@4da/mcp-server 6.0.2 → 6.2.0

package/dist/live/index.js

@@ -18,9 +18,13 @@ import { PyPIRegistry } from "./pypi-registry.js";
 import { GoRegistry } from "./go-registry.js";
 import { NpmPackumentReader } from "./npm-packument.js";
 import { CratesVersionsReader } from "./crates-versions.js";
+import { PypiReleasesReader } from "./pypi-releases.js";
+import { GoReleasesReader } from "./go-releases.js";
+import { FixPathSources } from "./fix-paths.js";
 import { fetchRegistryHealthFor } from "./registry-health.js";
 import { commonPathRoot, dedupeDependencies, emptyVulnResult } from "./dependency-set.js";
 import { groupIsStale, resolveGroup } from "./resolution.js";
+import { mapEcosystem } from "./version-resolver.js";
 import { applyInstanceDevScope } from "./dev-scope.js";
 /** Minimum gap between vulnerability warmup attempts after an offline result. */
 const WARMUP_RETRY_MS = 60_000;
@@ -36,6 +40,9 @@ export class LiveIntelligence {
     goRegistry;
     npmPackuments;
     cratesVersions;
+    pypiReleases;
+    goReleases;
+    fixPathSources;
     enabled;
     lastVulnScan = null;
     /** Whether the stored scan included direct devDependencies. */
@@ -49,6 +56,8 @@ export class LiveIntelligence {
      * runs, 2026-10-03 pre-publish verification).
      */
     scanRequests = 0;
+    /** Scans running now, by generation, scope and path: a request for one of them awaits it. */
+    scansInFlight = new Map();
     storedScanRequest = 0;
     lastHeadlines = [];
     resolvedDeps = [];
@@ -57,6 +66,8 @@ export class LiveIntelligence {
     projectRoot = null;
     /** One entry per resolution group: its inputs, result, and the file signatures that say when it went stale. */
     groupResults = [];
+    /** The project-tree walk's report of what it left out, when the groups came from one. */
+    discovery = null;
     /** When the dependency set in use was assembled: at init, or at the last re-resolution. */
     resolvedAt = null;
     /**
@@ -86,6 +97,25 @@ export class LiveIntelligence {
         this.goRegistry = new GoRegistry(this.cache, this.rateLimiter);
         this.npmPackuments = new NpmPackumentReader(this.cache, this.rateLimiter);
         this.cratesVersions = new CratesVersionsReader(this.cache, this.rateLimiter);
+        this.pypiReleases = new PypiReleasesReader(this.cache, this.rateLimiter);
+        this.goReleases = new GoReleasesReader(this.cache, this.rateLimiter);
+        this.fixPathSources = new FixPathSources(this.cache, this.rateLimiter);
+    }
+    /** Advisory, registry and parent-requirement lookups for fix paths; null when offline. */
+    getFixPathSources() {
+        return this.enabled ? this.fixPathSources : null;
+    }
+    /**
+     * The lockfile one manifest directory resolved this ecosystem from, or null
+     * when it resolved from a manifest or nothing. `dir` is spelled as the
+     * resolution group spells it (the scan's sourceDirs).
+     */
+    lockfileFor(dir, ecosystem) {
+        for (const r of this.groupResults) {
+            if (r.group.dir === dir && mapEcosystem(r.group.language) === ecosystem && r.source?.kind === "lockfile")
+                return r.source.path;
+        }
+        return null;
     }
     /**
      * Initialize with project data. Call once after project scan.
@@ -114,8 +144,20 @@ export class LiveIntelligence {
      * project-tree.ts): each group resolves from its own directory and keeps
      * its manifest's platform targets; `root` is the reported project root.
      */
-    initFromProjectTree(root, groups) {
+    initFromProjectTree(root, groups, discovery = null) {
         this.applyGroups(groups, root);
+        this.discovery = discovery;
+    }
+    /**
+     * Manifests with no lockfile beside them, whose ranged dependencies were not
+     * scanned: their versions are declared ranges, not installs.
+     */
+    getUnresolvedManifests() {
+        return this.groupResults.flatMap((r) => (r.unresolved ? [{ dir: r.group.dir, ...r.unresolved }] : []));
+    }
+    /** What the project-tree walk left out (lockfiles past its bounds); null when the set did not come from a walk. */
+    getDiscovery() {
+        return this.discovery;
     }
     /**
      * Initialize from dependency groups that each carry their own resolution
@@ -178,10 +220,12 @@ export class LiveIntelligence {
         const seen = new Set();
         const sources = [];
         for (const result of this.groupResults) {
-            if (!result.source || seen.has(result.source.path))
-                continue;
-            seen.add(result.source.path);
-            sources.push(result.source);
+            for (const source of result.sources) {
+                if (seen.has(source.path))
+                    continue;
+                seen.add(source.path);
+                sources.push(source);
+            }
         }
         return { resolvedAt: this.resolvedAt, sources };
     }
@@ -222,13 +266,28 @@ export class LiveIntelligence {
         if (options?.forceRefresh) {
             this.cache.invalidateSource("osv");
         }
+        // The same scan already running (the startup warm-up, or a second call
+        // while the first is out) is awaited, not repeated. A forced refresh
+        // always runs its own.
+        const shareKey = `${this.generation}${options?.includeDev ? "dev" : "runtime"}${projectPath}`;
+        const running = options?.forceRefresh ? undefined : this.scansInFlight.get(shareKey);
+        if (running)
+            return running;
+        const scan = this.runScan(deps, projectPath, options?.includeDev ?? false);
+        if (!options?.forceRefresh) {
+            this.scansInFlight.set(shareKey, scan);
+            void scan.finally(() => this.scansInFlight.delete(shareKey));
+        }
+        return scan;
+    }
+    async runScan(deps, projectPath, includeDev) {
         const generation = this.generation;
         const request = ++this.scanRequests;
         try {
             const result = await this.osvScanner.scan(deps, projectPath);
             if (generation === this.generation && request > this.storedScanRequest) {
                 this.lastVulnScan = result;
-                this.lastVulnScanIncludesDev = options?.includeDev ?? false;
+                this.lastVulnScanIncludesDev = includeDev;
                 this.storedScanRequest = request;
             }
             return result;
@@ -393,7 +452,7 @@ export class LiveIntelligence {
     }
     /** Per-release registry readers for dependency_check (name-only requests). */
     getReleaseSources() {
-        return { npm: this.npmPackuments, "crates.io": this.cratesVersions };
+        return { npm: this.npmPackuments, "crates.io": this.cratesVersions, PyPI: this.pypiReleases, Go: this.goReleases };
     }
     /**
      * OSV advisories for explicit (ecosystem, name, version) triples that need

package/dist/live/lockfile-parents.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Who pulls in one installed copy of a package, and with which declared
+ * requirement: the input to "is a lockfile refresh enough?".
+ *
+ * npm (package-lock), yarn and bun lockfiles record each parent's declared
+ * range. pnpm and Cargo lockfiles record only the resolved version, so their
+ * edges carry `range: null` and the caller looks the requirement up in the
+ * parent's registry metadata.
+ */
+export type LockfileFormat = "package-lock" | "pnpm" | "yarn" | "yarn-berry" | "bun" | "cargo";
+export interface ParentEdge {
+    /** The parent package, or the manifest's own name / directory for a project or workspace member. */
+    parent: string;
+    /** The parent's installed version; null for a project or workspace member. */
+    parentVersion: string | null;
+    /** The requirement as declared; null when the lockfile does not record it (pnpm, Cargo). */
+    range: string | null;
+    /** True when the parent is the project itself or a workspace member (then the package is direct there). */
+    local: boolean;
+}
+export interface LockfileParents {
+    format: LockfileFormat;
+    edges: ParentEdge[];
+}
+/** The lockfile format of a path, or null for a file this module does not read. */
+export declare function lockfileFormat(file: string, content: string): LockfileFormat | null;
+/** The parents of `name@version` in one lockfile, or null when the file is unreadable or not supported. */
+export declare function readLockfileParents(file: string, name: string, version: string): LockfileParents | null;
+interface LockEntry {
+    name?: string;
+    version?: string;
+    link?: boolean;
+    requires?: Record<string, string>;
+    dependencies?: Record<string, string> | Record<string, LockEntry>;
+    optionalDependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+}
+export declare function packageLockParents(lock: {
+    packages?: Record<string, LockEntry>;
+    dependencies?: Record<string, LockEntry>;
+    name?: string;
+}, name: string, version: string): ParentEdge[];
+/**
+ * Parents from `packages:` (v5/v6) or `snapshots:` (v9) entries whose
+ * dependency blocks resolve `name` to `version`. pnpm records resolved
+ * versions only, so `range` is null. Importers (the project's own manifests)
+ * become local edges with their `specifier` when the lockfile records one.
+ */
+export declare function pnpmParents(content: string, name: string, version: string): ParentEdge[];
+export declare function yarnParents(content: string, name: string, version: string): ParentEdge[];
+export declare function bunParents(lock: {
+    packages?: Record<string, unknown>;
+    workspaces?: Record<string, Record<string, Record<string, string>>>;
+}, name: string, version: string): ParentEdge[];
+/**
+ * Packages whose `dependencies` list this copy: "name" when only one version
+ * of it is in the lockfile, "name version" (optionally with a source) when
+ * several are. Cargo records no requirement, so `range` is null.
+ */
+export declare function cargoParents(content: string, name: string, version: string): ParentEdge[];
+export {};

package/dist/live/lockfile-parents.js

@@ -0,0 +1,360 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Who pulls in one installed copy of a package, and with which declared
+ * requirement: the input to "is a lockfile refresh enough?".
+ *
+ * npm (package-lock), yarn and bun lockfiles record each parent's declared
+ * range. pnpm and Cargo lockfiles record only the resolved version, so their
+ * edges carry `range: null` and the caller looks the requirement up in the
+ * parent's registry metadata.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { stripTrailingCommas } from "./bun-lockfile.js";
+import { parsePnpmKey } from "./js-lockfile-readers.js";
+import { packageNameFromNodeModulesPath, parseCargoLockPackages } from "./lockfile-parsers.js";
+const DEP_FIELDS = ["dependencies", "optionalDependencies", "peerDependencies"];
+/** The lockfile format of a path, or null for a file this module does not read. */
+export function lockfileFormat(file, content) {
+    const base = path.basename(file);
+    if (base === "package-lock.json" || base === "npm-shrinkwrap.json")
+        return "package-lock";
+    if (base === "pnpm-lock.yaml")
+        return "pnpm";
+    if (base === "yarn.lock")
+        return /^__metadata:/m.test(content) ? "yarn-berry" : "yarn";
+    if (base === "bun.lock")
+        return "bun";
+    if (base === "Cargo.lock")
+        return "cargo";
+    return null;
+}
+/** The parents of `name@version` in one lockfile, or null when the file is unreadable or not supported. */
+export function readLockfileParents(file, name, version) {
+    let content;
+    try {
+        content = fs.readFileSync(file, "utf-8");
+    }
+    catch {
+        return null;
+    }
+    const format = lockfileFormat(file, content);
+    if (!format)
+        return null;
+    try {
+        switch (format) {
+            case "package-lock":
+                return { format, edges: packageLockParents(JSON.parse(content), name, version) };
+            case "pnpm":
+                return { format, edges: pnpmParents(content, name, version) };
+            case "yarn":
+            case "yarn-berry":
+                return { format, edges: yarnParents(content, name, version) };
+            case "bun":
+                return { format, edges: bunParents(JSON.parse(stripTrailingCommas(content)), name, version) };
+            case "cargo":
+                return { format, edges: cargoParents(content, name, version) };
+        }
+    }
+    catch {
+        return null;
+    }
+}
+/** Node's lookup from install path `from`: its own node_modules, then each ancestor's, then the root's. */
+function resolveInstallPath(packages, from, name) {
+    let dir = from;
+    for (;;) {
+        const candidate = `${dir ? `${dir}/` : ""}node_modules/${name}`;
+        if (candidate in packages)
+            return candidate;
+        if (dir === "")
+            return null;
+        const cut = dir.lastIndexOf("/node_modules/");
+        dir = cut >= 0 ? dir.slice(0, cut) : "";
+    }
+}
+export function packageLockParents(lock, name, version) {
+    const edges = [];
+    if (lock.packages && Object.keys(lock.packages).length > 0) {
+        const packages = lock.packages;
+        for (const [key, entry] of Object.entries(packages)) {
+            if (!entry || entry.link)
+                continue;
+            for (const field of DEP_FIELDS) {
+                const declared = entry[field];
+                const range = declared?.[name];
+                if (typeof range !== "string")
+                    continue;
+                const at = resolveInstallPath(packages, key, name);
+                if (!at || packages[at]?.version !== version)
+                    continue;
+                const local = !key.startsWith("node_modules/") && !key.includes("/node_modules/");
+                edges.push({
+                    parent: local ? entry.name ?? (key || lock.name || ".") : packageNameFromNodeModulesPath(key),
+                    parentVersion: local ? null : entry.version ?? null,
+                    range,
+                    local,
+                });
+                break;
+            }
+        }
+        return edges;
+    }
+    // v1: nested `dependencies` trees; each entry's `requires` names its ranges.
+    const walk = (deps, ancestors) => {
+        for (const [parentName, entry] of Object.entries(deps)) {
+            const nested = (entry.dependencies ?? {});
+            const range = entry.requires?.[name];
+            if (typeof range === "string") {
+                const scopes = [nested, ...ancestors];
+                const resolved = scopes.find((s) => s[name])?.[name];
+                if (resolved?.version === version) {
+                    edges.push({ parent: parentName, parentVersion: entry.version ?? null, range, local: false });
+                }
+            }
+            if (Object.keys(nested).length > 0)
+                walk(nested, [nested, ...ancestors]);
+        }
+    };
+    if (lock.dependencies)
+        walk(lock.dependencies, [lock.dependencies]);
+    return edges;
+}
+// ---------------------------------------------------------------------------
+// pnpm-lock.yaml (v5, v6, v9)
+// ---------------------------------------------------------------------------
+function exactVersion(raw) {
+    const unquoted = raw.trim().replace(/^['"]|['"]$/g, "");
+    const v = unquoted.split("(")[0].split("_")[0].trim();
+    return /^\d/.test(v) ? v : null;
+}
+/**
+ * Parents from `packages:` (v5/v6) or `snapshots:` (v9) entries whose
+ * dependency blocks resolve `name` to `version`. pnpm records resolved
+ * versions only, so `range` is null. Importers (the project's own manifests)
+ * become local edges with their `specifier` when the lockfile records one.
+ */
+export function pnpmParents(content, name, version) {
+    const edges = [];
+    const seen = new Set();
+    let section = "";
+    let parent = null;
+    let importer = null;
+    let inDeps = false;
+    let depIndent = -1;
+    let pendingImporterDep = false;
+    let importerSpecifier = null;
+    const add = (edge) => {
+        const key = `${edge.parent}\0${edge.parentVersion}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            edges.push(edge);
+        }
+    };
+    for (const line of content.split(/\r?\n/)) {
+        const text = line.trim();
+        if (text === "" || text.startsWith("#"))
+            continue;
+        const indent = line.length - line.trimStart().length;
+        if (indent === 0) {
+            section = text.endsWith(":") ? text.slice(0, -1) : "";
+            parent = null;
+            importer = section === "dependencies" || section === "devDependencies" || section === "optionalDependencies" ? "." : null;
+            inDeps = importer !== null;
+            depIndent = inDeps ? 2 : -1;
+            continue;
+        }
+        if (section === "packages" || section === "snapshots") {
+            if (indent === 2 && text.endsWith(":")) {
+                parent = parsePnpmKey(text.slice(0, -1));
+                inDeps = false;
+            }
+            else if (indent === 4 && parent) {
+                inDeps = /^(?:dependencies|optionalDependencies):$/.test(text);
+            }
+            else if (indent === 6 && parent && inDeps) {
+                const m = /^(?:'([^']+)'|"([^"]+)"|([^\s:'"]+)):\s*(.+)$/.exec(text);
+                if (m && (m[1] ?? m[2] ?? m[3]) === name && exactVersion(m[4]) === version) {
+                    add({ parent: parent[0], parentVersion: parent[1], range: null, local: false });
+                }
+            }
+            continue;
+        }
+        if (section === "importers") {
+            if (indent === 2 && text.endsWith(":")) {
+                importer = text.slice(0, -1).replace(/^['"]|['"]$/g, "");
+                inDeps = false;
+                continue;
+            }
+            if (indent === 4) {
+                inDeps = /^(?:dependencies|devDependencies|optionalDependencies):$/.test(text);
+                depIndent = 4;
+                continue;
+            }
+        }
+        if (!inDeps || importer === null)
+            continue;
+        // A dependency of the project itself: v5 `name: 1.2.3`, v6/v9 `name:` + `specifier:` + `version:`.
+        if (indent === depIndent + 2) {
+            const m = /^(?:'([^']+)'|"([^"]+)"|([^\s:'"]+)):(?:\s+(.*))?$/.exec(text);
+            pendingImporterDep = !!m && (m[1] ?? m[2] ?? m[3]) === name;
+            importerSpecifier = null;
+            if (pendingImporterDep && m?.[4] && exactVersion(m[4]) === version) {
+                add({ parent: importer, parentVersion: null, range: null, local: true });
+                pendingImporterDep = false;
+            }
+        }
+        else if (indent === depIndent + 4 && pendingImporterDep) {
+            const spec = /^specifier:\s*(.+)$/.exec(text);
+            if (spec)
+                importerSpecifier = spec[1].replace(/^['"]|['"]$/g, "");
+            const ver = /^version:\s*(.+)$/.exec(text);
+            if (ver && exactVersion(ver[1]) === version) {
+                add({ parent: importer, parentVersion: null, range: importerSpecifier, local: true });
+                pendingImporterDep = false;
+            }
+        }
+    }
+    return edges;
+}
+// ---------------------------------------------------------------------------
+// yarn.lock (v1 and berry)
+// ---------------------------------------------------------------------------
+const unquote = (s) => s.trim().replace(/^"|"$/g, "");
+function parseYarnBlocks(content) {
+    const blocks = [];
+    for (const block of content.split(/\r?\n(?=\S)/)) {
+        const lines = block.split(/\r?\n/);
+        const header = lines[0];
+        const name = /^"?(@?[^@\s"]+)@/.exec(header)?.[1];
+        if (!name || name.startsWith("__"))
+            continue;
+        const version = /^\s+version:?\s+"?([^"\s]+)"?\s*$/m.exec(block)?.[1];
+        if (!version)
+            continue;
+        const specs = header.replace(/:\s*$/, "").split(",").map((s) => unquote(s).replace(/@npm:/, "@"));
+        const deps = [];
+        let inDeps = false;
+        let depIndent = -1;
+        for (const line of lines.slice(1)) {
+            if (!line.trim())
+                continue;
+            const indent = line.length - line.trimStart().length;
+            const text = line.trim();
+            if (/^(?:dependencies|optionalDependencies):?$/.test(text)) {
+                inDeps = true;
+                depIndent = indent;
+                continue;
+            }
+            if (inDeps && indent > depIndent) {
+                // v1: `name "range"`; berry: `name: "npm:range"` or `"@scope/x": range`.
+                const m = /^"?((?:@[^\s"/]+\/)?[^\s":]+)"?:?\s+"?([^"]+?)"?\s*$/.exec(text);
+                if (m)
+                    deps.push([m[1], m[2]]);
+            }
+            else {
+                inDeps = false;
+            }
+        }
+        blocks.push({ name, version, specs, deps });
+    }
+    return blocks;
+}
+export function yarnParents(content, name, version) {
+    const blocks = parseYarnBlocks(content);
+    const resolved = new Map();
+    for (const b of blocks)
+        for (const spec of b.specs)
+            resolved.set(spec, b.version);
+    const edges = [];
+    for (const b of blocks) {
+        for (const [dep, rawRange] of b.deps) {
+            if (dep !== name)
+                continue;
+            const range = rawRange.replace(/^npm:/, "");
+            if (resolved.get(`${name}@${range}`) !== version)
+                continue;
+            edges.push({ parent: b.name, parentVersion: b.version, range, local: false });
+        }
+    }
+    return edges;
+}
+// ---------------------------------------------------------------------------
+// bun.lock
+// ---------------------------------------------------------------------------
+export function bunParents(lock, name, version) {
+    const packages = lock.packages ?? {};
+    const entryOf = (key) => {
+        const value = packages[key];
+        if (!Array.isArray(value) || typeof value[0] !== "string")
+            return null;
+        const at = value[0].lastIndexOf("@");
+        if (at <= 0)
+            return null;
+        const meta = value[2] && typeof value[2] === "object" ? value[2] : {};
+        return { name: value[0].slice(0, at), version: value[0].slice(at + 1), meta };
+    };
+    const segments = (key) => {
+        const parts = key.split("/");
+        const out = [];
+        for (let i = 0; i < parts.length; i++)
+            out.push(parts[i].startsWith("@") && i + 1 < parts.length ? `${parts[i]}/${parts[++i]}` : parts[i]);
+        return out;
+    };
+    const resolve = (fromKey) => {
+        const segs = segments(fromKey);
+        for (let n = segs.length; n > 0; n--) {
+            const candidate = [...segs.slice(0, n), name].join("/");
+            if (candidate in packages)
+                return candidate;
+        }
+        return name in packages ? name : null;
+    };
+    const edges = [];
+    for (const key of Object.keys(packages)) {
+        const e = entryOf(key);
+        if (!e)
+            continue;
+        const range = e.meta.dependencies?.[name] ?? e.meta.optionalDependencies?.[name] ?? e.meta.peerDependencies?.[name];
+        if (typeof range !== "string")
+            continue;
+        const at = resolve(key);
+        if (!at || entryOf(at)?.version !== version)
+            continue;
+        edges.push({ parent: e.name, parentVersion: e.version, range, local: false });
+    }
+    for (const [dir, ws] of Object.entries(lock.workspaces ?? {})) {
+        const range = ws.dependencies?.[name] ?? ws.devDependencies?.[name] ?? ws.optionalDependencies?.[name];
+        if (typeof range === "string" && entryOf(name)?.version === version) {
+            edges.push({ parent: dir || ".", parentVersion: null, range, local: true });
+        }
+    }
+    return edges;
+}
+// ---------------------------------------------------------------------------
+// Cargo.lock
+// ---------------------------------------------------------------------------
+/**
+ * Packages whose `dependencies` list this copy: "name" when only one version
+ * of it is in the lockfile, "name version" (optionally with a source) when
+ * several are. Cargo records no requirement, so `range` is null.
+ */
+export function cargoParents(content, name, version) {
+    const packages = parseCargoLockPackages(content);
+    const versionsOf = packages.filter((p) => p.name === name).map((p) => p.version);
+    const cargoWritten = packages.some((p) => p.source !== null);
+    const edges = [];
+    for (const pkg of packages) {
+        for (const dep of pkg.dependencies) {
+            const [depName, depVersion] = dep.split(" ");
+            if (depName !== name)
+                continue;
+            const resolved = depVersion ?? (versionsOf.length === 1 ? versionsOf[0] : null);
+            if (resolved !== version)
+                continue;
+            const local = cargoWritten && pkg.source === null;
+            edges.push({ parent: pkg.name, parentVersion: local ? null : pkg.version, range: null, local });
+        }
+    }
+    return edges;
+}

package/dist/live/lockfile-parsers-pygo.d.ts

@@ -17,7 +17,38 @@
 import { InstanceSet, type VersionSource } from "./lockfile-types.js";
 /** PEP 503 normalised name: lowercase, runs of `-`, `_`, `.` become one `-`. */
 export declare function normalizePythonName(name: string): string;
+/**
+ * Requirement files in a project directory: `*requirements*.txt` beside it
+ * (requirements-dev.txt, dev_requirements.txt, _test_minimum_requirements.txt)
+ * and every `.txt` in a `requirements/` folder (pip-compile-multi: superset
+ * keeps its 100 runtime pins in requirements/base.txt, which nothing read).
+ */
+export declare function requirementFiles(cwd: string): string[];
+/**
+ * Whether a requirements file is dev-only by name: requirements-dev.txt,
+ * dev-requirements.txt, requirements/testing.txt, _test_minimum_requirements.txt,
+ * docs-requirements.txt. The convention is near universal, but it is a name:
+ * a package any other file also lists keeps an unknown scope, never "dev".
+ */
+export declare function devRequirementsFile(file: string): boolean;
+/**
+ * Every Python source in a directory, merged: poetry.lock, uv.lock, pdm.lock,
+ * Pipfile.lock AND the requirement files. One source per ecosystem dropped
+ * whatever sat beside the first: langchain's libs/community has a
+ * poetry.lock and _test_minimum_requirements.txt, and only the lock was read.
+ * The version a direct dependency resolves to comes from a lockfile first.
+ */
 export declare function resolvePython(cwd: string): VersionSource;
+/**
+ * Exact pins from one requirements file, following `-r`/`--requirement`
+ * includes (relative to the file) and applying `-c`/`--constraint` files:
+ * a constraints file installs nothing by itself, so its pins only give a
+ * version to a name the requirements list without one. Null when unreadable.
+ */
+export declare function readRequirementsFile(file: string, visited?: Set<string>): Array<{
+    name: string;
+    version: string;
+}> | null;
 /**
  * [[package]] tables from poetry.lock (any version) or uv.lock. A pre-1.2
  * poetry.lock records `category = "dev"` for dev-only packages; newer files