kirograph 0.17.0 → 0.20.0

package/dist/security/dep-confusion.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/dep-confusion.ts"],
+  "sourcesContent": ["/**\n * Dependency Confusion Checker\n *\n * Detects internal packages whose names exist in public registries\n * (a supply chain attack vector), and flags typosquatting candidates.\n */\n\nimport { logWarn } from '../errors';\nimport type { GraphDatabase } from '../db/database';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface DepConfusionFinding {\n  packageName: string;\n  ecosystem: string;\n  internalSource: string;    // e.g. \"private registry\" or \"local path\"\n  publicExists: boolean;\n  publicVersion: string | null;\n  publicPublishedAt: string | null;\n  riskLevel: 'critical' | 'high' | 'medium';\n  explanation: string;\n}\n\n// \u2500\u2500 Constants \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n// Well-known packages for typosquatting detection\nconst WELL_KNOWN_NPM: string[] = [\n  'lodash', 'express', 'react', 'axios', 'webpack', 'babel', 'moment',\n  'next', 'vue', 'angular',\n];\n\n// \u2500\u2500 Levenshtein distance (for typosquatting) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction levenshtein(a: string, b: string): number {\n  if (a === b) return 0;\n  if (a.length === 0) return b.length;\n  if (b.length === 0) return a.length;\n\n  const matrix: number[][] = [];\n  for (let i = 0; i <= b.length; i++) matrix[i] = [i];\n  for (let j = 0; j <= a.length; j++) matrix[0]![j] = j;\n\n  for (let i = 1; i <= b.length; i++) {\n    for (let j = 1; j <= a.length; j++) {\n      const cost = a[j - 1] === b[i - 1] ? 0 : 1;\n      matrix[i]![j] = Math.min(\n        matrix[i - 1]![j]! + 1,       // deletion\n        matrix[i]![j - 1]! + 1,        // insertion\n        matrix[i - 1]![j - 1]! + cost, // substitution\n      );\n    }\n  }\n  return matrix[b.length]![a.length]!;\n}\n\nfunction isTyposquatCandidate(name: string, wellKnown: string[]): string | null {\n  // Strip scoped prefix for comparison\n  const base = name.startsWith('@') ? name.split('/')[1] ?? name : name;\n  for (const known of wellKnown) {\n    const dist = levenshtein(base.toLowerCase(), known.toLowerCase());\n    if (dist > 0 && dist <= 2) return known;\n  }\n  return null;\n}\n\n// \u2500\u2500 Registry HEAD check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst TIMEOUT_MS = 10_000;\n\ninterface PublicInfo {\n  exists: boolean;\n  version: string | null;\n  publishedAt: string | null;\n}\n\nasync function checkNpmPublic(name: string): Promise<PublicInfo> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);\n  try {\n    const encoded = encodeURIComponent(name);\n    const resp = await fetch(`https://registry.npmjs.org/${encoded}/latest`, {\n      method: 'GET',\n      signal: controller.signal,\n      headers: { 'Accept': 'application/json' },\n    });\n    if (!resp.ok) return { exists: false, version: null, publishedAt: null };\n    const data = await resp.json() as Record<string, unknown>;\n    const version = (data['version'] as string) ?? null;\n    // Fetch time info\n    const full = await fetch(`https://registry.npmjs.org/${encoded}`, {\n      headers: { 'Accept': 'application/json' },\n    });\n    let publishedAt: string | null = null;\n    if (full.ok) {\n      const fullData = await full.json() as Record<string, unknown>;\n      const time = (fullData['time'] as Record<string, string>) ?? {};\n      publishedAt = time['created'] ?? null;\n    }\n    return { exists: true, version, publishedAt };\n  } catch {\n    return { exists: false, version: null, publishedAt: null };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nasync function checkPypiPublic(name: string): Promise<PublicInfo> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);\n  try {\n    const resp = await fetch(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`, {\n      signal: controller.signal,\n      headers: { 'Accept': 'application/json' },\n    });\n    if (!resp.ok) return { exists: false, version: null, publishedAt: null };\n    const data = await resp.json() as Record<string, unknown>;\n    const info = data['info'] as Record<string, unknown>;\n    const version = (info['version'] as string) ?? null;\n    return { exists: true, version, publishedAt: null };\n  } catch {\n    return { exists: false, version: null, publishedAt: null };\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\nasync function checkPublicRegistry(ecosystem: string, name: string): Promise<PublicInfo> {\n  const eco = ecosystem.toLowerCase();\n  switch (eco) {\n    case 'npm':  return checkNpmPublic(name);\n    case 'pypi':\n    case 'pip':  return checkPypiPublic(name);\n    default:\n      // For other ecosystems, we do not have a reliable public lookup\n      return { exists: false, version: null, publishedAt: null };\n  }\n}\n\n// \u2500\u2500 Internal package detection \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface InternalIndicator {\n  isInternal: boolean;\n  source: string;\n}\n\nfunction detectInternal(\n  packageName: string,\n  sourceManifests: string[],\n  declaredConstraint: string,\n): InternalIndicator {\n  // Local file references\n  if (declaredConstraint.startsWith('file:') || declaredConstraint.startsWith('./') || declaredConstraint.startsWith('../')) {\n    return { isInternal: true, source: 'local path' };\n  }\n  if (declaredConstraint.startsWith('git+') || declaredConstraint.startsWith('git://')) {\n    return { isInternal: true, source: 'git dependency' };\n  }\n\n  // Manifest path hints (e.g. a private registry URL)\n  for (const manifest of sourceManifests) {\n    if (manifest.includes('.kirograph/local') || manifest.includes('local/')) {\n      return { isInternal: true, source: 'local registry' };\n    }\n  }\n\n  // Scoped packages with company-like scope names (heuristic)\n  // e.g. @mycompany/foo \u2014 not @types, @babel, @jest, etc.\n  const wellKnownScopes = new Set([\n    '@types', '@babel', '@jest', '@testing-library', '@angular', '@vue',\n    '@react', '@emotion', '@mui', '@chakra-ui', '@tailwindcss', '@storybook',\n    '@vitejs', '@rollup', '@esbuild', '@swc', '@aws-sdk', '@google-cloud',\n  ]);\n\n  if (packageName.startsWith('@')) {\n    const scope = packageName.split('/')[0]!;\n    if (!wellKnownScopes.has(scope)) {\n      return { isInternal: true, source: `private scope ${scope}` };\n    }\n  }\n\n  return { isInternal: false, source: 'public registry' };\n}\n\n// \u2500\u2500 DepConfusionChecker \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class DepConfusionChecker {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async check(): Promise<DepConfusionFinding[]> {\n    const rawDb = this.db.getRawDb();\n    const rows: Array<{\n      node_id: string;\n      package_name: string;\n      ecosystem: string;\n      declared_constraint: string;\n      source_manifests: string;\n      scope: string;\n    }> = rawDb.all(\n      `SELECT node_id, package_name, ecosystem, declared_constraint, source_manifests, scope\n       FROM sec_dependencies\n       WHERE scope = 'production'`,\n    );\n\n    const findings: DepConfusionFinding[] = [];\n    const seen = new Set<string>();\n\n    for (const row of rows) {\n      const key = `${row.ecosystem}:${row.package_name}`;\n      if (seen.has(key)) continue;\n      seen.add(key);\n\n      let manifests: string[] = [];\n      try {\n        manifests = JSON.parse(row.source_manifests) as string[];\n      } catch {\n        // ignore malformed JSON\n      }\n\n      // \u2500\u2500 1. Internal package confusion \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n      const { isInternal, source } = detectInternal(\n        row.package_name,\n        manifests,\n        row.declared_constraint,\n      );\n\n      if (isInternal) {\n        let publicInfo: PublicInfo = { exists: false, version: null, publishedAt: null };\n        try {\n          // For scoped packages, also check the unscoped name\n          let nameToCheck = row.package_name;\n          if (nameToCheck.startsWith('@')) {\n            nameToCheck = nameToCheck.split('/')[1] ?? nameToCheck;\n          }\n          publicInfo = await checkPublicRegistry(row.ecosystem, nameToCheck);\n        } catch (err) {\n          const msg = err instanceof Error ? err.message : String(err);\n          logWarn(`[dep-confusion] Registry check failed for ${row.package_name}: ${msg}`);\n        }\n\n        if (publicInfo.exists) {\n          findings.push({\n            packageName: row.package_name,\n            ecosystem: row.ecosystem,\n            internalSource: source,\n            publicExists: true,\n            publicVersion: publicInfo.version,\n            publicPublishedAt: publicInfo.publishedAt,\n            riskLevel: 'critical',\n            explanation:\n              `Package \"${row.package_name}\" appears to be an internal dependency (${source}) ` +\n              `but a public package with the same name exists in the ${row.ecosystem} registry ` +\n              `(version ${publicInfo.version ?? 'unknown'}). This is a potential dependency confusion attack vector.`,\n          });\n          continue;\n        }\n\n        // Internal package without public counterpart \u2014 medium risk\n        findings.push({\n          packageName: row.package_name,\n          ecosystem: row.ecosystem,\n          internalSource: source,\n          publicExists: false,\n          publicVersion: null,\n          publicPublishedAt: null,\n          riskLevel: 'medium',\n          explanation:\n            `Package \"${row.package_name}\" appears to be an internal dependency (${source}). ` +\n            `No public package found with the same name, but this should be monitored.`,\n        });\n        continue;\n      }\n\n      // \u2500\u2500 2. Typosquatting detection (npm only for now) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n      if (row.ecosystem.toLowerCase() === 'npm') {\n        const similar = isTyposquatCandidate(row.package_name, WELL_KNOWN_NPM);\n        if (similar) {\n          findings.push({\n            packageName: row.package_name,\n            ecosystem: row.ecosystem,\n            internalSource: 'public registry',\n            publicExists: true,\n            publicVersion: null,\n            publicPublishedAt: null,\n            riskLevel: 'high',\n            explanation:\n              `Package \"${row.package_name}\" has a name very similar to the well-known package ` +\n              `\"${similar}\" (Levenshtein distance \u2264 2). This may be a typosquatting attempt.`,\n          });\n        }\n      }\n    }\n\n    return findings;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,oBAAwB;AAmBxB,MAAM,iBAA2B;AAAA,EAC/B;AAAA,EAAU;AAAA,EAAW;AAAA,EAAS;AAAA,EAAS;AAAA,EAAW;AAAA,EAAS;AAAA,EAC3D;AAAA,EAAQ;AAAA,EAAO;AACjB;AAIA,SAAS,YAAY,GAAW,GAAmB;AACjD,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,EAAE,WAAW,EAAG,QAAO,EAAE;AAC7B,MAAI,EAAE,WAAW,EAAG,QAAO,EAAE;AAE7B,QAAM,SAAqB,CAAC;AAC5B,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,IAAK,QAAO,CAAC,IAAI,CAAC,CAAC;AAClD,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,IAAK,QAAO,CAAC,EAAG,CAAC,IAAI;AAEpD,WAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK;AAClC,aAAS,IAAI,GAAG,KAAK,EAAE,QAAQ,KAAK;AAClC,YAAM,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,IAAI;AACzC,aAAO,CAAC,EAAG,CAAC,IAAI,KAAK;AAAA,QACnB,OAAO,IAAI,CAAC,EAAG,CAAC,IAAK;AAAA;AAAA,QACrB,OAAO,CAAC,EAAG,IAAI,CAAC,IAAK;AAAA;AAAA,QACrB,OAAO,IAAI,CAAC,EAAG,IAAI,CAAC,IAAK;AAAA;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO,EAAE,MAAM,EAAG,EAAE,MAAM;AACnC;AAEA,SAAS,qBAAqB,MAAc,WAAoC;AAE9E,QAAM,OAAO,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC,KAAK,OAAO;AACjE,aAAW,SAAS,WAAW;AAC7B,UAAM,OAAO,YAAY,KAAK,YAAY,GAAG,MAAM,YAAY,CAAC;AAChE,QAAI,OAAO,KAAK,QAAQ,EAAG,QAAO;AAAA,EACpC;AACA,SAAO;AACT;AAIA,MAAM,aAAa;AAQnB,eAAe,eAAe,MAAmC;AAC/D,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,MAAI;AACF,UAAM,UAAU,mBAAmB,IAAI;AACvC,UAAM,OAAO,MAAM,MAAM,8BAA8B,OAAO,WAAW;AAAA,MACvE,QAAQ;AAAA,MACR,QAAQ,WAAW;AAAA,MACnB,SAAS,EAAE,UAAU,mBAAmB;AAAA,IAC1C,CAAC;AACD,QAAI,CAAC,KAAK,GAAI,QAAO,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AACvE,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAM,UAAW,KAAK,SAAS,KAAgB;AAE/C,UAAM,OAAO,MAAM,MAAM,8BAA8B,OAAO,IAAI;AAAA,MAChE,SAAS,EAAE,UAAU,mBAAmB;AAAA,IAC1C,CAAC;AACD,QAAI,cAA6B;AACjC,QAAI,KAAK,IAAI;AACX,YAAM,WAAW,MAAM,KAAK,KAAK;AACjC,YAAM,OAAQ,SAAS,MAAM,KAAgC,CAAC;AAC9D,oBAAc,KAAK,SAAS,KAAK;AAAA,IACnC;AACA,WAAO,EAAE,QAAQ,MAAM,SAAS,YAAY;AAAA,EAC9C,QAAQ;AACN,WAAO,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AAAA,EAC3D,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAEA,eAAe,gBAAgB,MAAmC;AAChE,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,yBAAyB,mBAAmB,IAAI,CAAC,SAAS;AAAA,MACjF,QAAQ,WAAW;AAAA,MACnB,SAAS,EAAE,UAAU,mBAAmB;AAAA,IAC1C,CAAC;AACD,QAAI,CAAC,KAAK,GAAI,QAAO,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AACvE,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAM,OAAO,KAAK,MAAM;AACxB,UAAM,UAAW,KAAK,SAAS,KAAgB;AAC/C,WAAO,EAAE,QAAQ,MAAM,SAAS,aAAa,KAAK;AAAA,EACpD,QAAQ;AACN,WAAO,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AAAA,EAC3D,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAEA,eAAe,oBAAoB,WAAmB,MAAmC;AACvF,QAAM,MAAM,UAAU,YAAY;AAClC,UAAQ,KAAK;AAAA,IACX,KAAK;AAAQ,aAAO,eAAe,IAAI;AAAA,IACvC,KAAK;AAAA,IACL,KAAK;AAAQ,aAAO,gBAAgB,IAAI;AAAA,IACxC;AAEE,aAAO,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AAAA,EAC7D;AACF;AASA,SAAS,eACP,aACA,iBACA,oBACmB;AAEnB,MAAI,mBAAmB,WAAW,OAAO,KAAK,mBAAmB,WAAW,IAAI,KAAK,mBAAmB,WAAW,KAAK,GAAG;AACzH,WAAO,EAAE,YAAY,MAAM,QAAQ,aAAa;AAAA,EAClD;AACA,MAAI,mBAAmB,WAAW,MAAM,KAAK,mBAAmB,WAAW,QAAQ,GAAG;AACpF,WAAO,EAAE,YAAY,MAAM,QAAQ,iBAAiB;AAAA,EACtD;AAGA,aAAW,YAAY,iBAAiB;AACtC,QAAI,SAAS,SAAS,kBAAkB,KAAK,SAAS,SAAS,QAAQ,GAAG;AACxE,aAAO,EAAE,YAAY,MAAM,QAAQ,iBAAiB;AAAA,IACtD;AAAA,EACF;AAIA,QAAM,kBAAkB,oBAAI,IAAI;AAAA,IAC9B;AAAA,IAAU;AAAA,IAAU;AAAA,IAAS;AAAA,IAAoB;AAAA,IAAY;AAAA,IAC7D;AAAA,IAAU;AAAA,IAAY;AAAA,IAAQ;AAAA,IAAc;AAAA,IAAgB;AAAA,IAC5D;AAAA,IAAW;AAAA,IAAW;AAAA,IAAY;AAAA,IAAQ;AAAA,IAAY;AAAA,EACxD,CAAC;AAED,MAAI,YAAY,WAAW,GAAG,GAAG;AAC/B,UAAM,QAAQ,YAAY,MAAM,GAAG,EAAE,CAAC;AACtC,QAAI,CAAC,gBAAgB,IAAI,KAAK,GAAG;AAC/B,aAAO,EAAE,YAAY,MAAM,QAAQ,iBAAiB,KAAK,GAAG;AAAA,IAC9D;AAAA,EACF;AAEA,SAAO,EAAE,YAAY,OAAO,QAAQ,kBAAkB;AACxD;AAIO,MAAM,oBAAoB;AAAA,EAC/B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,QAAwC;AAC5C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,OAOD,MAAM;AAAA,MACT;AAAA;AAAA;AAAA,IAGF;AAEA,UAAM,WAAkC,CAAC;AACzC,UAAM,OAAO,oBAAI,IAAY;AAE7B,eAAW,OAAO,MAAM;AACtB,YAAM,MAAM,GAAG,IAAI,SAAS,IAAI,IAAI,YAAY;AAChD,UAAI,KAAK,IAAI,GAAG,EAAG;AACnB,WAAK,IAAI,GAAG;AAEZ,UAAI,YAAsB,CAAC;AAC3B,UAAI;AACF,oBAAY,KAAK,MAAM,IAAI,gBAAgB;AAAA,MAC7C,QAAQ;AAAA,MAER;AAGA,YAAM,EAAE,YAAY,OAAO,IAAI;AAAA,QAC7B,IAAI;AAAA,QACJ;AAAA,QACA,IAAI;AAAA,MACN;AAEA,UAAI,YAAY;AACd,YAAI,aAAyB,EAAE,QAAQ,OAAO,SAAS,MAAM,aAAa,KAAK;AAC/E,YAAI;AAEF,cAAI,cAAc,IAAI;AACtB,cAAI,YAAY,WAAW,GAAG,GAAG;AAC/B,0BAAc,YAAY,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,UAC7C;AACA,uBAAa,MAAM,oBAAoB,IAAI,WAAW,WAAW;AAAA,QACnE,SAAS,KAAK;AACZ,gBAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,qCAAQ,6CAA6C,IAAI,YAAY,KAAK,GAAG,EAAE;AAAA,QACjF;AAEA,YAAI,WAAW,QAAQ;AACrB,mBAAS,KAAK;AAAA,YACZ,aAAa,IAAI;AAAA,YACjB,WAAW,IAAI;AAAA,YACf,gBAAgB;AAAA,YAChB,cAAc;AAAA,YACd,eAAe,WAAW;AAAA,YAC1B,mBAAmB,WAAW;AAAA,YAC9B,WAAW;AAAA,YACX,aACE,YAAY,IAAI,YAAY,2CAA2C,MAAM,2DACpB,IAAI,SAAS,sBAC1D,WAAW,WAAW,SAAS;AAAA,UAC/C,CAAC;AACD;AAAA,QACF;AAGA,iBAAS,KAAK;AAAA,UACZ,aAAa,IAAI;AAAA,UACjB,WAAW,IAAI;AAAA,UACf,gBAAgB;AAAA,UAChB,cAAc;AAAA,UACd,eAAe;AAAA,UACf,mBAAmB;AAAA,UACnB,WAAW;AAAA,UACX,aACE,YAAY,IAAI,YAAY,2CAA2C,MAAM;AAAA,QAEjF,CAAC;AACD;AAAA,MACF;AAGA,UAAI,IAAI,UAAU,YAAY,MAAM,OAAO;AACzC,cAAM,UAAU,qBAAqB,IAAI,cAAc,cAAc;AACrE,YAAI,SAAS;AACX,mBAAS,KAAK;AAAA,YACZ,aAAa,IAAI;AAAA,YACjB,WAAW,IAAI;AAAA,YACf,gBAAgB;AAAA,YAChB,cAAc;AAAA,YACd,eAAe;AAAA,YACf,mBAAmB;AAAA,YACnB,WAAW;AAAA,YACX,aACE,YAAY,IAAI,YAAY,wDACxB,OAAO;AAAA,UACf,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/security/errors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * KiroGraph-Sec Error Classes
+ *
+ * Security-specific error types extending the base KiroGraphError.
+ */
+import { KiroGraphError } from '../errors';
+export declare class SecurityError extends KiroGraphError {
+    constructor(message: string, context?: Record<string, unknown>);
+}
+export declare class ManifestParseError extends KiroGraphError {
+    constructor(message: string, filePath: string, line?: number);
+}
+export declare class VulnDatabaseError extends KiroGraphError {
+    constructor(message: string, database: string, httpStatus?: number);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/security/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/security/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,qBAAa,aAAc,SAAQ,cAAc;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED,qBAAa,kBAAmB,SAAQ,cAAc;gBACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;CAI7D;AAED,qBAAa,iBAAkB,SAAQ,cAAc;gBACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAInE"}

package/dist/security/errors.js

@@ -0,0 +1,51 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var errors_exports = {};
+__export(errors_exports, {
+  ManifestParseError: () => ManifestParseError,
+  SecurityError: () => SecurityError,
+  VulnDatabaseError: () => VulnDatabaseError
+});
+module.exports = __toCommonJS(errors_exports);
+var import_errors = require("../errors");
+class SecurityError extends import_errors.KiroGraphError {
+  constructor(message, context) {
+    super(message, "SECURITY_ERROR", context);
+    this.name = "SecurityError";
+  }
+}
+class ManifestParseError extends import_errors.KiroGraphError {
+  constructor(message, filePath, line) {
+    super(message, "MANIFEST_PARSE_ERROR", { filePath, line });
+    this.name = "ManifestParseError";
+  }
+}
+class VulnDatabaseError extends import_errors.KiroGraphError {
+  constructor(message, database, httpStatus) {
+    super(message, "VULN_DATABASE_ERROR", { database, httpStatus });
+    this.name = "VulnDatabaseError";
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ManifestParseError,
+  SecurityError,
+  VulnDatabaseError
+});
+//# sourceMappingURL=errors.js.map

package/dist/security/errors.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/errors.ts"],
+  "sourcesContent": ["/**\n * KiroGraph-Sec Error Classes\n *\n * Security-specific error types extending the base KiroGraphError.\n */\n\nimport { KiroGraphError } from '../errors';\n\nexport class SecurityError extends KiroGraphError {\n  constructor(message: string, context?: Record<string, unknown>) {\n    super(message, 'SECURITY_ERROR', context);\n    this.name = 'SecurityError';\n  }\n}\n\nexport class ManifestParseError extends KiroGraphError {\n  constructor(message: string, filePath: string, line?: number) {\n    super(message, 'MANIFEST_PARSE_ERROR', { filePath, line });\n    this.name = 'ManifestParseError';\n  }\n}\n\nexport class VulnDatabaseError extends KiroGraphError {\n  constructor(message: string, database: string, httpStatus?: number) {\n    super(message, 'VULN_DATABASE_ERROR', { database, httpStatus });\n    this.name = 'VulnDatabaseError';\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,oBAA+B;AAExB,MAAM,sBAAsB,6BAAe;AAAA,EAChD,YAAY,SAAiB,SAAmC;AAC9D,UAAM,SAAS,kBAAkB,OAAO;AACxC,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,2BAA2B,6BAAe;AAAA,EACrD,YAAY,SAAiB,UAAkB,MAAe;AAC5D,UAAM,SAAS,wBAAwB,EAAE,UAAU,KAAK,CAAC;AACzD,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,0BAA0B,6BAAe;AAAA,EACpD,YAAY,SAAiB,UAAkB,YAAqB;AAClE,UAAM,SAAS,uBAAuB,EAAE,UAAU,WAAW,CAAC;AAC9D,SAAK,OAAO;AAAA,EACd;AACF;",
+  "names": []
+}

package/dist/security/export/fix-suggestions.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Fix Suggestion Builder
+ *
+ * Generates ecosystem-appropriate upgrade commands for vulnerabilities
+ * that have a known fixed version. Reusable by CLI and MCP tools.
+ */
+/**
+ * Build an ecosystem-appropriate fix suggestion command.
+ *
+ * @param ecosystem - The package ecosystem (npm, maven, go, pypi, cargo)
+ * @param packageName - The package name (for maven: groupId:artifactId)
+ * @param fixedVersion - The version that fixes the vulnerability
+ * @returns A formatted fix command string, or empty string if ecosystem is unknown
+ */
+export declare function buildFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string): string;
+/**
+ * Format a fix suggestion line for display.
+ * Returns the formatted line with the 💡 prefix, or empty string if no fixed version.
+ */
+export declare function formatFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string | null | undefined): string;
+//# sourceMappingURL=fix-suggestions.d.ts.map

package/dist/security/export/fix-suggestions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix-suggestions.d.ts","sourceRoot":"","sources":["../../../src/security/export/fix-suggestions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAuBvG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAI3H"}

package/dist/security/export/fix-suggestions.js

@@ -0,0 +1,58 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var fix_suggestions_exports = {};
+__export(fix_suggestions_exports, {
+  buildFixSuggestion: () => buildFixSuggestion,
+  formatFixSuggestion: () => formatFixSuggestion
+});
+module.exports = __toCommonJS(fix_suggestions_exports);
+function buildFixSuggestion(ecosystem, packageName, fixedVersion) {
+  switch (ecosystem.toLowerCase()) {
+    case "npm":
+      return `npm install ${packageName}@${fixedVersion}`;
+    case "maven": {
+      const parts = packageName.split(":");
+      if (parts.length === 2) {
+        return `Update ${parts[0]}:${parts[1]} to ${fixedVersion} in pom.xml`;
+      }
+      return `Update ${packageName} to ${fixedVersion} in pom.xml`;
+    }
+    case "go":
+    case "golang":
+      return `go get ${packageName}@v${fixedVersion}`;
+    case "pypi":
+    case "pip":
+      return `pip install ${packageName}==${fixedVersion}`;
+    case "cargo":
+      return `cargo update -p ${packageName} --precise ${fixedVersion}`;
+    default:
+      return `Upgrade ${packageName} to ${fixedVersion}`;
+  }
+}
+function formatFixSuggestion(ecosystem, packageName, fixedVersion) {
+  if (!fixedVersion) return "";
+  const command = buildFixSuggestion(ecosystem, packageName, fixedVersion);
+  return `\u{1F4A1} Fix: ${command}`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  buildFixSuggestion,
+  formatFixSuggestion
+});
+//# sourceMappingURL=fix-suggestions.js.map

package/dist/security/export/fix-suggestions.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/export/fix-suggestions.ts"],
+  "sourcesContent": ["/**\n * Fix Suggestion Builder\n *\n * Generates ecosystem-appropriate upgrade commands for vulnerabilities\n * that have a known fixed version. Reusable by CLI and MCP tools.\n */\n\n/**\n * Build an ecosystem-appropriate fix suggestion command.\n *\n * @param ecosystem - The package ecosystem (npm, maven, go, pypi, cargo)\n * @param packageName - The package name (for maven: groupId:artifactId)\n * @param fixedVersion - The version that fixes the vulnerability\n * @returns A formatted fix command string, or empty string if ecosystem is unknown\n */\nexport function buildFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string): string {\n  switch (ecosystem.toLowerCase()) {\n    case 'npm':\n      return `npm install ${packageName}@${fixedVersion}`;\n    case 'maven': {\n      // Maven packageName is typically \"groupId:artifactId\"\n      const parts = packageName.split(':');\n      if (parts.length === 2) {\n        return `Update ${parts[0]}:${parts[1]} to ${fixedVersion} in pom.xml`;\n      }\n      return `Update ${packageName} to ${fixedVersion} in pom.xml`;\n    }\n    case 'go':\n    case 'golang':\n      return `go get ${packageName}@v${fixedVersion}`;\n    case 'pypi':\n    case 'pip':\n      return `pip install ${packageName}==${fixedVersion}`;\n    case 'cargo':\n      return `cargo update -p ${packageName} --precise ${fixedVersion}`;\n    default:\n      return `Upgrade ${packageName} to ${fixedVersion}`;\n  }\n}\n\n/**\n * Format a fix suggestion line for display.\n * Returns the formatted line with the \uD83D\uDCA1 prefix, or empty string if no fixed version.\n */\nexport function formatFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string | null | undefined): string {\n  if (!fixedVersion) return '';\n  const command = buildFixSuggestion(ecosystem, packageName, fixedVersion);\n  return `\uD83D\uDCA1 Fix: ${command}`;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeO,SAAS,mBAAmB,WAAmB,aAAqB,cAA8B;AACvG,UAAQ,UAAU,YAAY,GAAG;AAAA,IAC/B,KAAK;AACH,aAAO,eAAe,WAAW,IAAI,YAAY;AAAA,IACnD,KAAK,SAAS;AAEZ,YAAM,QAAQ,YAAY,MAAM,GAAG;AACnC,UAAI,MAAM,WAAW,GAAG;AACtB,eAAO,UAAU,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,YAAY;AAAA,MAC1D;AACA,aAAO,UAAU,WAAW,OAAO,YAAY;AAAA,IACjD;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AACH,aAAO,UAAU,WAAW,KAAK,YAAY;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AACH,aAAO,eAAe,WAAW,KAAK,YAAY;AAAA,IACpD,KAAK;AACH,aAAO,mBAAmB,WAAW,cAAc,YAAY;AAAA,IACjE;AACE,aAAO,WAAW,WAAW,OAAO,YAAY;AAAA,EACpD;AACF;AAMO,SAAS,oBAAoB,WAAmB,aAAqB,cAAiD;AAC3H,MAAI,CAAC,aAAc,QAAO;AAC1B,QAAM,UAAU,mBAAmB,WAAW,aAAa,YAAY;AACvE,SAAO,kBAAW,OAAO;AAC3B;",
+  "names": []
+}

package/dist/security/export/sbom.d.ts

@@ -0,0 +1,33 @@
+/**
+ * SBOMExporter — CycloneDX 1.5 SBOM Generation
+ *
+ * Generates a CycloneDX 1.5 JSON Software Bill of Materials from the
+ * Dependency_Graph stored in the KiroGraph database. Each Dependency_Node
+ * becomes a component of type "library" with purl, scope, and
+ * direct/transitive classification.
+ *
+ * Requirements: 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7
+ */
+import type { GraphDatabase } from '../../db/database';
+import type { CycloneDXSBOM } from '../types';
+/**
+ * Generates CycloneDX 1.5 SBOM documents from the dependency graph.
+ */
+export declare class SBOMExporter {
+    private readonly db;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, projectRoot: string);
+    /**
+     * Generate a CycloneDX 1.5 SBOM object.
+     */
+    export(): CycloneDXSBOM;
+    /**
+     * Export the SBOM as a pretty-printed JSON string.
+     */
+    exportJSON(): string;
+    /**
+     * Build CycloneDX metadata section.
+     */
+    private buildMetadata;
+}
+//# sourceMappingURL=sbom.d.ts.map

package/dist/security/export/sbom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.d.ts","sourceRoot":"","sources":["../../../src/security/export/sbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EACV,aAAa,EAId,MAAM,UAAU,CAAC;AAiHlB;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAKlD;;OAEG;IACH,MAAM,IAAI,aAAa;IAsGvB;;OAEG;IACH,UAAU,IAAI,MAAM;IAKpB;;OAEG;IACH,OAAO,CAAC,aAAa;CA8BtB"}

package/dist/security/export/sbom.js

@@ -0,0 +1,230 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sbom_exports = {};
+__export(sbom_exports, {
+  SBOMExporter: () => SBOMExporter
+});
+module.exports = __toCommonJS(sbom_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+const ECOSYSTEM_PURL_MAP = {
+  npm: "npm",
+  maven: "maven",
+  go: "golang",
+  pypi: "pypi",
+  python: "pypi",
+  cargo: "cargo"
+};
+function buildPurl(ecosystem, name, version) {
+  const purlType = ECOSYSTEM_PURL_MAP[ecosystem] ?? ecosystem;
+  return `pkg:${purlType}/${name}@${version}`;
+}
+const TOOL_NAME = "kirograph-sec";
+function getToolVersion() {
+  try {
+    let dir = __dirname;
+    for (let i = 0; i < 5; i++) {
+      const pkgPath = path.join(dir, "package.json");
+      if (fs.existsSync(pkgPath)) {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        if (pkg.version) return pkg.version;
+      }
+      dir = path.dirname(dir);
+    }
+  } catch {
+  }
+  return "0.1.0";
+}
+function getProjectName(projectRoot) {
+  try {
+    const pkgJsonPath = path.join(projectRoot, "package.json");
+    if (fs.existsSync(pkgJsonPath)) {
+      const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+      if (pkg.name) return pkg.name;
+    }
+  } catch {
+  }
+  try {
+    const cargoPath = path.join(projectRoot, "Cargo.toml");
+    if (fs.existsSync(cargoPath)) {
+      const content = fs.readFileSync(cargoPath, "utf-8");
+      const match = content.match(/^\s*name\s*=\s*"([^"]+)"/m);
+      if (match) return match[1];
+    }
+  } catch {
+  }
+  try {
+    const goModPath = path.join(projectRoot, "go.mod");
+    if (fs.existsSync(goModPath)) {
+      const content = fs.readFileSync(goModPath, "utf-8");
+      const match = content.match(/^module\s+(\S+)/m);
+      if (match) return match[1];
+    }
+  } catch {
+  }
+  try {
+    const pomPath = path.join(projectRoot, "pom.xml");
+    if (fs.existsSync(pomPath)) {
+      const content = fs.readFileSync(pomPath, "utf-8");
+      const match = content.match(/<artifactId>([^<]+)<\/artifactId>/);
+      if (match) return match[1];
+    }
+  } catch {
+  }
+  return path.basename(projectRoot);
+}
+class SBOMExporter {
+  constructor(db, projectRoot) {
+    this.db = db;
+    this.projectRoot = projectRoot;
+  }
+  /**
+   * Generate a CycloneDX 1.5 SBOM object.
+   */
+  export() {
+    const rawDb = this.db.getRawDb();
+    const depRows = rawDb.all(
+      "SELECT node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests FROM sec_dependencies"
+    );
+    const directNodeIds = /* @__PURE__ */ new Set();
+    if (depRows.length > 0) {
+      const declaredInEdges = rawDb.all(
+        `SELECT source, target, kind FROM edges WHERE kind = 'declared_in'`
+      );
+      for (const edge of declaredInEdges) {
+        directNodeIds.add(edge.source);
+      }
+    }
+    const components = depRows.map((row) => {
+      const version = row.resolved_version ?? row.declared_constraint;
+      const purl = buildPurl(row.ecosystem, row.package_name, version);
+      const isDirect = directNodeIds.has(row.node_id);
+      const component = {
+        type: "library",
+        name: row.package_name,
+        version,
+        purl,
+        scope: isDirect ? "required" : "optional",
+        properties: [
+          { name: "kirograph:classification", value: isDirect ? "direct" : "transitive" },
+          { name: "kirograph:ecosystem", value: row.ecosystem }
+        ]
+      };
+      return component;
+    });
+    const dependencies = [];
+    if (depRows.length > 0) {
+      const dependsOnEdges = rawDb.all(
+        `SELECT source, target, kind FROM edges WHERE kind = 'depends_on'`
+      );
+      const depNodeIds = new Set(depRows.map((r) => r.node_id));
+      const depsMap = /* @__PURE__ */ new Map();
+      for (const edge of dependsOnEdges) {
+        if (depNodeIds.has(edge.source) && depNodeIds.has(edge.target)) {
+          const existing = depsMap.get(edge.source);
+          if (existing) {
+            existing.push(edge.target);
+          } else {
+            depsMap.set(edge.source, [edge.target]);
+          }
+        }
+      }
+      for (const row of depRows) {
+        const version = row.resolved_version ?? row.declared_constraint;
+        const ref = buildPurl(row.ecosystem, row.package_name, version);
+        const deps = depsMap.get(row.node_id);
+        const entry = { ref };
+        if (deps && deps.length > 0) {
+          entry.dependsOn = deps.map((targetId) => {
+            const targetRow = depRows.find((r) => r.node_id === targetId);
+            if (targetRow) {
+              const targetVersion = targetRow.resolved_version ?? targetRow.declared_constraint;
+              return buildPurl(targetRow.ecosystem, targetRow.package_name, targetVersion);
+            }
+            return targetId;
+          });
+        }
+        dependencies.push(entry);
+      }
+    }
+    const metadata = this.buildMetadata();
+    const sbom = {
+      bomFormat: "CycloneDX",
+      specVersion: "1.5",
+      version: 1,
+      metadata,
+      components,
+      dependencies
+    };
+    return sbom;
+  }
+  /**
+   * Export the SBOM as a pretty-printed JSON string.
+   */
+  exportJSON() {
+    const sbom = this.export();
+    return JSON.stringify(sbom, null, 2);
+  }
+  /**
+   * Build CycloneDX metadata section.
+   */
+  buildMetadata() {
+    const toolVersion = getToolVersion();
+    const projectName = getProjectName(this.projectRoot);
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const meta = {
+      toolName: TOOL_NAME,
+      toolVersion,
+      timestamp,
+      projectName
+    };
+    return {
+      timestamp: meta.timestamp,
+      tools: {
+        components: [
+          {
+            type: "application",
+            name: meta.toolName,
+            version: meta.toolVersion
+          }
+        ]
+      },
+      component: {
+        type: "application",
+        name: meta.projectName,
+        version: ""
+      }
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SBOMExporter
+});
+//# sourceMappingURL=sbom.js.map

package/dist/security/export/sbom.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/export/sbom.ts"],
+  "sourcesContent": ["/**\n * SBOMExporter \u2014 CycloneDX 1.5 SBOM Generation\n *\n * Generates a CycloneDX 1.5 JSON Software Bill of Materials from the\n * Dependency_Graph stored in the KiroGraph database. Each Dependency_Node\n * becomes a component of type \"library\" with purl, scope, and\n * direct/transitive classification.\n *\n * Requirements: 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7\n */\nimport type { GraphDatabase } from '../../db/database';\nimport type {\n  CycloneDXSBOM,\n  CycloneDXComponent,\n  CycloneDXDependencyEntry,\n  SBOMMetadata,\n} from '../types';\nimport * as fs from 'fs';\nimport * as path from 'path';\n\n// \u2500\u2500 Ecosystem \u2192 purl type mapping \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst ECOSYSTEM_PURL_MAP: Record<string, string> = {\n  npm: 'npm',\n  maven: 'maven',\n  go: 'golang',\n  pypi: 'pypi',\n  python: 'pypi',\n  cargo: 'cargo',\n};\n\n/**\n * Build a Package URL (purl) for a dependency.\n * Format: pkg:<type>/<name>@<version>\n */\nfunction buildPurl(ecosystem: string, name: string, version: string): string {\n  const purlType = ECOSYSTEM_PURL_MAP[ecosystem] ?? ecosystem;\n  return `pkg:${purlType}/${name}@${version}`;\n}\n\n// \u2500\u2500 Metadata helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst TOOL_NAME = 'kirograph-sec';\n\n/**\n * Read the tool version from package.json, falling back to \"0.1.0\".\n */\nfunction getToolVersion(): string {\n  try {\n    // Walk up from this file to find the project root package.json\n    let dir = __dirname;\n    for (let i = 0; i < 5; i++) {\n      const pkgPath = path.join(dir, 'package.json');\n      if (fs.existsSync(pkgPath)) {\n        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));\n        if (pkg.version) return pkg.version;\n      }\n      dir = path.dirname(dir);\n    }\n  } catch {\n    // Ignore errors \u2014 fall back to default\n  }\n  return '0.1.0';\n}\n\n/**\n * Detect the project name from the root manifest file.\n * Checks package.json, Cargo.toml, go.mod, pom.xml in order.\n */\nfunction getProjectName(projectRoot: string): string {\n  try {\n    const pkgJsonPath = path.join(projectRoot, 'package.json');\n    if (fs.existsSync(pkgJsonPath)) {\n      const pkg = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));\n      if (pkg.name) return pkg.name;\n    }\n  } catch { /* ignore */ }\n\n  try {\n    const cargoPath = path.join(projectRoot, 'Cargo.toml');\n    if (fs.existsSync(cargoPath)) {\n      const content = fs.readFileSync(cargoPath, 'utf-8');\n      const match = content.match(/^\\s*name\\s*=\\s*\"([^\"]+)\"/m);\n      if (match) return match[1];\n    }\n  } catch { /* ignore */ }\n\n  try {\n    const goModPath = path.join(projectRoot, 'go.mod');\n    if (fs.existsSync(goModPath)) {\n      const content = fs.readFileSync(goModPath, 'utf-8');\n      const match = content.match(/^module\\s+(\\S+)/m);\n      if (match) return match[1];\n    }\n  } catch { /* ignore */ }\n\n  try {\n    const pomPath = path.join(projectRoot, 'pom.xml');\n    if (fs.existsSync(pomPath)) {\n      const content = fs.readFileSync(pomPath, 'utf-8');\n      const match = content.match(/<artifactId>([^<]+)<\\/artifactId>/);\n      if (match) return match[1];\n    }\n  } catch { /* ignore */ }\n\n  // Fallback: use the directory name\n  return path.basename(projectRoot);\n}\n\n// \u2500\u2500 Database row types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface SecDependencyRow {\n  node_id: string;\n  ecosystem: string;\n  package_name: string;\n  declared_constraint: string;\n  resolved_version: string | null;\n  scope: string;\n  source_manifests: string;\n}\n\ninterface EdgeRow {\n  source: string;\n  target: string;\n  kind: string;\n}\n\n// \u2500\u2500 SBOMExporter \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Generates CycloneDX 1.5 SBOM documents from the dependency graph.\n */\nexport class SBOMExporter {\n  private readonly db: GraphDatabase;\n  private readonly projectRoot: string;\n\n  constructor(db: GraphDatabase, projectRoot: string) {\n    this.db = db;\n    this.projectRoot = projectRoot;\n  }\n\n  /**\n   * Generate a CycloneDX 1.5 SBOM object.\n   */\n  export(): CycloneDXSBOM {\n    const rawDb = this.db.getRawDb();\n\n    // Query all dependency nodes\n    const depRows: SecDependencyRow[] = rawDb.all(\n      'SELECT node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests FROM sec_dependencies',\n    );\n\n    // Determine which dependencies are direct (have a declared_in edge)\n    const directNodeIds = new Set<string>();\n    if (depRows.length > 0) {\n      const declaredInEdges: EdgeRow[] = rawDb.all(\n        `SELECT source, target, kind FROM edges WHERE kind = 'declared_in'`,\n      );\n      for (const edge of declaredInEdges) {\n        directNodeIds.add(edge.source);\n      }\n    }\n\n    // Build components\n    const components: CycloneDXComponent[] = depRows.map((row) => {\n      const version = row.resolved_version ?? row.declared_constraint;\n      const purl = buildPurl(row.ecosystem, row.package_name, version);\n      const isDirect = directNodeIds.has(row.node_id);\n\n      const component: CycloneDXComponent = {\n        type: 'library',\n        name: row.package_name,\n        version,\n        purl,\n        scope: isDirect ? 'required' : 'optional',\n        properties: [\n          { name: 'kirograph:classification', value: isDirect ? 'direct' : 'transitive' },\n          { name: 'kirograph:ecosystem', value: row.ecosystem },\n        ],\n      };\n\n      return component;\n    });\n\n    // Build dependency relationships from depends_on edges\n    const dependencies: CycloneDXDependencyEntry[] = [];\n\n    if (depRows.length > 0) {\n      const dependsOnEdges: EdgeRow[] = rawDb.all(\n        `SELECT source, target, kind FROM edges WHERE kind = 'depends_on'`,\n      );\n\n      // Group depends_on edges by source\n      const depNodeIds = new Set(depRows.map((r) => r.node_id));\n      const depsMap = new Map<string, string[]>();\n\n      for (const edge of dependsOnEdges) {\n        // Only include edges where both source and target are dependency nodes\n        if (depNodeIds.has(edge.source) && depNodeIds.has(edge.target)) {\n          const existing = depsMap.get(edge.source);\n          if (existing) {\n            existing.push(edge.target);\n          } else {\n            depsMap.set(edge.source, [edge.target]);\n          }\n        }\n      }\n\n      // Create an entry for each dependency node\n      for (const row of depRows) {\n        const version = row.resolved_version ?? row.declared_constraint;\n        const ref = buildPurl(row.ecosystem, row.package_name, version);\n        const deps = depsMap.get(row.node_id);\n\n        const entry: CycloneDXDependencyEntry = { ref };\n        if (deps && deps.length > 0) {\n          // Resolve target node_ids to purls\n          entry.dependsOn = deps.map((targetId) => {\n            const targetRow = depRows.find((r) => r.node_id === targetId);\n            if (targetRow) {\n              const targetVersion = targetRow.resolved_version ?? targetRow.declared_constraint;\n              return buildPurl(targetRow.ecosystem, targetRow.package_name, targetVersion);\n            }\n            return targetId; // fallback to node_id if not found\n          });\n        }\n\n        dependencies.push(entry);\n      }\n    }\n\n    // Build metadata\n    const metadata = this.buildMetadata();\n\n    const sbom: CycloneDXSBOM = {\n      bomFormat: 'CycloneDX',\n      specVersion: '1.5',\n      version: 1,\n      metadata,\n      components,\n      dependencies,\n    };\n\n    return sbom;\n  }\n\n  /**\n   * Export the SBOM as a pretty-printed JSON string.\n   */\n  exportJSON(): string {\n    const sbom = this.export();\n    return JSON.stringify(sbom, null, 2);\n  }\n\n  /**\n   * Build CycloneDX metadata section.\n   */\n  private buildMetadata(): Record<string, unknown> {\n    const toolVersion = getToolVersion();\n    const projectName = getProjectName(this.projectRoot);\n    const timestamp = new Date().toISOString();\n\n    const meta: SBOMMetadata = {\n      toolName: TOOL_NAME,\n      toolVersion,\n      timestamp,\n      projectName,\n    };\n\n    return {\n      timestamp: meta.timestamp,\n      tools: {\n        components: [\n          {\n            type: 'application',\n            name: meta.toolName,\n            version: meta.toolVersion,\n          },\n        ],\n      },\n      component: {\n        type: 'application',\n        name: meta.projectName,\n        version: '',\n      },\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBA,SAAoB;AACpB,WAAsB;AAItB,MAAM,qBAA6C;AAAA,EACjD,KAAK;AAAA,EACL,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AACT;AAMA,SAAS,UAAU,WAAmB,MAAc,SAAyB;AAC3E,QAAM,WAAW,mBAAmB,SAAS,KAAK;AAClD,SAAO,OAAO,QAAQ,IAAI,IAAI,IAAI,OAAO;AAC3C;AAIA,MAAM,YAAY;AAKlB,SAAS,iBAAyB;AAChC,MAAI;AAEF,QAAI,MAAM;AACV,aAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,YAAM,UAAU,KAAK,KAAK,KAAK,cAAc;AAC7C,UAAI,GAAG,WAAW,OAAO,GAAG;AAC1B,cAAM,MAAM,KAAK,MAAM,GAAG,aAAa,SAAS,OAAO,CAAC;AACxD,YAAI,IAAI,QAAS,QAAO,IAAI;AAAA,MAC9B;AACA,YAAM,KAAK,QAAQ,GAAG;AAAA,IACxB;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAMA,SAAS,eAAe,aAA6B;AACnD,MAAI;AACF,UAAM,cAAc,KAAK,KAAK,aAAa,cAAc;AACzD,QAAI,GAAG,WAAW,WAAW,GAAG;AAC9B,YAAM,MAAM,KAAK,MAAM,GAAG,aAAa,aAAa,OAAO,CAAC;AAC5D,UAAI,IAAI,KAAM,QAAO,IAAI;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAAe;AAEvB,MAAI;AACF,UAAM,YAAY,KAAK,KAAK,aAAa,YAAY;AACrD,QAAI,GAAG,WAAW,SAAS,GAAG;AAC5B,YAAM,UAAU,GAAG,aAAa,WAAW,OAAO;AAClD,YAAM,QAAQ,QAAQ,MAAM,2BAA2B;AACvD,UAAI,MAAO,QAAO,MAAM,CAAC;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAAe;AAEvB,MAAI;AACF,UAAM,YAAY,KAAK,KAAK,aAAa,QAAQ;AACjD,QAAI,GAAG,WAAW,SAAS,GAAG;AAC5B,YAAM,UAAU,GAAG,aAAa,WAAW,OAAO;AAClD,YAAM,QAAQ,QAAQ,MAAM,kBAAkB;AAC9C,UAAI,MAAO,QAAO,MAAM,CAAC;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAAe;AAEvB,MAAI;AACF,UAAM,UAAU,KAAK,KAAK,aAAa,SAAS;AAChD,QAAI,GAAG,WAAW,OAAO,GAAG;AAC1B,YAAM,UAAU,GAAG,aAAa,SAAS,OAAO;AAChD,YAAM,QAAQ,QAAQ,MAAM,mCAAmC;AAC/D,UAAI,MAAO,QAAO,MAAM,CAAC;AAAA,IAC3B;AAAA,EACF,QAAQ;AAAA,EAAe;AAGvB,SAAO,KAAK,SAAS,WAAW;AAClC;AAyBO,MAAM,aAAa;AAAA,EAIxB,YAAY,IAAmB,aAAqB;AAClD,SAAK,KAAK;AACV,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,SAAwB;AACtB,UAAM,QAAQ,KAAK,GAAG,SAAS;AAG/B,UAAM,UAA8B,MAAM;AAAA,MACxC;AAAA,IACF;AAGA,UAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,kBAA6B,MAAM;AAAA,QACvC;AAAA,MACF;AACA,iBAAW,QAAQ,iBAAiB;AAClC,sBAAc,IAAI,KAAK,MAAM;AAAA,MAC/B;AAAA,IACF;AAGA,UAAM,aAAmC,QAAQ,IAAI,CAAC,QAAQ;AAC5D,YAAM,UAAU,IAAI,oBAAoB,IAAI;AAC5C,YAAM,OAAO,UAAU,IAAI,WAAW,IAAI,cAAc,OAAO;AAC/D,YAAM,WAAW,cAAc,IAAI,IAAI,OAAO;AAE9C,YAAM,YAAgC;AAAA,QACpC,MAAM;AAAA,QACN,MAAM,IAAI;AAAA,QACV;AAAA,QACA;AAAA,QACA,OAAO,WAAW,aAAa;AAAA,QAC/B,YAAY;AAAA,UACV,EAAE,MAAM,4BAA4B,OAAO,WAAW,WAAW,aAAa;AAAA,UAC9E,EAAE,MAAM,uBAAuB,OAAO,IAAI,UAAU;AAAA,QACtD;AAAA,MACF;AAEA,aAAO;AAAA,IACT,CAAC;AAGD,UAAM,eAA2C,CAAC;AAElD,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,iBAA4B,MAAM;AAAA,QACtC;AAAA,MACF;AAGA,YAAM,aAAa,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;AACxD,YAAM,UAAU,oBAAI,IAAsB;AAE1C,iBAAW,QAAQ,gBAAgB;AAEjC,YAAI,WAAW,IAAI,KAAK,MAAM,KAAK,WAAW,IAAI,KAAK,MAAM,GAAG;AAC9D,gBAAM,WAAW,QAAQ,IAAI,KAAK,MAAM;AACxC,cAAI,UAAU;AACZ,qBAAS,KAAK,KAAK,MAAM;AAAA,UAC3B,OAAO;AACL,oBAAQ,IAAI,KAAK,QAAQ,CAAC,KAAK,MAAM,CAAC;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAGA,iBAAW,OAAO,SAAS;AACzB,cAAM,UAAU,IAAI,oBAAoB,IAAI;AAC5C,cAAM,MAAM,UAAU,IAAI,WAAW,IAAI,cAAc,OAAO;AAC9D,cAAM,OAAO,QAAQ,IAAI,IAAI,OAAO;AAEpC,cAAM,QAAkC,EAAE,IAAI;AAC9C,YAAI,QAAQ,KAAK,SAAS,GAAG;AAE3B,gBAAM,YAAY,KAAK,IAAI,CAAC,aAAa;AACvC,kBAAM,YAAY,QAAQ,KAAK,CAAC,MAAM,EAAE,YAAY,QAAQ;AAC5D,gBAAI,WAAW;AACb,oBAAM,gBAAgB,UAAU,oBAAoB,UAAU;AAC9D,qBAAO,UAAU,UAAU,WAAW,UAAU,cAAc,aAAa;AAAA,YAC7E;AACA,mBAAO;AAAA,UACT,CAAC;AAAA,QACH;AAEA,qBAAa,KAAK,KAAK;AAAA,MACzB;AAAA,IACF;AAGA,UAAM,WAAW,KAAK,cAAc;AAEpC,UAAM,OAAsB;AAAA,MAC1B,WAAW;AAAA,MACX,aAAa;AAAA,MACb,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,aAAqB;AACnB,UAAM,OAAO,KAAK,OAAO;AACzB,WAAO,KAAK,UAAU,MAAM,MAAM,CAAC;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAyC;AAC/C,UAAM,cAAc,eAAe;AACnC,UAAM,cAAc,eAAe,KAAK,WAAW;AACnD,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAEzC,UAAM,OAAqB;AAAA,MACzB,UAAU;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO;AAAA,MACL,WAAW,KAAK;AAAA,MAChB,OAAO;AAAA,QACL,YAAY;AAAA,UACV;AAAA,YACE,MAAM;AAAA,YACN,MAAM,KAAK;AAAA,YACX,SAAS,KAAK;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,MAAM;AAAA,QACN,MAAM,KAAK;AAAA,QACX,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/export/serialization.d.ts

@@ -0,0 +1,62 @@
+/**
+ * CycloneDX serialization utilities for Dependency_Nodes.
+ *
+ * Provides serialize/deserialize between DependencyRow (sec_dependencies table)
+ * and CycloneDX JSON component format, with partial failure resilience.
+ *
+ * Requirements: 8.2, 8.3, 8.4
+ */
+import type { CycloneDXComponent } from '../types';
+/**
+ * Represents a row from the sec_dependencies table.
+ */
+export interface DependencyRow {
+    node_id: string;
+    ecosystem: string;
+    package_name: string;
+    declared_constraint: string;
+    resolved_version: string | null;
+    scope: 'production' | 'development' | 'optional';
+    transitive_status: 'complete' | 'incomplete';
+    last_vuln_check: number | null;
+    vuln_data_stale: number;
+    vuln_data_stale_since: number | null;
+    source_manifests: string;
+}
+/**
+ * Error reported when a single node fails serialization/deserialization.
+ */
+export interface SerializationError {
+    name: string;
+    reason: string;
+}
+/**
+ * Converts a dependency database row to a CycloneDX component object.
+ * Stores the declared constraint in a `properties` array entry with
+ * name "kirograph:declaredConstraint".
+ *
+ * The purl format is: pkg:<ecosystem>/<name>@<version>
+ */
+export declare function serializeDependencyToComponent(dep: DependencyRow): CycloneDXComponent;
+/**
+ * Converts a CycloneDX component back to a dependency row.
+ * Extracts the constraint from the properties array.
+ */
+export declare function deserializeComponentToDependency(component: CycloneDXComponent): DependencyRow;
+/**
+ * Serializes all dependencies, collecting errors for any that fail
+ * without aborting the batch.
+ */
+export declare function serializeAll(deps: DependencyRow[]): {
+    components: CycloneDXComponent[];
+    errors: SerializationError[];
+};
+/**
+ * Deserializes all components back to dependency rows,
+ * collecting errors for any that fail without aborting the batch.
+ */
+export declare function deserializeAll(components: CycloneDXComponent[]): {
+    deps: DependencyRow[];
+    errors: SerializationError[];
+};
+//# sourceMappingURL=serialization.d.ts.map

package/dist/security/export/serialization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialization.d.ts","sourceRoot":"","sources":["../../../src/security/export/serialization.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAInD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,YAAY,GAAG,aAAa,GAAG,UAAU,CAAC;IACjD,iBAAiB,EAAE,UAAU,GAAG,YAAY,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAsBD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,aAAa,GAAG,kBAAkB,CAgCrF;AAID;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,kBAAkB,GAAG,aAAa,CA+C7F;AAID;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG;IACnD,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B,CAiBA;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG;IAChE,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B,CAiBA"}