@withtruing/companion 0.13.2 → 0.14.0

package/dist/whole-read/lockfiles.js

@@ -0,0 +1,947 @@
+import { createRequire } from 'node:module';
+import { parse as parseJsonc, visit } from 'jsonc-parser';
+import { parse as parseToml } from 'smol-toml';
+import { parseDocument } from 'yaml';
+const require = createRequire(import.meta.url);
+const yarnLockfile = require('@yarnpkg/lockfile');
+export const B14_LOCKFILE_NAMES = Object.freeze([
+    'package-lock.json',
+    'npm-shrinkwrap.json',
+    'pnpm-lock.yaml',
+    'yarn.lock',
+    'bun.lock',
+]);
+export const B15_LOCKFILE_NAMES = Object.freeze([
+    'Cargo.lock',
+    'poetry.lock',
+    'uv.lock',
+    'Pipfile.lock',
+    'go.sum',
+    'Gemfile.lock',
+    'composer.lock',
+]);
+export const LOCKFILE_OWNERS = Object.freeze({
+    'package-lock.json': 'B14',
+    'npm-shrinkwrap.json': 'B14',
+    'pnpm-lock.yaml': 'B14',
+    'yarn.lock': 'B14',
+    'bun.lock': 'B14',
+    'Cargo.lock': 'B15',
+    'poetry.lock': 'B15',
+    'uv.lock': 'B15',
+    'Pipfile.lock': 'B15',
+    'go.sum': 'B15',
+    'Gemfile.lock': 'B15',
+    'composer.lock': 'B15',
+});
+const RULES_VERSION = 'inventory-rules@1';
+const NPM_PARSER_VERSION = 'npm-lockfile@1';
+const PNPM_PARSER_VERSION = 'pnpm-lockfile@1';
+const YARN_CLASSIC_PARSER_VERSION = '@yarnpkg/lockfile@1.1.0';
+const YARN_BERRY_PARSER_VERSION = 'yaml@2.8.2';
+const BUN_PARSER_VERSION = 'jsonc-parser@3.3.1';
+const TOML_PARSER_VERSION = 'smol-toml@1.9.0';
+const GO_SUM_PARSER_VERSION = 'go-sum@1';
+const GEMFILE_LOCK_PARSER_VERSION = 'gemfile-lock@1';
+const PNPM_FORMAT_VERSIONS = new Set(['5.0', '5.1', '5.2', '5.3', '5.4', '6.0', '9.0']);
+const YARN_BERRY_FORMAT_VERSIONS = new Set(['4', '5', '6', '7', '8']);
+const BUN_FORMAT_VERSIONS = new Set(['0', '1']);
+const NPM_PACKAGE_NAME = /^(?:@[A-Za-z0-9][A-Za-z0-9._-]*\/)?[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const DEPENDENCY_FIELDS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
+const BOOLEAN_FIELDS = ['dev', 'optional', 'bundled', 'inBundle', 'hasInstallScript', 'link'];
+const hasOwn = (record, key) => Object.hasOwn(record, key);
+const isRecord = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const nonBlankString = (value) => typeof value === 'string' && value.trim().length > 0;
+function finalPathComponent(path) {
+    if (path.length === 0 || path.includes('\0'))
+        return null;
+    const component = path.slice(path.lastIndexOf('/') + 1);
+    return component.length === 0 ? null : component;
+}
+function ownedName(path) {
+    const filename = finalPathComponent(path);
+    return filename !== null && Object.hasOwn(LOCKFILE_OWNERS, filename)
+        ? filename
+        : null;
+}
+function hasDuplicateJsonKeys(text) {
+    let offset = 0;
+    const whitespace = () => {
+        while (offset < text.length && /[\t\n\r ]/.test(text[offset]))
+            offset += 1;
+    };
+    const string = () => {
+        if (text[offset] !== '"')
+            return null;
+        const start = offset;
+        offset += 1;
+        while (offset < text.length) {
+            const character = text[offset];
+            if (character === '\\') {
+                offset += 2;
+            }
+            else if (character === '"') {
+                offset += 1;
+                try {
+                    return JSON.parse(text.slice(start, offset));
+                }
+                catch {
+                    return null;
+                }
+            }
+            else {
+                offset += 1;
+            }
+        }
+        return null;
+    };
+    const primitive = () => {
+        const start = offset;
+        while (offset < text.length && !/[\t\n\r ,\]}]/.test(text[offset]))
+            offset += 1;
+        return offset > start;
+    };
+    const value = () => {
+        whitespace();
+        if (text[offset] === '{')
+            return object();
+        if (text[offset] === '[')
+            return array();
+        if (text[offset] === '"')
+            return string() !== null;
+        return primitive();
+    };
+    const object = () => {
+        if (text[offset] !== '{')
+            return false;
+        offset += 1;
+        whitespace();
+        const keys = new Set();
+        if (text[offset] === '}') {
+            offset += 1;
+            return true;
+        }
+        while (offset < text.length) {
+            whitespace();
+            const key = string();
+            if (key === null || keys.has(key))
+                return false;
+            keys.add(key);
+            whitespace();
+            if (text[offset] !== ':')
+                return false;
+            offset += 1;
+            if (!value())
+                return false;
+            whitespace();
+            if (text[offset] === '}') {
+                offset += 1;
+                return true;
+            }
+            if (text[offset] !== ',')
+                return false;
+            offset += 1;
+        }
+        return false;
+    };
+    const array = () => {
+        if (text[offset] !== '[')
+            return false;
+        offset += 1;
+        whitespace();
+        if (text[offset] === ']') {
+            offset += 1;
+            return true;
+        }
+        while (offset < text.length) {
+            if (!value())
+                return false;
+            whitespace();
+            if (text[offset] === ']') {
+                offset += 1;
+                return true;
+            }
+            if (text[offset] !== ',')
+                return false;
+            offset += 1;
+        }
+        return false;
+    };
+    return !value() || (whitespace(), offset !== text.length);
+}
+function stringMap(value) {
+    return isRecord(value) && Object.values(value).every((entry) => typeof entry === 'string');
+}
+function stringArray(value) {
+    return Array.isArray(value) && value.every((entry) => typeof entry === 'string');
+}
+function safePackagePath(path) {
+    return path === '' || (!path.startsWith('/') && !path.endsWith('/') && !path.includes('\\')
+        && path.split('/').every((part) => part.length > 0 && part !== '.' && part !== '..'));
+}
+function packageNameFromPath(path) {
+    const parts = path.split('/');
+    const nodeModules = parts.lastIndexOf('node_modules');
+    if (nodeModules < 0 || nodeModules === parts.length - 1)
+        return null;
+    const tail = parts.slice(nodeModules + 1);
+    const name = tail[0].startsWith('@') && tail.length === 2
+        ? `${tail[0]}/${tail[1]}`
+        : tail.length === 1 ? tail[0] : '';
+    return NPM_PACKAGE_NAME.test(name) ? name : null;
+}
+function validPackageRecord(value, requireVersion) {
+    if (!isRecord(value))
+        return false;
+    if (hasOwn(value, 'version') && !nonBlankString(value.version))
+        return false;
+    if (requireVersion && !nonBlankString(value.version)
+        && !(value.link === true && nonBlankString(value.resolved)))
+        return false;
+    if (hasOwn(value, 'resolved') && !nonBlankString(value.resolved))
+        return false;
+    if (hasOwn(value, 'link') && typeof value.link !== 'boolean')
+        return false;
+    if (hasOwn(value, 'bin') && !(typeof value.bin === 'string' || stringMap(value.bin)))
+        return false;
+    if (hasOwn(value, 'engines') && !stringMap(value.engines) && !stringArray(value.engines))
+        return false;
+    for (const field of DEPENDENCY_FIELDS) {
+        if (hasOwn(value, field) && !stringMap(value[field]))
+            return false;
+    }
+    for (const field of BOOLEAN_FIELDS) {
+        if (hasOwn(value, field) && typeof value[field] !== 'boolean')
+            return false;
+    }
+    return true;
+}
+function validDependencyRecords(value, dependencies) {
+    if (!isRecord(value))
+        return false;
+    for (const [name, record] of Object.entries(value)) {
+        if (!NPM_PACKAGE_NAME.test(name) || !isRecord(record) || !nonBlankString(record.version))
+            return false;
+        if (hasOwn(record, 'requires') && !stringMap(record.requires))
+            return false;
+        if (hasOwn(record, 'dependencies') && !validDependencyRecords(record.dependencies, dependencies))
+            return false;
+        for (const field of ['devDependencies', 'optionalDependencies', 'peerDependencies']) {
+            if (hasOwn(record, field) && !stringMap(record[field]))
+                return false;
+        }
+        for (const field of BOOLEAN_FIELDS) {
+            if (hasOwn(record, field) && typeof record[field] !== 'boolean')
+                return false;
+        }
+        dependencies.push({ ecosystem: 'npm', name, version: record.version });
+    }
+    return true;
+}
+function normalizedDependencies(dependencies) {
+    const unique = new Map();
+    for (const dependency of dependencies)
+        unique.set(`${dependency.name}\0${dependency.version}`, dependency);
+    return [...unique.values()].sort((left, right) => left.name === right.name ? left.version.localeCompare(right.version) : left.name.localeCompare(right.name));
+}
+function parseNpmLockfile(filename, text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { kind: 'read', reason: 'npm_lockfile_invalid_json' };
+    }
+    try {
+        return validateNpmLockfile(filename, text, parsed);
+    }
+    catch {
+        return { kind: 'read', reason: 'npm_lockfile_invalid_shape' };
+    }
+}
+function validateNpmLockfile(filename, text, parsed) {
+    if (hasDuplicateJsonKeys(text))
+        return { kind: 'read', reason: 'npm_lockfile_duplicate_key' };
+    if (!isRecord(parsed) || !Number.isInteger(parsed.lockfileVersion)) {
+        return { kind: 'read', reason: 'npm_lockfile_invalid_shape' };
+    }
+    const formatVersion = String(parsed.lockfileVersion);
+    if (formatVersion !== '1' && formatVersion !== '2' && formatVersion !== '3') {
+        return { kind: 'read', reason: 'npm_lockfile_unsupported_version' };
+    }
+    if (hasOwn(parsed, 'name') && !nonBlankString(parsed.name))
+        return { kind: 'read', reason: 'npm_lockfile_invalid_shape' };
+    if (hasOwn(parsed, 'version') && !nonBlankString(parsed.version))
+        return { kind: 'read', reason: 'npm_lockfile_invalid_shape' };
+    if (hasOwn(parsed, 'requires') && typeof parsed.requires !== 'boolean')
+        return { kind: 'read', reason: 'npm_lockfile_invalid_shape' };
+    const dependencies = [];
+    if (formatVersion === '1') {
+        if (!validDependencyRecords(parsed.dependencies, dependencies)) {
+            return { kind: 'read', reason: 'npm_lockfile_invalid_shape' };
+        }
+    }
+    else {
+        if (!isRecord(parsed.packages) || !hasOwn(parsed.packages, '') || !validPackageRecord(parsed.packages[''], false)) {
+            return { kind: 'read', reason: 'npm_lockfile_invalid_shape' };
+        }
+        for (const [path, record] of Object.entries(parsed.packages)) {
+            if (!safePackagePath(path) || (path.split('/').includes('node_modules') && packageNameFromPath(path) === null)
+                || !validPackageRecord(record, path !== '')) {
+                return { kind: 'read', reason: 'npm_lockfile_invalid_shape' };
+            }
+            const name = packageNameFromPath(path);
+            if (name !== null && nonBlankString(record.version)) {
+                dependencies.push({ ecosystem: 'npm', name, version: record.version });
+            }
+        }
+        if (hasOwn(parsed, 'dependencies') && !validDependencyRecords(parsed.dependencies, dependencies)) {
+            return { kind: 'read', reason: 'npm_lockfile_invalid_shape' };
+        }
+    }
+    return {
+        kind: 'lockfile',
+        proof: {
+            dependencies: normalizedDependencies(dependencies),
+            filename,
+            format: 'npm',
+            formatVersion,
+            parserVersion: NPM_PARSER_VERSION,
+            rulesVersion: RULES_VERSION,
+        },
+    };
+}
+function yamlRecord(text) {
+    if (/^%|(?:^|[\s:[{,])(?:!|&|\*)[A-Za-z!]/m.test(text))
+        return null;
+    try {
+        const document = parseDocument(text, {
+            merge: false,
+            prettyErrors: false,
+            schema: 'core',
+            strict: true,
+            uniqueKeys: true,
+        });
+        if (document.errors.length !== 0 || document.warnings.length !== 0)
+            return null;
+        const parsed = document.toJS({ maxAliasCount: 0 });
+        return isRecord(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function hasOnly(record, fields) {
+    return Object.keys(record).every((key) => fields.includes(key));
+}
+function stringRecord(value) {
+    return isRecord(value) && Object.values(value).every(nonBlankString);
+}
+function recordOfRecords(value) {
+    return isRecord(value) && Object.values(value).every(isRecord);
+}
+function stringList(value) {
+    return Array.isArray(value) && value.every(nonBlankString);
+}
+function pnpmVersion(value) {
+    if (typeof value === 'string' && PNPM_FORMAT_VERSIONS.has(value))
+        return value;
+    if (typeof value === 'number') {
+        if (value === 5)
+            return '5.0';
+        if (value === 6)
+            return '6.0';
+        if (value === 9)
+            return '9.0';
+        const normalized = String(value);
+        return PNPM_FORMAT_VERSIONS.has(normalized) ? normalized : null;
+    }
+    return null;
+}
+function validPnpmResolution(value) {
+    return isRecord(value) && Object.values(value).some(nonBlankString)
+        && Object.values(value).every((entry) => nonBlankString(entry) || typeof entry === 'boolean' || Number.isFinite(entry));
+}
+function validPnpmPackageRecord(value) {
+    if (!isRecord(value) || !hasOwn(value, 'resolution') || !validPnpmResolution(value.resolution))
+        return false;
+    if (!hasOnly(value, [
+        'resolution', 'dependencies', 'optionalDependencies', 'peerDependencies', 'peerDependenciesMeta',
+        'engines', 'cpu', 'os', 'libc', 'dev', 'optional', 'hasBin', 'requiresBuild', 'deprecated', 'id',
+        'bundledDependencies', 'prepare', 'requires',
+    ]))
+        return false;
+    for (const field of ['dependencies', 'optionalDependencies', 'peerDependencies', 'engines']) {
+        if (hasOwn(value, field) && !stringRecord(value[field]))
+            return false;
+    }
+    for (const field of ['peerDependenciesMeta']) {
+        if (hasOwn(value, field) && !recordOfRecords(value[field]))
+            return false;
+    }
+    for (const field of ['cpu', 'os', 'libc', 'bundledDependencies']) {
+        if (hasOwn(value, field) && !stringList(value[field]))
+            return false;
+    }
+    for (const field of ['dev', 'optional', 'hasBin', 'requiresBuild']) {
+        if (hasOwn(value, field) && typeof value[field] !== 'boolean')
+            return false;
+    }
+    for (const field of ['deprecated', 'id', 'prepare', 'requires']) {
+        if (hasOwn(value, field) && !nonBlankString(value[field]))
+            return false;
+    }
+    return true;
+}
+function validPnpmSnapshot(value) {
+    if (!isRecord(value) || !hasOnly(value, [
+        'dependencies', 'optionalDependencies', 'peerDependencies', 'transitivePeerDependencies', 'optional',
+    ]))
+        return false;
+    for (const field of ['dependencies', 'optionalDependencies', 'peerDependencies']) {
+        if (hasOwn(value, field) && !stringRecord(value[field]))
+            return false;
+    }
+    return (!hasOwn(value, 'transitivePeerDependencies') || stringList(value.transitivePeerDependencies))
+        && (!hasOwn(value, 'optional') || typeof value.optional === 'boolean');
+}
+function validPnpmMetadata(parsed) {
+    if (hasOwn(parsed, 'settings') && (!isRecord(parsed.settings)
+        || !Object.values(parsed.settings).every((value) => typeof value === 'boolean' || Number.isFinite(value))))
+        return false;
+    if (hasOwn(parsed, 'neverBuiltDependencies') && !stringList(parsed.neverBuiltDependencies))
+        return false;
+    if (hasOwn(parsed, 'onlyBuiltDependencies') && !stringList(parsed.onlyBuiltDependencies))
+        return false;
+    if (hasOwn(parsed, 'overrides') && !stringRecord(parsed.overrides))
+        return false;
+    if (hasOwn(parsed, 'packageExtensionsChecksum') && !nonBlankString(parsed.packageExtensionsChecksum))
+        return false;
+    if (hasOwn(parsed, 'patchedDependencies') && !stringRecord(parsed.patchedDependencies))
+        return false;
+    return !hasOwn(parsed, 'time') || (isRecord(parsed.time) && Object.values(parsed.time).every(Number.isFinite));
+}
+function pnpmPackageIdentity(key, formatVersion) {
+    let name = '';
+    let version = '';
+    if (formatVersion.startsWith('5.')) {
+        const match = /^\/((?:@[A-Za-z0-9][A-Za-z0-9._-]*\/)?[A-Za-z0-9][A-Za-z0-9._-]*)\/([^/]+)$/.exec(key);
+        if (match === null)
+            return null;
+        [, name, version] = match;
+    }
+    else {
+        const source = formatVersion === '6.0' ? key.slice(1) : key;
+        const separator = source.startsWith('@') ? source.indexOf('@', source.indexOf('/') + 1) : source.indexOf('@');
+        if (separator < 1)
+            return null;
+        name = source.slice(0, separator);
+        version = source.slice(separator + 1);
+    }
+    return NPM_PACKAGE_NAME.test(name) && nonBlankString(version) && !/^(?:file:|link:|workspace:|https?:)/.test(version)
+        ? { ecosystem: 'npm', name, version: version.replace(/\([^)]*\)$/, '') }
+        : null;
+}
+function parsePnpmLockfile(text) {
+    const parsed = yamlRecord(text);
+    if (parsed === null)
+        return { kind: 'read', reason: 'pnpm_lockfile_invalid_yaml' };
+    const formatVersion = pnpmVersion(parsed.lockfileVersion);
+    if (formatVersion === null)
+        return { kind: 'read', reason: 'pnpm_lockfile_unsupported_version' };
+    if (!hasOnly(parsed, [
+        'lockfileVersion', 'settings', 'neverBuiltDependencies', 'onlyBuiltDependencies', 'overrides',
+        'packageExtensionsChecksum', 'patchedDependencies', 'importers', 'packages', 'snapshots', 'time',
+    ]) || !validPnpmMetadata(parsed) || !isRecord(parsed.importers) || !isRecord(parsed.packages) || Object.keys(parsed.importers).length === 0) {
+        return { kind: 'read', reason: 'pnpm_lockfile_invalid_shape' };
+    }
+    if ((formatVersion === '9.0' && !isRecord(parsed.snapshots)) || (formatVersion !== '9.0' && hasOwn(parsed, 'snapshots'))) {
+        return { kind: 'read', reason: 'pnpm_lockfile_invalid_shape' };
+    }
+    const v5 = formatVersion.startsWith('5.');
+    for (const [path, importer] of Object.entries(parsed.importers)) {
+        if (!nonBlankString(path) || !isRecord(importer))
+            return { kind: 'read', reason: 'pnpm_lockfile_invalid_shape' };
+        const dependencyFields = ['dependencies', 'devDependencies', 'optionalDependencies'];
+        if (v5) {
+            if (!hasOnly(importer, ['specifiers', ...dependencyFields, 'dependenciesMeta']) || !stringRecord(importer.specifiers)) {
+                return { kind: 'read', reason: 'pnpm_lockfile_invalid_shape' };
+            }
+            if (hasOwn(importer, 'dependenciesMeta') && !recordOfRecords(importer.dependenciesMeta))
+                return { kind: 'read', reason: 'pnpm_lockfile_invalid_shape' };
+            if (dependencyFields.some((field) => hasOwn(importer, field) && !stringRecord(importer[field])))
+                return { kind: 'read', reason: 'pnpm_lockfile_invalid_shape' };
+        }
+        else {
+            if (!hasOnly(importer, [...dependencyFields, 'dependenciesMeta', 'publishDirectory'])
+                || (hasOwn(importer, 'publishDirectory') && !nonBlankString(importer.publishDirectory))
+                || (hasOwn(importer, 'dependenciesMeta') && !recordOfRecords(importer.dependenciesMeta)))
+                return { kind: 'read', reason: 'pnpm_lockfile_invalid_shape' };
+            for (const field of dependencyFields) {
+                if (!hasOwn(importer, field))
+                    continue;
+                if (!isRecord(importer[field]) || !Object.values(importer[field]).every((entry) => isRecord(entry)
+                    && hasOnly(entry, ['specifier', 'version']) && nonBlankString(entry.specifier) && nonBlankString(entry.version))) {
+                    return { kind: 'read', reason: 'pnpm_lockfile_invalid_shape' };
+                }
+            }
+        }
+    }
+    const dependencies = [];
+    for (const [key, record] of Object.entries(parsed.packages)) {
+        if (!validPnpmPackageRecord(record))
+            return { kind: 'read', reason: 'pnpm_lockfile_invalid_shape' };
+        const identity = pnpmPackageIdentity(key, formatVersion);
+        if (identity === null)
+            return { kind: 'read', reason: 'pnpm_lockfile_invalid_shape' };
+        dependencies.push(identity);
+    }
+    if (formatVersion === '9.0' && !Object.values(parsed.snapshots).every(validPnpmSnapshot)) {
+        return { kind: 'read', reason: 'pnpm_lockfile_invalid_shape' };
+    }
+    return { kind: 'lockfile', proof: {
+            dependencies: normalizedDependencies(dependencies), filename: 'pnpm-lock.yaml', format: 'pnpm', formatVersion,
+            parserVersion: PNPM_PARSER_VERSION, rulesVersion: RULES_VERSION,
+        } };
+}
+function yarnDescriptorIdentity(descriptor, version) {
+    const selector = descriptor.trim();
+    const separator = selector.startsWith('@') ? selector.indexOf('@', selector.indexOf('/') + 1) : selector.indexOf('@');
+    if (separator < 1 || /^(?:file:|link:|portal:|workspace:|https?:|git:|github:|patch:)/.test(selector.slice(separator + 1)))
+        return null;
+    const name = selector.slice(0, separator);
+    return NPM_PACKAGE_NAME.test(name) && nonBlankString(version) ? { ecosystem: 'npm', name, version } : null;
+}
+function validYarnClassicEntry(value) {
+    if (!isRecord(value) || !nonBlankString(value.version) || !hasOnly(value, [
+        'version', 'resolved', 'integrity', 'uid', 'registry', 'dependencies', 'optionalDependencies', 'peerDependencies',
+    ]))
+        return false;
+    for (const field of ['resolved', 'integrity', 'uid', 'registry'])
+        if (hasOwn(value, field) && !nonBlankString(value[field]))
+            return false;
+    for (const field of ['dependencies', 'optionalDependencies', 'peerDependencies'])
+        if (hasOwn(value, field) && !stringRecord(value[field]))
+            return false;
+    return true;
+}
+function parseYarnClassic(text) {
+    try {
+        const parsed = yarnLockfile.parse(text);
+        if (parsed.type !== 'success' || !isRecord(parsed.object) || Object.keys(parsed.object).length === 0) {
+            return { kind: 'read', reason: 'yarn_classic_invalid_grammar' };
+        }
+        const dependencies = [];
+        for (const [selectors, entry] of Object.entries(parsed.object)) {
+            if (!validYarnClassicEntry(entry))
+                return { kind: 'read', reason: 'yarn_classic_invalid_shape' };
+            for (const descriptor of selectors.split(/,\s*/)) {
+                const identity = yarnDescriptorIdentity(descriptor, entry.version);
+                if (identity !== null)
+                    dependencies.push(identity);
+            }
+        }
+        return { kind: 'lockfile', proof: {
+                dependencies: normalizedDependencies(dependencies), filename: 'yarn.lock', format: 'yarn-classic', formatVersion: '1',
+                parserVersion: YARN_CLASSIC_PARSER_VERSION, rulesVersion: RULES_VERSION,
+            } };
+    }
+    catch {
+        return { kind: 'read', reason: 'yarn_classic_invalid_grammar' };
+    }
+}
+function validYarnBerryEntry(value) {
+    if (!isRecord(value) || !nonBlankString(value.version) || !nonBlankString(value.resolution) || !hasOnly(value, [
+        'version', 'resolution', 'dependencies', 'optionalDependencies', 'peerDependencies', 'dependenciesMeta',
+        'peerDependenciesMeta', 'bin', 'languageName', 'linkType', 'checksum', 'conditions',
+    ]))
+        return false;
+    for (const field of ['dependencies', 'optionalDependencies', 'peerDependencies', 'bin'])
+        if (hasOwn(value, field) && !stringRecord(value[field]))
+            return false;
+    for (const field of ['dependenciesMeta', 'peerDependenciesMeta'])
+        if (hasOwn(value, field) && !recordOfRecords(value[field]))
+            return false;
+    for (const field of ['languageName', 'checksum', 'conditions'])
+        if (hasOwn(value, field) && !nonBlankString(value[field]))
+            return false;
+    return !hasOwn(value, 'linkType') || value.linkType === 'hard' || value.linkType === 'soft';
+}
+function parseYarnBerry(parsed) {
+    const metadata = parsed.__metadata;
+    if (!isRecord(metadata) || !hasOnly(metadata, ['version', 'cacheKey']) || !Number.isInteger(metadata.version)
+        || !YARN_BERRY_FORMAT_VERSIONS.has(String(metadata.version)) || (hasOwn(metadata, 'cacheKey') && !nonBlankString(metadata.cacheKey))) {
+        return { kind: 'read', reason: 'yarn_berry_unsupported_version' };
+    }
+    const dependencies = [];
+    for (const [selectors, entry] of Object.entries(parsed)) {
+        if (selectors === '__metadata')
+            continue;
+        if (!validYarnBerryEntry(entry))
+            return { kind: 'read', reason: 'yarn_berry_invalid_shape' };
+        for (const descriptor of selectors.split(/,\s*/)) {
+            const identity = yarnDescriptorIdentity(descriptor, entry.version);
+            if (identity !== null)
+                dependencies.push(identity);
+        }
+    }
+    return { kind: 'lockfile', proof: {
+            dependencies: normalizedDependencies(dependencies), filename: 'yarn.lock', format: 'yarn-berry', formatVersion: String(metadata.version),
+            parserVersion: YARN_BERRY_PARSER_VERSION, rulesVersion: RULES_VERSION,
+        } };
+}
+function parseYarnLockfile(text) {
+    const yaml = yamlRecord(text);
+    return yaml !== null && hasOwn(yaml, '__metadata') ? parseYarnBerry(yaml) : parseYarnClassic(text);
+}
+function validBunStringRecord(value) {
+    return isRecord(value) && Object.values(value).every(nonBlankString);
+}
+function validBunWorkspace(value) {
+    if (!isRecord(value) || !hasOnly(value, [
+        'name', 'version', 'dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies',
+    ]))
+        return false;
+    if (hasOwn(value, 'name') && !nonBlankString(value.name))
+        return false;
+    if (hasOwn(value, 'version') && !nonBlankString(value.version))
+        return false;
+    return ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']
+        .every((field) => !hasOwn(value, field) || validBunStringRecord(value[field]));
+}
+function bunPackageIdentity(value) {
+    const separator = value.startsWith('@') ? value.indexOf('@', value.indexOf('/') + 1) : value.indexOf('@');
+    if (separator < 1)
+        return null;
+    const name = value.slice(0, separator);
+    const version = value.slice(separator + 1);
+    return NPM_PACKAGE_NAME.test(name) && nonBlankString(version) && !/[\s/]/.test(version)
+        && !/^(?:file:|git:|github:|https?:|npm:|workspace:)/.test(version)
+        ? { ecosystem: 'npm', name, version }
+        : null;
+}
+function parseBunLockfile(text) {
+    const errors = [];
+    let duplicateKey = false;
+    let syntaxError = false;
+    const objectKeys = [];
+    const parsed = parseJsonc(text, errors, { allowTrailingComma: true, disallowComments: false });
+    visit(text, {
+        onObjectBegin: () => { objectKeys.push(new Set()); },
+        onObjectProperty: (property) => {
+            const keys = objectKeys.at(-1);
+            if (keys === undefined || keys.has(property))
+                duplicateKey = true;
+            else
+                keys.add(property);
+        },
+        onObjectEnd: () => { objectKeys.pop(); },
+        onError: () => { syntaxError = true; },
+    }, { allowTrailingComma: true, disallowComments: false });
+    if (errors.length !== 0 || syntaxError)
+        return { kind: 'read', reason: 'bun_lockfile_invalid_jsonc' };
+    if (duplicateKey)
+        return { kind: 'read', reason: 'bun_lockfile_duplicate_key' };
+    if (!isRecord(parsed) || !Number.isInteger(parsed.lockfileVersion)) {
+        return { kind: 'read', reason: 'bun_lockfile_invalid_shape' };
+    }
+    const formatVersion = String(parsed.lockfileVersion);
+    if (!BUN_FORMAT_VERSIONS.has(formatVersion))
+        return { kind: 'read', reason: 'bun_lockfile_unsupported_version' };
+    if (!hasOnly(parsed, ['lockfileVersion', 'workspaces', 'packages'])
+        || !isRecord(parsed.workspaces) || !isRecord(parsed.packages) || !hasOwn(parsed.workspaces, '')) {
+        return { kind: 'read', reason: 'bun_lockfile_invalid_shape' };
+    }
+    for (const [path, workspace] of Object.entries(parsed.workspaces)) {
+        if ((path !== '' && (!path || path.startsWith('/') || path.includes('\\') || path.includes('\0'))) || !validBunWorkspace(workspace)) {
+            return { kind: 'read', reason: 'bun_lockfile_invalid_shape' };
+        }
+    }
+    const dependencies = [];
+    const identities = new Set();
+    for (const [name, entry] of Object.entries(parsed.packages)) {
+        if (!NPM_PACKAGE_NAME.test(name) || !Array.isArray(entry) || entry.length !== 4
+            || !nonBlankString(entry[0]) || typeof entry[1] !== 'string' || !validBunStringRecord(entry[2]) || typeof entry[3] !== 'string') {
+            return { kind: 'read', reason: 'bun_lockfile_invalid_shape' };
+        }
+        const identity = bunPackageIdentity(entry[0]);
+        if (identity === null)
+            return { kind: 'read', reason: 'bun_lockfile_invalid_shape' };
+        const key = `${identity.name}\0${identity.version}`;
+        if (identities.has(key))
+            return { kind: 'read', reason: 'bun_lockfile_conflicting_identity' };
+        identities.add(key);
+        dependencies.push(identity);
+    }
+    return { kind: 'lockfile', proof: {
+            dependencies: normalizedDependencies(dependencies), filename: 'bun.lock', format: 'bun', formatVersion,
+            parserVersion: BUN_PARSER_VERSION, rulesVersion: RULES_VERSION,
+        } };
+}
+function tomlRecord(text) {
+    try {
+        const parsed = parseToml(text, { unsafeKeyBehaviour: 'throw' });
+        return isRecord(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function nonBlankStringArray(value) {
+    return Array.isArray(value) && value.every(nonBlankString);
+}
+function packageArray(value, validator) {
+    return Array.isArray(value) && value.length > 0 && value.every((entry) => isRecord(entry) && validator(entry));
+}
+function proof(filename, format, formatVersion, parserVersion, dependencies) {
+    return {
+        kind: 'lockfile',
+        proof: { filename, format, formatVersion, parserVersion, rulesVersion: RULES_VERSION, dependencies: normalizedDependencies(dependencies) },
+    };
+}
+function parseCargoLockfile(text) {
+    const parsed = tomlRecord(text);
+    if (parsed === null)
+        return { kind: 'read', reason: 'cargo_lockfile_invalid_toml' };
+    if (!Number.isInteger(parsed.version))
+        return { kind: 'read', reason: 'cargo_lockfile_invalid_shape' };
+    const formatVersion = String(parsed.version);
+    if (!new Set(['1', '2', '3', '4']).has(formatVersion))
+        return { kind: 'read', reason: 'cargo_lockfile_unsupported_version' };
+    if (!packageArray(parsed.package, (entry) => nonBlankString(entry.name) && nonBlankString(entry.version)
+        && (!hasOwn(entry, 'source') || nonBlankString(entry.source))
+        && (!hasOwn(entry, 'checksum') || nonBlankString(entry.checksum))
+        && (!hasOwn(entry, 'dependencies') || nonBlankStringArray(entry.dependencies)))) {
+        return { kind: 'read', reason: 'cargo_lockfile_invalid_shape' };
+    }
+    return proof('Cargo.lock', 'cargo', formatVersion, TOML_PARSER_VERSION, parsed.package.map((entry) => ({ ecosystem: 'cargo', name: entry.name, version: entry.version })));
+}
+const POETRY_FORMAT_VERSIONS = new Set(['1.1', '1.2', '2.0', '2.1', '2.2']);
+function parsePoetryLockfile(text) {
+    const parsed = tomlRecord(text);
+    if (parsed === null)
+        return { kind: 'read', reason: 'poetry_lockfile_invalid_toml' };
+    if (!isRecord(parsed.metadata) || !nonBlankString(parsed.metadata['lock-version']) || !nonBlankString(parsed.metadata['content-hash'])) {
+        return { kind: 'read', reason: 'poetry_lockfile_invalid_shape' };
+    }
+    const formatVersion = parsed.metadata['lock-version'];
+    if (!POETRY_FORMAT_VERSIONS.has(formatVersion))
+        return { kind: 'read', reason: 'poetry_lockfile_unsupported_version' };
+    if (!packageArray(parsed.package, (entry) => nonBlankString(entry.name) && nonBlankString(entry.version)
+        && nonBlankString(entry.description) && typeof entry.optional === 'boolean' && nonBlankString(entry['python-versions'])
+        && (!hasOwn(entry, 'groups') || nonBlankStringArray(entry.groups))
+        && (!hasOwn(entry, 'category') || nonBlankString(entry.category)))) {
+        return { kind: 'read', reason: 'poetry_lockfile_invalid_shape' };
+    }
+    return proof('poetry.lock', 'poetry', formatVersion, TOML_PARSER_VERSION, parsed.package.map((entry) => ({ ecosystem: 'poetry', name: entry.name, version: entry.version })));
+}
+function parseUvLockfile(text) {
+    const parsed = tomlRecord(text);
+    if (parsed === null)
+        return { kind: 'read', reason: 'uv_lockfile_invalid_toml' };
+    if (parsed.version !== 1)
+        return Number.isInteger(parsed.version)
+            ? { kind: 'read', reason: 'uv_lockfile_unsupported_version' }
+            : { kind: 'read', reason: 'uv_lockfile_invalid_shape' };
+    if (parsed.revision !== 1 || !nonBlankString(parsed['requires-python'])
+        || !packageArray(parsed.package, (entry) => nonBlankString(entry.name) && nonBlankString(entry.version)
+            && isRecord(entry.source) && Object.keys(entry.source).length > 0 && Object.values(entry.source).every(nonBlankString))) {
+        return { kind: 'read', reason: 'uv_lockfile_invalid_shape' };
+    }
+    return proof('uv.lock', 'uv', '1', TOML_PARSER_VERSION, parsed.package.map((entry) => ({ ecosystem: 'uv', name: entry.name, version: entry.version })));
+}
+function validPipfilePackages(value) {
+    return isRecord(value) && Object.values(value).every((entry) => nonBlankString(entry)
+        || (isRecord(entry) && nonBlankString(entry.version)));
+}
+function parsePipfileLockfile(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { kind: 'read', reason: 'pipfile_lockfile_invalid_json' };
+    }
+    if (hasDuplicateJsonKeys(text) || !isRecord(parsed) || !isRecord(parsed._meta) || !isRecord(parsed._meta.hash)
+        || !nonBlankString(parsed._meta.hash.sha256) || parsed._meta['pipfile-spec'] !== 6
+        || !isRecord(parsed._meta.requires) || !Array.isArray(parsed._meta.sources)
+        || !parsed._meta.sources.every((source) => isRecord(source) && nonBlankString(source.url) && nonBlankString(source.name)
+            && typeof source.verify_ssl === 'boolean') || !validPipfilePackages(parsed.default)
+        || (hasOwn(parsed, 'develop') && !validPipfilePackages(parsed.develop))) {
+        return { kind: 'read', reason: 'pipfile_lockfile_invalid_shape' };
+    }
+    const defaultPackages = parsed.default;
+    const dependencies = Object.entries(defaultPackages).flatMap(([name, entry]) => {
+        const version = typeof entry === 'string' ? entry : isRecord(entry) ? entry.version : '';
+        return typeof version === 'string' && /^==[^\s]+$/.test(version)
+            ? [{ ecosystem: 'python', name, version: version.slice(2) }]
+            : [];
+    });
+    return proof('Pipfile.lock', 'pipfile', '6', 'json@builtin', dependencies);
+}
+function validComposerPackages(value) {
+    return Array.isArray(value) && value.every((entry) => isRecord(entry) && nonBlankString(entry.name) && nonBlankString(entry.version));
+}
+function parseComposerLockfile(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { kind: 'read', reason: 'composer_lockfile_invalid_json' };
+    }
+    if (hasDuplicateJsonKeys(text) || !isRecord(parsed) || !/^[a-f0-9]{64}$/i.test(String(parsed['content-hash']))
+        || !validComposerPackages(parsed.packages) || (hasOwn(parsed, 'packages-dev') && !validComposerPackages(parsed['packages-dev']))) {
+        return { kind: 'read', reason: 'composer_lockfile_invalid_shape' };
+    }
+    const packages = [...parsed.packages, ...(parsed['packages-dev'] ?? [])];
+    return proof('composer.lock', 'composer', 'content-hash@1', 'json@builtin', packages.map((entry) => ({ ecosystem: 'composer', name: entry.name, version: entry.version })));
+}
+const GO_MODULE_PATH = /^[A-Za-z0-9][A-Za-z0-9.!~+_-]*(?:\/[A-Za-z0-9][A-Za-z0-9.!~+_-]*)*$/;
+const GO_VERSION = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.+-]+)?(?:\+incompatible)?(?:\/go\.mod)?$/;
+const GO_CHECKSUM = /^h1:[A-Za-z0-9+/]{43}=$/;
+function parseGoSum(text) {
+    if (text.length === 0)
+        return { kind: 'read', reason: 'go_sum_invalid_grammar' };
+    const lines = text.split('\n').map((line) => line.endsWith('\r') ? line.slice(0, -1) : line);
+    if (lines.at(-1) === '')
+        lines.pop();
+    if (lines.length === 0 || lines.some((line) => line.length === 0 || line.includes('\r')))
+        return { kind: 'read', reason: 'go_sum_invalid_grammar' };
+    const dependencies = [];
+    for (const line of lines) {
+        const fields = line.split(' ');
+        if (fields.length !== 3 || fields.some((field) => field.length === 0))
+            return { kind: 'read', reason: 'go_sum_invalid_grammar' };
+        const [name, version, checksum] = fields;
+        if (!GO_MODULE_PATH.test(name) || !GO_VERSION.test(version) || !GO_CHECKSUM.test(checksum)) {
+            return { kind: 'read', reason: 'go_sum_invalid_grammar' };
+        }
+        dependencies.push({ ecosystem: 'go', name: name, version: version.replace(/\/go\.mod$/, '') });
+    }
+    return proof('go.sum', 'go-sum', '1', GO_SUM_PARSER_VERSION, dependencies);
+}
+const GEM_SOURCE_SECTIONS = new Set(['GEM', 'GIT', 'PATH', 'PLUGIN']);
+const GEM_SIMPLE_SECTIONS = new Set(['CHECKSUMS', 'PLATFORMS', 'DEPENDENCIES', 'RUBY VERSION', 'RUBYGEMS']);
+const GEM_SPEC = /^    ([A-Za-z0-9_.-]+) \(([^()\s][^()]*)\)$/;
+const GEM_DEPENDENCY = /^      [A-Za-z0-9_.-]+(?: \([^()]+\))?$/;
+const GEM_CHECKSUM = /^  [A-Za-z0-9_.-]+ \([^()]+\) (?:sha256|sha512)=[A-Za-z0-9+/=]+(?:, (?:sha256|sha512)=[A-Za-z0-9+/=]+)*$/;
+function parseGemfileLock(text) {
+    if (text.length === 0 || text.includes('\r') && !text.includes('\r\n'))
+        return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+    const lines = text.split('\n').map((line) => line.endsWith('\r') ? line.slice(0, -1) : line);
+    if (lines.at(-1) === '')
+        lines.pop();
+    let index = 0;
+    let sourceCount = 0;
+    let platforms = false;
+    let dependenciesSection = false;
+    const dependencies = [];
+    while (index < lines.length) {
+        if (lines[index] === '') {
+            index += 1;
+            continue;
+        }
+        const section = lines[index];
+        if (!/^[A-Z][A-Z ]+$/.test(section) || (!GEM_SOURCE_SECTIONS.has(section) && !GEM_SIMPLE_SECTIONS.has(section) && section !== 'BUNDLED WITH')) {
+            return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+        }
+        index += 1;
+        if (GEM_SOURCE_SECTIONS.has(section)) {
+            sourceCount += 1;
+            let sawSpecs = false;
+            while (index < lines.length && lines[index] !== '' && !/^[A-Z][A-Z ]+$/.test(lines[index])) {
+                const line = lines[index];
+                if (/^  specs:$/.test(line)) {
+                    if (sawSpecs)
+                        return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+                    sawSpecs = true;
+                    index += 1;
+                    let specifications = 0;
+                    while (index < lines.length && GEM_SPEC.test(lines[index])) {
+                        const match = GEM_SPEC.exec(lines[index]);
+                        dependencies.push({ ecosystem: 'ruby', name: match[1], version: match[2] });
+                        specifications += 1;
+                        index += 1;
+                        while (index < lines.length && lines[index].startsWith('      ')) {
+                            if (!GEM_DEPENDENCY.test(lines[index]))
+                                return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+                            index += 1;
+                        }
+                    }
+                    if (specifications === 0)
+                        return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+                }
+                else if (!/^  (?:remote|revision|branch|ref|tag|glob):\s+\S.*$/.test(line)) {
+                    return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+                }
+                else
+                    index += 1;
+            }
+            if (!sawSpecs)
+                return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+        }
+        else if (section === 'BUNDLED WITH') {
+            if (index >= lines.length || !/^   \d+(?:\.\d+)+(?:[A-Za-z0-9.-]+)?$/.test(lines[index])) {
+                return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+            }
+            index += 1;
+        }
+        else {
+            let entries = 0;
+            while (index < lines.length && lines[index] !== '' && !/^[A-Z][A-Z ]+$/.test(lines[index])) {
+                const line = lines[index];
+                if (section === 'CHECKSUMS' && !GEM_CHECKSUM.test(line))
+                    return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+                if (section === 'PLATFORMS' && !/^  [A-Za-z0-9_.-]+$/.test(line))
+                    return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+                if (section === 'DEPENDENCIES' && !/^  [A-Za-z0-9_.-]+(?: \([^()]+\))?!?$/.test(line))
+                    return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+                if ((section === 'RUBY VERSION' || section === 'RUBYGEMS') && !/^  \S.*$/.test(line))
+                    return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+                entries += 1;
+                index += 1;
+            }
+            if (entries === 0)
+                return { kind: 'read', reason: 'gemfile_lock_invalid_grammar' };
+            if (section === 'PLATFORMS')
+                platforms = true;
+            if (section === 'DEPENDENCIES')
+                dependenciesSection = true;
+        }
+    }
+    return sourceCount > 0 && platforms && dependenciesSection
+        ? proof('Gemfile.lock', 'gemfile-lock', '1', GEMFILE_LOCK_PARSER_VERSION, dependencies)
+        : { kind: 'read', reason: 'gemfile_lock_invalid_shape' };
+}
+export function parseOwnedLockfile(input) {
+    const filename = typeof input.path === 'string' ? ownedName(input.path) : null;
+    if (filename === null)
+        return { kind: 'read', reason: 'lockfile_not_owned' };
+    if (typeof input.text !== 'string')
+        return { kind: 'read', reason: 'lockfile_input_invalid' };
+    if (filename === 'package-lock.json' || filename === 'npm-shrinkwrap.json') {
+        return parseNpmLockfile(filename, input.text);
+    }
+    if (filename === 'pnpm-lock.yaml')
+        return parsePnpmLockfile(input.text);
+    if (filename === 'yarn.lock')
+        return parseYarnLockfile(input.text);
+    if (filename === 'bun.lock')
+        return parseBunLockfile(input.text);
+    if (filename === 'Cargo.lock')
+        return parseCargoLockfile(input.text);
+    if (filename === 'poetry.lock')
+        return parsePoetryLockfile(input.text);
+    if (filename === 'uv.lock')
+        return parseUvLockfile(input.text);
+    if (filename === 'Pipfile.lock')
+        return parsePipfileLockfile(input.text);
+    if (filename === 'composer.lock')
+        return parseComposerLockfile(input.text);
+    if (filename === 'go.sum')
+        return parseGoSum(input.text);
+    if (filename === 'Gemfile.lock')
+        return parseGemfileLock(input.text);
+    return { kind: 'read', reason: 'lockfile_parser_not_implemented' };
+}