diff --git a/.changeset/prepack-dependency-gate.md b/.changeset/prepack-dependency-gate.md
new file mode 100644
index 000000000..d7566a9e8
--- /dev/null
+++ b/.changeset/prepack-dependency-gate.md
@@ -0,0 +1,6 @@
+---
+'agent-bundle': patch
+'create-agent-bundle': patch
+---
+
+Gate `agent-bundle prepack` on the installed-dependency fields of `package.json` so a published plugin installs only what its packed files need: `AB7014` reports a `dependencies`, `optionalDependencies`, or `peerDependencies` entry that no packed JavaScript imports, requires, resolves, or runs as an executable (a computed `import`/`require`, a packed file the ESM lexer rejects, or a `require` passed on as a value such as `const load = require`, withholds `AB7014` for the whole package; an installed manifest's `bin` is read as npm reads it, the last of duplicate keys winning), no packed declaration file references, and no `imports` mapping or consumer install script (including scripts it delegates to with `npm run` or `npm test`/`start`/`stop`/`restart`, `npm restart` without a `restart` script running `stop` and `start`) reaches — a warning rather than an error for a `peerDependencies` entry, which may be a deliberate host-compatibility contract — (the build inlines every dependency into `dist/bin` and the host packs, so a runtime external must be reached one of those ways; optional peers are skipped), and `AB7015` reports an entry a consumer's npm cannot resolve through a registry, judged by npm's own parser (`npm-package-arg`, now a dependency of `agent-bundle`): a git, GitHub-shorthand, remote-tarball, or path source, which npm 12 refuses to fetch by default (`allow-git`, `allow-remote`); a name or specifier npm cannot parse (`EINVALIDPACKAGENAME`, `EUNSUPPORTEDPROTOCOL` for `link:`, `portal:`, or a typo, `EINVALIDTAGNAME`, an alias of a non-registry target — reported even on an optional peer, since the manifest read itself fails); and `workspace:`/`catalog:` unless pnpm, Yarn, or Bun is running the pack and will rewrite them; a fetchable-but-unfetched `optionalDependencies` entry warns rather than fails, since npm continues without it (an unparseable one, or one a consumer install script runs, loads from an inline `node -e` program by `require`, `createRequire`, or `import()`, preloads with `node -r`/`--require`/`--import`/`--loader`, or loads from a packed file it executes — `node install.js`, `node .` through the root `main` — stays an error; each command after `&&`, `;`, or a newline counts on its own, shell quotes and backslash escapes are resolved, `node`'s options end at the program so `node install.js --require x` preloads nothing while a `NODE_OPTIONS=--require=x` assignment on the same command does, and `npm run <script>` delegates to the first positional alone — `npm run setup -- dormant` runs `setup`); an entry the tarball itself carries — a bundled dependency npm packed, or a `file:` path whose packed source is an installable package directory or tarball — is not reported — `agent-bundle prepack` prints such warnings and exits 0, and `prepack()` returns them on `PrepackResult.diagnostics`. Emitted `INSTALL.md` files now state that the bundle is self-contained, use the host's own `claude plugin` / `codex plugin` commands for uninstall, and mark every `agent-bundle install`/`uninstall`/`doctor` mention as optional automation. The `create-agent-bundle` `mcp-server` and `cli-tool` templates declare `@agent-bundle/runtime`, `react`, and `zod` under `devDependencies`. (#547)
diff --git a/docs/diagnostics.md b/docs/diagnostics.md
index e939218b2..4586b3769 100644
--- a/docs/diagnostics.md
+++ b/docs/diagnostics.md
@@ -33,7 +33,7 @@ even when no error diagnostic was reported.
 | `AB5000` | General CLI and adapter failures. |
 | `AB60xx` | Built-artifact validation, including schema documents and referenced files (`AB6011`/`AB6012`: a target's required pinned-schema document is missing or invalid; `AB6025`: a manifest-declared `logo` path is missing from the artifact or escapes the deploy tree; `AB6034`: emitted Skill Markdown has no instruction body; `AB6035`–`AB6038`: Agent Plugins portable validation, see below). |
 | `AB700x` | Host installation and uninstallation: bundle identity, host availability, scope, command failure, and collision checks (`AB7005`: version collision, pre-receipt content collision, or foreign install; `AB7006`: the host lists the installed copy with load errors; see below), plus the `uninstall` refusals `AB7007`–`AB7009` (ownership or content mismatch, unconfirmed data purge, missing receipt; see below). |
-| `AB7010`–`AB7013` | npm prepack inventory, artifact freshness, package bin targets, and release-version agreement. |
+| `AB7010`–`AB7015` | npm prepack inventory, artifact freshness, package bin targets, release-version agreement, and installed-dependency hygiene (`AB7014`: a dependency no packed file references; `AB7015`: a git, remote-tarball, path, or unrewritten workspace-protocol dependency specifier). |
 | `AB7200`–`AB7202`, `AB7210`–`AB7211` | Development rebuilds and live host surfaces: rebuild admission and phase failures, development host install sync, and the dev-epoch contract gate (see below). |
 | `AB7xxx` | Project preparation and development rebuilds. |
 | `AB7300`–`AB7331` | Read-only install Doctor: host probes, installed inventory, bundle comparison and registration proof, runtime endpoint health and identity, durable-state inventory, static bytes-at-rest validation, foreign-install detection (`AB7321`; see below), Cursor plugin hook registration / marketplace staging (`AB7322`–`AB7324`; see below), host load refusal (`AB7325`; see below), the Cursor Agent Plugins launch proof (`AB7326`; see below), a disabled Claude install (`AB7327`; see below), lifecycle receipts and activation states (`AB7328`–`AB7330`; see below), and the operator `.env` layer of an installed pack (`AB7331`; see below). `AB7311` and `AB7325` are also emitted by `build` and `validate --artifact` from the Claude load check (see "Claude Code host validation"). |
@@ -177,7 +177,7 @@ Validation happens at three moments, all fail-closed:
 | `AB6037` | error | A symlink inside the plugin resolves outside the plugin root, or cannot be resolved at all (§4.1 containment). | Replace the escaping symlink with a file or a link that resolves inside the plugin root, then rebuild. |
 | `AB6038` | info | Every portable host-validation report states that Agent Plugins publishes no reference validator and names the pinned schema provenance (specification repository commit, retrieval and re-verification dates) used for local validation. | Review the pinned Agent Plugins provenance before changing the local validator contract. |
 
-## npm prepack gate (`AB7010`–`AB7013`)
+## npm prepack gate (`AB7010`–`AB7015`)
 
 | Code | Meaning |
 | --- | --- |
@@ -185,6 +185,49 @@ Validation happens at three moments, all fail-closed:
 | `AB7011` | An on-disk artifact file no longer matches its manifest SHA-256. Rebuild and do not modify generated host packs. |
 | `AB7012` | A `package.json` bin points outside the packed `dist` output (including `src/`) or names a file npm omitted. Point it at the generated `dist/bin` file. |
 | `AB7013` | `package.json`, normalized plugin metadata, a host manifest, or artifact provenance reports a different release version. Make every release identity agree. |
+| `AB7014` | A `package.json` `dependencies`, `optionalDependencies`, or `peerDependencies` field names packages nothing in the pack uses: no packed JavaScript imports, requires, or resolves them, or runs one of their `bin` commands, no packed declaration file references them, no `#subpath` import reaches them through the manifest's `imports` map, and no consumer-side install script (or script it delegates to) runs them (one diagnostic per field; the full evidence list follows this table). Peers `peerDependenciesMeta` marks optional are never installed and are not inspected here (their specifier is still checked by `AB7015`), and a name under both `dependencies` and `optionalDependencies` is judged by its optional entry, which npm lets override. The build inlines every dependency into `dist/bin` and the host packs, so such an entry only makes every consumer's `npm install` fetch build-time packages. Move them to `devDependencies`, or import the package from a packed module if a consumer really needs it at runtime. For `peerDependencies` the diagnostic is a warning: a required peer nothing imports may be a deliberate compatibility contract with the host that loads the package, though npm 7+ still installs it for every consumer — keep it, mark it optional in `peerDependenciesMeta`, or move a build-only package to `devDependencies`. |
+| `AB7015` | A `package.json` `dependencies`, `optionalDependencies`, or `peerDependencies` entry that a consumer's npm cannot resolve through a registry. Each entry — name and specifier together, the value exactly as written (a leading space makes `" npm:bar@1"` an invalid dist-tag, not an alias) — is read with `npm-package-arg`, the parser npm, Arborist, and pacote share, so the verdict is npm's own rather than an imitation of its grammar: **registry** (a version, range, or dist-tag, or an `npm:` alias of one — the only kind a published package can rely on), **fetched** (parseable, but a `git`/`github:`/`gitlab:`/`bitbucket:`/`gist:` source or `owner/repo` shorthand, an `http(s):` tarball, or a `file:`/relative/bare path or tarball filename — npm 12 refuses git and remote fetches by default (`allow-git=none`, `allow-remote=none`) and a path never exists on the consumer's disk), or **unparseable** (npm rejects the manifest before fetching anything: `EINVALIDPACKAGENAME` for a name such as `bad name`, `.hidden`, or `node_modules`; `EUNSUPPORTEDPROTOCOL` for `link:`, `portal:`, `jsr:`, a `git+` transport npm lacks, or a typo; `EINVALIDTAGNAME` for a selector that is neither a range nor a URL-safe dist-tag, such as `"not a valid spec"`; an `npm:` alias without a name or with a non-registry target, since aliases only work for registry dependencies; or an invalid URL such as `http:%zz`). A fetched specifier is reported on installed entries only; an unparseable one is reported on every entry, even an optional peer npm would never install, because the manifest read itself fails. A peer that `dependencies` or `optionalDependencies` also names is judged by that concrete entry alone: npm resolves the concrete declaration and never reads the duplicate peer's selector. For an `optionalDependencies` entry that is fetched, the diagnostic is a warning, not an error (`agent-bundle prepack` prints it and exits 0): npm continues an install without such a dependency, but every consumer still tries and fails to fetch it. It stays an error when the entry is unparseable, or when a consumer-side install script needs the skipped package — runs one of its `bin` commands in command position (`setup-tool --init`, `npx setup-tool`, `cross-env CI=1 setup-tool`, `./node_modules/.bin/setup-tool`; a mention elsewhere, `echo setup-tool`, proves nothing), runs one of its files (`node node_modules/setup-tool/install.js`), loads it from an inline program (`node -e "require('setup-tool')"`, `node --input-type=module -e "await import('setup-tool')"`, also `-p`, `-pe`, `--eval=…`, `--print=…`; the program is read as a packed file is — `require`, `createRequire`, and `import()` — and a computed load there, or a program the lexer rejects, may need any declared package), preloads it (`node -r setup-tool/register install.js`; `-r`/`--require`, `--import`, `--loader`/`--experimental-loader`, with a space or `=` before the module — read as Node does, `node [options] script [arguments]`: options end at the first positional (the script, or an argument when `-e`/`-p` supply the program) or a `--`, valued options such as `--conditions x` or `--env-file x` taking their word with them, so `node install.js --require x` passes `--require x` to `install.js` and preloads nothing; a `NODE_OPTIONS` assignment on the same command — `NODE_OPTIONS=--require=setup-tool/register node install.js`, `cross-env NODE_OPTIONS="-r setup-tool/register" node .` — supplies options Node applies before the command line's, while one `export`ed by an earlier command is not read), or runs a packed file (`node install.cjs`, `node scripts/install` resolving `scripts/install.js`, `node "scripts/my install.cjs"`, `node install.js&&echo done`, `node .` or `node ./` running the root `main`, `node --import ./setup.mjs .` running a packed preload) that imports it — every word of the script that names a packed JavaScript file counts as run, deliberately, so that runners this gate does not model (`tsx`, `ts-node`, `zx`, `bun`, `deno run`, `npx <runner>`) still have the dependencies their file loads traced; the cost is a rare escalation for a word that names a packed file without running it (`echo install.js`), which the diagnostic makes visible by naming the file — directly, through relative imports inside the tarball (`require("./lib")` following `lib/package.json`'s `main` before `lib/index.js`, as Node does), or through the `imports` map resolved as Node does (`"#setup": "./setup.js"`; `#setup/foo` through `"#setup/*": "./scripts/*.js"`, a preloaded `#setup` included): npm continues past the failed fetch, then the script fails on the missing command or module. Each command of a script is read on its own: after a shell operator (`&&`, `;`, and the rest) or a newline — the second line of a script, and each lifecycle script after the first, starts a new command — and Node's options belong to `node` alone (`rm -r dist` preloads nothing, `npm --prefix . run setup` runs no `main`). Depend on a published registry version, or bundle the package and declare it under `devDependencies`. Entries the tarball itself carries are never reported, since a consumer does not fetch them: `bundleDependencies` (by name or `true`; never a peer, which npm cannot bundle; only when the pack inventory contains `node_modules/<name>/package.json`, since npm silently packs nothing for a bundled name absent from `node_modules`), and a `file:` or bare path inside the package (`file:vendor/foo`, `file:vendor/foo.tgz`) whose packed source npm can install from — a directory whose packed `package.json` parses to an object, or a packed tarball (gzipped or plain tar, ustar headers with valid checksums and payloads inside the archive) whose `<dir>/package.json` entry parses to an object — since npm installs it from the consumer's own copy. A path that escapes the package (`file:../sibling`), whose source is not packed, or whose packed source is not installable (a `.tgz` that is not an archive, or is malformed or truncated, fails the consumer's install with `TAR_BAD_ARCHIVE`; a manifest that does not parse, on disk or inside the archive, fails it with `EJSONPARSE`) is reported. `workspace:` and `catalog:` count as registry specifiers only when the `prepack` lifecycle runs under pnpm, Yarn, or Bun (`npm_config_user_agent`), which rewrite them in the tarball they pack; `npm publish` publishes them verbatim and consumers fail with `EUNSUPPORTEDPROTOCOL`, so under npm — or when `agent-bundle prepack` runs outside any package-manager lifecycle — they are reported. The `npm pack --dry-run` that `prepack` itself spawns is only the file inventory; the tarball consumers receive is the lifecycle's packer's, which is what the user agent identifies. |
+
+The dependency evidence is read from the packed bytes themselves: every `.js`/`.mjs`/`.cjs` file
+`npm pack --dry-run` lists is lexed for static and dynamic `import` specifiers and scanned for
+literal `require("…")` and `.resolve("…")` calls (`require.resolve`, `createRequire(…).resolve`,
+`import.meta.resolve`: a package located only to find an asset is still a runtime dependency; a
+binding such as `const load = createRequire(import.meta.url)` is a loader and `load("…")` counts like
+`require("…")`, whether the factory is imported under its own name, renamed with `as`, reached through a
+namespace import, or chained off `require("node:module")`; `createRequire(…)("…")` inline counts too, qualified the same
+ways — `Module.createRequire(…)("…")`, `require("node:module").createRequire(…)("…")` — the
+factory's argument nesting calls such as `new URL("./entry.js", import.meta.url)`; comments between a loader
+and its parentheses or around the argument, `require /* x */ ("y")`, are trivia), and
+every `.d.ts`/`.d.mts`/`.d.cts` file is scanned for `from "…"`,
+`import("…")`, `import x = require("…")`, `declare module "…"` (a module augmentation), and `/// <reference types="…" />` (a consumer needs the
+package that provides those types even without a runtime import; a type directive counts for the
+named package and its `@types/*` twin, `@types/scope__name` for a scoped name); bare specifiers are reduced to
+their package name (`@scope/name` or `name`), string escapes decoded first (`require("\x66oo")` loads `foo`),
+and Node built-ins are ignored. A dependency packed JavaScript runs rather than loads — a string literal that
+is one of the `bin` commands its manifest under `node_modules` declares, bare or followed by arguments
+(`spawnSync("tsc", ["--version"])`, `execSync("tsc --noEmit")`) — counts as used too; a dependency not installed
+at pack time has no known commands, so its bare name in a string proves nothing here. A mention inside a
+comment or string can only keep a dependency, never report one, and `devDependencies` are never
+inspected. A packed `#subpath` import counts for every package the `imports` entry Node would pick for it targets
+(the exact key, or the wildcard key with the longest matching prefix, its `*` substituted — every conditional target
+of that entry, since conditions are not settled here), and a dependency named — anywhere in the text, since a mention
+can only keep a declaration — by a consumer-side `preinstall`/`install`/`postinstall` script (not `prepare`, which npm
+runs on `pack`, local installs, and git dependencies but never for a published tarball), or by any
+script those reach through `npm run <name>` (also `pnpm`/`yarn`/`bun run` and npm's `run-script`/`rum`/`urn` aliases; the script is
+the first positional after `run`, options before or after `run` skipped with their values — `npm --prefix . run setup`,
+`npm run -w pkg setup`, `pnpm --filter pkg run setup`, `npm run -- setup` — and every later word an argument of that script,
+so `npm run setup -- dormant` and `npm run setup dormant` run `setup` alone; shell quotes and backslash escapes resolved
+(`npm run "setup"`) and `&&`/`||`/`;`/`|`/`&`/newline split off; the script is visited with its `pre<name>`/`post<name>` hooks) or through
+npm's direct script commands (`npm test`, `t`, `tst`, `start`, `stop`, `restart`, each running the script of that name with its hooks; `npm test foo` runs `test` alone; `npm restart` without a `restart` script runs `stop` then `start`, each with its hooks, inside `prerestart`/`postrestart`) — by
+package name or by one of its `bin` commands, read from `node_modules/<name>/package.json` (a string-form `bin`
+is one command named after the installed manifest's unscoped `name` — `real` for an alias `"wrapper":
+"npm:@scope/real@1"`; the manifest is read as npm reads it, so the last of duplicate keys wins), with the unscoped dependency name standing in when that manifest is unreadable or not JSON — counts as used. A computed `import(expression)` or
+`require(expression)` — also `require.resolve`, `import.meta.resolve`, a direct `createRequire(…)(…)`, or a
+`createRequire` binding — with a non-literal argument — in packed JavaScript could load any declared package, so its presence withholds
+`AB7014` entirely; the recovery text says so. So does packed source the ESM lexer rejects, whose `import()` calls it cannot report, and so does a loader passed on as a value rather than called — `const load = require`, `fn(require)`,
+`module.exports = require`, `x ? require : y` — since packages may then be loaded under a name the scan never sees (`require("x")`,
+`require.resolve("x")`, `typeof require`, and a `require` inside a string or comment are not that). Only those resolvers count, literal argument or not: `path.resolve("foo")`
+and `Promise.resolve("foo")` are not package resolution and never keep `foo`.
 
 ## Declaration generation (`AB4716`)
 
diff --git a/examples/audiobook-curator/package.json b/examples/audiobook-curator/package.json
index c2e6ad81a..6801c5138 100644
--- a/examples/audiobook-curator/package.json
+++ b/examples/audiobook-curator/package.json
@@ -30,14 +30,12 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "validate": "agent-bundle validate"
   },
-  "dependencies": {
-    "@agent-bundle/runtime": "workspace:*",
-    "react": "19.2.8",
-    "zod": "4.5.4"
-  },
   "devDependencies": {
+    "@agent-bundle/runtime": "workspace:*",
     "@rstest/core": "0.11.10",
     "@types/react": "19.2.18",
-    "agent-bundle": "workspace:*"
+    "agent-bundle": "workspace:*",
+    "react": "19.2.8",
+    "zod": "4.5.4"
   }
 }
diff --git a/examples/host-test/package.json b/examples/host-test/package.json
index 926dca108..f967c19ed 100644
--- a/examples/host-test/package.json
+++ b/examples/host-test/package.json
@@ -27,15 +27,13 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "validate": "agent-bundle validate"
   },
-  "dependencies": {
+  "devDependencies": {
     "@agent-bundle/runtime": "workspace:*",
     "@modelcontextprotocol/server": "2.0.0",
-    "react": "19.2.8",
-    "zod": "4.5.4"
-  },
-  "devDependencies": {
     "@rstest/core": "0.11.10",
     "@types/react": "19.2.18",
-    "agent-bundle": "workspace:*"
+    "agent-bundle": "workspace:*",
+    "react": "19.2.8",
+    "zod": "4.5.4"
   }
 }
diff --git a/examples/worktree-proximity/package.json b/examples/worktree-proximity/package.json
index ad8e07c63..f4272c2d8 100644
--- a/examples/worktree-proximity/package.json
+++ b/examples/worktree-proximity/package.json
@@ -21,14 +21,12 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "validate": "agent-bundle validate"
   },
-  "dependencies": {
-    "@agent-bundle/runtime": "workspace:*",
-    "react": "19.2.8",
-    "zod": "4.5.4"
-  },
   "devDependencies": {
+    "@agent-bundle/runtime": "workspace:*",
     "@rstest/core": "0.11.10",
     "@types/react": "19.2.18",
-    "agent-bundle": "workspace:*"
+    "agent-bundle": "workspace:*",
+    "react": "19.2.8",
+    "zod": "4.5.4"
   }
 }
diff --git a/packages/agent-bundle/package.json b/packages/agent-bundle/package.json
index bd521ec55..49ca5535e 100644
--- a/packages/agent-bundle/package.json
+++ b/packages/agent-bundle/package.json
@@ -94,6 +94,7 @@
     }
   },
   "dependencies": {
+    "@effect/platform-node-shared": "4.0.0-rc.112",
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/node": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
@@ -101,7 +102,6 @@
     "@rsbuild/plugin-react": "2.1.0",
     "@rslib/core": "0.23.2",
     "@rslint/core": "0.8.2",
-    "@effect/platform-node-shared": "4.0.0-rc.112",
     "@rstackjs/load-config": "0.1.2",
     "acorn": "8.18.0",
     "ajv": "8.20.0",
@@ -113,12 +113,14 @@
     "fast-glob": "3.3.3",
     "ignore": "7.0.7",
     "jiti": "2.7.0",
+    "npm-package-arg": "13.0.2",
     "open": "11.0.2",
     "ws": "8.21.3",
     "yaml": "2.9.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/server": "2.0.0",
+    "@types/npm-package-arg": "6.1.4",
     "@types/react": "19.2.18",
     "@types/ws": "8.18.1",
     "effect-rstest": "https://pkg.pr.new/ScriptedAlchemy/effect-rstest@e5f8d5f",
diff --git a/packages/agent-bundle/src/api.ts b/packages/agent-bundle/src/api.ts
index c42cc39d6..3ef332fcd 100644
--- a/packages/agent-bundle/src/api.ts
+++ b/packages/agent-bundle/src/api.ts
@@ -11,6 +11,7 @@ import type { TargetArtifactEntry, TargetHookEntry } from './adapters/types.ts';
 import { build as buildArtifact, type BuildResult } from './build/build.ts';
 import { routedCliBins, targetHostsCliBin } from './build/cli-bins.ts';
 import { buildPackageOutputs, type PackageBuildResult } from './build/package-build.ts';
+import { rewritesWorkspaceProtocols } from './build/pack-dependencies.ts';
 import {
   packInventoryDiagnostics,
   packOutputFromJson,
@@ -582,6 +583,8 @@ export interface BuildProjectResult {
 
 export interface PrepackResult {
   readonly build: BuildProjectResult;
+  /** Non-error pack-inventory diagnostics; errors throw `DiagnosticError` instead. */
+  readonly diagnostics: readonly Diagnostic[];
   readonly pack: PackOutput;
 }
 
@@ -1292,10 +1295,11 @@ export const prepack = async (options: BuildOptions): Promise<PrepackResult> =>
     model: result.model,
     packageBuild: result.packageBuild,
     packOutput: pack,
+    packerRewritesWorkspaceProtocols: rewritesWorkspaceProtocols(process.env.npm_config_user_agent),
     projectRoot: options.root,
   });
-  if (diagnostics.length > 0) throw new DiagnosticError(diagnostics);
-  return deepFreeze({ build: result, pack });
+  if (hasErrors(diagnostics)) throw new DiagnosticError(diagnostics);
+  return deepFreeze({ build: result, diagnostics, pack });
 };
 
 /** Every eval refusal reaches a caller as one actionable diagnostic, never a raw service error. */
diff --git a/packages/agent-bundle/src/build/module-imports.ts b/packages/agent-bundle/src/build/module-imports.ts
index 691fd12d2..f3af038ed 100644
--- a/packages/agent-bundle/src/build/module-imports.ts
+++ b/packages/agent-bundle/src/build/module-imports.ts
@@ -48,21 +48,21 @@ const remember = (key: string, imports: readonly ModuleImport[]): void => {
   importsByDigest.set(key, imports);
 };
 
-/** Imports previously read (this process) from bytes with this digest at this check level. */
-export const rememberedModuleImports = (
-  check: ModuleSyntaxCheck,
-  sha256: string,
-): readonly ModuleImport[] | undefined => importsByDigest.get(`${check}:${sha256}`);
-
 /**
  * Reads the imports of one ES module source, throwing on invalid syntax
  * (the lexer's or, for `parsed`, acorn's). When the source's SHA-256 is
- * known the result is remembered for the next pass over the same bytes.
+ * known, a result remembered for those bytes at this check level is
+ * returned as is, and a fresh read is remembered for the next pass over the
+ * same bytes.
  */
 export const readModuleImports = async (
   source: string,
   options: { readonly check: ModuleSyntaxCheck; readonly sha256?: string },
 ): Promise<readonly ModuleImport[]> => {
+  if (options.sha256 !== undefined) {
+    const known = importsByDigest.get(`${options.check}:${options.sha256}`);
+    if (known !== undefined) return known;
+  }
   await init;
   if (options.check === 'parsed') parseJavaScript(source, { ecmaVersion: 'latest', sourceType: 'module' });
   const [records] = parse(source);
diff --git a/packages/agent-bundle/src/build/pack-dependencies.ts b/packages/agent-bundle/src/build/pack-dependencies.ts
new file mode 100644
index 000000000..92884f5a1
--- /dev/null
+++ b/packages/agent-bundle/src/build/pack-dependencies.ts
@@ -0,0 +1,1151 @@
+import { readFile } from 'node:fs/promises';
+import { isBuiltin } from 'node:module';
+import { posix, relative, resolve } from 'node:path';
+import { gunzipSync } from 'node:zlib';
+
+import npa from 'npm-package-arg';
+
+import { sha256Hex } from '../core/digest.ts';
+import { isErrno } from '../core/errors.ts';
+import { isRecord } from '../core/strict-json.ts';
+import { readModuleImports, type ModuleImport } from './module-imports.ts';
+
+/**
+ * Evidence for the npm prepack dependency gate (`AB7014`/`AB7015`, emitted by
+ * `pack-inventory.ts`): what `package.json` asks npm to install alongside the
+ * package, and which packages the packed JavaScript and declaration files
+ * actually reference.
+ */
+
+/**
+ * The `package.json` fields npm installs alongside the published package.
+ * `peerDependencies` counts because npm 7+ installs peers automatically;
+ * `devDependencies` never reach a consumer and are not inspected.
+ */
+export const installedDependencyFields = Object.freeze([
+  'dependencies',
+  'optionalDependencies',
+  'peerDependencies',
+] as const);
+
+export type InstalledDependencyField = (typeof installedDependencyFields)[number];
+
+export interface DeclaredDependency {
+  readonly field: InstalledDependencyField;
+  readonly name: string;
+  readonly specifier: string;
+  /** Embedded in the tarball by npm (`bundleDependencies`), so a consumer never fetches its specifier. */
+  readonly bundled: boolean;
+  /**
+   * Fetched for a consumer. `false` for a peer `peerDependenciesMeta` marks
+   * optional: npm parses its specifier — an unsupported protocol still fails
+   * the install — but never installs it, so no packed file has to use it.
+   */
+  readonly installed: boolean;
+}
+
+/** Peers `peerDependenciesMeta` marks optional: npm parses but never installs them. */
+const optionalPeers = (packageDocument: Readonly<Record<string, unknown>>): ReadonlySet<string> => {
+  const meta = packageDocument.peerDependenciesMeta;
+  return new Set(isRecord(meta)
+    ? Object.entries(meta).filter(([, entry]) => isRecord(entry) && entry.optional === true).map(([name]) => name)
+    : []);
+};
+
+/**
+ * Which dependencies npm embeds under `node_modules` in the published tarball:
+ * `bundleDependencies` (or the `bundledDependencies` spelling) as a name list,
+ * or `true` for every entry of `dependencies`. Peers are never bundled, whatever
+ * the list says: npm packs no `node_modules` entry for a peer-only name, so a
+ * consumer still resolves the peer's own specifier.
+ */
+const bundledDependencies = (
+  packageDocument: Readonly<Record<string, unknown>>,
+): ((field: InstalledDependencyField, name: string) => boolean) => {
+  const value = packageDocument.bundleDependencies ?? packageDocument.bundledDependencies;
+  const names = new Set(Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : []);
+  return (field, name) => field !== 'peerDependencies' && (value === true ? field === 'dependencies' : names.has(name));
+};
+
+/**
+ * The entries a consumer's npm reads, one per name and field. A name in both
+ * `dependencies` and `optionalDependencies` is the optional entry (npm lets
+ * the optional declaration override), and a peer that `dependencies` or
+ * `optionalDependencies` also names is that concrete entry — npm resolves
+ * the concrete declaration and never reads the duplicate peer's selector; an
+ * optional peer is kept, not `installed`.
+ */
+export const declaredDependencies = (packageDocument: Readonly<Record<string, unknown>>): readonly DeclaredDependency[] => {
+  const skippedPeers = optionalPeers(packageDocument);
+  const bundled = bundledDependencies(packageDocument);
+  const entries = (field: InstalledDependencyField): readonly (readonly [string, string])[] => {
+    const value = packageDocument[field];
+    return isRecord(value) ? Object.entries(value).filter((entry): entry is [string, string] => typeof entry[1] === 'string') : [];
+  };
+  const optional = new Set(entries('optionalDependencies').map(([name]) => name));
+  const concrete = new Set([...entries('dependencies').map(([name]) => name), ...optional]);
+  const shadowed = (field: InstalledDependencyField, name: string): boolean => {
+    switch (field) {
+      case 'dependencies': return optional.has(name);
+      case 'peerDependencies': return concrete.has(name);
+      case 'optionalDependencies': return false;
+      default: {
+        const exhaustive: never = field;
+        return exhaustive;
+      }
+    }
+  };
+  return installedDependencyFields.flatMap((field) => entries(field)
+    .filter(([name]) => !shadowed(field, name))
+    .map(([name, specifier]) => ({
+      field,
+      name,
+      specifier,
+      bundled: bundled(field, name),
+      installed: !(field === 'peerDependencies' && skippedPeers.has(name)),
+    })));
+};
+
+/** Relative, package-imports (`#`), absolute, and URL-scheme specifiers (`node:`, `data:`, `file:`, `C:\`) name no package. */
+const nonPackageSpecifier = /^(?:[.#/]|[a-z][a-z0-9+.-]*:)/iu;
+/** `@scope/name` or `name`; a subpath after it is dropped. */
+const packageNamePrefix = /^(?:@[^/]+\/)?[^@/][^/]*/u;
+
+/** The package name an import specifier resolves through, or `undefined` for anything that is not a bare specifier. */
+export const packageNameOf = (specifier: string): string | undefined =>
+  nonPackageSpecifier.test(specifier) || isBuiltin(specifier) ? undefined : packageNamePrefix.exec(specifier)?.[0];
+
+/**
+ * Protocols only a workspace manager understands. pnpm, Yarn, and Bun
+ * rewrite them to registry versions while packing; npm publishes them
+ * verbatim and every consumer then fails with `EUNSUPPORTEDPROTOCOL`.
+ */
+const workspaceProtocol = /^(?:workspace|catalog):/u;
+
+/** Exact-prefix, as the packers test it: `" workspace:*"` is rewritten by none of them and published verbatim. */
+export const isWorkspaceProtocol = (specifier: string): boolean => workspaceProtocol.test(specifier);
+
+/**
+ * Whether the package manager running this pack (its `npm_config_user_agent`,
+ * e.g. `pnpm/10.0.0 npm/? node/v24.0.0 linux x64`) rewrites workspace
+ * protocols. Unknown or absent — `agent-bundle prepack` run outside any
+ * lifecycle — means no, so the gate stays strict.
+ */
+export const rewritesWorkspaceProtocols = (packerUserAgent: string | undefined): boolean =>
+  /^(?:pnpm|yarn|bun)\//u.test(packerUserAgent ?? '');
+
+/**
+ * How a consumer's npm reads one dependency entry, name and specifier
+ * together:
+ *
+ * - `registry`: a version, range, dist-tag, or `npm:` alias of one — resolved
+ *   through the registry, the only kind a published package can rely on.
+ * - `fetched`: parseable, but a git, remote-tarball, or path source. npm 12
+ *   refuses the first two by default (`allow-git=none`, `allow-remote=none`)
+ *   and a path never exists on the consumer's disk; an optional entry
+ *   survives the failed fetch, any other kind fails the install.
+ * - `unparseable`: npm rejects the manifest before fetching anything —
+ *   `EINVALIDPACKAGENAME`, `EUNSUPPORTEDPROTOCOL` (`workspace:`, `catalog:`,
+ *   `link:`, a typo), `EINVALIDTAGNAME`, an alias of a non-registry target,
+ *   or an invalid URL — whichever field declares it, even a peer it would
+ *   never install.
+ *
+ * The verdict is npm's own: `npm-package-arg` is the parser npm, Arborist,
+ * and pacote share, so the gate agrees with the consumer's install by
+ * construction rather than by imitating its grammar. Whether the packer
+ * rewrites a workspace protocol first is the caller's policy
+ * (`isWorkspaceProtocol`).
+ */
+export type DependencyKind = 'registry' | 'fetched' | 'unparseable';
+
+/**
+ * Where the package would be installed from, for path specifiers: a directory
+ * deep enough that `file:../sibling` stays distinguishable from a path inside
+ * the package. Nothing touches the disk.
+ */
+const packageAnchor = '/package/root';
+
+export const classifyDependency = (name: string, specifier: string): DependencyKind => {
+  try {
+    // The manifest value exactly as npm reads it: `" npm:bar@1"` is an invalid dist-tag, not an alias.
+    return npa.resolve(name, specifier, packageAnchor).registry === true ? 'registry' : 'fetched';
+  } catch {
+    return 'unparseable';
+  }
+};
+
+/**
+ * The tarball-relative path a `file:` or bare path specifier reads from, when
+ * it stays inside the package: `vendor/foo` for `file:vendor/foo`,
+ * `vendor/foo.tgz` for `file:vendor/foo.tgz`. npm installs such a dependency
+ * from the consumer's own `node_modules/<package>` copy, so shipping the
+ * source in the tarball makes it installable without a registry. `undefined`
+ * for anything else, including a path that escapes the package
+ * (`file:../sibling`), which no consumer has.
+ */
+export const packagedSourcePath = (name: string, specifier: string): string | undefined => {
+  try {
+    const parsed = npa.resolve(name, specifier, packageAnchor);
+    if ((parsed.type !== 'directory' && parsed.type !== 'file') || typeof parsed.fetchSpec !== 'string') return undefined;
+    const path = relative(packageAnchor, parsed.fetchSpec).split('\\').join('/');
+    return path === '' || path.startsWith('../') || path.startsWith('/') ? undefined : path;
+  } catch {
+    return undefined;
+  }
+};
+
+const nulTerminated = (bytes: Uint8Array): string => {
+  const end = bytes.indexOf(0);
+  return Buffer.from(end === -1 ? bytes : bytes.subarray(0, end)).toString('utf8');
+};
+
+const octalField = (bytes: Uint8Array): number | undefined => {
+  const text = nulTerminated(bytes).trim();
+  return /^[0-7]*$/u.test(text) ? Number.parseInt(text || '0', 8) : undefined;
+};
+
+/** Whether a 512-byte ustar header's stored checksum matches its bytes (the checksum field itself read as spaces). */
+const headerChecksumValid = (header: Buffer): boolean => {
+  const stored = octalField(header.subarray(148, 156));
+  if (stored === undefined) return false;
+  let sum = 0;
+  for (const [index, byte] of header.entries()) sum += index >= 148 && index < 156 ? 0x20 : byte;
+  return sum === stored;
+};
+
+/**
+ * Whether a tar archive holds a package npm can install: an entry
+ * `<dir>/package.json` one level down (the layout npm strips one component
+ * from on install) whose payload parses to a JSON object. Headers are the
+ * 512-byte ustar records, each with a valid checksum and a payload within the
+ * archive; an all-zero record ends the archive. A malformed or truncated
+ * archive (`TAR_BAD_ARCHIVE`) or a manifest that does not parse (`EJSONPARSE`)
+ * fails the consumer's install, so neither counts.
+ */
+const tarHoldsPackage = (archive: Buffer): boolean => {
+  for (let offset = 0; offset + 512 <= archive.length;) {
+    const header = archive.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0)) return false;
+    const size = octalField(header.subarray(124, 136));
+    if (size === undefined || !headerChecksumValid(header) || offset + 512 + size > archive.length) return false;
+    const name = nulTerminated(header.subarray(0, 100));
+    const prefix = nulTerminated(header.subarray(345, 500));
+    if (/^[^/]+\/package\.json$/u.test(prefix === '' ? name : `${prefix}/${name}`)) {
+      try {
+        const parsed: unknown = JSON.parse(archive.subarray(offset + 512, offset + 512 + size).toString('utf8'));
+        return isRecord(parsed);
+      } catch {
+        return false;
+      }
+    }
+    offset += 512 + Math.ceil(size / 512) * 512;
+  }
+  return false;
+};
+
+/**
+ * Whether the packed copy of a `file:` source is one npm can install from:
+ * a directory whose packed `package.json` parses to an object, or a packed
+ * tarball — gzipped or plain — holding a package. A path that merely exists
+ * under the right name (`foo.tgz` that is not an archive) fails the consumer's
+ * install with `TAR_BAD_ARCHIVE`, so it is not installable.
+ */
+export const packagedSourceInstallable = async (
+  projectRoot: string,
+  source: string,
+  packed: ReadonlySet<string>,
+): Promise<boolean> => {
+  if (packed.has(`${source}/package.json`)) {
+    try {
+      const parsed: unknown = JSON.parse(await readFile(resolve(projectRoot, source, 'package.json'), 'utf8'));
+      return isRecord(parsed);
+    } catch {
+      return false;
+    }
+  }
+  if (!packed.has(source)) return false;
+  let bytes: Buffer;
+  try {
+    bytes = await readFile(resolve(projectRoot, source));
+  } catch {
+    return false;
+  }
+  let archive = bytes;
+  try {
+    archive = gunzipSync(bytes);
+  } catch {
+    // Not gzipped: a plain `.tar`, or not an archive at all — the header scan decides.
+  }
+  return tarHoldsPackage(archive);
+};
+
+/** A single- or double-quoted string literal; the group after the opening quote is its body. */
+const quotedLiteral = String.raw`(["'])((?:(?!\1)[^\\\n]|\\.)+)\1`;
+
+const escapeSequence = /\\(?:x(?<hex>[0-9A-Fa-f]{2})|u\{(?<point>[0-9A-Fa-f]+)\}|u(?<unit>[0-9A-Fa-f]{4})|(?<other>.))/gsu;
+const controlEscapes: Readonly<Record<string, string>> = { 0: '\0', b: '\b', f: '\f', n: '\n', r: '\r', t: '\t', v: '\v' };
+
+/**
+ * The string a JavaScript literal's body denotes: `\x66oo` is `foo`,
+ * `foo\u002fsubpath` is `foo/subpath`, `\/` is `/`. Node resolves the value,
+ * not the source text, so a package name compared textually has to be
+ * decoded first.
+ */
+const decodeLiteral = (body: string): string => body.replace(escapeSequence, (...args) => {
+  const groups = args.at(-1) as Record<string, string | undefined>;
+  if (groups.hex !== undefined) return String.fromCharCode(Number.parseInt(groups.hex, 16));
+  if (groups.unit !== undefined) return String.fromCharCode(Number.parseInt(groups.unit, 16));
+  if (groups.point !== undefined) {
+    const point = Number.parseInt(groups.point, 16);
+    // Beyond Unicode the literal is a syntax error; the file never loads anything.
+    return point > 0x10_ff_ff ? '' : String.fromCodePoint(point);
+  }
+  const other = groups.other ?? '';
+  return controlEscapes[other] ?? other;
+});
+
+/**
+ * A `require("…")` call, or a resolution-only use — `require.resolve("…")`,
+ * `createRequire(…).resolve("…")`, `import.meta.resolve("…")` — with a
+ * literal argument. The ESM lexer reports `import` forms only; CommonJS
+ * payloads a consumer prebuilt reach the package through `require`, and a
+ * package located only to find an asset or executable is still a runtime
+ * dependency. Only these resolvers count: `path.resolve("foo")` or
+ * `Promise.resolve("foo")` never make an unused `foo` look reachable. A match
+ * inside a comment or string can only mark a dependency as imported, never as
+ * unused, so the pattern otherwise errs toward keeping a declaration.
+ */
+/**
+ * A parenthesised argument list with calls nested up to two deep —
+ * `(new URL("./entry.js", import.meta.url))`, `(join(dirname(x), "y"))` — the
+ * shapes a `createRequire` argument takes.
+ */
+const callArguments = (() => {
+  const flat = String.raw`[(][^()]*[)]`;
+  const nested = String.raw`[(](?:[^()]|${flat})*[)]`;
+  return String.raw`[(](?:[^()]|${nested})*[)]`;
+})();
+
+// Whitespace and comments, the trivia JavaScript allows around a call's parentheses: `require /* x */ ("y")`.
+const trivia = String.raw`(?:\s|/\*[\s\S]*?\*/|//[^\n]*\n)*`;
+
+/**
+ * What may qualify a factory: nothing (`createRequire(…)` after a named
+ * import), a dotted namespace (`Module.createRequire(…)` after `import * as
+ * Module from "node:module"`, `module.createRequire(…)`), or a CommonJS load
+ * (`require("node:module").createRequire(…)`, `require('module')…`; any
+ * argument, since a same-named factory from elsewhere can only keep a
+ * declaration). No capture group: the literal patterns after it count theirs
+ * by number.
+ */
+const factoryQualifier = String.raw`(?:(?:[A-Za-z_$][\w$]*\s*\.\s*)*|\brequire\s*${callArguments}\s*\.\s*)`;
+
+/** A factory call producing a loader, qualified or not: `createRequire(import.meta.url)`, `Module.createRequire(…)`, `require("node:module").createRequire(…)`. */
+const factoryCall = (factories: readonly string[]): string =>
+  String.raw`${factoryQualifier}\b(?:${factories.join('|')})${trivia}${callArguments}`;
+
+/** The resolvers a file loads packages through, each followed by its argument list. */
+const loadCall = (loaders: readonly string[], factories: readonly string[]): string =>
+  String.raw`(?:\b(?:${loaders.join('|')})(?:\.resolve)?|\bimport\.meta\.resolve|${factoryCall(factories)}(?:\.resolve)?)${trivia}[(]${trivia}`;
+
+const literalLoad = (loaders: readonly string[], factories: readonly string[]): RegExp => new RegExp(
+  String.raw`${loadCall(loaders, factories)}${quotedLiteral}${trivia}[)]`,
+  'gu',
+);
+
+/**
+ * A CommonJS load or resolution whose argument is not a string literal —
+ * `require(x)`, `require.resolve(x)`, `import.meta.resolve(x)`, or a direct
+ * `createRequire(…)(x)` — selecting a package at runtime, which no literal can
+ * prove. An argument that merely starts with a literal, `require("driver/" +
+ * variant)`, is computed too. Bundler runtimes (`__webpack_require__(…)`) have
+ * no word boundary before `require` and never match; `path.resolve(x)` and
+ * `Promise.resolve(x)` are not resolution and never match.
+ */
+const computedLoad = (loaders: readonly string[], factories: readonly string[]): RegExp => new RegExp(
+  // A comment is trivia the call prefix already consumed, not the start of a computed argument.
+  String.raw`${loadCall(loaders, factories)}(?:(?!/[*/])[^"'\s)]|"[^"\n]*"${trivia}(?!/[*/])[^)\s]|'[^'\n]*'${trivia}(?!/[*/])[^)\s])`,
+  'u',
+);
+
+const escapeIdentifier = (name: string): string => name.replace(/\$/gu, String.raw`\$`);
+
+/**
+ * `createRequire` renamed on import or destructuring: `import { createRequire
+ * as makeRequire } from "node:module"` or `const { createRequire: makeRequire }
+ * = require("node:module")`. Each alias is a factory like `createRequire` itself.
+ */
+const createRequireAlias = /\bcreateRequire\s*(?:as|:)\s*([A-Za-z_$][\w$]*)/gu;
+
+const factoryNames = (source: string): readonly string[] => [
+  'createRequire',
+  ...Array.from(source.matchAll(createRequireAlias), (match) => escapeIdentifier(match[1] ?? '')),
+];
+
+/**
+ * `const load = <factory>(…)`, the factory qualified as `factoryQualifier`
+ * allows or not: the binding is a loader, called like `require` from then on.
+ */
+const loaderBinding = (factories: readonly string[]): RegExp => new RegExp(
+  String.raw`\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*${factoryQualifier}\b(?:${factories.join('|')})\s*[(]`,
+  'gu',
+);
+
+/**
+ * The identifiers a file loads packages through: `require` itself plus every
+ * name bound to a `createRequire(…)` result — under the factory's own name or
+ * an alias — so `const load = createRequire(import.meta.url); load("driver")`
+ * counts like `require("driver")`.
+ */
+const loaderNames = (source: string): readonly string[] => [
+  'require',
+  ...Array.from(source.matchAll(loaderBinding(factoryNames(source))), (match) => escapeIdentifier(match[1] ?? '')),
+];
+
+/**
+ * JavaScript comments and string literals, each replaced by a space: the
+ * text that is not code. Bundled docblocks are prose ("may fail, require
+ * Effect services"), and a scan for a bare identifier has to skip them.
+ * Regular-expression literals are not recognised; one containing a quote
+ * can misalign the strings after it on the same line, which at worst hides
+ * or invents a bare reference there.
+ */
+const codeOnly = (source: string): string =>
+  source.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'|`(?:[^`\\]|\\[\s\S])*`/gu, ' ');
+
+/**
+ * A loader passed on as a value rather than called — `const load = require`,
+ * `fn(require)`, `[require]`, `{ require }`, `module.exports = require`,
+ * `return require`, `x ? require : y` — after which packages may be loaded
+ * under a name this scan never sees, so the file's evidence is incomplete
+ * like a computed load's. A call (`require("x")`), a property access
+ * (`require.resolve`), and `typeof require` pass nothing on and never match.
+ * Run on `codeOnly` text, so a mention in a comment or string is not one.
+ */
+const loaderReference = (loaders: readonly string[]): RegExp => new RegExp(
+  String.raw`(?:=>|\breturn|[=(,[{:?|&])\s*\b(?:${loaders.join('|')})\b\s*(?=[;,)\]}:]|$)`,
+  'mu',
+);
+
+/**
+ * Every module specifier a declaration file resolves: `from "…"`,
+ * `import("…")`, `import x = require("…")`, `declare module "…"` (an
+ * augmentation of that package's types, in an external-module declaration),
+ * and `/// <reference types="…" />`.
+ * A consumer needs the package that provides these types even though the
+ * bundled JavaScript has no runtime import. Declarations are not ES modules
+ * the lexer accepts, so this is a text scan with the same keep-only bias.
+ */
+const declarationSpecifier = new RegExp(
+  String.raw`\b(?:from|import|require|declare\s+module)\s*\(?\s*${quotedLiteral}|<reference\s+types\s*=\s*(["'])([^"'\n]+)\3`,
+  'gu',
+);
+
+/**
+ * The package a `/// <reference types="name" />` directive resolves through:
+ * `name` itself when it ships declarations, or its DefinitelyTyped package
+ * (`@types/name`; `@types/scope__name` for a scoped name). Both are reported,
+ * since the declaration cannot say which one the consumer needs.
+ */
+const typeDirectivePackages = (name: string): readonly string[] => [
+  name,
+  name.startsWith('@') ? `@types/${name.slice(1).replace('/', '__')}` : `@types/${name}`,
+];
+
+/** The literal module specifiers a declaration file resolves, in order of appearance. */
+export const declarationSpecifiers = (source: string): readonly string[] =>
+  Array.from(source.matchAll(declarationSpecifier)).flatMap((match) =>
+    (match[4] === undefined ? [decodeLiteral(match[2] ?? '')] : typeDirectivePackages(match[4])));
+
+/** The `bin` commands of each declared dependency, by package name. */
+type ExecutableCommands = ReadonlyMap<string, DependencyExecutables>;
+
+interface DependencyExecutables {
+  /** The commands the dependency's own manifest declares; empty when it declares none. */
+  readonly commands: readonly string[];
+  /**
+   * Whether `commands` was read from the manifest rather than guessed. With no
+   * manifest under `node_modules` (Plug'n'Play, a platform-specific optional
+   * dependency not installed here) the unscoped package name stands in — npm's
+   * default bin name — which is evidence enough in a shell script but too
+   * loose for JavaScript, where the bare name is also how the package is
+   * mentioned in a comment or docblock.
+   */
+  readonly known: boolean;
+}
+
+/** What one packed file proves about the packages it resolves. */
+interface FileEvidence {
+  readonly specifiers: readonly string[];
+  /** Dependencies the file runs as executables rather than loading as modules. */
+  readonly executed: readonly string[];
+  /** `false` when a computed `import(expression)` or `require(expression)`, or a `require` passed on as a value, means the file may load a package no literal names. */
+  readonly complete: boolean;
+}
+
+const escapeRegExp = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
+
+/**
+ * A string literal that is a shell command running `command`: the bare name
+ * (`spawnSync("foo", ["--version"])`) or the name followed by its arguments
+ * (`execSync("foo --version")`). A dependency a CLI package only ever shells
+ * out to is still one the consumer needs installed; the match is keep-only,
+ * so a name inside a comment or an unrelated string merely keeps a declaration.
+ */
+const commandLiteral = (command: string): RegExp =>
+  new RegExp(String.raw`(["'\x60])${escapeRegExp(command)}(?:\s[^"'\x60\n]*)?\1`, 'u');
+
+/**
+ * The module specifiers packed JavaScript resolves: the lexer's static and
+ * dynamic literal imports — never a mention inside a comment or string,
+ * which bundled library docblocks are full of — plus literal `require` calls;
+ * and the dependencies it runs by one of their `bin` commands.
+ */
+/**
+ * The module specifiers JavaScript source loads — the lexer's static and
+ * dynamic literal imports, plus literal `require`/`createRequire` calls —
+ * and whether that is all of them: a computed `import(x)` or `require(x)`,
+ * or a loader passed on as a value, means it is not — and so does source the
+ * lexer rejects, whose `import()` calls it could not report (syntax itself is
+ * another gate's concern). Packed files and inline `node -e` programs are
+ * read alike.
+ */
+const moduleLoads = async (source: string, sha256?: string): Promise<Pick<FileEvidence, 'complete' | 'specifiers'>> => {
+  let imports: readonly ModuleImport[];
+  let lexed = true;
+  try {
+    imports = await readModuleImports(source, { check: 'lexed', ...(sha256 === undefined ? {} : { sha256 }) });
+  } catch {
+    imports = [];
+    lexed = false;
+  }
+  const loaders = loaderNames(source);
+  const factories = factoryNames(source);
+  return {
+    complete: lexed
+      && imports.every((record) => record.kind !== 'dynamic' || record.specifier !== undefined)
+      && !computedLoad(loaders, factories).test(source)
+      && !loaderReference(loaders).test(codeOnly(source)),
+    specifiers: [
+      ...imports.flatMap((record) => (record.specifier === undefined ? [] : [record.specifier])),
+      ...Array.from(source.matchAll(literalLoad(loaders, factories)), (match) => decodeLiteral(match[2] ?? '')),
+    ],
+  };
+};
+
+const javaScriptEvidence = async (bytes: Buffer, executables: ExecutableCommands): Promise<FileEvidence> => {
+  const source = bytes.toString('utf8');
+  return {
+    ...await moduleLoads(source, sha256Hex(bytes)),
+    executed: [...executables]
+      .filter(([, { commands, known }]) => known && commands.some((command) => commandLiteral(command).test(source)))
+      .map(([name]) => name),
+  };
+};
+
+const javaScriptSuffix = /\.[cm]?js$/u;
+const declarationSuffix = /\.d\.[cm]?ts$/u;
+
+const fileEvidence = async (path: string, executables: ExecutableCommands): Promise<FileEvidence> => {
+  let bytes: Buffer;
+  try {
+    bytes = await readFile(path);
+  } catch (error) {
+    // npm listed the file; only its absence is a benign inconsistency.
+    if (isErrno(error, 'ENOENT')) return { complete: true, executed: [], specifiers: [] };
+    throw error;
+  }
+  return declarationSuffix.test(path)
+    ? { complete: true, executed: [], specifiers: declarationSpecifiers(bytes.toString('utf8')) }
+    : javaScriptEvidence(bytes, executables);
+};
+
+export interface ImportedPackages {
+  /** Every package name the packed files name literally, run as an executable, or need during a consumer's install. */
+  readonly names: ReadonlySet<string>;
+  /**
+   * The subset a consumer's install lifecycle needs: run as a command by a
+   * script, or loaded by a packed file the script runs. An optional dependency
+   * npm skipped after a failed fetch is then missing from `PATH` or
+   * `node_modules`, so the install fails after all.
+   */
+  readonly installScripts: ReadonlySet<string>;
+  /**
+   * Whether `names` is the whole story. A computed `import(expression)` or
+   * `require(expression)` in packed JavaScript may load any declared package,
+   * so no declaration can then be called unused.
+   */
+  readonly complete: boolean;
+}
+
+/** Every string target in a `package.json` `imports` map, through conditional and nested targets. */
+const importMapTargets = (value: unknown): readonly string[] => {
+  if (typeof value === 'string') return [value];
+  if (Array.isArray(value)) return value.flatMap(importMapTargets);
+  return isRecord(value) ? Object.values(value).flatMap(importMapTargets) : [];
+};
+
+/**
+ * The targets the manifest's `imports` map gives one `#specifier`, resolved
+ * the way Node does: the exact key, or else the pattern key `#prefix*suffix`
+ * with the longest prefix (then the longest key) the specifier matches, its
+ * `*` in every target replaced by the matched segment (`#setup/foo` through
+ * `"#setup/*": "./scripts/*.js"` is `./scripts/foo.js`). Which conditional
+ * target Node then picks depends on conditions, so every target of the
+ * matched key is a candidate; a specifier no key matches reaches nothing.
+ */
+const packageImportTargets = (packageDocument: Readonly<Record<string, unknown>>, specifier: string): readonly string[] => {
+  const imports = packageDocument.imports;
+  if (!isRecord(imports)) return [];
+  if (!specifier.includes('*') && Object.hasOwn(imports, specifier)) return importMapTargets(imports[specifier]);
+  let best: { readonly key: string; readonly prefix: string; readonly suffix: string } | undefined;
+  for (const key of Object.keys(imports)) {
+    const star = key.indexOf('*');
+    if (star === -1 || key.includes('*', star + 1)) continue;
+    const prefix = key.slice(0, star);
+    const suffix = key.slice(star + 1);
+    if (specifier.length < key.length || !specifier.startsWith(prefix) || !specifier.endsWith(suffix)) continue;
+    if (best === undefined || prefix.length > best.prefix.length || (prefix.length === best.prefix.length && key.length > best.key.length)) {
+      best = { key, prefix, suffix };
+    }
+  }
+  if (best === undefined) return [];
+  const segment = specifier.slice(best.prefix.length, specifier.length - best.suffix.length);
+  return importMapTargets(imports[best.key]).map((target) => target.replaceAll('*', segment));
+};
+
+/**
+ * The lifecycle scripts npm runs when installing a package from a registry
+ * or tarball. `prepare` is not one: npm runs it on `pack`, on local and
+ * `link:` installs, and for git dependencies — never for the published
+ * tarball — so a package it alone names is one every consumer installs for
+ * nothing.
+ */
+const installScripts = ['preinstall', 'install', 'postinstall'] as const;
+
+/**
+ * The segments of one shell word: a double-quoted one, in which a backslash
+ * escapes `"`, `\`, `$`, `` ` ``, and a newline and is literal before anything
+ * else; a single-quoted one, in which nothing escapes; and an unquoted
+ * backslash escape, `\x` being `x` and `\<newline>` a continuation. Unquoted
+ * text between them stands as written.
+ */
+const shellSegment = /"((?:[^"\\\n]|\\[\s\S])*)"|'([^'\n]*)'|\\([\s\S])/gu;
+const doubleQuotedEscape = /\\([\\"$`\n])/gu;
+
+/** The text a shell word denotes: quotes removed and escapes resolved, segment by segment. */
+const unquoteShellWord = (word: string): string => word.replace(
+  shellSegment,
+  (_segment, doubleQuoted: string | undefined, singleQuoted: string | undefined, escaped: string | undefined) => {
+    if (doubleQuoted !== undefined) return doubleQuoted.replace(doubleQuotedEscape, (_escape, char: string) => (char === '\n' ? '' : char));
+    if (singleQuoted !== undefined) return singleQuoted;
+    return escaped === '\n' ? '' : escaped ?? '';
+  },
+);
+
+/**
+ * A shell command's words: quoted arguments kept whole and unquoted (`node
+ * "scripts/my install.cjs"` is two words, `--import="./setup.mjs"` one),
+ * backslash escapes resolved (`"require(\"driver\")"` is
+ * `require("driver")`, `\"quoted\"` is `"quoted"`, `'lit\eral'` keeps its
+ * backslash), and the operators `&&`, `||`, `;`, `|`, `&` split off even
+ * without surrounding whitespace (`node install.js&&echo done` is four
+ * words). A newline is an operator too: it ends a command as `;` does, and is
+ * how `installScriptText` joins one script's body to the next.
+ */
+export const shellWords = (command: string): readonly string[] =>
+  Array.from(
+    command.matchAll(/(?:"(?:[^"\\\n]|\\[\s\S])*"|'[^'\n]*'|(?:[^\s"'&|;\\]|\\[\s\S])+)+|&&|\|\||[;|&\n]/gu),
+    (match) => unquoteShellWord(match[0]),
+  );
+
+const unscopedName = (name: string): string => name.replace(/^@[^/]+\//u, '');
+
+/**
+ * The executables a dependency puts on `PATH`, from its own manifest under
+ * `node_modules`. A string-form `bin` is one command named after the installed
+ * manifest's unscoped `name` — `real` for an alias `"wrapper":
+ * "npm:@scope/real@1"`, not `wrapper`. When the manifest is unreadable —
+ * absent, not JSON, or not an object — the dependency's unscoped name stands
+ * in, marked as a guess; a broken install never fails the gate.
+ */
+const executableCommands = async (names: readonly string[], projectRoot: string): Promise<ExecutableCommands> => {
+  const readManifest = async (name: string): Promise<Readonly<Record<string, unknown>> | undefined> => {
+    try {
+      // Plain `JSON.parse`, not `core/strict-json.ts`: this is a third party's manifest read as npm reads it, where a
+      // duplicate key's last value wins and decides the `bin` name; our own strict config rules do not apply to it.
+      const parsed: unknown = JSON.parse(await readFile(resolve(projectRoot, 'node_modules', name, 'package.json'), 'utf8'));
+      return isRecord(parsed) ? parsed : undefined;
+    } catch {
+      return undefined;
+    }
+  };
+  const binCommands = async (name: string): Promise<DependencyExecutables> => {
+    const parsed = await readManifest(name);
+    if (parsed === undefined) return { commands: [unscopedName(name)], known: false };
+    const bin = parsed.bin;
+    if (isRecord(bin)) return { commands: Object.keys(bin), known: true };
+    if (typeof bin !== 'string') return { commands: [], known: true };
+    return { commands: [unscopedName(typeof parsed.name === 'string' ? parsed.name : name)], known: true };
+  };
+  return new Map(await Promise.all(names.map(async (name) => [name, await binCommands(name)] as const)));
+};
+
+/**
+ * Dependencies a consumer's install lifecycle mentions: npm puts every
+ * dependency's executables on `PATH` for `preinstall`/`install`/`postinstall`,
+ * so a script that names a dependency, or one of its `bin` commands, anywhere
+ * may need it installed even though no packed JavaScript imports it. Keep-only
+ * evidence for `AB7014`: a mention in an argument or `echo` string cannot
+ * report a dependency, but neither does it prove the script runs it.
+ */
+const installScriptMentions = (text: string, executables: ExecutableCommands): readonly string[] => {
+  if (text === '') return [];
+  const runs = (command: string): boolean => new RegExp(String.raw`(?<![\w-])${escapeRegExp(command)}(?![\w-])`, 'u').test(text);
+  return [...executables]
+    .filter(([name, { commands }]) => text.includes(name) || commands.some(runs))
+    .map(([name]) => name);
+};
+
+const shellOperators = new Set(['&&', '||', ';', '|', '&', '\n']);
+/** An environment assignment before the command proper (`FOO=1 node x`), also the form `cross-env` and `env` take: name, then value. */
+const environmentAssignment = /^([A-Za-z_][A-Za-z0-9_]*)=([\s\S]*)$/u;
+/** Words a shell command may start with before the command proper, besides environment assignments: options, and wrappers that exec their argument. */
+const commandPrefix = /^(?:-|npx$|bunx$|cross-env$|env$|exec$|dotenv$|nice$|time$)/u;
+const packageManagers = new Set(['npm', 'pnpm', 'yarn', 'bun']);
+const execSubcommands = new Set(['exec', 'dlx', 'x']);
+/** npm's `run` and its aliases; each runs the script the first positional names. */
+const runSubcommands = new Set(['run', 'run-script', 'rum', 'urn']);
+/** npm's direct script commands, each running the script of the same name (`t` and `tst` are `test`). */
+const directScriptCommands: ReadonlyMap<string, string> = new Map([
+  ['test', 'test'],
+  ['tst', 'test'],
+  ['t', 'test'],
+  ['start', 'start'],
+  ['stop', 'stop'],
+  ['restart', 'restart'],
+]);
+/** Options npm, pnpm, Yarn, and Bun read with their value in the next word (`--prefix .`); `--option=value` takes none. */
+const valuedManagerOptions = new Set(['-w', '--workspace', '-C', '--prefix', '--filter', '--script-shell', '--loglevel', '--userconfig', '--registry']);
+
+interface ParsedOption {
+  readonly name: string;
+  readonly value: string | undefined;
+}
+
+/**
+ * A command line read as its program does, up to the first positional word:
+ * every `-x` before it is an option — one in `valued`, in space form, taking
+ * the next word as its value, `--x=v` carrying its own, any other a flag —
+ * and `--` ends the options, the word after it being positional. `-` alone
+ * is positional (stdin). Returns the options and the index of that first
+ * positional, `words.length` when there is none.
+ */
+const leadingOptions = (
+  words: readonly string[],
+  valued: ReadonlySet<string>,
+  from = 0,
+): { readonly options: readonly ParsedOption[]; readonly positional: number } => {
+  const options: ParsedOption[] = [];
+  for (let index = from; index < words.length; index += 1) {
+    const word = words[index] as string;
+    if (word === '--') return { options, positional: index + 1 };
+    if (word === '-' || !word.startsWith('-')) return { options, positional: index };
+    const assigned = /^(--[^=]+)=(.*)$/u.exec(word);
+    if (assigned !== null) {
+      options.push({ name: assigned[1] as string, value: assigned[2] });
+    } else if (valued.has(word)) {
+      options.push({ name: word, value: words[index + 1] });
+      index += 1;
+    } else {
+      options.push({ name: word, value: undefined });
+    }
+  }
+  return { options, positional: words.length };
+};
+
+/** One simple command of a shell script: what it runs, the words after it, and the environment set for it alone. */
+interface SimpleCommand {
+  /** The command proper, the directory dropped from a path (`./node_modules/.bin/tsc` is `tsc`). */
+  readonly command: string;
+  readonly operands: readonly string[];
+  /** The assignments before the command (`NODE_OPTIONS=-r x node install.js`, `cross-env CI=1 tsc`), by variable name. */
+  readonly environment: ReadonlyMap<string, string>;
+  /** The manifest script a package-manager command delegates to: `npm run setup`, `pnpm --filter pkg run setup`, `npm test`, `yarn start`. */
+  readonly script: string | undefined;
+}
+
+/**
+ * What a package-manager command runs, read as `npm [options] <subcommand>
+ * [options] <positional…>`. A `run` subcommand (`run-script`, `rum`, `urn`)
+ * runs the first positional after it as a manifest script — the rest, after
+ * a `--` or not, are that script's arguments (`npm run setup -- dormant`
+ * runs `setup` alone, as does `npm run setup dormant`) — and `test`, `start`,
+ * `stop`, `restart` (`t`, `tst`) run the script of that name, their
+ * positionals being arguments too. `exec`, `dlx`, and `x` run the first
+ * positional as a command, the rest its operands. Any other subcommand is
+ * the manager's own.
+ */
+const managerCommand = (manager: string, args: readonly string[], environment: ReadonlyMap<string, string>): SimpleCommand => {
+  const sub = leadingOptions(args, valuedManagerOptions).positional;
+  const subcommand = args[sub];
+  const next = leadingOptions(args, valuedManagerOptions, sub + 1).positional;
+  if (subcommand !== undefined && execSubcommands.has(subcommand) && next < args.length) {
+    return { command: posix.basename(args[next] as string), environment, operands: args.slice(next + 1), script: undefined };
+  }
+  const script = subcommand === undefined
+    ? undefined
+    : runSubcommands.has(subcommand) ? args[next] : directScriptCommands.get(subcommand);
+  return { command: manager, environment, operands: args.slice(sub + 1), script };
+};
+
+/**
+ * The simple commands of a shell script, one per operator-separated segment:
+ * the first word after environment assignments and exec wrappers (`FOO=1 npx
+ * tsc`, `pnpm exec -- tsc`, `cross-env CI=1 tsc`) is the command, the rest of
+ * the segment its operands, the assignments its environment; a package
+ * manager's command is read by its own grammar (`managerCommand`).
+ */
+const simpleCommands = (text: string): readonly SimpleCommand[] => {
+  const words = shellWords(text);
+  const commands: SimpleCommand[] = [];
+  let start = 0;
+  const segment = (end: number): void => {
+    const environment = new Map<string, string>();
+    let index = start;
+    for (; index < end; index += 1) {
+      const assignment = environmentAssignment.exec(words[index] as string);
+      if (assignment !== null) environment.set(assignment[1] as string, assignment[2] as string);
+      else if (!commandPrefix.test(words[index] as string)) break;
+    }
+    if (index >= end) return;
+    const word = words[index] as string;
+    const rest = words.slice(index + 1, end);
+    commands.push(packageManagers.has(word)
+      ? managerCommand(word, rest, environment)
+      : { command: posix.basename(word), environment, operands: rest, script: undefined });
+  };
+  words.forEach((word, index) => {
+    if (!shellOperators.has(word)) return;
+    segment(index);
+    start = index + 1;
+  });
+  segment(words.length);
+  return commands;
+};
+
+/**
+ * The text a consumer's install lifecycle executes: the lifecycle scripts,
+ * plus every script they reach through `npm run <name>` or a direct `npm
+ * test`/`start`/`stop`/`restart` (with its `pre<name>` and `post<name>`
+ * hooks), transitively. Dependency executables are on `PATH` for all of them.
+ */
+const installScriptText = (scripts: Readonly<Record<string, unknown>>): string => {
+  const seen = new Set<string>();
+  /**
+   * The scripts npm runs for a delegated name: the script with its hooks, or
+   * nothing when there is no such script — except `restart`, which without a
+   * `restart` script runs `stop` then `start`, each with its hooks, inside
+   * `prerestart`/`postrestart`.
+   */
+  const lifecycle = (name: string): readonly string[] => {
+    if (Object.hasOwn(scripts, name)) return [`pre${name}`, name, `post${name}`];
+    return name === 'restart' ? ['prerestart', ...lifecycle('stop'), ...lifecycle('start'), 'postrestart'] : [];
+  };
+  const visit = (name: string): void => {
+    const body = scripts[name];
+    if (seen.has(name) || typeof body !== 'string') return;
+    seen.add(name);
+    for (const { script } of simpleCommands(body)) {
+      if (script !== undefined) for (const hook of lifecycle(script)) visit(hook);
+    }
+  };
+  for (const script of installScripts) visit(script);
+  return [...seen].map((name) => scripts[name] as string).join('\n');
+};
+
+/**
+ * Node's options that take their value in the next word (`--require x`;
+ * `--require=x` carries its own). Everything else before the program is a
+ * flag, so the first word that is neither is the program.
+ */
+const valuedNodeOptions = new Set([
+  '-r', '--require', '--import', '--loader', '--experimental-loader',
+  '-e', '--eval', '-p', '--print', '-pe',
+  '--input-type', '-C', '--conditions', '--env-file', '--env-file-if-exists', '--title', '--run',
+  '--test-name-pattern', '--test-reporter', '--test-reporter-destination', '--test-shard', '--watch-path',
+  '--openssl-config', '--icu-data-dir', '--unhandled-rejections', '--dns-result-order', '--experimental-default-type',
+  '--redirect-warnings', '--report-directory', '--report-filename', '--report-signal', '--diagnostic-dir',
+  '--disable-warning', '--localstorage-file', '--cpu-prof-dir', '--cpu-prof-name', '--heap-prof-dir', '--heap-prof-name',
+  '--trace-event-categories', '--trace-event-file-pattern', '--experimental-sea-config', '--secure-heap',
+  '--stack-trace-limit', '--max-http-header-size', '--inspect-port', '--experimental-policy', '--policy-integrity',
+  '--tls-cipher-list', '--tls-keylog', '--heapsnapshot-signal', '--heapsnapshot-near-heap-limit',
+]);
+/** Node's preloads, loaded before the program: `-r`/`--require` (CommonJS), `--import`, and `--loader`/`--experimental-loader` (ES modules). */
+const preloadOptions = /^(?:-r|--require|--import|--loader|--experimental-loader)$/u;
+/** Node's inline programs: `-e`/`--eval`, `-p`/`--print`, and the one short combination Node accepts, `-pe`. */
+const inlineOptions = /^(?:-e|--eval|-p|-pe|--print)$/u;
+
+interface NodeCommand {
+  readonly options: readonly ParsedOption[];
+  /** The script Node runs, when the command names one: the first positional, unless an inline program makes it an argument. */
+  readonly program: string | undefined;
+}
+
+/**
+ * A `node` command read as Node does — `node [options] [script | -e code | -]
+ * [arguments]`: options up to the first positional or a `--`, that positional
+ * the program (an argument instead when `-e`/`-p` supply the program), and
+ * nothing after it Node's (`node install.js --require x` passes `--require
+ * x` to `install.js`). A `NODE_OPTIONS` assignment on the same command
+ * (`NODE_OPTIONS=--require=x node install.js`, `cross-env NODE_OPTIONS="-r x"
+ * node .`) supplies options Node applies before the command line's; one
+ * exported by an earlier command is not read.
+ */
+const nodeCommand = ({ environment, operands }: SimpleCommand): NodeCommand => {
+  const inherited = leadingOptions(shellWords(environment.get('NODE_OPTIONS') ?? ''), valuedNodeOptions).options;
+  const { options, positional } = leadingOptions(operands, valuedNodeOptions);
+  const inline = options.some((option) => inlineOptions.test(option.name));
+  return { options: [...inherited, ...options], program: inline ? undefined : operands[positional] };
+};
+
+/**
+ * The values a script gives one of `node`'s options, across every `node`
+ * command in command position: `-r dotenv/config` or `--require=dotenv/config`
+ * before the program, or in the command's `NODE_OPTIONS`; the same flag after
+ * the program (`node install.js -r x`) or on another command (`rm -r dist`)
+ * is never Node's.
+ */
+const nodeOptionValues = (commands: readonly SimpleCommand[], options: RegExp): readonly string[] =>
+  commands.filter(({ command }) => command === 'node').flatMap((command) => nodeCommand(command).options
+    .flatMap(({ name, value }) => (options.test(name) && value !== undefined ? [value] : [])));
+
+/**
+ * Dependencies a consumer's install lifecycle demonstrably needs: one of
+ * their `bin` commands in command position (`setup-tool --init`, `npx
+ * setup-tool`, `./node_modules/.bin/setup-tool`), a file of theirs run
+ * directly (`node node_modules/setup-tool/install.js`), or a load in an
+ * inline `node -e` program (`node -e "require('setup-tool')"`, `node
+ * --input-type=module -e "await import('setup-tool')"`, read as a packed
+ * file is; a computed load there may reach any declared package). An optional dependency npm
+ * skipped after a failed fetch then fails the script, so this is what turns
+ * a survivable `AB7015` fatal; `echo setup-tool` never does. The packages
+ * the files and preloads a `node` command runs then load are
+ * `installScriptModuleDependencies`'s.
+ */
+const installScriptCommandDependencies = async (
+  text: string,
+  commands: readonly SimpleCommand[],
+  executables: ExecutableCommands,
+  declared: readonly string[],
+): Promise<readonly string[]> => {
+  if (text === '') return [];
+  const run = new Set(commands.map(({ command }) => command));
+  const words = shellWords(text);
+  const names = new Set<string>();
+  for (const [name, { commands: bins }] of executables) {
+    if (bins.some((command) => run.has(command))) names.add(name);
+    if (words.some((word) => word.replace(/^\.\//u, '').startsWith(`node_modules/${name}/`))) names.add(name);
+  }
+  for (const program of nodeOptionValues(commands, inlineOptions)) {
+    const { complete, specifiers } = await moduleLoads(program);
+    if (!complete) for (const name of declared) names.add(name);
+    for (const specifier of specifiers) {
+      const name = packageNameOf(specifier);
+      if (name !== undefined) names.add(name);
+    }
+  }
+  return [...names];
+};
+
+/** The packed files a module resolves through: the module files, and each packed directory manifest's `main`. */
+interface PackedModules {
+  readonly files: ReadonlySet<string>;
+  /** Directory → the path its packed `package.json` `main` names, as Node reads it for `require("./dir")`. */
+  readonly mains: ReadonlyMap<string, string>;
+}
+
+/**
+ * Directory → the `main` of its packed manifest (`lib/package.json` with
+ * `"main": "setup.cjs"` → `lib` → `lib/setup.cjs`), which Node consults before
+ * the `index.js` fallback when a directory is required or run: the package's
+ * own manifest for `.` (what `node .` runs), read from the document since
+ * the inventory's `package.json` is the package itself, and every other
+ * packed manifest outside `node_modules`, whose manifests belong to bundled
+ * dependencies.
+ */
+const packedMains = async (
+  paths: readonly string[],
+  projectRoot: string,
+  packageDocument: Readonly<Record<string, unknown>>,
+): Promise<ReadonlyMap<string, string>> => {
+  const manifests = paths.filter((path) => /^(?!node_modules\/).+\/package\.json$/u.test(path));
+  const entries = await Promise.all(manifests.map(async (path): Promise<readonly [string, string] | undefined> => {
+    try {
+      const parsed: unknown = JSON.parse(await readFile(resolve(projectRoot, path), 'utf8'));
+      if (!isRecord(parsed) || typeof parsed.main !== 'string') return undefined;
+      const directory = posix.dirname(path);
+      return [directory, posix.join(directory, parsed.main)];
+    } catch {
+      return undefined;
+    }
+  }));
+  return new Map([
+    ...(typeof packageDocument.main === 'string' ? [['.', posix.join('.', packageDocument.main)] as const] : []),
+    ...entries.filter((entry): entry is readonly [string, string] => entry !== undefined),
+  ]);
+};
+
+/**
+ * The packed module a path names, in the order Node's CommonJS loader tries
+ * for `require("./lib")` or `node scripts/install`: the exact file, the `.js`
+ * extension, then the directory — its manifest's `main` as a file, with
+ * `.js`, or as a directory index, and finally `index.js`. Node never tries
+ * `.cjs` or `.mjs` there. A trailing slash names the same directory (`node
+ * scripts/`, `node ./`), and `.` is the package root.
+ */
+const packedModule = (path: string, modules: PackedModules): string | undefined => {
+  const base = posix.normalize(path).replace(/(?<=.)\/$/u, '');
+  const main = modules.mains.get(base);
+  const candidates = [
+    base,
+    `${base}.js`,
+    ...(main === undefined ? [] : [main, `${main}.js`, posix.join(main, 'index.js')]),
+    posix.join(base, 'index.js'),
+  ];
+  return candidates.find((candidate) => javaScriptSuffix.test(candidate) && modules.files.has(candidate));
+};
+
+/** `.` or `./`: the package directory, which `node .` runs through the root manifest's `main`. */
+const packageDirectory = /^\.\/*$/u;
+
+/**
+ * The packed JavaScript files an install script runs: `node install.cjs`,
+ * `node ./scripts/setup.mjs`, `node scripts/install`, `node "scripts/my
+ * install.cjs"`. Every word is tried; a word that is not a packed module is
+ * not one, and the empty word `""` names no path. The package directory
+ * itself counts only as a `node` program (`node .`, `node -r dotenv/config
+ * .`): elsewhere `.` is the working directory an option names (`npm --prefix
+ * . run setup`), not a program.
+ */
+const installScriptFiles = (text: string, commands: readonly SimpleCommand[], modules: PackedModules): readonly string[] => [
+  ...shellWords(text).filter((word) => word !== '' && !packageDirectory.test(word)),
+  ...commands.filter(({ command }) => command === 'node').flatMap((command) => {
+    const { program } = nodeCommand(command);
+    return program !== undefined && packageDirectory.test(program) ? [program] : [];
+  }),
+].flatMap((word) => {
+  const module = packedModule(word, modules);
+  return module === undefined ? [] : [module];
+});
+
+const relativeSpecifier = /^\.\.?\//u;
+
+/**
+ * The packages a consumer's install lifecycle loads through the packed
+ * JavaScript it runs — `"postinstall": "node install.cjs"` with `install.cjs`
+ * requiring a driver — and through the modules `node` preloads before the
+ * program (`node -r dotenv/config install.cjs`, `node --import ./setup.mjs
+ * .`), following relative imports and the manifest's `imports` map through
+ * the tarball. A computed load in any of those files could reach any declared
+ * package, so every declared name then counts as needed at install time.
+ */
+const installScriptModuleDependencies = (options: {
+  /** The packed files run directly. */
+  readonly roots: readonly string[];
+  /** The specifiers preloaded from the package root, where npm runs the lifecycle. */
+  readonly preloads: readonly string[];
+  readonly evidenceByPath: ReadonlyMap<string, FileEvidence>;
+  readonly modules: PackedModules;
+  readonly packageDocument: Readonly<Record<string, unknown>>;
+  readonly declared: readonly string[];
+}): readonly string[] => {
+  const { declared, evidenceByPath, modules, packageDocument } = options;
+  const names = new Set<string>();
+  const seen = new Set<string>();
+  const queue = [...options.roots];
+  // What one specifier resolved from `directory` reaches: a relative one a packed module to follow, a bare one a
+  // package, a `#` one whatever the `imports` map gives it — a package, or the package's own file
+  // (`"#setup": "./setup.js"`), relative to the package root.
+  const follow = (specifier: string, directory: string): void => {
+    if (relativeSpecifier.test(specifier)) {
+      const target = packedModule(posix.join(directory, specifier), modules);
+      if (target !== undefined) queue.push(target);
+      return;
+    }
+    for (const target of specifier.startsWith('#') ? packageImportTargets(packageDocument, specifier) : [specifier]) {
+      if (relativeSpecifier.test(target)) {
+        const module = packedModule(target, modules);
+        if (module !== undefined) queue.push(module);
+        continue;
+      }
+      const name = packageNameOf(target);
+      if (name !== undefined) names.add(name);
+    }
+  };
+  for (const specifier of options.preloads) follow(specifier, '.');
+  for (let path = queue.shift(); path !== undefined; path = queue.shift()) {
+    const evidence = evidenceByPath.get(path);
+    if (seen.has(path) || evidence === undefined) continue;
+    seen.add(path);
+    if (!evidence.complete) for (const name of declared) names.add(name);
+    for (const name of evidence.executed) names.add(name);
+    for (const specifier of evidence.specifiers) follow(specifier, posix.dirname(path));
+  }
+  return [...names];
+};
+
+/**
+ * Every package name the packed JavaScript imports, requires, resolves, or
+ * runs as an executable, the packed declarations reference, a packed `#`
+ * import may reach through the manifest's `imports` map, or a consumer's
+ * install script runs or loads — read from the bytes npm would publish.
+ */
+export const importedPackageNames = async (options: {
+  /** Names to test for executable and install-script use; every other source is scanned whole. */
+  readonly declared: readonly string[];
+  readonly packageDocument: Readonly<Record<string, unknown>>;
+  readonly paths: readonly string[];
+  readonly projectRoot: string;
+}): Promise<ImportedPackages> => {
+  const projectRoot = resolve(options.projectRoot);
+  const executables = await executableCommands(options.declared, projectRoot);
+  const evidenceByPath = new Map(await Promise.all(options.paths
+    .filter((path) => javaScriptSuffix.test(path) || declarationSuffix.test(path))
+    .map(async (path) => [path, await fileEvidence(resolve(projectRoot, path), executables)] as const)));
+  const modules: PackedModules = {
+    files: new Set(evidenceByPath.keys()),
+    mains: await packedMains(options.paths, projectRoot, options.packageDocument),
+  };
+  const evidence = [...evidenceByPath.values()];
+  const scriptText = installScriptText(isRecord(options.packageDocument.scripts) ? options.packageDocument.scripts : {});
+  const commands = simpleCommands(scriptText);
+  const neededByScripts = [
+    ...await installScriptCommandDependencies(scriptText, commands, executables, options.declared),
+    ...installScriptModuleDependencies({
+      declared: options.declared,
+      evidenceByPath,
+      modules,
+      packageDocument: options.packageDocument,
+      preloads: nodeOptionValues(commands, preloadOptions),
+      roots: installScriptFiles(scriptText, commands, modules),
+    }),
+  ];
+  const specifiers = evidence.flatMap((file) => file.specifiers);
+  const reachable = specifiers
+    .filter((specifier) => specifier.startsWith('#'))
+    .flatMap((specifier) => packageImportTargets(options.packageDocument, specifier));
+  return {
+    complete: evidence.every((file) => file.complete),
+    installScripts: new Set(neededByScripts),
+    names: new Set([
+      ...[...specifiers, ...reachable].flatMap((specifier) => {
+        const name = packageNameOf(specifier);
+        return name === undefined ? [] : [name];
+      }),
+      ...evidence.flatMap((file) => file.executed),
+      ...installScriptMentions(scriptText, executables),
+      ...neededByScripts,
+    ]),
+  };
+};
diff --git a/packages/agent-bundle/src/build/pack-inventory.ts b/packages/agent-bundle/src/build/pack-inventory.ts
index fba4b35ea..f5cb4bd9e 100644
--- a/packages/agent-bundle/src/build/pack-inventory.ts
+++ b/packages/agent-bundle/src/build/pack-inventory.ts
@@ -1,14 +1,27 @@
-import { createHash } from 'node:crypto';
 import { lstat } from 'node:fs/promises';
 import { join, relative, resolve } from 'node:path';
 
 import type { NormalizedPlugin } from '../core/types.ts';
-import type { Diagnostic } from '../core/diagnostics.ts';
+import type { Diagnostic, DiagnosticSeverity } from '../core/diagnostics.ts';
+import { sha256Hex } from '../core/digest.ts';
+import { isErrno } from '../core/errors.ts';
 import { deepFreeze } from '../core/freeze.ts';
+import { isRecord } from '../core/strict-json.ts';
 import { readFileBytes, readFileString, runWithPlatform } from '../effect/platform.ts';
 import { installSurfaceRequirements } from '../install/surface.ts';
 import { artifactManifestName } from './emit.ts';
 import { parseArtifactManifest } from './manifest.ts';
+import {
+  classifyDependency,
+  declaredDependencies,
+  importedPackageNames,
+  isWorkspaceProtocol,
+  packagedSourceInstallable,
+  packagedSourcePath,
+  type DeclaredDependency,
+  type DependencyKind,
+  type InstalledDependencyField,
+} from './pack-dependencies.ts';
 import type { PackageBuildResult } from './package-build.ts';
 
 export interface PackOutputFile {
@@ -20,9 +33,6 @@ export interface PackOutput {
   readonly files: readonly PackOutputFile[];
 }
 
-const isRecord = (value: unknown): value is Record<string, unknown> =>
-  typeof value === 'object' && value !== null && !Array.isArray(value);
-
 const packEntryName = (entry: unknown, key: string | undefined): string | undefined =>
   isRecord(entry) && typeof entry.name === 'string' ? entry.name : key;
 
@@ -83,7 +93,7 @@ const exists = async (path: string): Promise<boolean> => {
     await lstat(path);
     return true;
   } catch (error) {
-    if (error instanceof Error && (error as NodeJS.ErrnoException).code === 'ENOENT') return false;
+    if (isErrno(error, 'ENOENT')) return false;
     throw error;
   }
 };
@@ -123,18 +133,120 @@ const binEntries = (value: unknown): readonly [string, string][] => {
     .sort(([left], [right]) => left.localeCompare(right)));
 };
 
-const diagnostic = (code: string, message: string, recovery: string): Diagnostic => Object.freeze({
-  code,
-  message,
-  recovery,
-  severity: 'error',
-});
+const diagnostic = (code: string, message: string, recovery: string, severity: DiagnosticSeverity = 'error'): Diagnostic =>
+  Object.freeze({ code, message, recovery, severity });
+
+const quoteAll = (values: readonly string[]): string => values.map((value) => JSON.stringify(value)).join(', ');
+
+/** One diagnostic per installed-dependency field that has offending entries, entries sorted by name. */
+const perField = (
+  entries: readonly DeclaredDependency[],
+  emit: (field: InstalledDependencyField, entries: readonly DeclaredDependency[]) => Diagnostic,
+): readonly Diagnostic[] => [...Map.groupBy(entries, (entry) => entry.field)]
+  .map(([field, own]) => emit(field, own.toSorted((left, right) => left.name.localeCompare(right.name))));
+
+/**
+ * `AB7014`/`AB7015`: the build inlines every dependency into `dist/bin` and
+ * the host packs, so an installed-dependency entry no packed file references
+ * only makes every consumer's `npm install` fetch a build-time package — and
+ * fail outright when the specifier is one a consumer's npm cannot resolve
+ * (git, remote tarball, path, or an unrewritten workspace protocol).
+ */
+const unresolvableMessage = (field: InstalledDependencyField, own: readonly DeclaredDependency[]): string =>
+  `package.json ${field} names packages a consumer's npm cannot resolve through a registry (an invalid name or a non-registry specifier): ${own.map((dependency) =>
+    `${JSON.stringify(dependency.name)} -> ${JSON.stringify(dependency.specifier)}`).join(', ')}; `;
+
+const unresolvableRecovery = 'Depend on a published registry version, or bundle the package and declare it under devDependencies. '
+  + 'npm 12 refuses git and remote fetches by default (allow-git, allow-remote) and never accepts workspace: or catalog:, '
+  + 'which only pnpm, Yarn, or Bun rewrite while packing.';
+
+const dependencyDiagnostics = async (options: {
+  readonly packageDocument: Readonly<Record<string, unknown>>;
+  readonly packedPaths: readonly string[];
+  readonly packerRewritesWorkspaceProtocols: boolean;
+  readonly projectRoot: string;
+}): Promise<readonly Diagnostic[]> => {
+  const declared = declaredDependencies(options.packageDocument);
+  if (declared.length === 0) return [];
+  const imported = await importedPackageNames({
+    declared: declared.filter((dependency) => dependency.installed).map((dependency) => dependency.name),
+    packageDocument: options.packageDocument,
+    paths: options.packedPaths,
+    projectRoot: options.projectRoot,
+  });
+  // The tarball itself may carry the dependency: `bundleDependencies` exempts an entry only when npm actually
+  // packed it (a name absent from node_modules at pack time is silently dropped, and the consumer neither
+  // fetches nor finds it), and a `file:` path inside the package is installed from the consumer's own copy
+  // when the packed source is installable: a directory with a parseable manifest, or a tarball holding a package.
+  const packed = new Set(options.packedPaths);
+  const embeddedSources = new Set<DeclaredDependency>();
+  for (const dependency of declared) {
+    const source = packagedSourcePath(dependency.name, dependency.specifier);
+    if (source !== undefined && await packagedSourceInstallable(options.projectRoot, source, packed)) {
+      embeddedSources.add(dependency);
+    }
+  }
+  const embedded = (dependency: DeclaredDependency): boolean =>
+    (dependency.bundled && packed.has(`node_modules/${dependency.name}/package.json`)) || embeddedSources.has(dependency);
+  // A workspace protocol the packer rewrites reaches the consumer as a registry version; every other entry
+  // is read as npm itself reads it.
+  const kindOf = (dependency: DeclaredDependency): DependencyKind =>
+    isWorkspaceProtocol(dependency.specifier) && options.packerRewritesWorkspaceProtocols
+      ? 'registry'
+      : classifyDependency(dependency.name, dependency.specifier);
+  const kinds = new Map(declared.map((dependency) => [dependency, kindOf(dependency)]));
+  // A consumer's install fails on a fetch npm refuses (installed entries only), or on a name or specifier npm
+  // cannot parse — which it reads even for a peer it never installs.
+  const unresolvable = declared.filter((dependency) => !embedded(dependency)
+    && (dependency.installed ? kinds.get(dependency) !== 'registry' : kinds.get(dependency) === 'unparseable'));
+  // An optional dependency npm parses but cannot fetch: the install continues without it — unless a consumer
+  // install script then runs it, or loads it from a packed file it runs, and fails on the missing package.
+  const survivable = (dependency: DeclaredDependency): boolean =>
+    dependency.field === 'optionalDependencies'
+    && kinds.get(dependency) === 'fetched'
+    && !imported.installScripts.has(dependency.name);
+  // A computed import() may load any declared package; nothing can then be called unused.
+  const unused = imported.complete
+    ? declared.filter((dependency) => dependency.installed && !imported.names.has(dependency.name))
+    : [];
+  return [
+    // A peer nothing imports may be a deliberate compatibility contract with the host that loads the package;
+    // npm 7+ still installs it for every consumer, so it is worth a look, not a refusal.
+    ...perField(unused, (field, own) => diagnostic(
+      'AB7014',
+      `package.json ${field} names packages no packed JavaScript or declaration file references, runs, or install script needs: ${quoteAll(own.map((dependency) => dependency.name))}. `
+        + (field === 'peerDependencies'
+          ? 'If they only constrain the host version, that is a compatibility contract; npm 7+ still installs them for every consumer.'
+          : 'Every consumer installs them for nothing; the emitted outputs already inline what they use.'),
+      field === 'peerDependencies'
+        ? 'Keep a deliberate compatibility peer, mark it optional in peerDependenciesMeta so npm stops installing it, or move a build-only package to devDependencies.'
+        : 'Move build-only packages to devDependencies, or import the package from a packed module if a consumer needs it at runtime; a computed import() or require() in packed code withholds this check.',
+      field === 'peerDependencies' ? 'warning' : 'error',
+    )),
+    // npm skips an optional dependency it cannot fetch, so the install survives — but only once the specifier parsed
+    // (an unsupported protocol or invalid selector fails the manifest read itself, whichever field declares it) and
+    // only when no install script then runs the skipped package's command.
+    ...perField(unresolvable.filter((dependency) => !survivable(dependency)), (field, own) => diagnostic(
+      'AB7015',
+      `${unresolvableMessage(field, own)}consumers cannot install the package.`,
+      unresolvableRecovery,
+    )),
+    ...perField(unresolvable.filter(survivable), (field, own) => diagnostic(
+      'AB7015',
+      `${unresolvableMessage(field, own)}every consumer install tries and fails to fetch them, then continues without them.`,
+      unresolvableRecovery,
+      'warning',
+    )),
+  ];
+};
 
 export const packInventoryDiagnostics = async (options: {
   readonly artifactRoot: string;
   readonly model: NormalizedPlugin;
   readonly packageBuild: PackageBuildResult;
   readonly packOutput: PackOutput;
+  /** Whether the package manager packing the tarball rewrites `workspace:`/`catalog:` to registry versions. */
+  readonly packerRewritesWorkspaceProtocols: boolean;
   readonly projectRoot: string;
 }): Promise<readonly Diagnostic[]> => {
   const projectRoot = resolve(options.projectRoot);
@@ -159,7 +271,7 @@ export const packInventoryDiagnostics = async (options: {
   if (missing.length > 0) {
     diagnostics.push(diagnostic(
       'AB7010',
-      `npm pack omits expected files: ${missing.map((path) => JSON.stringify(path)).join(', ')}.`,
+      `npm pack omits expected files: ${quoteAll(missing)}.`,
       'Add the exact paths (including dist and the artifact directory) to the package.json "files" allowlist.',
     ));
   }
@@ -167,12 +279,12 @@ export const packInventoryDiagnostics = async (options: {
   const stale: string[] = [];
   for (const file of manifest.files) {
     const bytes = await runWithPlatform(readFileBytes(join(artifactRoot, file.path)));
-    if (createHash('sha256').update(bytes).digest('hex') !== file.sha256) stale.push(`${artifactPrefix}/${file.path}`);
+    if (sha256Hex(bytes) !== file.sha256) stale.push(`${artifactPrefix}/${file.path}`);
   }
   if (stale.length > 0) {
     diagnostics.push(diagnostic(
       'AB7011',
-      `Artifact files no longer match their manifest hashes: ${stale.sort().map((path) => JSON.stringify(path)).join(', ')}.`,
+      `Artifact files no longer match their manifest hashes: ${quoteAll(stale.sort())}.`,
       'Run agent-bundle prepack again without modifying generated artifacts.',
     ));
   }
@@ -217,5 +329,12 @@ export const packInventoryDiagnostics = async (options: {
     ));
   }
 
+  diagnostics.push(...await dependencyDiagnostics({
+    packageDocument,
+    packedPaths: [...packed],
+    packerRewritesWorkspaceProtocols: options.packerRewritesWorkspaceProtocols,
+    projectRoot,
+  }));
+
   return deepFreeze(diagnostics.sort((left, right) => left.code.localeCompare(right.code)));
 };
diff --git a/packages/agent-bundle/src/build/validate-artifact-modules.ts b/packages/agent-bundle/src/build/validate-artifact-modules.ts
index b114bbd11..a96d5ca9d 100644
--- a/packages/agent-bundle/src/build/validate-artifact-modules.ts
+++ b/packages/agent-bundle/src/build/validate-artifact-modules.ts
@@ -8,7 +8,7 @@ import type { Diagnostic } from '../core/diagnostics.ts';
 import { readFileBytes, runWithPlatform } from '../effect/platform.ts';
 import { artifactDiagnostic as diagnostic, artifactDiagnosticRecoveries } from './artifact-diagnostics.ts';
 import type { ArtifactFile } from './emit.ts';
-import { readModuleImports, rememberedModuleImports, type ModuleSyntaxCheck } from './module-imports.ts';
+import { readModuleImports, type ModuleImport, type ModuleSyntaxCheck } from './module-imports.ts';
 
 const javaScriptModuleSuffix = /\.(?:m?js)$/u;
 const generatedJavaScriptRecovery = artifactDiagnosticRecoveries.AB6005;
@@ -139,17 +139,14 @@ export const validateJavaScriptModules = async (options: {
     // Keyed by the digest of the bytes just read — not the inspection's — so
     // a module rewritten between the two is never answered from the cache,
     // while the same bytes scanned earlier in this process are not lexed twice.
-    const sha256 = sha256Hex(bytes);
-    let imports = rememberedModuleImports(check, sha256);
-    if (imports === undefined) {
-      try {
-        imports = await readModuleImports(bytes.toString('utf8'), { check, sha256 });
-      } catch {
-        diagnostics.push(graphDiagnostic(path, 'has invalid syntax.'));
-        visiting.delete(path);
-        visited.add(path);
-        return;
-      }
+    let imports: readonly ModuleImport[];
+    try {
+      imports = await readModuleImports(bytes.toString('utf8'), { check, sha256: sha256Hex(bytes) });
+    } catch {
+      diagnostics.push(graphDiagnostic(path, 'has invalid syntax.'));
+      visiting.delete(path);
+      visited.add(path);
+      return;
     }
     for (const imported of imports) {
       if (imported.kind === 'meta') continue;
diff --git a/packages/agent-bundle/src/cli.ts b/packages/agent-bundle/src/cli.ts
index a561d3226..4472da8f2 100644
--- a/packages/agent-bundle/src/cli.ts
+++ b/packages/agent-bundle/src/cli.ts
@@ -373,8 +373,11 @@ const humanBuild = (result: Awaited<ReturnType<typeof build>>): string => {
   return out.join('');
 };
 
-const humanPrepack = (result: Awaited<ReturnType<typeof prepack>>): string =>
-  `Prepack validated ${result.pack.files.length} file(s) for ${result.build.model.metadata.name}\n`;
+const humanPrepack = (result: Awaited<ReturnType<typeof prepack>>): string => [
+  // Errors abort the command before this formatter runs; what reaches it are warnings the pack survives.
+  ...result.diagnostics.map((diagnostic) => `${diagnostic.code} (${diagnostic.severity}): ${diagnostic.message}\n`),
+  `Prepack validated ${result.pack.files.length} file(s) for ${result.build.model.metadata.name}\n`,
+].join('');
 
 const shortContentHash = (hash: string): string => hash.slice(0, 12);
 
diff --git a/packages/agent-bundle/src/install/surface.ts b/packages/agent-bundle/src/install/surface.ts
index 115819b50..2f2ada271 100644
--- a/packages/agent-bundle/src/install/surface.ts
+++ b/packages/agent-bundle/src/install/surface.ts
@@ -27,10 +27,48 @@ const header = (model: NormalizedPlugin): string[] => [
   '',
   `Version: \`${model.metadata.version}\``,
   '',
-  'Run these commands from this bundle directory.',
+  'Run these commands from this bundle directory. The bundle is self-contained: every command below is',
+  'a host command or the bundled installer, and nothing requires the `agent-bundle` CLI. Where that CLI is',
+  'mentioned it is optional and automates the same steps.',
   '',
 ];
 
+/** The paragraph both marketplace hosts share: the framework CLI automates the host-native reinstall sequence. */
+const optionalCliReinstall = (host: 'claude' | 'codex'): string[] => [
+  `With the optional \`agent-bundle\` CLI, \`agent-bundle install ${host} --from ./\` runs this sequence`,
+  'automatically when the installed copy has the same version but a different content hash; `--replace`',
+  '(alias `--force`) forces it.',
+];
+
+/**
+ * `plugin marketplace remove` applies to every scope and every project at
+ * once, so it is never part of the executable uninstall block: the reader
+ * must first prove nothing else still installs from the marketplace, which is
+ * the inventory the framework's own uninstaller performs before it removes one.
+ */
+const marketplaceRemoval = (host: 'claude' | 'codex', model: NormalizedPlugin): string[] => [
+  `The marketplace \`${marketplaceName(model)}\` stays registered. Remove it only when nothing else installs from it:`,
+  ...(host === 'claude'
+    ? [
+      '`plugin marketplace remove` applies to every scope and every project, and `claude plugin list` shows only',
+      'the current project, so also check `~/.claude/plugins/installed_plugins.json` (under `$CLAUDE_CONFIG_DIR`',
+      'when set), where Claude records every scope of every install. The optional `agent-bundle uninstall claude`',
+      'below performs that inventory before it removes anything.',
+    ]
+    : ['`codex plugin list` shows every other plugin from it.']),
+  '',
+  '```sh',
+  `${host} plugin marketplace remove ${marketplaceName(model)}`,
+  '```',
+  '',
+];
+
+/** Its uninstall twin: the CLI replays the recorded host-native removal. */
+const optionalCliUninstall = (host: 'claude' | 'codex'): string[] => [
+  `With the optional \`agent-bundle\` CLI, \`agent-bundle uninstall ${host} --from ./ --plan\` prints exactly what`,
+  `would be removed and \`agent-bundle uninstall ${host} --from ./\` reverses the recorded registrations.`,
+];
+
 const claudeInstructions = (model: NormalizedPlugin): string[] => [
   '## Claude Code',
   '',
@@ -55,24 +93,27 @@ const claudeInstructions = (model: NormalizedPlugin): string[] => [
   `claude plugin install ${pluginId(model)} --scope user`,
   '```',
   '',
-  '`agent-bundle install claude --from ./` runs this sequence automatically when the installed',
-  'copy has the same version but a different content hash; `--replace` (alias `--force`) forces it.',
+  ...optionalCliReinstall('claude'),
   '',
   '### Uninstall',
   '',
   '```sh',
-  'agent-bundle uninstall claude --from ./ --plan   # print exactly what would be removed',
-  'agent-bundle uninstall claude --from ./          # reverse the recorded registrations',
+  `claude plugin uninstall ${pluginId(model)} --scope user --keep-data`,
   '```',
   '',
+  'Match the scope the plugin was installed with (`user`, `project`, or `local`). `--keep-data` keeps durable',
+  'runtime state (Claude orphans the cached copy, `state/` included, for its ~14-day grace period); omit it to',
+  'remove `~/.claude/plugins/data/<id>/` immediately.',
+  '',
+  ...marketplaceRemoval('claude', model),
+  ...optionalCliUninstall('claude'),
   `\`agent-bundle install claude\` records a receipt at \`~/.claude/agent-bundle/receipts/${model.metadata.name}.${marketplaceName(model)}.user.json\``,
   '(or under `$CLAUDE_CONFIG_DIR`; `user` is the install scope, pass `--scope project` or `--scope local` to match',
-  'a scoped install). `uninstall` consumes it: `claude plugin uninstall ' +
-    `${pluginId(model)} --scope user --keep-data\` first, then \`claude plugin marketplace remove ${marketplaceName(model)}\``,
-  'unless another installed plugin still uses that marketplace. Durable runtime state is kept by default (Claude',
-  'orphans the cached copy, `state/` included, for its ~14-day grace period); `--purge-data --confirm-purge`',
-  'removes `state/` and `~/.claude/plugins/data/<id>/` immediately. A missing receipt or a cached copy that no',
-  'longer matches it is refused unless `--force`; a second run is a `not-installed` no-op.',
+  'a scoped install), and `uninstall` consumes it, running the two commands above in order and retaining the',
+  'marketplace while any other plugin, scope, or project still installs from it. Durable runtime state',
+  'is kept by default; `--purge-data --confirm-purge` removes `state/` and `~/.claude/plugins/data/<id>/`',
+  'immediately. A missing receipt or a cached copy that no longer matches it is refused unless `--force`; a',
+  'second run is a `not-installed` no-op.',
   '',
 ];
 
@@ -97,23 +138,23 @@ const codexInstructions = (model: NormalizedPlugin): string[] => [
   `codex plugin add ${pluginId(model)}`,
   '```',
   '',
-  '`agent-bundle install codex --from ./` runs this sequence automatically when the installed',
-  'copy has the same version but a different content hash; `--replace` (alias `--force`) forces it.',
+  ...optionalCliReinstall('codex'),
   '',
   '### Uninstall',
   '',
   '```sh',
-  'agent-bundle uninstall codex --from ./ --plan   # print exactly what would be removed',
-  'agent-bundle uninstall codex --from ./          # reverse the recorded registrations',
+  `codex plugin remove ${pluginId(model)}`,
   '```',
   '',
+  'Codex 0.147.0 deletes the cached plugin tree, `state/` included, on `plugin remove` and has no keep-data',
+  'option.',
+  '',
+  ...marketplaceRemoval('codex', model),
+  ...optionalCliUninstall('codex'),
   `\`agent-bundle install codex\` records a receipt at \`~/.codex/agent-bundle/receipts/${model.metadata.name}.${marketplaceName(model)}.user.json\` (or`,
-  `under \`$CODEX_HOME\`). \`uninstall\` consumes it: \`codex plugin remove ${pluginId(model)}\` first, then`,
-  `\`codex plugin marketplace remove ${marketplaceName(model)}\` unless another installed plugin still uses that`,
-  'marketplace. Codex 0.147.0 deletes the cached plugin tree, `state/` included, on `plugin remove` and has no',
-  'keep-data option, so `--keep-data` cannot preserve durable state on Codex; the result says so (`unavailable`).',
-  'A missing receipt or a cached copy that no longer matches it is refused unless `--force`; a second run is a',
-  '`not-installed` no-op.',
+  'under `$CODEX_HOME`), and `uninstall` consumes it, running the two commands above in order. `--keep-data`',
+  'cannot preserve durable state on Codex; the result says so (`unavailable`). A missing receipt or a cached',
+  'copy that no longer matches it is refused unless `--force`; a second run is a `not-installed` no-op.',
   '',
 ];
 
@@ -147,7 +188,8 @@ const cursorInstructions = (model: NormalizedPlugin): string[] => [
   '',
   '`--force` is an alias for `--replace`. A directory that is not an agent-bundle install of this',
   'plugin is always refused with an installed-versus-artifact content-hash comparison; remove it',
-  'manually. `agent-bundle install cursor --from ./ [--replace]` applies the same policy.',
+  'manually. The optional `agent-bundle` CLI applies the same policy through',
+  '`agent-bundle install cursor --from ./ [--replace]`.',
   '',
   '### Uninstall',
   '',
@@ -167,9 +209,10 @@ const cursorInstructions = (model: NormalizedPlugin): string[] => [
   'receipt is refused unless',
   '`--force` (which removes a pre-receipt legacy copy by its inventory); owned content that no longer matches',
   'the receipt is refused unless `--force`; a directory that is not this plugin\'s install is always refused.',
-  'A second run is a `Not installed` no-op. `agent-bundle uninstall cursor --from ./ [--mode marketplace]`',
-  'applies the same policy, and `agent-bundle doctor --from ./` shows the lifecycle stage',
-  '(placed, registered, enabled, active) with unobservable stages typed `unavailable`.',
+  'A second run is a `Not installed` no-op. With the optional `agent-bundle` CLI,',
+  '`agent-bundle uninstall cursor --from ./ [--mode marketplace]` applies the same policy, and',
+  '`agent-bundle doctor --from ./` shows the lifecycle stage (placed, registered, enabled, active) with',
+  'unobservable stages typed `unavailable`.',
   '',
   '### Marketplace plugin',
   '',
@@ -180,8 +223,9 @@ const cursorInstructions = (model: NormalizedPlugin): string[] => [
   `It stages a committed Git repository at \`~/.cursor/agent-bundle/marketplaces/${model.metadata.name}\` whose`,
   `\`.cursor-plugin/marketplace.json\` lists this plugin, then prints the exact Cursor step: Customize -> Plugins ->`,
   '"Add Plugins from Local Repository" -> select that directory -> Install. Cursor then shows the plugin as a',
-  'marketplace install (not "local") and manages it from Customize. `git` must be on PATH. Verify with',
-  '`agent-bundle doctor --host cursor`.',
+  'marketplace install (not "local") and manages it from Customize. `git` must be on PATH. Verify in Cursor:',
+  'Customize -> Plugins lists the plugin, and its files appear under `~/.cursor/plugins/cache`. The optional',
+  '`agent-bundle` CLI performs the same check with `agent-bundle doctor --host cursor`.',
   '',
 ];
 
@@ -209,7 +253,7 @@ const portableInstructions = (): string[] => [
   '(created by the installer), an omitted `cwd` becomes the plugin root, `./` commands resolve against',
   'it, and every stdio server gains `PLUGIN_ROOT` / `PLUGIN_DATA` in its environment. The bundle itself',
   `stays spec-conformant; the pre-expansion document is kept in \`${installReceiptFile}\` (\`cursorExpansion\`),`,
-  'and `agent-bundle doctor --host cursor` verifies the expanded paths (`AB7326`). Nothing is changed for',
+  'and the optional `agent-bundle doctor --host cursor` verifies the expanded paths (`AB7326`). Nothing is changed for',
   'other Agent Plugins clients, which expand the placeholders themselves.',
   '',
   '### Reinstall after a same-version rebuild',
diff --git a/packages/agent-bundle/tests/install-surface.test.ts b/packages/agent-bundle/tests/install-surface.test.ts
index efde9d134..3a754e9d9 100644
--- a/packages/agent-bundle/tests/install-surface.test.ts
+++ b/packages/agent-bundle/tests/install-surface.test.ts
@@ -85,6 +85,37 @@ it('emits always-installable Claude and Codex local marketplaces with exact comm
   );
 });
 
+// A consumer never needs the framework CLI: the bundle is self-contained, so
+// install, reinstall, and uninstall are host commands, and `agent-bundle
+// install`/`uninstall`/`doctor` are documented as optional automation only.
+it.each(['claude', 'codex', 'cursor', 'portable'])(
+  'documents host-native install and uninstall for %s and marks the agent-bundle CLI optional',
+  (target) => {
+    const install = writesFor(target).get('INSTALL.md')!;
+    expect(install).toContain('nothing requires the `agent-bundle` CLI');
+    const codeBlocks = [...install.matchAll(/```sh\n([\s\S]*?)```/gu)].map((match) => match[1]!);
+    expect(codeBlocks.length).toBeGreaterThan(0);
+    for (const block of codeBlocks) expect(block).not.toContain('agent-bundle ');
+    // Every paragraph that names a framework CLI verb says the CLI is optional.
+    const paragraphs = install.split('\n\n').filter((paragraph) => /`agent-bundle (?:install|uninstall|doctor)/u.test(paragraph));
+    expect(paragraphs.length).toBeGreaterThan(0);
+    for (const paragraph of paragraphs) expect(paragraph).toMatch(/optional/u);
+  },
+);
+
+it('emits the exact host uninstall commands the framework CLI itself runs, with marketplace removal gated on an inventory check', () => {
+  const claude = writesFor('claude').get('INSTALL.md')!;
+  expect(claude).toContain('```sh\nclaude plugin uninstall install-fixture@install-fixture-marketplace --scope user --keep-data\n```');
+  // `plugin marketplace remove` applies to every scope, so it never sits in the same executable block.
+  expect(claude).not.toMatch(/--keep-data\nclaude plugin marketplace remove/u);
+  // Claude's project/local installs elsewhere are invisible to `plugin list`; the registry is the inventory.
+  expect(claude).toMatch(/stays registered\. Remove it only when nothing else installs from it:\n(?:[^\n]+\n){4}\n```sh\nclaude plugin marketplace remove install-fixture-marketplace\n```/u);
+  expect(claude).toContain('`claude plugin list` shows only\nthe current project, so also check `~/.claude/plugins/installed_plugins.json`');
+  const codex = writesFor('codex').get('INSTALL.md')!;
+  expect(codex).toContain('```sh\ncodex plugin remove install-fixture@install-fixture-marketplace\n```');
+  expect(codex).toMatch(/Remove it only when nothing else installs from it:\n`codex plugin list` shows every other plugin from it\.\n\n```sh\ncodex plugin marketplace remove install-fixture-marketplace\n```/u);
+});
+
 it('emits a standalone safe-copy installer only for Cursor-compatible fallback profiles', () => {
   for (const target of ['cursor', 'portable', 'plugin']) {
     const writes = writesFor(target);
@@ -393,7 +424,7 @@ it('documents the same-version reinstall recipe per host, including Claude\'s ve
   expect(claude).toContain('agent-bundle uninstall claude --from ./ --plan');
   expect(claude).toContain('~/.claude/agent-bundle/receipts/install-fixture.install-fixture-marketplace.user.json');
   expect(codex).toContain('agent-bundle uninstall codex --from ./ --plan');
-  expect(codex).toContain('no\nkeep-data option');
+  expect(codex).toMatch(/has no\s+keep-data\s+option/u);
   expect(writesFor('cursor').get('INSTALL.md')).toContain('node ./install.mjs --replace');
   expect(writesFor('cursor').get('INSTALL.md')).toContain('content-hash comparison');
 
diff --git a/packages/agent-bundle/tests/module-imports.test.ts b/packages/agent-bundle/tests/module-imports.test.ts
index ebb864b62..e7f7a3a28 100644
--- a/packages/agent-bundle/tests/module-imports.test.ts
+++ b/packages/agent-bundle/tests/module-imports.test.ts
@@ -1,7 +1,7 @@
 import { expect, it } from '@rstest/core';
 
 import { sha256Hex } from '../src/core/digest.ts';
-import { readModuleImports, rememberedModuleImports } from '../src/build/module-imports.ts';
+import { readModuleImports } from '../src/build/module-imports.ts';
 
 const source = [
   "import { a } from './a.mjs';",
@@ -26,26 +26,29 @@ it('reports every import with its kind and literal specifier', async () => {
 it('remembers imports by digest and check level so the same bytes are lexed once per process', async () => {
   const bytes = `${source}// remembered\n`;
   const sha256 = sha256Hex(bytes);
-  expect(rememberedModuleImports('lexed', sha256)).toBeUndefined();
   const imports = await readModuleImports(bytes, { check: 'lexed', sha256 });
-  expect(rememberedModuleImports('lexed', sha256)).toBe(imports);
-  // A full parse is a stronger claim than a lex; each level is remembered on its own.
-  expect(rememberedModuleImports('parsed', sha256)).toBeUndefined();
   expect(Object.isFrozen(imports)).toBe(true);
+  // The same bytes at the same level come back as the remembered object, even from a different source string.
+  expect(await readModuleImports('/* replaced */', { check: 'lexed', sha256 })).toBe(imports);
+  // A full parse is a stronger claim than a lex; each level is remembered on its own.
+  const parsed = await readModuleImports(bytes, { check: 'parsed', sha256 });
+  expect(parsed).not.toBe(imports);
+  expect(parsed).toEqual(imports);
   // Without a digest nothing is remembered.
-  await readModuleImports(`${source}// unkeyed\n`, { check: 'lexed' });
-  expect(rememberedModuleImports('lexed', sha256Hex(`${source}// unkeyed\n`))).toBeUndefined();
+  const unkeyed = `${source}// unkeyed\n`;
+  const first = await readModuleImports(unkeyed, { check: 'lexed' });
+  expect(await readModuleImports(unkeyed, { check: 'lexed' })).not.toBe(first);
 });
 
 it('rejects what each check level rejects and remembers nothing for invalid input', async () => {
   const unterminated = 'export const broken = `;\n';
   const badStatement = 'export const broken = ;\n';
   await expect(readModuleImports(unterminated, { check: 'lexed', sha256: sha256Hex(unterminated) })).rejects.toThrow();
-  expect(rememberedModuleImports('lexed', sha256Hex(unterminated))).toBeUndefined();
+  await expect(readModuleImports(unterminated, { check: 'lexed', sha256: sha256Hex(unterminated) })).rejects.toThrow();
   // The lexer accepts a bare statement error a bundler never emits; the full parse does not.
   expect(await readModuleImports(badStatement, { check: 'lexed' })).toEqual([]);
   await expect(readModuleImports(badStatement, { check: 'parsed', sha256: sha256Hex(badStatement) })).rejects.toThrow();
-  expect(rememberedModuleImports('parsed', sha256Hex(badStatement))).toBeUndefined();
+  await expect(readModuleImports(badStatement, { check: 'parsed', sha256: sha256Hex(badStatement) })).rejects.toThrow();
   // A hashbang line is legal ESM input for both levels.
   expect(await readModuleImports("#!/usr/bin/env node\nimport './cli.mjs';\n", { check: 'parsed' })).toEqual([
     { kind: 'static', specifier: './cli.mjs' },
diff --git a/packages/agent-bundle/tests/pack-dependencies.test.ts b/packages/agent-bundle/tests/pack-dependencies.test.ts
new file mode 100644
index 000000000..bb1966e82
--- /dev/null
+++ b/packages/agent-bundle/tests/pack-dependencies.test.ts
@@ -0,0 +1,248 @@
+import { expect, it } from '@rstest/core';
+
+import {
+  classifyDependency,
+  declaredDependencies,
+  isWorkspaceProtocol,
+  declarationSpecifiers,
+  packageNameOf,
+  rewritesWorkspaceProtocols,
+  shellWords,
+} from '../src/build/pack-dependencies.ts';
+
+it.each([
+  // Registry: versions, ranges (npm's loose grammar included), and dist-tags.
+  ['^1.2.3', 'registry'],
+  ['~1.2.3', 'registry'],
+  ['1.2.3', 'registry'],
+  ['v1.2.3', 'registry'],
+  ['1.2.3-beta.1+build.5', 'registry'],
+  ['latest', 'registry'],
+  ['next', 'registry'],
+  ['', 'registry'],
+  ['*', 'registry'],
+  ['1.x', 'registry'],
+  ['>=1 <2 || 3.x', 'registry'],
+  ['>=1, <2', 'registry'],
+  ['v=1', 'registry'],
+  ['1.2.3 - 2.3.4', 'registry'],
+  // An `npm:` alias, its prefix case-insensitive, an absent target being `latest`.
+  ['npm:effect@^4.0.0', 'registry'],
+  ['npm:@scope/name@latest', 'registry'],
+  ['npm:effect', 'registry'],
+  ['npm:name@', 'registry'],
+  ['NPM:effect@^4', 'registry'],
+  // "aliases only work for registry deps": a non-registry target fails the manifest read, as does an unnamed
+  // or invalidly named alias.
+  ['npm:bar@file:../bar', 'unparseable'],
+  ['npm:bar@workspace:*', 'unparseable'],
+  ['npm:bar@github:owner/repo', 'unparseable'],
+  ['npm:bar@npm:baz@^1', 'unparseable'],
+  ['npm:name@foo:bar', 'unparseable'],
+  ['npm:name@not a valid spec', 'unparseable'],
+  ['npm:bad name@1', 'unparseable'],
+  ['npm:', 'unparseable'],
+  // Workspace protocols, as written, are unparseable to npm; whether the packer rewrites them is the caller's policy.
+  ['workspace:*', 'unparseable'],
+  ['catalog:', 'unparseable'],
+  // Git, over every transport npm knows; any other `git+x` is unsupported.
+  ['git+ssh://git@github.com/owner/repo.git', 'fetched'],
+  ['git+https://github.com/owner/repo.git', 'fetched'],
+  ['git+ftp://host/repo', 'fetched'],
+  ['git+rsync://host/repo', 'fetched'],
+  ['git://github.com/owner/repo.git', 'fetched'],
+  ['git:', 'fetched'],
+  ['git+foo://host/repo', 'unparseable'],
+  // scp-style: only a host npm recognises parses; `git@host:path` is read as an invalid dist-tag.
+  ['git@github.com:owner/repo.git', 'fetched'],
+  ['git@host:path', 'unparseable'],
+  // Hosted shorthands; an empty one parses, a malformed one does not.
+  ['github:owner/repo#131f4b6', 'fetched'],
+  ['gitlab:owner/repo', 'fetched'],
+  ['bitbucket:owner/repo', 'fetched'],
+  ['gist:deadbeef', 'fetched'],
+  ['github:', 'fetched'],
+  ['github:%zz', 'unparseable'],
+  ['owner/repo', 'fetched'],
+  ['owner/repo#semver:^1', 'fetched'],
+  // Remote tarballs, when the URL is one.
+  ['https://pkg.pr.new/owner/repo/@scope/name@42539ff', 'fetched'],
+  ['http://example.test/name.tgz', 'fetched'],
+  ['http:%zz', 'unparseable'],
+  ['https://', 'unparseable'],
+  // Paths: `file:`, relative, absolute, home, Windows drive, bare tarball, bare directory.
+  ['file:../local', 'fetched'],
+  ['file:', 'fetched'],
+  ['./vendor/dep', 'fetched'],
+  ['../vendor/dep', 'fetched'],
+  ['/opt/vendor/dep', 'fetched'],
+  ['~/vendor/dep', 'fetched'],
+  ['C:\\vendor\\dep', 'fetched'],
+  ['c:/vendor/dep', 'fetched'],
+  ['foo.tgz', 'fetched'],
+  ['foo.tar', 'fetched'],
+  ['vendor/foo/bar', 'fetched'],
+  // Schemes npm does not support, including other managers' link protocols and a typo.
+  ['link:../local', 'unparseable'],
+  ['portal:../local', 'unparseable'],
+  ['foo:bar', 'unparseable'],
+  ['jsr:@scope/name', 'unparseable'],
+  // Neither a range nor a URL-safe dist-tag (EINVALIDTAGNAME) — including a value npm reads with its whitespace.
+  ['not a valid spec', 'unparseable'],
+  ['1.2.3+..', 'unparseable'],
+  [' npm:bar@1', 'unparseable'],
+])('classifyDependency("name", %j) is %s', (specifier, kind) => {
+  expect(classifyDependency('name', specifier)).toBe(kind);
+});
+
+it.each([
+  // npm validates the dependency key too (EINVALIDPACKAGENAME): scoped or not, URL-safe, no leading `.` or `_`
+  // on an unscoped name, and never a reserved name.
+  ['name', 'registry'],
+  ['@scope/name', 'registry'],
+  ['some.pkg_name-1~', 'registry'],
+  ['UPPER', 'registry'],
+  ['@_scope/name', 'registry'],
+  ['@.scope/name', 'registry'],
+  ['@scope/_name', 'registry'],
+  ['bad name', 'unparseable'],
+  ['.hidden', 'unparseable'],
+  ['_private', 'unparseable'],
+  ['@scope', 'unparseable'],
+  ['@scope/', 'unparseable'],
+  ['name/extra', 'unparseable'],
+  ['node_modules', 'unparseable'],
+  ['Favicon.ico', 'unparseable'],
+])('classifyDependency(%j, "^1") is %s', (name, kind) => {
+  expect(classifyDependency(name, '^1')).toBe(kind);
+});
+
+
+it('tells workspace protocols apart and knows which packers rewrite them', () => {
+  expect(isWorkspaceProtocol('workspace:*')).toBe(true);
+  expect(isWorkspaceProtocol('catalog:default')).toBe(true);
+  // No packer rewrites a value that merely contains the protocol; npm then reads it as an invalid dist-tag.
+  expect(isWorkspaceProtocol(' catalog:default')).toBe(false);
+  expect(isWorkspaceProtocol('npm:effect@^4')).toBe(false);
+  expect(isWorkspaceProtocol('github:owner/repo')).toBe(false);
+  expect(rewritesWorkspaceProtocols('pnpm/10.18.0 npm/? node/v24.0.0 linux x64')).toBe(true);
+  expect(rewritesWorkspaceProtocols('yarn/4.9.1 npm/? node/v24.0.0 linux x64')).toBe(true);
+  expect(rewritesWorkspaceProtocols('bun/1.2.0 npm/? node/v24.0.0 linux x64')).toBe(true);
+  expect(rewritesWorkspaceProtocols('npm/11.4.2 node/v24.0.0 linux x64 workspaces/false')).toBe(false);
+  expect(rewritesWorkspaceProtocols(undefined)).toBe(false);
+});
+
+it.each([
+  ['effect', 'effect'],
+  ['effect/Function', 'effect'],
+  ['@scope/name', '@scope/name'],
+  ['@scope/name/deep/path.js', '@scope/name'],
+  ['left-pad/lib/index.js', 'left-pad'],
+  // Not a package.
+  ['./a.mjs', undefined],
+  ['../a.mjs', undefined],
+  ['/abs/a.mjs', undefined],
+  ['#internal', undefined],
+  ['node:fs', undefined],
+  ['fs', undefined],
+  ['data:text/javascript,export default 1', undefined],
+  ['file:///tmp/a.mjs', undefined],
+  ['C:\\a.mjs', undefined],
+  ['@scope', undefined],
+  ['@scope/', undefined],
+  ['', undefined],
+])('packageNameOf(%j) is %j', (specifier, name) => {
+  expect(packageNameOf(specifier)).toBe(name);
+});
+
+it.each([
+  ['import { a } from "effect";', ['effect']],
+  ["import type { ZodType } from 'zod';", ['zod']],
+  ['export * from "@scope/name/deep";', ['@scope/name/deep']],
+  ['import "side-effect";', ['side-effect']],
+  ['type T = import("types-only").T;', ['types-only']],
+  ['import x = require("legacy");', ['legacy']],
+  ["declare const y: typeof import ( 'spaced' );", ['spaced']],
+  // A type directive resolves through the package itself or its DefinitelyTyped package.
+  ['/// <reference types="node" />', ['node', '@types/node']],
+  ['declare module "driver-package" { interface Options { verbose?: boolean } }', ['driver-package']],
+  ["declare module 'augmented' {}", ['augmented']],
+  ["/// <reference types = '@scope/name' />", ['@scope/name', '@types/scope__name']],
+  ['import a from "one"; export { b } from "two"; import c = require("three");', ['one', 'two', 'three']],
+  ['declare const n: string;', []],
+])('declarationSpecifiers(%j) is %j', (source, specifiers) => {
+  expect(declarationSpecifiers(source)).toEqual(specifiers);
+});
+
+it.each([
+  // Quoted arguments are whole words; adjacent segments join into one.
+  ['node "scripts/my install.cjs"', ['node', 'scripts/my install.cjs']],
+  ['node --import="./setup.mjs" .', ['node', '--import=./setup.mjs', '.']],
+  ["a'b c'\"d e\"f", ['ab cd ef']],
+  // Operators split without whitespace; a newline is one too.
+  ['node install.js&&echo done', ['node', 'install.js', '&&', 'echo', 'done']],
+  ['a || b | c ; d & e\nf', ['a', '||', 'b', '|', 'c', ';', 'd', '&', 'e', '\n', 'f']],
+  // Backslash escapes: `"`, `\`, `$`, and a backtick inside double quotes, anything unquoted; nothing single-quoted.
+  [String.raw`node -e "require(\"optional-driver\")"`, ['node', '-e', 'require("optional-driver")']],
+  [String.raw`echo "\\ \$HOME \` \n"`, ['echo', String.raw`\ $HOME ` + '` \\n']],
+  [String.raw`echo \"quoted\" my\ file \\`, ['echo', '"quoted"', 'my file', '\\']],
+  [String.raw`echo 'lit\eral' 'no\"escape'`, ['echo', String.raw`lit\eral`, String.raw`no\"escape`]],
+  // A backslash-newline continues the line, quoted or not.
+  ['echo one\\\ntwo "three\\\nfour"', ['echo', 'onetwo', 'threefour']],
+  ['', []],
+])('shellWords(%j) is %j', (command, words) => {
+  expect(shellWords(command)).toEqual(words);
+});
+
+it('lists installed-dependency fields only, skipping non-string specifiers; optional peers are kept but not installed', () => {
+  expect(declaredDependencies({
+    dependencies: { a: '^1', broken: 1 },
+    devDependencies: { ignored: '^1' },
+    optionalDependencies: 'not an object',
+    peerDependencies: { b: 'workspace:*', optional: '^2' },
+    peerDependenciesMeta: { optional: { optional: true } },
+  })).toEqual([
+    { bundled: false, field: 'dependencies', installed: true, name: 'a', specifier: '^1' },
+    { bundled: false, field: 'peerDependencies', installed: true, name: 'b', specifier: 'workspace:*' },
+    { bundled: false, field: 'peerDependencies', installed: false, name: 'optional', specifier: '^2' },
+  ]);
+});
+
+it('lets an optionalDependencies entry supersede the same name under dependencies', () => {
+  expect(declaredDependencies({
+    dependencies: { both: 'file:../both', only: '^1' },
+    optionalDependencies: { both: '^2' },
+  })).toEqual([
+    { bundled: false, field: 'dependencies', installed: true, name: 'only', specifier: '^1' },
+    { bundled: false, field: 'optionalDependencies', installed: true, name: 'both', specifier: '^2' },
+  ]);
+});
+
+it('drops a peer that dependencies or optionalDependencies also names, whose selector npm never reads', () => {
+  expect(declaredDependencies({
+    dependencies: { concrete: '^1' },
+    optionalDependencies: { optional: '^1' },
+    peerDependencies: { concrete: 'not a valid spec', optional: 'file:../optional', 'peer-only': '^1' },
+  })).toEqual([
+    { bundled: false, field: 'dependencies', installed: true, name: 'concrete', specifier: '^1' },
+    { bundled: false, field: 'optionalDependencies', installed: true, name: 'optional', specifier: '^1' },
+    { bundled: false, field: 'peerDependencies', installed: true, name: 'peer-only', specifier: '^1' },
+  ]);
+});
+
+it('marks bundleDependencies entries, by name list or wholesale, as bundled', () => {
+  const dependencies = { embedded: 'file:../embedded', fetched: '^1' };
+  expect(declaredDependencies({ bundleDependencies: ['embedded'], dependencies }).map((d) => [d.name, d.bundled])).toEqual([
+    ['embedded', true],
+    ['fetched', false],
+  ]);
+  expect(declaredDependencies({ bundledDependencies: ['embedded'], dependencies }).map((d) => d.bundled)).toEqual([true, false]);
+  expect(declaredDependencies({ bundleDependencies: true, dependencies }).map((d) => d.bundled)).toEqual([true, true]);
+  // npm never packs a node_modules entry for a peer, and `true` covers dependencies only.
+  expect(declaredDependencies({
+    bundleDependencies: ['peer', 'optional'],
+    optionalDependencies: { optional: 'file:../optional' },
+    peerDependencies: { peer: 'file:../peer' },
+  }).map((d) => [d.name, d.bundled])).toEqual([['optional', true], ['peer', false]]);
+  expect(declaredDependencies({ bundleDependencies: true, optionalDependencies: { optional: '^1' } })[0]?.bundled).toBe(false);
+});
diff --git a/packages/agent-bundle/tests/prepack.test.ts b/packages/agent-bundle/tests/prepack.test.ts
index 3002d42c6..4346bf20e 100644
--- a/packages/agent-bundle/tests/prepack.test.ts
+++ b/packages/agent-bundle/tests/prepack.test.ts
@@ -1,13 +1,15 @@
 import { execFile as executeFile } from 'node:child_process';
 import { cp, mkdir, mkdtemp, readFile, rm, stat, symlink, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { join, relative } from 'node:path';
 import { promisify } from 'node:util';
+import { gzipSync } from 'node:zlib';
 
 import { afterAll, beforeAll, expect, it } from '@rstest/core';
 
 import { prepack } from '../src/api.ts';
 import { runCli } from '../src/cli.ts';
+import type { Diagnostic } from '../src/core/diagnostics.ts';
 import { captureCliTerminal } from './support/cli-terminal.ts';
 import {
   packInventoryDiagnostics,
@@ -17,6 +19,25 @@ import {
 
 const execFile = promisify(executeFile);
 const workspaceNodeModules = join(process.cwd(), 'node_modules');
+
+/** A gzipped ustar archive in npm's layout: one `package/package.json` entry with the given manifest text. */
+const packageTarball = (manifest: string): Buffer => {
+  const data = Buffer.from(manifest);
+  const header = Buffer.alloc(512);
+  header.write('package/package.json', 0);
+  header.write('0000644\0', 100);
+  header.write('0000000\0', 108);
+  header.write('0000000\0', 116);
+  header.write(`${data.length.toString(8).padStart(11, '0')}\0`, 124);
+  header.write('00000000000\0', 136);
+  header.write('        ', 148);
+  header.write('0', 156);
+  header.write('ustar\0', 257);
+  header.write('00', 263);
+  const checksum = header.reduce((sum, byte) => sum + byte, 0);
+  header.write(`${checksum.toString(8).padStart(6, '0')}\0 `, 148);
+  return gzipSync(Buffer.concat([header, data, Buffer.alloc((512 - (data.length % 512)) % 512), Buffer.alloc(1024)]));
+};
 let cleanupRoot: string;
 let projectRoot: string;
 let result: Awaited<ReturnType<typeof prepack>>;
@@ -58,12 +79,16 @@ afterAll(async () => {
   await rm(cleanupRoot, { force: true, recursive: true });
 });
 
-const diagnostics = (packOutput: PackOutput = result.pack): Promise<readonly { readonly code: string }[]> =>
+const diagnostics = (
+  packOutput: PackOutput = result.pack,
+  packerRewritesWorkspaceProtocols = false,
+): Promise<readonly Diagnostic[]> =>
   packInventoryDiagnostics({
     artifactRoot: result.build.build.outputRoot,
     model: result.build.model,
     packageBuild: result.build.packageBuild!,
     packOutput,
+    packerRewritesWorkspaceProtocols,
     projectRoot,
   });
 
@@ -163,31 +188,675 @@ it('reports stale artifact hashes as AB7011', async () => {
   }
 });
 
-it('reports source-relative or unpacked package bins as AB7012', async () => {
+/** Runs `run` against `package.json` rewritten by `mutate`, restoring the original afterwards. */
+const withPackageDocument = async (
+  mutate: (document: Record<string, unknown>) => void,
+  run: () => Promise<void>,
+): Promise<void> => {
   const packagePath = join(projectRoot, 'package.json');
   const original = await readFile(packagePath, 'utf8');
   const document = JSON.parse(original) as Record<string, unknown>;
-  document.bin = { 'installer-fixture': './src/cli.ts' };
+  mutate(document);
   await writeFile(packagePath, `${JSON.stringify(document, null, 2)}\n`);
   try {
-    expect(await diagnostics()).toContainEqual(expect.objectContaining({ code: 'AB7012' }));
+    await run();
   } finally {
     await writeFile(packagePath, original);
   }
-});
+};
 
-it('reports package, model, host, and provenance version disagreement as AB7013', async () => {
-  const packagePath = join(projectRoot, 'package.json');
-  const original = await readFile(packagePath, 'utf8');
-  const document = JSON.parse(original) as Record<string, unknown>;
-  document.version = '9.0.0';
-  await writeFile(packagePath, `${JSON.stringify(document, null, 2)}\n`);
-  try {
+const withCode = (reported: readonly Diagnostic[], code: string): readonly Diagnostic[] =>
+  reported.filter((diagnostic) => diagnostic.code === code);
+
+it('reports source-relative or unpacked package bins as AB7012', () => withPackageDocument(
+  (document) => { document.bin = { 'installer-fixture': './src/cli.ts' }; },
+  async () => {
+    expect(await diagnostics()).toContainEqual(expect.objectContaining({ code: 'AB7012' }));
+  },
+));
+
+it('reports package, model, host, and provenance version disagreement as AB7013', () => withPackageDocument(
+  (document) => { document.version = '9.0.0'; },
+  async () => {
     expect(await diagnostics()).toContainEqual(expect.objectContaining({ code: 'AB7013' }));
-  } finally {
-    await writeFile(packagePath, original);
-  }
-});
+  },
+));
+
+it('reports installed dependencies no packed JavaScript imports as AB7014, per field', () => withPackageDocument(
+  (document) => {
+    document.dependencies = { zod: '4.5.4', effect: '4.0.0' };
+    document.peerDependencies = { react: '19.2.8', 'optional-host': '^1.0.0' };
+    document.peerDependenciesMeta = { 'optional-host': { optional: true } };
+    document.devDependencies = { 'agent-bundle': 'workspace:*' };
+  },
+  async () => {
+    const reported = withCode(await diagnostics(), 'AB7014');
+    // One diagnostic per field; devDependencies never reach a consumer and optional peers are never installed, so
+    // nothing has to use optional-host.
+    expect(reported.map((diagnostic) => diagnostic.message)).toEqual([
+      expect.stringMatching(/^package\.json dependencies .*"effect", "zod"/u),
+      expect.stringMatching(/^package\.json peerDependencies .*"react"/u),
+    ]);
+    // A required peer nothing imports may be a deliberate host-compatibility contract: a warning, not a refusal.
+    expect(reported.map((diagnostic) => diagnostic.severity)).toEqual(['error', 'warning']);
+    expect(reported[0]?.recovery).toContain('devDependencies');
+    expect(reported[1]?.message).toContain('compatibility contract');
+    expect(reported[1]?.recovery).toContain('peerDependenciesMeta');
+  },
+));
+
+it('reports an optional peer only for a protocol npm cannot parse, which fails the install before any fetch', () => withPackageDocument(
+  (document) => {
+    document.peerDependencies = { 'git-peer': 'github:owner/git-peer', 'workspace-peer': 'workspace:*', 'typo-peer': 'foo:bar' };
+    document.peerDependenciesMeta = {
+      'git-peer': { optional: true },
+      'typo-peer': { optional: true },
+      'workspace-peer': { optional: true },
+    };
+  },
+  async () => {
+    const [reported] = withCode(await diagnostics(), 'AB7015');
+    // npm never fetches an optional peer, so its git source is harmless; it still parses the specifier.
+    expect(reported?.message).toMatch(/^package\.json peerDependencies .*"typo-peer" -> "foo:bar", "workspace-peer" -> "workspace:\*"/u);
+    expect(reported?.message).not.toContain('"git-peer"');
+    expect(reported?.severity).toBe('error');
+    expect(withCode(await diagnostics(), 'AB7014')).toHaveLength(0);
+    // A packer that rewrites workspace protocols leaves only the typo.
+    expect(withCode(await diagnostics(result.pack, true), 'AB7015')[0]?.message).not.toContain('"workspace-peer"');
+  },
+));
+
+it('accepts a package loaded through a createRequire() binding, literal or computed', () => withPackageDocument(
+  (document) => { document.dependencies = { 'driver-package': '^1.0.0', 'never-loaded': '^1.0.0' }; },
+  async () => {
+    const consumer = join(projectRoot, 'dist', 'aliased.mjs');
+    await writeFile(consumer, [
+      // The factory renamed on import is still a factory.
+      'import { createRequire as makeRequire } from "node:module";',
+      'const load = makeRequire(import.meta.url);',
+      'export const driver = load("driver-package");',
+      '',
+    ].join('\n'));
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: 'dist/aliased.mjs' }] };
+      const [reported] = withCode(await diagnostics(pack), 'AB7014');
+      expect(reported?.message).toContain('"never-loaded"');
+      expect(reported?.message).not.toContain('"driver-package"');
+      // Namespace-qualified factory, computed argument.
+      await writeFile(consumer, 'import * as Module from "node:module";\nconst load = Module.createRequire(import.meta.url);\nexport const any = (name) => load(name);\n');
+      expect(withCode(await diagnostics(pack), 'AB7014')).toHaveLength(0);
+      // Factory chained off a CommonJS load, literal argument.
+      await writeFile(consumer, 'const load = require("node:module").createRequire(__filename);\nmodule.exports = load("driver-package");\n');
+      const [chained] = withCode(await diagnostics(pack), 'AB7014');
+      expect(chained?.message).toContain('"never-loaded"');
+      expect(chained?.message).not.toContain('"driver-package"');
+      // Loader called inline with a literal.
+      await writeFile(consumer, 'import { createRequire } from "node:module";\nexport const driver = createRequire(import.meta.url)("driver-package");\n');
+      const [inline] = withCode(await diagnostics(pack), 'AB7014');
+      expect(inline?.message).toContain('"never-loaded"');
+      expect(inline?.message).not.toContain('"driver-package"');
+      // Factory argument with nested calls, literal target.
+      await writeFile(consumer, 'import { createRequire } from "node:module";\nexport const driver = createRequire(new URL("./entry.js", import.meta.url))("driver-package");\n');
+      const [nested] = withCode(await diagnostics(pack), 'AB7014');
+      expect(nested?.message).toContain('"never-loaded"');
+      expect(nested?.message).not.toContain('"driver-package"');
+      // The same factory argument, computed target: nothing can be called unused.
+      await writeFile(consumer, 'import { createRequire } from "node:module";\nexport const any = (name) => createRequire(new URL("./entry.js", import.meta.url))(name);\n');
+      expect(withCode(await diagnostics(pack), 'AB7014')).toHaveLength(0);
+      // Comments between the loader and its parentheses, and around the literal, are trivia — and not a computed argument.
+      await writeFile(consumer, 'module.exports = require /* driver */ ( // which\n /* a */ "driver-package" /* b */ );\n');
+      const [commented] = withCode(await diagnostics(pack), 'AB7014');
+      expect(commented?.message).toContain('"never-loaded"');
+      expect(commented?.message).not.toContain('"driver-package"');
+      // Comment trivia before a computed argument still leaves the load computed.
+      await writeFile(consumer, 'module.exports = (name) => require /* any */ (/* of */ name);\n');
+      expect(withCode(await diagnostics(pack), 'AB7014')).toHaveLength(0);
+    } finally {
+      await rm(consumer, { force: true });
+    }
+  },
+));
+
+it.each([
+  ['a namespace import', 'import * as Module from "node:module";\nexport const driver = Module.createRequire(import.meta.url)("driver-package");'],
+  ['the default import', 'import module from "node:module";\nexport const driver = module.createRequire(import.meta.url)("driver-package");'],
+  ['require("node:module")', 'module.exports = require("node:module").createRequire(__filename)("driver-package");'],
+  ["require('module')", "module.exports = require('module').createRequire(__filename)('driver-package');"],
+  ['require("node:module") and .resolve', 'module.exports = require("node:module").createRequire(__filename).resolve("driver-package");'],
+  ['a two-level namespace, bound first', 'import * as ns from "node:module";\nconst load = ns.default.createRequire(import.meta.url);\nexport const driver = load("driver-package");'],
+])('accepts a package loaded by a createRequire() call qualified through %s, direct or bound', (_form, source) => withPackageDocument(
+  (document) => { document.dependencies = { 'driver-package': '^1.0.0', 'never-loaded': '^1.0.0' }; },
+  async () => {
+    const consumer = join(projectRoot, 'dist', source.startsWith('import') ? 'qualified.mjs' : 'qualified.cjs');
+    await writeFile(consumer, `${source}\n`);
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: relative(projectRoot, consumer) }] };
+      const [reported] = withCode(await diagnostics(pack), 'AB7014');
+      expect(reported?.message).toContain('"never-loaded"');
+      expect(reported?.message).not.toContain('"driver-package"');
+    } finally {
+      await rm(consumer, { force: true });
+    }
+  },
+));
+
+it.each([
+  ['a namespace import', 'import * as Module from "node:module";\nexport const load = (name) => Module.createRequire(import.meta.url)(name);'],
+  ['require("node:module")', 'module.exports = (name) => require("node:module").createRequire(__filename)(name);'],
+])('withholds AB7014 for a computed direct createRequire()() call qualified through %s', (_form, source) => withPackageDocument(
+  (document) => { document.dependencies = { 'chosen-at-runtime': '^1.0.0' }; },
+  async () => {
+    const consumer = join(projectRoot, 'dist', source.startsWith('import') ? 'qualified.mjs' : 'qualified.cjs');
+    await writeFile(consumer, `${source}\n`);
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: relative(projectRoot, consumer) }] };
+      expect(withCode(await diagnostics(pack), 'AB7014')).toHaveLength(0);
+    } finally {
+      await rm(consumer, { force: true });
+    }
+  },
+));
+
+it('reports git, GitHub-shorthand, remote-tarball, and path dependency specifiers as AB7015', () => withPackageDocument(
+  (document) => {
+    document.dependencies = {
+      '@agent-bundle/runtime': 'https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@42539ff',
+      bashjsast: 'github:woolkingx/bashjsast#131f4b6',
+      local: 'file:../local',
+      // Registry forms are not reported.
+      alias: 'npm:effect@^4.0.0',
+      tilde: '~1.2.3',
+      versioned: '^1.2.3',
+      // npm publishes a workspace protocol verbatim; only pnpm, Yarn, and Bun rewrite it while packing.
+      sibling: 'workspace:*',
+      // npm embeds bundled dependencies in the tarball; a consumer never fetches their specifier.
+      embedded: 'file:../embedded',
+      // Declared bundled but absent from node_modules at pack time: npm silently packs nothing, so the consumer fetches it.
+      'not-embedded': 'file:../not-embedded',
+      // Shipped inside the tarball, as a directory with a manifest and as a package tarball: npm installs them from
+      // the consumer's copy.
+      vendored: 'file:vendor/vendored',
+      tarred: 'file:vendor/tarred.tgz',
+      // Declared as if shipped, but the source is not in the pack — or is packed and not installable: a `.tgz` that
+      // is no archive (npm: TAR_BAD_ARCHIVE), a directory whose manifest does not parse.
+      'not-vendored': 'file:vendor/not-vendored',
+      'not-archive': 'file:vendor/not-archive.tgz',
+      'bad-manifest': 'file:vendor/bad-manifest',
+      // A well-formed archive whose `package/package.json` is not JSON: npm fails the install with EJSONPARSE.
+      'bad-tarred-manifest': 'file:vendor/bad-tarred-manifest.tgz',
+    };
+    document.bundleDependencies = ['embedded', 'not-embedded'];
+    document.optionalDependencies = {
+      scp: 'git@github.com:owner/repo.git',
+      // npm skips these ten after the failed fetch too — and then postinstall fails: on the missing commands, and on
+      // the missing modules packed files it runs require. `newline-tool` is the first command of postinstall's second
+      // line, `setup-tool` the second of the first. The files are reached as `node scripts/install` (Node resolves
+      // `scripts/install.js`), as `npm test` running a script whose quoted path contains a space, and as
+      // `node scripts/hooks.cjs&&…` with no whitespace around the shell operator; the last loads its dependencies
+      // through a wildcard `imports` entry mapped to the package's own file, and through a directory whose packed
+      // manifest names its `main`. An inline `node -e` program that requires a package needs it too — its quotes
+      // escaped for the shell — as do the modules `node` preloads — a bare `-r` package and a packed `--import=`
+      // file, behind the valued `--conditions` option — before running `.`, the root `main`, and the one a
+      // `NODE_OPTIONS=--require=…` assignment on the `node` command preloads.
+      'setup-tool': 'git+https://github.com/owner/setup-tool.git',
+      'newline-tool': 'github:owner/newline-tool',
+      'optional-driver': 'github:owner/optional-driver',
+      'optional-tester': 'github:owner/optional-tester',
+      'optional-hook': 'github:owner/optional-hook',
+      'optional-main': 'github:owner/optional-main',
+      'optional-inline': 'github:owner/optional-inline',
+      'optional-preload': 'github:owner/optional-preload',
+      'optional-imported': 'github:owner/optional-imported',
+      'optional-root': 'github:owner/optional-root',
+      'optional-env-preload': 'github:owner/optional-env-preload',
+      // Merely mentioned by the script — an `echo` argument; the operand of `rm -r`, whose `-r` is not Node's
+      // preload option; and the value of a `--require` after the program, which Node hands to the program as an
+      // argument — so npm's skipping them breaks nothing: a warning.
+      'optional-mentioned': 'github:owner/optional-mentioned',
+      'optional-removed': 'github:owner/optional-removed',
+      'optional-argument': 'github:owner/optional-argument',
+      // npm parses these only to fail, so optional or not, the consumer's install dies.
+      'typo-optional': 'foo:bar',
+      'tag-optional': 'not a valid spec',
+      'url-optional': 'http:%zz',
+      'bad name': '^1.0.0',
+    };
+    document.imports = { '#hooks/*': './scripts/*-setup.cjs' };
+    document.main = './scripts/root-setup.cjs';
+    document.scripts = {
+      ...(document.scripts as Record<string, string> | undefined),
+      postinstall: 'echo start\nnewline-tool --init && setup-tool --init'
+        + ' && NODE_OPTIONS=--require=optional-env-preload node scripts/install --require optional-argument && npm test',
+      // A `NODE_OPTIONS` that preloads nothing, set through `cross-env`, changes nothing about the command it precedes.
+      test: 'cross-env NODE_OPTIONS="--max-old-space-size=4096" node "scripts/my install.cjs";node scripts/hooks.cjs&&echo optional-mentioned'
+        + ' && node -e "require(\\"optional-inline\\")"'
+        + ' && rm -r optional-removed && node --conditions react-server -r optional-preload/register --import="./scripts/preload.mjs" .',
+    };
+  },
+  async () => {
+    await mkdir(join(projectRoot, 'scripts', 'lib'), { recursive: true });
+    await mkdir(join(projectRoot, 'vendor', 'vendored'), { recursive: true });
+    await mkdir(join(projectRoot, 'vendor', 'bad-manifest'), { recursive: true });
+    await Promise.all([
+      writeFile(join(projectRoot, 'scripts', 'install.js'), 'import "./driver-setup.cjs";\n'),
+      writeFile(join(projectRoot, 'scripts', 'driver-setup.cjs'), 'module.exports = require("optional-driver");\n'),
+      writeFile(join(projectRoot, 'scripts', 'my install.cjs'), 'require("optional-tester");\n'),
+      writeFile(join(projectRoot, 'scripts', 'hooks.cjs'), 'require("#hooks/hook");\nrequire("./lib");\n'),
+      writeFile(join(projectRoot, 'scripts', 'hook-setup.cjs'), 'require("optional-hook");\n'),
+      writeFile(join(projectRoot, 'scripts', 'lib', 'package.json'), '{ "main": "setup.cjs" }\n'),
+      writeFile(join(projectRoot, 'scripts', 'lib', 'setup.cjs'), 'require("optional-main");\n'),
+      writeFile(join(projectRoot, 'scripts', 'preload.mjs'), 'import "optional-imported";\n'),
+      writeFile(join(projectRoot, 'scripts', 'root-setup.cjs'), 'require("optional-root");\n'),
+      writeFile(join(projectRoot, 'vendor', 'vendored', 'package.json'), '{ "name": "vendored", "version": "1.0.0" }\n'),
+      writeFile(join(projectRoot, 'vendor', 'bad-manifest', 'package.json'), '{\n'),
+      writeFile(join(projectRoot, 'vendor', 'tarred.tgz'), packageTarball('{ "name": "tarred", "version": "1.0.0" }')),
+      writeFile(join(projectRoot, 'vendor', 'bad-tarred-manifest.tgz'), packageTarball('not json\n')),
+      writeFile(join(projectRoot, 'vendor', 'not-archive.tgz'), 'not a tarball\n'),
+    ]);
+    const pack = { ...result.pack, files: [...result.pack.files,
+      { path: 'node_modules/embedded/package.json' },
+      { path: 'vendor/vendored/package.json' },
+      { path: 'vendor/bad-manifest/package.json' },
+      { path: 'vendor/tarred.tgz' },
+      { path: 'vendor/bad-tarred-manifest.tgz' },
+      { path: 'vendor/not-archive.tgz' },
+      { path: 'scripts/install.js' },
+      { path: 'scripts/driver-setup.cjs' },
+      { path: 'scripts/my install.cjs' },
+      { path: 'scripts/hooks.cjs' },
+      { path: 'scripts/hook-setup.cjs' },
+      { path: 'scripts/lib/package.json' },
+      { path: 'scripts/lib/setup.cjs' },
+      { path: 'scripts/preload.mjs' },
+      { path: 'scripts/root-setup.cjs' },
+    ] };
+    const reported = withCode(await diagnostics(pack), 'AB7015');
+    expect(reported.map((diagnostic) => diagnostic.message)).toEqual([
+      expect.stringMatching(/^package\.json dependencies .*consumers cannot install the package\.$/u),
+      expect.stringMatching(/^package\.json optionalDependencies .*"bad name" -> "\^1\.0\.0", "newline-tool" -> "github:owner\/newline-tool", "optional-driver" -> "github:owner\/optional-driver", "optional-env-preload" -> "github:owner\/optional-env-preload", "optional-hook" -> "github:owner\/optional-hook", "optional-imported" -> "github:owner\/optional-imported", "optional-inline" -> "github:owner\/optional-inline", "optional-main" -> "github:owner\/optional-main", "optional-preload" -> "github:owner\/optional-preload", "optional-root" -> "github:owner\/optional-root", "optional-tester" -> "github:owner\/optional-tester", "setup-tool" -> "git\+https:\/\/github\.com\/owner\/setup-tool\.git", "tag-optional" -> "not a valid spec", "typo-optional" -> "foo:bar", "url-optional" -> "http:%zz"; consumers cannot install the package\.$/u),
+      expect.stringMatching(/^package\.json optionalDependencies .*"optional-argument" -> "github:owner\/optional-argument", "optional-mentioned" -> "github:owner\/optional-mentioned", "optional-removed" -> "github:owner\/optional-removed", "scp" -> "git@github\.com:owner\/repo\.git".*continues without them/u),
+    ]);
+    // npm survives an optional dependency it parsed but cannot fetch, so that entry warns rather than blocks the
+    // release; a specifier it cannot parse fails the manifest read and stays fatal, as does a skipped package an
+    // install script then runs or loads.
+    expect(reported.map((diagnostic) => diagnostic.severity)).toEqual(['error', 'error', 'warning']);
+    for (const name of ['scp', 'optional-argument', 'optional-mentioned', 'optional-removed']) {
+      expect(reported[1]?.message).not.toContain(JSON.stringify(name));
+    }
+    for (const name of [
+      'setup-tool', 'newline-tool', 'optional-driver', 'optional-tester', 'optional-hook', 'optional-main', 'optional-inline',
+      'optional-preload', 'optional-imported', 'optional-root', 'optional-env-preload',
+    ]) {
+      expect(reported[2]?.message).not.toContain(JSON.stringify(name));
+    }
+    // To npm, `.` is the working directory (`--prefix .`), not a program: only `node .` runs the root `main`.
+    await withPackageDocument(
+      (document) => {
+        document.scripts = { ...(document.scripts as Record<string, string>), postinstall: 'npm --prefix . run setup', setup: 'echo setup' };
+      },
+      async () => {
+        const survivable = withCode(await diagnostics(pack), 'AB7015').find((diagnostic) => diagnostic.severity === 'warning');
+        expect(survivable?.message).toContain('"optional-root"');
+      },
+    );
+    for (const name of ['@agent-bundle/runtime', 'bashjsast', 'local', 'sibling', 'not-embedded', 'not-vendored', 'not-archive', 'bad-manifest', 'bad-tarred-manifest']) {
+      expect(reported[0]?.message).toContain(`${JSON.stringify(name)} -> `);
+    }
+    for (const name of ['alias', 'tilde', 'versioned', 'embedded', 'vendored', 'tarred']) {
+      expect(reported[0]?.message).not.toContain(JSON.stringify(name));
+    }
+    await rm(join(projectRoot, 'scripts'), { force: true, recursive: true });
+    await rm(join(projectRoot, 'vendor'), { force: true, recursive: true });
+    expect(reported[0]?.recovery).toContain('registry');
+
+    const underPnpm = withCode(await diagnostics(pack, true), 'AB7015');
+    expect(underPnpm[0]?.message).not.toContain('"sibling"');
+  },
+));
+
+it('withholds AB7014 when packed JavaScript has a computed import() that could load any declared package', () => withPackageDocument(
+  (document) => { document.dependencies = { 'chosen-at-runtime': '^1.0.0' }; },
+  async () => {
+    const consumer = join(projectRoot, 'dist', 'computed.mjs');
+    await writeFile(consumer, 'export const load = (name) => import(name);\n');
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: 'dist/computed.mjs' }] };
+      expect(withCode(await diagnostics(pack), 'AB7014')).toHaveLength(0);
+      // Without that file the same declaration is reported.
+      expect(withCode(await diagnostics(), 'AB7014')).toHaveLength(1);
+    } finally {
+      await rm(consumer, { force: true });
+    }
+  },
+));
+
+it('withholds AB7014 when packed JavaScript the lexer rejects may hide an import()', () => withPackageDocument(
+  (document) => { document.dependencies = { 'chosen-at-runtime': '^1.0.0' }; },
+  async () => {
+    const consumer = join(projectRoot, 'dist', 'unlexable.mjs');
+    // An unbalanced call: the lexer throws before reporting any import, so nothing proves the package unused.
+    await writeFile(consumer, 'export const load = () => import("chosen-at-runtime"\n');
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: 'dist/unlexable.mjs' }] };
+      expect(withCode(await diagnostics(pack), 'AB7014')).toHaveLength(0);
+    } finally {
+      await rm(consumer, { force: true });
+    }
+  },
+));
+
+it.each([
+  ['require()', 'module.exports = (name) => require(name);'],
+  ['require.resolve()', 'module.exports = (name) => require.resolve(name);'],
+  ['import.meta.resolve()', 'export const where = (name) => import.meta.resolve(name);'],
+  ['a direct createRequire()()', 'import { createRequire } from "node:module";\nexport const load = (name) => createRequire(import.meta.url)(name);'],
+  ['require() of a literal-prefixed expression', 'module.exports = (variant) => require("chosen-at-runtime/" + variant);'],
+  ['require.resolve() of a template literal', 'module.exports = (variant) => require.resolve(`chosen-at-runtime/${variant}`);'],
+])('withholds AB7014 for a computed CommonJS %s just as for a computed import()', (_form, source) => withPackageDocument(
+  (document) => { document.dependencies = { 'chosen-at-runtime': '^1.0.0' }; },
+  async () => {
+    const consumer = join(projectRoot, 'dist', source.startsWith('module.exports') ? 'computed.cjs' : 'computed.mjs');
+    await writeFile(consumer, `${source}\n`);
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: relative(projectRoot, consumer) }] };
+      expect(withCode(await diagnostics(pack), 'AB7014')).toHaveLength(0);
+    } finally {
+      await rm(consumer, { force: true });
+    }
+  },
+));
+
+it.each([
+  ['const load = require;', 'const load = require;\nmodule.exports = load("chosen-at-runtime");'],
+  ['fn(require)', 'module.exports = (fn) => fn(require);'],
+  ['module.exports = require', 'module.exports = require'],
+  ['[require]', 'module.exports = [require];'],
+  ['a ? require : b', 'module.exports = typeof require === "function" ? require : null;'],
+  ['a createRequire() binding passed on', 'import { createRequire } from "node:module";\nconst load = createRequire(import.meta.url);\nexport const use = (fn) => fn(load);'],
+])('withholds AB7014 when a loader is passed on as a value (%s), since it may load anything under another name', (_form, source) => withPackageDocument(
+  (document) => { document.dependencies = { 'chosen-at-runtime': '^1.0.0' }; },
+  async () => {
+    const consumer = join(projectRoot, 'dist', source.startsWith('import') ? 'alias.mjs' : 'alias.cjs');
+    await writeFile(consumer, `${source}\n`);
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: relative(projectRoot, consumer) }] };
+      expect(withCode(await diagnostics(pack), 'AB7014')).toHaveLength(0);
+    } finally {
+      await rm(consumer, { force: true });
+    }
+  },
+));
+
+it.each([
+  ['require("…")', 'module.exports = require("node:path");'],
+  ['require.resolve("…")', 'module.exports = require.resolve("node:path");'],
+  ['typeof require', 'module.exports = typeof require;'],
+  ['the string "require"', 'module.exports = "require";'],
+  ['prose in comments', '/**\n * Use when a getter may fail, require\n * services, or run asynchronously.\n */\n// factory(module, require)\nmodule.exports = 1;'],
+  ['a bundler runtime named like require', 'const load = __webpack_require__;\nmodule.exports = load;'],
+])('still reports AB7014 when require is only called, resolved through, type-tested, or named in a string or comment (%s)', (_form, source) => withPackageDocument(
+  (document) => { document.dependencies = { 'never-loaded': '^1.0.0' }; },
+  async () => {
+    const consumer = join(projectRoot, 'dist', 'not-alias.cjs');
+    await writeFile(consumer, `${source}\n`);
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: 'dist/not-alias.cjs' }] };
+      const [reported] = withCode(await diagnostics(pack), 'AB7014');
+      expect(reported?.message).toContain('"never-loaded"');
+    } finally {
+      await rm(consumer, { force: true });
+    }
+  },
+));
+
+it('still reports AB7014 when the only resolve() calls are path or Promise resolution, literal or not', () => withPackageDocument(
+  (document) => { document.dependencies = { 'never-loaded': '^1.0.0' }; },
+  async () => {
+    const consumer = join(projectRoot, 'dist', 'resolvers.mjs');
+    await writeFile(consumer, [
+      'import path, { resolve } from "node:path";',
+      'export const f = (a, b) => [resolve(a, b), Promise.resolve(a), path.resolve("never-loaded"), Promise.resolve("never-loaded")];',
+      '',
+    ].join('\n'));
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: 'dist/resolvers.mjs' }] };
+      expect(withCode(await diagnostics(pack), 'AB7014')[0]?.message).toContain('"never-loaded"');
+    } finally {
+      await rm(consumer, { force: true });
+    }
+  },
+));
+
+it('accepts a dependency reached through a package imports map or run by a consumer install script', () => withPackageDocument(
+  (document) => {
+    document.dependencies = {
+      'driver-package': '^1.0.0',
+      'named-in-script': '^1.0.0',
+      typescript: '^5.0.0',
+      // Not installed here, so its bin names are unknowable; the unscoped name stands in for npm's default bin.
+      '@mapbox/node-pre-gyp': '^1.0.0',
+      // A string-form `bin` is one command named after the installed manifest, not the alias.
+      'prepack-test-wrapper': 'npm:@scope/real@^1.0.0',
+      // npm never runs `prepare` for a registry or tarball install; a package only it names is installed for nothing.
+      'prepare-only': '^1.0.0',
+      // Named by a script that `npm run` and `npm test` only receive as an argument, never run.
+      'dormant-only': '^1.0.0',
+      // Reached only through npm's direct script commands: `npm t` is `test` (and its `pretest`), `yarn start` is `start`.
+      'test-runner': '^1.0.0',
+      'server-starter': '^1.0.0',
+      // Reached only because `npm restart` without a `restart` script runs `stop` and `start`.
+      'server-stopper': '^1.0.0',
+    };
+    document.imports = { '#driver': { node: 'driver-package/node', default: 'driver-package' } };
+    document.scripts = {
+      ...(document.scripts as Record<string, string> | undefined),
+      // `tsc` and `node-pre-gyp` are reached only through delegated run-scripts and their pre/post hooks, behind
+      // options with values (`--prefix .`, `-w pkg`, pnpm's `--filter pkg`) and without (`--silent`), through npm's
+      // `rum` alias, after a `--`, and with the script name quoted for the shell. Only the first positional after
+      // `run` (or the direct command) is the script: `dormant`, with or without a `--` before it, is an argument.
+      postinstall: 'named-in-script --init && npm --silent --prefix . run setup dormant && npm t dormant && npm restart',
+      setup: 'echo setup',
+      presetup: 'pnpm --filter pkg rum typecheck',
+      typecheck: 'tsc --version',
+      postsetup: 'npm run -w pkg -- "finish" dormant',
+      finish: 'node-pre-gyp install && real --check',
+      dormant: 'dormant-only --generate',
+      prepare: 'prepare-only --generate',
+      pretest: 'yarn start',
+      test: 'test-runner --ci',
+      start: 'server-starter',
+      stop: 'server-stopper',
+    };
+  },
+  async () => {
+    const consumer = join(projectRoot, 'dist', 'mapped.mjs');
+    await writeFile(consumer, 'export { default } from "#driver";\n');
+    // The fixture's node_modules is the workspace's; the manifest is removed again below.
+    const wrapper = join(workspaceNodeModules, 'prepack-test-wrapper');
+    await mkdir(wrapper, { recursive: true });
+    await writeFile(join(wrapper, 'package.json'), JSON.stringify({ name: '@scope/real', version: '1.0.0', bin: 'cli.js' }));
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: 'dist/mapped.mjs' }] };
+      // `#driver` reaches driver-package; the script names named-in-script directly, typescript through its `tsc` bin,
+      // and the alias through `real`, the bin npm derives from the installed manifest's name. `prepare` proves nothing.
+      const [withImport] = withCode(await diagnostics(pack), 'AB7014');
+      expect(withImport?.message).toContain('"prepare-only"');
+      expect(withImport?.message).toContain('"dormant-only"');
+      expect(withImport?.message).not.toContain('"driver-package"');
+      // Without the `#` import the map alone proves nothing.
+      const [reported] = withCode(await diagnostics(), 'AB7014');
+      expect(reported?.message).toContain('"driver-package"');
+      expect(reported?.message).toContain('"prepare-only"');
+      expect(reported?.message).toContain('"dormant-only"');
+      expect(reported?.message).not.toContain('"typescript"');
+      expect(reported?.message).not.toContain('"@mapbox/node-pre-gyp"');
+      expect(reported?.message).not.toContain('"prepack-test-wrapper"');
+      expect(reported?.message).not.toContain('"test-runner"');
+      expect(reported?.message).not.toContain('"server-starter"');
+      expect(reported?.message).not.toContain('"server-stopper"');
+      // With a `restart` script present, `npm restart` runs it alone: `stop` is no longer reached (`start` still is,
+      // through `yarn start`).
+      await withPackageDocument(
+        (document) => { (document.scripts as Record<string, string>).restart = 'echo restart'; },
+        async () => {
+          const [withRestart] = withCode(await diagnostics(), 'AB7014');
+          expect(withRestart?.message).toContain('"server-stopper"');
+          expect(withRestart?.message).not.toContain('"server-starter"');
+        },
+      );
+    } finally {
+      await rm(wrapper, { force: true, recursive: true });
+      await rm(consumer, { force: true });
+    }
+  },
+));
+
+it.each([
+  ['a literal import()', 'node -e "import(\'optional-driver\')"', 'error'],
+  ['an awaited import() in an ES module program', 'node --input-type=module -e "await import(\'optional-driver\')"', 'error'],
+  ['a computed import(), which may load any declared package', 'node -e "import(process.argv[1])"', 'error'],
+  ['a literal require()', 'node -e "require(\'optional-driver\')"', 'error'],
+  ['source the lexer rejects, which may hide an import()', 'node -e "import(\'optional-driver\'"', 'error'],
+  ['import.meta, which loads nothing', 'node --input-type=module -p "typeof import.meta"', 'warning'],
+  ['the package name in a string', 'node -p "\'optional-driver\'"', 'warning'],
+])('an inline node program with %s (%s) leaves a skipped optional dependency at severity %s', (_form, postinstall, severity) => withPackageDocument(
+  (document) => {
+    document.optionalDependencies = { 'optional-driver': 'github:owner/optional-driver' };
+    document.scripts = { ...(document.scripts as Record<string, string> | undefined), postinstall };
+  },
+  async () => {
+    const [reported] = withCode(await diagnostics(), 'AB7015');
+    expect(reported?.message).toContain('"optional-driver"');
+    expect(reported?.severity).toBe(severity);
+  },
+));
+
+it('reads a dependency whose installed manifest is not JSON as an unknown executable instead of failing the gate', () => withPackageDocument(
+  (document) => {
+    document.dependencies = { 'broken-dep': '^1.0.0', 'never-loaded': '^1.0.0' };
+    document.scripts = { ...(document.scripts as Record<string, string> | undefined), postinstall: 'broken-dep --init' };
+  },
+  async () => {
+    // The fixture's node_modules is the workspace's; the manifest is removed again below.
+    const broken = join(workspaceNodeModules, 'broken-dep');
+    await mkdir(broken, { recursive: true });
+    await writeFile(join(broken, 'package.json'), '{ not json');
+    try {
+      // No throw; the unscoped name stands in for the unreadable manifest's bins, and the script runs it.
+      const reported = await diagnostics();
+      const [unused] = withCode(reported, 'AB7014');
+      expect(unused?.message).toContain('"never-loaded"');
+      expect(unused?.message).not.toContain('"broken-dep"');
+      expect(withCode(reported, 'AB7015')).toHaveLength(0);
+    } finally {
+      await rm(broken, { force: true, recursive: true });
+    }
+  },
+));
+
+it('reads an installed manifest as npm does, so the last of duplicate name keys decides a string-form bin', () => withPackageDocument(
+  (document) => {
+    document.optionalDependencies = { 'prepack-test-dup': 'github:owner/prepack-test-dup' };
+    document.scripts = { ...(document.scripts as Record<string, string> | undefined), postinstall: 'effective --init' };
+  },
+  async () => {
+    // The fixture's node_modules is the workspace's; the manifest is removed again below. `JSON.stringify` cannot
+    // write a duplicate key, so the manifest is spelled out.
+    const dup = join(workspaceNodeModules, 'prepack-test-dup');
+    await mkdir(dup, { recursive: true });
+    await writeFile(join(dup, 'package.json'), '{ "name": "first-name", "name": "@scope/effective", "version": "1.0.0", "bin": "cli.js" }');
+    try {
+      // npm installs the bin as `effective`, the unscoped last `name`; the script runs it, so the skipped fetch is fatal.
+      const reported = await diagnostics();
+      const [skipped] = withCode(reported, 'AB7015');
+      expect(skipped?.message).toContain('"prepack-test-dup"');
+      expect(skipped?.severity).toBe('error');
+      expect(withCode(reported, 'AB7014')).toHaveLength(0);
+    } finally {
+      await rm(dup, { force: true, recursive: true });
+    }
+  },
+));
+
+it('prepack succeeds and surfaces the warning when the only finding is an unresolvable optional dependency', () => withPackageDocument(
+  (document) => {
+    document.optionalDependencies = { 'optional-native': 'github:owner/optional-native' };
+    // The build rewrites dist, so the packed module that loads the optional package lives in its own packed
+    // directory; an install script naming it instead would make the failed fetch fatal.
+    document.files = [...(document.files as readonly string[]), 'extras'];
+  },
+  async () => {
+    const extras = join(projectRoot, 'extras');
+    await mkdir(extras, { recursive: true });
+    await writeFile(join(extras, 'optional.mjs'), 'export const native = await import("optional-native").catch(() => undefined);\n');
+    try {
+      const packed = await prepack({ root: projectRoot });
+      expect(packed.diagnostics.map((diagnostic) => [diagnostic.code, diagnostic.severity])).toEqual([['AB7015', 'warning']]);
+    } finally {
+      await rm(extras, { force: true, recursive: true });
+    }
+  },
+));
+
+it('accepts a dependency that only packed declaration files reference, including @types for a type directive', () => withPackageDocument(
+  (document) => { document.dependencies = { zod: '^4.5.4', '@types/node': '^22.0.0' }; },
+  async () => {
+    const declaration = join(projectRoot, 'dist', 'consumer.d.ts');
+    await writeFile(declaration, [
+      '/// <reference types="node" />',
+      "import type { ZodType } from 'zod';",
+      'export declare const schema: ZodType;',
+      'export declare const buffer: Buffer;',
+      '',
+    ].join('\n'));
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: 'dist/consumer.d.ts' }] };
+      expect(withCode(await diagnostics(pack), 'AB7014')).toHaveLength(0);
+    } finally {
+      await rm(declaration, { force: true });
+    }
+  },
+));
+
+it('accepts a dependency that packed JavaScript imports, requires, or only resolves', () => withPackageDocument(
+  (document) => {
+    document.dependencies = {
+      'left-pad': '^1.3.0',
+      '@scope/required': '^2.0.0',
+      'asset-pkg': '^1.0.0',
+      'tool-pkg': '^1.0.0',
+      // Named only through escaped literals, which Node decodes before resolving.
+      'hex-pkg': '^1.0.0',
+      'unicode-pkg': '^1.0.0',
+      // Run as an executable, never loaded: by the `tsc` bin its installed manifest declares.
+      typescript: '^5.0.0',
+    };
+  },
+  async () => {
+    const consumer = join(projectRoot, 'dist', 'consumer.mjs');
+    await writeFile(consumer, [
+      'import { execSync, spawnSync } from "node:child_process";',
+      'const ran = [spawnSync("tsc", ["--version"]), execSync("tsc --noEmit")];',
+      'import leftPad from "left-pad/lib/index.js";',
+      'const { createRequire } = await import("node:module");',
+      'const require = createRequire(import.meta.url);',
+      'const required = require("@scope/required/subpath");',
+      'const asset = require.resolve("asset-pkg/package.json");',
+      'const tool = import.meta.resolve("tool-pkg/bin/tool");',
+      String.raw`const hex = require("\x68ex-pkg");`,
+      String.raw`const unicode = require('unicode-pkg\u002fsubpath');`,
+      '// import { Function } from "effect" -- a comment never counts.',
+      'export { leftPad, required, asset, tool, hex, unicode, ran };',
+      '',
+    ].join('\n'));
+    try {
+      const pack = { ...result.pack, files: [...result.pack.files, { path: 'dist/consumer.mjs' }] };
+      expect(withCode(await diagnostics(pack), 'AB7014')).toHaveLength(0);
+    } finally {
+      await rm(consumer, { force: true });
+    }
+  },
+));
 
 it('installs a real packed tarball and runs its Cursor installer from node_modules', async () => {
   const tarballs = join(cleanupRoot, 'tarballs');
diff --git a/packages/create-agent-bundle/templates/cli-tool/package_json b/packages/create-agent-bundle/templates/cli-tool/package_json
index a30e97961..3f11ae749 100644
--- a/packages/create-agent-bundle/templates/cli-tool/package_json
+++ b/packages/create-agent-bundle/templates/cli-tool/package_json
@@ -35,9 +35,7 @@
     "@rstest/core": "0.11.10",
     "@types/node": "26.4.0",
     "agent-bundle": "workspace:*",
-    "typescript": "7.0.2"
-  },
-  "dependencies": {
+    "typescript": "7.0.2",
     "@agent-bundle/runtime": "workspace:*",
     "react": "19.2.8",
     "zod": "4.4.3"
diff --git a/packages/create-agent-bundle/templates/mcp-server/package_json b/packages/create-agent-bundle/templates/mcp-server/package_json
index 9988ec984..464af67b6 100644
--- a/packages/create-agent-bundle/templates/mcp-server/package_json
+++ b/packages/create-agent-bundle/templates/mcp-server/package_json
@@ -37,9 +37,7 @@
     "@types/node": "26.4.0",
     "agent-bundle": "workspace:*",
     "typescript": "7.0.2",
-    "@types/react": "19.2.18"
-  },
-  "dependencies": {
+    "@types/react": "19.2.18",
     "@agent-bundle/runtime": "workspace:*",
     "react": "19.2.8",
     "zod": "4.4.3"
diff --git a/packages/create-agent-bundle/tests/scaffold.test.ts b/packages/create-agent-bundle/tests/scaffold.test.ts
index 211c178b7..2120e4693 100644
--- a/packages/create-agent-bundle/tests/scaffold.test.ts
+++ b/packages/create-agent-bundle/tests/scaffold.test.ts
@@ -253,14 +253,19 @@ layer(NodeServices.layer, { excludeTestServices: true })('scaffold (real filesys
 
   // Routed commands execute inside the typed Agent request context, so the
   // cli-tool template now pairs the runtime package like mcp-server does.
-  it.effect('pins the paired runtime for the routed cli-tool template', () => Effect.gen(function* () {
+  // Every dependency is bundled into the emitted outputs, so the templates
+  // declare the whole stack under devDependencies: a published plugin installs
+  // nothing (`agent-bundle prepack` reports a stray runtime dependency as AB7014).
+  it.effect('pins the paired runtime for the routed cli-tool template as a dev dependency', () => Effect.gen(function* () {
     const path = yield* Path.Path;
     const { frameworkSpec, root } = yield* scaffoldTemplate('cli-tool', { pluginName: 'greeter' });
     const manifest = yield* readJson<{
-      readonly dependencies: Record<string, string>;
+      readonly dependencies?: Record<string, string>;
+      readonly devDependencies: Record<string, string>;
     }>(path.join(root, 'package.json'));
-    expect(manifest.dependencies['@agent-bundle/runtime']).toBe(runtimeSpecForFramework(frameworkSpec));
-    expect(manifest.dependencies['zod']).toBeDefined();
+    expect(manifest.dependencies).toBeUndefined();
+    expect(manifest.devDependencies['@agent-bundle/runtime']).toBe(runtimeSpecForFramework(frameworkSpec));
+    expect(manifest.devDependencies['zod']).toBeDefined();
   }));
 
   it.effect('replaces every placeholder and pins the framework spec', () => Effect.gen(function* () {
@@ -283,7 +288,8 @@ layer(NodeServices.layer, { excludeTestServices: true })('scaffold (real filesys
     expect(manifest.name).toBe('@scope/status-plugin');
     expect(manifest.devDependencies['agent-bundle']).toBe(frameworkSpec);
     expect(files).toContain('src/cli/greet.ts');
-    expect(manifest.dependencies?.['@agent-bundle/runtime']).toBe(runtimeSpecForFramework(frameworkSpec));
+    expect(manifest.dependencies).toBeUndefined();
+    expect(manifest.devDependencies['@agent-bundle/runtime']).toBe(runtimeSpecForFramework(frameworkSpec));
     expect(manifest.bin).toEqual({
       'status-plugin': './dist/bin/status-plugin.js',
       'status-plugin-install': './dist/bin/status-plugin-install.js',
@@ -461,9 +467,9 @@ layer(NodeServices.layer, { excludeTestServices: true })('scaffold (real filesys
     });
     expect(files).toContain('package.json');
     const manifest = yield* readJson<{
-      readonly dependencies: Record<string, string>;
+      readonly devDependencies: Record<string, string>;
     }>(path.join(targetDirectory, 'package.json'));
-    expect(manifest.dependencies['@agent-bundle/runtime']).toBe('file:../agent-bundle-runtime-0.0.0.tgz');
+    expect(manifest.devDependencies['@agent-bundle/runtime']).toBe('file:../agent-bundle-runtime-0.0.0.tgz');
   }));
 });
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 187af6d86..c6efd6094 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -83,17 +83,10 @@ importers:
         version: 7.0.2
 
   examples/audiobook-curator:
-    dependencies:
+    devDependencies:
       '@agent-bundle/runtime':
         specifier: workspace:*
         version: link:../../packages/rsc-runtime
-      react:
-        specifier: 19.2.8
-        version: 19.2.8
-      zod:
-        specifier: 4.5.4
-        version: 4.5.4
-    devDependencies:
       '@rstest/core':
         specifier: 0.11.10
         version: 0.11.10
@@ -103,6 +96,12 @@ importers:
       agent-bundle:
         specifier: workspace:*
         version: link:../../packages/agent-bundle
+      react:
+        specifier: 19.2.8
+        version: 19.2.8
+      zod:
+        specifier: 4.5.4
+        version: 4.5.4
 
   examples/hooks-and-scripts:
     devDependencies:
@@ -111,20 +110,13 @@ importers:
         version: link:../../packages/agent-bundle
 
   examples/host-test:
-    dependencies:
+    devDependencies:
       '@agent-bundle/runtime':
         specifier: workspace:*
         version: link:../../packages/rsc-runtime
       '@modelcontextprotocol/server':
         specifier: 2.0.0
         version: 2.0.0
-      react:
-        specifier: 19.2.8
-        version: 19.2.8
-      zod:
-        specifier: 4.5.4
-        version: 4.5.4
-    devDependencies:
       '@rstest/core':
         specifier: 0.11.10
         version: 0.11.10
@@ -134,6 +126,12 @@ importers:
       agent-bundle:
         specifier: workspace:*
         version: link:../../packages/agent-bundle
+      react:
+        specifier: 19.2.8
+        version: 19.2.8
+      zod:
+        specifier: 4.5.4
+        version: 4.5.4
 
   examples/mcp-app:
     devDependencies:
@@ -224,17 +222,10 @@ importers:
         version: link:../../packages/agent-bundle
 
   examples/worktree-proximity:
-    dependencies:
+    devDependencies:
       '@agent-bundle/runtime':
         specifier: workspace:*
         version: link:../../packages/rsc-runtime
-      react:
-        specifier: 19.2.8
-        version: 19.2.8
-      zod:
-        specifier: 4.5.4
-        version: 4.5.4
-    devDependencies:
       '@rstest/core':
         specifier: 0.11.10
         version: 0.11.10
@@ -244,6 +235,12 @@ importers:
       agent-bundle:
         specifier: workspace:*
         version: link:../../packages/agent-bundle
+      react:
+        specifier: 19.2.8
+        version: 19.2.8
+      zod:
+        specifier: 4.5.4
+        version: 4.5.4
 
   packages/agent-bundle:
     dependencies:
@@ -310,6 +307,9 @@ importers:
       jiti:
         specifier: 2.7.0
         version: 2.7.0
+      npm-package-arg:
+        specifier: 13.0.2
+        version: 13.0.2
       open:
         specifier: 11.0.2
         version: 11.0.2
@@ -320,6 +320,9 @@ importers:
         specifier: 2.9.0
         version: 2.9.0
     devDependencies:
+      '@types/npm-package-arg':
+        specifier: 6.1.4
+        version: 6.1.4
       '@types/react':
         specifier: 19.2.18
         version: 19.2.18
@@ -1520,6 +1523,9 @@ packages:
   '@types/node@26.4.0':
     resolution: {integrity: sha512-faiGnoIrLH/V8cibOMEAZ8pMw6oXqSukl29ra4mN8GdaB2ZewzeaLj+INpV5N+Z1eKWzY+IzaIZH2EIR6YZRNQ==}
 
+  '@types/npm-package-arg@6.1.4':
+    resolution: {integrity: sha512-vDgdbMy2QXHnAruzlv68pUtXCjmqUk3WrBAsRboRovsOmxbfn/WiYCjmecyKjGztnMps5dWp4Uq2prp+Ilo17Q==}
+
   '@types/qs@6.15.1':
     resolution: {integrity: sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw==}
 
@@ -2233,6 +2239,10 @@ packages:
   hookable@6.1.1:
     resolution: {integrity: sha512-U9LYDy1CwhMCnprUfeAZWZGByVbhd54hwepegYTK7Pi5NvqEj63ifz5z+xukznehT7i6NIZRu89Ay1AZmRsLEQ==}
 
+  hosted-git-info@9.0.3:
+    resolution: {integrity: sha512-Hc+ghLoSt6QaYZUv0WBiIvmMDZuZZ7oaDvdH8MbfOO4lOsxdXLEvuC6ePoGs9H1X9oCLyq6+NVN0MKqD+ydxyg==}
+    engines: {node: ^20.17.0 || >=22.9.0}
+
   html-url-attributes@3.0.1:
     resolution: {integrity: sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==}
 
@@ -2684,6 +2694,10 @@ packages:
     resolution: {integrity: sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw==}
     hasBin: true
 
+  npm-package-arg@13.0.2:
+    resolution: {integrity: sha512-IciCE3SY3uE84Ld8WZU23gAPPV9rIYod4F+rc+vJ7h7cwAJt9Vk6TVsK60ry7Uj3SRS3bqRRIGuTp9YVlk6WNA==}
+    engines: {node: ^20.17.0 || >=22.9.0}
+
   npm-run-path@6.0.0:
     resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
     engines: {node: '>=18'}
@@ -2801,6 +2815,10 @@ packages:
     resolution: {integrity: sha512-gjVS5hOP+M3wMm5nmNOucbIrqudzs9v/57bWRHQWLYklXqoXKrVfYW2W9+glfGsqtPgpiz5WwyEEB+ksXIx3gQ==}
     engines: {node: '>=18'}
 
+  proc-log@6.1.0:
+    resolution: {integrity: sha512-iG+GYldRf2BQ0UDUAd6JQ/RwzaQy6mXmsk/IzlYyal4A4SNFw54MeH4/tLkF4I5WoWG9SQwuqWzS99jaFQHBuQ==}
+    engines: {node: ^20.17.0 || >=22.9.0}
+
   property-information@7.2.0:
     resolution: {integrity: sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==}
 
@@ -3289,6 +3307,10 @@ packages:
     resolution: {integrity: sha512-OljLrQ9SQdOUqTaQxqL5dEfZWrXExyyWsozYlAWFawPVNuD83igl7uJD2RTkNMbniIYgt8l81eCJGIdQF7avLQ==}
     engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
 
+  validate-npm-package-name@7.0.2:
+    resolution: {integrity: sha512-hVDIBwsRruT73PbK7uP5ebUt+ezEtCmzZz3F59BSr2F6OVFnJ/6h8liuvdLrQ88Xmnk6/+xGGuq+pG9WwTuy3A==}
+    engines: {node: ^20.17.0 || >=22.9.0}
+
   vary@1.1.2:
     resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
     engines: {node: '>= 0.8'}
@@ -4436,6 +4458,8 @@ snapshots:
     dependencies:
       undici-types: 8.3.0
 
+  '@types/npm-package-arg@6.1.4': {}
+
   '@types/qs@6.15.1': {}
 
   '@types/range-parser@1.2.7': {}
@@ -5156,6 +5180,10 @@ snapshots:
 
   hookable@6.1.1: {}
 
+  hosted-git-info@9.0.3:
+    dependencies:
+      lru-cache: 11.5.2
+
   html-url-attributes@3.0.1: {}
 
   html-void-elements@3.0.0: {}
@@ -5846,6 +5874,13 @@ snapshots:
       detect-libc: 2.1.2
     optional: true
 
+  npm-package-arg@13.0.2:
+    dependencies:
+      hosted-git-info: 9.0.3
+      proc-log: 6.1.0
+      semver: 7.8.5
+      validate-npm-package-name: 7.0.2
+
   npm-run-path@6.0.0:
     dependencies:
       path-key: 4.0.0
@@ -5951,6 +5986,8 @@ snapshots:
     dependencies:
       parse-ms: 4.0.0
 
+  proc-log@6.1.0: {}
+
   property-information@7.2.0: {}
 
   proxy-addr@2.0.7:
@@ -6521,6 +6558,8 @@ snapshots:
 
   validate-npm-package-name@5.0.1: {}
 
+  validate-npm-package-name@7.0.2: {}
+
   vary@1.1.2: {}
 
   vfile-location@5.0.3:
diff --git a/website/docs/en/guide/distribution/installation.mdx b/website/docs/en/guide/distribution/installation.mdx
index 20527ec87..0bc12e8a5 100644
--- a/website/docs/en/guide/distribution/installation.mdx
+++ b/website/docs/en/guide/distribution/installation.mdx
@@ -5,7 +5,11 @@ description: 'Install a built agent-bundle into Claude Code, Codex, or Cursor: t
 # Host installation
 
 Every built target directory contains a generated `INSTALL.md` with commands that use the
-bundle's real plugin and marketplace names. The framework CLI performs those same operations:
+bundle's real plugin and marketplace names. Every command in it is a host command (`claude plugin
+…`, `codex plugin …`) or the bundled `install.mjs`, so a consumer who receives the built pack —
+from npm, a marketplace checkout, or a zip — never needs the `agent-bundle` CLI to install,
+reinstall, or uninstall it; `INSTALL.md` says so and marks the CLI optional wherever it is
+mentioned. The framework CLI performs those same operations for developers who have it:
 
 ```sh
 npx agent-bundle install claude --from artifact/claude --scope user
diff --git a/website/docs/en/guide/distribution/validation.mdx b/website/docs/en/guide/distribution/validation.mdx
index ecb5573ea..e7e71f095 100644
--- a/website/docs/en/guide/distribution/validation.mdx
+++ b/website/docs/en/guide/distribution/validation.mdx
@@ -177,8 +177,12 @@ npx agent-bundle prepack --root . --output artifact --json
 ```
 
 `prepack` runs the release build and `npm pack --dry-run --json --ignore-scripts`, then gates the
-exact package and artifact inventory, manifest hashes, package bin targets, and release-version
-agreement. `--output` is an artifact path relative to `--root` that overrides the configured
+exact package and artifact inventory, manifest hashes, package bin targets, release-version
+agreement, and the installed-dependency fields of `package.json`. The build inlines every
+dependency into `dist/bin` and the host packs, so a published plugin should install nothing:
+declare the framework, `@agent-bundle/runtime`, `react`, `zod`, and the rest of the stack under
+`devDependencies`. The exception is a package a packed module still imports — one kept external
+through the `tools` escape hatch — which belongs under `dependencies`, and `AB7014` permits it there. `--output` is an artifact path relative to `--root` that overrides the configured
 `output.distPath`, defaulting to `artifact`. Use it as an npm `prepack` script; `--ignore-scripts`
 prevents recursion, and no npm lifecycle ever performs a host install.
 
@@ -188,6 +192,32 @@ prevents recursion, and no npm lifecycle ever performs a host install.
 | `AB7011` | An on-disk artifact file no longer matches its manifest SHA-256. Rebuild, and do not modify generated host packs. |
 | `AB7012` | A `package.json` bin points outside the packed `dist` output (including `src/`) or names a file npm omitted. Point it at the generated `dist/bin` file. |
 | `AB7013` | `package.json`, normalized plugin metadata, a host manifest, or artifact provenance reports a different release version. Make every release identity agree. |
+| `AB7014` | A `dependencies`, `optionalDependencies`, or `peerDependencies` field names packages nothing in the pack uses — no packed JavaScript imports, requires, or resolves them, no packed declaration references them, no `imports` mapping or consumer install script reaches them (one diagnostic per field; optional peers are skipped here but their specifier is still checked by `AB7015`, and an `optionalDependencies` entry supersedes the same name under `dependencies`). Every consumer would install them for nothing. Move build-only packages to `devDependencies`. For `peerDependencies` this is a warning, since a required peer nothing imports may be a deliberate host-compatibility contract; mark it optional in `peerDependenciesMeta` if npm should stop installing it. |
+| `AB7015` | A `dependencies`, `optionalDependencies`, or `peerDependencies` entry a consumer's npm cannot resolve through a registry. Name and specifier are read with `npm-package-arg`, npm's own parser, and come out as one of three kinds: registry (a version, range, dist-tag, or `npm:` alias of one), fetched (a git, GitHub-shorthand, remote-tarball, or path source — npm 12 refuses git and remote fetches by default (`allow-git`, `allow-remote`), and a path never exists on the consumer's disk), or unparseable (a name npm rejects, a scheme it lacks such as `link:`, `portal:`, or a typo, a selector that is neither a range nor a URL-safe dist-tag, an alias of a non-registry target, or an invalid URL — the manifest read itself fails, so this is reported even on an optional peer). A fetched `optionalDependencies` entry warns instead of failing, since npm continues without it; it stays an error when unparseable, or when a consumer install script needs the skipped package (runs its command — not merely mentions it — loads it from an inline `node -e` program — scanned for `require`, `createRequire`, and `import()` like a packed file — preloads it with `node -r`/`--require`/`--import`/`--loader`, or runs a packed file that imports it, `node .` running the root `main` included; each command after `&&`, `;`, or a newline is read on its own, shell quotes and backslash escapes resolved, and `node`'s options belong to `node` alone and end at the program — `node install.js --require x` preloads nothing, while a `NODE_OPTIONS=--require=x` assignment on the same `node` command does; every script word naming a packed JavaScript file counts as run, deliberately, so that runners the gate does not model — `tsx`, `zx`, `bun`, `deno run` — still have their file's dependencies traced, at the cost of a rare escalation for a word such as `echo install.js`, which the diagnostic makes visible by naming the file). A peer that `dependencies` or `optionalDependencies` also names is judged by that concrete entry; npm never reads the duplicate peer's selector. `workspace:`/`catalog:` are reported too unless the `prepack` lifecycle runs under pnpm, Yarn, or Bun, which rewrite them at pack time — `npm publish` does not, so under npm `AB7015` fires; entries the tarball itself carries — `bundleDependencies` npm actually packed (never peers), and a `file:` path inside the package whose packed source is installable (a directory with a parseable `package.json`, or a well-formed tarball whose `package.json` parses) — are not reported. Depend on a published version, or bundle the package and declare it under `devDependencies`. |
+
+The dependency evidence is read from the packed bytes: every `.js`/`.mjs`/`.cjs` file npm would
+publish is lexed for `import` specifiers and scanned for literal `require("…")`, `require.resolve("…")`, and
+`import.meta.resolve("…")` calls (a `createRequire(…)` binding counts as `require`, even with the factory
+renamed on import, as do direct `Module.createRequire(…)("…")` and `require("node:module").createRequire(…)("…")` calls; `path.resolve("…")` does not count), and every
+packed `.d.ts` is scanned for the modules its types reference (a `/// <reference types>` directive
+counts for the package and its `@types/*` twin); specifiers are reduced to package names, string escapes
+decoded first, with Node built-ins ignored. A dependency packed code runs as an executable — a string literal
+that is one of the `bin` commands its installed manifest declares, such as `spawnSync("tsc", ["--version"])` —
+counts as used, as does one a
+`#subpath` import may reach through the `imports` map, and a
+dependency a consumer-side `preinstall`/`install`/`postinstall` script — not `prepare`, which npm never runs
+for a published tarball — or any script it delegates to with `npm run` (the first positional after `run`; options
+before or after `run`, valued or not, are skipped, and later words such as `npm run setup -- dormant` are that
+script's arguments) or a direct `npm test`/`start`/`stop`/`restart` names (`npm restart` without a `restart` script running `stop` then `start`) (or whose `bin` command it runs; a
+string-form `bin` is named after the installed manifest, read as npm reads it — the last of duplicate keys
+wins — and the unscoped name stands in when the dependency is not installed locally or its manifest is not
+JSON). A
+computed `import(expression)` or `require(expression)` (likewise `require.resolve`, `import.meta.resolve`,
+a direct `createRequire(…)(…)`, or a `createRequire` binding) in packed code could load any declared
+package, so it withholds `AB7014` altogether; so does packed source the ESM lexer rejects, whose `import()`
+calls it cannot report, and so does `require` passed on as a value (`const load = require`,
+`fn(require)`) rather than called, since packages may then be loaded under a name the scan never sees. A mention inside a comment can only keep a dependency, never
+report one; `devDependencies` are never inspected, and an `npm:` alias counts as a registry specifier when its target does.
 
 A release build also refuses a project with **no** release version at all (`AB4013`), so a
 published artifact never carries the `0.0.0-dev.<short-revision>` development fallback. A
diff --git a/website/docs/en/reference/index.mdx b/website/docs/en/reference/index.mdx
index 114b1a0ca..588d38ba9 100644
--- a/website/docs/en/reference/index.mdx
+++ b/website/docs/en/reference/index.mdx
@@ -46,7 +46,7 @@ from the repository's
 | `AB48xx`–`AB49xx` | Route graph, state, layout, and provider conventions: route module discovery, `config` extraction, shared layouts (`AB4830`–`AB4832`), and the compiled command surface. |
 | `AB5000` | General CLI and adapter failures. |
 | `AB60xx` | Built-artifact validation, including host schema documents and referenced files. |
-| `AB700x`–`AB7013` | Host installation and the npm prepack gate. |
+| `AB700x`–`AB7015` | Host installation and the npm prepack gate (`AB7014`/`AB7015`: installed-dependency hygiene). |
 | `AB7xxx` | Project preparation and development rebuilds, plus the read-only Doctor at `AB7300`–`AB7320`. |
 | `AB8xxx` | Development server configuration and Workbench routes. |
 | `AB9xxx` | Eval selection, harnesses, and persisted runs. |
diff --git a/website/docs/en/reference/targets-artifacts.mdx b/website/docs/en/reference/targets-artifacts.mdx
index 58270598b..467ee1ca9 100644
--- a/website/docs/en/reference/targets-artifacts.mdx
+++ b/website/docs/en/reference/targets-artifacts.mdx
@@ -61,7 +61,12 @@ Four version axes are tracked separately and are expected to agree:
 - **Running process** — the version a live MCP `initialize` reports.
 
 The `host-install` proof level records all four and fails closed when any is missing or differs.
-`prepack` gates the first two plus normalized plugin metadata and host manifests (`AB7013`).
+`prepack` gates the first two plus normalized plugin metadata and host manifests (`AB7013`), and
+refuses a `package.json` whose installed-dependency fields name packages nothing in the pack uses — no
+packed JavaScript imports, requires, or resolves them, no packed declaration references them, no
+`imports` mapping or consumer install script reaches them (`AB7014`) — or that a consumer's npm cannot
+fetch from a registry (`AB7015`): a published plugin installs only what its packed files need. The
+[validation guide](../guide/distribution/validation.mdx) lists every source of evidence.
 
 Target rows also record an `adapterRevision` (monotonic, repository-owned) and an
 `observedVersion` (the host version the capability evidence was recorded against). Neither is
diff --git a/website/docs/zh/guide/distribution/installation.mdx b/website/docs/zh/guide/distribution/installation.mdx
index c3d695dfd..39ad59119 100644
--- a/website/docs/zh/guide/distribution/installation.mdx
+++ b/website/docs/zh/guide/distribution/installation.mdx
@@ -4,8 +4,10 @@ description: '把已构建的 agent-bundle 安装进 Claude Code、Codex 或 Cur
 
 # 宿主安装
 
-每个已构建 target 目录都包含一份生成的 `INSTALL.md`，其中的命令使用捆绑包真实的插件名与市场名。框架
-CLI 执行的正是同样的操作：
+每个已构建 target 目录都包含一份生成的 `INSTALL.md`，其中的命令使用捆绑包真实的插件名与市场名。其中每条
+命令都是宿主命令（`claude plugin …`、`codex plugin …`）或随行的 `install.mjs`，因此无论从 npm、市场检出
+还是 zip 拿到已构建包的消费者，安装、重装或卸载它都不需要 `agent-bundle` CLI；`INSTALL.md` 明言这一点，
+并在每处提及该 CLI 时标注其为可选。框架 CLI 为拥有它的开发者执行同样的操作：
 
 ```sh
 npx agent-bundle install claude --from artifact/claude --scope user
diff --git a/website/docs/zh/guide/distribution/validation.mdx b/website/docs/zh/guide/distribution/validation.mdx
index 0c7a588ae..1294b31b1 100644
--- a/website/docs/zh/guide/distribution/validation.mdx
+++ b/website/docs/zh/guide/distribution/validation.mdx
@@ -158,7 +158,10 @@ npx agent-bundle prepack --root . --output artifact --json
 ```
 
 `prepack` 运行发布构建与 `npm pack --dry-run --json --ignore-scripts`，随后对精确的包与产物清单、清单
-哈希、包 bin 目标以及发布版本一致性把关。`--output` 是相对 `--root` 的产物路径，会覆盖配置中的
+哈希、包 bin 目标、发布版本一致性以及 `package.json` 中的安装期依赖字段把关。构建会把每个依赖内联进
+`dist/bin` 与各宿主包，因此已发布的插件不应安装任何东西：请把框架、`@agent-bundle/runtime`、`react`、
+`zod` 以及其余技术栈都声明在 `devDependencies` 下。例外是打包后的模块仍然导入的包——通过 `tools` 逃生舱保持
+外部化的包——它应声明在 `dependencies` 下，`AB7014` 会允许它。`--output` 是相对 `--root` 的产物路径，会覆盖配置中的
 `output.distPath`，默认值为 `artifact`。把它用作 npm 的 `prepack` 脚本；`--ignore-scripts` 可防止递归，
 而且任何 npm 生命周期都绝不会执行宿主安装。
 
@@ -168,6 +171,14 @@ npx agent-bundle prepack --root . --output artifact --json
 | `AB7011` | 磁盘上的某个产物文件与其清单 SHA-256 不再匹配。请重新构建，且不要修改生成的宿主包。 |
 | `AB7012` | 某个 `package.json` bin 指向了打包后的 `dist` 输出之外（包括 `src/`），或指名了一个被 npm 忽略的文件。请把它指向生成的 `dist/bin` 文件。 |
 | `AB7013` | `package.json`、规范化后的插件元数据、某份宿主清单或产物 provenance 报告了不同的发布版本。请让每处发布标识一致。 |
+| `AB7014` | `dependencies`、`optionalDependencies` 或 `peerDependencies` 字段里列出的包在整个包里无人使用——没有打包后的 JavaScript 导入、require 或解析它，没有打包后的声明文件引用它，也没有 `imports` 映射或消费者侧安装脚本触及它（每个字段一条诊断；可选 peer 在此被跳过，但其说明符仍由 `AB7015` 检查，`optionalDependencies` 中的同名项优先于 `dependencies`）。每位消费者都会白白安装它们。请把仅构建期需要的包移到 `devDependencies`。对 `peerDependencies` 而言这是警告：无人导入的必需 peer 可能是有意的宿主兼容性约束；若希望 npm 不再安装它，请在 `peerDependenciesMeta` 中标记为可选。 |
+| `AB7015` | `dependencies`、`optionalDependencies` 或 `peerDependencies` 中的某一项无法被消费者的 npm 经由注册表解析。包名与说明符一并交给 npm 自己的解析器 `npm-package-arg` 读取，结果分为三类：注册表类（版本、范围、dist-tag，或指向它们的 `npm:` 别名）、抓取类（git、GitHub 简写、远程 tarball 或路径来源——npm 12 默认拒绝 git 与远程抓取（`allow-git`、`allow-remote`），而路径在消费者磁盘上并不存在），以及不可解析类（npm 不接受的包名、它不支持的协议如 `link:`、`portal:` 或拼写错误、既非范围也非 URL 安全 dist-tag 的选择器、指向非注册表目标的别名，或非法 URL——清单本身就读不下去，因此即使出现在可选 peer 上也会被报告）。`optionalDependencies` 中的抓取类项只发出警告而不会失败，因为 npm 会继续安装；不可解析的项，或消费者安装脚本需要的项（运行其命令——而非仅仅提及它——在内联的 `node -e` 程序中加载它——该程序像已打包文件一样被扫描 `require`、`createRequire` 与 `import()`——用 `node -r`/`--require`/`--import`/`--loader` 预加载它，或运行某个导入它的已打包文件，包括通过根 `main` 运行的 `node .`；`&&`、`;` 或换行之后的每条命令单独判读，shell 引号与反斜杠转义均已解析，`node` 的选项只属于 `node` 且到程序为止——`node install.js --require x` 不会预加载任何东西，而同一条 `node` 命令上的 `NODE_OPTIONS=--require=x` 赋值会；脚本中每个点名已打包 JavaScript 文件的词都视为被运行，这是有意为之，使本闸门未建模的运行器——`tsx`、`zx`、`bun`、`deno run`——所运行文件的依赖仍被追踪，代价是像 `echo install.js` 这样的词偶有误升级，诊断会点名该文件使之可见），仍是错误。若 `dependencies` 或 `optionalDependencies` 也声明了同名 peer，则只按该具体条目判断；npm 从不读取重复 peer 的选择器。`workspace:`/`catalog:` 同样会被报告，除非 `prepack` 生命周期运行在 pnpm、Yarn 或 Bun 之下——它们会在打包时重写这些协议；`npm publish` 不会重写，因此在 npm 下 `AB7015` 会触发；tarball 自身携带的项——`bundleDependencies` 中 npm 实际打包进去的项（peer 除外），以及已打包来源可供安装的包内 `file:` 路径（带有可解析 `package.json` 的目录，或格式正确且其 `package.json` 可解析的 tarball）——不会被报告。请依赖已发布的版本，或把该包打包进产物并声明在 `devDependencies` 下。 |
+
+依赖证据直接读取自打包后的字节：npm 将发布的每个 `.js`/`.mjs`/`.cjs` 文件都会被词法分析出 `import`
+说明符，并扫描字面量 `require("…")`、`require.resolve("…")` 与 `import.meta.resolve("…")` 调用（`createRequire(…)` 的绑定视同 `require`，即使导入时重命名了该工厂，直接调用的 `Module.createRequire(…)("…")` 与 `require("node:module").createRequire(…)("…")` 亦然；`path.resolve("…")` 不计入）；每个打包后的 `.d.ts` 会被扫描其类型所引用的模块（`/// <reference types>` 指令同时计入该包及其
+`@types/*` 对应包）。说明符先解码字符串转义再归约为包名，忽略 Node 内建模块。打包代码作为可执行文件运行的依赖——字符串字面量正是其已安装清单所声明的某个 `bin` 命令，如 `spawnSync("tsc", ["--version"])`——视为已使用；`#子路径` 导入计入 `imports` 映射所指向的每个包；消费者侧 `preinstall`/`install`/`postinstall` 脚本（不含 `prepare`——npm 从不为已发布的 tarball 运行它）或其通过 `npm run`（取 `run` 之后的第一个位置参数；`run` 前后的选项，带值与否均被跳过，其后的词如 `npm run setup -- dormant` 中的 `dormant` 是该脚本的参数）或直接的 `npm test`/`start`/`stop`/`restart`（没有 `restart` 脚本时，`npm restart` 依次运行 `stop` 与 `start`）委托的任何脚本点名（或运行其 `bin` 命令；字符串形式的 `bin` 以已安装清单的名字命名——清单按 npm 的方式读取，重复键以最后一个为准——依赖未在本地安装或其清单不是 JSON 时以去掉作用域的包名代替）的依赖
+同样视为已使用。打包代码中的计算型 `import(表达式)` 或 `require(表达式)`（同样包括 `require.resolve`、`import.meta.resolve`、直接的 `createRequire(…)(…)` 或 `createRequire` 绑定）可能加载任何已声明的包，因此会整体撤回 `AB7014`；被 ESM 词法分析器拒绝的打包源码亦然，因为其中的 `import()` 调用无法被报告；把 `require` 当作值传递而非调用（`const load = require`、`fn(require)`）亦然，因为此后包可能以扫描看不到的名字被加载。注释中的提及只会保留某个依赖，绝不会报告它；`devDependencies` 永不检查，
+`npm:` 别名在其目标是注册表说明符时才视为注册表说明符。
 
 发布构建同样会拒绝**完全没有**发布版本的项目（`AB4013`），因此已发布的产物绝不会携带
 `0.0.0-dev.<short-revision>` 这个开发期回退值。声明的 `plugin.version` 与 `package.json` 不一致时会
diff --git a/website/docs/zh/reference/index.mdx b/website/docs/zh/reference/index.mdx
index 7f5628491..51472f5fe 100644
--- a/website/docs/zh/reference/index.mdx
+++ b/website/docs/zh/reference/index.mdx
@@ -43,7 +43,7 @@ description: 'agent-bundle 参考资料：命令行表面、配置字段、targe
 | `AB48xx`–`AB49xx` | 路由图、state、布局与 provider 约定：路由模块发现、`config` 提取、共享布局（`AB4830`–`AB4832`），以及编译后的命令表面。 |
 | `AB5000` | 通用的命令行与适配器失败。 |
 | `AB60xx` | 已构建产物校验，包括宿主 schema 文档与被引用的文件。 |
-| `AB700x`–`AB7013` | 宿主安装与 npm prepack 门禁。 |
+| `AB700x`–`AB7015` | 宿主安装与 npm prepack 门禁（`AB7014`/`AB7015`：安装期依赖卫生）。 |
 | `AB7xxx` | 项目准备与开发期重建，其中 `AB7300`–`AB7320` 为只读 Doctor。 |
 | `AB8xxx` | 开发服务器配置与 Workbench 路由。 |
 | `AB9xxx` | eval 选择、harness 与持久化运行记录。 |
diff --git a/website/docs/zh/reference/targets-artifacts.mdx b/website/docs/zh/reference/targets-artifacts.mdx
index 520970b5c..ff086ff47 100644
--- a/website/docs/zh/reference/targets-artifacts.mdx
+++ b/website/docs/zh/reference/targets-artifacts.mdx
@@ -56,7 +56,9 @@ target 表格——各 target 输出哪种布局，以及 portable 标准为何
 - **运行中的进程** —— 活跃的 MCP `initialize` 所报告的版本。
 
 `host-install` 证明级别会记录全部四者，并在任何一项缺失或不一致时以失败告终。`prepack` 则为前两者，外加
-规范化后的插件元数据与宿主清单把关（`AB7013`）。
+规范化后的插件元数据与宿主清单把关（`AB7013`），并拒绝这样的 `package.json`：安装期依赖字段中列出的包在整个包里无人使用——没有打包后的 JavaScript 导入、require 或解析它，
+没有打包后的声明文件引用它，也没有 `imports` 映射或消费者侧安装脚本触及它（`AB7014`）——或消费者的 npm 无法从注册表抓取它（`AB7015`）：
+已发布的插件只安装其打包文件所需的内容。[验证指南](../guide/distribution/validation.mdx)列出了每一种证据来源。
 
 target 行还记录 `adapterRevision`（单调递增，仓库自有）与 `observedVersion`（记录该能力证据时所观察到的
 宿主版本）。两者都不做哈希：Git 已经为仓库自有内容做了版本管理，在仓库内部再哈希一遍会让每次编辑表格