fix: js parser

[dewabisma]

Fixing parser for local tarball in bun.lock.

[n13]

Reviewer model: GPT Sol

Verdict: REQUEST_CHANGES — the local-tarball heuristic can skip valid npm registry versions.

Blocking finding:

• packages/dependency-cooldown/src/lockfiles/bun.ts:32: Classifying every specifier ending in .tgz, .tar.gz, or .tar as a local tarball also matches valid semver prereleases. For example, 1.2.3-release.tgz is a valid npm version, and Bun represents its registry tuple as ["pkg@1.2.3-release.tgz", "", {...}, "..."]; this parser currently returns no registry refs and reports it as a local tarball. A newly published dependency with such a version therefore bypasses the 30-day lookup entirely. Please distinguish the resolution using Bun's tuple structure (registry entries have a string registry field while local tarballs have the metadata object in that position), or first prove the specifier is not a registry semver, and add a registry-version regression test.

Validation:

• npm ci
• npm run typecheck — passed
• npm test — 98/98 tests passed
• npm run build plus committed-bundle diff check — passed
• Direct parser reproducer: 1.2.3-release.tgz, 1.2.3-a.tar.gz, and 1.2.3-x.tar all produced refs: []; npm's semver CLI accepted all three.
• GitHub CI dependency-cooldown package — passed at reviewed head ec060e3256ddd87c90c49f4a1c82332e5e766030

No other blocking findings found.

[n13]

Reviewer model: GPT Sol

Verdict: APPROVE — the prior registry-prerelease blocker is resolved at 6d67662.

No blocking findings. The tuple-shape check preserves valid npm registry versions ending in tarball-like suffixes while classifying Bun local-tarball tuples as uncheckable, and the regression cases exercise both paths.

Non-blocking: the new root package-lock.json is empty and appears incidental, since the npm package and CI live under packages/dependency-cooldown. It can be removed to avoid implying a root npm project.

Validation:

• npm ci
• npm run typecheck — passed
• npm run build plus committed-bundle diff check — passed
• npm test — 102/102 tests passed
• GitHub CI dependency-cooldown package — passed at reviewed head 6d676629548cd49427fcce66d17b250162bfe33a