kirograph 0.17.0 → 0.19.0

package/dist/security/context-warnings.test.js

@@ -0,0 +1,300 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var import_context_warnings = require("./context-warnings");
+var import_database = require("../db/database");
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var os = __toESM(require("os"));
+function createTempProject() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ctx-warn-test-"));
+  fs.writeFileSync(
+    path.join(dir, "package.json"),
+    JSON.stringify({ name: "test-project", version: "1.0.0" })
+  );
+  return dir;
+}
+function setupDb(projectRoot) {
+  const db = new import_database.GraphDatabase(projectRoot);
+  db.applySecuritySchema();
+  return db;
+}
+function insertEntryPoint(db, nodeId, name) {
+  db.upsertNode({
+    id: nodeId,
+    kind: "function",
+    name,
+    qualifiedName: name,
+    filePath: "src/index.ts",
+    language: "typescript",
+    startLine: 1,
+    endLine: 10,
+    startColumn: 0,
+    endColumn: 0,
+    updatedAt: Date.now()
+  });
+}
+function insertVulnerability(db, opts) {
+  const rawDb = db.getRawDb();
+  db.upsertNode({
+    id: opts.depNodeId,
+    kind: "dependency",
+    name: opts.packageName,
+    qualifiedName: `${opts.ecosystem}/${opts.packageName}`,
+    filePath: "package.json",
+    language: "unknown",
+    startLine: 0,
+    endLine: 0,
+    startColumn: 0,
+    endColumn: 0,
+    updatedAt: Date.now()
+  });
+  rawDb.run(
+    `INSERT OR REPLACE INTO sec_dependencies
+      (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`,
+    [opts.depNodeId, opts.ecosystem, opts.packageName, "^1.0.0", "1.0.0", "production", '["package.json"]']
+  );
+  db.upsertNode({
+    id: opts.vulnNodeId,
+    kind: "vulnerability",
+    name: opts.cveId,
+    qualifiedName: opts.cveId,
+    filePath: "package.json",
+    language: "unknown",
+    startLine: 0,
+    endLine: 0,
+    startColumn: 0,
+    endColumn: 0,
+    updatedAt: Date.now()
+  });
+  rawDb.run(
+    `INSERT OR REPLACE INTO sec_vulnerabilities
+      (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`,
+    [opts.vulnNodeId, opts.cveId, opts.severityScore, "[]", opts.fixedVersion ?? null, "Test vulnerability", "OSV"]
+  );
+  db.insertEdge({
+    source: opts.depNodeId,
+    target: opts.vulnNodeId,
+    kind: "has_vulnerability"
+  });
+  rawDb.run(
+    `INSERT OR REPLACE INTO sec_reachability
+      (vulnerability_node_id, verdict, paths, reaching_entry_point_count, analyzed_at)
+     VALUES (?, ?, ?, ?, ?)`,
+    [opts.vulnNodeId, opts.verdict, JSON.stringify(opts.paths), opts.paths.length, Date.now()]
+  );
+}
+(0, import_vitest.describe)("getSecurityWarningsForNodes", () => {
+  let projectRoot;
+  let db;
+  (0, import_vitest.beforeEach)(() => {
+    projectRoot = createTempProject();
+    db = setupDb(projectRoot);
+  });
+  (0, import_vitest.afterEach)(() => {
+    db.close();
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  });
+  (0, import_vitest.it)("returns empty array when no node IDs provided", () => {
+    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), []);
+    (0, import_vitest.expect)(result).toEqual([]);
+  });
+  (0, import_vitest.it)("returns empty array when no vulnerabilities exist", () => {
+    insertEntryPoint(db, "node-1", "handleRequest");
+    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["node-1"]);
+    (0, import_vitest.expect)(result).toEqual([]);
+  });
+  (0, import_vitest.it)("returns warnings for vulnerabilities reachable from context nodes", () => {
+    insertEntryPoint(db, "entry-1", "handleRequest");
+    insertVulnerability(db, {
+      vulnNodeId: "vuln-1",
+      depNodeId: "dep-1",
+      cveId: "CVE-2023-12345",
+      severityScore: 9.8,
+      fixedVersion: "1.2.0",
+      packageName: "express",
+      ecosystem: "npm",
+      verdict: "affected",
+      paths: [{ entryPoint: "entry-1", path: ["entry-1", "mid-1", "dep-1"] }]
+    });
+    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["entry-1"]);
+    (0, import_vitest.expect)(result).toHaveLength(1);
+    (0, import_vitest.expect)(result[0].cveId).toBe("CVE-2023-12345");
+    (0, import_vitest.expect)(result[0].severityScore).toBe(9.8);
+    (0, import_vitest.expect)(result[0].packageName).toBe("express");
+    (0, import_vitest.expect)(result[0].ecosystem).toBe("npm");
+    (0, import_vitest.expect)(result[0].fixedVersion).toBe("1.2.0");
+    (0, import_vitest.expect)(result[0].entryPoints).toContain("entry-1");
+  });
+  (0, import_vitest.it)("returns warnings when a context node is on the path (not just entry point)", () => {
+    insertEntryPoint(db, "entry-1", "handleRequest");
+    insertEntryPoint(db, "mid-1", "processData");
+    insertVulnerability(db, {
+      vulnNodeId: "vuln-1",
+      depNodeId: "dep-1",
+      cveId: "CVE-2023-99999",
+      severityScore: 7.5,
+      packageName: "lodash",
+      ecosystem: "npm",
+      verdict: "affected",
+      paths: [{ entryPoint: "entry-1", path: ["entry-1", "mid-1", "dep-1"] }]
+    });
+    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["mid-1"]);
+    (0, import_vitest.expect)(result).toHaveLength(1);
+    (0, import_vitest.expect)(result[0].cveId).toBe("CVE-2023-99999");
+  });
+  (0, import_vitest.it)("does not return warnings for not_affected vulnerabilities", () => {
+    insertEntryPoint(db, "entry-1", "handleRequest");
+    insertVulnerability(db, {
+      vulnNodeId: "vuln-1",
+      depNodeId: "dep-1",
+      cveId: "CVE-2023-00001",
+      severityScore: 5,
+      packageName: "some-pkg",
+      ecosystem: "npm",
+      verdict: "not_affected",
+      paths: []
+    });
+    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["entry-1"]);
+    (0, import_vitest.expect)(result).toEqual([]);
+  });
+  (0, import_vitest.it)("does not return warnings when context nodes are not on any path", () => {
+    insertEntryPoint(db, "entry-1", "handleRequest");
+    insertEntryPoint(db, "unrelated", "otherFunction");
+    insertVulnerability(db, {
+      vulnNodeId: "vuln-1",
+      depNodeId: "dep-1",
+      cveId: "CVE-2023-11111",
+      severityScore: 8,
+      packageName: "express",
+      ecosystem: "npm",
+      verdict: "affected",
+      paths: [{ entryPoint: "entry-1", path: ["entry-1", "dep-1"] }]
+    });
+    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["unrelated"]);
+    (0, import_vitest.expect)(result).toEqual([]);
+  });
+  (0, import_vitest.it)("sorts warnings by severity (highest first)", () => {
+    insertEntryPoint(db, "entry-1", "handleRequest");
+    insertVulnerability(db, {
+      vulnNodeId: "vuln-1",
+      depNodeId: "dep-1",
+      cveId: "CVE-2023-LOW",
+      severityScore: 3,
+      packageName: "low-pkg",
+      ecosystem: "npm",
+      verdict: "affected",
+      paths: [{ entryPoint: "entry-1", path: ["entry-1", "dep-1"] }]
+    });
+    insertVulnerability(db, {
+      vulnNodeId: "vuln-2",
+      depNodeId: "dep-2",
+      cveId: "CVE-2023-HIGH",
+      severityScore: 9.5,
+      packageName: "high-pkg",
+      ecosystem: "npm",
+      verdict: "affected",
+      paths: [{ entryPoint: "entry-1", path: ["entry-1", "dep-2"] }]
+    });
+    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["entry-1"]);
+    (0, import_vitest.expect)(result).toHaveLength(2);
+    (0, import_vitest.expect)(result[0].cveId).toBe("CVE-2023-HIGH");
+    (0, import_vitest.expect)(result[1].cveId).toBe("CVE-2023-LOW");
+  });
+});
+(0, import_vitest.describe)("formatSecurityWarnings", () => {
+  (0, import_vitest.it)("returns empty string when no warnings", () => {
+    (0, import_vitest.expect)((0, import_context_warnings.formatSecurityWarnings)([], /* @__PURE__ */ new Map())).toBe("");
+  });
+  (0, import_vitest.it)("formats a single warning with severity and entry point", () => {
+    const warnings = [
+      {
+        cveId: "CVE-2023-12345",
+        severityScore: 9.8,
+        packageName: "express",
+        ecosystem: "npm",
+        fixedVersion: "4.18.3",
+        entryPoints: ["entry-1"]
+      }
+    ];
+    const nodeNames = /* @__PURE__ */ new Map([["entry-1", "handleRequest"]]);
+    const result = (0, import_context_warnings.formatSecurityWarnings)(warnings, nodeNames);
+    (0, import_vitest.expect)(result).toContain("## \u26A0 Security");
+    (0, import_vitest.expect)(result).toContain("**CVE-2023-12345**");
+    (0, import_vitest.expect)(result).toContain("CVSS 9.8");
+    (0, import_vitest.expect)(result).toContain("express (npm)");
+    (0, import_vitest.expect)(result).toContain("handleRequest");
+    (0, import_vitest.expect)(result).toContain("\u{1F4A1} Fix: npm install express@4.18.3");
+  });
+  (0, import_vitest.it)('shows max 3 vulnerabilities and a "more" note', () => {
+    const warnings = Array.from({ length: 5 }, (_, i) => ({
+      cveId: `CVE-2023-${i}`,
+      severityScore: 9 - i,
+      packageName: `pkg-${i}`,
+      ecosystem: "npm",
+      fixedVersion: null,
+      entryPoints: ["entry-1"]
+    }));
+    const nodeNames = /* @__PURE__ */ new Map([["entry-1", "main"]]);
+    const result = (0, import_context_warnings.formatSecurityWarnings)(warnings, nodeNames);
+    (0, import_vitest.expect)(result).toContain("CVE-2023-0");
+    (0, import_vitest.expect)(result).toContain("CVE-2023-1");
+    (0, import_vitest.expect)(result).toContain("CVE-2023-2");
+    (0, import_vitest.expect)(result).not.toContain("CVE-2023-3");
+    (0, import_vitest.expect)(result).not.toContain("CVE-2023-4");
+    (0, import_vitest.expect)(result).toContain("2 more \u2014 use kirograph_vulns for full list");
+  });
+  (0, import_vitest.it)("does not show fix suggestion when fixedVersion is null", () => {
+    const warnings = [
+      {
+        cveId: "CVE-2023-99999",
+        severityScore: 7,
+        packageName: "lodash",
+        ecosystem: "npm",
+        fixedVersion: null,
+        entryPoints: ["entry-1"]
+      }
+    ];
+    const nodeNames = /* @__PURE__ */ new Map([["entry-1", "main"]]);
+    const result = (0, import_context_warnings.formatSecurityWarnings)(warnings, nodeNames);
+    (0, import_vitest.expect)(result).not.toContain("\u{1F4A1} Fix");
+  });
+  (0, import_vitest.it)("uses node ID when name is not in the map", () => {
+    const warnings = [
+      {
+        cveId: "CVE-2023-00001",
+        severityScore: 5,
+        packageName: "some-pkg",
+        ecosystem: "npm",
+        fixedVersion: null,
+        entryPoints: ["unknown-id"]
+      }
+    ];
+    const result = (0, import_context_warnings.formatSecurityWarnings)(warnings, /* @__PURE__ */ new Map());
+    (0, import_vitest.expect)(result).toContain("unknown-id");
+  });
+});
+//# sourceMappingURL=context-warnings.test.js.map

package/dist/security/context-warnings.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/context-warnings.test.ts"],
+  "sourcesContent": ["/**\n * Unit tests for security context warnings\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport { getSecurityWarningsForNodes, formatSecurityWarnings } from './context-warnings';\nimport type { SecurityWarning } from './context-warnings';\nimport { GraphDatabase } from '../db/database';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\n\n// \u2500\u2500 Test Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction createTempProject(): string {\n  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ctx-warn-test-'));\n  fs.writeFileSync(\n    path.join(dir, 'package.json'),\n    JSON.stringify({ name: 'test-project', version: '1.0.0' }),\n  );\n  return dir;\n}\n\nfunction setupDb(projectRoot: string): GraphDatabase {\n  const db = new GraphDatabase(projectRoot);\n  db.applySecuritySchema();\n  return db;\n}\n\nfunction insertEntryPoint(db: GraphDatabase, nodeId: string, name: string): void {\n  db.upsertNode({\n    id: nodeId,\n    kind: 'function',\n    name,\n    qualifiedName: name,\n    filePath: 'src/index.ts',\n    language: 'typescript',\n    startLine: 1,\n    endLine: 10,\n    startColumn: 0,\n    endColumn: 0,\n    updatedAt: Date.now(),\n  });\n}\n\nfunction insertVulnerability(\n  db: GraphDatabase,\n  opts: {\n    vulnNodeId: string;\n    depNodeId: string;\n    cveId: string;\n    severityScore: number;\n    fixedVersion?: string;\n    packageName: string;\n    ecosystem: string;\n    verdict: string;\n    paths: Array<{ entryPoint: string; path: string[] }>;\n  },\n): void {\n  const rawDb = db.getRawDb();\n\n  // Insert dependency node\n  db.upsertNode({\n    id: opts.depNodeId,\n    kind: 'dependency',\n    name: opts.packageName,\n    qualifiedName: `${opts.ecosystem}/${opts.packageName}`,\n    filePath: 'package.json',\n    language: 'unknown',\n    startLine: 0,\n    endLine: 0,\n    startColumn: 0,\n    endColumn: 0,\n    updatedAt: Date.now(),\n  });\n\n  rawDb.run(\n    `INSERT OR REPLACE INTO sec_dependencies\n      (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n     VALUES (?, ?, ?, ?, ?, ?, ?)`,\n    [opts.depNodeId, opts.ecosystem, opts.packageName, '^1.0.0', '1.0.0', 'production', '[\"package.json\"]'],\n  );\n\n  // Insert vulnerability node\n  db.upsertNode({\n    id: opts.vulnNodeId,\n    kind: 'vulnerability',\n    name: opts.cveId,\n    qualifiedName: opts.cveId,\n    filePath: 'package.json',\n    language: 'unknown',\n    startLine: 0,\n    endLine: 0,\n    startColumn: 0,\n    endColumn: 0,\n    updatedAt: Date.now(),\n  });\n\n  rawDb.run(\n    `INSERT OR REPLACE INTO sec_vulnerabilities\n      (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)\n     VALUES (?, ?, ?, ?, ?, ?, ?)`,\n    [opts.vulnNodeId, opts.cveId, opts.severityScore, '[]', opts.fixedVersion ?? null, 'Test vulnerability', 'OSV'],\n  );\n\n  // Insert has_vulnerability edge (from dependency to vulnerability)\n  db.insertEdge({\n    source: opts.depNodeId,\n    target: opts.vulnNodeId,\n    kind: 'has_vulnerability',\n  });\n\n  // Insert reachability record\n  rawDb.run(\n    `INSERT OR REPLACE INTO sec_reachability\n      (vulnerability_node_id, verdict, paths, reaching_entry_point_count, analyzed_at)\n     VALUES (?, ?, ?, ?, ?)`,\n    [opts.vulnNodeId, opts.verdict, JSON.stringify(opts.paths), opts.paths.length, Date.now()],\n  );\n}\n\n// \u2500\u2500 Tests \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ndescribe('getSecurityWarningsForNodes', () => {\n  let projectRoot: string;\n  let db: GraphDatabase;\n\n  beforeEach(() => {\n    projectRoot = createTempProject();\n    db = setupDb(projectRoot);\n  });\n\n  afterEach(() => {\n    db.close();\n    fs.rmSync(projectRoot, { recursive: true, force: true });\n  });\n\n  it('returns empty array when no node IDs provided', () => {\n    const result = getSecurityWarningsForNodes(db.getRawDb(), []);\n    expect(result).toEqual([]);\n  });\n\n  it('returns empty array when no vulnerabilities exist', () => {\n    insertEntryPoint(db, 'node-1', 'handleRequest');\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['node-1']);\n    expect(result).toEqual([]);\n  });\n\n  it('returns warnings for vulnerabilities reachable from context nodes', () => {\n    insertEntryPoint(db, 'entry-1', 'handleRequest');\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-1',\n      depNodeId: 'dep-1',\n      cveId: 'CVE-2023-12345',\n      severityScore: 9.8,\n      fixedVersion: '1.2.0',\n      packageName: 'express',\n      ecosystem: 'npm',\n      verdict: 'affected',\n      paths: [{ entryPoint: 'entry-1', path: ['entry-1', 'mid-1', 'dep-1'] }],\n    });\n\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['entry-1']);\n    expect(result).toHaveLength(1);\n    expect(result[0].cveId).toBe('CVE-2023-12345');\n    expect(result[0].severityScore).toBe(9.8);\n    expect(result[0].packageName).toBe('express');\n    expect(result[0].ecosystem).toBe('npm');\n    expect(result[0].fixedVersion).toBe('1.2.0');\n    expect(result[0].entryPoints).toContain('entry-1');\n  });\n\n  it('returns warnings when a context node is on the path (not just entry point)', () => {\n    insertEntryPoint(db, 'entry-1', 'handleRequest');\n    insertEntryPoint(db, 'mid-1', 'processData');\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-1',\n      depNodeId: 'dep-1',\n      cveId: 'CVE-2023-99999',\n      severityScore: 7.5,\n      packageName: 'lodash',\n      ecosystem: 'npm',\n      verdict: 'affected',\n      paths: [{ entryPoint: 'entry-1', path: ['entry-1', 'mid-1', 'dep-1'] }],\n    });\n\n    // Query with mid-1 (intermediate node on path)\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['mid-1']);\n    expect(result).toHaveLength(1);\n    expect(result[0].cveId).toBe('CVE-2023-99999');\n  });\n\n  it('does not return warnings for not_affected vulnerabilities', () => {\n    insertEntryPoint(db, 'entry-1', 'handleRequest');\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-1',\n      depNodeId: 'dep-1',\n      cveId: 'CVE-2023-00001',\n      severityScore: 5.0,\n      packageName: 'some-pkg',\n      ecosystem: 'npm',\n      verdict: 'not_affected',\n      paths: [],\n    });\n\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['entry-1']);\n    expect(result).toEqual([]);\n  });\n\n  it('does not return warnings when context nodes are not on any path', () => {\n    insertEntryPoint(db, 'entry-1', 'handleRequest');\n    insertEntryPoint(db, 'unrelated', 'otherFunction');\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-1',\n      depNodeId: 'dep-1',\n      cveId: 'CVE-2023-11111',\n      severityScore: 8.0,\n      packageName: 'express',\n      ecosystem: 'npm',\n      verdict: 'affected',\n      paths: [{ entryPoint: 'entry-1', path: ['entry-1', 'dep-1'] }],\n    });\n\n    // Query with 'unrelated' which is not on any path\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['unrelated']);\n    expect(result).toEqual([]);\n  });\n\n  it('sorts warnings by severity (highest first)', () => {\n    insertEntryPoint(db, 'entry-1', 'handleRequest');\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-1',\n      depNodeId: 'dep-1',\n      cveId: 'CVE-2023-LOW',\n      severityScore: 3.0,\n      packageName: 'low-pkg',\n      ecosystem: 'npm',\n      verdict: 'affected',\n      paths: [{ entryPoint: 'entry-1', path: ['entry-1', 'dep-1'] }],\n    });\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-2',\n      depNodeId: 'dep-2',\n      cveId: 'CVE-2023-HIGH',\n      severityScore: 9.5,\n      packageName: 'high-pkg',\n      ecosystem: 'npm',\n      verdict: 'affected',\n      paths: [{ entryPoint: 'entry-1', path: ['entry-1', 'dep-2'] }],\n    });\n\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['entry-1']);\n    expect(result).toHaveLength(2);\n    expect(result[0].cveId).toBe('CVE-2023-HIGH');\n    expect(result[1].cveId).toBe('CVE-2023-LOW');\n  });\n});\n\ndescribe('formatSecurityWarnings', () => {\n  it('returns empty string when no warnings', () => {\n    expect(formatSecurityWarnings([], new Map())).toBe('');\n  });\n\n  it('formats a single warning with severity and entry point', () => {\n    const warnings: SecurityWarning[] = [\n      {\n        cveId: 'CVE-2023-12345',\n        severityScore: 9.8,\n        packageName: 'express',\n        ecosystem: 'npm',\n        fixedVersion: '4.18.3',\n        entryPoints: ['entry-1'],\n      },\n    ];\n    const nodeNames = new Map([['entry-1', 'handleRequest']]);\n\n    const result = formatSecurityWarnings(warnings, nodeNames);\n    expect(result).toContain('## \u26A0 Security');\n    expect(result).toContain('**CVE-2023-12345**');\n    expect(result).toContain('CVSS 9.8');\n    expect(result).toContain('express (npm)');\n    expect(result).toContain('handleRequest');\n    expect(result).toContain('\uD83D\uDCA1 Fix: npm install express@4.18.3');\n  });\n\n  it('shows max 3 vulnerabilities and a \"more\" note', () => {\n    const warnings: SecurityWarning[] = Array.from({ length: 5 }, (_, i) => ({\n      cveId: `CVE-2023-${i}`,\n      severityScore: 9.0 - i,\n      packageName: `pkg-${i}`,\n      ecosystem: 'npm',\n      fixedVersion: null,\n      entryPoints: ['entry-1'],\n    }));\n    const nodeNames = new Map([['entry-1', 'main']]);\n\n    const result = formatSecurityWarnings(warnings, nodeNames);\n    expect(result).toContain('CVE-2023-0');\n    expect(result).toContain('CVE-2023-1');\n    expect(result).toContain('CVE-2023-2');\n    expect(result).not.toContain('CVE-2023-3');\n    expect(result).not.toContain('CVE-2023-4');\n    expect(result).toContain('2 more \u2014 use kirograph_vulns for full list');\n  });\n\n  it('does not show fix suggestion when fixedVersion is null', () => {\n    const warnings: SecurityWarning[] = [\n      {\n        cveId: 'CVE-2023-99999',\n        severityScore: 7.0,\n        packageName: 'lodash',\n        ecosystem: 'npm',\n        fixedVersion: null,\n        entryPoints: ['entry-1'],\n      },\n    ];\n    const nodeNames = new Map([['entry-1', 'main']]);\n\n    const result = formatSecurityWarnings(warnings, nodeNames);\n    expect(result).not.toContain('\uD83D\uDCA1 Fix');\n  });\n\n  it('uses node ID when name is not in the map', () => {\n    const warnings: SecurityWarning[] = [\n      {\n        cveId: 'CVE-2023-00001',\n        severityScore: 5.0,\n        packageName: 'some-pkg',\n        ecosystem: 'npm',\n        fixedVersion: null,\n        entryPoints: ['unknown-id'],\n      },\n    ];\n\n    const result = formatSecurityWarnings(warnings, new Map());\n    expect(result).toContain('unknown-id');\n  });\n});\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAGA,oBAA4D;AAC5D,8BAAoE;AAEpE,sBAA8B;AAC9B,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AAIpB,SAAS,oBAA4B;AACnC,QAAM,MAAM,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,gBAAgB,CAAC;AACnE,KAAG;AAAA,IACD,KAAK,KAAK,KAAK,cAAc;AAAA,IAC7B,KAAK,UAAU,EAAE,MAAM,gBAAgB,SAAS,QAAQ,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,aAAoC;AACnD,QAAM,KAAK,IAAI,8BAAc,WAAW;AACxC,KAAG,oBAAoB;AACvB,SAAO;AACT;AAEA,SAAS,iBAAiB,IAAmB,QAAgB,MAAoB;AAC/E,KAAG,WAAW;AAAA,IACZ,IAAI;AAAA,IACJ,MAAM;AAAA,IACN;AAAA,IACA,eAAe;AAAA,IACf,UAAU;AAAA,IACV,UAAU;AAAA,IACV,WAAW;AAAA,IACX,SAAS;AAAA,IACT,aAAa;AAAA,IACb,WAAW;AAAA,IACX,WAAW,KAAK,IAAI;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,oBACP,IACA,MAWM;AACN,QAAM,QAAQ,GAAG,SAAS;AAG1B,KAAG,WAAW;AAAA,IACZ,IAAI,KAAK;AAAA,IACT,MAAM;AAAA,IACN,MAAM,KAAK;AAAA,IACX,eAAe,GAAG,KAAK,SAAS,IAAI,KAAK,WAAW;AAAA,IACpD,UAAU;AAAA,IACV,UAAU;AAAA,IACV,WAAW;AAAA,IACX,SAAS;AAAA,IACT,aAAa;AAAA,IACb,WAAW;AAAA,IACX,WAAW,KAAK,IAAI;AAAA,EACtB,CAAC;AAED,QAAM;AAAA,IACJ;AAAA;AAAA;AAAA,IAGA,CAAC,KAAK,WAAW,KAAK,WAAW,KAAK,aAAa,UAAU,SAAS,cAAc,kBAAkB;AAAA,EACxG;AAGA,KAAG,WAAW;AAAA,IACZ,IAAI,KAAK;AAAA,IACT,MAAM;AAAA,IACN,MAAM,KAAK;AAAA,IACX,eAAe,KAAK;AAAA,IACpB,UAAU;AAAA,IACV,UAAU;AAAA,IACV,WAAW;AAAA,IACX,SAAS;AAAA,IACT,aAAa;AAAA,IACb,WAAW;AAAA,IACX,WAAW,KAAK,IAAI;AAAA,EACtB,CAAC;AAED,QAAM;AAAA,IACJ;AAAA;AAAA;AAAA,IAGA,CAAC,KAAK,YAAY,KAAK,OAAO,KAAK,eAAe,MAAM,KAAK,gBAAgB,MAAM,sBAAsB,KAAK;AAAA,EAChH;AAGA,KAAG,WAAW;AAAA,IACZ,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,MAAM;AAAA,EACR,CAAC;AAGD,QAAM;AAAA,IACJ;AAAA;AAAA;AAAA,IAGA,CAAC,KAAK,YAAY,KAAK,SAAS,KAAK,UAAU,KAAK,KAAK,GAAG,KAAK,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC3F;AACF;AAAA,IAIA,wBAAS,+BAA+B,MAAM;AAC5C,MAAI;AACJ,MAAI;AAEJ,gCAAW,MAAM;AACf,kBAAc,kBAAkB;AAChC,SAAK,QAAQ,WAAW;AAAA,EAC1B,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,MAAM;AACT,OAAG,OAAO,aAAa,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACzD,CAAC;AAED,wBAAG,iDAAiD,MAAM;AACxD,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,CAAC;AAC5D,8BAAO,MAAM,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3B,CAAC;AAED,wBAAG,qDAAqD,MAAM;AAC5D,qBAAiB,IAAI,UAAU,eAAe;AAC9C,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,QAAQ,CAAC;AACpE,8BAAO,MAAM,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3B,CAAC;AAED,wBAAG,qEAAqE,MAAM;AAC5E,qBAAiB,IAAI,WAAW,eAAe;AAC/C,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,cAAc;AAAA,MACd,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC,EAAE,YAAY,WAAW,MAAM,CAAC,WAAW,SAAS,OAAO,EAAE,CAAC;AAAA,IACxE,CAAC;AAED,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,SAAS,CAAC;AACrE,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,gBAAgB;AAC7C,8BAAO,OAAO,CAAC,EAAE,aAAa,EAAE,KAAK,GAAG;AACxC,8BAAO,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,SAAS;AAC5C,8BAAO,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,KAAK;AACtC,8BAAO,OAAO,CAAC,EAAE,YAAY,EAAE,KAAK,OAAO;AAC3C,8BAAO,OAAO,CAAC,EAAE,WAAW,EAAE,UAAU,SAAS;AAAA,EACnD,CAAC;AAED,wBAAG,8EAA8E,MAAM;AACrF,qBAAiB,IAAI,WAAW,eAAe;AAC/C,qBAAiB,IAAI,SAAS,aAAa;AAC3C,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC,EAAE,YAAY,WAAW,MAAM,CAAC,WAAW,SAAS,OAAO,EAAE,CAAC;AAAA,IACxE,CAAC;AAGD,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,OAAO,CAAC;AACnE,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,gBAAgB;AAAA,EAC/C,CAAC;AAED,wBAAG,6DAA6D,MAAM;AACpE,qBAAiB,IAAI,WAAW,eAAe;AAC/C,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC;AAAA,IACV,CAAC;AAED,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,SAAS,CAAC;AACrE,8BAAO,MAAM,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3B,CAAC;AAED,wBAAG,mEAAmE,MAAM;AAC1E,qBAAiB,IAAI,WAAW,eAAe;AAC/C,qBAAiB,IAAI,aAAa,eAAe;AACjD,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC,EAAE,YAAY,WAAW,MAAM,CAAC,WAAW,OAAO,EAAE,CAAC;AAAA,IAC/D,CAAC;AAGD,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,WAAW,CAAC;AACvE,8BAAO,MAAM,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3B,CAAC;AAED,wBAAG,8CAA8C,MAAM;AACrD,qBAAiB,IAAI,WAAW,eAAe;AAC/C,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC,EAAE,YAAY,WAAW,MAAM,CAAC,WAAW,OAAO,EAAE,CAAC;AAAA,IAC/D,CAAC;AACD,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC,EAAE,YAAY,WAAW,MAAM,CAAC,WAAW,OAAO,EAAE,CAAC;AAAA,IAC/D,CAAC;AAED,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,SAAS,CAAC;AACrE,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,eAAe;AAC5C,8BAAO,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,cAAc;AAAA,EAC7C,CAAC;AACH,CAAC;AAAA,IAED,wBAAS,0BAA0B,MAAM;AACvC,wBAAG,yCAAyC,MAAM;AAChD,kCAAO,gDAAuB,CAAC,GAAG,oBAAI,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE;AAAA,EACvD,CAAC;AAED,wBAAG,0DAA0D,MAAM;AACjE,UAAM,WAA8B;AAAA,MAClC;AAAA,QACE,OAAO;AAAA,QACP,eAAe;AAAA,QACf,aAAa;AAAA,QACb,WAAW;AAAA,QACX,cAAc;AAAA,QACd,aAAa,CAAC,SAAS;AAAA,MACzB;AAAA,IACF;AACA,UAAM,YAAY,oBAAI,IAAI,CAAC,CAAC,WAAW,eAAe,CAAC,CAAC;AAExD,UAAM,aAAS,gDAAuB,UAAU,SAAS;AACzD,8BAAO,MAAM,EAAE,UAAU,oBAAe;AACxC,8BAAO,MAAM,EAAE,UAAU,oBAAoB;AAC7C,8BAAO,MAAM,EAAE,UAAU,UAAU;AACnC,8BAAO,MAAM,EAAE,UAAU,eAAe;AACxC,8BAAO,MAAM,EAAE,UAAU,eAAe;AACxC,8BAAO,MAAM,EAAE,UAAU,2CAAoC;AAAA,EAC/D,CAAC;AAED,wBAAG,iDAAiD,MAAM;AACxD,UAAM,WAA8B,MAAM,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,OAAO;AAAA,MACvE,OAAO,YAAY,CAAC;AAAA,MACpB,eAAe,IAAM;AAAA,MACrB,aAAa,OAAO,CAAC;AAAA,MACrB,WAAW;AAAA,MACX,cAAc;AAAA,MACd,aAAa,CAAC,SAAS;AAAA,IACzB,EAAE;AACF,UAAM,YAAY,oBAAI,IAAI,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC;AAE/C,UAAM,aAAS,gDAAuB,UAAU,SAAS;AACzD,8BAAO,MAAM,EAAE,UAAU,YAAY;AACrC,8BAAO,MAAM,EAAE,UAAU,YAAY;AACrC,8BAAO,MAAM,EAAE,UAAU,YAAY;AACrC,8BAAO,MAAM,EAAE,IAAI,UAAU,YAAY;AACzC,8BAAO,MAAM,EAAE,IAAI,UAAU,YAAY;AACzC,8BAAO,MAAM,EAAE,UAAU,iDAA4C;AAAA,EACvE,CAAC;AAED,wBAAG,0DAA0D,MAAM;AACjE,UAAM,WAA8B;AAAA,MAClC;AAAA,QACE,OAAO;AAAA,QACP,eAAe;AAAA,QACf,aAAa;AAAA,QACb,WAAW;AAAA,QACX,cAAc;AAAA,QACd,aAAa,CAAC,SAAS;AAAA,MACzB;AAAA,IACF;AACA,UAAM,YAAY,oBAAI,IAAI,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC;AAE/C,UAAM,aAAS,gDAAuB,UAAU,SAAS;AACzD,8BAAO,MAAM,EAAE,IAAI,UAAU,eAAQ;AAAA,EACvC,CAAC;AAED,wBAAG,4CAA4C,MAAM;AACnD,UAAM,WAA8B;AAAA,MAClC;AAAA,QACE,OAAO;AAAA,QACP,eAAe;AAAA,QACf,aAAa;AAAA,QACb,WAAW;AAAA,QACX,cAAc;AAAA,QACd,aAAa,CAAC,YAAY;AAAA,MAC5B;AAAA,IACF;AAEA,UAAM,aAAS,gDAAuB,UAAU,oBAAI,IAAI,CAAC;AACzD,8BAAO,MAAM,EAAE,UAAU,YAAY;AAAA,EACvC,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/security/data-flows.js

@@ -0,0 +1,228 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var data_flows_exports = {};
+__export(data_flows_exports, {
+  DataFlowAnalyzer: () => DataFlowAnalyzer
+});
+module.exports = __toCommonJS(data_flows_exports);
+class DataFlowAnalyzer {
+  constructor(db) {
+    this.db = db;
+  }
+  async analyze() {
+    const rawDb = this.db.getRawDb();
+    const findings = [];
+    findings.push(...this._detectDangerousEval(rawDb));
+    findings.push(...this._detectUnsafeDeserialize(rawDb));
+    findings.push(...this._detectHardcodedCrypto(rawDb));
+    findings.push(...this._detectSqlInjection(rawDb));
+    findings.push(...this._detectPathTraversal(rawDb));
+    return findings;
+  }
+  // ── Detection: dangerous eval / exec ────────────────────────────────────────
+  _detectDangerousEval(rawDb) {
+    const rows = rawDb.all(`
+      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee
+      FROM edges e
+      JOIN nodes n  ON n.id  = e.source
+      JOIN nodes n2 ON n2.id = e.target
+      WHERE e.kind = 'calls'
+        AND n2.name IN ('eval', 'Function', 'execSync', 'exec', 'spawn', 'spawnSync', 'execFileSync', 'execFile')
+        AND n.file_path != ''
+    `);
+    return rows.map((row) => ({
+      type: "dangerous-eval",
+      severity: "critical",
+      owaspCategory: "A03",
+      filePath: row.file_path,
+      line: row.start_line,
+      symbol: row.caller,
+      description: `Function '${row.caller}' calls '${row.callee}', which can execute arbitrary code or OS commands.`,
+      recommendation: `Avoid '${row.callee}'. Use structured APIs or allowlists for dynamic execution. Validate and sanitize all inputs.`
+    }));
+  }
+  // ── Detection: unsafe deserialization ────────────────────────────────────────
+  _detectUnsafeDeserialize(rawDb) {
+    const rows = rawDb.all(`
+      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee
+      FROM edges e
+      JOIN nodes n  ON n.id  = e.source
+      JOIN nodes n2 ON n2.id = e.target
+      WHERE e.kind = 'calls'
+        AND (
+          n2.name IN ('unserialize', 'deserialize', 'fromJson', 'loads')
+          OR n2.name LIKE '%pickle%'
+          OR n2.name LIKE '%marshal%'
+          OR n2.name = 'yaml.load'
+        )
+        AND n.file_path != ''
+    `);
+    return rows.map((row) => ({
+      type: "unsafe-deserialize",
+      severity: "high",
+      owaspCategory: "A08",
+      filePath: row.file_path,
+      line: row.start_line,
+      symbol: row.caller,
+      description: `Function '${row.caller}' calls '${row.callee}', which may deserialize untrusted data unsafely.`,
+      recommendation: `Validate data before deserialization. Use safe alternatives (e.g. yaml.safe_load, JSON schema validation). Never deserialize data from untrusted sources.`
+    }));
+  }
+  // ── Detection: hardcoded weak crypto ─────────────────────────────────────────
+  _detectHardcodedCrypto(rawDb) {
+    const rows = rawDb.all(`
+      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee
+      FROM edges e
+      JOIN nodes n  ON n.id  = e.source
+      JOIN nodes n2 ON n2.id = e.target
+      WHERE e.kind = 'calls'
+        AND (
+          n2.name LIKE '%md5%'
+          OR n2.name LIKE '%sha1%'
+          OR n2.name LIKE '%des%'
+          OR n2.name LIKE '%rc4%'
+          OR n2.name LIKE '%blowfish%'
+        )
+        AND (
+          n.name LIKE '%crypto%'
+          OR n.name LIKE '%hash%'
+          OR n.name LIKE '%cipher%'
+          OR n.name LIKE '%encrypt%'
+          OR n.name LIKE '%digest%'
+          OR n.file_path LIKE '%crypto%'
+          OR n.file_path LIKE '%hash%'
+          OR n.file_path LIKE '%cipher%'
+          OR n.file_path LIKE '%auth%'
+        )
+        AND n.file_path != ''
+    `);
+    return rows.map((row) => ({
+      type: "hardcoded-crypto",
+      severity: "medium",
+      owaspCategory: "A02",
+      filePath: row.file_path,
+      line: row.start_line,
+      symbol: row.caller,
+      description: `Function '${row.caller}' uses weak or deprecated cryptographic algorithm '${row.callee}'.`,
+      recommendation: `Replace with a strong algorithm: SHA-256 or SHA-3 for hashing, AES-256-GCM for symmetric encryption. Avoid MD5 and SHA-1 for security purposes.`
+    }));
+  }
+  // ── Detection: SQL injection ──────────────────────────────────────────────────
+  _detectSqlInjection(rawDb) {
+    const rows = rawDb.all(`
+      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee
+      FROM edges e
+      JOIN nodes n  ON n.id  = e.source
+      JOIN nodes n2 ON n2.id = e.target
+      WHERE e.kind = 'calls'
+        AND n2.name IN ('query', 'execute', 'exec', 'raw', 'runQuery', 'executeQuery', 'runSql', 'executeSql')
+        AND (
+          n.name LIKE '%handle%'
+          OR n.name LIKE '%controller%'
+          OR n.name LIKE '%route%'
+          OR n.name LIKE '%request%'
+          OR n.name LIKE '%req%'
+          OR n.name LIKE '%endpoint%'
+          OR n.name LIKE '%action%'
+          OR n.name LIKE '%handler%'
+        )
+        AND n.file_path != ''
+    `);
+    const sanitizeCallers = new Set(
+      rawDb.all(`
+        SELECT DISTINCT n.id
+        FROM edges e
+        JOIN nodes n  ON n.id  = e.source
+        JOIN nodes n2 ON n2.id = e.target
+        WHERE e.kind = 'calls'
+          AND (
+            n2.name LIKE '%sanitize%'
+            OR n2.name LIKE '%escape%'
+            OR n2.name LIKE '%parameteriz%'
+            OR n2.name LIKE '%prepared%'
+            OR n2.name LIKE '%placeholder%'
+          )
+      `).map((r) => r.id)
+    );
+    const callerIds = new Map(
+      rawDb.all(`
+        SELECT id, name FROM nodes WHERE kind IN ('function', 'method', 'arrow_function')
+      `).map((r) => [r.name, r.id])
+    );
+    return rows.filter((row) => {
+      const callerId = callerIds.get(row.caller);
+      return !callerId || !sanitizeCallers.has(callerId);
+    }).map((row) => ({
+      type: "sql-injection",
+      severity: "critical",
+      owaspCategory: "A03",
+      filePath: row.file_path,
+      line: row.start_line,
+      symbol: row.caller,
+      description: `Controller/handler '${row.caller}' calls database function '${row.callee}' without apparent input sanitization.`,
+      recommendation: `Use parameterized queries or prepared statements. Never concatenate user input into SQL strings. Consider an ORM with query builders.`
+    }));
+  }
+  // ── Detection: path traversal ─────────────────────────────────────────────────
+  _detectPathTraversal(rawDb) {
+    const rows = rawDb.all(`
+      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee
+      FROM edges e
+      JOIN nodes n  ON n.id  = e.source
+      JOIN nodes n2 ON n2.id = e.target
+      WHERE e.kind = 'calls'
+        AND n2.name IN ('readFile', 'readFileSync', 'writeFile', 'writeFileSync', 'createReadStream', 'createWriteStream', 'openSync', 'unlink', 'unlinkSync')
+        AND (
+          n.name LIKE '%controller%'
+          OR n.name LIKE '%route%'
+          OR n.name LIKE '%request%'
+          OR n.name LIKE '%download%'
+          OR n.name LIKE '%upload%'
+          OR n.name LIKE '%get%file%'
+          OR n.name LIKE '%fetch%file%'
+          OR n.name LIKE '%serve%file%'
+          OR n.name LIKE '%handle%file%'
+        )
+        AND n.file_path != ''
+        AND n.file_path NOT LIKE '%/mcp/%'
+        AND n.file_path NOT LIKE '%/resolution/%'
+        AND n.file_path NOT LIKE '%/security/%'
+        AND n.file_path NOT LIKE '%/extraction/%'
+        AND n.file_path NOT LIKE '%/graph/%'
+        AND n.file_path NOT LIKE '%/architecture/%'
+        AND n.file_path NOT LIKE '%/frameworks/%'
+        AND n.file_path NOT LIKE '%/bridges/%'
+    `);
+    return rows.map((row) => ({
+      type: "path-traversal",
+      severity: "high",
+      owaspCategory: "A01",
+      filePath: row.file_path,
+      line: row.start_line,
+      symbol: row.caller,
+      description: `Handler '${row.caller}' calls file operation '${row.callee}'. Path may be influenced by user input, enabling directory traversal.`,
+      recommendation: `Validate and normalize file paths. Use path.resolve() and verify the result is inside an allowed base directory. Reject paths containing '..'.`
+    }));
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DataFlowAnalyzer
+});
+//# sourceMappingURL=data-flows.js.map

package/dist/security/data-flows.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/data-flows.ts"],
+  "sourcesContent": ["/**\n * KiroGraph SAST-lite: Dangerous Data Flow Detection\n *\n * Detects dangerous patterns by analysing call edges in the graph database.\n * Uses symbol names and callee chains rather than full AST traversal.\n */\n\nimport type { GraphDatabase } from '../db/database';\nimport type { OwaspCategory } from './owasp';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface DataFlowFinding {\n  type: 'sql-injection' | 'path-traversal' | 'xss' | 'dangerous-eval' | 'unsafe-deserialize' | 'hardcoded-crypto';\n  severity: 'critical' | 'high' | 'medium';\n  owaspCategory: OwaspCategory;\n  filePath: string;\n  line: number;\n  symbol: string;\n  description: string;\n  recommendation: string;\n}\n\n// \u2500\u2500 Internal row type returned by the DB queries \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface CallEdgeRow {\n  caller: string;\n  file_path: string;\n  start_line: number;\n  callee: string;\n}\n\n// \u2500\u2500 DataFlowAnalyzer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class DataFlowAnalyzer {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async analyze(): Promise<DataFlowFinding[]> {\n    const rawDb = this.db.getRawDb();\n    const findings: DataFlowFinding[] = [];\n\n    findings.push(...this._detectDangerousEval(rawDb));\n    findings.push(...this._detectUnsafeDeserialize(rawDb));\n    findings.push(...this._detectHardcodedCrypto(rawDb));\n    findings.push(...this._detectSqlInjection(rawDb));\n    findings.push(...this._detectPathTraversal(rawDb));\n\n    return findings;\n  }\n\n  // \u2500\u2500 Detection: dangerous eval / exec \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectDangerousEval(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('eval', 'Function', 'execSync', 'exec', 'spawn', 'spawnSync', 'execFileSync', 'execFile')\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'dangerous-eval' as const,\n      severity: 'critical' as const,\n      owaspCategory: 'A03' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which can execute arbitrary code or OS commands.`,\n      recommendation: `Avoid '${row.callee}'. Use structured APIs or allowlists for dynamic execution. Validate and sanitize all inputs.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: unsafe deserialization \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectUnsafeDeserialize(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name IN ('unserialize', 'deserialize', 'fromJson', 'loads')\n          OR n2.name LIKE '%pickle%'\n          OR n2.name LIKE '%marshal%'\n          OR n2.name = 'yaml.load'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'unsafe-deserialize' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A08' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which may deserialize untrusted data unsafely.`,\n      recommendation: `Validate data before deserialization. Use safe alternatives (e.g. yaml.safe_load, JSON schema validation). Never deserialize data from untrusted sources.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: hardcoded weak crypto \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectHardcodedCrypto(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name LIKE '%md5%'\n          OR n2.name LIKE '%sha1%'\n          OR n2.name LIKE '%des%'\n          OR n2.name LIKE '%rc4%'\n          OR n2.name LIKE '%blowfish%'\n        )\n        AND (\n          n.name LIKE '%crypto%'\n          OR n.name LIKE '%hash%'\n          OR n.name LIKE '%cipher%'\n          OR n.name LIKE '%encrypt%'\n          OR n.name LIKE '%digest%'\n          OR n.file_path LIKE '%crypto%'\n          OR n.file_path LIKE '%hash%'\n          OR n.file_path LIKE '%cipher%'\n          OR n.file_path LIKE '%auth%'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'hardcoded-crypto' as const,\n      severity: 'medium' as const,\n      owaspCategory: 'A02' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' uses weak or deprecated cryptographic algorithm '${row.callee}'.`,\n      recommendation: `Replace with a strong algorithm: SHA-256 or SHA-3 for hashing, AES-256-GCM for symmetric encryption. Avoid MD5 and SHA-1 for security purposes.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: SQL injection \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectSqlInjection(rawDb: any): DataFlowFinding[] {\n    // Find functions that:\n    //  (a) call a known DB query function\n    //  (b) AND whose name suggests user-input handling (controller/route/request context)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('query', 'execute', 'exec', 'raw', 'runQuery', 'executeQuery', 'runSql', 'executeSql')\n        AND (\n          n.name LIKE '%handle%'\n          OR n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%req%'\n          OR n.name LIKE '%endpoint%'\n          OR n.name LIKE '%action%'\n          OR n.name LIKE '%handler%'\n        )\n        AND n.file_path != ''\n    `);\n\n    // Only report entries that do NOT also have a sanitize/escape call in the same scope\n    const sanitizeCallers: Set<string> = new Set<string>(\n      (rawDb.all(`\n        SELECT DISTINCT n.id\n        FROM edges e\n        JOIN nodes n  ON n.id  = e.source\n        JOIN nodes n2 ON n2.id = e.target\n        WHERE e.kind = 'calls'\n          AND (\n            n2.name LIKE '%sanitize%'\n            OR n2.name LIKE '%escape%'\n            OR n2.name LIKE '%parameteriz%'\n            OR n2.name LIKE '%prepared%'\n            OR n2.name LIKE '%placeholder%'\n          )\n      `) as Array<{ id: string }>).map((r) => r.id),\n    );\n\n    // Cross-reference: look up caller node IDs to filter sanitized callers\n    const callerIds: Map<string, string> = new Map(\n      (rawDb.all(`\n        SELECT id, name FROM nodes WHERE kind IN ('function', 'method', 'arrow_function')\n      `) as Array<{ id: string; name: string }>).map((r) => [r.name, r.id]),\n    );\n\n    return rows\n      .filter((row) => {\n        const callerId = callerIds.get(row.caller);\n        return !callerId || !sanitizeCallers.has(callerId);\n      })\n      .map((row) => ({\n        type: 'sql-injection' as const,\n        severity: 'critical' as const,\n        owaspCategory: 'A03' as const,\n        filePath: row.file_path,\n        line: row.start_line,\n        symbol: row.caller,\n        description: `Controller/handler '${row.caller}' calls database function '${row.callee}' without apparent input sanitization.`,\n        recommendation: `Use parameterized queries or prepared statements. Never concatenate user input into SQL strings. Consider an ORM with query builders.`,\n      }));\n  }\n\n  // \u2500\u2500 Detection: path traversal \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectPathTraversal(rawDb: any): DataFlowFinding[] {\n    // Find functions that call file I/O operations and look like they handle requests.\n    // Exclusions:\n    //   - Internal analysis/infrastructure paths (mcp, resolution, security, extraction, graph, architecture)\n    //   - 'open' is excluded from file ops because KiroGraph.open() (DB) triggers false positives\n    //   - Class names ending in 'Handler' or 'Server' are excluded (too broad \u2014 use more specific patterns)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('readFile', 'readFileSync', 'writeFile', 'writeFileSync', 'createReadStream', 'createWriteStream', 'openSync', 'unlink', 'unlinkSync')\n        AND (\n          n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%download%'\n          OR n.name LIKE '%upload%'\n          OR n.name LIKE '%get%file%'\n          OR n.name LIKE '%fetch%file%'\n          OR n.name LIKE '%serve%file%'\n          OR n.name LIKE '%handle%file%'\n        )\n        AND n.file_path != ''\n        AND n.file_path NOT LIKE '%/mcp/%'\n        AND n.file_path NOT LIKE '%/resolution/%'\n        AND n.file_path NOT LIKE '%/security/%'\n        AND n.file_path NOT LIKE '%/extraction/%'\n        AND n.file_path NOT LIKE '%/graph/%'\n        AND n.file_path NOT LIKE '%/architecture/%'\n        AND n.file_path NOT LIKE '%/frameworks/%'\n        AND n.file_path NOT LIKE '%/bridges/%'\n    `);\n\n    return rows.map((row) => ({\n      type: 'path-traversal' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A01' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Handler '${row.caller}' calls file operation '${row.callee}'. Path may be influenced by user input, enabling directory traversal.`,\n      recommendation: `Validate and normalize file paths. Use path.resolve() and verify the result is inside an allowed base directory. Reject paths containing '..'.`,\n    }));\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCO,MAAM,iBAAiB;AAAA,EAC5B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,UAAsC;AAC1C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,WAA8B,CAAC;AAErC,aAAS,KAAK,GAAG,KAAK,qBAAqB,KAAK,CAAC;AACjD,aAAS,KAAK,GAAG,KAAK,yBAAyB,KAAK,CAAC;AACrD,aAAS,KAAK,GAAG,KAAK,uBAAuB,KAAK,CAAC;AACnD,aAAS,KAAK,GAAG,KAAK,oBAAoB,KAAK,CAAC;AAChD,aAAS,KAAK,GAAG,KAAK,qBAAqB,KAAK,CAAC;AAEjD,WAAO;AAAA,EACT;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAC1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAQrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB,UAAU,IAAI,MAAM;AAAA,IACtC,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,yBAAyB,OAA+B;AAC9D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAarC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,uBAAuB,OAA+B;AAC5D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAyBrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,sDAAsD,IAAI,MAAM;AAAA,MACpG,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,oBAAoB,OAA+B;AAIzD,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAkBrC;AAGD,UAAM,kBAA+B,IAAI;AAAA,MACtC,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAaV,EAA4B,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9C;AAGA,UAAM,YAAiC,IAAI;AAAA,MACxC,MAAM,IAAI;AAAA;AAAA,OAEV,EAA0C,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;AAAA,IACtE;AAEA,WAAO,KACJ,OAAO,CAAC,QAAQ;AACf,YAAM,WAAW,UAAU,IAAI,IAAI,MAAM;AACzC,aAAO,CAAC,YAAY,CAAC,gBAAgB,IAAI,QAAQ;AAAA,IACnD,CAAC,EACA,IAAI,CAAC,SAAS;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,uBAAuB,IAAI,MAAM,8BAA8B,IAAI,MAAM;AAAA,MACtF,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACN;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAM1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KA2BrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,YAAY,IAAI,MAAM,2BAA2B,IAAI,MAAM;AAAA,MACxE,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AACF;",
+  "names": []
+}