kirograph 0.16.1 → 0.19.0

package/dist/security/export/vex.js

@@ -0,0 +1,220 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var vex_exports = {};
+__export(vex_exports, {
+  VEXExporter: () => VEXExporter
+});
+module.exports = __toCommonJS(vex_exports);
+var path = __toESM(require("path"));
+const TOOL_NAME = "kirograph-sec";
+const TOOL_VERSION = "0.1.0";
+class VEXExporter {
+  constructor(db, projectRoot) {
+    this.db = db;
+    this.projectRoot = projectRoot;
+  }
+  /**
+   * Generate CycloneDX 1.5 VEX JSON object.
+   *
+   * Queries all Vulnerability_Nodes and their reachability verdicts,
+   * producing one VEX entry per vulnerability.
+   */
+  export() {
+    const rawDb = this.db.getRawDb();
+    const projectName = path.basename(this.projectRoot);
+    const metadata = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      tools: {
+        components: [
+          {
+            type: "application",
+            name: TOOL_NAME,
+            version: TOOL_VERSION
+          }
+        ]
+      },
+      component: {
+        type: "application",
+        name: projectName
+      }
+    };
+    const vulnRows = rawDb.all(
+      `SELECT node_id, cve_id, severity_score, source_database FROM sec_vulnerabilities`
+    );
+    const vulnerabilities = [];
+    for (const vuln of vulnRows) {
+      const entry = this.buildVulnerabilityEntry(rawDb, vuln);
+      vulnerabilities.push(entry);
+    }
+    return {
+      bomFormat: "CycloneDX",
+      specVersion: "1.5",
+      version: 1,
+      metadata,
+      vulnerabilities
+    };
+  }
+  /**
+   * Export to pretty-printed JSON string.
+   */
+  exportJSON() {
+    return JSON.stringify(this.export(), null, 2);
+  }
+  /**
+   * Build a single CycloneDX vulnerability entry from a Vulnerability_Node.
+   *
+   * Maps reachability verdicts to CycloneDX analysis states:
+   * - affected → "affected" with path summary detail
+   * - not_affected → "not_affected" with justification "code_not_reachable"
+   * - under_investigation → "under_investigation" with unresolved symbols detail
+   * - no reachability data → "under_investigation" with pending analysis detail
+   */
+  buildVulnerabilityEntry(rawDb, vuln) {
+    const entry = {
+      id: vuln.cve_id,
+      source: {
+        name: vuln.source_database
+      }
+    };
+    if (vuln.severity_score != null) {
+      entry.ratings = [
+        {
+          score: vuln.severity_score,
+          method: "CVSSv31"
+        }
+      ];
+    }
+    const depEdge = rawDb.get(
+      `SELECT source FROM edges WHERE target = ? AND kind = 'has_vulnerability'`,
+      [vuln.node_id]
+    );
+    if (depEdge) {
+      const depRow = rawDb.get(
+        `SELECT ecosystem, package_name, resolved_version, declared_constraint
+         FROM sec_dependencies WHERE node_id = ?`,
+        [depEdge.source]
+      );
+      if (depRow) {
+        const version = depRow.resolved_version || depRow.declared_constraint;
+        const purl = `pkg:${depRow.ecosystem}/${depRow.package_name}@${version}`;
+        entry.affects = [{ ref: purl }];
+      }
+    }
+    const reachRow = rawDb.get(
+      `SELECT verdict, paths, unresolved_symbols, reaching_entry_point_count
+       FROM sec_reachability WHERE vulnerability_node_id = ?`,
+      [vuln.node_id]
+    );
+    if (!reachRow) {
+      entry.analysis = {
+        state: "under_investigation",
+        detail: "Reachability analysis has not yet been executed for this vulnerability."
+      };
+    } else {
+      entry.analysis = this.buildAnalysis(rawDb, vuln.node_id, reachRow);
+    }
+    return entry;
+  }
+  /**
+   * Build the analysis section based on the reachability verdict.
+   */
+  buildAnalysis(rawDb, vulnerabilityNodeId, reachRow) {
+    switch (reachRow.verdict) {
+      case "affected":
+        return this.buildAffectedAnalysis(rawDb, vulnerabilityNodeId, reachRow);
+      case "not_affected":
+        return {
+          state: "not_affected",
+          justification: "code_not_reachable",
+          detail: "No reachable path found from any application entry point to this dependency."
+        };
+      case "under_investigation":
+        return this.buildUnderInvestigationAnalysis(reachRow);
+      default:
+        return {
+          state: "under_investigation",
+          detail: "Reachability analysis pending."
+        };
+    }
+  }
+  /**
+   * Build analysis detail for "affected" verdict.
+   *
+   * Includes: entry point count, layer count, shortest path length.
+   */
+  buildAffectedAnalysis(rawDb, vulnerabilityNodeId, reachRow) {
+    const entryPointCount = reachRow.reaching_entry_point_count;
+    const impactRow = rawDb.get(
+      `SELECT affected_layers, distinct_path_count FROM sec_impact WHERE vulnerability_node_id = ?`,
+      [vulnerabilityNodeId]
+    );
+    let layerCount = 0;
+    if (impactRow && impactRow.affected_layers) {
+      const layers = JSON.parse(impactRow.affected_layers);
+      layerCount = layers.length;
+    }
+    let shortestPathLength = 0;
+    if (reachRow.paths) {
+      const paths = JSON.parse(reachRow.paths);
+      if (paths.length > 0) {
+        shortestPathLength = Math.min(...paths.map((p) => p.path.length));
+      }
+    }
+    const detail = `Reachable from ${entryPointCount} entry point${entryPointCount !== 1 ? "s" : ""} via ${layerCount} layer${layerCount !== 1 ? "s" : ""}. Shortest path length: ${shortestPathLength} nodes.`;
+    return {
+      state: "affected",
+      detail
+    };
+  }
+  /**
+   * Build analysis detail for "under_investigation" verdict.
+   *
+   * Lists unresolved symbols or states pending analysis reason.
+   */
+  buildUnderInvestigationAnalysis(reachRow) {
+    if (reachRow.unresolved_symbols) {
+      const symbols = JSON.parse(reachRow.unresolved_symbols);
+      if (symbols.length > 0) {
+        return {
+          state: "under_investigation",
+          detail: `${symbols.length} unresolved symbol${symbols.length !== 1 ? "s" : ""} blocked complete analysis: ${symbols.join(", ")}`
+        };
+      }
+    }
+    return {
+      state: "under_investigation",
+      detail: "Reachability analysis pending."
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  VEXExporter
+});
+//# sourceMappingURL=vex.js.map

package/dist/security/export/vex.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/export/vex.ts"],
+  "sourcesContent": ["/**\n * KiroGraph-Sec VEX Exporter\n *\n * Generates CycloneDX 1.5 VEX (Vulnerability Exploitability eXchange) documents\n * with reachability-informed vulnerability status. Each Vulnerability_Node is\n * mapped to a VEX entry with an analysis state derived from the reachability verdict.\n *\n * Requirements: 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 7.8\n */\n\nimport * as path from 'path';\nimport type { GraphDatabase } from '../../db/database';\nimport type { CycloneDXVEX, CycloneDXVulnerability, ReachabilityPath } from '../types';\n\n/** Tool metadata for VEX document */\nconst TOOL_NAME = 'kirograph-sec';\nconst TOOL_VERSION = '0.1.0';\n\n/**\n * VEXExporter serializes vulnerability assessments with reachability verdicts\n * into CycloneDX 1.5 VEX format.\n */\nexport class VEXExporter {\n  private readonly db: GraphDatabase;\n  private readonly projectRoot: string;\n\n  constructor(db: GraphDatabase, projectRoot: string) {\n    this.db = db;\n    this.projectRoot = projectRoot;\n  }\n\n  /**\n   * Generate CycloneDX 1.5 VEX JSON object.\n   *\n   * Queries all Vulnerability_Nodes and their reachability verdicts,\n   * producing one VEX entry per vulnerability.\n   */\n  export(): CycloneDXVEX {\n    const rawDb = this.db.getRawDb();\n    const projectName = path.basename(this.projectRoot);\n\n    // Build metadata\n    const metadata: Record<string, unknown> = {\n      timestamp: new Date().toISOString(),\n      tools: {\n        components: [\n          {\n            type: 'application',\n            name: TOOL_NAME,\n            version: TOOL_VERSION,\n          },\n        ],\n      },\n      component: {\n        type: 'application',\n        name: projectName,\n      },\n    };\n\n    // Query all vulnerability nodes\n    const vulnRows: Array<{\n      node_id: string;\n      cve_id: string;\n      severity_score: number | null;\n      source_database: string;\n    }> = rawDb.all(\n      `SELECT node_id, cve_id, severity_score, source_database FROM sec_vulnerabilities`,\n    );\n\n    // Build vulnerability entries\n    const vulnerabilities: CycloneDXVulnerability[] = [];\n\n    for (const vuln of vulnRows) {\n      const entry = this.buildVulnerabilityEntry(rawDb, vuln);\n      vulnerabilities.push(entry);\n    }\n\n    return {\n      bomFormat: 'CycloneDX',\n      specVersion: '1.5',\n      version: 1,\n      metadata,\n      vulnerabilities,\n    };\n  }\n\n  /**\n   * Export to pretty-printed JSON string.\n   */\n  exportJSON(): string {\n    return JSON.stringify(this.export(), null, 2);\n  }\n\n  /**\n   * Build a single CycloneDX vulnerability entry from a Vulnerability_Node.\n   *\n   * Maps reachability verdicts to CycloneDX analysis states:\n   * - affected \u2192 \"affected\" with path summary detail\n   * - not_affected \u2192 \"not_affected\" with justification \"code_not_reachable\"\n   * - under_investigation \u2192 \"under_investigation\" with unresolved symbols detail\n   * - no reachability data \u2192 \"under_investigation\" with pending analysis detail\n   */\n  private buildVulnerabilityEntry(\n    rawDb: any,\n    vuln: { node_id: string; cve_id: string; severity_score: number | null; source_database: string },\n  ): CycloneDXVulnerability {\n    const entry: CycloneDXVulnerability = {\n      id: vuln.cve_id,\n      source: {\n        name: vuln.source_database,\n      },\n    };\n\n    // Add severity rating if available\n    if (vuln.severity_score != null) {\n      entry.ratings = [\n        {\n          score: vuln.severity_score,\n          method: 'CVSSv31',\n        },\n      ];\n    }\n\n    // Find the affected component purl via has_vulnerability edge\n    const depEdge = rawDb.get(\n      `SELECT source FROM edges WHERE target = ? AND kind = 'has_vulnerability'`,\n      [vuln.node_id],\n    );\n\n    if (depEdge) {\n      const depRow = rawDb.get(\n        `SELECT ecosystem, package_name, resolved_version, declared_constraint\n         FROM sec_dependencies WHERE node_id = ?`,\n        [depEdge.source],\n      );\n\n      if (depRow) {\n        const version = depRow.resolved_version || depRow.declared_constraint;\n        const purl = `pkg:${depRow.ecosystem}/${depRow.package_name}@${version}`;\n        entry.affects = [{ ref: purl }];\n      }\n    }\n\n    // Query reachability verdict\n    const reachRow = rawDb.get(\n      `SELECT verdict, paths, unresolved_symbols, reaching_entry_point_count\n       FROM sec_reachability WHERE vulnerability_node_id = ?`,\n      [vuln.node_id],\n    );\n\n    if (!reachRow) {\n      // No reachability analysis performed (Requirement 7.5)\n      entry.analysis = {\n        state: 'under_investigation',\n        detail: 'Reachability analysis has not yet been executed for this vulnerability.',\n      };\n    } else {\n      entry.analysis = this.buildAnalysis(rawDb, vuln.node_id, reachRow);\n    }\n\n    return entry;\n  }\n\n  /**\n   * Build the analysis section based on the reachability verdict.\n   */\n  private buildAnalysis(\n    rawDb: any,\n    vulnerabilityNodeId: string,\n    reachRow: {\n      verdict: string;\n      paths: string | null;\n      unresolved_symbols: string | null;\n      reaching_entry_point_count: number;\n    },\n  ): CycloneDXVulnerability['analysis'] {\n    switch (reachRow.verdict) {\n      case 'affected':\n        return this.buildAffectedAnalysis(rawDb, vulnerabilityNodeId, reachRow);\n\n      case 'not_affected':\n        return {\n          state: 'not_affected',\n          justification: 'code_not_reachable',\n          detail: 'No reachable path found from any application entry point to this dependency.',\n        };\n\n      case 'under_investigation':\n        return this.buildUnderInvestigationAnalysis(reachRow);\n\n      default:\n        return {\n          state: 'under_investigation',\n          detail: 'Reachability analysis pending.',\n        };\n    }\n  }\n\n  /**\n   * Build analysis detail for \"affected\" verdict.\n   *\n   * Includes: entry point count, layer count, shortest path length.\n   */\n  private buildAffectedAnalysis(\n    rawDb: any,\n    vulnerabilityNodeId: string,\n    reachRow: {\n      paths: string | null;\n      reaching_entry_point_count: number;\n    },\n  ): CycloneDXVulnerability['analysis'] {\n    const entryPointCount = reachRow.reaching_entry_point_count;\n\n    // Get impact summary for layer information\n    const impactRow = rawDb.get(\n      `SELECT affected_layers, distinct_path_count FROM sec_impact WHERE vulnerability_node_id = ?`,\n      [vulnerabilityNodeId],\n    );\n\n    let layerCount = 0;\n    if (impactRow && impactRow.affected_layers) {\n      const layers: string[] = JSON.parse(impactRow.affected_layers);\n      layerCount = layers.length;\n    }\n\n    // Calculate shortest path length from stored paths\n    let shortestPathLength = 0;\n    if (reachRow.paths) {\n      const paths: ReachabilityPath[] = JSON.parse(reachRow.paths);\n      if (paths.length > 0) {\n        shortestPathLength = Math.min(...paths.map(p => p.path.length));\n      }\n    }\n\n    const detail = `Reachable from ${entryPointCount} entry point${entryPointCount !== 1 ? 's' : ''} via ${layerCount} layer${layerCount !== 1 ? 's' : ''}. Shortest path length: ${shortestPathLength} nodes.`;\n\n    return {\n      state: 'affected',\n      detail,\n    };\n  }\n\n  /**\n   * Build analysis detail for \"under_investigation\" verdict.\n   *\n   * Lists unresolved symbols or states pending analysis reason.\n   */\n  private buildUnderInvestigationAnalysis(\n    reachRow: {\n      unresolved_symbols: string | null;\n    },\n  ): CycloneDXVulnerability['analysis'] {\n    if (reachRow.unresolved_symbols) {\n      const symbols: string[] = JSON.parse(reachRow.unresolved_symbols);\n      if (symbols.length > 0) {\n        return {\n          state: 'under_investigation',\n          detail: `${symbols.length} unresolved symbol${symbols.length !== 1 ? 's' : ''} blocked complete analysis: ${symbols.join(', ')}`,\n        };\n      }\n    }\n\n    return {\n      state: 'under_investigation',\n      detail: 'Reachability analysis pending.',\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,WAAsB;AAKtB,MAAM,YAAY;AAClB,MAAM,eAAe;AAMd,MAAM,YAAY;AAAA,EAIvB,YAAY,IAAmB,aAAqB;AAClD,SAAK,KAAK;AACV,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAuB;AACrB,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,cAAc,KAAK,SAAS,KAAK,WAAW;AAGlD,UAAM,WAAoC;AAAA,MACxC,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,OAAO;AAAA,QACL,YAAY;AAAA,UACV;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,UAAM,WAKD,MAAM;AAAA,MACT;AAAA,IACF;AAGA,UAAM,kBAA4C,CAAC;AAEnD,eAAW,QAAQ,UAAU;AAC3B,YAAM,QAAQ,KAAK,wBAAwB,OAAO,IAAI;AACtD,sBAAgB,KAAK,KAAK;AAAA,IAC5B;AAEA,WAAO;AAAA,MACL,WAAW;AAAA,MACX,aAAa;AAAA,MACb,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,aAAqB;AACnB,WAAO,KAAK,UAAU,KAAK,OAAO,GAAG,MAAM,CAAC;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,wBACN,OACA,MACwB;AACxB,UAAM,QAAgC;AAAA,MACpC,IAAI,KAAK;AAAA,MACT,QAAQ;AAAA,QACN,MAAM,KAAK;AAAA,MACb;AAAA,IACF;AAGA,QAAI,KAAK,kBAAkB,MAAM;AAC/B,YAAM,UAAU;AAAA,QACd;AAAA,UACE,OAAO,KAAK;AAAA,UACZ,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,CAAC,KAAK,OAAO;AAAA,IACf;AAEA,QAAI,SAAS;AACX,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA;AAAA,QAEA,CAAC,QAAQ,MAAM;AAAA,MACjB;AAEA,UAAI,QAAQ;AACV,cAAM,UAAU,OAAO,oBAAoB,OAAO;AAClD,cAAM,OAAO,OAAO,OAAO,SAAS,IAAI,OAAO,YAAY,IAAI,OAAO;AACtE,cAAM,UAAU,CAAC,EAAE,KAAK,KAAK,CAAC;AAAA,MAChC;AAAA,IACF;AAGA,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA;AAAA,MAEA,CAAC,KAAK,OAAO;AAAA,IACf;AAEA,QAAI,CAAC,UAAU;AAEb,YAAM,WAAW;AAAA,QACf,OAAO;AAAA,QACP,QAAQ;AAAA,MACV;AAAA,IACF,OAAO;AACL,YAAM,WAAW,KAAK,cAAc,OAAO,KAAK,SAAS,QAAQ;AAAA,IACnE;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,cACN,OACA,qBACA,UAMoC;AACpC,YAAQ,SAAS,SAAS;AAAA,MACxB,KAAK;AACH,eAAO,KAAK,sBAAsB,OAAO,qBAAqB,QAAQ;AAAA,MAExE,KAAK;AACH,eAAO;AAAA,UACL,OAAO;AAAA,UACP,eAAe;AAAA,UACf,QAAQ;AAAA,QACV;AAAA,MAEF,KAAK;AACH,eAAO,KAAK,gCAAgC,QAAQ;AAAA,MAEtD;AACE,eAAO;AAAA,UACL,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,IACJ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,sBACN,OACA,qBACA,UAIoC;AACpC,UAAM,kBAAkB,SAAS;AAGjC,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA,CAAC,mBAAmB;AAAA,IACtB;AAEA,QAAI,aAAa;AACjB,QAAI,aAAa,UAAU,iBAAiB;AAC1C,YAAM,SAAmB,KAAK,MAAM,UAAU,eAAe;AAC7D,mBAAa,OAAO;AAAA,IACtB;AAGA,QAAI,qBAAqB;AACzB,QAAI,SAAS,OAAO;AAClB,YAAM,QAA4B,KAAK,MAAM,SAAS,KAAK;AAC3D,UAAI,MAAM,SAAS,GAAG;AACpB,6BAAqB,KAAK,IAAI,GAAG,MAAM,IAAI,OAAK,EAAE,KAAK,MAAM,CAAC;AAAA,MAChE;AAAA,IACF;AAEA,UAAM,SAAS,kBAAkB,eAAe,eAAe,oBAAoB,IAAI,MAAM,EAAE,QAAQ,UAAU,SAAS,eAAe,IAAI,MAAM,EAAE,2BAA2B,kBAAkB;AAElM,WAAO;AAAA,MACL,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,gCACN,UAGoC;AACpC,QAAI,SAAS,oBAAoB;AAC/B,YAAM,UAAoB,KAAK,MAAM,SAAS,kBAAkB;AAChE,UAAI,QAAQ,SAAS,GAAG;AACtB,eAAO;AAAA,UACL,OAAO;AAAA,UACP,QAAQ,GAAG,QAAQ,MAAM,qBAAqB,QAAQ,WAAW,IAAI,MAAM,EAAE,+BAA+B,QAAQ,KAAK,IAAI,CAAC;AAAA,QAChI;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,IACV;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/export/vex.test.js

@@ -0,0 +1,278 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var import_vex = require("./vex");
+var import_database = require("../../db/database");
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var os = __toESM(require("os"));
+(0, import_vitest.describe)("VEXExporter", () => {
+  let db;
+  let tmpDir;
+  (0, import_vitest.beforeEach)(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "vex-test-"));
+    db = new import_database.GraphDatabase(tmpDir);
+    db.applySecuritySchema();
+  });
+  (0, import_vitest.afterEach)(() => {
+    db.close();
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+  function insertDependency(nodeId, ecosystem, packageName, version) {
+    const rawDb = db.getRawDb();
+    db.upsertNode({
+      id: nodeId,
+      kind: "dependency",
+      name: packageName,
+      qualifiedName: `${ecosystem}/${packageName}`,
+      filePath: "package.json",
+      language: "unknown",
+      startLine: 0,
+      endLine: 0,
+      startColumn: 0,
+      endColumn: 0,
+      updatedAt: Date.now()
+    });
+    rawDb.run(
+      `INSERT OR REPLACE INTO sec_dependencies
+        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
+       VALUES (?, ?, ?, ?, ?, 'production', '["package.json"]')`,
+      [nodeId, ecosystem, packageName, `^${version}`, version]
+    );
+  }
+  function insertVulnerability(vulnNodeId, cveId, depNodeId, severity = 7.5) {
+    const rawDb = db.getRawDb();
+    db.upsertNode({
+      id: vulnNodeId,
+      kind: "vulnerability",
+      name: cveId,
+      qualifiedName: cveId,
+      filePath: "",
+      language: "unknown",
+      startLine: 0,
+      endLine: 0,
+      startColumn: 0,
+      endColumn: 0,
+      updatedAt: Date.now()
+    });
+    rawDb.run(
+      `INSERT OR REPLACE INTO sec_vulnerabilities (node_id, cve_id, severity_score, affected_ranges, source_database)
+       VALUES (?, ?, ?, '[]', 'OSV')`,
+      [vulnNodeId, cveId, severity]
+    );
+    db.insertEdge({
+      source: depNodeId,
+      target: vulnNodeId,
+      kind: "has_vulnerability",
+      filePath: ""
+    });
+  }
+  function insertReachability(vulnNodeId, verdict, paths = null, unresolvedSymbols = null, entryPointCount = 0) {
+    const rawDb = db.getRawDb();
+    rawDb.run(
+      `INSERT INTO sec_reachability (vulnerability_node_id, verdict, paths, unresolved_symbols, reaching_entry_point_count, analyzed_at)
+       VALUES (?, ?, ?, ?, ?, ?)`,
+      [
+        vulnNodeId,
+        verdict,
+        paths ? JSON.stringify(paths) : null,
+        unresolvedSymbols ? JSON.stringify(unresolvedSymbols) : null,
+        entryPointCount,
+        Date.now()
+      ]
+    );
+  }
+  function insertImpact(vulnNodeId, layers, entryPoints, pathCount) {
+    const rawDb = db.getRawDb();
+    rawDb.run(
+      `INSERT INTO sec_impact (vulnerability_node_id, affected_layers, affected_entry_points, distinct_path_count, analyzed_at)
+       VALUES (?, ?, ?, ?, ?)`,
+      [vulnNodeId, JSON.stringify(layers), JSON.stringify(entryPoints), pathCount, Date.now()]
+    );
+  }
+  (0, import_vitest.describe)("export()", () => {
+    (0, import_vitest.it)("should produce valid CycloneDX 1.5 VEX with empty vulnerabilities when none exist", () => {
+      const exporter = new import_vex.VEXExporter(db, tmpDir);
+      const vex = exporter.export();
+      (0, import_vitest.expect)(vex.bomFormat).toBe("CycloneDX");
+      (0, import_vitest.expect)(vex.specVersion).toBe("1.5");
+      (0, import_vitest.expect)(vex.version).toBe(1);
+      (0, import_vitest.expect)(vex.metadata).toBeDefined();
+      (0, import_vitest.expect)(vex.vulnerabilities).toEqual([]);
+    });
+    (0, import_vitest.it)("should include correct metadata with tool name, version, and timestamp", () => {
+      const exporter = new import_vex.VEXExporter(db, "/projects/my-app");
+      const vex = exporter.export();
+      const meta = vex.metadata;
+      (0, import_vitest.expect)(meta.tools.components[0].name).toBe("kirograph-sec");
+      (0, import_vitest.expect)(meta.tools.components[0].version).toBe("0.1.0");
+      (0, import_vitest.expect)(meta.timestamp).toMatch(/^\d{4}-\d{2}-\d{2}T/);
+      (0, import_vitest.expect)(meta.component.name).toBe("my-app");
+    });
+    (0, import_vitest.it)('should map "affected" verdict correctly', () => {
+      insertDependency("dep-1", "npm", "lodash", "4.17.20");
+      insertVulnerability("vuln-1", "CVE-2021-23337", "dep-1", 9.8);
+      insertReachability(
+        "vuln-1",
+        "affected",
+        [
+          { entryPoint: "ep-1", path: ["ep-1", "mid-1", "dep-1"] },
+          { entryPoint: "ep-2", path: ["ep-2", "dep-1"] }
+        ],
+        null,
+        2
+      );
+      insertImpact("vuln-1", ["api", "service"], ["ep-1", "ep-2"], 2);
+      const exporter = new import_vex.VEXExporter(db, tmpDir);
+      const vex = exporter.export();
+      (0, import_vitest.expect)(vex.vulnerabilities).toHaveLength(1);
+      const v = vex.vulnerabilities[0];
+      (0, import_vitest.expect)(v.id).toBe("CVE-2021-23337");
+      (0, import_vitest.expect)(v.analysis?.state).toBe("affected");
+      (0, import_vitest.expect)(v.analysis?.detail).toContain("2 entry points");
+      (0, import_vitest.expect)(v.analysis?.detail).toContain("2 layers");
+      (0, import_vitest.expect)(v.analysis?.detail).toContain("Shortest path length: 2 nodes");
+      (0, import_vitest.expect)(v.affects).toEqual([{ ref: "pkg:npm/lodash@4.17.20" }]);
+      (0, import_vitest.expect)(v.ratings).toEqual([{ score: 9.8, method: "CVSSv31" }]);
+    });
+    (0, import_vitest.it)('should map "not_affected" verdict with justification "code_not_reachable"', () => {
+      insertDependency("dep-1", "npm", "express", "4.17.1");
+      insertVulnerability("vuln-1", "CVE-2022-24999", "dep-1", 5.3);
+      insertReachability("vuln-1", "not_affected", null, null, 0);
+      const exporter = new import_vex.VEXExporter(db, tmpDir);
+      const vex = exporter.export();
+      (0, import_vitest.expect)(vex.vulnerabilities).toHaveLength(1);
+      const v = vex.vulnerabilities[0];
+      (0, import_vitest.expect)(v.analysis?.state).toBe("not_affected");
+      (0, import_vitest.expect)(v.analysis?.justification).toBe("code_not_reachable");
+      (0, import_vitest.expect)(v.analysis?.detail).toContain("No reachable path found");
+    });
+    (0, import_vitest.it)('should map "under_investigation" verdict with unresolved symbols', () => {
+      insertDependency("dep-1", "pypi", "requests", "2.28.0");
+      insertVulnerability("vuln-1", "CVE-2023-32681", "dep-1", 6.1);
+      insertReachability(
+        "vuln-1",
+        "under_investigation",
+        null,
+        ["sym-unresolved-1", "sym-unresolved-2"],
+        0
+      );
+      const exporter = new import_vex.VEXExporter(db, tmpDir);
+      const vex = exporter.export();
+      (0, import_vitest.expect)(vex.vulnerabilities).toHaveLength(1);
+      const v = vex.vulnerabilities[0];
+      (0, import_vitest.expect)(v.analysis?.state).toBe("under_investigation");
+      (0, import_vitest.expect)(v.analysis?.detail).toContain("2 unresolved symbols");
+      (0, import_vitest.expect)(v.analysis?.detail).toContain("sym-unresolved-1");
+      (0, import_vitest.expect)(v.analysis?.detail).toContain("sym-unresolved-2");
+    });
+    (0, import_vitest.it)('should set "under_investigation" when no reachability analysis performed', () => {
+      insertDependency("dep-1", "cargo", "serde", "1.0.188");
+      insertVulnerability("vuln-1", "CVE-2024-00001", "dep-1", 4);
+      const exporter = new import_vex.VEXExporter(db, tmpDir);
+      const vex = exporter.export();
+      (0, import_vitest.expect)(vex.vulnerabilities).toHaveLength(1);
+      const v = vex.vulnerabilities[0];
+      (0, import_vitest.expect)(v.analysis?.state).toBe("under_investigation");
+      (0, import_vitest.expect)(v.analysis?.detail).toContain("has not yet been executed");
+    });
+    (0, import_vitest.it)("should handle multiple vulnerabilities", () => {
+      insertDependency("dep-1", "npm", "lodash", "4.17.20");
+      insertDependency("dep-2", "npm", "express", "4.17.1");
+      insertVulnerability("vuln-1", "CVE-2021-23337", "dep-1", 9.8);
+      insertVulnerability("vuln-2", "CVE-2022-24999", "dep-2", 5.3);
+      insertReachability(
+        "vuln-1",
+        "affected",
+        [{ entryPoint: "ep-1", path: ["ep-1", "dep-1"] }],
+        null,
+        1
+      );
+      insertReachability("vuln-2", "not_affected", null, null, 0);
+      const exporter = new import_vex.VEXExporter(db, tmpDir);
+      const vex = exporter.export();
+      (0, import_vitest.expect)(vex.vulnerabilities).toHaveLength(2);
+      const affected = vex.vulnerabilities.find((v) => v.id === "CVE-2021-23337");
+      const notAffected = vex.vulnerabilities.find((v) => v.id === "CVE-2022-24999");
+      (0, import_vitest.expect)(affected?.analysis?.state).toBe("affected");
+      (0, import_vitest.expect)(notAffected?.analysis?.state).toBe("not_affected");
+    });
+    (0, import_vitest.it)("should use declared_constraint as version when resolved_version is null", () => {
+      const rawDb = db.getRawDb();
+      db.upsertNode({
+        id: "dep-1",
+        kind: "dependency",
+        name: "axios",
+        qualifiedName: "npm/axios",
+        filePath: "package.json",
+        language: "unknown",
+        startLine: 0,
+        endLine: 0,
+        startColumn: 0,
+        endColumn: 0,
+        updatedAt: Date.now()
+      });
+      rawDb.run(
+        `INSERT OR REPLACE INTO sec_dependencies
+          (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
+         VALUES ('dep-1', 'npm', 'axios', '^1.0.0', NULL, 'production', '["package.json"]')`
+      );
+      insertVulnerability("vuln-1", "CVE-2023-45857", "dep-1", 6.5);
+      insertReachability("vuln-1", "not_affected", null, null, 0);
+      const exporter = new import_vex.VEXExporter(db, tmpDir);
+      const vex = exporter.export();
+      (0, import_vitest.expect)(vex.vulnerabilities[0].affects).toEqual([{ ref: "pkg:npm/axios@^1.0.0" }]);
+    });
+    (0, import_vitest.it)("should handle vulnerability with no severity score", () => {
+      insertDependency("dep-1", "go", "github.com/gin-gonic/gin", "1.9.1");
+      insertVulnerability("vuln-1", "CVE-2023-99999", "dep-1", null);
+      insertReachability("vuln-1", "not_affected", null, null, 0);
+      const exporter = new import_vex.VEXExporter(db, tmpDir);
+      const vex = exporter.export();
+      (0, import_vitest.expect)(vex.vulnerabilities[0].ratings).toBeUndefined();
+    });
+    (0, import_vitest.it)('should handle "under_investigation" with empty unresolved symbols', () => {
+      insertDependency("dep-1", "npm", "minimist", "1.2.5");
+      insertVulnerability("vuln-1", "CVE-2021-44906", "dep-1", 9.8);
+      insertReachability("vuln-1", "under_investigation", null, [], 0);
+      const exporter = new import_vex.VEXExporter(db, tmpDir);
+      const vex = exporter.export();
+      const v = vex.vulnerabilities[0];
+      (0, import_vitest.expect)(v.analysis?.state).toBe("under_investigation");
+      (0, import_vitest.expect)(v.analysis?.detail).toBe("Reachability analysis pending.");
+    });
+  });
+  (0, import_vitest.describe)("exportJSON()", () => {
+    (0, import_vitest.it)("should return pretty-printed JSON string", () => {
+      const exporter = new import_vex.VEXExporter(db, tmpDir);
+      const json = exporter.exportJSON();
+      (0, import_vitest.expect)(() => JSON.parse(json)).not.toThrow();
+      (0, import_vitest.expect)(json).toContain("\n");
+      const parsed = JSON.parse(json);
+      (0, import_vitest.expect)(parsed.bomFormat).toBe("CycloneDX");
+      (0, import_vitest.expect)(parsed.specVersion).toBe("1.5");
+    });
+  });
+});
+//# sourceMappingURL=vex.test.js.map

package/dist/security/export/vex.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/export/vex.test.ts"],
+  "sourcesContent": ["/**\n * Unit tests for VEXExporter\n *\n * Tests CycloneDX 1.5 VEX generation with various vulnerability/reachability scenarios.\n */\n\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport { VEXExporter } from './vex';\nimport { GraphDatabase } from '../../db/database';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\n\ndescribe('VEXExporter', () => {\n  let db: GraphDatabase;\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'vex-test-'));\n    db = new GraphDatabase(tmpDir);\n    db.applySecuritySchema();\n  });\n\n  afterEach(() => {\n    db.close();\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  /**\n   * Helper to insert a dependency node into the database.\n   */\n  function insertDependency(\n    nodeId: string,\n    ecosystem: string,\n    packageName: string,\n    version: string,\n  ): void {\n    const rawDb = db.getRawDb();\n\n    db.upsertNode({\n      id: nodeId,\n      kind: 'dependency',\n      name: packageName,\n      qualifiedName: `${ecosystem}/${packageName}`,\n      filePath: 'package.json',\n      language: 'unknown',\n      startLine: 0,\n      endLine: 0,\n      startColumn: 0,\n      endColumn: 0,\n      updatedAt: Date.now(),\n    });\n\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_dependencies\n        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n       VALUES (?, ?, ?, ?, ?, 'production', '[\"package.json\"]')`,\n      [nodeId, ecosystem, packageName, `^${version}`, version],\n    );\n  }\n\n  /**\n   * Helper to insert a vulnerability node linked to a dependency.\n   */\n  function insertVulnerability(\n    vulnNodeId: string,\n    cveId: string,\n    depNodeId: string,\n    severity: number | null = 7.5,\n  ): void {\n    const rawDb = db.getRawDb();\n\n    db.upsertNode({\n      id: vulnNodeId,\n      kind: 'vulnerability',\n      name: cveId,\n      qualifiedName: cveId,\n      filePath: '',\n      language: 'unknown',\n      startLine: 0,\n      endLine: 0,\n      startColumn: 0,\n      endColumn: 0,\n      updatedAt: Date.now(),\n    });\n\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_vulnerabilities (node_id, cve_id, severity_score, affected_ranges, source_database)\n       VALUES (?, ?, ?, '[]', 'OSV')`,\n      [vulnNodeId, cveId, severity],\n    );\n\n    db.insertEdge({\n      source: depNodeId,\n      target: vulnNodeId,\n      kind: 'has_vulnerability',\n      filePath: '',\n    });\n  }\n\n  /**\n   * Helper to insert a reachability result.\n   */\n  function insertReachability(\n    vulnNodeId: string,\n    verdict: string,\n    paths: any[] | null = null,\n    unresolvedSymbols: string[] | null = null,\n    entryPointCount: number = 0,\n  ): void {\n    const rawDb = db.getRawDb();\n    rawDb.run(\n      `INSERT INTO sec_reachability (vulnerability_node_id, verdict, paths, unresolved_symbols, reaching_entry_point_count, analyzed_at)\n       VALUES (?, ?, ?, ?, ?, ?)`,\n      [\n        vulnNodeId,\n        verdict,\n        paths ? JSON.stringify(paths) : null,\n        unresolvedSymbols ? JSON.stringify(unresolvedSymbols) : null,\n        entryPointCount,\n        Date.now(),\n      ],\n    );\n  }\n\n  /**\n   * Helper to insert an impact summary.\n   */\n  function insertImpact(\n    vulnNodeId: string,\n    layers: string[],\n    entryPoints: string[],\n    pathCount: number,\n  ): void {\n    const rawDb = db.getRawDb();\n    rawDb.run(\n      `INSERT INTO sec_impact (vulnerability_node_id, affected_layers, affected_entry_points, distinct_path_count, analyzed_at)\n       VALUES (?, ?, ?, ?, ?)`,\n      [vulnNodeId, JSON.stringify(layers), JSON.stringify(entryPoints), pathCount, Date.now()],\n    );\n  }\n\n  describe('export()', () => {\n    it('should produce valid CycloneDX 1.5 VEX with empty vulnerabilities when none exist', () => {\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.bomFormat).toBe('CycloneDX');\n      expect(vex.specVersion).toBe('1.5');\n      expect(vex.version).toBe(1);\n      expect(vex.metadata).toBeDefined();\n      expect(vex.vulnerabilities).toEqual([]);\n    });\n\n    it('should include correct metadata with tool name, version, and timestamp', () => {\n      const exporter = new VEXExporter(db, '/projects/my-app');\n      const vex = exporter.export();\n\n      const meta = vex.metadata as any;\n      expect(meta.tools.components[0].name).toBe('kirograph-sec');\n      expect(meta.tools.components[0].version).toBe('0.1.0');\n      expect(meta.timestamp).toMatch(/^\\d{4}-\\d{2}-\\d{2}T/);\n      expect(meta.component.name).toBe('my-app');\n    });\n\n    it('should map \"affected\" verdict correctly', () => {\n      insertDependency('dep-1', 'npm', 'lodash', '4.17.20');\n      insertVulnerability('vuln-1', 'CVE-2021-23337', 'dep-1', 9.8);\n      insertReachability(\n        'vuln-1',\n        'affected',\n        [\n          { entryPoint: 'ep-1', path: ['ep-1', 'mid-1', 'dep-1'] },\n          { entryPoint: 'ep-2', path: ['ep-2', 'dep-1'] },\n        ],\n        null,\n        2,\n      );\n      insertImpact('vuln-1', ['api', 'service'], ['ep-1', 'ep-2'], 2);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities).toHaveLength(1);\n      const v = vex.vulnerabilities[0];\n      expect(v.id).toBe('CVE-2021-23337');\n      expect(v.analysis?.state).toBe('affected');\n      expect(v.analysis?.detail).toContain('2 entry points');\n      expect(v.analysis?.detail).toContain('2 layers');\n      expect(v.analysis?.detail).toContain('Shortest path length: 2 nodes');\n      expect(v.affects).toEqual([{ ref: 'pkg:npm/lodash@4.17.20' }]);\n      expect(v.ratings).toEqual([{ score: 9.8, method: 'CVSSv31' }]);\n    });\n\n    it('should map \"not_affected\" verdict with justification \"code_not_reachable\"', () => {\n      insertDependency('dep-1', 'npm', 'express', '4.17.1');\n      insertVulnerability('vuln-1', 'CVE-2022-24999', 'dep-1', 5.3);\n      insertReachability('vuln-1', 'not_affected', null, null, 0);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities).toHaveLength(1);\n      const v = vex.vulnerabilities[0];\n      expect(v.analysis?.state).toBe('not_affected');\n      expect(v.analysis?.justification).toBe('code_not_reachable');\n      expect(v.analysis?.detail).toContain('No reachable path found');\n    });\n\n    it('should map \"under_investigation\" verdict with unresolved symbols', () => {\n      insertDependency('dep-1', 'pypi', 'requests', '2.28.0');\n      insertVulnerability('vuln-1', 'CVE-2023-32681', 'dep-1', 6.1);\n      insertReachability(\n        'vuln-1',\n        'under_investigation',\n        null,\n        ['sym-unresolved-1', 'sym-unresolved-2'],\n        0,\n      );\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities).toHaveLength(1);\n      const v = vex.vulnerabilities[0];\n      expect(v.analysis?.state).toBe('under_investigation');\n      expect(v.analysis?.detail).toContain('2 unresolved symbols');\n      expect(v.analysis?.detail).toContain('sym-unresolved-1');\n      expect(v.analysis?.detail).toContain('sym-unresolved-2');\n    });\n\n    it('should set \"under_investigation\" when no reachability analysis performed', () => {\n      insertDependency('dep-1', 'cargo', 'serde', '1.0.188');\n      insertVulnerability('vuln-1', 'CVE-2024-00001', 'dep-1', 4.0);\n      // No reachability row inserted\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities).toHaveLength(1);\n      const v = vex.vulnerabilities[0];\n      expect(v.analysis?.state).toBe('under_investigation');\n      expect(v.analysis?.detail).toContain('has not yet been executed');\n    });\n\n    it('should handle multiple vulnerabilities', () => {\n      insertDependency('dep-1', 'npm', 'lodash', '4.17.20');\n      insertDependency('dep-2', 'npm', 'express', '4.17.1');\n\n      insertVulnerability('vuln-1', 'CVE-2021-23337', 'dep-1', 9.8);\n      insertVulnerability('vuln-2', 'CVE-2022-24999', 'dep-2', 5.3);\n\n      insertReachability(\n        'vuln-1',\n        'affected',\n        [{ entryPoint: 'ep-1', path: ['ep-1', 'dep-1'] }],\n        null,\n        1,\n      );\n      insertReachability('vuln-2', 'not_affected', null, null, 0);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities).toHaveLength(2);\n      const affected = vex.vulnerabilities.find(v => v.id === 'CVE-2021-23337');\n      const notAffected = vex.vulnerabilities.find(v => v.id === 'CVE-2022-24999');\n      expect(affected?.analysis?.state).toBe('affected');\n      expect(notAffected?.analysis?.state).toBe('not_affected');\n    });\n\n    it('should use declared_constraint as version when resolved_version is null', () => {\n      const rawDb = db.getRawDb();\n\n      db.upsertNode({\n        id: 'dep-1',\n        kind: 'dependency',\n        name: 'axios',\n        qualifiedName: 'npm/axios',\n        filePath: 'package.json',\n        language: 'unknown',\n        startLine: 0,\n        endLine: 0,\n        startColumn: 0,\n        endColumn: 0,\n        updatedAt: Date.now(),\n      });\n\n      rawDb.run(\n        `INSERT OR REPLACE INTO sec_dependencies\n          (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n         VALUES ('dep-1', 'npm', 'axios', '^1.0.0', NULL, 'production', '[\"package.json\"]')`,\n      );\n      insertVulnerability('vuln-1', 'CVE-2023-45857', 'dep-1', 6.5);\n      insertReachability('vuln-1', 'not_affected', null, null, 0);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities[0].affects).toEqual([{ ref: 'pkg:npm/axios@^1.0.0' }]);\n    });\n\n    it('should handle vulnerability with no severity score', () => {\n      insertDependency('dep-1', 'go', 'github.com/gin-gonic/gin', '1.9.1');\n      insertVulnerability('vuln-1', 'CVE-2023-99999', 'dep-1', null);\n      insertReachability('vuln-1', 'not_affected', null, null, 0);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities[0].ratings).toBeUndefined();\n    });\n\n    it('should handle \"under_investigation\" with empty unresolved symbols', () => {\n      insertDependency('dep-1', 'npm', 'minimist', '1.2.5');\n      insertVulnerability('vuln-1', 'CVE-2021-44906', 'dep-1', 9.8);\n      insertReachability('vuln-1', 'under_investigation', null, [], 0);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      const v = vex.vulnerabilities[0];\n      expect(v.analysis?.state).toBe('under_investigation');\n      expect(v.analysis?.detail).toBe('Reachability analysis pending.');\n    });\n  });\n\n  describe('exportJSON()', () => {\n    it('should return pretty-printed JSON string', () => {\n      const exporter = new VEXExporter(db, tmpDir);\n      const json = exporter.exportJSON();\n\n      expect(() => JSON.parse(json)).not.toThrow();\n      // Pretty-printed means it contains newlines\n      expect(json).toContain('\\n');\n\n      const parsed = JSON.parse(json);\n      expect(parsed.bomFormat).toBe('CycloneDX');\n      expect(parsed.specVersion).toBe('1.5');\n    });\n  });\n});\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAMA,oBAA4D;AAC5D,iBAA4B;AAC5B,sBAA8B;AAC9B,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AAAA,IAEpB,wBAAS,eAAe,MAAM;AAC5B,MAAI;AACJ,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,WAAW,CAAC;AAC3D,SAAK,IAAI,8BAAc,MAAM;AAC7B,OAAG,oBAAoB;AAAA,EACzB,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,MAAM;AACT,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAKD,WAAS,iBACP,QACA,WACA,aACA,SACM;AACN,UAAM,QAAQ,GAAG,SAAS;AAE1B,OAAG,WAAW;AAAA,MACZ,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,eAAe,GAAG,SAAS,IAAI,WAAW;AAAA,MAC1C,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AAED,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,QAAQ,WAAW,aAAa,IAAI,OAAO,IAAI,OAAO;AAAA,IACzD;AAAA,EACF;AAKA,WAAS,oBACP,YACA,OACA,WACA,WAA0B,KACpB;AACN,UAAM,QAAQ,GAAG,SAAS;AAE1B,OAAG,WAAW;AAAA,MACZ,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,eAAe;AAAA,MACf,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AAED,UAAM;AAAA,MACJ;AAAA;AAAA,MAEA,CAAC,YAAY,OAAO,QAAQ;AAAA,IAC9B;AAEA,OAAG,WAAW;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAKA,WAAS,mBACP,YACA,SACA,QAAsB,MACtB,oBAAqC,MACrC,kBAA0B,GACpB;AACN,UAAM,QAAQ,GAAG,SAAS;AAC1B,UAAM;AAAA,MACJ;AAAA;AAAA,MAEA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,UAAU,KAAK,IAAI;AAAA,QAChC,oBAAoB,KAAK,UAAU,iBAAiB,IAAI;AAAA,QACxD;AAAA,QACA,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAKA,WAAS,aACP,YACA,QACA,aACA,WACM;AACN,UAAM,QAAQ,GAAG,SAAS;AAC1B,UAAM;AAAA,MACJ;AAAA;AAAA,MAEA,CAAC,YAAY,KAAK,UAAU,MAAM,GAAG,KAAK,UAAU,WAAW,GAAG,WAAW,KAAK,IAAI,CAAC;AAAA,IACzF;AAAA,EACF;AAEA,8BAAS,YAAY,MAAM;AACzB,0BAAG,qFAAqF,MAAM;AAC5F,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,SAAS,EAAE,KAAK,WAAW;AACtC,gCAAO,IAAI,WAAW,EAAE,KAAK,KAAK;AAClC,gCAAO,IAAI,OAAO,EAAE,KAAK,CAAC;AAC1B,gCAAO,IAAI,QAAQ,EAAE,YAAY;AACjC,gCAAO,IAAI,eAAe,EAAE,QAAQ,CAAC,CAAC;AAAA,IACxC,CAAC;AAED,0BAAG,0EAA0E,MAAM;AACjF,YAAM,WAAW,IAAI,uBAAY,IAAI,kBAAkB;AACvD,YAAM,MAAM,SAAS,OAAO;AAE5B,YAAM,OAAO,IAAI;AACjB,gCAAO,KAAK,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,eAAe;AAC1D,gCAAO,KAAK,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO;AACrD,gCAAO,KAAK,SAAS,EAAE,QAAQ,qBAAqB;AACpD,gCAAO,KAAK,UAAU,IAAI,EAAE,KAAK,QAAQ;AAAA,IAC3C,CAAC;AAED,0BAAG,2CAA2C,MAAM;AAClD,uBAAiB,SAAS,OAAO,UAAU,SAAS;AACpD,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,EAAE,YAAY,QAAQ,MAAM,CAAC,QAAQ,SAAS,OAAO,EAAE;AAAA,UACvD,EAAE,YAAY,QAAQ,MAAM,CAAC,QAAQ,OAAO,EAAE;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,mBAAa,UAAU,CAAC,OAAO,SAAS,GAAG,CAAC,QAAQ,MAAM,GAAG,CAAC;AAE9D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,eAAe,EAAE,aAAa,CAAC;AAC1C,YAAM,IAAI,IAAI,gBAAgB,CAAC;AAC/B,gCAAO,EAAE,EAAE,EAAE,KAAK,gBAAgB;AAClC,gCAAO,EAAE,UAAU,KAAK,EAAE,KAAK,UAAU;AACzC,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,gBAAgB;AACrD,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,UAAU;AAC/C,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,+BAA+B;AACpE,gCAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,KAAK,yBAAyB,CAAC,CAAC;AAC7D,gCAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC/D,CAAC;AAED,0BAAG,6EAA6E,MAAM;AACpF,uBAAiB,SAAS,OAAO,WAAW,QAAQ;AACpD,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D,yBAAmB,UAAU,gBAAgB,MAAM,MAAM,CAAC;AAE1D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,eAAe,EAAE,aAAa,CAAC;AAC1C,YAAM,IAAI,IAAI,gBAAgB,CAAC;AAC/B,gCAAO,EAAE,UAAU,KAAK,EAAE,KAAK,cAAc;AAC7C,gCAAO,EAAE,UAAU,aAAa,EAAE,KAAK,oBAAoB;AAC3D,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,yBAAyB;AAAA,IAChE,CAAC;AAED,0BAAG,oEAAoE,MAAM;AAC3E,uBAAiB,SAAS,QAAQ,YAAY,QAAQ;AACtD,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAC,oBAAoB,kBAAkB;AAAA,QACvC;AAAA,MACF;AAEA,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,eAAe,EAAE,aAAa,CAAC;AAC1C,YAAM,IAAI,IAAI,gBAAgB,CAAC;AAC/B,gCAAO,EAAE,UAAU,KAAK,EAAE,KAAK,qBAAqB;AACpD,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,sBAAsB;AAC3D,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,kBAAkB;AACvD,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,kBAAkB;AAAA,IACzD,CAAC;AAED,0BAAG,4EAA4E,MAAM;AACnF,uBAAiB,SAAS,SAAS,SAAS,SAAS;AACrD,0BAAoB,UAAU,kBAAkB,SAAS,CAAG;AAG5D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,eAAe,EAAE,aAAa,CAAC;AAC1C,YAAM,IAAI,IAAI,gBAAgB,CAAC;AAC/B,gCAAO,EAAE,UAAU,KAAK,EAAE,KAAK,qBAAqB;AACpD,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,2BAA2B;AAAA,IAClE,CAAC;AAED,0BAAG,0CAA0C,MAAM;AACjD,uBAAiB,SAAS,OAAO,UAAU,SAAS;AACpD,uBAAiB,SAAS,OAAO,WAAW,QAAQ;AAEpD,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAE5D;AAAA,QACE;AAAA,QACA;AAAA,QACA,CAAC,EAAE,YAAY,QAAQ,MAAM,CAAC,QAAQ,OAAO,EAAE,CAAC;AAAA,QAChD;AAAA,QACA;AAAA,MACF;AACA,yBAAmB,UAAU,gBAAgB,MAAM,MAAM,CAAC;AAE1D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,eAAe,EAAE,aAAa,CAAC;AAC1C,YAAM,WAAW,IAAI,gBAAgB,KAAK,OAAK,EAAE,OAAO,gBAAgB;AACxE,YAAM,cAAc,IAAI,gBAAgB,KAAK,OAAK,EAAE,OAAO,gBAAgB;AAC3E,gCAAO,UAAU,UAAU,KAAK,EAAE,KAAK,UAAU;AACjD,gCAAO,aAAa,UAAU,KAAK,EAAE,KAAK,cAAc;AAAA,IAC1D,CAAC;AAED,0BAAG,2EAA2E,MAAM;AAClF,YAAM,QAAQ,GAAG,SAAS;AAE1B,SAAG,WAAW;AAAA,QACZ,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,QACN,eAAe;AAAA,QACf,UAAU;AAAA,QACV,UAAU;AAAA,QACV,WAAW;AAAA,QACX,SAAS;AAAA,QACT,aAAa;AAAA,QACb,WAAW;AAAA,QACX,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAED,YAAM;AAAA,QACJ;AAAA;AAAA;AAAA,MAGF;AACA,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D,yBAAmB,UAAU,gBAAgB,MAAM,MAAM,CAAC;AAE1D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,KAAK,uBAAuB,CAAC,CAAC;AAAA,IAClF,CAAC;AAED,0BAAG,sDAAsD,MAAM;AAC7D,uBAAiB,SAAS,MAAM,4BAA4B,OAAO;AACnE,0BAAoB,UAAU,kBAAkB,SAAS,IAAI;AAC7D,yBAAmB,UAAU,gBAAgB,MAAM,MAAM,CAAC;AAE1D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,cAAc;AAAA,IACvD,CAAC;AAED,0BAAG,qEAAqE,MAAM;AAC5E,uBAAiB,SAAS,OAAO,YAAY,OAAO;AACpD,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D,yBAAmB,UAAU,uBAAuB,MAAM,CAAC,GAAG,CAAC;AAE/D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,YAAM,IAAI,IAAI,gBAAgB,CAAC;AAC/B,gCAAO,EAAE,UAAU,KAAK,EAAE,KAAK,qBAAqB;AACpD,gCAAO,EAAE,UAAU,MAAM,EAAE,KAAK,gCAAgC;AAAA,IAClE,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,gBAAgB,MAAM;AAC7B,0BAAG,4CAA4C,MAAM;AACnD,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,OAAO,SAAS,WAAW;AAEjC,gCAAO,MAAM,KAAK,MAAM,IAAI,CAAC,EAAE,IAAI,QAAQ;AAE3C,gCAAO,IAAI,EAAE,UAAU,IAAI;AAE3B,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,gCAAO,OAAO,SAAS,EAAE,KAAK,WAAW;AACzC,gCAAO,OAAO,WAAW,EAAE,KAAK,KAAK;AAAA,IACvC,CAAC;AAAA,EACH,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/security/index.js

@@ -0,0 +1,67 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var security_exports = {};
+__export(security_exports, {
+  DependencyGraphIntegrator: () => import_integrator.DependencyGraphIntegrator,
+  ManifestParseError: () => import_errors.ManifestParseError,
+  ManifestParser: () => import_parser.ManifestParser,
+  OsvAdapter: () => import_osv_adapter.OsvAdapter,
+  ReachabilityAnalyzer: () => import_reachability.ReachabilityAnalyzer,
+  SBOMExporter: () => import_sbom.SBOMExporter,
+  SecurityError: () => import_errors.SecurityError,
+  SecurityPipeline: () => import_pipeline.SecurityPipeline,
+  VEXExporter: () => import_vex.VEXExporter,
+  VulnDatabaseError: () => import_errors.VulnDatabaseError,
+  VulnerabilityDatabaseClient: () => import_client.VulnerabilityDatabaseClient,
+  buildFixSuggestion: () => import_fix_suggestions.buildFixSuggestion,
+  formatFixSuggestion: () => import_fix_suggestions.formatFixSuggestion,
+  formatSecurityWarnings: () => import_context_warnings.formatSecurityWarnings,
+  getSecurityWarningsForNodes: () => import_context_warnings.getSecurityWarningsForNodes
+});
+module.exports = __toCommonJS(security_exports);
+var import_pipeline = require("./pipeline");
+var import_parser = require("./manifest/parser");
+var import_integrator = require("./integrator");
+var import_client = require("./vuln/client");
+var import_osv_adapter = require("./vuln/osv-adapter");
+var import_reachability = require("./reachability");
+var import_sbom = require("./export/sbom");
+var import_vex = require("./export/vex");
+var import_fix_suggestions = require("./export/fix-suggestions");
+var import_context_warnings = require("./context-warnings");
+var import_errors = require("./errors");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DependencyGraphIntegrator,
+  ManifestParseError,
+  ManifestParser,
+  OsvAdapter,
+  ReachabilityAnalyzer,
+  SBOMExporter,
+  SecurityError,
+  SecurityPipeline,
+  VEXExporter,
+  VulnDatabaseError,
+  VulnerabilityDatabaseClient,
+  buildFixSuggestion,
+  formatFixSuggestion,
+  formatSecurityWarnings,
+  getSecurityWarningsForNodes
+});
+//# sourceMappingURL=index.js.map