@shipsafe/cli 0.1.0

package/dist/src/engines/graph/queries.js

@@ -0,0 +1,196 @@
+// ── Constants ──
+const ENTRY_POINT_PATTERNS = ['handle', 'route', 'controller', 'api', 'endpoint'];
+const SINK_PATTERNS = {
+    database: ['query', 'execute', 'exec', 'find', 'insert', 'update', 'delete', 'raw'],
+    filesystem: ['readFile', 'writeFile', 'unlink', 'createReadStream', 'open'],
+    shell: ['exec', 'execSync', 'spawn', 'execFile'],
+    network: ['fetch', 'axios', 'request', 'http.get'],
+};
+const VALIDATOR_PATTERNS = ['valid', 'sanitiz', 'escape', 'clean', 'check', 'verify', 'auth'];
+// ── Helpers ──
+function isEntryPoint(fn) {
+    const nameLower = fn.name.toLowerCase();
+    return (fn.isExported &&
+        (ENTRY_POINT_PATTERNS.some((p) => nameLower.includes(p)) || fn.isAsync));
+}
+function classifySink(name) {
+    const nameLower = name.toLowerCase();
+    for (const [type, patterns] of Object.entries(SINK_PATTERNS)) {
+        for (const pattern of patterns) {
+            if (nameLower === pattern.toLowerCase()) {
+                return type;
+            }
+        }
+    }
+    return null;
+}
+function isValidator(name) {
+    const nameLower = name.toLowerCase();
+    return VALIDATOR_PATTERNS.some((p) => nameLower.includes(p));
+}
+function isSink(name) {
+    return classifySink(name) !== null;
+}
+function isHandlerLike(name) {
+    const nameLower = name.toLowerCase();
+    return ENTRY_POINT_PATTERNS.some((p) => nameLower.includes(p));
+}
+// ── findAttackPaths ──
+/**
+ * Find paths from entry point functions to dangerous sink functions.
+ * Uses BFS via getCallees to trace call chains without native path queries.
+ */
+export async function findAttackPaths(store) {
+    // Step 1: Get all functions to identify entry points
+    const allFunctions = (await store.query('MATCH (fn:Function) RETURN fn.name AS name, fn.filePath AS filePath, fn.startLine AS line, fn.isAsync AS isAsync, fn.isExported AS isExported'));
+    const entryPoints = allFunctions.filter((fn) => {
+        const name = fn['name'];
+        const isExported = fn['isExported'];
+        const isAsync = fn['isAsync'];
+        return isExported && (isHandlerLike(name) || isAsync);
+    });
+    const attackPaths = [];
+    // Step 2: For each entry point, trace call chains to find sinks
+    for (const entry of entryPoints) {
+        const entryName = entry['name'];
+        // Get all direct callees (depth 1 only to build specific paths)
+        const directCallees = await store.getCallees(entryName, 1);
+        for (const callee of directCallees) {
+            if (isSink(callee.name)) {
+                // Direct path: entry -> sink
+                const pathNames = [entryName, callee.name];
+                attackPaths.push({
+                    entryPoint: {
+                        name: entryName,
+                        filePath: entry['filePath'],
+                        line: entry['line'],
+                    },
+                    sink: {
+                        name: callee.name,
+                        filePath: callee.filePath,
+                        line: callee.startLine,
+                        type: classifySink(callee.name),
+                    },
+                    path: pathNames,
+                    hasValidation: pathNames.some((n) => isValidator(n)),
+                });
+            }
+            else {
+                // Check if this intermediate callee leads to a sink (depth 2-5)
+                const deepCallees = await store.getCallees(callee.name, 4);
+                for (const deepCallee of deepCallees) {
+                    if (isSink(deepCallee.name)) {
+                        const pathNames = [entryName, callee.name, deepCallee.name];
+                        attackPaths.push({
+                            entryPoint: {
+                                name: entryName,
+                                filePath: entry['filePath'],
+                                line: entry['line'],
+                            },
+                            sink: {
+                                name: deepCallee.name,
+                                filePath: deepCallee.filePath,
+                                line: deepCallee.startLine,
+                                type: classifySink(deepCallee.name),
+                            },
+                            path: pathNames,
+                            hasValidation: pathNames.some((n) => isValidator(n)),
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return attackPaths;
+}
+// ── findBlastRadius ──
+export async function findBlastRadius(store, functionName) {
+    // Find all transitive callers of the target function
+    const callers = await store.getCallers(functionName, 10);
+    const affectedFunctions = callers.map((fn) => ({
+        name: fn.name,
+        filePath: fn.filePath,
+        line: fn.startLine,
+    }));
+    // Identify which callers are endpoints (exported + handler-like or async)
+    const affectedEndpoints = callers
+        .filter((fn) => isEntryPoint(fn))
+        .map((fn) => ({
+        name: fn.name,
+        filePath: fn.filePath,
+        line: fn.startLine,
+    }));
+    return {
+        targetFunction: functionName,
+        affectedFunctions,
+        affectedEndpoints,
+        totalAffected: affectedFunctions.length,
+    };
+}
+// ── findMissingAuth ──
+export async function findMissingAuth(store) {
+    // Find all exported endpoint-like functions
+    const allFunctions = (await store.query('MATCH (fn:Function) RETURN fn.name AS name, fn.filePath AS filePath, fn.startLine AS line, fn.isAsync AS isAsync, fn.isExported AS isExported'));
+    const results = [];
+    for (const fn of allFunctions) {
+        const name = fn['name'];
+        const isExported = fn['isExported'];
+        const isAsync = fn['isAsync'];
+        // Only check endpoint-like functions (handler/route/controller/api pattern AND async)
+        if (!isExported || !isAsync || !isHandlerLike(name))
+            continue;
+        // Check if any function in the call chain (callees) has 'auth' in the name
+        const callees = await store.getCallees(name, 10);
+        const hasAuth = callees.some((callee) => callee.name.toLowerCase().includes('auth'));
+        if (!hasAuth) {
+            results.push({
+                endpoint: {
+                    name,
+                    filePath: fn['filePath'],
+                    line: fn['line'],
+                },
+                reason: 'No auth middleware in call chain',
+            });
+        }
+    }
+    return results;
+}
+// ── queryResultsToFindings ──
+export function queryResultsToFindings(attackPaths, blastRadius, missingAuth) {
+    const findings = [];
+    let idCounter = 0;
+    // Attack paths without validation are findings
+    for (const ap of attackPaths) {
+        if (!ap.hasValidation) {
+            idCounter++;
+            findings.push({
+                id: `kg-attack-path-${idCounter}`,
+                engine: 'knowledge_graph',
+                severity: ap.sink.type === 'shell' ? 'critical' : 'high',
+                type: 'attack_path',
+                file: ap.entryPoint.filePath,
+                line: ap.entryPoint.line,
+                description: `Unvalidated path from ${ap.entryPoint.name} to ${ap.sink.name} (${ap.sink.type} sink): ${ap.path.join(' -> ')}`,
+                fix_suggestion: `Add input validation or sanitization in the call chain between ${ap.entryPoint.name} and ${ap.sink.name}`,
+                auto_fixable: false,
+            });
+        }
+    }
+    // Missing auth findings
+    for (const ma of missingAuth) {
+        idCounter++;
+        findings.push({
+            id: `kg-missing-auth-${idCounter}`,
+            engine: 'knowledge_graph',
+            severity: 'high',
+            type: 'missing_auth',
+            file: ma.endpoint.filePath,
+            line: ma.endpoint.line,
+            description: `Endpoint ${ma.endpoint.name} has no auth middleware in call chain`,
+            fix_suggestion: `Add authentication middleware (e.g., checkAuth) to the call chain for ${ma.endpoint.name}`,
+            auto_fixable: false,
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=queries.js.map

package/dist/src/engines/graph/queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queries.js","sourceRoot":"","sources":["../../../../src/engines/graph/queries.ts"],"names":[],"mappings":"AAGA,kBAAkB;AAElB,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AAElF,MAAM,aAAa,GAA6B;IAC9C,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;IACnF,UAAU,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,CAAC;IAC3E,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC;IAChD,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC;CACnD,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAE9F,gBAAgB;AAEhB,SAAS,YAAY,CAAC,EAAiB;IACrC,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,CACL,EAAE,CAAC,UAAU;QACb,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,wBAAwB;AAExB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAiB;IACrD,qDAAqD;IACrD,MAAM,YAAY,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,CACrC,+IAA+I,CAChJ,CAAmC,CAAC;IAErC,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAW,CAAC;QAClC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAY,CAAC;QAC/C,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAY,CAAC;QACzC,OAAO,UAAU,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAiB,EAAE,CAAC;IAErC,gEAAgE;IAChE,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAW,CAAC;QAE1C,gEAAgE;QAChE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAE3D,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,6BAA6B;gBAC7B,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC3C,WAAW,CAAC,IAAI,CAAC;oBACf,UAAU,EAAE;wBACV,IAAI,EAAE,SAAS;wBACf,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAW;wBACrC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAW;qBAC9B;oBACD,IAAI,EAAE;wBACJ,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,IAAI,EAAE,MAAM,CAAC,SAAS;wBACtB,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAE;qBACjC;oBACD,IAAI,EAAE,SAAS;oBACf,aAAa,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;iBACrD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,gEAAgE;gBAChE,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC3D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;oBACrC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC5B,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;wBAC5D,WAAW,CAAC,IAAI,CAAC;4BACf,UAAU,EAAE;gCACV,IAAI,EAAE,SAAS;gCACf,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAW;gCACrC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAW;6BAC9B;4BACD,IAAI,EAAE;gCACJ,IAAI,EAAE,UAAU,CAAC,IAAI;gCACrB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gCAC7B,IAAI,EAAE,UAAU,CAAC,SAAS;gCAC1B,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,IAAI,CAAE;6BACrC;4BACD,IAAI,EAAE,SAAS;4BACf,aAAa,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;yBACrD,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,wBAAwB;AAExB,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAiB,EACjB,YAAoB;IAEpB,qDAAqD;IACrD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAEzD,MAAM,iBAAiB,GAA2C,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrF,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,IAAI,EAAE,EAAE,CAAC,SAAS;KACnB,CAAC,CAAC,CAAC;IAEJ,0EAA0E;IAC1E,MAAM,iBAAiB,GAA2C,OAAO;SACtE,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;SAChC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACZ,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,IAAI,EAAE,EAAE,CAAC,SAAS;KACnB,CAAC,CAAC,CAAC;IAEN,OAAO;QACL,cAAc,EAAE,YAAY;QAC5B,iBAAiB;QACjB,iBAAiB;QACjB,aAAa,EAAE,iBAAiB,CAAC,MAAM;KACxC,CAAC;AACJ,CAAC;AAED,wBAAwB;AAExB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAiB;IACrD,4CAA4C;IAC5C,MAAM,YAAY,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,CACrC,+IAA+I,CAChJ,CAAmC,CAAC;IAErC,MAAM,OAAO,GAAwB,EAAE,CAAC;IAExC,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAW,CAAC;QAClC,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAY,CAAC;QAC/C,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAY,CAAC;QAEzC,sFAAsF;QACtF,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,SAAS;QAE9D,2EAA2E;QAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAErF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE;oBACR,IAAI;oBACJ,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAW;oBAClC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAW;iBAC3B;gBACD,MAAM,EAAE,kCAAkC;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+BAA+B;AAE/B,MAAM,UAAU,sBAAsB,CACpC,WAAyB,EACzB,WAAgC,EAChC,WAAgC;IAEhC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,+CAA+C;IAC/C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC;YACtB,SAAS,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,kBAAkB,SAAS,EAAE;gBACjC,MAAM,EAAE,iBAAiB;gBACzB,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;gBACxD,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ;gBAC5B,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI;gBACxB,WAAW,EAAE,yBAAyB,EAAE,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAC7H,cAAc,EAAE,kEAAkE,EAAE,CAAC,UAAU,CAAC,IAAI,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE;gBAC1H,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,SAAS,EAAE,CAAC;QACZ,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,mBAAmB,SAAS,EAAE;YAClC,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ;YAC1B,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI;YACtB,WAAW,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,IAAI,uCAAuC;YAChF,cAAc,EAAE,yEAAyE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE;YAC3G,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/engines/graph/store.d.ts

@@ -0,0 +1,35 @@
+import type { ParsedFile } from '../../types.js';
+export interface GraphFunction {
+    id: string;
+    name: string;
+    filePath: string;
+    startLine: number;
+    endLine: number;
+    isAsync: boolean;
+    isExported: boolean;
+    className: string;
+}
+export interface GraphImport {
+    source: string;
+    filePath: string;
+    line: number;
+    specifiers: string[];
+}
+export interface GraphStore {
+    /** Populate the graph from parsed files. */
+    buildGraph(parsedFiles: ParsedFile[]): Promise<void>;
+    /** Retrieve a function node by name. Returns the first match. */
+    getFunction(name: string): Promise<GraphFunction | null>;
+    /** Find functions that call the target (transitive up to depth). */
+    getCallers(functionName: string, depth?: number): Promise<GraphFunction[]>;
+    /** Find functions called by the target (transitive up to depth). */
+    getCallees(functionName: string, depth?: number): Promise<GraphFunction[]>;
+    /** Get all files that import a given module path. */
+    getImportsOf(modulePath: string): Promise<GraphImport[]>;
+    /** Execute a raw Cypher query. */
+    query(cypher: string, params?: Record<string, unknown>): Promise<unknown[]>;
+    /** Close the database and release resources. */
+    close(): Promise<void>;
+}
+export declare function createGraphStore(dbPath: string): Promise<GraphStore>;
+//# sourceMappingURL=store.d.ts.map

package/dist/src/engines/graph/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../../src/engines/graph/store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,UAAU,EAKX,MAAM,gBAAgB,CAAC;AAIxB,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,UAAU,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD,iEAAiE;IACjE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAEzD,oEAAoE;IACpE,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAE3E,oEAAoE;IACpE,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAE3E,qDAAqD;IACrD,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAEzD,kCAAkC;IAClC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAE5E,gDAAgD;IAChD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAkED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA+R1E"}

package/dist/src/engines/graph/store.js

@@ -0,0 +1,284 @@
+import kuzu from 'kuzu';
+// ── Helpers ──
+function functionId(fn) {
+    if (fn.className) {
+        return `${fn.filePath}::${fn.className}.${fn.name}`;
+    }
+    return `${fn.filePath}::${fn.name}`;
+}
+function classId(cls) {
+    return `${cls.filePath}::${cls.name}`;
+}
+/** Normalise a QueryResult (which may be a single result or array) into a single result. */
+function unwrapResult(result) {
+    if (Array.isArray(result)) {
+        return result[0];
+    }
+    return result;
+}
+// ── Schema creation ──
+const SCHEMA_STATEMENTS = [
+    // Node tables
+    `CREATE NODE TABLE IF NOT EXISTS Function(
+    id STRING,
+    name STRING,
+    filePath STRING,
+    startLine INT64,
+    endLine INT64,
+    isAsync BOOLEAN,
+    isExported BOOLEAN,
+    className STRING,
+    PRIMARY KEY(id)
+  )`,
+    `CREATE NODE TABLE IF NOT EXISTS Class(
+    id STRING,
+    name STRING,
+    filePath STRING,
+    startLine INT64,
+    endLine INT64,
+    isExported BOOLEAN,
+    PRIMARY KEY(id)
+  )`,
+    `CREATE NODE TABLE IF NOT EXISTS File(
+    path STRING,
+    language STRING,
+    PRIMARY KEY(path)
+  )`,
+    `CREATE NODE TABLE IF NOT EXISTS Module(
+    name STRING,
+    PRIMARY KEY(name)
+  )`,
+    // Relationship tables
+    `CREATE REL TABLE IF NOT EXISTS CALLS(FROM Function TO Function)`,
+    `CREATE REL TABLE IF NOT EXISTS CONTAINS(FROM File TO Function)`,
+    `CREATE REL TABLE IF NOT EXISTS CONTAINS_CLASS(FROM File TO Class)`,
+    `CREATE REL TABLE IF NOT EXISTS HAS_METHOD(FROM Class TO Function)`,
+    `CREATE REL TABLE IF NOT EXISTS IMPORTS(FROM File TO Module, line INT64, specifiers STRING)`,
+];
+// ── Implementation ──
+export async function createGraphStore(dbPath) {
+    const db = new kuzu.Database(dbPath);
+    const conn = new kuzu.Connection(db);
+    // Ensure schema exists
+    for (const stmt of SCHEMA_STATEMENTS) {
+        await conn.query(stmt);
+    }
+    // Pre-prepare reusable statements
+    const insertFunctionStmt = await conn.prepare('CREATE (:Function {id: $id, name: $name, filePath: $filePath, startLine: $startLine, endLine: $endLine, isAsync: $isAsync, isExported: $isExported, className: $className})');
+    const insertClassStmt = await conn.prepare('CREATE (:Class {id: $id, name: $name, filePath: $filePath, startLine: $startLine, endLine: $endLine, isExported: $isExported})');
+    const insertFileStmt = await conn.prepare('CREATE (:File {path: $path, language: $language})');
+    const insertContainsStmt = await conn.prepare('MATCH (f:File), (fn:Function) WHERE f.path = $filePath AND fn.id = $fnId CREATE (f)-[:CONTAINS]->(fn)');
+    const insertContainsClassStmt = await conn.prepare('MATCH (f:File), (c:Class) WHERE f.path = $filePath AND c.id = $classId CREATE (f)-[:CONTAINS_CLASS]->(c)');
+    const insertHasMethodStmt = await conn.prepare('MATCH (c:Class), (fn:Function) WHERE c.id = $classId AND fn.id = $fnId CREATE (c)-[:HAS_METHOD]->(fn)');
+    const insertCallsStmt = await conn.prepare('MATCH (a:Function), (b:Function) WHERE a.id = $callerId AND b.id = $calleeId CREATE (a)-[:CALLS]->(b)');
+    // ── buildGraph ──
+    async function buildGraph(parsedFiles) {
+        // Collect all function IDs for call-site resolution
+        const functionIndex = new Map(); // name -> id (first match)
+        // For methods with receivers: "receiver.method" -> id
+        const methodIndex = new Map();
+        // Pass 1: Insert nodes
+        for (const file of parsedFiles) {
+            // Insert File node
+            await conn.execute(insertFileStmt, {
+                path: file.filePath,
+                language: file.language,
+            });
+            // Insert Function nodes
+            for (const fn of file.functions) {
+                const id = functionId(fn);
+                await conn.execute(insertFunctionStmt, {
+                    id,
+                    name: fn.name,
+                    filePath: fn.filePath,
+                    startLine: fn.startLine,
+                    endLine: fn.endLine,
+                    isAsync: fn.isAsync,
+                    isExported: fn.isExported,
+                    className: fn.className ?? '',
+                });
+                // Index for call resolution
+                if (!functionIndex.has(fn.name)) {
+                    functionIndex.set(fn.name, id);
+                }
+                // Index methods by className.methodName
+                if (fn.className) {
+                    const qualifiedName = `${fn.className}.${fn.name}`;
+                    if (!methodIndex.has(qualifiedName)) {
+                        methodIndex.set(qualifiedName, id);
+                    }
+                }
+                // Create CONTAINS edge (File -> Function)
+                await conn.execute(insertContainsStmt, {
+                    filePath: file.filePath,
+                    fnId: id,
+                });
+            }
+            // Insert Class nodes
+            for (const cls of file.classes) {
+                const id = classId(cls);
+                await conn.execute(insertClassStmt, {
+                    id,
+                    name: cls.name,
+                    filePath: cls.filePath,
+                    startLine: cls.startLine,
+                    endLine: cls.endLine,
+                    isExported: cls.isExported,
+                });
+                // Create CONTAINS_CLASS edge (File -> Class)
+                await conn.execute(insertContainsClassStmt, {
+                    filePath: file.filePath,
+                    classId: id,
+                });
+                // Create HAS_METHOD edges (Class -> Function)
+                for (const methodName of cls.methods) {
+                    const methodFnId = `${cls.filePath}::${cls.name}.${methodName}`;
+                    await conn.execute(insertHasMethodStmt, {
+                        classId: id,
+                        fnId: methodFnId,
+                    });
+                }
+            }
+            // Insert Module nodes and IMPORTS edges
+            for (const imp of file.imports) {
+                // MERGE Module node (idempotent)
+                await conn.query(`MERGE (:Module {name: '${escapeCypher(imp.source)}'})`);
+                // Create IMPORTS edge with metadata
+                const importStmt = await conn.prepare('MATCH (f:File), (m:Module) WHERE f.path = $filePath AND m.name = $moduleName CREATE (f)-[:IMPORTS {line: $line, specifiers: $specifiers}]->(m)');
+                await conn.execute(importStmt, {
+                    filePath: file.filePath,
+                    moduleName: imp.source,
+                    line: imp.line,
+                    specifiers: imp.specifiers.join(','),
+                });
+            }
+        }
+        // Pass 2: Resolve call sites into CALLS edges
+        for (const file of parsedFiles) {
+            for (const call of file.callSites) {
+                // Find the caller function ID
+                const callerFn = file.functions.find((fn) => {
+                    if (fn.className) {
+                        return fn.name === call.callerName;
+                    }
+                    return fn.name === call.callerName;
+                });
+                if (!callerFn)
+                    continue;
+                const callerId = functionId(callerFn);
+                // Find the callee function ID
+                let calleeId;
+                if (call.receiver) {
+                    // Method call: try receiver.calleeName
+                    const qualifiedName = `${call.receiver}.${call.calleeName}`;
+                    calleeId = methodIndex.get(qualifiedName);
+                }
+                // Fallback to plain name lookup
+                if (!calleeId) {
+                    calleeId = functionIndex.get(call.calleeName);
+                }
+                if (!calleeId)
+                    continue; // External or unresolved call
+                await conn.execute(insertCallsStmt, {
+                    callerId,
+                    calleeId,
+                });
+            }
+        }
+    }
+    // ── getFunction ──
+    async function getFunction(name) {
+        const stmt = await conn.prepare('MATCH (f:Function) WHERE f.name = $name RETURN f.id, f.name, f.filePath, f.startLine, f.endLine, f.isAsync, f.isExported, f.className LIMIT 1');
+        const result = unwrapResult(await conn.execute(stmt, { name }));
+        const rows = await result.getAll();
+        if (rows.length === 0)
+            return null;
+        const row = rows[0];
+        return {
+            id: row['f.id'],
+            name: row['f.name'],
+            filePath: row['f.filePath'],
+            startLine: row['f.startLine'],
+            endLine: row['f.endLine'],
+            isAsync: row['f.isAsync'],
+            isExported: row['f.isExported'],
+            className: row['f.className'],
+        };
+    }
+    // ── getCallers ──
+    async function getCallers(functionName, depth = 1) {
+        const stmt = await conn.prepare(`MATCH (caller:Function)-[:CALLS*1..${depth}]->(target:Function) WHERE target.name = $name RETURN DISTINCT caller.id, caller.name, caller.filePath, caller.startLine, caller.endLine, caller.isAsync, caller.isExported, caller.className`);
+        const result = unwrapResult(await conn.execute(stmt, { name: functionName }));
+        const rows = await result.getAll();
+        return rows.map((row) => ({
+            id: row['caller.id'],
+            name: row['caller.name'],
+            filePath: row['caller.filePath'],
+            startLine: row['caller.startLine'],
+            endLine: row['caller.endLine'],
+            isAsync: row['caller.isAsync'],
+            isExported: row['caller.isExported'],
+            className: row['caller.className'],
+        }));
+    }
+    // ── getCallees ──
+    async function getCallees(functionName, depth = 1) {
+        const stmt = await conn.prepare(`MATCH (target:Function)-[:CALLS*1..${depth}]->(callee:Function) WHERE target.name = $name RETURN DISTINCT callee.id, callee.name, callee.filePath, callee.startLine, callee.endLine, callee.isAsync, callee.isExported, callee.className`);
+        const result = unwrapResult(await conn.execute(stmt, { name: functionName }));
+        const rows = await result.getAll();
+        return rows.map((row) => ({
+            id: row['callee.id'],
+            name: row['callee.name'],
+            filePath: row['callee.filePath'],
+            startLine: row['callee.startLine'],
+            endLine: row['callee.endLine'],
+            isAsync: row['callee.isAsync'],
+            isExported: row['callee.isExported'],
+            className: row['callee.className'],
+        }));
+    }
+    // ── getImportsOf ──
+    async function getImportsOf(modulePath) {
+        const stmt = await conn.prepare('MATCH (f:File)-[r:IMPORTS]->(m:Module) WHERE m.name = $name RETURN f.path, r.line, r.specifiers, m.name');
+        const result = unwrapResult(await conn.execute(stmt, { name: modulePath }));
+        const rows = await result.getAll();
+        return rows.map((row) => ({
+            source: row['m.name'],
+            filePath: row['f.path'],
+            line: row['r.line'],
+            specifiers: row['r.specifiers'].split(',').filter(Boolean),
+        }));
+    }
+    // ── query (raw Cypher) ──
+    async function rawQuery(cypher, params) {
+        let result;
+        if (params && Object.keys(params).length > 0) {
+            const stmt = await conn.prepare(cypher);
+            result = await conn.execute(stmt, params);
+        }
+        else {
+            result = await conn.query(cypher);
+        }
+        const qr = unwrapResult(result);
+        return await qr.getAll();
+    }
+    // ── close ──
+    async function close() {
+        await conn.close();
+        await db.close();
+    }
+    return {
+        buildGraph,
+        getFunction,
+        getCallers,
+        getCallees,
+        getImportsOf,
+        query: rawQuery,
+        close,
+    };
+}
+// ── Internal helpers ──
+function escapeCypher(value) {
+    return value.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+}
+//# sourceMappingURL=store.js.map

package/dist/src/engines/graph/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../../src/engines/graph/store.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAoDxB,gBAAgB;AAEhB,SAAS,UAAU,CAAC,EAAgB;IAClC,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACjB,OAAO,GAAG,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,OAAO,CAAC,GAAc;IAC7B,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,MAA6C;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wBAAwB;AAExB,MAAM,iBAAiB,GAAG;IACxB,cAAc;IACd;;;;;;;;;;IAUE;IACF;;;;;;;;IAQE;IACF;;;;IAIE;IACF;;;IAGE;IACF,sBAAsB;IACtB,iEAAiE;IACjE,gEAAgE;IAChE,mEAAmE;IACnE,mEAAmE;IACnE,4FAA4F;CAC7F,CAAC;AAEF,uBAAuB;AAEvB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAErC,uBAAuB;IACvB,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,kCAAkC;IAClC,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,OAAO,CAC3C,6KAA6K,CAC9K,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,OAAO,CACxC,gIAAgI,CACjI,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,OAAO,CACvC,mDAAmD,CACpD,CAAC;IAEF,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,OAAO,CAC3C,uGAAuG,CACxG,CAAC;IACF,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,OAAO,CAChD,0GAA0G,CAC3G,CAAC;IACF,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5C,uGAAuG,CACxG,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,OAAO,CACxC,uGAAuG,CACxG,CAAC;IAEF,mBAAmB;IAEnB,KAAK,UAAU,UAAU,CAAC,WAAyB;QACjD,oDAAoD;QACpD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,2BAA2B;QAC5E,sDAAsD;QACtD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE9C,uBAAuB;QACvB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,mBAAmB;YACnB,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE;gBACjC,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YAEH,wBAAwB;YACxB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,MAAM,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC1B,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE;oBACrC,EAAE;oBACF,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,UAAU,EAAE,EAAE,CAAC,UAAU;oBACzB,SAAS,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE;iBAC9B,CAAC,CAAC;gBAEH,4BAA4B;gBAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACjC,CAAC;gBAED,wCAAwC;gBACxC,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;oBACjB,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;oBACnD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;wBACpC,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;oBACrC,CAAC;gBACH,CAAC;gBAED,0CAA0C;gBAC1C,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE;oBACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,EAAE;iBACT,CAAC,CAAC;YACL,CAAC;YAED,qBAAqB;YACrB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBACxB,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE;oBAClC,EAAE;oBACF,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B,CAAC,CAAC;gBAEH,6CAA6C;gBAC7C,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE;oBAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,EAAE;iBACZ,CAAC,CAAC;gBAEH,8CAA8C;gBAC9C,KAAK,MAAM,UAAU,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBACrC,MAAM,UAAU,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;oBAChE,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE;wBACtC,OAAO,EAAE,EAAE;wBACX,IAAI,EAAE,UAAU;qBACjB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,wCAAwC;YACxC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/B,iCAAiC;gBACjC,MAAM,IAAI,CAAC,KAAK,CAAC,0BAA0B,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAE1E,oCAAoC;gBACpC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CACnC,gJAAgJ,CACjJ,CAAC;gBACF,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;oBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,GAAG,CAAC,MAAM;oBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;iBACrC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClC,8BAA8B;gBAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;oBAC1C,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;wBACjB,OAAO,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC;oBACrC,CAAC;oBACD,OAAO,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC;gBACrC,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAEtC,8BAA8B;gBAC9B,IAAI,QAA4B,CAAC;gBAEjC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,uCAAuC;oBACvC,MAAM,aAAa,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC5D,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC5C,CAAC;gBAED,gCAAgC;gBAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,CAAC,QAAQ;oBAAE,SAAS,CAAC,8BAA8B;gBAEvD,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE;oBAClC,QAAQ;oBACR,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB;IAEpB,KAAK,UAAU,WAAW,CAAC,IAAY;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,+IAA+I,CAChJ,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,MAAM,CAAW;YACzB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAW;YAC7B,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAW;YACrC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAW;YACvC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAW;YACnC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAY;YACpC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAY;YAC1C,SAAS,EAAE,GAAG,CAAC,aAAa,CAAW;SACxC,CAAC;IACJ,CAAC;IAED,mBAAmB;IAEnB,KAAK,UAAU,UAAU,CACvB,YAAoB,EACpB,QAAgB,CAAC;QAEjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,sCAAsC,KAAK,+LAA+L,CAC3O,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QAEnC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,WAAW,CAAW;YAC9B,IAAI,EAAE,GAAG,CAAC,aAAa,CAAW;YAClC,QAAQ,EAAE,GAAG,CAAC,iBAAiB,CAAW;YAC1C,SAAS,EAAE,GAAG,CAAC,kBAAkB,CAAW;YAC5C,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAW;YACxC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAY;YACzC,UAAU,EAAE,GAAG,CAAC,mBAAmB,CAAY;YAC/C,SAAS,EAAE,GAAG,CAAC,kBAAkB,CAAW;SAC7C,CAAC,CAAC,CAAC;IACN,CAAC;IAED,mBAAmB;IAEnB,KAAK,UAAU,UAAU,CACvB,YAAoB,EACpB,QAAgB,CAAC;QAEjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,sCAAsC,KAAK,+LAA+L,CAC3O,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QAEnC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,WAAW,CAAW;YAC9B,IAAI,EAAE,GAAG,CAAC,aAAa,CAAW;YAClC,QAAQ,EAAE,GAAG,CAAC,iBAAiB,CAAW;YAC1C,SAAS,EAAE,GAAG,CAAC,kBAAkB,CAAW;YAC5C,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAW;YACxC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAY;YACzC,UAAU,EAAE,GAAG,CAAC,mBAAmB,CAAY;YAC/C,SAAS,EAAE,GAAG,CAAC,kBAAkB,CAAW;SAC7C,CAAC,CAAC,CAAC;IACN,CAAC;IAED,qBAAqB;IAErB,KAAK,UAAU,YAAY,CAAC,UAAkB;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,yGAAyG,CAC1G,CAAC;QACF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QAEnC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAW;YAC/B,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAW;YACjC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAW;YAC7B,UAAU,EAAG,GAAG,CAAC,cAAc,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SACvE,CAAC,CAAC,CAAC;IACN,CAAC;IAED,2BAA2B;IAE3B,KAAK,UAAU,QAAQ,CACrB,MAAc,EACd,MAAgC;QAEhC,IAAI,MAA6C,CAAC;QAClD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAwC,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,cAAc;IAEd,KAAK,UAAU,KAAK;QAClB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,OAAO;QACL,UAAU;QACV,WAAW;QACX,UAAU;QACV,UAAU;QACV,YAAY;QACZ,KAAK,EAAE,QAAQ;QACf,KAAK;KACN,CAAC;AACJ,CAAC;AAED,yBAAyB;AAEzB,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3D,CAAC"}

package/dist/src/engines/pattern/gitleaks.d.ts

@@ -0,0 +1,4 @@
+import type { Finding } from '../../types.js';
+export declare function checkGitleaksInstalled(): Promise<boolean>;
+export declare function runGitleaks(targetPath: string, _stagedFiles?: string[]): Promise<Finding[]>;
+//# sourceMappingURL=gitleaks.d.ts.map

package/dist/src/engines/pattern/gitleaks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../../../src/engines/pattern/gitleaks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAyD9C,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAO/D;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,OAAO,EAAE,CAAC,CAmCpB"}

package/dist/src/engines/pattern/gitleaks.js

@@ -0,0 +1,78 @@
+import { execFile } from 'node:child_process';
+function execFilePromise(cmd, args) {
+    return new Promise((resolve, reject) => {
+        execFile(cmd, args, (error, stdout, stderr) => {
+            if (error) {
+                // Attach stdout/stderr to the error so callers can still read output
+                const enrichedError = error;
+                enrichedError.stdout = typeof stdout === 'string' ? stdout : '';
+                enrichedError.stderr = typeof stderr === 'string' ? stderr : '';
+                reject(enrichedError);
+                return;
+            }
+            resolve({
+                stdout: typeof stdout === 'string' ? stdout : '',
+                stderr: typeof stderr === 'string' ? stderr : '',
+            });
+        });
+    });
+}
+function parseGitleaksOutput(jsonString) {
+    const results = JSON.parse(jsonString);
+    return results.map((result) => ({
+        id: `gitleaks_${result.RuleID}_${result.StartLine}`,
+        engine: 'pattern',
+        severity: 'critical',
+        type: 'hardcoded_secret',
+        file: result.File,
+        line: result.StartLine,
+        description: result.Description,
+        fix_suggestion: 'Move this secret to a .env file or environment variable',
+        auto_fixable: true,
+    }));
+}
+export async function checkGitleaksInstalled() {
+    try {
+        await execFilePromise('which', ['gitleaks']);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function runGitleaks(targetPath, _stagedFiles) {
+    const installed = await checkGitleaksInstalled();
+    if (!installed) {
+        console.warn('ShipSafe: gitleaks is not installed, skipping secret scan');
+        return [];
+    }
+    try {
+        const args = [
+            'detect',
+            '--source',
+            targetPath,
+            '--report-format',
+            'json',
+            '--report-path',
+            '/dev/stdout',
+            '--no-git',
+        ];
+        const { stdout } = await execFilePromise('gitleaks', args);
+        return parseGitleaksOutput(stdout);
+    }
+    catch (error) {
+        // gitleaks exits non-zero when it finds secrets — still try to parse output
+        const execError = error;
+        if (execError.stdout) {
+            try {
+                return parseGitleaksOutput(execError.stdout);
+            }
+            catch {
+                // JSON parse failed on the output — fall through to warn
+            }
+        }
+        console.warn('ShipSafe: gitleaks scan failed', execError.message);
+        return [];
+    }
+}
+//# sourceMappingURL=gitleaks.js.map

package/dist/src/engines/pattern/gitleaks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../../../src/engines/pattern/gitleaks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAiB9C,SAAS,eAAe,CACtB,GAAW,EACX,IAAc;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,qEAAqE;gBACrE,MAAM,aAAa,GAAG,KAGrB,CAAC;gBACF,aAAa,CAAC,MAAM,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,aAAa,CAAC,MAAM,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,aAAa,CAAC,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,OAAO,CAAC;gBACN,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBAChD,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aACjD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,MAAM,OAAO,GAAqB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9B,EAAE,EAAE,YAAY,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE;QACnD,MAAM,EAAE,SAAkB;QAC1B,QAAQ,EAAE,UAAmB;QAC7B,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,SAAS;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,yDAAyD;QACzE,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAkB,EAClB,YAAuB;IAEvB,MAAM,SAAS,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACjD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC1E,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG;YACX,QAAQ;YACR,UAAU;YACV,UAAU;YACV,iBAAiB;YACjB,MAAM;YACN,eAAe;YACf,aAAa;YACb,UAAU;SACX,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,4EAA4E;QAC5E,MAAM,SAAS,GAAG,KAAoC,CAAC;QACvD,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;YAC3D,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAClE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/src/engines/pattern/index.d.ts

@@ -0,0 +1,11 @@
+import type { Finding, ScanResult, ScanScope, SecurityScore, ScannerAvailability } from '../../types.js';
+export interface PatternEngineOptions {
+    targetPath: string;
+    scope: ScanScope;
+    stagedFiles?: string[];
+}
+export declare function computeScore(findings: Finding[]): SecurityScore;
+export declare function getAvailableScanners(): Promise<ScannerAvailability>;
+export declare function getStagedFiles(projectDir: string): Promise<string[]>;
+export declare function runPatternEngine(options: PatternEngineOptions): Promise<ScanResult>;
+//# sourceMappingURL=index.d.ts.map