kirograph 0.17.0 → 0.19.0

package/dist/security/manifest/plugins/maven.test.js

@@ -0,0 +1,389 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var os = __toESM(require("os"));
+var import_maven = require("./maven");
+(0, import_vitest.describe)("parseMavenManifest", () => {
+  let tmpDir;
+  (0, import_vitest.beforeEach)(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "kirograph-maven-test-"));
+  });
+  (0, import_vitest.afterEach)(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+  function writePomXml(content, dir) {
+    const targetDir = dir ?? tmpDir;
+    const filePath = path.join(targetDir, "pom.xml");
+    fs.mkdirSync(targetDir, { recursive: true });
+    fs.writeFileSync(filePath, content);
+    return filePath;
+  }
+  (0, import_vitest.it)("extracts dependencies with groupId, artifactId, and version", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.example</groupId>
+  <artifactId>my-app</artifactId>
+  <version>1.0.0</version>
+  <dependencies>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-core</artifactId>
+      <version>5.3.20</version>
+    </dependency>
+    <dependency>
+      <groupId>com.google.guava</groupId>
+      <artifactId>guava</artifactId>
+      <version>31.1-jre</version>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(2);
+    const spring = deps.find((d) => d.name === "org.springframework:spring-core");
+    (0, import_vitest.expect)(spring).toBeDefined();
+    (0, import_vitest.expect)(spring.declaredConstraint).toBe("5.3.20");
+    (0, import_vitest.expect)(spring.resolvedVersion).toBe("5.3.20");
+    (0, import_vitest.expect)(spring.scope).toBe("production");
+    (0, import_vitest.expect)(spring.ecosystem).toBe("maven");
+    const guava = deps.find((d) => d.name === "com.google.guava:guava");
+    (0, import_vitest.expect)(guava).toBeDefined();
+    (0, import_vitest.expect)(guava.declaredConstraint).toBe("31.1-jre");
+    (0, import_vitest.expect)(guava.resolvedVersion).toBe("31.1-jre");
+  });
+  (0, import_vitest.it)("maps compile scope to production", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-lang3</artifactId>
+      <version>3.12.0</version>
+      <scope>compile</scope>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].scope).toBe("production");
+  });
+  (0, import_vitest.it)("maps runtime scope to production", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>mysql</groupId>
+      <artifactId>mysql-connector-java</artifactId>
+      <version>8.0.30</version>
+      <scope>runtime</scope>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].scope).toBe("production");
+  });
+  (0, import_vitest.it)("maps test scope to development", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].scope).toBe("development");
+  });
+  (0, import_vitest.it)("maps provided scope to optional", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>javax.servlet</groupId>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>4.0.1</version>
+      <scope>provided</scope>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].scope).toBe("optional");
+  });
+  (0, import_vitest.it)("maps system scope to optional", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>com.example</groupId>
+      <artifactId>local-lib</artifactId>
+      <version>1.0.0</version>
+      <scope>system</scope>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].scope).toBe("optional");
+  });
+  (0, import_vitest.it)("defaults to production scope when no scope specified", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-api</artifactId>
+      <version>2.0.7</version>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].scope).toBe("production");
+  });
+  (0, import_vitest.it)("handles all scope types together", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-core</artifactId>
+      <version>5.3.20</version>
+      <scope>compile</scope>
+    </dependency>
+    <dependency>
+      <groupId>mysql</groupId>
+      <artifactId>mysql-connector-java</artifactId>
+      <version>8.0.30</version>
+      <scope>runtime</scope>
+    </dependency>
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>javax.servlet</groupId>
+      <artifactId>javax.servlet-api</artifactId>
+      <version>4.0.1</version>
+      <scope>provided</scope>
+    </dependency>
+    <dependency>
+      <groupId>com.example</groupId>
+      <artifactId>system-lib</artifactId>
+      <version>1.0.0</version>
+      <scope>system</scope>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(5);
+    (0, import_vitest.expect)(deps.find((d) => d.name === "org.springframework:spring-core").scope).toBe("production");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "mysql:mysql-connector-java").scope).toBe("production");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "junit:junit").scope).toBe("development");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "javax.servlet:javax.servlet-api").scope).toBe("optional");
+    (0, import_vitest.expect)(deps.find((d) => d.name === "com.example:system-lib").scope).toBe("optional");
+  });
+  (0, import_vitest.it)("skips dependencies with missing groupId", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <artifactId>some-lib</artifactId>
+      <version>1.0.0</version>
+    </dependency>
+    <dependency>
+      <groupId>org.valid</groupId>
+      <artifactId>valid-lib</artifactId>
+      <version>2.0.0</version>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("org.valid:valid-lib");
+  });
+  (0, import_vitest.it)("skips dependencies with missing artifactId", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>org.example</groupId>
+      <version>1.0.0</version>
+    </dependency>
+    <dependency>
+      <groupId>org.valid</groupId>
+      <artifactId>valid-lib</artifactId>
+      <version>2.0.0</version>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("org.valid:valid-lib");
+  });
+  (0, import_vitest.it)("skips dependencies with unresolved Maven properties", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>\${project.groupId}</groupId>
+      <artifactId>internal-module</artifactId>
+      <version>1.0.0</version>
+    </dependency>
+    <dependency>
+      <groupId>org.valid</groupId>
+      <artifactId>valid-lib</artifactId>
+      <version>2.0.0</version>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("org.valid:valid-lib");
+  });
+  (0, import_vitest.it)("handles dependencies without version (managed by parent POM)", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-web</artifactId>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].name).toBe("org.springframework:spring-web");
+    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("");
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBeUndefined();
+  });
+  (0, import_vitest.it)("handles version with unresolved property", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-core</artifactId>
+      <version>\${spring.version}</version>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("");
+    (0, import_vitest.expect)(deps[0].resolvedVersion).toBeUndefined();
+  });
+  (0, import_vitest.it)("returns empty array for non-existent file", async () => {
+    const fakePath = path.join(tmpDir, "nonexistent", "pom.xml");
+    const deps = await (0, import_maven.parseMavenManifest)(fakePath, tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("returns empty array for invalid XML without project element", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<not-a-project>
+  <something>value</something>
+</not-a-project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("returns empty array for pom.xml with no dependencies", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.example</groupId>
+  <artifactId>my-app</artifactId>
+  <version>1.0.0</version>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toEqual([]);
+  });
+  (0, import_vitest.it)("sets sourceManifest as relative path", async () => {
+    const subDir = path.join(tmpDir, "modules", "core");
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>org.example</groupId>
+      <artifactId>lib</artifactId>
+      <version>1.0.0</version>
+    </dependency>
+  </dependencies>
+</project>`, subDir);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].sourceManifest).toBe("modules/core/pom.xml");
+  });
+  (0, import_vitest.it)("sets ecosystem to maven for all dependencies", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencies>
+    <dependency>
+      <groupId>org.apache.logging.log4j</groupId>
+      <artifactId>log4j-core</artifactId>
+      <version>2.17.0</version>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps).toHaveLength(1);
+    (0, import_vitest.expect)(deps[0].ecosystem).toBe("maven");
+  });
+  (0, import_vitest.it)("handles dependencies in dependencyManagement section", async () => {
+    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
+<project>
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-dependencies</artifactId>
+        <version>3.1.0</version>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+  <dependencies>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-web</artifactId>
+      <version>3.1.0</version>
+    </dependency>
+  </dependencies>
+</project>`);
+    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
+    (0, import_vitest.expect)(deps.length).toBeGreaterThanOrEqual(1);
+    const starterWeb = deps.find((d) => d.name === "org.springframework.boot:spring-boot-starter-web");
+    (0, import_vitest.expect)(starterWeb).toBeDefined();
+    (0, import_vitest.expect)(starterWeb.declaredConstraint).toBe("3.1.0");
+  });
+});
+//# sourceMappingURL=maven.test.js.map

package/dist/security/manifest/plugins/maven.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/maven.test.ts"],
+  "sourcesContent": ["/**\n * Unit tests for the Maven security manifest plugin.\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { parseMavenManifest } from './maven';\n\ndescribe('parseMavenManifest', () => {\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kirograph-maven-test-'));\n  });\n\n  afterEach(() => {\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  function writePomXml(content: string, dir?: string): string {\n    const targetDir = dir ?? tmpDir;\n    const filePath = path.join(targetDir, 'pom.xml');\n    fs.mkdirSync(targetDir, { recursive: true });\n    fs.writeFileSync(filePath, content);\n    return filePath;\n  }\n\n  it('extracts dependencies with groupId, artifactId, and version', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <modelVersion>4.0.0</modelVersion>\n  <groupId>com.example</groupId>\n  <artifactId>my-app</artifactId>\n  <version>1.0.0</version>\n  <dependencies>\n    <dependency>\n      <groupId>org.springframework</groupId>\n      <artifactId>spring-core</artifactId>\n      <version>5.3.20</version>\n    </dependency>\n    <dependency>\n      <groupId>com.google.guava</groupId>\n      <artifactId>guava</artifactId>\n      <version>31.1-jre</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n\n    const spring = deps.find(d => d.name === 'org.springframework:spring-core');\n    expect(spring).toBeDefined();\n    expect(spring!.declaredConstraint).toBe('5.3.20');\n    expect(spring!.resolvedVersion).toBe('5.3.20');\n    expect(spring!.scope).toBe('production');\n    expect(spring!.ecosystem).toBe('maven');\n\n    const guava = deps.find(d => d.name === 'com.google.guava:guava');\n    expect(guava).toBeDefined();\n    expect(guava!.declaredConstraint).toBe('31.1-jre');\n    expect(guava!.resolvedVersion).toBe('31.1-jre');\n  });\n\n  it('maps compile scope to production', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.apache.commons</groupId>\n      <artifactId>commons-lang3</artifactId>\n      <version>3.12.0</version>\n      <scope>compile</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('production');\n  });\n\n  it('maps runtime scope to production', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>mysql</groupId>\n      <artifactId>mysql-connector-java</artifactId>\n      <version>8.0.30</version>\n      <scope>runtime</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('production');\n  });\n\n  it('maps test scope to development', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>junit</groupId>\n      <artifactId>junit</artifactId>\n      <version>4.13.2</version>\n      <scope>test</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('development');\n  });\n\n  it('maps provided scope to optional', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>javax.servlet</groupId>\n      <artifactId>javax.servlet-api</artifactId>\n      <version>4.0.1</version>\n      <scope>provided</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('optional');\n  });\n\n  it('maps system scope to optional', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>com.example</groupId>\n      <artifactId>local-lib</artifactId>\n      <version>1.0.0</version>\n      <scope>system</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('optional');\n  });\n\n  it('defaults to production scope when no scope specified', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.slf4j</groupId>\n      <artifactId>slf4j-api</artifactId>\n      <version>2.0.7</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('production');\n  });\n\n  it('handles all scope types together', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.springframework</groupId>\n      <artifactId>spring-core</artifactId>\n      <version>5.3.20</version>\n      <scope>compile</scope>\n    </dependency>\n    <dependency>\n      <groupId>mysql</groupId>\n      <artifactId>mysql-connector-java</artifactId>\n      <version>8.0.30</version>\n      <scope>runtime</scope>\n    </dependency>\n    <dependency>\n      <groupId>junit</groupId>\n      <artifactId>junit</artifactId>\n      <version>4.13.2</version>\n      <scope>test</scope>\n    </dependency>\n    <dependency>\n      <groupId>javax.servlet</groupId>\n      <artifactId>javax.servlet-api</artifactId>\n      <version>4.0.1</version>\n      <scope>provided</scope>\n    </dependency>\n    <dependency>\n      <groupId>com.example</groupId>\n      <artifactId>system-lib</artifactId>\n      <version>1.0.0</version>\n      <scope>system</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(5);\n    expect(deps.find(d => d.name === 'org.springframework:spring-core')!.scope).toBe('production');\n    expect(deps.find(d => d.name === 'mysql:mysql-connector-java')!.scope).toBe('production');\n    expect(deps.find(d => d.name === 'junit:junit')!.scope).toBe('development');\n    expect(deps.find(d => d.name === 'javax.servlet:javax.servlet-api')!.scope).toBe('optional');\n    expect(deps.find(d => d.name === 'com.example:system-lib')!.scope).toBe('optional');\n  });\n\n  it('skips dependencies with missing groupId', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <artifactId>some-lib</artifactId>\n      <version>1.0.0</version>\n    </dependency>\n    <dependency>\n      <groupId>org.valid</groupId>\n      <artifactId>valid-lib</artifactId>\n      <version>2.0.0</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('org.valid:valid-lib');\n  });\n\n  it('skips dependencies with missing artifactId', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.example</groupId>\n      <version>1.0.0</version>\n    </dependency>\n    <dependency>\n      <groupId>org.valid</groupId>\n      <artifactId>valid-lib</artifactId>\n      <version>2.0.0</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('org.valid:valid-lib');\n  });\n\n  it('skips dependencies with unresolved Maven properties', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>\\${project.groupId}</groupId>\n      <artifactId>internal-module</artifactId>\n      <version>1.0.0</version>\n    </dependency>\n    <dependency>\n      <groupId>org.valid</groupId>\n      <artifactId>valid-lib</artifactId>\n      <version>2.0.0</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('org.valid:valid-lib');\n  });\n\n  it('handles dependencies without version (managed by parent POM)', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.springframework</groupId>\n      <artifactId>spring-web</artifactId>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('org.springframework:spring-web');\n    expect(deps[0].declaredConstraint).toBe('');\n    expect(deps[0].resolvedVersion).toBeUndefined();\n  });\n\n  it('handles version with unresolved property', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.springframework</groupId>\n      <artifactId>spring-core</artifactId>\n      <version>\\${spring.version}</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('');\n    expect(deps[0].resolvedVersion).toBeUndefined();\n  });\n\n  it('returns empty array for non-existent file', async () => {\n    const fakePath = path.join(tmpDir, 'nonexistent', 'pom.xml');\n    const deps = await parseMavenManifest(fakePath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('returns empty array for invalid XML without project element', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<not-a-project>\n  <something>value</something>\n</not-a-project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('returns empty array for pom.xml with no dependencies', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <modelVersion>4.0.0</modelVersion>\n  <groupId>com.example</groupId>\n  <artifactId>my-app</artifactId>\n  <version>1.0.0</version>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('sets sourceManifest as relative path', async () => {\n    const subDir = path.join(tmpDir, 'modules', 'core');\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.example</groupId>\n      <artifactId>lib</artifactId>\n      <version>1.0.0</version>\n    </dependency>\n  </dependencies>\n</project>`, subDir);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].sourceManifest).toBe('modules/core/pom.xml');\n  });\n\n  it('sets ecosystem to maven for all dependencies', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.apache.logging.log4j</groupId>\n      <artifactId>log4j-core</artifactId>\n      <version>2.17.0</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].ecosystem).toBe('maven');\n  });\n\n  it('handles dependencies in dependencyManagement section', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencyManagement>\n    <dependencies>\n      <dependency>\n        <groupId>org.springframework.boot</groupId>\n        <artifactId>spring-boot-dependencies</artifactId>\n        <version>3.1.0</version>\n        <scope>import</scope>\n      </dependency>\n    </dependencies>\n  </dependencyManagement>\n  <dependencies>\n    <dependency>\n      <groupId>org.springframework.boot</groupId>\n      <artifactId>spring-boot-starter-web</artifactId>\n      <version>3.1.0</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    // Should extract both dependencies (from dependencyManagement and regular)\n    expect(deps.length).toBeGreaterThanOrEqual(1);\n    const starterWeb = deps.find(d => d.name === 'org.springframework.boot:spring-boot-starter-web');\n    expect(starterWeb).toBeDefined();\n    expect(starterWeb!.declaredConstraint).toBe('3.1.0');\n  });\n});\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAGA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,mBAAmC;AAAA,IAEnC,wBAAS,sBAAsB,MAAM;AACnC,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,uBAAuB,CAAC;AAAA,EACzE,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAED,WAAS,YAAY,SAAiB,KAAsB;AAC1D,UAAM,YAAY,OAAO;AACzB,UAAM,WAAW,KAAK,KAAK,WAAW,SAAS;AAC/C,OAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAC3C,OAAG,cAAc,UAAU,OAAO;AAClC,WAAO;AAAA,EACT;AAEA,wBAAG,+DAA+D,YAAY;AAC5E,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAkB1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAE3B,UAAM,SAAS,KAAK,KAAK,OAAK,EAAE,SAAS,iCAAiC;AAC1E,8BAAO,MAAM,EAAE,YAAY;AAC3B,8BAAO,OAAQ,kBAAkB,EAAE,KAAK,QAAQ;AAChD,8BAAO,OAAQ,eAAe,EAAE,KAAK,QAAQ;AAC7C,8BAAO,OAAQ,KAAK,EAAE,KAAK,YAAY;AACvC,8BAAO,OAAQ,SAAS,EAAE,KAAK,OAAO;AAEtC,UAAM,QAAQ,KAAK,KAAK,OAAK,EAAE,SAAS,wBAAwB;AAChE,8BAAO,KAAK,EAAE,YAAY;AAC1B,8BAAO,MAAO,kBAAkB,EAAE,KAAK,UAAU;AACjD,8BAAO,MAAO,eAAe,EAAE,KAAK,UAAU;AAAA,EAChD,CAAC;AAED,wBAAG,oCAAoC,YAAY;AACjD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAU1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY;AAAA,EACzC,CAAC;AAED,wBAAG,oCAAoC,YAAY;AACjD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAU1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY;AAAA,EACzC,CAAC;AAED,wBAAG,kCAAkC,YAAY;AAC/C,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAU1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,aAAa;AAAA,EAC1C,CAAC;AAED,wBAAG,mCAAmC,YAAY;AAChD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAU1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,UAAU;AAAA,EACvC,CAAC;AAED,wBAAG,iCAAiC,YAAY;AAC9C,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAU1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,UAAU;AAAA,EACvC,CAAC;AAED,wBAAG,wDAAwD,YAAY;AACrE,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAS1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY;AAAA,EACzC,CAAC;AAED,wBAAG,oCAAoC,YAAY;AACjD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAkC1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,iCAAiC,EAAG,KAAK,EAAE,KAAK,YAAY;AAC7F,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,4BAA4B,EAAG,KAAK,EAAE,KAAK,YAAY;AACxF,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,aAAa,EAAG,KAAK,EAAE,KAAK,aAAa;AAC1E,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,iCAAiC,EAAG,KAAK,EAAE,KAAK,UAAU;AAC3F,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,wBAAwB,EAAG,KAAK,EAAE,KAAK,UAAU;AAAA,EACpF,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAa1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,qBAAqB;AAAA,EACjD,CAAC;AAED,wBAAG,8CAA8C,YAAY;AAC3D,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAa1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,qBAAqB;AAAA,EACjD,CAAC;AAED,wBAAG,uDAAuD,YAAY;AACpE,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAc1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,qBAAqB;AAAA,EACjD,CAAC;AAED,wBAAG,gEAAgE,YAAY;AAC7E,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAQ1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,gCAAgC;AAC1D,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE;AAC1C,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,cAAc;AAAA,EAChD,CAAC;AAED,wBAAG,4CAA4C,YAAY;AACzD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAS1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE;AAC1C,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,cAAc;AAAA,EAChD,CAAC;AAED,wBAAG,6CAA6C,YAAY;AAC1D,UAAM,WAAW,KAAK,KAAK,QAAQ,eAAe,SAAS;AAC3D,UAAM,OAAO,UAAM,iCAAmB,UAAU,MAAM;AACtD,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,+DAA+D,YAAY;AAC5E,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA,iBAGpB;AAEb,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAC1D,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,wDAAwD,YAAY;AACrE,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAM1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAC1D,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,SAAS,KAAK,KAAK,QAAQ,WAAW,MAAM;AAClD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aASxB,MAAM;AAEf,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,cAAc,EAAE,KAAK,sBAAsB;AAAA,EAC5D,CAAC;AAED,wBAAG,gDAAgD,YAAY;AAC7D,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAS1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,OAAO;AAAA,EACxC,CAAC;AAED,wBAAG,wDAAwD,YAAY;AACrE,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAmB1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAG1D,8BAAO,KAAK,MAAM,EAAE,uBAAuB,CAAC;AAC5C,UAAM,aAAa,KAAK,KAAK,OAAK,EAAE,SAAS,kDAAkD;AAC/F,8BAAO,UAAU,EAAE,YAAY;AAC/B,8BAAO,WAAY,kBAAkB,EAAE,KAAK,OAAO;AAAA,EACrD,CAAC;AACH,CAAC;",
+  "names": []
+}