kirograph 0.19.0 → 0.20.0

package/dist/security/staleness.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Dependency Staleness Checker
+ *
+ * Queries public package registries (npm, PyPI, crates.io, RubyGems, Packagist)
+ * to determine the latest published version and compute a staleness score for
+ * each dependency tracked in sec_dependencies.
+ *
+ * Score formula:
+ *   score = min(majorVersionsBehind * 0.2, 0.6)   // up to 0.6 for version lag
+ *         + min(monthsSinceLatest / 36, 0.4)        // up to 0.4 for time lag
+ *   score = min(score, 1.0)
+ */
+import type { GraphDatabase } from '../db/database';
+export interface StalenessResult {
+    packageName: string;
+    ecosystem: string;
+    resolvedVersion: string;
+    latestVersion: string;
+    latestPublished: number;
+    stalenessScore: number;
+    majorVersionsBehind: number;
+    monthsSinceLatest: number;
+}
+export declare class StalenessChecker {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    /**
+     * Check all dependencies in sec_dependencies that have a supported ecosystem.
+     * Returns a summary of checked/stale counts and any errors encountered.
+     */
+    checkAll(): Promise<{
+        checked: number;
+        stale: number;
+        errors: string[];
+    }>;
+    /**
+     * Check a single dependency by node_id. Returns null if the ecosystem is
+     * not supported or the dependency is not found.
+     */
+    checkOne(nodeId: string): Promise<StalenessResult | null>;
+    private _checkRow;
+}
+//# sourceMappingURL=staleness.d.ts.map

package/dist/security/staleness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staleness.d.ts","sourceRoot":"","sources":["../../src/security/staleness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAqJD,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAE9C;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA+B/E;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAqBjD,SAAS;CAkDxB"}

package/dist/security/supply-chain.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Supply Chain Health Checker
+ *
+ * Queries OpenSSF Scorecard and registry APIs to assess the health of
+ * dependencies: maintenance activity, maintainer count, package age, and
+ * overall supply-chain risk level.
+ */
+import type { GraphDatabase } from '../db/database';
+export interface SupplyChainRisk {
+    packageName: string;
+    ecosystem: string;
+    nodeId: string;
+    scorecardScore: number | null;
+    scorecardChecks: Record<string, number> | null;
+    daysSinceLastCommit: number | null;
+    isAbandoned: boolean;
+    maintainerCount: number | null;
+    isSingleMaintainer: boolean;
+    publishedAt: string | null;
+    isVeryNew: boolean;
+    riskLevel: 'critical' | 'high' | 'medium' | 'low' | 'unknown';
+    riskReasons: string[];
+}
+export declare class SupplyChainChecker {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    checkAll(): Promise<{
+        results: SupplyChainRisk[];
+        errors: string[];
+    }>;
+    checkOne(packageName: string, ecosystem: string): Promise<SupplyChainRisk | null>;
+    private _check;
+}
+//# sourceMappingURL=supply-chain.d.ts.map

package/dist/security/supply-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supply-chain.d.ts","sourceRoot":"","sources":["../../src/security/supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IAEf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAE/C,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,OAAO,CAAC;IAE5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IAEnB,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;IAC9D,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAuQD,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,QAAQ,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA2BrE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAUzE,MAAM;CAgErB"}

package/dist/security/suppressions.d.ts

@@ -0,0 +1,18 @@
+export interface Suppression {
+    cveId: string;
+    reason?: string;
+    suppressedAt: string;
+    expiresAt?: string;
+}
+export declare class SuppressionManager {
+    private readonly projectRoot;
+    constructor(projectRoot: string);
+    private get filePath();
+    load(): Suppression[];
+    save(suppressions: Suppression[]): void;
+    add(cveId: string, reason?: string, expiresAt?: string): void;
+    remove(cveId: string): boolean;
+    isSuppressed(cveId: string): boolean;
+    getActive(): Suppression[];
+}
+//# sourceMappingURL=suppressions.d.ts.map

package/dist/security/suppressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/security/suppressions.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,MAAM;IAEhD,OAAO,KAAK,QAAQ,GAEnB;IAED,IAAI,IAAI,WAAW,EAAE;IA2BrB,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI;IAQvC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAoB7D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAS9B,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIpC,SAAS,IAAI,WAAW,EAAE;CAG3B"}

package/dist/security/types.d.ts

@@ -0,0 +1,144 @@
+/**
+ * KiroGraph-Sec Type Definitions
+ *
+ * Interfaces for the security analysis module including manifest parsing,
+ * vulnerability detection, reachability analysis, and CycloneDX export.
+ */
+export interface ParsedDependency {
+    name: string;
+    declaredConstraint: string;
+    resolvedVersion?: string;
+    scope: 'production' | 'development' | 'optional';
+    ecosystem: string;
+    sourceManifest: string;
+    license?: string;
+}
+export interface ManifestParseResult {
+    dependenciesCreated: number;
+    manifestsParsed: number;
+    warnings: Array<{
+        file: string;
+        line?: number;
+        message: string;
+    }>;
+    errors: Array<{
+        file: string;
+        message: string;
+    }>;
+}
+export interface IntegrationResult {
+    importsEdgesCreated: number;
+    referencesEdgesCreated: number;
+}
+export interface TransitiveResult {
+    dependsOnEdgesCreated: number;
+    incompleteNodes: string[];
+}
+export interface CleanupResult {
+    nodesRemoved: number;
+    edgesRemoved: number;
+}
+export interface CVERecord {
+    id: string;
+    severity: number;
+    affectedVersionRanges: VersionRange[];
+    fixedVersion?: string;
+    summary: string;
+}
+export interface VersionRange {
+    introduced?: string;
+    fixed?: string;
+    lastAffected?: string;
+}
+export interface EnrichmentResult {
+    vulnerabilitiesFound: number;
+    dependenciesChecked: number;
+    errors: Array<{
+        dependency: string;
+        database: string;
+        error: string;
+    }>;
+    staleNodes: string[];
+}
+export type ReachabilityVerdict = 'affected' | 'not_affected' | 'under_investigation';
+export interface ReachabilityPath {
+    entryPoint: string;
+    path: string[];
+}
+export interface ReachabilityResult {
+    verdict: ReachabilityVerdict;
+    paths: ReachabilityPath[];
+    unresolvedSymbols: string[];
+    reachingEntryPointCount: number;
+}
+export interface ImpactSummary {
+    affectedLayers: string[];
+    affectedEntryPoints: string[];
+    distinctPathCount: number;
+}
+export interface SecurityResult {
+    manifestsDiscovered: number;
+    dependenciesCreated: number;
+    vulnerabilitiesFound: number;
+    affectedCount: number;
+    notAffectedCount: number;
+    underInvestigationCount: number;
+    duration: number;
+}
+export interface SBOMMetadata {
+    toolName: string;
+    toolVersion: string;
+    timestamp: string;
+    projectName: string;
+}
+export interface CycloneDXSBOM {
+    bomFormat: 'CycloneDX';
+    specVersion: '1.5';
+    version: number;
+    metadata: Record<string, unknown>;
+    components: CycloneDXComponent[];
+    dependencies: CycloneDXDependencyEntry[];
+}
+export interface CycloneDXComponent {
+    type: 'library';
+    name: string;
+    version: string;
+    purl: string;
+    scope?: 'required' | 'optional';
+    properties?: Array<{
+        name: string;
+        value: string;
+    }>;
+}
+export interface CycloneDXDependencyEntry {
+    ref: string;
+    dependsOn?: string[];
+}
+export interface CycloneDXVEX {
+    bomFormat: 'CycloneDX';
+    specVersion: '1.5';
+    version: number;
+    metadata: Record<string, unknown>;
+    vulnerabilities: CycloneDXVulnerability[];
+}
+export interface CycloneDXVulnerability {
+    id: string;
+    source?: {
+        name: string;
+        url?: string;
+    };
+    ratings?: Array<{
+        score: number;
+        severity?: string;
+        method?: string;
+    }>;
+    analysis?: {
+        state: 'affected' | 'not_affected' | 'under_investigation';
+        justification?: string;
+        detail?: string;
+    };
+    affects?: Array<{
+        ref: string;
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,YAAY,GAAG,aAAa,GAAG,UAAU,CAAC;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAID,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAID,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,YAAY,EAAE,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,cAAc,GAAG,qBAAqB,CAAC;AAEtF,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,cAAc;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,YAAY,EAAE,wBAAwB,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAChC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,eAAe,EAAE,sBAAsB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,QAAQ,CAAC,EAAE;QACT,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,qBAAqB,CAAC;QAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClC"}

package/dist/security/vuln/client.d.ts

@@ -0,0 +1,90 @@
+/**
+ * VulnerabilityDatabaseClient
+ *
+ * Orchestrates vulnerability enrichment by querying configured databases,
+ * merging and deduplicating results by CVE identifier, creating Vulnerability_Nodes
+ * linked to affected Dependency_Nodes, and handling unreachable databases gracefully.
+ *
+ * Requirements: 3.1, 3.2, 3.3, 3.4, 3.5, 3.7
+ */
+import type { GraphDatabase } from '../../db/database';
+import type { CVERecord, EnrichmentResult } from '../types';
+import type { VulnDatabaseAdapter } from './types';
+/**
+ * Compute a combined risk score (0.0–10.0) for a vulnerability.
+ *
+ * Formula:
+ *   risk = reachability_factor × (0.4 × cvss_normalized + 0.6 × epss) × staleness_bonus
+ *   scaled to 0–10: min(risk × 10, 10.0)
+ *
+ * @param cvss        - CVSS base score (0.0–10.0), null treated as 5.0
+ * @param epss        - EPSS exploitation probability (0.0–1.0), null treated as 0.0
+ * @param verdict     - Reachability verdict or null/undefined
+ * @param staleness   - Dependency staleness score (0.0–1.0), null treated as 0.0
+ */
+export declare function computeRiskScore(cvss: number | null | undefined, epss: number | null | undefined, verdict: string | null | undefined, staleness: number | null | undefined): number;
+export declare class VulnerabilityDatabaseClient {
+    private readonly adapters;
+    private readonly db;
+    private readonly timeoutMs;
+    constructor(adapters: VulnDatabaseAdapter[], db: GraphDatabase, timeoutMs?: number);
+    /**
+     * Enrich all Dependency_Nodes with vulnerability data.
+     *
+     * Uses batch queries (up to 1000 per HTTP request) when the adapter supports
+     * `queryBatch`. Falls back to sequential single queries per dependency if batch
+     * is unavailable or fails. Results are deduplicated by CVE ID across adapters.
+     */
+    enrichAll(): Promise<EnrichmentResult>;
+    /**
+     * Fetch EPSS scores for all stored vulnerabilities and update the database.
+     */
+    private enrichEpss;
+    /**
+     * Compute and persist combined risk scores for all stored vulnerabilities.
+     * Called after EPSS enrichment so epss_score values are up to date.
+     */
+    private computeRiskScores;
+    /**
+     * Batch enrichment path: groups deps into chunks of BATCH_CHUNK_SIZE and sends
+     * one HTTP request per chunk. Falls back to sequential on batch failure.
+     */
+    private enrichAllBatch;
+    /**
+     * Sequential enrichment path: queries one dependency at a time.
+     * Used when the adapter does not support queryBatch, or as a fallback.
+     */
+    private enrichAllSequential;
+    /**
+     * Enrich a single Dependency_Node with vulnerability data.
+     *
+     * @param dependencyNodeId - The node ID of the dependency to enrich
+     * @returns Array of CVE records found for this dependency
+     */
+    enrichOne(dependencyNodeId: string): Promise<CVERecord[]>;
+    /**
+     * Query a set of adapters for a single dependency.
+     * Handles timeouts and unreachable databases gracefully.
+     * Defaults to all configured adapters when adapterList is omitted.
+     */
+    private queryAdaptersForDependency;
+    /**
+     * Mark a dependency node as having stale vulnerability data.
+     * Retains cached data but sets the stale flag with timestamp.
+     */
+    private markDependencyStale;
+    /**
+     * Deduplicate CVE records by their ID.
+     * When the same CVE is reported by multiple databases, keep the first occurrence.
+     */
+    private deduplicateByCveId;
+    /**
+     * Create or update a Vulnerability_Node and link it to the affected dependency.
+     *
+     * - Creates a node in `nodes` table with kind='vulnerability', ID format `vuln:<cve_id>`
+     * - Inserts a row in `sec_vulnerabilities` with CVE metadata
+     * - Creates a `has_vulnerability` edge from the Dependency_Node to the Vulnerability_Node
+     */
+    private upsertVulnerabilityNode;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/security/vuln/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/security/vuln/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAc,MAAM,SAAS,CAAC;AAM/D;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,MAAM,CAoBR;AAaD,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGjC,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,EAAE,EAAE,aAAa,EACjB,SAAS,GAAE,MAAc;IAO3B;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA4C5C;;OAEG;YACW,UAAU;IA+BxB;;;OAGG;YACW,iBAAiB;IAsB/B;;;OAGG;YACW,cAAc;IA4C5B;;;OAGG;YACW,mBAAmB;IAkBjC;;;;;OAKG;IACG,SAAS,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAiD/D;;;;OAIG;YACW,0BAA0B;IA6CxC;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;CAuDhC"}

package/dist/security/vuln/client.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/security/vuln/client.ts"],
-  "sourcesContent": ["/**\n * VulnerabilityDatabaseClient\n *\n * Orchestrates vulnerability enrichment by querying configured databases,\n * merging and deduplicating results by CVE identifier, creating Vulnerability_Nodes\n * linked to affected Dependency_Nodes, and handling unreachable databases gracefully.\n *\n * Requirements: 3.1, 3.2, 3.3, 3.4, 3.5, 3.7\n */\n\nimport type { GraphDatabase } from '../../db/database';\nimport type { Edge } from '../../types';\nimport type { CVERecord, EnrichmentResult } from '../types';\nimport type { VulnDatabaseAdapter, BatchQuery } from './types';\nimport { logError, logWarn } from '../../errors';\nimport { EpssClient } from './epss-client';\n\nconst BATCH_CHUNK_SIZE = 1000;\n\n/**\n * Compute a combined risk score (0.0\u201310.0) for a vulnerability.\n *\n * Formula:\n *   risk = reachability_factor \u00D7 (0.4 \u00D7 cvss_normalized + 0.6 \u00D7 epss) \u00D7 staleness_bonus\n *   scaled to 0\u201310: min(risk \u00D7 10, 10.0)\n *\n * @param cvss        - CVSS base score (0.0\u201310.0), null treated as 5.0\n * @param epss        - EPSS exploitation probability (0.0\u20131.0), null treated as 0.0\n * @param verdict     - Reachability verdict or null/undefined\n * @param staleness   - Dependency staleness score (0.0\u20131.0), null treated as 0.0\n */\nexport function computeRiskScore(\n  cvss: number | null | undefined,\n  epss: number | null | undefined,\n  verdict: string | null | undefined,\n  staleness: number | null | undefined,\n): number {\n  const cvssNormalized = (cvss ?? 5.0) / 10.0;\n  const epssValue = epss ?? 0.0;\n\n  let reachabilityFactor: number;\n  if (verdict === 'affected') {\n    reachabilityFactor = 1.0;\n  } else if (verdict === 'under_investigation') {\n    reachabilityFactor = 0.5;\n  } else if (verdict === 'not_affected') {\n    reachabilityFactor = 0.1;\n  } else {\n    // no verdict\n    reachabilityFactor = 0.3;\n  }\n\n  const stalenessBonus = 1.0 + ((staleness ?? 0) * 0.2);\n\n  const raw = reachabilityFactor * (0.4 * cvssNormalized + 0.6 * epssValue) * stalenessBonus;\n  return Math.min(raw * 10, 10.0);\n}\n\n/**\n * Dependency row from sec_dependencies table.\n */\ninterface DependencyRow {\n  node_id: string;\n  ecosystem: string;\n  package_name: string;\n  resolved_version: string | null;\n  declared_constraint: string;\n}\n\nexport class VulnerabilityDatabaseClient {\n  private readonly adapters: VulnDatabaseAdapter[];\n  private readonly db: GraphDatabase;\n  private readonly timeoutMs: number;\n\n  constructor(\n    adapters: VulnDatabaseAdapter[],\n    db: GraphDatabase,\n    timeoutMs: number = 30000,\n  ) {\n    this.adapters = adapters;\n    this.db = db;\n    this.timeoutMs = timeoutMs;\n  }\n\n  /**\n   * Enrich all Dependency_Nodes with vulnerability data.\n   *\n   * Uses batch queries (up to 1000 per HTTP request) when the adapter supports\n   * `queryBatch`. Falls back to sequential single queries per dependency if batch\n   * is unavailable or fails. Results are deduplicated by CVE ID across adapters.\n   */\n  async enrichAll(): Promise<EnrichmentResult> {\n    const rawDb = this.db.getRawDb();\n    const result: EnrichmentResult = {\n      vulnerabilitiesFound: 0,\n      dependenciesChecked: 0,\n      errors: [],\n      staleNodes: [],\n    };\n\n    const depRows: DependencyRow[] = rawDb.all(\n      `SELECT node_id, ecosystem, package_name, resolved_version, declared_constraint\n       FROM sec_dependencies`,\n    );\n\n    // Filter out deps with no usable version\n    const queryableDeps = depRows.filter(d => d.resolved_version || d.declared_constraint);\n\n    for (const adapter of this.adapters) {\n      if (adapter.queryBatch) {\n        await this.enrichAllBatch(adapter, queryableDeps, result);\n      } else {\n        await this.enrichAllSequential(adapter, queryableDeps, result);\n      }\n    }\n\n    // Record lastVulnCheck for all queried deps (do once, after all adapters)\n    const now = Date.now();\n    for (const dep of queryableDeps) {\n      rawDb.run(\n        `UPDATE sec_dependencies SET last_vuln_check = ? WHERE node_id = ?`,\n        [now, dep.node_id],\n      );\n    }\n    result.dependenciesChecked = queryableDeps.length;\n\n    // Enrich stored vulnerabilities with EPSS scores\n    await this.enrichEpss(rawDb);\n\n    // Compute combined risk scores after all enrichment is done\n    await this.computeRiskScores(rawDb);\n\n    return result;\n  }\n\n  /**\n   * Fetch EPSS scores for all stored vulnerabilities and update the database.\n   */\n  private async enrichEpss(rawDb: any): Promise<void> {\n    try {\n      const cveRows: Array<{ cve_id: string }> = rawDb.all(\n        `SELECT cve_id FROM sec_vulnerabilities`,\n      );\n\n      if (cveRows.length === 0) {\n        return;\n      }\n\n      const cveIds = cveRows.map(r => r.cve_id);\n      const epssClient = new EpssClient();\n      const scores = await epssClient.fetchScores(cveIds);\n\n      if (scores.size === 0) {\n        return;\n      }\n\n      const fetchedAt = Date.now();\n      for (const [cveId, { score, percentile }] of scores) {\n        rawDb.run(\n          `UPDATE sec_vulnerabilities SET epss_score = ?, epss_percentile = ?, epss_fetched_at = ? WHERE cve_id = ?`,\n          [score, percentile, fetchedAt, cveId],\n        );\n      }\n    } catch (error: unknown) {\n      const msg = error instanceof Error ? error.message : String(error);\n      logWarn(`[sec:epss] EPSS enrichment failed (non-critical): ${msg}`);\n    }\n  }\n\n  /**\n   * Compute and persist combined risk scores for all stored vulnerabilities.\n   * Called after EPSS enrichment so epss_score values are up to date.\n   */\n  private async computeRiskScores(rawDb: any): Promise<void> {\n    const rows: Array<{\n      node_id: string;\n      severity_score: number | null;\n      epss_score: number | null;\n      verdict: string | null;\n      staleness_score: number | null;\n    }> = rawDb.all(`\n      SELECT v.node_id, v.severity_score, v.epss_score,\n             r.verdict,\n             d.staleness_score\n      FROM sec_vulnerabilities v\n      LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n      LEFT JOIN sec_dependencies d ON d.node_id = e.source\n      LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n    `);\n    for (const row of rows) {\n      const score = computeRiskScore(row.severity_score, row.epss_score, row.verdict, row.staleness_score);\n      rawDb.run(`UPDATE sec_vulnerabilities SET risk_score = ? WHERE node_id = ?`, [score, row.node_id]);\n    }\n  }\n\n  /**\n   * Batch enrichment path: groups deps into chunks of BATCH_CHUNK_SIZE and sends\n   * one HTTP request per chunk. Falls back to sequential on batch failure.\n   */\n  private async enrichAllBatch(\n    adapter: VulnDatabaseAdapter & Required<Pick<VulnDatabaseAdapter, 'queryBatch'>>,\n    deps: DependencyRow[],\n    result: EnrichmentResult,\n  ): Promise<void> {\n    const rawDb = this.db.getRawDb();\n\n    for (let i = 0; i < deps.length; i += BATCH_CHUNK_SIZE) {\n      const chunk = deps.slice(i, i + BATCH_CHUNK_SIZE);\n      const queries: BatchQuery[] = chunk.map(dep => ({\n        ecosystem: dep.ecosystem,\n        packageName: dep.package_name,\n        version: dep.resolved_version || dep.declared_constraint,\n      }));\n\n      let batchResults: Array<CVERecord[]>;\n      try {\n        const controller = new AbortController();\n        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);\n        try {\n          batchResults = await adapter.queryBatch(queries, controller.signal);\n        } finally {\n          clearTimeout(timeout);\n        }\n      } catch (error: unknown) {\n        // Batch failed \u2014 fall back to sequential for this chunk\n        const msg = error instanceof Error ? error.message : String(error);\n        logWarn(`[sec:vuln] ${adapter.name} batch query failed (${msg}), falling back to sequential for chunk of ${chunk.length}`);\n        await this.enrichAllSequential(adapter, chunk, result);\n        continue;\n      }\n\n      for (let j = 0; j < chunk.length; j++) {\n        const dep = chunk[j]!;\n        const cveRecords = batchResults[j] ?? [];\n        const uniqueCves = this.deduplicateByCveId(cveRecords);\n        for (const cve of uniqueCves) {\n          this.upsertVulnerabilityNode(rawDb, cve, dep.node_id);\n          result.vulnerabilitiesFound++;\n        }\n      }\n    }\n  }\n\n  /**\n   * Sequential enrichment path: queries one dependency at a time.\n   * Used when the adapter does not support queryBatch, or as a fallback.\n   */\n  private async enrichAllSequential(\n    adapter: VulnDatabaseAdapter,\n    deps: DependencyRow[],\n    result: EnrichmentResult,\n  ): Promise<void> {\n    const rawDb = this.db.getRawDb();\n\n    for (const dep of deps) {\n      const version = dep.resolved_version || dep.declared_constraint;\n      const cveRecords = await this.queryAdaptersForDependency(dep, version, result, [adapter]);\n      const uniqueCves = this.deduplicateByCveId(cveRecords);\n      for (const cve of uniqueCves) {\n        this.upsertVulnerabilityNode(rawDb, cve, dep.node_id);\n        result.vulnerabilitiesFound++;\n      }\n    }\n  }\n\n  /**\n   * Enrich a single Dependency_Node with vulnerability data.\n   *\n   * @param dependencyNodeId - The node ID of the dependency to enrich\n   * @returns Array of CVE records found for this dependency\n   */\n  async enrichOne(dependencyNodeId: string): Promise<CVERecord[]> {\n    const rawDb = this.db.getRawDb();\n\n    const dep: DependencyRow | undefined = rawDb.get(\n      `SELECT node_id, ecosystem, package_name, resolved_version, declared_constraint\n       FROM sec_dependencies WHERE node_id = ?`,\n      [dependencyNodeId],\n    );\n\n    if (!dep) {\n      return [];\n    }\n\n    const version = dep.resolved_version || dep.declared_constraint;\n    if (!version) {\n      return [];\n    }\n\n    const enrichResult: EnrichmentResult = {\n      vulnerabilitiesFound: 0,\n      dependenciesChecked: 0,\n      errors: [],\n      staleNodes: [],\n    };\n\n    const cveRecords = await this.queryAdaptersForDependency(\n      dep,\n      version,\n      enrichResult,\n    );\n\n    // Deduplicate by CVE ID\n    const uniqueCves = this.deduplicateByCveId(cveRecords);\n\n    // Create Vulnerability_Nodes and edges\n    for (const cve of uniqueCves) {\n      this.upsertVulnerabilityNode(rawDb, cve, dep.node_id);\n    }\n\n    // Record lastVulnCheck timestamp\n    const now = Date.now();\n    rawDb.run(\n      `UPDATE sec_dependencies SET last_vuln_check = ? WHERE node_id = ?`,\n      [now, dep.node_id],\n    );\n\n    return uniqueCves;\n  }\n\n  /**\n   * Query a set of adapters for a single dependency.\n   * Handles timeouts and unreachable databases gracefully.\n   * Defaults to all configured adapters when adapterList is omitted.\n   */\n  private async queryAdaptersForDependency(\n    dep: DependencyRow,\n    version: string,\n    result: EnrichmentResult,\n    adapterList: VulnDatabaseAdapter[] = this.adapters,\n  ): Promise<CVERecord[]> {\n    const allRecords: CVERecord[] = [];\n\n    for (const adapter of adapterList) {\n      try {\n        const controller = new AbortController();\n        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);\n\n        try {\n          const records = await adapter.query(\n            dep.ecosystem,\n            dep.package_name,\n            version,\n            controller.signal,\n          );\n          allRecords.push(...records);\n        } finally {\n          clearTimeout(timeout);\n        }\n      } catch (error: unknown) {\n        // Handle unreachable database (Requirement 3.5)\n        const errorMessage = error instanceof Error ? error.message : String(error);\n        logError(\n          `[sec:vuln] Failed to query ${adapter.name} for ${dep.package_name}@${version}: ${errorMessage}`,\n        );\n\n        result.errors.push({\n          dependency: dep.package_name,\n          database: adapter.name,\n          error: errorMessage,\n        });\n\n        // Set vulnDataStale flag on the dependency node\n        this.markDependencyStale(dep.node_id, result);\n      }\n    }\n\n    return allRecords;\n  }\n\n  /**\n   * Mark a dependency node as having stale vulnerability data.\n   * Retains cached data but sets the stale flag with timestamp.\n   */\n  private markDependencyStale(nodeId: string, result: EnrichmentResult): void {\n    const rawDb = this.db.getRawDb();\n    const now = Date.now();\n\n    rawDb.run(\n      `UPDATE sec_dependencies\n       SET vuln_data_stale = 1, vuln_data_stale_since = ?\n       WHERE node_id = ?`,\n      [now, nodeId],\n    );\n\n    if (!result.staleNodes.includes(nodeId)) {\n      result.staleNodes.push(nodeId);\n    }\n\n    logWarn(\n      `[sec:vuln] Vulnerability data marked stale for dependency node ${nodeId}`,\n    );\n  }\n\n  /**\n   * Deduplicate CVE records by their ID.\n   * When the same CVE is reported by multiple databases, keep the first occurrence.\n   */\n  private deduplicateByCveId(records: CVERecord[]): CVERecord[] {\n    const seen = new Map<string, CVERecord>();\n    for (const record of records) {\n      if (!seen.has(record.id)) {\n        seen.set(record.id, record);\n      }\n    }\n    return [...seen.values()];\n  }\n\n  /**\n   * Create or update a Vulnerability_Node and link it to the affected dependency.\n   *\n   * - Creates a node in `nodes` table with kind='vulnerability', ID format `vuln:<cve_id>`\n   * - Inserts a row in `sec_vulnerabilities` with CVE metadata\n   * - Creates a `has_vulnerability` edge from the Dependency_Node to the Vulnerability_Node\n   */\n  private upsertVulnerabilityNode(\n    rawDb: any,\n    cve: CVERecord,\n    dependencyNodeId: string,\n  ): void {\n    const vulnNodeId = `vuln:${cve.id}`;\n    const now = Date.now();\n\n    // Truncate summary to 500 characters (Requirement 3.3)\n    const summary = cve.summary.length > 500\n      ? cve.summary.slice(0, 500)\n      : cve.summary;\n\n    // Determine source database from the first adapter that returned this CVE\n    // (in practice, the adapter name is not stored on CVERecord, so we use\n    // the first configured adapter's name as the source)\n    const sourceDatabase = this.adapters.length > 0 ? this.adapters[0].name : 'unknown';\n\n    // Upsert into nodes table\n    rawDb.run(\n      `INSERT OR REPLACE INTO nodes\n        (id, kind, name, qualified_name, file_path, language,\n         start_line, end_line, start_column, end_column,\n         is_exported, is_async, is_static, is_abstract, updated_at)\n       VALUES (?, 'vulnerability', ?, ?, '', 'unknown', 0, 0, 0, 0, 0, 0, 0, 0, ?)`,\n      [vulnNodeId, cve.id, cve.id, now],\n    );\n\n    // Upsert into sec_vulnerabilities table\n    const affectedRangesJson = JSON.stringify(cve.affectedVersionRanges);\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_vulnerabilities\n        (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)\n       VALUES (?, ?, ?, ?, ?, ?, ?)`,\n      [\n        vulnNodeId,\n        cve.id,\n        cve.severity,\n        affectedRangesJson,\n        cve.fixedVersion ?? null,\n        summary,\n        sourceDatabase,\n      ],\n    );\n\n    // Create has_vulnerability edge from Dependency_Node to Vulnerability_Node\n    const edge: Edge = {\n      source: dependencyNodeId,\n      target: vulnNodeId,\n      kind: 'has_vulnerability',\n      confidence: 'extracted',\n      confidenceScore: 1.0,\n    };\n    this.db.insertEdge(edge);\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,oBAAkC;AAClC,yBAA2B;AAE3B,MAAM,mBAAmB;AAclB,SAAS,iBACd,MACA,MACA,SACA,WACQ;AACR,QAAM,kBAAkB,QAAQ,KAAO;AACvC,QAAM,YAAY,QAAQ;AAE1B,MAAI;AACJ,MAAI,YAAY,YAAY;AAC1B,yBAAqB;AAAA,EACvB,WAAW,YAAY,uBAAuB;AAC5C,yBAAqB;AAAA,EACvB,WAAW,YAAY,gBAAgB;AACrC,yBAAqB;AAAA,EACvB,OAAO;AAEL,yBAAqB;AAAA,EACvB;AAEA,QAAM,iBAAiB,KAAQ,aAAa,KAAK;AAEjD,QAAM,MAAM,sBAAsB,MAAM,iBAAiB,MAAM,aAAa;AAC5E,SAAO,KAAK,IAAI,MAAM,IAAI,EAAI;AAChC;AAaO,MAAM,4BAA4B;AAAA,EAKvC,YACE,UACA,IACA,YAAoB,KACpB;AACA,SAAK,WAAW;AAChB,SAAK,KAAK;AACV,SAAK,YAAY;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,YAAuC;AAC3C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,SAA2B;AAAA,MAC/B,sBAAsB;AAAA,MACtB,qBAAqB;AAAA,MACrB,QAAQ,CAAC;AAAA,MACT,YAAY,CAAC;AAAA,IACf;AAEA,UAAM,UAA2B,MAAM;AAAA,MACrC;AAAA;AAAA,IAEF;AAGA,UAAM,gBAAgB,QAAQ,OAAO,OAAK,EAAE,oBAAoB,EAAE,mBAAmB;AAErF,eAAW,WAAW,KAAK,UAAU;AACnC,UAAI,QAAQ,YAAY;AACtB,cAAM,KAAK,eAAe,SAAS,eAAe,MAAM;AAAA,MAC1D,OAAO;AACL,cAAM,KAAK,oBAAoB,SAAS,eAAe,MAAM;AAAA,MAC/D;AAAA,IACF;AAGA,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,OAAO,eAAe;AAC/B,YAAM;AAAA,QACJ;AAAA,QACA,CAAC,KAAK,IAAI,OAAO;AAAA,MACnB;AAAA,IACF;AACA,WAAO,sBAAsB,cAAc;AAG3C,UAAM,KAAK,WAAW,KAAK;AAG3B,UAAM,KAAK,kBAAkB,KAAK;AAElC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,WAAW,OAA2B;AAClD,QAAI;AACF,YAAM,UAAqC,MAAM;AAAA,QAC/C;AAAA,MACF;AAEA,UAAI,QAAQ,WAAW,GAAG;AACxB;AAAA,MACF;AAEA,YAAM,SAAS,QAAQ,IAAI,OAAK,EAAE,MAAM;AACxC,YAAM,aAAa,IAAI,8BAAW;AAClC,YAAM,SAAS,MAAM,WAAW,YAAY,MAAM;AAElD,UAAI,OAAO,SAAS,GAAG;AACrB;AAAA,MACF;AAEA,YAAM,YAAY,KAAK,IAAI;AAC3B,iBAAW,CAAC,OAAO,EAAE,OAAO,WAAW,CAAC,KAAK,QAAQ;AACnD,cAAM;AAAA,UACJ;AAAA,UACA,CAAC,OAAO,YAAY,WAAW,KAAK;AAAA,QACtC;AAAA,MACF;AAAA,IACF,SAAS,OAAgB;AACvB,YAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,iCAAQ,qDAAqD,GAAG,EAAE;AAAA,IACpE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,kBAAkB,OAA2B;AACzD,UAAM,OAMD,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAQd;AACD,eAAW,OAAO,MAAM;AACtB,YAAM,QAAQ,iBAAiB,IAAI,gBAAgB,IAAI,YAAY,IAAI,SAAS,IAAI,eAAe;AACnG,YAAM,IAAI,mEAAmE,CAAC,OAAO,IAAI,OAAO,CAAC;AAAA,IACnG;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,eACZ,SACA,MACA,QACe;AACf,UAAM,QAAQ,KAAK,GAAG,SAAS;AAE/B,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,kBAAkB;AACtD,YAAM,QAAQ,KAAK,MAAM,GAAG,IAAI,gBAAgB;AAChD,YAAM,UAAwB,MAAM,IAAI,UAAQ;AAAA,QAC9C,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,SAAS,IAAI,oBAAoB,IAAI;AAAA,MACvC,EAAE;AAEF,UAAI;AACJ,UAAI;AACF,cAAM,aAAa,IAAI,gBAAgB;AACvC,cAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AACnE,YAAI;AACF,yBAAe,MAAM,QAAQ,WAAW,SAAS,WAAW,MAAM;AAAA,QACpE,UAAE;AACA,uBAAa,OAAO;AAAA,QACtB;AAAA,MACF,SAAS,OAAgB;AAEvB,cAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,mCAAQ,cAAc,QAAQ,IAAI,wBAAwB,GAAG,8CAA8C,MAAM,MAAM,EAAE;AACzH,cAAM,KAAK,oBAAoB,SAAS,OAAO,MAAM;AACrD;AAAA,MACF;AAEA,eAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAM,MAAM,MAAM,CAAC;AACnB,cAAM,aAAa,aAAa,CAAC,KAAK,CAAC;AACvC,cAAM,aAAa,KAAK,mBAAmB,UAAU;AACrD,mBAAW,OAAO,YAAY;AAC5B,eAAK,wBAAwB,OAAO,KAAK,IAAI,OAAO;AACpD,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,oBACZ,SACA,MACA,QACe;AACf,UAAM,QAAQ,KAAK,GAAG,SAAS;AAE/B,eAAW,OAAO,MAAM;AACtB,YAAM,UAAU,IAAI,oBAAoB,IAAI;AAC5C,YAAM,aAAa,MAAM,KAAK,2BAA2B,KAAK,SAAS,QAAQ,CAAC,OAAO,CAAC;AACxF,YAAM,aAAa,KAAK,mBAAmB,UAAU;AACrD,iBAAW,OAAO,YAAY;AAC5B,aAAK,wBAAwB,OAAO,KAAK,IAAI,OAAO;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAU,kBAAgD;AAC9D,UAAM,QAAQ,KAAK,GAAG,SAAS;AAE/B,UAAM,MAAiC,MAAM;AAAA,MAC3C;AAAA;AAAA,MAEA,CAAC,gBAAgB;AAAA,IACnB;AAEA,QAAI,CAAC,KAAK;AACR,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,UAAU,IAAI,oBAAoB,IAAI;AAC5C,QAAI,CAAC,SAAS;AACZ,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,eAAiC;AAAA,MACrC,sBAAsB;AAAA,MACtB,qBAAqB;AAAA,MACrB,QAAQ,CAAC;AAAA,MACT,YAAY,CAAC;AAAA,IACf;AAEA,UAAM,aAAa,MAAM,KAAK;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,UAAM,aAAa,KAAK,mBAAmB,UAAU;AAGrD,eAAW,OAAO,YAAY;AAC5B,WAAK,wBAAwB,OAAO,KAAK,IAAI,OAAO;AAAA,IACtD;AAGA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM;AAAA,MACJ;AAAA,MACA,CAAC,KAAK,IAAI,OAAO;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,2BACZ,KACA,SACA,QACA,cAAqC,KAAK,UACpB;AACtB,UAAM,aAA0B,CAAC;AAEjC,eAAW,WAAW,aAAa;AACjC,UAAI;AACF,cAAM,aAAa,IAAI,gBAAgB;AACvC,cAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AAEnE,YAAI;AACF,gBAAM,UAAU,MAAM,QAAQ;AAAA,YAC5B,IAAI;AAAA,YACJ,IAAI;AAAA,YACJ;AAAA,YACA,WAAW;AAAA,UACb;AACA,qBAAW,KAAK,GAAG,OAAO;AAAA,QAC5B,UAAE;AACA,uBAAa,OAAO;AAAA,QACtB;AAAA,MACF,SAAS,OAAgB;AAEvB,cAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1E;AAAA,UACE,8BAA8B,QAAQ,IAAI,QAAQ,IAAI,YAAY,IAAI,OAAO,KAAK,YAAY;AAAA,QAChG;AAEA,eAAO,OAAO,KAAK;AAAA,UACjB,YAAY,IAAI;AAAA,UAChB,UAAU,QAAQ;AAAA,UAClB,OAAO;AAAA,QACT,CAAC;AAGD,aAAK,oBAAoB,IAAI,SAAS,MAAM;AAAA,MAC9C;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAoB,QAAgB,QAAgC;AAC1E,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,MAAM,KAAK,IAAI;AAErB,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,KAAK,MAAM;AAAA,IACd;AAEA,QAAI,CAAC,OAAO,WAAW,SAAS,MAAM,GAAG;AACvC,aAAO,WAAW,KAAK,MAAM;AAAA,IAC/B;AAEA;AAAA,MACE,kEAAkE,MAAM;AAAA,IAC1E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,mBAAmB,SAAmC;AAC5D,UAAM,OAAO,oBAAI,IAAuB;AACxC,eAAW,UAAU,SAAS;AAC5B,UAAI,CAAC,KAAK,IAAI,OAAO,EAAE,GAAG;AACxB,aAAK,IAAI,OAAO,IAAI,MAAM;AAAA,MAC5B;AAAA,IACF;AACA,WAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,wBACN,OACA,KACA,kBACM;AACN,UAAM,aAAa,QAAQ,IAAI,EAAE;AACjC,UAAM,MAAM,KAAK,IAAI;AAGrB,UAAM,UAAU,IAAI,QAAQ,SAAS,MACjC,IAAI,QAAQ,MAAM,GAAG,GAAG,IACxB,IAAI;AAKR,UAAM,iBAAiB,KAAK,SAAS,SAAS,IAAI,KAAK,SAAS,CAAC,EAAE,OAAO;AAG1E,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,YAAY,IAAI,IAAI,IAAI,IAAI,GAAG;AAAA,IAClC;AAGA,UAAM,qBAAqB,KAAK,UAAU,IAAI,qBAAqB;AACnE,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA;AAAA,QACE;AAAA,QACA,IAAI;AAAA,QACJ,IAAI;AAAA,QACJ;AAAA,QACA,IAAI,gBAAgB;AAAA,QACpB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,OAAa;AAAA,MACjB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB;AACA,SAAK,GAAG,WAAW,IAAI;AAAA,EACzB;AACF;",
+  "sourcesContent": ["/**\n * VulnerabilityDatabaseClient\n *\n * Orchestrates vulnerability enrichment by querying configured databases,\n * merging and deduplicating results by CVE identifier, creating Vulnerability_Nodes\n * linked to affected Dependency_Nodes, and handling unreachable databases gracefully.\n *\n * Requirements: 3.1, 3.2, 3.3, 3.4, 3.5, 3.7\n */\n\nimport type { GraphDatabase } from '../../db/database';\nimport type { Edge } from '../../types';\nimport type { CVERecord, EnrichmentResult } from '../types';\nimport type { VulnDatabaseAdapter, BatchQuery } from './types';\nimport { logError, logWarn } from '../../errors';\nimport { EpssClient } from './epss-client';\n\nconst BATCH_CHUNK_SIZE = 1000;\n\n/**\n * Compute a combined risk score (0.0\u201310.0) for a vulnerability.\n *\n * Formula:\n *   risk = reachability_factor \u00D7 (0.4 \u00D7 cvss_normalized + 0.6 \u00D7 epss) \u00D7 staleness_bonus\n *   scaled to 0\u201310: min(risk \u00D7 10, 10.0)\n *\n * @param cvss        - CVSS base score (0.0\u201310.0), null treated as 5.0\n * @param epss        - EPSS exploitation probability (0.0\u20131.0), null treated as 0.0\n * @param verdict     - Reachability verdict or null/undefined\n * @param staleness   - Dependency staleness score (0.0\u20131.0), null treated as 0.0\n */\nexport function computeRiskScore(\n  cvss: number | null | undefined,\n  epss: number | null | undefined,\n  verdict: string | null | undefined,\n  staleness: number | null | undefined,\n): number {\n  const cvssNormalized = (cvss ?? 5.0) / 10.0;\n  const epssValue = epss ?? 0.0;\n\n  let reachabilityFactor: number;\n  if (verdict === 'affected') {\n    reachabilityFactor = 1.0;\n  } else if (verdict === 'under_investigation') {\n    reachabilityFactor = 0.5;\n  } else if (verdict === 'not_affected') {\n    reachabilityFactor = 0.1;\n  } else {\n    // no verdict\n    reachabilityFactor = 0.3;\n  }\n\n  const stalenessBonus = 1.0 + ((staleness ?? 0) * 0.2);\n\n  const raw = reachabilityFactor * (0.4 * cvssNormalized + 0.6 * epssValue) * stalenessBonus;\n  return Math.min(raw * 10, 10.0);\n}\n\n/**\n * Dependency row from sec_dependencies table.\n */\ninterface DependencyRow {\n  node_id: string;\n  ecosystem: string;\n  package_name: string;\n  resolved_version: string | null;\n  declared_constraint: string;\n}\n\nexport class VulnerabilityDatabaseClient {\n  private readonly adapters: VulnDatabaseAdapter[];\n  private readonly db: GraphDatabase;\n  private readonly timeoutMs: number;\n\n  constructor(\n    adapters: VulnDatabaseAdapter[],\n    db: GraphDatabase,\n    timeoutMs: number = 30000,\n  ) {\n    this.adapters = adapters;\n    this.db = db;\n    this.timeoutMs = timeoutMs;\n  }\n\n  /**\n   * Enrich all Dependency_Nodes with vulnerability data.\n   *\n   * Uses batch queries (up to 1000 per HTTP request) when the adapter supports\n   * `queryBatch`. Falls back to sequential single queries per dependency if batch\n   * is unavailable or fails. Results are deduplicated by CVE ID across adapters.\n   */\n  async enrichAll(): Promise<EnrichmentResult> {\n    const rawDb = this.db.getRawDb();\n    const result: EnrichmentResult = {\n      vulnerabilitiesFound: 0,\n      dependenciesChecked: 0,\n      errors: [],\n      staleNodes: [],\n    };\n\n    const depRows: DependencyRow[] = rawDb.all(\n      `SELECT node_id, ecosystem, package_name, resolved_version, declared_constraint\n       FROM sec_dependencies`,\n    );\n\n    // Filter out deps with no usable version\n    const queryableDeps = depRows.filter(d => d.resolved_version || d.declared_constraint);\n\n    for (const adapter of this.adapters) {\n      if (adapter.queryBatch) {\n        await this.enrichAllBatch(adapter as typeof adapter & Required<Pick<typeof adapter, 'queryBatch'>>, queryableDeps, result);\n      } else {\n        await this.enrichAllSequential(adapter, queryableDeps, result);\n      }\n    }\n\n    // Record lastVulnCheck for all queried deps (do once, after all adapters)\n    const now = Date.now();\n    for (const dep of queryableDeps) {\n      rawDb.run(\n        `UPDATE sec_dependencies SET last_vuln_check = ? WHERE node_id = ?`,\n        [now, dep.node_id],\n      );\n    }\n    result.dependenciesChecked = queryableDeps.length;\n\n    // Enrich stored vulnerabilities with EPSS scores\n    await this.enrichEpss(rawDb);\n\n    // Compute combined risk scores after all enrichment is done\n    await this.computeRiskScores(rawDb);\n\n    return result;\n  }\n\n  /**\n   * Fetch EPSS scores for all stored vulnerabilities and update the database.\n   */\n  private async enrichEpss(rawDb: any): Promise<void> {\n    try {\n      const cveRows: Array<{ cve_id: string }> = rawDb.all(\n        `SELECT cve_id FROM sec_vulnerabilities`,\n      );\n\n      if (cveRows.length === 0) {\n        return;\n      }\n\n      const cveIds = cveRows.map(r => r.cve_id);\n      const epssClient = new EpssClient();\n      const scores = await epssClient.fetchScores(cveIds);\n\n      if (scores.size === 0) {\n        return;\n      }\n\n      const fetchedAt = Date.now();\n      for (const [cveId, { score, percentile }] of scores) {\n        rawDb.run(\n          `UPDATE sec_vulnerabilities SET epss_score = ?, epss_percentile = ?, epss_fetched_at = ? WHERE cve_id = ?`,\n          [score, percentile, fetchedAt, cveId],\n        );\n      }\n    } catch (error: unknown) {\n      const msg = error instanceof Error ? error.message : String(error);\n      logWarn(`[sec:epss] EPSS enrichment failed (non-critical): ${msg}`);\n    }\n  }\n\n  /**\n   * Compute and persist combined risk scores for all stored vulnerabilities.\n   * Called after EPSS enrichment so epss_score values are up to date.\n   */\n  private async computeRiskScores(rawDb: any): Promise<void> {\n    const rows: Array<{\n      node_id: string;\n      severity_score: number | null;\n      epss_score: number | null;\n      verdict: string | null;\n      staleness_score: number | null;\n    }> = rawDb.all(`\n      SELECT v.node_id, v.severity_score, v.epss_score,\n             r.verdict,\n             d.staleness_score\n      FROM sec_vulnerabilities v\n      LEFT JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n      LEFT JOIN sec_dependencies d ON d.node_id = e.source\n      LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n    `);\n    for (const row of rows) {\n      const score = computeRiskScore(row.severity_score, row.epss_score, row.verdict, row.staleness_score);\n      rawDb.run(`UPDATE sec_vulnerabilities SET risk_score = ? WHERE node_id = ?`, [score, row.node_id]);\n    }\n  }\n\n  /**\n   * Batch enrichment path: groups deps into chunks of BATCH_CHUNK_SIZE and sends\n   * one HTTP request per chunk. Falls back to sequential on batch failure.\n   */\n  private async enrichAllBatch(\n    adapter: VulnDatabaseAdapter & Required<Pick<VulnDatabaseAdapter, 'queryBatch'>>,\n    deps: DependencyRow[],\n    result: EnrichmentResult,\n  ): Promise<void> {\n    const rawDb = this.db.getRawDb();\n\n    for (let i = 0; i < deps.length; i += BATCH_CHUNK_SIZE) {\n      const chunk = deps.slice(i, i + BATCH_CHUNK_SIZE);\n      const queries: BatchQuery[] = chunk.map(dep => ({\n        ecosystem: dep.ecosystem,\n        packageName: dep.package_name,\n        version: dep.resolved_version || dep.declared_constraint,\n      }));\n\n      let batchResults: Array<CVERecord[]>;\n      try {\n        const controller = new AbortController();\n        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);\n        try {\n          batchResults = await adapter.queryBatch(queries, controller.signal);\n        } finally {\n          clearTimeout(timeout);\n        }\n      } catch (error: unknown) {\n        // Batch failed \u2014 fall back to sequential for this chunk\n        const msg = error instanceof Error ? error.message : String(error);\n        logWarn(`[sec:vuln] ${adapter.name} batch query failed (${msg}), falling back to sequential for chunk of ${chunk.length}`);\n        await this.enrichAllSequential(adapter, chunk, result);\n        continue;\n      }\n\n      for (let j = 0; j < chunk.length; j++) {\n        const dep = chunk[j]!;\n        const cveRecords = batchResults[j] ?? [];\n        const uniqueCves = this.deduplicateByCveId(cveRecords);\n        for (const cve of uniqueCves) {\n          this.upsertVulnerabilityNode(rawDb, cve, dep.node_id);\n          result.vulnerabilitiesFound++;\n        }\n      }\n    }\n  }\n\n  /**\n   * Sequential enrichment path: queries one dependency at a time.\n   * Used when the adapter does not support queryBatch, or as a fallback.\n   */\n  private async enrichAllSequential(\n    adapter: VulnDatabaseAdapter,\n    deps: DependencyRow[],\n    result: EnrichmentResult,\n  ): Promise<void> {\n    const rawDb = this.db.getRawDb();\n\n    for (const dep of deps) {\n      const version = dep.resolved_version || dep.declared_constraint;\n      const cveRecords = await this.queryAdaptersForDependency(dep, version, result, [adapter]);\n      const uniqueCves = this.deduplicateByCveId(cveRecords);\n      for (const cve of uniqueCves) {\n        this.upsertVulnerabilityNode(rawDb, cve, dep.node_id);\n        result.vulnerabilitiesFound++;\n      }\n    }\n  }\n\n  /**\n   * Enrich a single Dependency_Node with vulnerability data.\n   *\n   * @param dependencyNodeId - The node ID of the dependency to enrich\n   * @returns Array of CVE records found for this dependency\n   */\n  async enrichOne(dependencyNodeId: string): Promise<CVERecord[]> {\n    const rawDb = this.db.getRawDb();\n\n    const dep: DependencyRow | undefined = rawDb.get(\n      `SELECT node_id, ecosystem, package_name, resolved_version, declared_constraint\n       FROM sec_dependencies WHERE node_id = ?`,\n      [dependencyNodeId],\n    );\n\n    if (!dep) {\n      return [];\n    }\n\n    const version = dep.resolved_version || dep.declared_constraint;\n    if (!version) {\n      return [];\n    }\n\n    const enrichResult: EnrichmentResult = {\n      vulnerabilitiesFound: 0,\n      dependenciesChecked: 0,\n      errors: [],\n      staleNodes: [],\n    };\n\n    const cveRecords = await this.queryAdaptersForDependency(\n      dep,\n      version,\n      enrichResult,\n    );\n\n    // Deduplicate by CVE ID\n    const uniqueCves = this.deduplicateByCveId(cveRecords);\n\n    // Create Vulnerability_Nodes and edges\n    for (const cve of uniqueCves) {\n      this.upsertVulnerabilityNode(rawDb, cve, dep.node_id);\n    }\n\n    // Record lastVulnCheck timestamp\n    const now = Date.now();\n    rawDb.run(\n      `UPDATE sec_dependencies SET last_vuln_check = ? WHERE node_id = ?`,\n      [now, dep.node_id],\n    );\n\n    return uniqueCves;\n  }\n\n  /**\n   * Query a set of adapters for a single dependency.\n   * Handles timeouts and unreachable databases gracefully.\n   * Defaults to all configured adapters when adapterList is omitted.\n   */\n  private async queryAdaptersForDependency(\n    dep: DependencyRow,\n    version: string,\n    result: EnrichmentResult,\n    adapterList: VulnDatabaseAdapter[] = this.adapters,\n  ): Promise<CVERecord[]> {\n    const allRecords: CVERecord[] = [];\n\n    for (const adapter of adapterList) {\n      try {\n        const controller = new AbortController();\n        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);\n\n        try {\n          const records = await adapter.query(\n            dep.ecosystem,\n            dep.package_name,\n            version,\n            controller.signal,\n          );\n          allRecords.push(...records);\n        } finally {\n          clearTimeout(timeout);\n        }\n      } catch (error: unknown) {\n        // Handle unreachable database (Requirement 3.5)\n        const errorMessage = error instanceof Error ? error.message : String(error);\n        logError(\n          `[sec:vuln] Failed to query ${adapter.name} for ${dep.package_name}@${version}: ${errorMessage}`,\n        );\n\n        result.errors.push({\n          dependency: dep.package_name,\n          database: adapter.name,\n          error: errorMessage,\n        });\n\n        // Set vulnDataStale flag on the dependency node\n        this.markDependencyStale(dep.node_id, result);\n      }\n    }\n\n    return allRecords;\n  }\n\n  /**\n   * Mark a dependency node as having stale vulnerability data.\n   * Retains cached data but sets the stale flag with timestamp.\n   */\n  private markDependencyStale(nodeId: string, result: EnrichmentResult): void {\n    const rawDb = this.db.getRawDb();\n    const now = Date.now();\n\n    rawDb.run(\n      `UPDATE sec_dependencies\n       SET vuln_data_stale = 1, vuln_data_stale_since = ?\n       WHERE node_id = ?`,\n      [now, nodeId],\n    );\n\n    if (!result.staleNodes.includes(nodeId)) {\n      result.staleNodes.push(nodeId);\n    }\n\n    logWarn(\n      `[sec:vuln] Vulnerability data marked stale for dependency node ${nodeId}`,\n    );\n  }\n\n  /**\n   * Deduplicate CVE records by their ID.\n   * When the same CVE is reported by multiple databases, keep the first occurrence.\n   */\n  private deduplicateByCveId(records: CVERecord[]): CVERecord[] {\n    const seen = new Map<string, CVERecord>();\n    for (const record of records) {\n      if (!seen.has(record.id)) {\n        seen.set(record.id, record);\n      }\n    }\n    return [...seen.values()];\n  }\n\n  /**\n   * Create or update a Vulnerability_Node and link it to the affected dependency.\n   *\n   * - Creates a node in `nodes` table with kind='vulnerability', ID format `vuln:<cve_id>`\n   * - Inserts a row in `sec_vulnerabilities` with CVE metadata\n   * - Creates a `has_vulnerability` edge from the Dependency_Node to the Vulnerability_Node\n   */\n  private upsertVulnerabilityNode(\n    rawDb: any,\n    cve: CVERecord,\n    dependencyNodeId: string,\n  ): void {\n    const vulnNodeId = `vuln:${cve.id}`;\n    const now = Date.now();\n\n    // Truncate summary to 500 characters (Requirement 3.3)\n    const summary = cve.summary.length > 500\n      ? cve.summary.slice(0, 500)\n      : cve.summary;\n\n    // Determine source database from the first adapter that returned this CVE\n    // (in practice, the adapter name is not stored on CVERecord, so we use\n    // the first configured adapter's name as the source)\n    const sourceDatabase = this.adapters.length > 0 ? this.adapters[0].name : 'unknown';\n\n    // Upsert into nodes table\n    rawDb.run(\n      `INSERT OR REPLACE INTO nodes\n        (id, kind, name, qualified_name, file_path, language,\n         start_line, end_line, start_column, end_column,\n         is_exported, is_async, is_static, is_abstract, updated_at)\n       VALUES (?, 'vulnerability', ?, ?, '', 'unknown', 0, 0, 0, 0, 0, 0, 0, 0, ?)`,\n      [vulnNodeId, cve.id, cve.id, now],\n    );\n\n    // Upsert into sec_vulnerabilities table\n    const affectedRangesJson = JSON.stringify(cve.affectedVersionRanges);\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_vulnerabilities\n        (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)\n       VALUES (?, ?, ?, ?, ?, ?, ?)`,\n      [\n        vulnNodeId,\n        cve.id,\n        cve.severity,\n        affectedRangesJson,\n        cve.fixedVersion ?? null,\n        summary,\n        sourceDatabase,\n      ],\n    );\n\n    // Create has_vulnerability edge from Dependency_Node to Vulnerability_Node\n    const edge: Edge = {\n      source: dependencyNodeId,\n      target: vulnNodeId,\n      kind: 'has_vulnerability',\n      confidence: 'extracted',\n      confidenceScore: 1.0,\n    };\n    this.db.insertEdge(edge);\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcA,oBAAkC;AAClC,yBAA2B;AAE3B,MAAM,mBAAmB;AAclB,SAAS,iBACd,MACA,MACA,SACA,WACQ;AACR,QAAM,kBAAkB,QAAQ,KAAO;AACvC,QAAM,YAAY,QAAQ;AAE1B,MAAI;AACJ,MAAI,YAAY,YAAY;AAC1B,yBAAqB;AAAA,EACvB,WAAW,YAAY,uBAAuB;AAC5C,yBAAqB;AAAA,EACvB,WAAW,YAAY,gBAAgB;AACrC,yBAAqB;AAAA,EACvB,OAAO;AAEL,yBAAqB;AAAA,EACvB;AAEA,QAAM,iBAAiB,KAAQ,aAAa,KAAK;AAEjD,QAAM,MAAM,sBAAsB,MAAM,iBAAiB,MAAM,aAAa;AAC5E,SAAO,KAAK,IAAI,MAAM,IAAI,EAAI;AAChC;AAaO,MAAM,4BAA4B;AAAA,EAKvC,YACE,UACA,IACA,YAAoB,KACpB;AACA,SAAK,WAAW;AAChB,SAAK,KAAK;AACV,SAAK,YAAY;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,YAAuC;AAC3C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,SAA2B;AAAA,MAC/B,sBAAsB;AAAA,MACtB,qBAAqB;AAAA,MACrB,QAAQ,CAAC;AAAA,MACT,YAAY,CAAC;AAAA,IACf;AAEA,UAAM,UAA2B,MAAM;AAAA,MACrC;AAAA;AAAA,IAEF;AAGA,UAAM,gBAAgB,QAAQ,OAAO,OAAK,EAAE,oBAAoB,EAAE,mBAAmB;AAErF,eAAW,WAAW,KAAK,UAAU;AACnC,UAAI,QAAQ,YAAY;AACtB,cAAM,KAAK,eAAe,SAA0E,eAAe,MAAM;AAAA,MAC3H,OAAO;AACL,cAAM,KAAK,oBAAoB,SAAS,eAAe,MAAM;AAAA,MAC/D;AAAA,IACF;AAGA,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,OAAO,eAAe;AAC/B,YAAM;AAAA,QACJ;AAAA,QACA,CAAC,KAAK,IAAI,OAAO;AAAA,MACnB;AAAA,IACF;AACA,WAAO,sBAAsB,cAAc;AAG3C,UAAM,KAAK,WAAW,KAAK;AAG3B,UAAM,KAAK,kBAAkB,KAAK;AAElC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,WAAW,OAA2B;AAClD,QAAI;AACF,YAAM,UAAqC,MAAM;AAAA,QAC/C;AAAA,MACF;AAEA,UAAI,QAAQ,WAAW,GAAG;AACxB;AAAA,MACF;AAEA,YAAM,SAAS,QAAQ,IAAI,OAAK,EAAE,MAAM;AACxC,YAAM,aAAa,IAAI,8BAAW;AAClC,YAAM,SAAS,MAAM,WAAW,YAAY,MAAM;AAElD,UAAI,OAAO,SAAS,GAAG;AACrB;AAAA,MACF;AAEA,YAAM,YAAY,KAAK,IAAI;AAC3B,iBAAW,CAAC,OAAO,EAAE,OAAO,WAAW,CAAC,KAAK,QAAQ;AACnD,cAAM;AAAA,UACJ;AAAA,UACA,CAAC,OAAO,YAAY,WAAW,KAAK;AAAA,QACtC;AAAA,MACF;AAAA,IACF,SAAS,OAAgB;AACvB,YAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,iCAAQ,qDAAqD,GAAG,EAAE;AAAA,IACpE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,kBAAkB,OAA2B;AACzD,UAAM,OAMD,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAQd;AACD,eAAW,OAAO,MAAM;AACtB,YAAM,QAAQ,iBAAiB,IAAI,gBAAgB,IAAI,YAAY,IAAI,SAAS,IAAI,eAAe;AACnG,YAAM,IAAI,mEAAmE,CAAC,OAAO,IAAI,OAAO,CAAC;AAAA,IACnG;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,eACZ,SACA,MACA,QACe;AACf,UAAM,QAAQ,KAAK,GAAG,SAAS;AAE/B,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,kBAAkB;AACtD,YAAM,QAAQ,KAAK,MAAM,GAAG,IAAI,gBAAgB;AAChD,YAAM,UAAwB,MAAM,IAAI,UAAQ;AAAA,QAC9C,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,SAAS,IAAI,oBAAoB,IAAI;AAAA,MACvC,EAAE;AAEF,UAAI;AACJ,UAAI;AACF,cAAM,aAAa,IAAI,gBAAgB;AACvC,cAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AACnE,YAAI;AACF,yBAAe,MAAM,QAAQ,WAAW,SAAS,WAAW,MAAM;AAAA,QACpE,UAAE;AACA,uBAAa,OAAO;AAAA,QACtB;AAAA,MACF,SAAS,OAAgB;AAEvB,cAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,mCAAQ,cAAc,QAAQ,IAAI,wBAAwB,GAAG,8CAA8C,MAAM,MAAM,EAAE;AACzH,cAAM,KAAK,oBAAoB,SAAS,OAAO,MAAM;AACrD;AAAA,MACF;AAEA,eAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,cAAM,MAAM,MAAM,CAAC;AACnB,cAAM,aAAa,aAAa,CAAC,KAAK,CAAC;AACvC,cAAM,aAAa,KAAK,mBAAmB,UAAU;AACrD,mBAAW,OAAO,YAAY;AAC5B,eAAK,wBAAwB,OAAO,KAAK,IAAI,OAAO;AACpD,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,oBACZ,SACA,MACA,QACe;AACf,UAAM,QAAQ,KAAK,GAAG,SAAS;AAE/B,eAAW,OAAO,MAAM;AACtB,YAAM,UAAU,IAAI,oBAAoB,IAAI;AAC5C,YAAM,aAAa,MAAM,KAAK,2BAA2B,KAAK,SAAS,QAAQ,CAAC,OAAO,CAAC;AACxF,YAAM,aAAa,KAAK,mBAAmB,UAAU;AACrD,iBAAW,OAAO,YAAY;AAC5B,aAAK,wBAAwB,OAAO,KAAK,IAAI,OAAO;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAU,kBAAgD;AAC9D,UAAM,QAAQ,KAAK,GAAG,SAAS;AAE/B,UAAM,MAAiC,MAAM;AAAA,MAC3C;AAAA;AAAA,MAEA,CAAC,gBAAgB;AAAA,IACnB;AAEA,QAAI,CAAC,KAAK;AACR,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,UAAU,IAAI,oBAAoB,IAAI;AAC5C,QAAI,CAAC,SAAS;AACZ,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,eAAiC;AAAA,MACrC,sBAAsB;AAAA,MACtB,qBAAqB;AAAA,MACrB,QAAQ,CAAC;AAAA,MACT,YAAY,CAAC;AAAA,IACf;AAEA,UAAM,aAAa,MAAM,KAAK;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,UAAM,aAAa,KAAK,mBAAmB,UAAU;AAGrD,eAAW,OAAO,YAAY;AAC5B,WAAK,wBAAwB,OAAO,KAAK,IAAI,OAAO;AAAA,IACtD;AAGA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM;AAAA,MACJ;AAAA,MACA,CAAC,KAAK,IAAI,OAAO;AAAA,IACnB;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,2BACZ,KACA,SACA,QACA,cAAqC,KAAK,UACpB;AACtB,UAAM,aAA0B,CAAC;AAEjC,eAAW,WAAW,aAAa;AACjC,UAAI;AACF,cAAM,aAAa,IAAI,gBAAgB;AACvC,cAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AAEnE,YAAI;AACF,gBAAM,UAAU,MAAM,QAAQ;AAAA,YAC5B,IAAI;AAAA,YACJ,IAAI;AAAA,YACJ;AAAA,YACA,WAAW;AAAA,UACb;AACA,qBAAW,KAAK,GAAG,OAAO;AAAA,QAC5B,UAAE;AACA,uBAAa,OAAO;AAAA,QACtB;AAAA,MACF,SAAS,OAAgB;AAEvB,cAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1E;AAAA,UACE,8BAA8B,QAAQ,IAAI,QAAQ,IAAI,YAAY,IAAI,OAAO,KAAK,YAAY;AAAA,QAChG;AAEA,eAAO,OAAO,KAAK;AAAA,UACjB,YAAY,IAAI;AAAA,UAChB,UAAU,QAAQ;AAAA,UAClB,OAAO;AAAA,QACT,CAAC;AAGD,aAAK,oBAAoB,IAAI,SAAS,MAAM;AAAA,MAC9C;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,oBAAoB,QAAgB,QAAgC;AAC1E,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,MAAM,KAAK,IAAI;AAErB,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,KAAK,MAAM;AAAA,IACd;AAEA,QAAI,CAAC,OAAO,WAAW,SAAS,MAAM,GAAG;AACvC,aAAO,WAAW,KAAK,MAAM;AAAA,IAC/B;AAEA;AAAA,MACE,kEAAkE,MAAM;AAAA,IAC1E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,mBAAmB,SAAmC;AAC5D,UAAM,OAAO,oBAAI,IAAuB;AACxC,eAAW,UAAU,SAAS;AAC5B,UAAI,CAAC,KAAK,IAAI,OAAO,EAAE,GAAG;AACxB,aAAK,IAAI,OAAO,IAAI,MAAM;AAAA,MAC5B;AAAA,IACF;AACA,WAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,wBACN,OACA,KACA,kBACM;AACN,UAAM,aAAa,QAAQ,IAAI,EAAE;AACjC,UAAM,MAAM,KAAK,IAAI;AAGrB,UAAM,UAAU,IAAI,QAAQ,SAAS,MACjC,IAAI,QAAQ,MAAM,GAAG,GAAG,IACxB,IAAI;AAKR,UAAM,iBAAiB,KAAK,SAAS,SAAS,IAAI,KAAK,SAAS,CAAC,EAAE,OAAO;AAG1E,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,YAAY,IAAI,IAAI,IAAI,IAAI,GAAG;AAAA,IAClC;AAGA,UAAM,qBAAqB,KAAK,UAAU,IAAI,qBAAqB;AACnE,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA;AAAA,QACE;AAAA,QACA,IAAI;AAAA,QACJ,IAAI;AAAA,QACJ;AAAA,QACA,IAAI,gBAAgB;AAAA,QACpB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,OAAa;AAAA,MACjB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB;AACA,SAAK,GAAG,WAAW,IAAI;AAAA,EACzB;AACF;",
   "names": []
 }

package/dist/security/vuln/epss-client.d.ts

@@ -0,0 +1,26 @@
+/**
+ * EPSS (Exploit Prediction Scoring System) Client
+ *
+ * Fetches exploit prediction scores from the FIRST.org EPSS API for CVE IDs.
+ * EPSS is non-critical: on error, an empty map is returned so the caller can
+ * continue without scores.
+ *
+ * API: https://api.first.org/data/v1/epss
+ */
+export declare class EpssClient {
+    /**
+     * Fetch EPSS scores for a list of CVE IDs.
+     *
+     * CVEs are batched into chunks of 500 per request. Missing CVEs simply do
+     * not appear in the response and are omitted from the returned map.
+     *
+     * @param cveIds - List of CVE identifiers (e.g. ["CVE-2021-44228", ...])
+     * @returns Map from CVE ID to { score, percentile } (floats in [0, 1])
+     */
+    fetchScores(cveIds: string[]): Promise<Map<string, {
+        score: number;
+        percentile: number;
+    }>>;
+    private fetchChunk;
+}
+//# sourceMappingURL=epss-client.d.ts.map

package/dist/security/vuln/epss-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"epss-client.d.ts","sourceRoot":"","sources":["../../../src/security/vuln/epss-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmBH,qBAAa,UAAU;IACrB;;;;;;;;OAQG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;YAwBlF,UAAU;CA2CzB"}

package/dist/security/vuln/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Vulnerability database subsystem exports.
+ */
+export { VulnerabilityDatabaseClient } from './client';
+export type { VulnDatabaseAdapter } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/vuln/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/vuln/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC"}

package/dist/security/vuln/osv-adapter.d.ts

@@ -0,0 +1,58 @@
+/**
+ * OSV API Adapter
+ *
+ * Queries the OSV (Open Source Vulnerabilities) database for known CVEs
+ * affecting project dependencies. Implements the VulnDatabaseAdapter interface.
+ */
+import { CVERecord } from '../types';
+import type { VulnDatabaseAdapter, BatchQuery } from './types';
+export type { VulnDatabaseAdapter, BatchQuery };
+export declare class OsvAdapter implements VulnDatabaseAdapter {
+    readonly name = "OSV";
+    private readonly apiUrl;
+    private readonly batchApiUrl;
+    private readonly timeoutMs;
+    constructor(options?: {
+        apiUrl?: string;
+        batchApiUrl?: string;
+        timeoutMs?: number;
+    });
+    /**
+     * Batch query up to OSV_BATCH_MAX_QUERIES packages in a single HTTP request.
+     * Results are returned in the same order as the input queries.
+     * Queries for unsupported ecosystems produce empty results without an HTTP call.
+     */
+    queryBatch(queries: BatchQuery[], signal?: AbortSignal): Promise<Array<CVERecord[]>>;
+    query(ecosystem: string, packageName: string, version: string, signal?: AbortSignal): Promise<CVERecord[]>;
+    /**
+     * Parse the OSV API response into CVERecord objects.
+     */
+    private parseResponse;
+    /**
+     * Extract CVE ID from the vulnerability's aliases or use the OSV ID.
+     * Prefers CVE-* identifiers from the aliases array.
+     */
+    private extractCveId;
+    /**
+     * Extract CVSS v3.1 base score from the severity array.
+     * Returns 0 if no CVSS score is available.
+     */
+    private extractSeverity;
+    /**
+     * Parse a CVSS vector string or numeric score.
+     * CVSS vectors look like: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+     * The base score is not directly in the vector — we extract it if it's a plain number,
+     * or return null if we can't parse it.
+     */
+    private parseCvssScore;
+    /**
+     * Extract affected version ranges and the first fixed version from the vulnerability.
+     */
+    private extractAffectedRanges;
+    /**
+     * Extract and truncate the summary from the vulnerability.
+     * Prefers the summary field, falls back to details.
+     */
+    private extractSummary;
+}
+//# sourceMappingURL=osv-adapter.d.ts.map

package/dist/security/vuln/osv-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv-adapter.d.ts","sourceRoot":"","sources":["../../../src/security/vuln/osv-adapter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAgB,MAAM,UAAU,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI/D,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC;AAsEhD,qBAAa,UAAW,YAAW,mBAAmB;IACpD,SAAgB,IAAI,SAAS;IAE7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;IAMnF;;;;OAIG;IACG,UAAU,CACd,OAAO,EAAE,UAAU,EAAE,EACrB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IA6ExB,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,SAAS,EAAE,CAAC;IAkEvB;;OAEG;IACH,OAAO,CAAC,aAAa;IA8BrB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAapB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAyBvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAYtB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAiD7B;;;OAGG;IACH,OAAO,CAAC,cAAc;CAOvB"}

package/dist/security/vuln/types.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Shared types for the vulnerability database subsystem.
+ */
+import type { CVERecord } from '../types';
+/** A single entry in a batch vulnerability query. */
+export interface BatchQuery {
+    ecosystem: string;
+    packageName: string;
+    version: string;
+}
+/**
+ * Adapter interface for querying a vulnerability database.
+ * Each supported database (OSV, NVD, etc.) implements this interface.
+ */
+export interface VulnDatabaseAdapter {
+    /** Human-readable name of the database (e.g. "OSV") */
+    name: string;
+    /**
+     * Query for vulnerabilities affecting a specific package version.
+     */
+    query(ecosystem: string, packageName: string, version: string, signal?: AbortSignal): Promise<CVERecord[]>;
+    /**
+     * Batch query — results[i] corresponds to queries[i].
+     * Implementing this is optional but strongly recommended for performance:
+     * a single HTTP request replaces N sequential requests.
+     */
+    queryBatch?(queries: BatchQuery[], signal?: AbortSignal): Promise<Array<CVERecord[]>>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/vuln/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/vuln/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAExB;;;;OAIG;IACH,UAAU,CAAC,CACT,OAAO,EAAE,UAAU,EAAE,EACrB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;CAChC"}

package/dist/sync/index.d.ts

@@ -16,12 +16,14 @@ export declare function shouldIncludeFile(relPath: string, config: KiroGraphConf
 export declare function hashContent(content: Buffer | string): string;
 /**
  * Returns absolute paths of all indexable files under root.
- * Uses git ls-files fast-path when available; falls back to filesystem walk.
+ * Handles monorepos with multiple nested git roots by running git ls-files
+ * from each sub-repo root independently, then merging results.
+ * Falls back to filesystem walk if no git roots found.
  * Respects AbortSignal.
  */
 export declare function scanDirectory(root: string, config: KiroGraphConfig, signal?: AbortSignal): Promise<string[]>;
 /**
- * Classifies git-changed files into added / modified / removed.
+ * Classifies git-changed files into added / modified / removed across all nested git roots.
  * Returns absolute paths. Returns empty arrays if git is unavailable.
  * Excludes paths whose detected language is 'unknown'.
  */

package/dist/sync/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAsFjD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAUnF;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAwBnB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAoCrE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AA+GjD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAUnF;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CA8BnB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAmCrE"}