kirograph 0.17.0 → 0.19.0

package/dist/security/manifest/parser.js

@@ -0,0 +1,376 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var parser_exports = {};
+__export(parser_exports, {
+  ManifestParser: () => ManifestParser,
+  compareVersions: () => compareVersions,
+  deduplicateDependencies: () => deduplicateDependencies
+});
+module.exports = __toCommonJS(parser_exports);
+var import_adapter = require("./adapter");
+var import_npm = require("./plugins/npm");
+var import_maven = require("./plugins/maven");
+var import_go = require("./plugins/go");
+var import_pip = require("./plugins/pip");
+var import_cargo = require("./plugins/cargo");
+var import_nuget = require("./plugins/nuget");
+var import_gradle = require("./plugins/gradle");
+var import_rubygems = require("./plugins/rubygems");
+var import_composer = require("./plugins/composer");
+var import_swift = require("./plugins/swift");
+var import_pubspec = require("./plugins/pubspec");
+var import_hex = require("./plugins/hex");
+var import_pyproject = require("./plugins/pyproject");
+var import_errors = require("../../errors");
+function createNpmPlugin() {
+  return {
+    ecosystem: "npm",
+    manifestFiles: ["package.json"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("package.json");
+    },
+    extract: import_npm.parseNpmManifest
+  };
+}
+function createMavenPlugin() {
+  return {
+    ecosystem: "maven",
+    manifestFiles: ["pom.xml"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("pom.xml");
+    },
+    extract: import_maven.parseMavenManifest
+  };
+}
+function createGoPlugin() {
+  return {
+    ecosystem: "go",
+    manifestFiles: ["go.mod"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("go.mod");
+    },
+    extract: import_go.parseGoManifest
+  };
+}
+function createPipPlugin() {
+  return {
+    ecosystem: "python",
+    manifestFiles: ["requirements.txt"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("requirements.txt");
+    },
+    extract: import_pip.parsePipManifest
+  };
+}
+function createCargoPlugin() {
+  return {
+    ecosystem: "cargo",
+    manifestFiles: ["Cargo.toml"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("Cargo.toml");
+    },
+    extract: import_cargo.parseCargoManifest
+  };
+}
+function createNugetPlugin() {
+  return {
+    ecosystem: "csproj",
+    manifestFiles: [".csproj"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith(".csproj");
+    },
+    extract: import_nuget.parseNugetManifest
+  };
+}
+function createGradlePlugin() {
+  return {
+    ecosystem: "gradle",
+    manifestFiles: ["build.gradle", "build.gradle.kts"],
+    canExtract(manifestPath) {
+      const base = manifestPath.split("/").pop() ?? "";
+      return base === "build.gradle" || base === "build.gradle.kts";
+    },
+    extract: import_gradle.parseGradleManifest
+  };
+}
+function createPyprojectPlugin() {
+  return {
+    ecosystem: "pyproject",
+    manifestFiles: ["pyproject.toml"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("pyproject.toml");
+    },
+    extract: import_pyproject.parsePyprojectManifest
+  };
+}
+function createRubygemsPlugin() {
+  return {
+    ecosystem: "rubygems",
+    manifestFiles: ["Gemfile"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("/Gemfile") || manifestPath === "Gemfile";
+    },
+    extract: import_rubygems.parseRubygemsManifest
+  };
+}
+function createComposerPlugin() {
+  return {
+    ecosystem: "composer",
+    manifestFiles: ["composer.json"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("composer.json");
+    },
+    extract: import_composer.parseComposerManifest
+  };
+}
+function createSwiftPlugin() {
+  return {
+    ecosystem: "swift",
+    manifestFiles: ["Package.swift"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("Package.swift");
+    },
+    extract: import_swift.parseSwiftManifest
+  };
+}
+function createPubspecPlugin() {
+  return {
+    ecosystem: "pub",
+    manifestFiles: ["pubspec.yaml"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("pubspec.yaml");
+    },
+    extract: import_pubspec.parsePubspecManifest
+  };
+}
+function createHexPlugin() {
+  return {
+    ecosystem: "hex",
+    manifestFiles: ["mix.exs"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("mix.exs");
+    },
+    extract: import_hex.parseHexManifest
+  };
+}
+function compareVersions(a, b) {
+  const cleanA = a.startsWith("v") ? a.slice(1) : a;
+  const cleanB = b.startsWith("v") ? b.slice(1) : b;
+  const numericA = cleanA.replace(/^[~^>=<]+/, "");
+  const numericB = cleanB.replace(/^[~^>=<]+/, "");
+  const partsA = numericA.split(".");
+  const partsB = numericB.split(".");
+  const maxLen = Math.max(partsA.length, partsB.length);
+  for (let i = 0; i < maxLen; i++) {
+    const segA = partsA[i] ?? "0";
+    const segB = partsB[i] ?? "0";
+    const numA = parseInt(segA, 10);
+    const numB = parseInt(segB, 10);
+    if (!isNaN(numA) && !isNaN(numB)) {
+      if (numA !== numB) return numA - numB;
+      const suffixA = segA.slice(String(numA).length);
+      const suffixB = segB.slice(String(numB).length);
+      if (suffixA !== suffixB) {
+        if (suffixA && !suffixB) return -1;
+        if (!suffixA && suffixB) return 1;
+        return suffixA.localeCompare(suffixB);
+      }
+    } else {
+      const cmp = segA.localeCompare(segB);
+      if (cmp !== 0) return cmp;
+    }
+  }
+  return 0;
+}
+function getEffectiveVersion(dep) {
+  return dep.resolvedVersion ?? dep.declaredConstraint;
+}
+function deduplicateDependencies(deps) {
+  const map = /* @__PURE__ */ new Map();
+  for (const dep of deps) {
+    const key = `${dep.ecosystem}:${dep.name}`;
+    const existing = map.get(key);
+    if (!existing) {
+      map.set(key, {
+        name: dep.name,
+        ecosystem: dep.ecosystem,
+        declaredConstraint: dep.declaredConstraint,
+        resolvedVersion: dep.resolvedVersion,
+        scope: dep.scope,
+        sourceManifests: [dep.sourceManifest],
+        license: dep.license
+      });
+    } else {
+      if (!existing.sourceManifests.includes(dep.sourceManifest)) {
+        existing.sourceManifests.push(dep.sourceManifest);
+      }
+      const existingVersion = existing.resolvedVersion ?? existing.declaredConstraint;
+      const newVersion = getEffectiveVersion(dep);
+      if (compareVersions(newVersion, existingVersion) > 0) {
+        existing.declaredConstraint = dep.declaredConstraint;
+        existing.resolvedVersion = dep.resolvedVersion;
+        existing.scope = dep.scope;
+        if (dep.license !== void 0) {
+          existing.license = dep.license;
+        }
+      } else if (existing.license === void 0 && dep.license !== void 0) {
+        existing.license = dep.license;
+      }
+    }
+  }
+  return [...map.values()];
+}
+class ManifestParser {
+  constructor(db, projectRoot) {
+    this.db = db;
+    this.projectRoot = projectRoot;
+    this.adapter = new import_adapter.SecurityManifestAdapter(projectRoot);
+    this.adapter.registerPlugin(createNpmPlugin());
+    this.adapter.registerPlugin(createMavenPlugin());
+    this.adapter.registerPlugin(createGoPlugin());
+    this.adapter.registerPlugin(createPipPlugin());
+    this.adapter.registerPlugin(createCargoPlugin());
+    this.adapter.registerPlugin(createNugetPlugin());
+    this.adapter.registerPlugin(createGradlePlugin());
+    this.adapter.registerStandalonePlugin(createPyprojectPlugin());
+    this.adapter.registerStandalonePlugin(createRubygemsPlugin());
+    this.adapter.registerStandalonePlugin(createComposerPlugin());
+    this.adapter.registerStandalonePlugin(createSwiftPlugin());
+    this.adapter.registerStandalonePlugin(createPubspecPlugin());
+    this.adapter.registerStandalonePlugin(createHexPlugin());
+  }
+  /**
+   * Get the underlying adapter (useful for testing).
+   */
+  getAdapter() {
+    return this.adapter;
+  }
+  /**
+   * Run full manifest discovery, parsing, deduplication, and database persistence.
+   *
+   * Steps:
+   * 1. Discover manifest files via the adapter (reuses architecture parsers)
+   * 2. Extract dependencies with version/scope data via registered plugins
+   * 3. Deduplicate: same (name, ecosystem) → single entry with highest version
+   * 4. Create Dependency_Nodes in the database (nodes + sec_dependencies tables)
+   * 5. Create `declared_in` edges linking dependencies to their source manifests
+   */
+  async parseAll() {
+    const warnings = [];
+    const errors = [];
+    const allDeps = [];
+    const manifestPaths = this.adapter.discoverManifests();
+    let manifestsParsed = 0;
+    for (const manifestPath of manifestPaths) {
+      try {
+        const deps = await this.adapter.extractFromManifest(manifestPath);
+        if (deps.length > 0) {
+          allDeps.push(...deps);
+          manifestsParsed++;
+        } else {
+          manifestsParsed++;
+        }
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const relPath = manifestPath.replace(this.projectRoot + "/", "").replace(/\\/g, "/");
+        errors.push({ file: relPath, message });
+        (0, import_errors.logError)(`[sec:parser] Failed to parse manifest ${relPath}: ${message}`);
+      }
+    }
+    if (allDeps.length === 0) {
+      return {
+        dependenciesCreated: 0,
+        manifestsParsed,
+        warnings,
+        errors
+      };
+    }
+    const deduplicated = deduplicateDependencies(allDeps);
+    let dependenciesCreated = 0;
+    const rawDb = this.db.getRawDb();
+    for (const dep of deduplicated) {
+      try {
+        const nodeId = `dep:${dep.ecosystem}:${dep.name}`;
+        const node = {
+          id: nodeId,
+          kind: "dependency",
+          name: dep.name,
+          qualifiedName: `${dep.ecosystem}/${dep.name}`,
+          filePath: dep.sourceManifests[0] ?? "",
+          language: "unknown",
+          startLine: 0,
+          endLine: 0,
+          startColumn: 0,
+          endColumn: 0,
+          signature: dep.resolvedVersion ?? dep.declaredConstraint,
+          isExported: false,
+          isAsync: false,
+          isStatic: false,
+          isAbstract: false,
+          updatedAt: Date.now()
+        };
+        this.db.upsertNode(node);
+        rawDb.run(
+          `INSERT OR REPLACE INTO sec_dependencies
+            (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests, license)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+          [
+            nodeId,
+            dep.ecosystem,
+            dep.name,
+            dep.declaredConstraint,
+            dep.resolvedVersion ?? null,
+            dep.scope,
+            JSON.stringify(dep.sourceManifests),
+            dep.license ?? null
+          ]
+        );
+        for (const manifest of dep.sourceManifests) {
+          const edge = {
+            source: nodeId,
+            target: manifest,
+            kind: "declared_in"
+          };
+          this.db.insertEdge(edge);
+        }
+        dependenciesCreated++;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        warnings.push({
+          file: dep.sourceManifests[0] ?? "unknown",
+          message: `Failed to persist dependency ${dep.ecosystem}/${dep.name}: ${message}`
+        });
+        (0, import_errors.logWarn)(`[sec:parser] Failed to persist dependency ${dep.ecosystem}/${dep.name}: ${message}`);
+      }
+    }
+    return {
+      dependenciesCreated,
+      manifestsParsed,
+      warnings,
+      errors
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ManifestParser,
+  compareVersions,
+  deduplicateDependencies
+});
+//# sourceMappingURL=parser.js.map

package/dist/security/manifest/parser.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/manifest/parser.ts"],
+  "sourcesContent": ["/**\n * ManifestParser Orchestrator\n *\n * Orchestrates manifest discovery, version extraction, deduplication, and\n * database persistence. Uses the SecurityManifestAdapter for discovery and\n * extraction, registers all 12 version extraction plugins:\n *   Wrapped (arch parser exists): npm, maven, go, pip, cargo, nuget, gradle\n *   Standalone (no arch parser):  rubygems, composer, swift, pubspec, hex\n *\n * Node ID format: `dep:<ecosystem>:<name>` (e.g. `dep:npm:express`)\n */\nimport { SecurityManifestAdapter, type VersionExtractionPlugin } from './adapter';\nimport { parseNpmManifest } from './plugins/npm';\nimport { parseMavenManifest } from './plugins/maven';\nimport { parseGoManifest } from './plugins/go';\nimport { parsePipManifest } from './plugins/pip';\nimport { parseCargoManifest } from './plugins/cargo';\nimport { parseNugetManifest } from './plugins/nuget';\nimport { parseGradleManifest } from './plugins/gradle';\nimport { parseRubygemsManifest } from './plugins/rubygems';\nimport { parseComposerManifest } from './plugins/composer';\nimport { parseSwiftManifest } from './plugins/swift';\nimport { parsePubspecManifest } from './plugins/pubspec';\nimport { parseHexManifest } from './plugins/hex';\nimport { parsePyprojectManifest } from './plugins/pyproject';\nimport type { GraphDatabase } from '../../db/database';\nimport type { ParsedDependency, ManifestParseResult } from '../types';\nimport type { Node, Edge } from '../../types';\nimport { logWarn, logError } from '../../errors';\n\n// \u2500\u2500 Plugin Definitions \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Create the npm version extraction plugin wrapping parseNpmManifest.\n */\nfunction createNpmPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'npm',\n    manifestFiles: ['package.json'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('package.json');\n    },\n    extract: parseNpmManifest,\n  };\n}\n\n/**\n * Create the Maven version extraction plugin wrapping parseMavenManifest.\n */\nfunction createMavenPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'maven',\n    manifestFiles: ['pom.xml'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('pom.xml');\n    },\n    extract: parseMavenManifest,\n  };\n}\n\n/**\n * Create the Go version extraction plugin wrapping parseGoManifest.\n */\nfunction createGoPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'go',\n    manifestFiles: ['go.mod'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('go.mod');\n    },\n    extract: parseGoManifest,\n  };\n}\n\n/**\n * Create the pip version extraction plugin wrapping parsePipManifest.\n */\nfunction createPipPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'python',\n    manifestFiles: ['requirements.txt'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('requirements.txt');\n    },\n    extract: parsePipManifest,\n  };\n}\n\n/**\n * Create the Cargo version extraction plugin wrapping parseCargoManifest.\n */\nfunction createCargoPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'cargo',\n    manifestFiles: ['Cargo.toml'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('Cargo.toml');\n    },\n    extract: parseCargoManifest,\n  };\n}\n\n/**\n * Create the NuGet version extraction plugin wrapping parseNugetManifest.\n * ecosystem = 'csproj' to match the architecture parser name for lookup;\n * ParsedDependency.ecosystem is set to 'nuget' inside the plugin function.\n */\nfunction createNugetPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'csproj',\n    manifestFiles: ['.csproj'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('.csproj');\n    },\n    extract: parseNugetManifest,\n  };\n}\n\n/**\n * Create the Gradle version extraction plugin wrapping parseGradleManifest.\n */\nfunction createGradlePlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'gradle',\n    manifestFiles: ['build.gradle', 'build.gradle.kts'],\n    canExtract(manifestPath: string): boolean {\n      const base = manifestPath.split('/').pop() ?? '';\n      return base === 'build.gradle' || base === 'build.gradle.kts';\n    },\n    extract: parseGradleManifest,\n  };\n}\n\nfunction createPyprojectPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'pyproject',\n    manifestFiles: ['pyproject.toml'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('pyproject.toml');\n    },\n    extract: parsePyprojectManifest,\n  };\n}\n\n// \u2500\u2500 Standalone Plugin Factories \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction createRubygemsPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'rubygems',\n    manifestFiles: ['Gemfile'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('/Gemfile') || manifestPath === 'Gemfile';\n    },\n    extract: parseRubygemsManifest,\n  };\n}\n\nfunction createComposerPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'composer',\n    manifestFiles: ['composer.json'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('composer.json');\n    },\n    extract: parseComposerManifest,\n  };\n}\n\nfunction createSwiftPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'swift',\n    manifestFiles: ['Package.swift'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('Package.swift');\n    },\n    extract: parseSwiftManifest,\n  };\n}\n\nfunction createPubspecPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'pub',\n    manifestFiles: ['pubspec.yaml'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('pubspec.yaml');\n    },\n    extract: parsePubspecManifest,\n  };\n}\n\nfunction createHexPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'hex',\n    manifestFiles: ['mix.exs'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('mix.exs');\n    },\n    extract: parseHexManifest,\n  };\n}\n\n// \u2500\u2500 Version Comparison \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Compare two version strings. Returns:\n *  - positive if a > b\n *  - negative if a < b\n *  - 0 if equal\n *\n * Handles semver-like versions (1.2.3), Go pseudo-versions, and constraint\n * strings. Falls back to lexicographic comparison for non-numeric versions.\n */\nexport function compareVersions(a: string, b: string): number {\n  // Strip leading 'v' (common in Go modules)\n  const cleanA = a.startsWith('v') ? a.slice(1) : a;\n  const cleanB = b.startsWith('v') ? b.slice(1) : b;\n\n  // Strip common constraint prefixes (^, ~, >=, <=, =, >, <)\n  const numericA = cleanA.replace(/^[~^>=<]+/, '');\n  const numericB = cleanB.replace(/^[~^>=<]+/, '');\n\n  const partsA = numericA.split('.');\n  const partsB = numericB.split('.');\n\n  const maxLen = Math.max(partsA.length, partsB.length);\n  for (let i = 0; i < maxLen; i++) {\n    const segA = partsA[i] ?? '0';\n    const segB = partsB[i] ?? '0';\n\n    // Try numeric comparison first\n    const numA = parseInt(segA, 10);\n    const numB = parseInt(segB, 10);\n\n    if (!isNaN(numA) && !isNaN(numB)) {\n      if (numA !== numB) return numA - numB;\n      // If numeric parts are equal but segments differ (e.g. \"3-beta\" vs \"3\"),\n      // compare the remaining suffix\n      const suffixA = segA.slice(String(numA).length);\n      const suffixB = segB.slice(String(numB).length);\n      if (suffixA !== suffixB) {\n        // Pre-release suffixes (starting with -) are lower than no suffix\n        if (suffixA && !suffixB) return -1;\n        if (!suffixA && suffixB) return 1;\n        return suffixA.localeCompare(suffixB);\n      }\n    } else {\n      // Lexicographic fallback for non-numeric segments\n      const cmp = segA.localeCompare(segB);\n      if (cmp !== 0) return cmp;\n    }\n  }\n\n  return 0;\n}\n\n/**\n * Get the effective version string for comparison purposes.\n * Prefers resolvedVersion over declaredConstraint.\n */\nfunction getEffectiveVersion(dep: ParsedDependency): string {\n  return dep.resolvedVersion ?? dep.declaredConstraint;\n}\n\n// \u2500\u2500 Deduplication \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * A deduplicated dependency entry combining data from multiple manifests.\n */\ninterface DeduplicatedDependency {\n  name: string;\n  ecosystem: string;\n  /** The highest declared constraint across all manifests */\n  declaredConstraint: string;\n  /** The highest resolved version across all manifests (if any) */\n  resolvedVersion?: string;\n  /** Scope from the manifest with the highest version */\n  scope: ParsedDependency['scope'];\n  /** All source manifests that declared this dependency */\n  sourceManifests: string[];\n  /** License from manifest, if available */\n  license?: string;\n}\n\n/**\n * Deduplicate dependencies by (name, ecosystem) pair, keeping the entry\n * with the highest version and collecting all source manifests.\n */\nexport function deduplicateDependencies(deps: ParsedDependency[]): DeduplicatedDependency[] {\n  const map = new Map<string, DeduplicatedDependency>();\n\n  for (const dep of deps) {\n    const key = `${dep.ecosystem}:${dep.name}`;\n    const existing = map.get(key);\n\n    if (!existing) {\n      map.set(key, {\n        name: dep.name,\n        ecosystem: dep.ecosystem,\n        declaredConstraint: dep.declaredConstraint,\n        resolvedVersion: dep.resolvedVersion,\n        scope: dep.scope,\n        sourceManifests: [dep.sourceManifest],\n        license: dep.license,\n      });\n    } else {\n      // Add source manifest if not already present\n      if (!existing.sourceManifests.includes(dep.sourceManifest)) {\n        existing.sourceManifests.push(dep.sourceManifest);\n      }\n\n      // Keep the highest version\n      const existingVersion = existing.resolvedVersion ?? existing.declaredConstraint;\n      const newVersion = getEffectiveVersion(dep);\n\n      if (compareVersions(newVersion, existingVersion) > 0) {\n        existing.declaredConstraint = dep.declaredConstraint;\n        existing.resolvedVersion = dep.resolvedVersion;\n        existing.scope = dep.scope;\n        // Update license if the winning version entry has one\n        if (dep.license !== undefined) {\n          existing.license = dep.license;\n        }\n      } else if (existing.license === undefined && dep.license !== undefined) {\n        // Even if version didn't win, adopt the license if we don't have one\n        existing.license = dep.license;\n      }\n    }\n  }\n\n  return [...map.values()];\n}\n\n// \u2500\u2500 ManifestParser Class \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * ManifestParser orchestrates manifest discovery, parsing, deduplication,\n * and database persistence for the security module.\n */\nexport class ManifestParser {\n  private readonly adapter: SecurityManifestAdapter;\n  private readonly db: GraphDatabase;\n  private readonly projectRoot: string;\n\n  constructor(db: GraphDatabase, projectRoot: string) {\n    this.db = db;\n    this.projectRoot = projectRoot;\n    this.adapter = new SecurityManifestAdapter(projectRoot);\n\n    // Wrapped plugins (arch parser exists \u2014 ecosystem must match archParser.name)\n    this.adapter.registerPlugin(createNpmPlugin());\n    this.adapter.registerPlugin(createMavenPlugin());\n    this.adapter.registerPlugin(createGoPlugin());\n    this.adapter.registerPlugin(createPipPlugin());\n    this.adapter.registerPlugin(createCargoPlugin());\n    this.adapter.registerPlugin(createNugetPlugin());\n    this.adapter.registerPlugin(createGradlePlugin());\n\n    // Standalone plugins (no arch parser \u2014 own manifest discovery via manifestFiles)\n    this.adapter.registerStandalonePlugin(createPyprojectPlugin());\n    this.adapter.registerStandalonePlugin(createRubygemsPlugin());\n    this.adapter.registerStandalonePlugin(createComposerPlugin());\n    this.adapter.registerStandalonePlugin(createSwiftPlugin());\n    this.adapter.registerStandalonePlugin(createPubspecPlugin());\n    this.adapter.registerStandalonePlugin(createHexPlugin());\n  }\n\n  /**\n   * Get the underlying adapter (useful for testing).\n   */\n  getAdapter(): SecurityManifestAdapter {\n    return this.adapter;\n  }\n\n  /**\n   * Run full manifest discovery, parsing, deduplication, and database persistence.\n   *\n   * Steps:\n   * 1. Discover manifest files via the adapter (reuses architecture parsers)\n   * 2. Extract dependencies with version/scope data via registered plugins\n   * 3. Deduplicate: same (name, ecosystem) \u2192 single entry with highest version\n   * 4. Create Dependency_Nodes in the database (nodes + sec_dependencies tables)\n   * 5. Create `declared_in` edges linking dependencies to their source manifests\n   */\n  async parseAll(): Promise<ManifestParseResult> {\n    const warnings: Array<{ file: string; line?: number; message: string }> = [];\n    const errors: Array<{ file: string; message: string }> = [];\n\n    // Step 1 & 2: Discover and extract all dependencies\n    const allDeps: ParsedDependency[] = [];\n    const manifestPaths = this.adapter.discoverManifests();\n    let manifestsParsed = 0;\n\n    for (const manifestPath of manifestPaths) {\n      try {\n        const deps = await this.adapter.extractFromManifest(manifestPath);\n        if (deps.length > 0) {\n          allDeps.push(...deps);\n          manifestsParsed++;\n        } else {\n          // Manifest was parsed but had no dependencies \u2014 still counts\n          manifestsParsed++;\n        }\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        const relPath = manifestPath.replace(this.projectRoot + '/', '').replace(/\\\\/g, '/');\n        errors.push({ file: relPath, message });\n        logError(`[sec:parser] Failed to parse manifest ${relPath}: ${message}`);\n      }\n    }\n\n    if (allDeps.length === 0) {\n      return {\n        dependenciesCreated: 0,\n        manifestsParsed,\n        warnings,\n        errors,\n      };\n    }\n\n    // Step 3: Deduplicate by (name, ecosystem)\n    const deduplicated = deduplicateDependencies(allDeps);\n\n    // Step 4 & 5: Persist to database\n    let dependenciesCreated = 0;\n    const rawDb = this.db.getRawDb();\n\n    for (const dep of deduplicated) {\n      try {\n        const nodeId = `dep:${dep.ecosystem}:${dep.name}`;\n\n        // Create the node in the nodes table via upsertNode\n        const node: Node = {\n          id: nodeId,\n          kind: 'dependency',\n          name: dep.name,\n          qualifiedName: `${dep.ecosystem}/${dep.name}`,\n          filePath: dep.sourceManifests[0] ?? '',\n          language: 'unknown',\n          startLine: 0,\n          endLine: 0,\n          startColumn: 0,\n          endColumn: 0,\n          signature: dep.resolvedVersion ?? dep.declaredConstraint,\n          isExported: false,\n          isAsync: false,\n          isStatic: false,\n          isAbstract: false,\n          updatedAt: Date.now(),\n        };\n\n        this.db.upsertNode(node);\n\n        // Insert/update the sec_dependencies row\n        rawDb.run(\n          `INSERT OR REPLACE INTO sec_dependencies\n            (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests, license)\n           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n          [\n            nodeId,\n            dep.ecosystem,\n            dep.name,\n            dep.declaredConstraint,\n            dep.resolvedVersion ?? null,\n            dep.scope,\n            JSON.stringify(dep.sourceManifests),\n            dep.license ?? null,\n          ],\n        );\n\n        // Create `declared_in` edges from the dependency to each source manifest\n        for (const manifest of dep.sourceManifests) {\n          const edge: Edge = {\n            source: nodeId,\n            target: manifest,\n            kind: 'declared_in',\n          };\n          this.db.insertEdge(edge);\n        }\n\n        dependenciesCreated++;\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        warnings.push({\n          file: dep.sourceManifests[0] ?? 'unknown',\n          message: `Failed to persist dependency ${dep.ecosystem}/${dep.name}: ${message}`,\n        });\n        logWarn(`[sec:parser] Failed to persist dependency ${dep.ecosystem}/${dep.name}: ${message}`);\n      }\n    }\n\n    return {\n      dependenciesCreated,\n      manifestsParsed,\n      warnings,\n      errors,\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,qBAAsE;AACtE,iBAAiC;AACjC,mBAAmC;AACnC,gBAAgC;AAChC,iBAAiC;AACjC,mBAAmC;AACnC,mBAAmC;AACnC,oBAAoC;AACpC,sBAAsC;AACtC,sBAAsC;AACtC,mBAAmC;AACnC,qBAAqC;AACrC,iBAAiC;AACjC,uBAAuC;AAIvC,oBAAkC;AAOlC,SAAS,kBAA2C;AAClD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,cAAc;AAAA,IAC9B,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,cAAc;AAAA,IAC7C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAKA,SAAS,oBAA6C;AACpD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,SAAS;AAAA,IACzB,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,SAAS;AAAA,IACxC;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAKA,SAAS,iBAA0C;AACjD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,QAAQ;AAAA,IACxB,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,QAAQ;AAAA,IACvC;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAKA,SAAS,kBAA2C;AAClD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,kBAAkB;AAAA,IAClC,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,kBAAkB;AAAA,IACjD;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAKA,SAAS,oBAA6C;AACpD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,YAAY;AAAA,IAC5B,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,YAAY;AAAA,IAC3C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAOA,SAAS,oBAA6C;AACpD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,SAAS;AAAA,IACzB,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,SAAS;AAAA,IACxC;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAKA,SAAS,qBAA8C;AACrD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,gBAAgB,kBAAkB;AAAA,IAClD,WAAW,cAA+B;AACxC,YAAM,OAAO,aAAa,MAAM,GAAG,EAAE,IAAI,KAAK;AAC9C,aAAO,SAAS,kBAAkB,SAAS;AAAA,IAC7C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,wBAAiD;AACxD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,gBAAgB;AAAA,IAChC,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,gBAAgB;AAAA,IAC/C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAIA,SAAS,uBAAgD;AACvD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,SAAS;AAAA,IACzB,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,UAAU,KAAK,iBAAiB;AAAA,IAC/D;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,uBAAgD;AACvD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,eAAe;AAAA,IAC/B,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,eAAe;AAAA,IAC9C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,oBAA6C;AACpD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,eAAe;AAAA,IAC/B,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,eAAe;AAAA,IAC9C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,sBAA+C;AACtD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,cAAc;AAAA,IAC9B,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,cAAc;AAAA,IAC7C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,kBAA2C;AAClD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,SAAS;AAAA,IACzB,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,SAAS;AAAA,IACxC;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAaO,SAAS,gBAAgB,GAAW,GAAmB;AAE5D,QAAM,SAAS,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,CAAC,IAAI;AAChD,QAAM,SAAS,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,CAAC,IAAI;AAGhD,QAAM,WAAW,OAAO,QAAQ,aAAa,EAAE;AAC/C,QAAM,WAAW,OAAO,QAAQ,aAAa,EAAE;AAE/C,QAAM,SAAS,SAAS,MAAM,GAAG;AACjC,QAAM,SAAS,SAAS,MAAM,GAAG;AAEjC,QAAM,SAAS,KAAK,IAAI,OAAO,QAAQ,OAAO,MAAM;AACpD,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC/B,UAAM,OAAO,OAAO,CAAC,KAAK;AAC1B,UAAM,OAAO,OAAO,CAAC,KAAK;AAG1B,UAAM,OAAO,SAAS,MAAM,EAAE;AAC9B,UAAM,OAAO,SAAS,MAAM,EAAE;AAE9B,QAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;AAChC,UAAI,SAAS,KAAM,QAAO,OAAO;AAGjC,YAAM,UAAU,KAAK,MAAM,OAAO,IAAI,EAAE,MAAM;AAC9C,YAAM,UAAU,KAAK,MAAM,OAAO,IAAI,EAAE,MAAM;AAC9C,UAAI,YAAY,SAAS;AAEvB,YAAI,WAAW,CAAC,QAAS,QAAO;AAChC,YAAI,CAAC,WAAW,QAAS,QAAO;AAChC,eAAO,QAAQ,cAAc,OAAO;AAAA,MACtC;AAAA,IACF,OAAO;AAEL,YAAM,MAAM,KAAK,cAAc,IAAI;AACnC,UAAI,QAAQ,EAAG,QAAO;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,oBAAoB,KAA+B;AAC1D,SAAO,IAAI,mBAAmB,IAAI;AACpC;AA0BO,SAAS,wBAAwB,MAAoD;AAC1F,QAAM,MAAM,oBAAI,IAAoC;AAEpD,aAAW,OAAO,MAAM;AACtB,UAAM,MAAM,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI;AACxC,UAAM,WAAW,IAAI,IAAI,GAAG;AAE5B,QAAI,CAAC,UAAU;AACb,UAAI,IAAI,KAAK;AAAA,QACX,MAAM,IAAI;AAAA,QACV,WAAW,IAAI;AAAA,QACf,oBAAoB,IAAI;AAAA,QACxB,iBAAiB,IAAI;AAAA,QACrB,OAAO,IAAI;AAAA,QACX,iBAAiB,CAAC,IAAI,cAAc;AAAA,QACpC,SAAS,IAAI;AAAA,MACf,CAAC;AAAA,IACH,OAAO;AAEL,UAAI,CAAC,SAAS,gBAAgB,SAAS,IAAI,cAAc,GAAG;AAC1D,iBAAS,gBAAgB,KAAK,IAAI,cAAc;AAAA,MAClD;AAGA,YAAM,kBAAkB,SAAS,mBAAmB,SAAS;AAC7D,YAAM,aAAa,oBAAoB,GAAG;AAE1C,UAAI,gBAAgB,YAAY,eAAe,IAAI,GAAG;AACpD,iBAAS,qBAAqB,IAAI;AAClC,iBAAS,kBAAkB,IAAI;AAC/B,iBAAS,QAAQ,IAAI;AAErB,YAAI,IAAI,YAAY,QAAW;AAC7B,mBAAS,UAAU,IAAI;AAAA,QACzB;AAAA,MACF,WAAW,SAAS,YAAY,UAAa,IAAI,YAAY,QAAW;AAEtE,iBAAS,UAAU,IAAI;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,IAAI,OAAO,CAAC;AACzB;AAQO,MAAM,eAAe;AAAA,EAK1B,YAAY,IAAmB,aAAqB;AAClD,SAAK,KAAK;AACV,SAAK,cAAc;AACnB,SAAK,UAAU,IAAI,uCAAwB,WAAW;AAGtD,SAAK,QAAQ,eAAe,gBAAgB,CAAC;AAC7C,SAAK,QAAQ,eAAe,kBAAkB,CAAC;AAC/C,SAAK,QAAQ,eAAe,eAAe,CAAC;AAC5C,SAAK,QAAQ,eAAe,gBAAgB,CAAC;AAC7C,SAAK,QAAQ,eAAe,kBAAkB,CAAC;AAC/C,SAAK,QAAQ,eAAe,kBAAkB,CAAC;AAC/C,SAAK,QAAQ,eAAe,mBAAmB,CAAC;AAGhD,SAAK,QAAQ,yBAAyB,sBAAsB,CAAC;AAC7D,SAAK,QAAQ,yBAAyB,qBAAqB,CAAC;AAC5D,SAAK,QAAQ,yBAAyB,qBAAqB,CAAC;AAC5D,SAAK,QAAQ,yBAAyB,kBAAkB,CAAC;AACzD,SAAK,QAAQ,yBAAyB,oBAAoB,CAAC;AAC3D,SAAK,QAAQ,yBAAyB,gBAAgB,CAAC;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA,EAKA,aAAsC;AACpC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,WAAyC;AAC7C,UAAM,WAAoE,CAAC;AAC3E,UAAM,SAAmD,CAAC;AAG1D,UAAM,UAA8B,CAAC;AACrC,UAAM,gBAAgB,KAAK,QAAQ,kBAAkB;AACrD,QAAI,kBAAkB;AAEtB,eAAW,gBAAgB,eAAe;AACxC,UAAI;AACF,cAAM,OAAO,MAAM,KAAK,QAAQ,oBAAoB,YAAY;AAChE,YAAI,KAAK,SAAS,GAAG;AACnB,kBAAQ,KAAK,GAAG,IAAI;AACpB;AAAA,QACF,OAAO;AAEL;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,cAAM,UAAU,aAAa,QAAQ,KAAK,cAAc,KAAK,EAAE,EAAE,QAAQ,OAAO,GAAG;AACnF,eAAO,KAAK,EAAE,MAAM,SAAS,QAAQ,CAAC;AACtC,oCAAS,yCAAyC,OAAO,KAAK,OAAO,EAAE;AAAA,MACzE;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO;AAAA,QACL,qBAAqB;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,eAAe,wBAAwB,OAAO;AAGpD,QAAI,sBAAsB;AAC1B,UAAM,QAAQ,KAAK,GAAG,SAAS;AAE/B,eAAW,OAAO,cAAc;AAC9B,UAAI;AACF,cAAM,SAAS,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI;AAG/C,cAAM,OAAa;AAAA,UACjB,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,MAAM,IAAI;AAAA,UACV,eAAe,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI;AAAA,UAC3C,UAAU,IAAI,gBAAgB,CAAC,KAAK;AAAA,UACpC,UAAU;AAAA,UACV,WAAW;AAAA,UACX,SAAS;AAAA,UACT,aAAa;AAAA,UACb,WAAW;AAAA,UACX,WAAW,IAAI,mBAAmB,IAAI;AAAA,UACtC,YAAY;AAAA,UACZ,SAAS;AAAA,UACT,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,WAAW,KAAK,IAAI;AAAA,QACtB;AAEA,aAAK,GAAG,WAAW,IAAI;AAGvB,cAAM;AAAA,UACJ;AAAA;AAAA;AAAA,UAGA;AAAA,YACE;AAAA,YACA,IAAI;AAAA,YACJ,IAAI;AAAA,YACJ,IAAI;AAAA,YACJ,IAAI,mBAAmB;AAAA,YACvB,IAAI;AAAA,YACJ,KAAK,UAAU,IAAI,eAAe;AAAA,YAClC,IAAI,WAAW;AAAA,UACjB;AAAA,QACF;AAGA,mBAAW,YAAY,IAAI,iBAAiB;AAC1C,gBAAM,OAAa;AAAA,YACjB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,MAAM;AAAA,UACR;AACA,eAAK,GAAG,WAAW,IAAI;AAAA,QACzB;AAEA;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,iBAAS,KAAK;AAAA,UACZ,MAAM,IAAI,gBAAgB,CAAC,KAAK;AAAA,UAChC,SAAS,gCAAgC,IAAI,SAAS,IAAI,IAAI,IAAI,KAAK,OAAO;AAAA,QAChF,CAAC;AACD,mCAAQ,6CAA6C,IAAI,SAAS,IAAI,IAAI,IAAI,KAAK,OAAO,EAAE;AAAA,MAC9F;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/manifest/parser.test.js

@@ -0,0 +1,110 @@
+"use strict";
+var import_vitest = require("vitest");
+var import_parser = require("./parser");
+(0, import_vitest.describe)("compareVersions", () => {
+  (0, import_vitest.it)("should compare simple semver versions", () => {
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.0.0", "2.0.0")).toBeLessThan(0);
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("2.0.0", "1.0.0")).toBeGreaterThan(0);
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.0.0", "1.0.0")).toBe(0);
+  });
+  (0, import_vitest.it)("should compare versions with different patch levels", () => {
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.2.3", "1.2.4")).toBeLessThan(0);
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.2.10", "1.2.9")).toBeGreaterThan(0);
+  });
+  (0, import_vitest.it)("should compare versions with different minor levels", () => {
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.1.0", "1.2.0")).toBeLessThan(0);
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.10.0", "1.9.0")).toBeGreaterThan(0);
+  });
+  (0, import_vitest.it)("should handle versions with leading v", () => {
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("v1.2.3", "v1.2.4")).toBeLessThan(0);
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("v2.0.0", "1.0.0")).toBeGreaterThan(0);
+  });
+  (0, import_vitest.it)("should handle constraint prefixes (^, ~, >=)", () => {
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("^1.2.3", "^1.2.4")).toBeLessThan(0);
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("~2.0.0", "~1.0.0")).toBeGreaterThan(0);
+    (0, import_vitest.expect)((0, import_parser.compareVersions)(">=1.0.0", ">=2.0.0")).toBeLessThan(0);
+  });
+  (0, import_vitest.it)("should handle versions with different segment counts", () => {
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.2", "1.2.1")).toBeLessThan(0);
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.2.0", "1.2")).toBe(0);
+  });
+  (0, import_vitest.it)("should handle wildcard constraint as lowest", () => {
+    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.0.0", "*")).toBeGreaterThan(0);
+  });
+});
+(0, import_vitest.describe)("deduplicateDependencies", () => {
+  (0, import_vitest.it)("should return unique dependencies when no duplicates exist", () => {
+    const deps = [
+      { name: "express", declaredConstraint: "^4.18.0", resolvedVersion: "4.18.2", scope: "production", ecosystem: "npm", sourceManifest: "package.json" },
+      { name: "lodash", declaredConstraint: "^4.17.0", resolvedVersion: "4.17.21", scope: "production", ecosystem: "npm", sourceManifest: "package.json" }
+    ];
+    const result = (0, import_parser.deduplicateDependencies)(deps);
+    (0, import_vitest.expect)(result).toHaveLength(2);
+  });
+  (0, import_vitest.it)("should deduplicate same (name, ecosystem) keeping highest version", () => {
+    const deps = [
+      { name: "express", declaredConstraint: "^4.17.0", resolvedVersion: "4.17.1", scope: "production", ecosystem: "npm", sourceManifest: "packages/a/package.json" },
+      { name: "express", declaredConstraint: "^4.18.0", resolvedVersion: "4.18.2", scope: "production", ecosystem: "npm", sourceManifest: "packages/b/package.json" }
+    ];
+    const result = (0, import_parser.deduplicateDependencies)(deps);
+    (0, import_vitest.expect)(result).toHaveLength(1);
+    (0, import_vitest.expect)(result[0].name).toBe("express");
+    (0, import_vitest.expect)(result[0].resolvedVersion).toBe("4.18.2");
+    (0, import_vitest.expect)(result[0].declaredConstraint).toBe("^4.18.0");
+    (0, import_vitest.expect)(result[0].sourceManifests).toEqual(["packages/a/package.json", "packages/b/package.json"]);
+  });
+  (0, import_vitest.it)("should keep both when same name but different ecosystems", () => {
+    const deps = [
+      { name: "serde", declaredConstraint: "1.0.0", resolvedVersion: "1.0.0", scope: "production", ecosystem: "cargo", sourceManifest: "Cargo.toml" },
+      { name: "serde", declaredConstraint: "1.0.0", resolvedVersion: "1.0.0", scope: "production", ecosystem: "npm", sourceManifest: "package.json" }
+    ];
+    const result = (0, import_parser.deduplicateDependencies)(deps);
+    (0, import_vitest.expect)(result).toHaveLength(2);
+  });
+  (0, import_vitest.it)("should collect all source manifests for duplicates", () => {
+    const deps = [
+      { name: "lodash", declaredConstraint: "^4.17.0", resolvedVersion: "4.17.21", scope: "production", ecosystem: "npm", sourceManifest: "package.json" },
+      { name: "lodash", declaredConstraint: "^4.17.0", resolvedVersion: "4.17.21", scope: "development", ecosystem: "npm", sourceManifest: "packages/lib/package.json" },
+      { name: "lodash", declaredConstraint: "^4.17.0", resolvedVersion: "4.17.21", scope: "production", ecosystem: "npm", sourceManifest: "packages/app/package.json" }
+    ];
+    const result = (0, import_parser.deduplicateDependencies)(deps);
+    (0, import_vitest.expect)(result).toHaveLength(1);
+    (0, import_vitest.expect)(result[0].sourceManifests).toHaveLength(3);
+    (0, import_vitest.expect)(result[0].sourceManifests).toContain("package.json");
+    (0, import_vitest.expect)(result[0].sourceManifests).toContain("packages/lib/package.json");
+    (0, import_vitest.expect)(result[0].sourceManifests).toContain("packages/app/package.json");
+  });
+  (0, import_vitest.it)("should not duplicate source manifests when same manifest appears twice", () => {
+    const deps = [
+      { name: "express", declaredConstraint: "^4.17.0", scope: "production", ecosystem: "npm", sourceManifest: "package.json" },
+      { name: "express", declaredConstraint: "^4.18.0", scope: "production", ecosystem: "npm", sourceManifest: "package.json" }
+    ];
+    const result = (0, import_parser.deduplicateDependencies)(deps);
+    (0, import_vitest.expect)(result).toHaveLength(1);
+    (0, import_vitest.expect)(result[0].sourceManifests).toEqual(["package.json"]);
+  });
+  (0, import_vitest.it)("should use declaredConstraint for comparison when resolvedVersion is missing", () => {
+    const deps = [
+      { name: "django", declaredConstraint: "3.2.0", scope: "production", ecosystem: "python", sourceManifest: "requirements.txt" },
+      { name: "django", declaredConstraint: "4.2.0", scope: "production", ecosystem: "python", sourceManifest: "packages/api/requirements.txt" }
+    ];
+    const result = (0, import_parser.deduplicateDependencies)(deps);
+    (0, import_vitest.expect)(result).toHaveLength(1);
+    (0, import_vitest.expect)(result[0].declaredConstraint).toBe("4.2.0");
+  });
+  (0, import_vitest.it)("should handle empty input", () => {
+    const result = (0, import_parser.deduplicateDependencies)([]);
+    (0, import_vitest.expect)(result).toHaveLength(0);
+  });
+  (0, import_vitest.it)("should prefer resolvedVersion over declaredConstraint for comparison", () => {
+    const deps = [
+      { name: "express", declaredConstraint: "^4.0.0", resolvedVersion: "4.18.2", scope: "production", ecosystem: "npm", sourceManifest: "a/package.json" },
+      { name: "express", declaredConstraint: "^5.0.0", resolvedVersion: "5.0.0", scope: "production", ecosystem: "npm", sourceManifest: "b/package.json" }
+    ];
+    const result = (0, import_parser.deduplicateDependencies)(deps);
+    (0, import_vitest.expect)(result).toHaveLength(1);
+    (0, import_vitest.expect)(result[0].resolvedVersion).toBe("5.0.0");
+    (0, import_vitest.expect)(result[0].declaredConstraint).toBe("^5.0.0");
+  });
+});
+//# sourceMappingURL=parser.test.js.map

package/dist/security/manifest/parser.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/manifest/parser.test.ts"],
+  "sourcesContent": ["/**\n * Unit tests for ManifestParser orchestrator\n */\nimport { describe, it, expect } from 'vitest';\nimport { compareVersions, deduplicateDependencies } from './parser';\nimport type { ParsedDependency } from '../types';\n\ndescribe('compareVersions', () => {\n  it('should compare simple semver versions', () => {\n    expect(compareVersions('1.0.0', '2.0.0')).toBeLessThan(0);\n    expect(compareVersions('2.0.0', '1.0.0')).toBeGreaterThan(0);\n    expect(compareVersions('1.0.0', '1.0.0')).toBe(0);\n  });\n\n  it('should compare versions with different patch levels', () => {\n    expect(compareVersions('1.2.3', '1.2.4')).toBeLessThan(0);\n    expect(compareVersions('1.2.10', '1.2.9')).toBeGreaterThan(0);\n  });\n\n  it('should compare versions with different minor levels', () => {\n    expect(compareVersions('1.1.0', '1.2.0')).toBeLessThan(0);\n    expect(compareVersions('1.10.0', '1.9.0')).toBeGreaterThan(0);\n  });\n\n  it('should handle versions with leading v', () => {\n    expect(compareVersions('v1.2.3', 'v1.2.4')).toBeLessThan(0);\n    expect(compareVersions('v2.0.0', '1.0.0')).toBeGreaterThan(0);\n  });\n\n  it('should handle constraint prefixes (^, ~, >=)', () => {\n    expect(compareVersions('^1.2.3', '^1.2.4')).toBeLessThan(0);\n    expect(compareVersions('~2.0.0', '~1.0.0')).toBeGreaterThan(0);\n    expect(compareVersions('>=1.0.0', '>=2.0.0')).toBeLessThan(0);\n  });\n\n  it('should handle versions with different segment counts', () => {\n    expect(compareVersions('1.2', '1.2.1')).toBeLessThan(0);\n    expect(compareVersions('1.2.0', '1.2')).toBe(0);\n  });\n\n  it('should handle wildcard constraint as lowest', () => {\n    // '*' is not numeric, so it falls to lexicographic comparison\n    // but in practice we compare effective versions\n    expect(compareVersions('1.0.0', '*')).toBeGreaterThan(0);\n  });\n});\n\ndescribe('deduplicateDependencies', () => {\n  it('should return unique dependencies when no duplicates exist', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'express', declaredConstraint: '^4.18.0', resolvedVersion: '4.18.2', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n      { name: 'lodash', declaredConstraint: '^4.17.0', resolvedVersion: '4.17.21', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(2);\n  });\n\n  it('should deduplicate same (name, ecosystem) keeping highest version', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'express', declaredConstraint: '^4.17.0', resolvedVersion: '4.17.1', scope: 'production', ecosystem: 'npm', sourceManifest: 'packages/a/package.json' },\n      { name: 'express', declaredConstraint: '^4.18.0', resolvedVersion: '4.18.2', scope: 'production', ecosystem: 'npm', sourceManifest: 'packages/b/package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(1);\n    expect(result[0].name).toBe('express');\n    expect(result[0].resolvedVersion).toBe('4.18.2');\n    expect(result[0].declaredConstraint).toBe('^4.18.0');\n    expect(result[0].sourceManifests).toEqual(['packages/a/package.json', 'packages/b/package.json']);\n  });\n\n  it('should keep both when same name but different ecosystems', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'serde', declaredConstraint: '1.0.0', resolvedVersion: '1.0.0', scope: 'production', ecosystem: 'cargo', sourceManifest: 'Cargo.toml' },\n      { name: 'serde', declaredConstraint: '1.0.0', resolvedVersion: '1.0.0', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(2);\n  });\n\n  it('should collect all source manifests for duplicates', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'lodash', declaredConstraint: '^4.17.0', resolvedVersion: '4.17.21', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n      { name: 'lodash', declaredConstraint: '^4.17.0', resolvedVersion: '4.17.21', scope: 'development', ecosystem: 'npm', sourceManifest: 'packages/lib/package.json' },\n      { name: 'lodash', declaredConstraint: '^4.17.0', resolvedVersion: '4.17.21', scope: 'production', ecosystem: 'npm', sourceManifest: 'packages/app/package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(1);\n    expect(result[0].sourceManifests).toHaveLength(3);\n    expect(result[0].sourceManifests).toContain('package.json');\n    expect(result[0].sourceManifests).toContain('packages/lib/package.json');\n    expect(result[0].sourceManifests).toContain('packages/app/package.json');\n  });\n\n  it('should not duplicate source manifests when same manifest appears twice', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'express', declaredConstraint: '^4.17.0', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n      { name: 'express', declaredConstraint: '^4.18.0', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(1);\n    expect(result[0].sourceManifests).toEqual(['package.json']);\n  });\n\n  it('should use declaredConstraint for comparison when resolvedVersion is missing', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'django', declaredConstraint: '3.2.0', scope: 'production', ecosystem: 'python', sourceManifest: 'requirements.txt' },\n      { name: 'django', declaredConstraint: '4.2.0', scope: 'production', ecosystem: 'python', sourceManifest: 'packages/api/requirements.txt' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(1);\n    expect(result[0].declaredConstraint).toBe('4.2.0');\n  });\n\n  it('should handle empty input', () => {\n    const result = deduplicateDependencies([]);\n    expect(result).toHaveLength(0);\n  });\n\n  it('should prefer resolvedVersion over declaredConstraint for comparison', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'express', declaredConstraint: '^4.0.0', resolvedVersion: '4.18.2', scope: 'production', ecosystem: 'npm', sourceManifest: 'a/package.json' },\n      { name: 'express', declaredConstraint: '^5.0.0', resolvedVersion: '5.0.0', scope: 'production', ecosystem: 'npm', sourceManifest: 'b/package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(1);\n    expect(result[0].resolvedVersion).toBe('5.0.0');\n    expect(result[0].declaredConstraint).toBe('^5.0.0');\n  });\n});\n"],
+  "mappings": ";AAGA,oBAAqC;AACrC,oBAAyD;AAAA,IAGzD,wBAAS,mBAAmB,MAAM;AAChC,wBAAG,yCAAyC,MAAM;AAChD,kCAAO,+BAAgB,SAAS,OAAO,CAAC,EAAE,aAAa,CAAC;AACxD,kCAAO,+BAAgB,SAAS,OAAO,CAAC,EAAE,gBAAgB,CAAC;AAC3D,kCAAO,+BAAgB,SAAS,OAAO,CAAC,EAAE,KAAK,CAAC;AAAA,EAClD,CAAC;AAED,wBAAG,uDAAuD,MAAM;AAC9D,kCAAO,+BAAgB,SAAS,OAAO,CAAC,EAAE,aAAa,CAAC;AACxD,kCAAO,+BAAgB,UAAU,OAAO,CAAC,EAAE,gBAAgB,CAAC;AAAA,EAC9D,CAAC;AAED,wBAAG,uDAAuD,MAAM;AAC9D,kCAAO,+BAAgB,SAAS,OAAO,CAAC,EAAE,aAAa,CAAC;AACxD,kCAAO,+BAAgB,UAAU,OAAO,CAAC,EAAE,gBAAgB,CAAC;AAAA,EAC9D,CAAC;AAED,wBAAG,yCAAyC,MAAM;AAChD,kCAAO,+BAAgB,UAAU,QAAQ,CAAC,EAAE,aAAa,CAAC;AAC1D,kCAAO,+BAAgB,UAAU,OAAO,CAAC,EAAE,gBAAgB,CAAC;AAAA,EAC9D,CAAC;AAED,wBAAG,gDAAgD,MAAM;AACvD,kCAAO,+BAAgB,UAAU,QAAQ,CAAC,EAAE,aAAa,CAAC;AAC1D,kCAAO,+BAAgB,UAAU,QAAQ,CAAC,EAAE,gBAAgB,CAAC;AAC7D,kCAAO,+BAAgB,WAAW,SAAS,CAAC,EAAE,aAAa,CAAC;AAAA,EAC9D,CAAC;AAED,wBAAG,wDAAwD,MAAM;AAC/D,kCAAO,+BAAgB,OAAO,OAAO,CAAC,EAAE,aAAa,CAAC;AACtD,kCAAO,+BAAgB,SAAS,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EAChD,CAAC;AAED,wBAAG,+CAA+C,MAAM;AAGtD,kCAAO,+BAAgB,SAAS,GAAG,CAAC,EAAE,gBAAgB,CAAC;AAAA,EACzD,CAAC;AACH,CAAC;AAAA,IAED,wBAAS,2BAA2B,MAAM;AACxC,wBAAG,8DAA8D,MAAM;AACrE,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,WAAW,oBAAoB,WAAW,iBAAiB,UAAU,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,MACnJ,EAAE,MAAM,UAAU,oBAAoB,WAAW,iBAAiB,WAAW,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,IACrJ;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EAC/B,CAAC;AAED,wBAAG,qEAAqE,MAAM;AAC5E,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,WAAW,oBAAoB,WAAW,iBAAiB,UAAU,OAAO,cAAc,WAAW,OAAO,gBAAgB,0BAA0B;AAAA,MAC9J,EAAE,MAAM,WAAW,oBAAoB,WAAW,iBAAiB,UAAU,OAAO,cAAc,WAAW,OAAO,gBAAgB,0BAA0B;AAAA,IAChK;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS;AACrC,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,KAAK,QAAQ;AAC/C,8BAAO,OAAO,CAAC,EAAE,kBAAkB,EAAE,KAAK,SAAS;AACnD,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,2BAA2B,yBAAyB,CAAC;AAAA,EAClG,CAAC;AAED,wBAAG,4DAA4D,MAAM;AACnE,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,SAAS,oBAAoB,SAAS,iBAAiB,SAAS,OAAO,cAAc,WAAW,SAAS,gBAAgB,aAAa;AAAA,MAC9I,EAAE,MAAM,SAAS,oBAAoB,SAAS,iBAAiB,SAAS,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,IAChJ;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EAC/B,CAAC;AAED,wBAAG,sDAAsD,MAAM;AAC7D,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,UAAU,oBAAoB,WAAW,iBAAiB,WAAW,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,MACnJ,EAAE,MAAM,UAAU,oBAAoB,WAAW,iBAAiB,WAAW,OAAO,eAAe,WAAW,OAAO,gBAAgB,4BAA4B;AAAA,MACjK,EAAE,MAAM,UAAU,oBAAoB,WAAW,iBAAiB,WAAW,OAAO,cAAc,WAAW,OAAO,gBAAgB,4BAA4B;AAAA,IAClK;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,aAAa,CAAC;AAChD,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,cAAc;AAC1D,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,2BAA2B;AACvE,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,2BAA2B;AAAA,EACzE,CAAC;AAED,wBAAG,0EAA0E,MAAM;AACjF,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,WAAW,oBAAoB,WAAW,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,MACxH,EAAE,MAAM,WAAW,oBAAoB,WAAW,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,IAC1H;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,cAAc,CAAC;AAAA,EAC5D,CAAC;AAED,wBAAG,gFAAgF,MAAM;AACvF,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,UAAU,oBAAoB,SAAS,OAAO,cAAc,WAAW,UAAU,gBAAgB,mBAAmB;AAAA,MAC5H,EAAE,MAAM,UAAU,oBAAoB,SAAS,OAAO,cAAc,WAAW,UAAU,gBAAgB,gCAAgC;AAAA,IAC3I;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,kBAAkB,EAAE,KAAK,OAAO;AAAA,EACnD,CAAC;AAED,wBAAG,6BAA6B,MAAM;AACpC,UAAM,aAAS,uCAAwB,CAAC,CAAC;AACzC,8BAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EAC/B,CAAC;AAED,wBAAG,wEAAwE,MAAM;AAC/E,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,WAAW,oBAAoB,UAAU,iBAAiB,UAAU,OAAO,cAAc,WAAW,OAAO,gBAAgB,iBAAiB;AAAA,MACpJ,EAAE,MAAM,WAAW,oBAAoB,UAAU,iBAAiB,SAAS,OAAO,cAAc,WAAW,OAAO,gBAAgB,iBAAiB;AAAA,IACrJ;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,KAAK,OAAO;AAC9C,8BAAO,OAAO,CAAC,EAAE,kBAAkB,EAAE,KAAK,QAAQ;AAAA,EACpD,CAAC;AACH,CAAC;",
+  "names": []
+}