intentpatch 0.8.0 → 0.9.1

package/README.ko.md

@@ -19,16 +19,36 @@ IntentPatch는 이러한 질문에 답하기 위해 **Git diff, 정적 분석,
 LLM 없이도 재현 가능한 분석을 제공하고, AI 설명 기능은 선택적으로 결합하는 것을 목표로
 합니다.
 
+## 실제 보고서 바로 보기
+
+저장소를 복제한 뒤 실제 커밋 하나를 분석하는 명령을 실행합니다.
+
+```bash
+git clone https://github.com/xx2xxjaeil/intent-patch.git
+cd intent-patch
+npx --yes intentpatch@0.9.1 analyze --base '1cc489b^' --head 1cc489b --format html --output intentpatch-report.html
+```
+
+생성된 `intentpatch-report.html`을 로컬 브라우저에서 여세요. 이 변경에서는 나중에 수정된
+공개 API 위험과 중복 코드 후보가 보고됩니다. 판단 근거는 [실제 변경 사례](./docs/real-world-evaluation.md)에
+정리했고, [저장된 HTML 보고서](./docs/examples/intent-input-change.html)도 확인할 수 있습니다.
+GitHub에서는 HTML 화면 대신 소스가 보일 수 있습니다.
+
 ## 빠른 시작
 
-Node.js 20 이상과 Git이 설치되어 있어야 합니다. npm에 공개된 v0.8.0은 전역 설치 없이
-실행할 수 있습니다.
+Node.js 20 이상과 Git이 설치되어 있어야 합니다. 분석할 저장소에서 npm에 공개된 v0.9.1을
+전역 설치 없이 실행할 수 있습니다.
 
 ```bash
-npx intentpatch analyze --cwd /path/to/repository
-npx intentpatch analyze --format html --output intentpatch-report.html
+cd /path/to/repository
+npx intentpatch analyze
+npx intentpatch analyze --format html --output ../intentpatch-report.html
 ```
 
+처음 실행하는 경우 [첫 실행 안내](./docs/first-run.md)의 `init → analyze → HTML` 순서와
+오류별 확인 방법을 참고하세요. HTML finding에서 해당 파일의 제한된 Git diff 미리보기로
+이동할 수 있습니다.
+
 현재 소스 버전을 실행하려면 저장소를 빌드합니다.
 
 ```bash
@@ -67,7 +87,7 @@ jobs:
 
       - name: Analyze pull request
         id: intentpatch
-        uses: xx2xxjaeil/intent-patch@v0.8.0
+        uses: xx2xxjaeil/intent-patch@v0.9.1
         with:
           fail-on: high
 
@@ -79,8 +99,10 @@ jobs:
           path: intentpatch-report
 ```
 
-Action은 릴리스 버전이나 불변 commit SHA로 고정하는 방식을 권장합니다. v0.8.0에는 Yarn 4
-lockfile 분석, 소스와 테스트의 명시적 연결, 보고서 필터와 영향 그래프 탐색 개선이 포함됩니다.
+Action은 릴리스 버전이나 불변 commit SHA로 고정하는 방식을 권장합니다. v0.9.1에는 HTML diff
+미리보기, 확대된 외부 평가와 정적 CommonJS 이름 export 삭제 탐지가 포함됩니다. v0.9.0에는 Yarn
+workspace dependency 분석과 Change Contract를 안전하게 만드는 `init` 명령이 추가되었습니다.
+Yarn 4 lockfile 분석, 소스와 테스트의 명시적 연결, 보고서 필터와 영향 그래프 탐색 개선,
 패키지 진입점 기준 공개 API 경고, 삭제된 모듈의 이전 import 영향 분석, 선택적 Claude Code·Codex·Cursor
 Hook도 사용할 수 있습니다. 공개 API 규칙의 별도 외부 평가 결과와 한계는
 [평가 보고서](./docs/external-repository-evaluation.md)에 기록했습니다. `@main`은 미릴리스 변경을 따라갑니다.
@@ -141,15 +163,15 @@ LOW     구현체가 하나뿐인 추상화 추가
 
 실제 커밋을 분석한 [독립 실행형 HTML 예시](./docs/examples/intent-input-change.html),
 [자체 저장소 변경 3건의 사례 연구](./docs/real-world-evaluation.md),
-[외부 저장소 변경 32건·규칙별 판정 38건의 평가 결과](./docs/external-repository-evaluation.md)를 볼 수 있습니다. 저장소를 clone한
+[외부 저장소 변경 36건·규칙별 판정 43건의 평가 결과](./docs/external-repository-evaluation.md)를 볼 수 있습니다. 저장소를 clone한
 뒤 HTML 파일을 브라우저에서 열어 주세요. GitHub 파일 화면은 렌더링 대신 소스를 보여줄 수
 있습니다.
 
 ## 현재 구현된 기능
 
-현재 소스는 Git 변경사항 수집, 루트·npm workspace `package.json`의 직접 dependency와 npm lockfile 분석, TypeScript
-최상위 TypeScript·JavaScript 심볼과 공개 export 변경 분석, 기존 구현 중복·단일 구현 추상화 신호, import graph 기반
-영향 범위와 테스트 동반 변경 분석을 제공합니다.
+CLI는 Git 변경사항, 루트 및 npm·pnpm·Yarn workspace manifest의 직접 dependency,
+lockfile 변경, 최상위 TypeScript·JavaScript 심볼과 공개 export, 기존 구현 중복·단일 구현
+추상화 신호, import graph 기반 영향 범위와 테스트 동반 변경을 분석합니다.
 
 - `HEAD`와 현재 working tree 비교
 - 두 Git reference 또는 브랜치 비교
@@ -170,6 +192,7 @@ LOW     구현체가 하나뿐인 추상화 추가
 - pnpm `pnpm-lock.yaml` v9의 레지스트리 패키지 추가·삭제·버전 변경 비교(2개 문서 형식 포함)
 - 잘못되었거나 미지원인 lockfile을 누락하지 않고 finding으로 보고
 - 루트 `workspaces` 패턴에 속한 변경 manifest의 직접 dependency를 workspace별로 보고
+- 루트 `workspaces` 패턴에 속한 Yarn workspace manifest 변경도 분석하고 Yarn 근거를 표시
 - `pnpm-workspace.yaml`의 포함·제외 패턴에 속한 변경 manifest의 직접 dependency를 보고
 - workspace 설정 변경과 manifest의 workspace 안팎 이동을 탐지
 - finding 심각도(`high`, `medium`, `low`) 집계
@@ -263,6 +286,21 @@ intentpatch analyze --intent-file request.md --format html --output report.html
 
 ### Change Contract로 요청 범위 검사
 
+`intentpatch init` 명령은 기존 파일을 덮어쓰지 않고 `.intentpatch.json`을 생성합니다.
+자연어 요청만으로 경로를 추측하지 않으므로 이번 작업의 실제 경로를 전달하세요.
+
+```bash
+intentpatch init \
+  --intent "회원 탈퇴 기능 구현" \
+  --include 'src/user/**' --include 'tests/user/**' \
+  --allow package.json \
+  --test-source 'src/**/*.ts' --test-file 'tests/**/*.test.ts'
+```
+
+인자 없이 실행하면 비어 있지만 유효한 계약을 생성합니다. `scope.include` 경로를 지정하기
+전까지 범위 검사는 꺼져 있고, 테스트 변경 검사는 `--test-source`와 `--test-file`을 함께
+지정해야 켜집니다. 다른 디렉터리는 `--cwd`로 지정합니다. 이 명령은 v0.9.0부터 제공됩니다.
+
 분석할 저장소의 `.intentpatch.json`에 이번 요청의 기대 범위를 선언할 수 있습니다.
 
 ```json
@@ -427,7 +465,7 @@ npm run check
 - 생성한 npm tarball을 임시 프로젝트에 설치하고 실행하는 패키지 통합 테스트
 - 계층 간 의존 방향을 검증하는 아키텍처 테스트
 
-외부 저장소의 실제 변경 32건에서 공개 API·의존성·범위·테스트 규칙의 경고를 사람이 검토한 기대 결과와 비교하는
+외부 저장소의 실제 변경 36건에서 공개 API·의존성·범위·테스트 규칙의 경고를 사람이 검토한 기대 결과와 비교하는
 방법은 [외부 저장소 평가 문서](./docs/external-repository-evaluation.md)에 정리했습니다.
 
 프로덕션 빌드만 확인하려면 다음 명령을 사용합니다.
@@ -444,7 +482,7 @@ npm pack --dry-run
 
 ## 릴리스
 
-`v0.8.0`처럼 `package.json` 버전과 일치하는 태그를 기본 브랜치의 커밋에 push하면 릴리스
+`v0.9.1`처럼 `package.json` 버전과 일치하는 태그를 기본 브랜치의 커밋에 push하면 릴리스
 워크플로가 다음 작업을 순서대로 수행합니다.
 
 1. 태그·버전·기본 브랜치 포함 여부 검증
@@ -472,7 +510,7 @@ npm provenance가 자동 생성됩니다. 아직 npm에 존재하지 않는 신
    - ✅ pnpm `pnpm-lock.yaml` v9의 레지스트리 패키지 변경
    - ✅ pnpm workspace manifest의 직접 dependency 변경
    - ✅ Yarn 4 metadata-v8 `yarn.lock` 레지스트리 패키지 변경
-   - Yarn workspace manifest 변경은 미구현
+   - ✅ Yarn workspace manifest의 직접 dependency 변경
 7. ✅ 직접 export된 공개 심볼 삭제와 export 해제 탐지
    - ✅ JavaScript ESM의 이름 있는 export·default export 삭제 탐지
 8. ✅ 단일 HTML 대시보드와 SVG 기반 dependency 영향 그래프
@@ -490,7 +528,7 @@ npm provenance가 자동 생성됩니다. 아직 npm에 존재하지 않는 신
 - 분석 대상은 최소 한 번 이상 커밋된 Git 저장소여야 합니다.
 - untracked symbolic link는 안전을 위해 내용을 읽지 않습니다.
 - 10 MiB를 초과하는 untracked 파일은 라인 수를 측정하지 않습니다.
-- 직접 dependency 선언 분석은 저장소 루트와 변경된 npm·pnpm workspace `package.json`의
+- 직접 dependency 선언 분석은 저장소 루트와 변경된 npm·pnpm·Yarn workspace `package.json`의
   `dependencies`와 `devDependencies`를 대상으로 합니다.
 - 정적 참조 없음 finding은 미사용 확정이 아닌 검토 후보입니다. 유지보수 대상 JS/TS
   소스의 명시적 import·re-export·문자열 `require()`·`import()`를 살펴봅니다. CLI나 설정
@@ -501,8 +539,10 @@ npm provenance가 자동 생성됩니다. 아직 npm에 존재하지 않는 신
 - pnpm `pnpm-lock.yaml` v9은 프로젝트 문서의 레지스트리 패키지 ID와 버전을 비교합니다.
   integrity만 바뀐 경우, 로컬·Git 패키지, snapshot의 peer 변형, 부모 dependency 귀속은 분석하지 않습니다.
   루트의 직접 dependency 여부는 루트 importer를 기준으로 표시합니다.
-- workspace 판별은 루트의 npm `workspaces` 배열과 명시 경로, `*`·`**`·`?` 패턴을 지원합니다.
+- npm·Yarn workspace 판별은 루트의 `workspaces` 배열과 명시 경로, `*`·`**`·`?` 패턴을 지원합니다.
   부정·중괄호·문자 클래스 패턴은 미지원 finding으로 보고합니다.
+- Yarn 여부는 루트 `packageManager` 또는 `yarn.lock`으로 구분합니다. pnpm 설정이 함께
+  있으면 중복 보고를 막기 위해 pnpm을 우선합니다.
 - pnpm workspace는 `pnpm-workspace.yaml`의 `packages`에 명시한 `*`·`**`·`?`와 선행 `!`
   제외 패턴을 지원합니다. npm 설정이 함께 있으면 중복 보고를 막기 위해 pnpm 설정을
   우선합니다. 그 외 glob 문법과 catalog는 해석하지 않습니다.
@@ -515,16 +555,16 @@ npm provenance가 자동 생성됩니다. 아직 npm에 존재하지 않는 신
 - TypeScript 심볼 분석은 `.ts`와 `.tsx`의 이름이 있는 최상위 함수, 클래스, 인터페이스, 타입
   별칭만 지원합니다.
 - JavaScript 심볼 분석은 `.js`·`.jsx`·`.mjs`·`.cjs`의 최상위 함수·클래스·변수 및 식별 가능한
-  ESM export를 추적합니다. CommonJS `module.exports`는 아직 공개 API 분석 대상이 아닙니다.
+  ESM export와 최상위의 정적 `exports.name =`·`module.exports.name =` 할당을 추적합니다.
 - TypeScript 공개 API 분석은 이름이 있는 최상위 함수·인터페이스와 객체 리터럴, 같은 파일의
   비제네릭 별칭·교집합으로 구성된 공개 타입 별칭의 구성원 삭제를 지원합니다. 로컬
   `export { name }`, 외부 `export { name } from`, `export * from`은 export 근거로 추적합니다.
-  JavaScript는 이름 있는 ESM export와 default export 삭제를 탐지하지만 함수의 타입 호환성을
+  JavaScript는 이름 있는 ESM export·default export와 정적 CommonJS 이름 삭제를 탐지하지만 함수의 타입 호환성을
   추정하지 않습니다. 변경 전 루트·하위 패키지의 `exports`가 소스 파일을 직접 가리키면 공개
   진입점과 상대 경로 re-export가 도달하는 파일에만 공개 API 경고를 냅니다. 이는 파일 단위
   근사치로, 이름 있는 re-export가 파일의 일부 심볼만 노출하는 경우도 있습니다. 생성된
   진입점이나 해석 불가능한 경로에서는 비공개라고 단정하지 않고 기존 경고를 유지합니다.
-  CommonJS `module.exports`, 클래스 계약, 제네릭 별칭 인스턴스화, 합집합, 파일 간 타입 참조와
+  CommonJS 객체 전체 대입·동적 속성·중첩 대입, 클래스 계약, 제네릭 별칭 인스턴스화, 합집합, 파일 간 타입 참조와
   완전한 타입 할당 가능성은 해석하지 않습니다. 지원하지
   않는 타입 별칭 형태에서는 구성원 삭제 finding을 내지 않습니다.
 - 함수 호환성은 먼저 기록된 시그니처를 비교하고, 외부 참조 없이 해석할 수 있는 명시적 타입은

package/README.md

@@ -16,16 +16,35 @@ AI coding agents such as Codex, Claude Code, and Cursor can change many files fr
 
 IntentPatch combines **Git diff analysis, static analysis, and dependency analysis** to answer those questions. Its core analysis is deterministic and works without an LLM. Optional AI explanations can be added later without making the core tool dependent on a model provider.
 
+## See a real report
+
+Clone the repository, then run one analysis command against a real change in its history:
+
+```bash
+git clone https://github.com/xx2xxjaeil/intent-patch.git
+cd intent-patch
+npx --yes intentpatch@0.9.1 analyze --base '1cc489b^' --head 1cc489b --format html --output intentpatch-report.html
+```
+
+Open `intentpatch-report.html` locally. This case reports a public-API risk and a duplicate-code
+candidate that were later fixed; [the case study](./docs/real-world-evaluation.md) explains the
+review decisions. The [checked-in HTML report](./docs/examples/intent-input-change.html) is the
+same real-change example, not a mockup. GitHub may show the HTML source rather than render it.
+
 ## Quick start
 
-IntentPatch requires Node.js 20 or later and Git. Run the published v0.8.0 CLI without
-installing it globally:
+IntentPatch requires Node.js 20 or later and Git. From the repository you want to review, run
+the published v0.9.1 CLI without installing it globally:
 
 ```bash
-npx intentpatch analyze --cwd /path/to/repository
-npx intentpatch analyze --format html --output intentpatch-report.html
+cd /path/to/repository
+npx intentpatch analyze
+npx intentpatch analyze --format html --output ../intentpatch-report.html
 ```
 
+For the complete `init → analyze → HTML` walkthrough and common errors, see the
+[first-run guide](./docs/first-run.md). HTML findings link to bounded local Git diff previews.
+
 To run the current source version instead, build it from the repository:
 
 ```bash
@@ -62,7 +81,7 @@ jobs:
 
       - name: Analyze pull request
         id: intentpatch
-        uses: xx2xxjaeil/intent-patch@v0.8.0
+        uses: xx2xxjaeil/intent-patch@v0.9.1
         with:
           fail-on: high
 
@@ -74,10 +93,12 @@ jobs:
           path: intentpatch-report
 ```
 
-Pin the action to a released version or an immutable commit SHA. v0.8.0 adds Yarn 4
-lockfile analysis, explicit source-to-test mappings, report filters, and improved impact-graph
-navigation. It also includes package-entrypoint-aware public API warnings, historical import
-impact for deleted modules, and opt-in Claude Code, Codex, and Cursor Hooks.
+Pin the action to a released version or an immutable commit SHA. v0.9.1 adds HTML diff previews,
+expanded external evaluation, and static CommonJS named-export removal checks. v0.9.0 added Yarn workspace
+dependency analysis and a safe `init` command for creating a Change Contract. It also includes
+Yarn 4 lockfile analysis, explicit source-to-test mappings, report filters, improved impact-graph
+navigation, package-entrypoint-aware public API warnings, historical import impact for deleted
+modules, and opt-in Claude Code, Codex, and Cursor Hooks.
 See [the evaluation report](./docs/external-repository-evaluation.md) for the separately measured
 public-API rules and their limits. `@main` follows unreleased changes.
 
@@ -137,12 +158,14 @@ Every finding includes the relevant file, a stable rule ID, and evidence for the
 For reports generated from actual commits, see the
 [standalone HTML example](./docs/examples/intent-input-change.html), the
 [three-case self-repository study](./docs/real-world-evaluation.md), and the
-[external evaluation of 32 changes and 38 rule checks](./docs/external-repository-evaluation.md). After cloning,
+[external evaluation of 36 changes and 43 rule checks](./docs/external-repository-evaluation.md). After cloning,
 open the HTML file locally in a browser; GitHub may show its source rather than render it.
 
 ## Implemented capabilities
 
-The current source tree analyzes Git changes, direct dependencies in the root `package.json`, top-level TypeScript and JavaScript symbols and public exports, possible duplicate implementations, single-implementation abstractions, import-graph impact, and related test changes.
+The CLI analyzes Git changes, direct dependencies in the root and npm/pnpm/Yarn workspace manifests,
+lockfile changes, top-level TypeScript and JavaScript symbols and public exports, possible duplicate
+implementations, single-implementation abstractions, import-graph impact, and related test changes.
 
 ### Git and reporting
 
@@ -170,6 +193,7 @@ The current source tree analyzes Git changes, direct dependencies in the root `p
 - Compare resolved registry package changes in pnpm `pnpm-lock.yaml` v9, including two-document lockfiles.
 - Report malformed or unsupported lockfiles as findings rather than silently skipping them.
 - Attribute direct dependency changes to changed npm workspace manifests selected by the root `workspaces` patterns.
+- Attribute changed Yarn workspace manifests using the same root `workspaces` patterns, with Yarn provenance when `packageManager` or `yarn.lock` identifies Yarn.
 - Analyze changed pnpm workspace manifests selected by `pnpm-workspace.yaml`, including exclusion patterns.
 - Report changes to workspace patterns and manifest moves into or out of a configured workspace.
 - Extract top-level named functions, classes, interfaces, and type aliases from `.ts` and `.tsx` files.
@@ -256,6 +280,22 @@ intentpatch analyze --intent-file request.md --format html --output report.html
 
 ### Check request scope with a Change Contract
 
+`intentpatch init` creates `.intentpatch.json` without overwriting an
+existing file. Supply actual paths for the requested change; it never guesses scope from the
+request text:
+
+```bash
+intentpatch init \
+  --intent "Implement account deletion" \
+  --include 'src/user/**' --include 'tests/user/**' \
+  --allow package.json \
+  --test-source 'src/**/*.ts' --test-file 'tests/**/*.test.ts'
+```
+
+`init` with no options creates a valid blank contract. Scope checks remain off until you add an
+expected `--include` path; test-change checks require both `--test-source` and `--test-file`.
+Use `--cwd` to target another directory. This command is included in v0.9.0 and later.
+
 Create `.intentpatch.json` in the repository being analyzed and declare the expected scope of the request:
 
 ```json
@@ -422,7 +462,7 @@ This command runs:
 - architecture tests that enforce dependency direction;
 - a reproducibility check for the bundled GitHub Action.
 
-For a reproducible check of 38 rule decisions across 32 reviewed changes in external
+For a reproducible check of 43 rule decisions across 36 reviewed changes in external
 repositories, see the [external evaluation](./docs/external-repository-evaluation.md).
 
 Run only the production build with:
@@ -439,7 +479,7 @@ npm pack --dry-run
 
 ## Release process
 
-Pushing a tag such as `v0.8.0`, matching the version in `package.json`, from a commit contained in the default branch triggers the release workflow:
+Pushing a tag such as `v0.9.1`, matching the version in `package.json`, from a commit contained in the default branch triggers the release workflow:
 
 1. Validate the tag, package version, and default-branch ancestry.
 2. Run the full quality suite and inspect the npm package with a dry run.
@@ -463,7 +503,7 @@ No long-lived npm token is stored as a GitHub secret. Public packages published
    - ✅ pnpm `pnpm-lock.yaml` v9 resolved registry package changes
    - ✅ pnpm workspace manifest dependency changes
    - ✅ Yarn 4 metadata-v8 `yarn.lock` resolved registry package changes
-   - Yarn workspace manifest changes remain open
+   - ✅ Yarn workspace manifest dependency changes
 7. ✅ Detection of removed public exports
    - ✅ Named and default ESM exports in JavaScript, without inferred type compatibility
 8. ✅ Standalone HTML dashboard and SVG dependency-impact graph
@@ -481,11 +521,11 @@ No long-lived npm token is stored as a GitHub secret. Public packages published
 - The target must be a Git repository with at least one commit.
 - Untracked symbolic links are not read for safety.
 - Line counts are skipped for untracked files larger than 10 MiB.
-- Direct dependency declarations are analyzed from `dependencies` and `devDependencies` in the root `package.json` and changed npm/pnpm workspace manifests.
+- Direct dependency declarations are analyzed from `dependencies` and `devDependencies` in the root `package.json` and changed npm/pnpm/Yarn workspace manifests.
 - The no-static-reference finding is a review candidate, not proof that a package is unused. It checks explicit JS/TS imports, re-exports, literal `require()` and `import()` across maintained source files; CLI-only/configuration usage may not appear. It does not emit a candidate if source reads or parsing are incomplete, a computed module load exists, no source was scanned, or more than 5,000 source files are present.
 - npm `package-lock.json` v2/v3 analysis compares installed package paths and versions, not dependency provenance, integrity hashes, or vulnerability data. It does not attribute transitive packages to their parents.
 - pnpm `pnpm-lock.yaml` v9 analysis compares registry package IDs and versions in the project document. It ignores integrity-only edits, local/Git packages, snapshot peer variants, and dependency provenance. Root-direct evidence comes from the root importer only.
-- Workspace detection supports the root npm `workspaces` array with explicit paths and `*`, `**`, and `?` globs. Negation, brace, and character-class patterns are reported as unsupported.
+- npm and Yarn workspace detection supports the root `workspaces` array with explicit paths and `*`, `**`, and `?` globs. Negation, brace, and character-class patterns are reported as unsupported. Yarn is identified by the root `packageManager` field or `yarn.lock`; when pnpm config also exists, pnpm takes precedence.
 - pnpm workspace detection reads `pnpm-workspace.yaml` `packages` patterns with `*`, `**`, `?`, and leading `!` exclusions. When both npm and pnpm workspace settings exist, pnpm settings take precedence to avoid duplicate findings. Other glob features and pnpm catalogs are not interpreted.
 - Yarn 4 `yarn.lock` metadata-v8 analysis compares registry package resolutions and versions.
   Yarn Classic and other metadata versions are reported as unsupported. Workspace, patch, file,
@@ -493,7 +533,7 @@ No long-lived npm token is stored as a GitHub secret. Public packages published
   Runtime dependency usage is not established.
 - Working-tree `package-lock.json`, `pnpm-lock.yaml`, and `yarn.lock` files are limited to 10 MiB; other text snapshots retain the 1 MiB limit.
 - TypeScript symbol analysis supports named top-level functions, classes, interfaces, and type aliases in `.ts` and `.tsx` files. JavaScript symbol analysis supports named top-level functions, classes, variables, and identifiable ESM exports in `.js`, `.jsx`, `.mjs`, and `.cjs` files.
-- TypeScript public API analysis supports named top-level functions and interfaces, plus member removal from exported object type aliases composed of type literals and same-file, non-generic aliases/intersections. Local `export { name }`, external `export { name } from`, and `export * from` are tracked as export evidence. JavaScript supports identifiable named and default ESM export removal, but does not infer function signatures. Previous root or nested package `exports` are followed through explicit source targets and relative re-exports. This is a file-level approximation: a named re-export may still expose only some symbols from its module. If an entrypoint is generated, unresolved, or unsupported, IntentPatch retains the earlier conservative warnings instead of claiming a file is private. CommonJS `module.exports`, class contracts, generic alias instantiation, unions, cross-file type references, and full type assignability are not interpreted yet. Unsupported type-alias shapes do not produce member-removal findings.
+- TypeScript public API analysis supports named top-level functions and interfaces, plus member removal from exported object type aliases composed of type literals and same-file, non-generic aliases/intersections. Local `export { name }`, external `export { name } from`, and `export * from` are tracked as export evidence. JavaScript supports identifiable named and default ESM export removal and static top-level `exports.name =` / `module.exports.name =` removal, but does not infer function signatures. Previous root or nested package `exports` are followed through explicit source targets and relative re-exports. This is a file-level approximation: a named re-export may still expose only some symbols from its module. If an entrypoint is generated, unresolved, or unsupported, IntentPatch retains the earlier conservative warnings instead of claiming a file is private. Whole-object CommonJS assignments, dynamic keys, nested assignments, class contracts, generic alias instantiation, unions, cross-file type references, and full type assignability are not interpreted yet. Unsupported type-alias shapes do not produce member-removal findings.
 - Function compatibility first compares recorded signatures. For self-contained, explicitly typed declarations it then uses strict TypeScript assignability to avoid warning on compatible changes. A narrow syntactic check also accepts primitive parameters widened by union arms when the return text is unchanged. Other unresolved names, inferred types, malformed or unsupported signature shapes remain unverified and keep the review warning; this is not a whole-project type check or a runtime compatibility guarantee.
 - Interface property compatibility recognizes unchanged types and optional fields added inside
   supported object literals, including `Readonly` wrappers. Other nested type transformations

package/dist/application/rules/added-dependency-usage-rule.js

@@ -1,6 +1,6 @@
 import { isMaintainedSourcePath } from "../services/is-maintained-source-path.js";
-import { NpmWorkspaceDependencyRule } from "./npm-workspace-dependency-rule.js";
 import { PackageDependencyRule } from "./package-dependency-rule.js";
+import { PackageJsonWorkspaceDependencyRule } from "./package-json-workspace-dependency-rule.js";
 import { PnpmWorkspaceDependencyRule } from "./pnpm-workspace-dependency-rule.js";
 const rootManifest = "package.json";
 /** 새 직접 dependency의 정적 소스 참조가 없을 때만 검토 후보를 제시한다. */
@@ -18,7 +18,7 @@ export class AddedDependencyUsageRule {
     async analyze(context) {
         const manifestFindings = (await Promise.all([
             new PackageDependencyRule(this.snapshots, rootManifest).analyze(context),
-            new NpmWorkspaceDependencyRule(this.snapshots).analyze(context),
+            new PackageJsonWorkspaceDependencyRule(this.snapshots).analyze(context),
             new PnpmWorkspaceDependencyRule(this.snapshots, this.pnpmWorkspaceParser).analyze(context),
         ])).flat();
         const added = manifestFindings.filter((finding) => finding.ruleId === "dependency/new-production" ||

package/dist/application/rules/added-dependency-usage-rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"added-dependency-usage-rule.js","sourceRoot":"","sources":["../../../src/application/rules/added-dependency-usage-rule.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF,MAAM,YAAY,GAAG,cAAc,CAAC;AACpC,oDAAoD;AACpD,MAAM,OAAO,wBAAwB;IAEhB;IACA;IACA;IACA;IAJnB,YACmB,SAA6B,EAC7B,KAAwB,EACxB,SAAmC,EACnC,mBAAwC;QAHxC,cAAS,GAAT,SAAS,CAAoB;QAC7B,UAAK,GAAL,KAAK,CAAmB;QACxB,cAAS,GAAT,SAAS,CAA0B;QACnC,wBAAmB,GAAnB,mBAAmB,CAAqB;IACxD,CAAC;IAEG,KAAK,CAAC,OAAO,CAAC,OAAwB;QAC3C,MAAM,gBAAgB,GAAG,CACvB,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YACxE,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/D,IAAI,2BAA2B,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3F,CAAC,CACH,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CACnC,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,2BAA2B;YAC9C,OAAO,CAAC,MAAM,KAAK,4BAA4B,CAClD,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAElC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAC/D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CACxE,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,EAAE,CAAC;QAC1D,IAAI,QAAQ,GAAG,IAAI,CAAC;QAEpB,sDAAsD;QACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,QAAQ,GAAG,KAAK,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;gBAC7E,QAAQ,GAAG,KAAK,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC9C,MAAM,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,WAAW,KAAK,SAAS;oBAAE,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEzB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC;YAChE,OAAO;gBACL;oBACE,MAAM,EAAE,gCAAgC;oBACxC,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,+CAA+C;oBACtD,WAAW,EAAE,GAAG,IAAI,iBAAiB,OAAO,CAAC,IAAI,gHAAgH;oBACjK,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,QAAQ,EAAE;wBACR,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;wBACzC,YAAY,EAAE,KAAK,CAAC,MAAM;wBAC1B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;4BAC1C,CAAC,CAAC,EAAE;4BACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;wBAC9C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS;4BAC/C,CAAC,CAAC,EAAE;4BACJ,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;qBACzD;iBACgB;aACpB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,SAAiB;IACjD,IACE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QAE7B,OAAO,SAAS,CAAC;IACnB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"added-dependency-usage-rule.js","sourceRoot":"","sources":["../../../src/application/rules/added-dependency-usage-rule.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,kCAAkC,EAAE,MAAM,6CAA6C,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF,MAAM,YAAY,GAAG,cAAc,CAAC;AACpC,oDAAoD;AACpD,MAAM,OAAO,wBAAwB;IAEhB;IACA;IACA;IACA;IAJnB,YACmB,SAA6B,EAC7B,KAAwB,EACxB,SAAmC,EACnC,mBAAwC;QAHxC,cAAS,GAAT,SAAS,CAAoB;QAC7B,UAAK,GAAL,KAAK,CAAmB;QACxB,cAAS,GAAT,SAAS,CAA0B;QACnC,wBAAmB,GAAnB,mBAAmB,CAAqB;IACxD,CAAC;IAEG,KAAK,CAAC,OAAO,CAAC,OAAwB;QAC3C,MAAM,gBAAgB,GAAG,CACvB,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YACxE,IAAI,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YACvE,IAAI,2BAA2B,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3F,CAAC,CACH,CAAC,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CACnC,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,2BAA2B;YAC9C,OAAO,CAAC,MAAM,KAAK,4BAA4B,CAClD,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAElC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAC/D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CACxE,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,EAAE,CAAC;QAC1D,IAAI,QAAQ,GAAG,IAAI,CAAC;QAEpB,sDAAsD;QACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,QAAQ,GAAG,KAAK,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;gBAC7E,QAAQ,GAAG,KAAK,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC9C,MAAM,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,WAAW,KAAK,SAAS;oBAAE,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEzB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC;YAChE,OAAO;gBACL;oBACE,MAAM,EAAE,gCAAgC;oBACxC,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,+CAA+C;oBACtD,WAAW,EAAE,GAAG,IAAI,iBAAiB,OAAO,CAAC,IAAI,gHAAgH;oBACjK,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,QAAQ,EAAE;wBACR,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;wBACzC,YAAY,EAAE,KAAK,CAAC,MAAM;wBAC1B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;4BAC1C,CAAC,CAAC,EAAE;4BACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;wBAC9C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS;4BAC/C,CAAC,CAAC,EAAE;4BACJ,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;qBACzD;iBACgB;aACpB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,SAAiB;IACjD,IACE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QAE7B,OAAO,SAAS,CAAC;IACnB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC"}

package/dist/application/rules/npm-workspace-dependency-rule.d.ts

@@ -1,7 +1,7 @@
 import type { Finding } from "../../domain/finding.js";
 import type { AnalysisContext, AnalysisRule } from "../ports/analysis-rule.js";
 import type { FileSnapshotSource } from "../ports/file-snapshot-source.js";
-/** npm workspaces에 속한 변경 manifest를 찾아 기존 직접 dependency 규칙으로 분석한다. */
+/** 기존 공개 클래스명을 유지하며 package.json workspaces를 npm 또는 Yarn으로 분류한다. */
 export declare class NpmWorkspaceDependencyRule implements AnalysisRule {
     private readonly snapshots;
     constructor(snapshots: FileSnapshotSource);

package/dist/application/rules/npm-workspace-dependency-rule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm-workspace-dependency-rule.d.ts","sourceRoot":"","sources":["../../../src/application/rules/npm-workspace-dependency-rule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAY3E,qEAAqE;AACrE,qBAAa,0BAA2B,YAAW,YAAY;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,kBAAkB;IAEpD,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;CAsD5E"}
+{"version":3,"file":"npm-workspace-dependency-rule.d.ts","sourceRoot":"","sources":["../../../src/application/rules/npm-workspace-dependency-rule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAY3E,oEAAoE;AACpE,qBAAa,0BAA2B,YAAW,YAAY;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,kBAAkB;IAEpD,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;CA+D5E"}

package/dist/application/rules/npm-workspace-dependency-rule.js

@@ -1,7 +1,7 @@
 import { isRecord } from "../../domain/value-guards.js";
 import { analyzeWorkspaceManifests, isNestedManifestChange, } from "../services/workspace-manifest-analysis.js";
 const rootManifestPath = "package.json";
-/** npm workspaces에 속한 변경 manifest를 찾아 기존 직접 dependency 규칙으로 분석한다. */
+/** 기존 공개 클래스명을 유지하며 package.json workspaces를 npm 또는 Yarn으로 분류한다. */
 export class NpmWorkspaceDependencyRule {
     snapshots;
     constructor(snapshots) {
@@ -13,16 +13,20 @@ export class NpmWorkspaceDependencyRule {
         if (manifestChanges.length === 0 && !rootChanged) {
             return [];
         }
-        // pnpm-workspace.yaml이 있으면 pnpm 설정이 우선한다. 동일 manifest의 finding 중복을 피한다.
+        // pnpm 설정이 있으면 별도 규칙이 담당한다. Yarn lockfile이 있으면 Yarn으로 귀속한다.
         const pnpmConfig = await this.snapshots.read(context.target, "pnpm-workspace.yaml");
         if (pnpmConfig.before !== undefined || pnpmConfig.after !== undefined)
             return [];
         const snapshot = await this.snapshots.read(context.target, rootManifestPath);
         const before = parseWorkspaceConfig(snapshot.before);
         const after = parseWorkspaceConfig(snapshot.after);
+        const yarnLock = await this.snapshots.read(context.target, "yarn.lock");
+        const manager = (after.ok ? after.managerHint : undefined) ??
+            (before.ok ? before.managerHint : undefined) ??
+            (yarnLock.before !== undefined || yarnLock.after !== undefined ? "yarn" : "npm");
         const errors = [
-            ...(!before.ok ? [configFinding("base", before)] : []),
-            ...(!after.ok ? [configFinding("current", after)] : []),
+            ...(!before.ok ? [configFinding("base", before, manager)] : []),
+            ...(!after.ok ? [configFinding("current", after, manager)] : []),
         ];
         if (errors.length > 0) {
             return errors;
@@ -33,20 +37,23 @@ export class NpmWorkspaceDependencyRule {
         const findings = [];
         if (rootChanged && JSON.stringify(before.patterns) !== JSON.stringify(after.patterns)) {
             findings.push({
-                ruleId: "dependency/workspace-config-changed",
+                ruleId: manager === "yarn"
+                    ? "dependency/yarn-workspace-config-changed"
+                    : "dependency/workspace-config-changed",
                 severity: "low",
-                title: "npm workspace configuration changed",
+                title: `${manager} workspace configuration changed`,
                 description: "The root package.json workspace patterns changed.",
                 file: rootManifestPath,
                 evidence: {
                     from: JSON.stringify(before.patterns),
                     to: JSON.stringify(after.patterns),
+                    ...(manager === "yarn" ? { packageManager: manager } : {}),
                 },
             });
         }
         return [
             ...findings,
-            ...(await analyzeWorkspaceManifests(context, this.snapshots, manifestChanges, { includes: before.patterns, excludes: [] }, { includes: after.patterns, excludes: [] }, "npm")),
+            ...(await analyzeWorkspaceManifests(context, this.snapshots, manifestChanges, { includes: before.patterns, excludes: [] }, { includes: after.patterns, excludes: [] }, manager)),
         ];
     }
 }
@@ -64,8 +71,13 @@ function parseWorkspaceConfig(content) {
     if (!isRecord(manifest)) {
         return { ok: false, kind: "invalid", reason: "The root package.json must be an object." };
     }
+    const managerHint = typeof manifest.packageManager === "string" && manifest.packageManager.startsWith("yarn@")
+        ? "yarn"
+        : typeof manifest.packageManager === "string" && manifest.packageManager.startsWith("npm@")
+            ? "npm"
+            : undefined;
     if (manifest.workspaces === undefined) {
-        return { ok: true, patterns: [] };
+        return { ok: true, patterns: [], ...(managerHint === undefined ? {} : { managerHint }) };
     }
     if (!Array.isArray(manifest.workspaces)) {
         return { ok: false, kind: "invalid", reason: "workspaces must be an array of paths." };
@@ -88,20 +100,24 @@ function parseWorkspaceConfig(content) {
         }
         patterns.push(pattern);
     }
-    return { ok: true, patterns };
+    return { ok: true, patterns, ...(managerHint === undefined ? {} : { managerHint }) };
 }
-function configFinding(side, result) {
+function configFinding(side, result, manager) {
     return {
         ruleId: result.kind === "invalid"
             ? "dependency/invalid-workspace-config"
             : "dependency/unsupported-workspace-pattern",
         severity: result.kind === "invalid" ? "high" : "low",
         title: result.kind === "invalid"
-            ? "Invalid npm workspace configuration"
-            : "Unsupported npm workspace pattern",
-        description: `Could not analyze the ${side} npm workspaces: ${result.reason}`,
+            ? `Invalid ${manager} workspace configuration`
+            : `Unsupported ${manager} workspace pattern`,
+        description: `Could not analyze the ${side} ${manager} workspaces: ${result.reason}`,
         file: rootManifestPath,
-        evidence: { side, reason: result.reason },
+        evidence: {
+            side,
+            reason: result.reason,
+            ...(manager === "yarn" ? { packageManager: manager } : {}),
+        },
     };
 }
 //# sourceMappingURL=npm-workspace-dependency-rule.js.map

package/dist/application/rules/npm-workspace-dependency-rule.js.map

@@ -1 +1 @@
-{"version":3,"file":"npm-workspace-dependency-rule.js","sourceRoot":"","sources":["../../../src/application/rules/npm-workspace-dependency-rule.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAGxD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,4CAA4C,CAAC;AAEpD,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAMxC,qEAAqE;AACrE,MAAM,OAAO,0BAA0B;IACD;IAApC,YAAoC,SAA6B;QAA7B,cAAS,GAAT,SAAS,CAAoB;IAAG,CAAC;IAE9D,KAAK,CAAC,OAAO,CAAC,OAAwB;QAC3C,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC7E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAC5C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,MAAM,CAAC,YAAY,KAAK,gBAAgB,CACzF,CAAC;QACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,wEAAwE;QACxE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QACpF,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAEjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtF,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,qCAAqC;gBAC7C,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,qCAAqC;gBAC5C,WAAW,EAAE,mDAAmD;gBAChE,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE;oBACR,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACrC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;iBACnC;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,GAAG,QAAQ;YACX,GAAG,CAAC,MAAM,yBAAyB,CACjC,OAAO,EACP,IAAI,CAAC,SAAS,EACd,eAAe,EACf,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC3C,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC1C,KAAK,CACN,CAAC;SACH,CAAC;IACJ,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,OAA2B;IACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACzF,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QACzF,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,UAAU,GAAG,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,kCAAkC,UAAU,0CAA0C;aAC/F,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CACpB,IAAwB,EACxB,MAAqD;IAErD,OAAO;QACL,MAAM,EACJ,MAAM,CAAC,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,0CAA0C;QAChD,QAAQ,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QACpD,KAAK,EACH,MAAM,CAAC,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,mCAAmC;QACzC,WAAW,EAAE,yBAAyB,IAAI,oBAAoB,MAAM,CAAC,MAAM,EAAE;QAC7E,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;KAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"npm-workspace-dependency-rule.js","sourceRoot":"","sources":["../../../src/application/rules/npm-workspace-dependency-rule.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAGxD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,4CAA4C,CAAC;AAEpD,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAMxC,oEAAoE;AACpE,MAAM,OAAO,0BAA0B;IACD;IAApC,YAAoC,SAA6B;QAA7B,cAAS,GAAT,SAAS,CAAoB;IAAG,CAAC;IAE9D,KAAK,CAAC,OAAO,CAAC,OAAwB;QAC3C,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC7E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAC5C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,MAAM,CAAC,YAAY,KAAK,gBAAgB,CACzF,CAAC;QACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,4DAA4D;QAC5D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QACpF,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAEjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,MAAM,OAAO,GACX,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1C,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5C,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtF,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EACJ,OAAO,KAAK,MAAM;oBAChB,CAAC,CAAC,0CAA0C;oBAC5C,CAAC,CAAC,qCAAqC;gBAC3C,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,GAAG,OAAO,kCAAkC;gBACnD,WAAW,EAAE,mDAAmD;gBAChE,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE;oBACR,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACrC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAClC,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,GAAG,QAAQ;YACX,GAAG,CAAC,MAAM,yBAAyB,CACjC,OAAO,EACP,IAAI,CAAC,SAAS,EACd,eAAe,EACf,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC3C,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC1C,OAAO,CACR,CAAC;SACH,CAAC;IACJ,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,OAA2B;IACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC;QACxF,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;YACzF,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,SAAS,CAAC;IAClB,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACzF,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QACzF,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,UAAU,GAAG,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,kCAAkC,UAAU,0CAA0C;aAC/F,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,aAAa,CACpB,IAAwB,EACxB,MAAqD,EACrD,OAAuB;IAEvB,OAAO;QACL,MAAM,EACJ,MAAM,CAAC,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,0CAA0C;QAChD,QAAQ,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QACpD,KAAK,EACH,MAAM,CAAC,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,WAAW,OAAO,0BAA0B;YAC9C,CAAC,CAAC,eAAe,OAAO,oBAAoB;QAChD,WAAW,EAAE,yBAAyB,IAAI,IAAI,OAAO,gBAAgB,MAAM,CAAC,MAAM,EAAE;QACpF,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE;YACR,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;KACF,CAAC;AACJ,CAAC"}

package/dist/application/rules/package-json-workspace-dependency-rule.d.ts

@@ -0,0 +1,5 @@
+import { NpmWorkspaceDependencyRule } from "./npm-workspace-dependency-rule.js";
+/** npm과 Yarn이 공유하는 package.json workspace 규칙의 명시적 이름. */
+export declare class PackageJsonWorkspaceDependencyRule extends NpmWorkspaceDependencyRule {
+}
+//# sourceMappingURL=package-json-workspace-dependency-rule.d.ts.map

package/dist/application/rules/package-json-workspace-dependency-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-json-workspace-dependency-rule.d.ts","sourceRoot":"","sources":["../../../src/application/rules/package-json-workspace-dependency-rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF,yDAAyD;AACzD,qBAAa,kCAAmC,SAAQ,0BAA0B;CAAG"}

package/dist/application/rules/package-json-workspace-dependency-rule.js

@@ -0,0 +1,5 @@
+import { NpmWorkspaceDependencyRule } from "./npm-workspace-dependency-rule.js";
+/** npm과 Yarn이 공유하는 package.json workspace 규칙의 명시적 이름. */
+export class PackageJsonWorkspaceDependencyRule extends NpmWorkspaceDependencyRule {
+}
+//# sourceMappingURL=package-json-workspace-dependency-rule.js.map

package/dist/application/rules/package-json-workspace-dependency-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-json-workspace-dependency-rule.js","sourceRoot":"","sources":["../../../src/application/rules/package-json-workspace-dependency-rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAEhF,yDAAyD;AACzD,MAAM,OAAO,kCAAmC,SAAQ,0BAA0B;CAAG"}

package/dist/application/services/workspace-manifest-analysis.d.ts

@@ -9,4 +9,5 @@ export interface WorkspacePatterns {
 export declare function isNestedManifestChange(change: FileChange): boolean;
 /** 패키지 매니저별 설정 해석 뒤에는 같은 manifest 비교·membership 규칙을 적용한다. */
 export declare function analyzeWorkspaceManifests(context: AnalysisContext, snapshots: FileSnapshotSource, changes: readonly FileChange[], before: WorkspacePatterns, after: WorkspacePatterns, manager: "npm" | "pnpm"): Promise<Finding[]>;
+export declare function analyzeWorkspaceManifests(context: AnalysisContext, snapshots: FileSnapshotSource, changes: readonly FileChange[], before: WorkspacePatterns, after: WorkspacePatterns, manager: "npm" | "pnpm" | "yarn"): Promise<Finding[]>;
 //# sourceMappingURL=workspace-manifest-analysis.d.ts.map

package/dist/application/services/workspace-manifest-analysis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-manifest-analysis.d.ts","sourceRoot":"","sources":["../../../src/application/services/workspace-manifest-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAM3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAElE;AAED,6DAA6D;AAC7D,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,kBAAkB,EAC7B,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,KAAK,GAAG,MAAM,GACtB,OAAO,CAAC,OAAO,EAAE,CAAC,CAgDpB"}
+{"version":3,"file":"workspace-manifest-analysis.d.ts","sourceRoot":"","sources":["../../../src/application/services/workspace-manifest-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAM3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAElE;AAED,6DAA6D;AAC7D,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,kBAAkB,EAC7B,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,KAAK,GAAG,MAAM,GACtB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AACtB,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,kBAAkB,EAC7B,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAC/B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC"}

package/dist/application/services/workspace-manifest-analysis.js

@@ -4,7 +4,6 @@ const manifestSuffix = "/package.json";
 export function isNestedManifestChange(change) {
     return isNestedManifestPath(change.path) || isNestedManifestPath(change.previousPath);
 }
-/** 패키지 매니저별 설정 해석 뒤에는 같은 manifest 비교·membership 규칙을 적용한다. */
 export async function analyzeWorkspaceManifests(context, snapshots, changes, before, after, manager) {
     const results = await Promise.all(changes.map(async (change) => {
         const previousPath = change.kind === "renamed" ? (change.previousPath ?? change.path) : change.path;
@@ -28,6 +27,7 @@ export async function analyzeWorkspaceManifests(context, snapshots, changes, bef
                         currentPath,
                         fromWorkspace: wasWorkspace,
                         toWorkspace: isCurrentWorkspace,
+                        ...(manager === "npm" ? {} : { packageManager: manager }),
                     },
                 },
             ]
@@ -40,7 +40,7 @@ export async function analyzeWorkspaceManifests(context, snapshots, changes, bef
                 evidence: {
                     ...finding.evidence,
                     workspace,
-                    ...(manager === "pnpm" ? { packageManager: manager } : {}),
+                    ...(manager === "npm" ? {} : { packageManager: manager }),
                 },
             })),
         ];

package/dist/application/services/workspace-manifest-analysis.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-manifest-analysis.js","sourceRoot":"","sources":["../../../src/application/services/workspace-manifest-analysis.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,cAAc,GAAG,eAAe,CAAC;AAOvC,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACxF,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAwB,EACxB,SAA6B,EAC7B,OAA8B,EAC9B,MAAyB,EACzB,KAAwB,EACxB,OAAuB;IAEvB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3B,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QACjF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;QAChC,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3F,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,CAAC,YAAY,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,CAAC;QAEpD,MAAM,YAAY,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;QACpF,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,iBAAiB,GACrB,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,YAAY,KAAK,kBAAkB;YAC9D,CAAC,CAAC;gBACE;oBACE,MAAM,EAAE,yCAAyC;oBACjD,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,GAAG,OAAO,+BAA+B;oBAChD,WAAW,EAAE,GAAG,YAAY,aAAa,WAAW,kCAAkC;oBACtF,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE;wBACR,YAAY;wBACZ,WAAW;wBACX,aAAa,EAAE,YAAY;wBAC3B,WAAW,EAAE,kBAAkB;qBAChC;iBACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,YAAY,GAAG,MAAM,IAAI,qBAAqB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,OAAO,CACnF,OAAO,CACR,CAAC;QACF,OAAO;YACL,GAAG,iBAAiB;YACpB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChC,GAAG,OAAO;gBACV,QAAQ,EAAE;oBACR,GAAG,OAAO,CAAC,QAAQ;oBACnB,SAAS;oBACT,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;aACF,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,OAAO,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAA2B;IAC5D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3E,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAC7E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workspace-manifest-analysis.js","sourceRoot":"","sources":["../../../src/application/services/workspace-manifest-analysis.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,cAAc,GAAG,eAAe,CAAC;AAOvC,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACxF,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAwB,EACxB,SAA6B,EAC7B,OAA8B,EAC9B,MAAyB,EACzB,KAAwB,EACxB,OAAgC;IAEhC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3B,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QACjF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;QAChC,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3F,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,CAAC,YAAY,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,CAAC;QAEpD,MAAM,YAAY,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;QACpF,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,iBAAiB,GACrB,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,YAAY,KAAK,kBAAkB;YAC9D,CAAC,CAAC;gBACE;oBACE,MAAM,EAAE,yCAAyC;oBACjD,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,GAAG,OAAO,+BAA+B;oBAChD,WAAW,EAAE,GAAG,YAAY,aAAa,WAAW,kCAAkC;oBACtF,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE;wBACR,YAAY;wBACZ,WAAW;wBACX,aAAa,EAAE,YAAY;wBAC3B,WAAW,EAAE,kBAAkB;wBAC/B,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;qBAC1D;iBACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,YAAY,GAAG,MAAM,IAAI,qBAAqB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,OAAO,CACnF,OAAO,CACR,CAAC;QACF,OAAO;YACL,GAAG,iBAAiB;YACpB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChC,GAAG,OAAO;gBACV,QAAQ,EAAE;oBACR,GAAG,OAAO,CAAC,QAAQ;oBACnB,SAAS;oBACT,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;iBAC1D;aACF,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,OAAO,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAA2B;IAC5D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3E,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAC7E,CAAC;AACJ,CAAC"}