kirograph 0.16.1 → 0.19.0

package/dist/security/manifest/plugins/npm.js

@@ -0,0 +1,284 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var npm_exports = {};
+__export(npm_exports, {
+  parseNpmManifest: () => parseNpmManifest
+});
+module.exports = __toCommonJS(npm_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+const SCOPE_FIELDS = [
+  { field: "dependencies", scope: "production" },
+  { field: "devDependencies", scope: "development" },
+  { field: "optionalDependencies", scope: "optional" }
+];
+async function parseNpmManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let pkg;
+  try {
+    const raw = fs.readFileSync(manifestPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      (0, import_errors.logWarn)(`[sec:npm] Invalid package.json structure at ${relativeManifest}`);
+      return [];
+    }
+    pkg = parsed;
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:npm] Failed to read/parse ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const license = extractNpmLicense(pkg);
+  const dependencies = [];
+  const warnings = [];
+  for (const { field, scope } of SCOPE_FIELDS) {
+    const depsObj = pkg[field];
+    if (depsObj === void 0 || depsObj === null) continue;
+    if (typeof depsObj !== "object" || Array.isArray(depsObj)) {
+      (0, import_errors.logWarn)(`[sec:npm] Invalid "${field}" field in ${relativeManifest} \u2014 expected object, got ${typeof depsObj}`);
+      continue;
+    }
+    const entries = Object.entries(depsObj);
+    for (const [name, constraint] of entries) {
+      if (!isValidDependencyName(name)) {
+        (0, import_errors.logWarn)(`[sec:npm] Invalid dependency name "${name}" in ${relativeManifest} (${field}) \u2014 skipping`);
+        warnings.push({ name, reason: "invalid name" });
+        continue;
+      }
+      if (typeof constraint !== "string" || constraint.trim() === "") {
+        (0, import_errors.logWarn)(`[sec:npm] Invalid version constraint for "${name}" in ${relativeManifest} (${field}) \u2014 skipping`);
+        warnings.push({ name, reason: "invalid constraint" });
+        continue;
+      }
+      const resolvedVersion = resolvedVersions.get(name);
+      dependencies.push({
+        name,
+        declaredConstraint: constraint,
+        resolvedVersion,
+        scope,
+        ecosystem: "npm",
+        sourceManifest: relativeManifest,
+        ...license !== void 0 ? { license } : {}
+      });
+    }
+  }
+  const peerDeps = pkg.peerDependencies;
+  if (peerDeps && typeof peerDeps === "object" && !Array.isArray(peerDeps)) {
+    const peerEntries = Object.entries(peerDeps);
+    for (const [name, constraint] of peerEntries) {
+      if (!isValidDependencyName(name)) {
+        (0, import_errors.logWarn)(`[sec:npm] Invalid peer dependency name "${name}" in ${relativeManifest} \u2014 skipping`);
+        warnings.push({ name, reason: "invalid name" });
+        continue;
+      }
+      if (typeof constraint !== "string" || constraint.trim() === "") {
+        (0, import_errors.logWarn)(`[sec:npm] Invalid version constraint for peer dependency "${name}" in ${relativeManifest} \u2014 skipping`);
+        warnings.push({ name, reason: "invalid constraint" });
+        continue;
+      }
+      const alreadyDeclared = dependencies.some((d) => d.name === name);
+      if (!alreadyDeclared) {
+        const resolvedVersion = resolvedVersions.get(name);
+        dependencies.push({
+          name,
+          declaredConstraint: constraint,
+          resolvedVersion,
+          scope: "production",
+          ecosystem: "npm",
+          sourceManifest: relativeManifest,
+          ...license !== void 0 ? { license } : {}
+        });
+      }
+    }
+  }
+  return dependencies;
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const lockPath = path.join(manifestDir, "package-lock.json");
+  if (fs.existsSync(lockPath)) {
+    try {
+      const lockContent = fs.readFileSync(lockPath, "utf8");
+      const lockData = JSON.parse(lockContent);
+      extractFromPackageLock(lockData, map);
+      return map;
+    } catch (err) {
+      (0, import_errors.logWarn)(`[sec:npm] Failed to parse package-lock.json: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const pnpmLockPath = path.join(manifestDir, "pnpm-lock.yaml");
+  if (fs.existsSync(pnpmLockPath)) {
+    try {
+      const pnpmContent = fs.readFileSync(pnpmLockPath, "utf8");
+      extractFromPnpmLock(pnpmContent, map);
+      return map;
+    } catch (err) {
+      (0, import_errors.logWarn)(`[sec:npm] Failed to parse pnpm-lock.yaml: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const yarnLockPath = path.join(manifestDir, "yarn.lock");
+  if (fs.existsSync(yarnLockPath)) {
+    try {
+      const yarnContent = fs.readFileSync(yarnLockPath, "utf8");
+      extractFromYarnLock(yarnContent, map);
+      return map;
+    } catch (err) {
+      (0, import_errors.logWarn)(`[sec:npm] Failed to parse yarn.lock: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return map;
+}
+function extractFromPnpmLock(content, map) {
+  for (const m of content.matchAll(/^[\s]*\/?(@?[a-zA-Z0-9._-]+(?:\/[a-zA-Z0-9._-]+)?)[@/]([0-9][a-zA-Z0-9._-]*)(?:\(.*?\))?:/gm)) {
+    const name = m[1].replace(/^\//, "");
+    const version = m[2];
+    if (name && version && !map.has(name)) {
+      map.set(name, version);
+    }
+  }
+}
+function extractFromPackageLock(lockData, map) {
+  if (typeof lockData !== "object" || lockData === null) return;
+  const lock = lockData;
+  const packages = lock.packages;
+  if (typeof packages === "object" && packages !== null) {
+    for (const [key, value] of Object.entries(packages)) {
+      if (key === "") continue;
+      if (typeof value !== "object" || value === null) continue;
+      const pkg = value;
+      const version = pkg.version;
+      if (typeof version !== "string") continue;
+      const name = key.replace(/^.*node_modules\//, "");
+      if (name && !map.has(name)) {
+        map.set(name, version);
+      }
+    }
+    return;
+  }
+  const dependencies = lock.dependencies;
+  if (typeof dependencies === "object" && dependencies !== null) {
+    extractFromLockV1Dependencies(dependencies, map);
+  }
+}
+function extractFromLockV1Dependencies(deps, map) {
+  for (const [name, value] of Object.entries(deps)) {
+    if (typeof value !== "object" || value === null) continue;
+    const dep = value;
+    const version = dep.version;
+    if (typeof version === "string" && !map.has(name)) {
+      map.set(name, version);
+    }
+    const nested = dep.dependencies;
+    if (typeof nested === "object" && nested !== null) {
+      extractFromLockV1Dependencies(nested, map);
+    }
+  }
+}
+function extractFromYarnLock(content, map) {
+  const lines = content.split("\n");
+  let currentPackageName = null;
+  for (const line of lines) {
+    if (line.startsWith("#") || line.trim() === "") {
+      currentPackageName = null;
+      continue;
+    }
+    if (!line.startsWith(" ") && line.endsWith(":")) {
+      const header = line.slice(0, -1);
+      const name = extractPackageNameFromYarnHeader(header);
+      currentPackageName = name;
+      continue;
+    }
+    if (currentPackageName && line.trim().startsWith("version ")) {
+      const versionMatch = line.match(/version\s+"([^"]+)"/);
+      if (versionMatch && !map.has(currentPackageName)) {
+        map.set(currentPackageName, versionMatch[1]);
+      }
+      currentPackageName = null;
+    }
+  }
+}
+function extractPackageNameFromYarnHeader(header) {
+  const firstEntry = header.split(",")[0].trim();
+  const cleaned = firstEntry.replace(/^["']|["']$/g, "");
+  const lastAtIndex = cleaned.lastIndexOf("@");
+  if (lastAtIndex <= 0) return null;
+  if (cleaned.startsWith("@")) {
+    const afterScope = cleaned.indexOf("/", 1);
+    if (afterScope === -1) return null;
+    const atAfterName = cleaned.indexOf("@", afterScope);
+    if (atAfterName === -1) return cleaned;
+    return cleaned.slice(0, atAfterName);
+  }
+  return cleaned.slice(0, lastAtIndex);
+}
+function extractNpmLicense(pkg) {
+  const raw = pkg["license"];
+  if (typeof raw === "string" && raw.trim() !== "") {
+    return raw.trim();
+  }
+  if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
+    const licObj = raw;
+    if (typeof licObj["type"] === "string" && licObj["type"].trim() !== "") {
+      return licObj["type"].trim();
+    }
+  }
+  const licenses = pkg["licenses"];
+  if (Array.isArray(licenses) && licenses.length > 0) {
+    const first = licenses[0];
+    if (typeof first === "object" && first !== null) {
+      const lic = first;
+      if (typeof lic["type"] === "string" && lic["type"].trim() !== "") {
+        return lic["type"].trim();
+      }
+    }
+    if (typeof first === "string" && first.trim() !== "") {
+      return first.trim();
+    }
+  }
+  return void 0;
+}
+function isValidDependencyName(name) {
+  if (!name || typeof name !== "string") return false;
+  if (name.length > 214) return false;
+  if (name.startsWith("@")) {
+    const parts = name.split("/");
+    if (parts.length !== 2) return false;
+    if (!parts[0] || !parts[1]) return false;
+    return true;
+  }
+  if (name.startsWith(".") || name.startsWith("_")) return false;
+  return true;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseNpmManifest
+});
+//# sourceMappingURL=npm.js.map

package/dist/security/manifest/plugins/npm.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/npm.ts"],
+  "sourcesContent": ["/**\n * NPM Version Extraction Plugin for KiroGraph-Sec\n *\n * Extends the existing architecture npm parser to extract version constraints,\n * resolved versions (from lock files), and dependency scopes for security analysis.\n *\n * Reuses `npmParser` from `src/architecture/manifest/npm.ts` for discovery and\n * basic parsing, then layers on version/scope extraction.\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/** Scope fields in package.json mapped to their ParsedDependency scope */\nconst SCOPE_FIELDS: Array<{ field: string; scope: ParsedDependency['scope'] }> = [\n  { field: 'dependencies', scope: 'production' },\n  { field: 'devDependencies', scope: 'development' },\n  { field: 'optionalDependencies', scope: 'optional' },\n];\n\n/**\n * Resolved version map: package name \u2192 resolved version string.\n * Built from package-lock.json or yarn.lock.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * Parse an npm package.json manifest and extract dependency declarations\n * with version constraints, scopes, and resolved versions from lock files.\n *\n * @param manifestPath - Absolute path to the package.json file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parseNpmManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read and parse the package.json\n  let pkg: Record<string, unknown>;\n  try {\n    const raw = fs.readFileSync(manifestPath, 'utf8');\n    const parsed = JSON.parse(raw);\n    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {\n      logWarn(`[sec:npm] Invalid package.json structure at ${relativeManifest}`);\n      return [];\n    }\n    pkg = parsed as Record<string, unknown>;\n  } catch (err) {\n    logWarn(`[sec:npm] Failed to read/parse ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Attempt to load resolved versions from lock file\n  const resolvedVersions = loadResolvedVersions(manifestDir);\n\n  // Extract the package-level license\n  const license = extractNpmLicense(pkg);\n\n  // Extract dependencies from each scope field\n  const dependencies: ParsedDependency[] = [];\n  const warnings: Array<{ name: string; reason: string }> = [];\n\n  for (const { field, scope } of SCOPE_FIELDS) {\n    const depsObj = pkg[field];\n    if (depsObj === undefined || depsObj === null) continue;\n\n    if (typeof depsObj !== 'object' || Array.isArray(depsObj)) {\n      logWarn(`[sec:npm] Invalid \"${field}\" field in ${relativeManifest} \u2014 expected object, got ${typeof depsObj}`);\n      continue;\n    }\n\n    const entries = Object.entries(depsObj as Record<string, unknown>);\n    for (const [name, constraint] of entries) {\n      // Validate the dependency entry\n      if (!isValidDependencyName(name)) {\n        logWarn(`[sec:npm] Invalid dependency name \"${name}\" in ${relativeManifest} (${field}) \u2014 skipping`);\n        warnings.push({ name, reason: 'invalid name' });\n        continue;\n      }\n\n      if (typeof constraint !== 'string' || constraint.trim() === '') {\n        logWarn(`[sec:npm] Invalid version constraint for \"${name}\" in ${relativeManifest} (${field}) \u2014 skipping`);\n        warnings.push({ name, reason: 'invalid constraint' });\n        continue;\n      }\n\n      const resolvedVersion = resolvedVersions.get(name);\n\n      dependencies.push({\n        name,\n        declaredConstraint: constraint,\n        resolvedVersion,\n        scope,\n        ecosystem: 'npm',\n        sourceManifest: relativeManifest,\n        ...(license !== undefined ? { license } : {}),\n      });\n    }\n  }\n\n  // Also handle peerDependencies \u2014 default to production scope\n  const peerDeps = pkg.peerDependencies;\n  if (peerDeps && typeof peerDeps === 'object' && !Array.isArray(peerDeps)) {\n    const peerEntries = Object.entries(peerDeps as Record<string, unknown>);\n    for (const [name, constraint] of peerEntries) {\n      if (!isValidDependencyName(name)) {\n        logWarn(`[sec:npm] Invalid peer dependency name \"${name}\" in ${relativeManifest} \u2014 skipping`);\n        warnings.push({ name, reason: 'invalid name' });\n        continue;\n      }\n\n      if (typeof constraint !== 'string' || constraint.trim() === '') {\n        logWarn(`[sec:npm] Invalid version constraint for peer dependency \"${name}\" in ${relativeManifest} \u2014 skipping`);\n        warnings.push({ name, reason: 'invalid constraint' });\n        continue;\n      }\n\n      // Only add if not already declared in another scope\n      const alreadyDeclared = dependencies.some(d => d.name === name);\n      if (!alreadyDeclared) {\n        const resolvedVersion = resolvedVersions.get(name);\n        dependencies.push({\n          name,\n          declaredConstraint: constraint,\n          resolvedVersion,\n          scope: 'production',\n          ecosystem: 'npm',\n          sourceManifest: relativeManifest,\n          ...(license !== undefined ? { license } : {}),\n        });\n      }\n    }\n  }\n\n  return dependencies;\n}\n\n/**\n * Attempt to load resolved versions from package-lock.json, pnpm-lock.yaml,\n * or yarn.lock in the given directory. Returns an empty map if none is available.\n */\nfunction loadResolvedVersions(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  // Try package-lock.json first (preferred \u2014 npm)\n  const lockPath = path.join(manifestDir, 'package-lock.json');\n  if (fs.existsSync(lockPath)) {\n    try {\n      const lockContent = fs.readFileSync(lockPath, 'utf8');\n      const lockData = JSON.parse(lockContent);\n      extractFromPackageLock(lockData, map);\n      return map;\n    } catch (err) {\n      logWarn(`[sec:npm] Failed to parse package-lock.json: ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  // Try pnpm-lock.yaml (pnpm)\n  const pnpmLockPath = path.join(manifestDir, 'pnpm-lock.yaml');\n  if (fs.existsSync(pnpmLockPath)) {\n    try {\n      const pnpmContent = fs.readFileSync(pnpmLockPath, 'utf8');\n      extractFromPnpmLock(pnpmContent, map);\n      return map;\n    } catch (err) {\n      logWarn(`[sec:npm] Failed to parse pnpm-lock.yaml: ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  // Fall back to yarn.lock\n  const yarnLockPath = path.join(manifestDir, 'yarn.lock');\n  if (fs.existsSync(yarnLockPath)) {\n    try {\n      const yarnContent = fs.readFileSync(yarnLockPath, 'utf8');\n      extractFromYarnLock(yarnContent, map);\n      return map;\n    } catch (err) {\n      logWarn(`[sec:npm] Failed to parse yarn.lock: ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from pnpm-lock.yaml (v5, v6, v9 formats).\n *\n * v5/v6: packages section with keys like \"/express/4.18.2\" or \"/express@4.18.2\"\n * v9:    snapshots section with keys like \"express@4.18.2\" and\n *        packages section with \"express@4.18.2: {version: ...}\" (optional)\n */\nfunction extractFromPnpmLock(content: string, map: ResolvedVersionMap): void {\n  // v9 format: package entries under `packages:` or `snapshots:`\n  // Key format: \"name@version\" or \"@scope/name@version\"\n  // We extract name@version pairs from both sections.\n\n  // Match lines like:  /express/4.18.2:  or  /express@4.18.2:  or  express@4.18.2:\n  for (const m of content.matchAll(/^[\\s]*\\/?(@?[a-zA-Z0-9._-]+(?:\\/[a-zA-Z0-9._-]+)?)[@/]([0-9][a-zA-Z0-9._-]*)(?:\\(.*?\\))?:/gm)) {\n    const name = m[1].replace(/^\\//, ''); // strip leading slash for scoped packages\n    const version = m[2];\n    if (name && version && !map.has(name)) {\n      map.set(name, version);\n    }\n  }\n}\n\n/**\n * Extract resolved versions from package-lock.json (supports v2 and v3 format).\n */\nfunction extractFromPackageLock(lockData: unknown, map: ResolvedVersionMap): void {\n  if (typeof lockData !== 'object' || lockData === null) return;\n  const lock = lockData as Record<string, unknown>;\n\n  // lockfileVersion 2/3: uses \"packages\" field with \"\" as root\n  const packages = lock.packages;\n  if (typeof packages === 'object' && packages !== null) {\n    for (const [key, value] of Object.entries(packages as Record<string, unknown>)) {\n      if (key === '') continue; // skip root\n      if (typeof value !== 'object' || value === null) continue;\n      const pkg = value as Record<string, unknown>;\n      const version = pkg.version;\n      if (typeof version !== 'string') continue;\n\n      // Key format: \"node_modules/<name>\" or \"node_modules/@scope/name\"\n      const name = key.replace(/^.*node_modules\\//, '');\n      if (name && !map.has(name)) {\n        map.set(name, version);\n      }\n    }\n    return;\n  }\n\n  // lockfileVersion 1: uses \"dependencies\" field\n  const dependencies = lock.dependencies;\n  if (typeof dependencies === 'object' && dependencies !== null) {\n    extractFromLockV1Dependencies(dependencies as Record<string, unknown>, map);\n  }\n}\n\n/**\n * Recursively extract versions from lockfileVersion 1 dependencies.\n */\nfunction extractFromLockV1Dependencies(\n  deps: Record<string, unknown>,\n  map: ResolvedVersionMap,\n): void {\n  for (const [name, value] of Object.entries(deps)) {\n    if (typeof value !== 'object' || value === null) continue;\n    const dep = value as Record<string, unknown>;\n    const version = dep.version;\n    if (typeof version === 'string' && !map.has(name)) {\n      map.set(name, version);\n    }\n    // Recurse into nested dependencies\n    const nested = dep.dependencies;\n    if (typeof nested === 'object' && nested !== null) {\n      extractFromLockV1Dependencies(nested as Record<string, unknown>, map);\n    }\n  }\n}\n\n/**\n * Extract resolved versions from yarn.lock (v1 format).\n * yarn.lock uses a custom format, not JSON.\n */\nfunction extractFromYarnLock(content: string, map: ResolvedVersionMap): void {\n  const lines = content.split('\\n');\n  let currentPackageName: string | null = null;\n\n  for (const line of lines) {\n    // Skip comments and empty lines\n    if (line.startsWith('#') || line.trim() === '') {\n      currentPackageName = null;\n      continue;\n    }\n\n    // Package header line: \"package-name@version-range:\" or \"@scope/name@range:\"\n    // Can also be: \"package-name@range1, package-name@range2:\"\n    if (!line.startsWith(' ') && line.endsWith(':')) {\n      const header = line.slice(0, -1); // remove trailing ':'\n      // Extract package name from the first entry (before @version)\n      const name = extractPackageNameFromYarnHeader(header);\n      currentPackageName = name;\n      continue;\n    }\n\n    // Version line: \"  version \"x.y.z\"\"\n    if (currentPackageName && line.trim().startsWith('version ')) {\n      const versionMatch = line.match(/version\\s+\"([^\"]+)\"/);\n      if (versionMatch && !map.has(currentPackageName)) {\n        map.set(currentPackageName, versionMatch[1]);\n      }\n      currentPackageName = null;\n    }\n  }\n}\n\n/**\n * Extract the package name from a yarn.lock header line.\n * Handles formats like:\n *   - \"express@^4.17.1\"\n *   - \"@types/node@^18.0.0\"\n *   - \"express@^4.17.1, express@^4.18.0\"\n *   - '\"express@^4.17.1\"'\n */\nfunction extractPackageNameFromYarnHeader(header: string): string | null {\n  // Take the first entry if comma-separated\n  const firstEntry = header.split(',')[0].trim();\n  // Remove surrounding quotes if present\n  const cleaned = firstEntry.replace(/^[\"']|[\"']$/g, '');\n\n  // Find the last @ that separates name from version\n  // For scoped packages (@scope/name@version), we need the last @\n  const lastAtIndex = cleaned.lastIndexOf('@');\n  if (lastAtIndex <= 0) return null; // no @ or starts with @ (scoped without version)\n\n  // For scoped packages, check if the first char is @\n  if (cleaned.startsWith('@')) {\n    // @scope/name@version \u2014 find the @ after the scope\n    const afterScope = cleaned.indexOf('/', 1);\n    if (afterScope === -1) return null;\n    const atAfterName = cleaned.indexOf('@', afterScope);\n    if (atAfterName === -1) return cleaned; // no version part\n    return cleaned.slice(0, atAfterName);\n  }\n\n  return cleaned.slice(0, lastAtIndex);\n}\n\n/**\n * Extract the license field from a parsed package.json object.\n * Handles both string format (`\"MIT\"`) and object format (`{\"type\":\"MIT\"}`).\n */\nfunction extractNpmLicense(pkg: Record<string, unknown>): string | undefined {\n  const raw = pkg['license'];\n  if (typeof raw === 'string' && raw.trim() !== '') {\n    return raw.trim();\n  }\n  if (typeof raw === 'object' && raw !== null && !Array.isArray(raw)) {\n    const licObj = raw as Record<string, unknown>;\n    if (typeof licObj['type'] === 'string' && licObj['type'].trim() !== '') {\n      return licObj['type'].trim();\n    }\n  }\n  // Handle legacy \"licenses\" array\n  const licenses = pkg['licenses'];\n  if (Array.isArray(licenses) && licenses.length > 0) {\n    const first = licenses[0];\n    if (typeof first === 'object' && first !== null) {\n      const lic = first as Record<string, unknown>;\n      if (typeof lic['type'] === 'string' && lic['type'].trim() !== '') {\n        return lic['type'].trim();\n      }\n    }\n    if (typeof first === 'string' && first.trim() !== '') {\n      return first.trim();\n    }\n  }\n  return undefined;\n}\n\n/**\n * Validate that a dependency name follows npm naming conventions.\n * Must be non-empty, not start with a dot or underscore (unless scoped),\n * and contain only valid characters.\n */\nfunction isValidDependencyName(name: string): boolean {\n  if (!name || typeof name !== 'string') return false;\n  if (name.length > 214) return false;\n\n  // Scoped packages: @scope/name\n  if (name.startsWith('@')) {\n    const parts = name.split('/');\n    if (parts.length !== 2) return false;\n    if (!parts[0] || !parts[1]) return false;\n    return true;\n  }\n\n  // Unscoped: must not start with . or _\n  if (name.startsWith('.') || name.startsWith('_')) return false;\n\n  return true;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAGxB,MAAM,eAA2E;AAAA,EAC/E,EAAE,OAAO,gBAAgB,OAAO,aAAa;AAAA,EAC7C,EAAE,OAAO,mBAAmB,OAAO,cAAc;AAAA,EACjD,EAAE,OAAO,wBAAwB,OAAO,WAAW;AACrD;AAgBA,eAAsB,iBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,GAAG,aAAa,cAAc,MAAM;AAChD,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,iCAAQ,+CAA+C,gBAAgB,EAAE;AACzE,aAAO,CAAC;AAAA,IACV;AACA,UAAM;AAAA,EACR,SAAS,KAAK;AACZ,+BAAQ,kCAAkC,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AACjH,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,mBAAmB,qBAAqB,WAAW;AAGzD,QAAM,UAAU,kBAAkB,GAAG;AAGrC,QAAM,eAAmC,CAAC;AAC1C,QAAM,WAAoD,CAAC;AAE3D,aAAW,EAAE,OAAO,MAAM,KAAK,cAAc;AAC3C,UAAM,UAAU,IAAI,KAAK;AACzB,QAAI,YAAY,UAAa,YAAY,KAAM;AAE/C,QAAI,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG;AACzD,iCAAQ,sBAAsB,KAAK,cAAc,gBAAgB,gCAA2B,OAAO,OAAO,EAAE;AAC5G;AAAA,IACF;AAEA,UAAM,UAAU,OAAO,QAAQ,OAAkC;AACjE,eAAW,CAAC,MAAM,UAAU,KAAK,SAAS;AAExC,UAAI,CAAC,sBAAsB,IAAI,GAAG;AAChC,mCAAQ,sCAAsC,IAAI,QAAQ,gBAAgB,KAAK,KAAK,mBAAc;AAClG,iBAAS,KAAK,EAAE,MAAM,QAAQ,eAAe,CAAC;AAC9C;AAAA,MACF;AAEA,UAAI,OAAO,eAAe,YAAY,WAAW,KAAK,MAAM,IAAI;AAC9D,mCAAQ,6CAA6C,IAAI,QAAQ,gBAAgB,KAAK,KAAK,mBAAc;AACzG,iBAAS,KAAK,EAAE,MAAM,QAAQ,qBAAqB,CAAC;AACpD;AAAA,MACF;AAEA,YAAM,kBAAkB,iBAAiB,IAAI,IAAI;AAEjD,mBAAa,KAAK;AAAA,QAChB;AAAA,QACA,oBAAoB;AAAA,QACpB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,WAAW,IAAI;AACrB,MAAI,YAAY,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,QAAQ,GAAG;AACxE,UAAM,cAAc,OAAO,QAAQ,QAAmC;AACtE,eAAW,CAAC,MAAM,UAAU,KAAK,aAAa;AAC5C,UAAI,CAAC,sBAAsB,IAAI,GAAG;AAChC,mCAAQ,2CAA2C,IAAI,QAAQ,gBAAgB,kBAAa;AAC5F,iBAAS,KAAK,EAAE,MAAM,QAAQ,eAAe,CAAC;AAC9C;AAAA,MACF;AAEA,UAAI,OAAO,eAAe,YAAY,WAAW,KAAK,MAAM,IAAI;AAC9D,mCAAQ,6DAA6D,IAAI,QAAQ,gBAAgB,kBAAa;AAC9G,iBAAS,KAAK,EAAE,MAAM,QAAQ,qBAAqB,CAAC;AACpD;AAAA,MACF;AAGA,YAAM,kBAAkB,aAAa,KAAK,OAAK,EAAE,SAAS,IAAI;AAC9D,UAAI,CAAC,iBAAiB;AACpB,cAAM,kBAAkB,iBAAiB,IAAI,IAAI;AACjD,qBAAa,KAAK;AAAA,UAChB;AAAA,UACA,oBAAoB;AAAA,UACpB;AAAA,UACA,OAAO;AAAA,UACP,WAAW;AAAA,UACX,gBAAgB;AAAA,UAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC7C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,MAA0B,oBAAI,IAAI;AAGxC,QAAM,WAAW,KAAK,KAAK,aAAa,mBAAmB;AAC3D,MAAI,GAAG,WAAW,QAAQ,GAAG;AAC3B,QAAI;AACF,YAAM,cAAc,GAAG,aAAa,UAAU,MAAM;AACpD,YAAM,WAAW,KAAK,MAAM,WAAW;AACvC,6BAAuB,UAAU,GAAG;AACpC,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,iCAAQ,gDAAgD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,IAC5G;AAAA,EACF;AAGA,QAAM,eAAe,KAAK,KAAK,aAAa,gBAAgB;AAC5D,MAAI,GAAG,WAAW,YAAY,GAAG;AAC/B,QAAI;AACF,YAAM,cAAc,GAAG,aAAa,cAAc,MAAM;AACxD,0BAAoB,aAAa,GAAG;AACpC,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,iCAAQ,6CAA6C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,IACzG;AAAA,EACF;AAGA,QAAM,eAAe,KAAK,KAAK,aAAa,WAAW;AACvD,MAAI,GAAG,WAAW,YAAY,GAAG;AAC/B,QAAI;AACF,YAAM,cAAc,GAAG,aAAa,cAAc,MAAM;AACxD,0BAAoB,aAAa,GAAG;AACpC,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,iCAAQ,wCAAwC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,IACpG;AAAA,EACF;AAEA,SAAO;AACT;AASA,SAAS,oBAAoB,SAAiB,KAA+B;AAM3E,aAAW,KAAK,QAAQ,SAAS,6FAA6F,GAAG;AAC/H,UAAM,OAAO,EAAE,CAAC,EAAE,QAAQ,OAAO,EAAE;AACnC,UAAM,UAAU,EAAE,CAAC;AACnB,QAAI,QAAQ,WAAW,CAAC,IAAI,IAAI,IAAI,GAAG;AACrC,UAAI,IAAI,MAAM,OAAO;AAAA,IACvB;AAAA,EACF;AACF;AAKA,SAAS,uBAAuB,UAAmB,KAA+B;AAChF,MAAI,OAAO,aAAa,YAAY,aAAa,KAAM;AACvD,QAAM,OAAO;AAGb,QAAM,WAAW,KAAK;AACtB,MAAI,OAAO,aAAa,YAAY,aAAa,MAAM;AACrD,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAmC,GAAG;AAC9E,UAAI,QAAQ,GAAI;AAChB,UAAI,OAAO,UAAU,YAAY,UAAU,KAAM;AACjD,YAAM,MAAM;AACZ,YAAM,UAAU,IAAI;AACpB,UAAI,OAAO,YAAY,SAAU;AAGjC,YAAM,OAAO,IAAI,QAAQ,qBAAqB,EAAE;AAChD,UAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,GAAG;AAC1B,YAAI,IAAI,MAAM,OAAO;AAAA,MACvB;AAAA,IACF;AACA;AAAA,EACF;AAGA,QAAM,eAAe,KAAK;AAC1B,MAAI,OAAO,iBAAiB,YAAY,iBAAiB,MAAM;AAC7D,kCAA8B,cAAyC,GAAG;AAAA,EAC5E;AACF;AAKA,SAAS,8BACP,MACA,KACM;AACN,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAChD,QAAI,OAAO,UAAU,YAAY,UAAU,KAAM;AACjD,UAAM,MAAM;AACZ,UAAM,UAAU,IAAI;AACpB,QAAI,OAAO,YAAY,YAAY,CAAC,IAAI,IAAI,IAAI,GAAG;AACjD,UAAI,IAAI,MAAM,OAAO;AAAA,IACvB;AAEA,UAAM,SAAS,IAAI;AACnB,QAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,oCAA8B,QAAmC,GAAG;AAAA,IACtE;AAAA,EACF;AACF;AAMA,SAAS,oBAAoB,SAAiB,KAA+B;AAC3E,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,MAAI,qBAAoC;AAExC,aAAW,QAAQ,OAAO;AAExB,QAAI,KAAK,WAAW,GAAG,KAAK,KAAK,KAAK,MAAM,IAAI;AAC9C,2BAAqB;AACrB;AAAA,IACF;AAIA,QAAI,CAAC,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,GAAG;AAC/C,YAAM,SAAS,KAAK,MAAM,GAAG,EAAE;AAE/B,YAAM,OAAO,iCAAiC,MAAM;AACpD,2BAAqB;AACrB;AAAA,IACF;AAGA,QAAI,sBAAsB,KAAK,KAAK,EAAE,WAAW,UAAU,GAAG;AAC5D,YAAM,eAAe,KAAK,MAAM,qBAAqB;AACrD,UAAI,gBAAgB,CAAC,IAAI,IAAI,kBAAkB,GAAG;AAChD,YAAI,IAAI,oBAAoB,aAAa,CAAC,CAAC;AAAA,MAC7C;AACA,2BAAqB;AAAA,IACvB;AAAA,EACF;AACF;AAUA,SAAS,iCAAiC,QAA+B;AAEvE,QAAM,aAAa,OAAO,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AAE7C,QAAM,UAAU,WAAW,QAAQ,gBAAgB,EAAE;AAIrD,QAAM,cAAc,QAAQ,YAAY,GAAG;AAC3C,MAAI,eAAe,EAAG,QAAO;AAG7B,MAAI,QAAQ,WAAW,GAAG,GAAG;AAE3B,UAAM,aAAa,QAAQ,QAAQ,KAAK,CAAC;AACzC,QAAI,eAAe,GAAI,QAAO;AAC9B,UAAM,cAAc,QAAQ,QAAQ,KAAK,UAAU;AACnD,QAAI,gBAAgB,GAAI,QAAO;AAC/B,WAAO,QAAQ,MAAM,GAAG,WAAW;AAAA,EACrC;AAEA,SAAO,QAAQ,MAAM,GAAG,WAAW;AACrC;AAMA,SAAS,kBAAkB,KAAkD;AAC3E,QAAM,MAAM,IAAI,SAAS;AACzB,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAChD,WAAO,IAAI,KAAK;AAAA,EAClB;AACA,MAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,CAAC,MAAM,QAAQ,GAAG,GAAG;AAClE,UAAM,SAAS;AACf,QAAI,OAAO,OAAO,MAAM,MAAM,YAAY,OAAO,MAAM,EAAE,KAAK,MAAM,IAAI;AACtE,aAAO,OAAO,MAAM,EAAE,KAAK;AAAA,IAC7B;AAAA,EACF;AAEA,QAAM,WAAW,IAAI,UAAU;AAC/B,MAAI,MAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS,GAAG;AAClD,UAAM,QAAQ,SAAS,CAAC;AACxB,QAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,YAAM,MAAM;AACZ,UAAI,OAAO,IAAI,MAAM,MAAM,YAAY,IAAI,MAAM,EAAE,KAAK,MAAM,IAAI;AAChE,eAAO,IAAI,MAAM,EAAE,KAAK;AAAA,MAC1B;AAAA,IACF;AACA,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAAI;AACpD,aAAO,MAAM,KAAK;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;AAOA,SAAS,sBAAsB,MAAuB;AACpD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,MAAI,KAAK,SAAS,IAAK,QAAO;AAG9B,MAAI,KAAK,WAAW,GAAG,GAAG;AACxB,UAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAG,QAAO;AACnC,WAAO;AAAA,EACT;AAGA,MAAI,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AAEzD,SAAO;AACT;",
+  "names": []
+}

package/dist/security/manifest/plugins/npm.test.js

@@ -0,0 +1,298 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var os = __toESM(require("os"));
+var import_npm = require("./npm");
+(0, import_vitest.describe)("parseNpmManifest", () => {
+  let tmpDir;
+  (0, import_vitest.beforeEach)(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "kirograph-npm-test-"));
+  });
+  (0, import_vitest.afterEach)(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+  function writePackageJson(content, dir) {
+    const targetDir = dir ?? tmpDir;
+    const filePath = path.join(targetDir, "package.json");
+    fs.mkdirSync(targetDir, { recursive: true });
+    fs.writeFileSync(filePath, JSON.stringify(content, null, 2));
+    return filePath;
+  }
+  (0, import_vitest.it)("extracts production dependencies with correct scope", async () => {
+    const manifestPath = writePackageJson({
+      name: "test-project",
+      version: "1.0.0",
+      dependencies: {
+        express: "^4.18.2",
+        lodash: "~4.17.21"
+      }
+    });
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    const express = deps.find((d) => d.name === "express");
+    (0, import_vitest.expect)(express).toBeDefined();
+    (0, import_vitest.expect)(express.declaredConstraint).toBe("^4.18.2");
+    (0, import_vitest.expect)(express.scope).toBe("production");
+    (0, import_vitest.expect)(express.ecosystem).toBe("npm");
+    const lodash = deps.find((d) => d.name === "lodash");
+    (0, import_vitest.expect)(lodash).toBeDefined();
+    (0, import_vitest.expect)(lodash.declaredConstraint).toBe("~4.17.21");
+    (0, import_vitest.expect)(lodash.scope).toBe("production");
+  });
+  (0, import_vitest.it)("extracts devDependencies with development scope", async () => {
+    const manifestPath = writePackageJson({
+      name: "test-project",
+      devDependencies: {
+        vitest: "^1.0.0",
+        typescript: "^5.0.0"
+      }
+    });
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    (0, import_vitest.expect)(deps.every((d) => d.scope === "development")).toBe(true);
+  });
+  (0, import_vitest.it)("extracts optionalDependencies with optional scope", async () => {
+    const manifestPath = writePackageJson({
+      name: "test-project",
+      optionalDependencies: {
+        "better-sqlite3": "^11.0.0"
+      }
+    });
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].scope).toBe("optional");
+    (0, import_vitest.expect)(deps[0].name).toBe("better-sqlite3");
+  });
+  (0, import_vitest.it)("handles all scope fields together", async () => {
+    const manifestPath = writePackageJson({
+      name: "test-project",
+      dependencies: { express: "^4.18.0" },
+      devDependencies: { vitest: "^1.0.0" },
+      optionalDependencies: { sqlite3: "^5.0.0" }
+    });
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(3);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "express").scope).toBe("production");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "vitest").scope).toBe("development");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "sqlite3").scope).toBe("optional");
+  });
+  (0, import_vitest.it)("resolves versions from package-lock.json (v2/v3 format)", async () => {
+    writePackageJson({
+      name: "test-project",
+      dependencies: { express: "^4.18.0" }
+    });
+    const lockContent = {
+      lockfileVersion: 3,
+      packages: {
+        "": { name: "test-project", version: "1.0.0" },
+        "node_modules/express": { version: "4.18.2" }
+      }
+    };
+    fs.writeFileSync(
+      path.join(tmpDir, "package-lock.json"),
+      JSON.stringify(lockContent)
+    );
+    const manifestPath = path.join(tmpDir, "package.json");
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBe("4.18.2");
+    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("^4.18.0");
+  });
+  (0, import_vitest.it)("resolves versions from package-lock.json (v1 format)", async () => {
+    writePackageJson({
+      name: "test-project",
+      dependencies: { lodash: "^4.17.0" }
+    });
+    const lockContent = {
+      lockfileVersion: 1,
+      dependencies: {
+        lodash: { version: "4.17.21" }
+      }
+    };
+    fs.writeFileSync(
+      path.join(tmpDir, "package-lock.json"),
+      JSON.stringify(lockContent)
+    );
+    const manifestPath = path.join(tmpDir, "package.json");
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBe("4.17.21");
+  });
+  (0, import_vitest.it)("resolves versions from yarn.lock", async () => {
+    writePackageJson({
+      name: "test-project",
+      dependencies: { react: "^18.0.0" }
+    });
+    const yarnLock = `# yarn lockfile v1
+
+react@^18.0.0:
+  version "18.2.0"
+  resolved "https://registry.yarnpkg.com/react/-/react-18.2.0.tgz"
+  integrity sha512-abc123
+`;
+    fs.writeFileSync(path.join(tmpDir, "yarn.lock"), yarnLock);
+    const manifestPath = path.join(tmpDir, "package.json");
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBe("18.2.0");
+  });
+  (0, import_vitest.it)("handles scoped packages in yarn.lock", async () => {
+    writePackageJson({
+      name: "test-project",
+      dependencies: { "@types/node": "^20.0.0" }
+    });
+    const yarnLock = `# yarn lockfile v1
+
+"@types/node@^20.0.0":
+  version "20.11.5"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-20.11.5.tgz"
+`;
+    fs.writeFileSync(path.join(tmpDir, "yarn.lock"), yarnLock);
+    const manifestPath = path.join(tmpDir, "package.json");
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("@types/node");
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBe("20.11.5");
+  });
+  (0, import_vitest.it)("skips invalid dependency entries gracefully", async () => {
+    const manifestPath = writePackageJson({
+      name: "test-project",
+      dependencies: {
+        express: "^4.18.0",
+        "": "^1.0.0",
+        // invalid: empty name
+        ".hidden": "^1.0.0",
+        // invalid: starts with dot
+        validPkg: "",
+        // invalid: empty constraint
+        anotherValid: "^2.0.0",
+        // valid
+        badConstraint: 123
+        // invalid: non-string constraint
+      }
+    });
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    const names = deps.map((d) => d.name);
+    (0, import_vitest.expect)(names).toContain("express");
+    (0, import_vitest.expect)(names).toContain("anotherValid");
+    (0, import_vitest.expect)(names).not.toContain("");
+    (0, import_vitest.expect)(names).not.toContain(".hidden");
+    (0, import_vitest.expect)(names).not.toContain("validPkg");
+    (0, import_vitest.expect)(names).not.toContain("badConstraint");
+  });
+  (0, import_vitest.it)("returns empty array for invalid JSON", async () => {
+    const filePath = path.join(tmpDir, "package.json");
+    fs.writeFileSync(filePath, "not valid json {{{");
+    const deps = await (0, import_npm.parseNpmManifest)(filePath, tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("returns empty array for non-object JSON", async () => {
+    const filePath = path.join(tmpDir, "package.json");
+    fs.writeFileSync(filePath, '"just a string"');
+    const deps = await (0, import_npm.parseNpmManifest)(filePath, tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("returns empty array for array JSON", async () => {
+    const filePath = path.join(tmpDir, "package.json");
+    fs.writeFileSync(filePath, "[1, 2, 3]");
+    const deps = await (0, import_npm.parseNpmManifest)(filePath, tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("handles package.json with no dependency fields", async () => {
+    const manifestPath = writePackageJson({
+      name: "empty-project",
+      version: "1.0.0"
+    });
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("sets sourceManifest as relative path", async () => {
+    const subDir = path.join(tmpDir, "packages", "sub");
+    const manifestPath = writePackageJson(
+      { name: "sub", dependencies: { foo: "^1.0.0" } },
+      subDir
+    );
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].sourceManifest).toBe("packages/sub/package.json");
+  });
+  (0, import_vitest.it)("handles peerDependencies with production scope", async () => {
+    const manifestPath = writePackageJson({
+      name: "test-project",
+      peerDependencies: { react: ">=16.0.0" }
+    });
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("react");
+    (0, import_vitest.expect)(deps[0].scope).toBe("production");
+    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe(">=16.0.0");
+  });
+  (0, import_vitest.it)("does not duplicate peerDependencies already in dependencies", async () => {
+    const manifestPath = writePackageJson({
+      name: "test-project",
+      dependencies: { react: "^18.0.0" },
+      peerDependencies: { react: ">=16.0.0" }
+    });
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    const reactDeps = deps.filter((d) => d.name === "react");
+    (0, import_vitest.expect)(reactDeps).toHaveLength(1);
+    (0, import_vitest.expect)(reactDeps[0].scope).toBe("production");
+    (0, import_vitest.expect)(reactDeps[0].declaredConstraint).toBe("^18.0.0");
+  });
+  (0, import_vitest.it)("prefers package-lock.json over yarn.lock", async () => {
+    writePackageJson({
+      name: "test-project",
+      dependencies: { express: "^4.0.0" }
+    });
+    const lockContent = {
+      lockfileVersion: 3,
+      packages: {
+        "": { name: "test-project" },
+        "node_modules/express": { version: "4.18.2" }
+      }
+    };
+    fs.writeFileSync(path.join(tmpDir, "package-lock.json"), JSON.stringify(lockContent));
+    const yarnLock = `# yarn lockfile v1
+
+express@^4.0.0:
+  version "4.17.0"
+`;
+    fs.writeFileSync(path.join(tmpDir, "yarn.lock"), yarnLock);
+    const manifestPath = path.join(tmpDir, "package.json");
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBe("4.18.2");
+  });
+  (0, import_vitest.it)("leaves resolvedVersion undefined when no lock file exists", async () => {
+    const manifestPath = writePackageJson({
+      name: "test-project",
+      dependencies: { express: "^4.18.0" }
+    });
+    const deps = await (0, import_npm.parseNpmManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBeUndefined();
+  });
+});
+//# sourceMappingURL=npm.test.js.map