lockfiles 0.0.1

Multi-ecosystem lockfile parser that normalizes resolved dependencies, keyed by PURL.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

# lockfiles

Multi-ecosystem lockfile parser that turns lockfile *contents* into normalized,
resolved dependencies keyed by [PURL](https://github.com/package-url/purl-spec).

> [!WARNING]
> **WIP: name reserved, implementation to come.**
> This repository currently contains only the project scaffold (packaging, CI, and
> binding stubs). There is **no parsing logic yet**. The `0.0.1` placeholder releases
> on crates.io, PyPI, and npm exist solely to reserve the `lockfiles` name.

## What it will be

A Rust core (library + CLI) that parses lockfiles from multiple ecosystems and emits
normalized resolved dependencies. It is *content-in*: it consumes lockfile contents,
not paths. Its boundary is **facts, not verdicts**: it reports what a lockfile resolves
to, and leaves policy decisions to downstream tooling.

Bindings expose the same core to other ecosystems:

- **Python** via [PyO3](https://pyo3.rs) / [maturin](https://www.maturin.rs)
- **Node.js** via [napi-rs](https://napi.rs)

## Layout

```
.                 core crate `lockfiles` (library + CLI)
bindings/python   PyO3 + maturin binding   -> PyPI: lockfiles
bindings/node     napi-rs binding          -> npm:  lockfiles
```

## Development

```sh
cargo nextest run        # tests (or: cargo test)
cargo clippy --all-targets -- -D warnings
cargo fmt --all
```

Bindings are built out of band (they are excluded from the default workspace members):

```sh
# Python (uses uv)
cd bindings/python && uv run --with maturin maturin develop && uv run pytest

# Node
cd bindings/node && npm install && npm run build:debug && npm test
```

## License

Dual-licensed under either of [MIT](LICENSE-MIT) or [Apache-2.0](LICENSE-APACHE), at
your option.