@tractorcow/beefup 0.0.0 → 1.0.0

package/dist/pm/runner.d.ts

@@ -0,0 +1,17 @@
+/** Captured stdout, stderr, and exit code from a child process. */
+export interface RunResult {
+    stdout: string;
+    stderr: string;
+    code: number;
+}
+/** Abstraction for running package-manager or scanner binaries. */
+export interface ProcessRunner {
+    /**
+     * Spawns a binary with args in cwd and returns captured output and exit code.
+     */
+    run(bin: string, args: string[], cwd: string): Promise<RunResult>;
+}
+/**
+ * Default ProcessRunner that spawns a child process and collects stdout/stderr.
+ */
+export declare const defaultProcessRunner: ProcessRunner;

package/dist/pm/runner.js

@@ -0,0 +1,27 @@
+import { spawn } from "node:child_process";
+/**
+ * Default ProcessRunner that spawns a child process and collects stdout/stderr.
+ */
+export const defaultProcessRunner = {
+    /**
+     * Spawns a binary with args in cwd and returns captured output and exit code.
+     */
+    async run(bin, args, cwd) {
+        return new Promise((resolve, reject) => {
+            const child = spawn(bin, args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+            const stdoutChunks = [];
+            const stderrChunks = [];
+            child.stdout.on("data", (chunk) => stdoutChunks.push(chunk));
+            child.stderr.on("data", (chunk) => stderrChunks.push(chunk));
+            child.on("error", reject);
+            child.on("close", (code) => {
+                resolve({
+                    stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+                    stderr: Buffer.concat(stderrChunks).toString("utf8"),
+                    code: code ?? 1,
+                });
+            });
+        });
+    },
+};
+//# sourceMappingURL=runner.js.map

package/dist/pm/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/pm/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAiB3C;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkB;IACjD;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG;QACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,OAAO,CAAC;oBACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACpD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACpD,IAAI,EAAE,IAAI,IAAI,CAAC;iBAChB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/pm/safe-chain.d.ts

@@ -0,0 +1,17 @@
+import { type PackageManager } from "../project/types.js";
+export interface ProtectedPm {
+    bin: string;
+    prefixArgs: string[];
+}
+/**
+ * Returns the Aikido Safe Chain wrapper binary name for a package manager.
+ */
+export declare function aikidoBinName(packageManager: PackageManager): string;
+/**
+ * Locates a Safe Chain–protected package manager binary and prefix args.
+ */
+export declare function resolveProtectedPm(packageManager: PackageManager): Promise<ProtectedPm>;
+/**
+ * Asserts that the resolved npm binary reports major version 12 or higher.
+ */
+export declare function assertNpmVersion(pm: ProtectedPm): Promise<void>;

package/dist/pm/safe-chain.js

@@ -0,0 +1,65 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { promisify } from "node:util";
+import { BeefupError } from "../errors.js";
+import { PackageManagers } from "../project/types.js";
+const execFile = promisify(execFileCallback);
+/**
+ * Returns the Aikido Safe Chain wrapper binary name for a package manager.
+ */
+export function aikidoBinName(packageManager) {
+    return packageManager === PackageManagers.Npm ? "aikido-npm" : "aikido-pnpm";
+}
+/**
+ * Resolves an executable on PATH via `which`, or undefined when missing.
+ */
+async function which(bin) {
+    try {
+        const { stdout } = await execFile("which", [bin], { encoding: "utf8" });
+        const resolved = stdout.trim();
+        return resolved.length > 0 ? resolved : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Locates a Safe Chain–protected package manager binary and prefix args.
+ */
+export async function resolveProtectedPm(packageManager) {
+    const aikido = await which(aikidoBinName(packageManager));
+    if (aikido) {
+        return { bin: aikido, prefixArgs: [] };
+    }
+    const safeChain = await which("safe-chain");
+    if (safeChain) {
+        return { bin: safeChain, prefixArgs: [packageManager] };
+    }
+    throw new BeefupError(`Safe-chain is not enabled: neither ${aikidoBinName(packageManager)} nor safe-chain was found on PATH. Install Aikido Safe Chain and ensure it wraps ${packageManager}.`);
+}
+/**
+ * Parses the major version number from a package manager `--version` output.
+ */
+function parseMajorVersion(raw) {
+    const match = raw.trim().match(/(\d+)\./);
+    if (!match) {
+        return undefined;
+    }
+    return Number.parseInt(match[1], 10);
+}
+/**
+ * Asserts that the resolved npm binary reports major version 12 or higher.
+ */
+export async function assertNpmVersion(pm) {
+    const { stdout, stderr } = await execFile(pm.bin, [...pm.prefixArgs, "--version"], {
+        encoding: "utf8",
+    });
+    const raw = `${stdout}\n${stderr}`;
+    const major = parseMajorVersion(raw);
+    if (major === undefined) {
+        throw new BeefupError(`could not parse npm version from: ${raw.trim()}`);
+    }
+    if (major < 12) {
+        throw new BeefupError(`npm 12+ is required (got ${raw.trim().split("\n").pop()})`);
+    }
+}
+//# sourceMappingURL=safe-chain.js.map

package/dist/pm/safe-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-chain.js","sourceRoot":"","sources":["../../src/pm/safe-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAuB,MAAM,qBAAqB,CAAC;AAE3E,MAAM,QAAQ,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAO7C;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,cAA8B;IAC1D,OAAO,cAAc,KAAK,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;AAC/E,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,KAAK,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,cAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,WAAW,CACnB,sCAAsC,aAAa,CAAC,cAAc,CAAC,oFAAoF,cAAc,GAAG,CACzK,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAe;IACpD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE;QACjF,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,qCAAqC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CACnB,4BAA4B,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/pm/update.d.ts

@@ -0,0 +1,16 @@
+import { type PackageManager } from "../project/types.js";
+import type { ProcessRunner } from "./runner.js";
+import type { ProtectedPm } from "./safe-chain.js";
+/**
+ * Returns lockfile-only update CLI args for the given package manager.
+ */
+export declare function lockfileUpdateArgs(packageManager: PackageManager): string[];
+/**
+ * Regenerates the project lockfile through a Safe Chain–protected package manager.
+ */
+export declare function regenerateLockfile(options: {
+    pm: ProtectedPm;
+    packageManager: PackageManager;
+    cwd: string;
+    runner: ProcessRunner;
+}): Promise<void>;

package/dist/pm/update.js

@@ -0,0 +1,25 @@
+import { BeefupError } from "../errors.js";
+import { PackageManagers } from "../project/types.js";
+/**
+ * Returns lockfile-only update CLI args for the given package manager.
+ */
+export function lockfileUpdateArgs(packageManager) {
+    if (packageManager === PackageManagers.Npm) {
+        return ["update", "--package-lock-only", "--ignore-scripts"];
+    }
+    return ["update", "--lockfile-only", "--ignore-scripts", "--no-save"];
+}
+/**
+ * Regenerates the project lockfile through a Safe Chain–protected package manager.
+ */
+export async function regenerateLockfile(options) {
+    const args = [
+        ...options.pm.prefixArgs,
+        ...lockfileUpdateArgs(options.packageManager),
+    ];
+    const result = await options.runner.run(options.pm.bin, args, options.cwd);
+    if (result.code !== 0) {
+        throw new BeefupError(`lockfile regeneration failed (${options.pm.bin} ${args.join(" ")}):\n${result.stderr || result.stdout}`);
+    }
+}
+//# sourceMappingURL=update.js.map

package/dist/pm/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/pm/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAuB,MAAM,qBAAqB,CAAC;AAI3E;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,cAA8B;IAC/D,IAAI,cAAc,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;QAC3C,OAAO,CAAC,QAAQ,EAAE,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,QAAQ,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAKxC;IACC,MAAM,IAAI,GAAG;QACX,GAAG,OAAO,CAAC,EAAE,CAAC,UAAU;QACxB,GAAG,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;KAC9C,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CACnB,iCAAiC,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CACzG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/policy/alignment.d.ts

@@ -0,0 +1,13 @@
+import { type AlignmentAction, type BeefupConfig } from "../config/types.js";
+import type { NpmLockfile, PnpmLockfile } from "../lockfile/types.js";
+import { type PackageJson } from "../project/package-json.js";
+import { type PackageManager } from "../project/types.js";
+export interface AlignmentFinding {
+    group: string;
+    message: string;
+    severity: AlignmentAction;
+}
+/**
+ * Finds alignment mismatches for every configured group in the project.
+ */
+export declare function findAlignmentIssues(config: BeefupConfig, pkg: PackageJson, packageManager: PackageManager, lock: NpmLockfile | PnpmLockfile, workspaceOverrides?: Record<string, unknown>): AlignmentFinding[];

package/dist/policy/alignment.js

@@ -0,0 +1,171 @@
+import { AlignmentActions, } from "../config/types.js";
+import { extractPackageInfoFromName } from "../lockfile/pnpm.js";
+import { DIRECT_DEP_FIELDS, } from "../project/package-json.js";
+import { PackageManagers } from "../project/types.js";
+/**
+ * Reads a pinned override value, including nested `"."` map forms.
+ */
+function overridePin(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    if (value && typeof value === "object" && typeof value["."] === "string") {
+        return value["."];
+    }
+    return null;
+}
+/**
+ * Returns the direct-dependency version spec for `source` from package.json.
+ */
+function expectedVersion(pkg, source) {
+    for (const field of DIRECT_DEP_FIELDS) {
+        const spec = pkg[field]?.[source];
+        if (spec) {
+            return spec;
+        }
+    }
+    return undefined;
+}
+/**
+ * Collects resolved lockfile versions for the given package names.
+ */
+function collectLockVersions(packageManager, lock, names) {
+    const found = new Map();
+    /** Records a resolved version for a package name when it is in scope. */
+    const add = (name, version) => {
+        if (!names.has(name)) {
+            return;
+        }
+        const set = found.get(name) ?? new Set();
+        set.add(version);
+        found.set(name, set);
+    };
+    if (packageManager === PackageManagers.Npm) {
+        const packages = lock.packages ?? {};
+        for (const [key, meta] of Object.entries(packages)) {
+            if (!meta?.version) {
+                continue;
+            }
+            const parts = key.split("node_modules/");
+            const name = parts[parts.length - 1];
+            if (name) {
+                add(name, meta.version);
+            }
+        }
+        return found;
+    }
+    const pnpm = lock;
+    for (const [key, meta] of Object.entries(pnpm.packages ?? {})) {
+        const info = extractPackageInfoFromName(key);
+        if (!info) {
+            continue;
+        }
+        const version = meta?.version ?? info.version;
+        if (version) {
+            add(info.name, version);
+        }
+    }
+    for (const key of Object.keys(pnpm.snapshots ?? {})) {
+        const info = extractPackageInfoFromName(key);
+        if (info?.version) {
+            add(info.name, info.version);
+        }
+    }
+    return found;
+}
+/**
+ * Checks one aligned group for package.json, override, and lockfile mismatches.
+ */
+function checkGroup(group, pkg, packageManager, lock, workspaceOverrides, defaultAction) {
+    const severity = group.onMismatch ?? defaultAction;
+    const expected = expectedVersion(pkg, group.source);
+    const findings = [];
+    if (!expected) {
+        findings.push({
+            group: group.name,
+            severity,
+            message: `source package ${group.source} is not a direct dependency`,
+        });
+        return findings;
+    }
+    if (/[^\d.]/.test(expected)) {
+        findings.push({
+            group: group.name,
+            severity,
+            message: `${group.source} must be an exact version, got "${expected}"`,
+        });
+        return findings;
+    }
+    const names = new Set([group.source, ...group.packages]);
+    for (const field of DIRECT_DEP_FIELDS) {
+        const bucket = pkg[field];
+        if (!bucket) {
+            continue;
+        }
+        for (const name of names) {
+            const actual = bucket[name];
+            if (actual && actual !== expected) {
+                findings.push({
+                    group: group.name,
+                    severity,
+                    message: `${field}["${name}"] is ${actual}, expected ${expected}`,
+                });
+            }
+        }
+    }
+    const overrideMaps = [];
+    if (pkg.overrides && typeof pkg.overrides === "object") {
+        overrideMaps.push({ label: "package.json#overrides", map: pkg.overrides });
+    }
+    if (workspaceOverrides) {
+        overrideMaps.push({
+            label: "pnpm-workspace.yaml#overrides",
+            map: workspaceOverrides,
+        });
+    }
+    for (const { label, map } of overrideMaps) {
+        for (const name of group.packages) {
+            if (name === group.source) {
+                continue;
+            }
+            if (map[name] === undefined) {
+                continue;
+            }
+            const pinned = overridePin(map[name]);
+            if (pinned !== expected) {
+                findings.push({
+                    group: group.name,
+                    severity,
+                    message: `${label}["${name}"] is ${JSON.stringify(pinned)}, expected "${expected}"`,
+                });
+            }
+        }
+    }
+    const found = collectLockVersions(packageManager, lock, names);
+    for (const name of names) {
+        const versions = found.get(name);
+        if (!versions) {
+            continue;
+        }
+        const unexpected = [...versions].filter((version) => version !== expected);
+        if (unexpected.length) {
+            findings.push({
+                group: group.name,
+                severity,
+                message: `${name}: lockfile has ${[...versions].sort().join(", ")}, expected ${expected}`,
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Finds alignment mismatches for every configured group in the project.
+ */
+export function findAlignmentIssues(config, pkg, packageManager, lock, workspaceOverrides) {
+    const findings = [];
+    for (const group of config.alignedGroups) {
+        findings.push(...checkGroup(group, pkg, packageManager, lock, workspaceOverrides, config.alignment ?? AlignmentActions.Error));
+    }
+    return findings;
+}
+//# sourceMappingURL=alignment.js.map

package/dist/policy/alignment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alignment.js","sourceRoot":"","sources":["../../src/policy/alignment.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAIjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,eAAe,EAAuB,MAAM,qBAAqB,CAAC;AAQ3E;;GAEG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAiC,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtG,OAAQ,KAAgC,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,GAAgB,EAAE,MAAc;IACvD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,cAA8B,EAC9B,IAAgC,EAChC,KAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,yEAAyE;IACzE,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE;QAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,IAAI,cAAc,KAAK,eAAe,CAAC,GAAG,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAI,IAAoB,CAAC,QAAQ,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,IAAoB,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CACjB,KAAmB,EACnB,GAAgB,EAChB,cAA8B,EAC9B,IAAgC,EAChC,kBAAuD,EACvD,aAA8B;IAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC;IACnD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,QAAQ;YACR,OAAO,EAAE,kBAAkB,KAAK,CAAC,MAAM,6BAA6B;SACrE,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,QAAQ;YACR,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,mCAAmC,QAAQ,GAAG;SACvE,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,QAAQ;oBACR,OAAO,EAAE,GAAG,KAAK,KAAK,IAAI,SAAS,MAAM,cAAc,QAAQ,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAA2D,EAAE,CAAC;IAChF,IAAI,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACvD,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,kBAAkB,EAAE,CAAC;QACvB,YAAY,CAAC,IAAI,CAAC;YAChB,KAAK,EAAE,+BAA+B;YACtC,GAAG,EAAE,kBAAkB;SACxB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,YAAY,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,QAAQ;oBACR,OAAO,EAAE,GAAG,KAAK,KAAK,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,QAAQ,GAAG;iBACpF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC;QAC3E,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,QAAQ;gBACR,OAAO,EAAE,GAAG,IAAI,kBAAkB,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,QAAQ,EAAE;aAC1F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAoB,EACpB,GAAgB,EAChB,cAA8B,EAC9B,IAAgC,EAChC,kBAA4C;IAE5C,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CACX,KAAK,EACL,GAAG,EACH,cAAc,EACd,IAAI,EACJ,kBAAkB,EAClB,MAAM,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAC3C,CACF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/policy/evaluate.d.ts

@@ -0,0 +1,19 @@
+import { type BeefupConfig } from "../config/types.js";
+import { type PackageManager } from "../project/types.js";
+import { type AlignmentFinding } from "./alignment.js";
+import { type OverrideFinding } from "./overrides.js";
+import { type RangeFinding } from "./ranges.js";
+export interface PolicyResult {
+    ranges: RangeFinding[];
+    overrides: OverrideFinding[];
+    alignment: AlignmentFinding[];
+    warnings: string[];
+}
+/**
+ * Evaluates range, override, and alignment policy against a project workspace.
+ */
+export declare function evaluatePolicy(root: string, packageManager: PackageManager, lockfileName: string, config: BeefupConfig): Promise<PolicyResult>;
+/**
+ * Throws when the policy result contains any error-severity findings.
+ */
+export declare function assertPolicy(result: PolicyResult): void;

package/dist/policy/evaluate.js

@@ -0,0 +1,75 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { parse as parseYaml } from "yaml";
+import { AlignmentActions } from "../config/types.js";
+import { BeefupError } from "../errors.js";
+import { pathExists, readJsonFile } from "../fsutil.js";
+import { parseNpmLockfile } from "../lockfile/npm.js";
+import { parsePnpmLockfile } from "../lockfile/pnpm.js";
+import { PackageManagers } from "../project/types.js";
+import { listWorkspacePackages } from "../project/workspace.js";
+import { findAlignmentIssues } from "./alignment.js";
+import { findStaleOverridePins, findWorkspaceOverrideDrift, normalizeLockForOverrides, } from "./overrides.js";
+import { findRangeIssues } from "./ranges.js";
+/**
+ * Evaluates range, override, and alignment policy against a project workspace.
+ */
+export async function evaluatePolicy(root, packageManager, lockfileName, config) {
+    const pkg = await readJsonFile(path.join(root, "package.json"));
+    const lockPath = path.join(root, lockfileName);
+    const lockContent = await readFile(lockPath, "utf8");
+    const lock = packageManager === PackageManagers.Npm
+        ? parseNpmLockfile(lockContent)
+        : parsePnpmLockfile(lockContent);
+    let workspaceOverrides;
+    const workspacePath = path.join(root, "pnpm-workspace.yaml");
+    if (await pathExists(workspacePath)) {
+        const parsed = parseYaml(await readFile(workspacePath, "utf8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            const overrides = parsed.overrides;
+            if (overrides && typeof overrides === "object" && !Array.isArray(overrides)) {
+                workspaceOverrides = overrides;
+            }
+        }
+    }
+    const ranges = [];
+    const workspaces = await listWorkspacePackages(root);
+    for (const ws of workspaces) {
+        const wsPkg = await readJsonFile(ws.packageJsonPath);
+        const label = ws.relativeDir === "." ? "package.json" : `${ws.relativeDir}/package.json`;
+        ranges.push(...findRangeIssues(wsPkg, config, label));
+    }
+    const normalized = normalizeLockForOverrides(packageManager, lock);
+    const overrides = [
+        ...findStaleOverridePins(pkg, normalized),
+        ...findWorkspaceOverrideDrift(pkg, workspaceOverrides),
+    ];
+    const alignment = findAlignmentIssues(config, pkg, packageManager, lock, workspaceOverrides);
+    const warnings = [
+        ...ranges
+            .filter((item) => item.severity === AlignmentActions.Warn)
+            .map((item) => item.message),
+        ...alignment
+            .filter((item) => item.severity === AlignmentActions.Warn)
+            .map((item) => `[${item.group}] ${item.message}`),
+    ];
+    return { ranges, overrides, alignment, warnings };
+}
+/**
+ * Throws when the policy result contains any error-severity findings.
+ */
+export function assertPolicy(result) {
+    const errors = [
+        ...result.ranges
+            .filter((item) => item.severity === AlignmentActions.Error)
+            .map((item) => item.message),
+        ...result.overrides.map((item) => `[${item.override}] ${item.message}`),
+        ...result.alignment
+            .filter((item) => item.severity === AlignmentActions.Error)
+            .map((item) => `[${item.group}] ${item.message}`),
+    ];
+    if (errors.length > 0) {
+        throw new BeefupError(`policy failed:\n${errors.map((line) => `  - ${line}`).join("\n")}`);
+    }
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/policy/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/policy/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAqB,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAE,eAAe,EAAuB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAyB,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,GAE1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAqB,MAAM,aAAa,CAAC;AASjE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,cAA8B,EAC9B,YAAoB,EACpB,MAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAc,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GACR,cAAc,KAAK,eAAe,CAAC,GAAG;QACpC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC;QAC/B,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAErC,IAAI,kBAAuD,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC7D,IAAI,MAAM,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,SAAS,GAAI,MAAkC,CAAC,SAAS,CAAC;YAChE,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5E,kBAAkB,GAAG,SAAoC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAc,EAAE,CAAC,eAAe,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,WAAW,eAAe,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,yBAAyB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG;QAChB,GAAG,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC;QACzC,GAAG,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,CAAC;KACvD,CAAC;IACF,MAAM,SAAS,GAAG,mBAAmB,CACnC,MAAM,EACN,GAAG,EACH,cAAc,EACd,IAAI,EACJ,kBAAkB,CACnB,CAAC;IAEF,MAAM,QAAQ,GAAG;QACf,GAAG,MAAM;aACN,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,gBAAgB,CAAC,IAAI,CAAC;aACzD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,GAAG,SAAS;aACT,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,gBAAgB,CAAC,IAAI,CAAC;aACzD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;KACpD,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,MAAM,MAAM,GAAG;QACb,GAAG,MAAM,CAAC,MAAM;aACb,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,gBAAgB,CAAC,KAAK,CAAC;aAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACvE,GAAG,MAAM,CAAC,SAAS;aAChB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,gBAAgB,CAAC,KAAK,CAAC;aAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;KACpD,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CAAC,mBAAmB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}

package/dist/policy/overrides.d.ts

@@ -0,0 +1,42 @@
+import type { NpmLockfile, PnpmLockfile } from "../lockfile/types.js";
+import type { PackageJson } from "../project/package-json.js";
+import { type PackageManager } from "../project/types.js";
+export interface OverrideFinding {
+    override: string;
+    message: string;
+}
+/**
+ * Parses an override key into a package name and optional version selector.
+ */
+declare function parseOverrideKey(key: string): {
+    name: string;
+    selector: string | null;
+};
+interface FlatPin {
+    logicalName: string;
+    selector: string | null;
+    targetRaw: string;
+    trail: string[];
+    scopedTo: string | null;
+}
+/**
+ * Flattens nested npm/pnpm override maps into individual pin records.
+ */
+declare function flattenOverrides(node: Record<string, unknown>, trail?: string[], scopedTo?: string | null): FlatPin[];
+/**
+ * Finds override pins that are banned floating tags or below requested ranges.
+ */
+export declare function findStaleOverridePins(pkg: PackageJson, lock: NpmLockfile | {
+    packages?: Record<string, unknown>;
+}): OverrideFinding[];
+/**
+ * Finds keys where package.json and pnpm-workspace.yaml overrides disagree.
+ */
+export declare function findWorkspaceOverrideDrift(pkg: PackageJson, workspaceOverrides: Record<string, unknown> | undefined): OverrideFinding[];
+/**
+ * Normalizes a lockfile into the packages shape used by override pin checks.
+ */
+export declare function normalizeLockForOverrides(packageManager: PackageManager, lock: NpmLockfile | PnpmLockfile): {
+    packages?: Record<string, unknown>;
+};
+export { parseOverrideKey, flattenOverrides };