kirograph 0.19.0 → 0.20.0

package/dist/security/integrator-transitives.test.js

@@ -1,359 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var import_vitest = require("vitest");
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
-var os = __toESM(require("os"));
-var import_integrator = require("./integrator");
-var import_database = require("../db/database");
-(0, import_vitest.describe)("DependencyGraphIntegrator.resolveTransitives()", () => {
-  let db;
-  let tmpDir;
-  (0, import_vitest.beforeEach)(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "kirograph-transitives-test-"));
-    db = new import_database.GraphDatabase(tmpDir);
-    db.applySecuritySchema();
-  });
-  (0, import_vitest.afterEach)(() => {
-    db.close();
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-  function createDepNode(name, ecosystem, version) {
-    const nodeId = `dep:${ecosystem}:${name}`;
-    const rawDb = db.getRawDb();
-    const node = {
-      id: nodeId,
-      kind: "dependency",
-      name,
-      qualifiedName: `${ecosystem}/${name}`,
-      filePath: "package.json",
-      language: "unknown",
-      startLine: 0,
-      endLine: 0,
-      startColumn: 0,
-      endColumn: 0,
-      isExported: false,
-      isAsync: false,
-      isStatic: false,
-      isAbstract: false,
-      updatedAt: Date.now()
-    };
-    db.upsertNode(node);
-    rawDb.run(
-      `INSERT OR REPLACE INTO sec_dependencies
-        (node_id, ecosystem, package_name, declared_constraint,
-         resolved_version, scope, source_manifests)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`,
-      [
-        nodeId,
-        ecosystem,
-        name,
-        version ?? "^1.0.0",
-        version ?? "1.0.0",
-        "production",
-        '["package.json"]'
-      ]
-    );
-    return nodeId;
-  }
-  (0, import_vitest.it)("should create depends_on edges from npm package-lock.json", async () => {
-    createDepNode("express", "npm");
-    createDepNode("body-parser", "npm");
-    createDepNode("accepts", "npm");
-    const lockData = {
-      name: "test-project",
-      lockfileVersion: 3,
-      packages: {
-        "": { name: "test-project", version: "1.0.0" },
-        "node_modules/express": {
-          version: "4.18.2",
-          dependencies: { "body-parser": "^1.20.0", accepts: "~1.3.8" }
-        },
-        "node_modules/body-parser": {
-          version: "1.20.2",
-          dependencies: {}
-        },
-        "node_modules/accepts": {
-          version: "1.3.8",
-          dependencies: {}
-        }
-      }
-    };
-    fs.writeFileSync(
-      path.join(tmpDir, "package-lock.json"),
-      JSON.stringify(lockData, null, 2)
-    );
-    const integrator = new import_integrator.DependencyGraphIntegrator(db, tmpDir);
-    const result = await integrator.resolveTransitives(10);
-    (0, import_vitest.expect)(result.dependsOnEdgesCreated).toBe(2);
-    (0, import_vitest.expect)(result.incompleteNodes).toHaveLength(0);
-    const edges = db.getAllEdges();
-    const dependsOnEdges = edges.filter((e) => e.kind === "depends_on");
-    (0, import_vitest.expect)(dependsOnEdges).toHaveLength(2);
-    (0, import_vitest.expect)(dependsOnEdges).toContainEqual(
-      import_vitest.expect.objectContaining({
-        source: "dep:npm:express",
-        target: "dep:npm:body-parser",
-        kind: "depends_on"
-      })
-    );
-    (0, import_vitest.expect)(dependsOnEdges).toContainEqual(
-      import_vitest.expect.objectContaining({
-        source: "dep:npm:express",
-        target: "dep:npm:accepts",
-        kind: "depends_on"
-      })
-    );
-  });
-  (0, import_vitest.it)("should mark dependencies as incomplete when no lock file exists", async () => {
-    createDepNode("serde", "cargo");
-    createDepNode("tokio", "cargo");
-    const integrator = new import_integrator.DependencyGraphIntegrator(db, tmpDir);
-    const result = await integrator.resolveTransitives(10);
-    (0, import_vitest.expect)(result.dependsOnEdgesCreated).toBe(0);
-    (0, import_vitest.expect)(result.incompleteNodes).toHaveLength(2);
-    (0, import_vitest.expect)(result.incompleteNodes).toContain("dep:cargo:serde");
-    (0, import_vitest.expect)(result.incompleteNodes).toContain("dep:cargo:tokio");
-    const rawDb = db.getRawDb();
-    const row = rawDb.get(
-      "SELECT transitive_status FROM sec_dependencies WHERE node_id = ?",
-      ["dep:cargo:serde"]
-    );
-    (0, import_vitest.expect)(row.transitive_status).toBe("incomplete");
-  });
-  (0, import_vitest.it)("should respect maxDepth limit", async () => {
-    createDepNode("a", "npm");
-    createDepNode("b", "npm");
-    createDepNode("c", "npm");
-    createDepNode("d", "npm");
-    const lockData = {
-      name: "test-project",
-      lockfileVersion: 3,
-      packages: {
-        "": { name: "test-project", version: "1.0.0" },
-        "node_modules/a": {
-          version: "1.0.0",
-          dependencies: { b: "^1.0.0" }
-        },
-        "node_modules/b": {
-          version: "1.0.0",
-          dependencies: { c: "^1.0.0" }
-        },
-        "node_modules/c": {
-          version: "1.0.0",
-          dependencies: { d: "^1.0.0" }
-        },
-        "node_modules/d": {
-          version: "1.0.0",
-          dependencies: {}
-        }
-      }
-    };
-    fs.writeFileSync(
-      path.join(tmpDir, "package-lock.json"),
-      JSON.stringify(lockData, null, 2)
-    );
-    const integrator = new import_integrator.DependencyGraphIntegrator(db, tmpDir);
-    const result = await integrator.resolveTransitives(1);
-    (0, import_vitest.expect)(result.dependsOnEdgesCreated).toBe(3);
-    const edges = db.getAllEdges();
-    const dependsOnEdges = edges.filter((e) => e.kind === "depends_on");
-    const edgePairs = dependsOnEdges.map((e) => `${e.source}->${e.target}`);
-    (0, import_vitest.expect)(edgePairs).toContain("dep:npm:a->dep:npm:b");
-    (0, import_vitest.expect)(edgePairs).toContain("dep:npm:b->dep:npm:c");
-    (0, import_vitest.expect)(edgePairs).toContain("dep:npm:c->dep:npm:d");
-    (0, import_vitest.expect)(edgePairs).not.toContain("dep:npm:a->dep:npm:c");
-    (0, import_vitest.expect)(edgePairs).not.toContain("dep:npm:a->dep:npm:d");
-  });
-  (0, import_vitest.it)("should handle Cargo.lock transitive dependencies", async () => {
-    createDepNode("serde", "cargo");
-    createDepNode("serde_derive", "cargo");
-    const cargoLock = `[[package]]
-name = "serde"
-version = "1.0.193"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.193"
-`;
-    fs.writeFileSync(path.join(tmpDir, "Cargo.lock"), cargoLock);
-    const integrator = new import_integrator.DependencyGraphIntegrator(db, tmpDir);
-    const result = await integrator.resolveTransitives(10);
-    (0, import_vitest.expect)(result.dependsOnEdgesCreated).toBe(1);
-    (0, import_vitest.expect)(result.incompleteNodes).toHaveLength(0);
-    const edges = db.getAllEdges();
-    const dependsOnEdges = edges.filter((e) => e.kind === "depends_on");
-    (0, import_vitest.expect)(dependsOnEdges).toContainEqual(
-      import_vitest.expect.objectContaining({
-        source: "dep:cargo:serde",
-        target: "dep:cargo:serde_derive",
-        kind: "depends_on"
-      })
-    );
-  });
-  (0, import_vitest.it)("should mark Go dependencies as incomplete (no tree in go.sum)", async () => {
-    createDepNode("github.com/gin-gonic/gin", "go");
-    fs.writeFileSync(
-      path.join(tmpDir, "go.sum"),
-      "github.com/gin-gonic/gin v1.9.1 h1:abc=\n"
-    );
-    const integrator = new import_integrator.DependencyGraphIntegrator(db, tmpDir);
-    const result = await integrator.resolveTransitives(10);
-    (0, import_vitest.expect)(result.dependsOnEdgesCreated).toBe(0);
-    (0, import_vitest.expect)(result.incompleteNodes).toHaveLength(1);
-    (0, import_vitest.expect)(result.incompleteNodes).toContain("dep:go:github.com/gin-gonic/gin");
-  });
-  (0, import_vitest.it)("should return empty result when no dependencies exist", async () => {
-    const integrator = new import_integrator.DependencyGraphIntegrator(db, tmpDir);
-    const result = await integrator.resolveTransitives(10);
-    (0, import_vitest.expect)(result.dependsOnEdgesCreated).toBe(0);
-    (0, import_vitest.expect)(result.incompleteNodes).toHaveLength(0);
-  });
-  (0, import_vitest.it)("should not create duplicate depends_on edges", async () => {
-    createDepNode("express", "npm");
-    createDepNode("body-parser", "npm");
-    const lockData = {
-      name: "test-project",
-      lockfileVersion: 3,
-      packages: {
-        "": { name: "test-project", version: "1.0.0" },
-        "node_modules/express": {
-          version: "4.18.2",
-          dependencies: { "body-parser": "^1.20.0" }
-        },
-        "node_modules/body-parser": {
-          version: "1.20.2",
-          dependencies: {}
-        }
-      }
-    };
-    fs.writeFileSync(
-      path.join(tmpDir, "package-lock.json"),
-      JSON.stringify(lockData, null, 2)
-    );
-    const integrator = new import_integrator.DependencyGraphIntegrator(db, tmpDir);
-    const result = await integrator.resolveTransitives(10);
-    (0, import_vitest.expect)(result.dependsOnEdgesCreated).toBe(1);
-    const edges = db.getAllEdges();
-    const dependsOnEdges = edges.filter((e) => e.kind === "depends_on");
-    (0, import_vitest.expect)(dependsOnEdges).toHaveLength(1);
-  });
-  (0, import_vitest.it)("should handle npm lockfileVersion 1 format", async () => {
-    createDepNode("express", "npm");
-    createDepNode("debug", "npm");
-    const lockData = {
-      name: "test-project",
-      lockfileVersion: 1,
-      dependencies: {
-        express: {
-          version: "4.18.2",
-          requires: { debug: "2.6.9" }
-        },
-        debug: {
-          version: "2.6.9"
-        }
-      }
-    };
-    fs.writeFileSync(
-      path.join(tmpDir, "package-lock.json"),
-      JSON.stringify(lockData, null, 2)
-    );
-    const integrator = new import_integrator.DependencyGraphIntegrator(db, tmpDir);
-    const result = await integrator.resolveTransitives(10);
-    (0, import_vitest.expect)(result.dependsOnEdgesCreated).toBe(1);
-    const edges = db.getAllEdges();
-    const dependsOnEdges = edges.filter((e) => e.kind === "depends_on");
-    (0, import_vitest.expect)(dependsOnEdges).toContainEqual(
-      import_vitest.expect.objectContaining({
-        source: "dep:npm:express",
-        target: "dep:npm:debug",
-        kind: "depends_on"
-      })
-    );
-  });
-  (0, import_vitest.it)("should handle deep transitive chains with maxDepth=10", async () => {
-    createDepNode("a", "npm");
-    createDepNode("b", "npm");
-    createDepNode("c", "npm");
-    createDepNode("d", "npm");
-    createDepNode("e", "npm");
-    const lockData = {
-      name: "test-project",
-      lockfileVersion: 3,
-      packages: {
-        "": { name: "test-project", version: "1.0.0" },
-        "node_modules/a": { version: "1.0.0", dependencies: { b: "1.0.0" } },
-        "node_modules/b": { version: "1.0.0", dependencies: { c: "1.0.0" } },
-        "node_modules/c": { version: "1.0.0", dependencies: { d: "1.0.0" } },
-        "node_modules/d": { version: "1.0.0", dependencies: { e: "1.0.0" } },
-        "node_modules/e": { version: "1.0.0", dependencies: {} }
-      }
-    };
-    fs.writeFileSync(
-      path.join(tmpDir, "package-lock.json"),
-      JSON.stringify(lockData, null, 2)
-    );
-    const integrator = new import_integrator.DependencyGraphIntegrator(db, tmpDir);
-    const result = await integrator.resolveTransitives(10);
-    (0, import_vitest.expect)(result.dependsOnEdgesCreated).toBe(4);
-    (0, import_vitest.expect)(result.incompleteNodes).toHaveLength(0);
-  });
-  (0, import_vitest.it)("should handle circular dependencies in lock file gracefully", async () => {
-    createDepNode("a", "npm");
-    createDepNode("b", "npm");
-    const lockData = {
-      name: "test-project",
-      lockfileVersion: 3,
-      packages: {
-        "": { name: "test-project", version: "1.0.0" },
-        "node_modules/a": { version: "1.0.0", dependencies: { b: "1.0.0" } },
-        "node_modules/b": { version: "1.0.0", dependencies: { a: "1.0.0" } }
-      }
-    };
-    fs.writeFileSync(
-      path.join(tmpDir, "package-lock.json"),
-      JSON.stringify(lockData, null, 2)
-    );
-    const integrator = new import_integrator.DependencyGraphIntegrator(db, tmpDir);
-    const result = await integrator.resolveTransitives(10);
-    (0, import_vitest.expect)(result.dependsOnEdgesCreated).toBe(2);
-    (0, import_vitest.expect)(result.incompleteNodes).toHaveLength(0);
-  });
-  (0, import_vitest.it)("should log warning with dependency name when marking incomplete", async () => {
-    createDepNode("flask", "python");
-    const integrator = new import_integrator.DependencyGraphIntegrator(db, tmpDir);
-    const result = await integrator.resolveTransitives(10);
-    (0, import_vitest.expect)(result.incompleteNodes).toContain("dep:python:flask");
-    const rawDb = db.getRawDb();
-    const row = rawDb.get(
-      "SELECT transitive_status FROM sec_dependencies WHERE node_id = ?",
-      ["dep:python:flask"]
-    );
-    (0, import_vitest.expect)(row.transitive_status).toBe("incomplete");
-  });
-});
-//# sourceMappingURL=integrator-transitives.test.js.map

package/dist/security/integrator-transitives.test.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../src/security/integrator-transitives.test.ts"],
-  "sourcesContent": ["/**\n * Tests for DependencyGraphIntegrator.resolveTransitives()\n *\n * Verifies transitive dependency resolution from lock files,\n * creation of depends_on edges, and incomplete status marking.\n *\n * Requirements: 2.3, 2.5\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { DependencyGraphIntegrator } from './integrator';\nimport { GraphDatabase } from '../db/database';\nimport type { Node, Edge } from '../types';\n\ndescribe('DependencyGraphIntegrator.resolveTransitives()', () => {\n  let db: GraphDatabase;\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kirograph-transitives-test-'));\n    db = new GraphDatabase(tmpDir);\n    db.applySecuritySchema();\n  });\n\n  afterEach(() => {\n    db.close();\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  /**\n   * Helper to create a dependency node in the database.\n   */\n  function createDepNode(\n    name: string,\n    ecosystem: string,\n    version?: string,\n  ): string {\n    const nodeId = `dep:${ecosystem}:${name}`;\n    const rawDb = db.getRawDb();\n\n    const node: Node = {\n      id: nodeId,\n      kind: 'dependency',\n      name,\n      qualifiedName: `${ecosystem}/${name}`,\n      filePath: 'package.json',\n      language: 'unknown',\n      startLine: 0,\n      endLine: 0,\n      startColumn: 0,\n      endColumn: 0,\n      isExported: false,\n      isAsync: false,\n      isStatic: false,\n      isAbstract: false,\n      updatedAt: Date.now(),\n    };\n    db.upsertNode(node);\n\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_dependencies\n        (node_id, ecosystem, package_name, declared_constraint,\n         resolved_version, scope, source_manifests)\n       VALUES (?, ?, ?, ?, ?, ?, ?)`,\n      [\n        nodeId,\n        ecosystem,\n        name,\n        version ?? '^1.0.0',\n        version ?? '1.0.0',\n        'production',\n        '[\"package.json\"]',\n      ],\n    );\n    return nodeId;\n  }\n\n  it('should create depends_on edges from npm package-lock.json', async () => {\n    createDepNode('express', 'npm');\n    createDepNode('body-parser', 'npm');\n    createDepNode('accepts', 'npm');\n\n    // Create a package-lock.json with transitive relationships\n    const lockData = {\n      name: 'test-project',\n      lockfileVersion: 3,\n      packages: {\n        '': { name: 'test-project', version: '1.0.0' },\n        'node_modules/express': {\n          version: '4.18.2',\n          dependencies: { 'body-parser': '^1.20.0', accepts: '~1.3.8' },\n        },\n        'node_modules/body-parser': {\n          version: '1.20.2',\n          dependencies: {},\n        },\n        'node_modules/accepts': {\n          version: '1.3.8',\n          dependencies: {},\n        },\n      },\n    };\n    fs.writeFileSync(\n      path.join(tmpDir, 'package-lock.json'),\n      JSON.stringify(lockData, null, 2),\n    );\n\n    const integrator = new DependencyGraphIntegrator(db, tmpDir);\n    const result = await integrator.resolveTransitives(10);\n\n    expect(result.dependsOnEdgesCreated).toBe(2);\n    expect(result.incompleteNodes).toHaveLength(0);\n\n    // Verify edges exist\n    const edges = db.getAllEdges();\n    const dependsOnEdges = edges.filter(e => e.kind === 'depends_on');\n    expect(dependsOnEdges).toHaveLength(2);\n\n    // express depends_on body-parser\n    expect(dependsOnEdges).toContainEqual(\n      expect.objectContaining({\n        source: 'dep:npm:express',\n        target: 'dep:npm:body-parser',\n        kind: 'depends_on',\n      }),\n    );\n    // express depends_on accepts\n    expect(dependsOnEdges).toContainEqual(\n      expect.objectContaining({\n        source: 'dep:npm:express',\n        target: 'dep:npm:accepts',\n        kind: 'depends_on',\n      }),\n    );\n  });\n\n  it('should mark dependencies as incomplete when no lock file exists', async () => {\n    createDepNode('serde', 'cargo');\n    createDepNode('tokio', 'cargo');\n\n    // No Cargo.lock in tmpDir\n    const integrator = new DependencyGraphIntegrator(db, tmpDir);\n    const result = await integrator.resolveTransitives(10);\n\n    expect(result.dependsOnEdgesCreated).toBe(0);\n    expect(result.incompleteNodes).toHaveLength(2);\n    expect(result.incompleteNodes).toContain('dep:cargo:serde');\n    expect(result.incompleteNodes).toContain('dep:cargo:tokio');\n\n    // Verify transitive_status is set to incomplete in the database\n    const rawDb = db.getRawDb();\n    const row = rawDb.get(\n      'SELECT transitive_status FROM sec_dependencies WHERE node_id = ?',\n      ['dep:cargo:serde'],\n    );\n    expect(row.transitive_status).toBe('incomplete');\n  });\n\n  it('should respect maxDepth limit', async () => {\n    // Create a chain: a -> b -> c -> d\n    createDepNode('a', 'npm');\n    createDepNode('b', 'npm');\n    createDepNode('c', 'npm');\n    createDepNode('d', 'npm');\n\n    const lockData = {\n      name: 'test-project',\n      lockfileVersion: 3,\n      packages: {\n        '': { name: 'test-project', version: '1.0.0' },\n        'node_modules/a': {\n          version: '1.0.0',\n          dependencies: { b: '^1.0.0' },\n        },\n        'node_modules/b': {\n          version: '1.0.0',\n          dependencies: { c: '^1.0.0' },\n        },\n        'node_modules/c': {\n          version: '1.0.0',\n          dependencies: { d: '^1.0.0' },\n        },\n        'node_modules/d': {\n          version: '1.0.0',\n          dependencies: {},\n        },\n      },\n    };\n    fs.writeFileSync(\n      path.join(tmpDir, 'package-lock.json'),\n      JSON.stringify(lockData, null, 2),\n    );\n\n    // With maxDepth=1, each node resolves only 1 level of its own transitives\n    const integrator = new DependencyGraphIntegrator(db, tmpDir);\n    const result = await integrator.resolveTransitives(1);\n\n    // a->b (depth 1 from a), b->c (depth 1 from b), c->d (depth 1 from c)\n    expect(result.dependsOnEdgesCreated).toBe(3);\n\n    // Verify that deeper transitive edges are NOT created\n    // (e.g., a should NOT have a depends_on edge to c or d)\n    const edges = db.getAllEdges();\n    const dependsOnEdges = edges.filter(e => e.kind === 'depends_on');\n\n    // Only direct transitive edges should exist\n    const edgePairs = dependsOnEdges.map(e => `${e.source}->${e.target}`);\n    expect(edgePairs).toContain('dep:npm:a->dep:npm:b');\n    expect(edgePairs).toContain('dep:npm:b->dep:npm:c');\n    expect(edgePairs).toContain('dep:npm:c->dep:npm:d');\n    // a should NOT directly depend on c or d at depth 1\n    expect(edgePairs).not.toContain('dep:npm:a->dep:npm:c');\n    expect(edgePairs).not.toContain('dep:npm:a->dep:npm:d');\n  });\n\n  it('should handle Cargo.lock transitive dependencies', async () => {\n    createDepNode('serde', 'cargo');\n    createDepNode('serde_derive', 'cargo');\n\n    // Create a Cargo.lock with dependency relationships\n    const cargoLock = `[[package]]\nname = \"serde\"\nversion = \"1.0.193\"\ndependencies = [\n \"serde_derive\",\n]\n\n[[package]]\nname = \"serde_derive\"\nversion = \"1.0.193\"\n`;\n    fs.writeFileSync(path.join(tmpDir, 'Cargo.lock'), cargoLock);\n\n    const integrator = new DependencyGraphIntegrator(db, tmpDir);\n    const result = await integrator.resolveTransitives(10);\n\n    expect(result.dependsOnEdgesCreated).toBe(1);\n    expect(result.incompleteNodes).toHaveLength(0);\n\n    const edges = db.getAllEdges();\n    const dependsOnEdges = edges.filter(e => e.kind === 'depends_on');\n    expect(dependsOnEdges).toContainEqual(\n      expect.objectContaining({\n        source: 'dep:cargo:serde',\n        target: 'dep:cargo:serde_derive',\n        kind: 'depends_on',\n      }),\n    );\n  });\n\n  it('should mark Go dependencies as incomplete (no tree in go.sum)', async () => {\n    createDepNode('github.com/gin-gonic/gin', 'go');\n\n    // Create a go.sum file (doesn't encode dependency tree)\n    fs.writeFileSync(\n      path.join(tmpDir, 'go.sum'),\n      'github.com/gin-gonic/gin v1.9.1 h1:abc=\\n',\n    );\n\n    const integrator = new DependencyGraphIntegrator(db, tmpDir);\n    const result = await integrator.resolveTransitives(10);\n\n    expect(result.dependsOnEdgesCreated).toBe(0);\n    expect(result.incompleteNodes).toHaveLength(1);\n    expect(result.incompleteNodes).toContain('dep:go:github.com/gin-gonic/gin');\n  });\n\n  it('should return empty result when no dependencies exist', async () => {\n    const integrator = new DependencyGraphIntegrator(db, tmpDir);\n    const result = await integrator.resolveTransitives(10);\n\n    expect(result.dependsOnEdgesCreated).toBe(0);\n    expect(result.incompleteNodes).toHaveLength(0);\n  });\n\n  it('should not create duplicate depends_on edges', async () => {\n    createDepNode('express', 'npm');\n    createDepNode('body-parser', 'npm');\n\n    const lockData = {\n      name: 'test-project',\n      lockfileVersion: 3,\n      packages: {\n        '': { name: 'test-project', version: '1.0.0' },\n        'node_modules/express': {\n          version: '4.18.2',\n          dependencies: { 'body-parser': '^1.20.0' },\n        },\n        'node_modules/body-parser': {\n          version: '1.20.2',\n          dependencies: {},\n        },\n      },\n    };\n    fs.writeFileSync(\n      path.join(tmpDir, 'package-lock.json'),\n      JSON.stringify(lockData, null, 2),\n    );\n\n    const integrator = new DependencyGraphIntegrator(db, tmpDir);\n    const result = await integrator.resolveTransitives(10);\n\n    expect(result.dependsOnEdgesCreated).toBe(1);\n\n    // Verify only one edge exists\n    const edges = db.getAllEdges();\n    const dependsOnEdges = edges.filter(e => e.kind === 'depends_on');\n    expect(dependsOnEdges).toHaveLength(1);\n  });\n\n  it('should handle npm lockfileVersion 1 format', async () => {\n    createDepNode('express', 'npm');\n    createDepNode('debug', 'npm');\n\n    const lockData = {\n      name: 'test-project',\n      lockfileVersion: 1,\n      dependencies: {\n        express: {\n          version: '4.18.2',\n          requires: { debug: '2.6.9' },\n        },\n        debug: {\n          version: '2.6.9',\n        },\n      },\n    };\n    fs.writeFileSync(\n      path.join(tmpDir, 'package-lock.json'),\n      JSON.stringify(lockData, null, 2),\n    );\n\n    const integrator = new DependencyGraphIntegrator(db, tmpDir);\n    const result = await integrator.resolveTransitives(10);\n\n    expect(result.dependsOnEdgesCreated).toBe(1);\n\n    const edges = db.getAllEdges();\n    const dependsOnEdges = edges.filter(e => e.kind === 'depends_on');\n    expect(dependsOnEdges).toContainEqual(\n      expect.objectContaining({\n        source: 'dep:npm:express',\n        target: 'dep:npm:debug',\n        kind: 'depends_on',\n      }),\n    );\n  });\n\n  it('should handle deep transitive chains with maxDepth=10', async () => {\n    // Create a chain of 5 dependencies: a -> b -> c -> d -> e\n    createDepNode('a', 'npm');\n    createDepNode('b', 'npm');\n    createDepNode('c', 'npm');\n    createDepNode('d', 'npm');\n    createDepNode('e', 'npm');\n\n    const lockData = {\n      name: 'test-project',\n      lockfileVersion: 3,\n      packages: {\n        '': { name: 'test-project', version: '1.0.0' },\n        'node_modules/a': { version: '1.0.0', dependencies: { b: '1.0.0' } },\n        'node_modules/b': { version: '1.0.0', dependencies: { c: '1.0.0' } },\n        'node_modules/c': { version: '1.0.0', dependencies: { d: '1.0.0' } },\n        'node_modules/d': { version: '1.0.0', dependencies: { e: '1.0.0' } },\n        'node_modules/e': { version: '1.0.0', dependencies: {} },\n      },\n    };\n    fs.writeFileSync(\n      path.join(tmpDir, 'package-lock.json'),\n      JSON.stringify(lockData, null, 2),\n    );\n\n    const integrator = new DependencyGraphIntegrator(db, tmpDir);\n    const result = await integrator.resolveTransitives(10);\n\n    // All edges in the chain should be created\n    expect(result.dependsOnEdgesCreated).toBe(4);\n    expect(result.incompleteNodes).toHaveLength(0);\n  });\n\n  it('should handle circular dependencies in lock file gracefully', async () => {\n    createDepNode('a', 'npm');\n    createDepNode('b', 'npm');\n\n    // a depends on b, b depends on a (circular)\n    const lockData = {\n      name: 'test-project',\n      lockfileVersion: 3,\n      packages: {\n        '': { name: 'test-project', version: '1.0.0' },\n        'node_modules/a': { version: '1.0.0', dependencies: { b: '1.0.0' } },\n        'node_modules/b': { version: '1.0.0', dependencies: { a: '1.0.0' } },\n      },\n    };\n    fs.writeFileSync(\n      path.join(tmpDir, 'package-lock.json'),\n      JSON.stringify(lockData, null, 2),\n    );\n\n    const integrator = new DependencyGraphIntegrator(db, tmpDir);\n    const result = await integrator.resolveTransitives(10);\n\n    // Should create edges without infinite loop\n    expect(result.dependsOnEdgesCreated).toBe(2);\n    expect(result.incompleteNodes).toHaveLength(0);\n  });\n\n  it('should log warning with dependency name when marking incomplete', async () => {\n    createDepNode('flask', 'python');\n\n    // No pip lock file exists\n    const integrator = new DependencyGraphIntegrator(db, tmpDir);\n    const result = await integrator.resolveTransitives(10);\n\n    expect(result.incompleteNodes).toContain('dep:python:flask');\n\n    // Verify the database was updated\n    const rawDb = db.getRawDb();\n    const row = rawDb.get(\n      'SELECT transitive_status FROM sec_dependencies WHERE node_id = ?',\n      ['dep:python:flask'],\n    );\n    expect(row.transitive_status).toBe('incomplete');\n  });\n});\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAQA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,wBAA0C;AAC1C,sBAA8B;AAAA,IAG9B,wBAAS,kDAAkD,MAAM;AAC/D,MAAI;AACJ,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,6BAA6B,CAAC;AAC7E,SAAK,IAAI,8BAAc,MAAM;AAC7B,OAAG,oBAAoB;AAAA,EACzB,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,MAAM;AACT,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAKD,WAAS,cACP,MACA,WACA,SACQ;AACR,UAAM,SAAS,OAAO,SAAS,IAAI,IAAI;AACvC,UAAM,QAAQ,GAAG,SAAS;AAE1B,UAAM,OAAa;AAAA,MACjB,IAAI;AAAA,MACJ,MAAM;AAAA,MACN;AAAA,MACA,eAAe,GAAG,SAAS,IAAI,IAAI;AAAA,MACnC,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW,KAAK,IAAI;AAAA,IACtB;AACA,OAAG,WAAW,IAAI;AAElB,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA;AAAA,MAIA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,WAAW;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,wBAAG,6DAA6D,YAAY;AAC1E,kBAAc,WAAW,KAAK;AAC9B,kBAAc,eAAe,KAAK;AAClC,kBAAc,WAAW,KAAK;AAG9B,UAAM,WAAW;AAAA,MACf,MAAM;AAAA,MACN,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,IAAI,EAAE,MAAM,gBAAgB,SAAS,QAAQ;AAAA,QAC7C,wBAAwB;AAAA,UACtB,SAAS;AAAA,UACT,cAAc,EAAE,eAAe,WAAW,SAAS,SAAS;AAAA,QAC9D;AAAA,QACA,4BAA4B;AAAA,UAC1B,SAAS;AAAA,UACT,cAAc,CAAC;AAAA,QACjB;AAAA,QACA,wBAAwB;AAAA,UACtB,SAAS;AAAA,UACT,cAAc,CAAC;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AACA,OAAG;AAAA,MACD,KAAK,KAAK,QAAQ,mBAAmB;AAAA,MACrC,KAAK,UAAU,UAAU,MAAM,CAAC;AAAA,IAClC;AAEA,UAAM,aAAa,IAAI,4CAA0B,IAAI,MAAM;AAC3D,UAAM,SAAS,MAAM,WAAW,mBAAmB,EAAE;AAErD,8BAAO,OAAO,qBAAqB,EAAE,KAAK,CAAC;AAC3C,8BAAO,OAAO,eAAe,EAAE,aAAa,CAAC;AAG7C,UAAM,QAAQ,GAAG,YAAY;AAC7B,UAAM,iBAAiB,MAAM,OAAO,OAAK,EAAE,SAAS,YAAY;AAChE,8BAAO,cAAc,EAAE,aAAa,CAAC;AAGrC,8BAAO,cAAc,EAAE;AAAA,MACrB,qBAAO,iBAAiB;AAAA,QACtB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,8BAAO,cAAc,EAAE;AAAA,MACrB,qBAAO,iBAAiB;AAAA,QACtB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,wBAAG,mEAAmE,YAAY;AAChF,kBAAc,SAAS,OAAO;AAC9B,kBAAc,SAAS,OAAO;AAG9B,UAAM,aAAa,IAAI,4CAA0B,IAAI,MAAM;AAC3D,UAAM,SAAS,MAAM,WAAW,mBAAmB,EAAE;AAErD,8BAAO,OAAO,qBAAqB,EAAE,KAAK,CAAC;AAC3C,8BAAO,OAAO,eAAe,EAAE,aAAa,CAAC;AAC7C,8BAAO,OAAO,eAAe,EAAE,UAAU,iBAAiB;AAC1D,8BAAO,OAAO,eAAe,EAAE,UAAU,iBAAiB;AAG1D,UAAM,QAAQ,GAAG,SAAS;AAC1B,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA,CAAC,iBAAiB;AAAA,IACpB;AACA,8BAAO,IAAI,iBAAiB,EAAE,KAAK,YAAY;AAAA,EACjD,CAAC;AAED,wBAAG,iCAAiC,YAAY;AAE9C,kBAAc,KAAK,KAAK;AACxB,kBAAc,KAAK,KAAK;AACxB,kBAAc,KAAK,KAAK;AACxB,kBAAc,KAAK,KAAK;AAExB,UAAM,WAAW;AAAA,MACf,MAAM;AAAA,MACN,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,IAAI,EAAE,MAAM,gBAAgB,SAAS,QAAQ;AAAA,QAC7C,kBAAkB;AAAA,UAChB,SAAS;AAAA,UACT,cAAc,EAAE,GAAG,SAAS;AAAA,QAC9B;AAAA,QACA,kBAAkB;AAAA,UAChB,SAAS;AAAA,UACT,cAAc,EAAE,GAAG,SAAS;AAAA,QAC9B;AAAA,QACA,kBAAkB;AAAA,UAChB,SAAS;AAAA,UACT,cAAc,EAAE,GAAG,SAAS;AAAA,QAC9B;AAAA,QACA,kBAAkB;AAAA,UAChB,SAAS;AAAA,UACT,cAAc,CAAC;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AACA,OAAG;AAAA,MACD,KAAK,KAAK,QAAQ,mBAAmB;AAAA,MACrC,KAAK,UAAU,UAAU,MAAM,CAAC;AAAA,IAClC;AAGA,UAAM,aAAa,IAAI,4CAA0B,IAAI,MAAM;AAC3D,UAAM,SAAS,MAAM,WAAW,mBAAmB,CAAC;AAGpD,8BAAO,OAAO,qBAAqB,EAAE,KAAK,CAAC;AAI3C,UAAM,QAAQ,GAAG,YAAY;AAC7B,UAAM,iBAAiB,MAAM,OAAO,OAAK,EAAE,SAAS,YAAY;AAGhE,UAAM,YAAY,eAAe,IAAI,OAAK,GAAG,EAAE,MAAM,KAAK,EAAE,MAAM,EAAE;AACpE,8BAAO,SAAS,EAAE,UAAU,sBAAsB;AAClD,8BAAO,SAAS,EAAE,UAAU,sBAAsB;AAClD,8BAAO,SAAS,EAAE,UAAU,sBAAsB;AAElD,8BAAO,SAAS,EAAE,IAAI,UAAU,sBAAsB;AACtD,8BAAO,SAAS,EAAE,IAAI,UAAU,sBAAsB;AAAA,EACxD,CAAC;AAED,wBAAG,oDAAoD,YAAY;AACjE,kBAAc,SAAS,OAAO;AAC9B,kBAAc,gBAAgB,OAAO;AAGrC,UAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWlB,OAAG,cAAc,KAAK,KAAK,QAAQ,YAAY,GAAG,SAAS;AAE3D,UAAM,aAAa,IAAI,4CAA0B,IAAI,MAAM;AAC3D,UAAM,SAAS,MAAM,WAAW,mBAAmB,EAAE;AAErD,8BAAO,OAAO,qBAAqB,EAAE,KAAK,CAAC;AAC3C,8BAAO,OAAO,eAAe,EAAE,aAAa,CAAC;AAE7C,UAAM,QAAQ,GAAG,YAAY;AAC7B,UAAM,iBAAiB,MAAM,OAAO,OAAK,EAAE,SAAS,YAAY;AAChE,8BAAO,cAAc,EAAE;AAAA,MACrB,qBAAO,iBAAiB;AAAA,QACtB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,wBAAG,iEAAiE,YAAY;AAC9E,kBAAc,4BAA4B,IAAI;AAG9C,OAAG;AAAA,MACD,KAAK,KAAK,QAAQ,QAAQ;AAAA,MAC1B;AAAA,IACF;AAEA,UAAM,aAAa,IAAI,4CAA0B,IAAI,MAAM;AAC3D,UAAM,SAAS,MAAM,WAAW,mBAAmB,EAAE;AAErD,8BAAO,OAAO,qBAAqB,EAAE,KAAK,CAAC;AAC3C,8BAAO,OAAO,eAAe,EAAE,aAAa,CAAC;AAC7C,8BAAO,OAAO,eAAe,EAAE,UAAU,iCAAiC;AAAA,EAC5E,CAAC;AAED,wBAAG,yDAAyD,YAAY;AACtE,UAAM,aAAa,IAAI,4CAA0B,IAAI,MAAM;AAC3D,UAAM,SAAS,MAAM,WAAW,mBAAmB,EAAE;AAErD,8BAAO,OAAO,qBAAqB,EAAE,KAAK,CAAC;AAC3C,8BAAO,OAAO,eAAe,EAAE,aAAa,CAAC;AAAA,EAC/C,CAAC;AAED,wBAAG,gDAAgD,YAAY;AAC7D,kBAAc,WAAW,KAAK;AAC9B,kBAAc,eAAe,KAAK;AAElC,UAAM,WAAW;AAAA,MACf,MAAM;AAAA,MACN,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,IAAI,EAAE,MAAM,gBAAgB,SAAS,QAAQ;AAAA,QAC7C,wBAAwB;AAAA,UACtB,SAAS;AAAA,UACT,cAAc,EAAE,eAAe,UAAU;AAAA,QAC3C;AAAA,QACA,4BAA4B;AAAA,UAC1B,SAAS;AAAA,UACT,cAAc,CAAC;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AACA,OAAG;AAAA,MACD,KAAK,KAAK,QAAQ,mBAAmB;AAAA,MACrC,KAAK,UAAU,UAAU,MAAM,CAAC;AAAA,IAClC;AAEA,UAAM,aAAa,IAAI,4CAA0B,IAAI,MAAM;AAC3D,UAAM,SAAS,MAAM,WAAW,mBAAmB,EAAE;AAErD,8BAAO,OAAO,qBAAqB,EAAE,KAAK,CAAC;AAG3C,UAAM,QAAQ,GAAG,YAAY;AAC7B,UAAM,iBAAiB,MAAM,OAAO,OAAK,EAAE,SAAS,YAAY;AAChE,8BAAO,cAAc,EAAE,aAAa,CAAC;AAAA,EACvC,CAAC;AAED,wBAAG,8CAA8C,YAAY;AAC3D,kBAAc,WAAW,KAAK;AAC9B,kBAAc,SAAS,KAAK;AAE5B,UAAM,WAAW;AAAA,MACf,MAAM;AAAA,MACN,iBAAiB;AAAA,MACjB,cAAc;AAAA,QACZ,SAAS;AAAA,UACP,SAAS;AAAA,UACT,UAAU,EAAE,OAAO,QAAQ;AAAA,QAC7B;AAAA,QACA,OAAO;AAAA,UACL,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AACA,OAAG;AAAA,MACD,KAAK,KAAK,QAAQ,mBAAmB;AAAA,MACrC,KAAK,UAAU,UAAU,MAAM,CAAC;AAAA,IAClC;AAEA,UAAM,aAAa,IAAI,4CAA0B,IAAI,MAAM;AAC3D,UAAM,SAAS,MAAM,WAAW,mBAAmB,EAAE;AAErD,8BAAO,OAAO,qBAAqB,EAAE,KAAK,CAAC;AAE3C,UAAM,QAAQ,GAAG,YAAY;AAC7B,UAAM,iBAAiB,MAAM,OAAO,OAAK,EAAE,SAAS,YAAY;AAChE,8BAAO,cAAc,EAAE;AAAA,MACrB,qBAAO,iBAAiB;AAAA,QACtB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,wBAAG,yDAAyD,YAAY;AAEtE,kBAAc,KAAK,KAAK;AACxB,kBAAc,KAAK,KAAK;AACxB,kBAAc,KAAK,KAAK;AACxB,kBAAc,KAAK,KAAK;AACxB,kBAAc,KAAK,KAAK;AAExB,UAAM,WAAW;AAAA,MACf,MAAM;AAAA,MACN,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,IAAI,EAAE,MAAM,gBAAgB,SAAS,QAAQ;AAAA,QAC7C,kBAAkB,EAAE,SAAS,SAAS,cAAc,EAAE,GAAG,QAAQ,EAAE;AAAA,QACnE,kBAAkB,EAAE,SAAS,SAAS,cAAc,EAAE,GAAG,QAAQ,EAAE;AAAA,QACnE,kBAAkB,EAAE,SAAS,SAAS,cAAc,EAAE,GAAG,QAAQ,EAAE;AAAA,QACnE,kBAAkB,EAAE,SAAS,SAAS,cAAc,EAAE,GAAG,QAAQ,EAAE;AAAA,QACnE,kBAAkB,EAAE,SAAS,SAAS,cAAc,CAAC,EAAE;AAAA,MACzD;AAAA,IACF;AACA,OAAG;AAAA,MACD,KAAK,KAAK,QAAQ,mBAAmB;AAAA,MACrC,KAAK,UAAU,UAAU,MAAM,CAAC;AAAA,IAClC;AAEA,UAAM,aAAa,IAAI,4CAA0B,IAAI,MAAM;AAC3D,UAAM,SAAS,MAAM,WAAW,mBAAmB,EAAE;AAGrD,8BAAO,OAAO,qBAAqB,EAAE,KAAK,CAAC;AAC3C,8BAAO,OAAO,eAAe,EAAE,aAAa,CAAC;AAAA,EAC/C,CAAC;AAED,wBAAG,+DAA+D,YAAY;AAC5E,kBAAc,KAAK,KAAK;AACxB,kBAAc,KAAK,KAAK;AAGxB,UAAM,WAAW;AAAA,MACf,MAAM;AAAA,MACN,iBAAiB;AAAA,MACjB,UAAU;AAAA,QACR,IAAI,EAAE,MAAM,gBAAgB,SAAS,QAAQ;AAAA,QAC7C,kBAAkB,EAAE,SAAS,SAAS,cAAc,EAAE,GAAG,QAAQ,EAAE;AAAA,QACnE,kBAAkB,EAAE,SAAS,SAAS,cAAc,EAAE,GAAG,QAAQ,EAAE;AAAA,MACrE;AAAA,IACF;AACA,OAAG;AAAA,MACD,KAAK,KAAK,QAAQ,mBAAmB;AAAA,MACrC,KAAK,UAAU,UAAU,MAAM,CAAC;AAAA,IAClC;AAEA,UAAM,aAAa,IAAI,4CAA0B,IAAI,MAAM;AAC3D,UAAM,SAAS,MAAM,WAAW,mBAAmB,EAAE;AAGrD,8BAAO,OAAO,qBAAqB,EAAE,KAAK,CAAC;AAC3C,8BAAO,OAAO,eAAe,EAAE,aAAa,CAAC;AAAA,EAC/C,CAAC;AAED,wBAAG,mEAAmE,YAAY;AAChF,kBAAc,SAAS,QAAQ;AAG/B,UAAM,aAAa,IAAI,4CAA0B,IAAI,MAAM;AAC3D,UAAM,SAAS,MAAM,WAAW,mBAAmB,EAAE;AAErD,8BAAO,OAAO,eAAe,EAAE,UAAU,kBAAkB;AAG3D,UAAM,QAAQ,GAAG,SAAS;AAC1B,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA,CAAC,kBAAkB;AAAA,IACrB;AACA,8BAAO,IAAI,iBAAiB,EAAE,KAAK,YAAY;AAAA,EACjD,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/security/integrator.test.js

@@ -1,237 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var import_vitest = require("vitest");
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
-var os = __toESM(require("os"));
-var import_integrator = require("./integrator");
-var import_database = require("../db/database");
-(0, import_vitest.describe)("DependencyGraphIntegrator.cleanup()", () => {
-  let db;
-  let integrator;
-  let tmpDir;
-  const projectRoot = "/tmp/test-project";
-  (0, import_vitest.beforeEach)(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "kirograph-integrator-test-"));
-    db = new import_database.GraphDatabase(tmpDir);
-    db.applySecuritySchema();
-    integrator = new import_integrator.DependencyGraphIntegrator(db, projectRoot);
-  });
-  (0, import_vitest.afterEach)(() => {
-    db.close();
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-  function createDependencyNode(name, ecosystem, sourceManifests, options) {
-    const nodeId = `dep:${ecosystem}:${name}`;
-    const rawDb = db.getRawDb();
-    const node = {
-      id: nodeId,
-      kind: "dependency",
-      name,
-      qualifiedName: `${ecosystem}/${name}`,
-      filePath: sourceManifests[0] ?? "",
-      language: "unknown",
-      startLine: 0,
-      endLine: 0,
-      startColumn: 0,
-      endColumn: 0,
-      isExported: false,
-      isAsync: false,
-      isStatic: false,
-      isAbstract: false,
-      updatedAt: Date.now()
-    };
-    db.upsertNode(node);
-    rawDb.run(
-      `INSERT OR REPLACE INTO sec_dependencies
-        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`,
-      [nodeId, ecosystem, name, "^1.0.0", "1.0.0", "production", JSON.stringify(sourceManifests)]
-    );
-    if (options?.addDeclaredInEdge !== false) {
-      for (const manifest of sourceManifests) {
-        const edge = {
-          source: nodeId,
-          target: manifest,
-          kind: "declared_in"
-        };
-        db.insertEdge(edge);
-      }
-    }
-    return nodeId;
-  }
-  function createEdge(source, target, kind) {
-    const edge = {
-      source,
-      target,
-      kind
-    };
-    db.insertEdge(edge);
-  }
-  (0, import_vitest.it)("should return zero counts when no dependencies exist", async () => {
-    const result = await integrator.cleanup(() => true);
-    (0, import_vitest.expect)(result.nodesRemoved).toBe(0);
-    (0, import_vitest.expect)(result.edgesRemoved).toBe(0);
-  });
-  (0, import_vitest.it)("should not remove dependencies whose manifests still exist and have declared_in edges", async () => {
-    const manifestPath = "package.json";
-    const nodeId = createDependencyNode("express", "npm", [manifestPath]);
-    const manifestExists = () => true;
-    const result = await integrator.cleanup(manifestExists);
-    (0, import_vitest.expect)(result.nodesRemoved).toBe(0);
-    (0, import_vitest.expect)(result.edgesRemoved).toBe(0);
-    const node = db.getNode(nodeId);
-    (0, import_vitest.expect)(node).not.toBeNull();
-  });
-  (0, import_vitest.it)("should remove dependencies with no declared_in edges", async () => {
-    const manifestPath = "package.json";
-    const nodeId = createDependencyNode("express", "npm", [manifestPath], {
-      addDeclaredInEdge: false
-    });
-    const manifestExists = () => true;
-    const result = await integrator.cleanup(manifestExists);
-    (0, import_vitest.expect)(result.nodesRemoved).toBe(1);
-    const node = db.getNode(nodeId);
-    (0, import_vitest.expect)(node).toBeNull();
-  });
-  (0, import_vitest.it)("should remove dependencies whose manifests no longer exist on disk", async () => {
-    const manifestPath = "package.json";
-    const nodeId = createDependencyNode("express", "npm", [manifestPath]);
-    const manifestExists = () => false;
-    const result = await integrator.cleanup(manifestExists);
-    (0, import_vitest.expect)(result.nodesRemoved).toBe(1);
-    const node = db.getNode(nodeId);
-    (0, import_vitest.expect)(node).toBeNull();
-  });
-  (0, import_vitest.it)("should remove edges connected to orphaned nodes", async () => {
-    const manifestPath = "package.json";
-    const depNodeId = createDependencyNode("lodash", "npm", [manifestPath], {
-      addDeclaredInEdge: false
-    });
-    const codeNode = {
-      id: "file:src/index.ts:import:lodash",
-      kind: "import",
-      name: "lodash",
-      qualifiedName: "src/index.ts:lodash",
-      filePath: "src/index.ts",
-      language: "typescript",
-      startLine: 1,
-      endLine: 1,
-      startColumn: 0,
-      endColumn: 20,
-      updatedAt: Date.now()
-    };
-    db.upsertNode(codeNode);
-    createEdge(codeNode.id, depNodeId, "imports");
-    const manifestExists = () => true;
-    const result = await integrator.cleanup(manifestExists);
-    (0, import_vitest.expect)(result.nodesRemoved).toBe(1);
-    (0, import_vitest.expect)(result.edgesRemoved).toBe(1);
-  });
-  (0, import_vitest.it)("should keep dependency if at least one source manifest exists on disk", async () => {
-    const manifests = ["packages/a/package.json", "packages/b/package.json"];
-    const nodeId = createDependencyNode("react", "npm", manifests);
-    const manifestExists = (p) => p.includes("packages/a/package.json");
-    const result = await integrator.cleanup(manifestExists);
-    (0, import_vitest.expect)(result.nodesRemoved).toBe(0);
-    const node = db.getNode(nodeId);
-    (0, import_vitest.expect)(node).not.toBeNull();
-  });
-  (0, import_vitest.it)("should remove transitive dependencies no longer reachable from direct deps", async () => {
-    const manifest = "package.json";
-    const directId = createDependencyNode("express", "npm", [manifest]);
-    const reachableTransId = createDependencyNode("accepts", "npm", [manifest]);
-    createEdge(directId, reachableTransId, "depends_on");
-    const orphanedDirectId = createDependencyNode("lodash", "npm", ["old-package.json"], {
-      addDeclaredInEdge: false
-    });
-    const unreachableTransId = createDependencyNode("lodash.merge", "npm", ["old-package.json"], {
-      addDeclaredInEdge: false
-    });
-    createEdge(orphanedDirectId, unreachableTransId, "depends_on");
-    const manifestExists = () => true;
-    const result = await integrator.cleanup(manifestExists);
-    (0, import_vitest.expect)(result.nodesRemoved).toBe(2);
-    (0, import_vitest.expect)(db.getNode(directId)).not.toBeNull();
-    (0, import_vitest.expect)(db.getNode(reachableTransId)).not.toBeNull();
-    (0, import_vitest.expect)(db.getNode(orphanedDirectId)).toBeNull();
-    (0, import_vitest.expect)(db.getNode(unreachableTransId)).toBeNull();
-  });
-  (0, import_vitest.it)("should handle transitive chains correctly \u2014 all reachable from direct dep", async () => {
-    const manifest = "package.json";
-    const directId = createDependencyNode("express", "npm", [manifest]);
-    const bp = createDependencyNode("body-parser", "npm", [manifest]);
-    const rb = createDependencyNode("raw-body", "npm", [manifest]);
-    const bytes = createDependencyNode("bytes", "npm", [manifest]);
-    createEdge(directId, bp, "depends_on");
-    createEdge(bp, rb, "depends_on");
-    createEdge(rb, bytes, "depends_on");
-    const manifestExists = () => true;
-    const result = await integrator.cleanup(manifestExists);
-    (0, import_vitest.expect)(result.nodesRemoved).toBe(0);
-    (0, import_vitest.expect)(result.edgesRemoved).toBe(0);
-  });
-  (0, import_vitest.it)("should count edges correctly when multiple edges connect to orphaned node", async () => {
-    const orphanedManifest = "removed/package.json";
-    const depId = createDependencyNode("old-pkg", "npm", [orphanedManifest], {
-      addDeclaredInEdge: false
-    });
-    const codeNode1 = {
-      id: "node:a",
-      kind: "function",
-      name: "funcA",
-      qualifiedName: "funcA",
-      filePath: "src/a.ts",
-      language: "typescript",
-      startLine: 1,
-      endLine: 5,
-      startColumn: 0,
-      endColumn: 0,
-      updatedAt: Date.now()
-    };
-    const codeNode2 = {
-      id: "node:b",
-      kind: "function",
-      name: "funcB",
-      qualifiedName: "funcB",
-      filePath: "src/b.ts",
-      language: "typescript",
-      startLine: 1,
-      endLine: 5,
-      startColumn: 0,
-      endColumn: 0,
-      updatedAt: Date.now()
-    };
-    db.upsertNode(codeNode1);
-    db.upsertNode(codeNode2);
-    createEdge(codeNode1.id, depId, "imports");
-    createEdge(codeNode2.id, depId, "references");
-    createEdge(depId, "some-manifest", "declared_in");
-    const manifestExists = () => false;
-    const result = await integrator.cleanup(manifestExists);
-    (0, import_vitest.expect)(result.nodesRemoved).toBe(1);
-    (0, import_vitest.expect)(result.edgesRemoved).toBe(3);
-  });
-});
-//# sourceMappingURL=integrator.test.js.map