kirograph 0.17.0 → 0.19.0

package/dist/security/dep-confusion.js

@@ -0,0 +1,255 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var dep_confusion_exports = {};
+__export(dep_confusion_exports, {
+  DepConfusionChecker: () => DepConfusionChecker
+});
+module.exports = __toCommonJS(dep_confusion_exports);
+var import_errors = require("../errors");
+const WELL_KNOWN_NPM = [
+  "lodash",
+  "express",
+  "react",
+  "axios",
+  "webpack",
+  "babel",
+  "moment",
+  "next",
+  "vue",
+  "angular"
+];
+function levenshtein(a, b) {
+  if (a === b) return 0;
+  if (a.length === 0) return b.length;
+  if (b.length === 0) return a.length;
+  const matrix = [];
+  for (let i = 0; i <= b.length; i++) matrix[i] = [i];
+  for (let j = 0; j <= a.length; j++) matrix[0][j] = j;
+  for (let i = 1; i <= b.length; i++) {
+    for (let j = 1; j <= a.length; j++) {
+      const cost = a[j - 1] === b[i - 1] ? 0 : 1;
+      matrix[i][j] = Math.min(
+        matrix[i - 1][j] + 1,
+        // deletion
+        matrix[i][j - 1] + 1,
+        // insertion
+        matrix[i - 1][j - 1] + cost
+        // substitution
+      );
+    }
+  }
+  return matrix[b.length][a.length];
+}
+function isTyposquatCandidate(name, wellKnown) {
+  const base = name.startsWith("@") ? name.split("/")[1] ?? name : name;
+  for (const known of wellKnown) {
+    const dist = levenshtein(base.toLowerCase(), known.toLowerCase());
+    if (dist > 0 && dist <= 2) return known;
+  }
+  return null;
+}
+const TIMEOUT_MS = 1e4;
+async function checkNpmPublic(name) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const encoded = encodeURIComponent(name);
+    const resp = await fetch(`https://registry.npmjs.org/${encoded}/latest`, {
+      method: "GET",
+      signal: controller.signal,
+      headers: { "Accept": "application/json" }
+    });
+    if (!resp.ok) return { exists: false, version: null, publishedAt: null };
+    const data = await resp.json();
+    const version = data["version"] ?? null;
+    const full = await fetch(`https://registry.npmjs.org/${encoded}`, {
+      headers: { "Accept": "application/json" }
+    });
+    let publishedAt = null;
+    if (full.ok) {
+      const fullData = await full.json();
+      const time = fullData["time"] ?? {};
+      publishedAt = time["created"] ?? null;
+    }
+    return { exists: true, version, publishedAt };
+  } catch {
+    return { exists: false, version: null, publishedAt: null };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkPypiPublic(name) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const resp = await fetch(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`, {
+      signal: controller.signal,
+      headers: { "Accept": "application/json" }
+    });
+    if (!resp.ok) return { exists: false, version: null, publishedAt: null };
+    const data = await resp.json();
+    const info = data["info"];
+    const version = info["version"] ?? null;
+    return { exists: true, version, publishedAt: null };
+  } catch {
+    return { exists: false, version: null, publishedAt: null };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function checkPublicRegistry(ecosystem, name) {
+  const eco = ecosystem.toLowerCase();
+  switch (eco) {
+    case "npm":
+      return checkNpmPublic(name);
+    case "pypi":
+    case "pip":
+      return checkPypiPublic(name);
+    default:
+      return { exists: false, version: null, publishedAt: null };
+  }
+}
+function detectInternal(packageName, sourceManifests, declaredConstraint) {
+  if (declaredConstraint.startsWith("file:") || declaredConstraint.startsWith("./") || declaredConstraint.startsWith("../")) {
+    return { isInternal: true, source: "local path" };
+  }
+  if (declaredConstraint.startsWith("git+") || declaredConstraint.startsWith("git://")) {
+    return { isInternal: true, source: "git dependency" };
+  }
+  for (const manifest of sourceManifests) {
+    if (manifest.includes(".kirograph/local") || manifest.includes("local/")) {
+      return { isInternal: true, source: "local registry" };
+    }
+  }
+  const wellKnownScopes = /* @__PURE__ */ new Set([
+    "@types",
+    "@babel",
+    "@jest",
+    "@testing-library",
+    "@angular",
+    "@vue",
+    "@react",
+    "@emotion",
+    "@mui",
+    "@chakra-ui",
+    "@tailwindcss",
+    "@storybook",
+    "@vitejs",
+    "@rollup",
+    "@esbuild",
+    "@swc",
+    "@aws-sdk",
+    "@google-cloud"
+  ]);
+  if (packageName.startsWith("@")) {
+    const scope = packageName.split("/")[0];
+    if (!wellKnownScopes.has(scope)) {
+      return { isInternal: true, source: `private scope ${scope}` };
+    }
+  }
+  return { isInternal: false, source: "public registry" };
+}
+class DepConfusionChecker {
+  constructor(db) {
+    this.db = db;
+  }
+  async check() {
+    const rawDb = this.db.getRawDb();
+    const rows = rawDb.all(
+      `SELECT node_id, package_name, ecosystem, declared_constraint, source_manifests, scope
+       FROM sec_dependencies
+       WHERE scope = 'production'`
+    );
+    const findings = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const row of rows) {
+      const key = `${row.ecosystem}:${row.package_name}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      let manifests = [];
+      try {
+        manifests = JSON.parse(row.source_manifests);
+      } catch {
+      }
+      const { isInternal, source } = detectInternal(
+        row.package_name,
+        manifests,
+        row.declared_constraint
+      );
+      if (isInternal) {
+        let publicInfo = { exists: false, version: null, publishedAt: null };
+        try {
+          let nameToCheck = row.package_name;
+          if (nameToCheck.startsWith("@")) {
+            nameToCheck = nameToCheck.split("/")[1] ?? nameToCheck;
+          }
+          publicInfo = await checkPublicRegistry(row.ecosystem, nameToCheck);
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          (0, import_errors.logWarn)(`[dep-confusion] Registry check failed for ${row.package_name}: ${msg}`);
+        }
+        if (publicInfo.exists) {
+          findings.push({
+            packageName: row.package_name,
+            ecosystem: row.ecosystem,
+            internalSource: source,
+            publicExists: true,
+            publicVersion: publicInfo.version,
+            publicPublishedAt: publicInfo.publishedAt,
+            riskLevel: "critical",
+            explanation: `Package "${row.package_name}" appears to be an internal dependency (${source}) but a public package with the same name exists in the ${row.ecosystem} registry (version ${publicInfo.version ?? "unknown"}). This is a potential dependency confusion attack vector.`
+          });
+          continue;
+        }
+        findings.push({
+          packageName: row.package_name,
+          ecosystem: row.ecosystem,
+          internalSource: source,
+          publicExists: false,
+          publicVersion: null,
+          publicPublishedAt: null,
+          riskLevel: "medium",
+          explanation: `Package "${row.package_name}" appears to be an internal dependency (${source}). No public package found with the same name, but this should be monitored.`
+        });
+        continue;
+      }
+      if (row.ecosystem.toLowerCase() === "npm") {
+        const similar = isTyposquatCandidate(row.package_name, WELL_KNOWN_NPM);
+        if (similar) {
+          findings.push({
+            packageName: row.package_name,
+            ecosystem: row.ecosystem,
+            internalSource: "public registry",
+            publicExists: true,
+            publicVersion: null,
+            publicPublishedAt: null,
+            riskLevel: "high",
+            explanation: `Package "${row.package_name}" has a name very similar to the well-known package "${similar}" (Levenshtein distance \u2264 2). This may be a typosquatting attempt.`
+          });
+        }
+      }
+    }
+    return findings;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DepConfusionChecker
+});
+//# sourceMappingURL=dep-confusion.js.map

package/dist/security/dep-confusion.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/dep-confusion.ts"],
+  "sourcesContent": ["/**\n * Dependency Confusion Checker\n *\n * Detects internal packages whose names exist in public registries\n * (a supply chain attack vector), and flags typosquatting candidates.\n */\n\nimport { logWarn } from '../errors';\nimport type { GraphDatabase } from '../db/database';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface DepConfusionFinding {\n  packageName: string;\n  ecosystem: string;\n  internalSource: string;    // e.g. \"private registry\" or \"local path\"\n  publicExists: boolean;\n  publicVersion: string | null;\n  publicPublishedAt: string | null;\n  riskLevel: 'critical' | 'high' | 'medium';\n  explanation: string;\n}\n\n// \u2500\u2500 Constants \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n// Well-known packages for typosquatting detection\nconst WELL_KNOWN_NPM: string[] = [\n  'lodash', 'express', 'react', 'axios', 'webpack', 'babel', 'moment',\n  'next', 'vue', 'angular',\n];\n\n// \u2500\u2500 Levenshtein distance (for typosquatting) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction levenshtein(a: string, b: string): number {\n  if (a === b) return 0;\n  if (a.length === 0) return b.length;\n  if (b.length === 0) return a.length;\n\n  const matrix: number[][] = [];\n  for (let i = 0; i <= b.length; i++) matrix[i] = [i];\n  for (let j = 0; j <= a.length; j++) matrix[0]![j] = j;\n\n  for (let i = 1; i <= b.length; i++) {\n    for (let j = 1; j <= a.length; j++) {\n      const cost = a[j - 1] === b[i - 1] ? 0 : 1;\n      matrix[i]![j] = Math.min(\n        matrix[i - 1]![j]! + 1,       // deletion\n        matrix[i]![j - 1]! + 1,        // insertion\n        matrix[i - 1]![j - 1]! + cost, // substitution\n      );\n    }\n  }\n  return matrix[b.length]![a.length]!;\n}\n\nfunction isTyposquatCandidate(name: string, wellKnown: string[]): string | null {\n  // Strip scoped prefix for comparison\n  const base = name.startsWith('@') ? name.split('/')[1] ?? name : name;\n  for (const known of wellKnown) {\n    const dist = levenshtein(base.toLowerCase(), known.toLowerCase());\n    if (dist > 0 && dist <= 2) return known;\n  }\n  return null;\n}\n\n// \u2500\u2500 Registry HEAD check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst TIMEOUT_MS = 10_000;\n\ninterface PublicInfo {\n  exists: boolean;\n  version: string | null;\n  publishedAt: string | null;\n}\n\nasync function checkNpmPublic(name: string): Promise<PublicInfo> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);\n  try {\n    const encoded = encodeURIComponent(name);\n    const resp = await fetch(`https://registry.npmjs.org/${encoded}/latest`, {\n      method: 'GET',\n      signal: controller.signal,\n      headers: { 'Accept': 'application/json' },\n    });\n    if (!resp.ok) return { exists: false, version: null, publishedAt: null };\n    const data = await resp.json() as Record<string, unknown>;\n    const version = (data['version'] as string) ?? null;\n    // Fetch time info\n    const full = await fetch(`https://registry.npmjs.org/${encoded}`, {\n      headers: { 'Accept': 'application/json' },\n    });\n    let publishedAt: string | null = null;\n    if (full.ok) {\n      const fullData = await full.json() as Record<string, unknown>;\n      const time = (fullData['time'] as Record<string, string>) ?? {};\n      publishedAt = time['created'] ?? null;\n    }\n    return { exists: true, version, publishedAt };\n  } catch {\n    return { exists: false, version: null, publishedAt: null };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nasync function checkPypiPublic(name: string): Promise<PublicInfo> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);\n  try {\n    const resp = await fetch(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`, {\n      signal: controller.signal,\n      headers: { 'Accept': 'application/json' },\n    });\n    if (!resp.ok) return { exists: false, version: null, publishedAt: null };\n    const data = await resp.json() as Record<string, unknown>;\n    const info = data['info'] as Record<string, unknown>;\n    const version = (info['version'] as string) ?? null;\n    return { exists: true, version, publishedAt: null };\n  } catch {\n    return { exists: false, version: null, publishedAt: null };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nasync function checkPublicRegistry(ecosystem: string, name: string): Promise<PublicInfo> {\n  const eco = ecosystem.toLowerCase();\n  switch (eco) {\n    case 'npm':  return checkNpmPublic(name);\n    case 'pypi':\n    case 'pip':  return checkPypiPublic(name);\n    default:\n      // For other ecosystems, we do not have a reliable public lookup\n      return { exists: false, version: null, publishedAt: null };\n  }\n}\n\n// \u2500\u2500 Internal package detection \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface InternalIndicator {\n  isInternal: boolean;\n  source: string;\n}\n\nfunction detectInternal(\n  packageName: string,\n  sourceManifests: string[],\n  declaredConstraint: string,\n): InternalIndicator {\n  // Local file references\n  if (declaredConstraint.startsWith('file:') || declaredConstraint.startsWith('./') || declaredConstraint.startsWith('../')) {\n    return { isInternal: true, source: 'local path' };\n  }\n  if (declaredConstraint.startsWith('git+') || declaredConstraint.startsWith('git://')) {\n    return { isInternal: true, source: 'git dependency' };\n  }\n\n  // Manifest path hints (e.g. a private registry URL)\n  for (const manifest of sourceManifests) {\n    if (manifest.includes('.kirograph/local') || manifest.includes('local/')) {\n      return { isInternal: true, source: 'local registry' };\n    }\n  }\n\n  // Scoped packages with company-like scope names (heuristic)\n  // e.g. @mycompany/foo \u2014 not @types, @babel, @jest, etc.\n  const wellKnownScopes = new Set([\n    '@types', '@babel', '@jest', '@testing-library', '@angular', '@vue',\n    '@react', '@emotion', '@mui', '@chakra-ui', '@tailwindcss', '@storybook',\n    '@vitejs', '@rollup', '@esbuild', '@swc', '@aws-sdk', '@google-cloud',\n  ]);\n\n  if (packageName.startsWith('@')) {\n    const scope = packageName.split('/')[0]!;\n    if (!wellKnownScopes.has(scope)) {\n      return { isInternal: true, source: `private scope ${scope}` };\n    }\n  }\n\n  return { isInternal: false, source: 'public registry' };\n}\n\n// \u2500\u2500 DepConfusionChecker \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class DepConfusionChecker {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async check(): Promise<DepConfusionFinding[]> {\n    const rawDb = this.db.getRawDb();\n    const rows: Array<{\n      node_id: string;\n      package_name: string;\n      ecosystem: string;\n      declared_constraint: string;\n      source_manifests: string;\n      scope: string;\n    }> = rawDb.all(\n      `SELECT node_id, package_name, ecosystem, declared_constraint, source_manifests, scope\n       FROM sec_dependencies\n       WHERE scope = 'production'`,\n    );\n\n    const findings: DepConfusionFinding[] = [];\n    const seen = new Set<string>();\n\n    for (const row of rows) {\n      const key = `${row.ecosystem}:${row.package_name}`;\n      if (seen.has(key)) continue;\n      seen.add(key);\n\n      let manifests: string[] = [];\n      try {\n        manifests = JSON.parse(row.source_manifests) as string[];\n      } catch {\n        // ignore malformed JSON\n      }\n\n      // \u2500\u2500 1. Internal package confusion \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n      const { isInternal, source } = detectInternal(\n        row.package_name,\n        manifests,\n        row.declared_constraint,\n      );\n\n      if (isInternal) {\n        let publicInfo: PublicInfo = { exists: false, version: null, publishedAt: null };\n        try {\n          // For scoped packages, also check the unscoped name\n          let nameToCheck = row.package_name;\n          if (nameToCheck.startsWith('@')) {\n            nameToCheck = nameToCheck.split('/')[1] ?? nameToCheck;\n          }\n          publicInfo = await checkPublicRegistry(row.ecosystem, nameToCheck);\n        } catch (err) {\n          const msg = err instanceof Error ? err.message : String(err);\n          logWarn(`[dep-confusion] Registry check failed for ${row.package_name}: ${msg}`);\n        }\n\n        if (publicInfo.exists) {\n          findings.push({\n            packageName: row.package_name,\n            ecosystem: row.ecosystem,\n            internalSource: source,\n            publicExists: true,\n            publicVersion: publicInfo.version,\n            publicPublishedAt: publicInfo.publishedAt,\n            riskLevel: 'critical',\n            explanation:\n              `Package \"${row.package_name}\" appears to be an internal dependency (${source}) ` +\n              `but a public package with the same name exists in the ${row.ecosystem} registry ` +\n              `(version ${publicInfo.version ?? 'unknown'}). This is a potential dependency confusion attack vector.`,\n          });\n          continue;\n        }\n\n        // Internal package without public counterpart \u2014 medium risk\n        findings.push({\n          packageName: row.package_name,\n          ecosystem: row.ecosystem,\n          internalSource: source,\n          publicExists: false,\n          publicVersion: null,\n          publicPublishedAt: null,\n          riskLevel: 'medium',\n          explanation:\n            `Package \"${row.package_name}\" appears to be an internal dependency (${source}). ` +\n            `No public package found with the same name, but this should be monitored.`,\n        });\n        continue;\n      }\n\n      // \u2500\u2500 2. Typosquatting detection (npm only for now) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n      if (row.ecosystem.toLowerCase() === 'npm') {\n        const similar = isTyposquatCandidate(row.package_name, WELL_KNOWN_NPM);\n        if (similar) {\n          findings.push({\n            packageName: row.package_name,\n            ecosystem: row.ecosystem,\n            internalSource: 'public registry',\n            publicExists: true,\n            publicVersion: null,\n            publicPublishedAt: null,\n            riskLevel: 'high',\n            explanation:\n              `Package \"${row.package_name}\" has a name very similar to the well-known package ` +\n              `\"${similar}\" (Levenshtein distance \u2264 2). This may be a typosquatting attempt.`,\n          });\n        }\n      }\n    }\n\n    return findings;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,oBAAwB;AAmBxB,MAAM,iBAA2B;AAAA,EAC/B;AAAA,EAAU;AAAA,EAAW;AAAA,EAAS;AAAA,EAAS;AAAA,EAAW;AAAA,EAAS;AAAA,EAC3D;AAAA,EAAQ;AAAA,EAAO;AACjB;AAIA,SAAS,YAAY,GAAW,GAAmB;AACjD,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,EAAE,WAAW,EAAG,QAAO,EAAE;AAC7B,MAAI,EAAE,WAAW,EAAG,QAAO,EAAE;AAE7B,QAAM,SAAqB,CAAC;AAC5B,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,IAAK,QAAO,CAAC,IAAI,CAAC,CAAC;AAClD,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,IAAK,QAAO,CAAC,EAAG,CAAC,IAAI;AAEpD,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK;AAClC,aAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK;AAClC,YAAM,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI;AACzC,aAAO,CAAC,EAAG,CAAC,IAAI,KAAK;AAAA,QACnB,OAAO,IAAI,CAAC,EAAG,CAAC,IAAK;AAAA;AAAA,QACrB,OAAO,CAAC,EAAG,IAAI,CAAC,IAAK;AAAA;AAAA,QACrB,OAAO,IAAI,CAAC,EAAG,IAAI,CAAC,IAAK;AAAA;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO,EAAE,MAAM,EAAG,EAAE,MAAM;AACnC;AAEA,SAAS,qBAAqB,MAAc,WAAoC;AAE9E,QAAM,OAAO,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,KAAK,OAAO;AACjE,aAAW,SAAS,WAAW;AAC7B,UAAM,OAAO,YAAY,KAAK,YAAY,GAAG,MAAM,YAAY,CAAC;AAChE,QAAI,OAAO,KAAK,QAAQ,EAAG,QAAO;AAAA,EACpC;AACA,SAAO;AACT;AAIA,MAAM,aAAa;AAQnB,eAAe,eAAe,MAAmC;AAC/D,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,MAAI;AACF,UAAM,UAAU,mBAAmB,IAAI;AACvC,UAAM,OAAO,MAAM,MAAM,8BAA8B,OAAO,WAAW;AAAA,MACvE,QAAQ;AAAA,MACR,QAAQ,WAAW;AAAA,MACnB,SAAS,EAAE,UAAU,mBAAmB;AAAA,IAC1C,CAAC;AACD,QAAI,CAAC,KAAK,GAAI,QAAO,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AACvE,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAM,UAAW,KAAK,SAAS,KAAgB;AAE/C,UAAM,OAAO,MAAM,MAAM,8BAA8B,OAAO,IAAI;AAAA,MAChE,SAAS,EAAE,UAAU,mBAAmB;AAAA,IAC1C,CAAC;AACD,QAAI,cAA6B;AACjC,QAAI,KAAK,IAAI;AACX,YAAM,WAAW,MAAM,KAAK,KAAK;AACjC,YAAM,OAAQ,SAAS,MAAM,KAAgC,CAAC;AAC9D,oBAAc,KAAK,SAAS,KAAK;AAAA,IACnC;AACA,WAAO,EAAE,QAAQ,MAAM,SAAS,YAAY;AAAA,EAC9C,QAAQ;AACN,WAAO,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AAAA,EAC3D,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAEA,eAAe,gBAAgB,MAAmC;AAChE,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,yBAAyB,mBAAmB,IAAI,CAAC,SAAS;AAAA,MACjF,QAAQ,WAAW;AAAA,MACnB,SAAS,EAAE,UAAU,mBAAmB;AAAA,IAC1C,CAAC;AACD,QAAI,CAAC,KAAK,GAAI,QAAO,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AACvE,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAM,OAAO,KAAK,MAAM;AACxB,UAAM,UAAW,KAAK,SAAS,KAAgB;AAC/C,WAAO,EAAE,QAAQ,MAAM,SAAS,aAAa,KAAK;AAAA,EACpD,QAAQ;AACN,WAAO,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AAAA,EAC3D,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAEA,eAAe,oBAAoB,WAAmB,MAAmC;AACvF,QAAM,MAAM,UAAU,YAAY;AAClC,UAAQ,KAAK;AAAA,IACX,KAAK;AAAQ,aAAO,eAAe,IAAI;AAAA,IACvC,KAAK;AAAA,IACL,KAAK;AAAQ,aAAO,gBAAgB,IAAI;AAAA,IACxC;AAEE,aAAO,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AAAA,EAC7D;AACF;AASA,SAAS,eACP,aACA,iBACA,oBACmB;AAEnB,MAAI,mBAAmB,WAAW,OAAO,KAAK,mBAAmB,WAAW,IAAI,KAAK,mBAAmB,WAAW,KAAK,GAAG;AACzH,WAAO,EAAE,YAAY,MAAM,QAAQ,aAAa;AAAA,EAClD;AACA,MAAI,mBAAmB,WAAW,MAAM,KAAK,mBAAmB,WAAW,QAAQ,GAAG;AACpF,WAAO,EAAE,YAAY,MAAM,QAAQ,iBAAiB;AAAA,EACtD;AAGA,aAAW,YAAY,iBAAiB;AACtC,QAAI,SAAS,SAAS,kBAAkB,KAAK,SAAS,SAAS,QAAQ,GAAG;AACxE,aAAO,EAAE,YAAY,MAAM,QAAQ,iBAAiB;AAAA,IACtD;AAAA,EACF;AAIA,QAAM,kBAAkB,oBAAI,IAAI;AAAA,IAC9B;AAAA,IAAU;AAAA,IAAU;AAAA,IAAS;AAAA,IAAoB;AAAA,IAAY;AAAA,IAC7D;AAAA,IAAU;AAAA,IAAY;AAAA,IAAQ;AAAA,IAAc;AAAA,IAAgB;AAAA,IAC5D;AAAA,IAAW;AAAA,IAAW;AAAA,IAAY;AAAA,IAAQ;AAAA,IAAY;AAAA,EACxD,CAAC;AAED,MAAI,YAAY,WAAW,GAAG,GAAG;AAC/B,UAAM,QAAQ,YAAY,MAAM,GAAG,EAAE,CAAC;AACtC,QAAI,CAAC,gBAAgB,IAAI,KAAK,GAAG;AAC/B,aAAO,EAAE,YAAY,MAAM,QAAQ,iBAAiB,KAAK,GAAG;AAAA,IAC9D;AAAA,EACF;AAEA,SAAO,EAAE,YAAY,OAAO,QAAQ,kBAAkB;AACxD;AAIO,MAAM,oBAAoB;AAAA,EAC/B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,QAAwC;AAC5C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,OAOD,MAAM;AAAA,MACT;AAAA;AAAA;AAAA,IAGF;AAEA,UAAM,WAAkC,CAAC;AACzC,UAAM,OAAO,oBAAI,IAAY;AAE7B,eAAW,OAAO,MAAM;AACtB,YAAM,MAAM,GAAG,IAAI,SAAS,IAAI,IAAI,YAAY;AAChD,UAAI,KAAK,IAAI,GAAG,EAAG;AACnB,WAAK,IAAI,GAAG;AAEZ,UAAI,YAAsB,CAAC;AAC3B,UAAI;AACF,oBAAY,KAAK,MAAM,IAAI,gBAAgB;AAAA,MAC7C,QAAQ;AAAA,MAER;AAGA,YAAM,EAAE,YAAY,OAAO,IAAI;AAAA,QAC7B,IAAI;AAAA,QACJ;AAAA,QACA,IAAI;AAAA,MACN;AAEA,UAAI,YAAY;AACd,YAAI,aAAyB,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AAC/E,YAAI;AAEF,cAAI,cAAc,IAAI;AACtB,cAAI,YAAY,WAAW,GAAG,GAAG;AAC/B,0BAAc,YAAY,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,UAC7C;AACA,uBAAa,MAAM,oBAAoB,IAAI,WAAW,WAAW;AAAA,QACnE,SAAS,KAAK;AACZ,gBAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,qCAAQ,6CAA6C,IAAI,YAAY,KAAK,GAAG,EAAE;AAAA,QACjF;AAEA,YAAI,WAAW,QAAQ;AACrB,mBAAS,KAAK;AAAA,YACZ,aAAa,IAAI;AAAA,YACjB,WAAW,IAAI;AAAA,YACf,gBAAgB;AAAA,YAChB,cAAc;AAAA,YACd,eAAe,WAAW;AAAA,YAC1B,mBAAmB,WAAW;AAAA,YAC9B,WAAW;AAAA,YACX,aACE,YAAY,IAAI,YAAY,2CAA2C,MAAM,2DACpB,IAAI,SAAS,sBAC1D,WAAW,WAAW,SAAS;AAAA,UAC/C,CAAC;AACD;AAAA,QACF;AAGA,iBAAS,KAAK;AAAA,UACZ,aAAa,IAAI;AAAA,UACjB,WAAW,IAAI;AAAA,UACf,gBAAgB;AAAA,UAChB,cAAc;AAAA,UACd,eAAe;AAAA,UACf,mBAAmB;AAAA,UACnB,WAAW;AAAA,UACX,aACE,YAAY,IAAI,YAAY,2CAA2C,MAAM;AAAA,QAEjF,CAAC;AACD;AAAA,MACF;AAGA,UAAI,IAAI,UAAU,YAAY,MAAM,OAAO;AACzC,cAAM,UAAU,qBAAqB,IAAI,cAAc,cAAc;AACrE,YAAI,SAAS;AACX,mBAAS,KAAK;AAAA,YACZ,aAAa,IAAI;AAAA,YACjB,WAAW,IAAI;AAAA,YACf,gBAAgB;AAAA,YAChB,cAAc;AAAA,YACd,eAAe;AAAA,YACf,mBAAmB;AAAA,YACnB,WAAW;AAAA,YACX,aACE,YAAY,IAAI,YAAY,wDACxB,OAAO;AAAA,UACf,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/security/errors.js

@@ -0,0 +1,51 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var errors_exports = {};
+__export(errors_exports, {
+  ManifestParseError: () => ManifestParseError,
+  SecurityError: () => SecurityError,
+  VulnDatabaseError: () => VulnDatabaseError
+});
+module.exports = __toCommonJS(errors_exports);
+var import_errors = require("../errors");
+class SecurityError extends import_errors.KiroGraphError {
+  constructor(message, context) {
+    super(message, "SECURITY_ERROR", context);
+    this.name = "SecurityError";
+  }
+}
+class ManifestParseError extends import_errors.KiroGraphError {
+  constructor(message, filePath, line) {
+    super(message, "MANIFEST_PARSE_ERROR", { filePath, line });
+    this.name = "ManifestParseError";
+  }
+}
+class VulnDatabaseError extends import_errors.KiroGraphError {
+  constructor(message, database, httpStatus) {
+    super(message, "VULN_DATABASE_ERROR", { database, httpStatus });
+    this.name = "VulnDatabaseError";
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ManifestParseError,
+  SecurityError,
+  VulnDatabaseError
+});
+//# sourceMappingURL=errors.js.map

package/dist/security/errors.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/errors.ts"],
+  "sourcesContent": ["/**\n * KiroGraph-Sec Error Classes\n *\n * Security-specific error types extending the base KiroGraphError.\n */\n\nimport { KiroGraphError } from '../errors';\n\nexport class SecurityError extends KiroGraphError {\n  constructor(message: string, context?: Record<string, unknown>) {\n    super(message, 'SECURITY_ERROR', context);\n    this.name = 'SecurityError';\n  }\n}\n\nexport class ManifestParseError extends KiroGraphError {\n  constructor(message: string, filePath: string, line?: number) {\n    super(message, 'MANIFEST_PARSE_ERROR', { filePath, line });\n    this.name = 'ManifestParseError';\n  }\n}\n\nexport class VulnDatabaseError extends KiroGraphError {\n  constructor(message: string, database: string, httpStatus?: number) {\n    super(message, 'VULN_DATABASE_ERROR', { database, httpStatus });\n    this.name = 'VulnDatabaseError';\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,oBAA+B;AAExB,MAAM,sBAAsB,6BAAe;AAAA,EAChD,YAAY,SAAiB,SAAmC;AAC9D,UAAM,SAAS,kBAAkB,OAAO;AACxC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,6BAAe;AAAA,EACrD,YAAY,SAAiB,UAAkB,MAAe;AAC5D,UAAM,SAAS,wBAAwB,EAAE,UAAU,KAAK,CAAC;AACzD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0BAA0B,6BAAe;AAAA,EACpD,YAAY,SAAiB,UAAkB,YAAqB;AAClE,UAAM,SAAS,uBAAuB,EAAE,UAAU,WAAW,CAAC;AAC9D,SAAK,OAAO;AAAA,EACd;AACF;",
+  "names": []
+}

package/dist/security/export/fix-suggestions.js

@@ -0,0 +1,58 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var fix_suggestions_exports = {};
+__export(fix_suggestions_exports, {
+  buildFixSuggestion: () => buildFixSuggestion,
+  formatFixSuggestion: () => formatFixSuggestion
+});
+module.exports = __toCommonJS(fix_suggestions_exports);
+function buildFixSuggestion(ecosystem, packageName, fixedVersion) {
+  switch (ecosystem.toLowerCase()) {
+    case "npm":
+      return `npm install ${packageName}@${fixedVersion}`;
+    case "maven": {
+      const parts = packageName.split(":");
+      if (parts.length === 2) {
+        return `Update ${parts[0]}:${parts[1]} to ${fixedVersion} in pom.xml`;
+      }
+      return `Update ${packageName} to ${fixedVersion} in pom.xml`;
+    }
+    case "go":
+    case "golang":
+      return `go get ${packageName}@v${fixedVersion}`;
+    case "pypi":
+    case "pip":
+      return `pip install ${packageName}==${fixedVersion}`;
+    case "cargo":
+      return `cargo update -p ${packageName} --precise ${fixedVersion}`;
+    default:
+      return `Upgrade ${packageName} to ${fixedVersion}`;
+  }
+}
+function formatFixSuggestion(ecosystem, packageName, fixedVersion) {
+  if (!fixedVersion) return "";
+  const command = buildFixSuggestion(ecosystem, packageName, fixedVersion);
+  return `\u{1F4A1} Fix: ${command}`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  buildFixSuggestion,
+  formatFixSuggestion
+});
+//# sourceMappingURL=fix-suggestions.js.map

package/dist/security/export/fix-suggestions.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/export/fix-suggestions.ts"],
+  "sourcesContent": ["/**\n * Fix Suggestion Builder\n *\n * Generates ecosystem-appropriate upgrade commands for vulnerabilities\n * that have a known fixed version. Reusable by CLI and MCP tools.\n */\n\n/**\n * Build an ecosystem-appropriate fix suggestion command.\n *\n * @param ecosystem - The package ecosystem (npm, maven, go, pypi, cargo)\n * @param packageName - The package name (for maven: groupId:artifactId)\n * @param fixedVersion - The version that fixes the vulnerability\n * @returns A formatted fix command string, or empty string if ecosystem is unknown\n */\nexport function buildFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string): string {\n  switch (ecosystem.toLowerCase()) {\n    case 'npm':\n      return `npm install ${packageName}@${fixedVersion}`;\n    case 'maven': {\n      // Maven packageName is typically \"groupId:artifactId\"\n      const parts = packageName.split(':');\n      if (parts.length === 2) {\n        return `Update ${parts[0]}:${parts[1]} to ${fixedVersion} in pom.xml`;\n      }\n      return `Update ${packageName} to ${fixedVersion} in pom.xml`;\n    }\n    case 'go':\n    case 'golang':\n      return `go get ${packageName}@v${fixedVersion}`;\n    case 'pypi':\n    case 'pip':\n      return `pip install ${packageName}==${fixedVersion}`;\n    case 'cargo':\n      return `cargo update -p ${packageName} --precise ${fixedVersion}`;\n    default:\n      return `Upgrade ${packageName} to ${fixedVersion}`;\n  }\n}\n\n/**\n * Format a fix suggestion line for display.\n * Returns the formatted line with the \uD83D\uDCA1 prefix, or empty string if no fixed version.\n */\nexport function formatFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string | null | undefined): string {\n  if (!fixedVersion) return '';\n  const command = buildFixSuggestion(ecosystem, packageName, fixedVersion);\n  return `\uD83D\uDCA1 Fix: ${command}`;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeO,SAAS,mBAAmB,WAAmB,aAAqB,cAA8B;AACvG,UAAQ,UAAU,YAAY,GAAG;AAAA,IAC/B,KAAK;AACH,aAAO,eAAe,WAAW,IAAI,YAAY;AAAA,IACnD,KAAK,SAAS;AAEZ,YAAM,QAAQ,YAAY,MAAM,GAAG;AACnC,UAAI,MAAM,WAAW,GAAG;AACtB,eAAO,UAAU,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,YAAY;AAAA,MAC1D;AACA,aAAO,UAAU,WAAW,OAAO,YAAY;AAAA,IACjD;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AACH,aAAO,UAAU,WAAW,KAAK,YAAY;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AACH,aAAO,eAAe,WAAW,KAAK,YAAY;AAAA,IACpD,KAAK;AACH,aAAO,mBAAmB,WAAW,cAAc,YAAY;AAAA,IACjE;AACE,aAAO,WAAW,WAAW,OAAO,YAAY;AAAA,EACpD;AACF;AAMO,SAAS,oBAAoB,WAAmB,aAAqB,cAAiD;AAC3H,MAAI,CAAC,aAAc,QAAO;AAC1B,QAAM,UAAU,mBAAmB,WAAW,aAAa,YAAY;AACvE,SAAO,kBAAW,OAAO;AAC3B;",
+  "names": []
+}

package/dist/security/export/fix-suggestions.test.js

@@ -0,0 +1,74 @@
+"use strict";
+var import_vitest = require("vitest");
+var import_fix_suggestions = require("./fix-suggestions");
+(0, import_vitest.describe)("buildFixSuggestion", () => {
+  (0, import_vitest.it)("generates npm install command for npm ecosystem", () => {
+    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("npm", "express", "4.18.3")).toBe(
+      "npm install express@4.18.3"
+    );
+  });
+  (0, import_vitest.it)("generates maven update instruction for maven ecosystem with groupId:artifactId", () => {
+    (0, import_vitest.expect)(
+      (0, import_fix_suggestions.buildFixSuggestion)("maven", "org.apache.logging.log4j:log4j-core", "2.17.1")
+    ).toBe("Update org.apache.logging.log4j:log4j-core to 2.17.1 in pom.xml");
+  });
+  (0, import_vitest.it)("handles maven package without colon separator", () => {
+    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("maven", "log4j-core", "2.17.1")).toBe(
+      "Update log4j-core to 2.17.1 in pom.xml"
+    );
+  });
+  (0, import_vitest.it)("generates go get command for go ecosystem", () => {
+    (0, import_vitest.expect)(
+      (0, import_fix_suggestions.buildFixSuggestion)("go", "github.com/gin-gonic/gin", "1.9.2")
+    ).toBe("go get github.com/gin-gonic/gin@v1.9.2");
+  });
+  (0, import_vitest.it)("generates go get command for golang ecosystem alias", () => {
+    (0, import_vitest.expect)(
+      (0, import_fix_suggestions.buildFixSuggestion)("golang", "github.com/gin-gonic/gin", "1.9.2")
+    ).toBe("go get github.com/gin-gonic/gin@v1.9.2");
+  });
+  (0, import_vitest.it)("generates pip install command for pypi ecosystem", () => {
+    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("pypi", "django", "4.2.1")).toBe(
+      "pip install django==4.2.1"
+    );
+  });
+  (0, import_vitest.it)("generates pip install command for pip ecosystem alias", () => {
+    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("pip", "requests", "2.31.0")).toBe(
+      "pip install requests==2.31.0"
+    );
+  });
+  (0, import_vitest.it)("generates cargo update command for cargo ecosystem", () => {
+    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("cargo", "serde", "1.0.189")).toBe(
+      "cargo update -p serde --precise 1.0.189"
+    );
+  });
+  (0, import_vitest.it)("generates generic upgrade message for unknown ecosystem", () => {
+    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("unknown", "some-pkg", "2.0.0")).toBe(
+      "Upgrade some-pkg to 2.0.0"
+    );
+  });
+  (0, import_vitest.it)("is case-insensitive for ecosystem", () => {
+    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("NPM", "express", "4.18.3")).toBe(
+      "npm install express@4.18.3"
+    );
+    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("Cargo", "serde", "1.0.189")).toBe(
+      "cargo update -p serde --precise 1.0.189"
+    );
+  });
+});
+(0, import_vitest.describe)("formatFixSuggestion", () => {
+  (0, import_vitest.it)("returns formatted line with \u{1F4A1} prefix when fixedVersion is provided", () => {
+    const result = (0, import_fix_suggestions.formatFixSuggestion)("npm", "express", "4.18.3");
+    (0, import_vitest.expect)(result).toBe("\u{1F4A1} Fix: npm install express@4.18.3");
+  });
+  (0, import_vitest.it)("returns empty string when fixedVersion is null", () => {
+    (0, import_vitest.expect)((0, import_fix_suggestions.formatFixSuggestion)("npm", "express", null)).toBe("");
+  });
+  (0, import_vitest.it)("returns empty string when fixedVersion is undefined", () => {
+    (0, import_vitest.expect)((0, import_fix_suggestions.formatFixSuggestion)("npm", "express", void 0)).toBe("");
+  });
+  (0, import_vitest.it)("returns empty string when fixedVersion is empty string", () => {
+    (0, import_vitest.expect)((0, import_fix_suggestions.formatFixSuggestion)("npm", "express", "")).toBe("");
+  });
+});
+//# sourceMappingURL=fix-suggestions.test.js.map

package/dist/security/export/fix-suggestions.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/export/fix-suggestions.test.ts"],
+  "sourcesContent": ["/**\n * Unit tests for fix suggestion builder\n */\nimport { describe, it, expect } from 'vitest';\nimport { buildFixSuggestion, formatFixSuggestion } from './fix-suggestions';\n\ndescribe('buildFixSuggestion', () => {\n  it('generates npm install command for npm ecosystem', () => {\n    expect(buildFixSuggestion('npm', 'express', '4.18.3')).toBe(\n      'npm install express@4.18.3',\n    );\n  });\n\n  it('generates maven update instruction for maven ecosystem with groupId:artifactId', () => {\n    expect(\n      buildFixSuggestion('maven', 'org.apache.logging.log4j:log4j-core', '2.17.1'),\n    ).toBe('Update org.apache.logging.log4j:log4j-core to 2.17.1 in pom.xml');\n  });\n\n  it('handles maven package without colon separator', () => {\n    expect(buildFixSuggestion('maven', 'log4j-core', '2.17.1')).toBe(\n      'Update log4j-core to 2.17.1 in pom.xml',\n    );\n  });\n\n  it('generates go get command for go ecosystem', () => {\n    expect(\n      buildFixSuggestion('go', 'github.com/gin-gonic/gin', '1.9.2'),\n    ).toBe('go get github.com/gin-gonic/gin@v1.9.2');\n  });\n\n  it('generates go get command for golang ecosystem alias', () => {\n    expect(\n      buildFixSuggestion('golang', 'github.com/gin-gonic/gin', '1.9.2'),\n    ).toBe('go get github.com/gin-gonic/gin@v1.9.2');\n  });\n\n  it('generates pip install command for pypi ecosystem', () => {\n    expect(buildFixSuggestion('pypi', 'django', '4.2.1')).toBe(\n      'pip install django==4.2.1',\n    );\n  });\n\n  it('generates pip install command for pip ecosystem alias', () => {\n    expect(buildFixSuggestion('pip', 'requests', '2.31.0')).toBe(\n      'pip install requests==2.31.0',\n    );\n  });\n\n  it('generates cargo update command for cargo ecosystem', () => {\n    expect(buildFixSuggestion('cargo', 'serde', '1.0.189')).toBe(\n      'cargo update -p serde --precise 1.0.189',\n    );\n  });\n\n  it('generates generic upgrade message for unknown ecosystem', () => {\n    expect(buildFixSuggestion('unknown', 'some-pkg', '2.0.0')).toBe(\n      'Upgrade some-pkg to 2.0.0',\n    );\n  });\n\n  it('is case-insensitive for ecosystem', () => {\n    expect(buildFixSuggestion('NPM', 'express', '4.18.3')).toBe(\n      'npm install express@4.18.3',\n    );\n    expect(buildFixSuggestion('Cargo', 'serde', '1.0.189')).toBe(\n      'cargo update -p serde --precise 1.0.189',\n    );\n  });\n});\n\ndescribe('formatFixSuggestion', () => {\n  it('returns formatted line with \uD83D\uDCA1 prefix when fixedVersion is provided', () => {\n    const result = formatFixSuggestion('npm', 'express', '4.18.3');\n    expect(result).toBe('\uD83D\uDCA1 Fix: npm install express@4.18.3');\n  });\n\n  it('returns empty string when fixedVersion is null', () => {\n    expect(formatFixSuggestion('npm', 'express', null)).toBe('');\n  });\n\n  it('returns empty string when fixedVersion is undefined', () => {\n    expect(formatFixSuggestion('npm', 'express', undefined)).toBe('');\n  });\n\n  it('returns empty string when fixedVersion is empty string', () => {\n    expect(formatFixSuggestion('npm', 'express', '')).toBe('');\n  });\n});\n"],
+  "mappings": ";AAGA,oBAAqC;AACrC,6BAAwD;AAAA,IAExD,wBAAS,sBAAsB,MAAM;AACnC,wBAAG,mDAAmD,MAAM;AAC1D,kCAAO,2CAAmB,OAAO,WAAW,QAAQ,CAAC,EAAE;AAAA,MACrD;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,kFAAkF,MAAM;AACzF;AAAA,UACE,2CAAmB,SAAS,uCAAuC,QAAQ;AAAA,IAC7E,EAAE,KAAK,iEAAiE;AAAA,EAC1E,CAAC;AAED,wBAAG,iDAAiD,MAAM;AACxD,kCAAO,2CAAmB,SAAS,cAAc,QAAQ,CAAC,EAAE;AAAA,MAC1D;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,6CAA6C,MAAM;AACpD;AAAA,UACE,2CAAmB,MAAM,4BAA4B,OAAO;AAAA,IAC9D,EAAE,KAAK,wCAAwC;AAAA,EACjD,CAAC;AAED,wBAAG,uDAAuD,MAAM;AAC9D;AAAA,UACE,2CAAmB,UAAU,4BAA4B,OAAO;AAAA,IAClE,EAAE,KAAK,wCAAwC;AAAA,EACjD,CAAC;AAED,wBAAG,oDAAoD,MAAM;AAC3D,kCAAO,2CAAmB,QAAQ,UAAU,OAAO,CAAC,EAAE;AAAA,MACpD;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,yDAAyD,MAAM;AAChE,kCAAO,2CAAmB,OAAO,YAAY,QAAQ,CAAC,EAAE;AAAA,MACtD;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,sDAAsD,MAAM;AAC7D,kCAAO,2CAAmB,SAAS,SAAS,SAAS,CAAC,EAAE;AAAA,MACtD;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,2DAA2D,MAAM;AAClE,kCAAO,2CAAmB,WAAW,YAAY,OAAO,CAAC,EAAE;AAAA,MACzD;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,qCAAqC,MAAM;AAC5C,kCAAO,2CAAmB,OAAO,WAAW,QAAQ,CAAC,EAAE;AAAA,MACrD;AAAA,IACF;AACA,kCAAO,2CAAmB,SAAS,SAAS,SAAS,CAAC,EAAE;AAAA,MACtD;AAAA,IACF;AAAA,EACF,CAAC;AACH,CAAC;AAAA,IAED,wBAAS,uBAAuB,MAAM;AACpC,wBAAG,8EAAuE,MAAM;AAC9E,UAAM,aAAS,4CAAoB,OAAO,WAAW,QAAQ;AAC7D,8BAAO,MAAM,EAAE,KAAK,2CAAoC;AAAA,EAC1D,CAAC;AAED,wBAAG,kDAAkD,MAAM;AACzD,kCAAO,4CAAoB,OAAO,WAAW,IAAI,CAAC,EAAE,KAAK,EAAE;AAAA,EAC7D,CAAC;AAED,wBAAG,uDAAuD,MAAM;AAC9D,kCAAO,4CAAoB,OAAO,WAAW,MAAS,CAAC,EAAE,KAAK,EAAE;AAAA,EAClE,CAAC;AAED,wBAAG,0DAA0D,MAAM;AACjE,kCAAO,4CAAoB,OAAO,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE;AAAA,EAC3D,CAAC;AACH,CAAC;",
+  "names": []
+}