codeanalyzer-python 1.2.0__py3-none-any.whl → 1.3.0__py3-none-any.whl

codeanalyzer/artifacts/dependencies.py

@@ -0,0 +1,237 @@
+"""PyDependency / PyImportBinding construction from discovered artifacts.
+
+Deterministic by default: reads only repo files. ``resolve_installed`` adds
+filesystem reads of ``<venv>/**/site-packages/*.dist-info`` (never runs an
+interpreter), tagged ``prov: installed-metadata``.
+
+``-r``/``-c`` refs in a requirements-format manifest are chased one level
+only, by design: a chased target's own refs are not followed further.
+
+``unresolved_imports`` is byte-identical run-to-run only within one Python
+minor version: it is filtered against ``sys.stdlib_module_names``, and that
+set's membership varies across minors (a module added to or removed from the
+stdlib)."""
+
+import posixpath
+import re
+import sys
+from pathlib import Path
+from typing import Dict, List, Optional, Tuple
+
+from codeanalyzer.artifacts.parsers import (
+    RawDep, _kind_for_requirements, normalize_name, parse_lock_pins, parse_manifest,
+    parse_requirement_refs,
+)
+from codeanalyzer.schema.py_schema import (
+    PyArtifact, PyDependency, PyImportBinding, PyModule,
+)
+
+_LOCK_BASENAMES = ("poetry.lock", "uv.lock", "Pipfile.lock")
+
+# Small, non-exhaustive alias table for the worst offenders; everything else
+# rides the same-name rule or --resolve-installed. prov: heuristic. Identity
+# entries (key == value) do not belong here -- the same-name rule below
+# already covers them, and a redundant identity entry only mints a spurious
+# "heuristic" prov on what is actually a plain same-name match.
+_KNOWN_IMPORT_ALIASES: Dict[str, str] = {
+    "pyyaml": "yaml", "beautifulsoup4": "bs4", "pillow": "PIL",
+    "scikit-learn": "sklearn", "opencv-python": "cv2", "python-dateutil": "dateutil",
+    "msgpack-python": "msgpack", "protobuf": "google.protobuf", "attrs": "attr",
+}
+
+
+def _stdlib_names() -> set:
+    return set(getattr(sys, "stdlib_module_names", ())) | {"__future__"}
+
+
+def _installed_top_levels(venv_dir: Optional[Path]) -> Dict[str, List[str]]:
+    """{normalized dist name: [top-level import names]} from *.dist-info files."""
+    out: Dict[str, List[str]] = {}
+    if venv_dir is None or not venv_dir.exists():
+        return out
+    for di in sorted(venv_dir.glob("**/site-packages/*.dist-info")):
+        name = None
+        meta = di / "METADATA"
+        if meta.exists():
+            m = re.search(r"^Name:\s*(.+)$", meta.read_text(errors="replace"), re.M)
+            if m:
+                name = normalize_name(m.group(1).strip())
+        if name is None:
+            continue
+        tl = di / "top_level.txt"
+        if tl.exists():
+            out[name] = [l.strip() for l in tl.read_text().splitlines() if l.strip()]
+    return out
+
+
+def _is_requirements_format(path: str) -> bool:
+    base = path.rsplit("/", 1)[-1]
+    return base.startswith("requirements") and base.endswith(".txt")
+
+
+def _resolve_ref(manifest_path: str, ref: str) -> Optional[str]:
+    """POSIX-join a ``-r``/``-c`` ref against its manifest's directory,
+    normalized and repo-relative. ``None`` if it would escape ``project_dir``."""
+    manifest_dir = manifest_path.rsplit("/", 1)[0] if "/" in manifest_path else ""
+    joined = posixpath.normpath(posixpath.join(manifest_dir, ref) if manifest_dir else ref)
+    if joined == ".." or joined.startswith("../") or posixpath.isabs(joined):
+        return None
+    return joined
+
+
+def _full_text(project_dir: Path, path: str, art: PyArtifact) -> str:
+    """Manifest/lock extraction must never depend on the stored ``source`` --
+    that's capped by ``text_max_bytes`` and emptied by ``capture_text=False``
+    (both payload-size controls on the JSON/Neo4j payload, not extraction
+    controls). Read the real file fresh instead; fall back to ``art.source``
+    only if it is gone (e.g. a synthetic artifact in a unit test, or the file
+    vanished mid-run).
+
+    Mirrored (not imported -- this name is module-private) by
+    ``core._artifact_full_text`` for the same reason on config-key
+    extraction (#152); keep the two in sync if this logic changes."""
+    try:
+        return (project_dir / path).read_bytes().decode("utf-8")
+    except (OSError, UnicodeDecodeError):
+        return art.source
+
+
+def build_dependency_view(
+    artifacts: Dict[str, PyArtifact],
+    modules: Dict[str, PyModule],
+    project_dir: Path,
+    venv_dir: Optional[Path],
+    resolve_installed: bool,
+) -> Tuple[List[PyDependency], List[PyImportBinding]]:
+    deps: List[PyDependency] = []
+
+    def _emit(raw: List[RawDep], declared_in: str, kind_override: Optional[str] = None) -> None:
+        for r in raw:
+            deps.append(PyDependency(
+                name=r.name, ecosystem="pypi", spec=r.spec,
+                kind=kind_override if kind_override is not None else r.kind,
+                extras=sorted(r.extras), declared_in=declared_in, prov=["declared"],
+            ))
+
+    # 1. Declared records from every dependency-manifest artifact (non-lock).
+    for path in sorted(artifacts):
+        art = artifacts[path]
+        if "dependency-manifest" not in art.roles:
+            continue
+        if path.rsplit("/", 1)[-1] in _LOCK_BASENAMES:
+            continue
+        text = _full_text(project_dir, path, art)
+        raw, partial = parse_manifest(path, text)
+        art.extraction = "partial" if partial else "full"
+        _emit(raw, art.id)
+
+        # 1b. -r/-c refs: a target that is itself a dependency-manifest is
+        # parsed on its own above; a target with no RULES match for that role
+        # (e.g. base.txt -- never-drop inventory still captures it, just not
+        # as a manifest) is chased here and attributed to the referring
+        # artifact. Gate on the role, not mere presence in `artifacts`: since
+        # #157 every file is discovered, so presence alone no longer implies
+        # "already parsed as a manifest above".
+        if not _is_requirements_format(path):
+            continue
+        for ref in parse_requirement_refs(text):
+            resolved = _resolve_ref(path, ref)
+            if resolved is None:
+                continue
+            target_art = artifacts.get(resolved)
+            if target_art is not None and "dependency-manifest" in target_art.roles:
+                continue
+            target = project_dir / resolved
+            if not target.is_file():
+                continue
+            try:
+                ref_text = target.read_bytes().decode("utf-8")
+            except UnicodeDecodeError:
+                continue
+            # Force requirements-format dispatch (chased targets may not be
+            # named requirements*.txt), but recompute kind from the real
+            # basename so e.g. `-r dev.txt` still yields kind="dev".
+            raw_ref, _ = parse_manifest("requirements.txt", ref_text)
+            real_kind = _kind_for_requirements(resolved.rsplit("/", 1)[-1])
+            _emit(raw_ref, art.id, kind_override=real_kind)
+
+    # 2. Lock backfill (locked_version + prov "lockfile"). A pin with no
+    # manifest declaration is a *transitive* dependency: emitted with
+    # direct=False, attributed to the lock artifact (#152 reconciliation).
+    pins: Dict[str, str] = {}
+    pin_lock_artifact: Dict[str, str] = {}
+    for path in sorted(artifacts):
+        if path.rsplit("/", 1)[-1] in _LOCK_BASENAMES:
+            lock_text = _full_text(project_dir, path, artifacts[path])
+            lock_pins = parse_lock_pins(path, lock_text)
+            pins.update(lock_pins)
+            for name in lock_pins:
+                pin_lock_artifact[name] = artifacts[path].id
+            # A lock with real content that yields zero pins failed to parse
+            # (corrupt/unrecognized shape) -- don't claim "full" extraction
+            # for nothing extracted. An empty/whitespace-only lock is not a
+            # failure (nothing to extract), so it still counts as "full".
+            artifacts[path].extraction = (
+                "full" if lock_pins or not lock_text.strip() else "partial"
+            )
+    for d in deps:
+        if d.name in pins:
+            d.locked_version = pins[d.name]
+            d.prov = sorted(set(d.prov) | {"lockfile"})
+    declared_names = {d.name for d in deps}
+    for name in sorted(set(pins) - declared_names):
+        deps.append(PyDependency(
+            name=name, ecosystem="pypi", kind="runtime", declared_in=pin_lock_artifact[name],
+            direct=False, locked_version=pins[name], prov=["lockfile"],
+        ))
+
+    # 3. Import universe from the symbol table (top-level segments only).
+    # `module_name` is `py_file.stem` -- the leaf filename only (e.g. "api"
+    # for "odoo/api.py"), never the package path -- so it alone misses the
+    # top-level package name itself. Derive that from the symbol-table KEYS
+    # (repo-relative POSIX paths) too: first path segment when nested, else
+    # the root file's own stem. Keep the module_name-derived stems as well
+    # (harmless -- still excludes leaf-name imports the key pass can't see).
+    local = {m.module_name.split(".")[0] for m in modules.values() if m.module_name}
+    local |= {
+        key.split("/", 1)[0] if "/" in key else Path(key).stem for key in modules
+    }
+    stdlib = _stdlib_names()
+    imported: set = set()
+    for m in modules.values():
+        for imp in m.imports or []:
+            top = (imp.module or imp.name or "").split(".")[0]
+            if top and top not in stdlib and top not in local:
+                imported.add(top)
+
+    # 4. provides_imports: same-name rule, alias table, optional installed metadata.
+    installed = _installed_top_levels(venv_dir) if resolve_installed else {}
+    for d in deps:
+        provides: List[str] = []
+        same = d.name.replace("-", "_")
+        for candidate in {d.name, same}:
+            if candidate in imported:
+                provides.append(candidate)
+        alias = _KNOWN_IMPORT_ALIASES.get(d.name)
+        if alias and alias.split(".")[0] in imported:
+            provides.append(alias)
+            d.prov = sorted(set(d.prov) | {"heuristic"})
+        if d.name in installed:
+            for top in installed[d.name]:
+                if top in imported and top not in provides:
+                    provides.append(top)
+            d.prov = sorted(set(d.prov) | {"installed-metadata"})
+        d.provides_imports = sorted(set(provides))
+
+    # 5. Unresolved: imported, not stdlib/local, not provided by any dependency.
+    # Top-level segment only: `imported` (step 3) is already top-level-only, but
+    # a dotted alias (e.g. protobuf -> "google.protobuf") puts the FULL dotted
+    # path into provides_imports, so comparing it against `imported` verbatim
+    # never matches and "google" falsely resurfaces as unresolved even though
+    # protobuf declares it.
+    provided = {p.split(".")[0] for d in deps for p in d.provides_imports}
+    unresolved = [
+        PyImportBinding(module=m) for m in sorted(imported - provided)
+    ]
+    deps.sort(key=lambda d: (d.name, d.declared_in))
+    return deps, unresolved

codeanalyzer/artifacts/discovery.py

@@ -0,0 +1,167 @@
+from __future__ import annotations
+
+import fnmatch
+import hashlib
+from pathlib import Path
+from typing import Dict, List, Tuple
+
+from codeanalyzer.schema.ids import artifact_id
+from codeanalyzer.schema.py_schema import PyArtifact
+
+# (glob pattern against the repo-relative POSIX path, format, roles).
+# First match wins; patterns are checked in order.
+RULES: List[Tuple[str, str, List[str]]] = [
+    ("requirements*.txt", "requirements", ["dependency-manifest"]),
+    ("pyproject.toml", "toml", ["dependency-manifest", "tool-config"]),
+    ("setup.py", "text", ["dependency-manifest"]),
+    ("setup.cfg", "ini", ["dependency-manifest", "tool-config"]),
+    ("Pipfile", "toml", ["dependency-manifest"]),
+    ("Pipfile.lock", "json", ["dependency-manifest"]),
+    ("poetry.lock", "toml", ["dependency-manifest"]),
+    ("uv.lock", "toml", ["dependency-manifest"]),
+    ("environment.yml", "yaml", ["dependency-manifest"]),
+    ("environment.yaml", "yaml", ["dependency-manifest"]),
+    ("Dockerfile", "dockerfile", ["container-image"]),
+    ("*.dockerfile", "dockerfile", ["container-image"]),
+    ("docker-compose*.yml", "yaml", ["service-topology"]),
+    ("docker-compose*.yaml", "yaml", ["service-topology"]),
+    ("compose.yml", "yaml", ["service-topology"]),
+    ("compose.yaml", "yaml", ["service-topology"]),
+    ("k8s/*.yml", "yaml", ["service-topology"]),
+    ("k8s/*.yaml", "yaml", ["service-topology"]),
+    ("kind/*.yml", "yaml", ["service-topology"]),
+    ("kind/*.yaml", "yaml", ["service-topology"]),
+    ("Chart.yaml", "yaml", ["service-topology"]),
+    ("values.yaml", "yaml", ["service-topology"]),
+    ("config/*.yml", "yaml", ["tool-config"]),
+    ("config/*.yaml", "yaml", ["tool-config"]),
+    ("*.tf", "text", ["iac"]),
+    (".github/workflows/*.yml", "yaml", ["ci"]),
+    (".github/workflows/*.yaml", "yaml", ["ci"]),
+    (".gitlab-ci.yml", "yaml", ["ci"]),
+    (".env", "text", ["env"]),
+    (".env.*", "text", ["env"]),
+    (".flaskenv", "text", ["env"]),
+    ("tox.ini", "ini", ["tool-config"]),
+    ("noxfile.py", "text", ["tool-config"]),
+    ("Makefile", "text", ["tool-config"]),
+    ("MANIFEST.in", "text", ["packaging"]),
+    ("LICENSE*", "text", ["legal"]),
+    ("COPYRIGHT*", "text", ["legal"]),
+    ("NOTICE*", "text", ["legal"]),
+    ("*.md", "text", ["docs"]),
+    ("*.rst", "text", ["docs"]),
+    ("*.cfg", "ini", ["unknown"]),
+    ("*.toml", "toml", ["unknown"]),
+    ("*.properties", "properties", ["tool-config"]),
+    # Generic fallback AFTER the specific tox.ini rule above, so a non-tox
+    # *.ini file (mypy.ini, pytest.ini, ...) still reaches format="ini" --
+    # config-key extraction (#152) is namespace-eligible by format.
+    ("*.ini", "ini", ["tool-config"]),
+]
+
+_IGNORED_DIRS = {
+    ".git", ".hg", ".svn", "__pycache__", ".venv", "venv", ".tox", ".nox",
+    "node_modules", ".mypy_cache", ".pytest_cache", ".ruff_cache", ".idea",
+    "build", "dist", ".eggs", ".codeanalyzer", "virtualenv", "site-packages",
+}
+
+
+def _classify(rel_posix: str) -> Tuple[str, List[str]] | None:
+    name = rel_posix.rsplit("/", 1)[-1]
+    for pattern, fmt, roles in RULES:
+        target = rel_posix if ("/" in pattern or pattern.startswith("**")) else name
+        if fnmatch.fnmatch(target, pattern):
+            return fmt, roles
+    return None
+
+
+def _capture_source(
+    raw: bytes, text: str, capture_text: bool, text_max_bytes: int
+) -> Tuple[str, bool]:
+    """Decide ``(source, text_truncated)`` for a decodable file.
+
+    Slices ``raw`` (not ``text``) for the cap, so it is a true byte cap even
+    when it lands inside a multi-byte character -- ``errors="ignore"`` drops
+    the dangling partial char at the cut, so this never raises."""
+    if not capture_text:
+        return "", False
+    if len(raw) <= text_max_bytes:
+        return text, False
+    return raw[:text_max_bytes].decode("utf-8", errors="ignore"), True
+
+
+def discover_artifacts(
+    project_dir: Path,
+    app_name: str,
+    *,
+    capture_text: bool = True,
+    text_max_bytes: int = 262144,
+) -> Dict[str, PyArtifact]:
+    """Walk the project and return every file as an artifact, sorted by path.
+
+    Never-drop inventory (issue #157 follow-up): a rule-matched file keeps its
+    RULES format/roles; everything else falls back to ``text``/``["unknown"]``
+    (``source`` captured), or ``binary``/empty ``source`` when it is not UTF-8
+    decodable -- rule-matched but undecodable files downgrade to ``binary``
+    too, keeping the rule's roles. The one exclusion is a `.py` file no RULES
+    entry names: the symbol table already owns it. ``setup.py`` is the
+    deliberate exception -- it IS rule-matched (a dependency-manifest), so it
+    is captured like any other manifest despite the `.py` suffix.
+
+    ``capture_text=False`` empties ``source`` everywhere (inventory otherwise
+    identical); a decodable file over ``text_max_bytes`` gets a truncated
+    ``source`` and ``text_truncated=True`` -- except a ``dependency-manifest``
+    role artifact, which is always captured in full when decodable and
+    ``capture_text`` is on: its source is what ``build_dependency_view``
+    parses, not bulk/incidental content, so the byte cap does not apply to
+    it (``capture_text=False`` still empties it like everything else).
+    ``sha256``/``size_bytes`` always reflect the full file regardless of
+    either knob."""
+    out: Dict[str, PyArtifact] = {}
+    for path in sorted(project_dir.rglob("*")):
+        if not path.is_file():
+            continue
+        rel = path.relative_to(project_dir)
+        if any(part in _IGNORED_DIRS for part in rel.parts):
+            continue
+        rel_posix = rel.as_posix()
+        name = rel_posix.rsplit("/", 1)[-1]
+        hit = _classify(rel_posix)
+        if hit is None and name.endswith(".py"):
+            continue  # symbol table's domain (setup.py is rule-matched above)
+
+        raw = path.read_bytes()
+        try:
+            text = raw.decode("utf-8")
+            decodable = True
+        except UnicodeDecodeError:
+            text, decodable = "", False
+
+        if hit is not None:
+            fmt, roles = hit
+        else:
+            fmt, roles = "text", ["unknown"]
+            # Extensionless shebang script (e.g. odoo-bin): no RULES glob can
+            # name these (nothing to match on but the shebang itself), so this
+            # is the one deterministic content-sniff refinement.
+            if decodable and "." not in name and text.startswith("#!"):
+                roles = ["script"]
+        if decodable:
+            # A dependency-manifest's source IS the extracted meaning (build_
+            # dependency_view parses it) -- the byte cap targets bulk/incidental
+            # assets, never the files extraction depends on, so manifests are
+            # exempt from it. capture_text=False still empties source (handled
+            # inside _capture_source); only the byte CAP is bypassed here.
+            cap = len(raw) if "dependency-manifest" in roles else text_max_bytes
+            source, text_truncated = _capture_source(raw, text, capture_text, cap)
+        else:
+            fmt, source, text_truncated = "binary", "", False
+
+        out[rel_posix] = PyArtifact(
+            id=artifact_id(app_name, rel_posix), path=rel_posix, format=fmt,
+            roles=list(roles), size_bytes=len(raw),
+            sha256=hashlib.sha256(raw).hexdigest(),
+            source=source, text_truncated=text_truncated,
+        )
+    return out

codeanalyzer/artifacts/parsers.py

@@ -0,0 +1,248 @@
+"""Dependency-manifest readers. Pure text-in/records-out; no execution, no I/O."""
+
+import ast
+import configparser
+import json
+import re
+import sys
+from dataclasses import dataclass
+from typing import Dict, List, Optional, Tuple
+
+if sys.version_info >= (3, 11):
+    import tomllib
+else:  # pragma: no cover - exercised on the 3.10 CI leg
+    import tomli as tomllib
+
+import yaml
+
+
+@dataclass(frozen=True)
+class RawDep:
+    name: str  # PEP 503 normalized
+    spec: str = ""
+    kind: str = "runtime"  # runtime|dev|optional|build
+    extras: Tuple[str, ...] = ()
+
+
+def normalize_name(raw: str) -> str:
+    return re.sub(r"[-_.]+", "-", raw).lower()
+
+
+_REQ_LINE = re.compile(
+    r"^\s*(?P<name>[A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[(?P<extras>[^\]]+)\])?\s*(?P<spec>[^;#]*)"
+)
+
+
+def parse_requirement_line(line: str, kind: str = "runtime") -> Optional[RawDep]:
+    """One PEP 508-ish requirement line -> RawDep (None for options/paths/URLs)."""
+    line = line.split("#", 1)[0].strip()
+    if not line or line.startswith(("-", "--")) or line.startswith((".", "/")):
+        return None
+    if " @ " in line:
+        line = line.split(" @ ", 1)[0].strip()  # direct ref (PEP 508): keep the name, drop the URL
+    elif "://" in line:
+        return None
+    m = _REQ_LINE.match(line)
+    if not m:
+        return None
+    extras = tuple(e.strip() for e in (m.group("extras") or "").split(",") if e.strip())
+    spec = m.group("spec").strip().rstrip(",")
+    if spec.endswith("\\"):
+        spec = spec[:-1].rstrip()  # pip-compile --generate-hashes line continuation
+    return RawDep(normalize_name(m.group("name")), spec, kind, extras)
+
+
+_REF_LINE = re.compile(r"^(?:-r|--requirement|-c|--constraint)\s+(\S+)")
+
+
+def parse_requirement_refs(text: str) -> List[str]:
+    """-r/--requirement/-c/--constraint targets from a requirements file, in order."""
+    out = []
+    for line in text.splitlines():
+        line = line.split("#", 1)[0].strip()
+        m = _REF_LINE.match(line)
+        if m:
+            out.append(m.group(1))
+    return out
+
+
+def _kind_for_requirements(basename: str) -> str:
+    return "dev" if re.search(r"\b(dev|test|lint|doc)\b", basename, re.I) else "runtime"
+
+
+def _parse_requirements(basename: str, text: str) -> List[RawDep]:
+    kind = _kind_for_requirements(basename)
+    out = []
+    for line in text.splitlines():
+        dep = parse_requirement_line(line, kind)
+        if dep:
+            out.append(dep)
+    return out
+
+
+def _spec_and_extras(spec) -> Tuple[str, Tuple[str, ...]]:
+    """Poetry/Pipfile dep spec (bare string or {version, extras} inline table) -> (version, extras)."""
+    if isinstance(spec, dict):
+        return spec.get("version", "") or "", tuple(spec.get("extras", []) or [])
+    return (spec if isinstance(spec, str) else ""), ()
+
+
+def _parse_pyproject(text: str) -> List[RawDep]:
+    data = tomllib.loads(text)
+    out: List[RawDep] = []
+    for req in (data.get("build-system") or {}).get("requires", []):
+        d = parse_requirement_line(req, "build")
+        if d:
+            out.append(d)
+    proj = data.get("project") or {}
+    for req in proj.get("dependencies", []):
+        d = parse_requirement_line(req)
+        if d:
+            out.append(d)
+    for group in (proj.get("optional-dependencies") or {}).values():
+        for req in group:
+            d = parse_requirement_line(req, "optional")
+            if d:
+                out.append(d)
+    poetry = ((data.get("tool") or {}).get("poetry")) or {}
+    for name, spec in (poetry.get("dependencies") or {}).items():
+        if normalize_name(name) == "python":
+            continue
+        v, ex = _spec_and_extras(spec)
+        out.append(RawDep(normalize_name(name), v, "runtime", ex))
+    for gname, group in (poetry.get("group") or {}).items():
+        kind = "dev" if gname == "dev" else "optional"
+        for name, spec in (group.get("dependencies") or {}).items():
+            v, ex = _spec_and_extras(spec)
+            out.append(RawDep(normalize_name(name), v, kind, ex))
+    for name, spec in (poetry.get("dev-dependencies") or {}).items():  # legacy poetry
+        v, ex = _spec_and_extras(spec)
+        out.append(RawDep(normalize_name(name), v, "dev", ex))
+    return out
+
+
+def _parse_setup_py(text: str) -> Tuple[List[RawDep], bool]:
+    """Static AST only. Literal lists lift; anything computed -> partial=True."""
+    try:
+        tree = ast.parse(text)
+    except SyntaxError:
+        return [], True
+    out: List[RawDep] = []
+    partial = False
+    for node in ast.walk(tree):
+        if not (isinstance(node, ast.Call) and getattr(node.func, "id", getattr(node.func, "attr", "")) == "setup"):
+            continue
+        for kw in node.keywords:
+            if kw.arg == "install_requires":
+                lifted = _lift_str_list(kw.value)
+                if lifted is None:
+                    partial = True
+                else:
+                    out += [d for d in (parse_requirement_line(s) for s in lifted) if d]
+            elif kw.arg == "extras_require":
+                if not isinstance(kw.value, ast.Dict):
+                    partial = True
+                    continue
+                for v in kw.value.values:
+                    lifted = _lift_str_list(v)
+                    if lifted is None:
+                        partial = True
+                    else:
+                        out += [d for d in (parse_requirement_line(s, "optional") for s in lifted) if d]
+    return out, partial
+
+
+def _lift_str_list(node: ast.AST) -> Optional[List[str]]:
+    if isinstance(node, (ast.List, ast.Tuple)) and all(
+        isinstance(e, ast.Constant) and isinstance(e.value, str) for e in node.elts
+    ):
+        return [e.value for e in node.elts]
+    return None
+
+
+def _parse_setup_cfg(text: str) -> List[RawDep]:
+    cp = configparser.ConfigParser()
+    cp.read_string(text)
+    out: List[RawDep] = []
+    if cp.has_option("options", "install_requires"):
+        for line in cp.get("options", "install_requires").splitlines():
+            d = parse_requirement_line(line)
+            if d:
+                out.append(d)
+    if cp.has_section("options.extras_require"):
+        for _, val in cp.items("options.extras_require"):
+            for line in val.splitlines():
+                d = parse_requirement_line(line, "optional")
+                if d:
+                    out.append(d)
+    return out
+
+
+def _parse_pipfile(text: str) -> List[RawDep]:
+    data = tomllib.loads(text)
+    out: List[RawDep] = []
+    for section, kind in (("packages", "runtime"), ("dev-packages", "dev")):
+        for name, spec in (data.get(section) or {}).items():
+            v, ex = _spec_and_extras(spec)
+            out.append(RawDep(normalize_name(name), "" if v == "*" else v, kind, ex))
+    return out
+
+
+def _parse_environment_yml(text: str) -> List[RawDep]:
+    data = yaml.safe_load(text) or {}
+    out: List[RawDep] = []
+    for item in data.get("dependencies") or []:
+        if isinstance(item, str):
+            d = parse_requirement_line(item)
+            if d and d.name not in ("pip", "python"):
+                out.append(d)
+        elif isinstance(item, dict):
+            for req in item.get("pip") or []:
+                d = parse_requirement_line(req)
+                if d:
+                    out.append(d)
+    return out
+
+
+def parse_manifest(path: str, text: str) -> Tuple[List[RawDep], bool]:
+    """Dispatch on basename -> (records, partial). Unknown basenames -> ([], False)."""
+    base = path.rsplit("/", 1)[-1]
+    try:
+        if base.startswith("requirements") and base.endswith(".txt"):
+            return _parse_requirements(base, text), False
+        if base == "pyproject.toml":
+            return _parse_pyproject(text), False
+        if base == "setup.py":
+            return _parse_setup_py(text)
+        if base == "setup.cfg":
+            return _parse_setup_cfg(text), False
+        if base == "Pipfile":
+            return _parse_pipfile(text), False
+        if base in ("environment.yml", "environment.yaml"):
+            return _parse_environment_yml(text), False
+    except Exception:
+        return [], True  # unparseable manifest: keep the artifact, flag extraction
+    return [], False
+
+
+def parse_lock_pins(path: str, text: str) -> Dict[str, str]:
+    """Lock file -> {normalized name: pinned version}. Never creates records."""
+    base = path.rsplit("/", 1)[-1]
+    try:
+        if base in ("poetry.lock", "uv.lock"):
+            data = tomllib.loads(text)
+            return {
+                normalize_name(p["name"]): str(p["version"])
+                for p in data.get("package") or [] if "name" in p and "version" in p
+            }
+        if base == "Pipfile.lock":
+            data = json.loads(text)
+            out = {}
+            for section in ("default", "develop"):
+                for name, meta in (data.get(section) or {}).items():
+                    v = (meta or {}).get("version", "")
+                    out[normalize_name(name)] = v.lstrip("=")
+            return out
+    except Exception:
+        return {}
+    return {}