supply-chain-guard 5.2.45 → 5.3.0

package/dist/lockfile-checker.d.ts

@@ -1,16 +1,51 @@
 /**
  * Lockfile integrity verification (T-006)
  *
- * Parses package-lock.json and checks for:
+ * Covers all four major JavaScript package-manager lockfile formats:
+ * - package-lock.json (npm, lockfile v1/v2/v3)
+ * - pnpm-lock.yaml (pnpm v6 "/name@1.2.3" and v9 "name@1.2.3" package keys)
+ * - yarn.lock (classic v1 and Berry v2+ with __metadata)
+ * - bun.lock (JSONC text lockfile, bun >= 1.2); binary bun.lockb is flagged
+ *   as unauditable instead of parsed
+ *
+ * Shared checks across all formats:
  * - Integrity hashes matching expected format (sha512/sha256/sha1)
- * - Packages resolved from non-registry URLs
+ * - Packages resolved from non-registry / plain-HTTP / git URLs
+ * - Missing integrity data on resolvable packages
+ * - Known-compromised package versions (ioc-blocklist)
+ *
+ * npm-only checks (package-lock.json):
  * - Dependencies in lockfile but not in package.json
  * - Lockfile version downgrades
  */
 import type { Finding } from "./types.js";
 /**
- * Check a directory for lockfile issues.
- * Returns findings if a lockfile is present.
+ * Check a directory for lockfile issues across all supported formats.
+ * A repo can contain several lockfiles (e.g. after a package-manager
+ * migration); all present ones are checked.
  */
 export declare function checkLockfile(dir: string): Finding[];
+/**
+ * Check package-lock.json (npm) for lockfile issues.
+ * Returns findings if the lockfile is present.
+ */
+export declare function checkNpmLockfile(dir: string): Finding[];
+/**
+ * Check pnpm-lock.yaml for lockfile issues.
+ * Supports v6 ("/name@1.2.3") and v9 ("name@1.2.3") package-key styles.
+ */
+export declare function checkPnpmLockfile(dir: string): Finding[];
+/**
+ * Check yarn.lock for lockfile issues. Detects classic v1 (entry headers
+ * like 'name@^1.0.0:') and Berry v2+ (YAML with __metadata, keys like
+ * "name@npm:^1.0.0") automatically.
+ */
+export declare function checkYarnLockfile(dir: string): Finding[];
+/**
+ * Check bun lockfiles. The text lockfile (bun.lock, JSONC) is parsed and
+ * audited; the binary lockfile (bun.lockb) cannot be audited and is flagged
+ * with a low-severity finding instead. When both exist, bun uses the text
+ * lockfile, so the binary one is not flagged.
+ */
+export declare function checkBunLockfile(dir: string): Finding[];
 //# sourceMappingURL=lockfile-checker.d.ts.map

package/dist/lockfile-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile-checker.d.ts","sourceRoot":"","sources":["../src/lockfile-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAmD1C;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CAwDpD"}
+{"version":3,"file":"lockfile-checker.d.ts","sourceRoot":"","sources":["../src/lockfile-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAoE1C;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CAOpD;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CAgDvD;AA8TD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CAsBxD;AA2GD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CAsBxD;AAqKD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,EAAE,CA6CvD"}