Fixes #1851

Problem

Under Yarn Berry with nodeLinker: pnpm, Knip reports bogus unlisted dependencies named .store.

getPackageNameFromFilePath derives the package name from the last node_modules/ segment. That holds for the pnpm CLI (node_modules/<pkg>/), but Yarn's pnpm linker lays packages out in a content-addressed store instead:

node_modules/.store/<flattened-locator>/package/…

There is no nested node_modules/<pkg>, so the derived name is literally .store. It typically surfaces via plugins that resolve config files through store realpaths (e.g. Storybook/Babel addons via dirname(require.resolve('<addon>/package.json'))).

Why not parse the folder name

The store folder is <flatIdent>-<protocol>-<reference>-<hash> with scopes flattened (@scope/name → @scope-name), which is ambiguous two ways:

1. Flattened scope: @remix-run-router could be @remix-run/router or @remix/run-router.
2. Protocol markers (npm/virtual/patch/file/http/portal) are indistinguishable from real name segments (@dmsnell/diff-match-patch, write-file-atomic, @types/http-errors, is-npm).

So the folder name can't be parsed back to a package name reliably. The store package's own package.json name field is authoritative, so this reads that instead.

Change

In getPackageNameFromFilePath, when — and only when — the derived last segment is .store, resolve the name from the store package's package.json:

• Matches …/node_modules/.store/<locator>/package with a (?:\/|$) boundary so it handles both paths that continue past /package/… and paths that end exactly at …/package (e.g. addon dirs from dirname(require.resolve('<addon>/package.json'))).
• Caches per store root, so classic node_modules layouts never hit the filesystem and each store package is read at most once.
• Falls back to .store (prior behavior) if the package.json is missing/unreadable.

This mirrors the existing sync-read + Map cache pattern in src/manifest/helpers.ts.

Tests

Added a fixture (fixtures/yarn-pnpm-store) laid out as a Yarn pnpm store and unit tests in test/util/modules.test.ts covering:

• ambiguous flattened scope → @remix-run/router
• protocol-collision unscoped name → write-file-atomic
• path ending at /package with no trailing slash
• graceful fallback to .store when no package.json exists
• unchanged behavior for classic node_modules paths (including nested)

pnpm build (tsgo), oxlint, oxfmt --check, and the module tests pass locally (node + bun). The approach is validated in a production repo using nodeLinker: pnpm.