kirograph 0.19.0 → 0.20.0

package/dist/security/context-warnings.test.js

@@ -1,300 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var import_vitest = require("vitest");
-var import_context_warnings = require("./context-warnings");
-var import_database = require("../db/database");
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
-var os = __toESM(require("os"));
-function createTempProject() {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ctx-warn-test-"));
-  fs.writeFileSync(
-    path.join(dir, "package.json"),
-    JSON.stringify({ name: "test-project", version: "1.0.0" })
-  );
-  return dir;
-}
-function setupDb(projectRoot) {
-  const db = new import_database.GraphDatabase(projectRoot);
-  db.applySecuritySchema();
-  return db;
-}
-function insertEntryPoint(db, nodeId, name) {
-  db.upsertNode({
-    id: nodeId,
-    kind: "function",
-    name,
-    qualifiedName: name,
-    filePath: "src/index.ts",
-    language: "typescript",
-    startLine: 1,
-    endLine: 10,
-    startColumn: 0,
-    endColumn: 0,
-    updatedAt: Date.now()
-  });
-}
-function insertVulnerability(db, opts) {
-  const rawDb = db.getRawDb();
-  db.upsertNode({
-    id: opts.depNodeId,
-    kind: "dependency",
-    name: opts.packageName,
-    qualifiedName: `${opts.ecosystem}/${opts.packageName}`,
-    filePath: "package.json",
-    language: "unknown",
-    startLine: 0,
-    endLine: 0,
-    startColumn: 0,
-    endColumn: 0,
-    updatedAt: Date.now()
-  });
-  rawDb.run(
-    `INSERT OR REPLACE INTO sec_dependencies
-      (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
-     VALUES (?, ?, ?, ?, ?, ?, ?)`,
-    [opts.depNodeId, opts.ecosystem, opts.packageName, "^1.0.0", "1.0.0", "production", '["package.json"]']
-  );
-  db.upsertNode({
-    id: opts.vulnNodeId,
-    kind: "vulnerability",
-    name: opts.cveId,
-    qualifiedName: opts.cveId,
-    filePath: "package.json",
-    language: "unknown",
-    startLine: 0,
-    endLine: 0,
-    startColumn: 0,
-    endColumn: 0,
-    updatedAt: Date.now()
-  });
-  rawDb.run(
-    `INSERT OR REPLACE INTO sec_vulnerabilities
-      (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)
-     VALUES (?, ?, ?, ?, ?, ?, ?)`,
-    [opts.vulnNodeId, opts.cveId, opts.severityScore, "[]", opts.fixedVersion ?? null, "Test vulnerability", "OSV"]
-  );
-  db.insertEdge({
-    source: opts.depNodeId,
-    target: opts.vulnNodeId,
-    kind: "has_vulnerability"
-  });
-  rawDb.run(
-    `INSERT OR REPLACE INTO sec_reachability
-      (vulnerability_node_id, verdict, paths, reaching_entry_point_count, analyzed_at)
-     VALUES (?, ?, ?, ?, ?)`,
-    [opts.vulnNodeId, opts.verdict, JSON.stringify(opts.paths), opts.paths.length, Date.now()]
-  );
-}
-(0, import_vitest.describe)("getSecurityWarningsForNodes", () => {
-  let projectRoot;
-  let db;
-  (0, import_vitest.beforeEach)(() => {
-    projectRoot = createTempProject();
-    db = setupDb(projectRoot);
-  });
-  (0, import_vitest.afterEach)(() => {
-    db.close();
-    fs.rmSync(projectRoot, { recursive: true, force: true });
-  });
-  (0, import_vitest.it)("returns empty array when no node IDs provided", () => {
-    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), []);
-    (0, import_vitest.expect)(result).toEqual([]);
-  });
-  (0, import_vitest.it)("returns empty array when no vulnerabilities exist", () => {
-    insertEntryPoint(db, "node-1", "handleRequest");
-    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["node-1"]);
-    (0, import_vitest.expect)(result).toEqual([]);
-  });
-  (0, import_vitest.it)("returns warnings for vulnerabilities reachable from context nodes", () => {
-    insertEntryPoint(db, "entry-1", "handleRequest");
-    insertVulnerability(db, {
-      vulnNodeId: "vuln-1",
-      depNodeId: "dep-1",
-      cveId: "CVE-2023-12345",
-      severityScore: 9.8,
-      fixedVersion: "1.2.0",
-      packageName: "express",
-      ecosystem: "npm",
-      verdict: "affected",
-      paths: [{ entryPoint: "entry-1", path: ["entry-1", "mid-1", "dep-1"] }]
-    });
-    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["entry-1"]);
-    (0, import_vitest.expect)(result).toHaveLength(1);
-    (0, import_vitest.expect)(result[0].cveId).toBe("CVE-2023-12345");
-    (0, import_vitest.expect)(result[0].severityScore).toBe(9.8);
-    (0, import_vitest.expect)(result[0].packageName).toBe("express");
-    (0, import_vitest.expect)(result[0].ecosystem).toBe("npm");
-    (0, import_vitest.expect)(result[0].fixedVersion).toBe("1.2.0");
-    (0, import_vitest.expect)(result[0].entryPoints).toContain("entry-1");
-  });
-  (0, import_vitest.it)("returns warnings when a context node is on the path (not just entry point)", () => {
-    insertEntryPoint(db, "entry-1", "handleRequest");
-    insertEntryPoint(db, "mid-1", "processData");
-    insertVulnerability(db, {
-      vulnNodeId: "vuln-1",
-      depNodeId: "dep-1",
-      cveId: "CVE-2023-99999",
-      severityScore: 7.5,
-      packageName: "lodash",
-      ecosystem: "npm",
-      verdict: "affected",
-      paths: [{ entryPoint: "entry-1", path: ["entry-1", "mid-1", "dep-1"] }]
-    });
-    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["mid-1"]);
-    (0, import_vitest.expect)(result).toHaveLength(1);
-    (0, import_vitest.expect)(result[0].cveId).toBe("CVE-2023-99999");
-  });
-  (0, import_vitest.it)("does not return warnings for not_affected vulnerabilities", () => {
-    insertEntryPoint(db, "entry-1", "handleRequest");
-    insertVulnerability(db, {
-      vulnNodeId: "vuln-1",
-      depNodeId: "dep-1",
-      cveId: "CVE-2023-00001",
-      severityScore: 5,
-      packageName: "some-pkg",
-      ecosystem: "npm",
-      verdict: "not_affected",
-      paths: []
-    });
-    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["entry-1"]);
-    (0, import_vitest.expect)(result).toEqual([]);
-  });
-  (0, import_vitest.it)("does not return warnings when context nodes are not on any path", () => {
-    insertEntryPoint(db, "entry-1", "handleRequest");
-    insertEntryPoint(db, "unrelated", "otherFunction");
-    insertVulnerability(db, {
-      vulnNodeId: "vuln-1",
-      depNodeId: "dep-1",
-      cveId: "CVE-2023-11111",
-      severityScore: 8,
-      packageName: "express",
-      ecosystem: "npm",
-      verdict: "affected",
-      paths: [{ entryPoint: "entry-1", path: ["entry-1", "dep-1"] }]
-    });
-    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["unrelated"]);
-    (0, import_vitest.expect)(result).toEqual([]);
-  });
-  (0, import_vitest.it)("sorts warnings by severity (highest first)", () => {
-    insertEntryPoint(db, "entry-1", "handleRequest");
-    insertVulnerability(db, {
-      vulnNodeId: "vuln-1",
-      depNodeId: "dep-1",
-      cveId: "CVE-2023-LOW",
-      severityScore: 3,
-      packageName: "low-pkg",
-      ecosystem: "npm",
-      verdict: "affected",
-      paths: [{ entryPoint: "entry-1", path: ["entry-1", "dep-1"] }]
-    });
-    insertVulnerability(db, {
-      vulnNodeId: "vuln-2",
-      depNodeId: "dep-2",
-      cveId: "CVE-2023-HIGH",
-      severityScore: 9.5,
-      packageName: "high-pkg",
-      ecosystem: "npm",
-      verdict: "affected",
-      paths: [{ entryPoint: "entry-1", path: ["entry-1", "dep-2"] }]
-    });
-    const result = (0, import_context_warnings.getSecurityWarningsForNodes)(db.getRawDb(), ["entry-1"]);
-    (0, import_vitest.expect)(result).toHaveLength(2);
-    (0, import_vitest.expect)(result[0].cveId).toBe("CVE-2023-HIGH");
-    (0, import_vitest.expect)(result[1].cveId).toBe("CVE-2023-LOW");
-  });
-});
-(0, import_vitest.describe)("formatSecurityWarnings", () => {
-  (0, import_vitest.it)("returns empty string when no warnings", () => {
-    (0, import_vitest.expect)((0, import_context_warnings.formatSecurityWarnings)([], /* @__PURE__ */ new Map())).toBe("");
-  });
-  (0, import_vitest.it)("formats a single warning with severity and entry point", () => {
-    const warnings = [
-      {
-        cveId: "CVE-2023-12345",
-        severityScore: 9.8,
-        packageName: "express",
-        ecosystem: "npm",
-        fixedVersion: "4.18.3",
-        entryPoints: ["entry-1"]
-      }
-    ];
-    const nodeNames = /* @__PURE__ */ new Map([["entry-1", "handleRequest"]]);
-    const result = (0, import_context_warnings.formatSecurityWarnings)(warnings, nodeNames);
-    (0, import_vitest.expect)(result).toContain("## \u26A0 Security");
-    (0, import_vitest.expect)(result).toContain("**CVE-2023-12345**");
-    (0, import_vitest.expect)(result).toContain("CVSS 9.8");
-    (0, import_vitest.expect)(result).toContain("express (npm)");
-    (0, import_vitest.expect)(result).toContain("handleRequest");
-    (0, import_vitest.expect)(result).toContain("\u{1F4A1} Fix: npm install express@4.18.3");
-  });
-  (0, import_vitest.it)('shows max 3 vulnerabilities and a "more" note', () => {
-    const warnings = Array.from({ length: 5 }, (_, i) => ({
-      cveId: `CVE-2023-${i}`,
-      severityScore: 9 - i,
-      packageName: `pkg-${i}`,
-      ecosystem: "npm",
-      fixedVersion: null,
-      entryPoints: ["entry-1"]
-    }));
-    const nodeNames = /* @__PURE__ */ new Map([["entry-1", "main"]]);
-    const result = (0, import_context_warnings.formatSecurityWarnings)(warnings, nodeNames);
-    (0, import_vitest.expect)(result).toContain("CVE-2023-0");
-    (0, import_vitest.expect)(result).toContain("CVE-2023-1");
-    (0, import_vitest.expect)(result).toContain("CVE-2023-2");
-    (0, import_vitest.expect)(result).not.toContain("CVE-2023-3");
-    (0, import_vitest.expect)(result).not.toContain("CVE-2023-4");
-    (0, import_vitest.expect)(result).toContain("2 more \u2014 use kirograph_vulns for full list");
-  });
-  (0, import_vitest.it)("does not show fix suggestion when fixedVersion is null", () => {
-    const warnings = [
-      {
-        cveId: "CVE-2023-99999",
-        severityScore: 7,
-        packageName: "lodash",
-        ecosystem: "npm",
-        fixedVersion: null,
-        entryPoints: ["entry-1"]
-      }
-    ];
-    const nodeNames = /* @__PURE__ */ new Map([["entry-1", "main"]]);
-    const result = (0, import_context_warnings.formatSecurityWarnings)(warnings, nodeNames);
-    (0, import_vitest.expect)(result).not.toContain("\u{1F4A1} Fix");
-  });
-  (0, import_vitest.it)("uses node ID when name is not in the map", () => {
-    const warnings = [
-      {
-        cveId: "CVE-2023-00001",
-        severityScore: 5,
-        packageName: "some-pkg",
-        ecosystem: "npm",
-        fixedVersion: null,
-        entryPoints: ["unknown-id"]
-      }
-    ];
-    const result = (0, import_context_warnings.formatSecurityWarnings)(warnings, /* @__PURE__ */ new Map());
-    (0, import_vitest.expect)(result).toContain("unknown-id");
-  });
-});
-//# sourceMappingURL=context-warnings.test.js.map

package/dist/security/context-warnings.test.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../src/security/context-warnings.test.ts"],
-  "sourcesContent": ["/**\n * Unit tests for security context warnings\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport { getSecurityWarningsForNodes, formatSecurityWarnings } from './context-warnings';\nimport type { SecurityWarning } from './context-warnings';\nimport { GraphDatabase } from '../db/database';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\n\n// \u2500\u2500 Test Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction createTempProject(): string {\n  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ctx-warn-test-'));\n  fs.writeFileSync(\n    path.join(dir, 'package.json'),\n    JSON.stringify({ name: 'test-project', version: '1.0.0' }),\n  );\n  return dir;\n}\n\nfunction setupDb(projectRoot: string): GraphDatabase {\n  const db = new GraphDatabase(projectRoot);\n  db.applySecuritySchema();\n  return db;\n}\n\nfunction insertEntryPoint(db: GraphDatabase, nodeId: string, name: string): void {\n  db.upsertNode({\n    id: nodeId,\n    kind: 'function',\n    name,\n    qualifiedName: name,\n    filePath: 'src/index.ts',\n    language: 'typescript',\n    startLine: 1,\n    endLine: 10,\n    startColumn: 0,\n    endColumn: 0,\n    updatedAt: Date.now(),\n  });\n}\n\nfunction insertVulnerability(\n  db: GraphDatabase,\n  opts: {\n    vulnNodeId: string;\n    depNodeId: string;\n    cveId: string;\n    severityScore: number;\n    fixedVersion?: string;\n    packageName: string;\n    ecosystem: string;\n    verdict: string;\n    paths: Array<{ entryPoint: string; path: string[] }>;\n  },\n): void {\n  const rawDb = db.getRawDb();\n\n  // Insert dependency node\n  db.upsertNode({\n    id: opts.depNodeId,\n    kind: 'dependency',\n    name: opts.packageName,\n    qualifiedName: `${opts.ecosystem}/${opts.packageName}`,\n    filePath: 'package.json',\n    language: 'unknown',\n    startLine: 0,\n    endLine: 0,\n    startColumn: 0,\n    endColumn: 0,\n    updatedAt: Date.now(),\n  });\n\n  rawDb.run(\n    `INSERT OR REPLACE INTO sec_dependencies\n      (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n     VALUES (?, ?, ?, ?, ?, ?, ?)`,\n    [opts.depNodeId, opts.ecosystem, opts.packageName, '^1.0.0', '1.0.0', 'production', '[\"package.json\"]'],\n  );\n\n  // Insert vulnerability node\n  db.upsertNode({\n    id: opts.vulnNodeId,\n    kind: 'vulnerability',\n    name: opts.cveId,\n    qualifiedName: opts.cveId,\n    filePath: 'package.json',\n    language: 'unknown',\n    startLine: 0,\n    endLine: 0,\n    startColumn: 0,\n    endColumn: 0,\n    updatedAt: Date.now(),\n  });\n\n  rawDb.run(\n    `INSERT OR REPLACE INTO sec_vulnerabilities\n      (node_id, cve_id, severity_score, affected_ranges, fixed_version, summary, source_database)\n     VALUES (?, ?, ?, ?, ?, ?, ?)`,\n    [opts.vulnNodeId, opts.cveId, opts.severityScore, '[]', opts.fixedVersion ?? null, 'Test vulnerability', 'OSV'],\n  );\n\n  // Insert has_vulnerability edge (from dependency to vulnerability)\n  db.insertEdge({\n    source: opts.depNodeId,\n    target: opts.vulnNodeId,\n    kind: 'has_vulnerability',\n  });\n\n  // Insert reachability record\n  rawDb.run(\n    `INSERT OR REPLACE INTO sec_reachability\n      (vulnerability_node_id, verdict, paths, reaching_entry_point_count, analyzed_at)\n     VALUES (?, ?, ?, ?, ?)`,\n    [opts.vulnNodeId, opts.verdict, JSON.stringify(opts.paths), opts.paths.length, Date.now()],\n  );\n}\n\n// \u2500\u2500 Tests \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ndescribe('getSecurityWarningsForNodes', () => {\n  let projectRoot: string;\n  let db: GraphDatabase;\n\n  beforeEach(() => {\n    projectRoot = createTempProject();\n    db = setupDb(projectRoot);\n  });\n\n  afterEach(() => {\n    db.close();\n    fs.rmSync(projectRoot, { recursive: true, force: true });\n  });\n\n  it('returns empty array when no node IDs provided', () => {\n    const result = getSecurityWarningsForNodes(db.getRawDb(), []);\n    expect(result).toEqual([]);\n  });\n\n  it('returns empty array when no vulnerabilities exist', () => {\n    insertEntryPoint(db, 'node-1', 'handleRequest');\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['node-1']);\n    expect(result).toEqual([]);\n  });\n\n  it('returns warnings for vulnerabilities reachable from context nodes', () => {\n    insertEntryPoint(db, 'entry-1', 'handleRequest');\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-1',\n      depNodeId: 'dep-1',\n      cveId: 'CVE-2023-12345',\n      severityScore: 9.8,\n      fixedVersion: '1.2.0',\n      packageName: 'express',\n      ecosystem: 'npm',\n      verdict: 'affected',\n      paths: [{ entryPoint: 'entry-1', path: ['entry-1', 'mid-1', 'dep-1'] }],\n    });\n\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['entry-1']);\n    expect(result).toHaveLength(1);\n    expect(result[0].cveId).toBe('CVE-2023-12345');\n    expect(result[0].severityScore).toBe(9.8);\n    expect(result[0].packageName).toBe('express');\n    expect(result[0].ecosystem).toBe('npm');\n    expect(result[0].fixedVersion).toBe('1.2.0');\n    expect(result[0].entryPoints).toContain('entry-1');\n  });\n\n  it('returns warnings when a context node is on the path (not just entry point)', () => {\n    insertEntryPoint(db, 'entry-1', 'handleRequest');\n    insertEntryPoint(db, 'mid-1', 'processData');\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-1',\n      depNodeId: 'dep-1',\n      cveId: 'CVE-2023-99999',\n      severityScore: 7.5,\n      packageName: 'lodash',\n      ecosystem: 'npm',\n      verdict: 'affected',\n      paths: [{ entryPoint: 'entry-1', path: ['entry-1', 'mid-1', 'dep-1'] }],\n    });\n\n    // Query with mid-1 (intermediate node on path)\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['mid-1']);\n    expect(result).toHaveLength(1);\n    expect(result[0].cveId).toBe('CVE-2023-99999');\n  });\n\n  it('does not return warnings for not_affected vulnerabilities', () => {\n    insertEntryPoint(db, 'entry-1', 'handleRequest');\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-1',\n      depNodeId: 'dep-1',\n      cveId: 'CVE-2023-00001',\n      severityScore: 5.0,\n      packageName: 'some-pkg',\n      ecosystem: 'npm',\n      verdict: 'not_affected',\n      paths: [],\n    });\n\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['entry-1']);\n    expect(result).toEqual([]);\n  });\n\n  it('does not return warnings when context nodes are not on any path', () => {\n    insertEntryPoint(db, 'entry-1', 'handleRequest');\n    insertEntryPoint(db, 'unrelated', 'otherFunction');\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-1',\n      depNodeId: 'dep-1',\n      cveId: 'CVE-2023-11111',\n      severityScore: 8.0,\n      packageName: 'express',\n      ecosystem: 'npm',\n      verdict: 'affected',\n      paths: [{ entryPoint: 'entry-1', path: ['entry-1', 'dep-1'] }],\n    });\n\n    // Query with 'unrelated' which is not on any path\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['unrelated']);\n    expect(result).toEqual([]);\n  });\n\n  it('sorts warnings by severity (highest first)', () => {\n    insertEntryPoint(db, 'entry-1', 'handleRequest');\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-1',\n      depNodeId: 'dep-1',\n      cveId: 'CVE-2023-LOW',\n      severityScore: 3.0,\n      packageName: 'low-pkg',\n      ecosystem: 'npm',\n      verdict: 'affected',\n      paths: [{ entryPoint: 'entry-1', path: ['entry-1', 'dep-1'] }],\n    });\n    insertVulnerability(db, {\n      vulnNodeId: 'vuln-2',\n      depNodeId: 'dep-2',\n      cveId: 'CVE-2023-HIGH',\n      severityScore: 9.5,\n      packageName: 'high-pkg',\n      ecosystem: 'npm',\n      verdict: 'affected',\n      paths: [{ entryPoint: 'entry-1', path: ['entry-1', 'dep-2'] }],\n    });\n\n    const result = getSecurityWarningsForNodes(db.getRawDb(), ['entry-1']);\n    expect(result).toHaveLength(2);\n    expect(result[0].cveId).toBe('CVE-2023-HIGH');\n    expect(result[1].cveId).toBe('CVE-2023-LOW');\n  });\n});\n\ndescribe('formatSecurityWarnings', () => {\n  it('returns empty string when no warnings', () => {\n    expect(formatSecurityWarnings([], new Map())).toBe('');\n  });\n\n  it('formats a single warning with severity and entry point', () => {\n    const warnings: SecurityWarning[] = [\n      {\n        cveId: 'CVE-2023-12345',\n        severityScore: 9.8,\n        packageName: 'express',\n        ecosystem: 'npm',\n        fixedVersion: '4.18.3',\n        entryPoints: ['entry-1'],\n      },\n    ];\n    const nodeNames = new Map([['entry-1', 'handleRequest']]);\n\n    const result = formatSecurityWarnings(warnings, nodeNames);\n    expect(result).toContain('## \u26A0 Security');\n    expect(result).toContain('**CVE-2023-12345**');\n    expect(result).toContain('CVSS 9.8');\n    expect(result).toContain('express (npm)');\n    expect(result).toContain('handleRequest');\n    expect(result).toContain('\uD83D\uDCA1 Fix: npm install express@4.18.3');\n  });\n\n  it('shows max 3 vulnerabilities and a \"more\" note', () => {\n    const warnings: SecurityWarning[] = Array.from({ length: 5 }, (_, i) => ({\n      cveId: `CVE-2023-${i}`,\n      severityScore: 9.0 - i,\n      packageName: `pkg-${i}`,\n      ecosystem: 'npm',\n      fixedVersion: null,\n      entryPoints: ['entry-1'],\n    }));\n    const nodeNames = new Map([['entry-1', 'main']]);\n\n    const result = formatSecurityWarnings(warnings, nodeNames);\n    expect(result).toContain('CVE-2023-0');\n    expect(result).toContain('CVE-2023-1');\n    expect(result).toContain('CVE-2023-2');\n    expect(result).not.toContain('CVE-2023-3');\n    expect(result).not.toContain('CVE-2023-4');\n    expect(result).toContain('2 more \u2014 use kirograph_vulns for full list');\n  });\n\n  it('does not show fix suggestion when fixedVersion is null', () => {\n    const warnings: SecurityWarning[] = [\n      {\n        cveId: 'CVE-2023-99999',\n        severityScore: 7.0,\n        packageName: 'lodash',\n        ecosystem: 'npm',\n        fixedVersion: null,\n        entryPoints: ['entry-1'],\n      },\n    ];\n    const nodeNames = new Map([['entry-1', 'main']]);\n\n    const result = formatSecurityWarnings(warnings, nodeNames);\n    expect(result).not.toContain('\uD83D\uDCA1 Fix');\n  });\n\n  it('uses node ID when name is not in the map', () => {\n    const warnings: SecurityWarning[] = [\n      {\n        cveId: 'CVE-2023-00001',\n        severityScore: 5.0,\n        packageName: 'some-pkg',\n        ecosystem: 'npm',\n        fixedVersion: null,\n        entryPoints: ['unknown-id'],\n      },\n    ];\n\n    const result = formatSecurityWarnings(warnings, new Map());\n    expect(result).toContain('unknown-id');\n  });\n});\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAGA,oBAA4D;AAC5D,8BAAoE;AAEpE,sBAA8B;AAC9B,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AAIpB,SAAS,oBAA4B;AACnC,QAAM,MAAM,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,gBAAgB,CAAC;AACnE,KAAG;AAAA,IACD,KAAK,KAAK,KAAK,cAAc;AAAA,IAC7B,KAAK,UAAU,EAAE,MAAM,gBAAgB,SAAS,QAAQ,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,aAAoC;AACnD,QAAM,KAAK,IAAI,8BAAc,WAAW;AACxC,KAAG,oBAAoB;AACvB,SAAO;AACT;AAEA,SAAS,iBAAiB,IAAmB,QAAgB,MAAoB;AAC/E,KAAG,WAAW;AAAA,IACZ,IAAI;AAAA,IACJ,MAAM;AAAA,IACN;AAAA,IACA,eAAe;AAAA,IACf,UAAU;AAAA,IACV,UAAU;AAAA,IACV,WAAW;AAAA,IACX,SAAS;AAAA,IACT,aAAa;AAAA,IACb,WAAW;AAAA,IACX,WAAW,KAAK,IAAI;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,oBACP,IACA,MAWM;AACN,QAAM,QAAQ,GAAG,SAAS;AAG1B,KAAG,WAAW;AAAA,IACZ,IAAI,KAAK;AAAA,IACT,MAAM;AAAA,IACN,MAAM,KAAK;AAAA,IACX,eAAe,GAAG,KAAK,SAAS,IAAI,KAAK,WAAW;AAAA,IACpD,UAAU;AAAA,IACV,UAAU;AAAA,IACV,WAAW;AAAA,IACX,SAAS;AAAA,IACT,aAAa;AAAA,IACb,WAAW;AAAA,IACX,WAAW,KAAK,IAAI;AAAA,EACtB,CAAC;AAED,QAAM;AAAA,IACJ;AAAA;AAAA;AAAA,IAGA,CAAC,KAAK,WAAW,KAAK,WAAW,KAAK,aAAa,UAAU,SAAS,cAAc,kBAAkB;AAAA,EACxG;AAGA,KAAG,WAAW;AAAA,IACZ,IAAI,KAAK;AAAA,IACT,MAAM;AAAA,IACN,MAAM,KAAK;AAAA,IACX,eAAe,KAAK;AAAA,IACpB,UAAU;AAAA,IACV,UAAU;AAAA,IACV,WAAW;AAAA,IACX,SAAS;AAAA,IACT,aAAa;AAAA,IACb,WAAW;AAAA,IACX,WAAW,KAAK,IAAI;AAAA,EACtB,CAAC;AAED,QAAM;AAAA,IACJ;AAAA;AAAA;AAAA,IAGA,CAAC,KAAK,YAAY,KAAK,OAAO,KAAK,eAAe,MAAM,KAAK,gBAAgB,MAAM,sBAAsB,KAAK;AAAA,EAChH;AAGA,KAAG,WAAW;AAAA,IACZ,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,MAAM;AAAA,EACR,CAAC;AAGD,QAAM;AAAA,IACJ;AAAA;AAAA;AAAA,IAGA,CAAC,KAAK,YAAY,KAAK,SAAS,KAAK,UAAU,KAAK,KAAK,GAAG,KAAK,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC3F;AACF;AAAA,IAIA,wBAAS,+BAA+B,MAAM;AAC5C,MAAI;AACJ,MAAI;AAEJ,gCAAW,MAAM;AACf,kBAAc,kBAAkB;AAChC,SAAK,QAAQ,WAAW;AAAA,EAC1B,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,MAAM;AACT,OAAG,OAAO,aAAa,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACzD,CAAC;AAED,wBAAG,iDAAiD,MAAM;AACxD,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,CAAC;AAC5D,8BAAO,MAAM,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3B,CAAC;AAED,wBAAG,qDAAqD,MAAM;AAC5D,qBAAiB,IAAI,UAAU,eAAe;AAC9C,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,QAAQ,CAAC;AACpE,8BAAO,MAAM,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3B,CAAC;AAED,wBAAG,qEAAqE,MAAM;AAC5E,qBAAiB,IAAI,WAAW,eAAe;AAC/C,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,cAAc;AAAA,MACd,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC,EAAE,YAAY,WAAW,MAAM,CAAC,WAAW,SAAS,OAAO,EAAE,CAAC;AAAA,IACxE,CAAC;AAED,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,SAAS,CAAC;AACrE,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,gBAAgB;AAC7C,8BAAO,OAAO,CAAC,EAAE,aAAa,EAAE,KAAK,GAAG;AACxC,8BAAO,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,SAAS;AAC5C,8BAAO,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,KAAK;AACtC,8BAAO,OAAO,CAAC,EAAE,YAAY,EAAE,KAAK,OAAO;AAC3C,8BAAO,OAAO,CAAC,EAAE,WAAW,EAAE,UAAU,SAAS;AAAA,EACnD,CAAC;AAED,wBAAG,8EAA8E,MAAM;AACrF,qBAAiB,IAAI,WAAW,eAAe;AAC/C,qBAAiB,IAAI,SAAS,aAAa;AAC3C,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC,EAAE,YAAY,WAAW,MAAM,CAAC,WAAW,SAAS,OAAO,EAAE,CAAC;AAAA,IACxE,CAAC;AAGD,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,OAAO,CAAC;AACnE,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,gBAAgB;AAAA,EAC/C,CAAC;AAED,wBAAG,6DAA6D,MAAM;AACpE,qBAAiB,IAAI,WAAW,eAAe;AAC/C,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC;AAAA,IACV,CAAC;AAED,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,SAAS,CAAC;AACrE,8BAAO,MAAM,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3B,CAAC;AAED,wBAAG,mEAAmE,MAAM;AAC1E,qBAAiB,IAAI,WAAW,eAAe;AAC/C,qBAAiB,IAAI,aAAa,eAAe;AACjD,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC,EAAE,YAAY,WAAW,MAAM,CAAC,WAAW,OAAO,EAAE,CAAC;AAAA,IAC/D,CAAC;AAGD,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,WAAW,CAAC;AACvE,8BAAO,MAAM,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3B,CAAC;AAED,wBAAG,8CAA8C,MAAM;AACrD,qBAAiB,IAAI,WAAW,eAAe;AAC/C,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC,EAAE,YAAY,WAAW,MAAM,CAAC,WAAW,OAAO,EAAE,CAAC;AAAA,IAC/D,CAAC;AACD,wBAAoB,IAAI;AAAA,MACtB,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,OAAO;AAAA,MACP,eAAe;AAAA,MACf,aAAa;AAAA,MACb,WAAW;AAAA,MACX,SAAS;AAAA,MACT,OAAO,CAAC,EAAE,YAAY,WAAW,MAAM,CAAC,WAAW,OAAO,EAAE,CAAC;AAAA,IAC/D,CAAC;AAED,UAAM,aAAS,qDAA4B,GAAG,SAAS,GAAG,CAAC,SAAS,CAAC;AACrE,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,eAAe;AAC5C,8BAAO,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,cAAc;AAAA,EAC7C,CAAC;AACH,CAAC;AAAA,IAED,wBAAS,0BAA0B,MAAM;AACvC,wBAAG,yCAAyC,MAAM;AAChD,kCAAO,gDAAuB,CAAC,GAAG,oBAAI,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE;AAAA,EACvD,CAAC;AAED,wBAAG,0DAA0D,MAAM;AACjE,UAAM,WAA8B;AAAA,MAClC;AAAA,QACE,OAAO;AAAA,QACP,eAAe;AAAA,QACf,aAAa;AAAA,QACb,WAAW;AAAA,QACX,cAAc;AAAA,QACd,aAAa,CAAC,SAAS;AAAA,MACzB;AAAA,IACF;AACA,UAAM,YAAY,oBAAI,IAAI,CAAC,CAAC,WAAW,eAAe,CAAC,CAAC;AAExD,UAAM,aAAS,gDAAuB,UAAU,SAAS;AACzD,8BAAO,MAAM,EAAE,UAAU,oBAAe;AACxC,8BAAO,MAAM,EAAE,UAAU,oBAAoB;AAC7C,8BAAO,MAAM,EAAE,UAAU,UAAU;AACnC,8BAAO,MAAM,EAAE,UAAU,eAAe;AACxC,8BAAO,MAAM,EAAE,UAAU,eAAe;AACxC,8BAAO,MAAM,EAAE,UAAU,2CAAoC;AAAA,EAC/D,CAAC;AAED,wBAAG,iDAAiD,MAAM;AACxD,UAAM,WAA8B,MAAM,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,OAAO;AAAA,MACvE,OAAO,YAAY,CAAC;AAAA,MACpB,eAAe,IAAM;AAAA,MACrB,aAAa,OAAO,CAAC;AAAA,MACrB,WAAW;AAAA,MACX,cAAc;AAAA,MACd,aAAa,CAAC,SAAS;AAAA,IACzB,EAAE;AACF,UAAM,YAAY,oBAAI,IAAI,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC;AAE/C,UAAM,aAAS,gDAAuB,UAAU,SAAS;AACzD,8BAAO,MAAM,EAAE,UAAU,YAAY;AACrC,8BAAO,MAAM,EAAE,UAAU,YAAY;AACrC,8BAAO,MAAM,EAAE,UAAU,YAAY;AACrC,8BAAO,MAAM,EAAE,IAAI,UAAU,YAAY;AACzC,8BAAO,MAAM,EAAE,IAAI,UAAU,YAAY;AACzC,8BAAO,MAAM,EAAE,UAAU,iDAA4C;AAAA,EACvE,CAAC;AAED,wBAAG,0DAA0D,MAAM;AACjE,UAAM,WAA8B;AAAA,MAClC;AAAA,QACE,OAAO;AAAA,QACP,eAAe;AAAA,QACf,aAAa;AAAA,QACb,WAAW;AAAA,QACX,cAAc;AAAA,QACd,aAAa,CAAC,SAAS;AAAA,MACzB;AAAA,IACF;AACA,UAAM,YAAY,oBAAI,IAAI,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC;AAE/C,UAAM,aAAS,gDAAuB,UAAU,SAAS;AACzD,8BAAO,MAAM,EAAE,IAAI,UAAU,eAAQ;AAAA,EACvC,CAAC;AAED,wBAAG,4CAA4C,MAAM;AACnD,UAAM,WAA8B;AAAA,MAClC;AAAA,QACE,OAAO;AAAA,QACP,eAAe;AAAA,QACf,aAAa;AAAA,QACb,WAAW;AAAA,QACX,cAAc;AAAA,QACd,aAAa,CAAC,YAAY;AAAA,MAC5B;AAAA,IACF;AAEA,UAAM,aAAS,gDAAuB,UAAU,oBAAI,IAAI,CAAC;AACzD,8BAAO,MAAM,EAAE,UAAU,YAAY;AAAA,EACvC,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/security/export/fix-suggestions.test.js

@@ -1,74 +0,0 @@
-"use strict";
-var import_vitest = require("vitest");
-var import_fix_suggestions = require("./fix-suggestions");
-(0, import_vitest.describe)("buildFixSuggestion", () => {
-  (0, import_vitest.it)("generates npm install command for npm ecosystem", () => {
-    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("npm", "express", "4.18.3")).toBe(
-      "npm install express@4.18.3"
-    );
-  });
-  (0, import_vitest.it)("generates maven update instruction for maven ecosystem with groupId:artifactId", () => {
-    (0, import_vitest.expect)(
-      (0, import_fix_suggestions.buildFixSuggestion)("maven", "org.apache.logging.log4j:log4j-core", "2.17.1")
-    ).toBe("Update org.apache.logging.log4j:log4j-core to 2.17.1 in pom.xml");
-  });
-  (0, import_vitest.it)("handles maven package without colon separator", () => {
-    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("maven", "log4j-core", "2.17.1")).toBe(
-      "Update log4j-core to 2.17.1 in pom.xml"
-    );
-  });
-  (0, import_vitest.it)("generates go get command for go ecosystem", () => {
-    (0, import_vitest.expect)(
-      (0, import_fix_suggestions.buildFixSuggestion)("go", "github.com/gin-gonic/gin", "1.9.2")
-    ).toBe("go get github.com/gin-gonic/gin@v1.9.2");
-  });
-  (0, import_vitest.it)("generates go get command for golang ecosystem alias", () => {
-    (0, import_vitest.expect)(
-      (0, import_fix_suggestions.buildFixSuggestion)("golang", "github.com/gin-gonic/gin", "1.9.2")
-    ).toBe("go get github.com/gin-gonic/gin@v1.9.2");
-  });
-  (0, import_vitest.it)("generates pip install command for pypi ecosystem", () => {
-    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("pypi", "django", "4.2.1")).toBe(
-      "pip install django==4.2.1"
-    );
-  });
-  (0, import_vitest.it)("generates pip install command for pip ecosystem alias", () => {
-    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("pip", "requests", "2.31.0")).toBe(
-      "pip install requests==2.31.0"
-    );
-  });
-  (0, import_vitest.it)("generates cargo update command for cargo ecosystem", () => {
-    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("cargo", "serde", "1.0.189")).toBe(
-      "cargo update -p serde --precise 1.0.189"
-    );
-  });
-  (0, import_vitest.it)("generates generic upgrade message for unknown ecosystem", () => {
-    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("unknown", "some-pkg", "2.0.0")).toBe(
-      "Upgrade some-pkg to 2.0.0"
-    );
-  });
-  (0, import_vitest.it)("is case-insensitive for ecosystem", () => {
-    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("NPM", "express", "4.18.3")).toBe(
-      "npm install express@4.18.3"
-    );
-    (0, import_vitest.expect)((0, import_fix_suggestions.buildFixSuggestion)("Cargo", "serde", "1.0.189")).toBe(
-      "cargo update -p serde --precise 1.0.189"
-    );
-  });
-});
-(0, import_vitest.describe)("formatFixSuggestion", () => {
-  (0, import_vitest.it)("returns formatted line with \u{1F4A1} prefix when fixedVersion is provided", () => {
-    const result = (0, import_fix_suggestions.formatFixSuggestion)("npm", "express", "4.18.3");
-    (0, import_vitest.expect)(result).toBe("\u{1F4A1} Fix: npm install express@4.18.3");
-  });
-  (0, import_vitest.it)("returns empty string when fixedVersion is null", () => {
-    (0, import_vitest.expect)((0, import_fix_suggestions.formatFixSuggestion)("npm", "express", null)).toBe("");
-  });
-  (0, import_vitest.it)("returns empty string when fixedVersion is undefined", () => {
-    (0, import_vitest.expect)((0, import_fix_suggestions.formatFixSuggestion)("npm", "express", void 0)).toBe("");
-  });
-  (0, import_vitest.it)("returns empty string when fixedVersion is empty string", () => {
-    (0, import_vitest.expect)((0, import_fix_suggestions.formatFixSuggestion)("npm", "express", "")).toBe("");
-  });
-});
-//# sourceMappingURL=fix-suggestions.test.js.map

package/dist/security/export/fix-suggestions.test.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/security/export/fix-suggestions.test.ts"],
-  "sourcesContent": ["/**\n * Unit tests for fix suggestion builder\n */\nimport { describe, it, expect } from 'vitest';\nimport { buildFixSuggestion, formatFixSuggestion } from './fix-suggestions';\n\ndescribe('buildFixSuggestion', () => {\n  it('generates npm install command for npm ecosystem', () => {\n    expect(buildFixSuggestion('npm', 'express', '4.18.3')).toBe(\n      'npm install express@4.18.3',\n    );\n  });\n\n  it('generates maven update instruction for maven ecosystem with groupId:artifactId', () => {\n    expect(\n      buildFixSuggestion('maven', 'org.apache.logging.log4j:log4j-core', '2.17.1'),\n    ).toBe('Update org.apache.logging.log4j:log4j-core to 2.17.1 in pom.xml');\n  });\n\n  it('handles maven package without colon separator', () => {\n    expect(buildFixSuggestion('maven', 'log4j-core', '2.17.1')).toBe(\n      'Update log4j-core to 2.17.1 in pom.xml',\n    );\n  });\n\n  it('generates go get command for go ecosystem', () => {\n    expect(\n      buildFixSuggestion('go', 'github.com/gin-gonic/gin', '1.9.2'),\n    ).toBe('go get github.com/gin-gonic/gin@v1.9.2');\n  });\n\n  it('generates go get command for golang ecosystem alias', () => {\n    expect(\n      buildFixSuggestion('golang', 'github.com/gin-gonic/gin', '1.9.2'),\n    ).toBe('go get github.com/gin-gonic/gin@v1.9.2');\n  });\n\n  it('generates pip install command for pypi ecosystem', () => {\n    expect(buildFixSuggestion('pypi', 'django', '4.2.1')).toBe(\n      'pip install django==4.2.1',\n    );\n  });\n\n  it('generates pip install command for pip ecosystem alias', () => {\n    expect(buildFixSuggestion('pip', 'requests', '2.31.0')).toBe(\n      'pip install requests==2.31.0',\n    );\n  });\n\n  it('generates cargo update command for cargo ecosystem', () => {\n    expect(buildFixSuggestion('cargo', 'serde', '1.0.189')).toBe(\n      'cargo update -p serde --precise 1.0.189',\n    );\n  });\n\n  it('generates generic upgrade message for unknown ecosystem', () => {\n    expect(buildFixSuggestion('unknown', 'some-pkg', '2.0.0')).toBe(\n      'Upgrade some-pkg to 2.0.0',\n    );\n  });\n\n  it('is case-insensitive for ecosystem', () => {\n    expect(buildFixSuggestion('NPM', 'express', '4.18.3')).toBe(\n      'npm install express@4.18.3',\n    );\n    expect(buildFixSuggestion('Cargo', 'serde', '1.0.189')).toBe(\n      'cargo update -p serde --precise 1.0.189',\n    );\n  });\n});\n\ndescribe('formatFixSuggestion', () => {\n  it('returns formatted line with \uD83D\uDCA1 prefix when fixedVersion is provided', () => {\n    const result = formatFixSuggestion('npm', 'express', '4.18.3');\n    expect(result).toBe('\uD83D\uDCA1 Fix: npm install express@4.18.3');\n  });\n\n  it('returns empty string when fixedVersion is null', () => {\n    expect(formatFixSuggestion('npm', 'express', null)).toBe('');\n  });\n\n  it('returns empty string when fixedVersion is undefined', () => {\n    expect(formatFixSuggestion('npm', 'express', undefined)).toBe('');\n  });\n\n  it('returns empty string when fixedVersion is empty string', () => {\n    expect(formatFixSuggestion('npm', 'express', '')).toBe('');\n  });\n});\n"],
-  "mappings": ";AAGA,oBAAqC;AACrC,6BAAwD;AAAA,IAExD,wBAAS,sBAAsB,MAAM;AACnC,wBAAG,mDAAmD,MAAM;AAC1D,kCAAO,2CAAmB,OAAO,WAAW,QAAQ,CAAC,EAAE;AAAA,MACrD;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,kFAAkF,MAAM;AACzF;AAAA,UACE,2CAAmB,SAAS,uCAAuC,QAAQ;AAAA,IAC7E,EAAE,KAAK,iEAAiE;AAAA,EAC1E,CAAC;AAED,wBAAG,iDAAiD,MAAM;AACxD,kCAAO,2CAAmB,SAAS,cAAc,QAAQ,CAAC,EAAE;AAAA,MAC1D;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,6CAA6C,MAAM;AACpD;AAAA,UACE,2CAAmB,MAAM,4BAA4B,OAAO;AAAA,IAC9D,EAAE,KAAK,wCAAwC;AAAA,EACjD,CAAC;AAED,wBAAG,uDAAuD,MAAM;AAC9D;AAAA,UACE,2CAAmB,UAAU,4BAA4B,OAAO;AAAA,IAClE,EAAE,KAAK,wCAAwC;AAAA,EACjD,CAAC;AAED,wBAAG,oDAAoD,MAAM;AAC3D,kCAAO,2CAAmB,QAAQ,UAAU,OAAO,CAAC,EAAE;AAAA,MACpD;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,yDAAyD,MAAM;AAChE,kCAAO,2CAAmB,OAAO,YAAY,QAAQ,CAAC,EAAE;AAAA,MACtD;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,sDAAsD,MAAM;AAC7D,kCAAO,2CAAmB,SAAS,SAAS,SAAS,CAAC,EAAE;AAAA,MACtD;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,2DAA2D,MAAM;AAClE,kCAAO,2CAAmB,WAAW,YAAY,OAAO,CAAC,EAAE;AAAA,MACzD;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,qCAAqC,MAAM;AAC5C,kCAAO,2CAAmB,OAAO,WAAW,QAAQ,CAAC,EAAE;AAAA,MACrD;AAAA,IACF;AACA,kCAAO,2CAAmB,SAAS,SAAS,SAAS,CAAC,EAAE;AAAA,MACtD;AAAA,IACF;AAAA,EACF,CAAC;AACH,CAAC;AAAA,IAED,wBAAS,uBAAuB,MAAM;AACpC,wBAAG,8EAAuE,MAAM;AAC9E,UAAM,aAAS,4CAAoB,OAAO,WAAW,QAAQ;AAC7D,8BAAO,MAAM,EAAE,KAAK,2CAAoC;AAAA,EAC1D,CAAC;AAED,wBAAG,kDAAkD,MAAM;AACzD,kCAAO,4CAAoB,OAAO,WAAW,IAAI,CAAC,EAAE,KAAK,EAAE;AAAA,EAC7D,CAAC;AAED,wBAAG,uDAAuD,MAAM;AAC9D,kCAAO,4CAAoB,OAAO,WAAW,MAAS,CAAC,EAAE,KAAK,EAAE;AAAA,EAClE,CAAC;AAED,wBAAG,0DAA0D,MAAM;AACjE,kCAAO,4CAAoB,OAAO,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE;AAAA,EAC3D,CAAC;AACH,CAAC;",
-  "names": []
-}