src/dependency-resolver

Resolve npm dependency specifiers against a registry.

Callers pass an already-parsed package.json. The functions never write that project and never run an installer: they GET packuments over HTTP and walk declared plus transitive dependencies. Exact versions stay exact when they exist; ranges stay ranges when a published version satisfies them.

registryUrl defaults to npmRegistry from project-utils.