@mh-alikhani/bunready 0.1.0

package/src/rules/run/index.ts

@@ -0,0 +1,114 @@
+import type { Finding } from "../../report/types";
+import type { RunOutcome } from "../../scanner/execute";
+import { DEFAULT_RUN_OPTIONS, type RunOptions } from "../../scanner/execute";
+
+/**
+ * Findings for the `--run` phase.
+ *
+ * A timeout is a `risk`, never a `blocker`: a server that does not exit is
+ * behaving normally. A green script is `info`: the strongest evidence a scan can
+ * produce, and still not a compatibility claim.
+ */
+const INSTALL_ID = "run/install";
+const SCRIPT_FAILED_ID = "run/script-failed";
+const SCRIPT_PASSED_ID = "run/script-passed";
+const TIMEOUT_ID = "run/timeout";
+const NOTHING_TO_RUN_ID = "run/nothing-to-run";
+const CLEANUP_ID = "run/cleanup";
+const TOO_LARGE_ID = "run/copy-too-large";
+
+function megabytes(bytes: number): string {
+  return `${Math.round(bytes / (1024 * 1024))} MB`;
+}
+
+export function runFindings(
+  outcome: RunOutcome,
+  options: RunOptions = DEFAULT_RUN_OPTIONS,
+): Finding[] {
+  const findings: Finding[] = [];
+
+  if (outcome.copyTooLarge) {
+    findings.push({
+      id: TOO_LARGE_ID,
+      severity: "risk",
+      title: "the project was not executed: it is larger than the copy limit",
+      detail:
+        "Copying this repository would exceed the configured limit, so nothing was installed or run.",
+      evidence: `${megabytes(outcome.measuredBytes)} of source, limit ${options.maxCopyMegabytes} MB`,
+      hint: "raise run.maxCopyMegabytes in bunready.config.json if you want it executed anyway.",
+    });
+    return findings;
+  }
+
+  if (outcome.installFailed) {
+    findings.push({
+      id: INSTALL_ID,
+      severity: "blocker",
+      title: "the project does not install from a clean copy under Bun",
+      detail:
+        "Dependencies could not be installed in a clean copy of the repository, so nothing could be started.",
+      evidence:
+        outcome.install?.timedOut === true
+          ? `bun install did not finish within ${Math.round(options.installTimeoutMs / 1000)}s`
+          : `bun install exited with code ${outcome.install?.code ?? "unknown"}`,
+      hint:
+        outcome.failure?.message ??
+        "run `bun install` in a copy of the repository to see the full output.",
+    });
+  } else if (outcome.script === undefined) {
+    findings.push({
+      id: NOTHING_TO_RUN_ID,
+      severity: "info",
+      title: "no start or test script to run",
+      detail:
+        "The project installs cleanly, but it declares neither a `start` nor a `test` script, so there is nothing to exercise.",
+      evidence: "package.json declares no start or test script",
+      hint: "add a test script, or set run.script in bunready.config.json to the script you want.",
+    });
+  } else if (outcome.result?.timedOut === true) {
+    findings.push({
+      id: TIMEOUT_ID,
+      severity: "risk",
+      title: `bun run ${outcome.script} did not finish in time`,
+      detail:
+        "The script was still running when the timeout expired. A long-running server behaves this way, so this is not evidence of a failure.",
+      evidence: `no exit within ${Math.round(options.scriptTimeoutMs / 1000)}s`,
+      hint: "run it yourself with a longer timeout if you need a verdict on this script.",
+    });
+  } else if (outcome.result !== undefined && outcome.result.code === 0) {
+    findings.push({
+      id: SCRIPT_PASSED_ID,
+      severity: "info",
+      title: `bun run ${outcome.script} completed successfully`,
+      detail:
+        "The project installed and its script ran to completion under Bun in a clean copy. This is the strongest evidence a scan can produce.",
+      evidence: `exit code 0 after ${outcome.result.durationMs}ms`,
+    });
+  } else if (outcome.result !== undefined) {
+    findings.push({
+      id: SCRIPT_FAILED_ID,
+      severity: "blocker",
+      title: `bun run ${outcome.script} failed`,
+      detail: "The script exited with an error under Bun in a clean copy of the repository.",
+      evidence: [
+        `exit code ${outcome.result.code}`,
+        outcome.failure?.message ?? "no error line was recognised in the output",
+        ...(outcome.failure?.frames ?? []),
+      ].join("\n  "),
+      hint: `reproduce with a copy of the repository: bun install && bun run ${outcome.script}`,
+    });
+  }
+
+  if (outcome.cleanupFailed) {
+    findings.push({
+      id: CLEANUP_ID,
+      severity: "info",
+      title: "the temporary copy could not be removed",
+      detail: "The run finished but its working directory is still on disk.",
+      evidence: outcome.workDir,
+      hint: "delete it by hand; on Windows a file handle held by another process causes this.",
+    });
+  }
+
+  return findings;
+}

package/src/rules/runtime/builtins.ts

@@ -0,0 +1,148 @@
+import type { Finding } from "../../report/types";
+import { classifySpecifier, type SourceScan } from "../../scanner/sources";
+import runtimeDataset from "../data/node-runtime.json";
+
+/**
+ * Runtime-phase rule: what Node surface the repository actually depends on.
+ *
+ * The finding is deliberately an inventory with a pointer, not a verdict. Bun's
+ * Node compatibility is broad, actively changing, and version-dependent, so
+ * bunready only asserts what it can observe (these modules are imported in these
+ * files) and cites the compatibility table. A module is called out as a risk
+ * only when the vendored dataset carries a primary source for that specific
+ * claim - see docs/adr/0001-data-source-policy.md.
+ */
+const INVENTORY_ID = "runtime/node-builtins";
+const GAP_ID = "runtime/known-gap";
+const COVERAGE_ID = "runtime/scan-coverage";
+const MAX_LISTED_MODULES = 8;
+
+export interface RuntimeGapEntry {
+  readonly name: string;
+  readonly status: "partial" | "unimplemented";
+  readonly note: string;
+  readonly source: string;
+}
+
+export interface RuntimeDataset {
+  readonly compatibilityDocs: string | undefined;
+  readonly gaps: readonly RuntimeGapEntry[];
+}
+
+export interface BuiltinUsage {
+  readonly name: string;
+  readonly files: readonly string[];
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Validate the vendored dataset instead of trusting the import blindly. */
+export function readRuntimeDataset(raw: unknown = runtimeDataset): RuntimeDataset {
+  if (!isRecord(raw)) {
+    return { compatibilityDocs: undefined, gaps: [] };
+  }
+
+  const gaps: RuntimeGapEntry[] = [];
+  for (const candidate of Array.isArray(raw.gaps) ? raw.gaps : []) {
+    if (!isRecord(candidate)) {
+      continue;
+    }
+    const { name, status, note, source } = candidate;
+    if (
+      typeof name === "string" &&
+      (status === "partial" || status === "unimplemented") &&
+      typeof note === "string" &&
+      typeof source === "string"
+    ) {
+      gaps.push({ name, status, note, source });
+    }
+  }
+
+  return {
+    compatibilityDocs:
+      typeof raw.compatibilityDocs === "string" ? raw.compatibilityDocs : undefined,
+    gaps,
+  };
+}
+
+/** Node built-ins imported by the repository's own code, with where they appear. */
+export function collectNodeBuiltins(scan: SourceScan): BuiltinUsage[] {
+  const filesByName = new Map<string, Set<string>>();
+
+  for (const file of scan.files) {
+    for (const ref of file.imports) {
+      if (classifySpecifier(ref.specifier) !== "node-builtin") {
+        continue;
+      }
+      const name = ref.specifier.startsWith("node:") ? ref.specifier.slice(5) : ref.specifier;
+      const bucket = filesByName.get(name) ?? new Set<string>();
+      bucket.add(file.path);
+      filesByName.set(name, bucket);
+    }
+  }
+
+  return [...filesByName.entries()]
+    .sort((a, b) => a[0].localeCompare(b[0]))
+    .map(([name, files]) => ({ name, files: [...files].sort() }));
+}
+
+function normalise(name: string): string {
+  return name.startsWith("node:") ? name.slice(5) : name;
+}
+
+export function runtimeBuiltinFindings(
+  scan: SourceScan,
+  usages: readonly BuiltinUsage[],
+  dataset: RuntimeDataset = readRuntimeDataset(),
+): Finding[] {
+  const findings: Finding[] = [];
+  const byName = new Map(usages.map((usage) => [normalise(usage.name), usage]));
+
+  if (usages.length > 0) {
+    const listed = usages.slice(0, MAX_LISTED_MODULES).map((usage) => usage.name);
+    const remainder = usages.length - listed.length;
+    const fileCount = new Set(usages.flatMap((usage) => usage.files)).size;
+    findings.push({
+      id: INVENTORY_ID,
+      severity: "info",
+      title: `the project's own code imports ${usages.length} Node built-in module(s)`,
+      detail:
+        "Bun implements a large and still-moving part of the Node API. These are the modules this repository depends on; each was found by scanning the repository's own source, not its dependencies.",
+      evidence: `${listed.join(", ")}${remainder > 0 ? ` and ${remainder} more` : ""} (in ${fileCount} file(s))`,
+      ...(dataset.compatibilityDocs === undefined ? {} : { source: dataset.compatibilityDocs }),
+      hint: "run the project's own test suite under Bun: it decides more about your code than a compatibility table can.",
+    });
+  }
+
+  for (const gap of dataset.gaps) {
+    const usage = byName.get(normalise(gap.name));
+    if (usage === undefined) {
+      continue;
+    }
+    findings.push({
+      id: GAP_ID,
+      severity: "risk",
+      title: `${gap.name} is ${gap.status} in Bun and this project imports it`,
+      detail: gap.note,
+      evidence: `${usage.files.length} file(s), first at ${usage.files[0] ?? "unknown"}`,
+      source: gap.source,
+      hint: `check ${gap.name} against the compatibility table and cover it with a test before switching.`,
+    });
+  }
+
+  if (scan.truncated) {
+    findings.push({
+      id: COVERAGE_ID,
+      severity: "info",
+      title: "the source scan stopped at its file limit",
+      detail:
+        "The import inventory covers only part of the repository, so an imported module may be missing from it.",
+      evidence: `scanned ${scan.filesScanned} source file(s)`,
+      hint: "scan a subdirectory, or raise the limit if you need the complete inventory.",
+    });
+  }
+
+  return findings;
+}

package/src/rules/runtime/index.ts

@@ -0,0 +1,18 @@
+import { type Finding, sortFindings } from "../../report/types";
+import type { SourceScan } from "../../scanner/sources";
+import { type BuiltinUsage, type RuntimeDataset, runtimeBuiltinFindings } from "./builtins";
+
+/**
+ * Every runtime-phase rule.
+ *
+ * Currently one rule family: the Node surface the repository imports. Rules that
+ * would need compatibility claims bunready cannot source belong in the vendored
+ * dataset, not in code.
+ */
+export function runtimeFindings(
+  scan: SourceScan,
+  usages: readonly BuiltinUsage[],
+  dataset?: RuntimeDataset,
+): Finding[] {
+  return sortFindings(runtimeBuiltinFindings(scan, usages, dataset));
+}

package/src/rules/severity.ts

@@ -0,0 +1,46 @@
+/**
+ * Severity model shared by every rule.
+ *
+ * See docs/adr/0002-rule-severity-model.md: severity is a decision, not a
+ * feeling. `blocker` means the target repo cannot run correctly on Bun until it
+ * is fixed and it therefore changes the process exit code; `risk` is a real
+ * hazard that needs a human judgement call; `info` is context.
+ */
+
+export const SEVERITIES = ["blocker", "risk", "info"] as const;
+
+export type Severity = (typeof SEVERITIES)[number];
+
+/** Lower rank sorts first: blockers surface above everything else. */
+export const SEVERITY_RANK: Readonly<Record<Severity, number>> = {
+  blocker: 0,
+  risk: 1,
+  info: 2,
+};
+
+export function compareSeverity(a: Severity, b: Severity): number {
+  return SEVERITY_RANK[a] - SEVERITY_RANK[b];
+}
+
+export function countBySeverity(
+  severities: readonly Severity[],
+): Readonly<Record<Severity, number>> {
+  const counts: Record<Severity, number> = { blocker: 0, risk: 0, info: 0 };
+  for (const severity of severities) {
+    counts[severity] += 1;
+  }
+  return counts;
+}
+
+/** CI contract: blockers fail the run, risks and notes do not. */
+export function exitCodeForSeverities(severities: readonly Severity[]): number {
+  return severities.includes("blocker") ? 1 : 0;
+}
+
+/** Exit code for a set of findings, honouring a configured `failOn` threshold. */
+export function exitCodeForFindings(
+  findings: readonly { readonly severity: Severity }[],
+  failOn: Severity,
+): number {
+  return findings.some((finding) => compareSeverity(finding.severity, failOn) <= 0) ? 1 : 0;
+}

package/src/scanner/execute.ts

@@ -0,0 +1,301 @@
+import { cp, mkdtemp, readdir, rm, stat } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+import { ok, type Result } from "../core/errors";
+import type { Manifest } from "./manifest";
+
+/**
+ * `--run`: the only part of bunready that executes the target's code.
+ *
+ * Safety rules, all enforced here: always a temporary copy and never in place;
+ * VCS data, dependencies and build output are not copied; a size cap is checked
+ * before copying; every command is timed; the copy is removed even on failure.
+ * There is no network sandbox, and the report says so.
+ */
+
+export const COPY_EXCLUDES = [
+  ".git",
+  "node_modules",
+  "dist",
+  "coverage",
+  ".next",
+  ".turbo",
+  ".cache",
+] as const;
+
+export const RUNNABLE_SCRIPTS = ["start", "test"] as const;
+
+export interface ProcessResult {
+  readonly code: number | null;
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly timedOut: boolean;
+  readonly durationMs: number;
+}
+
+export interface RunCommandOptions {
+  readonly cwd: string;
+  readonly timeoutMs: number;
+}
+
+export interface CommandRunner {
+  readonly run: (command: readonly string[], options: RunCommandOptions) => Promise<ProcessResult>;
+}
+
+export interface RunEnvironment {
+  readonly runner: CommandRunner;
+  readonly makeTempDir: () => Promise<string>;
+  readonly copyProject: (from: string, to: string) => Promise<void>;
+  readonly removeDir: (path: string) => Promise<void>;
+  readonly measureTreeBytes: (path: string) => Promise<number>;
+}
+
+export interface RunFailure {
+  readonly message: string;
+  readonly frames: readonly string[];
+}
+
+export interface RunOutcome {
+  readonly workDir: string;
+  readonly script: string | undefined;
+  readonly install: ProcessResult | undefined;
+  readonly installFailed: boolean;
+  readonly result: ProcessResult | undefined;
+  readonly failure: RunFailure | undefined;
+  readonly cleanupFailed: boolean;
+  readonly measuredBytes: number;
+  readonly copyTooLarge: boolean;
+}
+
+export interface RunOptions {
+  readonly installTimeoutMs: number;
+  readonly scriptTimeoutMs: number;
+  readonly maxCopyMegabytes: number;
+  /** Explicit script name; defaults to the first of start/test that exists. */
+  readonly script?: string;
+}
+
+export const DEFAULT_RUN_OPTIONS: RunOptions = {
+  installTimeoutMs: 180_000,
+  scriptTimeoutMs: 120_000,
+  maxCopyMegabytes: 250,
+};
+
+const STACK_FRAME = /^\s+at\s+\S/;
+const ERROR_HINT = /(\berror\b|\bError\b|\bfailed\b|\bFAIL\b|✖|✗|×)/;
+const MAX_FRAMES = 5;
+
+/** The message above the first stack frame, plus a few frames. */
+export function firstFailure(output: string): RunFailure | undefined {
+  const lines = output.split(/\r?\n/).map((line) => line.trimEnd());
+
+  const stackStart = lines.findIndex((line) => STACK_FRAME.test(line));
+  if (stackStart !== -1) {
+    const frames: string[] = [];
+    for (let index = stackStart; index < lines.length && frames.length < MAX_FRAMES; index += 1) {
+      const line = lines[index] ?? "";
+      if (!STACK_FRAME.test(line)) {
+        break;
+      }
+      frames.push(line.trim());
+    }
+
+    for (let index = stackStart - 1; index >= 0; index -= 1) {
+      const candidate = (lines[index] ?? "").trim();
+      if (candidate !== "") {
+        return { message: candidate, frames };
+      }
+    }
+    return { message: frames[0] ?? "process failed", frames };
+  }
+
+  const hinted = lines.findIndex((line) => line.trim() !== "" && ERROR_HINT.test(line));
+  if (hinted === -1) {
+    return undefined;
+  }
+  return { message: (lines[hinted] ?? "").trim(), frames: [] };
+}
+
+export function pickScript(manifest: Manifest, requested?: string): string | undefined {
+  if (requested !== undefined) {
+    return typeof manifest.scripts[requested] === "string" ? requested : undefined;
+  }
+  return RUNNABLE_SCRIPTS.find((name) => typeof manifest.scripts[name] === "string");
+}
+
+export function isExcludedFromCopy(path: string): boolean {
+  return (COPY_EXCLUDES as readonly string[]).includes(basename(path));
+}
+
+export function bunCommandRunner(): CommandRunner {
+  return {
+    run: async (command, options) => {
+      const started = Date.now();
+      const child = Bun.spawn([...command], {
+        cwd: options.cwd,
+        stdout: "pipe",
+        stderr: "pipe",
+        env: { ...Bun.env, CI: "1" },
+      });
+
+      let timedOut = false;
+      const timer = setTimeout(() => {
+        timedOut = true;
+        child.kill();
+      }, options.timeoutMs);
+
+      try {
+        const [stdout, stderr] = await Promise.all([
+          new Response(child.stdout).text(),
+          new Response(child.stderr).text(),
+        ]);
+        const code = await child.exited;
+        return { code, stdout, stderr, timedOut, durationMs: Date.now() - started };
+      } finally {
+        clearTimeout(timer);
+      }
+    },
+  };
+}
+
+async function treeBytes(path: string): Promise<number> {
+  let total = 0;
+  let entries: { name: string; isDirectory: () => boolean }[];
+  try {
+    entries = (await readdir(path, { withFileTypes: true })) as unknown as {
+      name: string;
+      isDirectory: () => boolean;
+    }[];
+  } catch {
+    return 0;
+  }
+
+  for (const entry of entries) {
+    const name = String(entry.name);
+    if (isExcludedFromCopy(name)) {
+      continue;
+    }
+    const child = join(path, name);
+    if (entry.isDirectory()) {
+      total += await treeBytes(child);
+      continue;
+    }
+    try {
+      total += (await stat(child)).size;
+    } catch {
+      // An unreadable file simply does not contribute.
+    }
+  }
+  return total;
+}
+
+export function systemRunEnvironment(): RunEnvironment {
+  return {
+    runner: bunCommandRunner(),
+    makeTempDir: () => mkdtemp(join(tmpdir(), "bunready-run-")),
+    copyProject: async (from, to) => {
+      await cp(from, to, { recursive: true, filter: (source) => !isExcludedFromCopy(source) });
+    },
+    removeDir: (path) => rm(path, { recursive: true, force: true }),
+    measureTreeBytes: treeBytes,
+  };
+}
+
+async function perform(
+  workDir: string,
+  dir: string,
+  manifest: Manifest,
+  env: RunEnvironment,
+  options: RunOptions,
+): Promise<Omit<RunOutcome, "workDir" | "cleanupFailed" | "measuredBytes" | "copyTooLarge">> {
+  await env.copyProject(dir, workDir);
+
+  const install = await env.runner.run(["bun", "install"], {
+    cwd: workDir,
+    timeoutMs: options.installTimeoutMs,
+  });
+
+  if (install.timedOut || install.code !== 0) {
+    return {
+      script: undefined,
+      install,
+      installFailed: true,
+      result: undefined,
+      failure: firstFailure(`${install.stdout}\n${install.stderr}`),
+    };
+  }
+
+  const script = pickScript(manifest, options.script);
+  if (script === undefined) {
+    return {
+      script: undefined,
+      install,
+      installFailed: false,
+      result: undefined,
+      failure: undefined,
+    };
+  }
+
+  const result = await env.runner.run(["bun", "run", script], {
+    cwd: workDir,
+    timeoutMs: options.scriptTimeoutMs,
+  });
+
+  return {
+    script,
+    install,
+    installFailed: false,
+    result,
+    failure: firstFailure(`${result.stdout}\n${result.stderr}`),
+  };
+}
+
+export async function executeProject(
+  dir: string,
+  manifest: Manifest,
+  env: RunEnvironment = systemRunEnvironment(),
+  options: RunOptions = DEFAULT_RUN_OPTIONS,
+): Promise<Result<RunOutcome>> {
+  const measuredBytes = await env.measureTreeBytes(dir);
+  const limitBytes = options.maxCopyMegabytes * 1024 * 1024;
+
+  if (measuredBytes > limitBytes) {
+    return ok({
+      workDir: "",
+      script: undefined,
+      install: undefined,
+      installFailed: false,
+      result: undefined,
+      failure: undefined,
+      cleanupFailed: false,
+      measuredBytes,
+      copyTooLarge: true,
+    });
+  }
+
+  const workDir = await env.makeTempDir();
+
+  let partial: Awaited<ReturnType<typeof perform>>;
+  try {
+    partial = await perform(workDir, dir, manifest, env, options);
+  } catch (error) {
+    await env.removeDir(workDir).catch(() => undefined);
+    return {
+      ok: false,
+      error: {
+        code: "E_IO",
+        message: `could not prepare the temporary copy: ${error instanceof Error ? error.message : String(error)}`,
+        hint: "check that the target directory is readable and that the temporary directory is writable.",
+      },
+    };
+  }
+
+  let cleanupFailed = false;
+  try {
+    await env.removeDir(workDir);
+  } catch {
+    cleanupFailed = true;
+  }
+
+  return ok({ ...partial, workDir, cleanupFailed, measuredBytes, copyTooLarge: false });
+}

package/src/scanner/graph.ts

@@ -0,0 +1,77 @@
+import type { ParsedLockfile } from "./lockfile";
+import type { Manifest } from "./manifest";
+
+/** What bunready knows about the dependency set, and nothing more. */
+export interface DependencyGraph {
+  readonly direct: readonly string[];
+  readonly dev: readonly string[];
+  readonly optional: readonly string[];
+  readonly peer: readonly string[];
+  /** Distinct locked package names. */
+  readonly lockedNames: number;
+  /** Distinct name@version pairs in the lockfile. */
+  readonly lockedPackages: number;
+  readonly duplicates: readonly DuplicateVersion[];
+}
+
+export interface DuplicateVersion {
+  readonly name: string;
+  readonly versions: readonly string[];
+}
+
+function names(map: Readonly<Record<string, string>>): string[] {
+  return Object.keys(map).sort();
+}
+
+/**
+ * Build the graph from the manifest (direct dependencies, always trustworthy)
+ * plus the lockfile (transitive packages, only as good as the lockfile).
+ *
+ * Dev-ness of transitive packages is NOT inferred: only lockfiles that record
+ * it (npm) contribute that flag, and the graph does not use it to guess.
+ */
+export function buildGraph(
+  manifest: Manifest,
+  lockfile: ParsedLockfile | undefined,
+): DependencyGraph {
+  const versionsByName = new Map<string, Set<string>>();
+  for (const pkg of lockfile?.packages ?? []) {
+    const bucket = versionsByName.get(pkg.name) ?? new Set<string>();
+    bucket.add(pkg.version);
+    versionsByName.set(pkg.name, bucket);
+  }
+
+  const duplicates: DuplicateVersion[] = [];
+  for (const [name, versions] of [...versionsByName.entries()].sort((a, b) =>
+    a[0].localeCompare(b[0]),
+  )) {
+    if (versions.size > 1) {
+      duplicates.push({ name, versions: [...versions].sort() });
+    }
+  }
+
+  return {
+    direct: names(manifest.dependencies),
+    dev: names(manifest.devDependencies),
+    optional: names(manifest.optionalDependencies),
+    peer: names(manifest.peerDependencies),
+    lockedNames: versionsByName.size,
+    lockedPackages: lockfile?.packages.length ?? 0,
+    duplicates,
+  };
+}
+
+/** Every package name bunready saw, direct or transitive, deduplicated. */
+export function knownPackageNames(
+  graph: DependencyGraph,
+  lockfile: ParsedLockfile | undefined,
+): Set<string> {
+  const result = new Set<string>([
+    ...graph.direct,
+    ...graph.dev,
+    ...graph.optional,
+    ...graph.peer,
+    ...(lockfile?.packages ?? []).map((pkg) => pkg.name),
+  ]);
+  return result;
+}