iamsecure 0.0.0-stage → 0.1.0

package/src/code/strip.js

@@ -0,0 +1,51 @@
+/**
+ * Blank out comments while keeping strings, line numbers and column positions intact,
+ * so rules never fire on commented-out code.
+ * @param {string} text
+ * @param {'js'|'php'|'py'} lang
+ * @param {{blankStrings?: boolean}} [opts] also blank the contents of string literals (quotes are kept)
+ */
+export function stripComments(text, lang = 'js', { blankStrings = false } = {}) {
+  const out = text.split('');
+  const blank = (from, to) => {
+    for (let k = from; k < to; k++) if (out[k] !== '\n') out[k] = ' ';
+  };
+  const lineComment = lang === 'py' ? ['#'] : lang === 'php' ? ['//', '#'] : ['//'];
+  const quotes = lang === 'js' ? '\'"`' : '\'"';
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    if (quotes.includes(ch)) {
+      // Python triple-quoted strings.
+      const triple = lang === 'py' && text.startsWith(ch.repeat(3), i);
+      const end = triple ? ch.repeat(3) : ch;
+      let j = i + end.length;
+      while (j < text.length && !text.startsWith(end, j)) {
+        if (text[j] === '\\') j++;
+        else if (!triple && ch !== '`' && text[j] === '\n') break;
+        j++;
+      }
+      if (blankStrings) blank(i + end.length, Math.min(j, text.length));
+      i = j + end.length;
+      continue;
+    }
+    if (lang !== 'py' && text.startsWith('/*', i)) {
+      const j = text.indexOf('*/', i + 2);
+      const stop = j === -1 ? text.length : j + 2;
+      blank(i, stop);
+      i = stop;
+      continue;
+    }
+    const lc = lineComment.find((c) => text.startsWith(c, i));
+    // `//` right after ':' is a URL, not a comment (http://…).
+    if (lc && !(lc === '//' && text[i - 1] === ':')) {
+      const j = text.indexOf('\n', i);
+      const stop = j === -1 ? text.length : j;
+      blank(i, stop);
+      i = stop;
+      continue;
+    }
+    i++;
+  }
+  return out.join('');
+}

package/src/deps/cvss.js

@@ -0,0 +1,59 @@
+// CVSS v3.x base score calculator (spec: https://www.first.org/cvss/v3.1/specification-document).
+// For v4 vectors we only parse the metrics; the score then comes from the advisory's label.
+
+const W = {
+  AV: { N: 0.85, A: 0.62, L: 0.55, P: 0.2 },
+  AC: { L: 0.77, H: 0.44 },
+  UI: { N: 0.85, R: 0.62 },
+  CIA: { H: 0.56, L: 0.22, N: 0 },
+  PR_U: { N: 0.85, L: 0.62, H: 0.27 },
+  PR_C: { N: 0.85, L: 0.68, H: 0.5 },
+};
+
+function roundUp(x) {
+  const i = Math.round(x * 100000);
+  return i % 10000 === 0 ? i / 100000 : (Math.floor(i / 10000) + 1) / 10;
+}
+
+export function parseVector(vector) {
+  const metrics = {};
+  for (const part of String(vector).split('/')) {
+    const [k, v] = part.split(':');
+    if (k && v) metrics[k] = v;
+  }
+  return metrics;
+}
+
+/** @returns {{version:string, score:number|null, metrics:Record<string,string>}} */
+export function cvssScore(vector) {
+  const m = parseVector(vector);
+  const version = m.CVSS ?? '';
+  if (!version.startsWith('3')) return { version, score: null, metrics: m };
+  const scopeChanged = m.S === 'C';
+  const [C, I, A] = [W.CIA[m.C], W.CIA[m.I], W.CIA[m.A]];
+  const PR = (scopeChanged ? W.PR_C : W.PR_U)[m.PR];
+  if ([W.AV[m.AV], W.AC[m.AC], W.UI[m.UI], PR, C, I, A].some((x) => x === undefined)) {
+    return { version, score: null, metrics: m };
+  }
+  const iss = 1 - (1 - C) * (1 - I) * (1 - A);
+  const impact = scopeChanged ? 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15) : 6.42 * iss;
+  const exploitability = 8.22 * W.AV[m.AV] * W.AC[m.AC] * PR * W.UI[m.UI];
+  if (impact <= 0) return { version, score: 0, metrics: m };
+  const raw = scopeChanged ? 1.08 * (impact + exploitability) : impact + exploitability;
+  return { version, score: roundUp(Math.min(raw, 10)), metrics: m };
+}
+
+export const LEVELS = ['critical', 'high', 'medium', 'low', 'none'];
+
+export function levelFromScore(score) {
+  if (score >= 9) return 'critical';
+  if (score >= 7) return 'high';
+  if (score >= 4) return 'medium';
+  if (score > 0) return 'low';
+  return 'none';
+}
+
+/** Representative score for advisories that only carry a label. */
+export function scoreFromLabel(label) {
+  return { CRITICAL: 9.5, HIGH: 8, MODERATE: 5.5, MEDIUM: 5.5, LOW: 2.5 }[String(label).toUpperCase()] ?? null;
+}

package/src/deps/graph.js

@@ -0,0 +1,88 @@
+/**
+ * Resolved dependency graph for one lockfile. Nodes are unique name@version pairs;
+ * roots are the dependencies declared in package.json (or a workspace's package.json).
+ */
+export class DepGraph {
+  constructor(ecosystem, lockfile) {
+    this.ecosystem = ecosystem;
+    this.lockfile = lockfile;
+    /** @type {Map<string, {key:string,name:string,version:string,local:boolean,deps:Set<string>,prod?:boolean,direct?:boolean,parent?:string|null,depth?:number,reachedBy?:Set<string>}>} */
+    this.nodes = new Map();
+    /** @type {{name:string,key:string,dev:boolean,workspace:string}[]} */
+    this.roots = [];
+  }
+
+  addNode(name, version, { local = false } = {}) {
+    const key = `${name}@${version}`;
+    if (!this.nodes.has(key)) this.nodes.set(key, { key, name, version, local, deps: new Set() });
+    return key;
+  }
+
+  addEdge(from, to) {
+    if (from && to && from !== to) this.nodes.get(from)?.deps.add(to);
+  }
+
+  addRoot(name, key, { dev = false, workspace = '.' } = {}) {
+    if (key && this.nodes.has(key) && !this.nodes.get(key).local) this.roots.push({ name, key, dev, workspace });
+  }
+
+  /**
+   * Walks from every root and records, per node: whether any production root reaches it,
+   * which direct dependencies pull it in, and a shortest "why is this installed" parent pointer
+   * (production chains win over dev chains).
+   */
+  annotate() {
+    for (const n of this.nodes.values()) {
+      n.prod = false;
+      n.direct = false;
+      n.parent = undefined;
+      n.depth = Infinity;
+      n.reachedBy = new Set();
+    }
+    const roots = [...this.roots].sort((a, b) => Number(a.dev) - Number(b.dev));
+    for (const root of roots) {
+      const start = this.nodes.get(root.key);
+      start.direct = true;
+      if (start.depth > 0 && !(root.dev && start.prod)) {
+        start.parent = null;
+        start.depth = 0;
+      }
+      const seen = new Set([root.key]);
+      const queue = [root.key];
+      for (let qi = 0; qi < queue.length; qi++) {
+        const n = this.nodes.get(queue[qi]);
+        n.reachedBy.add(root.name);
+        if (!root.dev) n.prod = true;
+        for (const childKey of n.deps) {
+          if (seen.has(childKey)) continue;
+          seen.add(childKey);
+          const c = this.nodes.get(childKey);
+          if (!c || c.local) continue;
+          const better = c.parent === undefined || (n.depth + 1 < c.depth && !(root.dev && c.prod));
+          if (better && c.depth !== 0) {
+            c.parent = n.key;
+            c.depth = n.depth + 1;
+          }
+          queue.push(childKey);
+        }
+      }
+    }
+    return this;
+  }
+
+  /** Chain of node keys from a direct dependency down to `key`. */
+  pathTo(key) {
+    const chain = [];
+    const guard = new Set();
+    for (let k = key; k && !guard.has(k); k = this.nodes.get(k)?.parent) {
+      guard.add(k);
+      chain.unshift(k);
+    }
+    return chain;
+  }
+
+  /** Nodes that should be checked against advisory databases. */
+  packages() {
+    return [...this.nodes.values()].filter((n) => !n.local && n.version && !/^(file|link|git|https?):/.test(n.version));
+  }
+}

package/src/deps/index.js

@@ -0,0 +1,144 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { parseNpmLock } from './lockfiles/npm.js';
+import { parseYarnLock } from './lockfiles/yarn.js';
+import { parsePnpmLock } from './lockfiles/pnpm.js';
+import { parseComposerLock } from './lockfiles/composer.js';
+import { parseTomlLock, parsePipfileLock, parseRequirements } from './lockfiles/python.js';
+import { readJson } from '../project.js';
+import { queryOsv, normalizeVuln, pkgId } from './osv.js';
+
+const JS_LOCKFILES = [
+  ['package-lock.json', (t, p) => parseNpmLock(t, p.manifest, 'package-lock.json')],
+  ['npm-shrinkwrap.json', (t, p) => parseNpmLock(t, p.manifest, 'npm-shrinkwrap.json')],
+  ['pnpm-lock.yaml', (t) => parsePnpmLock(t)],
+  ['yarn.lock', (t, p) => parseYarnLock(t, p.manifests)],
+  // npm ≥7 keeps a copy of the resolved tree here even when package-lock.json isn't committed.
+  ['node_modules/.package-lock.json', (t, p) => parseNpmLock(t, p.manifest, 'node_modules/.package-lock.json')],
+];
+
+/** Find and parse the lockfile(s) of a project into dependency graphs. */
+export function loadGraphs(project) {
+  const graphs = [];
+  const warnings = [];
+
+  if (project.manifest) {
+    const found = JS_LOCKFILES.filter(([f]) => fs.existsSync(path.join(project.root, f)));
+    if (!found.length) {
+      warnings.push(
+        'package.json found but no lockfile — the full dependency tree can\'t be resolved. Run `npm install --package-lock-only` (or your package manager\'s equivalent) and scan again.',
+      );
+    } else {
+      const [file, parse] = found[0];
+      if (found.length > 1 && !found[1][0].startsWith('node_modules')) {
+        warnings.push(`Multiple lockfiles found (${found.map((f) => f[0]).join(', ')}); using ${file}.`);
+      }
+      try {
+        graphs.push(parse(fs.readFileSync(path.join(project.root, file), 'utf8'), project));
+      } catch (err) {
+        warnings.push(`Could not parse ${file}: ${err.message}`);
+      }
+    }
+  }
+  const read = (f) => fs.readFileSync(path.join(project.root, f), 'utf8');
+  const exists = (f) => fs.existsSync(path.join(project.root, f));
+  const tryParse = (file, fn) => {
+    try {
+      graphs.push(fn());
+    } catch (err) {
+      warnings.push(`Could not parse ${file}: ${err.message}`);
+    }
+  };
+
+  // PHP
+  if (exists('composer.lock')) {
+    tryParse('composer.lock', () => parseComposerLock(read('composer.lock'), readJson(path.join(project.root, 'composer.json'))));
+  } else if (exists('composer.json')) {
+    warnings.push('composer.json found but no composer.lock — run `composer update --lock` so exact versions can be checked.');
+  }
+
+  // Python: prefer a real lockfile, fall back to pinned requirements files.
+  const pyproject = exists('pyproject.toml') ? read('pyproject.toml') : null;
+  const pyLock = ['uv.lock', 'poetry.lock'].find(exists);
+  if (pyLock) tryParse(pyLock, () => parseTomlLock(read(pyLock), pyLock, pyproject));
+  else if (exists('Pipfile.lock')) tryParse('Pipfile.lock', () => parsePipfileLock(read('Pipfile.lock')));
+  else {
+    const reqFiles = fs.readdirSync(project.root).filter((f) => /^requirements([._-].*)?\.(txt|in)$/i.test(f) && !f.endsWith('.in'));
+    if (reqFiles.length) {
+      tryParse(reqFiles.join(', '), () => {
+        const g = parseRequirements(reqFiles.map((name) => ({ name, text: read(name) })));
+        if (g.unpinned) warnings.push(`${g.unpinned} Python requirement(s) aren't pinned with == and were skipped — pin them or use a lockfile (uv/poetry/pip-tools).`);
+        return g;
+      });
+    } else if (pyproject) {
+      warnings.push('pyproject.toml found but no uv.lock / poetry.lock / pinned requirements — Python dependencies were not checked.');
+    }
+  }
+
+  return { graphs, warnings };
+}
+
+/** Check every package in every graph against OSV and turn hits into findings. */
+export async function scanDependencies(graphs, { onProgress } = {}) {
+  const all = graphs.flatMap((g) => g.packages().map((n) => ({ node: n, graph: g, ecosystem: g.ecosystem })));
+  const unique = new Map(all.map((p) => [pkgId({ ...p.node, ecosystem: p.ecosystem }), { name: p.node.name, version: p.node.version, ecosystem: p.ecosystem }]));
+  const vulnsByPkg = await queryOsv([...unique.values()], { onProgress });
+
+  const findings = [];
+  for (const { node, graph, ecosystem } of all) {
+    const records = vulnsByPkg.get(pkgId({ ...node, ecosystem }));
+    if (!records) continue;
+    const seen = new Set();
+    for (const rec of records) {
+      // OSV can return the same issue under several ids (GHSA + PYSEC, …) — keep one.
+      if ([rec.id, ...(rec.aliases ?? [])].some((id) => seen.has(id))) continue;
+      seen.add(rec.id);
+      for (const a of rec.aliases ?? []) seen.add(a);
+
+      const adv = normalizeVuln(rec, { name: node.name, version: node.version, ecosystem });
+      const chain = graph.pathTo(node.key);
+      findings.push({
+        id: `dep:${ecosystem}:${node.key}:${adv.id}`,
+        kind: 'dependency',
+        title: adv.summary,
+        ruleId: adv.id,
+        severity: adv.severity,
+        severityScore: adv.severityScore,
+        package: {
+          name: node.name,
+          version: node.version,
+          ecosystem,
+          lockfile: graph.lockfile,
+          direct: !!node.direct,
+          prod: !!node.prod,
+          path: chain,
+          introducedBy: [...(node.reachedBy ?? [])],
+          fixedIn: adv.fixedIn,
+        },
+        advisory: adv,
+        fix: fixText(node, adv, chain),
+      });
+    }
+  }
+  return findings;
+}
+
+function fixText(node, adv, chain) {
+  if (adv.malicious) return `Remove ${node.name} immediately, rotate any credentials on machines that installed it, and audit for compromise.`;
+  if (!adv.fixedIn) return `No patched version published. Consider replacing ${node.name} or mitigating in code.`;
+  if (node.direct || chain.length <= 1) return `Upgrade ${node.name} to ${adv.fixedIn} or later.`;
+  const top = chain[0].slice(0, chain[0].lastIndexOf('@'));
+  return `Upgrade ${node.name} to ${adv.fixedIn}+ — it comes in via ${top}; update ${top}, or force the version with "overrides" (npm) / "resolutions" (yarn) / "pnpm.overrides".`;
+}
+
+export function treeStats(graphs) {
+  let total = 0, direct = 0, dev = 0;
+  for (const g of graphs) {
+    for (const n of g.packages()) {
+      total++;
+      if (n.direct) direct++;
+      if (!n.prod) dev++;
+    }
+  }
+  return { total, direct, transitive: total - direct, devOnly: dev };
+}

package/src/deps/lockfiles/composer.js

@@ -0,0 +1,31 @@
+import { DepGraph } from '../graph.js';
+
+const isPlatform = (name) => name === 'php' || /^(ext|lib|composer)-/.test(name) || !name.includes('/');
+const clean = (v) => String(v).replace(/^v(?=\d)/, '');
+
+/** composer.lock (PHP). OSV ecosystem: Packagist. */
+export function parseComposerLock(text, composerJson) {
+  const lock = JSON.parse(text);
+  const g = new DepGraph('Packagist', 'composer.lock');
+  const byName = new Map();
+  for (const p of [...(lock.packages ?? []), ...(lock['packages-dev'] ?? [])]) {
+    byName.set(p.name.toLowerCase(), { key: g.addNode(p.name, clean(p.version)), pkg: p });
+  }
+  for (const { key, pkg } of byName.values()) {
+    for (const dep of Object.keys(pkg.require ?? {})) {
+      if (!isPlatform(dep)) g.addEdge(key, byName.get(dep.toLowerCase())?.key);
+    }
+  }
+  for (const [field, dev] of [['require', false], ['require-dev', true]]) {
+    for (const name of Object.keys(composerJson?.[field] ?? {})) {
+      if (!isPlatform(name)) g.addRoot(name, byName.get(name.toLowerCase())?.key, { dev });
+    }
+  }
+  // No composer.json? Treat packages nothing depends on as roots.
+  if (!composerJson) {
+    const depended = new Set([...g.nodes.values()].flatMap((n) => [...n.deps]));
+    const devNames = new Set((lock['packages-dev'] ?? []).map((p) => p.name.toLowerCase()));
+    for (const [name, { key }] of byName) if (!depended.has(key)) g.addRoot(name, key, { dev: devNames.has(name) });
+  }
+  return g.annotate();
+}

package/src/deps/lockfiles/npm.js

@@ -0,0 +1,77 @@
+import { DepGraph } from '../graph.js';
+
+/** package-lock.json / npm-shrinkwrap.json, lockfileVersion 1, 2 and 3. */
+export function parseNpmLock(text, manifest, lockfile = 'package-lock.json') {
+  const lock = JSON.parse(text);
+  const pkgs = lock.packages ?? convertV1(lock, manifest);
+  const g = new DepGraph('npm', lockfile);
+
+  const isLocal = (p) => p !== '' && !p.includes('node_modules/');
+  const nameOf = (p) => pkgs[p]?.name || p.slice(p.lastIndexOf('node_modules/') + 'node_modules/'.length);
+
+  const realPath = (p) => {
+    const guard = new Set();
+    while (pkgs[p]?.link && !guard.has(p)) {
+      guard.add(p);
+      p = pkgs[p].resolved;
+    }
+    return pkgs[p] ? p : null;
+  };
+
+  // Node's resolution: look in ./node_modules, then each ancestor's node_modules.
+  const resolve = (from, name) => {
+    let base = from;
+    for (;;) {
+      const cand = (base ? base + '/' : '') + 'node_modules/' + name;
+      if (pkgs[cand]) return realPath(cand);
+      if (base === '') return null;
+      const i = base.lastIndexOf('/node_modules/');
+      base = i === -1 ? '' : base.slice(0, i);
+    }
+  };
+
+  const keys = new Map();
+  for (const [p, e] of Object.entries(pkgs)) {
+    if (p === '' || e.link) continue;
+    keys.set(p, isLocal(p) ? g.addNode(nameOf(p), 'workspace', { local: true }) : g.addNode(nameOf(p), e.version ?? '0.0.0'));
+  }
+
+  for (const [p, e] of Object.entries(pkgs)) {
+    if (e.link) continue;
+    const declared = { ...e.peerDependencies, ...e.optionalDependencies, ...e.dependencies };
+    if (p === '' || isLocal(p)) {
+      const addRoot = (name, dev) => {
+        const target = resolve(p, name);
+        if (target) g.addRoot(name, keys.get(target), { dev, workspace: p || '.' });
+      };
+      for (const name of Object.keys(declared)) addRoot(name, false);
+      for (const name of Object.keys(e.devDependencies ?? {})) addRoot(name, true);
+      continue;
+    }
+    for (const name of Object.keys(declared)) {
+      const target = resolve(p, name);
+      if (target && !isLocal(target)) g.addEdge(keys.get(p), keys.get(target));
+    }
+  }
+  return g.annotate();
+}
+
+/** Lockfile v1 nests deps under "dependencies" with "requires"; reshape it into the v2 path map. */
+function convertV1(lock, manifest) {
+  const pkgs = {
+    '': {
+      dependencies: manifest?.dependencies,
+      optionalDependencies: manifest?.optionalDependencies,
+      devDependencies: manifest?.devDependencies,
+    },
+  };
+  const walk = (deps, prefix) => {
+    for (const [name, e] of Object.entries(deps ?? {})) {
+      const p = (prefix ? prefix + '/' : '') + 'node_modules/' + name;
+      pkgs[p] = { version: e.version, dependencies: e.requires };
+      walk(e.dependencies, p);
+    }
+  };
+  walk(lock.dependencies, '');
+  return pkgs;
+}

package/src/deps/lockfiles/pnpm.js

@@ -0,0 +1,56 @@
+import { DepGraph } from '../graph.js';
+import { parseYaml } from '../../util/yaml.js';
+
+/** pnpm-lock.yaml, lockfile versions 5.x, 6.x and 9.x. */
+export function parsePnpmLock(text) {
+  const doc = parseYaml(text);
+  const ver = parseFloat(doc.lockfileVersion) || 5;
+  const section = (ver >= 9 ? doc.snapshots : doc.packages) ?? {};
+  const g = new DepGraph('npm', 'pnpm-lock.yaml');
+
+  // Turns a dependency reference ("18.2.0(react@18.2.0)", "/foo/1.0.0", "npm:bar@2.0.0") into a section key.
+  const sectionKey = (name, ref) => {
+    if (!ref || typeof ref !== 'string' || /^(link|file|workspace):/.test(ref)) return null;
+    if (ver < 6 && ref.startsWith('/')) return ref;
+    const alias = ref.replace(/^npm:/, '').replace(/^\//, '').match(/^(@?[^@(]+)@(.+)$/);
+    const [n, v] = alias ? [alias[1], alias[2]] : [name, ref];
+    if (ver >= 9) return `${n}@${v}`;
+    if (ver >= 6) return `/${n}@${v}`;
+    return `/${n}/${v}`;
+  };
+
+  const parseKey = (k) => {
+    let s = k.replace(/^\//, '');
+    if (ver < 6) {
+      s = s.replace(/_.*$/, '');
+      const i = s.lastIndexOf('/');
+      return { name: s.slice(0, i), version: s.slice(i + 1) };
+    }
+    s = s.replace(/\(.*$/, '');
+    const i = s.lastIndexOf('@');
+    return { name: s.slice(0, i), version: s.slice(i + 1) };
+  };
+
+  const nodeKeys = new Map();
+  for (const k of Object.keys(section)) {
+    const { name, version } = parseKey(k);
+    if (name && version) nodeKeys.set(k, g.addNode(name, version));
+  }
+  for (const [k, e] of Object.entries(section)) {
+    if (!e || typeof e !== 'object') continue;
+    for (const [dep, ref] of Object.entries({ ...e.optionalDependencies, ...e.dependencies })) {
+      g.addEdge(nodeKeys.get(k), nodeKeys.get(sectionKey(dep, ref)));
+    }
+  }
+
+  const importers = doc.importers ? Object.entries(doc.importers) : [['.', doc]];
+  for (const [workspace, imp] of importers) {
+    for (const type of ['dependencies', 'optionalDependencies', 'devDependencies']) {
+      for (const [name, val] of Object.entries(imp?.[type] ?? {})) {
+        const ref = typeof val === 'object' ? val.version : val;
+        g.addRoot(name, nodeKeys.get(sectionKey(name, ref)), { dev: type === 'devDependencies', workspace });
+      }
+    }
+  }
+  return g.annotate();
+}

package/src/deps/lockfiles/python.js

@@ -0,0 +1,101 @@
+import { DepGraph } from '../graph.js';
+import { parseToml } from '../../util/toml.js';
+
+// PEP 503 normalisation so "PyYAML", "pyyaml" and "py_yaml" match.
+const norm = (n) => String(n).toLowerCase().replace(/[-_.]+/g, '-');
+const reqName = (spec) => norm(String(spec).trim().split(/[\s<>=!~;\[(@]/)[0]);
+
+/** Direct dependency names from pyproject.toml: PEP 621 [project] and Poetry tables. */
+export function pyprojectRoots(text) {
+  if (!text) return null;
+  let doc;
+  try {
+    doc = parseToml(text);
+  } catch {
+    return null;
+  }
+  const prod = new Set();
+  const dev = new Set();
+  for (const spec of doc.project?.dependencies ?? []) prod.add(reqName(spec));
+  for (const list of Object.values(doc.project?.['optional-dependencies'] ?? {})) for (const s of list) dev.add(reqName(s));
+  for (const list of Object.values(doc['dependency-groups'] ?? {})) for (const s of list) if (typeof s === 'string') dev.add(reqName(s));
+  const poetry = doc.tool?.poetry ?? {};
+  for (const n of Object.keys(poetry.dependencies ?? {})) if (n !== 'python') prod.add(norm(n));
+  for (const n of Object.keys(poetry['dev-dependencies'] ?? {})) dev.add(norm(n));
+  for (const grp of Object.values(poetry.group ?? {})) for (const n of Object.keys(grp.dependencies ?? {})) dev.add(norm(n));
+  for (const s of doc.tool?.uv?.['dev-dependencies'] ?? []) dev.add(reqName(s));
+  return { prod, dev };
+}
+
+function finish(g, byName, roots, depsOf) {
+  for (const [name, key] of byName) for (const d of depsOf(name)) g.addEdge(key, byName.get(norm(d)));
+  if (roots && (roots.prod.size || roots.dev.size)) {
+    for (const n of roots.prod) g.addRoot(n, byName.get(n), { dev: false });
+    for (const n of roots.dev) if (!roots.prod.has(n)) g.addRoot(n, byName.get(n), { dev: true });
+  } else {
+    const depended = new Set([...g.nodes.values()].flatMap((n) => [...n.deps]));
+    for (const [name, key] of byName) if (!depended.has(key)) g.addRoot(name, key, { dev: false });
+  }
+  return g.annotate();
+}
+
+/** poetry.lock and uv.lock share the [[package]] layout. */
+export function parseTomlLock(text, file, pyproject) {
+  const doc = parseToml(text);
+  const g = new DepGraph('PyPI', file);
+  const byName = new Map();
+  const pkgs = new Map();
+  for (const p of doc.package ?? []) {
+    if (p.source?.virtual || p.source?.editable) continue; // the project itself (uv)
+    byName.set(norm(p.name), g.addNode(norm(p.name), p.version));
+    pkgs.set(norm(p.name), p);
+  }
+  const depsOf = (name) => {
+    const d = pkgs.get(name)?.dependencies;
+    if (Array.isArray(d)) return d.map((x) => (typeof x === 'object' ? x.name : x));
+    return Object.keys(d ?? {});
+  };
+  let roots = pyprojectRoots(pyproject);
+  // uv records the project's own deps on its virtual/editable package entry.
+  const self = (doc.package ?? []).find((p) => p.source?.virtual || p.source?.editable);
+  if (self && !roots) {
+    roots = { prod: new Set((self.dependencies ?? []).map((d) => norm(d.name))), dev: new Set() };
+    for (const list of Object.values(self['dev-dependencies'] ?? {})) for (const d of list) roots.dev.add(norm(d.name));
+  }
+  return finish(g, byName, roots, depsOf);
+}
+
+/** Pipfile.lock: flat "default"/"develop" maps of pinned versions. */
+export function parsePipfileLock(text) {
+  const lock = JSON.parse(text);
+  const g = new DepGraph('PyPI', 'Pipfile.lock');
+  for (const [section, dev] of [['default', false], ['develop', true]]) {
+    for (const [name, info] of Object.entries(lock[section] ?? {})) {
+      const version = String(info.version ?? '').replace(/^==/, '');
+      if (!version) continue;
+      g.addRoot(norm(name), g.addNode(norm(name), version), { dev });
+    }
+  }
+  return g.annotate();
+}
+
+/** requirements*.txt — only exact pins (==) can be checked. */
+export function parseRequirements(files) {
+  const g = new DepGraph('PyPI', files.map((f) => f.name).join(', '));
+  let unpinned = 0;
+  for (const { name: file, text } of files) {
+    const dev = /dev|test|lint|doc/i.test(file);
+    for (const raw of text.split(/\r?\n/)) {
+      const line = raw.replace(/\s#.*$/, '').trim();
+      if (!line || line.startsWith('#') || line.startsWith('-')) continue;
+      const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?\s*===?\s*([^\s;,]+)/.exec(line);
+      if (!m) {
+        unpinned++;
+        continue;
+      }
+      g.addRoot(norm(m[1]), g.addNode(norm(m[1]), m[2]), { dev });
+    }
+  }
+  g.unpinned = unpinned;
+  return g.annotate();
+}