@ash-technologia/fathom 0.1.0

package/dist/analyzers/dependencies/index.js

@@ -0,0 +1,403 @@
+import path from 'node:path';
+import { createFindingId } from '../../core/findings.js';
+import { createTimer } from '../../utils/timing.js';
+import { readFileSafe } from '../../utils/filesystem.js';
+import { extractRawSpecifiers } from '../architecture/imports.js';
+import { parsePackageLockJson, parseYarnLock, parsePnpmLock, } from './lockfiles.js';
+import { queryVulnerabilitiesOnline, checkOutdatedOnline } from './online.js';
+/** Maps lockfile names to their expected package manager */
+const LOCKFILE_TO_PM = {
+    'package-lock.json': 'npm',
+    'yarn.lock': 'yarn',
+    'pnpm-lock.yaml': 'pnpm',
+};
+/** Maps manifests to expected lockfiles */
+const MANIFEST_TO_LOCKFILES = {
+    'package.json': ['package-lock.json', 'yarn.lock', 'pnpm-lock.yaml'],
+    Pipfile: ['Pipfile.lock'],
+    'pyproject.toml': ['poetry.lock'],
+    'Cargo.toml': ['Cargo.lock'],
+    'go.mod': ['go.sum'],
+    'composer.json': ['composer.lock'],
+    Gemfile: ['Gemfile.lock'],
+};
+/** Known build-time, CLI, or polyfill packages that are legitimately not directly imported in source code */
+const RUNTIME_IGNORED_PACKAGES = new Set([
+    'tslib',
+    'core-js',
+    'dotenv',
+    'cross-env',
+    'concurrently',
+    'nodemon',
+    'husky',
+    'lint-staged',
+    'typescript',
+    'ts-node',
+    'tsx',
+    'vite',
+    'webpack',
+    'rollup',
+    'esbuild',
+    'eslint',
+    'prettier',
+    'vitest',
+    'jest',
+]);
+export class DependencyAnalyzer {
+    id = 'dependencies';
+    name = 'Dependencies';
+    category = 'dependencies';
+    description = 'Checks package manifests, lockfiles, duplicate versions, suspicious configurations, and dependency health.';
+    async analyze(context) {
+        const elapsed = createTimer();
+        const findings = [];
+        const warnings = [];
+        const rootFileSet = new Set(context.rootFilenames);
+        // 1. DEP-001: Manifest detection
+        const manifests = Object.keys(MANIFEST_TO_LOCKFILES).filter((m) => rootFileSet.has(m));
+        if (manifests.length === 0) {
+            findings.push({
+                id: createFindingId('DEP-001'),
+                ruleId: 'DEP-001',
+                category: 'dependencies',
+                severity: 'info',
+                title: 'No package manifest detected',
+                description: 'No recognised package manifest (package.json, pyproject.toml, Cargo.toml, go.mod, etc.) was found.',
+                recommendation: 'If this project has dependencies, add the appropriate manifest for your ecosystem.',
+                confidence: 0.8,
+                autoFixable: false,
+            });
+        }
+        // 2. DEP-002 + DEP-003: Lockfile detection
+        const lockfilesFound = context.manifests.lockfiles;
+        let directCount = 0;
+        let devCount = 0;
+        if (lockfilesFound.length > 0) {
+            findings.push({
+                id: createFindingId('DEP-002'),
+                ruleId: 'DEP-002',
+                category: 'dependencies',
+                severity: 'info',
+                title: `Lockfile detected: ${lockfilesFound.join(', ')}`,
+                description: `Found lockfile(s): ${lockfilesFound.join(', ')}. Ensures deterministic installs.`,
+                recommendation: 'Keep lockfiles committed and synchronised with package manifests.',
+                confidence: 0.99,
+                autoFixable: false,
+            });
+        }
+        for (const manifest of manifests) {
+            const expectedLockfiles = MANIFEST_TO_LOCKFILES[manifest] ?? [];
+            const hasLockfile = expectedLockfiles.some((lf) => rootFileSet.has(lf));
+            if (!hasLockfile) {
+                findings.push({
+                    id: createFindingId('DEP-003', manifest),
+                    ruleId: 'DEP-003',
+                    category: 'dependencies',
+                    severity: 'medium',
+                    title: `No lockfile found for ${manifest}`,
+                    description: 'A lockfile ensures reproducible installs across environments.',
+                    recommendation: `Run your package manager to generate a lockfile (e.g., \`npm install\`, \`poetry lock\`).`,
+                    confidence: 0.95,
+                    location: { file: manifest },
+                    autoFixable: false,
+                });
+            }
+        }
+        // 3. DEP-004: Package manager mismatch (multiple Node.js lockfiles)
+        const nodeLockfiles = lockfilesFound.filter((lf) => Object.keys(LOCKFILE_TO_PM).includes(lf));
+        if (nodeLockfiles.length > 1) {
+            findings.push({
+                id: createFindingId('DEP-004'),
+                ruleId: 'DEP-004',
+                category: 'dependencies',
+                severity: 'low',
+                title: 'Multiple lockfiles detected',
+                description: `Found multiple lockfiles: ${nodeLockfiles.join(', ')}. This may indicate conflicting package managers.`,
+                recommendation: "Choose one package manager and remove the others' lockfiles.",
+                confidence: 0.9,
+                evidence: nodeLockfiles.join(', '),
+                autoFixable: false,
+            });
+        }
+        // 4. Parse lockfiles for transitive packages and duplicates (DEP-008)
+        let transitiveCount = 0;
+        const duplicatesMap = new Map();
+        const resolvedPackages = [];
+        for (const lf of lockfilesFound) {
+            const fileEntry = context.files.find((f) => f.relativePath === lf);
+            const absPath = fileEntry ? fileEntry.absolutePath : path.join(context.root, lf);
+            const content = await readFileSafe(absPath);
+            if (!content)
+                continue;
+            let parsed = null;
+            if (lf === 'package-lock.json')
+                parsed = parsePackageLockJson(content);
+            else if (lf === 'yarn.lock')
+                parsed = parseYarnLock(content);
+            else if (lf === 'pnpm-lock.yaml')
+                parsed = parsePnpmLock(content);
+            if (parsed) {
+                transitiveCount = Math.max(transitiveCount, parsed.transitiveCount);
+                for (const [name, versions] of parsed.packages) {
+                    let verSet = duplicatesMap.get(name);
+                    if (!verSet) {
+                        verSet = new Set();
+                        duplicatesMap.set(name, verSet);
+                    }
+                    for (const ver of versions) {
+                        verSet.add(ver);
+                        resolvedPackages.push({ name, version: ver });
+                    }
+                }
+            }
+        }
+        const duplicatePackages = [];
+        for (const [name, versions] of duplicatesMap.entries()) {
+            if (versions.size > 1) {
+                const sorted = [...versions].sort();
+                duplicatePackages.push({ name, versions: sorted });
+                findings.push({
+                    id: createFindingId('DEP-008', name),
+                    ruleId: 'DEP-008',
+                    category: 'dependencies',
+                    severity: 'low',
+                    title: `Duplicate dependency versions: ${name}`,
+                    description: `Package "${name}" resolves to multiple distinct versions in lockfiles: ${sorted.join(', ')}.`,
+                    recommendation: 'Deduplicate versions using package manager dedupe (e.g. `npm dedupe`) or align version constraints.',
+                    confidence: 0.9,
+                    evidence: sorted.join(', '),
+                    autoFixable: false,
+                });
+            }
+        }
+        duplicatePackages.sort((a, b) => a.name.localeCompare(b.name));
+        // 5. DEP-005 & Suspicious Configuration (DEP-006) from package.json
+        const suspiciousConfigs = [];
+        const directDepsList = [];
+        const declaredProdDeps = new Set();
+        if (context.manifests.packageJson) {
+            const pkgJson = context.manifests.packageJson;
+            const deps = pkgJson.dependencies ?? {};
+            const devDeps = pkgJson.devDependencies ?? {};
+            directCount = Object.keys(deps).length;
+            devCount = Object.keys(devDeps).length;
+            const totalDeclared = directCount + devCount;
+            if (totalDeclared > 0) {
+                findings.push({
+                    id: createFindingId('DEP-005'),
+                    ruleId: 'DEP-005',
+                    category: 'dependencies',
+                    severity: 'info',
+                    title: `Dependencies declared: ${totalDeclared}`,
+                    description: `Project declares ${directCount} dependencies and ${devCount} devDependencies.`,
+                    recommendation: 'Audit dependencies regularly for security updates and unused packages.',
+                    confidence: 0.95,
+                    autoFixable: false,
+                });
+            }
+            // Check duplicate between dependencies and devDependencies
+            for (const depName of Object.keys(deps)) {
+                declaredProdDeps.add(depName);
+                directDepsList.push({ name: depName, currentVersion: deps[depName] ?? '' });
+                if (devDeps[depName] !== undefined) {
+                    const reason = `Package "${depName}" is declared in both dependencies and devDependencies.`;
+                    suspiciousConfigs.push({
+                        name: depName,
+                        versionSpec: `dependencies: ${deps[depName]} | devDependencies: ${devDeps[depName]}`,
+                        reason,
+                        manifestPath: 'package.json',
+                    });
+                    findings.push({
+                        id: createFindingId('DEP-006', `${depName}-duplicate`),
+                        ruleId: 'DEP-006',
+                        category: 'dependencies',
+                        severity: 'low',
+                        title: `Conflicting dependency declaration: ${depName}`,
+                        description: reason,
+                        recommendation: 'Remove the duplicate entry from devDependencies if it is required at runtime, or vice versa.',
+                        confidence: 0.95,
+                        location: { file: 'package.json' },
+                        autoFixable: false,
+                    });
+                }
+            }
+            // Check wildcards and unpinned Git/URL specs
+            const allSpecs = [
+                ...Object.entries(deps).map(([name, spec]) => ({ name, spec })),
+                ...Object.entries(devDeps).map(([name, spec]) => ({ name, spec })),
+            ];
+            for (const { name, spec } of allSpecs) {
+                let reason = '';
+                if (spec === '*' || spec === 'latest' || spec === 'x.x' || spec === '>0.0.0') {
+                    reason = `Unpinned wildcard version specifier "${spec}". Can introduce breaking changes or untrusted updates.`;
+                }
+                else if (spec.startsWith('git:') ||
+                    spec.startsWith('git+https:') ||
+                    spec.startsWith('http:')) {
+                    if (!spec.includes('#')) {
+                        reason = `Unpinned Git or HTTP repository reference "${spec}".`;
+                    }
+                }
+                else if (spec.startsWith('file:..')) {
+                    reason = `External local filesystem reference "${spec}". May fail in isolated build environments.`;
+                }
+                if (reason) {
+                    suspiciousConfigs.push({
+                        name,
+                        versionSpec: spec,
+                        reason,
+                        manifestPath: 'package.json',
+                    });
+                    findings.push({
+                        id: createFindingId('DEP-006', name),
+                        ruleId: 'DEP-006',
+                        category: 'dependencies',
+                        severity: 'low',
+                        title: `Suspicious dependency specifier: ${name}@${spec}`,
+                        description: reason,
+                        recommendation: 'Pin dependencies with standard semantic version ranges (e.g. `^1.2.0` or `~1.2.0`).',
+                        confidence: 0.9,
+                        location: { file: 'package.json' },
+                        autoFixable: false,
+                    });
+                }
+            }
+        }
+        // 6. Unused Dependencies (DEP-010, Confident detection)
+        const unusedDeps = [];
+        if (declaredProdDeps.size > 0 && context.files.filter((f) => f.isSource).length >= 3) {
+            // Collect all external imports from source files
+            const importedPackages = new Set();
+            for (const file of context.files) {
+                if (!file.isSource)
+                    continue;
+                if (file.sizeBytes > 1024 * 1024)
+                    continue;
+                const content = await readFileSafe(file.absolutePath);
+                if (!content)
+                    continue;
+                const specifiers = extractRawSpecifiers(content, file.extension);
+                for (const spec of specifiers) {
+                    if (spec.startsWith('.') || spec.startsWith('/'))
+                        continue;
+                    // Extract base package name (e.g. '@tanstack/react-query' -> '@tanstack/react-query', 'lodash/map' -> 'lodash')
+                    const parts = spec.split('/');
+                    const pkgName = spec.startsWith('@') ? `${parts[0]}/${parts[1]}` : parts[0];
+                    if (pkgName)
+                        importedPackages.add(pkgName);
+                }
+            }
+            for (const depName of declaredProdDeps) {
+                if (depName.startsWith('@types/'))
+                    continue;
+                if (RUNTIME_IGNORED_PACKAGES.has(depName))
+                    continue;
+                if (!importedPackages.has(depName)) {
+                    unusedDeps.push({
+                        name: depName,
+                        manifestPath: 'package.json',
+                        confidence: 0.85,
+                    });
+                    findings.push({
+                        id: createFindingId('DEP-010', depName),
+                        ruleId: 'DEP-010',
+                        category: 'dependencies',
+                        severity: 'info',
+                        title: `Unused production dependency: ${depName}`,
+                        description: `Package "${depName}" is declared in dependencies but no import references were found across source files.`,
+                        recommendation: 'If this package is no longer needed, remove it with your package manager or move it to devDependencies.',
+                        confidence: 0.85,
+                        location: { file: 'package.json' },
+                        autoFixable: false,
+                    });
+                }
+            }
+        }
+        // 7. Online Analysis: Vulnerabilities (DEP-007) and Outdated (DEP-009)
+        let vulnerabilities = [];
+        let outdated = [];
+        if (context.online) {
+            // Query vulnerabilities via OSV
+            const packagesToQuery = resolvedPackages.length > 0
+                ? resolvedPackages
+                : directDepsList.map((d) => ({
+                    name: d.name,
+                    version: d.currentVersion.replace(/^[\^~>=<v\s]+/, ''),
+                }));
+            vulnerabilities = await queryVulnerabilitiesOnline(packagesToQuery);
+            for (const vuln of vulnerabilities) {
+                const vulnFinding = {
+                    id: createFindingId('DEP-007', `${vuln.packageName}-${vuln.id}`),
+                    ruleId: 'DEP-007',
+                    category: 'dependencies',
+                    severity: vuln.severity,
+                    title: `Known vulnerability: ${vuln.packageName} (${vuln.id})`,
+                    description: vuln.title,
+                    recommendation: `Upgrade ${vuln.packageName} to a patched release. Advisory details: ${vuln.url ?? 'https://osv.dev'}`,
+                    confidence: 0.95,
+                    autoFixable: false,
+                };
+                if (vuln.url)
+                    vulnFinding.references = [vuln.url];
+                findings.push(vulnFinding);
+            }
+            // Query outdated packages via registry
+            if (directDepsList.length > 0) {
+                outdated = await checkOutdatedOnline(directDepsList);
+                for (const out of outdated) {
+                    findings.push({
+                        id: createFindingId('DEP-009', out.packageName),
+                        ruleId: 'DEP-009',
+                        category: 'dependencies',
+                        severity: 'low',
+                        title: `Outdated dependency: ${out.packageName} (${out.currentVersion} → ${out.latestVersion})`,
+                        description: `Package "${out.packageName}" is running version ${out.currentVersion}, while latest release is ${out.latestVersion}.`,
+                        recommendation: `Review release notes and upgrade ${out.packageName} to ${out.latestVersion}.`,
+                        confidence: 0.9,
+                        autoFixable: false,
+                    });
+                }
+            }
+        }
+        const summary = {
+            manifests,
+            lockfiles: lockfilesFound,
+            directCount,
+            devCount,
+            transitiveCount,
+            duplicates: duplicatePackages,
+            suspicious: suspiciousConfigs,
+            unused: unusedDeps,
+            vulnerabilities,
+            outdated,
+            isOnline: Boolean(context.online),
+        };
+        const metrics = {
+            manifestsFound: manifests,
+            lockfilesFound: lockfilesFound,
+            directCount,
+            devCount,
+            transitiveCount,
+            dependencyCount: directCount + devCount,
+            duplicateCount: duplicatePackages.length,
+            suspiciousCount: suspiciousConfigs.length,
+            unusedCount: unusedDeps.length,
+            vulnerabilityCount: vulnerabilities.length,
+            outdatedCount: outdated.length,
+            isOnline: Boolean(context.online),
+            hasMissingLockfile: manifests.some((m) => !(MANIFEST_TO_LOCKFILES[m] ?? []).some((lf) => rootFileSet.has(lf))),
+            summary: JSON.stringify(summary),
+        };
+        return {
+            analyzerId: this.id,
+            analyzerName: this.name,
+            category: this.category,
+            status: 'success',
+            findings,
+            metrics,
+            durationMs: elapsed(),
+            warnings,
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/analyzers/dependencies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyzers/dependencies/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,aAAa,GAEd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAkB9E,4DAA4D;AAC5D,MAAM,cAAc,GAA2B;IAC7C,mBAAmB,EAAE,KAAK;IAC1B,WAAW,EAAE,MAAM;IACnB,gBAAgB,EAAE,MAAM;CACzB,CAAC;AAEF,2CAA2C;AAC3C,MAAM,qBAAqB,GAA6B;IACtD,cAAc,EAAE,CAAC,mBAAmB,EAAE,WAAW,EAAE,gBAAgB,CAAC;IACpE,OAAO,EAAE,CAAC,cAAc,CAAC;IACzB,gBAAgB,EAAE,CAAC,aAAa,CAAC;IACjC,YAAY,EAAE,CAAC,YAAY,CAAC;IAC5B,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACpB,eAAe,EAAE,CAAC,eAAe,CAAC;IAClC,OAAO,EAAE,CAAC,cAAc,CAAC;CAC1B,CAAC;AAEF,6GAA6G;AAC7G,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,OAAO;IACP,SAAS;IACT,QAAQ;IACR,WAAW;IACX,cAAc;IACd,SAAS;IACT,OAAO;IACP,aAAa;IACb,YAAY;IACZ,SAAS;IACT,KAAK;IACL,MAAM;IACN,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,OAAO,kBAAkB;IACpB,EAAE,GAAG,cAAc,CAAC;IACpB,IAAI,GAAG,cAAc,CAAC;IACtB,QAAQ,GAAG,cAAuB,CAAC;IACnC,WAAW,GAClB,4GAA4G,CAAC;IAE/G,KAAK,CAAC,OAAO,CAAC,OAA0B;QACtC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAEnD,iCAAiC;QACjC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,eAAe,CAAC,SAAS,CAAC;gBAC9B,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,8BAA8B;gBACrC,WAAW,EACT,oGAAoG;gBACtG,cAAc,EACZ,oFAAoF;gBACtF,UAAU,EAAE,GAAG;gBACf,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;QACnD,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,eAAe,CAAC,SAAS,CAAC;gBAC9B,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,sBAAsB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACxD,WAAW,EAAE,sBAAsB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC;gBAC/F,cAAc,EAAE,mEAAmE;gBACnF,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChE,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAExE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC;oBACxC,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,cAAc;oBACxB,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,yBAAyB,QAAQ,EAAE;oBAC1C,WAAW,EAAE,+DAA+D;oBAC5E,cAAc,EAAE,2FAA2F;oBAC3G,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC5B,WAAW,EAAE,KAAK;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9F,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,eAAe,CAAC,SAAS,CAAC;gBAC9B,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,6BAA6B;gBACpC,WAAW,EAAE,6BAA6B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD;gBACrH,cAAc,EAAE,8DAA8D;gBAC9E,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClC,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;QACrD,MAAM,gBAAgB,GAA6C,EAAE,CAAC;QAEtE,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,IAAI,MAAM,GAA0B,IAAI,CAAC;YACzC,IAAI,EAAE,KAAK,mBAAmB;gBAAE,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;iBAClE,IAAI,EAAE,KAAK,WAAW;gBAAE,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;iBACxD,IAAI,EAAE,KAAK,gBAAgB;gBAAE,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YAElE,IAAI,MAAM,EAAE,CAAC;gBACX,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;gBACpE,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC/C,IAAI,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACrC,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;wBACnB,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAClC,CAAC;oBACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;wBAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBAChB,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GAAuB,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YACvD,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC;oBACpC,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,cAAc;oBACxB,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,kCAAkC,IAAI,EAAE;oBAC/C,WAAW,EAAE,YAAY,IAAI,0DAA0D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC3G,cAAc,EACZ,qGAAqG;oBACvG,UAAU,EAAE,GAAG;oBACf,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC3B,WAAW,EAAE,KAAK;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/D,oEAAoE;QACpE,MAAM,iBAAiB,GAA2B,EAAE,CAAC;QACrD,MAAM,cAAc,GAAoD,EAAE,CAAC;QAC3E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;QAE3C,IAAI,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,WAA0B,CAAC;YAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;YAC9C,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACvC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YACvC,MAAM,aAAa,GAAG,WAAW,GAAG,QAAQ,CAAC;YAE7C,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,eAAe,CAAC,SAAS,CAAC;oBAC9B,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,cAAc;oBACxB,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,0BAA0B,aAAa,EAAE;oBAChD,WAAW,EAAE,oBAAoB,WAAW,qBAAqB,QAAQ,mBAAmB;oBAC5F,cAAc,EAAE,wEAAwE;oBACxF,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,KAAK;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,2DAA2D;YAC3D,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9B,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAE5E,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,YAAY,OAAO,yDAAyD,CAAC;oBAC5F,iBAAiB,CAAC,IAAI,CAAC;wBACrB,IAAI,EAAE,OAAO;wBACb,WAAW,EAAE,iBAAiB,IAAI,CAAC,OAAO,CAAC,uBAAuB,OAAO,CAAC,OAAO,CAAC,EAAE;wBACpF,MAAM;wBACN,YAAY,EAAE,cAAc;qBAC7B,CAAC,CAAC;oBAEH,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,eAAe,CAAC,SAAS,EAAE,GAAG,OAAO,YAAY,CAAC;wBACtD,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,cAAc;wBACxB,QAAQ,EAAE,KAAK;wBACf,KAAK,EAAE,uCAAuC,OAAO,EAAE;wBACvD,WAAW,EAAE,MAAM;wBACnB,cAAc,EACZ,8FAA8F;wBAChG,UAAU,EAAE,IAAI;wBAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;wBAClC,WAAW,EAAE,KAAK;qBACnB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,6CAA6C;YAC7C,MAAM,QAAQ,GAA0C;gBACtD,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/D,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;aACnE,CAAC;YAEF,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtC,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7E,MAAM,GAAG,wCAAwC,IAAI,yDAAyD,CAAC;gBACjH,CAAC;qBAAM,IACL,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;oBACvB,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;oBAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EACxB,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBACxB,MAAM,GAAG,8CAA8C,IAAI,IAAI,CAAC;oBAClE,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBACtC,MAAM,GAAG,wCAAwC,IAAI,6CAA6C,CAAC;gBACrG,CAAC;gBAED,IAAI,MAAM,EAAE,CAAC;oBACX,iBAAiB,CAAC,IAAI,CAAC;wBACrB,IAAI;wBACJ,WAAW,EAAE,IAAI;wBACjB,MAAM;wBACN,YAAY,EAAE,cAAc;qBAC7B,CAAC,CAAC;oBAEH,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC;wBACpC,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,cAAc;wBACxB,QAAQ,EAAE,KAAK;wBACf,KAAK,EAAE,oCAAoC,IAAI,IAAI,IAAI,EAAE;wBACzD,WAAW,EAAE,MAAM;wBACnB,cAAc,EACZ,qFAAqF;wBACvF,UAAU,EAAE,GAAG;wBACf,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;wBAClC,WAAW,EAAE,KAAK;qBACnB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,MAAM,UAAU,GAAuB,EAAE,CAAC;QAC1C,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACrF,iDAAiD;YACjD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBAC7B,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI;oBAAE,SAAS;gBAE3C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACtD,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBACjE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;oBAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;wBAAE,SAAS;oBAC3D,gHAAgH;oBAChH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC5E,IAAI,OAAO;wBAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;gBACvC,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;oBAAE,SAAS;gBAC5C,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,SAAS;gBAEpD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnC,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,OAAO;wBACb,YAAY,EAAE,cAAc;wBAC5B,UAAU,EAAE,IAAI;qBACjB,CAAC,CAAC;oBAEH,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC;wBACvC,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,cAAc;wBACxB,QAAQ,EAAE,MAAM;wBAChB,KAAK,EAAE,iCAAiC,OAAO,EAAE;wBACjD,WAAW,EAAE,YAAY,OAAO,wFAAwF;wBACxH,cAAc,EACZ,yGAAyG;wBAC3G,UAAU,EAAE,IAAI;wBAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;wBAClC,WAAW,EAAE,KAAK;qBACnB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,IAAI,eAAe,GAA4B,EAAE,CAAC;QAClD,IAAI,QAAQ,GAAyB,EAAE,CAAC;QAExC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,gCAAgC;YAChC,MAAM,eAAe,GACnB,gBAAgB,CAAC,MAAM,GAAG,CAAC;gBACzB,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,OAAO,EAAE,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;iBACvD,CAAC,CAAC,CAAC;YAEV,eAAe,GAAG,MAAM,0BAA0B,CAAC,eAAe,CAAC,CAAC;YACpE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAY;oBAC3B,EAAE,EAAE,eAAe,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;oBAChE,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,cAAc;oBACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,wBAAwB,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,EAAE,GAAG;oBAC9D,WAAW,EAAE,IAAI,CAAC,KAAK;oBACvB,cAAc,EAAE,WAAW,IAAI,CAAC,WAAW,4CAA4C,IAAI,CAAC,GAAG,IAAI,iBAAiB,EAAE;oBACtH,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,KAAK;iBACnB,CAAC;gBACF,IAAI,IAAI,CAAC,GAAG;oBAAE,WAAW,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClD,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7B,CAAC;YAED,uCAAuC;YACvC,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,QAAQ,GAAG,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;gBACrD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC;wBAC/C,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,cAAc;wBACxB,QAAQ,EAAE,KAAK;wBACf,KAAK,EAAE,wBAAwB,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,cAAc,MAAM,GAAG,CAAC,aAAa,GAAG;wBAC/F,WAAW,EAAE,YAAY,GAAG,CAAC,WAAW,wBAAwB,GAAG,CAAC,cAAc,6BAA6B,GAAG,CAAC,aAAa,GAAG;wBACnI,cAAc,EAAE,oCAAoC,GAAG,CAAC,WAAW,OAAO,GAAG,CAAC,aAAa,GAAG;wBAC9F,UAAU,EAAE,GAAG;wBACf,WAAW,EAAE,KAAK;qBACnB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAkC;YAC7C,SAAS;YACT,SAAS,EAAE,cAAc;YACzB,WAAW;YACX,QAAQ;YACR,eAAe;YACf,UAAU,EAAE,iBAAiB;YAC7B,UAAU,EAAE,iBAAiB;YAC7B,MAAM,EAAE,UAAU;YAClB,eAAe;YACf,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;SAClC,CAAC;QAEF,MAAM,OAAO,GAAY;YACvB,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,cAAc;YAC9B,WAAW;YACX,QAAQ;YACR,eAAe;YACf,eAAe,EAAE,WAAW,GAAG,QAAQ;YACvC,cAAc,EAAE,iBAAiB,CAAC,MAAM;YACxC,eAAe,EAAE,iBAAiB,CAAC,MAAM;YACzC,WAAW,EAAE,UAAU,CAAC,MAAM;YAC9B,kBAAkB,EAAE,eAAe,CAAC,MAAM;YAC1C,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;YACjC,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAC3E;YACD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SACjC,CAAC;QAEF,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,SAAS;YACjB,QAAQ;YACR,OAAO;YACP,UAAU,EAAE,OAAO,EAAE;YACrB,QAAQ;SACT,CAAC;IACJ,CAAC;CACF"}

package/dist/analyzers/dependencies/lockfiles.d.ts

@@ -0,0 +1,19 @@
+import type { DuplicatePackage } from './types.js';
+export interface ParsedLockfile {
+    transitiveCount: number;
+    packages: Map<string, Set<string>>;
+    duplicates: DuplicatePackage[];
+}
+/**
+ * Statically parses a package-lock.json file (supporting v1, v2, and v3 schemas).
+ */
+export declare function parsePackageLockJson(content: string): ParsedLockfile;
+/**
+ * Statically parses a yarn.lock file without executing yarn.
+ */
+export declare function parseYarnLock(content: string): ParsedLockfile;
+/**
+ * Statically parses a pnpm-lock.yaml file without executing pnpm.
+ */
+export declare function parsePnpmLock(content: string): ParsedLockfile;
+//# sourceMappingURL=lockfiles.d.ts.map

package/dist/analyzers/dependencies/lockfiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfiles.d.ts","sourceRoot":"","sources":["../../../src/analyzers/dependencies/lockfiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnC,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAgFpE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAoD7D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAwC7D"}

package/dist/analyzers/dependencies/lockfiles.js

@@ -0,0 +1,172 @@
+/**
+ * Statically parses a package-lock.json file (supporting v1, v2, and v3 schemas).
+ */
+export function parsePackageLockJson(content) {
+    const packages = new Map();
+    try {
+        const data = JSON.parse(content);
+        // v2 & v3 schemas: "packages" object
+        const rawPackages = data['packages'];
+        if (rawPackages && typeof rawPackages === 'object' && !Array.isArray(rawPackages)) {
+            const pkgsObj = rawPackages;
+            for (const [pkgPath, pkgInfo] of Object.entries(pkgsObj)) {
+                if (!pkgPath || pkgPath === '')
+                    continue; // Skip root package definition
+                if (!pkgInfo || typeof pkgInfo.version !== 'string')
+                    continue;
+                // Extract package name from "node_modules/..."
+                const match = /node_modules\/((?:@[^/]+\/)?[^/]+)$/.exec(pkgPath);
+                if (match?.[1]) {
+                    const name = match[1];
+                    const ver = pkgInfo.version;
+                    let verSet = packages.get(name);
+                    if (!verSet) {
+                        verSet = new Set();
+                        packages.set(name, verSet);
+                    }
+                    verSet.add(ver);
+                }
+            }
+        }
+        else {
+            const rawDeps = data['dependencies'];
+            if (rawDeps && typeof rawDeps === 'object' && !Array.isArray(rawDeps)) {
+                // v1 schema: nested "dependencies"
+                function walkV1(depsObj) {
+                    for (const [name, info] of Object.entries(depsObj)) {
+                        if (!info || typeof info !== 'object')
+                            continue;
+                        const typedInfo = info;
+                        if (typeof typedInfo.version === 'string') {
+                            let verSet = packages.get(name);
+                            if (!verSet) {
+                                verSet = new Set();
+                                packages.set(name, verSet);
+                            }
+                            verSet.add(typedInfo.version);
+                        }
+                        const childDeps = typedInfo.dependencies;
+                        if (childDeps && typeof childDeps === 'object') {
+                            walkV1(childDeps);
+                        }
+                    }
+                }
+                walkV1(rawDeps);
+            }
+        }
+    }
+    catch {
+        return {
+            transitiveCount: 0,
+            packages,
+            duplicates: [],
+        };
+    }
+    const duplicates = [];
+    for (const [name, versions] of packages.entries()) {
+        if (versions.size > 1) {
+            duplicates.push({
+                name,
+                versions: [...versions].sort(),
+            });
+        }
+    }
+    duplicates.sort((a, b) => a.name.localeCompare(b.name));
+    return {
+        transitiveCount: packages.size,
+        packages,
+        duplicates,
+    };
+}
+/**
+ * Statically parses a yarn.lock file without executing yarn.
+ */
+export function parseYarnLock(content) {
+    const packages = new Map();
+    const lines = content.split(/\r?\n/);
+    let currentHeader = null;
+    for (const rawLine of lines) {
+        const line = rawLine.trimEnd();
+        if (!line || line.startsWith('#'))
+            continue;
+        if (!line.startsWith(' ') && line.endsWith(':')) {
+            currentHeader = line.slice(0, -1).trim();
+        }
+        else if (currentHeader && line.trim().startsWith('version ')) {
+            const verMatch = /version\s+["']?([^"']+)["']?/.exec(line.trim());
+            const version = verMatch?.[1];
+            if (version) {
+                const firstSpec = currentHeader
+                    .split(',')[0]
+                    ?.trim()
+                    .replace(/^["']|["']$/g, '') ?? '';
+                const atIdx = firstSpec.lastIndexOf('@');
+                if (atIdx > 0) {
+                    const name = firstSpec.slice(0, atIdx);
+                    let verSet = packages.get(name);
+                    if (!verSet) {
+                        verSet = new Set();
+                        packages.set(name, verSet);
+                    }
+                    verSet.add(version);
+                }
+            }
+            currentHeader = null;
+        }
+    }
+    const duplicates = [];
+    for (const [name, versions] of packages.entries()) {
+        if (versions.size > 1) {
+            duplicates.push({
+                name,
+                versions: [...versions].sort(),
+            });
+        }
+    }
+    duplicates.sort((a, b) => a.name.localeCompare(b.name));
+    return {
+        transitiveCount: packages.size,
+        packages,
+        duplicates,
+    };
+}
+/**
+ * Statically parses a pnpm-lock.yaml file without executing pnpm.
+ */
+export function parsePnpmLock(content) {
+    const packages = new Map();
+    // Matches pnpm packages block lines like:
+    //   /@types/node@20.1.0:
+    //   /lodash@4.17.21:
+    //   lodash@4.17.21:
+    const lineRegex = /^\s*['"]?(?:\/)?((?:@[^/@]+\/)?[^/@]+)@([^('"\s:]+)/gm;
+    let match;
+    while ((match = lineRegex.exec(content)) !== null) {
+        const name = match[1];
+        const version = match[2];
+        if (name && version) {
+            let verSet = packages.get(name);
+            if (!verSet) {
+                verSet = new Set();
+                packages.set(name, verSet);
+            }
+            verSet.add(version);
+        }
+    }
+    const duplicates = [];
+    for (const [name, versions] of packages.entries()) {
+        if (versions.size > 1) {
+            duplicates.push({
+                name,
+                versions: [...versions].sort(),
+            });
+        }
+    }
+    duplicates.sort((a, b) => a.name.localeCompare(b.name));
+    return {
+        transitiveCount: packages.size,
+        packages,
+        duplicates,
+    };
+}
+//# sourceMappingURL=lockfiles.js.map

package/dist/analyzers/dependencies/lockfiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfiles.js","sourceRoot":"","sources":["../../../src/analyzers/dependencies/lockfiles.ts"],"names":[],"mappings":"AAQA;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAE5D,qCAAqC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAClF,MAAM,OAAO,GAAG,WAAmD,CAAC;YACpE,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,EAAE;oBAAE,SAAS,CAAC,+BAA+B;gBACzE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;oBAAE,SAAS;gBAE9D,+CAA+C;gBAC/C,MAAM,KAAK,GAAG,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACf,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;oBAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAChC,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;wBACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC7B,CAAC;oBACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;YACrC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtE,mCAAmC;gBACnC,SAAS,MAAM,CAAC,OAAgC;oBAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;wBACnD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;4BAAE,SAAS;wBAChD,MAAM,SAAS,GAAG,IAGjB,CAAC;wBACF,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;4BAC1C,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BAChC,IAAI,CAAC,MAAM,EAAE,CAAC;gCACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;gCACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;4BAC7B,CAAC;4BACD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;wBAChC,CAAC;wBACD,MAAM,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC;wBACzC,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;4BAC/C,MAAM,CAAC,SAAS,CAAC,CAAC;wBACpB,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,MAAM,CAAC,OAAkC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,eAAe,EAAE,CAAC;YAClB,QAAQ;YACR,UAAU,EAAE,EAAE;SACf,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI;gBACJ,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAExD,OAAO;QACL,eAAe,EAAE,QAAQ,CAAC,IAAI;QAC9B,QAAQ;QACR,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,aAAa,GAAkB,IAAI,CAAC;IAExC,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAE5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;aAAM,IAAI,aAAa,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,SAAS,GACb,aAAa;qBACV,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACd,EAAE,IAAI,EAAE;qBACP,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACzC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACd,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;oBACvC,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAChC,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;wBACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC7B,CAAC;oBACD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI;gBACJ,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAExD,OAAO;QACL,eAAe,EAAE,QAAQ,CAAC,IAAI;QAC9B,QAAQ;QACR,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEhD,0CAA0C;IAC1C,yBAAyB;IACzB,qBAAqB;IACrB,oBAAoB;IACpB,MAAM,SAAS,GAAG,uDAAuD,CAAC;IAC1E,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YACpB,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;gBACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI;gBACJ,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAExD,OAAO;QACL,eAAe,EAAE,QAAQ,CAAC,IAAI;QAC9B,QAAQ;QACR,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/analyzers/dependencies/online.d.ts

@@ -0,0 +1,19 @@
+import type { VulnerabilityAdvisory, OutdatedDependency } from './types.js';
+/**
+ * Queries the public Open Source Vulnerabilities (OSV) API in batch mode.
+ * Strictly respects timeouts and offline failures. Never transmits repository source code or tokens.
+ */
+export declare function queryVulnerabilitiesOnline(packages: Array<{
+    name: string;
+    version: string;
+    ecosystem?: string;
+}>): Promise<VulnerabilityAdvisory[]>;
+/**
+ * Checks for latest versions of direct dependencies against npm registry.
+ * Limited to first 25 packages with 2.5s individual timeout.
+ */
+export declare function checkOutdatedOnline(directDeps: Array<{
+    name: string;
+    currentVersion: string;
+}>): Promise<OutdatedDependency[]>;
+//# sourceMappingURL=online.d.ts.map

package/dist/analyzers/dependencies/online.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"online.d.ts","sourceRoot":"","sources":["../../../src/analyzers/dependencies/online.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA2B5E;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GACrE,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAgElC;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1D,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAgD/B"}