@dep-radius/core 0.1.0

package/dist/infra/hash.js

@@ -0,0 +1,18 @@
+import { createHash } from "node:crypto";
+export function sha1(data) {
+    return createHash("sha1").update(data).digest("hex");
+}
+// npm integrity strings are "sha512-<base64>"; the cache is keyed by the hex digest.
+export function integrityHex(integrity) {
+    const m = /^sha512-(.+)$/.exec(integrity.split(/\s+/).find((s) => s.startsWith("sha512-")) ?? "");
+    return m?.[1] ? Buffer.from(m[1], "base64").toString("hex") : undefined;
+}
+export function verifyIntegrity(bytes, integrity) {
+    const hex = integrityHex(integrity);
+    if (hex)
+        return createHash("sha512").update(bytes).digest("hex") === hex;
+    const sha1m = /^sha1-(.+)$/.exec(integrity);
+    if (sha1m?.[1])
+        return createHash("sha1").update(bytes).digest("base64") === sha1m[1];
+    return false;
+}

package/dist/infra/http.d.ts

@@ -0,0 +1,24 @@
+export interface HttpRequest {
+    url: string;
+    headers?: Record<string, string>;
+}
+export interface HttpResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: Buffer;
+}
+export interface HttpClient {
+    get(req: HttpRequest): Promise<HttpResponse>;
+}
+export declare class OfflineError extends Error {
+    constructor(url: string);
+}
+export declare class FetchHttp implements HttpClient {
+    private readonly retries;
+    constructor(retries?: number);
+    get(req: HttpRequest): Promise<HttpResponse>;
+}
+export declare class NoNetworkHttp implements HttpClient {
+    get(req: HttpRequest): Promise<HttpResponse>;
+}
+//# sourceMappingURL=http.d.ts.map

package/dist/infra/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/infra/http.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAC7C;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,GAAG,EAAE,MAAM;CAGxB;AAED,qBAAa,SAAU,YAAW,UAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;gBACpB,OAAO,SAAI;IAIjB,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;CAuBnD;AAED,qBAAa,aAAc,YAAW,UAAU;IACxC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;CAGnD"}

package/dist/infra/http.js

@@ -0,0 +1,44 @@
+export class OfflineError extends Error {
+    constructor(url) {
+        super(`offline: ${url}`);
+    }
+}
+export class FetchHttp {
+    retries;
+    constructor(retries = 2) {
+        this.retries = retries;
+    }
+    async get(req) {
+        let lastError;
+        for (let attempt = 0; attempt <= this.retries; attempt++) {
+            try {
+                const res = await fetch(req.url, {
+                    headers: req.headers,
+                    redirect: "follow",
+                });
+                const body = Buffer.from(await res.arrayBuffer());
+                const headers = {};
+                res.headers.forEach((v, k) => (headers[k.toLowerCase()] = v));
+                if (res.status >= 500 && attempt < this.retries) {
+                    await delay(250 * 2 ** attempt);
+                    continue;
+                }
+                return { status: res.status, headers, body };
+            }
+            catch (error) {
+                lastError = error;
+                if (attempt < this.retries)
+                    await delay(250 * 2 ** attempt);
+            }
+        }
+        throw lastError;
+    }
+}
+export class NoNetworkHttp {
+    async get(req) {
+        throw new OfflineError(req.url);
+    }
+}
+function delay(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}

package/dist/infra/limit.d.ts

@@ -0,0 +1,4 @@
+export type Limiter = <T>(fn: () => Promise<T>) => Promise<T>;
+export declare function createLimiter(concurrency: number): Limiter;
+export declare function once<K, V>(fn: (key: K) => Promise<V>): (key: K) => Promise<V>;
+//# sourceMappingURL=limit.d.ts.map

package/dist/infra/limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limit.d.ts","sourceRoot":"","sources":["../../src/infra/limit.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;AAE7D,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAqB1D;AAED,wBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAU7E"}

package/dist/infra/limit.js

@@ -0,0 +1,34 @@
+export function createLimiter(concurrency) {
+    let active = 0;
+    const queue = [];
+    const next = () => {
+        if (active >= concurrency)
+            return;
+        const run = queue.shift();
+        if (run)
+            run();
+    };
+    return (fn) => new Promise((resolve, reject) => {
+        queue.push(() => {
+            active++;
+            fn()
+                .then(resolve, reject)
+                .finally(() => {
+                active--;
+                next();
+            });
+        });
+        next();
+    });
+}
+export function once(fn) {
+    const memo = new Map();
+    return (key) => {
+        let p = memo.get(key);
+        if (!p) {
+            p = fn(key);
+            memo.set(key, p);
+        }
+        return p;
+    };
+}

package/dist/infra/log.d.ts

@@ -0,0 +1,8 @@
+export interface Logger {
+    verbose: boolean;
+    debug(msg: string): void;
+    warn(msg: string): void;
+}
+export declare function createLogger(verbose: boolean): Logger;
+export declare const silentLogger: Logger;
+//# sourceMappingURL=log.d.ts.map

package/dist/infra/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../src/infra/log.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAUrD;AAED,eAAO,MAAM,YAAY,EAAE,MAAkD,CAAA"}

package/dist/infra/log.js

@@ -0,0 +1,13 @@
+export function createLogger(verbose) {
+    return {
+        verbose,
+        debug(msg) {
+            if (verbose)
+                process.stderr.write(`radius: ${msg}\n`);
+        },
+        warn(msg) {
+            process.stderr.write(`radius: ${msg}\n`);
+        },
+    };
+}
+export const silentLogger = { verbose: false, debug() { }, warn() { } };

package/dist/inventory/installed.d.ts

@@ -0,0 +1,15 @@
+import type { Inventory } from "../model.ts";
+export interface InventoryOptions {
+    prod: boolean;
+}
+export interface ResolvedInstall {
+    dir: string;
+    realDir: string;
+    name: string;
+    version: string;
+    local: boolean;
+}
+export declare function resolveInstalled(fromDir: string, key: string, stopAt: string): Promise<ResolvedInstall | undefined>;
+export declare function projectBoundary(root: string): string;
+export declare function buildInventory(root: string, opts: InventoryOptions, files?: string[]): Promise<Inventory>;
+//# sourceMappingURL=installed.d.ts.map

package/dist/inventory/installed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed.d.ts","sourceRoot":"","sources":["../../src/inventory/installed.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAGV,SAAS,EAGV,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAA;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,OAAO,CAAA;CACf;AAGD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CA6BtC;AA8DD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQpD;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,gBAAgB,EACtB,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,SAAS,CAAC,CAmFpB"}

package/dist/inventory/installed.js

@@ -0,0 +1,241 @@
+import { existsSync } from "node:fs";
+import { dirname, join, sep } from "node:path";
+import { readdir, readFile, realpath } from "node:fs/promises";
+import semver from "semver";
+import { bunLock } from "./lockfiles/bun.js";
+import { npmLock } from "./lockfiles/npm.js";
+import { pnpmLock } from "./lockfiles/pnpm.js";
+import { yarnLock } from "./lockfiles/yarn.js";
+import { findManifests, listProjectFiles, relPath } from "./manifests.js";
+// Walks up node_modules from `fromDir` exactly as Node does, stopping at the project boundary.
+export async function resolveInstalled(fromDir, key, stopAt) {
+    let dir = fromDir;
+    for (;;) {
+        const candidate = join(dir, "node_modules", key);
+        const pj = join(candidate, "package.json");
+        if (existsSync(pj)) {
+            try {
+                const json = JSON.parse(await readFile(pj, "utf8"));
+                const realDir = await realpath(candidate);
+                const local = !realDir.split(sep).includes("node_modules");
+                return {
+                    dir: candidate,
+                    realDir,
+                    name: json.name ?? key,
+                    version: json.version ?? "0.0.0",
+                    local,
+                };
+            }
+            catch {
+                return undefined;
+            }
+        }
+        if (dir === stopAt)
+            return undefined;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+async function loadLock(root) {
+    const tries = [
+        ["pnpm-lock.yaml", pnpmLock],
+        ["package-lock.json", npmLock],
+        ["npm-shrinkwrap.json", npmLock],
+        ["yarn.lock", yarnLock],
+        ["bun.lock", bunLock],
+    ];
+    for (const [file, reader] of tries) {
+        const p = join(root, file);
+        if (!existsSync(p))
+            continue;
+        try {
+            const r = reader(await readFile(p, "utf8"));
+            if (r)
+                return r;
+        }
+        catch {
+            // unreadable lockfile: fall through to the next source
+        }
+    }
+    return undefined;
+}
+async function patchedNames(root) {
+    const names = new Set();
+    try {
+        for (const f of await readdir(join(root, "patches"))) {
+            // patch-package: name+1.2.3.patch, @scope+name+1.2.3.patch ; pnpm: name@1.2.3.patch, @scope__name@1.2.3.patch
+            const pp = /^(.+)\+\d[^+]*\.patch$/.exec(f);
+            if (pp?.[1])
+                names.add(pp[1].replace(/^(@[^+]+)\+/, "$1/"));
+            const pn = /^(.+)@\d.*\.patch$/.exec(f);
+            if (pn?.[1])
+                names.add(pn[1].replace(/^(@[^_]+)__/, "$1/"));
+        }
+    }
+    catch {
+        // no patches folder
+    }
+    try {
+        const pj = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
+        for (const k of Object.keys(pj.pnpm?.patchedDependencies ?? {}))
+            names.add(k.replace(/@[^@]*$/, "") || k);
+    }
+    catch {
+        // no root manifest
+    }
+    try {
+        const ws = await readFile(join(root, "pnpm-workspace.yaml"), "utf8");
+        const block = /^patchedDependencies:\s*\n((?:[ \t]+.*\n?)*)/m.exec(ws);
+        for (const line of block?.[1]?.split("\n") ?? []) {
+            const m = /^\s+['"]?(@?[^@'":\s]+)(?:@[^'":]*)?['"]?:/.exec(line);
+            if (m?.[1])
+                names.add(m[1]);
+        }
+    }
+    catch {
+        // no workspace file
+    }
+    return names;
+}
+// Node walks to the filesystem root; the walk stops at the enclosing git root instead, so a
+// stray ~/node_modules never answers for a project.
+export function projectBoundary(root) {
+    let dir = root;
+    for (;;) {
+        if (existsSync(join(dir, ".git")))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return dir;
+        dir = parent;
+    }
+}
+export async function buildInventory(root, opts, files) {
+    const projectFiles = files ?? (await listProjectFiles(root));
+    const manifests = await findManifests(root, projectFiles);
+    const lock = await loadLock(root);
+    const patched = await patchedNames(root);
+    const hasPnp = existsSync(join(root, ".pnp.cjs")) || existsSync(join(root, ".pnp.js"));
+    const byId = new Map();
+    const local = new Set();
+    const notAnalyzed = new Map();
+    const workspaceNames = new Set(manifests.map((m) => m.name).filter((n) => !!n));
+    for (const m of manifests) {
+        for (const d of m.deps) {
+            if (d.field === "peerDependencies" &&
+                !m.deps.some((o) => o.key === d.key && o.field !== "peerDependencies"))
+                continue;
+            if (opts.prod && d.field === "devDependencies")
+                continue;
+            if (d.specKind === "workspace" ||
+                d.specKind === "link" ||
+                d.specKind === "file") {
+                local.add(d.key);
+                continue;
+            }
+            if (d.specKind === "git" || d.specKind === "url") {
+                notAnalyzed.set(d.key, {
+                    pkg: d.key,
+                    reason: `installed from ${d.specKind} (${d.spec}), not from a registry`,
+                });
+                continue;
+            }
+            const found = await resolveDep(root, m, d, lock, hasPnp);
+            if (!found) {
+                if (workspaceNames.has(d.key))
+                    local.add(d.key);
+                else
+                    notAnalyzed.set(d.key, {
+                        pkg: d.key,
+                        reason: d.specKind === "catalog"
+                            ? "not installed and declared through catalog:, so the version is unknown"
+                            : "not installed, not in a lockfile, and the range gives no version",
+                    });
+                continue;
+            }
+            if (found.local) {
+                local.add(d.key);
+                continue;
+            }
+            let dep = byId.get(found.id);
+            if (!dep) {
+                dep = found;
+                byId.set(found.id, dep);
+            }
+            dep.declaredBy.push({
+                manifest: relPath(root, m.path),
+                key: d.key,
+                field: d.field,
+            });
+            if (patched.has(dep.name) && !dep.flags.includes("patched"))
+                dep.flags.push("patched");
+        }
+    }
+    for (const dep of byId.values())
+        notAnalyzed.delete(dep.name);
+    return {
+        root,
+        manifests,
+        installed: [...byId.values()].sort((a, b) => a.name.localeCompare(b.name) || a.version.localeCompare(b.version)),
+        local: [...local].sort(),
+        notAnalyzed: [...notAnalyzed.values()].sort((a, b) => a.pkg.localeCompare(b.pkg)),
+    };
+}
+async function resolveDep(root, m, d, lock, hasPnp) {
+    if (!hasPnp) {
+        const r = await resolveInstalled(m.dir, d.key, projectBoundary(root));
+        if (r) {
+            const flags = [];
+            if (r.name !== d.key)
+                flags.push("alias");
+            if (semver.prerelease(r.version))
+                flags.push("prerelease-installed");
+            return {
+                id: r.realDir,
+                name: r.name,
+                version: r.version,
+                versionSource: "node_modules",
+                dir: r.realDir,
+                local: r.local,
+                declaredBy: [],
+                flags,
+            };
+        }
+    }
+    if (lock) {
+        const hit = lock.lookup(relPath(root, m.dir), d.key, d.spec);
+        if (hit) {
+            const flags = [];
+            if (hit.name !== d.key)
+                flags.push("alias");
+            return {
+                id: `${lock.source}:${hit.name}@${hit.version}`,
+                name: hit.name,
+                version: hit.version,
+                versionSource: lock.source,
+                local: false,
+                declaredBy: [],
+                flags,
+            };
+        }
+    }
+    const range = d.specKind === "alias" ? d.spec.replace(/^npm:.*@/, "") : d.spec;
+    if (d.specKind === "range" || d.specKind === "alias") {
+        const min = semver.validRange(range) ? semver.minVersion(range) : null;
+        if (min) {
+            const name = d.aliasOf ?? d.key;
+            return {
+                id: `manifest-range:${name}@${min.version}`,
+                name,
+                version: min.version,
+                versionSource: "manifest-range",
+                local: false,
+                declaredBy: [],
+                flags: ["range-guess", ...(d.aliasOf ? ["alias"] : [])],
+            };
+        }
+    }
+    return undefined;
+}

package/dist/inventory/lockfiles/bun.d.ts

@@ -0,0 +1,3 @@
+import type { LockReader } from "./types.ts";
+export declare function bunLock(text: string): LockReader | undefined;
+//# sourceMappingURL=bun.d.ts.map

package/dist/inventory/lockfiles/bun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun.d.ts","sourceRoot":"","sources":["../../../src/inventory/lockfiles/bun.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAG5C,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAoB5D"}

package/dist/inventory/lockfiles/bun.js

@@ -0,0 +1,24 @@
+import ts from "typescript";
+// bun.lock is JSONC: packages["<key>"] or packages["<parent>/<key>"] = ["name@version", ...].
+export function bunLock(text) {
+    const parsed = ts.parseConfigFileTextToJson("bun.lock", text);
+    const packages = parsed.config?.packages;
+    if (!packages)
+        return undefined;
+    return {
+        source: "lockfile:bun",
+        lookup(_dir, key) {
+            const entry = packages[key];
+            const ident = Array.isArray(entry) ? entry[0] : undefined;
+            if (typeof ident !== "string")
+                return undefined;
+            const at = ident.lastIndexOf("@");
+            if (at <= 0)
+                return undefined;
+            const version = ident.slice(at + 1);
+            return /^\d/.test(version)
+                ? { version, name: ident.slice(0, at) }
+                : undefined;
+        },
+    };
+}

package/dist/inventory/lockfiles/npm.d.ts

@@ -0,0 +1,3 @@
+import type { LockReader } from "./types.ts";
+export declare function npmLock(text: string): LockReader | undefined;
+//# sourceMappingURL=npm.d.ts.map

package/dist/inventory/lockfiles/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../../src/inventory/lockfiles/npm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAG5C,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CA6B5D"}

package/dist/inventory/lockfiles/npm.js

@@ -0,0 +1,29 @@
+// package-lock.json v2/v3 and npm-shrinkwrap.json: packages["<dir>/node_modules/<key>"].
+export function npmLock(text) {
+    let json;
+    try {
+        json = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    const packages = json.packages;
+    if (!packages)
+        return undefined;
+    return {
+        source: "lockfile:npm",
+        lookup(manifestDir, key) {
+            let dir = manifestDir === "." ? "" : manifestDir;
+            for (;;) {
+                const k = dir ? `${dir}/node_modules/${key}` : `node_modules/${key}`;
+                const entry = packages[k];
+                if (entry?.version && !entry.link)
+                    return { version: entry.version, name: entry.name ?? key };
+                if (!dir)
+                    return undefined;
+                const i = dir.lastIndexOf("/");
+                dir = i < 0 ? "" : dir.slice(0, i);
+            }
+        },
+    };
+}

package/dist/inventory/lockfiles/pnpm.d.ts

@@ -0,0 +1,3 @@
+import type { LockReader } from "./types.ts";
+export declare function pnpmLock(text: string): LockReader | undefined;
+//# sourceMappingURL=pnpm.d.ts.map

package/dist/inventory/lockfiles/pnpm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.d.ts","sourceRoot":"","sources":["../../../src/inventory/lockfiles/pnpm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAS5C,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAkE7D"}

package/dist/inventory/lockfiles/pnpm.js

@@ -0,0 +1,84 @@
+// pnpm-lock.yaml v6 to v9, read by indentation rather than with a YAML parser:
+//   importers:
+//     packages/app:
+//       dependencies:
+//         left-pad:
+//           specifier: ^1.3.0
+//           version: 1.3.0
+export function pnpmLock(text) {
+    const importers = new Map();
+    const lines = text.split(/\r?\n/);
+    let inImporters = false;
+    let importer;
+    let inDeps = false;
+    let depKey;
+    for (const line of lines) {
+        if (!line.trim() || line.trimStart().startsWith("#"))
+            continue;
+        const indent = line.length - line.trimStart().length;
+        const content = line.trim();
+        if (indent === 0) {
+            inImporters = content === "importers:";
+            importer = undefined;
+            continue;
+        }
+        if (!inImporters)
+            continue;
+        if (indent === 2) {
+            const name = unquote(content.replace(/:$/, ""));
+            importer = new Map();
+            importers.set(name, importer);
+            inDeps = false;
+            continue;
+        }
+        if (indent === 4) {
+            inDeps = /^(dependencies|devDependencies|optionalDependencies):$/.test(content);
+            depKey = undefined;
+            continue;
+        }
+        if (!importer || !inDeps)
+            continue;
+        if (indent === 6) {
+            // v5 inline form "left-pad: 1.3.0", or v6+ block form "left-pad:"
+            const m = /^(.+?):\s*(.*)$/.exec(content);
+            if (!m?.[1])
+                continue;
+            depKey = unquote(m[1]);
+            if (m[2])
+                importer.set(depKey, m[2]);
+            continue;
+        }
+        if (indent === 8 && depKey) {
+            const m = /^version:\s*(.+)$/.exec(content);
+            if (m?.[1])
+                importer.set(depKey, unquote(m[1]));
+        }
+    }
+    if (importers.size === 0)
+        return undefined;
+    return {
+        source: "lockfile:pnpm",
+        lookup(manifestDir, key) {
+            const raw = importers.get(manifestDir)?.get(key);
+            if (!raw || raw.startsWith("link:") || raw.startsWith("file:"))
+                return undefined;
+            // "4.5.4(typescript@6.0.3)" -> 4.5.4 ; "/left-pad/1.3.0" (v5) -> 1.3.0 ; "npm:x@1.0.0" style handled below
+            let v = raw.replace(/\(.*$/, "");
+            let name = key;
+            const alias = /^(@?[^@]+)@(\d.*)$/.exec(v);
+            if (alias?.[1] && alias[2]) {
+                name = alias[1];
+                v = alias[2];
+            }
+            v = v.replace(/^\/.*\//, "");
+            return /^\d/.test(v) ? { version: v, name } : undefined;
+        },
+    };
+}
+function unquote(s) {
+    const t = s.trim();
+    return (t.startsWith("'") && t.endsWith("'")) ||
+        (t.startsWith('"') && t.endsWith('"'))
+        ? t.slice(1, -1)
+        : t;
+}

package/dist/inventory/lockfiles/types.d.ts

@@ -0,0 +1,9 @@
+import type { VersionSource } from "../../model.ts";
+export interface LockReader {
+    source: VersionSource;
+    lookup(manifestDir: string, key: string, spec: string): {
+        version: string;
+        name: string;
+    } | undefined;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/inventory/lockfiles/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/inventory/lockfiles/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,aAAa,CAAA;IAErB,MAAM,CACJ,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAA;CACjD"}

package/dist/inventory/lockfiles/types.js

@@ -0,0 +1 @@
+export {};

package/dist/inventory/lockfiles/yarn.d.ts

@@ -0,0 +1,3 @@
+import type { LockReader } from "./types.ts";
+export declare function yarnLock(text: string): LockReader | undefined;
+//# sourceMappingURL=yarn.d.ts.map

package/dist/inventory/lockfiles/yarn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yarn.d.ts","sourceRoot":"","sources":["../../../src/inventory/lockfiles/yarn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAG5C,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAmC7D"}

package/dist/inventory/lockfiles/yarn.js

@@ -0,0 +1,46 @@
+// yarn.lock v1 ("left-pad@^1.3.0", left-pad@^1.0.0:\n  version "1.3.0") and berry ("left-pad@npm:^1.3.0":\n  version: 1.3.0).
+export function yarnLock(text) {
+    const byDescriptor = new Map();
+    let current = [];
+    for (const line of text.split(/\r?\n/)) {
+        if (!line.trim() || line.startsWith("#"))
+            continue;
+        if (!line.startsWith(" ") && line.endsWith(":")) {
+            current = line
+                .slice(0, -1)
+                .split(/,\s*/)
+                .map((d) => d.trim().replace(/^"|"$/g, ""));
+            continue;
+        }
+        const m = /^\s+version:?\s+"?([^"\s]+)"?\s*$/.exec(line);
+        if (m?.[1] && current.length > 0) {
+            for (const d of current)
+                byDescriptor.set(d, m[1]);
+            current = [];
+        }
+    }
+    if (byDescriptor.size === 0)
+        return undefined;
+    return {
+        source: "lockfile:yarn",
+        lookup(_dir, key, spec) {
+            const candidates = [`${key}@${spec}`, `${key}@npm:${spec}`];
+            if (spec.startsWith("npm:"))
+                candidates.push(`${key}@${spec}`);
+            for (const c of candidates) {
+                const v = byDescriptor.get(c);
+                if (v)
+                    return {
+                        version: v,
+                        name: spec.startsWith("npm:") ? (aliasName(spec) ?? key) : key,
+                    };
+            }
+            return undefined;
+        },
+    };
+}
+function aliasName(spec) {
+    const rest = spec.slice(4);
+    const at = rest.lastIndexOf("@");
+    return at > 0 ? rest.slice(0, at) : undefined;
+}