kirograph 0.16.1 → 0.19.0

package/dist/security/manifest/plugins/rubygems.js

@@ -0,0 +1,185 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var rubygems_exports = {};
+__export(rubygems_exports, {
+  parseRubygemsManifest: () => parseRubygemsManifest
+});
+module.exports = __toCommonJS(rubygems_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+async function parseRubygemsManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:rubygems] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const license = loadGemspecLicense(manifestDir);
+  const dependencies = [];
+  const lines = content.split("\n");
+  let currentScope = "production";
+  let groupDepth = 0;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    const groupMatch = trimmed.match(/^group\s+(.+?)\s+do\s*(?:#.*)?$/);
+    if (groupMatch) {
+      groupDepth++;
+      if (groupDepth === 1) {
+        currentScope = resolveGroupScope(groupMatch[1]);
+      }
+      continue;
+    }
+    if (trimmed === "end" || trimmed.startsWith("end ") || trimmed.startsWith("end#")) {
+      if (groupDepth > 0) {
+        groupDepth--;
+        if (groupDepth === 0) {
+          currentScope = "production";
+        }
+      }
+      continue;
+    }
+    const dep = parseGemLine(trimmed, relativeManifest);
+    if (dep) {
+      const resolvedVersion = resolvedVersions.get(dep.name);
+      dependencies.push({
+        name: dep.name,
+        declaredConstraint: dep.constraint,
+        resolvedVersion,
+        scope: currentScope,
+        ecosystem: "rubygems",
+        sourceManifest: relativeManifest,
+        ...license !== void 0 ? { license } : {}
+      });
+    }
+  }
+  return dependencies;
+}
+function parseGemLine(line, relativeManifest) {
+  const withoutComment = line.replace(/\s*#.*$/, "");
+  const gemMatch = withoutComment.match(/^gem\s+(['"])([^'"]+)\1(.*)?$/);
+  if (!gemMatch) return null;
+  const name = gemMatch[2].trim();
+  const rest = (gemMatch[3] || "").trim();
+  if (!isValidGemName(name)) {
+    (0, import_errors.logWarn)(`[sec:rubygems] Invalid gem name "${name}" in ${relativeManifest} \u2014 skipping`);
+    return null;
+  }
+  if (rest === "" || rest.startsWith(":") || rest.startsWith(",s*:")) {
+    return { name, constraint: "*" };
+  }
+  const versionConstraints = [];
+  const versionPattern = /['"]([^'"]*)['"]/g;
+  let versionMatch;
+  while ((versionMatch = versionPattern.exec(rest)) !== null) {
+    const candidate = versionMatch[1].trim();
+    if (/^(~>|>=|<=|!=|>|<|=|\d)/.test(candidate)) {
+      versionConstraints.push(candidate);
+    }
+  }
+  if (versionConstraints.length === 0) {
+    return { name, constraint: "*" };
+  }
+  return { name, constraint: versionConstraints.join(", ") };
+}
+function resolveGroupScope(groupSpec) {
+  if (/:test\b/.test(groupSpec) || /:development\b/.test(groupSpec)) {
+    return "development";
+  }
+  return "production";
+}
+function isValidGemName(name) {
+  if (!name || typeof name !== "string") return false;
+  if (name.length > 128) return false;
+  return /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(name);
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const lockPath = path.join(manifestDir, "Gemfile.lock");
+  if (!fs.existsSync(lockPath)) {
+    return map;
+  }
+  try {
+    const lockContent = fs.readFileSync(lockPath, "utf8");
+    extractFromGemfileLock(lockContent, map);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:rubygems] Failed to parse Gemfile.lock: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function extractFromGemfileLock(content, map) {
+  const lines = content.split("\n");
+  let inGemSection = false;
+  let inSpecsSection = false;
+  for (const line of lines) {
+    if (/^\S/.test(line)) {
+      inGemSection = line.trimEnd() === "GEM";
+      inSpecsSection = false;
+      continue;
+    }
+    if (!inGemSection) continue;
+    if (/^  specs:\s*$/.test(line)) {
+      inSpecsSection = true;
+      continue;
+    }
+    if (!inSpecsSection) continue;
+    const specMatch = line.match(/^    ([a-zA-Z0-9][a-zA-Z0-9_.-]*)\s+\(([^)]+)\)\s*$/);
+    if (specMatch) {
+      const name = specMatch[1];
+      const version = specMatch[2].trim();
+      if (!map.has(name)) {
+        map.set(name, version);
+      }
+    }
+  }
+}
+function loadGemspecLicense(dir) {
+  try {
+    const entries = fs.readdirSync(dir);
+    const gemspecFile = entries.find((f) => f.endsWith(".gemspec"));
+    if (!gemspecFile) return void 0;
+    const content = fs.readFileSync(path.join(dir, gemspecFile), "utf8");
+    const match = content.match(/\.license\s*=\s*['"]([^'"]+)['"]/);
+    if (match && match[1].trim() !== "") {
+      return match[1].trim();
+    }
+  } catch {
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseRubygemsManifest
+});
+//# sourceMappingURL=rubygems.js.map

package/dist/security/manifest/plugins/rubygems.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/rubygems.ts"],
+  "sourcesContent": ["/**\n * RubyGems Version Extraction Plugin for KiroGraph-Sec\n *\n * Parses Gemfile manifests to extract gem declarations with version constraints,\n * scopes (derived from `group` blocks), and resolved versions from Gemfile.lock.\n *\n * Handles:\n * - `gem 'name', '~> 1.0'` \u2014 single version constraint\n * - `gem 'name', '>= 1.0', '< 2.0'` \u2014 multiple constraints (joined with ', ')\n * - `gem 'name'` \u2014 no version constraint\n * - `group :development, :test do ... end` blocks \u2192 'development' scope\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Resolved version map: gem name \u2192 resolved version string.\n * Built from Gemfile.lock.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * Parse a Gemfile manifest and extract gem declarations with version constraints,\n * scopes, and resolved versions from Gemfile.lock.\n *\n * @param manifestPath - Absolute path to the Gemfile\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parseRubygemsManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read the Gemfile content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:rubygems] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Attempt to load resolved versions from Gemfile.lock\n  const resolvedVersions = loadResolvedVersions(manifestDir);\n\n  // Attempt to extract license from a gemspec in the same directory\n  const license = loadGemspecLicense(manifestDir);\n\n  // Extract dependencies from the Gemfile\n  const dependencies: ParsedDependency[] = [];\n  const lines = content.split('\\n');\n\n  // Track current group scope \u2014 null means top-level (production)\n  let currentScope: ParsedDependency['scope'] = 'production';\n  let groupDepth = 0; // tracks nesting depth inside a group block\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n    if (trimmed === '' || trimmed.startsWith('#')) continue;\n\n    // Detect start of a group block: `group :test, :development do`\n    const groupMatch = trimmed.match(/^group\\s+(.+?)\\s+do\\s*(?:#.*)?$/);\n    if (groupMatch) {\n      groupDepth++;\n      if (groupDepth === 1) {\n        currentScope = resolveGroupScope(groupMatch[1]);\n      }\n      continue;\n    }\n\n    // Detect `end` \u2014 only reset scope when we exit the outermost group block\n    if (trimmed === 'end' || trimmed.startsWith('end ') || trimmed.startsWith('end#')) {\n      if (groupDepth > 0) {\n        groupDepth--;\n        if (groupDepth === 0) {\n          currentScope = 'production';\n        }\n      }\n      continue;\n    }\n\n    // Match gem declarations\n    const dep = parseGemLine(trimmed, relativeManifest);\n    if (dep) {\n      const resolvedVersion = resolvedVersions.get(dep.name);\n      dependencies.push({\n        name: dep.name,\n        declaredConstraint: dep.constraint,\n        resolvedVersion,\n        scope: currentScope,\n        ecosystem: 'rubygems',\n        sourceManifest: relativeManifest,\n        ...(license !== undefined ? { license } : {}),\n      });\n    }\n  }\n\n  return dependencies;\n}\n\n/**\n * A raw dependency entry extracted from a Gemfile line.\n */\ninterface RawDependency {\n  name: string;\n  constraint: string;\n}\n\n/**\n * Parse a single `gem` declaration line from a Gemfile.\n *\n * Handles:\n * - `gem 'name'`\n * - `gem 'name', '~> 1.0'`\n * - `gem \"name\", \"~> 1.0\"`\n * - `gem 'name', '>= 1.0', '< 2.0'` (multiple constraints joined with ', ')\n */\nfunction parseGemLine(line: string, relativeManifest: string): RawDependency | null {\n  // Strip inline comments\n  const withoutComment = line.replace(/\\s*#.*$/, '');\n\n  // Match: gem 'name' or gem \"name\" followed by optional version strings\n  const gemMatch = withoutComment.match(/^gem\\s+(['\"])([^'\"]+)\\1(.*)?$/);\n  if (!gemMatch) return null;\n\n  const name = gemMatch[2].trim();\n  const rest = (gemMatch[3] || '').trim();\n\n  if (!isValidGemName(name)) {\n    logWarn(`[sec:rubygems] Invalid gem name \"${name}\" in ${relativeManifest} \u2014 skipping`);\n    return null;\n  }\n\n  // No version constraint\n  if (rest === '' || rest.startsWith(':') || rest.startsWith(',\\s*:')) {\n    return { name, constraint: '*' };\n  }\n\n  // Extract all string literals from the rest of the line that look like version constraints\n  const versionConstraints: string[] = [];\n  const versionPattern = /['\"]([^'\"]*)['\"]/g;\n  let versionMatch: RegExpExecArray | null;\n  while ((versionMatch = versionPattern.exec(rest)) !== null) {\n    const candidate = versionMatch[1].trim();\n    // Only capture strings that look like version constraints (start with ~>, >=, <=, !=, >, <, =, or a digit)\n    if (/^(~>|>=|<=|!=|>|<|=|\\d)/.test(candidate)) {\n      versionConstraints.push(candidate);\n    }\n  }\n\n  if (versionConstraints.length === 0) {\n    return { name, constraint: '*' };\n  }\n\n  return { name, constraint: versionConstraints.join(', ') };\n}\n\n/**\n * Determine the dependency scope from a group specifier string.\n * Any group containing :test or :development maps to 'development'.\n *\n * @param groupSpec - The group specifier string, e.g., `:development, :test`\n */\nfunction resolveGroupScope(groupSpec: string): ParsedDependency['scope'] {\n  if (/:test\\b/.test(groupSpec) || /:development\\b/.test(groupSpec)) {\n    return 'development';\n  }\n  return 'production';\n}\n\n/**\n * Validate that a gem name follows RubyGems naming conventions.\n */\nfunction isValidGemName(name: string): boolean {\n  if (!name || typeof name !== 'string') return false;\n  if (name.length > 128) return false;\n  return /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(name);\n}\n\n/**\n * Attempt to load resolved versions from Gemfile.lock in the given directory.\n * Returns an empty map if Gemfile.lock is not available.\n *\n * Gemfile.lock GEM section format:\n * ```\n * GEM\n *   remote: https://rubygems.org/\n *   specs:\n *     rails (7.0.4)\n *     rake (13.0.6)\n * ```\n */\nfunction loadResolvedVersions(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  const lockPath = path.join(manifestDir, 'Gemfile.lock');\n  if (!fs.existsSync(lockPath)) {\n    return map;\n  }\n\n  try {\n    const lockContent = fs.readFileSync(lockPath, 'utf8');\n    extractFromGemfileLock(lockContent, map);\n  } catch (err) {\n    logWarn(`[sec:rubygems] Failed to parse Gemfile.lock: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from Gemfile.lock content.\n *\n * The GEM section contains a `specs:` subsection with lines of the form:\n * `    gemname (1.2.3)` (4-space indent for direct deps, 6-space for sub-deps).\n * We capture all entries under `specs:`.\n */\nfunction extractFromGemfileLock(content: string, map: ResolvedVersionMap): void {\n  const lines = content.split('\\n');\n  let inGemSection = false;\n  let inSpecsSection = false;\n\n  for (const line of lines) {\n    // Detect top-level section headers (no indent)\n    if (/^\\S/.test(line)) {\n      inGemSection = line.trimEnd() === 'GEM';\n      inSpecsSection = false;\n      continue;\n    }\n\n    if (!inGemSection) continue;\n\n    // Detect `  specs:` subsection (2-space indent)\n    if (/^  specs:\\s*$/.test(line)) {\n      inSpecsSection = true;\n      continue;\n    }\n\n    if (!inSpecsSection) continue;\n\n    // Parse gem entries: `    gemname (1.2.3)` \u2014 4+ spaces indent\n    const specMatch = line.match(/^    ([a-zA-Z0-9][a-zA-Z0-9_.-]*)\\s+\\(([^)]+)\\)\\s*$/);\n    if (specMatch) {\n      const name = specMatch[1];\n      const version = specMatch[2].trim();\n      if (!map.has(name)) {\n        map.set(name, version);\n      }\n    }\n  }\n}\n\n/**\n * Attempt to load the license from a .gemspec file in the given directory.\n * Looks for: s.license = 'MIT' or spec.license = \"MIT\"\n */\nfunction loadGemspecLicense(dir: string): string | undefined {\n  try {\n    const entries = fs.readdirSync(dir);\n    const gemspecFile = entries.find(f => f.endsWith('.gemspec'));\n    if (!gemspecFile) return undefined;\n    const content = fs.readFileSync(path.join(dir, gemspecFile), 'utf8');\n    const match = content.match(/\\.license\\s*=\\s*['\"]([^'\"]+)['\"]/);\n    if (match && match[1].trim() !== '') {\n      return match[1].trim();\n    }\n  } catch {\n    // best-effort \u2014 ignore errors\n  }\n  return undefined;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAgBxB,eAAsB,sBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,iCAAiC,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAChH,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,mBAAmB,qBAAqB,WAAW;AAGzD,QAAM,UAAU,mBAAmB,WAAW;AAG9C,QAAM,eAAmC,CAAC;AAC1C,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAGhC,MAAI,eAA0C;AAC9C,MAAI,aAAa;AAEjB,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,YAAY,MAAM,QAAQ,WAAW,GAAG,EAAG;AAG/C,UAAM,aAAa,QAAQ,MAAM,iCAAiC;AAClE,QAAI,YAAY;AACd;AACA,UAAI,eAAe,GAAG;AACpB,uBAAe,kBAAkB,WAAW,CAAC,CAAC;AAAA,MAChD;AACA;AAAA,IACF;AAGA,QAAI,YAAY,SAAS,QAAQ,WAAW,MAAM,KAAK,QAAQ,WAAW,MAAM,GAAG;AACjF,UAAI,aAAa,GAAG;AAClB;AACA,YAAI,eAAe,GAAG;AACpB,yBAAe;AAAA,QACjB;AAAA,MACF;AACA;AAAA,IACF;AAGA,UAAM,MAAM,aAAa,SAAS,gBAAgB;AAClD,QAAI,KAAK;AACP,YAAM,kBAAkB,iBAAiB,IAAI,IAAI,IAAI;AACrD,mBAAa,KAAK;AAAA,QAChB,MAAM,IAAI;AAAA,QACV,oBAAoB,IAAI;AAAA,QACxB;AAAA,QACA,OAAO;AAAA,QACP,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAmBA,SAAS,aAAa,MAAc,kBAAgD;AAElF,QAAM,iBAAiB,KAAK,QAAQ,WAAW,EAAE;AAGjD,QAAM,WAAW,eAAe,MAAM,+BAA+B;AACrE,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,OAAO,SAAS,CAAC,EAAE,KAAK;AAC9B,QAAM,QAAQ,SAAS,CAAC,KAAK,IAAI,KAAK;AAEtC,MAAI,CAAC,eAAe,IAAI,GAAG;AACzB,+BAAQ,oCAAoC,IAAI,QAAQ,gBAAgB,kBAAa;AACrF,WAAO;AAAA,EACT;AAGA,MAAI,SAAS,MAAM,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,MAAO,GAAG;AACnE,WAAO,EAAE,MAAM,YAAY,IAAI;AAAA,EACjC;AAGA,QAAM,qBAA+B,CAAC;AACtC,QAAM,iBAAiB;AACvB,MAAI;AACJ,UAAQ,eAAe,eAAe,KAAK,IAAI,OAAO,MAAM;AAC1D,UAAM,YAAY,aAAa,CAAC,EAAE,KAAK;AAEvC,QAAI,0BAA0B,KAAK,SAAS,GAAG;AAC7C,yBAAmB,KAAK,SAAS;AAAA,IACnC;AAAA,EACF;AAEA,MAAI,mBAAmB,WAAW,GAAG;AACnC,WAAO,EAAE,MAAM,YAAY,IAAI;AAAA,EACjC;AAEA,SAAO,EAAE,MAAM,YAAY,mBAAmB,KAAK,IAAI,EAAE;AAC3D;AAQA,SAAS,kBAAkB,WAA8C;AACvE,MAAI,UAAU,KAAK,SAAS,KAAK,iBAAiB,KAAK,SAAS,GAAG;AACjE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAKA,SAAS,eAAe,MAAuB;AAC7C,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,MAAI,KAAK,SAAS,IAAK,QAAO;AAC9B,SAAO,+BAA+B,KAAK,IAAI;AACjD;AAeA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,MAA0B,oBAAI,IAAI;AAExC,QAAM,WAAW,KAAK,KAAK,aAAa,cAAc;AACtD,MAAI,CAAC,GAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,cAAc,GAAG,aAAa,UAAU,MAAM;AACpD,2BAAuB,aAAa,GAAG;AAAA,EACzC,SAAS,KAAK;AACZ,+BAAQ,gDAAgD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EAC5G;AAEA,SAAO;AACT;AASA,SAAS,uBAAuB,SAAiB,KAA+B;AAC9E,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,MAAI,eAAe;AACnB,MAAI,iBAAiB;AAErB,aAAW,QAAQ,OAAO;AAExB,QAAI,MAAM,KAAK,IAAI,GAAG;AACpB,qBAAe,KAAK,QAAQ,MAAM;AAClC,uBAAiB;AACjB;AAAA,IACF;AAEA,QAAI,CAAC,aAAc;AAGnB,QAAI,gBAAgB,KAAK,IAAI,GAAG;AAC9B,uBAAiB;AACjB;AAAA,IACF;AAEA,QAAI,CAAC,eAAgB;AAGrB,UAAM,YAAY,KAAK,MAAM,qDAAqD;AAClF,QAAI,WAAW;AACb,YAAM,OAAO,UAAU,CAAC;AACxB,YAAM,UAAU,UAAU,CAAC,EAAE,KAAK;AAClC,UAAI,CAAC,IAAI,IAAI,IAAI,GAAG;AAClB,YAAI,IAAI,MAAM,OAAO;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAMA,SAAS,mBAAmB,KAAiC;AAC3D,MAAI;AACF,UAAM,UAAU,GAAG,YAAY,GAAG;AAClC,UAAM,cAAc,QAAQ,KAAK,OAAK,EAAE,SAAS,UAAU,CAAC;AAC5D,QAAI,CAAC,YAAa,QAAO;AACzB,UAAM,UAAU,GAAG,aAAa,KAAK,KAAK,KAAK,WAAW,GAAG,MAAM;AACnE,UAAM,QAAQ,QAAQ,MAAM,kCAAkC;AAC9D,QAAI,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM,IAAI;AACnC,aAAO,MAAM,CAAC,EAAE,KAAK;AAAA,IACvB;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/security/manifest/plugins/swift.js

@@ -0,0 +1,200 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var swift_exports = {};
+__export(swift_exports, {
+  parseSwiftManifest: () => parseSwiftManifest
+});
+module.exports = __toCommonJS(swift_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+async function parseSwiftManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  const resolved = loadPackageResolved(manifestDir);
+  if (resolved.size > 0 || hasPackageResolved(manifestDir)) {
+    return buildFromResolved(resolved, relativeManifest);
+  }
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:swift] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const rawDeps = extractFromPackageSwift(content, relativeManifest);
+  return rawDeps.map((dep) => ({
+    name: dep.name,
+    declaredConstraint: dep.constraint,
+    resolvedVersion: dep.resolvedVersion,
+    scope: "production",
+    ecosystem: "swift",
+    sourceManifest: relativeManifest
+  }));
+}
+function buildFromResolved(resolved, relativeManifest) {
+  const deps = [];
+  for (const [name, version] of resolved) {
+    deps.push({
+      name,
+      declaredConstraint: version,
+      resolvedVersion: version,
+      scope: "production",
+      ecosystem: "swift",
+      sourceManifest: relativeManifest
+    });
+  }
+  return deps;
+}
+function extractFromPackageSwift(content, relativeManifest) {
+  const deps = [];
+  const packagePattern = /\.package\s*\(\s*url\s*:\s*"([^"]+)"[^)]+\)/gs;
+  let match;
+  while ((match = packagePattern.exec(content)) !== null) {
+    const url = match[1];
+    const fullMatch = match[0];
+    const name = packageNameFromUrl(url);
+    if (!name) {
+      (0, import_errors.logWarn)(`[sec:swift] Could not derive package name from URL "${url}" in ${relativeManifest} \u2014 skipping`);
+      continue;
+    }
+    const constraint = extractVersionConstraint(fullMatch, relativeManifest);
+    deps.push({ name, constraint });
+  }
+  return deps;
+}
+function extractVersionConstraint(packageCall, relativeManifest) {
+  const fromMatch = packageCall.match(/\bfrom\s*:\s*"([^"]+)"/);
+  if (fromMatch) return `from: ${fromMatch[1]}`;
+  const exactMatch = packageCall.match(/\bexact\s*:\s*"([^"]+)"/);
+  if (exactMatch) return `exact: ${exactMatch[1]}`;
+  const upToMajorMatch = packageCall.match(/\.upToNextMajor\s*\(\s*from\s*:\s*"([^"]+)"\s*\)/);
+  if (upToMajorMatch) return `upToNextMajor: ${upToMajorMatch[1]}`;
+  const upToMinorMatch = packageCall.match(/\.upToNextMinor\s*\(\s*from\s*:\s*"([^"]+)"\s*\)/);
+  if (upToMinorMatch) return `upToNextMinor: ${upToMinorMatch[1]}`;
+  const rangeMatch = packageCall.match(/"([^"]+)"\s*\.{2,3}<\s*"([^"]+)"/);
+  if (rangeMatch) return `${rangeMatch[1]} ..< ${rangeMatch[2]}`;
+  (0, import_errors.logWarn)(`[sec:swift] Unrecognised version specifier in Package.swift at ${relativeManifest} \u2014 using '*'`);
+  return "*";
+}
+function packageNameFromUrl(url) {
+  try {
+    const cleaned = url.replace(/\/+$/, "");
+    const segments = cleaned.split("/");
+    const last = segments[segments.length - 1];
+    if (!last) return null;
+    return last.replace(/\.git$/i, "").toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function hasPackageResolved(manifestDir) {
+  return fs.existsSync(path.join(manifestDir, "Package.resolved")) || fs.existsSync(path.join(manifestDir, ".build", "Package.resolved"));
+}
+function loadPackageResolved(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const candidates = [
+    path.join(manifestDir, "Package.resolved"),
+    path.join(manifestDir, ".build", "Package.resolved")
+  ];
+  for (const candidate of candidates) {
+    if (!fs.existsSync(candidate)) continue;
+    try {
+      const lockContent = fs.readFileSync(candidate, "utf8");
+      extractFromPackageResolved(lockContent, map, candidate);
+      return map;
+    } catch (err) {
+      (0, import_errors.logWarn)(`[sec:swift] Failed to parse ${candidate}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return map;
+}
+function extractFromPackageResolved(content, map, filePath) {
+  let data;
+  try {
+    data = JSON.parse(content);
+  } catch {
+    (0, import_errors.logWarn)(`[sec:swift] ${filePath} is not valid JSON \u2014 resolved versions unavailable`);
+    return;
+  }
+  let pins = null;
+  if (Array.isArray(data["pins"])) {
+    pins = data["pins"];
+    extractPinsV2(pins, map);
+    return;
+  }
+  const obj = data["object"];
+  if (obj && typeof obj === "object" && !Array.isArray(obj)) {
+    const objRecord = obj;
+    if (Array.isArray(objRecord["pins"])) {
+      pins = objRecord["pins"];
+      extractPinsV1(pins, map);
+      return;
+    }
+  }
+  (0, import_errors.logWarn)(`[sec:swift] ${filePath} has unrecognised Package.resolved format \u2014 resolved versions unavailable`);
+}
+function extractPinsV2(pins, map) {
+  for (const pin of pins) {
+    if (!pin || typeof pin !== "object") continue;
+    const p = pin;
+    const identity = typeof p["identity"] === "string" ? p["identity"].toLowerCase() : null;
+    const state = p["state"];
+    const version = state && typeof state === "object" && !Array.isArray(state) ? state["version"] : null;
+    if (identity && typeof version === "string" && version) {
+      if (!map.has(identity)) {
+        map.set(identity, version);
+      }
+    }
+  }
+}
+function extractPinsV1(pins, map) {
+  for (const pin of pins) {
+    if (!pin || typeof pin !== "object") continue;
+    const p = pin;
+    let name = null;
+    if (typeof p["package"] === "string" && p["package"]) {
+      name = p["package"].toLowerCase();
+    } else if (typeof p["repositoryURL"] === "string") {
+      name = packageNameFromUrl(p["repositoryURL"]);
+    }
+    const state = p["state"];
+    const version = state && typeof state === "object" && !Array.isArray(state) ? state["version"] : null;
+    if (name && typeof version === "string" && version) {
+      if (!map.has(name)) {
+        map.set(name, version);
+      }
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseSwiftManifest
+});
+//# sourceMappingURL=swift.js.map

package/dist/security/manifest/plugins/swift.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/swift.ts"],
+  "sourcesContent": ["/**\n * Swift Package Manager Version Extraction Plugin for KiroGraph-Sec\n *\n * Parses Package.swift manifests to extract Swift package dependencies with\n * version constraints and resolved versions from Package.resolved.\n *\n * Prefers Package.resolved (more reliable) over regex parsing of Package.swift.\n * Handles both v1 and v2 Package.resolved formats.\n *\n * Package.resolved locations searched:\n * - Same directory as Package.swift\n * - `.build/` subdirectory relative to Package.swift\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Resolved version map: package identity \u2192 resolved version string.\n * Built from Package.resolved.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * A raw dependency entry extracted from Package.swift or Package.resolved.\n */\ninterface RawDependency {\n  name: string;\n  constraint: string;\n  resolvedVersion?: string;\n}\n\n/**\n * Parse a Package.swift manifest and extract package dependencies with\n * version constraints and resolved versions from Package.resolved.\n *\n * @param manifestPath - Absolute path to the Package.swift file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parseSwiftManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Try to load Package.resolved first \u2014 it's more reliable than parsing Package.swift\n  const resolved = loadPackageResolved(manifestDir);\n  if (resolved.size > 0 || hasPackageResolved(manifestDir)) {\n    // We have a lock file \u2014 use its entries as the authoritative dependency list\n    return buildFromResolved(resolved, relativeManifest);\n  }\n\n  // Fallback: parse Package.swift directly\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:swift] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  const rawDeps = extractFromPackageSwift(content, relativeManifest);\n  return rawDeps.map((dep) => ({\n    name: dep.name,\n    declaredConstraint: dep.constraint,\n    resolvedVersion: dep.resolvedVersion,\n    scope: 'production' as const,\n    ecosystem: 'swift',\n    sourceManifest: relativeManifest,\n  }));\n}\n\n/**\n * Build ParsedDependency entries from a resolved version map.\n * All Swift dependencies are production scope (SPM has no dev deps concept).\n */\nfunction buildFromResolved(\n  resolved: ResolvedVersionMap,\n  relativeManifest: string,\n): ParsedDependency[] {\n  const deps: ParsedDependency[] = [];\n  for (const [name, version] of resolved) {\n    deps.push({\n      name,\n      declaredConstraint: version,\n      resolvedVersion: version,\n      scope: 'production',\n      ecosystem: 'swift',\n      sourceManifest: relativeManifest,\n    });\n  }\n  return deps;\n}\n\n/**\n * Extract dependencies from Package.swift using regex patterns.\n *\n * Handles:\n * - `.package(url: \"...\", from: \"1.0.0\")`\n * - `.package(url: \"...\", exact: \"1.0.0\")`\n * - `.package(url: \"...\", .upToNextMajor(from: \"1.0.0\"))`\n * - `.package(url: \"...\", .upToNextMinor(from: \"1.0.0\"))`\n */\nfunction extractFromPackageSwift(content: string, relativeManifest: string): RawDependency[] {\n  const deps: RawDependency[] = [];\n\n  // Match .package(url: \"...\", <version spec>) \u2014 possibly spanning multiple lines\n  // We capture the url argument and the version specifier\n  const packagePattern = /\\.package\\s*\\(\\s*url\\s*:\\s*\"([^\"]+)\"[^)]+\\)/gs;\n  let match: RegExpExecArray | null;\n\n  while ((match = packagePattern.exec(content)) !== null) {\n    const url = match[1];\n    const fullMatch = match[0];\n\n    const name = packageNameFromUrl(url);\n    if (!name) {\n      logWarn(`[sec:swift] Could not derive package name from URL \"${url}\" in ${relativeManifest} \u2014 skipping`);\n      continue;\n    }\n\n    const constraint = extractVersionConstraint(fullMatch, relativeManifest);\n    deps.push({ name, constraint });\n  }\n\n  return deps;\n}\n\n/**\n * Extract a version constraint string from a .package(...) call.\n * Returns '*' if no recognised version spec is found.\n */\nfunction extractVersionConstraint(packageCall: string, relativeManifest: string): string {\n  // from: \"1.0.0\"\n  const fromMatch = packageCall.match(/\\bfrom\\s*:\\s*\"([^\"]+)\"/);\n  if (fromMatch) return `from: ${fromMatch[1]}`;\n\n  // exact: \"1.0.0\"\n  const exactMatch = packageCall.match(/\\bexact\\s*:\\s*\"([^\"]+)\"/);\n  if (exactMatch) return `exact: ${exactMatch[1]}`;\n\n  // .upToNextMajor(from: \"1.0.0\")\n  const upToMajorMatch = packageCall.match(/\\.upToNextMajor\\s*\\(\\s*from\\s*:\\s*\"([^\"]+)\"\\s*\\)/);\n  if (upToMajorMatch) return `upToNextMajor: ${upToMajorMatch[1]}`;\n\n  // .upToNextMinor(from: \"1.0.0\")\n  const upToMinorMatch = packageCall.match(/\\.upToNextMinor\\s*\\(\\s*from\\s*:\\s*\"([^\"]+)\"\\s*\\)/);\n  if (upToMinorMatch) return `upToNextMinor: ${upToMinorMatch[1]}`;\n\n  // Range: \"1.0.0\"..<\"2.0.0\"\n  const rangeMatch = packageCall.match(/\"([^\"]+)\"\\s*\\.{2,3}<\\s*\"([^\"]+)\"/);\n  if (rangeMatch) return `${rangeMatch[1]} ..< ${rangeMatch[2]}`;\n\n  logWarn(`[sec:swift] Unrecognised version specifier in Package.swift at ${relativeManifest} \u2014 using '*'`);\n  return '*';\n}\n\n/**\n * Derive a package name from a Swift package URL.\n * Extracts the last path component and strips a `.git` suffix.\n *\n * e.g., `https://github.com/apple/swift-argument-parser.git` \u2192 `swift-argument-parser`\n */\nfunction packageNameFromUrl(url: string): string | null {\n  try {\n    // Remove trailing slash\n    const cleaned = url.replace(/\\/+$/, '');\n    const segments = cleaned.split('/');\n    const last = segments[segments.length - 1];\n    if (!last) return null;\n    // Strip .git suffix\n    return last.replace(/\\.git$/i, '').toLowerCase();\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Check whether Package.resolved exists in the expected locations.\n */\nfunction hasPackageResolved(manifestDir: string): boolean {\n  return (\n    fs.existsSync(path.join(manifestDir, 'Package.resolved')) ||\n    fs.existsSync(path.join(manifestDir, '.build', 'Package.resolved'))\n  );\n}\n\n/**\n * Attempt to load resolved versions from Package.resolved.\n * Searches the manifest directory and `.build/` subdirectory.\n * Returns an empty map if Package.resolved is not available.\n *\n * Supports both v1 and v2 Package.resolved formats.\n */\nfunction loadPackageResolved(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  const candidates = [\n    path.join(manifestDir, 'Package.resolved'),\n    path.join(manifestDir, '.build', 'Package.resolved'),\n  ];\n\n  for (const candidate of candidates) {\n    if (!fs.existsSync(candidate)) continue;\n\n    try {\n      const lockContent = fs.readFileSync(candidate, 'utf8');\n      extractFromPackageResolved(lockContent, map, candidate);\n      return map; // Use first found\n    } catch (err) {\n      logWarn(`[sec:swift] Failed to parse ${candidate}: ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from Package.resolved content.\n *\n * v2 format:\n * ```json\n * { \"pins\": [{ \"identity\": \"name\", \"kind\": \"remoteSourceControl\",\n *              \"location\": \"url\", \"state\": { \"version\": \"1.2.3\" } }] }\n * ```\n *\n * v1 format:\n * ```json\n * { \"object\": { \"pins\": [{ \"package\": \"Name\", \"repositoryURL\": \"url\",\n *                          \"state\": { \"version\": \"1.2.3\" } }] } }\n * ```\n */\nfunction extractFromPackageResolved(\n  content: string,\n  map: ResolvedVersionMap,\n  filePath: string,\n): void {\n  let data: Record<string, unknown>;\n  try {\n    data = JSON.parse(content) as Record<string, unknown>;\n  } catch {\n    logWarn(`[sec:swift] ${filePath} is not valid JSON \u2014 resolved versions unavailable`);\n    return;\n  }\n\n  // Determine format version and locate pins array\n  let pins: unknown[] | null = null;\n\n  // v2: top-level `pins` array\n  if (Array.isArray(data['pins'])) {\n    pins = data['pins'] as unknown[];\n    extractPinsV2(pins, map);\n    return;\n  }\n\n  // v1: `object.pins` array\n  const obj = data['object'];\n  if (obj && typeof obj === 'object' && !Array.isArray(obj)) {\n    const objRecord = obj as Record<string, unknown>;\n    if (Array.isArray(objRecord['pins'])) {\n      pins = objRecord['pins'] as unknown[];\n      extractPinsV1(pins, map);\n      return;\n    }\n  }\n\n  logWarn(`[sec:swift] ${filePath} has unrecognised Package.resolved format \u2014 resolved versions unavailable`);\n}\n\n/**\n * Extract pins from Package.resolved v2 format.\n * Each pin has: `{ identity, kind, location, state: { version } }`\n */\nfunction extractPinsV2(pins: unknown[], map: ResolvedVersionMap): void {\n  for (const pin of pins) {\n    if (!pin || typeof pin !== 'object') continue;\n    const p = pin as Record<string, unknown>;\n    const identity = typeof p['identity'] === 'string' ? p['identity'].toLowerCase() : null;\n    const state = p['state'];\n    const version =\n      state && typeof state === 'object' && !Array.isArray(state)\n        ? (state as Record<string, unknown>)['version']\n        : null;\n    if (identity && typeof version === 'string' && version) {\n      if (!map.has(identity)) {\n        map.set(identity, version);\n      }\n    }\n  }\n}\n\n/**\n * Extract pins from Package.resolved v1 format.\n * Each pin has: `{ package, repositoryURL, state: { version } }`\n */\nfunction extractPinsV1(pins: unknown[], map: ResolvedVersionMap): void {\n  for (const pin of pins) {\n    if (!pin || typeof pin !== 'object') continue;\n    const p = pin as Record<string, unknown>;\n    // v1 uses `package` or derives name from `repositoryURL`\n    let name: string | null = null;\n    if (typeof p['package'] === 'string' && p['package']) {\n      name = p['package'].toLowerCase();\n    } else if (typeof p['repositoryURL'] === 'string') {\n      name = packageNameFromUrl(p['repositoryURL']);\n    }\n    const state = p['state'];\n    const version =\n      state && typeof state === 'object' && !Array.isArray(state)\n        ? (state as Record<string, unknown>)['version']\n        : null;\n    if (name && typeof version === 'string' && version) {\n      if (!map.has(name)) {\n        map.set(name, version);\n      }\n    }\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAyBxB,eAAsB,mBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,QAAM,WAAW,oBAAoB,WAAW;AAChD,MAAI,SAAS,OAAO,KAAK,mBAAmB,WAAW,GAAG;AAExD,WAAO,kBAAkB,UAAU,gBAAgB;AAAA,EACrD;AAGA,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,8BAA8B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC7G,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAU,wBAAwB,SAAS,gBAAgB;AACjE,SAAO,QAAQ,IAAI,CAAC,SAAS;AAAA,IAC3B,MAAM,IAAI;AAAA,IACV,oBAAoB,IAAI;AAAA,IACxB,iBAAiB,IAAI;AAAA,IACrB,OAAO;AAAA,IACP,WAAW;AAAA,IACX,gBAAgB;AAAA,EAClB,EAAE;AACJ;AAMA,SAAS,kBACP,UACA,kBACoB;AACpB,QAAM,OAA2B,CAAC;AAClC,aAAW,CAAC,MAAM,OAAO,KAAK,UAAU;AACtC,SAAK,KAAK;AAAA,MACR;AAAA,MACA,oBAAoB;AAAA,MACpB,iBAAiB;AAAA,MACjB,OAAO;AAAA,MACP,WAAW;AAAA,MACX,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAWA,SAAS,wBAAwB,SAAiB,kBAA2C;AAC3F,QAAM,OAAwB,CAAC;AAI/B,QAAM,iBAAiB;AACvB,MAAI;AAEJ,UAAQ,QAAQ,eAAe,KAAK,OAAO,OAAO,MAAM;AACtD,UAAM,MAAM,MAAM,CAAC;AACnB,UAAM,YAAY,MAAM,CAAC;AAEzB,UAAM,OAAO,mBAAmB,GAAG;AACnC,QAAI,CAAC,MAAM;AACT,iCAAQ,uDAAuD,GAAG,QAAQ,gBAAgB,kBAAa;AACvG;AAAA,IACF;AAEA,UAAM,aAAa,yBAAyB,WAAW,gBAAgB;AACvE,SAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AAAA,EAChC;AAEA,SAAO;AACT;AAMA,SAAS,yBAAyB,aAAqB,kBAAkC;AAEvF,QAAM,YAAY,YAAY,MAAM,wBAAwB;AAC5D,MAAI,UAAW,QAAO,SAAS,UAAU,CAAC,CAAC;AAG3C,QAAM,aAAa,YAAY,MAAM,yBAAyB;AAC9D,MAAI,WAAY,QAAO,UAAU,WAAW,CAAC,CAAC;AAG9C,QAAM,iBAAiB,YAAY,MAAM,kDAAkD;AAC3F,MAAI,eAAgB,QAAO,kBAAkB,eAAe,CAAC,CAAC;AAG9D,QAAM,iBAAiB,YAAY,MAAM,kDAAkD;AAC3F,MAAI,eAAgB,QAAO,kBAAkB,eAAe,CAAC,CAAC;AAG9D,QAAM,aAAa,YAAY,MAAM,kCAAkC;AACvE,MAAI,WAAY,QAAO,GAAG,WAAW,CAAC,CAAC,QAAQ,WAAW,CAAC,CAAC;AAE5D,6BAAQ,kEAAkE,gBAAgB,mBAAc;AACxG,SAAO;AACT;AAQA,SAAS,mBAAmB,KAA4B;AACtD,MAAI;AAEF,UAAM,UAAU,IAAI,QAAQ,QAAQ,EAAE;AACtC,UAAM,WAAW,QAAQ,MAAM,GAAG;AAClC,UAAM,OAAO,SAAS,SAAS,SAAS,CAAC;AACzC,QAAI,CAAC,KAAM,QAAO;AAElB,WAAO,KAAK,QAAQ,WAAW,EAAE,EAAE,YAAY;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,mBAAmB,aAA8B;AACxD,SACE,GAAG,WAAW,KAAK,KAAK,aAAa,kBAAkB,CAAC,KACxD,GAAG,WAAW,KAAK,KAAK,aAAa,UAAU,kBAAkB,CAAC;AAEtE;AASA,SAAS,oBAAoB,aAAyC;AACpE,QAAM,MAA0B,oBAAI,IAAI;AAExC,QAAM,aAAa;AAAA,IACjB,KAAK,KAAK,aAAa,kBAAkB;AAAA,IACzC,KAAK,KAAK,aAAa,UAAU,kBAAkB;AAAA,EACrD;AAEA,aAAW,aAAa,YAAY;AAClC,QAAI,CAAC,GAAG,WAAW,SAAS,EAAG;AAE/B,QAAI;AACF,YAAM,cAAc,GAAG,aAAa,WAAW,MAAM;AACrD,iCAA2B,aAAa,KAAK,SAAS;AACtD,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,iCAAQ,+BAA+B,SAAS,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,IACzG;AAAA,EACF;AAEA,SAAO;AACT;AAiBA,SAAS,2BACP,SACA,KACA,UACM;AACN,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,+BAAQ,eAAe,QAAQ,yDAAoD;AACnF;AAAA,EACF;AAGA,MAAI,OAAyB;AAG7B,MAAI,MAAM,QAAQ,KAAK,MAAM,CAAC,GAAG;AAC/B,WAAO,KAAK,MAAM;AAClB,kBAAc,MAAM,GAAG;AACvB;AAAA,EACF;AAGA,QAAM,MAAM,KAAK,QAAQ;AACzB,MAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,GAAG;AACzD,UAAM,YAAY;AAClB,QAAI,MAAM,QAAQ,UAAU,MAAM,CAAC,GAAG;AACpC,aAAO,UAAU,MAAM;AACvB,oBAAc,MAAM,GAAG;AACvB;AAAA,IACF;AAAA,EACF;AAEA,6BAAQ,eAAe,QAAQ,gFAA2E;AAC5G;AAMA,SAAS,cAAc,MAAiB,KAA+B;AACrE,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,UAAM,IAAI;AACV,UAAM,WAAW,OAAO,EAAE,UAAU,MAAM,WAAW,EAAE,UAAU,EAAE,YAAY,IAAI;AACnF,UAAM,QAAQ,EAAE,OAAO;AACvB,UAAM,UACJ,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrD,MAAkC,SAAS,IAC5C;AACN,QAAI,YAAY,OAAO,YAAY,YAAY,SAAS;AACtD,UAAI,CAAC,IAAI,IAAI,QAAQ,GAAG;AACtB,YAAI,IAAI,UAAU,OAAO;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACF;AAMA,SAAS,cAAc,MAAiB,KAA+B;AACrE,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,UAAM,IAAI;AAEV,QAAI,OAAsB;AAC1B,QAAI,OAAO,EAAE,SAAS,MAAM,YAAY,EAAE,SAAS,GAAG;AACpD,aAAO,EAAE,SAAS,EAAE,YAAY;AAAA,IAClC,WAAW,OAAO,EAAE,eAAe,MAAM,UAAU;AACjD,aAAO,mBAAmB,EAAE,eAAe,CAAC;AAAA,IAC9C;AACA,UAAM,QAAQ,EAAE,OAAO;AACvB,UAAM,UACJ,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrD,MAAkC,SAAS,IAC5C;AACN,QAAI,QAAQ,OAAO,YAAY,YAAY,SAAS;AAClD,UAAI,CAAC,IAAI,IAAI,IAAI,GAAG;AAClB,YAAI,IAAI,MAAM,OAAO;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/owasp.js

@@ -0,0 +1,104 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var owasp_exports = {};
+__export(owasp_exports, {
+  OWASP_TOP_10: () => OWASP_TOP_10,
+  mapCveToOwasp: () => mapCveToOwasp
+});
+module.exports = __toCommonJS(owasp_exports);
+const OWASP_TOP_10 = {
+  A01: {
+    category: "A01",
+    name: "Broken Access Control",
+    description: "Restrictions on authenticated users are not properly enforced.",
+    cweIds: [200, 201, 284, 285, 352, 359, 732, 862, 863, 913]
+  },
+  A02: {
+    category: "A02",
+    name: "Cryptographic Failures",
+    description: "Failures related to cryptography which often lead to exposure of sensitive data.",
+    cweIds: [261, 296, 310, 312, 315, 319, 321, 326, 327, 328, 330, 331, 335, 336, 337, 338, 340, 347, 523, 720, 757, 759, 760, 780, 818, 916]
+  },
+  A03: {
+    category: "A03",
+    name: "Injection",
+    description: "User-supplied data is not validated, filtered, or sanitized by the application.",
+    cweIds: [20, 74, 77, 78, 79, 88, 89, 90, 91, 93, 94, 95, 116, 943]
+  },
+  A04: {
+    category: "A04",
+    name: "Insecure Design",
+    description: "Missing or ineffective control design.",
+    cweIds: [73, 183, 209, 213, 235, 256, 257, 266, 269, 280, 311, 312, 313, 316, 419, 434, 444, 451, 454, 602, 620, 636, 841, 862, 1004, 1173]
+  },
+  A05: {
+    category: "A05",
+    name: "Security Misconfiguration",
+    description: "Missing appropriate security hardening across any part of the application stack.",
+    cweIds: [2, 11, 13, 15, 16, 260, 315, 520, 526, 537, 541, 548, 732]
+  },
+  A06: {
+    category: "A06",
+    name: "Vulnerable and Outdated Components",
+    description: "Components with known vulnerabilities are used.",
+    cweIds: [1035, 1104]
+  },
+  A07: {
+    category: "A07",
+    name: "Identification and Authentication Failures",
+    description: "Confirmation of user identity, authentication, and session management failures.",
+    cweIds: [255, 259, 287, 288, 290, 294, 295, 297, 300, 302, 304, 306, 307, 346, 384, 521, 613, 620, 640, 798, 940, 1216]
+  },
+  A08: {
+    category: "A08",
+    name: "Software and Data Integrity Failures",
+    description: "Code and infrastructure that does not protect against integrity violations.",
+    cweIds: [345, 353, 426, 494, 502, 565, 784, 829, 830, 915]
+  },
+  A09: {
+    category: "A09",
+    name: "Security Logging and Monitoring Failures",
+    description: "Insufficient logging, detection, monitoring, and active response.",
+    cweIds: [117, 223, 532, 778]
+  },
+  A10: {
+    category: "A10",
+    name: "Server-Side Request Forgery",
+    description: "Web application fetches a remote resource without validating user-supplied URL.",
+    cweIds: [918]
+  }
+};
+function mapCveToOwasp(summary, packageName) {
+  const text = (summary + " " + packageName).toLowerCase();
+  if (/inject|sql|xss|cross.site|script|command.inject|ldap|xpath/i.test(text)) return "A03";
+  if (/auth|authentication|session|credential|password|token|csrf|bypass/i.test(text)) return "A07";
+  if (/access.control|privilege|permission|authoriz|rbac|idor/i.test(text)) return "A01";
+  if (/crypto|encrypt|tls|ssl|cipher|hash|random|certificate/i.test(text)) return "A02";
+  if (/deserializ|pickle|marshal|prototype.pollution|supply.chain|integrity/i.test(text)) return "A08";
+  if (/ssrf|request.forgery|server.side/i.test(text)) return "A10";
+  if (/config|misconfig|default|expose|disclose|information/i.test(text)) return "A05";
+  if (/log|monitor|audit|trace/i.test(text)) return "A09";
+  return "A06";
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OWASP_TOP_10,
+  mapCveToOwasp
+});
+//# sourceMappingURL=owasp.js.map

package/dist/security/owasp.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/owasp.ts"],
+  "sourcesContent": ["/**\n * OWASP Top 10 (2021) Mapping Utility\n *\n * Maps CVE findings to OWASP categories and provides associated CWE IDs.\n */\n\nexport type OwaspCategory = 'A01' | 'A02' | 'A03' | 'A04' | 'A05' | 'A06' | 'A07' | 'A08' | 'A09' | 'A10';\n\nexport interface OwaspMapping {\n  category: OwaspCategory;\n  name: string;\n  description: string;\n  cweIds: number[];\n}\n\nexport const OWASP_TOP_10: Record<OwaspCategory, OwaspMapping> = {\n  A01: {\n    category: 'A01',\n    name: 'Broken Access Control',\n    description: 'Restrictions on authenticated users are not properly enforced.',\n    cweIds: [200, 201, 284, 285, 352, 359, 732, 862, 863, 913],\n  },\n  A02: {\n    category: 'A02',\n    name: 'Cryptographic Failures',\n    description: 'Failures related to cryptography which often lead to exposure of sensitive data.',\n    cweIds: [261, 296, 310, 312, 315, 319, 321, 326, 327, 328, 330, 331, 335, 336, 337, 338, 340, 347, 523, 720, 757, 759, 760, 780, 818, 916],\n  },\n  A03: {\n    category: 'A03',\n    name: 'Injection',\n    description: 'User-supplied data is not validated, filtered, or sanitized by the application.',\n    cweIds: [20, 74, 77, 78, 79, 88, 89, 90, 91, 93, 94, 95, 116, 943],\n  },\n  A04: {\n    category: 'A04',\n    name: 'Insecure Design',\n    description: 'Missing or ineffective control design.',\n    cweIds: [73, 183, 209, 213, 235, 256, 257, 266, 269, 280, 311, 312, 313, 316, 419, 434, 444, 451, 454, 602, 620, 636, 841, 862, 1004, 1173],\n  },\n  A05: {\n    category: 'A05',\n    name: 'Security Misconfiguration',\n    description: 'Missing appropriate security hardening across any part of the application stack.',\n    cweIds: [2, 11, 13, 15, 16, 260, 315, 520, 526, 537, 541, 548, 732],\n  },\n  A06: {\n    category: 'A06',\n    name: 'Vulnerable and Outdated Components',\n    description: 'Components with known vulnerabilities are used.',\n    cweIds: [1035, 1104],\n  },\n  A07: {\n    category: 'A07',\n    name: 'Identification and Authentication Failures',\n    description: 'Confirmation of user identity, authentication, and session management failures.',\n    cweIds: [255, 259, 287, 288, 290, 294, 295, 297, 300, 302, 304, 306, 307, 346, 384, 521, 613, 620, 640, 798, 940, 1216],\n  },\n  A08: {\n    category: 'A08',\n    name: 'Software and Data Integrity Failures',\n    description: 'Code and infrastructure that does not protect against integrity violations.',\n    cweIds: [345, 353, 426, 494, 502, 565, 784, 829, 830, 915],\n  },\n  A09: {\n    category: 'A09',\n    name: 'Security Logging and Monitoring Failures',\n    description: 'Insufficient logging, detection, monitoring, and active response.',\n    cweIds: [117, 223, 532, 778],\n  },\n  A10: {\n    category: 'A10',\n    name: 'Server-Side Request Forgery',\n    description: 'Web application fetches a remote resource without validating user-supplied URL.',\n    cweIds: [918],\n  },\n};\n\n/** Map a CVE's summary/description to the most likely OWASP category. */\nexport function mapCveToOwasp(summary: string, packageName: string): OwaspCategory {\n  const text = (summary + ' ' + packageName).toLowerCase();\n  if (/inject|sql|xss|cross.site|script|command.inject|ldap|xpath/i.test(text)) return 'A03';\n  if (/auth|authentication|session|credential|password|token|csrf|bypass/i.test(text)) return 'A07';\n  if (/access.control|privilege|permission|authoriz|rbac|idor/i.test(text)) return 'A01';\n  if (/crypto|encrypt|tls|ssl|cipher|hash|random|certificate/i.test(text)) return 'A02';\n  if (/deserializ|pickle|marshal|prototype.pollution|supply.chain|integrity/i.test(text)) return 'A08';\n  if (/ssrf|request.forgery|server.side/i.test(text)) return 'A10';\n  if (/config|misconfig|default|expose|disclose|information/i.test(text)) return 'A05';\n  if (/log|monitor|audit|trace/i.test(text)) return 'A09';\n  return 'A06'; // default: vulnerable component\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeO,MAAM,eAAoD;AAAA,EAC/D,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG;AAAA,EAC3D;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG;AAAA,EAC3I;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,GAAG;AAAA,EACnE;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI;AAAA,EAC5I;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG;AAAA,EACpE;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,MAAM,IAAI;AAAA,EACrB;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI;AAAA,EACxH;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG;AAAA,EAC3D;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,KAAK,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,GAAG;AAAA,EACd;AACF;AAGO,SAAS,cAAc,SAAiB,aAAoC;AACjF,QAAM,QAAQ,UAAU,MAAM,aAAa,YAAY;AACvD,MAAI,8DAA8D,KAAK,IAAI,EAAG,QAAO;AACrF,MAAI,qEAAqE,KAAK,IAAI,EAAG,QAAO;AAC5F,MAAI,0DAA0D,KAAK,IAAI,EAAG,QAAO;AACjF,MAAI,yDAAyD,KAAK,IAAI,EAAG,QAAO;AAChF,MAAI,wEAAwE,KAAK,IAAI,EAAG,QAAO;AAC/F,MAAI,oCAAoC,KAAK,IAAI,EAAG,QAAO;AAC3D,MAAI,wDAAwD,KAAK,IAAI,EAAG,QAAO;AAC/E,MAAI,2BAA2B,KAAK,IAAI,EAAG,QAAO;AAClD,SAAO;AACT;",
+  "names": []
+}