kirograph 0.17.0 → 0.20.0

package/dist/bin/commands/security-secrets.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/security-secrets.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold } from '../ui';\n\n// \u2500\u2500 Severity helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst SEVERITY_ORDER: Record<string, number> = { critical: 0, high: 1, medium: 2, low: 3 };\n\nfunction severityColor(severity: string): string {\n  switch (severity) {\n    case 'critical': return '\\x1b[31m';\n    case 'high':     return '\\x1b[31m';\n    case 'medium':   return '\\x1b[33m';\n    default:         return dim;\n  }\n}\n\nfunction severityLabel(severity: string): string {\n  return severity.toUpperCase().padEnd(8);\n}\n\nfunction fixSuggestion(type: string): string {\n  if (type.includes('AWS')) return 'Rotate this key immediately and use environment variables or AWS IAM roles';\n  if (type.includes('GitHub')) return 'Revoke this token immediately and use GitHub Actions secrets or a vault';\n  if (type.includes('Stripe')) return 'Rotate via the Stripe dashboard and store in environment variables';\n  if (type.includes('SendGrid')) return 'Revoke via SendGrid settings and store in environment variables';\n  if (type.includes('Twilio')) return 'Rotate via the Twilio console and store in environment variables';\n  if (type.includes('Slack')) return 'Revoke via Slack app settings and store in environment variables';\n  if (type.includes('Private Key')) return 'Remove from source control immediately; generate a new key pair';\n  if (type.includes('JWT')) return 'Replace with a runtime-generated token; never hardcode JWTs in source';\n  if (type.includes('Database URL')) return 'Move credentials to environment variables or a secrets manager';\n  if (type.includes('API Key')) return 'Rotate this key and store it in environment variables or a vault';\n  return 'Rotate this credential and store it in environment variables or a secrets manager';\n}\n\n// \u2500\u2500 Command \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport function register(program: Command): void {\n  program\n    .command('secrets [projectPath]')\n    .description('Scan source files for hardcoded secrets and credentials')\n    .option('--include-tests', 'Include test files in the scan')\n    .option('--severity <level>', 'Filter by severity: critical, high, medium, low')\n    .option('--format <fmt>', 'Output format: text (default), json')\n    .action(async (\n      projectPath: string | undefined,\n      opts: { includeTests?: boolean; severity?: string; format?: string },\n    ) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      // Validate --severity early\n      const validSeverities = ['critical', 'high', 'medium', 'low'];\n      if (opts.severity && !validSeverities.includes(opts.severity.toLowerCase())) {\n        console.error(`  \u2716 Invalid --severity value: ${opts.severity}. Use: critical, high, medium, low`);\n        process.exit(1);\n      }\n\n      // Validate --format early\n      const validFormats = ['text', 'json'];\n      if (opts.format && !validFormats.includes(opts.format.toLowerCase())) {\n        console.error(`  \u2716 Invalid --format value: ${opts.format}. Use: text, json`);\n        process.exit(1);\n      }\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      if (!config.enableArchitecture) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Secrets scan requires Architecture analysis to be enabled.${reset}`);\n        console.error(`  ${dim}Enable both in .kirograph/config.json:${reset}`);\n        console.error(`    ${violet}${bold}\"enableArchitecture\": true${reset}`);\n        console.error(`    ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n\n      const { SecretsScanner } = await Promise.resolve().then(() => require('../../security/secrets.js'));\n      const scanner = new SecretsScanner(db, target);\n      const result = await scanner.scan({ includeTests: opts.includeTests });\n\n      // Apply severity filter\n      let findings = result.findings;\n      if (opts.severity) {\n        const minSeverity = opts.severity.toLowerCase();\n        const minOrder = SEVERITY_ORDER[minSeverity] ?? 3;\n        findings = findings.filter(f => (SEVERITY_ORDER[f.severity] ?? 3) <= minOrder);\n      }\n\n      // \u2500\u2500 JSON output \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      if (opts.format === 'json') {\n        process.stdout.write(JSON.stringify({\n          filesScanned: result.filesScanned,\n          totalFindings: findings.length,\n          criticalCount: findings.filter(f => f.severity === 'critical').length,\n          highCount: findings.filter(f => f.severity === 'high').length,\n          findings,\n        }, null, 2) + '\\n');\n        cg.close();\n        return;\n      }\n\n      // \u2500\u2500 Text output \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      const filterNote = opts.severity ? ` \u00B7 filtered to ${opts.severity}+` : '';\n      console.log(`\\n  ${violet}${bold}\uD83D\uDD11 Secrets Scan${reset}  ${dim}(${findings.length} finding${findings.length === 1 ? '' : 's'} in ${result.filesScanned} files${filterNote})${reset}\\n`);\n\n      if (findings.length === 0) {\n        console.log(`  ${dim}No secrets found.${reset}\\n`);\n        cg.close();\n        return;\n      }\n\n      for (const finding of findings) {\n        const color = severityColor(finding.severity);\n        const label = severityLabel(finding.severity);\n\n        // Relative path for display\n        const relPath = path.relative(target, finding.filePath);\n        const location = `${relPath}:${finding.line}`;\n\n        // Header line: severity + type + location\n        console.log(`  ${color}${bold}${label}${reset}  ${violet}${bold}${finding.type}${reset}  ${dim}${location}${reset}`);\n\n        // Detail line: snippet \u00B7 function \u00B7 blast radius\n        const snippetPart = `${dim}${finding.snippet}${reset}`;\n        const funcPart = finding.nodeName\n          ? ` \u00B7 ${dim}in${reset} ${violet}${finding.nodeName}()${reset}`\n          : '';\n        const reachabilityPart = finding.entryPointCount > 0\n          ? ` \u00B7 ${'\\x1b[33m'}reachable from ${bold}${finding.entryPointCount}${reset}${'\\x1b[33m'} entry point${finding.entryPointCount === 1 ? '' : 's'}${reset}`\n          : '';\n\n        console.log(`            ${snippetPart}${funcPart}${reachabilityPart}`);\n\n        // Fix suggestion\n        const suggestion = fixSuggestion(finding.type);\n        console.log(`            ${dim}\uD83D\uDCA1 ${suggestion}${reset}`);\n\n        console.log();\n      }\n\n      // Summary line when multiple severities present\n      if (findings.length > 1) {\n        const crit = findings.filter(f => f.severity === 'critical').length;\n        const high = findings.filter(f => f.severity === 'high').length;\n        const med  = findings.filter(f => f.severity === 'medium').length;\n        const low  = findings.filter(f => f.severity === 'low').length;\n\n        const parts: string[] = [];\n        if (crit > 0) parts.push(`${'\\x1b[31m'}${bold}${crit} critical${reset}`);\n        if (high > 0) parts.push(`${'\\x1b[31m'}${bold}${high} high${reset}`);\n        if (med  > 0) parts.push(`${'\\x1b[33m'}${bold}${med} medium${reset}`);\n        if (low  > 0) parts.push(`${dim}${bold}${low} low${reset}`);\n\n        console.log(`  ${dim}Total:${reset} ${parts.join(`${dim}, ${reset}`)}\\n`);\n      }\n\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAyC;AAIzC,MAAM,iBAAyC,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE;AAEzF,SAAS,cAAc,UAA0B;AAC/C,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAY,aAAO;AAAA,IACxB,KAAK;AAAY,aAAO;AAAA,IACxB,KAAK;AAAY,aAAO;AAAA,IACxB;AAAiB,aAAO;AAAA,EAC1B;AACF;AAEA,SAAS,cAAc,UAA0B;AAC/C,SAAO,SAAS,YAAY,EAAE,OAAO,CAAC;AACxC;AAEA,SAAS,cAAc,MAAsB;AAC3C,MAAI,KAAK,SAAS,KAAK,EAAG,QAAO;AACjC,MAAI,KAAK,SAAS,QAAQ,EAAG,QAAO;AACpC,MAAI,KAAK,SAAS,QAAQ,EAAG,QAAO;AACpC,MAAI,KAAK,SAAS,UAAU,EAAG,QAAO;AACtC,MAAI,KAAK,SAAS,QAAQ,EAAG,QAAO;AACpC,MAAI,KAAK,SAAS,OAAO,EAAG,QAAO;AACnC,MAAI,KAAK,SAAS,aAAa,EAAG,QAAO;AACzC,MAAI,KAAK,SAAS,KAAK,EAAG,QAAO;AACjC,MAAI,KAAK,SAAS,cAAc,EAAG,QAAO;AAC1C,MAAI,KAAK,SAAS,SAAS,EAAG,QAAO;AACrC,SAAO;AACT;AAIO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,uBAAuB,EAC/B,YAAY,yDAAyD,EACrE,OAAO,mBAAmB,gCAAgC,EAC1D,OAAO,sBAAsB,iDAAiD,EAC9E,OAAO,kBAAkB,qCAAqC,EAC9D,OAAO,OACN,aACA,SACG;AACH,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAGtC,UAAM,kBAAkB,CAAC,YAAY,QAAQ,UAAU,KAAK;AAC5D,QAAI,KAAK,YAAY,CAAC,gBAAgB,SAAS,KAAK,SAAS,YAAY,CAAC,GAAG;AAC3E,cAAQ,MAAM,sCAAiC,KAAK,QAAQ,oCAAoC;AAChG,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,UAAM,eAAe,CAAC,QAAQ,MAAM;AACpC,QAAI,KAAK,UAAU,CAAC,aAAa,SAAS,KAAK,OAAO,YAAY,CAAC,GAAG;AACpE,cAAQ,MAAM,oCAA+B,KAAK,MAAM,mBAAmB;AAC3E,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,UAAU,wCAAmC,eAAK,EAAE;AACzE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,CAAC,OAAO,oBAAoB;AAC9B,cAAQ,MAAM;AAAA,IAAO,UAAU,oEAA+D,eAAK,EAAE;AACrG,cAAQ,MAAM,KAAK,aAAG,yCAAyC,eAAK,EAAE;AACtE,cAAQ,MAAM,OAAO,gBAAM,GAAG,cAAI,6BAA6B,eAAK,EAAE;AACtE,cAAQ,MAAM,OAAO,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AAClE,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AAEvB,UAAM,EAAE,eAAe,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,2BAA2B,CAAC;AAClG,UAAM,UAAU,IAAI,eAAe,IAAI,MAAM;AAC7C,UAAM,SAAS,MAAM,QAAQ,KAAK,EAAE,cAAc,KAAK,aAAa,CAAC;AAGrE,QAAI,WAAW,OAAO;AACtB,QAAI,KAAK,UAAU;AACjB,YAAM,cAAc,KAAK,SAAS,YAAY;AAC9C,YAAM,WAAW,eAAe,WAAW,KAAK;AAChD,iBAAW,SAAS,OAAO,QAAM,eAAe,EAAE,QAAQ,KAAK,MAAM,QAAQ;AAAA,IAC/E;AAIA,QAAI,KAAK,WAAW,QAAQ;AAC1B,cAAQ,OAAO,MAAM,KAAK,UAAU;AAAA,QAClC,cAAc,OAAO;AAAA,QACrB,eAAe,SAAS;AAAA,QACxB,eAAe,SAAS,OAAO,OAAK,EAAE,aAAa,UAAU,EAAE;AAAA,QAC/D,WAAW,SAAS,OAAO,OAAK,EAAE,aAAa,MAAM,EAAE;AAAA,QACvD;AAAA,MACF,GAAG,MAAM,CAAC,IAAI,IAAI;AAClB,SAAG,MAAM;AACT;AAAA,IACF;AAIA,UAAM,aAAa,KAAK,WAAW,qBAAkB,KAAK,QAAQ,MAAM;AACxE,YAAQ,IAAI;AAAA,IAAO,gBAAM,GAAG,cAAI,yBAAkB,eAAK,KAAK,aAAG,IAAI,SAAS,MAAM,WAAW,SAAS,WAAW,IAAI,KAAK,GAAG,OAAO,OAAO,YAAY,SAAS,UAAU,IAAI,eAAK;AAAA,CAAI;AAEvL,QAAI,SAAS,WAAW,GAAG;AACzB,cAAQ,IAAI,KAAK,aAAG,oBAAoB,eAAK;AAAA,CAAI;AACjD,SAAG,MAAM;AACT;AAAA,IACF;AAEA,eAAW,WAAW,UAAU;AAC9B,YAAM,QAAQ,cAAc,QAAQ,QAAQ;AAC5C,YAAM,QAAQ,cAAc,QAAQ,QAAQ;AAG5C,YAAM,UAAU,KAAK,SAAS,QAAQ,QAAQ,QAAQ;AACtD,YAAM,WAAW,GAAG,OAAO,IAAI,QAAQ,IAAI;AAG3C,cAAQ,IAAI,KAAK,KAAK,GAAG,cAAI,GAAG,KAAK,GAAG,eAAK,KAAK,gBAAM,GAAG,cAAI,GAAG,QAAQ,IAAI,GAAG,eAAK,KAAK,aAAG,GAAG,QAAQ,GAAG,eAAK,EAAE;AAGnH,YAAM,cAAc,GAAG,aAAG,GAAG,QAAQ,OAAO,GAAG,eAAK;AACpD,YAAM,WAAW,QAAQ,WACrB,SAAM,aAAG,KAAK,eAAK,IAAI,gBAAM,GAAG,QAAQ,QAAQ,KAAK,eAAK,KAC1D;AACJ,YAAM,mBAAmB,QAAQ,kBAAkB,IAC/C,SAAM,UAAU,kBAAkB,cAAI,GAAG,QAAQ,eAAe,GAAG,eAAK,GAAG,UAAU,eAAe,QAAQ,oBAAoB,IAAI,KAAK,GAAG,GAAG,eAAK,KACpJ;AAEJ,cAAQ,IAAI,eAAe,WAAW,GAAG,QAAQ,GAAG,gBAAgB,EAAE;AAGtE,YAAM,aAAa,cAAc,QAAQ,IAAI;AAC7C,cAAQ,IAAI,eAAe,aAAG,aAAM,UAAU,GAAG,eAAK,EAAE;AAExD,cAAQ,IAAI;AAAA,IACd;AAGA,QAAI,SAAS,SAAS,GAAG;AACvB,YAAM,OAAO,SAAS,OAAO,OAAK,EAAE,aAAa,UAAU,EAAE;AAC7D,YAAM,OAAO,SAAS,OAAO,OAAK,EAAE,aAAa,MAAM,EAAE;AACzD,YAAM,MAAO,SAAS,OAAO,OAAK,EAAE,aAAa,QAAQ,EAAE;AAC3D,YAAM,MAAO,SAAS,OAAO,OAAK,EAAE,aAAa,KAAK,EAAE;AAExD,YAAM,QAAkB,CAAC;AACzB,UAAI,OAAO,EAAG,OAAM,KAAK,GAAG,UAAU,GAAG,cAAI,GAAG,IAAI,YAAY,eAAK,EAAE;AACvE,UAAI,OAAO,EAAG,OAAM,KAAK,GAAG,UAAU,GAAG,cAAI,GAAG,IAAI,QAAQ,eAAK,EAAE;AACnE,UAAI,MAAO,EAAG,OAAM,KAAK,GAAG,UAAU,GAAG,cAAI,GAAG,GAAG,UAAU,eAAK,EAAE;AACpE,UAAI,MAAO,EAAG,OAAM,KAAK,GAAG,aAAG,GAAG,cAAI,GAAG,GAAG,OAAO,eAAK,EAAE;AAE1D,cAAQ,IAAI,KAAK,aAAG,SAAS,eAAK,IAAI,MAAM,KAAK,GAAG,aAAG,KAAK,eAAK,EAAE,CAAC;AAAA,CAAI;AAAA,IAC1E;AAEA,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/security.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): Command;
+//# sourceMappingURL=security.d.ts.map

package/dist/bin/commands/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAiMlD"}

package/dist/bin/commands/security.js

@@ -0,0 +1,208 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var security_exports = {};
+__export(security_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(security_exports);
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+function register(program) {
+  const secCmd = program.command("security").description("Security analysis: overview, dashboard export, and vulnerability management").argument("[projectPath]", "Project root path (optional)").option("--refresh-staleness", "Fetch latest version info from registries and show stale dependency count").option("--fail-on <condition>", "Exit 1 if condition is met. Supported: affected").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(target);
+    if (!config.enableSecurity) {
+      console.error(`
+  ${"\x1B[33m"}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    if (!config.enableArchitecture) {
+      console.error(`
+  ${"\x1B[33m"}\u26A0 Security requires Architecture analysis to be enabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable both in .kirograph/config.json:${import_ui.reset}`);
+      console.error(`    ${import_ui.violet}${import_ui.bold}"enableArchitecture": true${import_ui.reset}`);
+      console.error(`    ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    if (opts.failOn !== void 0 && opts.failOn !== "affected") {
+      console.error(`  \u2716 Invalid --fail-on value: ${opts.failOn}. Supported: affected`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const rawDb = db.getRawDb();
+    if (opts.refreshStaleness) {
+      console.error(`  ${import_ui.dim}Fetching latest version info from package registries...${import_ui.reset}`);
+      const { StalenessChecker } = await Promise.resolve().then(() => require("../../security/staleness.js"));
+      const checker = new StalenessChecker(db);
+      const result = await checker.checkAll();
+      console.error(`  ${import_ui.green}\u2713${import_ui.reset} Checked ${import_ui.bold}${result.checked}${import_ui.reset} packages, ${import_ui.bold}${result.stale}${import_ui.reset} stale`);
+      if (result.errors.length > 0) {
+        console.error(`  ${"\x1B[33m"}\u26A0${import_ui.reset} ${result.errors.length} error(s) during registry fetch`);
+      }
+      console.error();
+    }
+    const depCount = rawDb.get(
+      `SELECT COUNT(*) as count FROM sec_dependencies`
+    ) ?? { count: 0 };
+    const vulnCount = rawDb.get(
+      `SELECT COUNT(*) as count FROM sec_vulnerabilities`
+    ) ?? { count: 0 };
+    const verdictRows = rawDb.all(
+      `SELECT verdict, COUNT(*) as count FROM sec_reachability GROUP BY verdict`
+    );
+    const verdicts = {};
+    for (const row of verdictRows) {
+      verdicts[row.verdict] = row.count;
+    }
+    const staleCount = rawDb.get(
+      `SELECT COUNT(*) as count FROM sec_dependencies WHERE vuln_data_stale = 1`
+    ) ?? { count: 0 };
+    console.log(`
+  ${(0, import_ui.section)("Security Overview")}
+`);
+    console.log(`  ${import_ui.dim}Dependencies:${import_ui.reset}          ${import_ui.violet}${import_ui.bold}${depCount.count}${import_ui.reset}`);
+    console.log(`  ${import_ui.dim}Vulnerabilities:${import_ui.reset}       ${import_ui.violet}${import_ui.bold}${vulnCount.count}${import_ui.reset}`);
+    console.log();
+    if (vulnCount.count > 0) {
+      const topCVE = rawDb.get(
+        `SELECT v.cve_id, v.risk_score, d.package_name
+             FROM sec_vulnerabilities v
+             LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'
+             LEFT JOIN sec_dependencies d ON d.node_id = e.source
+             LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id
+             WHERE r.verdict = 'affected' AND v.risk_score IS NOT NULL
+             ORDER BY v.risk_score DESC NULLS LAST
+             LIMIT 1`
+      );
+      if (topCVE && topCVE.risk_score != null) {
+        const riskColor = topCVE.risk_score >= 7 ? "\x1B[31m" : topCVE.risk_score >= 4 ? "\x1B[33m" : import_ui.dim;
+        const pkgLabel = topCVE.package_name ? ` in ${import_ui.dim}${topCVE.package_name}${import_ui.reset}` : "";
+        console.log(`  ${riskColor}Top risk:${import_ui.reset}              ${import_ui.violet}${import_ui.bold}${topCVE.cve_id}${import_ui.reset} ${riskColor}(Risk: ${topCVE.risk_score.toFixed(1)})${import_ui.reset}${pkgLabel}`);
+        console.log();
+      }
+      console.log(`  ${(0, import_ui.section)("Reachability Verdicts")}
+`);
+      const affected = verdicts["affected"] ?? 0;
+      const notAffected = verdicts["not_affected"] ?? 0;
+      const underInvestigation = verdicts["under_investigation"] ?? 0;
+      const noAnalysis = vulnCount.count - affected - notAffected - underInvestigation;
+      if (affected > 0) {
+        console.log(`  ${"\x1B[31m"}\u25CF${import_ui.reset} Affected:              ${import_ui.bold}${affected}${import_ui.reset}`);
+      }
+      if (notAffected > 0) {
+        console.log(`  ${import_ui.green}\u25CF${import_ui.reset} Not affected:          ${import_ui.bold}${notAffected}${import_ui.reset}`);
+      }
+      if (underInvestigation > 0) {
+        console.log(`  ${"\x1B[33m"}\u25CF${import_ui.reset} Under investigation:   ${import_ui.bold}${underInvestigation}${import_ui.reset}`);
+      }
+      if (noAnalysis > 0) {
+        console.log(`  ${import_ui.dim}\u25CF${import_ui.reset} Pending analysis:      ${import_ui.bold}${noAnalysis}${import_ui.reset}`);
+      }
+      console.log();
+    }
+    if (staleCount.count > 0) {
+      console.log(`  ${"\x1B[33m"}\u26A0${import_ui.reset} ${import_ui.bold}${staleCount.count}${import_ui.reset} ${import_ui.dim}dependenc${staleCount.count === 1 ? "y has" : "ies have"} stale vulnerability data.${import_ui.reset}`);
+      console.log(`  ${import_ui.dim}Run${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph vulns --refresh${import_ui.reset} ${import_ui.dim}to update.${import_ui.reset}
+`);
+    }
+    const stalenessDataCount = rawDb.get(
+      `SELECT COUNT(*) as count FROM sec_dependencies WHERE staleness_score IS NOT NULL`
+    ) ?? { count: 0 };
+    if (stalenessDataCount.count > 0) {
+      const staleDepCount = rawDb.get(
+        `SELECT COUNT(*) as count FROM sec_dependencies WHERE staleness_score >= 0.3`
+      ) ?? { count: 0 };
+      console.log(`  ${import_ui.dim}Stale dependencies:${import_ui.reset}    ${staleDepCount.count > 0 ? `${"\x1B[33m"}${import_ui.bold}${staleDepCount.count}${import_ui.reset}` : `${import_ui.green}${import_ui.bold}0${import_ui.reset}`} ${import_ui.dim}of ${stalenessDataCount.count} scored${import_ui.reset}`);
+      if (staleDepCount.count > 0) {
+        console.log(`  ${import_ui.dim}Run${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph staleness${import_ui.reset} ${import_ui.dim}for details.${import_ui.reset}`);
+      }
+      console.log();
+    } else if (!opts.refreshStaleness) {
+      console.log(`  ${import_ui.dim}No staleness data.${import_ui.reset} ${import_ui.dim}Run${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph security --refresh-staleness${import_ui.reset} ${import_ui.dim}to score dependencies.${import_ui.reset}
+`);
+    }
+    const lastCheck = rawDb.get(
+      `SELECT MIN(last_vuln_check) as oldest FROM sec_dependencies WHERE last_vuln_check IS NOT NULL`
+    )?.oldest;
+    if (lastCheck != null) {
+      const ageMs = Date.now() - lastCheck;
+      const ageDays = ageMs / (1e3 * 60 * 60 * 24);
+      const maxAge = config.securityEnrichMaxAgeDays ?? 7;
+      if (ageDays > maxAge) {
+        console.log(`
+  ${"\x1B[33m"}\u26A0 Vulnerability data is ${Math.floor(ageDays)} days old (max: ${maxAge}).${import_ui.reset}`);
+        console.log(`  ${import_ui.dim}Run${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph vulns --refresh${import_ui.reset} ${import_ui.dim}to update.${import_ui.reset}`);
+      }
+    }
+    try {
+      if (config.enablePatterns) {
+        const tableExists = rawDb.get("SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'");
+        if (tableExists) {
+          const pm = rawDb.get("SELECT COUNT(*) as cnt FROM pattern_matches");
+          if ((pm?.cnt ?? 0) > 0) {
+            const critPm = rawDb.get("SELECT COUNT(*) as cnt FROM pattern_matches WHERE severity='critical'");
+            console.log(`  ${import_ui.dim}SAST findings:${import_ui.reset}         ${import_ui.violet}${import_ui.bold}${pm.cnt}${import_ui.reset} ${import_ui.dim}pattern matches (${critPm?.cnt ?? 0} critical)${import_ui.reset}`);
+            console.log(`  ${import_ui.dim}Run${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph pattern --coverage${import_ui.reset} ${import_ui.dim}for details.${import_ui.reset}
+`);
+          }
+        }
+      }
+    } catch {
+    }
+    if (opts.failOn === "affected") {
+      const affectedCount = verdicts["affected"] ?? 0;
+      if (affectedCount > 0) {
+        console.log(`
+  \x1B[31m\u2716\x1B[0m --fail-on affected: ${affectedCount} affected vulnerabilit${affectedCount === 1 ? "y" : "ies"} found. Exiting with code 1.`);
+        cg.close();
+        process.exit(1);
+      }
+    }
+    cg.close();
+  });
+  return secCmd;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=security.js.map

package/dist/bin/commands/security.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/security.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green, section } from '../ui';\n\nexport function register(program: Command): Command {\n  const secCmd = program\n    .command('security')\n    .description('Security analysis: overview, dashboard export, and vulnerability management')\n    .argument('[projectPath]', 'Project root path (optional)')\n    .option('--refresh-staleness', 'Fetch latest version info from registries and show stale dependency count')\n    .option('--fail-on <condition>', 'Exit 1 if condition is met. Supported: affected')\n    .action(async (projectPath: string | undefined, opts: { refreshStaleness?: boolean; failOn?: string }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      if (!config.enableArchitecture) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Security requires Architecture analysis to be enabled.${reset}`);\n        console.error(`  ${dim}Enable both in .kirograph/config.json:${reset}`);\n        console.error(`    ${violet}${bold}\"enableArchitecture\": true${reset}`);\n        console.error(`    ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      if (opts.failOn !== undefined && opts.failOn !== 'affected') {\n        console.error(`  \u2716 Invalid --fail-on value: ${opts.failOn}. Supported: affected`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n      const rawDb = db.getRawDb();\n\n      // Optionally refresh staleness data from registries\n      if (opts.refreshStaleness) {\n        console.error(`  ${dim}Fetching latest version info from package registries...${reset}`);\n        const { StalenessChecker } = await Promise.resolve().then(() => require('../../security/staleness.js'));\n        const checker = new StalenessChecker(db);\n        const result = await checker.checkAll();\n        console.error(`  ${green}\u2713${reset} Checked ${bold}${result.checked}${reset} packages, ${bold}${result.stale}${reset} stale`);\n        if (result.errors.length > 0) {\n          console.error(`  ${'\\x1b[33m'}\u26A0${reset} ${result.errors.length} error(s) during registry fetch`);\n        }\n        console.error();\n      }\n\n      // Query dependency counts\n      const depCount: { count: number } = rawDb.get(\n        `SELECT COUNT(*) as count FROM sec_dependencies`,\n      ) ?? { count: 0 };\n\n      // Query vulnerability counts\n      const vulnCount: { count: number } = rawDb.get(\n        `SELECT COUNT(*) as count FROM sec_vulnerabilities`,\n      ) ?? { count: 0 };\n\n      // Query reachability verdict counts\n      const verdictRows: Array<{ verdict: string; count: number }> = rawDb.all(\n        `SELECT verdict, COUNT(*) as count FROM sec_reachability GROUP BY verdict`,\n      );\n      const verdicts: Record<string, number> = {};\n      for (const row of verdictRows) {\n        verdicts[row.verdict] = row.count;\n      }\n\n      // Check for stale data\n      const staleCount: { count: number } = rawDb.get(\n        `SELECT COUNT(*) as count FROM sec_dependencies WHERE vuln_data_stale = 1`,\n      ) ?? { count: 0 };\n\n      // Display overview\n      console.log(`\\n  ${section('Security Overview')}\\n`);\n      console.log(`  ${dim}Dependencies:${reset}          ${violet}${bold}${depCount.count}${reset}`);\n      console.log(`  ${dim}Vulnerabilities:${reset}       ${violet}${bold}${vulnCount.count}${reset}`);\n      console.log();\n\n      if (vulnCount.count > 0) {\n        // Show top-risk CVE when data is available\n        const topCVE: { cve_id: string; risk_score: number | null; package_name: string | null } | undefined =\n          rawDb.get(\n            `SELECT v.cve_id, v.risk_score, d.package_name\n             FROM sec_vulnerabilities v\n             LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n             LEFT JOIN sec_dependencies d ON d.node_id = e.source\n             LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n             WHERE r.verdict = 'affected' AND v.risk_score IS NOT NULL\n             ORDER BY v.risk_score DESC NULLS LAST\n             LIMIT 1`,\n          );\n        if (topCVE && topCVE.risk_score != null) {\n          const riskColor = topCVE.risk_score >= 7 ? '\\x1b[31m' : topCVE.risk_score >= 4 ? '\\x1b[33m' : dim;\n          const pkgLabel = topCVE.package_name ? ` in ${dim}${topCVE.package_name}${reset}` : '';\n          console.log(`  ${riskColor}Top risk:${reset}              ${violet}${bold}${topCVE.cve_id}${reset} ${riskColor}(Risk: ${topCVE.risk_score.toFixed(1)})${reset}${pkgLabel}`);\n          console.log();\n        }\n\n        console.log(`  ${section('Reachability Verdicts')}\\n`);\n        const affected = verdicts['affected'] ?? 0;\n        const notAffected = verdicts['not_affected'] ?? 0;\n        const underInvestigation = verdicts['under_investigation'] ?? 0;\n        const noAnalysis = vulnCount.count - affected - notAffected - underInvestigation;\n\n        if (affected > 0) {\n          console.log(`  ${'\\x1b[31m'}\u25CF${reset} Affected:              ${bold}${affected}${reset}`);\n        }\n        if (notAffected > 0) {\n          console.log(`  ${green}\u25CF${reset} Not affected:          ${bold}${notAffected}${reset}`);\n        }\n        if (underInvestigation > 0) {\n          console.log(`  ${'\\x1b[33m'}\u25CF${reset} Under investigation:   ${bold}${underInvestigation}${reset}`);\n        }\n        if (noAnalysis > 0) {\n          console.log(`  ${dim}\u25CF${reset} Pending analysis:      ${bold}${noAnalysis}${reset}`);\n        }\n        console.log();\n      }\n\n      if (staleCount.count > 0) {\n        console.log(`  ${'\\x1b[33m'}\u26A0${reset} ${bold}${staleCount.count}${reset} ${dim}dependenc${staleCount.count === 1 ? 'y has' : 'ies have'} stale vulnerability data.${reset}`);\n        console.log(`  ${dim}Run${reset} ${violet}${bold}kirograph vulns --refresh${reset} ${dim}to update.${reset}\\n`);\n      }\n\n      // Show stale dependency count (version staleness) if data exists\n      const stalenessDataCount: { count: number } = rawDb.get(\n        `SELECT COUNT(*) as count FROM sec_dependencies WHERE staleness_score IS NOT NULL`,\n      ) ?? { count: 0 };\n\n      if (stalenessDataCount.count > 0) {\n        const staleDepCount: { count: number } = rawDb.get(\n          `SELECT COUNT(*) as count FROM sec_dependencies WHERE staleness_score >= 0.3`,\n        ) ?? { count: 0 };\n        console.log(`  ${dim}Stale dependencies:${reset}    ${staleDepCount.count > 0 ? `${'\\x1b[33m'}${bold}${staleDepCount.count}${reset}` : `${green}${bold}0${reset}`} ${dim}of ${stalenessDataCount.count} scored${reset}`);\n        if (staleDepCount.count > 0) {\n          console.log(`  ${dim}Run${reset} ${violet}${bold}kirograph staleness${reset} ${dim}for details.${reset}`);\n        }\n        console.log();\n      } else if (!opts.refreshStaleness) {\n        console.log(`  ${dim}No staleness data.${reset} ${dim}Run${reset} ${violet}${bold}kirograph security --refresh-staleness${reset} ${dim}to score dependencies.${reset}\\n`);\n      }\n\n      // Check if vulnerability data is stale\n      const lastCheck = (rawDb.get(\n        `SELECT MIN(last_vuln_check) as oldest FROM sec_dependencies WHERE last_vuln_check IS NOT NULL`,\n      ) as { oldest: number | null } | undefined)?.oldest;\n      if (lastCheck != null) {\n        const ageMs = Date.now() - lastCheck;\n        const ageDays = ageMs / (1000 * 60 * 60 * 24);\n        const maxAge = config.securityEnrichMaxAgeDays ?? 7;\n        if (ageDays > maxAge) {\n          console.log(`\\n  ${'\\x1b[33m'}\u26A0 Vulnerability data is ${Math.floor(ageDays)} days old (max: ${maxAge}).${reset}`);\n          console.log(`  ${dim}Run${reset} ${violet}${bold}kirograph vulns --refresh${reset} ${dim}to update.${reset}`);\n        }\n      }\n\n      // Pattern SAST findings (if enablePatterns and data exists)\n      try {\n        if (config.enablePatterns) {\n          const tableExists = rawDb.get(\"SELECT name FROM sqlite_master WHERE type='table' AND name='pattern_matches'\");\n          if (tableExists) {\n            const pm = rawDb.get('SELECT COUNT(*) as cnt FROM pattern_matches') as { cnt: number } | undefined;\n            if ((pm?.cnt ?? 0) > 0) {\n              const critPm = rawDb.get(\"SELECT COUNT(*) as cnt FROM pattern_matches WHERE severity='critical'\") as { cnt: number } | undefined;\n              console.log(`  ${dim}SAST findings:${reset}         ${violet}${bold}${pm!.cnt}${reset} ${dim}pattern matches (${critPm?.cnt ?? 0} critical)${reset}`);\n              console.log(`  ${dim}Run${reset} ${violet}${bold}kirograph pattern --coverage${reset} ${dim}for details.${reset}\\n`);\n            }\n          }\n        }\n      } catch { /* non-critical */ }\n\n      // --fail-on: exit 1 if condition is met (after all output)\n      if (opts.failOn === 'affected') {\n        const affectedCount = verdicts['affected'] ?? 0;\n        if (affectedCount > 0) {\n          console.log(`\\n  \\x1b[31m\u2716\\x1b[0m --fail-on affected: ${affectedCount} affected vulnerabilit${affectedCount === 1 ? 'y' : 'ies'} found. Exiting with code 1.`);\n          cg.close();\n          process.exit(1);\n        }\n      }\n\n      cg.close();\n    });\n\n  return secCmd;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAyD;AAElD,SAAS,SAAS,SAA2B;AAClD,QAAM,SAAS,QACZ,QAAQ,UAAU,EAClB,YAAY,6EAA6E,EACzF,SAAS,iBAAiB,8BAA8B,EACxD,OAAO,uBAAuB,2EAA2E,EACzG,OAAO,yBAAyB,iDAAiD,EACjF,OAAO,OAAO,aAAiC,SAA0D;AACxG,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,UAAU,wCAAmC,eAAK,EAAE;AACzE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,CAAC,OAAO,oBAAoB;AAC9B,cAAQ,MAAM;AAAA,IAAO,UAAU,gEAA2D,eAAK,EAAE;AACjG,cAAQ,MAAM,KAAK,aAAG,yCAAyC,eAAK,EAAE;AACtE,cAAQ,MAAM,OAAO,gBAAM,GAAG,cAAI,6BAA6B,eAAK,EAAE;AACtE,cAAQ,MAAM,OAAO,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AAClE,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,KAAK,WAAW,UAAa,KAAK,WAAW,YAAY;AAC3D,cAAQ,MAAM,qCAAgC,KAAK,MAAM,uBAAuB;AAChF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AACvB,UAAM,QAAQ,GAAG,SAAS;AAG1B,QAAI,KAAK,kBAAkB;AACzB,cAAQ,MAAM,KAAK,aAAG,0DAA0D,eAAK,EAAE;AACvF,YAAM,EAAE,iBAAiB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,6BAA6B,CAAC;AACtG,YAAM,UAAU,IAAI,iBAAiB,EAAE;AACvC,YAAM,SAAS,MAAM,QAAQ,SAAS;AACtC,cAAQ,MAAM,KAAK,eAAK,SAAI,eAAK,YAAY,cAAI,GAAG,OAAO,OAAO,GAAG,eAAK,cAAc,cAAI,GAAG,OAAO,KAAK,GAAG,eAAK,QAAQ;AAC3H,UAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,gBAAQ,MAAM,KAAK,UAAU,SAAI,eAAK,IAAI,OAAO,OAAO,MAAM,iCAAiC;AAAA,MACjG;AACA,cAAQ,MAAM;AAAA,IAChB;AAGA,UAAM,WAA8B,MAAM;AAAA,MACxC;AAAA,IACF,KAAK,EAAE,OAAO,EAAE;AAGhB,UAAM,YAA+B,MAAM;AAAA,MACzC;AAAA,IACF,KAAK,EAAE,OAAO,EAAE;AAGhB,UAAM,cAAyD,MAAM;AAAA,MACnE;AAAA,IACF;AACA,UAAM,WAAmC,CAAC;AAC1C,eAAW,OAAO,aAAa;AAC7B,eAAS,IAAI,OAAO,IAAI,IAAI;AAAA,IAC9B;AAGA,UAAM,aAAgC,MAAM;AAAA,MAC1C;AAAA,IACF,KAAK,EAAE,OAAO,EAAE;AAGhB,YAAQ,IAAI;AAAA,QAAO,mBAAQ,mBAAmB,CAAC;AAAA,CAAI;AACnD,YAAQ,IAAI,KAAK,aAAG,gBAAgB,eAAK,aAAa,gBAAM,GAAG,cAAI,GAAG,SAAS,KAAK,GAAG,eAAK,EAAE;AAC9F,YAAQ,IAAI,KAAK,aAAG,mBAAmB,eAAK,UAAU,gBAAM,GAAG,cAAI,GAAG,UAAU,KAAK,GAAG,eAAK,EAAE;AAC/F,YAAQ,IAAI;AAEZ,QAAI,UAAU,QAAQ,GAAG;AAEvB,YAAM,SACJ,MAAM;AAAA,QACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQF;AACF,UAAI,UAAU,OAAO,cAAc,MAAM;AACvC,cAAM,YAAY,OAAO,cAAc,IAAI,aAAa,OAAO,cAAc,IAAI,aAAa;AAC9F,cAAM,WAAW,OAAO,eAAe,OAAO,aAAG,GAAG,OAAO,YAAY,GAAG,eAAK,KAAK;AACpF,gBAAQ,IAAI,KAAK,SAAS,YAAY,eAAK,iBAAiB,gBAAM,GAAG,cAAI,GAAG,OAAO,MAAM,GAAG,eAAK,IAAI,SAAS,UAAU,OAAO,WAAW,QAAQ,CAAC,CAAC,IAAI,eAAK,GAAG,QAAQ,EAAE;AAC1K,gBAAQ,IAAI;AAAA,MACd;AAEA,cAAQ,IAAI,SAAK,mBAAQ,uBAAuB,CAAC;AAAA,CAAI;AACrD,YAAM,WAAW,SAAS,UAAU,KAAK;AACzC,YAAM,cAAc,SAAS,cAAc,KAAK;AAChD,YAAM,qBAAqB,SAAS,qBAAqB,KAAK;AAC9D,YAAM,aAAa,UAAU,QAAQ,WAAW,cAAc;AAE9D,UAAI,WAAW,GAAG;AAChB,gBAAQ,IAAI,KAAK,UAAU,SAAI,eAAK,2BAA2B,cAAI,GAAG,QAAQ,GAAG,eAAK,EAAE;AAAA,MAC1F;AACA,UAAI,cAAc,GAAG;AACnB,gBAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,2BAA2B,cAAI,GAAG,WAAW,GAAG,eAAK,EAAE;AAAA,MACxF;AACA,UAAI,qBAAqB,GAAG;AAC1B,gBAAQ,IAAI,KAAK,UAAU,SAAI,eAAK,2BAA2B,cAAI,GAAG,kBAAkB,GAAG,eAAK,EAAE;AAAA,MACpG;AACA,UAAI,aAAa,GAAG;AAClB,gBAAQ,IAAI,KAAK,aAAG,SAAI,eAAK,2BAA2B,cAAI,GAAG,UAAU,GAAG,eAAK,EAAE;AAAA,MACrF;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,QAAI,WAAW,QAAQ,GAAG;AACxB,cAAQ,IAAI,KAAK,UAAU,SAAI,eAAK,IAAI,cAAI,GAAG,WAAW,KAAK,GAAG,eAAK,IAAI,aAAG,YAAY,WAAW,UAAU,IAAI,UAAU,UAAU,6BAA6B,eAAK,EAAE;AAC3K,cAAQ,IAAI,KAAK,aAAG,MAAM,eAAK,IAAI,gBAAM,GAAG,cAAI,4BAA4B,eAAK,IAAI,aAAG,aAAa,eAAK;AAAA,CAAI;AAAA,IAChH;AAGA,UAAM,qBAAwC,MAAM;AAAA,MAClD;AAAA,IACF,KAAK,EAAE,OAAO,EAAE;AAEhB,QAAI,mBAAmB,QAAQ,GAAG;AAChC,YAAM,gBAAmC,MAAM;AAAA,QAC7C;AAAA,MACF,KAAK,EAAE,OAAO,EAAE;AAChB,cAAQ,IAAI,KAAK,aAAG,sBAAsB,eAAK,OAAO,cAAc,QAAQ,IAAI,GAAG,UAAU,GAAG,cAAI,GAAG,cAAc,KAAK,GAAG,eAAK,KAAK,GAAG,eAAK,GAAG,cAAI,IAAI,eAAK,EAAE,IAAI,aAAG,MAAM,mBAAmB,KAAK,UAAU,eAAK,EAAE;AACvN,UAAI,cAAc,QAAQ,GAAG;AAC3B,gBAAQ,IAAI,KAAK,aAAG,MAAM,eAAK,IAAI,gBAAM,GAAG,cAAI,sBAAsB,eAAK,IAAI,aAAG,eAAe,eAAK,EAAE;AAAA,MAC1G;AACA,cAAQ,IAAI;AAAA,IACd,WAAW,CAAC,KAAK,kBAAkB;AACjC,cAAQ,IAAI,KAAK,aAAG,qBAAqB,eAAK,IAAI,aAAG,MAAM,eAAK,IAAI,gBAAM,GAAG,cAAI,yCAAyC,eAAK,IAAI,aAAG,yBAAyB,eAAK;AAAA,CAAI;AAAA,IAC1K;AAGA,UAAM,YAAa,MAAM;AAAA,MACvB;AAAA,IACF,GAA6C;AAC7C,QAAI,aAAa,MAAM;AACrB,YAAM,QAAQ,KAAK,IAAI,IAAI;AAC3B,YAAM,UAAU,SAAS,MAAO,KAAK,KAAK;AAC1C,YAAM,SAAS,OAAO,4BAA4B;AAClD,UAAI,UAAU,QAAQ;AACpB,gBAAQ,IAAI;AAAA,IAAO,UAAU,gCAA2B,KAAK,MAAM,OAAO,CAAC,mBAAmB,MAAM,KAAK,eAAK,EAAE;AAChH,gBAAQ,IAAI,KAAK,aAAG,MAAM,eAAK,IAAI,gBAAM,GAAG,cAAI,4BAA4B,eAAK,IAAI,aAAG,aAAa,eAAK,EAAE;AAAA,MAC9G;AAAA,IACF;AAGA,QAAI;AACF,UAAI,OAAO,gBAAgB;AACzB,cAAM,cAAc,MAAM,IAAI,8EAA8E;AAC5G,YAAI,aAAa;AACf,gBAAM,KAAK,MAAM,IAAI,6CAA6C;AAClE,eAAK,IAAI,OAAO,KAAK,GAAG;AACtB,kBAAM,SAAS,MAAM,IAAI,uEAAuE;AAChG,oBAAQ,IAAI,KAAK,aAAG,iBAAiB,eAAK,YAAY,gBAAM,GAAG,cAAI,GAAG,GAAI,GAAG,GAAG,eAAK,IAAI,aAAG,oBAAoB,QAAQ,OAAO,CAAC,aAAa,eAAK,EAAE;AACpJ,oBAAQ,IAAI,KAAK,aAAG,MAAM,eAAK,IAAI,gBAAM,GAAG,cAAI,+BAA+B,eAAK,IAAI,aAAG,eAAe,eAAK;AAAA,CAAI;AAAA,UACrH;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAqB;AAG7B,QAAI,KAAK,WAAW,YAAY;AAC9B,YAAM,gBAAgB,SAAS,UAAU,KAAK;AAC9C,UAAI,gBAAgB,GAAG;AACrB,gBAAQ,IAAI;AAAA,8CAA4C,aAAa,yBAAyB,kBAAkB,IAAI,MAAM,KAAK,8BAA8B;AAC7J,WAAG,MAAM;AACT,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,OAAG,MAAM;AAAA,EACX,CAAC;AAEH,SAAO;AACT;",
+  "names": []
+}

package/dist/bin/commands/snapshot.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=snapshot.d.ts.map

package/dist/bin/commands/snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/snapshot.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsG/C"}

package/dist/bin/commands/staleness.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=staleness.d.ts.map

package/dist/bin/commands/staleness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staleness.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/staleness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyBpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6H/C"}

package/dist/bin/commands/staleness.js

@@ -0,0 +1,144 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var staleness_exports = {};
+__export(staleness_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(staleness_exports);
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+function stalenessBar(score) {
+  const filled = Math.round(score * 10);
+  return "\u2588".repeat(filled) + "\u2591".repeat(10 - filled);
+}
+function register(program) {
+  program.command("staleness [projectPath]").description("Check dependency freshness \u2014 identifies packages significantly behind their latest published version").option("--threshold <n>", "Show only packages with staleness_score >= n (default: 0.3)", "0.3").option("--format <fmt>", "Output format: table | json (default: table)", "table").option("--refresh", "Fetch latest version info from registries before listing").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(target);
+    if (!config.enableSecurity) {
+      console.error(`
+  ${"\x1B[33m"}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const rawDb = db.getRawDb();
+    const threshold = parseFloat(opts.threshold);
+    if (isNaN(threshold) || threshold < 0 || threshold > 1) {
+      console.error(`  \u2716 --threshold must be a number between 0 and 1`);
+      cg.close();
+      process.exit(1);
+    }
+    if (opts.refresh) {
+      console.error(`  ${import_ui.dim}Fetching latest version info from package registries...${import_ui.reset}`);
+      const { StalenessChecker } = await Promise.resolve().then(() => require("../../security/staleness.js"));
+      const checker = new StalenessChecker(db);
+      const result = await checker.checkAll();
+      console.error(`  ${import_ui.green}\u2713${import_ui.reset} Checked ${import_ui.bold}${result.checked}${import_ui.reset} packages, ${import_ui.bold}${result.stale}${import_ui.reset} stale`);
+      if (result.errors.length > 0) {
+        console.error(`  ${"\x1B[33m"}\u26A0${import_ui.reset} ${result.errors.length} error(s) during registry fetch`);
+      }
+      console.error();
+    }
+    const rows = rawDb.all(
+      `SELECT node_id, package_name, ecosystem, resolved_version, declared_constraint,
+                latest_version, latest_published, staleness_score
+         FROM sec_dependencies
+         WHERE staleness_score >= ?
+         ORDER BY staleness_score DESC`,
+      [threshold]
+    );
+    const totalDeps = rawDb.get(
+      `SELECT COUNT(*) as count FROM sec_dependencies`
+    ) ?? { count: 0 };
+    if (opts.format === "json") {
+      console.log(JSON.stringify(rows.map((r) => ({
+        packageName: r.package_name,
+        ecosystem: r.ecosystem,
+        resolvedVersion: r.resolved_version ?? r.declared_constraint,
+        latestVersion: r.latest_version,
+        latestPublished: r.latest_published,
+        stalenessScore: r.staleness_score
+      })), null, 2));
+      cg.close();
+      return;
+    }
+    if (rows.length === 0) {
+      console.log(`
+  ${import_ui.dim}No stale dependencies found (threshold: ${threshold}).${import_ui.reset}`);
+      if (!opts.refresh) {
+        console.log(`  ${import_ui.dim}Run with${import_ui.reset} ${import_ui.violet}${import_ui.bold}--refresh${import_ui.reset} ${import_ui.dim}to fetch latest version data from registries.${import_ui.reset}`);
+      }
+      console.log();
+      cg.close();
+      return;
+    }
+    console.log(`
+  ${import_ui.bold}Stale Dependencies${import_ui.reset}
+`);
+    for (const row of rows) {
+      const resolved = row.resolved_version ?? row.declared_constraint ?? "?";
+      const latest = row.latest_version ?? "?";
+      const score = row.staleness_score ?? 0;
+      const months = row.latest_published ? Math.round((Date.now() - row.latest_published) / (1e3 * 60 * 60 * 24 * 30)) : null;
+      const bar = stalenessBar(score);
+      const scoreStr = score.toFixed(2);
+      let barColor = import_ui.dim;
+      if (score >= 0.7) barColor = "\x1B[31m";
+      else if (score >= 0.4) barColor = "\x1B[33m";
+      const pkgLabel = `${import_ui.violet}${import_ui.bold}${row.package_name}${import_ui.reset} ${import_ui.dim}(${row.ecosystem})${import_ui.reset}`;
+      const versionLabel = `${resolved} \u2192 ${import_ui.green}${latest}${import_ui.reset}`;
+      const monthsLabel = months !== null ? `${months}mo since latest` : "publish date unknown";
+      console.log(`  ${pkgLabel}`);
+      console.log(`    ${versionLabel}  ${import_ui.dim}${monthsLabel}${import_ui.reset}`);
+      console.log(`    ${barColor}${bar}${import_ui.reset} ${import_ui.dim}${scoreStr}${import_ui.reset}`);
+      console.log();
+    }
+    const staleCount = rows.length;
+    const totalCount = totalDeps.count;
+    console.log(`  ${import_ui.bold}${staleCount}${import_ui.reset} of ${import_ui.bold}${totalCount}${import_ui.reset} ${import_ui.dim}dependenc${staleCount === 1 ? "y is" : "ies are"} stale (score >= ${threshold})${import_ui.reset}
+`);
+    cg.close();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=staleness.js.map

package/dist/bin/commands/staleness.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/staleness.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\n\n// \u2500\u2500 Staleness bar (10-char proportional) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction stalenessBar(score: number): string {\n  const filled = Math.round(score * 10);\n  return '\u2588'.repeat(filled) + '\u2591'.repeat(10 - filled);\n}\n\n// \u2500\u2500 JSON output type \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface StalenessRow {\n  node_id: string;\n  package_name: string;\n  ecosystem: string;\n  resolved_version: string | null;\n  declared_constraint: string;\n  latest_version: string | null;\n  latest_published: number | null;\n  staleness_score: number | null;\n}\n\nexport function register(program: Command): void {\n  program\n    .command('staleness [projectPath]')\n    .description('Check dependency freshness \u2014 identifies packages significantly behind their latest published version')\n    .option('--threshold <n>', 'Show only packages with staleness_score >= n (default: 0.3)', '0.3')\n    .option('--format <fmt>', 'Output format: table | json (default: table)', 'table')\n    .option('--refresh', 'Fetch latest version info from registries before listing')\n    .action(async (projectPath: string | undefined, opts: {\n      threshold: string;\n      format: string;\n      refresh?: boolean;\n    }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n      const rawDb = db.getRawDb();\n\n      const threshold = parseFloat(opts.threshold);\n      if (isNaN(threshold) || threshold < 0 || threshold > 1) {\n        console.error(`  \u2716 --threshold must be a number between 0 and 1`);\n        cg.close(); process.exit(1);\n      }\n\n      // Optionally refresh staleness data from registries\n      if (opts.refresh) {\n        console.error(`  ${dim}Fetching latest version info from package registries...${reset}`);\n        const { StalenessChecker } = await Promise.resolve().then(() => require('../../security/staleness.js'));\n        const checker = new StalenessChecker(db);\n        const result = await checker.checkAll();\n        console.error(`  ${green}\u2713${reset} Checked ${bold}${result.checked}${reset} packages, ${bold}${result.stale}${reset} stale`);\n        if (result.errors.length > 0) {\n          console.error(`  ${'\\x1b[33m'}\u26A0${reset} ${result.errors.length} error(s) during registry fetch`);\n        }\n        console.error();\n      }\n\n      // Query dependencies with staleness data\n      const rows: StalenessRow[] = rawDb.all(\n        `SELECT node_id, package_name, ecosystem, resolved_version, declared_constraint,\n                latest_version, latest_published, staleness_score\n         FROM sec_dependencies\n         WHERE staleness_score >= ?\n         ORDER BY staleness_score DESC`,\n        [threshold],\n      );\n\n      const totalDeps: { count: number } = rawDb.get(\n        `SELECT COUNT(*) as count FROM sec_dependencies`,\n      ) ?? { count: 0 };\n\n      if (opts.format === 'json') {\n        console.log(JSON.stringify(rows.map(r => ({\n          packageName: r.package_name,\n          ecosystem: r.ecosystem,\n          resolvedVersion: r.resolved_version ?? r.declared_constraint,\n          latestVersion: r.latest_version,\n          latestPublished: r.latest_published,\n          stalenessScore: r.staleness_score,\n        })), null, 2));\n        cg.close();\n        return;\n      }\n\n      // \u2500\u2500 Table output \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n      if (rows.length === 0) {\n        console.log(`\\n  ${dim}No stale dependencies found (threshold: ${threshold}).${reset}`);\n        if (!opts.refresh) {\n          console.log(`  ${dim}Run with${reset} ${violet}${bold}--refresh${reset} ${dim}to fetch latest version data from registries.${reset}`);\n        }\n        console.log();\n        cg.close();\n        return;\n      }\n\n      console.log(`\\n  ${bold}Stale Dependencies${reset}\\n`);\n\n      for (const row of rows) {\n        const resolved = row.resolved_version ?? row.declared_constraint ?? '?';\n        const latest = row.latest_version ?? '?';\n        const score = row.staleness_score ?? 0;\n        const months = row.latest_published\n          ? Math.round((Date.now() - row.latest_published) / (1000 * 60 * 60 * 24 * 30))\n          : null;\n\n        const bar = stalenessBar(score);\n        const scoreStr = score.toFixed(2);\n\n        // Colour the bar: red >= 0.7, yellow >= 0.4, dim otherwise\n        let barColor = dim;\n        if (score >= 0.7) barColor = '\\x1b[31m';\n        else if (score >= 0.4) barColor = '\\x1b[33m';\n\n        const pkgLabel = `${violet}${bold}${row.package_name}${reset} ${dim}(${row.ecosystem})${reset}`;\n        const versionLabel = `${resolved} \u2192 ${green}${latest}${reset}`;\n        const monthsLabel = months !== null ? `${months}mo since latest` : 'publish date unknown';\n\n        console.log(`  ${pkgLabel}`);\n        console.log(`    ${versionLabel}  ${dim}${monthsLabel}${reset}`);\n        console.log(`    ${barColor}${bar}${reset} ${dim}${scoreStr}${reset}`);\n        console.log();\n      }\n\n      const staleCount = rows.length;\n      const totalCount = totalDeps.count;\n      console.log(`  ${bold}${staleCount}${reset} of ${bold}${totalCount}${reset} ${dim}dependenc${staleCount === 1 ? 'y is' : 'ies are'} stale (score >= ${threshold})${reset}\\n`);\n\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAIhD,SAAS,aAAa,OAAuB;AAC3C,QAAM,SAAS,KAAK,MAAM,QAAQ,EAAE;AACpC,SAAO,SAAI,OAAO,MAAM,IAAI,SAAI,OAAO,KAAK,MAAM;AACpD;AAeO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,yBAAyB,EACjC,YAAY,2GAAsG,EAClH,OAAO,mBAAmB,+DAA+D,KAAK,EAC9F,OAAO,kBAAkB,gDAAgD,OAAO,EAChF,OAAO,aAAa,0DAA0D,EAC9E,OAAO,OAAO,aAAiC,SAI1C;AACJ,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,UAAU,wCAAmC,eAAK,EAAE;AACzE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AACvB,UAAM,QAAQ,GAAG,SAAS;AAE1B,UAAM,YAAY,WAAW,KAAK,SAAS;AAC3C,QAAI,MAAM,SAAS,KAAK,YAAY,KAAK,YAAY,GAAG;AACtD,cAAQ,MAAM,uDAAkD;AAChE,SAAG,MAAM;AAAG,cAAQ,KAAK,CAAC;AAAA,IAC5B;AAGA,QAAI,KAAK,SAAS;AAChB,cAAQ,MAAM,KAAK,aAAG,0DAA0D,eAAK,EAAE;AACvF,YAAM,EAAE,iBAAiB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,6BAA6B,CAAC;AACtG,YAAM,UAAU,IAAI,iBAAiB,EAAE;AACvC,YAAM,SAAS,MAAM,QAAQ,SAAS;AACtC,cAAQ,MAAM,KAAK,eAAK,SAAI,eAAK,YAAY,cAAI,GAAG,OAAO,OAAO,GAAG,eAAK,cAAc,cAAI,GAAG,OAAO,KAAK,GAAG,eAAK,QAAQ;AAC3H,UAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,gBAAQ,MAAM,KAAK,UAAU,SAAI,eAAK,IAAI,OAAO,OAAO,MAAM,iCAAiC;AAAA,MACjG;AACA,cAAQ,MAAM;AAAA,IAChB;AAGA,UAAM,OAAuB,MAAM;AAAA,MACjC;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,YAA+B,MAAM;AAAA,MACzC;AAAA,IACF,KAAK,EAAE,OAAO,EAAE;AAEhB,QAAI,KAAK,WAAW,QAAQ;AAC1B,cAAQ,IAAI,KAAK,UAAU,KAAK,IAAI,QAAM;AAAA,QACxC,aAAa,EAAE;AAAA,QACf,WAAW,EAAE;AAAA,QACb,iBAAiB,EAAE,oBAAoB,EAAE;AAAA,QACzC,eAAe,EAAE;AAAA,QACjB,iBAAiB,EAAE;AAAA,QACnB,gBAAgB,EAAE;AAAA,MACpB,EAAE,GAAG,MAAM,CAAC,CAAC;AACb,SAAG,MAAM;AACT;AAAA,IACF;AAIA,QAAI,KAAK,WAAW,GAAG;AACrB,cAAQ,IAAI;AAAA,IAAO,aAAG,2CAA2C,SAAS,KAAK,eAAK,EAAE;AACtF,UAAI,CAAC,KAAK,SAAS;AACjB,gBAAQ,IAAI,KAAK,aAAG,WAAW,eAAK,IAAI,gBAAM,GAAG,cAAI,YAAY,eAAK,IAAI,aAAG,gDAAgD,eAAK,EAAE;AAAA,MACtI;AACA,cAAQ,IAAI;AACZ,SAAG,MAAM;AACT;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,IAAO,cAAI,qBAAqB,eAAK;AAAA,CAAI;AAErD,eAAW,OAAO,MAAM;AACtB,YAAM,WAAW,IAAI,oBAAoB,IAAI,uBAAuB;AACpE,YAAM,SAAS,IAAI,kBAAkB;AACrC,YAAM,QAAQ,IAAI,mBAAmB;AACrC,YAAM,SAAS,IAAI,mBACf,KAAK,OAAO,KAAK,IAAI,IAAI,IAAI,qBAAqB,MAAO,KAAK,KAAK,KAAK,GAAG,IAC3E;AAEJ,YAAM,MAAM,aAAa,KAAK;AAC9B,YAAM,WAAW,MAAM,QAAQ,CAAC;AAGhC,UAAI,WAAW;AACf,UAAI,SAAS,IAAK,YAAW;AAAA,eACpB,SAAS,IAAK,YAAW;AAElC,YAAM,WAAW,GAAG,gBAAM,GAAG,cAAI,GAAG,IAAI,YAAY,GAAG,eAAK,IAAI,aAAG,IAAI,IAAI,SAAS,IAAI,eAAK;AAC7F,YAAM,eAAe,GAAG,QAAQ,WAAM,eAAK,GAAG,MAAM,GAAG,eAAK;AAC5D,YAAM,cAAc,WAAW,OAAO,GAAG,MAAM,oBAAoB;AAEnE,cAAQ,IAAI,KAAK,QAAQ,EAAE;AAC3B,cAAQ,IAAI,OAAO,YAAY,KAAK,aAAG,GAAG,WAAW,GAAG,eAAK,EAAE;AAC/D,cAAQ,IAAI,OAAO,QAAQ,GAAG,GAAG,GAAG,eAAK,IAAI,aAAG,GAAG,QAAQ,GAAG,eAAK,EAAE;AACrE,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,aAAa,KAAK;AACxB,UAAM,aAAa,UAAU;AAC7B,YAAQ,IAAI,KAAK,cAAI,GAAG,UAAU,GAAG,eAAK,OAAO,cAAI,GAAG,UAAU,GAAG,eAAK,IAAI,aAAG,YAAY,eAAe,IAAI,SAAS,SAAS,oBAAoB,SAAS,IAAI,eAAK;AAAA,CAAI;AAE5K,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA4D/C"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwJ/C"}