safeinstall-cli 0.1.0

package/dist/output.js

@@ -0,0 +1,93 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printConfigInfo = printConfigInfo;
+exports.formatCommand = formatCommand;
+exports.printWarnings = printWarnings;
+exports.writeCliResult = writeCliResult;
+const node_path_1 = __importDefault(require("node:path"));
+function printConfigInfo(configPath) {
+    if (configPath) {
+        console.error(`Using config: ${configPath}`);
+    }
+    else {
+        console.error("Using config: built-in defaults");
+    }
+}
+function formatCommand(command, args) {
+    return [node_path_1.default.basename(command), ...args].join(" ");
+}
+function printWarnings(evaluations) {
+    for (const evaluation of evaluations) {
+        for (const warning of evaluation.warnings) {
+            console.error(`Warning: ${warning}`);
+        }
+    }
+}
+function printReason(reason, indent = "") {
+    console.error(`${indent}${reason.message}`);
+    if (reason.suggestion) {
+        console.error(`${indent}Suggestion: ${reason.suggestion}`);
+    }
+}
+function serializeCliResult(result) {
+    const { details: _details, ...serialized } = result;
+    return serialized;
+}
+function writeCliResult(result, jsonMode) {
+    if (jsonMode) {
+        process.stdout.write(`${JSON.stringify(serializeCliResult(result), null, 2)}\n`);
+        return;
+    }
+    if (result.details?.suppressHumanOutput === true) {
+        return;
+    }
+    if (result.configLabel) {
+        console.error(`Using config: ${result.configLabel}`);
+    }
+    else if (result.configPath) {
+        printConfigInfo(result.configPath);
+    }
+    for (const warning of result.warnings) {
+        console.error(`Warning: ${warning}`);
+    }
+    if (result.mode === "init") {
+        if (result.decision === "allow") {
+            console.error(result.summary);
+            if (typeof result.details?.configPath === "string") {
+                console.error(`Created: ${result.details.configPath}`);
+            }
+            return;
+        }
+        for (const reason of result.reasons) {
+            printReason(reason);
+        }
+        return;
+    }
+    if (result.decision === "allow") {
+        console.error(result.summary);
+        return;
+    }
+    if (result.affectedPackages.length > 0) {
+        console.error(result.mode === "check" ? "Check blocked." : "Install blocked.");
+        for (const affectedPackage of result.affectedPackages) {
+            const packageLabel = affectedPackage.resolvedVersion
+                ? `${affectedPackage.name}@${affectedPackage.resolvedVersion}`
+                : affectedPackage.requested;
+            console.error(`- ${packageLabel}`);
+            for (const reason of affectedPackage.reasons) {
+                printReason(reason, "  ");
+            }
+        }
+        return;
+    }
+    console.error(result.mode === "check" ? "Check blocked." : "Install blocked.");
+    for (const reason of result.reasons) {
+        console.error(`- ${reason.message}`);
+        if (reason.suggestion) {
+            console.error(`  Suggestion: ${reason.suggestion}`);
+        }
+    }
+}

package/dist/package-managers.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPackageManagerCommand = buildPackageManagerCommand;
+exports.runPackageManager = runPackageManager;
+const node_child_process_1 = require("node:child_process");
+const signals_1 = require("./signals");
+const IGNORE_SCRIPTS_FLAG = {
+    npm: "--ignore-scripts",
+    pnpm: "--ignore-scripts",
+    bun: "--ignore-scripts"
+};
+function buildPackageManagerCommand(manager, managerArgs, command, forwardedArgs, config) {
+    const args = [...managerArgs, command, ...forwardedArgs];
+    const ignoreScriptsFlag = IGNORE_SCRIPTS_FLAG[manager];
+    if (config.packageManagerDefaults[manager].ignoreScripts &&
+        !args.includes(ignoreScriptsFlag) &&
+        !args.some((arg) => arg.startsWith(`${ignoreScriptsFlag}=`))) {
+        args.push(ignoreScriptsFlag);
+    }
+    return {
+        command: manager,
+        args
+    };
+}
+async function runPackageManager(options) {
+    (0, signals_1.throwIfAborted)(options.signal);
+    const built = buildPackageManagerCommand(options.manager, options.managerArgs, options.command, options.forwardedArgs, options.config);
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const child = (0, node_child_process_1.spawn)(built.command, built.args, {
+            stdio: options.stdio ?? "inherit",
+            cwd: options.cwd,
+            env: options.env ?? process.env
+        });
+        const onAbort = () => {
+            const shutdownError = (0, signals_1.getShutdownSignalError)(options.signal);
+            child.kill(shutdownError?.signalName ?? "SIGTERM");
+        };
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        const cleanup = () => {
+            options.signal?.removeEventListener("abort", onAbort);
+        };
+        const rejectOnce = (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            reject(error);
+        };
+        const resolveOnce = (result) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            resolve(result);
+        };
+        let stdout = "";
+        let stderr = "";
+        if (options.stdio === "pipe") {
+            child.stdout?.on("data", (chunk) => {
+                stdout += chunk.toString();
+            });
+            child.stderr?.on("data", (chunk) => {
+                stderr += chunk.toString();
+            });
+        }
+        child.on("error", (error) => {
+            const shutdownError = (0, signals_1.getShutdownSignalError)(options.signal);
+            if (shutdownError) {
+                rejectOnce(shutdownError);
+                return;
+            }
+            if (error.code === "ENOENT") {
+                rejectOnce(new Error(`Package manager "${options.manager}" was not found in PATH.`));
+                return;
+            }
+            rejectOnce(error);
+        });
+        child.on("exit", (code, signal) => {
+            const shutdownError = (0, signals_1.getShutdownSignalError)(options.signal);
+            if (shutdownError) {
+                rejectOnce(shutdownError);
+                return;
+            }
+            if (signal) {
+                rejectOnce(new Error(`Package manager exited with signal ${signal}.`));
+                return;
+            }
+            resolveOnce({
+                code: code ?? 1,
+                stdout: options.stdio === "pipe" ? stdout : undefined,
+                stderr: options.stdio === "pipe" ? stderr : undefined
+            });
+        });
+    });
+}

package/dist/policy.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluatePackage = evaluatePackage;
+function isPackageAllowlisted(config, packageName) {
+    return config.allowedPackages.includes(packageName);
+}
+function isSourcePolicyRelevant(sourceType) {
+    return sourceType !== "workspace" && sourceType !== "file" && sourceType !== "directory";
+}
+function allowedLifecycleScripts(config, packageName) {
+    return config.allowedScripts[packageName] ?? [];
+}
+function hasUnallowedLifecycleScripts(config, packageName, scripts) {
+    const allowed = new Set(allowedLifecycleScripts(config, packageName));
+    return scripts.some((script) => !allowed.has(script));
+}
+function releaseAgeHours(now, publishedAt) {
+    return (now.getTime() - publishedAt.getTime()) / 1000 / 60 / 60;
+}
+function formatHours(value) {
+    return value.toFixed(1).replace(/\.0$/, "");
+}
+function evaluatePackage(input) {
+    const evaluation = {
+        requested: input.requested,
+        priorState: input.priorState,
+        resolvedRegistryPackage: input.resolvedRegistryPackage,
+        blockedReasons: [],
+        warnings: []
+    };
+    if (isPackageAllowlisted(input.config, input.requested.name)) {
+        evaluation.warnings.push(`Package ${input.requested.name} is allowlisted; policy checks were skipped.`);
+        return evaluation;
+    }
+    if (isSourcePolicyRelevant(input.requested.sourceType) &&
+        !input.config.allowedSources.includes(input.requested.sourceType)) {
+        evaluation.blockedReasons.push({
+            code: "untrusted-source",
+            message: `Blocked: untrusted source (${input.requested.sourceType}).`,
+            suggestion: "Use a registry release or allow this source intentionally."
+        });
+    }
+    const priorSourceType = input.priorState?.declaredSourceType;
+    if (priorSourceType === "registry" &&
+        (input.requested.sourceType === "git" ||
+            input.requested.sourceType === "url" ||
+            input.requested.sourceType === "tarball")) {
+        evaluation.blockedReasons.push({
+            code: "trust-level-dropped",
+            message: `Blocked: trust level dropped (${input.requested.name} changed from registry to ${input.requested.sourceType}).`,
+            suggestion: "Keep this package on a registry release or allow the source change intentionally."
+        });
+    }
+    if (!input.resolvedRegistryPackage) {
+        return evaluation;
+    }
+    const ageHours = releaseAgeHours(input.now, input.resolvedRegistryPackage.publishedAt);
+    if (ageHours < input.config.minimumReleaseAgeHours) {
+        evaluation.blockedReasons.push({
+            code: "release-too-new",
+            message: `Blocked: release too new (${input.requested.name}@${input.resolvedRegistryPackage.resolvedVersion} is ${formatHours(ageHours)} hours old; minimum is ${input.config.minimumReleaseAgeHours} hours).`,
+            suggestion: "Retry later or lower minimumReleaseAgeHours if this package is intentionally urgent."
+        });
+    }
+    if (input.resolvedRegistryPackage.lifecycleScripts.length > 0 &&
+        hasUnallowedLifecycleScripts(input.config, input.requested.name, input.resolvedRegistryPackage.lifecycleScripts)) {
+        evaluation.blockedReasons.push({
+            code: "install-script-present",
+            message: `Blocked: install script present (${input.requested.name}@${input.resolvedRegistryPackage.resolvedVersion} has ${input.resolvedRegistryPackage.lifecycleScripts.join(", ")}).`,
+            suggestion: "Allow this package explicitly in allowedScripts if you trust its install hooks."
+        });
+    }
+    const priorHadLifecycleScripts = (input.priorLifecycleScripts ?? []).length > 0;
+    const currentHasLifecycleScripts = input.resolvedRegistryPackage.lifecycleScripts.length > 0;
+    if (!priorHadLifecycleScripts && currentHasLifecycleScripts && input.priorState?.installedVersion) {
+        evaluation.blockedReasons.push({
+            code: "trust-level-dropped",
+            message: `Blocked: trust level dropped (${input.requested.name} introduces lifecycle scripts in ${input.resolvedRegistryPackage.resolvedVersion}; installed ${input.priorState.installedVersion} had none).`,
+            suggestion: "Review the new version carefully and allow the script only if you intend to trust it."
+        });
+    }
+    return evaluation;
+}

package/dist/project-discovery.js

@@ -0,0 +1,90 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fileExists = fileExists;
+exports.findNearestUpward = findNearestUpward;
+exports.findNearestPackageDir = findNearestPackageDir;
+exports.resolveEffectiveCwd = resolveEffectiveCwd;
+exports.hasAmbiguousWorkspaceFlags = hasAmbiguousWorkspaceFlags;
+exports.resolveInvocationContext = resolveInvocationContext;
+exports.relativeProjectKey = relativeProjectKey;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const CWD_FLAGS = new Set(["-C", "--dir", "--cwd", "--prefix"]);
+const AMBIGUOUS_WORKSPACE_FLAGS = {
+    npm: new Set(["-w", "--workspace", "--workspaces"]),
+    pnpm: new Set(["-F", "--filter", "-r", "--recursive"]),
+    bun: new Set([])
+};
+async function fileExists(filePath) {
+    try {
+        await (0, promises_1.access)(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function findNearestUpward(startDir, fileName) {
+    let currentDir = node_path_1.default.resolve(startDir);
+    while (true) {
+        const candidate = node_path_1.default.join(currentDir, fileName);
+        if (await fileExists(candidate)) {
+            return candidate;
+        }
+        const parentDir = node_path_1.default.dirname(currentDir);
+        if (parentDir === currentDir) {
+            return undefined;
+        }
+        currentDir = parentDir;
+    }
+}
+async function findNearestPackageDir(startDir) {
+    const packageJsonPath = await findNearestUpward(startDir, "package.json");
+    return packageJsonPath ? node_path_1.default.dirname(packageJsonPath) : undefined;
+}
+function extractFlagValue(args, index) {
+    const token = args[index];
+    if (token.includes("=")) {
+        return token.slice(token.indexOf("=") + 1);
+    }
+    return args[index + 1];
+}
+function resolveEffectiveCwd(invokedCwd, args) {
+    let effectiveCwd = node_path_1.default.resolve(invokedCwd);
+    for (let index = 0; index < args.length; index += 1) {
+        const token = args[index];
+        const flagName = token.includes("=") ? token.slice(0, token.indexOf("=")) : token;
+        if (!CWD_FLAGS.has(flagName)) {
+            continue;
+        }
+        const flagValue = extractFlagValue(args, index);
+        if (!flagValue) {
+            continue;
+        }
+        effectiveCwd = node_path_1.default.resolve(invokedCwd, flagValue);
+        if (!token.includes("=")) {
+            index += 1;
+        }
+    }
+    return effectiveCwd;
+}
+function hasAmbiguousWorkspaceFlags(manager, args) {
+    const flags = AMBIGUOUS_WORKSPACE_FLAGS[manager];
+    return args.some((token) => flags.has(token.includes("=") ? token.slice(0, token.indexOf("=")) : token));
+}
+async function resolveInvocationContext(invokedCwd, forwardedArgs) {
+    const effectiveCwd = resolveEffectiveCwd(invokedCwd, forwardedArgs);
+    const packageDir = await findNearestPackageDir(effectiveCwd);
+    return {
+        invokedCwd: node_path_1.default.resolve(invokedCwd),
+        effectiveCwd,
+        packageDir
+    };
+}
+function relativeProjectKey(rootDir, packageDir) {
+    const relativePath = node_path_1.default.relative(rootDir, packageDir);
+    return relativePath === "" ? "." : relativePath.split(node_path_1.default.sep).join("/");
+}

package/dist/project-installs/npm.js

@@ -0,0 +1,93 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadNpmProjectInstallTargets = loadNpmProjectInstallTargets;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const project_state_1 = require("../project-state");
+const project_discovery_1 = require("../project-discovery");
+const shared_1 = require("./shared");
+function readDirectManifestDependencies(manifestDependencies) {
+    return Object.entries(manifestDependencies).sort(([left], [right]) => left.localeCompare(right));
+}
+async function resolveNpmLockfilePath(effectiveCwd) {
+    let currentDir = node_path_1.default.resolve(effectiveCwd);
+    while (true) {
+        const packageLockPath = node_path_1.default.join(currentDir, "package-lock.json");
+        if (await (0, project_discovery_1.fileExists)(packageLockPath)) {
+            return packageLockPath;
+        }
+        const shrinkwrapPath = node_path_1.default.join(currentDir, "npm-shrinkwrap.json");
+        if (await (0, project_discovery_1.fileExists)(shrinkwrapPath)) {
+            return shrinkwrapPath;
+        }
+        const parentDir = node_path_1.default.dirname(currentDir);
+        if (parentDir === currentDir) {
+            return undefined;
+        }
+        currentDir = parentDir;
+    }
+}
+async function loadNpmProjectInstallTargets(effectiveCwd, packageDir) {
+    const lockfilePath = await resolveNpmLockfilePath(effectiveCwd);
+    if (!lockfilePath) {
+        return {
+            targets: [],
+            issues: ["Project install blocked: package-lock.json or npm-shrinkwrap.json is required for safeinstall npm install."]
+        };
+    }
+    const rootDir = node_path_1.default.dirname(lockfilePath);
+    const targetPackageDir = packageDir ?? rootDir;
+    const packageEntryKey = (0, project_discovery_1.relativeProjectKey)(rootDir, targetPackageDir) === "." ? "" : (0, project_discovery_1.relativeProjectKey)(rootDir, targetPackageDir);
+    const manifestDependencies = await (0, project_state_1.loadManifestDependencies)(targetPackageDir);
+    const directDependencies = readDirectManifestDependencies(manifestDependencies);
+    if (directDependencies.length === 0) {
+        return {
+            targets: [],
+            issues: [],
+            lockfilePath
+        };
+    }
+    const rawLockfile = await (0, promises_1.readFile)(lockfilePath, "utf8");
+    const lockfile = JSON.parse(rawLockfile);
+    const packageEntry = lockfile.packages?.[packageEntryKey];
+    if (!packageEntry) {
+        return {
+            targets: [],
+            issues: [
+                `Project install blocked: ${targetPackageDir} does not map to a package entry in ${node_path_1.default.basename(lockfilePath)}.`
+            ],
+            lockfilePath
+        };
+    }
+    const issues = [];
+    const targets = [];
+    for (const [name, manifestSpec] of directDependencies) {
+        const lockedSpec = packageEntry.dependencies?.[name] ??
+            packageEntry.devDependencies?.[name] ??
+            packageEntry.optionalDependencies?.[name];
+        if (lockedSpec && lockedSpec !== manifestSpec) {
+            issues.push(`Project install blocked: ${name} has specifier ${JSON.stringify(manifestSpec)} in package.json but ${JSON.stringify(lockedSpec)} in ${node_path_1.default.basename(lockfilePath)}.`);
+            continue;
+        }
+        const resolvedPackageEntry = lockfile.packages?.[`node_modules/${name}`] ??
+            lockfile.packages?.[`${packageEntryKey ? `${packageEntryKey}/` : ""}node_modules/${name}`] ??
+            lockfile.dependencies?.[name];
+        if (!resolvedPackageEntry) {
+            issues.push(`Project install blocked: ${name} is declared in package.json but missing from ${node_path_1.default.basename(lockfilePath)}.`);
+            continue;
+        }
+        const declaredSourceType = (0, project_state_1.classifyDeclaredSource)(manifestSpec);
+        const sourceType = (0, shared_1.classifyResolvedSource)(declaredSourceType, resolvedPackageEntry.resolved, Boolean(resolvedPackageEntry.integrity));
+        targets.push({
+            manifestSpec,
+            requested: sourceType === "registry" && resolvedPackageEntry.version
+                ? (0, shared_1.createRegistryRequestedPackage)(name, resolvedPackageEntry.version)
+                : (0, shared_1.createNonRegistryRequestedPackage)(name, manifestSpec, sourceType, resolvedPackageEntry.resolved ?? manifestSpec),
+            lockfilePath
+        });
+    }
+    return { targets, issues, lockfilePath };
+}

package/dist/project-installs/pnpm.js

@@ -0,0 +1,166 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadPnpmProjectInstallTargets = loadPnpmProjectInstallTargets;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const yaml_1 = require("yaml");
+const project_state_1 = require("../project-state");
+const project_discovery_1 = require("../project-discovery");
+const shared_1 = require("./shared");
+function readDirectManifestDependencies(manifestDependencies) {
+    return Object.entries(manifestDependencies).sort(([left], [right]) => left.localeCompare(right));
+}
+function normalizeImporterDependency(entry) {
+    if (!entry) {
+        return {};
+    }
+    if (typeof entry === "string") {
+        return { version: entry };
+    }
+    return {
+        specifier: entry.specifier,
+        version: entry.version
+    };
+}
+function getImporter(lockfile, importerKey) {
+    if (lockfile.importers?.[importerKey]) {
+        return lockfile.importers[importerKey];
+    }
+    if (importerKey === "." && (lockfile.dependencies ||
+        lockfile.devDependencies ||
+        lockfile.optionalDependencies ||
+        lockfile.specifiers)) {
+        const applySpecifiers = (entries) => {
+            if (!entries) {
+                return undefined;
+            }
+            return Object.fromEntries(Object.entries(entries).map(([name, entry]) => {
+                if (typeof entry === "string") {
+                    return [name, { specifier: lockfile.specifiers?.[name], version: entry }];
+                }
+                return [name, { specifier: entry.specifier ?? lockfile.specifiers?.[name], version: entry.version }];
+            }));
+        };
+        return {
+            dependencies: applySpecifiers(lockfile.dependencies),
+            devDependencies: applySpecifiers(lockfile.devDependencies),
+            optionalDependencies: applySpecifiers(lockfile.optionalDependencies)
+        };
+    }
+    return undefined;
+}
+function findPackageEntry(packages, name, versionRef) {
+    if (!packages) {
+        return undefined;
+    }
+    const exactKey = `${name}@${versionRef}`;
+    if (packages[exactKey]) {
+        return packages[exactKey];
+    }
+    const legacyKey = `/${name}/${versionRef}`;
+    if (packages[legacyKey]) {
+        return packages[legacyKey];
+    }
+    const matchingKey = Object.keys(packages).find((entryKey) => entryKey === exactKey || entryKey.startsWith(`${exactKey}(`));
+    if (matchingKey) {
+        return packages[matchingKey];
+    }
+    const legacyMatchingKey = Object.keys(packages).find((entryKey) => entryKey === legacyKey || entryKey.startsWith(`${legacyKey}_`));
+    return legacyMatchingKey ? packages[legacyMatchingKey] : undefined;
+}
+async function loadPnpmProjectInstallTargets(effectiveCwd, packageDir) {
+    const lockfilePath = await (async () => {
+        let currentDir = node_path_1.default.resolve(effectiveCwd);
+        while (true) {
+            const candidate = node_path_1.default.join(currentDir, "pnpm-lock.yaml");
+            if (await (0, project_discovery_1.fileExists)(candidate)) {
+                return candidate;
+            }
+            const parentDir = node_path_1.default.dirname(currentDir);
+            if (parentDir === currentDir) {
+                return undefined;
+            }
+            currentDir = parentDir;
+        }
+    })();
+    if (!lockfilePath) {
+        return {
+            targets: [],
+            issues: ["Project install blocked: pnpm-lock.yaml is required for safeinstall pnpm install."]
+        };
+    }
+    const rootDir = node_path_1.default.dirname(lockfilePath);
+    const targetPackageDir = packageDir ?? rootDir;
+    const importerKey = (0, project_discovery_1.relativeProjectKey)(rootDir, targetPackageDir);
+    const manifestDependencies = await (0, project_state_1.loadManifestDependencies)(targetPackageDir);
+    const directDependencies = readDirectManifestDependencies(manifestDependencies);
+    if (directDependencies.length === 0) {
+        return {
+            targets: [],
+            issues: [],
+            lockfilePath
+        };
+    }
+    const rawLockfile = await (0, promises_1.readFile)(lockfilePath, "utf8");
+    const lockfile = (0, yaml_1.parse)(rawLockfile);
+    const importer = getImporter(lockfile, importerKey);
+    if (!importer) {
+        return {
+            targets: [],
+            issues: [
+                `Project install blocked: ${targetPackageDir} does not map to a pnpm importer in ${node_path_1.default.basename(lockfilePath)}.`
+            ],
+            lockfilePath
+        };
+    }
+    const importerDependencies = {
+        ...(importer.dependencies ?? {}),
+        ...(importer.devDependencies ?? {}),
+        ...(importer.optionalDependencies ?? {})
+    };
+    const issues = [];
+    const targets = [];
+    for (const [name, manifestSpec] of directDependencies) {
+        const importerDependency = normalizeImporterDependency(importerDependencies[name]);
+        if (!importerDependency.version) {
+            issues.push(`Project install blocked: ${name} is declared in package.json but missing from pnpm-lock.yaml.`);
+            continue;
+        }
+        if (importerDependency.specifier && importerDependency.specifier !== manifestSpec) {
+            issues.push(`Project install blocked: ${name} has specifier ${JSON.stringify(manifestSpec)} in package.json but ${JSON.stringify(importerDependency.specifier)} in pnpm-lock.yaml.`);
+            continue;
+        }
+        const packageEntry = findPackageEntry(lockfile.packages, name, importerDependency.version);
+        const declaredSourceType = (0, project_state_1.classifyDeclaredSource)(manifestSpec);
+        if (importerDependency.version.startsWith("link:")) {
+            targets.push({
+                manifestSpec,
+                requested: (0, shared_1.createNonRegistryRequestedPackage)(name, manifestSpec, declaredSourceType === "directory" ? "directory" : "workspace", importerDependency.version),
+                lockfilePath
+            });
+            continue;
+        }
+        if (importerDependency.version.startsWith("file:")) {
+            targets.push({
+                manifestSpec,
+                requested: (0, shared_1.createNonRegistryRequestedPackage)(name, manifestSpec, "file", importerDependency.version),
+                lockfilePath
+            });
+            continue;
+        }
+        const packageVersion = packageEntry?.version ?? (0, shared_1.extractSemverPrefix)(importerDependency.version);
+        const resolvedReference = packageEntry?.resolution?.tarball ?? importerDependency.version;
+        const sourceType = (0, shared_1.classifyResolvedSource)(declaredSourceType, resolvedReference, Boolean(packageEntry?.resolution?.integrity));
+        targets.push({
+            manifestSpec,
+            requested: sourceType === "registry" && packageVersion
+                ? (0, shared_1.createRegistryRequestedPackage)(name, packageVersion)
+                : (0, shared_1.createNonRegistryRequestedPackage)(name, importerDependency.specifier ?? manifestSpec, sourceType, resolvedReference),
+            lockfilePath
+        });
+    }
+    return { targets, issues, lockfilePath };
+}