A selective decode of an npm packument: pull one version's pieces out of the document bytes without materialising the other versions.

The whole-packument decode (aeson's eitherDecodeStrict) builds a Value for every version -- and on a heavy packument (thousands of versions, multiple megabytes) that decode dominates the serve-path cost. But the tarball gate consults a single version: it needs that version's manifest object, its time[version] publish stamp, and the document's self-reported name -- nothing of the other versions. This module walks the registry's own JSON token stream (aeson's Data.Aeson.Decoding, no new dependency) and materialises a Value only for those few pieces, __skipping every other version's tokens without allocating them__. The win is on the parse, not the fetch: the full bytes are still read (npm carries time only in the full document), but they are parsed selectively -- O(1 version) work and residency rather than O(N).

Faithful to the whole-document decode

The skip is not a shortcut past validation. The walk consumes the entire token stream, so:

• malformed JSON anywhere surfaces as SelectiveUndecodable -- the lexer reaches the offending bytes whether or not they sit in the requested version (matching eitherDecodeStrict failing the whole body);
• trailing non-whitespace after the top-level object is rejected likewise (the same end-of-input check eitherDecodeStrict applies);
• every value is depth-bounded at the same budget checkNestingDepth would apply to it, so a deeply-nested sub-tree anywhere is a SelectiveTooDeeplyNested breach, not a serve.

The two pieces it does build -- the requested version object and the document name -- are produced by the same aeson Value decoder the whole-document path uses, so projecting them yields a byte-for-byte identical PackageDetails (the projection is "Ecluse.Core.Registry.Npm.Project.projectVersionEntry", run over the same Value).

What it deliberately does not re-validate

The selective walk reaches only the requested version's time entry: a structurally malformed-JSON one anywhere is still SelectiveUndecodable (the lexer reaches it), but a schema-invalid sibling (a non-ISO time string for another version, a non-string dist-tags value) is skipped unallocated and never inspected. The whole-document decode degrades the same way: it drops a malformed time/dist-tags entry per-entry (graceful per-entry degradation) rather than failing the document, so neither path refuses a sound version over an unrelated sibling malformation. The two paths agree on what is served (the one sound version, identically projected) and differ only in tracking: the whole-document projection records each dropped sibling as an InvalidEntry for the serve-path log, while this walk, skipping the siblings unallocated, cannot report them (the degenerate tracking a single-version read inherently has). The requested version's own schema-invalid stamp folds, on both paths, to a version with no known publish time (the projecting caller's lenient parse), never a document failure.