kirograph 0.17.0 → 0.20.0

package/dist/security/manifest/plugins/pip.js

@@ -0,0 +1,123 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var pip_exports = {};
+__export(pip_exports, {
+  parsePipManifest: () => parsePipManifest
+});
+module.exports = __toCommonJS(pip_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+const PIP_OPTION_PREFIXES = ["-r", "-c", "-e", "--index-url", "--extra-index-url"];
+const REQUIREMENT_REGEX = /^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)(\[.*?\])?\s*(.*)/;
+const VERSION_OPERATOR_REGEX = /^(~=|===|==|!=|>=|<=|>|<)/;
+async function parsePipManifest(manifestPath, projectRoot) {
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:pip] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const dependencies = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const rawLine = lines[i];
+    const line = stripInlineComment(rawLine).trim();
+    if (line === "") continue;
+    if (line.startsWith("#")) continue;
+    if (isPipOption(line)) continue;
+    const withoutMarker = stripEnvironmentMarker(line);
+    const parsed = parseRequirementLine(withoutMarker, i + 1, relativeManifest);
+    if (parsed) {
+      dependencies.push(parsed);
+    }
+  }
+  return dependencies;
+}
+function stripInlineComment(line) {
+  const commentIndex = line.search(/\s#/);
+  if (commentIndex !== -1) {
+    return line.slice(0, commentIndex);
+  }
+  return line;
+}
+function isPipOption(line) {
+  for (const prefix of PIP_OPTION_PREFIXES) {
+    if (line.startsWith(prefix)) return true;
+  }
+  return false;
+}
+function stripEnvironmentMarker(line) {
+  const semicolonIndex = line.indexOf(";");
+  if (semicolonIndex !== -1) {
+    return line.slice(0, semicolonIndex).trim();
+  }
+  return line;
+}
+function parseRequirementLine(line, lineNumber, relativeManifest) {
+  const match = line.match(REQUIREMENT_REGEX);
+  if (!match) {
+    (0, import_errors.logWarn)(`[sec:pip] Could not parse line ${lineNumber} in ${relativeManifest}: "${line}"`);
+    return null;
+  }
+  const name = match[1];
+  const constraintPart = (match[4] ?? "").trim();
+  let declaredConstraint = "";
+  let resolvedVersion;
+  if (constraintPart !== "") {
+    if (!VERSION_OPERATOR_REGEX.test(constraintPart)) {
+      (0, import_errors.logWarn)(`[sec:pip] Invalid version constraint for "${name}" at line ${lineNumber} in ${relativeManifest}: "${constraintPart}"`);
+      return null;
+    }
+    declaredConstraint = constraintPart;
+    const exactMatch = constraintPart.match(/^==\s*([^\s,]+)/);
+    if (exactMatch) {
+      resolvedVersion = exactMatch[1];
+    }
+  }
+  return {
+    name: normalizePackageName(name),
+    declaredConstraint,
+    resolvedVersion,
+    scope: "production",
+    // requirements.txt doesn't distinguish scopes
+    ecosystem: "pypi",
+    sourceManifest: relativeManifest
+  };
+}
+function normalizePackageName(name) {
+  return name.toLowerCase().replace(/[-_.]+/g, "-");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parsePipManifest
+});
+//# sourceMappingURL=pip.js.map

package/dist/security/manifest/plugins/pip.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/pip.ts"],
+  "sourcesContent": ["/**\n * Pip Version Extraction Plugin for KiroGraph-Sec\n *\n * Extends the existing architecture python parser to extract version constraints\n * and resolved versions from requirements.txt files for security analysis.\n *\n * Reuses `pythonParser` from `src/architecture/manifest/python.ts` for discovery.\n * Parses requirements.txt line by line to extract package names and version constraints.\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Lines starting with these prefixes are pip options, not package declarations.\n */\nconst PIP_OPTION_PREFIXES = ['-r', '-c', '-e', '--index-url', '--extra-index-url'];\n\n/**\n * Regex to parse a pip requirement line.\n * Captures: package name, optional version constraint (operator + version).\n * Examples:\n *   flask==2.3.0       \u2192 name=\"flask\", constraint=\"==2.3.0\"\n *   requests>=2.28     \u2192 name=\"requests\", constraint=\">=2.28\"\n *   django~=4.2        \u2192 name=\"django\", constraint=\"~=4.2\"\n *   numpy              \u2192 name=\"numpy\", constraint=\"\"\n *   package[extra]>=1  \u2192 name=\"package\", constraint=\">=1\"\n */\nconst REQUIREMENT_REGEX = /^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)(\\[.*?\\])?\\s*(.*)/;\n\n/**\n * Regex to match a version constraint operator at the start of a string.\n */\nconst VERSION_OPERATOR_REGEX = /^(~=|===|==|!=|>=|<=|>|<)/;\n\n/**\n * Parse a pip requirements.txt manifest and extract dependency declarations\n * with version constraints.\n *\n * @param manifestPath - Absolute path to the requirements.txt file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parsePipManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read the requirements.txt file\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:pip] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  const dependencies: ParsedDependency[] = [];\n  const lines = content.split('\\n');\n\n  for (let i = 0; i < lines.length; i++) {\n    const rawLine = lines[i];\n    // Strip inline comments and trim whitespace\n    const line = stripInlineComment(rawLine).trim();\n\n    // Skip empty lines\n    if (line === '') continue;\n\n    // Skip comment lines\n    if (line.startsWith('#')) continue;\n\n    // Skip pip option lines\n    if (isPipOption(line)) continue;\n\n    // Strip environment markers (e.g. \"; sys_platform == 'win32'\")\n    const withoutMarker = stripEnvironmentMarker(line);\n\n    // Parse the requirement\n    const parsed = parseRequirementLine(withoutMarker, i + 1, relativeManifest);\n    if (parsed) {\n      dependencies.push(parsed);\n    }\n  }\n\n  return dependencies;\n}\n\n/**\n * Strip inline comments from a line.\n * Inline comments in requirements.txt start with # preceded by whitespace.\n */\nfunction stripInlineComment(line: string): string {\n  // Match # that is preceded by whitespace (not part of a URL or version)\n  const commentIndex = line.search(/\\s#/);\n  if (commentIndex !== -1) {\n    return line.slice(0, commentIndex);\n  }\n  return line;\n}\n\n/**\n * Check if a line is a pip option (not a package declaration).\n */\nfunction isPipOption(line: string): boolean {\n  for (const prefix of PIP_OPTION_PREFIXES) {\n    if (line.startsWith(prefix)) return true;\n  }\n  return false;\n}\n\n/**\n * Strip environment markers from a requirement line.\n * Environment markers follow a semicolon, e.g.:\n *   pywin32; sys_platform == \"win32\"\n *   colorama>=0.4; os_name == \"nt\"\n */\nfunction stripEnvironmentMarker(line: string): string {\n  const semicolonIndex = line.indexOf(';');\n  if (semicolonIndex !== -1) {\n    return line.slice(0, semicolonIndex).trim();\n  }\n  return line;\n}\n\n/**\n * Parse a single requirement line into a ParsedDependency.\n * Returns null if the line cannot be parsed (logs a warning).\n */\nfunction parseRequirementLine(\n  line: string,\n  lineNumber: number,\n  relativeManifest: string,\n): ParsedDependency | null {\n  const match = line.match(REQUIREMENT_REGEX);\n  if (!match) {\n    logWarn(`[sec:pip] Could not parse line ${lineNumber} in ${relativeManifest}: \"${line}\"`);\n    return null;\n  }\n\n  const name = match[1];\n  const constraintPart = (match[4] ?? '').trim();\n\n  // Validate that the constraint part, if present, starts with a valid operator\n  let declaredConstraint = '';\n  let resolvedVersion: string | undefined;\n\n  if (constraintPart !== '') {\n    if (!VERSION_OPERATOR_REGEX.test(constraintPart)) {\n      logWarn(`[sec:pip] Invalid version constraint for \"${name}\" at line ${lineNumber} in ${relativeManifest}: \"${constraintPart}\"`);\n      return null;\n    }\n    declaredConstraint = constraintPart;\n\n    // If the constraint uses ==, the resolved version is the exact version\n    const exactMatch = constraintPart.match(/^==\\s*([^\\s,]+)/);\n    if (exactMatch) {\n      resolvedVersion = exactMatch[1];\n    }\n  }\n\n  return {\n    name: normalizePackageName(name),\n    declaredConstraint,\n    resolvedVersion,\n    scope: 'production', // requirements.txt doesn't distinguish scopes\n    ecosystem: 'pypi',\n    sourceManifest: relativeManifest,\n  };\n}\n\n/**\n * Normalize a Python package name following PEP 503:\n * lowercase and replace any run of underscores, hyphens, or periods with a single hyphen.\n */\nfunction normalizePackageName(name: string): string {\n  return name.toLowerCase().replace(/[-_.]+/g, '-');\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAKxB,MAAM,sBAAsB,CAAC,MAAM,MAAM,MAAM,eAAe,mBAAmB;AAYjF,MAAM,oBAAoB;AAK1B,MAAM,yBAAyB;AAU/B,eAAsB,iBACpB,cACA,aAC6B;AAC7B,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,4BAA4B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC3G,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,eAAmC,CAAC;AAC1C,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAEhC,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,UAAU,MAAM,CAAC;AAEvB,UAAM,OAAO,mBAAmB,OAAO,EAAE,KAAK;AAG9C,QAAI,SAAS,GAAI;AAGjB,QAAI,KAAK,WAAW,GAAG,EAAG;AAG1B,QAAI,YAAY,IAAI,EAAG;AAGvB,UAAM,gBAAgB,uBAAuB,IAAI;AAGjD,UAAM,SAAS,qBAAqB,eAAe,IAAI,GAAG,gBAAgB;AAC1E,QAAI,QAAQ;AACV,mBAAa,KAAK,MAAM;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,mBAAmB,MAAsB;AAEhD,QAAM,eAAe,KAAK,OAAO,KAAK;AACtC,MAAI,iBAAiB,IAAI;AACvB,WAAO,KAAK,MAAM,GAAG,YAAY;AAAA,EACnC;AACA,SAAO;AACT;AAKA,SAAS,YAAY,MAAuB;AAC1C,aAAW,UAAU,qBAAqB;AACxC,QAAI,KAAK,WAAW,MAAM,EAAG,QAAO;AAAA,EACtC;AACA,SAAO;AACT;AAQA,SAAS,uBAAuB,MAAsB;AACpD,QAAM,iBAAiB,KAAK,QAAQ,GAAG;AACvC,MAAI,mBAAmB,IAAI;AACzB,WAAO,KAAK,MAAM,GAAG,cAAc,EAAE,KAAK;AAAA,EAC5C;AACA,SAAO;AACT;AAMA,SAAS,qBACP,MACA,YACA,kBACyB;AACzB,QAAM,QAAQ,KAAK,MAAM,iBAAiB;AAC1C,MAAI,CAAC,OAAO;AACV,+BAAQ,kCAAkC,UAAU,OAAO,gBAAgB,MAAM,IAAI,GAAG;AACxF,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,MAAM,CAAC;AACpB,QAAM,kBAAkB,MAAM,CAAC,KAAK,IAAI,KAAK;AAG7C,MAAI,qBAAqB;AACzB,MAAI;AAEJ,MAAI,mBAAmB,IAAI;AACzB,QAAI,CAAC,uBAAuB,KAAK,cAAc,GAAG;AAChD,iCAAQ,6CAA6C,IAAI,aAAa,UAAU,OAAO,gBAAgB,MAAM,cAAc,GAAG;AAC9H,aAAO;AAAA,IACT;AACA,yBAAqB;AAGrB,UAAM,aAAa,eAAe,MAAM,iBAAiB;AACzD,QAAI,YAAY;AACd,wBAAkB,WAAW,CAAC;AAAA,IAChC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,qBAAqB,IAAI;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,OAAO;AAAA;AAAA,IACP,WAAW;AAAA,IACX,gBAAgB;AAAA,EAClB;AACF;AAMA,SAAS,qBAAqB,MAAsB;AAClD,SAAO,KAAK,YAAY,EAAE,QAAQ,WAAW,GAAG;AAClD;",
+  "names": []
+}

package/dist/security/manifest/plugins/pubspec.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a pubspec.yaml manifest and extract package declarations with
+ * version constraints, scopes, and resolved versions from pubspec.lock.
+ *
+ * @param manifestPath - Absolute path to the pubspec.yaml file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parsePubspecManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=pubspec.d.ts.map

package/dist/security/manifest/plugins/pubspec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pubspec.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/pubspec.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA4C7B"}

package/dist/security/manifest/plugins/pubspec.js

@@ -0,0 +1,212 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var pubspec_exports = {};
+__export(pubspec_exports, {
+  parsePubspecManifest: () => parsePubspecManifest
+});
+module.exports = __toCommonJS(pubspec_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+async function parsePubspecManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:pub] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const resolvedVersions = loadResolvedVersions(manifestDir);
+  const license = extractPubspecLicense(content);
+  const dependencies = [];
+  const sections = [
+    { key: "dependencies", scope: "production" },
+    { key: "dev_dependencies", scope: "development" }
+  ];
+  for (const { key, scope } of sections) {
+    const sectionDeps = extractSectionDependencies(content, key, relativeManifest);
+    for (const dep of sectionDeps) {
+      const resolvedVersion = resolvedVersions.get(dep.name);
+      dependencies.push({
+        name: dep.name,
+        declaredConstraint: dep.constraint,
+        resolvedVersion,
+        scope,
+        ecosystem: "pub",
+        sourceManifest: relativeManifest,
+        ...license !== void 0 ? { license } : {}
+      });
+    }
+  }
+  return dependencies;
+}
+function extractSectionDependencies(content, sectionKey, relativeManifest) {
+  const deps = [];
+  const lines = content.split("\n");
+  const headerPattern = new RegExp(`^${escapeRegex(sectionKey)}\\s*:\\s*$`);
+  let inSection = false;
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    const trimmed = line.trimEnd();
+    if (!inSection) {
+      if (headerPattern.test(trimmed)) {
+        inSection = true;
+      }
+      i++;
+      continue;
+    }
+    if (trimmed !== "" && !/^\s/.test(trimmed)) {
+      break;
+    }
+    if (trimmed === "") {
+      i++;
+      continue;
+    }
+    const entryMatch = trimmed.match(/^  ([a-zA-Z0-9_][a-zA-Z0-9_.-]*):\s*(.*)$/);
+    if (!entryMatch) {
+      i++;
+      continue;
+    }
+    const pkgName = entryMatch[1];
+    const valueOnSameLine = entryMatch[2].trim();
+    const nextLine = i + 1 < lines.length ? lines[i + 1] : "";
+    const isBlockMapping = nextLine !== "" && /^    \S/.test(nextLine);
+    if (isBlockMapping) {
+      i++;
+      while (i < lines.length) {
+        const subLine = lines[i];
+        if (subLine.trimEnd() === "" || /^    /.test(subLine)) {
+          i++;
+        } else {
+          break;
+        }
+      }
+      continue;
+    }
+    if (shouldSkipEntry(pkgName)) {
+      i++;
+      continue;
+    }
+    if (!isValidPackageName(pkgName)) {
+      (0, import_errors.logWarn)(`[sec:pub] Invalid package name "${pkgName}" in ${relativeManifest} \u2014 skipping`);
+      i++;
+      continue;
+    }
+    const constraint = parseConstraintValue(valueOnSameLine);
+    deps.push({ name: pkgName, constraint });
+    i++;
+  }
+  return deps;
+}
+function parseConstraintValue(value) {
+  if (!value || value === "" || value.toLowerCase() === "any") return "*";
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1).trim();
+  }
+  return value || "*";
+}
+function shouldSkipEntry(name) {
+  if (name === "sdk") return true;
+  if (name === "flutter") return true;
+  return false;
+}
+function isValidPackageName(name) {
+  if (!name || typeof name !== "string") return false;
+  if (name.length > 128) return false;
+  return /^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/.test(name);
+}
+function loadResolvedVersions(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const lockPath = path.join(manifestDir, "pubspec.lock");
+  if (!fs.existsSync(lockPath)) {
+    return map;
+  }
+  try {
+    const lockContent = fs.readFileSync(lockPath, "utf8");
+    extractFromPubspecLock(lockContent, map);
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:pub] Failed to parse pubspec.lock: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return map;
+}
+function extractFromPubspecLock(content, map) {
+  const lines = content.split("\n");
+  let inPackagesSection = false;
+  let currentPackage = null;
+  for (const line of lines) {
+    const trimmed = line.trimEnd();
+    if (trimmed === "packages:") {
+      inPackagesSection = true;
+      currentPackage = null;
+      continue;
+    }
+    if (inPackagesSection && trimmed !== "" && !/^\s/.test(trimmed)) {
+      inPackagesSection = false;
+      currentPackage = null;
+      continue;
+    }
+    if (!inPackagesSection) continue;
+    const pkgNameMatch = trimmed.match(/^  ([a-zA-Z0-9_][a-zA-Z0-9_.-]*):\s*$/);
+    if (pkgNameMatch) {
+      currentPackage = pkgNameMatch[1];
+      continue;
+    }
+    if (currentPackage) {
+      const versionMatch = trimmed.match(/^    version:\s*["']?([^"'\s]+)["']?\s*$/);
+      if (versionMatch) {
+        if (!map.has(currentPackage)) {
+          map.set(currentPackage, versionMatch[1]);
+        }
+        currentPackage = null;
+      }
+    }
+  }
+}
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function extractPubspecLicense(content) {
+  const match = content.match(/^license:\s*(.+)$/m);
+  if (match && match[1].trim() !== "") {
+    let value = match[1].trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1).trim();
+    }
+    return value || void 0;
+  }
+  return void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parsePubspecManifest
+});
+//# sourceMappingURL=pubspec.js.map

package/dist/security/manifest/plugins/pubspec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/pubspec.ts"],
+  "sourcesContent": ["/**\n * Dart/Flutter pub Version Extraction Plugin for KiroGraph-Sec\n *\n * Parses pubspec.yaml manifests to extract Dart package declarations with\n * version constraints, scopes, and resolved versions from pubspec.lock.\n *\n * Uses lightweight regex-based YAML parsing \u2014 no external YAML library required.\n *\n * Handles:\n * - `dependencies:` section \u2192 'production' scope\n * - `dev_dependencies:` section \u2192 'development' scope\n * - Version formats: `^1.0.0`, `\">=1.0.0 <2.0.0\"`, `any`\n * - Skips SDK entries (`sdk:`), `flutter:`, path deps, and git deps\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Resolved version map: package name \u2192 resolved version string.\n * Built from pubspec.lock.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * Parse a pubspec.yaml manifest and extract package declarations with\n * version constraints, scopes, and resolved versions from pubspec.lock.\n *\n * @param manifestPath - Absolute path to the pubspec.yaml file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parsePubspecManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Read the pubspec.yaml content\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:pub] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  // Attempt to load resolved versions from pubspec.lock\n  const resolvedVersions = loadResolvedVersions(manifestDir);\n\n  // Extract the license field if present\n  const license = extractPubspecLicense(content);\n\n  const dependencies: ParsedDependency[] = [];\n\n  // Process `dependencies` (production) and `dev_dependencies` (development)\n  const sections: Array<{ key: string; scope: ParsedDependency['scope'] }> = [\n    { key: 'dependencies', scope: 'production' },\n    { key: 'dev_dependencies', scope: 'development' },\n  ];\n\n  for (const { key, scope } of sections) {\n    const sectionDeps = extractSectionDependencies(content, key, relativeManifest);\n    for (const dep of sectionDeps) {\n      const resolvedVersion = resolvedVersions.get(dep.name);\n      dependencies.push({\n        name: dep.name,\n        declaredConstraint: dep.constraint,\n        resolvedVersion,\n        scope,\n        ecosystem: 'pub',\n        sourceManifest: relativeManifest,\n        ...(license !== undefined ? { license } : {}),\n      });\n    }\n  }\n\n  return dependencies;\n}\n\n/**\n * A raw dependency entry extracted from a pubspec.yaml section.\n */\ninterface RawDependency {\n  name: string;\n  constraint: string;\n}\n\n/**\n * Extract dependencies from a specific top-level section of a pubspec.yaml file.\n * Uses indentation-based parsing to determine section boundaries.\n *\n * Section entries take one of three forms:\n * - `  package_name: ^1.0.0`      (inline scalar version)\n * - `  package_name: \">=1.0.0 <2.0.0\"` (quoted version)\n * - `  package_name: any`         (any version)\n * - `  package_name:`             (block mapping \u2014 path/git/sdk dep)\n *   `    path: ../local`\n *\n * Entries with sub-keys (block mappings) are skipped as non-registry deps.\n */\nfunction extractSectionDependencies(\n  content: string,\n  sectionKey: string,\n  relativeManifest: string,\n): RawDependency[] {\n  const deps: RawDependency[] = [];\n  const lines = content.split('\\n');\n\n  // Find the section header line (at column 0, no indent)\n  const headerPattern = new RegExp(`^${escapeRegex(sectionKey)}\\\\s*:\\\\s*$`);\n  let inSection = false;\n  let i = 0;\n\n  while (i < lines.length) {\n    const line = lines[i];\n    const trimmed = line.trimEnd();\n\n    // Detect section header\n    if (!inSection) {\n      if (headerPattern.test(trimmed)) {\n        inSection = true;\n      }\n      i++;\n      continue;\n    }\n\n    // Exit section when we encounter another top-level key (no leading whitespace)\n    if (trimmed !== '' && !/^\\s/.test(trimmed)) {\n      break;\n    }\n\n    // Skip blank lines inside section\n    if (trimmed === '') {\n      i++;\n      continue;\n    }\n\n    // Match a 2-space-indented package entry: `  package_name: ...`\n    const entryMatch = trimmed.match(/^  ([a-zA-Z0-9_][a-zA-Z0-9_.-]*):\\s*(.*)$/);\n    if (!entryMatch) {\n      i++;\n      continue;\n    }\n\n    const pkgName = entryMatch[1];\n    const valueOnSameLine = entryMatch[2].trim();\n\n    // Check if the next line has deeper indentation (block mapping \u2192 skip)\n    const nextLine = i + 1 < lines.length ? lines[i + 1] : '';\n    const isBlockMapping = nextLine !== '' && /^    \\S/.test(nextLine);\n\n    if (isBlockMapping) {\n      // Skip \u2014 path/git/sdk dependency; advance past the block\n      i++;\n      while (i < lines.length) {\n        const subLine = lines[i];\n        if (subLine.trimEnd() === '' || /^    /.test(subLine)) {\n          i++;\n        } else {\n          break;\n        }\n      }\n      continue;\n    }\n\n    // Skip SDK and flutter pseudo-packages\n    if (shouldSkipEntry(pkgName)) {\n      i++;\n      continue;\n    }\n\n    if (!isValidPackageName(pkgName)) {\n      logWarn(`[sec:pub] Invalid package name \"${pkgName}\" in ${relativeManifest} \u2014 skipping`);\n      i++;\n      continue;\n    }\n\n    const constraint = parseConstraintValue(valueOnSameLine);\n    deps.push({ name: pkgName, constraint });\n    i++;\n  }\n\n  return deps;\n}\n\n/**\n * Parse a pubspec.yaml dependency version value string.\n *\n * Handles:\n * - `^1.0.0` \u2192 `^1.0.0`\n * - `\">=1.0.0 <2.0.0\"` \u2192 `>=1.0.0 <2.0.0` (quotes stripped)\n * - `'>=1.0.0 <2.0.0'` \u2192 `>=1.0.0 <2.0.0`\n * - `any` \u2192 `*`\n * - empty \u2192 `*`\n */\nfunction parseConstraintValue(value: string): string {\n  if (!value || value === '' || value.toLowerCase() === 'any') return '*';\n\n  // Strip surrounding quotes\n  if ((value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n    value = value.slice(1, -1).trim();\n  }\n\n  return value || '*';\n}\n\n/**\n * Determine whether a pubspec.yaml dependency key should be skipped.\n */\nfunction shouldSkipEntry(name: string): boolean {\n  if (name === 'sdk') return true;\n  if (name === 'flutter') return true;\n  return false;\n}\n\n/**\n * Validate that a pub package name follows Dart naming conventions.\n * Package names must be lowercase, with underscores, not hyphens.\n */\nfunction isValidPackageName(name: string): boolean {\n  if (!name || typeof name !== 'string') return false;\n  if (name.length > 128) return false;\n  return /^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/.test(name);\n}\n\n/**\n * Attempt to load resolved versions from pubspec.lock in the given directory.\n * Returns an empty map if pubspec.lock is not available.\n *\n * pubspec.lock YAML format:\n * ```yaml\n * packages:\n *   http:\n *     dependency: \"direct main\"\n *     description:\n *       name: http\n *       url: \"https://pub.dartlang.org\"\n *     version: \"0.13.5\"\n *   test:\n *     dependency: \"direct dev\"\n *     version: \"1.21.4\"\n * ```\n */\nfunction loadResolvedVersions(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  const lockPath = path.join(manifestDir, 'pubspec.lock');\n  if (!fs.existsSync(lockPath)) {\n    return map;\n  }\n\n  try {\n    const lockContent = fs.readFileSync(lockPath, 'utf8');\n    extractFromPubspecLock(lockContent, map);\n  } catch (err) {\n    logWarn(`[sec:pub] Failed to parse pubspec.lock: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from pubspec.lock content.\n *\n * The lock file is a YAML document. We use regex-based parsing to avoid\n * introducing a YAML library dependency. For each package block under\n * `packages:`, we find its `version:` entry.\n */\nfunction extractFromPubspecLock(content: string, map: ResolvedVersionMap): void {\n  const lines = content.split('\\n');\n  let inPackagesSection = false;\n  let currentPackage: string | null = null;\n\n  for (const line of lines) {\n    const trimmed = line.trimEnd();\n\n    // Detect top-level `packages:` section\n    if (trimmed === 'packages:') {\n      inPackagesSection = true;\n      currentPackage = null;\n      continue;\n    }\n\n    // Exit packages section if we hit another top-level key\n    if (inPackagesSection && trimmed !== '' && !/^\\s/.test(trimmed)) {\n      inPackagesSection = false;\n      currentPackage = null;\n      continue;\n    }\n\n    if (!inPackagesSection) continue;\n\n    // Package name entry: `  package_name:` (2-space indent)\n    const pkgNameMatch = trimmed.match(/^  ([a-zA-Z0-9_][a-zA-Z0-9_.-]*):\\s*$/);\n    if (pkgNameMatch) {\n      currentPackage = pkgNameMatch[1];\n      continue;\n    }\n\n    // Version entry: `    version: \"1.2.3\"` (4-space indent)\n    if (currentPackage) {\n      const versionMatch = trimmed.match(/^    version:\\s*[\"']?([^\"'\\s]+)[\"']?\\s*$/);\n      if (versionMatch) {\n        if (!map.has(currentPackage)) {\n          map.set(currentPackage, versionMatch[1]);\n        }\n        currentPackage = null;\n      }\n    }\n  }\n}\n\n/**\n * Escape special regex characters in a string.\n */\nfunction escapeRegex(str: string): string {\n  return str.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\n/**\n * Extract the `license:` field from pubspec.yaml content.\n * Handles: `license: MIT` (top-level scalar field)\n */\nfunction extractPubspecLicense(content: string): string | undefined {\n  const match = content.match(/^license:\\s*(.+)$/m);\n  if (match && match[1].trim() !== '') {\n    // Strip surrounding quotes if present\n    let value = match[1].trim();\n    if ((value.startsWith('\"') && value.endsWith('\"')) ||\n        (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n      value = value.slice(1, -1).trim();\n    }\n    return value || undefined;\n  }\n  return undefined;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAgBxB,eAAsB,qBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,4BAA4B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC3G,WAAO,CAAC;AAAA,EACV;AAGA,QAAM,mBAAmB,qBAAqB,WAAW;AAGzD,QAAM,UAAU,sBAAsB,OAAO;AAE7C,QAAM,eAAmC,CAAC;AAG1C,QAAM,WAAqE;AAAA,IACzE,EAAE,KAAK,gBAAgB,OAAO,aAAa;AAAA,IAC3C,EAAE,KAAK,oBAAoB,OAAO,cAAc;AAAA,EAClD;AAEA,aAAW,EAAE,KAAK,MAAM,KAAK,UAAU;AACrC,UAAM,cAAc,2BAA2B,SAAS,KAAK,gBAAgB;AAC7E,eAAW,OAAO,aAAa;AAC7B,YAAM,kBAAkB,iBAAiB,IAAI,IAAI,IAAI;AACrD,mBAAa,KAAK;AAAA,QAChB,MAAM,IAAI;AAAA,QACV,oBAAoB,IAAI;AAAA,QACxB;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAuBA,SAAS,2BACP,SACA,YACA,kBACiB;AACjB,QAAM,OAAwB,CAAC;AAC/B,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAGhC,QAAM,gBAAgB,IAAI,OAAO,IAAI,YAAY,UAAU,CAAC,YAAY;AACxE,MAAI,YAAY;AAChB,MAAI,IAAI;AAER,SAAO,IAAI,MAAM,QAAQ;AACvB,UAAM,OAAO,MAAM,CAAC;AACpB,UAAM,UAAU,KAAK,QAAQ;AAG7B,QAAI,CAAC,WAAW;AACd,UAAI,cAAc,KAAK,OAAO,GAAG;AAC/B,oBAAY;AAAA,MACd;AACA;AACA;AAAA,IACF;AAGA,QAAI,YAAY,MAAM,CAAC,MAAM,KAAK,OAAO,GAAG;AAC1C;AAAA,IACF;AAGA,QAAI,YAAY,IAAI;AAClB;AACA;AAAA,IACF;AAGA,UAAM,aAAa,QAAQ,MAAM,2CAA2C;AAC5E,QAAI,CAAC,YAAY;AACf;AACA;AAAA,IACF;AAEA,UAAM,UAAU,WAAW,CAAC;AAC5B,UAAM,kBAAkB,WAAW,CAAC,EAAE,KAAK;AAG3C,UAAM,WAAW,IAAI,IAAI,MAAM,SAAS,MAAM,IAAI,CAAC,IAAI;AACvD,UAAM,iBAAiB,aAAa,MAAM,UAAU,KAAK,QAAQ;AAEjE,QAAI,gBAAgB;AAElB;AACA,aAAO,IAAI,MAAM,QAAQ;AACvB,cAAM,UAAU,MAAM,CAAC;AACvB,YAAI,QAAQ,QAAQ,MAAM,MAAM,QAAQ,KAAK,OAAO,GAAG;AACrD;AAAA,QACF,OAAO;AACL;AAAA,QACF;AAAA,MACF;AACA;AAAA,IACF;AAGA,QAAI,gBAAgB,OAAO,GAAG;AAC5B;AACA;AAAA,IACF;AAEA,QAAI,CAAC,mBAAmB,OAAO,GAAG;AAChC,iCAAQ,mCAAmC,OAAO,QAAQ,gBAAgB,kBAAa;AACvF;AACA;AAAA,IACF;AAEA,UAAM,aAAa,qBAAqB,eAAe;AACvD,SAAK,KAAK,EAAE,MAAM,SAAS,WAAW,CAAC;AACvC;AAAA,EACF;AAEA,SAAO;AACT;AAYA,SAAS,qBAAqB,OAAuB;AACnD,MAAI,CAAC,SAAS,UAAU,MAAM,MAAM,YAAY,MAAM,MAAO,QAAO;AAGpE,MAAK,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAC3C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAAI;AAClD,YAAQ,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK;AAAA,EAClC;AAEA,SAAO,SAAS;AAClB;AAKA,SAAS,gBAAgB,MAAuB;AAC9C,MAAI,SAAS,MAAO,QAAO;AAC3B,MAAI,SAAS,UAAW,QAAO;AAC/B,SAAO;AACT;AAMA,SAAS,mBAAmB,MAAuB;AACjD,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,MAAI,KAAK,SAAS,IAAK,QAAO;AAC9B,SAAO,gCAAgC,KAAK,IAAI;AAClD;AAoBA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,MAA0B,oBAAI,IAAI;AAExC,QAAM,WAAW,KAAK,KAAK,aAAa,cAAc;AACtD,MAAI,CAAC,GAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,cAAc,GAAG,aAAa,UAAU,MAAM;AACpD,2BAAuB,aAAa,GAAG;AAAA,EACzC,SAAS,KAAK;AACZ,+BAAQ,2CAA2C,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EACvG;AAEA,SAAO;AACT;AASA,SAAS,uBAAuB,SAAiB,KAA+B;AAC9E,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,MAAI,oBAAoB;AACxB,MAAI,iBAAgC;AAEpC,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,QAAQ;AAG7B,QAAI,YAAY,aAAa;AAC3B,0BAAoB;AACpB,uBAAiB;AACjB;AAAA,IACF;AAGA,QAAI,qBAAqB,YAAY,MAAM,CAAC,MAAM,KAAK,OAAO,GAAG;AAC/D,0BAAoB;AACpB,uBAAiB;AACjB;AAAA,IACF;AAEA,QAAI,CAAC,kBAAmB;AAGxB,UAAM,eAAe,QAAQ,MAAM,uCAAuC;AAC1E,QAAI,cAAc;AAChB,uBAAiB,aAAa,CAAC;AAC/B;AAAA,IACF;AAGA,QAAI,gBAAgB;AAClB,YAAM,eAAe,QAAQ,MAAM,0CAA0C;AAC7E,UAAI,cAAc;AAChB,YAAI,CAAC,IAAI,IAAI,cAAc,GAAG;AAC5B,cAAI,IAAI,gBAAgB,aAAa,CAAC,CAAC;AAAA,QACzC;AACA,yBAAiB;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACF;AAKA,SAAS,YAAY,KAAqB;AACxC,SAAO,IAAI,QAAQ,uBAAuB,MAAM;AAClD;AAMA,SAAS,sBAAsB,SAAqC;AAClE,QAAM,QAAQ,QAAQ,MAAM,oBAAoB;AAChD,MAAI,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM,IAAI;AAEnC,QAAI,QAAQ,MAAM,CAAC,EAAE,KAAK;AAC1B,QAAK,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAC3C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAAI;AAClD,cAAQ,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK;AAAA,IAClC;AACA,WAAO,SAAS;AAAA,EAClB;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/security/manifest/plugins/pyproject.d.ts

@@ -0,0 +1,3 @@
+import type { ParsedDependency } from '../../types';
+export declare function parsePyprojectManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=pyproject.d.ts.map

package/dist/security/manifest/plugins/pyproject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pyproject.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/pyproject.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAOpD,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAiE7B"}