weavatrix 0.2.13 → 0.2.14

package/src/analysis/internal-audit/dependency-health.js

@@ -0,0 +1,111 @@
+import { readCoverageForRepo } from "../coverage-reports.js";
+import { buildHealthCapabilityMatrix } from "../health-capabilities.js";
+
+export function buildDependencyHealth({
+  repoPath,
+  graph,
+  repoFiles,
+  pyManifest,
+  dep,
+  goDep,
+  pyDep,
+  jvmDependencies,
+  externalImports,
+  findings,
+  packageScopes,
+  sourceFiles,
+  correctnessCoverage,
+  checks,
+}) {
+  const dependencyFindings = findings.filter((finding) => ["unused-dep", "missing-dep", "duplicate-dep"].includes(finding.rule));
+  const graphComplete = !((graph.graphBuildMode && graph.graphBuildMode !== "full") || graph.graphBuildScope);
+  const npmManifests = repoFiles.filter((file) => /(^|\/)package\.json$/i.test(file));
+  const goManifests = repoFiles.filter((file) => /(^|\/)go\.mod$/i.test(file));
+  const pythonManifests = [...new Set((pyManifest.scopes || []).flatMap((scope) => scope.manifests || []))];
+  const ecosystems = {
+    npm: {
+      ecosystem: "npm",
+      present: npmManifests.length > 0,
+      status: npmManifests.length ? "CHECKED" : "NOT_PRESENT",
+      completeness: graphComplete ? "COMPLETE" : "PARTIAL",
+      manifests: npmManifests,
+      declared: dep.declared.size,
+      reason: npmManifests.length
+        ? "package.json declarations were compared with indexed JavaScript/TypeScript imports, including per-finding manifest/source/config evidence."
+        : "No package.json was discovered.",
+    },
+    go: {
+      ecosystem: "go",
+      present: goManifests.length > 0,
+      status: goManifests.length ? "CHECKED" : "NOT_PRESENT",
+      completeness: goManifests.length ? "PARTIAL" : "NOT_APPLICABLE",
+      manifests: goManifests,
+      declared: goDep.declared.size,
+      reason: goManifests.length
+        ? "Go dependency checks use indexed imports and the root go.mod; nested modules and build-tag-specific resolution are not fully modeled."
+        : "No go.mod was discovered.",
+    },
+    python: {
+      ecosystem: "python",
+      present: pyManifest.present,
+      status: pyManifest.present ? "CHECKED" : "NOT_PRESENT",
+      completeness: pyManifest.present ? "PARTIAL" : "NOT_APPLICABLE",
+      manifests: pythonManifests,
+      declared: pyDep.declared.size,
+      reason: pyManifest.present
+        ? "Python declarations were compared with indexed imports; environment markers, extras and dynamic imports remain bounded static evidence."
+        : "No supported Python dependency manifest was discovered.",
+    },
+    maven: { ecosystem: "maven", ...jvmDependencies.maven },
+    gradle: { ecosystem: "gradle", ...jvmDependencies.gradle },
+  };
+  const present = Object.values(ecosystems).filter((item) => item.present);
+  const status = present.length === 0
+    ? "NOT_CHECKED"
+    : graphComplete && present.every((item) => item.status === "CHECKED" && item.completeness === "COMPLETE")
+      ? "COMPLETE"
+      : "PARTIAL";
+  const importedPackages = new Set(externalImports
+    .filter((entry) => entry?.pkg && !entry.builtin && !entry.unresolved)
+    .map((entry) => `${entry.ecosystem || (/\.java$/i.test(entry.file || "") ? "maven-unresolved" : "npm")}:${entry.pkg}`));
+  const supportedDeclared = dep.declared.size + goDep.declared.size + pyDep.declared.size;
+  const jvmDeclared = jvmDependencies.maven.declared + jvmDependencies.gradle.declared;
+  const measuredCoverage = readCoverageForRepo(repoPath, sourceFiles);
+  const healthCapabilities = buildHealthCapabilityMatrix({
+    graphComplete,
+    dependencyStatus: status,
+    dependencyEcosystems: ecosystems,
+    checks,
+    sourceFiles,
+    correctnessCoverage,
+    measuredCoverageFiles: measuredCoverage.size,
+  });
+  return {
+    manifestDeps: supportedDeclared + jvmDeclared,
+    healthCapabilities,
+    dependencyReport: {
+      status,
+      evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
+      perFindingVerification: present.some((item) => item.status === "CHECKED")
+        && dependencyFindings.every((finding) => finding.verification != null),
+      verificationCoverage: Object.fromEntries(present.map((item) => [item.ecosystem, `${item.status}/${item.completeness}`])),
+      ecosystems,
+      declared: supportedDeclared + jvmDeclared,
+      importedPackages: importedPackages.size,
+      importRecords: externalImports.length,
+      unused: dependencyFindings.filter((finding) => finding.rule === "unused-dep").length,
+      missing: dependencyFindings.filter((finding) => finding.rule === "missing-dep").length,
+      duplicateDeclarations: dependencyFindings.filter((finding) => finding.rule === "duplicate-dep").length,
+      unusedRequiringReview: dependencyFindings.filter((finding) => finding.rule === "unused-dep" && finding.verification?.decision === "REVIEW_REQUIRED").length,
+      missingWithSourceEvidence: dependencyFindings.filter((finding) => finding.rule === "missing-dep" && finding.verification?.indexedSourceImports?.status === "FOUND").length,
+      packageScopes: packageScopes.length,
+      reason: status === "NOT_CHECKED"
+        ? "No dependency manifest was discovered, so manifest-to-import verification did not run and no dependency verdict was produced."
+        : status === "COMPLETE"
+        ? "Every discovered dependency ecosystem has complete supported manifest-to-import evidence for the indexed repository."
+        : present.some((item) => item.status === "NOT_SUPPORTED")
+          ? `Dependency evidence is PARTIAL: ${present.filter((item) => item.status === "NOT_SUPPORTED").map((item) => item.ecosystem).join(", ")} manifests were counted, but package-to-artifact verification is NOT_SUPPORTED.`
+          : "Dependency checks ran at their documented evidence level, but at least one graph or ecosystem surface is partial; this is not a repository-wide clean bill.",
+    },
+  };
+}

package/src/analysis/internal-audit/python-manifests.js

@@ -0,0 +1,65 @@
+import {dirname} from 'node:path'
+import {createRepoBoundary} from '../../repo-path.js'
+import {parseRequirementsNames, parsePyprojectDeps, parsePipfileDeps, pep503} from '../manifests.js'
+import {listRepoFiles, readRepoText} from './repo-files.js'
+
+const normalizeRoot = (root) => {
+    const value = String(root || '').replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+|\/+$/g, '')
+    return value === '.' ? '' : value
+}
+
+// Python dependencies are owned by the nearest manifest root, including nested services.
+export function collectPyManifest(repoRoot) {
+    const boundary = createRepoBoundary(repoRoot)
+    const scopes = new Map()
+    const scopeFor = (root) => {
+        const normalized = normalizeRoot(root)
+        if (!scopes.has(normalized)) scopes.set(normalized, {root: normalized, present: false, deps: [], manifests: []})
+        return scopes.get(normalized)
+    }
+    const addManifest = (root, manifest, parsedDeps, present = true) => {
+        if (!present) return
+        const scope = scopeFor(root)
+        scope.present = true
+        scope.manifests.push(manifest)
+        scope.deps.push(...parsedDeps.map((dep) => ({...dep, manifest})))
+    }
+    const files = listRepoFiles(repoRoot)
+    for (const file of files.filter((name) => /(^|\/)requirements[\w.-]*\.(?:txt|in)$/i.test(name)
+        || /(^|\/)requirements\/[^/]+\.(?:txt|in)$/i.test(name))) {
+        const text = readRepoText(boundary, file)
+        if (text == null) continue
+        const parent = normalizeRoot(dirname(file))
+        const root = /(^|\/)requirements$/i.test(parent) ? normalizeRoot(dirname(parent)) : parent
+        const dev = /dev|test|lint|doc|ci/i.test(file.slice(file.lastIndexOf('/') + 1))
+        addManifest(root, file, parseRequirementsNames(text).map((dep) => ({...dep, dev})))
+    }
+    for (const file of files.filter((name) => /(^|\/)pyproject\.toml$/i.test(name))) {
+        const parsed = parsePyprojectDeps(readRepoText(boundary, file))
+        addManifest(dirname(file), file, parsed.deps, parsed.present)
+    }
+    for (const file of files.filter((name) => /(^|\/)Pipfile$/i.test(name))) {
+        const parsed = parsePipfileDeps(readRepoText(boundary, file))
+        addManifest(dirname(file), file, parsed.deps, parsed.present)
+    }
+    const normalizedScopes = [...scopes.values()]
+        .map((scope) => {
+            const seen = new Set()
+            return {
+                ...scope,
+                manifests: [...new Set(scope.manifests)].sort(),
+                deps: scope.deps.filter((dep) => {
+                    const key = pep503(dep.name)
+                    if (!key || seen.has(key)) return false
+                    seen.add(key)
+                    return true
+                }),
+            }
+        })
+        .sort((left, right) => right.root.length - left.root.length || left.root.localeCompare(right.root))
+    return {
+        present: normalizedScopes.some((scope) => scope.present),
+        deps: normalizedScopes.flatMap((scope) => scope.deps),
+        scopes: normalizedScopes,
+    }
+}

package/src/analysis/internal-audit/repo-files.js

@@ -0,0 +1,55 @@
+import {readFileSync, readdirSync} from 'node:fs'
+import {join} from 'node:path'
+import {spawnSync} from 'node:child_process'
+import {childProcessEnv} from '../../child-env.js'
+import {filterWeavatrixIgnored} from '../../path-ignore.js'
+
+export const readText = (path) => {
+    try { return readFileSync(path, 'utf8') } catch { return null }
+}
+
+export const readJson = (path) => {
+    try { return JSON.parse(readFileSync(path, 'utf8')) } catch { return null }
+}
+
+export const readRepoText = (boundary, relativePath) => {
+    const resolved = boundary.resolve(relativePath)
+    return resolved.ok ? readText(resolved.path) : null
+}
+
+export const readRepoJson = (boundary, relativePath) => {
+    const resolved = boundary.resolve(relativePath)
+    return resolved.ok ? readJson(resolved.path) : null
+}
+
+const SKIP_DIRS = new Set([
+    '.git', '.hg', '.svn', 'node_modules', 'vendor', 'dist', 'build', 'coverage', '.next', 'out',
+    'release', 'weavatrix-graphs', '__pycache__', '.venv', 'venv', 'env', '.tox', 'site-packages',
+    '.mypy_cache', '.pytest_cache',
+])
+
+export function listRepoFiles(repoRoot) {
+    try {
+        const result = spawnSync('git', ['-C', repoRoot, 'ls-files', '--cached', '--others', '--exclude-standard', '-z'], {
+            encoding: 'utf8', windowsHide: true, timeout: 15_000, maxBuffer: 32 * 1024 * 1024,
+            env: childProcessEnv(),
+        })
+        if (result.status === 0) {
+            const files = String(result.stdout || '').split('\0').filter(Boolean).map((file) => file.replace(/\\/g, '/'))
+            return filterWeavatrixIgnored(repoRoot, files)
+        }
+    } catch { /* non-Git repo or git unavailable: use the bounded walker below */ }
+
+    const files = []
+    const walk = (absolute, parts = []) => {
+        let entries = []
+        try { entries = readdirSync(absolute, {withFileTypes: true}) } catch { return }
+        for (const entry of entries) {
+            if (entry.isDirectory()) {
+                if (!SKIP_DIRS.has(entry.name)) walk(join(absolute, entry.name), [...parts, entry.name])
+            } else if (entry.isFile()) files.push([...parts, entry.name].join('/'))
+        }
+    }
+    walk(repoRoot)
+    return filterWeavatrixIgnored(repoRoot, files)
+}

package/src/analysis/internal-audit/supply-chain.js

@@ -0,0 +1,132 @@
+import { collectInstalled } from "../../security/installed.js";
+import { advisoryQueryFingerprint, loadStore, queryStore } from "../../security/advisory-store.js";
+import { matchAdvisories } from "../../security/match.js";
+import { scanMalware } from "../../security/malware-heuristics.js";
+import { classifyTyposquat } from "../../security/typosquat.js";
+import { makeFinding } from "../findings.js";
+import { packageReachability } from "../package-reachability.js";
+
+const LOWER_SEVERITY = { critical: "high", high: "medium", medium: "low", low: "info", info: "info" };
+
+const removalHint = (pkg) => {
+  if (pkg?.ecosystem === "npm") return `npm uninstall ${pkg.name} and audit what it touched`;
+  if (pkg?.ecosystem === "PyPI") return `remove ${pkg.name} from the Python environment/manifest and audit what it touched`;
+  if (pkg?.ecosystem === "Go") return `remove ${pkg.name} from the Go module graph, run go mod tidy, and audit what it touched`;
+  return `remove ${pkg?.name || "the package"} with its ecosystem's package manager and audit what it touched`;
+};
+
+export async function runSupplyChainChecks(repoPath, {
+  externalImports = [],
+  packageScopes = [],
+  isNonProductPath = () => false,
+  advisoryStorePath,
+  skipMalwareScan = false,
+  malwareExclusions = {},
+  rgPath = "",
+} = {}) {
+  const findings = [];
+  let advisoryDbDate = null;
+  let installedCount = 0;
+  let inst = { installed: [], drift: [] };
+  const checks = {
+    osv: { status: "NOT_CHECKED", detail: "Advisory cache was never refreshed for this repository. Enable the osv profile (or advisories capability), then call refresh_advisories explicitly to opt in to sending pinned package names and versions to OSV.dev." },
+    malware: { status: skipMalwareScan ? "NOT_CHECKED" : "PENDING", detail: skipMalwareScan ? "Installed-package malware scan is opt-in and was not requested." : "" },
+  };
+
+  try {
+    inst = collectInstalled(repoPath);
+    installedCount = inst.installed.length;
+    const store = advisoryStorePath ? loadStore(advisoryStorePath) : loadStore();
+    const repoStamp = store.meta?.repos?.[repoPath] || null;
+    advisoryDbDate = typeof repoStamp === "string" ? repoStamp : repoStamp?.fetched_at || null;
+    if (advisoryDbDate) {
+      let status = typeof repoStamp === "object" && ["OK", "PARTIAL", "ERROR"].includes(repoStamp.status) ? repoStamp.status : "PARTIAL";
+      const fingerprintMatches = typeof repoStamp === "object" && repoStamp.query_fingerprint === advisoryQueryFingerprint(inst.installed);
+      if (!fingerprintMatches && status === "OK") status = "PARTIAL";
+      const coverage = typeof repoStamp === "object" && Number.isFinite(repoStamp.queried)
+        ? ` (${repoStamp.queried_ok ?? repoStamp.queried}/${repoStamp.queried} package versions queried successfully)`
+        : "";
+      const drift = fingerprintMatches ? "" : " Dependency versions changed, or this is a legacy stamp without a package fingerprint; enable the osv profile (or advisories capability) and call refresh_advisories for complete coverage.";
+      checks.osv = {
+        status,
+        detail: `${status === "PARTIAL" ? "Partially matched" : "Matched"} installed packages against the cached OSV snapshot from ${advisoryDbDate}${coverage}.${drift}`,
+        checkedAt: advisoryDbDate,
+      };
+      for (const hit of matchAdvisories(inst.installed, (ecosystem, name) => queryStore(store, ecosystem, name))) {
+        const malicious = hit.adv.kind === "malicious";
+        const reachability = packageReachability(externalImports, hit.pkg.name, { isNonProductPath });
+        const observedInProduct = reachability.state === "DIRECT_RUNTIME_IMPORT";
+        const reachabilityDetail = observedInProduct
+          ? ` Graph reachability: directly imported by product code in ${reachability.directRuntimeImports} callsite(s) across ${reachability.files.length} file(s).`
+          : ` Graph reachability: ${reachability.state}; ${reachability.note}`;
+        findings.push(makeFinding({
+          category: malicious ? "malware" : "vulnerability",
+          rule: malicious ? "malicious-package" : "known-vuln",
+          severity: malicious || observedInProduct ? (malicious ? "critical" : hit.adv.severity) : LOWER_SEVERITY[hit.adv.severity] || hit.adv.severity,
+          confidence: malicious || observedInProduct ? hit.confidence : "low",
+          title: `${malicious ? "Known-malicious package" : `Known vulnerability (${hit.adv.id})`}: ${hit.pkg.name}@${hit.pkg.version}`,
+          detail: `${hit.adv.summary || hit.adv.id}${hit.adv.fixedIn.length ? ` Fixed in: ${hit.adv.fixedIn.join(", ")}.` : malicious ? " Remove this package immediately and rotate any secrets it could reach." : ""} (matched by ${hit.matchedBy}${hit.adv.aliases.length ? `; aliases ${hit.adv.aliases.join(", ")}` : ""}).${reachabilityDetail}`,
+          package: hit.pkg.name,
+          version: hit.pkg.version,
+          reachability,
+          evidence: [
+            { file: hit.adv.url, line: 0, snippet: `installed via ${hit.pkg.source}${hit.pkg.dev ? " (dev)" : ""}` },
+            ...reachability.evidence.slice(0, 5).map((item) => ({ file: item.file, line: item.line, snippet: `${item.typeOnly ? "type-only " : ""}${item.kind}` })),
+          ],
+          source: "osv",
+          fixHint: malicious
+            ? removalHint(hit.pkg)
+            : hit.adv.fixedIn.length
+              ? `upgrade ${hit.pkg.name} to ${hit.adv.fixedIn.at(-1)}+ with its ecosystem's package manager`
+              : "no fixed version published; consider replacing the package",
+        }));
+      }
+    }
+    const directDependencyNames = new Set(packageScopes.flatMap((scope) => Object.keys({ ...(scope.pkg?.dependencies || {}), ...(scope.pkg?.devDependencies || {}) })));
+    for (const name of directDependencyNames) {
+      const candidate = classifyTyposquat(name);
+      if (!candidate) continue;
+      findings.push(makeFinding({
+        category: "malware",
+        rule: "typosquat",
+        severity: "medium",
+        confidence: "low",
+        title: `Possible typosquat: ${name} (looks like "${candidate.nearest}")`,
+        detail: `Direct dependency "${name}" is edit-distance ${candidate.distance} from the popular package "${candidate.nearest}". Confirm you meant "${name}" and not "${candidate.nearest}" — name-confusion is a common supply-chain lure.`,
+        package: name,
+        source: "internal",
+        fixHint: `verify "${name}" is the intended package (not a typo of "${candidate.nearest}")`,
+      }));
+    }
+    for (const item of inst.drift.slice(0, 20)) {
+      findings.push(makeFinding({
+        category: "malware",
+        rule: "lockfile-drift",
+        severity: "low",
+        confidence: "medium",
+        title: `Lockfile drift: ${item.name} (locked ${item.locked}, installed ${item.installed})`,
+        detail: "The version on disk differs from the lockfile — a stale install, a manual edit, or (worst case) tampering. Reinstall from the lockfile to realign.",
+        package: item.name,
+        version: item.installed,
+        source: "internal",
+        fixHint: "npm ci (clean install from the lockfile)",
+      }));
+    }
+  } catch (error) {
+    checks.osv = { status: "ERROR", detail: `Offline advisory matching failed: ${error instanceof Error ? error.message : String(error)}` };
+  }
+
+  let malwareScan = null;
+  if (!skipMalwareScan) {
+    try {
+      const importedPkgs = new Set(externalImports.filter((entry) => entry.pkg && !entry.builtin).map((entry) => entry.pkg));
+      const scan = await scanMalware(repoPath, { installed: inst.installed, importedPkgs, malwareExclusions, rgPath });
+      findings.push(...scan.findings);
+      malwareScan = { scanMode: scan.scanMode, packagesScanned: scan.packagesScanned, findings: scan.findings.length, excludedSignals: scan.excludedSignals || 0 };
+      checks.malware = { status: "OK", detail: `Scanned ${scan.packagesScanned} installed package(s) using ${scan.scanMode}.` };
+    } catch (error) {
+      checks.malware = { status: "ERROR", detail: `Installed-package malware scan failed: ${error instanceof Error ? error.message : String(error)}` };
+    }
+  }
+  return { findings, checks, installedCount, advisoryDbDate, malwareScan };
+}

package/src/analysis/internal-audit.collect.js

@@ -1,55 +1,13 @@
 // internal-audit.collect.js — filesystem collection helpers for the internal audit: source/config
 // text gathering, workspace package names, and the Python manifest reader. Split from internal-audit.js.
-import { readFileSync, readdirSync } from "node:fs";
+import { readdirSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { spawnSync } from "node:child_process";
-import { parseRequirementsNames, parsePyprojectDeps, parsePipfileDeps, pep503 } from "./manifests.js";
 import { createRepoBoundary } from "../repo-path.js";
-import { childProcessEnv } from "../child-env.js";
-import { filterWeavatrixIgnored } from "../path-ignore.js";
+import {listRepoFiles, readJson, readRepoJson, readRepoText, readText} from './internal-audit/repo-files.js'
 
-export const readText = (p) => { try { return readFileSync(p, "utf8"); } catch { return null; } };
-export const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
-export const readRepoText = (boundary, relativePath) => {
-  const resolved = boundary.resolve(relativePath);
-  return resolved.ok ? readText(resolved.path) : null;
-};
-export const readRepoJson = (boundary, relativePath) => {
-  const resolved = boundary.resolve(relativePath);
-  return resolved.ok ? readJson(resolved.path) : null;
-};
-const SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?|py|go|vue|svelte)$/i;
-const SOURCE_SKIP_DIRS = new Set([
-  ".git", ".hg", ".svn", "node_modules", "vendor", "dist", "build", "coverage", ".next", "out",
-  "release", "weavatrix-graphs", "__pycache__", ".venv", "venv", "env", ".tox", "site-packages",
-  ".mypy_cache", ".pytest_cache",
-]);
-
-// One file universe for every filesystem-backed audit. In Git repos this exactly matches tracked files
-// plus untracked/non-ignored work, so release bundles and other .gitignore outputs cannot re-enter through
-// text/config/manifest fallback collectors after the graph builder correctly omitted them.
-export function listRepoFiles(repoRoot) {
-  try {
-    const r = spawnSync("git", ["-C", repoRoot, "ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
-      encoding: "utf8", windowsHide: true, timeout: 15_000, maxBuffer: 32 * 1024 * 1024,
-      env: childProcessEnv(),
-    });
-    if (r.status === 0) return filterWeavatrixIgnored(repoRoot, String(r.stdout || "").split("\0").filter(Boolean).map((f) => f.replace(/\\/g, "/")));
-  } catch { /* non-Git repo or git unavailable: use the bounded walker below */ }
-
-  const files = [];
-  const walk = (abs, parts = []) => {
-    let entries = [];
-    try { entries = readdirSync(abs, { withFileTypes: true }); } catch { return; }
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        if (!SOURCE_SKIP_DIRS.has(entry.name)) walk(join(abs, entry.name), [...parts, entry.name]);
-      } else if (entry.isFile()) files.push([...parts, entry.name].join("/"));
-    }
-  };
-  walk(repoRoot);
-  return filterWeavatrixIgnored(repoRoot, files);
-}
+export {listRepoFiles, readJson, readRepoJson, readRepoText, readText} from './internal-audit/repo-files.js'
+export {collectPyManifest} from './internal-audit/python-manifests.js'
+const SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?|py|go|java|rs|cs|vue|svelte)$/i;
 
 const NON_RUNTIME_DIR_RE = /^(?:templates?|examples?|samples?|fixtures?|snippets?|__fixtures__)$/i;
 const NON_RUNTIME_README_RE = /(?:\b(?:reusable|copyable|reference)\b[\s\S]{0,160}\b(?:templates?|snippets?|examples?|samples?)\b|\b(?:these|contents?)\s+are\s+templates?\b)/i;
@@ -253,62 +211,3 @@ export function workspacePkgNames(repoRoot, pkg) {
 }
 
 export const TEST_FILE_RE = /(^|[/])(test|tests|__tests__|spec|e2e|__mocks__)([/]|$)|[._-](test|spec)\.[a-z0-9]+$/i;
-
-// Python declared deps are owned by the nearest manifest root, matching nested service/monorepo
-// layouts. `requirements/*.txt` belongs to the directory above `requirements`; a colocated
-// requirements.txt, pyproject.toml or Pipfile owns its own directory.
-// present=false (no manifest at all) softens missing-dep findings instead of suppressing them.
-export function collectPyManifest(repoRoot) {
-  const boundary = createRepoBoundary(repoRoot);
-  const scopes = new Map();
-  const scopeFor = (root) => {
-    const normalized = normRoot(root);
-    if (!scopes.has(normalized)) scopes.set(normalized, { root: normalized, present: false, deps: [], manifests: [] });
-    return scopes.get(normalized);
-  };
-  const addManifest = (root, manifest, parsedDeps, present = true) => {
-    if (!present) return;
-    const scope = scopeFor(root);
-    scope.present = true;
-    scope.manifests.push(manifest);
-    scope.deps.push(...parsedDeps.map((dep) => ({ ...dep, manifest })));
-  };
-  const files = listRepoFiles(repoRoot);
-  for (const file of files.filter((name) => /(^|\/)requirements[\w.-]*\.(?:txt|in)$/i.test(name)
-    || /(^|\/)requirements\/[^/]+\.(?:txt|in)$/i.test(name))) {
-    const t = readRepoText(boundary, file);
-    if (t == null) continue;
-    const parent = normRoot(dirname(file));
-    const root = /(^|\/)requirements$/i.test(parent) ? normRoot(dirname(parent)) : parent;
-    const dev = /dev|test|lint|doc|ci/i.test(file.slice(file.lastIndexOf("/") + 1));
-    addManifest(root, file, parseRequirementsNames(t).map((dep) => ({ ...dep, dev })));
-  }
-  for (const file of files.filter((name) => /(^|\/)pyproject\.toml$/i.test(name))) {
-    const parsed = parsePyprojectDeps(readRepoText(boundary, file));
-    addManifest(dirname(file), file, parsed.deps, parsed.present);
-  }
-  for (const file of files.filter((name) => /(^|\/)Pipfile$/i.test(name))) {
-    const parsed = parsePipfileDeps(readRepoText(boundary, file));
-    addManifest(dirname(file), file, parsed.deps, parsed.present);
-  }
-  const normalizedScopes = [...scopes.values()]
-    .map((scope) => {
-      const seen = new Set();
-      return {
-        ...scope,
-        manifests: [...new Set(scope.manifests)].sort(),
-        deps: scope.deps.filter((dep) => {
-          const key = pep503(dep.name);
-          if (!key || seen.has(key)) return false;
-          seen.add(key);
-          return true;
-        }),
-      };
-    })
-    .sort((left, right) => right.root.length - left.root.length || left.root.localeCompare(right.root));
-  return {
-    present: normalizedScopes.some((scope) => scope.present),
-    deps: normalizedScopes.flatMap((scope) => scope.deps),
-    scopes: normalizedScopes,
-  };
-}