kirograph 0.16.1 → 0.19.0

package/dist/security/manifest/plugins/go.test.js

@@ -0,0 +1,341 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var os = __toESM(require("os"));
+var import_go = require("./go");
+(0, import_vitest.describe)("parseGoManifest", () => {
+  let tmpDir;
+  (0, import_vitest.beforeEach)(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "kirograph-go-test-"));
+  });
+  (0, import_vitest.afterEach)(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+  function writeGoMod(content, dir) {
+    const targetDir = dir ?? tmpDir;
+    fs.mkdirSync(targetDir, { recursive: true });
+    const filePath = path.join(targetDir, "go.mod");
+    fs.writeFileSync(filePath, content);
+    return filePath;
+  }
+  function writeGoSum(content, dir) {
+    const targetDir = dir ?? tmpDir;
+    fs.mkdirSync(targetDir, { recursive: true });
+    fs.writeFileSync(path.join(targetDir, "go.sum"), content);
+  }
+  (0, import_vitest.it)("extracts dependencies from require block", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require (
+	github.com/gin-gonic/gin v1.9.1
+	github.com/stretchr/testify v1.8.4
+)
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    const gin = deps.find((d) => d.name === "github.com/gin-gonic/gin");
+    (0, import_vitest.expect)(gin).toBeDefined();
+    (0, import_vitest.expect)(gin.declaredConstraint).toBe("v1.9.1");
+    (0, import_vitest.expect)(gin.resolvedVersion).toBe("v1.9.1");
+    (0, import_vitest.expect)(gin.scope).toBe("production");
+    (0, import_vitest.expect)(gin.ecosystem).toBe("go");
+    const testify = deps.find((d) => d.name === "github.com/stretchr/testify");
+    (0, import_vitest.expect)(testify).toBeDefined();
+    (0, import_vitest.expect)(testify.declaredConstraint).toBe("v1.8.4");
+    (0, import_vitest.expect)(testify.resolvedVersion).toBe("v1.8.4");
+  });
+  (0, import_vitest.it)("extracts single-line require directives", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require github.com/pkg/errors v0.9.1
+require golang.org/x/text v0.14.0
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "github.com/pkg/errors")).toBeDefined();
+    (0, import_vitest.expect)(deps.find((d) => d.name === "golang.org/x/text")).toBeDefined();
+  });
+  (0, import_vitest.it)("handles both block and single-line requires together", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require github.com/pkg/errors v0.9.1
+
+require (
+	github.com/gin-gonic/gin v1.9.1
+	github.com/stretchr/testify v1.8.4
+)
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(3);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "github.com/pkg/errors")).toBeDefined();
+    (0, import_vitest.expect)(deps.find((d) => d.name === "github.com/gin-gonic/gin")).toBeDefined();
+    (0, import_vitest.expect)(deps.find((d) => d.name === "github.com/stretchr/testify")).toBeDefined();
+  });
+  (0, import_vitest.it)("all dependencies have production scope", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require (
+	github.com/gin-gonic/gin v1.9.1
+	github.com/stretchr/testify v1.8.4
+)
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps.every((d) => d.scope === "production")).toBe(true);
+  });
+  (0, import_vitest.it)("sets declaredConstraint and resolvedVersion to the same value", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require github.com/gin-gonic/gin v1.9.1
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("v1.9.1");
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBe("v1.9.1");
+  });
+  (0, import_vitest.it)("skips comment lines in require block", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require (
+	// This is a comment
+	github.com/gin-gonic/gin v1.9.1
+	// Another comment
+	github.com/stretchr/testify v1.8.4
+)
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "github.com/gin-gonic/gin")).toBeDefined();
+    (0, import_vitest.expect)(deps.find((d) => d.name === "github.com/stretchr/testify")).toBeDefined();
+  });
+  (0, import_vitest.it)("handles indirect dependencies (// indirect comment)", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require (
+	github.com/gin-gonic/gin v1.9.1
+	golang.org/x/sys v0.15.0 // indirect
+)
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    const sys = deps.find((d) => d.name === "golang.org/x/sys");
+    (0, import_vitest.expect)(sys).toBeDefined();
+    (0, import_vitest.expect)(sys.declaredConstraint).toBe("v0.15.0");
+  });
+  (0, import_vitest.it)("handles pseudo-versions", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require (
+	github.com/some/module v0.0.0-20230101120000-abcdef123456
+)
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("v0.0.0-20230101120000-abcdef123456");
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBe("v0.0.0-20230101120000-abcdef123456");
+  });
+  (0, import_vitest.it)("handles +incompatible versions", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require github.com/some/legacy v3.2.1+incompatible
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("v3.2.1+incompatible");
+  });
+  (0, import_vitest.it)("skips entries with invalid module paths", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require (
+	github.com/valid/module v1.0.0
+	invalidpath v1.0.0
+)
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("github.com/valid/module");
+  });
+  (0, import_vitest.it)("skips entries with invalid version format", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require (
+	github.com/valid/module v1.0.0
+	github.com/bad/version 1.0.0
+	github.com/bad/version2 latest
+)
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("github.com/valid/module");
+  });
+  (0, import_vitest.it)("returns empty array for unreadable file", async () => {
+    const deps = await (0, import_go.parseGoManifest)("/nonexistent/go.mod", tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("returns empty array for go.mod with no require directives", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("sets sourceManifest as relative path", async () => {
+    const subDir = path.join(tmpDir, "services", "api");
+    const manifestPath = writeGoMod(`
+module github.com/example/api
+
+go 1.21
+
+require github.com/gin-gonic/gin v1.9.1
+`, subDir);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].sourceManifest).toBe("services/api/go.mod");
+  });
+  (0, import_vitest.it)("reads go.sum for integrity verification", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require github.com/gin-gonic/gin v1.9.1
+`);
+    writeGoSum(`github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqFPSKw=
+github.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL/0KcuqOSEXQHxOGZp0Lg2g/4wZIgGMnG3w3gI=
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("github.com/gin-gonic/gin");
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBe("v1.9.1");
+  });
+  (0, import_vitest.it)("handles go.mod with multiple require blocks", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require (
+	github.com/gin-gonic/gin v1.9.1
+)
+
+require (
+	golang.org/x/text v0.14.0
+	golang.org/x/sys v0.15.0
+)
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(3);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "github.com/gin-gonic/gin")).toBeDefined();
+    (0, import_vitest.expect)(deps.find((d) => d.name === "golang.org/x/text")).toBeDefined();
+    (0, import_vitest.expect)(deps.find((d) => d.name === "golang.org/x/sys")).toBeDefined();
+  });
+  (0, import_vitest.it)("handles empty require block", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require (
+)
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("handles pre-release versions", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require github.com/some/module v1.2.3-beta.1
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("v1.2.3-beta.1");
+  });
+  (0, import_vitest.it)("works without go.sum present", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require github.com/gin-gonic/gin v1.9.1
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("github.com/gin-gonic/gin");
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBe("v1.9.1");
+  });
+  (0, import_vitest.it)("sets ecosystem to go for all dependencies", async () => {
+    const manifestPath = writeGoMod(`
+module github.com/example/myproject
+
+go 1.21
+
+require (
+	github.com/gin-gonic/gin v1.9.1
+	golang.org/x/text v0.14.0
+)
+`);
+    const deps = await (0, import_go.parseGoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps.every((d) => d.ecosystem === "go")).toBe(true);
+  });
+});
+//# sourceMappingURL=go.test.js.map

package/dist/security/manifest/plugins/go.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/go.test.ts"],
+  "sourcesContent": ["/**\n * Unit tests for the Go security manifest plugin.\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { parseGoManifest } from './go';\n\ndescribe('parseGoManifest', () => {\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kirograph-go-test-'));\n  });\n\n  afterEach(() => {\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  function writeGoMod(content: string, dir?: string): string {\n    const targetDir = dir ?? tmpDir;\n    fs.mkdirSync(targetDir, { recursive: true });\n    const filePath = path.join(targetDir, 'go.mod');\n    fs.writeFileSync(filePath, content);\n    return filePath;\n  }\n\n  function writeGoSum(content: string, dir?: string): void {\n    const targetDir = dir ?? tmpDir;\n    fs.mkdirSync(targetDir, { recursive: true });\n    fs.writeFileSync(path.join(targetDir, 'go.sum'), content);\n  }\n\n  it('extracts dependencies from require block', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n\tgithub.com/stretchr/testify v1.8.4\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    const gin = deps.find(d => d.name === 'github.com/gin-gonic/gin');\n    expect(gin).toBeDefined();\n    expect(gin!.declaredConstraint).toBe('v1.9.1');\n    expect(gin!.resolvedVersion).toBe('v1.9.1');\n    expect(gin!.scope).toBe('production');\n    expect(gin!.ecosystem).toBe('go');\n\n    const testify = deps.find(d => d.name === 'github.com/stretchr/testify');\n    expect(testify).toBeDefined();\n    expect(testify!.declaredConstraint).toBe('v1.8.4');\n    expect(testify!.resolvedVersion).toBe('v1.8.4');\n  });\n\n  it('extracts single-line require directives', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/pkg/errors v0.9.1\nrequire golang.org/x/text v0.14.0\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps.find(d => d.name === 'github.com/pkg/errors')).toBeDefined();\n    expect(deps.find(d => d.name === 'golang.org/x/text')).toBeDefined();\n  });\n\n  it('handles both block and single-line requires together', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/pkg/errors v0.9.1\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n\tgithub.com/stretchr/testify v1.8.4\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(3);\n    expect(deps.find(d => d.name === 'github.com/pkg/errors')).toBeDefined();\n    expect(deps.find(d => d.name === 'github.com/gin-gonic/gin')).toBeDefined();\n    expect(deps.find(d => d.name === 'github.com/stretchr/testify')).toBeDefined();\n  });\n\n  it('all dependencies have production scope', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n\tgithub.com/stretchr/testify v1.8.4\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps.every(d => d.scope === 'production')).toBe(true);\n  });\n\n  it('sets declaredConstraint and resolvedVersion to the same value', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/gin-gonic/gin v1.9.1\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('v1.9.1');\n    expect(deps[0].resolvedVersion).toBe('v1.9.1');\n  });\n\n  it('skips comment lines in require block', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\t// This is a comment\n\tgithub.com/gin-gonic/gin v1.9.1\n\t// Another comment\n\tgithub.com/stretchr/testify v1.8.4\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps.find(d => d.name === 'github.com/gin-gonic/gin')).toBeDefined();\n    expect(deps.find(d => d.name === 'github.com/stretchr/testify')).toBeDefined();\n  });\n\n  it('handles indirect dependencies (// indirect comment)', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n\tgolang.org/x/sys v0.15.0 // indirect\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    const sys = deps.find(d => d.name === 'golang.org/x/sys');\n    expect(sys).toBeDefined();\n    expect(sys!.declaredConstraint).toBe('v0.15.0');\n  });\n\n  it('handles pseudo-versions', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/some/module v0.0.0-20230101120000-abcdef123456\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('v0.0.0-20230101120000-abcdef123456');\n    expect(deps[0].resolvedVersion).toBe('v0.0.0-20230101120000-abcdef123456');\n  });\n\n  it('handles +incompatible versions', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/some/legacy v3.2.1+incompatible\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('v3.2.1+incompatible');\n  });\n\n  it('skips entries with invalid module paths', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/valid/module v1.0.0\n\tinvalidpath v1.0.0\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('github.com/valid/module');\n  });\n\n  it('skips entries with invalid version format', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/valid/module v1.0.0\n\tgithub.com/bad/version 1.0.0\n\tgithub.com/bad/version2 latest\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('github.com/valid/module');\n  });\n\n  it('returns empty array for unreadable file', async () => {\n    const deps = await parseGoManifest('/nonexistent/go.mod', tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('returns empty array for go.mod with no require directives', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('sets sourceManifest as relative path', async () => {\n    const subDir = path.join(tmpDir, 'services', 'api');\n    const manifestPath = writeGoMod(`\nmodule github.com/example/api\n\ngo 1.21\n\nrequire github.com/gin-gonic/gin v1.9.1\n`, subDir);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].sourceManifest).toBe('services/api/go.mod');\n  });\n\n  it('reads go.sum for integrity verification', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/gin-gonic/gin v1.9.1\n`);\n\n    writeGoSum(`github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqFPSKw=\ngithub.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL/0KcuqOSEXQHxOGZp0Lg2g/4wZIgGMnG3w3gI=\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    // The dependency should still be extracted correctly\n    // go.sum is used for integrity verification awareness\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('github.com/gin-gonic/gin');\n    expect(deps[0].resolvedVersion).toBe('v1.9.1');\n  });\n\n  it('handles go.mod with multiple require blocks', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n)\n\nrequire (\n\tgolang.org/x/text v0.14.0\n\tgolang.org/x/sys v0.15.0\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(3);\n    expect(deps.find(d => d.name === 'github.com/gin-gonic/gin')).toBeDefined();\n    expect(deps.find(d => d.name === 'golang.org/x/text')).toBeDefined();\n    expect(deps.find(d => d.name === 'golang.org/x/sys')).toBeDefined();\n  });\n\n  it('handles empty require block', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('handles pre-release versions', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/some/module v1.2.3-beta.1\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('v1.2.3-beta.1');\n  });\n\n  it('works without go.sum present', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/gin-gonic/gin v1.9.1\n`);\n\n    // No go.sum written\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('github.com/gin-gonic/gin');\n    expect(deps[0].resolvedVersion).toBe('v1.9.1');\n  });\n\n  it('sets ecosystem to go for all dependencies', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n\tgolang.org/x/text v0.14.0\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps.every(d => d.ecosystem === 'go')).toBe(true);\n  });\n});\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAGA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,gBAAgC;AAAA,IAEhC,wBAAS,mBAAmB,MAAM;AAChC,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,oBAAoB,CAAC;AAAA,EACtE,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAED,WAAS,WAAW,SAAiB,KAAsB;AACzD,UAAM,YAAY,OAAO;AACzB,OAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAC3C,UAAM,WAAW,KAAK,KAAK,WAAW,QAAQ;AAC9C,OAAG,cAAc,UAAU,OAAO;AAClC,WAAO;AAAA,EACT;AAEA,WAAS,WAAW,SAAiB,KAAoB;AACvD,UAAM,YAAY,OAAO;AACzB,OAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAC3C,OAAG,cAAc,KAAK,KAAK,WAAW,QAAQ,GAAG,OAAO;AAAA,EAC1D;AAEA,wBAAG,4CAA4C,YAAY;AACzD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,UAAM,MAAM,KAAK,KAAK,OAAK,EAAE,SAAS,0BAA0B;AAChE,8BAAO,GAAG,EAAE,YAAY;AACxB,8BAAO,IAAK,kBAAkB,EAAE,KAAK,QAAQ;AAC7C,8BAAO,IAAK,eAAe,EAAE,KAAK,QAAQ;AAC1C,8BAAO,IAAK,KAAK,EAAE,KAAK,YAAY;AACpC,8BAAO,IAAK,SAAS,EAAE,KAAK,IAAI;AAEhC,UAAM,UAAU,KAAK,KAAK,OAAK,EAAE,SAAS,6BAA6B;AACvE,8BAAO,OAAO,EAAE,YAAY;AAC5B,8BAAO,QAAS,kBAAkB,EAAE,KAAK,QAAQ;AACjD,8BAAO,QAAS,eAAe,EAAE,KAAK,QAAQ;AAAA,EAChD,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAOnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,uBAAuB,CAAC,EAAE,YAAY;AACvE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,mBAAmB,CAAC,EAAE,YAAY;AAAA,EACrE,CAAC;AAED,wBAAG,wDAAwD,YAAY;AACrE,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAWnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,uBAAuB,CAAC,EAAE,YAAY;AACvE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,0BAA0B,CAAC,EAAE,YAAY;AAC1E,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,6BAA6B,CAAC,EAAE,YAAY;AAAA,EAC/E,CAAC;AAED,wBAAG,0CAA0C,YAAY;AACvD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,KAAK,MAAM,OAAK,EAAE,UAAU,YAAY,CAAC,EAAE,KAAK,IAAI;AAAA,EAC7D,CAAC;AAED,wBAAG,iEAAiE,YAAY;AAC9E,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,QAAQ;AAChD,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,QAAQ;AAAA,EAC/C,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAWnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,0BAA0B,CAAC,EAAE,YAAY;AAC1E,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,6BAA6B,CAAC,EAAE,YAAY;AAAA,EAC/E,CAAC;AAED,wBAAG,uDAAuD,YAAY;AACpE,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,UAAM,MAAM,KAAK,KAAK,OAAK,EAAE,SAAS,kBAAkB;AACxD,8BAAO,GAAG,EAAE,YAAY;AACxB,8BAAO,IAAK,kBAAkB,EAAE,KAAK,SAAS;AAAA,EAChD,CAAC;AAED,wBAAG,2BAA2B,YAAY;AACxC,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAQnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,oCAAoC;AAC5E,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,oCAAoC;AAAA,EAC3E,CAAC;AAED,wBAAG,kCAAkC,YAAY;AAC/C,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,qBAAqB;AAAA,EAC/D,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,yBAAyB;AAAA,EACrD,CAAC;AAED,wBAAG,6CAA6C,YAAY;AAC1D,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAUnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,yBAAyB;AAAA,EACrD,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,OAAO,UAAM,2BAAgB,uBAAuB,MAAM;AAChE,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,6DAA6D,YAAY;AAC1E,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA,CAInC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AACvD,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,SAAS,KAAK,KAAK,QAAQ,YAAY,KAAK;AAClD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAMjC,MAAM;AAEL,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,cAAc,EAAE,KAAK,qBAAqB;AAAA,EAC3D,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMnC;AAEG,eAAW;AAAA;AAAA,CAEd;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAIvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,0BAA0B;AACpD,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,QAAQ;AAAA,EAC/C,CAAC;AAED,wBAAG,+CAA+C,YAAY;AAC5D,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAanC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,0BAA0B,CAAC,EAAE,YAAY;AAC1E,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,mBAAmB,CAAC,EAAE,YAAY;AACnE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,kBAAkB,CAAC,EAAE,YAAY;AAAA,EACpE,CAAC;AAED,wBAAG,+BAA+B,YAAY;AAC5C,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAOnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AACvD,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,gCAAgC,YAAY;AAC7C,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,eAAe;AAAA,EACzD,CAAC;AAED,wBAAG,gCAAgC,YAAY;AAC7C,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMnC;AAGG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,0BAA0B;AACpD,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,QAAQ;AAAA,EAC/C,CAAC;AAED,wBAAG,6CAA6C,YAAY;AAC1D,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,KAAK,MAAM,OAAK,EAAE,cAAc,IAAI,CAAC,EAAE,KAAK,IAAI;AAAA,EACzD,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/security/manifest/plugins/gradle.js

@@ -0,0 +1,159 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var gradle_exports = {};
+__export(gradle_exports, {
+  parseGradleManifest: () => parseGradleManifest
+});
+module.exports = __toCommonJS(gradle_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+const TEST_CONFIGURATIONS = /* @__PURE__ */ new Set([
+  "testimplementation",
+  "testapi",
+  "testcompile",
+  "testruntimeonly",
+  "androidtestimplementation",
+  "androidtestapi"
+]);
+const KNOWN_CONFIGURATIONS = [
+  "androidTestImplementation",
+  "androidTestApi",
+  "debugImplementation",
+  "releaseImplementation",
+  "testImplementation",
+  "testRuntimeOnly",
+  "testCompile",
+  "testApi",
+  "implementation",
+  "runtimeOnly",
+  "compileOnly",
+  "compile",
+  "api"
+];
+async function parseGradleManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:gradle] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const dependencies = [];
+  const configPattern = KNOWN_CONFIGURATIONS.map((c) => escapeRegex(c)).join("|");
+  const depRegex = new RegExp(
+    `^\\s*(${configPattern})\\s*\\(?\\s*["']([^"']+)["']\\s*\\)?`,
+    "gmi"
+  );
+  let match;
+  while ((match = depRegex.exec(content)) !== null) {
+    const configuration = match[1];
+    const notation = match[2].trim();
+    const dep = parseGradleNotation(notation, configuration, relativeManifest);
+    if (!dep) continue;
+    const lookupKey = `${dep.group}:${dep.artifact}`.toLowerCase();
+    const resolvedVersion = resolvedVersions.get(lookupKey);
+    dependencies.push({
+      name: `${dep.group}:${dep.artifact}`,
+      declaredConstraint: dep.version,
+      resolvedVersion,
+      scope: resolveScope(configuration),
+      ecosystem: "gradle",
+      sourceManifest: relativeManifest
+    });
+  }
+  return dependencies;
+}
+function parseGradleNotation(notation, configuration, relativeManifest) {
+  if (notation.startsWith("libs.") || notation.startsWith("libs(")) {
+    return null;
+  }
+  const parts = notation.split(":");
+  if (parts.length < 2) {
+    return null;
+  }
+  const group = parts[0].trim();
+  const artifact = parts[1].trim();
+  const version = parts.length >= 3 ? parts[2].trim() : "";
+  if (!group || !artifact) {
+    (0, import_errors.logWarn)(`[sec:gradle] Empty group or artifact in notation "${notation}" (${configuration}) at ${relativeManifest} \u2014 skipping`);
+    return null;
+  }
+  const normalizedVersion = version === "" || version === "+" || version.toLowerCase() === "latest.release" ? "*" : version;
+  return { group, artifact, version: normalizedVersion };
+}
+function resolveScope(configuration) {
+  return TEST_CONFIGURATIONS.has(configuration.toLowerCase()) ? "development" : "production";
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const lockPath = path.join(manifestDir, "gradle.lockfile");
+  if (!fs.existsSync(lockPath)) {
+    return map;
+  }
+  try {
+    const content = fs.readFileSync(lockPath, "utf8");
+    extractFromGradleLockfile(content, map);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:gradle] Failed to parse gradle.lockfile: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function extractFromGradleLockfile(content, map) {
+  const lines = content.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    if (trimmed === "empty=") continue;
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1) continue;
+    const coordinate = trimmed.slice(0, eqIndex).trim();
+    const parts = coordinate.split(":");
+    if (parts.length < 3) continue;
+    const group = parts[0].trim();
+    const artifact = parts[1].trim();
+    const version = parts[2].trim();
+    if (!group || !artifact || !version) continue;
+    const key = `${group}:${artifact}`.toLowerCase();
+    if (!map.has(key)) {
+      map.set(key, version);
+    }
+  }
+}
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseGradleManifest
+});
+//# sourceMappingURL=gradle.js.map

package/dist/security/manifest/plugins/gradle.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/gradle.ts"],
+  "sourcesContent": ["/**\n * Gradle Version Extraction Plugin for KiroGraph-Sec\n *\n * Extends the existing architecture gradle parser to extract version constraints,\n * resolved versions (from gradle.lockfile), and dependency scopes for security analysis.\n *\n * Reuses `gradleParser` from `src/architecture/manifest/gradle.ts` for discovery and\n * basic parsing, then layers on version/scope extraction.\n *\n * Handles Groovy DSL (`build.gradle`) and Kotlin DSL (`build.gradle.kts`):\n * - Groovy: `implementation 'group:artifact:version'`\n * - Kotlin: `implementation(\"group:artifact:version\")`\n * - Configuration variants: `api`, `compile`, `testImplementation`, `testApi`,\n *   `androidTestImplementation`, `debugImplementation`, `releaseImplementation`\n * - Version catalog references (`libs.someDep`) are skipped \u2014 no version available\n * - Lock file: `gradle.lockfile` for resolved versions\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Gradle dependency configurations mapped to ParsedDependency scope.\n * Configurations not listed here are treated as 'production'.\n */\nconst TEST_CONFIGURATIONS = new Set([\n  'testimplementation',\n  'testapi',\n  'testcompile',\n  'testruntimeonly',\n  'androidtestimplementation',\n  'androidtestapi',\n]);\n\n/**\n * All known Gradle dependency configuration prefixes we parse.\n * Listed from longest to shortest so regex alternation matches greedily.\n */\nconst KNOWN_CONFIGURATIONS = [\n  'androidTestImplementation',\n  'androidTestApi',\n  'debugImplementation',\n  'releaseImplementation',\n  'testImplementation',\n  'testRuntimeOnly',\n  'testCompile',\n  'testApi',\n  'implementation',\n  'runtimeOnly',\n  'compileOnly',\n  'compile',\n  'api',\n];\n\n/**\n * Resolved version map: `group:artifact` (lower-cased) \u2192 resolved version string.\n * Built from gradle.lockfile.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * Parse a Gradle build script (`build.gradle` or `build.gradle.kts`) and extract\n * dependency declarations with version constraints, scopes, and resolved versions\n * from `gradle.lockfile`.\n *\n * @param manifestPath - Absolute path to the build.gradle or build.gradle.kts file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parseGradleManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read the build script content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:gradle] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Attempt to load resolved versions from gradle.lockfile\n  const resolvedVersions = loadResolvedVersions(manifestDir);\n\n  const dependencies: ParsedDependency[] = [];\n\n  // Build a regex that matches any known configuration followed by a dependency notation\n  // Groovy DSL:  implementation 'group:artifact:version'\n  //              implementation \"group:artifact:version\"\n  // Kotlin DSL:  implementation(\"group:artifact:version\")\n  const configPattern = KNOWN_CONFIGURATIONS.map(c => escapeRegex(c)).join('|');\n  // Match: <config> [optional (] ['\"] group:artifact:version ['\"] [optional )]\n  const depRegex = new RegExp(\n    `^\\\\s*(${configPattern})\\\\s*\\\\(?\\\\s*[\"']([^\"']+)[\"']\\\\s*\\\\)?`,\n    'gmi',\n  );\n\n  let match: RegExpExecArray | null;\n  while ((match = depRegex.exec(content)) !== null) {\n    const configuration = match[1];\n    const notation = match[2].trim();\n\n    const dep = parseGradleNotation(notation, configuration, relativeManifest);\n    if (!dep) continue;\n\n    const lookupKey = `${dep.group}:${dep.artifact}`.toLowerCase();\n    const resolvedVersion = resolvedVersions.get(lookupKey);\n\n    dependencies.push({\n      name: `${dep.group}:${dep.artifact}`,\n      declaredConstraint: dep.version,\n      resolvedVersion,\n      scope: resolveScope(configuration),\n      ecosystem: 'gradle',\n      sourceManifest: relativeManifest,\n    });\n  }\n\n  return dependencies;\n}\n\n/**\n * A parsed Gradle dependency notation (group:artifact:version).\n */\ninterface GradleCoordinate {\n  group: string;\n  artifact: string;\n  version: string;\n}\n\n/**\n * Parse a Gradle dependency notation string of the form `group:artifact:version`.\n *\n * Skips version catalog references (e.g. `libs.someDep`) and notations\n * that do not follow the three-part `group:artifact:version` format.\n */\nfunction parseGradleNotation(\n  notation: string,\n  configuration: string,\n  relativeManifest: string,\n): GradleCoordinate | null {\n  // Skip version catalog references \u2014 they don't carry version info\n  if (notation.startsWith('libs.') || notation.startsWith('libs(')) {\n    return null;\n  }\n\n  const parts = notation.split(':');\n  if (parts.length < 2) {\n    // Not a standard Maven/Gradle coordinate \u2014 skip silently\n    return null;\n  }\n\n  const group = parts[0].trim();\n  const artifact = parts[1].trim();\n  const version = parts.length >= 3 ? parts[2].trim() : '';\n\n  if (!group || !artifact) {\n    logWarn(`[sec:gradle] Empty group or artifact in notation \"${notation}\" (${configuration}) at ${relativeManifest} \u2014 skipping`);\n    return null;\n  }\n\n  // Dynamic/incomplete versions (e.g. \"+\", \"\", \"latest.release\") use \"*\" sentinel\n  const normalizedVersion =\n    version === '' || version === '+' || version.toLowerCase() === 'latest.release'\n      ? '*'\n      : version;\n\n  return { group, artifact, version: normalizedVersion };\n}\n\n/**\n * Map a Gradle configuration name to a ParsedDependency scope.\n *\n * Test configurations (`testImplementation`, `testApi`, etc.) map to 'development'.\n * All others (including `implementation`, `api`, `compile`, etc.) map to 'production'.\n */\nfunction resolveScope(configuration: string): ParsedDependency['scope'] {\n  return TEST_CONFIGURATIONS.has(configuration.toLowerCase()) ? 'development' : 'production';\n}\n\n/**\n * Attempt to load resolved versions from `gradle.lockfile` in the given directory.\n * Returns an empty map if the lock file is not available.\n *\n * gradle.lockfile format (one entry per line):\n * ```\n * # This is a comment\n * com.google.guava:guava:32.1.2-jre=compileClasspath,runtimeClasspath\n * junit:junit:4.13.2=testCompileClasspath,testRuntimeClasspath\n * empty=\n * ```\n */\nfunction loadResolvedVersions(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  const lockPath = path.join(manifestDir, 'gradle.lockfile');\n  if (!fs.existsSync(lockPath)) {\n    return map;\n  }\n\n  try {\n    const content = fs.readFileSync(lockPath, 'utf8');\n    extractFromGradleLockfile(content, map);\n  } catch (err) {\n    logWarn(`[sec:gradle] Failed to parse gradle.lockfile: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from gradle.lockfile content.\n *\n * Each non-comment, non-empty line has the form:\n *   `group:artifact:version=configurationList`\n *\n * The special line `empty=` indicates no locked dependencies and is ignored.\n */\nfunction extractFromGradleLockfile(content: string, map: ResolvedVersionMap): void {\n  const lines = content.split('\\n');\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n\n    // Skip comments and empty lines\n    if (trimmed === '' || trimmed.startsWith('#')) continue;\n\n    // Skip the sentinel \"empty=\" line\n    if (trimmed === 'empty=') continue;\n\n    // Format: group:artifact:version=configurationList\n    const eqIndex = trimmed.indexOf('=');\n    if (eqIndex === -1) continue;\n\n    const coordinate = trimmed.slice(0, eqIndex).trim();\n    const parts = coordinate.split(':');\n    if (parts.length < 3) continue;\n\n    const group = parts[0].trim();\n    const artifact = parts[1].trim();\n    const version = parts[2].trim();\n\n    if (!group || !artifact || !version) continue;\n\n    const key = `${group}:${artifact}`.toLowerCase();\n    if (!map.has(key)) {\n      map.set(key, version);\n    }\n  }\n}\n\n/**\n * Escape special regex characters in a string.\n */\nfunction escapeRegex(str: string): string {\n  return str.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAMxB,MAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMD,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAiBA,eAAsB,oBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,+BAA+B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC9G,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,mBAAmB,qBAAqB,WAAW;AAEzD,QAAM,eAAmC,CAAC;AAM1C,QAAM,gBAAgB,qBAAqB,IAAI,OAAK,YAAY,CAAC,CAAC,EAAE,KAAK,GAAG;AAE5E,QAAM,WAAW,IAAI;AAAA,IACnB,SAAS,aAAa;AAAA,IACtB;AAAA,EACF;AAEA,MAAI;AACJ,UAAQ,QAAQ,SAAS,KAAK,OAAO,OAAO,MAAM;AAChD,UAAM,gBAAgB,MAAM,CAAC;AAC7B,UAAM,WAAW,MAAM,CAAC,EAAE,KAAK;AAE/B,UAAM,MAAM,oBAAoB,UAAU,eAAe,gBAAgB;AACzE,QAAI,CAAC,IAAK;AAEV,UAAM,YAAY,GAAG,IAAI,KAAK,IAAI,IAAI,QAAQ,GAAG,YAAY;AAC7D,UAAM,kBAAkB,iBAAiB,IAAI,SAAS;AAEtD,iBAAa,KAAK;AAAA,MAChB,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,QAAQ;AAAA,MAClC,oBAAoB,IAAI;AAAA,MACxB;AAAA,MACA,OAAO,aAAa,aAAa;AAAA,MACjC,WAAW;AAAA,MACX,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAiBA,SAAS,oBACP,UACA,eACA,kBACyB;AAEzB,MAAI,SAAS,WAAW,OAAO,KAAK,SAAS,WAAW,OAAO,GAAG;AAChE,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,MAAI,MAAM,SAAS,GAAG;AAEpB,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MAAM,CAAC,EAAE,KAAK;AAC5B,QAAM,WAAW,MAAM,CAAC,EAAE,KAAK;AAC/B,QAAM,UAAU,MAAM,UAAU,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI;AAEtD,MAAI,CAAC,SAAS,CAAC,UAAU;AACvB,+BAAQ,qDAAqD,QAAQ,MAAM,aAAa,QAAQ,gBAAgB,kBAAa;AAC7H,WAAO;AAAA,EACT;AAGA,QAAM,oBACJ,YAAY,MAAM,YAAY,OAAO,QAAQ,YAAY,MAAM,mBAC3D,MACA;AAEN,SAAO,EAAE,OAAO,UAAU,SAAS,kBAAkB;AACvD;AAQA,SAAS,aAAa,eAAkD;AACtE,SAAO,oBAAoB,IAAI,cAAc,YAAY,CAAC,IAAI,gBAAgB;AAChF;AAcA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,MAA0B,oBAAI,IAAI;AAExC,QAAM,WAAW,KAAK,KAAK,aAAa,iBAAiB;AACzD,MAAI,CAAC,GAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,UAAU,GAAG,aAAa,UAAU,MAAM;AAChD,8BAA0B,SAAS,GAAG;AAAA,EACxC,SAAS,KAAK;AACZ,+BAAQ,iDAAiD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EAC7G;AAEA,SAAO;AACT;AAUA,SAAS,0BAA0B,SAAiB,KAA+B;AACjF,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAEhC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAG1B,QAAI,YAAY,MAAM,QAAQ,WAAW,GAAG,EAAG;AAG/C,QAAI,YAAY,SAAU;AAG1B,UAAM,UAAU,QAAQ,QAAQ,GAAG;AACnC,QAAI,YAAY,GAAI;AAEpB,UAAM,aAAa,QAAQ,MAAM,GAAG,OAAO,EAAE,KAAK;AAClD,UAAM,QAAQ,WAAW,MAAM,GAAG;AAClC,QAAI,MAAM,SAAS,EAAG;AAEtB,UAAM,QAAQ,MAAM,CAAC,EAAE,KAAK;AAC5B,UAAM,WAAW,MAAM,CAAC,EAAE,KAAK;AAC/B,UAAM,UAAU,MAAM,CAAC,EAAE,KAAK;AAE9B,QAAI,CAAC,SAAS,CAAC,YAAY,CAAC,QAAS;AAErC,UAAM,MAAM,GAAG,KAAK,IAAI,QAAQ,GAAG,YAAY;AAC/C,QAAI,CAAC,IAAI,IAAI,GAAG,GAAG;AACjB,UAAI,IAAI,KAAK,OAAO;AAAA,IACtB;AAAA,EACF;AACF;AAKA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uBAAuB,MAAM;AAClD;",
+  "names": []
+}