kirograph 0.16.1 → 0.19.0

package/dist/security/reachability.test.js

@@ -0,0 +1,394 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var os = __toESM(require("os"));
+var import_reachability = require("./reachability");
+var import_database = require("../db/database");
+var import_config = require("../config");
+(0, import_vitest.describe)("ReachabilityAnalyzer", () => {
+  let db;
+  let config;
+  let analyzer;
+  let tmpDir;
+  (0, import_vitest.beforeEach)(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "kirograph-reachability-test-"));
+    db = new import_database.GraphDatabase(tmpDir);
+    db.applySecuritySchema();
+    config = (0, import_config.createDefaultConfig)();
+    config.enableArchitecture = true;
+    config.enableSecurity = true;
+    analyzer = new import_reachability.ReachabilityAnalyzer(db, config);
+  });
+  (0, import_vitest.afterEach)(() => {
+    db.close();
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+  function createNode(id, kind, opts) {
+    const node = {
+      id,
+      kind,
+      name: opts?.name ?? id,
+      qualifiedName: opts?.qualifiedName ?? id,
+      filePath: opts?.filePath ?? `src/${id}.ts`,
+      language: "typescript",
+      startLine: 0,
+      endLine: 0,
+      startColumn: 0,
+      endColumn: 0,
+      isExported: opts?.isExported ?? false,
+      updatedAt: Date.now()
+    };
+    db.upsertNode(node);
+  }
+  function createEdge(source, target, kind) {
+    db.insertEdge({ source, target, kind });
+  }
+  function createDependencyNode(name) {
+    const nodeId = `dep:npm:${name}`;
+    createNode(nodeId, "dependency", { name });
+    const rawDb = db.getRawDb();
+    rawDb.run(
+      `INSERT OR REPLACE INTO sec_dependencies
+        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      [nodeId, "npm", name, "^1.0.0", "1.0.0", "production", '["package.json"]']
+    );
+    return nodeId;
+  }
+  function createVulnerabilityNode(cveId, depNodeId) {
+    const nodeId = `vuln:${cveId}`;
+    createNode(nodeId, "vulnerability", { name: cveId });
+    const rawDb = db.getRawDb();
+    rawDb.run(
+      `INSERT OR REPLACE INTO sec_vulnerabilities
+        (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      [nodeId, cveId, 7.5, "[]", "1.0.1", "Test vulnerability", "OSV"]
+    );
+    createEdge(depNodeId, nodeId, "has_vulnerability");
+    return nodeId;
+  }
+  function createEntryPoint(id, kind = "route") {
+    createNode(id, kind, { isExported: true });
+  }
+  function assignLayer(filePath, layerId) {
+    const rawDb = db.getRawDb();
+    rawDb.run(
+      `INSERT OR IGNORE INTO arch_layers (id, name, source, patterns, updated_at)
+       VALUES (?, ?, 'auto', '[]', ?)`,
+      [layerId, layerId, Date.now()]
+    );
+    rawDb.run(
+      `INSERT OR REPLACE INTO arch_file_layers (file_path, layer_id, confidence, matched_pattern)
+       VALUES (?, ?, 1.0, '**')`,
+      [filePath, layerId]
+    );
+  }
+  (0, import_vitest.describe)("analyze() - core reachability", () => {
+    (0, import_vitest.it)("should return affected when a path exists from entry point to dependency", async () => {
+      createEntryPoint("ep1");
+      createNode("mid1", "function");
+      const depId = createDependencyNode("vulnerable-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-001", depId);
+      createEdge("ep1", "mid1", "calls");
+      createEdge("mid1", depId, "imports");
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("affected");
+      (0, import_vitest.expect)(result.paths.length).toBe(1);
+      (0, import_vitest.expect)(result.paths[0].entryPoint).toBe("ep1");
+      (0, import_vitest.expect)(result.paths[0].path).toEqual(["ep1", "mid1", depId]);
+      (0, import_vitest.expect)(result.reachingEntryPointCount).toBe(1);
+    });
+    (0, import_vitest.it)("should return not_affected when no path exists", async () => {
+      createEntryPoint("ep1");
+      createNode("mid1", "function");
+      const depId = createDependencyNode("isolated-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-002", depId);
+      createEdge("ep1", "mid1", "calls");
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("not_affected");
+      (0, import_vitest.expect)(result.paths.length).toBe(0);
+      (0, import_vitest.expect)(result.reachingEntryPointCount).toBe(0);
+    });
+    (0, import_vitest.it)("should return under_investigation when unresolved imports are encountered", async () => {
+      createEntryPoint("ep1");
+      createNode("unresolved1", "import");
+      const depId = createDependencyNode("maybe-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-003", depId);
+      createEdge("ep1", "unresolved1", "imports");
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("under_investigation");
+      (0, import_vitest.expect)(result.unresolvedSymbols).toContain("unresolved1");
+      (0, import_vitest.expect)(result.paths.length).toBe(0);
+    });
+    (0, import_vitest.it)("should handle cycles without infinite loops", async () => {
+      createEntryPoint("ep1");
+      createNode("nodeA", "function");
+      createNode("nodeB", "function");
+      const depId = createDependencyNode("unreachable-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-004", depId);
+      createEdge("ep1", "nodeA", "calls");
+      createEdge("nodeA", "nodeB", "calls");
+      createEdge("nodeB", "nodeA", "calls");
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("not_affected");
+      (0, import_vitest.expect)(result.paths.length).toBe(0);
+    });
+    (0, import_vitest.it)("should visit each node at most once", async () => {
+      createEntryPoint("ep1");
+      createNode("nodeA", "function");
+      createNode("nodeB", "function");
+      const depId = createDependencyNode("shared-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-005", depId);
+      createEdge("ep1", "nodeA", "calls");
+      createEdge("ep1", "nodeB", "calls");
+      createEdge("nodeA", depId, "imports");
+      createEdge("nodeB", "nodeA", "calls");
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("affected");
+      (0, import_vitest.expect)(result.paths[0].path).toEqual(["ep1", "nodeA", depId]);
+    });
+    (0, import_vitest.it)("should traverse calls, imports, and references edges", async () => {
+      createEntryPoint("ep1");
+      createNode("mid1", "function");
+      createNode("mid2", "class");
+      const depId = createDependencyNode("ref-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-006", depId);
+      createEdge("ep1", "mid1", "calls");
+      createEdge("mid1", "mid2", "references");
+      createEdge("mid2", depId, "imports");
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("affected");
+      (0, import_vitest.expect)(result.paths[0].path).toEqual(["ep1", "mid1", "mid2", depId]);
+    });
+    (0, import_vitest.it)("should return under_investigation when no dependency is linked", async () => {
+      const vulnId = "vuln:CVE-2023-orphan";
+      createNode(vulnId, "vulnerability", { name: "CVE-2023-orphan" });
+      const rawDb = db.getRawDb();
+      rawDb.run(
+        `INSERT OR REPLACE INTO sec_vulnerabilities
+          (node_id, cve_id, severity_score, affected_ranges, summary, source_database)
+         VALUES (?, ?, ?, ?, ?, ?)`,
+        [vulnId, "CVE-2023-orphan", 5, "[]", "Orphan vuln", "OSV"]
+      );
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("under_investigation");
+    });
+    (0, import_vitest.it)("should return not_affected when no entry points exist", async () => {
+      const depId = createDependencyNode("no-ep-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-007", depId);
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("not_affected");
+    });
+    (0, import_vitest.it)("should limit unresolved symbols to 50", async () => {
+      createEntryPoint("ep1");
+      const depId = createDependencyNode("many-unresolved-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-008", depId);
+      for (let i = 0; i < 60; i++) {
+        const importId = `unresolved-import-${i}`;
+        createNode(importId, "import");
+        createEdge("ep1", importId, "imports");
+      }
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("under_investigation");
+      (0, import_vitest.expect)(result.unresolvedSymbols.length).toBeLessThanOrEqual(50);
+    });
+    (0, import_vitest.it)("should store result in sec_reachability table", async () => {
+      createEntryPoint("ep1");
+      const depId = createDependencyNode("stored-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-009", depId);
+      createEdge("ep1", depId, "imports");
+      await analyzer.analyze(vulnId);
+      const rawDb = db.getRawDb();
+      const row = rawDb.get(
+        `SELECT * FROM sec_reachability WHERE vulnerability_node_id = ?`,
+        [vulnId]
+      );
+      (0, import_vitest.expect)(row).not.toBeNull();
+      (0, import_vitest.expect)(row.verdict).toBe("affected");
+      (0, import_vitest.expect)(row.reaching_entry_point_count).toBe(1);
+    });
+  });
+  (0, import_vitest.describe)("analyze() - multi-entry-point paths", () => {
+    (0, import_vitest.it)("should record shortest path from each reaching entry point", async () => {
+      createEntryPoint("ep1");
+      createEntryPoint("ep2");
+      createNode("mid1", "function");
+      createNode("mid2", "function");
+      const depId = createDependencyNode("multi-ep-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-010", depId);
+      createEdge("ep1", "mid1", "calls");
+      createEdge("mid1", depId, "imports");
+      createEdge("ep2", depId, "imports");
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("affected");
+      (0, import_vitest.expect)(result.reachingEntryPointCount).toBe(2);
+      (0, import_vitest.expect)(result.paths.length).toBe(2);
+      const ep1Path = result.paths.find((p) => p.entryPoint === "ep1");
+      const ep2Path = result.paths.find((p) => p.entryPoint === "ep2");
+      (0, import_vitest.expect)(ep1Path).toBeDefined();
+      (0, import_vitest.expect)(ep1Path.path).toEqual(["ep1", "mid1", depId]);
+      (0, import_vitest.expect)(ep2Path).toBeDefined();
+      (0, import_vitest.expect)(ep2Path.path).toEqual(["ep2", depId]);
+    });
+    (0, import_vitest.it)("should include total count of reaching entry points", async () => {
+      const depId = createDependencyNode("counted-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-011", depId);
+      for (let i = 0; i < 5; i++) {
+        createEntryPoint(`ep${i}`);
+        if (i < 3) {
+          createEdge(`ep${i}`, depId, "imports");
+        }
+      }
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("affected");
+      (0, import_vitest.expect)(result.reachingEntryPointCount).toBe(3);
+      (0, import_vitest.expect)(result.paths.length).toBe(3);
+    });
+    (0, import_vitest.it)("should handle exported functions as entry points", async () => {
+      createEntryPoint("exported-fn", "function");
+      const depId = createDependencyNode("fn-ep-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-012", depId);
+      createEdge("exported-fn", depId, "references");
+      const result = await analyzer.analyze(vulnId);
+      (0, import_vitest.expect)(result.verdict).toBe("affected");
+      (0, import_vitest.expect)(result.paths[0].entryPoint).toBe("exported-fn");
+    });
+  });
+  (0, import_vitest.describe)("getImpactSummary()", () => {
+    (0, import_vitest.it)("should return null for non-affected vulnerabilities", async () => {
+      createEntryPoint("ep1");
+      const depId = createDependencyNode("not-affected-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-020", depId);
+      await analyzer.analyze(vulnId);
+      const summary = await analyzer.getImpactSummary(vulnId);
+      (0, import_vitest.expect)(summary).toBeNull();
+    });
+    (0, import_vitest.it)("should identify affected layers on reachable paths", async () => {
+      createEntryPoint("ep1");
+      createNode("mid1", "function", { filePath: "src/api/handler.ts" });
+      createNode("mid2", "function", { filePath: "src/service/logic.ts" });
+      const depId = createDependencyNode("layered-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-021", depId);
+      createEdge("ep1", "mid1", "calls");
+      createEdge("mid1", "mid2", "calls");
+      createEdge("mid2", depId, "imports");
+      assignLayer("src/api/handler.ts", "api");
+      assignLayer("src/service/logic.ts", "service");
+      await analyzer.analyze(vulnId);
+      const summary = await analyzer.getImpactSummary(vulnId);
+      (0, import_vitest.expect)(summary).not.toBeNull();
+      (0, import_vitest.expect)(summary.affectedLayers).toContain("api");
+      (0, import_vitest.expect)(summary.affectedLayers).toContain("service");
+    });
+    (0, import_vitest.it)("should identify all affected entry points", async () => {
+      createEntryPoint("ep1");
+      createEntryPoint("ep2");
+      const depId = createDependencyNode("multi-ep-impact-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-022", depId);
+      createEdge("ep1", depId, "imports");
+      createEdge("ep2", depId, "imports");
+      await analyzer.analyze(vulnId);
+      const summary = await analyzer.getImpactSummary(vulnId);
+      (0, import_vitest.expect)(summary).not.toBeNull();
+      (0, import_vitest.expect)(summary.affectedEntryPoints).toContain("ep1");
+      (0, import_vitest.expect)(summary.affectedEntryPoints).toContain("ep2");
+    });
+    (0, import_vitest.it)("should cap distinct path count at 100", async () => {
+      const depId = createDependencyNode("many-paths-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-023", depId);
+      for (let i = 0; i < 110; i++) {
+        createEntryPoint(`ep${i}`);
+        createEdge(`ep${i}`, depId, "imports");
+      }
+      await analyzer.analyze(vulnId);
+      const summary = await analyzer.getImpactSummary(vulnId);
+      (0, import_vitest.expect)(summary).not.toBeNull();
+      (0, import_vitest.expect)(summary.distinctPathCount).toBeLessThanOrEqual(100);
+    });
+    (0, import_vitest.it)("should classify symbols with no assigned layer as unclassified", async () => {
+      createEntryPoint("ep1");
+      createNode("mid1", "function", { filePath: "src/unknown/file.ts" });
+      const depId = createDependencyNode("unclassified-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-024", depId);
+      createEdge("ep1", "mid1", "calls");
+      createEdge("mid1", depId, "imports");
+      await analyzer.analyze(vulnId);
+      const summary = await analyzer.getImpactSummary(vulnId);
+      (0, import_vitest.expect)(summary).not.toBeNull();
+      (0, import_vitest.expect)(summary.affectedLayers).toContain("unclassified");
+    });
+    (0, import_vitest.it)("should omit layer classification when enableArchitecture is false", async () => {
+      config.enableArchitecture = false;
+      analyzer = new import_reachability.ReachabilityAnalyzer(db, config);
+      createEntryPoint("ep1");
+      createNode("mid1", "function", { filePath: "src/api/handler.ts" });
+      const depId = createDependencyNode("no-arch-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-025", depId);
+      createEdge("ep1", "mid1", "calls");
+      createEdge("mid1", depId, "imports");
+      assignLayer("src/api/handler.ts", "api");
+      await analyzer.analyze(vulnId);
+      const summary = await analyzer.getImpactSummary(vulnId);
+      (0, import_vitest.expect)(summary).not.toBeNull();
+      (0, import_vitest.expect)(summary.affectedLayers).toEqual([]);
+    });
+    (0, import_vitest.it)("should store impact summary in sec_impact table", async () => {
+      createEntryPoint("ep1");
+      const depId = createDependencyNode("stored-impact-pkg");
+      const vulnId = createVulnerabilityNode("CVE-2023-026", depId);
+      createEdge("ep1", depId, "imports");
+      await analyzer.analyze(vulnId);
+      await analyzer.getImpactSummary(vulnId);
+      const rawDb = db.getRawDb();
+      const row = rawDb.get(
+        `SELECT * FROM sec_impact WHERE vulnerability_node_id = ?`,
+        [vulnId]
+      );
+      (0, import_vitest.expect)(row).not.toBeNull();
+      (0, import_vitest.expect)(row.distinct_path_count).toBeGreaterThan(0);
+    });
+  });
+  (0, import_vitest.describe)("analyzeAll()", () => {
+    (0, import_vitest.it)("should analyze all vulnerability nodes", async () => {
+      createEntryPoint("ep1");
+      const dep1 = createDependencyNode("pkg1");
+      const dep2 = createDependencyNode("pkg2");
+      const vuln1 = createVulnerabilityNode("CVE-2023-030", dep1);
+      const vuln2 = createVulnerabilityNode("CVE-2023-031", dep2);
+      createEdge("ep1", dep1, "imports");
+      const results = await analyzer.analyzeAll();
+      (0, import_vitest.expect)(results.size).toBe(2);
+      (0, import_vitest.expect)(results.get(vuln1).verdict).toBe("affected");
+      (0, import_vitest.expect)(results.get(vuln2).verdict).toBe("not_affected");
+    });
+    (0, import_vitest.it)("should return empty map when no vulnerabilities exist", async () => {
+      const results = await analyzer.analyzeAll();
+      (0, import_vitest.expect)(results.size).toBe(0);
+    });
+  });
+});
+//# sourceMappingURL=reachability.test.js.map

package/dist/security/reachability.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/reachability.test.ts"],
+  "sourcesContent": ["/**\n * Tests for ReachabilityAnalyzer\n *\n * Verifies BFS traversal, verdict assignment, multi-entry-point path recording,\n * and impact analysis with architecture context.\n *\n * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6, 5.1, 5.2, 5.3, 5.4, 5.5\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { ReachabilityAnalyzer } from './reachability';\nimport { GraphDatabase } from '../db/database';\nimport { createDefaultConfig, type KiroGraphConfig } from '../config';\nimport type { Node, Edge } from '../types';\n\ndescribe('ReachabilityAnalyzer', () => {\n  let db: GraphDatabase;\n  let config: KiroGraphConfig;\n  let analyzer: ReachabilityAnalyzer;\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kirograph-reachability-test-'));\n    db = new GraphDatabase(tmpDir);\n    db.applySecuritySchema();\n    config = createDefaultConfig();\n    config.enableArchitecture = true;\n    config.enableSecurity = true;\n    analyzer = new ReachabilityAnalyzer(db, config);\n  });\n\n  afterEach(() => {\n    db.close();\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  // \u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  function createNode(id: string, kind: Node['kind'], opts?: Partial<Node>): void {\n    const node: Node = {\n      id,\n      kind,\n      name: opts?.name ?? id,\n      qualifiedName: opts?.qualifiedName ?? id,\n      filePath: opts?.filePath ?? `src/${id}.ts`,\n      language: 'typescript',\n      startLine: 0,\n      endLine: 0,\n      startColumn: 0,\n      endColumn: 0,\n      isExported: opts?.isExported ?? false,\n      updatedAt: Date.now(),\n    };\n    db.upsertNode(node);\n  }\n\n  function createEdge(source: string, target: string, kind: Edge['kind']): void {\n    db.insertEdge({ source, target, kind });\n  }\n\n  function createDependencyNode(name: string): string {\n    const nodeId = `dep:npm:${name}`;\n    createNode(nodeId, 'dependency', { name });\n    const rawDb = db.getRawDb();\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_dependencies\n        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n       VALUES (?, ?, ?, ?, ?, ?, ?)`,\n      [nodeId, 'npm', name, '^1.0.0', '1.0.0', 'production', '[\"package.json\"]'],\n    );\n    return nodeId;\n  }\n\n  function createVulnerabilityNode(cveId: string, depNodeId: string): string {\n    const nodeId = `vuln:${cveId}`;\n    createNode(nodeId, 'vulnerability', { name: cveId });\n    const rawDb = db.getRawDb();\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_vulnerabilities\n        (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)\n       VALUES (?, ?, ?, ?, ?, ?, ?)`,\n      [nodeId, cveId, 7.5, '[]', '1.0.1', 'Test vulnerability', 'OSV'],\n    );\n    // Create has_vulnerability edge: dependency \u2192 vulnerability\n    createEdge(depNodeId, nodeId, 'has_vulnerability');\n    return nodeId;\n  }\n\n  function createEntryPoint(id: string, kind: 'route' | 'function' = 'route'): void {\n    createNode(id, kind, { isExported: true });\n  }\n\n  function assignLayer(filePath: string, layerId: string): void {\n    const rawDb = db.getRawDb();\n    // Ensure the layer exists in arch_layers (FK constraint)\n    rawDb.run(\n      `INSERT OR IGNORE INTO arch_layers (id, name, source, patterns, updated_at)\n       VALUES (?, ?, 'auto', '[]', ?)`,\n      [layerId, layerId, Date.now()],\n    );\n    rawDb.run(\n      `INSERT OR REPLACE INTO arch_file_layers (file_path, layer_id, confidence, matched_pattern)\n       VALUES (?, ?, 1.0, '**')`,\n      [filePath, layerId],\n    );\n  }\n\n  // \u2500\u2500 Tests: Core Reachability Traversal (Task 7.1) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  describe('analyze() - core reachability', () => {\n    it('should return affected when a path exists from entry point to dependency', async () => {\n      // Graph: entryPoint \u2192 intermediate \u2192 dependency\n      createEntryPoint('ep1');\n      createNode('mid1', 'function');\n      const depId = createDependencyNode('vulnerable-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-001', depId);\n\n      createEdge('ep1', 'mid1', 'calls');\n      createEdge('mid1', depId, 'imports');\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('affected');\n      expect(result.paths.length).toBe(1);\n      expect(result.paths[0].entryPoint).toBe('ep1');\n      expect(result.paths[0].path).toEqual(['ep1', 'mid1', depId]);\n      expect(result.reachingEntryPointCount).toBe(1);\n    });\n\n    it('should return not_affected when no path exists', async () => {\n      // Graph: entryPoint \u2192 mid1 (no connection to dep)\n      createEntryPoint('ep1');\n      createNode('mid1', 'function');\n      const depId = createDependencyNode('isolated-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-002', depId);\n\n      createEdge('ep1', 'mid1', 'calls');\n      // No edge from mid1 to depId\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('not_affected');\n      expect(result.paths.length).toBe(0);\n      expect(result.reachingEntryPointCount).toBe(0);\n    });\n\n    it('should return under_investigation when unresolved imports are encountered', async () => {\n      // Graph: entryPoint \u2192 unresolvedImport (import node with no outgoing edges)\n      createEntryPoint('ep1');\n      createNode('unresolved1', 'import');\n      const depId = createDependencyNode('maybe-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-003', depId);\n\n      createEdge('ep1', 'unresolved1', 'imports');\n      // unresolved1 has no outgoing edges \u2192 unresolved import\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('under_investigation');\n      expect(result.unresolvedSymbols).toContain('unresolved1');\n      expect(result.paths.length).toBe(0);\n    });\n\n    it('should handle cycles without infinite loops', async () => {\n      // Graph: ep1 \u2192 A \u2192 B \u2192 A (cycle), no path to dep\n      createEntryPoint('ep1');\n      createNode('nodeA', 'function');\n      createNode('nodeB', 'function');\n      const depId = createDependencyNode('unreachable-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-004', depId);\n\n      createEdge('ep1', 'nodeA', 'calls');\n      createEdge('nodeA', 'nodeB', 'calls');\n      createEdge('nodeB', 'nodeA', 'calls'); // cycle\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('not_affected');\n      expect(result.paths.length).toBe(0);\n    });\n\n    it('should visit each node at most once', async () => {\n      // Graph: ep1 \u2192 A \u2192 dep, ep1 \u2192 B \u2192 A \u2192 dep\n      // A should only be visited once per BFS from ep1\n      createEntryPoint('ep1');\n      createNode('nodeA', 'function');\n      createNode('nodeB', 'function');\n      const depId = createDependencyNode('shared-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-005', depId);\n\n      createEdge('ep1', 'nodeA', 'calls');\n      createEdge('ep1', 'nodeB', 'calls');\n      createEdge('nodeA', depId, 'imports');\n      createEdge('nodeB', 'nodeA', 'calls');\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('affected');\n      // Should find shortest path: ep1 \u2192 nodeA \u2192 dep\n      expect(result.paths[0].path).toEqual(['ep1', 'nodeA', depId]);\n    });\n\n    it('should traverse calls, imports, and references edges', async () => {\n      createEntryPoint('ep1');\n      createNode('mid1', 'function');\n      createNode('mid2', 'class');\n      const depId = createDependencyNode('ref-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-006', depId);\n\n      createEdge('ep1', 'mid1', 'calls');\n      createEdge('mid1', 'mid2', 'references');\n      createEdge('mid2', depId, 'imports');\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('affected');\n      expect(result.paths[0].path).toEqual(['ep1', 'mid1', 'mid2', depId]);\n    });\n\n    it('should return under_investigation when no dependency is linked', async () => {\n      // Vulnerability with no has_vulnerability edge\n      const vulnId = 'vuln:CVE-2023-orphan';\n      createNode(vulnId, 'vulnerability', { name: 'CVE-2023-orphan' });\n      const rawDb = db.getRawDb();\n      rawDb.run(\n        `INSERT OR REPLACE INTO sec_vulnerabilities\n          (node_id, cve_id, severity_score, affected_ranges, summary, source_database)\n         VALUES (?, ?, ?, ?, ?, ?)`,\n        [vulnId, 'CVE-2023-orphan', 5.0, '[]', 'Orphan vuln', 'OSV'],\n      );\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('under_investigation');\n    });\n\n    it('should return not_affected when no entry points exist', async () => {\n      // No entry points in the graph\n      const depId = createDependencyNode('no-ep-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-007', depId);\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('not_affected');\n    });\n\n    it('should limit unresolved symbols to 50', async () => {\n      createEntryPoint('ep1');\n      const depId = createDependencyNode('many-unresolved-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-008', depId);\n\n      // Create 60 unresolved import nodes\n      for (let i = 0; i < 60; i++) {\n        const importId = `unresolved-import-${i}`;\n        createNode(importId, 'import');\n        createEdge('ep1', importId, 'imports');\n      }\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('under_investigation');\n      expect(result.unresolvedSymbols.length).toBeLessThanOrEqual(50);\n    });\n\n    it('should store result in sec_reachability table', async () => {\n      createEntryPoint('ep1');\n      const depId = createDependencyNode('stored-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-009', depId);\n      createEdge('ep1', depId, 'imports');\n\n      await analyzer.analyze(vulnId);\n\n      const rawDb = db.getRawDb();\n      const row = rawDb.get(\n        `SELECT * FROM sec_reachability WHERE vulnerability_node_id = ?`,\n        [vulnId],\n      );\n      expect(row).not.toBeNull();\n      expect(row.verdict).toBe('affected');\n      expect(row.reaching_entry_point_count).toBe(1);\n    });\n  });\n\n  // \u2500\u2500 Tests: Multi-Entry-Point Path Recording (Task 7.2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  describe('analyze() - multi-entry-point paths', () => {\n    it('should record shortest path from each reaching entry point', async () => {\n      createEntryPoint('ep1');\n      createEntryPoint('ep2');\n      createNode('mid1', 'function');\n      createNode('mid2', 'function');\n      const depId = createDependencyNode('multi-ep-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-010', depId);\n\n      // ep1 \u2192 mid1 \u2192 dep (length 3)\n      createEdge('ep1', 'mid1', 'calls');\n      createEdge('mid1', depId, 'imports');\n\n      // ep2 \u2192 dep (length 2, shorter)\n      createEdge('ep2', depId, 'imports');\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('affected');\n      expect(result.reachingEntryPointCount).toBe(2);\n      expect(result.paths.length).toBe(2);\n\n      const ep1Path = result.paths.find(p => p.entryPoint === 'ep1');\n      const ep2Path = result.paths.find(p => p.entryPoint === 'ep2');\n\n      expect(ep1Path).toBeDefined();\n      expect(ep1Path!.path).toEqual(['ep1', 'mid1', depId]);\n\n      expect(ep2Path).toBeDefined();\n      expect(ep2Path!.path).toEqual(['ep2', depId]);\n    });\n\n    it('should include total count of reaching entry points', async () => {\n      const depId = createDependencyNode('counted-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-011', depId);\n\n      // Create 5 entry points, 3 of which reach the dep\n      for (let i = 0; i < 5; i++) {\n        createEntryPoint(`ep${i}`);\n        if (i < 3) {\n          createEdge(`ep${i}`, depId, 'imports');\n        }\n      }\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('affected');\n      expect(result.reachingEntryPointCount).toBe(3);\n      expect(result.paths.length).toBe(3);\n    });\n\n    it('should handle exported functions as entry points', async () => {\n      createEntryPoint('exported-fn', 'function');\n      const depId = createDependencyNode('fn-ep-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-012', depId);\n\n      createEdge('exported-fn', depId, 'references');\n\n      const result = await analyzer.analyze(vulnId);\n\n      expect(result.verdict).toBe('affected');\n      expect(result.paths[0].entryPoint).toBe('exported-fn');\n    });\n  });\n\n  // \u2500\u2500 Tests: Impact Analysis (Task 7.3) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  describe('getImpactSummary()', () => {\n    it('should return null for non-affected vulnerabilities', async () => {\n      createEntryPoint('ep1');\n      const depId = createDependencyNode('not-affected-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-020', depId);\n      // No path to dep \u2192 not_affected\n\n      await analyzer.analyze(vulnId);\n      const summary = await analyzer.getImpactSummary(vulnId);\n\n      expect(summary).toBeNull();\n    });\n\n    it('should identify affected layers on reachable paths', async () => {\n      createEntryPoint('ep1');\n      createNode('mid1', 'function', { filePath: 'src/api/handler.ts' });\n      createNode('mid2', 'function', { filePath: 'src/service/logic.ts' });\n      const depId = createDependencyNode('layered-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-021', depId);\n\n      createEdge('ep1', 'mid1', 'calls');\n      createEdge('mid1', 'mid2', 'calls');\n      createEdge('mid2', depId, 'imports');\n\n      // Assign layers\n      assignLayer('src/api/handler.ts', 'api');\n      assignLayer('src/service/logic.ts', 'service');\n\n      await analyzer.analyze(vulnId);\n      const summary = await analyzer.getImpactSummary(vulnId);\n\n      expect(summary).not.toBeNull();\n      expect(summary!.affectedLayers).toContain('api');\n      expect(summary!.affectedLayers).toContain('service');\n    });\n\n    it('should identify all affected entry points', async () => {\n      createEntryPoint('ep1');\n      createEntryPoint('ep2');\n      const depId = createDependencyNode('multi-ep-impact-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-022', depId);\n\n      createEdge('ep1', depId, 'imports');\n      createEdge('ep2', depId, 'imports');\n\n      await analyzer.analyze(vulnId);\n      const summary = await analyzer.getImpactSummary(vulnId);\n\n      expect(summary).not.toBeNull();\n      expect(summary!.affectedEntryPoints).toContain('ep1');\n      expect(summary!.affectedEntryPoints).toContain('ep2');\n    });\n\n    it('should cap distinct path count at 100', async () => {\n      const depId = createDependencyNode('many-paths-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-023', depId);\n\n      // Create 110 entry points each with a direct path\n      for (let i = 0; i < 110; i++) {\n        createEntryPoint(`ep${i}`);\n        createEdge(`ep${i}`, depId, 'imports');\n      }\n\n      await analyzer.analyze(vulnId);\n      const summary = await analyzer.getImpactSummary(vulnId);\n\n      expect(summary).not.toBeNull();\n      expect(summary!.distinctPathCount).toBeLessThanOrEqual(100);\n    });\n\n    it('should classify symbols with no assigned layer as unclassified', async () => {\n      createEntryPoint('ep1');\n      createNode('mid1', 'function', { filePath: 'src/unknown/file.ts' });\n      const depId = createDependencyNode('unclassified-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-024', depId);\n\n      createEdge('ep1', 'mid1', 'calls');\n      createEdge('mid1', depId, 'imports');\n\n      // No layer assigned to src/unknown/file.ts\n\n      await analyzer.analyze(vulnId);\n      const summary = await analyzer.getImpactSummary(vulnId);\n\n      expect(summary).not.toBeNull();\n      expect(summary!.affectedLayers).toContain('unclassified');\n    });\n\n    it('should omit layer classification when enableArchitecture is false', async () => {\n      config.enableArchitecture = false;\n      analyzer = new ReachabilityAnalyzer(db, config);\n\n      createEntryPoint('ep1');\n      createNode('mid1', 'function', { filePath: 'src/api/handler.ts' });\n      const depId = createDependencyNode('no-arch-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-025', depId);\n\n      createEdge('ep1', 'mid1', 'calls');\n      createEdge('mid1', depId, 'imports');\n\n      assignLayer('src/api/handler.ts', 'api');\n\n      await analyzer.analyze(vulnId);\n      const summary = await analyzer.getImpactSummary(vulnId);\n\n      expect(summary).not.toBeNull();\n      // When enableArchitecture is false, affectedLayers should be empty\n      expect(summary!.affectedLayers).toEqual([]);\n    });\n\n    it('should store impact summary in sec_impact table', async () => {\n      createEntryPoint('ep1');\n      const depId = createDependencyNode('stored-impact-pkg');\n      const vulnId = createVulnerabilityNode('CVE-2023-026', depId);\n      createEdge('ep1', depId, 'imports');\n\n      await analyzer.analyze(vulnId);\n      await analyzer.getImpactSummary(vulnId);\n\n      const rawDb = db.getRawDb();\n      const row = rawDb.get(\n        `SELECT * FROM sec_impact WHERE vulnerability_node_id = ?`,\n        [vulnId],\n      );\n      expect(row).not.toBeNull();\n      expect(row.distinct_path_count).toBeGreaterThan(0);\n    });\n  });\n\n  // \u2500\u2500 Tests: analyzeAll() \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  describe('analyzeAll()', () => {\n    it('should analyze all vulnerability nodes', async () => {\n      createEntryPoint('ep1');\n      const dep1 = createDependencyNode('pkg1');\n      const dep2 = createDependencyNode('pkg2');\n      const vuln1 = createVulnerabilityNode('CVE-2023-030', dep1);\n      const vuln2 = createVulnerabilityNode('CVE-2023-031', dep2);\n\n      createEdge('ep1', dep1, 'imports');\n      // dep2 is not reachable\n\n      const results = await analyzer.analyzeAll();\n\n      expect(results.size).toBe(2);\n      expect(results.get(vuln1)!.verdict).toBe('affected');\n      expect(results.get(vuln2)!.verdict).toBe('not_affected');\n    });\n\n    it('should return empty map when no vulnerabilities exist', async () => {\n      const results = await analyzer.analyzeAll();\n      expect(results.size).toBe(0);\n    });\n  });\n});\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAQA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,0BAAqC;AACrC,sBAA8B;AAC9B,oBAA0D;AAAA,IAG1D,wBAAS,wBAAwB,MAAM;AACrC,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,8BAA8B,CAAC;AAC9E,SAAK,IAAI,8BAAc,MAAM;AAC7B,OAAG,oBAAoB;AACvB,iBAAS,mCAAoB;AAC7B,WAAO,qBAAqB;AAC5B,WAAO,iBAAiB;AACxB,eAAW,IAAI,yCAAqB,IAAI,MAAM;AAAA,EAChD,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,MAAM;AACT,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAID,WAAS,WAAW,IAAY,MAAoB,MAA4B;AAC9E,UAAM,OAAa;AAAA,MACjB;AAAA,MACA;AAAA,MACA,MAAM,MAAM,QAAQ;AAAA,MACpB,eAAe,MAAM,iBAAiB;AAAA,MACtC,UAAU,MAAM,YAAY,OAAO,EAAE;AAAA,MACrC,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,YAAY,MAAM,cAAc;AAAA,MAChC,WAAW,KAAK,IAAI;AAAA,IACtB;AACA,OAAG,WAAW,IAAI;AAAA,EACpB;AAEA,WAAS,WAAW,QAAgB,QAAgB,MAA0B;AAC5E,OAAG,WAAW,EAAE,QAAQ,QAAQ,KAAK,CAAC;AAAA,EACxC;AAEA,WAAS,qBAAqB,MAAsB;AAClD,UAAM,SAAS,WAAW,IAAI;AAC9B,eAAW,QAAQ,cAAc,EAAE,KAAK,CAAC;AACzC,UAAM,QAAQ,GAAG,SAAS;AAC1B,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,QAAQ,OAAO,MAAM,UAAU,SAAS,cAAc,kBAAkB;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AAEA,WAAS,wBAAwB,OAAe,WAA2B;AACzE,UAAM,SAAS,QAAQ,KAAK;AAC5B,eAAW,QAAQ,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACnD,UAAM,QAAQ,GAAG,SAAS;AAC1B,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,QAAQ,OAAO,KAAK,MAAM,SAAS,sBAAsB,KAAK;AAAA,IACjE;AAEA,eAAW,WAAW,QAAQ,mBAAmB;AACjD,WAAO;AAAA,EACT;AAEA,WAAS,iBAAiB,IAAY,OAA6B,SAAe;AAChF,eAAW,IAAI,MAAM,EAAE,YAAY,KAAK,CAAC;AAAA,EAC3C;AAEA,WAAS,YAAY,UAAkB,SAAuB;AAC5D,UAAM,QAAQ,GAAG,SAAS;AAE1B,UAAM;AAAA,MACJ;AAAA;AAAA,MAEA,CAAC,SAAS,SAAS,KAAK,IAAI,CAAC;AAAA,IAC/B;AACA,UAAM;AAAA,MACJ;AAAA;AAAA,MAEA,CAAC,UAAU,OAAO;AAAA,IACpB;AAAA,EACF;AAIA,8BAAS,iCAAiC,MAAM;AAC9C,0BAAG,4EAA4E,YAAY;AAEzF,uBAAiB,KAAK;AACtB,iBAAW,QAAQ,UAAU;AAC7B,YAAM,QAAQ,qBAAqB,gBAAgB;AACnD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,iBAAW,OAAO,QAAQ,OAAO;AACjC,iBAAW,QAAQ,OAAO,SAAS;AAEnC,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,UAAU;AACtC,gCAAO,OAAO,MAAM,MAAM,EAAE,KAAK,CAAC;AAClC,gCAAO,OAAO,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,KAAK;AAC7C,gCAAO,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,QAAQ,KAAK,CAAC;AAC3D,gCAAO,OAAO,uBAAuB,EAAE,KAAK,CAAC;AAAA,IAC/C,CAAC;AAED,0BAAG,kDAAkD,YAAY;AAE/D,uBAAiB,KAAK;AACtB,iBAAW,QAAQ,UAAU;AAC7B,YAAM,QAAQ,qBAAqB,cAAc;AACjD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,iBAAW,OAAO,QAAQ,OAAO;AAGjC,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,cAAc;AAC1C,gCAAO,OAAO,MAAM,MAAM,EAAE,KAAK,CAAC;AAClC,gCAAO,OAAO,uBAAuB,EAAE,KAAK,CAAC;AAAA,IAC/C,CAAC;AAED,0BAAG,6EAA6E,YAAY;AAE1F,uBAAiB,KAAK;AACtB,iBAAW,eAAe,QAAQ;AAClC,YAAM,QAAQ,qBAAqB,WAAW;AAC9C,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,iBAAW,OAAO,eAAe,SAAS;AAG1C,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,qBAAqB;AACjD,gCAAO,OAAO,iBAAiB,EAAE,UAAU,aAAa;AACxD,gCAAO,OAAO,MAAM,MAAM,EAAE,KAAK,CAAC;AAAA,IACpC,CAAC;AAED,0BAAG,+CAA+C,YAAY;AAE5D,uBAAiB,KAAK;AACtB,iBAAW,SAAS,UAAU;AAC9B,iBAAW,SAAS,UAAU;AAC9B,YAAM,QAAQ,qBAAqB,iBAAiB;AACpD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,iBAAW,OAAO,SAAS,OAAO;AAClC,iBAAW,SAAS,SAAS,OAAO;AACpC,iBAAW,SAAS,SAAS,OAAO;AAEpC,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,cAAc;AAC1C,gCAAO,OAAO,MAAM,MAAM,EAAE,KAAK,CAAC;AAAA,IACpC,CAAC;AAED,0BAAG,uCAAuC,YAAY;AAGpD,uBAAiB,KAAK;AACtB,iBAAW,SAAS,UAAU;AAC9B,iBAAW,SAAS,UAAU;AAC9B,YAAM,QAAQ,qBAAqB,YAAY;AAC/C,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,iBAAW,OAAO,SAAS,OAAO;AAClC,iBAAW,OAAO,SAAS,OAAO;AAClC,iBAAW,SAAS,OAAO,SAAS;AACpC,iBAAW,SAAS,SAAS,OAAO;AAEpC,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,UAAU;AAEtC,gCAAO,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,SAAS,KAAK,CAAC;AAAA,IAC9D,CAAC;AAED,0BAAG,wDAAwD,YAAY;AACrE,uBAAiB,KAAK;AACtB,iBAAW,QAAQ,UAAU;AAC7B,iBAAW,QAAQ,OAAO;AAC1B,YAAM,QAAQ,qBAAqB,SAAS;AAC5C,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,iBAAW,OAAO,QAAQ,OAAO;AACjC,iBAAW,QAAQ,QAAQ,YAAY;AACvC,iBAAW,QAAQ,OAAO,SAAS;AAEnC,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,UAAU;AACtC,gCAAO,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,QAAQ,QAAQ,KAAK,CAAC;AAAA,IACrE,CAAC;AAED,0BAAG,kEAAkE,YAAY;AAE/E,YAAM,SAAS;AACf,iBAAW,QAAQ,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,YAAM,QAAQ,GAAG,SAAS;AAC1B,YAAM;AAAA,QACJ;AAAA;AAAA;AAAA,QAGA,CAAC,QAAQ,mBAAmB,GAAK,MAAM,eAAe,KAAK;AAAA,MAC7D;AAEA,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,qBAAqB;AAAA,IACnD,CAAC;AAED,0BAAG,yDAAyD,YAAY;AAEtE,YAAM,QAAQ,qBAAqB,WAAW;AAC9C,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,cAAc;AAAA,IAC5C,CAAC;AAED,0BAAG,yCAAyC,YAAY;AACtD,uBAAiB,KAAK;AACtB,YAAM,QAAQ,qBAAqB,qBAAqB;AACxD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAG5D,eAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,cAAM,WAAW,qBAAqB,CAAC;AACvC,mBAAW,UAAU,QAAQ;AAC7B,mBAAW,OAAO,UAAU,SAAS;AAAA,MACvC;AAEA,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,qBAAqB;AACjD,gCAAO,OAAO,kBAAkB,MAAM,EAAE,oBAAoB,EAAE;AAAA,IAChE,CAAC;AAED,0BAAG,iDAAiD,YAAY;AAC9D,uBAAiB,KAAK;AACtB,YAAM,QAAQ,qBAAqB,YAAY;AAC/C,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAC5D,iBAAW,OAAO,OAAO,SAAS;AAElC,YAAM,SAAS,QAAQ,MAAM;AAE7B,YAAM,QAAQ,GAAG,SAAS;AAC1B,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA,CAAC,MAAM;AAAA,MACT;AACA,gCAAO,GAAG,EAAE,IAAI,SAAS;AACzB,gCAAO,IAAI,OAAO,EAAE,KAAK,UAAU;AACnC,gCAAO,IAAI,0BAA0B,EAAE,KAAK,CAAC;AAAA,IAC/C,CAAC;AAAA,EACH,CAAC;AAID,8BAAS,uCAAuC,MAAM;AACpD,0BAAG,8DAA8D,YAAY;AAC3E,uBAAiB,KAAK;AACtB,uBAAiB,KAAK;AACtB,iBAAW,QAAQ,UAAU;AAC7B,iBAAW,QAAQ,UAAU;AAC7B,YAAM,QAAQ,qBAAqB,cAAc;AACjD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAG5D,iBAAW,OAAO,QAAQ,OAAO;AACjC,iBAAW,QAAQ,OAAO,SAAS;AAGnC,iBAAW,OAAO,OAAO,SAAS;AAElC,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,UAAU;AACtC,gCAAO,OAAO,uBAAuB,EAAE,KAAK,CAAC;AAC7C,gCAAO,OAAO,MAAM,MAAM,EAAE,KAAK,CAAC;AAElC,YAAM,UAAU,OAAO,MAAM,KAAK,OAAK,EAAE,eAAe,KAAK;AAC7D,YAAM,UAAU,OAAO,MAAM,KAAK,OAAK,EAAE,eAAe,KAAK;AAE7D,gCAAO,OAAO,EAAE,YAAY;AAC5B,gCAAO,QAAS,IAAI,EAAE,QAAQ,CAAC,OAAO,QAAQ,KAAK,CAAC;AAEpD,gCAAO,OAAO,EAAE,YAAY;AAC5B,gCAAO,QAAS,IAAI,EAAE,QAAQ,CAAC,OAAO,KAAK,CAAC;AAAA,IAC9C,CAAC;AAED,0BAAG,uDAAuD,YAAY;AACpE,YAAM,QAAQ,qBAAqB,aAAa;AAChD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAG5D,eAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,yBAAiB,KAAK,CAAC,EAAE;AACzB,YAAI,IAAI,GAAG;AACT,qBAAW,KAAK,CAAC,IAAI,OAAO,SAAS;AAAA,QACvC;AAAA,MACF;AAEA,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,UAAU;AACtC,gCAAO,OAAO,uBAAuB,EAAE,KAAK,CAAC;AAC7C,gCAAO,OAAO,MAAM,MAAM,EAAE,KAAK,CAAC;AAAA,IACpC,CAAC;AAED,0BAAG,oDAAoD,YAAY;AACjE,uBAAiB,eAAe,UAAU;AAC1C,YAAM,QAAQ,qBAAqB,WAAW;AAC9C,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,iBAAW,eAAe,OAAO,YAAY;AAE7C,YAAM,SAAS,MAAM,SAAS,QAAQ,MAAM;AAE5C,gCAAO,OAAO,OAAO,EAAE,KAAK,UAAU;AACtC,gCAAO,OAAO,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,aAAa;AAAA,IACvD,CAAC;AAAA,EACH,CAAC;AAID,8BAAS,sBAAsB,MAAM;AACnC,0BAAG,uDAAuD,YAAY;AACpE,uBAAiB,KAAK;AACtB,YAAM,QAAQ,qBAAqB,kBAAkB;AACrD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAG5D,YAAM,SAAS,QAAQ,MAAM;AAC7B,YAAM,UAAU,MAAM,SAAS,iBAAiB,MAAM;AAEtD,gCAAO,OAAO,EAAE,SAAS;AAAA,IAC3B,CAAC;AAED,0BAAG,sDAAsD,YAAY;AACnE,uBAAiB,KAAK;AACtB,iBAAW,QAAQ,YAAY,EAAE,UAAU,qBAAqB,CAAC;AACjE,iBAAW,QAAQ,YAAY,EAAE,UAAU,uBAAuB,CAAC;AACnE,YAAM,QAAQ,qBAAqB,aAAa;AAChD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,iBAAW,OAAO,QAAQ,OAAO;AACjC,iBAAW,QAAQ,QAAQ,OAAO;AAClC,iBAAW,QAAQ,OAAO,SAAS;AAGnC,kBAAY,sBAAsB,KAAK;AACvC,kBAAY,wBAAwB,SAAS;AAE7C,YAAM,SAAS,QAAQ,MAAM;AAC7B,YAAM,UAAU,MAAM,SAAS,iBAAiB,MAAM;AAEtD,gCAAO,OAAO,EAAE,IAAI,SAAS;AAC7B,gCAAO,QAAS,cAAc,EAAE,UAAU,KAAK;AAC/C,gCAAO,QAAS,cAAc,EAAE,UAAU,SAAS;AAAA,IACrD,CAAC;AAED,0BAAG,6CAA6C,YAAY;AAC1D,uBAAiB,KAAK;AACtB,uBAAiB,KAAK;AACtB,YAAM,QAAQ,qBAAqB,qBAAqB;AACxD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,iBAAW,OAAO,OAAO,SAAS;AAClC,iBAAW,OAAO,OAAO,SAAS;AAElC,YAAM,SAAS,QAAQ,MAAM;AAC7B,YAAM,UAAU,MAAM,SAAS,iBAAiB,MAAM;AAEtD,gCAAO,OAAO,EAAE,IAAI,SAAS;AAC7B,gCAAO,QAAS,mBAAmB,EAAE,UAAU,KAAK;AACpD,gCAAO,QAAS,mBAAmB,EAAE,UAAU,KAAK;AAAA,IACtD,CAAC;AAED,0BAAG,yCAAyC,YAAY;AACtD,YAAM,QAAQ,qBAAqB,gBAAgB;AACnD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAG5D,eAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,yBAAiB,KAAK,CAAC,EAAE;AACzB,mBAAW,KAAK,CAAC,IAAI,OAAO,SAAS;AAAA,MACvC;AAEA,YAAM,SAAS,QAAQ,MAAM;AAC7B,YAAM,UAAU,MAAM,SAAS,iBAAiB,MAAM;AAEtD,gCAAO,OAAO,EAAE,IAAI,SAAS;AAC7B,gCAAO,QAAS,iBAAiB,EAAE,oBAAoB,GAAG;AAAA,IAC5D,CAAC;AAED,0BAAG,kEAAkE,YAAY;AAC/E,uBAAiB,KAAK;AACtB,iBAAW,QAAQ,YAAY,EAAE,UAAU,sBAAsB,CAAC;AAClE,YAAM,QAAQ,qBAAqB,kBAAkB;AACrD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,iBAAW,OAAO,QAAQ,OAAO;AACjC,iBAAW,QAAQ,OAAO,SAAS;AAInC,YAAM,SAAS,QAAQ,MAAM;AAC7B,YAAM,UAAU,MAAM,SAAS,iBAAiB,MAAM;AAEtD,gCAAO,OAAO,EAAE,IAAI,SAAS;AAC7B,gCAAO,QAAS,cAAc,EAAE,UAAU,cAAc;AAAA,IAC1D,CAAC;AAED,0BAAG,qEAAqE,YAAY;AAClF,aAAO,qBAAqB;AAC5B,iBAAW,IAAI,yCAAqB,IAAI,MAAM;AAE9C,uBAAiB,KAAK;AACtB,iBAAW,QAAQ,YAAY,EAAE,UAAU,qBAAqB,CAAC;AACjE,YAAM,QAAQ,qBAAqB,aAAa;AAChD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAE5D,iBAAW,OAAO,QAAQ,OAAO;AACjC,iBAAW,QAAQ,OAAO,SAAS;AAEnC,kBAAY,sBAAsB,KAAK;AAEvC,YAAM,SAAS,QAAQ,MAAM;AAC7B,YAAM,UAAU,MAAM,SAAS,iBAAiB,MAAM;AAEtD,gCAAO,OAAO,EAAE,IAAI,SAAS;AAE7B,gCAAO,QAAS,cAAc,EAAE,QAAQ,CAAC,CAAC;AAAA,IAC5C,CAAC;AAED,0BAAG,mDAAmD,YAAY;AAChE,uBAAiB,KAAK;AACtB,YAAM,QAAQ,qBAAqB,mBAAmB;AACtD,YAAM,SAAS,wBAAwB,gBAAgB,KAAK;AAC5D,iBAAW,OAAO,OAAO,SAAS;AAElC,YAAM,SAAS,QAAQ,MAAM;AAC7B,YAAM,SAAS,iBAAiB,MAAM;AAEtC,YAAM,QAAQ,GAAG,SAAS;AAC1B,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA,CAAC,MAAM;AAAA,MACT;AACA,gCAAO,GAAG,EAAE,IAAI,SAAS;AACzB,gCAAO,IAAI,mBAAmB,EAAE,gBAAgB,CAAC;AAAA,IACnD,CAAC;AAAA,EACH,CAAC;AAID,8BAAS,gBAAgB,MAAM;AAC7B,0BAAG,0CAA0C,YAAY;AACvD,uBAAiB,KAAK;AACtB,YAAM,OAAO,qBAAqB,MAAM;AACxC,YAAM,OAAO,qBAAqB,MAAM;AACxC,YAAM,QAAQ,wBAAwB,gBAAgB,IAAI;AAC1D,YAAM,QAAQ,wBAAwB,gBAAgB,IAAI;AAE1D,iBAAW,OAAO,MAAM,SAAS;AAGjC,YAAM,UAAU,MAAM,SAAS,WAAW;AAE1C,gCAAO,QAAQ,IAAI,EAAE,KAAK,CAAC;AAC3B,gCAAO,QAAQ,IAAI,KAAK,EAAG,OAAO,EAAE,KAAK,UAAU;AACnD,gCAAO,QAAQ,IAAI,KAAK,EAAG,OAAO,EAAE,KAAK,cAAc;AAAA,IACzD,CAAC;AAED,0BAAG,yDAAyD,YAAY;AACtE,YAAM,UAAU,MAAM,SAAS,WAAW;AAC1C,gCAAO,QAAQ,IAAI,EAAE,KAAK,CAAC;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/security/remediation.js

@@ -0,0 +1,126 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var remediation_exports = {};
+__export(remediation_exports, {
+  RemediationTracker: () => RemediationTracker
+});
+module.exports = __toCommonJS(remediation_exports);
+class RemediationTracker {
+  constructor(db) {
+    this.db = db;
+  }
+  /**
+   * Called when a vulnerability is first inserted.
+   * Sets first_detected_at if not already set, and fix_available_since if a
+   * fixed_version is provided and fix_available_since is not yet recorded.
+   */
+  markDetected(vulnNodeId, fixedVersion) {
+    const rawDb = this.db.getRawDb();
+    const now = Date.now();
+    rawDb.run(
+      `UPDATE sec_vulnerabilities
+       SET first_detected_at = COALESCE(first_detected_at, ?)
+       WHERE node_id = ?`,
+      [now, vulnNodeId]
+    );
+    if (fixedVersion) {
+      rawDb.run(
+        `UPDATE sec_vulnerabilities
+         SET fix_available_since = COALESCE(fix_available_since, ?)
+         WHERE node_id = ? AND fixed_version IS NOT NULL`,
+        [now, vulnNodeId]
+      );
+    }
+  }
+  /**
+   * Get remediation status for all open (non-remediated, non-suppressed)
+   * vulnerabilities that have been detected.
+   */
+  getStatus() {
+    const rawDb = this.db.getRawDb();
+    const now = Date.now();
+    const rows = rawDb.all(
+      `SELECT v.node_id, v.cve_id, v.severity_score, v.risk_score,
+              v.fixed_version, v.first_detected_at, v.fix_available_since,
+              v.suppressed_at, v.remediated_at,
+              d.package_name
+       FROM sec_vulnerabilities v
+       LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'
+       LEFT JOIN sec_dependencies d ON d.node_id = e.source
+       WHERE v.remediated_at IS NULL
+         AND v.suppressed_at IS NULL
+         AND v.first_detected_at IS NOT NULL`
+    );
+    return rows.map((row) => {
+      const firstDetectedAt = row.first_detected_at;
+      const daysOpen = firstDetectedAt !== null ? Math.floor((now - firstDetectedAt) / (1e3 * 60 * 60 * 24)) : null;
+      const fixAvailableSince = row.fix_available_since;
+      const daysWithFixAvailable = fixAvailableSince !== null ? Math.floor((now - fixAvailableSince) / (1e3 * 60 * 60 * 24)) : null;
+      const slaThreshold = this.getSlaThresholdDays(row.severity_score);
+      const slaDeadline = fixAvailableSince !== null ? fixAvailableSince + slaThreshold * 24 * 60 * 60 * 1e3 : firstDetectedAt !== null ? firstDetectedAt + slaThreshold * 24 * 60 * 60 * 1e3 : null;
+      let slaStatus;
+      let isOverdue = false;
+      if (!row.fixed_version && !fixAvailableSince) {
+        slaStatus = "no_fix";
+        isOverdue = false;
+      } else if (slaDeadline !== null && now > slaDeadline) {
+        slaStatus = "overdue";
+        isOverdue = true;
+      } else if (slaDeadline !== null && now > slaDeadline - slaThreshold * 0.5 * 24 * 60 * 60 * 1e3) {
+        slaStatus = "warning";
+        isOverdue = false;
+      } else {
+        slaStatus = "ok";
+        isOverdue = false;
+      }
+      return {
+        cveId: row.cve_id,
+        packageName: row.package_name ?? "unknown",
+        severity: row.severity_score,
+        riskScore: row.risk_score,
+        firstDetectedAt,
+        daysOpen,
+        fixAvailableSince,
+        daysWithFixAvailable,
+        isOverdue,
+        slaStatus,
+        slaDeadline
+      };
+    });
+  }
+  /**
+   * SLA thresholds by CVSS severity:
+   *   critical (≥ 9)  → 7 days
+   *   high (≥ 7)      → 30 days
+   *   medium (≥ 4)    → 90 days
+   *   low / unknown   → 180 days
+   */
+  getSlaThresholdDays(severity) {
+    if (severity === null) return 180;
+    if (severity >= 9) return 7;
+    if (severity >= 7) return 30;
+    if (severity >= 4) return 90;
+    return 180;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RemediationTracker
+});
+//# sourceMappingURL=remediation.js.map

package/dist/security/remediation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/remediation.ts"],
+  "sourcesContent": ["/**\n * Remediation SLA Tracker\n *\n * Tracks how long open vulnerabilities have been known, when a fix became\n * available, and whether remediation is overdue based on severity-based SLA\n * thresholds.\n *\n * SLA thresholds:\n *   critical (CVSS \u2265 9)  \u2192 7 days\n *   high     (CVSS \u2265 7)  \u2192 30 days\n *   medium   (CVSS \u2265 4)  \u2192 90 days\n *   low / unknown        \u2192 180 days\n */\n\nimport type { GraphDatabase } from '../db/database';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface RemediationStatus {\n  cveId: string;\n  packageName: string;\n  severity: number | null;\n  riskScore: number | null;\n  firstDetectedAt: number | null;\n  daysOpen: number | null;\n  fixAvailableSince: number | null;\n  daysWithFixAvailable: number | null;\n  isOverdue: boolean;\n  slaStatus: 'ok' | 'warning' | 'overdue' | 'no_fix';\n  slaDeadline: number | null;   // epoch ms\n}\n\n// \u2500\u2500 RemediationTracker \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class RemediationTracker {\n  constructor(private readonly db: GraphDatabase) {}\n\n  /**\n   * Called when a vulnerability is first inserted.\n   * Sets first_detected_at if not already set, and fix_available_since if a\n   * fixed_version is provided and fix_available_since is not yet recorded.\n   */\n  markDetected(vulnNodeId: string, fixedVersion: string | null): void {\n    const rawDb = this.db.getRawDb();\n    const now = Date.now();\n\n    // Set first_detected_at only if not already set\n    rawDb.run(\n      `UPDATE sec_vulnerabilities\n       SET first_detected_at = COALESCE(first_detected_at, ?)\n       WHERE node_id = ?`,\n      [now, vulnNodeId],\n    );\n\n    // Set fix_available_since if a fix is known and not yet recorded\n    if (fixedVersion) {\n      rawDb.run(\n        `UPDATE sec_vulnerabilities\n         SET fix_available_since = COALESCE(fix_available_since, ?)\n         WHERE node_id = ? AND fixed_version IS NOT NULL`,\n        [now, vulnNodeId],\n      );\n    }\n  }\n\n  /**\n   * Get remediation status for all open (non-remediated, non-suppressed)\n   * vulnerabilities that have been detected.\n   */\n  getStatus(): RemediationStatus[] {\n    const rawDb = this.db.getRawDb();\n    const now = Date.now();\n\n    const rows: Array<{\n      node_id: string;\n      cve_id: string;\n      severity_score: number | null;\n      risk_score: number | null;\n      fixed_version: string | null;\n      first_detected_at: number | null;\n      fix_available_since: number | null;\n      suppressed_at: number | null;\n      remediated_at: number | null;\n      package_name: string | null;\n    }> = rawDb.all(\n      `SELECT v.node_id, v.cve_id, v.severity_score, v.risk_score,\n              v.fixed_version, v.first_detected_at, v.fix_available_since,\n              v.suppressed_at, v.remediated_at,\n              d.package_name\n       FROM sec_vulnerabilities v\n       LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n       LEFT JOIN sec_dependencies d ON d.node_id = e.source\n       WHERE v.remediated_at IS NULL\n         AND v.suppressed_at IS NULL\n         AND v.first_detected_at IS NOT NULL`,\n    );\n\n    return rows.map(row => {\n      const firstDetectedAt = row.first_detected_at;\n      const daysOpen = firstDetectedAt !== null\n        ? Math.floor((now - firstDetectedAt) / (1000 * 60 * 60 * 24))\n        : null;\n\n      const fixAvailableSince = row.fix_available_since;\n      const daysWithFixAvailable = fixAvailableSince !== null\n        ? Math.floor((now - fixAvailableSince) / (1000 * 60 * 60 * 24))\n        : null;\n\n      const slaThreshold = this.getSlaThresholdDays(row.severity_score);\n      const slaDeadline = fixAvailableSince !== null\n        ? fixAvailableSince + slaThreshold * 24 * 60 * 60 * 1000\n        : firstDetectedAt !== null\n          ? firstDetectedAt + slaThreshold * 24 * 60 * 60 * 1000\n          : null;\n\n      let slaStatus: RemediationStatus['slaStatus'];\n      let isOverdue = false;\n\n      if (!row.fixed_version && !fixAvailableSince) {\n        slaStatus = 'no_fix';\n        isOverdue = false;\n      } else if (slaDeadline !== null && now > slaDeadline) {\n        slaStatus = 'overdue';\n        isOverdue = true;\n      } else if (slaDeadline !== null && now > slaDeadline - slaThreshold * 0.5 * 24 * 60 * 60 * 1000) {\n        // Over 50% of SLA elapsed\n        slaStatus = 'warning';\n        isOverdue = false;\n      } else {\n        slaStatus = 'ok';\n        isOverdue = false;\n      }\n\n      return {\n        cveId: row.cve_id,\n        packageName: row.package_name ?? 'unknown',\n        severity: row.severity_score,\n        riskScore: row.risk_score,\n        firstDetectedAt,\n        daysOpen,\n        fixAvailableSince,\n        daysWithFixAvailable,\n        isOverdue,\n        slaStatus,\n        slaDeadline,\n      };\n    });\n  }\n\n  /**\n   * SLA thresholds by CVSS severity:\n   *   critical (\u2265 9)  \u2192 7 days\n   *   high (\u2265 7)      \u2192 30 days\n   *   medium (\u2265 4)    \u2192 90 days\n   *   low / unknown   \u2192 180 days\n   */\n  getSlaThresholdDays(severity: number | null): number {\n    if (severity === null) return 180;\n    if (severity >= 9) return 7;\n    if (severity >= 7) return 30;\n    if (severity >= 4) return 90;\n    return 180;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCO,MAAM,mBAAmB;AAAA,EAC9B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,aAAa,YAAoB,cAAmC;AAClE,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,MAAM,KAAK,IAAI;AAGrB,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,KAAK,UAAU;AAAA,IAClB;AAGA,QAAI,cAAc;AAChB,YAAM;AAAA,QACJ;AAAA;AAAA;AAAA,QAGA,CAAC,KAAK,UAAU;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAiC;AAC/B,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,MAAM,KAAK,IAAI;AAErB,UAAM,OAWD,MAAM;AAAA,MACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUF;AAEA,WAAO,KAAK,IAAI,SAAO;AACrB,YAAM,kBAAkB,IAAI;AAC5B,YAAM,WAAW,oBAAoB,OACjC,KAAK,OAAO,MAAM,oBAAoB,MAAO,KAAK,KAAK,GAAG,IAC1D;AAEJ,YAAM,oBAAoB,IAAI;AAC9B,YAAM,uBAAuB,sBAAsB,OAC/C,KAAK,OAAO,MAAM,sBAAsB,MAAO,KAAK,KAAK,GAAG,IAC5D;AAEJ,YAAM,eAAe,KAAK,oBAAoB,IAAI,cAAc;AAChE,YAAM,cAAc,sBAAsB,OACtC,oBAAoB,eAAe,KAAK,KAAK,KAAK,MAClD,oBAAoB,OAClB,kBAAkB,eAAe,KAAK,KAAK,KAAK,MAChD;AAEN,UAAI;AACJ,UAAI,YAAY;AAEhB,UAAI,CAAC,IAAI,iBAAiB,CAAC,mBAAmB;AAC5C,oBAAY;AACZ,oBAAY;AAAA,MACd,WAAW,gBAAgB,QAAQ,MAAM,aAAa;AACpD,oBAAY;AACZ,oBAAY;AAAA,MACd,WAAW,gBAAgB,QAAQ,MAAM,cAAc,eAAe,MAAM,KAAK,KAAK,KAAK,KAAM;AAE/F,oBAAY;AACZ,oBAAY;AAAA,MACd,OAAO;AACL,oBAAY;AACZ,oBAAY;AAAA,MACd;AAEA,aAAO;AAAA,QACL,OAAO,IAAI;AAAA,QACX,aAAa,IAAI,gBAAgB;AAAA,QACjC,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,QACf;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,oBAAoB,UAAiC;AACnD,QAAI,aAAa,KAAM,QAAO;AAC9B,QAAI,YAAY,EAAG,QAAO;AAC1B,QAAI,YAAY,EAAG,QAAO;AAC1B,QAAI,YAAY,EAAG,QAAO;AAC1B,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}