@4da/mcp-server 5.0.4 → 6.0.0

package/dist/live/lockfile-parsers-pygo.js

@@ -0,0 +1,274 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Python and Go lockfile parsers (split out of lockfile-parsers.ts).
+ *
+ * Measured 2026-10-02 against osv-scanner and pip-audit, every miss below was
+ * a parsing loss before OSV was ever asked:
+ * - requirements.txt: `urllib3[secure]==1.25.0` and dotted names were skipped,
+ *   and an inline comment rode along as part of the version — OSV was asked
+ *   about `"8.0.0  # imaging"` and answered with 63 advisories for the real 45.
+ * - poetry.lock: the reader required `name` and `version` on consecutive
+ *   lines. Poetry before 1.0 wrote its keys alphabetically (`category`,
+ *   `description`, `name`, ..., `version`), so a whole lockfile read as empty.
+ * - go.sum: `(v[\d.]+)` cut `v0.0.0-20200622213623-75b288015ac9` to `v0.0.0`
+ *   and dropped `+incompatible`; `v0.0.0` then sorted AFTER the real
+ *   pseudo-version, so older advisories were missed and later ones invented.
+ *   go.sum also lists versions the build never selected.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { emptySource, found, InstanceSet } from "./lockfile-types.js";
+// =============================================================================
+// Python: poetry.lock > uv.lock > Pipfile.lock > requirements.txt
+// =============================================================================
+/** PEP 503 normalised name: lowercase, runs of `-`, `_`, `.` become one `-`. */
+export function normalizePythonName(name) {
+    return name.trim().toLowerCase().replace(/[-_.]+/g, "-");
+}
+export function resolvePython(cwd) {
+    // poetry.lock and uv.lock are TOML arrays of [[package]] tables.
+    for (const file of ["poetry.lock", "uv.lock"]) {
+        const lockPath = path.join(cwd, file);
+        if (!fs.existsSync(lockPath))
+            continue;
+        try {
+            const read = readTomlPackageLock(fs.readFileSync(lockPath, "utf-8"));
+            if (read.instances.size > 0)
+                return found(read.versions, read.instances, lockPath, "lockfile");
+        }
+        catch { /* fall through */ }
+    }
+    const pipfileLock = path.join(cwd, "Pipfile.lock");
+    if (fs.existsSync(pipfileLock)) {
+        try {
+            const lock = JSON.parse(fs.readFileSync(pipfileLock, "utf-8"));
+            const versions = new Map();
+            const instances = new InstanceSet();
+            for (const [section, dev] of [["default", false], ["develop", true]]) {
+                for (const [name, info] of Object.entries(lock[section] ?? {})) {
+                    const version = info.version?.replace(/^===?/, "");
+                    if (!version)
+                        continue;
+                    const normalized = normalizePythonName(name);
+                    instances.add(normalized, version, dev);
+                    if (!versions.has(normalized))
+                        versions.set(normalized, version);
+                }
+            }
+            if (instances.size > 0)
+                return found(versions, instances, pipfileLock, "lockfile");
+        }
+        catch { /* fall through */ }
+    }
+    const reqPath = path.join(cwd, "requirements.txt");
+    if (fs.existsSync(reqPath)) {
+        const versions = new Map();
+        const instances = new InstanceSet();
+        try {
+            for (const { name, version } of parseRequirements(fs.readFileSync(reqPath, "utf-8"))) {
+                instances.add(name, version);
+                if (!versions.has(name))
+                    versions.set(name, version);
+            }
+        }
+        catch { /* skip */ }
+        return found(versions, instances, reqPath, "manifest");
+    }
+    return emptySource();
+}
+/**
+ * [[package]] tables from poetry.lock (any version) or uv.lock. A pre-1.2
+ * poetry.lock records `category = "dev"` for dev-only packages; newer files
+ * and uv.lock do not record scope here, so it stays unknown.
+ */
+export function readTomlPackageLock(content) {
+    const versions = new Map();
+    const instances = new InstanceSet();
+    for (const block of content.split(/^\[\[package\]\]\s*$/m).slice(1)) {
+        // Stop at the next table header (e.g. [package.dependencies], [metadata]).
+        const body = block.split(/^\[/m)[0];
+        const field = (key) => new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m").exec(body)?.[1] ?? null;
+        const name = field("name");
+        const version = field("version");
+        if (!name || !version)
+            continue;
+        // uv.lock lists the project itself (source = { editable/virtual = "." }); it is not a release.
+        if (/^source\s*=\s*\{\s*(?:editable|virtual)\s*=/m.test(body))
+            continue;
+        const category = field("category");
+        const normalized = normalizePythonName(name);
+        instances.add(normalized, version, category === null ? undefined : category === "dev");
+        if (!versions.has(normalized))
+            versions.set(normalized, version);
+    }
+    return { versions, instances };
+}
+/**
+ * Exact pins from a requirements file: `name==1.2`, `name===1.2`,
+ * `name[extra1,extra2]==1.2`, with environment markers and inline comments.
+ * Ranges (`>=`, `~=`) do not name an installed version and are skipped, as are
+ * options (`-r`, `-e`, `--hash`) and URL requirements.
+ */
+export function parseRequirements(content) {
+    const out = [];
+    // Backslash continuations join physical lines into one requirement.
+    const logical = content.replace(/\\\r?\n/g, " ").split(/\r?\n/);
+    for (const raw of logical) {
+        // A `#` starts a comment at line start or after whitespace (PEP 508 URLs may contain `#`).
+        const line = raw.replace(/(^|\s)#.*$/, "").trim();
+        if (!line || line.startsWith("-"))
+            continue;
+        // Per-requirement options (pip-compile writes `--hash=sha256:...` on
+        // continuation lines) follow the specifier; they are not part of it.
+        const spec = line.split(";")[0].replace(/\s--?[A-Za-z][\w-]*(?:[=\s]\S+)?/g, "").trim();
+        const match = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*===?\s*([^\s,;]+)\s*$/.exec(spec);
+        if (!match)
+            continue;
+        out.push({ name: normalizePythonName(match[1]), version: match[2] });
+    }
+    return out;
+}
+// =============================================================================
+// Go: go.mod (the selected module set) completed from go.sum for go < 1.17
+// =============================================================================
+/** A full Go module version: release, prerelease, pseudo-version, `+incompatible`. */
+const GO_VERSION = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+export function resolveGo(cwd) {
+    const goModPath = path.join(cwd, "go.mod");
+    if (!fs.existsSync(goModPath))
+        return emptySource();
+    let mod;
+    try {
+        mod = parseGoMod(fs.readFileSync(goModPath, "utf-8"));
+    }
+    catch {
+        return emptySource();
+    }
+    const versions = new Map();
+    const instances = new InstanceSet();
+    for (const { module, version } of mod.requires) {
+        versions.set(module, version);
+        instances.add(module, version);
+    }
+    // From go 1.17 the go.mod `require` list names every module the build needs
+    // (module-graph pruning), so it IS the selected set and go.sum (which keeps
+    // hashes for versions the build never selects) would only over-report.
+    // Before 1.17 go.mod lists direct requirements only; transitives come from
+    // go.sum, at the highest version whose module zip is hashed there — what
+    // minimal version selection picked.
+    if (!mod.goVersionAtLeast117) {
+        const goSumPath = path.join(cwd, "go.sum");
+        if (fs.existsSync(goSumPath)) {
+            try {
+                for (const [module, version] of selectedFromGoSum(fs.readFileSync(goSumPath, "utf-8"))) {
+                    if (versions.has(module))
+                        continue;
+                    versions.set(module, version);
+                    instances.add(module, version);
+                }
+            }
+            catch { /* skip */ }
+        }
+    }
+    return found(versions, instances, goModPath, "lockfile");
+}
+/** `require` lines (block and single form) with `replace` applied, and whether the go directive is >= 1.17. */
+export function parseGoMod(content) {
+    const requires = new Map();
+    const replaces = new Map();
+    let block = null;
+    for (const rawLine of content.split(/\r?\n/)) {
+        const indirect = /\/\/\s*indirect\b/.test(rawLine);
+        const line = rawLine.replace(/\/\/.*$/, "").trim();
+        if (!line)
+            continue;
+        if (block && line === ")") {
+            block = null;
+            continue;
+        }
+        const opener = /^(require|replace)\s*\($/.exec(line);
+        if (opener) {
+            block = opener[1];
+            continue;
+        }
+        const single = /^(require|replace)\s+(.+)$/.exec(line);
+        const kind = single ? single[1] : block;
+        const rest = single ? single[2] : line;
+        if (kind === "require") {
+            const [module, version] = rest.split(/\s+/);
+            if (module && version && GO_VERSION.test(version))
+                requires.set(module, { module, version, indirect });
+        }
+        else if (kind === "replace") {
+            // `old [v] => new v` replaces with another module version; `=> ./path` is local code.
+            const [left, right] = rest.split("=>").map((s) => s.trim().split(/\s+/));
+            if (!left?.[0] || !right?.[0])
+                continue;
+            replaces.set(left[0], right[1] && GO_VERSION.test(right[1]) ? { module: right[0], version: right[1] } : null);
+        }
+    }
+    const result = [];
+    for (const req of requires.values()) {
+        if (!replaces.has(req.module)) {
+            result.push(req);
+            continue;
+        }
+        const target = replaces.get(req.module);
+        if (target)
+            result.push({ module: target.module, version: target.version, indirect: req.indirect });
+    }
+    const go = /^go\s+(\d+)\.(\d+)/m.exec(content);
+    const goVersionAtLeast117 = go ? Number(go[1]) > 1 || Number(go[2]) >= 17 : false;
+    return { requires: result, goVersionAtLeast117 };
+}
+/**
+ * Per module, the highest version go.sum records — minimal version selection
+ * picks the highest required version, and go.sum records every version the
+ * module graph required. A module listed only by its `/go.mod` hash is still
+ * in Go's build list (`go list -m all`): measured 2026-10-02 on gh cli v1.0
+ * (go 1.13), skipping those lines missed 14 advisories (grpc 1.21.0,
+ * jwt-go, gorilla/websocket, ...) the build list carries.
+ */
+export function selectedFromGoSum(content) {
+    const selected = new Map();
+    for (const line of content.split(/\r?\n/)) {
+        const [module, rawVersion] = line.trim().split(/\s+/);
+        const version = rawVersion?.replace(/\/go\.mod$/, "");
+        if (!module || !version || !GO_VERSION.test(version))
+            continue;
+        const current = selected.get(module);
+        if (!current || compareGoVersions(version, current) > 0)
+            selected.set(module, version);
+    }
+    return selected;
+}
+/** Semver precedence over Go versions; build metadata (`+incompatible`) is ignored. */
+export function compareGoVersions(a, b) {
+    const parse = (v) => {
+        const m = /^v(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/.exec(v);
+        return m ? { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ? m[4].split(".") : [] } : null;
+    };
+    const pa = parse(a);
+    const pb = parse(b);
+    if (!pa || !pb)
+        return 0;
+    for (let i = 0; i < 3; i++)
+        if (pa.nums[i] !== pb.nums[i])
+            return pa.nums[i] > pb.nums[i] ? 1 : -1;
+    if (pa.pre.length === 0 || pb.pre.length === 0)
+        return Math.sign(pb.pre.length - pa.pre.length);
+    for (let i = 0; i < Math.min(pa.pre.length, pb.pre.length); i++) {
+        const x = pa.pre[i];
+        const y = pb.pre[i];
+        if (x === y)
+            continue;
+        const xn = /^\d+$/.test(x);
+        const yn = /^\d+$/.test(y);
+        if (xn && yn)
+            return BigInt(x) > BigInt(y) ? 1 : -1;
+        if (xn !== yn)
+            return xn ? -1 : 1;
+        return x > y ? 1 : -1;
+    }
+    return Math.sign(pa.pre.length - pb.pre.length);
+}

package/dist/live/lockfile-parsers.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Lockfile parsers, one per ecosystem, each reporting WHICH file it resolved
+ * from as well as the versions it read.
+ *
+ * Priority per ecosystem: lock file (exact) > manifest (range/specifier).
+ * Uses only Node.js built-ins — no external parsers. The source path is what
+ * lets the live layer notice when that file changes and re-resolve (measured
+ * 2026-09-10: a server started before a lockfile bump kept reporting hono
+ * 4.13.3 after the lockfile said 4.13.5). The pnpm and yarn readers live in
+ * js-lockfile-readers.ts; Python and Go in lockfile-parsers-pygo.ts.
+ *
+ * Every parser reports two things (2026-10-02):
+ * - `instances`: EVERY installed copy, name@version, with the lockfile's own
+ *   dev flag when it records one. A lockfile routinely holds several versions
+ *   of one package (nested npm copies, two semver-incompatible crates). The
+ *   reader used to keep one version per name, last one wins: measured against
+ *   osv-scanner on 12 projects, nodegoat lost 287 of 1,091 installed copies
+ *   and 4DA's src-tauri lost 143 of 934 — including its own `rsa 0.9.10`
+ *   (RUSTSEC-2023-0071), overwritten by `rsa 0.10.0-rc.18` — and the direct
+ *   `minimist@1.2.0` was reported as its nested `0.0.8`.
+ * - `versions`: the ONE version per name a direct dependency resolves to (the
+ *   top-level npm copy, the crate version a workspace member depends on),
+ *   which dependency health and upgrade planning read.
+ */
+import { InstanceSet, type VersionSource } from "./lockfile-types.js";
+import type { OsvEcosystem } from "./types.js";
+export type { PackageInstance, VersionSource } from "./lockfile-types.js";
+/** Every lock file the resolver may read for this ecosystem, present or not, in priority order. */
+export declare function lockfileCandidates(cwd: string, ecosystem: OsvEcosystem): string[];
+/** The manifest the resolver falls back to for this ecosystem, or null when it has none. */
+export declare function manifestCandidate(cwd: string, ecosystem: OsvEcosystem): string | null;
+export declare function resolveVersionSource(cwd: string, ecosystem: OsvEcosystem): VersionSource;
+/** The package name a package-lock `packages` key installs: the segment after its LAST `node_modules/`. */
+export declare function packageNameFromNodeModulesPath(lockPath: string): string;
+interface LockEntry {
+    version?: string;
+    dev?: boolean;
+    link?: boolean;
+    dependencies?: Record<string, LockEntry>;
+}
+/**
+ * package-lock.json / npm-shrinkwrap.json, lockfile v1, v2 and v3.
+ *
+ * v2/v3 `packages` keys are install paths: `node_modules/a` is the hoisted
+ * copy a direct dependency of the root resolves to, `node_modules/a/node_modules/b`
+ * a nested one. npm writes `dev: true` on every entry only reachable from
+ * devDependencies (`devOptional` = also reachable as an optional runtime dep,
+ * so runtime), which makes the dev scope of a TRANSITIVE known. v1 nests the
+ * same information under `dependencies`.
+ */
+export declare function readPackageLock(lock: {
+    packages?: Record<string, LockEntry>;
+    dependencies?: Record<string, LockEntry>;
+}): {
+    versions: Map<string, string>;
+    instances: InstanceSet;
+};
+interface CargoPackage {
+    name: string;
+    version: string;
+    source: string | null;
+    dependencies: string[];
+}
+/**
+ * Every `[[package]]` table in a Cargo.lock, read field by field. The old
+ * reader required `name` and `version` on consecutive lines; that holds for
+ * cargo's own writer, but the table is TOML and nothing else guarantees it.
+ */
+export declare function parseCargoLockPackages(content: string): CargoPackage[];

package/dist/live/lockfile-parsers.js

@@ -0,0 +1,311 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Lockfile parsers, one per ecosystem, each reporting WHICH file it resolved
+ * from as well as the versions it read.
+ *
+ * Priority per ecosystem: lock file (exact) > manifest (range/specifier).
+ * Uses only Node.js built-ins — no external parsers. The source path is what
+ * lets the live layer notice when that file changes and re-resolve (measured
+ * 2026-09-10: a server started before a lockfile bump kept reporting hono
+ * 4.13.3 after the lockfile said 4.13.5). The pnpm and yarn readers live in
+ * js-lockfile-readers.ts; Python and Go in lockfile-parsers-pygo.ts.
+ *
+ * Every parser reports two things (2026-10-02):
+ * - `instances`: EVERY installed copy, name@version, with the lockfile's own
+ *   dev flag when it records one. A lockfile routinely holds several versions
+ *   of one package (nested npm copies, two semver-incompatible crates). The
+ *   reader used to keep one version per name, last one wins: measured against
+ *   osv-scanner on 12 projects, nodegoat lost 287 of 1,091 installed copies
+ *   and 4DA's src-tauri lost 143 of 934 — including its own `rsa 0.9.10`
+ *   (RUSTSEC-2023-0071), overwritten by `rsa 0.10.0-rc.18` — and the direct
+ *   `minimist@1.2.0` was reported as its nested `0.0.8`.
+ * - `versions`: the ONE version per name a direct dependency resolves to (the
+ *   top-level npm copy, the crate version a workspace member depends on),
+ *   which dependency health and upgrade planning read.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { readBunLock } from "./bun-lockfile.js";
+import { readPnpmLock, readYarnLock } from "./js-lockfile-readers.js";
+import { resolveGo, resolvePython } from "./lockfile-parsers-pygo.js";
+import { emptySource, found, InstanceSet } from "./lockfile-types.js";
+const LOCKFILES = {
+    npm: ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"],
+    "crates.io": ["Cargo.lock"],
+    PyPI: ["poetry.lock", "uv.lock", "Pipfile.lock"],
+    Go: ["go.mod", "go.sum"],
+};
+const MANIFESTS = {
+    npm: "package.json",
+    "crates.io": "Cargo.toml",
+    PyPI: "requirements.txt",
+};
+/** Every lock file the resolver may read for this ecosystem, present or not, in priority order. */
+export function lockfileCandidates(cwd, ecosystem) {
+    return (LOCKFILES[ecosystem] ?? []).map((name) => path.join(cwd, name));
+}
+/** The manifest the resolver falls back to for this ecosystem, or null when it has none. */
+export function manifestCandidate(cwd, ecosystem) {
+    const name = MANIFESTS[ecosystem];
+    return name ? path.join(cwd, name) : null;
+}
+export function resolveVersionSource(cwd, ecosystem) {
+    switch (ecosystem) {
+        case "npm":
+            return resolveNpm(cwd);
+        case "crates.io":
+            return resolveRust(cwd);
+        case "PyPI":
+            return resolvePython(cwd);
+        case "Go":
+            return resolveGo(cwd);
+        default:
+            return emptySource();
+    }
+}
+/** Instances for a manifest-only read: one per name, scope unknown. */
+function manifestInstances(versions) {
+    return [...versions].map(([name, version]) => ({ name, version }));
+}
+// =============================================================================
+// npm: package-lock.json > npm-shrinkwrap.json > pnpm-lock.yaml > yarn.lock > bun.lock > package.json ranges
+// =============================================================================
+function resolveNpm(cwd) {
+    for (const name of ["package-lock.json", "npm-shrinkwrap.json"]) {
+        const lockPath = path.join(cwd, name);
+        if (!fs.existsSync(lockPath))
+            continue;
+        try {
+            const read = readPackageLock(JSON.parse(fs.readFileSync(lockPath, "utf-8")));
+            if (read.instances.size > 0)
+                return found(read.versions, read.instances, lockPath, "lockfile");
+        }
+        catch { /* fall through */ }
+    }
+    // pnpm-lock.yaml (v5.x, v6 and v9, read by column; see js-lockfile-readers.ts)
+    const pnpmLockPath = path.join(cwd, "pnpm-lock.yaml");
+    if (fs.existsSync(pnpmLockPath)) {
+        try {
+            const versions = new Map();
+            const instances = new InstanceSet();
+            readPnpmLock(fs.readFileSync(pnpmLockPath, "utf-8"), versions, instances);
+            if (versions.size > 0)
+                return found(versions, instances, pnpmLockPath, "lockfile");
+        }
+        catch { /* fall through */ }
+    }
+    // yarn.lock (v1 and berry)
+    const yarnLockPath = path.join(cwd, "yarn.lock");
+    if (fs.existsSync(yarnLockPath)) {
+        try {
+            const versions = new Map();
+            const instances = new InstanceSet();
+            const specs = new Map();
+            readYarnLock(fs.readFileSync(yarnLockPath, "utf-8"), versions, instances, specs);
+            // The copy a direct dependency resolves to is the one its package.json range names.
+            for (const [name, range] of manifestRanges(cwd)) {
+                const version = specs.get(`${name}@${range}`);
+                if (version)
+                    versions.set(name, version);
+            }
+            if (versions.size > 0)
+                return found(versions, instances, yarnLockPath, "lockfile");
+        }
+        catch { /* fall through */ }
+    }
+    // bun.lock (Bun 1.2+ text lockfile; the binary bun.lockb is not readable)
+    const bunLockPath = path.join(cwd, "bun.lock");
+    if (fs.existsSync(bunLockPath)) {
+        try {
+            const versions = new Map();
+            const instances = new InstanceSet();
+            readBunLock(fs.readFileSync(bunLockPath, "utf-8"), versions, instances);
+            if (versions.size > 0)
+                return found(versions, instances, bunLockPath, "lockfile");
+        }
+        catch { /* fall through */ }
+    }
+    // Fallback: extract version floors from package.json ranges
+    const pkgPath = path.join(cwd, "package.json");
+    if (fs.existsSync(pkgPath)) {
+        const versions = new Map();
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+            const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+            for (const [name, spec] of Object.entries(allDeps)) {
+                const version = extractVersionFromSpec(spec);
+                if (version)
+                    versions.set(name, version);
+            }
+        }
+        catch { /* skip */ }
+        return found(versions, manifestInstances(versions), pkgPath, "manifest");
+    }
+    return emptySource();
+}
+/** The package name a package-lock `packages` key installs: the segment after its LAST `node_modules/`. */
+export function packageNameFromNodeModulesPath(lockPath) {
+    const marker = "node_modules/";
+    const index = lockPath.lastIndexOf(marker);
+    return index === -1 ? "" : lockPath.slice(index + marker.length);
+}
+/**
+ * package-lock.json / npm-shrinkwrap.json, lockfile v1, v2 and v3.
+ *
+ * v2/v3 `packages` keys are install paths: `node_modules/a` is the hoisted
+ * copy a direct dependency of the root resolves to, `node_modules/a/node_modules/b`
+ * a nested one. npm writes `dev: true` on every entry only reachable from
+ * devDependencies (`devOptional` = also reachable as an optional runtime dep,
+ * so runtime), which makes the dev scope of a TRANSITIVE known. v1 nests the
+ * same information under `dependencies`.
+ */
+export function readPackageLock(lock) {
+    const versions = new Map();
+    const instances = new InstanceSet();
+    if (lock.packages) {
+        for (const [key, value] of Object.entries(lock.packages)) {
+            const name = packageNameFromNodeModulesPath(key);
+            if (!name || !value || value.link || !value.version)
+                continue;
+            instances.add(name, value.version, value.dev === true);
+            // The hoisted root copy is what `require(name)` from the project resolves to.
+            if (key === `node_modules/${name}`)
+                versions.set(name, value.version);
+        }
+        // A workspace package's own nested copy (packages/x/node_modules/a) when nothing is hoisted.
+        for (const instance of instances.toArray()) {
+            if (!versions.has(instance.name))
+                versions.set(instance.name, instance.version);
+        }
+    }
+    if (instances.size === 0 && lock.dependencies) {
+        const walk = (deps, topLevel) => {
+            for (const [name, value] of Object.entries(deps)) {
+                if (value?.version && /^\d/.test(value.version)) {
+                    instances.add(name, value.version, value.dev === true);
+                    if (topLevel)
+                        versions.set(name, value.version);
+                }
+                if (value?.dependencies)
+                    walk(value.dependencies, false);
+            }
+        };
+        walk(lock.dependencies, true);
+    }
+    return { versions, instances };
+}
+/**
+ * Every `[[package]]` table in a Cargo.lock, read field by field. The old
+ * reader required `name` and `version` on consecutive lines; that holds for
+ * cargo's own writer, but the table is TOML and nothing else guarantees it.
+ */
+export function parseCargoLockPackages(content) {
+    const packages = [];
+    for (const block of content.split(/^\[\[package\]\]\s*$/m).slice(1)) {
+        const body = block.split(/^\[(?!\[package\]\])/m)[0];
+        const field = (key) => new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m").exec(body)?.[1] ?? null;
+        const name = field("name");
+        const version = field("version");
+        if (!name || !version)
+            continue;
+        const depsMatch = /^dependencies\s*=\s*\[([\s\S]*?)\]/m.exec(body);
+        const dependencies = depsMatch ? [...depsMatch[1].matchAll(/"([^"]+)"/g)].map((m) => m[1]) : [];
+        packages.push({ name, version, source: field("source"), dependencies });
+    }
+    return packages;
+}
+function resolveRust(cwd) {
+    const lockPath = path.join(cwd, "Cargo.lock");
+    if (!fs.existsSync(lockPath)) {
+        return resolveRustFromManifest(cwd);
+    }
+    const versions = new Map();
+    const instances = new InstanceSet();
+    try {
+        const packages = parseCargoLockPackages(fs.readFileSync(lockPath, "utf-8"));
+        const versionsByName = new Map();
+        // Cargo writes `source` on every registry or git package. In a file it
+        // wrote, a package with none is a workspace member or path dependency:
+        // local code, not a release, so no advisory can be about it. A lockfile
+        // with no `source` anywhere was not written by cargo; keep everything.
+        const cargoWritten = packages.some((pkg) => pkg.source !== null);
+        const isLocal = (pkg) => cargoWritten && pkg.source === null;
+        for (const pkg of packages) {
+            if (isLocal(pkg))
+                continue;
+            instances.add(pkg.name, pkg.version);
+            versionsByName.set(pkg.name, [...(versionsByName.get(pkg.name) ?? []), pkg.version]);
+        }
+        // The version a direct dependency resolves to: the one a workspace member
+        // names. Cargo writes "name version" when two versions coexist, else "name".
+        for (const member of packages.filter(isLocal)) {
+            for (const dep of member.dependencies) {
+                const [name, version] = dep.split(" ");
+                const candidates = versionsByName.get(name);
+                if (!candidates || versions.has(name))
+                    continue;
+                if (version && candidates.includes(version))
+                    versions.set(name, version);
+                else if (!version && candidates.length === 1)
+                    versions.set(name, candidates[0]);
+            }
+        }
+        for (const [name, list] of versionsByName) {
+            if (!versions.has(name))
+                versions.set(name, list[0]);
+        }
+    }
+    catch { /* skip */ }
+    return found(versions, instances, lockPath, "lockfile");
+}
+function resolveRustFromManifest(cwd) {
+    const versions = new Map();
+    const cargoPath = path.join(cwd, "Cargo.toml");
+    if (!fs.existsSync(cargoPath))
+        return emptySource();
+    try {
+        const content = fs.readFileSync(cargoPath, "utf-8");
+        // name = "1.0" or name = { version = "1.0", ... }
+        const depRegex = /^([a-zA-Z_][\w-]*)\s*=\s*(?:"([^"]+)"|.*?version\s*=\s*"([^"]+)")/gm;
+        let match;
+        while ((match = depRegex.exec(content)) !== null) {
+            const name = match[1];
+            const version = match[2] || match[3];
+            if (version && /^\d/.test(version)) {
+                versions.set(name, version);
+            }
+        }
+    }
+    catch { /* skip */ }
+    return found(versions, manifestInstances(versions), cargoPath, "manifest");
+}
+// =============================================================================
+// Helpers
+// =============================================================================
+/** package.json dependency ranges (all dependency fields), or none when unreadable. */
+function manifestRanges(cwd) {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf-8"));
+        const out = [];
+        for (const field of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+            for (const [name, range] of Object.entries(pkg[field] ?? {})) {
+                if (typeof range === "string")
+                    out.push([name, range]);
+            }
+        }
+        return out;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Extract a usable version from an npm version specifier.
+ * "^4.18.2" -> "4.18.2", "~1.0.0" -> "1.0.0", ">=2.0.0" -> "2.0.0"
+ */
+function extractVersionFromSpec(spec) {
+    if (!spec)
+        return null;
+    const match = spec.match(/(\d+\.\d+\.\d+(?:-[\w.]+)?)/);
+    return match ? match[1] : null;
+}