monkeypatchlist 0.0.0-stage → 0.1.0

package/dist/packages/attribution/lib/pnpm.js

@@ -0,0 +1,133 @@
+// `pnpm-lock.yaml` (§10 Introducing dependencies): `lockfileVersion` 6.0 and 9.x; any other version is unusable.
+// It records each importer's direct dependencies, dev ones apart, and each package's resolved dependencies, peers
+// included. It is keyed by name and version, not by install path, so it gives no version (§10 Version). Pure.
+import { graph, isRecord, normalizeFolder, placeByName, readManifest, } from "./lockfile-graph.js";
+import { readYaml } from "./yaml.js";
+/** A dependency map's references: a 9.0 or 6.0 package's `name: version`, or an importer's `name: { version }`. */
+function references(value) {
+    if (!isRecord(value))
+        return [];
+    return Object.entries(value).flatMap(([name, each]) => {
+        const version = isRecord(each) ? each.version : each;
+        return typeof version === 'string' ? [[name, version]] : [];
+    });
+}
+/** A package key's name and version: `name@1.0.0(peer@2.0.0)`, or 6.0's `/name@1.0.0(peer@2.0.0)`. */
+function identOf(key) {
+    const bare = key.startsWith('/') ? key.slice(1) : key;
+    const split = bare.indexOf('@', 1);
+    if (split <= 0)
+        return null;
+    const rest = bare.slice(split + 1);
+    const peers = rest.indexOf('(');
+    return { name: bare.slice(0, split), version: peers < 0 ? rest : rest.slice(0, peers) };
+}
+export function readPnpm(text, file, manifests) {
+    const doc = readYaml(text);
+    if (!isRecord(doc))
+        return { unusable: `${file} is not a pnpm lockfile` };
+    const version = typeof doc.lockfileVersion === 'string' ? doc.lockfileVersion : null;
+    const v9 = version !== null && /^9\.\d+$/.test(version);
+    if (!v9 && version !== '6.0')
+        return { unusable: `${file} lockfileVersion ${version ?? 'null'}` };
+    // A 6.0 lockfile of a project with no workspaces keeps its importer's lists at the top.
+    const importers = isRecord(doc.importers) ? doc.importers : { '.': doc };
+    const snapshots = v9 ? doc.snapshots : doc.packages;
+    const nodes = new Map();
+    for (const [key, entry] of Object.entries(isRecord(snapshots) ? snapshots : {})) {
+        const ident = identOf(key);
+        if (ident === null)
+            continue;
+        const own = isRecord(entry) ? entry : {};
+        nodes.set(key, {
+            key,
+            ...ident,
+            production: [...references(own.dependencies), ...references(own.optionalDependencies)],
+            development: [],
+        });
+    }
+    const workspaces = [];
+    const importerNodes = new Map();
+    for (const [path, entry] of Object.entries(importers)) {
+        if (!isRecord(entry))
+            continue;
+        const folder = normalizeFolder(path);
+        // pnpm records no importer's name or version: a linked workspace's come from its manifest, when it is readable.
+        const manifest = readManifest(manifests[folder]);
+        workspaces.push({ folder, name: null, version: null });
+        importerNodes.set(folder, {
+            key: `importer:${folder}`,
+            name: manifest?.name ?? '',
+            version: manifest?.version ?? '',
+            folder,
+            production: [...references(entry.dependencies), ...references(entry.optionalDependencies)],
+            development: references(entry.devDependencies),
+        });
+    }
+    /** The node a reference from `from` names: a linked importer, a package key, or an alias's key. */
+    const target = (from, name, reference) => {
+        if (reference.startsWith('link:')) {
+            const linked = importerNodes.get(normalizeFolder(`${from.folder ?? ''}/${reference.slice('link:'.length)}`));
+            return linked === undefined ? [] : [linked];
+        }
+        const keys = v9 ? [`${name}@${reference}`, reference] : [`/${name}@${reference}`, reference, `/${reference}`];
+        for (const key of keys) {
+            const found = nodes.get(key);
+            if (found !== undefined)
+                return [found];
+        }
+        return [];
+    };
+    const edges = (node) => {
+        const own = node;
+        return own.production.flatMap(([name, reference]) => target(own, name, reference));
+    };
+    const direct = (workspace) => {
+        const importer = importerNodes.get(workspace.folder);
+        if (importer === undefined)
+            return [];
+        return [...importer.production, ...importer.development].flatMap(([name, reference]) => target(importer, name, reference));
+    };
+    // Each importer is named by what refers to it when its manifest doesn't name it.
+    for (const node of [...nodes.values(), ...importerNodes.values()]) {
+        for (const [name, reference] of [...node.production, ...node.development]) {
+            if (!reference.startsWith('link:'))
+                continue;
+            const linked = importerNodes.get(normalizeFolder(`${node.folder ?? ''}/${reference.slice('link:'.length)}`));
+            if (linked !== undefined && linked.name === '')
+                linked.name = name;
+        }
+    }
+    const all = [...nodes.values(), ...[...importerNodes.values()].filter((node) => node.name !== '')];
+    const byName = new Map();
+    // A named workspace is installed too (linked into `node_modules`), so code under its name there is no vendored code.
+    // The root is no package anything installs.
+    for (const node of all) {
+        if (node.folder === '' || node.name === '')
+            continue;
+        const list = byName.get(node.name);
+        if (list === undefined)
+            byName.set(node.name, [node]);
+        else
+            list.push(node);
+    }
+    return {
+        lockfile: graph({
+            format: 'pnpm',
+            keyedByInstallPath: false,
+            confidence: 'high',
+            nodes: all,
+            workspaces,
+            edges,
+            direct,
+            place: (directory) => placeByName(directory, byName, workspaces, edges, direct),
+        }),
+    };
+}
+/** The importer folders a `pnpm-lock.yaml` names, besides its own directory, whose manifests name linked workspaces. */
+export function pnpmFolders(text) {
+    const doc = readYaml(text);
+    if (!isRecord(doc) || !isRecord(doc.importers))
+        return [];
+    return Object.keys(doc.importers).map(normalizeFolder).filter((folder) => folder !== '');
+}

package/dist/packages/attribution/lib/remote-url.d.ts

@@ -0,0 +1,7 @@
+import type { RemoteUrlNormalization } from '../../../catalog.ts';
+/**
+ * Normalizes a remote artifact's URL, as referenced, by the catalog's rules (§11 Remote URL normalization): its scheme
+ * (step 1), then its host, port, query and fragment (step 2), then each rewrite of its path, in order (steps 3 and 4).
+ * The path rules see the path only, so hosts are kept.
+ */
+export declare function normalizeRemoteUrl(href: string, rules: RemoteUrlNormalization): string;

package/dist/packages/attribution/lib/remote-url.js

@@ -0,0 +1,24 @@
+/** The default port of each scheme a remote script is fetched over (URL § Special schemes). */
+const defaultPorts = { 'http:': '80', 'https:': '443' };
+/**
+ * Normalizes a remote artifact's URL, as referenced, by the catalog's rules (§11 Remote URL normalization): its scheme
+ * (step 1), then its host, port, query and fragment (step 2), then each rewrite of its path, in order (steps 3 and 4).
+ * The path rules see the path only, so hosts are kept.
+ */
+export function normalizeRemoteUrl(href, rules) {
+    const url = new URL(href);
+    if (rules.scheme.from.includes(url.protocol))
+        url.protocol = rules.scheme.to;
+    url.hostname = url.hostname.toLowerCase();
+    if (rules.drop.includes('default-port') && url.port === defaultPorts[url.protocol])
+        url.port = '';
+    if (rules.drop.includes('query'))
+        url.search = '';
+    if (rules.drop.includes('fragment'))
+        url.hash = '';
+    const { pathname, search, hash } = url;
+    const origin = url.href.slice(0, url.href.length - pathname.length - search.length - hash.length);
+    // The path is rewritten as a string: the URL setters would percent-encode the `#` a hex run becomes.
+    const path = rules.path.reduce((rewritten, { pattern, replacement }) => rewritten.replace(new RegExp(pattern, 'gu'), replacement), pathname);
+    return `${origin}${path}${search}${hash}`;
+}

package/dist/packages/attribution/lib/source-map.d.ts

@@ -0,0 +1,51 @@
+import { type TraceMap } from '@jridgewell/trace-mapping';
+/** How an artifact's text splits into lines: the reading that verified its map (§2 Verification). */
+export type LineReading = 'ecmascript' | 'lf-cr';
+/** A verified map, read: its flattened mappings, and each source's raw entry, relative `sourceRoot` and content. */
+export interface ReadMap {
+    trace: TraceMap;
+    sources: SourceEntry[];
+}
+/**
+ * A `sources` entry: `raw` as the map writes it (null for a null entry), the relative `sourceRoot` of its map or
+ * section, which §10 step 1 joins only to an entry with no scheme that isn't absolute (null when there is none), its
+ * `sourcesContent` entry, null when the map has none for it, and whether its map or section's ignore list names it:
+ * `ignoreList` when the map has one, and `x_google_ignoreList` only otherwise (§10).
+ */
+export interface SourceEntry {
+    raw: string | null;
+    sourceRoot: string | null;
+    content: string | null;
+    ignored: boolean;
+}
+/** Reads a map's raw JSON, which verification has already read with `FlattenMap` (§2), or null if it can't. */
+export declare function readMap(raw: unknown): ReadMap | null;
+/**
+ * The mapped original position of a generated one (§10 lookup point): trace-mapping's greatest lower bound on the same
+ * generated line (0-based line and column). A 1-field segment, or no segment at or before the column, is unmapped.
+ */
+export declare function originalAt(map: ReadMap, line: number, column: number): {
+    source: SourceEntry;
+    index: number;
+    line: number;
+    column: number;
+} | null;
+/**
+ * How an original source's text may split into lines (§10 Token check): an artifact's two readings, or at LF only, as
+ * tools such as magic-string number an original's lines.
+ */
+type OriginalLineReading = LineReading | 'lf';
+/** Where each line of `text` starts, under a line reading: a CRLF ends one line. */
+export declare function lineStarts(text: string, reading: OriginalLineReading): number[];
+/** The 0-based line and column of a UTF-16 offset, through a line-start table. */
+export declare function position(starts: readonly number[], offset: number): {
+    line: number;
+    column: number;
+};
+/**
+ * The token check (§10): whether `token` appears as a whole identifier, case-sensitive, within ±1 line of the 0-based
+ * original `line` in `content`, under any of three line readings of the original: at §5's terminators, at LF and CR,
+ * or at LF only.
+ */
+export declare function tokenAppears(content: string, line: number, token: string): boolean;
+export {};

package/dist/packages/attribution/lib/source-map.js

@@ -0,0 +1,125 @@
+// Reading a verified source map for attribution (§10, §19 Discovery): positions are looked up with
+// `@jridgewell/trace-mapping` (`FlattenMap`, which flattens a sectioned map), and the raw `sources`, `sourceRoot` and
+// `sourcesContent` are read from the map's raw JSON, in `FlattenMap`'s section order.
+import { FlattenMap, traceSegment } from '@jridgewell/trace-mapping';
+import { relativeSourceRoot } from "./containing-package.js";
+/** Reads a map's raw JSON, which verification has already read with `FlattenMap` (§2), or null if it can't. */
+export function readMap(raw) {
+    try {
+        const trace = new FlattenMap(raw);
+        return { trace, sources: flattenedSources(raw) };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The sources of a map in `FlattenMap`'s order: a sectioned map's sections in turn, each flattened the same way, and a
+ * plain map's `sources` with its own `sourceRoot` and `sourcesContent`.
+ */
+function flattenedSources(raw) {
+    const map = typeof raw === 'string' ? JSON.parse(raw) : raw;
+    if (!isObject(map))
+        return [];
+    if (Array.isArray(map.sections)) {
+        return map.sections.flatMap((section) => (isObject(section) ? flattenedSources(section.map) : []));
+    }
+    const sources = Array.isArray(map.sources) ? map.sources : [];
+    const contents = Array.isArray(map.sourcesContent) ? map.sourcesContent : [];
+    const sourceRoot = relativeSourceRoot(map.sourceRoot);
+    const ignoreList = Array.isArray(map.ignoreList)
+        ? map.ignoreList
+        : Array.isArray(map.x_google_ignoreList)
+            ? map.x_google_ignoreList
+            : [];
+    return sources.map((source, index) => {
+        const content = contents[index];
+        return {
+            raw: typeof source === 'string' ? source : null,
+            sourceRoot,
+            content: typeof content === 'string' ? content : null,
+            ignored: ignoreList.includes(index),
+        };
+    });
+}
+/**
+ * The mapped original position of a generated one (§10 lookup point): trace-mapping's greatest lower bound on the same
+ * generated line (0-based line and column). A 1-field segment, or no segment at or before the column, is unmapped.
+ */
+export function originalAt(map, line, column) {
+    const segment = traceSegment(map.trace, line, column);
+    if (segment === null || segment.length === 1)
+        return null;
+    const [, index, originalLine, originalColumn] = segment;
+    const source = map.sources[index] ?? { raw: null, sourceRoot: null, content: null, ignored: false };
+    return { source, index, line: originalLine, column: originalColumn };
+}
+/** The terminators of each line reading (§2 Verification, §10 Token check). */
+const terminators = {
+    ecmascript: (code) => code === 0x0a || code === 0x0d || code === 0x2028 || code === 0x2029,
+    'lf-cr': (code) => code === 0x0a || code === 0x0d,
+    lf: (code) => code === 0x0a,
+};
+/** The line readings the token check tries on an original, any of which passes it (§10 Token check). */
+const originalReadings = ['ecmascript', 'lf-cr', 'lf'];
+/** Where each line of `text` starts, under a line reading: a CRLF ends one line. */
+export function lineStarts(text, reading) {
+    const ends = terminators[reading];
+    const starts = [0];
+    for (let i = 0; i < text.length; i++) {
+        const code = text.charCodeAt(i);
+        if (code === 0x0d && text.charCodeAt(i + 1) === 0x0a)
+            i++;
+        if (ends(code))
+            starts.push(i + 1);
+    }
+    return starts;
+}
+/** The 0-based line and column of a UTF-16 offset, through a line-start table. */
+export function position(starts, offset) {
+    let low = 0;
+    let high = starts.length - 1;
+    while (low < high) {
+        const middle = (low + high + 1) >> 1;
+        if (starts[middle] <= offset)
+            low = middle;
+        else
+            high = middle - 1;
+    }
+    return { line: low, column: offset - starts[low] };
+}
+/**
+ * The token check (§10): whether `token` appears as a whole identifier, case-sensitive, within ±1 line of the 0-based
+ * original `line` in `content`, under any of three line readings of the original: at §5's terminators, at LF and CR,
+ * or at LF only.
+ */
+export function tokenAppears(content, line, token) {
+    return originalReadings.some((reading) => appearsNear(content, lineStarts(content, reading), line, token));
+}
+/** Whether `token` appears as a whole identifier within ±1 line of `line`, through a line-start table. */
+function appearsNear(content, starts, line, token) {
+    const from = starts[Math.max(0, line - 1)] ?? content.length;
+    const to = starts[line + 2] ?? content.length;
+    const window = content.slice(from, to);
+    for (let at = window.indexOf(token); at >= 0; at = window.indexOf(token, at + 1)) {
+        const before = window.charCodeAt(at - 1);
+        const after = window.charCodeAt(at + token.length);
+        if (!identifierPart(before) && !identifierPart(after))
+            return true;
+    }
+    return false;
+}
+const identifierPartPattern = /[$\u200c\u200d\p{ID_Continue}]/u;
+/** Whether a UTF-16 code unit is an identifier part (ECMA-262 IdentifierPartChar). NaN, past either end, is not. */
+function identifierPart(code) {
+    if (Number.isNaN(code))
+        return false;
+    if (code < 0x80) {
+        return (code >= 0x30 && code <= 0x39) || (code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a) ||
+            code === 0x24 || code === 0x5f;
+    }
+    return identifierPartPattern.test(String.fromCharCode(code));
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/dist/packages/attribution/lib/yaml.d.ts

@@ -0,0 +1,9 @@
+/** A value read from lockfile YAML: every scalar is a string. */
+export type YamlValue = string | null | YamlValue[] | {
+    [key: string]: YamlValue;
+};
+/**
+ * Reads lockfile YAML, or returns null when the text is outside the subset. A stream of several documents (pnpm writes
+ * its environment lockfile first) reads as its last document.
+ */
+export declare function readYaml(input: string): YamlValue | null;

package/dist/packages/attribution/lib/yaml.js

@@ -0,0 +1,277 @@
+// The YAML that `pnpm-lock.yaml` and Yarn Berry's `yarn.lock` are written in (§10 Introducing dependencies): block
+// mappings and sequences, flow mappings and sequences, and plain or quoted scalars, every scalar read as a string.
+// Anchors, tags and block scalars, which neither lockfile writes, make the text unreadable. Pure.
+/** Thrown for text outside the lockfile subset. */
+class Unreadable extends Error {
+}
+/**
+ * Reads lockfile YAML, or returns null when the text is outside the subset. A stream of several documents (pnpm writes
+ * its environment lockfile first) reads as its last document.
+ */
+export function readYaml(input) {
+    const text = input.startsWith('') ? input.slice(1) : input;
+    const documents = [[]];
+    for (const raw of text.split(/\r?\n/)) {
+        if (/^---\s*$/.test(raw)) {
+            documents.push([]);
+            continue;
+        }
+        if (/^\.\.\.\s*$/.test(raw))
+            continue;
+        const body = withoutComment(raw).trimEnd();
+        if (body.trim() === '')
+            continue;
+        if (body.includes('\t') && /^\s*\t/.test(body))
+            return null;
+        const indent = body.length - body.trimStart().length;
+        documents.at(-1).push({ indent, text: body.trimStart() });
+    }
+    const lines = documents.filter((each) => each.length > 0).at(-1) ?? [];
+    try {
+        if (lines.length === 0)
+            return null;
+        const at = { i: 0 };
+        const value = block(lines, at, lines[0].indent);
+        if (at.i < lines.length)
+            throw new Unreadable();
+        return value;
+    }
+    catch (error) {
+        if (error instanceof Unreadable)
+            return null;
+        throw error;
+    }
+}
+/** A line without its comment: `#` at the start or after a space, outside quotes. */
+function withoutComment(line) {
+    let quote = null;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (quote !== null) {
+            if (quote === "'" && c === "'" && line[i + 1] === "'")
+                i++;
+            else if (quote === '"' && c === '\\')
+                i++;
+            else if (c === quote)
+                quote = null;
+        }
+        else if (c === "'" || c === '"') {
+            if (i === 0 || /[\s:[{,-]/.test(line[i - 1]))
+                quote = c;
+        }
+        else if (c === '#' && (i === 0 || /\s/.test(line[i - 1])))
+            return line.slice(0, i);
+    }
+    return line;
+}
+/** The block at `indent` starting at `at.i`: a sequence when its first line is a `- ` item, else a mapping. */
+function block(lines, at, indent) {
+    const first = lines[at.i];
+    if (first.text === '-' || first.text.startsWith('- '))
+        return sequence(lines, at, indent);
+    return mapping(lines, at, indent);
+}
+function sequence(lines, at, indent) {
+    const out = [];
+    while (at.i < lines.length) {
+        const line = lines[at.i];
+        if (line.indent < indent)
+            break;
+        if (line.indent > indent || !(line.text === '-' || line.text.startsWith('- ')))
+            throw new Unreadable();
+        const rest = line.text.slice(1).trimStart();
+        at.i++;
+        if (rest === '') {
+            out.push(nested(lines, at, indent));
+        }
+        else if (keyOf(rest) !== null) {
+            // An item that is a mapping: its first key sits on the item's line.
+            const shifted = [{ indent: indent + (line.text.length - rest.length), text: rest }];
+            const inner = { i: 0 };
+            const own = [...shifted];
+            while (at.i < lines.length && lines[at.i].indent > indent)
+                own.push(lines[at.i++]);
+            out.push(mapping(own, inner, shifted[0].indent));
+            if (inner.i < own.length)
+                throw new Unreadable();
+        }
+        else
+            out.push(inline(rest));
+    }
+    return out;
+}
+/** The more-indented block after a line that ends in `:` or `-`, or null when none follows. */
+function nested(lines, at, indent) {
+    const next = lines[at.i];
+    if (next === undefined || next.indent <= indent) {
+        // A block sequence may sit at its key's own indent.
+        if (next !== undefined && next.indent === indent && (next.text === '-' || next.text.startsWith('- '))) {
+            return sequence(lines, at, indent);
+        }
+        return null;
+    }
+    return block(lines, at, next.indent);
+}
+function mapping(lines, at, indent) {
+    const out = {};
+    while (at.i < lines.length) {
+        const line = lines[at.i];
+        if (line.indent < indent)
+            break;
+        if (line.indent > indent)
+            throw new Unreadable();
+        const found = keyOf(line.text);
+        if (found === null)
+            throw new Unreadable();
+        const { key, rest } = found;
+        at.i++;
+        const value = rest === '' ? nested(lines, at, indent) : inline(rest);
+        Object.defineProperty(out, key, { value, enumerable: true, writable: true, configurable: true });
+    }
+    return out;
+}
+/** A mapping line's key and the text after its `:`, or null when the line is no `key:` line. */
+function keyOf(text) {
+    if (text.startsWith('"') || text.startsWith("'")) {
+        const { value, end } = quoted(text, 0);
+        const after = text.slice(end).trimStart();
+        if (!after.startsWith(':'))
+            return null;
+        if (after.length > 1 && after[1] !== ' ')
+            return null;
+        return { key: value, rest: after.slice(1).trim() };
+    }
+    if (/^[[{&*!|>%@`]/.test(text))
+        return null;
+    for (let i = 0; i < text.length; i++) {
+        if (text[i] === ':' && (i + 1 === text.length || text[i + 1] === ' ')) {
+            return { key: text.slice(0, i).trimEnd(), rest: text.slice(i + 1).trim() };
+        }
+    }
+    return null;
+}
+/** A value written on its key's line: a flow collection or a scalar. */
+function inline(text) {
+    if (/^[&*!|>]/.test(text))
+        throw new Unreadable();
+    const at = { i: 0 };
+    const value = flow(text, at);
+    if (text.slice(at.i).trim() !== '')
+        throw new Unreadable();
+    return value;
+}
+/** A flow value at `at.i`: `{…}`, `[…]`, a quoted scalar, or a plain scalar that ends at `,`, `]` or `}`. */
+function flow(text, at, inCollection = false) {
+    skipSpaces(text, at);
+    const c = text[at.i];
+    if (c === '{') {
+        at.i++;
+        const out = {};
+        for (;;) {
+            skipSpaces(text, at);
+            if (text[at.i] === '}') {
+                at.i++;
+                return out;
+            }
+            const key = flowScalar(text, at, true);
+            skipSpaces(text, at);
+            let value = null;
+            if (text[at.i] === ':') {
+                at.i++;
+                value = flow(text, at, true);
+            }
+            Object.defineProperty(out, key ?? '', { value, enumerable: true, writable: true, configurable: true });
+            skipSpaces(text, at);
+            if (text[at.i] === ',')
+                at.i++;
+            else if (text[at.i] !== '}')
+                throw new Unreadable();
+        }
+    }
+    if (c === '[') {
+        at.i++;
+        const out = [];
+        for (;;) {
+            skipSpaces(text, at);
+            if (text[at.i] === ']') {
+                at.i++;
+                return out;
+            }
+            out.push(flow(text, at, true));
+            skipSpaces(text, at);
+            if (text[at.i] === ',')
+                at.i++;
+            else if (text[at.i] !== ']')
+                throw new Unreadable();
+        }
+    }
+    return flowScalar(text, at, inCollection);
+}
+function flowScalar(text, at, inCollection) {
+    skipSpaces(text, at);
+    const c = text[at.i];
+    if (c === '"' || c === "'") {
+        const { value, end } = quoted(text, at.i);
+        at.i = end;
+        return value;
+    }
+    const start = at.i;
+    while (at.i < text.length) {
+        const d = text[at.i];
+        if (inCollection && (d === ',' || d === ']' || d === '}'))
+            break;
+        if (inCollection && d === ':' && (at.i + 1 === text.length || /[\s,\]}]/.test(text[at.i + 1])))
+            break;
+        at.i++;
+    }
+    const plain = text.slice(start, at.i).trim();
+    if (plain === '')
+        return inCollection ? null : '';
+    return plain === '~' || plain === 'null' ? null : plain;
+}
+/** A quoted scalar starting at `start`: its value and the index after its closing quote. */
+function quoted(text, start) {
+    const quote = text[start];
+    let value = '';
+    for (let i = start + 1; i < text.length; i++) {
+        const c = text[i];
+        if (quote === "'") {
+            if (c === "'") {
+                if (text[i + 1] === "'") {
+                    value += "'";
+                    i++;
+                    continue;
+                }
+                return { value, end: i + 1 };
+            }
+            value += c;
+        }
+        else {
+            if (c === '"')
+                return { value, end: i + 1 };
+            if (c === '\\') {
+                const e = text[++i];
+                const escapes = { n: '\n', t: '\t', '"': '"', '\\': '\\', '/': '/', '0': '\0', r: '\r' };
+                if (e === 'u' || e === 'x') {
+                    const length = e === 'u' ? 4 : 2;
+                    const hex = text.slice(i + 1, i + 1 + length);
+                    if (!/^[0-9a-fA-F]+$/.test(hex) || hex.length !== length)
+                        throw new Unreadable();
+                    value += String.fromCharCode(parseInt(hex, 16));
+                    i += length;
+                }
+                else if (e !== undefined && e in escapes)
+                    value += escapes[e];
+                else
+                    throw new Unreadable();
+            }
+            else
+                value += c;
+        }
+    }
+    throw new Unreadable();
+}
+function skipSpaces(text, at) {
+    while (at.i < text.length && text[at.i] === ' ')
+        at.i++;
+}

package/dist/packages/attribution/lib/yarn.d.ts

@@ -0,0 +1,7 @@
+import { type ReadLockfile } from './lockfile-graph.ts';
+/** The manifests a `yarn.lock` needs besides its own directory's: Berry's workspace folders, or v1's globs. */
+export declare function yarnManifests(text: string, root: string | null): {
+    folders: string[];
+    globs: string[];
+};
+export declare function readYarn(text: string, file: string, manifests: Readonly<Record<string, string | null>>): ReadLockfile;