@wardby/cli 0.6.0 → 0.8.0

package/dist/coding/registry/pypi-plan.js

@@ -0,0 +1,406 @@
+/**
+ * PyPI lockfile verification hooks (`POST /registry/pypi/-/plan`): parsing a
+ * `uv.lock` or a pinned requirements file (`pip-compile`, `uv pip compile`,
+ * `pip freeze`) into entries, and reading each pinned release's facts from
+ * PyPI's JSON API. Nothing here decides anything: the registry core verifies
+ * every claim against these registry reads (plan.ts).
+ *
+ * Approvals are names (`approves: "names"`): a release has many files, and
+ * every download keeps the usual per-file checks (wheels only, per-file
+ * release age, the index's sha256). No lockfile integrity is compared
+ * (`integrity: "registry"`); pip and uv check the hashes a lockfile records
+ * themselves.
+ *
+ * Kept free of imports from pypi.ts, which imports this module.
+ */
+import { eq as pepEq, satisfies as pepSatisfies, valid as pepValid } from "@renovatebot/pep440";
+import { parse as parseToml } from "smol-toml";
+import { badRequest, tooLarge } from "./lockfile-shared.js";
+import { followedLines, isPypiProjectName, normalizePypiName, requirementLine, } from "./pypi-requirements.js";
+import { RegistryError, } from "./types.js";
+const JSON_API = "https://pypi.org/pypi/";
+/** The index URLs a registry package in a uv.lock may name (besides the proxy's own). */
+const PUBLIC_INDEXES = ["https://pypi.org/simple", "https://pypi.org/simple/"];
+/** The most dependency lines read from one release. */
+const MAX_REQUIRES_DIST = 2000;
+function unsupported(message) {
+    return new RegistryError(400, "wardby_lockfile_unsupported", message);
+}
+/** A registry entry for `name==version`, or an unsupported one when either is not valid. */
+function entryOf(name, version) {
+    const path = `${normalizePypiName(name)}@${version}`;
+    if (!isPypiProjectName(name) || pepValid(version) === null)
+        return {
+            path,
+            name,
+            version,
+            integrity: null,
+            kind: "unsupported",
+            unsupportedReason: "not a valid Python project name and exact version",
+        };
+    return { path, name: normalizePypiName(name), version, integrity: null, kind: "registry" };
+}
+function unsupportedEntry(name, version, reason) {
+    const normalized = isPypiProjectName(name) ? normalizePypiName(name) : name;
+    return {
+        path: `${normalized}@${version}`,
+        name: normalized,
+        version,
+        integrity: null,
+        kind: "unsupported",
+        unsupportedReason: reason,
+    };
+}
+/** Entries by name, for a lockfile with no per-parent pins (a requirements file). */
+function byName(entries) {
+    const names = new Map();
+    for (const entry of entries)
+        names.set(entry.name, [...(names.get(entry.name) ?? []), entry]);
+    return names;
+}
+// --- requirements files ------------------------------------------------------
+/** One logical line of a requirements file: continuations joined, the comment removed. */
+function logicalLines(body) {
+    const lines = [];
+    let pending = "";
+    for (const raw of body.split(/\r?\n/)) {
+        const line = raw.trimEnd();
+        if (line.endsWith("\\")) {
+            pending += `${line.slice(0, -1)} `;
+            continue;
+        }
+        lines.push(pending + line);
+        pending = "";
+    }
+    if (pending)
+        lines.push(pending);
+    // A comment starts at a `#` at the line's start or after whitespace (pip's rule).
+    return lines.map((line) => line.replace(/(^|\s)#.*$/, "").trim()).filter((line) => line !== "");
+}
+/** The requirement part of a line: everything before its first per-requirement option (`--hash=…`). */
+function requirementPart(line) {
+    const option = line.search(/\s--?[A-Za-z]/);
+    return (option === -1 ? line : line.slice(0, option)).trim();
+}
+const PINNED = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*(.*)$/;
+/**
+ * A pinned requirements file: every `name==version` (or `===`) line is an
+ * entry; a direct reference (`name @ url`) is an unsupported one. Options
+ * (`-r`, `-c`, `--index-url`, …), editable or local projects and unpinned
+ * lines are not entries: pip resolves those the usual way. The file records
+ * no dependency graph, so a parent's dependency resolves to every entry of
+ * that name (marker-split pins).
+ */
+export function parseRequirements(body, maxEntries) {
+    const entries = [];
+    for (const line of logicalLines(body)) {
+        if (line.startsWith("-"))
+            continue;
+        const requirement = requirementPart(line);
+        const match = requirement.match(PINNED);
+        if (!match)
+            continue;
+        const name = match[1];
+        const spec = match[2].split(";")[0].trim();
+        if (spec.startsWith("@")) {
+            entries.push(unsupportedEntry(name, "url", "installed from a URL, not the package registry"));
+            continue;
+        }
+        const pin = spec.match(/^===?\s*([^\s,;*]+)$/);
+        if (!pin)
+            continue;
+        entries.push(entryOf(name, pin[1]));
+        if (entries.length > maxEntries)
+            throw tooLarge(entries.length, maxEntries);
+    }
+    const unique = [...new Map(entries.map((entry) => [entry.path, entry])).values()];
+    const names = byName(unique);
+    return {
+        entries: unique,
+        projects: [],
+        integrity: "registry",
+        resolve: (_from, key) => names.get(key)?.[0],
+        resolveAll: (_from, key) => names.get(key) ?? [],
+    };
+}
+/** Every `{ name, version? }` a package's dependency lists name (all groups and extras). */
+function lockDependencies(pkg) {
+    const lists = [pkg.dependencies];
+    for (const field of ["optional-dependencies", "dev-dependencies"]) {
+        const groups = pkg[field];
+        if (groups && typeof groups === "object" && !Array.isArray(groups))
+            lists.push(...Object.values(groups));
+    }
+    const out = [];
+    for (const list of lists) {
+        if (!Array.isArray(list))
+            continue;
+        for (const item of list) {
+            if (typeof item?.name !== "string" || !isPypiProjectName(item.name))
+                continue;
+            out.push({
+                name: normalizePypiName(item.name),
+                ...(typeof item.version === "string" ? { version: item.version } : {}),
+            });
+        }
+    }
+    return out;
+}
+/**
+ * A uv.lock (`version = 1`). A package from PyPI (or the proxy) is an
+ * entry; the lock's own projects (editable, virtual and directory sources)
+ * are its projects; one from git, a URL, a path or another index is
+ * unsupported. A dependency resolves to the version the lock names for it
+ * when the lock pins the name at several versions.
+ */
+export function parseUvLock(body, maxEntries, proxyRegistryUrl) {
+    let doc;
+    try {
+        doc = parseToml(body);
+    }
+    catch {
+        throw badRequest("the uv.lock is not valid TOML");
+    }
+    if (doc.version !== 1)
+        throw unsupported(`uv.lock version ${String(doc.version)} is not supported (version 1 is)`);
+    const packages = Array.isArray(doc.package) ? doc.package : [];
+    if (packages.length > maxEntries)
+        throw tooLarge(packages.length, maxEntries);
+    const indexes = new Set([...PUBLIC_INDEXES, `${proxyRegistryUrl}simple`, `${proxyRegistryUrl}simple/`]);
+    const entries = [];
+    const projects = [];
+    const pins = new Map();
+    for (const pkg of packages) {
+        if (typeof pkg?.name !== "string")
+            throw badRequest("a uv.lock package has no name");
+        const name = pkg.name;
+        const version = typeof pkg.version === "string" ? pkg.version : "";
+        const source = pkg.source && typeof pkg.source === "object" ? pkg.source : {};
+        const dependencies = lockDependencies(pkg);
+        const path = `${isPypiProjectName(name) ? normalizePypiName(name) : name}@${version}`;
+        pins.set(path, new Map(dependencies.map((dependency) => [dependency.name, dependency.version])));
+        if ("editable" in source || "virtual" in source || "directory" in source) {
+            projects.push({
+                path,
+                dependencies: dependencies.map((dependency) => ({ key: dependency.name, name: dependency.name, range: "*" })),
+            });
+            continue;
+        }
+        if (typeof source.registry !== "string") {
+            entries.push(unsupportedEntry(name, version, "installed from git, a URL or a path, not the package registry"));
+            continue;
+        }
+        if (!indexes.has(source.registry)) {
+            entries.push(unsupportedEntry(name, version, "locked from another package index"));
+            continue;
+        }
+        entries.push(entryOf(name, version));
+    }
+    const names = byName(entries);
+    const resolve = (from, key) => {
+        const candidates = names.get(key);
+        if (!candidates || candidates.length <= 1)
+            return candidates?.[0];
+        const pinned = pins.get(from)?.get(key);
+        return pinned === undefined ? candidates[0] : candidates.find((entry) => entry.version === pinned);
+    };
+    return { entries, projects, integrity: "registry", resolve };
+}
+// --- format detection ----------------------------------------------------------
+/** Which file a plan body is: a uv.lock, a requirements file, or one this registry cannot verify. */
+export function parsePypiLockfile(body, options) {
+    const text = body.startsWith("") ? body.slice(1) : body;
+    if (/^# This file is automatically @generated by Poetry/m.test(text) || /^content-hash\s*=/m.test(text))
+        throw unsupported("Poetry lockfiles are not verified; install from a requirements file or uv.lock instead");
+    if (/^lock-version\s*=/m.test(text))
+        throw unsupported("pylock.toml files are not verified; install from a requirements file or uv.lock instead");
+    if (/^\[\[package\]\]\s*$/m.test(text) || /^version\s*=\s*\d+\s*$/m.test(text))
+        return parseUvLock(text, options.maxEntries, options.proxyRegistryUrl);
+    return parseRequirements(text, options.maxEntries);
+}
+/** The release's wheels PyPI still serves, each with its upload time and sha256. */
+function wheelsOf(urls) {
+    if (!Array.isArray(urls))
+        return [];
+    return urls.flatMap((file) => {
+        if (file?.packagetype !== "bdist_wheel" || file.yanked === true)
+            return [];
+        if (typeof file.filename !== "string" || !file.filename.endsWith(".whl") || typeof file.url !== "string")
+            return [];
+        const sha256 = typeof file.digests?.sha256 === "string" ? file.digests.sha256 : "";
+        const time = typeof file.upload_time_iso_8601 === "string" ? Date.parse(file.upload_time_iso_8601) : NaN;
+        return [{ url: file.url, sha256, uploadedAt: Number.isNaN(time) ? null : new Date(time) }];
+    });
+}
+/** The earliest upload among `wheels`, or null when none records one. */
+function earliest(wheels) {
+    const times = wheels.flatMap((wheel) => (wheel.uploadedAt ? [wheel.uploadedAt.getTime()] : []));
+    return times.length === 0 ? null : new Date(Math.min(...times));
+}
+async function fetchRelease(name, version, upstream, signal) {
+    const response = await upstream(`${JSON_API}${encodeURIComponent(name)}/${encodeURIComponent(version)}/json`, {
+        accept: "application/json",
+        signal,
+    });
+    if (response.status === 404) {
+        await response.body?.cancel().catch(() => undefined);
+        return null;
+    }
+    if (!response.ok)
+        throw new RegistryError(502, "wardby_upstream_error", `PyPI returned ${response.status}`);
+    const doc = (await response.json());
+    if (!doc.info || typeof doc.info !== "object")
+        return null;
+    const info = doc.info;
+    // The release must be exactly the one the lockfile pins.
+    if (typeof info.name !== "string" || normalizePypiName(info.name) !== name)
+        return null;
+    if (typeof info.version !== "string" || !safeEq(info.version, version))
+        return null;
+    return { info, urls: doc.urls };
+}
+function safeEq(a, b) {
+    try {
+        return pepEq(a, b);
+    }
+    catch {
+        return a === b;
+    }
+}
+/** One release's facts: its dependency lines (with their extras and extra
+ *  gates), and its earliest wheel's upload time, URL and sha256. A release
+ *  with no wheel is refused (`wardby_file_not_allowed`): nothing in it may
+ *  be installed. */
+export async function fetchPypiVersionFact(name, version, upstream, signal) {
+    const release = await fetchRelease(name, version, upstream, signal);
+    if (!release)
+        return null;
+    const wheels = wheelsOf(release.urls);
+    if (wheels.length === 0)
+        throw new RegistryError(403, "wardby_file_not_allowed", `${name} ${version} has no wheel on PyPI (only a source distribution), and only wheels are installed`);
+    const publishedAt = earliest(wheels);
+    const first = wheels.find((wheel) => wheel.uploadedAt?.getTime() === publishedAt?.getTime()) ?? wheels[0];
+    const lines = Array.isArray(release.info.requires_dist) ? release.info.requires_dist.slice(0, MAX_REQUIRES_DIST) : [];
+    const dependencies = [];
+    for (const value of lines) {
+        const line = typeof value === "string" ? requirementLine(value.trim()) : null;
+        if (!line || line.range === null)
+            continue;
+        dependencies.push({
+            key: line.name,
+            name: line.name,
+            range: line.range,
+            ...(line.extras.length > 0 ? { extras: line.extras } : {}),
+            ...(line.gate !== null ? { when: line.gate } : {}),
+        });
+    }
+    return {
+        name,
+        version,
+        publishedAt,
+        integrity: /^[0-9a-f]{64}$/.test(first.sha256)
+            ? `sha256-${Buffer.from(first.sha256, "hex").toString("base64")}`
+            : "",
+        downloadUrl: first.url,
+        dependencies,
+    };
+}
+/** Publish times for releases whose fact carried none (no wheel recorded an upload time). */
+export async function fetchPypiPublishTimes(name, versions, upstream, options) {
+    const times = new Map();
+    for (const version of versions) {
+        const release = await fetchRelease(name, version, upstream, options.signal);
+        const time = release ? earliest(wheelsOf(release.urls)) : null;
+        if (time)
+            times.set(version, time);
+    }
+    return times;
+}
+/** Whether a locked version is inside a dependency line's specifier, a
+ *  pinned pre-release included. */
+export function pypiEdgeSatisfies(version, range) {
+    if (range === "*" || range === "")
+        return true;
+    try {
+        return pepSatisfies(version, range, { prereleases: true });
+    }
+    catch {
+        return false;
+    }
+}
+/** The dependencies a release installed with `extras` follows, under the
+ *  same extras policy as the graph walk (pypi-requirements.ts). */
+export function pypiDependenciesOf(fact, extras) {
+    const lines = fact.dependencies.map((dependency) => ({
+        name: dependency.name,
+        extras: [...(dependency.extras ?? [])],
+        gate: dependency.when ? [...dependency.when] : null,
+        range: dependency.range,
+    }));
+    const followed = followedLines(fact.name, lines, extras);
+    return followed.lines.map((line) => ({
+        key: line.name,
+        name: line.name,
+        range: line.range ?? "*",
+        ...(!followed.plain && line.extras.length > 0 ? { extras: line.extras } : {}),
+    }));
+}
+export const pypiLockfilePlan = {
+    approves: "names",
+    parse: parsePypiLockfile,
+    fetchVersionFact: fetchPypiVersionFact,
+    fetchPublishTimes: fetchPypiPublishTimes,
+    edgeSatisfies: pypiEdgeSatisfies,
+    dependenciesOf: pypiDependenciesOf,
+};
+// --- uv.lock URLs ----------------------------------------------------------------
+/** PyPI's own path for a file by project and filename, which redirects to the
+ *  file (a wheel's python tag, or `source` for an sdist). */
+export function publicFileUrl(name, filename) {
+    if (!isPypiProjectName(name) || !/^[A-Za-z0-9._+!-]+$/.test(filename))
+        return undefined;
+    let tag = "source";
+    if (filename.endsWith(".whl")) {
+        const parts = filename.slice(0, -".whl".length).split("-");
+        if (parts.length < 5)
+            return undefined;
+        tag = parts[parts.length - 3];
+    }
+    else if (!/\.(?:tar\.gz|zip)$/.test(filename))
+        return undefined;
+    return `https://files.pythonhosted.org/packages/${tag}/${name[0]}/${name}/${filename}`;
+}
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function decodedOrUndefined(text) {
+    try {
+        return decodeURIComponent(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * A uv.lock with the proxy's URLs (which uv records when it locks through
+ * the proxy) put back to PyPI's: its index as `https://pypi.org/simple`, each
+ * file as PyPI's redirecting path (publicFileUrl). Credentials are never in
+ * them (uv records none), but any userinfo before the proxy host is dropped
+ * with the URL anyway. Everything else is left exactly as it was.
+ */
+export function normalizeUvLock(content, registryUrl) {
+    const at = registryUrl.indexOf("://");
+    if (at < 0)
+        return content;
+    const scheme = escapeRegExp(registryUrl.slice(0, at + 3));
+    const rest = escapeRegExp(registryUrl.slice(at + 3));
+    const base = `${scheme}(?:[^@/"\\s]*@)?${rest}`;
+    return content
+        .replace(new RegExp(`"${base}simple/?"`, "g"), `"${PUBLIC_INDEXES[0]}"`)
+        .replace(new RegExp(`"${base}files/([^/"]+)/([^/"]+)"`, "g"), (match, rawName, rawFile) => {
+        const name = decodedOrUndefined(rawName);
+        const filename = decodedOrUndefined(rawFile);
+        const url = name && filename ? publicFileUrl(name, filename) : undefined;
+        return url ? `"${url}"` : match;
+    });
+}

package/dist/coding/registry/pypi-requirements.d.ts

@@ -0,0 +1,58 @@
+/**
+ * PyPI dependency lines (PEP 508 requirements as wheel METADATA and PyPI's
+ * `requires_dist` write them) and the extras policy both the graph walk and
+ * lockfile verification follow. Kept free of imports from pypi.ts, which
+ * imports this module.
+ */
+import type { FileDependency } from "./types.js";
+/** The most extras one allowlist entry or dependency line may name. */
+export declare const MAX_EXTRAS = 32;
+export declare function isPypiProjectName(name: string): boolean;
+export declare function normalizePypiName(name: string): string;
+/** Normalized (PEP 685), sorted, de-duplicated extras from the text inside
+ *  `[...]`, or null when any is not a valid extra name (PEP 508: the same
+ *  shape as a project name), the list is empty, or it names too many. */
+export declare function parseExtras(list: string): string[] | null;
+export interface RequirementLine {
+    name: string;
+    extras: string[];
+    /** The extras the line is gated on; null when it is not extra-gated. */
+    gate: string[] | null;
+    /** The PEP 440 specifier the line asks for (`"*"` for none); null for a
+     *  direct reference (`name @ url`), which is never a registry edge. */
+    range: string | null;
+}
+/** One Requires-Dist value (`uvicorn[standard] (>=0.30) ; extra == "web"`),
+ *  split only at its first `;` (the marker), which is all wheel METADATA and
+ *  PyPI's `requires_dist` need: no `name @ url` with a `;` in the URL, no
+ *  comments or line continuations as in a requirements file. Null when it
+ *  names no valid project. */
+export declare function requirementLine(value: string): RequirementLine | null;
+/**
+ * The lines an install of the package `self` with `extras` follows: every
+ * line without an `extra == "…"` marker clause, plus the lines whose marker
+ * names one of the install's extras (other marker clauses are ignored, so a
+ * requested extra's lines are included on every platform). A line gated on
+ * any other extra is skipped. A line naming the package itself
+ * (`celery[redis]; extra == "all"`) adds those extras to this install
+ * instead, and is not returned. `plain`: the install has no extras, so its
+ * dependencies are installed bare.
+ */
+export declare function followedLines(self: string | null, lines: readonly RequirementLine[], extras: readonly string[]): {
+    lines: RequirementLine[];
+    plain: boolean;
+};
+/**
+ * The dependencies a wheel's METADATA declares for an install of the package
+ * with `extras` (see `followedLines`). Each dependency carries the extras its
+ * line asks of it (`uvicorn[standard]`). Names and extras are validated and
+ * normalized.
+ *
+ * Policy, not pip: a plain install (no `extras`) follows no extras at all,
+ * neither its own (a self-referencing line) nor its dependencies' — each
+ * dependency comes back bare, so extras are followed only along a chain that
+ * starts at an allowlist entry naming extras.
+ */
+export declare function requiredDists(metadataText: string, extras?: readonly string[]): FileDependency[];
+/** Dependency names a METADATA declares for a plain install (no extras). */
+export declare function requiresDist(metadataText: string): string[];

package/dist/coding/registry/pypi-requirements.js

@@ -0,0 +1,155 @@
+/** The most extras one allowlist entry or dependency line may name. */
+export const MAX_EXTRAS = 32;
+/** A valid PyPI project name (PEP 508): ASCII letters and digits, with
+ *  `.`, `_` and `-` allowed only between them. */
+const PROJECT_NAME = /^(?:[A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9._-]*[A-Za-z0-9])$/;
+export function isPypiProjectName(name) {
+    return PROJECT_NAME.test(name);
+}
+export function normalizePypiName(name) {
+    return name.toLowerCase().replace(/[-_.]+/g, "-");
+}
+/** Normalized (PEP 685), sorted, de-duplicated extras from the text inside
+ *  `[...]`, or null when any is not a valid extra name (PEP 508: the same
+ *  shape as a project name), the list is empty, or it names too many. */
+export function parseExtras(list) {
+    const items = list.split(",").map((item) => item.trim());
+    if (items.length > MAX_EXTRAS || items.some((item) => !PROJECT_NAME.test(item)))
+        return null;
+    return [...new Set(items.map(normalizePypiName))].sort();
+}
+/** The string literals a marker compares `extra` to with `==` or `===`
+ *  (either operand order), normalized; null when the marker never mentions
+ *  `extra`. Tokenized, so a quoted value never counts as a clause. Fails
+ *  closed: when `extra` appears in any shape this does not fully recognise
+ *  (`extra in "a b"`, `extra.x`, a bare `extra`, an unbalanced quote), the
+ *  line is gated on no extra at all, so it is never followed. */
+function markerExtras(marker) {
+    if (!/\bextra\b/.test(marker))
+        return null;
+    const tokens = marker.match(/"[^"]*"|'[^']*'|===|==|!=|<=|>=|~=|[A-Za-z_][A-Za-z0-9_.]*|\S/g) ?? [];
+    const isLiteral = (token) => token !== undefined && token.length >= 2 && (token[0] === '"' || token[0] === "'");
+    const isEquals = (token) => token === "==" || token === "===";
+    // A lone quote (unterminated string) means the marker cannot be read.
+    if (tokens.some((token) => token === '"' || token === "'"))
+        return [];
+    const found = [];
+    let recognised = 0;
+    for (let i = 0; i < tokens.length; i++) {
+        if (tokens[i] !== "extra")
+            continue;
+        let value = null;
+        if (isEquals(tokens[i + 1]) && isLiteral(tokens[i + 2]))
+            value = tokens[i + 2].slice(1, -1);
+        else if (isEquals(tokens[i - 1]) && isLiteral(tokens[i - 2]))
+            value = tokens[i - 2].slice(1, -1);
+        if (value === null)
+            return [];
+        recognised++;
+        if (PROJECT_NAME.test(value))
+            found.push(normalizePypiName(value));
+    }
+    // `extra` only inside quoted values: not a clause, but not one this reads either.
+    return recognised === 0 ? [] : found;
+}
+const REQUIREMENT = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[([^\]]*)\])?/;
+/** One Requires-Dist value (`uvicorn[standard] (>=0.30) ; extra == "web"`),
+ *  split only at its first `;` (the marker), which is all wheel METADATA and
+ *  PyPI's `requires_dist` need: no `name @ url` with a `;` in the URL, no
+ *  comments or line continuations as in a requirements file. Null when it
+ *  names no valid project. */
+export function requirementLine(value) {
+    const match = value.match(REQUIREMENT);
+    if (!match || !PROJECT_NAME.test(match[1]))
+        return null;
+    const semicolon = value.indexOf(";", match[0].length);
+    const spec = (semicolon === -1 ? value.slice(match[0].length) : value.slice(match[0].length, semicolon)).trim();
+    const bare = spec.startsWith("(") && spec.endsWith(")") ? spec.slice(1, -1).trim() : spec;
+    return {
+        name: normalizePypiName(match[1]),
+        // A malformed extras list still installs the package, just none of its extras.
+        extras: match[2] === undefined ? [] : (parseExtras(match[2]) ?? []),
+        gate: semicolon === -1 ? null : markerExtras(value.slice(semicolon + 1)),
+        range: bare.startsWith("@") ? null : bare === "" ? "*" : bare,
+    };
+}
+function requirementLines(metadataText) {
+    let self = null;
+    const lines = [];
+    for (const line of metadataText.split(/\r?\n/)) {
+        // The headers end at the first truly empty line; the description
+        // follows. A whitespace-only line is a folded header's continuation.
+        if (line === "")
+            break;
+        if (line.startsWith("Name:")) {
+            const name = line.slice("Name:".length).trim();
+            if (self === null && PROJECT_NAME.test(name))
+                self = normalizePypiName(name);
+            continue;
+        }
+        if (!line.startsWith("Requires-Dist:"))
+            continue;
+        const parsed = requirementLine(line.slice("Requires-Dist:".length).trim());
+        if (parsed)
+            lines.push(parsed);
+    }
+    return { self, lines };
+}
+/**
+ * The lines an install of the package `self` with `extras` follows: every
+ * line without an `extra == "…"` marker clause, plus the lines whose marker
+ * names one of the install's extras (other marker clauses are ignored, so a
+ * requested extra's lines are included on every platform). A line gated on
+ * any other extra is skipped. A line naming the package itself
+ * (`celery[redis]; extra == "all"`) adds those extras to this install
+ * instead, and is not returned. `plain`: the install has no extras, so its
+ * dependencies are installed bare.
+ */
+export function followedLines(self, lines, extras) {
+    const requested = new Set(extras.map(normalizePypiName));
+    const plain = requested.size === 0;
+    const included = (line) => line.gate === null || line.gate.some((extra) => requested.has(extra));
+    for (let grew = !plain; grew;) {
+        grew = false;
+        for (const line of lines) {
+            if (line.name !== self || !included(line))
+                continue;
+            for (const extra of line.extras) {
+                if (requested.size >= MAX_EXTRAS || requested.has(extra))
+                    continue;
+                requested.add(extra);
+                grew = true;
+            }
+        }
+    }
+    return { lines: lines.filter((line) => line.name !== self && included(line)), plain };
+}
+/**
+ * The dependencies a wheel's METADATA declares for an install of the package
+ * with `extras` (see `followedLines`). Each dependency carries the extras its
+ * line asks of it (`uvicorn[standard]`). Names and extras are validated and
+ * normalized.
+ *
+ * Policy, not pip: a plain install (no `extras`) follows no extras at all,
+ * neither its own (a self-referencing line) nor its dependencies' — each
+ * dependency comes back bare, so extras are followed only along a chain that
+ * starts at an allowlist entry naming extras.
+ */
+export function requiredDists(metadataText, extras = []) {
+    const { self, lines } = requirementLines(metadataText);
+    const followed = followedLines(self, lines, extras);
+    const out = new Map();
+    for (const line of followed.lines) {
+        const merged = out.get(line.name) ?? new Set();
+        if (!followed.plain)
+            for (const extra of line.extras)
+                if (merged.size < MAX_EXTRAS)
+                    merged.add(extra);
+        out.set(line.name, merged);
+    }
+    return [...out].map(([name, merged]) => ({ name, extras: [...merged].sort() }));
+}
+/** Dependency names a METADATA declares for a plain install (no extras). */
+export function requiresDist(metadataText) {
+    return requiredDists(metadataText).map((dependency) => dependency.name);
+}

package/dist/coding/registry/pypi.d.ts

@@ -1,28 +1,4 @@
-import { type FileDependency, type RegistryAdapter } from "./types.js";
-/** The most extras one allowlist entry or dependency line may name. */
-export declare const MAX_EXTRAS = 32;
-export declare function isPypiProjectName(name: string): boolean;
-export declare function normalizePypiName(name: string): string;
-/** Normalized (PEP 685), sorted, de-duplicated extras from the text inside
- *  `[...]`, or null when any is not a valid extra name (PEP 508: the same
- *  shape as a project name), the list is empty, or it names too many. */
-export declare function parseExtras(list: string): string[] | null;
-/**
- * The dependencies a wheel's METADATA declares for an install of the package
- * with `extras`: every line without an `extra == "…"` marker clause, plus the
- * lines whose marker names one of `extras` (other marker clauses are ignored,
- * so a requested extra's lines are included on every platform). A line gated
- * on any other extra is skipped. Each dependency carries the extras its line
- * asks of it (`uvicorn[standard]`); a line naming the package itself
- * (`celery[redis]; extra == "all"`) adds those extras to this install
- * instead. Names and extras are validated and normalized.
- *
- * Policy, not pip: a plain install (no `extras`) follows no extras at all,
- * neither its own (a self-referencing line) nor its dependencies' — each
- * dependency comes back bare, so extras are followed only along a chain that
- * starts at an allowlist entry naming extras.
- */
-export declare function requiredDists(metadataText: string, extras?: readonly string[]): FileDependency[];
-/** Dependency names a METADATA declares for a plain install (no extras). */
-export declare function requiresDist(metadataText: string): string[];
+import { isPypiProjectName, MAX_EXTRAS, normalizePypiName, parseExtras, requiredDists, requiresDist } from "./pypi-requirements.js";
+import { type RegistryAdapter } from "./types.js";
+export { isPypiProjectName, MAX_EXTRAS, normalizePypiName, parseExtras, requiredDists, requiresDist };
 export declare const pypiAdapter: RegistryAdapter;