@securecode-ai/mcp 0.2.1 → 0.3.1

package/dist/dependency/osvClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osvClient.js","sourceRoot":"","sources":["../../src/dependency/osvClient.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDA,sCAgIC;AAmBD,0CA0EC;AA4ED,wCAEC;AAyCD,sCA0BC;AAnaD,kDAAoC;AAIpC,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AAC/D,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,+BAA+B;AAC5D,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAChE,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,uDAAuD;AACvD,wEAAwE;AACxE,yEAAyE;AACzE,gEAAgE;AAChE,MAAM,eAAe,GAAG,KAAK,CAAC;AAY9B;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAoB;IACxC,QAAQ,GAAG,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM;YACP,OAAO,KAAK,CAAC;QACjB,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACT,OAAO,MAAM,CAAC;QAClB;YACI,OAAO,IAAI,CAAC;IACpB,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,aAAa,CAC/B,QAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE/C,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC;QACrD,MAAM,OAAO,GAAe,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,WAAW,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEnC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACD,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;QAAC,MAAM,CAAC;YACL,SAAS;QACb,CAAC;QAED,IAAI,IAAI,GAA4B,IAAI,CAAC;QACzC,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,kBAAkB,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;aAC5B,CAAC,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACP,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAqB,CAAC;YAChD,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,kCAAkC;QACtC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QAEpD,iEAAiE;QACjE,qEAAqE;QACrE,oEAAoE;QACpE,mEAAmE;QACnE,sCAAsC;QACtC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,uCAAuC,IAAI,CAAC,OAAO,CAAC,MAAM,OAAO,WAAW,CAAC,MAAM,wDAAwD,CAAC,CAAC;YAC1J,SAAS;QACb,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC;YACvB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC3C,MAAM,IAAI,GAAoB,EAAE,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAoB,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;wBACzB,MAAM,MAAM,GAAU,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;wBACtC,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;4BACvB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gCAAE,SAAS;4BACzC,IAAI,UAA8B,CAAC;4BACnC,IAAI,KAAyB,CAAC;4BAC9B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gCAC1B,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ;oCAAE,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC;gCAClE,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;oCAAE,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;4BACvD,CAAC;4BACD,QAAQ,CAAC,IAAI,CAAC;gCACV,SAAS,EAAG,CAAC,EAAE,OAAO,EAAE,SAA0B,IAAI,KAAK;gCAC3D,UAAU;gCACV,KAAK;gCACL,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;6BAC3B,CAAC,CAAC;wBACP,CAAC;oBACL,CAAC;gBACL,CAAC;gBACD,IAAI,SAA6B,CAAC;gBAClC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;wBACzB,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;4BACvD,0DAA0D;4BAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;4BAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gCACnD,SAAS,GAAG,GAAG,CAAC;4BACpB,CAAC;iCAAM,CAAC;gCACJ,4DAA4D;gCAC5D,qDAAqD;gCACrD,uDAAuD;gCACvD,uDAAuD;gCACvD,gCAAgC;gCAChC,mDAAmD;gCACnD,iCAAiC;4BACrC,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;gBACD,MAAM,UAAU,GAAa,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;wBAC7B,IAAI,OAAO,GAAG,EAAE,GAAG,KAAK,QAAQ;4BAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC/D,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC;oBACN,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;oBACxB,QAAQ;oBACR,SAAS;oBACT,UAAU;iBACb,CAAC,CAAC;YACP,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,eAAe,CACjC,QAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE/C,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,KAAK,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5C,IAAI,UAAiB,CAAC;QACtB,IAAI,CAAC;YACD,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACL,SAAS;QACb,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACrD,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,EAAE,OAAO;gBAAE,SAAS;YAC5B,mDAAmD;YACnD,IAAI,SAA6B,CAAC;YAClC,IAAI,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACtC,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAC/B,CAAC;iBAAM,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC5C,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC;YAC/B,CAAC;YACD,kEAAkE;YAClE,MAAM,QAAQ,GAAoB,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,wBAAwB,KAAK,QAAQ;oBAC5D,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,qBAAqB,KAAK,QAAQ;oBACxD,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,oDAAoD;gBACpD,wDAAwD;gBACxD,IAAI,KAAyB,CAAC;gBAC9B,IAAI,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;oBACzD,IAAI,CAAC;wBAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxB,CAAC;gBACD,4DAA4D;gBAC5D,IAAI,UAA8B,CAAC;gBACnC,IAAI,QAAQ,EAAE,CAAC;oBACX,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;oBAC1D,IAAI,CAAC;wBAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7B,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,2BAA2B;YAC3B,MAAM,IAAI,GAAa,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;gBAChD,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAClF,CAAC,CAAC,EAAE,CAAC;YACT,uEAAuE;YACvE,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC/C,IAAI,CAAC,IAAI,CAAC,oCAAoC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC;gBACN,EAAE,EAAE,GAAG,CAAC,OAAO;gBACf,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;gBAC1B,QAAQ;gBACR,SAAS;gBACT,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;QACP,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACpC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACzC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IAC/D,MAAM,GAAG,GAAG,GAAG,mBAAmB,cAAc,kBAAkB,CAAC,SAAS,CAAC,qBAAqB,kBAAkB,CAAC,WAAW,CAAC,aAAa,aAAa,EAAE,CAAC;IAC9J,MAAM,OAAO,GAA2B;QACpC,QAAQ,EAAE,6BAA6B;QACvC,YAAY,EAAE,sBAAsB;KACvC,CAAC;IACF,oDAAoD;IACpD,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;IACrC,IAAI,KAAK,EAAE,CAAC;QACR,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;IACtE,IAAI,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;YAAS,CAAC;QACP,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,IAAI,YAAuC,CAAC;AAC5C,KAAK,UAAU,cAAc;IACzB,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IACpD,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACX,YAAY,GAAG,QAAQ,CAAC;QACxB,OAAO,YAAY,CAAC;IACxB,CAAC;IACD,gEAAgE;IAChE,IAAI,CAAC;QACD,YAAY,GAAG,MAAM,IAAI,OAAO,CAAgB,OAAO,CAAC,EAAE;YACtD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACvC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACpB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACL,YAAY,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,YAAY,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,cAAc;IAChC,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAC/C,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAIvC,KAAK,UAAU,SAAS,CAAC,KAAa;IAClC,MAAM,GAAG,GAAG,0DAA0D,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAClG,IAAI,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,IAAI,GAAQ,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,KAAyB,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;QACtG,IAAI,IAAI,EAAE,QAAQ,EAAE,SAAS;YAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/D,MAAM,IAAI,GAAa,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACnF,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,aAAa,CAC/B,OAAwB,EACxB,KAAiB;IAEjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,SAAS;QACxC,sCAAsC;QACtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAE7C,MAAM,QAAQ,GAAG,oBAAoB,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAgB,QAAQ,CAAC,CAAC;QAClD,IAAI,KAA2B,CAAC;QAChC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,UAAU,EAAE,CAAC;YACvD,KAAK,GAAG,MAAM,CAAC;QACnB,CAAC;aAAM,CAAC;YACJ,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,KAAK;gBAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC5D,CAAC,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC"}

package/dist/dependency/parsers/npm.d.ts

@@ -0,0 +1,13 @@
+import { ParsedLockfile } from '../types';
+/**
+ * Parse a package-lock.json (npm v2/v3, lockfileVersion >= 2).
+ *
+ * npm lockfiles already contain the fully-resolved transitive tree — every
+ * installed package (direct and transitive) is a `packages.*` entry with a
+ * resolved `version`. The resolver therefore does not need to hit the
+ * network; it just walks `packages`.
+ *
+ * v1 (lockfileVersion 1) uses a `dependencies` tree instead; we support it
+ * too, recursively.
+ */
+export declare function parseNpmLockfile(lockfilePath: string): ParsedLockfile | null;

package/dist/dependency/parsers/npm.js

@@ -0,0 +1,160 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseNpmLockfile = parseNpmLockfile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Parse a package-lock.json (npm v2/v3, lockfileVersion >= 2).
+ *
+ * npm lockfiles already contain the fully-resolved transitive tree — every
+ * installed package (direct and transitive) is a `packages.*` entry with a
+ * resolved `version`. The resolver therefore does not need to hit the
+ * network; it just walks `packages`.
+ *
+ * v1 (lockfileVersion 1) uses a `dependencies` tree instead; we support it
+ * too, recursively.
+ */
+function parseNpmLockfile(lockfilePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(lockfilePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const manifestPath = path.join(path.dirname(lockfilePath), 'package.json');
+    let projectLicense;
+    try {
+        const pkg = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        if (typeof pkg.license === 'string')
+            projectLicense = pkg.license;
+        else if (pkg.license && typeof pkg.license === 'object' && typeof pkg.license.type === 'string') {
+            projectLicense = pkg.license.type;
+        }
+    }
+    catch {
+        // package.json optional; ignore
+    }
+    const packages = [];
+    const seen = new Set();
+    const lockfileVersion = typeof data.lockfileVersion === 'number' ? data.lockfileVersion : 0;
+    if (lockfileVersion >= 2 && data.packages) {
+        // v2/v3: keyed by install path, `node_modules/<name>`.
+        for (const [key, entry] of Object.entries(data.packages)) {
+            // The root project itself is keyed by "" — skip it.
+            if (key === '')
+                continue;
+            // Extract the package name from the path. Scoped packages live at
+            // `node_modules/@scope/name`. Optional deps may have their own paths.
+            const nmIdx = key.indexOf('node_modules/');
+            if (nmIdx < 0)
+                continue;
+            const name = key.slice(nmIdx + 'node_modules/'.length);
+            // Nested node_modules paths (e.g. "node_modules/a/node_modules/b")
+            // describe a deduped alternative install; the canonical entry is the
+            // top-level one. We keep the first occurrence per name+version.
+            if (entry.link === true)
+                continue; // symlinked, not a real install
+            const version = entry.version;
+            if (!version)
+                continue;
+            const id = `${name}@${version}`;
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            packages.push({
+                ecosystem: 'npm',
+                name,
+                version,
+                license: typeof entry.license === 'string' ? entry.license : undefined,
+                manifestPath,
+                direct: entry.dev === undefined && entry.optional === undefined
+                    ? isDirectNpm(key)
+                    : false,
+            });
+        }
+    }
+    else if (data.dependencies) {
+        // v1: recursive `dependencies` tree.
+        walkNpmV1(data.dependencies, '', manifestPath, packages, seen);
+    }
+    return {
+        ecosystem: 'npm',
+        lockfilePath,
+        manifestPath,
+        packages,
+        projectLicense,
+    };
+}
+function walkNpmV1(deps, parentPath, manifestPath, out, seen) {
+    for (const [name, entry] of Object.entries(deps || {})) {
+        const version = entry && entry.version;
+        if (!version)
+            continue;
+        const id = `${name}@${version}`;
+        if (!seen.has(id)) {
+            seen.add(id);
+            out.push({
+                ecosystem: 'npm',
+                name,
+                version,
+                license: entry && typeof entry.license === 'string' ? entry.license : undefined,
+                manifestPath,
+                direct: parentPath === '',
+            });
+        }
+        if (entry && entry.dependencies) {
+            walkNpmV1(entry.dependencies, `${parentPath}${name}/`, manifestPath, out, seen);
+        }
+    }
+}
+/**
+ * Best-effort: did this `packages` key correspond to a top-level dependency?
+ * Top-level keys look exactly like `node_modules/<name>` (no nested node_modules).
+ */
+function isDirectNpm(key) {
+    const nmIdx = key.indexOf('node_modules/');
+    const tail = key.slice(nmIdx + 'node_modules/'.length);
+    return !tail.includes('node_modules/');
+}
+//# sourceMappingURL=npm.js.map

package/dist/dependency/parsers/npm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../../src/dependency/parsers/npm.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,4CAyEC;AAxFD,uCAAyB;AACzB,2CAA6B;AAG7B;;;;;;;;;;GAUG;AACH,SAAgB,gBAAgB,CAAC,YAAoB;IACjD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC,CAAC;IAC3E,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC;aAC7D,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,gCAAgC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,eAAe,GAAW,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpG,IAAI,eAAe,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,uDAAuD;QACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,oDAAoD;YACpD,IAAI,GAAG,KAAK,EAAE;gBAAE,SAAS;YACzB,kEAAkE;YAClE,sEAAsE;YACtE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC3C,IAAI,KAAK,GAAG,CAAC;gBAAE,SAAS;YACxB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACvD,mEAAmE;YACnE,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS,CAAC,gCAAgC;YACnE,MAAM,OAAO,GAAuB,KAAK,CAAC,OAAO,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,OAAO;gBACP,OAAO,EAAE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACtE,YAAY;gBACZ,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;oBAC3D,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC;oBAClB,CAAC,CAAC,KAAK;aACd,CAAC,CAAC;QACP,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3B,qCAAqC;QACrC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,OAAO;QACH,SAAS,EAAE,KAAK;QAChB,YAAY;QACZ,YAAY;QACZ,QAAQ;QACR,cAAc;KACjB,CAAC;AACN,CAAC;AAED,SAAS,SAAS,CACd,IAAyB,EACzB,UAAkB,EAClB,YAAoB,EACpB,GAAsB,EACtB,IAAiB;IAEjB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAuB,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC;QAC3D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC;gBACL,SAAS,EAAE,KAAK;gBAChB,IAAI;gBACJ,OAAO;gBACP,OAAO,EAAE,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC/E,YAAY;gBACZ,MAAM,EAAE,UAAU,KAAK,EAAE;aAC5B,CAAC,CAAC;QACP,CAAC;QACD,IAAI,KAAK,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC9B,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,UAAU,GAAG,IAAI,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACpF,CAAC;IACL,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAW;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC3C,CAAC"}

package/dist/dependency/parsers/pipfile.d.ts

@@ -0,0 +1,8 @@
+import { ParsedLockfile } from '../types';
+/**
+ * Parse a `Pipfile.lock` (Pipenv). It is a JSON document with two top-level
+ * sections, `default` and `develop`, each keyed by package name with `version`
+ * (without leading `==`) and optional `hashes`. Both sections contain the
+ * resolved transitive tree, so we walk them and return everything.
+ */
+export declare function parsePipfileLock(lockfilePath: string): ParsedLockfile | null;

package/dist/dependency/parsers/pipfile.js

@@ -0,0 +1,110 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePipfileLock = parsePipfileLock;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const requirements_1 = require("./requirements");
+/**
+ * Parse a `Pipfile.lock` (Pipenv). It is a JSON document with two top-level
+ * sections, `default` and `develop`, each keyed by package name with `version`
+ * (without leading `==`) and optional `hashes`. Both sections contain the
+ * resolved transitive tree, so we walk them and return everything.
+ */
+function parsePipfileLock(lockfilePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(lockfilePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!data || typeof data !== 'object')
+        return null;
+    const manifestPath = path.join(path.dirname(lockfilePath), 'Pipfile');
+    let projectLicense;
+    try {
+        const pipfile = fs.readFileSync(manifestPath, 'utf8');
+        // Pipfile is TOML; we don't depend on a TOML parser. Best-effort regex
+        // for the top-level `license = "..."` line.
+        const m = pipfile.match(/^\s*license\s*=\s*"([^"]+)"/m);
+        if (m)
+            projectLicense = m[1];
+    }
+    catch {
+        // optional
+    }
+    const packages = [];
+    const seen = new Set();
+    for (const section of ['default', 'develop']) {
+        const deps = data[section];
+        if (!deps || typeof deps !== 'object')
+            continue;
+        for (const [rawName, entry] of Object.entries(deps)) {
+            const name = (0, requirements_1.normalizePipName)(rawName);
+            const version = entry && typeof entry.version === 'string'
+                ? entry.version.replace(/^==/, '')
+                : undefined;
+            if (!version)
+                continue;
+            const id = `${name}@${version}`;
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            packages.push({
+                ecosystem: 'pipenv',
+                name,
+                version,
+                manifestPath,
+                direct: section === 'default',
+            });
+        }
+    }
+    return {
+        ecosystem: 'pipenv',
+        lockfilePath,
+        manifestPath,
+        packages,
+        projectLicense,
+    };
+}
+//# sourceMappingURL=pipfile.js.map

package/dist/dependency/parsers/pipfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipfile.js","sourceRoot":"","sources":["../../../src/dependency/parsers/pipfile.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,4CA2DC;AAtED,uCAAyB;AACzB,2CAA6B;AAE7B,iDAAkD;AAElD;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,YAAoB;IACjD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,uEAAuE;QACvE,4CAA4C;QAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACxD,IAAI,CAAC;YAAE,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACL,WAAW;IACf,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,MAAM,IAAI,GAAoC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,IAAA,+BAAgB,EAAC,OAAO,CAAC,CAAC;YACvC,MAAM,OAAO,GAAuB,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBAC1E,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBAClC,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,QAAQ;gBACnB,IAAI;gBACJ,OAAO;gBACP,YAAY;gBACZ,MAAM,EAAE,OAAO,KAAK,SAAS;aAChC,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO;QACH,SAAS,EAAE,QAAQ;QACnB,YAAY;QACZ,YAAY;QACZ,QAAQ;QACR,cAAc;KACjB,CAAC;AACN,CAAC"}

package/dist/dependency/parsers/pnpm.d.ts

@@ -0,0 +1,11 @@
+import { ParsedLockfile } from '../types';
+/**
+ * Parse a pnpm-lock.yaml (v6+).
+ *
+ * pnpm lockfiles contain the resolved transitive tree under `packages`,
+ * keyed as `<name>@<version>` (with optional peer suffixes). We walk that
+ * section. Importers (`importers`) tell us which deps are direct; we use
+ * it to flag direct vs transitive, but every package ends up in the list
+ * regardless (transitive deps need scanning too).
+ */
+export declare function parsePnpmLockfile(lockfilePath: string): ParsedLockfile | null;

package/dist/dependency/parsers/pnpm.js

@@ -0,0 +1,148 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePnpmLockfile = parsePnpmLockfile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const yaml_1 = require("yaml");
+/**
+ * Parse a pnpm-lock.yaml (v6+).
+ *
+ * pnpm lockfiles contain the resolved transitive tree under `packages`,
+ * keyed as `<name>@<version>` (with optional peer suffixes). We walk that
+ * section. Importers (`importers`) tell us which deps are direct; we use
+ * it to flag direct vs transitive, but every package ends up in the list
+ * regardless (transitive deps need scanning too).
+ */
+function parsePnpmLockfile(lockfilePath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(lockfilePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let data;
+    try {
+        data = (0, yaml_1.parse)(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!data || typeof data !== 'object')
+        return null;
+    const manifestPath = path.join(path.dirname(lockfilePath), 'package.json');
+    let projectLicense;
+    try {
+        const pkg = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        if (typeof pkg.license === 'string')
+            projectLicense = pkg.license;
+        else if (pkg.license && typeof pkg.license === 'object' && typeof pkg.license.type === 'string') {
+            projectLicense = pkg.license.type;
+        }
+    }
+    catch {
+        // optional
+    }
+    // Collect direct dependency names from the lockfile's `importers` section
+    // (more reliable than reading package.json for pnpm, since pnpm prunes).
+    const directKeys = new Set();
+    const importers = data.importers || {};
+    for (const importer of Object.values(importers)) {
+        for (const cat of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+            const deps = importer?.[cat];
+            if (deps && typeof deps === 'object') {
+                for (const name of Object.keys(deps))
+                    directKeys.add(name);
+            }
+        }
+    }
+    const packages = [];
+    const seen = new Set();
+    const pkgSection = data.packages || {};
+    for (const key of Object.keys(pkgSection)) {
+        const entry = pkgSection[key];
+        // pnpm v6+: key like "lodash@4.17.19" or "/lodash/4.17.19"
+        // v9+: key like "lodash@4.17.19(peerdeps...)"
+        const { name, version } = parsePnpmPkgKey(key);
+        if (!name || !version)
+            continue;
+        const id = `${name}@${version}`;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        packages.push({
+            ecosystem: 'pnpm',
+            name,
+            version,
+            manifestPath,
+            direct: directKeys.has(name),
+        });
+    }
+    return {
+        ecosystem: 'pnpm',
+        lockfilePath,
+        manifestPath,
+        packages,
+        projectLicense,
+    };
+}
+/**
+ * Parse a pnpm `packages.<key>` entry. Supported forms:
+ *   "lodash@4.17.19"
+ *   "/lodash/4.17.19"          (older)
+ *   "@babel/core@7.0.0"
+ *   "lodash@4.17.19(react@18)" (peer-suffixed; we strip the parens)
+ */
+function parsePnpmPkgKey(key) {
+    // Strip peer suffix in parens.
+    const parenIdx = key.indexOf('(');
+    let k = parenIdx >= 0 ? key.slice(0, parenIdx) : key;
+    k = k.trim();
+    if (k.startsWith('/'))
+        k = k.slice(1);
+    // For scoped: leading "@" then name then "@version"
+    if (k.startsWith('@')) {
+        const at = k.indexOf('@', 1);
+        if (at < 0)
+            return { name: '', version: '' };
+        return { name: k.slice(0, at), version: k.slice(at + 1) };
+    }
+    const at = k.indexOf('@');
+    if (at < 0)
+        return { name: '', version: '' };
+    return { name: k.slice(0, at), version: k.slice(at + 1) };
+}
+//# sourceMappingURL=pnpm.js.map

package/dist/dependency/parsers/pnpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.js","sourceRoot":"","sources":["../../../src/dependency/parsers/pnpm.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,8CAoEC;AAlFD,uCAAyB;AACzB,2CAA6B;AAC7B,+BAA0C;AAG1C;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,YAAoB;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACD,IAAI,GAAG,IAAA,YAAS,EAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC,CAAC;IAC3E,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC;aAC7D,IAAI,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,WAAW;IACf,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,SAAS,GAAwB,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IAC5D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/D,CAAC;QACL,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAwB,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC5D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,2DAA2D;QAC3D,8CAA8C;QAC9C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS;QAChC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC;YACV,SAAS,EAAE,MAAM;YACjB,IAAI;YACJ,OAAO;YACP,YAAY;YACZ,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;SAC/B,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACH,SAAS,EAAE,MAAM;QACjB,YAAY;QACZ,YAAY;QACZ,QAAQ;QACR,cAAc;KACjB,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAW;IAChC,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACb,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,oDAAoD;IACpD,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/dist/dependency/parsers/requirements.d.ts

@@ -0,0 +1,24 @@
+import { ParsedLockfile } from '../types';
+/**
+ * Parse a `requirements.txt` file.
+ *
+ * Supported pins:
+ *   name==1.2.3
+ *   name>=1.2.3
+ *   name~=1.2.3
+ *   name>1.0,<2.0
+ *   name (unpinned — marked unresolved)
+ *
+ * `#`-comments, blank lines, `-r other.txt`, `-e .`, and VCS/URL specs are
+ * skipped (URL specs are treated as unpinned/unresolved under the package
+ * name extracted from the URL when possible, otherwise skipped entirely).
+ *
+ * IMPORTANT: no network calls are made. When a pin is not an exact `==`,
+ * the entry is marked `unresolved` and surfaced to the user as such rather
+ * than queried against OSV (since the installed version is unknown). A
+ * Pipfile.lock alongside the requirements.txt will be preferred when
+ * present (handled by the resolver/dependencyChecker, not here).
+ */
+export declare function parseRequirementsTxt(lockfilePath: string): ParsedLockfile | null;
+/** Normalize a PyPI package name per PEP 503 (lowercase, runs of [-_.] -> "-"). */
+export declare function normalizePipName(name: string): string;