pnpm-dedup 2.1.0

package/src/helpers/collectDependentRanges.test.ts

@@ -0,0 +1,311 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, strictEqual } from "node:assert/strict";
+import { fileURLToPath } from "node:url";
+import { readPnpmLock } from "../readPnpmLock.ts";
+import { collectDependentRanges } from "./collectDependentRanges.ts";
+import type { ManifestReader } from "./readInstalledManifest.ts";
+import { createManifestReader } from "./readInstalledManifest.ts";
+
+const fixturesBase = (rel: string) =>
+  fileURLToPath(new URL(rel, import.meta.url));
+
+const lockFor = (scenario: string) =>
+  readPnpmLock(fixturesBase(`../../test/fixtures/${scenario}/pnpm-lock.yaml`));
+
+const rangesFor = (
+  scenario: string,
+  packageNames: string[],
+  readManifest: ManifestReader = () => undefined,
+) =>
+  collectDependentRanges(
+    lockFor(scenario),
+    new Set(packageNames),
+    readManifest,
+  );
+
+// In `wildcard-not-reused`, `@tamagui/metro-plugin@1.139.4` declares
+// `metro-config: "*"` and `metro-transform-worker: "*"`. The lockfile only
+// stores the version pnpm picked (0.87.0), so the wildcard is only visible
+// through the installed manifest.
+const wildcardScenario = "wildcard-not-reused";
+const wildcardPackages = ["metro-config", "metro-transform-worker"];
+const wildcardDependent = "@tamagui/metro-plugin@1.139.4";
+
+const readWildcardManifest: ManifestReader = (name, version) =>
+  name === "@tamagui/metro-plugin" && version === "1.139.4"
+    ? { dependencies: { "metro-config": "*", "metro-transform-worker": "*" } }
+    : undefined;
+
+// `exact-pin-forces-downgrade` commits its virtual store, so the ranges come
+// from the real reader: `@yudiel/react-qr-scanner` pins `barcode-detector`
+// exactly at 3.0.3 while `expo-camera` declares `^3.0.0` and resolved 3.2.2.
+const downgradeScenario = "exact-pin-forces-downgrade";
+const readDowngradeManifest = createManifestReader(
+  fixturesBase(`../../test/fixtures/${downgradeScenario}`),
+);
+
+const rangeOf = (
+  ranges: ReturnType<typeof collectDependentRanges>,
+  packageName: string,
+  dependentKey: string,
+): string | undefined =>
+  ranges.get(packageName)?.find((dependent) => dependent.key === dependentKey)
+    ?.range;
+
+describe("collectDependentRanges", () => {
+  it("takes a direct dependency's range from the importer specifier", () => {
+    deepStrictEqual(rangesFor("simple", ["semver"]).get("semver"), [
+      {
+        key: "package.json in dependencies",
+        range: "7.7.3",
+        resolvedVersion: "7.7.3",
+        workspace: { path: ".", depType: "dependencies" },
+      },
+    ]);
+  });
+
+  it("ignores packages that are not in the requested set", () => {
+    deepStrictEqual(
+      [...rangesFor("duplicated-babel-frame", ["@babel/code-frame"]).keys()],
+      ["@babel/code-frame"],
+    );
+  });
+
+  it("reads a transitive dependent's declared range from its manifest", () => {
+    const ranges = rangesFor(
+      wildcardScenario,
+      wildcardPackages,
+      readWildcardManifest,
+    );
+    for (const name of wildcardPackages) {
+      strictEqual(rangeOf(ranges, name, wildcardDependent), "*");
+    }
+  });
+
+  it("falls back to the resolved version when the manifest is unavailable", () => {
+    const ranges = rangesFor(wildcardScenario, wildcardPackages);
+    for (const name of wildcardPackages) {
+      strictEqual(rangeOf(ranges, name, wildcardDependent), "0.87.0");
+    }
+  });
+
+  // pnpm folds a resolved peer into the snapshot's `dependencies`, so the edge is
+  // there — but only as the version it resolved to. The range stays in the
+  // `packages:` entry, and read from there a peer constraint needs no
+  // `node_modules`: without it every one of these read as an exact pin of 10.5.0,
+  // and no version could satisfy them all.
+  it("reads a peer range from the lockfile when no manifest is available", () => {
+    const ranges = rangesFor("duplicated-typescript-eslint", ["eslint"]);
+
+    strictEqual(
+      rangeOf(ranges, "eslint", "@eslint-community/eslint-utils@4.9.1"),
+      "^6.0.0 || ^7.0.0 || >=8.0.0",
+    );
+    strictEqual(
+      rangeOf(ranges, "eslint", "@typescript-eslint/eslint-plugin@8.61.0"),
+      "^8.57.0 || ^9.0.0 || ^10.0.0",
+    );
+    // declared optional, and kept: pnpm only writes the edge once something
+    // provides the peer, so an edge that exists is a peer that was provided
+    strictEqual(rangeOf(ranges, "eslint", "@eslint/js@10.0.1"), "^10.0.0");
+  });
+
+  // pnpm resolves a peer like any other edge, so nothing in the snapshot tells a
+  // peer requester apart from one holding a copy of its own — the report has to
+  it("marks a dependent whose range came from a peer declaration", () => {
+    const dependents =
+      rangesFor("duplicated-typescript-eslint", ["eslint"]).get("eslint") ?? [];
+
+    strictEqual(
+      dependents.find(
+        (dependent) => dependent.key === "eslint-plugin-n@17.24.0",
+      )?.peer,
+      true,
+    );
+    // a real dependency edge onto the same package stays unmarked
+    strictEqual(
+      rangesFor("duplicated-typescript-eslint", ["@eslint/plugin-kit"])
+        .get("@eslint/plugin-kit")
+        ?.find((dependent) => dependent.key === "eslint@10.5.0")?.peer,
+      undefined,
+    );
+  });
+
+  // the manifest is read first, so a name a package declares as both a
+  // dependency and a peer keeps the dependency's range
+  it("prefers a manifest declaration over the lockfile peer block", () => {
+    strictEqual(
+      rangeOf(
+        rangesFor("duplicated-typescript-eslint", ["eslint"], (name, version) =>
+          name === "@eslint-community/eslint-utils" && version === "4.9.1"
+            ? { dependencies: { eslint: "^10.1.0" } }
+            : undefined,
+        ),
+        "eslint",
+        "@eslint-community/eslint-utils@4.9.1",
+      ),
+      "^10.1.0",
+    );
+  });
+
+  it("separates a caret dependent's range from the version it resolved to", () => {
+    const ranges = rangesFor(
+      downgradeScenario,
+      ["barcode-detector"],
+      readDowngradeManifest,
+    );
+
+    deepStrictEqual(ranges.get("barcode-detector"), [
+      {
+        key: "@yudiel/react-qr-scanner@2.3.1",
+        range: "3.0.3",
+        resolvedVersion: "3.0.3",
+        requesterName: "@yudiel/react-qr-scanner",
+      },
+      {
+        key: "expo-camera@57.0.3",
+        range: "^3.0.0",
+        resolvedVersion: "3.2.2",
+        requesterName: "expo-camera",
+      },
+    ]);
+  });
+
+  // `aliased-swapped-names`: the importer reaches the real `typescript` through
+  // the `@typescript/native` key and hands the `typescript` key to another
+  // package. The dependent has to be filed under the npm name the specifier
+  // targets, with the range and the version the alias resolved to, and the key
+  // it was declared under — that key is what makes the declaration binding
+  // rather than a range the dedupe may rewrite.
+  it("resolves an importer alias whose key names another package", () => {
+    const ranges = rangesFor("aliased-swapped-names", [
+      "typescript",
+      "@typescript/typescript6",
+    ]);
+
+    deepStrictEqual(ranges.get("typescript"), [
+      {
+        key: "package.json in devDependencies",
+        range: "7.0.2",
+        resolvedVersion: "7.0.2",
+        aliasKey: "@typescript/native",
+        workspace: { path: ".", depType: "devDependencies" },
+      },
+      {
+        key: "tool@1.0.0",
+        range: "5.9.3",
+        resolvedVersion: "5.9.3",
+        requesterName: "tool",
+      },
+    ]);
+
+    deepStrictEqual(ranges.get("@typescript/typescript6"), [
+      {
+        key: "package.json in devDependencies",
+        range: "6.0.2",
+        resolvedVersion: "6.0.2",
+        aliasKey: "typescript",
+        workspace: { path: ".", depType: "devDependencies" },
+      },
+    ]);
+  });
+
+  // pnpm writes an aliased importer's `version` as `realName@version`, which is
+  // not a version: carrying it through would put a string no semver call accepts
+  // where the resolved version belongs.
+  it("strips the alias target from an importer's resolved version", () => {
+    deepStrictEqual(
+      rangesFor("mergeable-alias", ["printable-shell-command"])
+        .get("printable-shell-command")
+        ?.filter((dependent) => dependent.workspace !== undefined),
+      [
+        {
+          key: "package.json in devDependencies",
+          range: "^5.0.0",
+          resolvedVersion: "5.3.1",
+          workspace: { path: ".", depType: "devDependencies" },
+        },
+        {
+          key: "package.json in devDependencies",
+          range: "5.0.7",
+          resolvedVersion: "5.0.7",
+          aliasKey: "printable-shell-command-pinned",
+          workspace: { path: ".", depType: "devDependencies" },
+        },
+      ],
+    );
+  });
+
+  it("keeps the exact ranges a package declares for its own family", () => {
+    const ranges = rangesFor(
+      wildcardScenario,
+      wildcardPackages,
+      readWildcardManifest,
+    );
+    for (const name of wildcardPackages) {
+      strictEqual(rangeOf(ranges, name, "metro@0.84.5"), "0.84.5");
+      strictEqual(rangeOf(ranges, name, "metro@0.87.0"), "0.87.0");
+    }
+  });
+
+  // A `workspace:`, `catalog:`, `file:` or `link:` specifier names something
+  // other than the npm package sharing its key, and a dist-tag carries no
+  // comparable range. Both would read as unsatisfiable ranges rather than as
+  // "no constraint", which suppresses merges the real dependents allow.
+  it("leaves out importer specifiers that are not npm ranges", () => {
+    const ranges = rangesFor("protocol-dependents", [
+      "helper",
+      "semver",
+      "picocolors",
+      "left-pad",
+      "kleur",
+      "chalk",
+    ]);
+
+    // only the snapshot dependent of `app` survives for semver; the importer
+    // declares it as `latest`
+    deepStrictEqual(ranges.get("semver"), [
+      {
+        key: "app@1.0.0",
+        range: "7.8.1",
+        resolvedVersion: "7.8.1",
+        requesterName: "app",
+      },
+    ]);
+
+    for (const name of ["helper", "picocolors", "left-pad", "kleur", "chalk"]) {
+      strictEqual(ranges.has(name), false);
+    }
+  });
+
+  // A transitive dependent whose installed manifest declares a non-npm
+  // protocol falls back to the version it actually got, rather than carrying
+  // `workspace:*` into a semver comparison.
+  it("falls back to the resolved version when the manifest range is not comparable", () => {
+    const readWorkspaceManifest: ManifestReader = (name, version) =>
+      name === "@tamagui/metro-plugin" && version === "1.139.4"
+        ? {
+            dependencies: {
+              "metro-config": "workspace:*",
+              "metro-transform-worker": "*",
+            },
+          }
+        : undefined;
+
+    const ranges = rangesFor(
+      wildcardScenario,
+      wildcardPackages,
+      readWorkspaceManifest,
+    );
+
+    strictEqual(
+      rangeOf(ranges, "metro-config", wildcardDependent),
+      // the resolved version, not `*` and not `workspace:*`
+      "0.87.0",
+    );
+    strictEqual(
+      rangeOf(ranges, "metro-transform-worker", wildcardDependent),
+      "*",
+    );
+  });
+});

package/src/helpers/collectDependentRanges.ts

@@ -0,0 +1,185 @@
+import {
+  PackageDependencyDescriptorUtils,
+  isSemverComparable,
+} from "pm-dedup-core";
+import type { ClusterWorkspaceRef } from "pm-dedup-core";
+import type { PnpmLockFile } from "../pnpmLockTypes.ts";
+import {
+  parsePackageId,
+  resolveSnapshotDependency,
+} from "./parsePnpmLockPackages.ts";
+import type { PnpmProtocol } from "./pnpmProtocol.ts";
+import type {
+  InstalledManifest,
+  ManifestReader,
+} from "./readInstalledManifest.ts";
+
+export interface DependentRange {
+  key: string;
+  range: string;
+  // version the requester actually got
+  resolvedVersion?: string;
+  // npm name of the requester, or undefined for an importer (workspace) one
+  requesterName?: string;
+  // the key the declaration sits under, when it names another package
+  // (`"@typescript/native": "npm:typescript@7.0.2"`). The range constrains
+  // `typescript` all the same, but the declaration is not `typescript`'s
+  aliasKey?: string;
+  // set for importer dependents only: where the range is declared on disk
+  workspace?: ClusterWorkspaceRef;
+  // the range comes from `peerDependencies`. pnpm resolves the peer like any
+  // other edge, so the requester constrains the version without holding a copy
+  // of its own, and the report has to name the declaration it comes from
+  peer?: true;
+}
+
+export type DependentRangesMap = Map<string, DependentRange[]>;
+
+const snapshotDepTypes = ["dependencies", "optionalDependencies"] as const;
+const manifestDepTypes = [
+  "dependencies",
+  "optionalDependencies",
+  "peerDependencies",
+] as const;
+
+// a declaration semver cannot read says nothing about the version; the caller
+// falls back to the version this requester actually got
+const declaredRange = (
+  depName: string,
+  declared: string,
+): string | undefined => {
+  const parsed = PackageDependencyDescriptorUtils.parse<PnpmProtocol>(
+    depName,
+    declared,
+  );
+  return isSemverComparable(parsed) ? parsed.selector : undefined;
+};
+
+// which declaration a range was read from, so a peer requester can be told
+// apart from one holding a copy of its own
+interface RangeSource {
+  range: string;
+  peer?: true;
+}
+
+const manifestRange = (
+  manifest: InstalledManifest | undefined,
+  depName: string,
+): RangeSource | undefined => {
+  if (!manifest) return undefined;
+  for (const depType of manifestDepTypes) {
+    const declared = manifest[depType]?.[depName];
+    if (declared === undefined) continue;
+    const range = declaredRange(depName, declared);
+    if (range === undefined) return undefined;
+    return depType === "peerDependencies" ? { range, peer: true } : { range };
+  }
+  return undefined;
+};
+
+/**
+ * The peer range as the lockfile itself records it.
+ *
+ * pnpm resolves peers before writing the lockfile and folds each resolved peer
+ * into the snapshot's `dependencies` — which is why a peer edge is found here at
+ * all, unlike yarn's, where the fold lives only in the virtual packages the
+ * lockfile omits. But the snapshot carries the resolved *version*; the range
+ * stays behind in the `packages:` entry. Without it, seventeen plugins declaring
+ * `eslint: "^6.0.0 || ^7.0.0 || >=8.0.0"` and the like all read as exact pins of
+ * whatever got installed, and no version can satisfy them all — every merge
+ * ruled out by ranges that never said so.
+ *
+ * `packages:` keys carry no peer suffix, so the resolved id addresses the entry
+ * directly. `depName` is the key the requester declared, which is what an
+ * aliased peer sits under.
+ */
+const lockfilePeerRange = (
+  lock: PnpmLockFile,
+  dependent: { name: string; version: string },
+  depName: string,
+): RangeSource | undefined => {
+  const declared =
+    lock.packages?.[`${dependent.name}@${dependent.version}`]
+      ?.peerDependencies?.[depName];
+  if (declared === undefined) return undefined;
+  const range = declaredRange(depName, declared);
+  return range === undefined ? undefined : { range, peer: true };
+};
+
+/**
+ * Collect, for each duplicated package, the real semver range every dependent
+ * declares. Direct (importer) dependents carry their specifier; transitive
+ * dependents' ranges are read from their installed manifest (the pnpm lockfile
+ * only stores the resolved version, not the range). When a manifest is missing
+ * (project not installed), the resolved version is used as an exact fallback.
+ */
+export const collectDependentRanges = (
+  lock: PnpmLockFile,
+  duplicatePackageNames: Set<string>,
+  readManifest: ManifestReader,
+): DependentRangesMap => {
+  const rangesMap: DependentRangesMap = new Map();
+
+  const add = (name: string, dependent: DependentRange): void => {
+    if (!duplicatePackageNames.has(name)) return;
+    let dependents = rangesMap.get(name);
+    if (!dependents) {
+      dependents = [];
+      rangesMap.set(name, dependents);
+    }
+    dependents.push(dependent);
+  };
+
+  for (const [importerPath, project] of Object.entries(lock.importers ?? {})) {
+    (
+      ["dependencies", "devDependencies", "optionalDependencies"] as const
+    ).forEach((depType) => {
+      const deps = project[depType];
+      if (!deps) return;
+      for (const [depName, { specifier, version }] of Object.entries(deps)) {
+        const parsed = PackageDependencyDescriptorUtils.parse<PnpmProtocol>(
+          depName,
+          specifier,
+        );
+        // `workspace:` and `catalog:` name something other than the npm package
+        // sharing this key, so they constrain no npm version
+        if (!isSemverComparable(parsed)) continue;
+        add(parsed.npmName, {
+          key: `${importerPath === "." ? "package.json" : importerPath} in ${depType}`,
+          range: parsed.selector,
+          // an aliased importer entry stores `realName@version`, not a version
+          resolvedVersion: resolveSnapshotDependency(depName, version).version,
+          ...(parsed.isAlias ? { aliasKey: parsed.key } : {}),
+          workspace: { path: importerPath, depType },
+        });
+      }
+    });
+  }
+
+  for (const [snapshotKey, snapshot] of Object.entries(lock.snapshots ?? {})) {
+    const dependent = parsePackageId(snapshotKey);
+    snapshotDepTypes.forEach((depType) => {
+      const deps = snapshot[depType];
+      if (!deps) return;
+      for (const [depName, depValue] of Object.entries(deps)) {
+        const { name, version } = resolveSnapshotDependency(depName, depValue);
+        if (!duplicatePackageNames.has(name)) continue;
+        const source =
+          manifestRange(
+            readManifest(dependent.name, dependent.version),
+            depName,
+          ) ?? lockfilePeerRange(lock, dependent, depName);
+        add(name, {
+          key: `${dependent.name}@${dependent.version}`,
+          range: source?.range ?? version,
+          resolvedVersion: version,
+          requesterName: dependent.name,
+          ...(name === depName ? {} : { aliasKey: depName }),
+          ...(source?.peer ? { peer: source.peer } : {}),
+        });
+      }
+    });
+  }
+
+  return rangesMap;
+};

package/src/helpers/collectPnpmDependents.test.ts

@@ -0,0 +1,112 @@
+import { describe, it } from "bun:test";
+import { deepStrictEqual, ok, strictEqual } from "node:assert/strict";
+import { fileURLToPath } from "node:url";
+import { readPnpmLock } from "../readPnpmLock.ts";
+import { collectPnpmDependents } from "./collectPnpmDependents.ts";
+
+const fixturesBase = (rel: string) =>
+  fileURLToPath(new URL(rel, import.meta.url));
+
+const lockFor = (scenario: string) =>
+  readPnpmLock(fixturesBase(`../../test/fixtures/${scenario}/pnpm-lock.yaml`));
+
+describe("collectPnpmDependents", () => {
+  it("collects the importer specifier (range) for a direct dependency", () => {
+    const dependents = collectPnpmDependents(lockFor("simple"));
+    deepStrictEqual(dependents.get("semver"), [
+      { key: "package.json in dependencies", version: "7.7.3" },
+    ]);
+  });
+
+  it("collects both importer range and transitive resolved versions", () => {
+    const dependents = collectPnpmDependents(
+      lockFor("duplicated-babel-frame"),
+      ["@babel/code-frame"],
+    );
+    const codeFrame = dependents.get("@babel/code-frame");
+    ok(codeFrame);
+    // direct importer dependency carries the specifier range
+    ok(
+      codeFrame.some(
+        (dependent) =>
+          dependent.key === "package.json in dependencies" &&
+          dependent.version === "7.26.2",
+      ),
+    );
+    // transitive dependents carry a resolved version
+    ok(codeFrame.some((dependent) => dependent.version === "7.29.7"));
+    ok(codeFrame.length >= 2);
+  });
+
+  // A `workspace:`, `catalog:`, `file:` or `link:` specifier names something
+  // other than the npm package sharing its key, and a dist-tag carries no
+  // comparable range. Recording them as ranges makes `semver.satisfies` answer
+  // "not satisfied" for every candidate, suppressing merges the real dependents
+  // allow.
+  it("leaves out importer specifiers that are not npm ranges", () => {
+    const dependents = collectPnpmDependents(lockFor("protocol-dependents"));
+
+    deepStrictEqual([...dependents.keys()].toSorted(), ["app", "semver"]);
+
+    // the importer declares `semver` as `latest`, so only the snapshot dependent
+    // of `app` remains
+    deepStrictEqual(dependents.get("semver"), [
+      { key: "app@1.0.0", version: "7.8.1" },
+    ]);
+
+    for (const packageName of [
+      "helper",
+      "picocolors",
+      "left-pad",
+      "kleur",
+      "chalk",
+    ]) {
+      strictEqual(dependents.has(packageName), false);
+    }
+  });
+
+  it("keeps the range an aliased importer specifier declares", () => {
+    const dependents = collectPnpmDependents(lockFor("mergeable-alias"), [
+      "printable-shell-command",
+    ]);
+
+    deepStrictEqual(
+      (dependents.get("printable-shell-command") ?? [])
+        .filter((dependent) => dependent.key.startsWith("package.json"))
+        .map((dependent) => dependent.version)
+        .toSorted(),
+      ["5.0.7", "^5.0.0"],
+    );
+  });
+
+  // `aliased-swapped-names`: the importer declares `"@typescript/native":
+  // "npm:typescript@7.0.2"` and `"typescript":
+  // "npm:@typescript/typescript6@6.0.2"`, so each key names the other's package.
+  // Filing either under its key would put an exact pin on the wrong package.
+  it("files a swapped alias under the package its specifier targets", () => {
+    const dependents = collectPnpmDependents(lockFor("aliased-swapped-names"));
+
+    deepStrictEqual(dependents.get("typescript"), [
+      { key: "package.json in devDependencies", version: "7.0.2" },
+      { key: "tool@1.0.0", version: "5.9.3" },
+    ]);
+
+    deepStrictEqual(dependents.get("@typescript/typescript6"), [
+      { key: "package.json in devDependencies", version: "6.0.2" },
+    ]);
+  });
+
+  it("restricts results to onlyPackageNames", () => {
+    const dependents = collectPnpmDependents(
+      lockFor("duplicated-printable-shell-command"),
+      ["printable-shell-command"],
+    );
+    strictEqual(
+      [...dependents.keys()].every(
+        (name) => name === "printable-shell-command",
+      ),
+      true,
+    );
+    ok(dependents.get("printable-shell-command"));
+  });
+});

package/src/helpers/collectPnpmDependents.ts

@@ -0,0 +1,79 @@
+import {
+  PackageDependencyDescriptorUtils,
+  isSemverComparable,
+} from "pm-dedup-core";
+import type { PnpmLockFile } from "../pnpmLockTypes.ts";
+import {
+  parsePackageId,
+  resolveSnapshotDependency,
+} from "./parsePnpmLockPackages.ts";
+import type { PnpmProtocol } from "./pnpmProtocol.ts";
+
+export interface Dependent {
+  key: string;
+  version: string;
+}
+
+export type DependentsMap = Map<string, Dependent[]>;
+
+const importerDepTypes = [
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+] as const;
+
+const snapshotDepTypes = ["dependencies", "optionalDependencies"] as const;
+
+export function collectPnpmDependents(
+  lock: PnpmLockFile,
+  onlyPackageNames?: string[],
+): DependentsMap {
+  const dependentsMap: DependentsMap = new Map();
+
+  const add = (name: string, dependent: Dependent): void => {
+    if (onlyPackageNames && !onlyPackageNames.includes(name)) {
+      return;
+    }
+    let dependents = dependentsMap.get(name);
+    if (!dependents) {
+      dependents = [];
+      dependentsMap.set(name, dependents);
+    }
+    dependents.push(dependent);
+  };
+
+  for (const [importerPath, project] of Object.entries(lock.importers ?? {})) {
+    importerDepTypes.forEach((depType) => {
+      const deps = project[depType];
+      if (!deps) return;
+      for (const [depName, { specifier }] of Object.entries(deps)) {
+        const parsedDep = PackageDependencyDescriptorUtils.parse<PnpmProtocol>(
+          depName,
+          specifier,
+        );
+        // `workspace:` and `catalog:` name something other than the npm package
+        // sharing this key, so they constrain no npm version
+        if (!isSemverComparable(parsedDep)) continue;
+        add(parsedDep.npmName, {
+          key: `${importerPath === "." ? "package.json" : importerPath} in ${depType}`,
+          version: parsedDep.selector,
+        });
+      }
+    });
+  }
+
+  for (const [snapshotKey, snapshot] of Object.entries(lock.snapshots ?? {})) {
+    const { name, version } = parsePackageId(snapshotKey);
+    const key = `${name}@${version}`;
+    snapshotDepTypes.forEach((depType) => {
+      const deps = snapshot[depType];
+      if (!deps) return;
+      for (const [depName, depValue] of Object.entries(deps)) {
+        const resolved = resolveSnapshotDependency(depName, depValue);
+        add(resolved.name, { key, version: resolved.version });
+      }
+    });
+  }
+
+  return dependentsMap;
+}