Function parse_lockfile 

pub fn parse_lockfile(
    project_dir: &Path,
    manifest: &PackageJson,
) -> Result<LockfileGraph, Error>

Detect and parse the lockfile in the given project directory.

Priority: aube-lock.yaml → pnpm-lock.yaml → bun.lock → yarn.lock → npm-shrinkwrap.json → package-lock.json. (Shrinkwrap takes priority over package-lock.json when both exist, matching npm’s behavior.)

manifest is needed to classify direct vs transitive deps when reading yarn.lock (which has no notion of that distinction).