kirograph 0.17.0 → 0.19.0

package/dist/architecture/layers/dart.js

@@ -0,0 +1,112 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var dart_exports = {};
+__export(dart_exports, {
+  dartLayerDetector: () => dartLayerDetector
+});
+module.exports = __toCommonJS(dart_exports);
+var import_picomatch = __toESM(require("picomatch"));
+const LAYER_PATTERNS = [
+  // UI layer
+  ["ui", "**/lib/screens/**", 0.9],
+  ["ui", "**/lib/pages/**", 0.9],
+  ["ui", "**/lib/views/**", 0.85],
+  ["ui", "**/lib/widgets/**", 0.9],
+  ["ui", "**/lib/components/**", 0.85],
+  // Service / Business logic layer
+  ["service", "**/lib/services/**", 0.9],
+  ["service", "**/lib/providers/**", 0.85],
+  ["service", "**/lib/blocs/**", 0.9],
+  ["service", "**/lib/cubits/**", 0.9],
+  ["service", "**/lib/notifiers/**", 0.85],
+  // Data layer
+  ["data", "**/lib/repositories/**", 0.9],
+  ["data", "**/lib/data/**", 0.85],
+  ["data", "**/lib/datasources/**", 0.9],
+  ["data", "**/lib/models/**", 0.85],
+  ["data", "**/lib/entities/**", 0.85],
+  ["data", "**/lib/domain/**", 0.8],
+  // Shared / Infrastructure layer
+  ["shared", "**/lib/core/**", 0.85],
+  ["shared", "**/lib/utils/**", 0.85],
+  ["shared", "**/lib/helpers/**", 0.85],
+  ["shared", "**/lib/extensions/**", 0.85],
+  ["shared", "**/lib/constants/**", 0.8],
+  // API / Navigation layer
+  ["api", "**/lib/routes/**", 0.9],
+  ["api", "**/lib/navigation/**", 0.85],
+  ["api", "**/lib/router/**", 0.85],
+  ["api", "**/lib/main.dart", 0.8],
+  ["api", "**/lib/app.dart", 0.8]
+];
+const TEST_PATTERN = (0, import_picomatch.default)("**/test/**");
+const dartLayerDetector = {
+  language: "dart",
+  async detect(files, _projectRoot, configLayers) {
+    const results = [];
+    const configMatchers = _buildConfigMatchers(configLayers ?? {});
+    for (const file of files) {
+      if (!file.endsWith(".dart")) continue;
+      if (TEST_PATTERN(file)) continue;
+      const configMatch = _matchConfig(file, configMatchers);
+      if (configMatch) {
+        results.push({ ...configMatch, filePath: file });
+        continue;
+      }
+      let best = null;
+      for (const [layerName, pattern, confidence] of LAYER_PATTERNS) {
+        if ((0, import_picomatch.default)(pattern)(file)) {
+          if (!best || confidence > best.confidence) {
+            best = { layerName, filePath: file, confidence, matchedPattern: pattern };
+          }
+        }
+      }
+      if (best) results.push(best);
+    }
+    return results;
+  }
+};
+function _buildConfigMatchers(configLayers) {
+  return Object.entries(configLayers).flatMap(
+    ([layerName, patterns]) => patterns.map(
+      (pattern) => [layerName, (0, import_picomatch.default)(pattern), pattern]
+    )
+  );
+}
+function _matchConfig(file, matchers) {
+  for (const [layerName, matcher, pattern] of matchers) {
+    if (matcher(file)) return { layerName, confidence: 1, matchedPattern: `config:${pattern}` };
+  }
+  return null;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  dartLayerDetector
+});
+//# sourceMappingURL=dart.js.map

package/dist/architecture/layers/dart.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/architecture/layers/dart.ts"],
+  "sourcesContent": ["/**\n * Layer detector for Dart / Flutter projects.\n *\n * Detects: api, service, data, ui, shared layers based on\n * directory names common in Flutter projects under lib/.\n * Files in test/ are skipped (return no match).\n */\nimport type { LayerDetector, ArchLayerMatch } from '../types';\nimport picomatch from 'picomatch';\n\n// Pattern definitions: each entry is [layerName, glob, confidence]\nconst LAYER_PATTERNS: Array<[string, string, number]> = [\n  // UI layer\n  ['ui', '**/lib/screens/**', 0.9],\n  ['ui', '**/lib/pages/**', 0.9],\n  ['ui', '**/lib/views/**', 0.85],\n  ['ui', '**/lib/widgets/**', 0.9],\n  ['ui', '**/lib/components/**', 0.85],\n\n  // Service / Business logic layer\n  ['service', '**/lib/services/**', 0.9],\n  ['service', '**/lib/providers/**', 0.85],\n  ['service', '**/lib/blocs/**', 0.9],\n  ['service', '**/lib/cubits/**', 0.9],\n  ['service', '**/lib/notifiers/**', 0.85],\n\n  // Data layer\n  ['data', '**/lib/repositories/**', 0.9],\n  ['data', '**/lib/data/**', 0.85],\n  ['data', '**/lib/datasources/**', 0.9],\n  ['data', '**/lib/models/**', 0.85],\n  ['data', '**/lib/entities/**', 0.85],\n  ['data', '**/lib/domain/**', 0.8],\n\n  // Shared / Infrastructure layer\n  ['shared', '**/lib/core/**', 0.85],\n  ['shared', '**/lib/utils/**', 0.85],\n  ['shared', '**/lib/helpers/**', 0.85],\n  ['shared', '**/lib/extensions/**', 0.85],\n  ['shared', '**/lib/constants/**', 0.8],\n\n  // API / Navigation layer\n  ['api', '**/lib/routes/**', 0.9],\n  ['api', '**/lib/navigation/**', 0.85],\n  ['api', '**/lib/router/**', 0.85],\n  ['api', '**/lib/main.dart', 0.8],\n  ['api', '**/lib/app.dart', 0.8],\n];\n\nconst TEST_PATTERN = picomatch('**/test/**');\n\nexport const dartLayerDetector: LayerDetector = {\n  language: 'dart',\n\n  async detect(files: string[], _projectRoot: string, configLayers?: Record<string, string[]>): Promise<ArchLayerMatch[]> {\n    const results: ArchLayerMatch[] = [];\n    const configMatchers = _buildConfigMatchers(configLayers ?? {});\n\n    for (const file of files) {\n      if (!file.endsWith('.dart')) continue;\n\n      // Skip test files\n      if (TEST_PATTERN(file)) continue;\n\n      const configMatch = _matchConfig(file, configMatchers);\n      if (configMatch) {\n        results.push({ ...configMatch, filePath: file });\n        continue;\n      }\n\n      let best: ArchLayerMatch | null = null;\n      for (const [layerName, pattern, confidence] of LAYER_PATTERNS) {\n        if (picomatch(pattern)(file)) {\n          if (!best || confidence > best.confidence) {\n            best = { layerName, filePath: file, confidence, matchedPattern: pattern };\n          }\n        }\n      }\n      if (best) results.push(best);\n    }\n\n    return results;\n  },\n};\n\nfunction _buildConfigMatchers(configLayers: Record<string, string[]>): Array<[string, ReturnType<typeof picomatch>, string]> {\n  return Object.entries(configLayers).flatMap(([layerName, patterns]) =>\n    patterns.map((pattern): [string, ReturnType<typeof picomatch>, string] =>\n      [layerName, picomatch(pattern), pattern]\n    )\n  );\n}\n\nfunction _matchConfig(\n  file: string,\n  matchers: Array<[string, ReturnType<typeof picomatch>, string]>\n): Omit<ArchLayerMatch, 'filePath'> | null {\n  for (const [layerName, matcher, pattern] of matchers) {\n    if (matcher(file)) return { layerName, confidence: 1.0, matchedPattern: `config:${pattern}` };\n  }\n  return null;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,uBAAsB;AAGtB,MAAM,iBAAkD;AAAA;AAAA,EAEtD,CAAC,MAAM,qBAAqB,GAAG;AAAA,EAC/B,CAAC,MAAM,mBAAmB,GAAG;AAAA,EAC7B,CAAC,MAAM,mBAAmB,IAAI;AAAA,EAC9B,CAAC,MAAM,qBAAqB,GAAG;AAAA,EAC/B,CAAC,MAAM,wBAAwB,IAAI;AAAA;AAAA,EAGnC,CAAC,WAAW,sBAAsB,GAAG;AAAA,EACrC,CAAC,WAAW,uBAAuB,IAAI;AAAA,EACvC,CAAC,WAAW,mBAAmB,GAAG;AAAA,EAClC,CAAC,WAAW,oBAAoB,GAAG;AAAA,EACnC,CAAC,WAAW,uBAAuB,IAAI;AAAA;AAAA,EAGvC,CAAC,QAAQ,0BAA0B,GAAG;AAAA,EACtC,CAAC,QAAQ,kBAAkB,IAAI;AAAA,EAC/B,CAAC,QAAQ,yBAAyB,GAAG;AAAA,EACrC,CAAC,QAAQ,oBAAoB,IAAI;AAAA,EACjC,CAAC,QAAQ,sBAAsB,IAAI;AAAA,EACnC,CAAC,QAAQ,oBAAoB,GAAG;AAAA;AAAA,EAGhC,CAAC,UAAU,kBAAkB,IAAI;AAAA,EACjC,CAAC,UAAU,mBAAmB,IAAI;AAAA,EAClC,CAAC,UAAU,qBAAqB,IAAI;AAAA,EACpC,CAAC,UAAU,wBAAwB,IAAI;AAAA,EACvC,CAAC,UAAU,uBAAuB,GAAG;AAAA;AAAA,EAGrC,CAAC,OAAO,oBAAoB,GAAG;AAAA,EAC/B,CAAC,OAAO,wBAAwB,IAAI;AAAA,EACpC,CAAC,OAAO,oBAAoB,IAAI;AAAA,EAChC,CAAC,OAAO,oBAAoB,GAAG;AAAA,EAC/B,CAAC,OAAO,mBAAmB,GAAG;AAChC;AAEA,MAAM,mBAAe,iBAAAA,SAAU,YAAY;AAEpC,MAAM,oBAAmC;AAAA,EAC9C,UAAU;AAAA,EAEV,MAAM,OAAO,OAAiB,cAAsB,cAAoE;AACtH,UAAM,UAA4B,CAAC;AACnC,UAAM,iBAAiB,qBAAqB,gBAAgB,CAAC,CAAC;AAE9D,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,KAAK,SAAS,OAAO,EAAG;AAG7B,UAAI,aAAa,IAAI,EAAG;AAExB,YAAM,cAAc,aAAa,MAAM,cAAc;AACrD,UAAI,aAAa;AACf,gBAAQ,KAAK,EAAE,GAAG,aAAa,UAAU,KAAK,CAAC;AAC/C;AAAA,MACF;AAEA,UAAI,OAA8B;AAClC,iBAAW,CAAC,WAAW,SAAS,UAAU,KAAK,gBAAgB;AAC7D,gBAAI,iBAAAA,SAAU,OAAO,EAAE,IAAI,GAAG;AAC5B,cAAI,CAAC,QAAQ,aAAa,KAAK,YAAY;AACzC,mBAAO,EAAE,WAAW,UAAU,MAAM,YAAY,gBAAgB,QAAQ;AAAA,UAC1E;AAAA,QACF;AAAA,MACF;AACA,UAAI,KAAM,SAAQ,KAAK,IAAI;AAAA,IAC7B;AAEA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,cAA+F;AAC3H,SAAO,OAAO,QAAQ,YAAY,EAAE;AAAA,IAAQ,CAAC,CAAC,WAAW,QAAQ,MAC/D,SAAS;AAAA,MAAI,CAAC,YACZ,CAAC,eAAW,iBAAAA,SAAU,OAAO,GAAG,OAAO;AAAA,IACzC;AAAA,EACF;AACF;AAEA,SAAS,aACP,MACA,UACyC;AACzC,aAAW,CAAC,WAAW,SAAS,OAAO,KAAK,UAAU;AACpD,QAAI,QAAQ,IAAI,EAAG,QAAO,EAAE,WAAW,YAAY,GAAK,gBAAgB,UAAU,OAAO,GAAG;AAAA,EAC9F;AACA,SAAO;AACT;",
+  "names": ["picomatch"]
+}

package/dist/architecture/layers/index.js

@@ -36,6 +36,7 @@ var import_scala = require("./scala");
 var import_vue = require("./vue");
 var import_solidity = require("./solidity");
 var import_ocaml = require("./ocaml");
+var import_dart = require("./dart");
 const LAYER_DETECTORS = [
   import_typescript.typescriptLayerDetector,
   import_python.pythonLayerDetector,
@@ -48,7 +49,8 @@ const LAYER_DETECTORS = [
   import_scala.scalaLayerDetector,
   import_vue.vueLayerDetector,
   import_solidity.solidityLayerDetector,
-  import_ocaml.ocamlLayerDetector
+  import_ocaml.ocamlLayerDetector,
+  import_dart.dartLayerDetector
 ];
 function getAllLayerDetectors() {
   return LAYER_DETECTORS;

package/dist/architecture/layers/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/architecture/layers/index.ts"],
-  "sourcesContent": ["/**\n * Layer Detector Registry\n *\n * Dispatches layer detection to language-specific detectors.\n * Config-defined layers always win over auto-detection.\n */\nimport type { LayerDetector, ArchLayerMatch, ArchLayer } from '../types';\nimport { typescriptLayerDetector } from './typescript';\nimport { pythonLayerDetector } from './python';\nimport { goLayerDetector } from './go';\nimport { javaLayerDetector } from './java';\nimport { rubyLayerDetector } from './ruby';\nimport { rustLayerDetector } from './rust';\nimport { csharpLayerDetector } from './csharp';\nimport { elixirLayerDetector } from './elixir';\nimport { scalaLayerDetector } from './scala';\nimport { vueLayerDetector } from './vue';\nimport { solidityLayerDetector } from './solidity';\nimport { ocamlLayerDetector } from './ocaml';\n\nconst LAYER_DETECTORS: LayerDetector[] = [\n  typescriptLayerDetector,\n  pythonLayerDetector,\n  goLayerDetector,\n  javaLayerDetector,\n  rubyLayerDetector,\n  rustLayerDetector,\n  csharpLayerDetector,\n  elixirLayerDetector,\n  scalaLayerDetector,\n  vueLayerDetector,\n  solidityLayerDetector,\n  ocamlLayerDetector,\n];\n\nexport function getAllLayerDetectors(): LayerDetector[] {\n  return LAYER_DETECTORS;\n}\n\nexport function registerLayerDetector(detector: LayerDetector): void {\n  const idx = LAYER_DETECTORS.findIndex(d => d.language === detector.language && d.framework === detector.framework);\n  if (idx >= 0) LAYER_DETECTORS[idx] = detector;\n  else LAYER_DETECTORS.push(detector);\n}\n\nexport interface FileLayerAssignment {\n  filePath: string;\n  layerName: string;\n  confidence: number;\n  matchedPattern: string;\n}\n\n/**\n * Run all language-specific layer detectors against the file list.\n * Each file gets at most one layer assignment (highest confidence wins).\n * Config-defined layers (confidence=1.0) always beat auto-detected ones.\n *\n * @param files - relative file paths (from project root)\n * @param projectRoot - absolute project root path\n * @param configLayers - user-defined layer\u2192glob overrides from config\n */\nexport async function detectAllLayers(\n  files: string[],\n  projectRoot: string,\n  configLayers?: Record<string, string[]>\n): Promise<FileLayerAssignment[]> {\n  // Collect all matches from all detectors\n  const allMatches: ArchLayerMatch[] = [];\n  for (const detector of LAYER_DETECTORS) {\n    const matches = await detector.detect(files, projectRoot, configLayers);\n    allMatches.push(...matches);\n  }\n\n  // Per file, keep the highest-confidence match\n  const best = new Map<string, ArchLayerMatch>();\n  for (const match of allMatches) {\n    const existing = best.get(match.filePath);\n    if (!existing || match.confidence > existing.confidence) {\n      best.set(match.filePath, match);\n    }\n  }\n\n  return [...best.values()].map(m => ({\n    filePath: m.filePath,\n    layerName: m.layerName,\n    confidence: m.confidence,\n    matchedPattern: m.matchedPattern,\n  }));\n}\n\n/**\n * From a list of FileLayerAssignment, derive the unique ArchLayer records.\n */\nexport function buildArchLayers(\n  assignments: FileLayerAssignment[],\n  configLayers?: Record<string, string[]>\n): ArchLayer[] {\n  const layerMap = new Map<string, ArchLayer>();\n\n  for (const a of assignments) {\n    if (!layerMap.has(a.layerName)) {\n      const isConfig = configLayers && a.layerName in configLayers;\n      layerMap.set(a.layerName, {\n        id: `layer:${a.layerName}`,\n        name: a.layerName,\n        source: isConfig ? 'config' : 'auto',\n        patterns: [],\n        updatedAt: Date.now(),\n      });\n    }\n    const layer = layerMap.get(a.layerName)!;\n    if (!layer.patterns.includes(a.matchedPattern)) {\n      layer.patterns.push(a.matchedPattern);\n    }\n  }\n\n  return [...layerMap.values()];\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,wBAAwC;AACxC,oBAAoC;AACpC,gBAAgC;AAChC,kBAAkC;AAClC,kBAAkC;AAClC,kBAAkC;AAClC,oBAAoC;AACpC,oBAAoC;AACpC,mBAAmC;AACnC,iBAAiC;AACjC,sBAAsC;AACtC,mBAAmC;AAEnC,MAAM,kBAAmC;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,uBAAwC;AACtD,SAAO;AACT;AAEO,SAAS,sBAAsB,UAA+B;AACnE,QAAM,MAAM,gBAAgB,UAAU,OAAK,EAAE,aAAa,SAAS,YAAY,EAAE,cAAc,SAAS,SAAS;AACjH,MAAI,OAAO,EAAG,iBAAgB,GAAG,IAAI;AAAA,MAChC,iBAAgB,KAAK,QAAQ;AACpC;AAkBA,eAAsB,gBACpB,OACA,aACA,cACgC;AAEhC,QAAM,aAA+B,CAAC;AACtC,aAAW,YAAY,iBAAiB;AACtC,UAAM,UAAU,MAAM,SAAS,OAAO,OAAO,aAAa,YAAY;AACtE,eAAW,KAAK,GAAG,OAAO;AAAA,EAC5B;AAGA,QAAM,OAAO,oBAAI,IAA4B;AAC7C,aAAW,SAAS,YAAY;AAC9B,UAAM,WAAW,KAAK,IAAI,MAAM,QAAQ;AACxC,QAAI,CAAC,YAAY,MAAM,aAAa,SAAS,YAAY;AACvD,WAAK,IAAI,MAAM,UAAU,KAAK;AAAA,IAChC;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,IAAI,QAAM;AAAA,IAClC,UAAU,EAAE;AAAA,IACZ,WAAW,EAAE;AAAA,IACb,YAAY,EAAE;AAAA,IACd,gBAAgB,EAAE;AAAA,EACpB,EAAE;AACJ;AAKO,SAAS,gBACd,aACA,cACa;AACb,QAAM,WAAW,oBAAI,IAAuB;AAE5C,aAAW,KAAK,aAAa;AAC3B,QAAI,CAAC,SAAS,IAAI,EAAE,SAAS,GAAG;AAC9B,YAAM,WAAW,gBAAgB,EAAE,aAAa;AAChD,eAAS,IAAI,EAAE,WAAW;AAAA,QACxB,IAAI,SAAS,EAAE,SAAS;AAAA,QACxB,MAAM,EAAE;AAAA,QACR,QAAQ,WAAW,WAAW;AAAA,QAC9B,UAAU,CAAC;AAAA,QACX,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,SAAS,IAAI,EAAE,SAAS;AACtC,QAAI,CAAC,MAAM,SAAS,SAAS,EAAE,cAAc,GAAG;AAC9C,YAAM,SAAS,KAAK,EAAE,cAAc;AAAA,IACtC;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,SAAS,OAAO,CAAC;AAC9B;",
+  "sourcesContent": ["/**\n * Layer Detector Registry\n *\n * Dispatches layer detection to language-specific detectors.\n * Config-defined layers always win over auto-detection.\n */\nimport type { LayerDetector, ArchLayerMatch, ArchLayer } from '../types';\nimport { typescriptLayerDetector } from './typescript';\nimport { pythonLayerDetector } from './python';\nimport { goLayerDetector } from './go';\nimport { javaLayerDetector } from './java';\nimport { rubyLayerDetector } from './ruby';\nimport { rustLayerDetector } from './rust';\nimport { csharpLayerDetector } from './csharp';\nimport { elixirLayerDetector } from './elixir';\nimport { scalaLayerDetector } from './scala';\nimport { vueLayerDetector } from './vue';\nimport { solidityLayerDetector } from './solidity';\nimport { ocamlLayerDetector } from './ocaml';\nimport { dartLayerDetector } from './dart';\n\nconst LAYER_DETECTORS: LayerDetector[] = [\n  typescriptLayerDetector,\n  pythonLayerDetector,\n  goLayerDetector,\n  javaLayerDetector,\n  rubyLayerDetector,\n  rustLayerDetector,\n  csharpLayerDetector,\n  elixirLayerDetector,\n  scalaLayerDetector,\n  vueLayerDetector,\n  solidityLayerDetector,\n  ocamlLayerDetector,\n  dartLayerDetector,\n];\n\nexport function getAllLayerDetectors(): LayerDetector[] {\n  return LAYER_DETECTORS;\n}\n\nexport function registerLayerDetector(detector: LayerDetector): void {\n  const idx = LAYER_DETECTORS.findIndex(d => d.language === detector.language && d.framework === detector.framework);\n  if (idx >= 0) LAYER_DETECTORS[idx] = detector;\n  else LAYER_DETECTORS.push(detector);\n}\n\nexport interface FileLayerAssignment {\n  filePath: string;\n  layerName: string;\n  confidence: number;\n  matchedPattern: string;\n}\n\n/**\n * Run all language-specific layer detectors against the file list.\n * Each file gets at most one layer assignment (highest confidence wins).\n * Config-defined layers (confidence=1.0) always beat auto-detected ones.\n *\n * @param files - relative file paths (from project root)\n * @param projectRoot - absolute project root path\n * @param configLayers - user-defined layer\u2192glob overrides from config\n */\nexport async function detectAllLayers(\n  files: string[],\n  projectRoot: string,\n  configLayers?: Record<string, string[]>\n): Promise<FileLayerAssignment[]> {\n  // Collect all matches from all detectors\n  const allMatches: ArchLayerMatch[] = [];\n  for (const detector of LAYER_DETECTORS) {\n    const matches = await detector.detect(files, projectRoot, configLayers);\n    allMatches.push(...matches);\n  }\n\n  // Per file, keep the highest-confidence match\n  const best = new Map<string, ArchLayerMatch>();\n  for (const match of allMatches) {\n    const existing = best.get(match.filePath);\n    if (!existing || match.confidence > existing.confidence) {\n      best.set(match.filePath, match);\n    }\n  }\n\n  return [...best.values()].map(m => ({\n    filePath: m.filePath,\n    layerName: m.layerName,\n    confidence: m.confidence,\n    matchedPattern: m.matchedPattern,\n  }));\n}\n\n/**\n * From a list of FileLayerAssignment, derive the unique ArchLayer records.\n */\nexport function buildArchLayers(\n  assignments: FileLayerAssignment[],\n  configLayers?: Record<string, string[]>\n): ArchLayer[] {\n  const layerMap = new Map<string, ArchLayer>();\n\n  for (const a of assignments) {\n    if (!layerMap.has(a.layerName)) {\n      const isConfig = configLayers && a.layerName in configLayers;\n      layerMap.set(a.layerName, {\n        id: `layer:${a.layerName}`,\n        name: a.layerName,\n        source: isConfig ? 'config' : 'auto',\n        patterns: [],\n        updatedAt: Date.now(),\n      });\n    }\n    const layer = layerMap.get(a.layerName)!;\n    if (!layer.patterns.includes(a.matchedPattern)) {\n      layer.patterns.push(a.matchedPattern);\n    }\n  }\n\n  return [...layerMap.values()];\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,wBAAwC;AACxC,oBAAoC;AACpC,gBAAgC;AAChC,kBAAkC;AAClC,kBAAkC;AAClC,kBAAkC;AAClC,oBAAoC;AACpC,oBAAoC;AACpC,mBAAmC;AACnC,iBAAiC;AACjC,sBAAsC;AACtC,mBAAmC;AACnC,kBAAkC;AAElC,MAAM,kBAAmC;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,uBAAwC;AACtD,SAAO;AACT;AAEO,SAAS,sBAAsB,UAA+B;AACnE,QAAM,MAAM,gBAAgB,UAAU,OAAK,EAAE,aAAa,SAAS,YAAY,EAAE,cAAc,SAAS,SAAS;AACjH,MAAI,OAAO,EAAG,iBAAgB,GAAG,IAAI;AAAA,MAChC,iBAAgB,KAAK,QAAQ;AACpC;AAkBA,eAAsB,gBACpB,OACA,aACA,cACgC;AAEhC,QAAM,aAA+B,CAAC;AACtC,aAAW,YAAY,iBAAiB;AACtC,UAAM,UAAU,MAAM,SAAS,OAAO,OAAO,aAAa,YAAY;AACtE,eAAW,KAAK,GAAG,OAAO;AAAA,EAC5B;AAGA,QAAM,OAAO,oBAAI,IAA4B;AAC7C,aAAW,SAAS,YAAY;AAC9B,UAAM,WAAW,KAAK,IAAI,MAAM,QAAQ;AACxC,QAAI,CAAC,YAAY,MAAM,aAAa,SAAS,YAAY;AACvD,WAAK,IAAI,MAAM,UAAU,KAAK;AAAA,IAChC;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,KAAK,OAAO,CAAC,EAAE,IAAI,QAAM;AAAA,IAClC,UAAU,EAAE;AAAA,IACZ,WAAW,EAAE;AAAA,IACb,YAAY,EAAE;AAAA,IACd,gBAAgB,EAAE;AAAA,EACpB,EAAE;AACJ;AAKO,SAAS,gBACd,aACA,cACa;AACb,QAAM,WAAW,oBAAI,IAAuB;AAE5C,aAAW,KAAK,aAAa;AAC3B,QAAI,CAAC,SAAS,IAAI,EAAE,SAAS,GAAG;AAC9B,YAAM,WAAW,gBAAgB,EAAE,aAAa;AAChD,eAAS,IAAI,EAAE,WAAW;AAAA,QACxB,IAAI,SAAS,EAAE,SAAS;AAAA,QACxB,MAAM,EAAE;AAAA,QACR,QAAQ,WAAW,WAAW;AAAA,QAC9B,UAAU,CAAC;AAAA,QACX,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,SAAS,IAAI,EAAE,SAAS;AACtC,QAAI,CAAC,MAAM,SAAS,SAAS,EAAE,cAAc,GAAG;AAC9C,YAAM,SAAS,KAAK,EAAE,cAAc;AAAA,IACtC;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,SAAS,OAAO,CAAC;AAC9B;",
   "names": []
 }

package/dist/bin/banner.js

@@ -33,6 +33,7 @@ const c = {
   white: "\x1B[97m"
 };
 const TIPS = [
+  // Core graph
   `Run ${c.cyan}kirograph context "your task"${c.reset} to get relevant code
   in one shot \u2014 no file scanning needed.`,
   `Use ${c.cyan}kirograph query <name>${c.reset} instead of grep.
@@ -41,14 +42,81 @@ const TIPS = [
   that depends on a changed file \u2014 great for CI.`,
   `${c.cyan}kirograph files --format grouped${c.reset} shows your project
   structure grouped by language from the index.`,
-  `${c.cyan}kirograph impact <symbol>${c.reset} shows the blast radius
-  before you change anything.`,
-  `Run ${c.cyan}kirograph install${c.reset} once per Kiro workspace to wire up
-  MCP, auto-sync hooks, and steering automatically.`,
+  `${c.cyan}kirograph path LoginController DatabasePool${c.reset}
+  finds the shortest connection between any two symbols.`,
+  `${c.cyan}kirograph hotspots${c.reset} ranks symbols by edge degree \u2014
+  the top results are the riskiest to change.`,
+  `${c.cyan}kirograph surprising${c.reset} surfaces hidden cross-module coupling
+  you didn't know existed.`,
+  `${c.cyan}kirograph dead-code${c.reset} lists unexported symbols with zero
+  incoming references \u2014 safe candidates for deletion.`,
+  `${c.cyan}kirograph snapshot save pre-refactor${c.reset} then
+  ${c.cyan}kirograph snapshot diff pre-refactor${c.reset} after \u2014 structural changelog.`,
+  `Pipe git diff into kirograph:
+  ${c.cyan}git diff --name-only | kirograph affected --stdin${c.reset}`,
+  // Indexing
   `${c.cyan}kirograph sync${c.reset} is incremental \u2014 it only re-parses
   files whose content has changed since last index.`,
-  `Pipe git diff into kirograph:
-  ${c.cyan}git diff --name-only | kirograph affected --stdin${c.reset}`
+  `${c.cyan}kirograph sync-if-dirty${c.reset} is safe to call on every agent stop \u2014
+  it's a no-op when nothing changed.`,
+  `Run ${c.cyan}kirograph install${c.reset} once per workspace to wire up
+  MCP, auto-sync hooks, and steering automatically.`,
+  // Architecture
+  `${c.cyan}kirograph coupling --sort instability${c.reset} shows which packages
+  are most volatile and risky to depend on.`,
+  `${c.cyan}kirograph architecture${c.reset} detects packages and layers (api/service/
+  data/ui/shared) without any config \u2014 just enable it.`,
+  `${c.cyan}kirograph package src/auth${c.reset} shows incoming dependents,
+  outgoing deps, and files in one call.`,
+  // Security
+  `${c.cyan}kirograph security${c.reset} gives an instant vulnerability overview \u2014
+  dep count, CVEs, verdict breakdown, stale warnings.`,
+  `${c.cyan}kirograph vulns --verdict affected${c.reset} filters to only CVEs
+  with a confirmed reachable call path from your entry points.`,
+  `${c.cyan}kirograph vulns --epss 0.5${c.reset} shows only vulnerabilities
+  with >= 50% exploitation probability \u2014 EPSS beats CVSS for triage.`,
+  `${c.cyan}kirograph reachability CVE-2024-1234${c.reset} shows the exact
+  call path from your entry points to the vulnerable dependency.`,
+  `${c.cyan}kirograph licenses --policy${c.reset} flags dependencies that violate
+  your configured SPDX license policy (deny/warn lists).`,
+  `${c.cyan}kirograph staleness --threshold 0.7${c.reset} identifies dependencies
+  that are significantly behind their latest published version.`,
+  `${c.cyan}kirograph sbom --output sbom.json${c.reset} exports a CycloneDX 1.5
+  SBOM \u2014 parent directory is created automatically if missing.`,
+  `${c.cyan}kirograph vex --output vex.json${c.reset} exports a VEX document
+  with reachability-derived analysis states for each CVE.`,
+  // Memory
+  `${c.cyan}kirograph mem search "auth decision"${c.reset} recalls past observations
+  using hybrid FTS + vector search across all sessions.`,
+  `${c.cyan}kirograph mem store "..." --kind decision${c.reset} saves an observation
+  linked to relevant code symbols automatically.`,
+  `${c.cyan}kirograph mem timeline${c.reset} shows recent sessions and what
+  the agent observed \u2014 great for onboarding after a break.`,
+  // Docs & Data
+  `${c.cyan}kirograph docs search "authentication"${c.reset} searches indexed
+  documentation sections \u2014 faster than reading full files.`,
+  `${c.cyan}kirograph data describe orders${c.reset} gives full schema profile
+  without loading a single data row into context.`,
+  `${c.cyan}kirograph data aggregate orders --group-by region --metric sum:amount${c.reset}
+  runs GROUP BY server-side \u2014 only results enter context.`,
+  // Export & token tools
+  `${c.cyan}kirograph export start${c.reset} opens an interactive graph dashboard
+  in your browser \u2014 search, path-find, cluster, heat map.`,
+  `${c.cyan}kirograph exec "npm test"${c.reset} compresses test output by 80-90% \u2014
+  you get pass/fail and errors, not thousands of lines of noise.`,
+  `${c.cyan}kirograph gain --graph${c.reset} shows your cumulative token savings
+  from graph tools and shell compression over time.`,
+  // Workflow files
+  `Type ${c.cyan}/kirograph-security${c.reset} in Kiro to activate a step-by-step
+  security audit workflow with CVE triage and EPSS guidance.`,
+  `Type ${c.cyan}/kirograph-review${c.reset} in Kiro for a structured code review:
+  blast radius, test coverage, surprising coupling.`,
+  `Type ${c.cyan}/kirograph-refactor${c.reset} in Kiro before any major refactor \u2014
+  it guides you through blast radius, rename preview, and diff verify.`,
+  `Type ${c.cyan}/kirograph-debug${c.reset} in Kiro to trace a bug systematically:
+  callers, callees, recent diff, root cause analysis.`,
+  `Type ${c.cyan}/kirograph-architecture${c.reset} in Kiro for a full architecture
+  exploration: packages, layers, coupling, hidden cycles.`
 ];
 function pickTip() {
   const idx = Math.floor(Date.now() / 864e5) % TIPS.length;

package/dist/bin/banner.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/bin/banner.ts"],
-  "sourcesContent": ["/**\n * KiroGraph CLI Banner\n * Displays the KIROGRAPH ASCII art header and a rotating \"Did you know?\" tip.\n */\n\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst figlet = require('figlet');\n\n// ANSI color helpers (no external deps)\nconst c = {\n  reset:  '\\x1b[0m',\n  bold:   '\\x1b[1m',\n  dim:    '\\x1b[2m',\n  purple: '\\x1b[38;5;135m',\n  violet: '\\x1b[38;5;99m',\n  cyan:   '\\x1b[38;5;117m',\n  gray:   '\\x1b[90m',\n  white:  '\\x1b[97m',\n};\n\nconst TIPS = [\n  `Run ${c.cyan}kirograph context \"your task\"${c.reset} to get relevant code\\n  in one shot \u2014 no file scanning needed.`,\n  `Use ${c.cyan}kirograph query <name>${c.reset} instead of grep.\\n  It searches the symbol index instantly.`,\n  `${c.cyan}kirograph affected src/foo.ts${c.reset} finds every test file\\n  that depends on a changed file \u2014 great for CI.`,\n  `${c.cyan}kirograph files --format grouped${c.reset} shows your project\\n  structure grouped by language from the index.`,\n  `${c.cyan}kirograph impact <symbol>${c.reset} shows the blast radius\\n  before you change anything.`,\n  `Run ${c.cyan}kirograph install${c.reset} once per Kiro workspace to wire up\\n  MCP, auto-sync hooks, and steering automatically.`,\n  `${c.cyan}kirograph sync${c.reset} is incremental \u2014 it only re-parses\\n  files whose content has changed since last index.`,\n  `Pipe git diff into kirograph:\\n  ${c.cyan}git diff --name-only | kirograph affected --stdin${c.reset}`,\n];\n\nfunction pickTip(): string {\n  // Rotate daily so it feels fresh but is deterministic\n  const idx = Math.floor(Date.now() / 86_400_000) % TIPS.length;\n  return TIPS[idx];\n}\n\nfunction boxed(text: string, width = 70): string {\n  const lines = text.split('\\n');\n  const top    = `${c.gray}\u250C${'\u2500'.repeat(width - 2)}\u2510${c.reset}`;\n  const bottom = `${c.gray}\u2514${'\u2500'.repeat(width - 2)}\u2518${c.reset}`;\n  const padded = lines.map(l => {\n    // Strip ANSI for length calculation\n    const plain = l.replace(/\\x1b\\[[0-9;]*m/g, '');\n    const pad = Math.max(0, width - 4 - plain.length);\n    return `${c.gray}\u2502${c.reset}  ${l}${' '.repeat(pad)}  ${c.gray}\u2502${c.reset}`;\n  });\n  return [top, ...padded, bottom].join('\\n');\n}\n\nexport function printBanner(): void {\n  // ASCII art title\n  const art: string = figlet.textSync('KIROGRAPH', { font: 'ANSI Shadow' });\n\n  // Colorize each line of the art in purple/violet gradient\n  const artLines = art.split('\\n');\n  const colored = artLines.map((line, i) => {\n    const color = i < artLines.length / 2 ? c.purple : c.violet;\n    return `${color}${line}${c.reset}`;\n  }).join('\\n');\n\n  console.log('\\n' + colored);\n\n  // Subtitle\n  console.log(`${c.dim}  Semantic code knowledge graph for Kiro \u2014 100% local${c.reset}`);\n  console.log(`${c.dim}  Inspired by CodeGraph \u2014 original idea by ${c.reset}${c.violet}github.com/colbymchenry${c.reset}\\n`);\n\n  // Did you know box\n  const label = `${c.gray}\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 ${c.reset}${c.bold}${c.white}Did you know?${c.reset}${c.gray} \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${c.reset}`;\n  console.log(label);\n  console.log(boxed(pickTip()));\n  console.log();\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,MAAM,SAAS,QAAQ,QAAQ;AAG/B,MAAM,IAAI;AAAA,EACR,OAAQ;AAAA,EACR,MAAQ;AAAA,EACR,KAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,OAAQ;AACV;AAEA,MAAM,OAAO;AAAA,EACX,OAAO,EAAE,IAAI,gCAAgC,EAAE,KAAK;AAAA;AAAA,EACpD,OAAO,EAAE,IAAI,yBAAyB,EAAE,KAAK;AAAA;AAAA,EAC7C,GAAG,EAAE,IAAI,gCAAgC,EAAE,KAAK;AAAA;AAAA,EAChD,GAAG,EAAE,IAAI,mCAAmC,EAAE,KAAK;AAAA;AAAA,EACnD,GAAG,EAAE,IAAI,4BAA4B,EAAE,KAAK;AAAA;AAAA,EAC5C,OAAO,EAAE,IAAI,oBAAoB,EAAE,KAAK;AAAA;AAAA,EACxC,GAAG,EAAE,IAAI,iBAAiB,EAAE,KAAK;AAAA;AAAA,EACjC;AAAA,IAAoC,EAAE,IAAI,oDAAoD,EAAE,KAAK;AACvG;AAEA,SAAS,UAAkB;AAEzB,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,KAAU,IAAI,KAAK;AACvD,SAAO,KAAK,GAAG;AACjB;AAEA,SAAS,MAAM,MAAc,QAAQ,IAAY;AAC/C,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAM,MAAS,GAAG,EAAE,IAAI,SAAI,SAAI,OAAO,QAAQ,CAAC,CAAC,SAAI,EAAE,KAAK;AAC5D,QAAM,SAAS,GAAG,EAAE,IAAI,SAAI,SAAI,OAAO,QAAQ,CAAC,CAAC,SAAI,EAAE,KAAK;AAC5D,QAAM,SAAS,MAAM,IAAI,OAAK;AAE5B,UAAM,QAAQ,EAAE,QAAQ,mBAAmB,EAAE;AAC7C,UAAM,MAAM,KAAK,IAAI,GAAG,QAAQ,IAAI,MAAM,MAAM;AAChD,WAAO,GAAG,EAAE,IAAI,SAAI,EAAE,KAAK,KAAK,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,KAAK,EAAE,IAAI,SAAI,EAAE,KAAK;AAAA,EAC3E,CAAC;AACD,SAAO,CAAC,KAAK,GAAG,QAAQ,MAAM,EAAE,KAAK,IAAI;AAC3C;AAEO,SAAS,cAAoB;AAElC,QAAM,MAAc,OAAO,SAAS,aAAa,EAAE,MAAM,cAAc,CAAC;AAGxE,QAAM,WAAW,IAAI,MAAM,IAAI;AAC/B,QAAM,UAAU,SAAS,IAAI,CAAC,MAAM,MAAM;AACxC,UAAM,QAAQ,IAAI,SAAS,SAAS,IAAI,EAAE,SAAS,EAAE;AACrD,WAAO,GAAG,KAAK,GAAG,IAAI,GAAG,EAAE,KAAK;AAAA,EAClC,CAAC,EAAE,KAAK,IAAI;AAEZ,UAAQ,IAAI,OAAO,OAAO;AAG1B,UAAQ,IAAI,GAAG,EAAE,GAAG,6DAAwD,EAAE,KAAK,EAAE;AACrF,UAAQ,IAAI,GAAG,EAAE,GAAG,mDAA8C,EAAE,KAAK,GAAG,EAAE,MAAM,0BAA0B,EAAE,KAAK;AAAA,CAAI;AAGzH,QAAM,QAAQ,GAAG,EAAE,IAAI,8IAA2B,EAAE,KAAK,GAAG,EAAE,IAAI,GAAG,EAAE,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,IAAI,8IAA2B,EAAE,KAAK;AAC9I,UAAQ,IAAI,KAAK;AACjB,UAAQ,IAAI,MAAM,QAAQ,CAAC,CAAC;AAC5B,UAAQ,IAAI;AACd;",
+  "sourcesContent": ["/**\n * KiroGraph CLI Banner\n * Displays the KIROGRAPH ASCII art header and a rotating \"Did you know?\" tip.\n */\n\n// eslint-disable-next-line @typescript-eslint/no-require-imports\nconst figlet = require('figlet');\n\n// ANSI color helpers (no external deps)\nconst c = {\n  reset:  '\\x1b[0m',\n  bold:   '\\x1b[1m',\n  dim:    '\\x1b[2m',\n  purple: '\\x1b[38;5;135m',\n  violet: '\\x1b[38;5;99m',\n  cyan:   '\\x1b[38;5;117m',\n  gray:   '\\x1b[90m',\n  white:  '\\x1b[97m',\n};\n\nconst TIPS = [\n  // Core graph\n  `Run ${c.cyan}kirograph context \"your task\"${c.reset} to get relevant code\\n  in one shot \u2014 no file scanning needed.`,\n  `Use ${c.cyan}kirograph query <name>${c.reset} instead of grep.\\n  It searches the symbol index instantly.`,\n  `${c.cyan}kirograph affected src/foo.ts${c.reset} finds every test file\\n  that depends on a changed file \u2014 great for CI.`,\n  `${c.cyan}kirograph files --format grouped${c.reset} shows your project\\n  structure grouped by language from the index.`,\n  `${c.cyan}kirograph path LoginController DatabasePool${c.reset}\\n  finds the shortest connection between any two symbols.`,\n  `${c.cyan}kirograph hotspots${c.reset} ranks symbols by edge degree \u2014\\n  the top results are the riskiest to change.`,\n  `${c.cyan}kirograph surprising${c.reset} surfaces hidden cross-module coupling\\n  you didn't know existed.`,\n  `${c.cyan}kirograph dead-code${c.reset} lists unexported symbols with zero\\n  incoming references \u2014 safe candidates for deletion.`,\n  `${c.cyan}kirograph snapshot save pre-refactor${c.reset} then\\n  ${c.cyan}kirograph snapshot diff pre-refactor${c.reset} after \u2014 structural changelog.`,\n  `Pipe git diff into kirograph:\\n  ${c.cyan}git diff --name-only | kirograph affected --stdin${c.reset}`,\n  // Indexing\n  `${c.cyan}kirograph sync${c.reset} is incremental \u2014 it only re-parses\\n  files whose content has changed since last index.`,\n  `${c.cyan}kirograph sync-if-dirty${c.reset} is safe to call on every agent stop \u2014\\n  it's a no-op when nothing changed.`,\n  `Run ${c.cyan}kirograph install${c.reset} once per workspace to wire up\\n  MCP, auto-sync hooks, and steering automatically.`,\n  // Architecture\n  `${c.cyan}kirograph coupling --sort instability${c.reset} shows which packages\\n  are most volatile and risky to depend on.`,\n  `${c.cyan}kirograph architecture${c.reset} detects packages and layers (api/service/\\n  data/ui/shared) without any config \u2014 just enable it.`,\n  `${c.cyan}kirograph package src/auth${c.reset} shows incoming dependents,\\n  outgoing deps, and files in one call.`,\n  // Security\n  `${c.cyan}kirograph security${c.reset} gives an instant vulnerability overview \u2014\\n  dep count, CVEs, verdict breakdown, stale warnings.`,\n  `${c.cyan}kirograph vulns --verdict affected${c.reset} filters to only CVEs\\n  with a confirmed reachable call path from your entry points.`,\n  `${c.cyan}kirograph vulns --epss 0.5${c.reset} shows only vulnerabilities\\n  with >= 50% exploitation probability \u2014 EPSS beats CVSS for triage.`,\n  `${c.cyan}kirograph reachability CVE-2024-1234${c.reset} shows the exact\\n  call path from your entry points to the vulnerable dependency.`,\n  `${c.cyan}kirograph licenses --policy${c.reset} flags dependencies that violate\\n  your configured SPDX license policy (deny/warn lists).`,\n  `${c.cyan}kirograph staleness --threshold 0.7${c.reset} identifies dependencies\\n  that are significantly behind their latest published version.`,\n  `${c.cyan}kirograph sbom --output sbom.json${c.reset} exports a CycloneDX 1.5\\n  SBOM \u2014 parent directory is created automatically if missing.`,\n  `${c.cyan}kirograph vex --output vex.json${c.reset} exports a VEX document\\n  with reachability-derived analysis states for each CVE.`,\n  // Memory\n  `${c.cyan}kirograph mem search \"auth decision\"${c.reset} recalls past observations\\n  using hybrid FTS + vector search across all sessions.`,\n  `${c.cyan}kirograph mem store \"...\" --kind decision${c.reset} saves an observation\\n  linked to relevant code symbols automatically.`,\n  `${c.cyan}kirograph mem timeline${c.reset} shows recent sessions and what\\n  the agent observed \u2014 great for onboarding after a break.`,\n  // Docs & Data\n  `${c.cyan}kirograph docs search \"authentication\"${c.reset} searches indexed\\n  documentation sections \u2014 faster than reading full files.`,\n  `${c.cyan}kirograph data describe orders${c.reset} gives full schema profile\\n  without loading a single data row into context.`,\n  `${c.cyan}kirograph data aggregate orders --group-by region --metric sum:amount${c.reset}\\n  runs GROUP BY server-side \u2014 only results enter context.`,\n  // Export & token tools\n  `${c.cyan}kirograph export start${c.reset} opens an interactive graph dashboard\\n  in your browser \u2014 search, path-find, cluster, heat map.`,\n  `${c.cyan}kirograph exec \"npm test\"${c.reset} compresses test output by 80-90% \u2014\\n  you get pass/fail and errors, not thousands of lines of noise.`,\n  `${c.cyan}kirograph gain --graph${c.reset} shows your cumulative token savings\\n  from graph tools and shell compression over time.`,\n  // Workflow files\n  `Type ${c.cyan}/kirograph-security${c.reset} in Kiro to activate a step-by-step\\n  security audit workflow with CVE triage and EPSS guidance.`,\n  `Type ${c.cyan}/kirograph-review${c.reset} in Kiro for a structured code review:\\n  blast radius, test coverage, surprising coupling.`,\n  `Type ${c.cyan}/kirograph-refactor${c.reset} in Kiro before any major refactor \u2014\\n  it guides you through blast radius, rename preview, and diff verify.`,\n  `Type ${c.cyan}/kirograph-debug${c.reset} in Kiro to trace a bug systematically:\\n  callers, callees, recent diff, root cause analysis.`,\n  `Type ${c.cyan}/kirograph-architecture${c.reset} in Kiro for a full architecture\\n  exploration: packages, layers, coupling, hidden cycles.`,\n];\n\nfunction pickTip(): string {\n  // Rotate daily so it feels fresh but is deterministic\n  const idx = Math.floor(Date.now() / 86_400_000) % TIPS.length;\n  return TIPS[idx];\n}\n\nfunction boxed(text: string, width = 70): string {\n  const lines = text.split('\\n');\n  const top    = `${c.gray}\u250C${'\u2500'.repeat(width - 2)}\u2510${c.reset}`;\n  const bottom = `${c.gray}\u2514${'\u2500'.repeat(width - 2)}\u2518${c.reset}`;\n  const padded = lines.map(l => {\n    // Strip ANSI for length calculation\n    const plain = l.replace(/\\x1b\\[[0-9;]*m/g, '');\n    const pad = Math.max(0, width - 4 - plain.length);\n    return `${c.gray}\u2502${c.reset}  ${l}${' '.repeat(pad)}  ${c.gray}\u2502${c.reset}`;\n  });\n  return [top, ...padded, bottom].join('\\n');\n}\n\nexport function printBanner(): void {\n  // ASCII art title\n  const art: string = figlet.textSync('KIROGRAPH', { font: 'ANSI Shadow' });\n\n  // Colorize each line of the art in purple/violet gradient\n  const artLines = art.split('\\n');\n  const colored = artLines.map((line, i) => {\n    const color = i < artLines.length / 2 ? c.purple : c.violet;\n    return `${color}${line}${c.reset}`;\n  }).join('\\n');\n\n  console.log('\\n' + colored);\n\n  // Subtitle\n  console.log(`${c.dim}  Semantic code knowledge graph for Kiro \u2014 100% local${c.reset}`);\n  console.log(`${c.dim}  Inspired by CodeGraph \u2014 original idea by ${c.reset}${c.violet}github.com/colbymchenry${c.reset}\\n`);\n\n  // Did you know box\n  const label = `${c.gray}\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 ${c.reset}${c.bold}${c.white}Did you know?${c.reset}${c.gray} \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500${c.reset}`;\n  console.log(label);\n  console.log(boxed(pickTip()));\n  console.log();\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,MAAM,SAAS,QAAQ,QAAQ;AAG/B,MAAM,IAAI;AAAA,EACR,OAAQ;AAAA,EACR,MAAQ;AAAA,EACR,KAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAQ;AAAA,EACR,MAAQ;AAAA,EACR,OAAQ;AACV;AAEA,MAAM,OAAO;AAAA;AAAA,EAEX,OAAO,EAAE,IAAI,gCAAgC,EAAE,KAAK;AAAA;AAAA,EACpD,OAAO,EAAE,IAAI,yBAAyB,EAAE,KAAK;AAAA;AAAA,EAC7C,GAAG,EAAE,IAAI,gCAAgC,EAAE,KAAK;AAAA;AAAA,EAChD,GAAG,EAAE,IAAI,mCAAmC,EAAE,KAAK;AAAA;AAAA,EACnD,GAAG,EAAE,IAAI,8CAA8C,EAAE,KAAK;AAAA;AAAA,EAC9D,GAAG,EAAE,IAAI,qBAAqB,EAAE,KAAK;AAAA;AAAA,EACrC,GAAG,EAAE,IAAI,uBAAuB,EAAE,KAAK;AAAA;AAAA,EACvC,GAAG,EAAE,IAAI,sBAAsB,EAAE,KAAK;AAAA;AAAA,EACtC,GAAG,EAAE,IAAI,uCAAuC,EAAE,KAAK;AAAA,IAAY,EAAE,IAAI,uCAAuC,EAAE,KAAK;AAAA,EACvH;AAAA,IAAoC,EAAE,IAAI,oDAAoD,EAAE,KAAK;AAAA;AAAA,EAErG,GAAG,EAAE,IAAI,iBAAiB,EAAE,KAAK;AAAA;AAAA,EACjC,GAAG,EAAE,IAAI,0BAA0B,EAAE,KAAK;AAAA;AAAA,EAC1C,OAAO,EAAE,IAAI,oBAAoB,EAAE,KAAK;AAAA;AAAA;AAAA,EAExC,GAAG,EAAE,IAAI,wCAAwC,EAAE,KAAK;AAAA;AAAA,EACxD,GAAG,EAAE,IAAI,yBAAyB,EAAE,KAAK;AAAA;AAAA,EACzC,GAAG,EAAE,IAAI,6BAA6B,EAAE,KAAK;AAAA;AAAA;AAAA,EAE7C,GAAG,EAAE,IAAI,qBAAqB,EAAE,KAAK;AAAA;AAAA,EACrC,GAAG,EAAE,IAAI,qCAAqC,EAAE,KAAK;AAAA;AAAA,EACrD,GAAG,EAAE,IAAI,6BAA6B,EAAE,KAAK;AAAA;AAAA,EAC7C,GAAG,EAAE,IAAI,uCAAuC,EAAE,KAAK;AAAA;AAAA,EACvD,GAAG,EAAE,IAAI,8BAA8B,EAAE,KAAK;AAAA;AAAA,EAC9C,GAAG,EAAE,IAAI,sCAAsC,EAAE,KAAK;AAAA;AAAA,EACtD,GAAG,EAAE,IAAI,oCAAoC,EAAE,KAAK;AAAA;AAAA,EACpD,GAAG,EAAE,IAAI,kCAAkC,EAAE,KAAK;AAAA;AAAA;AAAA,EAElD,GAAG,EAAE,IAAI,uCAAuC,EAAE,KAAK;AAAA;AAAA,EACvD,GAAG,EAAE,IAAI,4CAA4C,EAAE,KAAK;AAAA;AAAA,EAC5D,GAAG,EAAE,IAAI,yBAAyB,EAAE,KAAK;AAAA;AAAA;AAAA,EAEzC,GAAG,EAAE,IAAI,yCAAyC,EAAE,KAAK;AAAA;AAAA,EACzD,GAAG,EAAE,IAAI,iCAAiC,EAAE,KAAK;AAAA;AAAA,EACjD,GAAG,EAAE,IAAI,wEAAwE,EAAE,KAAK;AAAA;AAAA;AAAA,EAExF,GAAG,EAAE,IAAI,yBAAyB,EAAE,KAAK;AAAA;AAAA,EACzC,GAAG,EAAE,IAAI,4BAA4B,EAAE,KAAK;AAAA;AAAA,EAC5C,GAAG,EAAE,IAAI,yBAAyB,EAAE,KAAK;AAAA;AAAA;AAAA,EAEzC,QAAQ,EAAE,IAAI,sBAAsB,EAAE,KAAK;AAAA;AAAA,EAC3C,QAAQ,EAAE,IAAI,oBAAoB,EAAE,KAAK;AAAA;AAAA,EACzC,QAAQ,EAAE,IAAI,sBAAsB,EAAE,KAAK;AAAA;AAAA,EAC3C,QAAQ,EAAE,IAAI,mBAAmB,EAAE,KAAK;AAAA;AAAA,EACxC,QAAQ,EAAE,IAAI,0BAA0B,EAAE,KAAK;AAAA;AACjD;AAEA,SAAS,UAAkB;AAEzB,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,KAAU,IAAI,KAAK;AACvD,SAAO,KAAK,GAAG;AACjB;AAEA,SAAS,MAAM,MAAc,QAAQ,IAAY;AAC/C,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,QAAM,MAAS,GAAG,EAAE,IAAI,SAAI,SAAI,OAAO,QAAQ,CAAC,CAAC,SAAI,EAAE,KAAK;AAC5D,QAAM,SAAS,GAAG,EAAE,IAAI,SAAI,SAAI,OAAO,QAAQ,CAAC,CAAC,SAAI,EAAE,KAAK;AAC5D,QAAM,SAAS,MAAM,IAAI,OAAK;AAE5B,UAAM,QAAQ,EAAE,QAAQ,mBAAmB,EAAE;AAC7C,UAAM,MAAM,KAAK,IAAI,GAAG,QAAQ,IAAI,MAAM,MAAM;AAChD,WAAO,GAAG,EAAE,IAAI,SAAI,EAAE,KAAK,KAAK,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,KAAK,EAAE,IAAI,SAAI,EAAE,KAAK;AAAA,EAC3E,CAAC;AACD,SAAO,CAAC,KAAK,GAAG,QAAQ,MAAM,EAAE,KAAK,IAAI;AAC3C;AAEO,SAAS,cAAoB;AAElC,QAAM,MAAc,OAAO,SAAS,aAAa,EAAE,MAAM,cAAc,CAAC;AAGxE,QAAM,WAAW,IAAI,MAAM,IAAI;AAC/B,QAAM,UAAU,SAAS,IAAI,CAAC,MAAM,MAAM;AACxC,UAAM,QAAQ,IAAI,SAAS,SAAS,IAAI,EAAE,SAAS,EAAE;AACrD,WAAO,GAAG,KAAK,GAAG,IAAI,GAAG,EAAE,KAAK;AAAA,EAClC,CAAC,EAAE,KAAK,IAAI;AAEZ,UAAQ,IAAI,OAAO,OAAO;AAG1B,UAAQ,IAAI,GAAG,EAAE,GAAG,6DAAwD,EAAE,KAAK,EAAE;AACrF,UAAQ,IAAI,GAAG,EAAE,GAAG,mDAA8C,EAAE,KAAK,GAAG,EAAE,MAAM,0BAA0B,EAAE,KAAK;AAAA,CAAI;AAGzH,QAAM,QAAQ,GAAG,EAAE,IAAI,8IAA2B,EAAE,KAAK,GAAG,EAAE,IAAI,GAAG,EAAE,KAAK,gBAAgB,EAAE,KAAK,GAAG,EAAE,IAAI,8IAA2B,EAAE,KAAK;AAC9I,UAAQ,IAAI,KAAK;AACjB,UAAQ,IAAI,MAAM,QAAQ,CAAC,CAAC;AAC5B,UAAQ,IAAI;AACd;",
   "names": []
 }

package/dist/bin/commands/attack-surface.js

@@ -0,0 +1,157 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var attack_surface_exports = {};
+__export(attack_surface_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(attack_surface_exports);
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+const red = "\x1B[31m";
+const yellow = "\x1B[33m";
+function register(program) {
+  program.command("attack-surface [projectPath]").description("Map HTTP routes to reachable vulnerable dependencies").option("--limit <n>", "Max routes to show (default: 20)", "20").option("--public-only", "Show only public/unauthenticated routes").option("--format <fmt>", "Output format: text, json (default: text)", "text").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(target);
+    if (!config.enableSecurity) {
+      console.error(`
+  ${yellow}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    const limit = parseInt(opts.limit, 10);
+    if (isNaN(limit) || limit < 1) {
+      console.error(`  \u2716 Invalid --limit value: ${opts.limit}. Must be a positive integer.`);
+      process.exit(1);
+    }
+    const validFormats = ["text", "json"];
+    if (!validFormats.includes(opts.format)) {
+      console.error(`  \u2716 Invalid --format value: ${opts.format}. Use: text, json`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const { AttackSurfaceAnalyzer } = await Promise.resolve().then(() => require("../../security/attack-surface.js"));
+    const analyzer = new AttackSurfaceAnalyzer(db);
+    const result = await analyzer.analyze();
+    cg.close();
+    let routes = opts.publicOnly ? result.allRoutes.filter((r) => r.exposureLevel === "public") : result.allRoutes;
+    const limited = routes.slice(0, limit);
+    if (opts.format === "json") {
+      console.log(JSON.stringify(
+        {
+          totalRoutes: result.totalRoutes,
+          publicRoutes: result.publicRoutes,
+          authenticatedRoutes: result.authenticatedRoutes,
+          routesWithVulns: result.routesWithVulns,
+          criticalPaths: result.criticalPaths,
+          routes: limited
+        },
+        null,
+        2
+      ));
+      return;
+    }
+    const totalLabel = result.totalRoutes === 1 ? "route" : "routes";
+    console.log(
+      `
+  ${(0, import_ui.section)("Attack Surface")}  ${import_ui.dim}(${result.totalRoutes} ${totalLabel} total: ${result.publicRoutes} public, ${result.authenticatedRoutes} authenticated)${import_ui.reset}
+`
+    );
+    if (result.criticalPaths.length === 0) {
+      console.log(`  ${import_ui.dim}No routes reaching vulnerable dependencies found.${import_ui.reset}
+`);
+      return;
+    }
+    console.log(`  ${import_ui.violet}${import_ui.bold}\u25CF Critical paths${import_ui.reset} ${import_ui.dim}(routes reaching affected vulnerabilities)${import_ui.reset}
+`);
+    const criticalToShow = result.criticalPaths.slice(0, limit);
+    for (const entry of criticalToShow) {
+      printRouteEntry(entry);
+    }
+    if (!opts.publicOnly) {
+      const cleanCount = result.totalRoutes - result.routesWithVulns;
+      if (cleanCount > 0) {
+        console.log(`  ${import_ui.dim}+ ${cleanCount} clean route${cleanCount === 1 ? "" : "s"} (no reachable vulnerabilities)${import_ui.reset}
+`);
+      }
+    }
+  });
+}
+function printRouteEntry(entry) {
+  const isPublicVuln = entry.exposureLevel === "public" && entry.vulnerableDeps.length > 0;
+  const isAuthVuln = (entry.exposureLevel === "authenticated" || entry.exposureLevel === "internal") && entry.vulnerableDeps.length > 0;
+  const routeColor = isPublicVuln ? red : isAuthVuln ? yellow : import_ui.dim;
+  const riskLabel = entry.riskScore > 0 ? `${entry.riskScore.toFixed(1)}` : "?";
+  const exposureBadge = (() => {
+    switch (entry.exposureLevel) {
+      case "public":
+        return `${red}public${import_ui.reset}     `;
+      case "authenticated":
+        return `${yellow}authenticated${import_ui.reset}`;
+      case "internal":
+        return `${import_ui.dim}internal${import_ui.reset}   `;
+      default:
+        return `${import_ui.dim}unknown${import_ui.reset}    `;
+    }
+  })();
+  const topVuln = entry.vulnerableDeps.reduce(
+    (best, v) => {
+      if (!best) return v;
+      if ((v.riskScore ?? 0) > (best.riskScore ?? 0)) return v;
+      return best;
+    },
+    null
+  );
+  let vulnSuffix = "";
+  if (topVuln) {
+    const hopWord = topVuln.hopCount === 1 ? "1 hop" : `${topVuln.hopCount} hops`;
+    vulnSuffix = `  ${import_ui.dim}\u2192${import_ui.reset} ${import_ui.violet}${topVuln.packageName}${import_ui.reset} ${import_ui.dim}${topVuln.cveId}${import_ui.reset} ${import_ui.dim}(${hopWord})${import_ui.reset}`;
+    if (entry.vulnerableDeps.length > 1) {
+      vulnSuffix += `  ${import_ui.dim}+${entry.vulnerableDeps.length - 1} more${import_ui.reset}`;
+    }
+  }
+  console.log(
+    `  ${routeColor}[${riskLabel}]${import_ui.reset} ${import_ui.bold}${entry.route.padEnd(30)}${import_ui.reset}  ${exposureBadge}${vulnSuffix}`
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=attack-surface.js.map

package/dist/bin/commands/attack-surface.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/attack-surface.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, section } from '../ui';\nimport type { AttackSurfaceEntry } from '../../security/attack-surface';\n\nconst red    = '\\x1b[31m';\nconst yellow = '\\x1b[33m';\n\nexport function register(program: Command): void {\n  program\n    .command('attack-surface [projectPath]')\n    .description('Map HTTP routes to reachable vulnerable dependencies')\n    .option('--limit <n>', 'Max routes to show (default: 20)', '20')\n    .option('--public-only', 'Show only public/unauthenticated routes')\n    .option('--format <fmt>', 'Output format: text, json (default: text)', 'text')\n    .action(async (\n      projectPath: string | undefined,\n      opts: { limit: string; publicOnly?: boolean; format: string },\n    ) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${yellow}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const limit = parseInt(opts.limit, 10);\n      if (isNaN(limit) || limit < 1) {\n        console.error(`  \u2716 Invalid --limit value: ${opts.limit}. Must be a positive integer.`);\n        process.exit(1);\n      }\n\n      const validFormats = ['text', 'json'];\n      if (!validFormats.includes(opts.format)) {\n        console.error(`  \u2716 Invalid --format value: ${opts.format}. Use: text, json`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n\n      const { AttackSurfaceAnalyzer } = await Promise.resolve().then(() => require('../../security/attack-surface.js'));\n      const analyzer = new AttackSurfaceAnalyzer(db);\n      const result = await analyzer.analyze();\n\n      cg.close();\n\n      // Apply --public-only filter\n      let routes = opts.publicOnly\n        ? result.allRoutes.filter(r => r.exposureLevel === 'public')\n        : result.allRoutes;\n\n      // Apply limit\n      const limited = routes.slice(0, limit);\n\n      // \u2500\u2500 JSON output \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n      if (opts.format === 'json') {\n        console.log(JSON.stringify(\n          {\n            totalRoutes: result.totalRoutes,\n            publicRoutes: result.publicRoutes,\n            authenticatedRoutes: result.authenticatedRoutes,\n            routesWithVulns: result.routesWithVulns,\n            criticalPaths: result.criticalPaths,\n            routes: limited,\n          },\n          null,\n          2,\n        ));\n        return;\n      }\n\n      // \u2500\u2500 Text output \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n      const totalLabel = result.totalRoutes === 1 ? 'route' : 'routes';\n      console.log(\n        `\\n  ${section('Attack Surface')}  ` +\n        `${dim}(${result.totalRoutes} ${totalLabel} total: ${result.publicRoutes} public, ${result.authenticatedRoutes} authenticated)${reset}\\n`,\n      );\n\n      if (result.criticalPaths.length === 0) {\n        console.log(`  ${dim}No routes reaching vulnerable dependencies found.${reset}\\n`);\n        return;\n      }\n\n      // Critical paths section\n      console.log(`  ${violet}${bold}\u25CF Critical paths${reset} ${dim}(routes reaching affected vulnerabilities)${reset}\\n`);\n\n      const criticalToShow = result.criticalPaths.slice(0, limit);\n\n      for (const entry of criticalToShow) {\n        printRouteEntry(entry);\n      }\n\n      // If public-only was not set, also show clean routes summary\n      if (!opts.publicOnly) {\n        const cleanCount = result.totalRoutes - result.routesWithVulns;\n        if (cleanCount > 0) {\n          console.log(`  ${dim}+ ${cleanCount} clean route${cleanCount === 1 ? '' : 's'} (no reachable vulnerabilities)${reset}\\n`);\n        }\n      }\n    });\n}\n\nfunction printRouteEntry(entry: AttackSurfaceEntry): void {\n  const isPublicVuln = entry.exposureLevel === 'public' && entry.vulnerableDeps.length > 0;\n  const isAuthVuln   = (entry.exposureLevel === 'authenticated' || entry.exposureLevel === 'internal') && entry.vulnerableDeps.length > 0;\n\n  const routeColor = isPublicVuln ? red : isAuthVuln ? yellow : dim;\n  const riskLabel  = entry.riskScore > 0 ? `${entry.riskScore.toFixed(1)}` : '?';\n\n  // Exposure badge\n  const exposureBadge = (() => {\n    switch (entry.exposureLevel) {\n      case 'public':        return `${red}public${reset}     `;\n      case 'authenticated': return `${yellow}authenticated${reset}`;\n      case 'internal':      return `${dim}internal${reset}   `;\n      default:              return `${dim}unknown${reset}    `;\n    }\n  })();\n\n  // Pick the top vuln by riskScore to show inline\n  const topVuln = entry.vulnerableDeps.reduce<AttackSurfaceEntry['vulnerableDeps'][0] | null>(\n    (best, v) => {\n      if (!best) return v;\n      if ((v.riskScore ?? 0) > (best.riskScore ?? 0)) return v;\n      return best;\n    },\n    null,\n  );\n\n  let vulnSuffix = '';\n  if (topVuln) {\n    const hopWord = topVuln.hopCount === 1 ? '1 hop' : `${topVuln.hopCount} hops`;\n    vulnSuffix = `  ${dim}\u2192${reset} ${violet}${topVuln.packageName}${reset} ${dim}${topVuln.cveId}${reset} ${dim}(${hopWord})${reset}`;\n    if (entry.vulnerableDeps.length > 1) {\n      vulnSuffix += `  ${dim}+${entry.vulnerableDeps.length - 1} more${reset}`;\n    }\n  }\n\n  console.log(\n    `  ${routeColor}[${riskLabel}]${reset} ${bold}${entry.route.padEnd(30)}${reset}  ${exposureBadge}${vulnSuffix}`,\n  );\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAkD;AAGlD,MAAM,MAAS;AACf,MAAM,SAAS;AAER,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,8BAA8B,EACtC,YAAY,sDAAsD,EAClE,OAAO,eAAe,oCAAoC,IAAI,EAC9D,OAAO,iBAAiB,yCAAyC,EACjE,OAAO,kBAAkB,6CAA6C,MAAM,EAC5E,OAAO,OACN,aACA,SACG;AACH,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,MAAM,wCAAmC,eAAK,EAAE;AACrE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,QAAQ,SAAS,KAAK,OAAO,EAAE;AACrC,QAAI,MAAM,KAAK,KAAK,QAAQ,GAAG;AAC7B,cAAQ,MAAM,mCAA8B,KAAK,KAAK,+BAA+B;AACrF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,eAAe,CAAC,QAAQ,MAAM;AACpC,QAAI,CAAC,aAAa,SAAS,KAAK,MAAM,GAAG;AACvC,cAAQ,MAAM,oCAA+B,KAAK,MAAM,mBAAmB;AAC3E,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AAEvB,UAAM,EAAE,sBAAsB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,kCAAkC,CAAC;AAChH,UAAM,WAAW,IAAI,sBAAsB,EAAE;AAC7C,UAAM,SAAS,MAAM,SAAS,QAAQ;AAEtC,OAAG,MAAM;AAGT,QAAI,SAAS,KAAK,aACd,OAAO,UAAU,OAAO,OAAK,EAAE,kBAAkB,QAAQ,IACzD,OAAO;AAGX,UAAM,UAAU,OAAO,MAAM,GAAG,KAAK;AAGrC,QAAI,KAAK,WAAW,QAAQ;AAC1B,cAAQ,IAAI,KAAK;AAAA,QACf;AAAA,UACE,aAAa,OAAO;AAAA,UACpB,cAAc,OAAO;AAAA,UACrB,qBAAqB,OAAO;AAAA,UAC5B,iBAAiB,OAAO;AAAA,UACxB,eAAe,OAAO;AAAA,UACtB,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAGA,UAAM,aAAa,OAAO,gBAAgB,IAAI,UAAU;AACxD,YAAQ;AAAA,MACN;AAAA,QAAO,mBAAQ,gBAAgB,CAAC,KAC7B,aAAG,IAAI,OAAO,WAAW,IAAI,UAAU,WAAW,OAAO,YAAY,YAAY,OAAO,mBAAmB,kBAAkB,eAAK;AAAA;AAAA,IACvI;AAEA,QAAI,OAAO,cAAc,WAAW,GAAG;AACrC,cAAQ,IAAI,KAAK,aAAG,oDAAoD,eAAK;AAAA,CAAI;AACjF;AAAA,IACF;AAGA,YAAQ,IAAI,KAAK,gBAAM,GAAG,cAAI,wBAAmB,eAAK,IAAI,aAAG,6CAA6C,eAAK;AAAA,CAAI;AAEnH,UAAM,iBAAiB,OAAO,cAAc,MAAM,GAAG,KAAK;AAE1D,eAAW,SAAS,gBAAgB;AAClC,sBAAgB,KAAK;AAAA,IACvB;AAGA,QAAI,CAAC,KAAK,YAAY;AACpB,YAAM,aAAa,OAAO,cAAc,OAAO;AAC/C,UAAI,aAAa,GAAG;AAClB,gBAAQ,IAAI,KAAK,aAAG,KAAK,UAAU,eAAe,eAAe,IAAI,KAAK,GAAG,kCAAkC,eAAK;AAAA,CAAI;AAAA,MAC1H;AAAA,IACF;AAAA,EACF,CAAC;AACL;AAEA,SAAS,gBAAgB,OAAiC;AACxD,QAAM,eAAe,MAAM,kBAAkB,YAAY,MAAM,eAAe,SAAS;AACvF,QAAM,cAAgB,MAAM,kBAAkB,mBAAmB,MAAM,kBAAkB,eAAe,MAAM,eAAe,SAAS;AAEtI,QAAM,aAAa,eAAe,MAAM,aAAa,SAAS;AAC9D,QAAM,YAAa,MAAM,YAAY,IAAI,GAAG,MAAM,UAAU,QAAQ,CAAC,CAAC,KAAK;AAG3E,QAAM,iBAAiB,MAAM;AAC3B,YAAQ,MAAM,eAAe;AAAA,MAC3B,KAAK;AAAiB,eAAO,GAAG,GAAG,SAAS,eAAK;AAAA,MACjD,KAAK;AAAiB,eAAO,GAAG,MAAM,gBAAgB,eAAK;AAAA,MAC3D,KAAK;AAAiB,eAAO,GAAG,aAAG,WAAW,eAAK;AAAA,MACnD;AAAsB,eAAO,GAAG,aAAG,UAAU,eAAK;AAAA,IACpD;AAAA,EACF,GAAG;AAGH,QAAM,UAAU,MAAM,eAAe;AAAA,IACnC,CAAC,MAAM,MAAM;AACX,UAAI,CAAC,KAAM,QAAO;AAClB,WAAK,EAAE,aAAa,MAAM,KAAK,aAAa,GAAI,QAAO;AACvD,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AAEA,MAAI,aAAa;AACjB,MAAI,SAAS;AACX,UAAM,UAAU,QAAQ,aAAa,IAAI,UAAU,GAAG,QAAQ,QAAQ;AACtE,iBAAa,KAAK,aAAG,SAAI,eAAK,IAAI,gBAAM,GAAG,QAAQ,WAAW,GAAG,eAAK,IAAI,aAAG,GAAG,QAAQ,KAAK,GAAG,eAAK,IAAI,aAAG,IAAI,OAAO,IAAI,eAAK;AAChI,QAAI,MAAM,eAAe,SAAS,GAAG;AACnC,oBAAc,KAAK,aAAG,IAAI,MAAM,eAAe,SAAS,CAAC,QAAQ,eAAK;AAAA,IACxE;AAAA,EACF;AAEA,UAAQ;AAAA,IACN,KAAK,UAAU,IAAI,SAAS,IAAI,eAAK,IAAI,cAAI,GAAG,MAAM,MAAM,OAAO,EAAE,CAAC,GAAG,eAAK,KAAK,aAAa,GAAG,UAAU;AAAA,EAC/G;AACF;",
+  "names": []
+}