node

Documentation

Overview

Package node implements the npm-ecosystem scanner adapter: lockfile-resolved dependency scanning (package-lock.json v2/v3, pnpm-lock.yaml v9, classic yarn.lock), static import/symbol extraction for TS/JS sources, command classification, and environment hints.

Index

• type Adapter
  • func (Adapter) Capabilities() []string
  • func (Adapter) ClassifyCommand(argv []string) scanner.CommandProfile
  • func (Adapter) Detect(dir string) bool
  • func (Adapter) Ecosystem() string
  • func (Adapter) EnvironmentHints(ctx context.Context, dir string) map[string]string
  • func (Adapter) ScanEdges(_ context.Context, dir string) ([]scanner.Edge, error)
  • func (Adapter) ScanPackages(ctx context.Context, dir string) ([]scanner.ResolvedPackage, error)
  • func (Adapter) ScanSymbols(ctx context.Context, dir string, pkgs []scanner.ResolvedPackage) ([]scanner.SymbolUsage, error)

Types

type Adapter

type Adapter struct{}

Adapter implements scanner.Adapter for the "npm" ecosystem.

func (Adapter) Capabilities

func (Adapter) Capabilities() []string

func (Adapter) ClassifyCommand

func (Adapter) ClassifyCommand(argv []string) scanner.CommandProfile

func (Adapter) Detect

func (Adapter) Detect(dir string) bool

func (Adapter) Ecosystem

func (Adapter) Ecosystem() string

func (Adapter) EnvironmentHints

func (Adapter) EnvironmentHints(ctx context.Context, dir string) map[string]string

func (Adapter) ScanEdges

func (Adapter) ScanEdges(_ context.Context, dir string) ([]scanner.Edge, error)

ScanEdges reports the dependency tree from package-lock.json.

Only package-lock.json for now: pnpm and yarn record the tree too, in their own shapes, and each is its own parser. An ecosystem that cannot answer contributes nothing rather than a guess.

Publicness is not decided here. Every edge is returned and the caller drops the ones whose ends are not public, the same way it does for packages — deciding it twice in two places is how the two answers drift apart.

func (Adapter) ScanPackages

func (Adapter) ScanPackages(ctx context.Context, dir string) ([]scanner.ResolvedPackage, error)

ScanPackages reads the first lockfile found (package-lock.json, pnpm-lock.yaml, yarn.lock) and returns resolved versions. No lockfile ⇒ empty result: manifest ranges are never reported as resolved (goal.md §7.1).

func (Adapter) ScanSymbols

func (Adapter) ScanSymbols(ctx context.Context, dir string, pkgs []scanner.ResolvedPackage) ([]scanner.SymbolUsage, error)

ScanSymbols statically extracts symbol usages from .ts/.tsx/.js/.mjs/.cjs sources, mapping import specifiers to the given resolved packages. Static analysis of JS is heuristic, so member usages are at most PROBABLE (goal.md §13.2); never EXACT.