flatlock 1.5.0 → 1.5.1

package/dist/detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.js"],"names":[],"mappings":"AA6FA;;;;;;;;;;;;;;GAcG;AACH,+CALG;IAAyB,IAAI;IACJ,OAAO;CAChC,GAAU,YAAY,CAgDxB;AArJD;;GAEG;AAEH;;GAEG;AACH;;;;;GAKG;2BAXU,KAAK,GAAG,MAAM,GAAG,cAAc,GAAG,YAAY"}
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.js"],"names":[],"mappings":"AAuGA;;;;;;;;;;;;;;GAcG;AACH,+CALG;IAAyB,IAAI;IACJ,OAAO;CAChC,GAAU,YAAY,CAgDxB;AA/JD;;GAEG;AAEH;;GAEG;AACH;;;;;GAKG;2BAXU,KAAK,GAAG,MAAM,GAAG,cAAc,GAAG,YAAY"}

package/dist/parsers/index.d.ts

@@ -1,5 +1,5 @@
 export { buildWorkspacePackages as buildNpmWorkspacePackages, extractWorkspacePaths as extractNpmWorkspacePaths, fromPackageLock, parseLockfileKey as parseNpmKey } from "./npm.js";
-export { buildWorkspacePackages as buildPnpmWorkspacePackages, extractWorkspacePaths as extractPnpmWorkspacePaths, fromPnpmLock, parseLockfileKey as parsePnpmKey } from "./pnpm.js";
+export { buildWorkspacePackages as buildPnpmWorkspacePackages, extractWorkspacePaths as extractPnpmWorkspacePaths, fromPnpmLock, parseLockfileKey as parsePnpmKey, parsePnpmYaml } from "./pnpm.js";
 export { buildWorkspacePackages as buildYarnBerryWorkspacePackages, extractWorkspacePaths as extractYarnBerryWorkspacePaths, fromYarnBerryLock, parseLockfileKey as parseYarnBerryKey, parseResolution as parseYarnBerryResolution } from "./yarn-berry.js";
 export { fromYarnClassicLock, parseLockfileKey as parseYarnClassicKey, parseYarnClassic } from "./yarn-classic.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/parsers/pnpm/index.d.ts

@@ -98,6 +98,17 @@ export function parseSpec(spec: string): {
  * parseLockfileKey('/lodash/4.17.21') // => 'lodash'
  */
 export function parseLockfileKey(key: string): string | null;
+/**
+ * Parse pnpm YAML content, tolerating truncated files.
+ *
+ * pnpm lockfiles use inline flow collections like `{integrity: sha512-...}`
+ * which cause js-yaml to throw if the file is truncated mid-entry. When that
+ * happens, we progressively trim trailing lines until parsing succeeds.
+ *
+ * @param {string} content - YAML content
+ * @returns {Record<string, any>} Parsed lockfile object
+ */
+export function parsePnpmYaml(content: string): Record<string, any>;
 /**
  * Parse pnpm lockfile (shrinkwrap.yaml, pnpm-lock.yaml v5.x, v6, v9)
  *

package/dist/parsers/pnpm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/parsers/pnpm/index.js"],"names":[],"mappings":"AAuCA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AACH,gCAzEW,MAAM,GACJ;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA+H3D;AAED;;;;;;;;;;GAUG;AACH,sCAPW,MAAM,GACJ,MAAM,GAAG,IAAI,CAQzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,oCAbW,MAAM,GAAG,MAAM,aACf,MAAM,GACJ,SAAS,CAAC,UAAU,CAAC,CAoGjC;AAED;;;;;;;;;;;;GAYG;AACH,6CAPW,MAAM,GAAG,MAAM,GACb,MAAM,EAAE,CAapB;AAED;;;;;;;;;;GAUG;AACH,8CARW,MAAM,GAAG,MAAM,WACf,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CA6BrD;;yBAhVa,OAAO,aAAa,EAAE,UAAU;;UAIhC,MAAM;aACN,MAAM;mBACN,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;sBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;2BACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;uBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/parsers/pnpm/index.js"],"names":[],"mappings":"AAuCA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AACH,gCAzEW,MAAM,GACJ;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA+H3D;AAED;;;;;;;;;;GAUG;AACH,sCAPW,MAAM,GACJ,MAAM,GAAG,IAAI,CAQzB;AAED;;;;;;;;;GASG;AACH,uCAHW,MAAM,GACJ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAoB/B;AAED;;;;;;;;;;;;;;;GAeG;AACH,oCAbW,MAAM,GAAG,MAAM,aACf,MAAM,GACJ,SAAS,CAAC,UAAU,CAAC,CAoGjC;AAED;;;;;;;;;;;;GAYG;AACH,6CAPW,MAAM,GAAG,MAAM,GACb,MAAM,EAAE,CAapB;AAED;;;;;;;;;;GAUG;AACH,8CARW,MAAM,GAAG,MAAM,WACf,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CA6BrD;;yBA9Wa,OAAO,aAAa,EAAE,UAAU;;UAIhC,MAAM;aACN,MAAM;mBACN,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;sBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;2BACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;uBACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flatlock",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "The Matlock of lockfile parsers - extracts packages without building dependency graphs",
   "keywords": [
     "lockfile",
@@ -47,8 +47,11 @@
     "bin/flatcover.js"
   ],
   "scripts": {
-    "test": "node --test ./test/*.test.js ./test/**/*.test.js",
-    "test:coverage": "c8 node --test ./test/*.test.js",
+    "pretest": "node test/fixtures/decode.js",
+    "pretest:coverage": "node test/fixtures/decode.js",
+    "test": "node --test ./test/*.test.js ./test/parsers/*.test.js",
+    "test:coverage": "c8 node --test ./test/*.test.js ./test/parsers/*.test.js",
+    "test:all": "node --test ./test/*.test.js ./test/**/*.test.js",
     "build:types": "tsc",
     "lint": "biome lint src test",
     "lint:fix": "biome lint --write src test",

package/src/detect.js

@@ -61,25 +61,35 @@ function tryParseYarnClassic(content) {
 
     const result = parseYarnClassic(content);
     // Must parse successfully and NOT have __metadata (that's berry)
-    // Must have at least one package entry (not empty object)
     const isValidResult = result.type === 'success' || result.type === 'merge';
-    const hasEntries = result.object && Object.keys(result.object).length > 0;
-    const notBerry = !('__metadata' in result.object);
+    const hasObject = result.object && typeof result.object === 'object';
+    const notBerry = hasObject && !('__metadata' in result.object);
+    // Must have entries OR start with the yarn lockfile header comment
+    const hasEntries = hasObject && Object.keys(result.object).length > 0;
+    const firstLines = content.split('\n', 5).join('\n');
+    const hasYarnHeader = /^# yarn lockfile v1/m.test(firstLines);
 
-    return isValidResult && hasEntries && notBerry;
+    return isValidResult && hasObject && notBerry && (hasEntries || hasYarnHeader);
   } catch {
     return false;
   }
 }
 
 /**
- * Try to parse content as pnpm lockfile
+ * Try to parse content as pnpm lockfile.
+ *
+ * Only parses the YAML header (first 20 lines) to check for lockfileVersion.
+ * This avoids failures on truncated lockfiles where the body is incomplete
+ * but the header is valid.
+ *
  * @param {string} content
  * @returns {boolean}
  */
 function tryParsePnpm(content) {
   try {
-    const parsed = yaml.load(content);
+    // Parse only the header to tolerate truncated lockfiles
+    const header = content.split('\n', 20).join('\n');
+    const parsed = yaml.load(header);
     // Must have lockfileVersion at root and NOT have __metadata
     // biome-ignore format: preserve multiline logical expression
     return !!(parsed

package/src/parsers/index.js

@@ -12,7 +12,8 @@ export {
   buildWorkspacePackages as buildPnpmWorkspacePackages,
   extractWorkspacePaths as extractPnpmWorkspacePaths,
   fromPnpmLock,
-  parseLockfileKey as parsePnpmKey
+  parseLockfileKey as parsePnpmKey,
+  parsePnpmYaml
 } from './pnpm.js';
 export {
   buildWorkspacePackages as buildYarnBerryWorkspacePackages,

package/src/parsers/pnpm/index.js

@@ -193,6 +193,36 @@ export function parseLockfileKey(key) {
   return parseSpec(key).name;
 }
 
+/**
+ * Parse pnpm YAML content, tolerating truncated files.
+ *
+ * pnpm lockfiles use inline flow collections like `{integrity: sha512-...}`
+ * which cause js-yaml to throw if the file is truncated mid-entry. When that
+ * happens, we progressively trim trailing lines until parsing succeeds.
+ *
+ * @param {string} content - YAML content
+ * @returns {Record<string, any>} Parsed lockfile object
+ */
+export function parsePnpmYaml(content) {
+  try {
+    return /** @type {Record<string, any>} */ (yaml.load(content));
+  } catch {
+    // Truncated file — trim lines from the end until yaml.load succeeds.
+    // Most truncations break an incomplete flow collection near the end,
+    // so we only need to trim a handful of lines.
+    const lines = content.split('\n');
+    for (let trim = 1; trim < Math.min(20, lines.length); trim++) {
+      try {
+        return /** @type {Record<string, any>} */ (yaml.load(lines.slice(0, -trim).join('\n')));
+      } catch {
+        // keep trimming
+      }
+    }
+    // If trimming didn't help, re-throw the original error
+    throw yaml.load(content);
+  }
+}
+
 /**
  * Parse pnpm lockfile (shrinkwrap.yaml, pnpm-lock.yaml v5.x, v6, v9)
  *
@@ -211,7 +241,7 @@ export function parseLockfileKey(key) {
  */
 export function* fromPnpmLock(input, _options = {}) {
   const lockfile = /** @type {Record<string, any>} */ (
-    typeof input === 'string' ? yaml.load(input) : input
+    typeof input === 'string' ? parsePnpmYaml(input) : input
   );
 
   // Detect version to determine where to look for packages
@@ -250,7 +280,7 @@ export function* fromPnpmLock(input, _options = {}) {
     if (seen.has(key)) continue;
     seen.add(key);
 
-    const resolution = pkg.resolution || {};
+    const resolution = pkg?.resolution || {};
     const integrity = resolution.integrity;
     const resolved = resolution.tarball;
     const link = spec.startsWith('link:') || resolution.type === 'directory';
@@ -315,7 +345,7 @@ export function* fromPnpmLock(input, _options = {}) {
  */
 export function extractWorkspacePaths(input) {
   const lockfile = /** @type {Record<string, any>} */ (
-    typeof input === 'string' ? yaml.load(input) : input
+    typeof input === 'string' ? parsePnpmYaml(input) : input
   );
 
   const importers = lockfile.importers || {};

package/src/set.js

@@ -1,6 +1,5 @@
 import { readFile } from 'node:fs/promises';
 import { parseSyml } from '@yarnpkg/parsers';
-import yaml from 'js-yaml';
 import { detectType, Type } from './detect.js';
 import {
   buildNpmWorkspacePackages,
@@ -13,6 +12,7 @@ import {
   fromPnpmLock,
   fromYarnBerryLock,
   fromYarnClassicLock,
+  parsePnpmYaml,
   parseYarnBerryKey,
   parseYarnClassic,
   parseYarnClassicKey
@@ -195,7 +195,7 @@ export class FlatlockSet {
       }
       case Type.PNPM: {
         /** @type {any} */
-        const lockfile = yaml.load(content);
+        const lockfile = parsePnpmYaml(content);
         packages = lockfile.packages || {};
         importers = lockfile.importers || null;
         snapshots = lockfile.snapshots || null;