[vibgrate-team]

Summary

parsePackageSwift only matched .package(url: "...", from|exact|upToNextMajor|revision|branch: "..."). Valid SwiftPM dependencies that use a ..< or ... range, put name: before url:, or declare a registry id: produced no dependency row, so they never showed up in a scan or in vg sbom export.

The parser now finds each .package( call and reads its argument text, skipping strings and comments so a ) inside a URL cannot end the call early. ..< and ... ranges record the lower bound as currentSpec. An explicit name: is used when present, and registry id: dependencies are included (the id is the package name). Local .package(path:) dependencies stay excluded. Existing from:, exact:, branch:, revision:, and .upToNextMajor(from:) forms still record the same spec.

Related issues

Closes #589

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated (README / DOCS / ARCHITECTURE) where behavior changed
• Determinism preserved — identical input still produces identical graph.json / report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)
• No proprietary or internal references — public, Apache-2.0 content only
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

Notes for reviewers

No README, DOCS, or ARCHITECTURE change: those docs do not describe Package.swift syntax. test/swift-package-manifest.test.ts covers half-open and closed ranges (including a spaced, multiline range), name:-first calls, an explicit name that differs from the URL basename, registry id: dependencies, the existing labelled forms, and the omission of .package(path:).

pnpm lint exits 0. It still reports five pre-existing unused-variable warnings in unrelated files. pnpm test (5638) and pnpm typecheck passed.