@securecode-ai/mcp 0.2.1 → 0.3.0

package/dist/dependency/parsers/npm.d.ts

@@ -0,0 +1,13 @@
+import { ParsedLockfile } from '../types';
+/**
+ * Parse a package-lock.json (npm v2/v3, lockfileVersion >= 2).
+ *
+ * npm lockfiles already contain the fully-resolved transitive tree — every
+ * installed package (direct and transitive) is a `packages.*` entry with a
+ * resolved `version`. The resolver therefore does not need to hit the
+ * network; it just walks `packages`.
+ *
+ * v1 (lockfileVersion 1) uses a `dependencies` tree instead; we support it
+ * too, recursively.
+ */
+export declare function parseNpmLockfile(lockfilePath: string): ParsedLockfile | null;

package/dist/dependency/parsers/npm.js

@@ -0,0 +1,160 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseNpmLockfile = parseNpmLockfile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Parse a package-lock.json (npm v2/v3, lockfileVersion >= 2).
+ *
+ * npm lockfiles already contain the fully-resolved transitive tree — every
+ * installed package (direct and transitive) is a `packages.*` entry with a
+ * resolved `version`. The resolver therefore does not need to hit the
+ * network; it just walks `packages`.
+ *
+ * v1 (lockfileVersion 1) uses a `dependencies` tree instead; we support it
+ * too, recursively.
+ */
+function parseNpmLockfile(lockfilePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(lockfilePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const manifestPath = path.join(path.dirname(lockfilePath), 'package.json');
+    let projectLicense;
+    try {
+        const pkg = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        if (typeof pkg.license === 'string')
+            projectLicense = pkg.license;
+        else if (pkg.license && typeof pkg.license === 'object' && typeof pkg.license.type === 'string') {
+            projectLicense = pkg.license.type;
+        }
+    }
+    catch {
+        // package.json optional; ignore
+    }
+    const packages = [];
+    const seen = new Set();
+    const lockfileVersion = typeof data.lockfileVersion === 'number' ? data.lockfileVersion : 0;
+    if (lockfileVersion >= 2 && data.packages) {
+        // v2/v3: keyed by install path, `node_modules/<name>`.
+        for (const [key, entry] of Object.entries(data.packages)) {
+            // The root project itself is keyed by "" — skip it.
+            if (key === '')
+                continue;
+            // Extract the package name from the path. Scoped packages live at
+            // `node_modules/@scope/name`. Optional deps may have their own paths.
+            const nmIdx = key.indexOf('node_modules/');
+            if (nmIdx < 0)
+                continue;
+            const name = key.slice(nmIdx + 'node_modules/'.length);
+            // Nested node_modules paths (e.g. "node_modules/a/node_modules/b")
+            // describe a deduped alternative install; the canonical entry is the
+            // top-level one. We keep the first occurrence per name+version.
+            if (entry.link === true)
+                continue; // symlinked, not a real install
+            const version = entry.version;
+            if (!version)
+                continue;
+            const id = `${name}@${version}`;
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            packages.push({
+                ecosystem: 'npm',
+                name,
+                version,
+                license: typeof entry.license === 'string' ? entry.license : undefined,
+                manifestPath,
+                direct: entry.dev === undefined && entry.optional === undefined
+                    ? isDirectNpm(key)
+                    : false,
+            });
+        }
+    }
+    else if (data.dependencies) {
+        // v1: recursive `dependencies` tree.
+        walkNpmV1(data.dependencies, '', manifestPath, packages, seen);
+    }
+    return {
+        ecosystem: 'npm',
+        lockfilePath,
+        manifestPath,
+        packages,
+        projectLicense,
+    };
+}
+function walkNpmV1(deps, parentPath, manifestPath, out, seen) {
+    for (const [name, entry] of Object.entries(deps || {})) {
+        const version = entry && entry.version;
+        if (!version)
+            continue;
+        const id = `${name}@${version}`;
+        if (!seen.has(id)) {
+            seen.add(id);
+            out.push({
+                ecosystem: 'npm',
+                name,
+                version,
+                license: entry && typeof entry.license === 'string' ? entry.license : undefined,
+                manifestPath,
+                direct: parentPath === '',
+            });
+        }
+        if (entry && entry.dependencies) {
+            walkNpmV1(entry.dependencies, `${parentPath}${name}/`, manifestPath, out, seen);
+        }
+    }
+}
+/**
+ * Best-effort: did this `packages` key correspond to a top-level dependency?
+ * Top-level keys look exactly like `node_modules/<name>` (no nested node_modules).
+ */
+function isDirectNpm(key) {
+    const nmIdx = key.indexOf('node_modules/');
+    const tail = key.slice(nmIdx + 'node_modules/'.length);
+    return !tail.includes('node_modules/');
+}
+//# sourceMappingURL=npm.js.map

package/dist/dependency/parsers/npm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../../src/dependency/parsers/npm.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,4CAyEC;AAxFD,uCAAyB;AACzB,2CAA6B;AAG7B;;;;;;;;;;GAUG;AACH,SAAgB,gBAAgB,CAAC,YAAoB;IACjD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC,CAAC;IAC3E,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC;aAC7D,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,gCAAgC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,eAAe,GAAW,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpG,IAAI,eAAe,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,uDAAuD;QACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,oDAAoD;YACpD,IAAI,GAAG,KAAK,EAAE;gBAAE,SAAS;YACzB,kEAAkE;YAClE,sEAAsE;YACtE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC3C,IAAI,KAAK,GAAG,CAAC;gBAAE,SAAS;YACxB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACvD,mEAAmE;YACnE,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS,CAAC,gCAAgC;YACnE,MAAM,OAAO,GAAuB,KAAK,CAAC,OAAO,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,OAAO;gBACP,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACtE,YAAY;gBACZ,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;oBAC3D,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC;oBAClB,CAAC,CAAC,KAAK;aACd,CAAC,CAAC;QACP,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3B,qCAAqC;QACrC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACH,SAAS,EAAE,KAAK;QAChB,YAAY;QACZ,YAAY;QACZ,QAAQ;QACR,cAAc;KACjB,CAAC;AACN,CAAC;AAED,SAAS,SAAS,CACd,IAAyB,EACzB,UAAkB,EAClB,YAAoB,EACpB,GAAsB,EACtB,IAAiB;IAEjB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAuB,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC;QAC3D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC;gBACL,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,OAAO;gBACP,OAAO,EAAE,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC/E,YAAY;gBACZ,MAAM,EAAE,UAAU,KAAK,EAAE;aAC5B,CAAC,CAAC;QACP,CAAC;QACD,IAAI,KAAK,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC9B,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,UAAU,GAAG,IAAI,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACpF,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAW;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC3C,CAAC"}

package/dist/dependency/parsers/pipfile.d.ts

@@ -0,0 +1,8 @@
+import { ParsedLockfile } from '../types';
+/**
+ * Parse a `Pipfile.lock` (Pipenv). It is a JSON document with two top-level
+ * sections, `default` and `develop`, each keyed by package name with `version`
+ * (without leading `==`) and optional `hashes`. Both sections contain the
+ * resolved transitive tree, so we walk them and return everything.
+ */
+export declare function parsePipfileLock(lockfilePath: string): ParsedLockfile | null;

package/dist/dependency/parsers/pipfile.js

@@ -0,0 +1,110 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePipfileLock = parsePipfileLock;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const requirements_1 = require("./requirements");
+/**
+ * Parse a `Pipfile.lock` (Pipenv). It is a JSON document with two top-level
+ * sections, `default` and `develop`, each keyed by package name with `version`
+ * (without leading `==`) and optional `hashes`. Both sections contain the
+ * resolved transitive tree, so we walk them and return everything.
+ */
+function parsePipfileLock(lockfilePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(lockfilePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!data || typeof data !== 'object')
+        return null;
+    const manifestPath = path.join(path.dirname(lockfilePath), 'Pipfile');
+    let projectLicense;
+    try {
+        const pipfile = fs.readFileSync(manifestPath, 'utf8');
+        // Pipfile is TOML; we don't depend on a TOML parser. Best-effort regex
+        // for the top-level `license = "..."` line.
+        const m = pipfile.match(/^\s*license\s*=\s*"([^"]+)"/m);
+        if (m)
+            projectLicense = m[1];
+    }
+    catch {
+        // optional
+    }
+    const packages = [];
+    const seen = new Set();
+    for (const section of ['default', 'develop']) {
+        const deps = data[section];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const [rawName, entry] of Object.entries(deps)) {
+            const name = (0, requirements_1.normalizePipName)(rawName);
+            const version = entry && typeof entry.version === 'string'
+                ? entry.version.replace(/^==/, '')
+                : undefined;
+            if (!version)
+                continue;
+            const id = `${name}@${version}`;
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            packages.push({
+                ecosystem: 'pipenv',
+                name,
+                version,
+                manifestPath,
+                direct: section === 'default',
+            });
+        }
+    }
+    return {
+        ecosystem: 'pipenv',
+        lockfilePath,
+        manifestPath,
+        packages,
+        projectLicense,
+    };
+}
+//# sourceMappingURL=pipfile.js.map

package/dist/dependency/parsers/pipfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipfile.js","sourceRoot":"","sources":["../../../src/dependency/parsers/pipfile.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,4CA2DC;AAtED,uCAAyB;AACzB,2CAA6B;AAE7B,iDAAkD;AAElD;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,YAAoB;IACjD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,uEAAuE;QACvE,4CAA4C;QAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACxD,IAAI,CAAC;YAAE,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACL,WAAW;IACf,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,MAAM,IAAI,GAAoC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,IAAA,+BAAgB,EAAC,OAAO,CAAC,CAAC;YACvC,MAAM,OAAO,GAAuB,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBAC1E,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAClC,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,QAAQ;gBACnB,IAAI;gBACJ,OAAO;gBACP,YAAY;gBACZ,MAAM,EAAE,OAAO,KAAK,SAAS;aAChC,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO;QACH,SAAS,EAAE,QAAQ;QACnB,YAAY;QACZ,YAAY;QACZ,QAAQ;QACR,cAAc;KACjB,CAAC;AACN,CAAC"}

package/dist/dependency/parsers/pnpm.d.ts

@@ -0,0 +1,11 @@
+import { ParsedLockfile } from '../types';
+/**
+ * Parse a pnpm-lock.yaml (v6+).
+ *
+ * pnpm lockfiles contain the resolved transitive tree under `packages`,
+ * keyed as `<name>@<version>` (with optional peer suffixes). We walk that
+ * section. Importers (`importers`) tell us which deps are direct; we use
+ * it to flag direct vs transitive, but every package ends up in the list
+ * regardless (transitive deps need scanning too).
+ */
+export declare function parsePnpmLockfile(lockfilePath: string): ParsedLockfile | null;

package/dist/dependency/parsers/pnpm.js

@@ -0,0 +1,148 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePnpmLockfile = parsePnpmLockfile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const yaml_1 = require("yaml");
+/**
+ * Parse a pnpm-lock.yaml (v6+).
+ *
+ * pnpm lockfiles contain the resolved transitive tree under `packages`,
+ * keyed as `<name>@<version>` (with optional peer suffixes). We walk that
+ * section. Importers (`importers`) tell us which deps are direct; we use
+ * it to flag direct vs transitive, but every package ends up in the list
+ * regardless (transitive deps need scanning too).
+ */
+function parsePnpmLockfile(lockfilePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(lockfilePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let data;
+    try {
+        data = (0, yaml_1.parse)(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!data || typeof data !== 'object')
+        return null;
+    const manifestPath = path.join(path.dirname(lockfilePath), 'package.json');
+    let projectLicense;
+    try {
+        const pkg = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        if (typeof pkg.license === 'string')
+            projectLicense = pkg.license;
+        else if (pkg.license && typeof pkg.license === 'object' && typeof pkg.license.type === 'string') {
+            projectLicense = pkg.license.type;
+        }
+    }
+    catch {
+        // optional
+    }
+    // Collect direct dependency names from the lockfile's `importers` section
+    // (more reliable than reading package.json for pnpm, since pnpm prunes).
+    const directKeys = new Set();
+    const importers = data.importers || {};
+    for (const importer of Object.values(importers)) {
+        for (const cat of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+            const deps = importer?.[cat];
+            if (deps && typeof deps === 'object') {
+                for (const name of Object.keys(deps))
+                    directKeys.add(name);
+            }
+        }
+    }
+    const packages = [];
+    const seen = new Set();
+    const pkgSection = data.packages || {};
+    for (const key of Object.keys(pkgSection)) {
+        const entry = pkgSection[key];
+        // pnpm v6+: key like "lodash@4.17.19" or "/lodash/4.17.19"
+        // v9+: key like "lodash@4.17.19(peerdeps...)"
+        const { name, version } = parsePnpmPkgKey(key);
+        if (!name || !version)
+            continue;
+        const id = `${name}@${version}`;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        packages.push({
+            ecosystem: 'pnpm',
+            name,
+            version,
+            manifestPath,
+            direct: directKeys.has(name),
+        });
+    }
+    return {
+        ecosystem: 'pnpm',
+        lockfilePath,
+        manifestPath,
+        packages,
+        projectLicense,
+    };
+}
+/**
+ * Parse a pnpm `packages.<key>` entry. Supported forms:
+ *   "lodash@4.17.19"
+ *   "/lodash/4.17.19"          (older)
+ *   "@babel/core@7.0.0"
+ *   "lodash@4.17.19(react@18)" (peer-suffixed; we strip the parens)
+ */
+function parsePnpmPkgKey(key) {
+    // Strip peer suffix in parens.
+    const parenIdx = key.indexOf('(');
+    let k = parenIdx >= 0 ? key.slice(0, parenIdx) : key;
+    k = k.trim();
+    if (k.startsWith('/'))
+        k = k.slice(1);
+    // For scoped: leading "@" then name then "@version"
+    if (k.startsWith('@')) {
+        const at = k.indexOf('@', 1);
+        if (at < 0)
+            return { name: '', version: '' };
+        return { name: k.slice(0, at), version: k.slice(at + 1) };
+    }
+    const at = k.indexOf('@');
+    if (at < 0)
+        return { name: '', version: '' };
+    return { name: k.slice(0, at), version: k.slice(at + 1) };
+}
+//# sourceMappingURL=pnpm.js.map

package/dist/dependency/parsers/pnpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.js","sourceRoot":"","sources":["../../../src/dependency/parsers/pnpm.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,8CAoEC;AAlFD,uCAAyB;AACzB,2CAA6B;AAC7B,+BAA0C;AAG1C;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,YAAoB;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACD,IAAI,GAAG,IAAA,YAAS,EAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC,CAAC;IAC3E,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC;aAC7D,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,WAAW;IACf,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,SAAS,GAAwB,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IAC5D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/D,CAAC;QACL,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAwB,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC5D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,2DAA2D;QAC3D,8CAA8C;QAC9C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS;QAChC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC;YACV,SAAS,EAAE,MAAM;YACjB,IAAI;YACJ,OAAO;YACP,YAAY;YACZ,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;SAC/B,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,SAAS,EAAE,MAAM;QACjB,YAAY;QACZ,YAAY;QACZ,QAAQ;QACR,cAAc;KACjB,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAW;IAChC,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACb,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,oDAAoD;IACpD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/dist/dependency/parsers/requirements.d.ts

@@ -0,0 +1,24 @@
+import { ParsedLockfile } from '../types';
+/**
+ * Parse a `requirements.txt` file.
+ *
+ * Supported pins:
+ *   name==1.2.3
+ *   name>=1.2.3
+ *   name~=1.2.3
+ *   name>1.0,<2.0
+ *   name (unpinned — marked unresolved)
+ *
+ * `#`-comments, blank lines, `-r other.txt`, `-e .`, and VCS/URL specs are
+ * skipped (URL specs are treated as unpinned/unresolved under the package
+ * name extracted from the URL when possible, otherwise skipped entirely).
+ *
+ * IMPORTANT: no network calls are made. When a pin is not an exact `==`,
+ * the entry is marked `unresolved` and surfaced to the user as such rather
+ * than queried against OSV (since the installed version is unknown). A
+ * Pipfile.lock alongside the requirements.txt will be preferred when
+ * present (handled by the resolver/dependencyChecker, not here).
+ */
+export declare function parseRequirementsTxt(lockfilePath: string): ParsedLockfile | null;
+/** Normalize a PyPI package name per PEP 503 (lowercase, runs of [-_.] -> "-"). */
+export declare function normalizePipName(name: string): string;

package/dist/dependency/parsers/requirements.js

@@ -0,0 +1,153 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRequirementsTxt = parseRequirementsTxt;
+exports.normalizePipName = normalizePipName;
+const fs = __importStar(require("fs"));
+/**
+ * Parse a `requirements.txt` file.
+ *
+ * Supported pins:
+ *   name==1.2.3
+ *   name>=1.2.3
+ *   name~=1.2.3
+ *   name>1.0,<2.0
+ *   name (unpinned — marked unresolved)
+ *
+ * `#`-comments, blank lines, `-r other.txt`, `-e .`, and VCS/URL specs are
+ * skipped (URL specs are treated as unpinned/unresolved under the package
+ * name extracted from the URL when possible, otherwise skipped entirely).
+ *
+ * IMPORTANT: no network calls are made. When a pin is not an exact `==`,
+ * the entry is marked `unresolved` and surfaced to the user as such rather
+ * than queried against OSV (since the installed version is unknown). A
+ * Pipfile.lock alongside the requirements.txt will be preferred when
+ * present (handled by the resolver/dependencyChecker, not here).
+ */
+function parseRequirementsTxt(lockfilePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(lockfilePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const manifestPath = lockfilePath; // requirements.txt IS the manifest
+    const packages = [];
+    const seen = new Set();
+    for (const line of raw.split(/\r?\n/)) {
+        let s = line.trim();
+        if (!s)
+            continue;
+        // Strip inline comment.
+        const hash = s.indexOf('#');
+        if (hash >= 0)
+            s = s.slice(0, hash).trim();
+        if (!s)
+            continue;
+        // Skip option lines and recursive includes; we don't follow them.
+        if (s.startsWith('-'))
+            continue;
+        if (s.startsWith('-e ') || s.startsWith('--'))
+            continue;
+        // Skip VCS / URL specs entirely (we cannot resolve them offline).
+        // Examples: git+https://..., https://..., file:///...
+        if (/^[a-z]+(\+[a-z]+)?:\/\//i.test(s))
+            continue;
+        // Strip environment markers: "name==1.0 ; python_version>='3.8'"
+        const semi = s.indexOf(';');
+        if (semi >= 0)
+            s = s.slice(0, semi).trim();
+        if (!s)
+            continue;
+        // Strip extras: "name[extra1,extra2]==1.0"
+        const nameMatch = s.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(\[[^\]]*\])?\s*(.*)$/);
+        if (!nameMatch)
+            continue;
+        const rawName = nameMatch[1];
+        const spec = (nameMatch[3] || '').trim();
+        const name = normalizePipName(rawName);
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        // Exact pin: "name==1.2.3"
+        const exact = spec.match(/^==\s*([A-Za-z0-9_.!+*-]+)$/);
+        if (exact) {
+            packages.push({
+                ecosystem: 'pip',
+                name,
+                version: exact[1],
+                manifestPath,
+                direct: true,
+            });
+            continue;
+        }
+        // Range pins (>=, >, ~=, <=, <, comma-separated): unresolved.
+        if (spec && /([<>=~!]=?)/.test(spec)) {
+            packages.push({
+                ecosystem: 'pip',
+                name,
+                version: spec, // best-effort: keep the spec for display
+                manifestPath,
+                direct: true,
+                unresolved: true,
+            });
+            continue;
+        }
+        // Bare "name" (no pin): unresolved.
+        if (!spec) {
+            packages.push({
+                ecosystem: 'pip',
+                name,
+                version: '',
+                manifestPath,
+                direct: true,
+                unresolved: true,
+            });
+            continue;
+        }
+    }
+    return {
+        ecosystem: 'pip',
+        lockfilePath,
+        manifestPath,
+        packages,
+    };
+}
+/** Normalize a PyPI package name per PEP 503 (lowercase, runs of [-_.] -> "-"). */
+function normalizePipName(name) {
+    return name.toLowerCase().replace(/[-_.]+/g, '-');
+}
+//# sourceMappingURL=requirements.js.map

package/dist/dependency/parsers/requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requirements.js","sourceRoot":"","sources":["../../../src/dependency/parsers/requirements.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,oDAyFC;AAGD,4CAEC;AAtHD,uCAAyB;AAIzB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,oBAAoB,CAAC,YAAoB;IACrD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,mCAAmC;IACtE,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,wBAAwB;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,CAAC;YAAE,SAAS;QAEjB,kEAAkE;QAClE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAExD,kEAAkE;QAClE,sDAAsD;QACtD,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,SAAS;QAEjD,iEAAiE;QACjE,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,CAAC;YAAE,SAAS;QAEjB,2CAA2C;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACnF,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEvC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEf,2BAA2B;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBACjB,YAAY;gBACZ,MAAM,EAAE,IAAI;aACf,CAAC,CAAC;YACH,SAAS;QACb,CAAC;QAED,8DAA8D;QAC9D,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,OAAO,EAAE,IAAI,EAAE,yCAAyC;gBACxD,YAAY;gBACZ,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,SAAS;QACb,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,OAAO,EAAE,EAAE;gBACX,YAAY;gBACZ,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,SAAS;QACb,CAAC;IACL,CAAC;IAED,OAAO;QACH,SAAS,EAAE,KAAK;QAChB,YAAY;QACZ,YAAY;QACZ,QAAQ;KACX,CAAC;AACN,CAAC;AAED,mFAAmF;AACnF,SAAgB,gBAAgB,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC"}

package/dist/dependency/parsers/yarn.d.ts

@@ -0,0 +1,10 @@
+import { ParsedLockfile } from '../types';
+/**
+ * Parse a yarn v1 `yarn.lock` (the classic format). v2+ (Berry) uses a
+ * different text format and is NOT covered here — we deliberately bail in
+ * that case so the caller can skip the file gracefully.
+ *
+ * yarn v1 lockfiles contain the resolved transitive tree: every package
+ * entry has a `version` and a `resolved` URL, including transitive deps.
+ */
+export declare function parseYarnLockfile(lockfilePath: string): ParsedLockfile | null;