fad-checker 1.0.6 → 2.0.1

package/lib/codecs/codec.interface.js

@@ -0,0 +1,27 @@
+/**
+ * lib/codecs/codec.interface.js — contrat que tout codec doit respecter.
+ *
+ * Pas de classe imposée : un codec est un objet litéral exportant ces clés.
+ * Voir docs/superpowers/specs/2026-05-29-codecs-multi-ecosystem-design.md.
+ */
+const REQUIRED_KEYS = [
+	"id", "label", "osvEcosystem", "manifestNames",
+	"detect", "collect", "coordKey", "formatCoord", "osvPackageName",
+	"checkRegistry", "resolveEolProduct", "recipe", "nativeScanners",
+];
+const FUNCTION_KEYS = ["detect", "collect", "coordKey", "formatCoord", "osvPackageName", "checkRegistry", "resolveEolProduct"];
+
+function assertCodecShape(codec) {
+	if (!codec || typeof codec !== "object") throw new Error("codec must be an object");
+	for (const k of REQUIRED_KEYS) {
+		if (!(k in codec)) throw new Error(`codec "${codec.id || "?"}" missing required key: ${k}`);
+	}
+	for (const k of FUNCTION_KEYS) {
+		if (typeof codec[k] !== "function") throw new Error(`codec "${codec.id}" key ${k} must be a function`);
+	}
+	if (!Array.isArray(codec.manifestNames)) throw new Error(`codec "${codec.id}" manifestNames must be an array`);
+	if (!Array.isArray(codec.nativeScanners)) throw new Error(`codec "${codec.id}" nativeScanners must be an array`);
+	return true;
+}
+
+module.exports = { REQUIRED_KEYS, FUNCTION_KEYS, assertCodecShape };

package/lib/codecs/composer/parse.js

@@ -0,0 +1,59 @@
+/**
+ * lib/composer/parse.js — parse PHP Composer manifests.
+ *
+ *   composer.lock — { packages: [{name, version}], "packages-dev": [...] }
+ *                   versions are concrete (resolved) — the ideal source.
+ *   composer.json — { require: {name: range}, "require-dev": {...} }
+ *                   used only as a no-lock fallback (pinned exact versions).
+ *
+ * Composer names are "vendor/package", case-insensitive (lowercased by convention).
+ */
+const fs = require("fs");
+
+// "1.2.3" | "v1.2.3" | "dev-main" | "1.0.x-dev". Strip a leading "v" for OSV/registry.
+function normVersion(v) {
+	if (!v) return null;
+	return String(v).replace(/^v/, "");
+}
+function isConcrete(v) {
+	if (!v) return false;
+	return /^\d+(\.\d+)*([.\-+]\S+)?$/.test(String(v).replace(/^v/, ""));
+}
+function splitName(full) {
+	const i = full.indexOf("/");
+	if (i < 0) return { vendor: "", pkg: full };
+	return { vendor: full.slice(0, i), pkg: full.slice(i + 1) };
+}
+
+function parseComposerLock(filePath) {
+	const json = JSON.parse(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	const push = (arr, scope) => {
+		for (const p of arr || []) {
+			if (!p.name) continue;
+			const { vendor, pkg } = splitName(p.name);
+			deps.push({ name: p.name, vendor, pkg, version: normVersion(p.version), scope, isDev: scope === "dev" });
+		}
+	};
+	push(json.packages, "prod");
+	push(json["packages-dev"], "dev");
+	return { manifestPath: filePath, manifestType: "composer.lock", deps };
+}
+
+function parseComposerJson(filePath) {
+	const json = JSON.parse(fs.readFileSync(filePath, "utf8"));
+	const deps = [];
+	const push = (obj, scope) => {
+		for (const [name, version] of Object.entries(obj || {})) {
+			// Platform requirements aren't packages.
+			if (name === "php" || name.startsWith("ext-") || name.startsWith("lib-")) continue;
+			const { vendor, pkg } = splitName(name);
+			deps.push({ name, vendor, pkg, version: String(version), scope, isDev: scope === "dev" });
+		}
+	};
+	push(json.require, "prod");
+	push(json["require-dev"], "dev");
+	return { manifestPath: filePath, manifestType: "composer.json", deps };
+}
+
+module.exports = { parseComposerLock, parseComposerJson, normVersion, isConcrete, splitName };

package/lib/codecs/composer/registry.js

@@ -0,0 +1,92 @@
+/**
+ * lib/composer/registry.js — query Packagist for a package's latest stable
+ * version and its `abandoned` flag (≈ npm `deprecated`).
+ *
+ * API: https://packagist.org/packages/{vendor}/{pkg}.json
+ *   → { package: { abandoned: bool|string, versions: { "<v>": {...} } } }
+ *
+ * Cached in ~/.fad-checker/packagist-cache.json for 24h.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+let pLimit; try { pLimit = require("p-limit"); } catch { pLimit = () => (fn) => fn(); }
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-checker");
+const CACHE_PATH = path.join(CACHE_DIR, "packagist-cache.json");
+const CACHE_MAX_AGE_MS = 24 * 3600 * 1000;
+const API = "https://packagist.org/packages";
+
+function loadCache() { try { return JSON.parse(fs.readFileSync(CACHE_PATH, "utf8")); } catch { return { entries: {}, meta: {} }; } }
+function saveCache(d) { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); fs.writeFileSync(CACHE_PATH, JSON.stringify(d)); } catch { /* ignore */ } }
+
+function isStable(v) { return /^\d+(\.\d+)*$/.test(String(v || "").replace(/^v/, "")); }
+function cmp(a, b) {
+	const pa = String(a).replace(/^v/, "").split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	const pb = String(b).replace(/^v/, "").split(/[.\-+]/).map(n => parseInt(n, 10) || 0);
+	for (let i = 0; i < Math.max(pa.length, pb.length); i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0 ? 1 : -1; }
+	return 0;
+}
+
+// Extract {abandoned, outdated} from a Packagist `package` object.
+function packagistToFindings(pkg, { version }) {
+	const out = { abandoned: null, outdated: null };
+	if (pkg.abandoned === true) out.abandoned = { replacement: null };
+	else if (typeof pkg.abandoned === "string") out.abandoned = { replacement: pkg.abandoned };
+	const stable = Object.keys(pkg.versions || {}).map(v => v.replace(/^v/, "")).filter(isStable);
+	if (stable.length) {
+		const latest = stable.sort(cmp).at(-1);
+		if (latest && cmp(latest, String(version).replace(/^v/, "")) > 0) out.outdated = { latest };
+	}
+	return out;
+}
+
+async function fetchPackage(name, { offline }) {
+	if (offline) return null;
+	try {
+		const res = await fetch(`${API}/${name}.json`, { headers: { "User-Agent": "fad-checker-packagist" } });
+		if (!res.ok) return { error: `HTTP ${res.status}` };
+		const json = await res.json();
+		return json.package || { error: "no package field" };
+	} catch (e) { return { error: e.message }; }
+}
+
+// Mirror of checkNpmRegistryDeps: returns { deprecated:[], outdated:[] }.
+async function checkComposerRegistryDeps(deps, opts = {}) {
+	const { verbose, offline, allLibs = true, concurrency = 8 } = opts;
+	const targets = [...deps.values()].filter(d => d.ecosystem === "composer" && d.version);
+	const result = { deprecated: [], outdated: [] };
+	if (!targets.length) return result;
+	const cache = loadCache();
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+	const limit = pLimit(concurrency);
+	await Promise.all(targets.map(t => limit(async () => {
+		const name = `${t.namespace}/${t.name}`.toLowerCase();
+		const key = `${name}@${t.version}`;
+		let ex = cache.entries[key];
+		if (!ex) {
+			const pkg = await fetchPackage(name, { offline });
+			if (pkg && !pkg.error) {
+				const f = packagistToFindings(pkg, { version: t.version });
+				ex = { abandoned: f.abandoned, latest: f.outdated?.latest || null };
+				cache.entries[key] = ex;
+			} else {
+				ex = { abandoned: null, latest: null };
+			}
+		}
+		if (ex.abandoned) {
+			result.deprecated.push({ dep: t, severity: "MEDIUM", replacement: ex.abandoned.replacement, reason: "Package marked abandoned on Packagist", source: "packagist" });
+			if (verbose) process.stdout.write(`  abandoned: ${name}@${t.version}\n`);
+		}
+		if (allLibs && ex.latest) {
+			result.outdated.push({ dep: t, latest: ex.latest, releaseDate: null });
+			if (verbose) process.stdout.write(`  outdated: ${name} ${t.version} → ${ex.latest}\n`);
+		}
+	})));
+	cache.meta = { fetchedAt: Date.now() };
+	saveCache(cache);
+	return result;
+}
+
+module.exports = { packagistToFindings, checkComposerRegistryDeps };

package/lib/codecs/composer.codec.js

@@ -0,0 +1,93 @@
+/**
+ * lib/codecs/composer.codec.js — codec PHP/Composer.
+ *
+ * Vuln scanning is OSV (ecosystem "Packagist", wired in Plan A). This codec adds
+ * collection (composer.lock, composer.json fallback), Packagist registry
+ * (abandoned + outdated), and EOL via endoflife.date.
+ */
+const fs = require("fs");
+const path = require("path");
+const { makeDepRecord, coordKeyFor } = require("../dep-record");
+const { parseComposerLock, parseComposerJson, isConcrete } = require("./composer/parse");
+
+const SKIP = new Set(["vendor", ".git", ".idea", ".vscode", "node_modules", "dist", "build", "out", "target"]);
+
+function findComposerManifests(dir) {
+	const groups = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries; try { entries = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
+		const names = new Set(entries.filter(e => e.isFile()).map(e => e.name));
+		if (names.has("composer.json") || names.has("composer.lock")) {
+			groups.push({
+				dir: cur,
+				composerJson: names.has("composer.json") ? path.join(cur, "composer.json") : null,
+				composerLock: names.has("composer.lock") ? path.join(cur, "composer.lock") : null,
+			});
+		}
+		for (const e of entries) if (e.isDirectory() && !SKIP.has(e.name)) stack.push(path.join(cur, e.name));
+	}
+	return groups;
+}
+
+module.exports = {
+	id: "composer",
+	label: "Composer",
+	osvEcosystem: "Packagist",
+	manifestNames: ["composer.json", "composer.lock"],
+
+	detect(dir) { return findComposerManifests(dir).length > 0; },
+
+	async collect(dir, opts = {}) {
+		const { ignoreTest, deps2Exclude } = opts;
+		const out = new Map();
+		const warnings = [];
+		for (const g of findComposerManifests(dir)) {
+			if (g.composerLock) {
+				let parsed;
+				try { parsed = parseComposerLock(g.composerLock); }
+				catch (e) { warnings.push({ type: "parse-error", manifestPath: g.composerLock, message: `composer.lock parse failed: ${e.message}` }); continue; }
+				const { deps } = parsed;
+				for (const d of deps) {
+					if (ignoreTest && d.isDev) continue;
+					if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+					out.set(coordKeyFor("composer", d.vendor, d.pkg),
+						makeDepRecord({ ecosystem: "composer", namespace: d.vendor, name: d.pkg, version: d.version, manifestPath: g.composerLock, scope: d.scope, isDev: d.isDev }));
+				}
+			} else if (g.composerJson) {
+				// No lockfile → best-effort: pinned exact versions only + warning.
+				let parsed;
+				try { parsed = parseComposerJson(g.composerJson); }
+				catch (e) { warnings.push({ type: "parse-error", manifestPath: g.composerJson, message: `composer.json parse failed: ${e.message}` }); continue; }
+				const { deps } = parsed;
+				let pinned = 0, ranges = 0;
+				for (const d of deps) {
+					if (ignoreTest && d.isDev) continue;
+					if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+					if (isConcrete(d.version)) {
+						out.set(coordKeyFor("composer", d.vendor, d.pkg),
+							makeDepRecord({ ecosystem: "composer", namespace: d.vendor, name: d.pkg, version: String(d.version).replace(/^v/, ""), manifestPath: g.composerJson, scope: d.scope, isDev: d.isDev }));
+						pinned++;
+					} else {
+						ranges++;
+					}
+				}
+				warnings.push({ type: "no-lockfile", manifestPath: g.composerJson, message: `composer.json without composer.lock — best-effort: ${pinned} pinned, ${ranges} range(s) skipped (run "composer install")` });
+			}
+		}
+		return { deps: out, warnings };
+	},
+
+	coordKey(d) { return coordKeyFor("composer", d.namespace || "", d.name); },
+	formatCoord(d) { return `${d.namespace || ""}/${d.name}`; },
+	osvPackageName(d) { return `${d.namespace || ""}/${d.name}`; },
+
+	async checkRegistry(deps, opts = {}) {
+		const { checkComposerRegistryDeps } = require("./composer/registry");
+		return checkComposerRegistryDeps(deps, opts);
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+	recipe: require("./recipes").composer,
+	nativeScanners: [],
+};

package/lib/codecs/index.js

@@ -0,0 +1,37 @@
+/**
+ * lib/codecs/index.js — registre des codecs.
+ *
+ * getCodec(id)      → le codec, ou null
+ * allCodecs()       → tous les codecs enregistrés, dans l'ordre report stable
+ * detectCodecs(dir) → les codecs dont detect() est vrai sur ce répertoire
+ */
+const { assertCodecShape } = require("./codec.interface");
+const maven = require("./maven.codec");
+const npm = require("./npm.codec");
+const yarn = require("./yarn.codec");
+const composer = require("./composer.codec");
+const pypi = require("./pypi.codec");
+const nuget = require("./nuget.codec");
+
+// Ordre stable pour le report (maven, npm, yarn, puis les nouveaux écosystèmes).
+const ORDER = ["maven", "npm", "yarn", "nuget", "composer", "pypi"];
+
+const REGISTRY = new Map();
+for (const c of [maven, npm, yarn, composer, pypi, nuget]) {
+	assertCodecShape(c);
+	REGISTRY.set(c.id, c);
+}
+
+function getCodec(id) { return REGISTRY.get(id) || null; }
+
+function allCodecs() {
+	return [...REGISTRY.values()].sort((a, b) => ORDER.indexOf(a.id) - ORDER.indexOf(b.id));
+}
+
+// yarn est détecté via le même arbre JS que npm ; on ne le renvoie pas en
+// doublon de détection (npm.collect ramasse déjà yarn.lock).
+function detectCodecs(dir) {
+	return allCodecs().filter(c => c.id !== "yarn" && c.detect(dir));
+}
+
+module.exports = { getCodec, allCodecs, detectCodecs, ORDER };

package/lib/codecs/maven.codec.js

@@ -0,0 +1,71 @@
+/**
+ * lib/codecs/maven.codec.js — codec Maven.
+ *
+ * N'INTRODUIT AUCUNE LOGIQUE NOUVELLE : enveloppe la résolution POM/BOM de
+ * lib/core.js (parse, parent, merge multi-profils, dependencyManagement, imports
+ * scope=import), le collecteur lib/cve-match.js, le walker transitif
+ * lib/transitive.js et le scanner natif CVE-index (cvelistV5).
+ */
+const core = require("../core");
+const { collectResolvedDeps, expandWithTransitives, matchDepsAgainstCves } = require("../cve-match");
+const { coordKeyFor } = require("../dep-record");
+
+// Scanner natif : CVE-index local cvelistV5. scan(deps,opts) → {matches, meta}.
+const cveIndexScanner = {
+	id: "cve-index",
+	kind: "cve",   // résultats → chapitre CVE (mergés avec OSV)
+	async scan(deps, opts = {}) {
+		const { ensureCveIndex } = require("../cve-download");
+		const idx = await ensureCveIndex({
+			force: !!opts.cveRefresh && !opts.offline,
+			offline: !!opts.cveOffline || !!opts.offline,
+			verbose: opts.verbose,
+		});
+		return { matches: matchDepsAgainstCves(deps, idx), meta: { cveDataDate: idx?.meta?.builtAt || null } };
+	},
+};
+
+module.exports = {
+	id: "maven",
+	label: "Maven",
+	osvEcosystem: "Maven",
+	manifestNames: ["pom.xml"],
+
+	detect(dir) { return core.findPomFiles(dir).length > 0; },
+
+	// collect enveloppe parse + inheritance + collectResolvedDeps existants.
+	// Expose _maven (store/propsByPom/pomFiles) pour que l'orchestrateur garde la
+	// phase de réécriture des POM nettoyés (lib/core.rewritePoms).
+	async collect(dir, opts = {}) {
+		const pomFiles = core.findPomFiles(dir);
+		const store = core.newMetadataStore();
+		const propsByPom = {};
+		for (const pom of pomFiles) {
+			try { await core.parsePom(pom, store); } catch { /* logged by orchestrator */ }
+		}
+		for (const pom of Object.keys(store.byPath)) {
+			try { await core.getAllInheritedProps(pom, store, propsByPom); } catch { /* logged */ }
+		}
+		const deps = collectResolvedDeps(store, propsByPom, { ignoreTest: opts.ignoreTest, deps2Exclude: opts.deps2Exclude });
+		return { deps, warnings: [], _maven: { store, propsByPom, pomFiles } };
+	},
+
+	coordKey(d) { return coordKeyFor("maven", d.namespace || d.groupId, d.name || d.artifactId); },
+	formatCoord(d) { return `${d.namespace || d.groupId}:${d.name || d.artifactId}`; },
+	osvPackageName(d) { return `${d.namespace || d.groupId}:${d.name || d.artifactId}`; },
+
+	async checkRegistry(deps, opts = {}) {
+		const outdated = require("../outdated");
+		const out = opts.allLibs ? await outdated.checkOutdatedDeps(deps, opts) : [];
+		const deprecated = outdated.checkObsoleteDeps(deps);
+		return { outdated: out, deprecated };
+	},
+	resolveEolProduct(d) { return require("../outdated").findEolProduct(d); },
+
+	recipe: require("./recipes").maven,
+
+	nativeScanners: [cveIndexScanner],
+
+	// Exposé pour l'orchestrateur (étape transitive, --transitive).
+	expandTransitives: expandWithTransitives,
+};

package/lib/{npm → codecs/npm}/collect.js

@@ -16,7 +16,8 @@
  */
 const path = require("path");
 const fs = require("fs");
-const { parsePackageJson, parsePackageLock, parseYarnLockV1, findJsManifests } = require("./parse");
+const { parsePackageJson, parsePackageLock, parseYarnLockV1, parsePnpmLock, findJsManifests } = require("./parse");
+const { makeDepRecord } = require("../../dep-record");
 
 const SCOPE_RANK = { prod: 4, peer: 3, optional: 2, dev: 1, transitive: 0 };
 
@@ -55,30 +56,30 @@ function upsert(out, dep, manifestPath, lockType) {
 	const ecosystemType = (lockType || "").startsWith("package-lock") ? "npm"
 		: (lockType || "").startsWith("yarn") ? "yarn"
 		: "npm";
-	const record = {
-		groupId: "",
-		artifactId: dep.name,
+	const record = makeDepRecord({
+		ecosystem: "npm",
+		ecosystemType,
+		namespace: "",
+		name: dep.name,
 		version: dep.version || null,
+		manifestPath,
 		scope: dep.scope || "prod",
 		isDev: !!dep.isDev,
-		pomPaths: [manifestPath],
-		manifestPaths: [manifestPath],
-		ecosystem: "npm",
-		ecosystemType,
-		lockType,
-		depth: dep.depth ?? null,
-		resolved: dep.resolved || null,
-		integrity: dep.integrity || null,
-		from: dep.from || null,
-	};
+	});
+	// npm-specific extras (not part of the shared depRecord contract)
+	record.lockType = lockType;
+	record.depth = dep.depth ?? null;
+	record.resolved = dep.resolved || null;
+	record.integrity = dep.integrity || null;
+	record.from = dep.from || null;
 	if (!existing) {
 		out.set(key, record);
 		return;
 	}
-	// Merge
+	// Merge. NB: pomPaths shares the manifestPaths array reference (makeDepRecord),
+	// so we push once — pushing to both would duplicate the entry.
 	if (!existing.manifestPaths.includes(manifestPath)) {
 		existing.manifestPaths.push(manifestPath);
-		existing.pomPaths.push(manifestPath);
 	}
 	// Prefer the resolved (lockfile) version over a range from package.json
 	const incoming = record.version;
@@ -132,27 +133,41 @@ function collectNpmDeps(rootDir, opts = {}) {
 		const pj = group.packageJson ? safeParse(parsePackageJson, group.packageJson, verbose) : null;
 		const pl = group.packageLock ? safeParse(parsePackageLock, group.packageLock, verbose) : null;
 		const yl = group.yarnLock ? safeParse(parseYarnLockV1, group.yarnLock, verbose) : null;
-		const hasLock = !!(pl || yl);
+		const pn = group.pnpmLock ? safeParse(parsePnpmLock, group.pnpmLock, verbose) : null;
+		const hasLock = !!(pl || yl || pn);
 
-		// package.json without lockfile → warning, skip dep collection.
+		// package.json without lockfile → best-effort fallback (changed contract):
+		// scan pinned exact versions ("1.2.3"), skip ranges ("^1.0.0"), and warn
+		// that results are partial. Previously this manifest was skipped entirely.
 		if (pj && !hasLock) {
+			let pinned = 0, ranges = 0;
+			for (const d of pj.deps) {
+				if (ignoreTest && (d.scope === "dev" || d.scope === "optional")) continue;
+				if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+				if (isResolvedVersion(d.version)) {
+					upsert(out, { name: d.name, version: d.version, scope: d.scope || "prod", isDev: !!d.isDev }, group.packageJson, "package-json-nolock");
+					pinned++;
+				} else {
+					ranges++;
+				}
+			}
 			warnings.push({
 				type: "no-lockfile",
 				manifestPath: group.packageJson,
 				packageName: pj.packageName || null,
-				message: `package.json without lockfile — skipped (run "npm install" or "yarn install" to generate one)`,
+				message: `package.json without lockfile — best-effort: ${pinned} pinned dep(s) scanned, ${ranges} range(s) skipped (run "npm install" or "yarn install" for full coverage)`,
 			});
-			if (verbose) console.warn(`⚠️  ${group.packageJson}: no lockfile, skipped (${pj.deps.length} ranges in package.json)`);
+			if (verbose) console.warn(`⚠️  ${group.packageJson}: no lockfile — best-effort (${pinned} pinned, ${ranges} ranges skipped)`);
 		}
 
-		// Yarn-Berry lockfile detected but unsupported → warning, skip.
-		if (yl?.unsupported === "yarn-berry") {
+		// Yarn-Berry lockfile that failed to parse → warning (deps still empty).
+		if (yl?.parseError) {
 			warnings.push({
-				type: "yarn-berry-unsupported",
+				type: "parse-error",
 				manifestPath: group.yarnLock,
-				message: `yarn 2+/Berry lockfile not yet supported — skipped`,
+				message: `yarn 2+/Berry lockfile parse failed: ${yl.parseError}`,
 			});
-			if (verbose) console.warn(`⚠️  ${group.yarnLock}: yarn-berry not supported, skipped`);
+			if (verbose) console.warn(`⚠️  ${group.yarnLock}: yarn-berry parse failed — ${yl.parseError}`);
 		}
 
 		// Used only as a source of scope info — never emits deps on its own.
@@ -171,15 +186,23 @@ function collectNpmDeps(rootDir, opts = {}) {
 		}
 		if (yl) {
 			parsedCount++;
-			// yarn-berry warning already pushed above; only emit deps for v1
-			if (yl.unsupported !== "yarn-berry") {
-				for (const d of yl.deps) {
-					const explicit = directScopes?.get(d.name);
-					const scope = explicit || "prod";
-					if (ignoreTest && (scope === "dev" || scope === "optional")) continue;
-					if (deps2Exclude && deps2Exclude.test(d.name)) continue;
-					upsert(out, { ...d, scope }, group.yarnLock, "yarn-v1");
-				}
+			const lockType = yl.lockfileVersion === "berry" ? "yarn-berry" : "yarn-v1";
+			for (const d of yl.deps) {
+				const explicit = directScopes?.get(d.name);
+				const scope = explicit || d.scope || "prod";
+				if (ignoreTest && (scope === "dev" || scope === "optional")) continue;
+				if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+				upsert(out, { ...d, scope }, group.yarnLock, lockType);
+			}
+		}
+		if (pn) {
+			parsedCount++;
+			for (const d of pn.deps) {
+				const explicit = directScopes?.get(d.name);
+				const scope = explicit || d.scope || "prod";
+				if (ignoreTest && (scope === "dev" || scope === "optional")) continue;
+				if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+				upsert(out, { ...d, scope }, group.pnpmLock, "pnpm");
 			}
 		}
 	}
@@ -237,7 +260,7 @@ function hasJsManifests(rootDir) {
 			try { entries = fs.readdirSync(cur, { withFileTypes: true }); }
 			catch { continue; }
 			for (const e of entries) {
-				if (e.isFile() && (e.name === "package.json" || e.name === "package-lock.json" || e.name === "yarn.lock")) return true;
+				if (e.isFile() && (e.name === "package.json" || e.name === "package-lock.json" || e.name === "yarn.lock" || e.name === "pnpm-lock.yaml")) return true;
 				if (e.isDirectory() && !skip.has(e.name)) stack.push(path.join(cur, e.name));
 			}
 		}