kirograph 0.17.0 → 0.20.0

package/dist/patterns/loader.d.ts

@@ -0,0 +1,18 @@
+/**
+ * KiroGraph PatternLibraryLoader — loads and merges YAML pattern rule files.
+ *
+ * js-yaml is not a declared dependency, so this uses a lightweight inline parser
+ * that handles the flat key:value + nested rule: block format used by KiroGraph
+ * pattern rule files.
+ */
+import { PatternRule } from './types';
+export declare class PatternLibraryLoader {
+    /**
+     * Load, validate, and merge rules from the builtin path and optional custom path.
+     * User-supplied rules override bundled rules on id collision.
+     */
+    load(builtinPath: string, customPath?: string): PatternRule[];
+    private _loadDirectory;
+    private _validate;
+}
+//# sourceMappingURL=loader.d.ts.map

package/dist/patterns/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/patterns/loader.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAyMtC,qBAAa,oBAAoB;IAC/B;;;OAGG;IACH,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE;IAmB7D,OAAO,CAAC,cAAc;IAsCtB,OAAO,CAAC,SAAS;CA2ClB"}

package/dist/patterns/loader.js

@@ -0,0 +1,277 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var loader_exports = {};
+__export(loader_exports, {
+  PatternLibraryLoader: () => PatternLibraryLoader
+});
+module.exports = __toCommonJS(loader_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../errors");
+function _parseYaml(text) {
+  const lines = text.split("\n");
+  return _parseBlock(lines, 0, 0).result;
+}
+function _parseBlock(lines, startIndex, baseIndent) {
+  const result = {};
+  let i = startIndex;
+  while (i < lines.length) {
+    const rawLine = lines[i];
+    const commentIdx = rawLine.indexOf(" #");
+    const line = commentIdx >= 0 ? rawLine.slice(0, commentIdx) : rawLine;
+    if (line.trim() === "" || line.trim().startsWith("#")) {
+      i++;
+      continue;
+    }
+    const indent = _countIndent(rawLine);
+    if (indent < baseIndent) break;
+    if (indent > baseIndent && Object.keys(result).length === 0) {
+      i++;
+      continue;
+    }
+    if (indent > baseIndent) {
+      break;
+    }
+    const trimmed = line.trim();
+    const colonIdx = trimmed.indexOf(":");
+    if (colonIdx <= 0) {
+      i++;
+      continue;
+    }
+    const key = trimmed.slice(0, colonIdx).trim();
+    const rest = trimmed.slice(colonIdx + 1).trimStart();
+    if (rest === "" || rest === "|" || rest === ">") {
+      const nextContentLine = _findNextContent(lines, i + 1);
+      if (nextContentLine === -1) {
+        result[key] = null;
+        i++;
+        continue;
+      }
+      const nextIndent = _countIndent(lines[nextContentLine]);
+      if (nextIndent > indent) {
+        if (lines[nextContentLine].trim().startsWith("- ")) {
+          const { items, nextIndex } = _parseSequence(lines, nextContentLine, nextIndent);
+          result[key] = items;
+          i = nextIndex;
+        } else {
+          const { result: subResult, nextIndex } = _parseBlock(lines, nextContentLine, nextIndent);
+          result[key] = subResult;
+          i = nextIndex;
+        }
+      } else {
+        result[key] = null;
+        i++;
+      }
+    } else if (rest.startsWith("[")) {
+      result[key] = _parseInlineArray(rest);
+      i++;
+    } else {
+      result[key] = _parseScalar(rest);
+      i++;
+    }
+  }
+  return { result, nextIndex: i };
+}
+function _parseSequence(lines, startIndex, baseIndent) {
+  const items = [];
+  let i = startIndex;
+  while (i < lines.length) {
+    const rawLine = lines[i];
+    if (rawLine.trim() === "" || rawLine.trim().startsWith("#")) {
+      i++;
+      continue;
+    }
+    const indent = _countIndent(rawLine);
+    if (indent < baseIndent) break;
+    const trimmed = rawLine.trim();
+    if (!trimmed.startsWith("- ") && trimmed !== "-") {
+      break;
+    }
+    const itemValue = trimmed.startsWith("- ") ? trimmed.slice(2).trim() : "";
+    if (itemValue === "" || itemValue === "|" || itemValue === ">") {
+      const nextContentLine = _findNextContent(lines, i + 1);
+      if (nextContentLine !== -1 && _countIndent(lines[nextContentLine]) > indent) {
+        const { result: subResult, nextIndex } = _parseBlock(lines, nextContentLine, _countIndent(lines[nextContentLine]));
+        items.push(subResult);
+        i = nextIndex;
+      } else {
+        items.push(null);
+        i++;
+      }
+    } else if (itemValue.includes(":")) {
+      const itemIndent = indent + 2;
+      const continuationLines = [];
+      let j = i + 1;
+      while (j < lines.length) {
+        const nextRaw = lines[j];
+        if (nextRaw.trim() === "" || nextRaw.trim().startsWith("#")) {
+          j++;
+          continue;
+        }
+        if (_countIndent(nextRaw) >= itemIndent) {
+          continuationLines.push(nextRaw);
+          j++;
+        } else {
+          break;
+        }
+      }
+      const blockLines = [" ".repeat(itemIndent) + itemValue, ...continuationLines];
+      const { result: subResult } = _parseBlock(blockLines, 0, itemIndent);
+      items.push(subResult);
+      i = j;
+    } else {
+      items.push(_parseScalar(itemValue));
+      i++;
+    }
+  }
+  return { items, nextIndex: i };
+}
+function _parseInlineArray(text) {
+  const inner = text.replace(/^\[/, "").replace(/\].*$/, "");
+  return inner.split(",").map((s) => _parseScalar(s.trim())).filter((s) => s !== null && s !== void 0);
+}
+function _parseScalar(text) {
+  if (text === "true") return true;
+  if (text === "false") return false;
+  if (text === "null" || text === "~") return null;
+  if (/^-?\d+$/.test(text)) return parseInt(text, 10);
+  if (/^-?\d+\.\d+$/.test(text)) return parseFloat(text);
+  if (text.startsWith('"') && text.endsWith('"') || text.startsWith("'") && text.endsWith("'")) {
+    return text.slice(1, -1);
+  }
+  return text;
+}
+function _countIndent(line) {
+  let i = 0;
+  while (i < line.length && line[i] === " ") i++;
+  return i;
+}
+function _findNextContent(lines, startIndex) {
+  for (let i = startIndex; i < lines.length; i++) {
+    const t = lines[i].trim();
+    if (t !== "" && !t.startsWith("#")) return i;
+  }
+  return -1;
+}
+class PatternLibraryLoader {
+  /**
+   * Load, validate, and merge rules from the builtin path and optional custom path.
+   * User-supplied rules override bundled rules on id collision.
+   */
+  load(builtinPath, customPath) {
+    const builtin = this._loadDirectory(builtinPath, "builtin");
+    const builtinMap = /* @__PURE__ */ new Map();
+    for (const rule of builtin) builtinMap.set(rule.id, rule);
+    if (!customPath) return builtin;
+    const custom = this._loadDirectory(customPath, "custom");
+    const merged = new Map(builtinMap);
+    for (const rule of custom) {
+      if (merged.has(rule.id)) {
+        (0, import_errors.logWarn)(`PatternLibraryLoader: custom rule "${rule.id}" overrides bundled rule`);
+      }
+      merged.set(rule.id, rule);
+    }
+    return [...merged.values()];
+  }
+  _loadDirectory(dirPath, source) {
+    if (!fs.existsSync(dirPath)) {
+      (0, import_errors.logWarn)(`PatternLibraryLoader: ${source} library path does not exist: ${dirPath}`);
+      return [];
+    }
+    const rules = [];
+    const seenIds = /* @__PURE__ */ new Map();
+    let files;
+    try {
+      files = fs.readdirSync(dirPath).filter((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
+    } catch (err) {
+      (0, import_errors.logWarn)(`PatternLibraryLoader: failed to read ${source} directory "${dirPath}": ${err instanceof Error ? err.message : String(err)}`);
+      return [];
+    }
+    for (const file of files) {
+      const filePath = path.join(dirPath, file);
+      try {
+        const text = fs.readFileSync(filePath, "utf8");
+        const parsed = _parseYaml(text);
+        const rule = this._validate(parsed, filePath);
+        if (!rule) continue;
+        if (seenIds.has(rule.id)) {
+          (0, import_errors.logWarn)(`PatternLibraryLoader: duplicate rule id "${rule.id}" in ${source} library \u2014 found in "${seenIds.get(rule.id)}" and "${filePath}", using last loaded`);
+        }
+        seenIds.set(rule.id, filePath);
+        rules.push(rule);
+      } catch (err) {
+        (0, import_errors.logWarn)(`PatternLibraryLoader: failed to load rule file "${filePath}": ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    return rules;
+  }
+  _validate(parsed, filePath) {
+    const required = ["id", "language", "severity", "owaspCategory", "description", "fixHint", "rule"];
+    for (const field of required) {
+      if (parsed[field] === void 0 || parsed[field] === null) {
+        (0, import_errors.logWarn)(`PatternLibraryLoader: rule file "${filePath}" is missing required field "${field}", skipping`);
+        return null;
+      }
+    }
+    const id = String(parsed["id"]);
+    const language = parsed["language"];
+    const severity = String(parsed["severity"]);
+    const owaspCategory = String(parsed["owaspCategory"]);
+    const description = String(parsed["description"]);
+    const fixHint = String(parsed["fixHint"]);
+    const rule = parsed["rule"];
+    const validSeverities = /* @__PURE__ */ new Set(["critical", "high", "medium", "low"]);
+    if (!validSeverities.has(severity)) {
+      (0, import_errors.logWarn)(`PatternLibraryLoader: rule file "${filePath}" has invalid severity "${severity}", skipping`);
+      return null;
+    }
+    if (typeof language !== "string" && !Array.isArray(language)) {
+      (0, import_errors.logWarn)(`PatternLibraryLoader: rule file "${filePath}" has invalid language field, skipping`);
+      return null;
+    }
+    if (typeof rule !== "object" || Array.isArray(rule) || rule === null) {
+      (0, import_errors.logWarn)(`PatternLibraryLoader: rule file "${filePath}" has invalid rule field (must be an object), skipping`);
+      return null;
+    }
+    return {
+      id,
+      language: Array.isArray(language) ? language : String(language),
+      severity,
+      owaspCategory,
+      description,
+      fixHint,
+      rule
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PatternLibraryLoader
+});
+//# sourceMappingURL=loader.js.map

package/dist/patterns/loader.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/patterns/loader.ts"],
+  "sourcesContent": ["/**\n * KiroGraph PatternLibraryLoader \u2014 loads and merges YAML pattern rule files.\n *\n * js-yaml is not a declared dependency, so this uses a lightweight inline parser\n * that handles the flat key:value + nested rule: block format used by KiroGraph\n * pattern rule files.\n */\n\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { PatternRule } from './types';\nimport { logWarn } from '../errors';\n\n// \u2500\u2500 Minimal YAML parser \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Supports the subset of YAML used by KiroGraph pattern files:\n//   - Flat key: value (string, boolean, number)\n//   - key: [item1, item2] (inline array)\n//   - key:\\n  - item (block sequence for simple values)\n//   - rule:\\n  (nested block as raw sub-object \u2014 parsed recursively)\n//   - Quoted strings: \"...\" and '...'\n//   - Comments: # ...\n\nfunction _parseYaml(text: string): Record<string, unknown> {\n  const lines = text.split('\\n');\n  return _parseBlock(lines, 0, 0).result;\n}\n\ninterface BlockResult {\n  result: Record<string, unknown>;\n  nextIndex: number;\n}\n\nfunction _parseBlock(lines: string[], startIndex: number, baseIndent: number): BlockResult {\n  const result: Record<string, unknown> = {};\n  let i = startIndex;\n\n  while (i < lines.length) {\n    const rawLine = lines[i];\n    // Strip trailing comments (but not inside strings \u2014 simplified approach)\n    const commentIdx = rawLine.indexOf(' #');\n    const line = commentIdx >= 0 ? rawLine.slice(0, commentIdx) : rawLine;\n\n    // Skip blank lines\n    if (line.trim() === '' || line.trim().startsWith('#')) {\n      i++;\n      continue;\n    }\n\n    const indent = _countIndent(rawLine);\n\n    // If we've de-indented past our base, stop\n    if (indent < baseIndent) break;\n\n    // Skip lines that are at an indent level below our block's base\n    if (indent > baseIndent && Object.keys(result).length === 0) {\n      // Haven't started the block yet \u2014 shouldn't happen but skip\n      i++;\n      continue;\n    }\n\n    if (indent > baseIndent) {\n      // This belongs to a child block already being processed \u2014 stop\n      break;\n    }\n\n    const trimmed = line.trim();\n\n    // Detect key: ... pattern\n    const colonIdx = trimmed.indexOf(':');\n    if (colonIdx <= 0) {\n      i++;\n      continue;\n    }\n\n    const key = trimmed.slice(0, colonIdx).trim();\n    const rest = trimmed.slice(colonIdx + 1).trimStart();\n\n    if (rest === '' || rest === '|' || rest === '>') {\n      // Value is on the following lines \u2014 could be a nested block or block scalar\n      // Peek ahead: if next non-empty line is indented more, recurse\n      const nextContentLine = _findNextContent(lines, i + 1);\n      if (nextContentLine === -1) {\n        result[key] = null;\n        i++;\n        continue;\n      }\n      const nextIndent = _countIndent(lines[nextContentLine]);\n      if (nextIndent > indent) {\n        // Check if next line is a sequence item (- ...)\n        if (lines[nextContentLine].trim().startsWith('- ')) {\n          const { items, nextIndex } = _parseSequence(lines, nextContentLine, nextIndent);\n          result[key] = items;\n          i = nextIndex;\n        } else {\n          const { result: subResult, nextIndex } = _parseBlock(lines, nextContentLine, nextIndent);\n          result[key] = subResult;\n          i = nextIndex;\n        }\n      } else {\n        result[key] = null;\n        i++;\n      }\n    } else if (rest.startsWith('[')) {\n      // Inline array: [a, b, c]\n      result[key] = _parseInlineArray(rest);\n      i++;\n    } else {\n      // Scalar value\n      result[key] = _parseScalar(rest);\n      i++;\n    }\n  }\n\n  return { result, nextIndex: i };\n}\n\nfunction _parseSequence(lines: string[], startIndex: number, baseIndent: number): { items: unknown[]; nextIndex: number } {\n  const items: unknown[] = [];\n  let i = startIndex;\n\n  while (i < lines.length) {\n    const rawLine = lines[i];\n    if (rawLine.trim() === '' || rawLine.trim().startsWith('#')) {\n      i++;\n      continue;\n    }\n    const indent = _countIndent(rawLine);\n    if (indent < baseIndent) break;\n\n    const trimmed = rawLine.trim();\n    if (!trimmed.startsWith('- ') && trimmed !== '-') {\n      break;\n    }\n\n    const itemValue = trimmed.startsWith('- ') ? trimmed.slice(2).trim() : '';\n\n    if (itemValue === '' || itemValue === '|' || itemValue === '>') {\n      // Multi-line sequence item\n      const nextContentLine = _findNextContent(lines, i + 1);\n      if (nextContentLine !== -1 && _countIndent(lines[nextContentLine]) > indent) {\n        const { result: subResult, nextIndex } = _parseBlock(lines, nextContentLine, _countIndent(lines[nextContentLine]));\n        items.push(subResult);\n        i = nextIndex;\n      } else {\n        items.push(null);\n        i++;\n      }\n    } else if (itemValue.includes(':')) {\n      // Inline key:value item \u2014 parse as sub-object, collecting any indented continuation lines\n      // Find continuation lines indented deeper than this item\n      const itemIndent = indent + 2;\n      const continuationLines: string[] = [];\n      let j = i + 1;\n      while (j < lines.length) {\n        const nextRaw = lines[j];\n        if (nextRaw.trim() === '' || nextRaw.trim().startsWith('#')) { j++; continue; }\n        if (_countIndent(nextRaw) >= itemIndent) {\n          continuationLines.push(nextRaw);\n          j++;\n        } else {\n          break;\n        }\n      }\n      const blockLines = [' '.repeat(itemIndent) + itemValue, ...continuationLines];\n      const { result: subResult } = _parseBlock(blockLines, 0, itemIndent);\n      items.push(subResult);\n      i = j;\n    } else {\n      items.push(_parseScalar(itemValue));\n      i++;\n    }\n  }\n\n  return { items, nextIndex: i };\n}\n\nfunction _parseInlineArray(text: string): string[] {\n  const inner = text.replace(/^\\[/, '').replace(/\\].*$/, '');\n  return inner.split(',').map(s => _parseScalar(s.trim()) as string).filter(s => s !== null && s !== undefined) as string[];\n}\n\nfunction _parseScalar(text: string): unknown {\n  if (text === 'true') return true;\n  if (text === 'false') return false;\n  if (text === 'null' || text === '~') return null;\n  if (/^-?\\d+$/.test(text)) return parseInt(text, 10);\n  if (/^-?\\d+\\.\\d+$/.test(text)) return parseFloat(text);\n  // Quoted string\n  if ((text.startsWith('\"') && text.endsWith('\"')) || (text.startsWith(\"'\") && text.endsWith(\"'\"))) {\n    return text.slice(1, -1);\n  }\n  return text;\n}\n\nfunction _countIndent(line: string): number {\n  let i = 0;\n  while (i < line.length && line[i] === ' ') i++;\n  return i;\n}\n\nfunction _findNextContent(lines: string[], startIndex: number): number {\n  for (let i = startIndex; i < lines.length; i++) {\n    const t = lines[i].trim();\n    if (t !== '' && !t.startsWith('#')) return i;\n  }\n  return -1;\n}\n\n// \u2500\u2500 PatternLibraryLoader \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class PatternLibraryLoader {\n  /**\n   * Load, validate, and merge rules from the builtin path and optional custom path.\n   * User-supplied rules override bundled rules on id collision.\n   */\n  load(builtinPath: string, customPath?: string): PatternRule[] {\n    const builtin = this._loadDirectory(builtinPath, 'builtin');\n    const builtinMap = new Map<string, PatternRule>();\n    for (const rule of builtin) builtinMap.set(rule.id, rule);\n\n    if (!customPath) return builtin;\n\n    const custom = this._loadDirectory(customPath, 'custom');\n    const merged = new Map<string, PatternRule>(builtinMap);\n    for (const rule of custom) {\n      if (merged.has(rule.id)) {\n        logWarn(`PatternLibraryLoader: custom rule \"${rule.id}\" overrides bundled rule`);\n      }\n      merged.set(rule.id, rule);\n    }\n\n    return [...merged.values()];\n  }\n\n  private _loadDirectory(dirPath: string, source: string): PatternRule[] {\n    if (!fs.existsSync(dirPath)) {\n      logWarn(`PatternLibraryLoader: ${source} library path does not exist: ${dirPath}`);\n      return [];\n    }\n\n    const rules: PatternRule[] = [];\n    const seenIds = new Map<string, string>();\n\n    let files: string[];\n    try {\n      files = fs.readdirSync(dirPath).filter(f => f.endsWith('.yaml') || f.endsWith('.yml'));\n    } catch (err) {\n      logWarn(`PatternLibraryLoader: failed to read ${source} directory \"${dirPath}\": ${err instanceof Error ? err.message : String(err)}`);\n      return [];\n    }\n\n    for (const file of files) {\n      const filePath = path.join(dirPath, file);\n      try {\n        const text = fs.readFileSync(filePath, 'utf8');\n        const parsed = _parseYaml(text);\n        const rule = this._validate(parsed, filePath);\n        if (!rule) continue;\n\n        if (seenIds.has(rule.id)) {\n          logWarn(`PatternLibraryLoader: duplicate rule id \"${rule.id}\" in ${source} library \u2014 found in \"${seenIds.get(rule.id)}\" and \"${filePath}\", using last loaded`);\n        }\n        seenIds.set(rule.id, filePath);\n        rules.push(rule);\n      } catch (err) {\n        logWarn(`PatternLibraryLoader: failed to load rule file \"${filePath}\": ${err instanceof Error ? err.message : String(err)}`);\n      }\n    }\n\n    return rules;\n  }\n\n  private _validate(parsed: Record<string, unknown>, filePath: string): PatternRule | null {\n    const required = ['id', 'language', 'severity', 'owaspCategory', 'description', 'fixHint', 'rule'];\n    for (const field of required) {\n      if (parsed[field] === undefined || parsed[field] === null) {\n        logWarn(`PatternLibraryLoader: rule file \"${filePath}\" is missing required field \"${field}\", skipping`);\n        return null;\n      }\n    }\n\n    const id = String(parsed['id']);\n    const language = parsed['language'];\n    const severity = String(parsed['severity']) as PatternRule['severity'];\n    const owaspCategory = String(parsed['owaspCategory']);\n    const description = String(parsed['description']);\n    const fixHint = String(parsed['fixHint']);\n    const rule = parsed['rule'];\n\n    const validSeverities = new Set(['critical', 'high', 'medium', 'low']);\n    if (!validSeverities.has(severity)) {\n      logWarn(`PatternLibraryLoader: rule file \"${filePath}\" has invalid severity \"${severity}\", skipping`);\n      return null;\n    }\n\n    if (typeof language !== 'string' && !Array.isArray(language)) {\n      logWarn(`PatternLibraryLoader: rule file \"${filePath}\" has invalid language field, skipping`);\n      return null;\n    }\n\n    if (typeof rule !== 'object' || Array.isArray(rule) || rule === null) {\n      logWarn(`PatternLibraryLoader: rule file \"${filePath}\" has invalid rule field (must be an object), skipping`);\n      return null;\n    }\n\n    return {\n      id,\n      language: Array.isArray(language) ? (language as string[]) : String(language),\n      severity,\n      owaspCategory,\n      description,\n      fixHint,\n      rule: rule as Record<string, unknown>,\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAYxB,SAAS,WAAW,MAAuC;AACzD,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,SAAO,YAAY,OAAO,GAAG,CAAC,EAAE;AAClC;AAOA,SAAS,YAAY,OAAiB,YAAoB,YAAiC;AACzF,QAAM,SAAkC,CAAC;AACzC,MAAI,IAAI;AAER,SAAO,IAAI,MAAM,QAAQ;AACvB,UAAM,UAAU,MAAM,CAAC;AAEvB,UAAM,aAAa,QAAQ,QAAQ,IAAI;AACvC,UAAM,OAAO,cAAc,IAAI,QAAQ,MAAM,GAAG,UAAU,IAAI;AAG9D,QAAI,KAAK,KAAK,MAAM,MAAM,KAAK,KAAK,EAAE,WAAW,GAAG,GAAG;AACrD;AACA;AAAA,IACF;AAEA,UAAM,SAAS,aAAa,OAAO;AAGnC,QAAI,SAAS,WAAY;AAGzB,QAAI,SAAS,cAAc,OAAO,KAAK,MAAM,EAAE,WAAW,GAAG;AAE3D;AACA;AAAA,IACF;AAEA,QAAI,SAAS,YAAY;AAEvB;AAAA,IACF;AAEA,UAAM,UAAU,KAAK,KAAK;AAG1B,UAAM,WAAW,QAAQ,QAAQ,GAAG;AACpC,QAAI,YAAY,GAAG;AACjB;AACA;AAAA,IACF;AAEA,UAAM,MAAM,QAAQ,MAAM,GAAG,QAAQ,EAAE,KAAK;AAC5C,UAAM,OAAO,QAAQ,MAAM,WAAW,CAAC,EAAE,UAAU;AAEnD,QAAI,SAAS,MAAM,SAAS,OAAO,SAAS,KAAK;AAG/C,YAAM,kBAAkB,iBAAiB,OAAO,IAAI,CAAC;AACrD,UAAI,oBAAoB,IAAI;AAC1B,eAAO,GAAG,IAAI;AACd;AACA;AAAA,MACF;AACA,YAAM,aAAa,aAAa,MAAM,eAAe,CAAC;AACtD,UAAI,aAAa,QAAQ;AAEvB,YAAI,MAAM,eAAe,EAAE,KAAK,EAAE,WAAW,IAAI,GAAG;AAClD,gBAAM,EAAE,OAAO,UAAU,IAAI,eAAe,OAAO,iBAAiB,UAAU;AAC9E,iBAAO,GAAG,IAAI;AACd,cAAI;AAAA,QACN,OAAO;AACL,gBAAM,EAAE,QAAQ,WAAW,UAAU,IAAI,YAAY,OAAO,iBAAiB,UAAU;AACvF,iBAAO,GAAG,IAAI;AACd,cAAI;AAAA,QACN;AAAA,MACF,OAAO;AACL,eAAO,GAAG,IAAI;AACd;AAAA,MACF;AAAA,IACF,WAAW,KAAK,WAAW,GAAG,GAAG;AAE/B,aAAO,GAAG,IAAI,kBAAkB,IAAI;AACpC;AAAA,IACF,OAAO;AAEL,aAAO,GAAG,IAAI,aAAa,IAAI;AAC/B;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,WAAW,EAAE;AAChC;AAEA,SAAS,eAAe,OAAiB,YAAoB,YAA6D;AACxH,QAAM,QAAmB,CAAC;AAC1B,MAAI,IAAI;AAER,SAAO,IAAI,MAAM,QAAQ;AACvB,UAAM,UAAU,MAAM,CAAC;AACvB,QAAI,QAAQ,KAAK,MAAM,MAAM,QAAQ,KAAK,EAAE,WAAW,GAAG,GAAG;AAC3D;AACA;AAAA,IACF;AACA,UAAM,SAAS,aAAa,OAAO;AACnC,QAAI,SAAS,WAAY;AAEzB,UAAM,UAAU,QAAQ,KAAK;AAC7B,QAAI,CAAC,QAAQ,WAAW,IAAI,KAAK,YAAY,KAAK;AAChD;AAAA,IACF;AAEA,UAAM,YAAY,QAAQ,WAAW,IAAI,IAAI,QAAQ,MAAM,CAAC,EAAE,KAAK,IAAI;AAEvE,QAAI,cAAc,MAAM,cAAc,OAAO,cAAc,KAAK;AAE9D,YAAM,kBAAkB,iBAAiB,OAAO,IAAI,CAAC;AACrD,UAAI,oBAAoB,MAAM,aAAa,MAAM,eAAe,CAAC,IAAI,QAAQ;AAC3E,cAAM,EAAE,QAAQ,WAAW,UAAU,IAAI,YAAY,OAAO,iBAAiB,aAAa,MAAM,eAAe,CAAC,CAAC;AACjH,cAAM,KAAK,SAAS;AACpB,YAAI;AAAA,MACN,OAAO;AACL,cAAM,KAAK,IAAI;AACf;AAAA,MACF;AAAA,IACF,WAAW,UAAU,SAAS,GAAG,GAAG;AAGlC,YAAM,aAAa,SAAS;AAC5B,YAAM,oBAA8B,CAAC;AACrC,UAAI,IAAI,IAAI;AACZ,aAAO,IAAI,MAAM,QAAQ;AACvB,cAAM,UAAU,MAAM,CAAC;AACvB,YAAI,QAAQ,KAAK,MAAM,MAAM,QAAQ,KAAK,EAAE,WAAW,GAAG,GAAG;AAAE;AAAK;AAAA,QAAU;AAC9E,YAAI,aAAa,OAAO,KAAK,YAAY;AACvC,4BAAkB,KAAK,OAAO;AAC9B;AAAA,QACF,OAAO;AACL;AAAA,QACF;AAAA,MACF;AACA,YAAM,aAAa,CAAC,IAAI,OAAO,UAAU,IAAI,WAAW,GAAG,iBAAiB;AAC5E,YAAM,EAAE,QAAQ,UAAU,IAAI,YAAY,YAAY,GAAG,UAAU;AACnE,YAAM,KAAK,SAAS;AACpB,UAAI;AAAA,IACN,OAAO;AACL,YAAM,KAAK,aAAa,SAAS,CAAC;AAClC;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,WAAW,EAAE;AAC/B;AAEA,SAAS,kBAAkB,MAAwB;AACjD,QAAM,QAAQ,KAAK,QAAQ,OAAO,EAAE,EAAE,QAAQ,SAAS,EAAE;AACzD,SAAO,MAAM,MAAM,GAAG,EAAE,IAAI,OAAK,aAAa,EAAE,KAAK,CAAC,CAAW,EAAE,OAAO,OAAK,MAAM,QAAQ,MAAM,MAAS;AAC9G;AAEA,SAAS,aAAa,MAAuB;AAC3C,MAAI,SAAS,OAAQ,QAAO;AAC5B,MAAI,SAAS,QAAS,QAAO;AAC7B,MAAI,SAAS,UAAU,SAAS,IAAK,QAAO;AAC5C,MAAI,UAAU,KAAK,IAAI,EAAG,QAAO,SAAS,MAAM,EAAE;AAClD,MAAI,eAAe,KAAK,IAAI,EAAG,QAAO,WAAW,IAAI;AAErD,MAAK,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,KAAO,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,GAAI;AAChG,WAAO,KAAK,MAAM,GAAG,EAAE;AAAA,EACzB;AACA,SAAO;AACT;AAEA,SAAS,aAAa,MAAsB;AAC1C,MAAI,IAAI;AACR,SAAO,IAAI,KAAK,UAAU,KAAK,CAAC,MAAM,IAAK;AAC3C,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAiB,YAA4B;AACrE,WAAS,IAAI,YAAY,IAAI,MAAM,QAAQ,KAAK;AAC9C,UAAM,IAAI,MAAM,CAAC,EAAE,KAAK;AACxB,QAAI,MAAM,MAAM,CAAC,EAAE,WAAW,GAAG,EAAG,QAAO;AAAA,EAC7C;AACA,SAAO;AACT;AAIO,MAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKhC,KAAK,aAAqB,YAAoC;AAC5D,UAAM,UAAU,KAAK,eAAe,aAAa,SAAS;AAC1D,UAAM,aAAa,oBAAI,IAAyB;AAChD,eAAW,QAAQ,QAAS,YAAW,IAAI,KAAK,IAAI,IAAI;AAExD,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,SAAS,KAAK,eAAe,YAAY,QAAQ;AACvD,UAAM,SAAS,IAAI,IAAyB,UAAU;AACtD,eAAW,QAAQ,QAAQ;AACzB,UAAI,OAAO,IAAI,KAAK,EAAE,GAAG;AACvB,mCAAQ,sCAAsC,KAAK,EAAE,0BAA0B;AAAA,MACjF;AACA,aAAO,IAAI,KAAK,IAAI,IAAI;AAAA,IAC1B;AAEA,WAAO,CAAC,GAAG,OAAO,OAAO,CAAC;AAAA,EAC5B;AAAA,EAEQ,eAAe,SAAiB,QAA+B;AACrE,QAAI,CAAC,GAAG,WAAW,OAAO,GAAG;AAC3B,iCAAQ,yBAAyB,MAAM,iCAAiC,OAAO,EAAE;AACjF,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,QAAuB,CAAC;AAC9B,UAAM,UAAU,oBAAI,IAAoB;AAExC,QAAI;AACJ,QAAI;AACF,cAAQ,GAAG,YAAY,OAAO,EAAE,OAAO,OAAK,EAAE,SAAS,OAAO,KAAK,EAAE,SAAS,MAAM,CAAC;AAAA,IACvF,SAAS,KAAK;AACZ,iCAAQ,wCAAwC,MAAM,eAAe,OAAO,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AACpI,aAAO,CAAC;AAAA,IACV;AAEA,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,KAAK,KAAK,SAAS,IAAI;AACxC,UAAI;AACF,cAAM,OAAO,GAAG,aAAa,UAAU,MAAM;AAC7C,cAAM,SAAS,WAAW,IAAI;AAC9B,cAAM,OAAO,KAAK,UAAU,QAAQ,QAAQ;AAC5C,YAAI,CAAC,KAAM;AAEX,YAAI,QAAQ,IAAI,KAAK,EAAE,GAAG;AACxB,qCAAQ,4CAA4C,KAAK,EAAE,QAAQ,MAAM,6BAAwB,QAAQ,IAAI,KAAK,EAAE,CAAC,UAAU,QAAQ,sBAAsB;AAAA,QAC/J;AACA,gBAAQ,IAAI,KAAK,IAAI,QAAQ;AAC7B,cAAM,KAAK,IAAI;AAAA,MACjB,SAAS,KAAK;AACZ,mCAAQ,mDAAmD,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,MAC7H;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,QAAiC,UAAsC;AACvF,UAAM,WAAW,CAAC,MAAM,YAAY,YAAY,iBAAiB,eAAe,WAAW,MAAM;AACjG,eAAW,SAAS,UAAU;AAC5B,UAAI,OAAO,KAAK,MAAM,UAAa,OAAO,KAAK,MAAM,MAAM;AACzD,mCAAQ,oCAAoC,QAAQ,gCAAgC,KAAK,aAAa;AACtG,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,OAAO,IAAI,CAAC;AAC9B,UAAM,WAAW,OAAO,UAAU;AAClC,UAAM,WAAW,OAAO,OAAO,UAAU,CAAC;AAC1C,UAAM,gBAAgB,OAAO,OAAO,eAAe,CAAC;AACpD,UAAM,cAAc,OAAO,OAAO,aAAa,CAAC;AAChD,UAAM,UAAU,OAAO,OAAO,SAAS,CAAC;AACxC,UAAM,OAAO,OAAO,MAAM;AAE1B,UAAM,kBAAkB,oBAAI,IAAI,CAAC,YAAY,QAAQ,UAAU,KAAK,CAAC;AACrE,QAAI,CAAC,gBAAgB,IAAI,QAAQ,GAAG;AAClC,iCAAQ,oCAAoC,QAAQ,2BAA2B,QAAQ,aAAa;AACpG,aAAO;AAAA,IACT;AAEA,QAAI,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,QAAQ,GAAG;AAC5D,iCAAQ,oCAAoC,QAAQ,wCAAwC;AAC5F,aAAO;AAAA,IACT;AAEA,QAAI,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,KAAK,SAAS,MAAM;AACpE,iCAAQ,oCAAoC,QAAQ,wDAAwD;AAC5G,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,MACL;AAAA,MACA,UAAU,MAAM,QAAQ,QAAQ,IAAK,WAAwB,OAAO,QAAQ;AAAA,MAC5E;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/patterns/runner.d.ts

@@ -0,0 +1,42 @@
+/**
+ * KiroGraph PatternRunner — lazy-loads @ast-grep/napi and executes pattern rules.
+ */
+import { PatternRule, PatternMatch } from './types';
+export declare class PatternRunner {
+    /**
+     * Synchronously check whether @ast-grep/napi is available.
+     */
+    isAvailable(): boolean;
+    /**
+     * Returns true if the language is supported by @ast-grep/napi.
+     * Unsupported languages must be skipped — calling parse() on them throws a
+     * native C++ exception that bypasses JS try/catch and corrupts internal mutexes.
+     */
+    isSupportedLanguage(language: string): boolean;
+    /**
+     * Lazy async loader — returns the napi module or null if missing.
+     */
+    getNapi(): Promise<any | null>;
+    /**
+     * Run a single library rule against a file's content.
+     * Returns an empty array and logs a warning on per-file errors.
+     */
+    runRule(rule: PatternRule, fileContent: string, language: string): Promise<PatternMatch[]>;
+    /**
+     * Run an inline pattern expression (not from library) against file content.
+     * Returns an empty array and logs a warning on per-file errors.
+     */
+    runInline(pattern: string, language: string, fileContent: string): Promise<PatternMatch[]>;
+    /**
+     * Run all rules against a file's content, filtered by severity threshold.
+     */
+    runAllRules(rules: PatternRule[], fileContent: string, language: string, threshold: PatternRule['severity']): Promise<PatternMatch[]>;
+    /**
+     * Apply the rule's fix template to all matches in the file content.
+     * Returns the transformed source string, or null if no fix was applied.
+     * Uses a range-based text substitution approach since commitEdits may not
+     * be available in all versions of @ast-grep/napi.
+     */
+    applyFix(filePath: string, fileContent: string, language: string, rule: PatternRule): Promise<string | null>;
+}
+//# sourceMappingURL=runner.d.ts.map

package/dist/patterns/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/patterns/runner.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAkB,MAAM,SAAS,CAAC;AAkDpE,qBAAa,aAAa;IACxB;;OAEG;IACH,WAAW,IAAI,OAAO;IAStB;;;;OAIG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI9C;;OAEG;IAEG,OAAO,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IAIpC;;;OAGG;IACG,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAuChG;;;OAGG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAqChG;;OAEG;IACG,WAAW,CACf,KAAK,EAAE,WAAW,EAAE,EACpB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,WAAW,CAAC,UAAU,CAAC,GACjC,OAAO,CAAC,YAAY,EAAE,CAAC;IAkB1B;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAiEnH"}

package/dist/patterns/runner.js

@@ -0,0 +1,277 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var runner_exports = {};
+__export(runner_exports, {
+  PatternRunner: () => PatternRunner
+});
+module.exports = __toCommonJS(runner_exports);
+var import_types = require("./types");
+var import_errors = require("../errors");
+const NAPI_SUPPORTED_LANGUAGES = /* @__PURE__ */ new Set([
+  "javascript",
+  "typescript",
+  "tsx",
+  "jsx",
+  "python",
+  "go",
+  "rust",
+  "java",
+  "c",
+  "cpp",
+  "cs",
+  "swift",
+  "kotlin",
+  "html",
+  "css",
+  "json",
+  "yaml",
+  "bash",
+  "ruby",
+  "php",
+  "scala",
+  "haskell",
+  "lua",
+  "r",
+  "dart",
+  "elixir",
+  "erlang",
+  "ocaml"
+]);
+let _napi = void 0;
+let _napiWarnLogged = false;
+async function getNapi() {
+  if (_napi !== void 0) return _napi;
+  try {
+    require.resolve("@ast-grep/napi");
+    _napi = require("@ast-grep/napi");
+    return _napi;
+  } catch {
+    _napi = null;
+    if (!_napiWarnLogged) {
+      (0, import_errors.logWarn)("PatternRunner: @ast-grep/napi is not installed. Pattern matching is disabled. Run: npm install @ast-grep/napi");
+      _napiWarnLogged = true;
+    }
+    return null;
+  }
+}
+function renderFix(fixTemplate, node) {
+  if (!fixTemplate) return void 0;
+  return fixTemplate.replace(/\$([A-Z_]+)/g, (_, varName) => {
+    try {
+      return node.getMatch(varName)?.text() ?? `$${varName}`;
+    } catch {
+      return `$${varName}`;
+    }
+  });
+}
+class PatternRunner {
+  /**
+   * Synchronously check whether @ast-grep/napi is available.
+   */
+  isAvailable() {
+    try {
+      require.resolve("@ast-grep/napi");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Returns true if the language is supported by @ast-grep/napi.
+   * Unsupported languages must be skipped — calling parse() on them throws a
+   * native C++ exception that bypasses JS try/catch and corrupts internal mutexes.
+   */
+  isSupportedLanguage(language) {
+    return NAPI_SUPPORTED_LANGUAGES.has(language.toLowerCase());
+  }
+  /**
+   * Lazy async loader — returns the napi module or null if missing.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  async getNapi() {
+    return getNapi();
+  }
+  /**
+   * Run a single library rule against a file's content.
+   * Returns an empty array and logs a warning on per-file errors.
+   */
+  async runRule(rule, fileContent, language) {
+    if (!this.isSupportedLanguage(language)) return [];
+    const napi = await getNapi();
+    if (!napi) return [];
+    try {
+      const { parse } = napi;
+      const root = parse(language, fileContent);
+      const nodes = root.root().findAll({ rule: rule.rule });
+      const lines = fileContent.split("\n");
+      return nodes.map((node) => {
+        const range = node.range();
+        const line = range.start.line + 1;
+        const col = range.start.column;
+        const matchText = node.text().slice(0, 500);
+        const context = _buildContext(lines, range.start.line);
+        const fixSuggestion = rule.fix ? renderFix(rule.fix, node) : void 0;
+        return {
+          patternId: rule.id,
+          filePath: "",
+          line,
+          col,
+          matchText,
+          context,
+          severity: rule.severity,
+          owaspCategory: rule.owaspCategory,
+          language,
+          ...fixSuggestion !== void 0 ? { fixSuggestion } : {}
+        };
+      });
+    } catch (err) {
+      (0, import_errors.logWarn)(`PatternRunner: error running rule "${rule.id}" on file (language: ${language}): ${err instanceof Error ? err.message : String(err)}`);
+      return [];
+    }
+  }
+  /**
+   * Run an inline pattern expression (not from library) against file content.
+   * Returns an empty array and logs a warning on per-file errors.
+   */
+  async runInline(pattern, language, fileContent) {
+    if (!this.isSupportedLanguage(language)) return [];
+    const napi = await getNapi();
+    if (!napi) return [];
+    try {
+      const { parse } = napi;
+      const root = parse(language, fileContent);
+      const nodes = root.root().findAll(pattern);
+      const lines = fileContent.split("\n");
+      return nodes.map((node) => {
+        const range = node.range();
+        const line = range.start.line + 1;
+        const col = range.start.column;
+        const matchText = node.text().slice(0, 500);
+        const context = _buildContext(lines, range.start.line);
+        return {
+          patternId: "",
+          filePath: "",
+          line,
+          col,
+          matchText,
+          context,
+          severity: "low",
+          owaspCategory: "",
+          language
+        };
+      });
+    } catch (err) {
+      (0, import_errors.logWarn)(`PatternRunner: error running inline pattern on file (language: ${language}): ${err instanceof Error ? err.message : String(err)}`);
+      return [];
+    }
+  }
+  /**
+   * Run all rules against a file's content, filtered by severity threshold.
+   */
+  async runAllRules(rules, fileContent, language, threshold) {
+    const napi = await getNapi();
+    if (!napi) return [];
+    const thresholdOrder = import_types.SEVERITY_ORDER[threshold];
+    const applicableRules = rules.filter((r) => {
+      const langs = Array.isArray(r.language) ? r.language : [r.language];
+      return langs.includes(language) && import_types.SEVERITY_ORDER[r.severity] >= thresholdOrder;
+    });
+    const results = [];
+    for (const rule of applicableRules) {
+      const matches = await this.runRule(rule, fileContent, language);
+      results.push(...matches);
+    }
+    return results;
+  }
+  /**
+   * Apply the rule's fix template to all matches in the file content.
+   * Returns the transformed source string, or null if no fix was applied.
+   * Uses a range-based text substitution approach since commitEdits may not
+   * be available in all versions of @ast-grep/napi.
+   */
+  async applyFix(filePath, fileContent, language, rule) {
+    const napi = await this.getNapi();
+    if (!napi || !rule.fix) return null;
+    try {
+      const { parse } = napi;
+      const root = parse(language, fileContent);
+      const nodes = root.root().findAll({ rule: rule.rule });
+      if (nodes.length === 0) return null;
+      try {
+        for (const node of nodes) {
+          const fixText = renderFix(rule.fix, node);
+          if (fixText) node.replace(fixText);
+        }
+        const edited = root.root().commitEdits?.();
+        if (typeof edited === "string") return edited;
+      } catch {
+      }
+      const edits = [];
+      for (const node of nodes) {
+        const fixText = renderFix(rule.fix, node);
+        if (fixText === void 0) continue;
+        const range = node.range();
+        const lines = fileContent.split("\n");
+        let startOffset = 0;
+        for (let i = 0; i < range.start.line; i++) {
+          startOffset += (lines[i]?.length ?? 0) + 1;
+        }
+        startOffset += range.start.column;
+        let endOffset = 0;
+        for (let i = 0; i < range.end.line; i++) {
+          endOffset += (lines[i]?.length ?? 0) + 1;
+        }
+        endOffset += range.end.column;
+        edits.push({ start: startOffset, end: endOffset, replacement: fixText });
+      }
+      if (edits.length === 0) return null;
+      edits.sort((a, b) => b.start - a.start);
+      let result = fileContent;
+      for (const edit of edits) {
+        result = result.slice(0, edit.start) + edit.replacement + result.slice(edit.end);
+      }
+      return result !== fileContent ? result : null;
+    } catch (err) {
+      (0, import_errors.logWarn)(`PatternRunner.applyFix: error applying fix for rule "${rule.id}" on "${filePath}": ${err instanceof Error ? err.message : String(err)}`);
+      return null;
+    }
+  }
+}
+function _buildContext(lines, zeroBasedLine) {
+  const contextLines = [];
+  if (zeroBasedLine > 0) contextLines.push(lines[zeroBasedLine - 1] ?? "");
+  contextLines.push(lines[zeroBasedLine] ?? "");
+  if (zeroBasedLine + 1 < lines.length) contextLines.push(lines[zeroBasedLine + 1] ?? "");
+  return contextLines.join("\n");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PatternRunner
+});
+//# sourceMappingURL=runner.js.map