intentpatch 0.1.1 → 0.2.0

package/README.ko.md

@@ -21,9 +21,16 @@ LLM 없이도 재현 가능한 분석을 제공하고, AI 설명 기능은 선
 
 ## 빠른 시작
 
-Node.js 20 이상과 Git이 설치되어 있어야 합니다. 현재 npm 공개 전에는 저장소를 빌드해 바로
+Node.js 20 이상과 Git이 설치되어 있어야 합니다. npm에 공개된 v0.2.0은 전역 설치 없이
 실행할 수 있습니다.
 
+```bash
+npx intentpatch analyze --cwd /path/to/repository
+npx intentpatch analyze --format html --output intentpatch-report.html
+```
+
+현재 소스 버전을 실행하려면 저장소를 빌드합니다.
+
 ```bash
 git clone https://github.com/xx2xxjaeil/intent-patch.git
 cd intent-patch
@@ -33,13 +40,6 @@ node dist/presentation/cli/main.js --version
 node dist/presentation/cli/main.js analyze --cwd /path/to/repository
 ```
 
-npm 릴리스가 공개된 뒤에는 설치 없이 같은 CLI를 실행할 수 있습니다.
-
-```bash
-npx intentpatch analyze --cwd /path/to/repository
-npx intentpatch analyze --format html --output intentpatch-report.html
-```
-
 핵심 분석에는 API key, 유료 AI 모델, 서버 또는 데이터베이스가 필요하지 않습니다. 분석할 Git
 저장소의 파일은 로컬에서 처리하며 LLM 연결은 현재 기본 실행 경로에 포함되지 않습니다.
 
@@ -67,7 +67,7 @@ jobs:
 
       - name: Analyze pull request
         id: intentpatch
-        uses: xx2xxjaeil/intent-patch@main
+        uses: xx2xxjaeil/intent-patch@v0.2.0
         with:
           fail-on: high
 
@@ -79,9 +79,9 @@ jobs:
           path: intentpatch-report
 ```
 
-현재 개발 버전은 `@main`으로 실행합니다. 첫 번째 정식 릴리스 후에는 불변 SHA 또는 `@v1`
-태그로 고정하는 방식을 권장합니다. Action은 PR·push 이벤트의 commit 범위를 자동으로
-선택하고 다음 결과를 남깁니다.
+Action은 릴리스 버전이나 불변 commit SHA로 고정하는 방식을 권장합니다. v0.2.0에는 TypeScript
+경로 별칭과 npm lockfile/workspace 분석이 포함되며, `@main`은 미릴리스 변경을 따라갑니다.
+Action은 PR·push 이벤트의 commit 범위를 자동으로 선택하고 다음 결과를 남깁니다.
 
 - GitHub Actions Job Summary의 Markdown 보고서
 - 심각도별 workflow annotation
@@ -129,7 +129,7 @@ LOW     구현체가 하나뿐인 추상화 추가
 
 ## 현재 구현된 기능
 
-현재 버전은 Git 변경사항 수집, 루트 `package.json`의 직접 dependency 분석, TypeScript
+현재 소스는 Git 변경사항 수집, 루트·npm workspace `package.json`의 직접 dependency와 npm lockfile 분석, TypeScript
 최상위 심볼과 공개 API 변경 분석, 기존 구현 중복·단일 구현 추상화 신호, import graph 기반
 영향 범위와 테스트 동반 변경 분석을 제공합니다.
 
@@ -146,6 +146,11 @@ LOW     구현체가 하나뿐인 추상화 추가
 - production·development dependency 추가 탐지
 - dependency 삭제, 버전 변경, 섹션 이동 탐지
 - 잘못된 `package.json`을 예외 대신 근거가 포함된 finding으로 보고
+- npm `package-lock.json` v2/v3의 실제 설치 패키지 추가·삭제·버전 변경 비교
+- scoped·중첩 설치 경로를 구분하고 로컬 workspace 링크는 제외
+- 잘못되었거나 미지원인 lockfile을 누락하지 않고 finding으로 보고
+- 루트 `workspaces` 패턴에 속한 변경 manifest의 직접 dependency를 workspace별로 보고
+- workspace 설정 변경과 manifest의 workspace 안팎 이동을 탐지
 - finding 심각도(`high`, `medium`, `low`) 집계
 - CI 품질 게이트를 위한 `--fail-on` 종료 코드
 - 설치된 패키지 버전을 확인하는 `--version` 명령
@@ -160,6 +165,8 @@ LOW     구현체가 하나뿐인 추상화 추가
 - rename 전후 파일 경로를 사용한 심볼 비교
 - 구문 오류가 있는 파일을 누락시키지 않고 분석 불가 근거로 보고
 - `.ts`·`.tsx` 파일의 상대 경로 정적 import와 re-export 관계 수집
+- 가장 가까운 `tsconfig.json`·`jsconfig.json`의 `paths`·`baseUrl`과 상대 경로 `extends`를
+  사용해 로컬 별칭 import 해석
 - `.js`·`.jsx`·`.mjs`·`.cjs` specifier를 대응하는 TypeScript 소스로 해석
 - 변경 모듈을 import하는 직접 의존자와 여러 단계를 거친 간접 영향 파일 계산
 - 해결하지 못한 상대 import와 읽기·파싱 실패를 분석 근거로 보존
@@ -174,7 +181,7 @@ LOW     구현체가 하나뿐인 추상화 추가
 - Pull Request·push commit 범위를 자동 판별하는 GitHub Action
 - GitHub Job Summary, workflow annotation, JSON·HTML artifact용 보고서 생성
 
-아직 lockfile의 전이 dependency 분석, path alias 해석, JavaScript·메서드 구조 분석과 AI 리뷰
+아직 lockfile 전이 dependency의 부모 귀속 분석, JavaScript·메서드 구조 분석과 AI 리뷰
 기능은 구현되지 않았습니다.
 
 ## 상세 사용법
@@ -412,9 +419,13 @@ npm provenance가 자동 생성됩니다. 아직 npm에 존재하지 않는 신
 1. ✅ `package.json` 직접 dependency 변경 탐지와 규칙 엔진
 2. ✅ TypeScript AST 기반 함수·클래스·인터페이스·타입 변경 분석
 3. ✅ 상대 경로 정적 import graph 기반 변경 영향 범위 계산
+   - ✅ 가장 가까운 TypeScript 프로젝트 설정의 `paths`·`baseUrl` 별칭 해석
 4. ✅ Change Contract 기반 예상 범위 이탈과 변경량 예산 탐지
 5. ✅ Contract 기반 관련 테스트 변경 누락 탐지
 6. lockfile과 workspace를 고려한 package manager adapter
+   - ✅ npm `package-lock.json` v2/v3의 설치 패키지 변경
+   - ✅ npm workspace manifest의 직접 dependency 변경
+   - pnpm·Yarn adapter
 7. ✅ 직접 export된 공개 심볼 삭제와 export 해제 탐지
 8. ✅ 단일 HTML 대시보드와 SVG 기반 dependency 영향 그래프
 9. ✅ re-export·함수/인터페이스 호환성과 기존 코드 중복 가능성 탐지
@@ -428,9 +439,14 @@ npm provenance가 자동 생성됩니다. 아직 npm에 존재하지 않는 신
 - 분석 대상은 최소 한 번 이상 커밋된 Git 저장소여야 합니다.
 - untracked symbolic link는 안전을 위해 내용을 읽지 않습니다.
 - 10 MiB를 초과하는 untracked 파일은 라인 수를 측정하지 않습니다.
-- dependency 분석은 저장소 루트의 npm `package.json`에 선언된 `dependencies`와
-  `devDependencies`를 대상으로 합니다.
-- lockfile의 전이 dependency, workspace package, 코드에서의 실제 사용 여부는 아직 분석하지 않습니다.
+- 직접 dependency 선언 분석은 저장소 루트와 변경된 npm workspace `package.json`의
+  `dependencies`와 `devDependencies`를 대상으로 합니다.
+- npm `package-lock.json` v2/v3은 설치 경로와 버전을 비교합니다. 부모 dependency 귀속,
+  integrity hash나 취약점 정보까지 분석하지는 않습니다.
+- workspace 판별은 루트의 npm `workspaces` 배열과 명시 경로, `*`·`**`·`?` 패턴을 지원합니다.
+  부정·중괄호·문자 클래스 패턴은 미지원 finding으로 보고합니다.
+- pnpm·Yarn lockfile, 코드에서의 실제 dependency 사용 여부는 아직 분석하지 않습니다.
+- working tree의 `package-lock.json`은 10 MiB, 그 외 텍스트 snapshot은 1 MiB로 제한합니다.
 - 심볼 분석은 `.ts`와 `.tsx`의 이름이 있는 최상위 함수, 클래스, 인터페이스, 타입
   별칭만 지원합니다.
 - 공개 API 분석은 이름이 있는 최상위 함수·인터페이스, 로컬 `export { name }`, 외부
@@ -445,10 +461,12 @@ npm provenance가 자동 생성됩니다. 아직 npm에 존재하지 않는 신
   보고합니다. TypeScript의 구조적 구현, factory 반환 타입과 런타임 등록은 계산하지 않습니다.
 - 메서드, 변수 선언, enum, 중첩 선언, JavaScript 파일은 아직 심볼 분석 대상이 아닙니다.
 - 선언 내부의 포맷이나 주석 변경도 심볼 수정으로 집계될 수 있습니다.
-- 영향 분석은 `.ts`·`.tsx` 파일의 상대 경로 정적 `import`, side-effect import,
-  `export ... from`, `import = require()`를 대상으로 합니다.
-- 외부 package import는 그래프에서 제외하며 path alias, dynamic `import()`, 일반 `require()`는
-  아직 해석하지 않습니다.
+- 영향 분석은 `.ts`·`.tsx` 파일의 정적 `import`, side-effect import, `export ... from`,
+  `import = require()`를 대상으로 합니다. 로컬 별칭은 가장 가까운 `tsconfig.json` 또는
+  `jsconfig.json`과 상대 경로 `extends`를 해석합니다.
+- 외부 패키지 설정을 참조하는 `extends`, project references, 임의 이름의 설정 파일,
+  package `imports`·`exports`, 외부 package import, dynamic `import()`, 일반 `require()`는
+  아직 그래프에 포함하지 않습니다.
 - 영향 그래프는 비교 결과점(working tree 또는 head ref)의 파일을 기준으로 만듭니다. 따라서
   삭제된 모듈을 가리키던 과거 import의 영향은 현재 단계에서 계산할 수 없습니다.
 - 영향 분석용 소스 파일은 파일당 1 MiB로 제한하며, symbolic link는 읽지 않습니다.

package/README.md

@@ -18,7 +18,15 @@ IntentPatch combines **Git diff analysis, static analysis, and dependency analys
 
 ## Quick start
 
-IntentPatch requires Node.js 20 or later and Git. Until the first public npm release is approved, build and run it directly from the repository:
+IntentPatch requires Node.js 20 or later and Git. Run the published v0.2.0 CLI without
+installing it globally:
+
+```bash
+npx intentpatch analyze --cwd /path/to/repository
+npx intentpatch analyze --format html --output intentpatch-report.html
+```
+
+To run the current source version instead, build it from the repository:
 
 ```bash
 git clone https://github.com/xx2xxjaeil/intent-patch.git
@@ -29,13 +37,6 @@ node dist/presentation/cli/main.js --version
 node dist/presentation/cli/main.js analyze --cwd /path/to/repository
 ```
 
-After the npm release becomes public, run the same CLI without installing it globally:
-
-```bash
-npx intentpatch analyze --cwd /path/to/repository
-npx intentpatch analyze --format html --output intentpatch-report.html
-```
-
 The core analyzer needs no API key, paid AI model, server, or database. Repository files are processed locally, and no LLM is used in the default execution path.
 
 ## GitHub Action
@@ -61,7 +62,7 @@ jobs:
 
       - name: Analyze pull request
         id: intentpatch
-        uses: xx2xxjaeil/intent-patch@main
+        uses: xx2xxjaeil/intent-patch@v0.2.0
         with:
           fail-on: high
 
@@ -73,7 +74,8 @@ jobs:
           path: intentpatch-report
 ```
 
-The development version currently runs from `@main`. After the first stable release, pin the action to an immutable commit SHA or a major tag such as `@v1`.
+Pin the action to a released version or an immutable commit SHA. The v0.2.0 release includes
+TypeScript path aliases and npm lockfile/workspace analysis; `@main` follows unreleased changes.
 
 The action detects the comparison range for pull request and push events and produces:
 
@@ -121,7 +123,7 @@ Every finding includes the relevant file, a stable rule ID, and evidence for the
 
 ## Implemented capabilities
 
-The current version analyzes Git changes, direct dependencies in the root `package.json`, top-level TypeScript symbols and public API changes, possible duplicate implementations, single-implementation abstractions, import-graph impact, and related test changes.
+The current source tree analyzes Git changes, direct dependencies in the root `package.json`, top-level TypeScript symbols and public API changes, possible duplicate implementations, single-implementation abstractions, import-graph impact, and related test changes.
 
 ### Git and reporting
 
@@ -143,6 +145,11 @@ The current version analyzes Git changes, direct dependencies in the root `packa
 - Detect additions to production and development dependencies.
 - Detect dependency removal, version changes, and section moves.
 - Report malformed `package.json` files as evidence-backed findings instead of crashing.
+- Compare resolved package additions, removals, and version changes in npm `package-lock.json` v2/v3.
+- Keep scoped and nested installation paths distinct, and exclude local workspace links.
+- Report malformed or unsupported lockfiles as findings rather than silently skipping them.
+- Attribute direct dependency changes to changed npm workspace manifests selected by the root `workspaces` patterns.
+- Report changes to workspace patterns and manifest moves into or out of a configured workspace.
 - Extract top-level named functions, classes, interfaces, and type aliases from `.ts` and `.tsx` files.
 - Detect symbol additions, modifications, and removals with source locations.
 - Preserve direct exports, local export lists, and external re-exports as public-symbol evidence.
@@ -157,6 +164,8 @@ The current version analyzes Git changes, direct dependencies in the root `packa
 ### Impact, scope, and tests
 
 - Build relative static import and re-export relationships for `.ts` and `.tsx` files.
+- Resolve local imports through the nearest `tsconfig.json` or `jsconfig.json` `paths` and
+  `baseUrl`, including relative `extends` files.
 - Resolve `.js`, `.jsx`, `.mjs`, and `.cjs` import specifiers to matching TypeScript sources.
 - Calculate direct importers and transitively impacted files for changed modules.
 - Preserve unresolved relative imports and file read or parse failures as evidence.
@@ -169,7 +178,7 @@ The current version analyzes Git changes, direct dependencies in the root `packa
 - Report source files without a related test change as medium-severity findings.
 - Support repository-relative `*`, `**`, and `?` path patterns.
 
-Lockfile transitive dependency analysis, path aliases, JavaScript and method-level structure analysis, and optional AI review are not implemented yet.
+Transitive lockfile dependency provenance, JavaScript and method-level structure analysis, and optional AI review are not implemented yet.
 
 ## CLI usage
 
@@ -396,9 +405,13 @@ No long-lived npm token is stored as a GitHub secret. Public packages published
 1. ✅ Direct `package.json` dependency detection and rule engine
 2. ✅ TypeScript AST analysis for functions, classes, interfaces, and types
 3. ✅ Relative static import graph and change-impact calculation
+   - ✅ TypeScript `paths` and `baseUrl` aliases from the nearest project config
 4. ✅ Change Contract scope and change-budget analysis
 5. ✅ Contract-based detection of missing related test changes
 6. Package-manager adapters for lockfiles and workspaces
+   - ✅ npm `package-lock.json` v2/v3 resolved package changes
+   - ✅ npm workspace manifest dependency changes
+   - pnpm and Yarn adapters
 7. ✅ Detection of removed public exports
 8. ✅ Standalone HTML dashboard and SVG dependency-impact graph
 9. ✅ Re-export and function/interface compatibility checks plus possible code duplication
@@ -412,8 +425,11 @@ No long-lived npm token is stored as a GitHub secret. Public packages published
 - The target must be a Git repository with at least one commit.
 - Untracked symbolic links are not read for safety.
 - Line counts are skipped for untracked files larger than 10 MiB.
-- Dependency analysis covers only `dependencies` and `devDependencies` in the root npm `package.json`.
-- Transitive lockfile dependencies, workspace packages, and real dependency usage in source code are not analyzed yet.
+- Direct dependency declarations are analyzed from `dependencies` and `devDependencies` in the root npm `package.json` and changed npm workspace manifests.
+- npm `package-lock.json` v2/v3 analysis compares installed package paths and versions, not dependency provenance, integrity hashes, or vulnerability data. It does not attribute transitive packages to their parents.
+- Workspace detection supports the root npm `workspaces` array with explicit paths and `*`, `**`, and `?` globs. Negation, brace, and character-class patterns are reported as unsupported.
+- pnpm and Yarn lockfiles and real dependency usage in source code are not analyzed yet.
+- Working-tree `package-lock.json` files are limited to 10 MiB; other text snapshots retain the 1 MiB limit.
 - Symbol analysis supports named top-level functions, classes, interfaces, and type aliases in `.ts` and `.tsx` files.
 - Public API analysis supports named top-level functions and interfaces, local `export { name }`, external `export { name } from`, and `export * from`. Package `exports`, anonymous default exports, and detailed class or type-alias contracts are not interpreted yet.
 - Function compatibility compares explicitly written parameter and return-type text. It does not evaluate inferred return types or full TypeScript structural assignability.
@@ -421,8 +437,12 @@ No long-lived npm token is stored as a GitHub secret. Public packages published
 - A single-implementation abstraction is reported only when exactly one named class explicitly uses `implements` for a new interface. Structural implementation, factory return types, and runtime registration are not calculated.
 - Methods, variable declarations, enums, nested declarations, and JavaScript files are not included in symbol analysis.
 - Formatting or comment changes inside a declaration can be counted as symbol modifications.
-- Impact analysis covers relative static `import`, side-effect imports, `export ... from`, and `import = require()` in `.ts` and `.tsx` files.
-- External package imports, path aliases, dynamic `import()`, and ordinary `require()` are not included in the graph.
+- Impact analysis covers static `import`, side-effect imports, `export ... from`, and
+  `import = require()` in `.ts` and `.tsx` files. Local aliases use the nearest `tsconfig.json` or
+  `jsconfig.json`, with relative `extends` support.
+- Package-based config `extends`, project references, arbitrary config filenames, package
+  `imports`/`exports`, external package imports, dynamic `import()`, and ordinary `require()` are
+  not included in the graph.
 - The graph is built from files at the comparison result point: the working tree or head ref. Impact from historical imports that referenced a deleted module cannot be calculated yet.
 - Source files used for impact analysis are limited to 1 MiB per file, and symbolic links are not read.
 - IntentPatch does not infer expected paths from natural-language intent. Scope decisions use the contract's explicit `include` and `allow` patterns.

package/dist/application/ports/module-alias-resolver.d.ts

@@ -0,0 +1,11 @@
+import type { ImpactAnalysisIssue } from "../../domain/impact.js";
+import type { AnalysisTarget } from "../../domain/report.js";
+/** 분석 결과점에서 해석 가능한 비상대 경로 import를 찾는 언어별 출력 포트다. */
+export interface ModuleAliasResolver {
+    prepare(target: AnalysisTarget, repositoryPaths: readonly string[], sourcePaths: ReadonlySet<string>): Promise<PreparedModuleAliasResolver>;
+}
+export interface PreparedModuleAliasResolver {
+    readonly issues: readonly ImpactAnalysisIssue[];
+    resolve(importer: string, specifier: string): string | undefined;
+}
+//# sourceMappingURL=module-alias-resolver.d.ts.map

package/dist/application/ports/module-alias-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-alias-resolver.d.ts","sourceRoot":"","sources":["../../../src/application/ports/module-alias-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,OAAO,CACL,MAAM,EAAE,cAAc,EACtB,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,GAC/B,OAAO,CAAC,2BAA2B,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAChD,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClE"}

package/dist/application/ports/module-alias-resolver.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=module-alias-resolver.js.map

package/dist/application/ports/module-alias-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-alias-resolver.js","sourceRoot":"","sources":["../../../src/application/ports/module-alias-resolver.ts"],"names":[],"mappings":""}

package/dist/application/ports/package-lock-parser.d.ts

@@ -0,0 +1,20 @@
+/** npm lockfile의 설치 위치를 기준으로 비교할 수 있는 패키지 정보다. */
+export interface LockedPackage {
+    readonly path: string;
+    readonly name: string;
+    readonly version: string;
+    readonly rootDirect: boolean;
+}
+export type PackageLockParseResult = Readonly<{
+    ok: true;
+    packages: ReadonlyMap<string, LockedPackage>;
+}> | Readonly<{
+    ok: false;
+    kind: "invalid" | "unsupported";
+    reason: string;
+}>;
+/** 패키지 매니저의 파일 형식을 분석 규칙에서 분리하는 입력 포트다. */
+export interface PackageLockParser {
+    parse(content: string): PackageLockParseResult;
+}
+//# sourceMappingURL=package-lock-parser.d.ts.map

package/dist/application/ports/package-lock-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-lock-parser.d.ts","sourceRoot":"","sources":["../../../src/application/ports/package-lock-parser.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,MAAM,sBAAsB,GAC9B,QAAQ,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;CAAE,CAAC,GACpE,QAAQ,CAAC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE7E,2CAA2C;AAC3C,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,CAAC;CAChD"}

package/dist/application/ports/package-lock-parser.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=package-lock-parser.js.map

package/dist/application/ports/package-lock-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-lock-parser.js","sourceRoot":"","sources":["../../../src/application/ports/package-lock-parser.ts"],"names":[],"mappings":""}

package/dist/application/rules/npm-lockfile-rule.d.ts

@@ -0,0 +1,12 @@
+import type { Finding } from "../../domain/finding.js";
+import type { AnalysisContext, AnalysisRule } from "../ports/analysis-rule.js";
+import type { FileSnapshotSource } from "../ports/file-snapshot-source.js";
+import type { PackageLockParser } from "../ports/package-lock-parser.js";
+/** 선언 버전이 아닌, npm이 실제로 고정한 패키지 버전과 설치 위치의 변화를 분석한다. */
+export declare class NpmLockfileRule implements AnalysisRule {
+    private readonly snapshots;
+    private readonly parser;
+    constructor(snapshots: FileSnapshotSource, parser: PackageLockParser);
+    analyze(context: AnalysisContext): Promise<readonly Finding[]>;
+}
+//# sourceMappingURL=npm-lockfile-rule.d.ts.map

package/dist/application/rules/npm-lockfile-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-lockfile-rule.d.ts","sourceRoot":"","sources":["../../../src/application/rules/npm-lockfile-rule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAiB,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAIxF,uDAAuD;AACvD,qBAAa,eAAgB,YAAW,YAAY;IAEhD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,iBAAiB;IAG/B,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;CAiC5E"}

package/dist/application/rules/npm-lockfile-rule.js

@@ -0,0 +1,109 @@
+const lockfilePath = "package-lock.json";
+/** 선언 버전이 아닌, npm이 실제로 고정한 패키지 버전과 설치 위치의 변화를 분석한다. */
+export class NpmLockfileRule {
+    snapshots;
+    parser;
+    constructor(snapshots, parser) {
+        this.snapshots = snapshots;
+        this.parser = parser;
+    }
+    async analyze(context) {
+        if (!context.changes.files.some((change) => change.path === lockfilePath || change.previousPath === lockfilePath)) {
+            return [];
+        }
+        const snapshot = await this.snapshots.read(context.target, lockfilePath);
+        const before = snapshot.before === undefined ? undefined : this.parser.parse(snapshot.before);
+        const after = snapshot.after === undefined ? undefined : this.parser.parse(snapshot.after);
+        const errors = [
+            ...(before !== undefined && !before.ok ? [parseFinding("base", before)] : []),
+            ...(after !== undefined && !after.ok ? [parseFinding("current", after)] : []),
+        ];
+        if (errors.length > 0) {
+            return errors;
+        }
+        if (before === undefined && after === undefined) {
+            return [];
+        }
+        if (before === undefined && after?.ok) {
+            return [lockfilePresenceFinding("added", after.packages.size)];
+        }
+        if (after === undefined && before?.ok) {
+            return [lockfilePresenceFinding("removed", before.packages.size)];
+        }
+        if (before?.ok && after?.ok) {
+            return comparePackages(before.packages, after.packages);
+        }
+        return [];
+    }
+}
+function comparePackages(before, after) {
+    const paths = [...new Set([...before.keys(), ...after.keys()])].sort();
+    const findings = [];
+    for (const path of paths) {
+        const previous = before.get(path);
+        const current = after.get(path);
+        if (previous === undefined && current !== undefined) {
+            findings.push({
+                ruleId: "dependency/locked-package-added",
+                severity: "low",
+                title: "Resolved package added",
+                description: `${current.name}@${current.version} was added at ${path}.`,
+                file: lockfilePath,
+                evidence: packageEvidence(current),
+            });
+        }
+        else if (previous !== undefined && current === undefined) {
+            findings.push({
+                ruleId: "dependency/locked-package-removed",
+                severity: "low",
+                title: "Resolved package removed",
+                description: `${previous.name}@${previous.version} was removed from ${path}.`,
+                file: lockfilePath,
+                evidence: packageEvidence(previous),
+            });
+        }
+        else if (previous !== undefined &&
+            current !== undefined &&
+            previous.version !== current.version) {
+            findings.push({
+                ruleId: "dependency/locked-version-changed",
+                severity: "low",
+                title: "Resolved package version changed",
+                description: `${current.name} at ${path} changed from ${previous.version} to ${current.version}.`,
+                file: lockfilePath,
+                evidence: { ...packageEvidence(current), from: previous.version, to: current.version },
+            });
+        }
+    }
+    return findings;
+}
+function packageEvidence(item) {
+    return {
+        package: item.name,
+        version: item.version,
+        installPath: item.path,
+        rootDirect: item.rootDirect,
+    };
+}
+function parseFinding(side, result) {
+    const unsupported = result.kind === "unsupported";
+    return {
+        ruleId: unsupported ? "dependency/unsupported-lockfile" : "dependency/invalid-lockfile",
+        severity: unsupported ? "low" : "high",
+        title: unsupported ? "Unsupported npm lockfile" : "Invalid npm lockfile",
+        description: `Could not analyze the ${side} package-lock.json: ${result.reason}`,
+        file: lockfilePath,
+        evidence: { side, reason: result.reason },
+    };
+}
+function lockfilePresenceFinding(kind, packageCount) {
+    return {
+        ruleId: `dependency/lockfile-${kind}`,
+        severity: "low",
+        title: kind === "added" ? "npm lockfile added" : "npm lockfile removed",
+        description: `package-lock.json was ${kind} with ${packageCount} resolved packages.`,
+        file: lockfilePath,
+        evidence: { packageCount },
+    };
+}
+//# sourceMappingURL=npm-lockfile-rule.js.map

package/dist/application/rules/npm-lockfile-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-lockfile-rule.js","sourceRoot":"","sources":["../../../src/application/rules/npm-lockfile-rule.ts"],"names":[],"mappings":"AAKA,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC,uDAAuD;AACvD,MAAM,OAAO,eAAe;IAEP;IACA;IAFnB,YACmB,SAA6B,EAC7B,MAAyB;QADzB,cAAS,GAAT,SAAS,CAAoB;QAC7B,WAAM,GAAN,MAAM,CAAmB;IACzC,CAAC;IAEG,KAAK,CAAC,OAAO,CAAC,OAAwB;QAC3C,IACE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CACzB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,CACjF,EACD,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,EAAE,EAAE,EAAE,CAAC;YACtC,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,EAAE,EAAE,EAAE,CAAC;YACtC,OAAO,CAAC,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,MAAM,EAAE,EAAE,IAAI,KAAK,EAAE,EAAE,EAAE,CAAC;YAC5B,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AAED,SAAS,eAAe,CACtB,MAA0C,EAC1C,KAAyC;IAEzC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACpD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,iCAAiC;gBACzC,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,iBAAiB,IAAI,GAAG;gBACvE,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mCAAmC;gBAC3C,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,0BAA0B;gBACjC,WAAW,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,qBAAqB,IAAI,GAAG;gBAC7E,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;aAAM,IACL,QAAQ,KAAK,SAAS;YACtB,OAAO,KAAK,SAAS;YACrB,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EACpC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,mCAAmC;gBAC3C,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,kCAAkC;gBACzC,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,OAAO,IAAI,iBAAiB,QAAQ,CAAC,OAAO,OAAO,OAAO,CAAC,OAAO,GAAG;gBACjG,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE;aACvF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,IAAmB;IAC1C,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,IAAI;QAClB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,IAAI;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,IAAwB,EACxB,MAAsE;IAEtE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC;IAClD,OAAO;QACL,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,6BAA6B;QACvF,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;QACtC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,sBAAsB;QACxE,WAAW,EAAE,yBAAyB,IAAI,uBAAuB,MAAM,CAAC,MAAM,EAAE;QAChF,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAyB,EAAE,YAAoB;IAC9E,OAAO;QACL,MAAM,EAAE,uBAAuB,IAAI,EAAE;QACrC,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,sBAAsB;QACvE,WAAW,EAAE,yBAAyB,IAAI,SAAS,YAAY,qBAAqB;QACpF,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,EAAE,YAAY,EAAE;KAC3B,CAAC;AACJ,CAAC"}

package/dist/application/rules/npm-workspace-dependency-rule.d.ts

@@ -0,0 +1,10 @@
+import type { Finding } from "../../domain/finding.js";
+import type { AnalysisContext, AnalysisRule } from "../ports/analysis-rule.js";
+import type { FileSnapshotSource } from "../ports/file-snapshot-source.js";
+/** npm workspaces에 속한 변경 manifest를 찾아 기존 직접 dependency 규칙으로 분석한다. */
+export declare class NpmWorkspaceDependencyRule implements AnalysisRule {
+    private readonly snapshots;
+    constructor(snapshots: FileSnapshotSource);
+    analyze(context: AnalysisContext): Promise<readonly Finding[]>;
+}
+//# sourceMappingURL=npm-workspace-dependency-rule.d.ts.map

package/dist/application/rules/npm-workspace-dependency-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-workspace-dependency-rule.d.ts","sourceRoot":"","sources":["../../../src/application/rules/npm-workspace-dependency-rule.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAW3E,qEAAqE;AACrE,qBAAa,0BAA2B,YAAW,YAAY;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,kBAAkB;IAEpD,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;CAwF5E"}

package/dist/application/rules/npm-workspace-dependency-rule.js

@@ -0,0 +1,155 @@
+import { matchesPathPattern } from "../services/path-pattern.js";
+import { PackageDependencyRule } from "./package-dependency-rule.js";
+const rootManifestPath = "package.json";
+const manifestSuffix = "/package.json";
+/** npm workspaces에 속한 변경 manifest를 찾아 기존 직접 dependency 규칙으로 분석한다. */
+export class NpmWorkspaceDependencyRule {
+    snapshots;
+    constructor(snapshots) {
+        this.snapshots = snapshots;
+    }
+    async analyze(context) {
+        const manifestChanges = context.changes.files.filter(isNestedManifestChange);
+        const rootChanged = context.changes.files.some((change) => change.path === rootManifestPath || change.previousPath === rootManifestPath);
+        if (manifestChanges.length === 0 && !rootChanged) {
+            return [];
+        }
+        const snapshot = await this.snapshots.read(context.target, rootManifestPath);
+        const before = parseWorkspaceConfig(snapshot.before);
+        const after = parseWorkspaceConfig(snapshot.after);
+        const errors = [
+            ...(!before.ok ? [configFinding("base", before)] : []),
+            ...(!after.ok ? [configFinding("current", after)] : []),
+        ];
+        if (errors.length > 0) {
+            return errors;
+        }
+        if (!before.ok || !after.ok) {
+            return [];
+        }
+        const findings = [];
+        if (rootChanged && JSON.stringify(before.patterns) !== JSON.stringify(after.patterns)) {
+            findings.push({
+                ruleId: "dependency/workspace-config-changed",
+                severity: "low",
+                title: "npm workspace configuration changed",
+                description: "The root package.json workspace patterns changed.",
+                file: rootManifestPath,
+                evidence: {
+                    from: JSON.stringify(before.patterns),
+                    to: JSON.stringify(after.patterns),
+                },
+            });
+        }
+        const results = await Promise.all(manifestChanges.map(async (change) => {
+            const previousPath = change.kind === "renamed" ? (change.previousPath ?? change.path) : change.path;
+            const currentPath = change.path;
+            const wasWorkspace = change.kind !== "added" &&
+                change.kind !== "copied" &&
+                isConfiguredWorkspace(previousPath, before.patterns);
+            const isWorkspace = change.kind !== "deleted" && isConfiguredWorkspace(currentPath, after.patterns);
+            if (!wasWorkspace && !isWorkspace) {
+                return [];
+            }
+            const manifestPath = isNestedManifestPath(currentPath) ? currentPath : previousPath;
+            const workspacePath = manifestPath.slice(0, -manifestSuffix.length);
+            const membershipFinding = change.kind === "renamed" && wasWorkspace !== isWorkspace
+                ? [
+                    {
+                        ruleId: "dependency/workspace-membership-changed",
+                        severity: "low",
+                        title: "npm workspace membership changed",
+                        description: `${previousPath} moved to ${currentPath}, changing workspace membership.`,
+                        file: currentPath,
+                        evidence: {
+                            previousPath,
+                            currentPath,
+                            fromWorkspace: wasWorkspace,
+                            toWorkspace: isWorkspace,
+                        },
+                    },
+                ]
+                : [];
+            const dependencyFindings = await new PackageDependencyRule(this.snapshots, manifestPath).analyze(context);
+            return [
+                ...membershipFinding,
+                ...dependencyFindings.map((finding) => ({
+                    ...finding,
+                    evidence: { ...finding.evidence, workspace: workspacePath },
+                })),
+            ];
+        }));
+        return [...findings, ...results.flat()];
+    }
+}
+function isNestedManifestChange(change) {
+    return isNestedManifestPath(change.path) || isNestedManifestPath(change.previousPath);
+}
+function isNestedManifestPath(path) {
+    return path?.endsWith(manifestSuffix) === true;
+}
+function isConfiguredWorkspace(path, patterns) {
+    if (!isNestedManifestPath(path)) {
+        return false;
+    }
+    const directory = path.slice(0, -manifestSuffix.length);
+    return patterns.some((pattern) => matchesPathPattern(directory, pattern));
+}
+function parseWorkspaceConfig(content) {
+    if (content === undefined) {
+        return { ok: true, patterns: [] };
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(content);
+    }
+    catch {
+        return { ok: false, kind: "invalid", reason: "The root package.json is not valid JSON." };
+    }
+    if (!isRecord(manifest)) {
+        return { ok: false, kind: "invalid", reason: "The root package.json must be an object." };
+    }
+    if (manifest.workspaces === undefined) {
+        return { ok: true, patterns: [] };
+    }
+    if (!Array.isArray(manifest.workspaces)) {
+        return { ok: false, kind: "invalid", reason: "workspaces must be an array of paths." };
+    }
+    const patterns = [];
+    for (const rawPattern of manifest.workspaces) {
+        if (typeof rawPattern !== "string" || rawPattern.trim().length === 0) {
+            return { ok: false, kind: "invalid", reason: "Each workspace path must be a string." };
+        }
+        const pattern = rawPattern.replace(/^(\.\/)+/, "").replace(/\/+$/, "");
+        if (pattern.length === 0 || pattern.startsWith("/") || pattern.split("/").includes("..")) {
+            return { ok: false, kind: "invalid", reason: `Invalid workspace path: ${rawPattern}.` };
+        }
+        if (["!", "{", "}", "[", "]", "\\"].some((character) => pattern.includes(character))) {
+            return {
+                ok: false,
+                kind: "unsupported",
+                reason: `Unsupported workspace pattern: ${rawPattern}. Only *, **, and ? globs are supported.`,
+            };
+        }
+        patterns.push(pattern);
+    }
+    return { ok: true, patterns };
+}
+function configFinding(side, result) {
+    return {
+        ruleId: result.kind === "invalid"
+            ? "dependency/invalid-workspace-config"
+            : "dependency/unsupported-workspace-pattern",
+        severity: result.kind === "invalid" ? "high" : "low",
+        title: result.kind === "invalid"
+            ? "Invalid npm workspace configuration"
+            : "Unsupported npm workspace pattern",
+        description: `Could not analyze the ${side} npm workspaces: ${result.reason}`,
+        file: rootManifestPath,
+        evidence: { side, reason: result.reason },
+    };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=npm-workspace-dependency-rule.js.map