vibecodedshit 0.0.0-stage → 0.2.0

package/dist/measure/d3/ts/config.js

@@ -0,0 +1,318 @@
+import path from 'node:path';
+import ts from 'typescript';
+import { readTracked, trackedPaths } from '../../../scope/tracked.js';
+const CONFIG_NAMES = ['.dependency-cruiser.js', '.dependency-cruiser.cjs', '.dependency-cruiser.mjs', '.dependency-cruiser.json'];
+class NonLiteral extends Error {
+}
+function evalLiteral(node) {
+    if (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node) || ts.isNonNullExpression(node)) {
+        return evalLiteral(node.expression);
+    }
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))
+        return node.text;
+    if (ts.isNumericLiteral(node))
+        return Number(node.text);
+    if (ts.isRegularExpressionLiteral(node))
+        return node.text.replace(/^\/(.*)\/[a-z]*$/s, '$1');
+    if (node.kind === ts.SyntaxKind.TrueKeyword)
+        return true;
+    if (node.kind === ts.SyntaxKind.FalseKeyword)
+        return false;
+    if (node.kind === ts.SyntaxKind.NullKeyword)
+        return null;
+    if (ts.isPrefixUnaryExpression(node) && node.operator === ts.SyntaxKind.MinusToken && ts.isNumericLiteral(node.operand)) {
+        return -Number(node.operand.text);
+    }
+    if (ts.isArrayLiteralExpression(node)) {
+        return node.elements.map((element) => {
+            if (ts.isSpreadElement(element))
+                throw new NonLiteral('spread element');
+            return evalLiteral(element);
+        });
+    }
+    if (ts.isObjectLiteralExpression(node)) {
+        const out = {};
+        for (const property of node.properties) {
+            if (!ts.isPropertyAssignment(property))
+                throw new NonLiteral('non-literal property');
+            const name = property.name;
+            const key = ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isNumericLiteral(name) ? name.text : undefined;
+            if (key === undefined)
+                throw new NonLiteral('computed property name');
+            out[key] = evalLiteral(property.initializer);
+        }
+        return out;
+    }
+    throw new NonLiteral(`${ts.SyntaxKind[node.kind]} is not a literal`);
+}
+/** The object literal a JS config exports: `module.exports = {...}`, `export default {...}` or a top-level const they name. */
+function exportedObject(sourceFile) {
+    const consts = new Map();
+    for (const statement of sourceFile.statements) {
+        if (!ts.isVariableStatement(statement))
+            continue;
+        for (const declaration of statement.declarationList.declarations) {
+            if (ts.isIdentifier(declaration.name) && declaration.initializer)
+                consts.set(declaration.name.text, declaration.initializer);
+        }
+    }
+    const resolve = (expression) => {
+        let current = expression;
+        while (ts.isParenthesizedExpression(current) || ts.isAsExpression(current) || ts.isSatisfiesExpression(current))
+            current = current.expression;
+        if (ts.isObjectLiteralExpression(current))
+            return current;
+        if (ts.isIdentifier(current)) {
+            const target = consts.get(current.text);
+            return target ? resolve(target) : undefined;
+        }
+        return undefined;
+    };
+    for (const statement of sourceFile.statements) {
+        if (ts.isExportAssignment(statement))
+            return resolve(statement.expression);
+        if (ts.isExpressionStatement(statement) &&
+            ts.isBinaryExpression(statement.expression) &&
+            statement.expression.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
+            ts.isPropertyAccessExpression(statement.expression.left) &&
+            ts.isIdentifier(statement.expression.left.expression) &&
+            statement.expression.left.expression.text === 'module' &&
+            statement.expression.left.name.text === 'exports') {
+            return resolve(statement.expression.right);
+        }
+    }
+    return undefined;
+}
+/** Elements of an array-literal property, one literal evaluation per element. */
+function elementsOf(object, key) {
+    for (const property of object.properties) {
+        if (!ts.isPropertyAssignment(property))
+            continue;
+        const name = property.name;
+        if (!(ts.isIdentifier(name) || ts.isStringLiteral(name)) || name.text !== key)
+            continue;
+        let init = property.initializer;
+        while (ts.isParenthesizedExpression(init) || ts.isAsExpression(init))
+            init = init.expression;
+        if (!ts.isArrayLiteralExpression(init))
+            return [{ node: init, error: `${key} is not an array literal` }];
+        return init.elements.map((node) => {
+            try {
+                if (ts.isSpreadElement(node))
+                    throw new NonLiteral('spread element');
+                return { node, value: evalLiteral(node) };
+            }
+            catch (err) {
+                const name = ts.isObjectLiteralExpression(node) ? scalar(node, 'name') : undefined;
+                return { node, error: err instanceof NonLiteral ? err.message : String(err), ...(typeof name === 'string' ? { name } : {}) };
+            }
+        });
+    }
+    return undefined;
+}
+function scalar(object, key) {
+    for (const property of object.properties) {
+        if (ts.isPropertyAssignment(property) && (ts.isIdentifier(property.name) || ts.isStringLiteral(property.name)) && property.name.text === key) {
+            try {
+                return evalLiteral(property.initializer);
+            }
+            catch {
+                return undefined;
+            }
+        }
+    }
+    return undefined;
+}
+const isObj = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+function patternList(value) {
+    if (typeof value === 'string')
+        return [value];
+    if (Array.isArray(value) && value.every((v) => typeof v === 'string'))
+        return value;
+    return undefined;
+}
+function pathSpec(value, label) {
+    if (value === undefined)
+        return {};
+    if (!isObj(value))
+        throw new NonLiteral(`${label} is not an object`);
+    const spec = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (key !== 'path' && key !== 'pathNot')
+            throw new NonLiteral(`${label}.${key} needs an installed project`);
+        const list = patternList(entry);
+        if (!list)
+            throw new NonLiteral(`${label}.${key} is not a string or list of strings`);
+        for (const pattern of list)
+            new RegExp(pattern);
+        spec[key] = entry;
+    }
+    return spec;
+}
+const LITERAL = '(?:[\\w@-]|\\\\\\.)+';
+const unescapeLiteral = (text) => text.replace(/\\\./g, '.').replace(/\\\//g, '/');
+/** The directories a regex pattern names, or undefined when it does not name any. */
+export function directoriesOf(pattern) {
+    const anywhere = new RegExp(`\\(\\^\\|\\\\?/\\)(${LITERAL})(?:\\\\?/)`).exec(pattern);
+    if (anywhere?.[1])
+        return [unescapeLiteral(anywhere[1])];
+    if (!pattern.startsWith('^'))
+        return undefined;
+    const group = new RegExp(`^\\^\\(((?:${LITERAL}(?:\\/${LITERAL})*)(?:\\|(?:${LITERAL}(?:\\/${LITERAL})*))*)\\)((?:\\/${LITERAL})*)(?:\\/|$)`).exec(pattern);
+    if (group?.[1])
+        return group[1].split('|').map((alt) => unescapeLiteral(`${alt}${group[2] ?? ''}`));
+    const literal = new RegExp(`^\\^(${LITERAL}(?:\\/${LITERAL})*)(?:\\/|$)`).exec(pattern);
+    if (literal?.[1])
+        return [unescapeLiteral(literal[1])];
+    return undefined;
+}
+function directorySet(value) {
+    const set = new Set();
+    for (const pattern of value === undefined ? [] : Array.isArray(value) ? value : [value]) {
+        for (const dir of directoriesOf(pattern) ?? [])
+            set.add(dir);
+    }
+    return set;
+}
+/** A direction rule: `from.path` and `to.path` both name directories and the two directory sets differ. */
+export function isDirectionRule(rule) {
+    const from = directorySet(rule.from.path);
+    const to = directorySet(rule.to.path);
+    if (from.size === 0 || to.size === 0)
+        return false;
+    return from.size !== to.size || [...from].some((dir) => !to.has(dir));
+}
+function rawPathSpec(value) {
+    if (!isObj(value))
+        return {};
+    const spec = {};
+    for (const key of ['path', 'pathNot']) {
+        const list = patternList(value[key]);
+        if (list)
+            spec[key] = value[key];
+    }
+    return spec;
+}
+const RULE_KEYS = new Set(['name', 'severity', 'comment', 'from', 'to']);
+/** Reads one rules file without executing it. Undefined when the file is absent or cannot be read. */
+export function readDeclaredConfig(repoPath, file, warnings = []) {
+    const text = readTracked(repoPath, file);
+    if (text === null)
+        return undefined;
+    const config = { file, forbidden: [], allowed: undefined, allowedSeverity: 'warn', declared: false };
+    let forbidden;
+    let allowed;
+    let allowedSeverity;
+    try {
+        if (file.endsWith('.json')) {
+            const doc = JSON.parse(text);
+            if (!isObj(doc))
+                throw new Error('not an object');
+            const wrap = (value) => (Array.isArray(value) ? value.map((v) => ({ value: v })) : undefined);
+            forbidden = wrap(doc.forbidden);
+            allowed = wrap(doc.allowed);
+            allowedSeverity = doc.allowedSeverity;
+            if (doc.options !== undefined || doc.extends !== undefined)
+                warnings.push(`${file}: "options" and "extends" are ignored`);
+        }
+        else {
+            const sourceFile = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
+            const object = exportedObject(sourceFile);
+            if (!object)
+                throw new Error('no module.exports or export default object literal');
+            forbidden = elementsOf(object, 'forbidden');
+            allowed = elementsOf(object, 'allowed');
+            allowedSeverity = scalar(object, 'allowedSeverity');
+            if (object.properties.some((p) => ts.isPropertyAssignment(p) && ts.isIdentifier(p.name) && (p.name.text === 'options' || p.name.text === 'extends'))) {
+                warnings.push(`${file}: "options" and "extends" are ignored`);
+            }
+        }
+    }
+    catch (err) {
+        warnings.push(`${file}: could not be read, treated as absent (${err instanceof Error ? err.message : String(err)})`);
+        return undefined;
+    }
+    const ruleName = (value, index, known) => known ?? (isObj(value) && typeof value.name === 'string' ? value.name : `#${index + 1}`);
+    (forbidden ?? []).forEach((entry, index) => {
+        if (entry.error !== undefined || !isObj(entry.value)) {
+            warnings.push(`${file}: forbidden rule ${ruleName(entry.value, index, entry.name)} skipped (${entry.error ?? 'not an object'})`);
+            return;
+        }
+        const rule = entry.value;
+        const raw = { from: rawPathSpec(rule.from), to: rawPathSpec(rule.to) };
+        if (isDirectionRule(raw))
+            config.declared = true;
+        try {
+            const extra = Object.keys(rule).find((key) => !RULE_KEYS.has(key));
+            if (extra !== undefined)
+                throw new NonLiteral(`rule key ${extra} needs an installed project`);
+            if (typeof rule.name !== 'string')
+                throw new NonLiteral('rule has no name');
+            const severity = rule.severity;
+            if (severity !== 'error' && severity !== 'warn' && severity !== 'info' && severity !== 'ignore')
+                throw new NonLiteral('unknown severity');
+            const from = pathSpec(rule.from, 'from');
+            const to = pathSpec(rule.to, 'to');
+            if (severity === 'error' || severity === 'warn')
+                config.forbidden.push({ name: rule.name, severity, from, to });
+        }
+        catch (err) {
+            warnings.push(`${file}: forbidden rule ${ruleName(rule, index)} skipped (${err instanceof Error ? err.message : String(err)})`);
+        }
+    });
+    if (allowed) {
+        const rules = [];
+        let complete = true;
+        allowed.forEach((entry, index) => {
+            if (entry.error !== undefined || !isObj(entry.value)) {
+                warnings.push(`${file}: allowed rule ${ruleName(entry.value, index, entry.name)} skipped (${entry.error ?? 'not an object'})`);
+                complete = false;
+                return;
+            }
+            const rule = entry.value;
+            const raw = { from: rawPathSpec(rule.from), to: rawPathSpec(rule.to) };
+            if (isDirectionRule(raw))
+                config.declared = true;
+            try {
+                const extra = Object.keys(rule).find((key) => !RULE_KEYS.has(key));
+                if (extra !== undefined)
+                    throw new NonLiteral(`rule key ${extra} needs an installed project`);
+                rules.push({ from: pathSpec(rule.from, 'from'), to: pathSpec(rule.to, 'to') });
+            }
+            catch (err) {
+                warnings.push(`${file}: allowed rule ${ruleName(rule, index)} skipped (${err instanceof Error ? err.message : String(err)})`);
+                complete = false;
+            }
+        });
+        if (!complete)
+            warnings.push(`${file}: the whole "allowed" list is dropped because one of its rules was skipped`);
+        const severity = allowedSeverity === undefined ? 'warn' : allowedSeverity;
+        if (severity === 'error' || severity === 'warn')
+            config.allowedSeverity = severity;
+        if (complete && rules.length > 0 && (severity === 'error' || severity === 'warn'))
+            config.allowed = rules;
+    }
+    return config;
+}
+/**
+ * The nearest rules file from `packageDir` upwards that declares at least one direction rule.
+ * Files that cannot be read, or that declare nothing, are passed over.
+ */
+export function findDeclaredConfig(repoPath, packageDir, warnings, cache) {
+    const tracked = new Set(trackedPaths(repoPath));
+    for (let dir = path.posix.normalize(packageDir === '' ? '.' : packageDir);; dir = path.posix.dirname(dir)) {
+        for (const name of CONFIG_NAMES) {
+            const file = path.posix.join(dir, name);
+            if (!tracked.has(file))
+                continue;
+            if (!cache.has(file)) {
+                cache.set(file, readDeclaredConfig(repoPath, file, warnings));
+            }
+            const config = cache.get(file);
+            if (config?.declared)
+                return config;
+        }
+        if (dir === '.' || dir === '')
+            return undefined;
+    }
+}

package/dist/measure/d3/ts/domain.js

@@ -0,0 +1,23 @@
+import path from 'node:path';
+import { callsGlobalFetch, classifyImports, packageName } from './classify.js';
+/** Logic files with a directory named exactly `domain` anywhere in their path. */
+export function isDomainFile(file) {
+    return path.posix.dirname(file).split('/').includes('domain');
+}
+function inInfrastructure(file, directories) {
+    if (isDomainFile(file))
+        return false;
+    return path.posix.dirname(file).split('/').some((segment) => directories.includes(segment));
+}
+/**
+ * A domain file is impure when it imports a forbidden package (type-only included), imports an in-scope
+ * file under an infrastructure directory (unless that file is itself under `domain`), or calls the global `fetch`.
+ */
+export function isImpure(sourceFile, importedFiles, lists) {
+    const forbidden = new Set(lists.forbiddenImports.typescript_javascript);
+    if (classifyImports(sourceFile).some((occurrence) => forbidden.has(packageName(occurrence.specifier))))
+        return true;
+    if (importedFiles.some((file) => inInfrastructure(file, lists.infrastructureDirectories)))
+        return true;
+    return callsGlobalFetch(sourceFile);
+}

package/dist/measure/d3/ts/rules.js

@@ -0,0 +1,65 @@
+const escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+function emit(node) {
+    const alternatives = [];
+    for (const [segment, child] of node.children) {
+        const rest = child.children.size > 0 ? `(?:/${emit(child)})${child.end ? '?' : ''}` : '';
+        alternatives.push(`${escape(segment)}${rest}`);
+    }
+    return alternatives.length === 1 ? alternatives[0] : `(?:${alternatives.join('|')})`;
+}
+/** An anchored regex that matches exactly the given repo-relative paths, built from a segment trie. */
+export function pathsToRegex(paths) {
+    const root = { children: new Map(), end: false };
+    for (const file of paths) {
+        let node = root;
+        for (const segment of file.split('/')) {
+            let child = node.children.get(segment);
+            if (!child) {
+                child = { children: new Map(), end: false };
+                node.children.set(segment, child);
+            }
+            node = child;
+        }
+        node.end = true;
+    }
+    return `^${emit(root)}$`;
+}
+/** Package names as a regex that also matches an import below the package (`pkg/sub`). */
+export function packagesToRegex(packages) {
+    return `^(?:${packages.map(escape).join('|')})(?:/|$)`;
+}
+/**
+ * Preset rules as dependency-cruiser rules for one unit. `layerFiles` maps a layer name to the
+ * unit's files in it; `unitFiles` is every in-scope file of the unit. One rule per (preset rule,
+ * `to` alternative), named `<package>:<rule>` with a `#packages` suffix on the packages alternative.
+ */
+export function presetRules(packageDir, rules, layerFiles, unitFiles) {
+    const out = [];
+    const meta = new Map();
+    const union = (names) => [...new Set(names.flatMap((n) => [...(layerFiles.get(n) ?? [])]))];
+    for (const rule of rules) {
+        if (rule.severity === 'info')
+            continue;
+        let fromFiles;
+        if (rule.from.in)
+            fromFiles = union(rule.from.in);
+        else {
+            const excluded = new Set(union(rule.from.not_in ?? []));
+            fromFiles = unitFiles.filter((f) => !excluded.has(f));
+        }
+        if (fromFiles.length === 0)
+            continue;
+        const from = { path: pathsToRegex(fromFiles) };
+        const base = `${packageDir}:${rule.name}`;
+        const toFiles = rule.to.in ? union(rule.to.in) : [];
+        const add = (name, to) => {
+            out.push({ name, severity: rule.severity, from, to });
+            meta.set(name, { rule: rule.name, excludesTypeOnly: rule.type_only_imports === 'excluded' });
+        };
+        if (toFiles.length > 0)
+            add(base, { path: pathsToRegex(toFiles) });
+        if (rule.to.packages && rule.to.packages.length > 0)
+            add(`${base}#packages`, { path: packagesToRegex(rule.to.packages) });
+    }
+    return { rules: out, meta };
+}

package/dist/measure/d3/types.js

@@ -0,0 +1,5 @@
+export const edgeKey = (from, to) => `${from}\u0000${to}`;
+/** Edges of the unit that count for 3.2: importer is not a test file. */
+export function internalEdges(unit) {
+    return unit.edges.filter((edge) => !edge.fromTest);
+}

package/dist/measure/deps/cvss.js

@@ -0,0 +1,66 @@
+/** CVSS v3.0 and v3.1 base score from a vector string. Other versions give undefined. */
+const WEIGHTS = {
+    AV: { N: 0.85, A: 0.62, L: 0.55, P: 0.2 },
+    AC: { L: 0.77, H: 0.44 },
+    UI: { N: 0.85, R: 0.62 },
+    CIA: { H: 0.56, L: 0.22, N: 0 },
+};
+function pr(value, changed) {
+    if (value === 'N')
+        return 0.85;
+    if (value === 'L')
+        return changed ? 0.68 : 0.62;
+    if (value === 'H')
+        return changed ? 0.5 : 0.27;
+    return undefined;
+}
+/** Smallest number, to one decimal, that is >= the input (CVSS v3.1 Roundup). */
+function roundUp(input) {
+    const int = Math.round(input * 100000);
+    if (int % 10000 === 0)
+        return int / 100000;
+    return (Math.floor(int / 10000) + 1) / 10;
+}
+export function cvss3BaseScore(vector) {
+    const parts = vector.trim().split('/');
+    if (parts[0] !== 'CVSS:3.0' && parts[0] !== 'CVSS:3.1')
+        return undefined;
+    const metrics = new Map();
+    for (const part of parts.slice(1)) {
+        const [key, value] = part.split(':');
+        if (key && value)
+            metrics.set(key, value);
+    }
+    const get = (key) => metrics.get(key) ?? '';
+    const scope = get('S');
+    if (scope !== 'U' && scope !== 'C')
+        return undefined;
+    const changed = scope === 'C';
+    const av = WEIGHTS.AV[get('AV')];
+    const ac = WEIGHTS.AC[get('AC')];
+    const ui = WEIGHTS.UI[get('UI')];
+    const c = WEIGHTS.CIA[get('C')];
+    const i = WEIGHTS.CIA[get('I')];
+    const a = WEIGHTS.CIA[get('A')];
+    const priv = pr(get('PR'), changed);
+    if ([av, ac, ui, c, i, a, priv].some((n) => n === undefined))
+        return undefined;
+    const iss = 1 - (1 - (c ?? 0)) * (1 - (i ?? 0)) * (1 - (a ?? 0));
+    const impact = changed ? 7.52 * (iss - 0.029) - 3.25 * (iss - 0.02) ** 15 : 6.42 * iss;
+    if (impact <= 0)
+        return 0;
+    const exploitability = 8.22 * (av ?? 0) * (ac ?? 0) * (priv ?? 0) * (ui ?? 0);
+    const raw = changed ? Math.min(1.08 * (impact + exploitability), 10) : Math.min(impact + exploitability, 10);
+    return roundUp(raw);
+}
+export function band(score) {
+    if (score >= 9)
+        return 'critical';
+    if (score >= 7)
+        return 'high';
+    if (score >= 4)
+        return 'moderate';
+    if (score > 0)
+        return 'low';
+    return 'none';
+}

package/dist/measure/deps/declared.js

@@ -0,0 +1,195 @@
+import path from 'node:path';
+import semver from 'semver';
+import { isValidSpecifier, normalizeName, poetryToPep440 } from '../../util/pep440.js';
+import { readToml } from '../../util/toml.js';
+import { joinRel, readTrackedText, trackedIn, trackedSet } from './files.js';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+// ---- npm --------------------------------------------------------------------------------
+function npmManifest(repoPath, pkg) {
+    const file = joinRel(pkg, 'package.json');
+    const text = readTrackedText(repoPath, file);
+    if (text === null)
+        return undefined;
+    const warnings = [];
+    let json;
+    try {
+        json = record(JSON.parse(text));
+    }
+    catch {
+        warnings.push(`${file}: invalid JSON, ignored`);
+    }
+    const deps = [];
+    const sections = [
+        ['dependencies', false],
+        ['devDependencies', true],
+        ['optionalDependencies', false],
+    ];
+    for (const [section, dev] of sections) {
+        const optional = section === 'optionalDependencies';
+        for (const [name, spec] of Object.entries(record(json?.[section]) ?? {})) {
+            if (typeof spec !== 'string')
+                continue;
+            deps.push({ name, spec, dev, registry: semver.validRange(spec) !== null, ...(optional ? { optional } : {}) });
+        }
+    }
+    return { file, kind: 'package.json', deps, warnings };
+}
+// ---- Python -----------------------------------------------------------------------------
+/** One PEP 508 requirement string, or undefined when it is not a requirement. */
+function parseRequirement(line, dev) {
+    const withoutMarker = (line.split(';')[0] ?? '').trim();
+    const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*(.*)$/.exec(withoutMarker);
+    if (!m?.[1])
+        return undefined;
+    let rest = (m[2] ?? '').trim();
+    if (rest.startsWith('@'))
+        return { name: normalizeName(m[1]), spec: '', dev, registry: false };
+    if (rest.startsWith('(') && rest.endsWith(')'))
+        rest = rest.slice(1, -1).trim();
+    rest = rest.replace(/\s+/g, '');
+    if (!isValidSpecifier(rest))
+        return undefined;
+    return { name: normalizeName(m[1]), spec: rest, dev, registry: true };
+}
+function requirementList(value, dev) {
+    if (!Array.isArray(value))
+        return [];
+    const found = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string')
+            continue; // include-group tables are skipped
+        const dep = parseRequirement(entry, dev);
+        if (dep)
+            found.push(dep);
+    }
+    return found;
+}
+function groupedLists(value, dev) {
+    return Object.values(record(value) ?? {}).flatMap((list) => requirementList(list, dev));
+}
+function poetryTable(value, dev) {
+    const found = [];
+    for (const [rawName, entry] of Object.entries(record(value) ?? {})) {
+        if (rawName.toLowerCase() === 'python')
+            continue;
+        const name = normalizeName(rawName);
+        const first = Array.isArray(entry) ? entry[0] : entry;
+        if (typeof first === 'string') {
+            found.push({ name, spec: poetryToPep440(first), dev, registry: true });
+            continue;
+        }
+        const table = record(first);
+        const version = table?.version;
+        const nonRegistry = table === undefined || table.git !== undefined || table.path !== undefined || table.url !== undefined;
+        if (nonRegistry || typeof version !== 'string')
+            found.push({ name, spec: '', dev, registry: false });
+        else
+            found.push({ name, spec: poetryToPep440(version), dev, registry: true });
+    }
+    return found;
+}
+function pyprojectDeps(doc) {
+    const project = record(doc.project);
+    const tool = record(doc.tool);
+    const poetry = record(tool?.poetry);
+    const uv = record(tool?.uv);
+    const pdm = record(tool?.pdm);
+    const sections = [];
+    let present = false;
+    const take = (value, make) => {
+        if (value !== undefined) {
+            present = true;
+            sections.push(make());
+        }
+    };
+    take(project?.dependencies, () => requirementList(project?.dependencies, false));
+    take(project?.['optional-dependencies'], () => groupedLists(project?.['optional-dependencies'], true));
+    take(doc['dependency-groups'], () => groupedLists(doc['dependency-groups'], true));
+    take(uv?.['dev-dependencies'], () => requirementList(uv?.['dev-dependencies'], true));
+    take(poetry?.dependencies, () => poetryTable(poetry?.dependencies, false));
+    take(poetry?.['dev-dependencies'], () => poetryTable(poetry?.['dev-dependencies'], true));
+    for (const group of Object.values(record(poetry?.group) ?? {})) {
+        take(record(group)?.dependencies, () => poetryTable(record(group)?.dependencies, true));
+    }
+    take(pdm?.['dev-dependencies'], () => groupedLists(pdm?.['dev-dependencies'], true));
+    return present ? sections.flat() : undefined;
+}
+function pipfileDeps(doc) {
+    const found = [];
+    for (const [section, dev] of [['packages', false], ['dev-packages', true]]) {
+        for (const [rawName, entry] of Object.entries(record(doc[section]) ?? {})) {
+            const name = normalizeName(rawName);
+            if (typeof entry === 'string') {
+                found.push({ name, spec: entry === '*' ? '' : entry.replace(/\s+/g, ''), dev, registry: isValidSpecifier(entry === '*' ? '' : entry.replace(/\s+/g, '')) });
+                continue;
+            }
+            const version = record(entry)?.version;
+            if (typeof version === 'string') {
+                const spec = version === '*' ? '' : version.replace(/\s+/g, '');
+                found.push({ name, spec, dev, registry: isValidSpecifier(spec) });
+            }
+            else
+                found.push({ name, spec: '', dev, registry: false });
+        }
+    }
+    return found;
+}
+/** Requirement lines of a requirements file: comments, options and hash continuations removed. */
+export function requirementLines(text) {
+    const joined = text.replace(/\\\r?\n/g, ' ');
+    const lines = [];
+    for (const raw of joined.split(/\r?\n/)) {
+        const line = raw.replace(/(^|\s)#.*$/, '').trim();
+        if (line === '' || line.startsWith('-'))
+            continue;
+        const hashed = /--hash[=\s]/.test(line);
+        const clean = line.replace(/\s--\S+(?:[= ]\S+)?/g, '').trim();
+        lines.push({ line: clean, hashed });
+    }
+    return lines;
+}
+export function requirementFiles(repoPath, pkg) {
+    return trackedIn(repoPath, pkg === '.' ? '' : pkg).filter((f) => /^requirements.*\.txt$/.test(path.posix.basename(f)));
+}
+function pythonManifest(repoPath, pkg) {
+    const warnings = [];
+    const dir = pkg === '.' ? '' : pkg;
+    const pyprojectFile = joinRel(dir, 'pyproject.toml');
+    const requirements = () => {
+        const found = new Map();
+        for (const file of requirementFiles(repoPath, pkg)) {
+            const text = readTrackedText(repoPath, file) ?? '';
+            for (const { line } of requirementLines(text)) {
+                const dep = parseRequirement(line, false);
+                if (dep && !found.has(dep.name))
+                    found.set(dep.name, dep);
+            }
+        }
+        return [...found.values()];
+    };
+    if (trackedSet(repoPath).has(pyprojectFile)) {
+        const doc = readToml(path.join(path.resolve(repoPath), pyprojectFile));
+        if (doc === undefined)
+            warnings.push(`${pyprojectFile}: invalid TOML, ignored`);
+        const deps = doc ? pyprojectDeps(doc) : undefined;
+        return { file: pyprojectFile, kind: 'pyproject.toml', deps: deps ?? requirements(), warnings };
+    }
+    const pipfile = joinRel(dir, 'Pipfile');
+    if (trackedSet(repoPath).has(pipfile)) {
+        const doc = readToml(path.join(path.resolve(repoPath), pipfile));
+        if (doc === undefined)
+            warnings.push(`${pipfile}: invalid TOML, ignored`);
+        return { file: pipfile, kind: 'Pipfile', deps: pipfileDeps(doc ?? {}), warnings };
+    }
+    const files = requirementFiles(repoPath, pkg);
+    const first = files[0];
+    if (first === undefined)
+        return undefined;
+    return { file: first, kind: 'requirements', deps: requirements(), warnings };
+}
+/** The unit's declared direct dependencies, or undefined when its package directory has no manifest. */
+export function readManifest(repoPath, pkg, group) {
+    return group === 'python' ? pythonManifest(repoPath, pkg) : npmManifest(repoPath, pkg);
+}