@patchstack/connect 0.2.3 → 0.2.5

package/README.md

@@ -2,6 +2,8 @@
 
 Connect a JavaScript / Node.js application to [Patchstack](https://patchstack.com) for continuous vulnerability monitoring. Scans your `package-lock.json` and reports installed packages so Patchstack can match them against its vulnerability database and notify you when something needs patching.
 
+For how this repo fits with the wider Patchstack ecosystem (`saas`, `hub`, `patchstack-website`, `patchstack-connect`), see [`patchstack/saas` → `docs/ecosystem.md`](https://github.com/patchstack/saas/blob/main/docs/ecosystem.md).
+
 ## Install prompt (for AI coding tools)
 
 Copy and paste this prompt into any AI coding assistant (Cursor, v0, Bolt, Lovable, Claude Code, etc.):
@@ -21,6 +23,7 @@ That's it. The first `scan`:
 2. POSTs the package list to Patchstack with **no** UUID.
 3. Patchstack provisions a fresh site and returns its UUID.
 4. The connector writes the UUID to `.patchstackrc.json` so the next `scan` targets the same site.
+5. The connector prints a claim URL — open it in a browser to attach the new site to your Patchstack account. You can re-display it any time with `npx @patchstack/connect status`.
 
 Then wire it into builds:
 
@@ -71,7 +74,7 @@ Precedence (highest wins):
 Environment variables:
 
 - `PATCHSTACK_SITE_UUID` — the site UUID from your Patchstack dashboard
-- `PATCHSTACK_ENDPOINT` — override the API endpoint (default `https://app.patchstack.com/monitor/pulse/manifest`)
+- `PATCHSTACK_ENDPOINT` — override the API endpoint (default `https://api.patchstack.com/monitor/pulse/manifest`)
 - `PATCHSTACK_TIMEOUT_MS` — request timeout in milliseconds (default `30000`)
 
 `.patchstackrc.json` example:
@@ -113,10 +116,10 @@ That's the entire payload. No source code, no environment variables, no file pat
 ## Supported lockfiles
 
 - ✅ `package-lock.json` (npm v6 / v2 / v3) — parsed directly
+- ✅ `pnpm-lock.yaml` (pnpm v5 / v6 / v7 / v8 / v9) — parsed directly
+- ✅ `yarn.lock` (yarn classic v1 and yarn berry v2+) — parsed directly
 - ✅ `bun.lockb` (binary) — package list resolved by walking `node_modules/`
 - ✅ `bun.lock` (text) — same fallback; direct parsing coming
-- ❌ `yarn.lock` — coming soon
-- ❌ `pnpm-lock.yaml` — coming soon
 
 If both a Bun lockfile and `node_modules/` are present, the connector walks `node_modules/` to enumerate the installed packages. Run `bun install` (or `npm install`) before scanning so the directory is populated.
 

package/dist/cli.js

@@ -2,7 +2,7 @@
 
 // src/parsers/index.ts
 import { access } from "fs/promises";
-import path3 from "path";
+import path4 from "path";
 
 // src/types.ts
 var PatchstackError = class extends Error {
@@ -209,9 +209,452 @@ async function isPlainDirectory(dir) {
   }
 }
 
+// src/parsers/pnpm.ts
+import { readFile as readFile3 } from "fs/promises";
+async function parsePnpmLockfile(lockfilePath) {
+  let raw;
+  try {
+    raw = await readFile3(lockfilePath, "utf8");
+  } catch (cause) {
+    throw new PatchstackError(
+      `Could not read lockfile at ${lockfilePath}`,
+      "LOCKFILE_NOT_FOUND",
+      cause
+    );
+  }
+  const lines = raw.split(/\r?\n/);
+  const directNames = collectDirectDepNames(lines);
+  const packageKeys = collectPackagesBlockKeys(lines);
+  if (packageKeys.length === 0) {
+    throw new PatchstackError(
+      `Lockfile at ${lockfilePath} has no "packages" entries`,
+      "LOCKFILE_PARSE_ERROR"
+    );
+  }
+  const entries = [];
+  for (const key of packageKeys) {
+    const parsed = parsePackageKey(key);
+    if (parsed === null) {
+      continue;
+    }
+    entries.push({
+      name: parsed.name,
+      version: parsed.version,
+      direct: directNames.has(parsed.name)
+    });
+  }
+  return entries;
+}
+function parsePackageKey(rawKey) {
+  let k = rawKey.trim();
+  if (k.length === 0) {
+    return null;
+  }
+  if (k.startsWith("'") && k.endsWith("'") || k.startsWith('"') && k.endsWith('"')) {
+    k = k.slice(1, -1);
+  }
+  if (k.startsWith("/")) {
+    k = k.slice(1);
+  }
+  const parenIdx = k.indexOf("(");
+  if (parenIdx >= 0) {
+    k = k.slice(0, parenIdx);
+  }
+  let scopePrefix = "";
+  let body = k;
+  if (k.startsWith("@")) {
+    const firstSlash = k.indexOf("/");
+    if (firstSlash <= 0) {
+      return null;
+    }
+    scopePrefix = k.slice(0, firstSlash + 1);
+    body = k.slice(firstSlash + 1);
+  }
+  const slashIdx = body.indexOf("/");
+  const atIdx = body.indexOf("@");
+  let sepIdx;
+  if (slashIdx < 0 && atIdx < 0) {
+    return null;
+  } else if (slashIdx < 0) {
+    sepIdx = atIdx;
+  } else if (atIdx < 0) {
+    sepIdx = slashIdx;
+  } else {
+    sepIdx = Math.min(slashIdx, atIdx);
+  }
+  const name = scopePrefix + body.slice(0, sepIdx);
+  let version = body.slice(sepIdx + 1);
+  const underscoreIdx = version.indexOf("_");
+  if (underscoreIdx >= 0) {
+    version = version.slice(0, underscoreIdx);
+  }
+  if (name.length === 0 || version.length === 0) {
+    return null;
+  }
+  return { name, version };
+}
+function indentOf(line) {
+  let i = 0;
+  while (i < line.length && line[i] === " ") {
+    i++;
+  }
+  return i;
+}
+function isBlankOrComment(line) {
+  const trimmed = line.trim();
+  return trimmed.length === 0 || trimmed.startsWith("#");
+}
+function collectPackagesBlockKeys(lines) {
+  const keys = [];
+  let inBlock = false;
+  let childIndent = null;
+  for (const line of lines) {
+    if (isBlankOrComment(line)) {
+      continue;
+    }
+    const indent = indentOf(line);
+    if (!inBlock) {
+      if (indent === 0 && line.trim() === "packages:") {
+        inBlock = true;
+      }
+      continue;
+    }
+    if (indent === 0) {
+      break;
+    }
+    if (childIndent === null) {
+      childIndent = indent;
+    }
+    if (indent !== childIndent) {
+      continue;
+    }
+    const content = line.slice(indent);
+    if (!content.endsWith(":")) {
+      continue;
+    }
+    keys.push(content.slice(0, -1));
+  }
+  return keys;
+}
+function collectDirectDepNames(lines) {
+  const names = /* @__PURE__ */ new Set();
+  collectFromImporters(lines, names);
+  for (const section of ["dependencies", "devDependencies", "optionalDependencies"]) {
+    collectFromTopLevelSection(lines, section, names);
+  }
+  return names;
+}
+var DEP_SECTIONS = /* @__PURE__ */ new Set([
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies"
+]);
+function collectFromImporters(lines, out) {
+  let inImporters = false;
+  let importerIndent = null;
+  let inDepSection = false;
+  let depSectionIndent = null;
+  let leafIndent = null;
+  for (const line of lines) {
+    if (isBlankOrComment(line)) {
+      continue;
+    }
+    const indent = indentOf(line);
+    const trimmed = line.trim();
+    if (!inImporters) {
+      if (indent === 0 && trimmed === "importers:") {
+        inImporters = true;
+      }
+      continue;
+    }
+    if (indent === 0) {
+      break;
+    }
+    if (importerIndent === null) {
+      importerIndent = indent;
+    }
+    if (indent === importerIndent) {
+      inDepSection = false;
+      depSectionIndent = null;
+      leafIndent = null;
+      continue;
+    }
+    if (!inDepSection) {
+      const key = stripTrailingColon(trimmed);
+      if (key !== null && DEP_SECTIONS.has(key)) {
+        inDepSection = true;
+        depSectionIndent = indent;
+      }
+      continue;
+    }
+    if (depSectionIndent !== null && indent <= depSectionIndent) {
+      inDepSection = false;
+      depSectionIndent = null;
+      leafIndent = null;
+      const key = stripTrailingColon(trimmed);
+      if (key !== null && DEP_SECTIONS.has(key)) {
+        inDepSection = true;
+        depSectionIndent = indent;
+      }
+      continue;
+    }
+    if (leafIndent === null) {
+      leafIndent = indent;
+    }
+    if (indent !== leafIndent) {
+      continue;
+    }
+    const name = extractLeafName(trimmed);
+    if (name !== null) {
+      out.add(name);
+    }
+  }
+}
+function collectFromTopLevelSection(lines, section, out) {
+  let inSection = false;
+  let leafIndent = null;
+  for (const line of lines) {
+    if (isBlankOrComment(line)) {
+      continue;
+    }
+    const indent = indentOf(line);
+    const trimmed = line.trim();
+    if (!inSection) {
+      if (indent === 0 && trimmed === `${section}:`) {
+        inSection = true;
+      }
+      continue;
+    }
+    if (indent === 0) {
+      break;
+    }
+    if (leafIndent === null) {
+      leafIndent = indent;
+    }
+    if (indent !== leafIndent) {
+      continue;
+    }
+    const name = extractLeafName(trimmed);
+    if (name !== null) {
+      out.add(name);
+    }
+  }
+}
+function stripTrailingColon(s) {
+  if (!s.endsWith(":")) {
+    return null;
+  }
+  return s.slice(0, -1).trim();
+}
+function extractLeafName(trimmed) {
+  const colonIdx = trimmed.indexOf(":");
+  if (colonIdx < 0) {
+    return null;
+  }
+  let name = trimmed.slice(0, colonIdx).trim();
+  if (name.length === 0) {
+    return null;
+  }
+  if (name.startsWith("'") && name.endsWith("'") || name.startsWith('"') && name.endsWith('"')) {
+    name = name.slice(1, -1);
+  }
+  return name.length > 0 ? name : null;
+}
+
+// src/parsers/yarn.ts
+import { readFile as readFile4 } from "fs/promises";
+import path3 from "path";
+async function parseYarnLockfile(lockfilePath) {
+  let raw;
+  try {
+    raw = await readFile4(lockfilePath, "utf8");
+  } catch (cause) {
+    throw new PatchstackError(
+      `Could not read lockfile at ${lockfilePath}`,
+      "LOCKFILE_NOT_FOUND",
+      cause
+    );
+  }
+  const blocks = parseBlocks(raw);
+  if (blocks.length === 0) {
+    throw new PatchstackError(
+      `Lockfile at ${lockfilePath} contains no package entries`,
+      "LOCKFILE_PARSE_ERROR"
+    );
+  }
+  const directNames = await readDirectDepNames(path3.dirname(lockfilePath));
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const block of blocks) {
+    if (block.version.length === 0 || block.names.size === 0) {
+      continue;
+    }
+    for (const name of block.names) {
+      const dedupKey = `${name}@${block.version}`;
+      if (seen.has(dedupKey)) {
+        continue;
+      }
+      seen.add(dedupKey);
+      entries.push({
+        name,
+        version: block.version,
+        direct: directNames.has(name)
+      });
+    }
+  }
+  return entries;
+}
+function parseBlocks(raw) {
+  const lines = raw.split(/\r?\n/);
+  const blocks = [];
+  let current = null;
+  const finalize = () => {
+    if (current !== null && current.version.length > 0 && current.names.size > 0) {
+      blocks.push(current);
+    }
+    current = null;
+  };
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0 || trimmed.startsWith("#")) {
+      continue;
+    }
+    const indent = countLeadingSpaces(line);
+    if (indent === 0) {
+      finalize();
+      if (!trimmed.endsWith(":")) {
+        continue;
+      }
+      const keyLine = trimmed.slice(0, -1);
+      const names = /* @__PURE__ */ new Set();
+      for (const spec of splitDescriptors(keyLine)) {
+        const name = extractName(spec);
+        if (name !== null) {
+          names.add(name);
+        }
+      }
+      current = { names, version: "" };
+      continue;
+    }
+    if (current === null) {
+      continue;
+    }
+    const version = parseVersionField(trimmed);
+    if (version !== null) {
+      current.version = version;
+    }
+  }
+  finalize();
+  return blocks;
+}
+function countLeadingSpaces(line) {
+  let i = 0;
+  while (i < line.length && line[i] === " ") {
+    i++;
+  }
+  return i;
+}
+function splitDescriptors(keyLine) {
+  const parts = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < keyLine.length; i++) {
+    const c = keyLine[i];
+    if (quote !== null) {
+      current += c;
+      if (c === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      current += c;
+      continue;
+    }
+    if (c === ",") {
+      const piece = current.trim();
+      if (piece.length > 0) {
+        parts.push(piece);
+      }
+      current = "";
+      continue;
+    }
+    current += c;
+  }
+  const tail = current.trim();
+  if (tail.length > 0) {
+    parts.push(tail);
+  }
+  return parts;
+}
+function extractName(rawSpec) {
+  let s = rawSpec.trim();
+  if (s.length === 0) {
+    return null;
+  }
+  if (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'")) {
+    s = s.slice(1, -1);
+  }
+  const atIdx = s.lastIndexOf("@");
+  if (atIdx <= 0) {
+    return null;
+  }
+  const name = s.slice(0, atIdx);
+  return name.length > 0 ? name : null;
+}
+function parseVersionField(content) {
+  if (!content.startsWith("version")) {
+    return null;
+  }
+  const after = content.slice("version".length);
+  const firstChar = after.charAt(0);
+  if (firstChar !== " " && firstChar !== "	" && firstChar !== ":") {
+    return null;
+  }
+  let rest = firstChar === ":" ? after.slice(1) : after;
+  rest = rest.trim();
+  if (rest.length === 0) {
+    return null;
+  }
+  if (rest.startsWith('"') && rest.endsWith('"') || rest.startsWith("'") && rest.endsWith("'")) {
+    rest = rest.slice(1, -1);
+  }
+  return rest.length > 0 ? rest : null;
+}
+async function readDirectDepNames(cwd) {
+  const names = /* @__PURE__ */ new Set();
+  let raw;
+  try {
+    raw = await readFile4(path3.join(cwd, "package.json"), "utf8");
+  } catch {
+    return names;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return names;
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return names;
+  }
+  const obj = parsed;
+  for (const field of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+    const section = obj[field];
+    if (typeof section !== "object" || section === null) {
+      continue;
+    }
+    for (const name of Object.keys(section)) {
+      names.add(name);
+    }
+  }
+  return names;
+}
+
 // src/parsers/index.ts
 async function detectLockfile(cwd) {
-  const npmLock = path3.join(cwd, "package-lock.json");
+  const npmLock = path4.join(cwd, "package-lock.json");
   if (await exists(npmLock)) {
     return {
       ecosystem: "npm",
@@ -220,7 +663,7 @@ async function detectLockfile(cwd) {
       strategy: "npm-lockfile"
     };
   }
-  const bunLock = path3.join(cwd, "bun.lock");
+  const bunLock = path4.join(cwd, "bun.lock");
   if (await exists(bunLock)) {
     return {
       ecosystem: "npm",
@@ -229,7 +672,7 @@ async function detectLockfile(cwd) {
       strategy: "node-modules-walk"
     };
   }
-  const bunLockB = path3.join(cwd, "bun.lockb");
+  const bunLockB = path4.join(cwd, "bun.lockb");
   if (await exists(bunLockB)) {
     return {
       ecosystem: "npm",
@@ -238,19 +681,23 @@ async function detectLockfile(cwd) {
       strategy: "node-modules-walk"
     };
   }
-  const yarnLock = path3.join(cwd, "yarn.lock");
-  if (await exists(yarnLock)) {
-    throw new PatchstackError(
-      "yarn.lock detected but not yet supported. Run `npm install` to generate a package-lock.json, or open an issue at github.com/patchstack/connect.",
-      "LOCKFILE_UNSUPPORTED"
-    );
-  }
-  const pnpmLock = path3.join(cwd, "pnpm-lock.yaml");
+  const pnpmLock = path4.join(cwd, "pnpm-lock.yaml");
   if (await exists(pnpmLock)) {
-    throw new PatchstackError(
-      "pnpm-lock.yaml detected but not yet supported. Open an issue at github.com/patchstack/connect to request support.",
-      "LOCKFILE_UNSUPPORTED"
-    );
+    return {
+      ecosystem: "npm",
+      filePath: pnpmLock,
+      filename: "pnpm-lock.yaml",
+      strategy: "pnpm-lockfile"
+    };
+  }
+  const yarnLock = path4.join(cwd, "yarn.lock");
+  if (await exists(yarnLock)) {
+    return {
+      ecosystem: "npm",
+      filePath: yarnLock,
+      filename: "yarn.lock",
+      strategy: "yarn-lockfile"
+    };
   }
   throw new PatchstackError(
     `No lockfile found in ${cwd}. Expected one of: package-lock.json, bun.lock, bun.lockb, yarn.lock, pnpm-lock.yaml.`,
@@ -266,6 +713,10 @@ async function runStrategy(detected, cwd) {
   switch (detected.strategy) {
     case "npm-lockfile":
       return parseNpmLockfile(detected.filePath);
+    case "pnpm-lockfile":
+      return parsePnpmLockfile(detected.filePath);
+    case "yarn-lockfile":
+      return parseYarnLockfile(detected.filePath);
     case "node-modules-walk":
       return walkNodeModules(cwd);
   }
@@ -382,12 +833,16 @@ function compareSegments(a, b) {
 }
 
 // src/client.ts
-var DEFAULT_ENDPOINT = "https://app.patchstack.com/monitor/pulse/manifest";
+var DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
 var DEFAULT_TIMEOUT_MS = 3e4;
 function buildEndpointUrl(base, siteUuid) {
   const trimmed = base.replace(/\/$/, "");
   return siteUuid !== void 0 && siteUuid !== null && siteUuid.length > 0 ? `${trimmed}/${encodeURIComponent(siteUuid)}` : trimmed;
 }
+function buildClaimUrl(endpoint, siteUuid) {
+  const origin = new URL(endpoint).origin;
+  return `${origin}/monitor/claim?site=${encodeURIComponent(siteUuid)}`;
+}
 async function postManifest(config, payload) {
   const url = buildEndpointUrl(config.endpoint, config.siteUuid);
   const timeoutMs = config.timeoutMs;
@@ -455,8 +910,8 @@ function isTimeoutError(cause) {
 }
 
 // src/config.ts
-import { readFile as readFile3, writeFile } from "fs/promises";
-import path4 from "path";
+import { readFile as readFile5, writeFile } from "fs/promises";
+import path5 from "path";
 var CONFIG_FILENAME = ".patchstackrc.json";
 async function resolveConfig(options) {
   const fromFile = await readConfigFile(options.cwd);
@@ -483,7 +938,7 @@ async function resolveConfig(options) {
   };
 }
 async function writeConfigFile(cwd, config) {
-  const target = path4.join(cwd, CONFIG_FILENAME);
+  const target = path5.join(cwd, CONFIG_FILENAME);
   const content = JSON.stringify(config, null, 2) + "\n";
   await writeFile(target, content, "utf8");
   return target;
@@ -493,10 +948,10 @@ async function persistSiteUuid(cwd, siteUuid) {
   return writeConfigFile(cwd, { ...existing, siteUuid });
 }
 async function readConfigFile(cwd) {
-  const target = path4.join(cwd, CONFIG_FILENAME);
+  const target = path5.join(cwd, CONFIG_FILENAME);
   let raw;
   try {
-    raw = await readFile3(target, "utf8");
+    raw = await readFile5(target, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return {};
@@ -559,7 +1014,7 @@ Options (for scan and status):
 
 Environment:
   PATCHSTACK_SITE_UUID    Site UUID
-  PATCHSTACK_ENDPOINT     API endpoint (default: https://app.patchstack.com/monitor/pulse/manifest)
+  PATCHSTACK_ENDPOINT     API endpoint (default: https://api.patchstack.com/monitor/pulse/manifest)
   PATCHSTACK_TIMEOUT_MS   Request timeout in ms (default: 30000)
 
 Precedence: CLI flag > environment variable > .patchstackrc.json.
@@ -671,6 +1126,11 @@ async function runScan(args) {
   } else {
     console.log(`Server response: ${response.message ?? JSON.stringify(response)}`);
   }
+  if (provisioning && response.uuid !== void 0 && response.uuid.length > 0) {
+    console.log("");
+    console.log("Claim this site to view vulnerability reports in your Patchstack dashboard:");
+    console.log(`  ${buildClaimUrl(config.endpoint, response.uuid)}`);
+  }
   return 0;
 }
 async function runStatus(args) {
@@ -682,6 +1142,9 @@ async function runStatus(args) {
   console.log(`Site UUID:  ${config.siteUuid ?? "(none yet \u2014 the next `scan` will provision one)"}`);
   console.log(`Endpoint:   ${config.endpoint}`);
   console.log(`Timeout:    ${config.timeoutMs}ms`);
+  if (config.siteUuid !== null) {
+    console.log(`Claim URL:  ${buildClaimUrl(config.endpoint, config.siteUuid)}`);
+  }
   return 0;
 }
 async function main() {