kirograph 0.19.0 → 0.20.1

package/dist/resolution/index.d.ts

@@ -6,22 +6,26 @@
  */
 import type { GraphDatabase } from '../db/database';
 import type { KiroGraphConfig } from '../config';
+import { type BridgeResolutionResult } from './bridges';
 export interface ResolutionResult {
     resolved: number;
     unresolved: number;
     total: number;
     durationMs: number;
+    bridgeResult?: BridgeResolutionResult;
 }
 export declare class ReferenceResolver {
     private db;
     private config;
+    private projectRoot;
     private nameCache;
     private qualifiedNameCache;
     private kindCache;
     private lowerNameCache;
     private nodeByIdCache;
+    private namespacePrefixCache;
     private cacheWarmed;
-    constructor(db: GraphDatabase, config: KiroGraphConfig);
+    constructor(db: GraphDatabase, config: KiroGraphConfig, projectRoot?: string);
     /**
      * Pre-load all nodes into Maps for O(1) lookup.
      * Must be called before resolveUnresolvedRefs() for best performance.
@@ -44,13 +48,34 @@ export declare class ReferenceResolver {
      */
     invalidateFile(filePath: string): void;
     /**
-     * Resolve a relative import path to the ID of the first node in the target file.
-     * Returns null if no indexed file matches.
+     * Resolve an import path to a node ID.
+     *
+     * Handles three cases:
+     *  1. Relative paths (JS/TS/Go/…) — resolved via the file tree.
+     *  2. Fully-qualified type imports (Java `import com.example.Foo`) — exact qualifiedName lookup,
+     *     then name+namespace-prefix match.
+     *  3. Namespace-level imports (C# `using MyApp.Services`) — namespace node lookup, then
+     *     namespace prefix cache (O(1)) to find any class in that namespace.
      */
     private _resolveImportPath;
+    /**
+     * Resolve a bare type name to a node ID.
+     * Used for extends/implements refs where we have only the unqualified type name.
+     * Prefers class/interface/trait/protocol nodes over other kinds.
+     */
+    private _resolveTypeName;
     /**
      * Convert a raw DB row to a Node object.
      */
     private _rowToNode;
+    /**
+     * Run cross-language bridge resolvers to synthesize edges between
+     * symbols in different languages (Swift ↔ ObjC, JS ↔ Native, etc.).
+     */
+    private _runBridgeResolvers;
+    /**
+     * Build a ResolutionContext for bridge resolvers using the warm caches.
+     */
+    private _buildBridgeContext;
 }
 //# sourceMappingURL=index.d.ts.map

package/dist/resolution/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resolution/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMjD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,EAAE,CAAgB;IAC1B,OAAO,CAAC,MAAM,CAAkB;IAGhC,OAAO,CAAC,SAAS,CAAkC;IACnD,OAAO,CAAC,kBAAkB,CAAgC;IAC1D,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,aAAa,CAAgC;IAErD,OAAO,CAAC,WAAW,CAAS;gBAEhB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe;IAKtD;;;OAGG;IACH,UAAU,IAAI,IAAI;IA2ClB;;;;OAIG;IACG,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAsBlG;;;OAGG;IACG,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAkHnG;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IA6DtC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAgC1B;;OAEG;IACH,OAAO,CAAC,UAAU;CAwBnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resolution/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGjD,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAI5E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,sBAAsB,CAAC;CACvC;AAID,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,EAAE,CAAgB;IAC1B,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,WAAW,CAAS;IAG5B,OAAO,CAAC,SAAS,CAAkC;IACnD,OAAO,CAAC,kBAAkB,CAAgC;IAC1D,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,aAAa,CAAgC;IAErD,OAAO,CAAC,oBAAoB,CAAkC;IAE9D,OAAO,CAAC,WAAW,CAAS;gBAEhB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,EAAE,MAAM;IAM5E;;;OAGG;IACH,UAAU,IAAI,IAAI;IA2DlB;;;;OAIG;IACG,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6BlG;;;OAGG;IACG,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IA+InG;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IA6DtC;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA0D1B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAcxB;;OAEG;IACH,OAAO,CAAC,UAAU;IA2BlB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAK3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;CAyC5B"}

package/dist/security/attack-surface.d.ts

@@ -0,0 +1,46 @@
+/**
+ * KiroGraph-Sec Attack Surface Analyzer
+ *
+ * Maps all route nodes in the knowledge graph to their reachable vulnerable
+ * dependencies, computing exposure levels and risk scores per route.
+ */
+import type { GraphDatabase } from '../db/database';
+export interface AttackSurfaceEntry {
+    route: string;
+    nodeId: string;
+    filePath: string;
+    isAuthenticated: boolean;
+    exposureLevel: 'public' | 'authenticated' | 'internal' | 'unknown';
+    vulnerableDeps: Array<{
+        cveId: string;
+        packageName: string;
+        severity: number | null;
+        epssScore: number | null;
+        riskScore: number | null;
+        verdict: string | null;
+        hopCount: number;
+    }>;
+    patternMatches: Array<{
+        patternId: string;
+        severity: string;
+        line: number;
+        symbolNodeId: string;
+        symbolName: string;
+    }>;
+    patternRiskLevel: 'none' | 'low' | 'medium' | 'high' | 'critical';
+    riskScore: number;
+}
+export interface AttackSurfaceResult {
+    totalRoutes: number;
+    publicRoutes: number;
+    authenticatedRoutes: number;
+    routesWithVulns: number;
+    criticalPaths: AttackSurfaceEntry[];
+    allRoutes: AttackSurfaceEntry[];
+}
+export declare class AttackSurfaceAnalyzer {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    analyze(): Promise<AttackSurfaceResult>;
+}
+//# sourceMappingURL=attack-surface.d.ts.map

package/dist/security/attack-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attack-surface.d.ts","sourceRoot":"","sources":["../../src/security/attack-surface.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAsBpD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,QAAQ,GAAG,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;IACnE,cAAc,EAAE,KAAK,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,cAAc,EAAE,KAAK,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,gBAAgB,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,OAAO,IAAI,OAAO,CAAC,mBAAmB,CAAC;CAgN9C"}

package/dist/security/attack-surface.js

@@ -95,6 +95,38 @@ class AttackSurfaceAnalyzer {
           });
         }
       }
+      const routeNodeId = route.id;
+      let patternRows = [];
+      try {
+        patternRows = rawDb.all(
+          `WITH RECURSIVE reachable(node_id, depth) AS (
+             SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')
+             UNION
+             SELECT e.target, r.depth + 1
+             FROM edges e
+             JOIN reachable r ON e.source = r.node_id
+             WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')
+           )
+           SELECT DISTINCT pm.symbol_node_id, n.name as symbol_name, pm.pattern_id, pm.severity, pm.line
+           FROM reachable r
+           JOIN pattern_matches pm ON pm.symbol_node_id = r.node_id
+           JOIN nodes n ON n.id = pm.symbol_node_id
+           WHERE pm.symbol_node_id IS NOT NULL
+           ORDER BY CASE pm.severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END DESC
+           LIMIT 10`,
+          [routeNodeId]
+        );
+      } catch {
+        patternRows = [];
+      }
+      const patternMatches = patternRows.map((r) => ({
+        patternId: r.pattern_id,
+        severity: r.severity,
+        line: r.line,
+        symbolNodeId: r.symbol_node_id,
+        symbolName: r.symbol_name
+      }));
+      const patternRiskLevel = patternMatches.length === 0 ? "none" : patternMatches[0].severity;
       const pathNodeNames = rawDb.all(
         `WITH RECURSIVE reachable(node_id, depth) AS (
            SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')
@@ -126,10 +158,18 @@ class AttackSurfaceAnalyzer {
         exposureLevel = "unknown";
       }
       const affectedVulns = vulnerableDeps.filter((v) => v.verdict === "affected" || v.verdict === "under_investigation");
-      const riskScore = affectedVulns.reduce((max, v) => {
+      const baseRiskScore = affectedVulns.reduce((max, v) => {
         if (v.riskScore != null && v.riskScore > max) return v.riskScore;
         return max;
       }, 0);
+      const patternBonus = {
+        none: 0,
+        low: 0.3,
+        medium: 0.6,
+        high: 0.8,
+        critical: 1
+      };
+      const riskScore = Math.min(10, baseRiskScore + (patternBonus[patternRiskLevel] ?? 0));
       entries.push({
         route: route.name ?? route.id,
         nodeId: route.id,
@@ -137,6 +177,8 @@ class AttackSurfaceAnalyzer {
         isAuthenticated,
         exposureLevel,
         vulnerableDeps,
+        patternMatches,
+        patternRiskLevel,
         riskScore
       });
     }

package/dist/security/attack-surface.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/security/attack-surface.ts"],
-  "sourcesContent": ["/**\n * KiroGraph-Sec Attack Surface Analyzer\n *\n * Maps all route nodes in the knowledge graph to their reachable vulnerable\n * dependencies, computing exposure levels and risk scores per route.\n */\n\nimport type { GraphDatabase } from '../db/database';\n\n/** Auth-related name patterns for heuristic isAuthenticated detection. */\nconst AUTH_PATTERNS = [\n  'auth',\n  'authenticate',\n  'middleware',\n  'guard',\n  'protect',\n  'requirelogin',\n  'isloggedin',\n  'verifytoken',\n  'checkauth',\n  'ensureauth',\n] as const;\n\n/** Route path patterns that indicate a public-facing API. */\nconst PUBLIC_ROUTE_PATTERNS = ['/api/', '/v1/', '/v2/', '/v3/', '/graphql', '/rest/'];\n\n/** Route path patterns that indicate an internal/admin route. */\nconst INTERNAL_ROUTE_PATTERNS = ['/internal/', '/admin/'];\n\nexport interface AttackSurfaceEntry {\n  route: string;\n  nodeId: string;\n  filePath: string;\n  isAuthenticated: boolean;\n  exposureLevel: 'public' | 'authenticated' | 'internal' | 'unknown';\n  vulnerableDeps: Array<{\n    cveId: string;\n    packageName: string;\n    severity: number | null;\n    epssScore: number | null;\n    riskScore: number | null;\n    verdict: string | null;\n    hopCount: number;\n  }>;\n  riskScore: number;\n}\n\nexport interface AttackSurfaceResult {\n  totalRoutes: number;\n  publicRoutes: number;\n  authenticatedRoutes: number;\n  routesWithVulns: number;\n  criticalPaths: AttackSurfaceEntry[];\n  allRoutes: AttackSurfaceEntry[];\n}\n\nexport class AttackSurfaceAnalyzer {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async analyze(): Promise<AttackSurfaceResult> {\n    const rawDb = this.db.getRawDb();\n\n    // Step 1: Query all route nodes\n    const routeRows: Array<{ id: string; name: string; file_path: string }> = rawDb.all(\n      `SELECT id, name, file_path FROM nodes WHERE kind = 'route'`,\n    );\n\n    if (routeRows.length === 0) {\n      return {\n        totalRoutes: 0,\n        publicRoutes: 0,\n        authenticatedRoutes: 0,\n        routesWithVulns: 0,\n        criticalPaths: [],\n        allRoutes: [],\n      };\n    }\n\n    const entries: AttackSurfaceEntry[] = [];\n\n    for (const route of routeRows) {\n      // Step 2: BFS via SQL to find reachable dependency nodes (max 5 hops)\n      const reachableDeps: Array<{\n        node_id: string;\n        package_name: string;\n        hop_count: number;\n      }> = rawDb.all(\n        `WITH RECURSIVE reachable(node_id, depth) AS (\n           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n           UNION\n           SELECT e.target, r.depth + 1\n           FROM edges e\n           JOIN reachable r ON e.source = r.node_id\n           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n         )\n         SELECT d.node_id, d.package_name, MIN(r.depth) as hop_count\n         FROM reachable r\n         JOIN sec_dependencies d ON d.node_id = r.node_id\n         GROUP BY d.node_id, d.package_name`,\n        [route.id],\n      );\n\n      // Step 3: For each reachable dep, find affected/under_investigation vulns\n      const vulnerableDeps: AttackSurfaceEntry['vulnerableDeps'] = [];\n\n      for (const dep of reachableDeps) {\n        const vulnRows: Array<{\n          cve_id: string;\n          package_name: string;\n          severity_score: number | null;\n          epss_score: number | null;\n          risk_score: number | null;\n          verdict: string | null;\n        }> = rawDb.all(\n          `SELECT v.cve_id, d.package_name, v.severity_score, v.epss_score, v.risk_score, r.verdict\n           FROM sec_vulnerabilities v\n           JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n           JOIN sec_dependencies d ON d.node_id = e.source\n           LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n           WHERE d.node_id = ?\n             AND (r.verdict IN ('affected', 'under_investigation') OR r.verdict IS NULL)`,\n          [dep.node_id],\n        );\n\n        for (const vuln of vulnRows) {\n          vulnerableDeps.push({\n            cveId: vuln.cve_id,\n            packageName: vuln.package_name ?? dep.package_name,\n            severity: vuln.severity_score,\n            epssScore: vuln.epss_score,\n            riskScore: vuln.risk_score,\n            verdict: vuln.verdict,\n            hopCount: dep.hop_count,\n          });\n        }\n      }\n\n      // Step 4: Heuristic \u2014 isAuthenticated via path node names\n      const pathNodeNames: Array<{ name: string }> = rawDb.all(\n        `WITH RECURSIVE reachable(node_id, depth) AS (\n           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n           UNION\n           SELECT e.target, r.depth + 1\n           FROM edges e\n           JOIN reachable r ON e.source = r.node_id\n           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n         )\n         SELECT DISTINCT n.name\n         FROM reachable r\n         JOIN nodes n ON n.id = r.node_id\n         WHERE n.name IS NOT NULL`,\n        [route.id],\n      );\n\n      const isAuthenticated = pathNodeNames.some(row => {\n        const lowerName = (row.name ?? '').toLowerCase();\n        return AUTH_PATTERNS.some(pattern => lowerName.includes(pattern));\n      });\n\n      // Step 5: Determine exposure level\n      const routeName = (route.name ?? '').toLowerCase();\n      let exposureLevel: AttackSurfaceEntry['exposureLevel'];\n\n      if (INTERNAL_ROUTE_PATTERNS.some(p => routeName.includes(p))) {\n        exposureLevel = 'internal';\n      } else if (isAuthenticated) {\n        exposureLevel = 'authenticated';\n      } else if (PUBLIC_ROUTE_PATTERNS.some(p => routeName.includes(p))) {\n        exposureLevel = 'public';\n      } else {\n        exposureLevel = 'unknown';\n      }\n\n      // Step 6: riskScore = max risk_score of reachable affected vulns\n      const affectedVulns = vulnerableDeps.filter(v => v.verdict === 'affected' || v.verdict === 'under_investigation');\n      const riskScore = affectedVulns.reduce((max, v) => {\n        if (v.riskScore != null && v.riskScore > max) return v.riskScore;\n        return max;\n      }, 0);\n\n      entries.push({\n        route: route.name ?? route.id,\n        nodeId: route.id,\n        filePath: route.file_path ?? '',\n        isAuthenticated,\n        exposureLevel,\n        vulnerableDeps,\n        riskScore,\n      });\n    }\n\n    // Compute summary stats\n    const publicRoutes = entries.filter(e => e.exposureLevel === 'public').length;\n    const authenticatedRoutes = entries.filter(\n      e => e.exposureLevel === 'authenticated' || e.exposureLevel === 'internal',\n    ).length;\n    const routesWithVulns = entries.filter(e => e.vulnerableDeps.length > 0).length;\n\n    // Critical paths: routes with affected/under_investigation vulns, sorted by riskScore desc\n    const criticalPaths = entries\n      .filter(e => e.vulnerableDeps.length > 0)\n      .sort((a, b) => b.riskScore - a.riskScore);\n\n    const allRoutes = entries.sort((a, b) => b.riskScore - a.riskScore);\n\n    return {\n      totalRoutes: entries.length,\n      publicRoutes,\n      authenticatedRoutes,\n      routesWithVulns,\n      criticalPaths,\n      allRoutes,\n    };\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,MAAM,wBAAwB,CAAC,SAAS,QAAQ,QAAQ,QAAQ,YAAY,QAAQ;AAGpF,MAAM,0BAA0B,CAAC,cAAc,SAAS;AA6BjD,MAAM,sBAAsB;AAAA,EACjC,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,UAAwC;AAC5C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAG/B,UAAM,YAAoE,MAAM;AAAA,MAC9E;AAAA,IACF;AAEA,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO;AAAA,QACL,aAAa;AAAA,QACb,cAAc;AAAA,QACd,qBAAqB;AAAA,QACrB,iBAAiB;AAAA,QACjB,eAAe,CAAC;AAAA,QAChB,WAAW,CAAC;AAAA,MACd;AAAA,IACF;AAEA,UAAM,UAAgC,CAAC;AAEvC,eAAW,SAAS,WAAW;AAE7B,YAAM,gBAID,MAAM;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,MAAM,EAAE;AAAA,MACX;AAGA,YAAM,iBAAuD,CAAC;AAE9D,iBAAW,OAAO,eAAe;AAC/B,cAAM,WAOD,MAAM;AAAA,UACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOA,CAAC,IAAI,OAAO;AAAA,QACd;AAEA,mBAAW,QAAQ,UAAU;AAC3B,yBAAe,KAAK;AAAA,YAClB,OAAO,KAAK;AAAA,YACZ,aAAa,KAAK,gBAAgB,IAAI;AAAA,YACtC,UAAU,KAAK;AAAA,YACf,WAAW,KAAK;AAAA,YAChB,WAAW,KAAK;AAAA,YAChB,SAAS,KAAK;AAAA,YACd,UAAU,IAAI;AAAA,UAChB,CAAC;AAAA,QACH;AAAA,MACF;AAGA,YAAM,gBAAyC,MAAM;AAAA,QACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,MAAM,EAAE;AAAA,MACX;AAEA,YAAM,kBAAkB,cAAc,KAAK,SAAO;AAChD,cAAM,aAAa,IAAI,QAAQ,IAAI,YAAY;AAC/C,eAAO,cAAc,KAAK,aAAW,UAAU,SAAS,OAAO,CAAC;AAAA,MAClE,CAAC;AAGD,YAAM,aAAa,MAAM,QAAQ,IAAI,YAAY;AACjD,UAAI;AAEJ,UAAI,wBAAwB,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5D,wBAAgB;AAAA,MAClB,WAAW,iBAAiB;AAC1B,wBAAgB;AAAA,MAClB,WAAW,sBAAsB,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AACjE,wBAAgB;AAAA,MAClB,OAAO;AACL,wBAAgB;AAAA,MAClB;AAGA,YAAM,gBAAgB,eAAe,OAAO,OAAK,EAAE,YAAY,cAAc,EAAE,YAAY,qBAAqB;AAChH,YAAM,YAAY,cAAc,OAAO,CAAC,KAAK,MAAM;AACjD,YAAI,EAAE,aAAa,QAAQ,EAAE,YAAY,IAAK,QAAO,EAAE;AACvD,eAAO;AAAA,MACT,GAAG,CAAC;AAEJ,cAAQ,KAAK;AAAA,QACX,OAAO,MAAM,QAAQ,MAAM;AAAA,QAC3B,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM,aAAa;AAAA,QAC7B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAGA,UAAM,eAAe,QAAQ,OAAO,OAAK,EAAE,kBAAkB,QAAQ,EAAE;AACvE,UAAM,sBAAsB,QAAQ;AAAA,MAClC,OAAK,EAAE,kBAAkB,mBAAmB,EAAE,kBAAkB;AAAA,IAClE,EAAE;AACF,UAAM,kBAAkB,QAAQ,OAAO,OAAK,EAAE,eAAe,SAAS,CAAC,EAAE;AAGzE,UAAM,gBAAgB,QACnB,OAAO,OAAK,EAAE,eAAe,SAAS,CAAC,EACvC,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;AAE3C,UAAM,YAAY,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;AAElE,WAAO;AAAA,MACL,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * KiroGraph-Sec Attack Surface Analyzer\n *\n * Maps all route nodes in the knowledge graph to their reachable vulnerable\n * dependencies, computing exposure levels and risk scores per route.\n */\n\nimport type { GraphDatabase } from '../db/database';\n\n/** Auth-related name patterns for heuristic isAuthenticated detection. */\nconst AUTH_PATTERNS = [\n  'auth',\n  'authenticate',\n  'middleware',\n  'guard',\n  'protect',\n  'requirelogin',\n  'isloggedin',\n  'verifytoken',\n  'checkauth',\n  'ensureauth',\n] as const;\n\n/** Route path patterns that indicate a public-facing API. */\nconst PUBLIC_ROUTE_PATTERNS = ['/api/', '/v1/', '/v2/', '/v3/', '/graphql', '/rest/'];\n\n/** Route path patterns that indicate an internal/admin route. */\nconst INTERNAL_ROUTE_PATTERNS = ['/internal/', '/admin/'];\n\nexport interface AttackSurfaceEntry {\n  route: string;\n  nodeId: string;\n  filePath: string;\n  isAuthenticated: boolean;\n  exposureLevel: 'public' | 'authenticated' | 'internal' | 'unknown';\n  vulnerableDeps: Array<{\n    cveId: string;\n    packageName: string;\n    severity: number | null;\n    epssScore: number | null;\n    riskScore: number | null;\n    verdict: string | null;\n    hopCount: number;\n  }>;\n  patternMatches: Array<{\n    patternId: string;\n    severity: string;\n    line: number;\n    symbolNodeId: string;\n    symbolName: string;\n  }>;\n  patternRiskLevel: 'none' | 'low' | 'medium' | 'high' | 'critical';\n  riskScore: number;\n}\n\nexport interface AttackSurfaceResult {\n  totalRoutes: number;\n  publicRoutes: number;\n  authenticatedRoutes: number;\n  routesWithVulns: number;\n  criticalPaths: AttackSurfaceEntry[];\n  allRoutes: AttackSurfaceEntry[];\n}\n\nexport class AttackSurfaceAnalyzer {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async analyze(): Promise<AttackSurfaceResult> {\n    const rawDb = this.db.getRawDb();\n\n    // Step 1: Query all route nodes\n    const routeRows: Array<{ id: string; name: string; file_path: string }> = rawDb.all(\n      `SELECT id, name, file_path FROM nodes WHERE kind = 'route'`,\n    );\n\n    if (routeRows.length === 0) {\n      return {\n        totalRoutes: 0,\n        publicRoutes: 0,\n        authenticatedRoutes: 0,\n        routesWithVulns: 0,\n        criticalPaths: [],\n        allRoutes: [],\n      };\n    }\n\n    const entries: AttackSurfaceEntry[] = [];\n\n    for (const route of routeRows) {\n      // Step 2: BFS via SQL to find reachable dependency nodes (max 5 hops)\n      const reachableDeps: Array<{\n        node_id: string;\n        package_name: string;\n        hop_count: number;\n      }> = rawDb.all(\n        `WITH RECURSIVE reachable(node_id, depth) AS (\n           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n           UNION\n           SELECT e.target, r.depth + 1\n           FROM edges e\n           JOIN reachable r ON e.source = r.node_id\n           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n         )\n         SELECT d.node_id, d.package_name, MIN(r.depth) as hop_count\n         FROM reachable r\n         JOIN sec_dependencies d ON d.node_id = r.node_id\n         GROUP BY d.node_id, d.package_name`,\n        [route.id],\n      );\n\n      // Step 3: For each reachable dep, find affected/under_investigation vulns\n      const vulnerableDeps: AttackSurfaceEntry['vulnerableDeps'] = [];\n\n      for (const dep of reachableDeps) {\n        const vulnRows: Array<{\n          cve_id: string;\n          package_name: string;\n          severity_score: number | null;\n          epss_score: number | null;\n          risk_score: number | null;\n          verdict: string | null;\n        }> = rawDb.all(\n          `SELECT v.cve_id, d.package_name, v.severity_score, v.epss_score, v.risk_score, r.verdict\n           FROM sec_vulnerabilities v\n           JOIN edges e ON e.target = v.node_id AND e.kind = 'has_vulnerability'\n           JOIN sec_dependencies d ON d.node_id = e.source\n           LEFT JOIN sec_reachability r ON r.vulnerability_node_id = v.node_id\n           WHERE d.node_id = ?\n             AND (r.verdict IN ('affected', 'under_investigation') OR r.verdict IS NULL)`,\n          [dep.node_id],\n        );\n\n        for (const vuln of vulnRows) {\n          vulnerableDeps.push({\n            cveId: vuln.cve_id,\n            packageName: vuln.package_name ?? dep.package_name,\n            severity: vuln.severity_score,\n            epssScore: vuln.epss_score,\n            riskScore: vuln.risk_score,\n            verdict: vuln.verdict,\n            hopCount: dep.hop_count,\n          });\n        }\n      }\n\n      // Step 3b: Find pattern matches on the call path (table may not exist)\n      const routeNodeId = route.id;\n      let patternRows: Array<{\n        symbol_node_id: string;\n        symbol_name: string;\n        pattern_id: string;\n        severity: string;\n        line: number;\n      }> = [];\n      try {\n        patternRows = rawDb.all(\n          `WITH RECURSIVE reachable(node_id, depth) AS (\n             SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n             UNION\n             SELECT e.target, r.depth + 1\n             FROM edges e\n             JOIN reachable r ON e.source = r.node_id\n             WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n           )\n           SELECT DISTINCT pm.symbol_node_id, n.name as symbol_name, pm.pattern_id, pm.severity, pm.line\n           FROM reachable r\n           JOIN pattern_matches pm ON pm.symbol_node_id = r.node_id\n           JOIN nodes n ON n.id = pm.symbol_node_id\n           WHERE pm.symbol_node_id IS NOT NULL\n           ORDER BY CASE pm.severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 ELSE 1 END DESC\n           LIMIT 10`,\n          [routeNodeId],\n        );\n      } catch {\n        // pattern_matches table does not exist yet \u2014 degrade silently\n        patternRows = [];\n      }\n\n      const patternMatches: AttackSurfaceEntry['patternMatches'] = patternRows.map(r => ({\n        patternId: r.pattern_id,\n        severity: r.severity,\n        line: r.line,\n        symbolNodeId: r.symbol_node_id,\n        symbolName: r.symbol_name,\n      }));\n\n      const patternRiskLevel: AttackSurfaceEntry['patternRiskLevel'] =\n        patternMatches.length === 0\n          ? 'none'\n          : (patternMatches[0].severity as AttackSurfaceEntry['patternRiskLevel']);\n\n      // Step 4: Heuristic \u2014 isAuthenticated via path node names\n      const pathNodeNames: Array<{ name: string }> = rawDb.all(\n        `WITH RECURSIVE reachable(node_id, depth) AS (\n           SELECT target, 1 FROM edges WHERE source = ? AND kind IN ('calls', 'imports', 'references')\n           UNION\n           SELECT e.target, r.depth + 1\n           FROM edges e\n           JOIN reachable r ON e.source = r.node_id\n           WHERE r.depth < 5 AND e.kind IN ('calls', 'imports', 'references')\n         )\n         SELECT DISTINCT n.name\n         FROM reachable r\n         JOIN nodes n ON n.id = r.node_id\n         WHERE n.name IS NOT NULL`,\n        [route.id],\n      );\n\n      const isAuthenticated = pathNodeNames.some(row => {\n        const lowerName = (row.name ?? '').toLowerCase();\n        return AUTH_PATTERNS.some(pattern => lowerName.includes(pattern));\n      });\n\n      // Step 5: Determine exposure level\n      const routeName = (route.name ?? '').toLowerCase();\n      let exposureLevel: AttackSurfaceEntry['exposureLevel'];\n\n      if (INTERNAL_ROUTE_PATTERNS.some(p => routeName.includes(p))) {\n        exposureLevel = 'internal';\n      } else if (isAuthenticated) {\n        exposureLevel = 'authenticated';\n      } else if (PUBLIC_ROUTE_PATTERNS.some(p => routeName.includes(p))) {\n        exposureLevel = 'public';\n      } else {\n        exposureLevel = 'unknown';\n      }\n\n      // Step 6: riskScore = max risk_score of reachable affected vulns, plus pattern bonus\n      const affectedVulns = vulnerableDeps.filter(v => v.verdict === 'affected' || v.verdict === 'under_investigation');\n      const baseRiskScore = affectedVulns.reduce((max, v) => {\n        if (v.riskScore != null && v.riskScore > max) return v.riskScore;\n        return max;\n      }, 0);\n\n      const patternBonus: Record<AttackSurfaceEntry['patternRiskLevel'], number> = {\n        none: 0, low: 0.3, medium: 0.6, high: 0.8, critical: 1.0,\n      };\n      const riskScore = Math.min(10, baseRiskScore + (patternBonus[patternRiskLevel] ?? 0));\n\n      entries.push({\n        route: route.name ?? route.id,\n        nodeId: route.id,\n        filePath: route.file_path ?? '',\n        isAuthenticated,\n        exposureLevel,\n        vulnerableDeps,\n        patternMatches,\n        patternRiskLevel,\n        riskScore,\n      });\n    }\n\n    // Compute summary stats\n    const publicRoutes = entries.filter(e => e.exposureLevel === 'public').length;\n    const authenticatedRoutes = entries.filter(\n      e => e.exposureLevel === 'authenticated' || e.exposureLevel === 'internal',\n    ).length;\n    const routesWithVulns = entries.filter(e => e.vulnerableDeps.length > 0).length;\n\n    // Critical paths: routes with affected/under_investigation vulns, sorted by riskScore desc\n    const criticalPaths = entries\n      .filter(e => e.vulnerableDeps.length > 0)\n      .sort((a, b) => b.riskScore - a.riskScore);\n\n    const allRoutes = entries.sort((a, b) => b.riskScore - a.riskScore);\n\n    return {\n      totalRoutes: entries.length,\n      publicRoutes,\n      authenticatedRoutes,\n      routesWithVulns,\n      criticalPaths,\n      allRoutes,\n    };\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,MAAM,wBAAwB,CAAC,SAAS,QAAQ,QAAQ,QAAQ,YAAY,QAAQ;AAGpF,MAAM,0BAA0B,CAAC,cAAc,SAAS;AAqCjD,MAAM,sBAAsB;AAAA,EACjC,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,UAAwC;AAC5C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAG/B,UAAM,YAAoE,MAAM;AAAA,MAC9E;AAAA,IACF;AAEA,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO;AAAA,QACL,aAAa;AAAA,QACb,cAAc;AAAA,QACd,qBAAqB;AAAA,QACrB,iBAAiB;AAAA,QACjB,eAAe,CAAC;AAAA,QAChB,WAAW,CAAC;AAAA,MACd;AAAA,IACF;AAEA,UAAM,UAAgC,CAAC;AAEvC,eAAW,SAAS,WAAW;AAE7B,YAAM,gBAID,MAAM;AAAA,QACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,MAAM,EAAE;AAAA,MACX;AAGA,YAAM,iBAAuD,CAAC;AAE9D,iBAAW,OAAO,eAAe;AAC/B,cAAM,WAOD,MAAM;AAAA,UACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAOA,CAAC,IAAI,OAAO;AAAA,QACd;AAEA,mBAAW,QAAQ,UAAU;AAC3B,yBAAe,KAAK;AAAA,YAClB,OAAO,KAAK;AAAA,YACZ,aAAa,KAAK,gBAAgB,IAAI;AAAA,YACtC,UAAU,KAAK;AAAA,YACf,WAAW,KAAK;AAAA,YAChB,WAAW,KAAK;AAAA,YAChB,SAAS,KAAK;AAAA,YACd,UAAU,IAAI;AAAA,UAChB,CAAC;AAAA,QACH;AAAA,MACF;AAGA,YAAM,cAAc,MAAM;AAC1B,UAAI,cAMC,CAAC;AACN,UAAI;AACF,sBAAc,MAAM;AAAA,UAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAeA,CAAC,WAAW;AAAA,QACd;AAAA,MACF,QAAQ;AAEN,sBAAc,CAAC;AAAA,MACjB;AAEA,YAAM,iBAAuD,YAAY,IAAI,QAAM;AAAA,QACjF,WAAW,EAAE;AAAA,QACb,UAAU,EAAE;AAAA,QACZ,MAAM,EAAE;AAAA,QACR,cAAc,EAAE;AAAA,QAChB,YAAY,EAAE;AAAA,MAChB,EAAE;AAEF,YAAM,mBACJ,eAAe,WAAW,IACtB,SACC,eAAe,CAAC,EAAE;AAGzB,YAAM,gBAAyC,MAAM;AAAA,QACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYA,CAAC,MAAM,EAAE;AAAA,MACX;AAEA,YAAM,kBAAkB,cAAc,KAAK,SAAO;AAChD,cAAM,aAAa,IAAI,QAAQ,IAAI,YAAY;AAC/C,eAAO,cAAc,KAAK,aAAW,UAAU,SAAS,OAAO,CAAC;AAAA,MAClE,CAAC;AAGD,YAAM,aAAa,MAAM,QAAQ,IAAI,YAAY;AACjD,UAAI;AAEJ,UAAI,wBAAwB,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5D,wBAAgB;AAAA,MAClB,WAAW,iBAAiB;AAC1B,wBAAgB;AAAA,MAClB,WAAW,sBAAsB,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AACjE,wBAAgB;AAAA,MAClB,OAAO;AACL,wBAAgB;AAAA,MAClB;AAGA,YAAM,gBAAgB,eAAe,OAAO,OAAK,EAAE,YAAY,cAAc,EAAE,YAAY,qBAAqB;AAChH,YAAM,gBAAgB,cAAc,OAAO,CAAC,KAAK,MAAM;AACrD,YAAI,EAAE,aAAa,QAAQ,EAAE,YAAY,IAAK,QAAO,EAAE;AACvD,eAAO;AAAA,MACT,GAAG,CAAC;AAEJ,YAAM,eAAuE;AAAA,QAC3E,MAAM;AAAA,QAAG,KAAK;AAAA,QAAK,QAAQ;AAAA,QAAK,MAAM;AAAA,QAAK,UAAU;AAAA,MACvD;AACA,YAAM,YAAY,KAAK,IAAI,IAAI,iBAAiB,aAAa,gBAAgB,KAAK,EAAE;AAEpF,cAAQ,KAAK;AAAA,QACX,OAAO,MAAM,QAAQ,MAAM;AAAA,QAC3B,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM,aAAa;AAAA,QAC7B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAGA,UAAM,eAAe,QAAQ,OAAO,OAAK,EAAE,kBAAkB,QAAQ,EAAE;AACvE,UAAM,sBAAsB,QAAQ;AAAA,MAClC,OAAK,EAAE,kBAAkB,mBAAmB,EAAE,kBAAkB;AAAA,IAClE,EAAE;AACF,UAAM,kBAAkB,QAAQ,OAAO,OAAK,EAAE,eAAe,SAAS,CAAC,EAAE;AAGzE,UAAM,gBAAgB,QACnB,OAAO,OAAK,EAAE,eAAe,SAAS,CAAC,EACvC,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;AAE3C,UAAM,YAAY,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;AAElE,WAAO;AAAA,MACL,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/security/context-warnings.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Security Context Warnings
+ *
+ * Queries pre-computed reachability data to find vulnerabilities
+ * reachable from symbols included in a context response.
+ * Used by kirograph_context to append security warnings.
+ */
+export interface SecurityWarning {
+    cveId: string;
+    severityScore: number | null;
+    epssScore: number | null;
+    epssPercentile: number | null;
+    packageName: string;
+    ecosystem: string;
+    fixedVersion: string | null;
+    entryPoints: string[];
+}
+/**
+ * Query the pre-computed reachability data to find vulnerabilities
+ * reachable from the given node IDs.
+ *
+ * This is a lightweight query joining sec_reachability + sec_vulnerabilities + sec_dependencies
+ * where the reachability paths include any of the context nodes. No graph traversal needed
+ * since reachability is pre-computed by the SecurityPipeline.
+ *
+ * @param rawDb - The raw SQLite database handle
+ * @param nodeIds - Node IDs from the context response (entry points + related symbols)
+ * @returns Array of SecurityWarning objects for affected vulnerabilities
+ */
+export declare function getSecurityWarningsForNodes(rawDb: any, nodeIds: string[]): SecurityWarning[];
+/**
+ * Format security warnings into a text section for the context output.
+ * Shows max 3 vulnerabilities with a note about remaining ones.
+ *
+ * @param warnings - Array of SecurityWarning objects
+ * @param nodeNames - Map of node IDs to human-readable names (for entry point display)
+ * @returns Formatted string section, or empty string if no warnings
+ */
+export declare function formatSecurityWarnings(warnings: SecurityWarning[], nodeNames: Map<string, string>): string;
+//# sourceMappingURL=context-warnings.d.ts.map

package/dist/security/context-warnings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-warnings.d.ts","sourceRoot":"","sources":["../../src/security/context-warnings.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,CA6F5F;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAmC1G"}

package/dist/security/data-flows.d.ts

@@ -0,0 +1,33 @@
+/**
+ * KiroGraph SAST-lite: Dangerous Data Flow Detection
+ *
+ * Detects dangerous patterns by analysing call edges in the graph database.
+ * Uses symbol names and callee chains rather than full AST traversal.
+ */
+import type { GraphDatabase } from '../db/database';
+import type { OwaspCategory } from './owasp';
+export interface DataFlowFinding {
+    type: 'sql-injection' | 'path-traversal' | 'xss' | 'dangerous-eval' | 'unsafe-deserialize' | 'hardcoded-crypto';
+    severity: 'critical' | 'high' | 'medium';
+    owaspCategory: OwaspCategory;
+    filePath: string;
+    line: number;
+    symbol: string;
+    description: string;
+    recommendation: string;
+}
+export declare class DataFlowAnalyzer {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    analyze(): Promise<DataFlowFinding[]>;
+    private analyzeFromPatternMatches;
+    private _patternIdToType;
+    private _findEnclosingSymbol;
+    private _getRecommendation;
+    private _detectDangerousEval;
+    private _detectUnsafeDeserialize;
+    private _detectHardcodedCrypto;
+    private _detectSqlInjection;
+    private _detectPathTraversal;
+}
+//# sourceMappingURL=data-flows.d.ts.map

package/dist/security/data-flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-flows.d.ts","sourceRoot":"","sources":["../../src/security/data-flows.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAI7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,eAAe,GAAG,gBAAgB,GAAG,KAAK,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;IAChH,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAyBD,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,OAAO,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAwB3C,OAAO,CAAC,yBAAyB;IA8BjC,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,oBAAoB;IAyB5B,OAAO,CAAC,wBAAwB;IA8BhC,OAAO,CAAC,sBAAsB;IA0C9B,OAAO,CAAC,mBAAmB;IAoE3B,OAAO,CAAC,oBAAoB;CA8C7B"}

package/dist/security/data-flows.js

@@ -21,19 +21,77 @@ __export(data_flows_exports, {
   DataFlowAnalyzer: () => DataFlowAnalyzer
 });
 module.exports = __toCommonJS(data_flows_exports);
+function hasPatternsData(rawDb) {
+  try {
+    const result = rawDb.get("SELECT COUNT(*) as cnt FROM pattern_matches");
+    return (result?.cnt ?? 0) > 0;
+  } catch {
+    return false;
+  }
+}
 class DataFlowAnalyzer {
   constructor(db) {
     this.db = db;
   }
   async analyze() {
     const rawDb = this.db.getRawDb();
-    const findings = [];
-    findings.push(...this._detectDangerousEval(rawDb));
-    findings.push(...this._detectUnsafeDeserialize(rawDb));
-    findings.push(...this._detectHardcodedCrypto(rawDb));
-    findings.push(...this._detectSqlInjection(rawDb));
-    findings.push(...this._detectPathTraversal(rawDb));
-    return findings;
+    const sqlFindings = [
+      ...this._detectDangerousEval(rawDb),
+      ...this._detectUnsafeDeserialize(rawDb),
+      ...this._detectHardcodedCrypto(rawDb),
+      ...this._detectSqlInjection(rawDb),
+      ...this._detectPathTraversal(rawDb)
+    ];
+    if (hasPatternsData(rawDb)) {
+      const astFindings = this.analyzeFromPatternMatches(rawDb);
+      const astKeys = new Set(astFindings.map((f) => `${f.filePath}:${f.line}`));
+      const filteredSql = sqlFindings.filter((f) => !astKeys.has(`${f.filePath}:${f.line}`));
+      return [...astFindings, ...filteredSql];
+    }
+    return sqlFindings;
+  }
+  analyzeFromPatternMatches(rawDb) {
+    const rows = rawDb.all("SELECT file_path, pattern_id, line, col, match_text, severity, owasp_category, language FROM pattern_matches");
+    return rows.map((row) => {
+      const type = this._patternIdToType(row.pattern_id);
+      const symbol = this._findEnclosingSymbol(rawDb, row.file_path, row.line);
+      return {
+        type,
+        severity: row.severity,
+        owaspCategory: row.owasp_category,
+        filePath: row.file_path,
+        line: row.line,
+        symbol: symbol ?? row.pattern_id,
+        description: `[AST pattern: ${row.pattern_id}] ${row.match_text.slice(0, 100)}`,
+        recommendation: this._getRecommendation(type)
+      };
+    });
+  }
+  _patternIdToType(patternId) {
+    if (patternId.startsWith("sql-injection")) return "sql-injection";
+    if (patternId.startsWith("dangerous-eval") || patternId.startsWith("dangerous-exec")) return "dangerous-eval";
+    if (patternId.startsWith("path-traversal")) return "path-traversal";
+    if (patternId.startsWith("prototype-pollution")) return "unsafe-deserialize";
+    if (patternId.startsWith("weak-crypto")) return "hardcoded-crypto";
+    return "dangerous-eval";
+  }
+  _findEnclosingSymbol(rawDb, filePath, line) {
+    const row = rawDb.get(
+      `SELECT name FROM nodes WHERE file_path = ? AND start_line <= ? AND end_line >= ? AND kind IN ('function', 'method', 'class') ORDER BY (end_line - start_line) ASC LIMIT 1`,
+      [filePath, line, line]
+    );
+    return row?.name ?? null;
+  }
+  _getRecommendation(type) {
+    const recs = {
+      "sql-injection": "Use parameterized queries. Never concatenate user input into SQL strings.",
+      "dangerous-eval": "Remove eval()/exec(). Use structured alternatives.",
+      "path-traversal": "Use path.resolve() and verify result is within an allowed base directory.",
+      "unsafe-deserialize": "Validate object keys before merge. Avoid untrusted deserialization.",
+      "hardcoded-crypto": "Use SHA-256+ for hashing. Use bcrypt/argon2 for passwords.",
+      "xss": "Sanitize output. Use a trusted template engine with auto-escaping."
+    };
+    return recs[type] ?? "Review and fix this security issue.";
   }
   // ── Detection: dangerous eval / exec ────────────────────────────────────────
   _detectDangerousEval(rawDb) {

package/dist/security/data-flows.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/security/data-flows.ts"],
-  "sourcesContent": ["/**\n * KiroGraph SAST-lite: Dangerous Data Flow Detection\n *\n * Detects dangerous patterns by analysing call edges in the graph database.\n * Uses symbol names and callee chains rather than full AST traversal.\n */\n\nimport type { GraphDatabase } from '../db/database';\nimport type { OwaspCategory } from './owasp';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface DataFlowFinding {\n  type: 'sql-injection' | 'path-traversal' | 'xss' | 'dangerous-eval' | 'unsafe-deserialize' | 'hardcoded-crypto';\n  severity: 'critical' | 'high' | 'medium';\n  owaspCategory: OwaspCategory;\n  filePath: string;\n  line: number;\n  symbol: string;\n  description: string;\n  recommendation: string;\n}\n\n// \u2500\u2500 Internal row type returned by the DB queries \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface CallEdgeRow {\n  caller: string;\n  file_path: string;\n  start_line: number;\n  callee: string;\n}\n\n// \u2500\u2500 DataFlowAnalyzer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class DataFlowAnalyzer {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async analyze(): Promise<DataFlowFinding[]> {\n    const rawDb = this.db.getRawDb();\n    const findings: DataFlowFinding[] = [];\n\n    findings.push(...this._detectDangerousEval(rawDb));\n    findings.push(...this._detectUnsafeDeserialize(rawDb));\n    findings.push(...this._detectHardcodedCrypto(rawDb));\n    findings.push(...this._detectSqlInjection(rawDb));\n    findings.push(...this._detectPathTraversal(rawDb));\n\n    return findings;\n  }\n\n  // \u2500\u2500 Detection: dangerous eval / exec \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectDangerousEval(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('eval', 'Function', 'execSync', 'exec', 'spawn', 'spawnSync', 'execFileSync', 'execFile')\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'dangerous-eval' as const,\n      severity: 'critical' as const,\n      owaspCategory: 'A03' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which can execute arbitrary code or OS commands.`,\n      recommendation: `Avoid '${row.callee}'. Use structured APIs or allowlists for dynamic execution. Validate and sanitize all inputs.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: unsafe deserialization \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectUnsafeDeserialize(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name IN ('unserialize', 'deserialize', 'fromJson', 'loads')\n          OR n2.name LIKE '%pickle%'\n          OR n2.name LIKE '%marshal%'\n          OR n2.name = 'yaml.load'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'unsafe-deserialize' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A08' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which may deserialize untrusted data unsafely.`,\n      recommendation: `Validate data before deserialization. Use safe alternatives (e.g. yaml.safe_load, JSON schema validation). Never deserialize data from untrusted sources.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: hardcoded weak crypto \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectHardcodedCrypto(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name LIKE '%md5%'\n          OR n2.name LIKE '%sha1%'\n          OR n2.name LIKE '%des%'\n          OR n2.name LIKE '%rc4%'\n          OR n2.name LIKE '%blowfish%'\n        )\n        AND (\n          n.name LIKE '%crypto%'\n          OR n.name LIKE '%hash%'\n          OR n.name LIKE '%cipher%'\n          OR n.name LIKE '%encrypt%'\n          OR n.name LIKE '%digest%'\n          OR n.file_path LIKE '%crypto%'\n          OR n.file_path LIKE '%hash%'\n          OR n.file_path LIKE '%cipher%'\n          OR n.file_path LIKE '%auth%'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'hardcoded-crypto' as const,\n      severity: 'medium' as const,\n      owaspCategory: 'A02' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' uses weak or deprecated cryptographic algorithm '${row.callee}'.`,\n      recommendation: `Replace with a strong algorithm: SHA-256 or SHA-3 for hashing, AES-256-GCM for symmetric encryption. Avoid MD5 and SHA-1 for security purposes.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: SQL injection \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectSqlInjection(rawDb: any): DataFlowFinding[] {\n    // Find functions that:\n    //  (a) call a known DB query function\n    //  (b) AND whose name suggests user-input handling (controller/route/request context)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('query', 'execute', 'exec', 'raw', 'runQuery', 'executeQuery', 'runSql', 'executeSql')\n        AND (\n          n.name LIKE '%handle%'\n          OR n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%req%'\n          OR n.name LIKE '%endpoint%'\n          OR n.name LIKE '%action%'\n          OR n.name LIKE '%handler%'\n        )\n        AND n.file_path != ''\n    `);\n\n    // Only report entries that do NOT also have a sanitize/escape call in the same scope\n    const sanitizeCallers: Set<string> = new Set<string>(\n      (rawDb.all(`\n        SELECT DISTINCT n.id\n        FROM edges e\n        JOIN nodes n  ON n.id  = e.source\n        JOIN nodes n2 ON n2.id = e.target\n        WHERE e.kind = 'calls'\n          AND (\n            n2.name LIKE '%sanitize%'\n            OR n2.name LIKE '%escape%'\n            OR n2.name LIKE '%parameteriz%'\n            OR n2.name LIKE '%prepared%'\n            OR n2.name LIKE '%placeholder%'\n          )\n      `) as Array<{ id: string }>).map((r) => r.id),\n    );\n\n    // Cross-reference: look up caller node IDs to filter sanitized callers\n    const callerIds: Map<string, string> = new Map(\n      (rawDb.all(`\n        SELECT id, name FROM nodes WHERE kind IN ('function', 'method', 'arrow_function')\n      `) as Array<{ id: string; name: string }>).map((r) => [r.name, r.id]),\n    );\n\n    return rows\n      .filter((row) => {\n        const callerId = callerIds.get(row.caller);\n        return !callerId || !sanitizeCallers.has(callerId);\n      })\n      .map((row) => ({\n        type: 'sql-injection' as const,\n        severity: 'critical' as const,\n        owaspCategory: 'A03' as const,\n        filePath: row.file_path,\n        line: row.start_line,\n        symbol: row.caller,\n        description: `Controller/handler '${row.caller}' calls database function '${row.callee}' without apparent input sanitization.`,\n        recommendation: `Use parameterized queries or prepared statements. Never concatenate user input into SQL strings. Consider an ORM with query builders.`,\n      }));\n  }\n\n  // \u2500\u2500 Detection: path traversal \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectPathTraversal(rawDb: any): DataFlowFinding[] {\n    // Find functions that call file I/O operations and look like they handle requests.\n    // Exclusions:\n    //   - Internal analysis/infrastructure paths (mcp, resolution, security, extraction, graph, architecture)\n    //   - 'open' is excluded from file ops because KiroGraph.open() (DB) triggers false positives\n    //   - Class names ending in 'Handler' or 'Server' are excluded (too broad \u2014 use more specific patterns)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('readFile', 'readFileSync', 'writeFile', 'writeFileSync', 'createReadStream', 'createWriteStream', 'openSync', 'unlink', 'unlinkSync')\n        AND (\n          n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%download%'\n          OR n.name LIKE '%upload%'\n          OR n.name LIKE '%get%file%'\n          OR n.name LIKE '%fetch%file%'\n          OR n.name LIKE '%serve%file%'\n          OR n.name LIKE '%handle%file%'\n        )\n        AND n.file_path != ''\n        AND n.file_path NOT LIKE '%/mcp/%'\n        AND n.file_path NOT LIKE '%/resolution/%'\n        AND n.file_path NOT LIKE '%/security/%'\n        AND n.file_path NOT LIKE '%/extraction/%'\n        AND n.file_path NOT LIKE '%/graph/%'\n        AND n.file_path NOT LIKE '%/architecture/%'\n        AND n.file_path NOT LIKE '%/frameworks/%'\n        AND n.file_path NOT LIKE '%/bridges/%'\n    `);\n\n    return rows.map((row) => ({\n      type: 'path-traversal' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A01' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Handler '${row.caller}' calls file operation '${row.callee}'. Path may be influenced by user input, enabling directory traversal.`,\n      recommendation: `Validate and normalize file paths. Use path.resolve() and verify the result is inside an allowed base directory. Reject paths containing '..'.`,\n    }));\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCO,MAAM,iBAAiB;AAAA,EAC5B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,UAAsC;AAC1C,UAAM,QAAQ,KAAK,GAAG,SAAS;AAC/B,UAAM,WAA8B,CAAC;AAErC,aAAS,KAAK,GAAG,KAAK,qBAAqB,KAAK,CAAC;AACjD,aAAS,KAAK,GAAG,KAAK,yBAAyB,KAAK,CAAC;AACrD,aAAS,KAAK,GAAG,KAAK,uBAAuB,KAAK,CAAC;AACnD,aAAS,KAAK,GAAG,KAAK,oBAAoB,KAAK,CAAC;AAChD,aAAS,KAAK,GAAG,KAAK,qBAAqB,KAAK,CAAC;AAEjD,WAAO;AAAA,EACT;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAC1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAQrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB,UAAU,IAAI,MAAM;AAAA,IACtC,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,yBAAyB,OAA+B;AAC9D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAarC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,uBAAuB,OAA+B;AAC5D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAyBrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,sDAAsD,IAAI,MAAM;AAAA,MACpG,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,oBAAoB,OAA+B;AAIzD,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAkBrC;AAGD,UAAM,kBAA+B,IAAI;AAAA,MACtC,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAaV,EAA4B,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9C;AAGA,UAAM,YAAiC,IAAI;AAAA,MACxC,MAAM,IAAI;AAAA;AAAA,OAEV,EAA0C,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;AAAA,IACtE;AAEA,WAAO,KACJ,OAAO,CAAC,QAAQ;AACf,YAAM,WAAW,UAAU,IAAI,IAAI,MAAM;AACzC,aAAO,CAAC,YAAY,CAAC,gBAAgB,IAAI,QAAQ;AAAA,IACnD,CAAC,EACA,IAAI,CAAC,SAAS;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,uBAAuB,IAAI,MAAM,8BAA8B,IAAI,MAAM;AAAA,MACtF,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACN;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAM1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KA2BrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,YAAY,IAAI,MAAM,2BAA2B,IAAI,MAAM;AAAA,MACxE,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AACF;",
+  "sourcesContent": ["/**\n * KiroGraph SAST-lite: Dangerous Data Flow Detection\n *\n * Detects dangerous patterns by analysing call edges in the graph database.\n * Uses symbol names and callee chains rather than full AST traversal.\n */\n\nimport type { GraphDatabase } from '../db/database';\nimport type { OwaspCategory } from './owasp';\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface DataFlowFinding {\n  type: 'sql-injection' | 'path-traversal' | 'xss' | 'dangerous-eval' | 'unsafe-deserialize' | 'hardcoded-crypto';\n  severity: 'critical' | 'high' | 'medium';\n  owaspCategory: OwaspCategory;\n  filePath: string;\n  line: number;\n  symbol: string;\n  description: string;\n  recommendation: string;\n}\n\n// \u2500\u2500 Internal row type returned by the DB queries \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface CallEdgeRow {\n  caller: string;\n  file_path: string;\n  start_line: number;\n  callee: string;\n}\n\n// \u2500\u2500 hasPatternsData helper \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nfunction hasPatternsData(rawDb: any): boolean {\n  try {\n    const result = rawDb.get(\"SELECT COUNT(*) as cnt FROM pattern_matches\") as { cnt: number } | undefined;\n    return (result?.cnt ?? 0) > 0;\n  } catch {\n    // Table doesn't exist (enablePatterns never ran)\n    return false;\n  }\n}\n\n// \u2500\u2500 DataFlowAnalyzer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class DataFlowAnalyzer {\n  constructor(private readonly db: GraphDatabase) {}\n\n  async analyze(): Promise<DataFlowFinding[]> {\n    const rawDb = (this.db as any).getRawDb();\n\n    // Always run existing SQL heuristics (unchanged behavior)\n    const sqlFindings = [\n      ...this._detectDangerousEval(rawDb),\n      ...this._detectUnsafeDeserialize(rawDb),\n      ...this._detectHardcodedCrypto(rawDb),\n      ...this._detectSqlInjection(rawDb),\n      ...this._detectPathTraversal(rawDb),\n    ];\n\n    // When pattern_matches has data, merge AST findings (more precise)\n    if (hasPatternsData(rawDb)) {\n      const astFindings = this.analyzeFromPatternMatches(rawDb);\n      // Deduplicate: AST entry wins over SQL entry at same (filePath, line)\n      const astKeys = new Set(astFindings.map(f => `${f.filePath}:${f.line}`));\n      const filteredSql = sqlFindings.filter(f => !astKeys.has(`${f.filePath}:${f.line}`));\n      return [...astFindings, ...filteredSql];\n    }\n\n    return sqlFindings;\n  }\n\n  private analyzeFromPatternMatches(rawDb: any): DataFlowFinding[] {\n    const rows: Array<{\n      file_path: string;\n      pattern_id: string;\n      line: number;\n      col: number;\n      match_text: string;\n      severity: string;\n      owasp_category: string;\n      language: string;\n    }> = rawDb.all('SELECT file_path, pattern_id, line, col, match_text, severity, owasp_category, language FROM pattern_matches');\n\n    return rows.map(row => {\n      // Map pattern_id prefix to DataFlowFinding type\n      const type = this._patternIdToType(row.pattern_id);\n      // Look up nearest enclosing symbol\n      const symbol = this._findEnclosingSymbol(rawDb, row.file_path, row.line);\n      return {\n        type,\n        severity: row.severity as DataFlowFinding['severity'],\n        owaspCategory: row.owasp_category as DataFlowFinding['owaspCategory'],\n        filePath: row.file_path,\n        line: row.line,\n        symbol: symbol ?? row.pattern_id,\n        description: `[AST pattern: ${row.pattern_id}] ${row.match_text.slice(0, 100)}`,\n        recommendation: this._getRecommendation(type),\n      };\n    });\n  }\n\n  private _patternIdToType(patternId: string): DataFlowFinding['type'] {\n    if (patternId.startsWith('sql-injection')) return 'sql-injection';\n    if (patternId.startsWith('dangerous-eval') || patternId.startsWith('dangerous-exec')) return 'dangerous-eval';\n    if (patternId.startsWith('path-traversal')) return 'path-traversal';\n    if (patternId.startsWith('prototype-pollution')) return 'unsafe-deserialize';\n    if (patternId.startsWith('weak-crypto')) return 'hardcoded-crypto';\n    return 'dangerous-eval'; // fallback\n  }\n\n  private _findEnclosingSymbol(rawDb: any, filePath: string, line: number): string | null {\n    const row = rawDb.get(\n      `SELECT name FROM nodes WHERE file_path = ? AND start_line <= ? AND end_line >= ? AND kind IN ('function', 'method', 'class') ORDER BY (end_line - start_line) ASC LIMIT 1`,\n      [filePath, line, line]\n    ) as { name: string } | undefined;\n    return row?.name ?? null;\n  }\n\n  private _getRecommendation(type: DataFlowFinding['type']): string {\n    const recs: Record<DataFlowFinding['type'], string> = {\n      'sql-injection': 'Use parameterized queries. Never concatenate user input into SQL strings.',\n      'dangerous-eval': 'Remove eval()/exec(). Use structured alternatives.',\n      'path-traversal': 'Use path.resolve() and verify result is within an allowed base directory.',\n      'unsafe-deserialize': 'Validate object keys before merge. Avoid untrusted deserialization.',\n      'hardcoded-crypto': 'Use SHA-256+ for hashing. Use bcrypt/argon2 for passwords.',\n      'xss': 'Sanitize output. Use a trusted template engine with auto-escaping.',\n    };\n    return recs[type] ?? 'Review and fix this security issue.';\n  }\n\n  // \u2500\u2500 Detection: dangerous eval / exec \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectDangerousEval(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('eval', 'Function', 'execSync', 'exec', 'spawn', 'spawnSync', 'execFileSync', 'execFile')\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'dangerous-eval' as const,\n      severity: 'critical' as const,\n      owaspCategory: 'A03' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which can execute arbitrary code or OS commands.`,\n      recommendation: `Avoid '${row.callee}'. Use structured APIs or allowlists for dynamic execution. Validate and sanitize all inputs.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: unsafe deserialization \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectUnsafeDeserialize(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name IN ('unserialize', 'deserialize', 'fromJson', 'loads')\n          OR n2.name LIKE '%pickle%'\n          OR n2.name LIKE '%marshal%'\n          OR n2.name = 'yaml.load'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'unsafe-deserialize' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A08' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' calls '${row.callee}', which may deserialize untrusted data unsafely.`,\n      recommendation: `Validate data before deserialization. Use safe alternatives (e.g. yaml.safe_load, JSON schema validation). Never deserialize data from untrusted sources.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: hardcoded weak crypto \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectHardcodedCrypto(rawDb: any): DataFlowFinding[] {\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND (\n          n2.name LIKE '%md5%'\n          OR n2.name LIKE '%sha1%'\n          OR n2.name LIKE '%des%'\n          OR n2.name LIKE '%rc4%'\n          OR n2.name LIKE '%blowfish%'\n        )\n        AND (\n          n.name LIKE '%crypto%'\n          OR n.name LIKE '%hash%'\n          OR n.name LIKE '%cipher%'\n          OR n.name LIKE '%encrypt%'\n          OR n.name LIKE '%digest%'\n          OR n.file_path LIKE '%crypto%'\n          OR n.file_path LIKE '%hash%'\n          OR n.file_path LIKE '%cipher%'\n          OR n.file_path LIKE '%auth%'\n        )\n        AND n.file_path != ''\n    `);\n\n    return rows.map((row) => ({\n      type: 'hardcoded-crypto' as const,\n      severity: 'medium' as const,\n      owaspCategory: 'A02' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Function '${row.caller}' uses weak or deprecated cryptographic algorithm '${row.callee}'.`,\n      recommendation: `Replace with a strong algorithm: SHA-256 or SHA-3 for hashing, AES-256-GCM for symmetric encryption. Avoid MD5 and SHA-1 for security purposes.`,\n    }));\n  }\n\n  // \u2500\u2500 Detection: SQL injection \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectSqlInjection(rawDb: any): DataFlowFinding[] {\n    // Find functions that:\n    //  (a) call a known DB query function\n    //  (b) AND whose name suggests user-input handling (controller/route/request context)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('query', 'execute', 'exec', 'raw', 'runQuery', 'executeQuery', 'runSql', 'executeSql')\n        AND (\n          n.name LIKE '%handle%'\n          OR n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%req%'\n          OR n.name LIKE '%endpoint%'\n          OR n.name LIKE '%action%'\n          OR n.name LIKE '%handler%'\n        )\n        AND n.file_path != ''\n    `);\n\n    // Only report entries that do NOT also have a sanitize/escape call in the same scope\n    const sanitizeCallers: Set<string> = new Set<string>(\n      (rawDb.all(`\n        SELECT DISTINCT n.id\n        FROM edges e\n        JOIN nodes n  ON n.id  = e.source\n        JOIN nodes n2 ON n2.id = e.target\n        WHERE e.kind = 'calls'\n          AND (\n            n2.name LIKE '%sanitize%'\n            OR n2.name LIKE '%escape%'\n            OR n2.name LIKE '%parameteriz%'\n            OR n2.name LIKE '%prepared%'\n            OR n2.name LIKE '%placeholder%'\n          )\n      `) as Array<{ id: string }>).map((r) => r.id),\n    );\n\n    // Cross-reference: look up caller node IDs to filter sanitized callers\n    const callerIds: Map<string, string> = new Map(\n      (rawDb.all(`\n        SELECT id, name FROM nodes WHERE kind IN ('function', 'method', 'arrow_function')\n      `) as Array<{ id: string; name: string }>).map((r) => [r.name, r.id]),\n    );\n\n    return rows\n      .filter((row) => {\n        const callerId = callerIds.get(row.caller);\n        return !callerId || !sanitizeCallers.has(callerId);\n      })\n      .map((row) => ({\n        type: 'sql-injection' as const,\n        severity: 'critical' as const,\n        owaspCategory: 'A03' as const,\n        filePath: row.file_path,\n        line: row.start_line,\n        symbol: row.caller,\n        description: `Controller/handler '${row.caller}' calls database function '${row.callee}' without apparent input sanitization.`,\n        recommendation: `Use parameterized queries or prepared statements. Never concatenate user input into SQL strings. Consider an ORM with query builders.`,\n      }));\n  }\n\n  // \u2500\u2500 Detection: path traversal \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  private _detectPathTraversal(rawDb: any): DataFlowFinding[] {\n    // Find functions that call file I/O operations and look like they handle requests.\n    // Exclusions:\n    //   - Internal analysis/infrastructure paths (mcp, resolution, security, extraction, graph, architecture)\n    //   - 'open' is excluded from file ops because KiroGraph.open() (DB) triggers false positives\n    //   - Class names ending in 'Handler' or 'Server' are excluded (too broad \u2014 use more specific patterns)\n    const rows: CallEdgeRow[] = rawDb.all(`\n      SELECT n.name as caller, n.file_path, n.start_line, n2.name as callee\n      FROM edges e\n      JOIN nodes n  ON n.id  = e.source\n      JOIN nodes n2 ON n2.id = e.target\n      WHERE e.kind = 'calls'\n        AND n2.name IN ('readFile', 'readFileSync', 'writeFile', 'writeFileSync', 'createReadStream', 'createWriteStream', 'openSync', 'unlink', 'unlinkSync')\n        AND (\n          n.name LIKE '%controller%'\n          OR n.name LIKE '%route%'\n          OR n.name LIKE '%request%'\n          OR n.name LIKE '%download%'\n          OR n.name LIKE '%upload%'\n          OR n.name LIKE '%get%file%'\n          OR n.name LIKE '%fetch%file%'\n          OR n.name LIKE '%serve%file%'\n          OR n.name LIKE '%handle%file%'\n        )\n        AND n.file_path != ''\n        AND n.file_path NOT LIKE '%/mcp/%'\n        AND n.file_path NOT LIKE '%/resolution/%'\n        AND n.file_path NOT LIKE '%/security/%'\n        AND n.file_path NOT LIKE '%/extraction/%'\n        AND n.file_path NOT LIKE '%/graph/%'\n        AND n.file_path NOT LIKE '%/architecture/%'\n        AND n.file_path NOT LIKE '%/frameworks/%'\n        AND n.file_path NOT LIKE '%/bridges/%'\n    `);\n\n    return rows.map((row) => ({\n      type: 'path-traversal' as const,\n      severity: 'high' as const,\n      owaspCategory: 'A01' as const,\n      filePath: row.file_path,\n      line: row.start_line,\n      symbol: row.caller,\n      description: `Handler '${row.caller}' calls file operation '${row.callee}'. Path may be influenced by user input, enabling directory traversal.`,\n      recommendation: `Validate and normalize file paths. Use path.resolve() and verify the result is inside an allowed base directory. Reject paths containing '..'.`,\n    }));\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCA,SAAS,gBAAgB,OAAqB;AAC5C,MAAI;AACF,UAAM,SAAS,MAAM,IAAI,6CAA6C;AACtE,YAAQ,QAAQ,OAAO,KAAK;AAAA,EAC9B,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAIO,MAAM,iBAAiB;AAAA,EAC5B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,UAAsC;AAC1C,UAAM,QAAS,KAAK,GAAW,SAAS;AAGxC,UAAM,cAAc;AAAA,MAClB,GAAG,KAAK,qBAAqB,KAAK;AAAA,MAClC,GAAG,KAAK,yBAAyB,KAAK;AAAA,MACtC,GAAG,KAAK,uBAAuB,KAAK;AAAA,MACpC,GAAG,KAAK,oBAAoB,KAAK;AAAA,MACjC,GAAG,KAAK,qBAAqB,KAAK;AAAA,IACpC;AAGA,QAAI,gBAAgB,KAAK,GAAG;AAC1B,YAAM,cAAc,KAAK,0BAA0B,KAAK;AAExD,YAAM,UAAU,IAAI,IAAI,YAAY,IAAI,OAAK,GAAG,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE,CAAC;AACvE,YAAM,cAAc,YAAY,OAAO,OAAK,CAAC,QAAQ,IAAI,GAAG,EAAE,QAAQ,IAAI,EAAE,IAAI,EAAE,CAAC;AACnF,aAAO,CAAC,GAAG,aAAa,GAAG,WAAW;AAAA,IACxC;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,0BAA0B,OAA+B;AAC/D,UAAM,OASD,MAAM,IAAI,8GAA8G;AAE7H,WAAO,KAAK,IAAI,SAAO;AAErB,YAAM,OAAO,KAAK,iBAAiB,IAAI,UAAU;AAEjD,YAAM,SAAS,KAAK,qBAAqB,OAAO,IAAI,WAAW,IAAI,IAAI;AACvE,aAAO;AAAA,QACL;AAAA,QACA,UAAU,IAAI;AAAA,QACd,eAAe,IAAI;AAAA,QACnB,UAAU,IAAI;AAAA,QACd,MAAM,IAAI;AAAA,QACV,QAAQ,UAAU,IAAI;AAAA,QACtB,aAAa,iBAAiB,IAAI,UAAU,KAAK,IAAI,WAAW,MAAM,GAAG,GAAG,CAAC;AAAA,QAC7E,gBAAgB,KAAK,mBAAmB,IAAI;AAAA,MAC9C;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEQ,iBAAiB,WAA4C;AACnE,QAAI,UAAU,WAAW,eAAe,EAAG,QAAO;AAClD,QAAI,UAAU,WAAW,gBAAgB,KAAK,UAAU,WAAW,gBAAgB,EAAG,QAAO;AAC7F,QAAI,UAAU,WAAW,gBAAgB,EAAG,QAAO;AACnD,QAAI,UAAU,WAAW,qBAAqB,EAAG,QAAO;AACxD,QAAI,UAAU,WAAW,aAAa,EAAG,QAAO;AAChD,WAAO;AAAA,EACT;AAAA,EAEQ,qBAAqB,OAAY,UAAkB,MAA6B;AACtF,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA,CAAC,UAAU,MAAM,IAAI;AAAA,IACvB;AACA,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA,EAEQ,mBAAmB,MAAuC;AAChE,UAAM,OAAgD;AAAA,MACpD,iBAAiB;AAAA,MACjB,kBAAkB;AAAA,MAClB,kBAAkB;AAAA,MAClB,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,MACpB,OAAO;AAAA,IACT;AACA,WAAO,KAAK,IAAI,KAAK;AAAA,EACvB;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAC1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAQrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB,UAAU,IAAI,MAAM;AAAA,IACtC,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,yBAAyB,OAA+B;AAC9D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAarC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,YAAY,IAAI,MAAM;AAAA,MAC1D,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,uBAAuB,OAA+B;AAC5D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAyBrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,aAAa,IAAI,MAAM,sDAAsD,IAAI,MAAM;AAAA,MACpG,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA,EAIQ,oBAAoB,OAA+B;AAIzD,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAkBrC;AAGD,UAAM,kBAA+B,IAAI;AAAA,MACtC,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAaV,EAA4B,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAC9C;AAGA,UAAM,YAAiC,IAAI;AAAA,MACxC,MAAM,IAAI;AAAA;AAAA,OAEV,EAA0C,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;AAAA,IACtE;AAEA,WAAO,KACJ,OAAO,CAAC,QAAQ;AACf,YAAM,WAAW,UAAU,IAAI,IAAI,MAAM;AACzC,aAAO,CAAC,YAAY,CAAC,gBAAgB,IAAI,QAAQ;AAAA,IACnD,CAAC,EACA,IAAI,CAAC,SAAS;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,uBAAuB,IAAI,MAAM,8BAA8B,IAAI,MAAM;AAAA,MACtF,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACN;AAAA;AAAA,EAIQ,qBAAqB,OAA+B;AAM1D,UAAM,OAAsB,MAAM,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KA2BrC;AAED,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,MAAM;AAAA,MACN,UAAU;AAAA,MACV,eAAe;AAAA,MACf,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,QAAQ,IAAI;AAAA,MACZ,aAAa,YAAY,IAAI,MAAM,2BAA2B,IAAI,MAAM;AAAA,MACxE,gBAAgB;AAAA,IAClB,EAAE;AAAA,EACJ;AACF;",
   "names": []
 }

package/dist/security/dep-confusion.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Dependency Confusion Checker
+ *
+ * Detects internal packages whose names exist in public registries
+ * (a supply chain attack vector), and flags typosquatting candidates.
+ */
+import type { GraphDatabase } from '../db/database';
+export interface DepConfusionFinding {
+    packageName: string;
+    ecosystem: string;
+    internalSource: string;
+    publicExists: boolean;
+    publicVersion: string | null;
+    publicPublishedAt: string | null;
+    riskLevel: 'critical' | 'high' | 'medium';
+    explanation: string;
+}
+export declare class DepConfusionChecker {
+    private readonly db;
+    constructor(db: GraphDatabase);
+    check(): Promise<DepConfusionFinding[]>;
+}
+//# sourceMappingURL=dep-confusion.d.ts.map

package/dist/security/dep-confusion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-confusion.d.ts","sourceRoot":"","sources":["../../src/security/dep-confusion.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;CACrB;AAoKD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,KAAK,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;CA0G9C"}

package/dist/security/errors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * KiroGraph-Sec Error Classes
+ *
+ * Security-specific error types extending the base KiroGraphError.
+ */
+import { KiroGraphError } from '../errors';
+export declare class SecurityError extends KiroGraphError {
+    constructor(message: string, context?: Record<string, unknown>);
+}
+export declare class ManifestParseError extends KiroGraphError {
+    constructor(message: string, filePath: string, line?: number);
+}
+export declare class VulnDatabaseError extends KiroGraphError {
+    constructor(message: string, database: string, httpStatus?: number);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/security/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/security/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,qBAAa,aAAc,SAAQ,cAAc;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED,qBAAa,kBAAmB,SAAQ,cAAc;gBACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;CAI7D;AAED,qBAAa,iBAAkB,SAAQ,cAAc;gBACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAInE"}

package/dist/security/export/fix-suggestions.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Fix Suggestion Builder
+ *
+ * Generates ecosystem-appropriate upgrade commands for vulnerabilities
+ * that have a known fixed version. Reusable by CLI and MCP tools.
+ */
+/**
+ * Build an ecosystem-appropriate fix suggestion command.
+ *
+ * @param ecosystem - The package ecosystem (npm, maven, go, pypi, cargo)
+ * @param packageName - The package name (for maven: groupId:artifactId)
+ * @param fixedVersion - The version that fixes the vulnerability
+ * @returns A formatted fix command string, or empty string if ecosystem is unknown
+ */
+export declare function buildFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string): string;
+/**
+ * Format a fix suggestion line for display.
+ * Returns the formatted line with the 💡 prefix, or empty string if no fixed version.
+ */
+export declare function formatFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string | null | undefined): string;
+//# sourceMappingURL=fix-suggestions.d.ts.map

package/dist/security/export/fix-suggestions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix-suggestions.d.ts","sourceRoot":"","sources":["../../../src/security/export/fix-suggestions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAuBvG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAI3H"}