, "optionalDependencies");
-	if (options.includeDev) collect(parsed.devDependencies, "devDependencies");
-	const meta = parsed.peerDependenciesMeta ?? {};
-	collect(parsed.peerDependencies, "peerDependencies", (name) => meta[name]?.optional === true);
-	if (specs.length === 0) throw new InvalidInputFileError(filePath, options.includeDev ? "package.json declares no dependencies to bundle" : "package.json declares no non-dev dependencies to bundle (drop --prod to include devDependencies)");
-	return {
-		kind: "package.json",
-		specs,
-		warnings
-	};
-};
-const fromList = (filePath, content) => {
-	const lines = [];
-	const rawLines = content.split(/\r?\n/);
-	for (const line of rawLines) {
-		const withoutComment = stripComment(line).trim();
-		if (withoutComment.length === 0) continue;
-		lines.push(withoutComment);
-	}
-	if (lines.length === 0) throw new InvalidInputFileError(filePath, "no package specs found (only blank lines and comments)");
-	const { specs, errors } = parseSpecs(lines);
-	if (errors.length > 0) throw new InvalidInputFileError(filePath, formatSpecErrors(errors, rawLines));
-	return {
-		kind: "list",
-		specs,
-		warnings: []
-	};
-};
-/**
-* Strips `#` and `//` comments.
-*
-* `//` only counts when it is not part of a URL, so a future line containing
-* `https://…` does not get silently truncated.
-*/
-const stripComment = (line) => {
-	const hash = line.indexOf("#");
-	let result = hash === -1 ? line : line.slice(0, hash);
-	const slashes = result.indexOf("//");
-	if (slashes > 0 && result[slashes - 1] !== ":") result = result.slice(0, slashes);
-	else if (slashes === 0) result = "";
-	return result;
-};
-const formatSpecErrors = (errors, rawLines) => {
-	const details = errors.map((error) => {
-		const index = rawLines.findIndex((line) => stripComment(line).trim() === error.spec);
-		const where = index === -1 ? "" : ` (line ${index + 1})`;
-		return `    ${error.spec}${where}: ${error.reason}`;
-	});
-	return `${errors.length} invalid spec(s):\n${details.join("\n")}`;
-};
-const describe = (error) => error instanceof Error ? error.message : String(error);
-
-//#endregion
-//#region src/Options.ts
-var Options_exports = /* @__PURE__ */ __export({
-	defaultBundleOptions: () => defaultBundleOptions,
-	defaultResolveOptions: () => defaultResolveOptions,
-	defaultScope: () => defaultScope,
-	layouts: () => layouts
-});
-const layouts = [
-	"per-spec",
-	"single",
-	"dir"
-];
-const defaultScope = {
-	optional: true,
-	peer: true,
-	platforms: allPlatforms
-};
-const defaultResolveOptions = {
-	scope: defaultScope,
-	allVersions: false,
-	includePrerelease: false,
-	concurrency: 10
-};
-const defaultBundleOptions = {
-	...defaultResolveOptions,
-	layout: "per-spec",
-	dryRun: false,
-	verifyIntegrity: true,
-	force: false
-};
-
-//#endregion
-export { Archive_exports as Archive, ArchiveError, AuthenticationError, Bundle_exports as Bundle, DependencyRange_exports as DependencyRange, Download_exports as Download, InputFile_exports as InputFile, Integrity_exports as Integrity, IntegrityError, InvalidInputFileError, InvalidSpecError, Layout_exports as Layout, Manifest_exports as Manifest, NoMatchingVersionsError, Options_exports as Options, OutputError, PackageNotFoundError, Platform_exports as Platform, Progress_exports as Progress, Progress as ProgressTag, Registry, RegistryResponseError, RegistryUnreachableError, Resolve_exports as Resolve, Spec_exports as Spec, VersionNotFoundError, allPlatforms, bundle, bundleResolved, currentPlatform, defaultBundleOptions, defaultResolveOptions, defaultScope, layouts, parsePlatformTarget, parseSpec, parseSpecs, plan, plannedOutputs, platformTargets, resolve, summarize, withLayout };
+export { ArchiveError, Archiver, ArtifactKind, AuthenticationError, DirectOnlyKind, EdgeKind, InputFileKind, IntegrityError, InvalidInputFileError, InvalidSpecError, Layout, Layouts, LockedRootKind, LockfileError, LockfileFormat, LockfileIncompleteError, LockfileOutOfDateError, MANIFEST_FILE, MANIFEST_VERSION, NoMatchingVersionsError, OptionalFlagRecordOrAbsentSchema, OptionalFlagRecordSchema, OptionalStringArraySchema, OptionalStringRecordSchema, OutputError, PackageNotFoundError, Phase, Progress, README_FILE, Registry, RegistryResponseError, RegistryUnreachableError, StringArraySchema, StringRecordSchema, VersionNotFoundError, allPlatforms, buildManifest, bundle, bundleLocked, bundleResolved, createArchive, currentPlatform, dedupeSpecs, defaultBundleOptions, defaultInputFileOptions, defaultResolveOptions, defaultScope, detectLockfile, digestOf, emit as emitProgress, formatByLockfileName, formatPlatformFilter, formatSelector, formatSpec, hexDigestOf, importGuide, indexPackages, isIncluded, isRecord, layerCallback as layerCallbackProgress, layerSilent as layerSilentProgress, lockfileNamesFor, makeCollector as makeProgressCollector, packageKey, packagePath, parseDependencyTarget, parseInputFile, parseIntegrity, parseLockfile, parsePlatformTarget, parseSpec, parseSpecs, perSpecArchiveName, plan, planLocked, plannedOutputs, platformTargets, readInputFile, resolve, resolveLocked, selectVersions, serializeManifest, singleArchiveName, splitName, summarize, tarballFileName, tolerant, verify as verifyIntegrity, withLayout };
 //# sourceMappingURL=index.js.map