kirograph 0.17.0 → 0.19.0

package/dist/security/manifest/plugins/hex.js

@@ -0,0 +1,159 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var hex_exports = {};
+__export(hex_exports, {
+  parseHexManifest: () => parseHexManifest
+});
+module.exports = __toCommonJS(hex_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+async function parseHexManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:hex] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const rawDeps = extractDepsFromMixExs(content, relativeManifest);
+  const dependencies = [];
+  for (const dep of rawDeps) {
+    const resolvedVersion = resolvedVersions.get(dep.name);
+    dependencies.push({
+      name: dep.name,
+      declaredConstraint: dep.constraint,
+      resolvedVersion,
+      scope: dep.scope,
+      ecosystem: "hex",
+      sourceManifest: relativeManifest
+    });
+  }
+  return dependencies;
+}
+function extractDepsFromMixExs(content, relativeManifest) {
+  const deps = [];
+  const depsBody = extractDepsFunctionBody(content, relativeManifest);
+  if (!depsBody) {
+    (0, import_errors.logWarn)(`[sec:hex] Could not locate deps function in ${relativeManifest}`);
+    return [];
+  }
+  const tuplePattern = /\{:([a-zA-Z0-9_]+)\s*,([^}]*)\}/g;
+  let match;
+  while ((match = tuplePattern.exec(depsBody)) !== null) {
+    const name = match[1];
+    const tupleBody = match[2];
+    if (isGitOrPathDep(tupleBody)) continue;
+    const version = extractVersionFromTuple(tupleBody);
+    if (!version) {
+      continue;
+    }
+    const scope = extractScopeFromTuple(tupleBody);
+    deps.push({ name, constraint: version, scope });
+  }
+  return deps;
+}
+function extractDepsFunctionBody(content, relativeManifest) {
+  const funcMatch = content.match(/def[p]?\s+deps\s+do([\s\S]*?)^  end/m);
+  if (funcMatch) {
+    return funcMatch[1];
+  }
+  const inlineMatch = content.match(/def[p]?\s+deps,\s*do:\s*\[([\s\S]*?)\]/);
+  if (inlineMatch) {
+    return inlineMatch[1];
+  }
+  const listMatch = content.match(/def[p]?\s+deps\s+do\s*\[([\s\S]*?)\]\s*end/);
+  if (listMatch) {
+    return listMatch[1];
+  }
+  (0, import_errors.logWarn)(`[sec:hex] No deps function found in ${relativeManifest} \u2014 trying full file scan`);
+  return content;
+}
+function isGitOrPathDep(tupleBody) {
+  return /\bgit:\s*"/.test(tupleBody) || /\bpath:\s*"/.test(tupleBody);
+}
+function extractVersionFromTuple(tupleBody) {
+  const versionMatch = tupleBody.match(/^\s*"([^"]+)"/);
+  if (versionMatch) {
+    return versionMatch[1].trim();
+  }
+  return null;
+}
+function extractScopeFromTuple(tupleBody) {
+  const onlyMatch = tupleBody.match(/\bonly\s*:\s*(.+?)(?:,\s*\w+:|$)/s);
+  if (!onlyMatch) return "production";
+  const onlyValue = onlyMatch[1].trim();
+  if (onlyValue.startsWith("[")) {
+    const atoms = onlyValue.match(/:(\w+)/g) || [];
+    const values = atoms.map((a) => a.slice(1));
+    if (values.some((v) => v === "dev" || v === "test")) {
+      return "development";
+    }
+    return "production";
+  }
+  const atom = onlyValue.match(/^:(\w+)/);
+  if (atom) {
+    if (atom[1] === "dev" || atom[1] === "test") return "development";
+    return "production";
+  }
+  return "production";
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const lockPath = path.join(manifestDir, "mix.lock");
+  if (!fs.existsSync(lockPath)) {
+    return map;
+  }
+  try {
+    const lockContent = fs.readFileSync(lockPath, "utf8");
+    extractFromMixLock(lockContent, map);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:hex] Failed to parse mix.lock: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function extractFromMixLock(content, map) {
+  const lockEntryPattern = /^\s*"([^"]+)"\s*=>\s*\{:hex\s*,\s*:[a-zA-Z0-9_]+\s*,\s*"([^"]+)"/gm;
+  let match;
+  while ((match = lockEntryPattern.exec(content)) !== null) {
+    const name = match[1];
+    const version = match[2];
+    if (!map.has(name)) {
+      map.set(name, version);
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseHexManifest
+});
+//# sourceMappingURL=hex.js.map

package/dist/security/manifest/plugins/hex.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/hex.ts"],
+  "sourcesContent": ["/**\n * Elixir/Hex Version Extraction Plugin for KiroGraph-Sec\n *\n * Parses mix.exs manifests to extract Elixir package declarations with\n * version constraints, scopes, and resolved versions from mix.lock.\n *\n * Handles:\n * - `{:package_name, \"~> 1.0\"}` \u2014 standard version constraint\n * - `{:package_name, \">= 1.0.0\"}` \u2014 range constraint\n * - `{:package_name, \"1.0.0\"}` \u2014 exact version\n * - `{:package_name, \"~> 1.0\", only: [:dev, :test]}` \u2192 'development' scope\n * - `{:package_name, \"~> 1.0\", only: :dev}` \u2192 'development' scope\n * - Skips git and path dependencies\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Resolved version map: package name \u2192 resolved version string.\n * Built from mix.lock.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * Parse a mix.exs manifest and extract package declarations with\n * version constraints, scopes, and resolved versions from mix.lock.\n *\n * @param manifestPath - Absolute path to the mix.exs file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parseHexManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read the mix.exs content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:hex] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Attempt to load resolved versions from mix.lock\n  const resolvedVersions = loadResolvedVersions(manifestDir);\n\n  // Extract dependencies from the deps function\n  const rawDeps = extractDepsFromMixExs(content, relativeManifest);\n  const dependencies: ParsedDependency[] = [];\n\n  for (const dep of rawDeps) {\n    const resolvedVersion = resolvedVersions.get(dep.name);\n    dependencies.push({\n      name: dep.name,\n      declaredConstraint: dep.constraint,\n      resolvedVersion,\n      scope: dep.scope,\n      ecosystem: 'hex',\n      sourceManifest: relativeManifest,\n    });\n  }\n\n  return dependencies;\n}\n\n/**\n * A raw dependency entry extracted from mix.exs.\n */\ninterface RawDependency {\n  name: string;\n  constraint: string;\n  scope: ParsedDependency['scope'];\n}\n\n/**\n * Extract dependencies from mix.exs content.\n *\n * Locates the `defp deps do` function and parses each dependency tuple.\n * Also handles `def deps do` (public deps function).\n *\n * Each dep tuple may span multiple lines, so we work with the full\n * content after extracting the deps list body.\n */\nfunction extractDepsFromMixExs(content: string, relativeManifest: string): RawDependency[] {\n  const deps: RawDependency[] = [];\n\n  // Find the deps function body \u2014 match `defp deps do` or `def deps do`\n  // and extract up to the matching `end`\n  const depsBody = extractDepsFunctionBody(content, relativeManifest);\n  if (!depsBody) {\n    logWarn(`[sec:hex] Could not locate deps function in ${relativeManifest}`);\n    return [];\n  }\n\n  // Match individual dependency tuples: {:name, \"version\", ...optional...}\n  // The tuple may contain nested content, so we match balanced braces roughly\n  const tuplePattern = /\\{:([a-zA-Z0-9_]+)\\s*,([^}]*)\\}/g;\n  let match: RegExpExecArray | null;\n\n  while ((match = tuplePattern.exec(depsBody)) !== null) {\n    const name = match[1];\n    const tupleBody = match[2];\n\n    // Skip git/path dependencies\n    if (isGitOrPathDep(tupleBody)) continue;\n\n    const version = extractVersionFromTuple(tupleBody);\n    if (!version) {\n      // Might be a non-version dep (e.g. manager: :rebar3) \u2014 skip silently\n      continue;\n    }\n\n    const scope = extractScopeFromTuple(tupleBody);\n    deps.push({ name, constraint: version, scope });\n  }\n\n  return deps;\n}\n\n/**\n * Extract the body of the `deps` function from mix.exs.\n * Returns the content between the `[` and closing `]` of the deps list,\n * or null if the deps function cannot be located.\n */\nfunction extractDepsFunctionBody(content: string, relativeManifest: string): string | null {\n  // Match `defp deps do` or `def deps do` followed by content and `end`\n  const funcMatch = content.match(/def[p]?\\s+deps\\s+do([\\s\\S]*?)^  end/m);\n  if (funcMatch) {\n    return funcMatch[1];\n  }\n\n  // Alternative: `defp deps,` with a list returned directly (single-expression)\n  // e.g. `def deps, do: [...]`\n  const inlineMatch = content.match(/def[p]?\\s+deps,\\s*do:\\s*\\[([\\s\\S]*?)\\]/);\n  if (inlineMatch) {\n    return inlineMatch[1];\n  }\n\n  // Also try matching a `[...]` list inside the function\n  const listMatch = content.match(/def[p]?\\s+deps\\s+do\\s*\\[([\\s\\S]*?)\\]\\s*end/);\n  if (listMatch) {\n    return listMatch[1];\n  }\n\n  logWarn(`[sec:hex] No deps function found in ${relativeManifest} \u2014 trying full file scan`);\n  // Last resort: scan entire file for dep tuples (less accurate but better than nothing)\n  return content;\n}\n\n/**\n * Determine if a dependency tuple body represents a git or path dependency.\n * These lack a standard version string and should be skipped.\n */\nfunction isGitOrPathDep(tupleBody: string): boolean {\n  return /\\bgit:\\s*\"/.test(tupleBody) || /\\bpath:\\s*\"/.test(tupleBody);\n}\n\n/**\n * Extract the version constraint string from a dependency tuple body.\n * The first string literal in the tuple body is taken as the version.\n *\n * Returns null if no version string is found (e.g. pure option tuples).\n */\nfunction extractVersionFromTuple(tupleBody: string): string | null {\n  // Match the first quoted string in the tuple body\n  const versionMatch = tupleBody.match(/^\\s*\"([^\"]+)\"/);\n  if (versionMatch) {\n    return versionMatch[1].trim();\n  }\n  return null;\n}\n\n/**\n * Extract the scope from a dependency tuple body by inspecting the `only:` option.\n *\n * `only: [:dev, :test]` \u2192 'development'\n * `only: :dev`          \u2192 'development'\n * `only: :test`         \u2192 'development'\n * `only: :prod`         \u2192 'production'\n * No `only:` option     \u2192 'production'\n */\nfunction extractScopeFromTuple(tupleBody: string): ParsedDependency['scope'] {\n  const onlyMatch = tupleBody.match(/\\bonly\\s*:\\s*(.+?)(?:,\\s*\\w+:|$)/s);\n  if (!onlyMatch) return 'production';\n\n  const onlyValue = onlyMatch[1].trim();\n\n  // List form: [:dev, :test] or [:test, :dev, ...]\n  if (onlyValue.startsWith('[')) {\n    const atoms = onlyValue.match(/:(\\w+)/g) || [];\n    const values = atoms.map((a) => a.slice(1));\n    if (values.some((v) => v === 'dev' || v === 'test')) {\n      return 'development';\n    }\n    return 'production';\n  }\n\n  // Atom form: :dev or :test or :prod\n  const atom = onlyValue.match(/^:(\\w+)/);\n  if (atom) {\n    if (atom[1] === 'dev' || atom[1] === 'test') return 'development';\n    return 'production';\n  }\n\n  return 'production';\n}\n\n/**\n * Attempt to load resolved versions from mix.lock in the given directory.\n * Returns an empty map if mix.lock is not available.\n *\n * mix.lock format:\n * ```elixir\n * %{\n *   \"package\" => {:hex, :package_name, \"1.2.3\", \"hash\", ...},\n *   \"another\" => {:hex, :another, \"2.0.0\", ...},\n * }\n * ```\n */\nfunction loadResolvedVersions(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  const lockPath = path.join(manifestDir, 'mix.lock');\n  if (!fs.existsSync(lockPath)) {\n    return map;\n  }\n\n  try {\n    const lockContent = fs.readFileSync(lockPath, 'utf8');\n    extractFromMixLock(lockContent, map);\n  } catch (err) {\n    logWarn(`[sec:hex] Failed to parse mix.lock: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from mix.lock content.\n *\n * mix.lock lines follow the pattern:\n * `  \"package_name\" => {:hex, :package_atom, \"1.2.3\", \"checksum\", [...]},`\n *\n * We extract the outer quoted key and the third positional element (version string).\n */\nfunction extractFromMixLock(content: string, map: ResolvedVersionMap): void {\n  // Match: \"name\" => {:hex, :name_atom, \"version\", ...\n  const lockEntryPattern = /^\\s*\"([^\"]+)\"\\s*=>\\s*\\{:hex\\s*,\\s*:[a-zA-Z0-9_]+\\s*,\\s*\"([^\"]+)\"/gm;\n  let match: RegExpExecArray | null;\n\n  while ((match = lockEntryPattern.exec(content)) !== null) {\n    const name = match[1];\n    const version = match[2];\n    if (!map.has(name)) {\n      map.set(name, version);\n    }\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAgBxB,eAAsB,iBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,4BAA4B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC3G,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,mBAAmB,qBAAqB,WAAW;AAGzD,QAAM,UAAU,sBAAsB,SAAS,gBAAgB;AAC/D,QAAM,eAAmC,CAAC;AAE1C,aAAW,OAAO,SAAS;AACzB,UAAM,kBAAkB,iBAAiB,IAAI,IAAI,IAAI;AACrD,iBAAa,KAAK;AAAA,MAChB,MAAM,IAAI;AAAA,MACV,oBAAoB,IAAI;AAAA,MACxB;AAAA,MACA,OAAO,IAAI;AAAA,MACX,WAAW;AAAA,MACX,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAoBA,SAAS,sBAAsB,SAAiB,kBAA2C;AACzF,QAAM,OAAwB,CAAC;AAI/B,QAAM,WAAW,wBAAwB,SAAS,gBAAgB;AAClE,MAAI,CAAC,UAAU;AACb,+BAAQ,+CAA+C,gBAAgB,EAAE;AACzE,WAAO,CAAC;AAAA,EACV;AAIA,QAAM,eAAe;AACrB,MAAI;AAEJ,UAAQ,QAAQ,aAAa,KAAK,QAAQ,OAAO,MAAM;AACrD,UAAM,OAAO,MAAM,CAAC;AACpB,UAAM,YAAY,MAAM,CAAC;AAGzB,QAAI,eAAe,SAAS,EAAG;AAE/B,UAAM,UAAU,wBAAwB,SAAS;AACjD,QAAI,CAAC,SAAS;AAEZ;AAAA,IACF;AAEA,UAAM,QAAQ,sBAAsB,SAAS;AAC7C,SAAK,KAAK,EAAE,MAAM,YAAY,SAAS,MAAM,CAAC;AAAA,EAChD;AAEA,SAAO;AACT;AAOA,SAAS,wBAAwB,SAAiB,kBAAyC;AAEzF,QAAM,YAAY,QAAQ,MAAM,sCAAsC;AACtE,MAAI,WAAW;AACb,WAAO,UAAU,CAAC;AAAA,EACpB;AAIA,QAAM,cAAc,QAAQ,MAAM,wCAAwC;AAC1E,MAAI,aAAa;AACf,WAAO,YAAY,CAAC;AAAA,EACtB;AAGA,QAAM,YAAY,QAAQ,MAAM,4CAA4C;AAC5E,MAAI,WAAW;AACb,WAAO,UAAU,CAAC;AAAA,EACpB;AAEA,6BAAQ,uCAAuC,gBAAgB,+BAA0B;AAEzF,SAAO;AACT;AAMA,SAAS,eAAe,WAA4B;AAClD,SAAO,aAAa,KAAK,SAAS,KAAK,cAAc,KAAK,SAAS;AACrE;AAQA,SAAS,wBAAwB,WAAkC;AAEjE,QAAM,eAAe,UAAU,MAAM,eAAe;AACpD,MAAI,cAAc;AAChB,WAAO,aAAa,CAAC,EAAE,KAAK;AAAA,EAC9B;AACA,SAAO;AACT;AAWA,SAAS,sBAAsB,WAA8C;AAC3E,QAAM,YAAY,UAAU,MAAM,mCAAmC;AACrE,MAAI,CAAC,UAAW,QAAO;AAEvB,QAAM,YAAY,UAAU,CAAC,EAAE,KAAK;AAGpC,MAAI,UAAU,WAAW,GAAG,GAAG;AAC7B,UAAM,QAAQ,UAAU,MAAM,SAAS,KAAK,CAAC;AAC7C,UAAM,SAAS,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC1C,QAAI,OAAO,KAAK,CAAC,MAAM,MAAM,SAAS,MAAM,MAAM,GAAG;AACnD,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAGA,QAAM,OAAO,UAAU,MAAM,SAAS;AACtC,MAAI,MAAM;AACR,QAAI,KAAK,CAAC,MAAM,SAAS,KAAK,CAAC,MAAM,OAAQ,QAAO;AACpD,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAcA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,MAA0B,oBAAI,IAAI;AAExC,QAAM,WAAW,KAAK,KAAK,aAAa,UAAU;AAClD,MAAI,CAAC,GAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,cAAc,GAAG,aAAa,UAAU,MAAM;AACpD,uBAAmB,aAAa,GAAG;AAAA,EACrC,SAAS,KAAK;AACZ,+BAAQ,uCAAuC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EACnG;AAEA,SAAO;AACT;AAUA,SAAS,mBAAmB,SAAiB,KAA+B;AAE1E,QAAM,mBAAmB;AACzB,MAAI;AAEJ,UAAQ,QAAQ,iBAAiB,KAAK,OAAO,OAAO,MAAM;AACxD,UAAM,OAAO,MAAM,CAAC;AACpB,UAAM,UAAU,MAAM,CAAC;AACvB,QAAI,CAAC,IAAI,IAAI,IAAI,GAAG;AAClB,UAAI,IAAI,MAAM,OAAO;AAAA,IACvB;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/manifest/plugins/maven.js

@@ -0,0 +1,128 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var maven_exports = {};
+__export(maven_exports, {
+  parseMavenManifest: () => parseMavenManifest
+});
+module.exports = __toCommonJS(maven_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+function mapMavenScope(mavenScope) {
+  if (!mavenScope || mavenScope.trim() === "") {
+    return "production";
+  }
+  const normalized = mavenScope.trim().toLowerCase();
+  switch (normalized) {
+    case "compile":
+    case "runtime":
+      return "production";
+    case "test":
+      return "development";
+    case "provided":
+    case "system":
+      return "optional";
+    default:
+      return "production";
+  }
+}
+function extractXmlElement(xml, tagName) {
+  const regex = new RegExp(`<${tagName}>([^<]*)</${tagName}>`);
+  const match = xml.match(regex);
+  return match ? match[1].trim() : void 0;
+}
+async function parseMavenManifest(manifestPath, projectRoot) {
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:maven] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  if (!content.includes("<project")) {
+    (0, import_errors.logWarn)(`[sec:maven] Invalid pom.xml structure at ${relativeManifest} \u2014 missing <project> element`);
+    return [];
+  }
+  const license = extractMavenLicense(content);
+  const dependencies = [];
+  const dependencyBlocks = content.matchAll(/<dependency>([\s\S]*?)<\/dependency>/g);
+  for (const block of dependencyBlocks) {
+    const depXml = block[1];
+    const groupId = extractXmlElement(depXml, "groupId");
+    const artifactId = extractXmlElement(depXml, "artifactId");
+    const version = extractXmlElement(depXml, "version");
+    const scope = extractXmlElement(depXml, "scope");
+    if (!groupId || groupId.trim() === "") {
+      (0, import_errors.logWarn)(`[sec:maven] Missing groupId in dependency at ${relativeManifest} \u2014 skipping`);
+      continue;
+    }
+    if (!artifactId || artifactId.trim() === "") {
+      (0, import_errors.logWarn)(`[sec:maven] Missing artifactId in dependency at ${relativeManifest} \u2014 skipping`);
+      continue;
+    }
+    if (groupId.includes("${") || artifactId.includes("${")) {
+      (0, import_errors.logWarn)(`[sec:maven] Unresolved property in dependency ${groupId}:${artifactId} at ${relativeManifest} \u2014 skipping`);
+      continue;
+    }
+    const name = `${groupId}:${artifactId}`;
+    let declaredConstraint;
+    if (version && version.trim() !== "" && !version.includes("${")) {
+      declaredConstraint = version.trim();
+    } else {
+      declaredConstraint = version && !version.includes("${") ? version.trim() : "";
+    }
+    const mappedScope = mapMavenScope(scope);
+    dependencies.push({
+      name,
+      declaredConstraint,
+      resolvedVersion: declaredConstraint || void 0,
+      scope: mappedScope,
+      ecosystem: "maven",
+      sourceManifest: relativeManifest,
+      ...license !== void 0 ? { license } : {}
+    });
+  }
+  return dependencies;
+}
+function extractMavenLicense(content) {
+  const licensesMatch = content.match(/<licenses\b[^>]*>([\s\S]*?)<\/licenses>/i);
+  if (!licensesMatch) return void 0;
+  const licenseBlock = licensesMatch[1];
+  const nameMatch = licenseBlock.match(/<name>([^<]+)<\/name>/i);
+  if (nameMatch && nameMatch[1].trim() !== "") {
+    return nameMatch[1].trim();
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseMavenManifest
+});
+//# sourceMappingURL=maven.js.map

package/dist/security/manifest/plugins/maven.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/maven.ts"],
+  "sourcesContent": ["/**\n * Maven Version Extraction Plugin for KiroGraph-Sec\n *\n * Extends the existing architecture maven parser to extract version constraints,\n * dependency scopes, and groupId/artifactId for security analysis.\n *\n * Reuses `mavenParser` from `src/architecture/manifest/maven.ts` for discovery and\n * basic parsing, then layers on version/scope extraction from pom.xml.\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Maven scope to ParsedDependency scope mapping.\n *\n * - compile (default), runtime \u2192 production\n * - test \u2192 development\n * - provided, system \u2192 optional\n */\nfunction mapMavenScope(mavenScope: string | undefined): ParsedDependency['scope'] {\n  if (!mavenScope || mavenScope.trim() === '') {\n    return 'production';\n  }\n\n  const normalized = mavenScope.trim().toLowerCase();\n  switch (normalized) {\n    case 'compile':\n    case 'runtime':\n      return 'production';\n    case 'test':\n      return 'development';\n    case 'provided':\n    case 'system':\n      return 'optional';\n    default:\n      // Unknown scope defaults to production\n      return 'production';\n  }\n}\n\n/**\n * Extract text content from an XML element by tag name within a given XML fragment.\n * Returns undefined if the element is not found.\n */\nfunction extractXmlElement(xml: string, tagName: string): string | undefined {\n  const regex = new RegExp(`<${tagName}>([^<]*)</${tagName}>`);\n  const match = xml.match(regex);\n  return match ? match[1].trim() : undefined;\n}\n\n/**\n * Parse a Maven pom.xml manifest and extract dependency declarations\n * with groupId, artifactId, version constraints, and scopes.\n *\n * @param manifestPath - Absolute path to the pom.xml file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parseMavenManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read the pom.xml content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:maven] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Validate basic XML structure\n  if (!content.includes('<project')) {\n    logWarn(`[sec:maven] Invalid pom.xml structure at ${relativeManifest} \u2014 missing <project> element`);\n    return [];\n  }\n\n  // Extract the project-level license\n  const license = extractMavenLicense(content);\n\n  // Extract all <dependency> blocks from the <dependencies> sections\n  const dependencies: ParsedDependency[] = [];\n\n  // Match all <dependency>...</dependency> blocks\n  const dependencyBlocks = content.matchAll(/<dependency>([\\s\\S]*?)<\\/dependency>/g);\n\n  for (const block of dependencyBlocks) {\n    const depXml = block[1];\n\n    const groupId = extractXmlElement(depXml, 'groupId');\n    const artifactId = extractXmlElement(depXml, 'artifactId');\n    const version = extractXmlElement(depXml, 'version');\n    const scope = extractXmlElement(depXml, 'scope');\n\n    // Validate required fields\n    if (!groupId || groupId.trim() === '') {\n      logWarn(`[sec:maven] Missing groupId in dependency at ${relativeManifest} \u2014 skipping`);\n      continue;\n    }\n\n    if (!artifactId || artifactId.trim() === '') {\n      logWarn(`[sec:maven] Missing artifactId in dependency at ${relativeManifest} \u2014 skipping`);\n      continue;\n    }\n\n    // Skip dependencies with unresolved Maven properties (e.g. ${project.version})\n    if (groupId.includes('${') || artifactId.includes('${')) {\n      logWarn(`[sec:maven] Unresolved property in dependency ${groupId}:${artifactId} at ${relativeManifest} \u2014 skipping`);\n      continue;\n    }\n\n    // Build the dependency name as groupId:artifactId (Maven convention)\n    const name = `${groupId}:${artifactId}`;\n\n    // Version constraint \u2014 may be absent (managed by parent POM or BOM)\n    let declaredConstraint: string;\n    if (version && version.trim() !== '' && !version.includes('${')) {\n      declaredConstraint = version.trim();\n    } else {\n      // No version or unresolved property \u2014 use empty string to indicate managed externally\n      declaredConstraint = version && !version.includes('${') ? version.trim() : '';\n    }\n\n    const mappedScope = mapMavenScope(scope);\n\n    dependencies.push({\n      name,\n      declaredConstraint,\n      resolvedVersion: declaredConstraint || undefined,\n      scope: mappedScope,\n      ecosystem: 'maven',\n      sourceManifest: relativeManifest,\n      ...(license !== undefined ? { license } : {}),\n    });\n  }\n\n  return dependencies;\n}\n\n/**\n * Extract the first license name from a pom.xml <licenses> block.\n * Looks for: <licenses><license><name>...</name></license></licenses>\n */\nfunction extractMavenLicense(content: string): string | undefined {\n  const licensesMatch = content.match(/<licenses\\b[^>]*>([\\s\\S]*?)<\\/licenses>/i);\n  if (!licensesMatch) return undefined;\n  const licenseBlock = licensesMatch[1];\n  const nameMatch = licenseBlock.match(/<name>([^<]+)<\\/name>/i);\n  if (nameMatch && nameMatch[1].trim() !== '') {\n    return nameMatch[1].trim();\n  }\n  return undefined;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AASxB,SAAS,cAAc,YAA2D;AAChF,MAAI,CAAC,cAAc,WAAW,KAAK,MAAM,IAAI;AAC3C,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,WAAW,KAAK,EAAE,YAAY;AACjD,UAAQ,YAAY;AAAA,IAClB,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AAEE,aAAO;AAAA,EACX;AACF;AAMA,SAAS,kBAAkB,KAAa,SAAqC;AAC3E,QAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,aAAa,OAAO,GAAG;AAC3D,QAAM,QAAQ,IAAI,MAAM,KAAK;AAC7B,SAAO,QAAQ,MAAM,CAAC,EAAE,KAAK,IAAI;AACnC;AAUA,eAAsB,mBACpB,cACA,aAC6B;AAC7B,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,8BAA8B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC7G,WAAO,CAAC;AAAA,EACV;AAGA,MAAI,CAAC,QAAQ,SAAS,UAAU,GAAG;AACjC,+BAAQ,4CAA4C,gBAAgB,mCAA8B;AAClG,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,UAAU,oBAAoB,OAAO;AAG3C,QAAM,eAAmC,CAAC;AAG1C,QAAM,mBAAmB,QAAQ,SAAS,uCAAuC;AAEjF,aAAW,SAAS,kBAAkB;AACpC,UAAM,SAAS,MAAM,CAAC;AAEtB,UAAM,UAAU,kBAAkB,QAAQ,SAAS;AACnD,UAAM,aAAa,kBAAkB,QAAQ,YAAY;AACzD,UAAM,UAAU,kBAAkB,QAAQ,SAAS;AACnD,UAAM,QAAQ,kBAAkB,QAAQ,OAAO;AAG/C,QAAI,CAAC,WAAW,QAAQ,KAAK,MAAM,IAAI;AACrC,iCAAQ,gDAAgD,gBAAgB,kBAAa;AACrF;AAAA,IACF;AAEA,QAAI,CAAC,cAAc,WAAW,KAAK,MAAM,IAAI;AAC3C,iCAAQ,mDAAmD,gBAAgB,kBAAa;AACxF;AAAA,IACF;AAGA,QAAI,QAAQ,SAAS,IAAI,KAAK,WAAW,SAAS,IAAI,GAAG;AACvD,iCAAQ,iDAAiD,OAAO,IAAI,UAAU,OAAO,gBAAgB,kBAAa;AAClH;AAAA,IACF;AAGA,UAAM,OAAO,GAAG,OAAO,IAAI,UAAU;AAGrC,QAAI;AACJ,QAAI,WAAW,QAAQ,KAAK,MAAM,MAAM,CAAC,QAAQ,SAAS,IAAI,GAAG;AAC/D,2BAAqB,QAAQ,KAAK;AAAA,IACpC,OAAO;AAEL,2BAAqB,WAAW,CAAC,QAAQ,SAAS,IAAI,IAAI,QAAQ,KAAK,IAAI;AAAA,IAC7E;AAEA,UAAM,cAAc,cAAc,KAAK;AAEvC,iBAAa,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,MACA,iBAAiB,sBAAsB;AAAA,MACvC,OAAO;AAAA,MACP,WAAW;AAAA,MACX,gBAAgB;AAAA,MAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7C,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAMA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,gBAAgB,QAAQ,MAAM,0CAA0C;AAC9E,MAAI,CAAC,cAAe,QAAO;AAC3B,QAAM,eAAe,cAAc,CAAC;AACpC,QAAM,YAAY,aAAa,MAAM,wBAAwB;AAC7D,MAAI,aAAa,UAAU,CAAC,EAAE,KAAK,MAAM,IAAI;AAC3C,WAAO,UAAU,CAAC,EAAE,KAAK;AAAA,EAC3B;AACA,SAAO;AACT;",
+  "names": []
+}