kirograph 0.17.0 → 0.20.0

package/dist/security/license.js

@@ -0,0 +1,70 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var license_exports = {};
+__export(license_exports, {
+  checkLicensePolicy: () => checkLicensePolicy
+});
+module.exports = __toCommonJS(license_exports);
+function matchesPattern(license, pattern) {
+  const lowerLicense = license.toLowerCase();
+  const lowerPattern = pattern.toLowerCase();
+  if (!lowerPattern.includes("*")) {
+    return lowerLicense === lowerPattern;
+  }
+  const regexStr = lowerPattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  const regex = new RegExp(`^${regexStr}$`);
+  return regex.test(lowerLicense);
+}
+function matchesAny(license, patterns) {
+  return patterns.some((p) => matchesPattern(license, p));
+}
+function checkLicensePolicy(deps, policy) {
+  const violations = [];
+  for (const dep of deps) {
+    if (!dep.license) continue;
+    const license = dep.license;
+    if (policy.deny.length > 0 && matchesAny(license, policy.deny)) {
+      violations.push({
+        packageName: dep.package_name,
+        ecosystem: dep.ecosystem,
+        license,
+        severity: "deny"
+      });
+    } else if (policy.warn.length > 0 && matchesAny(license, policy.warn)) {
+      violations.push({
+        packageName: dep.package_name,
+        ecosystem: dep.ecosystem,
+        license,
+        severity: "warn"
+      });
+    }
+  }
+  violations.sort((a, b) => {
+    if (a.severity !== b.severity) {
+      return a.severity === "deny" ? -1 : 1;
+    }
+    return a.packageName.localeCompare(b.packageName);
+  });
+  return violations;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  checkLicensePolicy
+});
+//# sourceMappingURL=license.js.map

package/dist/security/license.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/license.ts"],
+  "sourcesContent": ["/**\n * License Compliance Checker for KiroGraph-Sec\n *\n * Checks project dependencies against a license policy (deny/warn lists).\n * Supports case-insensitive matching and wildcard patterns (e.g. GPL-* matches\n * GPL-2.0, GPL-3.0-only, etc.).\n */\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface LicenseViolation {\n  packageName: string;\n  ecosystem: string;\n  license: string;\n  severity: 'deny' | 'warn';\n}\n\n// \u2500\u2500 Wildcard matching \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Test whether a license string matches a policy pattern.\n * Matching is case-insensitive. The pattern may contain `*` as a wildcard\n * (matches any sequence of characters).\n */\nfunction matchesPattern(license: string, pattern: string): boolean {\n  const lowerLicense = license.toLowerCase();\n  const lowerPattern = pattern.toLowerCase();\n\n  if (!lowerPattern.includes('*')) {\n    return lowerLicense === lowerPattern;\n  }\n\n  // Convert wildcard pattern to regex\n  // Escape regex special chars except *, then replace * with .*\n  const regexStr = lowerPattern\n    .replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n    .replace(/\\*/g, '.*');\n  const regex = new RegExp(`^${regexStr}$`);\n  return regex.test(lowerLicense);\n}\n\n/**\n * Test whether a license matches any pattern in the list.\n */\nfunction matchesAny(license: string, patterns: string[]): boolean {\n  return patterns.some(p => matchesPattern(license, p));\n}\n\n// \u2500\u2500 Main check function \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Check a list of dependencies against a license policy.\n *\n * Dependencies with no license are skipped (no violation).\n * A license matched in `deny` produces a 'deny' violation.\n * A license matched in `warn` (and not in `deny`) produces a 'warn' violation.\n *\n * @param deps - Array of dependency rows from sec_dependencies\n * @param policy - The license policy with deny and warn lists\n * @returns Array of violations sorted by severity (deny first) then package name\n */\nexport function checkLicensePolicy(\n  deps: Array<{ package_name: string; ecosystem: string; license: string | null }>,\n  policy: { deny: string[]; warn: string[] },\n): LicenseViolation[] {\n  const violations: LicenseViolation[] = [];\n\n  for (const dep of deps) {\n    if (!dep.license) continue;\n\n    const license = dep.license;\n\n    if (policy.deny.length > 0 && matchesAny(license, policy.deny)) {\n      violations.push({\n        packageName: dep.package_name,\n        ecosystem: dep.ecosystem,\n        license,\n        severity: 'deny',\n      });\n    } else if (policy.warn.length > 0 && matchesAny(license, policy.warn)) {\n      violations.push({\n        packageName: dep.package_name,\n        ecosystem: dep.ecosystem,\n        license,\n        severity: 'warn',\n      });\n    }\n  }\n\n  // Sort: deny first, then warn; within each group sort by package name\n  violations.sort((a, b) => {\n    if (a.severity !== b.severity) {\n      return a.severity === 'deny' ? -1 : 1;\n    }\n    return a.packageName.localeCompare(b.packageName);\n  });\n\n  return violations;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBA,SAAS,eAAe,SAAiB,SAA0B;AACjE,QAAM,eAAe,QAAQ,YAAY;AACzC,QAAM,eAAe,QAAQ,YAAY;AAEzC,MAAI,CAAC,aAAa,SAAS,GAAG,GAAG;AAC/B,WAAO,iBAAiB;AAAA,EAC1B;AAIA,QAAM,WAAW,aACd,QAAQ,sBAAsB,MAAM,EACpC,QAAQ,OAAO,IAAI;AACtB,QAAM,QAAQ,IAAI,OAAO,IAAI,QAAQ,GAAG;AACxC,SAAO,MAAM,KAAK,YAAY;AAChC;AAKA,SAAS,WAAW,SAAiB,UAA6B;AAChE,SAAO,SAAS,KAAK,OAAK,eAAe,SAAS,CAAC,CAAC;AACtD;AAeO,SAAS,mBACd,MACA,QACoB;AACpB,QAAM,aAAiC,CAAC;AAExC,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,IAAI,QAAS;AAElB,UAAM,UAAU,IAAI;AAEpB,QAAI,OAAO,KAAK,SAAS,KAAK,WAAW,SAAS,OAAO,IAAI,GAAG;AAC9D,iBAAW,KAAK;AAAA,QACd,aAAa,IAAI;AAAA,QACjB,WAAW,IAAI;AAAA,QACf;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AAAA,IACH,WAAW,OAAO,KAAK,SAAS,KAAK,WAAW,SAAS,OAAO,IAAI,GAAG;AACrE,iBAAW,KAAK;AAAA,QACd,aAAa,IAAI;AAAA,QACjB,WAAW,IAAI;AAAA,QACf;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,EACF;AAGA,aAAW,KAAK,CAAC,GAAG,MAAM;AACxB,QAAI,EAAE,aAAa,EAAE,UAAU;AAC7B,aAAO,EAAE,aAAa,SAAS,KAAK;AAAA,IACtC;AACA,WAAO,EAAE,YAAY,cAAc,EAAE,WAAW;AAAA,EAClD,CAAC;AAED,SAAO;AACT;",
+  "names": []
+}

package/dist/security/manifest/adapter.d.ts

@@ -0,0 +1,92 @@
+import type { ManifestParser as ArchManifestParser } from '../../architecture/types';
+import type { ParsedDependency, ManifestParseResult } from '../types';
+/**
+ * A version extraction plugin provides ecosystem-specific logic to extract
+ * version constraints and scopes from manifest files. Each plugin corresponds
+ * to one or more architecture parsers and enhances their output with security-
+ * relevant metadata.
+ */
+export interface VersionExtractionPlugin {
+    /** Ecosystem identifier matching the architecture parser name (e.g. 'npm', 'maven', 'go') */
+    ecosystem: string;
+    /** Manifest filenames this plugin handles (should match the architecture parser's manifestFiles) */
+    manifestFiles: string[];
+    /** Returns true if this plugin can handle the given manifest file path */
+    canExtract(manifestPath: string): boolean;
+    /**
+     * Extract version constraints and scopes from a manifest file.
+     * This is called AFTER the architecture parser has already discovered the manifest.
+     * The plugin receives the manifest path and project root, and returns detailed
+     * dependency information including versions and scopes.
+     */
+    extract(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+}
+export declare class SecurityManifestAdapter {
+    private readonly archParsers;
+    private readonly plugins;
+    /** Standalone plugins have no corresponding architecture parser — they own their own discovery. */
+    private readonly standalonePlugins;
+    private readonly projectRoot;
+    constructor(projectRoot: string);
+    /**
+     * Register a version extraction plugin for an ecosystem that has a
+     * corresponding architecture parser. The plugin's `ecosystem` field
+     * must equal the architecture parser's `name` for the lookup to work.
+     */
+    registerPlugin(plugin: VersionExtractionPlugin): void;
+    /**
+     * Register a standalone version extraction plugin for an ecosystem that
+     * has NO corresponding architecture parser. The plugin's `manifestFiles`
+     * list drives discovery — the adapter will scan for those filenames and
+     * invoke the plugin directly when found.
+     */
+    registerStandalonePlugin(plugin: VersionExtractionPlugin): void;
+    /**
+     * Get all registered version extraction plugins (wrapped + standalone).
+     */
+    getPlugins(): VersionExtractionPlugin[];
+    /**
+     * Get the architecture parsers being wrapped.
+     */
+    getArchParsers(): ArchManifestParser[];
+    /**
+     * Discover all manifest files in the project tree.
+     * Includes files known to architecture parsers AND files from standalone plugins.
+     * Returns absolute paths.
+     */
+    discoverManifests(): string[];
+    /**
+     * Run full discovery and extraction:
+     * 1. Discover manifest files (reusing architecture's SKIP_DIRS logic)
+     * 2. For each manifest, find the matching architecture parser
+     * 3. If a version extraction plugin is registered for that ecosystem,
+     *    use it to extract detailed version/scope information
+     * 4. Otherwise, fall back to basic extraction from the architecture parser's
+     *    ArchPackage.externalDeps (names only, no version info)
+     */
+    extractAll(): Promise<ManifestParseResult>;
+    /**
+     * Extract dependencies for a single manifest file.
+     * Tries standalone plugins first (when there is no arch parser), then
+     * wrapped plugins, then falls back to arch parser output.
+     */
+    extractFromManifest(manifestPath: string): Promise<ParsedDependency[]>;
+    /**
+     * Get the ecosystem name for a given manifest file path.
+     * Returns undefined if no parser handles this file.
+     */
+    getEcosystem(manifestPath: string): string | undefined;
+    /**
+     * Fallback extraction: converts ArchPackage.externalDeps (names only) into
+     * ParsedDependency records with empty version constraints and default scope.
+     */
+    private _fallbackExtract;
+    /**
+     * Walk the project directory tree looking for manifest files.
+     * Mirrors the architecture module's _findManifests() logic, respecting SKIP_DIRS.
+     * Includes manifest filenames from standalone plugins in addition to arch parsers.
+     */
+    private _findManifests;
+    private _walkDir;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/security/manifest/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../src/security/manifest/adapter.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,IAAI,kBAAkB,EAAe,MAAM,0BAA0B,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAItE;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0EAA0E;IAC1E,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1C;;;;;OAKG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CACjF;AAYD,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmD;IAC3E,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmD;IACrF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,WAAW,EAAE,MAAM;IAK/B;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAIrD;;;;;OAKG;IACH,wBAAwB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAI/D;;OAEG;IACH,UAAU,IAAI,uBAAuB,EAAE;IAIvC;;OAEG;IACH,cAAc,IAAI,kBAAkB,EAAE;IAItC;;;;OAIG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAI7B;;;;;;;;OAQG;IACG,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAqDhD;;;;OAIG;IACG,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyB5E;;;OAGG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAOtD;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAqBxB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,QAAQ;CAsBjB"}

package/dist/security/manifest/adapter.js

@@ -0,0 +1,243 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var adapter_exports = {};
+__export(adapter_exports, {
+  SecurityManifestAdapter: () => SecurityManifestAdapter
+});
+module.exports = __toCommonJS(adapter_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_manifest = require("../../architecture/manifest/index");
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "target",
+  ".gradle",
+  "__pycache__",
+  ".kirograph",
+  "vendor",
+  ".cache",
+  "coverage",
+  ".nyc_output",
+  "_build",
+  "_opam",
+  "elm-stuff",
+  "zig-cache",
+  "zig-out"
+]);
+class SecurityManifestAdapter {
+  constructor(projectRoot) {
+    this.plugins = /* @__PURE__ */ new Map();
+    /** Standalone plugins have no corresponding architecture parser — they own their own discovery. */
+    this.standalonePlugins = /* @__PURE__ */ new Map();
+    this.projectRoot = projectRoot;
+    this.archParsers = (0, import_manifest.getAllManifestParsers)();
+  }
+  /**
+   * Register a version extraction plugin for an ecosystem that has a
+   * corresponding architecture parser. The plugin's `ecosystem` field
+   * must equal the architecture parser's `name` for the lookup to work.
+   */
+  registerPlugin(plugin) {
+    this.plugins.set(plugin.ecosystem, plugin);
+  }
+  /**
+   * Register a standalone version extraction plugin for an ecosystem that
+   * has NO corresponding architecture parser. The plugin's `manifestFiles`
+   * list drives discovery — the adapter will scan for those filenames and
+   * invoke the plugin directly when found.
+   */
+  registerStandalonePlugin(plugin) {
+    this.standalonePlugins.set(plugin.ecosystem, plugin);
+  }
+  /**
+   * Get all registered version extraction plugins (wrapped + standalone).
+   */
+  getPlugins() {
+    return [...this.plugins.values(), ...this.standalonePlugins.values()];
+  }
+  /**
+   * Get the architecture parsers being wrapped.
+   */
+  getArchParsers() {
+    return this.archParsers;
+  }
+  /**
+   * Discover all manifest files in the project tree.
+   * Includes files known to architecture parsers AND files from standalone plugins.
+   * Returns absolute paths.
+   */
+  discoverManifests() {
+    return this._findManifests(this.projectRoot);
+  }
+  /**
+   * Run full discovery and extraction:
+   * 1. Discover manifest files (reusing architecture's SKIP_DIRS logic)
+   * 2. For each manifest, find the matching architecture parser
+   * 3. If a version extraction plugin is registered for that ecosystem,
+   *    use it to extract detailed version/scope information
+   * 4. Otherwise, fall back to basic extraction from the architecture parser's
+   *    ArchPackage.externalDeps (names only, no version info)
+   */
+  async extractAll() {
+    const manifestPaths = this.discoverManifests();
+    const allDeps = [];
+    const warnings = [];
+    const errors = [];
+    let manifestsParsed = 0;
+    for (const manifestPath of manifestPaths) {
+      const archParser = this.archParsers.find((p) => p.canParse(manifestPath));
+      if (!archParser) continue;
+      const relManifest = path.relative(this.projectRoot, manifestPath).replace(/\\/g, "/");
+      const plugin = this.plugins.get(archParser.name);
+      if (plugin && plugin.canExtract(manifestPath)) {
+        try {
+          const deps = await plugin.extract(manifestPath, this.projectRoot);
+          allDeps.push(...deps);
+          manifestsParsed++;
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          errors.push({ file: relManifest, message });
+        }
+      } else {
+        try {
+          const packages = await archParser.parse(manifestPath, this.projectRoot);
+          const deps = this._fallbackExtract(packages, archParser.name, relManifest);
+          allDeps.push(...deps);
+          manifestsParsed++;
+          if (!plugin) {
+            warnings.push({
+              file: relManifest,
+              message: `No version extraction plugin registered for ecosystem '${archParser.name}'; dependency names extracted without version constraints`
+            });
+          }
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          errors.push({ file: relManifest, message });
+        }
+      }
+    }
+    return {
+      dependenciesCreated: allDeps.length,
+      manifestsParsed,
+      warnings,
+      errors
+    };
+  }
+  /**
+   * Extract dependencies for a single manifest file.
+   * Tries standalone plugins first (when there is no arch parser), then
+   * wrapped plugins, then falls back to arch parser output.
+   */
+  async extractFromManifest(manifestPath) {
+    const archParser = this.archParsers.find((p) => p.canParse(manifestPath));
+    if (!archParser) {
+      const standalonePlugin = [...this.standalonePlugins.values()].find((p) => p.canExtract(manifestPath));
+      if (standalonePlugin) {
+        return standalonePlugin.extract(manifestPath, this.projectRoot);
+      }
+      return [];
+    }
+    const plugin = this.plugins.get(archParser.name);
+    if (plugin && plugin.canExtract(manifestPath)) {
+      return plugin.extract(manifestPath, this.projectRoot);
+    }
+    const packages = await archParser.parse(manifestPath, this.projectRoot);
+    const relManifest = path.relative(this.projectRoot, manifestPath).replace(/\\/g, "/");
+    return this._fallbackExtract(packages, archParser.name, relManifest);
+  }
+  /**
+   * Get the ecosystem name for a given manifest file path.
+   * Returns undefined if no parser handles this file.
+   */
+  getEcosystem(manifestPath) {
+    const parser = this.archParsers.find((p) => p.canParse(manifestPath));
+    return parser?.name;
+  }
+  // ── Private helpers ───────────────────────────────────────────────────────
+  /**
+   * Fallback extraction: converts ArchPackage.externalDeps (names only) into
+   * ParsedDependency records with empty version constraints and default scope.
+   */
+  _fallbackExtract(packages, ecosystem, sourceManifest) {
+    const deps = [];
+    for (const pkg of packages) {
+      if (!pkg.externalDeps) continue;
+      for (const depName of pkg.externalDeps) {
+        deps.push({
+          name: depName,
+          declaredConstraint: "*",
+          scope: "production",
+          ecosystem,
+          sourceManifest
+        });
+      }
+    }
+    return deps;
+  }
+  /**
+   * Walk the project directory tree looking for manifest files.
+   * Mirrors the architecture module's _findManifests() logic, respecting SKIP_DIRS.
+   * Includes manifest filenames from standalone plugins in addition to arch parsers.
+   */
+  _findManifests(dir, results = []) {
+    const manifestFilenames = /* @__PURE__ */ new Set([
+      ...this.archParsers.flatMap((p) => p.manifestFiles),
+      ...Array.from(this.standalonePlugins.values()).flatMap((p) => p.manifestFiles)
+    ]);
+    return this._walkDir(dir, manifestFilenames, results);
+  }
+  _walkDir(dir, manifestFilenames, results) {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return results;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) {
+          this._walkDir(path.join(dir, entry.name), manifestFilenames, results);
+        }
+      } else if (entry.isFile()) {
+        if (manifestFilenames.has(entry.name) || entry.name.endsWith(".csproj")) {
+          results.push(path.join(dir, entry.name));
+        }
+      }
+    }
+    return results;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SecurityManifestAdapter
+});
+//# sourceMappingURL=adapter.js.map

package/dist/security/manifest/adapter.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/manifest/adapter.ts"],
+  "sourcesContent": ["/**\n * SecurityManifestAdapter\n *\n * Wraps the existing architecture manifest parsers (11 parsers: npm, cargo, go,\n * gradle, maven, csproj, python, scala, elm, ocaml) to additionally extract\n * version constraints and dependency scopes that the architecture module does\n * not capture.\n *\n * The architecture parsers discover manifest files and extract package names into\n * `ArchPackage.externalDeps`. This adapter reuses that discovery infrastructure\n * and layers version/scope extraction on top via ecosystem-specific plugins.\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { getAllManifestParsers } from '../../architecture/manifest/index';\nimport type { ManifestParser as ArchManifestParser, ArchPackage } from '../../architecture/types';\nimport type { ParsedDependency, ManifestParseResult } from '../types';\n\n// \u2500\u2500 Plugin Interface \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * A version extraction plugin provides ecosystem-specific logic to extract\n * version constraints and scopes from manifest files. Each plugin corresponds\n * to one or more architecture parsers and enhances their output with security-\n * relevant metadata.\n */\nexport interface VersionExtractionPlugin {\n  /** Ecosystem identifier matching the architecture parser name (e.g. 'npm', 'maven', 'go') */\n  ecosystem: string;\n  /** Manifest filenames this plugin handles (should match the architecture parser's manifestFiles) */\n  manifestFiles: string[];\n  /** Returns true if this plugin can handle the given manifest file path */\n  canExtract(manifestPath: string): boolean;\n  /**\n   * Extract version constraints and scopes from a manifest file.\n   * This is called AFTER the architecture parser has already discovered the manifest.\n   * The plugin receives the manifest path and project root, and returns detailed\n   * dependency information including versions and scopes.\n   */\n  extract(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;\n}\n\n// \u2500\u2500 Directories to skip (mirrors architecture module's SKIP_DIRS) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst SKIP_DIRS = new Set([\n  'node_modules', '.git', 'dist', 'build', 'target', '.gradle', '__pycache__',\n  '.kirograph', 'vendor', '.cache', 'coverage', '.nyc_output', '_build', '_opam',\n  'elm-stuff', 'zig-cache', 'zig-out',\n]);\n\n// \u2500\u2500 SecurityManifestAdapter \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class SecurityManifestAdapter {\n  private readonly archParsers: ArchManifestParser[];\n  private readonly plugins: Map<string, VersionExtractionPlugin> = new Map();\n  /** Standalone plugins have no corresponding architecture parser \u2014 they own their own discovery. */\n  private readonly standalonePlugins: Map<string, VersionExtractionPlugin> = new Map();\n  private readonly projectRoot: string;\n\n  constructor(projectRoot: string) {\n    this.projectRoot = projectRoot;\n    this.archParsers = getAllManifestParsers();\n  }\n\n  /**\n   * Register a version extraction plugin for an ecosystem that has a\n   * corresponding architecture parser. The plugin's `ecosystem` field\n   * must equal the architecture parser's `name` for the lookup to work.\n   */\n  registerPlugin(plugin: VersionExtractionPlugin): void {\n    this.plugins.set(plugin.ecosystem, plugin);\n  }\n\n  /**\n   * Register a standalone version extraction plugin for an ecosystem that\n   * has NO corresponding architecture parser. The plugin's `manifestFiles`\n   * list drives discovery \u2014 the adapter will scan for those filenames and\n   * invoke the plugin directly when found.\n   */\n  registerStandalonePlugin(plugin: VersionExtractionPlugin): void {\n    this.standalonePlugins.set(plugin.ecosystem, plugin);\n  }\n\n  /**\n   * Get all registered version extraction plugins (wrapped + standalone).\n   */\n  getPlugins(): VersionExtractionPlugin[] {\n    return [...this.plugins.values(), ...this.standalonePlugins.values()];\n  }\n\n  /**\n   * Get the architecture parsers being wrapped.\n   */\n  getArchParsers(): ArchManifestParser[] {\n    return this.archParsers;\n  }\n\n  /**\n   * Discover all manifest files in the project tree.\n   * Includes files known to architecture parsers AND files from standalone plugins.\n   * Returns absolute paths.\n   */\n  discoverManifests(): string[] {\n    return this._findManifests(this.projectRoot);\n  }\n\n  /**\n   * Run full discovery and extraction:\n   * 1. Discover manifest files (reusing architecture's SKIP_DIRS logic)\n   * 2. For each manifest, find the matching architecture parser\n   * 3. If a version extraction plugin is registered for that ecosystem,\n   *    use it to extract detailed version/scope information\n   * 4. Otherwise, fall back to basic extraction from the architecture parser's\n   *    ArchPackage.externalDeps (names only, no version info)\n   */\n  async extractAll(): Promise<ManifestParseResult> {\n    const manifestPaths = this.discoverManifests();\n    const allDeps: ParsedDependency[] = [];\n    const warnings: Array<{ file: string; line?: number; message: string }> = [];\n    const errors: Array<{ file: string; message: string }> = [];\n    let manifestsParsed = 0;\n\n    for (const manifestPath of manifestPaths) {\n      const archParser = this.archParsers.find(p => p.canParse(manifestPath));\n      if (!archParser) continue;\n\n      const relManifest = path.relative(this.projectRoot, manifestPath).replace(/\\\\/g, '/');\n      const plugin = this.plugins.get(archParser.name);\n\n      if (plugin && plugin.canExtract(manifestPath)) {\n        // Use the version extraction plugin for detailed parsing\n        try {\n          const deps = await plugin.extract(manifestPath, this.projectRoot);\n          allDeps.push(...deps);\n          manifestsParsed++;\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err);\n          errors.push({ file: relManifest, message });\n        }\n      } else {\n        // Fallback: use architecture parser output (names only, no versions)\n        try {\n          const packages = await archParser.parse(manifestPath, this.projectRoot);\n          const deps = this._fallbackExtract(packages, archParser.name, relManifest);\n          allDeps.push(...deps);\n          manifestsParsed++;\n\n          if (!plugin) {\n            warnings.push({\n              file: relManifest,\n              message: `No version extraction plugin registered for ecosystem '${archParser.name}'; dependency names extracted without version constraints`,\n            });\n          }\n        } catch (err) {\n          const message = err instanceof Error ? err.message : String(err);\n          errors.push({ file: relManifest, message });\n        }\n      }\n    }\n\n    return {\n      dependenciesCreated: allDeps.length,\n      manifestsParsed,\n      warnings,\n      errors,\n    };\n  }\n\n  /**\n   * Extract dependencies for a single manifest file.\n   * Tries standalone plugins first (when there is no arch parser), then\n   * wrapped plugins, then falls back to arch parser output.\n   */\n  async extractFromManifest(manifestPath: string): Promise<ParsedDependency[]> {\n    const archParser = this.archParsers.find(p => p.canParse(manifestPath));\n\n    if (!archParser) {\n      // No arch parser \u2014 try standalone plugins\n      const standalonePlugin = [...this.standalonePlugins.values()]\n        .find(p => p.canExtract(manifestPath));\n      if (standalonePlugin) {\n        return standalonePlugin.extract(manifestPath, this.projectRoot);\n      }\n      return [];\n    }\n\n    const plugin = this.plugins.get(archParser.name);\n\n    if (plugin && plugin.canExtract(manifestPath)) {\n      return plugin.extract(manifestPath, this.projectRoot);\n    }\n\n    // Fallback: architecture parser output (names only)\n    const packages = await archParser.parse(manifestPath, this.projectRoot);\n    const relManifest = path.relative(this.projectRoot, manifestPath).replace(/\\\\/g, '/');\n    return this._fallbackExtract(packages, archParser.name, relManifest);\n  }\n\n  /**\n   * Get the ecosystem name for a given manifest file path.\n   * Returns undefined if no parser handles this file.\n   */\n  getEcosystem(manifestPath: string): string | undefined {\n    const parser = this.archParsers.find(p => p.canParse(manifestPath));\n    return parser?.name;\n  }\n\n  // \u2500\u2500 Private helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  /**\n   * Fallback extraction: converts ArchPackage.externalDeps (names only) into\n   * ParsedDependency records with empty version constraints and default scope.\n   */\n  private _fallbackExtract(\n    packages: ArchPackage[],\n    ecosystem: string,\n    sourceManifest: string,\n  ): ParsedDependency[] {\n    const deps: ParsedDependency[] = [];\n    for (const pkg of packages) {\n      if (!pkg.externalDeps) continue;\n      for (const depName of pkg.externalDeps) {\n        deps.push({\n          name: depName,\n          declaredConstraint: '*',\n          scope: 'production',\n          ecosystem,\n          sourceManifest,\n        });\n      }\n    }\n    return deps;\n  }\n\n  /**\n   * Walk the project directory tree looking for manifest files.\n   * Mirrors the architecture module's _findManifests() logic, respecting SKIP_DIRS.\n   * Includes manifest filenames from standalone plugins in addition to arch parsers.\n   */\n  private _findManifests(dir: string, results: string[] = []): string[] {\n    const manifestFilenames = new Set([\n      ...this.archParsers.flatMap(p => p.manifestFiles),\n      ...Array.from(this.standalonePlugins.values()).flatMap(p => p.manifestFiles),\n    ]);\n\n    return this._walkDir(dir, manifestFilenames, results);\n  }\n\n  private _walkDir(dir: string, manifestFilenames: Set<string>, results: string[]): string[] {\n    let entries: fs.Dirent[];\n    try {\n      entries = fs.readdirSync(dir, { withFileTypes: true });\n    } catch {\n      return results;\n    }\n\n    for (const entry of entries) {\n      if (entry.isDirectory()) {\n        if (!SKIP_DIRS.has(entry.name)) {\n          this._walkDir(path.join(dir, entry.name), manifestFilenames, results);\n        }\n      } else if (entry.isFile()) {\n        if (manifestFilenames.has(entry.name) || entry.name.endsWith('.csproj')) {\n          results.push(path.join(dir, entry.name));\n        }\n      }\n    }\n\n    return results;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,SAAoB;AACpB,WAAsB;AACtB,sBAAsC;AA8BtC,MAAM,YAAY,oBAAI,IAAI;AAAA,EACxB;AAAA,EAAgB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAU;AAAA,EAAW;AAAA,EAC9D;AAAA,EAAc;AAAA,EAAU;AAAA,EAAU;AAAA,EAAY;AAAA,EAAe;AAAA,EAAU;AAAA,EACvE;AAAA,EAAa;AAAA,EAAa;AAC5B,CAAC;AAIM,MAAM,wBAAwB;AAAA,EAOnC,YAAY,aAAqB;AALjC,SAAiB,UAAgD,oBAAI,IAAI;AAEzE;AAAA,SAAiB,oBAA0D,oBAAI,IAAI;AAIjF,SAAK,cAAc;AACnB,SAAK,kBAAc,uCAAsB;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe,QAAuC;AACpD,SAAK,QAAQ,IAAI,OAAO,WAAW,MAAM;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,yBAAyB,QAAuC;AAC9D,SAAK,kBAAkB,IAAI,OAAO,WAAW,MAAM;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,aAAwC;AACtC,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,GAAG,GAAG,KAAK,kBAAkB,OAAO,CAAC;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA,EAKA,iBAAuC;AACrC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBAA8B;AAC5B,WAAO,KAAK,eAAe,KAAK,WAAW;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,aAA2C;AAC/C,UAAM,gBAAgB,KAAK,kBAAkB;AAC7C,UAAM,UAA8B,CAAC;AACrC,UAAM,WAAoE,CAAC;AAC3E,UAAM,SAAmD,CAAC;AAC1D,QAAI,kBAAkB;AAEtB,eAAW,gBAAgB,eAAe;AACxC,YAAM,aAAa,KAAK,YAAY,KAAK,OAAK,EAAE,SAAS,YAAY,CAAC;AACtE,UAAI,CAAC,WAAY;AAEjB,YAAM,cAAc,KAAK,SAAS,KAAK,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AACpF,YAAM,SAAS,KAAK,QAAQ,IAAI,WAAW,IAAI;AAE/C,UAAI,UAAU,OAAO,WAAW,YAAY,GAAG;AAE7C,YAAI;AACF,gBAAM,OAAO,MAAM,OAAO,QAAQ,cAAc,KAAK,WAAW;AAChE,kBAAQ,KAAK,GAAG,IAAI;AACpB;AAAA,QACF,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,iBAAO,KAAK,EAAE,MAAM,aAAa,QAAQ,CAAC;AAAA,QAC5C;AAAA,MACF,OAAO;AAEL,YAAI;AACF,gBAAM,WAAW,MAAM,WAAW,MAAM,cAAc,KAAK,WAAW;AACtE,gBAAM,OAAO,KAAK,iBAAiB,UAAU,WAAW,MAAM,WAAW;AACzE,kBAAQ,KAAK,GAAG,IAAI;AACpB;AAEA,cAAI,CAAC,QAAQ;AACX,qBAAS,KAAK;AAAA,cACZ,MAAM;AAAA,cACN,SAAS,0DAA0D,WAAW,IAAI;AAAA,YACpF,CAAC;AAAA,UACH;AAAA,QACF,SAAS,KAAK;AACZ,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,iBAAO,KAAK,EAAE,MAAM,aAAa,QAAQ,CAAC;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,qBAAqB,QAAQ;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,oBAAoB,cAAmD;AAC3E,UAAM,aAAa,KAAK,YAAY,KAAK,OAAK,EAAE,SAAS,YAAY,CAAC;AAEtE,QAAI,CAAC,YAAY;AAEf,YAAM,mBAAmB,CAAC,GAAG,KAAK,kBAAkB,OAAO,CAAC,EACzD,KAAK,OAAK,EAAE,WAAW,YAAY,CAAC;AACvC,UAAI,kBAAkB;AACpB,eAAO,iBAAiB,QAAQ,cAAc,KAAK,WAAW;AAAA,MAChE;AACA,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,SAAS,KAAK,QAAQ,IAAI,WAAW,IAAI;AAE/C,QAAI,UAAU,OAAO,WAAW,YAAY,GAAG;AAC7C,aAAO,OAAO,QAAQ,cAAc,KAAK,WAAW;AAAA,IACtD;AAGA,UAAM,WAAW,MAAM,WAAW,MAAM,cAAc,KAAK,WAAW;AACtE,UAAM,cAAc,KAAK,SAAS,KAAK,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AACpF,WAAO,KAAK,iBAAiB,UAAU,WAAW,MAAM,WAAW;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa,cAA0C;AACrD,UAAM,SAAS,KAAK,YAAY,KAAK,OAAK,EAAE,SAAS,YAAY,CAAC;AAClE,WAAO,QAAQ;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,iBACN,UACA,WACA,gBACoB;AACpB,UAAM,OAA2B,CAAC;AAClC,eAAW,OAAO,UAAU;AAC1B,UAAI,CAAC,IAAI,aAAc;AACvB,iBAAW,WAAW,IAAI,cAAc;AACtC,aAAK,KAAK;AAAA,UACR,MAAM;AAAA,UACN,oBAAoB;AAAA,UACpB,OAAO;AAAA,UACP;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,KAAa,UAAoB,CAAC,GAAa;AACpE,UAAM,oBAAoB,oBAAI,IAAI;AAAA,MAChC,GAAG,KAAK,YAAY,QAAQ,OAAK,EAAE,aAAa;AAAA,MAChD,GAAG,MAAM,KAAK,KAAK,kBAAkB,OAAO,CAAC,EAAE,QAAQ,OAAK,EAAE,aAAa;AAAA,IAC7E,CAAC;AAED,WAAO,KAAK,SAAS,KAAK,mBAAmB,OAAO;AAAA,EACtD;AAAA,EAEQ,SAAS,KAAa,mBAAgC,SAA6B;AACzF,QAAI;AACJ,QAAI;AACF,gBAAU,GAAG,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,IACvD,QAAQ;AACN,aAAO;AAAA,IACT;AAEA,eAAW,SAAS,SAAS;AAC3B,UAAI,MAAM,YAAY,GAAG;AACvB,YAAI,CAAC,UAAU,IAAI,MAAM,IAAI,GAAG;AAC9B,eAAK,SAAS,KAAK,KAAK,KAAK,MAAM,IAAI,GAAG,mBAAmB,OAAO;AAAA,QACtE;AAAA,MACF,WAAW,MAAM,OAAO,GAAG;AACzB,YAAI,kBAAkB,IAAI,MAAM,IAAI,KAAK,MAAM,KAAK,SAAS,SAAS,GAAG;AACvE,kBAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI,CAAC;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/security/manifest/parser.d.ts

@@ -0,0 +1,73 @@
+/**
+ * ManifestParser Orchestrator
+ *
+ * Orchestrates manifest discovery, version extraction, deduplication, and
+ * database persistence. Uses the SecurityManifestAdapter for discovery and
+ * extraction, registers all 12 version extraction plugins:
+ *   Wrapped (arch parser exists): npm, maven, go, pip, cargo, nuget, gradle
+ *   Standalone (no arch parser):  rubygems, composer, swift, pubspec, hex
+ *
+ * Node ID format: `dep:<ecosystem>:<name>` (e.g. `dep:npm:express`)
+ */
+import { SecurityManifestAdapter } from './adapter';
+import type { GraphDatabase } from '../../db/database';
+import type { ParsedDependency, ManifestParseResult } from '../types';
+/**
+ * Compare two version strings. Returns:
+ *  - positive if a > b
+ *  - negative if a < b
+ *  - 0 if equal
+ *
+ * Handles semver-like versions (1.2.3), Go pseudo-versions, and constraint
+ * strings. Falls back to lexicographic comparison for non-numeric versions.
+ */
+export declare function compareVersions(a: string, b: string): number;
+/**
+ * A deduplicated dependency entry combining data from multiple manifests.
+ */
+interface DeduplicatedDependency {
+    name: string;
+    ecosystem: string;
+    /** The highest declared constraint across all manifests */
+    declaredConstraint: string;
+    /** The highest resolved version across all manifests (if any) */
+    resolvedVersion?: string;
+    /** Scope from the manifest with the highest version */
+    scope: ParsedDependency['scope'];
+    /** All source manifests that declared this dependency */
+    sourceManifests: string[];
+    /** License from manifest, if available */
+    license?: string;
+}
+/**
+ * Deduplicate dependencies by (name, ecosystem) pair, keeping the entry
+ * with the highest version and collecting all source manifests.
+ */
+export declare function deduplicateDependencies(deps: ParsedDependency[]): DeduplicatedDependency[];
+/**
+ * ManifestParser orchestrates manifest discovery, parsing, deduplication,
+ * and database persistence for the security module.
+ */
+export declare class ManifestParser {
+    private readonly adapter;
+    private readonly db;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, projectRoot: string);
+    /**
+     * Get the underlying adapter (useful for testing).
+     */
+    getAdapter(): SecurityManifestAdapter;
+    /**
+     * Run full manifest discovery, parsing, deduplication, and database persistence.
+     *
+     * Steps:
+     * 1. Discover manifest files via the adapter (reuses architecture parsers)
+     * 2. Extract dependencies with version/scope data via registered plugins
+     * 3. Deduplicate: same (name, ecosystem) → single entry with highest version
+     * 4. Create Dependency_Nodes in the database (nodes + sec_dependencies tables)
+     * 5. Create `declared_in` edges linking dependencies to their source manifests
+     */
+    parseAll(): Promise<ManifestParseResult>;
+}
+export {};
+//# sourceMappingURL=parser.d.ts.map

package/dist/security/manifest/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../../src/security/manifest/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,uBAAuB,EAAgC,MAAM,WAAW,CAAC;AAclF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAiLtE;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAyC5D;AAYD;;GAEG;AACH,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACjC,yDAAyD;IACzD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,sBAAsB,EAAE,CA2C1F;AAID;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAuBlD;;OAEG;IACH,UAAU,IAAI,uBAAuB;IAIrC;;;;;;;;;OASG;IACG,QAAQ,IAAI,OAAO,CAAC,mBAAmB,CAAC;CAkH/C"}