kirograph 0.17.0 → 0.20.0

package/dist/security/secrets.js

@@ -0,0 +1,176 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var secrets_exports = {};
+__export(secrets_exports, {
+  SecretsScanner: () => SecretsScanner
+});
+module.exports = __toCommonJS(secrets_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+const SECRET_PATTERNS = [
+  { name: "AWS Access Key ID", severity: "critical", pattern: /AKIA[0-9A-Z]{16}/ },
+  { name: "AWS Secret Access Key", severity: "critical", pattern: /aws[_\-]secret[_\-]?(access[_\-]?)?key\s*[=:]\s*["']?([A-Za-z0-9\/+=]{40})["']?/i },
+  { name: "GitHub Token", severity: "critical", pattern: /gh[pousr]_[A-Za-z0-9]{36,}/ },
+  { name: "Stripe Secret Key", severity: "critical", pattern: /sk_(live|test)_[A-Za-z0-9]{24,}/ },
+  { name: "Stripe Publishable Key", severity: "high", pattern: /pk_(live|test)_[A-Za-z0-9]{24,}/ },
+  { name: "SendGrid API Key", severity: "critical", pattern: /SG\.[A-Za-z0-9_\-]{22}\.[A-Za-z0-9_\-]{43}/ },
+  { name: "Twilio Account SID", severity: "high", pattern: /AC[a-z0-9]{32}/ },
+  { name: "Slack Token", severity: "high", pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/ },
+  { name: "Private Key (PEM)", severity: "critical", pattern: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/ },
+  { name: "JWT Token (hardcoded)", severity: "high", pattern: /eyJ[A-Za-z0-9+\/]{20,}\.[A-Za-z0-9+\/]{20,}\.[A-Za-z0-9+\/\-_]{20,}/ },
+  { name: "Generic API Key", severity: "medium", pattern: /api[_\-]?key\s*[=:]\s*["']([A-Za-z0-9_\-]{20,})["']/i },
+  { name: "Generic Secret", severity: "medium", pattern: /(?:secret|password|passwd|pwd)\s*[=:]\s*["']([^"'\s]{8,})["']/i },
+  { name: "Bearer Token", severity: "medium", pattern: /bearer\s+[A-Za-z0-9+\/=]{20,}/i },
+  { name: "Database URL", severity: "high", pattern: /(postgres|mysql|mongodb|redis):\/\/[^:]+:[^@]+@[^\/\s]+/ }
+];
+const SKIP_DIRS = ["node_modules", ".kirograph", "dist", "build"];
+const TEST_PATTERNS = [
+  /\.test\.[tj]sx?$/,
+  /\.spec\.[tj]sx?$/,
+  /\/__tests__\//,
+  /\/test\//,
+  /\/tests\//
+];
+function isTestFile(filePath) {
+  return TEST_PATTERNS.some((p) => p.test(filePath));
+}
+function shouldSkipPath(filePath) {
+  const parts = filePath.split(path.sep);
+  return parts.some((p) => SKIP_DIRS.includes(p));
+}
+function redact(value) {
+  if (value.length <= 4) return value + "****";
+  return value.slice(0, 4) + "****";
+}
+class SecretsScanner {
+  constructor(db, projectRoot) {
+    this.db = db;
+    this.projectRoot = projectRoot;
+  }
+  async scan(options) {
+    const rawDb = this.db.getRawDb();
+    const includeTests = options?.includeTests ?? false;
+    const fileRows = rawDb.all(`SELECT path FROM files`);
+    const findings = [];
+    let filesScanned = 0;
+    for (const { path: relOrAbsPath } of fileRows) {
+      const absPath = path.isAbsolute(relOrAbsPath) ? relOrAbsPath : path.join(this.projectRoot, relOrAbsPath);
+      if (shouldSkipPath(absPath)) continue;
+      if (!includeTests && isTestFile(absPath)) continue;
+      let content;
+      try {
+        content = fs.readFileSync(absPath, "utf8");
+      } catch {
+        continue;
+      }
+      filesScanned++;
+      const lines = content.split("\n");
+      for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+        const lineText = lines[lineIdx];
+        const lineNumber = lineIdx + 1;
+        for (const { name, severity, pattern } of SECRET_PATTERNS) {
+          const re = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g");
+          let match;
+          while ((match = re.exec(lineText)) !== null) {
+            const matchedValue = match[0];
+            const column = match.index + 1;
+            const { nodeId, nodeName } = this.findContainingNode(rawDb, absPath, lineNumber);
+            const entryPoints = nodeId ? this.findEntryPoints(rawDb, nodeId) : [];
+            findings.push({
+              filePath: absPath,
+              line: lineNumber,
+              column,
+              type: name,
+              severity,
+              snippet: redact(matchedValue),
+              nodeId,
+              nodeName,
+              reachableFromEntryPoints: entryPoints,
+              entryPointCount: entryPoints.length
+            });
+            if (match[0].length === 0) re.lastIndex++;
+          }
+        }
+      }
+    }
+    const criticalCount = findings.filter((f) => f.severity === "critical").length;
+    const highCount = findings.filter((f) => f.severity === "high").length;
+    findings.sort((a, b) => {
+      const severityOrder = { critical: 0, high: 1, medium: 2, low: 3 };
+      const diff = severityOrder[a.severity] - severityOrder[b.severity];
+      if (diff !== 0) return diff;
+      if (a.filePath !== b.filePath) return a.filePath.localeCompare(b.filePath);
+      return a.line - b.line;
+    });
+    return {
+      findings,
+      filesScanned,
+      totalFindings: findings.length,
+      criticalCount,
+      highCount
+    };
+  }
+  // ── Private helpers ──────────────────────────────────────────────────────────
+  findContainingNode(rawDb, filePath, line) {
+    const row = rawDb.get(
+      `SELECT id, name FROM nodes
+       WHERE file_path = ? AND start_line <= ? AND end_line >= ?
+         AND kind IN ('function', 'method')
+       ORDER BY (end_line - start_line) ASC
+       LIMIT 1`,
+      [filePath, line, line]
+    );
+    if (!row) return {};
+    return { nodeId: row.id, nodeName: row.name };
+  }
+  findEntryPoints(rawDb, nodeId) {
+    const rows = rawDb.all(
+      `WITH RECURSIVE callers(node_id, depth) AS (
+         SELECT source, 1 FROM edges WHERE target = ? AND kind = 'calls'
+         UNION
+         SELECT e.source, c.depth + 1
+         FROM edges e
+         JOIN callers c ON e.target = c.node_id
+         WHERE c.depth < 5 AND e.kind = 'calls'
+       )
+       SELECT DISTINCT n.id, n.name
+       FROM callers c
+       JOIN nodes n ON n.id = c.node_id
+       WHERE n.kind IN ('route', 'function')
+         AND (n.name LIKE '%route%' OR n.name LIKE '%handler%' OR n.name LIKE '%controller%')`,
+      [nodeId]
+    );
+    return rows.map((r) => r.id);
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SecretsScanner
+});
+//# sourceMappingURL=secrets.js.map

package/dist/security/secrets.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/secrets.ts"],
+  "sourcesContent": ["/**\n * KiroGraph-Sec Secrets Scanner\n *\n * Regex-based secret detection that scans source files and enriches findings\n * with call graph context (containing function + reachability from entry points).\n */\n\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport type { GraphDatabase } from '../db/database';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface SecretFinding {\n  filePath: string;\n  line: number;\n  column: number;\n  type: string;\n  severity: 'critical' | 'high' | 'medium' | 'low';\n  /** Redacted: first 4 chars of the matched value + \"****\" */\n  snippet: string;\n  nodeId?: string;\n  nodeName?: string;\n  reachableFromEntryPoints: string[];\n  entryPointCount: number;\n}\n\nexport interface SecretsResult {\n  findings: SecretFinding[];\n  filesScanned: number;\n  totalFindings: number;\n  criticalCount: number;\n  highCount: number;\n}\n\n// \u2500\u2500 Secret patterns \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface SecretPattern {\n  name: string;\n  severity: 'critical' | 'high' | 'medium' | 'low';\n  pattern: RegExp;\n}\n\nconst SECRET_PATTERNS: SecretPattern[] = [\n  { name: 'AWS Access Key ID',       severity: 'critical', pattern: /AKIA[0-9A-Z]{16}/ },\n  { name: 'AWS Secret Access Key',   severity: 'critical', pattern: /aws[_\\-]secret[_\\-]?(access[_\\-]?)?key\\s*[=:]\\s*[\"']?([A-Za-z0-9\\/+=]{40})[\"']?/i },\n  { name: 'GitHub Token',            severity: 'critical', pattern: /gh[pousr]_[A-Za-z0-9]{36,}/ },\n  { name: 'Stripe Secret Key',       severity: 'critical', pattern: /sk_(live|test)_[A-Za-z0-9]{24,}/ },\n  { name: 'Stripe Publishable Key',  severity: 'high',     pattern: /pk_(live|test)_[A-Za-z0-9]{24,}/ },\n  { name: 'SendGrid API Key',        severity: 'critical', pattern: /SG\\.[A-Za-z0-9_\\-]{22}\\.[A-Za-z0-9_\\-]{43}/ },\n  { name: 'Twilio Account SID',      severity: 'high',     pattern: /AC[a-z0-9]{32}/ },\n  { name: 'Slack Token',             severity: 'high',     pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/ },\n  { name: 'Private Key (PEM)',       severity: 'critical', pattern: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/ },\n  { name: 'JWT Token (hardcoded)',   severity: 'high',     pattern: /eyJ[A-Za-z0-9+\\/]{20,}\\.[A-Za-z0-9+\\/]{20,}\\.[A-Za-z0-9+\\/\\-_]{20,}/ },\n  { name: 'Generic API Key',         severity: 'medium',   pattern: /api[_\\-]?key\\s*[=:]\\s*[\"']([A-Za-z0-9_\\-]{20,})[\"']/i },\n  { name: 'Generic Secret',          severity: 'medium',   pattern: /(?:secret|password|passwd|pwd)\\s*[=:]\\s*[\"']([^\"'\\s]{8,})[\"']/i },\n  { name: 'Bearer Token',            severity: 'medium',   pattern: /bearer\\s+[A-Za-z0-9+\\/=]{20,}/i },\n  { name: 'Database URL',            severity: 'high',     pattern: /(postgres|mysql|mongodb|redis):\\/\\/[^:]+:[^@]+@[^\\/\\s]+/ },\n];\n\n// \u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst SKIP_DIRS = ['node_modules', '.kirograph', 'dist', 'build'];\nconst TEST_PATTERNS = [\n  /\\.test\\.[tj]sx?$/,\n  /\\.spec\\.[tj]sx?$/,\n  /\\/__tests__\\//,\n  /\\/test\\//,\n  /\\/tests\\//,\n];\n\nfunction isTestFile(filePath: string): boolean {\n  return TEST_PATTERNS.some(p => p.test(filePath));\n}\n\nfunction shouldSkipPath(filePath: string): boolean {\n  const parts = filePath.split(path.sep);\n  return parts.some(p => SKIP_DIRS.includes(p));\n}\n\n/**\n * Redact a matched string: show only the first 4 characters followed by \"****\".\n * If the match is shorter than 4 chars, show all of it + \"****\".\n */\nfunction redact(value: string): string {\n  if (value.length <= 4) return value + '****';\n  return value.slice(0, 4) + '****';\n}\n\n// \u2500\u2500 SecretsScanner \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class SecretsScanner {\n  constructor(\n    private readonly db: GraphDatabase,\n    private readonly projectRoot: string,\n  ) {}\n\n  async scan(options?: { includeTests?: boolean }): Promise<SecretsResult> {\n    const rawDb = this.db.getRawDb();\n    const includeTests = options?.includeTests ?? false;\n\n    // 1. Collect all indexed files\n    const fileRows: Array<{ path: string }> = rawDb.all(`SELECT path FROM files`);\n\n    const findings: SecretFinding[] = [];\n    let filesScanned = 0;\n\n    for (const { path: relOrAbsPath } of fileRows) {\n      // Resolve to absolute path\n      const absPath = path.isAbsolute(relOrAbsPath)\n        ? relOrAbsPath\n        : path.join(this.projectRoot, relOrAbsPath);\n\n      // Skip paths in blacklisted dirs\n      if (shouldSkipPath(absPath)) continue;\n\n      // Skip test files unless opted-in\n      if (!includeTests && isTestFile(absPath)) continue;\n\n      // Read file content\n      let content: string;\n      try {\n        content = fs.readFileSync(absPath, 'utf8');\n      } catch {\n        // File might have been deleted since indexing \u2014 skip silently\n        continue;\n      }\n\n      filesScanned++;\n      const lines = content.split('\\n');\n\n      for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {\n        const lineText = lines[lineIdx];\n        const lineNumber = lineIdx + 1;\n\n        for (const { name, severity, pattern } of SECRET_PATTERNS) {\n          // Clone regex to reset lastIndex between calls\n          const re = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : pattern.flags + 'g');\n          let match: RegExpExecArray | null;\n\n          while ((match = re.exec(lineText)) !== null) {\n            const matchedValue = match[0];\n            const column = match.index + 1;\n\n            // Enrich with graph context\n            const { nodeId, nodeName } = this.findContainingNode(rawDb, absPath, lineNumber);\n            const entryPoints = nodeId\n              ? this.findEntryPoints(rawDb, nodeId)\n              : [];\n\n            findings.push({\n              filePath: absPath,\n              line: lineNumber,\n              column,\n              type: name,\n              severity,\n              snippet: redact(matchedValue),\n              nodeId,\n              nodeName,\n              reachableFromEntryPoints: entryPoints,\n              entryPointCount: entryPoints.length,\n            });\n\n            // Avoid infinite loops on zero-width matches\n            if (match[0].length === 0) re.lastIndex++;\n          }\n        }\n      }\n    }\n\n    const criticalCount = findings.filter(f => f.severity === 'critical').length;\n    const highCount = findings.filter(f => f.severity === 'high').length;\n\n    // Sort: critical first, then high, then by file path + line\n    findings.sort((a, b) => {\n      const severityOrder = { critical: 0, high: 1, medium: 2, low: 3 };\n      const diff = severityOrder[a.severity] - severityOrder[b.severity];\n      if (diff !== 0) return diff;\n      if (a.filePath !== b.filePath) return a.filePath.localeCompare(b.filePath);\n      return a.line - b.line;\n    });\n\n    return {\n      findings,\n      filesScanned,\n      totalFindings: findings.length,\n      criticalCount,\n      highCount,\n    };\n  }\n\n  // \u2500\u2500 Private helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private findContainingNode(\n    rawDb: any,\n    filePath: string,\n    line: number,\n  ): { nodeId?: string; nodeName?: string } {\n    const row: { id: string; name: string } | undefined = rawDb.get(\n      `SELECT id, name FROM nodes\n       WHERE file_path = ? AND start_line <= ? AND end_line >= ?\n         AND kind IN ('function', 'method')\n       ORDER BY (end_line - start_line) ASC\n       LIMIT 1`,\n      [filePath, line, line],\n    );\n\n    if (!row) return {};\n    return { nodeId: row.id, nodeName: row.name };\n  }\n\n  private findEntryPoints(rawDb: any, nodeId: string): string[] {\n    const rows: Array<{ id: string; name: string }> = rawDb.all(\n      `WITH RECURSIVE callers(node_id, depth) AS (\n         SELECT source, 1 FROM edges WHERE target = ? AND kind = 'calls'\n         UNION\n         SELECT e.source, c.depth + 1\n         FROM edges e\n         JOIN callers c ON e.target = c.node_id\n         WHERE c.depth < 5 AND e.kind = 'calls'\n       )\n       SELECT DISTINCT n.id, n.name\n       FROM callers c\n       JOIN nodes n ON n.id = c.node_id\n       WHERE n.kind IN ('route', 'function')\n         AND (n.name LIKE '%route%' OR n.name LIKE '%handler%' OR n.name LIKE '%controller%')`,\n      [nodeId],\n    );\n\n    return rows.map(r => r.id);\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAOA,SAAoB;AACpB,WAAsB;AAmCtB,MAAM,kBAAmC;AAAA,EACvC,EAAE,MAAM,qBAA2B,UAAU,YAAY,SAAS,mBAAmB;AAAA,EACrF,EAAE,MAAM,yBAA2B,UAAU,YAAY,SAAS,mFAAmF;AAAA,EACrJ,EAAE,MAAM,gBAA2B,UAAU,YAAY,SAAS,6BAA6B;AAAA,EAC/F,EAAE,MAAM,qBAA2B,UAAU,YAAY,SAAS,kCAAkC;AAAA,EACpG,EAAE,MAAM,0BAA2B,UAAU,QAAY,SAAS,kCAAkC;AAAA,EACpG,EAAE,MAAM,oBAA2B,UAAU,YAAY,SAAS,6CAA6C;AAAA,EAC/G,EAAE,MAAM,sBAA2B,UAAU,QAAY,SAAS,iBAAiB;AAAA,EACnF,EAAE,MAAM,eAA2B,UAAU,QAAY,SAAS,+BAA+B;AAAA,EACjG,EAAE,MAAM,qBAA2B,UAAU,YAAY,SAAS,uDAAuD;AAAA,EACzH,EAAE,MAAM,yBAA2B,UAAU,QAAY,SAAS,sEAAsE;AAAA,EACxI,EAAE,MAAM,mBAA2B,UAAU,UAAY,SAAS,uDAAuD;AAAA,EACzH,EAAE,MAAM,kBAA2B,UAAU,UAAY,SAAS,iEAAiE;AAAA,EACnI,EAAE,MAAM,gBAA2B,UAAU,UAAY,SAAS,iCAAiC;AAAA,EACnG,EAAE,MAAM,gBAA2B,UAAU,QAAY,SAAS,0DAA0D;AAC9H;AAIA,MAAM,YAAY,CAAC,gBAAgB,cAAc,QAAQ,OAAO;AAChE,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,WAAW,UAA2B;AAC7C,SAAO,cAAc,KAAK,OAAK,EAAE,KAAK,QAAQ,CAAC;AACjD;AAEA,SAAS,eAAe,UAA2B;AACjD,QAAM,QAAQ,SAAS,MAAM,KAAK,GAAG;AACrC,SAAO,MAAM,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC;AAC9C;AAMA,SAAS,OAAO,OAAuB;AACrC,MAAI,MAAM,UAAU,EAAG,QAAO,QAAQ;AACtC,SAAO,MAAM,MAAM,GAAG,CAAC,IAAI;AAC7B;AAIO,MAAM,eAAe;AAAA,EAC1B,YACmB,IACA,aACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAM,KAAK,SAA8D;AACvE,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,eAAe,SAAS,gBAAgB;AAG9C,UAAM,WAAoC,MAAM,IAAI,wBAAwB;AAE5E,UAAM,WAA4B,CAAC;AACnC,QAAI,eAAe;AAEnB,eAAW,EAAE,MAAM,aAAa,KAAK,UAAU;AAE7C,YAAM,UAAU,KAAK,WAAW,YAAY,IACxC,eACA,KAAK,KAAK,KAAK,aAAa,YAAY;AAG5C,UAAI,eAAe,OAAO,EAAG;AAG7B,UAAI,CAAC,gBAAgB,WAAW,OAAO,EAAG;AAG1C,UAAI;AACJ,UAAI;AACF,kBAAU,GAAG,aAAa,SAAS,MAAM;AAAA,MAC3C,QAAQ;AAEN;AAAA,MACF;AAEA;AACA,YAAM,QAAQ,QAAQ,MAAM,IAAI;AAEhC,eAAS,UAAU,GAAG,UAAU,MAAM,QAAQ,WAAW;AACvD,cAAM,WAAW,MAAM,OAAO;AAC9B,cAAM,aAAa,UAAU;AAE7B,mBAAW,EAAE,MAAM,UAAU,QAAQ,KAAK,iBAAiB;AAEzD,gBAAM,KAAK,IAAI,OAAO,QAAQ,QAAQ,QAAQ,MAAM,SAAS,GAAG,IAAI,QAAQ,QAAQ,QAAQ,QAAQ,GAAG;AACvG,cAAI;AAEJ,kBAAQ,QAAQ,GAAG,KAAK,QAAQ,OAAO,MAAM;AAC3C,kBAAM,eAAe,MAAM,CAAC;AAC5B,kBAAM,SAAS,MAAM,QAAQ;AAG7B,kBAAM,EAAE,QAAQ,SAAS,IAAI,KAAK,mBAAmB,OAAO,SAAS,UAAU;AAC/E,kBAAM,cAAc,SAChB,KAAK,gBAAgB,OAAO,MAAM,IAClC,CAAC;AAEL,qBAAS,KAAK;AAAA,cACZ,UAAU;AAAA,cACV,MAAM;AAAA,cACN;AAAA,cACA,MAAM;AAAA,cACN;AAAA,cACA,SAAS,OAAO,YAAY;AAAA,cAC5B;AAAA,cACA;AAAA,cACA,0BAA0B;AAAA,cAC1B,iBAAiB,YAAY;AAAA,YAC/B,CAAC;AAGD,gBAAI,MAAM,CAAC,EAAE,WAAW,EAAG,IAAG;AAAA,UAChC;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,gBAAgB,SAAS,OAAO,OAAK,EAAE,aAAa,UAAU,EAAE;AACtE,UAAM,YAAY,SAAS,OAAO,OAAK,EAAE,aAAa,MAAM,EAAE;AAG9D,aAAS,KAAK,CAAC,GAAG,MAAM;AACtB,YAAM,gBAAgB,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE;AAChE,YAAM,OAAO,cAAc,EAAE,QAAQ,IAAI,cAAc,EAAE,QAAQ;AACjE,UAAI,SAAS,EAAG,QAAO;AACvB,UAAI,EAAE,aAAa,EAAE,SAAU,QAAO,EAAE,SAAS,cAAc,EAAE,QAAQ;AACzE,aAAO,EAAE,OAAO,EAAE;AAAA,IACpB,CAAC;AAED,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,eAAe,SAAS;AAAA,MACxB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAIQ,mBACN,OACA,UACA,MACwC;AACxC,UAAM,MAAgD,MAAM;AAAA,MAC1D;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,UAAU,MAAM,IAAI;AAAA,IACvB;AAEA,QAAI,CAAC,IAAK,QAAO,CAAC;AAClB,WAAO,EAAE,QAAQ,IAAI,IAAI,UAAU,IAAI,KAAK;AAAA,EAC9C;AAAA,EAEQ,gBAAgB,OAAY,QAA0B;AAC5D,UAAM,OAA4C,MAAM;AAAA,MACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAaA,CAAC,MAAM;AAAA,IACT;AAEA,WAAO,KAAK,IAAI,OAAK,EAAE,EAAE;AAAA,EAC3B;AACF;",
+  "names": []
+}

package/dist/security/staleness.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Dependency Staleness Checker
+ *
+ * Queries public package registries (npm, PyPI, crates.io, RubyGems, Packagist)
+ * to determine the latest published version and compute a staleness score for
+ * each dependency tracked in sec_dependencies.
+ *
+ * Score formula:
+ *   score = min(majorVersionsBehind * 0.2, 0.6)   // up to 0.6 for version lag
+ *         + min(monthsSinceLatest / 36, 0.4)        // up to 0.4 for time lag
+ *   score = min(score, 1.0)
+ */
+import type { GraphDatabase } from '../db/database';
+export interface StalenessResult {
+    packageName: string;
+    ecosystem: string;
+    resolvedVersion: string;
+    latestVersion: string;
+    latestPublished: number;
+    stalenessScore: number;
+    majorVersionsBehind: number;
+    monthsSinceLatest: number;
+}
+export declare class StalenessChecker {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    /**
+     * Check all dependencies in sec_dependencies that have a supported ecosystem.
+     * Returns a summary of checked/stale counts and any errors encountered.
+     */
+    checkAll(): Promise<{
+        checked: number;
+        stale: number;
+        errors: string[];
+    }>;
+    /**
+     * Check a single dependency by node_id. Returns null if the ecosystem is
+     * not supported or the dependency is not found.
+     */
+    checkOne(nodeId: string): Promise<StalenessResult | null>;
+    private _checkRow;
+}
+//# sourceMappingURL=staleness.d.ts.map

package/dist/security/staleness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staleness.d.ts","sourceRoot":"","sources":["../../src/security/staleness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAqJD,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAE9C;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA+B/E;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAqBjD,SAAS;CAkDxB"}

package/dist/security/staleness.js

@@ -0,0 +1,231 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var staleness_exports = {};
+__export(staleness_exports, {
+  StalenessChecker: () => StalenessChecker
+});
+module.exports = __toCommonJS(staleness_exports);
+var import_parser = require("./manifest/parser");
+var import_errors = require("../errors");
+const TIMEOUT_MS = 1e4;
+async function fetchJson(url, headers) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const resp = await fetch(url, {
+      signal: controller.signal,
+      headers: {
+        "Accept": "application/json",
+        ...headers
+      }
+    });
+    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
+    return await resp.json();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function fetchNpm(name) {
+  const encoded = encodeURIComponent(name);
+  const data = await fetchJson(`https://registry.npmjs.org/${encoded}/latest`);
+  const version = data["version"];
+  const full = await fetchJson(`https://registry.npmjs.org/${encoded}`);
+  const time = full["time"] ?? {};
+  const publishedStr = time[version] ?? full["time"]?.["modified"] ?? "";
+  const latestPublished = publishedStr ? new Date(publishedStr).getTime() : Date.now();
+  return { latestVersion: version, latestPublished };
+}
+async function fetchPypi(name) {
+  const data = await fetchJson(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`);
+  const info = data["info"];
+  const version = info["version"];
+  const releases = data["releases"] ?? {};
+  const files = releases[version] ?? [];
+  const uploadTime = files[0]?.["upload_time_iso_8601"] ?? "";
+  const latestPublished = uploadTime ? new Date(uploadTime).getTime() : Date.now();
+  return { latestVersion: version, latestPublished };
+}
+async function fetchCrates(name) {
+  const data = await fetchJson(
+    `https://crates.io/api/v1/crates/${encodeURIComponent(name)}`,
+    { "User-Agent": "KiroGraph/1.0" }
+  );
+  const crate = data["crate"];
+  const version = crate["newest_version"];
+  const updatedAt = crate["updated_at"] ?? "";
+  const latestPublished = updatedAt ? new Date(updatedAt).getTime() : Date.now();
+  return { latestVersion: version, latestPublished };
+}
+async function fetchRubygems(name) {
+  const data = await fetchJson(`https://rubygems.org/api/v1/gems/${encodeURIComponent(name)}.json`);
+  const version = data["version"];
+  const createdAt = data["version_created_at"] ?? "";
+  const latestPublished = createdAt ? new Date(createdAt).getTime() : Date.now();
+  return { latestVersion: version, latestPublished };
+}
+async function fetchPackagist(name) {
+  const parts = name.split("/");
+  if (parts.length !== 2) throw new Error(`Invalid Composer package name: ${name}`);
+  const [vendor, pkg] = parts;
+  const data = await fetchJson(`https://repo.packagist.org/p2/${encodeURIComponent(vendor)}/${encodeURIComponent(pkg)}.json`);
+  const packages = data["packages"] ?? {};
+  const versions = packages[name] ?? [];
+  if (versions.length === 0) throw new Error(`No versions found for ${name}`);
+  let latestVersion = "";
+  let latestPublished = 0;
+  for (const v of versions) {
+    const versionStr = v["version"] ?? "";
+    if (versionStr.startsWith("dev-") || versionStr === "dev-master") continue;
+    if (!latestVersion || (0, import_parser.compareVersions)(versionStr, latestVersion) > 0) {
+      latestVersion = versionStr;
+      const timeStr = v["time"] ?? "";
+      latestPublished = timeStr ? new Date(timeStr).getTime() : 0;
+    }
+  }
+  if (!latestVersion) throw new Error(`No stable versions found for ${name}`);
+  return { latestVersion, latestPublished: latestPublished || Date.now() };
+}
+async function fetchLatest(ecosystem, packageName) {
+  const eco = ecosystem.toLowerCase();
+  try {
+    switch (eco) {
+      case "npm":
+        return await fetchNpm(packageName);
+      case "pypi":
+        return await fetchPypi(packageName);
+      case "pip":
+        return await fetchPypi(packageName);
+      // alias
+      case "cargo":
+        return await fetchCrates(packageName);
+      case "rubygems":
+        return await fetchRubygems(packageName);
+      case "composer":
+        return await fetchPackagist(packageName);
+      default:
+        return null;
+    }
+  } catch (err) {
+    throw err;
+  }
+}
+function getMajorVersion(version) {
+  const clean = version.startsWith("v") ? version.slice(1) : version;
+  const stripped = clean.replace(/^[~^>=<]+/, "");
+  const major = parseInt(stripped.split(".")[0] ?? "0", 10);
+  return isNaN(major) ? 0 : major;
+}
+function computeStaleness(resolvedVersion, latestVersion, latestPublished) {
+  const resolvedMajor = getMajorVersion(resolvedVersion);
+  const latestMajor = getMajorVersion(latestVersion);
+  const majorVersionsBehind = Math.max(0, latestMajor - resolvedMajor);
+  const monthsSinceLatest = Math.max(0, (Date.now() - latestPublished) / (1e3 * 60 * 60 * 24 * 30));
+  const versionScore = Math.min(majorVersionsBehind * 0.2, 0.6);
+  const timeScore = Math.min(monthsSinceLatest / 36, 0.4);
+  const score = Math.min(versionScore + timeScore, 1);
+  return { score, majorVersionsBehind, monthsSinceLatest: Math.round(monthsSinceLatest) };
+}
+class StalenessChecker {
+  constructor(db) {
+    this.db = db;
+  }
+  /**
+   * Check all dependencies in sec_dependencies that have a supported ecosystem.
+   * Returns a summary of checked/stale counts and any errors encountered.
+   */
+  async checkAll() {
+    const rawDb = this.db.getRawDb();
+    const rows = rawDb.all(
+      `SELECT node_id, package_name, ecosystem, resolved_version, declared_constraint
+       FROM sec_dependencies`
+    );
+    let checked = 0;
+    let stale = 0;
+    const errors = [];
+    for (const row of rows) {
+      const result = await this._checkRow(row);
+      if (result === null) continue;
+      if (result instanceof Error) {
+        errors.push(`${row.package_name} (${row.ecosystem}): ${result.message}`);
+        continue;
+      }
+      checked++;
+      if (result.stalenessScore >= 0.3) stale++;
+    }
+    return { checked, stale, errors };
+  }
+  /**
+   * Check a single dependency by node_id. Returns null if the ecosystem is
+   * not supported or the dependency is not found.
+   */
+  async checkOne(nodeId) {
+    const rawDb = this.db.getRawDb();
+    const row = rawDb.get(
+      `SELECT node_id, package_name, ecosystem, resolved_version, declared_constraint
+       FROM sec_dependencies WHERE node_id = ?`,
+      [nodeId]
+    );
+    if (!row) return null;
+    const result = await this._checkRow(row);
+    if (result === null || result instanceof Error) return null;
+    return result;
+  }
+  async _checkRow(row) {
+    const resolvedVersion = row.resolved_version ?? row.declared_constraint;
+    let registryResult;
+    try {
+      registryResult = await fetchLatest(row.ecosystem, row.package_name);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      (0, import_errors.logWarn)(`[staleness] Failed to fetch ${row.package_name} (${row.ecosystem}): ${msg}`);
+      return new Error(msg);
+    }
+    if (registryResult === null) {
+      return null;
+    }
+    const { latestVersion, latestPublished } = registryResult;
+    const { score, majorVersionsBehind, monthsSinceLatest } = computeStaleness(
+      resolvedVersion,
+      latestVersion,
+      latestPublished
+    );
+    const rawDb = this.db.getRawDb();
+    rawDb.run(
+      `UPDATE sec_dependencies
+       SET latest_version = ?, latest_published = ?, staleness_score = ?
+       WHERE node_id = ?`,
+      [latestVersion, latestPublished, score, row.node_id]
+    );
+    return {
+      packageName: row.package_name,
+      ecosystem: row.ecosystem,
+      resolvedVersion,
+      latestVersion,
+      latestPublished,
+      stalenessScore: score,
+      majorVersionsBehind,
+      monthsSinceLatest
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  StalenessChecker
+});
+//# sourceMappingURL=staleness.js.map

package/dist/security/staleness.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/staleness.ts"],
+  "sourcesContent": ["/**\n * Dependency Staleness Checker\n *\n * Queries public package registries (npm, PyPI, crates.io, RubyGems, Packagist)\n * to determine the latest published version and compute a staleness score for\n * each dependency tracked in sec_dependencies.\n *\n * Score formula:\n *   score = min(majorVersionsBehind * 0.2, 0.6)   // up to 0.6 for version lag\n *         + min(monthsSinceLatest / 36, 0.4)        // up to 0.4 for time lag\n *   score = min(score, 1.0)\n */\n\nimport { compareVersions } from './manifest/parser';\nimport { logWarn, logError } from '../errors';\nimport type { GraphDatabase } from '../db/database';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface StalenessResult {\n  packageName: string;\n  ecosystem: string;\n  resolvedVersion: string;\n  latestVersion: string;\n  latestPublished: number;  // epoch ms\n  stalenessScore: number;   // 0.0\u20131.0\n  majorVersionsBehind: number;\n  monthsSinceLatest: number;\n}\n\n// \u2500\u2500 Registry fetch helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst TIMEOUT_MS = 10_000;\n\nasync function fetchJson(url: string, headers?: Record<string, string>): Promise<unknown> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);\n  try {\n    const resp = await fetch(url, {\n      signal: controller.signal,\n      headers: {\n        'Accept': 'application/json',\n        ...headers,\n      },\n    });\n    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);\n    return await resp.json();\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\ninterface RegistryResult {\n  latestVersion: string;\n  latestPublished: number; // epoch ms\n}\n\nasync function fetchNpm(name: string): Promise<RegistryResult> {\n  // Scoped packages: @scope/name \u2014 must be URL-encoded as %40scope%2Fname\n  const encoded = encodeURIComponent(name);\n  const data = await fetchJson(`https://registry.npmjs.org/${encoded}/latest`) as Record<string, unknown>;\n  const version = data['version'] as string;\n  // Fetch full metadata for publish time\n  const full = await fetchJson(`https://registry.npmjs.org/${encoded}`) as Record<string, unknown>;\n  const time = (full['time'] as Record<string, string>) ?? {};\n  const publishedStr = time[version] ?? (full['time'] as Record<string, string>)?.['modified'] ?? '';\n  const latestPublished = publishedStr ? new Date(publishedStr).getTime() : Date.now();\n  return { latestVersion: version, latestPublished };\n}\n\nasync function fetchPypi(name: string): Promise<RegistryResult> {\n  const data = await fetchJson(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`) as Record<string, unknown>;\n  const info = data['info'] as Record<string, unknown>;\n  const version = info['version'] as string;\n  const releases = (data['releases'] as Record<string, Array<Record<string, string>>>) ?? {};\n  const files = releases[version] ?? [];\n  const uploadTime = files[0]?.['upload_time_iso_8601'] ?? '';\n  const latestPublished = uploadTime ? new Date(uploadTime).getTime() : Date.now();\n  return { latestVersion: version, latestPublished };\n}\n\nasync function fetchCrates(name: string): Promise<RegistryResult> {\n  const data = await fetchJson(\n    `https://crates.io/api/v1/crates/${encodeURIComponent(name)}`,\n    { 'User-Agent': 'KiroGraph/1.0' },\n  ) as Record<string, unknown>;\n  const crate = data['crate'] as Record<string, unknown>;\n  const version = crate['newest_version'] as string;\n  const updatedAt = (crate['updated_at'] as string) ?? '';\n  const latestPublished = updatedAt ? new Date(updatedAt).getTime() : Date.now();\n  return { latestVersion: version, latestPublished };\n}\n\nasync function fetchRubygems(name: string): Promise<RegistryResult> {\n  const data = await fetchJson(`https://rubygems.org/api/v1/gems/${encodeURIComponent(name)}.json`) as Record<string, unknown>;\n  const version = data['version'] as string;\n  const createdAt = (data['version_created_at'] as string) ?? '';\n  const latestPublished = createdAt ? new Date(createdAt).getTime() : Date.now();\n  return { latestVersion: version, latestPublished };\n}\n\nasync function fetchPackagist(name: string): Promise<RegistryResult> {\n  // name is expected to be \"vendor/package\"\n  const parts = name.split('/');\n  if (parts.length !== 2) throw new Error(`Invalid Composer package name: ${name}`);\n  const [vendor, pkg] = parts;\n  const data = await fetchJson(`https://repo.packagist.org/p2/${encodeURIComponent(vendor!)}/${encodeURIComponent(pkg!)}.json`) as Record<string, unknown>;\n  const packages = (data['packages'] as Record<string, unknown[]>) ?? {};\n  const versions = (packages[name] ?? []) as Array<Record<string, unknown>>;\n  if (versions.length === 0) throw new Error(`No versions found for ${name}`);\n\n  // Find highest non-dev version\n  let latestVersion = '';\n  let latestPublished = 0;\n  for (const v of versions) {\n    const versionStr = (v['version'] as string) ?? '';\n    if (versionStr.startsWith('dev-') || versionStr === 'dev-master') continue;\n    if (!latestVersion || compareVersions(versionStr, latestVersion) > 0) {\n      latestVersion = versionStr;\n      const timeStr = (v['time'] as string) ?? '';\n      latestPublished = timeStr ? new Date(timeStr).getTime() : 0;\n    }\n  }\n  if (!latestVersion) throw new Error(`No stable versions found for ${name}`);\n  return { latestVersion, latestPublished: latestPublished || Date.now() };\n}\n\n// \u2500\u2500 Ecosystem dispatch \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function fetchLatest(ecosystem: string, packageName: string): Promise<RegistryResult | null> {\n  const eco = ecosystem.toLowerCase();\n  try {\n    switch (eco) {\n      case 'npm':       return await fetchNpm(packageName);\n      case 'pypi':      return await fetchPypi(packageName);\n      case 'pip':       return await fetchPypi(packageName); // alias\n      case 'cargo':     return await fetchCrates(packageName);\n      case 'rubygems':  return await fetchRubygems(packageName);\n      case 'composer':  return await fetchPackagist(packageName);\n      default:\n        // Maven, Go, NuGet, Swift, Pub, Hex, Gradle \u2014 skip\n        return null;\n    }\n  } catch (err) {\n    throw err; // let caller handle\n  }\n}\n\n// \u2500\u2500 Score calculation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction getMajorVersion(version: string): number {\n  const clean = version.startsWith('v') ? version.slice(1) : version;\n  const stripped = clean.replace(/^[~^>=<]+/, '');\n  const major = parseInt(stripped.split('.')[0] ?? '0', 10);\n  return isNaN(major) ? 0 : major;\n}\n\nfunction computeStaleness(\n  resolvedVersion: string,\n  latestVersion: string,\n  latestPublished: number,\n): { score: number; majorVersionsBehind: number; monthsSinceLatest: number } {\n  const resolvedMajor = getMajorVersion(resolvedVersion);\n  const latestMajor = getMajorVersion(latestVersion);\n  const majorVersionsBehind = Math.max(0, latestMajor - resolvedMajor);\n\n  const monthsSinceLatest = Math.max(0, (Date.now() - latestPublished) / (1000 * 60 * 60 * 24 * 30));\n\n  const versionScore = Math.min(majorVersionsBehind * 0.2, 0.6);\n  const timeScore = Math.min(monthsSinceLatest / 36, 0.4);\n  const score = Math.min(versionScore + timeScore, 1.0);\n\n  return { score, majorVersionsBehind, monthsSinceLatest: Math.round(monthsSinceLatest) };\n}\n\n// \u2500\u2500 StalenessChecker \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class StalenessChecker {\n  constructor(private readonly db: GraphDatabase) {}\n\n  /**\n   * Check all dependencies in sec_dependencies that have a supported ecosystem.\n   * Returns a summary of checked/stale counts and any errors encountered.\n   */\n  async checkAll(): Promise<{ checked: number; stale: number; errors: string[] }> {\n    const rawDb = this.db.getRawDb();\n    const rows: Array<{\n      node_id: string;\n      package_name: string;\n      ecosystem: string;\n      resolved_version: string | null;\n      declared_constraint: string;\n    }> = rawDb.all(\n      `SELECT node_id, package_name, ecosystem, resolved_version, declared_constraint\n       FROM sec_dependencies`,\n    );\n\n    let checked = 0;\n    let stale = 0;\n    const errors: string[] = [];\n\n    for (const row of rows) {\n      const result = await this._checkRow(row);\n      if (result === null) continue; // unsupported ecosystem \u2014 skip\n      if (result instanceof Error) {\n        errors.push(`${row.package_name} (${row.ecosystem}): ${result.message}`);\n        continue;\n      }\n      checked++;\n      if (result.stalenessScore >= 0.3) stale++;\n    }\n\n    return { checked, stale, errors };\n  }\n\n  /**\n   * Check a single dependency by node_id. Returns null if the ecosystem is\n   * not supported or the dependency is not found.\n   */\n  async checkOne(nodeId: string): Promise<StalenessResult | null> {\n    const rawDb = this.db.getRawDb();\n    const row: {\n      node_id: string;\n      package_name: string;\n      ecosystem: string;\n      resolved_version: string | null;\n      declared_constraint: string;\n    } | undefined = rawDb.get(\n      `SELECT node_id, package_name, ecosystem, resolved_version, declared_constraint\n       FROM sec_dependencies WHERE node_id = ?`,\n      [nodeId],\n    );\n\n    if (!row) return null;\n\n    const result = await this._checkRow(row);\n    if (result === null || result instanceof Error) return null;\n    return result;\n  }\n\n  private async _checkRow(row: {\n    node_id: string;\n    package_name: string;\n    ecosystem: string;\n    resolved_version: string | null;\n    declared_constraint: string;\n  }): Promise<StalenessResult | Error | null> {\n    const resolvedVersion = row.resolved_version ?? row.declared_constraint;\n\n    let registryResult: RegistryResult | null;\n    try {\n      registryResult = await fetchLatest(row.ecosystem, row.package_name);\n    } catch (err) {\n      const msg = err instanceof Error ? err.message : String(err);\n      logWarn(`[staleness] Failed to fetch ${row.package_name} (${row.ecosystem}): ${msg}`);\n      return new Error(msg);\n    }\n\n    if (registryResult === null) {\n      // Unsupported ecosystem \u2014 skip silently\n      return null;\n    }\n\n    const { latestVersion, latestPublished } = registryResult;\n    const { score, majorVersionsBehind, monthsSinceLatest } = computeStaleness(\n      resolvedVersion,\n      latestVersion,\n      latestPublished,\n    );\n\n    // Persist to sec_dependencies\n    const rawDb = this.db.getRawDb();\n    rawDb.run(\n      `UPDATE sec_dependencies\n       SET latest_version = ?, latest_published = ?, staleness_score = ?\n       WHERE node_id = ?`,\n      [latestVersion, latestPublished, score, row.node_id],\n    );\n\n    return {\n      packageName: row.package_name,\n      ecosystem: row.ecosystem,\n      resolvedVersion,\n      latestVersion,\n      latestPublished,\n      stalenessScore: score,\n      majorVersionsBehind,\n      monthsSinceLatest,\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,oBAAgC;AAChC,oBAAkC;AAkBlC,MAAM,aAAa;AAEnB,eAAe,UAAU,KAAa,SAAoD;AACxF,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,KAAK;AAAA,MAC5B,QAAQ,WAAW;AAAA,MACnB,SAAS;AAAA,QACP,UAAU;AAAA,QACV,GAAG;AAAA,MACL;AAAA,IACF,CAAC;AACD,QAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,QAAQ,KAAK,MAAM,EAAE;AACnD,WAAO,MAAM,KAAK,KAAK;AAAA,EACzB,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAOA,eAAe,SAAS,MAAuC;AAE7D,QAAM,UAAU,mBAAmB,IAAI;AACvC,QAAM,OAAO,MAAM,UAAU,8BAA8B,OAAO,SAAS;AAC3E,QAAM,UAAU,KAAK,SAAS;AAE9B,QAAM,OAAO,MAAM,UAAU,8BAA8B,OAAO,EAAE;AACpE,QAAM,OAAQ,KAAK,MAAM,KAAgC,CAAC;AAC1D,QAAM,eAAe,KAAK,OAAO,KAAM,KAAK,MAAM,IAA+B,UAAU,KAAK;AAChG,QAAM,kBAAkB,eAAe,IAAI,KAAK,YAAY,EAAE,QAAQ,IAAI,KAAK,IAAI;AACnF,SAAO,EAAE,eAAe,SAAS,gBAAgB;AACnD;AAEA,eAAe,UAAU,MAAuC;AAC9D,QAAM,OAAO,MAAM,UAAU,yBAAyB,mBAAmB,IAAI,CAAC,OAAO;AACrF,QAAM,OAAO,KAAK,MAAM;AACxB,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,WAAY,KAAK,UAAU,KAAuD,CAAC;AACzF,QAAM,QAAQ,SAAS,OAAO,KAAK,CAAC;AACpC,QAAM,aAAa,MAAM,CAAC,IAAI,sBAAsB,KAAK;AACzD,QAAM,kBAAkB,aAAa,IAAI,KAAK,UAAU,EAAE,QAAQ,IAAI,KAAK,IAAI;AAC/E,SAAO,EAAE,eAAe,SAAS,gBAAgB;AACnD;AAEA,eAAe,YAAY,MAAuC;AAChE,QAAM,OAAO,MAAM;AAAA,IACjB,mCAAmC,mBAAmB,IAAI,CAAC;AAAA,IAC3D,EAAE,cAAc,gBAAgB;AAAA,EAClC;AACA,QAAM,QAAQ,KAAK,OAAO;AAC1B,QAAM,UAAU,MAAM,gBAAgB;AACtC,QAAM,YAAa,MAAM,YAAY,KAAgB;AACrD,QAAM,kBAAkB,YAAY,IAAI,KAAK,SAAS,EAAE,QAAQ,IAAI,KAAK,IAAI;AAC7E,SAAO,EAAE,eAAe,SAAS,gBAAgB;AACnD;AAEA,eAAe,cAAc,MAAuC;AAClE,QAAM,OAAO,MAAM,UAAU,oCAAoC,mBAAmB,IAAI,CAAC,OAAO;AAChG,QAAM,UAAU,KAAK,SAAS;AAC9B,QAAM,YAAa,KAAK,oBAAoB,KAAgB;AAC5D,QAAM,kBAAkB,YAAY,IAAI,KAAK,SAAS,EAAE,QAAQ,IAAI,KAAK,IAAI;AAC7E,SAAO,EAAE,eAAe,SAAS,gBAAgB;AACnD;AAEA,eAAe,eAAe,MAAuC;AAEnE,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,kCAAkC,IAAI,EAAE;AAChF,QAAM,CAAC,QAAQ,GAAG,IAAI;AACtB,QAAM,OAAO,MAAM,UAAU,iCAAiC,mBAAmB,MAAO,CAAC,IAAI,mBAAmB,GAAI,CAAC,OAAO;AAC5H,QAAM,WAAY,KAAK,UAAU,KAAmC,CAAC;AACrE,QAAM,WAAY,SAAS,IAAI,KAAK,CAAC;AACrC,MAAI,SAAS,WAAW,EAAG,OAAM,IAAI,MAAM,yBAAyB,IAAI,EAAE;AAG1E,MAAI,gBAAgB;AACpB,MAAI,kBAAkB;AACtB,aAAW,KAAK,UAAU;AACxB,UAAM,aAAc,EAAE,SAAS,KAAgB;AAC/C,QAAI,WAAW,WAAW,MAAM,KAAK,eAAe,aAAc;AAClE,QAAI,CAAC,qBAAiB,+BAAgB,YAAY,aAAa,IAAI,GAAG;AACpE,sBAAgB;AAChB,YAAM,UAAW,EAAE,MAAM,KAAgB;AACzC,wBAAkB,UAAU,IAAI,KAAK,OAAO,EAAE,QAAQ,IAAI;AAAA,IAC5D;AAAA,EACF;AACA,MAAI,CAAC,cAAe,OAAM,IAAI,MAAM,gCAAgC,IAAI,EAAE;AAC1E,SAAO,EAAE,eAAe,iBAAiB,mBAAmB,KAAK,IAAI,EAAE;AACzE;AAIA,eAAe,YAAY,WAAmB,aAAqD;AACjG,QAAM,MAAM,UAAU,YAAY;AAClC,MAAI;AACF,YAAQ,KAAK;AAAA,MACX,KAAK;AAAa,eAAO,MAAM,SAAS,WAAW;AAAA,MACnD,KAAK;AAAa,eAAO,MAAM,UAAU,WAAW;AAAA,MACpD,KAAK;AAAa,eAAO,MAAM,UAAU,WAAW;AAAA;AAAA,MACpD,KAAK;AAAa,eAAO,MAAM,YAAY,WAAW;AAAA,MACtD,KAAK;AAAa,eAAO,MAAM,cAAc,WAAW;AAAA,MACxD,KAAK;AAAa,eAAO,MAAM,eAAe,WAAW;AAAA,MACzD;AAEE,eAAO;AAAA,IACX;AAAA,EACF,SAAS,KAAK;AACZ,UAAM;AAAA,EACR;AACF;AAIA,SAAS,gBAAgB,SAAyB;AAChD,QAAM,QAAQ,QAAQ,WAAW,GAAG,IAAI,QAAQ,MAAM,CAAC,IAAI;AAC3D,QAAM,WAAW,MAAM,QAAQ,aAAa,EAAE;AAC9C,QAAM,QAAQ,SAAS,SAAS,MAAM,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE;AACxD,SAAO,MAAM,KAAK,IAAI,IAAI;AAC5B;AAEA,SAAS,iBACP,iBACA,eACA,iBAC2E;AAC3E,QAAM,gBAAgB,gBAAgB,eAAe;AACrD,QAAM,cAAc,gBAAgB,aAAa;AACjD,QAAM,sBAAsB,KAAK,IAAI,GAAG,cAAc,aAAa;AAEnE,QAAM,oBAAoB,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,oBAAoB,MAAO,KAAK,KAAK,KAAK,GAAG;AAEjG,QAAM,eAAe,KAAK,IAAI,sBAAsB,KAAK,GAAG;AAC5D,QAAM,YAAY,KAAK,IAAI,oBAAoB,IAAI,GAAG;AACtD,QAAM,QAAQ,KAAK,IAAI,eAAe,WAAW,CAAG;AAEpD,SAAO,EAAE,OAAO,qBAAqB,mBAAmB,KAAK,MAAM,iBAAiB,EAAE;AACxF;AAIO,MAAM,iBAAiB;AAAA,EAC5B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjD,MAAM,WAA0E;AAC9E,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,OAMD,MAAM;AAAA,MACT;AAAA;AAAA,IAEF;AAEA,QAAI,UAAU;AACd,QAAI,QAAQ;AACZ,UAAM,SAAmB,CAAC;AAE1B,eAAW,OAAO,MAAM;AACtB,YAAM,SAAS,MAAM,KAAK,UAAU,GAAG;AACvC,UAAI,WAAW,KAAM;AACrB,UAAI,kBAAkB,OAAO;AAC3B,eAAO,KAAK,GAAG,IAAI,YAAY,KAAK,IAAI,SAAS,MAAM,OAAO,OAAO,EAAE;AACvE;AAAA,MACF;AACA;AACA,UAAI,OAAO,kBAAkB,IAAK;AAAA,IACpC;AAEA,WAAO,EAAE,SAAS,OAAO,OAAO;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,QAAiD;AAC9D,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,MAMU,MAAM;AAAA,MACpB;AAAA;AAAA,MAEA,CAAC,MAAM;AAAA,IACT;AAEA,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS,MAAM,KAAK,UAAU,GAAG;AACvC,QAAI,WAAW,QAAQ,kBAAkB,MAAO,QAAO;AACvD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,KAMoB;AAC1C,UAAM,kBAAkB,IAAI,oBAAoB,IAAI;AAEpD,QAAI;AACJ,QAAI;AACF,uBAAiB,MAAM,YAAY,IAAI,WAAW,IAAI,YAAY;AAAA,IACpE,SAAS,KAAK;AACZ,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,iCAAQ,+BAA+B,IAAI,YAAY,KAAK,IAAI,SAAS,MAAM,GAAG,EAAE;AACpF,aAAO,IAAI,MAAM,GAAG;AAAA,IACtB;AAEA,QAAI,mBAAmB,MAAM;AAE3B,aAAO;AAAA,IACT;AAEA,UAAM,EAAE,eAAe,gBAAgB,IAAI;AAC3C,UAAM,EAAE,OAAO,qBAAqB,kBAAkB,IAAI;AAAA,MACxD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,eAAe,iBAAiB,OAAO,IAAI,OAAO;AAAA,IACrD;AAEA,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,WAAW,IAAI;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/supply-chain.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Supply Chain Health Checker
+ *
+ * Queries OpenSSF Scorecard and registry APIs to assess the health of
+ * dependencies: maintenance activity, maintainer count, package age, and
+ * overall supply-chain risk level.
+ */
+import type { GraphDatabase } from '../db/database';
+export interface SupplyChainRisk {
+    packageName: string;
+    ecosystem: string;
+    nodeId: string;
+    scorecardScore: number | null;
+    scorecardChecks: Record<string, number> | null;
+    daysSinceLastCommit: number | null;
+    isAbandoned: boolean;
+    maintainerCount: number | null;
+    isSingleMaintainer: boolean;
+    publishedAt: string | null;
+    isVeryNew: boolean;
+    riskLevel: 'critical' | 'high' | 'medium' | 'low' | 'unknown';
+    riskReasons: string[];
+}
+export declare class SupplyChainChecker {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    checkAll(): Promise<{
+        results: SupplyChainRisk[];
+        errors: string[];
+    }>;
+    checkOne(packageName: string, ecosystem: string): Promise<SupplyChainRisk | null>;
+    private _check;
+}
+//# sourceMappingURL=supply-chain.d.ts.map

package/dist/security/supply-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supply-chain.d.ts","sourceRoot":"","sources":["../../src/security/supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IAEf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAE/C,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,OAAO,CAAC;IAE5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IAEnB,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;IAC9D,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAuQD,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,QAAQ,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA2BrE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAUzE,MAAM;CAgErB"}