autoremediator 0.21.2 → 0.22.0

package/dist/scanner/lock-graph/types.js

@@ -0,0 +1,32 @@
+export const LOCKFILE_NAMES = [
+    "package-lock.json",
+    "npm-shrinkwrap.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "bun.lock",
+];
+export function lockFormatOf(path) {
+    const name = path.slice(path.lastIndexOf("/") + 1);
+    if (name === "package-lock.json" || name === "npm-shrinkwrap.json")
+        return "npm";
+    if (name === "pnpm-lock.yaml")
+        return "pnpm";
+    if (name === "yarn.lock")
+        return "yarn";
+    if (name === "bun.lock")
+        return "bun";
+    return undefined;
+}
+export const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** String-valued entries of an object; anything else is dropped. */
+export function stringMap(value) {
+    if (!isRecord(value))
+        return {};
+    const result = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (typeof entry === "string")
+            result[key] = entry;
+    }
+    return result;
+}
+//# sourceMappingURL=types.js.map

package/dist/scanner/lock-graph/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/scanner/lock-graph/types.ts"],"names":[],"mappings":"AA2CA,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,mBAAmB;IACnB,qBAAqB;IACrB,gBAAgB;IAChB,WAAW;IACX,UAAU;CACF,CAAC;AAEX,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,KAAK,CAAC;IACjF,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAC7C,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAC3E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/scanner/lock-graph/yarn.d.ts

@@ -0,0 +1,4 @@
+import type { LockGraph, ManifestDeps } from "./types.js";
+/** Parse `yarn.lock`, classic (v1) or berry. Roots come from the manifest, which the lockfile does not record. */
+export declare function parseYarnLock(content: string, manifest?: ManifestDeps): LockGraph;
+//# sourceMappingURL=yarn.d.ts.map

package/dist/scanner/lock-graph/yarn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yarn.d.ts","sourceRoot":"","sources":["../../../src/scanner/lock-graph/yarn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAsB,YAAY,EAAE,MAAM,YAAY,CAAC;AA2F9E,kHAAkH;AAClH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,YAAiB,GAAG,SAAS,CAmDrF"}

package/dist/scanner/lock-graph/yarn.js

@@ -0,0 +1,132 @@
+const unquote = (text) => {
+    const trimmed = text.trim();
+    return trimmed.length >= 2 && trimmed.startsWith('"') && trimmed.endsWith('"')
+        ? trimmed.slice(1, -1)
+        : trimmed;
+};
+/** `name@range` descriptors out of a block header, classic (`a@1, "b@2":`) or berry (`"a@npm:1, b@npm:2":`). */
+function descriptorsOf(header) {
+    const body = header.endsWith(":") ? header.slice(0, -1) : header;
+    // Descriptors never contain quotes or commas themselves, so both can be dropped wholesale.
+    return body
+        .replaceAll('"', "")
+        .split(",")
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+}
+/** The package name of a descriptor: everything before the `@` that starts the range. */
+function nameOfDescriptor(descriptor) {
+    const at = descriptor.indexOf("@", 1);
+    return at > 0 ? descriptor.slice(0, at) : undefined;
+}
+/**
+ * The package a block installs. Berry records it in `resolution:` (`bar@npm:1.0.0`). Classic has only
+ * descriptors, where an alias reads `foo@npm:bar@^1.0.0`: the name is the part after `npm:`, so the
+ * real package (`bar`) is the node and `foo`, which exists only in this project's manifest, is not.
+ */
+function installedName(block) {
+    if (block.resolution) {
+        const fromResolution = nameOfDescriptor(block.resolution);
+        if (fromResolution)
+            return fromResolution;
+    }
+    const first = block.descriptors[0];
+    if (first === undefined)
+        return undefined;
+    const declared = nameOfDescriptor(first);
+    if (declared === undefined)
+        return undefined;
+    const range = first.slice(declared.length + 1);
+    if (range.startsWith("npm:"))
+        return nameOfDescriptor(range.slice(4)) ?? declared;
+    return declared;
+}
+function parseBlocks(content) {
+    const blocks = [];
+    let current;
+    let section;
+    for (const raw of content.split(/\r?\n/)) {
+        if (raw.trim() === "" || raw.startsWith("#"))
+            continue;
+        if (!raw.startsWith(" ")) {
+            current = raw.startsWith("__metadata")
+                ? undefined
+                : { descriptors: descriptorsOf(raw.trim()), dependencies: [], requiresBuild: false };
+            if (current)
+                blocks.push(current);
+            section = undefined;
+            continue;
+        }
+        if (!current)
+            continue;
+        const indent = raw.length - raw.trimStart().length;
+        const line = raw.trim();
+        if (indent <= 2) {
+            section = /^(?:dependencies|optionalDependencies):?$/.test(line) ? "dependencies" : "other";
+            const version = /^version:?\s+"?([^"\s]+)"?$/.exec(line);
+            if (version?.[1])
+                current.version = version[1];
+            const resolution = /^resolution:\s+"?([^"\s]+)"?$/.exec(line);
+            if (resolution?.[1])
+                current.resolution = resolution[1];
+            if (/^requiresBuild:\s*true$/.test(line))
+                current.requiresBuild = true;
+            continue;
+        }
+        if (section === "dependencies") {
+            // classic: `name "range"` or `name range`; berry: `name: range` or `"name": "range"`.
+            const match = /^("[^"]+"|[^\s:]+):?\s+(.+)$/.exec(line);
+            if (match?.[1] && match[2])
+                current.dependencies.push([unquote(match[1]), unquote(match[2])]);
+        }
+    }
+    return blocks;
+}
+/** Parse `yarn.lock`, classic (v1) or berry. Roots come from the manifest, which the lockfile does not record. */
+export function parseYarnLock(content, manifest = {}) {
+    const blocks = parseBlocks(content);
+    const byDescriptor = new Map();
+    const nodes = new Map();
+    const pending = [];
+    for (const block of blocks) {
+        const name = installedName(block);
+        // Berry lists the workspaces themselves as entries; they are not installed packages.
+        if (!name ||
+            block.version === undefined ||
+            block.descriptors.some((descriptor) => descriptor.includes("@workspace:"))) {
+            continue;
+        }
+        const id = `${name}@${block.version}`;
+        for (const descriptor of block.descriptors)
+            byDescriptor.set(descriptor, id);
+        if (!nodes.has(id)) {
+            nodes.set(id, {
+                id,
+                name,
+                version: block.version,
+                deps: [],
+                ...(block.requiresBuild ? { installScript: true } : {}),
+            });
+        }
+        pending.push({ id, deps: block.dependencies });
+    }
+    const resolve = (name, range) => byDescriptor.get(`${name}@${range}`) ?? byDescriptor.get(`${name}@npm:${range}`);
+    for (const { id, deps } of pending) {
+        const node = nodes.get(id);
+        const targets = new Set(node.deps);
+        for (const [name, range] of deps) {
+            const target = resolve(name, range);
+            if (target !== undefined)
+                targets.add(target);
+        }
+        node.deps = [...targets];
+    }
+    const resolveAll = (table) => Object.entries(table ?? {}).flatMap(([name, range]) => resolve(name, range) ?? []);
+    const root = {
+        workspace: ".",
+        prod: [...resolveAll(manifest.dependencies), ...resolveAll(manifest.optionalDependencies)],
+        dev: resolveAll(manifest.devDependencies),
+    };
+    return { format: "yarn", nodes, roots: [root], recordsInstallScripts: false };
+}
+//# sourceMappingURL=yarn.js.map

package/dist/scanner/lock-graph/yarn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yarn.js","sourceRoot":"","sources":["../../../src/scanner/lock-graph/yarn.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC5E,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC,CAAC,OAAO,CAAC;AACd,CAAC,CAAC;AAEF,gHAAgH;AAChH,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,2FAA2F;IAC3F,OAAO,IAAI;SACR,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,yFAAyF;AACzF,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAY;IACjC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IAClF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,OAA0B,CAAC;IAC/B,IAAI,OAA6C,CAAC;IAElD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;gBACpC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;YACvF,IAAI,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,GAAG,SAAS,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YAChB,OAAO,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5F,MAAM,OAAO,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACxD,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YAC/B,sFAAsF;YACtF,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,QAAQ,GAAiB,EAAE;IACxE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,MAAM,OAAO,GAAyD,EAAE,CAAC;IAEzE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,qFAAqF;QACrF,IACE,CAAC,IAAI;YACL,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAC1E,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACtC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW;YAAE,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE;gBACZ,EAAE;gBACF,IAAI;gBACJ,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,EAAE;gBACR,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,KAAa,EAAsB,EAAE,CAClE,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC;IAEnF,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,KAAyC,EAAY,EAAE,CACzE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAa;QACrB,SAAS,EAAE,GAAG;QACd,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAC1F,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;KAC1C,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;AAChF,CAAC"}

package/dist/scanner/lockfile-diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile-diff.d.ts","sourceRoot":"","sources":["../../src/scanner/lockfile-diff.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CA+G1B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,qBAAqB,EAAE,CA8DzB"}
+{"version":3,"file":"lockfile-diff.d.ts","sourceRoot":"","sources":["../../src/scanner/lockfile-diff.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGlE;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CA+G1B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,qBAAqB,EAAE,CA8DzB"}

package/dist/scanner/lockfile-diff.js

@@ -1,5 +1,5 @@
 import semver from "semver";
-import YAML from "yaml";
+import { parsePnpmLockDocument } from "./pnpm-lock-document.js";
 /**
  * Extracts a map of package names to their resolved versions from a lockfile content.
  */
@@ -52,7 +52,7 @@ export function parseLockfileDependencies(filename, content) {
     }
     else if (filename.endsWith("pnpm-lock.yaml")) {
         try {
-            const data = YAML.parse(content);
+            const data = parsePnpmLockDocument(content);
             if (data?.packages && typeof data.packages === "object") {
                 for (const [key, val] of Object.entries(data.packages)) {
                     let rawKey = key.replace(/^\//, "");

package/dist/scanner/lockfile-diff.js.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile-diff.js","sourceRoot":"","sources":["../../src/scanner/lockfile-diff.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,IAAI,MAAM,MAAM,CAAC;AAIxB;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,OAAe;IAEf,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE9C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,GAAY,EAAE,EAAE;QACzC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI,GAAG,CAAC;QACzE,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACvD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;wBAAE,SAAS;oBACpE,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;oBAC7C,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;wBACf,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;wBACxD,MAAM,GAAG,GAAI,GAA4B,CAAC,OAAO,CAAC;wBAClD,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC/D,MAAM,QAAQ,GAAG,CAAC,IAA6B,EAAE,EAAE;oBACjD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;4BAAE,SAAS;wBAChD,MAAM,MAAM,GAAG,IAAoE,CAAC;wBACpF,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;wBAC1B,IAAI,MAAM,CAAC,YAAY,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;4BACnE,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;wBAChC,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,QAAQ,CAAC,IAAI,CAAC,YAAuC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAG9B,CAAC;YACF,IAAI,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACxD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvD,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;wBACpB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;oBACvC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;wBACf,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBAClD,MAAM,OAAO,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;wBACzD,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,IAAI,EAAE,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9C,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;wBACpB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;oBACvC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;wBACf,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBACrC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;wBACzC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAS;YACzD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,eAAe,GAAG,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;gBACzF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;wBACf,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvD,IAAI,KAAK,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACrB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;wBAClC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAChB,CAAC;oBACD,eAAe,GAAG,EAAE,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,UAAyB,EACzB,UAAyB;IAEzB,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU;QACxB,CAAC,CAAC,yBAAyB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjD,CAAC,CAAC,IAAI,GAAG,EAAuB,CAAC;IACnC,MAAM,OAAO,GAAG,UAAU;QACxB,CAAC,CAAC,yBAAyB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjD,CAAC,CAAC,IAAI,GAAG,EAAuB,CAAC;IAEnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEhE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QAE9C,kCAAkC;QAClC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACvB,OAAO,CAAC,IAAI,CAAC;wBACX,WAAW,EAAE,GAAG;wBAChB,UAAU,EAAE,OAAO;wBACnB,UAAU,EAAE,IAAI;wBAChB,cAAc,EAAE,YAAY;wBAC5B,YAAY,EAAE,QAAQ;qBACvB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC;oBAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;oBAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;oBACpE,MAAM,SAAS,GACb,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;wBACtE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;wBAC/B,CAAC,CAAC,IAAI,CAAC;oBAEX,OAAO,CAAC,IAAI,CAAC;wBACX,WAAW,EAAE,GAAG;wBAChB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;wBACjD,UAAU,EAAE,QAAQ;wBACpB,UAAU,EAAE,IAAI;wBAChB,cAAc,EAAE,YAAY;wBAC5B,YAAY,EAAE,QAAQ;qBACvB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC;oBACX,WAAW,EAAE,GAAG;oBAChB,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,IAAI;oBAChB,cAAc,EAAE,YAAY;oBAC5B,YAAY,EAAE,QAAQ;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"lockfile-diff.js","sourceRoot":"","sources":["../../src/scanner/lockfile-diff.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,OAAe;IAEf,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE9C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,GAAY,EAAE,EAAE;QACzC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,IAAI,GAAG,CAAC;QACzE,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC,CAAC;IAEF,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACvD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;wBAAE,SAAS;oBACpE,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;oBAC7C,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;wBACf,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;wBACxD,MAAM,GAAG,GAAI,GAA4B,CAAC,OAAO,CAAC;wBAClD,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC/D,MAAM,QAAQ,GAAG,CAAC,IAA6B,EAAE,EAAE;oBACjD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;4BAAE,SAAS;wBAChD,MAAM,MAAM,GAAG,IAAoE,CAAC;wBACpF,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;wBAC1B,IAAI,MAAM,CAAC,YAAY,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;4BACnE,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;wBAChC,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,QAAQ,CAAC,IAAI,CAAC,YAAuC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAGzC,CAAC;YACF,IAAI,IAAI,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACxD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvD,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;wBACpB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;oBACvC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;wBACf,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBAClD,MAAM,OAAO,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;wBACzD,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,IAAI,EAAE,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9C,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;wBACpB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;oBACvC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;wBACf,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;wBACrC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;wBACzC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;QAC5B,CAAC;IACH,CAAC;SAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,eAAe,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAS;YACzD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,eAAe,GAAG,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;gBACzF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;wBACf,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvD,IAAI,KAAK,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACrB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;wBAClC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAChB,CAAC;oBACD,eAAe,GAAG,EAAE,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,UAAyB,EACzB,UAAyB;IAEzB,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU;QACxB,CAAC,CAAC,yBAAyB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjD,CAAC,CAAC,IAAI,GAAG,EAAuB,CAAC;IACnC,MAAM,OAAO,GAAG,UAAU;QACxB,CAAC,CAAC,yBAAyB,CAAC,QAAQ,EAAE,UAAU,CAAC;QACjD,CAAC,CAAC,IAAI,GAAG,EAAuB,CAAC;IAEnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEhE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QAE9C,kCAAkC;QAClC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACvB,OAAO,CAAC,IAAI,CAAC;wBACX,WAAW,EAAE,GAAG;wBAChB,UAAU,EAAE,OAAO;wBACnB,UAAU,EAAE,IAAI;wBAChB,cAAc,EAAE,YAAY;wBAC5B,YAAY,EAAE,QAAQ;qBACvB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC;oBAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;oBAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;oBACpE,MAAM,SAAS,GACb,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;wBACtE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;wBAC/B,CAAC,CAAC,IAAI,CAAC;oBAEX,OAAO,CAAC,IAAI,CAAC;wBACX,WAAW,EAAE,GAAG;wBAChB,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;wBACjD,UAAU,EAAE,QAAQ;wBACpB,UAAU,EAAE,IAAI;wBAChB,cAAc,EAAE,YAAY;wBAC5B,YAAY,EAAE,QAAQ;qBACvB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC;oBACX,WAAW,EAAE,GAAG;oBAChB,UAAU,EAAE,SAAS;oBACrB,UAAU,EAAE,IAAI;oBAChB,cAAc,EAAE,YAAY;oBAC5B,YAAY,EAAE,QAAQ;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/scanner/pnpm-lock-document.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The project's lockfile content from a `pnpm-lock.yaml`. pnpm 11 and later write TWO YAML
+ * documents: a short leading one for pnpm itself (`packageManagerDependencies`), then the project's.
+ * Parsing the file as a single document throws on that, so every document is parsed and the last
+ * one that looks like a lockfile is used. Older, single-document files come out unchanged.
+ */
+export declare function parsePnpmLockDocument(content: string): unknown;
+//# sourceMappingURL=pnpm-lock-document.d.ts.map

package/dist/scanner/pnpm-lock-document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm-lock-document.d.ts","sourceRoot":"","sources":["../../src/scanner/pnpm-lock-document.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ9D"}

package/dist/scanner/pnpm-lock-document.js

@@ -0,0 +1,15 @@
+import YAML from "yaml";
+/**
+ * The project's lockfile content from a `pnpm-lock.yaml`. pnpm 11 and later write TWO YAML
+ * documents: a short leading one for pnpm itself (`packageManagerDependencies`), then the project's.
+ * Parsing the file as a single document throws on that, so every document is parsed and the last
+ * one that looks like a lockfile is used. Older, single-document files come out unchanged.
+ */
+export function parsePnpmLockDocument(content) {
+    const documents = YAML.parseAllDocuments(content)
+        .filter((document) => document.errors.length === 0)
+        .map((document) => document.toJS());
+    const lockfiles = documents.filter((value) => value !== null && typeof value === "object" && "lockfileVersion" in value);
+    return lockfiles.at(-1) ?? documents.at(-1);
+}
+//# sourceMappingURL=pnpm-lock-document.js.map

package/dist/scanner/pnpm-lock-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pnpm-lock-document.js","sourceRoot":"","sources":["../../src/scanner/pnpm-lock-document.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;SAC9C,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;SAClD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAa,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAChC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,IAAI,KAAK,CACrF,CAAC;IACF,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/trace/esm-instrument.d.ts

@@ -0,0 +1,26 @@
+/** Which exports of a module are visible through a re-export from an entry, and under what names. */
+export interface ReexportSelection {
+    /** `export * from`: every export is visible. */
+    all: boolean;
+    /** Exported name in the target to the names other modules re-export it as. */
+    names: Map<string, Set<string>>;
+}
+export interface InstrumentResult {
+    /** The source with counting appended, or undefined when nothing could be counted. */
+    source?: string;
+    wrapped: string[];
+    unwrapped: Record<string, string>;
+    /** Relative modules this one re-exports from, which are instrumented in turn. */
+    reexports: Map<string, ReexportSelection>;
+}
+/**
+ * Work out what to count in one ES module.
+ *
+ * `visible` limits counting to the exports an importer can reach: undefined for an entry module
+ * (every export), or the selection a re-exporting module made for a module reached through one.
+ * `globalKey` names the runtime registry the appended code calls (`wrap(fn, names, packageKey)`).
+ */
+export declare function instrumentEsModule(filename: string, source: string, visible: ReexportSelection | undefined, registry: string, packageKey: string): InstrumentResult;
+/** The file a `file:` URL names, or undefined for other schemes. */
+export declare function filePathOf(url: string): string | undefined;
+//# sourceMappingURL=esm-instrument.d.ts.map

package/dist/trace/esm-instrument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"esm-instrument.d.ts","sourceRoot":"","sources":["../../src/trace/esm-instrument.ts"],"names":[],"mappings":"AAgBA,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,GAAG,EAAE,OAAO,CAAC;IACb,8EAA8E;IAC9E,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,iFAAiF;IACjF,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC3C;AAkFD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,GAAG,SAAS,EACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,gBAAgB,CA8DlB;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO1D"}

package/dist/trace/esm-instrument.js

@@ -0,0 +1,153 @@
+/**
+ * Call counting for native ES modules.
+ *
+ * An ES module's exports are live bindings that nothing outside the module can replace, so the only
+ * way to count calls is to rewrite the binding from inside. After the module has evaluated, this
+ * appends `name = wrap(name)` for each exported function or class declaration, so every importer
+ * (and the module's own internal callers) get the counting wrapper. The original source is left
+ * as is, so line numbers and source maps are unchanged.
+ *
+ * Bindings that cannot be reassigned (`const`, anonymous default exports, imported bindings) are
+ * reported as not counted instead of being rewritten.
+ */
+import { createRequire } from "node:module";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+let parseSync;
+/** oxc-parser loads on first use, so processes that never instrument an ES module do not pay for it. */
+function parse(filename, source) {
+    parseSync ??= createRequire(import.meta.url)("oxc-parser").parseSync;
+    return parseSync(filename, source);
+}
+/** Top-level declarations by local name, which tells a reassignable binding from a `const`. */
+function topLevelDeclarations(body) {
+    const locals = new Map();
+    const declare = (node) => {
+        if (!node)
+            return;
+        if (node.type === "FunctionDeclaration" || node.type === "ClassDeclaration") {
+            const id = node.id;
+            if (id?.name)
+                locals.set(id.name, node.type === "FunctionDeclaration" ? "function" : "class");
+        }
+        else if (node.type === "VariableDeclaration") {
+            const kind = node.kind;
+            const declarations = node.declarations;
+            for (const declarator of declarations) {
+                // Destructuring patterns are not tracked: their bindings fall through as unknown locals.
+                if (declarator.id.type === "Identifier" && declarator.id.name) {
+                    locals.set(declarator.id.name, kind === "const" || kind === "using" ? "const" : kind);
+                }
+            }
+        }
+    };
+    for (const node of body) {
+        if (node.type === "ExportNamedDeclaration" || node.type === "ExportDefaultDeclaration") {
+            declare(node.declaration);
+        }
+        else {
+            declare(node);
+        }
+    }
+    return locals;
+}
+function select(reexports, target, importName, alias) {
+    const selection = reexports.get(target) ?? { all: false, names: new Map() };
+    if (importName === undefined) {
+        selection.all = true;
+    }
+    else {
+        const aliases = selection.names.get(importName) ?? new Set();
+        if (alias !== undefined)
+            aliases.add(alias);
+        selection.names.set(importName, aliases);
+    }
+    reexports.set(target, selection);
+}
+/**
+ * Work out what to count in one ES module.
+ *
+ * `visible` limits counting to the exports an importer can reach: undefined for an entry module
+ * (every export), or the selection a re-exporting module made for a module reached through one.
+ * `globalKey` names the runtime registry the appended code calls (`wrap(fn, names, packageKey)`).
+ */
+export function instrumentEsModule(filename, source, visible, registry, packageKey) {
+    const result = { wrapped: [], unwrapped: {}, reexports: new Map() };
+    const parsed = parse(filename, source);
+    if (parsed.errors.length > 0) {
+        result.unwrapped["*"] = "source-could-not-be-parsed";
+        return result;
+    }
+    const locals = topLevelDeclarations(parsed.program.body);
+    const statements = [];
+    const wanted = (exportName) => {
+        if (!visible)
+            return [exportName];
+        const aliases = visible.names.get(exportName);
+        if (aliases)
+            return [exportName, ...aliases];
+        return visible.all ? [exportName] : undefined;
+    };
+    for (const statement of parsed.module.staticExports) {
+        for (const entry of statement.entries) {
+            const exportName = entry.exportName.kind === "Default" ? "default" : entry.exportName.name;
+            if (entry.moduleRequest) {
+                const specifier = entry.moduleRequest.value;
+                if (specifier.startsWith(".") || specifier.startsWith("/")) {
+                    const target = resolve(dirname(filename), specifier);
+                    if (entry.importName.kind === "AllButDefault") {
+                        select(result.reexports, target, undefined, undefined);
+                    }
+                    else if (entry.importName.kind === "Name" && entry.importName.name) {
+                        // `export { a as b } from "./x.js"`: counted in x.js under both names.
+                        const exported = exportName ?? entry.importName.name;
+                        select(result.reexports, target, entry.importName.name, exported);
+                    }
+                    else if (entry.importName.kind === "All" && exportName) {
+                        result.unwrapped[exportName] = "namespace-reexport";
+                    }
+                }
+                else if (exportName) {
+                    result.unwrapped[exportName] = "reexport-of-another-package";
+                }
+                continue;
+            }
+            if (!exportName)
+                continue;
+            const names = wanted(exportName);
+            if (!names)
+                continue;
+            const local = entry.localName.name;
+            const kind = local ? locals.get(local) : undefined;
+            if (!local || entry.localName.kind !== "Name") {
+                result.unwrapped[exportName] = "anonymous-or-expression-export";
+            }
+            else if (kind === "const") {
+                result.unwrapped[exportName] = "const-binding";
+            }
+            else if (kind === undefined) {
+                result.unwrapped[exportName] = "binding-is-not-a-top-level-declaration";
+            }
+            else {
+                statements.push(`try{${local}=__ar_trace_registry.wrap(${local},${JSON.stringify(names)},${JSON.stringify(packageKey)})}catch{}`);
+                result.wrapped.push(...names);
+            }
+        }
+    }
+    if (statements.length > 0) {
+        result.source = `${source}\n;{const __ar_trace_registry=globalThis[Symbol.for(${JSON.stringify(registry)})];if(__ar_trace_registry){${statements.join(";")}}}\n`;
+    }
+    return result;
+}
+/** The file a `file:` URL names, or undefined for other schemes. */
+export function filePathOf(url) {
+    if (!url.startsWith("file:"))
+        return undefined;
+    try {
+        return fileURLToPath(url);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=esm-instrument.js.map

package/dist/trace/esm-instrument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"esm-instrument.js","sourceRoot":"","sources":["../../src/trace/esm-instrument.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAwCzC,IAAI,SAA8B,CAAC;AAEnC,wGAAwG;AACxG,SAAS,KAAK,CAAC,QAAgB,EAAE,MAAc;IAC7C,SAAS,KAAM,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,CAA4B,CAAC,SAAS,CAAC;IACjG,OAAO,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAID,+FAA+F;AAC/F,SAAS,oBAAoB,CAAC,IAAe;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,IAAyB,EAAQ,EAAE;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,EAA8B,CAAC;YAC/C,IAAI,EAAE,EAAE,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAChG,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;YACjC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAyD,CAAC;YACpF,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;gBACtC,yFAAyF;gBACzF,IAAI,UAAU,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBAC9D,MAAM,CAAC,GAAG,CACR,UAAU,CAAC,EAAE,CAAC,IAAI,EAClB,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,IAAkB,CACrE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,IAAI,KAAK,wBAAwB,IAAI,IAAI,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC,WAAkC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CACb,SAAyC,EACzC,MAAc,EACd,UAA8B,EAC9B,KAAyB;IAEzB,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAC5E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACrE,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,MAAc,EACd,OAAsC,EACtC,QAAgB,EAChB,UAAkB;IAElB,MAAM,MAAM,GAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACtF,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,4BAA4B,CAAC;QACrD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAwB,EAAE;QAC1D,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,OAAO;YAAE,OAAO,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAC3F,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC;gBAC5C,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;oBACrD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;wBAC9C,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;oBACzD,CAAC;yBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;wBACrE,uEAAuE;wBACvE,MAAM,QAAQ,GAAG,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;wBACrD,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;oBACpE,CAAC;yBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,KAAK,IAAI,UAAU,EAAE,CAAC;wBACzD,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,oBAAoB,CAAC;oBACtD,CAAC;gBACH,CAAC;qBAAM,IAAI,UAAU,EAAE,CAAC;oBACtB,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,6BAA6B,CAAC;gBAC/D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC9C,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,gCAAgC,CAAC;YAClE,CAAC;iBAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC;YACjD,CAAC;iBAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,wCAAwC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CACb,OAAO,KAAK,6BAA6B,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CACjH,CAAC;gBACF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,uDAAuD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,8BAA8B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;IACnK,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/trace/fold.d.ts

@@ -0,0 +1,24 @@
+import { type TraceRecord, type TraceReport } from "./types.js";
+/** Parse JSONL text into records; lines that are not trace records are counted, not fatal. */
+export declare function parseTraceLines(text: string): {
+    records: TraceRecord[];
+    skipped: number;
+};
+/**
+ * Merge records from any number of processes into one report. Folding is order-independent: sets
+ * are unioned and call counts (written as deltas) are summed, so appending from several processes
+ * to one file, or folding two files together, gives the same result.
+ */
+export declare function foldTraceRecords(records: readonly TraceRecord[], extras?: {
+    skipped?: number;
+    command?: TraceReport["command"];
+    createdAt?: string;
+}): TraceReport;
+/** Fold raw JSONL text (what the hook writes). */
+export declare function foldTraceText(text: string, command?: TraceReport["command"]): TraceReport;
+/**
+ * Read a trace from disk: either the folded JSON that `traceRun` writes or the raw JSONL the hook
+ * appends. Throws with the path when the file is missing or is neither.
+ */
+export declare function readTraceFile(path: string): TraceReport;
+//# sourceMappingURL=fold.d.ts.map

package/dist/trace/fold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fold.d.ts","sourceRoot":"","sources":["../../src/trace/fold.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAapB,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAczF;AAaD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,MAAM,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACtF,WAAW,CAgGb;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,WAAW,CAGzF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAyBvD"}