kirograph 0.17.0 → 0.19.0

package/dist/security/pipeline.js

@@ -0,0 +1,125 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var pipeline_exports = {};
+__export(pipeline_exports, {
+  SecurityPipeline: () => SecurityPipeline
+});
+module.exports = __toCommonJS(pipeline_exports);
+var import_parser = require("./manifest/parser");
+var import_integrator = require("./integrator");
+var import_client = require("./vuln/client");
+var import_osv_adapter = require("./vuln/osv-adapter");
+var import_reachability = require("./reachability");
+var import_errors = require("../errors");
+class SecurityPipeline {
+  constructor(db, config, projectRoot) {
+    this.db = db;
+    this.config = config;
+    this.projectRoot = projectRoot;
+  }
+  /**
+   * Run the full security analysis pipeline.
+   *
+   * @param onProgress - Optional callback reporting (phase, current, total)
+   * @returns SecurityResult with counts and duration
+   */
+  async run(onProgress) {
+    const start = Date.now();
+    const result = {
+      manifestsDiscovered: 0,
+      dependenciesCreated: 0,
+      vulnerabilitiesFound: 0,
+      affectedCount: 0,
+      notAffectedCount: 0,
+      underInvestigationCount: 0,
+      duration: 0
+    };
+    onProgress?.("manifest-parsing", 0, 4);
+    const parser = new import_parser.ManifestParser(this.db, this.projectRoot);
+    const parseResult = await parser.parseAll();
+    result.manifestsDiscovered = parseResult.manifestsParsed;
+    result.dependenciesCreated = parseResult.dependenciesCreated;
+    onProgress?.("manifest-parsing", 1, 4);
+    onProgress?.("dependency-integration", 1, 4);
+    const integrator = new import_integrator.DependencyGraphIntegrator(this.db, this.projectRoot);
+    await integrator.integrate();
+    await integrator.resolveTransitives(10);
+    await integrator.cleanup();
+    onProgress?.("dependency-integration", 2, 4);
+    if (this.config.securityAutoEnrich) {
+      onProgress?.("vulnerability-enrichment", 2, 4);
+      const adapters = this.createVulnAdapters();
+      const vulnClient = new import_client.VulnerabilityDatabaseClient(adapters, this.db);
+      const enrichResult = await vulnClient.enrichAll();
+      result.vulnerabilitiesFound = enrichResult.vulnerabilitiesFound;
+      onProgress?.("vulnerability-enrichment", 3, 4);
+    } else {
+      onProgress?.("vulnerability-enrichment", 3, 4);
+    }
+    onProgress?.("reachability-analysis", 3, 4);
+    const reachability = new import_reachability.ReachabilityAnalyzer(this.db, this.config);
+    const reachResults = await reachability.analyzeAll();
+    for (const [, reachResult] of reachResults) {
+      switch (reachResult.verdict) {
+        case "affected":
+          result.affectedCount++;
+          break;
+        case "not_affected":
+          result.notAffectedCount++;
+          break;
+        case "under_investigation":
+          result.underInvestigationCount++;
+          break;
+      }
+    }
+    for (const [vulnNodeId, reachResult] of reachResults) {
+      if (reachResult.verdict === "affected") {
+        await reachability.getImpactSummary(vulnNodeId);
+      }
+    }
+    onProgress?.("reachability-analysis", 4, 4);
+    result.duration = Date.now() - start;
+    return result;
+  }
+  /**
+   * Create vulnerability database adapters based on config.
+   */
+  createVulnAdapters() {
+    const adapters = [];
+    for (const dbName of this.config.securityDatabases) {
+      switch (dbName.toUpperCase()) {
+        case "OSV":
+          adapters.push(new import_osv_adapter.OsvAdapter());
+          break;
+        default:
+          (0, import_errors.logWarn)(`[sec:pipeline] Unknown vulnerability database "${dbName}", skipping`);
+          break;
+      }
+    }
+    if (adapters.length === 0) {
+      adapters.push(new import_osv_adapter.OsvAdapter());
+    }
+    return adapters;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SecurityPipeline
+});
+//# sourceMappingURL=pipeline.js.map

package/dist/security/pipeline.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/pipeline.ts"],
+  "sourcesContent": ["/**\n * SecurityPipeline \u2014 Orchestrates the security analysis phases.\n *\n * Phases (in order):\n *   1. Manifest parsing \u2014 discover and parse dependency manifests\n *   2. Dependency integration \u2014 link dependencies to code symbols\n *   3. Vulnerability enrichment \u2014 query databases for CVEs (if securityAutoEnrich)\n *   4. Reachability analysis \u2014 determine if vulnerable code is reachable\n *\n * Reports progress via callback and returns a SecurityResult with counts and duration.\n *\n * Requirements: 9.3, 9.5\n */\n\nimport type { GraphDatabase } from '../db/database';\nimport type { KiroGraphConfig } from '../config';\nimport type { SecurityResult } from './types';\nimport { ManifestParser } from './manifest/parser';\nimport { DependencyGraphIntegrator } from './integrator';\nimport { VulnerabilityDatabaseClient } from './vuln/client';\nimport { OsvAdapter } from './vuln/osv-adapter';\nimport { ReachabilityAnalyzer } from './reachability';\nimport { logWarn } from '../errors';\n\n/**\n * SecurityPipeline orchestrates the full security analysis workflow.\n */\nexport class SecurityPipeline {\n  private readonly db: GraphDatabase;\n  private readonly config: KiroGraphConfig;\n  private readonly projectRoot: string;\n\n  constructor(db: GraphDatabase, config: KiroGraphConfig, projectRoot: string) {\n    this.db = db;\n    this.config = config;\n    this.projectRoot = projectRoot;\n  }\n\n  /**\n   * Run the full security analysis pipeline.\n   *\n   * @param onProgress - Optional callback reporting (phase, current, total)\n   * @returns SecurityResult with counts and duration\n   */\n  async run(\n    onProgress?: (phase: string, current: number, total: number) => void,\n  ): Promise<SecurityResult> {\n    const start = Date.now();\n\n    const result: SecurityResult = {\n      manifestsDiscovered: 0,\n      dependenciesCreated: 0,\n      vulnerabilitiesFound: 0,\n      affectedCount: 0,\n      notAffectedCount: 0,\n      underInvestigationCount: 0,\n      duration: 0,\n    };\n\n    // \u2500\u2500 Phase 1: Manifest Parsing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    onProgress?.('manifest-parsing', 0, 4);\n\n    const parser = new ManifestParser(this.db, this.projectRoot);\n    const parseResult = await parser.parseAll();\n\n    result.manifestsDiscovered = parseResult.manifestsParsed;\n    result.dependenciesCreated = parseResult.dependenciesCreated;\n\n    onProgress?.('manifest-parsing', 1, 4);\n\n    // \u2500\u2500 Phase 2: Dependency Integration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    onProgress?.('dependency-integration', 1, 4);\n\n    const integrator = new DependencyGraphIntegrator(this.db, this.projectRoot);\n    await integrator.integrate();\n    await integrator.resolveTransitives(10);\n    await integrator.cleanup();\n\n    onProgress?.('dependency-integration', 2, 4);\n\n    // \u2500\u2500 Phase 3: Vulnerability Enrichment (conditional) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    if (this.config.securityAutoEnrich) {\n      onProgress?.('vulnerability-enrichment', 2, 4);\n\n      const adapters = this.createVulnAdapters();\n      const vulnClient = new VulnerabilityDatabaseClient(adapters, this.db);\n      const enrichResult = await vulnClient.enrichAll();\n\n      result.vulnerabilitiesFound = enrichResult.vulnerabilitiesFound;\n\n      onProgress?.('vulnerability-enrichment', 3, 4);\n    } else {\n      onProgress?.('vulnerability-enrichment', 3, 4);\n    }\n\n    // \u2500\u2500 Phase 4: Reachability Analysis \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    onProgress?.('reachability-analysis', 3, 4);\n\n    const reachability = new ReachabilityAnalyzer(this.db, this.config);\n    const reachResults = await reachability.analyzeAll();\n\n    // Count verdicts\n    for (const [, reachResult] of reachResults) {\n      switch (reachResult.verdict) {\n        case 'affected':\n          result.affectedCount++;\n          break;\n        case 'not_affected':\n          result.notAffectedCount++;\n          break;\n        case 'under_investigation':\n          result.underInvestigationCount++;\n          break;\n      }\n    }\n\n    // Generate impact summaries for affected vulnerabilities\n    for (const [vulnNodeId, reachResult] of reachResults) {\n      if (reachResult.verdict === 'affected') {\n        await reachability.getImpactSummary(vulnNodeId);\n      }\n    }\n\n    onProgress?.('reachability-analysis', 4, 4);\n\n    result.duration = Date.now() - start;\n    return result;\n  }\n\n  /**\n   * Create vulnerability database adapters based on config.\n   */\n  private createVulnAdapters(): import('./vuln/types').VulnDatabaseAdapter[] {\n    const adapters: import('./vuln/types').VulnDatabaseAdapter[] = [];\n\n    for (const dbName of this.config.securityDatabases) {\n      switch (dbName.toUpperCase()) {\n        case 'OSV':\n          adapters.push(new OsvAdapter());\n          break;\n        default:\n          logWarn(`[sec:pipeline] Unknown vulnerability database \"${dbName}\", skipping`);\n          break;\n      }\n    }\n\n    // Fallback to OSV if no valid adapters configured\n    if (adapters.length === 0) {\n      adapters.push(new OsvAdapter());\n    }\n\n    return adapters;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBA,oBAA+B;AAC/B,wBAA0C;AAC1C,oBAA4C;AAC5C,yBAA2B;AAC3B,0BAAqC;AACrC,oBAAwB;AAKjB,MAAM,iBAAiB;AAAA,EAK5B,YAAY,IAAmB,QAAyB,aAAqB;AAC3E,SAAK,KAAK;AACV,SAAK,SAAS;AACd,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,IACJ,YACyB;AACzB,UAAM,QAAQ,KAAK,IAAI;AAEvB,UAAM,SAAyB;AAAA,MAC7B,qBAAqB;AAAA,MACrB,qBAAqB;AAAA,MACrB,sBAAsB;AAAA,MACtB,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,yBAAyB;AAAA,MACzB,UAAU;AAAA,IACZ;AAGA,iBAAa,oBAAoB,GAAG,CAAC;AAErC,UAAM,SAAS,IAAI,6BAAe,KAAK,IAAI,KAAK,WAAW;AAC3D,UAAM,cAAc,MAAM,OAAO,SAAS;AAE1C,WAAO,sBAAsB,YAAY;AACzC,WAAO,sBAAsB,YAAY;AAEzC,iBAAa,oBAAoB,GAAG,CAAC;AAGrC,iBAAa,0BAA0B,GAAG,CAAC;AAE3C,UAAM,aAAa,IAAI,4CAA0B,KAAK,IAAI,KAAK,WAAW;AAC1E,UAAM,WAAW,UAAU;AAC3B,UAAM,WAAW,mBAAmB,EAAE;AACtC,UAAM,WAAW,QAAQ;AAEzB,iBAAa,0BAA0B,GAAG,CAAC;AAG3C,QAAI,KAAK,OAAO,oBAAoB;AAClC,mBAAa,4BAA4B,GAAG,CAAC;AAE7C,YAAM,WAAW,KAAK,mBAAmB;AACzC,YAAM,aAAa,IAAI,0CAA4B,UAAU,KAAK,EAAE;AACpE,YAAM,eAAe,MAAM,WAAW,UAAU;AAEhD,aAAO,uBAAuB,aAAa;AAE3C,mBAAa,4BAA4B,GAAG,CAAC;AAAA,IAC/C,OAAO;AACL,mBAAa,4BAA4B,GAAG,CAAC;AAAA,IAC/C;AAGA,iBAAa,yBAAyB,GAAG,CAAC;AAE1C,UAAM,eAAe,IAAI,yCAAqB,KAAK,IAAI,KAAK,MAAM;AAClE,UAAM,eAAe,MAAM,aAAa,WAAW;AAGnD,eAAW,CAAC,EAAE,WAAW,KAAK,cAAc;AAC1C,cAAQ,YAAY,SAAS;AAAA,QAC3B,KAAK;AACH,iBAAO;AACP;AAAA,QACF,KAAK;AACH,iBAAO;AACP;AAAA,QACF,KAAK;AACH,iBAAO;AACP;AAAA,MACJ;AAAA,IACF;AAGA,eAAW,CAAC,YAAY,WAAW,KAAK,cAAc;AACpD,UAAI,YAAY,YAAY,YAAY;AACtC,cAAM,aAAa,iBAAiB,UAAU;AAAA,MAChD;AAAA,IACF;AAEA,iBAAa,yBAAyB,GAAG,CAAC;AAE1C,WAAO,WAAW,KAAK,IAAI,IAAI;AAC/B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,qBAAmE;AACzE,UAAM,WAAyD,CAAC;AAEhE,eAAW,UAAU,KAAK,OAAO,mBAAmB;AAClD,cAAQ,OAAO,YAAY,GAAG;AAAA,QAC5B,KAAK;AACH,mBAAS,KAAK,IAAI,8BAAW,CAAC;AAC9B;AAAA,QACF;AACE,qCAAQ,kDAAkD,MAAM,aAAa;AAC7E;AAAA,MACJ;AAAA,IACF;AAGA,QAAI,SAAS,WAAW,GAAG;AACzB,eAAS,KAAK,IAAI,8BAAW,CAAC;AAAA,IAChC;AAEA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/security/reachability.js

@@ -0,0 +1,276 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var reachability_exports = {};
+__export(reachability_exports, {
+  ReachabilityAnalyzer: () => ReachabilityAnalyzer
+});
+module.exports = __toCommonJS(reachability_exports);
+const TRAVERSAL_EDGE_KINDS = ["calls", "imports", "references"];
+const MAX_UNRESOLVED_SYMBOLS = 50;
+const MAX_DISTINCT_PATHS = 100;
+class ReachabilityAnalyzer {
+  constructor(db, config) {
+    this.db = db;
+    this.config = config;
+  }
+  /**
+   * Analyze reachability for a single Vulnerability_Node.
+   *
+   * 1. Find the Dependency_Node linked via `has_vulnerability` edge
+   * 2. Find all Entry_Points in the graph
+   * 3. BFS from each entry point toward the dependency node
+   * 4. Assign verdict based on path existence and unresolved imports
+   *
+   * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6
+   */
+  async analyze(vulnerabilityNodeId) {
+    const rawDb = this.db.getRawDb();
+    const depEdge = rawDb.get(
+      `SELECT source FROM edges WHERE target = ? AND kind = 'has_vulnerability'`,
+      [vulnerabilityNodeId]
+    );
+    if (!depEdge) {
+      return {
+        verdict: "under_investigation",
+        paths: [],
+        unresolvedSymbols: [],
+        reachingEntryPointCount: 0
+      };
+    }
+    const dependencyNodeId = depEdge.source;
+    const entryPoints = rawDb.all(
+      `SELECT id FROM nodes WHERE kind = 'route'
+       UNION
+       SELECT id FROM nodes WHERE kind = 'function' AND is_exported = 1`
+    );
+    if (entryPoints.length === 0) {
+      return {
+        verdict: "not_affected",
+        paths: [],
+        unresolvedSymbols: [],
+        reachingEntryPointCount: 0
+      };
+    }
+    const reachingPaths = [];
+    const allUnresolvedSymbols = /* @__PURE__ */ new Set();
+    for (const ep of entryPoints) {
+      const result2 = this.bfsFromEntryPoint(rawDb, ep.id, dependencyNodeId);
+      if (result2.path) {
+        reachingPaths.push({
+          entryPoint: ep.id,
+          path: result2.path
+        });
+      }
+      for (const sym of result2.unresolvedSymbols) {
+        allUnresolvedSymbols.add(sym);
+      }
+    }
+    const unresolvedSymbols = Array.from(allUnresolvedSymbols).slice(0, MAX_UNRESOLVED_SYMBOLS);
+    let verdict;
+    if (reachingPaths.length > 0) {
+      verdict = "affected";
+    } else if (allUnresolvedSymbols.size > 0) {
+      verdict = "under_investigation";
+    } else {
+      verdict = "not_affected";
+    }
+    const result = {
+      verdict,
+      paths: reachingPaths,
+      unresolvedSymbols: verdict === "under_investigation" ? unresolvedSymbols : [],
+      reachingEntryPointCount: reachingPaths.length
+    };
+    this.storeReachabilityResult(rawDb, vulnerabilityNodeId, result);
+    return result;
+  }
+  /**
+   * Produce impact summary for an affected vulnerability.
+   *
+   * Returns null if the vulnerability is not affected.
+   * Reads layer assignments from `arch_file_layers` table.
+   *
+   * Requirements: 5.1, 5.2, 5.3, 5.4, 5.5
+   */
+  async getImpactSummary(vulnerabilityNodeId) {
+    const rawDb = this.db.getRawDb();
+    const reachRow = rawDb.get(
+      `SELECT verdict, paths, reaching_entry_point_count FROM sec_reachability WHERE vulnerability_node_id = ?`,
+      [vulnerabilityNodeId]
+    );
+    if (!reachRow || reachRow.verdict !== "affected") {
+      return null;
+    }
+    const paths = reachRow.paths ? JSON.parse(reachRow.paths) : [];
+    if (paths.length === 0) {
+      return null;
+    }
+    const allNodeIds = /* @__PURE__ */ new Set();
+    const affectedEntryPoints = [];
+    for (const p of paths) {
+      affectedEntryPoints.push(p.entryPoint);
+      for (const nodeId of p.path) {
+        allNodeIds.add(nodeId);
+      }
+    }
+    const affectedLayers = /* @__PURE__ */ new Set();
+    if (this.config.enableArchitecture) {
+      const nodeIds = Array.from(allNodeIds);
+      if (nodeIds.length > 0) {
+        const placeholders = nodeIds.map(() => "?").join(",");
+        const nodeFiles = rawDb.all(
+          `SELECT id, file_path FROM nodes WHERE id IN (${placeholders})`,
+          nodeIds
+        );
+        const filePaths = [...new Set(nodeFiles.map((n) => n.file_path).filter(Boolean))];
+        if (filePaths.length > 0) {
+          const filePlaceholders = filePaths.map(() => "?").join(",");
+          const layerRows = rawDb.all(
+            `SELECT file_path, layer_id FROM arch_file_layers WHERE file_path IN (${filePlaceholders})`,
+            filePaths
+          );
+          const fileToLayer = /* @__PURE__ */ new Map();
+          for (const row of layerRows) {
+            fileToLayer.set(row.file_path, row.layer_id);
+          }
+          for (const nf of nodeFiles) {
+            if (nf.file_path) {
+              const layer = fileToLayer.get(nf.file_path);
+              affectedLayers.add(layer ?? "unclassified");
+            }
+          }
+        }
+      }
+    }
+    const distinctPathSet = /* @__PURE__ */ new Set();
+    for (const p of paths) {
+      const pathKey = p.path.join("\u2192");
+      distinctPathSet.add(pathKey);
+      if (distinctPathSet.size >= MAX_DISTINCT_PATHS) break;
+    }
+    const summary = {
+      affectedLayers: Array.from(affectedLayers),
+      affectedEntryPoints,
+      distinctPathCount: Math.min(distinctPathSet.size, MAX_DISTINCT_PATHS)
+    };
+    this.storeImpactSummary(rawDb, vulnerabilityNodeId, summary);
+    return summary;
+  }
+  /**
+   * Analyze all Vulnerability_Nodes in the graph.
+   *
+   * Iterates all vulnerability nodes and calls analyze() for each.
+   */
+  async analyzeAll() {
+    const rawDb = this.db.getRawDb();
+    const results = /* @__PURE__ */ new Map();
+    const vulnRows = rawDb.all(
+      `SELECT node_id FROM sec_vulnerabilities`
+    );
+    for (const row of vulnRows) {
+      const result = await this.analyze(row.node_id);
+      results.set(row.node_id, result);
+    }
+    return results;
+  }
+  /**
+   * BFS from a single entry point toward the dependency node.
+   *
+   * Uses outgoing edges of types: calls, imports, references.
+   * Visits each node at most once (handles cycles).
+   * Tracks unresolved imports encountered during traversal.
+   *
+   * Returns the shortest path if found, plus any unresolved symbols encountered.
+   */
+  bfsFromEntryPoint(rawDb, entryPointId, dependencyNodeId) {
+    const visited = /* @__PURE__ */ new Set();
+    const unresolvedSymbols = [];
+    const queue = [[entryPointId, [entryPointId]]];
+    visited.add(entryPointId);
+    const edgeKinds = TRAVERSAL_EDGE_KINDS.map((k) => `'${k}'`).join(",");
+    while (queue.length > 0) {
+      const [currentId, currentPath] = queue.shift();
+      const outEdges = rawDb.all(
+        `SELECT target, kind FROM edges WHERE source = ? AND kind IN (${edgeKinds})`,
+        [currentId]
+      );
+      if (outEdges.length === 0) {
+        const nodeRow = rawDb.get(
+          `SELECT kind FROM nodes WHERE id = ?`,
+          [currentId]
+        );
+        if (nodeRow && nodeRow.kind === "import") {
+          unresolvedSymbols.push(currentId);
+        }
+      }
+      for (const edge of outEdges) {
+        const targetId = edge.target;
+        if (targetId === dependencyNodeId) {
+          return {
+            path: [...currentPath, targetId],
+            unresolvedSymbols
+          };
+        }
+        if (visited.has(targetId)) continue;
+        visited.add(targetId);
+        queue.push([targetId, [...currentPath, targetId]]);
+      }
+    }
+    return { path: null, unresolvedSymbols };
+  }
+  /**
+   * Store reachability result in sec_reachability table.
+   */
+  storeReachabilityResult(rawDb, vulnerabilityNodeId, result) {
+    rawDb.run(
+      `INSERT OR REPLACE INTO sec_reachability
+        (vulnerability_node_id, verdict, paths, unresolved_symbols, reaching_entry_point_count, analyzed_at)
+       VALUES (?, ?, ?, ?, ?, ?)`,
+      [
+        vulnerabilityNodeId,
+        result.verdict,
+        result.paths.length > 0 ? JSON.stringify(result.paths) : null,
+        result.unresolvedSymbols.length > 0 ? JSON.stringify(result.unresolvedSymbols) : null,
+        result.reachingEntryPointCount,
+        Date.now()
+      ]
+    );
+  }
+  /**
+   * Store impact summary in sec_impact table.
+   */
+  storeImpactSummary(rawDb, vulnerabilityNodeId, summary) {
+    rawDb.run(
+      `INSERT OR REPLACE INTO sec_impact
+        (vulnerability_node_id, affected_layers, affected_entry_points, distinct_path_count, analyzed_at)
+       VALUES (?, ?, ?, ?, ?)`,
+      [
+        vulnerabilityNodeId,
+        JSON.stringify(summary.affectedLayers),
+        JSON.stringify(summary.affectedEntryPoints),
+        summary.distinctPathCount,
+        Date.now()
+      ]
+    );
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ReachabilityAnalyzer
+});
+//# sourceMappingURL=reachability.js.map

package/dist/security/reachability.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/reachability.ts"],
+  "sourcesContent": ["/**\n * KiroGraph-Sec Reachability Analyzer\n *\n * Traverses the knowledge graph from application entry points to determine\n * whether vulnerable dependencies are reachable through actual code paths.\n * Produces reachability verdicts and impact summaries enriched with\n * architectural layer context.\n *\n * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6, 5.1, 5.2, 5.3, 5.4, 5.5\n */\n\nimport type { GraphDatabase } from '../db/database';\nimport type { KiroGraphConfig } from '../config';\nimport type {\n  ReachabilityVerdict,\n  ReachabilityPath,\n  ReachabilityResult,\n  ImpactSummary,\n} from './types';\n\n/** Edge kinds used for reachability traversal */\nconst TRAVERSAL_EDGE_KINDS = ['calls', 'imports', 'references'] as const;\n\n/** Maximum unresolved symbols to report */\nconst MAX_UNRESOLVED_SYMBOLS = 50;\n\n/** Maximum distinct paths to report in impact summary */\nconst MAX_DISTINCT_PATHS = 100;\n\n/**\n * ReachabilityAnalyzer traverses the knowledge graph from entry points\n * toward affected dependency nodes to determine reachability verdicts.\n */\nexport class ReachabilityAnalyzer {\n  private readonly db: GraphDatabase;\n  private readonly config: KiroGraphConfig;\n\n  constructor(db: GraphDatabase, config: KiroGraphConfig) {\n    this.db = db;\n    this.config = config;\n  }\n\n  /**\n   * Analyze reachability for a single Vulnerability_Node.\n   *\n   * 1. Find the Dependency_Node linked via `has_vulnerability` edge\n   * 2. Find all Entry_Points in the graph\n   * 3. BFS from each entry point toward the dependency node\n   * 4. Assign verdict based on path existence and unresolved imports\n   *\n   * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6\n   */\n  async analyze(vulnerabilityNodeId: string): Promise<ReachabilityResult> {\n    const rawDb = this.db.getRawDb();\n\n    // Step 1: Find the Dependency_Node linked to this vulnerability\n    const depEdge = rawDb.get(\n      `SELECT source FROM edges WHERE target = ? AND kind = 'has_vulnerability'`,\n      [vulnerabilityNodeId],\n    );\n\n    if (!depEdge) {\n      // No dependency linked \u2014 cannot determine reachability\n      return {\n        verdict: 'under_investigation',\n        paths: [],\n        unresolvedSymbols: [],\n        reachingEntryPointCount: 0,\n      };\n    }\n\n    const dependencyNodeId: string = depEdge.source;\n\n    // Step 2: Find all Entry_Points\n    // Entry points are: nodes with kind='route' OR nodes with kind='function' that are exported\n    const entryPoints: Array<{ id: string }> = rawDb.all(\n      `SELECT id FROM nodes WHERE kind = 'route'\n       UNION\n       SELECT id FROM nodes WHERE kind = 'function' AND is_exported = 1`,\n    );\n\n    if (entryPoints.length === 0) {\n      // No entry points \u2014 cannot determine reachability\n      return {\n        verdict: 'not_affected',\n        paths: [],\n        unresolvedSymbols: [],\n        reachingEntryPointCount: 0,\n      };\n    }\n\n    // Step 3: BFS from each entry point toward the dependency node\n    const reachingPaths: ReachabilityPath[] = [];\n    const allUnresolvedSymbols = new Set<string>();\n\n    for (const ep of entryPoints) {\n      const result = this.bfsFromEntryPoint(rawDb, ep.id, dependencyNodeId);\n\n      if (result.path) {\n        reachingPaths.push({\n          entryPoint: ep.id,\n          path: result.path,\n        });\n      }\n\n      for (const sym of result.unresolvedSymbols) {\n        allUnresolvedSymbols.add(sym);\n      }\n    }\n\n    // Step 4: Assign verdict\n    const unresolvedSymbols = Array.from(allUnresolvedSymbols).slice(0, MAX_UNRESOLVED_SYMBOLS);\n\n    let verdict: ReachabilityVerdict;\n    if (reachingPaths.length > 0) {\n      verdict = 'affected';\n    } else if (allUnresolvedSymbols.size > 0) {\n      verdict = 'under_investigation';\n    } else {\n      verdict = 'not_affected';\n    }\n\n    const result: ReachabilityResult = {\n      verdict,\n      paths: reachingPaths,\n      unresolvedSymbols: verdict === 'under_investigation' ? unresolvedSymbols : [],\n      reachingEntryPointCount: reachingPaths.length,\n    };\n\n    // Store result in sec_reachability table\n    this.storeReachabilityResult(rawDb, vulnerabilityNodeId, result);\n\n    return result;\n  }\n\n  /**\n   * Produce impact summary for an affected vulnerability.\n   *\n   * Returns null if the vulnerability is not affected.\n   * Reads layer assignments from `arch_file_layers` table.\n   *\n   * Requirements: 5.1, 5.2, 5.3, 5.4, 5.5\n   */\n  async getImpactSummary(vulnerabilityNodeId: string): Promise<ImpactSummary | null> {\n    const rawDb = this.db.getRawDb();\n\n    // Check if the vulnerability has verdict 'affected'\n    const reachRow = rawDb.get(\n      `SELECT verdict, paths, reaching_entry_point_count FROM sec_reachability WHERE vulnerability_node_id = ?`,\n      [vulnerabilityNodeId],\n    );\n\n    if (!reachRow || reachRow.verdict !== 'affected') {\n      return null;\n    }\n\n    const paths: ReachabilityPath[] = reachRow.paths ? JSON.parse(reachRow.paths) : [];\n\n    if (paths.length === 0) {\n      return null;\n    }\n\n    // Collect all node IDs on reachable paths\n    const allNodeIds = new Set<string>();\n    const affectedEntryPoints: string[] = [];\n\n    for (const p of paths) {\n      affectedEntryPoints.push(p.entryPoint);\n      for (const nodeId of p.path) {\n        allNodeIds.add(nodeId);\n      }\n    }\n\n    // Identify architectural layers on reachable paths\n    const affectedLayers = new Set<string>();\n\n    if (this.config.enableArchitecture) {\n      // Get file paths for all nodes on reachable paths\n      const nodeIds = Array.from(allNodeIds);\n      if (nodeIds.length > 0) {\n        const placeholders = nodeIds.map(() => '?').join(',');\n        const nodeFiles: Array<{ id: string; file_path: string }> = rawDb.all(\n          `SELECT id, file_path FROM nodes WHERE id IN (${placeholders})`,\n          nodeIds,\n        );\n\n        // Get layer assignments for those files from arch_file_layers\n        const filePaths = [...new Set(nodeFiles.map(n => n.file_path).filter(Boolean))];\n        if (filePaths.length > 0) {\n          const filePlaceholders = filePaths.map(() => '?').join(',');\n          const layerRows: Array<{ file_path: string; layer_id: string }> = rawDb.all(\n            `SELECT file_path, layer_id FROM arch_file_layers WHERE file_path IN (${filePlaceholders})`,\n            filePaths,\n          );\n\n          const fileToLayer = new Map<string, string>();\n          for (const row of layerRows) {\n            fileToLayer.set(row.file_path, row.layer_id);\n          }\n\n          // Assign layers to nodes; classify as \"unclassified\" if no layer assigned\n          for (const nf of nodeFiles) {\n            if (nf.file_path) {\n              const layer = fileToLayer.get(nf.file_path);\n              affectedLayers.add(layer ?? 'unclassified');\n            }\n          }\n        }\n      }\n    }\n    // When enableArchitecture is false, omit layer classification (Requirement 5.4)\n\n    // Count distinct paths (capped at MAX_DISTINCT_PATHS)\n    // Two paths are distinct if they differ by at least one intermediate symbol\n    const distinctPathSet = new Set<string>();\n    for (const p of paths) {\n      // Use the full path as a key for distinctness\n      const pathKey = p.path.join('\u2192');\n      distinctPathSet.add(pathKey);\n      if (distinctPathSet.size >= MAX_DISTINCT_PATHS) break;\n    }\n\n    const summary: ImpactSummary = {\n      affectedLayers: Array.from(affectedLayers),\n      affectedEntryPoints,\n      distinctPathCount: Math.min(distinctPathSet.size, MAX_DISTINCT_PATHS),\n    };\n\n    // Store impact summary in sec_impact table\n    this.storeImpactSummary(rawDb, vulnerabilityNodeId, summary);\n\n    return summary;\n  }\n\n  /**\n   * Analyze all Vulnerability_Nodes in the graph.\n   *\n   * Iterates all vulnerability nodes and calls analyze() for each.\n   */\n  async analyzeAll(): Promise<Map<string, ReachabilityResult>> {\n    const rawDb = this.db.getRawDb();\n    const results = new Map<string, ReachabilityResult>();\n\n    const vulnRows: Array<{ node_id: string }> = rawDb.all(\n      `SELECT node_id FROM sec_vulnerabilities`,\n    );\n\n    for (const row of vulnRows) {\n      const result = await this.analyze(row.node_id);\n      results.set(row.node_id, result);\n    }\n\n    return results;\n  }\n\n  /**\n   * BFS from a single entry point toward the dependency node.\n   *\n   * Uses outgoing edges of types: calls, imports, references.\n   * Visits each node at most once (handles cycles).\n   * Tracks unresolved imports encountered during traversal.\n   *\n   * Returns the shortest path if found, plus any unresolved symbols encountered.\n   */\n  private bfsFromEntryPoint(\n    rawDb: any,\n    entryPointId: string,\n    dependencyNodeId: string,\n  ): { path: string[] | null; unresolvedSymbols: string[] } {\n    const visited = new Set<string>();\n    const unresolvedSymbols: string[] = [];\n\n    // BFS queue: each entry is [nodeId, path from entry point]\n    const queue: Array<[string, string[]]> = [[entryPointId, [entryPointId]]];\n    visited.add(entryPointId);\n\n    // Prepare edge kind filter\n    const edgeKinds = TRAVERSAL_EDGE_KINDS.map(k => `'${k}'`).join(',');\n\n    while (queue.length > 0) {\n      const [currentId, currentPath] = queue.shift()!;\n\n      // Get outgoing edges from current node (calls, imports, references)\n      const outEdges: Array<{ target: string; kind: string }> = rawDb.all(\n        `SELECT target, kind FROM edges WHERE source = ? AND kind IN (${edgeKinds})`,\n        [currentId],\n      );\n\n      // Check if current node is an unresolved import\n      // An unresolved import is a node with kind='import' that has no outgoing edges\n      if (outEdges.length === 0) {\n        const nodeRow = rawDb.get(\n          `SELECT kind FROM nodes WHERE id = ?`,\n          [currentId],\n        );\n        if (nodeRow && nodeRow.kind === 'import') {\n          unresolvedSymbols.push(currentId);\n        }\n      }\n\n      for (const edge of outEdges) {\n        const targetId = edge.target;\n\n        // Check if we reached the dependency node\n        if (targetId === dependencyNodeId) {\n          return {\n            path: [...currentPath, targetId],\n            unresolvedSymbols,\n          };\n        }\n\n        // Skip already visited nodes (cycle handling)\n        if (visited.has(targetId)) continue;\n        visited.add(targetId);\n\n        queue.push([targetId, [...currentPath, targetId]]);\n      }\n    }\n\n    // No path found from this entry point\n    return { path: null, unresolvedSymbols };\n  }\n\n  /**\n   * Store reachability result in sec_reachability table.\n   */\n  private storeReachabilityResult(\n    rawDb: any,\n    vulnerabilityNodeId: string,\n    result: ReachabilityResult,\n  ): void {\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_reachability\n        (vulnerability_node_id, verdict, paths, unresolved_symbols, reaching_entry_point_count, analyzed_at)\n       VALUES (?, ?, ?, ?, ?, ?)`,\n      [\n        vulnerabilityNodeId,\n        result.verdict,\n        result.paths.length > 0 ? JSON.stringify(result.paths) : null,\n        result.unresolvedSymbols.length > 0 ? JSON.stringify(result.unresolvedSymbols) : null,\n        result.reachingEntryPointCount,\n        Date.now(),\n      ],\n    );\n  }\n\n  /**\n   * Store impact summary in sec_impact table.\n   */\n  private storeImpactSummary(\n    rawDb: any,\n    vulnerabilityNodeId: string,\n    summary: ImpactSummary,\n  ): void {\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_impact\n        (vulnerability_node_id, affected_layers, affected_entry_points, distinct_path_count, analyzed_at)\n       VALUES (?, ?, ?, ?, ?)`,\n      [\n        vulnerabilityNodeId,\n        JSON.stringify(summary.affectedLayers),\n        JSON.stringify(summary.affectedEntryPoints),\n        summary.distinctPathCount,\n        Date.now(),\n      ],\n    );\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBA,MAAM,uBAAuB,CAAC,SAAS,WAAW,YAAY;AAG9D,MAAM,yBAAyB;AAG/B,MAAM,qBAAqB;AAMpB,MAAM,qBAAqB;AAAA,EAIhC,YAAY,IAAmB,QAAyB;AACtD,SAAK,KAAK;AACV,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,QAAQ,qBAA0D;AACtE,UAAM,QAAQ,KAAK,GAAG,SAAS;AAG/B,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,CAAC,mBAAmB;AAAA,IACtB;AAEA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,CAAC;AAAA,QACR,mBAAmB,CAAC;AAAA,QACpB,yBAAyB;AAAA,MAC3B;AAAA,IACF;AAEA,UAAM,mBAA2B,QAAQ;AAIzC,UAAM,cAAqC,MAAM;AAAA,MAC/C;AAAA;AAAA;AAAA,IAGF;AAEA,QAAI,YAAY,WAAW,GAAG;AAE5B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,CAAC;AAAA,QACR,mBAAmB,CAAC;AAAA,QACpB,yBAAyB;AAAA,MAC3B;AAAA,IACF;AAGA,UAAM,gBAAoC,CAAC;AAC3C,UAAM,uBAAuB,oBAAI,IAAY;AAE7C,eAAW,MAAM,aAAa;AAC5B,YAAMA,UAAS,KAAK,kBAAkB,OAAO,GAAG,IAAI,gBAAgB;AAEpE,UAAIA,QAAO,MAAM;AACf,sBAAc,KAAK;AAAA,UACjB,YAAY,GAAG;AAAA,UACf,MAAMA,QAAO;AAAA,QACf,CAAC;AAAA,MACH;AAEA,iBAAW,OAAOA,QAAO,mBAAmB;AAC1C,6BAAqB,IAAI,GAAG;AAAA,MAC9B;AAAA,IACF;AAGA,UAAM,oBAAoB,MAAM,KAAK,oBAAoB,EAAE,MAAM,GAAG,sBAAsB;AAE1F,QAAI;AACJ,QAAI,cAAc,SAAS,GAAG;AAC5B,gBAAU;AAAA,IACZ,WAAW,qBAAqB,OAAO,GAAG;AACxC,gBAAU;AAAA,IACZ,OAAO;AACL,gBAAU;AAAA,IACZ;AAEA,UAAM,SAA6B;AAAA,MACjC;AAAA,MACA,OAAO;AAAA,MACP,mBAAmB,YAAY,wBAAwB,oBAAoB,CAAC;AAAA,MAC5E,yBAAyB,cAAc;AAAA,IACzC;AAGA,SAAK,wBAAwB,OAAO,qBAAqB,MAAM;AAE/D,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,iBAAiB,qBAA4D;AACjF,UAAM,QAAQ,KAAK,GAAG,SAAS;AAG/B,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA,CAAC,mBAAmB;AAAA,IACtB;AAEA,QAAI,CAAC,YAAY,SAAS,YAAY,YAAY;AAChD,aAAO;AAAA,IACT;AAEA,UAAM,QAA4B,SAAS,QAAQ,KAAK,MAAM,SAAS,KAAK,IAAI,CAAC;AAEjF,QAAI,MAAM,WAAW,GAAG;AACtB,aAAO;AAAA,IACT;AAGA,UAAM,aAAa,oBAAI,IAAY;AACnC,UAAM,sBAAgC,CAAC;AAEvC,eAAW,KAAK,OAAO;AACrB,0BAAoB,KAAK,EAAE,UAAU;AACrC,iBAAW,UAAU,EAAE,MAAM;AAC3B,mBAAW,IAAI,MAAM;AAAA,MACvB;AAAA,IACF;AAGA,UAAM,iBAAiB,oBAAI,IAAY;AAEvC,QAAI,KAAK,OAAO,oBAAoB;AAElC,YAAM,UAAU,MAAM,KAAK,UAAU;AACrC,UAAI,QAAQ,SAAS,GAAG;AACtB,cAAM,eAAe,QAAQ,IAAI,MAAM,GAAG,EAAE,KAAK,GAAG;AACpD,cAAM,YAAsD,MAAM;AAAA,UAChE,gDAAgD,YAAY;AAAA,UAC5D;AAAA,QACF;AAGA,cAAM,YAAY,CAAC,GAAG,IAAI,IAAI,UAAU,IAAI,OAAK,EAAE,SAAS,EAAE,OAAO,OAAO,CAAC,CAAC;AAC9E,YAAI,UAAU,SAAS,GAAG;AACxB,gBAAM,mBAAmB,UAAU,IAAI,MAAM,GAAG,EAAE,KAAK,GAAG;AAC1D,gBAAM,YAA4D,MAAM;AAAA,YACtE,wEAAwE,gBAAgB;AAAA,YACxF;AAAA,UACF;AAEA,gBAAM,cAAc,oBAAI,IAAoB;AAC5C,qBAAW,OAAO,WAAW;AAC3B,wBAAY,IAAI,IAAI,WAAW,IAAI,QAAQ;AAAA,UAC7C;AAGA,qBAAW,MAAM,WAAW;AAC1B,gBAAI,GAAG,WAAW;AAChB,oBAAM,QAAQ,YAAY,IAAI,GAAG,SAAS;AAC1C,6BAAe,IAAI,SAAS,cAAc;AAAA,YAC5C;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAKA,UAAM,kBAAkB,oBAAI,IAAY;AACxC,eAAW,KAAK,OAAO;AAErB,YAAM,UAAU,EAAE,KAAK,KAAK,QAAG;AAC/B,sBAAgB,IAAI,OAAO;AAC3B,UAAI,gBAAgB,QAAQ,mBAAoB;AAAA,IAClD;AAEA,UAAM,UAAyB;AAAA,MAC7B,gBAAgB,MAAM,KAAK,cAAc;AAAA,MACzC;AAAA,MACA,mBAAmB,KAAK,IAAI,gBAAgB,MAAM,kBAAkB;AAAA,IACtE;AAGA,SAAK,mBAAmB,OAAO,qBAAqB,OAAO;AAE3D,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAuD;AAC3D,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,UAAU,oBAAI,IAAgC;AAEpD,UAAM,WAAuC,MAAM;AAAA,MACjD;AAAA,IACF;AAEA,eAAW,OAAO,UAAU;AAC1B,YAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,OAAO;AAC7C,cAAQ,IAAI,IAAI,SAAS,MAAM;AAAA,IACjC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,kBACN,OACA,cACA,kBACwD;AACxD,UAAM,UAAU,oBAAI,IAAY;AAChC,UAAM,oBAA8B,CAAC;AAGrC,UAAM,QAAmC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;AACxE,YAAQ,IAAI,YAAY;AAGxB,UAAM,YAAY,qBAAqB,IAAI,OAAK,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG;AAElE,WAAO,MAAM,SAAS,GAAG;AACvB,YAAM,CAAC,WAAW,WAAW,IAAI,MAAM,MAAM;AAG7C,YAAM,WAAoD,MAAM;AAAA,QAC9D,gEAAgE,SAAS;AAAA,QACzE,CAAC,SAAS;AAAA,MACZ;AAIA,UAAI,SAAS,WAAW,GAAG;AACzB,cAAM,UAAU,MAAM;AAAA,UACpB;AAAA,UACA,CAAC,SAAS;AAAA,QACZ;AACA,YAAI,WAAW,QAAQ,SAAS,UAAU;AACxC,4BAAkB,KAAK,SAAS;AAAA,QAClC;AAAA,MACF;AAEA,iBAAW,QAAQ,UAAU;AAC3B,cAAM,WAAW,KAAK;AAGtB,YAAI,aAAa,kBAAkB;AACjC,iBAAO;AAAA,YACL,MAAM,CAAC,GAAG,aAAa,QAAQ;AAAA,YAC/B;AAAA,UACF;AAAA,QACF;AAGA,YAAI,QAAQ,IAAI,QAAQ,EAAG;AAC3B,gBAAQ,IAAI,QAAQ;AAEpB,cAAM,KAAK,CAAC,UAAU,CAAC,GAAG,aAAa,QAAQ,CAAC,CAAC;AAAA,MACnD;AAAA,IACF;AAGA,WAAO,EAAE,MAAM,MAAM,kBAAkB;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKQ,wBACN,OACA,qBACA,QACM;AACN,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA;AAAA,QACE;AAAA,QACA,OAAO;AAAA,QACP,OAAO,MAAM,SAAS,IAAI,KAAK,UAAU,OAAO,KAAK,IAAI;AAAA,QACzD,OAAO,kBAAkB,SAAS,IAAI,KAAK,UAAU,OAAO,iBAAiB,IAAI;AAAA,QACjF,OAAO;AAAA,QACP,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,mBACN,OACA,qBACA,SACM;AACN,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA;AAAA,QACE;AAAA,QACA,KAAK,UAAU,QAAQ,cAAc;AAAA,QACrC,KAAK,UAAU,QAAQ,mBAAmB;AAAA,QAC1C,QAAQ;AAAA,QACR,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": ["result"]
+}