@exodus/stasis 1.0.0-beta.6 → 1.0.0-beta.8

package/README.md

@@ -27,7 +27,7 @@ Lockfile can attest the bundle in a readable form, but that's not required - bun
 | Modes: `add`, `replace`, `frozen`, `ignore` | Modes: `load`, `add`, `replace`, `frozen`, `ignore` |
 
 The main difference between lockfiles and bundles is that lockfiles contain integrities, and bundles contain full content.\
-See [file formats](https://github.com/ExodusOSS/stasis/blob/main/doc/file-formats.md).
+See [file formats](https://github.com/PreventiveMeasures/stasis/blob/main/doc/file-formats.md).
 
 Both can be run in full scope (default) or just in `node_modules` scope.
 
@@ -58,38 +58,40 @@ _Lockfiles (npm/pnpm/etc) not mentioned: they are like the "tarball" column, but
 | `stasis run --lock=add --bundle=add --mock app.js` | build without the app's side effects (network, fs writes) |
 | `stasis run --lock=add --child-process app.js` | also attest modules loaded in forked child processes (e.g. Metro transform workers) |
 | `stasis run --bundle=add --fs=sync app.js` | build a bundle that also captures sync `fs.readFileSync`/`readdirSync` reads |
-| `stasis run --lock=add --import=./instrument.mjs app.js` | forward extra preload modules (repeatable) to the node process running the entry: a preload's own module graph is runner infrastructure like stasis's loader itself — evaluated, but not captured. Modules the app graph *also* reaches (or that execute through a preload-transplanted `require()` pipeline) are still attested like any other app code, so frozen replays and `--bundle=load` stay fail-closed |
-| `stasis bundle src/index.js` | build a bundle statically, without executing it, into the `stasis.code.br` of the project root its paths are relative to (from a workspace package, the workspace root), where `stasis run --bundle=load` finds it |
-| `stasis bundle --add src/worker.js` | merge more entries (and their import graph) into an existing `stasis.code.br` instead of replacing it |
-| `stasis add a.js icon.svg` | add the listed files to the project's bundles (config-driven), with no dependency resolution |
-| `stasis add src assets` | same, expanding each directory to every file under it, minus an auto-excluded set unless explicitly named |
-| `stasis bundle --conditions=react-native,browser app.js` | statically bundle, asserting extra `exports`/`imports` resolution conditions |
-| `stasis bundle --mainFields=react-native,browser,main app.js` | statically bundle, honoring legacy package `mainFields` (incl. browser-field object redirection) |
-| `stasis bundle --metro --platforms=ios,android app.js` | statically bundle the way Metro resolves: RN conditions + mainFields + `.ios`/`.android`/`.native` suffixes, all platforms at once, plus each bundled native dependency's `ios/`/`android/` sources + podspec |
-| `stasis bundle --metro --metro-resolver --platforms=ios,android app.js` | same, but resolve through the project's own `metro-resolver` (byte-for-byte Metro fidelity) instead of the built-in approximation; requires `metro-resolver` installed (it ships with `react-native`/`metro`) |
-| `stasis bundle --flow app.js` | statically bundle Flow-typed sources: when oxc can't parse a `.js`/`.cjs`/`.mjs` file, strip its Flow syntax and retry so the import graph resolves (needs the optional `flow-remove-types` dependency; the stored source stays the original bytes). Combines with `--jsx`/`--conditions`/`--mainFields`/`--metro` |
-| `stasis bundle --typescript src/index.ts` | statically bundle TS sources that import by output name, the way tsc resolves: a `./x.js` (or `.jsx`/`.mjs`/`.cjs`) specifier with no such file on disk lands on its on-disk `./x.ts` or `./x.tsx` (`.tsx`/`.mts`/`.cts`) source, and an extensionless `./x` probes `./x.ts`, `./x.tsx` and `./x/index.ts(x)`; the same substitution applies to package `main`/`exports`/`imports` targets and bare subpaths, and an existing `.js` always wins over its `.ts` twin. None of this applies from or into `node_modules`, by real path: an installed package is used as published, while a monorepo's workspace packages, linked in through `node_modules`, really live outside it and resolve like the project's own files. On without the flag when every entry is TypeScript and their relative imports of JS outputs (`./x.js`) are each only on disk as the TS source (`./x.ts`) -- tsc's convention; a project of Node-compatible `.ts` files importing `./x.ts` keeps Node's resolution. Otherwise an import that fails but would resolve under it names the file and `--typescript` in the error. Combines with `--jsx`/`--conditions`/`--mainFields`/`--metro` (not `--metro-resolver`, which can't substitute) |
-| `stasis bundle --typescript --tsconfig=tsconfig.build.json src/index.ts` | same, honoring tsconfig `compilerOptions.paths` aliases (e.g. `"@/*": ["./src/*"]`, resolved against `baseUrl`, `extends` followed) for bare specifiers nothing else resolves, an extensionless target completing as tsc's does (`.ts`, `.tsx`, then `.js`, `.jsx`, then the directory's `index`); without `--tsconfig`, the `tsconfig.json` beside the importing file's `package.json` applies when present: in a monorepo (a `pnpm-workspace.yaml` or `package.json` `workspaces` at or above the cwd) the nearest named `package.json` at or above the file, else the project's one (the nearest named `package.json` at or above the cwd); never for a file in `node_modules`, and no lookup walks through one |
-| `stasis github-bundle --github=owner/name [--sha=<commit>] [--tag=<name>] [--directory=path] [--package-manager=pnpm] [src/index.js]` | statically bundle a GitHub repo at a commit, or the one `--tag` names (the default branch's head without either), as `stasis bundle` bundles a clone of it once installed: the tree is fetched (with `GITHUB_TOKEN` where set) and held to its git tree id, and the dependencies are laid out in memory from the lockfile alone (`pnpm`, `yarn1`, `npm`, or `soldeer` for `.sol` entries, a Soldeer git dependency on GitHub fetched as the repo is; without `--package-manager`, the one whose lockfile installs the directory, where only one's does), with nothing installed and no package script run; where no entries are given, they are the JS files the directory's `package.json` names (`main`, `exports`, `bin`), resolved as the build resolves (`--conditions`, `--mainFields`, `--metro --platforms`, `--typescript`), or for Soldeer its `.sol` files directly in it, under `contracts/`, and under its source directory (`foundry.toml`'s `src`, else `src/`), but tests, scripts, mocks and dependency or build directories; its paths, and the directory its `repo` names, are the directory's, or for a JS bundle, the innermost package's at or above it that holds every file it bundles (the project root's, where one is outside it, such as a sibling workspace package or the root's `node_modules`); written to `owner-name.<commit's first 7>.stasis.code.br` by default, `owner-name.<directory, its / made ->.<commit's first 7>.stasis.code.br` with `--directory` (each character outside `[A-Za-z0-9._-]` made `_`, and a directory too deep to fit in 255 characters cut, with a hash of it); takes `stasis bundle`'s options for the entries and `--lockfile` (as a library: `buildGitHubBundle` in `@exodus/stasis/vfs-bundle`, and `suggestedEntries` for the entries it would take, of a GitHub repo or a Vfs) |
-| `stasis github-bundle --github=owner/name --generate=prisma packages/api/src/index.ts` | same, with the Prisma Client each project's `prisma generate` would write first: for each project the lockfile installs with a `prisma-client` generator in its schema (the one its Prisma config names as a string literal or `path.join` of them, else `schema.prisma` or `prisma/schema.prisma`), as the Prisma it installs (7.4.0 to 7.10.0: its `prisma`, or beside Prisma 8, the one its `@prisma/prisma7` runs) writes it, byte for byte, where the generator's `output` says, the bundle then carrying it as a source like any other. Nothing of the repo runs: the schema, the config's `schema` path, and the `tsconfig.json` and `package.json` the generator infers its module format and import extensions from are read as data, its installed `prisma` only for its version (and, for an edge runtime's client, the query compiler it ships). The client is generated by the optional `@prisma/client-generator-ts` 7.10.0 dependency and rewritten as the version installed writes it; a project it can't generate for is skipped with a warning |
-| `stasis build --output=out.js app.stasis.code.br [entry]` | rebuild a runnable JS bundle with esbuild, following the bundle's recorded import graph exactly (entry optional when the bundle has one) |
+| `stasis run --lock=add --import=./instrument.mjs app.js` | also load a preload module; its own graph is runner infrastructure, not attested |
+| `stasis bundle src/index.js` | build a bundle statically, without executing it |
+| `stasis bundle --add src/worker.js` | merge more entries into the existing bundle |
+| `stasis bundle --conditions=react-native,browser app.js` | statically bundle with extra `exports`/`imports` resolution conditions |
+| `stasis bundle --mainFields=react-native,browser,main app.js` | statically bundle honoring legacy package `mainFields` |
+| `stasis bundle --metro --platforms=ios,android app.js` | statically bundle the way Metro resolves, all platforms at once |
+| `stasis bundle --typescript src/index.ts` | statically bundle TS sources, resolving `./x.js` imports to `./x.ts` as tsc does |
+| `stasis add src assets` | add files to the project's bundles as-is, with no dependency resolution |
+| `stasis github-bundle --github=owner/name --sha=<commit> src/index.js` | statically bundle a GitHub repo at a commit, with nothing installed |
+| `stasis build --output=out.js app.stasis.code.br [entry]` | rebuild a runnable JS bundle with esbuild, following the bundle's recorded import graph exactly |
 | `stasis build --output=out.js stasis.lock.json [entry]` | same, reading + verifying sources from disk against the lockfile |
 | `stasis extract app.stasis.code.br` | unpack a bundle back to sources + a `stasis.lock.json` |
 | `stasis diff --stat a.lock.json b.stasis.code.br` | summarize module/file differences between two lockfiles/bundles |
 | `stasis prune` | trim `node_modules` to the lockfile, verifying the rest |
-| `stasis audit stasis.lock.json` | report npm advisories for a lockfile's dependencies |
-| `stasis audit app.stasis.code.br` | report advisories for a bundle's dependencies: npm packages by npm's advisories, crates vendored from a registry and Composer packages by OSV's, and Soldeer packages and GitHub repos (Foundry's `lib/`) by those their GitHub repository publishes, asked with `GITHUB_TOKEN` where it is set; a Composer dev version, and a crate vendored from git or with no `.cargo-checksum.json` (never sent to OSV), are listed as not audited |
-| `stasis audit --why app.stasis.code.br` | same, with the cross-module import paths that pull each flagged package in (`run: a -> b -> c`), prefixed by the consumer that imports each chain at the top level; a chain is skipped when its full tail is already listed as its own chain |
-| `stasis audit --why-deep app.stasis.code.br` | like `--why`, but keep those longer chains too (every path, shared tails collapsed to `a -> b -> ... -> d`) |
-| `stasis audit --why-full app.stasis.code.br` | like `--why`, but spell every chain out with no `...` collapse (combine with `--why-deep` for the complete raw listing) |
-| `stasis audit --reason=run app.stasis.code.br` | show only advisories related to one consumer (`run`); with `--why`, keep only that consumer's chains |
-| `GITHUB_TOKEN=... stasis audit --repo-advisories stasis.lock.json` | also ask each dependency's GitHub repository for the advisories its maintainers published there, which npm's database has only once GitHub reviews them; needs a GitHub token in `GITHUB_TOKEN`. Each package's repository is the one its artifact records (its `package.json`'s, see `repo` in [file formats](https://github.com/ExodusOSS/stasis/blob/main/doc/file-formats.md)), else it is looked up in npm's registry, Packagist or crates.io and cached for a month in the user cache directory (`$XDG_CACHE_HOME/stasis`, `~/.cache/stasis`, `~/Library/Caches/stasis` on macOS, `%LOCALAPPDATA%\stasis\Cache` on Windows) |
+| `stasis audit stasis.lock.json` | report advisories for a lockfile's or bundle's dependencies |
+| `stasis audit --why app.stasis.code.br` | same, with the import chains that pull each flagged package in |
 | `stasis sbom --format=spdx stasis.lock.json` | export an SPDX SBOM for a lockfile or bundle |
 | `stasis sbom --format=cyclonedx app.stasis.code.br` | export a CycloneDX SBOM for a lockfile or bundle |
 
+Each command's options are documented in [doc/](https://github.com/PreventiveMeasures/stasis/tree/main/doc):
+[`bundle`](https://github.com/PreventiveMeasures/stasis/blob/main/doc/bundle.md) (and `add`),
+[`github-bundle`](https://github.com/PreventiveMeasures/stasis/blob/main/doc/github-bundle.md),
+[`build`](https://github.com/PreventiveMeasures/stasis/blob/main/doc/build.md),
+[`extract`](https://github.com/PreventiveMeasures/stasis/blob/main/doc/extract.md),
+[`diff`](https://github.com/PreventiveMeasures/stasis/blob/main/doc/diff.md),
+[`prune`](https://github.com/PreventiveMeasures/stasis/blob/main/doc/prune.md),
+[`audit`](https://github.com/PreventiveMeasures/stasis/blob/main/doc/audit.md),
+[`sbom`](https://github.com/PreventiveMeasures/stasis/blob/main/doc/sbom.md).
+`stasis bundle` also bundles Solidity, PHP, Bash and Rust sources, see [file formats](https://github.com/PreventiveMeasures/stasis/blob/main/doc/file-formats.md#source-language-bundles-solidity--php--bash--rust).
+
 ## Runtime
 
-The zero-dependency [`@exodus/stasis-core`](../stasis-core) CLI provides `run`, `prune`, and `add` commands only; the bundler plugins live in [`@exodus/stasis-plugins`](../stasis-plugins).
+The zero-dependency [`@exodus/stasis-core`](../stasis-core) CLI provides the `run`, `add`, `extract` and `prune` commands only.\
+The bundler plugins live in [`@exodus/stasis-plugins`](../stasis-plugins).
 
 ## License
 

package/bin/stasis.js

@@ -115,8 +115,9 @@ function usage(prefix = '') {
   --reason=consumer shows only advisories related to that consumer, and with --why only its chains;
   --repo-advisories also asks each package's GitHub repository for the advisories its maintainers
   published there, before GitHub reviews them into the databases above; it needs a token in
-  GITHUB_TOKEN, and asks the repository each package's artifact records, else looks one up and
-  caches it for a month in the user cache dir, e.g. ~/.cache/stasis)
+  GITHUB_TOKEN, and asks the repository each package's artifact records, else the one the
+  package.json a bundle carries of an npm package names, else looks one up and caches it for a
+  month in the user cache dir, e.g. ~/.cache/stasis)
  stasis sbom --format=(spdx|cyclonedx) [--output=(path|-)] path/to/(lockfile|bundle) ...
  (streams to stdout by default; --output=- is explicit stdout)
 `.trim())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/stasis",
-  "version": "1.0.0-beta.6",
+  "version": "1.0.0-beta.8",
   "description": "File-level source bundles and lockfiles",
   "type": "module",
   "exports": {
@@ -19,6 +19,7 @@
     "./lockfile": "./src/lockfile.js",
     "./prune": "./src/prune.js",
     "./sbom": "./src/sbom.js",
+    "./audit-corrections": "./src/audit-corrections.js",
     "./vfs-bundle": "./src/vfs-bundle.js",
     "./logo.svg": "./logo.svg"
   },
@@ -93,12 +94,12 @@
   "homepage": "https://github.com/PreventiveMeasures/stasis#readme",
   "dependencies": {
     "@exodus/bytes": "^1.16.0",
-    "@exodus/stasis-core": "1.0.0-beta.6",
-    "@exodus/stasis-plugins": "1.0.0-beta.6",
+    "@exodus/stasis-core": "1.0.0-beta.8",
+    "@exodus/stasis-plugins": "1.0.0-beta.8",
     "@preventive/archive": "1.0.0-beta.4",
-    "@preventive/deptree": "1.0.0-alpha.8",
+    "@preventive/deptree": "1.0.0-alpha.9",
     "@preventive/lockfile": "1.0.0-alpha.7",
-    "@preventive/upstream": "1.0.0-alpha.10",
+    "@preventive/upstream": "1.0.0-alpha.11",
     "@preventive/vfs": "1.0.0-beta.4",
     "oxc-parser": "^0.152.0"
   },

package/src/audit-corrections.js

@@ -6,38 +6,62 @@ import { satisfies, valid } from '@preventive/upstream/semver.js'
 // package pulled in only through corrected files is skipped by the audit (see
 // collectPackagesFromFile) -- none of its real code ships, so no advisory applies.
 //
-// Each entry names a package, the audit-irrelevant files (relative to the module
-// dir), and `range` -- the semver range VERIFIED to match the rationale. The
-// correction never applies outside it: a release could change the file, so the
-// range is widened only after re-checking the file in the new versions.
-const CORRECTIONS = [
+// Exported as `@exodus/stasis/audit-corrections`, as plain data, so a tool that
+// lays out or reads packages without stasis -- a tree @preventive/deptree builds,
+// a server reading bundles -- can apply the same corrections without its own copy.
+// Each entry names a package of `ecosystem`, one audit-irrelevant `file` (relative
+// to the module dir), `range` -- the semver range VERIFIED to match the rationale --
+// and `integrity`, the sha512 of every distinct copy of `file` the versions in
+// `range` publish, as a stasis lockfile records a file: a holder of the file's bytes
+// can tell they are one of the copies verified. The correction never applies outside
+// the range: a release could change the file, so the range is widened only after
+// re-checking the file in the new versions, adding any new copy's integrity. Frozen,
+// as the audit reads these very objects.
+export const CORRECTIONS = Object.freeze([
   {
     // ws's browser build is a noop stub -- `module.exports = function () { throw
     // new Error('ws does not work in the browser...') }` -- with none of the
-    // WebSocket implementation in it. Verified against the ws 8.21.1 tarball
-    // (latest at the time of writing); re-check browser.js before widening.
+    // WebSocket implementation in it. browser.js ships from 6.0.0 on; every copy
+    // through 8.22.0 (latest at the time of writing) is one of these two, which
+    // differ only in a space; re-check browser.js before widening.
+    ecosystem: 'npm',
     name: 'ws',
-    files: new Set(['browser.js']),
-    range: '<=8.21.1',
+    file: 'browser.js',
+    range: '<=8.22.0',
+    integrity: [
+      'sha512-98uEc4/THUpHCA7AQwBKLHHmxV6leyGmPkDAYZsoBiigxjKL8//TIb/oUKDUJLc+s/pwdGA9LR0F9e7nZHfXUQ==', // `function ()`: 6.0.0 - 6.1.1, 7.3.1 - 8.22.0
+      'sha512-F7vx6oiX9vsFoxNPTudk20Hjp7IzJePAJCYaSoX9FMJ2JaGVcFx4Bkw5W7+I3a1DsonitnosbpuG1qAMsUwH7w==', // `function()`: 6.1.2 - 7.3.0
+    ],
   },
   {
     // node-fetch's browser build re-exports the environment's native fetch
     // (`module.exports = globalObject.fetch`, plus Headers/Request/Response) --
     // none of the node-fetch implementation, where its advisories live, is in it.
-    // browser.js ships only through 2.7.0 (3.x dropped it); verified 2.6.13/2.7.0.
+    // browser.js ships only from 2.0.0 through 2.7.0 (3.x dropped it); every copy
+    // in the range is one of these, which differ in how they find the global.
+    ecosystem: 'npm',
     name: 'node-fetch',
-    files: new Set(['browser.js']),
+    file: 'browser.js',
     range: '<=2.7.0',
+    integrity: [
+      'sha512-uCZB0X6rUVIf5lZU2NN9/Z1Fd6cPCLg4M9eduYxOgSP3QZNwi0/xSa/s6AUFtvLz4y4MK02SJihOIhDoFIzdiA==', // 2.0.0 - 2.1.1
+      'sha512-toQ4RDdyjsAxTaxnaLs2AE56rXws+jMZV896U8pP0MSuKRiq8ZGKkOTMsvyCJoAJTbrgoQpr89H2n8+Z1ALcYA==', // 2.1.2
+      'sha512-LOd+I1R3xYSCHFN9oj3xeN3wa7fYYx5XQKTiKkvWn4dSYVgHI2jsXZp0mJt5KlQg3ECXXh5UtpEW7kGu1dG/aQ==', // 2.2.0 - 2.2.1
+      'sha512-2yo4Ysl+g09ocycwEBcN7IkSvM/KPpO9CW+1FI+0QfzvWJfaQepo+WEqn1/o5Og1weM14flcdv23hqZtxFXFUw==', // 2.3.0 - 2.6.0
+      'sha512-WgHaZJVwFovVrKVySaKzxzXssn5kY8y3x8NJThodDRL9nwUxV7Q1z/RRzuLZ2lNkxabHLpG/l+vu7KQ2tGbP8g==', // 2.6.1 - 2.6.7
+      'sha512-84sQFcu3uzgEsJOjIhz6tE8vInV1STCA4sX5EI9NK3Tt8n/Kb1serbKMz+YkdOAuCspHRiSUW2qV01z0wOgIXg==', // 2.6.8
+      'sha512-SkBfLO20d2Ngr6nhxgh/Pt6Yqe6oW8EB99KSPq0lrW0se8jIiRF3YpOe7hHbfNWxuNCsKoZZT98uCJI9OJAa/Q==', // 2.6.9 - 2.7.0
+    ],
   },
-]
+].map((correction) => Object.freeze({ ...correction, integrity: Object.freeze(correction.integrity) })))
 
 // Is `rel` (a file path relative to the module dir) audit-irrelevant for
-// `name@version`? Unknown or unparsable versions are never corrected (fail
-// closed: the package stays audited).
-function isCorrectedFile(name, version, rel) {
-  for (const { name: pkg, files, range } of CORRECTIONS) {
-    if (pkg !== name || !files.has(rel)) continue
-    if (valid(version) && satisfies(version, range)) return true
+// `name@version` of `ecosystem`? Unknown or unparsable versions are never
+// corrected (fail closed: the package stays audited).
+function isCorrectedFile(name, version, rel, ecosystem) {
+  for (const correction of CORRECTIONS) {
+    if (correction.ecosystem !== ecosystem || correction.name !== name || correction.file !== rel) continue
+    if (valid(version) && satisfies(version, correction.range)) return true
   }
   return false
 }
@@ -65,8 +89,8 @@ const isManifest = (rel, ecosystem) => MANIFESTS[ecosystem]?.has(rel.slice(rel.l
 // Is `rel` evidence that `name@version`'s REAL code is present, of a dependency of
 // `ecosystem` (npm by default)? This is the one rule every audit surface shares --
 // package presence, the reason column, and the --why chain graph all count a file
-// (or an edge targeting it) only when it passes. Manifests never do; corrected
-// files (npm's) don't within their verified range.
+// (or an edge targeting it) only when it passes. Manifests never do; CORRECTIONS'
+// files don't within their verified range.
 export function isEvidenceFile(name, version, rel, ecosystem = 'npm') {
-  return !isManifest(rel, ecosystem) && (ecosystem !== 'npm' || !isCorrectedFile(name, version, rel))
+  return !isManifest(rel, ecosystem) && !isCorrectedFile(name, version, rel, ecosystem)
 }

package/src/audit.js

@@ -1,8 +1,9 @@
+import { packageRepo } from '@exodus/stasis-core/bundle-util'
 import { dependencyEcosystem, moduleFileKey, sameGithub } from '@exodus/stasis-core/util'
 import { advisories } from '@preventive/upstream/advisories.js'
 import { compareVersions, valid } from '@preventive/upstream/semver.js'
 import { isEvidenceFile } from './audit-corrections.js'
-import { parseFile } from './parse.js'
+import { parseFile, parseFileWithKind } from './parse.js'
 import { collectWhy, invertReason } from './why.js'
 
 // Where advisories() asks for each ecosystem's advisories: npm's registry; OSV for crates (those
@@ -57,21 +58,37 @@ function unaudited({ ecosystem, version }) {
 // why.js apply the same evidence rule per file/edge there.
 //
 // A package's `github` is the repository its artifact records for it (its package.json's), where
-// one does; a GitHub repo is its own, and has none.
+// one does; else, for an npm package a bundle carries the package.json of (one built before builds
+// recorded `repo`), the one that names, read by the rule builds record it by. A GitHub repo is its
+// own, and has none.
 export function collectPackagesFromFile(file) {
   const out = []
-  for (const [dir, { name, version, ecosystem: tagged, repo, files }] of parseFile(file).modules) {
+  const { kind, artifact } = parseFileWithKind(file)
+  for (const [dir, { name, version, ecosystem: tagged, repo, files }] of artifact.modules) {
     const ecosystem = dependencyEcosystem(dir, tagged)
     // First-party code is never sent to a public registry (leaks names, adds noise).
     if (ecosystem === undefined) continue
     if (!name || !version) continue
     if (!Object.keys(files).some((rel) => isEvidenceFile(name, version, rel, ecosystem))) continue
-    const github = ecosystem === 'github' ? undefined : repo?.github
+    let github = ecosystem === 'github' ? undefined : repo?.github
+    if (github === undefined && ecosystem === 'npm' && kind === 'bundle') github = manifestRepo(files['package.json'])
     out.push({ ecosystem, name, version: versionOf(ecosystem, version), ...(github === undefined ? {} : { github }) })
   }
   return out
 }
 
+// The GitHub repository a bundled package.json's text names (packageRepo), or undefined where it
+// names none or doesn't parse. Read as Node reads one, past a byte order mark (packageJSONText),
+// which a bundle keeps in the text. A lockfile holds the file's digest alone, never asked here.
+function manifestRepo(text) {
+  if (typeof text !== 'string') return undefined
+  try {
+    return packageRepo(JSON.parse(text.replace(/^\uFEFF/u, '')))?.github
+  } catch {
+    return undefined
+  }
+}
+
 // Versions in semver's order where both are semver's, else as numbers in text compare.
 const byNumbers = new Intl.Collator('en', { numeric: true }).compare
 const byVersion = (a, b) => (valid(a) && valid(b) ? compareVersions(a, b) : byNumbers(a, b))