kirograph 0.16.1 → 0.19.0

package/dist/security/manifest/plugins/pip.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/pip.test.ts"],
+  "sourcesContent": ["/**\n * Unit tests for the pip security manifest plugin.\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { parsePipManifest } from './pip';\n\ndescribe('parsePipManifest', () => {\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kirograph-pip-test-'));\n  });\n\n  afterEach(() => {\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  function writeRequirements(content: string, filename = 'requirements.txt'): string {\n    const filePath = path.join(tmpDir, filename);\n    fs.writeFileSync(filePath, content);\n    return filePath;\n  }\n\n  it('extracts packages with == constraint and resolves exact version', async () => {\n    const manifestPath = writeRequirements('flask==2.3.0\\nrequests==2.28.1\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    const flask = deps.find(d => d.name === 'flask');\n    expect(flask).toBeDefined();\n    expect(flask!.declaredConstraint).toBe('==2.3.0');\n    expect(flask!.resolvedVersion).toBe('2.3.0');\n    expect(flask!.scope).toBe('production');\n    expect(flask!.ecosystem).toBe('pypi');\n\n    const requests = deps.find(d => d.name === 'requests');\n    expect(requests).toBeDefined();\n    expect(requests!.declaredConstraint).toBe('==2.28.1');\n    expect(requests!.resolvedVersion).toBe('2.28.1');\n  });\n\n  it('extracts packages with >= constraint (no resolved version)', async () => {\n    const manifestPath = writeRequirements('requests>=2.28\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('requests');\n    expect(deps[0].declaredConstraint).toBe('>=2.28');\n    expect(deps[0].resolvedVersion).toBeUndefined();\n  });\n\n  it('extracts packages with ~= constraint', async () => {\n    const manifestPath = writeRequirements('django~=4.2\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('django');\n    expect(deps[0].declaredConstraint).toBe('~=4.2');\n    expect(deps[0].resolvedVersion).toBeUndefined();\n  });\n\n  it('extracts packages with no version constraint', async () => {\n    const manifestPath = writeRequirements('numpy\\nscipy\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps[0].name).toBe('numpy');\n    expect(deps[0].declaredConstraint).toBe('');\n    expect(deps[0].resolvedVersion).toBeUndefined();\n    expect(deps[1].name).toBe('scipy');\n  });\n\n  it('skips comment lines', async () => {\n    const manifestPath = writeRequirements(\n      '# This is a comment\\nflask==2.3.0\\n# Another comment\\nrequests>=2.28\\n',\n    );\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps.map(d => d.name)).toEqual(['flask', 'requests']);\n  });\n\n  it('skips empty lines', async () => {\n    const manifestPath = writeRequirements('flask==2.3.0\\n\\n\\nrequests>=2.28\\n\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n  });\n\n  it('skips pip option lines (-r, -c, -e, --index-url, --extra-index-url)', async () => {\n    const manifestPath = writeRequirements(\n      '-r base.txt\\n-c constraints.txt\\n-e git+https://github.com/user/repo.git\\n--index-url https://pypi.org/simple\\n--extra-index-url https://private.pypi.org/simple\\nflask==2.3.0\\n',\n    );\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('flask');\n  });\n\n  it('strips environment markers', async () => {\n    const manifestPath = writeRequirements(\n      'pywin32>=300; sys_platform == \"win32\"\\ncolorama>=0.4; os_name == \"nt\"\\nflask==2.3.0\\n',\n    );\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(3);\n    const pywin32 = deps.find(d => d.name === 'pywin32');\n    expect(pywin32).toBeDefined();\n    expect(pywin32!.declaredConstraint).toBe('>=300');\n\n    const colorama = deps.find(d => d.name === 'colorama');\n    expect(colorama).toBeDefined();\n    expect(colorama!.declaredConstraint).toBe('>=0.4');\n  });\n\n  it('handles packages with extras (e.g. package[extra]>=1.0)', async () => {\n    const manifestPath = writeRequirements('requests[security]>=2.28.0\\ncelery[redis]==5.3.0\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    const requests = deps.find(d => d.name === 'requests');\n    expect(requests).toBeDefined();\n    expect(requests!.declaredConstraint).toBe('>=2.28.0');\n\n    const celery = deps.find(d => d.name === 'celery');\n    expect(celery).toBeDefined();\n    expect(celery!.declaredConstraint).toBe('==5.3.0');\n    expect(celery!.resolvedVersion).toBe('5.3.0');\n  });\n\n  it('normalizes package names (PEP 503)', async () => {\n    const manifestPath = writeRequirements(\n      'Flask==2.3.0\\nPyYAML>=6.0\\nmy_package==1.0.0\\nAnother.Package>=2.0\\n',\n    );\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(4);\n    expect(deps.map(d => d.name)).toEqual([\n      'flask',\n      'pyyaml',\n      'my-package',\n      'another-package',\n    ]);\n  });\n\n  it('all dependencies have production scope', async () => {\n    const manifestPath = writeRequirements('flask==2.3.0\\npytest==7.0.0\\nmypy>=1.0\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(3);\n    expect(deps.every(d => d.scope === 'production')).toBe(true);\n  });\n\n  it('all dependencies have pypi ecosystem', async () => {\n    const manifestPath = writeRequirements('flask==2.3.0\\ndjango~=4.2\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps.every(d => d.ecosystem === 'pypi')).toBe(true);\n  });\n\n  it('sets sourceManifest as relative path', async () => {\n    const subDir = path.join(tmpDir, 'services', 'api');\n    fs.mkdirSync(subDir, { recursive: true });\n    const filePath = path.join(subDir, 'requirements.txt');\n    fs.writeFileSync(filePath, 'flask==2.3.0\\n');\n\n    const deps = await parsePipManifest(filePath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].sourceManifest).toBe('services/api/requirements.txt');\n  });\n\n  it('returns empty array for non-existent file', async () => {\n    const deps = await parsePipManifest(\n      path.join(tmpDir, 'nonexistent.txt'),\n      tmpDir,\n    );\n    expect(deps).toEqual([]);\n  });\n\n  it('handles inline comments', async () => {\n    const manifestPath = writeRequirements(\n      'flask==2.3.0  # web framework\\nrequests>=2.28 # HTTP library\\n',\n    );\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps[0].declaredConstraint).toBe('==2.3.0');\n    expect(deps[1].declaredConstraint).toBe('>=2.28');\n  });\n\n  it('handles compound version constraints (e.g. >=1.0,<2.0)', async () => {\n    const manifestPath = writeRequirements('flask>=2.0,<3.0\\nrequests>=2.28,!=2.29.0\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps[0].name).toBe('flask');\n    expect(deps[0].declaredConstraint).toBe('>=2.0,<3.0');\n    expect(deps[0].resolvedVersion).toBeUndefined();\n\n    expect(deps[1].name).toBe('requests');\n    expect(deps[1].declaredConstraint).toBe('>=2.28,!=2.29.0');\n  });\n\n  it('handles != constraint', async () => {\n    const manifestPath = writeRequirements('flask!=2.2.0\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('!=2.2.0');\n    expect(deps[0].resolvedVersion).toBeUndefined();\n  });\n\n  it('handles < and > constraints', async () => {\n    const manifestPath = writeRequirements('flask>2.0\\ndjango<5.0\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps[0].declaredConstraint).toBe('>2.0');\n    expect(deps[1].declaredConstraint).toBe('<5.0');\n  });\n\n  it('handles <= constraint', async () => {\n    const manifestPath = writeRequirements('flask<=2.3.0\\n');\n\n    const deps = await parsePipManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('<=2.3.0');\n  });\n});\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAGA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,iBAAiC;AAAA,IAEjC,wBAAS,oBAAoB,MAAM;AACjC,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,qBAAqB,CAAC;AAAA,EACvE,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAED,WAAS,kBAAkB,SAAiB,WAAW,oBAA4B;AACjF,UAAM,WAAW,KAAK,KAAK,QAAQ,QAAQ;AAC3C,OAAG,cAAc,UAAU,OAAO;AAClC,WAAO;AAAA,EACT;AAEA,wBAAG,mEAAmE,YAAY;AAChF,UAAM,eAAe,kBAAkB,kCAAkC;AAEzE,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,UAAM,QAAQ,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO;AAC/C,8BAAO,KAAK,EAAE,YAAY;AAC1B,8BAAO,MAAO,kBAAkB,EAAE,KAAK,SAAS;AAChD,8BAAO,MAAO,eAAe,EAAE,KAAK,OAAO;AAC3C,8BAAO,MAAO,KAAK,EAAE,KAAK,YAAY;AACtC,8BAAO,MAAO,SAAS,EAAE,KAAK,MAAM;AAEpC,UAAM,WAAW,KAAK,KAAK,OAAK,EAAE,SAAS,UAAU;AACrD,8BAAO,QAAQ,EAAE,YAAY;AAC7B,8BAAO,SAAU,kBAAkB,EAAE,KAAK,UAAU;AACpD,8BAAO,SAAU,eAAe,EAAE,KAAK,QAAQ;AAAA,EACjD,CAAC;AAED,wBAAG,8DAA8D,YAAY;AAC3E,UAAM,eAAe,kBAAkB,kBAAkB;AAEzD,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,UAAU;AACpC,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,QAAQ;AAChD,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,cAAc;AAAA,EAChD,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,eAAe,kBAAkB,eAAe;AAEtD,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,QAAQ;AAClC,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,OAAO;AAC/C,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,cAAc;AAAA,EAChD,CAAC;AAED,wBAAG,gDAAgD,YAAY;AAC7D,UAAM,eAAe,kBAAkB,gBAAgB;AAEvD,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO;AACjC,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE;AAC1C,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,cAAc;AAC9C,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO;AAAA,EACnC,CAAC;AAED,wBAAG,uBAAuB,YAAY;AACpC,UAAM,eAAe;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,IAAI,OAAK,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,SAAS,UAAU,CAAC;AAAA,EAC7D,CAAC;AAED,wBAAG,qBAAqB,YAAY;AAClC,UAAM,eAAe,kBAAkB,sCAAsC;AAE7E,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAAA,EAC7B,CAAC;AAED,wBAAG,uEAAuE,YAAY;AACpF,UAAM,eAAe;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO;AAAA,EACnC,CAAC;AAED,wBAAG,8BAA8B,YAAY;AAC3C,UAAM,eAAe;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,UAAM,UAAU,KAAK,KAAK,OAAK,EAAE,SAAS,SAAS;AACnD,8BAAO,OAAO,EAAE,YAAY;AAC5B,8BAAO,QAAS,kBAAkB,EAAE,KAAK,OAAO;AAEhD,UAAM,WAAW,KAAK,KAAK,OAAK,EAAE,SAAS,UAAU;AACrD,8BAAO,QAAQ,EAAE,YAAY;AAC7B,8BAAO,SAAU,kBAAkB,EAAE,KAAK,OAAO;AAAA,EACnD,CAAC;AAED,wBAAG,2DAA2D,YAAY;AACxE,UAAM,eAAe,kBAAkB,oDAAoD;AAE3F,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,UAAM,WAAW,KAAK,KAAK,OAAK,EAAE,SAAS,UAAU;AACrD,8BAAO,QAAQ,EAAE,YAAY;AAC7B,8BAAO,SAAU,kBAAkB,EAAE,KAAK,UAAU;AAEpD,UAAM,SAAS,KAAK,KAAK,OAAK,EAAE,SAAS,QAAQ;AACjD,8BAAO,MAAM,EAAE,YAAY;AAC3B,8BAAO,OAAQ,kBAAkB,EAAE,KAAK,SAAS;AACjD,8BAAO,OAAQ,eAAe,EAAE,KAAK,OAAO;AAAA,EAC9C,CAAC;AAED,wBAAG,sCAAsC,YAAY;AACnD,UAAM,eAAe;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,IAAI,OAAK,EAAE,IAAI,CAAC,EAAE,QAAQ;AAAA,MACpC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAED,wBAAG,0CAA0C,YAAY;AACvD,UAAM,eAAe,kBAAkB,0CAA0C;AAEjF,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,MAAM,OAAK,EAAE,UAAU,YAAY,CAAC,EAAE,KAAK,IAAI;AAAA,EAC7D,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,eAAe,kBAAkB,6BAA6B;AAEpE,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,KAAK,MAAM,OAAK,EAAE,cAAc,MAAM,CAAC,EAAE,KAAK,IAAI;AAAA,EAC3D,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,SAAS,KAAK,KAAK,QAAQ,YAAY,KAAK;AAClD,OAAG,UAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;AACxC,UAAM,WAAW,KAAK,KAAK,QAAQ,kBAAkB;AACrD,OAAG,cAAc,UAAU,gBAAgB;AAE3C,UAAM,OAAO,UAAM,6BAAiB,UAAU,MAAM;AAEpD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,cAAc,EAAE,KAAK,+BAA+B;AAAA,EACrE,CAAC;AAED,wBAAG,6CAA6C,YAAY;AAC1D,UAAM,OAAO,UAAM;AAAA,MACjB,KAAK,KAAK,QAAQ,iBAAiB;AAAA,MACnC;AAAA,IACF;AACA,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,2BAA2B,YAAY;AACxC,UAAM,eAAe;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,SAAS;AACjD,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,QAAQ;AAAA,EAClD,CAAC;AAED,wBAAG,0DAA0D,YAAY;AACvE,UAAM,eAAe,kBAAkB,4CAA4C;AAEnF,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO;AACjC,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,YAAY;AACpD,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,cAAc;AAE9C,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,UAAU;AACpC,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,iBAAiB;AAAA,EAC3D,CAAC;AAED,wBAAG,yBAAyB,YAAY;AACtC,UAAM,eAAe,kBAAkB,gBAAgB;AAEvD,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,SAAS;AACjD,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,cAAc;AAAA,EAChD,CAAC;AAED,wBAAG,+BAA+B,YAAY;AAC5C,UAAM,eAAe,kBAAkB,yBAAyB;AAEhE,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,MAAM;AAC9C,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,MAAM;AAAA,EAChD,CAAC;AAED,wBAAG,yBAAyB,YAAY;AACtC,UAAM,eAAe,kBAAkB,gBAAgB;AAEvD,UAAM,OAAO,UAAM,6BAAiB,cAAc,MAAM;AAExD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,SAAS;AAAA,EACnD,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/security/manifest/plugins/pubspec.js

@@ -0,0 +1,212 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var pubspec_exports = {};
+__export(pubspec_exports, {
+  parsePubspecManifest: () => parsePubspecManifest
+});
+module.exports = __toCommonJS(pubspec_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+async function parsePubspecManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:pub] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const license = extractPubspecLicense(content);
+  const dependencies = [];
+  const sections = [
+    { key: "dependencies", scope: "production" },
+    { key: "dev_dependencies", scope: "development" }
+  ];
+  for (const { key, scope } of sections) {
+    const sectionDeps = extractSectionDependencies(content, key, relativeManifest);
+    for (const dep of sectionDeps) {
+      const resolvedVersion = resolvedVersions.get(dep.name);
+      dependencies.push({
+        name: dep.name,
+        declaredConstraint: dep.constraint,
+        resolvedVersion,
+        scope,
+        ecosystem: "pub",
+        sourceManifest: relativeManifest,
+        ...license !== void 0 ? { license } : {}
+      });
+    }
+  }
+  return dependencies;
+}
+function extractSectionDependencies(content, sectionKey, relativeManifest) {
+  const deps = [];
+  const lines = content.split("\n");
+  const headerPattern = new RegExp(`^${escapeRegex(sectionKey)}\\s*:\\s*$`);
+  let inSection = false;
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    const trimmed = line.trimEnd();
+    if (!inSection) {
+      if (headerPattern.test(trimmed)) {
+        inSection = true;
+      }
+      i++;
+      continue;
+    }
+    if (trimmed !== "" && !/^\s/.test(trimmed)) {
+      break;
+    }
+    if (trimmed === "") {
+      i++;
+      continue;
+    }
+    const entryMatch = trimmed.match(/^  ([a-zA-Z0-9_][a-zA-Z0-9_.-]*):\s*(.*)$/);
+    if (!entryMatch) {
+      i++;
+      continue;
+    }
+    const pkgName = entryMatch[1];
+    const valueOnSameLine = entryMatch[2].trim();
+    const nextLine = i + 1 < lines.length ? lines[i + 1] : "";
+    const isBlockMapping = nextLine !== "" && /^    \S/.test(nextLine);
+    if (isBlockMapping) {
+      i++;
+      while (i < lines.length) {
+        const subLine = lines[i];
+        if (subLine.trimEnd() === "" || /^    /.test(subLine)) {
+          i++;
+        } else {
+          break;
+        }
+      }
+      continue;
+    }
+    if (shouldSkipEntry(pkgName)) {
+      i++;
+      continue;
+    }
+    if (!isValidPackageName(pkgName)) {
+      (0, import_errors.logWarn)(`[sec:pub] Invalid package name "${pkgName}" in ${relativeManifest} \u2014 skipping`);
+      i++;
+      continue;
+    }
+    const constraint = parseConstraintValue(valueOnSameLine);
+    deps.push({ name: pkgName, constraint });
+    i++;
+  }
+  return deps;
+}
+function parseConstraintValue(value) {
+  if (!value || value === "" || value.toLowerCase() === "any") return "*";
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1).trim();
+  }
+  return value || "*";
+}
+function shouldSkipEntry(name) {
+  if (name === "sdk") return true;
+  if (name === "flutter") return true;
+  return false;
+}
+function isValidPackageName(name) {
+  if (!name || typeof name !== "string") return false;
+  if (name.length > 128) return false;
+  return /^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/.test(name);
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const lockPath = path.join(manifestDir, "pubspec.lock");
+  if (!fs.existsSync(lockPath)) {
+    return map;
+  }
+  try {
+    const lockContent = fs.readFileSync(lockPath, "utf8");
+    extractFromPubspecLock(lockContent, map);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:pub] Failed to parse pubspec.lock: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function extractFromPubspecLock(content, map) {
+  const lines = content.split("\n");
+  let inPackagesSection = false;
+  let currentPackage = null;
+  for (const line of lines) {
+    const trimmed = line.trimEnd();
+    if (trimmed === "packages:") {
+      inPackagesSection = true;
+      currentPackage = null;
+      continue;
+    }
+    if (inPackagesSection && trimmed !== "" && !/^\s/.test(trimmed)) {
+      inPackagesSection = false;
+      currentPackage = null;
+      continue;
+    }
+    if (!inPackagesSection) continue;
+    const pkgNameMatch = trimmed.match(/^  ([a-zA-Z0-9_][a-zA-Z0-9_.-]*):\s*$/);
+    if (pkgNameMatch) {
+      currentPackage = pkgNameMatch[1];
+      continue;
+    }
+    if (currentPackage) {
+      const versionMatch = trimmed.match(/^    version:\s*["']?([^"'\s]+)["']?\s*$/);
+      if (versionMatch) {
+        if (!map.has(currentPackage)) {
+          map.set(currentPackage, versionMatch[1]);
+        }
+        currentPackage = null;
+      }
+    }
+  }
+}
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function extractPubspecLicense(content) {
+  const match = content.match(/^license:\s*(.+)$/m);
+  if (match && match[1].trim() !== "") {
+    let value = match[1].trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1).trim();
+    }
+    return value || void 0;
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parsePubspecManifest
+});
+//# sourceMappingURL=pubspec.js.map

package/dist/security/manifest/plugins/pubspec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/pubspec.ts"],
+  "sourcesContent": ["/**\n * Dart/Flutter pub Version Extraction Plugin for KiroGraph-Sec\n *\n * Parses pubspec.yaml manifests to extract Dart package declarations with\n * version constraints, scopes, and resolved versions from pubspec.lock.\n *\n * Uses lightweight regex-based YAML parsing \u2014 no external YAML library required.\n *\n * Handles:\n * - `dependencies:` section \u2192 'production' scope\n * - `dev_dependencies:` section \u2192 'development' scope\n * - Version formats: `^1.0.0`, `\">=1.0.0 <2.0.0\"`, `any`\n * - Skips SDK entries (`sdk:`), `flutter:`, path deps, and git deps\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Resolved version map: package name \u2192 resolved version string.\n * Built from pubspec.lock.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * Parse a pubspec.yaml manifest and extract package declarations with\n * version constraints, scopes, and resolved versions from pubspec.lock.\n *\n * @param manifestPath - Absolute path to the pubspec.yaml file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parsePubspecManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read the pubspec.yaml content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:pub] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Attempt to load resolved versions from pubspec.lock\n  const resolvedVersions = loadResolvedVersions(manifestDir);\n\n  // Extract the license field if present\n  const license = extractPubspecLicense(content);\n\n  const dependencies: ParsedDependency[] = [];\n\n  // Process `dependencies` (production) and `dev_dependencies` (development)\n  const sections: Array<{ key: string; scope: ParsedDependency['scope'] }> = [\n    { key: 'dependencies', scope: 'production' },\n    { key: 'dev_dependencies', scope: 'development' },\n  ];\n\n  for (const { key, scope } of sections) {\n    const sectionDeps = extractSectionDependencies(content, key, relativeManifest);\n    for (const dep of sectionDeps) {\n      const resolvedVersion = resolvedVersions.get(dep.name);\n      dependencies.push({\n        name: dep.name,\n        declaredConstraint: dep.constraint,\n        resolvedVersion,\n        scope,\n        ecosystem: 'pub',\n        sourceManifest: relativeManifest,\n        ...(license !== undefined ? { license } : {}),\n      });\n    }\n  }\n\n  return dependencies;\n}\n\n/**\n * A raw dependency entry extracted from a pubspec.yaml section.\n */\ninterface RawDependency {\n  name: string;\n  constraint: string;\n}\n\n/**\n * Extract dependencies from a specific top-level section of a pubspec.yaml file.\n * Uses indentation-based parsing to determine section boundaries.\n *\n * Section entries take one of three forms:\n * - `  package_name: ^1.0.0`      (inline scalar version)\n * - `  package_name: \">=1.0.0 <2.0.0\"` (quoted version)\n * - `  package_name: any`         (any version)\n * - `  package_name:`             (block mapping \u2014 path/git/sdk dep)\n *   `    path: ../local`\n *\n * Entries with sub-keys (block mappings) are skipped as non-registry deps.\n */\nfunction extractSectionDependencies(\n  content: string,\n  sectionKey: string,\n  relativeManifest: string,\n): RawDependency[] {\n  const deps: RawDependency[] = [];\n  const lines = content.split('\\n');\n\n  // Find the section header line (at column 0, no indent)\n  const headerPattern = new RegExp(`^${escapeRegex(sectionKey)}\\\\s*:\\\\s*$`);\n  let inSection = false;\n  let i = 0;\n\n  while (i < lines.length) {\n    const line = lines[i];\n    const trimmed = line.trimEnd();\n\n    // Detect section header\n    if (!inSection) {\n      if (headerPattern.test(trimmed)) {\n        inSection = true;\n      }\n      i++;\n      continue;\n    }\n\n    // Exit section when we encounter another top-level key (no leading whitespace)\n    if (trimmed !== '' && !/^\\s/.test(trimmed)) {\n      break;\n    }\n\n    // Skip blank lines inside section\n    if (trimmed === '') {\n      i++;\n      continue;\n    }\n\n    // Match a 2-space-indented package entry: `  package_name: ...`\n    const entryMatch = trimmed.match(/^  ([a-zA-Z0-9_][a-zA-Z0-9_.-]*):\\s*(.*)$/);\n    if (!entryMatch) {\n      i++;\n      continue;\n    }\n\n    const pkgName = entryMatch[1];\n    const valueOnSameLine = entryMatch[2].trim();\n\n    // Check if the next line has deeper indentation (block mapping \u2192 skip)\n    const nextLine = i + 1 < lines.length ? lines[i + 1] : '';\n    const isBlockMapping = nextLine !== '' && /^    \\S/.test(nextLine);\n\n    if (isBlockMapping) {\n      // Skip \u2014 path/git/sdk dependency; advance past the block\n      i++;\n      while (i < lines.length) {\n        const subLine = lines[i];\n        if (subLine.trimEnd() === '' || /^    /.test(subLine)) {\n          i++;\n        } else {\n          break;\n        }\n      }\n      continue;\n    }\n\n    // Skip SDK and flutter pseudo-packages\n    if (shouldSkipEntry(pkgName)) {\n      i++;\n      continue;\n    }\n\n    if (!isValidPackageName(pkgName)) {\n      logWarn(`[sec:pub] Invalid package name \"${pkgName}\" in ${relativeManifest} \u2014 skipping`);\n      i++;\n      continue;\n    }\n\n    const constraint = parseConstraintValue(valueOnSameLine);\n    deps.push({ name: pkgName, constraint });\n    i++;\n  }\n\n  return deps;\n}\n\n/**\n * Parse a pubspec.yaml dependency version value string.\n *\n * Handles:\n * - `^1.0.0` \u2192 `^1.0.0`\n * - `\">=1.0.0 <2.0.0\"` \u2192 `>=1.0.0 <2.0.0` (quotes stripped)\n * - `'>=1.0.0 <2.0.0'` \u2192 `>=1.0.0 <2.0.0`\n * - `any` \u2192 `*`\n * - empty \u2192 `*`\n */\nfunction parseConstraintValue(value: string): string {\n  if (!value || value === '' || value.toLowerCase() === 'any') return '*';\n\n  // Strip surrounding quotes\n  if ((value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n    value = value.slice(1, -1).trim();\n  }\n\n  return value || '*';\n}\n\n/**\n * Determine whether a pubspec.yaml dependency key should be skipped.\n */\nfunction shouldSkipEntry(name: string): boolean {\n  if (name === 'sdk') return true;\n  if (name === 'flutter') return true;\n  return false;\n}\n\n/**\n * Validate that a pub package name follows Dart naming conventions.\n * Package names must be lowercase, with underscores, not hyphens.\n */\nfunction isValidPackageName(name: string): boolean {\n  if (!name || typeof name !== 'string') return false;\n  if (name.length > 128) return false;\n  return /^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/.test(name);\n}\n\n/**\n * Attempt to load resolved versions from pubspec.lock in the given directory.\n * Returns an empty map if pubspec.lock is not available.\n *\n * pubspec.lock YAML format:\n * ```yaml\n * packages:\n *   http:\n *     dependency: \"direct main\"\n *     description:\n *       name: http\n *       url: \"https://pub.dartlang.org\"\n *     version: \"0.13.5\"\n *   test:\n *     dependency: \"direct dev\"\n *     version: \"1.21.4\"\n * ```\n */\nfunction loadResolvedVersions(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  const lockPath = path.join(manifestDir, 'pubspec.lock');\n  if (!fs.existsSync(lockPath)) {\n    return map;\n  }\n\n  try {\n    const lockContent = fs.readFileSync(lockPath, 'utf8');\n    extractFromPubspecLock(lockContent, map);\n  } catch (err) {\n    logWarn(`[sec:pub] Failed to parse pubspec.lock: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from pubspec.lock content.\n *\n * The lock file is a YAML document. We use regex-based parsing to avoid\n * introducing a YAML library dependency. For each package block under\n * `packages:`, we find its `version:` entry.\n */\nfunction extractFromPubspecLock(content: string, map: ResolvedVersionMap): void {\n  const lines = content.split('\\n');\n  let inPackagesSection = false;\n  let currentPackage: string | null = null;\n\n  for (const line of lines) {\n    const trimmed = line.trimEnd();\n\n    // Detect top-level `packages:` section\n    if (trimmed === 'packages:') {\n      inPackagesSection = true;\n      currentPackage = null;\n      continue;\n    }\n\n    // Exit packages section if we hit another top-level key\n    if (inPackagesSection && trimmed !== '' && !/^\\s/.test(trimmed)) {\n      inPackagesSection = false;\n      currentPackage = null;\n      continue;\n    }\n\n    if (!inPackagesSection) continue;\n\n    // Package name entry: `  package_name:` (2-space indent)\n    const pkgNameMatch = trimmed.match(/^  ([a-zA-Z0-9_][a-zA-Z0-9_.-]*):\\s*$/);\n    if (pkgNameMatch) {\n      currentPackage = pkgNameMatch[1];\n      continue;\n    }\n\n    // Version entry: `    version: \"1.2.3\"` (4-space indent)\n    if (currentPackage) {\n      const versionMatch = trimmed.match(/^    version:\\s*[\"']?([^\"'\\s]+)[\"']?\\s*$/);\n      if (versionMatch) {\n        if (!map.has(currentPackage)) {\n          map.set(currentPackage, versionMatch[1]);\n        }\n        currentPackage = null;\n      }\n    }\n  }\n}\n\n/**\n * Escape special regex characters in a string.\n */\nfunction escapeRegex(str: string): string {\n  return str.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\n/**\n * Extract the `license:` field from pubspec.yaml content.\n * Handles: `license: MIT` (top-level scalar field)\n */\nfunction extractPubspecLicense(content: string): string | undefined {\n  const match = content.match(/^license:\\s*(.+)$/m);\n  if (match && match[1].trim() !== '') {\n    // Strip surrounding quotes if present\n    let value = match[1].trim();\n    if ((value.startsWith('\"') && value.endsWith('\"')) ||\n        (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n      value = value.slice(1, -1).trim();\n    }\n    return value || undefined;\n  }\n  return undefined;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAgBxB,eAAsB,qBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,4BAA4B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC3G,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,mBAAmB,qBAAqB,WAAW;AAGzD,QAAM,UAAU,sBAAsB,OAAO;AAE7C,QAAM,eAAmC,CAAC;AAG1C,QAAM,WAAqE;AAAA,IACzE,EAAE,KAAK,gBAAgB,OAAO,aAAa;AAAA,IAC3C,EAAE,KAAK,oBAAoB,OAAO,cAAc;AAAA,EAClD;AAEA,aAAW,EAAE,KAAK,MAAM,KAAK,UAAU;AACrC,UAAM,cAAc,2BAA2B,SAAS,KAAK,gBAAgB;AAC7E,eAAW,OAAO,aAAa;AAC7B,YAAM,kBAAkB,iBAAiB,IAAI,IAAI,IAAI;AACrD,mBAAa,KAAK;AAAA,QAChB,MAAM,IAAI;AAAA,QACV,oBAAoB,IAAI;AAAA,QACxB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAuBA,SAAS,2BACP,SACA,YACA,kBACiB;AACjB,QAAM,OAAwB,CAAC;AAC/B,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAGhC,QAAM,gBAAgB,IAAI,OAAO,IAAI,YAAY,UAAU,CAAC,YAAY;AACxE,MAAI,YAAY;AAChB,MAAI,IAAI;AAER,SAAO,IAAI,MAAM,QAAQ;AACvB,UAAM,OAAO,MAAM,CAAC;AACpB,UAAM,UAAU,KAAK,QAAQ;AAG7B,QAAI,CAAC,WAAW;AACd,UAAI,cAAc,KAAK,OAAO,GAAG;AAC/B,oBAAY;AAAA,MACd;AACA;AACA;AAAA,IACF;AAGA,QAAI,YAAY,MAAM,CAAC,MAAM,KAAK,OAAO,GAAG;AAC1C;AAAA,IACF;AAGA,QAAI,YAAY,IAAI;AAClB;AACA;AAAA,IACF;AAGA,UAAM,aAAa,QAAQ,MAAM,2CAA2C;AAC5E,QAAI,CAAC,YAAY;AACf;AACA;AAAA,IACF;AAEA,UAAM,UAAU,WAAW,CAAC;AAC5B,UAAM,kBAAkB,WAAW,CAAC,EAAE,KAAK;AAG3C,UAAM,WAAW,IAAI,IAAI,MAAM,SAAS,MAAM,IAAI,CAAC,IAAI;AACvD,UAAM,iBAAiB,aAAa,MAAM,UAAU,KAAK,QAAQ;AAEjE,QAAI,gBAAgB;AAElB;AACA,aAAO,IAAI,MAAM,QAAQ;AACvB,cAAM,UAAU,MAAM,CAAC;AACvB,YAAI,QAAQ,QAAQ,MAAM,MAAM,QAAQ,KAAK,OAAO,GAAG;AACrD;AAAA,QACF,OAAO;AACL;AAAA,QACF;AAAA,MACF;AACA;AAAA,IACF;AAGA,QAAI,gBAAgB,OAAO,GAAG;AAC5B;AACA;AAAA,IACF;AAEA,QAAI,CAAC,mBAAmB,OAAO,GAAG;AAChC,iCAAQ,mCAAmC,OAAO,QAAQ,gBAAgB,kBAAa;AACvF;AACA;AAAA,IACF;AAEA,UAAM,aAAa,qBAAqB,eAAe;AACvD,SAAK,KAAK,EAAE,MAAM,SAAS,WAAW,CAAC;AACvC;AAAA,EACF;AAEA,SAAO;AACT;AAYA,SAAS,qBAAqB,OAAuB;AACnD,MAAI,CAAC,SAAS,UAAU,MAAM,MAAM,YAAY,MAAM,MAAO,QAAO;AAGpE,MAAK,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAC3C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAAI;AAClD,YAAQ,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK;AAAA,EAClC;AAEA,SAAO,SAAS;AAClB;AAKA,SAAS,gBAAgB,MAAuB;AAC9C,MAAI,SAAS,MAAO,QAAO;AAC3B,MAAI,SAAS,UAAW,QAAO;AAC/B,SAAO;AACT;AAMA,SAAS,mBAAmB,MAAuB;AACjD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,MAAI,KAAK,SAAS,IAAK,QAAO;AAC9B,SAAO,gCAAgC,KAAK,IAAI;AAClD;AAoBA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,MAA0B,oBAAI,IAAI;AAExC,QAAM,WAAW,KAAK,KAAK,aAAa,cAAc;AACtD,MAAI,CAAC,GAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,cAAc,GAAG,aAAa,UAAU,MAAM;AACpD,2BAAuB,aAAa,GAAG;AAAA,EACzC,SAAS,KAAK;AACZ,+BAAQ,2CAA2C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EACvG;AAEA,SAAO;AACT;AASA,SAAS,uBAAuB,SAAiB,KAA+B;AAC9E,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,MAAI,oBAAoB;AACxB,MAAI,iBAAgC;AAEpC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,QAAQ;AAG7B,QAAI,YAAY,aAAa;AAC3B,0BAAoB;AACpB,uBAAiB;AACjB;AAAA,IACF;AAGA,QAAI,qBAAqB,YAAY,MAAM,CAAC,MAAM,KAAK,OAAO,GAAG;AAC/D,0BAAoB;AACpB,uBAAiB;AACjB;AAAA,IACF;AAEA,QAAI,CAAC,kBAAmB;AAGxB,UAAM,eAAe,QAAQ,MAAM,uCAAuC;AAC1E,QAAI,cAAc;AAChB,uBAAiB,aAAa,CAAC;AAC/B;AAAA,IACF;AAGA,QAAI,gBAAgB;AAClB,YAAM,eAAe,QAAQ,MAAM,0CAA0C;AAC7E,UAAI,cAAc;AAChB,YAAI,CAAC,IAAI,IAAI,cAAc,GAAG;AAC5B,cAAI,IAAI,gBAAgB,aAAa,CAAC,CAAC;AAAA,QACzC;AACA,yBAAiB;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACF;AAKA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uBAAuB,MAAM;AAClD;AAMA,SAAS,sBAAsB,SAAqC;AAClE,QAAM,QAAQ,QAAQ,MAAM,oBAAoB;AAChD,MAAI,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM,IAAI;AAEnC,QAAI,QAAQ,MAAM,CAAC,EAAE,KAAK;AAC1B,QAAK,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAC3C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAAI;AAClD,cAAQ,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK;AAAA,IAClC;AACA,WAAO,SAAS;AAAA,EAClB;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/security/manifest/plugins/pyproject.js

@@ -0,0 +1,261 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var pyproject_exports = {};
+__export(pyproject_exports, {
+  parsePyprojectManifest: () => parsePyprojectManifest
+});
+module.exports = __toCommonJS(pyproject_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+async function parsePyprojectManifest(manifestPath, projectRoot) {
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:pyproject] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const manifestDir = path.dirname(manifestPath);
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const license = extractPyprojectLicense(content);
+  const dependencies = [];
+  const pep621Deps = extractPep621Dependencies(content, relativeManifest);
+  for (const dep of pep621Deps) {
+    dependencies.push({
+      name: dep.name,
+      declaredConstraint: dep.constraint,
+      resolvedVersion: resolvedVersions.get(dep.name.toLowerCase()),
+      scope: dep.scope,
+      ecosystem: "pypi",
+      sourceManifest: relativeManifest,
+      ...license !== void 0 ? { license } : {}
+    });
+  }
+  if (dependencies.length === 0 || hasPoetrySection(content)) {
+    const poetryDeps = extractPoetryDependencies(content, relativeManifest);
+    for (const dep of poetryDeps) {
+      if (!dependencies.find((d) => d.name === dep.name)) {
+        dependencies.push({
+          name: dep.name,
+          declaredConstraint: dep.constraint,
+          resolvedVersion: resolvedVersions.get(dep.name.toLowerCase()),
+          scope: dep.scope,
+          ecosystem: "pypi",
+          sourceManifest: relativeManifest,
+          ...license !== void 0 ? { license } : {}
+        });
+      }
+    }
+  }
+  const pdmDeps = extractPdmDependencies(content, relativeManifest);
+  for (const dep of pdmDeps) {
+    if (!dependencies.find((d) => d.name === dep.name)) {
+      dependencies.push({
+        name: dep.name,
+        declaredConstraint: dep.constraint,
+        resolvedVersion: resolvedVersions.get(dep.name.toLowerCase()),
+        scope: dep.scope,
+        ecosystem: "pypi",
+        sourceManifest: relativeManifest,
+        ...license !== void 0 ? { license } : {}
+      });
+    }
+  }
+  return dependencies;
+}
+function extractPep621Dependencies(content, relativeManifest) {
+  const deps = [];
+  const depsBlock = extractTomlArray(content, /^\[project\]/m, "dependencies");
+  for (const spec of depsBlock) {
+    const dep = parsePep508Spec(spec, relativeManifest);
+    if (dep) deps.push({ ...dep, scope: "production" });
+  }
+  const optSection = extractSection(content, /^\[project\.optional-dependencies\]/m);
+  if (optSection) {
+    for (const m of optSection.matchAll(/^\s*([a-zA-Z0-9_-]+)\s*=\s*\[([^\]]*)\]/gm)) {
+      const groupName = m[1].toLowerCase();
+      const isDevGroup = /^(dev|test|lint|docs|ci|build|check|debug)/.test(groupName);
+      const items = parseTomlStringArray(m[2]);
+      for (const spec of items) {
+        const dep = parsePep508Spec(spec, relativeManifest);
+        if (dep) deps.push({ ...dep, scope: isDevGroup ? "development" : "optional" });
+      }
+    }
+  }
+  return deps;
+}
+function hasPoetrySection(content) {
+  return /^\[tool\.poetry/m.test(content);
+}
+function extractPoetryDependencies(content, relativeManifest) {
+  const deps = [];
+  const sections = [
+    { pattern: /^\[tool\.poetry\.dependencies\]/m, scope: "production" },
+    { pattern: /^\[tool\.poetry\.dev-dependencies\]/m, scope: "development" }
+  ];
+  for (const m of content.matchAll(/^\[tool\.poetry\.group\.([a-zA-Z0-9_-]+)\.dependencies\]/gm)) {
+    const groupName = m[1].toLowerCase();
+    const scope = /^(dev|test|lint|docs|ci)/.test(groupName) ? "development" : "optional";
+    sections.push({ pattern: new RegExp(`^\\[tool\\.poetry\\.group\\.${m[1]}\\.dependencies\\]`, "m"), scope });
+  }
+  for (const { pattern, scope } of sections) {
+    const section = extractSection(content, pattern);
+    if (!section) continue;
+    for (const line of section.split("\n")) {
+      const trimmed = line.trim();
+      if (trimmed === "" || trimmed.startsWith("#") || trimmed.startsWith("[")) break;
+      const simpleMatch = trimmed.match(/^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)\s*=\s*"([^"]+)"/);
+      if (simpleMatch) {
+        const name = simpleMatch[1];
+        if (name === "python") continue;
+        deps.push({ name: normalizePypiName(name), constraint: simpleMatch[3], scope });
+        continue;
+      }
+      const tableMatch = trimmed.match(/^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)\s*=\s*\{/);
+      if (tableMatch) {
+        const name = tableMatch[1];
+        if (name === "python") continue;
+        const versionMatch = trimmed.match(/version\s*=\s*"([^"]+)"/);
+        if (versionMatch) {
+          deps.push({ name: normalizePypiName(name), constraint: versionMatch[1], scope });
+        } else {
+          deps.push({ name: normalizePypiName(name), constraint: "*", scope });
+        }
+      }
+    }
+  }
+  return deps;
+}
+function extractPdmDependencies(content, relativeManifest) {
+  const deps = [];
+  const section = extractSection(content, /^\[tool\.pdm\.dev-dependencies\]/m);
+  if (section) {
+    for (const m of section.matchAll(/^\s*([a-zA-Z0-9_-]+)\s*=\s*\[([^\]]*)\]/gm)) {
+      const items = parseTomlStringArray(m[2]);
+      for (const spec of items) {
+        const dep = parsePep508Spec(spec, relativeManifest);
+        if (dep) deps.push({ ...dep, scope: "development" });
+      }
+    }
+  }
+  return deps;
+}
+function parsePep508Spec(spec, _relativeManifest) {
+  const withoutMarker = spec.split(";")[0].trim();
+  const withoutExtras = withoutMarker.replace(/\[[^\]]*\]/, "").trim();
+  const match = withoutExtras.match(/^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)\s*(.*)/);
+  if (!match) return null;
+  const name = normalizePypiName(match[1]);
+  const constraint = match[3].trim() || "*";
+  return { name, constraint };
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const candidates = ["poetry.lock", "pdm.lock", "uv.lock"];
+  for (const lockFile of candidates) {
+    const lockPath = path.join(manifestDir, lockFile);
+    if (!fs.existsSync(lockPath)) continue;
+    try {
+      const content = fs.readFileSync(lockPath, "utf8");
+      if (lockFile === "poetry.lock") extractFromPoetryLock(content, map);
+      else extractFromPdmUvLock(content, map);
+      break;
+    } catch (err) {
+      (0, import_errors.logWarn)(`[sec:pyproject] Failed to parse ${lockFile}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return map;
+}
+function extractFromPoetryLock(content, map) {
+  for (const m of content.matchAll(/\[\[package\]\][^[]*?name\s*=\s*"([^"]+)"[^[]*?version\s*=\s*"([^"]+)"/gs)) {
+    map.set(m[1].toLowerCase(), m[2]);
+  }
+}
+function extractFromPdmUvLock(content, map) {
+  for (const m of content.matchAll(/\[\[(?:package|distribution)\]\][^[]*?name\s*=\s*"([^"]+)"[^[]*?version\s*=\s*"([^"]+)"/gs)) {
+    map.set(m[1].toLowerCase(), m[2]);
+  }
+}
+function extractSection(content, headerPattern) {
+  const match = headerPattern.exec(content);
+  if (!match) return null;
+  const start = match.index + match[0].length;
+  const remaining = content.slice(start);
+  const nextSection = remaining.match(/^\[/m);
+  return nextSection ? remaining.slice(0, nextSection.index) : remaining;
+}
+function extractTomlArray(content, sectionPattern, key) {
+  const section = extractSection(content, sectionPattern);
+  if (!section) return [];
+  const keyPattern = new RegExp(`^${key}\\s*=\\s*\\[([^\\]]*(?:\\][^\\[\\]]*\\[)*[^\\]]*)\\]`, "ms");
+  const m = keyPattern.exec(section);
+  if (!m) return [];
+  return parseTomlStringArray(m[1]);
+}
+function parseTomlStringArray(body) {
+  const results = [];
+  for (const m of body.matchAll(/"([^"]+)"/g)) {
+    results.push(m[1].trim());
+  }
+  for (const m of body.matchAll(/'([^']+)'/g)) {
+    results.push(m[1].trim());
+  }
+  return results.filter(Boolean);
+}
+function normalizePypiName(name) {
+  return name.toLowerCase().replace(/[-_.]+/g, "-");
+}
+function extractPyprojectLicense(content) {
+  const pep621Section = extractSection(content, /^\[project\]/m);
+  if (pep621Section) {
+    const tableTextMatch = pep621Section.match(/^license\s*=\s*\{[^}]*text\s*=\s*["']([^"']+)["'][^}]*\}/m);
+    if (tableTextMatch && tableTextMatch[1].trim() !== "") {
+      return tableTextMatch[1].trim();
+    }
+    const stringMatch = pep621Section.match(/^license\s*=\s*["']([^"']+)["']/m);
+    if (stringMatch && stringMatch[1].trim() !== "") {
+      return stringMatch[1].trim();
+    }
+  }
+  const poetrySection = extractSection(content, /^\[tool\.poetry\]/m);
+  if (poetrySection) {
+    const poetryLicenseMatch = poetrySection.match(/^license\s*=\s*["']([^"']+)["']/m);
+    if (poetryLicenseMatch && poetryLicenseMatch[1].trim() !== "") {
+      return poetryLicenseMatch[1].trim();
+    }
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parsePyprojectManifest
+});
+//# sourceMappingURL=pyproject.js.map

package/dist/security/manifest/plugins/pyproject.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/pyproject.ts"],
+  "sourcesContent": ["/**\n * pyproject.toml Version Extraction Plugin for KiroGraph-Sec\n *\n * Handles modern Python packaging: PEP 621 (standard), Poetry, Hatch, PDM, Flit.\n * pyproject.toml is the canonical manifest for virtually all Python projects\n * created after 2021 \u2014 requirements.txt is only used for pinned deployment deps.\n *\n * Supports:\n *   - PEP 621 [project] dependencies = [\"package>=1.0\"]\n *   - Poetry [tool.poetry.dependencies] { package = \"^1.0\" }\n *   - PDM [tool.pdm.dev-dependencies] { dev = [\"package>=1.0\"] }\n *   - Hatch [tool.hatch.envs.default.dependencies] = [\"package>=1.0\"]\n * Lock files: poetry.lock, pdm.lock, uv.lock (all share the same version extraction)\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\ntype ResolvedVersionMap = Map<string, string>;\n\n// \u2500\u2500 Entry point \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport async function parsePyprojectManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:pyproject] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  const manifestDir = path.dirname(manifestPath);\n  const resolvedVersions = loadResolvedVersions(manifestDir);\n  const license = extractPyprojectLicense(content);\n  const dependencies: ParsedDependency[] = [];\n\n  // \u2500\u2500 PEP 621 [project] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const pep621Deps = extractPep621Dependencies(content, relativeManifest);\n  for (const dep of pep621Deps) {\n    dependencies.push({\n      name: dep.name,\n      declaredConstraint: dep.constraint,\n      resolvedVersion: resolvedVersions.get(dep.name.toLowerCase()),\n      scope: dep.scope,\n      ecosystem: 'pypi',\n      sourceManifest: relativeManifest,\n      ...(license !== undefined ? { license } : {}),\n    });\n  }\n\n  // \u2500\u2500 Poetry [tool.poetry.dependencies] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  if (dependencies.length === 0 || hasPoetrySection(content)) {\n    const poetryDeps = extractPoetryDependencies(content, relativeManifest);\n    for (const dep of poetryDeps) {\n      if (!dependencies.find(d => d.name === dep.name)) {\n        dependencies.push({\n          name: dep.name,\n          declaredConstraint: dep.constraint,\n          resolvedVersion: resolvedVersions.get(dep.name.toLowerCase()),\n          scope: dep.scope,\n          ecosystem: 'pypi',\n          sourceManifest: relativeManifest,\n          ...(license !== undefined ? { license } : {}),\n        });\n      }\n    }\n  }\n\n  // \u2500\u2500 PDM [tool.pdm.dev-dependencies] \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const pdmDeps = extractPdmDependencies(content, relativeManifest);\n  for (const dep of pdmDeps) {\n    if (!dependencies.find(d => d.name === dep.name)) {\n      dependencies.push({\n        name: dep.name,\n        declaredConstraint: dep.constraint,\n        resolvedVersion: resolvedVersions.get(dep.name.toLowerCase()),\n        scope: dep.scope,\n        ecosystem: 'pypi',\n        sourceManifest: relativeManifest,\n        ...(license !== undefined ? { license } : {}),\n      });\n    }\n  }\n\n  return dependencies;\n}\n\n// \u2500\u2500 PEP 621 extraction \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface RawDep { name: string; constraint: string; scope: ParsedDependency['scope'] }\n\nfunction extractPep621Dependencies(content: string, relativeManifest: string): RawDep[] {\n  const deps: RawDep[] = [];\n\n  // [project] dependencies = [\"package>=1.0\", ...]\n  const depsBlock = extractTomlArray(content, /^\\[project\\]/m, 'dependencies');\n  for (const spec of depsBlock) {\n    const dep = parsePep508Spec(spec, relativeManifest);\n    if (dep) deps.push({ ...dep, scope: 'production' });\n  }\n\n  // [project.optional-dependencies] group = [\"package>=1.0\", ...]\n  const optSection = extractSection(content, /^\\[project\\.optional-dependencies\\]/m);\n  if (optSection) {\n    for (const m of optSection.matchAll(/^\\s*([a-zA-Z0-9_-]+)\\s*=\\s*\\[([^\\]]*)\\]/gm)) {\n      const groupName = m[1].toLowerCase();\n      const isDevGroup = /^(dev|test|lint|docs|ci|build|check|debug)/.test(groupName);\n      const items = parseTomlStringArray(m[2]);\n      for (const spec of items) {\n        const dep = parsePep508Spec(spec, relativeManifest);\n        if (dep) deps.push({ ...dep, scope: isDevGroup ? 'development' : 'optional' });\n      }\n    }\n  }\n\n  return deps;\n}\n\n// \u2500\u2500 Poetry extraction \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction hasPoetrySection(content: string): boolean {\n  return /^\\[tool\\.poetry/m.test(content);\n}\n\nfunction extractPoetryDependencies(content: string, relativeManifest: string): RawDep[] {\n  const deps: RawDep[] = [];\n\n  const sections: Array<{ pattern: RegExp; scope: ParsedDependency['scope'] }> = [\n    { pattern: /^\\[tool\\.poetry\\.dependencies\\]/m, scope: 'production' },\n    { pattern: /^\\[tool\\.poetry\\.dev-dependencies\\]/m, scope: 'development' },\n  ];\n\n  // Also handle [tool.poetry.group.*.dependencies]\n  for (const m of content.matchAll(/^\\[tool\\.poetry\\.group\\.([a-zA-Z0-9_-]+)\\.dependencies\\]/gm)) {\n    const groupName = m[1].toLowerCase();\n    const scope: ParsedDependency['scope'] = /^(dev|test|lint|docs|ci)/.test(groupName) ? 'development' : 'optional';\n    sections.push({ pattern: new RegExp(`^\\\\[tool\\\\.poetry\\\\.group\\\\.${m[1]}\\\\.dependencies\\\\]`, 'm'), scope });\n  }\n\n  for (const { pattern, scope } of sections) {\n    const section = extractSection(content, pattern);\n    if (!section) continue;\n\n    for (const line of section.split('\\n')) {\n      const trimmed = line.trim();\n      if (trimmed === '' || trimmed.startsWith('#') || trimmed.startsWith('[')) break;\n\n      // name = \"^1.0\" or name = { version = \"^1.0\", ... }\n      const simpleMatch = trimmed.match(/^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)\\s*=\\s*\"([^\"]+)\"/);\n      if (simpleMatch) {\n        const name = simpleMatch[1];\n        if (name === 'python') continue; // skip python version constraint\n        deps.push({ name: normalizePypiName(name), constraint: simpleMatch[3], scope });\n        continue;\n      }\n\n      // name = { version = \"^1.0\", ... }\n      const tableMatch = trimmed.match(/^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)\\s*=\\s*\\{/);\n      if (tableMatch) {\n        const name = tableMatch[1];\n        if (name === 'python') continue;\n        const versionMatch = trimmed.match(/version\\s*=\\s*\"([^\"]+)\"/);\n        if (versionMatch) {\n          deps.push({ name: normalizePypiName(name), constraint: versionMatch[1], scope });\n        } else {\n          // path/git dep without version \u2014 record with wildcard\n          deps.push({ name: normalizePypiName(name), constraint: '*', scope });\n        }\n      }\n    }\n  }\n\n  return deps;\n}\n\n// \u2500\u2500 PDM extraction \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction extractPdmDependencies(content: string, relativeManifest: string): RawDep[] {\n  const deps: RawDep[] = [];\n\n  // [tool.pdm.dev-dependencies] groups with arrays\n  const section = extractSection(content, /^\\[tool\\.pdm\\.dev-dependencies\\]/m);\n  if (section) {\n    for (const m of section.matchAll(/^\\s*([a-zA-Z0-9_-]+)\\s*=\\s*\\[([^\\]]*)\\]/gm)) {\n      const items = parseTomlStringArray(m[2]);\n      for (const spec of items) {\n        const dep = parsePep508Spec(spec, relativeManifest);\n        if (dep) deps.push({ ...dep, scope: 'development' });\n      }\n    }\n  }\n\n  return deps;\n}\n\n// \u2500\u2500 PEP 508 spec parser \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction parsePep508Spec(spec: string, _relativeManifest: string): { name: string; constraint: string } | null {\n  // PEP 508: name [extras] [version_spec] [; marker]\n  // Strip markers (semicolon and beyond), extras ([...])\n  const withoutMarker = spec.split(';')[0].trim();\n  const withoutExtras = withoutMarker.replace(/\\[[^\\]]*\\]/, '').trim();\n\n  const match = withoutExtras.match(/^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)\\s*(.*)/);\n  if (!match) return null;\n\n  const name = normalizePypiName(match[1]);\n  const constraint = match[3].trim() || '*';\n  return { name, constraint };\n}\n\n// \u2500\u2500 Lock file loading \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction loadResolvedVersions(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  // Try poetry.lock, pdm.lock, uv.lock in order\n  const candidates = ['poetry.lock', 'pdm.lock', 'uv.lock'];\n  for (const lockFile of candidates) {\n    const lockPath = path.join(manifestDir, lockFile);\n    if (!fs.existsSync(lockPath)) continue;\n    try {\n      const content = fs.readFileSync(lockPath, 'utf8');\n      if (lockFile === 'poetry.lock') extractFromPoetryLock(content, map);\n      else extractFromPdmUvLock(content, map);\n      break; // only use the first lock file found\n    } catch (err) {\n      logWarn(`[sec:pyproject] Failed to parse ${lockFile}: ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  return map;\n}\n\nfunction extractFromPoetryLock(content: string, map: ResolvedVersionMap): void {\n  // [[package]] blocks with name and version fields\n  for (const m of content.matchAll(/\\[\\[package\\]\\][^[]*?name\\s*=\\s*\"([^\"]+)\"[^[]*?version\\s*=\\s*\"([^\"]+)\"/gs)) {\n    map.set(m[1].toLowerCase(), m[2]);\n  }\n}\n\nfunction extractFromPdmUvLock(content: string, map: ResolvedVersionMap): void {\n  // [[package]] or [[distribution]] blocks (pdm/uv use slightly different headers)\n  for (const m of content.matchAll(/\\[\\[(?:package|distribution)\\]\\][^[]*?name\\s*=\\s*\"([^\"]+)\"[^[]*?version\\s*=\\s*\"([^\"]+)\"/gs)) {\n    map.set(m[1].toLowerCase(), m[2]);\n  }\n}\n\n// \u2500\u2500 TOML helpers (no library dependency) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** Extract the content after a section header until the next header. */\nfunction extractSection(content: string, headerPattern: RegExp): string | null {\n  const match = headerPattern.exec(content);\n  if (!match) return null;\n  const start = match.index + match[0].length;\n  const remaining = content.slice(start);\n  const nextSection = remaining.match(/^\\[/m);\n  return nextSection ? remaining.slice(0, nextSection.index) : remaining;\n}\n\n/** Extract a TOML array value by key from a section. */\nfunction extractTomlArray(content: string, sectionPattern: RegExp, key: string): string[] {\n  const section = extractSection(content, sectionPattern);\n  if (!section) return [];\n\n  // Match key = [\"...\", \"...\", ...] \u2014 may span multiple lines\n  const keyPattern = new RegExp(`^${key}\\\\s*=\\\\s*\\\\[([^\\\\]]*(?:\\\\][^\\\\[\\\\]]*\\\\[)*[^\\\\]]*)\\\\]`, 'ms');\n  const m = keyPattern.exec(section);\n  if (!m) return [];\n  return parseTomlStringArray(m[1]);\n}\n\n/** Parse a TOML string array body (contents inside [...]) into individual strings. */\nfunction parseTomlStringArray(body: string): string[] {\n  const results: string[] = [];\n  for (const m of body.matchAll(/\"([^\"]+)\"/g)) {\n    results.push(m[1].trim());\n  }\n  for (const m of body.matchAll(/'([^']+)'/g)) {\n    results.push(m[1].trim());\n  }\n  return results.filter(Boolean);\n}\n\n/** Normalize PyPI package name: lowercase, replace - and _ with - (canonical form). */\nfunction normalizePypiName(name: string): string {\n  return name.toLowerCase().replace(/[-_.]+/g, '-');\n}\n\n/**\n * Extract the license from a pyproject.toml file.\n *\n * Handles:\n *   - PEP 621 [project] license = {text = \"MIT\"} or license = \"MIT\"\n *   - Poetry [tool.poetry] license = \"MIT\"\n */\nfunction extractPyprojectLicense(content: string): string | undefined {\n  // PEP 621: license = {text = \"MIT\"} or license = {file = \"LICENSE\"}\n  const pep621Section = extractSection(content, /^\\[project\\]/m);\n  if (pep621Section) {\n    // license = {text = \"MIT\"}\n    const tableTextMatch = pep621Section.match(/^license\\s*=\\s*\\{[^}]*text\\s*=\\s*[\"']([^\"']+)[\"'][^}]*\\}/m);\n    if (tableTextMatch && tableTextMatch[1].trim() !== '') {\n      return tableTextMatch[1].trim();\n    }\n    // license = \"MIT\"\n    const stringMatch = pep621Section.match(/^license\\s*=\\s*[\"']([^\"']+)[\"']/m);\n    if (stringMatch && stringMatch[1].trim() !== '') {\n      return stringMatch[1].trim();\n    }\n  }\n\n  // Poetry: [tool.poetry] license = \"MIT\"\n  const poetrySection = extractSection(content, /^\\[tool\\.poetry\\]/m);\n  if (poetrySection) {\n    const poetryLicenseMatch = poetrySection.match(/^license\\s*=\\s*[\"']([^\"']+)[\"']/m);\n    if (poetryLicenseMatch && poetryLicenseMatch[1].trim() !== '') {\n      return poetryLicenseMatch[1].trim();\n    }\n  }\n\n  return undefined;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAMxB,eAAsB,uBACpB,cACA,aAC6B;AAC7B,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAEpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,kCAAkC,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AACjH,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,qBAAqB,WAAW;AACzD,QAAM,UAAU,wBAAwB,OAAO;AAC/C,QAAM,eAAmC,CAAC;AAG1C,QAAM,aAAa,0BAA0B,SAAS,gBAAgB;AACtE,aAAW,OAAO,YAAY;AAC5B,iBAAa,KAAK;AAAA,MAChB,MAAM,IAAI;AAAA,MACV,oBAAoB,IAAI;AAAA,MACxB,iBAAiB,iBAAiB,IAAI,IAAI,KAAK,YAAY,CAAC;AAAA,MAC5D,OAAO,IAAI;AAAA,MACX,WAAW;AAAA,MACX,gBAAgB;AAAA,MAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7C,CAAC;AAAA,EACH;AAGA,MAAI,aAAa,WAAW,KAAK,iBAAiB,OAAO,GAAG;AAC1D,UAAM,aAAa,0BAA0B,SAAS,gBAAgB;AACtE,eAAW,OAAO,YAAY;AAC5B,UAAI,CAAC,aAAa,KAAK,OAAK,EAAE,SAAS,IAAI,IAAI,GAAG;AAChD,qBAAa,KAAK;AAAA,UAChB,MAAM,IAAI;AAAA,UACV,oBAAoB,IAAI;AAAA,UACxB,iBAAiB,iBAAiB,IAAI,IAAI,KAAK,YAAY,CAAC;AAAA,UAC5D,OAAO,IAAI;AAAA,UACX,WAAW;AAAA,UACX,gBAAgB;AAAA,UAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC7C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAGA,QAAM,UAAU,uBAAuB,SAAS,gBAAgB;AAChE,aAAW,OAAO,SAAS;AACzB,QAAI,CAAC,aAAa,KAAK,OAAK,EAAE,SAAS,IAAI,IAAI,GAAG;AAChD,mBAAa,KAAK;AAAA,QAChB,MAAM,IAAI;AAAA,QACV,oBAAoB,IAAI;AAAA,QACxB,iBAAiB,iBAAiB,IAAI,IAAI,KAAK,YAAY,CAAC;AAAA,QAC5D,OAAO,IAAI;AAAA,QACX,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,0BAA0B,SAAiB,kBAAoC;AACtF,QAAM,OAAiB,CAAC;AAGxB,QAAM,YAAY,iBAAiB,SAAS,iBAAiB,cAAc;AAC3E,aAAW,QAAQ,WAAW;AAC5B,UAAM,MAAM,gBAAgB,MAAM,gBAAgB;AAClD,QAAI,IAAK,MAAK,KAAK,EAAE,GAAG,KAAK,OAAO,aAAa,CAAC;AAAA,EACpD;AAGA,QAAM,aAAa,eAAe,SAAS,sCAAsC;AACjF,MAAI,YAAY;AACd,eAAW,KAAK,WAAW,SAAS,2CAA2C,GAAG;AAChF,YAAM,YAAY,EAAE,CAAC,EAAE,YAAY;AACnC,YAAM,aAAa,6CAA6C,KAAK,SAAS;AAC9E,YAAM,QAAQ,qBAAqB,EAAE,CAAC,CAAC;AACvC,iBAAW,QAAQ,OAAO;AACxB,cAAM,MAAM,gBAAgB,MAAM,gBAAgB;AAClD,YAAI,IAAK,MAAK,KAAK,EAAE,GAAG,KAAK,OAAO,aAAa,gBAAgB,WAAW,CAAC;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAIA,SAAS,iBAAiB,SAA0B;AAClD,SAAO,mBAAmB,KAAK,OAAO;AACxC;AAEA,SAAS,0BAA0B,SAAiB,kBAAoC;AACtF,QAAM,OAAiB,CAAC;AAExB,QAAM,WAAyE;AAAA,IAC7E,EAAE,SAAS,oCAAoC,OAAO,aAAa;AAAA,IACnE,EAAE,SAAS,wCAAwC,OAAO,cAAc;AAAA,EAC1E;AAGA,aAAW,KAAK,QAAQ,SAAS,4DAA4D,GAAG;AAC9F,UAAM,YAAY,EAAE,CAAC,EAAE,YAAY;AACnC,UAAM,QAAmC,2BAA2B,KAAK,SAAS,IAAI,gBAAgB;AACtG,aAAS,KAAK,EAAE,SAAS,IAAI,OAAO,+BAA+B,EAAE,CAAC,CAAC,sBAAsB,GAAG,GAAG,MAAM,CAAC;AAAA,EAC5G;AAEA,aAAW,EAAE,SAAS,MAAM,KAAK,UAAU;AACzC,UAAM,UAAU,eAAe,SAAS,OAAO;AAC/C,QAAI,CAAC,QAAS;AAEd,eAAW,QAAQ,QAAQ,MAAM,IAAI,GAAG;AACtC,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,YAAY,MAAM,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,EAAG;AAG1E,YAAM,cAAc,QAAQ,MAAM,6DAA6D;AAC/F,UAAI,aAAa;AACf,cAAM,OAAO,YAAY,CAAC;AAC1B,YAAI,SAAS,SAAU;AACvB,aAAK,KAAK,EAAE,MAAM,kBAAkB,IAAI,GAAG,YAAY,YAAY,CAAC,GAAG,MAAM,CAAC;AAC9E;AAAA,MACF;AAGA,YAAM,aAAa,QAAQ,MAAM,sDAAsD;AACvF,UAAI,YAAY;AACd,cAAM,OAAO,WAAW,CAAC;AACzB,YAAI,SAAS,SAAU;AACvB,cAAM,eAAe,QAAQ,MAAM,yBAAyB;AAC5D,YAAI,cAAc;AAChB,eAAK,KAAK,EAAE,MAAM,kBAAkB,IAAI,GAAG,YAAY,aAAa,CAAC,GAAG,MAAM,CAAC;AAAA,QACjF,OAAO;AAEL,eAAK,KAAK,EAAE,MAAM,kBAAkB,IAAI,GAAG,YAAY,KAAK,MAAM,CAAC;AAAA,QACrE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAIA,SAAS,uBAAuB,SAAiB,kBAAoC;AACnF,QAAM,OAAiB,CAAC;AAGxB,QAAM,UAAU,eAAe,SAAS,mCAAmC;AAC3E,MAAI,SAAS;AACX,eAAW,KAAK,QAAQ,SAAS,2CAA2C,GAAG;AAC7E,YAAM,QAAQ,qBAAqB,EAAE,CAAC,CAAC;AACvC,iBAAW,QAAQ,OAAO;AACxB,cAAM,MAAM,gBAAgB,MAAM,gBAAgB;AAClD,YAAI,IAAK,MAAK,KAAK,EAAE,GAAG,KAAK,OAAO,cAAc,CAAC;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAIA,SAAS,gBAAgB,MAAc,mBAAwE;AAG7G,QAAM,gBAAgB,KAAK,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AAC9C,QAAM,gBAAgB,cAAc,QAAQ,cAAc,EAAE,EAAE,KAAK;AAEnE,QAAM,QAAQ,cAAc,MAAM,oDAAoD;AACtF,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,OAAO,kBAAkB,MAAM,CAAC,CAAC;AACvC,QAAM,aAAa,MAAM,CAAC,EAAE,KAAK,KAAK;AACtC,SAAO,EAAE,MAAM,WAAW;AAC5B;AAIA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,MAA0B,oBAAI,IAAI;AAGxC,QAAM,aAAa,CAAC,eAAe,YAAY,SAAS;AACxD,aAAW,YAAY,YAAY;AACjC,UAAM,WAAW,KAAK,KAAK,aAAa,QAAQ;AAChD,QAAI,CAAC,GAAG,WAAW,QAAQ,EAAG;AAC9B,QAAI;AACF,YAAM,UAAU,GAAG,aAAa,UAAU,MAAM;AAChD,UAAI,aAAa,cAAe,uBAAsB,SAAS,GAAG;AAAA,UAC7D,sBAAqB,SAAS,GAAG;AACtC;AAAA,IACF,SAAS,KAAK;AACZ,iCAAQ,mCAAmC,QAAQ,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,IAC5G;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,sBAAsB,SAAiB,KAA+B;AAE7E,aAAW,KAAK,QAAQ,SAAS,0EAA0E,GAAG;AAC5G,QAAI,IAAI,EAAE,CAAC,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;AAAA,EAClC;AACF;AAEA,SAAS,qBAAqB,SAAiB,KAA+B;AAE5E,aAAW,KAAK,QAAQ,SAAS,2FAA2F,GAAG;AAC7H,QAAI,IAAI,EAAE,CAAC,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;AAAA,EAClC;AACF;AAKA,SAAS,eAAe,SAAiB,eAAsC;AAC7E,QAAM,QAAQ,cAAc,KAAK,OAAO;AACxC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MAAM,QAAQ,MAAM,CAAC,EAAE;AACrC,QAAM,YAAY,QAAQ,MAAM,KAAK;AACrC,QAAM,cAAc,UAAU,MAAM,MAAM;AAC1C,SAAO,cAAc,UAAU,MAAM,GAAG,YAAY,KAAK,IAAI;AAC/D;AAGA,SAAS,iBAAiB,SAAiB,gBAAwB,KAAuB;AACxF,QAAM,UAAU,eAAe,SAAS,cAAc;AACtD,MAAI,CAAC,QAAS,QAAO,CAAC;AAGtB,QAAM,aAAa,IAAI,OAAO,IAAI,GAAG,wDAAwD,IAAI;AACjG,QAAM,IAAI,WAAW,KAAK,OAAO;AACjC,MAAI,CAAC,EAAG,QAAO,CAAC;AAChB,SAAO,qBAAqB,EAAE,CAAC,CAAC;AAClC;AAGA,SAAS,qBAAqB,MAAwB;AACpD,QAAM,UAAoB,CAAC;AAC3B,aAAW,KAAK,KAAK,SAAS,YAAY,GAAG;AAC3C,YAAQ,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC;AAAA,EAC1B;AACA,aAAW,KAAK,KAAK,SAAS,YAAY,GAAG;AAC3C,YAAQ,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC;AAAA,EAC1B;AACA,SAAO,QAAQ,OAAO,OAAO;AAC/B;AAGA,SAAS,kBAAkB,MAAsB;AAC/C,SAAO,KAAK,YAAY,EAAE,QAAQ,WAAW,GAAG;AAClD;AASA,SAAS,wBAAwB,SAAqC;AAEpE,QAAM,gBAAgB,eAAe,SAAS,eAAe;AAC7D,MAAI,eAAe;AAEjB,UAAM,iBAAiB,cAAc,MAAM,2DAA2D;AACtG,QAAI,kBAAkB,eAAe,CAAC,EAAE,KAAK,MAAM,IAAI;AACrD,aAAO,eAAe,CAAC,EAAE,KAAK;AAAA,IAChC;AAEA,UAAM,cAAc,cAAc,MAAM,kCAAkC;AAC1E,QAAI,eAAe,YAAY,CAAC,EAAE,KAAK,MAAM,IAAI;AAC/C,aAAO,YAAY,CAAC,EAAE,KAAK;AAAA,IAC7B;AAAA,EACF;AAGA,QAAM,gBAAgB,eAAe,SAAS,oBAAoB;AAClE,MAAI,eAAe;AACjB,UAAM,qBAAqB,cAAc,MAAM,kCAAkC;AACjF,QAAI,sBAAsB,mBAAmB,CAAC,EAAE,KAAK,MAAM,IAAI;AAC7D,aAAO,mBAAmB,CAAC,EAAE,KAAK;AAAA,IACpC;AAAA,EACF;AAEA,SAAO;AACT;",
+  "names": []
+}