@tractorcow/beefup 0.0.0 → 1.0.0

package/dist/fsutil.js

@@ -0,0 +1,43 @@
+import { constants } from "node:fs";
+import { access, cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+/**
+ * Returns whether a filesystem path exists and is accessible.
+ */
+export async function pathExists(target) {
+    try {
+        await access(target, constants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Reads a UTF-8 JSON file and parses it as type T.
+ */
+export async function readJsonFile(filePath) {
+    const content = await readFile(filePath, "utf8");
+    return JSON.parse(content);
+}
+/**
+ * Writes a value as pretty-printed JSON, creating parent directories as needed.
+ */
+export async function writeJsonFile(filePath, value) {
+    await mkdir(path.dirname(filePath), { recursive: true });
+    await writeFile(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+/**
+ * Copies a file to a destination path, creating parent directories as needed.
+ */
+export async function copyFileTo(src, dest) {
+    await mkdir(path.dirname(dest), { recursive: true });
+    await cp(src, dest);
+}
+/**
+ * Removes a file or directory tree if it exists.
+ */
+export async function removePath(target) {
+    await rm(target, { recursive: true, force: true });
+}
+//# sourceMappingURL=fsutil.js.map

package/dist/fsutil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fsutil.js","sourceRoot":"","sources":["../src/fsutil.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAI,QAAgB;IACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,KAAc;IAClE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,IAAY;IACxD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC"}

package/dist/lockfile/locked.d.ts

@@ -0,0 +1,9 @@
+import { type PackageManager } from "../project/types.js";
+/**
+ * Reads a lockfile and returns direct dependency versions for one workspace importer.
+ */
+export declare function lockedVersionsForImporter(options: {
+    lockfilePath: string;
+    packageManager: PackageManager;
+    importerDir: string;
+}): Promise<Map<string, string>>;

package/dist/lockfile/locked.js

@@ -0,0 +1,15 @@
+import { readFile } from "node:fs/promises";
+import { PackageManagers } from "../project/types.js";
+import { lockedVersionsFromNpm, parseNpmLockfile } from "./npm.js";
+import { lockedVersionsFromPnpm, parsePnpmLockfile } from "./pnpm.js";
+/**
+ * Reads a lockfile and returns direct dependency versions for one workspace importer.
+ */
+export async function lockedVersionsForImporter(options) {
+    const content = await readFile(options.lockfilePath, "utf8");
+    if (options.packageManager === PackageManagers.Npm) {
+        return lockedVersionsFromNpm(parseNpmLockfile(content), options.importerDir);
+    }
+    return lockedVersionsFromPnpm(parsePnpmLockfile(content), options.importerDir);
+}
+//# sourceMappingURL=locked.js.map

package/dist/lockfile/locked.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"locked.js","sourceRoot":"","sources":["../../src/lockfile/locked.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAuB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEtE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAI/C;IACC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,cAAc,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;QACnD,OAAO,qBAAqB,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,sBAAsB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;AACjF,CAAC"}

package/dist/lockfile/npm.d.ts

@@ -0,0 +1,15 @@
+import type { NpmLockfile, Resolution } from "./types.js";
+/**
+ * Parses package-lock.json content into a typed lockfile object.
+ * Throws when the JSON is invalid.
+ */
+export declare function parseNpmLockfile(content: string): NpmLockfile;
+/**
+ * Reads and resolves an npm lockfile on disk into dependency and devDependency lists.
+ * Includes nested installs with their install paths as scopes.
+ */
+export declare function resolveNpmLockfile(filePath: string): Promise<Resolution>;
+/**
+ * Maps direct (non-nested) package names to locked versions for one npm importer path.
+ */
+export declare function lockedVersionsFromNpm(lockfile: NpmLockfile, importerDir: string): Map<string, string>;

package/dist/lockfile/npm.js

@@ -0,0 +1,152 @@
+import { readFile } from "node:fs/promises";
+/**
+ * Derives a package name from an npm `packages` key (including nested installs).
+ */
+function packageNameFromPackagesKey(key) {
+    if (key === "") {
+        return null;
+    }
+    const marker = "node_modules/";
+    const index = key.lastIndexOf(marker);
+    if (index === -1) {
+        return null;
+    }
+    const name = key.slice(index + marker.length);
+    return name.length > 0 ? name : null;
+}
+/**
+ * Appends dependency entries from an npm lockfile `packages` map, including nested paths.
+ */
+function extractFromPackagesMap(deps, dependencies, devDependencies) {
+    for (const [key, dep] of Object.entries(deps)) {
+        if (!dep || !dep.version) {
+            continue;
+        }
+        const packageName = packageNameFromPackagesKey(key);
+        if (!packageName) {
+            continue;
+        }
+        const info = {
+            name: packageName,
+            version: dep.version,
+            path: key,
+        };
+        if (dep.optional === true) {
+            info.optional = true;
+        }
+        if (dep.dev === true) {
+            devDependencies.push(info);
+            continue;
+        }
+        dependencies.push(info);
+    }
+}
+/**
+ * Recursively walks a lockfileVersion 1 dependency tree, recording each install path.
+ */
+function extractVersion1Tree(deps, dependencies, devDependencies, parentPath, forceDev) {
+    for (const [name, dep] of Object.entries(deps)) {
+        if (!dep || !dep.version) {
+            continue;
+        }
+        const installPath = parentPath
+            ? `${parentPath}/node_modules/${name}`
+            : `node_modules/${name}`;
+        const info = {
+            name,
+            version: dep.version,
+            path: installPath,
+        };
+        if (dep.optional === true) {
+            info.optional = true;
+        }
+        if (forceDev || dep.dev === true) {
+            devDependencies.push(info);
+        }
+        else {
+            dependencies.push(info);
+        }
+        if (dep.dependencies) {
+            extractVersion1Tree(dep.dependencies, dependencies, devDependencies, installPath, forceDev || dep.dev === true);
+        }
+    }
+}
+/**
+ * Builds a Resolution from an npm lockfileVersion 1 `dependencies` layout.
+ */
+function resolveVersion1(lockfile) {
+    const dependencies = [];
+    const devDependencies = [];
+    if (lockfile.dependencies) {
+        extractVersion1Tree(lockfile.dependencies, dependencies, devDependencies, "", false);
+    }
+    if (lockfile.devDependencies) {
+        extractVersion1Tree(lockfile.devDependencies, dependencies, devDependencies, "", true);
+    }
+    return { dependencies, devDependencies };
+}
+/**
+ * Builds a Resolution from an npm lockfileVersion 2/3 `packages` layout.
+ */
+function resolveVersion2Or3(lockfile) {
+    const dependencies = [];
+    const devDependencies = [];
+    if (lockfile.packages) {
+        extractFromPackagesMap(lockfile.packages, dependencies, devDependencies);
+    }
+    return { dependencies, devDependencies };
+}
+/**
+ * Parses package-lock.json content into a typed lockfile object.
+ * Throws when the JSON is invalid.
+ */
+export function parseNpmLockfile(content) {
+    try {
+        return JSON.parse(content);
+    }
+    catch (error) {
+        throw new Error(`Failed to parse package-lock.json: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * Reads and resolves an npm lockfile on disk into dependency and devDependency lists.
+ * Includes nested installs with their install paths as scopes.
+ */
+export async function resolveNpmLockfile(filePath) {
+    const parsed = parseNpmLockfile(await readFile(filePath, "utf8"));
+    const lockfileVersion = parsed.lockfileVersion ?? 1;
+    switch (lockfileVersion) {
+        case 1:
+            return resolveVersion1(parsed);
+        case 2:
+        case 3:
+            return resolveVersion2Or3(parsed);
+        default:
+            throw new Error(`Unsupported lockfileVersion: ${lockfileVersion}. Only versions 1, 2, and 3 are supported.`);
+    }
+}
+/**
+ * Maps direct (non-nested) package names to locked versions for one npm importer path.
+ */
+export function lockedVersionsFromNpm(lockfile, importerDir) {
+    const locked = new Map();
+    const packages = lockfile.packages ?? {};
+    const prefix = importerDir === "." || importerDir === ""
+        ? "node_modules/"
+        : `${importerDir.replace(/\\/g, "/")}/node_modules/`;
+    for (const [key, meta] of Object.entries(packages)) {
+        if (!meta?.version) {
+            continue;
+        }
+        if (!key.startsWith(prefix)) {
+            continue;
+        }
+        const rest = key.slice(prefix.length);
+        if (rest.includes("/node_modules/")) {
+            continue;
+        }
+        locked.set(rest, meta.version);
+    }
+    return locked;
+}
+//# sourceMappingURL=npm.js.map

package/dist/lockfile/npm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../src/lockfile/npm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAS5C;;GAEG;AACH,SAAS,0BAA0B,CAAC,GAAW;IAC7C,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAC7B,IAA2C,EAC3C,YAA2B,EAC3B,eAA8B;IAE9B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAgB;YACxB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG;SACV,CAAC;QACF,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACrB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,IAA2C,EAC3C,YAA2B,EAC3B,eAA8B,EAC9B,UAAkB,EAClB,QAAiB;IAEjB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,UAAU;YAC5B,CAAC,CAAC,GAAG,UAAU,iBAAiB,IAAI,EAAE;YACtC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAgB;YACxB,IAAI;YACJ,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,WAAW;SAClB,CAAC;QACF,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACjC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrB,mBAAmB,CACjB,GAAG,CAAC,YAAY,EAChB,YAAY,EACZ,eAAe,EACf,WAAW,EACX,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,QAAqB;IAC5C,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,eAAe,GAAkB,EAAE,CAAC;IAC1C,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC1B,mBAAmB,CACjB,QAAQ,CAAC,YAAY,EACrB,YAAY,EACZ,eAAe,EACf,EAAE,EACF,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC7B,mBAAmB,CACjB,QAAQ,CAAC,eAAe,EACxB,YAAY,EACZ,eAAe,EACf,EAAE,EACF,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,QAAqB;IAC/C,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,eAAe,GAAkB,EAAE,CAAC;IAC1C,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;IACpD,QAAQ,eAAe,EAAE,CAAC;QACxB,KAAK,CAAC;YACJ,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,CAAC;QACP,KAAK,CAAC;YACJ,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACpC;YACE,MAAM,IAAI,KAAK,CACb,gCAAgC,eAAe,4CAA4C,CAC5F,CAAC;IACN,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqB,EACrB,WAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GACV,WAAW,KAAK,GAAG,IAAI,WAAW,KAAK,EAAE;QACvC,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,gBAAgB,CAAC;IAEzD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lockfile/pnpm.d.ts

@@ -0,0 +1,27 @@
+import type { PnpmLockfile, Resolution } from "./types.js";
+/**
+ * Parses a pnpm packages-map key into package name and optional embedded version.
+ */
+declare function extractPackageInfoFromName(key: string): {
+    name: string;
+    version: string | null;
+} | null;
+/**
+ * Parses pnpm-lock.yaml content into a typed lockfile object.
+ * Throws when the YAML is not a valid object.
+ */
+export declare function parsePnpmLockfile(content: string): PnpmLockfile;
+/**
+ * Reads and resolves a pnpm lockfile on disk into dependency and devDependency lists.
+ * Each packages-map entry is a scoped install keyed by its lockfile path.
+ */
+export declare function resolvePnpmLockfile(filePath: string): Promise<Resolution>;
+/**
+ * Removes the peer-dependency suffix (parenthetical) from a pnpm version string.
+ */
+export declare function stripPnpmPeerSuffix(value: string): string;
+/**
+ * Maps direct dependency names to locked versions for one pnpm importer path.
+ */
+export declare function lockedVersionsFromPnpm(lockfile: PnpmLockfile, importerDir: string): Map<string, string>;
+export { extractPackageInfoFromName };

package/dist/lockfile/pnpm.js

@@ -0,0 +1,155 @@
+import { readFile } from "node:fs/promises";
+import { parse as parseYaml } from "yaml";
+/**
+ * Normalizes a pnpm package key, dropping nested node_modules paths.
+ */
+function cleanPackageKey(key) {
+    const parts = key.split("/");
+    const nodeModulesIndex = parts.indexOf("node_modules");
+    if (nodeModulesIndex !== -1) {
+        const nodeModulesCount = parts.filter((part) => part === "node_modules").length;
+        if (nodeModulesCount !== 1) {
+            return null;
+        }
+        return parts.slice(nodeModulesIndex + 1).join("/");
+    }
+    return key;
+}
+/**
+ * Parses a pnpm packages-map key into package name and optional embedded version.
+ */
+function extractPackageInfoFromName(key) {
+    const packageKey = cleanPackageKey(key);
+    if (!packageKey) {
+        return null;
+    }
+    let working = packageKey;
+    if (working.startsWith("/")) {
+        working = working.slice(1);
+    }
+    const paren = working.indexOf("(");
+    if (paren !== -1) {
+        working = working.slice(0, paren);
+    }
+    if (working.startsWith("@")) {
+        const lastAtIndex = working.lastIndexOf("@");
+        if (lastAtIndex <= 0) {
+            return { name: working, version: null };
+        }
+        return {
+            name: working.slice(0, lastAtIndex),
+            version: working.slice(lastAtIndex + 1),
+        };
+    }
+    const at = working.lastIndexOf("@");
+    if (at <= 0) {
+        return { name: working, version: null };
+    }
+    return {
+        name: working.slice(0, at),
+        version: working.slice(at + 1),
+    };
+}
+/**
+ * Parses pnpm-lock.yaml content into a typed lockfile object.
+ * Throws when the YAML is not a valid object.
+ */
+export function parsePnpmLockfile(content) {
+    try {
+        const parsed = parseYaml(content);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("Parsed YAML is not an object");
+        }
+        return parsed;
+    }
+    catch (error) {
+        throw new Error(`Failed to parse pnpm-lock.yaml: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * Reads and resolves a pnpm lockfile on disk into dependency and devDependency lists.
+ * Each packages-map entry is a scoped install keyed by its lockfile path.
+ */
+export async function resolvePnpmLockfile(filePath) {
+    const lockfile = parsePnpmLockfile(await readFile(filePath, "utf8"));
+    const dependencies = [];
+    const devDependencies = [];
+    if (lockfile.packages) {
+        for (const [key, pkg] of Object.entries(lockfile.packages)) {
+            if (!pkg || typeof pkg !== "object") {
+                continue;
+            }
+            const nameAndVersion = extractPackageInfoFromName(key);
+            if (!nameAndVersion) {
+                continue;
+            }
+            const version = typeof pkg.version === "string" ? pkg.version : nameAndVersion.version;
+            if (!version) {
+                continue;
+            }
+            const info = {
+                name: nameAndVersion.name,
+                version,
+                path: key,
+            };
+            if (pkg.optional === true) {
+                info.optional = true;
+            }
+            if (pkg.dev === true) {
+                devDependencies.push(info);
+                continue;
+            }
+            dependencies.push(info);
+        }
+    }
+    return { dependencies, devDependencies };
+}
+/**
+ * Removes the peer-dependency suffix (parenthetical) from a pnpm version string.
+ */
+export function stripPnpmPeerSuffix(value) {
+    const paren = value.indexOf("(");
+    return paren === -1 ? value : value.slice(0, paren);
+}
+/**
+ * Extracts a concrete version from a pnpm importer dependency entry.
+ */
+function importerVersion(value) {
+    if (typeof value === "string") {
+        return stripPnpmPeerSuffix(value);
+    }
+    if (value && typeof value.version === "string") {
+        return stripPnpmPeerSuffix(value.version);
+    }
+    return undefined;
+}
+/**
+ * Maps direct dependency names to locked versions for one pnpm importer path.
+ */
+export function lockedVersionsFromPnpm(lockfile, importerDir) {
+    const locked = new Map();
+    const key = importerDir === "." ? "." : importerDir.replace(/\\/g, "/");
+    const importer = lockfile.importers?.[key];
+    if (!importer) {
+        return locked;
+    }
+    const buckets = [
+        importer.dependencies,
+        importer.devDependencies,
+        importer.optionalDependencies,
+    ];
+    for (const bucket of buckets) {
+        if (!bucket) {
+            continue;
+        }
+        for (const [name, info] of Object.entries(bucket)) {
+            const version = importerVersion(info);
+            if (version && !version.startsWith("link:") && !version.startsWith("file:")) {
+                locked.set(name, version);
+            }
+        }
+    }
+    return locked;
+}
+export { extractPackageInfoFromName };
+//# sourceMappingURL=pnpm.js.map

package/dist/lockfile/pnpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.js","sourceRoot":"","sources":["../../src/lockfile/pnpm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAS1C;;GAEG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,gBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5B,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,MAAM,CAAC;QAChF,IAAI,gBAAgB,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CACjC,GAAW;IAEX,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,GAAG,UAAU,CAAC;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC;YACnC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC;SACxC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAsB,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,eAAe,GAAkB,EAAE,CAAC;IAE1C,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YACD,MAAM,cAAc,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC;YACzE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAgB;gBACxB,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,OAAO;gBACP,IAAI,EAAE,GAAG;aACV,CAAC;YACF,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;gBACrB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,KAA2C;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAsB,EACtB,WAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,GAAG,GAAG,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG;QACd,QAAQ,CAAC,YAAY;QACrB,QAAQ,CAAC,eAAe;QACxB,QAAQ,CAAC,oBAAoB;KAC9B,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5E,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,0BAA0B,EAAE,CAAC"}

package/dist/lockfile/resolve.d.ts

@@ -0,0 +1,10 @@
+import { type PackageManager } from "../project/types.js";
+import type { Resolution } from "./types.js";
+/**
+ * Resolves direct dependency versions from an npm or pnpm lockfile.
+ */
+export declare function resolveLockfile(lockfilePath: string, packageManager: PackageManager): Promise<Resolution>;
+/**
+ * Reads a UTF-8 text file from disk.
+ */
+export declare function readText(filePath: string): Promise<string>;

package/dist/lockfile/resolve.js

@@ -0,0 +1,20 @@
+import { readFile } from "node:fs/promises";
+import { PackageManagers } from "../project/types.js";
+import { resolveNpmLockfile } from "./npm.js";
+import { resolvePnpmLockfile } from "./pnpm.js";
+/**
+ * Resolves direct dependency versions from an npm or pnpm lockfile.
+ */
+export async function resolveLockfile(lockfilePath, packageManager) {
+    if (packageManager === PackageManagers.Npm) {
+        return resolveNpmLockfile(lockfilePath);
+    }
+    return resolvePnpmLockfile(lockfilePath);
+}
+/**
+ * Reads a UTF-8 text file from disk.
+ */
+export async function readText(filePath) {
+    return readFile(filePath, "utf8");
+}
+//# sourceMappingURL=resolve.js.map

package/dist/lockfile/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/lockfile/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAuB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGhD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,cAA8B;IAE9B,IAAI,cAAc,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;QAC3C,OAAO,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,mBAAmB,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB;IAC7C,OAAO,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/lockfile/types.d.ts

@@ -0,0 +1,49 @@
+export interface LockPackage {
+    name: string;
+    version: string;
+    /** Install / lockfile scope used for path-for-path comparison. */
+    path: string;
+    /** True when the lockfile marks this install as optional. */
+    optional?: boolean;
+}
+export interface Resolution {
+    dependencies: LockPackage[];
+    devDependencies: LockPackage[];
+}
+export interface NpmLockfileDependency {
+    version?: string;
+    dev?: boolean;
+    optional?: boolean;
+    dependencies?: Record<string, NpmLockfileDependency>;
+}
+export interface NpmLockfile {
+    lockfileVersion?: number;
+    packages?: Record<string, NpmLockfileDependency>;
+    dependencies?: Record<string, NpmLockfileDependency>;
+    devDependencies?: Record<string, NpmLockfileDependency>;
+}
+export interface PnpmLockfilePackage {
+    version?: string;
+    dev?: boolean;
+    optional?: boolean;
+    dependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+}
+export interface PnpmImporterDep {
+    specifier?: string;
+    version?: string;
+}
+export interface PnpmImporter {
+    dependencies?: Record<string, PnpmImporterDep | string>;
+    devDependencies?: Record<string, PnpmImporterDep | string>;
+    optionalDependencies?: Record<string, PnpmImporterDep | string>;
+    peerDependencies?: Record<string, PnpmImporterDep | string>;
+}
+export interface PnpmLockfile {
+    lockfileVersion?: string | number;
+    importers?: Record<string, PnpmImporter>;
+    packages?: Record<string, PnpmLockfilePackage>;
+    snapshots?: Record<string, PnpmLockfilePackage>;
+}

package/dist/lockfile/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/lockfile/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/lockfile/types.ts"],"names":[],"mappings":""}

package/dist/pm/cve-lite-bin.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Resolves the absolute path to the pinned cve-lite-cli binary on disk.
+ * Throws BeefupError when the package or bin entry is missing.
+ */
+export declare function resolveCveLiteBin(): Promise<string>;

package/dist/pm/cve-lite-bin.js

@@ -0,0 +1,36 @@
+import { createRequire } from "node:module";
+import path from "node:path";
+import { BeefupError } from "../errors.js";
+import { pathExists, readJsonFile } from "../fsutil.js";
+/**
+ * Resolves the absolute path to the pinned cve-lite-cli binary on disk.
+ * Throws BeefupError when the package or bin entry is missing.
+ */
+export async function resolveCveLiteBin() {
+    const require = createRequire(import.meta.url);
+    let pkgJsonPath;
+    try {
+        pkgJsonPath = require.resolve("cve-lite-cli/package.json");
+    }
+    catch {
+        throw new BeefupError("cve-lite-cli is not installed; Beefup requires it as a pinned dependency");
+    }
+    const pkg = await readJsonFile(pkgJsonPath);
+    const binField = pkg.bin;
+    let rel;
+    if (typeof binField === "string") {
+        rel = binField;
+    }
+    else if (binField && typeof binField === "object") {
+        rel = binField["cve-lite"] ?? Object.values(binField)[0];
+    }
+    if (!rel) {
+        throw new BeefupError("cve-lite-cli package.json is missing a bin entry");
+    }
+    const resolved = path.resolve(path.dirname(pkgJsonPath), rel);
+    if (!(await pathExists(resolved))) {
+        throw new BeefupError(`cve-lite binary not found at ${resolved}`);
+    }
+    return resolved;
+}
+//# sourceMappingURL=cve-lite-bin.js.map

package/dist/pm/cve-lite-bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-lite-bin.js","sourceRoot":"","sources":["../../src/pm/cve-lite-bin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAMxD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CACnB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAiB,WAAW,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC;IACzB,IAAI,GAAuB,CAAC;IAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;SAAM,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,WAAW,CAAC,kDAAkD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,WAAW,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/pm/install.d.ts

@@ -0,0 +1,24 @@
+import { type PackageManager } from "../project/types.js";
+import type { ProcessRunner } from "./runner.js";
+import type { ProtectedPm } from "./safe-chain.js";
+/**
+ * Frozen-lockfile install argv per package manager (never a bare mutating install).
+ */
+export declare const FrozenInstallArgv: {
+    readonly npm: readonly ["ci"];
+    readonly pnpm: readonly ["install", "--frozen-lockfile"];
+};
+/**
+ * Returns argv that installs node_modules exactly from the current lockfile.
+ */
+export declare function frozenInstallArgs(packageManager: PackageManager): string[];
+/**
+ * Installs packages from the live lockfile through a Safe Chain–protected package manager.
+ * Uses `npm ci` or `pnpm install --frozen-lockfile` so the reviewed lockfile is not rewritten.
+ */
+export declare function installFromLockfile(options: {
+    pm: ProtectedPm;
+    packageManager: PackageManager;
+    cwd: string;
+    runner: ProcessRunner;
+}): Promise<void>;

package/dist/pm/install.js

@@ -0,0 +1,30 @@
+import { BeefupError } from "../errors.js";
+import { PackageManagers } from "../project/types.js";
+/**
+ * Frozen-lockfile install argv per package manager (never a bare mutating install).
+ */
+export const FrozenInstallArgv = {
+    [PackageManagers.Npm]: ["ci"],
+    [PackageManagers.Pnpm]: ["install", "--frozen-lockfile"],
+};
+/**
+ * Returns argv that installs node_modules exactly from the current lockfile.
+ */
+export function frozenInstallArgs(packageManager) {
+    return [...FrozenInstallArgv[packageManager]];
+}
+/**
+ * Installs packages from the live lockfile through a Safe Chain–protected package manager.
+ * Uses `npm ci` or `pnpm install --frozen-lockfile` so the reviewed lockfile is not rewritten.
+ */
+export async function installFromLockfile(options) {
+    const args = [
+        ...options.pm.prefixArgs,
+        ...frozenInstallArgs(options.packageManager),
+    ];
+    const result = await options.runner.run(options.pm.bin, args, options.cwd);
+    if (result.code !== 0) {
+        throw new BeefupError(`frozen install failed (${options.pm.bin} ${args.join(" ")}):\n${result.stderr || result.stdout}`);
+    }
+}
+//# sourceMappingURL=install.js.map

package/dist/pm/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/pm/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAuB,MAAM,qBAAqB,CAAC;AAI3E;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;IAC7B,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,mBAAmB,CAAC;CAChD,CAAC;AAEX;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,cAA8B;IAC9D,OAAO,CAAC,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAKzC;IACC,MAAM,IAAI,GAAG;QACX,GAAG,OAAO,CAAC,EAAE,CAAC,UAAU;QACxB,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC;KAC7C,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CACnB,0BAA0B,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAClG,CAAC;IACJ,CAAC;AACH,CAAC"}