kirograph 0.17.0 → 0.20.0

package/dist/security/manifest/plugins/swift.js

@@ -0,0 +1,200 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var swift_exports = {};
+__export(swift_exports, {
+  parseSwiftManifest: () => parseSwiftManifest
+});
+module.exports = __toCommonJS(swift_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var import_errors = require("../../../errors");
+async function parseSwiftManifest(manifestPath, projectRoot) {
+  const manifestDir = path.dirname(manifestPath);
+  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\/g, "/");
+  const resolved = loadPackageResolved(manifestDir);
+  if (resolved.size > 0 || hasPackageResolved(manifestDir)) {
+    return buildFromResolved(resolved, relativeManifest);
+  }
+  let content;
+  try {
+    content = fs.readFileSync(manifestPath, "utf8");
+  } catch (err) {
+    (0, import_errors.logWarn)(`[sec:swift] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);
+    return [];
+  }
+  const rawDeps = extractFromPackageSwift(content, relativeManifest);
+  return rawDeps.map((dep) => ({
+    name: dep.name,
+    declaredConstraint: dep.constraint,
+    resolvedVersion: dep.resolvedVersion,
+    scope: "production",
+    ecosystem: "swift",
+    sourceManifest: relativeManifest
+  }));
+}
+function buildFromResolved(resolved, relativeManifest) {
+  const deps = [];
+  for (const [name, version] of resolved) {
+    deps.push({
+      name,
+      declaredConstraint: version,
+      resolvedVersion: version,
+      scope: "production",
+      ecosystem: "swift",
+      sourceManifest: relativeManifest
+    });
+  }
+  return deps;
+}
+function extractFromPackageSwift(content, relativeManifest) {
+  const deps = [];
+  const packagePattern = /\.package\s*\(\s*url\s*:\s*"([^"]+)"[^)]+\)/gs;
+  let match;
+  while ((match = packagePattern.exec(content)) !== null) {
+    const url = match[1];
+    const fullMatch = match[0];
+    const name = packageNameFromUrl(url);
+    if (!name) {
+      (0, import_errors.logWarn)(`[sec:swift] Could not derive package name from URL "${url}" in ${relativeManifest} \u2014 skipping`);
+      continue;
+    }
+    const constraint = extractVersionConstraint(fullMatch, relativeManifest);
+    deps.push({ name, constraint });
+  }
+  return deps;
+}
+function extractVersionConstraint(packageCall, relativeManifest) {
+  const fromMatch = packageCall.match(/\bfrom\s*:\s*"([^"]+)"/);
+  if (fromMatch) return `from: ${fromMatch[1]}`;
+  const exactMatch = packageCall.match(/\bexact\s*:\s*"([^"]+)"/);
+  if (exactMatch) return `exact: ${exactMatch[1]}`;
+  const upToMajorMatch = packageCall.match(/\.upToNextMajor\s*\(\s*from\s*:\s*"([^"]+)"\s*\)/);
+  if (upToMajorMatch) return `upToNextMajor: ${upToMajorMatch[1]}`;
+  const upToMinorMatch = packageCall.match(/\.upToNextMinor\s*\(\s*from\s*:\s*"([^"]+)"\s*\)/);
+  if (upToMinorMatch) return `upToNextMinor: ${upToMinorMatch[1]}`;
+  const rangeMatch = packageCall.match(/"([^"]+)"\s*\.{2,3}<\s*"([^"]+)"/);
+  if (rangeMatch) return `${rangeMatch[1]} ..< ${rangeMatch[2]}`;
+  (0, import_errors.logWarn)(`[sec:swift] Unrecognised version specifier in Package.swift at ${relativeManifest} \u2014 using '*'`);
+  return "*";
+}
+function packageNameFromUrl(url) {
+  try {
+    const cleaned = url.replace(/\/+$/, "");
+    const segments = cleaned.split("/");
+    const last = segments[segments.length - 1];
+    if (!last) return null;
+    return last.replace(/\.git$/i, "").toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function hasPackageResolved(manifestDir) {
+  return fs.existsSync(path.join(manifestDir, "Package.resolved")) || fs.existsSync(path.join(manifestDir, ".build", "Package.resolved"));
+}
+function loadPackageResolved(manifestDir) {
+  const map = /* @__PURE__ */ new Map();
+  const candidates = [
+    path.join(manifestDir, "Package.resolved"),
+    path.join(manifestDir, ".build", "Package.resolved")
+  ];
+  for (const candidate of candidates) {
+    if (!fs.existsSync(candidate)) continue;
+    try {
+      const lockContent = fs.readFileSync(candidate, "utf8");
+      extractFromPackageResolved(lockContent, map, candidate);
+      return map;
+    } catch (err) {
+      (0, import_errors.logWarn)(`[sec:swift] Failed to parse ${candidate}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return map;
+}
+function extractFromPackageResolved(content, map, filePath) {
+  let data;
+  try {
+    data = JSON.parse(content);
+  } catch {
+    (0, import_errors.logWarn)(`[sec:swift] ${filePath} is not valid JSON \u2014 resolved versions unavailable`);
+    return;
+  }
+  let pins = null;
+  if (Array.isArray(data["pins"])) {
+    pins = data["pins"];
+    extractPinsV2(pins, map);
+    return;
+  }
+  const obj = data["object"];
+  if (obj && typeof obj === "object" && !Array.isArray(obj)) {
+    const objRecord = obj;
+    if (Array.isArray(objRecord["pins"])) {
+      pins = objRecord["pins"];
+      extractPinsV1(pins, map);
+      return;
+    }
+  }
+  (0, import_errors.logWarn)(`[sec:swift] ${filePath} has unrecognised Package.resolved format \u2014 resolved versions unavailable`);
+}
+function extractPinsV2(pins, map) {
+  for (const pin of pins) {
+    if (!pin || typeof pin !== "object") continue;
+    const p = pin;
+    const identity = typeof p["identity"] === "string" ? p["identity"].toLowerCase() : null;
+    const state = p["state"];
+    const version = state && typeof state === "object" && !Array.isArray(state) ? state["version"] : null;
+    if (identity && typeof version === "string" && version) {
+      if (!map.has(identity)) {
+        map.set(identity, version);
+      }
+    }
+  }
+}
+function extractPinsV1(pins, map) {
+  for (const pin of pins) {
+    if (!pin || typeof pin !== "object") continue;
+    const p = pin;
+    let name = null;
+    if (typeof p["package"] === "string" && p["package"]) {
+      name = p["package"].toLowerCase();
+    } else if (typeof p["repositoryURL"] === "string") {
+      name = packageNameFromUrl(p["repositoryURL"]);
+    }
+    const state = p["state"];
+    const version = state && typeof state === "object" && !Array.isArray(state) ? state["version"] : null;
+    if (name && typeof version === "string" && version) {
+      if (!map.has(name)) {
+        map.set(name, version);
+      }
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseSwiftManifest
+});
+//# sourceMappingURL=swift.js.map

package/dist/security/manifest/plugins/swift.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/security/manifest/plugins/swift.ts"],
+  "sourcesContent": ["/**\n * Swift Package Manager Version Extraction Plugin for KiroGraph-Sec\n *\n * Parses Package.swift manifests to extract Swift package dependencies with\n * version constraints and resolved versions from Package.resolved.\n *\n * Prefers Package.resolved (more reliable) over regex parsing of Package.swift.\n * Handles both v1 and v2 Package.resolved formats.\n *\n * Package.resolved locations searched:\n * - Same directory as Package.swift\n * - `.build/` subdirectory relative to Package.swift\n */\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { ParsedDependency } from '../../types';\nimport { logWarn } from '../../../errors';\n\n/**\n * Resolved version map: package identity \u2192 resolved version string.\n * Built from Package.resolved.\n */\ntype ResolvedVersionMap = Map<string, string>;\n\n/**\n * A raw dependency entry extracted from Package.swift or Package.resolved.\n */\ninterface RawDependency {\n  name: string;\n  constraint: string;\n  resolvedVersion?: string;\n}\n\n/**\n * Parse a Package.swift manifest and extract package dependencies with\n * version constraints and resolved versions from Package.resolved.\n *\n * @param manifestPath - Absolute path to the Package.swift file\n * @param projectRoot - Absolute path to the project root directory\n * @returns Array of parsed dependencies with version and scope information\n */\nexport async function parseSwiftManifest(\n  manifestPath: string,\n  projectRoot: string,\n): Promise<ParsedDependency[]> {\n  const manifestDir = path.dirname(manifestPath);\n  const relativeManifest = path.relative(projectRoot, manifestPath).replace(/\\\\/g, '/');\n\n  // Try to load Package.resolved first \u2014 it's more reliable than parsing Package.swift\n  const resolved = loadPackageResolved(manifestDir);\n  if (resolved.size > 0 || hasPackageResolved(manifestDir)) {\n    // We have a lock file \u2014 use its entries as the authoritative dependency list\n    return buildFromResolved(resolved, relativeManifest);\n  }\n\n  // Fallback: parse Package.swift directly\n  let content: string;\n  try {\n    content = fs.readFileSync(manifestPath, 'utf8');\n  } catch (err) {\n    logWarn(`[sec:swift] Failed to read ${relativeManifest}: ${err instanceof Error ? err.message : String(err)}`);\n    return [];\n  }\n\n  const rawDeps = extractFromPackageSwift(content, relativeManifest);\n  return rawDeps.map((dep) => ({\n    name: dep.name,\n    declaredConstraint: dep.constraint,\n    resolvedVersion: dep.resolvedVersion,\n    scope: 'production' as const,\n    ecosystem: 'swift',\n    sourceManifest: relativeManifest,\n  }));\n}\n\n/**\n * Build ParsedDependency entries from a resolved version map.\n * All Swift dependencies are production scope (SPM has no dev deps concept).\n */\nfunction buildFromResolved(\n  resolved: ResolvedVersionMap,\n  relativeManifest: string,\n): ParsedDependency[] {\n  const deps: ParsedDependency[] = [];\n  for (const [name, version] of resolved) {\n    deps.push({\n      name,\n      declaredConstraint: version,\n      resolvedVersion: version,\n      scope: 'production',\n      ecosystem: 'swift',\n      sourceManifest: relativeManifest,\n    });\n  }\n  return deps;\n}\n\n/**\n * Extract dependencies from Package.swift using regex patterns.\n *\n * Handles:\n * - `.package(url: \"...\", from: \"1.0.0\")`\n * - `.package(url: \"...\", exact: \"1.0.0\")`\n * - `.package(url: \"...\", .upToNextMajor(from: \"1.0.0\"))`\n * - `.package(url: \"...\", .upToNextMinor(from: \"1.0.0\"))`\n */\nfunction extractFromPackageSwift(content: string, relativeManifest: string): RawDependency[] {\n  const deps: RawDependency[] = [];\n\n  // Match .package(url: \"...\", <version spec>) \u2014 possibly spanning multiple lines\n  // We capture the url argument and the version specifier\n  const packagePattern = /\\.package\\s*\\(\\s*url\\s*:\\s*\"([^\"]+)\"[^)]+\\)/gs;\n  let match: RegExpExecArray | null;\n\n  while ((match = packagePattern.exec(content)) !== null) {\n    const url = match[1];\n    const fullMatch = match[0];\n\n    const name = packageNameFromUrl(url);\n    if (!name) {\n      logWarn(`[sec:swift] Could not derive package name from URL \"${url}\" in ${relativeManifest} \u2014 skipping`);\n      continue;\n    }\n\n    const constraint = extractVersionConstraint(fullMatch, relativeManifest);\n    deps.push({ name, constraint });\n  }\n\n  return deps;\n}\n\n/**\n * Extract a version constraint string from a .package(...) call.\n * Returns '*' if no recognised version spec is found.\n */\nfunction extractVersionConstraint(packageCall: string, relativeManifest: string): string {\n  // from: \"1.0.0\"\n  const fromMatch = packageCall.match(/\\bfrom\\s*:\\s*\"([^\"]+)\"/);\n  if (fromMatch) return `from: ${fromMatch[1]}`;\n\n  // exact: \"1.0.0\"\n  const exactMatch = packageCall.match(/\\bexact\\s*:\\s*\"([^\"]+)\"/);\n  if (exactMatch) return `exact: ${exactMatch[1]}`;\n\n  // .upToNextMajor(from: \"1.0.0\")\n  const upToMajorMatch = packageCall.match(/\\.upToNextMajor\\s*\\(\\s*from\\s*:\\s*\"([^\"]+)\"\\s*\\)/);\n  if (upToMajorMatch) return `upToNextMajor: ${upToMajorMatch[1]}`;\n\n  // .upToNextMinor(from: \"1.0.0\")\n  const upToMinorMatch = packageCall.match(/\\.upToNextMinor\\s*\\(\\s*from\\s*:\\s*\"([^\"]+)\"\\s*\\)/);\n  if (upToMinorMatch) return `upToNextMinor: ${upToMinorMatch[1]}`;\n\n  // Range: \"1.0.0\"..<\"2.0.0\"\n  const rangeMatch = packageCall.match(/\"([^\"]+)\"\\s*\\.{2,3}<\\s*\"([^\"]+)\"/);\n  if (rangeMatch) return `${rangeMatch[1]} ..< ${rangeMatch[2]}`;\n\n  logWarn(`[sec:swift] Unrecognised version specifier in Package.swift at ${relativeManifest} \u2014 using '*'`);\n  return '*';\n}\n\n/**\n * Derive a package name from a Swift package URL.\n * Extracts the last path component and strips a `.git` suffix.\n *\n * e.g., `https://github.com/apple/swift-argument-parser.git` \u2192 `swift-argument-parser`\n */\nfunction packageNameFromUrl(url: string): string | null {\n  try {\n    // Remove trailing slash\n    const cleaned = url.replace(/\\/+$/, '');\n    const segments = cleaned.split('/');\n    const last = segments[segments.length - 1];\n    if (!last) return null;\n    // Strip .git suffix\n    return last.replace(/\\.git$/i, '').toLowerCase();\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Check whether Package.resolved exists in the expected locations.\n */\nfunction hasPackageResolved(manifestDir: string): boolean {\n  return (\n    fs.existsSync(path.join(manifestDir, 'Package.resolved')) ||\n    fs.existsSync(path.join(manifestDir, '.build', 'Package.resolved'))\n  );\n}\n\n/**\n * Attempt to load resolved versions from Package.resolved.\n * Searches the manifest directory and `.build/` subdirectory.\n * Returns an empty map if Package.resolved is not available.\n *\n * Supports both v1 and v2 Package.resolved formats.\n */\nfunction loadPackageResolved(manifestDir: string): ResolvedVersionMap {\n  const map: ResolvedVersionMap = new Map();\n\n  const candidates = [\n    path.join(manifestDir, 'Package.resolved'),\n    path.join(manifestDir, '.build', 'Package.resolved'),\n  ];\n\n  for (const candidate of candidates) {\n    if (!fs.existsSync(candidate)) continue;\n\n    try {\n      const lockContent = fs.readFileSync(candidate, 'utf8');\n      extractFromPackageResolved(lockContent, map, candidate);\n      return map; // Use first found\n    } catch (err) {\n      logWarn(`[sec:swift] Failed to parse ${candidate}: ${err instanceof Error ? err.message : String(err)}`);\n    }\n  }\n\n  return map;\n}\n\n/**\n * Extract resolved versions from Package.resolved content.\n *\n * v2 format:\n * ```json\n * { \"pins\": [{ \"identity\": \"name\", \"kind\": \"remoteSourceControl\",\n *              \"location\": \"url\", \"state\": { \"version\": \"1.2.3\" } }] }\n * ```\n *\n * v1 format:\n * ```json\n * { \"object\": { \"pins\": [{ \"package\": \"Name\", \"repositoryURL\": \"url\",\n *                          \"state\": { \"version\": \"1.2.3\" } }] } }\n * ```\n */\nfunction extractFromPackageResolved(\n  content: string,\n  map: ResolvedVersionMap,\n  filePath: string,\n): void {\n  let data: Record<string, unknown>;\n  try {\n    data = JSON.parse(content) as Record<string, unknown>;\n  } catch {\n    logWarn(`[sec:swift] ${filePath} is not valid JSON \u2014 resolved versions unavailable`);\n    return;\n  }\n\n  // Determine format version and locate pins array\n  let pins: unknown[] | null = null;\n\n  // v2: top-level `pins` array\n  if (Array.isArray(data['pins'])) {\n    pins = data['pins'] as unknown[];\n    extractPinsV2(pins, map);\n    return;\n  }\n\n  // v1: `object.pins` array\n  const obj = data['object'];\n  if (obj && typeof obj === 'object' && !Array.isArray(obj)) {\n    const objRecord = obj as Record<string, unknown>;\n    if (Array.isArray(objRecord['pins'])) {\n      pins = objRecord['pins'] as unknown[];\n      extractPinsV1(pins, map);\n      return;\n    }\n  }\n\n  logWarn(`[sec:swift] ${filePath} has unrecognised Package.resolved format \u2014 resolved versions unavailable`);\n}\n\n/**\n * Extract pins from Package.resolved v2 format.\n * Each pin has: `{ identity, kind, location, state: { version } }`\n */\nfunction extractPinsV2(pins: unknown[], map: ResolvedVersionMap): void {\n  for (const pin of pins) {\n    if (!pin || typeof pin !== 'object') continue;\n    const p = pin as Record<string, unknown>;\n    const identity = typeof p['identity'] === 'string' ? p['identity'].toLowerCase() : null;\n    const state = p['state'];\n    const version =\n      state && typeof state === 'object' && !Array.isArray(state)\n        ? (state as Record<string, unknown>)['version']\n        : null;\n    if (identity && typeof version === 'string' && version) {\n      if (!map.has(identity)) {\n        map.set(identity, version);\n      }\n    }\n  }\n}\n\n/**\n * Extract pins from Package.resolved v1 format.\n * Each pin has: `{ package, repositoryURL, state: { version } }`\n */\nfunction extractPinsV1(pins: unknown[], map: ResolvedVersionMap): void {\n  for (const pin of pins) {\n    if (!pin || typeof pin !== 'object') continue;\n    const p = pin as Record<string, unknown>;\n    // v1 uses `package` or derives name from `repositoryURL`\n    let name: string | null = null;\n    if (typeof p['package'] === 'string' && p['package']) {\n      name = p['package'].toLowerCase();\n    } else if (typeof p['repositoryURL'] === 'string') {\n      name = packageNameFromUrl(p['repositoryURL']);\n    }\n    const state = p['state'];\n    const version =\n      state && typeof state === 'object' && !Array.isArray(state)\n        ? (state as Record<string, unknown>)['version']\n        : null;\n    if (name && typeof version === 'string' && version) {\n      if (!map.has(name)) {\n        map.set(name, version);\n      }\n    }\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,SAAoB;AACpB,WAAsB;AAEtB,oBAAwB;AAyBxB,eAAsB,mBACpB,cACA,aAC6B;AAC7B,QAAM,cAAc,KAAK,QAAQ,YAAY;AAC7C,QAAM,mBAAmB,KAAK,SAAS,aAAa,YAAY,EAAE,QAAQ,OAAO,GAAG;AAGpF,QAAM,WAAW,oBAAoB,WAAW;AAChD,MAAI,SAAS,OAAO,KAAK,mBAAmB,WAAW,GAAG;AAExD,WAAO,kBAAkB,UAAU,gBAAgB;AAAA,EACrD;AAGA,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,aAAa,cAAc,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,+BAAQ,8BAA8B,gBAAgB,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC7G,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAU,wBAAwB,SAAS,gBAAgB;AACjE,SAAO,QAAQ,IAAI,CAAC,SAAS;AAAA,IAC3B,MAAM,IAAI;AAAA,IACV,oBAAoB,IAAI;AAAA,IACxB,iBAAiB,IAAI;AAAA,IACrB,OAAO;AAAA,IACP,WAAW;AAAA,IACX,gBAAgB;AAAA,EAClB,EAAE;AACJ;AAMA,SAAS,kBACP,UACA,kBACoB;AACpB,QAAM,OAA2B,CAAC;AAClC,aAAW,CAAC,MAAM,OAAO,KAAK,UAAU;AACtC,SAAK,KAAK;AAAA,MACR;AAAA,MACA,oBAAoB;AAAA,MACpB,iBAAiB;AAAA,MACjB,OAAO;AAAA,MACP,WAAW;AAAA,MACX,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAWA,SAAS,wBAAwB,SAAiB,kBAA2C;AAC3F,QAAM,OAAwB,CAAC;AAI/B,QAAM,iBAAiB;AACvB,MAAI;AAEJ,UAAQ,QAAQ,eAAe,KAAK,OAAO,OAAO,MAAM;AACtD,UAAM,MAAM,MAAM,CAAC;AACnB,UAAM,YAAY,MAAM,CAAC;AAEzB,UAAM,OAAO,mBAAmB,GAAG;AACnC,QAAI,CAAC,MAAM;AACT,iCAAQ,uDAAuD,GAAG,QAAQ,gBAAgB,kBAAa;AACvG;AAAA,IACF;AAEA,UAAM,aAAa,yBAAyB,WAAW,gBAAgB;AACvE,SAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AAAA,EAChC;AAEA,SAAO;AACT;AAMA,SAAS,yBAAyB,aAAqB,kBAAkC;AAEvF,QAAM,YAAY,YAAY,MAAM,wBAAwB;AAC5D,MAAI,UAAW,QAAO,SAAS,UAAU,CAAC,CAAC;AAG3C,QAAM,aAAa,YAAY,MAAM,yBAAyB;AAC9D,MAAI,WAAY,QAAO,UAAU,WAAW,CAAC,CAAC;AAG9C,QAAM,iBAAiB,YAAY,MAAM,kDAAkD;AAC3F,MAAI,eAAgB,QAAO,kBAAkB,eAAe,CAAC,CAAC;AAG9D,QAAM,iBAAiB,YAAY,MAAM,kDAAkD;AAC3F,MAAI,eAAgB,QAAO,kBAAkB,eAAe,CAAC,CAAC;AAG9D,QAAM,aAAa,YAAY,MAAM,kCAAkC;AACvE,MAAI,WAAY,QAAO,GAAG,WAAW,CAAC,CAAC,QAAQ,WAAW,CAAC,CAAC;AAE5D,6BAAQ,kEAAkE,gBAAgB,mBAAc;AACxG,SAAO;AACT;AAQA,SAAS,mBAAmB,KAA4B;AACtD,MAAI;AAEF,UAAM,UAAU,IAAI,QAAQ,QAAQ,EAAE;AACtC,UAAM,WAAW,QAAQ,MAAM,GAAG;AAClC,UAAM,OAAO,SAAS,SAAS,SAAS,CAAC;AACzC,QAAI,CAAC,KAAM,QAAO;AAElB,WAAO,KAAK,QAAQ,WAAW,EAAE,EAAE,YAAY;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,mBAAmB,aAA8B;AACxD,SACE,GAAG,WAAW,KAAK,KAAK,aAAa,kBAAkB,CAAC,KACxD,GAAG,WAAW,KAAK,KAAK,aAAa,UAAU,kBAAkB,CAAC;AAEtE;AASA,SAAS,oBAAoB,aAAyC;AACpE,QAAM,MAA0B,oBAAI,IAAI;AAExC,QAAM,aAAa;AAAA,IACjB,KAAK,KAAK,aAAa,kBAAkB;AAAA,IACzC,KAAK,KAAK,aAAa,UAAU,kBAAkB;AAAA,EACrD;AAEA,aAAW,aAAa,YAAY;AAClC,QAAI,CAAC,GAAG,WAAW,SAAS,EAAG;AAE/B,QAAI;AACF,YAAM,cAAc,GAAG,aAAa,WAAW,MAAM;AACrD,iCAA2B,aAAa,KAAK,SAAS;AACtD,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,iCAAQ,+BAA+B,SAAS,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,IACzG;AAAA,EACF;AAEA,SAAO;AACT;AAiBA,SAAS,2BACP,SACA,KACA,UACM;AACN,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,QAAQ;AACN,+BAAQ,eAAe,QAAQ,yDAAoD;AACnF;AAAA,EACF;AAGA,MAAI,OAAyB;AAG7B,MAAI,MAAM,QAAQ,KAAK,MAAM,CAAC,GAAG;AAC/B,WAAO,KAAK,MAAM;AAClB,kBAAc,MAAM,GAAG;AACvB;AAAA,EACF;AAGA,QAAM,MAAM,KAAK,QAAQ;AACzB,MAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,GAAG;AACzD,UAAM,YAAY;AAClB,QAAI,MAAM,QAAQ,UAAU,MAAM,CAAC,GAAG;AACpC,aAAO,UAAU,MAAM;AACvB,oBAAc,MAAM,GAAG;AACvB;AAAA,IACF;AAAA,EACF;AAEA,6BAAQ,eAAe,QAAQ,gFAA2E;AAC5G;AAMA,SAAS,cAAc,MAAiB,KAA+B;AACrE,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,UAAM,IAAI;AACV,UAAM,WAAW,OAAO,EAAE,UAAU,MAAM,WAAW,EAAE,UAAU,EAAE,YAAY,IAAI;AACnF,UAAM,QAAQ,EAAE,OAAO;AACvB,UAAM,UACJ,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrD,MAAkC,SAAS,IAC5C;AACN,QAAI,YAAY,OAAO,YAAY,YAAY,SAAS;AACtD,UAAI,CAAC,IAAI,IAAI,QAAQ,GAAG;AACtB,YAAI,IAAI,UAAU,OAAO;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACF;AAMA,SAAS,cAAc,MAAiB,KAA+B;AACrE,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,UAAM,IAAI;AAEV,QAAI,OAAsB;AAC1B,QAAI,OAAO,EAAE,SAAS,MAAM,YAAY,EAAE,SAAS,GAAG;AACpD,aAAO,EAAE,SAAS,EAAE,YAAY;AAAA,IAClC,WAAW,OAAO,EAAE,eAAe,MAAM,UAAU;AACjD,aAAO,mBAAmB,EAAE,eAAe,CAAC;AAAA,IAC9C;AACA,UAAM,QAAQ,EAAE,OAAO;AACvB,UAAM,UACJ,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrD,MAAkC,SAAS,IAC5C;AACN,QAAI,QAAQ,OAAO,YAAY,YAAY,SAAS;AAClD,UAAI,CAAC,IAAI,IAAI,IAAI,GAAG;AAClB,YAAI,IAAI,MAAM,OAAO;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/owasp.d.ts

@@ -0,0 +1,16 @@
+/**
+ * OWASP Top 10 (2021) Mapping Utility
+ *
+ * Maps CVE findings to OWASP categories and provides associated CWE IDs.
+ */
+export type OwaspCategory = 'A01' | 'A02' | 'A03' | 'A04' | 'A05' | 'A06' | 'A07' | 'A08' | 'A09' | 'A10';
+export interface OwaspMapping {
+    category: OwaspCategory;
+    name: string;
+    description: string;
+    cweIds: number[];
+}
+export declare const OWASP_TOP_10: Record<OwaspCategory, OwaspMapping>;
+/** Map a CVE's summary/description to the most likely OWASP category. */
+export declare function mapCveToOwasp(summary: string, packageName: string): OwaspCategory;
+//# sourceMappingURL=owasp.d.ts.map

package/dist/security/owasp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owasp.d.ts","sourceRoot":"","sources":["../../src/security/owasp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAE1G,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,YAAY,CA6D5D,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,CAWjF"}

package/dist/security/owasp.js

@@ -0,0 +1,104 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var owasp_exports = {};
+__export(owasp_exports, {
+  OWASP_TOP_10: () => OWASP_TOP_10,
+  mapCveToOwasp: () => mapCveToOwasp
+});
+module.exports = __toCommonJS(owasp_exports);
+const OWASP_TOP_10 = {
+  A01: {
+    category: "A01",
+    name: "Broken Access Control",
+    description: "Restrictions on authenticated users are not properly enforced.",
+    cweIds: [200, 201, 284, 285, 352, 359, 732, 862, 863, 913]
+  },
+  A02: {
+    category: "A02",
+    name: "Cryptographic Failures",
+    description: "Failures related to cryptography which often lead to exposure of sensitive data.",
+    cweIds: [261, 296, 310, 312, 315, 319, 321, 326, 327, 328, 330, 331, 335, 336, 337, 338, 340, 347, 523, 720, 757, 759, 760, 780, 818, 916]
+  },
+  A03: {
+    category: "A03",
+    name: "Injection",
+    description: "User-supplied data is not validated, filtered, or sanitized by the application.",
+    cweIds: [20, 74, 77, 78, 79, 88, 89, 90, 91, 93, 94, 95, 116, 943]
+  },
+  A04: {
+    category: "A04",
+    name: "Insecure Design",
+    description: "Missing or ineffective control design.",
+    cweIds: [73, 183, 209, 213, 235, 256, 257, 266, 269, 280, 311, 312, 313, 316, 419, 434, 444, 451, 454, 602, 620, 636, 841, 862, 1004, 1173]
+  },
+  A05: {
+    category: "A05",
+    name: "Security Misconfiguration",
+    description: "Missing appropriate security hardening across any part of the application stack.",
+    cweIds: [2, 11, 13, 15, 16, 260, 315, 520, 526, 537, 541, 548, 732]
+  },
+  A06: {
+    category: "A06",
+    name: "Vulnerable and Outdated Components",
+    description: "Components with known vulnerabilities are used.",
+    cweIds: [1035, 1104]
+  },
+  A07: {
+    category: "A07",
+    name: "Identification and Authentication Failures",
+    description: "Confirmation of user identity, authentication, and session management failures.",
+    cweIds: [255, 259, 287, 288, 290, 294, 295, 297, 300, 302, 304, 306, 307, 346, 384, 521, 613, 620, 640, 798, 940, 1216]
+  },
+  A08: {
+    category: "A08",
+    name: "Software and Data Integrity Failures",
+    description: "Code and infrastructure that does not protect against integrity violations.",
+    cweIds: [345, 353, 426, 494, 502, 565, 784, 829, 830, 915]
+  },
+  A09: {
+    category: "A09",
+    name: "Security Logging and Monitoring Failures",
+    description: "Insufficient logging, detection, monitoring, and active response.",
+    cweIds: [117, 223, 532, 778]
+  },
+  A10: {
+    category: "A10",
+    name: "Server-Side Request Forgery",
+    description: "Web application fetches a remote resource without validating user-supplied URL.",
+    cweIds: [918]
+  }
+};
+function mapCveToOwasp(summary, packageName) {
+  const text = (summary + " " + packageName).toLowerCase();
+  if (/inject|sql|xss|cross.site|script|command.inject|ldap|xpath/i.test(text)) return "A03";
+  if (/auth|authentication|session|credential|password|token|csrf|bypass/i.test(text)) return "A07";
+  if (/access.control|privilege|permission|authoriz|rbac|idor/i.test(text)) return "A01";
+  if (/crypto|encrypt|tls|ssl|cipher|hash|random|certificate/i.test(text)) return "A02";
+  if (/deserializ|pickle|marshal|prototype.pollution|supply.chain|integrity/i.test(text)) return "A08";
+  if (/ssrf|request.forgery|server.side/i.test(text)) return "A10";
+  if (/config|misconfig|default|expose|disclose|information/i.test(text)) return "A05";
+  if (/log|monitor|audit|trace/i.test(text)) return "A09";
+  return "A06";
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OWASP_TOP_10,
+  mapCveToOwasp
+});
+//# sourceMappingURL=owasp.js.map

package/dist/security/owasp.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/owasp.ts"],
+  "sourcesContent": ["/**\n * OWASP Top 10 (2021) Mapping Utility\n *\n * Maps CVE findings to OWASP categories and provides associated CWE IDs.\n */\n\nexport type OwaspCategory = 'A01' | 'A02' | 'A03' | 'A04' | 'A05' | 'A06' | 'A07' | 'A08' | 'A09' | 'A10';\n\nexport interface OwaspMapping {\n  category: OwaspCategory;\n  name: string;\n  description: string;\n  cweIds: number[];\n}\n\nexport const OWASP_TOP_10: Record<OwaspCategory, OwaspMapping> = {\n  A01: {\n    category: 'A01',\n    name: 'Broken Access Control',\n    description: 'Restrictions on authenticated users are not properly enforced.',\n    cweIds: [200, 201, 284, 285, 352, 359, 732, 862, 863, 913],\n  },\n  A02: {\n    category: 'A02',\n    name: 'Cryptographic Failures',\n    description: 'Failures related to cryptography which often lead to exposure of sensitive data.',\n    cweIds: [261, 296, 310, 312, 315, 319, 321, 326, 327, 328, 330, 331, 335, 336, 337, 338, 340, 347, 523, 720, 757, 759, 760, 780, 818, 916],\n  },\n  A03: {\n    category: 'A03',\n    name: 'Injection',\n    description: 'User-supplied data is not validated, filtered, or sanitized by the application.',\n    cweIds: [20, 74, 77, 78, 79, 88, 89, 90, 91, 93, 94, 95, 116, 943],\n  },\n  A04: {\n    category: 'A04',\n    name: 'Insecure Design',\n    description: 'Missing or ineffective control design.',\n    cweIds: [73, 183, 209, 213, 235, 256, 257, 266, 269, 280, 311, 312, 313, 316, 419, 434, 444, 451, 454, 602, 620, 636, 841, 862, 1004, 1173],\n  },\n  A05: {\n    category: 'A05',\n    name: 'Security Misconfiguration',\n    description: 'Missing appropriate security hardening across any part of the application stack.',\n    cweIds: [2, 11, 13, 15, 16, 260, 315, 520, 526, 537, 541, 548, 732],\n  },\n  A06: {\n    category: 'A06',\n    name: 'Vulnerable and Outdated Components',\n    description: 'Components with known vulnerabilities are used.',\n    cweIds: [1035, 1104],\n  },\n  A07: {\n    category: 'A07',\n    name: 'Identification and Authentication Failures',\n    description: 'Confirmation of user identity, authentication, and session management failures.',\n    cweIds: [255, 259, 287, 288, 290, 294, 295, 297, 300, 302, 304, 306, 307, 346, 384, 521, 613, 620, 640, 798, 940, 1216],\n  },\n  A08: {\n    category: 'A08',\n    name: 'Software and Data Integrity Failures',\n    description: 'Code and infrastructure that does not protect against integrity violations.',\n    cweIds: [345, 353, 426, 494, 502, 565, 784, 829, 830, 915],\n  },\n  A09: {\n    category: 'A09',\n    name: 'Security Logging and Monitoring Failures',\n    description: 'Insufficient logging, detection, monitoring, and active response.',\n    cweIds: [117, 223, 532, 778],\n  },\n  A10: {\n    category: 'A10',\n    name: 'Server-Side Request Forgery',\n    description: 'Web application fetches a remote resource without validating user-supplied URL.',\n    cweIds: [918],\n  },\n};\n\n/** Map a CVE's summary/description to the most likely OWASP category. */\nexport function mapCveToOwasp(summary: string, packageName: string): OwaspCategory {\n  const text = (summary + ' ' + packageName).toLowerCase();\n  if (/inject|sql|xss|cross.site|script|command.inject|ldap|xpath/i.test(text)) return 'A03';\n  if (/auth|authentication|session|credential|password|token|csrf|bypass/i.test(text)) return 'A07';\n  if (/access.control|privilege|permission|authoriz|rbac|idor/i.test(text)) return 'A01';\n  if (/crypto|encrypt|tls|ssl|cipher|hash|random|certificate/i.test(text)) return 'A02';\n  if (/deserializ|pickle|marshal|prototype.pollution|supply.chain|integrity/i.test(text)) return 'A08';\n  if (/ssrf|request.forgery|server.side/i.test(text)) return 'A10';\n  if (/config|misconfig|default|expose|disclose|information/i.test(text)) return 'A05';\n  if (/log|monitor|audit|trace/i.test(text)) return 'A09';\n  return 'A06'; // default: vulnerable component\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeO,MAAM,eAAoD;AAAA,EAC/D,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG;AAAA,EAC3D;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG;AAAA,EAC3I;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,GAAG;AAAA,EACnE;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI;AAAA,EAC5I;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG;AAAA,EACpE;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,MAAM,IAAI;AAAA,EACrB;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI;AAAA,EACxH;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG;AAAA,EAC3D;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,KAAK,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA,EACA,KAAK;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,IACN,aAAa;AAAA,IACb,QAAQ,CAAC,GAAG;AAAA,EACd;AACF;AAGO,SAAS,cAAc,SAAiB,aAAoC;AACjF,QAAM,QAAQ,UAAU,MAAM,aAAa,YAAY;AACvD,MAAI,8DAA8D,KAAK,IAAI,EAAG,QAAO;AACrF,MAAI,qEAAqE,KAAK,IAAI,EAAG,QAAO;AAC5F,MAAI,0DAA0D,KAAK,IAAI,EAAG,QAAO;AACjF,MAAI,yDAAyD,KAAK,IAAI,EAAG,QAAO;AAChF,MAAI,wEAAwE,KAAK,IAAI,EAAG,QAAO;AAC/F,MAAI,oCAAoC,KAAK,IAAI,EAAG,QAAO;AAC3D,MAAI,wDAAwD,KAAK,IAAI,EAAG,QAAO;AAC/E,MAAI,2BAA2B,KAAK,IAAI,EAAG,QAAO;AAClD,SAAO;AACT;",
+  "names": []
+}

package/dist/security/pipeline.d.ts

@@ -0,0 +1,37 @@
+/**
+ * SecurityPipeline — Orchestrates the security analysis phases.
+ *
+ * Phases (in order):
+ *   1. Manifest parsing — discover and parse dependency manifests
+ *   2. Dependency integration — link dependencies to code symbols
+ *   3. Vulnerability enrichment — query databases for CVEs (if securityAutoEnrich)
+ *   4. Reachability analysis — determine if vulnerable code is reachable
+ *
+ * Reports progress via callback and returns a SecurityResult with counts and duration.
+ *
+ * Requirements: 9.3, 9.5
+ */
+import type { GraphDatabase } from '../db/database';
+import type { KiroGraphConfig } from '../config';
+import type { SecurityResult } from './types';
+/**
+ * SecurityPipeline orchestrates the full security analysis workflow.
+ */
+export declare class SecurityPipeline {
+    private readonly db;
+    private readonly config;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, config: KiroGraphConfig, projectRoot: string);
+    /**
+     * Run the full security analysis pipeline.
+     *
+     * @param onProgress - Optional callback reporting (phase, current, total)
+     * @returns SecurityResult with counts and duration
+     */
+    run(onProgress?: (phase: string, current: number, total: number) => void): Promise<SecurityResult>;
+    /**
+     * Create vulnerability database adapters based on config.
+     */
+    private createVulnAdapters;
+}
+//# sourceMappingURL=pipeline.d.ts.map

package/dist/security/pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/security/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAQ9C;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM;IAM3E;;;;;OAKG;IACG,GAAG,CACP,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GACnE,OAAO,CAAC,cAAc,CAAC;IAmF1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAqB3B"}

package/dist/security/pipeline.js

@@ -0,0 +1,125 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var pipeline_exports = {};
+__export(pipeline_exports, {
+  SecurityPipeline: () => SecurityPipeline
+});
+module.exports = __toCommonJS(pipeline_exports);
+var import_parser = require("./manifest/parser");
+var import_integrator = require("./integrator");
+var import_client = require("./vuln/client");
+var import_osv_adapter = require("./vuln/osv-adapter");
+var import_reachability = require("./reachability");
+var import_errors = require("../errors");
+class SecurityPipeline {
+  constructor(db, config, projectRoot) {
+    this.db = db;
+    this.config = config;
+    this.projectRoot = projectRoot;
+  }
+  /**
+   * Run the full security analysis pipeline.
+   *
+   * @param onProgress - Optional callback reporting (phase, current, total)
+   * @returns SecurityResult with counts and duration
+   */
+  async run(onProgress) {
+    const start = Date.now();
+    const result = {
+      manifestsDiscovered: 0,
+      dependenciesCreated: 0,
+      vulnerabilitiesFound: 0,
+      affectedCount: 0,
+      notAffectedCount: 0,
+      underInvestigationCount: 0,
+      duration: 0
+    };
+    onProgress?.("manifest-parsing", 0, 4);
+    const parser = new import_parser.ManifestParser(this.db, this.projectRoot);
+    const parseResult = await parser.parseAll();
+    result.manifestsDiscovered = parseResult.manifestsParsed;
+    result.dependenciesCreated = parseResult.dependenciesCreated;
+    onProgress?.("manifest-parsing", 1, 4);
+    onProgress?.("dependency-integration", 1, 4);
+    const integrator = new import_integrator.DependencyGraphIntegrator(this.db, this.projectRoot);
+    await integrator.integrate();
+    await integrator.resolveTransitives(10);
+    await integrator.cleanup();
+    onProgress?.("dependency-integration", 2, 4);
+    if (this.config.securityAutoEnrich) {
+      onProgress?.("vulnerability-enrichment", 2, 4);
+      const adapters = this.createVulnAdapters();
+      const vulnClient = new import_client.VulnerabilityDatabaseClient(adapters, this.db);
+      const enrichResult = await vulnClient.enrichAll();
+      result.vulnerabilitiesFound = enrichResult.vulnerabilitiesFound;
+      onProgress?.("vulnerability-enrichment", 3, 4);
+    } else {
+      onProgress?.("vulnerability-enrichment", 3, 4);
+    }
+    onProgress?.("reachability-analysis", 3, 4);
+    const reachability = new import_reachability.ReachabilityAnalyzer(this.db, this.config);
+    const reachResults = await reachability.analyzeAll();
+    for (const [, reachResult] of reachResults) {
+      switch (reachResult.verdict) {
+        case "affected":
+          result.affectedCount++;
+          break;
+        case "not_affected":
+          result.notAffectedCount++;
+          break;
+        case "under_investigation":
+          result.underInvestigationCount++;
+          break;
+      }
+    }
+    for (const [vulnNodeId, reachResult] of reachResults) {
+      if (reachResult.verdict === "affected") {
+        await reachability.getImpactSummary(vulnNodeId);
+      }
+    }
+    onProgress?.("reachability-analysis", 4, 4);
+    result.duration = Date.now() - start;
+    return result;
+  }
+  /**
+   * Create vulnerability database adapters based on config.
+   */
+  createVulnAdapters() {
+    const adapters = [];
+    for (const dbName of this.config.securityDatabases) {
+      switch (dbName.toUpperCase()) {
+        case "OSV":
+          adapters.push(new import_osv_adapter.OsvAdapter());
+          break;
+        default:
+          (0, import_errors.logWarn)(`[sec:pipeline] Unknown vulnerability database "${dbName}", skipping`);
+          break;
+      }
+    }
+    if (adapters.length === 0) {
+      adapters.push(new import_osv_adapter.OsvAdapter());
+    }
+    return adapters;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SecurityPipeline
+});
+//# sourceMappingURL=pipeline.js.map

package/dist/security/pipeline.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/pipeline.ts"],
+  "sourcesContent": ["/**\n * SecurityPipeline \u2014 Orchestrates the security analysis phases.\n *\n * Phases (in order):\n *   1. Manifest parsing \u2014 discover and parse dependency manifests\n *   2. Dependency integration \u2014 link dependencies to code symbols\n *   3. Vulnerability enrichment \u2014 query databases for CVEs (if securityAutoEnrich)\n *   4. Reachability analysis \u2014 determine if vulnerable code is reachable\n *\n * Reports progress via callback and returns a SecurityResult with counts and duration.\n *\n * Requirements: 9.3, 9.5\n */\n\nimport type { GraphDatabase } from '../db/database';\nimport type { KiroGraphConfig } from '../config';\nimport type { SecurityResult } from './types';\nimport { ManifestParser } from './manifest/parser';\nimport { DependencyGraphIntegrator } from './integrator';\nimport { VulnerabilityDatabaseClient } from './vuln/client';\nimport { OsvAdapter } from './vuln/osv-adapter';\nimport { ReachabilityAnalyzer } from './reachability';\nimport { logWarn } from '../errors';\n\n/**\n * SecurityPipeline orchestrates the full security analysis workflow.\n */\nexport class SecurityPipeline {\n  private readonly db: GraphDatabase;\n  private readonly config: KiroGraphConfig;\n  private readonly projectRoot: string;\n\n  constructor(db: GraphDatabase, config: KiroGraphConfig, projectRoot: string) {\n    this.db = db;\n    this.config = config;\n    this.projectRoot = projectRoot;\n  }\n\n  /**\n   * Run the full security analysis pipeline.\n   *\n   * @param onProgress - Optional callback reporting (phase, current, total)\n   * @returns SecurityResult with counts and duration\n   */\n  async run(\n    onProgress?: (phase: string, current: number, total: number) => void,\n  ): Promise<SecurityResult> {\n    const start = Date.now();\n\n    const result: SecurityResult = {\n      manifestsDiscovered: 0,\n      dependenciesCreated: 0,\n      vulnerabilitiesFound: 0,\n      affectedCount: 0,\n      notAffectedCount: 0,\n      underInvestigationCount: 0,\n      duration: 0,\n    };\n\n    // \u2500\u2500 Phase 1: Manifest Parsing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    onProgress?.('manifest-parsing', 0, 4);\n\n    const parser = new ManifestParser(this.db, this.projectRoot);\n    const parseResult = await parser.parseAll();\n\n    result.manifestsDiscovered = parseResult.manifestsParsed;\n    result.dependenciesCreated = parseResult.dependenciesCreated;\n\n    onProgress?.('manifest-parsing', 1, 4);\n\n    // \u2500\u2500 Phase 2: Dependency Integration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    onProgress?.('dependency-integration', 1, 4);\n\n    const integrator = new DependencyGraphIntegrator(this.db, this.projectRoot);\n    await integrator.integrate();\n    await integrator.resolveTransitives(10);\n    await integrator.cleanup();\n\n    onProgress?.('dependency-integration', 2, 4);\n\n    // \u2500\u2500 Phase 3: Vulnerability Enrichment (conditional) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    if (this.config.securityAutoEnrich) {\n      onProgress?.('vulnerability-enrichment', 2, 4);\n\n      const adapters = this.createVulnAdapters();\n      const vulnClient = new VulnerabilityDatabaseClient(adapters, this.db);\n      const enrichResult = await vulnClient.enrichAll();\n\n      result.vulnerabilitiesFound = enrichResult.vulnerabilitiesFound;\n\n      onProgress?.('vulnerability-enrichment', 3, 4);\n    } else {\n      onProgress?.('vulnerability-enrichment', 3, 4);\n    }\n\n    // \u2500\u2500 Phase 4: Reachability Analysis \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    onProgress?.('reachability-analysis', 3, 4);\n\n    const reachability = new ReachabilityAnalyzer(this.db, this.config);\n    const reachResults = await reachability.analyzeAll();\n\n    // Count verdicts\n    for (const [, reachResult] of reachResults) {\n      switch (reachResult.verdict) {\n        case 'affected':\n          result.affectedCount++;\n          break;\n        case 'not_affected':\n          result.notAffectedCount++;\n          break;\n        case 'under_investigation':\n          result.underInvestigationCount++;\n          break;\n      }\n    }\n\n    // Generate impact summaries for affected vulnerabilities\n    for (const [vulnNodeId, reachResult] of reachResults) {\n      if (reachResult.verdict === 'affected') {\n        await reachability.getImpactSummary(vulnNodeId);\n      }\n    }\n\n    onProgress?.('reachability-analysis', 4, 4);\n\n    result.duration = Date.now() - start;\n    return result;\n  }\n\n  /**\n   * Create vulnerability database adapters based on config.\n   */\n  private createVulnAdapters(): import('./vuln/types').VulnDatabaseAdapter[] {\n    const adapters: import('./vuln/types').VulnDatabaseAdapter[] = [];\n\n    for (const dbName of this.config.securityDatabases) {\n      switch (dbName.toUpperCase()) {\n        case 'OSV':\n          adapters.push(new OsvAdapter());\n          break;\n        default:\n          logWarn(`[sec:pipeline] Unknown vulnerability database \"${dbName}\", skipping`);\n          break;\n      }\n    }\n\n    // Fallback to OSV if no valid adapters configured\n    if (adapters.length === 0) {\n      adapters.push(new OsvAdapter());\n    }\n\n    return adapters;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBA,oBAA+B;AAC/B,wBAA0C;AAC1C,oBAA4C;AAC5C,yBAA2B;AAC3B,0BAAqC;AACrC,oBAAwB;AAKjB,MAAM,iBAAiB;AAAA,EAK5B,YAAY,IAAmB,QAAyB,aAAqB;AAC3E,SAAK,KAAK;AACV,SAAK,SAAS;AACd,SAAK,cAAc;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,IACJ,YACyB;AACzB,UAAM,QAAQ,KAAK,IAAI;AAEvB,UAAM,SAAyB;AAAA,MAC7B,qBAAqB;AAAA,MACrB,qBAAqB;AAAA,MACrB,sBAAsB;AAAA,MACtB,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,yBAAyB;AAAA,MACzB,UAAU;AAAA,IACZ;AAGA,iBAAa,oBAAoB,GAAG,CAAC;AAErC,UAAM,SAAS,IAAI,6BAAe,KAAK,IAAI,KAAK,WAAW;AAC3D,UAAM,cAAc,MAAM,OAAO,SAAS;AAE1C,WAAO,sBAAsB,YAAY;AACzC,WAAO,sBAAsB,YAAY;AAEzC,iBAAa,oBAAoB,GAAG,CAAC;AAGrC,iBAAa,0BAA0B,GAAG,CAAC;AAE3C,UAAM,aAAa,IAAI,4CAA0B,KAAK,IAAI,KAAK,WAAW;AAC1E,UAAM,WAAW,UAAU;AAC3B,UAAM,WAAW,mBAAmB,EAAE;AACtC,UAAM,WAAW,QAAQ;AAEzB,iBAAa,0BAA0B,GAAG,CAAC;AAG3C,QAAI,KAAK,OAAO,oBAAoB;AAClC,mBAAa,4BAA4B,GAAG,CAAC;AAE7C,YAAM,WAAW,KAAK,mBAAmB;AACzC,YAAM,aAAa,IAAI,0CAA4B,UAAU,KAAK,EAAE;AACpE,YAAM,eAAe,MAAM,WAAW,UAAU;AAEhD,aAAO,uBAAuB,aAAa;AAE3C,mBAAa,4BAA4B,GAAG,CAAC;AAAA,IAC/C,OAAO;AACL,mBAAa,4BAA4B,GAAG,CAAC;AAAA,IAC/C;AAGA,iBAAa,yBAAyB,GAAG,CAAC;AAE1C,UAAM,eAAe,IAAI,yCAAqB,KAAK,IAAI,KAAK,MAAM;AAClE,UAAM,eAAe,MAAM,aAAa,WAAW;AAGnD,eAAW,CAAC,EAAE,WAAW,KAAK,cAAc;AAC1C,cAAQ,YAAY,SAAS;AAAA,QAC3B,KAAK;AACH,iBAAO;AACP;AAAA,QACF,KAAK;AACH,iBAAO;AACP;AAAA,QACF,KAAK;AACH,iBAAO;AACP;AAAA,MACJ;AAAA,IACF;AAGA,eAAW,CAAC,YAAY,WAAW,KAAK,cAAc;AACpD,UAAI,YAAY,YAAY,YAAY;AACtC,cAAM,aAAa,iBAAiB,UAAU;AAAA,MAChD;AAAA,IACF;AAEA,iBAAa,yBAAyB,GAAG,CAAC;AAE1C,WAAO,WAAW,KAAK,IAAI,IAAI;AAC/B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,qBAAmE;AACzE,UAAM,WAAyD,CAAC;AAEhE,eAAW,UAAU,KAAK,OAAO,mBAAmB;AAClD,cAAQ,OAAO,YAAY,GAAG;AAAA,QAC5B,KAAK;AACH,mBAAS,KAAK,IAAI,8BAAW,CAAC;AAC9B;AAAA,QACF;AACE,qCAAQ,kDAAkD,MAAM,aAAa;AAC7E;AAAA,MACJ;AAAA,IACF;AAGA,QAAI,SAAS,WAAW,GAAG;AACzB,eAAS,KAAK,IAAI,8BAAW,CAAC;AAAA,IAChC;AAEA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/security/reachability.d.ts

@@ -0,0 +1,67 @@
+/**
+ * KiroGraph-Sec Reachability Analyzer
+ *
+ * Traverses the knowledge graph from application entry points to determine
+ * whether vulnerable dependencies are reachable through actual code paths.
+ * Produces reachability verdicts and impact summaries enriched with
+ * architectural layer context.
+ *
+ * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6, 5.1, 5.2, 5.3, 5.4, 5.5
+ */
+import type { GraphDatabase } from '../db/database';
+import type { KiroGraphConfig } from '../config';
+import type { ReachabilityResult, ImpactSummary } from './types';
+/**
+ * ReachabilityAnalyzer traverses the knowledge graph from entry points
+ * toward affected dependency nodes to determine reachability verdicts.
+ */
+export declare class ReachabilityAnalyzer {
+    private readonly db;
+    private readonly config;
+    constructor(db: GraphDatabase, config: KiroGraphConfig);
+    /**
+     * Analyze reachability for a single Vulnerability_Node.
+     *
+     * 1. Find the Dependency_Node linked via `has_vulnerability` edge
+     * 2. Find all Entry_Points in the graph
+     * 3. BFS from each entry point toward the dependency node
+     * 4. Assign verdict based on path existence and unresolved imports
+     *
+     * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6
+     */
+    analyze(vulnerabilityNodeId: string): Promise<ReachabilityResult>;
+    /**
+     * Produce impact summary for an affected vulnerability.
+     *
+     * Returns null if the vulnerability is not affected.
+     * Reads layer assignments from `arch_file_layers` table.
+     *
+     * Requirements: 5.1, 5.2, 5.3, 5.4, 5.5
+     */
+    getImpactSummary(vulnerabilityNodeId: string): Promise<ImpactSummary | null>;
+    /**
+     * Analyze all Vulnerability_Nodes in the graph.
+     *
+     * Iterates all vulnerability nodes and calls analyze() for each.
+     */
+    analyzeAll(): Promise<Map<string, ReachabilityResult>>;
+    /**
+     * BFS from a single entry point toward the dependency node.
+     *
+     * Uses outgoing edges of types: calls, imports, references.
+     * Visits each node at most once (handles cycles).
+     * Tracks unresolved imports encountered during traversal.
+     *
+     * Returns the shortest path if found, plus any unresolved symbols encountered.
+     */
+    private bfsFromEntryPoint;
+    /**
+     * Store reachability result in sec_reachability table.
+     */
+    private storeReachabilityResult;
+    /**
+     * Store impact summary in sec_impact table.
+     */
+    private storeImpactSummary;
+}
+//# sourceMappingURL=reachability.d.ts.map

package/dist/security/reachability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachability.d.ts","sourceRoot":"","sources":["../../src/security/reachability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAGV,kBAAkB,EAClB,aAAa,EACd,MAAM,SAAS,CAAC;AAWjB;;;GAGG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;gBAE7B,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe;IAKtD;;;;;;;;;OASG;IACG,OAAO,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmFvE;;;;;;;OAOG;IACG,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA2FlF;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAgB5D;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IA2DzB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAoB/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAkB3B"}