[vibgrate-team]

Summary

parsePubspecYaml only accepted one-line name: constraint entries. A map such as http: / version: ^1.2.0 was skipped, and the nested keys (version, path, url, ref, git) were recorded as packages. http, shared, and analyzer_plugin never reached vg scan or vg sbom export.

A key with no value at the section's child indent now opens that package. Deeper lines belong to it and are never packages. A nested version: scalar is the constraint. path: and git: dependencies are recorded with their source (path:<path>, git:<url>, git:<url>#<ref>) rather than a registry version; a path or git source wins over a sibling version. The same rules apply to dependencies, dev_dependencies, and dependency_overrides. An override is kept only when that name is not already declared, so a one-line spec is unchanged. sdk: flutter is still skipped, and one-line tokens (including quotes and the first token of a range) are unchanged.

The polyglot pubspec fallback uses the same parser, so a lockfile-less scan cannot prefer a row list built from nested keys.

Related issues

Closes #583

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated (README / DOCS / ARCHITECTURE) where behavior changed
• Determinism preserved — identical input still produces identical graph.json / report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)
• No proprietary or internal references — public, Apache-2.0 content only
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

Notes for reviewers

Path and git specs are source strings, not versions, so those rows stay in the scan without inventing a constraint. Tests in test/dart-pubspec-map-dependencies.test.ts lock that choice, the issue example (http at ^1.2.0, no packages named version / path / url / ref / git), and one-line behavior.