@opencodehub/ingestion 0.1.0

package/dist/pipeline/dep-parsers/go.js

@@ -0,0 +1,146 @@
+/**
+ * Go ecosystem manifest parser.
+ *
+ * Supported inputs:
+ *   - `go.sum` — one module per line, format
+ *       `<module> <version>[/go.mod] <h1:hash>`
+ *     We consume only the 2-column (module, version) projection and skip
+ *     the `/go.mod` discriminator so each module is emitted once.
+ *   - `go.mod` — uses the text format specified at https://go.dev/ref/mod.
+ *     We parse the `require` block (single- or multi-line form), capture
+ *     `<module> <version>` pairs, and skip `replace` / `exclude` directives.
+ *
+ * The version is the raw Go module pseudo-version string (e.g.
+ * `v1.2.3`, or `v0.0.0-20231201123456-abcdef012345`) exactly as it appears
+ * in the source file.
+ *
+ * License detection: neither go.mod nor go.sum carries license metadata.
+ * The canonical source is `pkg.go.dev` + the module's `LICENSE` file,
+ * both of which live behind a network boundary this phase forbids.
+ * Per-dep `license` therefore stays undefined and the dependencies
+ * phase maps that to the `"UNKNOWN"` sentinel.
+ */
+import { promises as fs } from "node:fs";
+import path from "node:path";
+const GO_ECO = "go";
+export const parseGoDeps = async (input) => {
+    const basename = path.basename(input.relPath);
+    try {
+        if (basename === "go.sum") {
+            return await parseGoSum(input.absPath, input.relPath, input.onWarn);
+        }
+        if (basename === "go.mod") {
+            return await parseGoMod(input.absPath, input.relPath, input.onWarn);
+        }
+    }
+    catch (err) {
+        input.onWarn(`go: failed to parse ${input.relPath}: ${err instanceof Error ? err.message : String(err)}`);
+        return [];
+    }
+    return [];
+};
+async function parseGoSum(absPath, relPath, onWarn) {
+    const raw = await safeRead(absPath, relPath, onWarn);
+    if (raw === undefined)
+        return [];
+    const out = [];
+    for (const line of raw.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (trimmed.length === 0)
+            continue;
+        // "<module> <version>[/go.mod] <h1:hash>" — we only need the first two.
+        const parts = trimmed.split(/\s+/);
+        if (parts.length < 2)
+            continue;
+        const modulePart = parts[0];
+        const rawVersion = parts[1];
+        if (!modulePart || !rawVersion)
+            continue;
+        // Strip the `/go.mod` suffix that appears on the second occurrence of
+        // every module so we don't emit it twice.
+        const version = rawVersion.endsWith("/go.mod")
+            ? rawVersion.slice(0, -"/go.mod".length)
+            : rawVersion;
+        out.push({
+            ecosystem: GO_ECO,
+            name: modulePart,
+            version,
+            lockfileSource: relPath,
+        });
+    }
+    return out;
+}
+async function parseGoMod(absPath, relPath, onWarn) {
+    const raw = await safeRead(absPath, relPath, onWarn);
+    if (raw === undefined)
+        return [];
+    const out = [];
+    const lines = raw.split(/\r?\n/);
+    let inRequireBlock = false;
+    for (const rawLine of lines) {
+        // Strip line comments ("// ...") but tolerate `//` inside module paths
+        // (which is disallowed by the spec but we guard anyway).
+        const commentIdx = rawLine.indexOf("//");
+        const line = (commentIdx === -1 ? rawLine : rawLine.slice(0, commentIdx)).trim();
+        if (line.length === 0)
+            continue;
+        if (inRequireBlock) {
+            if (line === ")") {
+                inRequireBlock = false;
+                continue;
+            }
+            const dep = parseRequireLine(line);
+            if (dep) {
+                out.push({
+                    ecosystem: GO_ECO,
+                    name: dep.name,
+                    version: dep.version,
+                    lockfileSource: relPath,
+                });
+            }
+            continue;
+        }
+        if (line === "require (" || line.startsWith("require (")) {
+            inRequireBlock = true;
+            continue;
+        }
+        if (line.startsWith("require ")) {
+            const dep = parseRequireLine(line.slice("require ".length).trim());
+            if (dep) {
+                out.push({
+                    ecosystem: GO_ECO,
+                    name: dep.name,
+                    version: dep.version,
+                    lockfileSource: relPath,
+                });
+            }
+        }
+        // `replace` and `exclude` are intentionally ignored — they are either
+        // redirection directives or explicit removals and do not add modules.
+    }
+    return out;
+}
+function parseRequireLine(line) {
+    // Strip the `// indirect` marker if present.
+    const clean = line.replace(/\/\/.*$/, "").trim();
+    if (clean.length === 0)
+        return undefined;
+    const parts = clean.split(/\s+/);
+    if (parts.length < 2)
+        return undefined;
+    const name = parts[0];
+    const version = parts[1];
+    if (!name || !version)
+        return undefined;
+    return { name, version };
+}
+async function safeRead(absPath, relPath, onWarn) {
+    try {
+        return await fs.readFile(absPath, "utf8");
+    }
+    catch (err) {
+        onWarn(`go: cannot read ${relPath}: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+}
+//# sourceMappingURL=go.js.map

package/dist/pipeline/dep-parsers/go.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.js","sourceRoot":"","sources":["../../../src/pipeline/dep-parsers/go.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,MAAM,GAAG,IAAa,CAAC;AAE7B,MAAM,CAAC,MAAM,WAAW,GAAgB,KAAK,EAAE,KAAK,EAAE,EAAE;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,CACV,uBAAuB,KAAK,CAAC,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,OAAe,EACf,MAA2B;IAE3B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,wEAAwE;QACxE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;YAAE,SAAS;QACzC,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC5C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC;YACxC,CAAC,CAAC,UAAU,CAAC;QACf,GAAG,CAAC,IAAI,CAAC;YACP,SAAS,EAAE,MAAM;YACjB,IAAI,EAAE,UAAU;YAChB,OAAO;YACP,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,OAAe,EACf,MAA2B;IAE3B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEhC,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,cAAc,GAAG,KAAK,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,GAAG,EAAE,CAAC;gBACR,GAAG,CAAC,IAAI,CAAC;oBACP,SAAS,EAAE,MAAM;oBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,cAAc,EAAE,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,cAAc,GAAG,IAAI,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,IAAI,GAAG,EAAE,CAAC;gBACR,GAAG,CAAC,IAAI,CAAC;oBACP,SAAS,EAAE,MAAM;oBACjB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,cAAc,EAAE,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,sEAAsE;QACtE,sEAAsE;IACxE,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,6CAA6C;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,OAAe,EACf,OAAe,EACf,MAA2B;IAE3B,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,mBAAmB,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1F,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/pipeline/dep-parsers/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Per-ecosystem dependency parser registry.
+ *
+ * The `dependencies` pipeline phase consumes this map: it inspects the
+ * scanned file list, dispatches each recognised manifest path to the
+ * matching parser, and merges the returned `ParsedDependency[]` arrays
+ * into the shared `KnowledgeGraph`.
+ */
+export { parseGoDeps } from "./go.js";
+export { parseMavenDeps } from "./maven.js";
+export { parseNpmDeps } from "./npm.js";
+export { parseNugetDeps } from "./nuget.js";
+export { parsePythonDeps } from "./python.js";
+export { parseRustDeps } from "./rust.js";
+export type { Ecosystem, ParseDepsFn, ParseDepsInput, ParsedDependency, WarnFn, } from "./types.js";
+export { compareParsedDependency, dedupAndSort } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/pipeline/dep-parsers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/pipeline/dep-parsers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,YAAY,EACV,SAAS,EACT,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/pipeline/dep-parsers/index.js

@@ -0,0 +1,16 @@
+/**
+ * Per-ecosystem dependency parser registry.
+ *
+ * The `dependencies` pipeline phase consumes this map: it inspects the
+ * scanned file list, dispatches each recognised manifest path to the
+ * matching parser, and merges the returned `ParsedDependency[]` arrays
+ * into the shared `KnowledgeGraph`.
+ */
+export { parseGoDeps } from "./go.js";
+export { parseMavenDeps } from "./maven.js";
+export { parseNpmDeps } from "./npm.js";
+export { parseNugetDeps } from "./nuget.js";
+export { parsePythonDeps } from "./python.js";
+export { parseRustDeps } from "./rust.js";
+export { compareParsedDependency, dedupAndSort } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/pipeline/dep-parsers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/pipeline/dep-parsers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAQ1C,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/pipeline/dep-parsers/maven.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Maven ecosystem manifest parser.
+ *
+ * Supported input:
+ *   - `pom.xml` — XML manifest with a top-level `<dependencies>` element
+ *     plus `<dependencyManagement><dependencies>` shape. Each dependency
+ *     carries `<groupId>`, `<artifactId>`, `<version>`, and an optional
+ *     `<scope>`.
+ *
+ * The v1.0 parser only walks direct dependencies; full transitive
+ * resolution requires a Maven resolver runtime and is out of scope (see
+ * research-scanners.yaml §dependency_parsers.maven.pom_xml.complexity).
+ *
+ * Scopes "test" and "provided" are dropped (per-spec requirement) because
+ * they contribute no production dependency the graph should reason about.
+ *
+ * Version interpolation (e.g. `${spring.version}`) is NOT resolved.
+ * The raw placeholder is written through verbatim so downstream tools
+ * can still detect the dependency, and callers know the value is
+ * unresolved.
+ */
+import type { ParseDepsFn } from "./types.js";
+export declare const parseMavenDeps: ParseDepsFn;
+//# sourceMappingURL=maven.d.ts.map

package/dist/pipeline/dep-parsers/maven.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maven.d.ts","sourceRoot":"","sources":["../../../src/pipeline/dep-parsers/maven.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AAkBhE,eAAO,MAAM,cAAc,EAAE,WAa5B,CAAC"}

package/dist/pipeline/dep-parsers/maven.js

@@ -0,0 +1,131 @@
+/**
+ * Maven ecosystem manifest parser.
+ *
+ * Supported input:
+ *   - `pom.xml` — XML manifest with a top-level `<dependencies>` element
+ *     plus `<dependencyManagement><dependencies>` shape. Each dependency
+ *     carries `<groupId>`, `<artifactId>`, `<version>`, and an optional
+ *     `<scope>`.
+ *
+ * The v1.0 parser only walks direct dependencies; full transitive
+ * resolution requires a Maven resolver runtime and is out of scope (see
+ * research-scanners.yaml §dependency_parsers.maven.pom_xml.complexity).
+ *
+ * Scopes "test" and "provided" are dropped (per-spec requirement) because
+ * they contribute no production dependency the graph should reason about.
+ *
+ * Version interpolation (e.g. `${spring.version}`) is NOT resolved.
+ * The raw placeholder is written through verbatim so downstream tools
+ * can still detect the dependency, and callers know the value is
+ * unresolved.
+ */
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { XMLParser } from "fast-xml-parser";
+const MAVEN_ECO = "maven";
+const EXCLUDED_SCOPES = new Set(["test", "provided", "system"]);
+export const parseMavenDeps = async (input) => {
+    const basename = path.basename(input.relPath);
+    try {
+        if (basename === "pom.xml") {
+            return await parsePom(input.absPath, input.relPath, input.onWarn);
+        }
+    }
+    catch (err) {
+        input.onWarn(`maven: failed to parse ${input.relPath}: ${err instanceof Error ? err.message : String(err)}`);
+        return [];
+    }
+    return [];
+};
+async function parsePom(absPath, relPath, onWarn) {
+    let raw;
+    try {
+        raw = await fs.readFile(absPath, "utf8");
+    }
+    catch (err) {
+        onWarn(`maven: cannot read ${relPath}: ${err instanceof Error ? err.message : String(err)}`);
+        return [];
+    }
+    const parser = new XMLParser({
+        ignoreAttributes: false,
+        attributeNamePrefix: "@_",
+        allowBooleanAttributes: true,
+        parseTagValue: true,
+        trimValues: true,
+    });
+    let parsed;
+    try {
+        parsed = parser.parse(raw);
+    }
+    catch (err) {
+        onWarn(`maven: ${relPath} is not valid XML: ${err instanceof Error ? err.message : String(err)}`);
+        return [];
+    }
+    if (!isObject(parsed))
+        return [];
+    const project = parsed["project"];
+    if (!isObject(project))
+        return [];
+    const out = [];
+    // Direct dependencies.
+    collectDependencies(project["dependencies"], out, relPath);
+    // dependencyManagement -> dependencies (defaults for child poms).
+    const mgmt = project["dependencyManagement"];
+    if (isObject(mgmt)) {
+        collectDependencies(mgmt["dependencies"], out, relPath);
+    }
+    return out;
+}
+function collectDependencies(bag, out, lockfileSource) {
+    if (!isObject(bag))
+        return;
+    const raw = bag["dependency"];
+    const list = Array.isArray(raw) ? raw : raw === undefined ? [] : [raw];
+    for (const item of list) {
+        const dep = toMavenDependency(item);
+        if (!dep)
+            continue;
+        if (dep.scope !== undefined && EXCLUDED_SCOPES.has(dep.scope))
+            continue;
+        if (!dep.groupId || !dep.artifactId)
+            continue;
+        const version = dep.version ?? "UNKNOWN";
+        out.push({
+            ecosystem: MAVEN_ECO,
+            name: `${dep.groupId}:${dep.artifactId}`,
+            version,
+            lockfileSource,
+            ...(dep.license !== undefined ? { license: dep.license } : {}),
+        });
+    }
+}
+function toMavenDependency(item) {
+    if (!isObject(item))
+        return undefined;
+    const groupId = toText(item["groupId"]);
+    const artifactId = toText(item["artifactId"]);
+    const version = toText(item["version"]);
+    const scope = toText(item["scope"]);
+    // A small fraction of Maven poms attach a free-form `<license>` child
+    // to each `<dependency>` (via extensions like the Eclipse Dash plugin
+    // or Spring Cloud BOMs). Best-effort read; undefined for standard poms.
+    const license = toText(item["license"]);
+    return {
+        ...(groupId !== undefined ? { groupId } : {}),
+        ...(artifactId !== undefined ? { artifactId } : {}),
+        ...(version !== undefined ? { version } : {}),
+        ...(scope !== undefined ? { scope } : {}),
+        ...(license !== undefined ? { license } : {}),
+    };
+}
+function toText(v) {
+    if (typeof v === "string")
+        return v.trim();
+    if (typeof v === "number" || typeof v === "boolean")
+        return String(v);
+    return undefined;
+}
+function isObject(x) {
+    return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+//# sourceMappingURL=maven.js.map

package/dist/pipeline/dep-parsers/maven.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maven.js","sourceRoot":"","sources":["../../../src/pipeline/dep-parsers/maven.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,MAAM,SAAS,GAAG,OAAgB,CAAC;AACnC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAerF,MAAM,CAAC,MAAM,cAAc,GAAgB,KAAK,EAAE,KAAK,EAAE,EAAE;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,CACV,0BAA0B,KAAK,CAAC,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/F,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,KAAK,UAAU,QAAQ,CACrB,OAAe,EACf,OAAe,EACf,MAA2B;IAE3B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,sBAAsB,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,gBAAgB,EAAE,KAAK;QACvB,mBAAmB,EAAE,IAAI;QACzB,sBAAsB,EAAE,IAAI;QAC5B,aAAa,EAAE,IAAI;QACnB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IACH,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CACJ,UAAU,OAAO,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,GAAG,GAAuB,EAAE,CAAC;IAEnC,uBAAuB;IACvB,mBAAmB,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,kEAAkE;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,GAAuB,EAAE,cAAsB;IACxF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAc,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClF,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACxE,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,SAAS;QAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC;YACP,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE;YACxC,OAAO;YACP,cAAc;YACd,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACpC,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/pipeline/dep-parsers/npm.d.ts

@@ -0,0 +1,30 @@
+/**
+ * npm ecosystem manifest parser.
+ *
+ * Entry manifest path kinds we recognise:
+ *   - `package-lock.json` — npm lockfile (v1, v2, v3)
+ *   - `pnpm-lock.yaml` — pnpm lockfile (5.x, 6.x, 9.x)
+ *   - `package.json` — fallback when no lockfile sits beside it
+ *
+ * For lockfiles we lean on `snyk-nodejs-lockfile-parser` (Apache-2.0).
+ * The top-level `buildDepTree` shim only supports the legacy v1
+ * lockfile format; we therefore call the ecosystem-specific dep-graph
+ * builders (`parseNpmLockV2Project`, `parsePnpmProject`) which handle
+ * lockfileVersion 2/3 and modern pnpm layouts.
+ *
+ * For bare `package.json` (no lockfile), we parse top-level
+ * `dependencies` + `devDependencies` directly — the version is the raw
+ * semver specifier from the manifest (e.g. `^1.2.3`), which is the best
+ * signal available without a resolver.
+ *
+ * Errors (malformed JSON/YAML, snyk parser throws) are captured and
+ * reported via `onWarn`; the parser returns `[]` in that case.
+ */
+import type { ParseDepsFn } from "./types.js";
+/**
+ * Dispatcher keyed on the final path segment.
+ * `package.json` files are only parsed in "bare" mode when no lockfile
+ * sits beside them; the phase passes only manifests that earned this.
+ */
+export declare const parseNpmDeps: ParseDepsFn;
+//# sourceMappingURL=npm.d.ts.map

package/dist/pipeline/dep-parsers/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../../src/pipeline/dep-parsers/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAUH,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AAShE;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,WAmB1B,CAAC"}