kirograph 0.17.0 → 0.19.0

package/dist/security/manifest/plugins/cargo.js

@@ -0,0 +1,233 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var cargo_exports = {};
+__export(cargo_exports, {
+  parseCargoManifest: () => parseCargoManifest
+});
+module.exports = __toCommonJS(cargo_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+const SECTION_SCOPES = [
+  { section: "dependencies", scope: "production" },
+  { section: "dev-dependencies", scope: "development" },
+  { section: "build-dependencies", scope: "development" }
+];
+async function parseCargoManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:cargo] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const license = extractCargoLicense(content);
+  const dependencies = [];
+  for (const { section, scope } of SECTION_SCOPES) {
+    const sectionDeps = extractSectionDependencies(content, section, relativeManifest);
+    for (const dep of sectionDeps) {
+      const resolvedVersion = resolvedVersions.get(dep.name);
+      dependencies.push({
+        name: dep.name,
+        declaredConstraint: dep.constraint,
+        resolvedVersion,
+        scope,
+        ecosystem: "cargo",
+        sourceManifest: relativeManifest,
+        ...license !== void 0 ? { license } : {}
+      });
+    }
+  }
+  return dependencies;
+}
+function extractSectionDependencies(content, section, relativeManifest) {
+  const deps = [];
+  const sectionRegex = new RegExp(`^\\[${escapeRegex(section)}\\]\\s*$`, "m");
+  const sectionMatch = sectionRegex.exec(content);
+  if (sectionMatch) {
+    const startIdx = sectionMatch.index + sectionMatch[0].length;
+    const remaining = content.slice(startIdx);
+    const nextSectionMatch = remaining.match(/^\[/m);
+    const sectionContent = nextSectionMatch ? remaining.slice(0, nextSectionMatch.index) : remaining;
+    const lines = sectionContent.split("\n");
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (trimmed === "" || trimmed.startsWith("#")) continue;
+      const dep = parseDependencyLine(trimmed, relativeManifest, section);
+      if (dep) {
+        deps.push(dep);
+      }
+    }
+  }
+  const tableRegex = new RegExp(`^\\[${escapeRegex(section)}\\.([^\\]]+)\\]\\s*$`, "gm");
+  let tableMatch;
+  while ((tableMatch = tableRegex.exec(content)) !== null) {
+    const depName = tableMatch[1].trim();
+    const startIdx = tableMatch.index + tableMatch[0].length;
+    const remaining = content.slice(startIdx);
+    const nextSectionMatch = remaining.match(/^\[/m);
+    const tableContent = nextSectionMatch ? remaining.slice(0, nextSectionMatch.index) : remaining;
+    const version = extractVersionFromTable(tableContent);
+    if (version) {
+      deps.push({ name: depName, constraint: version });
+    } else {
+      deps.push({ name: depName, constraint: "*" });
+    }
+  }
+  return deps;
+}
+function parseDependencyLine(line, relativeManifest, section) {
+  const simpleMatch = line.match(/^([a-zA-Z0-9_-]+)\s*=\s*"([^"]*)"$/);
+  if (simpleMatch) {
+    const name = simpleMatch[1];
+    const constraint = simpleMatch[2];
+    if (!isValidCrateName(name)) {
+      (0, import_errors.logWarn)(`[sec:cargo] Invalid crate name "${name}" in ${relativeManifest} [${section}] \u2014 skipping`);
+      return null;
+    }
+    if (constraint.trim() === "") {
+      (0, import_errors.logWarn)(`[sec:cargo] Empty version constraint for "${name}" in ${relativeManifest} [${section}] \u2014 skipping`);
+      return null;
+    }
+    return { name, constraint };
+  }
+  const tableMatch = line.match(/^([a-zA-Z0-9_-]+)\s*=\s*\{(.*)\}\s*$/);
+  if (tableMatch) {
+    const name = tableMatch[1];
+    const tableContent = tableMatch[2];
+    if (!isValidCrateName(name)) {
+      (0, import_errors.logWarn)(`[sec:cargo] Invalid crate name "${name}" in ${relativeManifest} [${section}] \u2014 skipping`);
+      return null;
+    }
+    const version = extractVersionFromInlineTable(tableContent);
+    if (version) {
+      return { name, constraint: version };
+    }
+    return { name, constraint: "*" };
+  }
+  if (line.includes("=") && !line.startsWith("#")) {
+    const possibleName = line.split("=")[0].trim();
+    if (possibleName && /^[a-zA-Z0-9_-]+$/.test(possibleName)) {
+      (0, import_errors.logWarn)(`[sec:cargo] Could not parse dependency line in ${relativeManifest} [${section}]: "${line}" \u2014 skipping`);
+    }
+  }
+  return null;
+}
+function extractVersionFromInlineTable(tableContent) {
+  const versionMatch = tableContent.match(/version\s*=\s*"([^"]*)"/);
+  if (versionMatch && versionMatch[1].trim() !== "") {
+    return versionMatch[1];
+  }
+  return null;
+}
+function extractVersionFromTable(tableContent) {
+  const lines = tableContent.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const versionMatch = trimmed.match(/^version\s*=\s*"([^"]*)"$/);
+    if (versionMatch && versionMatch[1].trim() !== "") {
+      return versionMatch[1];
+    }
+  }
+  return null;
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const lockPath = path.join(manifestDir, "Cargo.lock");
+  if (!fs.existsSync(lockPath)) {
+    return map;
+  }
+  try {
+    const lockContent = fs.readFileSync(lockPath, "utf8");
+    extractFromCargoLock(lockContent, map);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:cargo] Failed to parse Cargo.lock: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function extractFromCargoLock(content, map) {
+  const lines = content.split("\n");
+  let currentName = null;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === "[[package]]") {
+      currentName = null;
+      continue;
+    }
+    if (currentName === null) {
+      const nameMatch = trimmed.match(/^name\s*=\s*"([^"]+)"$/);
+      if (nameMatch) {
+        currentName = nameMatch[1];
+        continue;
+      }
+    }
+    if (currentName !== null) {
+      const versionMatch = trimmed.match(/^version\s*=\s*"([^"]+)"$/);
+      if (versionMatch) {
+        if (!map.has(currentName)) {
+          map.set(currentName, versionMatch[1]);
+        }
+        currentName = null;
+        continue;
+      }
+    }
+    if (trimmed === "" || trimmed.startsWith("[")) {
+      currentName = null;
+    }
+  }
+}
+function isValidCrateName(name) {
+  if (!name || typeof name !== "string") return false;
+  if (name.length > 64) return false;
+  return /^[a-zA-Z][a-zA-Z0-9_-]*$/.test(name);
+}
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function extractCargoLicense(content) {
+  const packageSectionMatch = /^\[package\]\s*$/m.exec(content);
+  if (!packageSectionMatch) return void 0;
+  const startIdx = packageSectionMatch.index + packageSectionMatch[0].length;
+  const remaining = content.slice(startIdx);
+  const nextSection = remaining.match(/^\[/m);
+  const sectionContent = nextSection ? remaining.slice(0, nextSection.index) : remaining;
+  const licenseMatch = sectionContent.match(/^license\s*=\s*"([^"]+)"/m);
+  if (licenseMatch && licenseMatch[1].trim() !== "") {
+    return licenseMatch[1].trim();
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseCargoManifest
+});
+//# sourceMappingURL=cargo.js.map

package/dist/security/manifest/plugins/cargo.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/cargo.ts"],
+  "sourcesContent": ["/**\n * Cargo Version Extraction Plugin for KiroGraph-Sec\n *\n * Extends the existing architecture cargo parser to extract version constraints,\n * resolved versions (from Cargo.lock), and dependency scopes for security analysis.\n *\n * Reuses `cargoParser` from `src/architecture/manifest/cargo.ts` for discovery and\n * basic parsing, then layers on version/scope extraction.\n *\n * Handles both simple format (`serde = \"1.0\"`) and table format\n * (`serde = { version = \"1.0\", features = [\"derive\"] }`).\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Dependency section headers in Cargo.toml mapped to their ParsedDependency scope.\n */\nconst SECTION_SCOPES: Array<{ section: string; scope: ParsedDependency['scope'] }> = [\n  { section: 'dependencies', scope: 'production' },\n  { section: 'dev-dependencies', scope: 'development' },\n  { section: 'build-dependencies', scope: 'development' },\n];\n\n/**\n * Resolved version map: package name \u2192 resolved version string.\n * Built from Cargo.lock.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * Parse a Cargo.toml manifest and extract dependency declarations\n * with version constraints, scopes, and resolved versions from Cargo.lock.\n *\n * @param manifestPath - Absolute path to the Cargo.toml file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parseCargoManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read the Cargo.toml content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:cargo] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Attempt to load resolved versions from Cargo.lock\n  const resolvedVersions = loadResolvedVersions(manifestDir);\n\n  // Extract the package-level license from [package] section\n  const license = extractCargoLicense(content);\n\n  // Extract dependencies from each section\n  const dependencies: ParsedDependency[] = [];\n\n  for (const { section, scope } of SECTION_SCOPES) {\n    const sectionDeps = extractSectionDependencies(content, section, relativeManifest);\n    for (const dep of sectionDeps) {\n      const resolvedVersion = resolvedVersions.get(dep.name);\n      dependencies.push({\n        name: dep.name,\n        declaredConstraint: dep.constraint,\n        resolvedVersion,\n        scope,\n        ecosystem: 'cargo',\n        sourceManifest: relativeManifest,\n        ...(license !== undefined ? { license } : {}),\n      });\n    }\n  }\n\n  return dependencies;\n}\n\n/**\n * A raw dependency entry extracted from a TOML section.\n */\ninterface RawDependency {\n  name: string;\n  constraint: string;\n}\n\n/**\n * Extract dependencies from a specific section of a Cargo.toml file.\n * Handles both simple (`name = \"version\"`) and table (`name = { version = \"...\" }`) formats.\n * Also handles `[<section>.<name>]` table headers for individual dependency configuration.\n */\nfunction extractSectionDependencies(\n  content: string,\n  section: string,\n  relativeManifest: string,\n): RawDependency[] {\n  const deps: RawDependency[] = [];\n\n  // Pattern 1: Inline section [dependencies] / [dev-dependencies] / [build-dependencies]\n  // Match the section header and capture everything until the next section header\n  const sectionRegex = new RegExp(`^\\\\[${escapeRegex(section)}\\\\]\\\\s*$`, 'm');\n  const sectionMatch = sectionRegex.exec(content);\n\n  if (sectionMatch) {\n    const startIdx = sectionMatch.index + sectionMatch[0].length;\n    // Find the next section header (line starting with [)\n    const remaining = content.slice(startIdx);\n    const nextSectionMatch = remaining.match(/^\\[/m);\n    const sectionContent = nextSectionMatch\n      ? remaining.slice(0, nextSectionMatch.index)\n      : remaining;\n\n    const lines = sectionContent.split('\\n');\n    for (const line of lines) {\n      const trimmed = line.trim();\n      if (trimmed === '' || trimmed.startsWith('#')) continue;\n\n      const dep = parseDependencyLine(trimmed, relativeManifest, section);\n      if (dep) {\n        deps.push(dep);\n      }\n    }\n  }\n\n  // Pattern 2: Table-style individual dependency sections\n  // e.g., [dependencies.serde] or [dev-dependencies.tokio]\n  const tableRegex = new RegExp(`^\\\\[${escapeRegex(section)}\\\\.([^\\\\]]+)\\\\]\\\\s*$`, 'gm');\n  let tableMatch: RegExpExecArray | null;\n  while ((tableMatch = tableRegex.exec(content)) !== null) {\n    const depName = tableMatch[1].trim();\n    const startIdx = tableMatch.index + tableMatch[0].length;\n    const remaining = content.slice(startIdx);\n    const nextSectionMatch = remaining.match(/^\\[/m);\n    const tableContent = nextSectionMatch\n      ? remaining.slice(0, nextSectionMatch.index)\n      : remaining;\n\n    const version = extractVersionFromTable(tableContent);\n    if (version) {\n      deps.push({ name: depName, constraint: version });\n    } else {\n      // If no version specified, it might use path/git \u2014 use \"*\" as constraint\n      deps.push({ name: depName, constraint: '*' });\n    }\n  }\n\n  return deps;\n}\n\n/**\n * Parse a single dependency line from a Cargo.toml section.\n *\n * Handles:\n * - Simple string: `serde = \"1.0\"`\n * - Inline table: `serde = { version = \"1.0\", features = [\"derive\"] }`\n * - Path/git dependencies without version: `my-lib = { path = \"../my-lib\" }`\n */\nfunction parseDependencyLine(\n  line: string,\n  relativeManifest: string,\n  section: string,\n): RawDependency | null {\n  // Match: name = \"version\" or name = '...'\n  const simpleMatch = line.match(/^([a-zA-Z0-9_-]+)\\s*=\\s*\"([^\"]*)\"$/);\n  if (simpleMatch) {\n    const name = simpleMatch[1];\n    const constraint = simpleMatch[2];\n    if (!isValidCrateName(name)) {\n      logWarn(`[sec:cargo] Invalid crate name \"${name}\" in ${relativeManifest} [${section}] \u2014 skipping`);\n      return null;\n    }\n    if (constraint.trim() === '') {\n      logWarn(`[sec:cargo] Empty version constraint for \"${name}\" in ${relativeManifest} [${section}] \u2014 skipping`);\n      return null;\n    }\n    return { name, constraint };\n  }\n\n  // Match: name = { version = \"...\", ... }\n  const tableMatch = line.match(/^([a-zA-Z0-9_-]+)\\s*=\\s*\\{(.*)\\}\\s*$/);\n  if (tableMatch) {\n    const name = tableMatch[1];\n    const tableContent = tableMatch[2];\n    if (!isValidCrateName(name)) {\n      logWarn(`[sec:cargo] Invalid crate name \"${name}\" in ${relativeManifest} [${section}] \u2014 skipping`);\n      return null;\n    }\n\n    const version = extractVersionFromInlineTable(tableContent);\n    if (version) {\n      return { name, constraint: version };\n    }\n\n    // No version field \u2014 path or git dependency, use \"*\" as constraint\n    return { name, constraint: '*' };\n  }\n\n  // Line doesn't match expected formats \u2014 could be a comment or malformed\n  // Only warn if it looks like it was intended to be a dependency\n  if (line.includes('=') && !line.startsWith('#')) {\n    const possibleName = line.split('=')[0].trim();\n    if (possibleName && /^[a-zA-Z0-9_-]+$/.test(possibleName)) {\n      logWarn(`[sec:cargo] Could not parse dependency line in ${relativeManifest} [${section}]: \"${line}\" \u2014 skipping`);\n    }\n  }\n\n  return null;\n}\n\n/**\n * Extract the version field from an inline table string.\n * e.g., from `version = \"1.0\", features = [\"derive\"]` \u2192 \"1.0\"\n */\nfunction extractVersionFromInlineTable(tableContent: string): string | null {\n  const versionMatch = tableContent.match(/version\\s*=\\s*\"([^\"]*)\"/);\n  if (versionMatch && versionMatch[1].trim() !== '') {\n    return versionMatch[1];\n  }\n  return null;\n}\n\n/**\n * Extract the version field from a multi-line table section.\n * e.g., from lines like `version = \"1.0\"`\n */\nfunction extractVersionFromTable(tableContent: string): string | null {\n  const lines = tableContent.split('\\n');\n  for (const line of lines) {\n    const trimmed = line.trim();\n    const versionMatch = trimmed.match(/^version\\s*=\\s*\"([^\"]*)\"$/);\n    if (versionMatch && versionMatch[1].trim() !== '') {\n      return versionMatch[1];\n    }\n  }\n  return null;\n}\n\n/**\n * Attempt to load resolved versions from Cargo.lock in the given directory.\n * Returns an empty map if Cargo.lock is not available.\n *\n * Cargo.lock format uses [[package]] blocks:\n * ```\n * [[package]]\n * name = \"serde\"\n * version = \"1.0.193\"\n * ```\n */\nfunction loadResolvedVersions(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  const lockPath = path.join(manifestDir, 'Cargo.lock');\n  if (!fs.existsSync(lockPath)) {\n    return map;\n  }\n\n  try {\n    const lockContent = fs.readFileSync(lockPath, 'utf8');\n    extractFromCargoLock(lockContent, map);\n  } catch (err) {\n    logWarn(`[sec:cargo] Failed to parse Cargo.lock: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from Cargo.lock content.\n *\n * Cargo.lock uses [[package]] blocks with name and version fields:\n * ```\n * [[package]]\n * name = \"serde\"\n * version = \"1.0.193\"\n * source = \"registry+https://github.com/rust-lang/crates.io-index\"\n * ```\n */\nfunction extractFromCargoLock(content: string, map: ResolvedVersionMap): void {\n  const lines = content.split('\\n');\n  let currentName: string | null = null;\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n\n    // New package block\n    if (trimmed === '[[package]]') {\n      currentName = null;\n      continue;\n    }\n\n    // Name field within a package block\n    if (currentName === null) {\n      const nameMatch = trimmed.match(/^name\\s*=\\s*\"([^\"]+)\"$/);\n      if (nameMatch) {\n        currentName = nameMatch[1];\n        continue;\n      }\n    }\n\n    // Version field within a package block (after name is set)\n    if (currentName !== null) {\n      const versionMatch = trimmed.match(/^version\\s*=\\s*\"([^\"]+)\"$/);\n      if (versionMatch) {\n        // Only store the first occurrence (highest version is typically last,\n        // but Cargo.lock lists the resolved version for each unique instance)\n        if (!map.has(currentName)) {\n          map.set(currentName, versionMatch[1]);\n        }\n        currentName = null;\n        continue;\n      }\n    }\n\n    // Reset on empty line or new section\n    if (trimmed === '' || trimmed.startsWith('[')) {\n      currentName = null;\n    }\n  }\n}\n\n/**\n * Validate that a crate name follows Rust/Cargo naming conventions.\n * Crate names must be non-empty and contain only alphanumeric characters,\n * hyphens, or underscores.\n */\nfunction isValidCrateName(name: string): boolean {\n  if (!name || typeof name !== 'string') return false;\n  if (name.length > 64) return false;\n  return /^[a-zA-Z][a-zA-Z0-9_-]*$/.test(name);\n}\n\n/**\n * Escape special regex characters in a string.\n */\nfunction escapeRegex(str: string): string {\n  return str.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\n/**\n * Extract the license field from the [package] section of a Cargo.toml.\n * Handles: license = \"MIT\" or license = \"MIT OR Apache-2.0\"\n */\nfunction extractCargoLicense(content: string): string | undefined {\n  // Find the [package] section\n  const packageSectionMatch = /^\\[package\\]\\s*$/m.exec(content);\n  if (!packageSectionMatch) return undefined;\n\n  const startIdx = packageSectionMatch.index + packageSectionMatch[0].length;\n  const remaining = content.slice(startIdx);\n  // Grab content up to the next section header\n  const nextSection = remaining.match(/^\\[/m);\n  const sectionContent = nextSection ? remaining.slice(0, nextSection.index) : remaining;\n\n  const licenseMatch = sectionContent.match(/^license\\s*=\\s*\"([^\"]+)\"/m);\n  if (licenseMatch && licenseMatch[1].trim() !== '') {\n    return licenseMatch[1].trim();\n  }\n  return undefined;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAKxB,MAAM,iBAA+E;AAAA,EACnF,EAAE,SAAS,gBAAgB,OAAO,aAAa;AAAA,EAC/C,EAAE,SAAS,oBAAoB,OAAO,cAAc;AAAA,EACpD,EAAE,SAAS,sBAAsB,OAAO,cAAc;AACxD;AAgBA,eAAsB,mBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,8BAA8B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC7G,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,mBAAmB,qBAAqB,WAAW;AAGzD,QAAM,UAAU,oBAAoB,OAAO;AAG3C,QAAM,eAAmC,CAAC;AAE1C,aAAW,EAAE,SAAS,MAAM,KAAK,gBAAgB;AAC/C,UAAM,cAAc,2BAA2B,SAAS,SAAS,gBAAgB;AACjF,eAAW,OAAO,aAAa;AAC7B,YAAM,kBAAkB,iBAAiB,IAAI,IAAI,IAAI;AACrD,mBAAa,KAAK;AAAA,QAChB,MAAM,IAAI;AAAA,QACV,oBAAoB,IAAI;AAAA,QACxB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAeA,SAAS,2BACP,SACA,SACA,kBACiB;AACjB,QAAM,OAAwB,CAAC;AAI/B,QAAM,eAAe,IAAI,OAAO,OAAO,YAAY,OAAO,CAAC,YAAY,GAAG;AAC1E,QAAM,eAAe,aAAa,KAAK,OAAO;AAE9C,MAAI,cAAc;AAChB,UAAM,WAAW,aAAa,QAAQ,aAAa,CAAC,EAAE;AAEtD,UAAM,YAAY,QAAQ,MAAM,QAAQ;AACxC,UAAM,mBAAmB,UAAU,MAAM,MAAM;AAC/C,UAAM,iBAAiB,mBACnB,UAAU,MAAM,GAAG,iBAAiB,KAAK,IACzC;AAEJ,UAAM,QAAQ,eAAe,MAAM,IAAI;AACvC,eAAW,QAAQ,OAAO;AACxB,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,YAAY,MAAM,QAAQ,WAAW,GAAG,EAAG;AAE/C,YAAM,MAAM,oBAAoB,SAAS,kBAAkB,OAAO;AAClE,UAAI,KAAK;AACP,aAAK,KAAK,GAAG;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAIA,QAAM,aAAa,IAAI,OAAO,OAAO,YAAY,OAAO,CAAC,wBAAwB,IAAI;AACrF,MAAI;AACJ,UAAQ,aAAa,WAAW,KAAK,OAAO,OAAO,MAAM;AACvD,UAAM,UAAU,WAAW,CAAC,EAAE,KAAK;AACnC,UAAM,WAAW,WAAW,QAAQ,WAAW,CAAC,EAAE;AAClD,UAAM,YAAY,QAAQ,MAAM,QAAQ;AACxC,UAAM,mBAAmB,UAAU,MAAM,MAAM;AAC/C,UAAM,eAAe,mBACjB,UAAU,MAAM,GAAG,iBAAiB,KAAK,IACzC;AAEJ,UAAM,UAAU,wBAAwB,YAAY;AACpD,QAAI,SAAS;AACX,WAAK,KAAK,EAAE,MAAM,SAAS,YAAY,QAAQ,CAAC;AAAA,IAClD,OAAO;AAEL,WAAK,KAAK,EAAE,MAAM,SAAS,YAAY,IAAI,CAAC;AAAA,IAC9C;AAAA,EACF;AAEA,SAAO;AACT;AAUA,SAAS,oBACP,MACA,kBACA,SACsB;AAEtB,QAAM,cAAc,KAAK,MAAM,oCAAoC;AACnE,MAAI,aAAa;AACf,UAAM,OAAO,YAAY,CAAC;AAC1B,UAAM,aAAa,YAAY,CAAC;AAChC,QAAI,CAAC,iBAAiB,IAAI,GAAG;AAC3B,iCAAQ,mCAAmC,IAAI,QAAQ,gBAAgB,KAAK,OAAO,mBAAc;AACjG,aAAO;AAAA,IACT;AACA,QAAI,WAAW,KAAK,MAAM,IAAI;AAC5B,iCAAQ,6CAA6C,IAAI,QAAQ,gBAAgB,KAAK,OAAO,mBAAc;AAC3G,aAAO;AAAA,IACT;AACA,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AAGA,QAAM,aAAa,KAAK,MAAM,sCAAsC;AACpE,MAAI,YAAY;AACd,UAAM,OAAO,WAAW,CAAC;AACzB,UAAM,eAAe,WAAW,CAAC;AACjC,QAAI,CAAC,iBAAiB,IAAI,GAAG;AAC3B,iCAAQ,mCAAmC,IAAI,QAAQ,gBAAgB,KAAK,OAAO,mBAAc;AACjG,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,8BAA8B,YAAY;AAC1D,QAAI,SAAS;AACX,aAAO,EAAE,MAAM,YAAY,QAAQ;AAAA,IACrC;AAGA,WAAO,EAAE,MAAM,YAAY,IAAI;AAAA,EACjC;AAIA,MAAI,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,WAAW,GAAG,GAAG;AAC/C,UAAM,eAAe,KAAK,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AAC7C,QAAI,gBAAgB,mBAAmB,KAAK,YAAY,GAAG;AACzD,iCAAQ,kDAAkD,gBAAgB,KAAK,OAAO,OAAO,IAAI,mBAAc;AAAA,IACjH;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,8BAA8B,cAAqC;AAC1E,QAAM,eAAe,aAAa,MAAM,yBAAyB;AACjE,MAAI,gBAAgB,aAAa,CAAC,EAAE,KAAK,MAAM,IAAI;AACjD,WAAO,aAAa,CAAC;AAAA,EACvB;AACA,SAAO;AACT;AAMA,SAAS,wBAAwB,cAAqC;AACpE,QAAM,QAAQ,aAAa,MAAM,IAAI;AACrC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,eAAe,QAAQ,MAAM,2BAA2B;AAC9D,QAAI,gBAAgB,aAAa,CAAC,EAAE,KAAK,MAAM,IAAI;AACjD,aAAO,aAAa,CAAC;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;AAaA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,MAA0B,oBAAI,IAAI;AAExC,QAAM,WAAW,KAAK,KAAK,aAAa,YAAY;AACpD,MAAI,CAAC,GAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,cAAc,GAAG,aAAa,UAAU,MAAM;AACpD,yBAAqB,aAAa,GAAG;AAAA,EACvC,SAAS,KAAK;AACZ,+BAAQ,2CAA2C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EACvG;AAEA,SAAO;AACT;AAaA,SAAS,qBAAqB,SAAiB,KAA+B;AAC5E,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,MAAI,cAA6B;AAEjC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAG1B,QAAI,YAAY,eAAe;AAC7B,oBAAc;AACd;AAAA,IACF;AAGA,QAAI,gBAAgB,MAAM;AACxB,YAAM,YAAY,QAAQ,MAAM,wBAAwB;AACxD,UAAI,WAAW;AACb,sBAAc,UAAU,CAAC;AACzB;AAAA,MACF;AAAA,IACF;AAGA,QAAI,gBAAgB,MAAM;AACxB,YAAM,eAAe,QAAQ,MAAM,2BAA2B;AAC9D,UAAI,cAAc;AAGhB,YAAI,CAAC,IAAI,IAAI,WAAW,GAAG;AACzB,cAAI,IAAI,aAAa,aAAa,CAAC,CAAC;AAAA,QACtC;AACA,sBAAc;AACd;AAAA,MACF;AAAA,IACF;AAGA,QAAI,YAAY,MAAM,QAAQ,WAAW,GAAG,GAAG;AAC7C,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAOA,SAAS,iBAAiB,MAAuB;AAC/C,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,MAAI,KAAK,SAAS,GAAI,QAAO;AAC7B,SAAO,2BAA2B,KAAK,IAAI;AAC7C;AAKA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uBAAuB,MAAM;AAClD;AAMA,SAAS,oBAAoB,SAAqC;AAEhE,QAAM,sBAAsB,oBAAoB,KAAK,OAAO;AAC5D,MAAI,CAAC,oBAAqB,QAAO;AAEjC,QAAM,WAAW,oBAAoB,QAAQ,oBAAoB,CAAC,EAAE;AACpE,QAAM,YAAY,QAAQ,MAAM,QAAQ;AAExC,QAAM,cAAc,UAAU,MAAM,MAAM;AAC1C,QAAM,iBAAiB,cAAc,UAAU,MAAM,GAAG,YAAY,KAAK,IAAI;AAE7E,QAAM,eAAe,eAAe,MAAM,2BAA2B;AACrE,MAAI,gBAAgB,aAAa,CAAC,EAAE,KAAK,MAAM,IAAI;AACjD,WAAO,aAAa,CAAC,EAAE,KAAK;AAAA,EAC9B;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/security/manifest/plugins/cargo.test.js

@@ -0,0 +1,304 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var os = __toESM(require("os"));
+var import_cargo = require("./cargo");
+(0, import_vitest.describe)("parseCargoManifest", () => {
+  let tmpDir;
+  (0, import_vitest.beforeEach)(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "kirograph-cargo-test-"));
+  });
+  (0, import_vitest.afterEach)(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+  function writeCargoToml(content, dir) {
+    const targetDir = dir ?? tmpDir;
+    fs.mkdirSync(targetDir, { recursive: true });
+    const filePath = path.join(targetDir, "Cargo.toml");
+    fs.writeFileSync(filePath, content);
+    return filePath;
+  }
+  (0, import_vitest.it)("extracts simple string dependencies with production scope", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dependencies]
+serde = "1.0"
+tokio = "1.35"
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    const serde = deps.find((d) => d.name === "serde");
+    (0, import_vitest.expect)(serde).toBeDefined();
+    (0, import_vitest.expect)(serde.declaredConstraint).toBe("1.0");
+    (0, import_vitest.expect)(serde.scope).toBe("production");
+    (0, import_vitest.expect)(serde.ecosystem).toBe("cargo");
+    const tokio = deps.find((d) => d.name === "tokio");
+    (0, import_vitest.expect)(tokio).toBeDefined();
+    (0, import_vitest.expect)(tokio.declaredConstraint).toBe("1.35");
+    (0, import_vitest.expect)(tokio.scope).toBe("production");
+  });
+  (0, import_vitest.it)("extracts table format dependencies with version field", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dependencies]
+serde = { version = "1.0", features = ["derive"] }
+tokio = { version = "1.35", features = ["full"] }
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "serde").declaredConstraint).toBe("1.0");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "tokio").declaredConstraint).toBe("1.35");
+  });
+  (0, import_vitest.it)("extracts dev-dependencies with development scope", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dev-dependencies]
+criterion = "0.5"
+proptest = "1.4"
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    (0, import_vitest.expect)(deps.every((d) => d.scope === "development")).toBe(true);
+  });
+  (0, import_vitest.it)("extracts build-dependencies with development scope", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[build-dependencies]
+cc = "1.0"
+bindgen = "0.69"
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    (0, import_vitest.expect)(deps.every((d) => d.scope === "development")).toBe(true);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "cc").declaredConstraint).toBe("1.0");
+  });
+  (0, import_vitest.it)("handles all dependency sections together", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dependencies]
+serde = "1.0"
+
+[dev-dependencies]
+criterion = "0.5"
+
+[build-dependencies]
+cc = "1.0"
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(3);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "serde").scope).toBe("production");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "criterion").scope).toBe("development");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "cc").scope).toBe("development");
+  });
+  (0, import_vitest.it)("resolves versions from Cargo.lock", async () => {
+    writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dependencies]
+serde = "1.0"
+tokio = "1"
+`);
+    const lockContent = `# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "serde"
+version = "1.0.193"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+
+[[package]]
+name = "tokio"
+version = "1.35.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+`;
+    fs.writeFileSync(path.join(tmpDir, "Cargo.lock"), lockContent);
+    const manifestPath = path.join(tmpDir, "Cargo.toml");
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "serde").resolvedVersion).toBe("1.0.193");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "tokio").resolvedVersion).toBe("1.35.1");
+  });
+  (0, import_vitest.it)("leaves resolvedVersion undefined when no Cargo.lock exists", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dependencies]
+serde = "1.0"
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBeUndefined();
+  });
+  (0, import_vitest.it)("handles path dependencies with no version (uses * constraint)", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dependencies]
+my-lib = { path = "../my-lib" }
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("my-lib");
+    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("*");
+  });
+  (0, import_vitest.it)("handles git dependencies with no version (uses * constraint)", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dependencies]
+my-crate = { git = "https://github.com/user/repo" }
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("my-crate");
+    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("*");
+  });
+  (0, import_vitest.it)("handles table-style individual dependency sections", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dependencies.serde]
+version = "1.0"
+features = ["derive"]
+
+[dependencies.tokio]
+version = "1.35"
+features = ["full"]
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "serde").declaredConstraint).toBe("1.0");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "tokio").declaredConstraint).toBe("1.35");
+    (0, import_vitest.expect)(deps.every((d) => d.scope === "production")).toBe(true);
+  });
+  (0, import_vitest.it)("returns empty array for unreadable file", async () => {
+    const fakePath = path.join(tmpDir, "nonexistent", "Cargo.toml");
+    const deps = await (0, import_cargo.parseCargoManifest)(fakePath, tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("returns empty array for Cargo.toml with no dependency sections", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+edition = "2021"
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("skips comment lines in dependency sections", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dependencies]
+# This is a comment
+serde = "1.0"
+# Another comment
+tokio = "1.35"
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "serde")).toBeDefined();
+    (0, import_vitest.expect)(deps.find((d) => d.name === "tokio")).toBeDefined();
+  });
+  (0, import_vitest.it)("sets sourceManifest as relative path", async () => {
+    const subDir = path.join(tmpDir, "crates", "sub");
+    const manifestPath = writeCargoToml(`
+[package]
+name = "sub-crate"
+version = "0.1.0"
+
+[dependencies]
+serde = "1.0"
+`, subDir);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].sourceManifest).toBe("crates/sub/Cargo.toml");
+  });
+  (0, import_vitest.it)("handles mixed simple and table format in same section", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dependencies]
+log = "0.4"
+serde = { version = "1.0", features = ["derive"] }
+rand = "0.8"
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(3);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "log").declaredConstraint).toBe("0.4");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "serde").declaredConstraint).toBe("1.0");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "rand").declaredConstraint).toBe("0.8");
+  });
+  (0, import_vitest.it)("handles version constraints with operators", async () => {
+    const manifestPath = writeCargoToml(`
+[package]
+name = "my-app"
+version = "0.1.0"
+
+[dependencies]
+serde = ">=1.0, <2.0"
+tokio = "~1.35"
+rand = "^0.8"
+`);
+    const deps = await (0, import_cargo.parseCargoManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(3);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "serde").declaredConstraint).toBe(">=1.0, <2.0");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "tokio").declaredConstraint).toBe("~1.35");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "rand").declaredConstraint).toBe("^0.8");
+  });
+});
+//# sourceMappingURL=cargo.test.js.map

package/dist/security/manifest/plugins/cargo.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/cargo.test.ts"],
+  "sourcesContent": ["/**\n * Unit tests for the Cargo security manifest plugin.\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { parseCargoManifest } from './cargo';\n\ndescribe('parseCargoManifest', () => {\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kirograph-cargo-test-'));\n  });\n\n  afterEach(() => {\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  function writeCargoToml(content: string, dir?: string): string {\n    const targetDir = dir ?? tmpDir;\n    fs.mkdirSync(targetDir, { recursive: true });\n    const filePath = path.join(targetDir, 'Cargo.toml');\n    fs.writeFileSync(filePath, content);\n    return filePath;\n  }\n\n  it('extracts simple string dependencies with production scope', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \"1.0\"\ntokio = \"1.35\"\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    const serde = deps.find(d => d.name === 'serde');\n    expect(serde).toBeDefined();\n    expect(serde!.declaredConstraint).toBe('1.0');\n    expect(serde!.scope).toBe('production');\n    expect(serde!.ecosystem).toBe('cargo');\n\n    const tokio = deps.find(d => d.name === 'tokio');\n    expect(tokio).toBeDefined();\n    expect(tokio!.declaredConstraint).toBe('1.35');\n    expect(tokio!.scope).toBe('production');\n  });\n\n  it('extracts table format dependencies with version field', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = { version = \"1.0\", features = [\"derive\"] }\ntokio = { version = \"1.35\", features = [\"full\"] }\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps.find(d => d.name === 'serde')!.declaredConstraint).toBe('1.0');\n    expect(deps.find(d => d.name === 'tokio')!.declaredConstraint).toBe('1.35');\n  });\n\n  it('extracts dev-dependencies with development scope', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dev-dependencies]\ncriterion = \"0.5\"\nproptest = \"1.4\"\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps.every(d => d.scope === 'development')).toBe(true);\n  });\n\n  it('extracts build-dependencies with development scope', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[build-dependencies]\ncc = \"1.0\"\nbindgen = \"0.69\"\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps.every(d => d.scope === 'development')).toBe(true);\n    expect(deps.find(d => d.name === 'cc')!.declaredConstraint).toBe('1.0');\n  });\n\n  it('handles all dependency sections together', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \"1.0\"\n\n[dev-dependencies]\ncriterion = \"0.5\"\n\n[build-dependencies]\ncc = \"1.0\"\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(3);\n    expect(deps.find(d => d.name === 'serde')!.scope).toBe('production');\n    expect(deps.find(d => d.name === 'criterion')!.scope).toBe('development');\n    expect(deps.find(d => d.name === 'cc')!.scope).toBe('development');\n  });\n\n  it('resolves versions from Cargo.lock', async () => {\n    writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \"1.0\"\ntokio = \"1\"\n`);\n\n    const lockContent = `# This file is automatically @generated by Cargo.\n# It is not intended for manual editing.\nversion = 3\n\n[[package]]\nname = \"serde\"\nversion = \"1.0.193\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\n\n[[package]]\nname = \"tokio\"\nversion = \"1.35.1\"\nsource = \"registry+https://github.com/rust-lang/crates.io-index\"\n`;\n    fs.writeFileSync(path.join(tmpDir, 'Cargo.lock'), lockContent);\n\n    const manifestPath = path.join(tmpDir, 'Cargo.toml');\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps.find(d => d.name === 'serde')!.resolvedVersion).toBe('1.0.193');\n    expect(deps.find(d => d.name === 'tokio')!.resolvedVersion).toBe('1.35.1');\n  });\n\n  it('leaves resolvedVersion undefined when no Cargo.lock exists', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \"1.0\"\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].resolvedVersion).toBeUndefined();\n  });\n\n  it('handles path dependencies with no version (uses * constraint)', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dependencies]\nmy-lib = { path = \"../my-lib\" }\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('my-lib');\n    expect(deps[0].declaredConstraint).toBe('*');\n  });\n\n  it('handles git dependencies with no version (uses * constraint)', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dependencies]\nmy-crate = { git = \"https://github.com/user/repo\" }\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('my-crate');\n    expect(deps[0].declaredConstraint).toBe('*');\n  });\n\n  it('handles table-style individual dependency sections', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dependencies.serde]\nversion = \"1.0\"\nfeatures = [\"derive\"]\n\n[dependencies.tokio]\nversion = \"1.35\"\nfeatures = [\"full\"]\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps.find(d => d.name === 'serde')!.declaredConstraint).toBe('1.0');\n    expect(deps.find(d => d.name === 'tokio')!.declaredConstraint).toBe('1.35');\n    expect(deps.every(d => d.scope === 'production')).toBe(true);\n  });\n\n  it('returns empty array for unreadable file', async () => {\n    const fakePath = path.join(tmpDir, 'nonexistent', 'Cargo.toml');\n    const deps = await parseCargoManifest(fakePath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('returns empty array for Cargo.toml with no dependency sections', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\nedition = \"2021\"\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('skips comment lines in dependency sections', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dependencies]\n# This is a comment\nserde = \"1.0\"\n# Another comment\ntokio = \"1.35\"\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps.find(d => d.name === 'serde')).toBeDefined();\n    expect(deps.find(d => d.name === 'tokio')).toBeDefined();\n  });\n\n  it('sets sourceManifest as relative path', async () => {\n    const subDir = path.join(tmpDir, 'crates', 'sub');\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"sub-crate\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \"1.0\"\n`, subDir);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].sourceManifest).toBe('crates/sub/Cargo.toml');\n  });\n\n  it('handles mixed simple and table format in same section', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dependencies]\nlog = \"0.4\"\nserde = { version = \"1.0\", features = [\"derive\"] }\nrand = \"0.8\"\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(3);\n    expect(deps.find(d => d.name === 'log')!.declaredConstraint).toBe('0.4');\n    expect(deps.find(d => d.name === 'serde')!.declaredConstraint).toBe('1.0');\n    expect(deps.find(d => d.name === 'rand')!.declaredConstraint).toBe('0.8');\n  });\n\n  it('handles version constraints with operators', async () => {\n    const manifestPath = writeCargoToml(`\n[package]\nname = \"my-app\"\nversion = \"0.1.0\"\n\n[dependencies]\nserde = \">=1.0, <2.0\"\ntokio = \"~1.35\"\nrand = \"^0.8\"\n`);\n\n    const deps = await parseCargoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(3);\n    expect(deps.find(d => d.name === 'serde')!.declaredConstraint).toBe('>=1.0, <2.0');\n    expect(deps.find(d => d.name === 'tokio')!.declaredConstraint).toBe('~1.35');\n    expect(deps.find(d => d.name === 'rand')!.declaredConstraint).toBe('^0.8');\n  });\n});\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAGA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,mBAAmC;AAAA,IAEnC,wBAAS,sBAAsB,MAAM;AACnC,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,uBAAuB,CAAC;AAAA,EACzE,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAED,WAAS,eAAe,SAAiB,KAAsB;AAC7D,UAAM,YAAY,OAAO;AACzB,OAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAC3C,UAAM,WAAW,KAAK,KAAK,WAAW,YAAY;AAClD,OAAG,cAAc,UAAU,OAAO;AAClC,WAAO;AAAA,EACT;AAEA,wBAAG,6DAA6D,YAAY;AAC1E,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAQvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,UAAM,QAAQ,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO;AAC/C,8BAAO,KAAK,EAAE,YAAY;AAC1B,8BAAO,MAAO,kBAAkB,EAAE,KAAK,KAAK;AAC5C,8BAAO,MAAO,KAAK,EAAE,KAAK,YAAY;AACtC,8BAAO,MAAO,SAAS,EAAE,KAAK,OAAO;AAErC,UAAM,QAAQ,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO;AAC/C,8BAAO,KAAK,EAAE,YAAY;AAC1B,8BAAO,MAAO,kBAAkB,EAAE,KAAK,MAAM;AAC7C,8BAAO,MAAO,KAAK,EAAE,KAAK,YAAY;AAAA,EACxC,CAAC;AAED,wBAAG,yDAAyD,YAAY;AACtE,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAQvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,EAAG,kBAAkB,EAAE,KAAK,KAAK;AACzE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,EAAG,kBAAkB,EAAE,KAAK,MAAM;AAAA,EAC5E,CAAC;AAED,wBAAG,oDAAoD,YAAY;AACjE,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAQvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,MAAM,OAAK,EAAE,UAAU,aAAa,CAAC,EAAE,KAAK,IAAI;AAAA,EAC9D,CAAC;AAED,wBAAG,sDAAsD,YAAY;AACnE,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAQvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,MAAM,OAAK,EAAE,UAAU,aAAa,CAAC,EAAE,KAAK,IAAI;AAC5D,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,IAAI,EAAG,kBAAkB,EAAE,KAAK,KAAK;AAAA,EACxE,CAAC;AAED,wBAAG,4CAA4C,YAAY;AACzD,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAavC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,EAAG,KAAK,EAAE,KAAK,YAAY;AACnE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,WAAW,EAAG,KAAK,EAAE,KAAK,aAAa;AACxE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,IAAI,EAAG,KAAK,EAAE,KAAK,aAAa;AAAA,EACnE,CAAC;AAED,wBAAG,qCAAqC,YAAY;AAClD,mBAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAQlB;AAEG,UAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcpB,OAAG,cAAc,KAAK,KAAK,QAAQ,YAAY,GAAG,WAAW;AAE7D,UAAM,eAAe,KAAK,KAAK,QAAQ,YAAY;AACnD,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,EAAG,eAAe,EAAE,KAAK,SAAS;AAC1E,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,EAAG,eAAe,EAAE,KAAK,QAAQ;AAAA,EAC3E,CAAC;AAED,wBAAG,8DAA8D,YAAY;AAC3E,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAOvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,cAAc;AAAA,EAChD,CAAC;AAED,wBAAG,iEAAiE,YAAY;AAC9E,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAOvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,QAAQ;AAClC,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,GAAG;AAAA,EAC7C,CAAC;AAED,wBAAG,gEAAgE,YAAY;AAC7E,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAOvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,UAAU;AACpC,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,GAAG;AAAA,EAC7C,CAAC;AAED,wBAAG,sDAAsD,YAAY;AACnE,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAYvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,EAAG,kBAAkB,EAAE,KAAK,KAAK;AACzE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,EAAG,kBAAkB,EAAE,KAAK,MAAM;AAC1E,8BAAO,KAAK,MAAM,OAAK,EAAE,UAAU,YAAY,CAAC,EAAE,KAAK,IAAI;AAAA,EAC7D,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,WAAW,KAAK,KAAK,QAAQ,eAAe,YAAY;AAC9D,UAAM,OAAO,UAAM,iCAAmB,UAAU,MAAM;AACtD,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,kEAAkE,YAAY;AAC/E,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA,CAKvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAC1D,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,8CAA8C,YAAY;AAC3D,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAUvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,CAAC,EAAE,YAAY;AACvD,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,CAAC,EAAE,YAAY;AAAA,EACzD,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,SAAS,KAAK,KAAK,QAAQ,UAAU,KAAK;AAChD,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAOrC,MAAM;AAEL,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,cAAc,EAAE,KAAK,uBAAuB;AAAA,EAC7D,CAAC;AAED,wBAAG,yDAAyD,YAAY;AACtE,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,KAAK,EAAG,kBAAkB,EAAE,KAAK,KAAK;AACvE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,EAAG,kBAAkB,EAAE,KAAK,KAAK;AACzE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,MAAM,EAAG,kBAAkB,EAAE,KAAK,KAAK;AAAA,EAC1E,CAAC;AAED,wBAAG,8CAA8C,YAAY;AAC3D,UAAM,eAAe,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASvC;AAEG,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,EAAG,kBAAkB,EAAE,KAAK,aAAa;AACjF,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,OAAO,EAAG,kBAAkB,EAAE,KAAK,OAAO;AAC3E,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,MAAM,EAAG,kBAAkB,EAAE,KAAK,MAAM;AAAA,EAC3E,CAAC;AACH,CAAC;",
+  "names": []
+}