projscan 4.5.0 → 4.7.0

package/dist/core/languages/pythonPyproject.js

@@ -0,0 +1,160 @@
+import { splitPep508 } from './pythonPep508.js';
+import { extractListValues, offsetToLine } from './pythonManifestText.js';
+export function parsePyproject(content) {
+    const out = [];
+    const pep621Deps = extractListBlock(content, /(?:^|\n)\s*dependencies\s*=\s*\[/);
+    for (const { name, versionSpec, line } of pep621Deps) {
+        out.push({ name, versionSpec, source: 'pyproject.toml', line, scope: 'main' });
+    }
+    appendOptionalDependencies(out, content);
+    appendDependencyGroups(out, content);
+    appendPoetryDependencies(out, content);
+    appendLegacyPoetryDevDependencies(out, content);
+    return out;
+}
+function appendOptionalDependencies(out, content) {
+    const optBlockRe = /\[project\.optional-dependencies\]([\s\S]*?)(?=\n\[|$)/;
+    const optMatch = optBlockRe.exec(content);
+    if (!optMatch)
+        return;
+    const blockStart = optMatch.index + optMatch[0].indexOf(optMatch[1]);
+    const block = optMatch[1];
+    const stringRe = /["']([^"'\n]+)["']/g;
+    let stringMatch;
+    while ((stringMatch = stringRe.exec(block))) {
+        const { name, versionSpec } = splitPep508(stringMatch[1]);
+        if (!name)
+            continue;
+        out.push({
+            name,
+            versionSpec,
+            source: 'pyproject.toml',
+            line: offsetToLine(content, blockStart + stringMatch.index),
+            scope: 'dev',
+        });
+    }
+}
+function appendDependencyGroups(out, content) {
+    const groupsRe = /\[dependency-groups\]([\s\S]*?)(?=\n\[|$)/;
+    const groupsMatch = groupsRe.exec(content);
+    if (!groupsMatch)
+        return;
+    const blockStart = groupsMatch.index + groupsMatch[0].indexOf(groupsMatch[1]);
+    const block = groupsMatch[1];
+    const groupRe = /(?:^|\n)\s*[A-Za-z0-9_.-]+\s*=\s*\[/g;
+    let groupMatch;
+    while ((groupMatch = groupRe.exec(block))) {
+        const open = block.indexOf('[', groupMatch.index);
+        const close = matchingBracketOffset(block, open);
+        if (open < 0 || close < 0)
+            continue;
+        appendDependencyGroupArray(out, content, block, blockStart, open, close);
+        groupRe.lastIndex = close + 1;
+    }
+}
+function appendDependencyGroupArray(out, content, block, blockStart, open, close) {
+    const inside = maskIncludeGroupObjects(block.slice(open + 1, close));
+    const insideStart = blockStart + open + 1;
+    const stringRe = /["']([^"'\n]+)["']/g;
+    let stringMatch;
+    while ((stringMatch = stringRe.exec(inside))) {
+        const { name, versionSpec } = splitPep508(stringMatch[1]);
+        if (!name)
+            continue;
+        out.push({
+            name,
+            versionSpec,
+            source: 'pyproject.toml',
+            line: offsetToLine(content, insideStart + stringMatch.index),
+            scope: 'dev',
+        });
+    }
+}
+function matchingBracketOffset(value, open) {
+    if (open < 0)
+        return -1;
+    let depth = 1;
+    for (let index = open + 1; index < value.length; index++) {
+        const char = value[index];
+        if (char === '[')
+            depth += 1;
+        else if (char === ']')
+            depth -= 1;
+        if (depth === 0)
+            return index;
+    }
+    return -1;
+}
+function maskIncludeGroupObjects(value) {
+    return value.replace(/\{[^{}\n]*include-group\s*=[^{}]*\}/g, (match) => match.replace(/[^\n]/g, ' '));
+}
+function appendPoetryDependencies(out, content) {
+    const poetryMainRe = /\[tool\.poetry\.dependencies\]([\s\S]*?)(?=\n\[|$)/;
+    const poetryMainMatch = poetryMainRe.exec(content);
+    if (poetryMainMatch) {
+        const offset = offsetToLine(content, poetryMainMatch.index);
+        for (const { name, versionSpec, line } of parsePoetryKv(poetryMainMatch[1], offset)) {
+            if (name === 'python')
+                continue;
+            out.push({ name, versionSpec, source: 'pyproject.toml', line, scope: 'main' });
+        }
+    }
+    const poetryGroupRe = /\[tool\.poetry\.group\.[\w.-]+\.dependencies\]([\s\S]*?)(?=\n\[|$)/g;
+    let groupMatch;
+    while ((groupMatch = poetryGroupRe.exec(content))) {
+        const offset = offsetToLine(content, groupMatch.index);
+        for (const { name, versionSpec, line } of parsePoetryKv(groupMatch[1], offset)) {
+            out.push({ name, versionSpec, source: 'pyproject.toml', line, scope: 'dev' });
+        }
+    }
+}
+function appendLegacyPoetryDevDependencies(out, content) {
+    const legacyDevRe = /\[tool\.poetry\.dev-dependencies\]([\s\S]*?)(?=\n\[|$)/;
+    const legacyDevMatch = legacyDevRe.exec(content);
+    if (!legacyDevMatch)
+        return;
+    const offset = offsetToLine(content, legacyDevMatch.index);
+    for (const { name, versionSpec, line } of parsePoetryKv(legacyDevMatch[1], offset)) {
+        out.push({ name, versionSpec, source: 'pyproject.toml', line, scope: 'dev' });
+    }
+}
+function parsePoetryKv(block, lineOffset) {
+    const out = [];
+    const lines = block.split('\n');
+    for (let index = 0; index < lines.length; index++) {
+        const line = lines[index].replace(/#.*$/, '').trim();
+        if (!line)
+            continue;
+        const match = /^([A-Za-z_][\w.-]*)\s*=\s*(.+)$/.exec(line);
+        if (!match)
+            continue;
+        const name = match[1];
+        const versionSpec = poetryVersionSpec(match[2].trim());
+        out.push({ name, versionSpec, line: lineOffset + index + 1 });
+    }
+    return out;
+}
+function poetryVersionSpec(raw) {
+    if (raw.startsWith('{')) {
+        const versionMatch = /version\s*=\s*["']([^"']+)["']/.exec(raw);
+        return versionMatch ? versionMatch[1] : '';
+    }
+    if (/^["']/.test(raw))
+        return raw.replace(/^["']|["']$/g, '');
+    return raw;
+}
+function extractListBlock(content, opener) {
+    const match = opener.exec(content);
+    if (!match)
+        return [];
+    const start = content.indexOf('[', match.index);
+    if (start < 0)
+        return [];
+    const end = matchingBracketOffset(content, start);
+    if (end < 0)
+        return [];
+    const inside = content.slice(start + 1, end);
+    const baseLine = offsetToLine(content, start + 1);
+    return extractListValues(inside, baseLine);
+}
+//# sourceMappingURL=pythonPyproject.js.map

package/dist/core/languages/pythonPyproject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pythonPyproject.js","sourceRoot":"","sources":["../../../src/core/languages/pythonPyproject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE1E,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,GAAG,GAAwB,EAAE,CAAC;IAEpC,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAC;IACjF,KAAK,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,iCAAiC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEhD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAwB,EAAE,OAAe;IAC3E,MAAM,UAAU,GAAG,wDAAwD,CAAC;IAC5E,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,qBAAqB,CAAC;IACvC,IAAI,WAAmC,CAAC;IACxC,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,GAAG,CAAC,IAAI,CAAC;YACP,IAAI;YACJ,WAAW;YACX,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC;YAC3D,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAwB,EAAE,OAAe;IACvE,MAAM,QAAQ,GAAG,2CAA2C,CAAC;IAC7D,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,sCAAsC,CAAC;IACvD,IAAI,UAAkC,CAAC;IACvC,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACpC,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzE,OAAO,CAAC,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,GAAwB,EACxB,OAAe,EACf,KAAa,EACb,UAAkB,EAClB,IAAY,EACZ,KAAa;IAEb,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC;IACvC,IAAI,WAAmC,CAAC;IACxC,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,GAAG,CAAC,IAAI,CAAC;YACP,IAAI;YACJ,WAAW;YACX,MAAM,EAAE,gBAAgB;YACxB,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC;YAC5D,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,IAAY;IACxD,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IACxB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACxB,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,sCAAsC,EAAE,CAAC,KAAK,EAAE,EAAE,CACrE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAwB,EAAE,OAAe;IACzE,MAAM,YAAY,GAAG,oDAAoD,CAAC;IAC1E,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5D,KAAK,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YACpF,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,qEAAqE,CAAC;IAC5F,IAAI,UAAkC,CAAC;IACvC,OAAO,CAAC,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iCAAiC,CAAC,GAAwB,EAAE,OAAe;IAClF,MAAM,WAAW,GAAG,wDAAwD,CAAC;IAC7E,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3D,KAAK,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAAa,EACb,UAAkB;IAElB,MAAM,GAAG,GAA0D,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAe,EACf,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAClD,OAAO,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC"}

package/dist/core/languages/pythonRequirements.d.ts

@@ -0,0 +1,9 @@
+import type { FileEntry } from '../../types.js';
+import type { PythonDeclaredDep, PythonLockedDep } from './pythonProjectTypes.js';
+export interface PythonRequirementEvidence {
+    manifestFiles: string[];
+    declared: PythonDeclaredDep[];
+    locked: PythonLockedDep[];
+}
+export declare function readRootRequirementEvidence(rootPath: string, files: FileEntry[]): Promise<PythonRequirementEvidence>;
+export declare function parseRequirements(content: string, sourceFile: string, scope: 'main' | 'dev'): PythonDeclaredDep[];

package/dist/core/languages/pythonRequirements.js

@@ -0,0 +1,212 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { splitPep508 } from './pythonPep508.js';
+const REQUIREMENTS_DECLARATION_FILE_RE = /^(?:requirements(?:-.*)?|(?:dev|test|lint)-requirements)\.(?:txt|in)$/i;
+const REQUIREMENTS_LOCK_FILE_RE = /^(?:requirements(?:-.*)?|(?:dev|test|lint)-requirements)\.txt$/i;
+const DEV_REQUIREMENTS_FILE_RE = /^(?:requirements-(?:test|dev|lint)|(?:dev|test|lint)-requirements)\.(?:txt|in)$/i;
+const CONSTRAINTS_FILE_RE = /^constraints(-.*)?\.txt$/i;
+export async function readRootRequirementEvidence(rootPath, files) {
+    const context = {
+        rootPath,
+        fileSet: new Set(files.map((file) => normalizeRel(file.relativePath))),
+        seenRequirements: new Set(),
+        seenConstraints: new Set(),
+    };
+    const evidence = {
+        manifestFiles: [],
+        declared: [],
+        locked: [],
+    };
+    await appendRootRequirements(evidence, context, files);
+    await appendRootConstraints(evidence, context, files);
+    return evidence;
+}
+async function appendRootRequirements(evidence, context, files) {
+    for (const rel of rootRequirementFiles(files)) {
+        const isDev = DEV_REQUIREMENTS_FILE_RE.test(path.basename(rel));
+        await appendRequirementFile(evidence, context, rel, isDev ? 'dev' : 'main');
+    }
+}
+async function appendRootConstraints(evidence, context, files) {
+    for (const rel of rootConstraintFiles(files)) {
+        await appendConstraintFile(evidence, context, rel);
+    }
+}
+async function appendRequirementFile(evidence, context, rel, scope) {
+    const normalized = normalizeRel(rel);
+    if (context.seenRequirements.has(normalized))
+        return;
+    context.seenRequirements.add(normalized);
+    const content = await readScannedFile(context, normalized);
+    if (content === null)
+        return;
+    pushUnique(evidence.manifestFiles, normalized);
+    const deps = parseRequirements(content, normalized, scope);
+    evidence.declared.push(...deps);
+    if (isRequirementsLockFile(normalized)) {
+        evidence.locked.push(...deps.flatMap(requirementPinToLockedDep));
+    }
+    for (const include of parseRequirementIncludes(content, normalized)) {
+        if (include.kind === 'requirement') {
+            await appendRequirementFile(evidence, context, include.relativePath, scope);
+        }
+        else {
+            await appendConstraintFile(evidence, context, include.relativePath);
+        }
+    }
+}
+async function appendConstraintFile(evidence, context, rel) {
+    const normalized = normalizeRel(rel);
+    if (context.seenConstraints.has(normalized))
+        return;
+    context.seenConstraints.add(normalized);
+    const content = await readScannedFile(context, normalized);
+    if (content === null)
+        return;
+    const deps = parseRequirements(content, normalized, 'main');
+    evidence.locked.push(...deps.flatMap(requirementPinToLockedDep));
+    for (const include of parseRequirementIncludes(content, normalized)) {
+        if (include.kind === 'constraint') {
+            await appendConstraintFile(evidence, context, include.relativePath);
+        }
+    }
+}
+function rootRequirementFiles(files) {
+    return files.filter(isRootRequirementsFile).map((file) => file.relativePath);
+}
+function rootConstraintFiles(files) {
+    return files.filter(isRootConstraintsFile).map((file) => file.relativePath);
+}
+function isRootRequirementsFile(file) {
+    return isRootFile(file) && REQUIREMENTS_DECLARATION_FILE_RE.test(path.basename(file.relativePath));
+}
+function isRootConstraintsFile(file) {
+    return isRootFile(file) && CONSTRAINTS_FILE_RE.test(path.basename(file.relativePath));
+}
+function isRootFile(file) {
+    return !file.directory || file.directory === '.';
+}
+function isRequirementsLockFile(rel) {
+    return REQUIREMENTS_LOCK_FILE_RE.test(path.basename(rel));
+}
+async function readScannedFile(context, relativePath) {
+    if (!context.fileSet.has(relativePath))
+        return null;
+    return tryRead(path.join(context.rootPath, relativePath.split('/').join(path.sep)));
+}
+async function tryRead(absolutePath) {
+    try {
+        return await fs.readFile(absolutePath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+export function parseRequirements(content, sourceFile, scope) {
+    const out = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const stripped = raw.replace(/\s+#.*$/, '').trim();
+        if (!stripped || stripped.startsWith('#'))
+            continue;
+        if (stripped.startsWith('-'))
+            continue; // -r, -e, -c, etc.
+        const { name, versionSpec } = splitPep508(stripped);
+        if (!name)
+            continue;
+        out.push({ name, versionSpec, source: sourceFile, line: i + 1, scope });
+    }
+    return out;
+}
+function parseRequirementIncludes(content, sourceFile) {
+    const out = [];
+    for (const raw of content.split('\n')) {
+        const stripped = cleanRequirementLine(raw);
+        if (!stripped)
+            continue;
+        const parsed = requirementIncludeTarget(stripped, sourceFile);
+        if (parsed)
+            out.push(parsed);
+    }
+    return out;
+}
+function requirementIncludeTarget(line, sourceFile) {
+    const requirement = directiveTarget(line, '-r', '--requirement');
+    if (requirement) {
+        return safeRequirementInclude('requirement', sourceFile, requirement);
+    }
+    const constraint = directiveTarget(line, '-c', '--constraint');
+    if (constraint) {
+        return safeRequirementInclude('constraint', sourceFile, constraint);
+    }
+    return null;
+}
+function directiveTarget(line, shortFlag, longFlag) {
+    return (spacedDirectiveTarget(line, shortFlag) ??
+        compactShortDirectiveTarget(line, shortFlag) ??
+        spacedDirectiveTarget(line, longFlag) ??
+        equalsDirectiveTarget(line, longFlag));
+}
+function spacedDirectiveTarget(line, flag) {
+    return line.startsWith(`${flag} `) ? firstDirectiveToken(line.slice(flag.length).trim()) : null;
+}
+function compactShortDirectiveTarget(line, flag) {
+    const target = line.slice(flag.length).trim();
+    return line.startsWith(flag) && target && !target.startsWith('-')
+        ? firstDirectiveToken(target)
+        : null;
+}
+function equalsDirectiveTarget(line, flag) {
+    return line.startsWith(`${flag}=`) ? firstDirectiveToken(line.slice(flag.length + 1).trim()) : null;
+}
+function firstDirectiveToken(value) {
+    const match = /^(['"])(.*?)\1(?:\s|$)/.exec(value);
+    if (match)
+        return match[2];
+    return value.split(/\s+/)[0] || null;
+}
+function safeRequirementInclude(kind, sourceFile, target) {
+    if (!isLocalRequirementTarget(target))
+        return null;
+    const relativePath = resolveRequirementInclude(sourceFile, target);
+    return relativePath ? { kind, relativePath } : null;
+}
+function isLocalRequirementTarget(target) {
+    return Boolean(target) && !target.includes('\0') && !path.isAbsolute(target) && !isUrlLike(target);
+}
+function isUrlLike(target) {
+    return /^[a-z][a-z+.-]*:/i.test(target);
+}
+function resolveRequirementInclude(sourceFile, target) {
+    const sourceDir = path.posix.dirname(normalizeRel(sourceFile));
+    const baseDir = sourceDir === '.' ? '' : sourceDir;
+    const normalized = normalizeRel(path.posix.normalize(path.posix.join(baseDir, target)));
+    return isRepoRelativePath(normalized) ? normalized : null;
+}
+function isRepoRelativePath(relativePath) {
+    return (Boolean(relativePath) &&
+        relativePath !== '.' &&
+        relativePath !== '..' &&
+        !relativePath.startsWith('../'));
+}
+function cleanRequirementLine(raw) {
+    return raw.replace(/\s+#.*$/, '').trim();
+}
+function normalizeRel(rel) {
+    return rel.split(path.sep).join('/');
+}
+function pushUnique(arr, value) {
+    if (!arr.includes(value))
+        arr.push(value);
+}
+function exactVersionFromSpec(version) {
+    return /^={2,3}\s*([^\s,;]+)/.exec(version)?.[1] ?? null;
+}
+function requirementPinToLockedDep(dep) {
+    const version = exactVersionFromSpec(dep.versionSpec);
+    if (!version)
+        return [];
+    return [{ name: dep.name, version, source: dep.source, line: dep.line }];
+}
+//# sourceMappingURL=pythonRequirements.js.map

package/dist/core/languages/pythonRequirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pythonRequirements.js","sourceRoot":"","sources":["../../../src/core/languages/pythonRequirements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,gCAAgC,GACpC,wEAAwE,CAAC;AAC3E,MAAM,yBAAyB,GAAG,iEAAiE,CAAC;AACpG,MAAM,wBAAwB,GAC5B,kFAAkF,CAAC;AACrF,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAQxD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAgB,EAChB,KAAkB;IAElB,MAAM,OAAO,GAA2B;QACtC,QAAQ;QACR,OAAO,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACtE,gBAAgB,EAAE,IAAI,GAAG,EAAE;QAC3B,eAAe,EAAE,IAAI,GAAG,EAAE;KAC3B,CAAC;IACF,MAAM,QAAQ,GAA8B;QAC1C,aAAa,EAAE,EAAE;QACjB,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,MAAM,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtD,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD,KAAK,UAAU,sBAAsB,CACnC,QAAmC,EACnC,OAA+B,EAC/B,KAAkB;IAElB,KAAK,MAAM,GAAG,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,MAAM,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAmC,EACnC,OAA+B,EAC/B,KAAkB;IAElB,KAAK,MAAM,GAAG,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAmC,EACnC,OAA+B,EAC/B,GAAW,EACX,KAAqB;IAErB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO;IACrD,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO;IAE7B,UAAU,CAAC,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3D,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAChC,IAAI,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,wBAAwB,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACpE,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACnC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,QAAmC,EACnC,OAA+B,EAC/B,GAAW;IAEX,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO;IACpD,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAExC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO;IAE7B,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5D,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAEjE,KAAK,MAAM,OAAO,IAAI,wBAAwB,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACpE,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAkB;IAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAkB;IAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAe;IAC7C,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAe;IAC5C,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,UAAU,CAAC,IAAe;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC;AACnD,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAA+B,EAC/B,YAAoB;IAEpB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,YAAoB;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,UAAkB,EAClB,KAAqB;IAErB,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpD,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,mBAAmB;QAC3D,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAOD,SAAS,wBAAwB,CAAC,OAAe,EAAE,UAAkB;IACnE,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY,EAAE,UAAkB;IAChE,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACjE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,sBAAsB,CAAC,aAAa,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,sBAAsB,CAAC,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,SAAiB,EAAE,QAAgB;IACxE,OAAO,CACL,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;QACtC,2BAA2B,CAAC,IAAI,EAAE,SAAS,CAAC;QAC5C,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC;QACrC,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,IAAY;IACvD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClG,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,IAAY;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAC/D,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,IAAY;IACvD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtG,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACvC,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAgC,EAChC,UAAkB,EAClB,MAAc;IAEd,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,YAAY,GAAG,yBAAyB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAc;IAC9C,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,yBAAyB,CAAC,UAAkB,EAAE,MAAc;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACxF,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,OAAO,CACL,OAAO,CAAC,YAAY,CAAC;QACrB,YAAY,KAAK,GAAG;QACpB,YAAY,KAAK,IAAI;QACrB,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,UAAU,CAAC,GAAa,EAAE,KAAa;IAC9C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAsB;IACvD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/dist/core/languages/pythonRoots.d.ts

@@ -0,0 +1,3 @@
+import type { FileEntry } from '../../types.js';
+export declare function extractPyprojectRoots(content: string): string[];
+export declare function inferRootsFromInitFiles(files: FileEntry[]): string[];

package/dist/core/languages/pythonRoots.js

@@ -0,0 +1,83 @@
+import path from 'node:path';
+export function extractPyprojectRoots(content) {
+    const roots = [];
+    // [tool.setuptools.packages.find] where = ['src']
+    const findWhereRe = /\[tool\.setuptools\.packages\.find\]([\s\S]*?)(?=\n\[|$)/;
+    const findMatch = findWhereRe.exec(content);
+    if (findMatch) {
+        const whereRe = /where\s*=\s*\[\s*([^\]]+?)\s*\]/;
+        const whereMatch = whereRe.exec(findMatch[1]);
+        if (whereMatch) {
+            for (const s of extractStringList(whereMatch[1]))
+                roots.push(s);
+        }
+    }
+    // [tool.setuptools] package-dir or [tool.setuptools.package-dir] { '' = 'src' }
+    const pkgDirRe = /package[-_]dir\s*=\s*\{[^}]*""\s*=\s*["']([^"']+)["']/;
+    const pkgDirMatch = pkgDirRe.exec(content);
+    if (pkgDirMatch)
+        roots.push(pkgDirMatch[1]);
+    // Poetry explicit packages: [tool.poetry] packages = [{ include = "foo", from = "src" }]
+    const poetryPackagesRe = /\[tool\.poetry\][\s\S]*?packages\s*=\s*\[([\s\S]*?)\]/;
+    const poetryPkg = poetryPackagesRe.exec(content);
+    if (poetryPkg) {
+        const fromRe = /from\s*=\s*["']([^"']+)["']/g;
+        let m;
+        while ((m = fromRe.exec(poetryPkg[1])))
+            roots.push(m[1]);
+    }
+    return dedupe(roots);
+}
+export function inferRootsFromInitFiles(files) {
+    const initDirs = initDirectories(files);
+    if (initDirs.size === 0)
+        return [];
+    return candidateRootParents(initDirs);
+}
+function initDirectories(files) {
+    const dirs = new Set();
+    for (const f of files) {
+        if (isPackageInit(f))
+            dirs.add(normalizedPackageDir(f));
+    }
+    return dirs;
+}
+function isPackageInit(file) {
+    return path.basename(file.relativePath) === '__init__.py';
+}
+function normalizedPackageDir(file) {
+    return file.directory === '.' ? '' : file.directory;
+}
+function candidateRootParents(initDirs) {
+    const candidateParents = new Set();
+    for (const dir of initDirs) {
+        appendCandidateRootParent(candidateParents, initDirs, dir);
+    }
+    return [...candidateParents];
+}
+function appendCandidateRootParent(candidateParents, initDirs, dir) {
+    const parent = packageParent(dir);
+    if (initDirs.has(packageRootKey(parent)))
+        return;
+    candidateParents.add(parent);
+}
+function packageParent(dir) {
+    if (dir === '')
+        return '.';
+    return path.posix.dirname(dir);
+}
+function packageRootKey(parent) {
+    return parent === '.' ? '' : parent;
+}
+function extractStringList(fragment) {
+    const out = [];
+    const re = /["']([^"']+)["']/g;
+    let m;
+    while ((m = re.exec(fragment)))
+        out.push(m[1]);
+    return out;
+}
+function dedupe(arr) {
+    return [...new Set(arr)];
+}
+//# sourceMappingURL=pythonRoots.js.map

package/dist/core/languages/pythonRoots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pythonRoots.js","sourceRoot":"","sources":["../../../src/core/languages/pythonRoots.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,kDAAkD;IAClD,MAAM,WAAW,GAAG,0DAA0D,CAAC;IAC/E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,iCAAiC,CAAC;QAClD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,MAAM,QAAQ,GAAG,uDAAuD,CAAC;IACzE,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5C,yFAAyF;IACzF,MAAM,gBAAgB,GAAG,uDAAuD,CAAC;IACjF,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,8BAA8B,CAAC;QAC9C,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAkB;IACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,eAAe,CAAC,KAAkB;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,aAAa,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAe;IACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,aAAa,CAAC;AAC5D,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAe;IAC3C,OAAO,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAqB;IACjD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,yBAAyB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,GAAG,gBAAgB,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,yBAAyB,CAChC,gBAA6B,EAC7B,QAAqB,EACrB,GAAW;IAEX,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO;IACjD,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,mBAAmB,CAAC;IAC/B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,GAAa;IAC3B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC"}

package/dist/core/languages/pythonSetuptools.d.ts

@@ -0,0 +1,6 @@
+import type { PythonDeclaredDep } from './pythonProjectTypes.js';
+export interface PythonSetuptoolsEvidence {
+    manifestFiles: string[];
+    declared: PythonDeclaredDep[];
+}
+export declare function readSetuptoolsEvidence(rootPath: string): Promise<PythonSetuptoolsEvidence>;

package/dist/core/languages/pythonSetuptools.js

@@ -0,0 +1,58 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { extractListValues, offsetToLine } from './pythonManifestText.js';
+import { splitPep508 } from './pythonPep508.js';
+export async function readSetuptoolsEvidence(rootPath) {
+    const manifestFiles = [];
+    const declared = [];
+    const setupCfgContent = await tryRead(path.join(rootPath, 'setup.cfg'));
+    if (setupCfgContent !== null) {
+        manifestFiles.push('setup.cfg');
+        declared.push(...parseSetupCfg(setupCfgContent));
+    }
+    const setupPyContent = await tryRead(path.join(rootPath, 'setup.py'));
+    if (setupPyContent !== null) {
+        manifestFiles.push('setup.py');
+        declared.push(...parseSetupPyInstallRequires(setupPyContent));
+    }
+    return { manifestFiles, declared };
+}
+async function tryRead(absolutePath) {
+    try {
+        return await fs.readFile(absolutePath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+function parseSetupPyInstallRequires(content) {
+    const out = [];
+    const m = /install_requires\s*=\s*\[([\s\S]*?)\]/.exec(content);
+    if (!m)
+        return out;
+    const inside = m[1];
+    const baseLine = offsetToLine(content, m.index + m[0].indexOf('['));
+    for (const { name, versionSpec, line } of extractListValues(inside, baseLine)) {
+        out.push({ name, versionSpec, source: 'setup.py', line, scope: 'main' });
+    }
+    return out;
+}
+function parseSetupCfg(content) {
+    const out = [];
+    const m = /\[options\][\s\S]*?install_requires\s*=\s*([\s\S]*?)(?=\n\[|\n\n|$)/.exec(content);
+    if (!m)
+        return out;
+    const baseLine = offsetToLine(content, m.index + m[0].indexOf('install_requires'));
+    const lines = m[1].split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const stripped = lines[i].replace(/#.*$/, '').trim();
+        if (!stripped)
+            continue;
+        const { name, versionSpec } = splitPep508(stripped);
+        if (!name)
+            continue;
+        out.push({ name, versionSpec, source: 'setup.cfg', line: baseLine + i + 1, scope: 'main' });
+    }
+    return out;
+}
+//# sourceMappingURL=pythonSetuptools.js.map

package/dist/core/languages/pythonSetuptools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pythonSetuptools.js","sourceRoot":"","sources":["../../../src/core/languages/pythonSetuptools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IAC3D,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACxE,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,2BAA2B,CAAC,cAAc,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,YAAoB;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe;IAClD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,CAAC,GAAG,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACnB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,CAAC,GAAG,qEAAqE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACnB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/pluginManifestValidation.d.ts

@@ -0,0 +1,41 @@
+export declare const PLUGIN_SCHEMA_VERSION = 1;
+export type PluginKind = 'analyzer' | 'reporter';
+export type PluginReporterCommand = 'doctor' | 'analyze' | 'ci';
+export declare const PLUGIN_REPORTER_COMMANDS: readonly ["doctor", "analyze", "ci"];
+interface PluginManifestBase {
+    schemaVersion: number;
+    name: string;
+    kind: PluginKind;
+    /** Module entry point, relative to the manifest file. */
+    module: string;
+    /** Optional human-readable summary. */
+    description?: string;
+}
+export interface PluginAnalyzerManifest extends PluginManifestBase {
+    kind: 'analyzer';
+    /** Issue category emitted by this plugin (`Issue.category`). */
+    category: string;
+}
+export interface PluginReporterManifest extends PluginManifestBase {
+    kind: 'reporter';
+    /** CLI commands this reporter can render. */
+    commands: PluginReporterCommand[];
+}
+export type PluginManifest = PluginAnalyzerManifest | PluginReporterManifest;
+export interface PluginDiagnostic {
+    code: 'invalid-manifest' | 'unsupported-schema-version' | 'invalid-name' | 'unsupported-kind' | 'invalid-module' | 'invalid-category' | 'invalid-commands' | 'invalid-description' | 'invalid-manifest-path' | 'invalid-json' | 'read-error' | 'plugins-disabled' | 'reporter-not-found' | 'reporter-unsupported-command' | 'invalid-reporter-export' | 'reporter-load-error' | 'reporter-render-error' | 'plugin-untrusted';
+    message: string;
+    field?: string;
+    hint?: string;
+}
+interface ValidationOk {
+    ok: true;
+    manifest: PluginManifest;
+}
+interface ValidationFail {
+    ok: false;
+    reason: string;
+    diagnostic: PluginDiagnostic;
+}
+export declare function validateManifest(input: unknown): ValidationOk | ValidationFail;
+export {};