kirograph 0.17.0 → 0.20.0

package/dist/security/reachability.js

@@ -0,0 +1,276 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var reachability_exports = {};
+__export(reachability_exports, {
+  ReachabilityAnalyzer: () => ReachabilityAnalyzer
+});
+module.exports = __toCommonJS(reachability_exports);
+const TRAVERSAL_EDGE_KINDS = ["calls", "imports", "references"];
+const MAX_UNRESOLVED_SYMBOLS = 50;
+const MAX_DISTINCT_PATHS = 100;
+class ReachabilityAnalyzer {
+  constructor(db, config) {
+    this.db = db;
+    this.config = config;
+  }
+  /**
+   * Analyze reachability for a single Vulnerability_Node.
+   *
+   * 1. Find the Dependency_Node linked via `has_vulnerability` edge
+   * 2. Find all Entry_Points in the graph
+   * 3. BFS from each entry point toward the dependency node
+   * 4. Assign verdict based on path existence and unresolved imports
+   *
+   * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6
+   */
+  async analyze(vulnerabilityNodeId) {
+    const rawDb = this.db.getRawDb();
+    const depEdge = rawDb.get(
+      `SELECT source FROM edges WHERE target = ? AND kind = 'has_vulnerability'`,
+      [vulnerabilityNodeId]
+    );
+    if (!depEdge) {
+      return {
+        verdict: "under_investigation",
+        paths: [],
+        unresolvedSymbols: [],
+        reachingEntryPointCount: 0
+      };
+    }
+    const dependencyNodeId = depEdge.source;
+    const entryPoints = rawDb.all(
+      `SELECT id FROM nodes WHERE kind = 'route'
+       UNION
+       SELECT id FROM nodes WHERE kind = 'function' AND is_exported = 1`
+    );
+    if (entryPoints.length === 0) {
+      return {
+        verdict: "not_affected",
+        paths: [],
+        unresolvedSymbols: [],
+        reachingEntryPointCount: 0
+      };
+    }
+    const reachingPaths = [];
+    const allUnresolvedSymbols = /* @__PURE__ */ new Set();
+    for (const ep of entryPoints) {
+      const result2 = this.bfsFromEntryPoint(rawDb, ep.id, dependencyNodeId);
+      if (result2.path) {
+        reachingPaths.push({
+          entryPoint: ep.id,
+          path: result2.path
+        });
+      }
+      for (const sym of result2.unresolvedSymbols) {
+        allUnresolvedSymbols.add(sym);
+      }
+    }
+    const unresolvedSymbols = Array.from(allUnresolvedSymbols).slice(0, MAX_UNRESOLVED_SYMBOLS);
+    let verdict;
+    if (reachingPaths.length > 0) {
+      verdict = "affected";
+    } else if (allUnresolvedSymbols.size > 0) {
+      verdict = "under_investigation";
+    } else {
+      verdict = "not_affected";
+    }
+    const result = {
+      verdict,
+      paths: reachingPaths,
+      unresolvedSymbols: verdict === "under_investigation" ? unresolvedSymbols : [],
+      reachingEntryPointCount: reachingPaths.length
+    };
+    this.storeReachabilityResult(rawDb, vulnerabilityNodeId, result);
+    return result;
+  }
+  /**
+   * Produce impact summary for an affected vulnerability.
+   *
+   * Returns null if the vulnerability is not affected.
+   * Reads layer assignments from `arch_file_layers` table.
+   *
+   * Requirements: 5.1, 5.2, 5.3, 5.4, 5.5
+   */
+  async getImpactSummary(vulnerabilityNodeId) {
+    const rawDb = this.db.getRawDb();
+    const reachRow = rawDb.get(
+      `SELECT verdict, paths, reaching_entry_point_count FROM sec_reachability WHERE vulnerability_node_id = ?`,
+      [vulnerabilityNodeId]
+    );
+    if (!reachRow || reachRow.verdict !== "affected") {
+      return null;
+    }
+    const paths = reachRow.paths ? JSON.parse(reachRow.paths) : [];
+    if (paths.length === 0) {
+      return null;
+    }
+    const allNodeIds = /* @__PURE__ */ new Set();
+    const affectedEntryPoints = [];
+    for (const p of paths) {
+      affectedEntryPoints.push(p.entryPoint);
+      for (const nodeId of p.path) {
+        allNodeIds.add(nodeId);
+      }
+    }
+    const affectedLayers = /* @__PURE__ */ new Set();
+    if (this.config.enableArchitecture) {
+      const nodeIds = Array.from(allNodeIds);
+      if (nodeIds.length > 0) {
+        const placeholders = nodeIds.map(() => "?").join(",");
+        const nodeFiles = rawDb.all(
+          `SELECT id, file_path FROM nodes WHERE id IN (${placeholders})`,
+          nodeIds
+        );
+        const filePaths = [...new Set(nodeFiles.map((n) => n.file_path).filter(Boolean))];
+        if (filePaths.length > 0) {
+          const filePlaceholders = filePaths.map(() => "?").join(",");
+          const layerRows = rawDb.all(
+            `SELECT file_path, layer_id FROM arch_file_layers WHERE file_path IN (${filePlaceholders})`,
+            filePaths
+          );
+          const fileToLayer = /* @__PURE__ */ new Map();
+          for (const row of layerRows) {
+            fileToLayer.set(row.file_path, row.layer_id);
+          }
+          for (const nf of nodeFiles) {
+            if (nf.file_path) {
+              const layer = fileToLayer.get(nf.file_path);
+              affectedLayers.add(layer ?? "unclassified");
+            }
+          }
+        }
+      }
+    }
+    const distinctPathSet = /* @__PURE__ */ new Set();
+    for (const p of paths) {
+      const pathKey = p.path.join("\u2192");
+      distinctPathSet.add(pathKey);
+      if (distinctPathSet.size >= MAX_DISTINCT_PATHS) break;
+    }
+    const summary = {
+      affectedLayers: Array.from(affectedLayers),
+      affectedEntryPoints,
+      distinctPathCount: Math.min(distinctPathSet.size, MAX_DISTINCT_PATHS)
+    };
+    this.storeImpactSummary(rawDb, vulnerabilityNodeId, summary);
+    return summary;
+  }
+  /**
+   * Analyze all Vulnerability_Nodes in the graph.
+   *
+   * Iterates all vulnerability nodes and calls analyze() for each.
+   */
+  async analyzeAll() {
+    const rawDb = this.db.getRawDb();
+    const results = /* @__PURE__ */ new Map();
+    const vulnRows = rawDb.all(
+      `SELECT node_id FROM sec_vulnerabilities`
+    );
+    for (const row of vulnRows) {
+      const result = await this.analyze(row.node_id);
+      results.set(row.node_id, result);
+    }
+    return results;
+  }
+  /**
+   * BFS from a single entry point toward the dependency node.
+   *
+   * Uses outgoing edges of types: calls, imports, references.
+   * Visits each node at most once (handles cycles).
+   * Tracks unresolved imports encountered during traversal.
+   *
+   * Returns the shortest path if found, plus any unresolved symbols encountered.
+   */
+  bfsFromEntryPoint(rawDb, entryPointId, dependencyNodeId) {
+    const visited = /* @__PURE__ */ new Set();
+    const unresolvedSymbols = [];
+    const queue = [[entryPointId, [entryPointId]]];
+    visited.add(entryPointId);
+    const edgeKinds = TRAVERSAL_EDGE_KINDS.map((k) => `'${k}'`).join(",");
+    while (queue.length > 0) {
+      const [currentId, currentPath] = queue.shift();
+      const outEdges = rawDb.all(
+        `SELECT target, kind FROM edges WHERE source = ? AND kind IN (${edgeKinds})`,
+        [currentId]
+      );
+      if (outEdges.length === 0) {
+        const nodeRow = rawDb.get(
+          `SELECT kind FROM nodes WHERE id = ?`,
+          [currentId]
+        );
+        if (nodeRow && nodeRow.kind === "import") {
+          unresolvedSymbols.push(currentId);
+        }
+      }
+      for (const edge of outEdges) {
+        const targetId = edge.target;
+        if (targetId === dependencyNodeId) {
+          return {
+            path: [...currentPath, targetId],
+            unresolvedSymbols
+          };
+        }
+        if (visited.has(targetId)) continue;
+        visited.add(targetId);
+        queue.push([targetId, [...currentPath, targetId]]);
+      }
+    }
+    return { path: null, unresolvedSymbols };
+  }
+  /**
+   * Store reachability result in sec_reachability table.
+   */
+  storeReachabilityResult(rawDb, vulnerabilityNodeId, result) {
+    rawDb.run(
+      `INSERT OR REPLACE INTO sec_reachability
+        (vulnerability_node_id, verdict, paths, unresolved_symbols, reaching_entry_point_count, analyzed_at)
+       VALUES (?, ?, ?, ?, ?, ?)`,
+      [
+        vulnerabilityNodeId,
+        result.verdict,
+        result.paths.length > 0 ? JSON.stringify(result.paths) : null,
+        result.unresolvedSymbols.length > 0 ? JSON.stringify(result.unresolvedSymbols) : null,
+        result.reachingEntryPointCount,
+        Date.now()
+      ]
+    );
+  }
+  /**
+   * Store impact summary in sec_impact table.
+   */
+  storeImpactSummary(rawDb, vulnerabilityNodeId, summary) {
+    rawDb.run(
+      `INSERT OR REPLACE INTO sec_impact
+        (vulnerability_node_id, affected_layers, affected_entry_points, distinct_path_count, analyzed_at)
+       VALUES (?, ?, ?, ?, ?)`,
+      [
+        vulnerabilityNodeId,
+        JSON.stringify(summary.affectedLayers),
+        JSON.stringify(summary.affectedEntryPoints),
+        summary.distinctPathCount,
+        Date.now()
+      ]
+    );
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ReachabilityAnalyzer
+});
+//# sourceMappingURL=reachability.js.map

package/dist/security/reachability.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/reachability.ts"],
+  "sourcesContent": ["/**\n * KiroGraph-Sec Reachability Analyzer\n *\n * Traverses the knowledge graph from application entry points to determine\n * whether vulnerable dependencies are reachable through actual code paths.\n * Produces reachability verdicts and impact summaries enriched with\n * architectural layer context.\n *\n * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6, 5.1, 5.2, 5.3, 5.4, 5.5\n */\n\nimport type { GraphDatabase } from '../db/database';\nimport type { KiroGraphConfig } from '../config';\nimport type {\n  ReachabilityVerdict,\n  ReachabilityPath,\n  ReachabilityResult,\n  ImpactSummary,\n} from './types';\n\n/** Edge kinds used for reachability traversal */\nconst TRAVERSAL_EDGE_KINDS = ['calls', 'imports', 'references'] as const;\n\n/** Maximum unresolved symbols to report */\nconst MAX_UNRESOLVED_SYMBOLS = 50;\n\n/** Maximum distinct paths to report in impact summary */\nconst MAX_DISTINCT_PATHS = 100;\n\n/**\n * ReachabilityAnalyzer traverses the knowledge graph from entry points\n * toward affected dependency nodes to determine reachability verdicts.\n */\nexport class ReachabilityAnalyzer {\n  private readonly db: GraphDatabase;\n  private readonly config: KiroGraphConfig;\n\n  constructor(db: GraphDatabase, config: KiroGraphConfig) {\n    this.db = db;\n    this.config = config;\n  }\n\n  /**\n   * Analyze reachability for a single Vulnerability_Node.\n   *\n   * 1. Find the Dependency_Node linked via `has_vulnerability` edge\n   * 2. Find all Entry_Points in the graph\n   * 3. BFS from each entry point toward the dependency node\n   * 4. Assign verdict based on path existence and unresolved imports\n   *\n   * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6\n   */\n  async analyze(vulnerabilityNodeId: string): Promise<ReachabilityResult> {\n    const rawDb = this.db.getRawDb();\n\n    // Step 1: Find the Dependency_Node linked to this vulnerability\n    const depEdge = rawDb.get(\n      `SELECT source FROM edges WHERE target = ? AND kind = 'has_vulnerability'`,\n      [vulnerabilityNodeId],\n    );\n\n    if (!depEdge) {\n      // No dependency linked \u2014 cannot determine reachability\n      return {\n        verdict: 'under_investigation',\n        paths: [],\n        unresolvedSymbols: [],\n        reachingEntryPointCount: 0,\n      };\n    }\n\n    const dependencyNodeId: string = depEdge.source;\n\n    // Step 2: Find all Entry_Points\n    // Entry points are: nodes with kind='route' OR nodes with kind='function' that are exported\n    const entryPoints: Array<{ id: string }> = rawDb.all(\n      `SELECT id FROM nodes WHERE kind = 'route'\n       UNION\n       SELECT id FROM nodes WHERE kind = 'function' AND is_exported = 1`,\n    );\n\n    if (entryPoints.length === 0) {\n      // No entry points \u2014 cannot determine reachability\n      return {\n        verdict: 'not_affected',\n        paths: [],\n        unresolvedSymbols: [],\n        reachingEntryPointCount: 0,\n      };\n    }\n\n    // Step 3: BFS from each entry point toward the dependency node\n    const reachingPaths: ReachabilityPath[] = [];\n    const allUnresolvedSymbols = new Set<string>();\n\n    for (const ep of entryPoints) {\n      const result = this.bfsFromEntryPoint(rawDb, ep.id, dependencyNodeId);\n\n      if (result.path) {\n        reachingPaths.push({\n          entryPoint: ep.id,\n          path: result.path,\n        });\n      }\n\n      for (const sym of result.unresolvedSymbols) {\n        allUnresolvedSymbols.add(sym);\n      }\n    }\n\n    // Step 4: Assign verdict\n    const unresolvedSymbols = Array.from(allUnresolvedSymbols).slice(0, MAX_UNRESOLVED_SYMBOLS);\n\n    let verdict: ReachabilityVerdict;\n    if (reachingPaths.length > 0) {\n      verdict = 'affected';\n    } else if (allUnresolvedSymbols.size > 0) {\n      verdict = 'under_investigation';\n    } else {\n      verdict = 'not_affected';\n    }\n\n    const result: ReachabilityResult = {\n      verdict,\n      paths: reachingPaths,\n      unresolvedSymbols: verdict === 'under_investigation' ? unresolvedSymbols : [],\n      reachingEntryPointCount: reachingPaths.length,\n    };\n\n    // Store result in sec_reachability table\n    this.storeReachabilityResult(rawDb, vulnerabilityNodeId, result);\n\n    return result;\n  }\n\n  /**\n   * Produce impact summary for an affected vulnerability.\n   *\n   * Returns null if the vulnerability is not affected.\n   * Reads layer assignments from `arch_file_layers` table.\n   *\n   * Requirements: 5.1, 5.2, 5.3, 5.4, 5.5\n   */\n  async getImpactSummary(vulnerabilityNodeId: string): Promise<ImpactSummary | null> {\n    const rawDb = this.db.getRawDb();\n\n    // Check if the vulnerability has verdict 'affected'\n    const reachRow = rawDb.get(\n      `SELECT verdict, paths, reaching_entry_point_count FROM sec_reachability WHERE vulnerability_node_id = ?`,\n      [vulnerabilityNodeId],\n    );\n\n    if (!reachRow || reachRow.verdict !== 'affected') {\n      return null;\n    }\n\n    const paths: ReachabilityPath[] = reachRow.paths ? JSON.parse(reachRow.paths) : [];\n\n    if (paths.length === 0) {\n      return null;\n    }\n\n    // Collect all node IDs on reachable paths\n    const allNodeIds = new Set<string>();\n    const affectedEntryPoints: string[] = [];\n\n    for (const p of paths) {\n      affectedEntryPoints.push(p.entryPoint);\n      for (const nodeId of p.path) {\n        allNodeIds.add(nodeId);\n      }\n    }\n\n    // Identify architectural layers on reachable paths\n    const affectedLayers = new Set<string>();\n\n    if (this.config.enableArchitecture) {\n      // Get file paths for all nodes on reachable paths\n      const nodeIds = Array.from(allNodeIds);\n      if (nodeIds.length > 0) {\n        const placeholders = nodeIds.map(() => '?').join(',');\n        const nodeFiles: Array<{ id: string; file_path: string }> = rawDb.all(\n          `SELECT id, file_path FROM nodes WHERE id IN (${placeholders})`,\n          nodeIds,\n        );\n\n        // Get layer assignments for those files from arch_file_layers\n        const filePaths = [...new Set(nodeFiles.map(n => n.file_path).filter(Boolean))];\n        if (filePaths.length > 0) {\n          const filePlaceholders = filePaths.map(() => '?').join(',');\n          const layerRows: Array<{ file_path: string; layer_id: string }> = rawDb.all(\n            `SELECT file_path, layer_id FROM arch_file_layers WHERE file_path IN (${filePlaceholders})`,\n            filePaths,\n          );\n\n          const fileToLayer = new Map<string, string>();\n          for (const row of layerRows) {\n            fileToLayer.set(row.file_path, row.layer_id);\n          }\n\n          // Assign layers to nodes; classify as \"unclassified\" if no layer assigned\n          for (const nf of nodeFiles) {\n            if (nf.file_path) {\n              const layer = fileToLayer.get(nf.file_path);\n              affectedLayers.add(layer ?? 'unclassified');\n            }\n          }\n        }\n      }\n    }\n    // When enableArchitecture is false, omit layer classification (Requirement 5.4)\n\n    // Count distinct paths (capped at MAX_DISTINCT_PATHS)\n    // Two paths are distinct if they differ by at least one intermediate symbol\n    const distinctPathSet = new Set<string>();\n    for (const p of paths) {\n      // Use the full path as a key for distinctness\n      const pathKey = p.path.join('\u2192');\n      distinctPathSet.add(pathKey);\n      if (distinctPathSet.size >= MAX_DISTINCT_PATHS) break;\n    }\n\n    const summary: ImpactSummary = {\n      affectedLayers: Array.from(affectedLayers),\n      affectedEntryPoints,\n      distinctPathCount: Math.min(distinctPathSet.size, MAX_DISTINCT_PATHS),\n    };\n\n    // Store impact summary in sec_impact table\n    this.storeImpactSummary(rawDb, vulnerabilityNodeId, summary);\n\n    return summary;\n  }\n\n  /**\n   * Analyze all Vulnerability_Nodes in the graph.\n   *\n   * Iterates all vulnerability nodes and calls analyze() for each.\n   */\n  async analyzeAll(): Promise<Map<string, ReachabilityResult>> {\n    const rawDb = this.db.getRawDb();\n    const results = new Map<string, ReachabilityResult>();\n\n    const vulnRows: Array<{ node_id: string }> = rawDb.all(\n      `SELECT node_id FROM sec_vulnerabilities`,\n    );\n\n    for (const row of vulnRows) {\n      const result = await this.analyze(row.node_id);\n      results.set(row.node_id, result);\n    }\n\n    return results;\n  }\n\n  /**\n   * BFS from a single entry point toward the dependency node.\n   *\n   * Uses outgoing edges of types: calls, imports, references.\n   * Visits each node at most once (handles cycles).\n   * Tracks unresolved imports encountered during traversal.\n   *\n   * Returns the shortest path if found, plus any unresolved symbols encountered.\n   */\n  private bfsFromEntryPoint(\n    rawDb: any,\n    entryPointId: string,\n    dependencyNodeId: string,\n  ): { path: string[] | null; unresolvedSymbols: string[] } {\n    const visited = new Set<string>();\n    const unresolvedSymbols: string[] = [];\n\n    // BFS queue: each entry is [nodeId, path from entry point]\n    const queue: Array<[string, string[]]> = [[entryPointId, [entryPointId]]];\n    visited.add(entryPointId);\n\n    // Prepare edge kind filter\n    const edgeKinds = TRAVERSAL_EDGE_KINDS.map(k => `'${k}'`).join(',');\n\n    while (queue.length > 0) {\n      const [currentId, currentPath] = queue.shift()!;\n\n      // Get outgoing edges from current node (calls, imports, references)\n      const outEdges: Array<{ target: string; kind: string }> = rawDb.all(\n        `SELECT target, kind FROM edges WHERE source = ? AND kind IN (${edgeKinds})`,\n        [currentId],\n      );\n\n      // Check if current node is an unresolved import\n      // An unresolved import is a node with kind='import' that has no outgoing edges\n      if (outEdges.length === 0) {\n        const nodeRow = rawDb.get(\n          `SELECT kind FROM nodes WHERE id = ?`,\n          [currentId],\n        );\n        if (nodeRow && nodeRow.kind === 'import') {\n          unresolvedSymbols.push(currentId);\n        }\n      }\n\n      for (const edge of outEdges) {\n        const targetId = edge.target;\n\n        // Check if we reached the dependency node\n        if (targetId === dependencyNodeId) {\n          return {\n            path: [...currentPath, targetId],\n            unresolvedSymbols,\n          };\n        }\n\n        // Skip already visited nodes (cycle handling)\n        if (visited.has(targetId)) continue;\n        visited.add(targetId);\n\n        queue.push([targetId, [...currentPath, targetId]]);\n      }\n    }\n\n    // No path found from this entry point\n    return { path: null, unresolvedSymbols };\n  }\n\n  /**\n   * Store reachability result in sec_reachability table.\n   */\n  private storeReachabilityResult(\n    rawDb: any,\n    vulnerabilityNodeId: string,\n    result: ReachabilityResult,\n  ): void {\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_reachability\n        (vulnerability_node_id, verdict, paths, unresolved_symbols, reaching_entry_point_count, analyzed_at)\n       VALUES (?, ?, ?, ?, ?, ?)`,\n      [\n        vulnerabilityNodeId,\n        result.verdict,\n        result.paths.length > 0 ? JSON.stringify(result.paths) : null,\n        result.unresolvedSymbols.length > 0 ? JSON.stringify(result.unresolvedSymbols) : null,\n        result.reachingEntryPointCount,\n        Date.now(),\n      ],\n    );\n  }\n\n  /**\n   * Store impact summary in sec_impact table.\n   */\n  private storeImpactSummary(\n    rawDb: any,\n    vulnerabilityNodeId: string,\n    summary: ImpactSummary,\n  ): void {\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_impact\n        (vulnerability_node_id, affected_layers, affected_entry_points, distinct_path_count, analyzed_at)\n       VALUES (?, ?, ?, ?, ?)`,\n      [\n        vulnerabilityNodeId,\n        JSON.stringify(summary.affectedLayers),\n        JSON.stringify(summary.affectedEntryPoints),\n        summary.distinctPathCount,\n        Date.now(),\n      ],\n    );\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAqBA,MAAM,uBAAuB,CAAC,SAAS,WAAW,YAAY;AAG9D,MAAM,yBAAyB;AAG/B,MAAM,qBAAqB;AAMpB,MAAM,qBAAqB;AAAA,EAIhC,YAAY,IAAmB,QAAyB;AACtD,SAAK,KAAK;AACV,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAM,QAAQ,qBAA0D;AACtE,UAAM,QAAQ,KAAK,GAAG,SAAS;AAG/B,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA,CAAC,mBAAmB;AAAA,IACtB;AAEA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,CAAC;AAAA,QACR,mBAAmB,CAAC;AAAA,QACpB,yBAAyB;AAAA,MAC3B;AAAA,IACF;AAEA,UAAM,mBAA2B,QAAQ;AAIzC,UAAM,cAAqC,MAAM;AAAA,MAC/C;AAAA;AAAA;AAAA,IAGF;AAEA,QAAI,YAAY,WAAW,GAAG;AAE5B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,CAAC;AAAA,QACR,mBAAmB,CAAC;AAAA,QACpB,yBAAyB;AAAA,MAC3B;AAAA,IACF;AAGA,UAAM,gBAAoC,CAAC;AAC3C,UAAM,uBAAuB,oBAAI,IAAY;AAE7C,eAAW,MAAM,aAAa;AAC5B,YAAMA,UAAS,KAAK,kBAAkB,OAAO,GAAG,IAAI,gBAAgB;AAEpE,UAAIA,QAAO,MAAM;AACf,sBAAc,KAAK;AAAA,UACjB,YAAY,GAAG;AAAA,UACf,MAAMA,QAAO;AAAA,QACf,CAAC;AAAA,MACH;AAEA,iBAAW,OAAOA,QAAO,mBAAmB;AAC1C,6BAAqB,IAAI,GAAG;AAAA,MAC9B;AAAA,IACF;AAGA,UAAM,oBAAoB,MAAM,KAAK,oBAAoB,EAAE,MAAM,GAAG,sBAAsB;AAE1F,QAAI;AACJ,QAAI,cAAc,SAAS,GAAG;AAC5B,gBAAU;AAAA,IACZ,WAAW,qBAAqB,OAAO,GAAG;AACxC,gBAAU;AAAA,IACZ,OAAO;AACL,gBAAU;AAAA,IACZ;AAEA,UAAM,SAA6B;AAAA,MACjC;AAAA,MACA,OAAO;AAAA,MACP,mBAAmB,YAAY,wBAAwB,oBAAoB,CAAC;AAAA,MAC5E,yBAAyB,cAAc;AAAA,IACzC;AAGA,SAAK,wBAAwB,OAAO,qBAAqB,MAAM;AAE/D,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,iBAAiB,qBAA4D;AACjF,UAAM,QAAQ,KAAK,GAAG,SAAS;AAG/B,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA,CAAC,mBAAmB;AAAA,IACtB;AAEA,QAAI,CAAC,YAAY,SAAS,YAAY,YAAY;AAChD,aAAO;AAAA,IACT;AAEA,UAAM,QAA4B,SAAS,QAAQ,KAAK,MAAM,SAAS,KAAK,IAAI,CAAC;AAEjF,QAAI,MAAM,WAAW,GAAG;AACtB,aAAO;AAAA,IACT;AAGA,UAAM,aAAa,oBAAI,IAAY;AACnC,UAAM,sBAAgC,CAAC;AAEvC,eAAW,KAAK,OAAO;AACrB,0BAAoB,KAAK,EAAE,UAAU;AACrC,iBAAW,UAAU,EAAE,MAAM;AAC3B,mBAAW,IAAI,MAAM;AAAA,MACvB;AAAA,IACF;AAGA,UAAM,iBAAiB,oBAAI,IAAY;AAEvC,QAAI,KAAK,OAAO,oBAAoB;AAElC,YAAM,UAAU,MAAM,KAAK,UAAU;AACrC,UAAI,QAAQ,SAAS,GAAG;AACtB,cAAM,eAAe,QAAQ,IAAI,MAAM,GAAG,EAAE,KAAK,GAAG;AACpD,cAAM,YAAsD,MAAM;AAAA,UAChE,gDAAgD,YAAY;AAAA,UAC5D;AAAA,QACF;AAGA,cAAM,YAAY,CAAC,GAAG,IAAI,IAAI,UAAU,IAAI,OAAK,EAAE,SAAS,EAAE,OAAO,OAAO,CAAC,CAAC;AAC9E,YAAI,UAAU,SAAS,GAAG;AACxB,gBAAM,mBAAmB,UAAU,IAAI,MAAM,GAAG,EAAE,KAAK,GAAG;AAC1D,gBAAM,YAA4D,MAAM;AAAA,YACtE,wEAAwE,gBAAgB;AAAA,YACxF;AAAA,UACF;AAEA,gBAAM,cAAc,oBAAI,IAAoB;AAC5C,qBAAW,OAAO,WAAW;AAC3B,wBAAY,IAAI,IAAI,WAAW,IAAI,QAAQ;AAAA,UAC7C;AAGA,qBAAW,MAAM,WAAW;AAC1B,gBAAI,GAAG,WAAW;AAChB,oBAAM,QAAQ,YAAY,IAAI,GAAG,SAAS;AAC1C,6BAAe,IAAI,SAAS,cAAc;AAAA,YAC5C;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAKA,UAAM,kBAAkB,oBAAI,IAAY;AACxC,eAAW,KAAK,OAAO;AAErB,YAAM,UAAU,EAAE,KAAK,KAAK,QAAG;AAC/B,sBAAgB,IAAI,OAAO;AAC3B,UAAI,gBAAgB,QAAQ,mBAAoB;AAAA,IAClD;AAEA,UAAM,UAAyB;AAAA,MAC7B,gBAAgB,MAAM,KAAK,cAAc;AAAA,MACzC;AAAA,MACA,mBAAmB,KAAK,IAAI,gBAAgB,MAAM,kBAAkB;AAAA,IACtE;AAGA,SAAK,mBAAmB,OAAO,qBAAqB,OAAO;AAE3D,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAuD;AAC3D,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,UAAU,oBAAI,IAAgC;AAEpD,UAAM,WAAuC,MAAM;AAAA,MACjD;AAAA,IACF;AAEA,eAAW,OAAO,UAAU;AAC1B,YAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,OAAO;AAC7C,cAAQ,IAAI,IAAI,SAAS,MAAM;AAAA,IACjC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,kBACN,OACA,cACA,kBACwD;AACxD,UAAM,UAAU,oBAAI,IAAY;AAChC,UAAM,oBAA8B,CAAC;AAGrC,UAAM,QAAmC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;AACxE,YAAQ,IAAI,YAAY;AAGxB,UAAM,YAAY,qBAAqB,IAAI,OAAK,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG;AAElE,WAAO,MAAM,SAAS,GAAG;AACvB,YAAM,CAAC,WAAW,WAAW,IAAI,MAAM,MAAM;AAG7C,YAAM,WAAoD,MAAM;AAAA,QAC9D,gEAAgE,SAAS;AAAA,QACzE,CAAC,SAAS;AAAA,MACZ;AAIA,UAAI,SAAS,WAAW,GAAG;AACzB,cAAM,UAAU,MAAM;AAAA,UACpB;AAAA,UACA,CAAC,SAAS;AAAA,QACZ;AACA,YAAI,WAAW,QAAQ,SAAS,UAAU;AACxC,4BAAkB,KAAK,SAAS;AAAA,QAClC;AAAA,MACF;AAEA,iBAAW,QAAQ,UAAU;AAC3B,cAAM,WAAW,KAAK;AAGtB,YAAI,aAAa,kBAAkB;AACjC,iBAAO;AAAA,YACL,MAAM,CAAC,GAAG,aAAa,QAAQ;AAAA,YAC/B;AAAA,UACF;AAAA,QACF;AAGA,YAAI,QAAQ,IAAI,QAAQ,EAAG;AAC3B,gBAAQ,IAAI,QAAQ;AAEpB,cAAM,KAAK,CAAC,UAAU,CAAC,GAAG,aAAa,QAAQ,CAAC,CAAC;AAAA,MACnD;AAAA,IACF;AAGA,WAAO,EAAE,MAAM,MAAM,kBAAkB;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKQ,wBACN,OACA,qBACA,QACM;AACN,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA;AAAA,QACE;AAAA,QACA,OAAO;AAAA,QACP,OAAO,MAAM,SAAS,IAAI,KAAK,UAAU,OAAO,KAAK,IAAI;AAAA,QACzD,OAAO,kBAAkB,SAAS,IAAI,KAAK,UAAU,OAAO,iBAAiB,IAAI;AAAA,QACjF,OAAO;AAAA,QACP,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,mBACN,OACA,qBACA,SACM;AACN,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA;AAAA,QACE;AAAA,QACA,KAAK,UAAU,QAAQ,cAAc;AAAA,QACrC,KAAK,UAAU,QAAQ,mBAAmB;AAAA,QAC1C,QAAQ;AAAA,QACR,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": ["result"]
+}

package/dist/security/remediation.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Remediation SLA Tracker
+ *
+ * Tracks how long open vulnerabilities have been known, when a fix became
+ * available, and whether remediation is overdue based on severity-based SLA
+ * thresholds.
+ *
+ * SLA thresholds:
+ *   critical (CVSS ≥ 9)  → 7 days
+ *   high     (CVSS ≥ 7)  → 30 days
+ *   medium   (CVSS ≥ 4)  → 90 days
+ *   low / unknown        → 180 days
+ */
+import type { GraphDatabase } from '../db/database';
+export interface RemediationStatus {
+    cveId: string;
+    packageName: string;
+    severity: number | null;
+    riskScore: number | null;
+    firstDetectedAt: number | null;
+    daysOpen: number | null;
+    fixAvailableSince: number | null;
+    daysWithFixAvailable: number | null;
+    isOverdue: boolean;
+    slaStatus: 'ok' | 'warning' | 'overdue' | 'no_fix';
+    slaDeadline: number | null;
+}
+export declare class RemediationTracker {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    /**
+     * Called when a vulnerability is first inserted.
+     * Sets first_detected_at if not already set, and fix_available_since if a
+     * fixed_version is provided and fix_available_since is not yet recorded.
+     */
+    markDetected(vulnNodeId: string, fixedVersion: string | null): void;
+    /**
+     * Get remediation status for all open (non-remediated, non-suppressed)
+     * vulnerabilities that have been detected.
+     */
+    getStatus(): RemediationStatus[];
+    /**
+     * SLA thresholds by CVSS severity:
+     *   critical (≥ 9)  → 7 days
+     *   high (≥ 7)      → 30 days
+     *   medium (≥ 4)    → 90 days
+     *   low / unknown   → 180 days
+     */
+    getSlaThresholdDays(severity: number | null): number;
+}
+//# sourceMappingURL=remediation.d.ts.map

package/dist/security/remediation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../src/security/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACnD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAID,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAE9C;;;;OAIG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAuBnE;;;OAGG;IACH,SAAS,IAAI,iBAAiB,EAAE;IAgFhC;;;;;;OAMG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM;CAOrD"}

package/dist/security/remediation.js

@@ -0,0 +1,126 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var remediation_exports = {};
+__export(remediation_exports, {
+  RemediationTracker: () => RemediationTracker
+});
+module.exports = __toCommonJS(remediation_exports);
+class RemediationTracker {
+  constructor(db) {
+    this.db = db;
+  }
+  /**
+   * Called when a vulnerability is first inserted.
+   * Sets first_detected_at if not already set, and fix_available_since if a
+   * fixed_version is provided and fix_available_since is not yet recorded.
+   */
+  markDetected(vulnNodeId, fixedVersion) {
+    const rawDb = this.db.getRawDb();
+    const now = Date.now();
+    rawDb.run(
+      `UPDATE sec_vulnerabilities
+       SET first_detected_at = COALESCE(first_detected_at, ?)
+       WHERE node_id = ?`,
+      [now, vulnNodeId]
+    );
+    if (fixedVersion) {
+      rawDb.run(
+        `UPDATE sec_vulnerabilities
+         SET fix_available_since = COALESCE(fix_available_since, ?)
+         WHERE node_id = ? AND fixed_version IS NOT NULL`,
+        [now, vulnNodeId]
+      );
+    }
+  }
+  /**
+   * Get remediation status for all open (non-remediated, non-suppressed)
+   * vulnerabilities that have been detected.
+   */
+  getStatus() {
+    const rawDb = this.db.getRawDb();
+    const now = Date.now();
+    const rows = rawDb.all(
+      `SELECT v.node_id, v.cve_id, v.severity_score, v.risk_score,
+              v.fixed_version, v.first_detected_at, v.fix_available_since,
+              v.suppressed_at, v.remediated_at,
+              d.package_name
+       FROM sec_vulnerabilities v
+       LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'
+       LEFT JOIN sec_dependencies d ON d.node_id = e.source
+       WHERE v.remediated_at IS NULL
+         AND v.suppressed_at IS NULL
+         AND v.first_detected_at IS NOT NULL`
+    );
+    return rows.map((row) => {
+      const firstDetectedAt = row.first_detected_at;
+      const daysOpen = firstDetectedAt !== null ? Math.floor((now - firstDetectedAt) / (1e3 * 60 * 60 * 24)) : null;
+      const fixAvailableSince = row.fix_available_since;
+      const daysWithFixAvailable = fixAvailableSince !== null ? Math.floor((now - fixAvailableSince) / (1e3 * 60 * 60 * 24)) : null;
+      const slaThreshold = this.getSlaThresholdDays(row.severity_score);
+      const slaDeadline = fixAvailableSince !== null ? fixAvailableSince + slaThreshold * 24 * 60 * 60 * 1e3 : firstDetectedAt !== null ? firstDetectedAt + slaThreshold * 24 * 60 * 60 * 1e3 : null;
+      let slaStatus;
+      let isOverdue = false;
+      if (!row.fixed_version && !fixAvailableSince) {
+        slaStatus = "no_fix";
+        isOverdue = false;
+      } else if (slaDeadline !== null && now > slaDeadline) {
+        slaStatus = "overdue";
+        isOverdue = true;
+      } else if (slaDeadline !== null && now > slaDeadline - slaThreshold * 0.5 * 24 * 60 * 60 * 1e3) {
+        slaStatus = "warning";
+        isOverdue = false;
+      } else {
+        slaStatus = "ok";
+        isOverdue = false;
+      }
+      return {
+        cveId: row.cve_id,
+        packageName: row.package_name ?? "unknown",
+        severity: row.severity_score,
+        riskScore: row.risk_score,
+        firstDetectedAt,
+        daysOpen,
+        fixAvailableSince,
+        daysWithFixAvailable,
+        isOverdue,
+        slaStatus,
+        slaDeadline
+      };
+    });
+  }
+  /**
+   * SLA thresholds by CVSS severity:
+   *   critical (≥ 9)  → 7 days
+   *   high (≥ 7)      → 30 days
+   *   medium (≥ 4)    → 90 days
+   *   low / unknown   → 180 days
+   */
+  getSlaThresholdDays(severity) {
+    if (severity === null) return 180;
+    if (severity >= 9) return 7;
+    if (severity >= 7) return 30;
+    if (severity >= 4) return 90;
+    return 180;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RemediationTracker
+});
+//# sourceMappingURL=remediation.js.map

package/dist/security/remediation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/remediation.ts"],
+  "sourcesContent": ["/**\n * Remediation SLA Tracker\n *\n * Tracks how long open vulnerabilities have been known, when a fix became\n * available, and whether remediation is overdue based on severity-based SLA\n * thresholds.\n *\n * SLA thresholds:\n *   critical (CVSS \u2265 9)  \u2192 7 days\n *   high     (CVSS \u2265 7)  \u2192 30 days\n *   medium   (CVSS \u2265 4)  \u2192 90 days\n *   low / unknown        \u2192 180 days\n */\n\nimport type { GraphDatabase } from '../db/database';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface RemediationStatus {\n  cveId: string;\n  packageName: string;\n  severity: number | null;\n  riskScore: number | null;\n  firstDetectedAt: number | null;\n  daysOpen: number | null;\n  fixAvailableSince: number | null;\n  daysWithFixAvailable: number | null;\n  isOverdue: boolean;\n  slaStatus: 'ok' | 'warning' | 'overdue' | 'no_fix';\n  slaDeadline: number | null;   // epoch ms\n}\n\n// \u2500\u2500 RemediationTracker \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class RemediationTracker {\n  constructor(private readonly db: GraphDatabase) {}\n\n  /**\n   * Called when a vulnerability is first inserted.\n   * Sets first_detected_at if not already set, and fix_available_since if a\n   * fixed_version is provided and fix_available_since is not yet recorded.\n   */\n  markDetected(vulnNodeId: string, fixedVersion: string | null): void {\n    const rawDb = this.db.getRawDb();\n    const now = Date.now();\n\n    // Set first_detected_at only if not already set\n    rawDb.run(\n      `UPDATE sec_vulnerabilities\n       SET first_detected_at = COALESCE(first_detected_at, ?)\n       WHERE node_id = ?`,\n      [now, vulnNodeId],\n    );\n\n    // Set fix_available_since if a fix is known and not yet recorded\n    if (fixedVersion) {\n      rawDb.run(\n        `UPDATE sec_vulnerabilities\n         SET fix_available_since = COALESCE(fix_available_since, ?)\n         WHERE node_id = ? AND fixed_version IS NOT NULL`,\n        [now, vulnNodeId],\n      );\n    }\n  }\n\n  /**\n   * Get remediation status for all open (non-remediated, non-suppressed)\n   * vulnerabilities that have been detected.\n   */\n  getStatus(): RemediationStatus[] {\n    const rawDb = this.db.getRawDb();\n    const now = Date.now();\n\n    const rows: Array<{\n      node_id: string;\n      cve_id: string;\n      severity_score: number | null;\n      risk_score: number | null;\n      fixed_version: string | null;\n      first_detected_at: number | null;\n      fix_available_since: number | null;\n      suppressed_at: number | null;\n      remediated_at: number | null;\n      package_name: string | null;\n    }> = rawDb.all(\n      `SELECT v.node_id, v.cve_id, v.severity_score, v.risk_score,\n              v.fixed_version, v.first_detected_at, v.fix_available_since,\n              v.suppressed_at, v.remediated_at,\n              d.package_name\n       FROM sec_vulnerabilities v\n       LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n       LEFT JOIN sec_dependencies d ON d.node_id = e.source\n       WHERE v.remediated_at IS NULL\n         AND v.suppressed_at IS NULL\n         AND v.first_detected_at IS NOT NULL`,\n    );\n\n    return rows.map(row => {\n      const firstDetectedAt = row.first_detected_at;\n      const daysOpen = firstDetectedAt !== null\n        ? Math.floor((now - firstDetectedAt) / (1000 * 60 * 60 * 24))\n        : null;\n\n      const fixAvailableSince = row.fix_available_since;\n      const daysWithFixAvailable = fixAvailableSince !== null\n        ? Math.floor((now - fixAvailableSince) / (1000 * 60 * 60 * 24))\n        : null;\n\n      const slaThreshold = this.getSlaThresholdDays(row.severity_score);\n      const slaDeadline = fixAvailableSince !== null\n        ? fixAvailableSince + slaThreshold * 24 * 60 * 60 * 1000\n        : firstDetectedAt !== null\n          ? firstDetectedAt + slaThreshold * 24 * 60 * 60 * 1000\n          : null;\n\n      let slaStatus: RemediationStatus['slaStatus'];\n      let isOverdue = false;\n\n      if (!row.fixed_version && !fixAvailableSince) {\n        slaStatus = 'no_fix';\n        isOverdue = false;\n      } else if (slaDeadline !== null && now > slaDeadline) {\n        slaStatus = 'overdue';\n        isOverdue = true;\n      } else if (slaDeadline !== null && now > slaDeadline - slaThreshold * 0.5 * 24 * 60 * 60 * 1000) {\n        // Over 50% of SLA elapsed\n        slaStatus = 'warning';\n        isOverdue = false;\n      } else {\n        slaStatus = 'ok';\n        isOverdue = false;\n      }\n\n      return {\n        cveId: row.cve_id,\n        packageName: row.package_name ?? 'unknown',\n        severity: row.severity_score,\n        riskScore: row.risk_score,\n        firstDetectedAt,\n        daysOpen,\n        fixAvailableSince,\n        daysWithFixAvailable,\n        isOverdue,\n        slaStatus,\n        slaDeadline,\n      };\n    });\n  }\n\n  /**\n   * SLA thresholds by CVSS severity:\n   *   critical (\u2265 9)  \u2192 7 days\n   *   high (\u2265 7)      \u2192 30 days\n   *   medium (\u2265 4)    \u2192 90 days\n   *   low / unknown   \u2192 180 days\n   */\n  getSlaThresholdDays(severity: number | null): number {\n    if (severity === null) return 180;\n    if (severity >= 9) return 7;\n    if (severity >= 7) return 30;\n    if (severity >= 4) return 90;\n    return 180;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCO,MAAM,mBAAmB;AAAA,EAC9B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,aAAa,YAAoB,cAAmC;AAClE,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,MAAM,KAAK,IAAI;AAGrB,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,KAAK,UAAU;AAAA,IAClB;AAGA,QAAI,cAAc;AAChB,YAAM;AAAA,QACJ;AAAA;AAAA;AAAA,QAGA,CAAC,KAAK,UAAU;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAiC;AAC/B,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,MAAM,KAAK,IAAI;AAErB,UAAM,OAWD,MAAM;AAAA,MACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUF;AAEA,WAAO,KAAK,IAAI,SAAO;AACrB,YAAM,kBAAkB,IAAI;AAC5B,YAAM,WAAW,oBAAoB,OACjC,KAAK,OAAO,MAAM,oBAAoB,MAAO,KAAK,KAAK,GAAG,IAC1D;AAEJ,YAAM,oBAAoB,IAAI;AAC9B,YAAM,uBAAuB,sBAAsB,OAC/C,KAAK,OAAO,MAAM,sBAAsB,MAAO,KAAK,KAAK,GAAG,IAC5D;AAEJ,YAAM,eAAe,KAAK,oBAAoB,IAAI,cAAc;AAChE,YAAM,cAAc,sBAAsB,OACtC,oBAAoB,eAAe,KAAK,KAAK,KAAK,MAClD,oBAAoB,OAClB,kBAAkB,eAAe,KAAK,KAAK,KAAK,MAChD;AAEN,UAAI;AACJ,UAAI,YAAY;AAEhB,UAAI,CAAC,IAAI,iBAAiB,CAAC,mBAAmB;AAC5C,oBAAY;AACZ,oBAAY;AAAA,MACd,WAAW,gBAAgB,QAAQ,MAAM,aAAa;AACpD,oBAAY;AACZ,oBAAY;AAAA,MACd,WAAW,gBAAgB,QAAQ,MAAM,cAAc,eAAe,MAAM,KAAK,KAAK,KAAK,KAAM;AAE/F,oBAAY;AACZ,oBAAY;AAAA,MACd,OAAO;AACL,oBAAY;AACZ,oBAAY;AAAA,MACd;AAEA,aAAO;AAAA,QACL,OAAO,IAAI;AAAA,QACX,aAAa,IAAI,gBAAgB;AAAA,QACjC,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,QACf;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,oBAAoB,UAAiC;AACnD,QAAI,aAAa,KAAM,QAAO;AAC9B,QAAI,YAAY,EAAG,QAAO;AAC1B,QAAI,YAAY,EAAG,QAAO;AAC1B,QAAI,YAAY,EAAG,QAAO;AAC1B,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/security/secrets.d.ts

@@ -0,0 +1,38 @@
+/**
+ * KiroGraph-Sec Secrets Scanner
+ *
+ * Regex-based secret detection that scans source files and enriches findings
+ * with call graph context (containing function + reachability from entry points).
+ */
+import type { GraphDatabase } from '../db/database';
+export interface SecretFinding {
+    filePath: string;
+    line: number;
+    column: number;
+    type: string;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    /** Redacted: first 4 chars of the matched value + "****" */
+    snippet: string;
+    nodeId?: string;
+    nodeName?: string;
+    reachableFromEntryPoints: string[];
+    entryPointCount: number;
+}
+export interface SecretsResult {
+    findings: SecretFinding[];
+    filesScanned: number;
+    totalFindings: number;
+    criticalCount: number;
+    highCount: number;
+}
+export declare class SecretsScanner {
+    private readonly db;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, projectRoot: string);
+    scan(options?: {
+        includeTests?: boolean;
+    }): Promise<SecretsResult>;
+    private findContainingNode;
+    private findEntryPoints;
+}
+//# sourceMappingURL=secrets.d.ts.map

package/dist/security/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/security/secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AA0DD,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,EAAE,EAAE,aAAa,EACjB,WAAW,EAAE,MAAM;IAGhC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAgGxE,OAAO,CAAC,kBAAkB;IAkB1B,OAAO,CAAC,eAAe;CAoBxB"}