@psnext/lscg 0.1.4 → 0.1.5

package/dist/src/graph/repositoryScanWorker.d.ts

@@ -0,0 +1,21 @@
+import { extractGraph } from './extract.js';
+export interface RepositoryScanTask {
+    repositoryId: string;
+    relativePath: string;
+    absolutePath: string;
+    source: string;
+    sourceHash: string;
+    mtimeMs: number;
+}
+export interface RepositoryScanResult {
+    relativePath: string;
+    sourceHash: string;
+    size: number;
+    mtimeMs: number;
+    language?: string;
+    parser?: string;
+    parserVersion?: string;
+    graph?: ReturnType<typeof extractGraph>;
+    error?: string;
+}
+//# sourceMappingURL=repositoryScanWorker.d.ts.map

package/dist/src/graph/repositoryScanWorker.js

@@ -0,0 +1,45 @@
+import { parentPort } from 'node:worker_threads';
+import { extractGraph, hashParts } from './extract.js';
+import { parseSource } from '../parser/treeSitter.js';
+if (!parentPort)
+    throw new Error('repository scan worker requires a parent port');
+parentPort.on('message', (tasks) => {
+    const results = tasks.map((task) => {
+        const parsed = parseSource(task.absolutePath, task.source);
+        if (!parsed) {
+            return { relativePath: task.relativePath, sourceHash: task.sourceHash, size: Buffer.byteLength(task.source, 'utf8'), mtimeMs: task.mtimeMs, error: 'unsupported or unparseable source' };
+        }
+        try {
+            return {
+                relativePath: task.relativePath,
+                sourceHash: task.sourceHash,
+                size: Buffer.byteLength(task.source, 'utf8'),
+                mtimeMs: task.mtimeMs,
+                language: parsed.language,
+                parser: parsed.parser,
+                parserVersion: parsed.parserVersion,
+                graph: parsed.language === 'python' || parsed.language === 'java'
+                    ? { nodes: [], edges: [] }
+                    : extractGraph({
+                        repositoryId: task.repositoryId,
+                        fileId: hashParts([task.repositoryId, task.relativePath]),
+                        relativePath: task.relativePath,
+                        source: task.source,
+                        sourceHash: task.sourceHash,
+                        parseResult: parsed
+                    })
+            };
+        }
+        catch (error) {
+            return {
+                relativePath: task.relativePath,
+                sourceHash: task.sourceHash,
+                size: Buffer.byteLength(task.source, 'utf8'),
+                mtimeMs: task.mtimeMs,
+                error: error instanceof Error ? error.message : String(error)
+            };
+        }
+    });
+    parentPort.postMessage(results);
+});
+//# sourceMappingURL=repositoryScanWorker.js.map

package/dist/src/index.d.ts

@@ -3,6 +3,11 @@ export { watchRepository } from './watch.js';
 export { SCANNER_PLUGIN_API_VERSION, DEFAULT_PLUGIN_RESOURCE_LIMITS, createRepositoryScanContext, runScannerPlugins, BUILTIN_GRAPH_PLUGIN } from './scanner/plugins.js';
 export type { ScannerPlugin, ScannerCapability, PluginConflictPolicy, PluginNodeFact, PluginEdgeFact, PluginScanResult, PluginRunResult, PluginResourceLimits, RepositoryScanContext, RepositoryScanFile } from './scanner/plugins.js';
 export { PackagePlugin } from './scanner/packagePlugin.js';
+export { PythonScannerPlugin, PYTHON_SCANNER_PLUGIN_NAME, scanPythonFiles } from './scanner/pythonPlugin.js';
+export { JavaScannerPlugin, JAVA_SCANNER_PLUGIN_NAME, scanJavaFiles } from './scanner/javaPlugin.js';
+export { JavaDependencyPlugin, JAVA_DEPENDENCY_PLUGIN_NAME, scanJavaDependencies } from './scanner/javaDependencyPlugin.js';
+export { inventoryRepositoryManifests, inspectRepositoryManifests, mergeManifestInventories } from './scanner/artifactInventory.js';
+export type { RepositoryManifest, ManifestKind, ManifestStatus } from './scanner/artifactInventory.js';
 export { viewGraph, loadViewSnapshot, buildViewModel, renderInteractiveHtml, renderSvgMarkup, openInDefaultBrowser, openHtmlArtifactInBrowser, writeTemporaryHtmlArtifact } from './view/index.js';
 export { repoDatabasePath, homeDatabasePath, resolveProjectRoot } from './config/paths.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.js

@@ -2,6 +2,10 @@ export { initGraph, listEdges, listNodes, graphStatus, callGraph, neighbors, con
 export { watchRepository } from './watch.js';
 export { SCANNER_PLUGIN_API_VERSION, DEFAULT_PLUGIN_RESOURCE_LIMITS, createRepositoryScanContext, runScannerPlugins, BUILTIN_GRAPH_PLUGIN } from './scanner/plugins.js';
 export { PackagePlugin } from './scanner/packagePlugin.js';
+export { PythonScannerPlugin, PYTHON_SCANNER_PLUGIN_NAME, scanPythonFiles } from './scanner/pythonPlugin.js';
+export { JavaScannerPlugin, JAVA_SCANNER_PLUGIN_NAME, scanJavaFiles } from './scanner/javaPlugin.js';
+export { JavaDependencyPlugin, JAVA_DEPENDENCY_PLUGIN_NAME, scanJavaDependencies } from './scanner/javaDependencyPlugin.js';
+export { inventoryRepositoryManifests, inspectRepositoryManifests, mergeManifestInventories } from './scanner/artifactInventory.js';
 export { viewGraph, loadViewSnapshot, buildViewModel, renderInteractiveHtml, renderSvgMarkup, openInDefaultBrowser, openHtmlArtifactInBrowser, writeTemporaryHtmlArtifact } from './view/index.js';
 export { repoDatabasePath, homeDatabasePath, resolveProjectRoot } from './config/paths.js';
 //# sourceMappingURL=index.js.map

package/dist/src/mcp/server.js

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
-import { graphStatus, listEdges, listNodes, neighbors, runReadOnlySql, scanRepository } from '../graph/repository.js';
+import { contextGraph, graphStatus, listEdges, listNodes, neighbors, runReadOnlySql, scanRepository } from '../graph/repository.js';
 const scopeSchema = z.enum(['repo', 'home', 'both']).default('repo');
 export async function startMcpServer({ root = process.cwd() } = {}) {
     const server = new McpServer({
@@ -13,6 +13,21 @@ export async function startMcpServer({ root = process.cwd() } = {}) {
         root: z.string().optional().describe('Repository root. Defaults to the MCP server cwd.'),
         scope: scopeSchema.describe('Graph storage scope to update.')
     }, async (input) => jsonResponse(await scanRepository({ root: input.root ?? root, scope: input.scope })));
+    tool('context_graph_context', 'Return stored, relationship-aware context and its persisted freshness report without scanning.', {
+        root: z.string().optional(),
+        scope: scopeSchema,
+        symbol: z.string().min(1),
+        kind: z.enum(['file', 'symbol', 'import', 'export', 'call', 'user', 'package']).optional(),
+        depth: z.number().int().min(0).max(5).optional(),
+        limit: z.number().int().positive().max(500).optional()
+    }, async (input) => jsonResponse(await contextGraph({
+        root: input.root ?? root,
+        scope: input.scope,
+        symbol: input.symbol,
+        kind: input.kind,
+        depth: input.depth,
+        limit: input.limit
+    })));
     tool('context_graph_status', 'Return repository graph counts and database paths.', {
         root: z.string().optional(),
         scope: scopeSchema

package/dist/src/parser/treeSitter.js

@@ -2,6 +2,8 @@ import path from 'node:path';
 import Parser from 'tree-sitter';
 import JavaScriptLanguage from 'tree-sitter-javascript';
 import TypeScriptLanguages from 'tree-sitter-typescript';
+import PythonLanguage from 'tree-sitter-python';
+import JavaLanguage from 'tree-sitter-java';
 const typeScriptModule = TypeScriptLanguages.default ?? TypeScriptLanguages;
 const LANGUAGE_CONFIGS = [
     {
@@ -21,6 +23,18 @@ const LANGUAGE_CONFIGS = [
         parserVersion: 'tree-sitter-typescript-tsx',
         extensions: ['.tsx'],
         language: typeScriptModule.tsx ?? typeScriptModule.typescript ?? typeScriptModule
+    },
+    {
+        name: 'python',
+        parserVersion: 'tree-sitter-python',
+        extensions: ['.py'],
+        language: PythonLanguage.default ?? PythonLanguage
+    },
+    {
+        name: 'java',
+        parserVersion: 'tree-sitter-java@0.21.0',
+        extensions: ['.java'],
+        language: JavaLanguage.default ?? JavaLanguage
     }
 ];
 const byExtension = new Map();
@@ -30,6 +44,7 @@ for (const config of LANGUAGE_CONFIGS) {
     }
 }
 const parserCache = new Map();
+const MIN_PARSE_BUFFER_SIZE = 32 * 1024;
 export function supportedExtensions() {
     return [...byExtension.keys()];
 }
@@ -51,7 +66,11 @@ export function parseSource(filePath, source) {
     }
     let tree;
     try {
-        tree = parser.parse(source);
+        // tree-sitter's native string input path rejects sources larger than its
+        // default 32 KiB input buffer. Give it enough room for this source while
+        // retaining the default-sized buffer for smaller files.
+        const bufferSize = Math.max(MIN_PARSE_BUFFER_SIZE, Buffer.byteLength(source, 'utf8') + 1);
+        tree = parser.parse(source, undefined, { bufferSize });
     }
     catch {
         return null;

package/dist/src/scanner/artifactInventory.d.ts

@@ -0,0 +1,35 @@
+export type ManifestKind = 'maven-pom' | 'gradle-groovy' | 'gradle-kotlin';
+export type ManifestStatus = 'observed' | 'read_failed' | 'traversal_incomplete' | 'confirmed_deleted';
+/** The in-memory representation passed to repository analyzers. */
+export interface RepositoryManifest {
+    path: string;
+    kind: ManifestKind;
+    moduleIdentity: string;
+    size: number;
+    mtimeMs: number;
+    sourceHash: string | null;
+    content: string | null;
+    status: ManifestStatus;
+    /** Set when this record came from the durable inventory. */
+    generation?: number;
+}
+export interface ManifestInventoryResult {
+    manifests: RepositoryManifest[];
+    /** False means the absence of a prior path must not be interpreted as deletion. */
+    complete: boolean;
+}
+export declare const MAX_MANIFEST_BYTES: number;
+export declare const MAX_MANIFESTS = 256;
+export declare const MAX_MANIFEST_CONTENT_BYTES: number;
+/**
+ * Return the bounded Maven/Gradle inventory used by repository analyzers.
+ * Only the repository root and its immediate child modules are considered;
+ * symlinks and deeper build trees are deliberately ignored.
+ */
+export declare function inventoryRepositoryManifests(root: string, previous?: readonly RepositoryManifest[]): RepositoryManifest[];
+/** Perform one bounded filesystem traversal, without interpreting missing paths as deletions. */
+export declare function inspectRepositoryManifests(root: string): ManifestInventoryResult;
+/** Merge a current traversal with durable records, retaining uncertain paths. */
+export declare function mergeManifestInventories(current: readonly RepositoryManifest[], previous: readonly RepositoryManifest[], complete: boolean): RepositoryManifest[];
+export declare function kindForPath(relativePath: string): ManifestKind | undefined;
+//# sourceMappingURL=artifactInventory.d.ts.map

package/dist/src/scanner/artifactInventory.js

@@ -0,0 +1,139 @@
+import { createHash } from 'node:crypto';
+import { lstatSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+export const MAX_MANIFEST_BYTES = 1 * 1024 * 1024;
+export const MAX_MANIFESTS = 256;
+export const MAX_MANIFEST_CONTENT_BYTES = 16 * 1024 * 1024;
+const IGNORED_MODULE_DIRECTORIES = new Set(['.git', '.sling', 'node_modules', 'dist', 'coverage', '.next', '.turbo', '.cache']);
+/**
+ * Return the bounded Maven/Gradle inventory used by repository analyzers.
+ * Only the repository root and its immediate child modules are considered;
+ * symlinks and deeper build trees are deliberately ignored.
+ */
+export function inventoryRepositoryManifests(root, previous = []) {
+    const result = inspectRepositoryManifests(root);
+    return mergeManifestInventories(result.manifests, previous, result.complete);
+}
+/** Perform one bounded filesystem traversal, without interpreting missing paths as deletions. */
+export function inspectRepositoryManifests(root) {
+    const candidates = new Set();
+    const addDirectory = (directory, relativeDirectory) => {
+        for (const name of ['pom.xml', 'build.gradle', 'build.gradle.kts']) {
+            const relative = relativeDirectory ? path.posix.join(relativeDirectory, name) : name;
+            candidates.add(relative);
+        }
+    };
+    addDirectory(root, '');
+    let children;
+    try {
+        children = readdirSync(root, { withFileTypes: true });
+    }
+    catch {
+        return { manifests: [], complete: false };
+    }
+    for (const entry of children) {
+        if (!entry.isDirectory() || entry.isSymbolicLink() || IGNORED_MODULE_DIRECTORIES.has(entry.name))
+            continue;
+        addDirectory(path.join(root, entry.name), entry.name);
+    }
+    const sortedCandidates = [...candidates].sort();
+    let complete = true;
+    const manifests = [];
+    const existingCandidates = [];
+    for (const relativePath of sortedCandidates) {
+        const absolute = path.join(root, relativePath);
+        const kind = kindForPath(relativePath);
+        if (!kind)
+            continue;
+        try {
+            // lstat is intentional: a symlink is never a supported artifact, even if
+            // its target happens to be a regular manifest.
+            const stat = lstatSync(absolute);
+            if (!stat.isSymbolicLink() && stat.isFile())
+                existingCandidates.push({ relativePath, kind, stat });
+        }
+        catch (error) {
+            // A path that is simply absent is not an artifact candidate. Other
+            // failures (permissions/races) are retained as uncertain reads.
+            if (error.code === 'ENOENT')
+                continue;
+            complete = false;
+            manifests.push(unavailableManifest(relativePath, kind, 'read_failed'));
+        }
+    }
+    if (existingCandidates.length > MAX_MANIFESTS)
+        complete = false;
+    let aggregate = 0;
+    for (const { relativePath, kind, stat } of existingCandidates.slice(0, MAX_MANIFESTS)) {
+        const absolute = path.join(root, relativePath);
+        const size = stat.size;
+        const mtimeMs = Math.round(stat.mtimeMs);
+        if (size > MAX_MANIFEST_BYTES || aggregate + size > MAX_MANIFEST_CONTENT_BYTES) {
+            manifests.push({ path: relativePath, kind, moduleIdentity: moduleIdentityFor(relativePath), size, mtimeMs, sourceHash: null, content: null, status: 'traversal_incomplete' });
+            continue;
+        }
+        try {
+            const content = readFileSync(absolute, 'utf8');
+            const bytes = Buffer.byteLength(content, 'utf8');
+            let afterRead;
+            try {
+                afterRead = statSync(absolute);
+            }
+            catch {
+                manifests.push(unavailableManifest(relativePath, kind, 'read_failed', size, mtimeMs));
+                continue;
+            }
+            if (bytes > MAX_MANIFEST_BYTES || aggregate + bytes > MAX_MANIFEST_CONTENT_BYTES || afterRead.size !== size || Math.round(afterRead.mtimeMs) !== mtimeMs) {
+                manifests.push({ path: relativePath, kind, moduleIdentity: moduleIdentityFor(relativePath), size: afterRead.size, mtimeMs: Math.round(afterRead.mtimeMs), sourceHash: null, content: null, status: 'traversal_incomplete' });
+                continue;
+            }
+            aggregate += bytes;
+            manifests.push({ path: relativePath, kind, moduleIdentity: moduleIdentityFor(relativePath), size, mtimeMs, sourceHash: sha256(content), content, status: 'observed' });
+        }
+        catch {
+            manifests.push(unavailableManifest(relativePath, kind, 'read_failed', size, mtimeMs));
+        }
+    }
+    return { manifests: manifests.sort((a, b) => a.path.localeCompare(b.path)), complete: complete && !manifests.some((manifest) => manifest.status === 'traversal_incomplete' || manifest.status === 'read_failed') };
+}
+/** Merge a current traversal with durable records, retaining uncertain paths. */
+export function mergeManifestInventories(current, previous, complete) {
+    const merged = new Map(previous.map((manifest) => [manifest.path, { ...manifest, content: null }]));
+    for (const manifest of current)
+        merged.set(manifest.path, manifest);
+    if (complete) {
+        for (const [manifestPath, previousManifest] of merged) {
+            if (current.some((manifest) => manifest.path === manifestPath))
+                continue;
+            merged.set(manifestPath, { ...previousManifest, content: null, status: 'confirmed_deleted' });
+        }
+    }
+    else {
+        for (const [manifestPath, previousManifest] of merged) {
+            if (current.some((manifest) => manifest.path === manifestPath))
+                continue;
+            merged.set(manifestPath, { ...previousManifest, content: null, status: 'traversal_incomplete' });
+        }
+    }
+    return [...merged.values()].sort((a, b) => a.path.localeCompare(b.path));
+}
+export function kindForPath(relativePath) {
+    if (relativePath === 'pom.xml' || relativePath.endsWith('/pom.xml'))
+        return 'maven-pom';
+    if (relativePath.endsWith('/build.gradle') || relativePath === 'build.gradle')
+        return 'gradle-groovy';
+    if (relativePath.endsWith('/build.gradle.kts') || relativePath === 'build.gradle.kts')
+        return 'gradle-kotlin';
+    return undefined;
+}
+function moduleIdentityFor(relativePath) {
+    const directory = path.posix.dirname(relativePath);
+    return directory === '.' ? 'root' : directory;
+}
+function unavailableManifest(pathValue, kind, status, size = 0, mtimeMs = 0) {
+    return { path: pathValue, kind, moduleIdentity: moduleIdentityFor(pathValue), size, mtimeMs, sourceHash: null, content: null, status };
+}
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+//# sourceMappingURL=artifactInventory.js.map

package/dist/src/scanner/fingerprint.js

@@ -2,9 +2,11 @@ import { createHash } from 'node:crypto';
 import { statSync } from 'node:fs';
 import path from 'node:path';
 import { discoverSourceFiles } from './discover.js';
+import { inventoryRepositoryManifests } from './artifactInventory.js';
 /** Fast metadata fingerprint shared by watch and context freshness checks. */
 export function collectRepositoryFingerprint(root) {
     const files = discoverSourceFiles(root);
+    const manifests = inventoryRepositoryManifests(root);
     const hash = createHash('sha256');
     for (const relativePath of files) {
         const absolutePath = path.join(root, relativePath);
@@ -22,6 +24,9 @@ export function collectRepositoryFingerprint(root) {
             hash.update('\0missing\0');
         }
     }
+    for (const manifest of manifests) {
+        hash.update(`manifest:${manifest.path}\0${manifest.size}\0${manifest.mtimeMs}\0${manifest.sourceHash ?? manifest.status}\0`);
+    }
     return hash.digest('hex');
 }
 //# sourceMappingURL=fingerprint.js.map

package/dist/src/scanner/javaDependencyPlugin.d.ts

@@ -0,0 +1,5 @@
+import type { PluginScanResult, ScannerPlugin, RepositoryScanContext } from './plugins.js';
+export declare const JAVA_DEPENDENCY_PLUGIN_NAME = "java-dependency-plugin";
+export declare const JavaDependencyPlugin: ScannerPlugin;
+export declare function scanJavaDependencies(context: RepositoryScanContext): PluginScanResult;
+//# sourceMappingURL=javaDependencyPlugin.d.ts.map

package/dist/src/scanner/javaDependencyPlugin.js

@@ -0,0 +1,107 @@
+export const JAVA_DEPENDENCY_PLUGIN_NAME = 'java-dependency-plugin';
+const MAX_DECLARATIONS = 10_000;
+export const JavaDependencyPlugin = {
+    name: JAVA_DEPENDENCY_PLUGIN_NAME,
+    apiVersion: 1,
+    capabilities: ['repository-analyzer'],
+    scan: (context) => scanJavaDependencies(context),
+    scanIncremental: (context, _delta, previous) => scanJavaDependenciesIncremental(context, previous)
+};
+export function scanJavaDependencies(context) {
+    const nodes = [];
+    const diagnostics = [];
+    for (const manifest of context.manifests) {
+        if (manifest.status !== 'observed' || manifest.content === null) {
+            if (manifest.status !== 'confirmed_deleted')
+                diagnostics.push(`${manifest.path}: manifest read unavailable (${manifest.status})`);
+            continue;
+        }
+        const parsed = manifest.kind === 'maven-pom' ? parseMaven(manifest) : parseGradle(manifest);
+        nodes.push(...parsed.nodes);
+        diagnostics.push(...parsed.diagnostics);
+    }
+    return { nodes, edges: [], diagnostics };
+}
+function scanJavaDependenciesIncremental(context, previous) {
+    const result = scanJavaDependencies(context);
+    // Repository facts are cheap and bounded, so each incremental run replaces
+    // the complete analyzer contribution. This also handles manifest-only edits
+    // and the final manifest deletion after reopening the database.
+    if (!previous || result.diagnostics?.length) {
+        // A bounded/read/parse failure is not a confirmed deletion. Keep the
+        // previous repository contribution while exposing diagnostics.
+        return { ...result, retractions: { nodes: [], edges: [] } };
+    }
+    return { ...result, retractions: { nodes: previous.nodes.map((node) => String(node.metadata.factKey ?? '')).filter(Boolean), edges: previous.edges.map((edge) => String(edge.metadata.factKey ?? '')).filter(Boolean) } };
+}
+function parseMaven(manifest) {
+    const source = manifest.content ?? '';
+    const diagnostics = [];
+    if (/<!DOCTYPE|<!ENTITY/iu.test(source))
+        return { nodes: [], diagnostics: ['pom.xml rejected DTD/entity expansion'] };
+    if (!/<project\b/iu.test(source) || !/<\/project\s*>/iu.test(source))
+        return { nodes: [], diagnostics: [`${manifest.path}: malformed or unsupported Maven XML`] };
+    const properties = new Map();
+    const propertyBlock = /<properties\b[^>]*>([\s\S]*?)<\/properties>/iu.exec(source)?.[1] ?? '';
+    for (const match of propertyBlock.matchAll(/<([\w.-]+)\s*>([^<]{0,1000})<\/\1\s*>/gu))
+        properties.set(match[1], match[2].trim());
+    const nodes = [];
+    let occurrence = 0;
+    for (const match of source.matchAll(/<dependency\b[^>]*>([\s\S]*?)<\/dependency\s*>/giu)) {
+        if (occurrence >= MAX_DECLARATIONS) {
+            diagnostics.push(`${manifest.path}: dependency declaration limit exceeded`);
+            break;
+        }
+        const block = match[1];
+        const group = xmlTag(block, 'groupId');
+        const artifact = xmlTag(block, 'artifactId');
+        const version = resolveProperty(xmlTag(block, 'version'), properties);
+        const scope = xmlTag(block, 'scope') || 'compile';
+        if (!group || !artifact || !version) {
+            diagnostics.push(`${manifest.path}: unsupported or unresolved Maven dependency at declaration ${occurrence}`);
+            occurrence += 1;
+            continue;
+        }
+        const coordinate = `${group}:${artifact}:${version}`;
+        nodes.push(dependencyNode(manifest, `${manifest.path}\u0000${manifest.moduleIdentity}\u0000${coordinate}\u0000${scope}\u0000${occurrence}`, coordinate, group, artifact, version, scope, occurrence));
+        occurrence += 1;
+    }
+    return { nodes, diagnostics };
+}
+function parseGradle(manifest) {
+    const source = manifest.content ?? '';
+    const diagnostics = [];
+    const nodes = [];
+    let occurrence = 0;
+    // Literal Groovy/Kotlin dependency calls only. No Gradle expressions are evaluated.
+    const pattern = /\b(api|implementation|compileOnly|runtimeOnly|testImplementation|testRuntimeOnly|annotationProcessor|kapt|classpath)\b\s*(?:\(\s*)?['"]([^'"\n]+)['"]\s*\)?/gu;
+    for (const match of source.matchAll(pattern)) {
+        if (occurrence >= MAX_DECLARATIONS) {
+            diagnostics.push(`${manifest.path}: dependency declaration limit exceeded`);
+            break;
+        }
+        const raw = match[2].trim();
+        const parts = raw.split(':');
+        const configuration = match[1].trim();
+        if (parts.length < 3 || parts.slice(0, 3).some((part) => !/^[\w.${}-]+$/u.test(part))) {
+            diagnostics.push(`${manifest.path}: unsupported Gradle dependency declaration ${raw.slice(0, 120)}`);
+            occurrence += 1;
+            continue;
+        }
+        const [group, artifact, version] = parts;
+        const coordinate = `${group}:${artifact}:${version}`;
+        nodes.push(dependencyNode(manifest, `${manifest.path}\u0000${manifest.moduleIdentity}\u0000${coordinate}\u0000${configuration}\u0000${occurrence}`, coordinate, group, artifact, version, configuration, occurrence));
+        occurrence += 1;
+    }
+    if (/\b(?:project|platform|enforcedPlatform|libs\.|version\.catalog|\$\{)/u.test(source))
+        diagnostics.push(`${manifest.path}: dynamic or unsupported Gradle dependency expressions were ignored`);
+    return { nodes, diagnostics };
+}
+function dependencyNode(manifest, factKey, coordinate, group, artifact, version, scope, occurrence) {
+    return { factKey: `java-dependency:${factKey}`, kind: 'package', type: 'java-dependency', name: coordinate, metadata: { dependencyType: 'java-dependency', coordinate, group, artifact, version, scope, configuration: scope, declarationOccurrence: occurrence, manifestPath: manifest.path, manifestKind: manifest.kind, moduleIdentity: manifest.moduleIdentity, sourceHash: manifest.sourceHash } };
+}
+function xmlTag(source, tag) { return new RegExp(`<${tag}\\s*>([^<]{0,1000})<\\/${tag}\\s*>`, 'iu').exec(source)?.[1]?.trim(); }
+function resolveProperty(value, properties) { if (!value)
+    return undefined; const match = /^\$\{([^}]+)\}$/u.exec(value); return match ? properties.get(match[1]) : value; }
+function configurationAt(source, offset) { const line = source.slice(Math.max(0, source.lastIndexOf('\n', offset - 1) + 1), offset); return /\b(\w+)\s*$/u.exec(line)?.[1] ?? 'implementation'; }
+//# sourceMappingURL=javaDependencyPlugin.js.map

package/dist/src/scanner/javaPlugin.d.ts

@@ -0,0 +1,5 @@
+import type { PluginScanResult, RepositoryScanFile, ScannerPlugin } from './plugins.js';
+export declare const JAVA_SCANNER_PLUGIN_NAME = "java-scanner-plugin";
+export declare function scanJavaFiles(files: readonly RepositoryScanFile[]): PluginScanResult;
+export declare const JavaScannerPlugin: ScannerPlugin;
+//# sourceMappingURL=javaPlugin.d.ts.map