audit-tools 0.28.0

package/dist/audit/extractors/graphManifestEdges/go.js

@@ -0,0 +1,152 @@
+import { posix } from "node:path";
+import { scanStringAware } from "audit-tools/shared";
+import { graphEdge, normalizeGraphPath, isGoModuleManifestPath, isGoWorkspaceManifestPath } from "../graphPathUtils.js";
+export const GO_WORKSPACE_MODULE_EDGE_CONFIDENCE = 0.87;
+const GO_SCAN_OPTIONS = {
+    quoteChars: ['"', "`"],
+    // Backtick raw strings do not honour backslash escapes.
+    escapedQuotes: ['"'],
+};
+export function stripGoLineComment(line) {
+    let commentIndex;
+    scanStringAware(line, GO_SCAN_OPTIONS, {
+        onUnquoted(char, i) {
+            if (char === "/" && line[i + 1] === "/") {
+                commentIndex = i;
+                return false;
+            }
+        },
+    });
+    return commentIndex !== undefined ? line.slice(0, commentIndex) : line;
+}
+function unquoteGoWorkspaceSpecifier(value) {
+    const trimmed = value.trim();
+    if (trimmed.length < 2) {
+        return trimmed;
+    }
+    if (trimmed[0] === '"' && trimmed.at(-1) === '"') {
+        try {
+            const parsed = JSON.parse(trimmed);
+            return typeof parsed === "string" ? parsed.trim() : trimmed;
+        }
+        catch {
+            return trimmed.slice(1, -1).trim();
+        }
+    }
+    if (trimmed[0] === "`" && trimmed.at(-1) === "`") {
+        return trimmed.slice(1, -1).trim();
+    }
+    return trimmed;
+}
+export function splitGoWorkspaceSpecifiers(value) {
+    const specifiers = [];
+    let tokenStart;
+    // Use scanStringAware to correctly skip over quoted string content, and
+    // detect whitespace-delimited token boundaries in unquoted regions.
+    // Quoted tokens are captured from the opening quote (tokenStart) through
+    // the closing quote (flushed on the next whitespace event), so that
+    // unquoteGoWorkspaceSpecifier sees the delimiters and can strip them.
+    scanStringAware(value, GO_SCAN_OPTIONS, {
+        onQuoteOpen(_q, i) {
+            tokenStart ??= i; // quoted token begins at the opening quote
+        },
+        onUnquoted(char, i) {
+            if (/\s/.test(char)) {
+                if (tokenStart !== undefined) {
+                    const specifier = unquoteGoWorkspaceSpecifier(value.slice(tokenStart, i));
+                    if (specifier.length > 0) {
+                        specifiers.push(specifier);
+                    }
+                    tokenStart = undefined;
+                }
+            }
+            else {
+                tokenStart ??= i;
+            }
+        },
+    });
+    // Flush final token (no trailing whitespace).
+    if (tokenStart !== undefined) {
+        const specifier = unquoteGoWorkspaceSpecifier(value.slice(tokenStart));
+        if (specifier.length > 0) {
+            specifiers.push(specifier);
+        }
+    }
+    return specifiers;
+}
+function goWorkspaceUseSpecifiers(content) {
+    const specifiers = [];
+    let inUseBlock = false;
+    for (const rawLine of content.split(/\r?\n/)) {
+        const trimmed = stripGoLineComment(rawLine).trim();
+        if (trimmed.length === 0) {
+            continue;
+        }
+        if (inUseBlock) {
+            const closeIndex = trimmed.indexOf(")");
+            const body = closeIndex >= 0 ? trimmed.slice(0, closeIndex).trim() : trimmed;
+            specifiers.push(...splitGoWorkspaceSpecifiers(body));
+            if (closeIndex >= 0) {
+                inUseBlock = false;
+            }
+            continue;
+        }
+        const useMatch = /^use(?:\s+(.+)|\s*)$/.exec(trimmed);
+        if (!useMatch) {
+            continue;
+        }
+        let body = useMatch[1]?.trim() ?? "";
+        if (!body.startsWith("(")) {
+            specifiers.push(...splitGoWorkspaceSpecifiers(body));
+            continue;
+        }
+        body = body.slice(1).trim();
+        const closeIndex = body.indexOf(")");
+        if (closeIndex >= 0) {
+            specifiers.push(...splitGoWorkspaceSpecifiers(body.slice(0, closeIndex).trim()));
+        }
+        else {
+            specifiers.push(...splitGoWorkspaceSpecifiers(body));
+            inUseBlock = true;
+        }
+    }
+    return specifiers;
+}
+function resolveGoWorkspaceModuleReference(fromPath, specifier, pathLookup) {
+    const normalizedSpecifier = normalizeGraphPath(specifier);
+    if (normalizedSpecifier.length === 0 ||
+        normalizedSpecifier.startsWith("/") ||
+        /^[a-z][a-z0-9+.-]*:/i.test(normalizedSpecifier)) {
+        return undefined;
+    }
+    const workspaceDir = posix.dirname(normalizeGraphPath(fromPath));
+    const target = workspaceDir === "."
+        ? normalizedSpecifier
+        : posix.join(workspaceDir, normalizedSpecifier);
+    const direct = pathLookup.get(target.toLowerCase());
+    if (direct && isGoModuleManifestPath(direct)) {
+        return direct;
+    }
+    return pathLookup.get(posix.join(target, "go.mod").toLowerCase());
+}
+export function extractGoWorkspaceModuleEdges(fromPath, content, pathLookup) {
+    if (!isGoWorkspaceManifestPath(fromPath)) {
+        return [];
+    }
+    const edges = [];
+    for (const specifier of goWorkspaceUseSpecifiers(content)) {
+        const target = resolveGoWorkspaceModuleReference(fromPath, specifier, pathLookup);
+        if (!target) {
+            continue;
+        }
+        edges.push(graphEdge({
+            from: fromPath,
+            to: target,
+            kind: "go-workspace-module-link",
+            confidence: GO_WORKSPACE_MODULE_EDGE_CONFIDENCE,
+            reason: `Go workspace use directive '${specifier}' resolves to module '${target}'.`,
+        }));
+    }
+    return edges;
+}
+//# sourceMappingURL=go.js.map

package/dist/audit/extractors/graphManifestEdges/go.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/go.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAExH,MAAM,CAAC,MAAM,mCAAmC,GAAG,IAAI,CAAC;AAExD,MAAM,eAAe,GAAG;IACtB,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,CAAU;IAC/B,wDAAwD;IACxD,aAAa,EAAE,CAAC,GAAG,CAAU;CAC9B,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,YAAgC,CAAC;IAErC,eAAe,CACb,IAAI,EACJ,eAAe,EACf;QACE,UAAU,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxC,YAAY,GAAG,CAAC,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CACF,CAAC;IAEF,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,UAA8B,CAAC;IAEnC,wEAAwE;IACxE,oEAAoE;IACpE,yEAAyE;IACzE,oEAAoE;IACpE,sEAAsE;IACtE,eAAe,CACb,KAAK,EACL,eAAe,EACf;QACE,WAAW,CAAC,EAAE,EAAE,CAAC;YACf,UAAU,KAAK,CAAC,CAAC,CAAC,2CAA2C;QAC/D,CAAC;QACD,UAAU,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC1E,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAC7B,CAAC;oBACD,UAAU,GAAG,SAAS,CAAC;gBACzB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,UAAU,KAAK,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CACF,CAAC;IAEF,8CAA8C;IAC9C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACvE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,IAAI,GACR,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAClE,UAAU,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;gBACpB,UAAU,GAAG,KAAK,CAAC;YACrB,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QAED,IAAI,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QAED,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACpB,UAAU,CAAC,IAAI,CACb,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAChE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iCAAiC,CACxC,QAAgB,EAChB,SAAiB,EACjB,UAA+B;IAE/B,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1D,IACE,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAChC,mBAAmB,CAAC,UAAU,CAAC,GAAG,CAAC;QACnC,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAChD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GACV,YAAY,KAAK,GAAG;QAClB,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAgB,EAChB,OAAe,EACf,UAA+B;IAE/B,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,SAAS,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,iCAAiC,CAC9C,QAAQ,EACR,SAAS,EACT,UAAU,CACX,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,0BAA0B;YAChC,UAAU,EAAE,mCAAmC;YAC/C,MAAM,EAAE,+BAA+B,SAAS,yBAAyB,MAAM,IAAI;SACpF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/audit/extractors/graphManifestEdges/index.d.ts

@@ -0,0 +1,9 @@
+export { isCargoManifestPath, isGoWorkspaceManifestPath, isMavenPomPath, isPyprojectPath, } from "../graphPathUtils.js";
+export { extractPackageEntrypointEdges, extractPackageScriptEdges, extractWorkspacePackageEdges } from "./packageJson.js";
+export { extractCargoWorkspaceMemberEdges } from "./cargo.js";
+export { extractTypescriptProjectReferenceEdges } from "./typescript.js";
+export { extractGoWorkspaceModuleEdges } from "./go.js";
+export { extractMavenModuleEdges } from "./maven.js";
+export { extractPyprojectTestpathLinks } from "./pyproject.js";
+export { extractYamlPathReferenceEdges } from "./yamlPaths.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/extractors/graphManifestEdges/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,cAAc,EACd,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAC1H,OAAO,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,sCAAsC,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/audit/extractors/graphManifestEdges/index.js

@@ -0,0 +1,12 @@
+// Re-exported for the graph builder, which imports these manifest predicates
+// from here for historical reasons; the canonical definitions live in
+// graphPathUtils.
+export { isCargoManifestPath, isGoWorkspaceManifestPath, isMavenPomPath, isPyprojectPath, } from "../graphPathUtils.js";
+export { extractPackageEntrypointEdges, extractPackageScriptEdges, extractWorkspacePackageEdges } from "./packageJson.js";
+export { extractCargoWorkspaceMemberEdges } from "./cargo.js";
+export { extractTypescriptProjectReferenceEdges } from "./typescript.js";
+export { extractGoWorkspaceModuleEdges } from "./go.js";
+export { extractMavenModuleEdges } from "./maven.js";
+export { extractPyprojectTestpathLinks } from "./pyproject.js";
+export { extractYamlPathReferenceEdges } from "./yamlPaths.js";
+//# sourceMappingURL=index.js.map

package/dist/audit/extractors/graphManifestEdges/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,sEAAsE;AACtE,kBAAkB;AAClB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,cAAc,EACd,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAC1H,OAAO,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,sCAAsC,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/audit/extractors/graphManifestEdges/jsonc.d.ts

@@ -0,0 +1,4 @@
+export declare function stripJsonComments(content: string): string;
+export declare function removeTrailingJsonCommas(content: string): string;
+export declare function parseJsoncObject(content: string): Record<string, unknown> | undefined;
+//# sourceMappingURL=jsonc.d.ts.map

package/dist/audit/extractors/graphManifestEdges/jsonc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonc.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/jsonc.ts"],"names":[],"mappings":"AAIA,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA0DzD;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmChE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAWrF"}

package/dist/audit/extractors/graphManifestEdges/jsonc.js

@@ -0,0 +1,98 @@
+import { scanStringAware } from "audit-tools/shared";
+const JSON_SCAN_OPTIONS = { quoteChars: ['"'], escapedQuotes: ['"'] };
+export function stripJsonComments(content) {
+    let result = "";
+    let inString = false;
+    let escaped = false;
+    for (let index = 0; index < content.length; index++) {
+        const char = content[index];
+        const next = content[index + 1];
+        if (inString) {
+            result += char;
+            if (escaped) {
+                escaped = false;
+            }
+            else if (char === "\\") {
+                escaped = true;
+            }
+            else if (char === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+            result += char;
+            continue;
+        }
+        if (char === "/" && next === "/") {
+            while (index < content.length && content[index] !== "\n") {
+                index++;
+            }
+            if (index < content.length) {
+                result += content[index];
+            }
+            continue;
+        }
+        if (char === "/" && next === "*") {
+            index += 2;
+            while (index < content.length &&
+                !(content[index] === "*" && content[index + 1] === "/")) {
+                if (content[index] === "\n") {
+                    result += "\n";
+                }
+                index++;
+            }
+            if (index < content.length) {
+                index++;
+            }
+            continue;
+        }
+        result += char;
+    }
+    return result;
+}
+export function removeTrailingJsonCommas(content) {
+    let result = "";
+    let pos = 0;
+    scanStringAware(content, JSON_SCAN_OPTIONS, {
+        onQuoteOpen(_q, i) {
+            result += content.slice(pos, i + 1);
+            pos = i + 1;
+        },
+        onQuoteClose(_q, i) {
+            result += content.slice(pos, i + 1);
+            pos = i + 1;
+        },
+        onUnquoted(char, i) {
+            if (char === ",") {
+                let lookahead = i + 1;
+                while (/\s/.test(content[lookahead] ?? "")) {
+                    lookahead++;
+                }
+                if (content[lookahead] === "}" || content[lookahead] === "]") {
+                    // Flush up to (not including) the comma; skip it.
+                    result += content.slice(pos, i);
+                    pos = i + 1;
+                }
+            }
+        },
+    });
+    // Flush anything after the last event.
+    result += content.slice(pos);
+    return result;
+}
+export function parseJsoncObject(content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(removeTrailingJsonCommas(stripJsonComments(content)));
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return undefined;
+    }
+    return parsed;
+}
+//# sourceMappingURL=jsonc.js.map

package/dist/audit/extractors/graphManifestEdges/jsonc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonc.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/jsonc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,iBAAiB,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAU,EAAE,aAAa,EAAE,CAAC,GAAG,CAAU,EAAE,CAAC;AAExF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAEhC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,IAAI,CAAC;YACf,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACxB,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,IAAI,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzD,KAAK,EAAE,CAAC;YACV,CAAC;YACD,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,KAAK,IAAI,CAAC,CAAC;YACX,OACE,KAAK,GAAG,OAAO,CAAC,MAAM;gBACtB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EACvD,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC5B,MAAM,IAAI,IAAI,CAAC;gBACjB,CAAC;gBACD,KAAK,EAAE,CAAC;YACV,CAAC;YACD,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC3B,KAAK,EAAE,CAAC;YACV,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,IAAI,IAAI,CAAC;IACjB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,eAAe,CACb,OAAO,EACP,iBAAiB,EACjB;QACE,WAAW,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACpC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;QACD,YAAY,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACpC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;QACD,UAAU,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,IAAI,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC3C,SAAS,EAAE,CAAC;gBACd,CAAC;gBACD,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC7D,kDAAkD;oBAClD,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBAChC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;KACF,CACF,CAAC;IAEF,uCAAuC;IACvC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC"}

package/dist/audit/extractors/graphManifestEdges/maven.d.ts

@@ -0,0 +1,4 @@
+import type { GraphEdge } from "audit-tools/shared";
+export declare const MAVEN_MODULE_EDGE_CONFIDENCE = 0.87;
+export declare function extractMavenModuleEdges(fromPath: string, content: string, pathLookup: Map<string, string>): GraphEdge[];
+//# sourceMappingURL=maven.d.ts.map

package/dist/audit/extractors/graphManifestEdges/maven.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maven.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/maven.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGpD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAoEjD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,SAAS,EAAE,CAsBb"}

package/dist/audit/extractors/graphManifestEdges/maven.js

@@ -0,0 +1,74 @@
+import { posix } from "node:path";
+import { graphEdge, normalizeGraphPath, isMavenPomPath } from "../graphPathUtils.js";
+export const MAVEN_MODULE_EDGE_CONFIDENCE = 0.87;
+function stripXmlComments(content) {
+    return content.replace(/<!--[\s\S]*?-->/g, "");
+}
+function decodeXmlText(value) {
+    return value
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&quot;/g, "\"")
+        .replace(/&apos;/g, "'")
+        .replace(/&amp;/g, "&");
+}
+function mavenModuleSpecifiers(content) {
+    const specifiers = [];
+    const withoutComments = stripXmlComments(content);
+    const modulesPattern = /<modules(?:\s[^>]*)?>([\s\S]*?)<\/modules>/gi;
+    let modulesMatch;
+    while ((modulesMatch = modulesPattern.exec(withoutComments))) {
+        const body = modulesMatch[1] ?? "";
+        const modulePattern = /<module(?:\s[^>]*)?>([\s\S]*?)<\/module>/gi;
+        let moduleMatch;
+        while ((moduleMatch = modulePattern.exec(body))) {
+            const specifier = decodeXmlText(moduleMatch[1] ?? "").trim();
+            if (specifier.length > 0) {
+                specifiers.push(specifier);
+            }
+        }
+    }
+    return specifiers;
+}
+function resolveMavenModuleReference(fromPath, specifier, pathLookup) {
+    const normalizedSpecifier = normalizeGraphPath(specifier);
+    if (normalizedSpecifier.length === 0 ||
+        normalizedSpecifier.startsWith("/") ||
+        /^[a-z][a-z0-9+.-]*:/i.test(normalizedSpecifier)) {
+        return undefined;
+    }
+    const manifestDir = posix.dirname(normalizeGraphPath(fromPath));
+    const target = manifestDir === "."
+        ? normalizedSpecifier
+        : posix.join(manifestDir, normalizedSpecifier);
+    const normalizedTarget = normalizeGraphPath(target);
+    if (normalizedTarget === ".." || normalizedTarget.startsWith("../")) {
+        return undefined;
+    }
+    const direct = pathLookup.get(normalizedTarget.toLowerCase());
+    if (direct && isMavenPomPath(direct)) {
+        return direct;
+    }
+    return pathLookup.get(posix.join(normalizedTarget, "pom.xml").toLowerCase());
+}
+export function extractMavenModuleEdges(fromPath, content, pathLookup) {
+    if (!isMavenPomPath(fromPath)) {
+        return [];
+    }
+    const edges = [];
+    for (const specifier of mavenModuleSpecifiers(content)) {
+        const target = resolveMavenModuleReference(fromPath, specifier, pathLookup);
+        if (!target || target === fromPath) {
+            continue;
+        }
+        edges.push(graphEdge({
+            from: fromPath,
+            to: target,
+            kind: "maven-module-link",
+            confidence: MAVEN_MODULE_EDGE_CONFIDENCE,
+            reason: `Maven module '${specifier}' resolves to module manifest '${target}'.`,
+        }));
+    }
+    return edges;
+}
+//# sourceMappingURL=maven.js.map

package/dist/audit/extractors/graphManifestEdges/maven.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maven.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/maven.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAErF,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAEjD,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK;SACT,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,eAAe,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,8CAA8C,CAAC;IACtE,IAAI,YAAoC,CAAC;IAEzC,OAAO,CAAC,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,4CAA4C,CAAC;QACnE,IAAI,WAAmC,CAAC;QACxC,OAAO,CAAC,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAgB,EAChB,SAAiB,EACjB,UAA+B;IAE/B,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1D,IACE,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAChC,mBAAmB,CAAC,UAAU,CAAC,GAAG,CAAC;QACnC,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAChD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GACV,WAAW,KAAK,GAAG;QACjB,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9D,IAAI,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,OAAe,EACf,UAA+B;IAE/B,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,SAAS,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,2BAA2B,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnC,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,mBAAmB;YACzB,UAAU,EAAE,4BAA4B;YACxC,MAAM,EAAE,iBAAiB,SAAS,kCAAkC,MAAM,IAAI;SAC/E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/audit/extractors/graphManifestEdges/packageJson.d.ts

@@ -0,0 +1,20 @@
+import type { GraphEdge } from "audit-tools/shared";
+import { WorkspacePattern } from "./workspace.js";
+export declare const PACKAGE_ENTRYPOINT_EDGE_CONFIDENCE = 0.9;
+export declare const PACKAGE_SCRIPT_EDGE_CONFIDENCE = 0.88;
+export declare const WORKSPACE_PACKAGE_EDGE_CONFIDENCE = 0.86;
+export declare const PACKAGE_SCRIPT_REFERENCE_PATTERN: RegExp;
+export declare function packageEntrypointCandidates(content: string): Array<{
+    field: string;
+    specifier: string;
+}>;
+export declare function resolvePackageEntrypoint(packagePath: string, specifier: string, pathLookup: Map<string, string>): string | undefined;
+export declare function extractPackageEntrypointEdges(fromPath: string, content: string, pathLookup: Map<string, string>): GraphEdge[];
+export declare function packageScriptCandidates(content: string): Array<{
+    script: string;
+    specifier: string;
+}>;
+export declare function extractPackageScriptEdges(fromPath: string, content: string, pathLookup: Map<string, string>): GraphEdge[];
+export declare function packageWorkspacePatterns(content: string): WorkspacePattern[];
+export declare function extractWorkspacePackageEdges(fromPath: string, content: string, pathLookup: Map<string, string>): GraphEdge[];
+//# sourceMappingURL=packageJson.d.ts.map

package/dist/audit/extractors/graphManifestEdges/packageJson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageJson.d.ts","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/packageJson.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EACL,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAIxB,eAAO,MAAM,kCAAkC,MAAM,CAAC;AACtD,eAAO,MAAM,8BAA8B,OAAO,CAAC;AACnD,eAAO,MAAM,iCAAiC,OAAO,CAAC;AACtD,eAAO,MAAM,gCAAgC,QAC2D,CAAC;AA8BzG,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,GACd,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB7C;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,GAAG,SAAS,CAgBpB;AAED,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,SAAS,EAAE,CAsBb;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,GACd,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAkC9C;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,SAAS,EAAE,CAsBb;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAyB5E;AAeD,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,SAAS,EAAE,CAgDb"}

package/dist/audit/extractors/graphManifestEdges/packageJson.js

@@ -0,0 +1,205 @@
+import { posix } from "node:path";
+import { graphEdge, normalizeGraphPath, resolveCandidate, isPackageManifestPath } from "../graphPathUtils.js";
+import { collectWorkspacePatternValues, normalizeWorkspacePattern, workspacePatternMatchesPackage, } from "./workspace.js";
+import { pnpmWorkspacePatterns } from "./pnpm.js";
+import { isPnpmWorkspaceManifestPath } from "../graphPathUtils.js";
+export const PACKAGE_ENTRYPOINT_EDGE_CONFIDENCE = 0.9;
+export const PACKAGE_SCRIPT_EDGE_CONFIDENCE = 0.88;
+export const WORKSPACE_PACKAGE_EDGE_CONFIDENCE = 0.86;
+export const PACKAGE_SCRIPT_REFERENCE_PATTERN = /(?:^|[\s"'`])((?:\.{1,2}\/)?(?:[\w.-]+\/)*[\w.-]+\.(?:cjs|cts|js|jsx|mjs|mts|ts|tsx))(?:$|[\s"'`])/gi;
+function collectPackageEntrypointValues(value, fieldPath, entries) {
+    if (typeof value === "string") {
+        if (value.trim().length > 0) {
+            entries.push({ field: fieldPath, specifier: value });
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => collectPackageEntrypointValues(item, `${fieldPath}.${index}`, entries));
+        return;
+    }
+    if (value === null || typeof value !== "object") {
+        return;
+    }
+    for (const [key, item] of Object.entries(value)) {
+        collectPackageEntrypointValues(item, `${fieldPath}.${key}`, entries);
+    }
+}
+export function packageEntrypointCandidates(content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return [];
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return [];
+    }
+    const record = parsed;
+    const entries = [];
+    for (const field of ["main", "module", "types", "typings", "browser"]) {
+        collectPackageEntrypointValues(record[field], field, entries);
+    }
+    collectPackageEntrypointValues(record.bin, "bin", entries);
+    collectPackageEntrypointValues(record.exports, "exports", entries);
+    return entries;
+}
+export function resolvePackageEntrypoint(packagePath, specifier, pathLookup) {
+    const normalizedSpecifier = normalizeGraphPath(specifier);
+    if (normalizedSpecifier.length === 0 ||
+        normalizedSpecifier.startsWith("/") ||
+        /^[a-z][a-z0-9+.-]*:/i.test(normalizedSpecifier)) {
+        return undefined;
+    }
+    const packageDir = posix.dirname(normalizeGraphPath(packagePath));
+    const packageRelative = packageDir === "."
+        ? normalizedSpecifier
+        : posix.join(packageDir, normalizedSpecifier);
+    return resolveCandidate(packageRelative, pathLookup);
+}
+export function extractPackageEntrypointEdges(fromPath, content, pathLookup) {
+    if (!isPackageManifestPath(fromPath)) {
+        return [];
+    }
+    const edges = [];
+    for (const { field, specifier } of packageEntrypointCandidates(content)) {
+        const target = resolvePackageEntrypoint(fromPath, specifier, pathLookup);
+        if (!target) {
+            continue;
+        }
+        edges.push(graphEdge({
+            from: fromPath,
+            to: target,
+            kind: "package-entrypoint-link",
+            confidence: PACKAGE_ENTRYPOINT_EDGE_CONFIDENCE,
+            reason: `Package manifest field '${field}' points to '${specifier}'.`,
+        }));
+    }
+    return edges;
+}
+export function packageScriptCandidates(content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return [];
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return [];
+    }
+    const scripts = parsed.scripts;
+    if (scripts === null ||
+        typeof scripts !== "object" ||
+        Array.isArray(scripts)) {
+        return [];
+    }
+    const entries = [];
+    for (const [script, command] of Object.entries(scripts)) {
+        if (typeof command !== "string") {
+            continue;
+        }
+        PACKAGE_SCRIPT_REFERENCE_PATTERN.lastIndex = 0;
+        for (const match of command.matchAll(PACKAGE_SCRIPT_REFERENCE_PATTERN)) {
+            const specifier = match[1]?.trim();
+            if (specifier) {
+                entries.push({ script, specifier });
+            }
+        }
+    }
+    return entries;
+}
+export function extractPackageScriptEdges(fromPath, content, pathLookup) {
+    if (!isPackageManifestPath(fromPath)) {
+        return [];
+    }
+    const edges = [];
+    for (const { script, specifier } of packageScriptCandidates(content)) {
+        const target = resolvePackageEntrypoint(fromPath, specifier, pathLookup);
+        if (!target) {
+            continue;
+        }
+        edges.push(graphEdge({
+            from: fromPath,
+            to: target,
+            kind: "package-script-link",
+            confidence: PACKAGE_SCRIPT_EDGE_CONFIDENCE,
+            reason: `Package script '${script}' references '${specifier}'.`,
+        }));
+    }
+    return edges;
+}
+export function packageWorkspacePatterns(content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return [];
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return [];
+    }
+    const record = parsed;
+    const patterns = [];
+    collectWorkspacePatternValues(record.workspaces, patterns);
+    if (record.workspaces !== null &&
+        typeof record.workspaces === "object" &&
+        !Array.isArray(record.workspaces)) {
+        collectWorkspacePatternValues(record.workspaces.packages, patterns);
+    }
+    return patterns;
+}
+function workspacePatternsForFile(path, content) {
+    if (isPackageManifestPath(path)) {
+        return packageWorkspacePatterns(content);
+    }
+    if (isPnpmWorkspaceManifestPath(path)) {
+        return pnpmWorkspacePatterns(content);
+    }
+    return [];
+}
+export function extractWorkspacePackageEdges(fromPath, content, pathLookup) {
+    const rawPatterns = workspacePatternsForFile(fromPath, content);
+    if (rawPatterns.length === 0) {
+        return [];
+    }
+    const positivePatterns = [];
+    const negativePatterns = [];
+    for (const { pattern, negated } of rawPatterns) {
+        const normalized = normalizeWorkspacePattern(fromPath, pattern);
+        if (!normalized) {
+            continue;
+        }
+        if (negated) {
+            negativePatterns.push(normalized);
+        }
+        else {
+            positivePatterns.push(normalized);
+        }
+    }
+    const edges = [];
+    for (const pattern of positivePatterns) {
+        for (const target of pathLookup.values()) {
+            if (target === fromPath || !isPackageManifestPath(target)) {
+                continue;
+            }
+            if (!workspacePatternMatchesPackage(pattern, target)) {
+                continue;
+            }
+            if (negativePatterns.some((negativePattern) => workspacePatternMatchesPackage(negativePattern, target))) {
+                continue;
+            }
+            edges.push(graphEdge({
+                from: fromPath,
+                to: target,
+                kind: "workspace-package-link",
+                confidence: WORKSPACE_PACKAGE_EDGE_CONFIDENCE,
+                reason: `Workspace pattern '${pattern}' includes package manifest '${target}'.`,
+            }));
+        }
+    }
+    return edges;
+}
+//# sourceMappingURL=packageJson.js.map

package/dist/audit/extractors/graphManifestEdges/packageJson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageJson.js","sourceRoot":"","sources":["../../../../src/audit/extractors/graphManifestEdges/packageJson.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAGL,6BAA6B,EAC7B,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAEnE,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AACtD,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,gCAAgC,GAC3C,sGAAsG,CAAC;AAEzG,SAAS,8BAA8B,CACrC,KAAc,EACd,SAAiB,EACjB,OAAoD;IAEpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC5B,8BAA8B,CAAC,IAAI,EAAE,GAAG,SAAS,IAAI,KAAK,EAAE,EAAE,OAAO,CAAC,CACvE,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,8BAA8B,CAAC,IAAI,EAAE,GAAG,SAAS,IAAI,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,OAAe;IAEf,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,OAAO,GAAgD,EAAE,CAAC;IAChE,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QACtE,8BAA8B,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,8BAA8B,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,8BAA8B,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,SAAiB,EACjB,UAA+B;IAE/B,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1D,IACE,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAChC,mBAAmB,CAAC,UAAU,CAAC,GAAG,CAAC;QACnC,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAChD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,MAAM,eAAe,GACnB,UAAU,KAAK,GAAG;QAChB,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAClD,OAAO,gBAAgB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAgB,EAChB,OAAe,EACf,UAA+B;IAE/B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,yBAAyB;YAC/B,UAAU,EAAE,kCAAkC;YAC9C,MAAM,EAAE,2BAA2B,KAAK,gBAAgB,SAAS,IAAI;SACtE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe;IAEf,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAI,MAAkC,CAAC,OAAO,CAAC;IAC5D,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAiD,EAAE,CAAC;IACjE,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QACD,gCAAgC,CAAC,SAAS,GAAG,CAAC,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;YACvE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACnC,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,OAAe,EACf,UAA+B;IAE/B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,qBAAqB;YAC3B,UAAU,EAAE,8BAA8B;YAC1C,MAAM,EAAE,mBAAmB,MAAM,iBAAiB,SAAS,IAAI;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,6BAA6B,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3D,IACE,MAAM,CAAC,UAAU,KAAK,IAAI;QAC1B,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EACjC,CAAC;QACD,6BAA6B,CAC1B,MAAM,CAAC,UAAsC,CAAC,QAAQ,EACvD,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAY,EACZ,OAAe;IAEf,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,OAAe,EACf,UAA+B;IAE/B,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,yBAAyB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,IAAI,CAAC,8BAA8B,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;gBACrD,SAAS;YACX,CAAC;YACD,IACE,gBAAgB,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CACxC,8BAA8B,CAAC,eAAe,EAAE,MAAM,CAAC,CACxD,EACD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;gBACR,IAAI,EAAE,QAAQ;gBACd,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,wBAAwB;gBAC9B,UAAU,EAAE,iCAAiC;gBAC7C,MAAM,EAAE,sBAAsB,OAAO,gCAAgC,MAAM,IAAI;aAChF,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}