kirograph 0.19.0 → 0.20.0

package/dist/security/data-flows.d.ts

@@ -0,0 +1,33 @@
+/**
+ * KiroGraph SAST-lite: Dangerous Data Flow Detection
+ *
+ * Detects dangerous patterns by analysing call edges in the graph database.
+ * Uses symbol names and callee chains rather than full AST traversal.
+ */
+import type { GraphDatabase } from '../db/database';
+import type { OwaspCategory } from './owasp';
+export interface DataFlowFinding {
+    type: 'sql-injection' | 'path-traversal' | 'xss' | 'dangerous-eval' | 'unsafe-deserialize' | 'hardcoded-crypto';
+    severity: 'critical' | 'high' | 'medium';
+    owaspCategory: OwaspCategory;
+    filePath: string;
+    line: number;
+    symbol: string;
+    description: string;
+    recommendation: string;
+}
+export declare class DataFlowAnalyzer {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    analyze(): Promise<DataFlowFinding[]>;
+    private analyzeFromPatternMatches;
+    private _patternIdToType;
+    private _findEnclosingSymbol;
+    private _getRecommendation;
+    private _detectDangerousEval;
+    private _detectUnsafeDeserialize;
+    private _detectHardcodedCrypto;
+    private _detectSqlInjection;
+    private _detectPathTraversal;
+}
+//# sourceMappingURL=data-flows.d.ts.map

package/dist/security/data-flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-flows.d.ts","sourceRoot":"","sources":["../../src/security/data-flows.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAI7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,eAAe,GAAG,gBAAgB,GAAG,KAAK,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;IAChH,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAyBD,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,OAAO,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAwB3C,OAAO,CAAC,yBAAyB;IA8BjC,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,oBAAoB;IAyB5B,OAAO,CAAC,wBAAwB;IA8BhC,OAAO,CAAC,sBAAsB;IA0C9B,OAAO,CAAC,mBAAmB;IAoE3B,OAAO,CAAC,oBAAoB;CA8C7B"}

package/dist/security/data-flows.js

@@ -21,19 +21,77 @@ __export(data_flows_exports, {
   DataFlowAnalyzer: () => DataFlowAnalyzer
 });
 module.exports = __toCommonJS(data_flows_exports);
+function hasPatternsData(rawDb) {
+  try {
+    const result = rawDb.get("SELECT COUNT(*) as cnt FROM pattern_matches");
+    return (result?.cnt ?? 0) > 0;
+  } catch {
+    return false;
+  }
+}
 class DataFlowAnalyzer {
   constructor(db) {
     this.db = db;
   }
   async analyze() {
     const rawDb = this.db.getRawDb();
-    const findings = [];
-    findings.push(...this._detectDangerousEval(rawDb));
-    findings.push(...this._detectUnsafeDeserialize(rawDb));
-    findings.push(...this._detectHardcodedCrypto(rawDb));
-    findings.push(...this._detectSqlInjection(rawDb));
-    findings.push(...this._detectPathTraversal(rawDb));
-    return findings;
+    const sqlFindings = [
+      ...this._detectDangerousEval(rawDb),
+      ...this._detectUnsafeDeserialize(rawDb),
+      ...this._detectHardcodedCrypto(rawDb),
+      ...this._detectSqlInjection(rawDb),
+      ...this._detectPathTraversal(rawDb)
+    ];
+    if (hasPatternsData(rawDb)) {
+      const astFindings = this.analyzeFromPatternMatches(rawDb);
+      const astKeys = new Set(astFindings.map((f) => `${f.filePath}:${f.line}`));
+      const filteredSql = sqlFindings.filter((f) => !astKeys.has(`${f.filePath}:${f.line}`));
+      return [...astFindings, ...filteredSql];
+    }
+    return sqlFindings;
+  }
+  analyzeFromPatternMatches(rawDb) {
+    const rows = rawDb.all("SELECT file_path, pattern_id, line, col, match_text, severity, owasp_category, language FROM pattern_matches");
+    return rows.map((row) => {
+      const type = this._patternIdToType(row.pattern_id);
+      const symbol = this._findEnclosingSymbol(rawDb, row.file_path, row.line);
+      return {
+        type,
+        severity: row.severity,
+        owaspCategory: row.owasp_category,
+        filePath: row.file_path,
+        line: row.line,
+        symbol: symbol ?? row.pattern_id,
+        description: `[AST pattern: ${row.pattern_id}] ${row.match_text.slice(0, 100)}`,
+        recommendation: this._getRecommendation(type)
+      };
+    });
+  }
+  _patternIdToType(patternId) {
+    if (patternId.startsWith("sql-injection")) return "sql-injection";
+    if (patternId.startsWith("dangerous-eval") || patternId.startsWith("dangerous-exec")) return "dangerous-eval";
+    if (patternId.startsWith("path-traversal")) return "path-traversal";
+    if (patternId.startsWith("prototype-pollution")) return "unsafe-deserialize";
+    if (patternId.startsWith("weak-crypto")) return "hardcoded-crypto";
+    return "dangerous-eval";
+  }
+  _findEnclosingSymbol(rawDb, filePath, line) {
+    const row = rawDb.get(
+      `SELECT name FROM nodes WHERE file_path = ? AND start_line <= ? AND end_line >= ? AND kind IN ('function', 'method', 'class') ORDER BY (end_line - start_line) ASC LIMIT 1`,
+      [filePath, line, line]
+    );
+    return row?.name ?? null;
+  }
+  _getRecommendation(type) {
+    const recs = {
+      "sql-injection": "Use parameterized queries. Never concatenate user input into SQL strings.",
+      "dangerous-eval": "Remove eval()/exec(). Use structured alternatives.",
+      "path-traversal": "Use path.resolve() and verify result is within an allowed base directory.",
+      "unsafe-deserialize": "Validate object keys before merge. Avoid untrusted deserialization.",
+      "hardcoded-crypto": "Use SHA-256+ for hashing. Use bcrypt/argon2 for passwords.",
+      "xss": "Sanitize output. Use a trusted template engine with auto-escaping."
+    };
+    return recs[type] ?? "Review and fix this security issue.";
   }
   // ── Detection: dangerous eval / exec ────────────────────────────────────────
   _detectDangerousEval(rawDb) {

package/dist/security/data-flows.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/security/data-flows.ts"],
-  "sourcesContent": ["/**\n * KiroGraph SAST-lite: Dangerous Data Flow Detection\n *\n * Detects dangerous patterns by analysing call edges in the graph database.\n * Uses symbol names and callee chains rather than full AST traversal.\n */\n\nimport type { GraphDatabase } from '../db/database';\nimport type { OwaspCategory } from './owasp';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface DataFlowFinding {\n  type: 'sql-injection' | 'path-traversal' | 'xss' | 'dangerous-eval' | 'unsafe-deserialize' | 'hardcoded-crypto';\n  severity: 'critical' | 'high' | 'medium';\n  owaspCategory: OwaspCategory;\n  filePath: string;\n  line: number;\n  symbol: string;\n  description: string;\n  recommendation: string;\n}\n\n// \u2500\u2500 Internal row type returned by the DB queries \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface CallEdgeRow {\n  caller: string;\n  file_path: string;\n  start_line: number;\n  callee: string;\n}\n\n// \u2500\u2500 DataFlowAnalyzer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class DataFlowAnalyzer {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async analyze(): Promise<DataFlowFinding[]> {\n    const rawDb = this.db.getRawDb();\n    const findings: DataFlowFinding[] = [];\n\n    findings.push(...this._detectDangerousEval(rawDb));\n    findings.push(...this._detectUnsafeDeserialize(rawDb));\n    findings.push(...this._detectHardcodedCrypto(rawDb));\n    findings.push(...this._detectSqlInjection(rawDb));\n    findings.push(...this._detectPathTraversal(rawDb));\n\n    return findings;\n  }\n\n  // \u2500\u2500 Detection: dangerous eval / exec \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectDangerousEval(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('eval', 'Function', 'execSync', 'exec', 'spawn', 'spawnSync', 'execFileSync', 'execFile')\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'dangerous-eval' as const,\n      severity: 'critical' as const,\n      owaspCategory: 'A03' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which can execute arbitrary code or OS commands.`,\n      recommendation: `Avoid '${row.callee}'. Use structured APIs or allowlists for dynamic execution. Validate and sanitize all inputs.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: unsafe deserialization \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectUnsafeDeserialize(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name IN ('unserialize', 'deserialize', 'fromJson', 'loads')\n          OR n2.name LIKE '%pickle%'\n          OR n2.name LIKE '%marshal%'\n          OR n2.name = 'yaml.load'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'unsafe-deserialize' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A08' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which may deserialize untrusted data unsafely.`,\n      recommendation: `Validate data before deserialization. Use safe alternatives (e.g. yaml.safe_load, JSON schema validation). Never deserialize data from untrusted sources.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: hardcoded weak crypto \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectHardcodedCrypto(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name LIKE '%md5%'\n          OR n2.name LIKE '%sha1%'\n          OR n2.name LIKE '%des%'\n          OR n2.name LIKE '%rc4%'\n          OR n2.name LIKE '%blowfish%'\n        )\n        AND (\n          n.name LIKE '%crypto%'\n          OR n.name LIKE '%hash%'\n          OR n.name LIKE '%cipher%'\n          OR n.name LIKE '%encrypt%'\n          OR n.name LIKE '%digest%'\n          OR n.file_path LIKE '%crypto%'\n          OR n.file_path LIKE '%hash%'\n          OR n.file_path LIKE '%cipher%'\n          OR n.file_path LIKE '%auth%'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'hardcoded-crypto' as const,\n      severity: 'medium' as const,\n      owaspCategory: 'A02' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' uses weak or deprecated cryptographic algorithm '${row.callee}'.`,\n      recommendation: `Replace with a strong algorithm: SHA-256 or SHA-3 for hashing, AES-256-GCM for symmetric encryption. Avoid MD5 and SHA-1 for security purposes.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: SQL injection \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectSqlInjection(rawDb: any): DataFlowFinding[] {\n    // Find functions that:\n    //  (a) call a known DB query function\n    //  (b) AND whose name suggests user-input handling (controller/route/request context)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('query', 'execute', 'exec', 'raw', 'runQuery', 'executeQuery', 'runSql', 'executeSql')\n        AND (\n          n.name LIKE '%handle%'\n          OR n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%req%'\n          OR n.name LIKE '%endpoint%'\n          OR n.name LIKE '%action%'\n          OR n.name LIKE '%handler%'\n        )\n        AND n.file_path != ''\n    `);\n\n    // Only report entries that do NOT also have a sanitize/escape call in the same scope\n    const sanitizeCallers: Set<string> = new Set<string>(\n      (rawDb.all(`\n        SELECT DISTINCT n.id\n        FROM edges e\n        JOIN nodes n  ON n.id  = e.source\n        JOIN nodes n2 ON n2.id = e.target\n        WHERE e.kind = 'calls'\n          AND (\n            n2.name LIKE '%sanitize%'\n            OR n2.name LIKE '%escape%'\n            OR n2.name LIKE '%parameteriz%'\n            OR n2.name LIKE '%prepared%'\n            OR n2.name LIKE '%placeholder%'\n          )\n      `) as Array<{ id: string }>).map((r) => r.id),\n    );\n\n    // Cross-reference: look up caller node IDs to filter sanitized callers\n    const callerIds: Map<string, string> = new Map(\n      (rawDb.all(`\n        SELECT id, name FROM nodes WHERE kind IN ('function', 'method', 'arrow_function')\n      `) as Array<{ id: string; name: string }>).map((r) => [r.name, r.id]),\n    );\n\n    return rows\n      .filter((row) => {\n        const callerId = callerIds.get(row.caller);\n        return !callerId || !sanitizeCallers.has(callerId);\n      })\n      .map((row) => ({\n        type: 'sql-injection' as const,\n        severity: 'critical' as const,\n        owaspCategory: 'A03' as const,\n        filePath: row.file_path,\n        line: row.start_line,\n        symbol: row.caller,\n        description: `Controller/handler '${row.caller}' calls database function '${row.callee}' without apparent input sanitization.`,\n        recommendation: `Use parameterized queries or prepared statements. Never concatenate user input into SQL strings. Consider an ORM with query builders.`,\n      }));\n  }\n\n  // \u2500\u2500 Detection: path traversal \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectPathTraversal(rawDb: any): DataFlowFinding[] {\n    // Find functions that call file I/O operations and look like they handle requests.\n    // Exclusions:\n    //   - Internal analysis/infrastructure paths (mcp, resolution, security, extraction, graph, architecture)\n    //   - 'open' is excluded from file ops because KiroGraph.open() (DB) triggers false positives\n    //   - Class names ending in 'Handler' or 'Server' are excluded (too broad \u2014 use more specific patterns)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('readFile', 'readFileSync', 'writeFile', 'writeFileSync', 'createReadStream', 'createWriteStream', 'openSync', 'unlink', 'unlinkSync')\n        AND (\n          n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%download%'\n          OR n.name LIKE '%upload%'\n          OR n.name LIKE '%get%file%'\n          OR n.name LIKE '%fetch%file%'\n          OR n.name LIKE '%serve%file%'\n          OR n.name LIKE '%handle%file%'\n        )\n        AND n.file_path != ''\n        AND n.file_path NOT LIKE '%/mcp/%'\n        AND n.file_path NOT LIKE '%/resolution/%'\n        AND n.file_path NOT LIKE '%/security/%'\n        AND n.file_path NOT LIKE '%/extraction/%'\n        AND n.file_path NOT LIKE '%/graph/%'\n        AND n.file_path NOT LIKE '%/architecture/%'\n        AND n.file_path NOT LIKE '%/frameworks/%'\n        AND n.file_path NOT LIKE '%/bridges/%'\n    `);\n\n    return rows.map((row) => ({\n      type: 'path-traversal' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A01' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Handler '${row.caller}' calls file operation '${row.callee}'. Path may be influenced by user input, enabling directory traversal.`,\n      recommendation: `Validate and normalize file paths. Use path.resolve() and verify the result is inside an allowed base directory. Reject paths containing '..'.`,\n    }));\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCO,MAAM,iBAAiB;AAAA,EAC5B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,UAAsC;AAC1C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,WAA8B,CAAC;AAErC,aAAS,KAAK,GAAG,KAAK,qBAAqB,KAAK,CAAC;AACjD,aAAS,KAAK,GAAG,KAAK,yBAAyB,KAAK,CAAC;AACrD,aAAS,KAAK,GAAG,KAAK,uBAAuB,KAAK,CAAC;AACnD,aAAS,KAAK,GAAG,KAAK,oBAAoB,KAAK,CAAC;AAChD,aAAS,KAAK,GAAG,KAAK,qBAAqB,KAAK,CAAC;AAEjD,WAAO;AAAA,EACT;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAC1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAQrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB,UAAU,IAAI,MAAM;AAAA,IACtC,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,yBAAyB,OAA+B;AAC9D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAarC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,uBAAuB,OAA+B;AAC5D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAyBrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,sDAAsD,IAAI,MAAM;AAAA,MACpG,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,oBAAoB,OAA+B;AAIzD,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAkBrC;AAGD,UAAM,kBAA+B,IAAI;AAAA,MACtC,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAaV,EAA4B,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9C;AAGA,UAAM,YAAiC,IAAI;AAAA,MACxC,MAAM,IAAI;AAAA;AAAA,OAEV,EAA0C,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;AAAA,IACtE;AAEA,WAAO,KACJ,OAAO,CAAC,QAAQ;AACf,YAAM,WAAW,UAAU,IAAI,IAAI,MAAM;AACzC,aAAO,CAAC,YAAY,CAAC,gBAAgB,IAAI,QAAQ;AAAA,IACnD,CAAC,EACA,IAAI,CAAC,SAAS;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,uBAAuB,IAAI,MAAM,8BAA8B,IAAI,MAAM;AAAA,MACtF,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACN;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAM1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KA2BrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,YAAY,IAAI,MAAM,2BAA2B,IAAI,MAAM;AAAA,MACxE,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AACF;",
+  "sourcesContent": ["/**\n * KiroGraph SAST-lite: Dangerous Data Flow Detection\n *\n * Detects dangerous patterns by analysing call edges in the graph database.\n * Uses symbol names and callee chains rather than full AST traversal.\n */\n\nimport type { GraphDatabase } from '../db/database';\nimport type { OwaspCategory } from './owasp';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface DataFlowFinding {\n  type: 'sql-injection' | 'path-traversal' | 'xss' | 'dangerous-eval' | 'unsafe-deserialize' | 'hardcoded-crypto';\n  severity: 'critical' | 'high' | 'medium';\n  owaspCategory: OwaspCategory;\n  filePath: string;\n  line: number;\n  symbol: string;\n  description: string;\n  recommendation: string;\n}\n\n// \u2500\u2500 Internal row type returned by the DB queries \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface CallEdgeRow {\n  caller: string;\n  file_path: string;\n  start_line: number;\n  callee: string;\n}\n\n// \u2500\u2500 hasPatternsData helper \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction hasPatternsData(rawDb: any): boolean {\n  try {\n    const result = rawDb.get(\"SELECT COUNT(*) as cnt FROM pattern_matches\") as { cnt: number } | undefined;\n    return (result?.cnt ?? 0) > 0;\n  } catch {\n    // Table doesn't exist (enablePatterns never ran)\n    return false;\n  }\n}\n\n// \u2500\u2500 DataFlowAnalyzer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class DataFlowAnalyzer {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async analyze(): Promise<DataFlowFinding[]> {\n    const rawDb = (this.db as any).getRawDb();\n\n    // Always run existing SQL heuristics (unchanged behavior)\n    const sqlFindings = [\n      ...this._detectDangerousEval(rawDb),\n      ...this._detectUnsafeDeserialize(rawDb),\n      ...this._detectHardcodedCrypto(rawDb),\n      ...this._detectSqlInjection(rawDb),\n      ...this._detectPathTraversal(rawDb),\n    ];\n\n    // When pattern_matches has data, merge AST findings (more precise)\n    if (hasPatternsData(rawDb)) {\n      const astFindings = this.analyzeFromPatternMatches(rawDb);\n      // Deduplicate: AST entry wins over SQL entry at same (filePath, line)\n      const astKeys = new Set(astFindings.map(f => `${f.filePath}:${f.line}`));\n      const filteredSql = sqlFindings.filter(f => !astKeys.has(`${f.filePath}:${f.line}`));\n      return [...astFindings, ...filteredSql];\n    }\n\n    return sqlFindings;\n  }\n\n  private analyzeFromPatternMatches(rawDb: any): DataFlowFinding[] {\n    const rows: Array<{\n      file_path: string;\n      pattern_id: string;\n      line: number;\n      col: number;\n      match_text: string;\n      severity: string;\n      owasp_category: string;\n      language: string;\n    }> = rawDb.all('SELECT file_path, pattern_id, line, col, match_text, severity, owasp_category, language FROM pattern_matches');\n\n    return rows.map(row => {\n      // Map pattern_id prefix to DataFlowFinding type\n      const type = this._patternIdToType(row.pattern_id);\n      // Look up nearest enclosing symbol\n      const symbol = this._findEnclosingSymbol(rawDb, row.file_path, row.line);\n      return {\n        type,\n        severity: row.severity as DataFlowFinding['severity'],\n        owaspCategory: row.owasp_category as DataFlowFinding['owaspCategory'],\n        filePath: row.file_path,\n        line: row.line,\n        symbol: symbol ?? row.pattern_id,\n        description: `[AST pattern: ${row.pattern_id}] ${row.match_text.slice(0, 100)}`,\n        recommendation: this._getRecommendation(type),\n      };\n    });\n  }\n\n  private _patternIdToType(patternId: string): DataFlowFinding['type'] {\n    if (patternId.startsWith('sql-injection')) return 'sql-injection';\n    if (patternId.startsWith('dangerous-eval') || patternId.startsWith('dangerous-exec')) return 'dangerous-eval';\n    if (patternId.startsWith('path-traversal')) return 'path-traversal';\n    if (patternId.startsWith('prototype-pollution')) return 'unsafe-deserialize';\n    if (patternId.startsWith('weak-crypto')) return 'hardcoded-crypto';\n    return 'dangerous-eval'; // fallback\n  }\n\n  private _findEnclosingSymbol(rawDb: any, filePath: string, line: number): string | null {\n    const row = rawDb.get(\n      `SELECT name FROM nodes WHERE file_path = ? AND start_line <= ? AND end_line >= ? AND kind IN ('function', 'method', 'class') ORDER BY (end_line - start_line) ASC LIMIT 1`,\n      [filePath, line, line]\n    ) as { name: string } | undefined;\n    return row?.name ?? null;\n  }\n\n  private _getRecommendation(type: DataFlowFinding['type']): string {\n    const recs: Record<DataFlowFinding['type'], string> = {\n      'sql-injection': 'Use parameterized queries. Never concatenate user input into SQL strings.',\n      'dangerous-eval': 'Remove eval()/exec(). Use structured alternatives.',\n      'path-traversal': 'Use path.resolve() and verify result is within an allowed base directory.',\n      'unsafe-deserialize': 'Validate object keys before merge. Avoid untrusted deserialization.',\n      'hardcoded-crypto': 'Use SHA-256+ for hashing. Use bcrypt/argon2 for passwords.',\n      'xss': 'Sanitize output. Use a trusted template engine with auto-escaping.',\n    };\n    return recs[type] ?? 'Review and fix this security issue.';\n  }\n\n  // \u2500\u2500 Detection: dangerous eval / exec \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectDangerousEval(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('eval', 'Function', 'execSync', 'exec', 'spawn', 'spawnSync', 'execFileSync', 'execFile')\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'dangerous-eval' as const,\n      severity: 'critical' as const,\n      owaspCategory: 'A03' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which can execute arbitrary code or OS commands.`,\n      recommendation: `Avoid '${row.callee}'. Use structured APIs or allowlists for dynamic execution. Validate and sanitize all inputs.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: unsafe deserialization \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectUnsafeDeserialize(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name IN ('unserialize', 'deserialize', 'fromJson', 'loads')\n          OR n2.name LIKE '%pickle%'\n          OR n2.name LIKE '%marshal%'\n          OR n2.name = 'yaml.load'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'unsafe-deserialize' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A08' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which may deserialize untrusted data unsafely.`,\n      recommendation: `Validate data before deserialization. Use safe alternatives (e.g. yaml.safe_load, JSON schema validation). Never deserialize data from untrusted sources.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: hardcoded weak crypto \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectHardcodedCrypto(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name LIKE '%md5%'\n          OR n2.name LIKE '%sha1%'\n          OR n2.name LIKE '%des%'\n          OR n2.name LIKE '%rc4%'\n          OR n2.name LIKE '%blowfish%'\n        )\n        AND (\n          n.name LIKE '%crypto%'\n          OR n.name LIKE '%hash%'\n          OR n.name LIKE '%cipher%'\n          OR n.name LIKE '%encrypt%'\n          OR n.name LIKE '%digest%'\n          OR n.file_path LIKE '%crypto%'\n          OR n.file_path LIKE '%hash%'\n          OR n.file_path LIKE '%cipher%'\n          OR n.file_path LIKE '%auth%'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'hardcoded-crypto' as const,\n      severity: 'medium' as const,\n      owaspCategory: 'A02' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' uses weak or deprecated cryptographic algorithm '${row.callee}'.`,\n      recommendation: `Replace with a strong algorithm: SHA-256 or SHA-3 for hashing, AES-256-GCM for symmetric encryption. Avoid MD5 and SHA-1 for security purposes.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: SQL injection \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectSqlInjection(rawDb: any): DataFlowFinding[] {\n    // Find functions that:\n    //  (a) call a known DB query function\n    //  (b) AND whose name suggests user-input handling (controller/route/request context)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('query', 'execute', 'exec', 'raw', 'runQuery', 'executeQuery', 'runSql', 'executeSql')\n        AND (\n          n.name LIKE '%handle%'\n          OR n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%req%'\n          OR n.name LIKE '%endpoint%'\n          OR n.name LIKE '%action%'\n          OR n.name LIKE '%handler%'\n        )\n        AND n.file_path != ''\n    `);\n\n    // Only report entries that do NOT also have a sanitize/escape call in the same scope\n    const sanitizeCallers: Set<string> = new Set<string>(\n      (rawDb.all(`\n        SELECT DISTINCT n.id\n        FROM edges e\n        JOIN nodes n  ON n.id  = e.source\n        JOIN nodes n2 ON n2.id = e.target\n        WHERE e.kind = 'calls'\n          AND (\n            n2.name LIKE '%sanitize%'\n            OR n2.name LIKE '%escape%'\n            OR n2.name LIKE '%parameteriz%'\n            OR n2.name LIKE '%prepared%'\n            OR n2.name LIKE '%placeholder%'\n          )\n      `) as Array<{ id: string }>).map((r) => r.id),\n    );\n\n    // Cross-reference: look up caller node IDs to filter sanitized callers\n    const callerIds: Map<string, string> = new Map(\n      (rawDb.all(`\n        SELECT id, name FROM nodes WHERE kind IN ('function', 'method', 'arrow_function')\n      `) as Array<{ id: string; name: string }>).map((r) => [r.name, r.id]),\n    );\n\n    return rows\n      .filter((row) => {\n        const callerId = callerIds.get(row.caller);\n        return !callerId || !sanitizeCallers.has(callerId);\n      })\n      .map((row) => ({\n        type: 'sql-injection' as const,\n        severity: 'critical' as const,\n        owaspCategory: 'A03' as const,\n        filePath: row.file_path,\n        line: row.start_line,\n        symbol: row.caller,\n        description: `Controller/handler '${row.caller}' calls database function '${row.callee}' without apparent input sanitization.`,\n        recommendation: `Use parameterized queries or prepared statements. Never concatenate user input into SQL strings. Consider an ORM with query builders.`,\n      }));\n  }\n\n  // \u2500\u2500 Detection: path traversal \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectPathTraversal(rawDb: any): DataFlowFinding[] {\n    // Find functions that call file I/O operations and look like they handle requests.\n    // Exclusions:\n    //   - Internal analysis/infrastructure paths (mcp, resolution, security, extraction, graph, architecture)\n    //   - 'open' is excluded from file ops because KiroGraph.open() (DB) triggers false positives\n    //   - Class names ending in 'Handler' or 'Server' are excluded (too broad \u2014 use more specific patterns)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('readFile', 'readFileSync', 'writeFile', 'writeFileSync', 'createReadStream', 'createWriteStream', 'openSync', 'unlink', 'unlinkSync')\n        AND (\n          n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%download%'\n          OR n.name LIKE '%upload%'\n          OR n.name LIKE '%get%file%'\n          OR n.name LIKE '%fetch%file%'\n          OR n.name LIKE '%serve%file%'\n          OR n.name LIKE '%handle%file%'\n        )\n        AND n.file_path != ''\n        AND n.file_path NOT LIKE '%/mcp/%'\n        AND n.file_path NOT LIKE '%/resolution/%'\n        AND n.file_path NOT LIKE '%/security/%'\n        AND n.file_path NOT LIKE '%/extraction/%'\n        AND n.file_path NOT LIKE '%/graph/%'\n        AND n.file_path NOT LIKE '%/architecture/%'\n        AND n.file_path NOT LIKE '%/frameworks/%'\n        AND n.file_path NOT LIKE '%/bridges/%'\n    `);\n\n    return rows.map((row) => ({\n      type: 'path-traversal' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A01' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Handler '${row.caller}' calls file operation '${row.callee}'. Path may be influenced by user input, enabling directory traversal.`,\n      recommendation: `Validate and normalize file paths. Use path.resolve() and verify the result is inside an allowed base directory. Reject paths containing '..'.`,\n    }));\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCA,SAAS,gBAAgB,OAAqB;AAC5C,MAAI;AACF,UAAM,SAAS,MAAM,IAAI,6CAA6C;AACtE,YAAQ,QAAQ,OAAO,KAAK;AAAA,EAC9B,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAIO,MAAM,iBAAiB;AAAA,EAC5B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,UAAsC;AAC1C,UAAM,QAAS,KAAK,GAAW,SAAS;AAGxC,UAAM,cAAc;AAAA,MAClB,GAAG,KAAK,qBAAqB,KAAK;AAAA,MAClC,GAAG,KAAK,yBAAyB,KAAK;AAAA,MACtC,GAAG,KAAK,uBAAuB,KAAK;AAAA,MACpC,GAAG,KAAK,oBAAoB,KAAK;AAAA,MACjC,GAAG,KAAK,qBAAqB,KAAK;AAAA,IACpC;AAGA,QAAI,gBAAgB,KAAK,GAAG;AAC1B,YAAM,cAAc,KAAK,0BAA0B,KAAK;AAExD,YAAM,UAAU,IAAI,IAAI,YAAY,IAAI,OAAK,GAAG,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE,CAAC;AACvE,YAAM,cAAc,YAAY,OAAO,OAAK,CAAC,QAAQ,IAAI,GAAG,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE,CAAC;AACnF,aAAO,CAAC,GAAG,aAAa,GAAG,WAAW;AAAA,IACxC;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,0BAA0B,OAA+B;AAC/D,UAAM,OASD,MAAM,IAAI,8GAA8G;AAE7H,WAAO,KAAK,IAAI,SAAO;AAErB,YAAM,OAAO,KAAK,iBAAiB,IAAI,UAAU;AAEjD,YAAM,SAAS,KAAK,qBAAqB,OAAO,IAAI,WAAW,IAAI,IAAI;AACvE,aAAO;AAAA,QACL;AAAA,QACA,UAAU,IAAI;AAAA,QACd,eAAe,IAAI;AAAA,QACnB,UAAU,IAAI;AAAA,QACd,MAAM,IAAI;AAAA,QACV,QAAQ,UAAU,IAAI;AAAA,QACtB,aAAa,iBAAiB,IAAI,UAAU,KAAK,IAAI,WAAW,MAAM,GAAG,GAAG,CAAC;AAAA,QAC7E,gBAAgB,KAAK,mBAAmB,IAAI;AAAA,MAC9C;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,iBAAiB,WAA4C;AACnE,QAAI,UAAU,WAAW,eAAe,EAAG,QAAO;AAClD,QAAI,UAAU,WAAW,gBAAgB,KAAK,UAAU,WAAW,gBAAgB,EAAG,QAAO;AAC7F,QAAI,UAAU,WAAW,gBAAgB,EAAG,QAAO;AACnD,QAAI,UAAU,WAAW,qBAAqB,EAAG,QAAO;AACxD,QAAI,UAAU,WAAW,aAAa,EAAG,QAAO;AAChD,WAAO;AAAA,EACT;AAAA,EAEQ,qBAAqB,OAAY,UAAkB,MAA6B;AACtF,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA,CAAC,UAAU,MAAM,IAAI;AAAA,IACvB;AACA,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA,EAEQ,mBAAmB,MAAuC;AAChE,UAAM,OAAgD;AAAA,MACpD,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,MACpB,OAAO;AAAA,IACT;AACA,WAAO,KAAK,IAAI,KAAK;AAAA,EACvB;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAC1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAQrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB,UAAU,IAAI,MAAM;AAAA,IACtC,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,yBAAyB,OAA+B;AAC9D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAarC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,uBAAuB,OAA+B;AAC5D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAyBrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,sDAAsD,IAAI,MAAM;AAAA,MACpG,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,oBAAoB,OAA+B;AAIzD,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAkBrC;AAGD,UAAM,kBAA+B,IAAI;AAAA,MACtC,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAaV,EAA4B,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9C;AAGA,UAAM,YAAiC,IAAI;AAAA,MACxC,MAAM,IAAI;AAAA;AAAA,OAEV,EAA0C,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;AAAA,IACtE;AAEA,WAAO,KACJ,OAAO,CAAC,QAAQ;AACf,YAAM,WAAW,UAAU,IAAI,IAAI,MAAM;AACzC,aAAO,CAAC,YAAY,CAAC,gBAAgB,IAAI,QAAQ;AAAA,IACnD,CAAC,EACA,IAAI,CAAC,SAAS;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,uBAAuB,IAAI,MAAM,8BAA8B,IAAI,MAAM;AAAA,MACtF,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACN;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAM1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KA2BrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,YAAY,IAAI,MAAM,2BAA2B,IAAI,MAAM;AAAA,MACxE,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AACF;",
   "names": []
 }

package/dist/security/dep-confusion.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Dependency Confusion Checker
+ *
+ * Detects internal packages whose names exist in public registries
+ * (a supply chain attack vector), and flags typosquatting candidates.
+ */
+import type { GraphDatabase } from '../db/database';
+export interface DepConfusionFinding {
+    packageName: string;
+    ecosystem: string;
+    internalSource: string;
+    publicExists: boolean;
+    publicVersion: string | null;
+    publicPublishedAt: string | null;
+    riskLevel: 'critical' | 'high' | 'medium';
+    explanation: string;
+}
+export declare class DepConfusionChecker {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    check(): Promise<DepConfusionFinding[]>;
+}
+//# sourceMappingURL=dep-confusion.d.ts.map

package/dist/security/dep-confusion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-confusion.d.ts","sourceRoot":"","sources":["../../src/security/dep-confusion.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;CACrB;AAoKD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,KAAK,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;CA0G9C"}

package/dist/security/errors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * KiroGraph-Sec Error Classes
+ *
+ * Security-specific error types extending the base KiroGraphError.
+ */
+import { KiroGraphError } from '../errors';
+export declare class SecurityError extends KiroGraphError {
+    constructor(message: string, context?: Record<string, unknown>);
+}
+export declare class ManifestParseError extends KiroGraphError {
+    constructor(message: string, filePath: string, line?: number);
+}
+export declare class VulnDatabaseError extends KiroGraphError {
+    constructor(message: string, database: string, httpStatus?: number);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/security/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/security/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,qBAAa,aAAc,SAAQ,cAAc;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED,qBAAa,kBAAmB,SAAQ,cAAc;gBACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;CAI7D;AAED,qBAAa,iBAAkB,SAAQ,cAAc;gBACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAInE"}

package/dist/security/export/fix-suggestions.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Fix Suggestion Builder
+ *
+ * Generates ecosystem-appropriate upgrade commands for vulnerabilities
+ * that have a known fixed version. Reusable by CLI and MCP tools.
+ */
+/**
+ * Build an ecosystem-appropriate fix suggestion command.
+ *
+ * @param ecosystem - The package ecosystem (npm, maven, go, pypi, cargo)
+ * @param packageName - The package name (for maven: groupId:artifactId)
+ * @param fixedVersion - The version that fixes the vulnerability
+ * @returns A formatted fix command string, or empty string if ecosystem is unknown
+ */
+export declare function buildFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string): string;
+/**
+ * Format a fix suggestion line for display.
+ * Returns the formatted line with the 💡 prefix, or empty string if no fixed version.
+ */
+export declare function formatFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string | null | undefined): string;
+//# sourceMappingURL=fix-suggestions.d.ts.map

package/dist/security/export/fix-suggestions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix-suggestions.d.ts","sourceRoot":"","sources":["../../../src/security/export/fix-suggestions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAuBvG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAI3H"}

package/dist/security/export/sbom.d.ts

@@ -0,0 +1,33 @@
+/**
+ * SBOMExporter — CycloneDX 1.5 SBOM Generation
+ *
+ * Generates a CycloneDX 1.5 JSON Software Bill of Materials from the
+ * Dependency_Graph stored in the KiroGraph database. Each Dependency_Node
+ * becomes a component of type "library" with purl, scope, and
+ * direct/transitive classification.
+ *
+ * Requirements: 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7
+ */
+import type { GraphDatabase } from '../../db/database';
+import type { CycloneDXSBOM } from '../types';
+/**
+ * Generates CycloneDX 1.5 SBOM documents from the dependency graph.
+ */
+export declare class SBOMExporter {
+    private readonly db;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, projectRoot: string);
+    /**
+     * Generate a CycloneDX 1.5 SBOM object.
+     */
+    export(): CycloneDXSBOM;
+    /**
+     * Export the SBOM as a pretty-printed JSON string.
+     */
+    exportJSON(): string;
+    /**
+     * Build CycloneDX metadata section.
+     */
+    private buildMetadata;
+}
+//# sourceMappingURL=sbom.d.ts.map

package/dist/security/export/sbom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sbom.d.ts","sourceRoot":"","sources":["../../../src/security/export/sbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EACV,aAAa,EAId,MAAM,UAAU,CAAC;AAiHlB;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAKlD;;OAEG;IACH,MAAM,IAAI,aAAa;IAsGvB;;OAEG;IACH,UAAU,IAAI,MAAM;IAKpB;;OAEG;IACH,OAAO,CAAC,aAAa;CA8BtB"}

package/dist/security/export/serialization.d.ts

@@ -0,0 +1,62 @@
+/**
+ * CycloneDX serialization utilities for Dependency_Nodes.
+ *
+ * Provides serialize/deserialize between DependencyRow (sec_dependencies table)
+ * and CycloneDX JSON component format, with partial failure resilience.
+ *
+ * Requirements: 8.2, 8.3, 8.4
+ */
+import type { CycloneDXComponent } from '../types';
+/**
+ * Represents a row from the sec_dependencies table.
+ */
+export interface DependencyRow {
+    node_id: string;
+    ecosystem: string;
+    package_name: string;
+    declared_constraint: string;
+    resolved_version: string | null;
+    scope: 'production' | 'development' | 'optional';
+    transitive_status: 'complete' | 'incomplete';
+    last_vuln_check: number | null;
+    vuln_data_stale: number;
+    vuln_data_stale_since: number | null;
+    source_manifests: string;
+}
+/**
+ * Error reported when a single node fails serialization/deserialization.
+ */
+export interface SerializationError {
+    name: string;
+    reason: string;
+}
+/**
+ * Converts a dependency database row to a CycloneDX component object.
+ * Stores the declared constraint in a `properties` array entry with
+ * name "kirograph:declaredConstraint".
+ *
+ * The purl format is: pkg:<ecosystem>/<name>@<version>
+ */
+export declare function serializeDependencyToComponent(dep: DependencyRow): CycloneDXComponent;
+/**
+ * Converts a CycloneDX component back to a dependency row.
+ * Extracts the constraint from the properties array.
+ */
+export declare function deserializeComponentToDependency(component: CycloneDXComponent): DependencyRow;
+/**
+ * Serializes all dependencies, collecting errors for any that fail
+ * without aborting the batch.
+ */
+export declare function serializeAll(deps: DependencyRow[]): {
+    components: CycloneDXComponent[];
+    errors: SerializationError[];
+};
+/**
+ * Deserializes all components back to dependency rows,
+ * collecting errors for any that fail without aborting the batch.
+ */
+export declare function deserializeAll(components: CycloneDXComponent[]): {
+    deps: DependencyRow[];
+    errors: SerializationError[];
+};
+//# sourceMappingURL=serialization.d.ts.map

package/dist/security/export/serialization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialization.d.ts","sourceRoot":"","sources":["../../../src/security/export/serialization.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAInD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,YAAY,GAAG,aAAa,GAAG,UAAU,CAAC;IACjD,iBAAiB,EAAE,UAAU,GAAG,YAAY,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAsBD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,aAAa,GAAG,kBAAkB,CAgCrF;AAID;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,kBAAkB,GAAG,aAAa,CA+C7F;AAID;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG;IACnD,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B,CAiBA;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG;IAChE,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B,CAiBA"}

package/dist/security/export/vex.d.ts

@@ -0,0 +1,58 @@
+/**
+ * KiroGraph-Sec VEX Exporter
+ *
+ * Generates CycloneDX 1.5 VEX (Vulnerability Exploitability eXchange) documents
+ * with reachability-informed vulnerability status. Each Vulnerability_Node is
+ * mapped to a VEX entry with an analysis state derived from the reachability verdict.
+ *
+ * Requirements: 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 7.8
+ */
+import type { GraphDatabase } from '../../db/database';
+import type { CycloneDXVEX } from '../types';
+/**
+ * VEXExporter serializes vulnerability assessments with reachability verdicts
+ * into CycloneDX 1.5 VEX format.
+ */
+export declare class VEXExporter {
+    private readonly db;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, projectRoot: string);
+    /**
+     * Generate CycloneDX 1.5 VEX JSON object.
+     *
+     * Queries all Vulnerability_Nodes and their reachability verdicts,
+     * producing one VEX entry per vulnerability.
+     */
+    export(): CycloneDXVEX;
+    /**
+     * Export to pretty-printed JSON string.
+     */
+    exportJSON(): string;
+    /**
+     * Build a single CycloneDX vulnerability entry from a Vulnerability_Node.
+     *
+     * Maps reachability verdicts to CycloneDX analysis states:
+     * - affected → "affected" with path summary detail
+     * - not_affected → "not_affected" with justification "code_not_reachable"
+     * - under_investigation → "under_investigation" with unresolved symbols detail
+     * - no reachability data → "under_investigation" with pending analysis detail
+     */
+    private buildVulnerabilityEntry;
+    /**
+     * Build the analysis section based on the reachability verdict.
+     */
+    private buildAnalysis;
+    /**
+     * Build analysis detail for "affected" verdict.
+     *
+     * Includes: entry point count, layer count, shortest path length.
+     */
+    private buildAffectedAnalysis;
+    /**
+     * Build analysis detail for "under_investigation" verdict.
+     *
+     * Lists unresolved symbols or states pending analysis reason.
+     */
+    private buildUnderInvestigationAnalysis;
+}
+//# sourceMappingURL=vex.d.ts.map

package/dist/security/export/vex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vex.d.ts","sourceRoot":"","sources":["../../../src/security/export/vex.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAA4C,MAAM,UAAU,CAAC;AAMvF;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAKlD;;;;;OAKG;IACH,MAAM,IAAI,YAAY;IAiDtB;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;;;;;;;OAQG;IACH,OAAO,CAAC,uBAAuB;IA6D/B;;OAEG;IACH,OAAO,CAAC,aAAa;IAgCrB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAuC7B;;;;OAIG;IACH,OAAO,CAAC,+BAA+B;CAoBxC"}

package/dist/security/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * KiroGraph-Sec Module Index
+ *
+ * Exports all public interfaces, classes, and types for the security module.
+ * Used by MCP tools, CLI commands, and pipeline integration.
+ */
+export { SecurityPipeline } from './pipeline';
+export { ManifestParser } from './manifest/parser';
+export { DependencyGraphIntegrator } from './integrator';
+export { VulnerabilityDatabaseClient } from './vuln/client';
+export { OsvAdapter } from './vuln/osv-adapter';
+export type { VulnDatabaseAdapter } from './vuln/types';
+export { ReachabilityAnalyzer } from './reachability';
+export { SBOMExporter } from './export/sbom';
+export { VEXExporter } from './export/vex';
+export { buildFixSuggestion, formatFixSuggestion } from './export/fix-suggestions';
+export { getSecurityWarningsForNodes, formatSecurityWarnings } from './context-warnings';
+export type { SecurityWarning } from './context-warnings';
+export type { ParsedDependency, ManifestParseResult, IntegrationResult, TransitiveResult, CleanupResult, CVERecord, VersionRange, EnrichmentResult, ReachabilityVerdict, ReachabilityPath, ReachabilityResult, ImpactSummary, SecurityResult, SBOMMetadata, CycloneDXSBOM, CycloneDXComponent, CycloneDXDependencyEntry, CycloneDXVEX, CycloneDXVulnerability, } from './types';
+export { SecurityError, ManifestParseError, VulnDatabaseError } from './errors';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAGzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGnF,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACzF,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,wBAAwB,EACxB,YAAY,EACZ,sBAAsB,GACvB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/security/integrator.d.ts

@@ -0,0 +1,63 @@
+import type { GraphDatabase } from '../db/database';
+import type { IntegrationResult, TransitiveResult, CleanupResult } from './types';
+export declare class DependencyGraphIntegrator {
+    private readonly db;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, projectRoot: string);
+    /**
+     * Create import/reference edges between code symbols and Dependency_Nodes.
+     *
+     * Per Requirement 2.1: creates `imports` edges from file nodes that contain
+     * import statements resolving to a dependency → the Dependency_Node.
+     *
+     * Per Requirement 2.2: creates `references` edges from code symbols that
+     * reference classes/functions from a dependency → the Dependency_Node.
+     */
+    integrate(): Promise<IntegrationResult>;
+    /**
+     * Find the file node ID for a given file path.
+     * File nodes have kind='file' and their file_path matches.
+     */
+    private findFileNodeId;
+    /**
+     * Match an import specifier to a dependency node ID.
+     *
+     * Handles:
+     * - Exact match: `express` → dep:npm:express
+     * - Scoped packages: `@scope/pkg` → dep:npm:@scope/pkg
+     * - Subpath imports: `express/Router` → dep:npm:express
+     * - Scoped subpath: `@angular/core/testing` → dep:npm:@angular/core
+     * - Go modules: `github.com/gin-gonic/gin` → dep:go:github.com/gin-gonic/gin
+     * - Go subpath: `github.com/gin-gonic/gin/internal` → dep:go:github.com/gin-gonic/gin
+     */
+    private matchImportToDependency;
+    /**
+     * Resolve transitive dependencies up to maxDepth levels.
+     *
+     * For each ecosystem with a lock file:
+     * 1. Parse the lock file to extract dependency relationships
+     * 2. Create `depends_on` edges between Dependency_Nodes
+     * 3. Traverse up to maxDepth levels of transitive depth
+     *
+     * If a lock file is missing for an ecosystem, mark all dependencies of that
+     * ecosystem with `transitive_status: 'incomplete'` and log a warning.
+     *
+     * @param maxDepth - Maximum levels of transitive depth to resolve (default: 10)
+     */
+    resolveTransitives(maxDepth?: number): Promise<TransitiveResult>;
+    /**
+     * Remove orphaned Dependency_Nodes and their edges.
+     *
+     * A Dependency_Node is orphaned if:
+     * 1. It has no `declared_in` edges (manifest no longer declares it), OR
+     * 2. None of its source manifests still exist on disk
+     *
+     * Also removes transitive Dependency_Nodes that are no longer reachable from
+     * any remaining direct dependency via `depends_on` edges.
+     *
+     * @param manifestExists - Optional function to check if a manifest path exists.
+     *   Defaults to fs.existsSync. Useful for testing.
+     */
+    cleanup(manifestExists?: (absolutePath: string) => boolean): Promise<CleanupResult>;
+}
+//# sourceMappingURL=integrator.d.ts.map

package/dist/security/integrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrator.d.ts","sourceRoot":"","sources":["../../src/security/integrator.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAmNlF,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAKlD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAwG7C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,uBAAuB;IAmD/B;;;;;;;;;;;;OAYG;IACG,kBAAkB,CAAC,QAAQ,GAAE,MAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAmI1E;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;CA2G1F"}

package/dist/security/license.d.ts

@@ -0,0 +1,33 @@
+/**
+ * License Compliance Checker for KiroGraph-Sec
+ *
+ * Checks project dependencies against a license policy (deny/warn lists).
+ * Supports case-insensitive matching and wildcard patterns (e.g. GPL-* matches
+ * GPL-2.0, GPL-3.0-only, etc.).
+ */
+export interface LicenseViolation {
+    packageName: string;
+    ecosystem: string;
+    license: string;
+    severity: 'deny' | 'warn';
+}
+/**
+ * Check a list of dependencies against a license policy.
+ *
+ * Dependencies with no license are skipped (no violation).
+ * A license matched in `deny` produces a 'deny' violation.
+ * A license matched in `warn` (and not in `deny`) produces a 'warn' violation.
+ *
+ * @param deps - Array of dependency rows from sec_dependencies
+ * @param policy - The license policy with deny and warn lists
+ * @returns Array of violations sorted by severity (deny first) then package name
+ */
+export declare function checkLicensePolicy(deps: Array<{
+    package_name: string;
+    ecosystem: string;
+    license: string | null;
+}>, policy: {
+    deny: string[];
+    warn: string[];
+}): LicenseViolation[];
+//# sourceMappingURL=license.d.ts.map

package/dist/security/license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/security/license.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AAmCD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,KAAK,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,EAChF,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GACzC,gBAAgB,EAAE,CAkCpB"}