kirograph 0.19.0 → 0.20.0

package/dist/security/export/sbom.test.js

@@ -1,288 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var import_vitest = require("vitest");
-var import_sbom = require("./sbom");
-var import_database = require("../../db/database");
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
-var os = __toESM(require("os"));
-function createTempProject() {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "sbom-test-"));
-  fs.writeFileSync(
-    path.join(dir, "package.json"),
-    JSON.stringify({ name: "test-project", version: "1.0.0" })
-  );
-  return dir;
-}
-function setupDb(projectRoot) {
-  const db = new import_database.GraphDatabase(projectRoot);
-  db.applySecuritySchema();
-  return db;
-}
-function insertDependency(db, opts) {
-  const rawDb = db.getRawDb();
-  db.upsertNode({
-    id: opts.nodeId,
-    kind: "dependency",
-    name: opts.packageName,
-    qualifiedName: `${opts.ecosystem}/${opts.packageName}`,
-    filePath: opts.sourceManifests?.[0] ?? "package.json",
-    language: "unknown",
-    startLine: 0,
-    endLine: 0,
-    startColumn: 0,
-    endColumn: 0,
-    updatedAt: Date.now()
-  });
-  rawDb.run(
-    `INSERT OR REPLACE INTO sec_dependencies
-      (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
-     VALUES (?, ?, ?, ?, ?, ?, ?)`,
-    [
-      opts.nodeId,
-      opts.ecosystem,
-      opts.packageName,
-      opts.declaredConstraint,
-      opts.resolvedVersion ?? null,
-      opts.scope ?? "production",
-      JSON.stringify(opts.sourceManifests ?? ["package.json"])
-    ]
-  );
-  if (opts.isDirect !== false) {
-    db.insertEdge({
-      source: opts.nodeId,
-      target: opts.sourceManifests?.[0] ?? "package.json",
-      kind: "declared_in"
-    });
-  }
-}
-function insertDependsOnEdge(db, source, target) {
-  db.insertEdge({ source, target, kind: "depends_on" });
-}
-(0, import_vitest.describe)("SBOMExporter", () => {
-  let projectRoot;
-  let db;
-  (0, import_vitest.beforeEach)(() => {
-    projectRoot = createTempProject();
-    db = setupDb(projectRoot);
-  });
-  (0, import_vitest.afterEach)(() => {
-    db.close();
-    fs.rmSync(projectRoot, { recursive: true, force: true });
-  });
-  (0, import_vitest.describe)("empty dependency graph", () => {
-    (0, import_vitest.it)("generates a valid CycloneDX 1.5 document with empty components", () => {
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      (0, import_vitest.expect)(sbom.bomFormat).toBe("CycloneDX");
-      (0, import_vitest.expect)(sbom.specVersion).toBe("1.5");
-      (0, import_vitest.expect)(sbom.version).toBe(1);
-      (0, import_vitest.expect)(sbom.components).toEqual([]);
-      (0, import_vitest.expect)(sbom.dependencies).toEqual([]);
-      (0, import_vitest.expect)(sbom.metadata).toBeDefined();
-    });
-    (0, import_vitest.it)("includes metadata with tool name, timestamp, and project name", () => {
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      const meta = sbom.metadata;
-      (0, import_vitest.expect)(meta.timestamp).toMatch(/^\d{4}-\d{2}-\d{2}T/);
-      (0, import_vitest.expect)(meta.tools.components[0].name).toBe("kirograph-sec");
-      (0, import_vitest.expect)(meta.tools.components[0].version).toBeDefined();
-      (0, import_vitest.expect)(meta.component.name).toBe("test-project");
-    });
-  });
-  (0, import_vitest.describe)("with dependencies", () => {
-    (0, import_vitest.beforeEach)(() => {
-      insertDependency(db, {
-        nodeId: "dep:npm:express",
-        ecosystem: "npm",
-        packageName: "express",
-        declaredConstraint: "^4.18.0",
-        resolvedVersion: "4.18.2",
-        scope: "production",
-        isDirect: true
-      });
-      insertDependency(db, {
-        nodeId: "dep:npm:lodash",
-        ecosystem: "npm",
-        packageName: "lodash",
-        declaredConstraint: "^4.17.0",
-        resolvedVersion: "4.17.21",
-        scope: "production",
-        isDirect: false
-        // transitive — no declared_in edge
-      });
-      insertDependsOnEdge(db, "dep:npm:express", "dep:npm:lodash");
-    });
-    (0, import_vitest.it)("includes all dependencies as components of type library", () => {
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      (0, import_vitest.expect)(sbom.components).toHaveLength(2);
-      (0, import_vitest.expect)(sbom.components.every((c) => c.type === "library")).toBe(true);
-    });
-    (0, import_vitest.it)("includes correct purl for each component", () => {
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      const express = sbom.components.find((c) => c.name === "express");
-      (0, import_vitest.expect)(express?.purl).toBe("pkg:npm/express@4.18.2");
-      const lodash = sbom.components.find((c) => c.name === "lodash");
-      (0, import_vitest.expect)(lodash?.purl).toBe("pkg:npm/lodash@4.17.21");
-    });
-    (0, import_vitest.it)('sets scope to "required" for direct and "optional" for transitive', () => {
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      const express = sbom.components.find((c) => c.name === "express");
-      (0, import_vitest.expect)(express?.scope).toBe("required");
-      const lodash = sbom.components.find((c) => c.name === "lodash");
-      (0, import_vitest.expect)(lodash?.scope).toBe("optional");
-    });
-    (0, import_vitest.it)("includes direct/transitive classification in properties", () => {
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      const express = sbom.components.find((c) => c.name === "express");
-      const expressClassification = express?.properties?.find(
-        (p) => p.name === "kirograph:classification"
-      );
-      (0, import_vitest.expect)(expressClassification?.value).toBe("direct");
-      const lodash = sbom.components.find((c) => c.name === "lodash");
-      const lodashClassification = lodash?.properties?.find(
-        (p) => p.name === "kirograph:classification"
-      );
-      (0, import_vitest.expect)(lodashClassification?.value).toBe("transitive");
-    });
-    (0, import_vitest.it)("includes dependency relationships reflecting depends_on edges", () => {
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      const expressDep = sbom.dependencies.find(
-        (d) => d.ref === "pkg:npm/express@4.18.2"
-      );
-      (0, import_vitest.expect)(expressDep).toBeDefined();
-      (0, import_vitest.expect)(expressDep?.dependsOn).toContain("pkg:npm/lodash@4.17.21");
-      const lodashDep = sbom.dependencies.find(
-        (d) => d.ref === "pkg:npm/lodash@4.17.21"
-      );
-      (0, import_vitest.expect)(lodashDep).toBeDefined();
-      (0, import_vitest.expect)(lodashDep?.dependsOn).toBeUndefined();
-    });
-  });
-  (0, import_vitest.describe)("version fallback", () => {
-    (0, import_vitest.it)("uses declared constraint when resolved version is not available", () => {
-      insertDependency(db, {
-        nodeId: "dep:npm:some-pkg",
-        ecosystem: "npm",
-        packageName: "some-pkg",
-        declaredConstraint: ">=2.0.0",
-        resolvedVersion: void 0,
-        isDirect: true
-      });
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      const comp = sbom.components.find((c) => c.name === "some-pkg");
-      (0, import_vitest.expect)(comp?.version).toBe(">=2.0.0");
-      (0, import_vitest.expect)(comp?.purl).toBe("pkg:npm/some-pkg@>=2.0.0");
-    });
-  });
-  (0, import_vitest.describe)("ecosystem purl mapping", () => {
-    (0, import_vitest.it)("maps go ecosystem to golang in purl", () => {
-      insertDependency(db, {
-        nodeId: "dep:go:github.com/gin-gonic/gin",
-        ecosystem: "go",
-        packageName: "github.com/gin-gonic/gin",
-        declaredConstraint: "v1.9.1",
-        resolvedVersion: "v1.9.1",
-        isDirect: true
-      });
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      const comp = sbom.components.find((c) => c.name === "github.com/gin-gonic/gin");
-      (0, import_vitest.expect)(comp?.purl).toBe("pkg:golang/github.com/gin-gonic/gin@v1.9.1");
-    });
-    (0, import_vitest.it)("maps python ecosystem to pypi in purl", () => {
-      insertDependency(db, {
-        nodeId: "dep:python:django",
-        ecosystem: "python",
-        packageName: "django",
-        declaredConstraint: "==4.2.0",
-        resolvedVersion: "4.2.0",
-        isDirect: true
-      });
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      const comp = sbom.components.find((c) => c.name === "django");
-      (0, import_vitest.expect)(comp?.purl).toBe("pkg:pypi/django@4.2.0");
-    });
-    (0, import_vitest.it)("maps cargo ecosystem correctly in purl", () => {
-      insertDependency(db, {
-        nodeId: "dep:cargo:serde",
-        ecosystem: "cargo",
-        packageName: "serde",
-        declaredConstraint: "1.0.188",
-        resolvedVersion: "1.0.188",
-        isDirect: true
-      });
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      const comp = sbom.components.find((c) => c.name === "serde");
-      (0, import_vitest.expect)(comp?.purl).toBe("pkg:cargo/serde@1.0.188");
-    });
-    (0, import_vitest.it)("maps maven ecosystem correctly in purl", () => {
-      insertDependency(db, {
-        nodeId: "dep:maven:org.apache.logging.log4j/log4j-core",
-        ecosystem: "maven",
-        packageName: "org.apache.logging.log4j/log4j-core",
-        declaredConstraint: "2.17.0",
-        resolvedVersion: "2.17.0",
-        isDirect: true
-      });
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const sbom = exporter.export();
-      const comp = sbom.components.find(
-        (c) => c.name === "org.apache.logging.log4j/log4j-core"
-      );
-      (0, import_vitest.expect)(comp?.purl).toBe(
-        "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0"
-      );
-    });
-  });
-  (0, import_vitest.describe)("exportJSON", () => {
-    (0, import_vitest.it)("returns a pretty-printed JSON string", () => {
-      insertDependency(db, {
-        nodeId: "dep:npm:express",
-        ecosystem: "npm",
-        packageName: "express",
-        declaredConstraint: "^4.18.0",
-        resolvedVersion: "4.18.2",
-        isDirect: true
-      });
-      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
-      const json = exporter.exportJSON();
-      const parsed = JSON.parse(json);
-      (0, import_vitest.expect)(parsed.bomFormat).toBe("CycloneDX");
-      (0, import_vitest.expect)(parsed.specVersion).toBe("1.5");
-      (0, import_vitest.expect)(json).toContain("\n");
-      (0, import_vitest.expect)(json).toContain("  ");
-    });
-  });
-});
-//# sourceMappingURL=sbom.test.js.map

package/dist/security/export/sbom.test.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/security/export/sbom.test.ts"],
-  "sourcesContent": ["/**\n * Unit tests for SBOMExporter \u2014 CycloneDX 1.5 SBOM generation\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport { SBOMExporter } from './sbom';\nimport { GraphDatabase } from '../../db/database';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\n\n// \u2500\u2500 Test Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction createTempProject(): string {\n  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sbom-test-'));\n  // Create a package.json so the project name can be detected\n  fs.writeFileSync(\n    path.join(dir, 'package.json'),\n    JSON.stringify({ name: 'test-project', version: '1.0.0' }),\n  );\n  return dir;\n}\n\nfunction setupDb(projectRoot: string): GraphDatabase {\n  const db = new GraphDatabase(projectRoot);\n  db.applySecuritySchema();\n  return db;\n}\n\nfunction insertDependency(\n  db: GraphDatabase,\n  opts: {\n    nodeId: string;\n    ecosystem: string;\n    packageName: string;\n    declaredConstraint: string;\n    resolvedVersion?: string;\n    scope?: string;\n    sourceManifests?: string[];\n    isDirect?: boolean;\n  },\n): void {\n  const rawDb = db.getRawDb();\n\n  // Insert into nodes table\n  db.upsertNode({\n    id: opts.nodeId,\n    kind: 'dependency',\n    name: opts.packageName,\n    qualifiedName: `${opts.ecosystem}/${opts.packageName}`,\n    filePath: opts.sourceManifests?.[0] ?? 'package.json',\n    language: 'unknown',\n    startLine: 0,\n    endLine: 0,\n    startColumn: 0,\n    endColumn: 0,\n    updatedAt: Date.now(),\n  });\n\n  // Insert into sec_dependencies\n  rawDb.run(\n    `INSERT OR REPLACE INTO sec_dependencies\n      (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n     VALUES (?, ?, ?, ?, ?, ?, ?)`,\n    [\n      opts.nodeId,\n      opts.ecosystem,\n      opts.packageName,\n      opts.declaredConstraint,\n      opts.resolvedVersion ?? null,\n      opts.scope ?? 'production',\n      JSON.stringify(opts.sourceManifests ?? ['package.json']),\n    ],\n  );\n\n  // Create declared_in edge if direct\n  if (opts.isDirect !== false) {\n    db.insertEdge({\n      source: opts.nodeId,\n      target: opts.sourceManifests?.[0] ?? 'package.json',\n      kind: 'declared_in',\n    });\n  }\n}\n\nfunction insertDependsOnEdge(db: GraphDatabase, source: string, target: string): void {\n  db.insertEdge({ source, target, kind: 'depends_on' });\n}\n\n// \u2500\u2500 Tests \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ndescribe('SBOMExporter', () => {\n  let projectRoot: string;\n  let db: GraphDatabase;\n\n  beforeEach(() => {\n    projectRoot = createTempProject();\n    db = setupDb(projectRoot);\n  });\n\n  afterEach(() => {\n    db.close();\n    fs.rmSync(projectRoot, { recursive: true, force: true });\n  });\n\n  describe('empty dependency graph', () => {\n    it('generates a valid CycloneDX 1.5 document with empty components', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      expect(sbom.bomFormat).toBe('CycloneDX');\n      expect(sbom.specVersion).toBe('1.5');\n      expect(sbom.version).toBe(1);\n      expect(sbom.components).toEqual([]);\n      expect(sbom.dependencies).toEqual([]);\n      expect(sbom.metadata).toBeDefined();\n    });\n\n    it('includes metadata with tool name, timestamp, and project name', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const meta = sbom.metadata as any;\n      expect(meta.timestamp).toMatch(/^\\d{4}-\\d{2}-\\d{2}T/);\n      expect(meta.tools.components[0].name).toBe('kirograph-sec');\n      expect(meta.tools.components[0].version).toBeDefined();\n      expect(meta.component.name).toBe('test-project');\n    });\n  });\n\n  describe('with dependencies', () => {\n    beforeEach(() => {\n      insertDependency(db, {\n        nodeId: 'dep:npm:express',\n        ecosystem: 'npm',\n        packageName: 'express',\n        declaredConstraint: '^4.18.0',\n        resolvedVersion: '4.18.2',\n        scope: 'production',\n        isDirect: true,\n      });\n\n      insertDependency(db, {\n        nodeId: 'dep:npm:lodash',\n        ecosystem: 'npm',\n        packageName: 'lodash',\n        declaredConstraint: '^4.17.0',\n        resolvedVersion: '4.17.21',\n        scope: 'production',\n        isDirect: false, // transitive \u2014 no declared_in edge\n      });\n\n      // express depends on lodash (transitive)\n      insertDependsOnEdge(db, 'dep:npm:express', 'dep:npm:lodash');\n    });\n\n    it('includes all dependencies as components of type library', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      expect(sbom.components).toHaveLength(2);\n      expect(sbom.components.every((c) => c.type === 'library')).toBe(true);\n    });\n\n    it('includes correct purl for each component', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const express = sbom.components.find((c) => c.name === 'express');\n      expect(express?.purl).toBe('pkg:npm/express@4.18.2');\n\n      const lodash = sbom.components.find((c) => c.name === 'lodash');\n      expect(lodash?.purl).toBe('pkg:npm/lodash@4.17.21');\n    });\n\n    it('sets scope to \"required\" for direct and \"optional\" for transitive', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const express = sbom.components.find((c) => c.name === 'express');\n      expect(express?.scope).toBe('required');\n\n      const lodash = sbom.components.find((c) => c.name === 'lodash');\n      expect(lodash?.scope).toBe('optional');\n    });\n\n    it('includes direct/transitive classification in properties', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const express = sbom.components.find((c) => c.name === 'express');\n      const expressClassification = express?.properties?.find(\n        (p) => p.name === 'kirograph:classification',\n      );\n      expect(expressClassification?.value).toBe('direct');\n\n      const lodash = sbom.components.find((c) => c.name === 'lodash');\n      const lodashClassification = lodash?.properties?.find(\n        (p) => p.name === 'kirograph:classification',\n      );\n      expect(lodashClassification?.value).toBe('transitive');\n    });\n\n    it('includes dependency relationships reflecting depends_on edges', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const expressDep = sbom.dependencies.find(\n        (d) => d.ref === 'pkg:npm/express@4.18.2',\n      );\n      expect(expressDep).toBeDefined();\n      expect(expressDep?.dependsOn).toContain('pkg:npm/lodash@4.17.21');\n\n      // lodash has no depends_on\n      const lodashDep = sbom.dependencies.find(\n        (d) => d.ref === 'pkg:npm/lodash@4.17.21',\n      );\n      expect(lodashDep).toBeDefined();\n      expect(lodashDep?.dependsOn).toBeUndefined();\n    });\n  });\n\n  describe('version fallback', () => {\n    it('uses declared constraint when resolved version is not available', () => {\n      insertDependency(db, {\n        nodeId: 'dep:npm:some-pkg',\n        ecosystem: 'npm',\n        packageName: 'some-pkg',\n        declaredConstraint: '>=2.0.0',\n        resolvedVersion: undefined,\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const comp = sbom.components.find((c) => c.name === 'some-pkg');\n      expect(comp?.version).toBe('>=2.0.0');\n      expect(comp?.purl).toBe('pkg:npm/some-pkg@>=2.0.0');\n    });\n  });\n\n  describe('ecosystem purl mapping', () => {\n    it('maps go ecosystem to golang in purl', () => {\n      insertDependency(db, {\n        nodeId: 'dep:go:github.com/gin-gonic/gin',\n        ecosystem: 'go',\n        packageName: 'github.com/gin-gonic/gin',\n        declaredConstraint: 'v1.9.1',\n        resolvedVersion: 'v1.9.1',\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const comp = sbom.components.find((c) => c.name === 'github.com/gin-gonic/gin');\n      expect(comp?.purl).toBe('pkg:golang/github.com/gin-gonic/gin@v1.9.1');\n    });\n\n    it('maps python ecosystem to pypi in purl', () => {\n      insertDependency(db, {\n        nodeId: 'dep:python:django',\n        ecosystem: 'python',\n        packageName: 'django',\n        declaredConstraint: '==4.2.0',\n        resolvedVersion: '4.2.0',\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const comp = sbom.components.find((c) => c.name === 'django');\n      expect(comp?.purl).toBe('pkg:pypi/django@4.2.0');\n    });\n\n    it('maps cargo ecosystem correctly in purl', () => {\n      insertDependency(db, {\n        nodeId: 'dep:cargo:serde',\n        ecosystem: 'cargo',\n        packageName: 'serde',\n        declaredConstraint: '1.0.188',\n        resolvedVersion: '1.0.188',\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const comp = sbom.components.find((c) => c.name === 'serde');\n      expect(comp?.purl).toBe('pkg:cargo/serde@1.0.188');\n    });\n\n    it('maps maven ecosystem correctly in purl', () => {\n      insertDependency(db, {\n        nodeId: 'dep:maven:org.apache.logging.log4j/log4j-core',\n        ecosystem: 'maven',\n        packageName: 'org.apache.logging.log4j/log4j-core',\n        declaredConstraint: '2.17.0',\n        resolvedVersion: '2.17.0',\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const comp = sbom.components.find(\n        (c) => c.name === 'org.apache.logging.log4j/log4j-core',\n      );\n      expect(comp?.purl).toBe(\n        'pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0',\n      );\n    });\n  });\n\n  describe('exportJSON', () => {\n    it('returns a pretty-printed JSON string', () => {\n      insertDependency(db, {\n        nodeId: 'dep:npm:express',\n        ecosystem: 'npm',\n        packageName: 'express',\n        declaredConstraint: '^4.18.0',\n        resolvedVersion: '4.18.2',\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const json = exporter.exportJSON();\n\n      // Should be valid JSON\n      const parsed = JSON.parse(json);\n      expect(parsed.bomFormat).toBe('CycloneDX');\n      expect(parsed.specVersion).toBe('1.5');\n\n      // Should be pretty-printed (contains newlines and indentation)\n      expect(json).toContain('\\n');\n      expect(json).toContain('  ');\n    });\n  });\n});\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAGA,oBAA4D;AAC5D,kBAA6B;AAC7B,sBAA8B;AAC9B,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AAIpB,SAAS,oBAA4B;AACnC,QAAM,MAAM,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,YAAY,CAAC;AAE/D,KAAG;AAAA,IACD,KAAK,KAAK,KAAK,cAAc;AAAA,IAC7B,KAAK,UAAU,EAAE,MAAM,gBAAgB,SAAS,QAAQ,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,aAAoC;AACnD,QAAM,KAAK,IAAI,8BAAc,WAAW;AACxC,KAAG,oBAAoB;AACvB,SAAO;AACT;AAEA,SAAS,iBACP,IACA,MAUM;AACN,QAAM,QAAQ,GAAG,SAAS;AAG1B,KAAG,WAAW;AAAA,IACZ,IAAI,KAAK;AAAA,IACT,MAAM;AAAA,IACN,MAAM,KAAK;AAAA,IACX,eAAe,GAAG,KAAK,SAAS,IAAI,KAAK,WAAW;AAAA,IACpD,UAAU,KAAK,kBAAkB,CAAC,KAAK;AAAA,IACvC,UAAU;AAAA,IACV,WAAW;AAAA,IACX,SAAS;AAAA,IACT,aAAa;AAAA,IACb,WAAW;AAAA,IACX,WAAW,KAAK,IAAI;AAAA,EACtB,CAAC;AAGD,QAAM;AAAA,IACJ;AAAA;AAAA;AAAA,IAGA;AAAA,MACE,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,mBAAmB;AAAA,MACxB,KAAK,SAAS;AAAA,MACd,KAAK,UAAU,KAAK,mBAAmB,CAAC,cAAc,CAAC;AAAA,IACzD;AAAA,EACF;AAGA,MAAI,KAAK,aAAa,OAAO;AAC3B,OAAG,WAAW;AAAA,MACZ,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK,kBAAkB,CAAC,KAAK;AAAA,MACrC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACF;AAEA,SAAS,oBAAoB,IAAmB,QAAgB,QAAsB;AACpF,KAAG,WAAW,EAAE,QAAQ,QAAQ,MAAM,aAAa,CAAC;AACtD;AAAA,IAIA,wBAAS,gBAAgB,MAAM;AAC7B,MAAI;AACJ,MAAI;AAEJ,gCAAW,MAAM;AACf,kBAAc,kBAAkB;AAChC,SAAK,QAAQ,WAAW;AAAA,EAC1B,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,MAAM;AACT,OAAG,OAAO,aAAa,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACzD,CAAC;AAED,8BAAS,0BAA0B,MAAM;AACvC,0BAAG,kEAAkE,MAAM;AACzE,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,gCAAO,KAAK,SAAS,EAAE,KAAK,WAAW;AACvC,gCAAO,KAAK,WAAW,EAAE,KAAK,KAAK;AACnC,gCAAO,KAAK,OAAO,EAAE,KAAK,CAAC;AAC3B,gCAAO,KAAK,UAAU,EAAE,QAAQ,CAAC,CAAC;AAClC,gCAAO,KAAK,YAAY,EAAE,QAAQ,CAAC,CAAC;AACpC,gCAAO,KAAK,QAAQ,EAAE,YAAY;AAAA,IACpC,CAAC;AAED,0BAAG,iEAAiE,MAAM;AACxE,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK;AAClB,gCAAO,KAAK,SAAS,EAAE,QAAQ,qBAAqB;AACpD,gCAAO,KAAK,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,eAAe;AAC1D,gCAAO,KAAK,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,YAAY;AACrD,gCAAO,KAAK,UAAU,IAAI,EAAE,KAAK,cAAc;AAAA,IACjD,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,qBAAqB,MAAM;AAClC,kCAAW,MAAM;AACf,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,OAAO;AAAA,QACP,UAAU;AAAA,MACZ,CAAC;AAED,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,OAAO;AAAA,QACP,UAAU;AAAA;AAAA,MACZ,CAAC;AAGD,0BAAoB,IAAI,mBAAmB,gBAAgB;AAAA,IAC7D,CAAC;AAED,0BAAG,2DAA2D,MAAM;AAClE,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,gCAAO,KAAK,UAAU,EAAE,aAAa,CAAC;AACtC,gCAAO,KAAK,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,KAAK,IAAI;AAAA,IACtE,CAAC;AAED,0BAAG,4CAA4C,MAAM;AACnD,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,UAAU,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AAChE,gCAAO,SAAS,IAAI,EAAE,KAAK,wBAAwB;AAEnD,YAAM,SAAS,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAC9D,gCAAO,QAAQ,IAAI,EAAE,KAAK,wBAAwB;AAAA,IACpD,CAAC;AAED,0BAAG,qEAAqE,MAAM;AAC5E,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,UAAU,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AAChE,gCAAO,SAAS,KAAK,EAAE,KAAK,UAAU;AAEtC,YAAM,SAAS,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAC9D,gCAAO,QAAQ,KAAK,EAAE,KAAK,UAAU;AAAA,IACvC,CAAC;AAED,0BAAG,2DAA2D,MAAM;AAClE,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,UAAU,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AAChE,YAAM,wBAAwB,SAAS,YAAY;AAAA,QACjD,CAAC,MAAM,EAAE,SAAS;AAAA,MACpB;AACA,gCAAO,uBAAuB,KAAK,EAAE,KAAK,QAAQ;AAElD,YAAM,SAAS,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAC9D,YAAM,uBAAuB,QAAQ,YAAY;AAAA,QAC/C,CAAC,MAAM,EAAE,SAAS;AAAA,MACpB;AACA,gCAAO,sBAAsB,KAAK,EAAE,KAAK,YAAY;AAAA,IACvD,CAAC;AAED,0BAAG,iEAAiE,MAAM;AACxE,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,aAAa,KAAK,aAAa;AAAA,QACnC,CAAC,MAAM,EAAE,QAAQ;AAAA,MACnB;AACA,gCAAO,UAAU,EAAE,YAAY;AAC/B,gCAAO,YAAY,SAAS,EAAE,UAAU,wBAAwB;AAGhE,YAAM,YAAY,KAAK,aAAa;AAAA,QAClC,CAAC,MAAM,EAAE,QAAQ;AAAA,MACnB;AACA,gCAAO,SAAS,EAAE,YAAY;AAC9B,gCAAO,WAAW,SAAS,EAAE,cAAc;AAAA,IAC7C,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,oBAAoB,MAAM;AACjC,0BAAG,mEAAmE,MAAM;AAC1E,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,UAAU;AAC9D,gCAAO,MAAM,OAAO,EAAE,KAAK,SAAS;AACpC,gCAAO,MAAM,IAAI,EAAE,KAAK,0BAA0B;AAAA,IACpD,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,0BAA0B,MAAM;AACvC,0BAAG,uCAAuC,MAAM;AAC9C,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,0BAA0B;AAC9E,gCAAO,MAAM,IAAI,EAAE,KAAK,4CAA4C;AAAA,IACtE,CAAC;AAED,0BAAG,yCAAyC,MAAM;AAChD,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAC5D,gCAAO,MAAM,IAAI,EAAE,KAAK,uBAAuB;AAAA,IACjD,CAAC;AAED,0BAAG,0CAA0C,MAAM;AACjD,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,OAAO;AAC3D,gCAAO,MAAM,IAAI,EAAE,KAAK,yBAAyB;AAAA,IACnD,CAAC;AAED,0BAAG,0CAA0C,MAAM;AACjD,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK,WAAW;AAAA,QAC3B,CAAC,MAAM,EAAE,SAAS;AAAA,MACpB;AACA,gCAAO,MAAM,IAAI,EAAE;AAAA,QACjB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,cAAc,MAAM;AAC3B,0BAAG,wCAAwC,MAAM;AAC/C,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,WAAW;AAGjC,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,gCAAO,OAAO,SAAS,EAAE,KAAK,WAAW;AACzC,gCAAO,OAAO,WAAW,EAAE,KAAK,KAAK;AAGrC,gCAAO,IAAI,EAAE,UAAU,IAAI;AAC3B,gCAAO,IAAI,EAAE,UAAU,IAAI;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/security/export/serialization.test.js

@@ -1,310 +0,0 @@
-"use strict";
-var import_vitest = require("vitest");
-var import_serialization = require("./serialization");
-function makeDependencyRow(overrides) {
-  return {
-    node_id: "dep:npm:express",
-    ecosystem: "npm",
-    package_name: "express",
-    declared_constraint: "^4.18.0",
-    resolved_version: "4.18.2",
-    scope: "production",
-    transitive_status: "complete",
-    last_vuln_check: null,
-    vuln_data_stale: 0,
-    vuln_data_stale_since: null,
-    source_manifests: '["package.json"]',
-    ...overrides
-  };
-}
-(0, import_vitest.describe)("serializeDependencyToComponent", () => {
-  (0, import_vitest.it)("should serialize an npm dependency to a CycloneDX component", () => {
-    const dep = makeDependencyRow();
-    const component = (0, import_serialization.serializeDependencyToComponent)(dep);
-    (0, import_vitest.expect)(component.type).toBe("library");
-    (0, import_vitest.expect)(component.name).toBe("express");
-    (0, import_vitest.expect)(component.version).toBe("4.18.2");
-    (0, import_vitest.expect)(component.purl).toBe("pkg:npm/express@4.18.2");
-    (0, import_vitest.expect)(component.scope).toBe("required");
-    (0, import_vitest.expect)(component.properties).toEqual([
-      { name: "kirograph:declaredConstraint", value: "^4.18.0" }
-    ]);
-  });
-  (0, import_vitest.it)("should use declared_constraint as version when resolved_version is null", () => {
-    const dep = makeDependencyRow({ resolved_version: null });
-    const component = (0, import_serialization.serializeDependencyToComponent)(dep);
-    (0, import_vitest.expect)(component.version).toBe("^4.18.0");
-    (0, import_vitest.expect)(component.purl).toBe("pkg:npm/express@^4.18.0");
-  });
-  (0, import_vitest.it)("should map production scope to required", () => {
-    const dep = makeDependencyRow({ scope: "production" });
-    const component = (0, import_serialization.serializeDependencyToComponent)(dep);
-    (0, import_vitest.expect)(component.scope).toBe("required");
-  });
-  (0, import_vitest.it)("should map development scope to optional", () => {
-    const dep = makeDependencyRow({ scope: "development" });
-    const component = (0, import_serialization.serializeDependencyToComponent)(dep);
-    (0, import_vitest.expect)(component.scope).toBe("optional");
-  });
-  (0, import_vitest.it)("should map optional scope to optional", () => {
-    const dep = makeDependencyRow({ scope: "optional" });
-    const component = (0, import_serialization.serializeDependencyToComponent)(dep);
-    (0, import_vitest.expect)(component.scope).toBe("optional");
-  });
-  (0, import_vitest.it)("should correctly map maven ecosystem to purl type", () => {
-    const dep = makeDependencyRow({
-      node_id: "dep:maven:log4j-core",
-      ecosystem: "maven",
-      package_name: "org.apache.logging.log4j/log4j-core",
-      resolved_version: "2.17.0"
-    });
-    const component = (0, import_serialization.serializeDependencyToComponent)(dep);
-    (0, import_vitest.expect)(component.purl).toBe("pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0");
-  });
-  (0, import_vitest.it)("should correctly map go ecosystem to golang purl type", () => {
-    const dep = makeDependencyRow({
-      node_id: "dep:go:github.com/gin-gonic/gin",
-      ecosystem: "go",
-      package_name: "github.com/gin-gonic/gin",
-      resolved_version: "1.9.1"
-    });
-    const component = (0, import_serialization.serializeDependencyToComponent)(dep);
-    (0, import_vitest.expect)(component.purl).toBe("pkg:golang/github.com/gin-gonic/gin@1.9.1");
-  });
-  (0, import_vitest.it)("should correctly map pypi ecosystem", () => {
-    const dep = makeDependencyRow({
-      node_id: "dep:pypi:django",
-      ecosystem: "pypi",
-      package_name: "django",
-      resolved_version: "4.2.0"
-    });
-    const component = (0, import_serialization.serializeDependencyToComponent)(dep);
-    (0, import_vitest.expect)(component.purl).toBe("pkg:pypi/django@4.2.0");
-  });
-  (0, import_vitest.it)("should correctly map cargo ecosystem", () => {
-    const dep = makeDependencyRow({
-      node_id: "dep:cargo:serde",
-      ecosystem: "cargo",
-      package_name: "serde",
-      resolved_version: "1.0.188"
-    });
-    const component = (0, import_serialization.serializeDependencyToComponent)(dep);
-    (0, import_vitest.expect)(component.purl).toBe("pkg:cargo/serde@1.0.188");
-  });
-  (0, import_vitest.it)("should throw for unsupported ecosystem", () => {
-    const dep = makeDependencyRow({ ecosystem: "unknown" });
-    (0, import_vitest.expect)(() => (0, import_serialization.serializeDependencyToComponent)(dep)).toThrow("Unsupported ecosystem: unknown");
-  });
-  (0, import_vitest.it)("should throw when both version and constraint are empty", () => {
-    const dep = makeDependencyRow({
-      resolved_version: null,
-      declared_constraint: ""
-    });
-    (0, import_vitest.expect)(() => (0, import_serialization.serializeDependencyToComponent)(dep)).toThrow(
-      "No version or constraint available"
-    );
-  });
-  (0, import_vitest.it)("should throw when package_name is empty", () => {
-    const dep = makeDependencyRow({ package_name: "" });
-    (0, import_vitest.expect)(() => (0, import_serialization.serializeDependencyToComponent)(dep)).toThrow(
-      "Dependency package_name is required"
-    );
-  });
-});
-(0, import_vitest.describe)("deserializeComponentToDependency", () => {
-  (0, import_vitest.it)("should deserialize a CycloneDX component to a dependency row", () => {
-    const component = {
-      type: "library",
-      name: "express",
-      version: "4.18.2",
-      purl: "pkg:npm/express@4.18.2",
-      scope: "required",
-      properties: [{ name: "kirograph:declaredConstraint", value: "^4.18.0" }]
-    };
-    const dep = (0, import_serialization.deserializeComponentToDependency)(component);
-    (0, import_vitest.expect)(dep.ecosystem).toBe("npm");
-    (0, import_vitest.expect)(dep.package_name).toBe("express");
-    (0, import_vitest.expect)(dep.resolved_version).toBe("4.18.2");
-    (0, import_vitest.expect)(dep.declared_constraint).toBe("^4.18.0");
-    (0, import_vitest.expect)(dep.scope).toBe("production");
-    (0, import_vitest.expect)(dep.node_id).toBe("dep:npm:express");
-  });
-  (0, import_vitest.it)("should use version as declared_constraint when property is missing", () => {
-    const component = {
-      type: "library",
-      name: "express",
-      version: "4.18.2",
-      purl: "pkg:npm/express@4.18.2"
-    };
-    const dep = (0, import_serialization.deserializeComponentToDependency)(component);
-    (0, import_vitest.expect)(dep.declared_constraint).toBe("4.18.2");
-  });
-  (0, import_vitest.it)("should map optional scope back to optional", () => {
-    const component = {
-      type: "library",
-      name: "jest",
-      version: "29.0.0",
-      purl: "pkg:npm/jest@29.0.0",
-      scope: "optional"
-    };
-    const dep = (0, import_serialization.deserializeComponentToDependency)(component);
-    (0, import_vitest.expect)(dep.scope).toBe("optional");
-  });
-  (0, import_vitest.it)("should map required scope back to production", () => {
-    const component = {
-      type: "library",
-      name: "express",
-      version: "4.18.2",
-      purl: "pkg:npm/express@4.18.2",
-      scope: "required"
-    };
-    const dep = (0, import_serialization.deserializeComponentToDependency)(component);
-    (0, import_vitest.expect)(dep.scope).toBe("production");
-  });
-  (0, import_vitest.it)("should map golang purl type back to go ecosystem", () => {
-    const component = {
-      type: "library",
-      name: "github.com/gin-gonic/gin",
-      version: "1.9.1",
-      purl: "pkg:golang/github.com/gin-gonic/gin@1.9.1"
-    };
-    const dep = (0, import_serialization.deserializeComponentToDependency)(component);
-    (0, import_vitest.expect)(dep.ecosystem).toBe("go");
-    (0, import_vitest.expect)(dep.package_name).toBe("github.com/gin-gonic/gin");
-  });
-  (0, import_vitest.it)("should throw for missing purl", () => {
-    const component = {
-      type: "library",
-      name: "express",
-      version: "4.18.2",
-      purl: ""
-    };
-    (0, import_vitest.expect)(() => (0, import_serialization.deserializeComponentToDependency)(component)).toThrow("missing purl");
-  });
-  (0, import_vitest.it)("should throw for invalid purl format", () => {
-    const component = {
-      type: "library",
-      name: "express",
-      version: "4.18.2",
-      purl: "invalid-purl"
-    };
-    (0, import_vitest.expect)(() => (0, import_serialization.deserializeComponentToDependency)(component)).toThrow("Invalid purl format");
-  });
-  (0, import_vitest.it)("should throw for unsupported purl type", () => {
-    const component = {
-      type: "library",
-      name: "something",
-      version: "1.0.0",
-      purl: "pkg:nuget/something@1.0.0"
-    };
-    (0, import_vitest.expect)(() => (0, import_serialization.deserializeComponentToDependency)(component)).toThrow("Unsupported purl type");
-  });
-  (0, import_vitest.it)("should set default values for non-serialized fields", () => {
-    const component = {
-      type: "library",
-      name: "express",
-      version: "4.18.2",
-      purl: "pkg:npm/express@4.18.2"
-    };
-    const dep = (0, import_serialization.deserializeComponentToDependency)(component);
-    (0, import_vitest.expect)(dep.transitive_status).toBe("complete");
-    (0, import_vitest.expect)(dep.last_vuln_check).toBeNull();
-    (0, import_vitest.expect)(dep.vuln_data_stale).toBe(0);
-    (0, import_vitest.expect)(dep.vuln_data_stale_since).toBeNull();
-    (0, import_vitest.expect)(dep.source_manifests).toBe("[]");
-  });
-});
-(0, import_vitest.describe)("serializeDependencyToComponent \u2192 deserializeComponentToDependency round-trip", () => {
-  (0, import_vitest.it)("should preserve key fields through round-trip", () => {
-    const original = makeDependencyRow();
-    const component = (0, import_serialization.serializeDependencyToComponent)(original);
-    const restored = (0, import_serialization.deserializeComponentToDependency)(component);
-    (0, import_vitest.expect)(restored.package_name).toBe(original.package_name);
-    (0, import_vitest.expect)(restored.resolved_version).toBe(original.resolved_version);
-    (0, import_vitest.expect)(restored.ecosystem).toBe(original.ecosystem);
-    (0, import_vitest.expect)(restored.scope).toBe(original.scope);
-    (0, import_vitest.expect)(restored.declared_constraint).toBe(original.declared_constraint);
-  });
-  (0, import_vitest.it)("should preserve constraint when resolved_version is null", () => {
-    const original = makeDependencyRow({ resolved_version: null });
-    const component = (0, import_serialization.serializeDependencyToComponent)(original);
-    const restored = (0, import_serialization.deserializeComponentToDependency)(component);
-    (0, import_vitest.expect)(restored.declared_constraint).toBe(original.declared_constraint);
-    (0, import_vitest.expect)(restored.resolved_version).toBe(original.declared_constraint);
-  });
-});
-(0, import_vitest.describe)("serializeAll", () => {
-  (0, import_vitest.it)("should serialize all valid dependencies", () => {
-    const deps = [
-      makeDependencyRow({ package_name: "express", node_id: "dep:npm:express" }),
-      makeDependencyRow({ package_name: "lodash", node_id: "dep:npm:lodash" })
-    ];
-    const result = (0, import_serialization.serializeAll)(deps);
-    (0, import_vitest.expect)(result.components).toHaveLength(2);
-    (0, import_vitest.expect)(result.errors).toHaveLength(0);
-  });
-  (0, import_vitest.it)("should collect errors for failing nodes and continue with remaining", () => {
-    const deps = [
-      makeDependencyRow({ package_name: "express" }),
-      makeDependencyRow({ package_name: "bad-dep", ecosystem: "unsupported" }),
-      makeDependencyRow({ package_name: "lodash" })
-    ];
-    const result = (0, import_serialization.serializeAll)(deps);
-    (0, import_vitest.expect)(result.components).toHaveLength(2);
-    (0, import_vitest.expect)(result.errors).toHaveLength(1);
-    (0, import_vitest.expect)(result.errors[0].name).toBe("bad-dep");
-    (0, import_vitest.expect)(result.errors[0].reason).toContain("Unsupported ecosystem");
-  });
-  (0, import_vitest.it)("should handle empty input", () => {
-    const result = (0, import_serialization.serializeAll)([]);
-    (0, import_vitest.expect)(result.components).toHaveLength(0);
-    (0, import_vitest.expect)(result.errors).toHaveLength(0);
-  });
-  (0, import_vitest.it)("should handle all failures gracefully", () => {
-    const deps = [
-      makeDependencyRow({ ecosystem: "unknown1", package_name: "a" }),
-      makeDependencyRow({ ecosystem: "unknown2", package_name: "b" })
-    ];
-    const result = (0, import_serialization.serializeAll)(deps);
-    (0, import_vitest.expect)(result.components).toHaveLength(0);
-    (0, import_vitest.expect)(result.errors).toHaveLength(2);
-  });
-});
-(0, import_vitest.describe)("deserializeAll", () => {
-  (0, import_vitest.it)("should deserialize all valid components", () => {
-    const components = [
-      { type: "library", name: "express", version: "4.18.2", purl: "pkg:npm/express@4.18.2" },
-      { type: "library", name: "lodash", version: "4.17.21", purl: "pkg:npm/lodash@4.17.21" }
-    ];
-    const result = (0, import_serialization.deserializeAll)(components);
-    (0, import_vitest.expect)(result.deps).toHaveLength(2);
-    (0, import_vitest.expect)(result.errors).toHaveLength(0);
-  });
-  (0, import_vitest.it)("should collect errors for failing components and continue with remaining", () => {
-    const components = [
-      { type: "library", name: "express", version: "4.18.2", purl: "pkg:npm/express@4.18.2" },
-      { type: "library", name: "bad", version: "1.0.0", purl: "invalid-purl" },
-      { type: "library", name: "lodash", version: "4.17.21", purl: "pkg:npm/lodash@4.17.21" }
-    ];
-    const result = (0, import_serialization.deserializeAll)(components);
-    (0, import_vitest.expect)(result.deps).toHaveLength(2);
-    (0, import_vitest.expect)(result.errors).toHaveLength(1);
-    (0, import_vitest.expect)(result.errors[0].name).toBe("bad");
-    (0, import_vitest.expect)(result.errors[0].reason).toContain("Invalid purl format");
-  });
-  (0, import_vitest.it)("should handle empty input", () => {
-    const result = (0, import_serialization.deserializeAll)([]);
-    (0, import_vitest.expect)(result.deps).toHaveLength(0);
-    (0, import_vitest.expect)(result.errors).toHaveLength(0);
-  });
-  (0, import_vitest.it)("should handle all failures gracefully", () => {
-    const components = [
-      { type: "library", name: "a", version: "1.0", purl: "bad1" },
-      { type: "library", name: "b", version: "2.0", purl: "bad2" }
-    ];
-    const result = (0, import_serialization.deserializeAll)(components);
-    (0, import_vitest.expect)(result.deps).toHaveLength(0);
-    (0, import_vitest.expect)(result.errors).toHaveLength(2);
-  });
-});
-//# sourceMappingURL=serialization.test.js.map