kirograph 0.17.0 → 0.20.0

package/dist/security/supply-chain.js

@@ -0,0 +1,301 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var supply_chain_exports = {};
+__export(supply_chain_exports, {
+  SupplyChainChecker: () => SupplyChainChecker
+});
+module.exports = __toCommonJS(supply_chain_exports);
+var import_errors = require("../errors");
+const TIMEOUT_MS = 1e4;
+async function fetchJson(url, headers) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const resp = await fetch(url, {
+      signal: controller.signal,
+      headers: { "Accept": "application/json", ...headers }
+    });
+    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
+    return await resp.json();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function getGithubRepoFromNpm(name) {
+  try {
+    const encoded = encodeURIComponent(name);
+    const data = await fetchJson(`https://registry.npmjs.org/${encoded}/latest`);
+    const repo = data["repository"];
+    const url = typeof repo === "string" ? repo : repo?.url ?? null;
+    return extractGithubPath(url);
+  } catch {
+    return null;
+  }
+}
+async function getGithubRepoFromCargo(name) {
+  try {
+    const data = await fetchJson(
+      `https://crates.io/api/v1/crates/${encodeURIComponent(name)}`,
+      { "User-Agent": "KiroGraph/1.0" }
+    );
+    const crate = data["crate"];
+    const repo = crate["repository"];
+    return extractGithubPath(repo ?? null);
+  } catch {
+    return null;
+  }
+}
+async function getGithubRepoFromPypi(name) {
+  try {
+    const data = await fetchJson(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`);
+    const info = data["info"];
+    const projectUrls = info["project_urls"];
+    const homePage = info["home_page"];
+    const sourceUrl = projectUrls?.["Source"] ?? projectUrls?.["source"] ?? projectUrls?.["Homepage"] ?? homePage ?? null;
+    return extractGithubPath(sourceUrl);
+  } catch {
+    return null;
+  }
+}
+function extractGithubPath(url) {
+  if (!url) return null;
+  const cleaned = url.replace(/^git\+/, "").replace(/^git:\/\//, "https://").replace(/^ssh:\/\/git@/, "https://").replace(/^git@github\.com:/, "https://github.com/").replace(/\.git$/, "");
+  const m = cleaned.match(/github\.com[/:]([^/\s]+\/[^/\s#?]+)/);
+  if (!m) return null;
+  return m[1];
+}
+async function resolveGithubRepo(ecosystem, name) {
+  const eco = ecosystem.toLowerCase();
+  switch (eco) {
+    case "npm":
+      return getGithubRepoFromNpm(name);
+    case "cargo":
+      return getGithubRepoFromCargo(name);
+    case "pypi":
+    case "pip":
+      return getGithubRepoFromPypi(name);
+    default:
+      return null;
+  }
+}
+async function fetchScorecard(githubRepo) {
+  try {
+    const data = await fetchJson(`https://api.securityscorecards.dev/projects/github.com/${githubRepo}`);
+    const score = data["score"];
+    const checksRaw = data["checks"] ?? [];
+    const checks = {};
+    for (const c of checksRaw) {
+      const checkName = c["name"];
+      const checkScore = c["score"];
+      if (checkName) checks[checkName] = checkScore ?? 0;
+    }
+    return { score, checks };
+  } catch {
+    return null;
+  }
+}
+async function getNpmMaintenance(name) {
+  try {
+    const encoded = encodeURIComponent(name);
+    const full = await fetchJson(`https://registry.npmjs.org/${encoded}`);
+    const time = full["time"] ?? {};
+    const maintainers = full["maintainers"] ?? [];
+    const maintainerCount = maintainers.length;
+    const timeValues = Object.entries(time).filter(([k]) => k !== "created" && k !== "modified").map(([, v]) => new Date(v).getTime()).filter((t) => !isNaN(t));
+    const lastPublishMs = timeValues.length > 0 ? Math.max(...timeValues) : null;
+    const daysSinceLastCommit = lastPublishMs !== null ? Math.floor((Date.now() - lastPublishMs) / (1e3 * 60 * 60 * 24)) : null;
+    const createdStr = time["created"] ?? null;
+    const publishedAt = createdStr || null;
+    return { daysSinceLastCommit, maintainerCount: maintainerCount || null, publishedAt };
+  } catch {
+    return { daysSinceLastCommit: null, maintainerCount: null, publishedAt: null };
+  }
+}
+async function getCratesMaintenance(name) {
+  try {
+    const data = await fetchJson(
+      `https://crates.io/api/v1/crates/${encodeURIComponent(name)}`,
+      { "User-Agent": "KiroGraph/1.0" }
+    );
+    const crate = data["crate"];
+    const updatedAt = crate["updated_at"] ?? null;
+    const createdAt = crate["created_at"] ?? null;
+    const daysSinceLastCommit = updatedAt ? Math.floor((Date.now() - new Date(updatedAt).getTime()) / (1e3 * 60 * 60 * 24)) : null;
+    return { daysSinceLastCommit, maintainerCount: null, publishedAt: createdAt };
+  } catch {
+    return { daysSinceLastCommit: null, maintainerCount: null, publishedAt: null };
+  }
+}
+async function getPypiMaintenance(name) {
+  try {
+    const data = await fetchJson(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`);
+    const info = data["info"];
+    const releases = data["releases"] ?? {};
+    let latestMs = null;
+    let earliestMs = null;
+    for (const files of Object.values(releases)) {
+      for (const f of files) {
+        const t = f["upload_time_iso_8601"] ?? f["upload_time"];
+        if (t) {
+          const ms = new Date(t).getTime();
+          if (!isNaN(ms)) {
+            latestMs = latestMs === null ? ms : Math.max(latestMs, ms);
+            earliestMs = earliestMs === null ? ms : Math.min(earliestMs, ms);
+          }
+        }
+      }
+    }
+    const daysSinceLastCommit = latestMs !== null ? Math.floor((Date.now() - latestMs) / (1e3 * 60 * 60 * 24)) : null;
+    const maintainerCount = null;
+    const authorEmail = info["author_email"];
+    const estimatedMaintainers = authorEmail ? authorEmail.split(",").filter((s) => s.trim()).length : null;
+    const publishedAt = earliestMs !== null ? new Date(earliestMs).toISOString() : null;
+    return { daysSinceLastCommit, maintainerCount: estimatedMaintainers ?? maintainerCount, publishedAt };
+  } catch {
+    return { daysSinceLastCommit: null, maintainerCount: null, publishedAt: null };
+  }
+}
+async function getMaintenance(ecosystem, name) {
+  const eco = ecosystem.toLowerCase();
+  switch (eco) {
+    case "npm":
+      return getNpmMaintenance(name);
+    case "cargo":
+      return getCratesMaintenance(name);
+    case "pypi":
+    case "pip":
+      return getPypiMaintenance(name);
+    default:
+      return { daysSinceLastCommit: null, maintainerCount: null, publishedAt: null };
+  }
+}
+function computeRisk(scorecardScore, daysSinceLastCommit, maintainerCount, isVeryNew, hasActiveCVEs) {
+  const reasons = [];
+  const isAbandoned = daysSinceLastCommit !== null && daysSinceLastCommit > 365;
+  const isSingleMaintainer = maintainerCount !== null && maintainerCount === 1;
+  const lowScorecard = scorecardScore !== null && scorecardScore < 3;
+  const mediumScorecard = scorecardScore !== null && scorecardScore >= 3 && scorecardScore <= 6;
+  const noActivityRecent = daysSinceLastCommit !== null && daysSinceLastCommit > 180;
+  if (isAbandoned) reasons.push(`Abandoned: no activity for ${daysSinceLastCommit} days`);
+  if (isVeryNew) reasons.push("Very new package (< 30 days old): potential supply chain risk");
+  if (isSingleMaintainer) reasons.push("Single maintainer: bus-factor risk");
+  if (lowScorecard) reasons.push(`Low OpenSSF Scorecard score: ${scorecardScore.toFixed(1)}/10`);
+  if (mediumScorecard) reasons.push(`Moderate OpenSSF Scorecard score: ${scorecardScore.toFixed(1)}/10`);
+  if (noActivityRecent && !isAbandoned) reasons.push(`No activity in ${daysSinceLastCommit} days`);
+  if (hasActiveCVEs) reasons.push("Has known CVEs");
+  let riskLevel;
+  if (isAbandoned && hasActiveCVEs) {
+    riskLevel = "critical";
+  } else if (isSingleMaintainer || lowScorecard || isVeryNew) {
+    riskLevel = "high";
+  } else if (mediumScorecard || noActivityRecent && !isAbandoned) {
+    riskLevel = "medium";
+  } else if (scorecardScore !== null && scorecardScore > 6) {
+    riskLevel = "low";
+  } else {
+    riskLevel = "unknown";
+  }
+  return { riskLevel, riskReasons: reasons };
+}
+class SupplyChainChecker {
+  constructor(db) {
+    this.db = db;
+  }
+  async checkAll() {
+    const rawDb = this.db.getRawDb();
+    const rows = rawDb.all(
+      `SELECT node_id, package_name, ecosystem FROM sec_dependencies`
+    );
+    const results = [];
+    const errors = [];
+    for (const row of rows) {
+      try {
+        const risk = await this._check(row.node_id, row.package_name, row.ecosystem);
+        if (risk) results.push(risk);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        (0, import_errors.logWarn)(`[supply-chain] Failed to check ${row.package_name} (${row.ecosystem}): ${msg}`);
+        errors.push(`${row.package_name} (${row.ecosystem}): ${msg}`);
+      }
+    }
+    return { results, errors };
+  }
+  async checkOne(packageName, ecosystem) {
+    const rawDb = this.db.getRawDb();
+    const row = rawDb.get(
+      `SELECT node_id FROM sec_dependencies WHERE package_name = ? AND ecosystem = ? LIMIT 1`,
+      [packageName, ecosystem]
+    );
+    if (!row) return null;
+    return this._check(row.node_id, packageName, ecosystem);
+  }
+  async _check(nodeId, packageName, ecosystem) {
+    const githubRepo = await resolveGithubRepo(ecosystem, packageName);
+    let scorecardScore = null;
+    let scorecardChecks = null;
+    if (githubRepo) {
+      const sc = await fetchScorecard(githubRepo);
+      if (sc) {
+        scorecardScore = sc.score;
+        scorecardChecks = sc.checks;
+      }
+    }
+    const maintenance = await getMaintenance(ecosystem, packageName);
+    const { daysSinceLastCommit, maintainerCount, publishedAt } = maintenance;
+    const isAbandoned = daysSinceLastCommit !== null && daysSinceLastCommit > 365;
+    const isSingleMaintainer = maintainerCount !== null && maintainerCount === 1;
+    const publishedMs = publishedAt ? new Date(publishedAt).getTime() : null;
+    const isVeryNew = publishedMs !== null && Date.now() - publishedMs < 30 * 24 * 60 * 60 * 1e3;
+    const rawDb = this.db.getRawDb();
+    const cveCount = rawDb.get(
+      `SELECT COUNT(*) as count FROM sec_vulnerabilities v
+       JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'
+       WHERE e.source = ?`,
+      [nodeId]
+    ) ?? { count: 0 };
+    const hasActiveCVEs = cveCount.count > 0;
+    const { riskLevel, riskReasons } = computeRisk(
+      scorecardScore,
+      daysSinceLastCommit,
+      maintainerCount,
+      isVeryNew,
+      hasActiveCVEs
+    );
+    return {
+      packageName,
+      ecosystem,
+      nodeId,
+      scorecardScore,
+      scorecardChecks,
+      daysSinceLastCommit,
+      isAbandoned,
+      maintainerCount,
+      isSingleMaintainer,
+      publishedAt,
+      isVeryNew,
+      riskLevel,
+      riskReasons
+    };
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SupplyChainChecker
+});
+//# sourceMappingURL=supply-chain.js.map

package/dist/security/supply-chain.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/supply-chain.ts"],
+  "sourcesContent": ["/**\n * Supply Chain Health Checker\n *\n * Queries OpenSSF Scorecard and registry APIs to assess the health of\n * dependencies: maintenance activity, maintainer count, package age, and\n * overall supply-chain risk level.\n */\n\nimport { logWarn } from '../errors';\nimport type { GraphDatabase } from '../db/database';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface SupplyChainRisk {\n  packageName: string;\n  ecosystem: string;\n  nodeId: string;\n  // OpenSSF Scorecard\n  scorecardScore: number | null;    // 0-10\n  scorecardChecks: Record<string, number> | null;\n  // Maintenance health\n  daysSinceLastCommit: number | null;\n  isAbandoned: boolean;   // no commit in > 365 days\n  maintainerCount: number | null;\n  isSingleMaintainer: boolean;\n  // Package age\n  publishedAt: string | null;\n  isVeryNew: boolean;  // published < 30 days ago (supply chain risk)\n  // Risk summary\n  riskLevel: 'critical' | 'high' | 'medium' | 'low' | 'unknown';\n  riskReasons: string[];\n}\n\n// \u2500\u2500 Fetch helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst TIMEOUT_MS = 10_000;\n\nasync function fetchJson(url: string, headers?: Record<string, string>): Promise<unknown> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);\n  try {\n    const resp = await fetch(url, {\n      signal: controller.signal,\n      headers: { 'Accept': 'application/json', ...headers },\n    });\n    if (!resp.ok) throw new Error(`HTTP ${resp.status}`);\n    return await resp.json();\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n// \u2500\u2500 Registry repo-URL resolvers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nasync function getGithubRepoFromNpm(name: string): Promise<string | null> {\n  try {\n    const encoded = encodeURIComponent(name);\n    const data = await fetchJson(`https://registry.npmjs.org/${encoded}/latest`) as Record<string, unknown>;\n    const repo = data['repository'] as Record<string, string> | string | undefined;\n    const url = typeof repo === 'string' ? repo : repo?.url ?? null;\n    return extractGithubPath(url);\n  } catch {\n    return null;\n  }\n}\n\nasync function getGithubRepoFromCargo(name: string): Promise<string | null> {\n  try {\n    const data = await fetchJson(\n      `https://crates.io/api/v1/crates/${encodeURIComponent(name)}`,\n      { 'User-Agent': 'KiroGraph/1.0' },\n    ) as Record<string, unknown>;\n    const crate = data['crate'] as Record<string, unknown>;\n    const repo = crate['repository'] as string | null | undefined;\n    return extractGithubPath(repo ?? null);\n  } catch {\n    return null;\n  }\n}\n\nasync function getGithubRepoFromPypi(name: string): Promise<string | null> {\n  try {\n    const data = await fetchJson(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`) as Record<string, unknown>;\n    const info = data['info'] as Record<string, unknown>;\n    const projectUrls = info['project_urls'] as Record<string, string> | null | undefined;\n    const homePage = info['home_page'] as string | null | undefined;\n    const sourceUrl = projectUrls?.['Source'] ?? projectUrls?.['source'] ?? projectUrls?.['Homepage'] ?? homePage ?? null;\n    return extractGithubPath(sourceUrl);\n  } catch {\n    return null;\n  }\n}\n\nfunction extractGithubPath(url: string | null | undefined): string | null {\n  if (!url) return null;\n  // normalise git+https://, git://, ssh://git@github.com, etc.\n  const cleaned = url\n    .replace(/^git\\+/, '')\n    .replace(/^git:\\/\\//, 'https://')\n    .replace(/^ssh:\\/\\/git@/, 'https://')\n    .replace(/^git@github\\.com:/, 'https://github.com/')\n    .replace(/\\.git$/, '');\n  const m = cleaned.match(/github\\.com[/:]([^/\\s]+\\/[^/\\s#?]+)/);\n  if (!m) return null;\n  return m[1]!;\n}\n\nasync function resolveGithubRepo(ecosystem: string, name: string): Promise<string | null> {\n  const eco = ecosystem.toLowerCase();\n  switch (eco) {\n    case 'npm':    return getGithubRepoFromNpm(name);\n    case 'cargo':  return getGithubRepoFromCargo(name);\n    case 'pypi':\n    case 'pip':    return getGithubRepoFromPypi(name);\n    default:       return null;\n  }\n}\n\n// \u2500\u2500 OpenSSF Scorecard \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface ScorecardResult {\n  score: number;\n  checks: Record<string, number>;\n}\n\nasync function fetchScorecard(githubRepo: string): Promise<ScorecardResult | null> {\n  try {\n    const data = await fetchJson(`https://api.securityscorecards.dev/projects/github.com/${githubRepo}`) as Record<string, unknown>;\n    const score = data['score'] as number;\n    const checksRaw = (data['checks'] as Array<Record<string, unknown>>) ?? [];\n    const checks: Record<string, number> = {};\n    for (const c of checksRaw) {\n      const checkName = c['name'] as string;\n      const checkScore = c['score'] as number;\n      if (checkName) checks[checkName] = checkScore ?? 0;\n    }\n    return { score, checks };\n  } catch {\n    return null;\n  }\n}\n\n// \u2500\u2500 Maintenance data from registries \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface MaintenanceInfo {\n  daysSinceLastCommit: number | null;\n  maintainerCount: number | null;\n  publishedAt: string | null;\n}\n\nasync function getNpmMaintenance(name: string): Promise<MaintenanceInfo> {\n  try {\n    const encoded = encodeURIComponent(name);\n    const full = await fetchJson(`https://registry.npmjs.org/${encoded}`) as Record<string, unknown>;\n    const time = (full['time'] as Record<string, string>) ?? {};\n    const maintainers = (full['maintainers'] as unknown[]) ?? [];\n    const maintainerCount = maintainers.length;\n\n    // Latest publish date\n    const timeValues = Object.entries(time)\n      .filter(([k]) => k !== 'created' && k !== 'modified')\n      .map(([, v]) => new Date(v).getTime())\n      .filter(t => !isNaN(t));\n    const lastPublishMs = timeValues.length > 0 ? Math.max(...timeValues) : null;\n    const daysSinceLastCommit = lastPublishMs !== null\n      ? Math.floor((Date.now() - lastPublishMs) / (1000 * 60 * 60 * 24))\n      : null;\n\n    // Earliest publish date as \"publishedAt\"\n    const createdStr = time['created'] ?? null;\n    const publishedAt = createdStr || null;\n\n    return { daysSinceLastCommit, maintainerCount: maintainerCount || null, publishedAt };\n  } catch {\n    return { daysSinceLastCommit: null, maintainerCount: null, publishedAt: null };\n  }\n}\n\nasync function getCratesMaintenance(name: string): Promise<MaintenanceInfo> {\n  try {\n    const data = await fetchJson(\n      `https://crates.io/api/v1/crates/${encodeURIComponent(name)}`,\n      { 'User-Agent': 'KiroGraph/1.0' },\n    ) as Record<string, unknown>;\n    const crate = data['crate'] as Record<string, unknown>;\n    const updatedAt = (crate['updated_at'] as string) ?? null;\n    const createdAt = (crate['created_at'] as string) ?? null;\n\n    const daysSinceLastCommit = updatedAt\n      ? Math.floor((Date.now() - new Date(updatedAt).getTime()) / (1000 * 60 * 60 * 24))\n      : null;\n\n    return { daysSinceLastCommit, maintainerCount: null, publishedAt: createdAt };\n  } catch {\n    return { daysSinceLastCommit: null, maintainerCount: null, publishedAt: null };\n  }\n}\n\nasync function getPypiMaintenance(name: string): Promise<MaintenanceInfo> {\n  try {\n    const data = await fetchJson(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`) as Record<string, unknown>;\n    const info = data['info'] as Record<string, unknown>;\n    const releases = (data['releases'] as Record<string, Array<Record<string, string>>>) ?? {};\n\n    // Find the most recent release upload time across all versions\n    let latestMs: number | null = null;\n    let earliestMs: number | null = null;\n    for (const files of Object.values(releases)) {\n      for (const f of files) {\n        const t = f['upload_time_iso_8601'] ?? f['upload_time'];\n        if (t) {\n          const ms = new Date(t).getTime();\n          if (!isNaN(ms)) {\n            latestMs = latestMs === null ? ms : Math.max(latestMs, ms);\n            earliestMs = earliestMs === null ? ms : Math.min(earliestMs, ms);\n          }\n        }\n      }\n    }\n\n    const daysSinceLastCommit = latestMs !== null\n      ? Math.floor((Date.now() - latestMs) / (1000 * 60 * 60 * 24))\n      : null;\n\n    // PyPI doesn't expose maintainer counts in the public JSON\n    const maintainerCount = null;\n    const authorEmail = info['author_email'] as string | null | undefined;\n    // Rough proxy: if the author_email field has multiple addresses \u2192 multiple maintainers\n    const estimatedMaintainers = authorEmail\n      ? authorEmail.split(',').filter(s => s.trim()).length\n      : null;\n\n    const publishedAt = earliestMs !== null ? new Date(earliestMs).toISOString() : null;\n\n    return { daysSinceLastCommit, maintainerCount: estimatedMaintainers ?? maintainerCount, publishedAt };\n  } catch {\n    return { daysSinceLastCommit: null, maintainerCount: null, publishedAt: null };\n  }\n}\n\nasync function getMaintenance(ecosystem: string, name: string): Promise<MaintenanceInfo> {\n  const eco = ecosystem.toLowerCase();\n  switch (eco) {\n    case 'npm':    return getNpmMaintenance(name);\n    case 'cargo':  return getCratesMaintenance(name);\n    case 'pypi':\n    case 'pip':    return getPypiMaintenance(name);\n    default:       return { daysSinceLastCommit: null, maintainerCount: null, publishedAt: null };\n  }\n}\n\n// \u2500\u2500 Risk scoring \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction computeRisk(\n  scorecardScore: number | null,\n  daysSinceLastCommit: number | null,\n  maintainerCount: number | null,\n  isVeryNew: boolean,\n  hasActiveCVEs: boolean,\n): { riskLevel: SupplyChainRisk['riskLevel']; riskReasons: string[] } {\n  const reasons: string[] = [];\n\n  const isAbandoned = daysSinceLastCommit !== null && daysSinceLastCommit > 365;\n  const isSingleMaintainer = maintainerCount !== null && maintainerCount === 1;\n  const lowScorecard = scorecardScore !== null && scorecardScore < 3;\n  const mediumScorecard = scorecardScore !== null && scorecardScore >= 3 && scorecardScore <= 6;\n  const noActivityRecent = daysSinceLastCommit !== null && daysSinceLastCommit > 180;\n\n  if (isAbandoned) reasons.push(`Abandoned: no activity for ${daysSinceLastCommit} days`);\n  if (isVeryNew) reasons.push('Very new package (< 30 days old): potential supply chain risk');\n  if (isSingleMaintainer) reasons.push('Single maintainer: bus-factor risk');\n  if (lowScorecard) reasons.push(`Low OpenSSF Scorecard score: ${scorecardScore!.toFixed(1)}/10`);\n  if (mediumScorecard) reasons.push(`Moderate OpenSSF Scorecard score: ${scorecardScore!.toFixed(1)}/10`);\n  if (noActivityRecent && !isAbandoned) reasons.push(`No activity in ${daysSinceLastCommit} days`);\n  if (hasActiveCVEs) reasons.push('Has known CVEs');\n\n  let riskLevel: SupplyChainRisk['riskLevel'];\n  if (isAbandoned && hasActiveCVEs) {\n    riskLevel = 'critical';\n  } else if (isSingleMaintainer || lowScorecard || isVeryNew) {\n    riskLevel = 'high';\n  } else if (mediumScorecard || (noActivityRecent && !isAbandoned)) {\n    riskLevel = 'medium';\n  } else if (scorecardScore !== null && scorecardScore > 6) {\n    riskLevel = 'low';\n  } else {\n    riskLevel = 'unknown';\n  }\n\n  return { riskLevel, riskReasons: reasons };\n}\n\n// \u2500\u2500 SupplyChainChecker \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class SupplyChainChecker {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async checkAll(): Promise<{ results: SupplyChainRisk[]; errors: string[] }> {\n    const rawDb = this.db.getRawDb();\n    const rows: Array<{\n      node_id: string;\n      package_name: string;\n      ecosystem: string;\n    }> = rawDb.all(\n      `SELECT node_id, package_name, ecosystem FROM sec_dependencies`,\n    );\n\n    const results: SupplyChainRisk[] = [];\n    const errors: string[] = [];\n\n    for (const row of rows) {\n      try {\n        const risk = await this._check(row.node_id, row.package_name, row.ecosystem);\n        if (risk) results.push(risk);\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        logWarn(`[supply-chain] Failed to check ${row.package_name} (${row.ecosystem}): ${msg}`);\n        errors.push(`${row.package_name} (${row.ecosystem}): ${msg}`);\n      }\n    }\n\n    return { results, errors };\n  }\n\n  async checkOne(packageName: string, ecosystem: string): Promise<SupplyChainRisk | null> {\n    const rawDb = this.db.getRawDb();\n    const row: { node_id: string } | undefined = rawDb.get(\n      `SELECT node_id FROM sec_dependencies WHERE package_name = ? AND ecosystem = ? LIMIT 1`,\n      [packageName, ecosystem],\n    );\n    if (!row) return null;\n    return this._check(row.node_id, packageName, ecosystem);\n  }\n\n  private async _check(\n    nodeId: string,\n    packageName: string,\n    ecosystem: string,\n  ): Promise<SupplyChainRisk | null> {\n    // Resolve GitHub repo from registry metadata\n    const githubRepo = await resolveGithubRepo(ecosystem, packageName);\n\n    // Fetch Scorecard (only if we have a GitHub repo)\n    let scorecardScore: number | null = null;\n    let scorecardChecks: Record<string, number> | null = null;\n    if (githubRepo) {\n      const sc = await fetchScorecard(githubRepo);\n      if (sc) {\n        scorecardScore = sc.score;\n        scorecardChecks = sc.checks;\n      }\n    }\n\n    // Fetch maintenance info from registry\n    const maintenance = await getMaintenance(ecosystem, packageName);\n    const { daysSinceLastCommit, maintainerCount, publishedAt } = maintenance;\n\n    const isAbandoned = daysSinceLastCommit !== null && daysSinceLastCommit > 365;\n    const isSingleMaintainer = maintainerCount !== null && maintainerCount === 1;\n\n    // Package age\n    const publishedMs = publishedAt ? new Date(publishedAt).getTime() : null;\n    const isVeryNew = publishedMs !== null && (Date.now() - publishedMs) < 30 * 24 * 60 * 60 * 1000;\n\n    // Check if dep has known CVEs\n    const rawDb = this.db.getRawDb();\n    const cveCount: { count: number } = rawDb.get(\n      `SELECT COUNT(*) as count FROM sec_vulnerabilities v\n       JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n       WHERE e.source = ?`,\n      [nodeId],\n    ) ?? { count: 0 };\n    const hasActiveCVEs = cveCount.count > 0;\n\n    const { riskLevel, riskReasons } = computeRisk(\n      scorecardScore,\n      daysSinceLastCommit,\n      maintainerCount,\n      isVeryNew,\n      hasActiveCVEs,\n    );\n\n    return {\n      packageName,\n      ecosystem,\n      nodeId,\n      scorecardScore,\n      scorecardChecks,\n      daysSinceLastCommit,\n      isAbandoned,\n      maintainerCount,\n      isSingleMaintainer,\n      publishedAt,\n      isVeryNew,\n      riskLevel,\n      riskReasons,\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,oBAAwB;AA2BxB,MAAM,aAAa;AAEnB,eAAe,UAAU,KAAa,SAAoD;AACxF,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAC7D,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,KAAK;AAAA,MAC5B,QAAQ,WAAW;AAAA,MACnB,SAAS,EAAE,UAAU,oBAAoB,GAAG,QAAQ;AAAA,IACtD,CAAC;AACD,QAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,QAAQ,KAAK,MAAM,EAAE;AACnD,WAAO,MAAM,KAAK,KAAK;AAAA,EACzB,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAIA,eAAe,qBAAqB,MAAsC;AACxE,MAAI;AACF,UAAM,UAAU,mBAAmB,IAAI;AACvC,UAAM,OAAO,MAAM,UAAU,8BAA8B,OAAO,SAAS;AAC3E,UAAM,OAAO,KAAK,YAAY;AAC9B,UAAM,MAAM,OAAO,SAAS,WAAW,OAAO,MAAM,OAAO;AAC3D,WAAO,kBAAkB,GAAG;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,uBAAuB,MAAsC;AAC1E,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,MACjB,mCAAmC,mBAAmB,IAAI,CAAC;AAAA,MAC3D,EAAE,cAAc,gBAAgB;AAAA,IAClC;AACA,UAAM,QAAQ,KAAK,OAAO;AAC1B,UAAM,OAAO,MAAM,YAAY;AAC/B,WAAO,kBAAkB,QAAQ,IAAI;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,sBAAsB,MAAsC;AACzE,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,yBAAyB,mBAAmB,IAAI,CAAC,OAAO;AACrF,UAAM,OAAO,KAAK,MAAM;AACxB,UAAM,cAAc,KAAK,cAAc;AACvC,UAAM,WAAW,KAAK,WAAW;AACjC,UAAM,YAAY,cAAc,QAAQ,KAAK,cAAc,QAAQ,KAAK,cAAc,UAAU,KAAK,YAAY;AACjH,WAAO,kBAAkB,SAAS;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,KAA+C;AACxE,MAAI,CAAC,IAAK,QAAO;AAEjB,QAAM,UAAU,IACb,QAAQ,UAAU,EAAE,EACpB,QAAQ,aAAa,UAAU,EAC/B,QAAQ,iBAAiB,UAAU,EACnC,QAAQ,qBAAqB,qBAAqB,EAClD,QAAQ,UAAU,EAAE;AACvB,QAAM,IAAI,QAAQ,MAAM,qCAAqC;AAC7D,MAAI,CAAC,EAAG,QAAO;AACf,SAAO,EAAE,CAAC;AACZ;AAEA,eAAe,kBAAkB,WAAmB,MAAsC;AACxF,QAAM,MAAM,UAAU,YAAY;AAClC,UAAQ,KAAK;AAAA,IACX,KAAK;AAAU,aAAO,qBAAqB,IAAI;AAAA,IAC/C,KAAK;AAAU,aAAO,uBAAuB,IAAI;AAAA,IACjD,KAAK;AAAA,IACL,KAAK;AAAU,aAAO,sBAAsB,IAAI;AAAA,IAChD;AAAe,aAAO;AAAA,EACxB;AACF;AASA,eAAe,eAAe,YAAqD;AACjF,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,0DAA0D,UAAU,EAAE;AACnG,UAAM,QAAQ,KAAK,OAAO;AAC1B,UAAM,YAAa,KAAK,QAAQ,KAAwC,CAAC;AACzE,UAAM,SAAiC,CAAC;AACxC,eAAW,KAAK,WAAW;AACzB,YAAM,YAAY,EAAE,MAAM;AAC1B,YAAM,aAAa,EAAE,OAAO;AAC5B,UAAI,UAAW,QAAO,SAAS,IAAI,cAAc;AAAA,IACnD;AACA,WAAO,EAAE,OAAO,OAAO;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,eAAe,kBAAkB,MAAwC;AACvE,MAAI;AACF,UAAM,UAAU,mBAAmB,IAAI;AACvC,UAAM,OAAO,MAAM,UAAU,8BAA8B,OAAO,EAAE;AACpE,UAAM,OAAQ,KAAK,MAAM,KAAgC,CAAC;AAC1D,UAAM,cAAe,KAAK,aAAa,KAAmB,CAAC;AAC3D,UAAM,kBAAkB,YAAY;AAGpC,UAAM,aAAa,OAAO,QAAQ,IAAI,EACnC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,aAAa,MAAM,UAAU,EACnD,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,QAAQ,CAAC,EACpC,OAAO,OAAK,CAAC,MAAM,CAAC,CAAC;AACxB,UAAM,gBAAgB,WAAW,SAAS,IAAI,KAAK,IAAI,GAAG,UAAU,IAAI;AACxE,UAAM,sBAAsB,kBAAkB,OAC1C,KAAK,OAAO,KAAK,IAAI,IAAI,kBAAkB,MAAO,KAAK,KAAK,GAAG,IAC/D;AAGJ,UAAM,aAAa,KAAK,SAAS,KAAK;AACtC,UAAM,cAAc,cAAc;AAElC,WAAO,EAAE,qBAAqB,iBAAiB,mBAAmB,MAAM,YAAY;AAAA,EACtF,QAAQ;AACN,WAAO,EAAE,qBAAqB,MAAM,iBAAiB,MAAM,aAAa,KAAK;AAAA,EAC/E;AACF;AAEA,eAAe,qBAAqB,MAAwC;AAC1E,MAAI;AACF,UAAM,OAAO,MAAM;AAAA,MACjB,mCAAmC,mBAAmB,IAAI,CAAC;AAAA,MAC3D,EAAE,cAAc,gBAAgB;AAAA,IAClC;AACA,UAAM,QAAQ,KAAK,OAAO;AAC1B,UAAM,YAAa,MAAM,YAAY,KAAgB;AACrD,UAAM,YAAa,MAAM,YAAY,KAAgB;AAErD,UAAM,sBAAsB,YACxB,KAAK,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,QAAQ,MAAM,MAAO,KAAK,KAAK,GAAG,IAC/E;AAEJ,WAAO,EAAE,qBAAqB,iBAAiB,MAAM,aAAa,UAAU;AAAA,EAC9E,QAAQ;AACN,WAAO,EAAE,qBAAqB,MAAM,iBAAiB,MAAM,aAAa,KAAK;AAAA,EAC/E;AACF;AAEA,eAAe,mBAAmB,MAAwC;AACxE,MAAI;AACF,UAAM,OAAO,MAAM,UAAU,yBAAyB,mBAAmB,IAAI,CAAC,OAAO;AACrF,UAAM,OAAO,KAAK,MAAM;AACxB,UAAM,WAAY,KAAK,UAAU,KAAuD,CAAC;AAGzF,QAAI,WAA0B;AAC9B,QAAI,aAA4B;AAChC,eAAW,SAAS,OAAO,OAAO,QAAQ,GAAG;AAC3C,iBAAW,KAAK,OAAO;AACrB,cAAM,IAAI,EAAE,sBAAsB,KAAK,EAAE,aAAa;AACtD,YAAI,GAAG;AACL,gBAAM,KAAK,IAAI,KAAK,CAAC,EAAE,QAAQ;AAC/B,cAAI,CAAC,MAAM,EAAE,GAAG;AACd,uBAAW,aAAa,OAAO,KAAK,KAAK,IAAI,UAAU,EAAE;AACzD,yBAAa,eAAe,OAAO,KAAK,KAAK,IAAI,YAAY,EAAE;AAAA,UACjE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,sBAAsB,aAAa,OACrC,KAAK,OAAO,KAAK,IAAI,IAAI,aAAa,MAAO,KAAK,KAAK,GAAG,IAC1D;AAGJ,UAAM,kBAAkB;AACxB,UAAM,cAAc,KAAK,cAAc;AAEvC,UAAM,uBAAuB,cACzB,YAAY,MAAM,GAAG,EAAE,OAAO,OAAK,EAAE,KAAK,CAAC,EAAE,SAC7C;AAEJ,UAAM,cAAc,eAAe,OAAO,IAAI,KAAK,UAAU,EAAE,YAAY,IAAI;AAE/E,WAAO,EAAE,qBAAqB,iBAAiB,wBAAwB,iBAAiB,YAAY;AAAA,EACtG,QAAQ;AACN,WAAO,EAAE,qBAAqB,MAAM,iBAAiB,MAAM,aAAa,KAAK;AAAA,EAC/E;AACF;AAEA,eAAe,eAAe,WAAmB,MAAwC;AACvF,QAAM,MAAM,UAAU,YAAY;AAClC,UAAQ,KAAK;AAAA,IACX,KAAK;AAAU,aAAO,kBAAkB,IAAI;AAAA,IAC5C,KAAK;AAAU,aAAO,qBAAqB,IAAI;AAAA,IAC/C,KAAK;AAAA,IACL,KAAK;AAAU,aAAO,mBAAmB,IAAI;AAAA,IAC7C;AAAe,aAAO,EAAE,qBAAqB,MAAM,iBAAiB,MAAM,aAAa,KAAK;AAAA,EAC9F;AACF;AAIA,SAAS,YACP,gBACA,qBACA,iBACA,WACA,eACoE;AACpE,QAAM,UAAoB,CAAC;AAE3B,QAAM,cAAc,wBAAwB,QAAQ,sBAAsB;AAC1E,QAAM,qBAAqB,oBAAoB,QAAQ,oBAAoB;AAC3E,QAAM,eAAe,mBAAmB,QAAQ,iBAAiB;AACjE,QAAM,kBAAkB,mBAAmB,QAAQ,kBAAkB,KAAK,kBAAkB;AAC5F,QAAM,mBAAmB,wBAAwB,QAAQ,sBAAsB;AAE/E,MAAI,YAAa,SAAQ,KAAK,8BAA8B,mBAAmB,OAAO;AACtF,MAAI,UAAW,SAAQ,KAAK,+DAA+D;AAC3F,MAAI,mBAAoB,SAAQ,KAAK,oCAAoC;AACzE,MAAI,aAAc,SAAQ,KAAK,gCAAgC,eAAgB,QAAQ,CAAC,CAAC,KAAK;AAC9F,MAAI,gBAAiB,SAAQ,KAAK,qCAAqC,eAAgB,QAAQ,CAAC,CAAC,KAAK;AACtG,MAAI,oBAAoB,CAAC,YAAa,SAAQ,KAAK,kBAAkB,mBAAmB,OAAO;AAC/F,MAAI,cAAe,SAAQ,KAAK,gBAAgB;AAEhD,MAAI;AACJ,MAAI,eAAe,eAAe;AAChC,gBAAY;AAAA,EACd,WAAW,sBAAsB,gBAAgB,WAAW;AAC1D,gBAAY;AAAA,EACd,WAAW,mBAAoB,oBAAoB,CAAC,aAAc;AAChE,gBAAY;AAAA,EACd,WAAW,mBAAmB,QAAQ,iBAAiB,GAAG;AACxD,gBAAY;AAAA,EACd,OAAO;AACL,gBAAY;AAAA,EACd;AAEA,SAAO,EAAE,WAAW,aAAa,QAAQ;AAC3C;AAIO,MAAM,mBAAmB;AAAA,EAC9B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,WAAsE;AAC1E,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,OAID,MAAM;AAAA,MACT;AAAA,IACF;AAEA,UAAM,UAA6B,CAAC;AACpC,UAAM,SAAmB,CAAC;AAE1B,eAAW,OAAO,MAAM;AACtB,UAAI;AACF,cAAM,OAAO,MAAM,KAAK,OAAO,IAAI,SAAS,IAAI,cAAc,IAAI,SAAS;AAC3E,YAAI,KAAM,SAAQ,KAAK,IAAI;AAAA,MAC7B,SAAS,KAAK;AACZ,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,mCAAQ,kCAAkC,IAAI,YAAY,KAAK,IAAI,SAAS,MAAM,GAAG,EAAE;AACvF,eAAO,KAAK,GAAG,IAAI,YAAY,KAAK,IAAI,SAAS,MAAM,GAAG,EAAE;AAAA,MAC9D;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,OAAO;AAAA,EAC3B;AAAA,EAEA,MAAM,SAAS,aAAqB,WAAoD;AACtF,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,MAAuC,MAAM;AAAA,MACjD;AAAA,MACA,CAAC,aAAa,SAAS;AAAA,IACzB;AACA,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO,KAAK,OAAO,IAAI,SAAS,aAAa,SAAS;AAAA,EACxD;AAAA,EAEA,MAAc,OACZ,QACA,aACA,WACiC;AAEjC,UAAM,aAAa,MAAM,kBAAkB,WAAW,WAAW;AAGjE,QAAI,iBAAgC;AACpC,QAAI,kBAAiD;AACrD,QAAI,YAAY;AACd,YAAM,KAAK,MAAM,eAAe,UAAU;AAC1C,UAAI,IAAI;AACN,yBAAiB,GAAG;AACpB,0BAAkB,GAAG;AAAA,MACvB;AAAA,IACF;AAGA,UAAM,cAAc,MAAM,eAAe,WAAW,WAAW;AAC/D,UAAM,EAAE,qBAAqB,iBAAiB,YAAY,IAAI;AAE9D,UAAM,cAAc,wBAAwB,QAAQ,sBAAsB;AAC1E,UAAM,qBAAqB,oBAAoB,QAAQ,oBAAoB;AAG3E,UAAM,cAAc,cAAc,IAAI,KAAK,WAAW,EAAE,QAAQ,IAAI;AACpE,UAAM,YAAY,gBAAgB,QAAS,KAAK,IAAI,IAAI,cAAe,KAAK,KAAK,KAAK,KAAK;AAG3F,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,WAA8B,MAAM;AAAA,MACxC;AAAA;AAAA;AAAA,MAGA,CAAC,MAAM;AAAA,IACT,KAAK,EAAE,OAAO,EAAE;AAChB,UAAM,gBAAgB,SAAS,QAAQ;AAEvC,UAAM,EAAE,WAAW,YAAY,IAAI;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/security/suppressions.d.ts

@@ -0,0 +1,18 @@
+export interface Suppression {
+    cveId: string;
+    reason?: string;
+    suppressedAt: string;
+    expiresAt?: string;
+}
+export declare class SuppressionManager {
+    private readonly projectRoot;
+    constructor(projectRoot: string);
+    private get filePath();
+    load(): Suppression[];
+    save(suppressions: Suppression[]): void;
+    add(cveId: string, reason?: string, expiresAt?: string): void;
+    remove(cveId: string): boolean;
+    isSuppressed(cveId: string): boolean;
+    getActive(): Suppression[];
+}
+//# sourceMappingURL=suppressions.d.ts.map

package/dist/security/suppressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/security/suppressions.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,MAAM;IAEhD,OAAO,KAAK,QAAQ,GAEnB;IAED,IAAI,IAAI,WAAW,EAAE;IA2BrB,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI;IAQvC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAoB7D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAS9B,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIpC,SAAS,IAAI,WAAW,EAAE;CAG3B"}

package/dist/security/suppressions.js

@@ -0,0 +1,106 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var suppressions_exports = {};
+__export(suppressions_exports, {
+  SuppressionManager: () => SuppressionManager
+});
+module.exports = __toCommonJS(suppressions_exports);
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+class SuppressionManager {
+  constructor(projectRoot) {
+    this.projectRoot = projectRoot;
+  }
+  get filePath() {
+    return path.join(this.projectRoot, ".kirograph", "security-suppressions.json");
+  }
+  load() {
+    if (!fs.existsSync(this.filePath)) {
+      return [];
+    }
+    let all;
+    try {
+      const raw = fs.readFileSync(this.filePath, "utf-8");
+      all = JSON.parse(raw);
+    } catch {
+      return [];
+    }
+    const now = /* @__PURE__ */ new Date();
+    const active = all.filter((s) => {
+      if (!s.expiresAt) return true;
+      return new Date(s.expiresAt) > now;
+    });
+    if (active.length !== all.length) {
+      this.save(active);
+    }
+    return active;
+  }
+  save(suppressions) {
+    const dir = path.dirname(this.filePath);
+    if (!fs.existsSync(dir)) {
+      fs.mkdirSync(dir, { recursive: true });
+    }
+    fs.writeFileSync(this.filePath, JSON.stringify(suppressions, null, 2), "utf-8");
+  }
+  add(cveId, reason, expiresAt) {
+    const current = this.load();
+    const idx = current.findIndex((s) => s.cveId === cveId);
+    const entry = {
+      cveId,
+      suppressedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...reason ? { reason } : {},
+      ...expiresAt ? { expiresAt } : {}
+    };
+    if (idx >= 0) {
+      current[idx] = entry;
+    } else {
+      current.push(entry);
+    }
+    this.save(current);
+  }
+  remove(cveId) {
+    const current = this.load();
+    const idx = current.findIndex((s) => s.cveId === cveId);
+    if (idx < 0) return false;
+    current.splice(idx, 1);
+    this.save(current);
+    return true;
+  }
+  isSuppressed(cveId) {
+    return this.load().some((s) => s.cveId === cveId);
+  }
+  getActive() {
+    return this.load();
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SuppressionManager
+});
+//# sourceMappingURL=suppressions.js.map

package/dist/security/suppressions.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/suppressions.ts"],
+  "sourcesContent": ["import * as fs from 'fs';\nimport * as path from 'path';\n\nexport interface Suppression {\n  cveId: string;\n  reason?: string;\n  suppressedAt: string;   // ISO 8601\n  expiresAt?: string;     // ISO 8601, optional\n}\n\nexport class SuppressionManager {\n  constructor(private readonly projectRoot: string) {}\n\n  private get filePath(): string {\n    return path.join(this.projectRoot, '.kirograph', 'security-suppressions.json');\n  }\n\n  load(): Suppression[] {\n    if (!fs.existsSync(this.filePath)) {\n      return [];\n    }\n\n    let all: Suppression[];\n    try {\n      const raw = fs.readFileSync(this.filePath, 'utf-8');\n      all = JSON.parse(raw) as Suppression[];\n    } catch {\n      return [];\n    }\n\n    const now = new Date();\n    const active = all.filter(s => {\n      if (!s.expiresAt) return true;\n      return new Date(s.expiresAt) > now;\n    });\n\n    // Silently remove expired entries by rewriting if any were filtered\n    if (active.length !== all.length) {\n      this.save(active);\n    }\n\n    return active;\n  }\n\n  save(suppressions: Suppression[]): void {\n    const dir = path.dirname(this.filePath);\n    if (!fs.existsSync(dir)) {\n      fs.mkdirSync(dir, { recursive: true });\n    }\n    fs.writeFileSync(this.filePath, JSON.stringify(suppressions, null, 2), 'utf-8');\n  }\n\n  add(cveId: string, reason?: string, expiresAt?: string): void {\n    const current = this.load();\n    const idx = current.findIndex(s => s.cveId === cveId);\n\n    const entry: Suppression = {\n      cveId,\n      suppressedAt: new Date().toISOString(),\n      ...(reason ? { reason } : {}),\n      ...(expiresAt ? { expiresAt } : {}),\n    };\n\n    if (idx >= 0) {\n      current[idx] = entry;\n    } else {\n      current.push(entry);\n    }\n\n    this.save(current);\n  }\n\n  remove(cveId: string): boolean {\n    const current = this.load();\n    const idx = current.findIndex(s => s.cveId === cveId);\n    if (idx < 0) return false;\n    current.splice(idx, 1);\n    this.save(current);\n    return true;\n  }\n\n  isSuppressed(cveId: string): boolean {\n    return this.load().some(s => s.cveId === cveId);\n  }\n\n  getActive(): Suppression[] {\n    return this.load();\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAoB;AACpB,WAAsB;AASf,MAAM,mBAAmB;AAAA,EAC9B,YAA6B,aAAqB;AAArB;AAAA,EAAsB;AAAA,EAEnD,IAAY,WAAmB;AAC7B,WAAO,KAAK,KAAK,KAAK,aAAa,cAAc,4BAA4B;AAAA,EAC/E;AAAA,EAEA,OAAsB;AACpB,QAAI,CAAC,GAAG,WAAW,KAAK,QAAQ,GAAG;AACjC,aAAO,CAAC;AAAA,IACV;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,GAAG,aAAa,KAAK,UAAU,OAAO;AAClD,YAAM,KAAK,MAAM,GAAG;AAAA,IACtB,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,SAAS,IAAI,OAAO,OAAK;AAC7B,UAAI,CAAC,EAAE,UAAW,QAAO;AACzB,aAAO,IAAI,KAAK,EAAE,SAAS,IAAI;AAAA,IACjC,CAAC;AAGD,QAAI,OAAO,WAAW,IAAI,QAAQ;AAChC,WAAK,KAAK,MAAM;AAAA,IAClB;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,KAAK,cAAmC;AACtC,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ;AACtC,QAAI,CAAC,GAAG,WAAW,GAAG,GAAG;AACvB,SAAG,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,IACvC;AACA,OAAG,cAAc,KAAK,UAAU,KAAK,UAAU,cAAc,MAAM,CAAC,GAAG,OAAO;AAAA,EAChF;AAAA,EAEA,IAAI,OAAe,QAAiB,WAA0B;AAC5D,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,MAAM,QAAQ,UAAU,OAAK,EAAE,UAAU,KAAK;AAEpD,UAAM,QAAqB;AAAA,MACzB;AAAA,MACA,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,MACrC,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,MAC3B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACnC;AAEA,QAAI,OAAO,GAAG;AACZ,cAAQ,GAAG,IAAI;AAAA,IACjB,OAAO;AACL,cAAQ,KAAK,KAAK;AAAA,IACpB;AAEA,SAAK,KAAK,OAAO;AAAA,EACnB;AAAA,EAEA,OAAO,OAAwB;AAC7B,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,MAAM,QAAQ,UAAU,OAAK,EAAE,UAAU,KAAK;AACpD,QAAI,MAAM,EAAG,QAAO;AACpB,YAAQ,OAAO,KAAK,CAAC;AACrB,SAAK,KAAK,OAAO;AACjB,WAAO;AAAA,EACT;AAAA,EAEA,aAAa,OAAwB;AACnC,WAAO,KAAK,KAAK,EAAE,KAAK,OAAK,EAAE,UAAU,KAAK;AAAA,EAChD;AAAA,EAEA,YAA2B;AACzB,WAAO,KAAK,KAAK;AAAA,EACnB;AACF;",
+  "names": []
+}

package/dist/security/types.d.ts

@@ -0,0 +1,144 @@
+/**
+ * KiroGraph-Sec Type Definitions
+ *
+ * Interfaces for the security analysis module including manifest parsing,
+ * vulnerability detection, reachability analysis, and CycloneDX export.
+ */
+export interface ParsedDependency {
+    name: string;
+    declaredConstraint: string;
+    resolvedVersion?: string;
+    scope: 'production' | 'development' | 'optional';
+    ecosystem: string;
+    sourceManifest: string;
+    license?: string;
+}
+export interface ManifestParseResult {
+    dependenciesCreated: number;
+    manifestsParsed: number;
+    warnings: Array<{
+        file: string;
+        line?: number;
+        message: string;
+    }>;
+    errors: Array<{
+        file: string;
+        message: string;
+    }>;
+}
+export interface IntegrationResult {
+    importsEdgesCreated: number;
+    referencesEdgesCreated: number;
+}
+export interface TransitiveResult {
+    dependsOnEdgesCreated: number;
+    incompleteNodes: string[];
+}
+export interface CleanupResult {
+    nodesRemoved: number;
+    edgesRemoved: number;
+}
+export interface CVERecord {
+    id: string;
+    severity: number;
+    affectedVersionRanges: VersionRange[];
+    fixedVersion?: string;
+    summary: string;
+}
+export interface VersionRange {
+    introduced?: string;
+    fixed?: string;
+    lastAffected?: string;
+}
+export interface EnrichmentResult {
+    vulnerabilitiesFound: number;
+    dependenciesChecked: number;
+    errors: Array<{
+        dependency: string;
+        database: string;
+        error: string;
+    }>;
+    staleNodes: string[];
+}
+export type ReachabilityVerdict = 'affected' | 'not_affected' | 'under_investigation';
+export interface ReachabilityPath {
+    entryPoint: string;
+    path: string[];
+}
+export interface ReachabilityResult {
+    verdict: ReachabilityVerdict;
+    paths: ReachabilityPath[];
+    unresolvedSymbols: string[];
+    reachingEntryPointCount: number;
+}
+export interface ImpactSummary {
+    affectedLayers: string[];
+    affectedEntryPoints: string[];
+    distinctPathCount: number;
+}
+export interface SecurityResult {
+    manifestsDiscovered: number;
+    dependenciesCreated: number;
+    vulnerabilitiesFound: number;
+    affectedCount: number;
+    notAffectedCount: number;
+    underInvestigationCount: number;
+    duration: number;
+}
+export interface SBOMMetadata {
+    toolName: string;
+    toolVersion: string;
+    timestamp: string;
+    projectName: string;
+}
+export interface CycloneDXSBOM {
+    bomFormat: 'CycloneDX';
+    specVersion: '1.5';
+    version: number;
+    metadata: Record<string, unknown>;
+    components: CycloneDXComponent[];
+    dependencies: CycloneDXDependencyEntry[];
+}
+export interface CycloneDXComponent {
+    type: 'library';
+    name: string;
+    version: string;
+    purl: string;
+    scope?: 'required' | 'optional';
+    properties?: Array<{
+        name: string;
+        value: string;
+    }>;
+}
+export interface CycloneDXDependencyEntry {
+    ref: string;
+    dependsOn?: string[];
+}
+export interface CycloneDXVEX {
+    bomFormat: 'CycloneDX';
+    specVersion: '1.5';
+    version: number;
+    metadata: Record<string, unknown>;
+    vulnerabilities: CycloneDXVulnerability[];
+}
+export interface CycloneDXVulnerability {
+    id: string;
+    source?: {
+        name: string;
+        url?: string;
+    };
+    ratings?: Array<{
+        score: number;
+        severity?: string;
+        method?: string;
+    }>;
+    analysis?: {
+        state: 'affected' | 'not_affected' | 'under_investigation';
+        justification?: string;
+        detail?: string;
+    };
+    affects?: Array<{
+        ref: string;
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,YAAY,GAAG,aAAa,GAAG,UAAU,CAAC;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAID,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAID,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,YAAY,EAAE,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,cAAc,GAAG,qBAAqB,CAAC;AAEtF,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,cAAc;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,YAAY,EAAE,wBAAwB,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAChC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,eAAe,EAAE,sBAAsB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,QAAQ,CAAC,EAAE;QACT,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,qBAAqB,CAAC;QAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClC"}