kirograph 0.19.0 → 0.20.0

package/dist/security/integrator.test.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../src/security/integrator.test.ts"],
-  "sourcesContent": ["/**\n * Tests for DependencyGraphIntegrator.cleanup()\n *\n * Verifies that orphaned Dependency_Nodes are correctly identified and removed\n * when their source manifests no longer exist on disk or when they have no\n * declared_in edges.\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { DependencyGraphIntegrator } from './integrator';\nimport { GraphDatabase } from '../db/database';\nimport type { Node, Edge } from '../types';\n\ndescribe('DependencyGraphIntegrator.cleanup()', () => {\n  let db: GraphDatabase;\n  let integrator: DependencyGraphIntegrator;\n  let tmpDir: string;\n  const projectRoot = '/tmp/test-project';\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kirograph-integrator-test-'));\n    db = new GraphDatabase(tmpDir);\n    db.applySecuritySchema();\n    integrator = new DependencyGraphIntegrator(db, projectRoot);\n  });\n\n  afterEach(() => {\n    db.close();\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  function createDependencyNode(\n    name: string,\n    ecosystem: string,\n    sourceManifests: string[],\n    options?: { addDeclaredInEdge?: boolean },\n  ): string {\n    const nodeId = `dep:${ecosystem}:${name}`;\n    const rawDb = db.getRawDb();\n\n    const node: Node = {\n      id: nodeId,\n      kind: 'dependency',\n      name,\n      qualifiedName: `${ecosystem}/${name}`,\n      filePath: sourceManifests[0] ?? '',\n      language: 'unknown',\n      startLine: 0,\n      endLine: 0,\n      startColumn: 0,\n      endColumn: 0,\n      isExported: false,\n      isAsync: false,\n      isStatic: false,\n      isAbstract: false,\n      updatedAt: Date.now(),\n    };\n\n    db.upsertNode(node);\n\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_dependencies\n        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n       VALUES (?, ?, ?, ?, ?, ?, ?)`,\n      [nodeId, ecosystem, name, '^1.0.0', '1.0.0', 'production', JSON.stringify(sourceManifests)],\n    );\n\n    // Optionally add declared_in edge (simulates a manifest that still declares this dep)\n    if (options?.addDeclaredInEdge !== false) {\n      for (const manifest of sourceManifests) {\n        const edge: Edge = {\n          source: nodeId,\n          target: manifest,\n          kind: 'declared_in',\n        };\n        db.insertEdge(edge);\n      }\n    }\n\n    return nodeId;\n  }\n\n  function createEdge(source: string, target: string, kind: string): void {\n    const edge: Edge = {\n      source,\n      target,\n      kind: kind as Edge['kind'],\n    };\n    db.insertEdge(edge);\n  }\n\n  it('should return zero counts when no dependencies exist', async () => {\n    const result = await integrator.cleanup(() => true);\n    expect(result.nodesRemoved).toBe(0);\n    expect(result.edgesRemoved).toBe(0);\n  });\n\n  it('should not remove dependencies whose manifests still exist and have declared_in edges', async () => {\n    const manifestPath = 'package.json';\n    const nodeId = createDependencyNode('express', 'npm', [manifestPath]);\n\n    const manifestExists = () => true;\n\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(0);\n    expect(result.edgesRemoved).toBe(0);\n\n    const node = db.getNode(nodeId);\n    expect(node).not.toBeNull();\n  });\n\n  it('should remove dependencies with no declared_in edges', async () => {\n    const manifestPath = 'package.json';\n    const nodeId = createDependencyNode('express', 'npm', [manifestPath], {\n      addDeclaredInEdge: false,\n    });\n\n    const manifestExists = () => true;\n\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(1);\n\n    const node = db.getNode(nodeId);\n    expect(node).toBeNull();\n  });\n\n  it('should remove dependencies whose manifests no longer exist on disk', async () => {\n    const manifestPath = 'package.json';\n    const nodeId = createDependencyNode('express', 'npm', [manifestPath]);\n\n    const manifestExists = () => false;\n\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(1);\n\n    const node = db.getNode(nodeId);\n    expect(node).toBeNull();\n  });\n\n  it('should remove edges connected to orphaned nodes', async () => {\n    const manifestPath = 'package.json';\n    const depNodeId = createDependencyNode('lodash', 'npm', [manifestPath], {\n      addDeclaredInEdge: false,\n    });\n\n    const codeNode: Node = {\n      id: 'file:src/index.ts:import:lodash',\n      kind: 'import',\n      name: 'lodash',\n      qualifiedName: 'src/index.ts:lodash',\n      filePath: 'src/index.ts',\n      language: 'typescript',\n      startLine: 1,\n      endLine: 1,\n      startColumn: 0,\n      endColumn: 20,\n      updatedAt: Date.now(),\n    };\n    db.upsertNode(codeNode);\n    createEdge(codeNode.id, depNodeId, 'imports');\n\n    const manifestExists = () => true;\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(1);\n    expect(result.edgesRemoved).toBe(1);\n  });\n\n  it('should keep dependency if at least one source manifest exists on disk', async () => {\n    const manifests = ['packages/a/package.json', 'packages/b/package.json'];\n    const nodeId = createDependencyNode('react', 'npm', manifests);\n\n    const manifestExists = (p: string) => p.includes('packages/a/package.json');\n\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(0);\n\n    const node = db.getNode(nodeId);\n    expect(node).not.toBeNull();\n  });\n\n  it('should remove transitive dependencies no longer reachable from direct deps', async () => {\n    const manifest = 'package.json';\n\n    // Direct dependency (manifest exists, has declared_in edge)\n    const directId = createDependencyNode('express', 'npm', [manifest]);\n\n    // Transitive dependency reachable from express\n    const reachableTransId = createDependencyNode('accepts', 'npm', [manifest]);\n    createEdge(directId, reachableTransId, 'depends_on');\n\n    // Orphaned direct dependency (no declared_in edge)\n    const orphanedDirectId = createDependencyNode('lodash', 'npm', ['old-package.json'], {\n      addDeclaredInEdge: false,\n    });\n\n    // Transitive dependency ONLY reachable from orphaned direct (no declared_in edge)\n    const unreachableTransId = createDependencyNode('lodash.merge', 'npm', ['old-package.json'], {\n      addDeclaredInEdge: false,\n    });\n    createEdge(orphanedDirectId, unreachableTransId, 'depends_on');\n\n    const manifestExists = () => true;\n\n    const result = await integrator.cleanup(manifestExists);\n\n    // lodash and lodash.merge should be removed\n    expect(result.nodesRemoved).toBe(2);\n\n    // express and accepts should remain\n    expect(db.getNode(directId)).not.toBeNull();\n    expect(db.getNode(reachableTransId)).not.toBeNull();\n\n    // orphaned nodes should be gone\n    expect(db.getNode(orphanedDirectId)).toBeNull();\n    expect(db.getNode(unreachableTransId)).toBeNull();\n  });\n\n  it('should handle transitive chains correctly \u2014 all reachable from direct dep', async () => {\n    const manifest = 'package.json';\n\n    const directId = createDependencyNode('express', 'npm', [manifest]);\n\n    // Chain: express \u2192 body-parser \u2192 raw-body \u2192 bytes\n    const bp = createDependencyNode('body-parser', 'npm', [manifest]);\n    const rb = createDependencyNode('raw-body', 'npm', [manifest]);\n    const bytes = createDependencyNode('bytes', 'npm', [manifest]);\n\n    createEdge(directId, bp, 'depends_on');\n    createEdge(bp, rb, 'depends_on');\n    createEdge(rb, bytes, 'depends_on');\n\n    const manifestExists = () => true;\n\n    const result = await integrator.cleanup(manifestExists);\n\n    expect(result.nodesRemoved).toBe(0);\n    expect(result.edgesRemoved).toBe(0);\n  });\n\n  it('should count edges correctly when multiple edges connect to orphaned node', async () => {\n    const orphanedManifest = 'removed/package.json';\n    const depId = createDependencyNode('old-pkg', 'npm', [orphanedManifest], {\n      addDeclaredInEdge: false,\n    });\n\n    const codeNode1: Node = {\n      id: 'node:a',\n      kind: 'function',\n      name: 'funcA',\n      qualifiedName: 'funcA',\n      filePath: 'src/a.ts',\n      language: 'typescript',\n      startLine: 1,\n      endLine: 5,\n      startColumn: 0,\n      endColumn: 0,\n      updatedAt: Date.now(),\n    };\n    const codeNode2: Node = {\n      id: 'node:b',\n      kind: 'function',\n      name: 'funcB',\n      qualifiedName: 'funcB',\n      filePath: 'src/b.ts',\n      language: 'typescript',\n      startLine: 1,\n      endLine: 5,\n      startColumn: 0,\n      endColumn: 0,\n      updatedAt: Date.now(),\n    };\n    db.upsertNode(codeNode1);\n    db.upsertNode(codeNode2);\n\n    createEdge(codeNode1.id, depId, 'imports');\n    createEdge(codeNode2.id, depId, 'references');\n    createEdge(depId, 'some-manifest', 'declared_in');\n\n    // No manifests exist on disk\n    const manifestExists = () => false;\n\n    const result = await integrator.cleanup(manifestExists);\n    expect(result.nodesRemoved).toBe(1);\n    // 2 incoming (imports, references) + 1 outgoing (declared_in) = 3\n    expect(result.edgesRemoved).toBe(3);\n  });\n});\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAOA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,wBAA0C;AAC1C,sBAA8B;AAAA,IAG9B,wBAAS,uCAAuC,MAAM;AACpD,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,QAAM,cAAc;AAEpB,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,4BAA4B,CAAC;AAC5E,SAAK,IAAI,8BAAc,MAAM;AAC7B,OAAG,oBAAoB;AACvB,iBAAa,IAAI,4CAA0B,IAAI,WAAW;AAAA,EAC5D,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,MAAM;AACT,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAED,WAAS,qBACP,MACA,WACA,iBACA,SACQ;AACR,UAAM,SAAS,OAAO,SAAS,IAAI,IAAI;AACvC,UAAM,QAAQ,GAAG,SAAS;AAE1B,UAAM,OAAa;AAAA,MACjB,IAAI;AAAA,MACJ,MAAM;AAAA,MACN;AAAA,MACA,eAAe,GAAG,SAAS,IAAI,IAAI;AAAA,MACnC,UAAU,gBAAgB,CAAC,KAAK;AAAA,MAChC,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW,KAAK,IAAI;AAAA,IACtB;AAEA,OAAG,WAAW,IAAI;AAElB,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,QAAQ,WAAW,MAAM,UAAU,SAAS,cAAc,KAAK,UAAU,eAAe,CAAC;AAAA,IAC5F;AAGA,QAAI,SAAS,sBAAsB,OAAO;AACxC,iBAAW,YAAY,iBAAiB;AACtC,cAAM,OAAa;AAAA,UACjB,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,MAAM;AAAA,QACR;AACA,WAAG,WAAW,IAAI;AAAA,MACpB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,WAAW,QAAgB,QAAgB,MAAoB;AACtE,UAAM,OAAa;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,OAAG,WAAW,IAAI;AAAA,EACpB;AAEA,wBAAG,wDAAwD,YAAY;AACrE,UAAM,SAAS,MAAM,WAAW,QAAQ,MAAM,IAAI;AAClD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAClC,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAAA,EACpC,CAAC;AAED,wBAAG,yFAAyF,YAAY;AACtG,UAAM,eAAe;AACrB,UAAM,SAAS,qBAAqB,WAAW,OAAO,CAAC,YAAY,CAAC;AAEpE,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAClC,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAElC,UAAM,OAAO,GAAG,QAAQ,MAAM;AAC9B,8BAAO,IAAI,EAAE,IAAI,SAAS;AAAA,EAC5B,CAAC;AAED,wBAAG,wDAAwD,YAAY;AACrE,UAAM,eAAe;AACrB,UAAM,SAAS,qBAAqB,WAAW,OAAO,CAAC,YAAY,GAAG;AAAA,MACpE,mBAAmB;AAAA,IACrB,CAAC;AAED,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAElC,UAAM,OAAO,GAAG,QAAQ,MAAM;AAC9B,8BAAO,IAAI,EAAE,SAAS;AAAA,EACxB,CAAC;AAED,wBAAG,sEAAsE,YAAY;AACnF,UAAM,eAAe;AACrB,UAAM,SAAS,qBAAqB,WAAW,OAAO,CAAC,YAAY,CAAC;AAEpE,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAElC,UAAM,OAAO,GAAG,QAAQ,MAAM;AAC9B,8BAAO,IAAI,EAAE,SAAS;AAAA,EACxB,CAAC;AAED,wBAAG,mDAAmD,YAAY;AAChE,UAAM,eAAe;AACrB,UAAM,YAAY,qBAAqB,UAAU,OAAO,CAAC,YAAY,GAAG;AAAA,MACtE,mBAAmB;AAAA,IACrB,CAAC;AAED,UAAM,WAAiB;AAAA,MACrB,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,eAAe;AAAA,MACf,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW,KAAK,IAAI;AAAA,IACtB;AACA,OAAG,WAAW,QAAQ;AACtB,eAAW,SAAS,IAAI,WAAW,SAAS;AAE5C,UAAM,iBAAiB,MAAM;AAC7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAClC,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAAA,EACpC,CAAC;AAED,wBAAG,yEAAyE,YAAY;AACtF,UAAM,YAAY,CAAC,2BAA2B,yBAAyB;AACvE,UAAM,SAAS,qBAAqB,SAAS,OAAO,SAAS;AAE7D,UAAM,iBAAiB,CAAC,MAAc,EAAE,SAAS,yBAAyB;AAE1E,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAElC,UAAM,OAAO,GAAG,QAAQ,MAAM;AAC9B,8BAAO,IAAI,EAAE,IAAI,SAAS;AAAA,EAC5B,CAAC;AAED,wBAAG,8EAA8E,YAAY;AAC3F,UAAM,WAAW;AAGjB,UAAM,WAAW,qBAAqB,WAAW,OAAO,CAAC,QAAQ,CAAC;AAGlE,UAAM,mBAAmB,qBAAqB,WAAW,OAAO,CAAC,QAAQ,CAAC;AAC1E,eAAW,UAAU,kBAAkB,YAAY;AAGnD,UAAM,mBAAmB,qBAAqB,UAAU,OAAO,CAAC,kBAAkB,GAAG;AAAA,MACnF,mBAAmB;AAAA,IACrB,CAAC;AAGD,UAAM,qBAAqB,qBAAqB,gBAAgB,OAAO,CAAC,kBAAkB,GAAG;AAAA,MAC3F,mBAAmB;AAAA,IACrB,CAAC;AACD,eAAW,kBAAkB,oBAAoB,YAAY;AAE7D,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AAGtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAGlC,8BAAO,GAAG,QAAQ,QAAQ,CAAC,EAAE,IAAI,SAAS;AAC1C,8BAAO,GAAG,QAAQ,gBAAgB,CAAC,EAAE,IAAI,SAAS;AAGlD,8BAAO,GAAG,QAAQ,gBAAgB,CAAC,EAAE,SAAS;AAC9C,8BAAO,GAAG,QAAQ,kBAAkB,CAAC,EAAE,SAAS;AAAA,EAClD,CAAC;AAED,wBAAG,kFAA6E,YAAY;AAC1F,UAAM,WAAW;AAEjB,UAAM,WAAW,qBAAqB,WAAW,OAAO,CAAC,QAAQ,CAAC;AAGlE,UAAM,KAAK,qBAAqB,eAAe,OAAO,CAAC,QAAQ,CAAC;AAChE,UAAM,KAAK,qBAAqB,YAAY,OAAO,CAAC,QAAQ,CAAC;AAC7D,UAAM,QAAQ,qBAAqB,SAAS,OAAO,CAAC,QAAQ,CAAC;AAE7D,eAAW,UAAU,IAAI,YAAY;AACrC,eAAW,IAAI,IAAI,YAAY;AAC/B,eAAW,IAAI,OAAO,YAAY;AAElC,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AAEtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAClC,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAAA,EACpC,CAAC;AAED,wBAAG,6EAA6E,YAAY;AAC1F,UAAM,mBAAmB;AACzB,UAAM,QAAQ,qBAAqB,WAAW,OAAO,CAAC,gBAAgB,GAAG;AAAA,MACvE,mBAAmB;AAAA,IACrB,CAAC;AAED,UAAM,YAAkB;AAAA,MACtB,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,eAAe;AAAA,MACf,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW,KAAK,IAAI;AAAA,IACtB;AACA,UAAM,YAAkB;AAAA,MACtB,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,eAAe;AAAA,MACf,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW,KAAK,IAAI;AAAA,IACtB;AACA,OAAG,WAAW,SAAS;AACvB,OAAG,WAAW,SAAS;AAEvB,eAAW,UAAU,IAAI,OAAO,SAAS;AACzC,eAAW,UAAU,IAAI,OAAO,YAAY;AAC5C,eAAW,OAAO,iBAAiB,aAAa;AAGhD,UAAM,iBAAiB,MAAM;AAE7B,UAAM,SAAS,MAAM,WAAW,QAAQ,cAAc;AACtD,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAElC,8BAAO,OAAO,YAAY,EAAE,KAAK,CAAC;AAAA,EACpC,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/security/manifest/adapter.test.js

@@ -1,272 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var import_vitest = require("vitest");
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
-var os = __toESM(require("os"));
-var import_adapter = require("./adapter");
-(0, import_vitest.describe)("SecurityManifestAdapter", () => {
-  let tmpDir;
-  (0, import_vitest.beforeEach)(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "sec-adapter-test-"));
-  });
-  (0, import_vitest.afterEach)(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-  (0, import_vitest.describe)("constructor", () => {
-    (0, import_vitest.it)("should initialize with architecture parsers", () => {
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const parsers = adapter.getArchParsers();
-      (0, import_vitest.expect)(parsers.length).toBeGreaterThan(0);
-      const names = parsers.map((p) => p.name);
-      (0, import_vitest.expect)(names).toContain("npm");
-      (0, import_vitest.expect)(names).toContain("cargo");
-      (0, import_vitest.expect)(names).toContain("go");
-      (0, import_vitest.expect)(names).toContain("maven");
-      (0, import_vitest.expect)(names).toContain("python");
-    });
-  });
-  (0, import_vitest.describe)("registerPlugin", () => {
-    (0, import_vitest.it)("should register and retrieve a version extraction plugin", () => {
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const plugin = {
-        ecosystem: "npm",
-        manifestFiles: ["package.json"],
-        canExtract: (p) => path.basename(p) === "package.json",
-        extract: async () => []
-      };
-      adapter.registerPlugin(plugin);
-      const plugins = adapter.getPlugins();
-      (0, import_vitest.expect)(plugins).toHaveLength(1);
-      (0, import_vitest.expect)(plugins[0].ecosystem).toBe("npm");
-    });
-    (0, import_vitest.it)("should overwrite plugin for same ecosystem", () => {
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const plugin1 = {
-        ecosystem: "npm",
-        manifestFiles: ["package.json"],
-        canExtract: () => true,
-        extract: async () => [{ name: "a", declaredConstraint: "1.0", scope: "production", ecosystem: "npm", sourceManifest: "package.json" }]
-      };
-      const plugin2 = {
-        ecosystem: "npm",
-        manifestFiles: ["package.json"],
-        canExtract: () => true,
-        extract: async () => [{ name: "b", declaredConstraint: "2.0", scope: "development", ecosystem: "npm", sourceManifest: "package.json" }]
-      };
-      adapter.registerPlugin(plugin1);
-      adapter.registerPlugin(plugin2);
-      const plugins = adapter.getPlugins();
-      (0, import_vitest.expect)(plugins).toHaveLength(1);
-      (0, import_vitest.expect)(plugins[0]).toBe(plugin2);
-    });
-  });
-  (0, import_vitest.describe)("discoverManifests", () => {
-    (0, import_vitest.it)("should discover package.json files", () => {
-      fs.writeFileSync(path.join(tmpDir, "package.json"), JSON.stringify({ name: "test", dependencies: { express: "^4.0.0" } }));
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const manifests = adapter.discoverManifests();
-      (0, import_vitest.expect)(manifests).toHaveLength(1);
-      (0, import_vitest.expect)(manifests[0]).toBe(path.join(tmpDir, "package.json"));
-    });
-    (0, import_vitest.it)("should discover nested manifest files", () => {
-      fs.mkdirSync(path.join(tmpDir, "sub"));
-      fs.writeFileSync(path.join(tmpDir, "package.json"), JSON.stringify({ name: "root" }));
-      fs.writeFileSync(path.join(tmpDir, "sub", "package.json"), JSON.stringify({ name: "sub" }));
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const manifests = adapter.discoverManifests();
-      (0, import_vitest.expect)(manifests).toHaveLength(2);
-    });
-    (0, import_vitest.it)("should skip node_modules directory", () => {
-      fs.mkdirSync(path.join(tmpDir, "node_modules"));
-      fs.writeFileSync(path.join(tmpDir, "node_modules", "package.json"), JSON.stringify({ name: "dep" }));
-      fs.writeFileSync(path.join(tmpDir, "package.json"), JSON.stringify({ name: "root" }));
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const manifests = adapter.discoverManifests();
-      (0, import_vitest.expect)(manifests).toHaveLength(1);
-      (0, import_vitest.expect)(manifests[0]).toBe(path.join(tmpDir, "package.json"));
-    });
-    (0, import_vitest.it)("should skip .git directory", () => {
-      fs.mkdirSync(path.join(tmpDir, ".git"));
-      fs.writeFileSync(path.join(tmpDir, ".git", "package.json"), JSON.stringify({ name: "git" }));
-      fs.writeFileSync(path.join(tmpDir, "package.json"), JSON.stringify({ name: "root" }));
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const manifests = adapter.discoverManifests();
-      (0, import_vitest.expect)(manifests).toHaveLength(1);
-    });
-    (0, import_vitest.it)("should skip dist and build directories", () => {
-      fs.mkdirSync(path.join(tmpDir, "dist"));
-      fs.mkdirSync(path.join(tmpDir, "build"));
-      fs.writeFileSync(path.join(tmpDir, "dist", "package.json"), JSON.stringify({ name: "dist" }));
-      fs.writeFileSync(path.join(tmpDir, "build", "package.json"), JSON.stringify({ name: "build" }));
-      fs.writeFileSync(path.join(tmpDir, "package.json"), JSON.stringify({ name: "root" }));
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const manifests = adapter.discoverManifests();
-      (0, import_vitest.expect)(manifests).toHaveLength(1);
-    });
-    (0, import_vitest.it)("should discover multiple ecosystem manifests", () => {
-      fs.writeFileSync(path.join(tmpDir, "package.json"), JSON.stringify({ name: "js-project" }));
-      fs.writeFileSync(path.join(tmpDir, "Cargo.toml"), '[package]\nname = "rust-project"\nversion = "0.1.0"');
-      fs.writeFileSync(path.join(tmpDir, "go.mod"), "module example.com/mymod\n\ngo 1.21");
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const manifests = adapter.discoverManifests();
-      (0, import_vitest.expect)(manifests).toHaveLength(3);
-    });
-    (0, import_vitest.it)("should return empty array for empty directory", () => {
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const manifests = adapter.discoverManifests();
-      (0, import_vitest.expect)(manifests).toHaveLength(0);
-    });
-  });
-  (0, import_vitest.describe)("getEcosystem", () => {
-    (0, import_vitest.it)("should return npm for package.json", () => {
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      (0, import_vitest.expect)(adapter.getEcosystem("/some/path/package.json")).toBe("npm");
-    });
-    (0, import_vitest.it)("should return cargo for Cargo.toml", () => {
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      (0, import_vitest.expect)(adapter.getEcosystem("/some/path/Cargo.toml")).toBe("cargo");
-    });
-    (0, import_vitest.it)("should return go for go.mod", () => {
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      (0, import_vitest.expect)(adapter.getEcosystem("/some/path/go.mod")).toBe("go");
-    });
-    (0, import_vitest.it)("should return maven for pom.xml", () => {
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      (0, import_vitest.expect)(adapter.getEcosystem("/some/path/pom.xml")).toBe("maven");
-    });
-    (0, import_vitest.it)("should return undefined for unknown files", () => {
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      (0, import_vitest.expect)(adapter.getEcosystem("/some/path/unknown.txt")).toBeUndefined();
-    });
-  });
-  (0, import_vitest.describe)("extractAll", () => {
-    (0, import_vitest.it)("should use registered plugin for extraction", async () => {
-      fs.writeFileSync(path.join(tmpDir, "package.json"), JSON.stringify({
-        name: "test-project",
-        dependencies: { express: "^4.18.0", lodash: "~4.17.21" },
-        devDependencies: { vitest: "^1.0.0" }
-      }));
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const mockDeps = [
-        { name: "express", declaredConstraint: "^4.18.0", scope: "production", ecosystem: "npm", sourceManifest: "package.json" },
-        { name: "lodash", declaredConstraint: "~4.17.21", scope: "production", ecosystem: "npm", sourceManifest: "package.json" },
-        { name: "vitest", declaredConstraint: "^1.0.0", scope: "development", ecosystem: "npm", sourceManifest: "package.json" }
-      ];
-      const plugin = {
-        ecosystem: "npm",
-        manifestFiles: ["package.json"],
-        canExtract: (p) => path.basename(p) === "package.json",
-        extract: async () => mockDeps
-      };
-      adapter.registerPlugin(plugin);
-      const result = await adapter.extractAll();
-      (0, import_vitest.expect)(result.dependenciesCreated).toBe(3);
-      (0, import_vitest.expect)(result.manifestsParsed).toBe(1);
-      (0, import_vitest.expect)(result.warnings).toHaveLength(0);
-      (0, import_vitest.expect)(result.errors).toHaveLength(0);
-    });
-    (0, import_vitest.it)("should fall back to architecture parser when no plugin registered", async () => {
-      fs.writeFileSync(path.join(tmpDir, "package.json"), JSON.stringify({
-        name: "test-project",
-        dependencies: { express: "^4.18.0", lodash: "~4.17.21" }
-      }));
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const result = await adapter.extractAll();
-      (0, import_vitest.expect)(result.dependenciesCreated).toBe(2);
-      (0, import_vitest.expect)(result.manifestsParsed).toBe(1);
-      (0, import_vitest.expect)(result.warnings.length).toBeGreaterThan(0);
-      (0, import_vitest.expect)(result.warnings[0].message).toContain("No version extraction plugin");
-    });
-    (0, import_vitest.it)("should handle plugin extraction errors gracefully", async () => {
-      fs.writeFileSync(path.join(tmpDir, "package.json"), JSON.stringify({
-        name: "test-project",
-        dependencies: { express: "^4.18.0" }
-      }));
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const plugin = {
-        ecosystem: "npm",
-        manifestFiles: ["package.json"],
-        canExtract: () => true,
-        extract: async () => {
-          throw new Error("Parse failed");
-        }
-      };
-      adapter.registerPlugin(plugin);
-      const result = await adapter.extractAll();
-      (0, import_vitest.expect)(result.dependenciesCreated).toBe(0);
-      (0, import_vitest.expect)(result.errors).toHaveLength(1);
-      (0, import_vitest.expect)(result.errors[0].message).toBe("Parse failed");
-    });
-    (0, import_vitest.it)("should handle empty project with no manifests", async () => {
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const result = await adapter.extractAll();
-      (0, import_vitest.expect)(result.dependenciesCreated).toBe(0);
-      (0, import_vitest.expect)(result.manifestsParsed).toBe(0);
-      (0, import_vitest.expect)(result.warnings).toHaveLength(0);
-      (0, import_vitest.expect)(result.errors).toHaveLength(0);
-    });
-  });
-  (0, import_vitest.describe)("extractFromManifest", () => {
-    (0, import_vitest.it)("should use plugin when available", async () => {
-      const manifestPath = path.join(tmpDir, "package.json");
-      fs.writeFileSync(manifestPath, JSON.stringify({
-        name: "test",
-        dependencies: { express: "^4.0.0" }
-      }));
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const expectedDeps = [
-        { name: "express", declaredConstraint: "^4.0.0", scope: "production", ecosystem: "npm", sourceManifest: "package.json" }
-      ];
-      adapter.registerPlugin({
-        ecosystem: "npm",
-        manifestFiles: ["package.json"],
-        canExtract: (p) => path.basename(p) === "package.json",
-        extract: async () => expectedDeps
-      });
-      const deps = await adapter.extractFromManifest(manifestPath);
-      (0, import_vitest.expect)(deps).toEqual(expectedDeps);
-    });
-    (0, import_vitest.it)("should fall back to architecture parser when no plugin", async () => {
-      const manifestPath = path.join(tmpDir, "package.json");
-      fs.writeFileSync(manifestPath, JSON.stringify({
-        name: "test",
-        dependencies: { express: "^4.0.0", lodash: "~4.17.0" }
-      }));
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const deps = await adapter.extractFromManifest(manifestPath);
-      (0, import_vitest.expect)(deps).toHaveLength(2);
-      (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("*");
-      (0, import_vitest.expect)(deps[0].scope).toBe("production");
-    });
-    (0, import_vitest.it)("should return empty array for unknown manifest type", async () => {
-      const manifestPath = path.join(tmpDir, "unknown.txt");
-      fs.writeFileSync(manifestPath, "some content");
-      const adapter = new import_adapter.SecurityManifestAdapter(tmpDir);
-      const deps = await adapter.extractFromManifest(manifestPath);
-      (0, import_vitest.expect)(deps).toHaveLength(0);
-    });
-  });
-});
-//# sourceMappingURL=adapter.test.js.map

package/dist/security/manifest/adapter.test.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/security/manifest/adapter.test.ts"],
-  "sourcesContent": ["/**\n * Unit tests for SecurityManifestAdapter\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { SecurityManifestAdapter, type VersionExtractionPlugin } from './adapter';\nimport type { ParsedDependency } from '../types';\n\ndescribe('SecurityManifestAdapter', () => {\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sec-adapter-test-'));\n  });\n\n  afterEach(() => {\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  describe('constructor', () => {\n    it('should initialize with architecture parsers', () => {\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const parsers = adapter.getArchParsers();\n      expect(parsers.length).toBeGreaterThan(0);\n      // Should include the known parsers\n      const names = parsers.map(p => p.name);\n      expect(names).toContain('npm');\n      expect(names).toContain('cargo');\n      expect(names).toContain('go');\n      expect(names).toContain('maven');\n      expect(names).toContain('python');\n    });\n  });\n\n  describe('registerPlugin', () => {\n    it('should register and retrieve a version extraction plugin', () => {\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const plugin: VersionExtractionPlugin = {\n        ecosystem: 'npm',\n        manifestFiles: ['package.json'],\n        canExtract: (p) => path.basename(p) === 'package.json',\n        extract: async () => [],\n      };\n      adapter.registerPlugin(plugin);\n      const plugins = adapter.getPlugins();\n      expect(plugins).toHaveLength(1);\n      expect(plugins[0].ecosystem).toBe('npm');\n    });\n\n    it('should overwrite plugin for same ecosystem', () => {\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const plugin1: VersionExtractionPlugin = {\n        ecosystem: 'npm',\n        manifestFiles: ['package.json'],\n        canExtract: () => true,\n        extract: async () => [{ name: 'a', declaredConstraint: '1.0', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' }],\n      };\n      const plugin2: VersionExtractionPlugin = {\n        ecosystem: 'npm',\n        manifestFiles: ['package.json'],\n        canExtract: () => true,\n        extract: async () => [{ name: 'b', declaredConstraint: '2.0', scope: 'development', ecosystem: 'npm', sourceManifest: 'package.json' }],\n      };\n      adapter.registerPlugin(plugin1);\n      adapter.registerPlugin(plugin2);\n      const plugins = adapter.getPlugins();\n      expect(plugins).toHaveLength(1);\n      expect(plugins[0]).toBe(plugin2);\n    });\n  });\n\n  describe('discoverManifests', () => {\n    it('should discover package.json files', () => {\n      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({ name: 'test', dependencies: { express: '^4.0.0' } }));\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const manifests = adapter.discoverManifests();\n      expect(manifests).toHaveLength(1);\n      expect(manifests[0]).toBe(path.join(tmpDir, 'package.json'));\n    });\n\n    it('should discover nested manifest files', () => {\n      fs.mkdirSync(path.join(tmpDir, 'sub'));\n      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({ name: 'root' }));\n      fs.writeFileSync(path.join(tmpDir, 'sub', 'package.json'), JSON.stringify({ name: 'sub' }));\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const manifests = adapter.discoverManifests();\n      expect(manifests).toHaveLength(2);\n    });\n\n    it('should skip node_modules directory', () => {\n      fs.mkdirSync(path.join(tmpDir, 'node_modules'));\n      fs.writeFileSync(path.join(tmpDir, 'node_modules', 'package.json'), JSON.stringify({ name: 'dep' }));\n      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({ name: 'root' }));\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const manifests = adapter.discoverManifests();\n      expect(manifests).toHaveLength(1);\n      expect(manifests[0]).toBe(path.join(tmpDir, 'package.json'));\n    });\n\n    it('should skip .git directory', () => {\n      fs.mkdirSync(path.join(tmpDir, '.git'));\n      fs.writeFileSync(path.join(tmpDir, '.git', 'package.json'), JSON.stringify({ name: 'git' }));\n      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({ name: 'root' }));\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const manifests = adapter.discoverManifests();\n      expect(manifests).toHaveLength(1);\n    });\n\n    it('should skip dist and build directories', () => {\n      fs.mkdirSync(path.join(tmpDir, 'dist'));\n      fs.mkdirSync(path.join(tmpDir, 'build'));\n      fs.writeFileSync(path.join(tmpDir, 'dist', 'package.json'), JSON.stringify({ name: 'dist' }));\n      fs.writeFileSync(path.join(tmpDir, 'build', 'package.json'), JSON.stringify({ name: 'build' }));\n      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({ name: 'root' }));\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const manifests = adapter.discoverManifests();\n      expect(manifests).toHaveLength(1);\n    });\n\n    it('should discover multiple ecosystem manifests', () => {\n      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({ name: 'js-project' }));\n      fs.writeFileSync(path.join(tmpDir, 'Cargo.toml'), '[package]\\nname = \"rust-project\"\\nversion = \"0.1.0\"');\n      fs.writeFileSync(path.join(tmpDir, 'go.mod'), 'module example.com/mymod\\n\\ngo 1.21');\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const manifests = adapter.discoverManifests();\n      expect(manifests).toHaveLength(3);\n    });\n\n    it('should return empty array for empty directory', () => {\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const manifests = adapter.discoverManifests();\n      expect(manifests).toHaveLength(0);\n    });\n  });\n\n  describe('getEcosystem', () => {\n    it('should return npm for package.json', () => {\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      expect(adapter.getEcosystem('/some/path/package.json')).toBe('npm');\n    });\n\n    it('should return cargo for Cargo.toml', () => {\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      expect(adapter.getEcosystem('/some/path/Cargo.toml')).toBe('cargo');\n    });\n\n    it('should return go for go.mod', () => {\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      expect(adapter.getEcosystem('/some/path/go.mod')).toBe('go');\n    });\n\n    it('should return maven for pom.xml', () => {\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      expect(adapter.getEcosystem('/some/path/pom.xml')).toBe('maven');\n    });\n\n    it('should return undefined for unknown files', () => {\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      expect(adapter.getEcosystem('/some/path/unknown.txt')).toBeUndefined();\n    });\n  });\n\n  describe('extractAll', () => {\n    it('should use registered plugin for extraction', async () => {\n      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({\n        name: 'test-project',\n        dependencies: { express: '^4.18.0', lodash: '~4.17.21' },\n        devDependencies: { vitest: '^1.0.0' },\n      }));\n\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const mockDeps: ParsedDependency[] = [\n        { name: 'express', declaredConstraint: '^4.18.0', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n        { name: 'lodash', declaredConstraint: '~4.17.21', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n        { name: 'vitest', declaredConstraint: '^1.0.0', scope: 'development', ecosystem: 'npm', sourceManifest: 'package.json' },\n      ];\n\n      const plugin: VersionExtractionPlugin = {\n        ecosystem: 'npm',\n        manifestFiles: ['package.json'],\n        canExtract: (p) => path.basename(p) === 'package.json',\n        extract: async () => mockDeps,\n      };\n      adapter.registerPlugin(plugin);\n\n      const result = await adapter.extractAll();\n      expect(result.dependenciesCreated).toBe(3);\n      expect(result.manifestsParsed).toBe(1);\n      expect(result.warnings).toHaveLength(0);\n      expect(result.errors).toHaveLength(0);\n    });\n\n    it('should fall back to architecture parser when no plugin registered', async () => {\n      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({\n        name: 'test-project',\n        dependencies: { express: '^4.18.0', lodash: '~4.17.21' },\n      }));\n\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const result = await adapter.extractAll();\n\n      // Should extract deps from architecture parser (names only)\n      expect(result.dependenciesCreated).toBe(2);\n      expect(result.manifestsParsed).toBe(1);\n      // Should warn about missing plugin\n      expect(result.warnings.length).toBeGreaterThan(0);\n      expect(result.warnings[0].message).toContain('No version extraction plugin');\n    });\n\n    it('should handle plugin extraction errors gracefully', async () => {\n      fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify({\n        name: 'test-project',\n        dependencies: { express: '^4.18.0' },\n      }));\n\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const plugin: VersionExtractionPlugin = {\n        ecosystem: 'npm',\n        manifestFiles: ['package.json'],\n        canExtract: () => true,\n        extract: async () => { throw new Error('Parse failed'); },\n      };\n      adapter.registerPlugin(plugin);\n\n      const result = await adapter.extractAll();\n      expect(result.dependenciesCreated).toBe(0);\n      expect(result.errors).toHaveLength(1);\n      expect(result.errors[0].message).toBe('Parse failed');\n    });\n\n    it('should handle empty project with no manifests', async () => {\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const result = await adapter.extractAll();\n      expect(result.dependenciesCreated).toBe(0);\n      expect(result.manifestsParsed).toBe(0);\n      expect(result.warnings).toHaveLength(0);\n      expect(result.errors).toHaveLength(0);\n    });\n  });\n\n  describe('extractFromManifest', () => {\n    it('should use plugin when available', async () => {\n      const manifestPath = path.join(tmpDir, 'package.json');\n      fs.writeFileSync(manifestPath, JSON.stringify({\n        name: 'test',\n        dependencies: { express: '^4.0.0' },\n      }));\n\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const expectedDeps: ParsedDependency[] = [\n        { name: 'express', declaredConstraint: '^4.0.0', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n      ];\n\n      adapter.registerPlugin({\n        ecosystem: 'npm',\n        manifestFiles: ['package.json'],\n        canExtract: (p) => path.basename(p) === 'package.json',\n        extract: async () => expectedDeps,\n      });\n\n      const deps = await adapter.extractFromManifest(manifestPath);\n      expect(deps).toEqual(expectedDeps);\n    });\n\n    it('should fall back to architecture parser when no plugin', async () => {\n      const manifestPath = path.join(tmpDir, 'package.json');\n      fs.writeFileSync(manifestPath, JSON.stringify({\n        name: 'test',\n        dependencies: { express: '^4.0.0', lodash: '~4.17.0' },\n      }));\n\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const deps = await adapter.extractFromManifest(manifestPath);\n      expect(deps).toHaveLength(2);\n      // Fallback uses '*' as constraint and 'production' as default scope\n      expect(deps[0].declaredConstraint).toBe('*');\n      expect(deps[0].scope).toBe('production');\n    });\n\n    it('should return empty array for unknown manifest type', async () => {\n      const manifestPath = path.join(tmpDir, 'unknown.txt');\n      fs.writeFileSync(manifestPath, 'some content');\n\n      const adapter = new SecurityManifestAdapter(tmpDir);\n      const deps = await adapter.extractFromManifest(manifestPath);\n      expect(deps).toHaveLength(0);\n    });\n  });\n});\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAGA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,qBAAsE;AAAA,IAGtE,wBAAS,2BAA2B,MAAM;AACxC,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,mBAAmB,CAAC;AAAA,EACrE,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAED,8BAAS,eAAe,MAAM;AAC5B,0BAAG,+CAA+C,MAAM;AACtD,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,UAAU,QAAQ,eAAe;AACvC,gCAAO,QAAQ,MAAM,EAAE,gBAAgB,CAAC;AAExC,YAAM,QAAQ,QAAQ,IAAI,OAAK,EAAE,IAAI;AACrC,gCAAO,KAAK,EAAE,UAAU,KAAK;AAC7B,gCAAO,KAAK,EAAE,UAAU,OAAO;AAC/B,gCAAO,KAAK,EAAE,UAAU,IAAI;AAC5B,gCAAO,KAAK,EAAE,UAAU,OAAO;AAC/B,gCAAO,KAAK,EAAE,UAAU,QAAQ;AAAA,IAClC,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,kBAAkB,MAAM;AAC/B,0BAAG,4DAA4D,MAAM;AACnE,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,SAAkC;AAAA,QACtC,WAAW;AAAA,QACX,eAAe,CAAC,cAAc;AAAA,QAC9B,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;AAAA,QACxC,SAAS,YAAY,CAAC;AAAA,MACxB;AACA,cAAQ,eAAe,MAAM;AAC7B,YAAM,UAAU,QAAQ,WAAW;AACnC,gCAAO,OAAO,EAAE,aAAa,CAAC;AAC9B,gCAAO,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,KAAK;AAAA,IACzC,CAAC;AAED,0BAAG,8CAA8C,MAAM;AACrD,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,UAAmC;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,CAAC,cAAc;AAAA,QAC9B,YAAY,MAAM;AAAA,QAClB,SAAS,YAAY,CAAC,EAAE,MAAM,KAAK,oBAAoB,OAAO,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe,CAAC;AAAA,MACvI;AACA,YAAM,UAAmC;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,CAAC,cAAc;AAAA,QAC9B,YAAY,MAAM;AAAA,QAClB,SAAS,YAAY,CAAC,EAAE,MAAM,KAAK,oBAAoB,OAAO,OAAO,eAAe,WAAW,OAAO,gBAAgB,eAAe,CAAC;AAAA,MACxI;AACA,cAAQ,eAAe,OAAO;AAC9B,cAAQ,eAAe,OAAO;AAC9B,YAAM,UAAU,QAAQ,WAAW;AACnC,gCAAO,OAAO,EAAE,aAAa,CAAC;AAC9B,gCAAO,QAAQ,CAAC,CAAC,EAAE,KAAK,OAAO;AAAA,IACjC,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,qBAAqB,MAAM;AAClC,0BAAG,sCAAsC,MAAM;AAC7C,SAAG,cAAc,KAAK,KAAK,QAAQ,cAAc,GAAG,KAAK,UAAU,EAAE,MAAM,QAAQ,cAAc,EAAE,SAAS,SAAS,EAAE,CAAC,CAAC;AACzH,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,YAAY,QAAQ,kBAAkB;AAC5C,gCAAO,SAAS,EAAE,aAAa,CAAC;AAChC,gCAAO,UAAU,CAAC,CAAC,EAAE,KAAK,KAAK,KAAK,QAAQ,cAAc,CAAC;AAAA,IAC7D,CAAC;AAED,0BAAG,yCAAyC,MAAM;AAChD,SAAG,UAAU,KAAK,KAAK,QAAQ,KAAK,CAAC;AACrC,SAAG,cAAc,KAAK,KAAK,QAAQ,cAAc,GAAG,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC;AACpF,SAAG,cAAc,KAAK,KAAK,QAAQ,OAAO,cAAc,GAAG,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC,CAAC;AAC1F,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,YAAY,QAAQ,kBAAkB;AAC5C,gCAAO,SAAS,EAAE,aAAa,CAAC;AAAA,IAClC,CAAC;AAED,0BAAG,sCAAsC,MAAM;AAC7C,SAAG,UAAU,KAAK,KAAK,QAAQ,cAAc,CAAC;AAC9C,SAAG,cAAc,KAAK,KAAK,QAAQ,gBAAgB,cAAc,GAAG,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC,CAAC;AACnG,SAAG,cAAc,KAAK,KAAK,QAAQ,cAAc,GAAG,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC;AACpF,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,YAAY,QAAQ,kBAAkB;AAC5C,gCAAO,SAAS,EAAE,aAAa,CAAC;AAChC,gCAAO,UAAU,CAAC,CAAC,EAAE,KAAK,KAAK,KAAK,QAAQ,cAAc,CAAC;AAAA,IAC7D,CAAC;AAED,0BAAG,8BAA8B,MAAM;AACrC,SAAG,UAAU,KAAK,KAAK,QAAQ,MAAM,CAAC;AACtC,SAAG,cAAc,KAAK,KAAK,QAAQ,QAAQ,cAAc,GAAG,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC,CAAC;AAC3F,SAAG,cAAc,KAAK,KAAK,QAAQ,cAAc,GAAG,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC;AACpF,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,YAAY,QAAQ,kBAAkB;AAC5C,gCAAO,SAAS,EAAE,aAAa,CAAC;AAAA,IAClC,CAAC;AAED,0BAAG,0CAA0C,MAAM;AACjD,SAAG,UAAU,KAAK,KAAK,QAAQ,MAAM,CAAC;AACtC,SAAG,UAAU,KAAK,KAAK,QAAQ,OAAO,CAAC;AACvC,SAAG,cAAc,KAAK,KAAK,QAAQ,QAAQ,cAAc,GAAG,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC;AAC5F,SAAG,cAAc,KAAK,KAAK,QAAQ,SAAS,cAAc,GAAG,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC,CAAC;AAC9F,SAAG,cAAc,KAAK,KAAK,QAAQ,cAAc,GAAG,KAAK,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC;AACpF,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,YAAY,QAAQ,kBAAkB;AAC5C,gCAAO,SAAS,EAAE,aAAa,CAAC;AAAA,IAClC,CAAC;AAED,0BAAG,gDAAgD,MAAM;AACvD,SAAG,cAAc,KAAK,KAAK,QAAQ,cAAc,GAAG,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC,CAAC;AAC1F,SAAG,cAAc,KAAK,KAAK,QAAQ,YAAY,GAAG,qDAAqD;AACvG,SAAG,cAAc,KAAK,KAAK,QAAQ,QAAQ,GAAG,qCAAqC;AACnF,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,YAAY,QAAQ,kBAAkB;AAC5C,gCAAO,SAAS,EAAE,aAAa,CAAC;AAAA,IAClC,CAAC;AAED,0BAAG,iDAAiD,MAAM;AACxD,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,YAAY,QAAQ,kBAAkB;AAC5C,gCAAO,SAAS,EAAE,aAAa,CAAC;AAAA,IAClC,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,gBAAgB,MAAM;AAC7B,0BAAG,sCAAsC,MAAM;AAC7C,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,gCAAO,QAAQ,aAAa,yBAAyB,CAAC,EAAE,KAAK,KAAK;AAAA,IACpE,CAAC;AAED,0BAAG,sCAAsC,MAAM;AAC7C,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,gCAAO,QAAQ,aAAa,uBAAuB,CAAC,EAAE,KAAK,OAAO;AAAA,IACpE,CAAC;AAED,0BAAG,+BAA+B,MAAM;AACtC,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,gCAAO,QAAQ,aAAa,mBAAmB,CAAC,EAAE,KAAK,IAAI;AAAA,IAC7D,CAAC;AAED,0BAAG,mCAAmC,MAAM;AAC1C,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,gCAAO,QAAQ,aAAa,oBAAoB,CAAC,EAAE,KAAK,OAAO;AAAA,IACjE,CAAC;AAED,0BAAG,6CAA6C,MAAM;AACpD,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,gCAAO,QAAQ,aAAa,wBAAwB,CAAC,EAAE,cAAc;AAAA,IACvE,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,cAAc,MAAM;AAC3B,0BAAG,+CAA+C,YAAY;AAC5D,SAAG,cAAc,KAAK,KAAK,QAAQ,cAAc,GAAG,KAAK,UAAU;AAAA,QACjE,MAAM;AAAA,QACN,cAAc,EAAE,SAAS,WAAW,QAAQ,WAAW;AAAA,QACvD,iBAAiB,EAAE,QAAQ,SAAS;AAAA,MACtC,CAAC,CAAC;AAEF,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,WAA+B;AAAA,QACnC,EAAE,MAAM,WAAW,oBAAoB,WAAW,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,QACxH,EAAE,MAAM,UAAU,oBAAoB,YAAY,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,QACxH,EAAE,MAAM,UAAU,oBAAoB,UAAU,OAAO,eAAe,WAAW,OAAO,gBAAgB,eAAe;AAAA,MACzH;AAEA,YAAM,SAAkC;AAAA,QACtC,WAAW;AAAA,QACX,eAAe,CAAC,cAAc;AAAA,QAC9B,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;AAAA,QACxC,SAAS,YAAY;AAAA,MACvB;AACA,cAAQ,eAAe,MAAM;AAE7B,YAAM,SAAS,MAAM,QAAQ,WAAW;AACxC,gCAAO,OAAO,mBAAmB,EAAE,KAAK,CAAC;AACzC,gCAAO,OAAO,eAAe,EAAE,KAAK,CAAC;AACrC,gCAAO,OAAO,QAAQ,EAAE,aAAa,CAAC;AACtC,gCAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AAAA,IACtC,CAAC;AAED,0BAAG,qEAAqE,YAAY;AAClF,SAAG,cAAc,KAAK,KAAK,QAAQ,cAAc,GAAG,KAAK,UAAU;AAAA,QACjE,MAAM;AAAA,QACN,cAAc,EAAE,SAAS,WAAW,QAAQ,WAAW;AAAA,MACzD,CAAC,CAAC;AAEF,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,SAAS,MAAM,QAAQ,WAAW;AAGxC,gCAAO,OAAO,mBAAmB,EAAE,KAAK,CAAC;AACzC,gCAAO,OAAO,eAAe,EAAE,KAAK,CAAC;AAErC,gCAAO,OAAO,SAAS,MAAM,EAAE,gBAAgB,CAAC;AAChD,gCAAO,OAAO,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,8BAA8B;AAAA,IAC7E,CAAC;AAED,0BAAG,qDAAqD,YAAY;AAClE,SAAG,cAAc,KAAK,KAAK,QAAQ,cAAc,GAAG,KAAK,UAAU;AAAA,QACjE,MAAM;AAAA,QACN,cAAc,EAAE,SAAS,UAAU;AAAA,MACrC,CAAC,CAAC;AAEF,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,SAAkC;AAAA,QACtC,WAAW;AAAA,QACX,eAAe,CAAC,cAAc;AAAA,QAC9B,YAAY,MAAM;AAAA,QAClB,SAAS,YAAY;AAAE,gBAAM,IAAI,MAAM,cAAc;AAAA,QAAG;AAAA,MAC1D;AACA,cAAQ,eAAe,MAAM;AAE7B,YAAM,SAAS,MAAM,QAAQ,WAAW;AACxC,gCAAO,OAAO,mBAAmB,EAAE,KAAK,CAAC;AACzC,gCAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AACpC,gCAAO,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,cAAc;AAAA,IACtD,CAAC;AAED,0BAAG,iDAAiD,YAAY;AAC9D,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,SAAS,MAAM,QAAQ,WAAW;AACxC,gCAAO,OAAO,mBAAmB,EAAE,KAAK,CAAC;AACzC,gCAAO,OAAO,eAAe,EAAE,KAAK,CAAC;AACrC,gCAAO,OAAO,QAAQ,EAAE,aAAa,CAAC;AACtC,gCAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AAAA,IACtC,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,uBAAuB,MAAM;AACpC,0BAAG,oCAAoC,YAAY;AACjD,YAAM,eAAe,KAAK,KAAK,QAAQ,cAAc;AACrD,SAAG,cAAc,cAAc,KAAK,UAAU;AAAA,QAC5C,MAAM;AAAA,QACN,cAAc,EAAE,SAAS,SAAS;AAAA,MACpC,CAAC,CAAC;AAEF,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,eAAmC;AAAA,QACvC,EAAE,MAAM,WAAW,oBAAoB,UAAU,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,MACzH;AAEA,cAAQ,eAAe;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,CAAC,cAAc;AAAA,QAC9B,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;AAAA,QACxC,SAAS,YAAY;AAAA,MACvB,CAAC;AAED,YAAM,OAAO,MAAM,QAAQ,oBAAoB,YAAY;AAC3D,gCAAO,IAAI,EAAE,QAAQ,YAAY;AAAA,IACnC,CAAC;AAED,0BAAG,0DAA0D,YAAY;AACvE,YAAM,eAAe,KAAK,KAAK,QAAQ,cAAc;AACrD,SAAG,cAAc,cAAc,KAAK,UAAU;AAAA,QAC5C,MAAM;AAAA,QACN,cAAc,EAAE,SAAS,UAAU,QAAQ,UAAU;AAAA,MACvD,CAAC,CAAC;AAEF,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,OAAO,MAAM,QAAQ,oBAAoB,YAAY;AAC3D,gCAAO,IAAI,EAAE,aAAa,CAAC;AAE3B,gCAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,GAAG;AAC3C,gCAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY;AAAA,IACzC,CAAC;AAED,0BAAG,uDAAuD,YAAY;AACpE,YAAM,eAAe,KAAK,KAAK,QAAQ,aAAa;AACpD,SAAG,cAAc,cAAc,cAAc;AAE7C,YAAM,UAAU,IAAI,uCAAwB,MAAM;AAClD,YAAM,OAAO,MAAM,QAAQ,oBAAoB,YAAY;AAC3D,gCAAO,IAAI,EAAE,aAAa,CAAC;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/security/manifest/parser.test.js

@@ -1,110 +0,0 @@
-"use strict";
-var import_vitest = require("vitest");
-var import_parser = require("./parser");
-(0, import_vitest.describe)("compareVersions", () => {
-  (0, import_vitest.it)("should compare simple semver versions", () => {
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.0.0", "2.0.0")).toBeLessThan(0);
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("2.0.0", "1.0.0")).toBeGreaterThan(0);
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.0.0", "1.0.0")).toBe(0);
-  });
-  (0, import_vitest.it)("should compare versions with different patch levels", () => {
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.2.3", "1.2.4")).toBeLessThan(0);
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.2.10", "1.2.9")).toBeGreaterThan(0);
-  });
-  (0, import_vitest.it)("should compare versions with different minor levels", () => {
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.1.0", "1.2.0")).toBeLessThan(0);
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.10.0", "1.9.0")).toBeGreaterThan(0);
-  });
-  (0, import_vitest.it)("should handle versions with leading v", () => {
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("v1.2.3", "v1.2.4")).toBeLessThan(0);
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("v2.0.0", "1.0.0")).toBeGreaterThan(0);
-  });
-  (0, import_vitest.it)("should handle constraint prefixes (^, ~, >=)", () => {
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("^1.2.3", "^1.2.4")).toBeLessThan(0);
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("~2.0.0", "~1.0.0")).toBeGreaterThan(0);
-    (0, import_vitest.expect)((0, import_parser.compareVersions)(">=1.0.0", ">=2.0.0")).toBeLessThan(0);
-  });
-  (0, import_vitest.it)("should handle versions with different segment counts", () => {
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.2", "1.2.1")).toBeLessThan(0);
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.2.0", "1.2")).toBe(0);
-  });
-  (0, import_vitest.it)("should handle wildcard constraint as lowest", () => {
-    (0, import_vitest.expect)((0, import_parser.compareVersions)("1.0.0", "*")).toBeGreaterThan(0);
-  });
-});
-(0, import_vitest.describe)("deduplicateDependencies", () => {
-  (0, import_vitest.it)("should return unique dependencies when no duplicates exist", () => {
-    const deps = [
-      { name: "express", declaredConstraint: "^4.18.0", resolvedVersion: "4.18.2", scope: "production", ecosystem: "npm", sourceManifest: "package.json" },
-      { name: "lodash", declaredConstraint: "^4.17.0", resolvedVersion: "4.17.21", scope: "production", ecosystem: "npm", sourceManifest: "package.json" }
-    ];
-    const result = (0, import_parser.deduplicateDependencies)(deps);
-    (0, import_vitest.expect)(result).toHaveLength(2);
-  });
-  (0, import_vitest.it)("should deduplicate same (name, ecosystem) keeping highest version", () => {
-    const deps = [
-      { name: "express", declaredConstraint: "^4.17.0", resolvedVersion: "4.17.1", scope: "production", ecosystem: "npm", sourceManifest: "packages/a/package.json" },
-      { name: "express", declaredConstraint: "^4.18.0", resolvedVersion: "4.18.2", scope: "production", ecosystem: "npm", sourceManifest: "packages/b/package.json" }
-    ];
-    const result = (0, import_parser.deduplicateDependencies)(deps);
-    (0, import_vitest.expect)(result).toHaveLength(1);
-    (0, import_vitest.expect)(result[0].name).toBe("express");
-    (0, import_vitest.expect)(result[0].resolvedVersion).toBe("4.18.2");
-    (0, import_vitest.expect)(result[0].declaredConstraint).toBe("^4.18.0");
-    (0, import_vitest.expect)(result[0].sourceManifests).toEqual(["packages/a/package.json", "packages/b/package.json"]);
-  });
-  (0, import_vitest.it)("should keep both when same name but different ecosystems", () => {
-    const deps = [
-      { name: "serde", declaredConstraint: "1.0.0", resolvedVersion: "1.0.0", scope: "production", ecosystem: "cargo", sourceManifest: "Cargo.toml" },
-      { name: "serde", declaredConstraint: "1.0.0", resolvedVersion: "1.0.0", scope: "production", ecosystem: "npm", sourceManifest: "package.json" }
-    ];
-    const result = (0, import_parser.deduplicateDependencies)(deps);
-    (0, import_vitest.expect)(result).toHaveLength(2);
-  });
-  (0, import_vitest.it)("should collect all source manifests for duplicates", () => {
-    const deps = [
-      { name: "lodash", declaredConstraint: "^4.17.0", resolvedVersion: "4.17.21", scope: "production", ecosystem: "npm", sourceManifest: "package.json" },
-      { name: "lodash", declaredConstraint: "^4.17.0", resolvedVersion: "4.17.21", scope: "development", ecosystem: "npm", sourceManifest: "packages/lib/package.json" },
-      { name: "lodash", declaredConstraint: "^4.17.0", resolvedVersion: "4.17.21", scope: "production", ecosystem: "npm", sourceManifest: "packages/app/package.json" }
-    ];
-    const result = (0, import_parser.deduplicateDependencies)(deps);
-    (0, import_vitest.expect)(result).toHaveLength(1);
-    (0, import_vitest.expect)(result[0].sourceManifests).toHaveLength(3);
-    (0, import_vitest.expect)(result[0].sourceManifests).toContain("package.json");
-    (0, import_vitest.expect)(result[0].sourceManifests).toContain("packages/lib/package.json");
-    (0, import_vitest.expect)(result[0].sourceManifests).toContain("packages/app/package.json");
-  });
-  (0, import_vitest.it)("should not duplicate source manifests when same manifest appears twice", () => {
-    const deps = [
-      { name: "express", declaredConstraint: "^4.17.0", scope: "production", ecosystem: "npm", sourceManifest: "package.json" },
-      { name: "express", declaredConstraint: "^4.18.0", scope: "production", ecosystem: "npm", sourceManifest: "package.json" }
-    ];
-    const result = (0, import_parser.deduplicateDependencies)(deps);
-    (0, import_vitest.expect)(result).toHaveLength(1);
-    (0, import_vitest.expect)(result[0].sourceManifests).toEqual(["package.json"]);
-  });
-  (0, import_vitest.it)("should use declaredConstraint for comparison when resolvedVersion is missing", () => {
-    const deps = [
-      { name: "django", declaredConstraint: "3.2.0", scope: "production", ecosystem: "python", sourceManifest: "requirements.txt" },
-      { name: "django", declaredConstraint: "4.2.0", scope: "production", ecosystem: "python", sourceManifest: "packages/api/requirements.txt" }
-    ];
-    const result = (0, import_parser.deduplicateDependencies)(deps);
-    (0, import_vitest.expect)(result).toHaveLength(1);
-    (0, import_vitest.expect)(result[0].declaredConstraint).toBe("4.2.0");
-  });
-  (0, import_vitest.it)("should handle empty input", () => {
-    const result = (0, import_parser.deduplicateDependencies)([]);
-    (0, import_vitest.expect)(result).toHaveLength(0);
-  });
-  (0, import_vitest.it)("should prefer resolvedVersion over declaredConstraint for comparison", () => {
-    const deps = [
-      { name: "express", declaredConstraint: "^4.0.0", resolvedVersion: "4.18.2", scope: "production", ecosystem: "npm", sourceManifest: "a/package.json" },
-      { name: "express", declaredConstraint: "^5.0.0", resolvedVersion: "5.0.0", scope: "production", ecosystem: "npm", sourceManifest: "b/package.json" }
-    ];
-    const result = (0, import_parser.deduplicateDependencies)(deps);
-    (0, import_vitest.expect)(result).toHaveLength(1);
-    (0, import_vitest.expect)(result[0].resolvedVersion).toBe("5.0.0");
-    (0, import_vitest.expect)(result[0].declaredConstraint).toBe("^5.0.0");
-  });
-});
-//# sourceMappingURL=parser.test.js.map

package/dist/security/manifest/parser.test.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/security/manifest/parser.test.ts"],
-  "sourcesContent": ["/**\n * Unit tests for ManifestParser orchestrator\n */\nimport { describe, it, expect } from 'vitest';\nimport { compareVersions, deduplicateDependencies } from './parser';\nimport type { ParsedDependency } from '../types';\n\ndescribe('compareVersions', () => {\n  it('should compare simple semver versions', () => {\n    expect(compareVersions('1.0.0', '2.0.0')).toBeLessThan(0);\n    expect(compareVersions('2.0.0', '1.0.0')).toBeGreaterThan(0);\n    expect(compareVersions('1.0.0', '1.0.0')).toBe(0);\n  });\n\n  it('should compare versions with different patch levels', () => {\n    expect(compareVersions('1.2.3', '1.2.4')).toBeLessThan(0);\n    expect(compareVersions('1.2.10', '1.2.9')).toBeGreaterThan(0);\n  });\n\n  it('should compare versions with different minor levels', () => {\n    expect(compareVersions('1.1.0', '1.2.0')).toBeLessThan(0);\n    expect(compareVersions('1.10.0', '1.9.0')).toBeGreaterThan(0);\n  });\n\n  it('should handle versions with leading v', () => {\n    expect(compareVersions('v1.2.3', 'v1.2.4')).toBeLessThan(0);\n    expect(compareVersions('v2.0.0', '1.0.0')).toBeGreaterThan(0);\n  });\n\n  it('should handle constraint prefixes (^, ~, >=)', () => {\n    expect(compareVersions('^1.2.3', '^1.2.4')).toBeLessThan(0);\n    expect(compareVersions('~2.0.0', '~1.0.0')).toBeGreaterThan(0);\n    expect(compareVersions('>=1.0.0', '>=2.0.0')).toBeLessThan(0);\n  });\n\n  it('should handle versions with different segment counts', () => {\n    expect(compareVersions('1.2', '1.2.1')).toBeLessThan(0);\n    expect(compareVersions('1.2.0', '1.2')).toBe(0);\n  });\n\n  it('should handle wildcard constraint as lowest', () => {\n    // '*' is not numeric, so it falls to lexicographic comparison\n    // but in practice we compare effective versions\n    expect(compareVersions('1.0.0', '*')).toBeGreaterThan(0);\n  });\n});\n\ndescribe('deduplicateDependencies', () => {\n  it('should return unique dependencies when no duplicates exist', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'express', declaredConstraint: '^4.18.0', resolvedVersion: '4.18.2', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n      { name: 'lodash', declaredConstraint: '^4.17.0', resolvedVersion: '4.17.21', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(2);\n  });\n\n  it('should deduplicate same (name, ecosystem) keeping highest version', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'express', declaredConstraint: '^4.17.0', resolvedVersion: '4.17.1', scope: 'production', ecosystem: 'npm', sourceManifest: 'packages/a/package.json' },\n      { name: 'express', declaredConstraint: '^4.18.0', resolvedVersion: '4.18.2', scope: 'production', ecosystem: 'npm', sourceManifest: 'packages/b/package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(1);\n    expect(result[0].name).toBe('express');\n    expect(result[0].resolvedVersion).toBe('4.18.2');\n    expect(result[0].declaredConstraint).toBe('^4.18.0');\n    expect(result[0].sourceManifests).toEqual(['packages/a/package.json', 'packages/b/package.json']);\n  });\n\n  it('should keep both when same name but different ecosystems', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'serde', declaredConstraint: '1.0.0', resolvedVersion: '1.0.0', scope: 'production', ecosystem: 'cargo', sourceManifest: 'Cargo.toml' },\n      { name: 'serde', declaredConstraint: '1.0.0', resolvedVersion: '1.0.0', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(2);\n  });\n\n  it('should collect all source manifests for duplicates', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'lodash', declaredConstraint: '^4.17.0', resolvedVersion: '4.17.21', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n      { name: 'lodash', declaredConstraint: '^4.17.0', resolvedVersion: '4.17.21', scope: 'development', ecosystem: 'npm', sourceManifest: 'packages/lib/package.json' },\n      { name: 'lodash', declaredConstraint: '^4.17.0', resolvedVersion: '4.17.21', scope: 'production', ecosystem: 'npm', sourceManifest: 'packages/app/package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(1);\n    expect(result[0].sourceManifests).toHaveLength(3);\n    expect(result[0].sourceManifests).toContain('package.json');\n    expect(result[0].sourceManifests).toContain('packages/lib/package.json');\n    expect(result[0].sourceManifests).toContain('packages/app/package.json');\n  });\n\n  it('should not duplicate source manifests when same manifest appears twice', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'express', declaredConstraint: '^4.17.0', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n      { name: 'express', declaredConstraint: '^4.18.0', scope: 'production', ecosystem: 'npm', sourceManifest: 'package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(1);\n    expect(result[0].sourceManifests).toEqual(['package.json']);\n  });\n\n  it('should use declaredConstraint for comparison when resolvedVersion is missing', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'django', declaredConstraint: '3.2.0', scope: 'production', ecosystem: 'python', sourceManifest: 'requirements.txt' },\n      { name: 'django', declaredConstraint: '4.2.0', scope: 'production', ecosystem: 'python', sourceManifest: 'packages/api/requirements.txt' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(1);\n    expect(result[0].declaredConstraint).toBe('4.2.0');\n  });\n\n  it('should handle empty input', () => {\n    const result = deduplicateDependencies([]);\n    expect(result).toHaveLength(0);\n  });\n\n  it('should prefer resolvedVersion over declaredConstraint for comparison', () => {\n    const deps: ParsedDependency[] = [\n      { name: 'express', declaredConstraint: '^4.0.0', resolvedVersion: '4.18.2', scope: 'production', ecosystem: 'npm', sourceManifest: 'a/package.json' },\n      { name: 'express', declaredConstraint: '^5.0.0', resolvedVersion: '5.0.0', scope: 'production', ecosystem: 'npm', sourceManifest: 'b/package.json' },\n    ];\n\n    const result = deduplicateDependencies(deps);\n    expect(result).toHaveLength(1);\n    expect(result[0].resolvedVersion).toBe('5.0.0');\n    expect(result[0].declaredConstraint).toBe('^5.0.0');\n  });\n});\n"],
-  "mappings": ";AAGA,oBAAqC;AACrC,oBAAyD;AAAA,IAGzD,wBAAS,mBAAmB,MAAM;AAChC,wBAAG,yCAAyC,MAAM;AAChD,kCAAO,+BAAgB,SAAS,OAAO,CAAC,EAAE,aAAa,CAAC;AACxD,kCAAO,+BAAgB,SAAS,OAAO,CAAC,EAAE,gBAAgB,CAAC;AAC3D,kCAAO,+BAAgB,SAAS,OAAO,CAAC,EAAE,KAAK,CAAC;AAAA,EAClD,CAAC;AAED,wBAAG,uDAAuD,MAAM;AAC9D,kCAAO,+BAAgB,SAAS,OAAO,CAAC,EAAE,aAAa,CAAC;AACxD,kCAAO,+BAAgB,UAAU,OAAO,CAAC,EAAE,gBAAgB,CAAC;AAAA,EAC9D,CAAC;AAED,wBAAG,uDAAuD,MAAM;AAC9D,kCAAO,+BAAgB,SAAS,OAAO,CAAC,EAAE,aAAa,CAAC;AACxD,kCAAO,+BAAgB,UAAU,OAAO,CAAC,EAAE,gBAAgB,CAAC;AAAA,EAC9D,CAAC;AAED,wBAAG,yCAAyC,MAAM;AAChD,kCAAO,+BAAgB,UAAU,QAAQ,CAAC,EAAE,aAAa,CAAC;AAC1D,kCAAO,+BAAgB,UAAU,OAAO,CAAC,EAAE,gBAAgB,CAAC;AAAA,EAC9D,CAAC;AAED,wBAAG,gDAAgD,MAAM;AACvD,kCAAO,+BAAgB,UAAU,QAAQ,CAAC,EAAE,aAAa,CAAC;AAC1D,kCAAO,+BAAgB,UAAU,QAAQ,CAAC,EAAE,gBAAgB,CAAC;AAC7D,kCAAO,+BAAgB,WAAW,SAAS,CAAC,EAAE,aAAa,CAAC;AAAA,EAC9D,CAAC;AAED,wBAAG,wDAAwD,MAAM;AAC/D,kCAAO,+BAAgB,OAAO,OAAO,CAAC,EAAE,aAAa,CAAC;AACtD,kCAAO,+BAAgB,SAAS,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EAChD,CAAC;AAED,wBAAG,+CAA+C,MAAM;AAGtD,kCAAO,+BAAgB,SAAS,GAAG,CAAC,EAAE,gBAAgB,CAAC;AAAA,EACzD,CAAC;AACH,CAAC;AAAA,IAED,wBAAS,2BAA2B,MAAM;AACxC,wBAAG,8DAA8D,MAAM;AACrE,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,WAAW,oBAAoB,WAAW,iBAAiB,UAAU,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,MACnJ,EAAE,MAAM,UAAU,oBAAoB,WAAW,iBAAiB,WAAW,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,IACrJ;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EAC/B,CAAC;AAED,wBAAG,qEAAqE,MAAM;AAC5E,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,WAAW,oBAAoB,WAAW,iBAAiB,UAAU,OAAO,cAAc,WAAW,OAAO,gBAAgB,0BAA0B;AAAA,MAC9J,EAAE,MAAM,WAAW,oBAAoB,WAAW,iBAAiB,UAAU,OAAO,cAAc,WAAW,OAAO,gBAAgB,0BAA0B;AAAA,IAChK;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS;AACrC,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,KAAK,QAAQ;AAC/C,8BAAO,OAAO,CAAC,EAAE,kBAAkB,EAAE,KAAK,SAAS;AACnD,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,2BAA2B,yBAAyB,CAAC;AAAA,EAClG,CAAC;AAED,wBAAG,4DAA4D,MAAM;AACnE,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,SAAS,oBAAoB,SAAS,iBAAiB,SAAS,OAAO,cAAc,WAAW,SAAS,gBAAgB,aAAa;AAAA,MAC9I,EAAE,MAAM,SAAS,oBAAoB,SAAS,iBAAiB,SAAS,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,IAChJ;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EAC/B,CAAC;AAED,wBAAG,sDAAsD,MAAM;AAC7D,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,UAAU,oBAAoB,WAAW,iBAAiB,WAAW,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,MACnJ,EAAE,MAAM,UAAU,oBAAoB,WAAW,iBAAiB,WAAW,OAAO,eAAe,WAAW,OAAO,gBAAgB,4BAA4B;AAAA,MACjK,EAAE,MAAM,UAAU,oBAAoB,WAAW,iBAAiB,WAAW,OAAO,cAAc,WAAW,OAAO,gBAAgB,4BAA4B;AAAA,IAClK;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,aAAa,CAAC;AAChD,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,cAAc;AAC1D,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,2BAA2B;AACvE,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,UAAU,2BAA2B;AAAA,EACzE,CAAC;AAED,wBAAG,0EAA0E,MAAM;AACjF,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,WAAW,oBAAoB,WAAW,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,MACxH,EAAE,MAAM,WAAW,oBAAoB,WAAW,OAAO,cAAc,WAAW,OAAO,gBAAgB,eAAe;AAAA,IAC1H;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,cAAc,CAAC;AAAA,EAC5D,CAAC;AAED,wBAAG,gFAAgF,MAAM;AACvF,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,UAAU,oBAAoB,SAAS,OAAO,cAAc,WAAW,UAAU,gBAAgB,mBAAmB;AAAA,MAC5H,EAAE,MAAM,UAAU,oBAAoB,SAAS,OAAO,cAAc,WAAW,UAAU,gBAAgB,gCAAgC;AAAA,IAC3I;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,kBAAkB,EAAE,KAAK,OAAO;AAAA,EACnD,CAAC;AAED,wBAAG,6BAA6B,MAAM;AACpC,UAAM,aAAS,uCAAwB,CAAC,CAAC;AACzC,8BAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EAC/B,CAAC;AAED,wBAAG,wEAAwE,MAAM;AAC/E,UAAM,OAA2B;AAAA,MAC/B,EAAE,MAAM,WAAW,oBAAoB,UAAU,iBAAiB,UAAU,OAAO,cAAc,WAAW,OAAO,gBAAgB,iBAAiB;AAAA,MACpJ,EAAE,MAAM,WAAW,oBAAoB,UAAU,iBAAiB,SAAS,OAAO,cAAc,WAAW,OAAO,gBAAgB,iBAAiB;AAAA,IACrJ;AAEA,UAAM,aAAS,uCAAwB,IAAI;AAC3C,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,eAAe,EAAE,KAAK,OAAO;AAC9C,8BAAO,OAAO,CAAC,EAAE,kBAAkB,EAAE,KAAK,QAAQ;AAAA,EACpD,CAAC;AACH,CAAC;",
-  "names": []
-}