diff --git a/package.json b/package.json
index 2c609d25..c2183531 100644
--- a/package.json
+++ b/package.json
@@ -764,15 +764,16 @@
     "npm-package-arg": "13.0.0",
     "oxfmt": "^0.37.0",
     "oxlint": "1.53.0",
+    "p-map": "7.0.4",
     "pacote": "21.0.1",
-    "picomatch": "2.3.1",
+    "picomatch": "4.0.4",
     "pony-cause": "2.1.11",
     "semver": "7.7.2",
     "signal-exit": "4.1.0",
     "spdx-correct": "3.2.0",
     "spdx-expression-parse": "4.0.0",
     "streaming-iterables": "8.0.1",
-    "supports-color": "10.0.0",
+    "supports-color": "10.2.2",
     "tar-fs": "3.1.2",
     "tar-stream": "3.1.8",
     "taze": "19.9.2",
@@ -821,7 +822,8 @@
       "minizlib": "3.1.0",
       "npm-package-arg": "12.0.2",
       "npm-pick-manifest": "10.0.0",
-      "picomatch": "4.0.3",
+      "p-map": "7.0.4",
+      "picomatch": "4.0.4",
       "proc-log": "6.1.0",
       "semver": "7.7.2",
       "signal-exit": "4.1.0",
@@ -829,7 +831,7 @@
       "ssri": "12.0.0",
       "string-width": "8.1.0",
       "strip-ansi": "7.1.2",
-      "supports-color": "10.0.0",
+      "supports-color": "10.2.2",
       "tar": "7.5.11",
       "which": "5.0.0",
       "wrap-ansi": "9.0.2",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 321a9dfb..23395712 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -23,13 +23,14 @@ overrides:
   lru-cache: 11.2.2
   minimatch: 9.0.5
   minipass: 7.1.3
-  minipass@7: 7.1.3
   minipass-fetch: 4.0.1
   minipass-sized: 1.0.3
+  minipass@7: 7.1.3
   minizlib: 3.1.0
   npm-package-arg: 12.0.2
   npm-pick-manifest: 10.0.0
-  picomatch: 4.0.3
+  p-map: 7.0.4
+  picomatch: 4.0.4
   proc-log: 6.1.0
   semver: 7.7.2
   signal-exit: 4.1.0
@@ -37,7 +38,7 @@ overrides:
   ssri: 12.0.0
   string-width: 8.1.0
   strip-ansi: 7.1.2
-  supports-color: 10.0.0
+  supports-color: 10.2.2
   tar: 7.5.11
   which: 5.0.0
   wrap-ansi: 9.0.2
@@ -72,13 +73,13 @@ importers:
     devDependencies:
       '@babel/core':
         specifier: 7.28.4
-        version: 7.28.4(supports-color@10.0.0)
+        version: 7.28.4(supports-color@10.2.2)
       '@babel/parser':
         specifier: 7.28.4
         version: 7.28.4
       '@babel/traverse':
         specifier: 7.28.4
-        version: 7.28.4(supports-color@10.0.0)
+        version: 7.28.4(supports-color@10.2.2)
       '@babel/types':
         specifier: 7.28.4
         version: 7.28.4
@@ -105,7 +106,7 @@ importers:
         version: 4.3.2(@types/node@24.9.2)
       '@npmcli/arborist':
         specifier: 9.1.6
-        version: 9.1.6(supports-color@10.0.0)
+        version: 9.1.6(supports-color@10.2.2)
       '@npmcli/package-json':
         specifier: 7.0.0
         version: 7.0.0
@@ -132,7 +133,7 @@ importers:
         version: 7.0.0-dev.20250920.1
       '@vitest/coverage-v8':
         specifier: 4.0.3
-        version: 4.0.3(supports-color@10.0.0)(vitest@4.0.3)
+        version: 4.0.3(supports-color@10.2.2)(vitest@4.0.3)
       '@vitest/ui':
         specifier: 4.0.3
         version: 4.0.3(vitest@4.0.3)
@@ -150,7 +151,7 @@ importers:
         version: 20.0.1
       debug:
         specifier: 4.4.3
-        version: 4.4.3(supports-color@10.0.0)
+        version: 4.4.3(supports-color@10.2.2)
       del:
         specifier: 8.0.1
         version: 8.0.1
@@ -162,7 +163,7 @@ importers:
         version: 0.25.11
       eslint-plugin-sort-destructure-keys:
         specifier: 2.0.0
-        version: 2.0.0(eslint@9.35.0(jiti@2.6.1)(supports-color@10.0.0))
+        version: 2.0.0(eslint@9.35.0(jiti@2.6.1)(supports-color@10.2.2))
       fast-glob:
         specifier: 3.3.3
         version: 3.3.3
@@ -183,19 +184,19 @@ importers:
         version: 9.1.7
       libnpmexec:
         specifier: 10.2.3
-        version: 10.2.3(supports-color@10.0.0)
+        version: 10.2.3(supports-color@10.2.2)
       libnpmpack:
         specifier: 9.0.9
-        version: 9.0.9(supports-color@10.0.0)
+        version: 9.0.9(supports-color@10.2.2)
       lint-staged:
         specifier: 15.2.11
-        version: 15.2.11(supports-color@10.0.0)
+        version: 15.2.11(supports-color@10.2.2)
       magic-string:
         specifier: 0.30.17
         version: 0.30.17
       make-fetch-happen:
         specifier: 15.0.2
-        version: 15.0.2(supports-color@10.0.0)
+        version: 15.0.2(supports-color@10.2.2)
       nock:
         specifier: 14.0.10
         version: 14.0.10
@@ -211,12 +212,15 @@ importers:
       oxlint:
         specifier: 1.53.0
         version: 1.53.0
+      p-map:
+        specifier: 7.0.4
+        version: 7.0.4
       pacote:
         specifier: 21.0.1
-        version: 21.0.1(supports-color@10.0.0)
+        version: 21.0.1(supports-color@10.2.2)
       picomatch:
-        specifier: 4.0.3
-        version: 4.0.3
+        specifier: 4.0.4
+        version: 4.0.4
       pony-cause:
         specifier: 2.1.11
         version: 2.1.11
@@ -236,8 +240,8 @@ importers:
         specifier: 8.0.1
         version: 8.0.1
       supports-color:
-        specifier: 10.0.0
-        version: 10.0.0
+        specifier: 10.2.2
+        version: 10.2.2
       tar-fs:
         specifier: 3.1.2
         version: 3.1.2
@@ -261,10 +265,10 @@ importers:
         version: 6.0.2
       vite-tsconfig-paths:
         specifier: 5.1.4
-        version: 5.1.4(supports-color@10.0.0)(typescript@5.9.2)(vite@7.3.1(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.2))
+        version: 5.1.4(supports-color@10.2.2)(typescript@5.9.2)(vite@7.3.1(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.2))
       vitest:
         specifier: 4.0.3
-        version: 4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(supports-color@10.0.0)(yaml@2.8.2)
+        version: 4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(supports-color@10.2.2)(yaml@2.8.2)
       which:
         specifier: 5.0.0
         version: 5.0.0
@@ -2040,7 +2044,7 @@ packages:
     resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
     engines: {node: '>=12.0.0'}
     peerDependencies:
-      picomatch: 4.0.3
+      picomatch: 4.0.4
     peerDependenciesMeta:
       picomatch:
         optional: true
@@ -2068,9 +2072,6 @@ packages:
     resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
     engines: {node: '>=16'}
 
-  flatted@3.4.1:
-    resolution: {integrity: sha512-IxfVbRFVlV8V/yRaGzk0UVIcsKKHMSfYw66T/u4nTwlWteQePsxe//LjudR1AMX4tZW3WFCh3Zqa/sjlqpbURQ==}
-
   flatted@3.4.2:
     resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
 
@@ -2722,8 +2723,8 @@ packages:
   picocolors@1.1.1:
     resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
 
-  picomatch@4.0.3:
-    resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
+  picomatch@4.0.4:
+    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
     engines: {node: '>=12'}
 
   pidtree@0.6.0:
@@ -2972,8 +2973,8 @@ packages:
     resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
     engines: {node: '>=8'}
 
-  supports-color@10.0.0:
-    resolution: {integrity: sha512-HRVVSbCCMbj7/kdWF9Q+bbckjBHLtHMEoJWlkmYzzdwhYMkjkOwubLM6t7NbWKjgKamGDrWL1++KrjUO1t9oAQ==}
+  supports-color@10.2.2:
+    resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==}
     engines: {node: '>=18'}
 
   tar-fs@3.1.2:
@@ -3313,20 +3314,20 @@ snapshots:
 
   '@babel/compat-data@7.29.0': {}
 
-  '@babel/core@7.28.4(supports-color@10.0.0)':
+  '@babel/core@7.28.4(supports-color@10.2.2)':
     dependencies:
       '@babel/code-frame': 7.29.0
       '@babel/generator': 7.29.1
       '@babel/helper-compilation-targets': 7.28.6
-      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.28.4(supports-color@10.0.0))(supports-color@10.0.0)
+      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.28.4(supports-color@10.2.2))(supports-color@10.2.2)
       '@babel/helpers': 7.28.6
       '@babel/parser': 7.28.4
       '@babel/template': 7.28.6
-      '@babel/traverse': 7.28.4(supports-color@10.0.0)
+      '@babel/traverse': 7.28.4(supports-color@10.2.2)
       '@babel/types': 7.28.4
       '@jridgewell/remapping': 2.3.5
       convert-source-map: 2.0.0
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
       gensync: 1.0.0-beta.2
       json5: 2.2.3
       semver: 7.7.2
@@ -3351,19 +3352,19 @@ snapshots:
 
   '@babel/helper-globals@7.28.0': {}
 
-  '@babel/helper-module-imports@7.28.6(supports-color@10.0.0)':
+  '@babel/helper-module-imports@7.28.6(supports-color@10.2.2)':
     dependencies:
-      '@babel/traverse': 7.29.0(supports-color@10.0.0)
+      '@babel/traverse': 7.29.0(supports-color@10.2.2)
       '@babel/types': 7.29.0
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-module-transforms@7.28.6(@babel/core@7.28.4(supports-color@10.0.0))(supports-color@10.0.0)':
+  '@babel/helper-module-transforms@7.28.6(@babel/core@7.28.4(supports-color@10.2.2))(supports-color@10.2.2)':
     dependencies:
-      '@babel/core': 7.28.4(supports-color@10.0.0)
-      '@babel/helper-module-imports': 7.28.6(supports-color@10.0.0)
+      '@babel/core': 7.28.4(supports-color@10.2.2)
+      '@babel/helper-module-imports': 7.28.6(supports-color@10.2.2)
       '@babel/helper-validator-identifier': 7.28.5
-      '@babel/traverse': 7.29.0(supports-color@10.0.0)
+      '@babel/traverse': 7.29.0(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -3392,7 +3393,7 @@ snapshots:
       '@babel/parser': 7.29.0
       '@babel/types': 7.29.0
 
-  '@babel/traverse@7.28.4(supports-color@10.0.0)':
+  '@babel/traverse@7.28.4(supports-color@10.2.2)':
     dependencies:
       '@babel/code-frame': 7.29.0
       '@babel/generator': 7.29.1
@@ -3400,11 +3401,11 @@ snapshots:
       '@babel/parser': 7.28.4
       '@babel/template': 7.28.6
       '@babel/types': 7.28.4
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/traverse@7.29.0(supports-color@10.0.0)':
+  '@babel/traverse@7.29.0(supports-color@10.2.2)':
     dependencies:
       '@babel/code-frame': 7.29.0
       '@babel/generator': 7.29.1
@@ -3412,7 +3413,7 @@ snapshots:
       '@babel/parser': 7.29.0
       '@babel/template': 7.28.6
       '@babel/types': 7.29.0
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -3434,10 +3435,10 @@ snapshots:
       dotenv: 17.3.1
       eciesjs: 0.4.18
       execa: 5.1.1(patch_hash=ee0e2217eadd7986ec585d2e684030a05ad958593a9b11affa002a14a5d46f77)
-      fdir: 6.5.0(picomatch@4.0.3)
+      fdir: 6.5.0(picomatch@4.0.4)
       ignore: 5.3.2
       object-treeify: 1.1.33
-      picomatch: 4.0.3
+      picomatch: 4.0.4
       which: 5.0.0
 
   '@ecies/ciphers@0.2.5(@noble/ciphers@1.3.0)':
@@ -3600,17 +3601,17 @@ snapshots:
   '@esbuild/win32-x64@0.27.3':
     optional: true
 
-  '@eslint-community/eslint-utils@4.9.1(eslint@9.35.0(jiti@2.6.1)(supports-color@10.0.0))':
+  '@eslint-community/eslint-utils@4.9.1(eslint@9.35.0(jiti@2.6.1)(supports-color@10.2.2))':
     dependencies:
-      eslint: 9.35.0(jiti@2.6.1)(supports-color@10.0.0)
+      eslint: 9.35.0(jiti@2.6.1)(supports-color@10.2.2)
       eslint-visitor-keys: 3.4.3
 
   '@eslint-community/regexpp@4.12.2': {}
 
-  '@eslint/config-array@0.21.2(supports-color@10.0.0)':
+  '@eslint/config-array@0.21.2(supports-color@10.2.2)':
     dependencies:
       '@eslint/object-schema': 2.1.7
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
       minimatch: 9.0.5
     transitivePeerDependencies:
       - supports-color
@@ -3621,10 +3622,10 @@ snapshots:
     dependencies:
       '@types/json-schema': 7.0.15
 
-  '@eslint/eslintrc@3.3.5(supports-color@10.0.0)':
+  '@eslint/eslintrc@3.3.5(supports-color@10.2.2)':
     dependencies:
       ajv: 6.14.0
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
       espree: 10.4.0
       globals: 14.0.0
       ignore: 5.3.2
@@ -3796,39 +3797,39 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.20.1
 
-  '@npmcli/agent@3.0.0(supports-color@10.0.0)':
+  '@npmcli/agent@3.0.0(supports-color@10.2.2)':
     dependencies:
       agent-base: 7.1.4
-      http-proxy-agent: 7.0.2(supports-color@10.0.0)
-      https-proxy-agent: 7.0.6(supports-color@10.0.0)
+      http-proxy-agent: 7.0.2(supports-color@10.2.2)
+      https-proxy-agent: 7.0.6(supports-color@10.2.2)
       lru-cache: 11.2.2
-      socks-proxy-agent: 8.0.5(supports-color@10.0.0)
+      socks-proxy-agent: 8.0.5(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
-  '@npmcli/agent@4.0.0(supports-color@10.0.0)':
+  '@npmcli/agent@4.0.0(supports-color@10.2.2)':
     dependencies:
       agent-base: 7.1.4
-      http-proxy-agent: 7.0.2(supports-color@10.0.0)
-      https-proxy-agent: 7.0.6(supports-color@10.0.0)
+      http-proxy-agent: 7.0.2(supports-color@10.2.2)
+      https-proxy-agent: 7.0.6(supports-color@10.2.2)
       lru-cache: 11.2.2
-      socks-proxy-agent: 8.0.5(supports-color@10.0.0)
+      socks-proxy-agent: 8.0.5(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
-  '@npmcli/arborist@9.1.6(supports-color@10.0.0)':
+  '@npmcli/arborist@9.1.6(supports-color@10.2.2)':
     dependencies:
       '@isaacs/string-locale-compare': 1.1.0
       '@npmcli/fs': 4.0.0
       '@npmcli/installed-package-contents': 3.0.0
       '@npmcli/map-workspaces': 5.0.3
-      '@npmcli/metavuln-calculator': 9.0.3(supports-color@10.0.0)
+      '@npmcli/metavuln-calculator': 9.0.3(supports-color@10.2.2)
       '@npmcli/name-from-folder': 3.0.0
       '@npmcli/node-gyp': 4.0.0
       '@npmcli/package-json': 7.0.0
       '@npmcli/query': 4.0.1
       '@npmcli/redact': 3.2.2
-      '@npmcli/run-script': 10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.0.0)
+      '@npmcli/run-script': 10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.2.2)
       bin-links: 5.0.0
       cacache: 20.0.1
       common-ancestor-path: 1.0.1
@@ -3840,8 +3841,8 @@ snapshots:
       npm-install-checks: 7.1.2
       npm-package-arg: 12.0.2
       npm-pick-manifest: 10.0.0
-      npm-registry-fetch: 19.1.1(supports-color@10.0.0)
-      pacote: 21.5.0(supports-color@10.0.0)
+      npm-registry-fetch: 19.1.1(supports-color@10.2.2)
+      pacote: 21.5.0(supports-color@10.2.2)
       parse-conflict-json: 4.0.0
       proc-log: 6.1.0
       proggy: 3.0.0
@@ -3886,11 +3887,11 @@ snapshots:
       glob: 13.0.6
       minimatch: 9.0.5
 
-  '@npmcli/metavuln-calculator@9.0.3(supports-color@10.0.0)':
+  '@npmcli/metavuln-calculator@9.0.3(supports-color@10.2.2)':
     dependencies:
       cacache: 20.0.1
       json-parse-even-better-errors: 5.0.0
-      pacote: 21.0.1(supports-color@10.0.0)
+      pacote: 21.0.1(supports-color@10.2.2)
       proc-log: 6.1.0
       semver: 7.7.2
     transitivePeerDependencies:
@@ -3928,12 +3929,12 @@ snapshots:
 
   '@npmcli/redact@4.0.0': {}
 
-  '@npmcli/run-script@10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.0.0)':
+  '@npmcli/run-script@10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.2.2)':
     dependencies:
       '@npmcli/node-gyp': 4.0.0
       '@npmcli/package-json': 7.0.0
       '@npmcli/promise-spawn': 8.0.3
-      node-gyp: 11.5.0(patch_hash=140ba43d43d74f7d3577feb3f8a6efad544dbb0059784102b144a0e2daa437f9)(supports-color@10.0.0)
+      node-gyp: 11.5.0(patch_hash=140ba43d43d74f7d3577feb3f8a6efad544dbb0059784102b144a0e2daa437f9)(supports-color@10.2.2)
       proc-log: 6.1.0
       which: 5.0.0
     transitivePeerDependencies:
@@ -4154,21 +4155,21 @@ snapshots:
 
   '@sigstore/protobuf-specs@0.5.0': {}
 
-  '@sigstore/sign@4.1.0(patch_hash=cdf99454490d44e78fde33563611c0bf50da7f256a239c94d3eb7af6c7d205fa)(supports-color@10.0.0)':
+  '@sigstore/sign@4.1.0(patch_hash=cdf99454490d44e78fde33563611c0bf50da7f256a239c94d3eb7af6c7d205fa)(supports-color@10.2.2)':
     dependencies:
       '@sigstore/bundle': 4.0.0
       '@sigstore/core': 3.1.0
       '@sigstore/protobuf-specs': 0.5.0
-      make-fetch-happen: 15.0.4(supports-color@10.0.0)
+      make-fetch-happen: 15.0.4(supports-color@10.2.2)
       proc-log: 6.1.0
       promise-retry: 2.0.1
     transitivePeerDependencies:
       - supports-color
 
-  '@sigstore/tuf@4.0.1(supports-color@10.0.0)':
+  '@sigstore/tuf@4.0.1(supports-color@10.2.2)':
     dependencies:
       '@sigstore/protobuf-specs': 0.5.0
-      tuf-js: 4.1.0(supports-color@10.0.0)
+      tuf-js: 4.1.0(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -4286,20 +4287,20 @@ snapshots:
       '@typescript/native-preview-win32-arm64': 7.0.0-dev.20250920.1
       '@typescript/native-preview-win32-x64': 7.0.0-dev.20250920.1
 
-  '@vitest/coverage-v8@4.0.3(supports-color@10.0.0)(vitest@4.0.3)':
+  '@vitest/coverage-v8@4.0.3(supports-color@10.2.2)(vitest@4.0.3)':
     dependencies:
       '@bcoe/v8-coverage': 1.0.2
       '@vitest/utils': 4.0.3
       ast-v8-to-istanbul: 0.3.12
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
       istanbul-lib-coverage: 3.2.2
       istanbul-lib-report: 3.0.1
-      istanbul-lib-source-maps: 5.0.6(supports-color@10.0.0)
+      istanbul-lib-source-maps: 5.0.6(supports-color@10.2.2)
       istanbul-reports: 3.2.0
       magicast: 0.3.5
       std-env: 3.10.0
       tinyrainbow: 3.0.3
-      vitest: 4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(supports-color@10.0.0)(yaml@2.8.2)
+      vitest: 4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(supports-color@10.2.2)(yaml@2.8.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -4341,12 +4342,12 @@ snapshots:
     dependencies:
       '@vitest/utils': 4.0.3
       fflate: 0.8.2
-      flatted: 3.4.1
+      flatted: 3.4.2
       pathe: 2.0.3
       sirv: 3.0.2
       tinyglobby: 0.2.15
       tinyrainbow: 3.0.3
-      vitest: 4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(supports-color@10.0.0)(yaml@2.8.2)
+      vitest: 4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(supports-color@10.2.2)(yaml@2.8.2)
 
   '@vitest/utils@4.0.3':
     dependencies:
@@ -4584,7 +4585,7 @@ snapshots:
   chalk@4.1.2:
     dependencies:
       ansi-styles: 4.3.0
-      supports-color: 10.0.0
+      supports-color: 10.2.2
 
   chalk@5.3.0: {}
 
@@ -4637,11 +4638,11 @@ snapshots:
 
   cssesc@3.0.0: {}
 
-  debug@4.4.3(supports-color@10.0.0):
+  debug@4.4.3(supports-color@10.2.2):
     dependencies:
       ms: 2.1.3
     optionalDependencies:
-      supports-color: 10.0.0
+      supports-color: 10.2.2
 
   decompress-response@6.0.0:
     dependencies:
@@ -4768,9 +4769,9 @@ snapshots:
 
   escape-string-regexp@4.0.0: {}
 
-  eslint-plugin-sort-destructure-keys@2.0.0(eslint@9.35.0(jiti@2.6.1)(supports-color@10.0.0)):
+  eslint-plugin-sort-destructure-keys@2.0.0(eslint@9.35.0(jiti@2.6.1)(supports-color@10.2.2)):
     dependencies:
-      eslint: 9.35.0(jiti@2.6.1)(supports-color@10.0.0)
+      eslint: 9.35.0(jiti@2.6.1)(supports-color@10.2.2)
       natural-compare-lite: 1.4.0
 
   eslint-scope@8.4.0:
@@ -4782,14 +4783,14 @@ snapshots:
 
   eslint-visitor-keys@4.2.1: {}
 
-  eslint@9.35.0(jiti@2.6.1)(supports-color@10.0.0):
+  eslint@9.35.0(jiti@2.6.1)(supports-color@10.2.2):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@9.35.0(jiti@2.6.1)(supports-color@10.0.0))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.35.0(jiti@2.6.1)(supports-color@10.2.2))
       '@eslint-community/regexpp': 4.12.2
-      '@eslint/config-array': 0.21.2(supports-color@10.0.0)
+      '@eslint/config-array': 0.21.2(supports-color@10.2.2)
       '@eslint/config-helpers': 0.3.1
       '@eslint/core': 0.15.2
-      '@eslint/eslintrc': 3.3.5(supports-color@10.0.0)
+      '@eslint/eslintrc': 3.3.5(supports-color@10.2.2)
       '@eslint/js': 9.35.0
       '@eslint/plugin-kit': 0.3.5
       '@humanfs/node': 0.16.7
@@ -4800,7 +4801,7 @@ snapshots:
       ajv: 6.14.0
       chalk: 4.1.2
       cross-spawn: 7.0.6
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
       escape-string-regexp: 4.0.0
       eslint-scope: 8.4.0
       eslint-visitor-keys: 4.2.1
@@ -4894,9 +4895,9 @@ snapshots:
     dependencies:
       reusify: 1.1.0
 
-  fdir@6.5.0(picomatch@4.0.3):
+  fdir@6.5.0(picomatch@4.0.4):
     optionalDependencies:
-      picomatch: 4.0.3
+      picomatch: 4.0.4
 
   fflate@0.8.2: {}
 
@@ -4920,8 +4921,6 @@ snapshots:
       flatted: 3.4.2
       keyv: 4.5.4
 
-  flatted@3.4.1: {}
-
   flatted@3.4.2: {}
 
   foreground-child@3.3.1:
@@ -5027,10 +5026,10 @@ snapshots:
 
   http-cache-semantics@4.2.0: {}
 
-  http-proxy-agent@7.0.2(supports-color@10.0.0):
+  http-proxy-agent@7.0.2(supports-color@10.2.2):
     dependencies:
       agent-base: 7.1.4
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -5039,10 +5038,10 @@ snapshots:
       quick-lru: 5.1.1
       resolve-alpn: 1.2.1
 
-  https-proxy-agent@7.0.6(supports-color@10.0.0):
+  https-proxy-agent@7.0.6(supports-color@10.2.2):
     dependencies:
       agent-base: 7.1.4
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -5106,12 +5105,12 @@ snapshots:
     dependencies:
       istanbul-lib-coverage: 3.2.2
       make-dir: 4.0.0
-      supports-color: 10.0.0
+      supports-color: 10.2.2
 
-  istanbul-lib-source-maps@5.0.6(supports-color@10.0.0):
+  istanbul-lib-source-maps@5.0.6(supports-color@10.2.2):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
       istanbul-lib-coverage: 3.2.2
     transitivePeerDependencies:
       - supports-color
@@ -5179,15 +5178,15 @@ snapshots:
       prelude-ls: 1.2.1
       type-check: 0.4.0
 
-  libnpmexec@10.2.3(supports-color@10.0.0):
+  libnpmexec@10.2.3(supports-color@10.2.2):
     dependencies:
       '@gar/promise-retry': 1.0.2
-      '@npmcli/arborist': 9.1.6(supports-color@10.0.0)
+      '@npmcli/arborist': 9.1.6(supports-color@10.2.2)
       '@npmcli/package-json': 7.0.0
-      '@npmcli/run-script': 10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.0.0)
+      '@npmcli/run-script': 10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.2.2)
       ci-info: 4.4.0
       npm-package-arg: 12.0.2
-      pacote: 21.5.0(supports-color@10.0.0)
+      pacote: 21.5.0(supports-color@10.2.2)
       proc-log: 6.1.0
       read: 5.0.1
       semver: 7.7.2
@@ -5196,22 +5195,22 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  libnpmpack@9.0.9(supports-color@10.0.0):
+  libnpmpack@9.0.9(supports-color@10.2.2):
     dependencies:
-      '@npmcli/arborist': 9.1.6(supports-color@10.0.0)
-      '@npmcli/run-script': 10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.0.0)
+      '@npmcli/arborist': 9.1.6(supports-color@10.2.2)
+      '@npmcli/run-script': 10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.2.2)
       npm-package-arg: 12.0.2
-      pacote: 21.5.0(supports-color@10.0.0)
+      pacote: 21.5.0(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
   lilconfig@3.1.3: {}
 
-  lint-staged@15.2.11(supports-color@10.0.0):
+  lint-staged@15.2.11(supports-color@10.2.2):
     dependencies:
       chalk: 5.3.0
       commander: 12.1.0
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
       execa: 5.1.1(patch_hash=ee0e2217eadd7986ec585d2e684030a05ad958593a9b11affa002a14a5d46f77)
       lilconfig: 3.1.3
       listr2: 8.2.5
@@ -5267,9 +5266,9 @@ snapshots:
     dependencies:
       semver: 7.7.2
 
-  make-fetch-happen@14.0.3(supports-color@10.0.0):
+  make-fetch-happen@14.0.3(supports-color@10.2.2):
     dependencies:
-      '@npmcli/agent': 3.0.0(supports-color@10.0.0)
+      '@npmcli/agent': 3.0.0(supports-color@10.2.2)
       cacache: 19.0.1
       http-cache-semantics: 4.2.0
       minipass: 7.1.3
@@ -5283,9 +5282,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  make-fetch-happen@15.0.2(supports-color@10.0.0):
+  make-fetch-happen@15.0.2(supports-color@10.2.2):
     dependencies:
-      '@npmcli/agent': 4.0.0(supports-color@10.0.0)
+      '@npmcli/agent': 4.0.0(supports-color@10.2.2)
       cacache: 20.0.1
       http-cache-semantics: 4.2.0
       minipass: 7.1.3
@@ -5299,10 +5298,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  make-fetch-happen@15.0.4(supports-color@10.0.0):
+  make-fetch-happen@15.0.4(supports-color@10.2.2):
     dependencies:
       '@gar/promise-retry': 1.0.2
-      '@npmcli/agent': 4.0.0(supports-color@10.0.0)
+      '@npmcli/agent': 4.0.0(supports-color@10.2.2)
       cacache: 20.0.1
       http-cache-semantics: 4.2.0
       minipass: 7.1.3
@@ -5324,7 +5323,7 @@ snapshots:
   micromatch@4.0.8:
     dependencies:
       braces: 3.0.3
-      picomatch: 4.0.3
+      picomatch: 4.0.4
 
   mimic-fn@2.1.0: {}
 
@@ -5402,12 +5401,12 @@ snapshots:
 
   node-fetch-native@1.6.7: {}
 
-  node-gyp@11.5.0(patch_hash=140ba43d43d74f7d3577feb3f8a6efad544dbb0059784102b144a0e2daa437f9)(supports-color@10.0.0):
+  node-gyp@11.5.0(patch_hash=140ba43d43d74f7d3577feb3f8a6efad544dbb0059784102b144a0e2daa437f9)(supports-color@10.2.2):
     dependencies:
       env-paths: 2.2.1
       exponential-backoff: 3.1.3
       graceful-fs: 4.2.11
-      make-fetch-happen: 14.0.3(supports-color@10.0.0)
+      make-fetch-happen: 14.0.3(supports-color@10.2.2)
       nopt: 8.1.0
       proc-log: 6.1.0
       semver: 7.7.2
@@ -5468,11 +5467,11 @@ snapshots:
       npm-package-arg: 12.0.2
       semver: 7.7.2
 
-  npm-registry-fetch@19.1.1(supports-color@10.0.0):
+  npm-registry-fetch@19.1.1(supports-color@10.2.2):
     dependencies:
       '@npmcli/redact': 4.0.0
       jsonparse: 1.3.1
-      make-fetch-happen: 15.0.2(supports-color@10.0.0)
+      make-fetch-happen: 15.0.2(supports-color@10.2.2)
       minipass: 7.1.3
       minipass-fetch: 4.0.1
       minizlib: 3.1.0
@@ -5586,45 +5585,45 @@ snapshots:
 
   package-manager-detector@1.6.0: {}
 
-  pacote@21.0.1(supports-color@10.0.0):
+  pacote@21.0.1(supports-color@10.2.2):
     dependencies:
       '@npmcli/git': 6.0.3
       '@npmcli/installed-package-contents': 3.0.0
       '@npmcli/package-json': 7.0.0
       '@npmcli/promise-spawn': 8.0.3
-      '@npmcli/run-script': 10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.0.0)
+      '@npmcli/run-script': 10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.2.2)
       cacache: 20.0.1
       fs-minipass: 3.0.3
       minipass: 7.1.3
       npm-package-arg: 12.0.2
       npm-packlist: 10.0.4
       npm-pick-manifest: 10.0.0
-      npm-registry-fetch: 19.1.1(supports-color@10.0.0)
+      npm-registry-fetch: 19.1.1(supports-color@10.2.2)
       proc-log: 6.1.0
       promise-retry: 2.0.1
-      sigstore: 4.1.0(supports-color@10.0.0)
+      sigstore: 4.1.0(supports-color@10.2.2)
       ssri: 12.0.0
       tar: 7.5.11
     transitivePeerDependencies:
       - supports-color
 
-  pacote@21.5.0(supports-color@10.0.0):
+  pacote@21.5.0(supports-color@10.2.2):
     dependencies:
       '@gar/promise-retry': 1.0.2
       '@npmcli/git': 6.0.3
       '@npmcli/installed-package-contents': 4.0.0
       '@npmcli/package-json': 7.0.0
       '@npmcli/promise-spawn': 9.0.1
-      '@npmcli/run-script': 10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.0.0)
+      '@npmcli/run-script': 10.0.0(patch_hash=65d59a7c4dd7b00f1c218cbcf97d78fe2f462f2e048de4a22b41bd70dbdefcdc)(supports-color@10.2.2)
       cacache: 20.0.1
       fs-minipass: 3.0.3
       minipass: 7.1.3
       npm-package-arg: 12.0.2
       npm-packlist: 10.0.4
       npm-pick-manifest: 10.0.0
-      npm-registry-fetch: 19.1.1(supports-color@10.0.0)
+      npm-registry-fetch: 19.1.1(supports-color@10.2.2)
       proc-log: 6.1.0
-      sigstore: 4.1.0(supports-color@10.0.0)
+      sigstore: 4.1.0(supports-color@10.2.2)
       ssri: 12.0.0
       tar: 7.5.11
     transitivePeerDependencies:
@@ -5662,7 +5661,7 @@ snapshots:
 
   picocolors@1.1.1: {}
 
-  picomatch@4.0.3: {}
+  picomatch@4.0.4: {}
 
   pidtree@0.6.0: {}
 
@@ -5800,13 +5799,13 @@ snapshots:
 
   signal-exit@4.1.0: {}
 
-  sigstore@4.1.0(supports-color@10.0.0):
+  sigstore@4.1.0(supports-color@10.2.2):
     dependencies:
       '@sigstore/bundle': 4.0.0
       '@sigstore/core': 3.1.0
       '@sigstore/protobuf-specs': 0.5.0
-      '@sigstore/sign': 4.1.0(patch_hash=cdf99454490d44e78fde33563611c0bf50da7f256a239c94d3eb7af6c7d205fa)(supports-color@10.0.0)
-      '@sigstore/tuf': 4.0.1(supports-color@10.0.0)
+      '@sigstore/sign': 4.1.0(patch_hash=cdf99454490d44e78fde33563611c0bf50da7f256a239c94d3eb7af6c7d205fa)(supports-color@10.2.2)
+      '@sigstore/tuf': 4.0.1(supports-color@10.2.2)
       '@sigstore/verify': 3.1.0
     transitivePeerDependencies:
       - supports-color
@@ -5831,10 +5830,10 @@ snapshots:
 
   smart-buffer@4.2.0: {}
 
-  socks-proxy-agent@8.0.5(supports-color@10.0.0):
+  socks-proxy-agent@8.0.5(supports-color@10.2.2):
     dependencies:
       agent-base: 7.1.4
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
       socks: 2.8.7
     transitivePeerDependencies:
       - supports-color
@@ -5908,7 +5907,7 @@ snapshots:
 
   strip-json-comments@3.1.1: {}
 
-  supports-color@10.0.0: {}
+  supports-color@10.2.2: {}
 
   tar-fs@3.1.2:
     dependencies:
@@ -5977,8 +5976,8 @@ snapshots:
 
   tinyglobby@0.2.15:
     dependencies:
-      fdir: 6.5.0(picomatch@4.0.3)
-      picomatch: 4.0.3
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
 
   tinylogic@2.0.0: {}
 
@@ -6019,11 +6018,11 @@ snapshots:
       tslib: 1.14.1
       typescript: 5.9.2
 
-  tuf-js@4.1.0(supports-color@10.0.0):
+  tuf-js@4.1.0(supports-color@10.2.2):
     dependencies:
       '@tufjs/models': 4.1.0
-      debug: 4.4.3(supports-color@10.0.0)
-      make-fetch-happen: 15.0.2(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
+      make-fetch-happen: 15.0.2(supports-color@10.2.2)
     transitivePeerDependencies:
       - supports-color
 
@@ -6104,9 +6103,9 @@ snapshots:
 
   validate-npm-package-name@6.0.2: {}
 
-  vite-tsconfig-paths@5.1.4(supports-color@10.0.0)(typescript@5.9.2)(vite@7.3.1(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.2)):
+  vite-tsconfig-paths@5.1.4(supports-color@10.2.2)(typescript@5.9.2)(vite@7.3.1(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.2)):
     dependencies:
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
       globrex: 0.1.2
       tsconfck: 3.1.6(typescript@5.9.2)
     optionalDependencies:
@@ -6118,8 +6117,8 @@ snapshots:
   vite@7.3.1(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.2):
     dependencies:
       esbuild: 0.27.3
-      fdir: 6.5.0(picomatch@4.0.3)
-      picomatch: 4.0.3
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
       postcss: 8.5.8
       rollup: 4.59.0
       tinyglobby: 0.2.15
@@ -6129,7 +6128,7 @@ snapshots:
       jiti: 2.6.1
       yaml: 2.8.2
 
-  vitest@4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(supports-color@10.0.0)(yaml@2.8.2):
+  vitest@4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(supports-color@10.2.2)(yaml@2.8.2):
     dependencies:
       '@vitest/expect': 4.0.3
       '@vitest/mocker': 4.0.3(vite@7.3.1(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.2))
@@ -6138,12 +6137,12 @@ snapshots:
       '@vitest/snapshot': 4.0.3
       '@vitest/spy': 4.0.3
       '@vitest/utils': 4.0.3
-      debug: 4.4.3(supports-color@10.0.0)
+      debug: 4.4.3(supports-color@10.2.2)
       es-module-lexer: 1.7.0
       expect-type: 1.3.0
       magic-string: 0.30.21
       pathe: 2.0.3
-      picomatch: 4.0.3
+      picomatch: 4.0.4
       std-env: 3.10.0
       tinybench: 2.9.0
       tinyexec: 0.3.2
diff --git a/scripts/build-externals/config.mjs b/scripts/build-externals/config.mjs
index f8015245..f7af546b 100644
--- a/scripts/build-externals/config.mjs
+++ b/scripts/build-externals/config.mjs
@@ -26,7 +26,9 @@ export const externalPackages = [
   { name: 'adm-zip', bundle: true },
   { name: 'debug', bundle: true },
   { name: 'tar-fs', bundle: true },
-  // pico-pack: picomatch, del, fast-glob
+  // p-map: Standalone bundle (ESM-only package, bundled before pico-pack).
+  { name: 'p-map', bundle: true },
+  // pico-pack: picomatch, del, fast-glob (p-map marked external).
   { name: 'pico-pack', bundle: true },
   { name: 'del', bundle: false },
   { name: 'fast-glob', bundle: false },
diff --git a/scripts/build-externals/esbuild-config.mjs b/scripts/build-externals/esbuild-config.mjs
index 48e044c5..dba6d45e 100644
--- a/scripts/build-externals/esbuild-config.mjs
+++ b/scripts/build-externals/esbuild-config.mjs
@@ -89,6 +89,7 @@ function createForceNodeModulesPlugin() {
     'cacache',
     'make-fetch-happen',
     'fast-sort',
+    'p-map',
     'pacote',
     'tar-fs',
     'libnpmexec',
@@ -111,7 +112,27 @@ function createForceNodeModulesPlugin() {
                 external: false,
               }
             } catch {
-              // Package not found, let esbuild handle the error
+              // require.resolve fails for ESM-only packages.
+              // Fall back to resolving the package.json and deriving the entry point.
+              try {
+                const pkgJsonPath = requireResolve.resolve(
+                  `${pkg}/package.json`,
+                )
+                const pkgDir = path.dirname(pkgJsonPath)
+                const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf8'))
+                const entry =
+                  typeof pkgJson.exports === 'string'
+                    ? pkgJson.exports
+                    : pkgJson.exports?.default || pkgJson.module || pkgJson.main
+                if (entry) {
+                  return {
+                    path: path.resolve(pkgDir, entry),
+                    external: false,
+                  }
+                }
+              } catch {
+                // Package not found, let esbuild handle the error
+              }
               return undefined
             }
           }
@@ -156,11 +177,18 @@ function createStubPlugin(stubMap = STUB_MAP) {
   }
 }
 
-// Shared dependencies bundled in external-pack that should be marked external in other bundles.
-const _EXTERNAL_PACK_DEPS = [
+// Shared dependencies that exist as standalone bundle files in dist/external/.
+// These must be marked external in bundles that would otherwise inline them,
+// so that at runtime they resolve to the existing bundle wrappers.
+const SHARED_EXTERNAL_DEPS = [
+  'debug',
   'has-flag',
+  'p-map',
   'signal-exit',
+  'spdx-correct',
+  'spdx-expression-parse',
   'supports-color',
+  'which',
   'yoctocolors-cjs',
 ]
 
@@ -182,8 +210,11 @@ export function getPackageSpecificOptions(packageName) {
     // Zod has localization files we don't need.
     opts.external = [...(opts.external || []), './locales/*']
   } else if (packageName === 'debug') {
-    // Bundle supports-color inline to avoid external dependency.
-    // This makes debug.js fully self-contained.
+    // Mark supports-color as external - it exists as a standalone bundle wrapper.
+    opts.external = [...(opts.external || []), 'supports-color']
+  } else if (packageName === 'pico-pack') {
+    // Mark p-map as external - it has its own standalone bundle.
+    opts.external = [...(opts.external || []), 'p-map']
   } else if (packageName === 'external-pack') {
     // Inquirer packages have heavy dependencies we can exclude.
     opts.external = [...(opts.external || []), 'rxjs/operators']
@@ -193,8 +224,9 @@ export function getPackageSpecificOptions(packageName) {
       js: 'if (module.exports && module.exports.default && Object.keys(module.exports).length === 1) { module.exports = module.exports.default; }',
     }
   } else if (packageName === 'npm-pack') {
-    // Bundle all deps inline to make npm-pack.js fully self-contained.
-    // This avoids hidden requires to debug, which, signal-exit, supports-color.
+    // Mark shared deps as external - they exist as standalone bundle wrappers.
+    // This eliminates ~100KB of duplication in the npm-pack bundle.
+    opts.external = [...(opts.external || []), ...SHARED_EXTERNAL_DEPS]
   } else if (packageName === '@socketregistry/packageurl-js') {
     // packageurl-js imports from socket-lib, creating a circular dependency.
     // Mark socket-lib imports as external to avoid bundling issues.
diff --git a/src/external/p-map.js b/src/external/p-map.js
new file mode 100644
index 00000000..c4154890
--- /dev/null
+++ b/src/external/p-map.js
@@ -0,0 +1,3 @@
+'use strict'
+
+module.exports = require('p-map')
diff --git a/test/unit/utils/temp-file-helper.ts b/test/unit/utils/temp-file-helper.ts
index 62106e41..79d5c0f4 100644
--- a/test/unit/utils/temp-file-helper.ts
+++ b/test/unit/utils/temp-file-helper.ts
@@ -113,7 +113,7 @@ export async function withTempDir(prefix: string): Promise<{
  */
 export async function runWithTempDir(
   callback: (tempDir: string) => Promise<void>,
-  prefix: string,
+  prefix = 'tmp',
 ): Promise<void> {
   const { cleanup, path: tempDir } = await withTempDir(prefix)
   try {