agentic-qe 3.15.5 → 3.15.7

package/dist/domains/security-compliance/dependency-advisory-engine.js

@@ -0,0 +1,113 @@
+/**
+ * Dependency advisory (OSV) engine for the scan-security task (#1049).
+ *
+ * Runs the security-compliance DependencyScanner on the project's package.json
+ * and turns its outcome into an execution receipt. A failed or partial OSV
+ * lookup is a failed/partial engine with the unchecked packages listed, never
+ * a completed engine with zero findings.
+ */
+import * as fs from 'fs/promises';
+import * as path from 'path';
+export const DEPENDENCY_ADVISORY_ENGINE_ID = 'osv-dependency-advisories';
+/** The package.json for a scan target: the target directory's, else the project root's. */
+export async function findPackageJson(targetPath, env = process.env) {
+    let dir = targetPath;
+    try {
+        if (!(await fs.stat(targetPath)).isDirectory())
+            dir = path.dirname(targetPath);
+    }
+    catch {
+        dir = path.dirname(targetPath);
+    }
+    const candidates = [dir, env.AQE_PROJECT_ROOT ? path.resolve(env.AQE_PROJECT_ROOT) : null];
+    for (const candidate of candidates) {
+        if (!candidate)
+            continue;
+        const manifest = path.join(candidate, 'package.json');
+        try {
+            if ((await fs.stat(manifest)).isFile())
+                return manifest;
+        }
+        catch { /* try next */ }
+    }
+    return null;
+}
+/** Human message for a dependency scan outcome. */
+export const DEPENDENCY_SCOPE_NOTE = 'direct dependencies of this package.json only; workspace members and transitive dependencies are not checked';
+export function dependencyScanMessage(report) {
+    return `${statusMessage(report)} Scope: ${DEPENDENCY_SCOPE_NOTE}.`;
+}
+function statusMessage(report) {
+    switch (report.status) {
+        case 'complete':
+            return report.packagesRequested === 0
+                ? `No registry dependencies to check${report.localPackages.length ? ` (${report.localPackages.length} local package(s) excluded)` : ' in package.json'}; nothing to check (complete).`
+                : `Dependency advisories checked for all ${report.packagesChecked} package(s): ${report.vulnerabilities} advisory finding(s).`;
+        case 'incomplete':
+            return (report.uncheckedPackages.length > 0
+                ? `Dependency advisories could not be checked for ${report.uncheckedPackages.length} of ${report.packagesRequested} package(s); ` : '') +
+                (report.resolutionErrors.length > 0 ? `${report.resolutionErrors.slice(0, 3).join('; ')}; ` : '') +
+                `${report.vulnerabilities} finding(s) from the ${report.packagesChecked} checked package(s). Dependency scan is INCOMPLETE, not clean.`;
+        case 'failed':
+            return `${report.error ?? `Dependency advisories could not be checked for ${report.uncheckedPackages.length} package(s)`}. ` +
+                'Dependency vulnerabilities are UNMEASURED, not zero.';
+        default:
+            return report.error ?? 'Dependency advisory scan did not run.';
+    }
+}
+function notRun(reason, manifest) {
+    const base = { status: 'not-run', measured: false, ...(manifest ? { manifest } : {}),
+        packagesRequested: 0, packagesChecked: 0, uncheckedPackages: [], localPackages: [],
+        resolutionErrors: [], scope: 'direct',
+        vulnerabilities: 0, error: reason };
+    return {
+        engine: { id: DEPENDENCY_ADVISORY_ENGINE_ID, requested: true, required: true, status: 'failed', scope: 'parent-directory',
+            ...(manifest ? { target: manifest } : {}), analyzedFiles: 0, ruleCoverage: 'unknown', errors: [reason], limitations: [] },
+        vulnerabilities: [],
+        report: { ...base, message: dependencyScanMessage(base) },
+    };
+}
+/** Run the OSV dependency scan for a target and describe it as an engine receipt. */
+export async function runDependencyAdvisoryScan(scanner, targetPath) {
+    const manifest = await findPackageJson(targetPath);
+    if (!manifest)
+        return notRun('No package.json found for the dependency advisory scan.');
+    let scan;
+    try {
+        scan = await scanner.scanPackageJson(manifest);
+    }
+    catch (error) {
+        return notRun(`Dependency advisory scan failed: ${error instanceof Error ? error.message : String(error)}`, manifest);
+    }
+    if (!scan.success)
+        return notRun(`Dependency advisory scan did not run: ${scan.error.message}`, manifest);
+    const value = scan.value;
+    const unchecked = value.uncheckedPackages.map((p) => `${p.name}@${p.version}: ${p.reason}`);
+    const base = {
+        status: value.status, measured: value.measured, manifest, lockfile: value.lockfile ?? null,
+        packagesRequested: value.packagesScanned, packagesChecked: value.packagesChecked,
+        uncheckedPackages: value.uncheckedPackages, localPackages: value.localPackages ?? [],
+        resolutionErrors: value.resolutionErrors ?? [], scope: 'direct',
+        vulnerabilities: value.vulnerabilities.length,
+        scanId: value.scanId, ...(value.error ? { error: value.error } : {}),
+    };
+    return {
+        engine: {
+            id: DEPENDENCY_ADVISORY_ENGINE_ID, requested: true, required: true,
+            status: value.status === 'complete' ? 'completed' : value.status === 'incomplete' ? 'partial' : 'failed',
+            scope: 'parent-directory', target: manifest, ruleCoverage: 'unknown',
+            errors: [...(value.error ? [value.error] : []), ...(value.resolutionErrors ?? []), ...unchecked.slice(0, 20),
+                ...(unchecked.length > 20 ? [`... and ${unchecked.length - 20} more unchecked package(s)`] : [])],
+            limitations: [
+                value.lockfile
+                    ? `Direct dependencies are checked at the versions ${value.lockfile} resolves (when in sync with package.json); transitive dependencies are not checked.`
+                    : 'No lockfile: only exact versions in package.json are checked; ranges are reported unchecked. Transitive dependencies are not checked.',
+                ...((value.localPackages ?? []).length > 0
+                    ? [`${value.localPackages.length} local workspace/linked package(s) are not OSV subjects and were excluded.`] : []),
+            ],
+        },
+        vulnerabilities: value.vulnerabilities,
+        report: { ...base, message: dependencyScanMessage(base) },
+    };
+}
+//# sourceMappingURL=dependency-advisory-engine.js.map

package/dist/domains/security-compliance/interfaces.d.ts

@@ -214,6 +214,36 @@ export interface DependencyScanResult {
     readonly vulnerabilities: Vulnerability[];
     readonly outdatedPackages: OutdatedPackage[];
     readonly summary: ScanSummary;
+    /**
+     * #1049: whether the advisory lookup covered every dependency. Only
+     * 'complete' is a measurement; 'incomplete' findings are real but partial,
+     * and 'failed' means no dependency was checked (never "0 vulnerabilities").
+     */
+    readonly status: 'complete' | 'incomplete' | 'failed';
+    /** True only when status is 'complete'. */
+    readonly measured: boolean;
+    readonly packagesChecked: number;
+    readonly uncheckedPackages: UncheckedDependency[];
+    /** Why the scan is incomplete/failed; absent when complete. */
+    readonly error?: string;
+}
+/** A dependency whose advisories could not be checked, and why (#1049). */
+export interface UncheckedDependency {
+    readonly name: string;
+    /** The spec as declared in the manifest. */
+    readonly version: string;
+    readonly reason: string;
+    /** Workspace member the dependency belongs to (absent for the scanned package itself). */
+    readonly member?: string;
+    /** The lockfile-resolved version, when the lockfile has one. */
+    readonly lockedVersion?: string;
+}
+/** A local (workspace / linked / file-directory) package: not an OSV subject (#1049). */
+export interface LocalDependency {
+    readonly name: string;
+    readonly spec: string;
+    readonly reason: string;
+    readonly member?: string;
 }
 export interface PackageSecurityInfo {
     readonly name: string;

package/dist/domains/security-compliance/plugin.d.ts

@@ -8,7 +8,7 @@ import { BaseDomainPlugin, TaskHandler } from '../domain-interface.js';
 import { FilePath } from '../../shared/value-objects/index.js';
 import type { SecurityAuditOptions, SecurityAuditReport, SecurityPosture, ComplianceReport, ComplianceStandard, SASTResult, DASTResult, Vulnerability, GapAnalysis } from './interfaces.js';
 import { type IExtendedSecurityComplianceCoordinator, type CoordinatorConfig } from './coordinator.js';
-import { type ISecurityScannerService, type SecurityScannerConfig } from './services/security-scanner.js';
+import { type ISecurityScannerService, type SecurityScannerConfig, type DependencyScanResult as OSVDependencyScanResult } from './services/security-scanner.js';
 import { type ISecurityAuditorService, type SecurityAuditorConfig } from './services/security-auditor.js';
 import type { HybridRouter } from '../../shared/llm/router/hybrid-router.js';
 import { type IExtendedComplianceValidationService, type ComplianceValidatorConfig } from './services/compliance-validator.js';
@@ -26,6 +26,11 @@ export interface SecurityComplianceAPI {
     getSecurityPosture(): Promise<Result<SecurityPosture>>;
     runSASTScan(files: FilePath[]): Promise<Result<SASTResult>>;
     runDASTScan(targetUrl: string): Promise<Result<DASTResult>>;
+    /**
+     * #1049: OSV advisory scan of a package.json. Check `status`: only 'complete'
+     * is a measurement; 'incomplete'/'failed' list the unchecked dependencies.
+     */
+    runDependencyScan(packageJsonPath: string): Promise<Result<OSVDependencyScanResult>>;
     triageVulnerabilities(vulnerabilities: Vulnerability[]): Promise<Result<{
         immediate: Vulnerability[];
         shortTerm: Vulnerability[];
@@ -66,6 +71,7 @@ export declare class SecurityCompliancePlugin extends BaseDomainPlugin {
     protected onEvent(event: DomainEvent): Promise<void>;
     private runSecurityAudit;
     private getSecurityPosture;
+    private runDependencyScan;
     private runSASTScan;
     private runDASTScan;
     private triageVulnerabilities;

package/dist/domains/security-compliance/plugin.js

@@ -49,6 +49,7 @@ export class SecurityCompliancePlugin extends BaseDomainPlugin {
             getSecurityPosture: this.getSecurityPosture.bind(this),
             runSASTScan: this.runSASTScan.bind(this),
             runDASTScan: this.runDASTScan.bind(this),
+            runDependencyScan: this.runDependencyScan.bind(this),
             triageVulnerabilities: this.triageVulnerabilities.bind(this),
             runComplianceCheck: this.runComplianceCheck.bind(this),
             getAvailableStandards: this.getAvailableStandards.bind(this),
@@ -209,6 +210,24 @@ export class SecurityCompliancePlugin extends BaseDomainPlugin {
             return this.handleError(error);
         }
     }
+    async runDependencyScan(packageJsonPath) {
+        this.ensureInitialized();
+        try {
+            const result = await this.securityScanner.scanPackageJson(packageJsonPath);
+            if (result.success && result.value.status === 'complete') {
+                this.trackSuccessfulOperation('dependency-scan');
+            }
+            else {
+                this.trackFailedOperation('dependency-scan', result.success
+                    ? new Error(result.value.error ?? 'Dependency advisory scan incomplete')
+                    : result.error);
+            }
+            return result;
+        }
+        catch (error) {
+            return this.handleError(error);
+        }
+    }
     async runSASTScan(files) {
         this.ensureInitialized();
         try {

package/dist/domains/security-compliance/services/scanners/dast-scanner.js

@@ -6,6 +6,7 @@ import { LoggerFactory } from '../../../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../../shared/types/index.js';
 import { toError } from '../../../../shared/error-utils.js';
+import { fetchWithResponseDeadline } from '../../../../shared/llm/providers/response-deadline.js';
 import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, handleFetchError, calculateSummary, storeScanResults, } from './dast-helpers.js';
 // ============================================================================
 // DAST Scanner Service
@@ -144,20 +145,19 @@ export class DASTScanner {
             }
             const timeout = options.timeout ?? this.config.timeout;
             const maxDepth = options.maxDepth ?? this.config.dastMaxDepth;
-            // Perform main page scan
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), Math.min(timeout, 30000));
+            // Perform main page scan. #980: the deadline must cover the body too —
+            // the target is untrusted and may send headers and then stall the body,
+            // so it stays armed until `response.clone().text()` below has finished.
+            const deadlineMs = Math.min(timeout, 30000);
             try {
-                const response = await fetch(targetUrl, {
+                const response = await fetchWithResponseDeadline(targetUrl, {
                     method: 'GET',
                     headers: {
                         'User-Agent': 'AgenticQE-DAST-Scanner/3.0',
                         'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
                     },
-                    signal: controller.signal,
                     redirect: 'follow',
-                });
-                clearTimeout(timeoutId);
+                }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
                 crawledUrls++;
                 // Security header analysis
                 analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities);
@@ -171,19 +171,25 @@ export class DASTScanner {
                 analyzeServerHeaders(response.headers, targetUrl, vulnerabilities);
                 // Active scanning features
                 if (options.activeScanning ?? this.config.dastActiveScanning) {
+                    // Read the page body first, inside the request deadline (#980), so the
+                    // slower probes below cannot use up the deadline of a healthy target.
+                    const responseText = await response.text();
                     crawledUrls = await scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulnerabilities);
                     await analyzeCORS(targetUrl, vulnerabilities);
                     // Enhanced DAST: Link crawling, injection testing, form analysis
-                    const responseText = await response.clone().text();
                     crawledUrls = await extractAndCrawlLinks(responseText, parsedUrl, crawledUrls, maxDepth, vulnerabilities);
                     if (parsedUrl.search) {
                         await this.testInjectionVulnerabilities(targetUrl, parsedUrl, vulnerabilities);
                     }
                     analyzeFormsForSecurityIssues(responseText, targetUrl, vulnerabilities);
                 }
+                else {
+                    // Passive scan: headers only. Release the connection instead of
+                    // leaving an unread body to the deadline timer.
+                    await response.body?.cancel().catch(() => undefined);
+                }
             }
             catch (fetchError) {
-                clearTimeout(timeoutId);
                 handleFetchError(fetchError, targetUrl, vulnerabilities);
             }
         }
@@ -210,20 +216,21 @@ export class DASTScanner {
             }
             const timeout = options.timeout ?? this.config.timeout;
             const maxDepth = options.maxDepth ?? this.config.dastMaxDepth;
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), Math.min(timeout, 30000));
+            // #980 review N8: same deadline treatment as the unauthenticated scan.
+            // This path reads headers only; the unread body is cancelled below so
+            // a target that stalls it cannot hold the connection open.
+            const deadlineMs = Math.min(timeout, 30000);
             try {
-                const response = await fetch(targetUrl, {
+                const response = await fetchWithResponseDeadline(targetUrl, {
                     method: 'GET',
                     headers: {
                         'User-Agent': 'AgenticQE-DAST-Scanner/3.0',
                         'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
                         ...authHeaders,
                     },
-                    signal: controller.signal,
                     redirect: 'follow',
-                });
-                clearTimeout(timeoutId);
+                }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
+                await response.body?.cancel().catch(() => undefined);
                 crawledUrls++;
                 // Check if authentication was successful
                 if (response.status === 401 || response.status === 403) {
@@ -244,7 +251,6 @@ export class DASTScanner {
                 analyzeCookieSecurity(response.headers, targetUrl, vulnerabilities, true);
             }
             catch (fetchError) {
-                clearTimeout(timeoutId);
                 handleFetchError(fetchError, targetUrl, vulnerabilities);
             }
         }

package/dist/domains/security-compliance/services/scanners/dependency-resolver.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Agentic QE v3 - Dependency resolution for the OSV advisory scan (#1049)
+ *
+ * Decides, for every direct dependency of a package.json, what can be checked
+ * against OSV:
+ *
+ * - check:     a registry package at a concrete version — the lockfile's
+ *              resolved version when the lockfile is in sync with package.json,
+ *              else an exact spec. `npm:` aliases resolve to the real package.
+ * - local:     a workspace / linked / local-directory package. Not an OSV
+ *              subject; listed separately and never makes a scan incomplete.
+ * - unchecked: anything that cannot be matched without guessing — a range
+ *              with no (in-sync) lockfile resolution, a lockfile out of sync
+ *              with package.json, git/URL/tarball sources.
+ *
+ * The lockfile is looked up from the package directory upwards (never above
+ * AQE_PROJECT_ROOT or the git root), so scanning a workspace member directly
+ * uses the workspace root's lockfile.
+ *
+ * Workspace member scanning is not part of 3.15.7 (#1057): at a workspace root
+ * only the root's own dependencies are checked and the scan is reported as not
+ * complete, with a reason; each member can be scanned directly.
+ */
+export interface ResolvedDependency {
+    /** Dependency name as declared (the alias name for `npm:` aliases). */
+    readonly name: string;
+    /** Spec as declared in package.json. */
+    readonly spec: string;
+    /** Lockfile importer the dependency belongs to ('' = the lockfile root). */
+    readonly member: string;
+    readonly kind: 'check' | 'local' | 'unchecked';
+    /** Registry package to check (differs from `name` for aliases). */
+    readonly packageName?: string;
+    /** Concrete version to check. */
+    readonly version?: string;
+    /** Lockfile-resolved version, also reported for unchecked packages when known. */
+    readonly lockedVersion?: string;
+    readonly reason?: string;
+}
+export interface DependencyResolution {
+    readonly dependencies: ResolvedDependency[];
+    /** Lockfile used (relative to the scanned package.json directory), or null. */
+    readonly lockfile: string | null;
+    /** A lockfile that exists but could not be read or parsed. */
+    readonly error?: string;
+    /**
+     * Reasons the scan cannot be complete beyond individual packages — today: a
+     * workspace root, whose members' dependencies are not scanned (#1057).
+     */
+    readonly memberErrors: string[];
+}
+/** The reason a workspace root's scan is not complete (#1057). */
+export declare const WORKSPACE_NOT_SCANNED = "workspace member dependencies are not scanned yet (#1057); scan each member directory separately";
+type Manifest = {
+    name?: unknown;
+    workspaces?: unknown;
+} & Partial<Record<'dependencies' | 'devDependencies' | 'peerDependencies' | 'optionalDependencies', Record<string, unknown>>>;
+/** All declared dependencies of a manifest (later fields win, as npm resolves them). */
+export declare function declaredDependencies(manifest: Manifest): Record<string, string>;
+/**
+ * Resolve a `name -> spec` record with caller-supplied resolved versions
+ * (programmatic use; no lockfile on disk). Same rules as `resolveDependencies`.
+ */
+export declare function resolveFromRecord(dependencies: Record<string, string>, lockedVersions?: Record<string, string>): ResolvedDependency[];
+/**
+ * Resolve the dependencies to check for the package.json at `manifestPath`.
+ * @throws when package.json itself cannot be read or parsed.
+ */
+export declare function resolveDependencies(manifestPath: string): Promise<DependencyResolution>;
+export {};
+//# sourceMappingURL=dependency-resolver.d.ts.map

package/dist/domains/security-compliance/services/scanners/dependency-resolver.js

@@ -0,0 +1,232 @@
+/**
+ * Agentic QE v3 - Dependency resolution for the OSV advisory scan (#1049)
+ *
+ * Decides, for every direct dependency of a package.json, what can be checked
+ * against OSV:
+ *
+ * - check:     a registry package at a concrete version — the lockfile's
+ *              resolved version when the lockfile is in sync with package.json,
+ *              else an exact spec. `npm:` aliases resolve to the real package.
+ * - local:     a workspace / linked / local-directory package. Not an OSV
+ *              subject; listed separately and never makes a scan incomplete.
+ * - unchecked: anything that cannot be matched without guessing — a range
+ *              with no (in-sync) lockfile resolution, a lockfile out of sync
+ *              with package.json, git/URL/tarball sources.
+ *
+ * The lockfile is looked up from the package directory upwards (never above
+ * AQE_PROJECT_ROOT or the git root), so scanning a workspace member directly
+ * uses the workspace root's lockfile.
+ *
+ * Workspace member scanning is not part of 3.15.7 (#1057): at a workspace root
+ * only the root's own dependencies are checked and the scan is reported as not
+ * complete, with a reason; each member can be scanned directly.
+ */
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import semver from 'semver';
+import { parse as parseYaml } from 'yaml';
+import { safeJsonParse } from '../../../../shared/safe-json.js';
+import { classifyNpmSpec, exactNpmVersion } from '../../../../shared/security/osv-lookup.js';
+import { LOCKFILES, parseLockfile } from './lockfile-versions.js';
+/** The reason a workspace root's scan is not complete (#1057). */
+export const WORKSPACE_NOT_SCANNED = 'workspace member dependencies are not scanned yet (#1057); scan each member directory separately';
+const OUT_OF_SYNC = 'lockfile out of sync with package.json';
+/** All declared dependencies of a manifest (later fields win, as npm resolves them). */
+export function declaredDependencies(manifest) {
+    const out = {};
+    for (const field of ['peerDependencies', 'optionalDependencies', 'devDependencies', 'dependencies']) {
+        for (const [name, spec] of Object.entries(manifest[field] ?? {})) {
+            if (typeof spec === 'string')
+                out[name] = spec;
+        }
+    }
+    return out;
+}
+async function readManifest(file) {
+    return safeJsonParse(await fs.readFile(file, 'utf-8'));
+}
+async function exists(file) {
+    try {
+        await fs.access(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function realOrResolved(p) {
+    try {
+        return await fs.realpath(p);
+    }
+    catch {
+        return path.resolve(p);
+    }
+}
+/**
+ * Find the lockfile governing `dir`: walk up, but never above the project root
+ * (`AQE_PROJECT_ROOT` when `dir` is inside it) nor above the git root.
+ */
+async function findLockfile(dir, env = process.env) {
+    let current = await realOrResolved(dir);
+    const projectRoot = env.AQE_PROJECT_ROOT ? await realOrResolved(env.AQE_PROJECT_ROOT) : null;
+    const boundary = projectRoot && isInside(projectRoot, current) ? projectRoot : null;
+    for (;;) {
+        for (const file of LOCKFILES) {
+            if (await exists(path.join(current, file)))
+                return { dir: current, file };
+        }
+        if (current === boundary || await exists(path.join(current, '.git')))
+            return null;
+        const parent = path.dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+}
+/** Whether `child` is `root` or inside it (both absolute, real paths). */
+function isInside(root, child) {
+    const rel = path.relative(root, child);
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+/** Largest pnpm-workspace.yaml that is read; a larger one counts as a workspace root. */
+const MAX_PNPM_WORKSPACE_BYTES = 1024 * 1024;
+const nonEmptyArray = (v) => Array.isArray(v) && v.length > 0;
+/**
+ * A workspace root, detected without expanding any glob: package.json
+ * `workspaces` is a non-empty array or an object with a non-empty `packages`,
+ * or a pnpm-workspace.yaml declares workspace packages.
+ */
+async function isWorkspaceRoot(dir, manifest) {
+    const ws = manifest.workspaces;
+    if (nonEmptyArray(ws))
+        return true;
+    if (ws !== null && typeof ws === 'object' && nonEmptyArray(ws.packages))
+        return true;
+    return pnpmDeclaresPackages(path.join(dir, 'pnpm-workspace.yaml'));
+}
+/**
+ * pnpm 10+ keeps project settings (nodeLinker, onlyBuiltDependencies, ...) in
+ * pnpm-workspace.yaml even for a single package, so only a file that declares
+ * `packages` is a workspace root. Fail closed: an unreadable, oversized,
+ * non-regular, dangling or unparsable file, or a `packages` that is not a list,
+ * counts as a root. No file, a map without `packages`, or `packages: []` does not.
+ */
+async function pnpmDeclaresPackages(file) {
+    try {
+        await fs.lstat(file);
+    }
+    catch (e) {
+        return e.code !== 'ENOENT';
+    }
+    let doc;
+    try {
+        const st = await fs.stat(file); // follows a link; a dangling one throws
+        if (!st.isFile() || st.size > MAX_PNPM_WORKSPACE_BYTES)
+            return true;
+        const text = await fs.readFile(file, 'utf-8');
+        doc = parseYaml(text, { uniqueKeys: false, merge: true, maxAliasCount: 100 });
+    }
+    catch {
+        return true;
+    }
+    if (doc === null || typeof doc !== 'object' || Array.isArray(doc))
+        return true;
+    if (!Object.prototype.hasOwnProperty.call(doc, 'packages'))
+        return false;
+    const packages = doc.packages;
+    return !Array.isArray(packages) || packages.length > 0;
+}
+/** Resolve one declared dependency of `member`. */
+function resolveOne(name, spec, member, index, localNames) {
+    const base = { name, spec, member };
+    const kind = classifyNpmSpec(spec);
+    if (kind.kind === 'local')
+        return { ...base, kind: 'local', reason: 'local package (workspace/link/file directory)' };
+    if (kind.kind === 'remote') {
+        return { ...base, kind: 'unchecked', reason: `not a registry dependency ("${spec}": git/URL/tarball source); OSV advisories cannot be matched` };
+    }
+    const packageName = kind.kind === 'alias' ? kind.name : name;
+    const rangeSpec = kind.spec;
+    const locked = index?.resolve(member, name, spec);
+    if (locked?.local || (!locked && localNames.has(name))) {
+        return { ...base, kind: 'local', reason: 'workspace package (local source)' };
+    }
+    if (locked && index) {
+        const recorded = index.recordedSpec(member, name);
+        const lockedVersion = locked.version ? exactNpmVersion(locked.version) ?? undefined : undefined;
+        const specDiffers = recorded === undefined || (recorded !== null && recorded !== spec);
+        const unsatisfied = lockedVersion !== undefined && !!semver.validRange(rangeSpec)
+            && !semver.satisfies(lockedVersion, rangeSpec, { includePrerelease: true });
+        if (specDiffers || unsatisfied) {
+            return {
+                ...base, kind: 'unchecked', ...(lockedVersion ? { lockedVersion } : {}),
+                reason: `${OUT_OF_SYNC} (${index.file} has ${recorded ? `"${recorded}"` : 'no entry'}${lockedVersion ? ` -> ${lockedVersion}` : ''} for "${spec}")`,
+            };
+        }
+        if (lockedVersion) {
+            return { ...base, kind: 'check', packageName: locked.realName ?? packageName, version: lockedVersion, lockedVersion };
+        }
+    }
+    const exact = exactNpmVersion(rangeSpec);
+    if (exact)
+        return { ...base, kind: 'check', packageName, version: exact };
+    return { ...base, kind: 'unchecked', reason: `version range "${spec}", no lockfile resolution` };
+}
+/**
+ * Resolve a `name -> spec` record with caller-supplied resolved versions
+ * (programmatic use; no lockfile on disk). Same rules as `resolveDependencies`.
+ */
+export function resolveFromRecord(dependencies, lockedVersions = {}) {
+    const index = {
+        file: 'package-lock.json',
+        members: () => [],
+        hasImporter: () => true,
+        recordedSpec: () => null,
+        resolve: (_importer, name) => (lockedVersions[name] !== undefined ? { version: lockedVersions[name] } : undefined),
+    };
+    return Object.entries(dependencies).map(([name, spec]) => resolveOne(name, spec, '', index, new Set()));
+}
+/**
+ * Resolve the dependencies to check for the package.json at `manifestPath`.
+ * @throws when package.json itself cannot be read or parsed.
+ */
+export async function resolveDependencies(manifestPath) {
+    const manifestDir = path.dirname(path.resolve(manifestPath));
+    const manifest = await readManifest(manifestPath);
+    let index = null;
+    let lockDir = await realOrResolved(manifestDir);
+    const realManifestDir = lockDir;
+    let lockfile = null;
+    let error;
+    const found = await findLockfile(manifestDir);
+    if (found) {
+        const member = path.relative(found.dir, realManifestDir).split(path.sep).join('/');
+        try {
+            const parsed = parseLockfile(found.file, await fs.readFile(path.join(found.dir, found.file), 'utf-8'));
+            const rootManifest = member ? await readManifest(path.join(found.dir, 'package.json')).catch(() => ({})) : manifest;
+            // A member scanned directly: the root lockfile covers it if it lists the
+            // importer (npm/pnpm) or, for yarn, if the root declares workspaces.
+            const covers = member === '' || parsed.hasImporter(member) && (parsed.file !== 'yarn.lock'
+                || await isWorkspaceRoot(found.dir, rootManifest));
+            if (covers) {
+                index = parsed;
+                lockDir = found.dir;
+                lockfile = path.relative(realManifestDir, path.join(found.dir, found.file)).split(path.sep).join('/');
+            }
+        }
+        catch (e) {
+            // #1049 round 4: a malformed lockfile is an error (the scan is not complete), not "no lockfile".
+            error = `${path.relative(realManifestDir, path.join(found.dir, found.file)).split(path.sep).join('/')} could not be read or parsed `
+                + `(${e instanceof Error ? e.message.slice(0, 120) : 'error'}); versions were not resolved from it`;
+        }
+    }
+    const scannedMember = path.relative(lockDir, realManifestDir).split(path.sep).join('/');
+    // #1057: workspace members are not scanned in 3.15.7 — a workspace root is never complete.
+    const memberErrors = await isWorkspaceRoot(realManifestDir, manifest) ? [WORKSPACE_NOT_SCANNED] : [];
+    const dependencies = [];
+    for (const [name, spec] of Object.entries(declaredDependencies(manifest))) {
+        dependencies.push(resolveOne(name, spec, scannedMember, index, new Set()));
+    }
+    return { dependencies, lockfile, memberErrors, ...(error ? { error } : {}) };
+}
+//# sourceMappingURL=dependency-resolver.js.map