kirograph 0.16.1 → 0.19.0

package/dist/bin/commands/vuln-suppress.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/vuln-suppress.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { dim, reset, violet, bold, green } from '../ui';\nimport { SuppressionManager } from '../../security/suppressions';\n\nexport function register(program: Command): void {\n  const vulnCmd = program\n    .command('vuln')\n    .description('CVE suppression management');\n\n  vulnCmd\n    .command('suppress <cveId> [projectPath]')\n    .description('Mark a CVE as suppressed (false positive or accepted risk)')\n    .option('--reason <text>', 'Reason for suppression')\n    .option('--expires <date>', 'Expiry date in ISO format (e.g. 2026-12-31)')\n    .action(async (cveId: string, projectPath: string | undefined, opts: {\n      reason?: string;\n      expires?: string;\n    }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const manager = new SuppressionManager(target);\n      manager.add(cveId, opts.reason, opts.expires);\n      const reasonNote = opts.reason ? ` ${dim}(${opts.reason})${reset}` : '';\n      console.log(`  ${green}\u2713${reset} ${violet}${bold}${cveId}${reset} suppressed${reasonNote}`);\n    });\n\n  vulnCmd\n    .command('unsuppress <cveId> [projectPath]')\n    .description('Remove a CVE suppression')\n    .action(async (cveId: string, projectPath: string | undefined) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const manager = new SuppressionManager(target);\n      const removed = manager.remove(cveId);\n      if (!removed) {\n        console.error(`  \u2716 No suppression found for ${violet}${bold}${cveId}${reset}`);\n        process.exit(1);\n      }\n      console.log(`  ${green}\u2713${reset} ${violet}${bold}${cveId}${reset} unsuppressed`);\n    });\n\n  vulnCmd\n    .command('suppressions [projectPath]')\n    .description('List all active CVE suppressions')\n    .option('--format <fmt>', 'Output format: table | json', 'table')\n    .action(async (projectPath: string | undefined, opts: { format?: string }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const manager = new SuppressionManager(target);\n      const suppressions = manager.getActive();\n\n      if (opts.format === 'json') {\n        console.log(JSON.stringify(suppressions, null, 2));\n        return;\n      }\n\n      if (suppressions.length === 0) {\n        console.log(`\\n  ${dim}No active suppressions.${reset}\\n`);\n        return;\n      }\n\n      const CVE_W = Math.max(6, ...suppressions.map(s => s.cveId.length));\n      const DATE_W = 12;\n      const EXP_W = 12;\n\n      const header =\n        `  ${bold}${'CVE ID'.padEnd(CVE_W)}${reset}  ` +\n        `${bold}${'Suppressed At'.padEnd(DATE_W)}${reset}  ` +\n        `${bold}${'Expires'.padEnd(EXP_W)}${reset}  ` +\n        `${bold}Reason${reset}`;\n\n      const separator = `  ${'\u2500'.repeat(CVE_W)}  ${'\u2500'.repeat(DATE_W)}  ${'\u2500'.repeat(EXP_W)}  ${'\u2500'.repeat(20)}`;\n\n      console.log(`\\n  ${bold}Active Suppressions${reset} (${suppressions.length})\\n`);\n      console.log(header);\n      console.log(separator);\n\n      for (const s of suppressions) {\n        const suppressedDate = s.suppressedAt.slice(0, 10);\n        const expiresStr = s.expiresAt ? s.expiresAt.slice(0, 10) : dim + '\u2014' + reset;\n        const reasonStr = s.reason ? `${dim}${s.reason}${reset}` : `${dim}\u2014${reset}`;\n        console.log(\n          `  ${violet}${s.cveId.padEnd(CVE_W)}${reset}  ` +\n          `${suppressedDate.padEnd(DATE_W)}  ` +\n          `${expiresStr.padEnd(EXP_W + (s.expiresAt ? 0 : (dim + reset).length))}  ` +\n          `${reasonStr}`,\n        );\n      }\n\n      console.log();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,gBAAgD;AAChD,0BAAmC;AAE5B,SAAS,SAAS,SAAwB;AAC/C,QAAM,UAAU,QACb,QAAQ,MAAM,EACd,YAAY,4BAA4B;AAE3C,UACG,QAAQ,gCAAgC,EACxC,YAAY,4DAA4D,EACxE,OAAO,mBAAmB,wBAAwB,EAClD,OAAO,oBAAoB,6CAA6C,EACxE,OAAO,OAAO,OAAe,aAAiC,SAGzD;AACJ,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,UAAU,IAAI,uCAAmB,MAAM;AAC7C,YAAQ,IAAI,OAAO,KAAK,QAAQ,KAAK,OAAO;AAC5C,UAAM,aAAa,KAAK,SAAS,IAAI,aAAG,IAAI,KAAK,MAAM,IAAI,eAAK,KAAK;AACrE,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,IAAI,gBAAM,GAAG,cAAI,GAAG,KAAK,GAAG,eAAK,cAAc,UAAU,EAAE;AAAA,EAC5F,CAAC;AAEH,UACG,QAAQ,kCAAkC,EAC1C,YAAY,0BAA0B,EACtC,OAAO,OAAO,OAAe,gBAAoC;AAChE,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,UAAU,IAAI,uCAAmB,MAAM;AAC7C,UAAM,UAAU,QAAQ,OAAO,KAAK;AACpC,QAAI,CAAC,SAAS;AACZ,cAAQ,MAAM,qCAAgC,gBAAM,GAAG,cAAI,GAAG,KAAK,GAAG,eAAK,EAAE;AAC7E,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,IAAI,gBAAM,GAAG,cAAI,GAAG,KAAK,GAAG,eAAK,eAAe;AAAA,EACjF,CAAC;AAEH,UACG,QAAQ,4BAA4B,EACpC,YAAY,kCAAkC,EAC9C,OAAO,kBAAkB,+BAA+B,OAAO,EAC/D,OAAO,OAAO,aAAiC,SAA8B;AAC5E,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,UAAU,IAAI,uCAAmB,MAAM;AAC7C,UAAM,eAAe,QAAQ,UAAU;AAEvC,QAAI,KAAK,WAAW,QAAQ;AAC1B,cAAQ,IAAI,KAAK,UAAU,cAAc,MAAM,CAAC,CAAC;AACjD;AAAA,IACF;AAEA,QAAI,aAAa,WAAW,GAAG;AAC7B,cAAQ,IAAI;AAAA,IAAO,aAAG,0BAA0B,eAAK;AAAA,CAAI;AACzD;AAAA,IACF;AAEA,UAAM,QAAQ,KAAK,IAAI,GAAG,GAAG,aAAa,IAAI,OAAK,EAAE,MAAM,MAAM,CAAC;AAClE,UAAM,SAAS;AACf,UAAM,QAAQ;AAEd,UAAM,SACJ,KAAK,cAAI,GAAG,SAAS,OAAO,KAAK,CAAC,GAAG,eAAK,KACvC,cAAI,GAAG,gBAAgB,OAAO,MAAM,CAAC,GAAG,eAAK,KAC7C,cAAI,GAAG,UAAU,OAAO,KAAK,CAAC,GAAG,eAAK,KACtC,cAAI,SAAS,eAAK;AAEvB,UAAM,YAAY,KAAK,SAAI,OAAO,KAAK,CAAC,KAAK,SAAI,OAAO,MAAM,CAAC,KAAK,SAAI,OAAO,KAAK,CAAC,KAAK,SAAI,OAAO,EAAE,CAAC;AAExG,YAAQ,IAAI;AAAA,IAAO,cAAI,sBAAsB,eAAK,KAAK,aAAa,MAAM;AAAA,CAAK;AAC/E,YAAQ,IAAI,MAAM;AAClB,YAAQ,IAAI,SAAS;AAErB,eAAW,KAAK,cAAc;AAC5B,YAAM,iBAAiB,EAAE,aAAa,MAAM,GAAG,EAAE;AACjD,YAAM,aAAa,EAAE,YAAY,EAAE,UAAU,MAAM,GAAG,EAAE,IAAI,gBAAM,WAAM;AACxE,YAAM,YAAY,EAAE,SAAS,GAAG,aAAG,GAAG,EAAE,MAAM,GAAG,eAAK,KAAK,GAAG,aAAG,SAAI,eAAK;AAC1E,cAAQ;AAAA,QACN,KAAK,gBAAM,GAAG,EAAE,MAAM,OAAO,KAAK,CAAC,GAAG,eAAK,KACxC,eAAe,OAAO,MAAM,CAAC,KAC7B,WAAW,OAAO,SAAS,EAAE,YAAY,KAAK,gBAAM,iBAAO,OAAO,CAAC,KACnE,SAAS;AAAA,MACd;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/vulns.js

@@ -0,0 +1,382 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var vulns_exports = {};
+__export(vulns_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(vulns_exports);
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+var import_fix_suggestions = require("../../security/export/fix-suggestions");
+var import_suppressions = require("../../security/suppressions");
+function parseEpssFailOn(failOn) {
+  const m = failOn.match(/^epss=(.+)$/);
+  if (!m) return null;
+  const n = parseFloat(m[1]);
+  return isNaN(n) ? null : n;
+}
+function workspaceFromManifests(sourceManifests) {
+  if (!sourceManifests) return "root";
+  try {
+    const manifests = JSON.parse(sourceManifests);
+    if (!manifests.length) return "root";
+    const dir = path.dirname(manifests[0]);
+    return dir === "." ? "root" : dir;
+  } catch {
+    return "root";
+  }
+}
+function register(program) {
+  program.command("vulns [projectPath]").description("List vulnerabilities with reachability verdicts and severity").option("--severity <level>", "Filter by severity: critical, high, medium, low").option("--verdict <verdict>", "Filter by verdict: affected, not_affected, under_investigation").option("--refresh", "Trigger fresh vulnerability enrichment before listing").option("--epss <threshold>", "Filter by EPSS score (e.g. 0.5 shows only vulns with EPSS >= 0.5)").option("--stale", "Show staleness score of the affected dependency alongside each CVE").option("--sort <key>", "Sort results by: risk (default), cvss, epss, name").option("--add <cveId>", "Manually register a CVE").option("--package <name>", "Package name for --add").option("--version <ver>", "Package version for --add").option("--fail-on <condition>", "Exit 1 if condition is met: affected, any, critical, high, epss=N").option("--group-by <key>", "Group output by: workspace").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(target);
+    if (!config.enableSecurity) {
+      console.error(`
+  ${"\x1B[33m"}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    if (opts.failOn !== void 0) {
+      const validFailOns = ["affected", "any", "critical", "high"];
+      const isEpss = parseEpssFailOn(opts.failOn) !== null;
+      if (!validFailOns.includes(opts.failOn) && !isEpss) {
+        console.error(`  \u2716 Invalid --fail-on value: ${opts.failOn}. Use: affected, any, critical, high, epss=N`);
+        process.exit(1);
+      }
+    }
+    if (opts.groupBy !== void 0 && opts.groupBy !== "workspace") {
+      console.error(`  \u2716 Invalid --group-by value: ${opts.groupBy}. Supported: workspace`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const rawDb = db.getRawDb();
+    if (opts.add) {
+      if (!opts.package || !opts.version) {
+        console.error(`  \u2716 --add requires --package <name> and --version <ver>`);
+        cg.close();
+        process.exit(1);
+      }
+      const cveId = opts.add;
+      const pkgName = opts.package;
+      const pkgVersion = opts.version;
+      const depRow = rawDb.get(
+        `SELECT node_id, ecosystem FROM sec_dependencies
+           WHERE package_name = ? AND (resolved_version = ? OR declared_constraint = ?)`,
+        [pkgName, pkgVersion, pkgVersion]
+      );
+      if (!depRow) {
+        console.error(`  \u2716 No dependency found matching ${import_ui.violet}${pkgName}@${pkgVersion}${import_ui.reset}`);
+        console.error(`  ${import_ui.dim}Run${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset} ${import_ui.dim}first to discover dependencies.${import_ui.reset}`);
+        cg.close();
+        process.exit(1);
+      }
+      const vulnNodeId = `vuln:${cveId}`;
+      const now = Date.now();
+      rawDb.run(
+        `INSERT OR REPLACE INTO nodes
+            (id, kind, name, qualified_name, file_path, language,
+             start_line, end_line, start_column, end_column,
+             is_exported, is_async, is_static, is_abstract, updated_at)
+           VALUES (?, 'vulnerability', ?, ?, '', 'unknown', 0, 0, 0, 0, 0, 0, 0, 0, ?)`,
+        [vulnNodeId, cveId, cveId, now]
+      );
+      rawDb.run(
+        `INSERT OR REPLACE INTO sec_vulnerabilities
+            (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)
+           VALUES (?, ?, NULL, '[]', NULL, 'Manually registered', 'manual')`,
+        [vulnNodeId, cveId]
+      );
+      rawDb.run(
+        `INSERT OR IGNORE INTO edges (source, target, kind, confidence, confidence_score)
+           VALUES (?, ?, 'has_vulnerability', 'extracted', 1.0)`,
+        [depRow.node_id, vulnNodeId]
+      );
+      console.log(`  ${import_ui.green}\u2713${import_ui.reset} Registered ${import_ui.violet}${import_ui.bold}${cveId}${import_ui.reset} against ${import_ui.violet}${pkgName}@${pkgVersion}${import_ui.reset}`);
+      cg.close();
+      return;
+    }
+    if (opts.refresh) {
+      console.error(`  ${import_ui.dim}Refreshing vulnerability data from configured databases...${import_ui.reset}`);
+      const { OsvAdapter } = await Promise.resolve().then(() => require("../../security/vuln/osv-adapter.js"));
+      const { VulnerabilityDatabaseClient } = await Promise.resolve().then(() => require("../../security/vuln/client.js"));
+      const adapters = config.securityDatabases.map((dbName) => {
+        if (dbName.toUpperCase() === "OSV") return new OsvAdapter();
+        return null;
+      }).filter(Boolean);
+      const client = new VulnerabilityDatabaseClient(adapters, db);
+      const result = await client.enrichAll();
+      console.error(`  ${import_ui.green}\u2713${import_ui.reset} Checked ${import_ui.bold}${result.dependenciesChecked}${import_ui.reset} dependencies, found ${import_ui.bold}${result.vulnerabilitiesFound}${import_ui.reset} vulnerabilities`);
+      if (result.errors.length > 0) {
+        console.error(`  ${"\x1B[33m"}\u26A0${import_ui.reset} ${result.errors.length} error(s) during enrichment`);
+      }
+      console.error();
+    }
+    const selectSourceManifests = opts.groupBy === "workspace" ? `,
+          d.source_manifests` : "";
+    let query = `
+        SELECT
+          v.node_id, v.cve_id, v.severity_score, v.fixed_version, v.summary, v.source_database,
+          v.epss_score, v.epss_percentile, v.risk_score,
+          d.package_name, d.ecosystem, d.resolved_version, d.declared_constraint,
+          d.staleness_score,
+          r.verdict${selectSourceManifests}
+        FROM sec_vulnerabilities v
+        LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'
+        LEFT JOIN sec_dependencies d ON d.node_id = e.source
+        LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id
+        WHERE 1=1
+      `;
+    const params = [];
+    if (opts.severity) {
+      const severityRanges = {
+        critical: [9, 10],
+        high: [7, 8.9],
+        medium: [4, 6.9],
+        low: [0.1, 3.9]
+      };
+      const range = severityRanges[opts.severity.toLowerCase()];
+      if (!range) {
+        console.error(`  \u2716 Invalid severity: ${opts.severity}. Use: critical, high, medium, low`);
+        cg.close();
+        process.exit(1);
+      }
+      query += ` AND v.severity_score >= ? AND v.severity_score <= ?`;
+      params.push(range[0], range[1]);
+    }
+    if (opts.verdict) {
+      const validVerdicts = ["affected", "not_affected", "under_investigation"];
+      if (!validVerdicts.includes(opts.verdict)) {
+        console.error(`  \u2716 Invalid verdict: ${opts.verdict}. Use: affected, not_affected, under_investigation`);
+        cg.close();
+        process.exit(1);
+      }
+      query += ` AND r.verdict = ?`;
+      params.push(opts.verdict);
+    }
+    if (opts.epss !== void 0) {
+      const epssThreshold = parseFloat(opts.epss);
+      if (isNaN(epssThreshold) || epssThreshold < 0 || epssThreshold > 1) {
+        console.error(`  \u2716 Invalid EPSS threshold: ${opts.epss}. Use a number between 0 and 1 (e.g. 0.5)`);
+        cg.close();
+        process.exit(1);
+      }
+      query += ` AND v.epss_score >= ?`;
+      params.push(epssThreshold);
+    }
+    const sortKey = opts.sort?.toLowerCase() ?? "risk";
+    const validSortKeys = ["risk", "cvss", "epss", "name"];
+    if (!validSortKeys.includes(sortKey)) {
+      console.error(`  \u2716 Invalid sort key: ${opts.sort}. Use: risk, cvss, epss, name`);
+      cg.close();
+      process.exit(1);
+    }
+    const sortClause = sortKey === "risk" ? `v.risk_score DESC NULLS LAST` : sortKey === "cvss" ? `v.severity_score DESC NULLS LAST` : sortKey === "epss" ? `v.epss_score DESC NULLS LAST` : `v.cve_id ASC`;
+    query += ` ORDER BY ${sortClause}`;
+    const rows = rawDb.all(query, params);
+    const verdictRank = (v) => v === "affected" ? 3 : v === "under_investigation" ? 2 : v === "not_affected" ? 1 : 0;
+    const deduped = /* @__PURE__ */ new Map();
+    for (const row of rows) {
+      const key = `${row.cve_id}::${row.package_name ?? ""}::${row.ecosystem ?? ""}`;
+      const existing = deduped.get(key);
+      if (!existing || verdictRank(row.verdict) > verdictRank(existing.verdict)) {
+        deduped.set(key, row);
+      }
+    }
+    const dedupedRows = [...deduped.values()];
+    const suppressions = new import_suppressions.SuppressionManager(target);
+    const suppressedRows = dedupedRows.filter((row) => suppressions.isSuppressed(row.cve_id));
+    const filteredRows = dedupedRows.filter((row) => !suppressions.isSuppressed(row.cve_id));
+    if (filteredRows.length === 0) {
+      const filterNote = opts.severity || opts.verdict ? ` matching filters` : "";
+      console.log(`
+  ${import_ui.dim}No vulnerabilities found${filterNote}.${import_ui.reset}
+`);
+      if (suppressedRows.length > 0) {
+        console.log(`  ${import_ui.dim}${suppressedRows.length} CVE(s) suppressed \u2014 kirograph vuln suppressions to review${import_ui.reset}
+`);
+      }
+      cg.close();
+      return;
+    }
+    function printVulnRow(row, indent = "  ") {
+      const score = row.severity_score;
+      let severityLabel;
+      let severityColor;
+      if (score == null) {
+        severityLabel = "unknown";
+        severityColor = import_ui.dim;
+      } else if (score >= 9) {
+        severityLabel = "CRITICAL";
+        severityColor = "\x1B[31m";
+      } else if (score >= 7) {
+        severityLabel = "HIGH";
+        severityColor = "\x1B[31m";
+      } else if (score >= 4) {
+        severityLabel = "MEDIUM";
+        severityColor = "\x1B[33m";
+      } else {
+        severityLabel = "LOW";
+        severityColor = import_ui.dim;
+      }
+      let verdictLabel;
+      let verdictColor;
+      if (!row.verdict) {
+        verdictLabel = "pending";
+        verdictColor = import_ui.dim;
+      } else if (row.verdict === "affected") {
+        verdictLabel = "affected";
+        verdictColor = "\x1B[31m";
+      } else if (row.verdict === "not_affected") {
+        verdictLabel = "not affected";
+        verdictColor = import_ui.green;
+      } else {
+        verdictLabel = "investigating";
+        verdictColor = "\x1B[33m";
+      }
+      const pkg = row.package_name ? `${row.package_name}@${row.resolved_version || row.declared_constraint || "?"}` : "unknown package";
+      let epssBadge = "";
+      if (row.epss_score != null && row.epss_percentile != null) {
+        const epssColor = row.epss_score >= 0.3 ? "\x1B[33m" : import_ui.dim;
+        const scoreStr = row.epss_score.toFixed(2);
+        const pctStr = `${Math.round(row.epss_percentile * 100)}th%`;
+        epssBadge = `  ${epssColor}${import_ui.dim}[EPSS: ${scoreStr} / ${pctStr}]${import_ui.reset}`;
+      }
+      let riskBadge = "";
+      if (row.risk_score != null) {
+        const riskColor = row.risk_score >= 7 ? "\x1B[31m" : row.risk_score >= 4 ? "\x1B[33m" : import_ui.dim;
+        riskBadge = `  ${riskColor}[Risk: ${row.risk_score.toFixed(1)}]${import_ui.reset}`;
+      }
+      console.log(`${indent}${severityColor}${severityLabel}${import_ui.reset}  ${import_ui.violet}${import_ui.bold}${row.cve_id}${import_ui.reset}  ${import_ui.dim}${pkg}${import_ui.reset}  [${verdictColor}${verdictLabel}${import_ui.reset}]${epssBadge}${riskBadge}`);
+      if (row.summary && row.summary !== "Manually registered") {
+        const truncated = row.summary.length > 100 ? row.summary.slice(0, 100) + "\u2026" : row.summary;
+        console.log(`${indent}  ${import_ui.dim}${truncated}${import_ui.reset}`);
+      }
+      if (opts.stale && row.staleness_score != null) {
+        const s = row.staleness_score;
+        const staleColor = s >= 0.7 ? "\x1B[31m" : s >= 0.4 ? "\x1B[33m" : import_ui.dim;
+        console.log(`${indent}  ${staleColor}${import_ui.dim}[staleness: ${s.toFixed(2)}]${import_ui.reset}`);
+      }
+      if (row.fixed_version && row.ecosystem && row.package_name) {
+        const fix = (0, import_fix_suggestions.formatFixSuggestion)(row.ecosystem, row.package_name, row.fixed_version);
+        if (fix) {
+          console.log(`${indent}  ${fix}`);
+        }
+      }
+      console.log();
+    }
+    if (opts.groupBy === "workspace") {
+      const groups = /* @__PURE__ */ new Map();
+      for (const row of filteredRows) {
+        const ws = workspaceFromManifests(row.source_manifests ?? null);
+        if (!groups.has(ws)) groups.set(ws, []);
+        groups.get(ws).push(row);
+      }
+      const workspaces = Array.from(groups.keys());
+      if (workspaces.length <= 1) {
+        console.log(`
+  ${import_ui.bold}Vulnerabilities${import_ui.reset} (${filteredRows.length})
+`);
+        for (const row of filteredRows) {
+          printVulnRow(row);
+        }
+      } else {
+        console.log(`
+  ${import_ui.bold}Vulnerabilities${import_ui.reset} (${filteredRows.length})
+`);
+        for (const ws of workspaces) {
+          const wsRows = groups.get(ws);
+          const count = wsRows.length;
+          const header = `Workspace: ${ws} (${count} vulnerabilit${count === 1 ? "y" : "ies"})`;
+          const line = "\u2500".repeat(header.length);
+          console.log(`  ${import_ui.bold}${header}${import_ui.reset}`);
+          console.log(`  ${import_ui.dim}${line}${import_ui.reset}`);
+          for (const row of wsRows) {
+            printVulnRow(row);
+          }
+        }
+      }
+    } else {
+      console.log(`
+  ${import_ui.bold}Vulnerabilities${import_ui.reset} (${filteredRows.length})
+`);
+      for (const row of filteredRows) {
+        printVulnRow(row);
+      }
+    }
+    if (suppressedRows.length > 0) {
+      console.log(`  ${import_ui.dim}${suppressedRows.length} CVE(s) suppressed \u2014 kirograph vuln suppressions to review${import_ui.reset}
+`);
+    }
+    if (opts.failOn !== void 0) {
+      const failOn = opts.failOn;
+      let failCount = 0;
+      let failReason = "";
+      if (failOn === "affected") {
+        failCount = filteredRows.filter((r) => r.verdict === "affected").length;
+        failReason = `affected`;
+      } else if (failOn === "any") {
+        failCount = filteredRows.length;
+        failReason = `any`;
+      } else if (failOn === "critical") {
+        failCount = filteredRows.filter((r) => r.severity_score != null && r.severity_score >= 9).length;
+        failReason = `critical`;
+      } else if (failOn === "high") {
+        failCount = filteredRows.filter((r) => r.severity_score != null && r.severity_score >= 7).length;
+        failReason = `high`;
+      } else {
+        const epssThreshold = parseEpssFailOn(failOn);
+        if (epssThreshold !== null) {
+          failCount = filteredRows.filter((r) => r.epss_score != null && r.epss_score >= epssThreshold).length;
+          failReason = `epss=${epssThreshold}`;
+        }
+      }
+      if (failCount > 0) {
+        console.log(`  \x1B[31m\u2716\x1B[0m --fail-on ${failReason}: ${failCount} ${failReason === "any" ? "" : `${failReason} `}vulnerabilit${failCount === 1 ? "y" : "ies"} found. Exiting with code 1.`);
+        cg.close();
+        process.exit(1);
+      }
+    }
+    cg.close();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=vulns.js.map

package/dist/bin/commands/vulns.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/vulns.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\nimport { formatFixSuggestion } from '../../security/export/fix-suggestions';\nimport { SuppressionManager } from '../../security/suppressions';\n\n// \u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** Parse an `epss=N` fail-on value and return the threshold, or null if not an epss condition. */\nfunction parseEpssFailOn(failOn: string): number | null {\n  const m = failOn.match(/^epss=(.+)$/);\n  if (!m) return null;\n  const n = parseFloat(m[1]);\n  return isNaN(n) ? null : n;\n}\n\n/** Extract workspace label from a source_manifests JSON string. */\nfunction workspaceFromManifests(sourceManifests: string | null): string {\n  if (!sourceManifests) return 'root';\n  try {\n    const manifests: string[] = JSON.parse(sourceManifests);\n    if (!manifests.length) return 'root';\n    const dir = path.dirname(manifests[0]);\n    return dir === '.' ? 'root' : dir;\n  } catch {\n    return 'root';\n  }\n}\n\nexport function register(program: Command): void {\n  program\n    .command('vulns [projectPath]')\n    .description('List vulnerabilities with reachability verdicts and severity')\n    .option('--severity <level>', 'Filter by severity: critical, high, medium, low')\n    .option('--verdict <verdict>', 'Filter by verdict: affected, not_affected, under_investigation')\n    .option('--refresh', 'Trigger fresh vulnerability enrichment before listing')\n    .option('--epss <threshold>', 'Filter by EPSS score (e.g. 0.5 shows only vulns with EPSS >= 0.5)')\n    .option('--stale', 'Show staleness score of the affected dependency alongside each CVE')\n    .option('--sort <key>', 'Sort results by: risk (default), cvss, epss, name')\n    .option('--add <cveId>', 'Manually register a CVE')\n    .option('--package <name>', 'Package name for --add')\n    .option('--version <ver>', 'Package version for --add')\n    .option('--fail-on <condition>', 'Exit 1 if condition is met: affected, any, critical, high, epss=N')\n    .option('--group-by <key>', 'Group output by: workspace')\n    .action(async (projectPath: string | undefined, opts: {\n      severity?: string;\n      verdict?: string;\n      refresh?: boolean;\n      epss?: string;\n      stale?: boolean;\n      sort?: string;\n      add?: string;\n      package?: string;\n      version?: string;\n      failOn?: string;\n      groupBy?: string;\n    }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      // Validate --fail-on early\n      if (opts.failOn !== undefined) {\n        const validFailOns = ['affected', 'any', 'critical', 'high'];\n        const isEpss = parseEpssFailOn(opts.failOn) !== null;\n        if (!validFailOns.includes(opts.failOn) && !isEpss) {\n          console.error(`  \u2716 Invalid --fail-on value: ${opts.failOn}. Use: affected, any, critical, high, epss=N`);\n          process.exit(1);\n        }\n      }\n\n      // Validate --group-by early\n      if (opts.groupBy !== undefined && opts.groupBy !== 'workspace') {\n        console.error(`  \u2716 Invalid --group-by value: ${opts.groupBy}. Supported: workspace`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n      const rawDb = db.getRawDb();\n\n      // Handle --add: manually register a CVE\n      if (opts.add) {\n        if (!opts.package || !opts.version) {\n          console.error(`  \u2716 --add requires --package <name> and --version <ver>`);\n          cg.close(); process.exit(1);\n        }\n\n        const cveId = opts.add;\n        const pkgName = opts.package;\n        const pkgVersion = opts.version;\n\n        // Find the matching dependency node\n        const depRow: { node_id: string; ecosystem: string } | undefined = rawDb.get(\n          `SELECT node_id, ecosystem FROM sec_dependencies\n           WHERE package_name = ? AND (resolved_version = ? OR declared_constraint = ?)`,\n          [pkgName, pkgVersion, pkgVersion],\n        );\n\n        if (!depRow) {\n          console.error(`  \u2716 No dependency found matching ${violet}${pkgName}@${pkgVersion}${reset}`);\n          console.error(`  ${dim}Run${reset} ${violet}${bold}kirograph index${reset} ${dim}first to discover dependencies.${reset}`);\n          cg.close(); process.exit(1);\n        }\n\n        // Create the vulnerability node\n        const vulnNodeId = `vuln:${cveId}`;\n        const now = Date.now();\n\n        rawDb.run(\n          `INSERT OR REPLACE INTO nodes\n            (id, kind, name, qualified_name, file_path, language,\n             start_line, end_line, start_column, end_column,\n             is_exported, is_async, is_static, is_abstract, updated_at)\n           VALUES (?, 'vulnerability', ?, ?, '', 'unknown', 0, 0, 0, 0, 0, 0, 0, 0, ?)`,\n          [vulnNodeId, cveId, cveId, now],\n        );\n\n        rawDb.run(\n          `INSERT OR REPLACE INTO sec_vulnerabilities\n            (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)\n           VALUES (?, ?, NULL, '[]', NULL, 'Manually registered', 'manual')`,\n          [vulnNodeId, cveId],\n        );\n\n        // Create has_vulnerability edge\n        rawDb.run(\n          `INSERT OR IGNORE INTO edges (source, target, kind, confidence, confidence_score)\n           VALUES (?, ?, 'has_vulnerability', 'extracted', 1.0)`,\n          [depRow.node_id, vulnNodeId],\n        );\n\n        console.log(`  ${green}\u2713${reset} Registered ${violet}${bold}${cveId}${reset} against ${violet}${pkgName}@${pkgVersion}${reset}`);\n        cg.close();\n        return;\n      }\n\n      // Handle --refresh: trigger fresh vulnerability enrichment\n      if (opts.refresh) {\n        console.error(`  ${dim}Refreshing vulnerability data from configured databases...${reset}`);\n        const { OsvAdapter } = await Promise.resolve().then(() => require('../../security/vuln/osv-adapter.js'));\n        const { VulnerabilityDatabaseClient } = await Promise.resolve().then(() => require('../../security/vuln/client.js'));\n\n        const adapters = config.securityDatabases.map((dbName: string) => {\n          if (dbName.toUpperCase() === 'OSV') return new OsvAdapter();\n          return null;\n        }).filter(Boolean) as any[];\n\n        const client = new VulnerabilityDatabaseClient(adapters, db);\n        const result = await client.enrichAll();\n\n        console.error(`  ${green}\u2713${reset} Checked ${bold}${result.dependenciesChecked}${reset} dependencies, found ${bold}${result.vulnerabilitiesFound}${reset} vulnerabilities`);\n        if (result.errors.length > 0) {\n          console.error(`  ${'\\x1b[33m'}\u26A0${reset} ${result.errors.length} error(s) during enrichment`);\n        }\n        console.error();\n      }\n\n      // Build query for listing vulnerabilities\n      // Include source_manifests when group-by workspace is requested\n      const selectSourceManifests = opts.groupBy === 'workspace' ? `,\\n          d.source_manifests` : '';\n      let query = `\n        SELECT\n          v.node_id, v.cve_id, v.severity_score, v.fixed_version, v.summary, v.source_database,\n          v.epss_score, v.epss_percentile, v.risk_score,\n          d.package_name, d.ecosystem, d.resolved_version, d.declared_constraint,\n          d.staleness_score,\n          r.verdict${selectSourceManifests}\n        FROM sec_vulnerabilities v\n        LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n        LEFT JOIN sec_dependencies d ON d.node_id = e.source\n        LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n        WHERE 1=1\n      `;\n      const params: any[] = [];\n\n      // Apply severity filter\n      if (opts.severity) {\n        const severityRanges: Record<string, [number, number]> = {\n          critical: [9.0, 10.0],\n          high: [7.0, 8.9],\n          medium: [4.0, 6.9],\n          low: [0.1, 3.9],\n        };\n        const range = severityRanges[opts.severity.toLowerCase()];\n        if (!range) {\n          console.error(`  \u2716 Invalid severity: ${opts.severity}. Use: critical, high, medium, low`);\n          cg.close(); process.exit(1);\n        }\n        query += ` AND v.severity_score >= ? AND v.severity_score <= ?`;\n        params.push(range[0], range[1]);\n      }\n\n      // Apply verdict filter\n      if (opts.verdict) {\n        const validVerdicts = ['affected', 'not_affected', 'under_investigation'];\n        if (!validVerdicts.includes(opts.verdict)) {\n          console.error(`  \u2716 Invalid verdict: ${opts.verdict}. Use: affected, not_affected, under_investigation`);\n          cg.close(); process.exit(1);\n        }\n        query += ` AND r.verdict = ?`;\n        params.push(opts.verdict);\n      }\n\n      // Apply EPSS threshold filter\n      if (opts.epss !== undefined) {\n        const epssThreshold = parseFloat(opts.epss);\n        if (isNaN(epssThreshold) || epssThreshold < 0 || epssThreshold > 1) {\n          console.error(`  \u2716 Invalid EPSS threshold: ${opts.epss}. Use a number between 0 and 1 (e.g. 0.5)`);\n          cg.close(); process.exit(1);\n        }\n        query += ` AND v.epss_score >= ?`;\n        params.push(epssThreshold);\n      }\n\n      // Resolve sort order\n      const sortKey = opts.sort?.toLowerCase() ?? 'risk';\n      const validSortKeys = ['risk', 'cvss', 'epss', 'name'];\n      if (!validSortKeys.includes(sortKey)) {\n        console.error(`  \u2716 Invalid sort key: ${opts.sort}. Use: risk, cvss, epss, name`);\n        cg.close(); process.exit(1);\n      }\n      const sortClause =\n        sortKey === 'risk' ? `v.risk_score DESC NULLS LAST` :\n        sortKey === 'cvss' ? `v.severity_score DESC NULLS LAST` :\n        sortKey === 'epss' ? `v.epss_score DESC NULLS LAST` :\n        `v.cve_id ASC`;\n      query += ` ORDER BY ${sortClause}`;\n\n      const rows: Array<{\n        node_id: string;\n        cve_id: string;\n        severity_score: number | null;\n        fixed_version: string | null;\n        summary: string | null;\n        source_database: string;\n        epss_score: number | null;\n        epss_percentile: number | null;\n        risk_score: number | null;\n        package_name: string | null;\n        ecosystem: string | null;\n        resolved_version: string | null;\n        declared_constraint: string | null;\n        staleness_score: number | null;\n        verdict: string | null;\n        source_manifests?: string | null;\n      }> = rawDb.all(query, params);\n\n      // Deduplicate by (cve_id, package_name, ecosystem) \u2014 same CVE can appear multiple\n      // times if a package is declared in multiple manifests (monorepo) or has multiple\n      // dep nodes. Keep the row with the worst verdict (affected > under_investigation > not_affected > null).\n      const verdictRank = (v: string | null) =>\n        v === 'affected' ? 3 : v === 'under_investigation' ? 2 : v === 'not_affected' ? 1 : 0;\n      const deduped = new Map<string, typeof rows[0]>();\n      for (const row of rows) {\n        const key = `${row.cve_id}::${row.package_name ?? ''}::${row.ecosystem ?? ''}`;\n        const existing = deduped.get(key);\n        if (!existing || verdictRank(row.verdict) > verdictRank(existing.verdict)) {\n          deduped.set(key, row);\n        }\n      }\n      const dedupedRows = [...deduped.values()];\n\n      // Filter out suppressed CVEs\n      const suppressions = new SuppressionManager(target);\n      const suppressedRows = dedupedRows.filter(row => suppressions.isSuppressed(row.cve_id));\n      const filteredRows = dedupedRows.filter(row => !suppressions.isSuppressed(row.cve_id));\n\n      if (filteredRows.length === 0) {\n        const filterNote = (opts.severity || opts.verdict)\n          ? ` matching filters`\n          : '';\n        console.log(`\\n  ${dim}No vulnerabilities found${filterNote}.${reset}\\n`);\n        if (suppressedRows.length > 0) {\n          console.log(`  ${dim}${suppressedRows.length} CVE(s) suppressed \u2014 kirograph vuln suppressions to review${reset}\\n`);\n        }\n        cg.close();\n        return;\n      }\n\n      // \u2500\u2500 Render a single vulnerability row \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      function printVulnRow(row: (typeof filteredRows)[0], indent = '  '): void {\n        // Severity badge\n        const score = row.severity_score;\n        let severityLabel: string;\n        let severityColor: string;\n        if (score == null) {\n          severityLabel = 'unknown';\n          severityColor = dim;\n        } else if (score >= 9.0) {\n          severityLabel = 'CRITICAL';\n          severityColor = '\\x1b[31m';\n        } else if (score >= 7.0) {\n          severityLabel = 'HIGH';\n          severityColor = '\\x1b[31m';\n        } else if (score >= 4.0) {\n          severityLabel = 'MEDIUM';\n          severityColor = '\\x1b[33m';\n        } else {\n          severityLabel = 'LOW';\n          severityColor = dim;\n        }\n\n        // Verdict badge\n        let verdictLabel: string;\n        let verdictColor: string;\n        if (!row.verdict) {\n          verdictLabel = 'pending';\n          verdictColor = dim;\n        } else if (row.verdict === 'affected') {\n          verdictLabel = 'affected';\n          verdictColor = '\\x1b[31m';\n        } else if (row.verdict === 'not_affected') {\n          verdictLabel = 'not affected';\n          verdictColor = green;\n        } else {\n          verdictLabel = 'investigating';\n          verdictColor = '\\x1b[33m';\n        }\n\n        const pkg = row.package_name\n          ? `${row.package_name}@${row.resolved_version || row.declared_constraint || '?'}`\n          : 'unknown package';\n\n        // EPSS badge\n        let epssBadge = '';\n        if (row.epss_score != null && row.epss_percentile != null) {\n          const epssColor = row.epss_score >= 0.3 ? '\\x1b[33m' : dim;\n          const scoreStr = row.epss_score.toFixed(2);\n          const pctStr = `${Math.round(row.epss_percentile * 100)}th%`;\n          epssBadge = `  ${epssColor}${dim}[EPSS: ${scoreStr} / ${pctStr}]${reset}`;\n        }\n\n        // Risk score badge\n        let riskBadge = '';\n        if (row.risk_score != null) {\n          const riskColor = row.risk_score >= 7 ? '\\x1b[31m' : row.risk_score >= 4 ? '\\x1b[33m' : dim;\n          riskBadge = `  ${riskColor}[Risk: ${row.risk_score.toFixed(1)}]${reset}`;\n        }\n\n        console.log(`${indent}${severityColor}${severityLabel}${reset}  ${violet}${bold}${row.cve_id}${reset}  ${dim}${pkg}${reset}  [${verdictColor}${verdictLabel}${reset}]${epssBadge}${riskBadge}`);\n\n        if (row.summary && row.summary !== 'Manually registered') {\n          const truncated = row.summary.length > 100 ? row.summary.slice(0, 100) + '\u2026' : row.summary;\n          console.log(`${indent}  ${dim}${truncated}${reset}`);\n        }\n\n        // Staleness badge (when --stale flag is set)\n        if (opts.stale && row.staleness_score != null) {\n          const s = row.staleness_score;\n          const staleColor = s >= 0.7 ? '\\x1b[31m' : s >= 0.4 ? '\\x1b[33m' : dim;\n          console.log(`${indent}  ${staleColor}${dim}[staleness: ${s.toFixed(2)}]${reset}`);\n        }\n\n        // Fix suggestion\n        if (row.fixed_version && row.ecosystem && row.package_name) {\n          const fix = formatFixSuggestion(row.ecosystem, row.package_name, row.fixed_version);\n          if (fix) {\n            console.log(`${indent}  ${fix}`);\n          }\n        }\n\n        console.log();\n      }\n\n      // \u2500\u2500 Output: grouped or flat \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      if (opts.groupBy === 'workspace') {\n        // Group by workspace (directory of first source manifest)\n        const groups = new Map<string, Array<(typeof filteredRows)[0]>>();\n        for (const row of filteredRows) {\n          const ws = workspaceFromManifests(row.source_manifests ?? null);\n          if (!groups.has(ws)) groups.set(ws, []);\n          groups.get(ws)!.push(row);\n        }\n\n        // Only apply workspace grouping when there are multiple distinct workspaces\n        const workspaces = Array.from(groups.keys());\n        if (workspaces.length <= 1) {\n          // Single workspace \u2014 fall through to flat output\n          console.log(`\\n  ${bold}Vulnerabilities${reset} (${filteredRows.length})\\n`);\n          for (const row of filteredRows) {\n            printVulnRow(row);\n          }\n        } else {\n          console.log(`\\n  ${bold}Vulnerabilities${reset} (${filteredRows.length})\\n`);\n          for (const ws of workspaces) {\n            const wsRows = groups.get(ws)!;\n            const count = wsRows.length;\n            const header = `Workspace: ${ws} (${count} vulnerabilit${count === 1 ? 'y' : 'ies'})`;\n            const line = '\u2500'.repeat(header.length);\n            console.log(`  ${bold}${header}${reset}`);\n            console.log(`  ${dim}${line}${reset}`);\n            for (const row of wsRows) {\n              printVulnRow(row);\n            }\n          }\n        }\n      } else {\n        console.log(`\\n  ${bold}Vulnerabilities${reset} (${filteredRows.length})\\n`);\n        for (const row of filteredRows) {\n          printVulnRow(row);\n        }\n      }\n\n      if (suppressedRows.length > 0) {\n        console.log(`  ${dim}${suppressedRows.length} CVE(s) suppressed \u2014 kirograph vuln suppressions to review${reset}\\n`);\n      }\n\n      // \u2500\u2500 CI exit codes: --fail-on \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      if (opts.failOn !== undefined) {\n        const failOn = opts.failOn;\n\n        let failCount = 0;\n        let failReason = '';\n\n        if (failOn === 'affected') {\n          failCount = filteredRows.filter(r => r.verdict === 'affected').length;\n          failReason = `affected`;\n        } else if (failOn === 'any') {\n          failCount = filteredRows.length;\n          failReason = `any`;\n        } else if (failOn === 'critical') {\n          failCount = filteredRows.filter(r => r.severity_score != null && r.severity_score >= 9.0).length;\n          failReason = `critical`;\n        } else if (failOn === 'high') {\n          failCount = filteredRows.filter(r => r.severity_score != null && r.severity_score >= 7.0).length;\n          failReason = `high`;\n        } else {\n          const epssThreshold = parseEpssFailOn(failOn);\n          if (epssThreshold !== null) {\n            failCount = filteredRows.filter(r => r.epss_score != null && r.epss_score >= epssThreshold).length;\n            failReason = `epss=${epssThreshold}`;\n          }\n        }\n\n        if (failCount > 0) {\n          console.log(`  \\x1b[31m\u2716\\x1b[0m --fail-on ${failReason}: ${failCount} ${failReason === 'any' ? '' : `${failReason} `}vulnerabilit${failCount === 1 ? 'y' : 'ies'} found. Exiting with code 1.`);\n          cg.close();\n          process.exit(1);\n        }\n      }\n\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAChD,6BAAoC;AACpC,0BAAmC;AAKnC,SAAS,gBAAgB,QAA+B;AACtD,QAAM,IAAI,OAAO,MAAM,aAAa;AACpC,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,WAAW,EAAE,CAAC,CAAC;AACzB,SAAO,MAAM,CAAC,IAAI,OAAO;AAC3B;AAGA,SAAS,uBAAuB,iBAAwC;AACtE,MAAI,CAAC,gBAAiB,QAAO;AAC7B,MAAI;AACF,UAAM,YAAsB,KAAK,MAAM,eAAe;AACtD,QAAI,CAAC,UAAU,OAAQ,QAAO;AAC9B,UAAM,MAAM,KAAK,QAAQ,UAAU,CAAC,CAAC;AACrC,WAAO,QAAQ,MAAM,SAAS;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,qBAAqB,EAC7B,YAAY,8DAA8D,EAC1E,OAAO,sBAAsB,iDAAiD,EAC9E,OAAO,uBAAuB,gEAAgE,EAC9F,OAAO,aAAa,uDAAuD,EAC3E,OAAO,sBAAsB,mEAAmE,EAChG,OAAO,WAAW,oEAAoE,EACtF,OAAO,gBAAgB,mDAAmD,EAC1E,OAAO,iBAAiB,yBAAyB,EACjD,OAAO,oBAAoB,wBAAwB,EACnD,OAAO,mBAAmB,2BAA2B,EACrD,OAAO,yBAAyB,mEAAmE,EACnG,OAAO,oBAAoB,4BAA4B,EACvD,OAAO,OAAO,aAAiC,SAY1C;AACJ,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,UAAU,wCAAmC,eAAK,EAAE;AACzE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,QAAI,KAAK,WAAW,QAAW;AAC7B,YAAM,eAAe,CAAC,YAAY,OAAO,YAAY,MAAM;AAC3D,YAAM,SAAS,gBAAgB,KAAK,MAAM,MAAM;AAChD,UAAI,CAAC,aAAa,SAAS,KAAK,MAAM,KAAK,CAAC,QAAQ;AAClD,gBAAQ,MAAM,qCAAgC,KAAK,MAAM,8CAA8C;AACvG,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAGA,QAAI,KAAK,YAAY,UAAa,KAAK,YAAY,aAAa;AAC9D,cAAQ,MAAM,sCAAiC,KAAK,OAAO,wBAAwB;AACnF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AACvB,UAAM,QAAQ,GAAG,SAAS;AAG1B,QAAI,KAAK,KAAK;AACZ,UAAI,CAAC,KAAK,WAAW,CAAC,KAAK,SAAS;AAClC,gBAAQ,MAAM,8DAAyD;AACvE,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AAEA,YAAM,QAAQ,KAAK;AACnB,YAAM,UAAU,KAAK;AACrB,YAAM,aAAa,KAAK;AAGxB,YAAM,SAA6D,MAAM;AAAA,QACvE;AAAA;AAAA,QAEA,CAAC,SAAS,YAAY,UAAU;AAAA,MAClC;AAEA,UAAI,CAAC,QAAQ;AACX,gBAAQ,MAAM,yCAAoC,gBAAM,GAAG,OAAO,IAAI,UAAU,GAAG,eAAK,EAAE;AAC1F,gBAAQ,MAAM,KAAK,aAAG,MAAM,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK,IAAI,aAAG,kCAAkC,eAAK,EAAE;AACzH,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AAGA,YAAM,aAAa,QAAQ,KAAK;AAChC,YAAM,MAAM,KAAK,IAAI;AAErB,YAAM;AAAA,QACJ;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,CAAC,YAAY,OAAO,OAAO,GAAG;AAAA,MAChC;AAEA,YAAM;AAAA,QACJ;AAAA;AAAA;AAAA,QAGA,CAAC,YAAY,KAAK;AAAA,MACpB;AAGA,YAAM;AAAA,QACJ;AAAA;AAAA,QAEA,CAAC,OAAO,SAAS,UAAU;AAAA,MAC7B;AAEA,cAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,eAAe,gBAAM,GAAG,cAAI,GAAG,KAAK,GAAG,eAAK,YAAY,gBAAM,GAAG,OAAO,IAAI,UAAU,GAAG,eAAK,EAAE;AAC/H,SAAG,MAAM;AACT;AAAA,IACF;AAGA,QAAI,KAAK,SAAS;AAChB,cAAQ,MAAM,KAAK,aAAG,6DAA6D,eAAK,EAAE;AAC1F,YAAM,EAAE,WAAW,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,oCAAoC,CAAC;AACvG,YAAM,EAAE,4BAA4B,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,+BAA+B,CAAC;AAEnH,YAAM,WAAW,OAAO,kBAAkB,IAAI,CAAC,WAAmB;AAChE,YAAI,OAAO,YAAY,MAAM,MAAO,QAAO,IAAI,WAAW;AAC1D,eAAO;AAAA,MACT,CAAC,EAAE,OAAO,OAAO;AAEjB,YAAM,SAAS,IAAI,4BAA4B,UAAU,EAAE;AAC3D,YAAM,SAAS,MAAM,OAAO,UAAU;AAEtC,cAAQ,MAAM,KAAK,eAAK,SAAI,eAAK,YAAY,cAAI,GAAG,OAAO,mBAAmB,GAAG,eAAK,wBAAwB,cAAI,GAAG,OAAO,oBAAoB,GAAG,eAAK,kBAAkB;AAC1K,UAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,gBAAQ,MAAM,KAAK,UAAU,SAAI,eAAK,IAAI,OAAO,OAAO,MAAM,6BAA6B;AAAA,MAC7F;AACA,cAAQ,MAAM;AAAA,IAChB;AAIA,UAAM,wBAAwB,KAAK,YAAY,cAAc;AAAA,gCAAoC;AACjG,QAAI,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAMG,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOpC,UAAM,SAAgB,CAAC;AAGvB,QAAI,KAAK,UAAU;AACjB,YAAM,iBAAmD;AAAA,QACvD,UAAU,CAAC,GAAK,EAAI;AAAA,QACpB,MAAM,CAAC,GAAK,GAAG;AAAA,QACf,QAAQ,CAAC,GAAK,GAAG;AAAA,QACjB,KAAK,CAAC,KAAK,GAAG;AAAA,MAChB;AACA,YAAM,QAAQ,eAAe,KAAK,SAAS,YAAY,CAAC;AACxD,UAAI,CAAC,OAAO;AACV,gBAAQ,MAAM,8BAAyB,KAAK,QAAQ,oCAAoC;AACxF,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AACA,eAAS;AACT,aAAO,KAAK,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,IAChC;AAGA,QAAI,KAAK,SAAS;AAChB,YAAM,gBAAgB,CAAC,YAAY,gBAAgB,qBAAqB;AACxE,UAAI,CAAC,cAAc,SAAS,KAAK,OAAO,GAAG;AACzC,gBAAQ,MAAM,6BAAwB,KAAK,OAAO,oDAAoD;AACtG,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AACA,eAAS;AACT,aAAO,KAAK,KAAK,OAAO;AAAA,IAC1B;AAGA,QAAI,KAAK,SAAS,QAAW;AAC3B,YAAM,gBAAgB,WAAW,KAAK,IAAI;AAC1C,UAAI,MAAM,aAAa,KAAK,gBAAgB,KAAK,gBAAgB,GAAG;AAClE,gBAAQ,MAAM,oCAA+B,KAAK,IAAI,2CAA2C;AACjG,WAAG,MAAM;AAAG,gBAAQ,KAAK,CAAC;AAAA,MAC5B;AACA,eAAS;AACT,aAAO,KAAK,aAAa;AAAA,IAC3B;AAGA,UAAM,UAAU,KAAK,MAAM,YAAY,KAAK;AAC5C,UAAM,gBAAgB,CAAC,QAAQ,QAAQ,QAAQ,MAAM;AACrD,QAAI,CAAC,cAAc,SAAS,OAAO,GAAG;AACpC,cAAQ,MAAM,8BAAyB,KAAK,IAAI,+BAA+B;AAC/E,SAAG,MAAM;AAAG,cAAQ,KAAK,CAAC;AAAA,IAC5B;AACA,UAAM,aACJ,YAAY,SAAS,iCACrB,YAAY,SAAS,qCACrB,YAAY,SAAS,iCACrB;AACF,aAAS,aAAa,UAAU;AAEhC,UAAM,OAiBD,MAAM,IAAI,OAAO,MAAM;AAK5B,UAAM,cAAc,CAAC,MACnB,MAAM,aAAa,IAAI,MAAM,wBAAwB,IAAI,MAAM,iBAAiB,IAAI;AACtF,UAAM,UAAU,oBAAI,IAA4B;AAChD,eAAW,OAAO,MAAM;AACtB,YAAM,MAAM,GAAG,IAAI,MAAM,KAAK,IAAI,gBAAgB,EAAE,KAAK,IAAI,aAAa,EAAE;AAC5E,YAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,UAAI,CAAC,YAAY,YAAY,IAAI,OAAO,IAAI,YAAY,SAAS,OAAO,GAAG;AACzE,gBAAQ,IAAI,KAAK,GAAG;AAAA,MACtB;AAAA,IACF;AACA,UAAM,cAAc,CAAC,GAAG,QAAQ,OAAO,CAAC;AAGxC,UAAM,eAAe,IAAI,uCAAmB,MAAM;AAClD,UAAM,iBAAiB,YAAY,OAAO,SAAO,aAAa,aAAa,IAAI,MAAM,CAAC;AACtF,UAAM,eAAe,YAAY,OAAO,SAAO,CAAC,aAAa,aAAa,IAAI,MAAM,CAAC;AAErF,QAAI,aAAa,WAAW,GAAG;AAC7B,YAAM,aAAc,KAAK,YAAY,KAAK,UACtC,sBACA;AACJ,cAAQ,IAAI;AAAA,IAAO,aAAG,2BAA2B,UAAU,IAAI,eAAK;AAAA,CAAI;AACxE,UAAI,eAAe,SAAS,GAAG;AAC7B,gBAAQ,IAAI,KAAK,aAAG,GAAG,eAAe,MAAM,kEAA6D,eAAK;AAAA,CAAI;AAAA,MACpH;AACA,SAAG,MAAM;AACT;AAAA,IACF;AAIA,aAAS,aAAa,KAA+B,SAAS,MAAY;AAExE,YAAM,QAAQ,IAAI;AAClB,UAAI;AACJ,UAAI;AACJ,UAAI,SAAS,MAAM;AACjB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,WAAW,SAAS,GAAK;AACvB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,WAAW,SAAS,GAAK;AACvB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,WAAW,SAAS,GAAK;AACvB,wBAAgB;AAChB,wBAAgB;AAAA,MAClB,OAAO;AACL,wBAAgB;AAChB,wBAAgB;AAAA,MAClB;AAGA,UAAI;AACJ,UAAI;AACJ,UAAI,CAAC,IAAI,SAAS;AAChB,uBAAe;AACf,uBAAe;AAAA,MACjB,WAAW,IAAI,YAAY,YAAY;AACrC,uBAAe;AACf,uBAAe;AAAA,MACjB,WAAW,IAAI,YAAY,gBAAgB;AACzC,uBAAe;AACf,uBAAe;AAAA,MACjB,OAAO;AACL,uBAAe;AACf,uBAAe;AAAA,MACjB;AAEA,YAAM,MAAM,IAAI,eACZ,GAAG,IAAI,YAAY,IAAI,IAAI,oBAAoB,IAAI,uBAAuB,GAAG,KAC7E;AAGJ,UAAI,YAAY;AAChB,UAAI,IAAI,cAAc,QAAQ,IAAI,mBAAmB,MAAM;AACzD,cAAM,YAAY,IAAI,cAAc,MAAM,aAAa;AACvD,cAAM,WAAW,IAAI,WAAW,QAAQ,CAAC;AACzC,cAAM,SAAS,GAAG,KAAK,MAAM,IAAI,kBAAkB,GAAG,CAAC;AACvD,oBAAY,KAAK,SAAS,GAAG,aAAG,UAAU,QAAQ,MAAM,MAAM,IAAI,eAAK;AAAA,MACzE;AAGA,UAAI,YAAY;AAChB,UAAI,IAAI,cAAc,MAAM;AAC1B,cAAM,YAAY,IAAI,cAAc,IAAI,aAAa,IAAI,cAAc,IAAI,aAAa;AACxF,oBAAY,KAAK,SAAS,UAAU,IAAI,WAAW,QAAQ,CAAC,CAAC,IAAI,eAAK;AAAA,MACxE;AAEA,cAAQ,IAAI,GAAG,MAAM,GAAG,aAAa,GAAG,aAAa,GAAG,eAAK,KAAK,gBAAM,GAAG,cAAI,GAAG,IAAI,MAAM,GAAG,eAAK,KAAK,aAAG,GAAG,GAAG,GAAG,eAAK,MAAM,YAAY,GAAG,YAAY,GAAG,eAAK,IAAI,SAAS,GAAG,SAAS,EAAE;AAE9L,UAAI,IAAI,WAAW,IAAI,YAAY,uBAAuB;AACxD,cAAM,YAAY,IAAI,QAAQ,SAAS,MAAM,IAAI,QAAQ,MAAM,GAAG,GAAG,IAAI,WAAM,IAAI;AACnF,gBAAQ,IAAI,GAAG,MAAM,KAAK,aAAG,GAAG,SAAS,GAAG,eAAK,EAAE;AAAA,MACrD;AAGA,UAAI,KAAK,SAAS,IAAI,mBAAmB,MAAM;AAC7C,cAAM,IAAI,IAAI;AACd,cAAM,aAAa,KAAK,MAAM,aAAa,KAAK,MAAM,aAAa;AACnE,gBAAQ,IAAI,GAAG,MAAM,KAAK,UAAU,GAAG,aAAG,eAAe,EAAE,QAAQ,CAAC,CAAC,IAAI,eAAK,EAAE;AAAA,MAClF;AAGA,UAAI,IAAI,iBAAiB,IAAI,aAAa,IAAI,cAAc;AAC1D,cAAM,UAAM,4CAAoB,IAAI,WAAW,IAAI,cAAc,IAAI,aAAa;AAClF,YAAI,KAAK;AACP,kBAAQ,IAAI,GAAG,MAAM,KAAK,GAAG,EAAE;AAAA,QACjC;AAAA,MACF;AAEA,cAAQ,IAAI;AAAA,IACd;AAIA,QAAI,KAAK,YAAY,aAAa;AAEhC,YAAM,SAAS,oBAAI,IAA6C;AAChE,iBAAW,OAAO,cAAc;AAC9B,cAAM,KAAK,uBAAuB,IAAI,oBAAoB,IAAI;AAC9D,YAAI,CAAC,OAAO,IAAI,EAAE,EAAG,QAAO,IAAI,IAAI,CAAC,CAAC;AACtC,eAAO,IAAI,EAAE,EAAG,KAAK,GAAG;AAAA,MAC1B;AAGA,YAAM,aAAa,MAAM,KAAK,OAAO,KAAK,CAAC;AAC3C,UAAI,WAAW,UAAU,GAAG;AAE1B,gBAAQ,IAAI;AAAA,IAAO,cAAI,kBAAkB,eAAK,KAAK,aAAa,MAAM;AAAA,CAAK;AAC3E,mBAAW,OAAO,cAAc;AAC9B,uBAAa,GAAG;AAAA,QAClB;AAAA,MACF,OAAO;AACL,gBAAQ,IAAI;AAAA,IAAO,cAAI,kBAAkB,eAAK,KAAK,aAAa,MAAM;AAAA,CAAK;AAC3E,mBAAW,MAAM,YAAY;AAC3B,gBAAM,SAAS,OAAO,IAAI,EAAE;AAC5B,gBAAM,QAAQ,OAAO;AACrB,gBAAM,SAAS,cAAc,EAAE,KAAK,KAAK,gBAAgB,UAAU,IAAI,MAAM,KAAK;AAClF,gBAAM,OAAO,SAAI,OAAO,OAAO,MAAM;AACrC,kBAAQ,IAAI,KAAK,cAAI,GAAG,MAAM,GAAG,eAAK,EAAE;AACxC,kBAAQ,IAAI,KAAK,aAAG,GAAG,IAAI,GAAG,eAAK,EAAE;AACrC,qBAAW,OAAO,QAAQ;AACxB,yBAAa,GAAG;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,IAAI;AAAA,IAAO,cAAI,kBAAkB,eAAK,KAAK,aAAa,MAAM;AAAA,CAAK;AAC3E,iBAAW,OAAO,cAAc;AAC9B,qBAAa,GAAG;AAAA,MAClB;AAAA,IACF;AAEA,QAAI,eAAe,SAAS,GAAG;AAC7B,cAAQ,IAAI,KAAK,aAAG,GAAG,eAAe,MAAM,kEAA6D,eAAK;AAAA,CAAI;AAAA,IACpH;AAIA,QAAI,KAAK,WAAW,QAAW;AAC7B,YAAM,SAAS,KAAK;AAEpB,UAAI,YAAY;AAChB,UAAI,aAAa;AAEjB,UAAI,WAAW,YAAY;AACzB,oBAAY,aAAa,OAAO,OAAK,EAAE,YAAY,UAAU,EAAE;AAC/D,qBAAa;AAAA,MACf,WAAW,WAAW,OAAO;AAC3B,oBAAY,aAAa;AACzB,qBAAa;AAAA,MACf,WAAW,WAAW,YAAY;AAChC,oBAAY,aAAa,OAAO,OAAK,EAAE,kBAAkB,QAAQ,EAAE,kBAAkB,CAAG,EAAE;AAC1F,qBAAa;AAAA,MACf,WAAW,WAAW,QAAQ;AAC5B,oBAAY,aAAa,OAAO,OAAK,EAAE,kBAAkB,QAAQ,EAAE,kBAAkB,CAAG,EAAE;AAC1F,qBAAa;AAAA,MACf,OAAO;AACL,cAAM,gBAAgB,gBAAgB,MAAM;AAC5C,YAAI,kBAAkB,MAAM;AAC1B,sBAAY,aAAa,OAAO,OAAK,EAAE,cAAc,QAAQ,EAAE,cAAc,aAAa,EAAE;AAC5F,uBAAa,QAAQ,aAAa;AAAA,QACpC;AAAA,MACF;AAEA,UAAI,YAAY,GAAG;AACjB,gBAAQ,IAAI,qCAAgC,UAAU,KAAK,SAAS,IAAI,eAAe,QAAQ,KAAK,GAAG,UAAU,GAAG,eAAe,cAAc,IAAI,MAAM,KAAK,8BAA8B;AAC9L,WAAG,MAAM;AACT,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/installer/auto-detect.js

@@ -0,0 +1,125 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var auto_detect_exports = {};
+__export(auto_detect_exports, {
+  runAutoDetectInstaller: () => runAutoDetectInstaller
+});
+module.exports = __toCommonJS(auto_detect_exports);
+var readline = __toESM(require("readline"));
+var import_detect = require("./detect");
+var import_index = require("./index");
+var import_banner = require("../banner");
+const dim = "\x1B[2m";
+const reset = "\x1B[0m";
+const green = "\x1B[32m";
+const bold = "\x1B[1m";
+async function runAutoDetectInstaller(opts = {}) {
+  if (!opts.skipBanner) (0, import_banner.printBanner)();
+  const cwd = process.cwd();
+  const detected = (0, import_detect.detectPlatforms)(cwd);
+  if (detected.length === 0) {
+    console.log("  No AI coding platforms detected in this environment.");
+    console.log("  Use --target <name> to install for a specific platform.");
+    console.log(`  Available targets: kiro, claude, cursor, windsurf, codex, copilot, ...`);
+    console.log(`  Run ${bold}kirograph install --help${reset} for the full list.
+`);
+    return;
+  }
+  console.log(`  ${bold}Detected platforms:${reset}
+`);
+  for (const d of detected) {
+    console.log(`    ${green}\u2713${reset} ${d.label.padEnd(20)} ${dim}(${d.reason})${reset}`);
+  }
+  console.log();
+  if (opts.dryRun) {
+    console.log(`  ${dim}[dry-run] Would install KiroGraph for ${detected.length} platform(s).${reset}`);
+    console.log(`  ${dim}[dry-run] No files will be written.${reset}
+`);
+    return;
+  }
+  let targets = detected.map((d) => d.target);
+  if (!opts.skipPrompt) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+      const answer = await new Promise((resolve) => {
+        rl.question(`  Install KiroGraph for all ${detected.length} detected platform(s)? [Y/n] `, resolve);
+      });
+      const trimmed = answer.trim().toLowerCase();
+      if (trimmed === "n" || trimmed === "no") {
+        console.log("  Cancelled. Use --target <name> to install for a specific platform.\n");
+        rl.close();
+        return;
+      }
+      if (detected.length > 1) {
+        const selectAnswer = await new Promise((resolve) => {
+          rl.question(`  Install all, or select specific platforms? [all/select] `, resolve);
+        });
+        if (selectAnswer.trim().toLowerCase() === "select") {
+          const selectedTargets = [];
+          for (const d of detected) {
+            const include = await new Promise((resolve) => {
+              rl.question(`    Include ${d.label}? [Y/n] `, resolve);
+            });
+            if (include.trim().toLowerCase() !== "n") {
+              selectedTargets.push(d.target);
+            }
+          }
+          targets = selectedTargets;
+          if (targets.length === 0) {
+            console.log("  No platforms selected. Cancelled.\n");
+            rl.close();
+            return;
+          }
+        }
+      }
+      rl.close();
+    } catch {
+      rl.close();
+      return;
+    }
+  }
+  console.log(`
+  Installing KiroGraph for ${targets.length} platform(s)...
+`);
+  for (const target of targets) {
+    const label = detected.find((d) => d.target === target)?.label ?? target;
+    console.log(`  \u2500\u2500 ${bold}${label}${reset} \u2500\u2500
+`);
+    await (0, import_index.runInstaller)(target);
+    console.log();
+  }
+  console.log(`  ${green}\u2713${reset} ${bold}All done!${reset} Configured ${targets.length} platform(s).`);
+  console.log(`  Restart your AI coding tools for the MCP servers to load.
+`);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  runAutoDetectInstaller
+});
+//# sourceMappingURL=auto-detect.js.map

package/dist/bin/installer/auto-detect.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/installer/auto-detect.ts"],
+  "sourcesContent": ["/**\n * Auto-detect installer for KiroGraph.\n *\n * When `kirograph install` is run without --target, this module detects\n * all installed AI coding platforms and offers to configure them all.\n */\n\nimport * as readline from 'readline';\nimport { detectPlatforms, type DetectionResult } from './detect';\nimport { runInstaller } from './index';\nimport { printBanner } from '../banner';\nimport type { InstallTarget } from './common';\n\nconst dim = '\\x1b[2m';\nconst reset = '\\x1b[0m';\nconst green = '\\x1b[32m';\nconst bold = '\\x1b[1m';\n\nexport interface AutoDetectOptions {\n  /** Skip the confirmation prompt and install all detected platforms */\n  skipPrompt?: boolean;\n  /** Show what would be written without making changes */\n  dryRun?: boolean;\n}\n\nexport async function runAutoDetectInstaller(opts: AutoDetectOptions & { skipBanner?: boolean } = {}): Promise<void> {\n  if (!opts.skipBanner) printBanner();\n\n  const cwd = process.cwd();\n  const detected = detectPlatforms(cwd);\n\n  if (detected.length === 0) {\n    console.log('  No AI coding platforms detected in this environment.');\n    console.log('  Use --target <name> to install for a specific platform.');\n    console.log(`  Available targets: kiro, claude, cursor, windsurf, codex, copilot, ...`);\n    console.log(`  Run ${bold}kirograph install --help${reset} for the full list.\\n`);\n    return;\n  }\n\n  console.log(`  ${bold}Detected platforms:${reset}\\n`);\n  for (const d of detected) {\n    console.log(`    ${green}\u2713${reset} ${d.label.padEnd(20)} ${dim}(${d.reason})${reset}`);\n  }\n  console.log();\n\n  if (opts.dryRun) {\n    console.log(`  ${dim}[dry-run] Would install KiroGraph for ${detected.length} platform(s).${reset}`);\n    console.log(`  ${dim}[dry-run] No files will be written.${reset}\\n`);\n    return;\n  }\n\n  let targets: InstallTarget[] = detected.map(d => d.target);\n\n  if (!opts.skipPrompt) {\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n      const answer = await new Promise<string>((resolve) => {\n        rl.question(`  Install KiroGraph for all ${detected.length} detected platform(s)? [Y/n] `, resolve);\n      });\n      const trimmed = answer.trim().toLowerCase();\n      if (trimmed === 'n' || trimmed === 'no') {\n        console.log('  Cancelled. Use --target <name> to install for a specific platform.\\n');\n        rl.close();\n        return;\n      }\n\n      // Ask if they want to select specific ones\n      if (detected.length > 1) {\n        const selectAnswer = await new Promise<string>((resolve) => {\n          rl.question(`  Install all, or select specific platforms? [all/select] `, resolve);\n        });\n        if (selectAnswer.trim().toLowerCase() === 'select') {\n          const selectedTargets: InstallTarget[] = [];\n          for (const d of detected) {\n            const include = await new Promise<string>((resolve) => {\n              rl.question(`    Include ${d.label}? [Y/n] `, resolve);\n            });\n            if (include.trim().toLowerCase() !== 'n') {\n              selectedTargets.push(d.target);\n            }\n          }\n          targets = selectedTargets;\n          if (targets.length === 0) {\n            console.log('  No platforms selected. Cancelled.\\n');\n            rl.close();\n            return;\n          }\n        }\n      }\n      rl.close();\n    } catch {\n      rl.close();\n      return;\n    }\n  }\n\n  console.log(`\\n  Installing KiroGraph for ${targets.length} platform(s)...\\n`);\n\n  for (const target of targets) {\n    const label = detected.find(d => d.target === target)?.label ?? target;\n    console.log(`  \u2500\u2500 ${bold}${label}${reset} \u2500\u2500\\n`);\n    await runInstaller(target);\n    console.log();\n  }\n\n  console.log(`  ${green}\u2713${reset} ${bold}All done!${reset} Configured ${targets.length} platform(s).`);\n  console.log(`  Restart your AI coding tools for the MCP servers to load.\\n`);\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,eAA0B;AAC1B,oBAAsD;AACtD,mBAA6B;AAC7B,oBAA4B;AAG5B,MAAM,MAAM;AACZ,MAAM,QAAQ;AACd,MAAM,QAAQ;AACd,MAAM,OAAO;AASb,eAAsB,uBAAuB,OAAqD,CAAC,GAAkB;AACnH,MAAI,CAAC,KAAK,WAAY,gCAAY;AAElC,QAAM,MAAM,QAAQ,IAAI;AACxB,QAAM,eAAW,+BAAgB,GAAG;AAEpC,MAAI,SAAS,WAAW,GAAG;AACzB,YAAQ,IAAI,wDAAwD;AACpE,YAAQ,IAAI,2DAA2D;AACvE,YAAQ,IAAI,0EAA0E;AACtF,YAAQ,IAAI,SAAS,IAAI,2BAA2B,KAAK;AAAA,CAAuB;AAChF;AAAA,EACF;AAEA,UAAQ,IAAI,KAAK,IAAI,sBAAsB,KAAK;AAAA,CAAI;AACpD,aAAW,KAAK,UAAU;AACxB,YAAQ,IAAI,OAAO,KAAK,SAAI,KAAK,IAAI,EAAE,MAAM,OAAO,EAAE,CAAC,IAAI,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,EAAE;AAAA,EACvF;AACA,UAAQ,IAAI;AAEZ,MAAI,KAAK,QAAQ;AACf,YAAQ,IAAI,KAAK,GAAG,yCAAyC,SAAS,MAAM,gBAAgB,KAAK,EAAE;AACnG,YAAQ,IAAI,KAAK,GAAG,sCAAsC,KAAK;AAAA,CAAI;AACnE;AAAA,EACF;AAEA,MAAI,UAA2B,SAAS,IAAI,OAAK,EAAE,MAAM;AAEzD,MAAI,CAAC,KAAK,YAAY;AACpB,UAAM,KAAK,SAAS,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AACpF,QAAI;AACF,YAAM,SAAS,MAAM,IAAI,QAAgB,CAAC,YAAY;AACpD,WAAG,SAAS,+BAA+B,SAAS,MAAM,iCAAiC,OAAO;AAAA,MACpG,CAAC;AACD,YAAM,UAAU,OAAO,KAAK,EAAE,YAAY;AAC1C,UAAI,YAAY,OAAO,YAAY,MAAM;AACvC,gBAAQ,IAAI,wEAAwE;AACpF,WAAG,MAAM;AACT;AAAA,MACF;AAGA,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,eAAe,MAAM,IAAI,QAAgB,CAAC,YAAY;AAC1D,aAAG,SAAS,8DAA8D,OAAO;AAAA,QACnF,CAAC;AACD,YAAI,aAAa,KAAK,EAAE,YAAY,MAAM,UAAU;AAClD,gBAAM,kBAAmC,CAAC;AAC1C,qBAAW,KAAK,UAAU;AACxB,kBAAM,UAAU,MAAM,IAAI,QAAgB,CAAC,YAAY;AACrD,iBAAG,SAAS,eAAe,EAAE,KAAK,YAAY,OAAO;AAAA,YACvD,CAAC;AACD,gBAAI,QAAQ,KAAK,EAAE,YAAY,MAAM,KAAK;AACxC,8BAAgB,KAAK,EAAE,MAAM;AAAA,YAC/B;AAAA,UACF;AACA,oBAAU;AACV,cAAI,QAAQ,WAAW,GAAG;AACxB,oBAAQ,IAAI,uCAAuC;AACnD,eAAG,MAAM;AACT;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,SAAG,MAAM;AAAA,IACX,QAAQ;AACN,SAAG,MAAM;AACT;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,IAAI;AAAA,6BAAgC,QAAQ,MAAM;AAAA,CAAmB;AAE7E,aAAW,UAAU,SAAS;AAC5B,UAAM,QAAQ,SAAS,KAAK,OAAK,EAAE,WAAW,MAAM,GAAG,SAAS;AAChE,YAAQ,IAAI,kBAAQ,IAAI,GAAG,KAAK,GAAG,KAAK;AAAA,CAAO;AAC/C,cAAM,2BAAa,MAAM;AACzB,YAAQ,IAAI;AAAA,EACd;AAEA,UAAQ,IAAI,KAAK,KAAK,SAAI,KAAK,IAAI,IAAI,YAAY,KAAK,eAAe,QAAQ,MAAM,eAAe;AACpG,UAAQ,IAAI;AAAA,CAA+D;AAC7E;",
+  "names": []
+}