@packall/core 0.0.1 → 0.2.0

package/dist/input-file.d.ts

@@ -0,0 +1,77 @@
+/**
+ * `--file` handling.
+ *
+ * One flag, three accepted shapes, detected from the content rather than the
+ * extension so that `--file deps.json` and `--file my-packages` both do the
+ * obvious thing:
+ *
+ * - a **package.json** — bundle everything it depends on
+ * - a **lockfile** — npm, pnpm or bun; bundle the exact versions it pins
+ * - a **newline-delimited list** — one spec per line, `#` and `//` comments
+ *   allowed, blank lines ignored
+ *
+ * A lockfile is checked for first, because `package-lock.json` and
+ * `package.json` are both JSON objects and only the content tells them apart.
+ */
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import { InputFileKind } from "./enums/input-file-kind.js";
+import type { LockfileError } from "./errors.js";
+import { InvalidInputFileError } from "./errors.js";
+import type { LockedTree } from "./lockfile/types.js";
+import type { PackageSpec } from "./spec.js";
+export type InputFileResult = {
+    readonly kind: InputFileKind;
+    readonly specs: ReadonlyArray<PackageSpec>;
+    /** Entries that were recognised but cannot be bundled from a registry. */
+    readonly warnings: ReadonlyArray<string>;
+    /**
+     * The pinned graph, set only for a lockfile.
+     *
+     * `specs` carries the same roots for display, but a lockfile run must resolve
+     * from this — see `locked-resolve` for why re-resolving the roots' ranges
+     * would quietly produce a different bundle.
+     */
+    readonly lockfile?: LockedTree | undefined;
+    /**
+     * Names from the blocks a package.json always installs — `dependencies` and,
+     * unless `--prod`, `devDependencies`.
+     *
+     * Used to check a lockfile against the manifest beside it. Deliberately
+     * excludes optional and peer entries: both are legitimately absent from a
+     * lockfile (an optional dependency that failed to build, a peer the consumer
+     * is expected to supply), so including them would turn a useful staleness
+     * check into a false alarm.
+     */
+    readonly required?: ReadonlyArray<string> | undefined;
+};
+/** Which dependency blocks of a package.json become root specs. */
+export type InputFileOptions = {
+    /**
+     * Include `devDependencies`.
+     *
+     * On by default: if you are pointing this tool at a package.json, you are
+     * almost certainly trying to make that project installable behind the
+     * firewall, and a project without its dev tooling does not build. `--prod`
+     * turns it off.
+     */
+    readonly includeDev: boolean;
+    /**
+     * For a lockfile, which workspace member's dependencies are the roots.
+     *
+     * Set when a package.json found its lockfile by walking up: the file then
+     * covers the whole repository, and only one member of it was asked for.
+     */
+    readonly importer?: string | undefined;
+};
+export declare const defaultInputFileOptions: InputFileOptions;
+/** Reads and parses an input file. */
+export declare const readInputFile: (filePath: string, options?: InputFileOptions) => Effect.Effect<InputFileResult, InvalidInputFileError | LockfileError, FileSystem.FileSystem>;
+/**
+ * Parses file content that has already been read.
+ *
+ * Split out from the IO so the whole of this logic is testable with plain
+ * strings and no file system at all.
+ */
+export declare const parseInputFile: (filePath: string, content: string, options?: InputFileOptions) => InputFileResult;
+//# sourceMappingURL=input-file.d.ts.map

package/dist/input-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-file.d.ts","sourceRoot":"","sources":["../src/input-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAIhD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE3D,OAAO,KAAK,EAAoB,aAAa,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC3C,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC3C;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CACtD,CAAC;AAEF,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GAAG;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,gBAAuC,CAAC;AAE9E,sCAAsC;AACtC,eAAO,MAAM,aAAa,aACf,MAAM,YACP,gBAAgB,KACvB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,qBAAqB,GAAG,aAAa,EAAE,UAAU,CAAC,UAAU,CAgC3F,CAAC;AAKJ;;;;;GAKG;AACH,eAAO,MAAM,cAAc,aAChB,MAAM,WACP,MAAM,YACN,gBAAgB,KACvB,eAoBF,CAAC"}

package/dist/integrity.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Checksum verification for downloaded tarballs.
+ *
+ * A failed check discards the download rather than warning and carrying on —
+ * see `notes/requirements.md` § FR-9 for why that strictness is a requirement
+ * rather than a preference.
+ *
+ * Built on Effect's `Crypto` service rather than `node:crypto` directly. The
+ * four digests `Crypto` offers — SHA-1, SHA-256, SHA-384, SHA-512 — are exactly
+ * the four npm publishes, so nothing is given up, and the same verification
+ * then runs unchanged against WebCrypto in a browser. Parsing stays here
+ * because the subset of Subresource Integrity npm actually emits is small and
+ * entirely mechanical; `ssri` would be a dependency for a regex.
+ */
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import type { PlatformError } from "effect/PlatformError";
+/**
+ * The digests npm publishes, mapped to what `Crypto.digest` calls them.
+ *
+ * Doubles as the supported-algorithm list: an SRI token whose algorithm is not
+ * a key here is one we cannot check, and is dropped during parsing.
+ */
+declare const digestAlgorithmByName: {
+    readonly sha512: "SHA-512";
+    readonly sha384: "SHA-384";
+    readonly sha256: "SHA-256";
+    readonly sha1: "SHA-1";
+};
+/** An algorithm this module can verify against. */
+export type IntegrityAlgorithm = keyof typeof digestAlgorithmByName;
+/** One parsed SRI hash. */
+export type IntegrityHash = {
+    readonly algorithm: IntegrityAlgorithm;
+    /** Base64 digest, exactly as written in the SRI string. */
+    readonly digest: string;
+};
+/**
+ * Parses an SRI string such as `sha512-abc...==`.
+ *
+ * npm permits several space-separated hashes; we keep every one we can verify
+ * and ignore algorithms we cannot.
+ */
+export declare const parseIntegrity: (integrity: string) => ReadonlyArray<IntegrityHash>;
+/** Computes the base64 digest of some bytes under one algorithm. */
+export declare const digestOf: (data: Uint8Array, algorithm: IntegrityAlgorithm) => Effect.Effect<string, PlatformError, Crypto.Crypto>;
+/** Computes the hex digest of some bytes — the form legacy `shasum` uses. */
+export declare const hexDigestOf: (data: Uint8Array, algorithm: IntegrityAlgorithm) => Effect.Effect<string, PlatformError, Crypto.Crypto>;
+/** Result of checking a download. */
+export type VerificationResult = 
+/** Verified against at least one checksum. */
+{
+    readonly _tag: "Verified";
+    readonly using: string;
+}
+/** The registry advertised no checksum we could use. */
+ | {
+    readonly _tag: "Unverifiable";
+    readonly reason: string;
+}
+/** A checksum was present and did not match. */
+ | {
+    readonly _tag: "Mismatch";
+    readonly expected: string;
+    readonly actual: string;
+};
+/**
+ * Checks bytes against whichever checksums the registry supplied.
+ *
+ * SRI is preferred; `shasum` is the fallback for versions published before
+ * integrity strings existed. If the registry gave us neither, that is reported
+ * as `Unverifiable` rather than silently treated as a pass — the caller decides
+ * whether to tolerate it.
+ */
+export declare const verify: (data: Uint8Array, dist: {
+    readonly integrity?: string | undefined;
+    readonly shasum?: string | undefined;
+}) => Effect.Effect<VerificationResult, PlatformError, Crypto.Crypto>;
+export {};
+//# sourceMappingURL=integrity.d.ts.map

package/dist/integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.d.ts","sourceRoot":"","sources":["../src/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;GAKG;AACH,QAAA,MAAM,qBAAqB;qBAClB,SAAS;qBACT,SAAS;qBACT,SAAS;mBACX,OAAO;CAC6C,CAAC;AAE5D,mDAAmD;AACnD,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,qBAAqB,CAAC;AAKpE,2BAA2B;AAC3B,MAAM,MAAM,aAAa,GAAG;IAC3B,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,cAAe,MAAM,KAAG,aAAa,CAAC,aAAa,CAY7E,CAAC;AAWF,oEAAoE;AACpE,eAAO,MAAM,QAAQ,SACd,UAAU,aACL,kBAAkB,KAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CACW,CAAC;AAEjE,6EAA6E;AAC7E,eAAO,MAAM,WAAW,SACjB,UAAU,aACL,kBAAkB,KAC3B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CACQ,CAAC;AAE9D,qCAAqC;AACrC,MAAM,MAAM,kBAAkB;AAC7B,8CAA8C;AAC5C;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AACvD,wDAAwD;GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC5D,gDAAgD;GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAmBrF;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,SACZ,UAAU,QACV;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,KACrF,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAgC9D,CAAC"}

package/dist/layout.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The on-disk shape of a bundle.
+ *
+ * Everything is laid out exactly the way a registry serves it:
+ *
+ *     lodash/-/lodash-4.17.21.tgz
+ *     @babel/core/-/core-7.24.0.tgz
+ *
+ * That is not an Artifactory convention — it is the path structure in every
+ * `dist.tarball` URL npm publishes. See `notes/requirements.md` § FR-12 for
+ * what that buys.
+ *
+ * The one shape worth noticing before editing anything here: a scoped
+ * package's file name drops the scope, so `@babel/core` becomes
+ * `core-7.24.0.tgz` under an `@babel/core/-/` directory.
+ */
+/** Splits `@scope/name` into its parts. `scope` is undefined when unscoped. */
+export declare const splitName: (name: string) => {
+    readonly scope: string | undefined;
+    readonly bare: string;
+};
+/** `@babel/core` + `7.24.0` -> `core-7.24.0.tgz` */
+export declare const tarballFileName: (name: string, version: string) => string;
+/**
+ * The path of one package tarball within a bundle, using `/` separators
+ * regardless of host platform — these become tar entry names, and tar entries
+ * are always POSIX.
+ */
+export declare const packagePath: (name: string, version: string) => string;
+/** File name of the manifest that ships inside every bundle. */
+export declare const MANIFEST_FILE = "bundle-manifest.json";
+/** File name of the short import guide that ships inside every bundle. */
+export declare const README_FILE = "IMPORT.md";
+/**
+ * Name of the archive produced for one root spec in `per-spec` layout.
+ *
+ * It is the spec, with the one character a file name cannot hold taken out:
+ * `@types/react@19.2.18` becomes `@types-react@19.2.18.tgz`. So the name of the
+ * file answers the question somebody has when they are looking at a directory
+ * of them — which package, and which version — in the notation they would have
+ * typed to ask for it.
+ *
+ * The version is joined with `@` rather than `-` for the same reason. A
+ * hyphen made `foo-bar-1.0.0` ambiguous by eye: package `foo` at `bar-1.0.0`,
+ * or `foo-bar` at `1.0.0`? npm's own syntax has no such problem, because a
+ * package name may not contain `@` beyond its scope.
+ *
+ * **The scope's `@` stays**, and it is the difference between a correct bundle
+ * and a quietly incomplete one.
+ *
+ * Dropping it — which this did, matching what `npm pack` produces — meant
+ * `@something/somewhat` and `something-somewhat` were both
+ * `something-somewhat-1.0.0.tgz`. Two different packages, one path: the second
+ * landed on the first, and the run reported two artifacts for the one file that
+ * survived. A bundle short a package, called complete, found at the far end of
+ * an air gap.
+ *
+ * Keeping the `@` makes that impossible by construction rather than by a check,
+ * because an unscoped npm name may not begin with one. It is also the more
+ * honest name: the scope is part of what the package *is*, and a directory of
+ * archives that has forgotten which ones were scoped is a directory somebody
+ * has to cross-reference against a manifest.
+ *
+ * It does not make every collision impossible — `@a/b-c` and `@a-b/c` still
+ * meet — so `assertDistinctOutputs` still runs. That pair is pathological; the
+ * scoped-against-unscoped one is `@babel/core` beside `babel-core`, which is a
+ * real migration somebody could be bundling.
+ *
+ * The leading `@` is safe here in a way it is not inside the archive: tar's
+ * splice convention applies to the *file list* it is given, which is what
+ * `archive.ts` guards with `./`. This is the output path, not an entry.
+ */
+export declare const perSpecArchiveName: (name: string, version: string) => string;
+/** Name of the archive produced in `single` layout. */
+export declare const singleArchiveName: (base?: string) => string;
+/**
+ * The import guide written into each bundle.
+ *
+ * Kept short and copy-pasteable on purpose: whoever opens this is mid-task on a
+ * restricted network and does not want prose.
+ */
+export declare const importGuide: (options: {
+    readonly packageCount: number;
+    readonly createdAt: string;
+    readonly toolVersion: string;
+}) => string;
+//# sourceMappingURL=layout.d.ts.map

package/dist/layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layout.d.ts","sourceRoot":"","sources":["../src/layout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,SAAS,SACf,MAAM,KACV;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAK7D,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,eAAe,SAAU,MAAM,WAAW,MAAM,KAAG,MAG/D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,WAAW,SAAU,MAAM,WAAW,MAAM,KAAG,MACd,CAAC;AAE/C,gEAAgE;AAChE,eAAO,MAAM,aAAa,yBAAyB,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,WAAW,cAAc,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,kBAAkB,SAAU,MAAM,WAAW,MAAM,KAAG,MAIlE,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,iBAAiB,qBAAsB,MAAuB,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,YAAa;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B,KAAG,MA+BH,CAAC"}

package/dist/locked-resolve.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Resolution driven by a lockfile instead of by semver.
+ *
+ * The distinction matters more than it first looks. Feeding a lockfile's
+ * versions in as exact root specs and letting the ordinary walk run would still
+ * produce the wrong bundle: every *transitive* edge is a range, and
+ * `Resolve.walk` answers a range with whatever is newest today. Lock `tslib` at
+ * 2.6.0 and let something depending on `tslib@^2` be re-resolved, and the
+ * bundle grows a second copy at 2.8.1 that CI never installed.
+ *
+ * So the lockfile is treated as the graph, not as a set of hints. The package
+ * set *is* what the file pins, and every edge is satisfied from inside it.
+ * Nothing here calls `selectVersions`; the only thing the registry is asked for
+ * is the metadata that a lockfile does not record — `dist`, and the `os`/`cpu`
+ * constraints that `--platform` narrows on.
+ *
+ * The result is an ordinary `Resolution`, so layout, archiving, the manifest
+ * and the summary cannot tell which path produced it.
+ */
+import * as Effect from "effect/Effect";
+import type { BundlerError } from "./errors.js";
+import type { LockedTree } from "./lockfile/types.js";
+import type { ResolveOptions } from "./options.js";
+import * as Progress from "./progress.js";
+import { Registry } from "./registry.js";
+import type { Resolution } from "./resolve.js";
+/** Options for a lockfile-pinned resolution. */
+export type LockedResolveOptions = ResolveOptions & {
+    /**
+     * Include the project's `devDependencies`.
+     *
+     * Matches `--file package.json`: on by default, because a project without its
+     * dev tooling does not build behind the firewall either.
+     */
+    readonly includeDev: boolean;
+    /**
+     * Direct dependency names declared by the accompanying package.json.
+     *
+     * When present, anything declared there but absent from the lockfile's roots
+     * means the two have drifted — which is exactly the silent-mismatch case this
+     * whole feature exists to catch, so it is reported rather than papered over.
+     */
+    readonly declared?: ReadonlyArray<string> | undefined;
+};
+/** Turns a parsed lockfile into a resolution, pinning every version. */
+export declare const resolveLocked: (lock: LockedTree, options: LockedResolveOptions) => Effect.Effect<Resolution, BundlerError, Registry | Progress.Progress>;
+//# sourceMappingURL=locked-resolve.d.ts.map

package/dist/locked-resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locked-resolve.d.ts","sourceRoot":"","sources":["../src/locked-resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAMxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,KAAK,EAAc,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,KAAK,EAGX,UAAU,EAIV,MAAM,cAAc,CAAC;AAKtB,gDAAgD;AAChD,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CACtD,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,SACnB,UAAU,WACP,oBAAoB,KAC3B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CA8EpE,CAAC"}

package/dist/lockfile/bun.d.ts

@@ -0,0 +1,3 @@
+import type { LockedTree } from "./types.js";
+export declare const parseBunLockfile: (path: string, content: string, importer: string | undefined) => LockedTree;
+//# sourceMappingURL=bun.d.ts.map

package/dist/lockfile/bun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun.d.ts","sourceRoot":"","sources":["../../src/lockfile/bun.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAc,UAAU,EAAE,MAAM,YAAY,CAAC;AAqBzD,eAAO,MAAM,gBAAgB,SACtB,MAAM,WACH,MAAM,YACL,MAAM,GAAG,SAAS,KAC1B,UAsBF,CAAC"}

package/dist/lockfile/detect.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Working out which lockfile — if any — some content is.
+ *
+ * Detection is by content, matching how `--file` treats everything else: a
+ * lockfile renamed to `deps.txt` still parses, and a `package-lock.json` that
+ * is actually a package.json still gets read as one.
+ */
+import { LockfileFormat } from "../enums/lockfile-format.js";
+/** What a blob of file content turned out to be. */
+export type LockfileDetection = {
+    readonly _tag: "Supported";
+    readonly format: LockfileFormat;
+}
+/**
+ * Recognisably a lockfile, but not one we can read. Named explicitly so the
+ * error says "yarn.lock is not supported yet" rather than leaving somebody to
+ * work out why their file parsed as a spec list.
+ */
+ | {
+    readonly _tag: "Unsupported";
+    readonly label: string;
+    readonly hint: string;
+} | {
+    readonly _tag: "NotALockfile";
+};
+/**
+ * Deliberately cheap and total: it never throws, so `--file` can try this
+ * first and fall through to its other shapes when the answer is `NotALockfile`.
+ */
+export declare const detectLockfile: (content: string) => LockfileDetection;
+//# sourceMappingURL=detect.d.ts.map

package/dist/lockfile/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../src/lockfile/detect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAI7D,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE;AACjE;;;;GAIG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,cAAc,YAAa,MAAM,KAAG,iBA8BhD,CAAC"}

package/dist/lockfile/json.d.ts

@@ -0,0 +1,23 @@
+export declare const stringOr: (value: unknown, fallback: string) => string;
+/** Keeps only the string-valued members of an untyped object. */
+export declare const stringRecord: (value: unknown) => Readonly<Record<string, string>>;
+/** Names a package marked its peers optional with. */
+export declare const optionalPeerNames: (value: unknown) => ReadonlySet<string>;
+export declare const parseJsonObject: (path: string, content: string) => Record<string, unknown>;
+/**
+ * Parses JSON, tolerating the comments and trailing commas bun writes.
+ *
+ * `bun.lock` is JSONC by design — bun puts explanatory comments in it — so
+ * plain `JSON.parse` rejects real lockfiles. Returns `undefined` rather than
+ * throwing so detection can use it as a probe.
+ */
+export declare const tryParseJsonc: (content: string) => unknown;
+/**
+ * Removes comments and trailing commas.
+ *
+ * String-aware, because a `//` inside a tarball URL is not a comment and an
+ * escaped quote does not end a string. Both appear in every real lockfile.
+ */
+export declare const stripJsonc: (content: string) => string;
+export declare const describeError: (error: unknown) => string;
+//# sourceMappingURL=json.d.ts.map

package/dist/lockfile/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/lockfile/json.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,QAAQ,UAAW,OAAO,YAAY,MAAM,KAAG,MACf,CAAC;AAI9C,iEAAiE;AACjE,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACG,CAAC;AAIjF,sDAAsD;AACtD,eAAO,MAAM,iBAAiB,UAAW,OAAO,KAAG,WAAW,CAAC,MAAM,CAMpE,CAAC;AAEF,eAAO,MAAM,eAAe,SAAU,MAAM,WAAW,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CASrF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,YAAa,MAAM,KAAG,OAU/C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,YAAa,MAAM,KAAG,MAuD5C,CAAC;AAEF,eAAO,MAAM,aAAa,UAAW,OAAO,KAAG,MACQ,CAAC"}

package/dist/lockfile/names.d.ts

@@ -0,0 +1,16 @@
+import { LockfileFormat } from "../enums/lockfile-format.js";
+/**
+ * The file name each supported manager writes, in detection order.
+ *
+ * Ordered: `package-lock.json` before `npm-shrinkwrap.json` before pnpm's and
+ * bun's, so a directory holding several is searched the way npm itself would.
+ */
+export declare const formatByLockfileName: {
+    readonly "package-lock.json": "npm";
+    readonly "npm-shrinkwrap.json": "npm";
+    readonly "pnpm-lock.yaml": "pnpm";
+    readonly "bun.lock": "bun";
+};
+/** The names a given manager writes. */
+export declare const lockfileNamesFor: (format: LockfileFormat) => ReadonlyArray<string>;
+//# sourceMappingURL=names.d.ts.map

package/dist/lockfile/names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.d.ts","sourceRoot":"","sources":["../../src/lockfile/names.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;CAKkB,CAAC;AAEpD,wCAAwC;AACxC,eAAO,MAAM,gBAAgB,WAAY,cAAc,KAAG,aAAa,CAAC,MAAM,CAG5E,CAAC"}

package/dist/lockfile/npm.d.ts

@@ -0,0 +1,3 @@
+import type { LockedTree } from "./types.js";
+export declare const parseNpmLockfile: (path: string, content: string, importer: string | undefined) => LockedTree;
+//# sourceMappingURL=npm.d.ts.map

package/dist/lockfile/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/lockfile/npm.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAc,UAAU,EAAE,MAAM,YAAY,CAAC;AAgCzD,eAAO,MAAM,gBAAgB,SACtB,MAAM,WACH,MAAM,YACL,MAAM,GAAG,SAAS,KAC1B,UAuBF,CAAC"}

package/dist/lockfile/parse.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Lockfile parsing — npm, pnpm and bun.
+ *
+ * `--file package.json` reads *ranges*, and a range resolves to whatever is
+ * newest at the moment the command runs. That is the right answer for "bundle
+ * me something installable" and the wrong one for "bundle exactly what CI
+ * installed" — which is what a lockfile records and what this module reads.
+ *
+ * Three formats, one output shape. Each parser's real job is the same: turn a
+ * manager-specific encoding of "package X at path P depends on Y" into a flat
+ * graph keyed by `name@version`, with every edge already pointing at a concrete
+ * version. Once that is done, nothing downstream has to know which manager
+ * wrote the file.
+ */
+import { LockfileFormat } from "../enums/lockfile-format.js";
+import type { LockedTree, LockfileParseOptions } from "./types.js";
+/**
+ * Parses lockfile content into a flat graph.
+ *
+ * Throws `LockfileError`; the caller is expected to be inside an `Effect.try`.
+ */
+export declare const parseLockfile: (path: string, content: string, format?: LockfileFormat, options?: LockfileParseOptions) => LockedTree;
+//# sourceMappingURL=parse.d.ts.map

package/dist/lockfile/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/lockfile/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAM7D,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,aAAa,SACnB,MAAM,WACH,MAAM,WACN,cAAc,YACd,oBAAoB,KAC3B,UAWF,CAAC"}

package/dist/lockfile/pnpm.d.ts

@@ -0,0 +1,20 @@
+import type { LockedTree } from "./types.js";
+/** `name@version`, as a snapshot or importer entry resolves to. */
+type PnpmReference = {
+    readonly name: string;
+    readonly version: string;
+};
+export declare const parsePnpmLockfile: (path: string, content: string, importer: string | undefined) => LockedTree;
+/**
+ * Splits a package key into name and version.
+ *
+ * Three encodings across the versions still in the wild:
+ *   v5  `/@babel/core/7.0.0`
+ *   v6  `/@babel/core@7.0.0`
+ *   v9  `@babel/core@7.0.0`
+ *
+ * plus an optional `(peer@1.0.0)` or `(patch_hash=…)` suffix on any of them.
+ */
+export declare const parsePnpmKey: (key: string) => PnpmReference | null;
+export {};
+//# sourceMappingURL=pnpm.d.ts.map

package/dist/lockfile/pnpm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.d.ts","sourceRoot":"","sources":["../../src/lockfile/pnpm.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAc,UAAU,EAAE,MAAM,YAAY,CAAC;AAEzD,mEAAmE;AACnE,KAAK,aAAa,GAAG;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB,CAAC;AAKF,eAAO,MAAM,iBAAiB,SACvB,MAAM,WACH,MAAM,YACL,MAAM,GAAG,SAAS,KAC1B,UAgDF,CAAC;AAgGF;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,aAAa,GAAG,IAc1D,CAAC"}

package/dist/lockfile/tree-builder.d.ts

@@ -0,0 +1,70 @@
+import type { LockfileFormat } from "../enums/lockfile-format.js";
+import type { LockedPackage, LockedRoot, LockedTree } from "./types.js";
+/**
+ * Which manifest block each root kind is declared in.
+ *
+ * The block names are the same across npm, pnpm and bun; only which of them a
+ * given format writes differs, which is why each parser supplies its own order
+ * rather than iterating this.
+ */
+export declare const fieldByRootKind: {
+    readonly prod: "dependencies";
+    readonly optional: "optionalDependencies";
+    readonly dev: "devDependencies";
+    readonly peer: "peerDependencies";
+};
+export declare class TreeBuilder {
+    readonly packages: Map<string, LockedPackage>;
+    readonly roots: Array<LockedRoot>;
+    readonly warnings: Array<string>;
+    readonly incomplete: Array<string>;
+    /** Names dropped on purpose, so an edge into one is explained, not alarming. */
+    private readonly skipped;
+    private readonly seenWarnings;
+    add(pkg: LockedPackage): void;
+    addRoot(root: LockedRoot): void;
+    warn(message: string): void;
+    /** Notes an entry that is real but cannot come from a registry. */
+    skip(name: string, spec: string, reason: string): void;
+    /**
+     * Records a required edge that resolved to nothing.
+     *
+     * An edge into something skipped on purpose is expected — you cannot bundle a
+     * `workspace:` sibling from a registry — so it stays a warning. Anything else
+     * means the file does not pin what it claims to.
+     */
+    dangling(from: string, name: string): void;
+    finish(input: {
+        readonly format: LockfileFormat;
+        readonly lockfileVersion: string;
+        readonly path: string;
+        readonly importer?: string | undefined;
+    }): LockedTree;
+}
+/**
+ * Reads the right-hand side of a locked entry as an exact version.
+ *
+ * Returns the version when it is one, or the reason it is not — `file:../x`,
+ * `workspace:*`, a git URL. `parseDependencyTarget` already classifies every
+ * one of those for package.json parsing, so the vocabulary of skip reasons
+ * stays identical between the two paths.
+ */
+export declare const asExactVersion: (name: string, raw: string) => {
+    readonly _tag: "Version";
+    readonly version: string;
+} | {
+    readonly _tag: "Unsupported";
+    readonly reason: string;
+};
+/**
+ * Raised when a lockfile found by walking up turns out not to cover the
+ * package.json that went looking for it.
+ *
+ * Worth distinguishing from "no lockfile at all": the file exists and is
+ * readable, it simply belongs to a different project, and bundling it would
+ * produce someone else's dependency set.
+ */
+export declare const notCovered: (path: string, importer: string, known: ReadonlyArray<string>) => never;
+/** `""` is how npm and bun spell the project at the lockfile's own level. */
+export declare const importerKey: (importer: string) => string;
+//# sourceMappingURL=tree-builder.d.ts.map

package/dist/lockfile/tree-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree-builder.d.ts","sourceRoot":"","sources":["../../src/lockfile/tree-builder.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,KAAK,EAAc,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;mBACJ,cAAc;uBACV,sBAAsB;kBAC3B,iBAAiB;mBAChB,kBAAkB;CACS,CAAC;AAEpD,qBAAa,WAAW;IACvB,QAAQ,CAAC,QAAQ,6BAAoC;IACrD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAM;IACvC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAM;IACtC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAM;IACxC,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAElD,GAAG,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAc5B;IAED,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAG9B;IAED,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAI1B;IAED,mEAAmE;IACnE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAGrD;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMzC;IAED,MAAM,CAAC,KAAK,EAAE;QACb,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;QAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACvC,GAAG,UAAU,CAcb;CACD;AAaD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,SACpB,MAAM,OACP,MAAM,KAET;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAOzD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,SAAU,MAAM,YAAY,MAAM,SAAS,aAAa,CAAC,MAAM,CAAC,KAAG,KAazF,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,WAAW,aAAc,MAAM,KAAG,MAA4C,CAAC"}

package/dist/lockfile/types.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The one output shape every lockfile parser produces.
+ *
+ * npm, pnpm and bun encode "package X at path P depends on Y" in three
+ * different ways; once flattened into this graph, nothing downstream has to
+ * know which manager wrote the file.
+ */
+import type { EdgeKind, LockedRootKind } from "../enums/edge-kind.js";
+import type { LockfileFormat } from "../enums/lockfile-format.js";
+/** One edge out of a locked package, already pinned to an exact version. */
+export type LockedEdge = {
+    readonly name: string;
+    readonly version: string;
+    readonly kind: EdgeKind;
+};
+/** One package pinned by a lockfile. */
+export type LockedPackage = {
+    readonly name: string;
+    readonly version: string;
+    readonly dependencies: ReadonlyArray<LockedEdge>;
+};
+/** A direct dependency of the locked project. */
+export type LockedRoot = {
+    readonly name: string;
+    readonly version: string;
+    readonly kind: LockedRootKind;
+    /** The range the manifest asked for, kept for reporting. */
+    readonly specifier?: string | undefined;
+};
+/** Options for reading a lockfile. */
+export type LockfileParseOptions = {
+    /**
+     * Which workspace member's dependencies become the roots, as a path relative
+     * to the lockfile in POSIX form — `"packages/core"`, or `"."` for the project
+     * at the lockfile's own level.
+     *
+     * Left undefined, every workspace member in the file contributes, which is
+     * what pointing `--file` straight at a lockfile should mean. It matters when
+     * a package.json found a lockfile by walking *up*: the file then pins the
+     * whole repository, and only one member of it was asked for.
+     */
+    readonly importer?: string | undefined;
+};
+/** A whole lockfile, flattened. */
+export type LockedTree = {
+    readonly format: LockfileFormat;
+    /** As the file declares it: `3`, `'9.0'`, `1`. */
+    readonly lockfileVersion: string;
+    /** Where it was read from, for error messages. */
+    readonly path: string;
+    /** The workspace member the roots came from, when one was selected. */
+    readonly importer?: string | undefined;
+    /** Every pinned package, keyed by `name@version`. */
+    readonly packages: ReadonlyMap<string, LockedPackage>;
+    /** The project's direct dependencies. */
+    readonly roots: ReadonlyArray<LockedRoot>;
+    /** Entries that were recognised but cannot be fetched from a registry. */
+    readonly warnings: ReadonlyArray<string>;
+    /**
+     * Required edges pointing at nothing the file pins.
+     *
+     * Distinct from `warnings`: a `workspace:` dependency that cannot be bundled
+     * is expected and gets a warning, while an ordinary registry dependency with
+     * no entry means the lockfile is genuinely partial and the bundle it produces
+     * would be missing a package. The caller decides what to do about it, but the
+     * two must not be confused.
+     */
+    readonly incomplete: ReadonlyArray<string>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/lockfile/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/lockfile/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,4EAA4E;AAC5E,MAAM,MAAM,UAAU,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACxB,CAAC;AAEF,wCAAwC;AACxC,MAAM,MAAM,aAAa,GAAG;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACjD,CAAC;AAEF,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,CAAC;AAEF,sCAAsC;AACtC,MAAM,MAAM,oBAAoB,GAAG;IAClC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC,CAAC;AAEF,mCAAmC;AACnC,MAAM,MAAM,UAAU,GAAG;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtD,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1C,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC3C,CAAC"}