kirograph 0.19.0 → 0.20.0

package/dist/security/manifest/adapter.d.ts

@@ -0,0 +1,92 @@
+import type { ManifestParser as ArchManifestParser } from '../../architecture/types';
+import type { ParsedDependency, ManifestParseResult } from '../types';
+/**
+ * A version extraction plugin provides ecosystem-specific logic to extract
+ * version constraints and scopes from manifest files. Each plugin corresponds
+ * to one or more architecture parsers and enhances their output with security-
+ * relevant metadata.
+ */
+export interface VersionExtractionPlugin {
+    /** Ecosystem identifier matching the architecture parser name (e.g. 'npm', 'maven', 'go') */
+    ecosystem: string;
+    /** Manifest filenames this plugin handles (should match the architecture parser's manifestFiles) */
+    manifestFiles: string[];
+    /** Returns true if this plugin can handle the given manifest file path */
+    canExtract(manifestPath: string): boolean;
+    /**
+     * Extract version constraints and scopes from a manifest file.
+     * This is called AFTER the architecture parser has already discovered the manifest.
+     * The plugin receives the manifest path and project root, and returns detailed
+     * dependency information including versions and scopes.
+     */
+    extract(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+}
+export declare class SecurityManifestAdapter {
+    private readonly archParsers;
+    private readonly plugins;
+    /** Standalone plugins have no corresponding architecture parser — they own their own discovery. */
+    private readonly standalonePlugins;
+    private readonly projectRoot;
+    constructor(projectRoot: string);
+    /**
+     * Register a version extraction plugin for an ecosystem that has a
+     * corresponding architecture parser. The plugin's `ecosystem` field
+     * must equal the architecture parser's `name` for the lookup to work.
+     */
+    registerPlugin(plugin: VersionExtractionPlugin): void;
+    /**
+     * Register a standalone version extraction plugin for an ecosystem that
+     * has NO corresponding architecture parser. The plugin's `manifestFiles`
+     * list drives discovery — the adapter will scan for those filenames and
+     * invoke the plugin directly when found.
+     */
+    registerStandalonePlugin(plugin: VersionExtractionPlugin): void;
+    /**
+     * Get all registered version extraction plugins (wrapped + standalone).
+     */
+    getPlugins(): VersionExtractionPlugin[];
+    /**
+     * Get the architecture parsers being wrapped.
+     */
+    getArchParsers(): ArchManifestParser[];
+    /**
+     * Discover all manifest files in the project tree.
+     * Includes files known to architecture parsers AND files from standalone plugins.
+     * Returns absolute paths.
+     */
+    discoverManifests(): string[];
+    /**
+     * Run full discovery and extraction:
+     * 1. Discover manifest files (reusing architecture's SKIP_DIRS logic)
+     * 2. For each manifest, find the matching architecture parser
+     * 3. If a version extraction plugin is registered for that ecosystem,
+     *    use it to extract detailed version/scope information
+     * 4. Otherwise, fall back to basic extraction from the architecture parser's
+     *    ArchPackage.externalDeps (names only, no version info)
+     */
+    extractAll(): Promise<ManifestParseResult>;
+    /**
+     * Extract dependencies for a single manifest file.
+     * Tries standalone plugins first (when there is no arch parser), then
+     * wrapped plugins, then falls back to arch parser output.
+     */
+    extractFromManifest(manifestPath: string): Promise<ParsedDependency[]>;
+    /**
+     * Get the ecosystem name for a given manifest file path.
+     * Returns undefined if no parser handles this file.
+     */
+    getEcosystem(manifestPath: string): string | undefined;
+    /**
+     * Fallback extraction: converts ArchPackage.externalDeps (names only) into
+     * ParsedDependency records with empty version constraints and default scope.
+     */
+    private _fallbackExtract;
+    /**
+     * Walk the project directory tree looking for manifest files.
+     * Mirrors the architecture module's _findManifests() logic, respecting SKIP_DIRS.
+     * Includes manifest filenames from standalone plugins in addition to arch parsers.
+     */
+    private _findManifests;
+    private _walkDir;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/security/manifest/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../src/security/manifest/adapter.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,IAAI,kBAAkB,EAAe,MAAM,0BAA0B,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAItE;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0EAA0E;IAC1E,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1C;;;;;OAKG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CACjF;AAYD,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmD;IAC3E,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmD;IACrF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,WAAW,EAAE,MAAM;IAK/B;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAIrD;;;;;OAKG;IACH,wBAAwB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAI/D;;OAEG;IACH,UAAU,IAAI,uBAAuB,EAAE;IAIvC;;OAEG;IACH,cAAc,IAAI,kBAAkB,EAAE;IAItC;;;;OAIG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAI7B;;;;;;;;OAQG;IACG,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAqDhD;;;;OAIG;IACG,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyB5E;;;OAGG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAOtD;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAqBxB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,QAAQ;CAsBjB"}

package/dist/security/manifest/parser.d.ts

@@ -0,0 +1,73 @@
+/**
+ * ManifestParser Orchestrator
+ *
+ * Orchestrates manifest discovery, version extraction, deduplication, and
+ * database persistence. Uses the SecurityManifestAdapter for discovery and
+ * extraction, registers all 12 version extraction plugins:
+ *   Wrapped (arch parser exists): npm, maven, go, pip, cargo, nuget, gradle
+ *   Standalone (no arch parser):  rubygems, composer, swift, pubspec, hex
+ *
+ * Node ID format: `dep:<ecosystem>:<name>` (e.g. `dep:npm:express`)
+ */
+import { SecurityManifestAdapter } from './adapter';
+import type { GraphDatabase } from '../../db/database';
+import type { ParsedDependency, ManifestParseResult } from '../types';
+/**
+ * Compare two version strings. Returns:
+ *  - positive if a > b
+ *  - negative if a < b
+ *  - 0 if equal
+ *
+ * Handles semver-like versions (1.2.3), Go pseudo-versions, and constraint
+ * strings. Falls back to lexicographic comparison for non-numeric versions.
+ */
+export declare function compareVersions(a: string, b: string): number;
+/**
+ * A deduplicated dependency entry combining data from multiple manifests.
+ */
+interface DeduplicatedDependency {
+    name: string;
+    ecosystem: string;
+    /** The highest declared constraint across all manifests */
+    declaredConstraint: string;
+    /** The highest resolved version across all manifests (if any) */
+    resolvedVersion?: string;
+    /** Scope from the manifest with the highest version */
+    scope: ParsedDependency['scope'];
+    /** All source manifests that declared this dependency */
+    sourceManifests: string[];
+    /** License from manifest, if available */
+    license?: string;
+}
+/**
+ * Deduplicate dependencies by (name, ecosystem) pair, keeping the entry
+ * with the highest version and collecting all source manifests.
+ */
+export declare function deduplicateDependencies(deps: ParsedDependency[]): DeduplicatedDependency[];
+/**
+ * ManifestParser orchestrates manifest discovery, parsing, deduplication,
+ * and database persistence for the security module.
+ */
+export declare class ManifestParser {
+    private readonly adapter;
+    private readonly db;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, projectRoot: string);
+    /**
+     * Get the underlying adapter (useful for testing).
+     */
+    getAdapter(): SecurityManifestAdapter;
+    /**
+     * Run full manifest discovery, parsing, deduplication, and database persistence.
+     *
+     * Steps:
+     * 1. Discover manifest files via the adapter (reuses architecture parsers)
+     * 2. Extract dependencies with version/scope data via registered plugins
+     * 3. Deduplicate: same (name, ecosystem) → single entry with highest version
+     * 4. Create Dependency_Nodes in the database (nodes + sec_dependencies tables)
+     * 5. Create `declared_in` edges linking dependencies to their source manifests
+     */
+    parseAll(): Promise<ManifestParseResult>;
+}
+export {};
+//# sourceMappingURL=parser.d.ts.map

package/dist/security/manifest/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../../src/security/manifest/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,uBAAuB,EAAgC,MAAM,WAAW,CAAC;AAclF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAiLtE;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAyC5D;AAYD;;GAEG;AACH,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACjC,yDAAyD;IACzD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,sBAAsB,EAAE,CA2C1F;AAID;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAuBlD;;OAEG;IACH,UAAU,IAAI,uBAAuB;IAIrC;;;;;;;;;OASG;IACG,QAAQ,IAAI,OAAO,CAAC,mBAAmB,CAAC;CAkH/C"}

package/dist/security/manifest/plugins/cargo.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a Cargo.toml manifest and extract dependency declarations
+ * with version constraints, scopes, and resolved versions from Cargo.lock.
+ *
+ * @param manifestPath - Absolute path to the Cargo.toml file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseCargoManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=cargo.d.ts.map

package/dist/security/manifest/plugins/cargo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cargo.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/cargo.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAkBpD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuC7B"}

package/dist/security/manifest/plugins/composer.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a composer.json manifest and extract package declarations with
+ * version constraints, scopes, and resolved versions from composer.lock.
+ *
+ * @param manifestPath - Absolute path to the composer.json file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseComposerManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=composer.d.ts.map

package/dist/security/manifest/plugins/composer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composer.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/composer.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoE7B"}

package/dist/security/manifest/plugins/go.d.ts

@@ -0,0 +1,12 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a go.mod manifest and extract dependency declarations with version
+ * information. In Go modules, the version declared in go.mod is the resolved
+ * version (pinned), so declaredConstraint and resolvedVersion are the same.
+ *
+ * @param manifestPath - Absolute path to the go.mod file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version information
+ */
+export declare function parseGoManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=go.d.ts.map

package/dist/security/manifest/plugins/go.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/go.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA0C7B"}

package/dist/security/manifest/plugins/gradle.d.ts

@@ -0,0 +1,12 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a Gradle build script (`build.gradle` or `build.gradle.kts`) and extract
+ * dependency declarations with version constraints, scopes, and resolved versions
+ * from `gradle.lockfile`.
+ *
+ * @param manifestPath - Absolute path to the build.gradle or build.gradle.kts file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseGradleManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=gradle.d.ts.map

package/dist/security/manifest/plugins/gradle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gradle.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/gradle.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA0CpD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAmD7B"}

package/dist/security/manifest/plugins/hex.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a mix.exs manifest and extract package declarations with
+ * version constraints, scopes, and resolved versions from mix.lock.
+ *
+ * @param manifestPath - Absolute path to the mix.exs file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseHexManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=hex.d.ts.map

package/dist/security/manifest/plugins/hex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hex.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/hex.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAiC7B"}

package/dist/security/manifest/plugins/maven.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a Maven pom.xml manifest and extract dependency declarations
+ * with groupId, artifactId, version constraints, and scopes.
+ *
+ * @param manifestPath - Absolute path to the pom.xml file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseMavenManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=maven.d.ts.map

package/dist/security/manifest/plugins/maven.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maven.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/maven.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAyCpD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA8E7B"}

package/dist/security/manifest/plugins/npm.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse an npm package.json manifest and extract dependency declarations
+ * with version constraints, scopes, and resolved versions from lock files.
+ *
+ * @param manifestPath - Absolute path to the package.json file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseNpmManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=npm.d.ts.map

package/dist/security/manifest/plugins/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/npm.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAgBpD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAsG7B"}

package/dist/security/manifest/plugins/nuget.d.ts

@@ -0,0 +1,12 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a .csproj manifest and extract NuGet dependency declarations
+ * with version constraints, scopes, and resolved versions from packages.lock.json.
+ * Also parses a packages.config in the same directory if present.
+ *
+ * @param manifestPath - Absolute path to the .csproj file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseNugetManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=nuget.d.ts.map

package/dist/security/manifest/plugins/nuget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nuget.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/nuget.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA6D7B"}

package/dist/security/manifest/plugins/pip.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a pip requirements.txt manifest and extract dependency declarations
+ * with version constraints.
+ *
+ * @param manifestPath - Absolute path to the requirements.txt file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parsePipManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=pip.d.ts.map

package/dist/security/manifest/plugins/pip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pip.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/pip.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAyBpD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAwC7B"}

package/dist/security/manifest/plugins/pubspec.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a pubspec.yaml manifest and extract package declarations with
+ * version constraints, scopes, and resolved versions from pubspec.lock.
+ *
+ * @param manifestPath - Absolute path to the pubspec.yaml file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parsePubspecManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=pubspec.d.ts.map

package/dist/security/manifest/plugins/pubspec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pubspec.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/pubspec.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA4C7B"}

package/dist/security/manifest/plugins/pyproject.d.ts

@@ -0,0 +1,3 @@
+import type { ParsedDependency } from '../../types';
+export declare function parsePyprojectManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=pyproject.d.ts.map

package/dist/security/manifest/plugins/pyproject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pyproject.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/pyproject.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAOpD,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAiE7B"}

package/dist/security/manifest/plugins/rubygems.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a Gemfile manifest and extract gem declarations with version constraints,
+ * scopes, and resolved versions from Gemfile.lock.
+ *
+ * @param manifestPath - Absolute path to the Gemfile
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseRubygemsManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=rubygems.d.ts.map

package/dist/security/manifest/plugins/rubygems.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubygems.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/rubygems.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAqE7B"}

package/dist/security/manifest/plugins/swift.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedDependency } from '../../types';
+/**
+ * Parse a Package.swift manifest and extract package dependencies with
+ * version constraints and resolved versions from Package.resolved.
+ *
+ * @param manifestPath - Absolute path to the Package.swift file
+ * @param projectRoot - Absolute path to the project root directory
+ * @returns Array of parsed dependencies with version and scope information
+ */
+export declare function parseSwiftManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
+//# sourceMappingURL=swift.d.ts.map

package/dist/security/manifest/plugins/swift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"swift.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/swift.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAkBpD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA6B7B"}

package/dist/security/owasp.d.ts

@@ -0,0 +1,16 @@
+/**
+ * OWASP Top 10 (2021) Mapping Utility
+ *
+ * Maps CVE findings to OWASP categories and provides associated CWE IDs.
+ */
+export type OwaspCategory = 'A01' | 'A02' | 'A03' | 'A04' | 'A05' | 'A06' | 'A07' | 'A08' | 'A09' | 'A10';
+export interface OwaspMapping {
+    category: OwaspCategory;
+    name: string;
+    description: string;
+    cweIds: number[];
+}
+export declare const OWASP_TOP_10: Record<OwaspCategory, OwaspMapping>;
+/** Map a CVE's summary/description to the most likely OWASP category. */
+export declare function mapCveToOwasp(summary: string, packageName: string): OwaspCategory;
+//# sourceMappingURL=owasp.d.ts.map

package/dist/security/owasp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owasp.d.ts","sourceRoot":"","sources":["../../src/security/owasp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAE1G,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,YAAY,CA6D5D,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,CAWjF"}

package/dist/security/pipeline.d.ts

@@ -0,0 +1,37 @@
+/**
+ * SecurityPipeline — Orchestrates the security analysis phases.
+ *
+ * Phases (in order):
+ *   1. Manifest parsing — discover and parse dependency manifests
+ *   2. Dependency integration — link dependencies to code symbols
+ *   3. Vulnerability enrichment — query databases for CVEs (if securityAutoEnrich)
+ *   4. Reachability analysis — determine if vulnerable code is reachable
+ *
+ * Reports progress via callback and returns a SecurityResult with counts and duration.
+ *
+ * Requirements: 9.3, 9.5
+ */
+import type { GraphDatabase } from '../db/database';
+import type { KiroGraphConfig } from '../config';
+import type { SecurityResult } from './types';
+/**
+ * SecurityPipeline orchestrates the full security analysis workflow.
+ */
+export declare class SecurityPipeline {
+    private readonly db;
+    private readonly config;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, config: KiroGraphConfig, projectRoot: string);
+    /**
+     * Run the full security analysis pipeline.
+     *
+     * @param onProgress - Optional callback reporting (phase, current, total)
+     * @returns SecurityResult with counts and duration
+     */
+    run(onProgress?: (phase: string, current: number, total: number) => void): Promise<SecurityResult>;
+    /**
+     * Create vulnerability database adapters based on config.
+     */
+    private createVulnAdapters;
+}
+//# sourceMappingURL=pipeline.d.ts.map

package/dist/security/pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/security/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAQ9C;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM;IAM3E;;;;;OAKG;IACG,GAAG,CACP,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GACnE,OAAO,CAAC,cAAc,CAAC;IAmF1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAqB3B"}

package/dist/security/reachability.d.ts

@@ -0,0 +1,67 @@
+/**
+ * KiroGraph-Sec Reachability Analyzer
+ *
+ * Traverses the knowledge graph from application entry points to determine
+ * whether vulnerable dependencies are reachable through actual code paths.
+ * Produces reachability verdicts and impact summaries enriched with
+ * architectural layer context.
+ *
+ * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6, 5.1, 5.2, 5.3, 5.4, 5.5
+ */
+import type { GraphDatabase } from '../db/database';
+import type { KiroGraphConfig } from '../config';
+import type { ReachabilityResult, ImpactSummary } from './types';
+/**
+ * ReachabilityAnalyzer traverses the knowledge graph from entry points
+ * toward affected dependency nodes to determine reachability verdicts.
+ */
+export declare class ReachabilityAnalyzer {
+    private readonly db;
+    private readonly config;
+    constructor(db: GraphDatabase, config: KiroGraphConfig);
+    /**
+     * Analyze reachability for a single Vulnerability_Node.
+     *
+     * 1. Find the Dependency_Node linked via `has_vulnerability` edge
+     * 2. Find all Entry_Points in the graph
+     * 3. BFS from each entry point toward the dependency node
+     * 4. Assign verdict based on path existence and unresolved imports
+     *
+     * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6
+     */
+    analyze(vulnerabilityNodeId: string): Promise<ReachabilityResult>;
+    /**
+     * Produce impact summary for an affected vulnerability.
+     *
+     * Returns null if the vulnerability is not affected.
+     * Reads layer assignments from `arch_file_layers` table.
+     *
+     * Requirements: 5.1, 5.2, 5.3, 5.4, 5.5
+     */
+    getImpactSummary(vulnerabilityNodeId: string): Promise<ImpactSummary | null>;
+    /**
+     * Analyze all Vulnerability_Nodes in the graph.
+     *
+     * Iterates all vulnerability nodes and calls analyze() for each.
+     */
+    analyzeAll(): Promise<Map<string, ReachabilityResult>>;
+    /**
+     * BFS from a single entry point toward the dependency node.
+     *
+     * Uses outgoing edges of types: calls, imports, references.
+     * Visits each node at most once (handles cycles).
+     * Tracks unresolved imports encountered during traversal.
+     *
+     * Returns the shortest path if found, plus any unresolved symbols encountered.
+     */
+    private bfsFromEntryPoint;
+    /**
+     * Store reachability result in sec_reachability table.
+     */
+    private storeReachabilityResult;
+    /**
+     * Store impact summary in sec_impact table.
+     */
+    private storeImpactSummary;
+}
+//# sourceMappingURL=reachability.d.ts.map

package/dist/security/reachability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachability.d.ts","sourceRoot":"","sources":["../../src/security/reachability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAGV,kBAAkB,EAClB,aAAa,EACd,MAAM,SAAS,CAAC;AAWjB;;;GAGG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;gBAE7B,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe;IAKtD;;;;;;;;;OASG;IACG,OAAO,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmFvE;;;;;;;OAOG;IACG,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA2FlF;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAgB5D;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IA2DzB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAoB/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAkB3B"}

package/dist/security/remediation.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Remediation SLA Tracker
+ *
+ * Tracks how long open vulnerabilities have been known, when a fix became
+ * available, and whether remediation is overdue based on severity-based SLA
+ * thresholds.
+ *
+ * SLA thresholds:
+ *   critical (CVSS ≥ 9)  → 7 days
+ *   high     (CVSS ≥ 7)  → 30 days
+ *   medium   (CVSS ≥ 4)  → 90 days
+ *   low / unknown        → 180 days
+ */
+import type { GraphDatabase } from '../db/database';
+export interface RemediationStatus {
+    cveId: string;
+    packageName: string;
+    severity: number | null;
+    riskScore: number | null;
+    firstDetectedAt: number | null;
+    daysOpen: number | null;
+    fixAvailableSince: number | null;
+    daysWithFixAvailable: number | null;
+    isOverdue: boolean;
+    slaStatus: 'ok' | 'warning' | 'overdue' | 'no_fix';
+    slaDeadline: number | null;
+}
+export declare class RemediationTracker {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    /**
+     * Called when a vulnerability is first inserted.
+     * Sets first_detected_at if not already set, and fix_available_since if a
+     * fixed_version is provided and fix_available_since is not yet recorded.
+     */
+    markDetected(vulnNodeId: string, fixedVersion: string | null): void;
+    /**
+     * Get remediation status for all open (non-remediated, non-suppressed)
+     * vulnerabilities that have been detected.
+     */
+    getStatus(): RemediationStatus[];
+    /**
+     * SLA thresholds by CVSS severity:
+     *   critical (≥ 9)  → 7 days
+     *   high (≥ 7)      → 30 days
+     *   medium (≥ 4)    → 90 days
+     *   low / unknown   → 180 days
+     */
+    getSlaThresholdDays(severity: number | null): number;
+}
+//# sourceMappingURL=remediation.d.ts.map

package/dist/security/remediation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../src/security/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACnD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAID,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAE9C;;;;OAIG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAuBnE;;;OAGG;IACH,SAAS,IAAI,iBAAiB,EAAE;IAgFhC;;;;;;OAMG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM;CAOrD"}

package/dist/security/secrets.d.ts

@@ -0,0 +1,38 @@
+/**
+ * KiroGraph-Sec Secrets Scanner
+ *
+ * Regex-based secret detection that scans source files and enriches findings
+ * with call graph context (containing function + reachability from entry points).
+ */
+import type { GraphDatabase } from '../db/database';
+export interface SecretFinding {
+    filePath: string;
+    line: number;
+    column: number;
+    type: string;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    /** Redacted: first 4 chars of the matched value + "****" */
+    snippet: string;
+    nodeId?: string;
+    nodeName?: string;
+    reachableFromEntryPoints: string[];
+    entryPointCount: number;
+}
+export interface SecretsResult {
+    findings: SecretFinding[];
+    filesScanned: number;
+    totalFindings: number;
+    criticalCount: number;
+    highCount: number;
+}
+export declare class SecretsScanner {
+    private readonly db;
+    private readonly projectRoot;
+    constructor(db: GraphDatabase, projectRoot: string);
+    scan(options?: {
+        includeTests?: boolean;
+    }): Promise<SecretsResult>;
+    private findContainingNode;
+    private findEntryPoints;
+}
+//# sourceMappingURL=secrets.d.ts.map

package/dist/security/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/security/secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AA0DD,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,EAAE,EAAE,aAAa,EACjB,WAAW,EAAE,MAAM;IAGhC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAgGxE,OAAO,CAAC,kBAAkB;IAkB1B,OAAO,CAAC,eAAe;CAoBxB"}