@visulima/package 5.0.0-alpha.3 → 5.0.0-alpha.31

package/CHANGELOG.md

@@ -1,3 +1,373 @@
+## @visulima/package [5.0.0-alpha.31](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.30...@visulima/package@5.0.0-alpha.31) (2026-06-13)
+
+### Features
+
+* **package:** recognise the modern bun.lock text lockfile ([8fec531](https://github.com/visulima/visulima/commit/8fec531a20c32857de93c801d4b42e0eff32c6a8))
+
+### Bug Fixes
+
+* **package:** replace unsafe type cast with String() coercions ([4c85a5e](https://github.com/visulima/visulima/commit/4c85a5e3fdeb194a0a2bbcee24b85ee23697d3ea))
+* **package:** resolve caching and ReDoS findings ([fb9e5cb](https://github.com/visulima/visulima/commit/fb9e5cb0fbb5fad2078750464845c6b223e0afc5))
+
+### Tests
+
+* **package:** stop partial process stub leaking across ensurePackages tests ([7059537](https://github.com/visulima/visulima/commit/705953754fe0a64612de06ff1140a9e744b25bfe))
+
+### Build System
+
+* regenerate bundled-license manifests and types ordering ([af26588](https://github.com/visulima/visulima/commit/af26588d75aaa937fd4862800560bd4070a4878c))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.32
+* **@visulima/path:** upgraded to 3.0.0-alpha.13
+
+## @visulima/package [5.0.0-alpha.30](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.29...@visulima/package@5.0.0-alpha.30) (2026-06-04)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.31
+
+## @visulima/package [5.0.0-alpha.29](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.28...@visulima/package@5.0.0-alpha.29) (2026-06-04)
+
+### Bug Fixes
+
+* **lint:** clear pre-existing eslint rot across packages ([#674](https://github.com/visulima/visulima/issues/674)) ([5354253](https://github.com/visulima/visulima/commit/5354253b163bd50bcefaf8a3fddf831bdb5df32b))
+* **package:** 4 bug fixes ([1e2fba6](https://github.com/visulima/visulima/commit/1e2fba6b0d048f3b90f4e0b428fd984d66f1431e))
+
+### Tests
+
+* fix cross-platform flakes in package + cerebro ([#676](https://github.com/visulima/visulima/issues/676)) ([d1afb4b](https://github.com/visulima/visulima/commit/d1afb4ba743cf18bdf9f02081539d70bdcda91e9))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.30
+* **@visulima/path:** upgraded to 3.0.0-alpha.12
+
+## @visulima/package [5.0.0-alpha.28](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.27...@visulima/package@5.0.0-alpha.28) (2026-06-02)
+
+### Miscellaneous Chores
+
+* apply eslint + prettier autofixes across packages ([c1bb784](https://github.com/visulima/visulima/commit/c1bb7848a0d93d0dfe2960c77e3cda22239c79a0))
+
+### Tests
+
+* **package:** cover confirm prompt, lockfile parsers, package-json/manager, monorepo, and pnpm workspace branches ([7916131](https://github.com/visulima/visulima/commit/7916131a2206a8ebefb0817d7ae0a340fdee2ba0))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.29
+
+## @visulima/package [5.0.0-alpha.27](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.26...@visulima/package@5.0.0-alpha.27) (2026-05-27)
+
+### Bug Fixes
+
+* **storage-client:** percent-encode user fields in defaultFingerprint ([7c78a0f](https://github.com/visulima/visulima/commit/7c78a0f9512e2a673b941d80839e9f1e86b7b5d0))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.28
+* **@visulima/path:** upgraded to 3.0.0-alpha.11
+
+## @visulima/package [5.0.0-alpha.26](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.25...@visulima/package@5.0.0-alpha.26) (2026-05-26)
+
+### Miscellaneous Chores
+
+* sorted package.json ([b47c545](https://github.com/visulima/visulima/commit/b47c545591600fdab17d5cd3a3fbc68b61e199da))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.27
+
+## @visulima/package [5.0.0-alpha.25](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.24...@visulima/package@5.0.0-alpha.25) (2026-05-26)
+
+### Miscellaneous Chores
+
+* **ci-stability:** green CI across vis, native, lint, tests, attw ([#651](https://github.com/visulima/visulima/issues/651)) ([d4eb684](https://github.com/visulima/visulima/commit/d4eb684b5f75c818c9251048c605a0ed54a268e3))
+* **repo:** sort package.json keys across all packages ([e1fd9ab](https://github.com/visulima/visulima/commit/e1fd9ab467ef96a98c777da1572ff6a50fcf7e71))
+
+### Tests
+
+* **repo:** add dist runtime + types integration tests ([32ee300](https://github.com/visulima/visulima/commit/32ee300b7184117a0ddf9f9d390f75f8932d5ed9))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.26
+
+## @visulima/package [5.0.0-alpha.24](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.23...@visulima/package@5.0.0-alpha.24) (2026-05-20)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.25
+
+## @visulima/package [5.0.0-alpha.23](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.22...@visulima/package@5.0.0-alpha.23) (2026-05-19)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.24
+
+## @visulima/package [5.0.0-alpha.22](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.21...@visulima/package@5.0.0-alpha.22) (2026-05-16)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.23
+
+## @visulima/package [5.0.0-alpha.21](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.20...@visulima/package@5.0.0-alpha.21) (2026-05-14)
+
+### Miscellaneous Chores
+
+* **tooling:** apply prettier and eslint formatting sweep ([c2c641d](https://github.com/visulima/visulima/commit/c2c641d40242e99030cb990fa01039db5e267667))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.22
+
+## @visulima/package [5.0.0-alpha.20](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.19...@visulima/package@5.0.0-alpha.20) (2026-05-11)
+
+### ⚠ BREAKING CHANGES
+
+* **vis:** vis sbom now emits CycloneDX 1.7. Downstream consumers
+pinned to a 1.6 validator must upgrade.
+
+Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
+
+### Features
+
+* **vis:** bump sbom to cyclonedx 1.7 ([904075f](https://github.com/visulima/visulima/commit/904075fd9353e40b593d5a13f53307c584e31da7))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.21
+
+## @visulima/package [5.0.0-alpha.19](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.18...@visulima/package@5.0.0-alpha.19) (2026-05-11)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.20
+
+## @visulima/package [5.0.0-alpha.18](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.17...@visulima/package@5.0.0-alpha.18) (2026-05-10)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.19
+
+## @visulima/package [5.0.0-alpha.17](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.16...@visulima/package@5.0.0-alpha.17) (2026-05-10)
+
+### Code Refactoring
+
+* replace execa with tinyexec ([56ec776](https://github.com/visulima/visulima/commit/56ec776908fe0c068c54542f3885cb29f061fea7))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.18
+
+## @visulima/package [5.0.0-alpha.16](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.15...@visulima/package@5.0.0-alpha.16) (2026-05-07)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.17
+
+## @visulima/package [5.0.0-alpha.15](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.14...@visulima/package@5.0.0-alpha.15) (2026-05-07)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.16
+
+## @visulima/package [5.0.0-alpha.14](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.13...@visulima/package@5.0.0-alpha.14) (2026-05-06)
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.15
+
+## @visulima/package [5.0.0-alpha.13](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.12...@visulima/package@5.0.0-alpha.13) (2026-05-06)
+
+### Miscellaneous Chores
+
+* **package:** apply prettier and eslint quote-style auto-fix ([0316bca](https://github.com/visulima/visulima/commit/0316bca0deca444ff12675bc760c7091ce243d31))
+* **package:** housekeeping cleanup ([113978b](https://github.com/visulima/visulima/commit/113978b0babcfc7879514aec076f6e2d5e7afab0))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.14
+
+## @visulima/package [5.0.0-alpha.12](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.11...@visulima/package@5.0.0-alpha.12) (2026-05-04)
+
+### Miscellaneous Chores
+
+* **package:** upgrade packem to 2.0.0-alpha.76 ([b2ef62b](https://github.com/visulima/visulima/commit/b2ef62b72a84545cb025a250cbe7e3e36b34330d))
+* re-sort workspace package.json files via vis sort-package-json ([f625696](https://github.com/visulima/visulima/commit/f625696cfac974325774b3243e1a83c3d23acbd7))
+* simplify pnpm-workspace packages list ([7cab221](https://github.com/visulima/visulima/commit/7cab221163632d9b7aa044a6f88c49083103a869))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.13
+
+## @visulima/package [5.0.0-alpha.11](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.10...@visulima/package@5.0.0-alpha.11) (2026-04-22)
+
+### Bug Fixes
+
+* Remove JSR configuration generation script and generated jsr.json files ([#616](https://github.com/visulima/visulima/issues/616)) ([533744b](https://github.com/visulima/visulima/commit/533744b103b74896941db5b727173e617a27a63b))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.12
+* **@visulima/path:** upgraded to 3.0.0-alpha.10
+
+## @visulima/package [5.0.0-alpha.10](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.9...@visulima/package@5.0.0-alpha.10) (2026-04-21)
+
+### Miscellaneous Chores
+
+* jsr.json update and lock file ([73fce38](https://github.com/visulima/visulima/commit/73fce38c7cb4603f3fffb88609b1b18e2feb4937))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.11
+
+## @visulima/package [5.0.0-alpha.9](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.8...@visulima/package@5.0.0-alpha.9) (2026-04-21)
+
+### Miscellaneous Chores
+
+* update the jsr.json ([864ab7e](https://github.com/visulima/visulima/commit/864ab7e71c4b5ae82f64792d1ae8debfea2c539b))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.10
+
+## @visulima/package [5.0.0-alpha.8](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.7...@visulima/package@5.0.0-alpha.8) (2026-04-21)
+
+### Features
+
+* Add CycloneDX 1.6 SBOM generation with `vis sbom` command ([#611](https://github.com/visulima/visulima/issues/611)) ([1e95276](https://github.com/visulima/visulima/commit/1e9527630958722a0f0f7e79d18bb23b5a57e0df))
+* **package:** add lockfile utilities ([12f9076](https://github.com/visulima/visulima/commit/12f9076ba1570bec2f2d43b58fcd31701634434e))
+
+### Bug Fixes
+
+* **package:** hoist regexes, rewrite lockfile parser, resolve eslint issues ([585ed7f](https://github.com/visulima/visulima/commit/585ed7f16b3f42996bb030a8bae5f1f37a50c316))
+
+### Miscellaneous Chores
+
+* **api-platform:** apply pending lint and source updates ([3fb0043](https://github.com/visulima/visulima/commit/3fb0043a4cf35f752ca89a09a077100ae0142da8))
+* bump engines.node to ^22.14.0 || >=24.10.0 ([c3d0931](https://github.com/visulima/visulima/commit/c3d0931d1504e4f21ebf50ea680cfa7ce4ba15ce))
+* fixed jsr.json ([5d85e51](https://github.com/visulima/visulima/commit/5d85e5179de38e284ec433b14d77c71a1619c8d6))
+* **package:** apply formatter and lint fixes ([a0f4acf](https://github.com/visulima/visulima/commit/a0f4acfb15beb256edd3b62958b4e3db039757a9))
+* **package:** apply pending changes ([919b214](https://github.com/visulima/visulima/commit/919b214f9659a5b4ff95ec8b35a70c10af3c4853))
+* **package:** apply pending lint and source updates ([2fd1c04](https://github.com/visulima/visulima/commit/2fd1c044d9528500943368c01f9b24fd2280058c))
+* **package:** enforce curly braces and apply lint fixes ([0df50ba](https://github.com/visulima/visulima/commit/0df50ba4f45bac67dabeb78ebfc3d555ba5aec56))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.9
+
+## @visulima/package [5.0.0-alpha.7](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.6...@visulima/package@5.0.0-alpha.7) (2026-04-08)
+
+### Bug Fixes
+
+* **package:** properly fix eslint errors in code ([56b1547](https://github.com/visulima/visulima/commit/56b15474d6edd8f33fb46cca81fa34d600df2023))
+* **package:** remove remaining eslint suppressions with proper code fixes ([69efa7a](https://github.com/visulima/visulima/commit/69efa7a9c67977c491a1ec8eaded733478ed29a1))
+* **package:** resolve eslint errors ([1ec4728](https://github.com/visulima/visulima/commit/1ec47286cfcec55ea50c51d51f198b119dd22e71))
+* resolve failing tests across multiple packages ([2b4b6f0](https://github.com/visulima/visulima/commit/2b4b6f04169b60fdc4cf77b293015436a272c0fb))
+
+### Miscellaneous Chores
+
+* **package:** add tsconfig.eslint.json for type-aware linting ([0355fea](https://github.com/visulima/visulima/commit/0355fea301fb7a8571da25bebd108830bc23ed04))
+* **package:** apply prettier formatting ([ebb5bd1](https://github.com/visulima/visulima/commit/ebb5bd12c6b7d49811c68ea96bf62ce7e2a7d42d))
+* **package:** migrate .prettierrc.cjs to prettier.config.js ([2b84ef0](https://github.com/visulima/visulima/commit/2b84ef0db67467e1360b2f1e6f9b6e96bf3dbbb0))
+* **tooling:** remove empty dependency objects from package.json ([dc52a23](https://github.com/visulima/visulima/commit/dc52a23bc1e2d36f4ec71ca67506bf6861a02929))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.7
+* **@visulima/path:** upgraded to 3.0.0-alpha.8
+
+## @visulima/package [5.0.0-alpha.6](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.5...@visulima/package@5.0.0-alpha.6) (2026-03-26)
+
+### Features
+
+* **web:** auto-generate packages page from workspace metadata ([623e520](https://github.com/visulima/visulima/commit/623e5207693a7fe720f5f2f179593a3654c880e3))
+
+### Miscellaneous Chores
+
+* update homepage URLs to visulima.com/packages/ format ([be42968](https://github.com/visulima/visulima/commit/be42968129df85fb074224435e33135ff44cab91))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.6
+* **@visulima/path:** upgraded to 3.0.0-alpha.7
+
+## @visulima/package [5.0.0-alpha.5](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.4...@visulima/package@5.0.0-alpha.5) (2026-03-26)
+
+### Bug Fixes
+
+* **package:** use workspace:* for internal [@visulima](https://github.com/visulima) deps ([e409128](https://github.com/visulima/visulima/commit/e409128c02a6d801dd385ae845c1ab28ca5c09da))
+* **web:** improve build setup with incremental stats caching and prod install ([fe33e75](https://github.com/visulima/visulima/commit/fe33e75827586779b4b3a0c6d57b39f889ee6207))
+
+### Miscellaneous Chores
+
+* **package:** migrate deps to pnpm catalogs ([301fac4](https://github.com/visulima/visulima/commit/301fac41be88df7469155649467921a72ca740a6))
+* **package:** update dependencies ([fb1a43d](https://github.com/visulima/visulima/commit/fb1a43de0fd345806d76aec660d48c627d576083))
+* visulima website ([#591](https://github.com/visulima/visulima/issues/591)) ([59ab2e2](https://github.com/visulima/visulima/commit/59ab2e2befb03e51cd2088956f83d9b87de6d033))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.5
+* **@visulima/path:** upgraded to 3.0.0-alpha.6
+
+## @visulima/package [5.0.0-alpha.4](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.3...@visulima/package@5.0.0-alpha.4) (2026-03-06)
+
+### Bug Fixes
+
+* **package:** update packem to 2.0.0-alpha.54 ([e5b3249](https://github.com/visulima/visulima/commit/e5b3249026a425b7a42443f66a08f8f68c3d62e4))
+* **package:** use intentionally malformed JSON in bad workspace fixture ([a6680e7](https://github.com/visulima/visulima/commit/a6680e7a97aeae643c26b69bc5eb6c64c28de278))
+
+### Documentation
+
+* **humanizer,html,iso-locale,package,tsconfig:** add comprehensive Fumadocs documentation ([19781ce](https://github.com/visulima/visulima/commit/19781ce5d27605971a9f2fdf0a99863effd98091))
+
+### Miscellaneous Chores
+
+* **package:** update dependencies ([d89cde6](https://github.com/visulima/visulima/commit/d89cde6792e9036d0690cfaf9b771e26b24faac8))
+* **package:** update dependencies ([4b62cf8](https://github.com/visulima/visulima/commit/4b62cf85e6ef4deac4ef01c8a7e15bcf49ecbe80))
+* **tooling:** update dependencies ([7f6f9d3](https://github.com/visulima/visulima/commit/7f6f9d3c41b170c53659ab34b79ceb23e4e9660a))
+* update lock file maintenance ([d83e716](https://github.com/visulima/visulima/commit/d83e71697b75d24704185b66bb521a934d2db02d))
+* year update ([47f4105](https://github.com/visulima/visulima/commit/47f410596ce7190cfea36a073db32e0cec50bbcd))
+
+### Tests
+
+* **package:** fix broken JSON test fixture ([46141d6](https://github.com/visulima/visulima/commit/46141d6472d8de20512109200a12e79c48ddc33c))
+
+
+### Dependencies
+
+* **@visulima/fs:** upgraded to 5.0.0-alpha.4
+* **@visulima/path:** upgraded to 3.0.0-alpha.5
+
 ## @visulima/package [5.0.0-alpha.3](https://github.com/visulima/visulima/compare/@visulima/package@5.0.0-alpha.2...@visulima/package@5.0.0-alpha.3) (2025-12-27)
 
 ### Bug Fixes

package/LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 visulima
+Copyright (c) 2026 visulima
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -155,6 +155,41 @@ const version = await getPackageManagerVersion("pnpm");
 // => '8.15.0'
 ```
 
+> `getPackageManagerVersion` only accepts the known managers (`npm`, `pnpm`, `yarn`, `bun`) and throws on anything else, so a `packageManager`-derived value from an untrusted repo can't be executed as an arbitrary binary.
+
+#### identifyInitiatingPackageManager
+
+Detects which package manager is currently executing the process by reading the `npm_config_user_agent` environment variable. Useful inside `postinstall`/`prepare` scripts to print the right install command. Returns `undefined` when the variable is not set.
+
+```typescript
+import { identifyInitiatingPackageManager } from "@visulima/package";
+
+const pm = identifyInitiatingPackageManager();
+// => { name: 'pnpm', version: '8.15.0' } | { name: 'cnpm', ... } | undefined
+```
+
+#### generateMissingPackagesInstallMessage
+
+Builds a human-readable message instructing the user how to install missing packages with each requested package manager.
+
+```typescript
+import { generateMissingPackagesInstallMessage } from "@visulima/package";
+
+const message = generateMissingPackagesInstallMessage("my-tool", ["typescript", "@types/node"], {
+    packageManagers: ["npm", "pnpm", "yarn"], // default: ["npm", "pnpm", "yarn"]
+    preMessage: "Some optional dependencies are missing.\n",
+    postMessage: "\nSee the docs for details.",
+});
+
+console.log(message);
+// my-tool could not find the following packages
+//   typescript
+//   @types/node
+// To install the missing packages, please run the following command:
+//   npm install typescript@latest @types/node@latest --save-dev
+//   ...
+```
+
 ### Package.json Operations
 
 #### parsePackageJson
@@ -218,6 +253,14 @@ const result3 = await parsePackageJson("./package.json", { cache: myCache }); //
 const result4 = await parsePackageJson({ name: "test" }, { cache: true }); // Always parsed fresh
 ```
 
+The module-level cache used when `cache: true` (and no custom cache is supplied) never expires on its own. Writing through `writePackageJson[Sync]` evicts the written path automatically, but if you mutate a package file out of band (e.g. in a long-running process or test), call `clearPackageJsonCache()` to drop all cached reads:
+
+```typescript
+import { clearPackageJsonCache } from "@visulima/package";
+
+clearPackageJsonCache();
+```
+
 **Example File Formats**:
 
 ```yaml
@@ -335,6 +378,101 @@ import { ensurePackages } from "@visulima/package";
 await ensurePackages(packageJson, ["typescript", "@types/node"], "devDependencies");
 ```
 
+### Lockfile Parsing
+
+A regex-based lockfile parser (no YAML dependency) covering all four mainstream JS package managers. Each entry is normalized to `{ name, version, integrity?, dependencies?, peerDependencies?, optionalDependencies? }`, so callers can build SBOMs, dedupe reports, or any other lockfile-derived artifact from a single source of truth.
+
+Integrity support:
+
+- **npm** (`package-lock.json` v2/v3): `integrity: "sha512-…"` ✅
+- **pnpm** (`pnpm-lock.yaml`): `resolution: { integrity: "sha512-…" }` ✅
+- **yarn v1** (Classic): `integrity "sha512-…"` ✅
+- **yarn v2+** (Berry): emits `checksum: 10c0/…` (XXH64), which is not a cryptographic hash and is outside the CycloneDX 1.6 `HashAlgorithm` enum. Berry entries are still parsed (name / version / dependencies), but `integrity` is `undefined`.
+- **bun** (`bun.lock`): `[versionKey, registryUrl, metadata, integrity]` tuples ✅
+
+#### parseLockFile
+
+Walks up from `cwd`, locates the nearest supported lockfile, reads it, and returns the parsed entries alongside the lockfile type and absolute path.
+
+```typescript
+import { parseLockFile, parseLockFileSync } from "@visulima/package";
+
+const result = await parseLockFile();
+// => { entries: [{ name: 'react', version: '18.2.0', integrity: { algorithm: 'sha512', hex: '…' } }, …], path: '/path/to/pnpm-lock.yaml', type: 'pnpm' }
+
+// Synchronous version
+const resultSync = parseLockFileSync("./some/dir");
+```
+
+#### Per-package-manager parsers
+
+When you already have the lockfile contents (and know the format), call a specific parser directly. Each returns a `LockFileEntry[]`.
+
+```typescript
+import { parseNpmLockFile, parsePnpmLockFile, parseYarnLockFile, parseBunLockFile } from "@visulima/package";
+import { readFileSync } from "node:fs";
+
+const entries = parsePnpmLockFile(readFileSync("./pnpm-lock.yaml", "utf8"));
+```
+
+#### decodeSriIntegrity
+
+Decodes a Subresource Integrity string (`sha512-<base64>`) into a `{ algorithm, hex }` pair. Returns `undefined` if the string is malformed, oversized, or uses an unsupported algorithm.
+
+```typescript
+import { decodeSriIntegrity } from "@visulima/package";
+
+const integrity = decodeSriIntegrity("sha512-…");
+// => { algorithm: 'sha512', hex: '…' } | undefined
+```
+
+### pnpm Catalogs & Workspaces
+
+Helpers for reading and resolving pnpm [catalog](https://pnpm.io/catalogs) references from `pnpm-workspace.yaml`.
+
+#### readPnpmCatalogs
+
+Reads the catalog definitions for the workspace that owns `packagePath`. Returns `undefined` when the package is not part of a pnpm workspace.
+
+```typescript
+import { readPnpmCatalogs, readPnpmCatalogsSync } from "@visulima/package";
+
+const catalogs = await readPnpmCatalogs("./packages/app/package.json");
+// => { default: { react: '^18.0.0' }, named: { next: { react: '^19.0.0' } } } | undefined
+```
+
+#### isPackageInWorkspace
+
+Checks whether a package path is covered by a workspace's `packages:` globs.
+
+```typescript
+import { isPackageInWorkspace } from "@visulima/package";
+
+const inWorkspace = isPackageInWorkspace("/repo", "/repo/packages/app", ["packages/*"]);
+// => true
+```
+
+> Catalog references are also resolved automatically when you pass `resolveCatalogs: true` to `parsePackageJson[Sync]` / `findPackageJson[Sync]` (see above).
+
+### Subpath Exports
+
+Every concern ships as its own entry point. Import from the narrowest one for the best tree-shaking — the root (`@visulima/package`) re-exports everything but pulls in all modules.
+
+| Subpath                             | Contents                                                                                                                                                  |
+| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `@visulima/package/monorepo`        | `findMonorepoRoot[Sync]`                                                                                                                                  |
+| `@visulima/package/package`         | `findPackageRoot[Sync]`                                                                                                                                   |
+| `@visulima/package/package-json`    | `findPackageJson[Sync]`, `parsePackageJson[Sync]`, `writePackageJson[Sync]`, `clearPackageJsonCache`, property helpers, `ensurePackages`                  |
+| `@visulima/package/package-manager` | `findPackageManager[Sync]`, `findLockFile[Sync]`, `getPackageManagerVersion`, `identifyInitiatingPackageManager`, `generateMissingPackagesInstallMessage` |
+| `@visulima/package/lockfile`        | `parseLockFile[Sync]`, `parseNpmLockFile`, `parsePnpmLockFile`, `parseYarnLockFile`, `parseBunLockFile`, `decodeSriIntegrity`                             |
+| `@visulima/package/pnpm`            | `readPnpmCatalogs[Sync]`, `resolveCatalogReference[s]`, `resolveDependenciesCatalogReferences`, `isPackageInWorkspace`                                    |
+| `@visulima/package/error`           | `PackageNotFoundError`                                                                                                                                    |
+
+```typescript
+import { parseLockFile } from "@visulima/package/lockfile";
+import { readPnpmCatalogs } from "@visulima/package/pnpm";
+```
+
 ## Supported Node.js Versions
 
 Libraries in this ecosystem make the best effort to track [Node.js’ release schedule](https://github.com/nodejs/release#release-schedule).

package/dist/error.d.ts

@@ -1 +1,15 @@
-export { default as PackageNotFoundError } from "./error/package-not-found-error.d.ts";
+/**
+* Error thrown when a package was not found.
+*/
+declare class PackageNotFoundError extends Error {
+  /**
+  * @param packageName The name of the package that was not found.
+  * @param packageManager The package manager used to install the package.
+  */
+  constructor(packageName: string[] | string, packageManager?: string);
+  get code(): string;
+  set code(_name: string);
+  override get name(): string;
+  override set name(_name: string);
+}
+export { PackageNotFoundError };

package/dist/error.js

@@ -1 +1 @@
-import{default as a}from"./packem_shared/PackageNotFoundError-BictYTIA.js";export{a as PackageNotFoundError};
+import{default as a}from"./packem_shared/PackageNotFoundError-Bi41exhP.js";export{a as PackageNotFoundError};

package/dist/index.d.ts

@@ -1,11 +1,13 @@
-export { default as PackageNotFoundError } from "./error/package-not-found-error.d.ts";
-export type { RootMonorepo, Strategy } from "./monorepo.d.ts";
-export { findMonorepoRoot, findMonorepoRootSync } from "./monorepo.d.ts";
-export { findPackageRoot, findPackageRootSync } from "./package.d.ts";
-export type { FindPackageJsonCache, NormalizedReadResult } from "./package-json.d.ts";
-export { ensurePackages, findPackageJson, findPackageJsonSync, getPackageJsonProperty, hasPackageJsonAnyDependency, hasPackageJsonProperty, parsePackageJson, parsePackageJsonSync, writePackageJson, writePackageJsonSync, } from "./package-json.d.ts";
-export type { PackageManager, PackageManagerResult } from "./package-manager.d.ts";
-export { findLockFile, findLockFileSync, findPackageManager, findPackageManagerSync, generateMissingPackagesInstallMessage, getPackageManagerVersion, identifyInitiatingPackageManager, } from "./package-manager.d.ts";
-export type { PnpmCatalog, PnpmCatalogs } from "./pnpm.d.ts";
-export { isPackageInWorkspace, readPnpmCatalogs, readPnpmCatalogsSync, resolveCatalogReference, resolveCatalogReferences, resolveDependenciesCatalogReferences, } from "./pnpm.d.ts";
-export type { EnsurePackagesOptions, NormalizedPackageJson, PackageJson } from "./types.d.ts";
+export { PackageNotFoundError } from "./error.js";
+export { type LockFileEntry, type LockFileIntegrity, type LockFileIntegrityAlgorithm, type LockFileParseResult, type LockFileType, decodeSriIntegrity, parseBunLockFile, parseLockFile, parseLockFileContent, parseLockFileSync, parseNpmLockFile, parsePnpmLockFile, parseYarnLockFile } from "./lockfile.js";
+export { type RootMonorepo, type Strategy, findMonorepoRoot, findMonorepoRootSync } from "./monorepo.js";
+export { findPackageRoot, findPackageRootSync } from "./package.js";
+export { type E as EnsurePackagesOptions, type F as FindPackageJsonCache, type N as NormalizedPackageJson, type a as NormalizedReadResult, type P as PackageJson, c as clearPackageJsonCache, e as ensurePackages, f as findPackageJson, b as findPackageJsonSync, g as getPackageJsonProperty, h as hasPackageJsonAnyDependency, d as hasPackageJsonProperty, p as parsePackageJson, i as parsePackageJsonSync, w as writePackageJson, j as writePackageJsonSync } from "./packem_shared/package-json.d-BHWsl_Em.js";
+export { type PackageManager, type PackageManagerResult, findLockFile, findLockFileSync, findPackageManager, findPackageManagerSync, generateMissingPackagesInstallMessage, getPackageManagerVersion, identifyInitiatingPackageManager } from "./package-manager.js";
+export { type PnpmCatalog, type PnpmCatalogs, isPackageInWorkspace, readPnpmCatalogs, readPnpmCatalogsSync, resolveCatalogReference, resolveCatalogReferences, resolveDependenciesCatalogReferences } from "./pnpm.js";
+import '@visulima/fs';
+import 'type-fest';
+import '@antfu/install-pkg';
+import '@inquirer/core';
+import '@inquirer/type';
+import 'normalize-package-data';

package/dist/index.js

@@ -1 +1 @@
-import{default as n}from"./packem_shared/PackageNotFoundError-BictYTIA.js";import{findMonorepoRoot as r,findMonorepoRootSync as c}from"./monorepo.js";import{findPackageRoot as s,findPackageRootSync as t}from"./package.js";import{ensurePackages as P,findPackageJson as k,findPackageJsonSync as f,getPackageJsonProperty as d,hasPackageJsonAnyDependency as p,hasPackageJsonProperty as l,parsePackageJson as y,parsePackageJsonSync as J,writePackageJson as m,writePackageJsonSync as M}from"./package-json.js";import{findLockFile as R,findLockFileSync as x,findPackageManager as C,findPackageManagerSync as u,generateMissingPackagesInstallMessage as v,getPackageManagerVersion as F,identifyInitiatingPackageManager as I}from"./package-manager.js";import{isPackageInWorkspace as w,readPnpmCatalogs as D,readPnpmCatalogsSync as L,resolveCatalogReference as A,resolveCatalogReferences as E,resolveDependenciesCatalogReferences as N}from"./pnpm.js";export{n as PackageNotFoundError,P as ensurePackages,R as findLockFile,x as findLockFileSync,r as findMonorepoRoot,c as findMonorepoRootSync,k as findPackageJson,f as findPackageJsonSync,C as findPackageManager,u as findPackageManagerSync,s as findPackageRoot,t as findPackageRootSync,v as generateMissingPackagesInstallMessage,d as getPackageJsonProperty,F as getPackageManagerVersion,p as hasPackageJsonAnyDependency,l as hasPackageJsonProperty,I as identifyInitiatingPackageManager,w as isPackageInWorkspace,y as parsePackageJson,J as parsePackageJsonSync,D as readPnpmCatalogs,L as readPnpmCatalogsSync,A as resolveCatalogReference,E as resolveCatalogReferences,N as resolveDependenciesCatalogReferences,m as writePackageJson,M as writePackageJsonSync};
+import{default as o}from"./packem_shared/PackageNotFoundError-Bi41exhP.js";import{decodeSriIntegrity as r,parseBunLockFile as c,parseLockFile as s,parseLockFileContent as g,parseLockFileSync as i,parseNpmLockFile as t,parsePnpmLockFile as k,parseYarnLockFile as p}from"./lockfile.js";import{findMonorepoRoot as f,findMonorepoRootSync as l}from"./monorepo.js";import{findPackageRoot as y,findPackageRootSync as m}from"./package.js";import{clearPackageJsonCache as J,ensurePackages as S,findPackageJson as L,findPackageJsonSync as M,getPackageJsonProperty as x,hasPackageJsonAnyDependency as C,hasPackageJsonProperty as R,parsePackageJson as u,parsePackageJsonSync as I,writePackageJson as h,writePackageJsonSync as v}from"./package-json.js";import{findLockFile as D,findLockFileSync as N,findPackageManager as A,findPackageManagerSync as B,generateMissingPackagesInstallMessage as E,getPackageManagerVersion as V,identifyInitiatingPackageManager as W}from"./package-manager.js";import{isPackageInWorkspace as b,readPnpmCatalogs as j,readPnpmCatalogsSync as q,resolveCatalogReference as z,resolveCatalogReferences as G,resolveDependenciesCatalogReferences as H}from"./pnpm.js";export{o as PackageNotFoundError,J as clearPackageJsonCache,r as decodeSriIntegrity,S as ensurePackages,D as findLockFile,N as findLockFileSync,f as findMonorepoRoot,l as findMonorepoRootSync,L as findPackageJson,M as findPackageJsonSync,A as findPackageManager,B as findPackageManagerSync,y as findPackageRoot,m as findPackageRootSync,E as generateMissingPackagesInstallMessage,x as getPackageJsonProperty,V as getPackageManagerVersion,C as hasPackageJsonAnyDependency,R as hasPackageJsonProperty,W as identifyInitiatingPackageManager,b as isPackageInWorkspace,c as parseBunLockFile,s as parseLockFile,g as parseLockFileContent,i as parseLockFileSync,t as parseNpmLockFile,u as parsePackageJson,I as parsePackageJsonSync,k as parsePnpmLockFile,p as parseYarnLockFile,j as readPnpmCatalogs,q as readPnpmCatalogsSync,z as resolveCatalogReference,G as resolveCatalogReferences,H as resolveDependenciesCatalogReferences,h as writePackageJson,v as writePackageJsonSync};