monkeypatchlist 0.0.0-stage → 0.1.0

package/dist/packages/attribution/lib/lockfile-graph.js

@@ -0,0 +1,158 @@
+// The installed-package graph every lockfile format reads into (§10 Introducing dependencies), and the parts the
+// formats share. Pure.
+/** A node's `name@version`, or its name alone when the lockfile records no version. */
+export const nameAtVersion = ({ name, version }) => (version === '' ? name : `${name}@${version}`);
+const compareText = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+/** A lockfile over `nodes`, whose dependency edges and workspaces' direct dependencies are resolved by the format. */
+export function graph(parts) {
+    const nodes = [...parts.nodes];
+    const { edges, direct } = parts;
+    let reverse;
+    const dependents = () => {
+        if (reverse !== undefined)
+            return reverse;
+        reverse = new Map();
+        for (const node of nodes) {
+            for (const target of edges(node)) {
+                const list = reverse.get(target);
+                if (list === undefined)
+                    reverse.set(target, [node]);
+                else if (!list.includes(node))
+                    list.push(node);
+            }
+        }
+        return reverse;
+    };
+    return {
+        format: parts.format,
+        keyedByInstallPath: parts.keyedByInstallPath,
+        confidence: parts.confidence,
+        workspaces: parts.workspaces,
+        unresolved: parts.unresolved ?? null,
+        place: parts.place,
+        named: (name, version) => nodes.filter((node) => node.name === name && node.version === version),
+        introducers(from, workspace) {
+            const directs = new Set(direct(workspace));
+            const seen = new Set(from);
+            const queue = [...from];
+            for (let next = 0; next < queue.length; next++) {
+                for (const dependent of dependents().get(queue[next]) ?? []) {
+                    if (seen.has(dependent))
+                        continue;
+                    seen.add(dependent);
+                    queue.push(dependent);
+                }
+            }
+            const found = [...seen].filter((node) => directs.has(node)).map(nameAtVersion);
+            return [...new Set(found)].sort(compareText);
+        },
+    };
+}
+/** The package names of a `node_modules/<a>/node_modules/<b>` chain, or null when it is no such chain. */
+export function installChain(segments) {
+    const out = [];
+    for (let i = 0; i < segments.length;) {
+        if (segments[i] !== 'node_modules')
+            return null;
+        const next = segments[i + 1];
+        if (next === undefined || next.startsWith('.'))
+            return null;
+        if (next.startsWith('@')) {
+            if (segments[i + 2] === undefined)
+                return null;
+            out.push(`${next}/${segments[i + 2]}`);
+            i += 3;
+        }
+        else {
+            out.push(next);
+            i += 2;
+        }
+    }
+    return out.length === 0 ? null : out;
+}
+/** The nodes when they are all one version, or null: several versions leave the copy unknown. */
+function oneVersion(nodes) {
+    if (nodes.length === 0)
+        return null;
+    return nodes.every((node) => node.version === nodes[0].version) ? [...new Set(nodes)] : null;
+}
+/**
+ * Where a lockfile that isn't keyed by install path (`pnpm-lock.yaml`, `yarn.lock`) puts a package directory: by the
+ * names of its `node_modules` chain. The first name is the workspace's (the folder before the chain) or else the root's
+ * direct dependency of that name, or else the lockfile's only version of it; each further name is what the package
+ * before it depends on by that name. A name the lockfile doesn't install at all is vendored, in the package before it.
+ * Anything else is unplaced: the lockfile doesn't record where its copies are installed.
+ */
+export function placeByName(directory, byName, workspaces, edges, direct) {
+    const top = (name, holders) => {
+        for (const holder of holders) {
+            const one = holder === undefined ? null : oneVersion(direct(holder).filter((node) => node.name === name));
+            if (one !== null)
+                return one;
+        }
+        return oneVersion(byName.get(name));
+    };
+    for (let i = 0; i < directory.length; i++) {
+        if (directory[i] !== 'node_modules')
+            continue;
+        const chain = installChain(directory.slice(i));
+        if (chain === null)
+            continue;
+        const before = directory.slice(0, i).join('/');
+        const root = workspaces.find(({ folder }) => folder === '');
+        const workspace = workspaces
+            .filter(({ folder }) => folder !== '' && (before === folder || before.endsWith(`/${folder}`)))
+            .sort((a, b) => b.folder.length - a.folder.length)[0];
+        let current = [];
+        for (let k = 0; k < chain.length; k++) {
+            const name = chain[k];
+            if ((byName.get(name) ?? []).length === 0)
+                return { kind: 'vendored', around: current };
+            const candidates = k === 0
+                ? top(name, [workspace, root])
+                : oneVersion(current.flatMap(edges).filter((node) => node.name === name));
+            if (candidates === null)
+                return { kind: 'unplaced' };
+            current = candidates;
+        }
+        return { kind: 'installed', nodes: current };
+    }
+    return { kind: 'unplaced' };
+}
+/** A manifest's text read, or null when it is missing or isn't a manifest. */
+export function readManifest(text) {
+    if (text === null || text === undefined)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(text.startsWith('') ? text.slice(1) : text);
+    }
+    catch {
+        return null;
+    }
+    if (!isRecord(value))
+        return null;
+    const list = (field) => isRecord(field) ? Object.entries(field).flatMap(([name, range]) => (typeof range === 'string' ? [[name, range]] : [])) : [];
+    return {
+        name: typeof value.name === 'string' ? value.name : null,
+        version: typeof value.version === 'string' ? value.version : null,
+        production: [...list(value.dependencies), ...list(value.optionalDependencies), ...list(value.peerDependencies)],
+        development: list(value.devDependencies),
+    };
+}
+export function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** A folder relative to the lockfile's directory, normalized: `.` is `''`, and `./`, `x/..` and a trailing `/` go. */
+export function normalizeFolder(folder) {
+    const out = [];
+    for (const segment of folder.replace(/\\/g, '/').split('/')) {
+        if (segment === '' || segment === '.')
+            continue;
+        if (segment === '..' && out.length > 0 && out.at(-1) !== '..')
+            out.pop();
+        else
+            out.push(segment);
+    }
+    return out.join('/');
+}

package/dist/packages/attribution/lib/lockfile.d.ts

@@ -0,0 +1,33 @@
+/** Why introducers are unknown (§10 Unknown is not empty, §13 Attribution block): a closed list of three. */
+export declare const introducerReasons: readonly ["no-lockfile", "importer-unresolved", "lockfile-stale"];
+export type IntroducerReason = (typeof introducerReasons)[number];
+import { nameAtVersion, type Lockfile, type Node, type Placed, type ReadLockfile, type Workspace } from './lockfile-graph.ts';
+export { nameAtVersion };
+export type { Lockfile, Placed, ReadLockfile, Workspace };
+export type { Node as LockfileNode };
+/** A lockfile's format, by its file name, and for a `.lock` file by its text: Bun's is JSON, Yarn's isn't. */
+export declare function lockfileFormat(path: string, text: string | null): Lockfile['format'];
+/**
+ * Reads a lockfile's text by its format (`lockfileFormat`). Null text is a file that couldn't be read. `manifests`
+ * holds the `package.json` texts beside it, by folder relative to its directory (`''` for its own), null for one that
+ * couldn't be read: Yarn's direct dependencies come from them, and pnpm's linked workspaces' names and versions.
+ */
+export declare function readLockfile(path: string, text: string | null, manifests?: Readonly<Record<string, string | null>>): ReadLockfile;
+/**
+ * The importer (§10 Importer): the `lockfile.importer` workspace, by folder (`.` for the root) or name; else the one
+ * workspace that holds every first-party source path, taken relative to the lockfile's directory, each in its deepest
+ * workspace. With no first-party path, a lockfile with only a root has the root. Null when none decides.
+ */
+export declare function importerOf(lockfile: Lockfile, configured: string | null, firstParty: readonly string[]): Workspace | null;
+/** The deepest workspace whose folder holds `path`, relative to the lockfile's directory: the root if no other does. */
+export declare function workspaceOf(lockfile: Lockfile, path: string): Workspace | undefined;
+/**
+ * The `package.json` manifests a lockfile needs beside it (§2 Inputs), besides the one in its own directory, which
+ * pnpm and Yarn always read: the workspace folders it names (pnpm's importers, Yarn Berry's workspace entries), or for
+ * Yarn v1 the `workspaces` globs of its own manifest (`root`), relative to its directory. Null for npm and Bun, which
+ * read none.
+ */
+export declare function lockfileManifests(path: string, text: string | null, root: string | null): {
+    folders: string[];
+    globs: string[];
+} | null;

package/dist/packages/attribution/lib/lockfile.js

@@ -0,0 +1,330 @@
+// Lockfiles (§10 Introducing dependencies): `package-lock.json` v2/v3 and `bun.lock`, read into one installed-package
+// graph keyed by install path. Pure: the CLI reads the file's text.
+/** Why introducers are unknown (§10 Unknown is not empty, §13 Attribution block): a closed list of three. */
+export const introducerReasons = ['no-lockfile', 'importer-unresolved', 'lockfile-stale'];
+import { graph, installChain, isRecord, nameAtVersion, } from "./lockfile-graph.js";
+import { pnpmFolders, readPnpm } from "./pnpm.js";
+import { readYarn, yarnManifests } from "./yarn.js";
+export { nameAtVersion };
+/** A lockfile's format, by its file name, and for a `.lock` file by its text: Bun's is JSON, Yarn's isn't. */
+export function lockfileFormat(path, text) {
+    const name = path.split(/[/\\]/).at(-1) ?? path;
+    if (/\.ya?ml$/.test(name))
+        return 'pnpm';
+    if (name === 'yarn.lock')
+        return 'yarn';
+    if (name.endsWith('.lock'))
+        return text !== null && !stripBom(text).trimStart().startsWith('{') ? 'yarn' : 'bun';
+    return 'npm';
+}
+/**
+ * Reads a lockfile's text by its format (`lockfileFormat`). Null text is a file that couldn't be read. `manifests`
+ * holds the `package.json` texts beside it, by folder relative to its directory (`''` for its own), null for one that
+ * couldn't be read: Yarn's direct dependencies come from them, and pnpm's linked workspaces' names and versions.
+ */
+export function readLockfile(path, text, manifests = {}) {
+    if (text === null)
+        return { unusable: `${path} can't be read` };
+    const name = path.split(/[/\\]/).at(-1) ?? path;
+    const format = lockfileFormat(path, text);
+    if (format === 'pnpm')
+        return readPnpm(text, name, manifests);
+    if (format === 'yarn')
+        return readYarn(text, name, manifests);
+    const bun = format === 'bun';
+    let value;
+    try {
+        value = JSON.parse(bun ? withoutJsonc(text) : stripBom(text));
+    }
+    catch {
+        return { unusable: `${name} is not valid JSON` };
+    }
+    if (!isRecord(value))
+        return { unusable: `${name} is not a lockfile` };
+    return bun ? readBun(value, name) : readNpm(value, name);
+}
+const stripBom = (text) => (text.startsWith('') ? text.slice(1) : text);
+/** JSON with comments and trailing commas (`bun.lock`), as plain JSON. */
+function withoutJsonc(input) {
+    const text = stripBom(input);
+    let out = '';
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (c === '"') {
+            const start = i;
+            for (i++; i < text.length && text[i] !== '"'; i++)
+                if (text[i] === '\\')
+                    i++;
+            out += text.slice(start, i + 1);
+        }
+        else if (c === '/' && text[i + 1] === '/') {
+            while (i < text.length && text[i] !== '\n')
+                i++;
+            out += '\n';
+        }
+        else if (c === '/' && text[i + 1] === '*') {
+            const end = text.indexOf('*/', i + 2);
+            i = end < 0 ? text.length : end + 1;
+        }
+        else if (c === ',') {
+            let j = i + 1;
+            while (j < text.length && /\s/.test(text[j]))
+                j++;
+            if (text[j] !== '}' && text[j] !== ']')
+                out += c;
+        }
+        else
+            out += c;
+    }
+    return out;
+}
+/** A record's string-keyed names: the keys of a dependency map. */
+function names(value) {
+    return isRecord(value) ? Object.keys(value) : [];
+}
+const str = (value) => (typeof value === 'string' ? value : null);
+/** The package name an npm install key ends in: the segment after its last `node_modules`, two for a scope. */
+function nameInKey(segments) {
+    const at = segments.lastIndexOf('node_modules');
+    if (at < 0)
+        return null;
+    const next = segments[at + 1];
+    if (next === undefined)
+        return null;
+    return next.startsWith('@') ? (segments[at + 2] === undefined ? null : `${next}/${segments[at + 2]}`) : next;
+}
+/** `package-lock.json` v2/v3: `packages` keyed by install path. v1 and anything else is unusable. */
+function readNpm(value, file) {
+    const version = value.lockfileVersion;
+    if ((version !== 2 && version !== 3) || !isRecord(value.packages)) {
+        return { unusable: `${file} lockfileVersion ${JSON.stringify(version ?? null)}` };
+    }
+    const entries = value.packages;
+    const nodes = new Map();
+    /** A link entry's target folder, by its key. */
+    const links = new Map();
+    const workspaces = [];
+    for (const [key, entry] of Object.entries(entries)) {
+        if (!isRecord(entry))
+            continue;
+        const segments = key === '' ? [] : key.split('/');
+        if (entry.link === true && typeof entry.resolved === 'string') {
+            links.set(key, entry.resolved);
+            continue;
+        }
+        const dependencies = [...names(entry.dependencies), ...names(entry.optionalDependencies), ...names(entry.peerDependencies)];
+        const name = str(entry.name) ?? nameInKey(segments);
+        const own = str(entry.version);
+        if (!segments.includes('node_modules')) {
+            workspaces.push({
+                folder: key,
+                name,
+                version: own,
+                key,
+                direct: [...dependencies, ...names(entry.devDependencies)],
+            });
+        }
+        if (name !== null && key !== '')
+            nodes.set(key, { key, name, version: own ?? '', dependencies });
+    }
+    const lookup = (key) => {
+        const target = links.get(key);
+        return nodes.get(target ?? key) ?? null;
+    };
+    /** Node's resolution of `name` from the package at `key` (§10 Walk): up its directories' `node_modules`. */
+    const resolve = (key, name) => {
+        const dir = key === '' ? [] : key.split('/');
+        for (;;) {
+            const found = lookup([...dir, 'node_modules', name].join('/'));
+            if (found !== null)
+                return found;
+            if (dir.length === 0)
+                return null;
+            dir.pop();
+            if (dir.at(-1) === 'node_modules')
+                dir.pop();
+        }
+    };
+    return {
+        lockfile: namedGraph('npm', nodes, workspaces, resolve, (directory) => {
+            for (let i = 0; i < directory.length; i++) {
+                const found = lookup(directory.slice(i).join('/'));
+                if (found !== null && !links.has(found.key))
+                    return found;
+            }
+            return null;
+        }),
+    };
+}
+/** `bun.lock`: `packages` keyed by hoisted path (`a/b` is `node_modules/a/node_modules/b`), and `workspaces`. */
+function readBun(value, file) {
+    const version = value.lockfileVersion;
+    if ((version !== 0 && version !== 1) || !isRecord(value.packages) || !isRecord(value.workspaces)) {
+        return { unusable: `${file} lockfileVersion ${JSON.stringify(version ?? null)}` };
+    }
+    const declared = value.workspaces;
+    const workspaces = [];
+    const byName = new Map();
+    for (const [folder, entry] of Object.entries(declared)) {
+        if (!isRecord(entry))
+            continue;
+        const name = str(entry.name);
+        const workspace = {
+            folder,
+            name,
+            version: str(entry.version),
+            // The root resolves from the top; another workspace from its own entry, where Bun nests what it doesn't hoist.
+            key: folder === '' || name === null ? '' : name,
+            direct: [
+                ...names(entry.dependencies),
+                ...names(entry.optionalDependencies),
+                ...names(entry.peerDependencies),
+                ...names(entry.devDependencies),
+            ],
+        };
+        workspaces.push(workspace);
+        if (name !== null)
+            byName.set(name, workspace);
+    }
+    const nodes = new Map();
+    for (const [key, entry] of Object.entries(value.packages)) {
+        if (!Array.isArray(entry) || typeof entry[0] !== 'string')
+            continue;
+        const ident = entry[0];
+        const split = ident.indexOf('@', 1);
+        if (split <= 0)
+            continue;
+        const name = ident.slice(0, split);
+        let own = ident.slice(split + 1);
+        let dependencies;
+        const info = entry.find((part, i) => i > 0 && isRecord(part));
+        if (own.startsWith('workspace:')) {
+            // A workspace's dependencies are its `workspaces` entry's, without its dev dependencies.
+            const workspace = workspaces.find(({ folder }) => folder === own.slice('workspace:'.length)) ?? byName.get(name);
+            own = workspace?.version ?? own;
+            const entry = workspace === undefined ? undefined : declared[workspace.folder];
+            dependencies = isRecord(entry)
+                ? [...names(entry.dependencies), ...names(entry.optionalDependencies), ...names(entry.peerDependencies)]
+                : [];
+        }
+        else {
+            dependencies = [
+                ...names(info?.dependencies),
+                ...names(info?.optionalDependencies),
+                ...names(info?.peerDependencies),
+            ];
+        }
+        nodes.set(key, { key, name, version: own, dependencies });
+    }
+    /** The package names of a hoisted key, a scope and its name together. */
+    const parts = (key) => {
+        const out = [];
+        const segments = key === '' ? [] : key.split('/');
+        for (let i = 0; i < segments.length; i++) {
+            out.push(segments[i].startsWith('@') && i + 1 < segments.length ? `${segments[i]}/${segments[++i]}` : segments[i]);
+        }
+        return out;
+    };
+    const resolve = (key, name) => {
+        const path = parts(key);
+        for (;;) {
+            const found = nodes.get([...path, name].join('/'));
+            if (found !== undefined)
+                return found;
+            if (path.length === 0)
+                return null;
+            path.pop();
+        }
+    };
+    const folders = workspaces.filter(({ folder, name }) => folder !== '' && name !== null);
+    return {
+        lockfile: namedGraph('bun', nodes, workspaces, resolve, (directory) => {
+            for (let i = 0; i < directory.length; i++) {
+                if (directory[i] !== 'node_modules')
+                    continue;
+                const chain = installChain(directory.slice(i));
+                if (chain === null)
+                    continue;
+                const before = directory.slice(0, i).join('/');
+                // A workspace's own `node_modules` is keyed under the workspace's name.
+                const workspace = folders.find(({ folder }) => before === folder || before.endsWith(`/${folder}`));
+                const found = (workspace === undefined ? undefined : nodes.get([workspace.name, ...chain].join('/'))) ??
+                    nodes.get(chain.join('/'));
+                if (found !== undefined)
+                    return found;
+            }
+            return null;
+        }),
+    };
+}
+/**
+ * A lockfile keyed by install path (npm, Bun), over nodes whose dependencies `resolve` resolves by name. A package
+ * directory is the node its install path is; a path the lockfile doesn't install is vendored, in the installed package
+ * whose directory holds it (the directory before its package's `node_modules` segment), or in none the lockfile names.
+ */
+function namedGraph(format, nodes, workspaces, resolve, atInstallPath) {
+    const byFolder = new Map(workspaces.map((workspace) => [workspace.folder, workspace]));
+    return graph({
+        format,
+        keyedByInstallPath: true,
+        confidence: 'high',
+        nodes: nodes.values(),
+        workspaces: workspaces.map(({ folder, name, version }) => ({ folder, name, version })),
+        edges: (node) => node.dependencies.flatMap((name) => resolve(node.key, name) ?? []),
+        direct: (workspace) => {
+            const named = byFolder.get(workspace.folder);
+            return named === undefined ? [] : named.direct.flatMap((name) => resolve(named.key, name) ?? []);
+        },
+        place(directory) {
+            const node = atInstallPath(directory);
+            if (node !== null)
+                return { kind: 'installed', nodes: [node] };
+            const around = directory.slice(0, directory.lastIndexOf('node_modules'));
+            const vendoring = around.includes('node_modules') ? atInstallPath(around) : null;
+            return { kind: 'vendored', around: vendoring === null ? [] : [vendoring] };
+        },
+    });
+}
+/**
+ * The importer (§10 Importer): the `lockfile.importer` workspace, by folder (`.` for the root) or name; else the one
+ * workspace that holds every first-party source path, taken relative to the lockfile's directory, each in its deepest
+ * workspace. With no first-party path, a lockfile with only a root has the root. Null when none decides.
+ */
+export function importerOf(lockfile, configured, firstParty) {
+    const { workspaces } = lockfile;
+    if (configured !== null) {
+        const folder = configured === '.' || configured === './' ? '' : configured.replace(/^\.\//, '').replace(/\/$/, '');
+        return workspaces.find((each) => each.folder === folder) ?? workspaces.find((each) => each.name === configured) ?? null;
+    }
+    if (firstParty.length === 0)
+        return workspaces.length === 1 ? workspaces[0] : null;
+    const holding = new Set(firstParty.map((path) => workspaceOf(lockfile, path)));
+    const [only] = holding;
+    return holding.size === 1 && only !== undefined ? only : null;
+}
+/** The deepest workspace whose folder holds `path`, relative to the lockfile's directory: the root if no other does. */
+export function workspaceOf(lockfile, path) {
+    let best;
+    for (const workspace of lockfile.workspaces) {
+        const { folder } = workspace;
+        if (folder !== '' && !path.startsWith(`${folder}/`))
+            continue;
+        if (best === undefined || folder.length > best.folder.length)
+            best = workspace;
+    }
+    return best;
+}
+/**
+ * The `package.json` manifests a lockfile needs beside it (§2 Inputs), besides the one in its own directory, which
+ * pnpm and Yarn always read: the workspace folders it names (pnpm's importers, Yarn Berry's workspace entries), or for
+ * Yarn v1 the `workspaces` globs of its own manifest (`root`), relative to its directory. Null for npm and Bun, which
+ * read none.
+ */
+export function lockfileManifests(path, text, root) {
+    const format = lockfileFormat(path, text);
+    if (format === 'npm' || format === 'bun')
+        return null;
+    if (text === null)
+        return { folders: [], globs: [] };
+    return format === 'pnpm' ? { folders: pnpmFolders(text), globs: [] } : yarnManifests(text, root);
+}

package/dist/packages/attribution/lib/path-rules.d.ts

@@ -0,0 +1,29 @@
+import type { EscapeOnlyShape, FrameworkPathRule } from '../../../catalog.ts';
+import type { SourcePath } from './containing-package.ts';
+/** The curated path data attribution reads from the catalog (§4 Catalog versions). */
+export interface PathRules {
+    frameworkPathRules: Readonly<Record<string, FrameworkPathRule>>;
+    escapeOnlyShapes: Readonly<Record<string, EscapeOnlyShape>>;
+}
+/**
+ * What the curated path data says of a source with no `node_modules` segment (§10 Escaped sources):
+ * - `rule`: a framework path rule matched it, and names `package` (the rule with the lowest id when several match)
+ * - `escaped`: no rule matched, but an escape-only shape did
+ * - `none`: neither did, so the inferred root decides
+ */
+export type PathRuling = {
+    kind: 'rule';
+    rule: string;
+    package: string;
+} | {
+    kind: 'escaped';
+    shape: string;
+} | {
+    kind: 'none';
+};
+/**
+ * Tries the framework path rules first, then the escape-only shapes, against a source's normalized path (§10 Escaped
+ * sources: "Framework path rules are tried first"). Each is tried in id order, so the answer never depends on the
+ * catalog's key order.
+ */
+export declare function pathRuling(path: SourcePath, rules: PathRules): PathRuling;

package/dist/packages/attribution/lib/path-rules.js

@@ -0,0 +1,84 @@
+// Framework path rules and escape-only shapes (§10 Escaped sources, Framework path rules): curated catalog data (§4)
+// matched against a source's normalized path.
+/**
+ * Tries the framework path rules first, then the escape-only shapes, against a source's normalized path (§10 Escaped
+ * sources: "Framework path rules are tried first"). Each is tried in id order, so the answer never depends on the
+ * catalog's key order.
+ */
+export function pathRuling(path, rules) {
+    if (path.segments.includes('node_modules'))
+        return { kind: 'none' };
+    for (const id of sortedIds(rules.frameworkPathRules)) {
+        const rule = rules.frameworkPathRules[id];
+        const captured = matches(rule, path);
+        if (captured !== null) {
+            return { kind: 'rule', rule: id, package: rule.package.replace(placeholder, (_, name) => captured[name]) };
+        }
+    }
+    for (const id of sortedIds(rules.escapeOnlyShapes)) {
+        if (matches(rules.escapeOnlyShapes[id], path) !== null)
+            return { kind: 'escaped', shape: id };
+    }
+    return { kind: 'none' };
+}
+const placeholder = /<([A-Za-z][A-Za-z0-9_-]*)>/g;
+function sortedIds(record) {
+    return Object.keys(record).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+}
+/**
+ * What a shape captures from a path it matches, or null when it doesn't match: the path is in the shape's namespace,
+ * and its segments hold the shape's run of whole segments, with at least one segment after it, and each placeholder
+ * captured a value the shape's `captures` allows. With `up`, the run comes right after the path's leading `..`
+ * segments, of which there are at least `up`. Without it, the run may start at any segment, and the first place it
+ * matches counts.
+ */
+function matches(shape, path) {
+    if (shape.namespace !== undefined && shape.namespace !== path.namespace)
+        return null;
+    const { segments } = path;
+    let leading = 0;
+    while (segments[leading] === '..')
+        leading++;
+    const starts = shape.up === undefined
+        ? segments.map((_, at) => at)
+        : leading >= shape.up
+            ? [leading]
+            : [];
+    for (const start of starts) {
+        if (start + shape.segments.length >= segments.length)
+            continue;
+        const captured = {};
+        const all = shape.segments.every((pattern, i) => segmentMatches(pattern, segments[start + i], captured));
+        if (all && capturesAllowed(shape, captured))
+            return captured;
+    }
+    return null;
+}
+/** Whether every placeholder captured a value its shape's `captures` allows, when it limits that placeholder. */
+function capturesAllowed({ captures }, captured) {
+    if (captures === undefined)
+        return true;
+    return Object.entries(captured).every(([name, value]) => captures[name]?.includes(value) ?? true);
+}
+/** Whether one path segment matches a segment pattern, adding what its placeholders capture to `captured`. */
+function segmentMatches(pattern, segment, captured) {
+    const names = [];
+    const source = pattern
+        .split(/(<[A-Za-z][A-Za-z0-9_-]*>|\*)/)
+        .map((part) => {
+        if (part === '*')
+            return '.*';
+        const name = /^<(.+)>$/.exec(part)?.[1];
+        if (name !== undefined) {
+            names.push(name);
+            return '(.+)';
+        }
+        return part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    })
+        .join('');
+    const found = new RegExp(`^${source}$`, 's').exec(segment);
+    if (found === null)
+        return false;
+    names.forEach((name, i) => (captured[name] = found[i + 1]));
+    return true;
+}

package/dist/packages/attribution/lib/pnpm.d.ts

@@ -0,0 +1,4 @@
+import { type ReadLockfile } from './lockfile-graph.ts';
+export declare function readPnpm(text: string, file: string, manifests: Readonly<Record<string, string | null>>): ReadLockfile;
+/** The importer folders a `pnpm-lock.yaml` names, besides its own directory, whose manifests name linked workspaces. */
+export declare function pnpmFolders(text: string): string[];