upstream-radar 0.32.0 → 0.33.0

package/dist/src/graph.js

@@ -49,14 +49,15 @@ function candidateDependencyPaths(parentPath, dependencyName) {
     candidates.push(`node_modules/${dependencyName}`);
     return [...new Set(candidates)];
 }
-function dependencyEntries(item) {
+function dependencyEntries(item, includeDevelopment = true) {
     const selected = new Map();
     const add = (value, kind, selectKind) => {
         for (const [name, spec] of Object.entries(asStringRecord(value))) {
             selected.set(name, { spec, kind: selectKind?.(name) ?? kind });
         }
     };
-    add(item.devDependencies, 'development');
+    if (includeDevelopment)
+        add(item.devDependencies, 'development');
     add(item.dependencies, 'runtime');
     const optionalPeers = optionalPeerNames(item.peerDependenciesMeta);
     add(item.peerDependencies, 'peer', name => optionalPeers.has(name) ? 'optional' : 'peer');
@@ -96,10 +97,20 @@ export function parseNpmLockGraph(lockfile, rootPackage) {
             continue;
         allNodes.set(path, { id: path, name, version });
     }
+    const rootRecord = asRecord(rawPackages['']);
+    const rootRecordName = typeof rootRecord?.name === 'string' ? rootRecord.name : undefined;
+    const rootRecordVersion = typeof rootRecord?.version === 'string' ? rootRecord.version : undefined;
+    const workspaceRootId = rootRecordName === rootPackage.name && rootRecordVersion === rootPackage.version
+        ? `npm:workspace-root:${rootPackage.name}@${rootPackage.version}`
+        : undefined;
+    if (workspaceRootId !== undefined && rootRecord !== undefined) {
+        records.set(workspaceRootId, rootRecord);
+        allNodes.set(workspaceRootId, { id: workspaceRootId, name: rootPackage.name, version: rootPackage.version });
+    }
     const roots = [...allNodes.values()]
         .filter(node => node.name === rootPackage.name && node.version === rootPackage.version)
         .sort((left, right) => left.id.length - right.id.length || left.id.localeCompare(right.id));
-    const rootNode = roots[0];
+    const rootNode = workspaceRootId === undefined ? roots[0] : allNodes.get(workspaceRootId);
     if (rootNode === undefined) {
         throw new Error(`requested root package is not present in npm lockfile: ${rootPackage.name}@${rootPackage.version}`);
     }
@@ -109,7 +120,7 @@ export function parseNpmLockGraph(lockfile, rootPackage) {
         const item = records.get(parentPath);
         if (item === undefined)
             continue;
-        for (const dependency of dependencyEntries(item)) {
+        for (const dependency of dependencyEntries(item, parentPath !== workspaceRootId)) {
             const targetPath = candidateDependencyPaths(parentPath, dependency.name)
                 .find(candidate => allNodes.has(candidate));
             if (targetPath === undefined) {
@@ -156,6 +167,591 @@ export function parseNpmLockGraph(lockfile, rootPackage) {
         ...(reachableUnresolved.length === 0 ? {} : { unresolved: reachableUnresolved }),
     };
 }
+const MAX_PNPM_LOCKFILE_BYTES = 16 * 1024 * 1024;
+const MAX_PNPM_LOCKFILE_LINES = 500_000;
+const MAX_PNPM_LOCKFILE_PACKAGES = 100_000;
+const MAX_PNPM_LOCKFILE_EDGES = 250_000;
+const PNPM_DEPENDENCY_SECTIONS = new Set(['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']);
+function stripPnpmYamlComment(value) {
+    let quote;
+    for (let index = 0; index < value.length; index += 1) {
+        const character = value[index];
+        if (quote === 'single') {
+            if (character === "'" && value[index + 1] === "'") {
+                index += 1;
+            }
+            else if (character === "'") {
+                quote = undefined;
+            }
+            continue;
+        }
+        if (quote === 'double') {
+            if (character === '\\')
+                index += 1;
+            else if (character === '"')
+                quote = undefined;
+            continue;
+        }
+        if (character === "'")
+            quote = 'single';
+        else if (character === '"')
+            quote = 'double';
+        else if (character === '#' && (index === 0 || /\s/.test(value[index - 1] ?? '')))
+            return value.slice(0, index).trimEnd();
+    }
+    return value.trimEnd();
+}
+function pnpmMappingColon(value) {
+    let quote;
+    for (let index = 0; index < value.length; index += 1) {
+        const character = value[index];
+        if (quote === 'single') {
+            if (character === "'" && value[index + 1] === "'")
+                index += 1;
+            else if (character === "'")
+                quote = undefined;
+            continue;
+        }
+        if (quote === 'double') {
+            if (character === '\\')
+                index += 1;
+            else if (character === '"')
+                quote = undefined;
+            continue;
+        }
+        if (character === "'")
+            quote = 'single';
+        else if (character === '"')
+            quote = 'double';
+        else if (character === ':' && (index + 1 === value.length || /\s/.test(value[index + 1] ?? '')))
+            return index;
+    }
+    return -1;
+}
+function parsePnpmYamlScalar(value, line) {
+    const trimmed = stripPnpmYamlComment(value).trim();
+    if (trimmed === '')
+        return '';
+    if (trimmed.startsWith("'") && trimmed.endsWith("'")) {
+        return trimmed.slice(1, -1).replaceAll("''", "'");
+    }
+    if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (typeof parsed !== 'string')
+                throw new Error('not a string');
+            return parsed;
+        }
+        catch {
+            throw new Error(`pnpm lockfile has an invalid quoted scalar on line ${line}`);
+        }
+    }
+    if (trimmed.startsWith('{') || trimmed.startsWith('[') || trimmed.startsWith('&') || trimmed.startsWith('*')) {
+        return trimmed;
+    }
+    return trimmed;
+}
+function parsePnpmMapping(line) {
+    const colon = pnpmMappingColon(line.content);
+    if (colon < 0)
+        return undefined;
+    const key = parsePnpmYamlScalar(line.content.slice(0, colon), line.line);
+    if (key === '')
+        throw new Error(`pnpm lockfile has an empty mapping key on line ${line.line}`);
+    return { key, value: parsePnpmYamlScalar(line.content.slice(colon + 1), line.line) };
+}
+function preparePnpmYamlLines(text) {
+    if (Buffer.byteLength(text, 'utf8') > MAX_PNPM_LOCKFILE_BYTES) {
+        throw new Error(`pnpm lockfile exceeds the ${MAX_PNPM_LOCKFILE_BYTES} byte limit`);
+    }
+    const rawLines = text.split(/\r?\n/);
+    if (rawLines.length > MAX_PNPM_LOCKFILE_LINES) {
+        throw new Error(`pnpm lockfile exceeds the ${MAX_PNPM_LOCKFILE_LINES} line limit`);
+    }
+    const lines = [];
+    for (let index = 0; index < rawLines.length; index += 1) {
+        const raw = rawLines[index] ?? '';
+        if (raw.includes('\t'))
+            throw new Error(`pnpm lockfile uses tabs on line ${index + 1}`);
+        const content = stripPnpmYamlComment(raw).trimEnd();
+        if (content.trim() === '' || content.trim() === '---' || content.trim() === '...')
+            continue;
+        const indent = raw.length - raw.trimStart().length;
+        if (indent > 256)
+            throw new Error(`pnpm lockfile indentation is too deep on line ${index + 1}`);
+        lines.push({ indent, content: content.slice(indent), line: index + 1 });
+    }
+    return lines;
+}
+function pnpmSectionRange(lines, section) {
+    const start = lines.findIndex(line => line.indent === 0 && parsePnpmMapping(line)?.key === section);
+    if (start < 0)
+        throw new Error(`pnpm lockfile does not contain a ${section} section`);
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        if (lines[index]?.indent === 0) {
+            end = index;
+            break;
+        }
+    }
+    return { start, end };
+}
+function parsePnpmInlineDependencyMap(value, line) {
+    const trimmed = value.trim();
+    if (!trimmed.startsWith('{') || !trimmed.endsWith('}'))
+        return {};
+    const result = {};
+    let start = 1;
+    let quote;
+    let depth = 0;
+    const parts = [];
+    for (let index = 1; index < trimmed.length - 1; index += 1) {
+        const character = trimmed[index];
+        if (quote === 'single') {
+            if (character === "'" && trimmed[index + 1] === "'")
+                index += 1;
+            else if (character === "'")
+                quote = undefined;
+        }
+        else if (quote === 'double') {
+            if (character === '\\')
+                index += 1;
+            else if (character === '"')
+                quote = undefined;
+        }
+        else if (character === "'")
+            quote = 'single';
+        else if (character === '"')
+            quote = 'double';
+        else if (character === '{' || character === '[')
+            depth += 1;
+        else if (character === '}' || character === ']')
+            depth -= 1;
+        else if (character === ',' && depth === 0) {
+            parts.push(trimmed.slice(start, index));
+            start = index + 1;
+        }
+    }
+    parts.push(trimmed.slice(start, -1));
+    for (const part of parts) {
+        const colon = pnpmMappingColon(part.trim());
+        if (colon < 0)
+            throw new Error(`pnpm lockfile has an invalid inline dependency map on line ${line}`);
+        const key = parsePnpmYamlScalar(part.trim().slice(0, colon), line);
+        const dependency = parsePnpmYamlScalar(part.trim().slice(colon + 1), line);
+        if (key === '' || dependency === '')
+            throw new Error(`pnpm lockfile has an invalid inline dependency map on line ${line}`);
+        if (Object.hasOwn(result, key))
+            throw new Error(`pnpm lockfile repeats dependency ${key} on line ${line}`);
+        result[key] = dependency;
+    }
+    return result;
+}
+function parsePnpmChildMap(lines, start, end, parentIndent, label) {
+    const result = {};
+    for (let index = start; index < end; index += 1) {
+        const line = lines[index];
+        if (line === undefined || line.indent <= parentIndent)
+            break;
+        if (line.indent !== parentIndent + 2)
+            continue;
+        const mapping = parsePnpmMapping(line);
+        if (mapping === undefined)
+            continue;
+        if (mapping.value === '')
+            continue;
+        if (Object.hasOwn(result, mapping.key))
+            throw new Error(`pnpm lockfile repeats ${label} ${mapping.key} on line ${line.line}`);
+        result[mapping.key] = mapping.value;
+    }
+    return result;
+}
+function parsePnpmEntry(lines, start, end) {
+    const entry = {
+        dependencies: {},
+        devDependencies: {},
+        optionalDependencies: {},
+        peerDependencies: {},
+        optionalPeers: new Set(),
+    };
+    for (let index = start + 1; index < end; index += 1) {
+        const line = lines[index];
+        if (line === undefined || line.indent <= 2)
+            break;
+        if (line.indent !== 4)
+            continue;
+        const mapping = parsePnpmMapping(line);
+        if (mapping === undefined)
+            continue;
+        if (PNPM_DEPENDENCY_SECTIONS.has(mapping.key)) {
+            const parsed = mapping.value.startsWith('{')
+                ? parsePnpmInlineDependencyMap(mapping.value, line.line)
+                : parsePnpmChildMap(lines, index + 1, end, line.indent, mapping.key);
+            Object.assign(entry[mapping.key], parsed);
+        }
+        else if (mapping.key === 'peerDependenciesMeta' && mapping.value === '') {
+            for (let child = index + 1; child < end; child += 1) {
+                const childLine = lines[child];
+                if (childLine === undefined || childLine.indent <= line.indent)
+                    break;
+                if (childLine.indent !== line.indent + 2)
+                    continue;
+                const childMapping = parsePnpmMapping(childLine);
+                if (childMapping === undefined || childMapping.value !== '')
+                    continue;
+                for (let meta = child + 1; meta < end; meta += 1) {
+                    const metaLine = lines[meta];
+                    if (metaLine === undefined || metaLine.indent <= childLine.indent)
+                        break;
+                    if (metaLine.indent !== childLine.indent + 2)
+                        continue;
+                    const metaMapping = parsePnpmMapping(metaLine);
+                    if (metaMapping?.key === 'optional' && metaMapping.value === 'true')
+                        entry.optionalPeers.add(childMapping.key);
+                }
+            }
+        }
+    }
+    return entry;
+}
+function parsePnpmSectionEntries(lines, section) {
+    const range = pnpmSectionRange(lines, section);
+    const result = new Map();
+    for (let index = range.start + 1; index < range.end; index += 1) {
+        const line = lines[index];
+        if (line === undefined || line.indent !== 2)
+            continue;
+        const mapping = parsePnpmMapping(line);
+        if (mapping === undefined)
+            continue;
+        if (mapping.value !== '' && mapping.value !== '{}')
+            throw new Error(`pnpm lockfile ${section} entry ${mapping.key} must be a mapping on line ${line.line}`);
+        let end = range.end;
+        for (let next = index + 1; next < range.end; next += 1) {
+            if (lines[next]?.indent !== undefined && (lines[next]?.indent ?? 0) <= 2) {
+                end = next;
+                break;
+            }
+        }
+        if (result.has(mapping.key))
+            throw new Error(`pnpm lockfile repeats ${section} entry ${mapping.key}`);
+        result.set(mapping.key, parsePnpmEntry(lines, index, end));
+        index = end - 1;
+    }
+    return result;
+}
+function pnpmTopLevelSectionExists(lines, section) {
+    return lines.some(line => line.indent === 0 && parsePnpmMapping(line)?.key === section);
+}
+function parsePnpmTopLevelDependencyMap(lines, section) {
+    if (!pnpmTopLevelSectionExists(lines, section))
+        return {};
+    const range = pnpmSectionRange(lines, section);
+    const result = {};
+    for (let index = range.start + 1; index < range.end; index += 1) {
+        const line = lines[index];
+        if (line === undefined || line.indent !== 2)
+            continue;
+        const mapping = parsePnpmMapping(line);
+        if (mapping === undefined || mapping.value === '')
+            continue;
+        if (Object.hasOwn(result, mapping.key))
+            throw new Error(`pnpm lockfile repeats ${section} dependency ${mapping.key}`);
+        result[mapping.key] = mapping.value;
+    }
+    return result;
+}
+function parsePnpmRootImporter(lines) {
+    if (!pnpmTopLevelSectionExists(lines, 'importers'))
+        return undefined;
+    const range = pnpmSectionRange(lines, 'importers');
+    let start = -1;
+    for (let index = range.start + 1; index < range.end; index += 1) {
+        const line = lines[index];
+        if (line?.indent === 2 && parsePnpmMapping(line)?.key === '.') {
+            start = index;
+            break;
+        }
+    }
+    if (start < 0)
+        return undefined;
+    let end = range.end;
+    for (let index = start + 1; index < range.end; index += 1) {
+        if (lines[index]?.indent !== undefined && (lines[index]?.indent ?? 0) <= 2) {
+            end = index;
+            break;
+        }
+    }
+    const entry = {
+        dependencies: {},
+        devDependencies: {},
+        optionalDependencies: {},
+        peerDependencies: {},
+        optionalPeers: new Set(),
+    };
+    for (let index = start + 1; index < end; index += 1) {
+        const line = lines[index];
+        if (line === undefined || line.indent !== 4)
+            continue;
+        const mapping = parsePnpmMapping(line);
+        if (mapping === undefined || !PNPM_DEPENDENCY_SECTIONS.has(mapping.key))
+            continue;
+        const target = entry[mapping.key];
+        if (mapping.value !== '') {
+            Object.assign(target, parsePnpmInlineDependencyMap(mapping.value, line.line));
+            continue;
+        }
+        for (let child = index + 1; child < end; child += 1) {
+            const childLine = lines[child];
+            if (childLine === undefined || childLine.indent <= line.indent)
+                break;
+            if (childLine.indent !== line.indent + 2)
+                continue;
+            const childMapping = parsePnpmMapping(childLine);
+            if (childMapping === undefined)
+                continue;
+            let version = childMapping.value;
+            if (version === '') {
+                for (let detail = child + 1; detail < end; detail += 1) {
+                    const detailLine = lines[detail];
+                    if (detailLine === undefined || detailLine.indent <= childLine.indent)
+                        break;
+                    if (detailLine.indent !== childLine.indent + 2)
+                        continue;
+                    const detailMapping = parsePnpmMapping(detailLine);
+                    if (detailMapping?.key === 'version')
+                        version = detailMapping.value;
+                }
+            }
+            if (version !== '')
+                target[childMapping.key] = version;
+        }
+    }
+    return entry;
+}
+function splitPnpmLocatorVersion(value) {
+    const markers = [value.indexOf('('), value.indexOf('_')].filter(index => index >= 0);
+    const marker = markers.length === 0 ? -1 : Math.min(...markers);
+    const version = marker < 0 ? value : value.slice(0, marker);
+    if (version === '')
+        return undefined;
+    return { version, suffix: marker < 0 ? '' : value.slice(marker) };
+}
+function parsePnpmLocator(value) {
+    let key = value.trim();
+    if (key.startsWith('/'))
+        key = key.slice(1);
+    if (key === '' || key.startsWith('link:') || key.startsWith('file:') || key.startsWith('workspace:'))
+        return undefined;
+    let name;
+    let versionWithSuffix;
+    const firstSlash = key.indexOf('/');
+    const peerMarkers = [key.indexOf('('), key.indexOf('_')].filter(index => index >= 0);
+    const firstPeerMarker = peerMarkers.length === 0 ? -1 : Math.min(...peerMarkers);
+    if (key.startsWith('@')) {
+        const secondSlash = firstSlash < 0 ? -1 : key.indexOf('/', firstSlash + 1);
+        const atAfterName = firstSlash < 0 ? -1 : key.indexOf('@', firstSlash + 1);
+        if (secondSlash > firstSlash && (atAfterName < 0 || secondSlash < atAfterName)) {
+            name = key.slice(0, secondSlash);
+            versionWithSuffix = key.slice(secondSlash + 1);
+        }
+        else if (atAfterName > firstSlash) {
+            name = key.slice(0, atAfterName);
+            versionWithSuffix = key.slice(atAfterName + 1);
+        }
+        else {
+            return undefined;
+        }
+    }
+    else {
+        const at = key.indexOf('@');
+        if (firstSlash > 0 && (firstPeerMarker < 0 || firstSlash < firstPeerMarker) && (at < 0 || firstSlash < at || (firstPeerMarker >= 0 && at > firstPeerMarker))) {
+            name = key.slice(0, firstSlash);
+            versionWithSuffix = key.slice(firstSlash + 1);
+        }
+        else if (at > 0) {
+            name = key.slice(0, at);
+            versionWithSuffix = key.slice(at + 1);
+        }
+        else {
+            return undefined;
+        }
+    }
+    const split = splitPnpmLocatorVersion(versionWithSuffix);
+    if (split === undefined || name === '' || split.version === '')
+        return undefined;
+    return { key, name, version: split.version, suffix: split.suffix };
+}
+function pnpmDependencyEntries(entry) {
+    const selected = new Map();
+    const add = (value, kind, selectKind) => {
+        for (const [name, spec] of Object.entries(value))
+            selected.set(name, { spec, kind: selectKind?.(name) ?? kind });
+    };
+    add(entry.devDependencies, 'development');
+    add(entry.dependencies, 'runtime');
+    add(entry.peerDependencies, 'peer', name => entry.optionalPeers.has(name) ? 'optional' : 'peer');
+    add(entry.optionalDependencies, 'optional');
+    return [...selected.entries()].map(([name, value]) => ({ name, ...value }));
+}
+function normalizedPnpmSuffix(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith('_'))
+        return trimmed.slice(1);
+    if (trimmed.startsWith('(') && trimmed.endsWith(')'))
+        return trimmed.slice(1, -1);
+    return trimmed;
+}
+function pnpmDependencyReference(spec, dependencyName) {
+    const trimmed = spec.trim();
+    const firstPeerMarker = [trimmed.indexOf('('), trimmed.indexOf('_')].filter(index => index >= 0);
+    const firstAt = trimmed.indexOf('@');
+    const firstMarker = firstPeerMarker.length === 0 ? -1 : Math.min(...firstPeerMarker);
+    const canBeFullLocator = trimmed.startsWith('/')
+        || (firstAt >= 0 && (firstMarker < 0 || firstAt < firstMarker));
+    if (canBeFullLocator) {
+        const full = parsePnpmLocator(trimmed);
+        if (full === undefined || full.name !== dependencyName)
+            return undefined;
+        return { version: full.version, suffix: full.suffix };
+    }
+    const split = splitPnpmLocatorVersion(trimmed);
+    return split;
+}
+function pnpmRecordCoordinateKey(name, version) {
+    return `${name}\0${version}`;
+}
+/** Parse pnpm lockfile v6/v9 package snapshots without installing or executing package code. */
+export function parsePnpmLockGraph(text, rootPackage) {
+    const lines = preparePnpmYamlLines(text);
+    const packageEntries = parsePnpmSectionEntries(lines, 'packages');
+    const snapshotEntries = lines.some(line => line.indent === 0 && parsePnpmMapping(line)?.key === 'snapshots')
+        ? parsePnpmSectionEntries(lines, 'snapshots')
+        : new Map();
+    if (packageEntries.size > MAX_PNPM_LOCKFILE_PACKAGES || snapshotEntries.size > MAX_PNPM_LOCKFILE_PACKAGES) {
+        throw new Error(`pnpm lockfile exceeds the ${MAX_PNPM_LOCKFILE_PACKAGES} package limit`);
+    }
+    const records = new Map();
+    const addRecords = (entries) => {
+        for (const [rawKey, entry] of entries) {
+            const locator = parsePnpmLocator(rawKey);
+            if (locator === undefined)
+                continue;
+            const existing = records.get(locator.key);
+            if (existing === undefined) {
+                records.set(locator.key, { ...locator, id: `pnpm:${locator.key}`, entry });
+            }
+            else {
+                existing.entry = {
+                    dependencies: { ...existing.entry.dependencies, ...entry.dependencies },
+                    devDependencies: { ...existing.entry.devDependencies, ...entry.devDependencies },
+                    optionalDependencies: { ...existing.entry.optionalDependencies, ...entry.optionalDependencies },
+                    peerDependencies: { ...existing.entry.peerDependencies, ...entry.peerDependencies },
+                    optionalPeers: new Set([...existing.entry.optionalPeers, ...entry.optionalPeers]),
+                };
+            }
+        }
+    };
+    addRecords(packageEntries);
+    addRecords(snapshotEntries);
+    if (records.size > MAX_PNPM_LOCKFILE_PACKAGES) {
+        throw new Error(`pnpm lockfile exceeds the ${MAX_PNPM_LOCKFILE_PACKAGES} package limit`);
+    }
+    const roots = [...records.values()]
+        .filter(record => record.name === rootPackage.name && record.version === rootPackage.version)
+        .sort((left, right) => left.suffix.length - right.suffix.length || left.key.localeCompare(right.key));
+    const root = roots[0] ?? (() => {
+        const importer = parsePnpmRootImporter(lines);
+        const legacyImporter = {
+            dependencies: parsePnpmTopLevelDependencyMap(lines, 'dependencies'),
+            devDependencies: parsePnpmTopLevelDependencyMap(lines, 'devDependencies'),
+            optionalDependencies: parsePnpmTopLevelDependencyMap(lines, 'optionalDependencies'),
+            peerDependencies: {},
+            optionalPeers: new Set(),
+        };
+        const hasImporterDependencies = importer !== undefined && pnpmDependencyEntries(importer).length > 0;
+        const hasLegacyDependencies = pnpmDependencyEntries(legacyImporter).length > 0;
+        if (!hasImporterDependencies && !hasLegacyDependencies)
+            return undefined;
+        const synthetic = {
+            key: `workspace-root:${rootPackage.name}@${rootPackage.version}`,
+            name: rootPackage.name,
+            version: rootPackage.version,
+            suffix: '',
+            id: `pnpm:workspace-root:${rootPackage.name}@${rootPackage.version}`,
+            entry: hasImporterDependencies ? importer : legacyImporter,
+        };
+        records.set(synthetic.key, synthetic);
+        return synthetic;
+    })();
+    if (root === undefined) {
+        throw new Error(`requested root package is not present in pnpm lockfile: ${rootPackage.name}@${rootPackage.version}`);
+    }
+    const byCoordinate = new Map();
+    for (const record of records.values()) {
+        const key = pnpmRecordCoordinateKey(record.name, record.version);
+        const list = byCoordinate.get(key) ?? [];
+        list.push(record);
+        byCoordinate.set(key, list);
+    }
+    const resolveDependency = (name, spec) => {
+        const reference = pnpmDependencyReference(spec, name);
+        if (reference === undefined)
+            return undefined;
+        const candidates = byCoordinate.get(pnpmRecordCoordinateKey(name, reference.version)) ?? [];
+        if (candidates.length === 0)
+            return undefined;
+        const wantedSuffix = normalizedPnpmSuffix(reference.suffix);
+        if (wantedSuffix !== '') {
+            const exact = candidates.find(candidate => normalizedPnpmSuffix(candidate.suffix) === wantedSuffix);
+            if (exact !== undefined)
+                return exact;
+        }
+        const base = candidates.find(candidate => candidate.suffix === '');
+        if (base !== undefined)
+            return base;
+        return candidates.length === 1 ? candidates[0] : undefined;
+    };
+    const nodesById = new Map();
+    const edges = [];
+    const unresolved = [];
+    const queue = [root];
+    const visited = new Set();
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (current === undefined || visited.has(current.id))
+            continue;
+        visited.add(current.id);
+        nodesById.set(current.id, { id: current.id, name: current.name, version: current.version });
+        for (const dependency of pnpmDependencyEntries(current.entry)) {
+            const target = resolveDependency(dependency.name, dependency.spec);
+            if (target === undefined) {
+                unresolved.push({ from: current.id, ...dependency });
+                if (unresolved.length > MAX_PNPM_LOCKFILE_EDGES)
+                    throw new Error(`pnpm dependency graph exceeds the ${MAX_PNPM_LOCKFILE_EDGES} edge limit`);
+                continue;
+            }
+            if (edges.length >= MAX_PNPM_LOCKFILE_EDGES)
+                throw new Error(`pnpm dependency graph exceeds the ${MAX_PNPM_LOCKFILE_EDGES} edge limit`);
+            edges.push({ from: current.id, to: target.id, kind: dependency.kind });
+            if (!visited.has(target.id))
+                queue.push(target);
+        }
+    }
+    const nodes = [...nodesById.values()]
+        .sort((left, right) => left.id === root.id ? -1 : right.id === root.id ? 1 : left.id.localeCompare(right.id));
+    const sortedEdges = edges.sort((left, right) => (left.from.localeCompare(right.from) || left.to.localeCompare(right.to) || left.kind.localeCompare(right.kind)));
+    const sortedUnresolved = unresolved.sort((left, right) => (left.from.localeCompare(right.from) || left.name.localeCompare(right.name) || left.spec.localeCompare(right.spec)));
+    return {
+        schema: DEPENDENCY_GRAPH_SCHEMA,
+        rootNodeId: root.id,
+        nodes,
+        edges: sortedEdges,
+        source: 'pnpm-lock',
+        digest: dependencyGraphDigest(nodes, sortedEdges),
+        ...(sortedUnresolved.length === 0 ? {} : { unresolved: sortedUnresolved }),
+    };
+}
 /** Return bounded, cycle-safe root-to-node paths for an alert. */
 export function findDependencyPaths(graph, targetNodeId, options = {}) {
     const maxPaths = options.maxPaths ?? 20;