autoremediator 0.21.2 → 0.22.0

package/dist/scanner/lock-graph/bun.js

@@ -0,0 +1,116 @@
+import { isRecord, stringMap } from "./types.js";
+/** Remove comments and trailing commas, which `bun.lock` (JSONC) allows and `JSON.parse` does not. */
+export function stripJsonc(text) {
+    let out = "";
+    let inString = false;
+    for (let i = 0; i < text.length; i += 1) {
+        const char = text[i];
+        if (inString) {
+            out += char;
+            if (char === "\\") {
+                out += text[i + 1] ?? "";
+                i += 1;
+            }
+            else if (char === '"')
+                inString = false;
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+            out += char;
+        }
+        else if (char === "/" && text[i + 1] === "/") {
+            while (i < text.length && text[i] !== "\n")
+                i += 1;
+            out += "\n";
+        }
+        else if (char === "/" && text[i + 1] === "*") {
+            const end = text.indexOf("*/", i + 2);
+            i = end === -1 ? text.length : end + 1;
+        }
+        else if (char === ",") {
+            // Drop the comma when only whitespace and a closing bracket follow.
+            let next = i + 1;
+            while (next < text.length && /\s/.test(text[next]))
+                next += 1;
+            if (text[next] !== "}" && text[next] !== "]")
+                out += char;
+        }
+        else {
+            out += char;
+        }
+    }
+    return out;
+}
+/** Key of the package that encloses `key` (`a/b` is nested in `a`; `@s/a/@s/b` in `@s/a`). */
+function enclosing(key) {
+    const segments = key.split("/");
+    const drop = segments.length >= 2 && segments.at(-2)?.startsWith("@") ? 2 : 1;
+    return segments.slice(0, -drop).join("/");
+}
+/** `name` and `version` out of the `name@spec` identifier at the head of a package entry. */
+function parseIdent(ident) {
+    const at = ident.indexOf("@", 1);
+    if (at <= 0)
+        return undefined;
+    const spec = ident.slice(at + 1);
+    // An alias reads `alias@npm:real@1.2.3`.
+    const version = spec.startsWith("npm:") ? spec.slice(spec.lastIndexOf("@") + 1) : spec;
+    return { name: ident.slice(0, at), version };
+}
+const resolveAll = (resolve, ...tables) => tables
+    .flatMap((table) => Object.keys(stringMap(table)))
+    .flatMap((name) => resolve("", name) ?? []);
+/** Parse the text `bun.lock` (Bun 1.2+). The binary `bun.lockb` is not supported. */
+export function parseBunLock(content) {
+    const data = JSON.parse(stripJsonc(content));
+    if (!isRecord(data))
+        throw new Error("bun.lock is not a JSON object");
+    const packages = isRecord(data["packages"]) ? data["packages"] : {};
+    const resolve = (from, name) => {
+        for (let location = from;; location = enclosing(location)) {
+            const candidate = location === "" ? name : `${location}/${name}`;
+            if (Object.hasOwn(packages, candidate))
+                return candidate;
+            if (location === "")
+                return undefined;
+        }
+    };
+    const nodes = new Map();
+    for (const [key, raw] of Object.entries(packages)) {
+        if (!Array.isArray(raw) || typeof raw[0] !== "string")
+            continue;
+        const ident = parseIdent(raw[0]);
+        // Workspace packages are listed as `name@workspace:path`; they are roots, not installs.
+        if (!ident || raw[0].includes("@workspace:"))
+            continue;
+        const meta = isRecord(raw[2]) ? raw[2] : {};
+        const deps = new Set();
+        for (const table of [
+            meta["dependencies"],
+            meta["optionalDependencies"],
+            meta["peerDependencies"],
+        ]) {
+            for (const dep of Object.keys(stringMap(table))) {
+                const target = resolve(key, dep);
+                if (target !== undefined && target !== key)
+                    deps.add(target);
+            }
+        }
+        nodes.set(key, { id: key, name: ident.name, version: ident.version, deps: [...deps] });
+    }
+    const workspaces = isRecord(data["workspaces"]) ? data["workspaces"] : {};
+    const roots = Object.entries(workspaces).flatMap(([workspace, raw]) => {
+        if (!isRecord(raw))
+            return [];
+        return [
+            {
+                workspace: workspace === "" ? "." : workspace,
+                prod: resolveAll(resolve, raw["dependencies"], raw["optionalDependencies"]),
+                dev: resolveAll(resolve, raw["devDependencies"]),
+            },
+        ];
+    });
+    return { format: "bun", nodes, roots, recordsInstallScripts: false };
+}
+//# sourceMappingURL=bun.js.map

package/dist/scanner/lock-graph/bun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun.js","sourceRoot":"","sources":["../../../src/scanner/lock-graph/bun.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAgD,MAAM,YAAY,CAAC;AAE/F,sGAAsG;AACtG,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACtB,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,IAAI,IAAI,CAAC;YACZ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,IAAI,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC;YACnD,GAAG,IAAI,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,oEAAoE;YACpE,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC;gBAAE,IAAI,IAAI,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG;gBAAE,GAAG,IAAI,IAAI,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,6FAA6F;AAC7F,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACjC,yCAAyC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,GAAG,CACjB,OAA2D,EAC3D,GAAG,MAAiB,EACV,EAAE,CACZ,MAAM;KACH,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;KACjD,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAEhD,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE;QACjE,KAAK,IAAI,QAAQ,GAAG,IAAI,GAAI,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,SAAS,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;YACjE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YACzD,IAAI,QAAQ,KAAK,EAAE;gBAAE,OAAO,SAAS,CAAC;QACxC,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,SAAS;QAChE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,wFAAwF;QACxF,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,SAAS;QACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI;YAClB,IAAI,CAAC,cAAc,CAAC;YACpB,IAAI,CAAC,sBAAsB,CAAC;YAC5B,IAAI,CAAC,kBAAkB,CAAC;SACzB,EAAE,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACjC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,GAAG;oBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,MAAM,KAAK,GAAe,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE;QAChF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9B,OAAO;YACL;gBACE,SAAS,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBAC7C,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC;gBAC3E,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC;aACjD;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC"}

package/dist/scanner/lock-graph/index.d.ts

@@ -0,0 +1,32 @@
+import { type LockGraph, type ManifestDeps } from "./types.js";
+export { LOCKFILE_NAMES, lockFormatOf } from "./types.js";
+export type { LockFormat, LockGraph, LockNode, LockRoot, ManifestDeps } from "./types.js";
+/**
+ * Read a lockfile as a graph. `path` is only used to tell which format it is. Throws when the
+ * content is not a lockfile of that format; returns undefined for a file name that is not a lockfile.
+ */
+export declare function parseLockGraph(path: string, content: string, manifest?: ManifestDeps): LockGraph | undefined;
+export interface PackageOccurrence {
+    name: string;
+    version: string;
+    nodeId: string;
+    /** Asked for by a manifest of the project (or a workspace) itself. */
+    direct: boolean;
+    /** `unreferenced`: in the lockfile, but nothing the manifests ask for leads to it. */
+    scope: "production" | "development" | "unreferenced";
+    /** The workspaces that depend on it directly. */
+    workspaces: string[];
+    /** Shortest chain from a workspace to this package: the workspace, then `name@version` per hop. */
+    via: string[];
+    /** Packages that depend on it directly, as `name@version` (at most five). */
+    dependents: string[];
+    /** Whether installing it runs scripts, as far as the lockfile says; absent when the format does not record it. */
+    installScript?: boolean;
+}
+/** Every locked package the predicate accepts, with how the project comes to have it. */
+export declare function findOccurrences(graph: LockGraph, matches: (name: string, version: string) => boolean): PackageOccurrence[];
+/** Predicate for "this package, in this range" (prereleases count). */
+export declare function inRange(packageName: string, range: string): (name: string, version: string) => boolean;
+/** Every distinct locked version of a package. */
+export declare function versionsOfPackage(graph: LockGraph, packageName: string): string[];
+//# sourceMappingURL=index.d.ts.map

package/dist/scanner/lock-graph/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanner/lock-graph/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAgB,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAG7E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1D,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1F;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,YAAY,GACtB,SAAS,GAAG,SAAS,CAOvB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,KAAK,EAAE,YAAY,GAAG,aAAa,GAAG,cAAc,CAAC;IACrD,iDAAiD;IACjD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mGAAmG;IACnG,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kHAAkH;IAClH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AA8BD,yFAAyF;AACzF,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,GAClD,iBAAiB,EAAE,CAuErB;AAED,uEAAuE;AACvE,wBAAgB,OAAO,CACrB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAK5C;AAED,kDAAkD;AAClD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAQjF"}

package/dist/scanner/lock-graph/index.js

@@ -0,0 +1,125 @@
+import semver from "semver";
+import { parseBunLock } from "./bun.js";
+import { parseNpmLock } from "./npm.js";
+import { parsePnpmLock } from "./pnpm.js";
+import { lockFormatOf } from "./types.js";
+import { parseYarnLock } from "./yarn.js";
+export { LOCKFILE_NAMES, lockFormatOf } from "./types.js";
+/**
+ * Read a lockfile as a graph. `path` is only used to tell which format it is. Throws when the
+ * content is not a lockfile of that format; returns undefined for a file name that is not a lockfile.
+ */
+export function parseLockGraph(path, content, manifest) {
+    const format = lockFormatOf(path);
+    if (format === "npm")
+        return parseNpmLock(content, manifest);
+    if (format === "pnpm")
+        return parsePnpmLock(content);
+    if (format === "yarn")
+        return parseYarnLock(content, manifest);
+    if (format === "bun")
+        return parseBunLock(content);
+    return undefined;
+}
+/** Breadth-first search from the given nodes; `parent` points back along a shortest path. */
+function reach(graph, starts) {
+    const parent = new Map();
+    const queue = [];
+    for (const start of starts) {
+        if (!graph.nodes.has(start.id) || parent.has(start.id))
+            continue;
+        parent.set(start.id, `workspace:${start.workspace}`);
+        queue.push(start.id);
+    }
+    for (let head = 0; head < queue.length; head += 1) {
+        const id = queue[head];
+        for (const dep of graph.nodes.get(id)?.deps ?? []) {
+            if (parent.has(dep) || !graph.nodes.has(dep))
+                continue;
+            parent.set(dep, id);
+            queue.push(dep);
+        }
+    }
+    return parent;
+}
+const label = (graph, id) => {
+    const node = graph.nodes.get(id);
+    return node ? `${node.name}@${node.version}` : id;
+};
+/** Every locked package the predicate accepts, with how the project comes to have it. */
+export function findOccurrences(graph, matches) {
+    const hits = [...graph.nodes.values()].filter((node) => matches(node.name, node.version));
+    if (hits.length === 0)
+        return [];
+    const prod = reach(graph, graph.roots.flatMap((root) => root.prod.map((id) => ({ id, workspace: root.workspace }))));
+    const dev = reach(graph, graph.roots.flatMap((root) => root.dev.map((id) => ({ id, workspace: root.workspace }))));
+    const dependentsOf = new Map();
+    for (const node of graph.nodes.values()) {
+        for (const dep of node.deps) {
+            const list = dependentsOf.get(dep) ?? [];
+            list.push(node.id);
+            dependentsOf.set(dep, list);
+        }
+    }
+    const chain = (parents, id) => {
+        const hops = [];
+        let current = id;
+        // The graph is finite and `parents` is a BFS tree, but bound the walk anyway.
+        for (let guard = 0; current !== undefined && guard <= graph.nodes.size; guard += 1) {
+            if (current.startsWith("workspace:") && !graph.nodes.has(current)) {
+                hops.push(current.slice("workspace:".length));
+                break;
+            }
+            hops.push(label(graph, current));
+            current = parents.get(current);
+        }
+        return hops.toReversed();
+    };
+    const found = [];
+    for (const node of hits) {
+        const scope = prod.has(node.id)
+            ? "production"
+            : dev.has(node.id)
+                ? "development"
+                : "unreferenced";
+        const workspaces = graph.roots
+            .filter((root) => root.prod.includes(node.id) || root.dev.includes(node.id))
+            .map((root) => root.workspace);
+        const occurrence = {
+            name: node.name,
+            version: node.version,
+            nodeId: node.id,
+            direct: workspaces.length > 0,
+            scope,
+            workspaces,
+            via: scope === "production"
+                ? chain(prod, node.id)
+                : scope === "development"
+                    ? chain(dev, node.id)
+                    : [],
+            dependents: (dependentsOf.get(node.id) ?? []).slice(0, 5).map((id) => label(graph, id)),
+        };
+        if (node.installScript)
+            occurrence.installScript = true;
+        else if (graph.recordsInstallScripts)
+            occurrence.installScript = false;
+        found.push(occurrence);
+    }
+    return found.toSorted((a, b) => a.name.localeCompare(b.name) ||
+        semver.compare(semver.coerce(a.version) ?? "0.0.0", semver.coerce(b.version) ?? "0.0.0"));
+}
+/** Predicate for "this package, in this range" (prereleases count). */
+export function inRange(packageName, range) {
+    return (name, version) => name === packageName &&
+        semver.valid(version) !== null &&
+        semver.satisfies(version, range, { includePrerelease: true });
+}
+/** Every distinct locked version of a package. */
+export function versionsOfPackage(graph, packageName) {
+    return [
+        ...new Set([...graph.nodes.values()]
+            .filter((node) => node.name === packageName)
+            .map((node) => node.version)),
+    ];
+}
+//# sourceMappingURL=index.js.map

package/dist/scanner/lock-graph/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scanner/lock-graph/index.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAqC,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG1D;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,OAAe,EACf,QAAuB;IAEvB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAoBD,6FAA6F;AAC7F,SAAS,KAAK,CACZ,KAAgB,EAChB,MAAgD;IAEhD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,SAAS;QACjE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,KAAgB,EAAE,EAAU,EAAU,EAAE;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC,CAAC;AAEF,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAC7B,KAAgB,EAChB,OAAmD;IAEnD,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,IAAI,GAAG,KAAK,CAChB,KAAK,EACL,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAC1F,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,CACf,KAAK,EACL,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CACzF,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,OAA4B,EAAE,EAAU,EAAY,EAAE;QACnE,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,OAAO,GAAuB,EAAE,CAAC;QACrC,8EAA8E;QAC9E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,OAAO,KAAK,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACnF,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9C,MAAM;YACR,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACjC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChB,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,cAAc,CAAC;QACrB,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK;aAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aAC3E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,UAAU,GAAsB;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;YAC7B,KAAK;YACL,UAAU;YACV,GAAG,EACD,KAAK,KAAK,YAAY;gBACpB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBACtB,CAAC,CAAC,KAAK,KAAK,aAAa;oBACvB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;oBACrB,CAAC,CAAC,EAAE;YACV,UAAU,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;SACxF,CAAC;QACF,IAAI,IAAI,CAAC,aAAa;YAAE,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC;aACnD,IAAI,KAAK,CAAC,qBAAqB;YAAE,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC;QACvE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CACnB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAC3F,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,OAAO,CACrB,WAAmB,EACnB,KAAa;IAEb,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CACvB,IAAI,KAAK,WAAW;QACpB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;QAC9B,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,iBAAiB,CAAC,KAAgB,EAAE,WAAmB;IACrE,OAAO;QACL,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aACtB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC;aAC3C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAC/B;KACF,CAAC;AACJ,CAAC"}

package/dist/scanner/lock-graph/npm.d.ts

@@ -0,0 +1,4 @@
+import { type LockGraph, type ManifestDeps } from "./types.js";
+/** Parse `package-lock.json` / `npm-shrinkwrap.json` (lockfile versions 1, 2 and 3). */
+export declare function parseNpmLock(content: string, manifest?: ManifestDeps): LockGraph;
+//# sourceMappingURL=npm.d.ts.map

package/dist/scanner/lock-graph/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../../src/scanner/lock-graph/npm.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,SAAS,EAGd,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AA0EpB,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,YAAiB,GAAG,SAAS,CAwEpF"}

package/dist/scanner/lock-graph/npm.js

@@ -0,0 +1,119 @@
+import { isRecord, stringMap, } from "./types.js";
+const keysOf = (value) => Object.keys(stringMap(value));
+/** v2 and v3 lockfiles: a flat `packages` map keyed by install path. */
+function fromPackages(packages) {
+    const entries = new Map();
+    for (const [key, raw] of Object.entries(packages)) {
+        if (!isRecord(raw))
+            continue;
+        entries.set(key, {
+            ...(typeof raw["name"] === "string" ? { name: raw["name"] } : {}),
+            ...(typeof raw["version"] === "string" ? { version: raw["version"] } : {}),
+            ...(raw["link"] === true ? { link: true } : {}),
+            ...(typeof raw["resolved"] === "string" ? { resolved: raw["resolved"] } : {}),
+            ...(raw["hasInstallScript"] === true ? { hasInstallScript: true } : {}),
+            dependencies: [...keysOf(raw["dependencies"]), ...keysOf(raw["optionalDependencies"])],
+            peerDependencies: keysOf(raw["peerDependencies"]),
+            devDependencies: keysOf(raw["devDependencies"]),
+        });
+    }
+    return entries;
+}
+/** v1 lockfiles: a nested `dependencies` tree; flattened into the v2 path-keyed shape. */
+function fromNestedTree(tree, prefix = "", out = new Map()) {
+    for (const [name, raw] of Object.entries(tree)) {
+        if (!isRecord(raw))
+            continue;
+        const key = `${prefix}node_modules/${name}`;
+        out.set(key, {
+            ...(typeof raw["version"] === "string" ? { version: raw["version"] } : {}),
+            dependencies: keysOf(raw["requires"]),
+            peerDependencies: [],
+            devDependencies: [],
+        });
+        if (isRecord(raw["dependencies"]))
+            fromNestedTree(raw["dependencies"], `${key}/`, out);
+    }
+    return out;
+}
+function nameFromKey(key) {
+    const marker = "node_modules/";
+    const at = key.lastIndexOf(marker);
+    return at === -1 ? key : key.slice(at + marker.length);
+}
+/** Where Node looks, in order, for a dependency of the package installed at `from`. */
+function searchLocations(from) {
+    const locations = [from];
+    let location = from;
+    while (location !== "") {
+        const at = location.lastIndexOf("/node_modules/");
+        // A top-level install or a workspace directory is enclosed by the project root.
+        location = at === -1 ? "" : location.slice(0, at);
+        locations.push(location);
+    }
+    return locations;
+}
+/** Parse `package-lock.json` / `npm-shrinkwrap.json` (lockfile versions 1, 2 and 3). */
+export function parseNpmLock(content, manifest = {}) {
+    const data = JSON.parse(content);
+    if (!isRecord(data))
+        throw new Error("package-lock.json is not a JSON object");
+    const entries = isRecord(data["packages"])
+        ? fromPackages(data["packages"])
+        : isRecord(data["dependencies"])
+            ? fromNestedTree(data["dependencies"])
+            : new Map();
+    const resolve = (from, name) => {
+        for (const location of searchLocations(from)) {
+            const candidate = location === "" ? `node_modules/${name}` : `${location}/node_modules/${name}`;
+            const hit = entries.get(candidate);
+            if (!hit)
+                continue;
+            // A workspace package is installed as a link to its source directory.
+            return hit.link && hit.resolved !== undefined && entries.has(hit.resolved)
+                ? hit.resolved
+                : candidate;
+        }
+        return undefined;
+    };
+    const nodes = new Map();
+    for (const [key, entry] of entries) {
+        if (key === "" || entry.link || entry.version === undefined)
+            continue;
+        const deps = new Set();
+        for (const dep of [...entry.dependencies, ...entry.peerDependencies]) {
+            const target = resolve(key, dep);
+            if (target !== undefined)
+                deps.add(target);
+        }
+        nodes.set(key, {
+            id: key,
+            name: entry.name ?? nameFromKey(key),
+            version: entry.version,
+            deps: [...deps],
+            ...(entry.hasInstallScript ? { installScript: true } : {}),
+        });
+    }
+    const rootOf = (workspace, location, prod, dev) => ({
+        workspace,
+        prod: prod.flatMap((name) => resolve(location, name) ?? []),
+        dev: dev.flatMap((name) => resolve(location, name) ?? []),
+    });
+    const rootEntry = entries.get("");
+    const roots = [
+        rootEntry
+            ? rootOf(".", "", rootEntry.dependencies, rootEntry.devDependencies)
+            : // Lockfile v1 does not record what the project itself asks for.
+                rootOf(".", "", [
+                    ...Object.keys(manifest.dependencies ?? {}),
+                    ...Object.keys(manifest.optionalDependencies ?? {}),
+                ], Object.keys(manifest.devDependencies ?? {})),
+    ];
+    for (const [key, entry] of entries) {
+        if (key === "" || entry.link || key.includes("node_modules/"))
+            continue;
+        roots.push(rootOf(key, key, entry.dependencies, entry.devDependencies));
+    }
+    return { format: "npm", nodes, roots, recordsInstallScripts: isRecord(data["packages"]) };
+}
+//# sourceMappingURL=npm.js.map

package/dist/scanner/lock-graph/npm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.js","sourceRoot":"","sources":["../../../src/scanner/lock-graph/npm.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,SAAS,GAKV,MAAM,YAAY,CAAC;AAcpB,MAAM,MAAM,GAAG,CAAC,KAAc,EAAY,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAE3E,wEAAwE;AACxE,SAAS,YAAY,CAAC,QAAiC;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;YACf,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACtF,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACjD,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0FAA0F;AAC1F,SAAS,cAAc,CACrB,IAA6B,EAC7B,MAAM,GAAG,EAAE,EACX,GAAG,GAAG,IAAI,GAAG,EAAoB;IAEjC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,GAAG,MAAM,gBAAgB,IAAI,EAAE,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;YACX,GAAG,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrC,gBAAgB,EAAE,EAAE;YACpB,eAAe,EAAE,EAAE;SACpB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAAE,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,MAAM,GAAG,eAAe,CAAC;IAC/B,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,uFAAuF;AACvF,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,OAAO,QAAQ,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAClD,gFAAgF;QAChF,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAQ,GAAiB,EAAE;IACvE,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAE/E,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC9B,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACtC,CAAC,CAAC,IAAI,GAAG,EAAoB,CAAC;IAElC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE;QACjE,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,SAAS,GACb,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,iBAAiB,IAAI,EAAE,CAAC;YAChF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,sEAAsE;YACtE,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACxE,CAAC,CAAC,GAAG,CAAC,QAAQ;gBACd,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,GAAG,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YACb,EAAE,EAAE,GAAG;YACP,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,CACb,SAAiB,EACjB,QAAgB,EAChB,IAAc,EACd,GAAa,EACH,EAAE,CAAC,CAAC;QACd,SAAS;QACT,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3D,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;KAC1D,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,KAAK,GAAe;QACxB,SAAS;YACP,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,eAAe,CAAC;YACpE,CAAC,CAAC,gEAAgE;gBAChE,MAAM,CACJ,GAAG,EACH,EAAE,EACF;oBACE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;oBAC3C,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,EAAE,CAAC;iBACpD,EACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAC5C;KACN,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,GAAG,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,SAAS;QACxE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;AAC5F,CAAC"}

package/dist/scanner/lock-graph/pnpm.d.ts

@@ -0,0 +1,4 @@
+import { type LockGraph } from "./types.js";
+/** Parse `pnpm-lock.yaml` (lockfile versions 5 to 9). */
+export declare function parsePnpmLock(content: string): LockGraph;
+//# sourceMappingURL=pnpm.d.ts.map

package/dist/scanner/lock-graph/pnpm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.d.ts","sourceRoot":"","sources":["../../../src/scanner/lock-graph/pnpm.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,KAAK,SAAS,EAAgC,MAAM,YAAY,CAAC;AAoCpF,yDAAyD;AACzD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAoExD"}

package/dist/scanner/lock-graph/pnpm.js

@@ -0,0 +1,101 @@
+import { parsePnpmLockDocument } from "../pnpm-lock-document.js";
+import { isRecord } from "./types.js";
+/** `{ name: ref }` of a dependency table; the ref is a string (v5, snapshots) or `{ specifier, version }` (importers). */
+function refsOf(table) {
+    if (!isRecord(table))
+        return [];
+    const refs = [];
+    for (const [name, value] of Object.entries(table)) {
+        const ref = isRecord(value) ? value["version"] : value;
+        if (typeof ref === "string")
+            refs.push([name, ref]);
+        else if (typeof ref === "number")
+            refs.push([name, String(ref)]);
+    }
+    return refs;
+}
+/** `name` and `version` out of a package key in any lockfile generation. */
+function parseKey(key, generation) {
+    const bare = key.startsWith("/") ? key.slice(1) : key;
+    if (generation < 6) {
+        // v5: `name/version[_peers]`, with a scope taking two segments.
+        const segments = bare.split("/");
+        const nameLength = bare.startsWith("@") ? 2 : 1;
+        const version = segments[nameLength]?.split("_")[0];
+        return version ? { name: segments.slice(0, nameLength).join("/"), version } : undefined;
+    }
+    // v6, v9: `name@version(peers)`.
+    const paren = bare.indexOf("(");
+    const core = paren === -1 ? bare : bare.slice(0, paren);
+    const at = core.lastIndexOf("@");
+    return at > 0 ? { name: core.slice(0, at), version: core.slice(at + 1) } : undefined;
+}
+const resolveAll = (resolveRef, entries) => entries.flatMap(([name, ref]) => resolveRef(name, ref) ?? []);
+/** Parse `pnpm-lock.yaml` (lockfile versions 5 to 9). */
+export function parsePnpmLock(content) {
+    const data = parsePnpmLockDocument(content);
+    if (!isRecord(data))
+        throw new Error("pnpm-lock.yaml is not a YAML mapping");
+    const declared = data["lockfileVersion"];
+    const generation = typeof declared === "number" || typeof declared === "string"
+        ? Math.trunc(Number.parseFloat(String(declared)))
+        : 9;
+    const packages = isRecord(data["packages"]) ? data["packages"] : {};
+    const snapshots = isRecord(data["snapshots"]) ? data["snapshots"] : {};
+    // From v9 the graph lives in `snapshots` and per-package facts in `packages`; before, in `packages`.
+    const table = Object.keys(snapshots).length > 0 ? snapshots : packages;
+    const resolveRef = (name, ref) => {
+        if (/^(?:link|file|workspace|portal):/.test(ref))
+            return undefined;
+        return [`${name}@${ref}`, `/${name}@${ref}`, `/${name}/${ref}`, ref, `/${ref}`].find((key) => Object.hasOwn(table, key));
+    };
+    const nodes = new Map();
+    for (const [key, raw] of Object.entries(table)) {
+        const entry = isRecord(raw) ? raw : {};
+        const parsed = parseKey(key, generation);
+        const paren = key.indexOf("(");
+        const info = packages[key] ?? packages[paren === -1 ? key : key.slice(0, paren)];
+        const facts = isRecord(info) ? info : {};
+        const name = typeof facts["name"] === "string" ? facts["name"] : parsed?.name;
+        const version = typeof facts["version"] === "string" ? facts["version"] : parsed?.version;
+        if (!name || !version)
+            continue;
+        const deps = new Set();
+        for (const [depName, ref] of [
+            ...refsOf(entry["dependencies"]),
+            ...refsOf(entry["optionalDependencies"]),
+        ]) {
+            const target = resolveRef(depName, ref);
+            if (target !== undefined)
+                deps.add(target);
+        }
+        nodes.set(key, {
+            id: key,
+            name,
+            version,
+            deps: [...deps],
+            ...(facts["requiresBuild"] === true || entry["requiresBuild"] === true
+                ? { installScript: true }
+                : {}),
+        });
+    }
+    const importers = isRecord(data["importers"])
+        ? data["importers"]
+        : { ".": data };
+    const roots = Object.entries(importers).flatMap(([workspace, raw]) => {
+        if (!isRecord(raw))
+            return [];
+        return [
+            {
+                workspace,
+                prod: resolveAll(resolveRef, [
+                    ...refsOf(raw["dependencies"]),
+                    ...refsOf(raw["optionalDependencies"]),
+                ]),
+                dev: resolveAll(resolveRef, refsOf(raw["devDependencies"])),
+            },
+        ];
+    });
+    return { format: "pnpm", nodes, roots, recordsInstallScripts: true };
+}
+//# sourceMappingURL=pnpm.js.map

package/dist/scanner/lock-graph/pnpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm.js","sourceRoot":"","sources":["../../../src/scanner/lock-graph/pnpm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAgD,MAAM,YAAY,CAAC;AAEpF,0HAA0H;AAC1H,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACvD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;aAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,GAAW,EAAE,UAAkB;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;IACD,iCAAiC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,GAAG,CACjB,UAA6D,EAC7D,OAAgC,EACtB,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAE7E,yDAAyD;AACzD,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAY,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACzC,MAAM,UAAU,GACd,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAC1D,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC,CAAC;IACR,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,qGAAqG;IACrG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEvE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,GAAW,EAAsB,EAAE;QACnE,IAAI,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACnE,OAAO,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3F,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAC1B,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;QAC9E,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC;QAC1F,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS;QAEhC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI;YAC3B,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAChC,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;SACzC,EAAE,CAAC;YACF,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxC,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YACb,EAAE,EAAE,GAAG;YACP,IAAI;YACJ,OAAO;YACP,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,IAAI;gBACpE,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE;gBACzB,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAA4B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACnB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAClB,MAAM,KAAK,GAAe,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE;QAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9B,OAAO;YACL;gBACE,SAAS;gBACT,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC3B,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;oBAC9B,GAAG,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;iBACvC,CAAC;gBACF,GAAG,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;aAC5D;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC"}

package/dist/scanner/lock-graph/types.d.ts

@@ -0,0 +1,44 @@
+/**
+ * A lockfile read as a dependency graph: which package versions are locked, who depends on whom,
+ * and which of them the project's manifests ask for. Built from the text of the lockfile alone, so
+ * it works on a checkout without `node_modules` and on a lockfile read from git history.
+ */
+export type LockFormat = "npm" | "pnpm" | "yarn" | "bun";
+export interface LockNode {
+    /** Unique within the graph. */
+    id: string;
+    name: string;
+    version: string;
+    /** Ids of the nodes this one depends on. */
+    deps: string[];
+    /** The lockfile says installing this package runs scripts (npm `hasInstallScript`, pnpm `requiresBuild`). */
+    installScript?: boolean;
+}
+/** The dependencies one workspace (the project itself, or a workspace package) asks for. */
+export interface LockRoot {
+    /** `.` for the project itself, else the workspace path or name. */
+    workspace: string;
+    /** Node ids of dependencies and optional dependencies. */
+    prod: string[];
+    /** Node ids of devDependencies. */
+    dev: string[];
+}
+export interface LockGraph {
+    format: LockFormat;
+    nodes: Map<string, LockNode>;
+    roots: LockRoot[];
+    /** The format marks every package whose install runs scripts, so a node without the flag does not. */
+    recordsInstallScripts: boolean;
+}
+/** The parts of `package.json` the graph needs when the lockfile does not record them. */
+export interface ManifestDeps {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+}
+export declare const LOCKFILE_NAMES: readonly ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"];
+export declare function lockFormatOf(path: string): LockFormat | undefined;
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;
+/** String-valued entries of an object; anything else is dropped. */
+export declare function stringMap(value: unknown): Record<string, string>;
+//# sourceMappingURL=types.d.ts.map

package/dist/scanner/lock-graph/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/scanner/lock-graph/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;AAEzD,MAAM,WAAW,QAAQ;IACvB,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6GAA6G;IAC7G,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mCAAmC;IACnC,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,sGAAsG;IACtG,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED,0FAA0F;AAC1F,MAAM,WAAW,YAAY;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C;AAED,eAAO,MAAM,cAAc,YACzB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,UAAU,CACF,CAAC;AAEX,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAOjE;AAED,eAAO,MAAM,QAAQ,UAAW,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CACH,CAAC;AAEvE,oEAAoE;AACpE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOhE"}