entrygraph 0.1.0__py3-none-any.whl

entrygraph/detect/frameworks.py

@@ -0,0 +1,369 @@
+"""Framework detection: manifest deps + code signals, noisy-or confidence.
+
+confidence = 1 - prod(1 - w_i) over fired signals. A manifest dependency or an
+import alone is strong evidence; file-presence signals corroborate.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+from dataclasses import dataclass
+from typing import Literal
+
+from entrygraph.detect.manifests import ManifestDeps
+
+SignalKind = Literal["manifest_dep", "import", "file_presence", "symbol_name"]
+
+
+@dataclass(frozen=True, slots=True)
+class FrameworkSignal:
+    kind: SignalKind
+    pattern: str  # dep glob, import module, path glob, or symbol-name glob
+    weight: float
+
+
+@dataclass(frozen=True, slots=True)
+class FrameworkSpec:
+    name: str
+    language: str
+    signals: tuple[FrameworkSignal, ...]
+    threshold: float = 0.5
+
+
+@dataclass(frozen=True, slots=True)
+class DetectedFramework:
+    name: str
+    language: str
+    confidence: float
+    evidence: tuple[str, ...]
+
+    @property
+    def detected(self) -> bool:
+        return True
+
+
+FRAMEWORKS: list[FrameworkSpec] = [
+    FrameworkSpec("flask", "python", (
+        FrameworkSignal("manifest_dep", "flask", 0.8),
+        FrameworkSignal("import", "flask", 0.7),
+    )),
+    FrameworkSpec("fastapi", "python", (
+        FrameworkSignal("manifest_dep", "fastapi", 0.8),
+        FrameworkSignal("import", "fastapi", 0.7),
+    )),
+    FrameworkSpec("django", "python", (
+        FrameworkSignal("manifest_dep", "django", 0.8),
+        FrameworkSignal("import", "django", 0.7),
+        FrameworkSignal("file_presence", "*manage.py", 0.3),
+        FrameworkSignal("file_presence", "*urls.py", 0.2),
+    )),
+    FrameworkSpec("click", "python", (
+        FrameworkSignal("manifest_dep", "click", 0.8),
+        FrameworkSignal("import", "click", 0.7),
+    )),
+    FrameworkSpec("typer", "python", (
+        FrameworkSignal("manifest_dep", "typer", 0.8),
+        FrameworkSignal("import", "typer", 0.7),
+    )),
+    FrameworkSpec("argparse", "python", (
+        FrameworkSignal("import", "argparse", 0.7),
+    )),
+    FrameworkSpec("celery", "python", (
+        FrameworkSignal("manifest_dep", "celery", 0.8),
+        FrameworkSignal("import", "celery", 0.7),
+    )),
+    FrameworkSpec("aws-lambda", "python", (
+        FrameworkSignal("file_presence", "serverless.y*ml", 0.5),
+        FrameworkSignal("file_presence", "template.y*ml", 0.3),
+        FrameworkSignal("symbol_name", "lambda_handler", 0.5),
+    )),
+    # JS/TS, Go, Java, Ruby specs land with their extractors (M8)
+    FrameworkSpec("express", "javascript", (
+        FrameworkSignal("manifest_dep", "express", 0.8),
+        FrameworkSignal("import", "express", 0.7),
+    )),
+    FrameworkSpec("fastify", "javascript", (
+        FrameworkSignal("manifest_dep", "fastify", 0.8),
+        FrameworkSignal("import", "fastify", 0.7),
+    )),
+    FrameworkSpec("nestjs", "javascript", (
+        FrameworkSignal("manifest_dep", "@nestjs/*", 0.8),
+        FrameworkSignal("import", "@nestjs/*", 0.7),
+    )),
+    FrameworkSpec("next", "javascript", (
+        FrameworkSignal("manifest_dep", "next", 0.8),
+        FrameworkSignal("file_presence", "next.config.*", 0.5),
+    )),
+    FrameworkSpec("react", "javascript", (
+        FrameworkSignal("manifest_dep", "react", 0.8),
+        FrameworkSignal("import", "react", 0.7),
+    )),
+    FrameworkSpec("gin", "go", (
+        FrameworkSignal("manifest_dep", "github.com/gin-gonic/gin", 0.8),
+        FrameworkSignal("import", "github.com/gin-gonic/gin", 0.7),
+    )),
+    FrameworkSpec("echo", "go", (
+        FrameworkSignal("manifest_dep", "github.com/labstack/echo*", 0.8),
+        FrameworkSignal("import", "github.com/labstack/echo*", 0.7),
+    )),
+    FrameworkSpec("cobra", "go", (
+        FrameworkSignal("manifest_dep", "github.com/spf13/cobra", 0.8),
+        FrameworkSignal("import", "github.com/spf13/cobra", 0.7),
+    )),
+    FrameworkSpec("net/http", "go", (
+        FrameworkSignal("import", "net/http", 0.7),
+    )),
+    FrameworkSpec("spring-boot", "java", (
+        FrameworkSignal("manifest_dep", "*spring-boot*", 0.8),
+        FrameworkSignal("import", "org.springframework*", 0.7),
+    )),
+    FrameworkSpec("jax-rs", "java", (
+        FrameworkSignal("import", "javax.ws.rs*", 0.7),
+        FrameworkSignal("import", "jakarta.ws.rs*", 0.7),
+    )),
+    FrameworkSpec("rails", "ruby", (
+        FrameworkSignal("manifest_dep", "rails", 0.8),
+        FrameworkSignal("file_presence", "config/routes.rb", 0.5),
+    )),
+    FrameworkSpec("sinatra", "ruby", (
+        FrameworkSignal("manifest_dep", "sinatra", 0.8),
+        FrameworkSignal("import", "sinatra", 0.7),
+    )),
+    FrameworkSpec("rake", "ruby", (
+        FrameworkSignal("file_presence", "Rakefile", 0.6),
+    )),
+    # --- C6: additional framework specs ---
+    # Python
+    FrameworkSpec("tornado", "python", (
+        FrameworkSignal("manifest_dep", "tornado", 0.8),
+        FrameworkSignal("import", "tornado", 0.7),
+    )),
+    FrameworkSpec("aiohttp", "python", (
+        FrameworkSignal("manifest_dep", "aiohttp", 0.8),
+        FrameworkSignal("import", "aiohttp", 0.7),
+    )),
+    FrameworkSpec("bottle", "python", (
+        FrameworkSignal("manifest_dep", "bottle", 0.8),
+        FrameworkSignal("import", "bottle", 0.7),
+    )),
+    FrameworkSpec("pyramid", "python", (
+        FrameworkSignal("manifest_dep", "pyramid", 0.8),
+        FrameworkSignal("import", "pyramid", 0.7),
+    )),
+    FrameworkSpec("sanic", "python", (
+        FrameworkSignal("manifest_dep", "sanic", 0.8),
+        FrameworkSignal("import", "sanic", 0.7),
+    )),
+    FrameworkSpec("dramatiq", "python", (
+        FrameworkSignal("manifest_dep", "dramatiq", 0.8),
+        FrameworkSignal("import", "dramatiq", 0.7),
+    )),
+    FrameworkSpec("rq", "python", (
+        FrameworkSignal("manifest_dep", "rq", 0.8),
+        FrameworkSignal("import", "rq", 0.7),
+    )),
+    FrameworkSpec("airflow", "python", (
+        FrameworkSignal("manifest_dep", "apache-airflow", 0.8),
+        FrameworkSignal("import", "airflow", 0.7),
+        FrameworkSignal("file_presence", "*dags/*", 0.2),
+    )),
+    # JS/TS
+    FrameworkSpec("koa", "javascript", (
+        FrameworkSignal("manifest_dep", "koa", 0.8),
+        FrameworkSignal("import", "koa", 0.7),
+    )),
+    FrameworkSpec("hapi", "javascript", (
+        FrameworkSignal("manifest_dep", "@hapi/hapi", 0.8),
+        FrameworkSignal("import", "@hapi/hapi", 0.7),
+    )),
+    FrameworkSpec("remix", "javascript", (
+        FrameworkSignal("manifest_dep", "@remix-run/*", 0.8),
+        FrameworkSignal("file_presence", "app/routes/*", 0.3),
+    )),
+    FrameworkSpec("hono", "javascript", (
+        FrameworkSignal("manifest_dep", "hono", 0.8),
+        FrameworkSignal("import", "hono", 0.7),
+    )),
+    FrameworkSpec("electron", "javascript", (
+        FrameworkSignal("manifest_dep", "electron", 0.8),
+        FrameworkSignal("import", "electron", 0.7),
+    )),
+    FrameworkSpec("socket.io", "javascript", (
+        FrameworkSignal("manifest_dep", "socket.io", 0.8),
+        FrameworkSignal("import", "socket.io", 0.7),
+    )),
+    # Go
+    FrameworkSpec("fiber", "go", (
+        FrameworkSignal("manifest_dep", "github.com/gofiber/fiber*", 0.8),
+        FrameworkSignal("import", "github.com/gofiber/fiber*", 0.7),
+    )),
+    FrameworkSpec("chi", "go", (
+        FrameworkSignal("manifest_dep", "github.com/go-chi/chi*", 0.8),
+        FrameworkSignal("import", "github.com/go-chi/chi*", 0.7),
+    )),
+    FrameworkSpec("gorilla-mux", "go", (
+        FrameworkSignal("manifest_dep", "github.com/gorilla/mux", 0.8),
+        FrameworkSignal("import", "github.com/gorilla/mux", 0.7),
+    )),
+    FrameworkSpec("grpc-go", "go", (
+        FrameworkSignal("manifest_dep", "google.golang.org/grpc", 0.8),
+        FrameworkSignal("import", "google.golang.org/grpc", 0.7),
+    )),
+    FrameworkSpec("urfave-cli", "go", (
+        FrameworkSignal("manifest_dep", "github.com/urfave/cli*", 0.8),
+        FrameworkSignal("import", "github.com/urfave/cli*", 0.7),
+    )),
+    # Java
+    FrameworkSpec("micronaut", "java", (
+        FrameworkSignal("manifest_dep", "*micronaut*", 0.8),
+        FrameworkSignal("import", "io.micronaut*", 0.7),
+    )),
+    FrameworkSpec("quarkus", "java", (
+        FrameworkSignal("manifest_dep", "*quarkus*", 0.8),
+        FrameworkSignal("import", "io.quarkus*", 0.7),
+    )),
+    FrameworkSpec("vertx", "java", (
+        FrameworkSignal("manifest_dep", "*vertx*", 0.8),
+        FrameworkSignal("import", "io.vertx*", 0.7),
+    )),
+    FrameworkSpec("servlet-api", "java", (
+        FrameworkSignal("import", "javax.servlet*", 0.7),
+        FrameworkSignal("import", "jakarta.servlet*", 0.7),
+        FrameworkSignal("file_presence", "*web.xml", 0.3),
+    )),
+    FrameworkSpec("dropwizard", "java", (
+        FrameworkSignal("manifest_dep", "*dropwizard*", 0.8),
+        FrameworkSignal("import", "io.dropwizard*", 0.7),
+    )),
+    # Ruby
+    FrameworkSpec("hanami", "ruby", (
+        FrameworkSignal("manifest_dep", "hanami", 0.8),
+        FrameworkSignal("import", "hanami", 0.7),
+    )),
+    FrameworkSpec("grape", "ruby", (
+        FrameworkSignal("manifest_dep", "grape", 0.8),
+        FrameworkSignal("import", "grape", 0.7),
+    )),
+    FrameworkSpec("sidekiq", "ruby", (
+        FrameworkSignal("manifest_dep", "sidekiq", 0.8),
+        FrameworkSignal("import", "sidekiq", 0.7),
+    )),
+    FrameworkSpec("rack", "ruby", (
+        FrameworkSignal("manifest_dep", "rack", 0.8),
+        FrameworkSignal("file_presence", "config.ru", 0.6),
+    )),
+    # --- C2/C3/C4: C#, PHP, Rust ---
+    FrameworkSpec("aspnetcore", "csharp", (
+        FrameworkSignal("manifest_dep", "microsoft.aspnetcore*", 0.8),
+        FrameworkSignal("import", "Microsoft.AspNetCore*", 0.7),
+        FrameworkSignal("file_presence", "*appsettings.json", 0.2),
+    )),
+    FrameworkSpec("ef-core", "csharp", (
+        FrameworkSignal("manifest_dep", "microsoft.entityframeworkcore*", 0.8),
+        FrameworkSignal("import", "Microsoft.EntityFrameworkCore*", 0.7),
+    )),
+    FrameworkSpec("laravel", "php", (
+        FrameworkSignal("manifest_dep", "laravel/framework", 0.8),
+        FrameworkSignal("file_presence", "artisan", 0.5),
+        FrameworkSignal("file_presence", "routes/web.php", 0.3),
+    )),
+    FrameworkSpec("symfony", "php", (
+        FrameworkSignal("manifest_dep", "symfony/framework-bundle", 0.8),
+        FrameworkSignal("manifest_dep", "symfony/*", 0.5),
+        FrameworkSignal("file_presence", "bin/console", 0.4),
+    )),
+    FrameworkSpec("wordpress", "php", (
+        FrameworkSignal("file_presence", "wp-config.php", 0.7),
+        FrameworkSignal("symbol_name", "wp_*", 0.2),
+    )),
+    FrameworkSpec("actix-web", "rust", (
+        FrameworkSignal("manifest_dep", "actix-web", 0.8),
+        FrameworkSignal("import", "actix_web", 0.7),
+    )),
+    FrameworkSpec("axum", "rust", (
+        FrameworkSignal("manifest_dep", "axum", 0.8),
+        FrameworkSignal("import", "axum", 0.7),
+    )),
+    FrameworkSpec("rocket", "rust", (
+        FrameworkSignal("manifest_dep", "rocket", 0.8),
+        FrameworkSignal("import", "rocket", 0.7),
+    )),
+    FrameworkSpec("clap", "rust", (
+        FrameworkSignal("manifest_dep", "clap", 0.8),
+        FrameworkSignal("import", "clap", 0.7),
+    )),
+    FrameworkSpec("tokio", "rust", (
+        FrameworkSignal("manifest_dep", "tokio", 0.8),
+        FrameworkSignal("import", "tokio", 0.7),
+    )),
+]
+
+
+def detect_frameworks(
+    manifests: ManifestDeps,
+    import_signals: set[tuple[str, str]],  # (language, module)
+    file_paths: list[str],
+    symbol_names: set[str] | None = None,
+    languages_present: set[str] | None = None,
+) -> list[DetectedFramework]:
+    symbol_names = symbol_names or set()
+    detected: list[DetectedFramework] = []
+    for spec in FRAMEWORKS:
+        if languages_present is not None and spec.language not in languages_present:
+            continue
+        fired: list[tuple[FrameworkSignal, str]] = []
+        for signal in spec.signals:
+            evidence = _check_signal(signal, spec, manifests, import_signals, file_paths, symbol_names)
+            if evidence:
+                fired.append((signal, evidence))
+        if not fired:
+            continue
+        confidence = 1.0
+        for signal, _ in fired:
+            confidence *= 1.0 - signal.weight
+        confidence = 1.0 - confidence
+        if confidence >= spec.threshold:
+            detected.append(
+                DetectedFramework(
+                    name=spec.name,
+                    language=spec.language,
+                    confidence=round(confidence, 3),
+                    evidence=tuple(e for _, e in fired),
+                )
+            )
+    detected.sort(key=lambda d: d.confidence, reverse=True)
+    return detected
+
+
+def _check_signal(
+    signal: FrameworkSignal,
+    spec: FrameworkSpec,
+    manifests: ManifestDeps,
+    import_signals: set[tuple[str, str]],
+    file_paths: list[str],
+    symbol_names: set[str],
+) -> str | None:
+    if signal.kind == "manifest_dep":
+        for dep in manifests.for_language(spec.language):
+            if fnmatch.fnmatch(dep.lower(), signal.pattern.lower()):
+                return f"manifest dependency {dep!r}"
+    elif signal.kind == "import":
+        for lang, module in import_signals:
+            if _same_ecosystem(lang, spec.language) and fnmatch.fnmatch(module, signal.pattern):
+                return f"import of {module!r}"
+    elif signal.kind == "file_presence":
+        for path in file_paths:
+            if fnmatch.fnmatch(path, signal.pattern):
+                return f"file {path!r}"
+    elif signal.kind == "symbol_name":
+        for name in symbol_names:
+            if fnmatch.fnmatch(name, signal.pattern):
+                return f"symbol {name!r}"
+    return None
+
+
+def _same_ecosystem(lang: str, spec_lang: str) -> bool:
+    js = {"javascript", "typescript", "tsx"}
+    if spec_lang == "javascript":
+        return lang in js
+    return lang == spec_lang

entrygraph/detect/manifests.py

@@ -0,0 +1,234 @@
+"""Dependency-manifest parsers — stdlib + regex only.
+
+Each parser takes file text and returns a set of normalized dependency names.
+``parse_manifests(root)`` walks the well-known manifest locations and merges
+results per ecosystem.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import tomllib
+import xml.etree.ElementTree as ET
+from dataclasses import dataclass, field
+from pathlib import Path
+
+_REQ_LINE = re.compile(r"^\s*([A-Za-z0-9][A-Za-z0-9._-]*)")
+_GO_REQUIRE_BLOCK = re.compile(r"require\s*\(([^)]*)\)", re.DOTALL)
+_GO_REQUIRE_LINE = re.compile(r"^\s*require\s+(\S+)", re.MULTILINE)
+_GO_MODULE_LINE = re.compile(r"^\s*(\S+)\s+v[\w.\-+]+", re.MULTILINE)
+_GRADLE_DEP = re.compile(
+    r"""(?:implementation|api|compile|runtimeOnly|compileOnly|testImplementation)\s*[\(\s]\s*['"]([^'"]+)['"]"""
+)
+_GEMFILE_GEM = re.compile(r"""^\s*gem\s+['"]([^'"]+)['"]""", re.MULTILINE)
+
+
+def parse_requirements_txt(text: str) -> set[str]:
+    deps: set[str] = set()
+    for line in text.splitlines():
+        line = line.strip()
+        if not line or line.startswith(("#", "-")):
+            continue
+        match = _REQ_LINE.match(line)
+        if match:
+            deps.add(match.group(1).lower().replace("_", "-"))
+    return deps
+
+
+def parse_pyproject_toml(text: str) -> set[str]:
+    try:
+        data = tomllib.loads(text)
+    except tomllib.TOMLDecodeError:
+        return set()
+    deps: set[str] = set()
+    project = data.get("project", {})
+    raw: list[str] = list(project.get("dependencies", []) or [])
+    for extra_deps in (project.get("optional-dependencies", {}) or {}).values():
+        raw.extend(extra_deps or [])
+    for spec in raw:
+        match = _REQ_LINE.match(spec)
+        if match:
+            deps.add(match.group(1).lower().replace("_", "-"))
+    poetry = data.get("tool", {}).get("poetry", {}).get("dependencies", {}) or {}
+    deps.update(k.lower().replace("_", "-") for k in poetry if k.lower() != "python")
+    return deps
+
+
+def parse_package_json(text: str) -> set[str]:
+    try:
+        data = json.loads(text)
+    except (json.JSONDecodeError, TypeError):
+        return set()
+    if not isinstance(data, dict):
+        return set()
+    deps: set[str] = set()
+    for key in ("dependencies", "devDependencies", "peerDependencies"):
+        section = data.get(key)
+        if isinstance(section, dict):
+            deps.update(section)
+    return deps
+
+
+def parse_go_mod(text: str) -> set[str]:
+    deps: set[str] = set()
+    for block in _GO_REQUIRE_BLOCK.findall(text):
+        deps.update(_GO_MODULE_LINE.findall(block))
+    for single in _GO_REQUIRE_LINE.findall(text):
+        if single != "(":
+            deps.add(single)
+    return deps
+
+
+def parse_pom_xml(text: str) -> set[str]:
+    try:
+        root = ET.fromstring(text)
+    except ET.ParseError:
+        return set()
+    ns = {"m": root.tag.split("}")[0].strip("{")} if root.tag.startswith("{") else {}
+    prefix = "m:" if ns else ""
+    deps: set[str] = set()
+    for dep in root.iter():
+        if dep.tag.endswith("dependency"):
+            group = dep.find(f"{prefix}groupId", ns)
+            artifact = dep.find(f"{prefix}artifactId", ns)
+            if group is not None and artifact is not None:
+                deps.add(f"{group.text}:{artifact.text}")
+    return deps
+
+
+def parse_build_gradle(text: str) -> set[str]:
+    return {m for m in _GRADLE_DEP.findall(text)}
+
+
+def parse_gemfile(text: str) -> set[str]:
+    return set(_GEMFILE_GEM.findall(text))
+
+
+def parse_csproj(text: str) -> set[str]:
+    """NuGet <PackageReference Include="..."> (and <Reference> fallback)."""
+    try:
+        root = ET.fromstring(text)
+    except ET.ParseError:
+        return set()
+    deps: set[str] = set()
+    for el in root.iter():
+        tag = el.tag.split("}")[-1]
+        if tag in ("PackageReference", "Reference"):
+            include = el.get("Include")
+            if include:
+                deps.add(include.split(",", 1)[0].strip().lower())
+    return deps
+
+
+def parse_packages_config(text: str) -> set[str]:
+    """Legacy NuGet packages.config: <package id="..." />."""
+    try:
+        root = ET.fromstring(text)
+    except ET.ParseError:
+        return set()
+    return {
+        el.get("id").lower()
+        for el in root.iter()
+        if el.tag.split("}")[-1] == "package" and el.get("id")
+    }
+
+
+def parse_composer_json(text: str) -> set[str]:
+    try:
+        data = json.loads(text)
+    except (json.JSONDecodeError, TypeError):
+        return set()
+    if not isinstance(data, dict):
+        return set()
+    deps: set[str] = set()
+    for key in ("require", "require-dev"):
+        section = data.get(key)
+        if isinstance(section, dict):
+            for name in section:
+                low = name.lower()
+                if low == "php" or low.startswith("ext-"):
+                    continue
+                deps.add(low)
+    return deps
+
+
+def parse_cargo_toml(text: str) -> set[str]:
+    try:
+        data = tomllib.loads(text)
+    except tomllib.TOMLDecodeError:
+        return set()
+    deps: set[str] = set()
+
+    def collect(section) -> None:
+        if isinstance(section, dict):
+            deps.update(k.lower().replace("_", "-") for k in section)
+
+    for key in ("dependencies", "dev-dependencies", "build-dependencies"):
+        collect(data.get(key))
+    collect(data.get("workspace", {}).get("dependencies"))
+    for target in (data.get("target", {}) or {}).values():
+        if isinstance(target, dict):
+            collect(target.get("dependencies"))
+    return deps
+
+
+@dataclass(slots=True)
+class ManifestDeps:
+    """Dependencies per ecosystem, plus which manifest files provided them."""
+
+    python: set[str] = field(default_factory=set)
+    javascript: set[str] = field(default_factory=set)
+    go: set[str] = field(default_factory=set)
+    java: set[str] = field(default_factory=set)
+    ruby: set[str] = field(default_factory=set)
+    csharp: set[str] = field(default_factory=set)
+    php: set[str] = field(default_factory=set)
+    rust: set[str] = field(default_factory=set)
+    sources: list[str] = field(default_factory=list)  # repo-relative manifest paths
+
+    def for_language(self, language: str) -> set[str]:
+        if language in ("typescript", "tsx"):
+            language = "javascript"
+        return getattr(self, language, set())
+
+
+_MANIFEST_SPECS: list[tuple[str, str, object]] = [  # (glob, ecosystem, parser fn)
+    ("requirements*.txt", "python", parse_requirements_txt),
+    ("pyproject.toml", "python", parse_pyproject_toml),
+    ("package.json", "javascript", parse_package_json),
+    ("go.mod", "go", parse_go_mod),
+    ("pom.xml", "java", parse_pom_xml),
+    ("build.gradle", "java", parse_build_gradle),
+    ("build.gradle.kts", "java", parse_build_gradle),
+    ("Gemfile", "ruby", parse_gemfile),
+    ("*.csproj", "csharp", parse_csproj),
+    ("packages.config", "csharp", parse_packages_config),
+    ("composer.json", "php", parse_composer_json),
+    ("Cargo.toml", "rust", parse_cargo_toml),
+]
+
+_MANIFEST_SEARCH_DEPTH = 3  # root plus a couple of levels for monorepos
+
+
+def parse_manifests(root: str | Path) -> ManifestDeps:
+    root = Path(root)
+    result = ManifestDeps()
+    for pattern, ecosystem, parser in _MANIFEST_SPECS:
+        for depth in range(_MANIFEST_SEARCH_DEPTH):
+            glob = "/".join(["*"] * depth + [pattern]) if depth else pattern
+            for manifest in root.glob(glob):
+                if not manifest.is_file():
+                    continue
+                if any(part in ("node_modules", "vendor", ".venv", "venv", "target", "packages")
+                       for part in manifest.parts):
+                    continue
+                try:
+                    text = manifest.read_text(encoding="utf-8", errors="replace")
+                except OSError:
+                    continue
+                deps = parser(text)
+                if deps:
+                    getattr(result, ecosystem).update(deps)
+                    result.sources.append(manifest.relative_to(root).as_posix())
+    return result