@packall/core 0.0.1

package/dist/index.js

@@ -0,0 +1,1766 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import { create } from "tar";
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+import * as Ref from "effect/Ref";
+import * as Path from "effect/Path";
+import { createHash, timingSafeEqual } from "node:crypto";
+import semver from "semver";
+
+//#region rolldown:runtime
+var __defProp = Object.defineProperty;
+var __export = (all) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	return target;
+};
+
+//#endregion
+//#region src/Errors.ts
+var BundlerErrorBase = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = new.target.name;
+	}
+};
+/** A package spec on the command line or in an input file could not be parsed. */
+var InvalidSpecError = class extends BundlerErrorBase {
+	_tag = "InvalidSpecError";
+	spec;
+	reason;
+	constructor(spec, reason) {
+		super(`Invalid package spec ${JSON.stringify(spec)}: ${reason}`);
+		this.spec = spec;
+		this.reason = reason;
+	}
+};
+/** `--file` pointed at something that is neither a usable package.json nor a spec list. */
+var InvalidInputFileError = class extends BundlerErrorBase {
+	_tag = "InvalidInputFileError";
+	path;
+	reason;
+	constructor(path, reason, options) {
+		super(`Cannot read specs from ${path}: ${reason}`, options);
+		this.path = path;
+		this.reason = reason;
+	}
+};
+/**
+* The registry could not be reached at all — DNS failure, refused connection,
+* proxy blackhole, or a preflight that timed out.
+*
+* This is the error that fixes "hangs forever with no network": we surface it
+* quickly and say which host we could not reach.
+*/
+var RegistryUnreachableError = class extends BundlerErrorBase {
+	_tag = "RegistryUnreachableError";
+	registry;
+	timeoutMillis;
+	constructor(registry, detail, options) {
+		super(`Cannot reach registry ${registry}: ${detail}.\n  Check your network connection, VPN, and the proxy settings in your .npmrc.`, options);
+		this.registry = registry;
+		this.timeoutMillis = options?.timeoutMillis;
+	}
+};
+/** The registry answered, but has never heard of this package. */
+var PackageNotFoundError = class extends BundlerErrorBase {
+	_tag = "PackageNotFoundError";
+	packageName;
+	registry;
+	constructor(packageName, registry) {
+		super(`Package "${packageName}" was not found on ${registry}`);
+		this.packageName = packageName;
+		this.registry = registry;
+	}
+};
+/** The package exists but the exact version requested does not. */
+var VersionNotFoundError = class extends BundlerErrorBase {
+	_tag = "VersionNotFoundError";
+	packageName;
+	version;
+	available;
+	constructor(packageName, version, available) {
+		const tail = available.slice(-5).join(", ");
+		super(`${packageName}@${version} does not exist.` + (tail.length > 0 ? ` Most recent published versions: ${tail}` : ""));
+		this.packageName = packageName;
+		this.version = version;
+		this.available = available;
+	}
+};
+/** A range (or dist-tag) matched nothing that is actually published. */
+var NoMatchingVersionsError = class extends BundlerErrorBase {
+	_tag = "NoMatchingVersionsError";
+	packageName;
+	selector;
+	available;
+	constructor(packageName, selector, available) {
+		const tail = available.slice(-5).join(", ");
+		super(`No published version of ${packageName} satisfies "${selector}".` + (tail.length > 0 ? ` Most recent published versions: ${tail}` : ""));
+		this.packageName = packageName;
+		this.selector = selector;
+		this.available = available;
+	}
+};
+/** The registry responded, but with something we cannot use. */
+var RegistryResponseError = class extends BundlerErrorBase {
+	_tag = "RegistryResponseError";
+	url;
+	status;
+	constructor(url, detail, options) {
+		super(`Unexpected response from ${url}: ${detail}`, options);
+		this.url = url;
+		this.status = options?.status;
+	}
+};
+/** 401/403 — almost always a missing or stale token in `.npmrc`. */
+var AuthenticationError = class extends BundlerErrorBase {
+	_tag = "AuthenticationError";
+	registry;
+	status;
+	constructor(registry, status, packageName) {
+		super(`Registry ${registry} rejected the request with HTTP ${status}` + (packageName ? ` while fetching "${packageName}"` : "") + `.\n  Add credentials to your .npmrc, e.g.\n    //${safeHost(registry)}/:_authToken=\${NPM_TOKEN}`);
+		this.registry = registry;
+		this.status = status;
+	}
+};
+/**
+* A downloaded tarball did not match the checksum the registry advertised.
+*
+* Never soft-fail this: a bundle is a supply-chain artifact and a corrupt or
+* substituted tarball is exactly what integrity checking exists to catch.
+*/
+var IntegrityError = class extends BundlerErrorBase {
+	_tag = "IntegrityError";
+	packageName;
+	version;
+	expected;
+	actual;
+	constructor(packageName, version, expected, actual) {
+		super(`Integrity check failed for ${packageName}@${version}.\n  expected: ${expected}\n  actual:   ${actual}\n  The download was discarded. This is either corruption in transit or a tampered artifact.`);
+		this.packageName = packageName;
+		this.version = version;
+		this.expected = expected;
+		this.actual = actual;
+	}
+};
+/** Something went wrong writing the `.tgz`. */
+var ArchiveError = class extends BundlerErrorBase {
+	_tag = "ArchiveError";
+	path;
+	constructor(path, detail, options) {
+		super(`Failed to create archive ${path}: ${detail}`, options);
+		this.path = path;
+	}
+};
+/** Something went wrong preparing or writing to the output directory. */
+var OutputError = class extends BundlerErrorBase {
+	_tag = "OutputError";
+	path;
+	constructor(path, detail, options) {
+		super(`Output error at ${path}: ${detail}`, options);
+		this.path = path;
+	}
+};
+const safeHost = (registry) => {
+	try {
+		const url = new URL(registry);
+		return url.host + url.pathname.replace(/\/+$/, "");
+	} catch {
+		return registry;
+	}
+};
+
+//#endregion
+//#region src/Progress.ts
+var Progress_exports = /* @__PURE__ */ __export({
+	Progress: () => Progress,
+	emit: () => emit,
+	layerCallback: () => layerCallback,
+	layerSilent: () => layerSilent,
+	makeCollector: () => makeCollector
+});
+/** Service tag for progress reporting. */
+var Progress = class extends Context.Service()("@packall/core/Progress") {};
+/** Emits an event to whichever reporter is installed. */
+const emit = (event) => Effect.gen(function* () {
+	yield* (yield* Progress).emit(event);
+});
+/**
+* Discards every event.
+*
+* The default for library consumers and for tests that do not care about
+* progress — silence should never require ceremony.
+*/
+const layerSilent = Layer.succeed(Progress)({ emit: () => Effect.void });
+/** Sends every event to a callback. Used by the CLI renderer. */
+const layerCallback = (onEvent) => Layer.succeed(Progress)({ emit: (event) => Effect.sync(() => onEvent(event)) });
+/**
+* Accumulates every event into a `Ref`, for assertions.
+*
+* Returned as `[layer, ref]` so a test can provide the layer and then read the
+* transcript afterwards.
+*/
+const makeCollector = Effect.gen(function* () {
+	const ref = yield* Ref.make([]);
+	return {
+		layer: Layer.succeed(Progress)({ emit: (event) => Ref.update(ref, (events) => [...events, event]) }),
+		events: Ref.get(ref)
+	};
+});
+
+//#endregion
+//#region src/Archive.ts
+var Archive_exports = /* @__PURE__ */ __export({ createArchive: () => createArchive });
+/**
+* Packs `entries` (paths relative to `cwd`) into a gzipped tar at `outPath`.
+*
+* `portable` normalises uid/gid/mtime so the same inputs produce byte-identical
+* output — which matters when a security team wants to diff two bundles or
+* re-derive one from a manifest.
+*/
+const createArchive = (options) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	yield* emit({
+		_tag: "ArchiveStarted",
+		path: options.outPath,
+		entryCount: options.entries.length
+	});
+	yield* Effect.tryPromise({
+		try: () => create({
+			gzip: options.gzipLevel === void 0 ? true : { level: options.gzipLevel },
+			file: options.outPath,
+			cwd: options.cwd,
+			portable: true,
+			onWriteEntry: (entry) => {
+				entry.path = entry.path.replace(/^\.\//, "");
+			}
+		}, [...options.entries].sort().map(dotSlash)),
+		catch: (cause) => new ArchiveError(options.outPath, describe$1(cause), { cause })
+	});
+	const info = yield* fs.stat(options.outPath);
+	const bytes = Number(info.size);
+	yield* emit({
+		_tag: "ArchiveCompleted",
+		path: options.outPath,
+		bytes
+	});
+	return {
+		path: options.outPath,
+		bytes
+	};
+});
+/**
+* Guards every entry against tar's `@` convention.
+*
+* In a tar file list, a leading `@` means "splice in the entries of this other
+* archive" — a GNU convention `node-tar` implements by stripping the `@` and
+* looking for what is left. Every scoped package is a top-level entry starting
+* with `@`, so this hit the bundler in both possible ways:
+*
+* - `@oxc-project` became `oxc-project`, which does not exist, and the run died
+*   with an ENOENT naming a path that appears nowhere in the staging tree.
+* - `@esbuild` became `esbuild`, which *does* exist — the unscoped package of
+*   the same name sitting right next to it. No error, and every scoped tarball
+*   silently missing from a bundle that reported success. That is the dangerous
+*   one: you would not find out until the install failed behind the firewall.
+*
+* `./@scope` is not subject to the convention and resolves identically.
+*/
+const dotSlash = (entry) => entry.startsWith("./") ? entry : `./${entry}`;
+const describe$1 = (cause) => cause instanceof Error ? cause.message : String(cause);
+
+//#endregion
+//#region src/Integrity.ts
+var Integrity_exports = /* @__PURE__ */ __export({
+	digestOf: () => digestOf,
+	hexDigestOf: () => hexDigestOf,
+	parseIntegrity: () => parseIntegrity,
+	verify: () => verify
+});
+const SUPPORTED = new Set([
+	"sha512",
+	"sha384",
+	"sha256",
+	"sha1"
+]);
+/**
+* Parses an SRI string such as `sha512-abc...==`.
+*
+* npm permits several space-separated hashes; we keep every one we can verify
+* and ignore algorithms Node does not implement.
+*/
+const parseIntegrity = (integrity) => {
+	const hashes = [];
+	for (const token of integrity.trim().split(/\s+/)) {
+		if (token.length === 0) continue;
+		const dash = token.indexOf("-");
+		if (dash <= 0) continue;
+		const algorithm = token.slice(0, dash).toLowerCase();
+		const digest = token.slice(dash + 1);
+		if (!SUPPORTED.has(algorithm) || digest.length === 0) continue;
+		hashes.push({
+			algorithm,
+			digest
+		});
+	}
+	return hashes;
+};
+/** Computes the base64 digest of some bytes under one algorithm. */
+const digestOf = (data, algorithm) => createHash(algorithm).update(data).digest("base64");
+/** Computes the hex digest of some bytes — the form legacy `shasum` uses. */
+const hexDigestOf = (data, algorithm) => createHash(algorithm).update(data).digest("hex");
+/** Constant-time comparison of two digest strings of equal length. */
+const digestsEqual = (a, b) => {
+	const left = Buffer.from(a);
+	const right = Buffer.from(b);
+	return left.length === right.length && timingSafeEqual(left, right);
+};
+/**
+* Checks bytes against whichever checksums the registry supplied.
+*
+* SRI is preferred; `shasum` is the fallback for versions published before
+* integrity strings existed. If the registry gave us neither, that is reported
+* as `Unverifiable` rather than silently treated as a pass — the caller decides
+* whether to tolerate it.
+*/
+const verify = (data, dist) => {
+	if (dist.integrity !== void 0 && dist.integrity.length > 0) {
+		const hashes = parseIntegrity(dist.integrity);
+		if (hashes.length === 0) return {
+			_tag: "Unverifiable",
+			reason: `no supported algorithm in "${dist.integrity}"`
+		};
+		const best = [...hashes].sort((a, b) => strength(b.algorithm) - strength(a.algorithm))[0];
+		const actual = digestOf(data, best.algorithm);
+		return digestsEqual(actual, best.digest) ? {
+			_tag: "Verified",
+			using: best.algorithm
+		} : {
+			_tag: "Mismatch",
+			expected: `${best.algorithm}-${best.digest}`,
+			actual: `${best.algorithm}-${actual}`
+		};
+	}
+	if (dist.shasum !== void 0 && dist.shasum.length > 0) {
+		const actual = hexDigestOf(data, "sha1");
+		return digestsEqual(actual.toLowerCase(), dist.shasum.toLowerCase()) ? {
+			_tag: "Verified",
+			using: "sha1"
+		} : {
+			_tag: "Mismatch",
+			expected: `sha1-${dist.shasum}`,
+			actual: `sha1-${actual}`
+		};
+	}
+	return {
+		_tag: "Unverifiable",
+		reason: "registry advertised no integrity or shasum"
+	};
+};
+const strength = (algorithm) => {
+	switch (algorithm) {
+		case "sha512": return 4;
+		case "sha384": return 3;
+		case "sha256": return 2;
+		default: return 1;
+	}
+};
+
+//#endregion
+//#region src/Layout.ts
+var Layout_exports = /* @__PURE__ */ __export({
+	MANIFEST_FILE: () => MANIFEST_FILE,
+	README_FILE: () => README_FILE,
+	importGuide: () => importGuide,
+	packagePath: () => packagePath,
+	perSpecArchiveName: () => perSpecArchiveName,
+	singleArchiveName: () => singleArchiveName,
+	splitName: () => splitName,
+	tarballFileName: () => tarballFileName
+});
+/**
+* The on-disk shape of a bundle.
+*
+* Everything is laid out exactly the way a registry serves it:
+*
+*     lodash/-/lodash-4.17.21.tgz
+*     @babel/core/-/core-7.24.0.tgz
+*
+* That is not an Artifactory convention — it is the path structure in every
+* `dist.tarball` URL npm publishes, which is why the same tree imports into
+* Artifactory, Nexus and Verdaccio without translation. Note that a scoped
+* package's file name drops the scope: `@babel/core` becomes `core-7.24.0.tgz`
+* under an `@babel/core/-/` directory.
+*/
+/** Splits `@scope/name` into its parts. `scope` is undefined when unscoped. */
+const splitName = (name) => {
+	if (!name.startsWith("@")) return {
+		scope: void 0,
+		bare: name
+	};
+	const slash = name.indexOf("/");
+	if (slash === -1) return {
+		scope: void 0,
+		bare: name
+	};
+	return {
+		scope: name.slice(0, slash),
+		bare: name.slice(slash + 1)
+	};
+};
+/** `@babel/core` + `7.24.0` -> `core-7.24.0.tgz` */
+const tarballFileName = (name, version) => {
+	const { bare } = splitName(name);
+	return `${bare}-${version}.tgz`;
+};
+/**
+* The path of one package tarball within a bundle, using `/` separators
+* regardless of host platform — these become tar entry names, and tar entries
+* are always POSIX.
+*/
+const packagePath = (name, version) => `${name}/-/${tarballFileName(name, version)}`;
+/** File name of the manifest that ships inside every bundle. */
+const MANIFEST_FILE = "bundle-manifest.json";
+/** File name of the short import guide that ships inside every bundle. */
+const README_FILE = "IMPORT.md";
+/**
+* Name of the archive produced for one root spec in `per-spec` layout.
+*
+* Scoped names are flattened (`@babel/core` -> `babel-core`) because a `/` in a
+* file name is not a thing, and `@` confuses enough shells and web UIs to be
+* worth avoiding.
+*/
+const perSpecArchiveName = (name, version) => {
+	const { scope, bare } = splitName(name);
+	return `${scope === void 0 ? bare : `${scope.slice(1)}-${bare}`}-${version}.tgz`;
+};
+/** Name of the archive produced in `single` layout. */
+const singleArchiveName = (base = "bundle") => `${base}.tgz`;
+/**
+* The import guide written into each bundle.
+*
+* Kept short and copy-pasteable on purpose: whoever opens this is mid-task on a
+* restricted network and does not want prose.
+*/
+const importGuide = (options) => `# Importing this bundle
+
+${options.packageCount} package tarball(s), laid out exactly as an npm registry serves them:
+
+    <package-name>/-/<file>.tgz
+    @<scope>/<name>/-/<file>.tgz
+
+Created ${options.createdAt} by packall ${options.toolVersion}.
+See ${MANIFEST_FILE} for the full list with checksums.
+
+## JFrog Artifactory
+
+Unpack, then upload the tree into a **local npm** repository. The layout already
+matches what Artifactory expects, so no path rewriting is needed:
+
+    tar -xzf <this-bundle>.tgz -C ./bundle
+    jf rt upload "bundle/(**)" "<npm-local-repo>/{1}" --flat=false
+
+## Verdaccio / Nexus / any npm registry
+
+Publish each tarball individually:
+
+    find ./bundle -name '*.tgz' -exec npm publish --registry <url> {} \\;
+
+## Verifying before import
+
+    node -e "const m=require('./bundle/${MANIFEST_FILE}');console.log(m.packages.length+' packages')"
+
+Every entry in ${MANIFEST_FILE} carries the integrity string the source registry
+advertised, and each tarball was checked against it at download time.
+`;
+
+//#endregion
+//#region src/Registry.ts
+/**
+* Service tag for the registry backend.
+*
+* @example
+* ```ts
+* import { Effect } from "effect"
+* import { Registry } from "@packall/core"
+*
+* const program = Effect.gen(function*() {
+*   const registry = yield* Registry
+*   return yield* registry.packument("lodash")
+* })
+* ```
+*/
+var Registry = class extends Context.Service()("@packall/core/Registry") {};
+
+//#endregion
+//#region src/Download.ts
+var Download_exports = /* @__PURE__ */ __export({ downloadAll: () => downloadAll });
+/**
+* Downloads every package into `destDir`, laid out the way a registry serves
+* them.
+*
+* `verifyIntegrity` defaulting to on is deliberate: a corrupt tarball that
+* makes it into a corporate registry is far more expensive than a failed run.
+*/
+const downloadAll = (packages, destDir, options) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const registry = yield* Registry;
+	yield* emit({
+		_tag: "PhaseStarted",
+		phase: "download",
+		total: packages.length
+	});
+	let completed = 0;
+	const sizes = /* @__PURE__ */ new Map();
+	const unverified = [];
+	const results = yield* Effect.forEach(packages, (pkg) => Effect.gen(function* () {
+		const key = `${pkg.name}@${pkg.version}`;
+		yield* emit({
+			_tag: "DownloadStarted",
+			name: pkg.name,
+			version: pkg.version
+		});
+		const bytes = yield* registry.download(pkg.manifest);
+		if (options.verifyIntegrity) {
+			const result = verify(bytes, pkg.manifest.dist);
+			if (result._tag === "Mismatch") return yield* Effect.fail(new IntegrityError(pkg.name, pkg.version, result.expected, result.actual));
+			if (result._tag === "Unverifiable") yield* emit({
+				_tag: "Warning",
+				message: `${key} could not be verified (${result.reason})`
+			});
+		}
+		const verifiable = (pkg.manifest.dist.integrity?.length ?? 0) > 0 || (pkg.manifest.dist.shasum?.length ?? 0) > 0;
+		const relative = packagePath(pkg.name, pkg.version);
+		const target = path.join(destDir, ...relative.split("/"));
+		yield* fs.makeDirectory(path.dirname(target), { recursive: true }).pipe(Effect.mapError((cause) => new OutputError(path.dirname(target), "could not create directory", { cause })));
+		yield* fs.writeFile(target, bytes).pipe(Effect.mapError((cause) => new OutputError(target, "could not write tarball", { cause })));
+		completed += 1;
+		yield* emit({
+			_tag: "DownloadCompleted",
+			name: pkg.name,
+			version: pkg.version,
+			bytes: bytes.byteLength,
+			completedCount: completed,
+			totalCount: packages.length
+		});
+		return {
+			key,
+			bytes: bytes.byteLength,
+			verifiable
+		};
+	}), { concurrency: options.concurrency });
+	for (const result of results) {
+		sizes.set(result.key, result.bytes);
+		if (!result.verifiable) unverified.push(result.key);
+	}
+	yield* emit({
+		_tag: "PhaseCompleted",
+		phase: "download"
+	});
+	return {
+		sizes,
+		unverified,
+		totalBytes: results.reduce((sum, r) => sum + r.bytes, 0)
+	};
+});
+
+//#endregion
+//#region src/Platform.ts
+var Platform_exports = /* @__PURE__ */ __export({
+	allPlatforms: () => allPlatforms,
+	currentPlatform: () => currentPlatform,
+	formatPlatformFilter: () => formatPlatformFilter,
+	isIncluded: () => isIncluded,
+	matchesTarget: () => matchesTarget,
+	parsePlatformTarget: () => parsePlatformTarget,
+	platformTargets: () => platformTargets
+});
+const allPlatforms = { _tag: "All" };
+const platformTargets = (targets) => ({
+	_tag: "Targets",
+	targets
+});
+/** The machine we are currently running on. */
+const currentPlatform = () => ({
+	os: process.platform,
+	cpu: process.arch
+});
+/**
+* npm's documented `os` values, plus the names people actually type.
+*
+* An OS on its own is a valid target, so a typo has to be caught here — the
+* whole failure mode this tool exists to prevent is a bundle that looks fine
+* and installs nothing. `--platform windows` silently matching no binding at
+* all would be precisely that, so it is corrected rather than accepted.
+*/
+const OS_ALIASES = {
+	win: "win32",
+	windows: "win32",
+	mac: "darwin",
+	macos: "darwin",
+	osx: "darwin"
+};
+const KNOWN_OS = new Set([
+	"aix",
+	"android",
+	"cygwin",
+	"darwin",
+	"freebsd",
+	"haiku",
+	"linux",
+	"netbsd",
+	"openbsd",
+	"sunos",
+	"win32"
+]);
+const LIBC = new Set(["musl", "glibc"]);
+/**
+* Parses `linux`, `linux-x64`, `darwin-arm64`, `win32-x64`, `linux-x64-musl`,
+* `linux-musl`.
+*
+* An OS on its own means every architecture for that OS, which is almost always
+* what you want: "the Windows and Linux bindings" is a far more natural way to
+* describe a target set than enumerating four `os-arch` pairs, and it keeps
+* working when a package adds an arm64 build.
+*
+* Returns `null` rather than throwing so the CLI can report every bad value at
+* once alongside the list of accepted forms.
+*/
+const parsePlatformTarget = (input) => {
+	const parts = input.trim().toLowerCase().split("-").filter((p) => p.length > 0);
+	if (parts.length === 0 || parts.length > 3) return null;
+	const rawOs = parts[0];
+	const os = OS_ALIASES[rawOs] ?? rawOs;
+	if (!KNOWN_OS.has(os)) return null;
+	if (parts.length === 1) return { os };
+	if (parts.length === 2 && LIBC.has(parts[1])) return {
+		os,
+		libc: parts[1]
+	};
+	const cpu = parts[1];
+	if (parts.length === 2) return {
+		os,
+		cpu
+	};
+	const libc = parts[2];
+	if (!LIBC.has(libc)) return null;
+	return {
+		os,
+		cpu,
+		libc
+	};
+};
+/**
+* npm's `os`/`cpu`/`libc` fields use a list of allowed values, where a leading
+* `!` negates. An empty or absent list means "no constraint".
+*
+* The semantics npm implements: if any negated entry matches, reject. Otherwise
+* if there are any positive entries, at least one must match.
+*/
+const listAllows = (list, value) => {
+	if (list === void 0 || list.length === 0) return true;
+	let hasPositive = false;
+	let positiveMatched = false;
+	for (const entry of list) {
+		const normalized = entry.trim().toLowerCase();
+		if (normalized.length === 0) continue;
+		if (normalized === "any" || normalized === "*") return true;
+		if (normalized.startsWith("!")) {
+			if (normalized.slice(1) === value) return false;
+		} else {
+			hasPositive = true;
+			if (normalized === value) positiveMatched = true;
+		}
+	}
+	return hasPositive ? positiveMatched : true;
+};
+/** Would this package install on this specific target? */
+const matchesTarget = (constraints, target) => {
+	if (!listAllows(constraints.os, target.os)) return false;
+	if (target.cpu !== void 0 && !listAllows(constraints.cpu, target.cpu)) return false;
+	if (target.libc !== void 0 && !listAllows(constraints.libc, target.libc)) return false;
+	return true;
+};
+/**
+* Should this package be included, given the active filter?
+*
+* Under `All` this is unconditionally `true` — that is the whole point.
+*/
+const isIncluded = (constraints, filter) => {
+	if (filter._tag === "All") return true;
+	return filter.targets.some((target) => matchesTarget(constraints, target));
+};
+/** Renders a filter for the manifest and for `--dry-run` output. */
+const formatPlatformFilter = (filter) => {
+	if (filter._tag === "All") return "all";
+	return filter.targets.map((t) => [
+		t.os,
+		t.cpu,
+		t.libc
+	].filter((part) => part !== void 0).join("-")).join(",");
+};
+
+//#endregion
+//#region src/Spec.ts
+var Spec_exports = /* @__PURE__ */ __export({
+	dedupeSpecs: () => dedupeSpecs,
+	formatSelector: () => formatSelector,
+	formatSpec: () => formatSpec,
+	parseSelector: () => parseSelector,
+	parseSpec: () => parseSpec,
+	parseSpecs: () => parseSpecs,
+	validatePackageName: () => validatePackageName
+});
+/** Renders a spec back into the canonical `name@selector` form. */
+const formatSpec = (spec) => {
+	switch (spec.selector._tag) {
+		case "Exact": return `${spec.name}@${spec.selector.version}`;
+		case "Range": return `${spec.name}@${spec.selector.range}`;
+		case "Tag": return `${spec.name}@${spec.selector.tag}`;
+	}
+};
+/** Human-readable form of just the selector part. */
+const formatSelector = (selector) => {
+	switch (selector._tag) {
+		case "Exact": return selector.version;
+		case "Range": return selector.range;
+		case "Tag": return selector.tag;
+	}
+};
+const MAX_NAME_LENGTH = 214;
+/**
+* Validates an npm package name against the rules the registry actually
+* enforces. Returns `null` when valid, or the reason it is not.
+*/
+const validatePackageName = (name) => {
+	if (name.length === 0) return "name is empty";
+	if (name.length > MAX_NAME_LENGTH) return `name is longer than ${MAX_NAME_LENGTH} characters`;
+	if (name.trim() !== name) return "name has leading or trailing whitespace";
+	if (name.startsWith(".")) return "name cannot start with a period";
+	if (name.startsWith("_")) return "name cannot start with an underscore";
+	if (name !== name.toLowerCase()) return "name cannot contain capital letters";
+	if (name.startsWith("@")) {
+		const slash = name.indexOf("/");
+		if (slash === -1) return "scoped name is missing the '/name' part";
+		const scope = name.slice(1, slash);
+		const rest = name.slice(slash + 1);
+		if (scope.length === 0) return "scope is empty";
+		if (rest.length === 0) return "name after the scope is empty";
+		if (rest.includes("/")) return "name contains more than one '/'";
+		if (!SEGMENT_RE.test(scope)) return `scope "${scope}" contains illegal characters`;
+		if (!SEGMENT_RE.test(rest)) return `name "${rest}" contains illegal characters`;
+		return null;
+	}
+	if (name.includes("/")) return "unscoped name cannot contain '/'";
+	if (!SEGMENT_RE.test(name)) return "name contains illegal characters";
+	return null;
+};
+const SEGMENT_RE = /^[a-z0-9\-._~]+$/;
+/**
+* Parses a single spec string.
+*
+* Splitting on `@` is the fiddly part: a scoped name *starts* with `@`, so we
+* look for the last `@` that is not at index 0.
+*/
+const parseSpec = (raw) => {
+	const input = raw.trim();
+	if (input.length === 0) throw new InvalidSpecError(raw, "spec is empty");
+	const at = input.lastIndexOf("@");
+	const hasSelector = at > 0;
+	const name = hasSelector ? input.slice(0, at) : input;
+	const selectorText = hasSelector ? input.slice(at + 1) : "";
+	const nameProblem = validatePackageName(name);
+	if (nameProblem !== null) throw new InvalidSpecError(raw, nameProblem);
+	if (!hasSelector || selectorText.length === 0) return {
+		name,
+		selector: {
+			_tag: "Tag",
+			tag: "latest"
+		},
+		raw: input
+	};
+	return {
+		name,
+		selector: parseSelector(raw, selectorText),
+		raw: input
+	};
+};
+/** Classifies the part after the `@` as an exact version, a range, or a dist-tag. */
+const parseSelector = (raw, text) => {
+	const exact = semver.valid(text, { loose: false });
+	if (exact !== null) return {
+		_tag: "Exact",
+		version: exact
+	};
+	if (semver.validRange(text, { loose: false }) !== null) return {
+		_tag: "Range",
+		range: text
+	};
+	if (!DIST_TAG_RE.test(text)) throw new InvalidSpecError(raw, `"${text}" is not a valid version, semver range, or dist-tag`);
+	return {
+		_tag: "Tag",
+		tag: text
+	};
+};
+const DIST_TAG_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+/**
+* Parses many specs, collecting *every* failure rather than stopping at the
+* first. Somebody bundling forty packages should be told about all four typos
+* in one go, not made to re-run four times.
+*/
+const parseSpecs = (inputs) => {
+	const specs = [];
+	const errors = [];
+	for (const input of inputs) try {
+		specs.push(parseSpec(input));
+	} catch (error) {
+		if (error instanceof InvalidSpecError) errors.push(error);
+		else throw error;
+	}
+	return {
+		specs,
+		errors
+	};
+};
+/**
+* Collapses duplicate specs, keeping the first occurrence.
+*
+* `npmb react react@latest` is a plausible thing to type and should not
+* download React twice.
+*/
+const dedupeSpecs = (specs) => {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const spec of specs) {
+		const key = formatSpec(spec);
+		if (seen.has(key)) continue;
+		seen.add(key);
+		out.push(spec);
+	}
+	return out;
+};
+
+//#endregion
+//#region src/Manifest.ts
+var Manifest_exports = /* @__PURE__ */ __export({
+	MANIFEST_VERSION: () => MANIFEST_VERSION,
+	buildManifest: () => buildManifest,
+	formatReasons: () => formatReasons,
+	serializeManifest: () => serializeManifest
+});
+/** Schema version, bumped when the shape changes incompatibly. */
+const MANIFEST_VERSION = 1;
+/** Renders a package's reasons into short, greppable strings. */
+const formatReasons = (pkg) => pkg.reasons.map((reason) => reason._tag === "Root" ? `root:${reason.spec}` : `${reason.kind}:${reason.from}`);
+/** Builds the manifest for a completed (or dry) run. */
+const buildManifest = (input) => {
+	const includedNames = new Set(input.included.map((p) => `${p.name}@${p.version}`));
+	const packages = input.included.map((pkg) => {
+		const key = `${pkg.name}@${pkg.version}`;
+		return {
+			name: pkg.name,
+			version: pkg.version,
+			path: packagePath(pkg.name, pkg.version),
+			tarball: pkg.manifest.dist.tarball,
+			integrity: pkg.manifest.dist.integrity,
+			shasum: pkg.manifest.dist.shasum,
+			bytes: input.sizes.get(key),
+			reasons: formatReasons(pkg)
+		};
+	});
+	const totalBytes = packages.reduce((sum, entry) => sum + (entry.bytes ?? 0), 0);
+	return {
+		manifestVersion: MANIFEST_VERSION,
+		tool: {
+			name: "packall",
+			version: input.toolVersion
+		},
+		createdAt: (input.createdAt ?? /* @__PURE__ */ new Date()).toISOString(),
+		registry: input.registry,
+		requested: input.resolution.roots.map((root) => formatSpec(root.spec)),
+		roots: input.resolution.roots.map((root) => ({
+			spec: formatSpec(root.spec),
+			versions: root.versions,
+			packageCount: root.closure.filter((key) => includedNames.has(key)).length
+		})),
+		options: {
+			layout: input.options.layout,
+			optionalDependencies: input.options.scope.optional,
+			peerDependencies: input.options.scope.peer,
+			platforms: formatPlatformFilter(input.options.scope.platforms),
+			allVersions: input.options.allVersions,
+			includePrerelease: input.options.includePrerelease,
+			integrityVerified: input.options.verifyIntegrity
+		},
+		packages,
+		warnings: input.resolution.warnings.map((warning) => warning.from === void 0 ? warning.message : `${warning.from}: ${warning.message}`),
+		totals: {
+			packages: packages.length,
+			bytes: totalBytes
+		}
+	};
+};
+/** Serialises a manifest with stable key order and a trailing newline. */
+const serializeManifest = (manifest) => `${JSON.stringify(manifest, null, 2)}\n`;
+
+//#endregion
+//#region src/DependencyRange.ts
+var DependencyRange_exports = /* @__PURE__ */ __export({ parseDependencyTarget: () => parseDependencyTarget });
+const UNSUPPORTED_PROTOCOLS = [
+	["file:", "local file path"],
+	["link:", "local link"],
+	["workspace:", "workspace protocol"],
+	["portal:", "portal protocol"],
+	["patch:", "patch protocol"],
+	["git:", "git dependency"],
+	["git+", "git dependency"],
+	["github:", "GitHub shorthand"],
+	["gitlab:", "GitLab shorthand"],
+	["bitbucket:", "Bitbucket shorthand"],
+	["http:", "remote tarball URL"],
+	["https:", "remote tarball URL"]
+];
+/**
+* Classifies one `name -> range` entry.
+*
+* An empty range, `*`, and `latest` all mean "any published version"; npm
+* treats them interchangeably and so do we.
+*/
+const parseDependencyTarget = (name, raw) => {
+	const text = raw.trim();
+	if (text.length === 0 || text === "*" || text === "x" || text === "latest") return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Range",
+			range: "*"
+		}
+	};
+	if (text.startsWith("npm:")) return parseAlias(name, text);
+	for (const [prefix, reason] of UNSUPPORTED_PROTOCOLS) if (text.startsWith(prefix)) return {
+		_tag: "Unsupported",
+		name,
+		raw: text,
+		reason
+	};
+	if (semver.validRange(text, { loose: true }) === null && /^[\w.-]+\/[\w.-]+/.test(text)) return {
+		_tag: "Unsupported",
+		name,
+		raw: text,
+		reason: "git shorthand"
+	};
+	const exact = semver.valid(text, { loose: true });
+	if (exact !== null) return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Exact",
+			version: exact
+		}
+	};
+	if (semver.validRange(text, { loose: true }) !== null) return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Range",
+			range: text
+		}
+	};
+	if (/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(text)) return {
+		_tag: "Registry",
+		name,
+		selector: {
+			_tag: "Tag",
+			tag: text
+		}
+	};
+	return {
+		_tag: "Unsupported",
+		name,
+		raw: text,
+		reason: "unrecognised version specifier"
+	};
+};
+/**
+* Parses `npm:<name>[@<range>]`.
+*
+* The nested name may itself be scoped, so the `@` split has the same
+* "not at index 0" caveat as top-level spec parsing.
+*/
+const parseAlias = (key, text) => {
+	const body = text.slice(4);
+	if (body.length === 0) return {
+		_tag: "Unsupported",
+		name: key,
+		raw: text,
+		reason: "empty npm: alias"
+	};
+	const at = body.lastIndexOf("@");
+	const target = at > 0 ? body.slice(0, at) : body;
+	const rangeText = at > 0 ? body.slice(at + 1) : "";
+	if (target.length === 0) return {
+		_tag: "Unsupported",
+		name: key,
+		raw: text,
+		reason: "empty npm: alias target"
+	};
+	const inner = parseDependencyTarget(target, rangeText);
+	if (inner._tag === "Unsupported") return {
+		...inner,
+		name: key,
+		raw: text
+	};
+	return {
+		_tag: "Registry",
+		name: target,
+		selector: inner.selector,
+		aliasOf: key
+	};
+};
+
+//#endregion
+//#region src/Resolve.ts
+var Resolve_exports = /* @__PURE__ */ __export({
+	edgesOf: () => edgesOf,
+	indexPackages: () => indexPackages,
+	packageKey: () => packageKey,
+	resolve: () => resolve,
+	selectVersions: () => selectVersions
+});
+const packageKey = (name, version) => `${name}@${version}`;
+/** Index of a resolution by `name@version`, for lookups during bundling. */
+const indexPackages = (resolution) => new Map(resolution.packages.map((p) => [packageKey(p.name, p.version), p]));
+/**
+* Turns a selector into the concrete version(s) it names.
+*
+* `all` controls whether a range collapses to its best match — npm's behaviour,
+* and what you always want for a transitive dependency — or expands to every
+* satisfying published version, which is what `--all-versions` is for.
+*/
+const selectVersions = (packument, selector, options) => {
+	const available = Object.keys(packument.versions);
+	switch (selector._tag) {
+		case "Exact":
+			if (!Object.hasOwn(packument.versions, selector.version)) throw new VersionNotFoundError(packument.name, selector.version, sortVersions(available));
+			return [selector.version];
+		case "Tag": {
+			const version = packument.distTags[selector.tag];
+			if (version === void 0 || !Object.hasOwn(packument.versions, version)) throw new NoMatchingVersionsError(packument.name, selector.tag, sortVersions(available));
+			return [version];
+		}
+		case "Range": {
+			const satisfying = available.filter((v) => semver.satisfies(v, selector.range, {
+				loose: true,
+				includePrerelease: options.includePrerelease
+			})).sort(semver.rcompare);
+			if (satisfying.length === 0) throw new NoMatchingVersionsError(packument.name, selector.range, sortVersions(available));
+			if (!options.all) return [satisfying[0]];
+			return options.maxVersions !== void 0 && options.maxVersions > 0 ? satisfying.slice(0, options.maxVersions) : satisfying;
+		}
+	}
+};
+const sortVersions = (versions) => [...versions].sort((a, b) => semver.valid(a) && semver.valid(b) ? semver.compare(a, b) : a.localeCompare(b));
+const makeWalkState = () => ({
+	resolved: /* @__PURE__ */ new Map(),
+	edges: /* @__PURE__ */ new Map(),
+	packuments: /* @__PURE__ */ new Map(),
+	warnings: [],
+	warningKeys: /* @__PURE__ */ new Set()
+});
+const addWarning = (state, warning) => {
+	const key = `${warning.from ?? ""}|${warning.message}`;
+	if (state.warningKeys.has(key)) return;
+	state.warningKeys.add(key);
+	state.warnings.push(warning);
+};
+/**
+* Fetches a packument, reusing anything already seen in this run.
+*
+* Two fibers in the same wave can race here and both fetch. That is one
+* duplicated GET at worst, and de-racing it would cost more complexity than it
+* saves.
+*/
+const getPackument = (state, name) => Effect.gen(function* () {
+	const cached = state.packuments.get(name);
+	if (cached !== void 0) return cached;
+	const packument = yield* (yield* Registry).packument(name);
+	state.packuments.set(name, packument);
+	return packument;
+});
+/** Expands one resolved manifest into the edges that follow from it. */
+const edgesOf = (manifest, options) => {
+	const from = packageKey(manifest.name, manifest.version);
+	const tasks = [];
+	const warnings = [];
+	const add = (entries, kind, tolerateFailure, skip) => {
+		if (entries === void 0) return;
+		for (const [name, raw] of Object.entries(entries)) {
+			if (skip?.(name)) continue;
+			const target = parseDependencyTarget(name, raw);
+			if (target._tag === "Unsupported") {
+				warnings.push({
+					from,
+					message: `Skipped ${name}@${target.raw} (${target.reason}) — it cannot be fetched from a registry. Vendor it separately if the offline install needs it.`
+				});
+				continue;
+			}
+			tasks.push({
+				name: target.name,
+				selector: target.selector,
+				reason: {
+					_tag: "Edge",
+					from,
+					kind
+				},
+				tolerateFailure
+			});
+		}
+	};
+	add(manifest.dependencies, "prod", false);
+	if (options.scope.optional) add(manifest.optionalDependencies, "optional", true);
+	if (options.scope.peer) {
+		const meta = manifest.peerDependenciesMeta ?? {};
+		add(manifest.peerDependencies, "peer", false, (name) => meta[name]?.optional === true);
+	}
+	return {
+		tasks,
+		warnings
+	};
+};
+/** Edges for a package, computed once and cached. */
+const edgesFor = (state, manifest, options) => {
+	const key = packageKey(manifest.name, manifest.version);
+	const cached = state.edges.get(key);
+	if (cached !== void 0) return cached;
+	const { tasks, warnings } = edgesOf(manifest, options);
+	for (const warning of warnings) addWarning(state, warning);
+	state.edges.set(key, tasks);
+	return tasks;
+};
+/**
+* Resolves everything reachable from `seeds`, returning the closure.
+*
+* `state` is mutated with newly resolved packages and warnings; the returned
+* array is scoped to *this* walk, which is what makes per-root-version
+* closures possible.
+*/
+const walk = (state, seeds, options) => Effect.gen(function* () {
+	const discovered = /* @__PURE__ */ new Set();
+	const attempted = /* @__PURE__ */ new Set();
+	let frontier = seeds;
+	while (frontier.length > 0) {
+		const wave = [];
+		for (const task of frontier) {
+			const id = `${task.name} ${formatSelector(task.selector)}`;
+			if (attempted.has(id)) continue;
+			attempted.add(id);
+			wave.push(task);
+		}
+		if (wave.length === 0) break;
+		const results = yield* Effect.forEach(wave, (task) => resolveTask(state, task, options), { concurrency: options.concurrency });
+		const next = [];
+		for (const result of results) {
+			if (result === null) continue;
+			for (const { manifest, reason } of result) {
+				const key = packageKey(manifest.name, manifest.version);
+				if (!state.resolved.has(key)) {
+					state.resolved.set(key, {
+						name: manifest.name,
+						version: manifest.version,
+						manifest,
+						reasons: [reason]
+					});
+					yield* emit({
+						_tag: "PackageResolved",
+						name: manifest.name,
+						version: manifest.version,
+						resolvedCount: state.resolved.size,
+						pendingCount: next.length
+					});
+					if (manifest.deprecated !== void 0 && manifest.deprecated !== "") addWarning(state, {
+						from: key,
+						message: `${key} is deprecated: ${manifest.deprecated}`
+					});
+				} else {
+					const existing = state.resolved.get(key);
+					if (!hasReason(existing.reasons, reason)) state.resolved.set(key, {
+						...existing,
+						reasons: [...existing.reasons, reason]
+					});
+				}
+				if (!discovered.has(key)) {
+					discovered.add(key);
+					next.push(...edgesFor(state, manifest, options));
+				}
+			}
+		}
+		frontier = next;
+	}
+	return [...discovered];
+});
+const hasReason = (reasons, candidate) => reasons.some((reason) => {
+	if (reason._tag === "Root" && candidate._tag === "Root") return reason.spec === candidate.spec;
+	if (reason._tag === "Edge" && candidate._tag === "Edge") return reason.from === candidate.from && reason.kind === candidate.kind;
+	return false;
+});
+/**
+* Resolves one task to its manifest(s).
+*
+* Returns `null` when an optional edge could not be resolved — the caller
+* treats that as "skip quietly", which is what npm does for
+* `optionalDependencies`.
+*/
+const resolveTask = (state, task, options) => Effect.gen(function* () {
+	const packument = yield* getPackument(state, task.name);
+	const versions = yield* Effect.try({
+		try: () => selectVersions(packument, task.selector, {
+			all: false,
+			includePrerelease: options.includePrerelease
+		}),
+		catch: (error) => error
+	});
+	const out = [];
+	for (const version of versions) {
+		const manifest = packument.versions[version];
+		if (manifest === void 0) continue;
+		if (task.reason._tag === "Edge" && task.reason.kind === "optional" && !isIncluded(manifest, options.scope.platforms)) continue;
+		out.push({
+			manifest,
+			reason: task.reason
+		});
+	}
+	return out;
+}).pipe(Effect.catch((error) => {
+	if (!task.tolerateFailure) return Effect.fail(error);
+	return Effect.sync(() => {
+		addWarning(state, { message: `Optional dependency ${task.name}@${formatSelector(task.selector)} could not be resolved and was skipped: ${error.message}` });
+		return null;
+	});
+}));
+/**
+* Resolves every requested spec.
+*
+* Each selected root *version* is walked separately so `per-spec` layout has an
+* exact closure per tarball, while all walks share one cache, so a package
+* reached from twenty roots is fetched once.
+*/
+const resolve = (specs, options) => Effect.gen(function* () {
+	yield* emit({
+		_tag: "PhaseStarted",
+		phase: "resolve",
+		total: specs.length
+	});
+	const state = makeWalkState();
+	const roots = [];
+	for (const spec of specs) {
+		const packument = yield* getPackument(state, spec.name);
+		const versions = yield* Effect.try({
+			try: () => selectVersions(packument, spec.selector, {
+				all: options.allVersions,
+				maxVersions: options.maxVersions,
+				includePrerelease: options.includePrerelease
+			}),
+			catch: (error) => error
+		});
+		const closures = /* @__PURE__ */ new Map();
+		const union = /* @__PURE__ */ new Set();
+		for (const version of versions) {
+			const closure = yield* walk(state, [{
+				name: spec.name,
+				selector: {
+					_tag: "Exact",
+					version
+				},
+				reason: {
+					_tag: "Root",
+					spec: formatSpec(spec)
+				},
+				tolerateFailure: false
+			}], options);
+			closures.set(version, closure);
+			for (const key of closure) union.add(key);
+		}
+		roots.push({
+			spec,
+			versions,
+			closures,
+			closure: [...union]
+		});
+	}
+	yield* emit({
+		_tag: "PhaseCompleted",
+		phase: "resolve"
+	});
+	return {
+		roots,
+		packages: [...state.resolved.values()].sort(compareResolved),
+		warnings: state.warnings
+	};
+});
+const compareResolved = (a, b) => {
+	if (a.name !== b.name) return a.name < b.name ? -1 : 1;
+	return semver.valid(a.version) && semver.valid(b.version) ? semver.compare(a.version, b.version) : a.version.localeCompare(b.version);
+};
+
+//#endregion
+//#region src/Bundle.ts
+var Bundle_exports = /* @__PURE__ */ __export({
+	bundle: () => bundle,
+	bundleResolved: () => bundleResolved,
+	plan: () => plan,
+	plannedOutputs: () => plannedOutputs,
+	summarize: () => summarize,
+	withLayout: () => withLayout
+});
+/** Computes the plan summary for a resolution. */
+const summarize = (resolution) => {
+	let perSpecArchives = 0;
+	let perSpecEntries = 0;
+	for (const root of resolution.roots) for (const version of root.versions) {
+		perSpecArchives += 1;
+		perSpecEntries += (root.closures.get(version) ?? []).length;
+	}
+	return {
+		uniquePackages: resolution.packages.length,
+		perSpecArchives,
+		perSpecEntries
+	};
+};
+/** Replaces the layout on a set of options. */
+const withLayout = (options, layout) => ({
+	...options,
+	layout
+});
+/**
+* Checks the registry is reachable, then resolves every spec.
+*
+* Split out from `bundle` so a caller can inspect the plan — how many packages,
+* how many archives — and act on it before any bytes move. The CLI uses this to
+* offer a different layout when a run turns out to be much larger than
+* expected.
+*/
+const plan = (specs, options) => Effect.gen(function* () {
+	const registry = yield* Registry;
+	yield* emit({
+		_tag: "PhaseStarted",
+		phase: "preflight"
+	});
+	yield* registry.preflight;
+	yield* emit({
+		_tag: "PhaseCompleted",
+		phase: "preflight"
+	});
+	return yield* resolve(specs, options);
+});
+/**
+* Resolves, downloads and packages a set of specs.
+*
+* Under `dryRun` this stops after resolution and reports the plan — useful for
+* checking what a command *would* pull before committing to a multi-gigabyte
+* download over a slow VPN.
+*/
+const bundle = (specs, options) => Effect.gen(function* () {
+	return yield* bundleResolved(yield* plan(specs, options), options);
+});
+/**
+* Downloads and packages an already-computed resolution.
+*
+* Everything from here on touches the disk, and all of it happens inside
+* `Effect.scoped` — so the staging tree's lifetime is exactly this call,
+* including when it fails partway through or the user hits Ctrl-C.
+*/
+const bundleResolved = (resolution, options) => Effect.gen(function* () {
+	if (options.dryRun) return {
+		resolution,
+		artifacts: [],
+		downloadedBytes: 0,
+		unverified: [],
+		dryRun: true
+	};
+	return yield* Effect.scoped(runBundle(resolution, options));
+});
+const runBundle = (resolution, options) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const registry = yield* Registry;
+	yield* prepareOutputDir(resolution, options);
+	const staging = yield* fs.makeTempDirectoryScoped({ prefix: "packall-" });
+	const packagesDir = path.join(staging, "packages");
+	yield* fs.makeDirectory(packagesDir, { recursive: true });
+	const report = yield* downloadAll(resolution.packages, packagesDir, {
+		concurrency: options.concurrency,
+		verifyIntegrity: options.verifyIntegrity
+	});
+	yield* emit({
+		_tag: "PhaseStarted",
+		phase: "archive"
+	});
+	const registryInfo = {
+		kind: registry.kind,
+		url: registry.registryFor(resolution.roots[0]?.spec.name ?? "")
+	};
+	const index = indexPackages(resolution);
+	const artifacts = options.layout === "single" ? yield* emitSingle({
+		resolution,
+		options,
+		staging,
+		packagesDir,
+		report,
+		registryInfo
+	}) : options.layout === "dir" ? yield* emitDirectory({
+		resolution,
+		options,
+		packagesDir,
+		report,
+		registryInfo
+	}) : yield* emitPerSpec({
+		resolution,
+		options,
+		staging,
+		packagesDir,
+		report,
+		registryInfo,
+		index
+	});
+	yield* emit({
+		_tag: "PhaseCompleted",
+		phase: "archive"
+	});
+	yield* emit({
+		_tag: "PhaseStarted",
+		phase: "done"
+	});
+	return {
+		resolution,
+		artifacts,
+		downloadedBytes: report.totalBytes,
+		unverified: report.unverified,
+		dryRun: false
+	};
+});
+/** One tarball containing the deduplicated union of every closure. */
+const emitSingle = (input) => Effect.gen(function* () {
+	const path = yield* Path.Path;
+	const archiveName = singleArchiveName(input.options.archiveName ?? "bundle");
+	if (input.options.skipExisting?.has(archiveName) === true) return [];
+	yield* writeBundleMetadata({
+		dir: input.packagesDir,
+		resolution: input.resolution,
+		included: input.resolution.packages,
+		options: input.options,
+		registryInfo: input.registryInfo,
+		sizes: input.report.sizes
+	});
+	const outPath = path.join(input.options.outDir, archiveName);
+	const result = yield* createArchive({
+		cwd: input.packagesDir,
+		entries: yield* topLevelEntries(input.packagesDir),
+		outPath
+	});
+	return [{
+		kind: "archive",
+		path: result.path,
+		bytes: result.bytes,
+		packageCount: input.resolution.packages.length
+	}];
+});
+/** The raw npm-layout tree, no archive. */
+const emitDirectory = (input) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	yield* writeBundleMetadata({
+		dir: input.packagesDir,
+		resolution: input.resolution,
+		included: input.resolution.packages,
+		options: input.options,
+		registryInfo: input.registryInfo,
+		sizes: input.report.sizes
+	});
+	yield* fs.copy(input.packagesDir, input.options.outDir, { overwrite: true }).pipe(Effect.mapError((cause) => new OutputError(input.options.outDir, "could not write output tree", { cause })));
+	const bytes = [...input.report.sizes.values()].reduce((a, b) => a + b, 0);
+	return [{
+		kind: "directory",
+		path: input.options.outDir,
+		bytes,
+		packageCount: input.resolution.packages.length
+	}];
+});
+/**
+* One tarball per resolved root *version*.
+*
+* Under `--all-versions react@^18` this produces `react-18.0.0.tgz`,
+* `react-18.1.0.tgz` and so on, each independently importable — which is the
+* whole reason to prefer this layout.
+*/
+const emitPerSpec = (input) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const artifacts = [];
+	let counter = 0;
+	for (const root of input.resolution.roots) for (const version of root.versions) {
+		if (input.options.skipExisting?.has(perSpecArchiveName(root.spec.name, version)) === true) continue;
+		const included = (root.closures.get(version) ?? []).map((key) => input.index.get(key)).filter((pkg) => pkg !== void 0);
+		const rootDir = path.join(input.staging, "roots", String(counter++));
+		yield* fs.makeDirectory(rootDir, { recursive: true });
+		for (const pkg of included) {
+			const parts = packagePath(pkg.name, pkg.version).split("/");
+			const source = path.join(input.packagesDir, ...parts);
+			const target = path.join(rootDir, ...parts);
+			yield* fs.makeDirectory(path.dirname(target), { recursive: true });
+			yield* linkOrCopy(source, target);
+		}
+		yield* writeBundleMetadata({
+			dir: rootDir,
+			resolution: {
+				...input.resolution,
+				roots: [{
+					...root,
+					versions: [version]
+				}]
+			},
+			included,
+			options: input.options,
+			registryInfo: input.registryInfo,
+			sizes: input.report.sizes
+		});
+		const outPath = path.join(input.options.outDir, perSpecArchiveName(root.spec.name, version));
+		const result = yield* createArchive({
+			cwd: rootDir,
+			entries: yield* topLevelEntries(rootDir),
+			outPath
+		});
+		artifacts.push({
+			kind: "archive",
+			path: result.path,
+			bytes: result.bytes,
+			packageCount: included.length,
+			spec: formatSpec(root.spec),
+			version
+		});
+	}
+	return artifacts;
+});
+/**
+* Hard-links a file, falling back to a copy.
+*
+* Hard links make `per-spec` layout nearly free in the staging tree. They fail
+* across devices and on some Windows configurations, so the copy fallback is
+* not optional.
+*/
+const linkOrCopy = (source, target) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	yield* fs.link(source, target).pipe(Effect.catch(() => fs.copyFile(source, target)));
+});
+/** Writes the manifest and import guide into a staging directory. */
+const writeBundleMetadata = (input) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const createdAt = /* @__PURE__ */ new Date();
+	const manifest = buildManifest({
+		resolution: input.resolution,
+		included: input.included,
+		options: input.options,
+		registry: input.registryInfo,
+		toolVersion: input.options.toolVersion,
+		sizes: input.sizes,
+		createdAt
+	});
+	yield* fs.writeFileString(path.join(input.dir, MANIFEST_FILE), serializeManifest(manifest));
+	yield* fs.writeFileString(path.join(input.dir, README_FILE), importGuide({
+		packageCount: input.included.length,
+		createdAt: createdAt.toISOString(),
+		toolVersion: input.options.toolVersion
+	}));
+});
+/** Sorted top-level entries of a directory, used as the tar entry list. */
+const topLevelEntries = (dir) => Effect.gen(function* () {
+	return [...yield* (yield* FileSystem.FileSystem).readDirectory(dir)].sort();
+});
+const plannedOutputs = (resolution, options) => {
+	if (options.layout === "dir") return [{ file: MANIFEST_FILE }, { file: README_FILE }];
+	if (options.layout === "single") return [{ file: singleArchiveName(options.archiveName ?? "bundle") }];
+	return resolution.roots.flatMap((root) => root.versions.map((version) => ({
+		file: perSpecArchiveName(root.spec.name, version),
+		name: root.spec.name,
+		version
+	})));
+};
+/**
+* Fails if the run would overwrite something, unless `--force`.
+*
+* The guard is on the *files this run writes*, not on whether the directory has
+* anything in it. An output directory accumulating bundles is the normal way to
+* use this — bundling `esbuild` into an `out/` that already holds `tsdown` is
+* not a conflict, and refusing it made `--out` a single-use directory and the
+* default `.` unusable.
+*
+* Checked before anything is downloaded. Discovering the collision *after* a
+* twenty-minute download would be a uniquely irritating way to fail.
+*/
+const prepareOutputDir = (resolution, options) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const outDir = options.outDir;
+	if (!options.force) {
+		const clashes = [];
+		for (const planned of plannedOutputs(resolution, options)) {
+			if (options.skipExisting?.has(planned.file) === true) continue;
+			if (options.overwrite?.has(planned.file) === true) continue;
+			if (yield* fs.exists(path.join(outDir, planned.file)).pipe(Effect.orElseSucceed(() => false))) clashes.push(planned.file);
+		}
+		if (clashes.length > 0) return yield* Effect.fail(new OutputError(outDir, `would overwrite ${clashes.length} existing file${clashes.length === 1 ? "" : "s"} (${clashes.slice(0, 3).join(", ")}${clashes.length > 3 ? ", …" : ""}). Pass --force true to replace ${clashes.length === 1 ? "it" : "them"}, or choose a different --out.`));
+	}
+	yield* fs.makeDirectory(outDir, { recursive: true }).pipe(Effect.mapError((cause) => new OutputError(outDir, "could not create output directory", { cause })));
+});
+
+//#endregion
+//#region src/InputFile.ts
+var InputFile_exports = /* @__PURE__ */ __export({
+	defaultInputFileOptions: () => defaultInputFileOptions,
+	parseInputFile: () => parseInputFile,
+	readInputFile: () => readInputFile
+});
+const defaultInputFileOptions = { includeDev: true };
+/** Reads and parses an input file. */
+const readInputFile = (filePath, options = defaultInputFileOptions) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	if (!(yield* fs.exists(filePath).pipe(Effect.mapError((cause) => new InvalidInputFileError(filePath, "could not be read", { cause }))))) return yield* Effect.fail(new InvalidInputFileError(filePath, "file does not exist"));
+	const content = yield* fs.readFileString(filePath).pipe(Effect.mapError((cause) => new InvalidInputFileError(filePath, "could not be read", { cause })));
+	return yield* Effect.try({
+		try: () => parseInputFile(filePath, content, options),
+		catch: (error) => error instanceof InvalidInputFileError ? error : new InvalidInputFileError(filePath, describe(error), { cause: error })
+	});
+});
+/**
+* Parses file content that has already been read.
+*
+* Split out from the IO so the whole of this logic is testable with plain
+* strings and no file system at all.
+*/
+const parseInputFile = (filePath, content, options = defaultInputFileOptions) => {
+	const trimmed = content.trim();
+	if (trimmed.length === 0) throw new InvalidInputFileError(filePath, "file is empty");
+	return looksLikeJson(trimmed) ? fromPackageJson(filePath, trimmed, options) : fromList(filePath, content);
+};
+const looksLikeJson = (trimmed) => trimmed.startsWith("{");
+const fromPackageJson = (filePath, content, options) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(content);
+	} catch (error) {
+		throw new InvalidInputFileError(filePath, `not valid JSON — ${describe(error)}`, { cause: error });
+	}
+	const specs = [];
+	const warnings = [];
+	const seen = /* @__PURE__ */ new Set();
+	const collect = (entries, label, skip) => {
+		if (entries === void 0) return;
+		for (const [name, raw] of Object.entries(entries)) {
+			if (skip?.(name)) continue;
+			const target = parseDependencyTarget(name, raw);
+			if (target._tag === "Unsupported") {
+				warnings.push(`${label}: skipped ${name}@${target.raw} (${target.reason}) — not fetchable from a registry`);
+				continue;
+			}
+			const key = `${target.name}|${JSON.stringify(target.selector)}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			specs.push({
+				name: target.name,
+				selector: target.selector,
+				raw: `${target.name}@${raw}`
+			});
+		}
+	};
+	collect(parsed.dependencies, "dependencies");
+	collect(parsed.optionalDependencies, "optionalDependencies");
+	if (options.includeDev) collect(parsed.devDependencies, "devDependencies");
+	const meta = parsed.peerDependenciesMeta ?? {};
+	collect(parsed.peerDependencies, "peerDependencies", (name) => meta[name]?.optional === true);
+	if (specs.length === 0) throw new InvalidInputFileError(filePath, options.includeDev ? "package.json declares no dependencies to bundle" : "package.json declares no non-dev dependencies to bundle (drop --prod to include devDependencies)");
+	return {
+		kind: "package.json",
+		specs,
+		warnings
+	};
+};
+const fromList = (filePath, content) => {
+	const lines = [];
+	const rawLines = content.split(/\r?\n/);
+	for (const line of rawLines) {
+		const withoutComment = stripComment(line).trim();
+		if (withoutComment.length === 0) continue;
+		lines.push(withoutComment);
+	}
+	if (lines.length === 0) throw new InvalidInputFileError(filePath, "no package specs found (only blank lines and comments)");
+	const { specs, errors } = parseSpecs(lines);
+	if (errors.length > 0) throw new InvalidInputFileError(filePath, formatSpecErrors(errors, rawLines));
+	return {
+		kind: "list",
+		specs,
+		warnings: []
+	};
+};
+/**
+* Strips `#` and `//` comments.
+*
+* `//` only counts when it is not part of a URL, so a future line containing
+* `https://…` does not get silently truncated.
+*/
+const stripComment = (line) => {
+	const hash = line.indexOf("#");
+	let result = hash === -1 ? line : line.slice(0, hash);
+	const slashes = result.indexOf("//");
+	if (slashes > 0 && result[slashes - 1] !== ":") result = result.slice(0, slashes);
+	else if (slashes === 0) result = "";
+	return result;
+};
+const formatSpecErrors = (errors, rawLines) => {
+	const details = errors.map((error) => {
+		const index = rawLines.findIndex((line) => stripComment(line).trim() === error.spec);
+		const where = index === -1 ? "" : ` (line ${index + 1})`;
+		return `    ${error.spec}${where}: ${error.reason}`;
+	});
+	return `${errors.length} invalid spec(s):\n${details.join("\n")}`;
+};
+const describe = (error) => error instanceof Error ? error.message : String(error);
+
+//#endregion
+//#region src/Options.ts
+var Options_exports = /* @__PURE__ */ __export({
+	defaultBundleOptions: () => defaultBundleOptions,
+	defaultResolveOptions: () => defaultResolveOptions,
+	defaultScope: () => defaultScope,
+	layouts: () => layouts
+});
+const layouts = [
+	"per-spec",
+	"single",
+	"dir"
+];
+const defaultScope = {
+	optional: true,
+	peer: true,
+	platforms: allPlatforms
+};
+const defaultResolveOptions = {
+	scope: defaultScope,
+	allVersions: false,
+	includePrerelease: false,
+	concurrency: 10
+};
+const defaultBundleOptions = {
+	...defaultResolveOptions,
+	layout: "per-spec",
+	dryRun: false,
+	verifyIntegrity: true,
+	force: false
+};
+
+//#endregion
+export { Archive_exports as Archive, ArchiveError, AuthenticationError, Bundle_exports as Bundle, DependencyRange_exports as DependencyRange, Download_exports as Download, InputFile_exports as InputFile, Integrity_exports as Integrity, IntegrityError, InvalidInputFileError, InvalidSpecError, Layout_exports as Layout, Manifest_exports as Manifest, NoMatchingVersionsError, Options_exports as Options, OutputError, PackageNotFoundError, Platform_exports as Platform, Progress_exports as Progress, Progress as ProgressTag, Registry, RegistryResponseError, RegistryUnreachableError, Resolve_exports as Resolve, Spec_exports as Spec, VersionNotFoundError, allPlatforms, bundle, bundleResolved, currentPlatform, defaultBundleOptions, defaultResolveOptions, defaultScope, layouts, parsePlatformTarget, parseSpec, parseSpecs, plan, plannedOutputs, platformTargets, resolve, summarize, withLayout };
+//# sourceMappingURL=index.js.map