kirograph 0.19.0 → 0.20.0

package/dist/patterns/runner.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/patterns/runner.ts"],
+  "sourcesContent": ["/**\n * KiroGraph PatternRunner \u2014 lazy-loads @ast-grep/napi and executes pattern rules.\n */\n\nimport { PatternRule, PatternMatch, SEVERITY_ORDER } from './types';\nimport { logWarn } from '../errors';\n\n// Languages supported by @ast-grep/napi tree-sitter grammars.\n// Calling parse() with an unsupported language throws a native C++ exception\n// that bypasses JS try/catch and corrupts the mutex \u2014 skip unsupported languages.\nconst NAPI_SUPPORTED_LANGUAGES = new Set([\n  'javascript', 'typescript', 'tsx', 'jsx',\n  'python', 'go', 'rust', 'java', 'c', 'cpp', 'cs', 'swift', 'kotlin',\n  'html', 'css', 'json', 'yaml', 'bash', 'ruby', 'php', 'scala',\n  'haskell', 'lua', 'r', 'dart', 'elixir', 'erlang', 'ocaml',\n]);\n\n// Module-level cache: undefined = not yet attempted, null = missing, module = loaded\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nlet _napi: any | null | undefined = undefined;\nlet _napiWarnLogged = false;\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nasync function getNapi(): Promise<any | null> {\n  if (_napi !== undefined) return _napi;\n  try {\n    // Verify it can be resolved synchronously before async import\n    require.resolve('@ast-grep/napi');\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    _napi = require('@ast-grep/napi');\n    return _napi;\n  } catch {\n    _napi = null;\n    if (!_napiWarnLogged) {\n      logWarn('PatternRunner: @ast-grep/napi is not installed. Pattern matching is disabled. Run: npm install @ast-grep/napi');\n      _napiWarnLogged = true;\n    }\n    return null;\n  }\n}\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nfunction renderFix(fixTemplate: string, node: any): string | undefined {\n  if (!fixTemplate) return undefined;\n  // Replace $VAR metavariables with matched text\n  return fixTemplate.replace(/\\$([A-Z_]+)/g, (_, varName) => {\n    try {\n      return node.getMatch(varName)?.text() ?? `$${varName}`;\n    } catch {\n      return `$${varName}`;\n    }\n  });\n}\n\nexport class PatternRunner {\n  /**\n   * Synchronously check whether @ast-grep/napi is available.\n   */\n  isAvailable(): boolean {\n    try {\n      require.resolve('@ast-grep/napi');\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  /**\n   * Returns true if the language is supported by @ast-grep/napi.\n   * Unsupported languages must be skipped \u2014 calling parse() on them throws a\n   * native C++ exception that bypasses JS try/catch and corrupts internal mutexes.\n   */\n  isSupportedLanguage(language: string): boolean {\n    return NAPI_SUPPORTED_LANGUAGES.has(language.toLowerCase());\n  }\n\n  /**\n   * Lazy async loader \u2014 returns the napi module or null if missing.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  async getNapi(): Promise<any | null> {\n    return getNapi();\n  }\n\n  /**\n   * Run a single library rule against a file's content.\n   * Returns an empty array and logs a warning on per-file errors.\n   */\n  async runRule(rule: PatternRule, fileContent: string, language: string): Promise<PatternMatch[]> {\n    if (!this.isSupportedLanguage(language)) return [];\n    const napi = await getNapi();\n    if (!napi) return [];\n\n    try {\n      const { parse } = napi;\n      const root = parse(language as any, fileContent);\n      const nodes = root.root().findAll({ rule: rule.rule as any });\n      const lines = fileContent.split('\\n');\n\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      return nodes.map((node: any) => {\n        const range = node.range();\n        const line = range.start.line + 1; // 1-based\n        const col = range.start.column;    // 0-based\n        const matchText = node.text().slice(0, 500);\n        const context = _buildContext(lines, range.start.line);\n        const fixSuggestion = rule.fix ? renderFix(rule.fix, node) : undefined;\n\n        return {\n          patternId: rule.id,\n          filePath: '',\n          line,\n          col,\n          matchText,\n          context,\n          severity: rule.severity,\n          owaspCategory: rule.owaspCategory,\n          language,\n          ...(fixSuggestion !== undefined ? { fixSuggestion } : {}),\n        };\n      });\n    } catch (err) {\n      logWarn(`PatternRunner: error running rule \"${rule.id}\" on file (language: ${language}): ${err instanceof Error ? err.message : String(err)}`);\n      return [];\n    }\n  }\n\n  /**\n   * Run an inline pattern expression (not from library) against file content.\n   * Returns an empty array and logs a warning on per-file errors.\n   */\n  async runInline(pattern: string, language: string, fileContent: string): Promise<PatternMatch[]> {\n    if (!this.isSupportedLanguage(language)) return [];\n    const napi = await getNapi();\n    if (!napi) return [];\n\n    try {\n      const { parse } = napi;\n      const root = parse(language as any, fileContent);\n      const nodes = root.root().findAll(pattern);\n      const lines = fileContent.split('\\n');\n\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      return nodes.map((node: any) => {\n        const range = node.range();\n        const line = range.start.line + 1;\n        const col = range.start.column;\n        const matchText = node.text().slice(0, 500);\n        const context = _buildContext(lines, range.start.line);\n\n        return {\n          patternId: '',\n          filePath: '',\n          line,\n          col,\n          matchText,\n          context,\n          severity: 'low' as const,\n          owaspCategory: '',\n          language,\n        };\n      });\n    } catch (err) {\n      logWarn(`PatternRunner: error running inline pattern on file (language: ${language}): ${err instanceof Error ? err.message : String(err)}`);\n      return [];\n    }\n  }\n\n  /**\n   * Run all rules against a file's content, filtered by severity threshold.\n   */\n  async runAllRules(\n    rules: PatternRule[],\n    fileContent: string,\n    language: string,\n    threshold: PatternRule['severity'],\n  ): Promise<PatternMatch[]> {\n    const napi = await getNapi();\n    if (!napi) return [];\n\n    const thresholdOrder = SEVERITY_ORDER[threshold];\n    const applicableRules = rules.filter(r => {\n      const langs = Array.isArray(r.language) ? r.language : [r.language];\n      return langs.includes(language) && SEVERITY_ORDER[r.severity] >= thresholdOrder;\n    });\n\n    const results: PatternMatch[] = [];\n    for (const rule of applicableRules) {\n      const matches = await this.runRule(rule, fileContent, language);\n      results.push(...matches);\n    }\n    return results;\n  }\n\n  /**\n   * Apply the rule's fix template to all matches in the file content.\n   * Returns the transformed source string, or null if no fix was applied.\n   * Uses a range-based text substitution approach since commitEdits may not\n   * be available in all versions of @ast-grep/napi.\n   */\n  async applyFix(filePath: string, fileContent: string, language: string, rule: PatternRule): Promise<string | null> {\n    const napi = await this.getNapi();\n    if (!napi || !rule.fix) return null;\n    try {\n      const { parse } = napi;\n      const root = parse(language as any, fileContent);\n      const nodes = root.root().findAll({ rule: rule.rule as any });\n      if (nodes.length === 0) return null;\n\n      // Try the native commitEdits API first\n      try {\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        for (const node of nodes as any[]) {\n          const fixText = renderFix(rule.fix, node);\n          if (fixText) node.replace(fixText);\n        }\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        const edited: string | null | undefined = (root.root() as any).commitEdits?.();\n        if (typeof edited === 'string') return edited;\n      } catch {\n        // commitEdits not available \u2014 fall through to text substitution\n      }\n\n      // Fallback: apply replacements using byte offsets, processing from end to start\n      // so earlier replacements don't shift the offsets of later ones.\n      interface Edit { start: number; end: number; replacement: string }\n      const edits: Edit[] = [];\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      for (const node of nodes as any[]) {\n        const fixText = renderFix(rule.fix, node);\n        if (fixText === undefined) continue;\n        const range = node.range();\n        // Convert line/col to byte offset\n        const lines = fileContent.split('\\n');\n        let startOffset = 0;\n        for (let i = 0; i < range.start.line; i++) {\n          startOffset += (lines[i]?.length ?? 0) + 1; // +1 for \\n\n        }\n        startOffset += range.start.column;\n\n        let endOffset = 0;\n        for (let i = 0; i < range.end.line; i++) {\n          endOffset += (lines[i]?.length ?? 0) + 1;\n        }\n        endOffset += range.end.column;\n\n        edits.push({ start: startOffset, end: endOffset, replacement: fixText });\n      }\n\n      if (edits.length === 0) return null;\n\n      // Sort descending by start offset so we can splice without re-indexing\n      edits.sort((a, b) => b.start - a.start);\n\n      let result = fileContent;\n      for (const edit of edits) {\n        result = result.slice(0, edit.start) + edit.replacement + result.slice(edit.end);\n      }\n\n      return result !== fileContent ? result : null;\n    } catch (err) {\n      logWarn(`PatternRunner.applyFix: error applying fix for rule \"${rule.id}\" on \"${filePath}\": ${err instanceof Error ? err.message : String(err)}`);\n      return null;\n    }\n  }\n}\n\nfunction _buildContext(lines: string[], zeroBasedLine: number): string {\n  const contextLines: string[] = [];\n  if (zeroBasedLine > 0) contextLines.push(lines[zeroBasedLine - 1] ?? '');\n  contextLines.push(lines[zeroBasedLine] ?? '');\n  if (zeroBasedLine + 1 < lines.length) contextLines.push(lines[zeroBasedLine + 1] ?? '');\n  return contextLines.join('\\n');\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,mBAA0D;AAC1D,oBAAwB;AAKxB,MAAM,2BAA2B,oBAAI,IAAI;AAAA,EACvC;AAAA,EAAc;AAAA,EAAc;AAAA,EAAO;AAAA,EACnC;AAAA,EAAU;AAAA,EAAM;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAK;AAAA,EAAO;AAAA,EAAM;AAAA,EAAS;AAAA,EAC3D;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EACtD;AAAA,EAAW;AAAA,EAAO;AAAA,EAAK;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAU;AACrD,CAAC;AAID,IAAI,QAAgC;AACpC,IAAI,kBAAkB;AAGtB,eAAe,UAA+B;AAC5C,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI;AAEF,oBAAgB,gBAAgB;AAEhC,YAAQ,QAAQ,gBAAgB;AAChC,WAAO;AAAA,EACT,QAAQ;AACN,YAAQ;AACR,QAAI,CAAC,iBAAiB;AACpB,iCAAQ,+GAA+G;AACvH,wBAAkB;AAAA,IACpB;AACA,WAAO;AAAA,EACT;AACF;AAGA,SAAS,UAAU,aAAqB,MAA+B;AACrE,MAAI,CAAC,YAAa,QAAO;AAEzB,SAAO,YAAY,QAAQ,gBAAgB,CAAC,GAAG,YAAY;AACzD,QAAI;AACF,aAAO,KAAK,SAAS,OAAO,GAAG,KAAK,KAAK,IAAI,OAAO;AAAA,IACtD,QAAQ;AACN,aAAO,IAAI,OAAO;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEO,MAAM,cAAc;AAAA;AAAA;AAAA;AAAA,EAIzB,cAAuB;AACrB,QAAI;AACF,sBAAgB,gBAAgB;AAChC,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBAAoB,UAA2B;AAC7C,WAAO,yBAAyB,IAAI,SAAS,YAAY,CAAC;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAA+B;AACnC,WAAO,QAAQ;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,MAAmB,aAAqB,UAA2C;AAC/F,QAAI,CAAC,KAAK,oBAAoB,QAAQ,EAAG,QAAO,CAAC;AACjD,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO,CAAC;AAEnB,QAAI;AACF,YAAM,EAAE,MAAM,IAAI;AAClB,YAAM,OAAO,MAAM,UAAiB,WAAW;AAC/C,YAAM,QAAQ,KAAK,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,KAAY,CAAC;AAC5D,YAAM,QAAQ,YAAY,MAAM,IAAI;AAGpC,aAAO,MAAM,IAAI,CAAC,SAAc;AAC9B,cAAM,QAAQ,KAAK,MAAM;AACzB,cAAM,OAAO,MAAM,MAAM,OAAO;AAChC,cAAM,MAAM,MAAM,MAAM;AACxB,cAAM,YAAY,KAAK,KAAK,EAAE,MAAM,GAAG,GAAG;AAC1C,cAAM,UAAU,cAAc,OAAO,MAAM,MAAM,IAAI;AACrD,cAAM,gBAAgB,KAAK,MAAM,UAAU,KAAK,KAAK,IAAI,IAAI;AAE7D,eAAO;AAAA,UACL,WAAW,KAAK;AAAA,UAChB,UAAU;AAAA,UACV;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU,KAAK;AAAA,UACf,eAAe,KAAK;AAAA,UACpB;AAAA,UACA,GAAI,kBAAkB,SAAY,EAAE,cAAc,IAAI,CAAC;AAAA,QACzD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,iCAAQ,sCAAsC,KAAK,EAAE,wBAAwB,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC7I,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAU,SAAiB,UAAkB,aAA8C;AAC/F,QAAI,CAAC,KAAK,oBAAoB,QAAQ,EAAG,QAAO,CAAC;AACjD,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO,CAAC;AAEnB,QAAI;AACF,YAAM,EAAE,MAAM,IAAI;AAClB,YAAM,OAAO,MAAM,UAAiB,WAAW;AAC/C,YAAM,QAAQ,KAAK,KAAK,EAAE,QAAQ,OAAO;AACzC,YAAM,QAAQ,YAAY,MAAM,IAAI;AAGpC,aAAO,MAAM,IAAI,CAAC,SAAc;AAC9B,cAAM,QAAQ,KAAK,MAAM;AACzB,cAAM,OAAO,MAAM,MAAM,OAAO;AAChC,cAAM,MAAM,MAAM,MAAM;AACxB,cAAM,YAAY,KAAK,KAAK,EAAE,MAAM,GAAG,GAAG;AAC1C,cAAM,UAAU,cAAc,OAAO,MAAM,MAAM,IAAI;AAErD,eAAO;AAAA,UACL,WAAW;AAAA,UACX,UAAU;AAAA,UACV;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU;AAAA,UACV,eAAe;AAAA,UACf;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,iCAAQ,kEAAkE,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC1I,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YACJ,OACA,aACA,UACA,WACyB;AACzB,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,KAAM,QAAO,CAAC;AAEnB,UAAM,iBAAiB,4BAAe,SAAS;AAC/C,UAAM,kBAAkB,MAAM,OAAO,OAAK;AACxC,YAAM,QAAQ,MAAM,QAAQ,EAAE,QAAQ,IAAI,EAAE,WAAW,CAAC,EAAE,QAAQ;AAClE,aAAO,MAAM,SAAS,QAAQ,KAAK,4BAAe,EAAE,QAAQ,KAAK;AAAA,IACnE,CAAC;AAED,UAAM,UAA0B,CAAC;AACjC,eAAW,QAAQ,iBAAiB;AAClC,YAAM,UAAU,MAAM,KAAK,QAAQ,MAAM,aAAa,QAAQ;AAC9D,cAAQ,KAAK,GAAG,OAAO;AAAA,IACzB;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,UAAkB,aAAqB,UAAkB,MAA2C;AACjH,UAAM,OAAO,MAAM,KAAK,QAAQ;AAChC,QAAI,CAAC,QAAQ,CAAC,KAAK,IAAK,QAAO;AAC/B,QAAI;AACF,YAAM,EAAE,MAAM,IAAI;AAClB,YAAM,OAAO,MAAM,UAAiB,WAAW;AAC/C,YAAM,QAAQ,KAAK,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,KAAY,CAAC;AAC5D,UAAI,MAAM,WAAW,EAAG,QAAO;AAG/B,UAAI;AAEF,mBAAW,QAAQ,OAAgB;AACjC,gBAAM,UAAU,UAAU,KAAK,KAAK,IAAI;AACxC,cAAI,QAAS,MAAK,QAAQ,OAAO;AAAA,QACnC;AAEA,cAAM,SAAqC,KAAK,KAAK,EAAU,cAAc;AAC7E,YAAI,OAAO,WAAW,SAAU,QAAO;AAAA,MACzC,QAAQ;AAAA,MAER;AAKA,YAAM,QAAgB,CAAC;AAEvB,iBAAW,QAAQ,OAAgB;AACjC,cAAM,UAAU,UAAU,KAAK,KAAK,IAAI;AACxC,YAAI,YAAY,OAAW;AAC3B,cAAM,QAAQ,KAAK,MAAM;AAEzB,cAAM,QAAQ,YAAY,MAAM,IAAI;AACpC,YAAI,cAAc;AAClB,iBAAS,IAAI,GAAG,IAAI,MAAM,MAAM,MAAM,KAAK;AACzC,0BAAgB,MAAM,CAAC,GAAG,UAAU,KAAK;AAAA,QAC3C;AACA,uBAAe,MAAM,MAAM;AAE3B,YAAI,YAAY;AAChB,iBAAS,IAAI,GAAG,IAAI,MAAM,IAAI,MAAM,KAAK;AACvC,wBAAc,MAAM,CAAC,GAAG,UAAU,KAAK;AAAA,QACzC;AACA,qBAAa,MAAM,IAAI;AAEvB,cAAM,KAAK,EAAE,OAAO,aAAa,KAAK,WAAW,aAAa,QAAQ,CAAC;AAAA,MACzE;AAEA,UAAI,MAAM,WAAW,EAAG,QAAO;AAG/B,YAAM,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AAEtC,UAAI,SAAS;AACb,iBAAW,QAAQ,OAAO;AACxB,iBAAS,OAAO,MAAM,GAAG,KAAK,KAAK,IAAI,KAAK,cAAc,OAAO,MAAM,KAAK,GAAG;AAAA,MACjF;AAEA,aAAO,WAAW,cAAc,SAAS;AAAA,IAC3C,SAAS,KAAK;AACZ,iCAAQ,wDAAwD,KAAK,EAAE,SAAS,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAChJ,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,cAAc,OAAiB,eAA+B;AACrE,QAAM,eAAyB,CAAC;AAChC,MAAI,gBAAgB,EAAG,cAAa,KAAK,MAAM,gBAAgB,CAAC,KAAK,EAAE;AACvE,eAAa,KAAK,MAAM,aAAa,KAAK,EAAE;AAC5C,MAAI,gBAAgB,IAAI,MAAM,OAAQ,cAAa,KAAK,MAAM,gBAAgB,CAAC,KAAK,EAAE;AACtF,SAAO,aAAa,KAAK,IAAI;AAC/B;",
+  "names": []
+}

package/dist/patterns/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * KiroGraph Patterns — shared types for pattern rules, matches, and results.
+ */
+export interface PatternRule {
+    id: string;
+    language: string | string[];
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    owaspCategory: string;
+    description: string;
+    fixHint: string;
+    fix?: string;
+    rule: Record<string, unknown>;
+}
+export interface PatternMatch {
+    patternId: string;
+    filePath: string;
+    line: number;
+    col: number;
+    matchText: string;
+    context: string;
+    severity: PatternRule['severity'];
+    owaspCategory: string;
+    language: string;
+    fixSuggestion?: string;
+}
+export declare const SEVERITY_ORDER: Record<PatternRule['severity'], number>;
+//# sourceMappingURL=types.d.ts.map

package/dist/patterns/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/patterns/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,CAElE,CAAC"}

package/dist/patterns/types.js

@@ -0,0 +1,34 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+__export(types_exports, {
+  SEVERITY_ORDER: () => SEVERITY_ORDER
+});
+module.exports = __toCommonJS(types_exports);
+const SEVERITY_ORDER = {
+  low: 0,
+  medium: 1,
+  high: 2,
+  critical: 3
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SEVERITY_ORDER
+});
+//# sourceMappingURL=types.js.map

package/dist/patterns/types.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/patterns/types.ts"],
+  "sourcesContent": ["/**\n * KiroGraph Patterns \u2014 shared types for pattern rules, matches, and results.\n */\n\nexport interface PatternRule {\n  id: string;\n  language: string | string[];\n  severity: 'critical' | 'high' | 'medium' | 'low';\n  owaspCategory: string;\n  description: string;\n  fixHint: string;\n  fix?: string;          // ast-grep fix template using metavariables\n  rule: Record<string, unknown>;\n}\n\nexport interface PatternMatch {\n  patternId: string;\n  filePath: string;\n  line: number;       // 1-based\n  col: number;        // 0-based\n  matchText: string;  // truncated to 500 chars\n  context: string;    // line before + matched + line after\n  severity: PatternRule['severity'];\n  owaspCategory: string;\n  language: string;\n  fixSuggestion?: string;  // populated when the rule has a fix: field\n}\n\nexport const SEVERITY_ORDER: Record<PatternRule['severity'], number> = {\n  low: 0, medium: 1, high: 2, critical: 3,\n};\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA4BO,MAAM,iBAA0D;AAAA,EACrE,KAAK;AAAA,EAAG,QAAQ;AAAA,EAAG,MAAM;AAAA,EAAG,UAAU;AACxC;",
+  "names": []
+}

package/dist/resolution/bridges/android-rn.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Android React Native Bridge
+ *
+ * Synthesizes edges between JavaScript/TypeScript calls to NativeModules.X.method()
+ * (and NativeEventEmitter) and their Kotlin/Java implementations declared via
+ * @ReactMethod or @ReactProp in classes extending ReactContextBaseJavaModule.
+ *
+ * Covers the Android/Kotlin/Java side of the React Native bridge, closing the
+ * gap with the iOS/ObjC coverage provided by react-native-legacy-bridge.
+ */
+import type { BridgeResolver } from './index';
+export declare const androidRnBridge: BridgeResolver;
+//# sourceMappingURL=android-rn.d.ts.map

package/dist/resolution/bridges/android-rn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"android-rn.d.ts","sourceRoot":"","sources":["../../../src/resolution/bridges/android-rn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,SAAS,CAAC;AAqV/D,eAAO,MAAM,eAAe,EAAE,cA+G7B,CAAC"}

package/dist/resolution/bridges/expo-modules.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Expo Modules Bridge
+ *
+ * Synthesizes edges between JavaScript calls to requireNativeModule('X').fn()
+ * and Swift/Kotlin module definitions using the Expo Modules DSL:
+ *   Module { Name("X"); AsyncFunction("fn") { ... } }
+ */
+import type { BridgeResolver } from './index';
+export declare const expoModulesBridge: BridgeResolver;
+//# sourceMappingURL=expo-modules.d.ts.map

package/dist/resolution/bridges/expo-modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expo-modules.d.ts","sourceRoot":"","sources":["../../../src/resolution/bridges/expo-modules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,SAAS,CAAC;AAuJ/D,eAAO,MAAM,iBAAiB,EAAE,cAwD/B,CAAC"}

package/dist/resolution/bridges/flutter-channel.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Flutter Method Channel Bridge
+ *
+ * Synthesizes edges between Dart callers using MethodChannel.invokeMethod() /
+ * EventChannel.receiveBroadcastStream() and their native handler implementations
+ * in Kotlin/Java (setMethodCallHandler / setStreamHandler) or Swift/ObjC
+ * (FlutterMethodChannel.setMethodCallHandler).
+ *
+ * The channel name string (e.g. "com.example/camera") is the linking key between
+ * the Dart side and each native platform side.
+ */
+import type { BridgeResolver } from './index';
+export declare const flutterChannelBridge: BridgeResolver;
+//# sourceMappingURL=flutter-channel.d.ts.map

package/dist/resolution/bridges/flutter-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flutter-channel.d.ts","sourceRoot":"","sources":["../../../src/resolution/bridges/flutter-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,SAAS,CAAC;AAse/D,eAAO,MAAM,oBAAoB,EAAE,cAkElC,CAAC"}

package/dist/resolution/bridges/index.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Bridge Resolver Registry
+ *
+ * Manages cross-language bridge resolvers that synthesize edges between
+ * symbols in different languages (Swift ↔ ObjC, JS ↔ Native, etc.).
+ * Bridges run after standard resolution and emit heuristic-based edges.
+ */
+import type { EdgeKind } from '../../types';
+import type { ResolutionContext } from '../../frameworks/types';
+import type { GraphDatabase } from '../../db/database';
+export interface SynthesizedEdge {
+    source: string;
+    target: string;
+    kind: EdgeKind;
+    confidence: 'inferred';
+    confidenceScore: number;
+    metadata: {
+        synthesizedBy: string;
+        provenance: 'heuristic';
+        [key: string]: unknown;
+    };
+}
+export interface BridgeResolver {
+    name: string;
+    /** Detect if this bridge is relevant for the project */
+    detect(context: ResolutionContext): boolean;
+    /** Synthesize cross-language edges */
+    resolve(context: ResolutionContext): SynthesizedEdge[];
+}
+export interface BridgeResolutionResult {
+    totalEdges: number;
+    bridgesRun: string[];
+    durationMs: number;
+}
+/**
+ * Run all applicable bridge resolvers and insert synthesized edges into the database.
+ * Bridges that are not relevant for the project are skipped via detect().
+ */
+export declare function runBridgeResolvers(context: ResolutionContext, db: GraphDatabase): BridgeResolutionResult;
+//# sourceMappingURL=index.d.ts.map

package/dist/resolution/bridges/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/resolution/bridges/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAc,QAAQ,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE;QACR,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,WAAW,CAAC;QACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC;IAC5C,sCAAsC;IACtC,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,eAAe,EAAE,CAAC;CACxD;AA0BD,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,iBAAiB,EAC1B,EAAE,EAAE,aAAa,GAChB,sBAAsB,CAsCxB"}

package/dist/resolution/bridges/native-events.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Native → JS Events Bridge
+ *
+ * Synthesizes edges between native event emitters (sendEventWithName: in ObjC,
+ * .emit() in Java/Kotlin) and JavaScript event listeners (NativeEventEmitter.addListener).
+ * Matches by literal event name string.
+ */
+import type { BridgeResolver } from './index';
+export declare const nativeEventsBridge: BridgeResolver;
+//# sourceMappingURL=native-events.d.ts.map

package/dist/resolution/bridges/native-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-events.d.ts","sourceRoot":"","sources":["../../../src/resolution/bridges/native-events.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,SAAS,CAAC;AAqM/D,eAAO,MAAM,kBAAkB,EAAE,cAsDhC,CAAC"}

package/dist/resolution/bridges/native-views.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Fabric/Paper Native Views Bridge
+ *
+ * Synthesizes edges between JSX usage of native components (<MyView />)
+ * and their native view manager implementations. Uses convention-based
+ * name + suffix lookup to match components to their native counterparts.
+ *
+ * Conventions:
+ *   <MyView /> → MyViewManager, MyViewComponentView, RCTMyViewManager
+ */
+import type { BridgeResolver } from './index';
+export declare const nativeViewsBridge: BridgeResolver;
+//# sourceMappingURL=native-views.d.ts.map

package/dist/resolution/bridges/native-views.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-views.d.ts","sourceRoot":"","sources":["../../../src/resolution/bridges/native-views.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,SAAS,CAAC;AAuP/D,eAAO,MAAM,iBAAiB,EAAE,cA+E/B,CAAC"}

package/dist/resolution/bridges/react-native.d.ts

@@ -0,0 +1,9 @@
+/**
+ * React Native Legacy Bridge
+ *
+ * Synthesizes edges between JavaScript/TypeScript calls to NativeModules.X.method()
+ * and native implementations declared via RCT_EXPORT_METHOD (ObjC) or @ReactMethod (Java/Kotlin).
+ */
+import type { BridgeResolver } from './index';
+export declare const reactNativeLegacyBridge: BridgeResolver;
+//# sourceMappingURL=react-native.d.ts.map

package/dist/resolution/bridges/react-native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-native.d.ts","sourceRoot":"","sources":["../../../src/resolution/bridges/react-native.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,SAAS,CAAC;AAuK/D,eAAO,MAAM,uBAAuB,EAAE,cA+CrC,CAAC"}

package/dist/resolution/bridges/swift-objc.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Swift ↔ ObjC Bridge
+ *
+ * Synthesizes edges between Swift functions with @objc attributes and
+ * Objective-C message sends that match the mangled selector.
+ *
+ * Name mangling rules:
+ *   - func foo(bar: Int) → -fooWithBar:
+ *   - init(name:) → -initWithName:
+ *   - var x → -x / -setX:
+ */
+import type { BridgeResolver } from './index';
+export declare const swiftObjcBridge: BridgeResolver;
+//# sourceMappingURL=swift-objc.d.ts.map

package/dist/resolution/bridges/swift-objc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"swift-objc.d.ts","sourceRoot":"","sources":["../../../src/resolution/bridges/swift-objc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,SAAS,CAAC;AA0F/D,eAAO,MAAM,eAAe,EAAE,cAoL7B,CAAC"}

package/dist/resolution/bridges/turbomodules.d.ts

@@ -0,0 +1,10 @@
+/**
+ * React Native TurboModules Bridge
+ *
+ * Synthesizes edges between TypeScript TurboModule spec interfaces and their
+ * native implementations. TurboModules use codegen specs (Native*.ts files)
+ * as the source of truth for the JS ↔ Native contract.
+ */
+import type { BridgeResolver } from './index';
+export declare const turboModulesBridge: BridgeResolver;
+//# sourceMappingURL=turbomodules.d.ts.map

package/dist/resolution/bridges/turbomodules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turbomodules.d.ts","sourceRoot":"","sources":["../../../src/resolution/bridges/turbomodules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,SAAS,CAAC;AA6J/D,eAAO,MAAM,kBAAkB,EAAE,cA8EhC,CAAC"}

package/dist/resolution/index.d.ts

@@ -6,22 +6,26 @@
  */
 import type { GraphDatabase } from '../db/database';
 import type { KiroGraphConfig } from '../config';
+import { type BridgeResolutionResult } from './bridges';
 export interface ResolutionResult {
     resolved: number;
     unresolved: number;
     total: number;
     durationMs: number;
+    bridgeResult?: BridgeResolutionResult;
 }
 export declare class ReferenceResolver {
     private db;
     private config;
+    private projectRoot;
     private nameCache;
     private qualifiedNameCache;
     private kindCache;
     private lowerNameCache;
     private nodeByIdCache;
+    private namespacePrefixCache;
     private cacheWarmed;
-    constructor(db: GraphDatabase, config: KiroGraphConfig);
+    constructor(db: GraphDatabase, config: KiroGraphConfig, projectRoot?: string);
     /**
      * Pre-load all nodes into Maps for O(1) lookup.
      * Must be called before resolveUnresolvedRefs() for best performance.
@@ -44,13 +48,34 @@ export declare class ReferenceResolver {
      */
     invalidateFile(filePath: string): void;
     /**
-     * Resolve a relative import path to the ID of the first node in the target file.
-     * Returns null if no indexed file matches.
+     * Resolve an import path to a node ID.
+     *
+     * Handles three cases:
+     *  1. Relative paths (JS/TS/Go/…) — resolved via the file tree.
+     *  2. Fully-qualified type imports (Java `import com.example.Foo`) — exact qualifiedName lookup,
+     *     then name+namespace-prefix match.
+     *  3. Namespace-level imports (C# `using MyApp.Services`) — namespace node lookup, then
+     *     namespace prefix cache (O(1)) to find any class in that namespace.
      */
     private _resolveImportPath;
+    /**
+     * Resolve a bare type name to a node ID.
+     * Used for extends/implements refs where we have only the unqualified type name.
+     * Prefers class/interface/trait/protocol nodes over other kinds.
+     */
+    private _resolveTypeName;
     /**
      * Convert a raw DB row to a Node object.
      */
     private _rowToNode;
+    /**
+     * Run cross-language bridge resolvers to synthesize edges between
+     * symbols in different languages (Swift ↔ ObjC, JS ↔ Native, etc.).
+     */
+    private _runBridgeResolvers;
+    /**
+     * Build a ResolutionContext for bridge resolvers using the warm caches.
+     */
+    private _buildBridgeContext;
 }
 //# sourceMappingURL=index.d.ts.map

package/dist/resolution/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resolution/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMjD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,EAAE,CAAgB;IAC1B,OAAO,CAAC,MAAM,CAAkB;IAGhC,OAAO,CAAC,SAAS,CAAkC;IACnD,OAAO,CAAC,kBAAkB,CAAgC;IAC1D,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,aAAa,CAAgC;IAErD,OAAO,CAAC,WAAW,CAAS;gBAEhB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe;IAKtD;;;OAGG;IACH,UAAU,IAAI,IAAI;IA2ClB;;;;OAIG;IACG,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAsBlG;;;OAGG;IACG,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAkHnG;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IA6DtC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAgC1B;;OAEG;IACH,OAAO,CAAC,UAAU;CAwBnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resolution/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGjD,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAI5E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,sBAAsB,CAAC;CACvC;AAID,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,EAAE,CAAgB;IAC1B,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,WAAW,CAAS;IAG5B,OAAO,CAAC,SAAS,CAAkC;IACnD,OAAO,CAAC,kBAAkB,CAAgC;IAC1D,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,aAAa,CAAgC;IAErD,OAAO,CAAC,oBAAoB,CAAkC;IAE9D,OAAO,CAAC,WAAW,CAAS;gBAEhB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,EAAE,MAAM;IAM5E;;;OAGG;IACH,UAAU,IAAI,IAAI;IA2DlB;;;;OAIG;IACG,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6BlG;;;OAGG;IACG,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IA+InG;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IA6DtC;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA0D1B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAcxB;;OAEG;IACH,OAAO,CAAC,UAAU;IA2BlB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAK3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;CAyC5B"}

package/dist/security/attack-surface.d.ts

@@ -0,0 +1,46 @@
+/**
+ * KiroGraph-Sec Attack Surface Analyzer
+ *
+ * Maps all route nodes in the knowledge graph to their reachable vulnerable
+ * dependencies, computing exposure levels and risk scores per route.
+ */
+import type { GraphDatabase } from '../db/database';
+export interface AttackSurfaceEntry {
+    route: string;
+    nodeId: string;
+    filePath: string;
+    isAuthenticated: boolean;
+    exposureLevel: 'public' | 'authenticated' | 'internal' | 'unknown';
+    vulnerableDeps: Array<{
+        cveId: string;
+        packageName: string;
+        severity: number | null;
+        epssScore: number | null;
+        riskScore: number | null;
+        verdict: string | null;
+        hopCount: number;
+    }>;
+    patternMatches: Array<{
+        patternId: string;
+        severity: string;
+        line: number;
+        symbolNodeId: string;
+        symbolName: string;
+    }>;
+    patternRiskLevel: 'none' | 'low' | 'medium' | 'high' | 'critical';
+    riskScore: number;
+}
+export interface AttackSurfaceResult {
+    totalRoutes: number;
+    publicRoutes: number;
+    authenticatedRoutes: number;
+    routesWithVulns: number;
+    criticalPaths: AttackSurfaceEntry[];
+    allRoutes: AttackSurfaceEntry[];
+}
+export declare class AttackSurfaceAnalyzer {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    analyze(): Promise<AttackSurfaceResult>;
+}
+//# sourceMappingURL=attack-surface.d.ts.map

package/dist/security/attack-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attack-surface.d.ts","sourceRoot":"","sources":["../../src/security/attack-surface.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAsBpD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,QAAQ,GAAG,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;IACnE,cAAc,EAAE,KAAK,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,cAAc,EAAE,KAAK,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,gBAAgB,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,OAAO,IAAI,OAAO,CAAC,mBAAmB,CAAC;CAgN9C"}

package/dist/security/attack-surface.js

@@ -95,6 +95,38 @@ class AttackSurfaceAnalyzer {
           });
         }
       }
+      const routeNodeId = route.id;
+      let patternRows = [];
+      try {
+        patternRows = rawDb.all(
+          `WITH RECURSIVE reachable(node_id, depth) AS (
+             SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')
+             UNION
+             SELECT e.target, r.depth + 1
+             FROM edges e
+             JOIN reachable r ON e.source = r.node_id
+             WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')
+           )
+           SELECT DISTINCT pm.symbol_node_id, n.name as symbol_name, pm.pattern_id, pm.severity, pm.line
+           FROM reachable r
+           JOIN pattern_matches pm ON pm.symbol_node_id = r.node_id
+           JOIN nodes n ON n.id = pm.symbol_node_id
+           WHERE pm.symbol_node_id IS NOT NULL
+           ORDER BY CASE pm.severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END DESC
+           LIMIT 10`,
+          [routeNodeId]
+        );
+      } catch {
+        patternRows = [];
+      }
+      const patternMatches = patternRows.map((r) => ({
+        patternId: r.pattern_id,
+        severity: r.severity,
+        line: r.line,
+        symbolNodeId: r.symbol_node_id,
+        symbolName: r.symbol_name
+      }));
+      const patternRiskLevel = patternMatches.length === 0 ? "none" : patternMatches[0].severity;
       const pathNodeNames = rawDb.all(
         `WITH RECURSIVE reachable(node_id, depth) AS (
            SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')
@@ -126,10 +158,18 @@ class AttackSurfaceAnalyzer {
         exposureLevel = "unknown";
       }
       const affectedVulns = vulnerableDeps.filter((v) => v.verdict === "affected" || v.verdict === "under_investigation");
-      const riskScore = affectedVulns.reduce((max, v) => {
+      const baseRiskScore = affectedVulns.reduce((max, v) => {
         if (v.riskScore != null && v.riskScore > max) return v.riskScore;
         return max;
       }, 0);
+      const patternBonus = {
+        none: 0,
+        low: 0.3,
+        medium: 0.6,
+        high: 0.8,
+        critical: 1
+      };
+      const riskScore = Math.min(10, baseRiskScore + (patternBonus[patternRiskLevel] ?? 0));
       entries.push({
         route: route.name ?? route.id,
         nodeId: route.id,
@@ -137,6 +177,8 @@ class AttackSurfaceAnalyzer {
         isAuthenticated,
         exposureLevel,
         vulnerableDeps,
+        patternMatches,
+        patternRiskLevel,
         riskScore
       });
     }

package/dist/security/attack-surface.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/security/attack-surface.ts"],
-  "sourcesContent": ["/**\n * KiroGraph-Sec Attack Surface Analyzer\n *\n * Maps all route nodes in the knowledge graph to their reachable vulnerable\n * dependencies, computing exposure levels and risk scores per route.\n */\n\nimport type { GraphDatabase } from '../db/database';\n\n/** Auth-related name patterns for heuristic isAuthenticated detection. */\nconst AUTH_PATTERNS = [\n  'auth',\n  'authenticate',\n  'middleware',\n  'guard',\n  'protect',\n  'requirelogin',\n  'isloggedin',\n  'verifytoken',\n  'checkauth',\n  'ensureauth',\n] as const;\n\n/** Route path patterns that indicate a public-facing API. */\nconst PUBLIC_ROUTE_PATTERNS = ['/api/', '/v1/', '/v2/', '/v3/', '/graphql', '/rest/'];\n\n/** Route path patterns that indicate an internal/admin route. */\nconst INTERNAL_ROUTE_PATTERNS = ['/internal/', '/admin/'];\n\nexport interface AttackSurfaceEntry {\n  route: string;\n  nodeId: string;\n  filePath: string;\n  isAuthenticated: boolean;\n  exposureLevel: 'public' | 'authenticated' | 'internal' | 'unknown';\n  vulnerableDeps: Array<{\n    cveId: string;\n    packageName: string;\n    severity: number | null;\n    epssScore: number | null;\n    riskScore: number | null;\n    verdict: string | null;\n    hopCount: number;\n  }>;\n  riskScore: number;\n}\n\nexport interface AttackSurfaceResult {\n  totalRoutes: number;\n  publicRoutes: number;\n  authenticatedRoutes: number;\n  routesWithVulns: number;\n  criticalPaths: AttackSurfaceEntry[];\n  allRoutes: AttackSurfaceEntry[];\n}\n\nexport class AttackSurfaceAnalyzer {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async analyze(): Promise<AttackSurfaceResult> {\n    const rawDb = this.db.getRawDb();\n\n    // Step 1: Query all route nodes\n    const routeRows: Array<{ id: string; name: string; file_path: string }> = rawDb.all(\n      `SELECT id, name, file_path FROM nodes WHERE kind = 'route'`,\n    );\n\n    if (routeRows.length === 0) {\n      return {\n        totalRoutes: 0,\n        publicRoutes: 0,\n        authenticatedRoutes: 0,\n        routesWithVulns: 0,\n        criticalPaths: [],\n        allRoutes: [],\n      };\n    }\n\n    const entries: AttackSurfaceEntry[] = [];\n\n    for (const route of routeRows) {\n      // Step 2: BFS via SQL to find reachable dependency nodes (max 5 hops)\n      const reachableDeps: Array<{\n        node_id: string;\n        package_name: string;\n        hop_count: number;\n      }> = rawDb.all(\n        `WITH RECURSIVE reachable(node_id, depth) AS (\n           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n           UNION\n           SELECT e.target, r.depth + 1\n           FROM edges e\n           JOIN reachable r ON e.source = r.node_id\n           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n         )\n         SELECT d.node_id, d.package_name, MIN(r.depth) as hop_count\n         FROM reachable r\n         JOIN sec_dependencies d ON d.node_id = r.node_id\n         GROUP BY d.node_id, d.package_name`,\n        [route.id],\n      );\n\n      // Step 3: For each reachable dep, find affected/under_investigation vulns\n      const vulnerableDeps: AttackSurfaceEntry['vulnerableDeps'] = [];\n\n      for (const dep of reachableDeps) {\n        const vulnRows: Array<{\n          cve_id: string;\n          package_name: string;\n          severity_score: number | null;\n          epss_score: number | null;\n          risk_score: number | null;\n          verdict: string | null;\n        }> = rawDb.all(\n          `SELECT v.cve_id, d.package_name, v.severity_score, v.epss_score, v.risk_score, r.verdict\n           FROM sec_vulnerabilities v\n           JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n           JOIN sec_dependencies d ON d.node_id = e.source\n           LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n           WHERE d.node_id = ?\n             AND (r.verdict IN ('affected', 'under_investigation') OR r.verdict IS NULL)`,\n          [dep.node_id],\n        );\n\n        for (const vuln of vulnRows) {\n          vulnerableDeps.push({\n            cveId: vuln.cve_id,\n            packageName: vuln.package_name ?? dep.package_name,\n            severity: vuln.severity_score,\n            epssScore: vuln.epss_score,\n            riskScore: vuln.risk_score,\n            verdict: vuln.verdict,\n            hopCount: dep.hop_count,\n          });\n        }\n      }\n\n      // Step 4: Heuristic \u2014 isAuthenticated via path node names\n      const pathNodeNames: Array<{ name: string }> = rawDb.all(\n        `WITH RECURSIVE reachable(node_id, depth) AS (\n           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n           UNION\n           SELECT e.target, r.depth + 1\n           FROM edges e\n           JOIN reachable r ON e.source = r.node_id\n           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n         )\n         SELECT DISTINCT n.name\n         FROM reachable r\n         JOIN nodes n ON n.id = r.node_id\n         WHERE n.name IS NOT NULL`,\n        [route.id],\n      );\n\n      const isAuthenticated = pathNodeNames.some(row => {\n        const lowerName = (row.name ?? '').toLowerCase();\n        return AUTH_PATTERNS.some(pattern => lowerName.includes(pattern));\n      });\n\n      // Step 5: Determine exposure level\n      const routeName = (route.name ?? '').toLowerCase();\n      let exposureLevel: AttackSurfaceEntry['exposureLevel'];\n\n      if (INTERNAL_ROUTE_PATTERNS.some(p => routeName.includes(p))) {\n        exposureLevel = 'internal';\n      } else if (isAuthenticated) {\n        exposureLevel = 'authenticated';\n      } else if (PUBLIC_ROUTE_PATTERNS.some(p => routeName.includes(p))) {\n        exposureLevel = 'public';\n      } else {\n        exposureLevel = 'unknown';\n      }\n\n      // Step 6: riskScore = max risk_score of reachable affected vulns\n      const affectedVulns = vulnerableDeps.filter(v => v.verdict === 'affected' || v.verdict === 'under_investigation');\n      const riskScore = affectedVulns.reduce((max, v) => {\n        if (v.riskScore != null && v.riskScore > max) return v.riskScore;\n        return max;\n      }, 0);\n\n      entries.push({\n        route: route.name ?? route.id,\n        nodeId: route.id,\n        filePath: route.file_path ?? '',\n        isAuthenticated,\n        exposureLevel,\n        vulnerableDeps,\n        riskScore,\n      });\n    }\n\n    // Compute summary stats\n    const publicRoutes = entries.filter(e => e.exposureLevel === 'public').length;\n    const authenticatedRoutes = entries.filter(\n      e => e.exposureLevel === 'authenticated' || e.exposureLevel === 'internal',\n    ).length;\n    const routesWithVulns = entries.filter(e => e.vulnerableDeps.length > 0).length;\n\n    // Critical paths: routes with affected/under_investigation vulns, sorted by riskScore desc\n    const criticalPaths = entries\n      .filter(e => e.vulnerableDeps.length > 0)\n      .sort((a, b) => b.riskScore - a.riskScore);\n\n    const allRoutes = entries.sort((a, b) => b.riskScore - a.riskScore);\n\n    return {\n      totalRoutes: entries.length,\n      publicRoutes,\n      authenticatedRoutes,\n      routesWithVulns,\n      criticalPaths,\n      allRoutes,\n    };\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,MAAM,wBAAwB,CAAC,SAAS,QAAQ,QAAQ,QAAQ,YAAY,QAAQ;AAGpF,MAAM,0BAA0B,CAAC,cAAc,SAAS;AA6BjD,MAAM,sBAAsB;AAAA,EACjC,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,UAAwC;AAC5C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAG/B,UAAM,YAAoE,MAAM;AAAA,MAC9E;AAAA,IACF;AAEA,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO;AAAA,QACL,aAAa;AAAA,QACb,cAAc;AAAA,QACd,qBAAqB;AAAA,QACrB,iBAAiB;AAAA,QACjB,eAAe,CAAC;AAAA,QAChB,WAAW,CAAC;AAAA,MACd;AAAA,IACF;AAEA,UAAM,UAAgC,CAAC;AAEvC,eAAW,SAAS,WAAW;AAE7B,YAAM,gBAID,MAAM;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,MAAM,EAAE;AAAA,MACX;AAGA,YAAM,iBAAuD,CAAC;AAE9D,iBAAW,OAAO,eAAe;AAC/B,cAAM,WAOD,MAAM;AAAA,UACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOA,CAAC,IAAI,OAAO;AAAA,QACd;AAEA,mBAAW,QAAQ,UAAU;AAC3B,yBAAe,KAAK;AAAA,YAClB,OAAO,KAAK;AAAA,YACZ,aAAa,KAAK,gBAAgB,IAAI;AAAA,YACtC,UAAU,KAAK;AAAA,YACf,WAAW,KAAK;AAAA,YAChB,WAAW,KAAK;AAAA,YAChB,SAAS,KAAK;AAAA,YACd,UAAU,IAAI;AAAA,UAChB,CAAC;AAAA,QACH;AAAA,MACF;AAGA,YAAM,gBAAyC,MAAM;AAAA,QACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,MAAM,EAAE;AAAA,MACX;AAEA,YAAM,kBAAkB,cAAc,KAAK,SAAO;AAChD,cAAM,aAAa,IAAI,QAAQ,IAAI,YAAY;AAC/C,eAAO,cAAc,KAAK,aAAW,UAAU,SAAS,OAAO,CAAC;AAAA,MAClE,CAAC;AAGD,YAAM,aAAa,MAAM,QAAQ,IAAI,YAAY;AACjD,UAAI;AAEJ,UAAI,wBAAwB,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5D,wBAAgB;AAAA,MAClB,WAAW,iBAAiB;AAC1B,wBAAgB;AAAA,MAClB,WAAW,sBAAsB,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AACjE,wBAAgB;AAAA,MAClB,OAAO;AACL,wBAAgB;AAAA,MAClB;AAGA,YAAM,gBAAgB,eAAe,OAAO,OAAK,EAAE,YAAY,cAAc,EAAE,YAAY,qBAAqB;AAChH,YAAM,YAAY,cAAc,OAAO,CAAC,KAAK,MAAM;AACjD,YAAI,EAAE,aAAa,QAAQ,EAAE,YAAY,IAAK,QAAO,EAAE;AACvD,eAAO;AAAA,MACT,GAAG,CAAC;AAEJ,cAAQ,KAAK;AAAA,QACX,OAAO,MAAM,QAAQ,MAAM;AAAA,QAC3B,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM,aAAa;AAAA,QAC7B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAGA,UAAM,eAAe,QAAQ,OAAO,OAAK,EAAE,kBAAkB,QAAQ,EAAE;AACvE,UAAM,sBAAsB,QAAQ;AAAA,MAClC,OAAK,EAAE,kBAAkB,mBAAmB,EAAE,kBAAkB;AAAA,IAClE,EAAE;AACF,UAAM,kBAAkB,QAAQ,OAAO,OAAK,EAAE,eAAe,SAAS,CAAC,EAAE;AAGzE,UAAM,gBAAgB,QACnB,OAAO,OAAK,EAAE,eAAe,SAAS,CAAC,EACvC,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;AAE3C,UAAM,YAAY,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;AAElE,WAAO;AAAA,MACL,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * KiroGraph-Sec Attack Surface Analyzer\n *\n * Maps all route nodes in the knowledge graph to their reachable vulnerable\n * dependencies, computing exposure levels and risk scores per route.\n */\n\nimport type { GraphDatabase } from '../db/database';\n\n/** Auth-related name patterns for heuristic isAuthenticated detection. */\nconst AUTH_PATTERNS = [\n  'auth',\n  'authenticate',\n  'middleware',\n  'guard',\n  'protect',\n  'requirelogin',\n  'isloggedin',\n  'verifytoken',\n  'checkauth',\n  'ensureauth',\n] as const;\n\n/** Route path patterns that indicate a public-facing API. */\nconst PUBLIC_ROUTE_PATTERNS = ['/api/', '/v1/', '/v2/', '/v3/', '/graphql', '/rest/'];\n\n/** Route path patterns that indicate an internal/admin route. */\nconst INTERNAL_ROUTE_PATTERNS = ['/internal/', '/admin/'];\n\nexport interface AttackSurfaceEntry {\n  route: string;\n  nodeId: string;\n  filePath: string;\n  isAuthenticated: boolean;\n  exposureLevel: 'public' | 'authenticated' | 'internal' | 'unknown';\n  vulnerableDeps: Array<{\n    cveId: string;\n    packageName: string;\n    severity: number | null;\n    epssScore: number | null;\n    riskScore: number | null;\n    verdict: string | null;\n    hopCount: number;\n  }>;\n  patternMatches: Array<{\n    patternId: string;\n    severity: string;\n    line: number;\n    symbolNodeId: string;\n    symbolName: string;\n  }>;\n  patternRiskLevel: 'none' | 'low' | 'medium' | 'high' | 'critical';\n  riskScore: number;\n}\n\nexport interface AttackSurfaceResult {\n  totalRoutes: number;\n  publicRoutes: number;\n  authenticatedRoutes: number;\n  routesWithVulns: number;\n  criticalPaths: AttackSurfaceEntry[];\n  allRoutes: AttackSurfaceEntry[];\n}\n\nexport class AttackSurfaceAnalyzer {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async analyze(): Promise<AttackSurfaceResult> {\n    const rawDb = this.db.getRawDb();\n\n    // Step 1: Query all route nodes\n    const routeRows: Array<{ id: string; name: string; file_path: string }> = rawDb.all(\n      `SELECT id, name, file_path FROM nodes WHERE kind = 'route'`,\n    );\n\n    if (routeRows.length === 0) {\n      return {\n        totalRoutes: 0,\n        publicRoutes: 0,\n        authenticatedRoutes: 0,\n        routesWithVulns: 0,\n        criticalPaths: [],\n        allRoutes: [],\n      };\n    }\n\n    const entries: AttackSurfaceEntry[] = [];\n\n    for (const route of routeRows) {\n      // Step 2: BFS via SQL to find reachable dependency nodes (max 5 hops)\n      const reachableDeps: Array<{\n        node_id: string;\n        package_name: string;\n        hop_count: number;\n      }> = rawDb.all(\n        `WITH RECURSIVE reachable(node_id, depth) AS (\n           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n           UNION\n           SELECT e.target, r.depth + 1\n           FROM edges e\n           JOIN reachable r ON e.source = r.node_id\n           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n         )\n         SELECT d.node_id, d.package_name, MIN(r.depth) as hop_count\n         FROM reachable r\n         JOIN sec_dependencies d ON d.node_id = r.node_id\n         GROUP BY d.node_id, d.package_name`,\n        [route.id],\n      );\n\n      // Step 3: For each reachable dep, find affected/under_investigation vulns\n      const vulnerableDeps: AttackSurfaceEntry['vulnerableDeps'] = [];\n\n      for (const dep of reachableDeps) {\n        const vulnRows: Array<{\n          cve_id: string;\n          package_name: string;\n          severity_score: number | null;\n          epss_score: number | null;\n          risk_score: number | null;\n          verdict: string | null;\n        }> = rawDb.all(\n          `SELECT v.cve_id, d.package_name, v.severity_score, v.epss_score, v.risk_score, r.verdict\n           FROM sec_vulnerabilities v\n           JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n           JOIN sec_dependencies d ON d.node_id = e.source\n           LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n           WHERE d.node_id = ?\n             AND (r.verdict IN ('affected', 'under_investigation') OR r.verdict IS NULL)`,\n          [dep.node_id],\n        );\n\n        for (const vuln of vulnRows) {\n          vulnerableDeps.push({\n            cveId: vuln.cve_id,\n            packageName: vuln.package_name ?? dep.package_name,\n            severity: vuln.severity_score,\n            epssScore: vuln.epss_score,\n            riskScore: vuln.risk_score,\n            verdict: vuln.verdict,\n            hopCount: dep.hop_count,\n          });\n        }\n      }\n\n      // Step 3b: Find pattern matches on the call path (table may not exist)\n      const routeNodeId = route.id;\n      let patternRows: Array<{\n        symbol_node_id: string;\n        symbol_name: string;\n        pattern_id: string;\n        severity: string;\n        line: number;\n      }> = [];\n      try {\n        patternRows = rawDb.all(\n          `WITH RECURSIVE reachable(node_id, depth) AS (\n             SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n             UNION\n             SELECT e.target, r.depth + 1\n             FROM edges e\n             JOIN reachable r ON e.source = r.node_id\n             WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n           )\n           SELECT DISTINCT pm.symbol_node_id, n.name as symbol_name, pm.pattern_id, pm.severity, pm.line\n           FROM reachable r\n           JOIN pattern_matches pm ON pm.symbol_node_id = r.node_id\n           JOIN nodes n ON n.id = pm.symbol_node_id\n           WHERE pm.symbol_node_id IS NOT NULL\n           ORDER BY CASE pm.severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END DESC\n           LIMIT 10`,\n          [routeNodeId],\n        );\n      } catch {\n        // pattern_matches table does not exist yet \u2014 degrade silently\n        patternRows = [];\n      }\n\n      const patternMatches: AttackSurfaceEntry['patternMatches'] = patternRows.map(r => ({\n        patternId: r.pattern_id,\n        severity: r.severity,\n        line: r.line,\n        symbolNodeId: r.symbol_node_id,\n        symbolName: r.symbol_name,\n      }));\n\n      const patternRiskLevel: AttackSurfaceEntry['patternRiskLevel'] =\n        patternMatches.length === 0\n          ? 'none'\n          : (patternMatches[0].severity as AttackSurfaceEntry['patternRiskLevel']);\n\n      // Step 4: Heuristic \u2014 isAuthenticated via path node names\n      const pathNodeNames: Array<{ name: string }> = rawDb.all(\n        `WITH RECURSIVE reachable(node_id, depth) AS (\n           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n           UNION\n           SELECT e.target, r.depth + 1\n           FROM edges e\n           JOIN reachable r ON e.source = r.node_id\n           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n         )\n         SELECT DISTINCT n.name\n         FROM reachable r\n         JOIN nodes n ON n.id = r.node_id\n         WHERE n.name IS NOT NULL`,\n        [route.id],\n      );\n\n      const isAuthenticated = pathNodeNames.some(row => {\n        const lowerName = (row.name ?? '').toLowerCase();\n        return AUTH_PATTERNS.some(pattern => lowerName.includes(pattern));\n      });\n\n      // Step 5: Determine exposure level\n      const routeName = (route.name ?? '').toLowerCase();\n      let exposureLevel: AttackSurfaceEntry['exposureLevel'];\n\n      if (INTERNAL_ROUTE_PATTERNS.some(p => routeName.includes(p))) {\n        exposureLevel = 'internal';\n      } else if (isAuthenticated) {\n        exposureLevel = 'authenticated';\n      } else if (PUBLIC_ROUTE_PATTERNS.some(p => routeName.includes(p))) {\n        exposureLevel = 'public';\n      } else {\n        exposureLevel = 'unknown';\n      }\n\n      // Step 6: riskScore = max risk_score of reachable affected vulns, plus pattern bonus\n      const affectedVulns = vulnerableDeps.filter(v => v.verdict === 'affected' || v.verdict === 'under_investigation');\n      const baseRiskScore = affectedVulns.reduce((max, v) => {\n        if (v.riskScore != null && v.riskScore > max) return v.riskScore;\n        return max;\n      }, 0);\n\n      const patternBonus: Record<AttackSurfaceEntry['patternRiskLevel'], number> = {\n        none: 0, low: 0.3, medium: 0.6, high: 0.8, critical: 1.0,\n      };\n      const riskScore = Math.min(10, baseRiskScore + (patternBonus[patternRiskLevel] ?? 0));\n\n      entries.push({\n        route: route.name ?? route.id,\n        nodeId: route.id,\n        filePath: route.file_path ?? '',\n        isAuthenticated,\n        exposureLevel,\n        vulnerableDeps,\n        patternMatches,\n        patternRiskLevel,\n        riskScore,\n      });\n    }\n\n    // Compute summary stats\n    const publicRoutes = entries.filter(e => e.exposureLevel === 'public').length;\n    const authenticatedRoutes = entries.filter(\n      e => e.exposureLevel === 'authenticated' || e.exposureLevel === 'internal',\n    ).length;\n    const routesWithVulns = entries.filter(e => e.vulnerableDeps.length > 0).length;\n\n    // Critical paths: routes with affected/under_investigation vulns, sorted by riskScore desc\n    const criticalPaths = entries\n      .filter(e => e.vulnerableDeps.length > 0)\n      .sort((a, b) => b.riskScore - a.riskScore);\n\n    const allRoutes = entries.sort((a, b) => b.riskScore - a.riskScore);\n\n    return {\n      totalRoutes: entries.length,\n      publicRoutes,\n      authenticatedRoutes,\n      routesWithVulns,\n      criticalPaths,\n      allRoutes,\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,MAAM,wBAAwB,CAAC,SAAS,QAAQ,QAAQ,QAAQ,YAAY,QAAQ;AAGpF,MAAM,0BAA0B,CAAC,cAAc,SAAS;AAqCjD,MAAM,sBAAsB;AAAA,EACjC,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,UAAwC;AAC5C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAG/B,UAAM,YAAoE,MAAM;AAAA,MAC9E;AAAA,IACF;AAEA,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO;AAAA,QACL,aAAa;AAAA,QACb,cAAc;AAAA,QACd,qBAAqB;AAAA,QACrB,iBAAiB;AAAA,QACjB,eAAe,CAAC;AAAA,QAChB,WAAW,CAAC;AAAA,MACd;AAAA,IACF;AAEA,UAAM,UAAgC,CAAC;AAEvC,eAAW,SAAS,WAAW;AAE7B,YAAM,gBAID,MAAM;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,MAAM,EAAE;AAAA,MACX;AAGA,YAAM,iBAAuD,CAAC;AAE9D,iBAAW,OAAO,eAAe;AAC/B,cAAM,WAOD,MAAM;AAAA,UACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOA,CAAC,IAAI,OAAO;AAAA,QACd;AAEA,mBAAW,QAAQ,UAAU;AAC3B,yBAAe,KAAK;AAAA,YAClB,OAAO,KAAK;AAAA,YACZ,aAAa,KAAK,gBAAgB,IAAI;AAAA,YACtC,UAAU,KAAK;AAAA,YACf,WAAW,KAAK;AAAA,YAChB,WAAW,KAAK;AAAA,YAChB,SAAS,KAAK;AAAA,YACd,UAAU,IAAI;AAAA,UAChB,CAAC;AAAA,QACH;AAAA,MACF;AAGA,YAAM,cAAc,MAAM;AAC1B,UAAI,cAMC,CAAC;AACN,UAAI;AACF,sBAAc,MAAM;AAAA,UAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAeA,CAAC,WAAW;AAAA,QACd;AAAA,MACF,QAAQ;AAEN,sBAAc,CAAC;AAAA,MACjB;AAEA,YAAM,iBAAuD,YAAY,IAAI,QAAM;AAAA,QACjF,WAAW,EAAE;AAAA,QACb,UAAU,EAAE;AAAA,QACZ,MAAM,EAAE;AAAA,QACR,cAAc,EAAE;AAAA,QAChB,YAAY,EAAE;AAAA,MAChB,EAAE;AAEF,YAAM,mBACJ,eAAe,WAAW,IACtB,SACC,eAAe,CAAC,EAAE;AAGzB,YAAM,gBAAyC,MAAM;AAAA,QACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,MAAM,EAAE;AAAA,MACX;AAEA,YAAM,kBAAkB,cAAc,KAAK,SAAO;AAChD,cAAM,aAAa,IAAI,QAAQ,IAAI,YAAY;AAC/C,eAAO,cAAc,KAAK,aAAW,UAAU,SAAS,OAAO,CAAC;AAAA,MAClE,CAAC;AAGD,YAAM,aAAa,MAAM,QAAQ,IAAI,YAAY;AACjD,UAAI;AAEJ,UAAI,wBAAwB,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5D,wBAAgB;AAAA,MAClB,WAAW,iBAAiB;AAC1B,wBAAgB;AAAA,MAClB,WAAW,sBAAsB,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AACjE,wBAAgB;AAAA,MAClB,OAAO;AACL,wBAAgB;AAAA,MAClB;AAGA,YAAM,gBAAgB,eAAe,OAAO,OAAK,EAAE,YAAY,cAAc,EAAE,YAAY,qBAAqB;AAChH,YAAM,gBAAgB,cAAc,OAAO,CAAC,KAAK,MAAM;AACrD,YAAI,EAAE,aAAa,QAAQ,EAAE,YAAY,IAAK,QAAO,EAAE;AACvD,eAAO;AAAA,MACT,GAAG,CAAC;AAEJ,YAAM,eAAuE;AAAA,QAC3E,MAAM;AAAA,QAAG,KAAK;AAAA,QAAK,QAAQ;AAAA,QAAK,MAAM;AAAA,QAAK,UAAU;AAAA,MACvD;AACA,YAAM,YAAY,KAAK,IAAI,IAAI,iBAAiB,aAAa,gBAAgB,KAAK,EAAE;AAEpF,cAAQ,KAAK;AAAA,QACX,OAAO,MAAM,QAAQ,MAAM;AAAA,QAC3B,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM,aAAa;AAAA,QAC7B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAGA,UAAM,eAAe,QAAQ,OAAO,OAAK,EAAE,kBAAkB,QAAQ,EAAE;AACvE,UAAM,sBAAsB,QAAQ;AAAA,MAClC,OAAK,EAAE,kBAAkB,mBAAmB,EAAE,kBAAkB;AAAA,IAClE,EAAE;AACF,UAAM,kBAAkB,QAAQ,OAAO,OAAK,EAAE,eAAe,SAAS,CAAC,EAAE;AAGzE,UAAM,gBAAgB,QACnB,OAAO,OAAK,EAAE,eAAe,SAAS,CAAC,EACvC,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;AAE3C,UAAM,YAAY,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;AAElE,WAAO;AAAA,MACL,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/security/context-warnings.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Security Context Warnings
+ *
+ * Queries pre-computed reachability data to find vulnerabilities
+ * reachable from symbols included in a context response.
+ * Used by kirograph_context to append security warnings.
+ */
+export interface SecurityWarning {
+    cveId: string;
+    severityScore: number | null;
+    epssScore: number | null;
+    epssPercentile: number | null;
+    packageName: string;
+    ecosystem: string;
+    fixedVersion: string | null;
+    entryPoints: string[];
+}
+/**
+ * Query the pre-computed reachability data to find vulnerabilities
+ * reachable from the given node IDs.
+ *
+ * This is a lightweight query joining sec_reachability + sec_vulnerabilities + sec_dependencies
+ * where the reachability paths include any of the context nodes. No graph traversal needed
+ * since reachability is pre-computed by the SecurityPipeline.
+ *
+ * @param rawDb - The raw SQLite database handle
+ * @param nodeIds - Node IDs from the context response (entry points + related symbols)
+ * @returns Array of SecurityWarning objects for affected vulnerabilities
+ */
+export declare function getSecurityWarningsForNodes(rawDb: any, nodeIds: string[]): SecurityWarning[];
+/**
+ * Format security warnings into a text section for the context output.
+ * Shows max 3 vulnerabilities with a note about remaining ones.
+ *
+ * @param warnings - Array of SecurityWarning objects
+ * @param nodeNames - Map of node IDs to human-readable names (for entry point display)
+ * @returns Formatted string section, or empty string if no warnings
+ */
+export declare function formatSecurityWarnings(warnings: SecurityWarning[], nodeNames: Map<string, string>): string;
+//# sourceMappingURL=context-warnings.d.ts.map

package/dist/security/context-warnings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-warnings.d.ts","sourceRoot":"","sources":["../../src/security/context-warnings.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,CA6F5F;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAmC1G"}