kirograph 0.19.0 → 0.20.1

package/README.md

@@ -22,7 +22,7 @@ The result is fewer tool calls, less context used, and faster responses on compl
 
 | Feature | Description |
 |---------|-------------|
-| <h4>Graph & Analysis (Kirograph-Core)</h4> | |
+| <h4>Graph & Analysis (KiroGraph-Core)</h4> | |
 | 🕸️ **Semantic Graph** | tree-sitter AST parsing across 33+ languages — functions, classes, call edges, type hierarchies, all in SQLite |
 | 🎯 **Context Building** | One tool call returns entry points, related symbols, and code snippets for any task description |
 | 💥 **Impact Analysis** | Blast-radius traversal before making changes — know what breaks at any depth |
@@ -35,20 +35,21 @@ The result is fewer tool calls, less context used, and faster responses on compl
 | <h4>Semantic Search</h4> | |
 | ⚡ **7 Semantic Engines** | Cosine, sqlite-vec, Orama, PGlite, LanceDB, Qdrant, Typesense — pick the best fit for your project |
 | 🤖 **Custom Embedding Models** | Use any HuggingFace `feature-extraction` model — nomic, Gemma, MiniLM, BGE, or bring your own |
-| <h4>Architecture (Kirograph-Arch opt-in  module)</h4> | |
+| <h4>Architecture (KiroGraph-Arch opt-in  module)</h4> | |
 | 🏛️ **Architecture Analysis** | Package graph, layer detection, coupling metrics (Ca/Ce/instability) |
 | 📸 **Snapshots & Diff** | Save graph state before refactors, diff after to verify structural changes |
 | <h4>Security</h4> | |
-| 🔒 **Security (KiroGraph-Sec opt-in  module)** | Goes beyond "this dependency has a CVE" — uses the call graph to determine if vulnerable code is **actually reachable** from your entry points. Maps your **attack surface** (which HTTP routes reach vulnerable deps). Detects **hardcoded secrets** and shows how many entry points expose them. **SAST-lite** finds SQL injection, path traversal, and dangerous eval in your code. **Supply chain health** checks OpenSSF Scorecard scores and detects dependency confusion attacks. Covers 14 ecosystems, outputs CycloneDX SBOM/VEX and CI-ready SARIF reports. |
+| 🔒 **Security (KiroGraph-Sec opt-in  module)** | Goes beyond "this dependency has a CVE" — uses the call graph to determine if vulnerable code is **actually reachable** from your entry points. Maps your **attack surface** (which HTTP routes reach vulnerable deps). Detects **hardcoded secrets** and shows how many entry points expose them. **SAST-lite** finds SQL injection, path traversal, and dangerous eval in your code. **AST-based SAST (opt-in via `enablePatterns`)** runs 10 bundled structural pattern rules via `@ast-grep/napi` — matches actual code structure, not just symbol names. **Supply chain health** checks OpenSSF Scorecard scores and detects dependency confusion attacks. Covers 14 ecosystems, outputs CycloneDX SBOM/VEX and CI-ready SARIF reports. |
 | <h4>Knowledge & Data</h4> | |
 | 🧠 **Persistent Memor (KiroGraph-Mem opt-in module)** | Cross-session observations — decisions, errors, patterns — auto-linked to code symbols |
+| 👁️ **Watchmen (KiroGraph-Watchmen opt-in module)** ⚠️ *experimental* | Auto-synthesizes accumulated memory observations into workspace briefs and `inclusion: manual` skill files. Fires via the `watchmenReady` signal in `kirograph_mem_store` when threshold is reached. **Local model** (default, `watchmenSynthesisMode: 'local'`): runs `gemma-4-E4B-it-ONNX` on-device via `@huggingface/transformers` — ~3–4 GB one-time download, ~3–5 GB RAM, 8–15 s on Apple Silicon M1+. No API key, no background daemon, no external calls. **Agent mode** also available for Kiro (`watchmenSynthesisMode: 'agent'`, uses active session). ⚠️ **Experimental:** output quality in local mode depends heavily on the model chosen and your hardware. Smaller models or slower machines may produce incomplete briefs and lower-quality skill files. Use `agent` mode for best results. |
 | 📖 **Documentation Indexing (KiroGraph-Doc opt-in  module)** | Section-level retrieval from Markdown, MDX, RST, AsciiDoc, OpenAPI — 92-97% token savings |
 | 📊 **Data Navigation (KiroGraph-Data opt-in  module)** | Query CSV/JSON/Excel/Parquet with filters, aggregations, joins — all server-side in SQLite |
 | <h4>Token Optimization</h4> | |
-| 🗜️ **Shell Compression (Kirograph-RTK opt-in  module)** | Token-optimized command output (git, tests, linters, docker, AWS) — 60-90% savings |
-| 🪨 **Caveman Mode (Kirograph-Caveman opt-in module)** 🪨 | Agent prose compression (lite → ultra) — fewer tokens on explanations without touching code |
-| 📈 **Token Analytics (Kirograph-Gain core module)** | Track cumulative savings from graph tools and shell compression over time |
-| <h4>Integration (Kirograph-Integration core module)</h4> | |
+| 🗜️ **Shell Compression (KiroGraph-RTK opt-in  module)** | Token-optimized command output (git, tests, linters, docker, AWS) — 60-90% savings |
+| 🪨 **Caveman Mode (KiroGraph-Caveman opt-in module)** 🪨 | Agent prose compression (lite → ultra) — fewer tokens on explanations without touching code |
+| 📈 **Token Analytics (KiroGraph-Gain core module)** | Track cumulative savings from graph tools and shell compression over time |
+| <h4>Integration (KiroGraph-Integration core module)</h4> | |
 | 🔌 **Multi-tool Support** | Native Kiro + 32 experimental targets (Cursor, Copilot, Claude Code, Codex, Windsurf, Cline, and more) |
 
 
@@ -88,7 +89,7 @@ All Kiro integration files are written to `.kiro/`. Restart Kiro IDE, or switch
 | [MCP Tools](docs/guide/mcp-tools.md) | Full reference for all MCP tools |
 | [CLI Reference](docs/guide/cli.md) | All CLI commands with examples |
 | [Configuration](docs/guide/configuration.md) | Config fields, semantic engines, architecture analysis |
-| [Security](docs/guide/security.md) | Full SCA+: 14 ecosystems, EPSS, reachability, attack surface, secrets, SAST-lite, supply chain, SBOM/VEX/SARIF |
+| [Security](docs/guide/security.md) | Full SCA+: 14 ecosystems, EPSS, reachability, attack surface, secrets, SAST-lite, AST pattern matching (opt-in), supply chain, SBOM/VEX/SARIF |
 | [Languages & Frameworks](docs/guide/languages.md) | Supported languages, frameworks, and detection |
 | [Changelog](CHANGELOG.md) | Release history |
 | [Contributing](CONTRIBUTING.md) | How to contribute |
@@ -140,6 +141,7 @@ KiroGraph is inspired by [CodeGraph](https://github.com/colbymchenry/codegraph)
 ### Inspirations
 
 - [cavemem](https://github.com/JuliusBrussee/cavemem) by [Julius Brussee](https://www.linkedin.com/in/julius-brussee/): the memory module's hook-based observation capture, deterministic compression, and SQLite storage pattern.
+- [watchmen](https://github.com/firstbatchxyz/watchmen) by [firstbatch](https://github.com/firstbatchxyz): the watchmen module's session-mining concept, workspace brief generation, and `AGENTS.md` mirroring pattern.
 - [jDocMunch-MCP](https://github.com/jgravelle/jdocmunch-mcp) by [J. Gravelle](https://www.linkedin.com/in/j-gravelle-2778223/): the documentation module's section-first retrieval approach, stable section IDs, and byte-offset addressing.
 - [jDataMunch-MCP](https://github.com/jgravelle/jdatamunch-mcp) by [J. Gravelle](https://www.linkedin.com/in/j-gravelle-2778223/): the data module's column profiling, streaming parsers, and server-side aggregation approach.
 - [code-review-graph](https://github.com/tirth8205/code-review-graph) by [Tirth Kanani](https://github.com/tirth8205): community detection, execution flow tracing, refactoring tools, and multi-platform auto-detection patterns.

package/dist/architecture/layers/dart.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Layer detector for Dart / Flutter projects.
+ *
+ * Detects: api, service, data, ui, shared layers based on
+ * directory names common in Flutter projects under lib/.
+ * Files in test/ are skipped (return no match).
+ */
+import type { LayerDetector } from '../types';
+export declare const dartLayerDetector: LayerDetector;
+//# sourceMappingURL=dart.d.ts.map

package/dist/architecture/layers/dart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dart.d.ts","sourceRoot":"","sources":["../../../src/architecture/layers/dart.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,UAAU,CAAC;AA4C9D,eAAO,MAAM,iBAAiB,EAAE,aAgC/B,CAAC"}

package/dist/architecture/layers/elixir.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Layer detector for Elixir / Phoenix projects.
+ */
+import type { LayerDetector } from '../types';
+export declare const elixirLayerDetector: LayerDetector;
+//# sourceMappingURL=elixir.d.ts.map

package/dist/architecture/layers/elixir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elixir.d.ts","sourceRoot":"","sources":["../../../src/architecture/layers/elixir.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,UAAU,CAAC;AA2C9D,eAAO,MAAM,mBAAmB,EAAE,aAyBjC,CAAC"}

package/dist/architecture/layers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/architecture/layers/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,SAAS,EAAE,MAAM,UAAU,CAAC;AAmBzE,wBAAgB,oBAAoB,IAAI,aAAa,EAAE,CAEtD;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAInE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACtC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAuBhC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,mBAAmB,EAAE,EAClC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACtC,SAAS,EAAE,CAqBb"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/architecture/layers/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,SAAS,EAAE,MAAM,UAAU,CAAC;AA+BzE,wBAAgB,oBAAoB,IAAI,aAAa,EAAE,CAEtD;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAInE;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACtC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAuBhC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,mBAAmB,EAAE,EAClC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACtC,SAAS,EAAE,CAqBb"}

package/dist/architecture/layers/ocaml.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Layer detector for OCaml projects (Dune-based).
+ */
+import type { LayerDetector } from '../types';
+export declare const ocamlLayerDetector: LayerDetector;
+//# sourceMappingURL=ocaml.d.ts.map

package/dist/architecture/layers/ocaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ocaml.d.ts","sourceRoot":"","sources":["../../../src/architecture/layers/ocaml.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,UAAU,CAAC;AAmC9D,eAAO,MAAM,kBAAkB,EAAE,aAyBhC,CAAC"}

package/dist/architecture/layers/scala.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Layer detector for Scala projects (Play, Akka, general SBT).
+ */
+import type { LayerDetector } from '../types';
+export declare const scalaLayerDetector: LayerDetector;
+//# sourceMappingURL=scala.d.ts.map

package/dist/architecture/layers/scala.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scala.d.ts","sourceRoot":"","sources":["../../../src/architecture/layers/scala.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,UAAU,CAAC;AAmD9D,eAAO,MAAM,kBAAkB,EAAE,aAyBhC,CAAC"}

package/dist/architecture/layers/solidity.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Layer detector for Solidity projects (Hardhat, Foundry, Truffle).
+ */
+import type { LayerDetector } from '../types';
+export declare const solidityLayerDetector: LayerDetector;
+//# sourceMappingURL=solidity.d.ts.map

package/dist/architecture/layers/solidity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"solidity.d.ts","sourceRoot":"","sources":["../../../src/architecture/layers/solidity.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,UAAU,CAAC;AAoC9D,eAAO,MAAM,qBAAqB,EAAE,aAyBnC,CAAC"}

package/dist/architecture/layers/vue.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Layer detector for Vue / Nuxt projects.
+ */
+import type { LayerDetector } from '../types';
+export declare const vueLayerDetector: LayerDetector;
+//# sourceMappingURL=vue.d.ts.map

package/dist/architecture/layers/vue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vue.d.ts","sourceRoot":"","sources":["../../../src/architecture/layers/vue.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,aAAa,EAAkB,MAAM,UAAU,CAAC;AA0C9D,eAAO,MAAM,gBAAgB,EAAE,aAyB9B,CAAC"}

package/dist/architecture/manifest/elm.d.ts

@@ -0,0 +1,3 @@
+import type { ManifestParser } from '../types';
+export declare const elmParser: ManifestParser;
+//# sourceMappingURL=elm.d.ts.map

package/dist/architecture/manifest/elm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elm.d.ts","sourceRoot":"","sources":["../../../src/architecture/manifest/elm.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAe,MAAM,UAAU,CAAC;AAE5D,eAAO,MAAM,SAAS,EAAE,cA6DvB,CAAC"}

package/dist/architecture/manifest/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/architecture/manifest/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AA+B5D,wBAAgB,qBAAqB,IAAI,cAAc,EAAE,CAExD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE1E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAInE;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAsBnF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/architecture/manifest/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAsC5D,wBAAgB,qBAAqB,IAAI,cAAc,EAAE,CAExD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE1E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAInE;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAsBnF"}

package/dist/architecture/manifest/ocaml.d.ts

@@ -0,0 +1,3 @@
+import type { ManifestParser } from '../types';
+export declare const ocamlParser: ManifestParser;
+//# sourceMappingURL=ocaml.d.ts.map

package/dist/architecture/manifest/ocaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ocaml.d.ts","sourceRoot":"","sources":["../../../src/architecture/manifest/ocaml.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAe,MAAM,UAAU,CAAC;AAE5D,eAAO,MAAM,WAAW,EAAE,cA6BzB,CAAC"}

package/dist/architecture/manifest/scala.d.ts

@@ -0,0 +1,3 @@
+import type { ManifestParser } from '../types';
+export declare const sbtParser: ManifestParser;
+//# sourceMappingURL=scala.d.ts.map

package/dist/architecture/manifest/scala.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scala.d.ts","sourceRoot":"","sources":["../../../src/architecture/manifest/scala.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAe,MAAM,UAAU,CAAC;AAE5D,eAAO,MAAM,SAAS,EAAE,cA2FvB,CAAC"}

package/dist/bin/banner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"banner.d.ts","sourceRoot":"","sources":["../../src/bin/banner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA+CH,wBAAgB,WAAW,IAAI,IAAI,CAsBlC"}
+{"version":3,"file":"banner.d.ts","sourceRoot":"","sources":["../../src/bin/banner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAqFH,wBAAgB,WAAW,IAAI,IAAI,CAsBlC"}

package/dist/bin/commands/affected.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"affected.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/affected.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkD/C"}
+{"version":3,"file":"affected.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/affected.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+F/C"}

package/dist/bin/commands/attack-surface.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=attack-surface.d.ts.map

package/dist/bin/commands/attack-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attack-surface.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/attack-surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuG/C"}

package/dist/bin/commands/attack-surface.js

@@ -149,6 +149,13 @@ function printRouteEntry(entry) {
   console.log(
     `  ${routeColor}[${riskLabel}]${import_ui.reset} ${import_ui.bold}${entry.route.padEnd(30)}${import_ui.reset}  ${exposureBadge}${vulnSuffix}`
   );
+  for (const pm of entry.patternMatches) {
+    const sevUpper = pm.severity.toUpperCase();
+    const pmColor = pm.severity === "critical" ? red : pm.severity === "high" ? yellow : import_ui.dim;
+    console.log(
+      `        ${pmColor}\u26A0 [${sevUpper}]${import_ui.reset} ${import_ui.dim}${pm.patternId}${import_ui.reset} ${import_ui.dim}at${import_ui.reset} ${pm.symbolName}:${pm.line}`
+    );
+  }
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/bin/commands/attack-surface.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/bin/commands/attack-surface.ts"],
-  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, section } from '../ui';\nimport type { AttackSurfaceEntry } from '../../security/attack-surface';\n\nconst red    = '\\x1b[31m';\nconst yellow = '\\x1b[33m';\n\nexport function register(program: Command): void {\n  program\n    .command('attack-surface [projectPath]')\n    .description('Map HTTP routes to reachable vulnerable dependencies')\n    .option('--limit <n>', 'Max routes to show (default: 20)', '20')\n    .option('--public-only', 'Show only public/unauthenticated routes')\n    .option('--format <fmt>', 'Output format: text, json (default: text)', 'text')\n    .action(async (\n      projectPath: string | undefined,\n      opts: { limit: string; publicOnly?: boolean; format: string },\n    ) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${yellow}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const limit = parseInt(opts.limit, 10);\n      if (isNaN(limit) || limit < 1) {\n        console.error(`  \u2716 Invalid --limit value: ${opts.limit}. Must be a positive integer.`);\n        process.exit(1);\n      }\n\n      const validFormats = ['text', 'json'];\n      if (!validFormats.includes(opts.format)) {\n        console.error(`  \u2716 Invalid --format value: ${opts.format}. Use: text, json`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n\n      const { AttackSurfaceAnalyzer } = await Promise.resolve().then(() => require('../../security/attack-surface.js'));\n      const analyzer = new AttackSurfaceAnalyzer(db);\n      const result = await analyzer.analyze();\n\n      cg.close();\n\n      // Apply --public-only filter\n      let routes = opts.publicOnly\n        ? result.allRoutes.filter(r => r.exposureLevel === 'public')\n        : result.allRoutes;\n\n      // Apply limit\n      const limited = routes.slice(0, limit);\n\n      // \u2500\u2500 JSON output \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n      if (opts.format === 'json') {\n        console.log(JSON.stringify(\n          {\n            totalRoutes: result.totalRoutes,\n            publicRoutes: result.publicRoutes,\n            authenticatedRoutes: result.authenticatedRoutes,\n            routesWithVulns: result.routesWithVulns,\n            criticalPaths: result.criticalPaths,\n            routes: limited,\n          },\n          null,\n          2,\n        ));\n        return;\n      }\n\n      // \u2500\u2500 Text output \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n      const totalLabel = result.totalRoutes === 1 ? 'route' : 'routes';\n      console.log(\n        `\\n  ${section('Attack Surface')}  ` +\n        `${dim}(${result.totalRoutes} ${totalLabel} total: ${result.publicRoutes} public, ${result.authenticatedRoutes} authenticated)${reset}\\n`,\n      );\n\n      if (result.criticalPaths.length === 0) {\n        console.log(`  ${dim}No routes reaching vulnerable dependencies found.${reset}\\n`);\n        return;\n      }\n\n      // Critical paths section\n      console.log(`  ${violet}${bold}\u25CF Critical paths${reset} ${dim}(routes reaching affected vulnerabilities)${reset}\\n`);\n\n      const criticalToShow = result.criticalPaths.slice(0, limit);\n\n      for (const entry of criticalToShow) {\n        printRouteEntry(entry);\n      }\n\n      // If public-only was not set, also show clean routes summary\n      if (!opts.publicOnly) {\n        const cleanCount = result.totalRoutes - result.routesWithVulns;\n        if (cleanCount > 0) {\n          console.log(`  ${dim}+ ${cleanCount} clean route${cleanCount === 1 ? '' : 's'} (no reachable vulnerabilities)${reset}\\n`);\n        }\n      }\n    });\n}\n\nfunction printRouteEntry(entry: AttackSurfaceEntry): void {\n  const isPublicVuln = entry.exposureLevel === 'public' && entry.vulnerableDeps.length > 0;\n  const isAuthVuln   = (entry.exposureLevel === 'authenticated' || entry.exposureLevel === 'internal') && entry.vulnerableDeps.length > 0;\n\n  const routeColor = isPublicVuln ? red : isAuthVuln ? yellow : dim;\n  const riskLabel  = entry.riskScore > 0 ? `${entry.riskScore.toFixed(1)}` : '?';\n\n  // Exposure badge\n  const exposureBadge = (() => {\n    switch (entry.exposureLevel) {\n      case 'public':        return `${red}public${reset}     `;\n      case 'authenticated': return `${yellow}authenticated${reset}`;\n      case 'internal':      return `${dim}internal${reset}   `;\n      default:              return `${dim}unknown${reset}    `;\n    }\n  })();\n\n  // Pick the top vuln by riskScore to show inline\n  const topVuln = entry.vulnerableDeps.reduce<AttackSurfaceEntry['vulnerableDeps'][0] | null>(\n    (best, v) => {\n      if (!best) return v;\n      if ((v.riskScore ?? 0) > (best.riskScore ?? 0)) return v;\n      return best;\n    },\n    null,\n  );\n\n  let vulnSuffix = '';\n  if (topVuln) {\n    const hopWord = topVuln.hopCount === 1 ? '1 hop' : `${topVuln.hopCount} hops`;\n    vulnSuffix = `  ${dim}\u2192${reset} ${violet}${topVuln.packageName}${reset} ${dim}${topVuln.cveId}${reset} ${dim}(${hopWord})${reset}`;\n    if (entry.vulnerableDeps.length > 1) {\n      vulnSuffix += `  ${dim}+${entry.vulnerableDeps.length - 1} more${reset}`;\n    }\n  }\n\n  console.log(\n    `  ${routeColor}[${riskLabel}]${reset} ${bold}${entry.route.padEnd(30)}${reset}  ${exposureBadge}${vulnSuffix}`,\n  );\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAkD;AAGlD,MAAM,MAAS;AACf,MAAM,SAAS;AAER,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,8BAA8B,EACtC,YAAY,sDAAsD,EAClE,OAAO,eAAe,oCAAoC,IAAI,EAC9D,OAAO,iBAAiB,yCAAyC,EACjE,OAAO,kBAAkB,6CAA6C,MAAM,EAC5E,OAAO,OACN,aACA,SACG;AACH,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,MAAM,wCAAmC,eAAK,EAAE;AACrE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,QAAQ,SAAS,KAAK,OAAO,EAAE;AACrC,QAAI,MAAM,KAAK,KAAK,QAAQ,GAAG;AAC7B,cAAQ,MAAM,mCAA8B,KAAK,KAAK,+BAA+B;AACrF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,eAAe,CAAC,QAAQ,MAAM;AACpC,QAAI,CAAC,aAAa,SAAS,KAAK,MAAM,GAAG;AACvC,cAAQ,MAAM,oCAA+B,KAAK,MAAM,mBAAmB;AAC3E,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AAEvB,UAAM,EAAE,sBAAsB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,kCAAkC,CAAC;AAChH,UAAM,WAAW,IAAI,sBAAsB,EAAE;AAC7C,UAAM,SAAS,MAAM,SAAS,QAAQ;AAEtC,OAAG,MAAM;AAGT,QAAI,SAAS,KAAK,aACd,OAAO,UAAU,OAAO,OAAK,EAAE,kBAAkB,QAAQ,IACzD,OAAO;AAGX,UAAM,UAAU,OAAO,MAAM,GAAG,KAAK;AAGrC,QAAI,KAAK,WAAW,QAAQ;AAC1B,cAAQ,IAAI,KAAK;AAAA,QACf;AAAA,UACE,aAAa,OAAO;AAAA,UACpB,cAAc,OAAO;AAAA,UACrB,qBAAqB,OAAO;AAAA,UAC5B,iBAAiB,OAAO;AAAA,UACxB,eAAe,OAAO;AAAA,UACtB,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAGA,UAAM,aAAa,OAAO,gBAAgB,IAAI,UAAU;AACxD,YAAQ;AAAA,MACN;AAAA,QAAO,mBAAQ,gBAAgB,CAAC,KAC7B,aAAG,IAAI,OAAO,WAAW,IAAI,UAAU,WAAW,OAAO,YAAY,YAAY,OAAO,mBAAmB,kBAAkB,eAAK;AAAA;AAAA,IACvI;AAEA,QAAI,OAAO,cAAc,WAAW,GAAG;AACrC,cAAQ,IAAI,KAAK,aAAG,oDAAoD,eAAK;AAAA,CAAI;AACjF;AAAA,IACF;AAGA,YAAQ,IAAI,KAAK,gBAAM,GAAG,cAAI,wBAAmB,eAAK,IAAI,aAAG,6CAA6C,eAAK;AAAA,CAAI;AAEnH,UAAM,iBAAiB,OAAO,cAAc,MAAM,GAAG,KAAK;AAE1D,eAAW,SAAS,gBAAgB;AAClC,sBAAgB,KAAK;AAAA,IACvB;AAGA,QAAI,CAAC,KAAK,YAAY;AACpB,YAAM,aAAa,OAAO,cAAc,OAAO;AAC/C,UAAI,aAAa,GAAG;AAClB,gBAAQ,IAAI,KAAK,aAAG,KAAK,UAAU,eAAe,eAAe,IAAI,KAAK,GAAG,kCAAkC,eAAK;AAAA,CAAI;AAAA,MAC1H;AAAA,IACF;AAAA,EACF,CAAC;AACL;AAEA,SAAS,gBAAgB,OAAiC;AACxD,QAAM,eAAe,MAAM,kBAAkB,YAAY,MAAM,eAAe,SAAS;AACvF,QAAM,cAAgB,MAAM,kBAAkB,mBAAmB,MAAM,kBAAkB,eAAe,MAAM,eAAe,SAAS;AAEtI,QAAM,aAAa,eAAe,MAAM,aAAa,SAAS;AAC9D,QAAM,YAAa,MAAM,YAAY,IAAI,GAAG,MAAM,UAAU,QAAQ,CAAC,CAAC,KAAK;AAG3E,QAAM,iBAAiB,MAAM;AAC3B,YAAQ,MAAM,eAAe;AAAA,MAC3B,KAAK;AAAiB,eAAO,GAAG,GAAG,SAAS,eAAK;AAAA,MACjD,KAAK;AAAiB,eAAO,GAAG,MAAM,gBAAgB,eAAK;AAAA,MAC3D,KAAK;AAAiB,eAAO,GAAG,aAAG,WAAW,eAAK;AAAA,MACnD;AAAsB,eAAO,GAAG,aAAG,UAAU,eAAK;AAAA,IACpD;AAAA,EACF,GAAG;AAGH,QAAM,UAAU,MAAM,eAAe;AAAA,IACnC,CAAC,MAAM,MAAM;AACX,UAAI,CAAC,KAAM,QAAO;AAClB,WAAK,EAAE,aAAa,MAAM,KAAK,aAAa,GAAI,QAAO;AACvD,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AAEA,MAAI,aAAa;AACjB,MAAI,SAAS;AACX,UAAM,UAAU,QAAQ,aAAa,IAAI,UAAU,GAAG,QAAQ,QAAQ;AACtE,iBAAa,KAAK,aAAG,SAAI,eAAK,IAAI,gBAAM,GAAG,QAAQ,WAAW,GAAG,eAAK,IAAI,aAAG,GAAG,QAAQ,KAAK,GAAG,eAAK,IAAI,aAAG,IAAI,OAAO,IAAI,eAAK;AAChI,QAAI,MAAM,eAAe,SAAS,GAAG;AACnC,oBAAc,KAAK,aAAG,IAAI,MAAM,eAAe,SAAS,CAAC,QAAQ,eAAK;AAAA,IACxE;AAAA,EACF;AAEA,UAAQ;AAAA,IACN,KAAK,UAAU,IAAI,SAAS,IAAI,eAAK,IAAI,cAAI,GAAG,MAAM,MAAM,OAAO,EAAE,CAAC,GAAG,eAAK,KAAK,aAAa,GAAG,UAAU;AAAA,EAC/G;AACF;",
+  "sourcesContent": ["import { Command } from 'commander';\nimport * as path from 'path';\nimport { loadConfig } from '../../config';\nimport { dim, reset, violet, bold, section } from '../ui';\nimport type { AttackSurfaceEntry } from '../../security/attack-surface';\n\nconst red    = '\\x1b[31m';\nconst yellow = '\\x1b[33m';\n\nexport function register(program: Command): void {\n  program\n    .command('attack-surface [projectPath]')\n    .description('Map HTTP routes to reachable vulnerable dependencies')\n    .option('--limit <n>', 'Max routes to show (default: 20)', '20')\n    .option('--public-only', 'Show only public/unauthenticated routes')\n    .option('--format <fmt>', 'Output format: text, json (default: text)', 'text')\n    .action(async (\n      projectPath: string | undefined,\n      opts: { limit: string; publicOnly?: boolean; format: string },\n    ) => {\n      const target = path.resolve(projectPath ?? process.cwd());\n      const config = await loadConfig(target);\n\n      if (!config.enableSecurity) {\n        console.error(`\\n  ${yellow}\u26A0 Security analysis is disabled.${reset}`);\n        console.error(`  ${dim}Enable it in .kirograph/config.json:${reset} ${violet}${bold}\"enableSecurity\": true${reset}`);\n        console.error(`  ${dim}Then re-run:${reset} ${violet}${bold}kirograph index${reset}\\n`);\n        process.exit(1);\n      }\n\n      const limit = parseInt(opts.limit, 10);\n      if (isNaN(limit) || limit < 1) {\n        console.error(`  \u2716 Invalid --limit value: ${opts.limit}. Must be a positive integer.`);\n        process.exit(1);\n      }\n\n      const validFormats = ['text', 'json'];\n      if (!validFormats.includes(opts.format)) {\n        console.error(`  \u2716 Invalid --format value: ${opts.format}. Use: text, json`);\n        process.exit(1);\n      }\n\n      const KiroGraph = (await Promise.resolve().then(() => require('../../index.js'))).default;\n      if (!KiroGraph.isInitialized(target)) {\n        console.error('  \u2716 KiroGraph not initialized. Run: kirograph init');\n        process.exit(1);\n      }\n\n      const cg = await KiroGraph.open(target);\n      const db = cg.getDatabase();\n      db.applySecuritySchema();\n\n      const { AttackSurfaceAnalyzer } = await Promise.resolve().then(() => require('../../security/attack-surface.js'));\n      const analyzer = new AttackSurfaceAnalyzer(db);\n      const result = await analyzer.analyze();\n\n      cg.close();\n\n      // Apply --public-only filter\n      let routes = opts.publicOnly\n        ? result.allRoutes.filter(r => r.exposureLevel === 'public')\n        : result.allRoutes;\n\n      // Apply limit\n      const limited = routes.slice(0, limit);\n\n      // \u2500\u2500 JSON output \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n      if (opts.format === 'json') {\n        console.log(JSON.stringify(\n          {\n            totalRoutes: result.totalRoutes,\n            publicRoutes: result.publicRoutes,\n            authenticatedRoutes: result.authenticatedRoutes,\n            routesWithVulns: result.routesWithVulns,\n            criticalPaths: result.criticalPaths,\n            routes: limited,\n          },\n          null,\n          2,\n        ));\n        return;\n      }\n\n      // \u2500\u2500 Text output \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n      const totalLabel = result.totalRoutes === 1 ? 'route' : 'routes';\n      console.log(\n        `\\n  ${section('Attack Surface')}  ` +\n        `${dim}(${result.totalRoutes} ${totalLabel} total: ${result.publicRoutes} public, ${result.authenticatedRoutes} authenticated)${reset}\\n`,\n      );\n\n      if (result.criticalPaths.length === 0) {\n        console.log(`  ${dim}No routes reaching vulnerable dependencies found.${reset}\\n`);\n        return;\n      }\n\n      // Critical paths section\n      console.log(`  ${violet}${bold}\u25CF Critical paths${reset} ${dim}(routes reaching affected vulnerabilities)${reset}\\n`);\n\n      const criticalToShow = result.criticalPaths.slice(0, limit);\n\n      for (const entry of criticalToShow) {\n        printRouteEntry(entry);\n      }\n\n      // If public-only was not set, also show clean routes summary\n      if (!opts.publicOnly) {\n        const cleanCount = result.totalRoutes - result.routesWithVulns;\n        if (cleanCount > 0) {\n          console.log(`  ${dim}+ ${cleanCount} clean route${cleanCount === 1 ? '' : 's'} (no reachable vulnerabilities)${reset}\\n`);\n        }\n      }\n    });\n}\n\nfunction printRouteEntry(entry: AttackSurfaceEntry): void {\n  const isPublicVuln = entry.exposureLevel === 'public' && entry.vulnerableDeps.length > 0;\n  const isAuthVuln   = (entry.exposureLevel === 'authenticated' || entry.exposureLevel === 'internal') && entry.vulnerableDeps.length > 0;\n\n  const routeColor = isPublicVuln ? red : isAuthVuln ? yellow : dim;\n  const riskLabel  = entry.riskScore > 0 ? `${entry.riskScore.toFixed(1)}` : '?';\n\n  // Exposure badge\n  const exposureBadge = (() => {\n    switch (entry.exposureLevel) {\n      case 'public':        return `${red}public${reset}     `;\n      case 'authenticated': return `${yellow}authenticated${reset}`;\n      case 'internal':      return `${dim}internal${reset}   `;\n      default:              return `${dim}unknown${reset}    `;\n    }\n  })();\n\n  // Pick the top vuln by riskScore to show inline\n  const topVuln = entry.vulnerableDeps.reduce<AttackSurfaceEntry['vulnerableDeps'][0] | null>(\n    (best, v) => {\n      if (!best) return v;\n      if ((v.riskScore ?? 0) > (best.riskScore ?? 0)) return v;\n      return best;\n    },\n    null,\n  );\n\n  let vulnSuffix = '';\n  if (topVuln) {\n    const hopWord = topVuln.hopCount === 1 ? '1 hop' : `${topVuln.hopCount} hops`;\n    vulnSuffix = `  ${dim}\u2192${reset} ${violet}${topVuln.packageName}${reset} ${dim}${topVuln.cveId}${reset} ${dim}(${hopWord})${reset}`;\n    if (entry.vulnerableDeps.length > 1) {\n      vulnSuffix += `  ${dim}+${entry.vulnerableDeps.length - 1} more${reset}`;\n    }\n  }\n\n  console.log(\n    `  ${routeColor}[${riskLabel}]${reset} ${bold}${entry.route.padEnd(30)}${reset}  ${exposureBadge}${vulnSuffix}`,\n  );\n\n  // Pattern matches below the route line\n  for (const pm of entry.patternMatches) {\n    const sevUpper = pm.severity.toUpperCase();\n    const pmColor = pm.severity === 'critical' ? red : pm.severity === 'high' ? yellow : dim;\n    console.log(\n      `        ${pmColor}\u26A0 [${sevUpper}]${reset} ${dim}${pm.patternId}${reset} ${dim}at${reset} ${pm.symbolName}:${pm.line}`,\n    );\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,WAAsB;AACtB,oBAA2B;AAC3B,gBAAkD;AAGlD,MAAM,MAAS;AACf,MAAM,SAAS;AAER,SAAS,SAAS,SAAwB;AAC/C,UACG,QAAQ,8BAA8B,EACtC,YAAY,sDAAsD,EAClE,OAAO,eAAe,oCAAoC,IAAI,EAC9D,OAAO,iBAAiB,yCAAyC,EACjE,OAAO,kBAAkB,6CAA6C,MAAM,EAC5E,OAAO,OACN,aACA,SACG;AACH,UAAM,SAAS,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC;AACxD,UAAM,SAAS,UAAM,0BAAW,MAAM;AAEtC,QAAI,CAAC,OAAO,gBAAgB;AAC1B,cAAQ,MAAM;AAAA,IAAO,MAAM,wCAAmC,eAAK,EAAE;AACrE,cAAQ,MAAM,KAAK,aAAG,uCAAuC,eAAK,IAAI,gBAAM,GAAG,cAAI,yBAAyB,eAAK,EAAE;AACnH,cAAQ,MAAM,KAAK,aAAG,eAAe,eAAK,IAAI,gBAAM,GAAG,cAAI,kBAAkB,eAAK;AAAA,CAAI;AACtF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,QAAQ,SAAS,KAAK,OAAO,EAAE;AACrC,QAAI,MAAM,KAAK,KAAK,QAAQ,GAAG;AAC7B,cAAQ,MAAM,mCAA8B,KAAK,KAAK,+BAA+B;AACrF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,eAAe,CAAC,QAAQ,MAAM;AACpC,QAAI,CAAC,aAAa,SAAS,KAAK,MAAM,GAAG;AACvC,cAAQ,MAAM,oCAA+B,KAAK,MAAM,mBAAmB;AAC3E,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,aAAa,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,gBAAgB,CAAC,GAAG;AAClF,QAAI,CAAC,UAAU,cAAc,MAAM,GAAG;AACpC,cAAQ,MAAM,yDAAoD;AAClE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACtC,UAAM,KAAK,GAAG,YAAY;AAC1B,OAAG,oBAAoB;AAEvB,UAAM,EAAE,sBAAsB,IAAI,MAAM,QAAQ,QAAQ,EAAE,KAAK,MAAM,QAAQ,kCAAkC,CAAC;AAChH,UAAM,WAAW,IAAI,sBAAsB,EAAE;AAC7C,UAAM,SAAS,MAAM,SAAS,QAAQ;AAEtC,OAAG,MAAM;AAGT,QAAI,SAAS,KAAK,aACd,OAAO,UAAU,OAAO,OAAK,EAAE,kBAAkB,QAAQ,IACzD,OAAO;AAGX,UAAM,UAAU,OAAO,MAAM,GAAG,KAAK;AAGrC,QAAI,KAAK,WAAW,QAAQ;AAC1B,cAAQ,IAAI,KAAK;AAAA,QACf;AAAA,UACE,aAAa,OAAO;AAAA,UACpB,cAAc,OAAO;AAAA,UACrB,qBAAqB,OAAO;AAAA,UAC5B,iBAAiB,OAAO;AAAA,UACxB,eAAe,OAAO;AAAA,UACtB,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAGA,UAAM,aAAa,OAAO,gBAAgB,IAAI,UAAU;AACxD,YAAQ;AAAA,MACN;AAAA,QAAO,mBAAQ,gBAAgB,CAAC,KAC7B,aAAG,IAAI,OAAO,WAAW,IAAI,UAAU,WAAW,OAAO,YAAY,YAAY,OAAO,mBAAmB,kBAAkB,eAAK;AAAA;AAAA,IACvI;AAEA,QAAI,OAAO,cAAc,WAAW,GAAG;AACrC,cAAQ,IAAI,KAAK,aAAG,oDAAoD,eAAK;AAAA,CAAI;AACjF;AAAA,IACF;AAGA,YAAQ,IAAI,KAAK,gBAAM,GAAG,cAAI,wBAAmB,eAAK,IAAI,aAAG,6CAA6C,eAAK;AAAA,CAAI;AAEnH,UAAM,iBAAiB,OAAO,cAAc,MAAM,GAAG,KAAK;AAE1D,eAAW,SAAS,gBAAgB;AAClC,sBAAgB,KAAK;AAAA,IACvB;AAGA,QAAI,CAAC,KAAK,YAAY;AACpB,YAAM,aAAa,OAAO,cAAc,OAAO;AAC/C,UAAI,aAAa,GAAG;AAClB,gBAAQ,IAAI,KAAK,aAAG,KAAK,UAAU,eAAe,eAAe,IAAI,KAAK,GAAG,kCAAkC,eAAK;AAAA,CAAI;AAAA,MAC1H;AAAA,IACF;AAAA,EACF,CAAC;AACL;AAEA,SAAS,gBAAgB,OAAiC;AACxD,QAAM,eAAe,MAAM,kBAAkB,YAAY,MAAM,eAAe,SAAS;AACvF,QAAM,cAAgB,MAAM,kBAAkB,mBAAmB,MAAM,kBAAkB,eAAe,MAAM,eAAe,SAAS;AAEtI,QAAM,aAAa,eAAe,MAAM,aAAa,SAAS;AAC9D,QAAM,YAAa,MAAM,YAAY,IAAI,GAAG,MAAM,UAAU,QAAQ,CAAC,CAAC,KAAK;AAG3E,QAAM,iBAAiB,MAAM;AAC3B,YAAQ,MAAM,eAAe;AAAA,MAC3B,KAAK;AAAiB,eAAO,GAAG,GAAG,SAAS,eAAK;AAAA,MACjD,KAAK;AAAiB,eAAO,GAAG,MAAM,gBAAgB,eAAK;AAAA,MAC3D,KAAK;AAAiB,eAAO,GAAG,aAAG,WAAW,eAAK;AAAA,MACnD;AAAsB,eAAO,GAAG,aAAG,UAAU,eAAK;AAAA,IACpD;AAAA,EACF,GAAG;AAGH,QAAM,UAAU,MAAM,eAAe;AAAA,IACnC,CAAC,MAAM,MAAM;AACX,UAAI,CAAC,KAAM,QAAO;AAClB,WAAK,EAAE,aAAa,MAAM,KAAK,aAAa,GAAI,QAAO;AACvD,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AAEA,MAAI,aAAa;AACjB,MAAI,SAAS;AACX,UAAM,UAAU,QAAQ,aAAa,IAAI,UAAU,GAAG,QAAQ,QAAQ;AACtE,iBAAa,KAAK,aAAG,SAAI,eAAK,IAAI,gBAAM,GAAG,QAAQ,WAAW,GAAG,eAAK,IAAI,aAAG,GAAG,QAAQ,KAAK,GAAG,eAAK,IAAI,aAAG,IAAI,OAAO,IAAI,eAAK;AAChI,QAAI,MAAM,eAAe,SAAS,GAAG;AACnC,oBAAc,KAAK,aAAG,IAAI,MAAM,eAAe,SAAS,CAAC,QAAQ,eAAK;AAAA,IACxE;AAAA,EACF;AAEA,UAAQ;AAAA,IACN,KAAK,UAAU,IAAI,SAAS,IAAI,eAAK,IAAI,cAAI,GAAG,MAAM,MAAM,OAAO,EAAE,CAAC,GAAG,eAAK,KAAK,aAAa,GAAG,UAAU;AAAA,EAC/G;AAGA,aAAW,MAAM,MAAM,gBAAgB;AACrC,UAAM,WAAW,GAAG,SAAS,YAAY;AACzC,UAAM,UAAU,GAAG,aAAa,aAAa,MAAM,GAAG,aAAa,SAAS,SAAS;AACrF,YAAQ;AAAA,MACN,WAAW,OAAO,WAAM,QAAQ,IAAI,eAAK,IAAI,aAAG,GAAG,GAAG,SAAS,GAAG,eAAK,IAAI,aAAG,KAAK,eAAK,IAAI,GAAG,UAAU,IAAI,GAAG,IAAI;AAAA,IACtH;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/bin/commands/benchmark.d.ts

@@ -0,0 +1,9 @@
+/**
+ * KiroGraph Benchmark Runner
+ *
+ * Clones repos at pinned SHAs, indexes them, runs predefined queries,
+ * and measures token efficiency vs naive file reading.
+ */
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=benchmark.d.ts.map

package/dist/bin/commands/benchmark.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"benchmark.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/benchmark.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwCpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA4C/C"}

package/dist/bin/commands/budget.d.ts

@@ -0,0 +1,6 @@
+/**
+ * kirograph budget — Context budget governance CLI command
+ */
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=budget.d.ts.map

package/dist/bin/commands/budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/budget.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoD/C"}

package/dist/bin/commands/caveman.d.ts

@@ -0,0 +1,7 @@
+/**
+ * kg caveman [off|lite|full|ultra]   — set caveman mode for this project
+ * kg caveman                        — show current mode
+ */
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=caveman.d.ts.map

package/dist/bin/commands/caveman.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caveman.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/caveman.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkCpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgG/C"}

package/dist/bin/commands/communities.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=communities.d.ts.map

package/dist/bin/commands/communities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"communities.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/communities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+C/C"}

package/dist/bin/commands/compression.d.ts

@@ -0,0 +1,7 @@
+/**
+ * kg compression [off|normal|aggressive|ultra]   — set compression level for this project
+ * kg compression                                 — show current level
+ */
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=compression.d.ts.map

package/dist/bin/commands/compression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compression.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/compression.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwE/C"}

package/dist/bin/commands/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmD/C"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+D/C"}

package/dist/bin/commands/data.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=data.d.ts.map

package/dist/bin/commands/data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8rB/C"}

package/dist/bin/commands/dead-code.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=dead-code.d.ts.map

package/dist/bin/commands/dead-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dead-code.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/dead-code.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2C/C"}

package/dist/bin/commands/dep-confusion.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=dep-confusion.d.ts.map

package/dist/bin/commands/dep-confusion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-confusion.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/dep-confusion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiBpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwE/C"}

package/dist/bin/commands/docs.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=docs.d.ts.map

package/dist/bin/commands/docs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/docs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoBpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA4W/C"}

package/dist/bin/commands/exec.d.ts

@@ -0,0 +1,11 @@
+/**
+ * kirograph exec <command...> — Run a shell command with token-optimized output
+ *
+ * Examples:
+ *   kirograph exec git status
+ *   kirograph exec --level aggressive npm test
+ *   kirograph exec -l ultra ls -la src/
+ */
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=exec.d.ts.map

package/dist/bin/commands/exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/exec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmG/C"}

package/dist/bin/commands/export.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=export.d.ts.map

package/dist/bin/commands/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/export.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0wFpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyL/C"}

package/dist/bin/commands/flows.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=flows.d.ts.map

package/dist/bin/commands/flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/flows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+D/C"}

package/dist/bin/commands/gain.d.ts

@@ -0,0 +1,6 @@
+/**
+ * kirograph gain — Token savings analytics CLI command
+ */
+import { Command } from 'commander';
+export declare function register(program: Command): void;
+//# sourceMappingURL=gain.d.ts.map

package/dist/bin/commands/gain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gain.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/gain.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkH/C"}

package/dist/bin/commands/help.d.ts

@@ -1,4 +1,11 @@
 import { Command } from 'commander';
+/**
+ * Interactive tabbed help — left/right for tabs, up/down for commands, enter to copy.
+ */
+export declare function printInteractiveHelp(): void;
+/**
+ * Non-interactive full help (for piping, --help flag).
+ */
 export declare function printColoredHelp(): void;
 export declare function register(program: Command): void;
 //# sourceMappingURL=help.d.ts.map

package/dist/bin/commands/help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,wBAAgB,gBAAgB,IAAI,IAAI,CA0EvC;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAS/C"}
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../../src/bin/commands/help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0QpC;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAiG3C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAkIvC;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAK/C"}

package/dist/bin/commands/help.js

@@ -194,7 +194,18 @@ const GROUPS = [
       { name: "attack-surface", args: "[path]", desc: "Map attack surface: routes \u2192 vulnerable deps with hop count and auth status", opts: ["--limit <n>", "--public-only", "--format json"] },
       { name: "supply-chain", args: "[path]", desc: "Supply chain health: OpenSSF Scorecard, maintainer count, abandoned packages", opts: ["--threshold critical|high|medium", "--refresh", "--format json"] },
       { name: "dep-confusion", args: "[path]", desc: "Detect dependency confusion: internal packages that exist in public registries", opts: ["--format json"] },
-      { name: "remediation", args: "[path]", desc: "Remediation SLA tracking: days open, fix available since, overdue alerts", opts: ["--overdue-only", "--format json"] }
+      { name: "remediation", args: "[path]", desc: "Remediation SLA tracking: days open, fix available since, overdue alerts", opts: ["--overdue-only", "--format json"] },
+      {
+        name: "pattern",
+        args: "[pattern]",
+        desc: "AST structural search: live pattern search or library rule runner",
+        opts: [
+          "--list             Show all bundled SAST rules",
+          "--library <id>    Run a specific library rule",
+          "--lang <l>        Language filter (js, ts, python, go, ...)",
+          "--format json     JSON output"
+        ]
+      }
     ],
     examples: [
       ["kirograph security", "Overview: dep count, vuln count, verdict breakdown"],
@@ -223,7 +234,10 @@ const GROUPS = [
       ["kirograph remediation --overdue-only", "Show CVEs past their remediation SLA"],
       ['kirograph vuln suppress CVE-2024-1234 --reason "not in code path"', "Suppress a false positive CVE"],
       ["kirograph vuln unsuppress CVE-2024-1234", "Remove a suppression"],
-      ["kirograph vuln suppressions", "List all active suppressions"]
+      ["kirograph vuln suppressions", "List all active suppressions"],
+      ['kirograph pattern "eval($X)"', "Find all eval() calls"],
+      ["kirograph pattern --list", "Show all bundled SAST rules"],
+      ["kirograph pattern --library dangerous-eval-js", "Run the dangerous-eval library rule"]
     ]
   },
   {
@@ -465,7 +479,10 @@ ${c.bold}${c.paleLavender}USAGE${c.reset}`);
         ['kirograph vuln suppress CVE-2024-1234 --reason "not in code path"', "Suppress a false positive CVE"],
         ["kirograph vuln suppress CVE-2024-1234 --expires 2026-12-31", "Suppress with expiry date"],
         ["kirograph vuln unsuppress CVE-2024-1234", "Remove a suppression"],
-        ["kirograph vuln suppressions", "List all active suppressions"]
+        ["kirograph vuln suppressions", "List all active suppressions"],
+        ['kirograph pattern "eval($X)"', "Find all eval() calls (requires enablePatterns: true)"],
+        ["kirograph pattern --list", "Show all bundled SAST pattern rules"],
+        ["kirograph pattern --library dangerous-eval-js", "Run a specific library rule"]
       ]
     },
     {