@lofi-js/parser 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 philSixZero
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,214 @@
-# Temporary Holding Version
+# @lofi-js/parser
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A small, single dependency library written in typescript for parsing **lockfiles of any js package manager**. Put in a path and get the parsed lockfile data. No matter which package manager you use, it just works.
+
+## Quick Guide
+
+### Installation
+
+```bash
+npm i @lofi-js/parser
+```
+
+### Usage
+
+```ts
+import { parseLockfile } from "@lofi-js/parser";
+
+// From a path
+const lockfile = await parseLockfile("./package-lock.json");
+
+const entry = lockfile.get("react", "19.0.0");
+console.log(entry?.integrity, entry?.dependencies);
+```
+
+## Supported Lock Files
+
+| Package Manager | Lock File                                   | Version                                     |
+| --------------- | ------------------------------------------- | ------------------------------------------- |
+| npm             | `package-lock.json` / `npm-shrinkwrap.json` | `lockfileVersion` 2 and 3 (npm >= 7)        |
+| pnpm            | `pnpm-lock.yaml`                            | `lockfileVersion` 6 and 9 (pnpm >= 8)       |
+| yarn classic    | `yarn.lock`                                 | v1                                          |
+| yarn berry      | `yarn.lock`                                 | any (tested with `__metadata` version 10)   |
+| bun             | `bun.lock`                                  | any (tested with `lockfileVersion` 1 and 2) |
+
+## API
+
+### Functions
+
+#### `parseLockfile(input: string): Promise<Lockfile>`
+
+Results in a parsed lockfile. `input` is either the path to a lockfile or the content of one.
+
+```ts
+const lockfile = await parseLockfile("./package-lock.json");
+```
+
+#### `parseLockfileSync(input: string): Lockfile`
+
+Same as `parseLockfile`, but synchronous. It throws if the file can't be read.
+
+#### `findLockfile(startDir?: string, options?: { searchParents?: boolean }): Promise<string | undefined>`
+
+Looks for a lockfile in `startDir` and returns its absolute path, or `undefined` if there is none. `startDir` defaults to current working directory (`process.cwd()`).
+
+Set `searchParents: true` to increase the search in the parent directories. Might be helpful for monorepos.
+Hits in order: `package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`.
+
+```ts
+const file = await findLockfile(process.cwd(), { searchParents: true });
+const lockfile = file && (await parseLockfile(file));
+```
+
+#### `findLockfileSync(startDir?: string, options?: { searchParents?: boolean }): string | undefined`
+
+Same as `findLockfile`, but synchronous.
+
+#### `findAndParseLock(startDir?: string, options?: { searchParents?: boolean }): Promise<Lockfile | undefined>`
+
+Finds a lockfile with `findLockfile` and parses it with `parseLockfile`. It takes the same arguments as `findLockfile`. It returns `undefined` if there is no lockfile.
+
+```ts
+const lockfile = await findAndParseLock(process.cwd(), { searchParents: true });
+```
+
+#### `findAndParseLockSync(startDir?: string, options?: { searchParents?: boolean }): Lockfile | undefined`
+
+Same as `findAndParseLock`, but synchronous.
+
+### `Lockfile`
+
+The result of `parseLockfile`.
+
+| Member               | Type                                 | Description                                                                 |
+| -------------------- | ------------------------------------ | --------------------------------------------------------------------------- |
+| `kind`               | `"npm" \| "pnpm" \| "yarn" \| "bun"` | The package manager of the lockfile                                         |
+| `lockfileVersion`    | `string \| undefined`                | The version of the lockfile format                                          |
+| `entries`            | `Map<string, LockEntry>`             | All packages, keyed by `name@version`                                       |
+| `importers`          | `Map<string, Importer>`              | The project and its workspace packages, keyed by path. The root key is `''` |
+| `get(name, version)` | `LockEntry \| undefined`             | One package by name and version                                             |
+| `entriesOf(name)`    | `LockEntry[]`                        | All entries of a package, one for each version                              |
+| `versionsOf(name)`   | `string[]`                           | All versions of a package                                                   |
+
+#### Working with the dependency graph
+
+| Member                          | Returns                    | Description                                               |
+| ------------------------------- | -------------------------- | --------------------------------------------------------- |
+| `lockfile.size`                 | `number`                   | Number of packages                                        |
+| `for (const entry of lockfile)` | `LockEntry`                | Loops over all packages                                   |
+| `filter(predicate)`             | `LockEntry[]`              | All packages for which `predicate` is true                |
+| `getAll(options?)`              | `LockEntry[]`              | All packages, except the types set to `false` (see below) |
+| `dependenciesOf(entry)`         | `LockEntry[]`              | All packages that `entry` depends on                      |
+| `dependentsOf(name, version)`   | `LockEntry[]`              | All packages that depend on this package                  |
+| `traverse(options?)`            | `Generator<LockEntry>`     | Generator returning every package that can be reached     |
+| `duplicates()`                  | `Map<string, LockEntry[]>` | Packages that are installed in more than one version      |
+| `why(name, version, options?)`  | `LockEntry[][]`            | Why a package is installed                                |
+| `toJSON()`                      | `LockfileJSON`             | Plain data in JSON format                                 |
+
+```ts
+const lockfile = await parseLockfile("./package-lock.json");
+
+for (const chain of lockfile.why("js-tokens", "4.0.0")) {
+  console.log(chain.map((entry) => entry.name).join(" > "));
+}
+// react > loose-envify > js-tokens
+// react-dom > loose-envify > js-tokens
+// react-dom > react > loose-envify > js-tokens
+// react-dom > scheduler > loose-envify > js-tokens
+```
+
+`getAll` returns all dependencies. Leave out types `prod`, `dev`, `optional` and `peer` by filling the the option object. Keep in mind, that a package can have more than one type, e.g. a dev package that is also optional, which is left out if either of the types is set to `false`. `prod` means a package that is none of the others.
+
+```ts
+// All packages a production install needs
+const production = lockfile.getAll({ dev: false, optional: false });
+```
+
+Yarn does not store these types, so `getAll` treats all yarn packages as `prod`.
+
+`traverse` starts at the dependencies of the importers. Use `dev: false` to skip dev dependencies and `optional: false` to skip optional ones. Use `from` to start at other packages.
+
+```ts
+// All packages a production install needs
+const production = [...lockfile.traverse({ dev: false, optional: false })];
+```
+
+`why` stops after 50 chains. Change this with `{ limit }`.
+
+> [!note]
+> `traverse` and `why` need importers. Yarn classic lockfiles have none, so they find nothing there.
+
+### `LockEntry`
+
+One installed package.
+
+| Field                                                      | Description                                                                                  |
+| ---------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| `name`, `version`                                          | Name and version of the package                                                              |
+| `integrity`, `resolved`                                    | Integrity hash and download URL                                                              |
+| `checksum`                                                 | Checksum of the archive (yarn berry only, not an integrity hash)                             |
+| `source`                                                   | Where the package comes from: `registry`, `git`, `tarball`, `file` or `workspace`            |
+| `dev`, `optional`                                          | `true` if the package is only used through dev or optional dependencies                      |
+| `peer`                                                     | `true` if the package is only used through peer dependencies                                 |
+| `license`, `deprecated`, `hasInstallScript`                | Package metadata                                                                             |
+| `bin`, `engines`, `os`, `cpu`, `libc`                      | Package metadata                                                                             |
+| `dependencies`, `optionalDependencies`, `peerDependencies` | Sets of `name@version` keys that point to `entries`. The last two are part of `dependencies` |
+| `ranges`                                                   | The requested version range for each dependency name                                         |
+
+> [!note]
+> Not every package manager stores every field. See [Package Manager Differences](#package-manager-differences).
+
+### `Importer`
+
+The root project or a workspace package.
+
+| Field                                                                         | Description                                                    |
+| ----------------------------------------------------------------------------- | -------------------------------------------------------------- |
+| `path`                                                                        | Path relative to the lockfile. It is `''` for the root project |
+| `name`, `version`                                                             | Name and version, if the lockfile has them                     |
+| `dependencies`, `devDependencies`, `optionalDependencies`, `peerDependencies` | Sets of `name@version` keys that point to `entries`            |
+
+## Package Manager Differences And Limitations
+
+Not all fields are stored by every package manager, so that missing fields in a lockfile are `undefined` (or empty). However, `@lofi-js/parser` tries to infer as much information as possible from the available data.
+
+✅ read from the lockfile &nbsp; 🟡 partial, derived or inferred &nbsp; ❌ not stored in the lockfile
+
+| Data                       | npm | pnpm | yarn classic | yarn berry | bun |
+| -------------------------- | :-: | :--: | :----------: | :--------: | :-: |
+| `lockfileVersion`          | ✅  |  ✅  |      ✅      |     ✅     | ✅  |
+| `integrity`                | ✅  |  ✅  |      ✅      |     ❌     | ✅  |
+| `checksum`                 | ❌  |  ❌  |      ❌      |     ✅     | ❌  |
+| `resolved`                 | ✅  |  ✅  |      ✅      |     🟡     | ❌  |
+| `source`                   | 🟡  |  ✅  |      🟡      |     ✅     | ✅  |
+| Non-registry packages      | ✅  |  ✅  |      ✅      |     ✅     | ❌  |
+| `dev`                      | ✅  |  🟡  |      ❌      |     ❌     | 🟡  |
+| `optional`                 | ✅  |  ✅  |      ❌      |     ❌     | 🟡  |
+| `peer`                     | ✅  |  ❌  |      ❌      |     ❌     | ❌  |
+| `license`                  | ✅  |  ❌  |      ❌      |     ❌     | ❌  |
+| `hasInstallScript`         | ✅  |  🟡  |      ❌      |     ❌     | ❌  |
+| `deprecated`               | ✅  |  ✅  |      ❌      |     ❌     | ❌  |
+| `bin`                      | ✅  |  ❌  |      ❌      |     ✅     | ✅  |
+| `engines`                  | ✅  |  ✅  |      ❌      |     ❌     | ❌  |
+| `os`, `cpu`, `libc`        | ✅  |  ✅  |      ❌      |     ✅     | ✅  |
+| `optionalDependencies`     | ✅  |  ✅  |      ✅      |     ✅     | ✅  |
+| `peerDependencies`         | ✅  |  ✅  |      ❌      |     ❌     | ✅  |
+| `ranges`                   | ✅  |  🟡  |      ✅      |     ✅     | ✅  |
+| Importers                  | ✅  |  ✅  |      ❌      |     🟡     | ✅  |
+| Importer `devDependencies` | ✅  |  ✅  |      ❌      |     ❌     | ✅  |
+
+### Notes
+
+- **npm:** `source` is derived from the `resolved` URL (a `/-/` path segment means registry). Workspace packages are also regular entries with `source: "workspace"`. `package-lock.json` with `lockfileVersion` 1 is not supported.
+- **pnpm:** `dev` is read from lockfile v6 and inferred from the importers for v9. `ranges` only contains peer ranges. `hasInstallScript` is only available for lockfile v6. `lockfileVersion` below 6 is not supported.
+- **yarn classic:** the lockfile has no information about the project itself, so there are no importers and no `dev`/`optional` flags.
+- **yarn berry:** dev dependencies are merged into the importer's `dependencies`. Peer dependencies are only stored as ranges and are not resolved. `resolved` is only set for non-registry packages.
+- **bun:** versions of non-registry packages (git, tarball) are not recorded, so only registry packages appear. `dev` and `optional` are inferred from the importers.
+
+## Missing something?
+
+If you are missing a package manager or a feature, feel free to open an issue or submit a pull request to add support for it.
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,239 @@
+//#region src/lockfile.d.ts
+/** Where a package comes from. `workspace` means a local package of the project. */
+type Source = 'registry' | 'git' | 'tarball' | 'file' | 'workspace';
+interface LockEntry {
+  /** Package name, e.g. `react` or `@scope/pkg`. */
+  name: string;
+  /** Exact installed version. */
+  version: string;
+  /** Integrity hash of the package tarball (SRI format, e.g. `sha512-...`). */
+  integrity?: string;
+  /** Checksum of the package archive. Only in yarn berry. It is not an SRI hash! */
+  checksum?: string;
+  /** URL or path the package was resolved from. */
+  resolved?: string;
+  /** Where the package comes from. */
+  source?: Source;
+  /** `true` if the package is only used through dev dependencies. Not available for yarn. */
+  dev?: boolean;
+  /** `true` if the package is only used through optional dependencies. Not available for yarn. */
+  optional?: boolean;
+  /** `true` if the package is only used through peer dependencies. Only available for npm. */
+  peer?: boolean;
+  /** License of the package, e.g. `MIT`. */
+  license?: string;
+  /** Executables of the package. Maps the command name to the file path. */
+  bin?: Record<string, string>;
+  /** Required versions of the runtime, e.g. `{ node: ">=18" }`. */
+  engines?: Record<string, string>;
+  /** Operating systems the package works on, e.g. `["darwin"]`. */
+  os?: string[];
+  /** CPU architectures the package works on, e.g. `["arm64"]`. */
+  cpu?: string[];
+  /** C libraries the package works with, e.g. `["glibc"]`. */
+  libc?: string[];
+  /** `true` if the package runs a script when it is installed. */
+  hasInstallScript?: boolean;
+  /** Message from the author if the package is deprecated. */
+  deprecated?: string;
+  /** Keys (`name@version`) of all packages this package depends on. This includes optional and peer dependencies. */
+  dependencies: Set<string>;
+  /** Keys of the optional dependencies. These are also in `dependencies`. */
+  optionalDependencies: Set<string>;
+  /** Keys of the peer dependencies. These are also in `dependencies`. Not available for yarn. */
+  peerDependencies: Set<string>;
+  /** The version range that was requested for each dependency, by name. Not available for pnpm. */
+  ranges: Record<string, string>;
+}
+/** The root project or a workspace package. */
+interface Importer {
+  /** Path relative to the lockfile. It is empty for the root project. */
+  path: string;
+  /** Package name from the `package.json`, if the lockfile has it. */
+  name?: string;
+  /** Package version from the `package.json`, if the lockfile has it. */
+  version?: string;
+  /** Keys (`name@version`) of the dependencies. Yarn does not keep dev dependencies apart, so they are also here. */
+  dependencies: Set<string>;
+  /** Keys of the dev dependencies. */
+  devDependencies: Set<string>;
+  /** Keys of the optional dependencies. */
+  optionalDependencies: Set<string>;
+  /** Keys of the peer dependencies. */
+  peerDependencies: Set<string>;
+}
+type LockEntryExtra = Partial<Omit<LockEntry, 'name' | 'version' | 'dependencies' | 'optionalDependencies' | 'peerDependencies'>> & {
+  dependencies?: Iterable<string>;
+  optionalDependencies?: Iterable<string>;
+  peerDependencies?: Iterable<string>;
+};
+type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'bun';
+/**
+ * What kind of dependency a package is.
+ * A package can have more than one kind, e.g. a dev package that is also optional. `prod` means none of the others.
+ */
+type DependencyType = 'prod' | 'dev' | 'optional' | 'peer';
+/** Set a type to `false` to leave out the packages of that type. Every type defaults to `true`. */
+type GetAllOptions = Partial<Record<DependencyType, boolean>>;
+/** `T` with every `Set<string>` turned into a `string[]`. */
+type Serialized<T> = { [K in keyof T]: T[K] extends Set<string> ? string[] : T[K]; };
+/** What `Lockfile.toJSON()` returns. Sets become arrays and maps become objects. */
+interface LockfileJSON {
+  kind: PackageManager;
+  lockfileVersion?: string;
+  /** Keyed by `name@version`. */
+  entries: Record<string, Serialized<LockEntry>>;
+  /** Keyed by path. */
+  importers: Record<string, Serialized<Importer>>;
+}
+interface TraverseOptions {
+  /** Where to start. By default, everything the importers depend on. The start entries are included. */
+  from?: Iterable<LockEntry>;
+  /** Follow the dev dependencies of the importers. Defaults to `true`. */
+  dev?: boolean;
+  /** Follow optional dependencies. Defaults to `true`. */
+  optional?: boolean;
+}
+export declare const keyOf: (name: string, version: string) => string;
+export declare class Lockfile {
+  #private;
+  readonly kind: PackageManager;
+  /** All packages, keyed by `name@version`. */
+  readonly entries: Map<string, LockEntry>;
+  /** The root project and its workspace packages, keyed by path. The root has the key `''`. */
+  readonly importers: Map<string, Importer>;
+  /** Version of the lockfile format, if the lockfile has one. */
+  lockfileVersion?: string;
+  /** @param kind The package manager that wrote the lockfile. */
+  constructor(kind: PackageManager);
+  add(name: string, version: string, extra?: LockEntryExtra): LockEntry;
+  importer(path: string): Importer;
+  /**
+   * Returns the package with this name and version, or `undefined`.
+   *
+   * @param name The name of the package.
+   * @param version The version of the package.
+   * @returns The lock entry for the specified package name and version, or `undefined` if it does not exist.
+   */
+  get(name: string, version: string): LockEntry | undefined;
+  /**
+   * Returns all entries of a package, one for each version.
+   *
+   * @param name The name of the package.
+   * @returns An array of all entries for the specified package name.
+   */
+  entriesOf(name: string): LockEntry[];
+  /**
+   * Returns all versions of a package.
+   *
+   * @param name The name of the package.
+   * @returns An array of all versions for the specified package name.
+   */
+  versionsOf(name: string): string[];
+  /** Number of packages in the lockfile. */
+  get size(): number;
+  [Symbol.iterator](): IterableIterator<LockEntry>;
+  /** Returns all packages for which `predicate` is true. */
+  filter(predicate: (entry: LockEntry) => unknown): LockEntry[];
+  /**
+   * Returns all packages. Set a type to `false` to leave out the packages of that type.
+   * A package is left out if it has any of the types that are `false`.
+   * For example, `getAll({ dev: false, optional: false })` returns what a production install needs.
+   *
+   * **Note:** All yarn packages count as `prod`.
+   */
+  getAll(options?: GetAllOptions): LockEntry[];
+  /** Returns the packages that `entry` depends on. Dependencies that are not in the lockfile are left out. */
+  dependenciesOf(entry: LockEntry): LockEntry[];
+  /** Returns the packages that depend on the given package. */
+  dependentsOf(name: string, version: string): LockEntry[];
+  /**
+   * Visits every package that can be reached from the start, once each. The order is not defined.
+   * Without `from` it starts at the dependencies of the importers, so it finds nothing for yarn classic.
+   */
+  traverse(options?: TraverseOptions): Generator<LockEntry>;
+  /** Returns the packages with the same name that are installed in more than one version. */
+  duplicates(): Map<string, LockEntry[]>;
+  /**
+   * Explains why a package is installed. Returns the chains of packages that lead to it.
+   * Each chain starts with a package an importer depends on and ends with the given package.
+   * The shortest chains come first. The result is empty if the package is missing or if there are no importers (yarn classic).
+   *
+   * @param options.limit The most chains to return. Defaults to `50`.
+   */
+  why(name: string, version: string, options?: {
+    limit?: number;
+  }): LockEntry[][];
+  /** Returns a plain data representation that `JSON.stringify` can handle. */
+  toJSON(): LockfileJSON;
+}
+//#endregion
+//#region src/bun.d.ts
+export declare function parseBunLock(text: string): Lockfile;
+//#endregion
+//#region src/npm.d.ts
+export declare function parseNpmLock(text: string): Lockfile;
+//#endregion
+//#region src/pnpm.d.ts
+export declare function parsePnpmLock(text: string): Lockfile;
+//#endregion
+//#region src/yarn.d.ts
+export declare function parseYarnLock(text: string): Lockfile;
+//#endregion
+//#region src/index.d.ts
+/**
+ * Parse a lockfile by passing the already read contents or the path to it.
+ *
+ * @param input The contents of the lockfile or the path to it.
+ * @returns A `Promise` that resolves to a `Lockfile` object.
+ */
+export declare function parseLockfile(input: string): Promise<Lockfile>;
+/**
+ * Synchronous version of {@link parseLockfile}.
+ *
+ * @param input The contents of the lockfile or the path to it.
+ * @returns The parsed `Lockfile`.
+ */
+export declare function parseLockfileSync(input: string): Lockfile;
+/**
+ * Finds a lockfile in `startDir`, and optionally in its parent directories.
+ *
+ * @param startDir The directory to start searching from. Defaults to cwd.
+ * @param options.searchParents Also look in each parent directory, e.g. to find the root lockfile of a workspace. Defaults to `false`.
+ * @returns The absolute path of the closest lockfile, or `undefined` if none is found.
+ */
+export declare function findLockfile(startDir?: string, options?: {
+  searchParents?: boolean;
+}): Promise<string | undefined>;
+/**
+ * Synchronous version of {@link findLockfile}.
+ *
+ * @param startDir The directory to start searching from. Defaults to cwd.
+ * @param options.searchParents Also look in each parent directory, e.g. to find the root lockfile of a workspace. Defaults to `false`.
+ * @returns The absolute path of the closest lockfile, or `undefined` if none is found.
+ */
+export declare function findLockfileSync(startDir?: string, options?: {
+  searchParents?: boolean;
+}): string | undefined;
+/**
+ * Finds a lockfile with {@link findLockfile} and parses it with {@link parseLockfile}.
+ *
+ * @param startDir The directory to start searching from. Defaults to cwd.
+ * @param options.searchParents Also look in each parent directory. Defaults to `false`.
+ * @returns The parsed `Lockfile`, or `undefined` if no lockfile is found.
+ */
+export declare function findAndParseLock(startDir?: string, options?: {
+  searchParents?: boolean;
+}): Promise<Lockfile | undefined>;
+/**
+ * Synchronous version of {@link findAndParseLock}.
+ *
+ * @param startDir The directory to start searching from. Defaults to cwd.
+ * @param options.searchParents Also look in each parent directory. Defaults to `false`.
+ * @returns The parsed `Lockfile`, or `undefined` if no lockfile is found.
+ */
+export declare function findAndParseLockSync(startDir?: string, options?: {
+  searchParents?: boolean;
+}): Lockfile | undefined;
+//#endregion
+export type { DependencyType, GetAllOptions, Importer, LockEntry, LockfileJSON, PackageManager, Source, TraverseOptions };

package/dist/index.js

@@ -0,0 +1,773 @@
+import { access, readFile } from "node:fs/promises";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { parse } from "yaml";
+//#region src/lockfile.ts
+const serialize = (value) => Object.fromEntries(Object.entries(value).map(([key, item]) => [key, item instanceof Set ? [...item] : item]));
+const keyOf = (name, version) => `${name}@${version}`;
+const both = (a, b) => a === void 0 ? b : b === void 0 ? a : a && b;
+var Lockfile = class {
+	kind;
+	/** All packages, keyed by `name@version`. */
+	entries = /* @__PURE__ */ new Map();
+	/** The root project and its workspace packages, keyed by path. The root has the key `''`. */
+	importers = /* @__PURE__ */ new Map();
+	/** Version of the lockfile format, if the lockfile has one. */
+	lockfileVersion;
+	/** Reverse of `dependencies`. It is built when needed and reset when an entry is added. */
+	#dependents;
+	/** @param kind The package manager that wrote the lockfile. */
+	constructor(kind) {
+		this.kind = kind;
+	}
+	add(name, version, extra = {}) {
+		this.#dependents = void 0;
+		const key = keyOf(name, version);
+		let entry = this.entries.get(key);
+		if (!entry) {
+			entry = {
+				name,
+				version,
+				dependencies: /* @__PURE__ */ new Set(),
+				optionalDependencies: /* @__PURE__ */ new Set(),
+				peerDependencies: /* @__PURE__ */ new Set(),
+				ranges: {}
+			};
+			this.entries.set(key, entry);
+		}
+		const { dependencies, optionalDependencies, peerDependencies, ranges, dev, optional, peer, ...scalars } = extra;
+		const target = entry;
+		for (const [field, value] of Object.entries(scalars)) if (value !== void 0) target[field] ??= value;
+		entry.dev = both(entry.dev, dev);
+		entry.optional = both(entry.optional, optional);
+		entry.peer = both(entry.peer, peer);
+		for (const dep of dependencies ?? []) entry.dependencies.add(dep);
+		for (const dep of optionalDependencies ?? []) entry.optionalDependencies.add(dep);
+		for (const dep of peerDependencies ?? []) entry.peerDependencies.add(dep);
+		for (const [dep, range] of Object.entries(ranges ?? {})) entry.ranges[dep] ??= range;
+		return entry;
+	}
+	importer(path) {
+		let importer = this.importers.get(path);
+		if (!importer) {
+			importer = {
+				path,
+				dependencies: /* @__PURE__ */ new Set(),
+				devDependencies: /* @__PURE__ */ new Set(),
+				optionalDependencies: /* @__PURE__ */ new Set(),
+				peerDependencies: /* @__PURE__ */ new Set()
+			};
+			this.importers.set(path, importer);
+		}
+		return importer;
+	}
+	/**
+	* Returns the package with this name and version, or `undefined`.
+	*
+	* @param name The name of the package.
+	* @param version The version of the package.
+	* @returns The lock entry for the specified package name and version, or `undefined` if it does not exist.
+	*/
+	get(name, version) {
+		return this.entries.get(keyOf(name, version));
+	}
+	/**
+	* Returns all entries of a package, one for each version.
+	*
+	* @param name The name of the package.
+	* @returns An array of all entries for the specified package name.
+	*/
+	entriesOf(name) {
+		return this.filter((e) => e.name === name);
+	}
+	/**
+	* Returns all versions of a package.
+	*
+	* @param name The name of the package.
+	* @returns An array of all versions for the specified package name.
+	*/
+	versionsOf(name) {
+		return this.filter((e) => e.name === name).map((e) => e.version);
+	}
+	/** Number of packages in the lockfile. */
+	get size() {
+		return this.entries.size;
+	}
+	[Symbol.iterator]() {
+		return this.entries.values();
+	}
+	/** Returns all packages for which `predicate` is true. */
+	filter(predicate) {
+		return [...this.entries.values()].filter(predicate);
+	}
+	/**
+	* Returns all packages. Set a type to `false` to leave out the packages of that type.
+	* A package is left out if it has any of the types that are `false`.
+	* For example, `getAll({ dev: false, optional: false })` returns what a production install needs.
+	*
+	* **Note:** All yarn packages count as `prod`.
+	*/
+	getAll(options = {}) {
+		const { prod = true, dev = true, optional = true, peer = true } = options;
+		return this.filter((entry) => {
+			const isOtherType = entry.dev || entry.optional || entry.peer;
+			if (!prod && !isOtherType) return false;
+			return !(!dev && entry.dev || !optional && entry.optional || !peer && entry.peer);
+		});
+	}
+	/** Returns the packages that `entry` depends on. Dependencies that are not in the lockfile are left out. */
+	dependenciesOf(entry) {
+		return [...entry.dependencies].flatMap((key) => this.entries.get(key) ?? []);
+	}
+	/** Returns the packages that depend on the given package. */
+	dependentsOf(name, version) {
+		if (!this.#dependents) {
+			this.#dependents = /* @__PURE__ */ new Map();
+			for (const entry of this.entries.values()) for (const key of entry.dependencies) {
+				const list = this.#dependents.get(key);
+				if (list) list.push(entry);
+				else this.#dependents.set(key, [entry]);
+			}
+		}
+		return this.#dependents.get(keyOf(name, version)) ?? [];
+	}
+	/**
+	* Visits every package that can be reached from the start, once each. The order is not defined.
+	* Without `from` it starts at the dependencies of the importers, so it finds nothing for yarn classic.
+	*/
+	*traverse(options = {}) {
+		const { dev = true, optional = true } = options;
+		const stack = [...options.from ?? this.#directDependencies(dev, optional)];
+		const seen = /* @__PURE__ */ new Set();
+		for (let entry = stack.pop(); entry; entry = stack.pop()) {
+			if (seen.has(entry)) continue;
+			seen.add(entry);
+			yield entry;
+			for (const key of entry.dependencies) {
+				if (!optional && entry.optionalDependencies.has(key)) continue;
+				const dependency = this.entries.get(key);
+				if (dependency) stack.push(dependency);
+			}
+		}
+	}
+	/** Returns the packages with the same name that are installed in more than one version. */
+	duplicates() {
+		const byName = /* @__PURE__ */ new Map();
+		for (const entry of this.entries.values()) {
+			const list = byName.get(entry.name);
+			if (list) list.push(entry);
+			else byName.set(entry.name, [entry]);
+		}
+		return new Map([...byName].filter(([, list]) => list.length > 1));
+	}
+	/**
+	* Explains why a package is installed. Returns the chains of packages that lead to it.
+	* Each chain starts with a package an importer depends on and ends with the given package.
+	* The shortest chains come first. The result is empty if the package is missing or if there are no importers (yarn classic).
+	*
+	* @param options.limit The most chains to return. Defaults to `50`.
+	*/
+	why(name, version, options = {}) {
+		const { limit = 50 } = options;
+		const target = this.get(name, version);
+		if (!target) return [];
+		const roots = new Set(this.#directDependencies(true, true));
+		const chains = [];
+		const queue = [[target]];
+		for (let i = 0; i < queue.length && chains.length < limit; i++) {
+			const path = queue[i];
+			const head = path[path.length - 1];
+			if (roots.has(head)) chains.push([...path].reverse());
+			for (const parent of this.dependentsOf(head.name, head.version)) if (!path.includes(parent)) queue.push([...path, parent]);
+		}
+		return chains;
+	}
+	/** Returns a plain data representation that `JSON.stringify` can handle. */
+	toJSON() {
+		return {
+			kind: this.kind,
+			lockfileVersion: this.lockfileVersion,
+			entries: Object.fromEntries([...this.entries].map(([key, entry]) => [key, serialize(entry)])),
+			importers: Object.fromEntries([...this.importers].map(([path, importer]) => [path, serialize(importer)]))
+		};
+	}
+	#directDependencies(dev, optional) {
+		const keys = /* @__PURE__ */ new Set();
+		for (const importer of this.importers.values()) {
+			for (const key of importer.dependencies) keys.add(key);
+			for (const key of importer.peerDependencies) keys.add(key);
+			if (dev) for (const key of importer.devDependencies) keys.add(key);
+			if (optional) for (const key of importer.optionalDependencies) keys.add(key);
+		}
+		return [...keys].flatMap((key) => this.entries.get(key) ?? []);
+	}
+};
+//#endregion
+//#region src/util.ts
+const asList = (value) => value === void 0 ? void 0 : Array.isArray(value) ? value : [value];
+function asBin(bin, name) {
+	if (typeof bin === "string") return { [name.slice(name.lastIndexOf("/") + 1)]: bin };
+	return bin && typeof bin === "object" ? bin : void 0;
+}
+const asLicense = (license) => typeof license === "string" ? license : void 0;
+const GIT_URL = /^(?:git(?:\+|:)|github:|gitlab:|bitbucket:|gist:)|\.git(?:#|$)|codeload\.github\.com/;
+/** Registry tarballs have a `/-/` path segment; other http(s) URLs are treated as plain tarballs. */
+function sourceOfUrl(url) {
+	if (url.startsWith("file:")) return "file";
+	if (GIT_URL.test(url)) return "git";
+	return url.includes("/-/") ? "registry" : "tarball";
+}
+/**
+* Fills `dev` and `optional` where the lockfile did not record them, by walking the dependency graph from the importers.
+* `dev`: not reachable from any non-dev root. `optional`: not reachable without crossing an optional edge.
+*/
+function inferScopes(lockfile) {
+	const importers = [...lockfile.importers.values()];
+	if (importers.length === 0) return;
+	const reach = (roots, skipOptionalEdges) => {
+		const seen = /* @__PURE__ */ new Set();
+		const stack = [...roots];
+		for (let key = stack.pop(); key !== void 0; key = stack.pop()) {
+			const entry = lockfile.entries.get(key);
+			if (!entry || seen.has(key)) continue;
+			seen.add(key);
+			for (const dep of entry.dependencies) if (!(skipOptionalEdges && entry.optionalDependencies.has(dep))) stack.push(dep);
+		}
+		return seen;
+	};
+	const prod = reach(importers.flatMap((i) => [
+		...i.dependencies,
+		...i.optionalDependencies,
+		...i.peerDependencies
+	]), false);
+	const required = reach(importers.flatMap((i) => [
+		...i.dependencies,
+		...i.devDependencies,
+		...i.peerDependencies
+	]), true);
+	for (const [key, entry] of lockfile.entries) {
+		entry.dev ??= !prod.has(key);
+		entry.optional ??= !required.has(key);
+	}
+}
+//#endregion
+//#region src/bun.ts
+function identify(ident) {
+	const at = ident.indexOf("@", 1);
+	if (at <= 0) return void 0;
+	const spec = ident.slice(at + 1);
+	if (spec.startsWith("npm:")) return identify(spec.slice(4));
+	return /^\d/.test(spec) ? {
+		name: ident.slice(0, at),
+		version: spec
+	} : void 0;
+}
+const infoOf = (pkg) => pkg.slice(1, 3).find((x) => x && typeof x === "object" && !Array.isArray(x)) ?? {};
+/** Splits a lockfile key such as `@scope/a/b` into its package segments `@scope/a`, `b`. */
+function segments(key) {
+	const parts = key.split("/");
+	const result = [];
+	for (let i = 0; i < parts.length; i++) result.push(parts[i].startsWith("@") && i + 1 < parts.length ? `${parts[i]}/${parts[++i]}` : parts[i]);
+	return result;
+}
+function parseBunLock(text) {
+	const doc = parse(text);
+	if (!doc?.packages) throw new Error("bun.lock has no packages section");
+	const keyByPath = /* @__PURE__ */ new Map();
+	for (const [lockKey, pkg] of Object.entries(doc.packages)) {
+		const id = identify(pkg[0]);
+		if (id) keyByPath.set(lockKey, keyOf(id.name, id.version));
+	}
+	const resolve = (parent, dep) => {
+		for (let base = parent;; base = base.slice(0, -1)) {
+			const target = keyByPath.get([...base, dep].join("/"));
+			if (target) return target;
+			if (base.length === 0) return void 0;
+		}
+	};
+	const resolveAll = (parent, names) => {
+		const keys = /* @__PURE__ */ new Set();
+		for (const dep of names) {
+			const key = resolve(parent, dep);
+			if (key) keys.add(key);
+		}
+		return keys;
+	};
+	const lockfile = new Lockfile("bun");
+	if (doc.lockfileVersion !== void 0) lockfile.lockfileVersion = String(doc.lockfileVersion);
+	for (const [lockKey, pkg] of Object.entries(doc.packages)) {
+		const id = identify(pkg[0]);
+		if (!id) continue;
+		const info = infoOf(pkg);
+		const parent = segments(lockKey);
+		const optionalDependencies = resolveAll(parent, [...Object.keys(info.optionalDependencies ?? {}), ...info.optionalPeers ?? []]);
+		const peerDependencies = resolveAll(parent, Object.keys(info.peerDependencies ?? {}));
+		const integrity = typeof pkg[3] === "string" && pkg[3].startsWith("sha") ? pkg[3] : void 0;
+		lockfile.add(id.name, id.version, {
+			integrity,
+			source: "registry",
+			bin: asBin(info.bin, id.name),
+			os: asList(info.os),
+			cpu: asList(info.cpu),
+			libc: asList(info.libc),
+			dependencies: /* @__PURE__ */ new Set([
+				...resolveAll(parent, Object.keys(info.dependencies ?? {})),
+				...optionalDependencies,
+				...peerDependencies
+			]),
+			optionalDependencies,
+			peerDependencies,
+			ranges: {
+				...info.peerDependencies,
+				...info.optionalDependencies,
+				...info.dependencies
+			}
+		});
+	}
+	for (const [workspacePath, workspace] of Object.entries(doc.workspaces ?? {})) {
+		const importer = lockfile.importer(workspacePath);
+		importer.name = workspace.name;
+		importer.version = workspace.version;
+		const parent = workspacePath && workspace.name ? [workspace.name] : [];
+		importer.dependencies = resolveAll(parent, Object.keys(workspace.dependencies ?? {}));
+		importer.devDependencies = resolveAll(parent, Object.keys(workspace.devDependencies ?? {}));
+		importer.optionalDependencies = resolveAll(parent, Object.keys(workspace.optionalDependencies ?? {}));
+		importer.peerDependencies = resolveAll(parent, Object.keys(workspace.peerDependencies ?? {}));
+	}
+	inferScopes(lockfile);
+	return lockfile;
+}
+//#endregion
+//#region src/npm.ts
+const LAST_PACKAGE_SEGMENT = /(?:^|\/)node_modules\/(?:@[^/]+\/)?[^/]+$/;
+const isInstalled = (pkgPath) => pkgPath.includes("node_modules/");
+function sourceOf$1(pkgPath, info) {
+	if (!isInstalled(pkgPath)) return "workspace";
+	return info.resolved ? sourceOfUrl(info.resolved) : void 0;
+}
+function parseNpmLock(text) {
+	const json = JSON.parse(text);
+	if (!json.packages) throw new Error("package-lock.json lockfileVersion 1 is not supported; regenerate it with npm >= 7");
+	const lockfile = new Lockfile("npm");
+	if (json.lockfileVersion !== void 0) lockfile.lockfileVersion = String(json.lockfileVersion);
+	const keyByPath = /* @__PURE__ */ new Map();
+	for (const [pkgPath, info] of Object.entries(json.packages)) {
+		if (!pkgPath || info.link) continue;
+		const name = info.name ?? pkgPath.slice(pkgPath.lastIndexOf("node_modules/") + 13);
+		if (!name || !info.version) continue;
+		keyByPath.set(pkgPath, keyOf(name, info.version));
+	}
+	const resolve = (pkgPath, dep) => {
+		let base = pkgPath;
+		for (;;) {
+			const target = keyByPath.get(`${base ? `${base}/` : ""}node_modules/${dep}`);
+			if (target) return target;
+			if (!base) return void 0;
+			const parent = base.replace(LAST_PACKAGE_SEGMENT, "");
+			base = parent === base ? "" : parent;
+		}
+	};
+	const resolveAll = (pkgPath, deps) => {
+		const keys = /* @__PURE__ */ new Set();
+		for (const dep of Object.keys(deps ?? {})) {
+			const key = resolve(pkgPath, dep);
+			if (key) keys.add(key);
+		}
+		return keys;
+	};
+	for (const [pkgPath, info] of Object.entries(json.packages)) {
+		const key = keyByPath.get(pkgPath);
+		if (!key || !info.version) continue;
+		const name = key.slice(0, key.length - info.version.length - 1);
+		const optionalDependencies = resolveAll(pkgPath, info.optionalDependencies);
+		const peerDependencies = resolveAll(pkgPath, info.peerDependencies);
+		lockfile.add(name, info.version, {
+			integrity: info.integrity,
+			resolved: info.resolved,
+			source: sourceOf$1(pkgPath, info),
+			dev: info.dev === true || info.devOptional === true,
+			optional: info.optional === true || info.devOptional === true,
+			peer: info.peer === true,
+			license: asLicense(info.license),
+			bin: asBin(info.bin, name),
+			engines: Array.isArray(info.engines) ? void 0 : info.engines,
+			os: asList(info.os),
+			cpu: asList(info.cpu),
+			libc: asList(info.libc),
+			hasInstallScript: info.hasInstallScript,
+			deprecated: info.deprecated,
+			dependencies: /* @__PURE__ */ new Set([
+				...resolveAll(pkgPath, info.dependencies),
+				...optionalDependencies,
+				...peerDependencies
+			]),
+			optionalDependencies,
+			peerDependencies,
+			ranges: {
+				...info.peerDependencies,
+				...info.optionalDependencies,
+				...info.dependencies
+			}
+		});
+	}
+	for (const [pkgPath, info] of Object.entries(json.packages)) {
+		if (info.link || isInstalled(pkgPath)) continue;
+		const importer = lockfile.importer(pkgPath);
+		importer.name = info.name;
+		importer.version = info.version;
+		importer.dependencies = resolveAll(pkgPath, info.dependencies);
+		importer.devDependencies = resolveAll(pkgPath, info.devDependencies);
+		importer.optionalDependencies = resolveAll(pkgPath, info.optionalDependencies);
+		importer.peerDependencies = resolveAll(pkgPath, info.peerDependencies);
+	}
+	return lockfile;
+}
+//#endregion
+//#region src/pnpm.ts
+const NUMERIC = /^\d/;
+/** Splits a package or snapshot key into its name and spec; the spec is a version unless the package is not from a registry. */
+function parseKey(rawKey) {
+	const s = (rawKey.startsWith("/") ? rawKey.slice(1) : rawKey).replace(/\(.*$/, "");
+	const at = s.indexOf("@", 1);
+	if (at <= 0) return void 0;
+	const spec = s.slice(at + 1);
+	return {
+		name: s.slice(0, at),
+		spec: NUMERIC.test(spec) ? spec.split("_")[0] : spec
+	};
+}
+function sourceOf(spec, resolution) {
+	if (NUMERIC.test(spec)) return "registry";
+	if (resolution?.type === "git" || resolution?.repo) return "git";
+	if (resolution?.type === "directory" || resolution?.directory) return "file";
+	return sourceOfUrl(spec);
+}
+function parsePnpmLock(text) {
+	const doc = parse(text);
+	if (!doc || typeof doc !== "object" || doc.lockfileVersion === void 0) throw new Error("Not a pnpm-lock.yaml: lockfileVersion is missing");
+	if (Number.parseFloat(String(doc.lockfileVersion)) < 6) throw new Error(`pnpm-lock.yaml lockfileVersion ${doc.lockfileVersion} is not supported; use pnpm >= 8`);
+	const keyBySpec = /* @__PURE__ */ new Map();
+	const metas = /* @__PURE__ */ new Map();
+	for (const [rawKey, info] of Object.entries(doc.packages ?? {})) {
+		const id = parseKey(rawKey);
+		const version = id && (NUMERIC.test(id.spec) ? id.spec : info.version);
+		if (!id || !version) continue;
+		keyBySpec.set(`${id.name}@${id.spec}`, keyOf(id.name, String(version)));
+		metas.set(`${id.name}@${id.spec}`, info);
+	}
+	const resolveDependency = (depName, rawValue) => {
+		const value = String(rawValue).replace(/\(.*$/, "");
+		if (value.startsWith("link:")) return void 0;
+		if (NUMERIC.test(value)) return keyOf(depName, value.split("_")[0]);
+		const alias = value.startsWith("/") || value.indexOf("@", 1) > 0 ? parseKey(value) : void 0;
+		if (alias && NUMERIC.test(alias.spec)) return keyOf(alias.name, alias.spec);
+		return keyBySpec.get(alias ? `${alias.name}@${alias.spec}` : `${depName}@${value}`);
+	};
+	const lockfile = new Lockfile("pnpm");
+	if (doc.lockfileVersion !== void 0) lockfile.lockfileVersion = String(doc.lockfileVersion);
+	for (const [rawKey, info] of Object.entries(doc.snapshots ?? doc.packages ?? {})) {
+		const id = parseKey(rawKey);
+		if (!id) continue;
+		const meta = metas.get(`${id.name}@${id.spec}`);
+		const key = keyBySpec.get(`${id.name}@${id.spec}`);
+		if (!key || !meta) continue;
+		const version = key.slice(id.name.length + 1);
+		const resolved = /* @__PURE__ */ new Map();
+		const optionalDependencies = /* @__PURE__ */ new Set();
+		for (const [depName, value] of Object.entries(info.dependencies ?? {})) {
+			const target = resolveDependency(depName, value);
+			if (target) resolved.set(depName, target);
+		}
+		for (const [depName, value] of Object.entries(info.optionalDependencies ?? {})) {
+			const target = resolveDependency(depName, value);
+			if (!target) continue;
+			resolved.set(depName, target);
+			optionalDependencies.add(target);
+		}
+		const peerDependencies = /* @__PURE__ */ new Set();
+		for (const peer of Object.keys(meta.peerDependencies ?? {})) {
+			const target = resolved.get(peer);
+			if (target) peerDependencies.add(target);
+		}
+		const resolution = meta.resolution;
+		lockfile.add(id.name, version, {
+			integrity: resolution?.integrity,
+			resolved: resolution?.tarball ?? resolution?.directory ?? (resolution?.repo ? `${resolution.repo}#${resolution.commit}` : void 0),
+			source: sourceOf(id.spec, resolution),
+			dev: meta.dev,
+			optional: info.optional === true || meta.optional === true,
+			engines: meta.engines,
+			os: asList(meta.os),
+			cpu: asList(meta.cpu),
+			libc: asList(meta.libc),
+			hasInstallScript: info.requiresBuild ?? meta.requiresBuild,
+			deprecated: meta.deprecated,
+			dependencies: resolved.values(),
+			optionalDependencies,
+			peerDependencies,
+			ranges: meta.peerDependencies
+		});
+	}
+	const importers = doc.importers ?? (doc.dependencies || doc.devDependencies || doc.optionalDependencies ? { ".": doc } : {});
+	const resolveImporterDeps = (deps) => {
+		const keys = /* @__PURE__ */ new Set();
+		for (const [depName, value] of Object.entries(deps ?? {})) {
+			const target = resolveDependency(depName, typeof value === "string" ? value : value.version);
+			if (target) keys.add(target);
+		}
+		return keys;
+	};
+	for (const [importerPath, info] of Object.entries(importers)) {
+		const importer = lockfile.importer(importerPath === "." ? "" : importerPath);
+		importer.dependencies = resolveImporterDeps(info.dependencies);
+		importer.devDependencies = resolveImporterDeps(info.devDependencies);
+		importer.optionalDependencies = resolveImporterDeps(info.optionalDependencies);
+	}
+	inferScopes(lockfile);
+	return lockfile;
+}
+//#endregion
+//#region src/yarn.ts
+const nameOfDescriptor = (descriptor) => descriptor.slice(0, descriptor.indexOf("@", 1));
+function link(lockfile, entries, keyByDescriptor, candidates) {
+	const resolve = (name, range) => candidates(name, range).map((c) => keyByDescriptor.get(c)).find(Boolean);
+	for (const [descriptor, info] of entries) {
+		if (!keyByDescriptor.get(descriptor) || !info.version) continue;
+		const { dependencies, optionalDependencies } = resolveDependencies(info, resolve);
+		lockfile.add(nameOfDescriptor(descriptor), info.version, {
+			dependencies,
+			optionalDependencies,
+			ranges: {
+				...info.dependencies,
+				...info.optionalDependencies
+			}
+		});
+	}
+}
+function resolveDependencies(info, resolve) {
+	const dependencies = /* @__PURE__ */ new Set();
+	const optionalDependencies = /* @__PURE__ */ new Set();
+	const add = (deps, optional) => {
+		for (const [dep, range] of Object.entries(deps ?? {})) {
+			const target = resolve(dep, range);
+			if (!target) continue;
+			dependencies.add(target);
+			if (optional(dep)) optionalDependencies.add(target);
+		}
+	};
+	add(info.dependencies, (name) => info.dependenciesMeta?.[name]?.optional === true);
+	add(info.optionalDependencies, () => true);
+	return {
+		dependencies,
+		optionalDependencies
+	};
+}
+const QUOTED = String.raw`"(?:[^"\\]|\\.)*"`;
+const DESCRIPTOR = new RegExp(`${QUOTED}|[^\\s,]+`, "g");
+const SECTION = new RegExp(`^(${QUOTED}|[^\\s:]+):$`);
+const FIELD = new RegExp(`^(${QUOTED}|\\S+)\\s+(.*)$`);
+const unquote = (value) => value.startsWith("\"") ? JSON.parse(value) : value;
+/** Parses the yarn v1 format: `descriptor, descriptor:` headers followed by indented `key value` lines and `key:` sections. */
+function parseClassicText(text) {
+	const entries = {};
+	let entry;
+	let section;
+	for (const rawLine of text.split(/\r?\n/)) {
+		const line = rawLine.trim();
+		if (!line || line.startsWith("#")) continue;
+		const indent = rawLine.length - rawLine.trimStart().length;
+		if (indent === 0) {
+			entry = {};
+			section = void 0;
+			for (const [descriptor] of line.replace(/:$/, "").matchAll(DESCRIPTOR)) entries[unquote(descriptor)] = entry;
+		} else if (!entry) throw new Error("yarn.lock is not valid: found a field outside of an entry");
+		else if (indent === 2) {
+			const sectionName = SECTION.exec(line)?.[1];
+			if (sectionName) {
+				section = {};
+				entry[unquote(sectionName)] = section;
+				continue;
+			}
+			const [, key, value] = FIELD.exec(line) ?? [];
+			if (key && value !== void 0) entry[unquote(key)] = unquote(value);
+		} else if (section) {
+			const [, name, range] = FIELD.exec(line) ?? [];
+			if (name && range !== void 0) section[unquote(name)] = unquote(range);
+		}
+	}
+	return entries;
+}
+function parseClassic(text) {
+	const object = parseClassicText(text);
+	const lockfile = new Lockfile("yarn");
+	lockfile.lockfileVersion = "1";
+	const keyByDescriptor = /* @__PURE__ */ new Map();
+	const entries = Object.entries(object);
+	for (const [descriptor, info] of entries) {
+		if (!info.version) continue;
+		const name = nameOfDescriptor(descriptor);
+		keyByDescriptor.set(descriptor, keyOf(name, info.version));
+		lockfile.add(name, info.version, {
+			integrity: info.integrity,
+			resolved: info.resolved,
+			source: info.resolved ? sourceOfUrl(info.resolved) : void 0
+		});
+	}
+	link(lockfile, entries, keyByDescriptor, (name, range) => [`${name}@${range}`]);
+	return lockfile;
+}
+/** Returns undefined for entries that are not installed packages (patches, links, generated). */
+function berrySource(spec) {
+	if (spec.startsWith("npm:")) return "registry";
+	if (/^(?:patch|portal|link|exec):/.test(spec)) return void 0;
+	return sourceOfUrl(spec);
+}
+function parseConditions(conditions) {
+	const result = {};
+	for (const [, field, value] of (conditions ?? "").matchAll(/\b(os|cpu|libc)=([^\s&|]+)/g)) (result[field] ??= []).push(value);
+	return result;
+}
+function parseBerry(text) {
+	const doc = parse(text);
+	const lockfile = new Lockfile("yarn");
+	const metadata = doc.__metadata;
+	if (metadata?.version !== void 0) lockfile.lockfileVersion = String(metadata.version);
+	const keyByDescriptor = /* @__PURE__ */ new Map();
+	const entries = [];
+	const workspaces = [];
+	for (const [descriptors, info] of Object.entries(doc)) {
+		if (descriptors === "__metadata" || !info.version || !info.resolution) continue;
+		const name = nameOfDescriptor(info.resolution);
+		const spec = info.resolution.slice(name.length + 1);
+		if (spec.startsWith("workspace:")) {
+			workspaces.push([descriptors, info]);
+			continue;
+		}
+		const source = berrySource(spec);
+		if (!source) continue;
+		for (const descriptor of descriptors.split(",").map((d) => d.trim())) {
+			keyByDescriptor.set(descriptor, keyOf(name, info.version));
+			entries.push([descriptor, info]);
+		}
+		lockfile.add(name, info.version, {
+			checksum: info.checksum,
+			resolved: source === "registry" ? void 0 : spec,
+			source,
+			bin: asBin(info.bin, name),
+			...parseConditions(info.conditions)
+		});
+	}
+	const candidates = (name, range) => [`${name}@${range}`, `${name}@npm:${range}`];
+	link(lockfile, entries, keyByDescriptor, candidates);
+	for (const [, info] of workspaces) {
+		const name = nameOfDescriptor(info.resolution);
+		const workspacePath = info.resolution.slice(name.length + 11);
+		const importer = lockfile.importer(workspacePath === "." ? "" : workspacePath);
+		importer.name = name;
+		if (!info.version.startsWith("0.0.0-use.local")) importer.version = info.version;
+		const { dependencies, optionalDependencies } = resolveDependencies(info, (dep, range) => candidates(dep, range).map((c) => keyByDescriptor.get(c)).find(Boolean));
+		for (const key of optionalDependencies) dependencies.delete(key);
+		importer.dependencies = dependencies;
+		importer.optionalDependencies = optionalDependencies;
+	}
+	return lockfile;
+}
+function parseYarnLock(text) {
+	return /^__metadata:/m.test(text) ? parseBerry(text) : parseClassic(text);
+}
+//#endregion
+//#region src/index.ts
+const PARSER_BY_FILENAME = {
+	"package-lock.json": parseNpmLock,
+	"npm-shrinkwrap.json": parseNpmLock,
+	"pnpm-lock.yaml": parsePnpmLock,
+	"yarn.lock": parseYarnLock,
+	"bun.lock": parseBunLock
+};
+function detectParser(text) {
+	if (text.trimStart().startsWith("{")) try {
+		const { packages } = JSON.parse(text);
+		const first = Object.values(packages ?? {})[0];
+		return Array.isArray(first) ? parseBunLock : parseNpmLock;
+	} catch {
+		return parseBunLock;
+	}
+	return /^lockfileVersion:/m.test(text) ? parsePnpmLock : parseYarnLock;
+}
+const isContent = (input) => input.includes("\n") || input.trimStart().startsWith("{");
+function parseText(text, file) {
+	return (file && PARSER_BY_FILENAME[path.basename(file)] || detectParser(text))(text);
+}
+function* nextFile(startDir, searchParents) {
+	for (let dir = path.resolve(startDir);; dir = path.dirname(dir)) {
+		for (const name of Object.keys(PARSER_BY_FILENAME)) yield path.join(dir, name);
+		if (!searchParents || path.dirname(dir) === dir) return;
+	}
+}
+/**
+* Parse a lockfile by passing the already read contents or the path to it.
+*
+* @param input The contents of the lockfile or the path to it.
+* @returns A `Promise` that resolves to a `Lockfile` object.
+*/
+async function parseLockfile(input) {
+	if (isContent(input)) return parseText(input);
+	return parseText(await readFile(input, "utf8"), input);
+}
+/**
+* Synchronous version of {@link parseLockfile}.
+*
+* @param input The contents of the lockfile or the path to it.
+* @returns The parsed `Lockfile`.
+*/
+function parseLockfileSync(input) {
+	if (isContent(input)) return parseText(input);
+	return parseText(readFileSync(input, "utf8"), input);
+}
+/**
+* Finds a lockfile in `startDir`, and optionally in its parent directories.
+*
+* @param startDir The directory to start searching from. Defaults to cwd.
+* @param options.searchParents Also look in each parent directory, e.g. to find the root lockfile of a workspace. Defaults to `false`.
+* @returns The absolute path of the closest lockfile, or `undefined` if none is found.
+*/
+async function findLockfile(startDir = process.cwd(), options = {}) {
+	for (const file of nextFile(startDir, options.searchParents ?? false)) try {
+		await access(file);
+		return file;
+	} catch {}
+}
+/**
+* Synchronous version of {@link findLockfile}.
+*
+* @param startDir The directory to start searching from. Defaults to cwd.
+* @param options.searchParents Also look in each parent directory, e.g. to find the root lockfile of a workspace. Defaults to `false`.
+* @returns The absolute path of the closest lockfile, or `undefined` if none is found.
+*/
+function findLockfileSync(startDir = process.cwd(), options = {}) {
+	for (const file of nextFile(startDir, options.searchParents ?? false)) if (existsSync(file)) return file;
+}
+/**
+* Finds a lockfile with {@link findLockfile} and parses it with {@link parseLockfile}.
+*
+* @param startDir The directory to start searching from. Defaults to cwd.
+* @param options.searchParents Also look in each parent directory. Defaults to `false`.
+* @returns The parsed `Lockfile`, or `undefined` if no lockfile is found.
+*/
+async function findAndParseLock(startDir, options) {
+	const file = await findLockfile(startDir, options);
+	return file === void 0 ? void 0 : parseLockfile(file);
+}
+/**
+* Synchronous version of {@link findAndParseLock}.
+*
+* @param startDir The directory to start searching from. Defaults to cwd.
+* @param options.searchParents Also look in each parent directory. Defaults to `false`.
+* @returns The parsed `Lockfile`, or `undefined` if no lockfile is found.
+*/
+function findAndParseLockSync(startDir, options) {
+	const file = findLockfileSync(startDir, options);
+	return file === void 0 ? void 0 : parseLockfileSync(file);
+}
+//#endregion
+export { Lockfile, findAndParseLock, findAndParseLockSync, findLockfile, findLockfileSync, keyOf, parseBunLock, parseLockfile, parseLockfileSync, parseNpmLock, parsePnpmLock, parseYarnLock };

package/package.json

@@ -1,6 +1,60 @@
 {
   "name": "@lofi-js/parser",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "A typescript lockfile parser. Parse lockfiles of any package manager (npm, pnpm, yarn, bun).",
+  "keywords": [
+    "bun.lock",
+    "lockfile",
+    "package-lock",
+    "parser",
+    "pnpm-lock",
+    "yarn.lock"
+  ],
+  "homepage": "https://github.com/lofi-js/parser#readme",
+  "bugs": {
+    "url": "https://github.com/lofi-js/parser/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lofi-js/parser.git"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "lint": "oxlint",
+    "format": "oxfmt",
+    "format:check": "oxfmt --check",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "dependencies": {
+    "yaml": "^2.9.1"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.5",
+    "oxfmt": "^0.73.0",
+    "oxlint": "^1.88.0",
+    "tsdown": "^0.23.1",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.4"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}