kirograph 0.17.0 → 0.20.0

package/dist/security/manifest/parser.js

@@ -0,0 +1,376 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var parser_exports = {};
+__export(parser_exports, {
+  ManifestParser: () => ManifestParser,
+  compareVersions: () => compareVersions,
+  deduplicateDependencies: () => deduplicateDependencies
+});
+module.exports = __toCommonJS(parser_exports);
+var import_adapter = require("./adapter");
+var import_npm = require("./plugins/npm");
+var import_maven = require("./plugins/maven");
+var import_go = require("./plugins/go");
+var import_pip = require("./plugins/pip");
+var import_cargo = require("./plugins/cargo");
+var import_nuget = require("./plugins/nuget");
+var import_gradle = require("./plugins/gradle");
+var import_rubygems = require("./plugins/rubygems");
+var import_composer = require("./plugins/composer");
+var import_swift = require("./plugins/swift");
+var import_pubspec = require("./plugins/pubspec");
+var import_hex = require("./plugins/hex");
+var import_pyproject = require("./plugins/pyproject");
+var import_errors = require("../../errors");
+function createNpmPlugin() {
+  return {
+    ecosystem: "npm",
+    manifestFiles: ["package.json"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("package.json");
+    },
+    extract: import_npm.parseNpmManifest
+  };
+}
+function createMavenPlugin() {
+  return {
+    ecosystem: "maven",
+    manifestFiles: ["pom.xml"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("pom.xml");
+    },
+    extract: import_maven.parseMavenManifest
+  };
+}
+function createGoPlugin() {
+  return {
+    ecosystem: "go",
+    manifestFiles: ["go.mod"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("go.mod");
+    },
+    extract: import_go.parseGoManifest
+  };
+}
+function createPipPlugin() {
+  return {
+    ecosystem: "python",
+    manifestFiles: ["requirements.txt"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("requirements.txt");
+    },
+    extract: import_pip.parsePipManifest
+  };
+}
+function createCargoPlugin() {
+  return {
+    ecosystem: "cargo",
+    manifestFiles: ["Cargo.toml"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("Cargo.toml");
+    },
+    extract: import_cargo.parseCargoManifest
+  };
+}
+function createNugetPlugin() {
+  return {
+    ecosystem: "csproj",
+    manifestFiles: [".csproj"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith(".csproj");
+    },
+    extract: import_nuget.parseNugetManifest
+  };
+}
+function createGradlePlugin() {
+  return {
+    ecosystem: "gradle",
+    manifestFiles: ["build.gradle", "build.gradle.kts"],
+    canExtract(manifestPath) {
+      const base = manifestPath.split("/").pop() ?? "";
+      return base === "build.gradle" || base === "build.gradle.kts";
+    },
+    extract: import_gradle.parseGradleManifest
+  };
+}
+function createPyprojectPlugin() {
+  return {
+    ecosystem: "pyproject",
+    manifestFiles: ["pyproject.toml"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("pyproject.toml");
+    },
+    extract: import_pyproject.parsePyprojectManifest
+  };
+}
+function createRubygemsPlugin() {
+  return {
+    ecosystem: "rubygems",
+    manifestFiles: ["Gemfile"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("/Gemfile") || manifestPath === "Gemfile";
+    },
+    extract: import_rubygems.parseRubygemsManifest
+  };
+}
+function createComposerPlugin() {
+  return {
+    ecosystem: "composer",
+    manifestFiles: ["composer.json"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("composer.json");
+    },
+    extract: import_composer.parseComposerManifest
+  };
+}
+function createSwiftPlugin() {
+  return {
+    ecosystem: "swift",
+    manifestFiles: ["Package.swift"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("Package.swift");
+    },
+    extract: import_swift.parseSwiftManifest
+  };
+}
+function createPubspecPlugin() {
+  return {
+    ecosystem: "pub",
+    manifestFiles: ["pubspec.yaml"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("pubspec.yaml");
+    },
+    extract: import_pubspec.parsePubspecManifest
+  };
+}
+function createHexPlugin() {
+  return {
+    ecosystem: "hex",
+    manifestFiles: ["mix.exs"],
+    canExtract(manifestPath) {
+      return manifestPath.endsWith("mix.exs");
+    },
+    extract: import_hex.parseHexManifest
+  };
+}
+function compareVersions(a, b) {
+  const cleanA = a.startsWith("v") ? a.slice(1) : a;
+  const cleanB = b.startsWith("v") ? b.slice(1) : b;
+  const numericA = cleanA.replace(/^[~^>=<]+/, "");
+  const numericB = cleanB.replace(/^[~^>=<]+/, "");
+  const partsA = numericA.split(".");
+  const partsB = numericB.split(".");
+  const maxLen = Math.max(partsA.length, partsB.length);
+  for (let i = 0; i < maxLen; i++) {
+    const segA = partsA[i] ?? "0";
+    const segB = partsB[i] ?? "0";
+    const numA = parseInt(segA, 10);
+    const numB = parseInt(segB, 10);
+    if (!isNaN(numA) && !isNaN(numB)) {
+      if (numA !== numB) return numA - numB;
+      const suffixA = segA.slice(String(numA).length);
+      const suffixB = segB.slice(String(numB).length);
+      if (suffixA !== suffixB) {
+        if (suffixA && !suffixB) return -1;
+        if (!suffixA && suffixB) return 1;
+        return suffixA.localeCompare(suffixB);
+      }
+    } else {
+      const cmp = segA.localeCompare(segB);
+      if (cmp !== 0) return cmp;
+    }
+  }
+  return 0;
+}
+function getEffectiveVersion(dep) {
+  return dep.resolvedVersion ?? dep.declaredConstraint;
+}
+function deduplicateDependencies(deps) {
+  const map = /* @__PURE__ */ new Map();
+  for (const dep of deps) {
+    const key = `${dep.ecosystem}:${dep.name}`;
+    const existing = map.get(key);
+    if (!existing) {
+      map.set(key, {
+        name: dep.name,
+        ecosystem: dep.ecosystem,
+        declaredConstraint: dep.declaredConstraint,
+        resolvedVersion: dep.resolvedVersion,
+        scope: dep.scope,
+        sourceManifests: [dep.sourceManifest],
+        license: dep.license
+      });
+    } else {
+      if (!existing.sourceManifests.includes(dep.sourceManifest)) {
+        existing.sourceManifests.push(dep.sourceManifest);
+      }
+      const existingVersion = existing.resolvedVersion ?? existing.declaredConstraint;
+      const newVersion = getEffectiveVersion(dep);
+      if (compareVersions(newVersion, existingVersion) > 0) {
+        existing.declaredConstraint = dep.declaredConstraint;
+        existing.resolvedVersion = dep.resolvedVersion;
+        existing.scope = dep.scope;
+        if (dep.license !== void 0) {
+          existing.license = dep.license;
+        }
+      } else if (existing.license === void 0 && dep.license !== void 0) {
+        existing.license = dep.license;
+      }
+    }
+  }
+  return [...map.values()];
+}
+class ManifestParser {
+  constructor(db, projectRoot) {
+    this.db = db;
+    this.projectRoot = projectRoot;
+    this.adapter = new import_adapter.SecurityManifestAdapter(projectRoot);
+    this.adapter.registerPlugin(createNpmPlugin());
+    this.adapter.registerPlugin(createMavenPlugin());
+    this.adapter.registerPlugin(createGoPlugin());
+    this.adapter.registerPlugin(createPipPlugin());
+    this.adapter.registerPlugin(createCargoPlugin());
+    this.adapter.registerPlugin(createNugetPlugin());
+    this.adapter.registerPlugin(createGradlePlugin());
+    this.adapter.registerStandalonePlugin(createPyprojectPlugin());
+    this.adapter.registerStandalonePlugin(createRubygemsPlugin());
+    this.adapter.registerStandalonePlugin(createComposerPlugin());
+    this.adapter.registerStandalonePlugin(createSwiftPlugin());
+    this.adapter.registerStandalonePlugin(createPubspecPlugin());
+    this.adapter.registerStandalonePlugin(createHexPlugin());
+  }
+  /**
+   * Get the underlying adapter (useful for testing).
+   */
+  getAdapter() {
+    return this.adapter;
+  }
+  /**
+   * Run full manifest discovery, parsing, deduplication, and database persistence.
+   *
+   * Steps:
+   * 1. Discover manifest files via the adapter (reuses architecture parsers)
+   * 2. Extract dependencies with version/scope data via registered plugins
+   * 3. Deduplicate: same (name, ecosystem) → single entry with highest version
+   * 4. Create Dependency_Nodes in the database (nodes + sec_dependencies tables)
+   * 5. Create `declared_in` edges linking dependencies to their source manifests
+   */
+  async parseAll() {
+    const warnings = [];
+    const errors = [];
+    const allDeps = [];
+    const manifestPaths = this.adapter.discoverManifests();
+    let manifestsParsed = 0;
+    for (const manifestPath of manifestPaths) {
+      try {
+        const deps = await this.adapter.extractFromManifest(manifestPath);
+        if (deps.length > 0) {
+          allDeps.push(...deps);
+          manifestsParsed++;
+        } else {
+          manifestsParsed++;
+        }
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const relPath = manifestPath.replace(this.projectRoot + "/", "").replace(/\\/g, "/");
+        errors.push({ file: relPath, message });
+        (0, import_errors.logError)(`[sec:parser] Failed to parse manifest ${relPath}: ${message}`);
+      }
+    }
+    if (allDeps.length === 0) {
+      return {
+        dependenciesCreated: 0,
+        manifestsParsed,
+        warnings,
+        errors
+      };
+    }
+    const deduplicated = deduplicateDependencies(allDeps);
+    let dependenciesCreated = 0;
+    const rawDb = this.db.getRawDb();
+    for (const dep of deduplicated) {
+      try {
+        const nodeId = `dep:${dep.ecosystem}:${dep.name}`;
+        const node = {
+          id: nodeId,
+          kind: "dependency",
+          name: dep.name,
+          qualifiedName: `${dep.ecosystem}/${dep.name}`,
+          filePath: dep.sourceManifests[0] ?? "",
+          language: "unknown",
+          startLine: 0,
+          endLine: 0,
+          startColumn: 0,
+          endColumn: 0,
+          signature: dep.resolvedVersion ?? dep.declaredConstraint,
+          isExported: false,
+          isAsync: false,
+          isStatic: false,
+          isAbstract: false,
+          updatedAt: Date.now()
+        };
+        this.db.upsertNode(node);
+        rawDb.run(
+          `INSERT OR REPLACE INTO sec_dependencies
+            (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests, license)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+          [
+            nodeId,
+            dep.ecosystem,
+            dep.name,
+            dep.declaredConstraint,
+            dep.resolvedVersion ?? null,
+            dep.scope,
+            JSON.stringify(dep.sourceManifests),
+            dep.license ?? null
+          ]
+        );
+        for (const manifest of dep.sourceManifests) {
+          const edge = {
+            source: nodeId,
+            target: manifest,
+            kind: "declared_in"
+          };
+          this.db.insertEdge(edge);
+        }
+        dependenciesCreated++;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        warnings.push({
+          file: dep.sourceManifests[0] ?? "unknown",
+          message: `Failed to persist dependency ${dep.ecosystem}/${dep.name}: ${message}`
+        });
+        (0, import_errors.logWarn)(`[sec:parser] Failed to persist dependency ${dep.ecosystem}/${dep.name}: ${message}`);
+      }
+    }
+    return {
+      dependenciesCreated,
+      manifestsParsed,
+      warnings,
+      errors
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ManifestParser,
+  compareVersions,
+  deduplicateDependencies
+});
+//# sourceMappingURL=parser.js.map

package/dist/security/manifest/parser.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/manifest/parser.ts"],
+  "sourcesContent": ["/**\n * ManifestParser Orchestrator\n *\n * Orchestrates manifest discovery, version extraction, deduplication, and\n * database persistence. Uses the SecurityManifestAdapter for discovery and\n * extraction, registers all 12 version extraction plugins:\n *   Wrapped (arch parser exists): npm, maven, go, pip, cargo, nuget, gradle\n *   Standalone (no arch parser):  rubygems, composer, swift, pubspec, hex\n *\n * Node ID format: `dep:<ecosystem>:<name>` (e.g. `dep:npm:express`)\n */\nimport { SecurityManifestAdapter, type VersionExtractionPlugin } from './adapter';\nimport { parseNpmManifest } from './plugins/npm';\nimport { parseMavenManifest } from './plugins/maven';\nimport { parseGoManifest } from './plugins/go';\nimport { parsePipManifest } from './plugins/pip';\nimport { parseCargoManifest } from './plugins/cargo';\nimport { parseNugetManifest } from './plugins/nuget';\nimport { parseGradleManifest } from './plugins/gradle';\nimport { parseRubygemsManifest } from './plugins/rubygems';\nimport { parseComposerManifest } from './plugins/composer';\nimport { parseSwiftManifest } from './plugins/swift';\nimport { parsePubspecManifest } from './plugins/pubspec';\nimport { parseHexManifest } from './plugins/hex';\nimport { parsePyprojectManifest } from './plugins/pyproject';\nimport type { GraphDatabase } from '../../db/database';\nimport type { ParsedDependency, ManifestParseResult } from '../types';\nimport type { Node, Edge } from '../../types';\nimport { logWarn, logError } from '../../errors';\n\n// \u2500\u2500 Plugin Definitions \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Create the npm version extraction plugin wrapping parseNpmManifest.\n */\nfunction createNpmPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'npm',\n    manifestFiles: ['package.json'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('package.json');\n    },\n    extract: parseNpmManifest,\n  };\n}\n\n/**\n * Create the Maven version extraction plugin wrapping parseMavenManifest.\n */\nfunction createMavenPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'maven',\n    manifestFiles: ['pom.xml'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('pom.xml');\n    },\n    extract: parseMavenManifest,\n  };\n}\n\n/**\n * Create the Go version extraction plugin wrapping parseGoManifest.\n */\nfunction createGoPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'go',\n    manifestFiles: ['go.mod'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('go.mod');\n    },\n    extract: parseGoManifest,\n  };\n}\n\n/**\n * Create the pip version extraction plugin wrapping parsePipManifest.\n */\nfunction createPipPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'python',\n    manifestFiles: ['requirements.txt'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('requirements.txt');\n    },\n    extract: parsePipManifest,\n  };\n}\n\n/**\n * Create the Cargo version extraction plugin wrapping parseCargoManifest.\n */\nfunction createCargoPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'cargo',\n    manifestFiles: ['Cargo.toml'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('Cargo.toml');\n    },\n    extract: parseCargoManifest,\n  };\n}\n\n/**\n * Create the NuGet version extraction plugin wrapping parseNugetManifest.\n * ecosystem = 'csproj' to match the architecture parser name for lookup;\n * ParsedDependency.ecosystem is set to 'nuget' inside the plugin function.\n */\nfunction createNugetPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'csproj',\n    manifestFiles: ['.csproj'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('.csproj');\n    },\n    extract: parseNugetManifest,\n  };\n}\n\n/**\n * Create the Gradle version extraction plugin wrapping parseGradleManifest.\n */\nfunction createGradlePlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'gradle',\n    manifestFiles: ['build.gradle', 'build.gradle.kts'],\n    canExtract(manifestPath: string): boolean {\n      const base = manifestPath.split('/').pop() ?? '';\n      return base === 'build.gradle' || base === 'build.gradle.kts';\n    },\n    extract: parseGradleManifest,\n  };\n}\n\nfunction createPyprojectPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'pyproject',\n    manifestFiles: ['pyproject.toml'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('pyproject.toml');\n    },\n    extract: parsePyprojectManifest,\n  };\n}\n\n// \u2500\u2500 Standalone Plugin Factories \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction createRubygemsPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'rubygems',\n    manifestFiles: ['Gemfile'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('/Gemfile') || manifestPath === 'Gemfile';\n    },\n    extract: parseRubygemsManifest,\n  };\n}\n\nfunction createComposerPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'composer',\n    manifestFiles: ['composer.json'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('composer.json');\n    },\n    extract: parseComposerManifest,\n  };\n}\n\nfunction createSwiftPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'swift',\n    manifestFiles: ['Package.swift'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('Package.swift');\n    },\n    extract: parseSwiftManifest,\n  };\n}\n\nfunction createPubspecPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'pub',\n    manifestFiles: ['pubspec.yaml'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('pubspec.yaml');\n    },\n    extract: parsePubspecManifest,\n  };\n}\n\nfunction createHexPlugin(): VersionExtractionPlugin {\n  return {\n    ecosystem: 'hex',\n    manifestFiles: ['mix.exs'],\n    canExtract(manifestPath: string): boolean {\n      return manifestPath.endsWith('mix.exs');\n    },\n    extract: parseHexManifest,\n  };\n}\n\n// \u2500\u2500 Version Comparison \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Compare two version strings. Returns:\n *  - positive if a > b\n *  - negative if a < b\n *  - 0 if equal\n *\n * Handles semver-like versions (1.2.3), Go pseudo-versions, and constraint\n * strings. Falls back to lexicographic comparison for non-numeric versions.\n */\nexport function compareVersions(a: string, b: string): number {\n  // Strip leading 'v' (common in Go modules)\n  const cleanA = a.startsWith('v') ? a.slice(1) : a;\n  const cleanB = b.startsWith('v') ? b.slice(1) : b;\n\n  // Strip common constraint prefixes (^, ~, >=, <=, =, >, <)\n  const numericA = cleanA.replace(/^[~^>=<]+/, '');\n  const numericB = cleanB.replace(/^[~^>=<]+/, '');\n\n  const partsA = numericA.split('.');\n  const partsB = numericB.split('.');\n\n  const maxLen = Math.max(partsA.length, partsB.length);\n  for (let i = 0; i < maxLen; i++) {\n    const segA = partsA[i] ?? '0';\n    const segB = partsB[i] ?? '0';\n\n    // Try numeric comparison first\n    const numA = parseInt(segA, 10);\n    const numB = parseInt(segB, 10);\n\n    if (!isNaN(numA) && !isNaN(numB)) {\n      if (numA !== numB) return numA - numB;\n      // If numeric parts are equal but segments differ (e.g. \"3-beta\" vs \"3\"),\n      // compare the remaining suffix\n      const suffixA = segA.slice(String(numA).length);\n      const suffixB = segB.slice(String(numB).length);\n      if (suffixA !== suffixB) {\n        // Pre-release suffixes (starting with -) are lower than no suffix\n        if (suffixA && !suffixB) return -1;\n        if (!suffixA && suffixB) return 1;\n        return suffixA.localeCompare(suffixB);\n      }\n    } else {\n      // Lexicographic fallback for non-numeric segments\n      const cmp = segA.localeCompare(segB);\n      if (cmp !== 0) return cmp;\n    }\n  }\n\n  return 0;\n}\n\n/**\n * Get the effective version string for comparison purposes.\n * Prefers resolvedVersion over declaredConstraint.\n */\nfunction getEffectiveVersion(dep: ParsedDependency): string {\n  return dep.resolvedVersion ?? dep.declaredConstraint;\n}\n\n// \u2500\u2500 Deduplication \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * A deduplicated dependency entry combining data from multiple manifests.\n */\ninterface DeduplicatedDependency {\n  name: string;\n  ecosystem: string;\n  /** The highest declared constraint across all manifests */\n  declaredConstraint: string;\n  /** The highest resolved version across all manifests (if any) */\n  resolvedVersion?: string;\n  /** Scope from the manifest with the highest version */\n  scope: ParsedDependency['scope'];\n  /** All source manifests that declared this dependency */\n  sourceManifests: string[];\n  /** License from manifest, if available */\n  license?: string;\n}\n\n/**\n * Deduplicate dependencies by (name, ecosystem) pair, keeping the entry\n * with the highest version and collecting all source manifests.\n */\nexport function deduplicateDependencies(deps: ParsedDependency[]): DeduplicatedDependency[] {\n  const map = new Map<string, DeduplicatedDependency>();\n\n  for (const dep of deps) {\n    const key = `${dep.ecosystem}:${dep.name}`;\n    const existing = map.get(key);\n\n    if (!existing) {\n      map.set(key, {\n        name: dep.name,\n        ecosystem: dep.ecosystem,\n        declaredConstraint: dep.declaredConstraint,\n        resolvedVersion: dep.resolvedVersion,\n        scope: dep.scope,\n        sourceManifests: [dep.sourceManifest],\n        license: dep.license,\n      });\n    } else {\n      // Add source manifest if not already present\n      if (!existing.sourceManifests.includes(dep.sourceManifest)) {\n        existing.sourceManifests.push(dep.sourceManifest);\n      }\n\n      // Keep the highest version\n      const existingVersion = existing.resolvedVersion ?? existing.declaredConstraint;\n      const newVersion = getEffectiveVersion(dep);\n\n      if (compareVersions(newVersion, existingVersion) > 0) {\n        existing.declaredConstraint = dep.declaredConstraint;\n        existing.resolvedVersion = dep.resolvedVersion;\n        existing.scope = dep.scope;\n        // Update license if the winning version entry has one\n        if (dep.license !== undefined) {\n          existing.license = dep.license;\n        }\n      } else if (existing.license === undefined && dep.license !== undefined) {\n        // Even if version didn't win, adopt the license if we don't have one\n        existing.license = dep.license;\n      }\n    }\n  }\n\n  return [...map.values()];\n}\n\n// \u2500\u2500 ManifestParser Class \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * ManifestParser orchestrates manifest discovery, parsing, deduplication,\n * and database persistence for the security module.\n */\nexport class ManifestParser {\n  private readonly adapter: SecurityManifestAdapter;\n  private readonly db: GraphDatabase;\n  private readonly projectRoot: string;\n\n  constructor(db: GraphDatabase, projectRoot: string) {\n    this.db = db;\n    this.projectRoot = projectRoot;\n    this.adapter = new SecurityManifestAdapter(projectRoot);\n\n    // Wrapped plugins (arch parser exists \u2014 ecosystem must match archParser.name)\n    this.adapter.registerPlugin(createNpmPlugin());\n    this.adapter.registerPlugin(createMavenPlugin());\n    this.adapter.registerPlugin(createGoPlugin());\n    this.adapter.registerPlugin(createPipPlugin());\n    this.adapter.registerPlugin(createCargoPlugin());\n    this.adapter.registerPlugin(createNugetPlugin());\n    this.adapter.registerPlugin(createGradlePlugin());\n\n    // Standalone plugins (no arch parser \u2014 own manifest discovery via manifestFiles)\n    this.adapter.registerStandalonePlugin(createPyprojectPlugin());\n    this.adapter.registerStandalonePlugin(createRubygemsPlugin());\n    this.adapter.registerStandalonePlugin(createComposerPlugin());\n    this.adapter.registerStandalonePlugin(createSwiftPlugin());\n    this.adapter.registerStandalonePlugin(createPubspecPlugin());\n    this.adapter.registerStandalonePlugin(createHexPlugin());\n  }\n\n  /**\n   * Get the underlying adapter (useful for testing).\n   */\n  getAdapter(): SecurityManifestAdapter {\n    return this.adapter;\n  }\n\n  /**\n   * Run full manifest discovery, parsing, deduplication, and database persistence.\n   *\n   * Steps:\n   * 1. Discover manifest files via the adapter (reuses architecture parsers)\n   * 2. Extract dependencies with version/scope data via registered plugins\n   * 3. Deduplicate: same (name, ecosystem) \u2192 single entry with highest version\n   * 4. Create Dependency_Nodes in the database (nodes + sec_dependencies tables)\n   * 5. Create `declared_in` edges linking dependencies to their source manifests\n   */\n  async parseAll(): Promise<ManifestParseResult> {\n    const warnings: Array<{ file: string; line?: number; message: string }> = [];\n    const errors: Array<{ file: string; message: string }> = [];\n\n    // Step 1 & 2: Discover and extract all dependencies\n    const allDeps: ParsedDependency[] = [];\n    const manifestPaths = this.adapter.discoverManifests();\n    let manifestsParsed = 0;\n\n    for (const manifestPath of manifestPaths) {\n      try {\n        const deps = await this.adapter.extractFromManifest(manifestPath);\n        if (deps.length > 0) {\n          allDeps.push(...deps);\n          manifestsParsed++;\n        } else {\n          // Manifest was parsed but had no dependencies \u2014 still counts\n          manifestsParsed++;\n        }\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        const relPath = manifestPath.replace(this.projectRoot + '/', '').replace(/\\\\/g, '/');\n        errors.push({ file: relPath, message });\n        logError(`[sec:parser] Failed to parse manifest ${relPath}: ${message}`);\n      }\n    }\n\n    if (allDeps.length === 0) {\n      return {\n        dependenciesCreated: 0,\n        manifestsParsed,\n        warnings,\n        errors,\n      };\n    }\n\n    // Step 3: Deduplicate by (name, ecosystem)\n    const deduplicated = deduplicateDependencies(allDeps);\n\n    // Step 4 & 5: Persist to database\n    let dependenciesCreated = 0;\n    const rawDb = this.db.getRawDb();\n\n    for (const dep of deduplicated) {\n      try {\n        const nodeId = `dep:${dep.ecosystem}:${dep.name}`;\n\n        // Create the node in the nodes table via upsertNode\n        const node: Node = {\n          id: nodeId,\n          kind: 'dependency',\n          name: dep.name,\n          qualifiedName: `${dep.ecosystem}/${dep.name}`,\n          filePath: dep.sourceManifests[0] ?? '',\n          language: 'unknown',\n          startLine: 0,\n          endLine: 0,\n          startColumn: 0,\n          endColumn: 0,\n          signature: dep.resolvedVersion ?? dep.declaredConstraint,\n          isExported: false,\n          isAsync: false,\n          isStatic: false,\n          isAbstract: false,\n          updatedAt: Date.now(),\n        };\n\n        this.db.upsertNode(node);\n\n        // Insert/update the sec_dependencies row\n        rawDb.run(\n          `INSERT OR REPLACE INTO sec_dependencies\n            (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests, license)\n           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n          [\n            nodeId,\n            dep.ecosystem,\n            dep.name,\n            dep.declaredConstraint,\n            dep.resolvedVersion ?? null,\n            dep.scope,\n            JSON.stringify(dep.sourceManifests),\n            dep.license ?? null,\n          ],\n        );\n\n        // Create `declared_in` edges from the dependency to each source manifest\n        for (const manifest of dep.sourceManifests) {\n          const edge: Edge = {\n            source: nodeId,\n            target: manifest,\n            kind: 'declared_in',\n          };\n          this.db.insertEdge(edge);\n        }\n\n        dependenciesCreated++;\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        warnings.push({\n          file: dep.sourceManifests[0] ?? 'unknown',\n          message: `Failed to persist dependency ${dep.ecosystem}/${dep.name}: ${message}`,\n        });\n        logWarn(`[sec:parser] Failed to persist dependency ${dep.ecosystem}/${dep.name}: ${message}`);\n      }\n    }\n\n    return {\n      dependenciesCreated,\n      manifestsParsed,\n      warnings,\n      errors,\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,qBAAsE;AACtE,iBAAiC;AACjC,mBAAmC;AACnC,gBAAgC;AAChC,iBAAiC;AACjC,mBAAmC;AACnC,mBAAmC;AACnC,oBAAoC;AACpC,sBAAsC;AACtC,sBAAsC;AACtC,mBAAmC;AACnC,qBAAqC;AACrC,iBAAiC;AACjC,uBAAuC;AAIvC,oBAAkC;AAOlC,SAAS,kBAA2C;AAClD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,cAAc;AAAA,IAC9B,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,cAAc;AAAA,IAC7C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAKA,SAAS,oBAA6C;AACpD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,SAAS;AAAA,IACzB,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,SAAS;AAAA,IACxC;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAKA,SAAS,iBAA0C;AACjD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,QAAQ;AAAA,IACxB,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,QAAQ;AAAA,IACvC;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAKA,SAAS,kBAA2C;AAClD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,kBAAkB;AAAA,IAClC,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,kBAAkB;AAAA,IACjD;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAKA,SAAS,oBAA6C;AACpD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,YAAY;AAAA,IAC5B,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,YAAY;AAAA,IAC3C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAOA,SAAS,oBAA6C;AACpD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,SAAS;AAAA,IACzB,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,SAAS;AAAA,IACxC;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAKA,SAAS,qBAA8C;AACrD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,gBAAgB,kBAAkB;AAAA,IAClD,WAAW,cAA+B;AACxC,YAAM,OAAO,aAAa,MAAM,GAAG,EAAE,IAAI,KAAK;AAC9C,aAAO,SAAS,kBAAkB,SAAS;AAAA,IAC7C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,wBAAiD;AACxD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,gBAAgB;AAAA,IAChC,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,gBAAgB;AAAA,IAC/C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAIA,SAAS,uBAAgD;AACvD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,SAAS;AAAA,IACzB,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,UAAU,KAAK,iBAAiB;AAAA,IAC/D;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,uBAAgD;AACvD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,eAAe;AAAA,IAC/B,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,eAAe;AAAA,IAC9C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,oBAA6C;AACpD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,eAAe;AAAA,IAC/B,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,eAAe;AAAA,IAC9C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,sBAA+C;AACtD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,cAAc;AAAA,IAC9B,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,cAAc;AAAA,IAC7C;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAEA,SAAS,kBAA2C;AAClD,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,CAAC,SAAS;AAAA,IACzB,WAAW,cAA+B;AACxC,aAAO,aAAa,SAAS,SAAS;AAAA,IACxC;AAAA,IACA,SAAS;AAAA,EACX;AACF;AAaO,SAAS,gBAAgB,GAAW,GAAmB;AAE5D,QAAM,SAAS,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,CAAC,IAAI;AAChD,QAAM,SAAS,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,CAAC,IAAI;AAGhD,QAAM,WAAW,OAAO,QAAQ,aAAa,EAAE;AAC/C,QAAM,WAAW,OAAO,QAAQ,aAAa,EAAE;AAE/C,QAAM,SAAS,SAAS,MAAM,GAAG;AACjC,QAAM,SAAS,SAAS,MAAM,GAAG;AAEjC,QAAM,SAAS,KAAK,IAAI,OAAO,QAAQ,OAAO,MAAM;AACpD,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC/B,UAAM,OAAO,OAAO,CAAC,KAAK;AAC1B,UAAM,OAAO,OAAO,CAAC,KAAK;AAG1B,UAAM,OAAO,SAAS,MAAM,EAAE;AAC9B,UAAM,OAAO,SAAS,MAAM,EAAE;AAE9B,QAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;AAChC,UAAI,SAAS,KAAM,QAAO,OAAO;AAGjC,YAAM,UAAU,KAAK,MAAM,OAAO,IAAI,EAAE,MAAM;AAC9C,YAAM,UAAU,KAAK,MAAM,OAAO,IAAI,EAAE,MAAM;AAC9C,UAAI,YAAY,SAAS;AAEvB,YAAI,WAAW,CAAC,QAAS,QAAO;AAChC,YAAI,CAAC,WAAW,QAAS,QAAO;AAChC,eAAO,QAAQ,cAAc,OAAO;AAAA,MACtC;AAAA,IACF,OAAO;AAEL,YAAM,MAAM,KAAK,cAAc,IAAI;AACnC,UAAI,QAAQ,EAAG,QAAO;AAAA,IACxB;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,oBAAoB,KAA+B;AAC1D,SAAO,IAAI,mBAAmB,IAAI;AACpC;AA0BO,SAAS,wBAAwB,MAAoD;AAC1F,QAAM,MAAM,oBAAI,IAAoC;AAEpD,aAAW,OAAO,MAAM;AACtB,UAAM,MAAM,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI;AACxC,UAAM,WAAW,IAAI,IAAI,GAAG;AAE5B,QAAI,CAAC,UAAU;AACb,UAAI,IAAI,KAAK;AAAA,QACX,MAAM,IAAI;AAAA,QACV,WAAW,IAAI;AAAA,QACf,oBAAoB,IAAI;AAAA,QACxB,iBAAiB,IAAI;AAAA,QACrB,OAAO,IAAI;AAAA,QACX,iBAAiB,CAAC,IAAI,cAAc;AAAA,QACpC,SAAS,IAAI;AAAA,MACf,CAAC;AAAA,IACH,OAAO;AAEL,UAAI,CAAC,SAAS,gBAAgB,SAAS,IAAI,cAAc,GAAG;AAC1D,iBAAS,gBAAgB,KAAK,IAAI,cAAc;AAAA,MAClD;AAGA,YAAM,kBAAkB,SAAS,mBAAmB,SAAS;AAC7D,YAAM,aAAa,oBAAoB,GAAG;AAE1C,UAAI,gBAAgB,YAAY,eAAe,IAAI,GAAG;AACpD,iBAAS,qBAAqB,IAAI;AAClC,iBAAS,kBAAkB,IAAI;AAC/B,iBAAS,QAAQ,IAAI;AAErB,YAAI,IAAI,YAAY,QAAW;AAC7B,mBAAS,UAAU,IAAI;AAAA,QACzB;AAAA,MACF,WAAW,SAAS,YAAY,UAAa,IAAI,YAAY,QAAW;AAEtE,iBAAS,UAAU,IAAI;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,IAAI,OAAO,CAAC;AACzB;AAQO,MAAM,eAAe;AAAA,EAK1B,YAAY,IAAmB,aAAqB;AAClD,SAAK,KAAK;AACV,SAAK,cAAc;AACnB,SAAK,UAAU,IAAI,uCAAwB,WAAW;AAGtD,SAAK,QAAQ,eAAe,gBAAgB,CAAC;AAC7C,SAAK,QAAQ,eAAe,kBAAkB,CAAC;AAC/C,SAAK,QAAQ,eAAe,eAAe,CAAC;AAC5C,SAAK,QAAQ,eAAe,gBAAgB,CAAC;AAC7C,SAAK,QAAQ,eAAe,kBAAkB,CAAC;AAC/C,SAAK,QAAQ,eAAe,kBAAkB,CAAC;AAC/C,SAAK,QAAQ,eAAe,mBAAmB,CAAC;AAGhD,SAAK,QAAQ,yBAAyB,sBAAsB,CAAC;AAC7D,SAAK,QAAQ,yBAAyB,qBAAqB,CAAC;AAC5D,SAAK,QAAQ,yBAAyB,qBAAqB,CAAC;AAC5D,SAAK,QAAQ,yBAAyB,kBAAkB,CAAC;AACzD,SAAK,QAAQ,yBAAyB,oBAAoB,CAAC;AAC3D,SAAK,QAAQ,yBAAyB,gBAAgB,CAAC;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA,EAKA,aAAsC;AACpC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,WAAyC;AAC7C,UAAM,WAAoE,CAAC;AAC3E,UAAM,SAAmD,CAAC;AAG1D,UAAM,UAA8B,CAAC;AACrC,UAAM,gBAAgB,KAAK,QAAQ,kBAAkB;AACrD,QAAI,kBAAkB;AAEtB,eAAW,gBAAgB,eAAe;AACxC,UAAI;AACF,cAAM,OAAO,MAAM,KAAK,QAAQ,oBAAoB,YAAY;AAChE,YAAI,KAAK,SAAS,GAAG;AACnB,kBAAQ,KAAK,GAAG,IAAI;AACpB;AAAA,QACF,OAAO;AAEL;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,cAAM,UAAU,aAAa,QAAQ,KAAK,cAAc,KAAK,EAAE,EAAE,QAAQ,OAAO,GAAG;AACnF,eAAO,KAAK,EAAE,MAAM,SAAS,QAAQ,CAAC;AACtC,oCAAS,yCAAyC,OAAO,KAAK,OAAO,EAAE;AAAA,MACzE;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO;AAAA,QACL,qBAAqB;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,eAAe,wBAAwB,OAAO;AAGpD,QAAI,sBAAsB;AAC1B,UAAM,QAAQ,KAAK,GAAG,SAAS;AAE/B,eAAW,OAAO,cAAc;AAC9B,UAAI;AACF,cAAM,SAAS,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI;AAG/C,cAAM,OAAa;AAAA,UACjB,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,MAAM,IAAI;AAAA,UACV,eAAe,GAAG,IAAI,SAAS,IAAI,IAAI,IAAI;AAAA,UAC3C,UAAU,IAAI,gBAAgB,CAAC,KAAK;AAAA,UACpC,UAAU;AAAA,UACV,WAAW;AAAA,UACX,SAAS;AAAA,UACT,aAAa;AAAA,UACb,WAAW;AAAA,UACX,WAAW,IAAI,mBAAmB,IAAI;AAAA,UACtC,YAAY;AAAA,UACZ,SAAS;AAAA,UACT,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,WAAW,KAAK,IAAI;AAAA,QACtB;AAEA,aAAK,GAAG,WAAW,IAAI;AAGvB,cAAM;AAAA,UACJ;AAAA;AAAA;AAAA,UAGA;AAAA,YACE;AAAA,YACA,IAAI;AAAA,YACJ,IAAI;AAAA,YACJ,IAAI;AAAA,YACJ,IAAI,mBAAmB;AAAA,YACvB,IAAI;AAAA,YACJ,KAAK,UAAU,IAAI,eAAe;AAAA,YAClC,IAAI,WAAW;AAAA,UACjB;AAAA,QACF;AAGA,mBAAW,YAAY,IAAI,iBAAiB;AAC1C,gBAAM,OAAa;AAAA,YACjB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR,MAAM;AAAA,UACR;AACA,eAAK,GAAG,WAAW,IAAI;AAAA,QACzB;AAEA;AAAA,MACF,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,iBAAS,KAAK;AAAA,UACZ,MAAM,IAAI,gBAAgB,CAAC,KAAK;AAAA,UAChC,SAAS,gCAAgC,IAAI,SAAS,IAAI,IAAI,IAAI,KAAK,OAAO;AAAA,QAChF,CAAC;AACD,mCAAQ,6CAA6C,IAAI,SAAS,IAAI,IAAI,IAAI,KAAK,OAAO,EAAE;AAAA,MAC9F;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/manifest/plugins/cargo.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a Cargo.toml manifest and extract dependency declarations
+ * with version constraints, scopes, and resolved versions from Cargo.lock.
+ *
+ * @param manifestPath - Absolute path to the Cargo.toml file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseCargoManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=cargo.d.ts.map

package/dist/security/manifest/plugins/cargo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cargo.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/cargo.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAkBpD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuC7B"}

package/dist/security/manifest/plugins/cargo.js

@@ -0,0 +1,233 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var cargo_exports = {};
+__export(cargo_exports, {
+  parseCargoManifest: () => parseCargoManifest
+});
+module.exports = __toCommonJS(cargo_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+const SECTION_SCOPES = [
+  { section: "dependencies", scope: "production" },
+  { section: "dev-dependencies", scope: "development" },
+  { section: "build-dependencies", scope: "development" }
+];
+async function parseCargoManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:cargo] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const license = extractCargoLicense(content);
+  const dependencies = [];
+  for (const { section, scope } of SECTION_SCOPES) {
+    const sectionDeps = extractSectionDependencies(content, section, relativeManifest);
+    for (const dep of sectionDeps) {
+      const resolvedVersion = resolvedVersions.get(dep.name);
+      dependencies.push({
+        name: dep.name,
+        declaredConstraint: dep.constraint,
+        resolvedVersion,
+        scope,
+        ecosystem: "cargo",
+        sourceManifest: relativeManifest,
+        ...license !== void 0 ? { license } : {}
+      });
+    }
+  }
+  return dependencies;
+}
+function extractSectionDependencies(content, section, relativeManifest) {
+  const deps = [];
+  const sectionRegex = new RegExp(`^\\[${escapeRegex(section)}\\]\\s*$`, "m");
+  const sectionMatch = sectionRegex.exec(content);
+  if (sectionMatch) {
+    const startIdx = sectionMatch.index + sectionMatch[0].length;
+    const remaining = content.slice(startIdx);
+    const nextSectionMatch = remaining.match(/^\[/m);
+    const sectionContent = nextSectionMatch ? remaining.slice(0, nextSectionMatch.index) : remaining;
+    const lines = sectionContent.split("\n");
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (trimmed === "" || trimmed.startsWith("#")) continue;
+      const dep = parseDependencyLine(trimmed, relativeManifest, section);
+      if (dep) {
+        deps.push(dep);
+      }
+    }
+  }
+  const tableRegex = new RegExp(`^\\[${escapeRegex(section)}\\.([^\\]]+)\\]\\s*$`, "gm");
+  let tableMatch;
+  while ((tableMatch = tableRegex.exec(content)) !== null) {
+    const depName = tableMatch[1].trim();
+    const startIdx = tableMatch.index + tableMatch[0].length;
+    const remaining = content.slice(startIdx);
+    const nextSectionMatch = remaining.match(/^\[/m);
+    const tableContent = nextSectionMatch ? remaining.slice(0, nextSectionMatch.index) : remaining;
+    const version = extractVersionFromTable(tableContent);
+    if (version) {
+      deps.push({ name: depName, constraint: version });
+    } else {
+      deps.push({ name: depName, constraint: "*" });
+    }
+  }
+  return deps;
+}
+function parseDependencyLine(line, relativeManifest, section) {
+  const simpleMatch = line.match(/^([a-zA-Z0-9_-]+)\s*=\s*"([^"]*)"$/);
+  if (simpleMatch) {
+    const name = simpleMatch[1];
+    const constraint = simpleMatch[2];
+    if (!isValidCrateName(name)) {
+      (0, import_errors.logWarn)(`[sec:cargo] Invalid crate name "${name}" in ${relativeManifest} [${section}] \u2014 skipping`);
+      return null;
+    }
+    if (constraint.trim() === "") {
+      (0, import_errors.logWarn)(`[sec:cargo] Empty version constraint for "${name}" in ${relativeManifest} [${section}] \u2014 skipping`);
+      return null;
+    }
+    return { name, constraint };
+  }
+  const tableMatch = line.match(/^([a-zA-Z0-9_-]+)\s*=\s*\{(.*)\}\s*$/);
+  if (tableMatch) {
+    const name = tableMatch[1];
+    const tableContent = tableMatch[2];
+    if (!isValidCrateName(name)) {
+      (0, import_errors.logWarn)(`[sec:cargo] Invalid crate name "${name}" in ${relativeManifest} [${section}] \u2014 skipping`);
+      return null;
+    }
+    const version = extractVersionFromInlineTable(tableContent);
+    if (version) {
+      return { name, constraint: version };
+    }
+    return { name, constraint: "*" };
+  }
+  if (line.includes("=") && !line.startsWith("#")) {
+    const possibleName = line.split("=")[0].trim();
+    if (possibleName && /^[a-zA-Z0-9_-]+$/.test(possibleName)) {
+      (0, import_errors.logWarn)(`[sec:cargo] Could not parse dependency line in ${relativeManifest} [${section}]: "${line}" \u2014 skipping`);
+    }
+  }
+  return null;
+}
+function extractVersionFromInlineTable(tableContent) {
+  const versionMatch = tableContent.match(/version\s*=\s*"([^"]*)"/);
+  if (versionMatch && versionMatch[1].trim() !== "") {
+    return versionMatch[1];
+  }
+  return null;
+}
+function extractVersionFromTable(tableContent) {
+  const lines = tableContent.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const versionMatch = trimmed.match(/^version\s*=\s*"([^"]*)"$/);
+    if (versionMatch && versionMatch[1].trim() !== "") {
+      return versionMatch[1];
+    }
+  }
+  return null;
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const lockPath = path.join(manifestDir, "Cargo.lock");
+  if (!fs.existsSync(lockPath)) {
+    return map;
+  }
+  try {
+    const lockContent = fs.readFileSync(lockPath, "utf8");
+    extractFromCargoLock(lockContent, map);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:cargo] Failed to parse Cargo.lock: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function extractFromCargoLock(content, map) {
+  const lines = content.split("\n");
+  let currentName = null;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === "[[package]]") {
+      currentName = null;
+      continue;
+    }
+    if (currentName === null) {
+      const nameMatch = trimmed.match(/^name\s*=\s*"([^"]+)"$/);
+      if (nameMatch) {
+        currentName = nameMatch[1];
+        continue;
+      }
+    }
+    if (currentName !== null) {
+      const versionMatch = trimmed.match(/^version\s*=\s*"([^"]+)"$/);
+      if (versionMatch) {
+        if (!map.has(currentName)) {
+          map.set(currentName, versionMatch[1]);
+        }
+        currentName = null;
+        continue;
+      }
+    }
+    if (trimmed === "" || trimmed.startsWith("[")) {
+      currentName = null;
+    }
+  }
+}
+function isValidCrateName(name) {
+  if (!name || typeof name !== "string") return false;
+  if (name.length > 64) return false;
+  return /^[a-zA-Z][a-zA-Z0-9_-]*$/.test(name);
+}
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function extractCargoLicense(content) {
+  const packageSectionMatch = /^\[package\]\s*$/m.exec(content);
+  if (!packageSectionMatch) return void 0;
+  const startIdx = packageSectionMatch.index + packageSectionMatch[0].length;
+  const remaining = content.slice(startIdx);
+  const nextSection = remaining.match(/^\[/m);
+  const sectionContent = nextSection ? remaining.slice(0, nextSection.index) : remaining;
+  const licenseMatch = sectionContent.match(/^license\s*=\s*"([^"]+)"/m);
+  if (licenseMatch && licenseMatch[1].trim() !== "") {
+    return licenseMatch[1].trim();
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseCargoManifest
+});
+//# sourceMappingURL=cargo.js.map