@0xcraft/powershot 1.0.0

package/dist/verifiers/dead-on-arrival.js

@@ -0,0 +1,92 @@
+import { Node } from 'ts-morph';
+import { locate, relPath } from '#app/ground.js';
+/**
+ * Only module-private declarations are considered. An exported symbol with no callers
+ * may simply be public API this repo does not consume itself, which is not a defect —
+ * an unexported one that nothing in its own module reaches provably is.
+ */
+function privateDeclarations(sf) {
+    const out = [];
+    for (const fn of sf.getFunctions()) {
+        const name = fn.getName();
+        const id = fn.getNameNode();
+        if (!name || !id || fn.isExported() || fn.isDefaultExport())
+            continue;
+        out.push({ name, node: fn, nameStart: id.getStart(), nameWidth: id.getWidth(), line: fn.getStartLineNumber() });
+    }
+    for (const cls of sf.getClasses()) {
+        const name = cls.getName();
+        const id = cls.getNameNode();
+        if (!name || !id || cls.isExported() || cls.isDefaultExport())
+            continue;
+        out.push({ name, node: cls, nameStart: id.getStart(), nameWidth: id.getWidth(), line: cls.getStartLineNumber() });
+    }
+    for (const stmt of sf.getVariableStatements()) {
+        if (stmt.isExported())
+            continue;
+        for (const v of stmt.getDeclarations()) {
+            const id = v.getNameNode();
+            // destructuring binds several names at once; skip rather than guess which is dead
+            if (!Node.isIdentifier(id))
+                continue;
+            out.push({
+                name: v.getName(),
+                node: v,
+                nameStart: id.getStart(),
+                nameWidth: id.getWidth(),
+                line: v.getStartLineNumber(),
+            });
+        }
+    }
+    return out;
+}
+/** `_unused` is the conventional way to say "deliberately not referenced". */
+function deliberatelyUnused(name) {
+    return name.startsWith('_');
+}
+/** Code the change adds that nothing reaches. */
+export const deadOnArrival = {
+    name: 'dead-on-arrival',
+    needs: ['references'],
+    run(g) {
+        const findings = [];
+        for (const { sf, changed } of g.files) {
+            const file = relPath(sf, g.root);
+            for (const decl of privateDeclarations(sf)) {
+                if (!changed.added.has(decl.line))
+                    continue;
+                if (deliberatelyUnused(decl.name))
+                    continue;
+                let refs;
+                try {
+                    refs = decl.node.findReferencesAsNodes();
+                }
+                catch {
+                    continue; // no answer from the language service is not the same as "no callers"
+                }
+                if (refs.length > 0)
+                    continue;
+                // A decorator can register what it decorates without ever naming it again,
+                // so for those the reference graph answers a narrower question than the one
+                // the finding asks. Everywhere else nothing outside the module can reach a
+                // module-private name at all, which is what makes the graph's answer exact.
+                const decorated = Node.isDecoratable(decl.node) && decl.node.getDecorators().length > 0;
+                findings.push({
+                    id: '',
+                    class: 'verified',
+                    check: 'dead-on-arrival',
+                    severity: 'low',
+                    confidence: decorated ? 'firm' : 'proven',
+                    file,
+                    line: decl.line,
+                    span: locate(sf, decl.nameStart, decl.nameWidth).span,
+                    title: decl.name + ' is added by this change and nothing references it',
+                    evidence: { oracle: 'reference graph', detail: 'module-private and unreferenced anywhere in the project' },
+                    fix: 'Delete it, or export it if something outside this module is meant to use it',
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=dead-on-arrival.js.map

package/dist/verifiers/dropped-guard.js

@@ -0,0 +1,144 @@
+import { Node, SyntaxKind } from 'ts-morph';
+import { locate, relPath } from '#app/ground.js';
+function functionsOf(sf) {
+    const out = [];
+    for (const fn of sf.getFunctions()) {
+        const name = fn.getName();
+        if (name)
+            out.push({ name, node: fn });
+    }
+    for (const cls of sf.getClasses()) {
+        const prefix = (cls.getName() ?? 'anonymous') + '.';
+        for (const m of cls.getMethods())
+            out.push({ name: prefix + m.getName(), node: m });
+    }
+    for (const v of sf.getVariableDeclarations()) {
+        const init = v.getInitializer();
+        if (init?.isKind(SyntaxKind.ArrowFunction) || init?.isKind(SyntaxKind.FunctionExpression)) {
+            out.push({ name: v.getName(), node: v });
+        }
+    }
+    return out;
+}
+/** collapse whitespace so reformatting alone never reads as a dropped guard */
+function normalize(text) {
+    return text.replace(/\s+/g, ' ').trim();
+}
+/** every identifier the new version of a function still mentions */
+function identifiersIn(fn) {
+    const out = new Set();
+    for (const id of fn.getDescendantsOfKind(SyntaxKind.Identifier))
+        out.add(id.getText());
+    return out;
+}
+/**
+ * The things a condition actually reads: the base of each reference, never the
+ * property names hanging off it. In `!inv.customer` the root is `inv` — `customer`
+ * is a field, and a rewritten body has no reason to mention it.
+ */
+function rootsOf(condition) {
+    const roots = [];
+    for (const id of condition.getDescendantsOfKind(SyntaxKind.Identifier)) {
+        const parent = id.getParent();
+        // skip the `.name` half of a property access, and object-literal keys
+        if (Node.isPropertyAccessExpression(parent) && parent.getNameNode() === id)
+            continue;
+        if (Node.isPropertyAssignment(parent) && parent.getNameNode() === id)
+            continue;
+        roots.push(id.getText());
+    }
+    if (Node.isIdentifier(condition))
+        roots.push(condition.getText());
+    return roots;
+}
+/**
+ * A guard whose roots the rewritten function no longer has is not a guard someone
+ * dropped — it stopped existing along with the code it protected. `formatWeight`
+ * rewritten from ounces to grams cannot keep `if (pounds === 0)`, and reporting it
+ * would accuse a deliberate rewrite of losing a check it could not have kept.
+ */
+function stillApplicable(roots, available) {
+    return roots.every((n) => available.has(n) || GLOBALS.has(n));
+}
+/**
+ * The same check, respelled. When `pool` turns from an array into a number,
+ * `pool.length === 0` becomes `pool === 0`: different text, same guarantee. Matching
+ * on what a guard reads rather than how it is written keeps a rewrite from reading
+ * as a removal — at the cost of missing a guard narrowed on the same variable, which
+ * is the direction this tool chooses to err in.
+ */
+function guardedElsewhere(roots, after) {
+    if (roots.length === 0)
+        return false;
+    return [...after.values()].some((other) => roots.every((r) => other.includes(r)));
+}
+const GLOBALS = new Set(['undefined', 'NaN', 'Number', 'String', 'Array', 'Object', 'Boolean', 'Math', 'JSON', 'Date']);
+/**
+ * A guard is an `if` whose branch bails out — throw, return, continue, or break.
+ * That shape is what protects the code below it, so losing one changes behaviour.
+ */
+function guardsOf(fn) {
+    const guards = new Map();
+    for (const ifStmt of fn.getDescendantsOfKind(SyntaxKind.IfStatement)) {
+        const branch = ifStmt.getThenStatement();
+        const bails = branch.getDescendantsOfKind(SyntaxKind.ThrowStatement).length > 0 ||
+            branch.getDescendantsOfKind(SyntaxKind.ReturnStatement).length > 0 ||
+            branch.getDescendantsOfKind(SyntaxKind.ContinueStatement).length > 0 ||
+            branch.getDescendantsOfKind(SyntaxKind.BreakStatement).length > 0 ||
+            Node.isThrowStatement(branch) ||
+            Node.isReturnStatement(branch);
+        if (bails)
+            guards.set(normalize(ifStmt.getExpression().getText()), rootsOf(ifStmt.getExpression()));
+    }
+    return guards;
+}
+/**
+ * A guard that existed before the change and is gone after it, in a function that
+ * still exists. The pre/post AST pair is the oracle, so this is proven: the
+ * condition text was there and now it is not.
+ */
+export const droppedGuard = {
+    name: 'dropped-guard',
+    needs: ['syntax', 'base'],
+    run(g) {
+        const findings = [];
+        for (const { sf, before } of g.files) {
+            if (!before)
+                continue; // a new file cannot have dropped anything
+            const after = new Map(functionsOf(sf).map((f) => [f.name, f]));
+            for (const prev of functionsOf(before)) {
+                const now = after.get(prev.name);
+                if (!now)
+                    continue; // function removed entirely — that is a different finding
+                const had = guardsOf(prev.node);
+                if (had.size === 0)
+                    continue;
+                const has = guardsOf(now.node);
+                const available = identifiersIn(now.node);
+                const dropped = [...had.entries()]
+                    .filter(([guard, roots]) => !has.has(guard) && stillApplicable(roots, available) && !guardedElsewhere(roots, has))
+                    .map(([guard]) => guard);
+                if (dropped.length === 0)
+                    continue;
+                // one finding per function, not per guard: several guards lost in the same
+                // rewrite are one fact about one place, and repeating the line is noise
+                findings.push({
+                    id: '',
+                    class: 'verified',
+                    check: 'dropped-guard',
+                    severity: 'high',
+                    confidence: 'proven',
+                    file: relPath(sf, g.root),
+                    line: now.node.getStartLineNumber(),
+                    span: locate(sf, now.node.getStart(), Math.min(now.node.getWidth(), 80)).span,
+                    title: dropped.map((d) => '`if (' + d + ')`').join(' and ') +
+                        ' ' + (dropped.length > 1 ? 'were' : 'was') +
+                        ' present in ' + prev.name + '() before this change and ' + (dropped.length > 1 ? 'are' : 'is') + ' gone',
+                    evidence: { oracle: 'pre/post AST', detail: 'early-exit branch removed while the function still exists and still uses the same names' },
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=dropped-guard.js.map

package/dist/verifiers/foreign-contract-drift.js

@@ -0,0 +1,114 @@
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { pyrightDiagnostics } from '#app/lang/pyright.js';
+import { decode, lines } from '#app/text.js';
+import { repoPath } from '#app/fspolicy.js';
+/**
+ * A Python signature changed and callers were left behind.
+ *
+ * The break is detected syntactically — a required parameter appeared, or one is
+ * gone — which is cheap and needs no checker. Finding who broke is where pyright
+ * earns its place: its errors land *at the call sites*, in files this change never
+ * touched, which is precisely the blast radius nothing else in a Python project is
+ * watching for.
+ */
+function callsFunction(line, name) {
+    let from = 0;
+    for (;;) {
+        const at = line.indexOf(name, from);
+        if (at === -1)
+            return false;
+        const before = at === 0 ? '' : line[at - 1];
+        const after = line.slice(at + name.length).trimStart();
+        const isWordBoundary = before === '' || !/[A-Za-z0-9_.]/.test(before);
+        if (isWordBoundary && after.startsWith('('))
+            return true;
+        from = at + name.length;
+    }
+}
+export const foreignContractDrift = {
+    name: 'contract-drift',
+    needs: ['syntax', 'base', 'python-types'],
+    run(g) {
+        const python = g.foreign.filter((f) => f.pack.name === 'python' && f.beforeTree);
+        if (python.length === 0)
+            return [];
+        // which callables lost compatibility, and in which file
+        const broken = new Map();
+        for (const file of python) {
+            const now = file.pack.signatures?.(file.tree.rootNode);
+            const was = file.pack.signatures?.(file.beforeTree.rootNode);
+            if (!now || !was)
+                continue;
+            for (const [name, before] of was) {
+                const after = now.get(name);
+                if (!after)
+                    continue;
+                if (after.required > before.required) {
+                    broken.set(name, {
+                        file: file.path,
+                        line: after.node.startPosition.row + 1,
+                        detail: 'now requires ' + after.required + ' argument(s), was ' + before.required,
+                    });
+                }
+                else if (after.params.length < before.params.length) {
+                    broken.set(name, {
+                        file: file.path,
+                        line: after.node.startPosition.row + 1,
+                        detail: 'takes ' + after.params.length + ' parameter(s), was ' + before.params.length,
+                    });
+                }
+            }
+        }
+        if (broken.size === 0)
+            return [];
+        const changed = new Set(python.map((f) => f.path));
+        const diagnostics = pyrightDiagnostics(g.root, [g.root]);
+        // group the broken callers by the function they were calling
+        const callers = new Map();
+        for (const d of diagnostics) {
+            if (d.rule !== 'reportCallIssue' && d.rule !== 'reportArgumentType')
+                continue;
+            const path = repoPath(g.root, d.file);
+            if (changed.has(path))
+                continue; // a caller inside the change is not left behind
+            let source = '';
+            try {
+                source = lines(decode(readFileSync(join(g.root, path))))[d.line - 1] ?? '';
+            }
+            catch {
+                continue; // cannot read it, cannot attribute it
+            }
+            for (const name of broken.keys()) {
+                // attribute the error only where the line actually calls the changed function
+                if (!callsFunction(source, name))
+                    continue;
+                const list = callers.get(name) ?? [];
+                list.push({ file: path, line: d.line });
+                callers.set(name, list);
+            }
+        }
+        const findings = [];
+        for (const [name, sites] of callers) {
+            const where = broken.get(name);
+            const shown = sites.slice(0, 3).map((s) => s.file + ':' + s.line).join(', ');
+            findings.push({
+                id: '',
+                class: 'verified',
+                check: 'contract-drift',
+                severity: 'high',
+                confidence: 'proven',
+                file: where.file,
+                line: where.line,
+                title: name + '() ' + where.detail + ', and ' + sites.length + ' call site(s) outside this change now fail',
+                evidence: {
+                    oracle: 'pyright',
+                    detail: 'the checker reports a call error at ' + shown + (sites.length > 3 ? ' and others' : ''),
+                },
+                fix: 'Update the call sites, or keep the old shape working with a default',
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=foreign-contract-drift.js.map

package/dist/verifiers/foreign-copy-paste-drift.js

@@ -0,0 +1,83 @@
+import { nodesOfType } from '#app/lang/packs.js';
+import { finding, tokensFor } from './foreign-tokens.js';
+const MIN_TOKENS = 8;
+/** import / use / require statements, whatever each grammar calls them */
+const IMPORTISH = /import|use_declaration|require|include|using_directive|package_/;
+/** The defect is an inconsistent rename, not the duplication — see the TS version. */
+function missedRename(a, b, pack) {
+    if (a.length !== b.length || a.length < MIN_TOKENS)
+        return undefined;
+    const mapping = new Map();
+    let renamed = false;
+    for (let i = 0; i < a.length; i++) {
+        const x = a[i];
+        const y = b[i];
+        if (x.type !== y.type)
+            return undefined;
+        if (!pack.nodes.identifier.includes(x.type)) {
+            if (x.text !== y.text)
+                return undefined;
+            continue;
+        }
+        if (x.text !== y.text)
+            renamed = true;
+        const targets = mapping.get(x.text) ?? new Set();
+        targets.add(y.text);
+        mapping.set(x.text, targets);
+    }
+    if (!renamed)
+        return undefined;
+    for (const [name, targets] of mapping) {
+        // The signature of a missed rename is that one occurrence changed and another
+        // stayed behind, so the original name must be among the targets. Two different
+        // things that merely share a name map to two *new* names, which is not a rename
+        // anyone forgot. Found by running this check over its own repository.
+        if (targets.size > 1 && targets.has(name))
+            return { name, became: [...targets] };
+    }
+    return undefined;
+}
+function statementLists(root, pack) {
+    const lists = [root.namedChildren];
+    for (const block of nodesOfType(root, pack.nodes.block))
+        lists.push(block.namedChildren);
+    return lists;
+}
+export const foreignCopyPasteDrift = {
+    name: 'copy-paste-drift',
+    needs: ['syntax'],
+    run(g) {
+        const findings = [];
+        for (const file of g.foreign) {
+            for (const statements of statementLists(file.tree.rootNode, file.pack)) {
+                for (let i = 1; i < statements.length; i++) {
+                    const prev = statements[i - 1];
+                    const curr = statements[i];
+                    const line = curr.startPosition.row + 1;
+                    if (!file.changed.added.has(line))
+                        continue;
+                    if (file.pack.nodes.comment.includes(curr.type) || file.pack.nodes.comment.includes(prev.type))
+                        continue;
+                    // Consecutive imports from the same package share a shape by nature — a
+                    // list of what a file uses is not a block anyone copied and half-renamed.
+                    if (IMPORTISH.test(curr.type) || IMPORTISH.test(prev.type))
+                        continue;
+                    const miss = missedRename(tokensFor(prev, file.pack), tokensFor(curr, file.pack), file.pack);
+                    if (!miss)
+                        continue;
+                    findings.push(finding(file, curr, {
+                        check: 'copy-paste-drift',
+                        severity: 'high',
+                        confidence: 'firm',
+                        title: 'Copied from the statement above with `' + miss.name + '` renamed inconsistently — it became ' +
+                            miss.became.map((t) => '`' + t + '`').join(' in one place and ') + ' in another',
+                        evidence: { oracle: file.pack.name + ' token stream', detail: 'identical shape and literals, one identifier left un-renamed' },
+                        fix: 'Rename the remaining `' + miss.name + '`, or extract the shared shape',
+                    }));
+                }
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=foreign-copy-paste-drift.js.map

package/dist/verifiers/foreign-dropped-guard.js

@@ -0,0 +1,78 @@
+import { nodesOfType } from '#app/lang/packs.js';
+import { declaredName, finding } from './foreign-tokens.js';
+function guardsOf(fn, pack) {
+    const guards = new Map();
+    for (const stmt of nodesOfType(fn, pack.nodes.ifStatement)) {
+        const cond = stmt.childForFieldName(pack.nodes.ifCondition);
+        const body = stmt.childForFieldName(pack.nodes.ifBody);
+        if (!cond || !body)
+            continue;
+        const bails = nodesOfType(body, pack.nodes.bail).length > 0;
+        if (!bails)
+            continue;
+        const roots = nodesOfType(cond, pack.nodes.identifier).map((n) => n.text);
+        guards.set(cond.text.replace(/\s+/g, ' ').trim(), roots);
+    }
+    return guards;
+}
+/** Declarations at module level — the names another file could actually import. */
+export function functionsByName(root, pack) {
+    const all = nodesOfType(root, pack.nodes.declaration);
+    const out = new Map();
+    for (const decl of all) {
+        const containsAnother = all.some((other) => other !== decl &&
+            other.startPosition.row >= decl.startPosition.row &&
+            other.endPosition.row <= decl.endPosition.row);
+        if (containsAnother)
+            continue;
+        const name = declaredName(decl, pack);
+        if (name)
+            out.set(name, decl);
+    }
+    return out;
+}
+/** A guard the change removed from a function that still exists — see the TS version
+ *  for why obsolete and respelled guards are excluded. */
+export const foreignDroppedGuard = {
+    name: 'dropped-guard',
+    needs: ['syntax', 'base'],
+    run(g) {
+        const findings = [];
+        for (const file of g.foreign) {
+            if (!file.beforeTree)
+                continue;
+            const after = functionsByName(file.tree.rootNode, file.pack);
+            for (const [name, prev] of functionsByName(file.beforeTree.rootNode, file.pack)) {
+                const now = after.get(name);
+                if (!now)
+                    continue;
+                const had = guardsOf(prev, file.pack);
+                if (had.size === 0)
+                    continue;
+                const has = guardsOf(now, file.pack);
+                const available = new Set(nodesOfType(now, file.pack.nodes.identifier).map((n) => n.text));
+                const dropped = [...had.entries()]
+                    .filter(([text, roots]) => {
+                    if (has.has(text))
+                        return false;
+                    if (!roots.every((r) => available.has(r)))
+                        return false; // obsolete with the code it protected
+                    return ![...has.values()].some((other) => roots.every((r) => other.includes(r))); // respelled
+                })
+                    .map(([text]) => text);
+                if (dropped.length === 0)
+                    continue;
+                findings.push(finding(file, now, {
+                    check: 'dropped-guard',
+                    severity: 'high',
+                    confidence: 'proven',
+                    title: dropped.map((d) => '`' + d + '`').join(' and ') + ' guarded ' + name + '() before this change and ' +
+                        (dropped.length > 1 ? 'are' : 'is') + ' gone',
+                    evidence: { oracle: file.pack.name + ' pre/post AST', detail: 'early-exit branch removed while the function still uses the same names' },
+                }));
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=foreign-dropped-guard.js.map

package/dist/verifiers/foreign-phantom-api.js

@@ -0,0 +1,36 @@
+import { join } from 'node:path';
+import { pyrightAvailable, pyrightDiagnostics } from '#app/lang/pyright.js';
+/** An API the generated code invented, in Python. */
+export const foreignPhantomApi = {
+    name: 'phantom-api',
+    needs: ['python-types'],
+    run(g) {
+        const python = g.foreign.filter((f) => f.pack.name === 'python');
+        if (python.length === 0)
+            return [];
+        if (!pyrightAvailable(g.root))
+            return []; // no oracle, no claim
+        const byAbsolute = new Map(python.map((f) => [join(g.root, f.path), f]));
+        const diagnostics = pyrightDiagnostics(g.root, [...byAbsolute.keys()]);
+        const findings = [];
+        for (const d of diagnostics) {
+            const file = byAbsolute.get(d.file);
+            if (!file || !file.changed.added.has(d.line))
+                continue;
+            findings.push({
+                id: '',
+                class: 'verified',
+                check: 'phantom-api',
+                severity: 'high',
+                confidence: 'proven',
+                file: file.path,
+                line: d.line,
+                span: { column: d.column, length: 1 },
+                title: d.message,
+                evidence: { oracle: 'pyright', detail: d.rule + ': ' + d.meaning },
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=foreign-phantom-api.js.map

package/dist/verifiers/foreign-phantom-config.js

@@ -0,0 +1,40 @@
+import { finding } from './foreign-tokens.js';
+export const foreignPhantomConfig = {
+    name: 'phantom-config',
+    needs: ['syntax'],
+    supports: (file) => file.pack.envReads !== undefined,
+    run(g) {
+        if (g.foreign.length === 0)
+            return [];
+        // a key read anywhere else in the change is a documentation gap, not an invention
+        const elsewhere = new Set();
+        for (const file of g.foreign) {
+            for (const read of file.pack.envReads?.(file.tree.rootNode) ?? []) {
+                if (!file.changed.added.has(read.node.startPosition.row + 1))
+                    elsewhere.add(read.name);
+            }
+        }
+        const findings = [];
+        for (const file of g.foreign) {
+            for (const read of file.pack.envReads?.(file.tree.rootNode) ?? []) {
+                const line = read.node.startPosition.row + 1;
+                if (!file.changed.added.has(line))
+                    continue;
+                if (g.envManifest?.keys.has(read.name) || elsewhere.has(read.name))
+                    continue;
+                if (!g.envManifest)
+                    continue; // no manifest to be wrong about
+                findings.push(finding(file, read.node, {
+                    check: 'phantom-config',
+                    severity: 'medium',
+                    confidence: 'proven',
+                    title: 'Reads ' + read.name + ', which is not declared in ' + g.envManifest.file,
+                    evidence: { oracle: g.envManifest.file, detail: 'the key appears in no manifest entry and nowhere else in the change' },
+                    fix: 'Add ' + read.name + ' to ' + g.envManifest.file + ', or drop the reference',
+                }));
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=foreign-phantom-config.js.map

package/dist/verifiers/foreign-phantom-dep.js

@@ -0,0 +1,82 @@
+import { dirname, join } from 'node:path';
+import { isPhantom, localModules, pythonManifest } from '#app/lang/python-deps.js';
+import { isPhantomGem, rubyLocal, rubyManifest } from '#app/lang/ruby-deps.js';
+/** An import nothing installs, in a language with no build step to catch it. */
+export const foreignPhantomDep = {
+    name: 'phantom-dep',
+    needs: ['syntax'],
+    supports: (file) => file.pack.name === 'python' || file.pack.name === 'ruby',
+    run(g) {
+        return [...pythonFindings(g), ...rubyFindings(g)];
+    },
+};
+function rubyFindings(g) {
+    const ruby = g.foreign.filter((f) => f.pack.name === 'ruby');
+    if (ruby.length === 0)
+        return [];
+    const manifest = rubyManifest(g.root);
+    if (!manifest)
+        return [];
+    const local = rubyLocal(g.root);
+    const findings = [];
+    for (const file of ruby) {
+        for (const required of file.pack.imports?.(file.tree.rootNode) ?? []) {
+            const line = required.node.startPosition.row + 1;
+            if (!file.changed.added.has(line))
+                continue;
+            if (!isPhantomGem(required.name, manifest, local))
+                continue;
+            findings.push({
+                id: '',
+                class: 'verified',
+                check: 'phantom-dep',
+                severity: 'high',
+                confidence: 'firm',
+                file: file.path,
+                line,
+                span: { column: required.node.startPosition.column + 1, length: Math.min(required.node.text.length, 60) },
+                title: 'Requires "' + required.name + '", which is neither stdlib, local, nor a declared gem',
+                evidence: { oracle: manifest.file, detail: 'not found in the manifest, the standard library, or this repository' },
+                fix: 'Add it to ' + manifest.file.split(', ')[0] + ', or drop the require if it was invented',
+            });
+        }
+    }
+    return findings;
+}
+function pythonFindings(g) {
+    const python = g.foreign.filter((f) => f.pack.name === 'python');
+    if (python.length === 0)
+        return [];
+    const local = localModules(g.root);
+    const findings = [];
+    for (const file of python) {
+        // the manifests governing this file, not just the repository's own
+        const manifest = pythonManifest(g.root, dirname(join(g.root, file.path)));
+        if (!manifest)
+            continue;
+        for (const imported of file.pack.imports?.(file.tree.rootNode) ?? []) {
+            const line = imported.node.startPosition.row + 1;
+            if (!file.changed.added.has(line))
+                continue;
+            if (!isPhantom(imported.name, manifest, local))
+                continue;
+            findings.push({
+                id: '',
+                class: 'verified',
+                check: 'phantom-dep',
+                severity: 'high',
+                // firm, not proven: a package can be installed by means this cannot see —
+                // vendored, system-wide, or an editable install outside the manifest
+                confidence: 'firm',
+                file: file.path,
+                line,
+                span: { column: imported.node.startPosition.column + 1, length: Math.min(imported.node.text.length, 60) },
+                title: 'Imports "' + imported.name + '", which is neither stdlib, local, nor a declared dependency',
+                evidence: { oracle: manifest.file, detail: 'not found in the manifest, the standard library, or this repository' },
+                fix: 'Add it to ' + manifest.file.split(', ')[0] + ', or drop the import if it was invented',
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=foreign-phantom-dep.js.map