flatlock 1.3.0 → 1.5.0

package/dist/parsers/yarn-berry.d.ts

@@ -0,0 +1,197 @@
+/** @typedef {import('./types.js').Dependency} Dependency */
+/**
+ * @typedef {Object} WorkspacePackage
+ * @property {string} name
+ * @property {string} version
+ * @property {Record<string, string>} [dependencies]
+ * @property {Record<string, string>} [devDependencies]
+ * @property {Record<string, string>} [optionalDependencies]
+ * @property {Record<string, string>} [peerDependencies]
+ */
+/**
+ * Extract package name from yarn berry resolution field.
+ *
+ * The resolution field is the CANONICAL identifier and should be used instead of the key.
+ * Keys can contain npm aliases (e.g., "string-width-cjs@npm:string-width@^4.2.0") while
+ * the resolution always contains the actual package name (e.g., "string-width@npm:4.2.3").
+ *
+ * @param {string} resolution - Resolution field from lockfile entry
+ * @returns {string | null} Package name or null if parsing fails
+ *
+ * @example
+ * // Unscoped npm package
+ * parseResolution('lodash@npm:4.17.21')
+ * // => 'lodash'
+ *
+ * @example
+ * // Scoped npm package
+ * parseResolution('@babel/core@npm:7.24.0')
+ * // => '@babel/core'
+ *
+ * @example
+ * // Aliased package - resolution shows the REAL package name
+ * // (key was "string-width-cjs@npm:string-width@^4.2.0")
+ * parseResolution('string-width@npm:4.2.3')
+ * // => 'string-width'
+ *
+ * @example
+ * // Scoped aliased package - resolution shows the REAL package name
+ * // (key was "@babel-baseline/core@npm:@babel/core@7.24.4")
+ * parseResolution('@babel/core@npm:7.24.4')
+ * // => '@babel/core'
+ *
+ * @example
+ * // Patch protocol (nested protocols)
+ * parseResolution('pkg@patch:pkg@npm:1.0.0#./patch')
+ * // => 'pkg'
+ *
+ * @example
+ * // Scoped package with patch protocol
+ * parseResolution('@scope/pkg@patch:@scope/pkg@npm:1.0.0#./fix.patch')
+ * // => '@scope/pkg'
+ *
+ * @example
+ * // Workspace protocol
+ * parseResolution('my-pkg@workspace:packages/my-pkg')
+ * // => 'my-pkg'
+ *
+ * @example
+ * // Scoped workspace package
+ * parseResolution('@myorg/utils@workspace:packages/utils')
+ * // => '@myorg/utils'
+ *
+ * @example
+ * // Git protocol
+ * parseResolution('my-lib@git:github.com/user/repo#commit-hash')
+ * // => 'my-lib'
+ *
+ * @example
+ * // Null/empty input
+ * parseResolution(null)
+ * // => null
+ *
+ * @example
+ * // Empty string
+ * parseResolution('')
+ * // => null
+ *
+ * @example
+ * // Portal protocol (symlink to external package)
+ * parseResolution('@scope/external@portal:../external-pkg')
+ * // => '@scope/external'
+ */
+export function parseResolution(resolution: string): string | null;
+/**
+ * Extract package name from yarn berry key (fallback for when resolution is unavailable).
+ *
+ * WARNING: Keys can contain npm aliases. Prefer parseResolution() when possible.
+ * The key may return an alias name instead of the real package name.
+ *
+ * @param {string} key - Lockfile entry key
+ * @returns {string} Package name (may be alias name, not canonical name)
+ *
+ * @example
+ * // Simple unscoped package
+ * parseLockfileKey('lodash@npm:^4.17.21')
+ * // => 'lodash'
+ *
+ * @example
+ * // Scoped package
+ * parseLockfileKey('@babel/core@npm:^7.24.0')
+ * // => '@babel/core'
+ *
+ * @example
+ * // Multiple version ranges (comma-separated) - takes first entry
+ * parseLockfileKey('@types/node@npm:^18.0.0, @types/node@npm:^20.0.0')
+ * // => '@types/node'
+ *
+ * @example
+ * // npm alias - returns the ALIAS name (not real package)
+ * // Use parseResolution() for the real package name
+ * parseLockfileKey('string-width-cjs@npm:string-width@^4.2.0')
+ * // => 'string-width-cjs'
+ *
+ * @example
+ * // Scoped npm alias
+ * parseLockfileKey('@babel-baseline/core@npm:@babel/core@7.24.4')
+ * // => '@babel-baseline/core'
+ *
+ * @example
+ * // Workspace protocol
+ * parseLockfileKey('my-pkg@workspace:packages/my-pkg')
+ * // => 'my-pkg'
+ *
+ * @example
+ * // Scoped workspace package
+ * parseLockfileKey('@myorg/utils@workspace:.')
+ * // => '@myorg/utils'
+ *
+ * @example
+ * // Portal protocol
+ * parseLockfileKey('external-pkg@portal:../some/path')
+ * // => 'external-pkg'
+ *
+ * @example
+ * // Link protocol
+ * parseLockfileKey('linked-pkg@link:./local')
+ * // => 'linked-pkg'
+ *
+ * @example
+ * // Patch protocol (complex nested format)
+ * parseLockfileKey('pkg@patch:pkg@npm:1.0.0#./patches/fix.patch')
+ * // => 'pkg'
+ *
+ * @example
+ * // Scoped patch
+ * parseLockfileKey('@scope/pkg@patch:@scope/pkg@npm:1.0.0#./fix.patch')
+ * // => '@scope/pkg'
+ *
+ * @example
+ * // File protocol
+ * parseLockfileKey('local-pkg@file:../local-package')
+ * // => 'local-pkg'
+ */
+export function parseLockfileKey(key: string): string;
+/**
+ * Parse yarn.lock v2+ (berry)
+ * @param {string | object} input - Lockfile content string or pre-parsed object
+ * @param {Object} [_options] - Parser options (unused, reserved for future use)
+ * @returns {Generator<Dependency>}
+ */
+export function fromYarnBerryLock(input: string | object, _options?: Object): Generator<Dependency>;
+/**
+ * Extract workspace paths from yarn berry lockfile.
+ *
+ * Yarn berry workspace entries use `@workspace:` protocol in keys.
+ * Keys can have multiple comma-separated descriptors.
+ *
+ * @param {string | object} input - Lockfile content string or pre-parsed object
+ * @returns {string[]} Array of workspace paths (e.g., ['packages/foo', 'packages/bar'])
+ *
+ * @example
+ * extractWorkspacePaths(lockfile)
+ * // => ['packages/babel-core', 'packages/babel-parser', ...]
+ */
+export function extractWorkspacePaths(input: string | object): string[];
+/**
+ * Build workspace packages map by reading package.json files.
+ *
+ * @param {string | object} input - Lockfile content string or pre-parsed object
+ * @param {string} repoDir - Path to repository root
+ * @returns {Promise<Record<string, WorkspacePackage>>} Map of workspace path to package info
+ *
+ * @example
+ * const workspaces = await buildWorkspacePackages(lockfile, '/path/to/repo');
+ * // => { 'packages/foo': { name: '@scope/foo', version: '1.0.0', dependencies: {...} } }
+ */
+export function buildWorkspacePackages(input: string | object, repoDir: string): Promise<Record<string, WorkspacePackage>>;
+export type Dependency = import("./types.js").Dependency;
+export type WorkspacePackage = {
+    name: string;
+    version: string;
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+};
+//# sourceMappingURL=yarn-berry.d.ts.map

package/dist/parsers/yarn-berry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yarn-berry.d.ts","sourceRoot":"","sources":["../../src/parsers/yarn-berry.js"],"names":[],"mappings":"AAIA,4DAA4D;AAE5D;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AACH,4CAjEW,MAAM,GACJ,MAAM,GAAG,IAAI,CA4FzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,sCAhEW,MAAM,GACJ,MAAM,CAiGlB;AAED;;;;;GAKG;AACH,yCAJW,MAAM,GAAG,MAAM,aACf,MAAM,GACJ,SAAS,CAAC,UAAU,CAAC,CAqCjC;AAED;;;;;;;;;;;;GAYG;AACH,6CAPW,MAAM,GAAG,MAAM,GACb,MAAM,EAAE,CA+BpB;AAED;;;;;;;;;;GAUG;AACH,8CARW,MAAM,GAAG,MAAM,WACf,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CA6BrD;yBAjVa,OAAO,YAAY,EAAE,UAAU;;UAI/B,MAAM;aACN,MAAM;mBACN,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;sBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;2BACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;uBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC"}

package/dist/parsers/yarn-classic.d.ts

@@ -0,0 +1,110 @@
+/**
+ * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+ * !! WARNING: DO NOT MODIFY THIS FUNCTION                                   !!
+ * !! AI AGENTS (Claude, Copilot, etc.): DO NOT TOUCH THIS CODE              !!
+ * !!                                                                        !!
+ * !! This is YARN LOCKFILE KEY parsing, NOT npm spec parsing.               !!
+ * !! Yarn lockfile keys have their own format:                              !!
+ * !!   - Multiple comma-separated entries: "pkg@^1.0.0, pkg@^2.0.0"         !!
+ * !!   - npm: aliasing protocol: "alias@npm:actual@^1.0.0"                  !!
+ * !!                                                                        !!
+ * !! npm-package-arg (npa) does NOT understand these formats.               !!
+ * !! Do not "improve" this with npa.                                        !!
+ * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+ *
+ * Extract package name from yarn classic key.
+ *
+ * @param {string} key - Lockfile entry key
+ * @returns {string} Package name
+ *
+ * @example
+ * // Simple unscoped package with semver range
+ * parseLockfileKey('lodash@^4.17.21')
+ * // => 'lodash'
+ *
+ * @example
+ * // Scoped package
+ * parseLockfileKey('@babel/core@^7.0.0')
+ * // => '@babel/core'
+ *
+ * @example
+ * // Multiple version ranges (comma-separated) - takes first entry
+ * parseLockfileKey('lodash@^4.17.21, lodash@^4.0.0')
+ * // => 'lodash'
+ *
+ * @example
+ * // Multiple ranges for scoped package
+ * parseLockfileKey('@types/node@^18.0.0, @types/node@^20.0.0')
+ * // => '@types/node'
+ *
+ * @example
+ * // npm: alias protocol - returns the ALIAS name
+ * parseLockfileKey('@babel/traverse--for-generate-function-map@npm:@babel/traverse@^7.25.3')
+ * // => '@babel/traverse--for-generate-function-map'
+ *
+ * @example
+ * // Unscoped alias
+ * parseLockfileKey('string-width-cjs@npm:string-width@^4.2.0')
+ * // => 'string-width-cjs'
+ *
+ * @example
+ * // Exact version
+ * parseLockfileKey('typescript@5.3.3')
+ * // => 'typescript'
+ *
+ * @example
+ * // Git URL specifier
+ * parseLockfileKey('my-lib@github:user/repo#v1.0.0')
+ * // => 'my-lib'
+ *
+ * @example
+ * // Tarball URL
+ * parseLockfileKey('custom-pkg@https://example.com/pkg.tgz')
+ * // => 'custom-pkg'
+ *
+ * @example
+ * // Package with prerelease version
+ * parseLockfileKey('@next/env@^14.0.0-canary.0')
+ * // => '@next/env'
+ *
+ * @example
+ * // Package without @ (bare name, edge case)
+ * parseLockfileKey('lodash')
+ * // => 'lodash'
+ *
+ * @example
+ * // Deeply scoped alias pointing to scoped package
+ * parseLockfileKey('@myorg/my-alias@npm:@original/package@^1.0.0')
+ * // => '@myorg/my-alias'
+ */
+export function parseLockfileKey(key: string): string;
+/**
+ * Parse yarn.lock v1 (classic)
+ * @param {string | object} input - Lockfile content string or pre-parsed object
+ * @param {Object} [_options] - Parser options (unused, reserved for future use)
+ * @returns {Generator<Dependency>}
+ */
+export function fromYarnClassicLock(input: string | object, _options?: Object): Generator<Dependency>;
+/** @typedef {import('./types.js').Dependency} Dependency */
+/**
+ * @typedef {Object} YarnClassicParseResult
+ * @property {'success' | 'merge' | 'conflict'} type - Parse result type
+ * @property {Record<string, any>} object - Parsed lockfile object
+ */
+/**
+ * The yarn classic parse function (handles CJS/ESM interop)
+ * @type {(content: string) => YarnClassicParseResult}
+ */
+export const parseYarnClassic: (content: string) => YarnClassicParseResult;
+export type Dependency = import("./types.js").Dependency;
+export type YarnClassicParseResult = {
+    /**
+     * - Parse result type
+     */
+    type: "success" | "merge" | "conflict";
+    /**
+     * - Parsed lockfile object
+     */
+    object: Record<string, any>;
+};
+//# sourceMappingURL=yarn-classic.d.ts.map

package/dist/parsers/yarn-classic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yarn-classic.d.ts","sourceRoot":"","sources":["../../src/parsers/yarn-classic.js"],"names":[],"mappings":"AAgBA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,sCA/DW,MAAM,GACJ,MAAM,CA8FlB;AAED;;;;;GAKG;AACH,2CAJW,MAAM,GAAG,MAAM,aACf,MAAM,GACJ,SAAS,CAAC,UAAU,CAAC,CAgCjC;AAnKD,4DAA4D;AAE5D;;;;GAIG;AAEH;;;GAGG;AACH,+BAFU,CAAC,OAAO,EAAE,MAAM,KAAK,sBAAsB,CAE6B;yBAZpE,OAAO,YAAY,EAAE,UAAU;;;;;UAI/B,SAAS,GAAG,OAAO,GAAG,UAAU;;;;YAChC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC"}

package/dist/result.d.ts

@@ -0,0 +1,12 @@
+export function Ok<T>(value: T): OkResult<T>;
+export function Err(error: Error | string): ErrResult;
+export type OkResult<T> = {
+    ok: true;
+    value: T;
+};
+export type ErrResult = {
+    ok: false;
+    error: Error;
+};
+export type Result<T> = OkResult<T> | ErrResult;
+//# sourceMappingURL=result.d.ts.map

package/dist/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../src/result.js"],"names":[],"mappings":"AAwBO,mBAJM,CAAC,SACH,CAAC,GACC,QAAQ,CAAC,CAAC,CAAC,CAEwB;AAOzC,2BAHI,KAAK,GAAG,MAAM,GACZ,SAAS,CAKpB;qBAjCW,CAAC;QAEA,IAAI;WACJ,CAAC;;;QAKD,KAAK;WACL,KAAK;;mBAIN,CAAC,IACD,QAAQ,CAAC,CAAC,CAAC,GAAG,SAAS"}

package/dist/set.d.ts

@@ -0,0 +1,238 @@
+/**
+ * A Set-like container for lockfile dependencies.
+ *
+ * Identity is determined by name@version. Two dependencies with the same
+ * name and version are considered equal, regardless of integrity or resolved URL.
+ *
+ * All set operations return new FlatlockSet instances (immutable pattern).
+ *
+ * NOTE: Set operations (union, intersection, difference) return sets that
+ * cannot use dependenciesOf() because they lack lockfile traversal data.
+ *
+ * @example
+ * const set = await FlatlockSet.fromPath('./package-lock.json');
+ * console.log(set.size); // 1234
+ * console.log(set.has('lodash@4.17.21')); // true
+ *
+ * // Get dependencies for a specific workspace
+ * const pkg = JSON.parse(await readFile('./packages/foo/package.json'));
+ * const subset = await set.dependenciesOf(pkg, { workspacePath: 'packages/foo', repoDir: '.' });
+ *
+ * // Set operations
+ * const other = await FlatlockSet.fromPath('./other-lock.json');
+ * const common = set.intersection(other);
+ */
+export class FlatlockSet {
+    /**
+     * Create FlatlockSet from lockfile path (auto-detect type)
+     * @param {string} path - Path to lockfile
+     * @param {FromStringOptions} [options] - Parser options
+     * @returns {Promise<FlatlockSet>}
+     */
+    static fromPath(path: string, options?: FromStringOptions): Promise<FlatlockSet>;
+    /**
+     * Create FlatlockSet from lockfile string
+     * @param {string} content - Lockfile content
+     * @param {FromStringOptions} [options] - Parser options
+     * @returns {FlatlockSet}
+     */
+    static fromString(content: string, options?: FromStringOptions): FlatlockSet;
+    /**
+     * Parse lockfile once, returning both processed deps and raw data
+     * @param {string} content
+     * @param {LockfileType} type
+     * @param {FromStringOptions} options
+     * @returns {{ deps: Map<string, Dependency>, packages: LockfilePackages, importers: LockfileImporters | null, snapshots: Record<string, any> | null }}
+     */
+    static "__#private@#parseAll"(content: string, type: LockfileType, options: FromStringOptions): {
+        deps: Map<string, Dependency>;
+        packages: LockfilePackages;
+        importers: LockfileImporters | null;
+        snapshots: Record<string, any> | null;
+    };
+    /**
+     * @param {symbol} internal - Must be INTERNAL symbol
+     * @param {Map<string, Dependency>} deps
+     * @param {LockfilePackages | null} packages
+     * @param {LockfileImporters | null} importers
+     * @param {Record<string, any> | null} snapshots
+     * @param {LockfileType | null} type
+     */
+    constructor(internal: symbol, deps: Map<string, Dependency>, packages: LockfilePackages | null, importers: LockfileImporters | null, snapshots: Record<string, any> | null, type: LockfileType | null);
+    /** @returns {number} */
+    get size(): number;
+    /** @returns {LockfileType | null} */
+    get type(): LockfileType | null;
+    /** @returns {boolean} */
+    get canTraverse(): boolean;
+    /**
+     * Get workspace paths from lockfile.
+     * Supports npm, pnpm, and yarn berry lockfiles.
+     * @returns {string[]} Array of workspace paths (e.g., ['packages/foo', 'packages/bar'])
+     */
+    getWorkspacePaths(): string[];
+    /**
+     * Check if a dependency exists
+     * @param {string} nameAtVersion - e.g., "lodash@4.17.21"
+     * @returns {boolean}
+     */
+    has(nameAtVersion: string): boolean;
+    /**
+     * Get a dependency by name@version
+     * @param {string} nameAtVersion
+     * @returns {Dependency | undefined}
+     */
+    get(nameAtVersion: string): Dependency | undefined;
+    /** @returns {IterableIterator<Dependency>} */
+    values(): IterableIterator<Dependency>;
+    /** @returns {IterableIterator<string>} */
+    keys(): IterableIterator<string>;
+    /** @returns {IterableIterator<[string, Dependency]>} */
+    entries(): IterableIterator<[string, Dependency]>;
+    /**
+     * Execute a callback for each dependency
+     * @param {(dep: Dependency, key: string, set: FlatlockSet) => void} callback
+     * @param {any} [thisArg]
+     */
+    forEach(callback: (dep: Dependency, key: string, set: FlatlockSet) => void, thisArg?: any): void;
+    /**
+     * Union of this set with another
+     * @param {FlatlockSet} other
+     * @returns {FlatlockSet}
+     */
+    union(other: FlatlockSet): FlatlockSet;
+    /**
+     * Intersection of this set with another
+     * @param {FlatlockSet} other
+     * @returns {FlatlockSet}
+     */
+    intersection(other: FlatlockSet): FlatlockSet;
+    /**
+     * Difference: elements in this set but not in other
+     * @param {FlatlockSet} other
+     * @returns {FlatlockSet}
+     */
+    difference(other: FlatlockSet): FlatlockSet;
+    /**
+     * Check if this set is a subset of another
+     * @param {FlatlockSet} other
+     * @returns {boolean}
+     */
+    isSubsetOf(other: FlatlockSet): boolean;
+    /**
+     * Check if this set is a superset of another
+     * @param {FlatlockSet} other
+     * @returns {boolean}
+     */
+    isSupersetOf(other: FlatlockSet): boolean;
+    /**
+     * Check if this set has no elements in common with another
+     * @param {FlatlockSet} other
+     * @returns {boolean}
+     */
+    isDisjointFrom(other: FlatlockSet): boolean;
+    /**
+     * Get transitive dependencies of a package.json
+     *
+     * For monorepos, provide workspacePath and repoDir to get correct resolution.
+     * Without workspacePath, assumes root package (hoisted deps only).
+     *
+     * NOTE: This method is only available on sets created directly from
+     * fromPath/fromString. Sets created via union/intersection/difference
+     * cannot use this method (canTraverse will be false).
+     *
+     * @param {PackageJson} packageJson - Parsed package.json
+     * @param {DependenciesOfOptions} [options]
+     * @returns {Promise<FlatlockSet>}
+     * @throws {Error} If called on a set that cannot traverse
+     *
+     * @example
+     * // Simple usage with repoDir (recommended)
+     * const deps = await lockfile.dependenciesOf(pkg, {
+     *   workspacePath: 'packages/foo',
+     *   repoDir: '/path/to/repo'
+     * });
+     */
+    dependenciesOf(packageJson: PackageJson, options?: DependenciesOfOptions): Promise<FlatlockSet>;
+    /**
+     * Convert to array
+     * @returns {Dependency[]}
+     */
+    toArray(): Dependency[];
+    /** @returns {IterableIterator<Dependency>} */
+    [Symbol.iterator](): IterableIterator<Dependency>;
+    #private;
+}
+export type Dependency = import("./parsers/npm.js").Dependency;
+export type LockfileType = import("./detect.js").LockfileType;
+export type WorkspacePackage = {
+    /**
+     * - Package name (e.g., '@vue/shared')
+     */
+    name: string;
+    /**
+     * - Package version (e.g., '3.5.26')
+     */
+    version: string;
+    /**
+     * - Production dependencies (for yarn berry workspace traversal)
+     */
+    dependencies?: Record<string, string>;
+    /**
+     * - Dev dependencies
+     */
+    devDependencies?: Record<string, string>;
+    /**
+     * - Optional dependencies
+     */
+    optionalDependencies?: Record<string, string>;
+    /**
+     * - Peer dependencies
+     */
+    peerDependencies?: Record<string, string>;
+};
+export type DependenciesOfOptions = {
+    /**
+     * - Path to workspace (e.g., 'packages/foo')
+     */
+    workspacePath?: string;
+    /**
+     * - Path to repository root for reading workspace package.json files
+     */
+    repoDir?: string;
+    /**
+     * - Include devDependencies
+     */
+    dev?: boolean;
+    /**
+     * - Include optionalDependencies
+     */
+    optional?: boolean;
+    /**
+     * - Include peerDependencies (default false: peers are provided by consumer)
+     */
+    peer?: boolean;
+    /**
+     * - Map of workspace path to package info for resolving workspace links (auto-built if repoDir provided)
+     */
+    workspacePackages?: Record<string, WorkspacePackage>;
+};
+export type FromStringOptions = {
+    /**
+     * - Path hint for type detection
+     */
+    path?: string;
+    /**
+     * - Explicit lockfile type
+     */
+    type?: LockfileType;
+};
+export type PackageJson = {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+};
+export type LockfilePackages = Record<string, any>;
+export type LockfileImporters = Record<string, any>;
+//# sourceMappingURL=set.d.ts.map

package/dist/set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../src/set.js"],"names":[],"mappings":"AAsEA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;IAyCE;;;;;OAKG;IACH,sBAJW,MAAM,YACN,iBAAiB,GACf,OAAO,CAAC,WAAW,CAAC,CAKhC;IAED;;;;;OAKG;IACH,2BAJW,MAAM,YACN,iBAAiB,GACf,WAAW,CAgBvB;IAED;;;;;;OAMG;IACH,uCALW,MAAM,QACN,YAAY,WACZ,iBAAiB,GACf;QAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAAC,QAAQ,EAAE,gBAAgB,CAAC;QAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;KAAE,CAsDrJ;IAlHD;;;;;;;OAOG;IACH,sBAPW,MAAM,QACN,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,YACvB,gBAAgB,GAAG,IAAI,aACvB,iBAAiB,GAAG,IAAI,aACxB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,QAC1B,YAAY,GAAG,IAAI,EAc7B;IAgGD,wBAAwB;IACxB,YADc,MAAM,CAGnB;IAED,qCAAqC;IACrC,YADc,YAAY,GAAG,IAAI,CAGhC;IAED,yBAAyB;IACzB,mBADc,OAAO,CAGpB;IAED;;;;OAIG;IACH,qBAFa,MAAM,EAAE,CAapB;IAoBD;;;;OAIG;IACH,mBAHW,MAAM,GACJ,OAAO,CAInB;IAED;;;;OAIG;IACH,mBAHW,MAAM,GACJ,UAAU,GAAG,SAAS,CAIlC;IAOD,8CAA8C;IAC9C,UADc,gBAAgB,CAAC,UAAU,CAAC,CAGzC;IAED,0CAA0C;IAC1C,QADc,gBAAgB,CAAC,MAAM,CAAC,CAGrC;IAED,wDAAwD;IACxD,WADc,gBAAgB,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAGnD;IAED;;;;OAIG;IACH,kBAHW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,KAAK,IAAI,YACxD,GAAG,QAMb;IAED;;;;OAIG;IACH,aAHW,WAAW,GACT,WAAW,CAUvB;IAED;;;;OAIG;IACH,oBAHW,WAAW,GACT,WAAW,CAUvB;IAED;;;;OAIG;IACH,kBAHW,WAAW,GACT,WAAW,CAUvB;IAED;;;;OAIG;IACH,kBAHW,WAAW,GACT,OAAO,CAOnB;IAED;;;;OAIG;IACH,oBAHW,WAAW,GACT,OAAO,CAInB;IAED;;;;OAIG;IACH,sBAHW,WAAW,GACT,OAAO,CAOnB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,4BAZW,WAAW,YACX,qBAAqB,GACnB,OAAO,CAAC,WAAW,CAAC,CA8EhC;IAkyBD;;;OAGG;IACH,WAFa,UAAU,EAAE,CAIxB;IA/+BD,8CAA8C;IAC9C,qBADc,gBAAgB,CAAC,UAAU,CAAC,CAGzC;;CA6+BF;yBArwCY,OAAO,kBAAkB,EAAE,UAAU;2BACrC,OAAO,aAAa,EAAE,YAAY;;;;;UAKjC,MAAM;;;;aACN,MAAM;;;;mBACN,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;;;;sBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;;;;2BACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;;;;uBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;;;;;;oBAKtB,MAAM;;;;cACN,MAAM;;;;UACN,OAAO;;;;eACP,OAAO;;;;WACP,OAAO;;;;wBACP,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;;;;;;WAKhC,MAAM;;;;WACN,YAAY;;;mBAKZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;sBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;2BACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;uBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;;+BAIvB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;gCAInB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flatlock",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "The Matlock of lockfile parsers - extracts packages without building dependency graphs",
   "keywords": [
     "lockfile",
@@ -35,9 +35,9 @@
   },
   "main": "src/index.js",
   "bin": {
-    "flatlock": "./bin/flatlock.js",
-    "flatlock-cmp": "./bin/flatlock-cmp.js",
-    "flatcover": "./bin/flatcover.js"
+    "flatlock": "bin/flatlock.js",
+    "flatlock-cmp": "bin/flatlock-cmp.js",
+    "flatcover": "bin/flatcover.js"
   },
   "files": [
     "src",
@@ -87,6 +87,11 @@
     "@yarnpkg/core": "^4.5.0"
   },
   "packageManager": "pnpm@10.25.0",
+  "pnpm": {
+    "overrides": {
+      "tar": ">=7.5.3"
+    }
+  },
   "engines": {
     "node": ">=22"
   },

package/src/compare.js

@@ -6,7 +6,7 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { parseSyml } from '@yarnpkg/parsers';
 import yaml from 'js-yaml';
-import { detectType, fromPath, Type } from './index.js';
+import { collect, detectType, Type } from './index.js';
 import { parseYarnBerryKey, parseYarnClassic, parseYarnClassicKey } from './parsers/index.js';
 import { parseSpec as parsePnpmSpec } from './parsers/pnpm.js';
 
@@ -545,12 +545,10 @@ export async function compare(filepath, options = {}) {
   const content = await readFile(filepath, 'utf8');
   const type = detectType({ path: filepath, content });
 
-  const flatlockSet = new Set();
-  for await (const dep of fromPath(filepath)) {
-    if (dep.name && dep.version) {
-      flatlockSet.add(`${dep.name}@${dep.version}`);
-    }
-  }
+  console.time(`⏱  collect [...]${filepath.slice(-40)}`);
+  const deps = await collect(filepath);
+  console.timeEnd(`⏱  collect [...]${filepath.slice(-40)}`);
+  const flatlockSet = new Set(deps.map(({ name, version }) => `${name}@${version}`));
 
   let comparisonResult;
   switch (type) {