kirograph 0.17.0 → 0.20.0

package/dist/security/manifest/plugins/cargo.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/cargo.ts"],
+  "sourcesContent": ["/**\n * Cargo Version Extraction Plugin for KiroGraph-Sec\n *\n * Extends the existing architecture cargo parser to extract version constraints,\n * resolved versions (from Cargo.lock), and dependency scopes for security analysis.\n *\n * Reuses `cargoParser` from `src/architecture/manifest/cargo.ts` for discovery and\n * basic parsing, then layers on version/scope extraction.\n *\n * Handles both simple format (`serde = \"1.0\"`) and table format\n * (`serde = { version = \"1.0\", features = [\"derive\"] }`).\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Dependency section headers in Cargo.toml mapped to their ParsedDependency scope.\n */\nconst SECTION_SCOPES: Array<{ section: string; scope: ParsedDependency['scope'] }> = [\n  { section: 'dependencies', scope: 'production' },\n  { section: 'dev-dependencies', scope: 'development' },\n  { section: 'build-dependencies', scope: 'development' },\n];\n\n/**\n * Resolved version map: package name \u2192 resolved version string.\n * Built from Cargo.lock.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * Parse a Cargo.toml manifest and extract dependency declarations\n * with version constraints, scopes, and resolved versions from Cargo.lock.\n *\n * @param manifestPath - Absolute path to the Cargo.toml file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parseCargoManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read the Cargo.toml content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:cargo] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Attempt to load resolved versions from Cargo.lock\n  const resolvedVersions = loadResolvedVersions(manifestDir);\n\n  // Extract the package-level license from [package] section\n  const license = extractCargoLicense(content);\n\n  // Extract dependencies from each section\n  const dependencies: ParsedDependency[] = [];\n\n  for (const { section, scope } of SECTION_SCOPES) {\n    const sectionDeps = extractSectionDependencies(content, section, relativeManifest);\n    for (const dep of sectionDeps) {\n      const resolvedVersion = resolvedVersions.get(dep.name);\n      dependencies.push({\n        name: dep.name,\n        declaredConstraint: dep.constraint,\n        resolvedVersion,\n        scope,\n        ecosystem: 'cargo',\n        sourceManifest: relativeManifest,\n        ...(license !== undefined ? { license } : {}),\n      });\n    }\n  }\n\n  return dependencies;\n}\n\n/**\n * A raw dependency entry extracted from a TOML section.\n */\ninterface RawDependency {\n  name: string;\n  constraint: string;\n}\n\n/**\n * Extract dependencies from a specific section of a Cargo.toml file.\n * Handles both simple (`name = \"version\"`) and table (`name = { version = \"...\" }`) formats.\n * Also handles `[<section>.<name>]` table headers for individual dependency configuration.\n */\nfunction extractSectionDependencies(\n  content: string,\n  section: string,\n  relativeManifest: string,\n): RawDependency[] {\n  const deps: RawDependency[] = [];\n\n  // Pattern 1: Inline section [dependencies] / [dev-dependencies] / [build-dependencies]\n  // Match the section header and capture everything until the next section header\n  const sectionRegex = new RegExp(`^\\\\[${escapeRegex(section)}\\\\]\\\\s*$`, 'm');\n  const sectionMatch = sectionRegex.exec(content);\n\n  if (sectionMatch) {\n    const startIdx = sectionMatch.index + sectionMatch[0].length;\n    // Find the next section header (line starting with [)\n    const remaining = content.slice(startIdx);\n    const nextSectionMatch = remaining.match(/^\\[/m);\n    const sectionContent = nextSectionMatch\n      ? remaining.slice(0, nextSectionMatch.index)\n      : remaining;\n\n    const lines = sectionContent.split('\\n');\n    for (const line of lines) {\n      const trimmed = line.trim();\n      if (trimmed === '' || trimmed.startsWith('#')) continue;\n\n      const dep = parseDependencyLine(trimmed, relativeManifest, section);\n      if (dep) {\n        deps.push(dep);\n      }\n    }\n  }\n\n  // Pattern 2: Table-style individual dependency sections\n  // e.g., [dependencies.serde] or [dev-dependencies.tokio]\n  const tableRegex = new RegExp(`^\\\\[${escapeRegex(section)}\\\\.([^\\\\]]+)\\\\]\\\\s*$`, 'gm');\n  let tableMatch: RegExpExecArray | null;\n  while ((tableMatch = tableRegex.exec(content)) !== null) {\n    const depName = tableMatch[1].trim();\n    const startIdx = tableMatch.index + tableMatch[0].length;\n    const remaining = content.slice(startIdx);\n    const nextSectionMatch = remaining.match(/^\\[/m);\n    const tableContent = nextSectionMatch\n      ? remaining.slice(0, nextSectionMatch.index)\n      : remaining;\n\n    const version = extractVersionFromTable(tableContent);\n    if (version) {\n      deps.push({ name: depName, constraint: version });\n    } else {\n      // If no version specified, it might use path/git \u2014 use \"*\" as constraint\n      deps.push({ name: depName, constraint: '*' });\n    }\n  }\n\n  return deps;\n}\n\n/**\n * Parse a single dependency line from a Cargo.toml section.\n *\n * Handles:\n * - Simple string: `serde = \"1.0\"`\n * - Inline table: `serde = { version = \"1.0\", features = [\"derive\"] }`\n * - Path/git dependencies without version: `my-lib = { path = \"../my-lib\" }`\n */\nfunction parseDependencyLine(\n  line: string,\n  relativeManifest: string,\n  section: string,\n): RawDependency | null {\n  // Match: name = \"version\" or name = '...'\n  const simpleMatch = line.match(/^([a-zA-Z0-9_-]+)\\s*=\\s*\"([^\"]*)\"$/);\n  if (simpleMatch) {\n    const name = simpleMatch[1];\n    const constraint = simpleMatch[2];\n    if (!isValidCrateName(name)) {\n      logWarn(`[sec:cargo] Invalid crate name \"${name}\" in ${relativeManifest} [${section}] \u2014 skipping`);\n      return null;\n    }\n    if (constraint.trim() === '') {\n      logWarn(`[sec:cargo] Empty version constraint for \"${name}\" in ${relativeManifest} [${section}] \u2014 skipping`);\n      return null;\n    }\n    return { name, constraint };\n  }\n\n  // Match: name = { version = \"...\", ... }\n  const tableMatch = line.match(/^([a-zA-Z0-9_-]+)\\s*=\\s*\\{(.*)\\}\\s*$/);\n  if (tableMatch) {\n    const name = tableMatch[1];\n    const tableContent = tableMatch[2];\n    if (!isValidCrateName(name)) {\n      logWarn(`[sec:cargo] Invalid crate name \"${name}\" in ${relativeManifest} [${section}] \u2014 skipping`);\n      return null;\n    }\n\n    const version = extractVersionFromInlineTable(tableContent);\n    if (version) {\n      return { name, constraint: version };\n    }\n\n    // No version field \u2014 path or git dependency, use \"*\" as constraint\n    return { name, constraint: '*' };\n  }\n\n  // Line doesn't match expected formats \u2014 could be a comment or malformed\n  // Only warn if it looks like it was intended to be a dependency\n  if (line.includes('=') && !line.startsWith('#')) {\n    const possibleName = line.split('=')[0].trim();\n    if (possibleName && /^[a-zA-Z0-9_-]+$/.test(possibleName)) {\n      logWarn(`[sec:cargo] Could not parse dependency line in ${relativeManifest} [${section}]: \"${line}\" \u2014 skipping`);\n    }\n  }\n\n  return null;\n}\n\n/**\n * Extract the version field from an inline table string.\n * e.g., from `version = \"1.0\", features = [\"derive\"]` \u2192 \"1.0\"\n */\nfunction extractVersionFromInlineTable(tableContent: string): string | null {\n  const versionMatch = tableContent.match(/version\\s*=\\s*\"([^\"]*)\"/);\n  if (versionMatch && versionMatch[1].trim() !== '') {\n    return versionMatch[1];\n  }\n  return null;\n}\n\n/**\n * Extract the version field from a multi-line table section.\n * e.g., from lines like `version = \"1.0\"`\n */\nfunction extractVersionFromTable(tableContent: string): string | null {\n  const lines = tableContent.split('\\n');\n  for (const line of lines) {\n    const trimmed = line.trim();\n    const versionMatch = trimmed.match(/^version\\s*=\\s*\"([^\"]*)\"$/);\n    if (versionMatch && versionMatch[1].trim() !== '') {\n      return versionMatch[1];\n    }\n  }\n  return null;\n}\n\n/**\n * Attempt to load resolved versions from Cargo.lock in the given directory.\n * Returns an empty map if Cargo.lock is not available.\n *\n * Cargo.lock format uses [[package]] blocks:\n * ```\n * [[package]]\n * name = \"serde\"\n * version = \"1.0.193\"\n * ```\n */\nfunction loadResolvedVersions(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  const lockPath = path.join(manifestDir, 'Cargo.lock');\n  if (!fs.existsSync(lockPath)) {\n    return map;\n  }\n\n  try {\n    const lockContent = fs.readFileSync(lockPath, 'utf8');\n    extractFromCargoLock(lockContent, map);\n  } catch (err) {\n    logWarn(`[sec:cargo] Failed to parse Cargo.lock: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from Cargo.lock content.\n *\n * Cargo.lock uses [[package]] blocks with name and version fields:\n * ```\n * [[package]]\n * name = \"serde\"\n * version = \"1.0.193\"\n * source = \"registry+https://github.com/rust-lang/crates.io-index\"\n * ```\n */\nfunction extractFromCargoLock(content: string, map: ResolvedVersionMap): void {\n  const lines = content.split('\\n');\n  let currentName: string | null = null;\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n\n    // New package block\n    if (trimmed === '[[package]]') {\n      currentName = null;\n      continue;\n    }\n\n    // Name field within a package block\n    if (currentName === null) {\n      const nameMatch = trimmed.match(/^name\\s*=\\s*\"([^\"]+)\"$/);\n      if (nameMatch) {\n        currentName = nameMatch[1];\n        continue;\n      }\n    }\n\n    // Version field within a package block (after name is set)\n    if (currentName !== null) {\n      const versionMatch = trimmed.match(/^version\\s*=\\s*\"([^\"]+)\"$/);\n      if (versionMatch) {\n        // Only store the first occurrence (highest version is typically last,\n        // but Cargo.lock lists the resolved version for each unique instance)\n        if (!map.has(currentName)) {\n          map.set(currentName, versionMatch[1]);\n        }\n        currentName = null;\n        continue;\n      }\n    }\n\n    // Reset on empty line or new section\n    if (trimmed === '' || trimmed.startsWith('[')) {\n      currentName = null;\n    }\n  }\n}\n\n/**\n * Validate that a crate name follows Rust/Cargo naming conventions.\n * Crate names must be non-empty and contain only alphanumeric characters,\n * hyphens, or underscores.\n */\nfunction isValidCrateName(name: string): boolean {\n  if (!name || typeof name !== 'string') return false;\n  if (name.length > 64) return false;\n  return /^[a-zA-Z][a-zA-Z0-9_-]*$/.test(name);\n}\n\n/**\n * Escape special regex characters in a string.\n */\nfunction escapeRegex(str: string): string {\n  return str.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\n/**\n * Extract the license field from the [package] section of a Cargo.toml.\n * Handles: license = \"MIT\" or license = \"MIT OR Apache-2.0\"\n */\nfunction extractCargoLicense(content: string): string | undefined {\n  // Find the [package] section\n  const packageSectionMatch = /^\\[package\\]\\s*$/m.exec(content);\n  if (!packageSectionMatch) return undefined;\n\n  const startIdx = packageSectionMatch.index + packageSectionMatch[0].length;\n  const remaining = content.slice(startIdx);\n  // Grab content up to the next section header\n  const nextSection = remaining.match(/^\\[/m);\n  const sectionContent = nextSection ? remaining.slice(0, nextSection.index) : remaining;\n\n  const licenseMatch = sectionContent.match(/^license\\s*=\\s*\"([^\"]+)\"/m);\n  if (licenseMatch && licenseMatch[1].trim() !== '') {\n    return licenseMatch[1].trim();\n  }\n  return undefined;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAYA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAKxB,MAAM,iBAA+E;AAAA,EACnF,EAAE,SAAS,gBAAgB,OAAO,aAAa;AAAA,EAC/C,EAAE,SAAS,oBAAoB,OAAO,cAAc;AAAA,EACpD,EAAE,SAAS,sBAAsB,OAAO,cAAc;AACxD;AAgBA,eAAsB,mBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,8BAA8B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC7G,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,mBAAmB,qBAAqB,WAAW;AAGzD,QAAM,UAAU,oBAAoB,OAAO;AAG3C,QAAM,eAAmC,CAAC;AAE1C,aAAW,EAAE,SAAS,MAAM,KAAK,gBAAgB;AAC/C,UAAM,cAAc,2BAA2B,SAAS,SAAS,gBAAgB;AACjF,eAAW,OAAO,aAAa;AAC7B,YAAM,kBAAkB,iBAAiB,IAAI,IAAI,IAAI;AACrD,mBAAa,KAAK;AAAA,QAChB,MAAM,IAAI;AAAA,QACV,oBAAoB,IAAI;AAAA,QACxB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAeA,SAAS,2BACP,SACA,SACA,kBACiB;AACjB,QAAM,OAAwB,CAAC;AAI/B,QAAM,eAAe,IAAI,OAAO,OAAO,YAAY,OAAO,CAAC,YAAY,GAAG;AAC1E,QAAM,eAAe,aAAa,KAAK,OAAO;AAE9C,MAAI,cAAc;AAChB,UAAM,WAAW,aAAa,QAAQ,aAAa,CAAC,EAAE;AAEtD,UAAM,YAAY,QAAQ,MAAM,QAAQ;AACxC,UAAM,mBAAmB,UAAU,MAAM,MAAM;AAC/C,UAAM,iBAAiB,mBACnB,UAAU,MAAM,GAAG,iBAAiB,KAAK,IACzC;AAEJ,UAAM,QAAQ,eAAe,MAAM,IAAI;AACvC,eAAW,QAAQ,OAAO;AACxB,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,YAAY,MAAM,QAAQ,WAAW,GAAG,EAAG;AAE/C,YAAM,MAAM,oBAAoB,SAAS,kBAAkB,OAAO;AAClE,UAAI,KAAK;AACP,aAAK,KAAK,GAAG;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAIA,QAAM,aAAa,IAAI,OAAO,OAAO,YAAY,OAAO,CAAC,wBAAwB,IAAI;AACrF,MAAI;AACJ,UAAQ,aAAa,WAAW,KAAK,OAAO,OAAO,MAAM;AACvD,UAAM,UAAU,WAAW,CAAC,EAAE,KAAK;AACnC,UAAM,WAAW,WAAW,QAAQ,WAAW,CAAC,EAAE;AAClD,UAAM,YAAY,QAAQ,MAAM,QAAQ;AACxC,UAAM,mBAAmB,UAAU,MAAM,MAAM;AAC/C,UAAM,eAAe,mBACjB,UAAU,MAAM,GAAG,iBAAiB,KAAK,IACzC;AAEJ,UAAM,UAAU,wBAAwB,YAAY;AACpD,QAAI,SAAS;AACX,WAAK,KAAK,EAAE,MAAM,SAAS,YAAY,QAAQ,CAAC;AAAA,IAClD,OAAO;AAEL,WAAK,KAAK,EAAE,MAAM,SAAS,YAAY,IAAI,CAAC;AAAA,IAC9C;AAAA,EACF;AAEA,SAAO;AACT;AAUA,SAAS,oBACP,MACA,kBACA,SACsB;AAEtB,QAAM,cAAc,KAAK,MAAM,oCAAoC;AACnE,MAAI,aAAa;AACf,UAAM,OAAO,YAAY,CAAC;AAC1B,UAAM,aAAa,YAAY,CAAC;AAChC,QAAI,CAAC,iBAAiB,IAAI,GAAG;AAC3B,iCAAQ,mCAAmC,IAAI,QAAQ,gBAAgB,KAAK,OAAO,mBAAc;AACjG,aAAO;AAAA,IACT;AACA,QAAI,WAAW,KAAK,MAAM,IAAI;AAC5B,iCAAQ,6CAA6C,IAAI,QAAQ,gBAAgB,KAAK,OAAO,mBAAc;AAC3G,aAAO;AAAA,IACT;AACA,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AAGA,QAAM,aAAa,KAAK,MAAM,sCAAsC;AACpE,MAAI,YAAY;AACd,UAAM,OAAO,WAAW,CAAC;AACzB,UAAM,eAAe,WAAW,CAAC;AACjC,QAAI,CAAC,iBAAiB,IAAI,GAAG;AAC3B,iCAAQ,mCAAmC,IAAI,QAAQ,gBAAgB,KAAK,OAAO,mBAAc;AACjG,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,8BAA8B,YAAY;AAC1D,QAAI,SAAS;AACX,aAAO,EAAE,MAAM,YAAY,QAAQ;AAAA,IACrC;AAGA,WAAO,EAAE,MAAM,YAAY,IAAI;AAAA,EACjC;AAIA,MAAI,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,WAAW,GAAG,GAAG;AAC/C,UAAM,eAAe,KAAK,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK;AAC7C,QAAI,gBAAgB,mBAAmB,KAAK,YAAY,GAAG;AACzD,iCAAQ,kDAAkD,gBAAgB,KAAK,OAAO,OAAO,IAAI,mBAAc;AAAA,IACjH;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,8BAA8B,cAAqC;AAC1E,QAAM,eAAe,aAAa,MAAM,yBAAyB;AACjE,MAAI,gBAAgB,aAAa,CAAC,EAAE,KAAK,MAAM,IAAI;AACjD,WAAO,aAAa,CAAC;AAAA,EACvB;AACA,SAAO;AACT;AAMA,SAAS,wBAAwB,cAAqC;AACpE,QAAM,QAAQ,aAAa,MAAM,IAAI;AACrC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,eAAe,QAAQ,MAAM,2BAA2B;AAC9D,QAAI,gBAAgB,aAAa,CAAC,EAAE,KAAK,MAAM,IAAI;AACjD,aAAO,aAAa,CAAC;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;AAaA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,MAA0B,oBAAI,IAAI;AAExC,QAAM,WAAW,KAAK,KAAK,aAAa,YAAY;AACpD,MAAI,CAAC,GAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,cAAc,GAAG,aAAa,UAAU,MAAM;AACpD,yBAAqB,aAAa,GAAG;AAAA,EACvC,SAAS,KAAK;AACZ,+BAAQ,2CAA2C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EACvG;AAEA,SAAO;AACT;AAaA,SAAS,qBAAqB,SAAiB,KAA+B;AAC5E,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,MAAI,cAA6B;AAEjC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAG1B,QAAI,YAAY,eAAe;AAC7B,oBAAc;AACd;AAAA,IACF;AAGA,QAAI,gBAAgB,MAAM;AACxB,YAAM,YAAY,QAAQ,MAAM,wBAAwB;AACxD,UAAI,WAAW;AACb,sBAAc,UAAU,CAAC;AACzB;AAAA,MACF;AAAA,IACF;AAGA,QAAI,gBAAgB,MAAM;AACxB,YAAM,eAAe,QAAQ,MAAM,2BAA2B;AAC9D,UAAI,cAAc;AAGhB,YAAI,CAAC,IAAI,IAAI,WAAW,GAAG;AACzB,cAAI,IAAI,aAAa,aAAa,CAAC,CAAC;AAAA,QACtC;AACA,sBAAc;AACd;AAAA,MACF;AAAA,IACF;AAGA,QAAI,YAAY,MAAM,QAAQ,WAAW,GAAG,GAAG;AAC7C,oBAAc;AAAA,IAChB;AAAA,EACF;AACF;AAOA,SAAS,iBAAiB,MAAuB;AAC/C,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,MAAI,KAAK,SAAS,GAAI,QAAO;AAC7B,SAAO,2BAA2B,KAAK,IAAI;AAC7C;AAKA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uBAAuB,MAAM;AAClD;AAMA,SAAS,oBAAoB,SAAqC;AAEhE,QAAM,sBAAsB,oBAAoB,KAAK,OAAO;AAC5D,MAAI,CAAC,oBAAqB,QAAO;AAEjC,QAAM,WAAW,oBAAoB,QAAQ,oBAAoB,CAAC,EAAE;AACpE,QAAM,YAAY,QAAQ,MAAM,QAAQ;AAExC,QAAM,cAAc,UAAU,MAAM,MAAM;AAC1C,QAAM,iBAAiB,cAAc,UAAU,MAAM,GAAG,YAAY,KAAK,IAAI;AAE7E,QAAM,eAAe,eAAe,MAAM,2BAA2B;AACrE,MAAI,gBAAgB,aAAa,CAAC,EAAE,KAAK,MAAM,IAAI;AACjD,WAAO,aAAa,CAAC,EAAE,KAAK;AAAA,EAC9B;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/security/manifest/plugins/composer.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a composer.json manifest and extract package declarations with
+ * version constraints, scopes, and resolved versions from composer.lock.
+ *
+ * @param manifestPath - Absolute path to the composer.json file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseComposerManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=composer.d.ts.map

package/dist/security/manifest/plugins/composer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composer.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/composer.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoE7B"}

package/dist/security/manifest/plugins/composer.js

@@ -0,0 +1,152 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var composer_exports = {};
+__export(composer_exports, {
+  parseComposerManifest: () => parseComposerManifest
+});
+module.exports = __toCommonJS(composer_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+async function parseComposerManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:composer] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(content);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:composer] Failed to parse JSON in ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const license = extractComposerLicense(manifest);
+  const dependencies = [];
+  const sections = [
+    { key: "require", scope: "production" },
+    { key: "require-dev", scope: "development" }
+  ];
+  for (const { key, scope } of sections) {
+    const section = manifest[key];
+    if (!section || typeof section !== "object" || Array.isArray(section)) continue;
+    for (const [pkgName, versionConstraint] of Object.entries(section)) {
+      if (shouldSkipEntry(pkgName)) continue;
+      if (typeof versionConstraint !== "string") {
+        (0, import_errors.logWarn)(`[sec:composer] Non-string version for "${pkgName}" in ${relativeManifest} \u2014 skipping`);
+        continue;
+      }
+      if (!isValidPackageName(pkgName)) {
+        (0, import_errors.logWarn)(`[sec:composer] Invalid package name "${pkgName}" in ${relativeManifest} \u2014 skipping`);
+        continue;
+      }
+      const resolvedVersion = resolvedVersions.get(pkgName.toLowerCase());
+      dependencies.push({
+        name: pkgName,
+        declaredConstraint: versionConstraint,
+        resolvedVersion,
+        scope,
+        ecosystem: "composer",
+        sourceManifest: relativeManifest,
+        ...license !== void 0 ? { license } : {}
+      });
+    }
+  }
+  return dependencies;
+}
+function shouldSkipEntry(name) {
+  if (name === "php") return true;
+  if (name.startsWith("ext-")) return true;
+  if (name === "platform") return true;
+  return false;
+}
+function isValidPackageName(name) {
+  if (!name || typeof name !== "string") return false;
+  if (name.length > 255) return false;
+  return /^[a-z0-9]([a-z0-9_.-]*\/[a-z0-9][a-z0-9_.-]*)$/.test(name);
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const lockPath = path.join(manifestDir, "composer.lock");
+  if (!fs.existsSync(lockPath)) {
+    return map;
+  }
+  try {
+    const lockContent = fs.readFileSync(lockPath, "utf8");
+    extractFromComposerLock(lockContent, map);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:composer] Failed to parse composer.lock: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function extractFromComposerLock(content, map) {
+  let lockData;
+  try {
+    lockData = JSON.parse(content);
+  } catch {
+    (0, import_errors.logWarn)("[sec:composer] composer.lock is not valid JSON \u2014 resolved versions unavailable");
+    return;
+  }
+  const arrays = [lockData["packages"], lockData["packages-dev"]];
+  for (const arr of arrays) {
+    if (!Array.isArray(arr)) continue;
+    for (const entry of arr) {
+      if (!entry || typeof entry !== "object") continue;
+      const pkg = entry;
+      const name = typeof pkg["name"] === "string" ? pkg["name"].toLowerCase() : null;
+      const version = typeof pkg["version"] === "string" ? pkg["version"] : null;
+      if (name && version) {
+        const normalised = version.startsWith("v") ? version.slice(1) : version;
+        if (!map.has(name)) {
+          map.set(name, normalised);
+        }
+      }
+    }
+  }
+}
+function extractComposerLicense(manifest) {
+  const raw = manifest["license"];
+  if (typeof raw === "string" && raw.trim() !== "") {
+    return raw.trim();
+  }
+  if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === "string") {
+    return raw.join(" OR ");
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseComposerManifest
+});
+//# sourceMappingURL=composer.js.map

package/dist/security/manifest/plugins/composer.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/composer.ts"],
+  "sourcesContent": ["/**\n * Composer Version Extraction Plugin for KiroGraph-Sec\n *\n * Parses composer.json manifests to extract PHP package declarations with\n * version constraints, scopes, and resolved versions from composer.lock.\n *\n * Handles:\n * - `require` section \u2192 'production' scope\n * - `require-dev` section \u2192 'development' scope\n * - Skips `php`, `ext-*`, and `platform` entries (not installable packages)\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Resolved version map: package name \u2192 resolved version string.\n * Built from composer.lock.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * Parse a composer.json manifest and extract package declarations with\n * version constraints, scopes, and resolved versions from composer.lock.\n *\n * @param manifestPath - Absolute path to the composer.json file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parseComposerManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read the composer.json content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:composer] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Parse JSON\n  let manifest: Record<string, unknown>;\n  try {\n    manifest = JSON.parse(content) as Record<string, unknown>;\n  } catch (err) {\n    logWarn(`[sec:composer] Failed to parse JSON in ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Attempt to load resolved versions from composer.lock\n  const resolvedVersions = loadResolvedVersions(manifestDir);\n\n  // Extract the project-level license\n  const license = extractComposerLicense(manifest);\n\n  const dependencies: ParsedDependency[] = [];\n\n  // Process `require` (production) and `require-dev` (development) sections\n  const sections: Array<{ key: string; scope: ParsedDependency['scope'] }> = [\n    { key: 'require', scope: 'production' },\n    { key: 'require-dev', scope: 'development' },\n  ];\n\n  for (const { key, scope } of sections) {\n    const section = manifest[key];\n    if (!section || typeof section !== 'object' || Array.isArray(section)) continue;\n\n    for (const [pkgName, versionConstraint] of Object.entries(section as Record<string, unknown>)) {\n      // Skip PHP runtime and extensions\n      if (shouldSkipEntry(pkgName)) continue;\n\n      if (typeof versionConstraint !== 'string') {\n        logWarn(`[sec:composer] Non-string version for \"${pkgName}\" in ${relativeManifest} \u2014 skipping`);\n        continue;\n      }\n\n      if (!isValidPackageName(pkgName)) {\n        logWarn(`[sec:composer] Invalid package name \"${pkgName}\" in ${relativeManifest} \u2014 skipping`);\n        continue;\n      }\n\n      const resolvedVersion = resolvedVersions.get(pkgName.toLowerCase());\n      dependencies.push({\n        name: pkgName,\n        declaredConstraint: versionConstraint,\n        resolvedVersion,\n        scope,\n        ecosystem: 'composer',\n        sourceManifest: relativeManifest,\n        ...(license !== undefined ? { license } : {}),\n      });\n    }\n  }\n\n  return dependencies;\n}\n\n/**\n * Determine whether a composer.json key should be skipped.\n * Skips `php`, `ext-*`, and `platform` entries.\n */\nfunction shouldSkipEntry(name: string): boolean {\n  if (name === 'php') return true;\n  if (name.startsWith('ext-')) return true;\n  if (name === 'platform') return true;\n  return false;\n}\n\n/**\n * Validate that a Composer package name follows the `vendor/package` convention.\n * Also accepts bare names for legacy packages, but rejects obviously invalid entries.\n */\nfunction isValidPackageName(name: string): boolean {\n  if (!name || typeof name !== 'string') return false;\n  if (name.length > 255) return false;\n  // Composer names must be vendor/package (lowercase, hyphens, digits allowed)\n  return /^[a-z0-9]([a-z0-9_.-]*\\/[a-z0-9][a-z0-9_.-]*)$/.test(name);\n}\n\n/**\n * Attempt to load resolved versions from composer.lock in the given directory.\n * Returns an empty map if composer.lock is not available.\n *\n * composer.lock format (JSON):\n * ```json\n * {\n *   \"packages\": [{ \"name\": \"vendor/package\", \"version\": \"1.2.3\" }],\n *   \"packages-dev\": [{ \"name\": \"vendor/dev-package\", \"version\": \"v2.0.0\" }]\n * }\n * ```\n * Version strings may be prefixed with `v` \u2014 these are stripped.\n */\nfunction loadResolvedVersions(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  const lockPath = path.join(manifestDir, 'composer.lock');\n  if (!fs.existsSync(lockPath)) {\n    return map;\n  }\n\n  try {\n    const lockContent = fs.readFileSync(lockPath, 'utf8');\n    extractFromComposerLock(lockContent, map);\n  } catch (err) {\n    logWarn(`[sec:composer] Failed to parse composer.lock: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from composer.lock content.\n *\n * Reads both `packages` (production) and `packages-dev` arrays.\n * Normalises version strings by stripping a leading `v`.\n */\nfunction extractFromComposerLock(content: string, map: ResolvedVersionMap): void {\n  let lockData: Record<string, unknown>;\n  try {\n    lockData = JSON.parse(content) as Record<string, unknown>;\n  } catch {\n    logWarn('[sec:composer] composer.lock is not valid JSON \u2014 resolved versions unavailable');\n    return;\n  }\n\n  const arrays = [lockData['packages'], lockData['packages-dev']];\n  for (const arr of arrays) {\n    if (!Array.isArray(arr)) continue;\n    for (const entry of arr) {\n      if (!entry || typeof entry !== 'object') continue;\n      const pkg = entry as Record<string, unknown>;\n      const name = typeof pkg['name'] === 'string' ? pkg['name'].toLowerCase() : null;\n      const version = typeof pkg['version'] === 'string' ? pkg['version'] : null;\n      if (name && version) {\n        // Strip leading `v` from version strings (e.g. \"v1.2.3\" \u2192 \"1.2.3\")\n        const normalised = version.startsWith('v') ? version.slice(1) : version;\n        if (!map.has(name)) {\n          map.set(name, normalised);\n        }\n      }\n    }\n  }\n}\n\n/**\n * Extract the license field from a parsed composer.json manifest.\n * The \"license\" field can be a string or an array of strings (SPDX).\n */\nfunction extractComposerLicense(manifest: Record<string, unknown>): string | undefined {\n  const raw = manifest['license'];\n  if (typeof raw === 'string' && raw.trim() !== '') {\n    return raw.trim();\n  }\n  if (Array.isArray(raw) && raw.length > 0 && typeof raw[0] === 'string') {\n    return (raw as string[]).join(' OR ');\n  }\n  return undefined;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAgBxB,eAAsB,sBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,iCAAiC,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAChH,WAAO,CAAC;AAAA,EACV;AAGA,MAAI;AACJ,MAAI;AACF,eAAW,KAAK,MAAM,OAAO;AAAA,EAC/B,SAAS,KAAK;AACZ,+BAAQ,0CAA0C,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AACzH,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,mBAAmB,qBAAqB,WAAW;AAGzD,QAAM,UAAU,uBAAuB,QAAQ;AAE/C,QAAM,eAAmC,CAAC;AAG1C,QAAM,WAAqE;AAAA,IACzE,EAAE,KAAK,WAAW,OAAO,aAAa;AAAA,IACtC,EAAE,KAAK,eAAe,OAAO,cAAc;AAAA,EAC7C;AAEA,aAAW,EAAE,KAAK,MAAM,KAAK,UAAU;AACrC,UAAM,UAAU,SAAS,GAAG;AAC5B,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG;AAEvE,eAAW,CAAC,SAAS,iBAAiB,KAAK,OAAO,QAAQ,OAAkC,GAAG;AAE7F,UAAI,gBAAgB,OAAO,EAAG;AAE9B,UAAI,OAAO,sBAAsB,UAAU;AACzC,mCAAQ,0CAA0C,OAAO,QAAQ,gBAAgB,kBAAa;AAC9F;AAAA,MACF;AAEA,UAAI,CAAC,mBAAmB,OAAO,GAAG;AAChC,mCAAQ,wCAAwC,OAAO,QAAQ,gBAAgB,kBAAa;AAC5F;AAAA,MACF;AAEA,YAAM,kBAAkB,iBAAiB,IAAI,QAAQ,YAAY,CAAC;AAClE,mBAAa,KAAK;AAAA,QAChB,MAAM;AAAA,QACN,oBAAoB;AAAA,QACpB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,gBAAgB,MAAuB;AAC9C,MAAI,SAAS,MAAO,QAAO;AAC3B,MAAI,KAAK,WAAW,MAAM,EAAG,QAAO;AACpC,MAAI,SAAS,WAAY,QAAO;AAChC,SAAO;AACT;AAMA,SAAS,mBAAmB,MAAuB;AACjD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,MAAI,KAAK,SAAS,IAAK,QAAO;AAE9B,SAAO,iDAAiD,KAAK,IAAI;AACnE;AAeA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,MAA0B,oBAAI,IAAI;AAExC,QAAM,WAAW,KAAK,KAAK,aAAa,eAAe;AACvD,MAAI,CAAC,GAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,cAAc,GAAG,aAAa,UAAU,MAAM;AACpD,4BAAwB,aAAa,GAAG;AAAA,EAC1C,SAAS,KAAK;AACZ,+BAAQ,iDAAiD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EAC7G;AAEA,SAAO;AACT;AAQA,SAAS,wBAAwB,SAAiB,KAA+B;AAC/E,MAAI;AACJ,MAAI;AACF,eAAW,KAAK,MAAM,OAAO;AAAA,EAC/B,QAAQ;AACN,+BAAQ,qFAAgF;AACxF;AAAA,EACF;AAEA,QAAM,SAAS,CAAC,SAAS,UAAU,GAAG,SAAS,cAAc,CAAC;AAC9D,aAAW,OAAO,QAAQ;AACxB,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,eAAW,SAAS,KAAK;AACvB,UAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,YAAM,MAAM;AACZ,YAAM,OAAO,OAAO,IAAI,MAAM,MAAM,WAAW,IAAI,MAAM,EAAE,YAAY,IAAI;AAC3E,YAAM,UAAU,OAAO,IAAI,SAAS,MAAM,WAAW,IAAI,SAAS,IAAI;AACtE,UAAI,QAAQ,SAAS;AAEnB,cAAM,aAAa,QAAQ,WAAW,GAAG,IAAI,QAAQ,MAAM,CAAC,IAAI;AAChE,YAAI,CAAC,IAAI,IAAI,IAAI,GAAG;AAClB,cAAI,IAAI,MAAM,UAAU;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAMA,SAAS,uBAAuB,UAAuD;AACrF,QAAM,MAAM,SAAS,SAAS;AAC9B,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,MAAM,IAAI;AAChD,WAAO,IAAI,KAAK;AAAA,EAClB;AACA,MAAI,MAAM,QAAQ,GAAG,KAAK,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,MAAM,UAAU;AACtE,WAAQ,IAAiB,KAAK,MAAM;AAAA,EACtC;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/security/manifest/plugins/go.d.ts

@@ -0,0 +1,12 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a go.mod manifest and extract dependency declarations with version
+ * information. In Go modules, the version declared in go.mod is the resolved
+ * version (pinned), so declaredConstraint and resolvedVersion are the same.
+ *
+ * @param manifestPath - Absolute path to the go.mod file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version information
+ */
+export declare function parseGoManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=go.d.ts.map

package/dist/security/manifest/plugins/go.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/go.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA0C7B"}

package/dist/security/manifest/plugins/go.js

@@ -0,0 +1,146 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var go_exports = {};
+__export(go_exports, {
+  parseGoManifest: () => parseGoManifest
+});
+module.exports = __toCommonJS(go_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+async function parseGoManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:go] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const goSumHashes = loadGoSumHashes(manifestDir);
+  const dependencies = [];
+  const requireBlockRegex = /require\s*\(([^)]*)\)/gs;
+  let blockMatch;
+  while ((blockMatch = requireBlockRegex.exec(content)) !== null) {
+    const blockContent = blockMatch[1];
+    parseRequireLines(blockContent, relativeManifest, goSumHashes, dependencies);
+  }
+  const lines = content.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    const singleRequireMatch = trimmed.match(/^require\s+(\S+)\s+(\S+)/);
+    if (singleRequireMatch) {
+      const modulePath = singleRequireMatch[1];
+      const version = singleRequireMatch[2];
+      addDependency(modulePath, version, relativeManifest, goSumHashes, dependencies);
+    }
+  }
+  return dependencies;
+}
+function parseRequireLines(blockContent, relativeManifest, goSumHashes, dependencies) {
+  const lines = blockContent.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    const match = trimmed.match(/^(\S+)\s+(\S+)/);
+    if (match) {
+      const modulePath = match[1];
+      const version = match[2];
+      if (modulePath.startsWith("//")) continue;
+      addDependency(modulePath, version, relativeManifest, goSumHashes, dependencies);
+    }
+  }
+}
+function addDependency(modulePath, version, relativeManifest, goSumHashes, dependencies) {
+  if (!isValidGoModulePath(modulePath)) {
+    (0, import_errors.logWarn)(`[sec:go] Invalid module path "${modulePath}" in ${relativeManifest} \u2014 skipping`);
+    return;
+  }
+  if (!isValidGoVersion(version)) {
+    (0, import_errors.logWarn)(`[sec:go] Invalid version "${version}" for module "${modulePath}" in ${relativeManifest} \u2014 skipping`);
+    return;
+  }
+  const hasIntegrity = goSumHashes.has(`${modulePath}@${version}`);
+  dependencies.push({
+    name: modulePath,
+    declaredConstraint: version,
+    resolvedVersion: version,
+    scope: "production",
+    // Go doesn't have dev dependencies in go.mod
+    ecosystem: "go",
+    sourceManifest: relativeManifest
+  });
+}
+function loadGoSumHashes(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const goSumPath = path.join(manifestDir, "go.sum");
+  if (!fs.existsSync(goSumPath)) {
+    return map;
+  }
+  try {
+    const content = fs.readFileSync(goSumPath, "utf8");
+    const lines = content.split("\n");
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const parts = trimmed.split(/\s+/);
+      if (parts.length >= 3) {
+        const modulePath = parts[0];
+        let version = parts[1];
+        version = version.replace(/\/go\.mod$/, "");
+        map.set(`${modulePath}@${version}`, true);
+      }
+    }
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:go] Failed to read go.sum: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function isValidGoModulePath(modulePath) {
+  if (!modulePath || typeof modulePath !== "string") return false;
+  if (modulePath.includes(" ") || modulePath.includes("	")) return false;
+  const firstSlash = modulePath.indexOf("/");
+  const firstElement = firstSlash === -1 ? modulePath : modulePath.slice(0, firstSlash);
+  if (!firstElement.includes(".")) return false;
+  return true;
+}
+function isValidGoVersion(version) {
+  if (!version || typeof version !== "string") return false;
+  if (!version.startsWith("v")) return false;
+  const versionBody = version.slice(1);
+  if (!versionBody) return false;
+  const semverPattern = /^\d+\.\d+\.\d+/;
+  return semverPattern.test(versionBody);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseGoManifest
+});
+//# sourceMappingURL=go.js.map

package/dist/security/manifest/plugins/go.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/go.ts"],
+  "sourcesContent": ["/**\n * Go Version Extraction Plugin for KiroGraph-Sec\n *\n * Extends the existing architecture go parser to extract version constraints\n * and resolved versions from go.mod and go.sum for security analysis.\n *\n * Reuses `goParser` from `src/architecture/manifest/go.ts` for discovery and\n * basic parsing, then layers on version extraction.\n *\n * In Go modules, the version in go.mod IS the resolved version (go.mod is\n * effectively a lock file). go.sum provides integrity hashes but the version\n * source of truth is go.mod itself. All Go dependencies are scope \"production\"\n * since Go doesn't have dev dependencies in go.mod.\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Parse a go.mod manifest and extract dependency declarations with version\n * information. In Go modules, the version declared in go.mod is the resolved\n * version (pinned), so declaredConstraint and resolvedVersion are the same.\n *\n * @param manifestPath - Absolute path to the go.mod file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version information\n */\nexport async function parseGoManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read go.mod content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:go] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Load go.sum for integrity verification (optional)\n  const goSumHashes = loadGoSumHashes(manifestDir);\n\n  // Extract dependencies from require directives\n  const dependencies: ParsedDependency[] = [];\n\n  // Parse require block: require ( ... )\n  const requireBlockRegex = /require\\s*\\(([^)]*)\\)/gs;\n  let blockMatch: RegExpExecArray | null;\n  while ((blockMatch = requireBlockRegex.exec(content)) !== null) {\n    const blockContent = blockMatch[1];\n    parseRequireLines(blockContent, relativeManifest, goSumHashes, dependencies);\n  }\n\n  // Parse single-line require directives: require module/path v1.2.3\n  const lines = content.split('\\n');\n  for (const line of lines) {\n    const trimmed = line.trim();\n    // Skip lines inside require blocks (already handled above)\n    // Match: require <module> <version>\n    const singleRequireMatch = trimmed.match(/^require\\s+(\\S+)\\s+(\\S+)/);\n    if (singleRequireMatch) {\n      const modulePath = singleRequireMatch[1];\n      const version = singleRequireMatch[2];\n      addDependency(modulePath, version, relativeManifest, goSumHashes, dependencies);\n    }\n  }\n\n  return dependencies;\n}\n\n/**\n * Parse lines within a require block and extract module paths and versions.\n */\nfunction parseRequireLines(\n  blockContent: string,\n  relativeManifest: string,\n  goSumHashes: GoSumMap,\n  dependencies: ParsedDependency[],\n): void {\n  const lines = blockContent.split('\\n');\n  for (const line of lines) {\n    const trimmed = line.trim();\n\n    // Skip empty lines and comments\n    if (!trimmed || trimmed.startsWith('//')) continue;\n\n    // Match: module/path v1.2.3 [// indirect]\n    const match = trimmed.match(/^(\\S+)\\s+(\\S+)/);\n    if (match) {\n      const modulePath = match[1];\n      const version = match[2];\n\n      // Skip if the \"module path\" is actually a comment\n      if (modulePath.startsWith('//')) continue;\n\n      addDependency(modulePath, version, relativeManifest, goSumHashes, dependencies);\n    }\n  }\n}\n\n/**\n * Add a single dependency entry after validation.\n */\nfunction addDependency(\n  modulePath: string,\n  version: string,\n  relativeManifest: string,\n  goSumHashes: GoSumMap,\n  dependencies: ParsedDependency[],\n): void {\n  // Validate module path\n  if (!isValidGoModulePath(modulePath)) {\n    logWarn(`[sec:go] Invalid module path \"${modulePath}\" in ${relativeManifest} \u2014 skipping`);\n    return;\n  }\n\n  // Validate version format (should start with 'v' for Go modules)\n  if (!isValidGoVersion(version)) {\n    logWarn(`[sec:go] Invalid version \"${version}\" for module \"${modulePath}\" in ${relativeManifest} \u2014 skipping`);\n    return;\n  }\n\n  // Check if this module+version has integrity info in go.sum\n  const hasIntegrity = goSumHashes.has(`${modulePath}@${version}`);\n\n  // In Go, the version in go.mod is the resolved version\n  // declaredConstraint and resolvedVersion are the same\n  dependencies.push({\n    name: modulePath,\n    declaredConstraint: version,\n    resolvedVersion: version,\n    scope: 'production', // Go doesn't have dev dependencies in go.mod\n    ecosystem: 'go',\n    sourceManifest: relativeManifest,\n  });\n}\n\n/**\n * Map of module@version \u2192 true, indicating presence in go.sum.\n * Used for integrity verification awareness.\n */\ntype GoSumMap = Map<string, boolean>;\n\n/**\n * Load go.sum hashes from the same directory as go.mod.\n * go.sum contains lines like:\n *   module/path v1.2.3 h1:hash...\n *   module/path v1.2.3/go.mod h1:hash...\n */\nfunction loadGoSumHashes(manifestDir: string): GoSumMap {\n  const map: GoSumMap = new Map();\n  const goSumPath = path.join(manifestDir, 'go.sum');\n\n  if (!fs.existsSync(goSumPath)) {\n    return map;\n  }\n\n  try {\n    const content = fs.readFileSync(goSumPath, 'utf8');\n    const lines = content.split('\\n');\n\n    for (const line of lines) {\n      const trimmed = line.trim();\n      if (!trimmed) continue;\n\n      // Format: module/path version hash\n      // e.g.: github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqFPSKw=\n      const parts = trimmed.split(/\\s+/);\n      if (parts.length >= 3) {\n        const modulePath = parts[0];\n        let version = parts[1];\n        // Strip /go.mod suffix from version if present\n        version = version.replace(/\\/go\\.mod$/, '');\n        map.set(`${modulePath}@${version}`, true);\n      }\n    }\n  } catch (err) {\n    logWarn(`[sec:go] Failed to read go.sum: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  return map;\n}\n\n/**\n * Validate a Go module path.\n * A valid module path must contain at least one dot in the first path element\n * (domain requirement) and consist of valid characters.\n */\nfunction isValidGoModulePath(modulePath: string): boolean {\n  if (!modulePath || typeof modulePath !== 'string') return false;\n\n  // Must not be empty or contain spaces\n  if (modulePath.includes(' ') || modulePath.includes('\\t')) return false;\n\n  // First path element must contain a dot (domain name requirement)\n  const firstSlash = modulePath.indexOf('/');\n  const firstElement = firstSlash === -1 ? modulePath : modulePath.slice(0, firstSlash);\n  if (!firstElement.includes('.')) return false;\n\n  return true;\n}\n\n/**\n * Validate a Go module version string.\n * Valid formats: v1.2.3, v0.0.0-timestamp-hash, v1.2.3-pre, v1.2.3+incompatible\n */\nfunction isValidGoVersion(version: string): boolean {\n  if (!version || typeof version !== 'string') return false;\n\n  // Must start with 'v'\n  if (!version.startsWith('v')) return false;\n\n  // Basic semver-like check after 'v': at minimum \"vX.Y.Z\" or pseudo-version\n  const versionBody = version.slice(1);\n  if (!versionBody) return false;\n\n  // Allow semver, pseudo-versions, and +incompatible suffix\n  // Pseudo-version format: v0.0.0-20230101120000-abcdef123456\n  const semverPattern = /^\\d+\\.\\d+\\.\\d+/;\n  return semverPattern.test(versionBody);\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAWxB,eAAsB,gBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,2BAA2B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC1G,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,cAAc,gBAAgB,WAAW;AAG/C,QAAM,eAAmC,CAAC;AAG1C,QAAM,oBAAoB;AAC1B,MAAI;AACJ,UAAQ,aAAa,kBAAkB,KAAK,OAAO,OAAO,MAAM;AAC9D,UAAM,eAAe,WAAW,CAAC;AACjC,sBAAkB,cAAc,kBAAkB,aAAa,YAAY;AAAA,EAC7E;AAGA,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAG1B,UAAM,qBAAqB,QAAQ,MAAM,0BAA0B;AACnE,QAAI,oBAAoB;AACtB,YAAM,aAAa,mBAAmB,CAAC;AACvC,YAAM,UAAU,mBAAmB,CAAC;AACpC,oBAAc,YAAY,SAAS,kBAAkB,aAAa,YAAY;AAAA,IAChF;AAAA,EACF;AAEA,SAAO;AACT;AAKA,SAAS,kBACP,cACA,kBACA,aACA,cACM;AACN,QAAM,QAAQ,aAAa,MAAM,IAAI;AACrC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAG1B,QAAI,CAAC,WAAW,QAAQ,WAAW,IAAI,EAAG;AAG1C,UAAM,QAAQ,QAAQ,MAAM,gBAAgB;AAC5C,QAAI,OAAO;AACT,YAAM,aAAa,MAAM,CAAC;AAC1B,YAAM,UAAU,MAAM,CAAC;AAGvB,UAAI,WAAW,WAAW,IAAI,EAAG;AAEjC,oBAAc,YAAY,SAAS,kBAAkB,aAAa,YAAY;AAAA,IAChF;AAAA,EACF;AACF;AAKA,SAAS,cACP,YACA,SACA,kBACA,aACA,cACM;AAEN,MAAI,CAAC,oBAAoB,UAAU,GAAG;AACpC,+BAAQ,iCAAiC,UAAU,QAAQ,gBAAgB,kBAAa;AACxF;AAAA,EACF;AAGA,MAAI,CAAC,iBAAiB,OAAO,GAAG;AAC9B,+BAAQ,6BAA6B,OAAO,iBAAiB,UAAU,QAAQ,gBAAgB,kBAAa;AAC5G;AAAA,EACF;AAGA,QAAM,eAAe,YAAY,IAAI,GAAG,UAAU,IAAI,OAAO,EAAE;AAI/D,eAAa,KAAK;AAAA,IAChB,MAAM;AAAA,IACN,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,IACjB,OAAO;AAAA;AAAA,IACP,WAAW;AAAA,IACX,gBAAgB;AAAA,EAClB,CAAC;AACH;AAcA,SAAS,gBAAgB,aAA+B;AACtD,QAAM,MAAgB,oBAAI,IAAI;AAC9B,QAAM,YAAY,KAAK,KAAK,aAAa,QAAQ;AAEjD,MAAI,CAAC,GAAG,WAAW,SAAS,GAAG;AAC7B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,UAAU,GAAG,aAAa,WAAW,MAAM;AACjD,UAAM,QAAQ,QAAQ,MAAM,IAAI;AAEhC,eAAW,QAAQ,OAAO;AACxB,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,CAAC,QAAS;AAId,YAAM,QAAQ,QAAQ,MAAM,KAAK;AACjC,UAAI,MAAM,UAAU,GAAG;AACrB,cAAM,aAAa,MAAM,CAAC;AAC1B,YAAI,UAAU,MAAM,CAAC;AAErB,kBAAU,QAAQ,QAAQ,cAAc,EAAE;AAC1C,YAAI,IAAI,GAAG,UAAU,IAAI,OAAO,IAAI,IAAI;AAAA,MAC1C;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,+BAAQ,mCAAmC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EAC/F;AAEA,SAAO;AACT;AAOA,SAAS,oBAAoB,YAA6B;AACxD,MAAI,CAAC,cAAc,OAAO,eAAe,SAAU,QAAO;AAG1D,MAAI,WAAW,SAAS,GAAG,KAAK,WAAW,SAAS,GAAI,EAAG,QAAO;AAGlE,QAAM,aAAa,WAAW,QAAQ,GAAG;AACzC,QAAM,eAAe,eAAe,KAAK,aAAa,WAAW,MAAM,GAAG,UAAU;AACpF,MAAI,CAAC,aAAa,SAAS,GAAG,EAAG,QAAO;AAExC,SAAO;AACT;AAMA,SAAS,iBAAiB,SAA0B;AAClD,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AAGpD,MAAI,CAAC,QAAQ,WAAW,GAAG,EAAG,QAAO;AAGrC,QAAM,cAAc,QAAQ,MAAM,CAAC;AACnC,MAAI,CAAC,YAAa,QAAO;AAIzB,QAAM,gBAAgB;AACtB,SAAO,cAAc,KAAK,WAAW;AACvC;",
+  "names": []
+}

package/dist/security/manifest/plugins/gradle.d.ts

@@ -0,0 +1,12 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a Gradle build script (`build.gradle` or `build.gradle.kts`) and extract
+ * dependency declarations with version constraints, scopes, and resolved versions
+ * from `gradle.lockfile`.
+ *
+ * @param manifestPath - Absolute path to the build.gradle or build.gradle.kts file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseGradleManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=gradle.d.ts.map

package/dist/security/manifest/plugins/gradle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gradle.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/gradle.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA0CpD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAmD7B"}

package/dist/security/manifest/plugins/gradle.js

@@ -0,0 +1,159 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var gradle_exports = {};
+__export(gradle_exports, {
+  parseGradleManifest: () => parseGradleManifest
+});
+module.exports = __toCommonJS(gradle_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+const TEST_CONFIGURATIONS = /* @__PURE__ */ new Set([
+  "testimplementation",
+  "testapi",
+  "testcompile",
+  "testruntimeonly",
+  "androidtestimplementation",
+  "androidtestapi"
+]);
+const KNOWN_CONFIGURATIONS = [
+  "androidTestImplementation",
+  "androidTestApi",
+  "debugImplementation",
+  "releaseImplementation",
+  "testImplementation",
+  "testRuntimeOnly",
+  "testCompile",
+  "testApi",
+  "implementation",
+  "runtimeOnly",
+  "compileOnly",
+  "compile",
+  "api"
+];
+async function parseGradleManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:gradle] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const dependencies = [];
+  const configPattern = KNOWN_CONFIGURATIONS.map((c) => escapeRegex(c)).join("|");
+  const depRegex = new RegExp(
+    `^\\s*(${configPattern})\\s*\\(?\\s*["']([^"']+)["']\\s*\\)?`,
+    "gmi"
+  );
+  let match;
+  while ((match = depRegex.exec(content)) !== null) {
+    const configuration = match[1];
+    const notation = match[2].trim();
+    const dep = parseGradleNotation(notation, configuration, relativeManifest);
+    if (!dep) continue;
+    const lookupKey = `${dep.group}:${dep.artifact}`.toLowerCase();
+    const resolvedVersion = resolvedVersions.get(lookupKey);
+    dependencies.push({
+      name: `${dep.group}:${dep.artifact}`,
+      declaredConstraint: dep.version,
+      resolvedVersion,
+      scope: resolveScope(configuration),
+      ecosystem: "gradle",
+      sourceManifest: relativeManifest
+    });
+  }
+  return dependencies;
+}
+function parseGradleNotation(notation, configuration, relativeManifest) {
+  if (notation.startsWith("libs.") || notation.startsWith("libs(")) {
+    return null;
+  }
+  const parts = notation.split(":");
+  if (parts.length < 2) {
+    return null;
+  }
+  const group = parts[0].trim();
+  const artifact = parts[1].trim();
+  const version = parts.length >= 3 ? parts[2].trim() : "";
+  if (!group || !artifact) {
+    (0, import_errors.logWarn)(`[sec:gradle] Empty group or artifact in notation "${notation}" (${configuration}) at ${relativeManifest} \u2014 skipping`);
+    return null;
+  }
+  const normalizedVersion = version === "" || version === "+" || version.toLowerCase() === "latest.release" ? "*" : version;
+  return { group, artifact, version: normalizedVersion };
+}
+function resolveScope(configuration) {
+  return TEST_CONFIGURATIONS.has(configuration.toLowerCase()) ? "development" : "production";
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const lockPath = path.join(manifestDir, "gradle.lockfile");
+  if (!fs.existsSync(lockPath)) {
+    return map;
+  }
+  try {
+    const content = fs.readFileSync(lockPath, "utf8");
+    extractFromGradleLockfile(content, map);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:gradle] Failed to parse gradle.lockfile: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function extractFromGradleLockfile(content, map) {
+  const lines = content.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    if (trimmed === "empty=") continue;
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex === -1) continue;
+    const coordinate = trimmed.slice(0, eqIndex).trim();
+    const parts = coordinate.split(":");
+    if (parts.length < 3) continue;
+    const group = parts[0].trim();
+    const artifact = parts[1].trim();
+    const version = parts[2].trim();
+    if (!group || !artifact || !version) continue;
+    const key = `${group}:${artifact}`.toLowerCase();
+    if (!map.has(key)) {
+      map.set(key, version);
+    }
+  }
+}
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseGradleManifest
+});
+//# sourceMappingURL=gradle.js.map