pnpm-lock.yaml and shard.lock parse to zero dependencies unless indentation is exactly two spaces

[andrew]

Parsing a pnpm-lock.yaml or shard.lock that has been reformatted with a different indent width returns no dependencies and no error.

Both parsers read the file line by line and compare indentation literally. extractPnpmPackageKey (internal/npm/pnpm.go:15) accepts a package key only when the line begins with precisely two spaces followed by a non-space, which is also how it skips nested keys such as peerDependenciesMeta. The shard.lock parser does the same for names (internal/crystal/crystal.go:17) and matches " version: " and " commit: " with four literal spaces (internal/crystal/crystal.go:138).

To reproduce, double the leading spaces on every line of a fixture and parse it again through manifests.Parse:

file	as written	indentation doubled
testdata/npm/pnpm-lock.yaml	9 deps	0 deps
testdata/crystal/shard.lock	7 deps	0 deps

Both files survive a YAML round-trip that re-emits block style at two spaces and reorders keys, so the sensitivity is to indent width specifically, not to reformatting in general. The TOML lockfiles read the same way, Cargo.lock and Julia Manifest.toml, parse identically after re-indentation and are not affected.

pnpm and shards write these files, so this only surfaces when something else rewrites them, such as a repo that runs a YAML formatter across its lockfile.

One fix that keeps the line scanners: take the indent width from the first entry inside packages: / shards: and compare relative to that, rather than hard-coding two and four spaces. Decoding with go.yaml.in/yaml/v3, already a direct dependency used for shard.yml and Chart.yaml, would also cover flow style, at a higher memory cost on large pnpm lockfiles. #107 fixes the same class of assumption in the npm package-lock.json scanner, where compact JSON parsed to zero dependencies.

manifests at c29c967 (current main).