kirograph 0.17.0 → 0.20.0

package/dist/security/export/serialization.js

@@ -0,0 +1,142 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var serialization_exports = {};
+__export(serialization_exports, {
+  deserializeAll: () => deserializeAll,
+  deserializeComponentToDependency: () => deserializeComponentToDependency,
+  serializeAll: () => serializeAll,
+  serializeDependencyToComponent: () => serializeDependencyToComponent
+});
+module.exports = __toCommonJS(serialization_exports);
+const ECOSYSTEM_TO_PURL = {
+  npm: "npm",
+  maven: "maven",
+  go: "golang",
+  pypi: "pypi",
+  cargo: "cargo"
+};
+const PURL_TO_ECOSYSTEM = {
+  npm: "npm",
+  maven: "maven",
+  golang: "go",
+  pypi: "pypi",
+  cargo: "cargo"
+};
+function serializeDependencyToComponent(dep) {
+  const purlType = ECOSYSTEM_TO_PURL[dep.ecosystem];
+  if (!purlType) {
+    throw new Error(`Unsupported ecosystem: ${dep.ecosystem}`);
+  }
+  const version = dep.resolved_version ?? dep.declared_constraint;
+  if (!version) {
+    throw new Error(`No version or constraint available for dependency: ${dep.package_name}`);
+  }
+  if (!dep.package_name) {
+    throw new Error("Dependency package_name is required");
+  }
+  const purl = `pkg:${purlType}/${dep.package_name}@${version}`;
+  const scope = dep.scope === "production" ? "required" : "optional";
+  const component = {
+    type: "library",
+    name: dep.package_name,
+    version,
+    purl,
+    scope,
+    properties: [
+      { name: "kirograph:declaredConstraint", value: dep.declared_constraint }
+    ]
+  };
+  return component;
+}
+function deserializeComponentToDependency(component) {
+  if (!component.purl) {
+    throw new Error(`Component "${component.name}" is missing purl`);
+  }
+  if (!component.name) {
+    throw new Error("Component name is required");
+  }
+  const purlMatch = component.purl.match(/^pkg:([^/]+)\/(.+)@(.+)$/);
+  if (!purlMatch) {
+    throw new Error(`Invalid purl format: ${component.purl}`);
+  }
+  const [, purlType, purlName, purlVersion] = purlMatch;
+  const ecosystem = PURL_TO_ECOSYSTEM[purlType];
+  if (!ecosystem) {
+    throw new Error(`Unsupported purl type: ${purlType}`);
+  }
+  const constraintProp = component.properties?.find(
+    (p) => p.name === "kirograph:declaredConstraint"
+  );
+  const declaredConstraint = constraintProp?.value ?? component.version;
+  const scope = component.scope === "optional" ? "optional" : "production";
+  const row = {
+    node_id: `dep:${ecosystem}:${purlName}`,
+    ecosystem,
+    package_name: purlName,
+    declared_constraint: declaredConstraint,
+    resolved_version: purlVersion,
+    scope,
+    transitive_status: "complete",
+    last_vuln_check: null,
+    vuln_data_stale: 0,
+    vuln_data_stale_since: null,
+    source_manifests: "[]"
+  };
+  return row;
+}
+function serializeAll(deps) {
+  const components = [];
+  const errors = [];
+  for (const dep of deps) {
+    try {
+      const component = serializeDependencyToComponent(dep);
+      components.push(component);
+    } catch (err) {
+      errors.push({
+        name: dep.package_name || dep.node_id || "unknown",
+        reason: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return { components, errors };
+}
+function deserializeAll(components) {
+  const deps = [];
+  const errors = [];
+  for (const component of components) {
+    try {
+      const dep = deserializeComponentToDependency(component);
+      deps.push(dep);
+    } catch (err) {
+      errors.push({
+        name: component.name || "unknown",
+        reason: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return { deps, errors };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  deserializeAll,
+  deserializeComponentToDependency,
+  serializeAll,
+  serializeDependencyToComponent
+});
+//# sourceMappingURL=serialization.js.map

package/dist/security/export/serialization.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/export/serialization.ts"],
+  "sourcesContent": ["/**\n * CycloneDX serialization utilities for Dependency_Nodes.\n *\n * Provides serialize/deserialize between DependencyRow (sec_dependencies table)\n * and CycloneDX JSON component format, with partial failure resilience.\n *\n * Requirements: 8.2, 8.3, 8.4\n */\nimport type { CycloneDXComponent } from '../types';\n\n// \u2500\u2500 Interfaces \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Represents a row from the sec_dependencies table.\n */\nexport interface DependencyRow {\n  node_id: string;\n  ecosystem: string;\n  package_name: string;\n  declared_constraint: string;\n  resolved_version: string | null;\n  scope: 'production' | 'development' | 'optional';\n  transitive_status: 'complete' | 'incomplete';\n  last_vuln_check: number | null;\n  vuln_data_stale: number;\n  vuln_data_stale_since: number | null;\n  source_manifests: string; // JSON array of manifest paths\n}\n\n/**\n * Error reported when a single node fails serialization/deserialization.\n */\nexport interface SerializationError {\n  name: string;\n  reason: string;\n}\n\n// \u2500\u2500 Ecosystem \u2194 purl type mapping \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst ECOSYSTEM_TO_PURL: Record<string, string> = {\n  npm: 'npm',\n  maven: 'maven',\n  go: 'golang',\n  pypi: 'pypi',\n  cargo: 'cargo',\n};\n\nconst PURL_TO_ECOSYSTEM: Record<string, string> = {\n  npm: 'npm',\n  maven: 'maven',\n  golang: 'go',\n  pypi: 'pypi',\n  cargo: 'cargo',\n};\n\n// \u2500\u2500 Single-item serialization \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Converts a dependency database row to a CycloneDX component object.\n * Stores the declared constraint in a `properties` array entry with\n * name \"kirograph:declaredConstraint\".\n *\n * The purl format is: pkg:<ecosystem>/<name>@<version>\n */\nexport function serializeDependencyToComponent(dep: DependencyRow): CycloneDXComponent {\n  const purlType = ECOSYSTEM_TO_PURL[dep.ecosystem];\n  if (!purlType) {\n    throw new Error(`Unsupported ecosystem: ${dep.ecosystem}`);\n  }\n\n  const version = dep.resolved_version ?? dep.declared_constraint;\n  if (!version) {\n    throw new Error(`No version or constraint available for dependency: ${dep.package_name}`);\n  }\n\n  if (!dep.package_name) {\n    throw new Error('Dependency package_name is required');\n  }\n\n  const purl = `pkg:${purlType}/${dep.package_name}@${version}`;\n\n  const scope: 'required' | 'optional' =\n    dep.scope === 'production' ? 'required' : 'optional';\n\n  const component: CycloneDXComponent = {\n    type: 'library',\n    name: dep.package_name,\n    version,\n    purl,\n    scope,\n    properties: [\n      { name: 'kirograph:declaredConstraint', value: dep.declared_constraint },\n    ],\n  };\n\n  return component;\n}\n\n// \u2500\u2500 Single-item deserialization \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Converts a CycloneDX component back to a dependency row.\n * Extracts the constraint from the properties array.\n */\nexport function deserializeComponentToDependency(component: CycloneDXComponent): DependencyRow {\n  if (!component.purl) {\n    throw new Error(`Component \"${component.name}\" is missing purl`);\n  }\n\n  if (!component.name) {\n    throw new Error('Component name is required');\n  }\n\n  // Parse purl: pkg:<type>/<name>@<version>\n  const purlMatch = component.purl.match(/^pkg:([^/]+)\\/(.+)@(.+)$/);\n  if (!purlMatch) {\n    throw new Error(`Invalid purl format: ${component.purl}`);\n  }\n\n  const [, purlType, purlName, purlVersion] = purlMatch;\n\n  const ecosystem = PURL_TO_ECOSYSTEM[purlType];\n  if (!ecosystem) {\n    throw new Error(`Unsupported purl type: ${purlType}`);\n  }\n\n  // Extract declared constraint from properties\n  const constraintProp = component.properties?.find(\n    (p) => p.name === 'kirograph:declaredConstraint',\n  );\n  const declaredConstraint = constraintProp?.value ?? component.version;\n\n  // Map CycloneDX scope back to dependency scope\n  const scope: 'production' | 'development' | 'optional' =\n    component.scope === 'optional' ? 'optional' : 'production';\n\n  const row: DependencyRow = {\n    node_id: `dep:${ecosystem}:${purlName}`,\n    ecosystem,\n    package_name: purlName,\n    declared_constraint: declaredConstraint,\n    resolved_version: purlVersion,\n    scope,\n    transitive_status: 'complete',\n    last_vuln_check: null,\n    vuln_data_stale: 0,\n    vuln_data_stale_since: null,\n    source_manifests: '[]',\n  };\n\n  return row;\n}\n\n// \u2500\u2500 Batch serialization with partial failure resilience \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Serializes all dependencies, collecting errors for any that fail\n * without aborting the batch.\n */\nexport function serializeAll(deps: DependencyRow[]): {\n  components: CycloneDXComponent[];\n  errors: SerializationError[];\n} {\n  const components: CycloneDXComponent[] = [];\n  const errors: SerializationError[] = [];\n\n  for (const dep of deps) {\n    try {\n      const component = serializeDependencyToComponent(dep);\n      components.push(component);\n    } catch (err) {\n      errors.push({\n        name: dep.package_name || dep.node_id || 'unknown',\n        reason: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return { components, errors };\n}\n\n/**\n * Deserializes all components back to dependency rows,\n * collecting errors for any that fail without aborting the batch.\n */\nexport function deserializeAll(components: CycloneDXComponent[]): {\n  deps: DependencyRow[];\n  errors: SerializationError[];\n} {\n  const deps: DependencyRow[] = [];\n  const errors: SerializationError[] = [];\n\n  for (const component of components) {\n    try {\n      const dep = deserializeComponentToDependency(component);\n      deps.push(dep);\n    } catch (err) {\n      errors.push({\n        name: component.name || 'unknown',\n        reason: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return { deps, errors };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuCA,MAAM,oBAA4C;AAAA,EAChD,KAAK;AAAA,EACL,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,OAAO;AACT;AAEA,MAAM,oBAA4C;AAAA,EAChD,KAAK;AAAA,EACL,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAO;AACT;AAWO,SAAS,+BAA+B,KAAwC;AACrF,QAAM,WAAW,kBAAkB,IAAI,SAAS;AAChD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,0BAA0B,IAAI,SAAS,EAAE;AAAA,EAC3D;AAEA,QAAM,UAAU,IAAI,oBAAoB,IAAI;AAC5C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,sDAAsD,IAAI,YAAY,EAAE;AAAA,EAC1F;AAEA,MAAI,CAAC,IAAI,cAAc;AACrB,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,QAAM,OAAO,OAAO,QAAQ,IAAI,IAAI,YAAY,IAAI,OAAO;AAE3D,QAAM,QACJ,IAAI,UAAU,eAAe,aAAa;AAE5C,QAAM,YAAgC;AAAA,IACpC,MAAM;AAAA,IACN,MAAM,IAAI;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,MACV,EAAE,MAAM,gCAAgC,OAAO,IAAI,oBAAoB;AAAA,IACzE;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,iCAAiC,WAA8C;AAC7F,MAAI,CAAC,UAAU,MAAM;AACnB,UAAM,IAAI,MAAM,cAAc,UAAU,IAAI,mBAAmB;AAAA,EACjE;AAEA,MAAI,CAAC,UAAU,MAAM;AACnB,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAGA,QAAM,YAAY,UAAU,KAAK,MAAM,0BAA0B;AACjE,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,wBAAwB,UAAU,IAAI,EAAE;AAAA,EAC1D;AAEA,QAAM,CAAC,EAAE,UAAU,UAAU,WAAW,IAAI;AAE5C,QAAM,YAAY,kBAAkB,QAAQ;AAC5C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,0BAA0B,QAAQ,EAAE;AAAA,EACtD;AAGA,QAAM,iBAAiB,UAAU,YAAY;AAAA,IAC3C,CAAC,MAAM,EAAE,SAAS;AAAA,EACpB;AACA,QAAM,qBAAqB,gBAAgB,SAAS,UAAU;AAG9D,QAAM,QACJ,UAAU,UAAU,aAAa,aAAa;AAEhD,QAAM,MAAqB;AAAA,IACzB,SAAS,OAAO,SAAS,IAAI,QAAQ;AAAA,IACrC;AAAA,IACA,cAAc;AAAA,IACd,qBAAqB;AAAA,IACrB,kBAAkB;AAAA,IAClB;AAAA,IACA,mBAAmB;AAAA,IACnB,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,uBAAuB;AAAA,IACvB,kBAAkB;AAAA,EACpB;AAEA,SAAO;AACT;AAQO,SAAS,aAAa,MAG3B;AACA,QAAM,aAAmC,CAAC;AAC1C,QAAM,SAA+B,CAAC;AAEtC,aAAW,OAAO,MAAM;AACtB,QAAI;AACF,YAAM,YAAY,+BAA+B,GAAG;AACpD,iBAAW,KAAK,SAAS;AAAA,IAC3B,SAAS,KAAK;AACZ,aAAO,KAAK;AAAA,QACV,MAAM,IAAI,gBAAgB,IAAI,WAAW;AAAA,QACzC,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACzD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,YAAY,OAAO;AAC9B;AAMO,SAAS,eAAe,YAG7B;AACA,QAAM,OAAwB,CAAC;AAC/B,QAAM,SAA+B,CAAC;AAEtC,aAAW,aAAa,YAAY;AAClC,QAAI;AACF,YAAM,MAAM,iCAAiC,SAAS;AACtD,WAAK,KAAK,GAAG;AAAA,IACf,SAAS,KAAK;AACZ,aAAO,KAAK;AAAA,QACV,MAAM,UAAU,QAAQ;AAAA,QACxB,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACzD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,OAAO;AACxB;",
+  "names": []
+}

package/dist/security/export/vex.d.ts

@@ -0,0 +1,58 @@
+/**
+ * KiroGraph-Sec VEX Exporter
+ *
+ * Generates CycloneDX 1.5 VEX (Vulnerability Exploitability eXchange) documents
+ * with reachability-informed vulnerability status. Each Vulnerability_Node is
+ * mapped to a VEX entry with an analysis state derived from the reachability verdict.
+ *
+ * Requirements: 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 7.8
+ */
+import type { GraphDatabase } from '../../db/database';
+import type { CycloneDXVEX } from '../types';
+/**
+ * VEXExporter serializes vulnerability assessments with reachability verdicts
+ * into CycloneDX 1.5 VEX format.
+ */
+export declare class VEXExporter {
+    private readonly db;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, projectRoot: string);
+    /**
+     * Generate CycloneDX 1.5 VEX JSON object.
+     *
+     * Queries all Vulnerability_Nodes and their reachability verdicts,
+     * producing one VEX entry per vulnerability.
+     */
+    export(): CycloneDXVEX;
+    /**
+     * Export to pretty-printed JSON string.
+     */
+    exportJSON(): string;
+    /**
+     * Build a single CycloneDX vulnerability entry from a Vulnerability_Node.
+     *
+     * Maps reachability verdicts to CycloneDX analysis states:
+     * - affected → "affected" with path summary detail
+     * - not_affected → "not_affected" with justification "code_not_reachable"
+     * - under_investigation → "under_investigation" with unresolved symbols detail
+     * - no reachability data → "under_investigation" with pending analysis detail
+     */
+    private buildVulnerabilityEntry;
+    /**
+     * Build the analysis section based on the reachability verdict.
+     */
+    private buildAnalysis;
+    /**
+     * Build analysis detail for "affected" verdict.
+     *
+     * Includes: entry point count, layer count, shortest path length.
+     */
+    private buildAffectedAnalysis;
+    /**
+     * Build analysis detail for "under_investigation" verdict.
+     *
+     * Lists unresolved symbols or states pending analysis reason.
+     */
+    private buildUnderInvestigationAnalysis;
+}
+//# sourceMappingURL=vex.d.ts.map

package/dist/security/export/vex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vex.d.ts","sourceRoot":"","sources":["../../../src/security/export/vex.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAA4C,MAAM,UAAU,CAAC;AAMvF;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAKlD;;;;;OAKG;IACH,MAAM,IAAI,YAAY;IAiDtB;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;;;;;;;OAQG;IACH,OAAO,CAAC,uBAAuB;IA6D/B;;OAEG;IACH,OAAO,CAAC,aAAa;IAgCrB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAuC7B;;;;OAIG;IACH,OAAO,CAAC,+BAA+B;CAoBxC"}

package/dist/security/export/vex.js

@@ -0,0 +1,220 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var vex_exports = {};
+__export(vex_exports, {
+  VEXExporter: () => VEXExporter
+});
+module.exports = __toCommonJS(vex_exports);
+var path = __toESM(require("path"));
+const TOOL_NAME = "kirograph-sec";
+const TOOL_VERSION = "0.1.0";
+class VEXExporter {
+  constructor(db, projectRoot) {
+    this.db = db;
+    this.projectRoot = projectRoot;
+  }
+  /**
+   * Generate CycloneDX 1.5 VEX JSON object.
+   *
+   * Queries all Vulnerability_Nodes and their reachability verdicts,
+   * producing one VEX entry per vulnerability.
+   */
+  export() {
+    const rawDb = this.db.getRawDb();
+    const projectName = path.basename(this.projectRoot);
+    const metadata = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      tools: {
+        components: [
+          {
+            type: "application",
+            name: TOOL_NAME,
+            version: TOOL_VERSION
+          }
+        ]
+      },
+      component: {
+        type: "application",
+        name: projectName
+      }
+    };
+    const vulnRows = rawDb.all(
+      `SELECT node_id, cve_id, severity_score, source_database FROM sec_vulnerabilities`
+    );
+    const vulnerabilities = [];
+    for (const vuln of vulnRows) {
+      const entry = this.buildVulnerabilityEntry(rawDb, vuln);
+      vulnerabilities.push(entry);
+    }
+    return {
+      bomFormat: "CycloneDX",
+      specVersion: "1.5",
+      version: 1,
+      metadata,
+      vulnerabilities
+    };
+  }
+  /**
+   * Export to pretty-printed JSON string.
+   */
+  exportJSON() {
+    return JSON.stringify(this.export(), null, 2);
+  }
+  /**
+   * Build a single CycloneDX vulnerability entry from a Vulnerability_Node.
+   *
+   * Maps reachability verdicts to CycloneDX analysis states:
+   * - affected → "affected" with path summary detail
+   * - not_affected → "not_affected" with justification "code_not_reachable"
+   * - under_investigation → "under_investigation" with unresolved symbols detail
+   * - no reachability data → "under_investigation" with pending analysis detail
+   */
+  buildVulnerabilityEntry(rawDb, vuln) {
+    const entry = {
+      id: vuln.cve_id,
+      source: {
+        name: vuln.source_database
+      }
+    };
+    if (vuln.severity_score != null) {
+      entry.ratings = [
+        {
+          score: vuln.severity_score,
+          method: "CVSSv31"
+        }
+      ];
+    }
+    const depEdge = rawDb.get(
+      `SELECT source FROM edges WHERE target = ? AND kind = 'has_vulnerability'`,
+      [vuln.node_id]
+    );
+    if (depEdge) {
+      const depRow = rawDb.get(
+        `SELECT ecosystem, package_name, resolved_version, declared_constraint
+         FROM sec_dependencies WHERE node_id = ?`,
+        [depEdge.source]
+      );
+      if (depRow) {
+        const version = depRow.resolved_version || depRow.declared_constraint;
+        const purl = `pkg:${depRow.ecosystem}/${depRow.package_name}@${version}`;
+        entry.affects = [{ ref: purl }];
+      }
+    }
+    const reachRow = rawDb.get(
+      `SELECT verdict, paths, unresolved_symbols, reaching_entry_point_count
+       FROM sec_reachability WHERE vulnerability_node_id = ?`,
+      [vuln.node_id]
+    );
+    if (!reachRow) {
+      entry.analysis = {
+        state: "under_investigation",
+        detail: "Reachability analysis has not yet been executed for this vulnerability."
+      };
+    } else {
+      entry.analysis = this.buildAnalysis(rawDb, vuln.node_id, reachRow);
+    }
+    return entry;
+  }
+  /**
+   * Build the analysis section based on the reachability verdict.
+   */
+  buildAnalysis(rawDb, vulnerabilityNodeId, reachRow) {
+    switch (reachRow.verdict) {
+      case "affected":
+        return this.buildAffectedAnalysis(rawDb, vulnerabilityNodeId, reachRow);
+      case "not_affected":
+        return {
+          state: "not_affected",
+          justification: "code_not_reachable",
+          detail: "No reachable path found from any application entry point to this dependency."
+        };
+      case "under_investigation":
+        return this.buildUnderInvestigationAnalysis(reachRow);
+      default:
+        return {
+          state: "under_investigation",
+          detail: "Reachability analysis pending."
+        };
+    }
+  }
+  /**
+   * Build analysis detail for "affected" verdict.
+   *
+   * Includes: entry point count, layer count, shortest path length.
+   */
+  buildAffectedAnalysis(rawDb, vulnerabilityNodeId, reachRow) {
+    const entryPointCount = reachRow.reaching_entry_point_count;
+    const impactRow = rawDb.get(
+      `SELECT affected_layers, distinct_path_count FROM sec_impact WHERE vulnerability_node_id = ?`,
+      [vulnerabilityNodeId]
+    );
+    let layerCount = 0;
+    if (impactRow && impactRow.affected_layers) {
+      const layers = JSON.parse(impactRow.affected_layers);
+      layerCount = layers.length;
+    }
+    let shortestPathLength = 0;
+    if (reachRow.paths) {
+      const paths = JSON.parse(reachRow.paths);
+      if (paths.length > 0) {
+        shortestPathLength = Math.min(...paths.map((p) => p.path.length));
+      }
+    }
+    const detail = `Reachable from ${entryPointCount} entry point${entryPointCount !== 1 ? "s" : ""} via ${layerCount} layer${layerCount !== 1 ? "s" : ""}. Shortest path length: ${shortestPathLength} nodes.`;
+    return {
+      state: "affected",
+      detail
+    };
+  }
+  /**
+   * Build analysis detail for "under_investigation" verdict.
+   *
+   * Lists unresolved symbols or states pending analysis reason.
+   */
+  buildUnderInvestigationAnalysis(reachRow) {
+    if (reachRow.unresolved_symbols) {
+      const symbols = JSON.parse(reachRow.unresolved_symbols);
+      if (symbols.length > 0) {
+        return {
+          state: "under_investigation",
+          detail: `${symbols.length} unresolved symbol${symbols.length !== 1 ? "s" : ""} blocked complete analysis: ${symbols.join(", ")}`
+        };
+      }
+    }
+    return {
+      state: "under_investigation",
+      detail: "Reachability analysis pending."
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  VEXExporter
+});
+//# sourceMappingURL=vex.js.map

package/dist/security/export/vex.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/export/vex.ts"],
+  "sourcesContent": ["/**\n * KiroGraph-Sec VEX Exporter\n *\n * Generates CycloneDX 1.5 VEX (Vulnerability Exploitability eXchange) documents\n * with reachability-informed vulnerability status. Each Vulnerability_Node is\n * mapped to a VEX entry with an analysis state derived from the reachability verdict.\n *\n * Requirements: 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 7.8\n */\n\nimport * as path from 'path';\nimport type { GraphDatabase } from '../../db/database';\nimport type { CycloneDXVEX, CycloneDXVulnerability, ReachabilityPath } from '../types';\n\n/** Tool metadata for VEX document */\nconst TOOL_NAME = 'kirograph-sec';\nconst TOOL_VERSION = '0.1.0';\n\n/**\n * VEXExporter serializes vulnerability assessments with reachability verdicts\n * into CycloneDX 1.5 VEX format.\n */\nexport class VEXExporter {\n  private readonly db: GraphDatabase;\n  private readonly projectRoot: string;\n\n  constructor(db: GraphDatabase, projectRoot: string) {\n    this.db = db;\n    this.projectRoot = projectRoot;\n  }\n\n  /**\n   * Generate CycloneDX 1.5 VEX JSON object.\n   *\n   * Queries all Vulnerability_Nodes and their reachability verdicts,\n   * producing one VEX entry per vulnerability.\n   */\n  export(): CycloneDXVEX {\n    const rawDb = this.db.getRawDb();\n    const projectName = path.basename(this.projectRoot);\n\n    // Build metadata\n    const metadata: Record<string, unknown> = {\n      timestamp: new Date().toISOString(),\n      tools: {\n        components: [\n          {\n            type: 'application',\n            name: TOOL_NAME,\n            version: TOOL_VERSION,\n          },\n        ],\n      },\n      component: {\n        type: 'application',\n        name: projectName,\n      },\n    };\n\n    // Query all vulnerability nodes\n    const vulnRows: Array<{\n      node_id: string;\n      cve_id: string;\n      severity_score: number | null;\n      source_database: string;\n    }> = rawDb.all(\n      `SELECT node_id, cve_id, severity_score, source_database FROM sec_vulnerabilities`,\n    );\n\n    // Build vulnerability entries\n    const vulnerabilities: CycloneDXVulnerability[] = [];\n\n    for (const vuln of vulnRows) {\n      const entry = this.buildVulnerabilityEntry(rawDb, vuln);\n      vulnerabilities.push(entry);\n    }\n\n    return {\n      bomFormat: 'CycloneDX',\n      specVersion: '1.5',\n      version: 1,\n      metadata,\n      vulnerabilities,\n    };\n  }\n\n  /**\n   * Export to pretty-printed JSON string.\n   */\n  exportJSON(): string {\n    return JSON.stringify(this.export(), null, 2);\n  }\n\n  /**\n   * Build a single CycloneDX vulnerability entry from a Vulnerability_Node.\n   *\n   * Maps reachability verdicts to CycloneDX analysis states:\n   * - affected \u2192 \"affected\" with path summary detail\n   * - not_affected \u2192 \"not_affected\" with justification \"code_not_reachable\"\n   * - under_investigation \u2192 \"under_investigation\" with unresolved symbols detail\n   * - no reachability data \u2192 \"under_investigation\" with pending analysis detail\n   */\n  private buildVulnerabilityEntry(\n    rawDb: any,\n    vuln: { node_id: string; cve_id: string; severity_score: number | null; source_database: string },\n  ): CycloneDXVulnerability {\n    const entry: CycloneDXVulnerability = {\n      id: vuln.cve_id,\n      source: {\n        name: vuln.source_database,\n      },\n    };\n\n    // Add severity rating if available\n    if (vuln.severity_score != null) {\n      entry.ratings = [\n        {\n          score: vuln.severity_score,\n          method: 'CVSSv31',\n        },\n      ];\n    }\n\n    // Find the affected component purl via has_vulnerability edge\n    const depEdge = rawDb.get(\n      `SELECT source FROM edges WHERE target = ? AND kind = 'has_vulnerability'`,\n      [vuln.node_id],\n    );\n\n    if (depEdge) {\n      const depRow = rawDb.get(\n        `SELECT ecosystem, package_name, resolved_version, declared_constraint\n         FROM sec_dependencies WHERE node_id = ?`,\n        [depEdge.source],\n      );\n\n      if (depRow) {\n        const version = depRow.resolved_version || depRow.declared_constraint;\n        const purl = `pkg:${depRow.ecosystem}/${depRow.package_name}@${version}`;\n        entry.affects = [{ ref: purl }];\n      }\n    }\n\n    // Query reachability verdict\n    const reachRow = rawDb.get(\n      `SELECT verdict, paths, unresolved_symbols, reaching_entry_point_count\n       FROM sec_reachability WHERE vulnerability_node_id = ?`,\n      [vuln.node_id],\n    );\n\n    if (!reachRow) {\n      // No reachability analysis performed (Requirement 7.5)\n      entry.analysis = {\n        state: 'under_investigation',\n        detail: 'Reachability analysis has not yet been executed for this vulnerability.',\n      };\n    } else {\n      entry.analysis = this.buildAnalysis(rawDb, vuln.node_id, reachRow);\n    }\n\n    return entry;\n  }\n\n  /**\n   * Build the analysis section based on the reachability verdict.\n   */\n  private buildAnalysis(\n    rawDb: any,\n    vulnerabilityNodeId: string,\n    reachRow: {\n      verdict: string;\n      paths: string | null;\n      unresolved_symbols: string | null;\n      reaching_entry_point_count: number;\n    },\n  ): CycloneDXVulnerability['analysis'] {\n    switch (reachRow.verdict) {\n      case 'affected':\n        return this.buildAffectedAnalysis(rawDb, vulnerabilityNodeId, reachRow);\n\n      case 'not_affected':\n        return {\n          state: 'not_affected',\n          justification: 'code_not_reachable',\n          detail: 'No reachable path found from any application entry point to this dependency.',\n        };\n\n      case 'under_investigation':\n        return this.buildUnderInvestigationAnalysis(reachRow);\n\n      default:\n        return {\n          state: 'under_investigation',\n          detail: 'Reachability analysis pending.',\n        };\n    }\n  }\n\n  /**\n   * Build analysis detail for \"affected\" verdict.\n   *\n   * Includes: entry point count, layer count, shortest path length.\n   */\n  private buildAffectedAnalysis(\n    rawDb: any,\n    vulnerabilityNodeId: string,\n    reachRow: {\n      paths: string | null;\n      reaching_entry_point_count: number;\n    },\n  ): CycloneDXVulnerability['analysis'] {\n    const entryPointCount = reachRow.reaching_entry_point_count;\n\n    // Get impact summary for layer information\n    const impactRow = rawDb.get(\n      `SELECT affected_layers, distinct_path_count FROM sec_impact WHERE vulnerability_node_id = ?`,\n      [vulnerabilityNodeId],\n    );\n\n    let layerCount = 0;\n    if (impactRow && impactRow.affected_layers) {\n      const layers: string[] = JSON.parse(impactRow.affected_layers);\n      layerCount = layers.length;\n    }\n\n    // Calculate shortest path length from stored paths\n    let shortestPathLength = 0;\n    if (reachRow.paths) {\n      const paths: ReachabilityPath[] = JSON.parse(reachRow.paths);\n      if (paths.length > 0) {\n        shortestPathLength = Math.min(...paths.map(p => p.path.length));\n      }\n    }\n\n    const detail = `Reachable from ${entryPointCount} entry point${entryPointCount !== 1 ? 's' : ''} via ${layerCount} layer${layerCount !== 1 ? 's' : ''}. Shortest path length: ${shortestPathLength} nodes.`;\n\n    return {\n      state: 'affected',\n      detail,\n    };\n  }\n\n  /**\n   * Build analysis detail for \"under_investigation\" verdict.\n   *\n   * Lists unresolved symbols or states pending analysis reason.\n   */\n  private buildUnderInvestigationAnalysis(\n    reachRow: {\n      unresolved_symbols: string | null;\n    },\n  ): CycloneDXVulnerability['analysis'] {\n    if (reachRow.unresolved_symbols) {\n      const symbols: string[] = JSON.parse(reachRow.unresolved_symbols);\n      if (symbols.length > 0) {\n        return {\n          state: 'under_investigation',\n          detail: `${symbols.length} unresolved symbol${symbols.length !== 1 ? 's' : ''} blocked complete analysis: ${symbols.join(', ')}`,\n        };\n      }\n    }\n\n    return {\n      state: 'under_investigation',\n      detail: 'Reachability analysis pending.',\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,WAAsB;AAKtB,MAAM,YAAY;AAClB,MAAM,eAAe;AAMd,MAAM,YAAY;AAAA,EAIvB,YAAY,IAAmB,aAAqB;AAClD,SAAK,KAAK;AACV,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAuB;AACrB,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,cAAc,KAAK,SAAS,KAAK,WAAW;AAGlD,UAAM,WAAoC;AAAA,MACxC,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,OAAO;AAAA,QACL,YAAY;AAAA,UACV;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,UAAM,WAKD,MAAM;AAAA,MACT;AAAA,IACF;AAGA,UAAM,kBAA4C,CAAC;AAEnD,eAAW,QAAQ,UAAU;AAC3B,YAAM,QAAQ,KAAK,wBAAwB,OAAO,IAAI;AACtD,sBAAgB,KAAK,KAAK;AAAA,IAC5B;AAEA,WAAO;AAAA,MACL,WAAW;AAAA,MACX,aAAa;AAAA,MACb,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,aAAqB;AACnB,WAAO,KAAK,UAAU,KAAK,OAAO,GAAG,MAAM,CAAC;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,wBACN,OACA,MACwB;AACxB,UAAM,QAAgC;AAAA,MACpC,IAAI,KAAK;AAAA,MACT,QAAQ;AAAA,QACN,MAAM,KAAK;AAAA,MACb;AAAA,IACF;AAGA,QAAI,KAAK,kBAAkB,MAAM;AAC/B,YAAM,UAAU;AAAA,QACd;AAAA,UACE,OAAO,KAAK;AAAA,UACZ,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,CAAC,KAAK,OAAO;AAAA,IACf;AAEA,QAAI,SAAS;AACX,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA;AAAA,QAEA,CAAC,QAAQ,MAAM;AAAA,MACjB;AAEA,UAAI,QAAQ;AACV,cAAM,UAAU,OAAO,oBAAoB,OAAO;AAClD,cAAM,OAAO,OAAO,OAAO,SAAS,IAAI,OAAO,YAAY,IAAI,OAAO;AACtE,cAAM,UAAU,CAAC,EAAE,KAAK,KAAK,CAAC;AAAA,MAChC;AAAA,IACF;AAGA,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA;AAAA,MAEA,CAAC,KAAK,OAAO;AAAA,IACf;AAEA,QAAI,CAAC,UAAU;AAEb,YAAM,WAAW;AAAA,QACf,OAAO;AAAA,QACP,QAAQ;AAAA,MACV;AAAA,IACF,OAAO;AACL,YAAM,WAAW,KAAK,cAAc,OAAO,KAAK,SAAS,QAAQ;AAAA,IACnE;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,cACN,OACA,qBACA,UAMoC;AACpC,YAAQ,SAAS,SAAS;AAAA,MACxB,KAAK;AACH,eAAO,KAAK,sBAAsB,OAAO,qBAAqB,QAAQ;AAAA,MAExE,KAAK;AACH,eAAO;AAAA,UACL,OAAO;AAAA,UACP,eAAe;AAAA,UACf,QAAQ;AAAA,QACV;AAAA,MAEF,KAAK;AACH,eAAO,KAAK,gCAAgC,QAAQ;AAAA,MAEtD;AACE,eAAO;AAAA,UACL,OAAO;AAAA,UACP,QAAQ;AAAA,QACV;AAAA,IACJ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,sBACN,OACA,qBACA,UAIoC;AACpC,UAAM,kBAAkB,SAAS;AAGjC,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA,CAAC,mBAAmB;AAAA,IACtB;AAEA,QAAI,aAAa;AACjB,QAAI,aAAa,UAAU,iBAAiB;AAC1C,YAAM,SAAmB,KAAK,MAAM,UAAU,eAAe;AAC7D,mBAAa,OAAO;AAAA,IACtB;AAGA,QAAI,qBAAqB;AACzB,QAAI,SAAS,OAAO;AAClB,YAAM,QAA4B,KAAK,MAAM,SAAS,KAAK;AAC3D,UAAI,MAAM,SAAS,GAAG;AACpB,6BAAqB,KAAK,IAAI,GAAG,MAAM,IAAI,OAAK,EAAE,KAAK,MAAM,CAAC;AAAA,MAChE;AAAA,IACF;AAEA,UAAM,SAAS,kBAAkB,eAAe,eAAe,oBAAoB,IAAI,MAAM,EAAE,QAAQ,UAAU,SAAS,eAAe,IAAI,MAAM,EAAE,2BAA2B,kBAAkB;AAElM,WAAO;AAAA,MACL,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,gCACN,UAGoC;AACpC,QAAI,SAAS,oBAAoB;AAC/B,YAAM,UAAoB,KAAK,MAAM,SAAS,kBAAkB;AAChE,UAAI,QAAQ,SAAS,GAAG;AACtB,eAAO;AAAA,UACL,OAAO;AAAA,UACP,QAAQ,GAAG,QAAQ,MAAM,qBAAqB,QAAQ,WAAW,IAAI,MAAM,EAAE,+BAA+B,QAAQ,KAAK,IAAI,CAAC;AAAA,QAChI;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,IACV;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * KiroGraph-Sec Module Index
+ *
+ * Exports all public interfaces, classes, and types for the security module.
+ * Used by MCP tools, CLI commands, and pipeline integration.
+ */
+export { SecurityPipeline } from './pipeline';
+export { ManifestParser } from './manifest/parser';
+export { DependencyGraphIntegrator } from './integrator';
+export { VulnerabilityDatabaseClient } from './vuln/client';
+export { OsvAdapter } from './vuln/osv-adapter';
+export type { VulnDatabaseAdapter } from './vuln/types';
+export { ReachabilityAnalyzer } from './reachability';
+export { SBOMExporter } from './export/sbom';
+export { VEXExporter } from './export/vex';
+export { buildFixSuggestion, formatFixSuggestion } from './export/fix-suggestions';
+export { getSecurityWarningsForNodes, formatSecurityWarnings } from './context-warnings';
+export type { SecurityWarning } from './context-warnings';
+export type { ParsedDependency, ManifestParseResult, IntegrationResult, TransitiveResult, CleanupResult, CVERecord, VersionRange, EnrichmentResult, ReachabilityVerdict, ReachabilityPath, ReachabilityResult, ImpactSummary, SecurityResult, SBOMMetadata, CycloneDXSBOM, CycloneDXComponent, CycloneDXDependencyEntry, CycloneDXVEX, CycloneDXVulnerability, } from './types';
+export { SecurityError, ManifestParseError, VulnDatabaseError } from './errors';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAGzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGnF,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACzF,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,wBAAwB,EACxB,YAAY,EACZ,sBAAsB,GACvB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/security/index.js

@@ -0,0 +1,67 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var security_exports = {};
+__export(security_exports, {
+  DependencyGraphIntegrator: () => import_integrator.DependencyGraphIntegrator,
+  ManifestParseError: () => import_errors.ManifestParseError,
+  ManifestParser: () => import_parser.ManifestParser,
+  OsvAdapter: () => import_osv_adapter.OsvAdapter,
+  ReachabilityAnalyzer: () => import_reachability.ReachabilityAnalyzer,
+  SBOMExporter: () => import_sbom.SBOMExporter,
+  SecurityError: () => import_errors.SecurityError,
+  SecurityPipeline: () => import_pipeline.SecurityPipeline,
+  VEXExporter: () => import_vex.VEXExporter,
+  VulnDatabaseError: () => import_errors.VulnDatabaseError,
+  VulnerabilityDatabaseClient: () => import_client.VulnerabilityDatabaseClient,
+  buildFixSuggestion: () => import_fix_suggestions.buildFixSuggestion,
+  formatFixSuggestion: () => import_fix_suggestions.formatFixSuggestion,
+  formatSecurityWarnings: () => import_context_warnings.formatSecurityWarnings,
+  getSecurityWarningsForNodes: () => import_context_warnings.getSecurityWarningsForNodes
+});
+module.exports = __toCommonJS(security_exports);
+var import_pipeline = require("./pipeline");
+var import_parser = require("./manifest/parser");
+var import_integrator = require("./integrator");
+var import_client = require("./vuln/client");
+var import_osv_adapter = require("./vuln/osv-adapter");
+var import_reachability = require("./reachability");
+var import_sbom = require("./export/sbom");
+var import_vex = require("./export/vex");
+var import_fix_suggestions = require("./export/fix-suggestions");
+var import_context_warnings = require("./context-warnings");
+var import_errors = require("./errors");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DependencyGraphIntegrator,
+  ManifestParseError,
+  ManifestParser,
+  OsvAdapter,
+  ReachabilityAnalyzer,
+  SBOMExporter,
+  SecurityError,
+  SecurityPipeline,
+  VEXExporter,
+  VulnDatabaseError,
+  VulnerabilityDatabaseClient,
+  buildFixSuggestion,
+  formatFixSuggestion,
+  formatSecurityWarnings,
+  getSecurityWarningsForNodes
+});
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/index.ts"],
+  "sourcesContent": ["/**\n * KiroGraph-Sec Module Index\n *\n * Exports all public interfaces, classes, and types for the security module.\n * Used by MCP tools, CLI commands, and pipeline integration.\n */\n\n// \u2500\u2500 Pipeline \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport { SecurityPipeline } from './pipeline';\n\n// \u2500\u2500 Manifest Parsing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport { ManifestParser } from './manifest/parser';\n\n// \u2500\u2500 Dependency Graph Integration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport { DependencyGraphIntegrator } from './integrator';\n\n// \u2500\u2500 Vulnerability Database \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport { VulnerabilityDatabaseClient } from './vuln/client';\nexport { OsvAdapter } from './vuln/osv-adapter';\nexport type { VulnDatabaseAdapter } from './vuln/types';\n\n// \u2500\u2500 Reachability Analysis \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport { ReachabilityAnalyzer } from './reachability';\n\n// \u2500\u2500 Export (SBOM / VEX) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport { SBOMExporter } from './export/sbom';\nexport { VEXExporter } from './export/vex';\nexport { buildFixSuggestion, formatFixSuggestion } from './export/fix-suggestions';\n\n// \u2500\u2500 Context Warnings \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport { getSecurityWarningsForNodes, formatSecurityWarnings } from './context-warnings';\nexport type { SecurityWarning } from './context-warnings';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport type {\n  ParsedDependency,\n  ManifestParseResult,\n  IntegrationResult,\n  TransitiveResult,\n  CleanupResult,\n  CVERecord,\n  VersionRange,\n  EnrichmentResult,\n  ReachabilityVerdict,\n  ReachabilityPath,\n  ReachabilityResult,\n  ImpactSummary,\n  SecurityResult,\n  SBOMMetadata,\n  CycloneDXSBOM,\n  CycloneDXComponent,\n  CycloneDXDependencyEntry,\n  CycloneDXVEX,\n  CycloneDXVulnerability,\n} from './types';\n\n// \u2500\u2500 Errors \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nexport { SecurityError, ManifestParseError, VulnDatabaseError } from './errors';\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,sBAAiC;AAGjC,oBAA+B;AAG/B,wBAA0C;AAG1C,oBAA4C;AAC5C,yBAA2B;AAI3B,0BAAqC;AAGrC,kBAA6B;AAC7B,iBAA4B;AAC5B,6BAAwD;AAGxD,8BAAoE;AA2BpE,oBAAqE;",
+  "names": []
+}

package/dist/security/integrator.d.ts

@@ -0,0 +1,63 @@
+import type { GraphDatabase } from '../db/database';
+import type { IntegrationResult, TransitiveResult, CleanupResult } from './types';
+export declare class DependencyGraphIntegrator {
+    private readonly db;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, projectRoot: string);
+    /**
+     * Create import/reference edges between code symbols and Dependency_Nodes.
+     *
+     * Per Requirement 2.1: creates `imports` edges from file nodes that contain
+     * import statements resolving to a dependency → the Dependency_Node.
+     *
+     * Per Requirement 2.2: creates `references` edges from code symbols that
+     * reference classes/functions from a dependency → the Dependency_Node.
+     */
+    integrate(): Promise<IntegrationResult>;
+    /**
+     * Find the file node ID for a given file path.
+     * File nodes have kind='file' and their file_path matches.
+     */
+    private findFileNodeId;
+    /**
+     * Match an import specifier to a dependency node ID.
+     *
+     * Handles:
+     * - Exact match: `express` → dep:npm:express
+     * - Scoped packages: `@scope/pkg` → dep:npm:@scope/pkg
+     * - Subpath imports: `express/Router` → dep:npm:express
+     * - Scoped subpath: `@angular/core/testing` → dep:npm:@angular/core
+     * - Go modules: `github.com/gin-gonic/gin` → dep:go:github.com/gin-gonic/gin
+     * - Go subpath: `github.com/gin-gonic/gin/internal` → dep:go:github.com/gin-gonic/gin
+     */
+    private matchImportToDependency;
+    /**
+     * Resolve transitive dependencies up to maxDepth levels.
+     *
+     * For each ecosystem with a lock file:
+     * 1. Parse the lock file to extract dependency relationships
+     * 2. Create `depends_on` edges between Dependency_Nodes
+     * 3. Traverse up to maxDepth levels of transitive depth
+     *
+     * If a lock file is missing for an ecosystem, mark all dependencies of that
+     * ecosystem with `transitive_status: 'incomplete'` and log a warning.
+     *
+     * @param maxDepth - Maximum levels of transitive depth to resolve (default: 10)
+     */
+    resolveTransitives(maxDepth?: number): Promise<TransitiveResult>;
+    /**
+     * Remove orphaned Dependency_Nodes and their edges.
+     *
+     * A Dependency_Node is orphaned if:
+     * 1. It has no `declared_in` edges (manifest no longer declares it), OR
+     * 2. None of its source manifests still exist on disk
+     *
+     * Also removes transitive Dependency_Nodes that are no longer reachable from
+     * any remaining direct dependency via `depends_on` edges.
+     *
+     * @param manifestExists - Optional function to check if a manifest path exists.
+     *   Defaults to fs.existsSync. Useful for testing.
+     */
+    cleanup(manifestExists?: (absolutePath: string) => boolean): Promise<CleanupResult>;
+}
+//# sourceMappingURL=integrator.d.ts.map

package/dist/security/integrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrator.d.ts","sourceRoot":"","sources":["../../src/security/integrator.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAmNlF,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAKlD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAwG7C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,uBAAuB;IAmD/B;;;;;;;;;;;;OAYG;IACG,kBAAkB,CAAC,QAAQ,GAAE,MAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAmI1E;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;CA2G1F"}