frontops-dev
diff --git a/‎README.md‎
Lines changed: 35 additions & 1 deletion b/‎README.md‎
Lines changed: 35 additions & 1 deletion
diff --git a/‎src/cli.rs‎
Lines changed: 7 additions & 1 deletion b/‎src/cli.rs‎
Lines changed: 7 additions & 1 deletion
diff --git a/‎src/core.rs‎
Lines changed: 99 additions & 4 deletions b/‎src/core.rs‎
Lines changed: 99 additions & 4 deletions
diff --git a/‎src/git.rs‎
Lines changed: 17 additions & 16 deletions b/‎src/git.rs‎
Lines changed: 17 additions & 16 deletions
diff --git a/‎src/lib.rs‎
Lines changed: 11 additions & 0 deletions b/‎src/lib.rs‎
Lines changed: 11 additions & 0 deletions
@@ -17,6 +17,7 @@ domino is a drop-in replacement for the TypeScript version of [traf](https://git
 
 - **Semantic Change Detection**: Analyzes actual code changes at the AST level, not just file changes
 - **Cross-File Reference Tracking**: Follows symbol references across your entire workspace
+- **Lockfile Change Detection**: Detects dependency version changes in npm, yarn, pnpm, and bun lockfiles and traces affected projects
 - **Fast Oxc Parser**: 3-5x faster than TypeScript's compiler API
 - **Workspace Support**: Works with Nx, Turborepo, and generic npm/yarn/pnpm/bun workspaces
 - **Module Resolution**: Uses oxc_resolver (same as Rolldown and Nova) for accurate module resolution
@@ -112,14 +113,46 @@ domino affected --report report.html
 - `--report <PATH>`: Generate a detailed analysis report
 - `--debug`: Enable debug logging
 - `--cwd <PATH>`: Set the current working directory
+- `--lockfile-strategy <STRATEGY>`: Lockfile change detection strategy (default: `direct`)
+
+### Lockfile Change Detection
+
+domino automatically detects when your lockfile changes and identifies which projects are affected by dependency version updates. This works with all major package managers:
+
+| Package Manager | Lockfile            |
+| --------------- | ------------------- |
+| npm             | `package-lock.json` |
+| yarn            | `yarn.lock`         |
+| pnpm            | `pnpm-lock.yaml`    |
+| bun             | `bun.lock`          |
+
+Three strategies are available via `--lockfile-strategy`:
+
+- **`none`** — Ignore lockfile changes entirely
+- **`direct`** (default) — Mark projects that directly import an affected dependency
+- **`full`** — Like `direct`, but also traces the full reference chain (e.g. if `lib-a` changed and `ProjectA` imports it, `full` follows all re-exports of `lib-a` symbols to find additional affected projects)
+
+The detection is transitive: if a deeply nested dependency changes, domino walks the reverse dependency graph to find which direct dependency was affected, then finds all projects importing that dependency.
+
+```bash
+# Default: detect lockfile changes with "direct" strategy
+domino affected
+
+# Disable lockfile detection
+domino affected --lockfile-strategy none
+
+# Full reference chain tracing
+domino affected --lockfile-strategy full
+```
 
 ## How It Works
 
 1. **Git Diff Analysis**: Detects which files and specific lines have changed
 2. **Semantic Parsing**: Parses all TypeScript/JavaScript files using Oxc
 3. **Symbol Resolution**: Identifies which symbols (functions, classes, constants) were modified
 4. **Reference Finding**: Recursively finds all cross-file references to those symbols
-5. **Project Mapping**: Maps affected files to their owning projects
+5. **Lockfile Analysis**: Detects dependency version changes and traces affected imports
+6. **Project Mapping**: Maps affected files to their owning projects
 
 ## Performance
 
@@ -147,6 +180,7 @@ Thanks to Rust and Oxc, domino is significantly faster than the TypeScript versi
 - **Workspace Discovery** (`src/workspace/`): Discovers projects in Nx, Turbo, and generic npm/yarn/pnpm/bun workspaces
 - **Semantic Analyzer** (`src/semantic/analyzer.rs`): Uses Oxc to parse and analyze TypeScript/JavaScript
 - **Reference Finder** (`src/semantic/reference_finder.rs`): Tracks cross-file symbol references
+- **Lockfile Analyzer** (`src/lockfile.rs`): Parses lockfiles, builds reverse dependency graphs, and detects affected packages
 - **Core Algorithm** (`src/core.rs`): Orchestrates the affected detection logic
 
 ### Key Technologies
 
@@ -1,7 +1,7 @@
 use crate::core;
 use crate::error::Result;
 use crate::profiler::Profiler;
-use crate::types::TrueAffectedConfig;
+use crate::types::{LockfileStrategy, TrueAffectedConfig};
 use crate::workspace;
 use clap::{Parser, Subcommand};
 use colored::Colorize;
@@ -57,6 +57,10 @@ enum Commands {
     /// Generate HTML dependency graph report
     #[arg(long)]
     report: Option<PathBuf>,
+
+    /// Lockfile change detection strategy: none, direct, full
+    #[arg(long, default_value = "direct")]
+    lockfile_strategy: LockfileStrategy,
   },
 }
 
@@ -93,6 +97,7 @@ pub fn run() -> Result<()> {
       ts_config,
       profile,
       report,
+      lockfile_strategy,
     } => {
       let cwd = cwd.unwrap_or_else(|| std::env::current_dir().unwrap());
 
@@ -156,6 +161,7 @@ pub fn run() -> Result<()> {
           "build".to_string(),
           ".git".to_string(),
         ],
+        lockfile_strategy,
       };
 
       // Use the report-generating version if --report is specified
 
@@ -1,10 +1,11 @@
 use crate::error::Result;
 use crate::git;
+use crate::lockfile;
 use crate::profiler::Profiler;
 use crate::semantic::{AssetReferenceFinder, ReferenceFinder, WorkspaceAnalyzer};
 use crate::types::{
-  AffectCause, AffectedProjectInfo, AffectedReport, AffectedResult, ChangedFile, Project,
-  TrueAffectedConfig,
+  AffectCause, AffectedProjectInfo, AffectedReport, AffectedResult, ChangedFile, LockfileStrategy,
+  Project, TrueAffectedConfig,
 };
 use crate::utils::{self, ProjectIndex};
 use rustc_hash::{FxHashMap, FxHashSet};
@@ -45,8 +46,8 @@ fn find_affected_internal(
   debug!("Base: {}", config.base);
   debug!("Projects: {}", config.projects.len());
 
-  // Step 1: Get changed files from git
-  let changed_files = git::get_changed_files(&config.cwd, &config.base)?;
+  // Step 1: Get changed files from git (also returns the merge-base SHA)
+  let (changed_files, merge_base) = git::get_changed_files(&config.cwd, &config.base)?;
   debug!("Found {} changed files", changed_files.len());
 
   if changed_files.is_empty() {
@@ -72,9 +73,18 @@ fn find_affected_internal(
   let mut affected_packages = FxHashSet::default();
   let mut project_causes: FxHashMap<String, Vec<AffectCause>> = FxHashMap::default();
 
+  // Step 5: Partition changed files into source and non-source (excluding lockfiles)
+  let detected_pm = lockfile::detect_package_manager(&config.cwd);
+  let lockfile_filename = detected_pm.as_ref().map(|pm| lockfile::lockfile_name(pm));
+
   // Step 6: Partition changed files into source and non-source
   let (source_files, asset_files): (Vec<&ChangedFile>, Vec<&ChangedFile>) = changed_files
     .iter()
+    .filter(|f| {
+      lockfile_filename
+        .as_ref()
+        .is_none_or(|name| f.file_path.to_str() != Some(*name))
+    })
     .partition(|f| utils::is_source_file(&f.file_path));
 
   debug!(
@@ -359,6 +369,91 @@ fn find_affected_internal(
     }
   }
 
+  // Step 5c: Process lockfile changes
+  if !matches!(config.lockfile_strategy, LockfileStrategy::None) {
+    if let Some(ref pm) = detected_pm {
+      if lockfile::has_lockfile_changed(&changed_files, pm) {
+        debug!("Lockfile changed, strategy: {:?}", config.lockfile_strategy);
+        match lockfile::find_affected_dependencies(&config.cwd, &merge_base, pm) {
+          Ok(affected_deps) if !affected_deps.is_empty() => {
+            debug!("Found {} affected direct dependencies", affected_deps.len());
+
+            let mut lockfile_visited = FxHashSet::default();
+
+            for (file_path, file_imports) in &analyzer.imports {
+              // Collect (import, matched canonical dep name) pairs
+              let matching_imports: Vec<_> = file_imports
+                .iter()
+                .filter_map(|imp| {
+                  lockfile::match_affected_dependency(&imp.from_module, &affected_deps)
+                    .map(|dep| (imp, dep))
+                })
+                .collect();
+
+              if matching_imports.is_empty() {
+                continue;
+              }
+
+              let owning_packages = project_index.get_package_names_by_path(file_path);
+              for pkg in &owning_packages {
+                affected_packages.insert(pkg.clone());
+                if generate_report {
+                  for &(_, dep_name) in &matching_imports {
+                    project_causes.entry(pkg.clone()).or_default().push(
+                      AffectCause::LockfileChange {
+                        dependency: dep_name.to_string(),
+                        importing_file: file_path.clone(),
+                      },
+                    );
+                  }
+                }
+              }
+
+              if matches!(config.lockfile_strategy, LockfileStrategy::Full) {
+                for &(imp, _) in &matching_imports {
+                  let symbols_to_trace =
+                    match analyzer.find_exported_symbols_using(file_path, &imp.local_name) {
+                      Ok(exports) if !exports.is_empty() => exports,
+                      Ok(_) => vec![imp.local_name.clone()],
+                      Err(e) => {
+                        debug!("Error finding exports using '{}': {}", imp.local_name, e);
+                        continue;
+                      }
+                    };
+
+                  for sym in symbols_to_trace {
+                    let mut state = AffectedState {
+                      affected_packages: &mut affected_packages,
+                      project_causes: if generate_report {
+                        Some(&mut project_causes)
+                      } else {
+                        None
+                      },
+                      visited: &mut lockfile_visited,
+                    };
+                    if let Err(e) = process_changed_symbol(
+                      &analyzer,
+                      &reference_finder,
+                      file_path,
+                      &sym,
+                      &project_index,
+                      &mut state,
+                    ) {
+                      debug!("Error tracing lockfile symbol '{}': {}", sym, e);
+                    }
+                  }
+                }
+              }
+            }
+          }
+          Ok(_) => debug!("Lockfile changed but no dependency versions differ"),
+          Err(e) => debug!("Lockfile analysis failed, skipping: {}", e),
+        }
+      }
+    }
+  }
+
+  // Step 6: Add implicit dependencies
   // Step 7: Add implicit dependencies
   add_implicit_dependencies(
     &config.projects,
 
@@ -3,8 +3,14 @@ use crate::types::ChangedFile;
 use regex::Regex;
 use std::path::Path;
 use std::process::Command;
+use std::sync::LazyLock;
 use tracing::{debug, warn};
 
+static FILE_RE: LazyLock<Regex> =
+  LazyLock::new(|| Regex::new(r#"(?:["\s]a/)(.*)(?:["\s]b/)"#).expect("file regex is valid"));
+static LINE_RE: LazyLock<Regex> =
+  LazyLock::new(|| Regex::new(r"@@ -.* \+(\d+)(?:,\d+)? @@").expect("line regex is valid"));
+
 /// Detect the default branch (tries origin/main, then origin/master)
 pub fn detect_default_branch(repo_path: &Path) -> String {
   // Try origin/main first
@@ -89,35 +95,30 @@ pub fn get_diff(repo_path: &Path, base: &str) -> Result<String> {
     )));
   }
 
-  Ok(String::from_utf8_lossy(&output.stdout).to_string())
+  Ok(
+    String::from_utf8(output.stdout)
+      .unwrap_or_else(|e| String::from_utf8_lossy(e.as_bytes()).into_owned()),
+  )
 }
 
-/// Parse git diff output to extract changed files and line numbers
-pub fn get_changed_files(repo_path: &Path, base: &str) -> Result<Vec<ChangedFile>> {
+/// Parse git diff output to extract changed files and line numbers.
+/// Returns the changed files along with the computed merge-base SHA.
+pub fn get_changed_files(repo_path: &Path, base: &str) -> Result<(Vec<ChangedFile>, String)> {
   debug!("Getting diff for base: {}", base);
 
-  // First, find the merge base between base and HEAD
-  // This ensures we only see changes from the current branch, not changes
-  // from the base branch that happened after branching
   let merge_base = get_merge_base(repo_path, base, "HEAD")?;
   debug!("Merge base: {}", merge_base);
 
-  // Then diff the merge base against the working tree (not HEAD)
-  // This includes both committed and uncommitted changes, matching traf's behavior
   let diff = get_diff(repo_path, &merge_base)?;
+  let files = parse_diff(&diff)?;
 
-  parse_diff(&diff)
+  Ok((files, merge_base))
 }
 
 /// Parse git diff output into ChangedFile structs
 fn parse_diff(diff: &str) -> Result<Vec<ChangedFile>> {
-  // Regex to extract file path: matches "a/path/to/file" between quotes or spaces
-  let file_regex = Regex::new(r#"(?:["\s]a/)(.*)(?:["\s]b/)"#)
-    .map_err(|e| DominoError::Parse(format!("Invalid file regex: {}", e)))?;
-
-  // Regex to extract line numbers: matches "+<line_number>" in diff header
-  let line_regex = Regex::new(r"@@ -.* \+(\d+)(?:,\d+)? @@")
-    .map_err(|e| DominoError::Parse(format!("Invalid line regex: {}", e)))?;
+  let file_regex = &*FILE_RE;
+  let line_regex = &*LINE_RE;
 
   let changed_files: Vec<ChangedFile> = diff
     .split("diff --git")
 
@@ -4,6 +4,7 @@ pub mod cli;
 pub mod core;
 pub mod error;
 pub mod git;
+pub mod lockfile;
 pub mod profiler;
 pub mod report;
 pub mod semantic;
@@ -66,6 +67,8 @@ mod napi_bindings {
     pub include: Option<Vec<String>>,
     pub ignored_paths: Option<Vec<String>>,
     pub enable_profiling: Option<bool>,
+    /// Lockfile change detection strategy: "none", "direct", "full" (default: "direct")
+    pub lockfile_strategy: Option<String>,
   }
 
   #[napi(object)]
@@ -81,13 +84,21 @@ mod napi_bindings {
 
     let profiler = Arc::new(Profiler::new(options.enable_profiling.unwrap_or(false)));
 
+    let lockfile_strategy = options
+      .lockfile_strategy
+      .as_deref()
+      .map(|s| s.parse::<LockfileStrategy>().map_err(Error::from_reason))
+      .transpose()?
+      .unwrap_or_default();
+
     let config = TrueAffectedConfig {
       cwd,
       base: options.base,
       root_ts_config: options.root_ts_config.map(PathBuf::from),
       projects,
       include: options.include.unwrap_or_default(),
       ignored_paths: options.ignored_paths.unwrap_or_default(),
+      lockfile_strategy,
     };
 
     let result =