kirograph 0.19.0 → 0.20.0

package/dist/security/manifest/plugins/go.test.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/security/manifest/plugins/go.test.ts"],
-  "sourcesContent": ["/**\n * Unit tests for the Go security manifest plugin.\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { parseGoManifest } from './go';\n\ndescribe('parseGoManifest', () => {\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kirograph-go-test-'));\n  });\n\n  afterEach(() => {\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  function writeGoMod(content: string, dir?: string): string {\n    const targetDir = dir ?? tmpDir;\n    fs.mkdirSync(targetDir, { recursive: true });\n    const filePath = path.join(targetDir, 'go.mod');\n    fs.writeFileSync(filePath, content);\n    return filePath;\n  }\n\n  function writeGoSum(content: string, dir?: string): void {\n    const targetDir = dir ?? tmpDir;\n    fs.mkdirSync(targetDir, { recursive: true });\n    fs.writeFileSync(path.join(targetDir, 'go.sum'), content);\n  }\n\n  it('extracts dependencies from require block', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n\tgithub.com/stretchr/testify v1.8.4\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    const gin = deps.find(d => d.name === 'github.com/gin-gonic/gin');\n    expect(gin).toBeDefined();\n    expect(gin!.declaredConstraint).toBe('v1.9.1');\n    expect(gin!.resolvedVersion).toBe('v1.9.1');\n    expect(gin!.scope).toBe('production');\n    expect(gin!.ecosystem).toBe('go');\n\n    const testify = deps.find(d => d.name === 'github.com/stretchr/testify');\n    expect(testify).toBeDefined();\n    expect(testify!.declaredConstraint).toBe('v1.8.4');\n    expect(testify!.resolvedVersion).toBe('v1.8.4');\n  });\n\n  it('extracts single-line require directives', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/pkg/errors v0.9.1\nrequire golang.org/x/text v0.14.0\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps.find(d => d.name === 'github.com/pkg/errors')).toBeDefined();\n    expect(deps.find(d => d.name === 'golang.org/x/text')).toBeDefined();\n  });\n\n  it('handles both block and single-line requires together', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/pkg/errors v0.9.1\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n\tgithub.com/stretchr/testify v1.8.4\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(3);\n    expect(deps.find(d => d.name === 'github.com/pkg/errors')).toBeDefined();\n    expect(deps.find(d => d.name === 'github.com/gin-gonic/gin')).toBeDefined();\n    expect(deps.find(d => d.name === 'github.com/stretchr/testify')).toBeDefined();\n  });\n\n  it('all dependencies have production scope', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n\tgithub.com/stretchr/testify v1.8.4\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps.every(d => d.scope === 'production')).toBe(true);\n  });\n\n  it('sets declaredConstraint and resolvedVersion to the same value', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/gin-gonic/gin v1.9.1\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('v1.9.1');\n    expect(deps[0].resolvedVersion).toBe('v1.9.1');\n  });\n\n  it('skips comment lines in require block', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\t// This is a comment\n\tgithub.com/gin-gonic/gin v1.9.1\n\t// Another comment\n\tgithub.com/stretchr/testify v1.8.4\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    expect(deps.find(d => d.name === 'github.com/gin-gonic/gin')).toBeDefined();\n    expect(deps.find(d => d.name === 'github.com/stretchr/testify')).toBeDefined();\n  });\n\n  it('handles indirect dependencies (// indirect comment)', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n\tgolang.org/x/sys v0.15.0 // indirect\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n    const sys = deps.find(d => d.name === 'golang.org/x/sys');\n    expect(sys).toBeDefined();\n    expect(sys!.declaredConstraint).toBe('v0.15.0');\n  });\n\n  it('handles pseudo-versions', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/some/module v0.0.0-20230101120000-abcdef123456\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('v0.0.0-20230101120000-abcdef123456');\n    expect(deps[0].resolvedVersion).toBe('v0.0.0-20230101120000-abcdef123456');\n  });\n\n  it('handles +incompatible versions', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/some/legacy v3.2.1+incompatible\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('v3.2.1+incompatible');\n  });\n\n  it('skips entries with invalid module paths', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/valid/module v1.0.0\n\tinvalidpath v1.0.0\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('github.com/valid/module');\n  });\n\n  it('skips entries with invalid version format', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/valid/module v1.0.0\n\tgithub.com/bad/version 1.0.0\n\tgithub.com/bad/version2 latest\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('github.com/valid/module');\n  });\n\n  it('returns empty array for unreadable file', async () => {\n    const deps = await parseGoManifest('/nonexistent/go.mod', tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('returns empty array for go.mod with no require directives', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('sets sourceManifest as relative path', async () => {\n    const subDir = path.join(tmpDir, 'services', 'api');\n    const manifestPath = writeGoMod(`\nmodule github.com/example/api\n\ngo 1.21\n\nrequire github.com/gin-gonic/gin v1.9.1\n`, subDir);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].sourceManifest).toBe('services/api/go.mod');\n  });\n\n  it('reads go.sum for integrity verification', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/gin-gonic/gin v1.9.1\n`);\n\n    writeGoSum(`github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqFPSKw=\ngithub.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL/0KcuqOSEXQHxOGZp0Lg2g/4wZIgGMnG3w3gI=\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    // The dependency should still be extracted correctly\n    // go.sum is used for integrity verification awareness\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('github.com/gin-gonic/gin');\n    expect(deps[0].resolvedVersion).toBe('v1.9.1');\n  });\n\n  it('handles go.mod with multiple require blocks', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n)\n\nrequire (\n\tgolang.org/x/text v0.14.0\n\tgolang.org/x/sys v0.15.0\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(3);\n    expect(deps.find(d => d.name === 'github.com/gin-gonic/gin')).toBeDefined();\n    expect(deps.find(d => d.name === 'golang.org/x/text')).toBeDefined();\n    expect(deps.find(d => d.name === 'golang.org/x/sys')).toBeDefined();\n  });\n\n  it('handles empty require block', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('handles pre-release versions', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/some/module v1.2.3-beta.1\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('v1.2.3-beta.1');\n  });\n\n  it('works without go.sum present', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire github.com/gin-gonic/gin v1.9.1\n`);\n\n    // No go.sum written\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('github.com/gin-gonic/gin');\n    expect(deps[0].resolvedVersion).toBe('v1.9.1');\n  });\n\n  it('sets ecosystem to go for all dependencies', async () => {\n    const manifestPath = writeGoMod(`\nmodule github.com/example/myproject\n\ngo 1.21\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.1\n\tgolang.org/x/text v0.14.0\n)\n`);\n\n    const deps = await parseGoManifest(manifestPath, tmpDir);\n\n    expect(deps.every(d => d.ecosystem === 'go')).toBe(true);\n  });\n});\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAGA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,gBAAgC;AAAA,IAEhC,wBAAS,mBAAmB,MAAM;AAChC,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,oBAAoB,CAAC;AAAA,EACtE,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAED,WAAS,WAAW,SAAiB,KAAsB;AACzD,UAAM,YAAY,OAAO;AACzB,OAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAC3C,UAAM,WAAW,KAAK,KAAK,WAAW,QAAQ;AAC9C,OAAG,cAAc,UAAU,OAAO;AAClC,WAAO;AAAA,EACT;AAEA,WAAS,WAAW,SAAiB,KAAoB;AACvD,UAAM,YAAY,OAAO;AACzB,OAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAC3C,OAAG,cAAc,KAAK,KAAK,WAAW,QAAQ,GAAG,OAAO;AAAA,EAC1D;AAEA,wBAAG,4CAA4C,YAAY;AACzD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,UAAM,MAAM,KAAK,KAAK,OAAK,EAAE,SAAS,0BAA0B;AAChE,8BAAO,GAAG,EAAE,YAAY;AACxB,8BAAO,IAAK,kBAAkB,EAAE,KAAK,QAAQ;AAC7C,8BAAO,IAAK,eAAe,EAAE,KAAK,QAAQ;AAC1C,8BAAO,IAAK,KAAK,EAAE,KAAK,YAAY;AACpC,8BAAO,IAAK,SAAS,EAAE,KAAK,IAAI;AAEhC,UAAM,UAAU,KAAK,KAAK,OAAK,EAAE,SAAS,6BAA6B;AACvE,8BAAO,OAAO,EAAE,YAAY;AAC5B,8BAAO,QAAS,kBAAkB,EAAE,KAAK,QAAQ;AACjD,8BAAO,QAAS,eAAe,EAAE,KAAK,QAAQ;AAAA,EAChD,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAOnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,uBAAuB,CAAC,EAAE,YAAY;AACvE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,mBAAmB,CAAC,EAAE,YAAY;AAAA,EACrE,CAAC;AAED,wBAAG,wDAAwD,YAAY;AACrE,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAWnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,uBAAuB,CAAC,EAAE,YAAY;AACvE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,0BAA0B,CAAC,EAAE,YAAY;AAC1E,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,6BAA6B,CAAC,EAAE,YAAY;AAAA,EAC/E,CAAC;AAED,wBAAG,0CAA0C,YAAY;AACvD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,KAAK,MAAM,OAAK,EAAE,UAAU,YAAY,CAAC,EAAE,KAAK,IAAI;AAAA,EAC7D,CAAC;AAED,wBAAG,iEAAiE,YAAY;AAC9E,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,QAAQ;AAChD,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,QAAQ;AAAA,EAC/C,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAWnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,0BAA0B,CAAC,EAAE,YAAY;AAC1E,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,6BAA6B,CAAC,EAAE,YAAY;AAAA,EAC/E,CAAC;AAED,wBAAG,uDAAuD,YAAY;AACpE,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,UAAM,MAAM,KAAK,KAAK,OAAK,EAAE,SAAS,kBAAkB;AACxD,8BAAO,GAAG,EAAE,YAAY;AACxB,8BAAO,IAAK,kBAAkB,EAAE,KAAK,SAAS;AAAA,EAChD,CAAC;AAED,wBAAG,2BAA2B,YAAY;AACxC,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAQnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,oCAAoC;AAC5E,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,oCAAoC;AAAA,EAC3E,CAAC;AAED,wBAAG,kCAAkC,YAAY;AAC/C,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,qBAAqB;AAAA,EAC/D,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,yBAAyB;AAAA,EACrD,CAAC;AAED,wBAAG,6CAA6C,YAAY;AAC1D,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAUnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,yBAAyB;AAAA,EACrD,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,OAAO,UAAM,2BAAgB,uBAAuB,MAAM;AAChE,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,6DAA6D,YAAY;AAC1E,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA,CAInC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AACvD,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,SAAS,KAAK,KAAK,QAAQ,YAAY,KAAK;AAClD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAMjC,MAAM;AAEL,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,cAAc,EAAE,KAAK,qBAAqB;AAAA,EAC3D,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMnC;AAEG,eAAW;AAAA;AAAA,CAEd;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAIvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,0BAA0B;AACpD,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,QAAQ;AAAA,EAC/C,CAAC;AAED,wBAAG,+CAA+C,YAAY;AAC5D,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAanC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,0BAA0B,CAAC,EAAE,YAAY;AAC1E,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,mBAAmB,CAAC,EAAE,YAAY;AACnE,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,kBAAkB,CAAC,EAAE,YAAY;AAAA,EACpE,CAAC;AAED,wBAAG,+BAA+B,YAAY;AAC5C,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAOnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AACvD,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,gCAAgC,YAAY;AAC7C,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,eAAe;AAAA,EACzD,CAAC;AAED,wBAAG,gCAAgC,YAAY;AAC7C,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAMnC;AAGG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,0BAA0B;AACpD,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,KAAK,QAAQ;AAAA,EAC/C,CAAC;AAED,wBAAG,6CAA6C,YAAY;AAC1D,UAAM,eAAe,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CASnC;AAEG,UAAM,OAAO,UAAM,2BAAgB,cAAc,MAAM;AAEvD,8BAAO,KAAK,MAAM,OAAK,EAAE,cAAc,IAAI,CAAC,EAAE,KAAK,IAAI;AAAA,EACzD,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/security/manifest/plugins/maven.test.js

@@ -1,389 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var import_vitest = require("vitest");
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
-var os = __toESM(require("os"));
-var import_maven = require("./maven");
-(0, import_vitest.describe)("parseMavenManifest", () => {
-  let tmpDir;
-  (0, import_vitest.beforeEach)(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "kirograph-maven-test-"));
-  });
-  (0, import_vitest.afterEach)(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-  function writePomXml(content, dir) {
-    const targetDir = dir ?? tmpDir;
-    const filePath = path.join(targetDir, "pom.xml");
-    fs.mkdirSync(targetDir, { recursive: true });
-    fs.writeFileSync(filePath, content);
-    return filePath;
-  }
-  (0, import_vitest.it)("extracts dependencies with groupId, artifactId, and version", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <modelVersion>4.0.0</modelVersion>
-  <groupId>com.example</groupId>
-  <artifactId>my-app</artifactId>
-  <version>1.0.0</version>
-  <dependencies>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-core</artifactId>
-      <version>5.3.20</version>
-    </dependency>
-    <dependency>
-      <groupId>com.google.guava</groupId>
-      <artifactId>guava</artifactId>
-      <version>31.1-jre</version>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(2);
-    const spring = deps.find((d) => d.name === "org.springframework:spring-core");
-    (0, import_vitest.expect)(spring).toBeDefined();
-    (0, import_vitest.expect)(spring.declaredConstraint).toBe("5.3.20");
-    (0, import_vitest.expect)(spring.resolvedVersion).toBe("5.3.20");
-    (0, import_vitest.expect)(spring.scope).toBe("production");
-    (0, import_vitest.expect)(spring.ecosystem).toBe("maven");
-    const guava = deps.find((d) => d.name === "com.google.guava:guava");
-    (0, import_vitest.expect)(guava).toBeDefined();
-    (0, import_vitest.expect)(guava.declaredConstraint).toBe("31.1-jre");
-    (0, import_vitest.expect)(guava.resolvedVersion).toBe("31.1-jre");
-  });
-  (0, import_vitest.it)("maps compile scope to production", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>org.apache.commons</groupId>
-      <artifactId>commons-lang3</artifactId>
-      <version>3.12.0</version>
-      <scope>compile</scope>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].scope).toBe("production");
-  });
-  (0, import_vitest.it)("maps runtime scope to production", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>mysql</groupId>
-      <artifactId>mysql-connector-java</artifactId>
-      <version>8.0.30</version>
-      <scope>runtime</scope>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].scope).toBe("production");
-  });
-  (0, import_vitest.it)("maps test scope to development", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
-      <version>4.13.2</version>
-      <scope>test</scope>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].scope).toBe("development");
-  });
-  (0, import_vitest.it)("maps provided scope to optional", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>javax.servlet-api</artifactId>
-      <version>4.0.1</version>
-      <scope>provided</scope>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].scope).toBe("optional");
-  });
-  (0, import_vitest.it)("maps system scope to optional", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>com.example</groupId>
-      <artifactId>local-lib</artifactId>
-      <version>1.0.0</version>
-      <scope>system</scope>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].scope).toBe("optional");
-  });
-  (0, import_vitest.it)("defaults to production scope when no scope specified", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-api</artifactId>
-      <version>2.0.7</version>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].scope).toBe("production");
-  });
-  (0, import_vitest.it)("handles all scope types together", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-core</artifactId>
-      <version>5.3.20</version>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>mysql</groupId>
-      <artifactId>mysql-connector-java</artifactId>
-      <version>8.0.30</version>
-      <scope>runtime</scope>
-    </dependency>
-    <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
-      <version>4.13.2</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>javax.servlet</groupId>
-      <artifactId>javax.servlet-api</artifactId>
-      <version>4.0.1</version>
-      <scope>provided</scope>
-    </dependency>
-    <dependency>
-      <groupId>com.example</groupId>
-      <artifactId>system-lib</artifactId>
-      <version>1.0.0</version>
-      <scope>system</scope>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(5);
-    (0, import_vitest.expect)(deps.find((d) => d.name === "org.springframework:spring-core").scope).toBe("production");
-    (0, import_vitest.expect)(deps.find((d) => d.name === "mysql:mysql-connector-java").scope).toBe("production");
-    (0, import_vitest.expect)(deps.find((d) => d.name === "junit:junit").scope).toBe("development");
-    (0, import_vitest.expect)(deps.find((d) => d.name === "javax.servlet:javax.servlet-api").scope).toBe("optional");
-    (0, import_vitest.expect)(deps.find((d) => d.name === "com.example:system-lib").scope).toBe("optional");
-  });
-  (0, import_vitest.it)("skips dependencies with missing groupId", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <artifactId>some-lib</artifactId>
-      <version>1.0.0</version>
-    </dependency>
-    <dependency>
-      <groupId>org.valid</groupId>
-      <artifactId>valid-lib</artifactId>
-      <version>2.0.0</version>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].name).toBe("org.valid:valid-lib");
-  });
-  (0, import_vitest.it)("skips dependencies with missing artifactId", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>org.example</groupId>
-      <version>1.0.0</version>
-    </dependency>
-    <dependency>
-      <groupId>org.valid</groupId>
-      <artifactId>valid-lib</artifactId>
-      <version>2.0.0</version>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].name).toBe("org.valid:valid-lib");
-  });
-  (0, import_vitest.it)("skips dependencies with unresolved Maven properties", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>\${project.groupId}</groupId>
-      <artifactId>internal-module</artifactId>
-      <version>1.0.0</version>
-    </dependency>
-    <dependency>
-      <groupId>org.valid</groupId>
-      <artifactId>valid-lib</artifactId>
-      <version>2.0.0</version>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].name).toBe("org.valid:valid-lib");
-  });
-  (0, import_vitest.it)("handles dependencies without version (managed by parent POM)", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-web</artifactId>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].name).toBe("org.springframework:spring-web");
-    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("");
-    (0, import_vitest.expect)(deps[0].resolvedVersion).toBeUndefined();
-  });
-  (0, import_vitest.it)("handles version with unresolved property", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-core</artifactId>
-      <version>\${spring.version}</version>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].declaredConstraint).toBe("");
-    (0, import_vitest.expect)(deps[0].resolvedVersion).toBeUndefined();
-  });
-  (0, import_vitest.it)("returns empty array for non-existent file", async () => {
-    const fakePath = path.join(tmpDir, "nonexistent", "pom.xml");
-    const deps = await (0, import_maven.parseMavenManifest)(fakePath, tmpDir);
-    (0, import_vitest.expect)(deps).toEqual([]);
-  });
-  (0, import_vitest.it)("returns empty array for invalid XML without project element", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<not-a-project>
-  <something>value</something>
-</not-a-project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toEqual([]);
-  });
-  (0, import_vitest.it)("returns empty array for pom.xml with no dependencies", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <modelVersion>4.0.0</modelVersion>
-  <groupId>com.example</groupId>
-  <artifactId>my-app</artifactId>
-  <version>1.0.0</version>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toEqual([]);
-  });
-  (0, import_vitest.it)("sets sourceManifest as relative path", async () => {
-    const subDir = path.join(tmpDir, "modules", "core");
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>org.example</groupId>
-      <artifactId>lib</artifactId>
-      <version>1.0.0</version>
-    </dependency>
-  </dependencies>
-</project>`, subDir);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].sourceManifest).toBe("modules/core/pom.xml");
-  });
-  (0, import_vitest.it)("sets ecosystem to maven for all dependencies", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencies>
-    <dependency>
-      <groupId>org.apache.logging.log4j</groupId>
-      <artifactId>log4j-core</artifactId>
-      <version>2.17.0</version>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps).toHaveLength(1);
-    (0, import_vitest.expect)(deps[0].ecosystem).toBe("maven");
-  });
-  (0, import_vitest.it)("handles dependencies in dependencyManagement section", async () => {
-    const manifestPath = writePomXml(`<?xml version="1.0" encoding="UTF-8"?>
-<project>
-  <dependencyManagement>
-    <dependencies>
-      <dependency>
-        <groupId>org.springframework.boot</groupId>
-        <artifactId>spring-boot-dependencies</artifactId>
-        <version>3.1.0</version>
-        <scope>import</scope>
-      </dependency>
-    </dependencies>
-  </dependencyManagement>
-  <dependencies>
-    <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-web</artifactId>
-      <version>3.1.0</version>
-    </dependency>
-  </dependencies>
-</project>`);
-    const deps = await (0, import_maven.parseMavenManifest)(manifestPath, tmpDir);
-    (0, import_vitest.expect)(deps.length).toBeGreaterThanOrEqual(1);
-    const starterWeb = deps.find((d) => d.name === "org.springframework.boot:spring-boot-starter-web");
-    (0, import_vitest.expect)(starterWeb).toBeDefined();
-    (0, import_vitest.expect)(starterWeb.declaredConstraint).toBe("3.1.0");
-  });
-});
-//# sourceMappingURL=maven.test.js.map

package/dist/security/manifest/plugins/maven.test.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/security/manifest/plugins/maven.test.ts"],
-  "sourcesContent": ["/**\n * Unit tests for the Maven security manifest plugin.\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { parseMavenManifest } from './maven';\n\ndescribe('parseMavenManifest', () => {\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kirograph-maven-test-'));\n  });\n\n  afterEach(() => {\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  function writePomXml(content: string, dir?: string): string {\n    const targetDir = dir ?? tmpDir;\n    const filePath = path.join(targetDir, 'pom.xml');\n    fs.mkdirSync(targetDir, { recursive: true });\n    fs.writeFileSync(filePath, content);\n    return filePath;\n  }\n\n  it('extracts dependencies with groupId, artifactId, and version', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <modelVersion>4.0.0</modelVersion>\n  <groupId>com.example</groupId>\n  <artifactId>my-app</artifactId>\n  <version>1.0.0</version>\n  <dependencies>\n    <dependency>\n      <groupId>org.springframework</groupId>\n      <artifactId>spring-core</artifactId>\n      <version>5.3.20</version>\n    </dependency>\n    <dependency>\n      <groupId>com.google.guava</groupId>\n      <artifactId>guava</artifactId>\n      <version>31.1-jre</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(2);\n\n    const spring = deps.find(d => d.name === 'org.springframework:spring-core');\n    expect(spring).toBeDefined();\n    expect(spring!.declaredConstraint).toBe('5.3.20');\n    expect(spring!.resolvedVersion).toBe('5.3.20');\n    expect(spring!.scope).toBe('production');\n    expect(spring!.ecosystem).toBe('maven');\n\n    const guava = deps.find(d => d.name === 'com.google.guava:guava');\n    expect(guava).toBeDefined();\n    expect(guava!.declaredConstraint).toBe('31.1-jre');\n    expect(guava!.resolvedVersion).toBe('31.1-jre');\n  });\n\n  it('maps compile scope to production', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.apache.commons</groupId>\n      <artifactId>commons-lang3</artifactId>\n      <version>3.12.0</version>\n      <scope>compile</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('production');\n  });\n\n  it('maps runtime scope to production', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>mysql</groupId>\n      <artifactId>mysql-connector-java</artifactId>\n      <version>8.0.30</version>\n      <scope>runtime</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('production');\n  });\n\n  it('maps test scope to development', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>junit</groupId>\n      <artifactId>junit</artifactId>\n      <version>4.13.2</version>\n      <scope>test</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('development');\n  });\n\n  it('maps provided scope to optional', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>javax.servlet</groupId>\n      <artifactId>javax.servlet-api</artifactId>\n      <version>4.0.1</version>\n      <scope>provided</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('optional');\n  });\n\n  it('maps system scope to optional', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>com.example</groupId>\n      <artifactId>local-lib</artifactId>\n      <version>1.0.0</version>\n      <scope>system</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('optional');\n  });\n\n  it('defaults to production scope when no scope specified', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.slf4j</groupId>\n      <artifactId>slf4j-api</artifactId>\n      <version>2.0.7</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].scope).toBe('production');\n  });\n\n  it('handles all scope types together', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.springframework</groupId>\n      <artifactId>spring-core</artifactId>\n      <version>5.3.20</version>\n      <scope>compile</scope>\n    </dependency>\n    <dependency>\n      <groupId>mysql</groupId>\n      <artifactId>mysql-connector-java</artifactId>\n      <version>8.0.30</version>\n      <scope>runtime</scope>\n    </dependency>\n    <dependency>\n      <groupId>junit</groupId>\n      <artifactId>junit</artifactId>\n      <version>4.13.2</version>\n      <scope>test</scope>\n    </dependency>\n    <dependency>\n      <groupId>javax.servlet</groupId>\n      <artifactId>javax.servlet-api</artifactId>\n      <version>4.0.1</version>\n      <scope>provided</scope>\n    </dependency>\n    <dependency>\n      <groupId>com.example</groupId>\n      <artifactId>system-lib</artifactId>\n      <version>1.0.0</version>\n      <scope>system</scope>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(5);\n    expect(deps.find(d => d.name === 'org.springframework:spring-core')!.scope).toBe('production');\n    expect(deps.find(d => d.name === 'mysql:mysql-connector-java')!.scope).toBe('production');\n    expect(deps.find(d => d.name === 'junit:junit')!.scope).toBe('development');\n    expect(deps.find(d => d.name === 'javax.servlet:javax.servlet-api')!.scope).toBe('optional');\n    expect(deps.find(d => d.name === 'com.example:system-lib')!.scope).toBe('optional');\n  });\n\n  it('skips dependencies with missing groupId', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <artifactId>some-lib</artifactId>\n      <version>1.0.0</version>\n    </dependency>\n    <dependency>\n      <groupId>org.valid</groupId>\n      <artifactId>valid-lib</artifactId>\n      <version>2.0.0</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('org.valid:valid-lib');\n  });\n\n  it('skips dependencies with missing artifactId', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.example</groupId>\n      <version>1.0.0</version>\n    </dependency>\n    <dependency>\n      <groupId>org.valid</groupId>\n      <artifactId>valid-lib</artifactId>\n      <version>2.0.0</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('org.valid:valid-lib');\n  });\n\n  it('skips dependencies with unresolved Maven properties', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>\\${project.groupId}</groupId>\n      <artifactId>internal-module</artifactId>\n      <version>1.0.0</version>\n    </dependency>\n    <dependency>\n      <groupId>org.valid</groupId>\n      <artifactId>valid-lib</artifactId>\n      <version>2.0.0</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('org.valid:valid-lib');\n  });\n\n  it('handles dependencies without version (managed by parent POM)', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.springframework</groupId>\n      <artifactId>spring-web</artifactId>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].name).toBe('org.springframework:spring-web');\n    expect(deps[0].declaredConstraint).toBe('');\n    expect(deps[0].resolvedVersion).toBeUndefined();\n  });\n\n  it('handles version with unresolved property', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.springframework</groupId>\n      <artifactId>spring-core</artifactId>\n      <version>\\${spring.version}</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].declaredConstraint).toBe('');\n    expect(deps[0].resolvedVersion).toBeUndefined();\n  });\n\n  it('returns empty array for non-existent file', async () => {\n    const fakePath = path.join(tmpDir, 'nonexistent', 'pom.xml');\n    const deps = await parseMavenManifest(fakePath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('returns empty array for invalid XML without project element', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<not-a-project>\n  <something>value</something>\n</not-a-project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('returns empty array for pom.xml with no dependencies', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <modelVersion>4.0.0</modelVersion>\n  <groupId>com.example</groupId>\n  <artifactId>my-app</artifactId>\n  <version>1.0.0</version>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n    expect(deps).toEqual([]);\n  });\n\n  it('sets sourceManifest as relative path', async () => {\n    const subDir = path.join(tmpDir, 'modules', 'core');\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.example</groupId>\n      <artifactId>lib</artifactId>\n      <version>1.0.0</version>\n    </dependency>\n  </dependencies>\n</project>`, subDir);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].sourceManifest).toBe('modules/core/pom.xml');\n  });\n\n  it('sets ecosystem to maven for all dependencies', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencies>\n    <dependency>\n      <groupId>org.apache.logging.log4j</groupId>\n      <artifactId>log4j-core</artifactId>\n      <version>2.17.0</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    expect(deps).toHaveLength(1);\n    expect(deps[0].ecosystem).toBe('maven');\n  });\n\n  it('handles dependencies in dependencyManagement section', async () => {\n    const manifestPath = writePomXml(`<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project>\n  <dependencyManagement>\n    <dependencies>\n      <dependency>\n        <groupId>org.springframework.boot</groupId>\n        <artifactId>spring-boot-dependencies</artifactId>\n        <version>3.1.0</version>\n        <scope>import</scope>\n      </dependency>\n    </dependencies>\n  </dependencyManagement>\n  <dependencies>\n    <dependency>\n      <groupId>org.springframework.boot</groupId>\n      <artifactId>spring-boot-starter-web</artifactId>\n      <version>3.1.0</version>\n    </dependency>\n  </dependencies>\n</project>`);\n\n    const deps = await parseMavenManifest(manifestPath, tmpDir);\n\n    // Should extract both dependencies (from dependencyManagement and regular)\n    expect(deps.length).toBeGreaterThanOrEqual(1);\n    const starterWeb = deps.find(d => d.name === 'org.springframework.boot:spring-boot-starter-web');\n    expect(starterWeb).toBeDefined();\n    expect(starterWeb!.declaredConstraint).toBe('3.1.0');\n  });\n});\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAGA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,mBAAmC;AAAA,IAEnC,wBAAS,sBAAsB,MAAM;AACnC,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,uBAAuB,CAAC;AAAA,EACzE,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAED,WAAS,YAAY,SAAiB,KAAsB;AAC1D,UAAM,YAAY,OAAO;AACzB,UAAM,WAAW,KAAK,KAAK,WAAW,SAAS;AAC/C,OAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAC3C,OAAG,cAAc,UAAU,OAAO;AAClC,WAAO;AAAA,EACT;AAEA,wBAAG,+DAA+D,YAAY;AAC5E,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAkB1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAE3B,UAAM,SAAS,KAAK,KAAK,OAAK,EAAE,SAAS,iCAAiC;AAC1E,8BAAO,MAAM,EAAE,YAAY;AAC3B,8BAAO,OAAQ,kBAAkB,EAAE,KAAK,QAAQ;AAChD,8BAAO,OAAQ,eAAe,EAAE,KAAK,QAAQ;AAC7C,8BAAO,OAAQ,KAAK,EAAE,KAAK,YAAY;AACvC,8BAAO,OAAQ,SAAS,EAAE,KAAK,OAAO;AAEtC,UAAM,QAAQ,KAAK,KAAK,OAAK,EAAE,SAAS,wBAAwB;AAChE,8BAAO,KAAK,EAAE,YAAY;AAC1B,8BAAO,MAAO,kBAAkB,EAAE,KAAK,UAAU;AACjD,8BAAO,MAAO,eAAe,EAAE,KAAK,UAAU;AAAA,EAChD,CAAC;AAED,wBAAG,oCAAoC,YAAY;AACjD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAU1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY;AAAA,EACzC,CAAC;AAED,wBAAG,oCAAoC,YAAY;AACjD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAU1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY;AAAA,EACzC,CAAC;AAED,wBAAG,kCAAkC,YAAY;AAC/C,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAU1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,aAAa;AAAA,EAC1C,CAAC;AAED,wBAAG,mCAAmC,YAAY;AAChD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAU1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,UAAU;AAAA,EACvC,CAAC;AAED,wBAAG,iCAAiC,YAAY;AAC9C,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAU1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,UAAU;AAAA,EACvC,CAAC;AAED,wBAAG,wDAAwD,YAAY;AACrE,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAS1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY;AAAA,EACzC,CAAC;AAED,wBAAG,oCAAoC,YAAY;AACjD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAkC1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,iCAAiC,EAAG,KAAK,EAAE,KAAK,YAAY;AAC7F,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,4BAA4B,EAAG,KAAK,EAAE,KAAK,YAAY;AACxF,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,aAAa,EAAG,KAAK,EAAE,KAAK,aAAa;AAC1E,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,iCAAiC,EAAG,KAAK,EAAE,KAAK,UAAU;AAC3F,8BAAO,KAAK,KAAK,OAAK,EAAE,SAAS,wBAAwB,EAAG,KAAK,EAAE,KAAK,UAAU;AAAA,EACpF,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAa1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,qBAAqB;AAAA,EACjD,CAAC;AAED,wBAAG,8CAA8C,YAAY;AAC3D,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAa1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,qBAAqB;AAAA,EACjD,CAAC;AAED,wBAAG,uDAAuD,YAAY;AACpE,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAc1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,qBAAqB;AAAA,EACjD,CAAC;AAED,wBAAG,gEAAgE,YAAY;AAC7E,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAQ1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,gCAAgC;AAC1D,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE;AAC1C,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,cAAc;AAAA,EAChD,CAAC;AAED,wBAAG,4CAA4C,YAAY;AACzD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAS1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE;AAC1C,8BAAO,KAAK,CAAC,EAAE,eAAe,EAAE,cAAc;AAAA,EAChD,CAAC;AAED,wBAAG,6CAA6C,YAAY;AAC1D,UAAM,WAAW,KAAK,KAAK,QAAQ,eAAe,SAAS;AAC3D,UAAM,OAAO,UAAM,iCAAmB,UAAU,MAAM;AACtD,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,+DAA+D,YAAY;AAC5E,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA,iBAGpB;AAEb,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAC1D,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,wDAAwD,YAAY;AACrE,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAM1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAC1D,8BAAO,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzB,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,SAAS,KAAK,KAAK,QAAQ,WAAW,MAAM;AAClD,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aASxB,MAAM;AAEf,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,cAAc,EAAE,KAAK,sBAAsB;AAAA,EAC5D,CAAC;AAED,wBAAG,gDAAgD,YAAY;AAC7D,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAS1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAE1D,8BAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,8BAAO,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,OAAO;AAAA,EACxC,CAAC;AAED,wBAAG,wDAAwD,YAAY;AACrE,UAAM,eAAe,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAmB1B;AAEP,UAAM,OAAO,UAAM,iCAAmB,cAAc,MAAM;AAG1D,8BAAO,KAAK,MAAM,EAAE,uBAAuB,CAAC;AAC5C,UAAM,aAAa,KAAK,KAAK,OAAK,EAAE,SAAS,kDAAkD;AAC/F,8BAAO,UAAU,EAAE,YAAY;AAC/B,8BAAO,WAAY,kBAAkB,EAAE,KAAK,OAAO;AAAA,EACrD,CAAC;AACH,CAAC;",
-  "names": []
-}