kirograph 0.16.1 → 0.19.0

package/dist/security/export/sbom.js

@@ -0,0 +1,230 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sbom_exports = {};
+__export(sbom_exports, {
+  SBOMExporter: () => SBOMExporter
+});
+module.exports = __toCommonJS(sbom_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+const ECOSYSTEM_PURL_MAP = {
+  npm: "npm",
+  maven: "maven",
+  go: "golang",
+  pypi: "pypi",
+  python: "pypi",
+  cargo: "cargo"
+};
+function buildPurl(ecosystem, name, version) {
+  const purlType = ECOSYSTEM_PURL_MAP[ecosystem] ?? ecosystem;
+  return `pkg:${purlType}/${name}@${version}`;
+}
+const TOOL_NAME = "kirograph-sec";
+function getToolVersion() {
+  try {
+    let dir = __dirname;
+    for (let i = 0; i < 5; i++) {
+      const pkgPath = path.join(dir, "package.json");
+      if (fs.existsSync(pkgPath)) {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        if (pkg.version) return pkg.version;
+      }
+      dir = path.dirname(dir);
+    }
+  } catch {
+  }
+  return "0.1.0";
+}
+function getProjectName(projectRoot) {
+  try {
+    const pkgJsonPath = path.join(projectRoot, "package.json");
+    if (fs.existsSync(pkgJsonPath)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+      if (pkg.name) return pkg.name;
+    }
+  } catch {
+  }
+  try {
+    const cargoPath = path.join(projectRoot, "Cargo.toml");
+    if (fs.existsSync(cargoPath)) {
+      const content = fs.readFileSync(cargoPath, "utf-8");
+      const match = content.match(/^\s*name\s*=\s*"([^"]+)"/m);
+      if (match) return match[1];
+    }
+  } catch {
+  }
+  try {
+    const goModPath = path.join(projectRoot, "go.mod");
+    if (fs.existsSync(goModPath)) {
+      const content = fs.readFileSync(goModPath, "utf-8");
+      const match = content.match(/^module\s+(\S+)/m);
+      if (match) return match[1];
+    }
+  } catch {
+  }
+  try {
+    const pomPath = path.join(projectRoot, "pom.xml");
+    if (fs.existsSync(pomPath)) {
+      const content = fs.readFileSync(pomPath, "utf-8");
+      const match = content.match(/<artifactId>([^<]+)<\/artifactId>/);
+      if (match) return match[1];
+    }
+  } catch {
+  }
+  return path.basename(projectRoot);
+}
+class SBOMExporter {
+  constructor(db, projectRoot) {
+    this.db = db;
+    this.projectRoot = projectRoot;
+  }
+  /**
+   * Generate a CycloneDX 1.5 SBOM object.
+   */
+  export() {
+    const rawDb = this.db.getRawDb();
+    const depRows = rawDb.all(
+      "SELECT node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests FROM sec_dependencies"
+    );
+    const directNodeIds = /* @__PURE__ */ new Set();
+    if (depRows.length > 0) {
+      const declaredInEdges = rawDb.all(
+        `SELECT source, target, kind FROM edges WHERE kind = 'declared_in'`
+      );
+      for (const edge of declaredInEdges) {
+        directNodeIds.add(edge.source);
+      }
+    }
+    const components = depRows.map((row) => {
+      const version = row.resolved_version ?? row.declared_constraint;
+      const purl = buildPurl(row.ecosystem, row.package_name, version);
+      const isDirect = directNodeIds.has(row.node_id);
+      const component = {
+        type: "library",
+        name: row.package_name,
+        version,
+        purl,
+        scope: isDirect ? "required" : "optional",
+        properties: [
+          { name: "kirograph:classification", value: isDirect ? "direct" : "transitive" },
+          { name: "kirograph:ecosystem", value: row.ecosystem }
+        ]
+      };
+      return component;
+    });
+    const dependencies = [];
+    if (depRows.length > 0) {
+      const dependsOnEdges = rawDb.all(
+        `SELECT source, target, kind FROM edges WHERE kind = 'depends_on'`
+      );
+      const depNodeIds = new Set(depRows.map((r) => r.node_id));
+      const depsMap = /* @__PURE__ */ new Map();
+      for (const edge of dependsOnEdges) {
+        if (depNodeIds.has(edge.source) && depNodeIds.has(edge.target)) {
+          const existing = depsMap.get(edge.source);
+          if (existing) {
+            existing.push(edge.target);
+          } else {
+            depsMap.set(edge.source, [edge.target]);
+          }
+        }
+      }
+      for (const row of depRows) {
+        const version = row.resolved_version ?? row.declared_constraint;
+        const ref = buildPurl(row.ecosystem, row.package_name, version);
+        const deps = depsMap.get(row.node_id);
+        const entry = { ref };
+        if (deps && deps.length > 0) {
+          entry.dependsOn = deps.map((targetId) => {
+            const targetRow = depRows.find((r) => r.node_id === targetId);
+            if (targetRow) {
+              const targetVersion = targetRow.resolved_version ?? targetRow.declared_constraint;
+              return buildPurl(targetRow.ecosystem, targetRow.package_name, targetVersion);
+            }
+            return targetId;
+          });
+        }
+        dependencies.push(entry);
+      }
+    }
+    const metadata = this.buildMetadata();
+    const sbom = {
+      bomFormat: "CycloneDX",
+      specVersion: "1.5",
+      version: 1,
+      metadata,
+      components,
+      dependencies
+    };
+    return sbom;
+  }
+  /**
+   * Export the SBOM as a pretty-printed JSON string.
+   */
+  exportJSON() {
+    const sbom = this.export();
+    return JSON.stringify(sbom, null, 2);
+  }
+  /**
+   * Build CycloneDX metadata section.
+   */
+  buildMetadata() {
+    const toolVersion = getToolVersion();
+    const projectName = getProjectName(this.projectRoot);
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const meta = {
+      toolName: TOOL_NAME,
+      toolVersion,
+      timestamp,
+      projectName
+    };
+    return {
+      timestamp: meta.timestamp,
+      tools: {
+        components: [
+          {
+            type: "application",
+            name: meta.toolName,
+            version: meta.toolVersion
+          }
+        ]
+      },
+      component: {
+        type: "application",
+        name: meta.projectName,
+        version: ""
+      }
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SBOMExporter
+});
+//# sourceMappingURL=sbom.js.map

package/dist/security/export/sbom.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/export/sbom.ts"],
+  "sourcesContent": ["/**\n * SBOMExporter \u2014 CycloneDX 1.5 SBOM Generation\n *\n * Generates a CycloneDX 1.5 JSON Software Bill of Materials from the\n * Dependency_Graph stored in the KiroGraph database. Each Dependency_Node\n * becomes a component of type \"library\" with purl, scope, and\n * direct/transitive classification.\n *\n * Requirements: 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7\n */\nimport type { GraphDatabase } from '../../db/database';\nimport type {\n  CycloneDXSBOM,\n  CycloneDXComponent,\n  CycloneDXDependencyEntry,\n  SBOMMetadata,\n} from '../types';\nimport * as fs from 'fs';\nimport * as path from 'path';\n\n// \u2500\u2500 Ecosystem \u2192 purl type mapping \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst ECOSYSTEM_PURL_MAP: Record<string, string> = {\n  npm: 'npm',\n  maven: 'maven',\n  go: 'golang',\n  pypi: 'pypi',\n  python: 'pypi',\n  cargo: 'cargo',\n};\n\n/**\n * Build a Package URL (purl) for a dependency.\n * Format: pkg:<type>/<name>@<version>\n */\nfunction buildPurl(ecosystem: string, name: string, version: string): string {\n  const purlType = ECOSYSTEM_PURL_MAP[ecosystem] ?? ecosystem;\n  return `pkg:${purlType}/${name}@${version}`;\n}\n\n// \u2500\u2500 Metadata helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst TOOL_NAME = 'kirograph-sec';\n\n/**\n * Read the tool version from package.json, falling back to \"0.1.0\".\n */\nfunction getToolVersion(): string {\n  try {\n    // Walk up from this file to find the project root package.json\n    let dir = __dirname;\n    for (let i = 0; i < 5; i++) {\n      const pkgPath = path.join(dir, 'package.json');\n      if (fs.existsSync(pkgPath)) {\n        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));\n        if (pkg.version) return pkg.version;\n      }\n      dir = path.dirname(dir);\n    }\n  } catch {\n    // Ignore errors \u2014 fall back to default\n  }\n  return '0.1.0';\n}\n\n/**\n * Detect the project name from the root manifest file.\n * Checks package.json, Cargo.toml, go.mod, pom.xml in order.\n */\nfunction getProjectName(projectRoot: string): string {\n  try {\n    const pkgJsonPath = path.join(projectRoot, 'package.json');\n    if (fs.existsSync(pkgJsonPath)) {\n      const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));\n      if (pkg.name) return pkg.name;\n    }\n  } catch { /* ignore */ }\n\n  try {\n    const cargoPath = path.join(projectRoot, 'Cargo.toml');\n    if (fs.existsSync(cargoPath)) {\n      const content = fs.readFileSync(cargoPath, 'utf-8');\n      const match = content.match(/^\\s*name\\s*=\\s*\"([^\"]+)\"/m);\n      if (match) return match[1];\n    }\n  } catch { /* ignore */ }\n\n  try {\n    const goModPath = path.join(projectRoot, 'go.mod');\n    if (fs.existsSync(goModPath)) {\n      const content = fs.readFileSync(goModPath, 'utf-8');\n      const match = content.match(/^module\\s+(\\S+)/m);\n      if (match) return match[1];\n    }\n  } catch { /* ignore */ }\n\n  try {\n    const pomPath = path.join(projectRoot, 'pom.xml');\n    if (fs.existsSync(pomPath)) {\n      const content = fs.readFileSync(pomPath, 'utf-8');\n      const match = content.match(/<artifactId>([^<]+)<\\/artifactId>/);\n      if (match) return match[1];\n    }\n  } catch { /* ignore */ }\n\n  // Fallback: use the directory name\n  return path.basename(projectRoot);\n}\n\n// \u2500\u2500 Database row types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface SecDependencyRow {\n  node_id: string;\n  ecosystem: string;\n  package_name: string;\n  declared_constraint: string;\n  resolved_version: string | null;\n  scope: string;\n  source_manifests: string;\n}\n\ninterface EdgeRow {\n  source: string;\n  target: string;\n  kind: string;\n}\n\n// \u2500\u2500 SBOMExporter \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Generates CycloneDX 1.5 SBOM documents from the dependency graph.\n */\nexport class SBOMExporter {\n  private readonly db: GraphDatabase;\n  private readonly projectRoot: string;\n\n  constructor(db: GraphDatabase, projectRoot: string) {\n    this.db = db;\n    this.projectRoot = projectRoot;\n  }\n\n  /**\n   * Generate a CycloneDX 1.5 SBOM object.\n   */\n  export(): CycloneDXSBOM {\n    const rawDb = this.db.getRawDb();\n\n    // Query all dependency nodes\n    const depRows: SecDependencyRow[] = rawDb.all(\n      'SELECT node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests FROM sec_dependencies',\n    );\n\n    // Determine which dependencies are direct (have a declared_in edge)\n    const directNodeIds = new Set<string>();\n    if (depRows.length > 0) {\n      const declaredInEdges: EdgeRow[] = rawDb.all(\n        `SELECT source, target, kind FROM edges WHERE kind = 'declared_in'`,\n      );\n      for (const edge of declaredInEdges) {\n        directNodeIds.add(edge.source);\n      }\n    }\n\n    // Build components\n    const components: CycloneDXComponent[] = depRows.map((row) => {\n      const version = row.resolved_version ?? row.declared_constraint;\n      const purl = buildPurl(row.ecosystem, row.package_name, version);\n      const isDirect = directNodeIds.has(row.node_id);\n\n      const component: CycloneDXComponent = {\n        type: 'library',\n        name: row.package_name,\n        version,\n        purl,\n        scope: isDirect ? 'required' : 'optional',\n        properties: [\n          { name: 'kirograph:classification', value: isDirect ? 'direct' : 'transitive' },\n          { name: 'kirograph:ecosystem', value: row.ecosystem },\n        ],\n      };\n\n      return component;\n    });\n\n    // Build dependency relationships from depends_on edges\n    const dependencies: CycloneDXDependencyEntry[] = [];\n\n    if (depRows.length > 0) {\n      const dependsOnEdges: EdgeRow[] = rawDb.all(\n        `SELECT source, target, kind FROM edges WHERE kind = 'depends_on'`,\n      );\n\n      // Group depends_on edges by source\n      const depNodeIds = new Set(depRows.map((r) => r.node_id));\n      const depsMap = new Map<string, string[]>();\n\n      for (const edge of dependsOnEdges) {\n        // Only include edges where both source and target are dependency nodes\n        if (depNodeIds.has(edge.source) && depNodeIds.has(edge.target)) {\n          const existing = depsMap.get(edge.source);\n          if (existing) {\n            existing.push(edge.target);\n          } else {\n            depsMap.set(edge.source, [edge.target]);\n          }\n        }\n      }\n\n      // Create an entry for each dependency node\n      for (const row of depRows) {\n        const version = row.resolved_version ?? row.declared_constraint;\n        const ref = buildPurl(row.ecosystem, row.package_name, version);\n        const deps = depsMap.get(row.node_id);\n\n        const entry: CycloneDXDependencyEntry = { ref };\n        if (deps && deps.length > 0) {\n          // Resolve target node_ids to purls\n          entry.dependsOn = deps.map((targetId) => {\n            const targetRow = depRows.find((r) => r.node_id === targetId);\n            if (targetRow) {\n              const targetVersion = targetRow.resolved_version ?? targetRow.declared_constraint;\n              return buildPurl(targetRow.ecosystem, targetRow.package_name, targetVersion);\n            }\n            return targetId; // fallback to node_id if not found\n          });\n        }\n\n        dependencies.push(entry);\n      }\n    }\n\n    // Build metadata\n    const metadata = this.buildMetadata();\n\n    const sbom: CycloneDXSBOM = {\n      bomFormat: 'CycloneDX',\n      specVersion: '1.5',\n      version: 1,\n      metadata,\n      components,\n      dependencies,\n    };\n\n    return sbom;\n  }\n\n  /**\n   * Export the SBOM as a pretty-printed JSON string.\n   */\n  exportJSON(): string {\n    const sbom = this.export();\n    return JSON.stringify(sbom, null, 2);\n  }\n\n  /**\n   * Build CycloneDX metadata section.\n   */\n  private buildMetadata(): Record<string, unknown> {\n    const toolVersion = getToolVersion();\n    const projectName = getProjectName(this.projectRoot);\n    const timestamp = new Date().toISOString();\n\n    const meta: SBOMMetadata = {\n      toolName: TOOL_NAME,\n      toolVersion,\n      timestamp,\n      projectName,\n    };\n\n    return {\n      timestamp: meta.timestamp,\n      tools: {\n        components: [\n          {\n            type: 'application',\n            name: meta.toolName,\n            version: meta.toolVersion,\n          },\n        ],\n      },\n      component: {\n        type: 'application',\n        name: meta.projectName,\n        version: '',\n      },\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBA,SAAoB;AACpB,WAAsB;AAItB,MAAM,qBAA6C;AAAA,EACjD,KAAK;AAAA,EACL,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AACT;AAMA,SAAS,UAAU,WAAmB,MAAc,SAAyB;AAC3E,QAAM,WAAW,mBAAmB,SAAS,KAAK;AAClD,SAAO,OAAO,QAAQ,IAAI,IAAI,IAAI,OAAO;AAC3C;AAIA,MAAM,YAAY;AAKlB,SAAS,iBAAyB;AAChC,MAAI;AAEF,QAAI,MAAM;AACV,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,YAAM,UAAU,KAAK,KAAK,KAAK,cAAc;AAC7C,UAAI,GAAG,WAAW,OAAO,GAAG;AAC1B,cAAM,MAAM,KAAK,MAAM,GAAG,aAAa,SAAS,OAAO,CAAC;AACxD,YAAI,IAAI,QAAS,QAAO,IAAI;AAAA,MAC9B;AACA,YAAM,KAAK,QAAQ,GAAG;AAAA,IACxB;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAMA,SAAS,eAAe,aAA6B;AACnD,MAAI;AACF,UAAM,cAAc,KAAK,KAAK,aAAa,cAAc;AACzD,QAAI,GAAG,WAAW,WAAW,GAAG;AAC9B,YAAM,MAAM,KAAK,MAAM,GAAG,aAAa,aAAa,OAAO,CAAC;AAC5D,UAAI,IAAI,KAAM,QAAO,IAAI;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAAe;AAEvB,MAAI;AACF,UAAM,YAAY,KAAK,KAAK,aAAa,YAAY;AACrD,QAAI,GAAG,WAAW,SAAS,GAAG;AAC5B,YAAM,UAAU,GAAG,aAAa,WAAW,OAAO;AAClD,YAAM,QAAQ,QAAQ,MAAM,2BAA2B;AACvD,UAAI,MAAO,QAAO,MAAM,CAAC;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAAe;AAEvB,MAAI;AACF,UAAM,YAAY,KAAK,KAAK,aAAa,QAAQ;AACjD,QAAI,GAAG,WAAW,SAAS,GAAG;AAC5B,YAAM,UAAU,GAAG,aAAa,WAAW,OAAO;AAClD,YAAM,QAAQ,QAAQ,MAAM,kBAAkB;AAC9C,UAAI,MAAO,QAAO,MAAM,CAAC;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAAe;AAEvB,MAAI;AACF,UAAM,UAAU,KAAK,KAAK,aAAa,SAAS;AAChD,QAAI,GAAG,WAAW,OAAO,GAAG;AAC1B,YAAM,UAAU,GAAG,aAAa,SAAS,OAAO;AAChD,YAAM,QAAQ,QAAQ,MAAM,mCAAmC;AAC/D,UAAI,MAAO,QAAO,MAAM,CAAC;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAAe;AAGvB,SAAO,KAAK,SAAS,WAAW;AAClC;AAyBO,MAAM,aAAa;AAAA,EAIxB,YAAY,IAAmB,aAAqB;AAClD,SAAK,KAAK;AACV,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,SAAwB;AACtB,UAAM,QAAQ,KAAK,GAAG,SAAS;AAG/B,UAAM,UAA8B,MAAM;AAAA,MACxC;AAAA,IACF;AAGA,UAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,kBAA6B,MAAM;AAAA,QACvC;AAAA,MACF;AACA,iBAAW,QAAQ,iBAAiB;AAClC,sBAAc,IAAI,KAAK,MAAM;AAAA,MAC/B;AAAA,IACF;AAGA,UAAM,aAAmC,QAAQ,IAAI,CAAC,QAAQ;AAC5D,YAAM,UAAU,IAAI,oBAAoB,IAAI;AAC5C,YAAM,OAAO,UAAU,IAAI,WAAW,IAAI,cAAc,OAAO;AAC/D,YAAM,WAAW,cAAc,IAAI,IAAI,OAAO;AAE9C,YAAM,YAAgC;AAAA,QACpC,MAAM;AAAA,QACN,MAAM,IAAI;AAAA,QACV;AAAA,QACA;AAAA,QACA,OAAO,WAAW,aAAa;AAAA,QAC/B,YAAY;AAAA,UACV,EAAE,MAAM,4BAA4B,OAAO,WAAW,WAAW,aAAa;AAAA,UAC9E,EAAE,MAAM,uBAAuB,OAAO,IAAI,UAAU;AAAA,QACtD;AAAA,MACF;AAEA,aAAO;AAAA,IACT,CAAC;AAGD,UAAM,eAA2C,CAAC;AAElD,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,iBAA4B,MAAM;AAAA,QACtC;AAAA,MACF;AAGA,YAAM,aAAa,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;AACxD,YAAM,UAAU,oBAAI,IAAsB;AAE1C,iBAAW,QAAQ,gBAAgB;AAEjC,YAAI,WAAW,IAAI,KAAK,MAAM,KAAK,WAAW,IAAI,KAAK,MAAM,GAAG;AAC9D,gBAAM,WAAW,QAAQ,IAAI,KAAK,MAAM;AACxC,cAAI,UAAU;AACZ,qBAAS,KAAK,KAAK,MAAM;AAAA,UAC3B,OAAO;AACL,oBAAQ,IAAI,KAAK,QAAQ,CAAC,KAAK,MAAM,CAAC;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAGA,iBAAW,OAAO,SAAS;AACzB,cAAM,UAAU,IAAI,oBAAoB,IAAI;AAC5C,cAAM,MAAM,UAAU,IAAI,WAAW,IAAI,cAAc,OAAO;AAC9D,cAAM,OAAO,QAAQ,IAAI,IAAI,OAAO;AAEpC,cAAM,QAAkC,EAAE,IAAI;AAC9C,YAAI,QAAQ,KAAK,SAAS,GAAG;AAE3B,gBAAM,YAAY,KAAK,IAAI,CAAC,aAAa;AACvC,kBAAM,YAAY,QAAQ,KAAK,CAAC,MAAM,EAAE,YAAY,QAAQ;AAC5D,gBAAI,WAAW;AACb,oBAAM,gBAAgB,UAAU,oBAAoB,UAAU;AAC9D,qBAAO,UAAU,UAAU,WAAW,UAAU,cAAc,aAAa;AAAA,YAC7E;AACA,mBAAO;AAAA,UACT,CAAC;AAAA,QACH;AAEA,qBAAa,KAAK,KAAK;AAAA,MACzB;AAAA,IACF;AAGA,UAAM,WAAW,KAAK,cAAc;AAEpC,UAAM,OAAsB;AAAA,MAC1B,WAAW;AAAA,MACX,aAAa;AAAA,MACb,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,aAAqB;AACnB,UAAM,OAAO,KAAK,OAAO;AACzB,WAAO,KAAK,UAAU,MAAM,MAAM,CAAC;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAyC;AAC/C,UAAM,cAAc,eAAe;AACnC,UAAM,cAAc,eAAe,KAAK,WAAW;AACnD,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAEzC,UAAM,OAAqB;AAAA,MACzB,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO;AAAA,MACL,WAAW,KAAK;AAAA,MAChB,OAAO;AAAA,QACL,YAAY;AAAA,UACV;AAAA,YACE,MAAM;AAAA,YACN,MAAM,KAAK;AAAA,YACX,SAAS,KAAK;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,QACX,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/export/sbom.test.js

@@ -0,0 +1,288 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var import_sbom = require("./sbom");
+var import_database = require("../../db/database");
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var os = __toESM(require("os"));
+function createTempProject() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "sbom-test-"));
+  fs.writeFileSync(
+    path.join(dir, "package.json"),
+    JSON.stringify({ name: "test-project", version: "1.0.0" })
+  );
+  return dir;
+}
+function setupDb(projectRoot) {
+  const db = new import_database.GraphDatabase(projectRoot);
+  db.applySecuritySchema();
+  return db;
+}
+function insertDependency(db, opts) {
+  const rawDb = db.getRawDb();
+  db.upsertNode({
+    id: opts.nodeId,
+    kind: "dependency",
+    name: opts.packageName,
+    qualifiedName: `${opts.ecosystem}/${opts.packageName}`,
+    filePath: opts.sourceManifests?.[0] ?? "package.json",
+    language: "unknown",
+    startLine: 0,
+    endLine: 0,
+    startColumn: 0,
+    endColumn: 0,
+    updatedAt: Date.now()
+  });
+  rawDb.run(
+    `INSERT OR REPLACE INTO sec_dependencies
+      (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`,
+    [
+      opts.nodeId,
+      opts.ecosystem,
+      opts.packageName,
+      opts.declaredConstraint,
+      opts.resolvedVersion ?? null,
+      opts.scope ?? "production",
+      JSON.stringify(opts.sourceManifests ?? ["package.json"])
+    ]
+  );
+  if (opts.isDirect !== false) {
+    db.insertEdge({
+      source: opts.nodeId,
+      target: opts.sourceManifests?.[0] ?? "package.json",
+      kind: "declared_in"
+    });
+  }
+}
+function insertDependsOnEdge(db, source, target) {
+  db.insertEdge({ source, target, kind: "depends_on" });
+}
+(0, import_vitest.describe)("SBOMExporter", () => {
+  let projectRoot;
+  let db;
+  (0, import_vitest.beforeEach)(() => {
+    projectRoot = createTempProject();
+    db = setupDb(projectRoot);
+  });
+  (0, import_vitest.afterEach)(() => {
+    db.close();
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  });
+  (0, import_vitest.describe)("empty dependency graph", () => {
+    (0, import_vitest.it)("generates a valid CycloneDX 1.5 document with empty components", () => {
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      (0, import_vitest.expect)(sbom.bomFormat).toBe("CycloneDX");
+      (0, import_vitest.expect)(sbom.specVersion).toBe("1.5");
+      (0, import_vitest.expect)(sbom.version).toBe(1);
+      (0, import_vitest.expect)(sbom.components).toEqual([]);
+      (0, import_vitest.expect)(sbom.dependencies).toEqual([]);
+      (0, import_vitest.expect)(sbom.metadata).toBeDefined();
+    });
+    (0, import_vitest.it)("includes metadata with tool name, timestamp, and project name", () => {
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      const meta = sbom.metadata;
+      (0, import_vitest.expect)(meta.timestamp).toMatch(/^\d{4}-\d{2}-\d{2}T/);
+      (0, import_vitest.expect)(meta.tools.components[0].name).toBe("kirograph-sec");
+      (0, import_vitest.expect)(meta.tools.components[0].version).toBeDefined();
+      (0, import_vitest.expect)(meta.component.name).toBe("test-project");
+    });
+  });
+  (0, import_vitest.describe)("with dependencies", () => {
+    (0, import_vitest.beforeEach)(() => {
+      insertDependency(db, {
+        nodeId: "dep:npm:express",
+        ecosystem: "npm",
+        packageName: "express",
+        declaredConstraint: "^4.18.0",
+        resolvedVersion: "4.18.2",
+        scope: "production",
+        isDirect: true
+      });
+      insertDependency(db, {
+        nodeId: "dep:npm:lodash",
+        ecosystem: "npm",
+        packageName: "lodash",
+        declaredConstraint: "^4.17.0",
+        resolvedVersion: "4.17.21",
+        scope: "production",
+        isDirect: false
+        // transitive — no declared_in edge
+      });
+      insertDependsOnEdge(db, "dep:npm:express", "dep:npm:lodash");
+    });
+    (0, import_vitest.it)("includes all dependencies as components of type library", () => {
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      (0, import_vitest.expect)(sbom.components).toHaveLength(2);
+      (0, import_vitest.expect)(sbom.components.every((c) => c.type === "library")).toBe(true);
+    });
+    (0, import_vitest.it)("includes correct purl for each component", () => {
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      const express = sbom.components.find((c) => c.name === "express");
+      (0, import_vitest.expect)(express?.purl).toBe("pkg:npm/express@4.18.2");
+      const lodash = sbom.components.find((c) => c.name === "lodash");
+      (0, import_vitest.expect)(lodash?.purl).toBe("pkg:npm/lodash@4.17.21");
+    });
+    (0, import_vitest.it)('sets scope to "required" for direct and "optional" for transitive', () => {
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      const express = sbom.components.find((c) => c.name === "express");
+      (0, import_vitest.expect)(express?.scope).toBe("required");
+      const lodash = sbom.components.find((c) => c.name === "lodash");
+      (0, import_vitest.expect)(lodash?.scope).toBe("optional");
+    });
+    (0, import_vitest.it)("includes direct/transitive classification in properties", () => {
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      const express = sbom.components.find((c) => c.name === "express");
+      const expressClassification = express?.properties?.find(
+        (p) => p.name === "kirograph:classification"
+      );
+      (0, import_vitest.expect)(expressClassification?.value).toBe("direct");
+      const lodash = sbom.components.find((c) => c.name === "lodash");
+      const lodashClassification = lodash?.properties?.find(
+        (p) => p.name === "kirograph:classification"
+      );
+      (0, import_vitest.expect)(lodashClassification?.value).toBe("transitive");
+    });
+    (0, import_vitest.it)("includes dependency relationships reflecting depends_on edges", () => {
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      const expressDep = sbom.dependencies.find(
+        (d) => d.ref === "pkg:npm/express@4.18.2"
+      );
+      (0, import_vitest.expect)(expressDep).toBeDefined();
+      (0, import_vitest.expect)(expressDep?.dependsOn).toContain("pkg:npm/lodash@4.17.21");
+      const lodashDep = sbom.dependencies.find(
+        (d) => d.ref === "pkg:npm/lodash@4.17.21"
+      );
+      (0, import_vitest.expect)(lodashDep).toBeDefined();
+      (0, import_vitest.expect)(lodashDep?.dependsOn).toBeUndefined();
+    });
+  });
+  (0, import_vitest.describe)("version fallback", () => {
+    (0, import_vitest.it)("uses declared constraint when resolved version is not available", () => {
+      insertDependency(db, {
+        nodeId: "dep:npm:some-pkg",
+        ecosystem: "npm",
+        packageName: "some-pkg",
+        declaredConstraint: ">=2.0.0",
+        resolvedVersion: void 0,
+        isDirect: true
+      });
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      const comp = sbom.components.find((c) => c.name === "some-pkg");
+      (0, import_vitest.expect)(comp?.version).toBe(">=2.0.0");
+      (0, import_vitest.expect)(comp?.purl).toBe("pkg:npm/some-pkg@>=2.0.0");
+    });
+  });
+  (0, import_vitest.describe)("ecosystem purl mapping", () => {
+    (0, import_vitest.it)("maps go ecosystem to golang in purl", () => {
+      insertDependency(db, {
+        nodeId: "dep:go:github.com/gin-gonic/gin",
+        ecosystem: "go",
+        packageName: "github.com/gin-gonic/gin",
+        declaredConstraint: "v1.9.1",
+        resolvedVersion: "v1.9.1",
+        isDirect: true
+      });
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      const comp = sbom.components.find((c) => c.name === "github.com/gin-gonic/gin");
+      (0, import_vitest.expect)(comp?.purl).toBe("pkg:golang/github.com/gin-gonic/gin@v1.9.1");
+    });
+    (0, import_vitest.it)("maps python ecosystem to pypi in purl", () => {
+      insertDependency(db, {
+        nodeId: "dep:python:django",
+        ecosystem: "python",
+        packageName: "django",
+        declaredConstraint: "==4.2.0",
+        resolvedVersion: "4.2.0",
+        isDirect: true
+      });
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      const comp = sbom.components.find((c) => c.name === "django");
+      (0, import_vitest.expect)(comp?.purl).toBe("pkg:pypi/django@4.2.0");
+    });
+    (0, import_vitest.it)("maps cargo ecosystem correctly in purl", () => {
+      insertDependency(db, {
+        nodeId: "dep:cargo:serde",
+        ecosystem: "cargo",
+        packageName: "serde",
+        declaredConstraint: "1.0.188",
+        resolvedVersion: "1.0.188",
+        isDirect: true
+      });
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      const comp = sbom.components.find((c) => c.name === "serde");
+      (0, import_vitest.expect)(comp?.purl).toBe("pkg:cargo/serde@1.0.188");
+    });
+    (0, import_vitest.it)("maps maven ecosystem correctly in purl", () => {
+      insertDependency(db, {
+        nodeId: "dep:maven:org.apache.logging.log4j/log4j-core",
+        ecosystem: "maven",
+        packageName: "org.apache.logging.log4j/log4j-core",
+        declaredConstraint: "2.17.0",
+        resolvedVersion: "2.17.0",
+        isDirect: true
+      });
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const sbom = exporter.export();
+      const comp = sbom.components.find(
+        (c) => c.name === "org.apache.logging.log4j/log4j-core"
+      );
+      (0, import_vitest.expect)(comp?.purl).toBe(
+        "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0"
+      );
+    });
+  });
+  (0, import_vitest.describe)("exportJSON", () => {
+    (0, import_vitest.it)("returns a pretty-printed JSON string", () => {
+      insertDependency(db, {
+        nodeId: "dep:npm:express",
+        ecosystem: "npm",
+        packageName: "express",
+        declaredConstraint: "^4.18.0",
+        resolvedVersion: "4.18.2",
+        isDirect: true
+      });
+      const exporter = new import_sbom.SBOMExporter(db, projectRoot);
+      const json = exporter.exportJSON();
+      const parsed = JSON.parse(json);
+      (0, import_vitest.expect)(parsed.bomFormat).toBe("CycloneDX");
+      (0, import_vitest.expect)(parsed.specVersion).toBe("1.5");
+      (0, import_vitest.expect)(json).toContain("\n");
+      (0, import_vitest.expect)(json).toContain("  ");
+    });
+  });
+});
+//# sourceMappingURL=sbom.test.js.map

package/dist/security/export/sbom.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/export/sbom.test.ts"],
+  "sourcesContent": ["/**\n * Unit tests for SBOMExporter \u2014 CycloneDX 1.5 SBOM generation\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport { SBOMExporter } from './sbom';\nimport { GraphDatabase } from '../../db/database';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\n\n// \u2500\u2500 Test Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction createTempProject(): string {\n  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sbom-test-'));\n  // Create a package.json so the project name can be detected\n  fs.writeFileSync(\n    path.join(dir, 'package.json'),\n    JSON.stringify({ name: 'test-project', version: '1.0.0' }),\n  );\n  return dir;\n}\n\nfunction setupDb(projectRoot: string): GraphDatabase {\n  const db = new GraphDatabase(projectRoot);\n  db.applySecuritySchema();\n  return db;\n}\n\nfunction insertDependency(\n  db: GraphDatabase,\n  opts: {\n    nodeId: string;\n    ecosystem: string;\n    packageName: string;\n    declaredConstraint: string;\n    resolvedVersion?: string;\n    scope?: string;\n    sourceManifests?: string[];\n    isDirect?: boolean;\n  },\n): void {\n  const rawDb = db.getRawDb();\n\n  // Insert into nodes table\n  db.upsertNode({\n    id: opts.nodeId,\n    kind: 'dependency',\n    name: opts.packageName,\n    qualifiedName: `${opts.ecosystem}/${opts.packageName}`,\n    filePath: opts.sourceManifests?.[0] ?? 'package.json',\n    language: 'unknown',\n    startLine: 0,\n    endLine: 0,\n    startColumn: 0,\n    endColumn: 0,\n    updatedAt: Date.now(),\n  });\n\n  // Insert into sec_dependencies\n  rawDb.run(\n    `INSERT OR REPLACE INTO sec_dependencies\n      (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n     VALUES (?, ?, ?, ?, ?, ?, ?)`,\n    [\n      opts.nodeId,\n      opts.ecosystem,\n      opts.packageName,\n      opts.declaredConstraint,\n      opts.resolvedVersion ?? null,\n      opts.scope ?? 'production',\n      JSON.stringify(opts.sourceManifests ?? ['package.json']),\n    ],\n  );\n\n  // Create declared_in edge if direct\n  if (opts.isDirect !== false) {\n    db.insertEdge({\n      source: opts.nodeId,\n      target: opts.sourceManifests?.[0] ?? 'package.json',\n      kind: 'declared_in',\n    });\n  }\n}\n\nfunction insertDependsOnEdge(db: GraphDatabase, source: string, target: string): void {\n  db.insertEdge({ source, target, kind: 'depends_on' });\n}\n\n// \u2500\u2500 Tests \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ndescribe('SBOMExporter', () => {\n  let projectRoot: string;\n  let db: GraphDatabase;\n\n  beforeEach(() => {\n    projectRoot = createTempProject();\n    db = setupDb(projectRoot);\n  });\n\n  afterEach(() => {\n    db.close();\n    fs.rmSync(projectRoot, { recursive: true, force: true });\n  });\n\n  describe('empty dependency graph', () => {\n    it('generates a valid CycloneDX 1.5 document with empty components', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      expect(sbom.bomFormat).toBe('CycloneDX');\n      expect(sbom.specVersion).toBe('1.5');\n      expect(sbom.version).toBe(1);\n      expect(sbom.components).toEqual([]);\n      expect(sbom.dependencies).toEqual([]);\n      expect(sbom.metadata).toBeDefined();\n    });\n\n    it('includes metadata with tool name, timestamp, and project name', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const meta = sbom.metadata as any;\n      expect(meta.timestamp).toMatch(/^\\d{4}-\\d{2}-\\d{2}T/);\n      expect(meta.tools.components[0].name).toBe('kirograph-sec');\n      expect(meta.tools.components[0].version).toBeDefined();\n      expect(meta.component.name).toBe('test-project');\n    });\n  });\n\n  describe('with dependencies', () => {\n    beforeEach(() => {\n      insertDependency(db, {\n        nodeId: 'dep:npm:express',\n        ecosystem: 'npm',\n        packageName: 'express',\n        declaredConstraint: '^4.18.0',\n        resolvedVersion: '4.18.2',\n        scope: 'production',\n        isDirect: true,\n      });\n\n      insertDependency(db, {\n        nodeId: 'dep:npm:lodash',\n        ecosystem: 'npm',\n        packageName: 'lodash',\n        declaredConstraint: '^4.17.0',\n        resolvedVersion: '4.17.21',\n        scope: 'production',\n        isDirect: false, // transitive \u2014 no declared_in edge\n      });\n\n      // express depends on lodash (transitive)\n      insertDependsOnEdge(db, 'dep:npm:express', 'dep:npm:lodash');\n    });\n\n    it('includes all dependencies as components of type library', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      expect(sbom.components).toHaveLength(2);\n      expect(sbom.components.every((c) => c.type === 'library')).toBe(true);\n    });\n\n    it('includes correct purl for each component', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const express = sbom.components.find((c) => c.name === 'express');\n      expect(express?.purl).toBe('pkg:npm/express@4.18.2');\n\n      const lodash = sbom.components.find((c) => c.name === 'lodash');\n      expect(lodash?.purl).toBe('pkg:npm/lodash@4.17.21');\n    });\n\n    it('sets scope to \"required\" for direct and \"optional\" for transitive', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const express = sbom.components.find((c) => c.name === 'express');\n      expect(express?.scope).toBe('required');\n\n      const lodash = sbom.components.find((c) => c.name === 'lodash');\n      expect(lodash?.scope).toBe('optional');\n    });\n\n    it('includes direct/transitive classification in properties', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const express = sbom.components.find((c) => c.name === 'express');\n      const expressClassification = express?.properties?.find(\n        (p) => p.name === 'kirograph:classification',\n      );\n      expect(expressClassification?.value).toBe('direct');\n\n      const lodash = sbom.components.find((c) => c.name === 'lodash');\n      const lodashClassification = lodash?.properties?.find(\n        (p) => p.name === 'kirograph:classification',\n      );\n      expect(lodashClassification?.value).toBe('transitive');\n    });\n\n    it('includes dependency relationships reflecting depends_on edges', () => {\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const expressDep = sbom.dependencies.find(\n        (d) => d.ref === 'pkg:npm/express@4.18.2',\n      );\n      expect(expressDep).toBeDefined();\n      expect(expressDep?.dependsOn).toContain('pkg:npm/lodash@4.17.21');\n\n      // lodash has no depends_on\n      const lodashDep = sbom.dependencies.find(\n        (d) => d.ref === 'pkg:npm/lodash@4.17.21',\n      );\n      expect(lodashDep).toBeDefined();\n      expect(lodashDep?.dependsOn).toBeUndefined();\n    });\n  });\n\n  describe('version fallback', () => {\n    it('uses declared constraint when resolved version is not available', () => {\n      insertDependency(db, {\n        nodeId: 'dep:npm:some-pkg',\n        ecosystem: 'npm',\n        packageName: 'some-pkg',\n        declaredConstraint: '>=2.0.0',\n        resolvedVersion: undefined,\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const comp = sbom.components.find((c) => c.name === 'some-pkg');\n      expect(comp?.version).toBe('>=2.0.0');\n      expect(comp?.purl).toBe('pkg:npm/some-pkg@>=2.0.0');\n    });\n  });\n\n  describe('ecosystem purl mapping', () => {\n    it('maps go ecosystem to golang in purl', () => {\n      insertDependency(db, {\n        nodeId: 'dep:go:github.com/gin-gonic/gin',\n        ecosystem: 'go',\n        packageName: 'github.com/gin-gonic/gin',\n        declaredConstraint: 'v1.9.1',\n        resolvedVersion: 'v1.9.1',\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const comp = sbom.components.find((c) => c.name === 'github.com/gin-gonic/gin');\n      expect(comp?.purl).toBe('pkg:golang/github.com/gin-gonic/gin@v1.9.1');\n    });\n\n    it('maps python ecosystem to pypi in purl', () => {\n      insertDependency(db, {\n        nodeId: 'dep:python:django',\n        ecosystem: 'python',\n        packageName: 'django',\n        declaredConstraint: '==4.2.0',\n        resolvedVersion: '4.2.0',\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const comp = sbom.components.find((c) => c.name === 'django');\n      expect(comp?.purl).toBe('pkg:pypi/django@4.2.0');\n    });\n\n    it('maps cargo ecosystem correctly in purl', () => {\n      insertDependency(db, {\n        nodeId: 'dep:cargo:serde',\n        ecosystem: 'cargo',\n        packageName: 'serde',\n        declaredConstraint: '1.0.188',\n        resolvedVersion: '1.0.188',\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const comp = sbom.components.find((c) => c.name === 'serde');\n      expect(comp?.purl).toBe('pkg:cargo/serde@1.0.188');\n    });\n\n    it('maps maven ecosystem correctly in purl', () => {\n      insertDependency(db, {\n        nodeId: 'dep:maven:org.apache.logging.log4j/log4j-core',\n        ecosystem: 'maven',\n        packageName: 'org.apache.logging.log4j/log4j-core',\n        declaredConstraint: '2.17.0',\n        resolvedVersion: '2.17.0',\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const sbom = exporter.export();\n\n      const comp = sbom.components.find(\n        (c) => c.name === 'org.apache.logging.log4j/log4j-core',\n      );\n      expect(comp?.purl).toBe(\n        'pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0',\n      );\n    });\n  });\n\n  describe('exportJSON', () => {\n    it('returns a pretty-printed JSON string', () => {\n      insertDependency(db, {\n        nodeId: 'dep:npm:express',\n        ecosystem: 'npm',\n        packageName: 'express',\n        declaredConstraint: '^4.18.0',\n        resolvedVersion: '4.18.2',\n        isDirect: true,\n      });\n\n      const exporter = new SBOMExporter(db, projectRoot);\n      const json = exporter.exportJSON();\n\n      // Should be valid JSON\n      const parsed = JSON.parse(json);\n      expect(parsed.bomFormat).toBe('CycloneDX');\n      expect(parsed.specVersion).toBe('1.5');\n\n      // Should be pretty-printed (contains newlines and indentation)\n      expect(json).toContain('\\n');\n      expect(json).toContain('  ');\n    });\n  });\n});\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAGA,oBAA4D;AAC5D,kBAA6B;AAC7B,sBAA8B;AAC9B,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AAIpB,SAAS,oBAA4B;AACnC,QAAM,MAAM,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,YAAY,CAAC;AAE/D,KAAG;AAAA,IACD,KAAK,KAAK,KAAK,cAAc;AAAA,IAC7B,KAAK,UAAU,EAAE,MAAM,gBAAgB,SAAS,QAAQ,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,aAAoC;AACnD,QAAM,KAAK,IAAI,8BAAc,WAAW;AACxC,KAAG,oBAAoB;AACvB,SAAO;AACT;AAEA,SAAS,iBACP,IACA,MAUM;AACN,QAAM,QAAQ,GAAG,SAAS;AAG1B,KAAG,WAAW;AAAA,IACZ,IAAI,KAAK;AAAA,IACT,MAAM;AAAA,IACN,MAAM,KAAK;AAAA,IACX,eAAe,GAAG,KAAK,SAAS,IAAI,KAAK,WAAW;AAAA,IACpD,UAAU,KAAK,kBAAkB,CAAC,KAAK;AAAA,IACvC,UAAU;AAAA,IACV,WAAW;AAAA,IACX,SAAS;AAAA,IACT,aAAa;AAAA,IACb,WAAW;AAAA,IACX,WAAW,KAAK,IAAI;AAAA,EACtB,CAAC;AAGD,QAAM;AAAA,IACJ;AAAA;AAAA;AAAA,IAGA;AAAA,MACE,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,mBAAmB;AAAA,MACxB,KAAK,SAAS;AAAA,MACd,KAAK,UAAU,KAAK,mBAAmB,CAAC,cAAc,CAAC;AAAA,IACzD;AAAA,EACF;AAGA,MAAI,KAAK,aAAa,OAAO;AAC3B,OAAG,WAAW;AAAA,MACZ,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK,kBAAkB,CAAC,KAAK;AAAA,MACrC,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACF;AAEA,SAAS,oBAAoB,IAAmB,QAAgB,QAAsB;AACpF,KAAG,WAAW,EAAE,QAAQ,QAAQ,MAAM,aAAa,CAAC;AACtD;AAAA,IAIA,wBAAS,gBAAgB,MAAM;AAC7B,MAAI;AACJ,MAAI;AAEJ,gCAAW,MAAM;AACf,kBAAc,kBAAkB;AAChC,SAAK,QAAQ,WAAW;AAAA,EAC1B,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,MAAM;AACT,OAAG,OAAO,aAAa,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACzD,CAAC;AAED,8BAAS,0BAA0B,MAAM;AACvC,0BAAG,kEAAkE,MAAM;AACzE,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,gCAAO,KAAK,SAAS,EAAE,KAAK,WAAW;AACvC,gCAAO,KAAK,WAAW,EAAE,KAAK,KAAK;AACnC,gCAAO,KAAK,OAAO,EAAE,KAAK,CAAC;AAC3B,gCAAO,KAAK,UAAU,EAAE,QAAQ,CAAC,CAAC;AAClC,gCAAO,KAAK,YAAY,EAAE,QAAQ,CAAC,CAAC;AACpC,gCAAO,KAAK,QAAQ,EAAE,YAAY;AAAA,IACpC,CAAC;AAED,0BAAG,iEAAiE,MAAM;AACxE,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK;AAClB,gCAAO,KAAK,SAAS,EAAE,QAAQ,qBAAqB;AACpD,gCAAO,KAAK,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,eAAe;AAC1D,gCAAO,KAAK,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,YAAY;AACrD,gCAAO,KAAK,UAAU,IAAI,EAAE,KAAK,cAAc;AAAA,IACjD,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,qBAAqB,MAAM;AAClC,kCAAW,MAAM;AACf,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,OAAO;AAAA,QACP,UAAU;AAAA,MACZ,CAAC;AAED,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,OAAO;AAAA,QACP,UAAU;AAAA;AAAA,MACZ,CAAC;AAGD,0BAAoB,IAAI,mBAAmB,gBAAgB;AAAA,IAC7D,CAAC;AAED,0BAAG,2DAA2D,MAAM;AAClE,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,gCAAO,KAAK,UAAU,EAAE,aAAa,CAAC;AACtC,gCAAO,KAAK,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,SAAS,CAAC,EAAE,KAAK,IAAI;AAAA,IACtE,CAAC;AAED,0BAAG,4CAA4C,MAAM;AACnD,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,UAAU,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AAChE,gCAAO,SAAS,IAAI,EAAE,KAAK,wBAAwB;AAEnD,YAAM,SAAS,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAC9D,gCAAO,QAAQ,IAAI,EAAE,KAAK,wBAAwB;AAAA,IACpD,CAAC;AAED,0BAAG,qEAAqE,MAAM;AAC5E,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,UAAU,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AAChE,gCAAO,SAAS,KAAK,EAAE,KAAK,UAAU;AAEtC,YAAM,SAAS,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAC9D,gCAAO,QAAQ,KAAK,EAAE,KAAK,UAAU;AAAA,IACvC,CAAC;AAED,0BAAG,2DAA2D,MAAM;AAClE,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,UAAU,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AAChE,YAAM,wBAAwB,SAAS,YAAY;AAAA,QACjD,CAAC,MAAM,EAAE,SAAS;AAAA,MACpB;AACA,gCAAO,uBAAuB,KAAK,EAAE,KAAK,QAAQ;AAElD,YAAM,SAAS,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAC9D,YAAM,uBAAuB,QAAQ,YAAY;AAAA,QAC/C,CAAC,MAAM,EAAE,SAAS;AAAA,MACpB;AACA,gCAAO,sBAAsB,KAAK,EAAE,KAAK,YAAY;AAAA,IACvD,CAAC;AAED,0BAAG,iEAAiE,MAAM;AACxE,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,aAAa,KAAK,aAAa;AAAA,QACnC,CAAC,MAAM,EAAE,QAAQ;AAAA,MACnB;AACA,gCAAO,UAAU,EAAE,YAAY;AAC/B,gCAAO,YAAY,SAAS,EAAE,UAAU,wBAAwB;AAGhE,YAAM,YAAY,KAAK,aAAa;AAAA,QAClC,CAAC,MAAM,EAAE,QAAQ;AAAA,MACnB;AACA,gCAAO,SAAS,EAAE,YAAY;AAC9B,gCAAO,WAAW,SAAS,EAAE,cAAc;AAAA,IAC7C,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,oBAAoB,MAAM;AACjC,0BAAG,mEAAmE,MAAM;AAC1E,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,UAAU;AAC9D,gCAAO,MAAM,OAAO,EAAE,KAAK,SAAS;AACpC,gCAAO,MAAM,IAAI,EAAE,KAAK,0BAA0B;AAAA,IACpD,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,0BAA0B,MAAM;AACvC,0BAAG,uCAAuC,MAAM;AAC9C,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,0BAA0B;AAC9E,gCAAO,MAAM,IAAI,EAAE,KAAK,4CAA4C;AAAA,IACtE,CAAC;AAED,0BAAG,yCAAyC,MAAM;AAChD,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAC5D,gCAAO,MAAM,IAAI,EAAE,KAAK,uBAAuB;AAAA,IACjD,CAAC;AAED,0BAAG,0CAA0C,MAAM;AACjD,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,OAAO;AAC3D,gCAAO,MAAM,IAAI,EAAE,KAAK,yBAAyB;AAAA,IACnD,CAAC;AAED,0BAAG,0CAA0C,MAAM;AACjD,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,OAAO;AAE7B,YAAM,OAAO,KAAK,WAAW;AAAA,QAC3B,CAAC,MAAM,EAAE,SAAS;AAAA,MACpB;AACA,gCAAO,MAAM,IAAI,EAAE;AAAA,QACjB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,cAAc,MAAM;AAC3B,0BAAG,wCAAwC,MAAM;AAC/C,uBAAiB,IAAI;AAAA,QACnB,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,oBAAoB;AAAA,QACpB,iBAAiB;AAAA,QACjB,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,WAAW,IAAI,yBAAa,IAAI,WAAW;AACjD,YAAM,OAAO,SAAS,WAAW;AAGjC,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,gCAAO,OAAO,SAAS,EAAE,KAAK,WAAW;AACzC,gCAAO,OAAO,WAAW,EAAE,KAAK,KAAK;AAGrC,gCAAO,IAAI,EAAE,UAAU,IAAI;AAC3B,gCAAO,IAAI,EAAE,UAAU,IAAI;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AACH,CAAC;",
+  "names": []
+}