kirograph 0.17.0 → 0.20.0

package/dist/bin/commands/remediation.js

@@ -0,0 +1,133 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var remediation_exports = {};
+__export(remediation_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(remediation_exports);
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+const red = "\x1B[31m";
+const yellow = "\x1B[33m";
+function slaColor(status) {
+  switch (status) {
+    case "ok":
+      return import_ui.green;
+    case "warning":
+      return yellow;
+    case "overdue":
+      return red;
+    case "no_fix":
+      return import_ui.dim;
+    default:
+      return import_ui.dim;
+  }
+}
+function formatDate(epochMs) {
+  if (epochMs === null) return "n/a";
+  return new Date(epochMs).toISOString().slice(0, 10);
+}
+function register(program) {
+  program.command("remediation [projectPath]").description("Track remediation SLA: how long vulnerabilities have been open and whether fixes are overdue").option("--overdue-only", "Show only overdue items").option("--format <fmt>", "Output format: table | json (default: table)", "table").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(target);
+    if (!config.enableSecurity) {
+      console.error(`
+  ${yellow}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const { RemediationTracker } = await Promise.resolve().then(() => require("../../security/remediation.js"));
+    const tracker = new RemediationTracker(db);
+    let statuses = tracker.getStatus();
+    const ORDER = { overdue: 3, warning: 2, no_fix: 1, ok: 0 };
+    statuses.sort((a, b) => {
+      const diff = (ORDER[b.slaStatus] ?? 0) - (ORDER[a.slaStatus] ?? 0);
+      if (diff !== 0) return diff;
+      return (b.daysOpen ?? 0) - (a.daysOpen ?? 0);
+    });
+    if (opts.overdueOnly) {
+      statuses = statuses.filter((s) => s.isOverdue);
+    }
+    if (opts.format === "json") {
+      console.log(JSON.stringify(statuses, null, 2));
+      cg.close();
+      return;
+    }
+    if (statuses.length === 0) {
+      const msg = opts.overdueOnly ? "No overdue vulnerabilities found." : "No tracked vulnerabilities with detection timestamps found.";
+      console.log(`
+  ${import_ui.dim}${msg}${import_ui.reset}`);
+      console.log(`  ${import_ui.dim}Detection timestamps are recorded when vulnerabilities are first inserted via${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph vulns --refresh${import_ui.reset}
+`);
+      cg.close();
+      return;
+    }
+    console.log(`
+  ${import_ui.violet}${import_ui.bold}Remediation SLA Tracking${import_ui.reset}
+`);
+    for (const s of statuses) {
+      const sevStr = s.severity !== null ? s.severity.toFixed(1) : "n/a";
+      const daysOpen = s.daysOpen !== null ? `${s.daysOpen}d` : "n/a";
+      const fixSince = s.fixAvailableSince !== null ? `${s.daysWithFixAvailable}d ago (${formatDate(s.fixAvailableSince)})` : "no fix";
+      const deadline = s.slaDeadline !== null ? formatDate(s.slaDeadline) : "n/a";
+      const color = slaColor(s.slaStatus);
+      console.log(`  ${import_ui.violet}${import_ui.bold}${s.cveId}${import_ui.reset}  ${import_ui.dim}${s.packageName}${import_ui.reset}`);
+      console.log(`    CVSS: ${import_ui.dim}${sevStr}${import_ui.reset}   Open: ${import_ui.dim}${daysOpen}${import_ui.reset}   Fix available: ${import_ui.dim}${fixSince}${import_ui.reset}`);
+      console.log(`    SLA status: ${color}${import_ui.bold}${s.slaStatus.toUpperCase()}${import_ui.reset}   Deadline: ${import_ui.dim}${deadline}${import_ui.reset}`);
+      console.log();
+    }
+    const overdueCount = statuses.filter((s) => s.slaStatus === "overdue").length;
+    const warningCount = statuses.filter((s) => s.slaStatus === "warning").length;
+    const noFixCount = statuses.filter((s) => s.slaStatus === "no_fix").length;
+    const parts = [];
+    if (overdueCount > 0) parts.push(`${red}${import_ui.bold}${overdueCount} overdue${import_ui.reset}`);
+    if (warningCount > 0) parts.push(`${yellow}${import_ui.bold}${warningCount} warning${import_ui.reset}`);
+    if (noFixCount > 0) parts.push(`${import_ui.dim}${noFixCount} no fix available${import_ui.reset}`);
+    console.log(`  ${import_ui.bold}${statuses.length}${import_ui.reset} open vulnerabilit${statuses.length === 1 ? "y" : "ies"}${parts.length > 0 ? `: ${parts.join(", ")}` : ""}
+`);
+    cg.close();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=remediation.js.map

package/dist/bin/commands/remediation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/remediation.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\n\nconst red    = '\\x1b[31m';\nconst yellow = '\\x1b[33m';\n\nfunction slaColor(status: string): string {\n  switch (status) {\n    case 'ok':      return green;\n    case 'warning': return yellow;\n    case 'overdue': return red;\n    case 'no_fix':  return dim;\n    default:        return dim;\n  }\n}\n\nfunction formatDate(epochMs: number | null): string {\n  if (epochMs === null) return 'n/a';\n  return new Date(epochMs).toISOString().slice(0, 10);\n}\n\nexport function register(program: Command): void {\n  program\n    .command('remediation [projectPath]')\n    .description('Track remediation SLA: how long vulnerabilities have been open and whether fixes are overdue')\n    .option('--overdue-only', 'Show only overdue items')\n    .option('--format <fmt>', 'Output format: table | json (default: table)', 'table')\n    .action(async (projectPath: string | undefined, opts: {\n      overdueOnly?: boolean;\n      format: string;\n    }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${yellow}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n\n      const { RemediationTracker } = await Promise.resolve().then(() => require('../../security/remediation.js'));\n      const tracker = new RemediationTracker(db);\n\n      let statuses = tracker.getStatus();\n\n      // Sort: overdue first, then warning, then by daysOpen desc\n      const ORDER: Record<string, number> = { overdue: 3, warning: 2, no_fix: 1, ok: 0 };\n      statuses.sort((a, b) => {\n        const diff = (ORDER[b.slaStatus] ?? 0) - (ORDER[a.slaStatus] ?? 0);\n        if (diff !== 0) return diff;\n        return (b.daysOpen ?? 0) - (a.daysOpen ?? 0);\n      });\n\n      if (opts.overdueOnly) {\n        statuses = statuses.filter(s => s.isOverdue);\n      }\n\n      if (opts.format === 'json') {\n        console.log(JSON.stringify(statuses, null, 2));\n        cg.close();\n        return;\n      }\n\n      if (statuses.length === 0) {\n        const msg = opts.overdueOnly\n          ? 'No overdue vulnerabilities found.'\n          : 'No tracked vulnerabilities with detection timestamps found.';\n        console.log(`\\n  ${dim}${msg}${reset}`);\n        console.log(`  ${dim}Detection timestamps are recorded when vulnerabilities are first inserted via${reset} ${violet}${bold}kirograph vulns --refresh${reset}\\n`);\n        cg.close();\n        return;\n      }\n\n      console.log(`\\n  ${violet}${bold}Remediation SLA Tracking${reset}\\n`);\n\n      for (const s of statuses) {\n        const sevStr   = s.severity !== null ? s.severity.toFixed(1) : 'n/a';\n        const daysOpen = s.daysOpen !== null ? `${s.daysOpen}d` : 'n/a';\n        const fixSince = s.fixAvailableSince !== null ? `${s.daysWithFixAvailable}d ago (${formatDate(s.fixAvailableSince)})` : 'no fix';\n        const deadline = s.slaDeadline !== null ? formatDate(s.slaDeadline) : 'n/a';\n        const color    = slaColor(s.slaStatus);\n\n        console.log(`  ${violet}${bold}${s.cveId}${reset}  ${dim}${s.packageName}${reset}`);\n        console.log(`    CVSS: ${dim}${sevStr}${reset}   Open: ${dim}${daysOpen}${reset}   Fix available: ${dim}${fixSince}${reset}`);\n        console.log(`    SLA status: ${color}${bold}${s.slaStatus.toUpperCase()}${reset}   Deadline: ${dim}${deadline}${reset}`);\n        console.log();\n      }\n\n      const overdueCount = statuses.filter(s => s.slaStatus === 'overdue').length;\n      const warningCount = statuses.filter(s => s.slaStatus === 'warning').length;\n      const noFixCount   = statuses.filter(s => s.slaStatus === 'no_fix').length;\n\n      const parts: string[] = [];\n      if (overdueCount > 0) parts.push(`${red}${bold}${overdueCount} overdue${reset}`);\n      if (warningCount > 0) parts.push(`${yellow}${bold}${warningCount} warning${reset}`);\n      if (noFixCount > 0)   parts.push(`${dim}${noFixCount} no fix available${reset}`);\n\n      console.log(`  ${bold}${statuses.length}${reset} open vulnerabilit${statuses.length === 1 ? 'y' : 'ies'}${parts.length > 0 ? `: ${parts.join(', ')}` : ''}\\n`);\n\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAEhD,MAAM,MAAS;AACf,MAAM,SAAS;AAEf,SAAS,SAAS,QAAwB;AACxC,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAW,aAAO;AAAA,IACvB,KAAK;AAAW,aAAO;AAAA,IACvB,KAAK;AAAW,aAAO;AAAA,IACvB,KAAK;AAAW,aAAO;AAAA,IACvB;AAAgB,aAAO;AAAA,EACzB;AACF;AAEA,SAAS,WAAW,SAAgC;AAClD,MAAI,YAAY,KAAM,QAAO;AAC7B,SAAO,IAAI,KAAK,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AACpD;AAEO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,2BAA2B,EACnC,YAAY,8FAA8F,EAC1G,OAAO,kBAAkB,yBAAyB,EAClD,OAAO,kBAAkB,gDAAgD,OAAO,EAChF,OAAO,OAAO,aAAiC,SAG1C;AACJ,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,MAAM,wCAAmC,eAAK,EAAE;AACrE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AAEvB,UAAM,EAAE,mBAAmB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,+BAA+B,CAAC;AAC1G,UAAM,UAAU,IAAI,mBAAmB,EAAE;AAEzC,QAAI,WAAW,QAAQ,UAAU;AAGjC,UAAM,QAAgC,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,IAAI,EAAE;AACjF,aAAS,KAAK,CAAC,GAAG,MAAM;AACtB,YAAM,QAAQ,MAAM,EAAE,SAAS,KAAK,MAAM,MAAM,EAAE,SAAS,KAAK;AAChE,UAAI,SAAS,EAAG,QAAO;AACvB,cAAQ,EAAE,YAAY,MAAM,EAAE,YAAY;AAAA,IAC5C,CAAC;AAED,QAAI,KAAK,aAAa;AACpB,iBAAW,SAAS,OAAO,OAAK,EAAE,SAAS;AAAA,IAC7C;AAEA,QAAI,KAAK,WAAW,QAAQ;AAC1B,cAAQ,IAAI,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAC7C,SAAG,MAAM;AACT;AAAA,IACF;AAEA,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,MAAM,KAAK,cACb,sCACA;AACJ,cAAQ,IAAI;AAAA,IAAO,aAAG,GAAG,GAAG,GAAG,eAAK,EAAE;AACtC,cAAQ,IAAI,KAAK,aAAG,gFAAgF,eAAK,IAAI,gBAAM,GAAG,cAAI,4BAA4B,eAAK;AAAA,CAAI;AAC/J,SAAG,MAAM;AACT;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,IAAO,gBAAM,GAAG,cAAI,2BAA2B,eAAK;AAAA,CAAI;AAEpE,eAAW,KAAK,UAAU;AACxB,YAAM,SAAW,EAAE,aAAa,OAAO,EAAE,SAAS,QAAQ,CAAC,IAAI;AAC/D,YAAM,WAAW,EAAE,aAAa,OAAO,GAAG,EAAE,QAAQ,MAAM;AAC1D,YAAM,WAAW,EAAE,sBAAsB,OAAO,GAAG,EAAE,oBAAoB,UAAU,WAAW,EAAE,iBAAiB,CAAC,MAAM;AACxH,YAAM,WAAW,EAAE,gBAAgB,OAAO,WAAW,EAAE,WAAW,IAAI;AACtE,YAAM,QAAW,SAAS,EAAE,SAAS;AAErC,cAAQ,IAAI,KAAK,gBAAM,GAAG,cAAI,GAAG,EAAE,KAAK,GAAG,eAAK,KAAK,aAAG,GAAG,EAAE,WAAW,GAAG,eAAK,EAAE;AAClF,cAAQ,IAAI,aAAa,aAAG,GAAG,MAAM,GAAG,eAAK,YAAY,aAAG,GAAG,QAAQ,GAAG,eAAK,qBAAqB,aAAG,GAAG,QAAQ,GAAG,eAAK,EAAE;AAC5H,cAAQ,IAAI,mBAAmB,KAAK,GAAG,cAAI,GAAG,EAAE,UAAU,YAAY,CAAC,GAAG,eAAK,gBAAgB,aAAG,GAAG,QAAQ,GAAG,eAAK,EAAE;AACvH,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,eAAe,SAAS,OAAO,OAAK,EAAE,cAAc,SAAS,EAAE;AACrE,UAAM,eAAe,SAAS,OAAO,OAAK,EAAE,cAAc,SAAS,EAAE;AACrE,UAAM,aAAe,SAAS,OAAO,OAAK,EAAE,cAAc,QAAQ,EAAE;AAEpE,UAAM,QAAkB,CAAC;AACzB,QAAI,eAAe,EAAG,OAAM,KAAK,GAAG,GAAG,GAAG,cAAI,GAAG,YAAY,WAAW,eAAK,EAAE;AAC/E,QAAI,eAAe,EAAG,OAAM,KAAK,GAAG,MAAM,GAAG,cAAI,GAAG,YAAY,WAAW,eAAK,EAAE;AAClF,QAAI,aAAa,EAAK,OAAM,KAAK,GAAG,aAAG,GAAG,UAAU,oBAAoB,eAAK,EAAE;AAE/E,YAAQ,IAAI,KAAK,cAAI,GAAG,SAAS,MAAM,GAAG,eAAK,qBAAqB,SAAS,WAAW,IAAI,MAAM,KAAK,GAAG,MAAM,SAAS,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE;AAAA,CAAI;AAE7J,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/sbom.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=sbom.d.ts.map

package/dist/bin/commands/sbom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/sbom.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyC/C"}

package/dist/bin/commands/sbom.js

@@ -0,0 +1,76 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sbom_exports = {};
+__export(sbom_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(sbom_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+function register(program) {
+  program.command("sbom [projectPath]").description("Export CycloneDX 1.5 SBOM (Software Bill of Materials)").option("--output <file>", "Write SBOM to file instead of stdout").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(target);
+    if (!config.enableSecurity) {
+      console.error(`
+  ${"\x1B[33m"}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const { SBOMExporter } = await Promise.resolve().then(() => require("../../security/export/sbom.js"));
+    const exporter = new SBOMExporter(db, target);
+    const json = exporter.exportJSON();
+    if (opts.output) {
+      const outPath = path.resolve(opts.output);
+      fs.mkdirSync(path.dirname(outPath), { recursive: true });
+      fs.writeFileSync(outPath, json, "utf-8");
+      console.error(`  ${import_ui.green}\u2713${import_ui.reset} SBOM written to ${import_ui.violet}${import_ui.bold}${outPath}${import_ui.reset}`);
+    } else {
+      process.stdout.write(json + "\n");
+    }
+    cg.close();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=sbom.js.map

package/dist/bin/commands/sbom.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/sbom.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\n\nexport function register(program: Command): void {\n  program\n    .command('sbom [projectPath]')\n    .description('Export CycloneDX 1.5 SBOM (Software Bill of Materials)')\n    .option('--output <file>', 'Write SBOM to file instead of stdout')\n    .action(async (projectPath: string | undefined, opts: { output?: string }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n\n      const { SBOMExporter } = await Promise.resolve().then(() => require('../../security/export/sbom.js'));\n      const exporter = new SBOMExporter(db, target);\n      const json = exporter.exportJSON();\n\n      if (opts.output) {\n        const outPath = path.resolve(opts.output);\n        fs.mkdirSync(path.dirname(outPath), { recursive: true });\n        fs.writeFileSync(outPath, json, 'utf-8');\n        console.error(`  ${green}\u2713${reset} SBOM written to ${violet}${bold}${outPath}${reset}`);\n      } else {\n        process.stdout.write(json + '\\n');\n      }\n\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,SAAoB;AACpB,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAEzC,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,oBAAoB,EAC5B,YAAY,wDAAwD,EACpE,OAAO,mBAAmB,sCAAsC,EAChE,OAAO,OAAO,aAAiC,SAA8B;AAC5E,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,UAAU,wCAAmC,eAAK,EAAE;AACzE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AAEvB,UAAM,EAAE,aAAa,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,+BAA+B,CAAC;AACpG,UAAM,WAAW,IAAI,aAAa,IAAI,MAAM;AAC5C,UAAM,OAAO,SAAS,WAAW;AAEjC,QAAI,KAAK,QAAQ;AACf,YAAM,UAAU,KAAK,QAAQ,KAAK,MAAM;AACxC,SAAG,UAAU,KAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,SAAG,cAAc,SAAS,MAAM,OAAO;AACvC,cAAQ,MAAM,KAAK,eAAK,SAAI,eAAK,oBAAoB,gBAAM,GAAG,cAAI,GAAG,OAAO,GAAG,eAAK,EAAE;AAAA,IACxF,OAAO;AACL,cAAQ,OAAO,MAAM,OAAO,IAAI;AAAA,IAClC;AAEA,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/security-ci-report.d.ts

@@ -0,0 +1,9 @@
+/**
+ * kirograph security ci-report
+ *
+ * Generates a structured security report for CI/CD pipelines.
+ * Supports JSON, SARIF 2.1.0, and compact text output formats.
+ */
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=security-ci-report.d.ts.map

package/dist/bin/commands/security-ci-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-ci-report.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/security-ci-report.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkNpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgK/C"}

package/dist/bin/commands/security-ci-report.js

@@ -0,0 +1,267 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var security_ci_report_exports = {};
+__export(security_ci_report_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(security_ci_report_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+var import_owasp = require("../../security/owasp");
+function severityToSarifLevel(score) {
+  if (score == null) return "note";
+  if (score >= 7) return "error";
+  if (score >= 4) return "warning";
+  return "note";
+}
+function computeMaxRisk(vulns) {
+  const scores = vulns.map((v) => v.riskScore ?? v.severityScore ?? 0);
+  return scores.length > 0 ? Math.max(...scores) : 0;
+}
+function collectOwaspCategories(vulns) {
+  const cats = new Set(vulns.map((v) => v.owaspCategory));
+  return Array.from(cats).sort();
+}
+function shouldFail(failOn, vulns) {
+  switch (failOn) {
+    case "affected":
+      return vulns.some((v) => v.verdict === "affected");
+    case "any":
+      return vulns.length > 0;
+    case "critical":
+      return vulns.some((v) => v.severityScore != null && v.severityScore >= 9);
+    default:
+      return false;
+  }
+}
+function buildSarif(vulns, projectPath) {
+  const rulesMap = /* @__PURE__ */ new Map();
+  for (const v of vulns) {
+    const ruleId = v.cveId;
+    if (!rulesMap.has(ruleId)) {
+      const owasp = import_owasp.OWASP_TOP_10[v.owaspCategory];
+      rulesMap.set(ruleId, {
+        id: ruleId,
+        name: ruleId.replace(/-/g, ""),
+        shortDescription: { text: v.summary ?? ruleId },
+        fullDescription: { text: v.summary ?? ruleId },
+        helpUri: `https://osv.dev/vulnerability/${ruleId}`,
+        properties: {
+          tags: [
+            "security",
+            `owasp:${v.owaspCategory}`,
+            owasp ? owasp.name : ""
+          ].filter(Boolean)
+        }
+      });
+    }
+  }
+  const results = vulns.map((v) => {
+    const pkg = v.packageName ?? "unknown";
+    const ver = v.version ?? "?";
+    const msgText = `${v.cveId} in ${pkg}@${ver}` + (v.fixedVersion ? ` \u2014 fix available: ${v.fixedVersion}` : "") + (v.summary ? ` \u2014 ${v.summary}` : "");
+    return {
+      ruleId: v.cveId,
+      message: { text: msgText },
+      level: severityToSarifLevel(v.severityScore),
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: {
+              uri: projectPath,
+              uriBaseId: "%SRCROOT%"
+            },
+            region: { startLine: 1 }
+          }
+        }
+      ],
+      properties: {
+        verdict: v.verdict ?? "unknown",
+        owaspCategory: v.owaspCategory,
+        riskScore: v.riskScore,
+        severityScore: v.severityScore
+      }
+    };
+  });
+  return {
+    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "kirograph",
+            version: "1.0",
+            informationUri: "https://github.com/eleva/kirograph",
+            rules: Array.from(rulesMap.values())
+          }
+        },
+        results
+      }
+    ]
+  };
+}
+function renderText(vulns, exitCode) {
+  const lines = [];
+  for (const v of vulns) {
+    const pkg = v.packageName ? `${v.packageName}@${v.version ?? "?"}` : "unknown";
+    const score = v.severityScore != null ? v.severityScore.toFixed(1) : "?";
+    const verdict = v.verdict ?? "pending";
+    const risk = v.riskScore != null ? ` risk=${v.riskScore.toFixed(1)}` : "";
+    lines.push(`${v.cveId} | ${pkg} | cvss=${score}${risk} | ${verdict} | ${v.owaspCategory}`);
+  }
+  if (exitCode !== 0) {
+    lines.push(`EXIT_CODE=1`);
+  }
+  return lines.join("\n");
+}
+function register(program) {
+  program.command("ci-report [projectPath]").description("Generate a structured security report for CI/CD pipelines (JSON, SARIF, or text)").option("--format <fmt>", "Output format: json|sarif|text (default: json)", "json").option("--fail-on <condition>", "Exit 1 if condition is met: affected|any|critical", "affected").option("--output <file>", "Write report to file instead of stdout").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(target);
+    const validFormats = ["json", "sarif", "text"];
+    if (!validFormats.includes(opts.format)) {
+      console.error(`  \u2716 Invalid --format value: ${opts.format}. Use: ${validFormats.join(", ")}`);
+      process.exit(1);
+    }
+    const validFailOns = ["affected", "any", "critical"];
+    if (!validFailOns.includes(opts.failOn)) {
+      console.error(`  \u2716 Invalid --fail-on value: ${opts.failOn}. Use: ${validFailOns.join(", ")}`);
+      process.exit(1);
+    }
+    if (!config.enableSecurity) {
+      console.error(`
+  ${"\x1B[33m"}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const rawDb = db.getRawDb();
+    const depCount = rawDb.get(
+      `SELECT COUNT(*) as count FROM sec_dependencies`
+    ) ?? { count: 0 };
+    const vulnRows = rawDb.all(`
+        SELECT
+          v.cve_id,
+          d.package_name,
+          d.ecosystem,
+          d.resolved_version,
+          d.declared_constraint,
+          v.severity_score,
+          r.verdict,
+          v.risk_score,
+          v.summary,
+          v.fixed_version
+        FROM sec_vulnerabilities v
+        LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'
+        LEFT JOIN sec_dependencies d ON d.node_id = e.source
+        LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id
+        ORDER BY v.risk_score DESC NULLS LAST, v.severity_score DESC NULLS LAST
+      `);
+    const vulns = vulnRows.map((row) => {
+      const owaspCat = (0, import_owasp.mapCveToOwasp)(row.summary ?? "", row.package_name ?? "");
+      return {
+        cveId: row.cve_id,
+        packageName: row.package_name,
+        ecosystem: row.ecosystem,
+        version: row.resolved_version ?? row.declared_constraint,
+        severityScore: row.severity_score,
+        verdict: row.verdict,
+        riskScore: row.risk_score,
+        owaspCategory: owaspCat,
+        owaspName: import_owasp.OWASP_TOP_10[owaspCat].name,
+        summary: row.summary,
+        fixedVersion: row.fixed_version
+      };
+    });
+    const willFail = shouldFail(opts.failOn, vulns);
+    const exitCode = willFail ? 1 : 0;
+    let output;
+    if (opts.format === "sarif") {
+      const sarif = buildSarif(vulns, target);
+      output = JSON.stringify(sarif, null, 2);
+    } else if (opts.format === "text") {
+      output = renderText(vulns, exitCode);
+    } else {
+      const affectedCount = vulns.filter((v) => v.verdict === "affected").length;
+      const maxRisk = parseFloat(computeMaxRisk(vulns).toFixed(1));
+      const report = {
+        version: "1.0",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        project: path.basename(target),
+        summary: {
+          dependencies: depCount.count,
+          vulnerabilities: vulns.length,
+          affected: affectedCount,
+          riskScore: maxRisk,
+          secretsFound: 0,
+          // secrets scanning not yet wired
+          owaspCategories: collectOwaspCategories(vulns)
+        },
+        vulnerabilities: vulns,
+        secrets: [],
+        exitCode
+      };
+      output = JSON.stringify(report, null, 2);
+    }
+    if (opts.output) {
+      const outPath = path.resolve(opts.output);
+      fs.mkdirSync(path.dirname(outPath), { recursive: true });
+      fs.writeFileSync(outPath, output, "utf-8");
+      console.error(`  ${import_ui.green}\u2713${import_ui.reset} Report written to ${import_ui.violet}${import_ui.bold}${outPath}${import_ui.reset}`);
+    } else {
+      process.stdout.write(output + "\n");
+    }
+    cg.close();
+    if (exitCode !== 0) {
+      const failLabel = opts.failOn;
+      console.error(
+        `
+  \x1B[31m\u2716\x1B[0m --fail-on ${failLabel}: condition met. Exiting with code 1.`
+      );
+      process.exit(1);
+    }
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=security-ci-report.js.map

package/dist/bin/commands/security-ci-report.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/security-ci-report.ts"],
+  "sourcesContent": ["/**\n * kirograph security ci-report\n *\n * Generates a structured security report for CI/CD pipelines.\n * Supports JSON, SARIF 2.1.0, and compact text output formats.\n */\n\nimport { Command } from 'commander';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\nimport { mapCveToOwasp, OWASP_TOP_10 } from '../../security/owasp';\n\n// \u2500\u2500 Report types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface CiVulnEntry {\n  cveId: string;\n  packageName: string | null;\n  ecosystem: string | null;\n  version: string | null;\n  severityScore: number | null;\n  verdict: string | null;\n  riskScore: number | null;\n  owaspCategory: string;\n  owaspName: string;\n  summary: string | null;\n  fixedVersion: string | null;\n}\n\ninterface CiReport {\n  version: '1.0';\n  timestamp: string;\n  project: string;\n  summary: {\n    dependencies: number;\n    vulnerabilities: number;\n    affected: number;\n    riskScore: number;\n    secretsFound: number;\n    owaspCategories: string[];\n  };\n  vulnerabilities: CiVulnEntry[];\n  secrets: unknown[];\n  exitCode: number;\n}\n\n// \u2500\u2500 SARIF types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface SarifRule {\n  id: string;\n  name: string;\n  shortDescription: { text: string };\n  fullDescription: { text: string };\n  helpUri: string;\n  properties: { tags: string[] };\n}\n\ninterface SarifResult {\n  ruleId: string;\n  message: { text: string };\n  level: 'error' | 'warning' | 'note';\n  locations: Array<{\n    physicalLocation: {\n      artifactLocation: { uri: string; uriBaseId: string };\n      region: { startLine: number };\n    };\n  }>;\n  properties: Record<string, unknown>;\n}\n\ninterface SarifOutput {\n  $schema: string;\n  version: '2.1.0';\n  runs: Array<{\n    tool: {\n      driver: {\n        name: string;\n        version: string;\n        informationUri: string;\n        rules: SarifRule[];\n      };\n    };\n    results: SarifResult[];\n  }>;\n}\n\n// \u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction severityToSarifLevel(score: number | null): 'error' | 'warning' | 'note' {\n  if (score == null) return 'note';\n  if (score >= 7.0) return 'error';\n  if (score >= 4.0) return 'warning';\n  return 'note';\n}\n\nfunction computeMaxRisk(vulns: CiVulnEntry[]): number {\n  const scores = vulns.map((v) => v.riskScore ?? v.severityScore ?? 0);\n  return scores.length > 0 ? Math.max(...scores) : 0;\n}\n\nfunction collectOwaspCategories(vulns: CiVulnEntry[]): string[] {\n  const cats = new Set<string>(vulns.map((v) => v.owaspCategory));\n  return Array.from(cats).sort();\n}\n\n// \u2500\u2500 Fail-on evaluation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction shouldFail(failOn: string, vulns: CiVulnEntry[]): boolean {\n  switch (failOn) {\n    case 'affected':\n      return vulns.some((v) => v.verdict === 'affected');\n    case 'any':\n      return vulns.length > 0;\n    case 'critical':\n      return vulns.some((v) => v.severityScore != null && v.severityScore >= 9.0);\n    default:\n      return false;\n  }\n}\n\n// \u2500\u2500 SARIF generation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction buildSarif(vulns: CiVulnEntry[], projectPath: string): SarifOutput {\n  const rulesMap = new Map<string, SarifRule>();\n\n  for (const v of vulns) {\n    const ruleId = v.cveId;\n    if (!rulesMap.has(ruleId)) {\n      const owasp = OWASP_TOP_10[v.owaspCategory as keyof typeof OWASP_TOP_10];\n      rulesMap.set(ruleId, {\n        id: ruleId,\n        name: ruleId.replace(/-/g, ''),\n        shortDescription: { text: v.summary ?? ruleId },\n        fullDescription: { text: v.summary ?? ruleId },\n        helpUri: `https://osv.dev/vulnerability/${ruleId}`,\n        properties: {\n          tags: [\n            'security',\n            `owasp:${v.owaspCategory}`,\n            owasp ? owasp.name : '',\n          ].filter(Boolean),\n        },\n      });\n    }\n  }\n\n  const results: SarifResult[] = vulns.map((v) => {\n    const pkg = v.packageName ?? 'unknown';\n    const ver = v.version ?? '?';\n    const msgText =\n      `${v.cveId} in ${pkg}@${ver}` +\n      (v.fixedVersion ? ` \u2014 fix available: ${v.fixedVersion}` : '') +\n      (v.summary ? ` \u2014 ${v.summary}` : '');\n\n    return {\n      ruleId: v.cveId,\n      message: { text: msgText },\n      level: severityToSarifLevel(v.severityScore),\n      locations: [\n        {\n          physicalLocation: {\n            artifactLocation: {\n              uri: projectPath,\n              uriBaseId: '%SRCROOT%',\n            },\n            region: { startLine: 1 },\n          },\n        },\n      ],\n      properties: {\n        verdict: v.verdict ?? 'unknown',\n        owaspCategory: v.owaspCategory,\n        riskScore: v.riskScore,\n        severityScore: v.severityScore,\n      },\n    };\n  });\n\n  return {\n    $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',\n    version: '2.1.0',\n    runs: [\n      {\n        tool: {\n          driver: {\n            name: 'kirograph',\n            version: '1.0',\n            informationUri: 'https://github.com/eleva/kirograph',\n            rules: Array.from(rulesMap.values()),\n          },\n        },\n        results,\n      },\n    ],\n  };\n}\n\n// \u2500\u2500 Text format \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction renderText(vulns: CiVulnEntry[], exitCode: number): string {\n  const lines: string[] = [];\n  for (const v of vulns) {\n    const pkg = v.packageName ? `${v.packageName}@${v.version ?? '?'}` : 'unknown';\n    const score = v.severityScore != null ? v.severityScore.toFixed(1) : '?';\n    const verdict = v.verdict ?? 'pending';\n    const risk = v.riskScore != null ? ` risk=${v.riskScore.toFixed(1)}` : '';\n    lines.push(`${v.cveId} | ${pkg} | cvss=${score}${risk} | ${verdict} | ${v.owaspCategory}`);\n  }\n  if (exitCode !== 0) {\n    lines.push(`EXIT_CODE=1`);\n  }\n  return lines.join('\\n');\n}\n\n// \u2500\u2500 Command registration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport function register(program: Command): void {\n  program\n    .command('ci-report [projectPath]')\n    .description('Generate a structured security report for CI/CD pipelines (JSON, SARIF, or text)')\n    .option('--format <fmt>', 'Output format: json|sarif|text (default: json)', 'json')\n    .option('--fail-on <condition>', 'Exit 1 if condition is met: affected|any|critical', 'affected')\n    .option('--output <file>', 'Write report to file instead of stdout')\n    .action(async (\n      projectPath: string | undefined,\n      opts: { format: string; failOn: string; output?: string },\n    ) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      // Validate --format\n      const validFormats = ['json', 'sarif', 'text'];\n      if (!validFormats.includes(opts.format)) {\n        console.error(`  \u2716 Invalid --format value: ${opts.format}. Use: ${validFormats.join(', ')}`);\n        process.exit(1);\n      }\n\n      // Validate --fail-on\n      const validFailOns = ['affected', 'any', 'critical'];\n      if (!validFailOns.includes(opts.failOn)) {\n        console.error(`  \u2716 Invalid --fail-on value: ${opts.failOn}. Use: ${validFailOns.join(', ')}`);\n        process.exit(1);\n      }\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n      const rawDb = db.getRawDb();\n\n      // \u2500\u2500 Query data \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      const depCount: { count: number } = rawDb.get(\n        `SELECT COUNT(*) as count FROM sec_dependencies`,\n      ) ?? { count: 0 };\n\n      const vulnRows: Array<{\n        cve_id: string;\n        package_name: string | null;\n        ecosystem: string | null;\n        resolved_version: string | null;\n        declared_constraint: string | null;\n        severity_score: number | null;\n        verdict: string | null;\n        risk_score: number | null;\n        summary: string | null;\n        fixed_version: string | null;\n      }> = rawDb.all(`\n        SELECT\n          v.cve_id,\n          d.package_name,\n          d.ecosystem,\n          d.resolved_version,\n          d.declared_constraint,\n          v.severity_score,\n          r.verdict,\n          v.risk_score,\n          v.summary,\n          v.fixed_version\n        FROM sec_vulnerabilities v\n        LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n        LEFT JOIN sec_dependencies d ON d.node_id = e.source\n        LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n        ORDER BY v.risk_score DESC NULLS LAST, v.severity_score DESC NULLS LAST\n      `);\n\n      // \u2500\u2500 Build enriched vuln list with OWASP mapping \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      const vulns: CiVulnEntry[] = vulnRows.map((row) => {\n        const owaspCat = mapCveToOwasp(row.summary ?? '', row.package_name ?? '');\n        return {\n          cveId: row.cve_id,\n          packageName: row.package_name,\n          ecosystem: row.ecosystem,\n          version: row.resolved_version ?? row.declared_constraint,\n          severityScore: row.severity_score,\n          verdict: row.verdict,\n          riskScore: row.risk_score,\n          owaspCategory: owaspCat,\n          owaspName: OWASP_TOP_10[owaspCat].name,\n          summary: row.summary,\n          fixedVersion: row.fixed_version,\n        };\n      });\n\n      // \u2500\u2500 Compute exit code \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      const willFail = shouldFail(opts.failOn, vulns);\n      const exitCode = willFail ? 1 : 0;\n\n      // \u2500\u2500 Build and emit report \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      let output: string;\n\n      if (opts.format === 'sarif') {\n        const sarif = buildSarif(vulns, target);\n        output = JSON.stringify(sarif, null, 2);\n      } else if (opts.format === 'text') {\n        output = renderText(vulns, exitCode);\n      } else {\n        // JSON\n        const affectedCount = vulns.filter((v) => v.verdict === 'affected').length;\n        const maxRisk = parseFloat(computeMaxRisk(vulns).toFixed(1));\n\n        const report: CiReport = {\n          version: '1.0',\n          timestamp: new Date().toISOString(),\n          project: path.basename(target),\n          summary: {\n            dependencies: depCount.count,\n            vulnerabilities: vulns.length,\n            affected: affectedCount,\n            riskScore: maxRisk,\n            secretsFound: 0, // secrets scanning not yet wired\n            owaspCategories: collectOwaspCategories(vulns),\n          },\n          vulnerabilities: vulns,\n          secrets: [],\n          exitCode,\n        };\n        output = JSON.stringify(report, null, 2);\n      }\n\n      // \u2500\u2500 Write or print \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      if (opts.output) {\n        const outPath = path.resolve(opts.output);\n        fs.mkdirSync(path.dirname(outPath), { recursive: true });\n        fs.writeFileSync(outPath, output, 'utf-8');\n        console.error(`  ${green}\u2713${reset} Report written to ${violet}${bold}${outPath}${reset}`);\n      } else {\n        process.stdout.write(output + '\\n');\n      }\n\n      cg.close();\n\n      if (exitCode !== 0) {\n        const failLabel = opts.failOn;\n        console.error(\n          `\\n  \\x1b[31m\u2716\\x1b[0m --fail-on ${failLabel}: condition met. Exiting with code 1.`,\n        );\n        process.exit(1);\n      }\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,SAAoB;AACpB,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAChD,mBAA4C;AA6E5C,SAAS,qBAAqB,OAAoD;AAChF,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,SAAS,EAAK,QAAO;AACzB,MAAI,SAAS,EAAK,QAAO;AACzB,SAAO;AACT;AAEA,SAAS,eAAe,OAA8B;AACpD,QAAM,SAAS,MAAM,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,CAAC;AACnE,SAAO,OAAO,SAAS,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI;AACnD;AAEA,SAAS,uBAAuB,OAAgC;AAC9D,QAAM,OAAO,IAAI,IAAY,MAAM,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC;AAC9D,SAAO,MAAM,KAAK,IAAI,EAAE,KAAK;AAC/B;AAIA,SAAS,WAAW,QAAgB,OAA+B;AACjE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,MAAM,KAAK,CAAC,MAAM,EAAE,YAAY,UAAU;AAAA,IACnD,KAAK;AACH,aAAO,MAAM,SAAS;AAAA,IACxB,KAAK;AACH,aAAO,MAAM,KAAK,CAAC,MAAM,EAAE,iBAAiB,QAAQ,EAAE,iBAAiB,CAAG;AAAA,IAC5E;AACE,aAAO;AAAA,EACX;AACF;AAIA,SAAS,WAAW,OAAsB,aAAkC;AAC1E,QAAM,WAAW,oBAAI,IAAuB;AAE5C,aAAW,KAAK,OAAO;AACrB,UAAM,SAAS,EAAE;AACjB,QAAI,CAAC,SAAS,IAAI,MAAM,GAAG;AACzB,YAAM,QAAQ,0BAAa,EAAE,aAA0C;AACvE,eAAS,IAAI,QAAQ;AAAA,QACnB,IAAI;AAAA,QACJ,MAAM,OAAO,QAAQ,MAAM,EAAE;AAAA,QAC7B,kBAAkB,EAAE,MAAM,EAAE,WAAW,OAAO;AAAA,QAC9C,iBAAiB,EAAE,MAAM,EAAE,WAAW,OAAO;AAAA,QAC7C,SAAS,iCAAiC,MAAM;AAAA,QAChD,YAAY;AAAA,UACV,MAAM;AAAA,YACJ;AAAA,YACA,SAAS,EAAE,aAAa;AAAA,YACxB,QAAQ,MAAM,OAAO;AAAA,UACvB,EAAE,OAAO,OAAO;AAAA,QAClB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,UAAyB,MAAM,IAAI,CAAC,MAAM;AAC9C,UAAM,MAAM,EAAE,eAAe;AAC7B,UAAM,MAAM,EAAE,WAAW;AACzB,UAAM,UACJ,GAAG,EAAE,KAAK,OAAO,GAAG,IAAI,GAAG,MAC1B,EAAE,eAAe,0BAAqB,EAAE,YAAY,KAAK,OACzD,EAAE,UAAU,WAAM,EAAE,OAAO,KAAK;AAEnC,WAAO;AAAA,MACL,QAAQ,EAAE;AAAA,MACV,SAAS,EAAE,MAAM,QAAQ;AAAA,MACzB,OAAO,qBAAqB,EAAE,aAAa;AAAA,MAC3C,WAAW;AAAA,QACT;AAAA,UACE,kBAAkB;AAAA,YAChB,kBAAkB;AAAA,cAChB,KAAK;AAAA,cACL,WAAW;AAAA,YACb;AAAA,YACA,QAAQ,EAAE,WAAW,EAAE;AAAA,UACzB;AAAA,QACF;AAAA,MACF;AAAA,MACA,YAAY;AAAA,QACV,SAAS,EAAE,WAAW;AAAA,QACtB,eAAe,EAAE;AAAA,QACjB,WAAW,EAAE;AAAA,QACb,eAAe,EAAE;AAAA,MACnB;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,SAAS;AAAA,IACT,SAAS;AAAA,IACT,MAAM;AAAA,MACJ;AAAA,QACE,MAAM;AAAA,UACJ,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,SAAS;AAAA,YACT,gBAAgB;AAAA,YAChB,OAAO,MAAM,KAAK,SAAS,OAAO,CAAC;AAAA,UACrC;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAIA,SAAS,WAAW,OAAsB,UAA0B;AAClE,QAAM,QAAkB,CAAC;AACzB,aAAW,KAAK,OAAO;AACrB,UAAM,MAAM,EAAE,cAAc,GAAG,EAAE,WAAW,IAAI,EAAE,WAAW,GAAG,KAAK;AACrE,UAAM,QAAQ,EAAE,iBAAiB,OAAO,EAAE,cAAc,QAAQ,CAAC,IAAI;AACrE,UAAM,UAAU,EAAE,WAAW;AAC7B,UAAM,OAAO,EAAE,aAAa,OAAO,SAAS,EAAE,UAAU,QAAQ,CAAC,CAAC,KAAK;AACvE,UAAM,KAAK,GAAG,EAAE,KAAK,MAAM,GAAG,WAAW,KAAK,GAAG,IAAI,MAAM,OAAO,MAAM,EAAE,aAAa,EAAE;AAAA,EAC3F;AACA,MAAI,aAAa,GAAG;AAClB,UAAM,KAAK,aAAa;AAAA,EAC1B;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAIO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,yBAAyB,EACjC,YAAY,kFAAkF,EAC9F,OAAO,kBAAkB,kDAAkD,MAAM,EACjF,OAAO,yBAAyB,qDAAqD,UAAU,EAC/F,OAAO,mBAAmB,wCAAwC,EAClE,OAAO,OACN,aACA,SACG;AACH,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAGtC,UAAM,eAAe,CAAC,QAAQ,SAAS,MAAM;AAC7C,QAAI,CAAC,aAAa,SAAS,KAAK,MAAM,GAAG;AACvC,cAAQ,MAAM,oCAA+B,KAAK,MAAM,UAAU,aAAa,KAAK,IAAI,CAAC,EAAE;AAC3F,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,UAAM,eAAe,CAAC,YAAY,OAAO,UAAU;AACnD,QAAI,CAAC,aAAa,SAAS,KAAK,MAAM,GAAG;AACvC,cAAQ,MAAM,qCAAgC,KAAK,MAAM,UAAU,aAAa,KAAK,IAAI,CAAC,EAAE;AAC5F,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,UAAU,wCAAmC,eAAK,EAAE;AACzE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AACvB,UAAM,QAAQ,GAAG,SAAS;AAI1B,UAAM,WAA8B,MAAM;AAAA,MACxC;AAAA,IACF,KAAK,EAAE,OAAO,EAAE;AAEhB,UAAM,WAWD,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAiBd;AAID,UAAM,QAAuB,SAAS,IAAI,CAAC,QAAQ;AACjD,YAAM,eAAW,4BAAc,IAAI,WAAW,IAAI,IAAI,gBAAgB,EAAE;AACxE,aAAO;AAAA,QACL,OAAO,IAAI;AAAA,QACX,aAAa,IAAI;AAAA,QACjB,WAAW,IAAI;AAAA,QACf,SAAS,IAAI,oBAAoB,IAAI;AAAA,QACrC,eAAe,IAAI;AAAA,QACnB,SAAS,IAAI;AAAA,QACb,WAAW,IAAI;AAAA,QACf,eAAe;AAAA,QACf,WAAW,0BAAa,QAAQ,EAAE;AAAA,QAClC,SAAS,IAAI;AAAA,QACb,cAAc,IAAI;AAAA,MACpB;AAAA,IACF,CAAC;AAID,UAAM,WAAW,WAAW,KAAK,QAAQ,KAAK;AAC9C,UAAM,WAAW,WAAW,IAAI;AAIhC,QAAI;AAEJ,QAAI,KAAK,WAAW,SAAS;AAC3B,YAAM,QAAQ,WAAW,OAAO,MAAM;AACtC,eAAS,KAAK,UAAU,OAAO,MAAM,CAAC;AAAA,IACxC,WAAW,KAAK,WAAW,QAAQ;AACjC,eAAS,WAAW,OAAO,QAAQ;AAAA,IACrC,OAAO;AAEL,YAAM,gBAAgB,MAAM,OAAO,CAAC,MAAM,EAAE,YAAY,UAAU,EAAE;AACpE,YAAM,UAAU,WAAW,eAAe,KAAK,EAAE,QAAQ,CAAC,CAAC;AAE3D,YAAM,SAAmB;AAAA,QACvB,SAAS;AAAA,QACT,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,SAAS,KAAK,SAAS,MAAM;AAAA,QAC7B,SAAS;AAAA,UACP,cAAc,SAAS;AAAA,UACvB,iBAAiB,MAAM;AAAA,UACvB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,cAAc;AAAA;AAAA,UACd,iBAAiB,uBAAuB,KAAK;AAAA,QAC/C;AAAA,QACA,iBAAiB;AAAA,QACjB,SAAS,CAAC;AAAA,QACV;AAAA,MACF;AACA,eAAS,KAAK,UAAU,QAAQ,MAAM,CAAC;AAAA,IACzC;AAIA,QAAI,KAAK,QAAQ;AACf,YAAM,UAAU,KAAK,QAAQ,KAAK,MAAM;AACxC,SAAG,UAAU,KAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,SAAG,cAAc,SAAS,QAAQ,OAAO;AACzC,cAAQ,MAAM,KAAK,eAAK,SAAI,eAAK,sBAAsB,gBAAM,GAAG,cAAI,GAAG,OAAO,GAAG,eAAK,EAAE;AAAA,IAC1F,OAAO;AACL,cAAQ,OAAO,MAAM,SAAS,IAAI;AAAA,IACpC;AAEA,OAAG,MAAM;AAET,QAAI,aAAa,GAAG;AAClB,YAAM,YAAY,KAAK;AACvB,cAAQ;AAAA,QACN;AAAA,oCAAkC,SAAS;AAAA,MAC7C;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/security-export.d.ts

@@ -0,0 +1,2 @@
+export declare function register(secCmd: import('commander').Command): void;
+//# sourceMappingURL=security-export.d.ts.map

package/dist/bin/commands/security-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-export.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/security-export.ts"],"names":[],"mappings":"AAqwCA,wBAAgB,QAAQ,CAAC,MAAM,EAAE,OAAO,WAAW,EAAE,OAAO,GAAG,IAAI,CAoJlE"}