vibecodedshit 0.0.0-stage → 0.2.0

package/dist/measure/deps/files.js

@@ -0,0 +1,40 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { trackedPaths } from '../../scope/tracked.js';
+const sets = new Map();
+export function trackedSet(repoPath) {
+    const key = path.resolve(repoPath);
+    const cached = sets.get(key);
+    if (cached)
+        return cached;
+    const made = new Set(trackedPaths(key));
+    sets.set(key, made);
+    return made;
+}
+export function joinRel(...parts) {
+    return parts.filter((p) => p !== '' && p !== '.').join('/');
+}
+/** Text of a tracked file of any size, or null when it is not tracked or unreadable. */
+export function readTrackedText(repoPath, rel) {
+    if (!trackedSet(repoPath).has(rel))
+        return null;
+    try {
+        return readFileSync(path.join(path.resolve(repoPath), rel), 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/** Tracked files that sit directly in `dir` ('' for the repository root). */
+export function trackedIn(repoPath, dir) {
+    const prefix = dir === '' ? '' : `${dir}/`;
+    const found = [];
+    for (const file of trackedSet(repoPath)) {
+        if (!file.startsWith(prefix))
+            continue;
+        if (file.slice(prefix.length).includes('/'))
+            continue;
+        found.push(file);
+    }
+    return found.sort();
+}

package/dist/measure/deps/lockfiles.js

@@ -0,0 +1,308 @@
+import path from 'node:path';
+import semver from 'semver';
+import ts from 'typescript';
+import { parse as parseYaml } from 'yaml';
+import { normalizeName, satisfies as pySatisfies } from '../../util/pep440.js';
+import { readToml } from '../../util/toml.js';
+import { requirementLines } from './declared.js';
+import { readTrackedText, trackedIn } from './files.js';
+export function kindGroup(kind) {
+    return ['uv', 'poetry', 'pdm', 'pipfile', 'requirements'].includes(kind) ? 'python' : 'typescript_javascript';
+}
+const NAMED = {
+    'package-lock.json': 'package-lock',
+    'npm-shrinkwrap.json': 'npm-shrinkwrap',
+    'pnpm-lock.yaml': 'pnpm',
+    'yarn.lock': 'yarn',
+    'bun.lock': 'bun',
+    'uv.lock': 'uv',
+    'poetry.lock': 'poetry',
+    'pdm.lock': 'pdm',
+    'Pipfile.lock': 'pipfile',
+};
+/**
+ * JS lockfiles in the install step's preference order. With several in one directory, the first one
+ * present is the one that gets installed, so D5 reads that one too. `bun.lockb` is binary: install
+ * uses it, D5 cannot read it.
+ */
+const JS_LOCK_ORDER = ['pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb', 'npm-shrinkwrap.json', 'package-lock.json'];
+/** The JS lockfile names among `names`, in preference order. */
+export function jsLockfiles(names) {
+    const present = new Set(names);
+    return JS_LOCK_ORDER.filter((name) => present.has(name));
+}
+/** The one JS lockfile the install step and D5 use, among the file names of one directory. */
+export function chooseJsLockfile(names) {
+    return jsLockfiles(names)[0];
+}
+const MISSING = { present: false, versions: [], specifierOk: true };
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function str(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+function found(version, specifierOk = true) {
+    return { present: true, versions: version === undefined ? [] : [version], specifierOk };
+}
+// ---- npm --------------------------------------------------------------------------------
+function npmReader(json) {
+    const packages = record(json.packages);
+    const tree = record(json.dependencies);
+    return {
+        lookup(dep, pkgDir) {
+            if (packages) {
+                let dir = pkgDir;
+                for (;;) {
+                    const entry = record(packages[dir === '' ? `node_modules/${dep.name}` : `${dir}/node_modules/${dep.name}`]);
+                    if (entry) {
+                        const target = entry.link === true ? record(packages[str(entry.resolved) ?? '']) : undefined;
+                        return found(str(target?.version) ?? str(entry.version));
+                    }
+                    if (dir === '')
+                        break;
+                    dir = dir.includes('/') ? dir.slice(0, dir.lastIndexOf('/')) : '';
+                }
+                return MISSING;
+            }
+            const entry = record(tree?.[dep.name]);
+            return entry ? found(str(entry.version)) : MISSING;
+        },
+    };
+}
+// ---- pnpm -------------------------------------------------------------------------------
+function pnpmVersion(raw) {
+    if (raw.startsWith('link:') || raw.startsWith('file:'))
+        return undefined;
+    return raw.replace(/\(.*$/, '').replace(/_.*$/, '');
+}
+function pnpmReader(doc) {
+    const importers = record(doc.importers);
+    return {
+        lookup(dep, pkgDir) {
+            const section = importers ? record(importers[pkgDir === '' ? '.' : pkgDir]) : doc;
+            if (!section)
+                return MISSING;
+            const specifiers = record(section.specifiers);
+            for (const key of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+                const entry = record(section[key])?.[dep.name];
+                if (entry === undefined)
+                    continue;
+                if (typeof entry === 'string')
+                    return found(pnpmVersion(entry), str(specifiers?.[dep.name]) === dep.spec);
+                const table = record(entry);
+                const version = str(table?.version);
+                return found(version === undefined ? undefined : pnpmVersion(version), str(table?.specifier) === dep.spec);
+            }
+            return MISSING;
+        },
+    };
+}
+// ---- yarn -------------------------------------------------------------------------------
+function yarnReader(text) {
+    const entries = new Map();
+    const names = new Set();
+    let keys = [];
+    for (const line of text.split(/\r?\n/)) {
+        if (line === '' || line.startsWith('#'))
+            continue;
+        if (!/^\s/.test(line)) {
+            keys = [];
+            if (!line.endsWith(':') || line.startsWith('__metadata'))
+                continue;
+            for (const part of line.slice(0, -1).split(',')) {
+                const key = part.trim().replace(/^"|"$/g, '');
+                const at = key.indexOf('@', 1);
+                if (at === -1)
+                    continue;
+                const name = key.slice(0, at);
+                const range = key.slice(at + 1).replace(/^npm:/, '');
+                names.add(name);
+                keys.push(`${name}@${range}`);
+                entries.set(`${name}@${range}`, undefined);
+            }
+            continue;
+        }
+        const m = /^\s+version:?\s+"?([^"\s]+)"?\s*$/.exec(line);
+        if (m?.[1])
+            for (const key of keys)
+                entries.set(key, m[1]);
+    }
+    return {
+        lookup(dep) {
+            if (!dep.registry)
+                return names.has(dep.name) ? found(undefined) : MISSING;
+            const key = `${dep.name}@${dep.spec}`;
+            return entries.has(key) ? found(entries.get(key)) : MISSING;
+        },
+    };
+}
+// ---- bun --------------------------------------------------------------------------------
+function bunReader(doc) {
+    const workspaces = record(doc.workspaces);
+    const packages = record(doc.packages);
+    return {
+        lookup(dep, pkgDir) {
+            const workspace = record(workspaces?.[pkgDir]);
+            let specifier;
+            for (const key of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+                specifier ??= str(record(workspace?.[key])?.[dep.name]);
+            }
+            const tuple = packages?.[dep.name];
+            if (specifier === undefined && tuple === undefined)
+                return MISSING;
+            const id = Array.isArray(tuple) ? str(tuple[0]) : undefined;
+            const version = id !== undefined && id.lastIndexOf('@') > 0 ? id.slice(id.lastIndexOf('@') + 1) : undefined;
+            return found(version, specifier === undefined || specifier === dep.spec);
+        },
+    };
+}
+// ---- Python -----------------------------------------------------------------------------
+function tomlReader(absPath) {
+    const doc = readToml(absPath);
+    if (!doc || !Array.isArray(doc.package))
+        return undefined;
+    const byName = new Map();
+    for (const entry of doc.package) {
+        const table = record(entry);
+        const name = str(table?.name);
+        if (name === undefined)
+            continue;
+        const version = str(table?.version);
+        const list = byName.get(normalizeName(name)) ?? [];
+        if (version !== undefined)
+            list.push(version);
+        byName.set(normalizeName(name), list);
+    }
+    return {
+        lookup(dep) {
+            const versions = byName.get(dep.name);
+            return versions === undefined ? MISSING : { present: true, versions, specifierOk: true };
+        },
+    };
+}
+function pipfileLockReader(json) {
+    return {
+        lookup(dep) {
+            for (const section of ['default', 'develop']) {
+                for (const [rawName, entry] of Object.entries(record(json[section]) ?? {})) {
+                    if (normalizeName(rawName) !== dep.name)
+                        continue;
+                    const version = str(record(entry)?.version)?.replace(/^==/, '');
+                    return found(version);
+                }
+            }
+            return MISSING;
+        },
+    };
+}
+/** `name==version` for every requirement of a hashed, fully pinned requirements file, else undefined. */
+function pinnedRequirements(text) {
+    const lines = requirementLines(text);
+    if (lines.length === 0)
+        return undefined;
+    const pinned = new Map();
+    for (const { line, hashed } of lines) {
+        const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*==\s*([^\s;=!<>~,]+)\s*(?:;.*)?$/.exec(line);
+        if (!hashed || !m?.[1] || !m[2] || m[2].endsWith('.*'))
+            return undefined;
+        pinned.set(normalizeName(m[1]), m[2]);
+    }
+    return pinned;
+}
+function requirementsReader(pinned) {
+    return {
+        lookup(dep) {
+            const version = pinned.get(dep.name);
+            return version === undefined ? MISSING : found(version);
+        },
+    };
+}
+// ---- search and parse -------------------------------------------------------------------
+/**
+ * Lockfiles of the unit's group in the nearest directory (the package directory, then each
+ * ancestor) that holds any. Every kind found in that directory is a candidate.
+ */
+export function findLockfiles(repoPath, pkg, group) {
+    let dir = pkg === '.' ? '' : pkg;
+    for (;;) {
+        const candidates = [];
+        for (const file of trackedIn(repoPath, dir)) {
+            const base = path.posix.basename(file);
+            const kind = NAMED[base];
+            if (kind !== undefined && kindGroup(kind) === group)
+                candidates.push({ path: file, dir, kind });
+            else if (group === 'python' && /^requirements.*\.txt$/.test(base)) {
+                const text = readTrackedText(repoPath, file);
+                if (text !== null && pinnedRequirements(text) !== undefined)
+                    candidates.push({ path: file, dir, kind: 'requirements' });
+            }
+        }
+        if (candidates.length > 0)
+            return candidates;
+        if (dir === '')
+            return [];
+        dir = dir.includes('/') ? dir.slice(0, dir.lastIndexOf('/')) : '';
+    }
+}
+function parseJson(text) {
+    try {
+        return record(JSON.parse(text));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Parse a lockfile. Undefined when it cannot be read or parsed (it then counts as out of sync). */
+export function readLockfile(repoPath, ref) {
+    const text = readTrackedText(repoPath, ref.path);
+    if (text === null)
+        return undefined;
+    const abs = path.join(path.resolve(repoPath), ref.path);
+    switch (ref.kind) {
+        case 'package-lock':
+        case 'npm-shrinkwrap': {
+            const json = parseJson(text);
+            return json ? npmReader(json) : undefined;
+        }
+        case 'pnpm': {
+            try {
+                const doc = record(parseYaml(text));
+                return doc ? pnpmReader(doc) : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        }
+        case 'yarn':
+            return yarnReader(text);
+        case 'bun': {
+            const parsed = ts.parseConfigFileTextToJson(ref.path, text);
+            const doc = record(parsed.config);
+            return doc ? bunReader(doc) : undefined;
+        }
+        case 'uv':
+        case 'poetry':
+        case 'pdm':
+            return tomlReader(abs);
+        case 'pipfile': {
+            const json = parseJson(text);
+            return json ? pipfileLockReader(json) : undefined;
+        }
+        case 'requirements': {
+            const pinned = pinnedRequirements(text);
+            return pinned ? requirementsReader(pinned) : undefined;
+        }
+    }
+}
+export function entrySatisfies(dep, entry, group) {
+    if (!entry.present)
+        return false;
+    if (!dep.registry)
+        return true;
+    if (!entry.specifierOk)
+        return false;
+    if (group === 'python')
+        return entry.versions.some((v) => pySatisfies(v, dep.spec));
+    return entry.versions.some((v) => semver.satisfies(v, dep.spec, { includePrerelease: true }));
+}

package/dist/measure/deps/osv.js

@@ -0,0 +1,122 @@
+import { band, cvss3BaseScore } from './cvss.js';
+const POINTS = { critical: 10, high: 5, moderate: 2, low: 0.5, none: 0 };
+const LABELS = {
+    CRITICAL: 'critical',
+    HIGH: 'high',
+    MODERATE: 'moderate',
+    MEDIUM: 'moderate',
+    LOW: 'low',
+};
+export function endOfDay(asOf) {
+    return Date.parse(`${asOf}T23:59:59.999Z`);
+}
+/** Published at or before the end of the as-of day (no `published` is kept) and not withdrawn. */
+function counts(record, asOf) {
+    if (record.withdrawn !== undefined && record.withdrawn !== '')
+        return false;
+    if (record.published === undefined)
+        return true;
+    const published = Date.parse(record.published);
+    return Number.isNaN(published) || published <= endOfDay(asOf);
+}
+const ORDER = ['none', 'low', 'moderate', 'high', 'critical'];
+function highest(values) {
+    return values.reduce((top, v) => (top === undefined || ORDER.indexOf(v) > ORDER.indexOf(top) ? v : top), undefined);
+}
+/** Methodology 5.1 order: GHSA label, then CVSS v3.x base score band, then moderate. */
+function groupSeverity(records) {
+    const labelled = records
+        .map((r) => LABELS[(r.database_specific?.severity ?? '').toUpperCase()])
+        .filter((s) => s !== undefined);
+    const label = highest(labelled);
+    if (label !== undefined)
+        return label;
+    const scored = [];
+    for (const record of records) {
+        for (const entry of record.severity ?? []) {
+            if (entry.type !== 'CVSS_V3' || !entry.score?.startsWith('CVSS:3.'))
+                continue;
+            const score = cvss3BaseScore(entry.score);
+            if (score !== undefined)
+                scored.push(band(score));
+        }
+    }
+    return highest(scored) ?? 'moderate';
+}
+/** Group the records of one package into advisories by alias closure. */
+function advisories(records) {
+    const parent = new Map();
+    const find = (x) => {
+        let root = parent.get(x) ?? x;
+        while ((parent.get(root) ?? root) !== root)
+            root = parent.get(root) ?? root;
+        parent.set(x, root);
+        return root;
+    };
+    const union = (a, b) => {
+        const ra = find(a);
+        const rb = find(b);
+        if (ra !== rb)
+            parent.set(ra, rb);
+    };
+    for (const r of records) {
+        find(r.id);
+        for (const alias of r.aliases ?? [])
+            union(r.id, alias);
+    }
+    const groups = new Map();
+    for (const r of records) {
+        const root = find(r.id);
+        groups.set(root, [...(groups.get(root) ?? []), r]);
+    }
+    return [...groups.values()];
+}
+/** Severity points of the advisories that count at the as-of date. Each advisory counts once per package. */
+export function severityPoints(packages, asOf) {
+    const found = [];
+    for (const pkg of packages) {
+        const records = pkg.vulnerabilities.filter((r) => counts(r, asOf));
+        for (const group of advisories(records)) {
+            const severity = groupSeverity(group);
+            const first = group[0];
+            if (!first)
+                continue;
+            found.push({ name: pkg.name, version: pkg.version, dev: pkg.dev, id: first.id, severity, points: POINTS[severity] });
+        }
+    }
+    return { points: found.reduce((sum, a) => sum + a.points, 0), advisories: found };
+}
+/** Packages of an osv-scanner JSON report. Undefined when the shape is not recognised. */
+export function parseOsvReport(text) {
+    let json;
+    try {
+        json = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    const results = json?.results;
+    if (results === null || results === undefined)
+        return [];
+    if (!Array.isArray(results))
+        return undefined;
+    const found = [];
+    for (const result of results) {
+        if (!Array.isArray(result?.packages))
+            continue;
+        for (const entry of result.packages) {
+            const { name, version, ecosystem } = entry.package ?? {};
+            if (typeof name !== 'string' || typeof version !== 'string')
+                return undefined;
+            const groups = Array.isArray(entry.dependency_groups) ? entry.dependency_groups : [];
+            found.push({
+                name,
+                version,
+                ecosystem: typeof ecosystem === 'string' ? ecosystem : '',
+                dev: groups.includes('dev'),
+                vulnerabilities: Array.isArray(entry.vulnerabilities) ? entry.vulnerabilities : [],
+            });
+        }
+    }
+    return found;
+}

package/dist/measure/deps/registry.js

@@ -0,0 +1,142 @@
+import semver from 'semver';
+import { compareVersions, isStable, normalizeName, parseVersion } from '../../util/pep440.js';
+import { endOfDay } from './osv.js';
+/** Anything but a 404: the registry could not be read. */
+export class RegistryError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RegistryError';
+    }
+}
+const TIMEOUT_MS = 20_000;
+export const CONCURRENCY = 8;
+async function getJson(ctx, url) {
+    let lastError = 'unknown error';
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const response = await ctx.tools.fetch(url, { signal: AbortSignal.timeout(TIMEOUT_MS) });
+            if (response.status === 404)
+                return 'not_found';
+            if (!response.ok) {
+                lastError = `HTTP ${response.status}`;
+                continue;
+            }
+            return (await response.json());
+        }
+        catch (err) {
+            lastError = err instanceof Error ? err.message : String(err);
+        }
+    }
+    throw new RegistryError(`registry request ${url} failed: ${lastError}`);
+}
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function npmVersions(doc) {
+    const time = record(doc.time) ?? {};
+    const found = [];
+    for (const version of Object.keys(record(doc.versions) ?? {})) {
+        const published = typeof time[version] === 'string' ? Date.parse(time[version]) : Number.NaN;
+        if (!Number.isNaN(published))
+            found.push({ version, time: published, yanked: false });
+    }
+    return found;
+}
+function pypiVersions(doc) {
+    const found = [];
+    for (const [version, files] of Object.entries(record(doc.releases) ?? {})) {
+        if (!Array.isArray(files) || files.length === 0)
+            continue;
+        const entries = files.map((f) => record(f)).filter((f) => f !== undefined);
+        const times = entries
+            .map((f) => (typeof f.upload_time_iso_8601 === 'string' ? Date.parse(f.upload_time_iso_8601) : Number.NaN))
+            .filter((t) => !Number.isNaN(t));
+        if (times.length === 0)
+            continue;
+        found.push({ version, time: Math.min(...times), yanked: entries.every((f) => f.yanked === true) });
+    }
+    return found;
+}
+/** Registry data for one package, memoized per scan. `null` when the registry has no such package (404). */
+export function fetchRegistry(ctx, group, name) {
+    const key = group === 'python' ? `pypi:${normalizeName(name)}` : `npm:${name}`;
+    return ctx.tools.memo(key, async () => {
+        const url = group === 'python'
+            ? `https://pypi.org/pypi/${encodeURIComponent(normalizeName(name))}/json`
+            : `https://registry.npmjs.org/${name.startsWith('@') ? name.replace('/', '%2F') : encodeURIComponent(name)}`;
+        const doc = await getJson(ctx, url);
+        if (doc === 'not_found')
+            return null;
+        if (!doc)
+            throw new RegistryError(`registry request ${url} returned no document`);
+        return { versions: group === 'python' ? pypiVersions(doc) : npmVersions(doc) };
+    });
+}
+/** Highest stable, non-yanked version published at or before the end of the as-of day. */
+export function latestStable(data, group, asOf) {
+    const limit = endOfDay(asOf);
+    const candidates = data.versions.filter((v) => !v.yanked && v.time <= limit);
+    if (group === 'python') {
+        let top;
+        for (const { version } of candidates) {
+            const parsed = parseVersion(version);
+            if (!parsed || !isStable(parsed))
+                continue;
+            if (!top || compareVersions(parsed, top.parsed) > 0)
+                top = { text: version, parsed };
+        }
+        return top?.text;
+    }
+    return candidates
+        .map((v) => v.version)
+        .filter((v) => semver.valid(v) !== null && semver.prerelease(v) === null)
+        .sort(semver.compare)
+        .pop();
+}
+function parts(version, group) {
+    if (group === 'python') {
+        const parsed = parseVersion(version);
+        if (!parsed)
+            return undefined;
+        return {
+            release: parsed.release,
+            cmp: (other) => {
+                const o = parseVersion(other);
+                return o ? compareVersions(parsed, o) : 0;
+            },
+        };
+    }
+    const parsed = semver.parse(version);
+    if (!parsed)
+        return undefined;
+    return { release: [parsed.major, parsed.minor, parsed.patch], cmp: (other) => semver.compare(version, other) };
+}
+/** At least one major behind; for 0.x a minor bump counts as a major. A resolved version newer than latest is not behind. */
+export function isMajorBehind(resolved, latest, group) {
+    const r = parts(resolved, group);
+    const l = parts(latest, group);
+    if (!r || !l)
+        return false;
+    if (r.cmp(latest) >= 0)
+        return false;
+    const [rMajor = 0, rMinor = 0] = r.release;
+    const [lMajor = 0, lMinor = 0] = l.release;
+    if (lMajor > rMajor)
+        return true;
+    return rMajor === 0 && lMajor === 0 && lMinor > rMinor;
+}
+/** Population and behind count of `direct` against one registry snapshot. Keys of `registryData`: `<group>:<name>`. */
+export function majorsBehind(direct, registryData, asOf) {
+    let numerator = 0;
+    let denominator = 0;
+    for (const dep of direct) {
+        const data = registryData.get(`${dep.group}:${dep.group === 'python' ? normalizeName(dep.name) : dep.name}`);
+        if (!data)
+            continue;
+        denominator += 1;
+        const latest = latestStable(data, dep.group, asOf);
+        if (latest !== undefined && isMajorBehind(dep.version, latest, dep.group))
+            numerator += 1;
+    }
+    return { numerator, denominator };
+}

package/dist/measure/deps/resolved.js

@@ -0,0 +1,78 @@
+import path from 'node:path';
+import semver from 'semver';
+import { compareVersions, parseVersion, satisfies as pySatisfies } from '../../util/pep440.js';
+import { readManifest } from './declared.js';
+import { trackedIn } from './files.js';
+import { chooseJsLockfile, entrySatisfies, findLockfiles, jsLockfiles, readLockfile } from './lockfiles.js';
+/** Manifest and lockfiles of one unit, read once per scan. */
+export function unitDeps(ctx, pkg, group) {
+    return ctx.tools.memo(`deps:${pkg}\0${group}`, async () => {
+        const manifest = readManifest(ctx.repoPath, pkg, group);
+        const found = manifest ? findLockfiles(ctx.repoPath, pkg, group) : [];
+        const { refs, warnings } = group === 'typescript_javascript' ? installedLockfile(ctx.repoPath, found) : { refs: found, warnings: [] };
+        const lockfiles = refs.map((ref) => ({ ref, reader: readLockfile(ctx.repoPath, ref) }));
+        return { package: pkg, group, manifest, lockfiles, warnings };
+    });
+}
+/**
+ * With several JS lockfiles in the lockfile directory, keep only the one the install step uses
+ * (`chooseJsLockfile`) and warn. A binary `bun.lockb` cannot be read, so then every readable candidate stays.
+ */
+function installedLockfile(repoPath, refs) {
+    const dir = refs[0]?.dir;
+    if (dir === undefined)
+        return { refs, warnings: [] };
+    const names = jsLockfiles(trackedIn(repoPath, dir).map((file) => path.posix.basename(file)));
+    if (names.length < 2)
+        return { refs, warnings: [] };
+    const chosen = chooseJsLockfile(names);
+    const where = dir === '' ? 'the repository root' : dir;
+    const picked = refs.filter((ref) => path.posix.basename(ref.path) === chosen);
+    if (picked.length === 0) {
+        return { refs, warnings: [`5.3: ${where} has several JS lockfiles (${names.join(', ')}); install uses ${chosen}, which is binary, so 5.3 checks ${refs.map((r) => path.posix.basename(r.path)).join(', ')}`] };
+    }
+    return { refs: picked, warnings: [`5.3: ${where} has several JS lockfiles (${names.join(', ')}); install and 5.3 use ${chosen}`] };
+}
+/** The unit's package directory relative to a lockfile's directory ('' when they are the same). */
+function relToLock(pkg, lockDir) {
+    const dir = pkg === '.' ? '' : pkg;
+    if (lockDir === '')
+        return dir;
+    return dir === lockDir ? '' : path.posix.relative(lockDir, dir);
+}
+export function lockLevel(unit) {
+    if (!unit.manifest || unit.lockfiles.length === 0)
+        return 'none';
+    const inSync = unit.lockfiles.some(({ ref, reader }) => {
+        if (!reader)
+            return false;
+        const rel = relToLock(unit.package, ref.dir);
+        return (unit.manifest?.deps ?? []).every((dep) => entrySatisfies(dep, reader.lookup(dep, rel), unit.group));
+    });
+    return inSync ? 'in_sync' : 'out_of_sync';
+}
+function best(versions, dep, group) {
+    const fits = versions.filter((v) => group === 'python' ? pySatisfies(v, dep.spec) : semver.satisfies(v, dep.spec, { includePrerelease: true }));
+    const pool = fits.length > 0 ? fits : versions;
+    if (group === 'python') {
+        return [...pool].sort((a, b) => {
+            const pa = parseVersion(a);
+            const pb = parseVersion(b);
+            return pa && pb ? compareVersions(pb, pa) : 0;
+        })[0];
+    }
+    return pool[0];
+}
+/** Declared direct dependencies with the version the first lockfile holding them resolves. */
+export function resolveDirect(unit) {
+    return (unit.manifest?.deps ?? []).map((dep) => {
+        for (const { ref, reader } of unit.lockfiles) {
+            if (!reader)
+                continue;
+            const entry = reader.lookup(dep, relToLock(unit.package, ref.dir));
+            if (entry.present)
+                return { name: dep.name, version: best(entry.versions, dep, unit.group), dev: dep.dev, registry: dep.registry };
+        }
+        return { name: dep.name, version: undefined, dev: dep.dev, registry: dep.registry };
+    });
+}