snyk-nodejs-lockfile-parser/dist/utils.d.ts

Generate a dep tree given a lockfile

export declare enum NodeLockfileVersion {
    NpmLockV1 = "NPM_LOCK_V1",
    NpmLockV2 = "NPM_LOCK_V2",
    NpmLockV3 = "NPM_LOCK_V3",
    YarnLockV1 = "YARN_LOCK_V1",
    YarnLockV2 = "YARN_LOCK_V2",
    PnpmLockV5 = "PNPM_LOCK_V5",
    PnpmLockV6 = "PNPM_LOCK_V6",
    PnpmLockV9 = "PNPM_LOCK_V9"
}
export declare const getLockfileVersionFromFile: (targetFile: string) => NodeLockfileVersion;
/**
 * Extract the dependency lockfile document from pnpm-lock.yaml content.
 *
 * Since pnpm 11, projects that use configDependencies or a pnpm-managed
 * package manager version (devEngines.packageManager) get a multi-document
 * pnpm-lock.yaml: an env/config document first, then the dependency
 * lockfile, both marked lockfileVersion 9.0. Follows pnpm's own
 * extractMainDocument() (lockfile/fs/src/yamlDocuments.ts): content that
 * does not start with a document-start marker is returned unchanged, and an
 * env-only file (second separator with nothing after it) yields ''. A
 * leading byte-order mark is ignored for detection (pnpm's readers
 * strip-bom before the marker check) but preserved on the no-marker path.
 * One deviation: pnpm's writer always emits both separators, so content
 * with a lone document-start marker and no second separator is not a pnpm
 * 11 multi-document lockfile — it is returned unchanged and parses exactly
 * as it did before this function existed (a bare '---\n' is still rejected
 * loudly; an explicit-start single document still parses as one document).
 */
export declare function extractPnpmMainDocument(content: string): string;
export declare function getPnpmLockfileVersion(lockFileContents: string): NodeLockfileVersion.PnpmLockV5 | NodeLockfileVersion.PnpmLockV6 | NodeLockfileVersion.PnpmLockV9;
export declare function getYarnLockfileVersion(lockFileContents: string): NodeLockfileVersion.YarnLockV1 | NodeLockfileVersion.YarnLockV2;
export declare function getNpmLockfileVersion(lockFileContents: string): NodeLockfileVersion.NpmLockV1 | NodeLockfileVersion.NpmLockV2 | NodeLockfileVersion.NpmLockV3;
/**
 * Parse JSON from a manifest or lockfile. On failure throws an
 * InvalidUserInputError that preserves the underlying parser message
 * (including the position of the syntax error) and appends a best-effort hint
 * about the likely cause.
 *
 * `fileLabel` is the file kind shown in the error, e.g. 'package.json' or
 * 'package-lock.json'.
 */
export declare function parseJsonFile<T = any>(content: string, fileLabel: string): T;
/**
 * Best-effort, allocation-light hint describing the most likely reason a JSON
 * parse failed. Inspects only the leading characters of the content, never
 * throws, and returns '' when nothing recognisable is found - so it is always
 * safe to append to a parse-error message.
 */
export declare function describeLikelyJsonCause(content: string): string;
/**
 * Parse a single-document YAML file with the option set used across this
 * library. Returns null for a document-less file (empty, only comments, or
 * only whitespace), matching js-yaml 4's load() behaviour - js-yaml 5 throws
 * on those instead. Malformed and multi-document input rethrow js-yaml's
 * original error.
 *
 * The document-less case is detected with loadAll(), which returns [] for it
 * on both major versions, rather than by matching the human-readable text of
 * the YAMLException, which is not a stable API.
 */
export declare function loadYamlOrNull<T = any>(content: string): T | null;
/**
 * Like loadYamlOrNull, but for files that must contain a YAML mapping
 * (lockfiles). Content that parses to anything else (empty, comment-only, or
 * a bare document separator) is rejected loudly with an InvalidUserInputError
 * rather than silently producing an empty dependency graph.
 *
 * `fileLabel` names the file in the error, e.g. 'pnpm-lock.yaml'.
 */
export declare function loadYamlMappingOrThrow<T = any>(content: string, fileLabel: string): T;