kirograph 0.17.0 → 0.20.0

package/dist/bin/commands/uninit.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/bin/commands/uninit.ts"],
-  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport * as fs from 'fs';\nimport * as readline from 'readline';\nimport { printBanner } from '../banner';\nimport { dim, reset, violet, bold, green } from '../ui';\nimport { askToggle } from '../installer/prompts';\n\nexport const UNINIT_FAREWELLS = [\n  \"Oh. So it's come to this.\",\n  \"We're sorry to see you go. (Are we? Yes. We are.)\",\n  \"Deleting months of carefully indexed knowledge. Bold move.\",\n  \"Fine. We'll just sit here in the dark.\",\n  \"You can always come back. We won't mention this.\",\n  \"The graph remembers everything. Except, soon, anything.\",\n  \"Somewhere a tree-sitter is crying.\",\n  \"Uninstalling... and pretending it doesn't hurt.\",\n  \"574 embeddings. Gone. Just like that.\",\n  \"See you on the other side of `kirograph install`.\",\n];\n\ntype UninitTarget = 'kiro' | 'claude' | 'codex' | 'all';\n\nconst UNINIT_TARGETS: UninitTarget[] = ['kiro', 'claude', 'codex', 'all'];\n\nasync function runUninit(projectPath: string | undefined, opts: { force?: boolean; target?: string }): Promise<void> {\n  const target = path.resolve(projectPath ?? process.cwd());\n  const integration = (opts.target ?? 'kiro').toLowerCase() as UninitTarget;\n  if (!UNINIT_TARGETS.includes(integration)) {\n    console.error(`Unknown uninit target: ${opts.target}. Choose from: kiro, claude, codex, all`);\n    process.exit(1);\n  }\n  const dir = path.join(target, '.kirograph');\n  if (!fs.existsSync(dir)) { console.log('Not initialized.'); return; }\n\n  let removeIntegration = true;\n  let removeGraph = opts.force === true;\n\n  if (!opts.force) {\n    printBanner();\n    const farewell = UNINIT_FAREWELLS[Math.floor(Math.random() * UNINIT_FAREWELLS.length)]!;\n    console.log(`  ${violet}${bold}${farewell}${reset}`);\n    console.log(`\\n  ${dim}This can remove ${integration} integration files and, separately, the shared .kirograph/ data.${reset}`);\n    console.log(`  ${dim}Your source code is untouched.${reset}`);\n\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n\n    removeIntegration = await askToggle(rl, `Remove ${integration} integration files?`, 'Removes hooks, steering, MCP config, and agent instructions for this target.', false);\n    removeGraph = await askToggle(rl, 'Remove shared .kirograph/ data too?', 'Deletes the graph database, snapshots, and all indexed data. Cannot be undone.', false);\n\n    rl.close();\n\n    if (!removeIntegration && !removeGraph) {\n      console.log(`\\n  ${dim}Cancelled. Nothing removed.${reset}\\n`);\n      return;\n    }\n    console.log();\n  }\n\n  if (removeGraph) {\n    fs.rmSync(dir, { recursive: true, force: true });\n    console.log(`  ${green}\u2713${reset} Removed .kirograph/`);\n  }\n\n  if (removeIntegration && (integration === 'kiro' || integration === 'all')) {\n    // Remove .kiro hooks created by kirograph\n    const kiroHooks = [\n      'kirograph-mark-dirty-on-save.kiro.hook',\n      'kirograph-mark-dirty-on-create.kiro.hook',\n      'kirograph-sync-on-delete.kiro.hook',\n      'kirograph-sync-if-dirty.kiro.hook',\n      'kirograph-compress-hint.kiro.hook',\n      'kirograph-mem-capture.kiro.hook',\n      // Legacy .json filenames\n      'kirograph-mark-dirty-on-save.json',\n      'kirograph-mark-dirty-on-create.json',\n      'kirograph-sync-on-delete.json',\n      'kirograph-sync-if-dirty.json',\n      'kirograph-sync-on-save.json',\n      'kirograph-sync-on-create.json',\n      'kirograph-compress-hint.json',\n      'kirograph-mem-capture.json',\n    ];\n    const hooksDir = path.join(target, '.kiro', 'hooks');\n    let removedHooks = 0;\n    for (const hook of kiroHooks) {\n      const p = path.join(hooksDir, hook);\n      if (fs.existsSync(p)) { fs.unlinkSync(p); removedHooks++; }\n    }\n    if (removedHooks > 0) console.log(`  ${green}\u2713${reset} Removed ${removedHooks} hook(s) from .kiro/hooks/`);\n\n    // Remove .kiro/steering/kirograph.md\n    const steeringPath = path.join(target, '.kiro', 'steering', 'kirograph.md');\n    if (fs.existsSync(steeringPath)) {\n      fs.unlinkSync(steeringPath);\n      console.log(`  ${green}\u2713${reset} Removed .kiro/steering/kirograph.md`);\n    }\n\n    // Remove .kiro/agents/kirograph.json\n    const agentPath = path.join(target, '.kiro', 'agents', 'kirograph.json');\n    if (fs.existsSync(agentPath)) {\n      fs.unlinkSync(agentPath);\n      console.log(`  ${green}\u2713${reset} Removed .kiro/agents/kirograph.json`);\n    }\n\n    // Remove kirograph server from .kiro/settings/mcp.json\n    const { removeMcpServersConfig } = await Promise.resolve().then(() => require('../installer/common.js'));\n    const mcpPath = path.join(target, '.kiro', 'settings', 'mcp.json');\n    if (removeMcpServersConfig(mcpPath)) {\n      console.log(`  ${green}\u2713${reset} Removed kirograph from .kiro/settings/mcp.json`);\n    }\n  }\n\n  if (removeIntegration && (integration === 'claude' || integration === 'all')) {\n    const { uninitClaude } = await Promise.resolve().then(() => require('../installer/targets/claude.js'));\n    uninitClaude(target);\n  }\n\n  if (removeIntegration && (integration === 'codex' || integration === 'all')) {\n    const { uninitCodex } = await Promise.resolve().then(() => require('../installer/targets/codex.js'));\n    uninitCodex(target);\n  }\n\n  console.log(`\\n  ${dim}Done. Run ${violet}kirograph install --target ${integration === 'all' ? 'kiro' : integration}${reset}${dim} to come back anytime.${reset}\\n`);\n}\n\nexport function register(program: Command): void {\n  program\n    .command('uninit [projectPath]')\n    .description('Remove KiroGraph from a project')\n    .option('--force', 'Skip confirmation')\n    .option('--target <target>', 'Integration target to clean up: kiro, claude, codex, or all', 'kiro')\n    .action(runUninit);\n\n  program\n    .command('uninstall [projectPath]')\n    .description('Alias for uninit. Remove KiroGraph from a project')\n    .option('--force', 'Skip confirmation')\n    .option('--target <target>', 'Integration target to clean up: kiro, claude, codex, or all', 'kiro')\n    .action(runUninit);\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,SAAoB;AACpB,eAA0B;AAC1B,oBAA4B;AAC5B,gBAAgD;AAChD,qBAA0B;AAEnB,MAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,MAAM,iBAAiC,CAAC,QAAQ,UAAU,SAAS,KAAK;AAExE,eAAe,UAAU,aAAiC,MAA2D;AACnH,QAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,QAAM,eAAe,KAAK,UAAU,QAAQ,YAAY;AACxD,MAAI,CAAC,eAAe,SAAS,WAAW,GAAG;AACzC,YAAQ,MAAM,0BAA0B,KAAK,MAAM,yCAAyC;AAC5F,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,MAAM,KAAK,KAAK,QAAQ,YAAY;AAC1C,MAAI,CAAC,GAAG,WAAW,GAAG,GAAG;AAAE,YAAQ,IAAI,kBAAkB;AAAG;AAAA,EAAQ;AAEpE,MAAI,oBAAoB;AACxB,MAAI,cAAc,KAAK,UAAU;AAEjC,MAAI,CAAC,KAAK,OAAO;AACf,mCAAY;AACZ,UAAM,WAAW,iBAAiB,KAAK,MAAM,KAAK,OAAO,IAAI,iBAAiB,MAAM,CAAC;AACrF,YAAQ,IAAI,KAAK,gBAAM,GAAG,cAAI,GAAG,QAAQ,GAAG,eAAK,EAAE;AACnD,YAAQ,IAAI;AAAA,IAAO,aAAG,mBAAmB,WAAW,mEAAmE,eAAK,EAAE;AAC9H,YAAQ,IAAI,KAAK,aAAG,iCAAiC,eAAK,EAAE;AAE5D,UAAM,KAAK,SAAS,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAEpF,wBAAoB,UAAM,0BAAU,IAAI,UAAU,WAAW,uBAAuB,gFAAgF,KAAK;AACzK,kBAAc,UAAM,0BAAU,IAAI,uCAAuC,kFAAkF,KAAK;AAEhK,OAAG,MAAM;AAET,QAAI,CAAC,qBAAqB,CAAC,aAAa;AACtC,cAAQ,IAAI;AAAA,IAAO,aAAG,8BAA8B,eAAK;AAAA,CAAI;AAC7D;AAAA,IACF;AACA,YAAQ,IAAI;AAAA,EACd;AAEA,MAAI,aAAa;AACf,OAAG,OAAO,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,sBAAsB;AAAA,EACvD;AAEA,MAAI,sBAAsB,gBAAgB,UAAU,gBAAgB,QAAQ;AAE1E,UAAM,YAAY;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA,MAEA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,WAAW,KAAK,KAAK,QAAQ,SAAS,OAAO;AACnD,QAAI,eAAe;AACnB,eAAW,QAAQ,WAAW;AAC5B,YAAM,IAAI,KAAK,KAAK,UAAU,IAAI;AAClC,UAAI,GAAG,WAAW,CAAC,GAAG;AAAE,WAAG,WAAW,CAAC;AAAG;AAAA,MAAgB;AAAA,IAC5D;AACA,QAAI,eAAe,EAAG,SAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,YAAY,YAAY,4BAA4B;AAGzG,UAAM,eAAe,KAAK,KAAK,QAAQ,SAAS,YAAY,cAAc;AAC1E,QAAI,GAAG,WAAW,YAAY,GAAG;AAC/B,SAAG,WAAW,YAAY;AAC1B,cAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,sCAAsC;AAAA,IACvE;AAGA,UAAM,YAAY,KAAK,KAAK,QAAQ,SAAS,UAAU,gBAAgB;AACvE,QAAI,GAAG,WAAW,SAAS,GAAG;AAC5B,SAAG,WAAW,SAAS;AACvB,cAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,sCAAsC;AAAA,IACvE;AAGA,UAAM,EAAE,uBAAuB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,wBAAwB,CAAC;AACvG,UAAM,UAAU,KAAK,KAAK,QAAQ,SAAS,YAAY,UAAU;AACjE,QAAI,uBAAuB,OAAO,GAAG;AACnC,cAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,iDAAiD;AAAA,IAClF;AAAA,EACF;AAEA,MAAI,sBAAsB,gBAAgB,YAAY,gBAAgB,QAAQ;AAC5E,UAAM,EAAE,aAAa,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gCAAgC,CAAC;AACrG,iBAAa,MAAM;AAAA,EACrB;AAEA,MAAI,sBAAsB,gBAAgB,WAAW,gBAAgB,QAAQ;AAC3E,UAAM,EAAE,YAAY,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,+BAA+B,CAAC;AACnG,gBAAY,MAAM;AAAA,EACpB;AAEA,UAAQ,IAAI;AAAA,IAAO,aAAG,aAAa,gBAAM,8BAA8B,gBAAgB,QAAQ,SAAS,WAAW,GAAG,eAAK,GAAG,aAAG,yBAAyB,eAAK;AAAA,CAAI;AACrK;AAEO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,sBAAsB,EAC9B,YAAY,iCAAiC,EAC7C,OAAO,WAAW,mBAAmB,EACrC,OAAO,qBAAqB,+DAA+D,MAAM,EACjG,OAAO,SAAS;AAEnB,UACG,QAAQ,yBAAyB,EACjC,YAAY,mDAAmD,EAC/D,OAAO,WAAW,mBAAmB,EACrC,OAAO,qBAAqB,+DAA+D,MAAM,EACjG,OAAO,SAAS;AACrB;",
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport * as fs from 'fs';\nimport * as readline from 'readline';\nimport { printBanner } from '../banner';\nimport { dim, reset, violet, bold, green } from '../ui';\nimport { askToggle } from '../installer/prompts';\nimport type { InstallTarget } from '../installer/common';\nimport { getTargetInstaller } from '../installer/targets';\n\nexport const UNINIT_FAREWELLS = [\n  \"Oh. So it's come to this.\",\n  \"We're sorry to see you go. (Are we? Yes. We are.)\",\n  \"Deleting months of carefully indexed knowledge. Bold move.\",\n  \"Fine. We'll just sit here in the dark.\",\n  \"You can always come back. We won't mention this.\",\n  \"The graph remembers everything. Except, soon, anything.\",\n  \"Somewhere a tree-sitter is crying.\",\n  \"Uninstalling... and pretending it doesn't hurt.\",\n  \"574 embeddings. Gone. Just like that.\",\n  \"See you on the other side of `kirograph install`.\",\n];\n\nconst ALL_TARGETS: InstallTarget[] = [\n  'kiro', 'claude', 'codex', 'cursor', 'antigravity', 'opencode',\n  'windsurf', 'cline', 'copilot', 'junie', 'gemini-cli',\n  'continue', 'roo', 'warp', 'aider', 'trae',\n  'augment', 'kilo', 'amp', 'devin', 'replit', 'goose', 'openhands', 'tabnine',\n  'mistral-vibe', 'ibm-bob', 'crush', 'droid-factory', 'forgecode', 'iflow', 'qwen', 'rovo', 'qoder',\n];\n\nfunction isValidTarget(t: string): t is InstallTarget | 'all' {\n  return t === 'all' || ALL_TARGETS.includes(t as InstallTarget);\n}\n\nfunction uninitKiro(projectRoot: string): void {\n  // Remove .kiro hooks created by kirograph\n  const kiroHooks = [\n    'kirograph-mark-dirty-on-save.kiro.hook',\n    'kirograph-mark-dirty-on-create.kiro.hook',\n    'kirograph-sync-on-delete.kiro.hook',\n    'kirograph-sync-if-dirty.kiro.hook',\n    'kirograph-compress-hint.kiro.hook',\n    'kirograph-mem-capture.kiro.hook',\n    // Legacy .json filenames\n    'kirograph-mark-dirty-on-save.json',\n    'kirograph-mark-dirty-on-create.json',\n    'kirograph-sync-on-delete.json',\n    'kirograph-sync-if-dirty.json',\n    'kirograph-sync-on-save.json',\n    'kirograph-sync-on-create.json',\n    'kirograph-compress-hint.json',\n    'kirograph-mem-capture.json',\n  ];\n  const hooksDir = path.join(projectRoot, '.kiro', 'hooks');\n  let removedHooks = 0;\n  for (const hook of kiroHooks) {\n    const p = path.join(hooksDir, hook);\n    if (fs.existsSync(p)) { fs.unlinkSync(p); removedHooks++; }\n  }\n  if (removedHooks > 0) console.log(`  ${green}\u2713${reset} Removed ${removedHooks} hook(s) from .kiro/hooks/`);\n\n  // Remove .kiro/steering/kirograph*.md (main + all workflow files)\n  const steeringDir = path.join(projectRoot, '.kiro', 'steering');\n  let removedSteering = 0;\n  if (fs.existsSync(steeringDir)) {\n    for (const entry of fs.readdirSync(steeringDir)) {\n      if (entry.startsWith('kirograph') && entry.endsWith('.md')) {\n        fs.unlinkSync(path.join(steeringDir, entry));\n        removedSteering++;\n      }\n    }\n  }\n  if (removedSteering > 0) {\n    console.log(`  ${green}\u2713${reset} Removed ${removedSteering} steering file(s) from .kiro/steering/`);\n  }\n\n  // Remove .kiro/agents/kirograph.json\n  const agentPath = path.join(projectRoot, '.kiro', 'agents', 'kirograph.json');\n  if (fs.existsSync(agentPath)) {\n    fs.unlinkSync(agentPath);\n    console.log(`  ${green}\u2713${reset} Removed .kiro/agents/kirograph.json`);\n  }\n\n  // Remove kirograph server from .kiro/settings/mcp.json\n  const { removeMcpServersConfig } = require('../installer/common');\n  const mcpPath = path.join(projectRoot, '.kiro', 'settings', 'mcp.json');\n  if (removeMcpServersConfig(mcpPath)) {\n    console.log(`  ${green}\u2713${reset} Removed kirograph from .kiro/settings/mcp.json`);\n  }\n}\n\nasync function runUninit(projectPath: string | undefined, opts: { force?: boolean; target?: string }): Promise<void> {\n  const projectRoot = path.resolve(projectPath ?? process.cwd());\n  const targetName = (opts.target ?? 'kiro').toLowerCase();\n\n  if (!isValidTarget(targetName)) {\n    console.error(`Unknown uninit target: ${opts.target}. Choose from: ${ALL_TARGETS.join(', ')}, all`);\n    process.exit(1);\n  }\n\n  const dir = path.join(projectRoot, '.kirograph');\n  if (!fs.existsSync(dir)) { console.log('Not initialized.'); return; }\n\n  let removeIntegration = true;\n  let removeGraph = opts.force === true;\n\n  if (!opts.force) {\n    printBanner();\n    const farewell = UNINIT_FAREWELLS[Math.floor(Math.random() * UNINIT_FAREWELLS.length)]!;\n    console.log(`  ${violet}${bold}${farewell}${reset}`);\n    console.log(`\\n  ${dim}This can remove ${targetName} integration files and, separately, the shared .kirograph/ data.${reset}`);\n    console.log(`  ${dim}Your source code is untouched.${reset}`);\n\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n\n    removeIntegration = await askToggle(rl, `Remove ${targetName} integration files?`, 'Removes hooks, MCP config, rules, and agent instructions for this target.', false);\n    removeGraph = await askToggle(rl, 'Remove shared .kirograph/ data too?', 'Deletes the graph database, snapshots, and all indexed data. Cannot be undone.', false);\n\n    rl.close();\n\n    if (!removeIntegration && !removeGraph) {\n      console.log(`\\n  ${dim}Cancelled. Nothing removed.${reset}\\n`);\n      return;\n    }\n    console.log();\n  }\n\n  if (removeGraph) {\n    fs.rmSync(dir, { recursive: true, force: true });\n    console.log(`  ${green}\u2713${reset} Removed .kirograph/`);\n  }\n\n  if (removeIntegration) {\n    const targets: InstallTarget[] = targetName === 'all' ? [...ALL_TARGETS] : [targetName as InstallTarget];\n\n    for (const t of targets) {\n      if (t === 'kiro') {\n        uninitKiro(projectRoot);\n      } else {\n        const installer = getTargetInstaller(t);\n        installer.uninit?.(projectRoot);\n      }\n    }\n  }\n\n  console.log(`\\n  ${dim}Done. Run ${violet}kirograph install --target ${targetName === 'all' ? 'kiro' : targetName}${reset}${dim} to come back anytime.${reset}\\n`);\n}\n\nexport function register(program: Command): void {\n  program\n    .command('uninit [projectPath]')\n    .description('Remove KiroGraph from a project')\n    .option('--force', 'Skip confirmation')\n    .option('--target <target>', `Integration target to clean up (or \"all\"): ${ALL_TARGETS.slice(0, 6).join(', ')}, ...`, 'kiro')\n    .action(runUninit);\n\n  program\n    .command('uninstall [projectPath]')\n    .description('Alias for uninit. Remove KiroGraph from a project')\n    .option('--force', 'Skip confirmation')\n    .option('--target <target>', `Integration target to clean up (or \"all\"): ${ALL_TARGETS.slice(0, 6).join(', ')}, ...`, 'kiro')\n    .action(runUninit);\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,SAAoB;AACpB,eAA0B;AAC1B,oBAA4B;AAC5B,gBAAgD;AAChD,qBAA0B;AAE1B,qBAAmC;AAE5B,MAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,cAA+B;AAAA,EACnC;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAS;AAAA,EAAU;AAAA,EAAe;AAAA,EACpD;AAAA,EAAY;AAAA,EAAS;AAAA,EAAW;AAAA,EAAS;AAAA,EACzC;AAAA,EAAY;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAS;AAAA,EACpC;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAS;AAAA,EAAU;AAAA,EAAS;AAAA,EAAa;AAAA,EACnE;AAAA,EAAgB;AAAA,EAAW;AAAA,EAAS;AAAA,EAAiB;AAAA,EAAa;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAC7F;AAEA,SAAS,cAAc,GAAuC;AAC5D,SAAO,MAAM,SAAS,YAAY,SAAS,CAAkB;AAC/D;AAEA,SAAS,WAAW,aAA2B;AAE7C,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,KAAK,KAAK,aAAa,SAAS,OAAO;AACxD,MAAI,eAAe;AACnB,aAAW,QAAQ,WAAW;AAC5B,UAAM,IAAI,KAAK,KAAK,UAAU,IAAI;AAClC,QAAI,GAAG,WAAW,CAAC,GAAG;AAAE,SAAG,WAAW,CAAC;AAAG;AAAA,IAAgB;AAAA,EAC5D;AACA,MAAI,eAAe,EAAG,SAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,YAAY,YAAY,4BAA4B;AAGzG,QAAM,cAAc,KAAK,KAAK,aAAa,SAAS,UAAU;AAC9D,MAAI,kBAAkB;AACtB,MAAI,GAAG,WAAW,WAAW,GAAG;AAC9B,eAAW,SAAS,GAAG,YAAY,WAAW,GAAG;AAC/C,UAAI,MAAM,WAAW,WAAW,KAAK,MAAM,SAAS,KAAK,GAAG;AAC1D,WAAG,WAAW,KAAK,KAAK,aAAa,KAAK,CAAC;AAC3C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,kBAAkB,GAAG;AACvB,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,YAAY,eAAe,wCAAwC;AAAA,EACpG;AAGA,QAAM,YAAY,KAAK,KAAK,aAAa,SAAS,UAAU,gBAAgB;AAC5E,MAAI,GAAG,WAAW,SAAS,GAAG;AAC5B,OAAG,WAAW,SAAS;AACvB,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,sCAAsC;AAAA,EACvE;AAGA,QAAM,EAAE,uBAAuB,IAAI,QAAQ,qBAAqB;AAChE,QAAM,UAAU,KAAK,KAAK,aAAa,SAAS,YAAY,UAAU;AACtE,MAAI,uBAAuB,OAAO,GAAG;AACnC,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,iDAAiD;AAAA,EAClF;AACF;AAEA,eAAe,UAAU,aAAiC,MAA2D;AACnH,QAAM,cAAc,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AAC7D,QAAM,cAAc,KAAK,UAAU,QAAQ,YAAY;AAEvD,MAAI,CAAC,cAAc,UAAU,GAAG;AAC9B,YAAQ,MAAM,0BAA0B,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAI,CAAC,OAAO;AAClG,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,MAAM,KAAK,KAAK,aAAa,YAAY;AAC/C,MAAI,CAAC,GAAG,WAAW,GAAG,GAAG;AAAE,YAAQ,IAAI,kBAAkB;AAAG;AAAA,EAAQ;AAEpE,MAAI,oBAAoB;AACxB,MAAI,cAAc,KAAK,UAAU;AAEjC,MAAI,CAAC,KAAK,OAAO;AACf,mCAAY;AACZ,UAAM,WAAW,iBAAiB,KAAK,MAAM,KAAK,OAAO,IAAI,iBAAiB,MAAM,CAAC;AACrF,YAAQ,IAAI,KAAK,gBAAM,GAAG,cAAI,GAAG,QAAQ,GAAG,eAAK,EAAE;AACnD,YAAQ,IAAI;AAAA,IAAO,aAAG,mBAAmB,UAAU,mEAAmE,eAAK,EAAE;AAC7H,YAAQ,IAAI,KAAK,aAAG,iCAAiC,eAAK,EAAE;AAE5D,UAAM,KAAK,SAAS,gBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAEpF,wBAAoB,UAAM,0BAAU,IAAI,UAAU,UAAU,uBAAuB,6EAA6E,KAAK;AACrK,kBAAc,UAAM,0BAAU,IAAI,uCAAuC,kFAAkF,KAAK;AAEhK,OAAG,MAAM;AAET,QAAI,CAAC,qBAAqB,CAAC,aAAa;AACtC,cAAQ,IAAI;AAAA,IAAO,aAAG,8BAA8B,eAAK;AAAA,CAAI;AAC7D;AAAA,IACF;AACA,YAAQ,IAAI;AAAA,EACd;AAEA,MAAI,aAAa;AACf,OAAG,OAAO,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAC/C,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,sBAAsB;AAAA,EACvD;AAEA,MAAI,mBAAmB;AACrB,UAAM,UAA2B,eAAe,QAAQ,CAAC,GAAG,WAAW,IAAI,CAAC,UAA2B;AAEvG,eAAW,KAAK,SAAS;AACvB,UAAI,MAAM,QAAQ;AAChB,mBAAW,WAAW;AAAA,MACxB,OAAO;AACL,cAAM,gBAAY,mCAAmB,CAAC;AACtC,kBAAU,SAAS,WAAW;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AAEA,UAAQ,IAAI;AAAA,IAAO,aAAG,aAAa,gBAAM,8BAA8B,eAAe,QAAQ,SAAS,UAAU,GAAG,eAAK,GAAG,aAAG,yBAAyB,eAAK;AAAA,CAAI;AACnK;AAEO,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,sBAAsB,EAC9B,YAAY,iCAAiC,EAC7C,OAAO,WAAW,mBAAmB,EACrC,OAAO,qBAAqB,8CAA8C,YAAY,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,MAAM,EAC3H,OAAO,SAAS;AAEnB,UACG,QAAQ,yBAAyB,EACjC,YAAY,mDAAmD,EAC/D,OAAO,WAAW,mBAAmB,EACrC,OAAO,qBAAqB,8CAA8C,YAAY,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,MAAM,EAC3H,OAAO,SAAS;AACrB;",
   "names": []
 }

package/dist/bin/commands/utils.d.ts

@@ -9,4 +9,9 @@ export declare function formatSyncCounts(result: {
     removed: unknown[];
     duration: number;
 }): string;
+/**
+ * Track token savings for a CLI graph tool invocation.
+ * Non-critical — silently ignores errors.
+ */
+export declare function trackCliToolSaving(projectRoot: string, toolName: string, output: string, args?: Record<string, unknown>): void;
 //# sourceMappingURL=utils.d.ts.map

package/dist/bin/commands/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/utils.ts"],"names":[],"mappings":"AAGA,wBAAsB,WAAW,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK5F;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE1D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhI"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/utils.ts"],"names":[],"mappings":"AAGA,wBAAsB,WAAW,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK5F;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE1D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhI;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAa9H"}

package/dist/bin/commands/vex.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=vex.d.ts.map

package/dist/bin/commands/vex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vex.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/vex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyC/C"}

package/dist/bin/commands/vex.js

@@ -0,0 +1,76 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var vex_exports = {};
+__export(vex_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(vex_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_config = require("../../config");
+var import_ui = require("../ui");
+function register(program) {
+  program.command("vex [projectPath]").description("Export CycloneDX 1.5 VEX (Vulnerability Exploitability eXchange)").option("--output <file>", "Write VEX to file instead of stdout").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const config = await (0, import_config.loadConfig)(target);
+    if (!config.enableSecurity) {
+      console.error(`
+  ${"\x1B[33m"}\u26A0 Security analysis is disabled.${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Enable it in .kirograph/config.json:${import_ui.reset} ${import_ui.violet}${import_ui.bold}"enableSecurity": true${import_ui.reset}`);
+      console.error(`  ${import_ui.dim}Then re-run:${import_ui.reset} ${import_ui.violet}${import_ui.bold}kirograph index${import_ui.reset}
+`);
+      process.exit(1);
+    }
+    const KiroGraph = (await Promise.resolve().then(() => require("../../index.js"))).default;
+    if (!KiroGraph.isInitialized(target)) {
+      console.error("  \u2716 KiroGraph not initialized. Run: kirograph init");
+      process.exit(1);
+    }
+    const cg = await KiroGraph.open(target);
+    const db = cg.getDatabase();
+    db.applySecuritySchema();
+    const { VEXExporter } = await Promise.resolve().then(() => require("../../security/export/vex.js"));
+    const exporter = new VEXExporter(db, target);
+    const json = exporter.exportJSON();
+    if (opts.output) {
+      const outPath = path.resolve(opts.output);
+      fs.mkdirSync(path.dirname(outPath), { recursive: true });
+      fs.writeFileSync(outPath, json, "utf-8");
+      console.error(`  ${import_ui.green}\u2713${import_ui.reset} VEX written to ${import_ui.violet}${import_ui.bold}${outPath}${import_ui.reset}`);
+    } else {
+      process.stdout.write(json + "\n");
+    }
+    cg.close();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=vex.js.map

package/dist/bin/commands/vex.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/vex.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, green } from '../ui';\n\nexport function register(program: Command): void {\n  program\n    .command('vex [projectPath]')\n    .description('Export CycloneDX 1.5 VEX (Vulnerability Exploitability eXchange)')\n    .option('--output <file>', 'Write VEX to file instead of stdout')\n    .action(async (projectPath: string | undefined, opts: { output?: string }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${'\\x1b[33m'}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n\n      const { VEXExporter } = await Promise.resolve().then(() => require('../../security/export/vex.js'));\n      const exporter = new VEXExporter(db, target);\n      const json = exporter.exportJSON();\n\n      if (opts.output) {\n        const outPath = path.resolve(opts.output);\n        fs.mkdirSync(path.dirname(outPath), { recursive: true });\n        fs.writeFileSync(outPath, json, 'utf-8');\n        console.error(`  ${green}\u2713${reset} VEX written to ${violet}${bold}${outPath}${reset}`);\n      } else {\n        process.stdout.write(json + '\\n');\n      }\n\n      cg.close();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,SAAoB;AACpB,WAAsB;AACtB,oBAA2B;AAC3B,gBAAgD;AAEzC,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,mBAAmB,EAC3B,YAAY,kEAAkE,EAC9E,OAAO,mBAAmB,qCAAqC,EAC/D,OAAO,OAAO,aAAiC,SAA8B;AAC5E,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,UAAU,wCAAmC,eAAK,EAAE;AACzE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AAEvB,UAAM,EAAE,YAAY,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,8BAA8B,CAAC;AAClG,UAAM,WAAW,IAAI,YAAY,IAAI,MAAM;AAC3C,UAAM,OAAO,SAAS,WAAW;AAEjC,QAAI,KAAK,QAAQ;AACf,YAAM,UAAU,KAAK,QAAQ,KAAK,MAAM;AACxC,SAAG,UAAU,KAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,SAAG,cAAc,SAAS,MAAM,OAAO;AACvC,cAAQ,MAAM,KAAK,eAAK,SAAI,eAAK,mBAAmB,gBAAM,GAAG,cAAI,GAAG,OAAO,GAAG,eAAK,EAAE;AAAA,IACvF,OAAO;AACL,cAAQ,OAAO,MAAM,OAAO,IAAI;AAAA,IAClC;AAEA,OAAG,MAAM;AAAA,EACX,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/vuln-suppress.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=vuln-suppress.d.ts.map

package/dist/bin/commands/vuln-suppress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vuln-suppress.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/vuln-suppress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoF/C"}

package/dist/bin/commands/vuln-suppress.js

@@ -0,0 +1,95 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var vuln_suppress_exports = {};
+__export(vuln_suppress_exports, {
+  register: () => register
+});
+module.exports = __toCommonJS(vuln_suppress_exports);
+var path = __toESM(require("path"));
+var import_ui = require("../ui");
+var import_suppressions = require("../../security/suppressions");
+function register(program) {
+  const vulnCmd = program.command("vuln").description("CVE suppression management");
+  vulnCmd.command("suppress <cveId> [projectPath]").description("Mark a CVE as suppressed (false positive or accepted risk)").option("--reason <text>", "Reason for suppression").option("--expires <date>", "Expiry date in ISO format (e.g. 2026-12-31)").action(async (cveId, projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const manager = new import_suppressions.SuppressionManager(target);
+    manager.add(cveId, opts.reason, opts.expires);
+    const reasonNote = opts.reason ? ` ${import_ui.dim}(${opts.reason})${import_ui.reset}` : "";
+    console.log(`  ${import_ui.green}\u2713${import_ui.reset} ${import_ui.violet}${import_ui.bold}${cveId}${import_ui.reset} suppressed${reasonNote}`);
+  });
+  vulnCmd.command("unsuppress <cveId> [projectPath]").description("Remove a CVE suppression").action(async (cveId, projectPath) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const manager = new import_suppressions.SuppressionManager(target);
+    const removed = manager.remove(cveId);
+    if (!removed) {
+      console.error(`  \u2716 No suppression found for ${import_ui.violet}${import_ui.bold}${cveId}${import_ui.reset}`);
+      process.exit(1);
+    }
+    console.log(`  ${import_ui.green}\u2713${import_ui.reset} ${import_ui.violet}${import_ui.bold}${cveId}${import_ui.reset} unsuppressed`);
+  });
+  vulnCmd.command("suppressions [projectPath]").description("List all active CVE suppressions").option("--format <fmt>", "Output format: table | json", "table").action(async (projectPath, opts) => {
+    const target = path.resolve(projectPath ?? process.cwd());
+    const manager = new import_suppressions.SuppressionManager(target);
+    const suppressions = manager.getActive();
+    if (opts.format === "json") {
+      console.log(JSON.stringify(suppressions, null, 2));
+      return;
+    }
+    if (suppressions.length === 0) {
+      console.log(`
+  ${import_ui.dim}No active suppressions.${import_ui.reset}
+`);
+      return;
+    }
+    const CVE_W = Math.max(6, ...suppressions.map((s) => s.cveId.length));
+    const DATE_W = 12;
+    const EXP_W = 12;
+    const header = `  ${import_ui.bold}${"CVE ID".padEnd(CVE_W)}${import_ui.reset}  ${import_ui.bold}${"Suppressed At".padEnd(DATE_W)}${import_ui.reset}  ${import_ui.bold}${"Expires".padEnd(EXP_W)}${import_ui.reset}  ${import_ui.bold}Reason${import_ui.reset}`;
+    const separator = `  ${"\u2500".repeat(CVE_W)}  ${"\u2500".repeat(DATE_W)}  ${"\u2500".repeat(EXP_W)}  ${"\u2500".repeat(20)}`;
+    console.log(`
+  ${import_ui.bold}Active Suppressions${import_ui.reset} (${suppressions.length})
+`);
+    console.log(header);
+    console.log(separator);
+    for (const s of suppressions) {
+      const suppressedDate = s.suppressedAt.slice(0, 10);
+      const expiresStr = s.expiresAt ? s.expiresAt.slice(0, 10) : import_ui.dim + "\u2014" + import_ui.reset;
+      const reasonStr = s.reason ? `${import_ui.dim}${s.reason}${import_ui.reset}` : `${import_ui.dim}\u2014${import_ui.reset}`;
+      console.log(
+        `  ${import_ui.violet}${s.cveId.padEnd(CVE_W)}${import_ui.reset}  ${suppressedDate.padEnd(DATE_W)}  ${expiresStr.padEnd(EXP_W + (s.expiresAt ? 0 : (import_ui.dim + import_ui.reset).length))}  ${reasonStr}`
+      );
+    }
+    console.log();
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  register
+});
+//# sourceMappingURL=vuln-suppress.js.map

package/dist/bin/commands/vuln-suppress.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bin/commands/vuln-suppress.ts"],
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { dim, reset, violet, bold, green } from '../ui';\nimport { SuppressionManager } from '../../security/suppressions';\n\nexport function register(program: Command): void {\n  const vulnCmd = program\n    .command('vuln')\n    .description('CVE suppression management');\n\n  vulnCmd\n    .command('suppress <cveId> [projectPath]')\n    .description('Mark a CVE as suppressed (false positive or accepted risk)')\n    .option('--reason <text>', 'Reason for suppression')\n    .option('--expires <date>', 'Expiry date in ISO format (e.g. 2026-12-31)')\n    .action(async (cveId: string, projectPath: string | undefined, opts: {\n      reason?: string;\n      expires?: string;\n    }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const manager = new SuppressionManager(target);\n      manager.add(cveId, opts.reason, opts.expires);\n      const reasonNote = opts.reason ? ` ${dim}(${opts.reason})${reset}` : '';\n      console.log(`  ${green}\u2713${reset} ${violet}${bold}${cveId}${reset} suppressed${reasonNote}`);\n    });\n\n  vulnCmd\n    .command('unsuppress <cveId> [projectPath]')\n    .description('Remove a CVE suppression')\n    .action(async (cveId: string, projectPath: string | undefined) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const manager = new SuppressionManager(target);\n      const removed = manager.remove(cveId);\n      if (!removed) {\n        console.error(`  \u2716 No suppression found for ${violet}${bold}${cveId}${reset}`);\n        process.exit(1);\n      }\n      console.log(`  ${green}\u2713${reset} ${violet}${bold}${cveId}${reset} unsuppressed`);\n    });\n\n  vulnCmd\n    .command('suppressions [projectPath]')\n    .description('List all active CVE suppressions')\n    .option('--format <fmt>', 'Output format: table | json', 'table')\n    .action(async (projectPath: string | undefined, opts: { format?: string }) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const manager = new SuppressionManager(target);\n      const suppressions = manager.getActive();\n\n      if (opts.format === 'json') {\n        console.log(JSON.stringify(suppressions, null, 2));\n        return;\n      }\n\n      if (suppressions.length === 0) {\n        console.log(`\\n  ${dim}No active suppressions.${reset}\\n`);\n        return;\n      }\n\n      const CVE_W = Math.max(6, ...suppressions.map(s => s.cveId.length));\n      const DATE_W = 12;\n      const EXP_W = 12;\n\n      const header =\n        `  ${bold}${'CVE ID'.padEnd(CVE_W)}${reset}  ` +\n        `${bold}${'Suppressed At'.padEnd(DATE_W)}${reset}  ` +\n        `${bold}${'Expires'.padEnd(EXP_W)}${reset}  ` +\n        `${bold}Reason${reset}`;\n\n      const separator = `  ${'\u2500'.repeat(CVE_W)}  ${'\u2500'.repeat(DATE_W)}  ${'\u2500'.repeat(EXP_W)}  ${'\u2500'.repeat(20)}`;\n\n      console.log(`\\n  ${bold}Active Suppressions${reset} (${suppressions.length})\\n`);\n      console.log(header);\n      console.log(separator);\n\n      for (const s of suppressions) {\n        const suppressedDate = s.suppressedAt.slice(0, 10);\n        const expiresStr = s.expiresAt ? s.expiresAt.slice(0, 10) : dim + '\u2014' + reset;\n        const reasonStr = s.reason ? `${dim}${s.reason}${reset}` : `${dim}\u2014${reset}`;\n        console.log(\n          `  ${violet}${s.cveId.padEnd(CVE_W)}${reset}  ` +\n          `${suppressedDate.padEnd(DATE_W)}  ` +\n          `${expiresStr.padEnd(EXP_W + (s.expiresAt ? 0 : (dim + reset).length))}  ` +\n          `${reasonStr}`,\n        );\n      }\n\n      console.log();\n    });\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,gBAAgD;AAChD,0BAAmC;AAE5B,SAAS,SAAS,SAAwB;AAC/C,QAAM,UAAU,QACb,QAAQ,MAAM,EACd,YAAY,4BAA4B;AAE3C,UACG,QAAQ,gCAAgC,EACxC,YAAY,4DAA4D,EACxE,OAAO,mBAAmB,wBAAwB,EAClD,OAAO,oBAAoB,6CAA6C,EACxE,OAAO,OAAO,OAAe,aAAiC,SAGzD;AACJ,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,UAAU,IAAI,uCAAmB,MAAM;AAC7C,YAAQ,IAAI,OAAO,KAAK,QAAQ,KAAK,OAAO;AAC5C,UAAM,aAAa,KAAK,SAAS,IAAI,aAAG,IAAI,KAAK,MAAM,IAAI,eAAK,KAAK;AACrE,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,IAAI,gBAAM,GAAG,cAAI,GAAG,KAAK,GAAG,eAAK,cAAc,UAAU,EAAE;AAAA,EAC5F,CAAC;AAEH,UACG,QAAQ,kCAAkC,EAC1C,YAAY,0BAA0B,EACtC,OAAO,OAAO,OAAe,gBAAoC;AAChE,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,UAAU,IAAI,uCAAmB,MAAM;AAC7C,UAAM,UAAU,QAAQ,OAAO,KAAK;AACpC,QAAI,CAAC,SAAS;AACZ,cAAQ,MAAM,qCAAgC,gBAAM,GAAG,cAAI,GAAG,KAAK,GAAG,eAAK,EAAE;AAC7E,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,IAAI,KAAK,eAAK,SAAI,eAAK,IAAI,gBAAM,GAAG,cAAI,GAAG,KAAK,GAAG,eAAK,eAAe;AAAA,EACjF,CAAC;AAEH,UACG,QAAQ,4BAA4B,EACpC,YAAY,kCAAkC,EAC9C,OAAO,kBAAkB,+BAA+B,OAAO,EAC/D,OAAO,OAAO,aAAiC,SAA8B;AAC5E,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,UAAU,IAAI,uCAAmB,MAAM;AAC7C,UAAM,eAAe,QAAQ,UAAU;AAEvC,QAAI,KAAK,WAAW,QAAQ;AAC1B,cAAQ,IAAI,KAAK,UAAU,cAAc,MAAM,CAAC,CAAC;AACjD;AAAA,IACF;AAEA,QAAI,aAAa,WAAW,GAAG;AAC7B,cAAQ,IAAI;AAAA,IAAO,aAAG,0BAA0B,eAAK;AAAA,CAAI;AACzD;AAAA,IACF;AAEA,UAAM,QAAQ,KAAK,IAAI,GAAG,GAAG,aAAa,IAAI,OAAK,EAAE,MAAM,MAAM,CAAC;AAClE,UAAM,SAAS;AACf,UAAM,QAAQ;AAEd,UAAM,SACJ,KAAK,cAAI,GAAG,SAAS,OAAO,KAAK,CAAC,GAAG,eAAK,KACvC,cAAI,GAAG,gBAAgB,OAAO,MAAM,CAAC,GAAG,eAAK,KAC7C,cAAI,GAAG,UAAU,OAAO,KAAK,CAAC,GAAG,eAAK,KACtC,cAAI,SAAS,eAAK;AAEvB,UAAM,YAAY,KAAK,SAAI,OAAO,KAAK,CAAC,KAAK,SAAI,OAAO,MAAM,CAAC,KAAK,SAAI,OAAO,KAAK,CAAC,KAAK,SAAI,OAAO,EAAE,CAAC;AAExG,YAAQ,IAAI;AAAA,IAAO,cAAI,sBAAsB,eAAK,KAAK,aAAa,MAAM;AAAA,CAAK;AAC/E,YAAQ,IAAI,MAAM;AAClB,YAAQ,IAAI,SAAS;AAErB,eAAW,KAAK,cAAc;AAC5B,YAAM,iBAAiB,EAAE,aAAa,MAAM,GAAG,EAAE;AACjD,YAAM,aAAa,EAAE,YAAY,EAAE,UAAU,MAAM,GAAG,EAAE,IAAI,gBAAM,WAAM;AACxE,YAAM,YAAY,EAAE,SAAS,GAAG,aAAG,GAAG,EAAE,MAAM,GAAG,eAAK,KAAK,GAAG,aAAG,SAAI,eAAK;AAC1E,cAAQ;AAAA,QACN,KAAK,gBAAM,GAAG,EAAE,MAAM,OAAO,KAAK,CAAC,GAAG,eAAK,KACxC,eAAe,OAAO,MAAM,CAAC,KAC7B,WAAW,OAAO,SAAS,EAAE,YAAY,KAAK,gBAAM,iBAAO,OAAO,CAAC,KACnE,SAAS;AAAA,MACd;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AACL;",
+  "names": []
+}

package/dist/bin/commands/vulns.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=vulns.d.ts.map

package/dist/bin/commands/vulns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vulns.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/vulns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8BpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+a/C"}