kirograph 0.19.0 → 0.20.1

package/dist/security/export/serialization.test.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/security/export/serialization.test.ts"],
-  "sourcesContent": ["/**\n * Unit tests for CycloneDX serialization utilities.\n *\n * Tests serialize/deserialize for Dependency_Nodes to/from CycloneDX JSON\n * component format, including round-trip and partial failure resilience.\n */\nimport { describe, it, expect } from 'vitest';\nimport {\n  serializeDependencyToComponent,\n  deserializeComponentToDependency,\n  serializeAll,\n  deserializeAll,\n  type DependencyRow,\n} from './serialization';\nimport type { CycloneDXComponent } from '../types';\n\nfunction makeDependencyRow(overrides?: Partial<DependencyRow>): DependencyRow {\n  return {\n    node_id: 'dep:npm:express',\n    ecosystem: 'npm',\n    package_name: 'express',\n    declared_constraint: '^4.18.0',\n    resolved_version: '4.18.2',\n    scope: 'production',\n    transitive_status: 'complete',\n    last_vuln_check: null,\n    vuln_data_stale: 0,\n    vuln_data_stale_since: null,\n    source_manifests: '[\"package.json\"]',\n    ...overrides,\n  };\n}\n\ndescribe('serializeDependencyToComponent', () => {\n  it('should serialize an npm dependency to a CycloneDX component', () => {\n    const dep = makeDependencyRow();\n    const component = serializeDependencyToComponent(dep);\n\n    expect(component.type).toBe('library');\n    expect(component.name).toBe('express');\n    expect(component.version).toBe('4.18.2');\n    expect(component.purl).toBe('pkg:npm/express@4.18.2');\n    expect(component.scope).toBe('required');\n    expect(component.properties).toEqual([\n      { name: 'kirograph:declaredConstraint', value: '^4.18.0' },\n    ]);\n  });\n\n  it('should use declared_constraint as version when resolved_version is null', () => {\n    const dep = makeDependencyRow({ resolved_version: null });\n    const component = serializeDependencyToComponent(dep);\n\n    expect(component.version).toBe('^4.18.0');\n    expect(component.purl).toBe('pkg:npm/express@^4.18.0');\n  });\n\n  it('should map production scope to required', () => {\n    const dep = makeDependencyRow({ scope: 'production' });\n    const component = serializeDependencyToComponent(dep);\n    expect(component.scope).toBe('required');\n  });\n\n  it('should map development scope to optional', () => {\n    const dep = makeDependencyRow({ scope: 'development' });\n    const component = serializeDependencyToComponent(dep);\n    expect(component.scope).toBe('optional');\n  });\n\n  it('should map optional scope to optional', () => {\n    const dep = makeDependencyRow({ scope: 'optional' });\n    const component = serializeDependencyToComponent(dep);\n    expect(component.scope).toBe('optional');\n  });\n\n  it('should correctly map maven ecosystem to purl type', () => {\n    const dep = makeDependencyRow({\n      node_id: 'dep:maven:log4j-core',\n      ecosystem: 'maven',\n      package_name: 'org.apache.logging.log4j/log4j-core',\n      resolved_version: '2.17.0',\n    });\n    const component = serializeDependencyToComponent(dep);\n    expect(component.purl).toBe('pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0');\n  });\n\n  it('should correctly map go ecosystem to golang purl type', () => {\n    const dep = makeDependencyRow({\n      node_id: 'dep:go:github.com/gin-gonic/gin',\n      ecosystem: 'go',\n      package_name: 'github.com/gin-gonic/gin',\n      resolved_version: '1.9.1',\n    });\n    const component = serializeDependencyToComponent(dep);\n    expect(component.purl).toBe('pkg:golang/github.com/gin-gonic/gin@1.9.1');\n  });\n\n  it('should correctly map pypi ecosystem', () => {\n    const dep = makeDependencyRow({\n      node_id: 'dep:pypi:django',\n      ecosystem: 'pypi',\n      package_name: 'django',\n      resolved_version: '4.2.0',\n    });\n    const component = serializeDependencyToComponent(dep);\n    expect(component.purl).toBe('pkg:pypi/django@4.2.0');\n  });\n\n  it('should correctly map cargo ecosystem', () => {\n    const dep = makeDependencyRow({\n      node_id: 'dep:cargo:serde',\n      ecosystem: 'cargo',\n      package_name: 'serde',\n      resolved_version: '1.0.188',\n    });\n    const component = serializeDependencyToComponent(dep);\n    expect(component.purl).toBe('pkg:cargo/serde@1.0.188');\n  });\n\n  it('should throw for unsupported ecosystem', () => {\n    const dep = makeDependencyRow({ ecosystem: 'unknown' });\n    expect(() => serializeDependencyToComponent(dep)).toThrow('Unsupported ecosystem: unknown');\n  });\n\n  it('should throw when both version and constraint are empty', () => {\n    const dep = makeDependencyRow({\n      resolved_version: null,\n      declared_constraint: '',\n    });\n    expect(() => serializeDependencyToComponent(dep)).toThrow(\n      'No version or constraint available',\n    );\n  });\n\n  it('should throw when package_name is empty', () => {\n    const dep = makeDependencyRow({ package_name: '' });\n    expect(() => serializeDependencyToComponent(dep)).toThrow(\n      'Dependency package_name is required',\n    );\n  });\n});\n\ndescribe('deserializeComponentToDependency', () => {\n  it('should deserialize a CycloneDX component to a dependency row', () => {\n    const component: CycloneDXComponent = {\n      type: 'library',\n      name: 'express',\n      version: '4.18.2',\n      purl: 'pkg:npm/express@4.18.2',\n      scope: 'required',\n      properties: [{ name: 'kirograph:declaredConstraint', value: '^4.18.0' }],\n    };\n\n    const dep = deserializeComponentToDependency(component);\n\n    expect(dep.ecosystem).toBe('npm');\n    expect(dep.package_name).toBe('express');\n    expect(dep.resolved_version).toBe('4.18.2');\n    expect(dep.declared_constraint).toBe('^4.18.0');\n    expect(dep.scope).toBe('production');\n    expect(dep.node_id).toBe('dep:npm:express');\n  });\n\n  it('should use version as declared_constraint when property is missing', () => {\n    const component: CycloneDXComponent = {\n      type: 'library',\n      name: 'express',\n      version: '4.18.2',\n      purl: 'pkg:npm/express@4.18.2',\n    };\n\n    const dep = deserializeComponentToDependency(component);\n    expect(dep.declared_constraint).toBe('4.18.2');\n  });\n\n  it('should map optional scope back to optional', () => {\n    const component: CycloneDXComponent = {\n      type: 'library',\n      name: 'jest',\n      version: '29.0.0',\n      purl: 'pkg:npm/jest@29.0.0',\n      scope: 'optional',\n    };\n\n    const dep = deserializeComponentToDependency(component);\n    expect(dep.scope).toBe('optional');\n  });\n\n  it('should map required scope back to production', () => {\n    const component: CycloneDXComponent = {\n      type: 'library',\n      name: 'express',\n      version: '4.18.2',\n      purl: 'pkg:npm/express@4.18.2',\n      scope: 'required',\n    };\n\n    const dep = deserializeComponentToDependency(component);\n    expect(dep.scope).toBe('production');\n  });\n\n  it('should map golang purl type back to go ecosystem', () => {\n    const component: CycloneDXComponent = {\n      type: 'library',\n      name: 'github.com/gin-gonic/gin',\n      version: '1.9.1',\n      purl: 'pkg:golang/github.com/gin-gonic/gin@1.9.1',\n    };\n\n    const dep = deserializeComponentToDependency(component);\n    expect(dep.ecosystem).toBe('go');\n    expect(dep.package_name).toBe('github.com/gin-gonic/gin');\n  });\n\n  it('should throw for missing purl', () => {\n    const component = {\n      type: 'library',\n      name: 'express',\n      version: '4.18.2',\n      purl: '',\n    } as CycloneDXComponent;\n\n    expect(() => deserializeComponentToDependency(component)).toThrow('missing purl');\n  });\n\n  it('should throw for invalid purl format', () => {\n    const component: CycloneDXComponent = {\n      type: 'library',\n      name: 'express',\n      version: '4.18.2',\n      purl: 'invalid-purl',\n    };\n\n    expect(() => deserializeComponentToDependency(component)).toThrow('Invalid purl format');\n  });\n\n  it('should throw for unsupported purl type', () => {\n    const component: CycloneDXComponent = {\n      type: 'library',\n      name: 'something',\n      version: '1.0.0',\n      purl: 'pkg:nuget/something@1.0.0',\n    };\n\n    expect(() => deserializeComponentToDependency(component)).toThrow('Unsupported purl type');\n  });\n\n  it('should set default values for non-serialized fields', () => {\n    const component: CycloneDXComponent = {\n      type: 'library',\n      name: 'express',\n      version: '4.18.2',\n      purl: 'pkg:npm/express@4.18.2',\n    };\n\n    const dep = deserializeComponentToDependency(component);\n    expect(dep.transitive_status).toBe('complete');\n    expect(dep.last_vuln_check).toBeNull();\n    expect(dep.vuln_data_stale).toBe(0);\n    expect(dep.vuln_data_stale_since).toBeNull();\n    expect(dep.source_manifests).toBe('[]');\n  });\n});\n\ndescribe('serializeDependencyToComponent \u2192 deserializeComponentToDependency round-trip', () => {\n  it('should preserve key fields through round-trip', () => {\n    const original = makeDependencyRow();\n    const component = serializeDependencyToComponent(original);\n    const restored = deserializeComponentToDependency(component);\n\n    expect(restored.package_name).toBe(original.package_name);\n    expect(restored.resolved_version).toBe(original.resolved_version);\n    expect(restored.ecosystem).toBe(original.ecosystem);\n    expect(restored.scope).toBe(original.scope);\n    expect(restored.declared_constraint).toBe(original.declared_constraint);\n  });\n\n  it('should preserve constraint when resolved_version is null', () => {\n    const original = makeDependencyRow({ resolved_version: null });\n    const component = serializeDependencyToComponent(original);\n    const restored = deserializeComponentToDependency(component);\n\n    expect(restored.declared_constraint).toBe(original.declared_constraint);\n    // When no resolved version, the version in purl is the constraint\n    expect(restored.resolved_version).toBe(original.declared_constraint);\n  });\n});\n\ndescribe('serializeAll', () => {\n  it('should serialize all valid dependencies', () => {\n    const deps = [\n      makeDependencyRow({ package_name: 'express', node_id: 'dep:npm:express' }),\n      makeDependencyRow({ package_name: 'lodash', node_id: 'dep:npm:lodash' }),\n    ];\n\n    const result = serializeAll(deps);\n    expect(result.components).toHaveLength(2);\n    expect(result.errors).toHaveLength(0);\n  });\n\n  it('should collect errors for failing nodes and continue with remaining', () => {\n    const deps = [\n      makeDependencyRow({ package_name: 'express' }),\n      makeDependencyRow({ package_name: 'bad-dep', ecosystem: 'unsupported' }),\n      makeDependencyRow({ package_name: 'lodash' }),\n    ];\n\n    const result = serializeAll(deps);\n    expect(result.components).toHaveLength(2);\n    expect(result.errors).toHaveLength(1);\n    expect(result.errors[0].name).toBe('bad-dep');\n    expect(result.errors[0].reason).toContain('Unsupported ecosystem');\n  });\n\n  it('should handle empty input', () => {\n    const result = serializeAll([]);\n    expect(result.components).toHaveLength(0);\n    expect(result.errors).toHaveLength(0);\n  });\n\n  it('should handle all failures gracefully', () => {\n    const deps = [\n      makeDependencyRow({ ecosystem: 'unknown1', package_name: 'a' }),\n      makeDependencyRow({ ecosystem: 'unknown2', package_name: 'b' }),\n    ];\n\n    const result = serializeAll(deps);\n    expect(result.components).toHaveLength(0);\n    expect(result.errors).toHaveLength(2);\n  });\n});\n\ndescribe('deserializeAll', () => {\n  it('should deserialize all valid components', () => {\n    const components: CycloneDXComponent[] = [\n      { type: 'library', name: 'express', version: '4.18.2', purl: 'pkg:npm/express@4.18.2' },\n      { type: 'library', name: 'lodash', version: '4.17.21', purl: 'pkg:npm/lodash@4.17.21' },\n    ];\n\n    const result = deserializeAll(components);\n    expect(result.deps).toHaveLength(2);\n    expect(result.errors).toHaveLength(0);\n  });\n\n  it('should collect errors for failing components and continue with remaining', () => {\n    const components: CycloneDXComponent[] = [\n      { type: 'library', name: 'express', version: '4.18.2', purl: 'pkg:npm/express@4.18.2' },\n      { type: 'library', name: 'bad', version: '1.0.0', purl: 'invalid-purl' },\n      { type: 'library', name: 'lodash', version: '4.17.21', purl: 'pkg:npm/lodash@4.17.21' },\n    ];\n\n    const result = deserializeAll(components);\n    expect(result.deps).toHaveLength(2);\n    expect(result.errors).toHaveLength(1);\n    expect(result.errors[0].name).toBe('bad');\n    expect(result.errors[0].reason).toContain('Invalid purl format');\n  });\n\n  it('should handle empty input', () => {\n    const result = deserializeAll([]);\n    expect(result.deps).toHaveLength(0);\n    expect(result.errors).toHaveLength(0);\n  });\n\n  it('should handle all failures gracefully', () => {\n    const components: CycloneDXComponent[] = [\n      { type: 'library', name: 'a', version: '1.0', purl: 'bad1' },\n      { type: 'library', name: 'b', version: '2.0', purl: 'bad2' },\n    ];\n\n    const result = deserializeAll(components);\n    expect(result.deps).toHaveLength(0);\n    expect(result.errors).toHaveLength(2);\n  });\n});\n"],
-  "mappings": ";AAMA,oBAAqC;AACrC,2BAMO;AAGP,SAAS,kBAAkB,WAAmD;AAC5E,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW;AAAA,IACX,cAAc;AAAA,IACd,qBAAqB;AAAA,IACrB,kBAAkB;AAAA,IAClB,OAAO;AAAA,IACP,mBAAmB;AAAA,IACnB,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,uBAAuB;AAAA,IACvB,kBAAkB;AAAA,IAClB,GAAG;AAAA,EACL;AACF;AAAA,IAEA,wBAAS,kCAAkC,MAAM;AAC/C,wBAAG,+DAA+D,MAAM;AACtE,UAAM,MAAM,kBAAkB;AAC9B,UAAM,gBAAY,qDAA+B,GAAG;AAEpD,8BAAO,UAAU,IAAI,EAAE,KAAK,SAAS;AACrC,8BAAO,UAAU,IAAI,EAAE,KAAK,SAAS;AACrC,8BAAO,UAAU,OAAO,EAAE,KAAK,QAAQ;AACvC,8BAAO,UAAU,IAAI,EAAE,KAAK,wBAAwB;AACpD,8BAAO,UAAU,KAAK,EAAE,KAAK,UAAU;AACvC,8BAAO,UAAU,UAAU,EAAE,QAAQ;AAAA,MACnC,EAAE,MAAM,gCAAgC,OAAO,UAAU;AAAA,IAC3D,CAAC;AAAA,EACH,CAAC;AAED,wBAAG,2EAA2E,MAAM;AAClF,UAAM,MAAM,kBAAkB,EAAE,kBAAkB,KAAK,CAAC;AACxD,UAAM,gBAAY,qDAA+B,GAAG;AAEpD,8BAAO,UAAU,OAAO,EAAE,KAAK,SAAS;AACxC,8BAAO,UAAU,IAAI,EAAE,KAAK,yBAAyB;AAAA,EACvD,CAAC;AAED,wBAAG,2CAA2C,MAAM;AAClD,UAAM,MAAM,kBAAkB,EAAE,OAAO,aAAa,CAAC;AACrD,UAAM,gBAAY,qDAA+B,GAAG;AACpD,8BAAO,UAAU,KAAK,EAAE,KAAK,UAAU;AAAA,EACzC,CAAC;AAED,wBAAG,4CAA4C,MAAM;AACnD,UAAM,MAAM,kBAAkB,EAAE,OAAO,cAAc,CAAC;AACtD,UAAM,gBAAY,qDAA+B,GAAG;AACpD,8BAAO,UAAU,KAAK,EAAE,KAAK,UAAU;AAAA,EACzC,CAAC;AAED,wBAAG,yCAAyC,MAAM;AAChD,UAAM,MAAM,kBAAkB,EAAE,OAAO,WAAW,CAAC;AACnD,UAAM,gBAAY,qDAA+B,GAAG;AACpD,8BAAO,UAAU,KAAK,EAAE,KAAK,UAAU;AAAA,EACzC,CAAC;AAED,wBAAG,qDAAqD,MAAM;AAC5D,UAAM,MAAM,kBAAkB;AAAA,MAC5B,SAAS;AAAA,MACT,WAAW;AAAA,MACX,cAAc;AAAA,MACd,kBAAkB;AAAA,IACpB,CAAC;AACD,UAAM,gBAAY,qDAA+B,GAAG;AACpD,8BAAO,UAAU,IAAI,EAAE,KAAK,sDAAsD;AAAA,EACpF,CAAC;AAED,wBAAG,yDAAyD,MAAM;AAChE,UAAM,MAAM,kBAAkB;AAAA,MAC5B,SAAS;AAAA,MACT,WAAW;AAAA,MACX,cAAc;AAAA,MACd,kBAAkB;AAAA,IACpB,CAAC;AACD,UAAM,gBAAY,qDAA+B,GAAG;AACpD,8BAAO,UAAU,IAAI,EAAE,KAAK,2CAA2C;AAAA,EACzE,CAAC;AAED,wBAAG,uCAAuC,MAAM;AAC9C,UAAM,MAAM,kBAAkB;AAAA,MAC5B,SAAS;AAAA,MACT,WAAW;AAAA,MACX,cAAc;AAAA,MACd,kBAAkB;AAAA,IACpB,CAAC;AACD,UAAM,gBAAY,qDAA+B,GAAG;AACpD,8BAAO,UAAU,IAAI,EAAE,KAAK,uBAAuB;AAAA,EACrD,CAAC;AAED,wBAAG,wCAAwC,MAAM;AAC/C,UAAM,MAAM,kBAAkB;AAAA,MAC5B,SAAS;AAAA,MACT,WAAW;AAAA,MACX,cAAc;AAAA,MACd,kBAAkB;AAAA,IACpB,CAAC;AACD,UAAM,gBAAY,qDAA+B,GAAG;AACpD,8BAAO,UAAU,IAAI,EAAE,KAAK,yBAAyB;AAAA,EACvD,CAAC;AAED,wBAAG,0CAA0C,MAAM;AACjD,UAAM,MAAM,kBAAkB,EAAE,WAAW,UAAU,CAAC;AACtD,8BAAO,UAAM,qDAA+B,GAAG,CAAC,EAAE,QAAQ,gCAAgC;AAAA,EAC5F,CAAC;AAED,wBAAG,2DAA2D,MAAM;AAClE,UAAM,MAAM,kBAAkB;AAAA,MAC5B,kBAAkB;AAAA,MAClB,qBAAqB;AAAA,IACvB,CAAC;AACD,8BAAO,UAAM,qDAA+B,GAAG,CAAC,EAAE;AAAA,MAChD;AAAA,IACF;AAAA,EACF,CAAC;AAED,wBAAG,2CAA2C,MAAM;AAClD,UAAM,MAAM,kBAAkB,EAAE,cAAc,GAAG,CAAC;AAClD,8BAAO,UAAM,qDAA+B,GAAG,CAAC,EAAE;AAAA,MAChD;AAAA,IACF;AAAA,EACF,CAAC;AACH,CAAC;AAAA,IAED,wBAAS,oCAAoC,MAAM;AACjD,wBAAG,gEAAgE,MAAM;AACvE,UAAM,YAAgC;AAAA,MACpC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,MACP,YAAY,CAAC,EAAE,MAAM,gCAAgC,OAAO,UAAU,CAAC;AAAA,IACzE;AAEA,UAAM,UAAM,uDAAiC,SAAS;AAEtD,8BAAO,IAAI,SAAS,EAAE,KAAK,KAAK;AAChC,8BAAO,IAAI,YAAY,EAAE,KAAK,SAAS;AACvC,8BAAO,IAAI,gBAAgB,EAAE,KAAK,QAAQ;AAC1C,8BAAO,IAAI,mBAAmB,EAAE,KAAK,SAAS;AAC9C,8BAAO,IAAI,KAAK,EAAE,KAAK,YAAY;AACnC,8BAAO,IAAI,OAAO,EAAE,KAAK,iBAAiB;AAAA,EAC5C,CAAC;AAED,wBAAG,sEAAsE,MAAM;AAC7E,UAAM,YAAgC;AAAA,MACpC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR;AAEA,UAAM,UAAM,uDAAiC,SAAS;AACtD,8BAAO,IAAI,mBAAmB,EAAE,KAAK,QAAQ;AAAA,EAC/C,CAAC;AAED,wBAAG,8CAA8C,MAAM;AACrD,UAAM,YAAgC;AAAA,MACpC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,IACT;AAEA,UAAM,UAAM,uDAAiC,SAAS;AACtD,8BAAO,IAAI,KAAK,EAAE,KAAK,UAAU;AAAA,EACnC,CAAC;AAED,wBAAG,gDAAgD,MAAM;AACvD,UAAM,YAAgC;AAAA,MACpC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,IACT;AAEA,UAAM,UAAM,uDAAiC,SAAS;AACtD,8BAAO,IAAI,KAAK,EAAE,KAAK,YAAY;AAAA,EACrC,CAAC;AAED,wBAAG,oDAAoD,MAAM;AAC3D,UAAM,YAAgC;AAAA,MACpC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR;AAEA,UAAM,UAAM,uDAAiC,SAAS;AACtD,8BAAO,IAAI,SAAS,EAAE,KAAK,IAAI;AAC/B,8BAAO,IAAI,YAAY,EAAE,KAAK,0BAA0B;AAAA,EAC1D,CAAC;AAED,wBAAG,iCAAiC,MAAM;AACxC,UAAM,YAAY;AAAA,MAChB,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR;AAEA,8BAAO,UAAM,uDAAiC,SAAS,CAAC,EAAE,QAAQ,cAAc;AAAA,EAClF,CAAC;AAED,wBAAG,wCAAwC,MAAM;AAC/C,UAAM,YAAgC;AAAA,MACpC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR;AAEA,8BAAO,UAAM,uDAAiC,SAAS,CAAC,EAAE,QAAQ,qBAAqB;AAAA,EACzF,CAAC;AAED,wBAAG,0CAA0C,MAAM;AACjD,UAAM,YAAgC;AAAA,MACpC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR;AAEA,8BAAO,UAAM,uDAAiC,SAAS,CAAC,EAAE,QAAQ,uBAAuB;AAAA,EAC3F,CAAC;AAED,wBAAG,uDAAuD,MAAM;AAC9D,UAAM,YAAgC;AAAA,MACpC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IACR;AAEA,UAAM,UAAM,uDAAiC,SAAS;AACtD,8BAAO,IAAI,iBAAiB,EAAE,KAAK,UAAU;AAC7C,8BAAO,IAAI,eAAe,EAAE,SAAS;AACrC,8BAAO,IAAI,eAAe,EAAE,KAAK,CAAC;AAClC,8BAAO,IAAI,qBAAqB,EAAE,SAAS;AAC3C,8BAAO,IAAI,gBAAgB,EAAE,KAAK,IAAI;AAAA,EACxC,CAAC;AACH,CAAC;AAAA,IAED,wBAAS,qFAAgF,MAAM;AAC7F,wBAAG,iDAAiD,MAAM;AACxD,UAAM,WAAW,kBAAkB;AACnC,UAAM,gBAAY,qDAA+B,QAAQ;AACzD,UAAM,eAAW,uDAAiC,SAAS;AAE3D,8BAAO,SAAS,YAAY,EAAE,KAAK,SAAS,YAAY;AACxD,8BAAO,SAAS,gBAAgB,EAAE,KAAK,SAAS,gBAAgB;AAChE,8BAAO,SAAS,SAAS,EAAE,KAAK,SAAS,SAAS;AAClD,8BAAO,SAAS,KAAK,EAAE,KAAK,SAAS,KAAK;AAC1C,8BAAO,SAAS,mBAAmB,EAAE,KAAK,SAAS,mBAAmB;AAAA,EACxE,CAAC;AAED,wBAAG,4DAA4D,MAAM;AACnE,UAAM,WAAW,kBAAkB,EAAE,kBAAkB,KAAK,CAAC;AAC7D,UAAM,gBAAY,qDAA+B,QAAQ;AACzD,UAAM,eAAW,uDAAiC,SAAS;AAE3D,8BAAO,SAAS,mBAAmB,EAAE,KAAK,SAAS,mBAAmB;AAEtE,8BAAO,SAAS,gBAAgB,EAAE,KAAK,SAAS,mBAAmB;AAAA,EACrE,CAAC;AACH,CAAC;AAAA,IAED,wBAAS,gBAAgB,MAAM;AAC7B,wBAAG,2CAA2C,MAAM;AAClD,UAAM,OAAO;AAAA,MACX,kBAAkB,EAAE,cAAc,WAAW,SAAS,kBAAkB,CAAC;AAAA,MACzE,kBAAkB,EAAE,cAAc,UAAU,SAAS,iBAAiB,CAAC;AAAA,IACzE;AAEA,UAAM,aAAS,mCAAa,IAAI;AAChC,8BAAO,OAAO,UAAU,EAAE,aAAa,CAAC;AACxC,8BAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EACtC,CAAC;AAED,wBAAG,uEAAuE,MAAM;AAC9E,UAAM,OAAO;AAAA,MACX,kBAAkB,EAAE,cAAc,UAAU,CAAC;AAAA,MAC7C,kBAAkB,EAAE,cAAc,WAAW,WAAW,cAAc,CAAC;AAAA,MACvE,kBAAkB,EAAE,cAAc,SAAS,CAAC;AAAA,IAC9C;AAEA,UAAM,aAAS,mCAAa,IAAI;AAChC,8BAAO,OAAO,UAAU,EAAE,aAAa,CAAC;AACxC,8BAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AACpC,8BAAO,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS;AAC5C,8BAAO,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,uBAAuB;AAAA,EACnE,CAAC;AAED,wBAAG,6BAA6B,MAAM;AACpC,UAAM,aAAS,mCAAa,CAAC,CAAC;AAC9B,8BAAO,OAAO,UAAU,EAAE,aAAa,CAAC;AACxC,8BAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EACtC,CAAC;AAED,wBAAG,yCAAyC,MAAM;AAChD,UAAM,OAAO;AAAA,MACX,kBAAkB,EAAE,WAAW,YAAY,cAAc,IAAI,CAAC;AAAA,MAC9D,kBAAkB,EAAE,WAAW,YAAY,cAAc,IAAI,CAAC;AAAA,IAChE;AAEA,UAAM,aAAS,mCAAa,IAAI;AAChC,8BAAO,OAAO,UAAU,EAAE,aAAa,CAAC;AACxC,8BAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EACtC,CAAC;AACH,CAAC;AAAA,IAED,wBAAS,kBAAkB,MAAM;AAC/B,wBAAG,2CAA2C,MAAM;AAClD,UAAM,aAAmC;AAAA,MACvC,EAAE,MAAM,WAAW,MAAM,WAAW,SAAS,UAAU,MAAM,yBAAyB;AAAA,MACtF,EAAE,MAAM,WAAW,MAAM,UAAU,SAAS,WAAW,MAAM,yBAAyB;AAAA,IACxF;AAEA,UAAM,aAAS,qCAAe,UAAU;AACxC,8BAAO,OAAO,IAAI,EAAE,aAAa,CAAC;AAClC,8BAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EACtC,CAAC;AAED,wBAAG,4EAA4E,MAAM;AACnF,UAAM,aAAmC;AAAA,MACvC,EAAE,MAAM,WAAW,MAAM,WAAW,SAAS,UAAU,MAAM,yBAAyB;AAAA,MACtF,EAAE,MAAM,WAAW,MAAM,OAAO,SAAS,SAAS,MAAM,eAAe;AAAA,MACvE,EAAE,MAAM,WAAW,MAAM,UAAU,SAAS,WAAW,MAAM,yBAAyB;AAAA,IACxF;AAEA,UAAM,aAAS,qCAAe,UAAU;AACxC,8BAAO,OAAO,IAAI,EAAE,aAAa,CAAC;AAClC,8BAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AACpC,8BAAO,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK;AACxC,8BAAO,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,qBAAqB;AAAA,EACjE,CAAC;AAED,wBAAG,6BAA6B,MAAM;AACpC,UAAM,aAAS,qCAAe,CAAC,CAAC;AAChC,8BAAO,OAAO,IAAI,EAAE,aAAa,CAAC;AAClC,8BAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EACtC,CAAC;AAED,wBAAG,yCAAyC,MAAM;AAChD,UAAM,aAAmC;AAAA,MACvC,EAAE,MAAM,WAAW,MAAM,KAAK,SAAS,OAAO,MAAM,OAAO;AAAA,MAC3D,EAAE,MAAM,WAAW,MAAM,KAAK,SAAS,OAAO,MAAM,OAAO;AAAA,IAC7D;AAEA,UAAM,aAAS,qCAAe,UAAU;AACxC,8BAAO,OAAO,IAAI,EAAE,aAAa,CAAC;AAClC,8BAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AAAA,EACtC,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/security/export/vex.test.js

@@ -1,278 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var import_vitest = require("vitest");
-var import_vex = require("./vex");
-var import_database = require("../../db/database");
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
-var os = __toESM(require("os"));
-(0, import_vitest.describe)("VEXExporter", () => {
-  let db;
-  let tmpDir;
-  (0, import_vitest.beforeEach)(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "vex-test-"));
-    db = new import_database.GraphDatabase(tmpDir);
-    db.applySecuritySchema();
-  });
-  (0, import_vitest.afterEach)(() => {
-    db.close();
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-  function insertDependency(nodeId, ecosystem, packageName, version) {
-    const rawDb = db.getRawDb();
-    db.upsertNode({
-      id: nodeId,
-      kind: "dependency",
-      name: packageName,
-      qualifiedName: `${ecosystem}/${packageName}`,
-      filePath: "package.json",
-      language: "unknown",
-      startLine: 0,
-      endLine: 0,
-      startColumn: 0,
-      endColumn: 0,
-      updatedAt: Date.now()
-    });
-    rawDb.run(
-      `INSERT OR REPLACE INTO sec_dependencies
-        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
-       VALUES (?, ?, ?, ?, ?, 'production', '["package.json"]')`,
-      [nodeId, ecosystem, packageName, `^${version}`, version]
-    );
-  }
-  function insertVulnerability(vulnNodeId, cveId, depNodeId, severity = 7.5) {
-    const rawDb = db.getRawDb();
-    db.upsertNode({
-      id: vulnNodeId,
-      kind: "vulnerability",
-      name: cveId,
-      qualifiedName: cveId,
-      filePath: "",
-      language: "unknown",
-      startLine: 0,
-      endLine: 0,
-      startColumn: 0,
-      endColumn: 0,
-      updatedAt: Date.now()
-    });
-    rawDb.run(
-      `INSERT OR REPLACE INTO sec_vulnerabilities (node_id, cve_id, severity_score, affected_ranges, source_database)
-       VALUES (?, ?, ?, '[]', 'OSV')`,
-      [vulnNodeId, cveId, severity]
-    );
-    db.insertEdge({
-      source: depNodeId,
-      target: vulnNodeId,
-      kind: "has_vulnerability",
-      filePath: ""
-    });
-  }
-  function insertReachability(vulnNodeId, verdict, paths = null, unresolvedSymbols = null, entryPointCount = 0) {
-    const rawDb = db.getRawDb();
-    rawDb.run(
-      `INSERT INTO sec_reachability (vulnerability_node_id, verdict, paths, unresolved_symbols, reaching_entry_point_count, analyzed_at)
-       VALUES (?, ?, ?, ?, ?, ?)`,
-      [
-        vulnNodeId,
-        verdict,
-        paths ? JSON.stringify(paths) : null,
-        unresolvedSymbols ? JSON.stringify(unresolvedSymbols) : null,
-        entryPointCount,
-        Date.now()
-      ]
-    );
-  }
-  function insertImpact(vulnNodeId, layers, entryPoints, pathCount) {
-    const rawDb = db.getRawDb();
-    rawDb.run(
-      `INSERT INTO sec_impact (vulnerability_node_id, affected_layers, affected_entry_points, distinct_path_count, analyzed_at)
-       VALUES (?, ?, ?, ?, ?)`,
-      [vulnNodeId, JSON.stringify(layers), JSON.stringify(entryPoints), pathCount, Date.now()]
-    );
-  }
-  (0, import_vitest.describe)("export()", () => {
-    (0, import_vitest.it)("should produce valid CycloneDX 1.5 VEX with empty vulnerabilities when none exist", () => {
-      const exporter = new import_vex.VEXExporter(db, tmpDir);
-      const vex = exporter.export();
-      (0, import_vitest.expect)(vex.bomFormat).toBe("CycloneDX");
-      (0, import_vitest.expect)(vex.specVersion).toBe("1.5");
-      (0, import_vitest.expect)(vex.version).toBe(1);
-      (0, import_vitest.expect)(vex.metadata).toBeDefined();
-      (0, import_vitest.expect)(vex.vulnerabilities).toEqual([]);
-    });
-    (0, import_vitest.it)("should include correct metadata with tool name, version, and timestamp", () => {
-      const exporter = new import_vex.VEXExporter(db, "/projects/my-app");
-      const vex = exporter.export();
-      const meta = vex.metadata;
-      (0, import_vitest.expect)(meta.tools.components[0].name).toBe("kirograph-sec");
-      (0, import_vitest.expect)(meta.tools.components[0].version).toBe("0.1.0");
-      (0, import_vitest.expect)(meta.timestamp).toMatch(/^\d{4}-\d{2}-\d{2}T/);
-      (0, import_vitest.expect)(meta.component.name).toBe("my-app");
-    });
-    (0, import_vitest.it)('should map "affected" verdict correctly', () => {
-      insertDependency("dep-1", "npm", "lodash", "4.17.20");
-      insertVulnerability("vuln-1", "CVE-2021-23337", "dep-1", 9.8);
-      insertReachability(
-        "vuln-1",
-        "affected",
-        [
-          { entryPoint: "ep-1", path: ["ep-1", "mid-1", "dep-1"] },
-          { entryPoint: "ep-2", path: ["ep-2", "dep-1"] }
-        ],
-        null,
-        2
-      );
-      insertImpact("vuln-1", ["api", "service"], ["ep-1", "ep-2"], 2);
-      const exporter = new import_vex.VEXExporter(db, tmpDir);
-      const vex = exporter.export();
-      (0, import_vitest.expect)(vex.vulnerabilities).toHaveLength(1);
-      const v = vex.vulnerabilities[0];
-      (0, import_vitest.expect)(v.id).toBe("CVE-2021-23337");
-      (0, import_vitest.expect)(v.analysis?.state).toBe("affected");
-      (0, import_vitest.expect)(v.analysis?.detail).toContain("2 entry points");
-      (0, import_vitest.expect)(v.analysis?.detail).toContain("2 layers");
-      (0, import_vitest.expect)(v.analysis?.detail).toContain("Shortest path length: 2 nodes");
-      (0, import_vitest.expect)(v.affects).toEqual([{ ref: "pkg:npm/lodash@4.17.20" }]);
-      (0, import_vitest.expect)(v.ratings).toEqual([{ score: 9.8, method: "CVSSv31" }]);
-    });
-    (0, import_vitest.it)('should map "not_affected" verdict with justification "code_not_reachable"', () => {
-      insertDependency("dep-1", "npm", "express", "4.17.1");
-      insertVulnerability("vuln-1", "CVE-2022-24999", "dep-1", 5.3);
-      insertReachability("vuln-1", "not_affected", null, null, 0);
-      const exporter = new import_vex.VEXExporter(db, tmpDir);
-      const vex = exporter.export();
-      (0, import_vitest.expect)(vex.vulnerabilities).toHaveLength(1);
-      const v = vex.vulnerabilities[0];
-      (0, import_vitest.expect)(v.analysis?.state).toBe("not_affected");
-      (0, import_vitest.expect)(v.analysis?.justification).toBe("code_not_reachable");
-      (0, import_vitest.expect)(v.analysis?.detail).toContain("No reachable path found");
-    });
-    (0, import_vitest.it)('should map "under_investigation" verdict with unresolved symbols', () => {
-      insertDependency("dep-1", "pypi", "requests", "2.28.0");
-      insertVulnerability("vuln-1", "CVE-2023-32681", "dep-1", 6.1);
-      insertReachability(
-        "vuln-1",
-        "under_investigation",
-        null,
-        ["sym-unresolved-1", "sym-unresolved-2"],
-        0
-      );
-      const exporter = new import_vex.VEXExporter(db, tmpDir);
-      const vex = exporter.export();
-      (0, import_vitest.expect)(vex.vulnerabilities).toHaveLength(1);
-      const v = vex.vulnerabilities[0];
-      (0, import_vitest.expect)(v.analysis?.state).toBe("under_investigation");
-      (0, import_vitest.expect)(v.analysis?.detail).toContain("2 unresolved symbols");
-      (0, import_vitest.expect)(v.analysis?.detail).toContain("sym-unresolved-1");
-      (0, import_vitest.expect)(v.analysis?.detail).toContain("sym-unresolved-2");
-    });
-    (0, import_vitest.it)('should set "under_investigation" when no reachability analysis performed', () => {
-      insertDependency("dep-1", "cargo", "serde", "1.0.188");
-      insertVulnerability("vuln-1", "CVE-2024-00001", "dep-1", 4);
-      const exporter = new import_vex.VEXExporter(db, tmpDir);
-      const vex = exporter.export();
-      (0, import_vitest.expect)(vex.vulnerabilities).toHaveLength(1);
-      const v = vex.vulnerabilities[0];
-      (0, import_vitest.expect)(v.analysis?.state).toBe("under_investigation");
-      (0, import_vitest.expect)(v.analysis?.detail).toContain("has not yet been executed");
-    });
-    (0, import_vitest.it)("should handle multiple vulnerabilities", () => {
-      insertDependency("dep-1", "npm", "lodash", "4.17.20");
-      insertDependency("dep-2", "npm", "express", "4.17.1");
-      insertVulnerability("vuln-1", "CVE-2021-23337", "dep-1", 9.8);
-      insertVulnerability("vuln-2", "CVE-2022-24999", "dep-2", 5.3);
-      insertReachability(
-        "vuln-1",
-        "affected",
-        [{ entryPoint: "ep-1", path: ["ep-1", "dep-1"] }],
-        null,
-        1
-      );
-      insertReachability("vuln-2", "not_affected", null, null, 0);
-      const exporter = new import_vex.VEXExporter(db, tmpDir);
-      const vex = exporter.export();
-      (0, import_vitest.expect)(vex.vulnerabilities).toHaveLength(2);
-      const affected = vex.vulnerabilities.find((v) => v.id === "CVE-2021-23337");
-      const notAffected = vex.vulnerabilities.find((v) => v.id === "CVE-2022-24999");
-      (0, import_vitest.expect)(affected?.analysis?.state).toBe("affected");
-      (0, import_vitest.expect)(notAffected?.analysis?.state).toBe("not_affected");
-    });
-    (0, import_vitest.it)("should use declared_constraint as version when resolved_version is null", () => {
-      const rawDb = db.getRawDb();
-      db.upsertNode({
-        id: "dep-1",
-        kind: "dependency",
-        name: "axios",
-        qualifiedName: "npm/axios",
-        filePath: "package.json",
-        language: "unknown",
-        startLine: 0,
-        endLine: 0,
-        startColumn: 0,
-        endColumn: 0,
-        updatedAt: Date.now()
-      });
-      rawDb.run(
-        `INSERT OR REPLACE INTO sec_dependencies
-          (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
-         VALUES ('dep-1', 'npm', 'axios', '^1.0.0', NULL, 'production', '["package.json"]')`
-      );
-      insertVulnerability("vuln-1", "CVE-2023-45857", "dep-1", 6.5);
-      insertReachability("vuln-1", "not_affected", null, null, 0);
-      const exporter = new import_vex.VEXExporter(db, tmpDir);
-      const vex = exporter.export();
-      (0, import_vitest.expect)(vex.vulnerabilities[0].affects).toEqual([{ ref: "pkg:npm/axios@^1.0.0" }]);
-    });
-    (0, import_vitest.it)("should handle vulnerability with no severity score", () => {
-      insertDependency("dep-1", "go", "github.com/gin-gonic/gin", "1.9.1");
-      insertVulnerability("vuln-1", "CVE-2023-99999", "dep-1", null);
-      insertReachability("vuln-1", "not_affected", null, null, 0);
-      const exporter = new import_vex.VEXExporter(db, tmpDir);
-      const vex = exporter.export();
-      (0, import_vitest.expect)(vex.vulnerabilities[0].ratings).toBeUndefined();
-    });
-    (0, import_vitest.it)('should handle "under_investigation" with empty unresolved symbols', () => {
-      insertDependency("dep-1", "npm", "minimist", "1.2.5");
-      insertVulnerability("vuln-1", "CVE-2021-44906", "dep-1", 9.8);
-      insertReachability("vuln-1", "under_investigation", null, [], 0);
-      const exporter = new import_vex.VEXExporter(db, tmpDir);
-      const vex = exporter.export();
-      const v = vex.vulnerabilities[0];
-      (0, import_vitest.expect)(v.analysis?.state).toBe("under_investigation");
-      (0, import_vitest.expect)(v.analysis?.detail).toBe("Reachability analysis pending.");
-    });
-  });
-  (0, import_vitest.describe)("exportJSON()", () => {
-    (0, import_vitest.it)("should return pretty-printed JSON string", () => {
-      const exporter = new import_vex.VEXExporter(db, tmpDir);
-      const json = exporter.exportJSON();
-      (0, import_vitest.expect)(() => JSON.parse(json)).not.toThrow();
-      (0, import_vitest.expect)(json).toContain("\n");
-      const parsed = JSON.parse(json);
-      (0, import_vitest.expect)(parsed.bomFormat).toBe("CycloneDX");
-      (0, import_vitest.expect)(parsed.specVersion).toBe("1.5");
-    });
-  });
-});
-//# sourceMappingURL=vex.test.js.map

package/dist/security/export/vex.test.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/security/export/vex.test.ts"],
-  "sourcesContent": ["/**\n * Unit tests for VEXExporter\n *\n * Tests CycloneDX 1.5 VEX generation with various vulnerability/reachability scenarios.\n */\n\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport { VEXExporter } from './vex';\nimport { GraphDatabase } from '../../db/database';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\n\ndescribe('VEXExporter', () => {\n  let db: GraphDatabase;\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'vex-test-'));\n    db = new GraphDatabase(tmpDir);\n    db.applySecuritySchema();\n  });\n\n  afterEach(() => {\n    db.close();\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  /**\n   * Helper to insert a dependency node into the database.\n   */\n  function insertDependency(\n    nodeId: string,\n    ecosystem: string,\n    packageName: string,\n    version: string,\n  ): void {\n    const rawDb = db.getRawDb();\n\n    db.upsertNode({\n      id: nodeId,\n      kind: 'dependency',\n      name: packageName,\n      qualifiedName: `${ecosystem}/${packageName}`,\n      filePath: 'package.json',\n      language: 'unknown',\n      startLine: 0,\n      endLine: 0,\n      startColumn: 0,\n      endColumn: 0,\n      updatedAt: Date.now(),\n    });\n\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_dependencies\n        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n       VALUES (?, ?, ?, ?, ?, 'production', '[\"package.json\"]')`,\n      [nodeId, ecosystem, packageName, `^${version}`, version],\n    );\n  }\n\n  /**\n   * Helper to insert a vulnerability node linked to a dependency.\n   */\n  function insertVulnerability(\n    vulnNodeId: string,\n    cveId: string,\n    depNodeId: string,\n    severity: number | null = 7.5,\n  ): void {\n    const rawDb = db.getRawDb();\n\n    db.upsertNode({\n      id: vulnNodeId,\n      kind: 'vulnerability',\n      name: cveId,\n      qualifiedName: cveId,\n      filePath: '',\n      language: 'unknown',\n      startLine: 0,\n      endLine: 0,\n      startColumn: 0,\n      endColumn: 0,\n      updatedAt: Date.now(),\n    });\n\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_vulnerabilities (node_id, cve_id, severity_score, affected_ranges, source_database)\n       VALUES (?, ?, ?, '[]', 'OSV')`,\n      [vulnNodeId, cveId, severity],\n    );\n\n    db.insertEdge({\n      source: depNodeId,\n      target: vulnNodeId,\n      kind: 'has_vulnerability',\n      filePath: '',\n    });\n  }\n\n  /**\n   * Helper to insert a reachability result.\n   */\n  function insertReachability(\n    vulnNodeId: string,\n    verdict: string,\n    paths: any[] | null = null,\n    unresolvedSymbols: string[] | null = null,\n    entryPointCount: number = 0,\n  ): void {\n    const rawDb = db.getRawDb();\n    rawDb.run(\n      `INSERT INTO sec_reachability (vulnerability_node_id, verdict, paths, unresolved_symbols, reaching_entry_point_count, analyzed_at)\n       VALUES (?, ?, ?, ?, ?, ?)`,\n      [\n        vulnNodeId,\n        verdict,\n        paths ? JSON.stringify(paths) : null,\n        unresolvedSymbols ? JSON.stringify(unresolvedSymbols) : null,\n        entryPointCount,\n        Date.now(),\n      ],\n    );\n  }\n\n  /**\n   * Helper to insert an impact summary.\n   */\n  function insertImpact(\n    vulnNodeId: string,\n    layers: string[],\n    entryPoints: string[],\n    pathCount: number,\n  ): void {\n    const rawDb = db.getRawDb();\n    rawDb.run(\n      `INSERT INTO sec_impact (vulnerability_node_id, affected_layers, affected_entry_points, distinct_path_count, analyzed_at)\n       VALUES (?, ?, ?, ?, ?)`,\n      [vulnNodeId, JSON.stringify(layers), JSON.stringify(entryPoints), pathCount, Date.now()],\n    );\n  }\n\n  describe('export()', () => {\n    it('should produce valid CycloneDX 1.5 VEX with empty vulnerabilities when none exist', () => {\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.bomFormat).toBe('CycloneDX');\n      expect(vex.specVersion).toBe('1.5');\n      expect(vex.version).toBe(1);\n      expect(vex.metadata).toBeDefined();\n      expect(vex.vulnerabilities).toEqual([]);\n    });\n\n    it('should include correct metadata with tool name, version, and timestamp', () => {\n      const exporter = new VEXExporter(db, '/projects/my-app');\n      const vex = exporter.export();\n\n      const meta = vex.metadata as any;\n      expect(meta.tools.components[0].name).toBe('kirograph-sec');\n      expect(meta.tools.components[0].version).toBe('0.1.0');\n      expect(meta.timestamp).toMatch(/^\\d{4}-\\d{2}-\\d{2}T/);\n      expect(meta.component.name).toBe('my-app');\n    });\n\n    it('should map \"affected\" verdict correctly', () => {\n      insertDependency('dep-1', 'npm', 'lodash', '4.17.20');\n      insertVulnerability('vuln-1', 'CVE-2021-23337', 'dep-1', 9.8);\n      insertReachability(\n        'vuln-1',\n        'affected',\n        [\n          { entryPoint: 'ep-1', path: ['ep-1', 'mid-1', 'dep-1'] },\n          { entryPoint: 'ep-2', path: ['ep-2', 'dep-1'] },\n        ],\n        null,\n        2,\n      );\n      insertImpact('vuln-1', ['api', 'service'], ['ep-1', 'ep-2'], 2);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities).toHaveLength(1);\n      const v = vex.vulnerabilities[0];\n      expect(v.id).toBe('CVE-2021-23337');\n      expect(v.analysis?.state).toBe('affected');\n      expect(v.analysis?.detail).toContain('2 entry points');\n      expect(v.analysis?.detail).toContain('2 layers');\n      expect(v.analysis?.detail).toContain('Shortest path length: 2 nodes');\n      expect(v.affects).toEqual([{ ref: 'pkg:npm/lodash@4.17.20' }]);\n      expect(v.ratings).toEqual([{ score: 9.8, method: 'CVSSv31' }]);\n    });\n\n    it('should map \"not_affected\" verdict with justification \"code_not_reachable\"', () => {\n      insertDependency('dep-1', 'npm', 'express', '4.17.1');\n      insertVulnerability('vuln-1', 'CVE-2022-24999', 'dep-1', 5.3);\n      insertReachability('vuln-1', 'not_affected', null, null, 0);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities).toHaveLength(1);\n      const v = vex.vulnerabilities[0];\n      expect(v.analysis?.state).toBe('not_affected');\n      expect(v.analysis?.justification).toBe('code_not_reachable');\n      expect(v.analysis?.detail).toContain('No reachable path found');\n    });\n\n    it('should map \"under_investigation\" verdict with unresolved symbols', () => {\n      insertDependency('dep-1', 'pypi', 'requests', '2.28.0');\n      insertVulnerability('vuln-1', 'CVE-2023-32681', 'dep-1', 6.1);\n      insertReachability(\n        'vuln-1',\n        'under_investigation',\n        null,\n        ['sym-unresolved-1', 'sym-unresolved-2'],\n        0,\n      );\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities).toHaveLength(1);\n      const v = vex.vulnerabilities[0];\n      expect(v.analysis?.state).toBe('under_investigation');\n      expect(v.analysis?.detail).toContain('2 unresolved symbols');\n      expect(v.analysis?.detail).toContain('sym-unresolved-1');\n      expect(v.analysis?.detail).toContain('sym-unresolved-2');\n    });\n\n    it('should set \"under_investigation\" when no reachability analysis performed', () => {\n      insertDependency('dep-1', 'cargo', 'serde', '1.0.188');\n      insertVulnerability('vuln-1', 'CVE-2024-00001', 'dep-1', 4.0);\n      // No reachability row inserted\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities).toHaveLength(1);\n      const v = vex.vulnerabilities[0];\n      expect(v.analysis?.state).toBe('under_investigation');\n      expect(v.analysis?.detail).toContain('has not yet been executed');\n    });\n\n    it('should handle multiple vulnerabilities', () => {\n      insertDependency('dep-1', 'npm', 'lodash', '4.17.20');\n      insertDependency('dep-2', 'npm', 'express', '4.17.1');\n\n      insertVulnerability('vuln-1', 'CVE-2021-23337', 'dep-1', 9.8);\n      insertVulnerability('vuln-2', 'CVE-2022-24999', 'dep-2', 5.3);\n\n      insertReachability(\n        'vuln-1',\n        'affected',\n        [{ entryPoint: 'ep-1', path: ['ep-1', 'dep-1'] }],\n        null,\n        1,\n      );\n      insertReachability('vuln-2', 'not_affected', null, null, 0);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities).toHaveLength(2);\n      const affected = vex.vulnerabilities.find(v => v.id === 'CVE-2021-23337');\n      const notAffected = vex.vulnerabilities.find(v => v.id === 'CVE-2022-24999');\n      expect(affected?.analysis?.state).toBe('affected');\n      expect(notAffected?.analysis?.state).toBe('not_affected');\n    });\n\n    it('should use declared_constraint as version when resolved_version is null', () => {\n      const rawDb = db.getRawDb();\n\n      db.upsertNode({\n        id: 'dep-1',\n        kind: 'dependency',\n        name: 'axios',\n        qualifiedName: 'npm/axios',\n        filePath: 'package.json',\n        language: 'unknown',\n        startLine: 0,\n        endLine: 0,\n        startColumn: 0,\n        endColumn: 0,\n        updatedAt: Date.now(),\n      });\n\n      rawDb.run(\n        `INSERT OR REPLACE INTO sec_dependencies\n          (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n         VALUES ('dep-1', 'npm', 'axios', '^1.0.0', NULL, 'production', '[\"package.json\"]')`,\n      );\n      insertVulnerability('vuln-1', 'CVE-2023-45857', 'dep-1', 6.5);\n      insertReachability('vuln-1', 'not_affected', null, null, 0);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities[0].affects).toEqual([{ ref: 'pkg:npm/axios@^1.0.0' }]);\n    });\n\n    it('should handle vulnerability with no severity score', () => {\n      insertDependency('dep-1', 'go', 'github.com/gin-gonic/gin', '1.9.1');\n      insertVulnerability('vuln-1', 'CVE-2023-99999', 'dep-1', null);\n      insertReachability('vuln-1', 'not_affected', null, null, 0);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      expect(vex.vulnerabilities[0].ratings).toBeUndefined();\n    });\n\n    it('should handle \"under_investigation\" with empty unresolved symbols', () => {\n      insertDependency('dep-1', 'npm', 'minimist', '1.2.5');\n      insertVulnerability('vuln-1', 'CVE-2021-44906', 'dep-1', 9.8);\n      insertReachability('vuln-1', 'under_investigation', null, [], 0);\n\n      const exporter = new VEXExporter(db, tmpDir);\n      const vex = exporter.export();\n\n      const v = vex.vulnerabilities[0];\n      expect(v.analysis?.state).toBe('under_investigation');\n      expect(v.analysis?.detail).toBe('Reachability analysis pending.');\n    });\n  });\n\n  describe('exportJSON()', () => {\n    it('should return pretty-printed JSON string', () => {\n      const exporter = new VEXExporter(db, tmpDir);\n      const json = exporter.exportJSON();\n\n      expect(() => JSON.parse(json)).not.toThrow();\n      // Pretty-printed means it contains newlines\n      expect(json).toContain('\\n');\n\n      const parsed = JSON.parse(json);\n      expect(parsed.bomFormat).toBe('CycloneDX');\n      expect(parsed.specVersion).toBe('1.5');\n    });\n  });\n});\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAMA,oBAA4D;AAC5D,iBAA4B;AAC5B,sBAA8B;AAC9B,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AAAA,IAEpB,wBAAS,eAAe,MAAM;AAC5B,MAAI;AACJ,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,WAAW,CAAC;AAC3D,SAAK,IAAI,8BAAc,MAAM;AAC7B,OAAG,oBAAoB;AAAA,EACzB,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,MAAM;AACT,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAKD,WAAS,iBACP,QACA,WACA,aACA,SACM;AACN,UAAM,QAAQ,GAAG,SAAS;AAE1B,OAAG,WAAW;AAAA,MACZ,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,eAAe,GAAG,SAAS,IAAI,WAAW;AAAA,MAC1C,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AAED,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,QAAQ,WAAW,aAAa,IAAI,OAAO,IAAI,OAAO;AAAA,IACzD;AAAA,EACF;AAKA,WAAS,oBACP,YACA,OACA,WACA,WAA0B,KACpB;AACN,UAAM,QAAQ,GAAG,SAAS;AAE1B,OAAG,WAAW;AAAA,MACZ,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,eAAe;AAAA,MACf,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AAED,UAAM;AAAA,MACJ;AAAA;AAAA,MAEA,CAAC,YAAY,OAAO,QAAQ;AAAA,IAC9B;AAEA,OAAG,WAAW;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAKA,WAAS,mBACP,YACA,SACA,QAAsB,MACtB,oBAAqC,MACrC,kBAA0B,GACpB;AACN,UAAM,QAAQ,GAAG,SAAS;AAC1B,UAAM;AAAA,MACJ;AAAA;AAAA,MAEA;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK,UAAU,KAAK,IAAI;AAAA,QAChC,oBAAoB,KAAK,UAAU,iBAAiB,IAAI;AAAA,QACxD;AAAA,QACA,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAKA,WAAS,aACP,YACA,QACA,aACA,WACM;AACN,UAAM,QAAQ,GAAG,SAAS;AAC1B,UAAM;AAAA,MACJ;AAAA;AAAA,MAEA,CAAC,YAAY,KAAK,UAAU,MAAM,GAAG,KAAK,UAAU,WAAW,GAAG,WAAW,KAAK,IAAI,CAAC;AAAA,IACzF;AAAA,EACF;AAEA,8BAAS,YAAY,MAAM;AACzB,0BAAG,qFAAqF,MAAM;AAC5F,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,SAAS,EAAE,KAAK,WAAW;AACtC,gCAAO,IAAI,WAAW,EAAE,KAAK,KAAK;AAClC,gCAAO,IAAI,OAAO,EAAE,KAAK,CAAC;AAC1B,gCAAO,IAAI,QAAQ,EAAE,YAAY;AACjC,gCAAO,IAAI,eAAe,EAAE,QAAQ,CAAC,CAAC;AAAA,IACxC,CAAC;AAED,0BAAG,0EAA0E,MAAM;AACjF,YAAM,WAAW,IAAI,uBAAY,IAAI,kBAAkB;AACvD,YAAM,MAAM,SAAS,OAAO;AAE5B,YAAM,OAAO,IAAI;AACjB,gCAAO,KAAK,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,eAAe;AAC1D,gCAAO,KAAK,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO;AACrD,gCAAO,KAAK,SAAS,EAAE,QAAQ,qBAAqB;AACpD,gCAAO,KAAK,UAAU,IAAI,EAAE,KAAK,QAAQ;AAAA,IAC3C,CAAC;AAED,0BAAG,2CAA2C,MAAM;AAClD,uBAAiB,SAAS,OAAO,UAAU,SAAS;AACpD,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,EAAE,YAAY,QAAQ,MAAM,CAAC,QAAQ,SAAS,OAAO,EAAE;AAAA,UACvD,EAAE,YAAY,QAAQ,MAAM,CAAC,QAAQ,OAAO,EAAE;AAAA,QAChD;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,mBAAa,UAAU,CAAC,OAAO,SAAS,GAAG,CAAC,QAAQ,MAAM,GAAG,CAAC;AAE9D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,eAAe,EAAE,aAAa,CAAC;AAC1C,YAAM,IAAI,IAAI,gBAAgB,CAAC;AAC/B,gCAAO,EAAE,EAAE,EAAE,KAAK,gBAAgB;AAClC,gCAAO,EAAE,UAAU,KAAK,EAAE,KAAK,UAAU;AACzC,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,gBAAgB;AACrD,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,UAAU;AAC/C,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,+BAA+B;AACpE,gCAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,KAAK,yBAAyB,CAAC,CAAC;AAC7D,gCAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,KAAK,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC/D,CAAC;AAED,0BAAG,6EAA6E,MAAM;AACpF,uBAAiB,SAAS,OAAO,WAAW,QAAQ;AACpD,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D,yBAAmB,UAAU,gBAAgB,MAAM,MAAM,CAAC;AAE1D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,eAAe,EAAE,aAAa,CAAC;AAC1C,YAAM,IAAI,IAAI,gBAAgB,CAAC;AAC/B,gCAAO,EAAE,UAAU,KAAK,EAAE,KAAK,cAAc;AAC7C,gCAAO,EAAE,UAAU,aAAa,EAAE,KAAK,oBAAoB;AAC3D,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,yBAAyB;AAAA,IAChE,CAAC;AAED,0BAAG,oEAAoE,MAAM;AAC3E,uBAAiB,SAAS,QAAQ,YAAY,QAAQ;AACtD,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAC,oBAAoB,kBAAkB;AAAA,QACvC;AAAA,MACF;AAEA,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,eAAe,EAAE,aAAa,CAAC;AAC1C,YAAM,IAAI,IAAI,gBAAgB,CAAC;AAC/B,gCAAO,EAAE,UAAU,KAAK,EAAE,KAAK,qBAAqB;AACpD,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,sBAAsB;AAC3D,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,kBAAkB;AACvD,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,kBAAkB;AAAA,IACzD,CAAC;AAED,0BAAG,4EAA4E,MAAM;AACnF,uBAAiB,SAAS,SAAS,SAAS,SAAS;AACrD,0BAAoB,UAAU,kBAAkB,SAAS,CAAG;AAG5D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,eAAe,EAAE,aAAa,CAAC;AAC1C,YAAM,IAAI,IAAI,gBAAgB,CAAC;AAC/B,gCAAO,EAAE,UAAU,KAAK,EAAE,KAAK,qBAAqB;AACpD,gCAAO,EAAE,UAAU,MAAM,EAAE,UAAU,2BAA2B;AAAA,IAClE,CAAC;AAED,0BAAG,0CAA0C,MAAM;AACjD,uBAAiB,SAAS,OAAO,UAAU,SAAS;AACpD,uBAAiB,SAAS,OAAO,WAAW,QAAQ;AAEpD,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAE5D;AAAA,QACE;AAAA,QACA;AAAA,QACA,CAAC,EAAE,YAAY,QAAQ,MAAM,CAAC,QAAQ,OAAO,EAAE,CAAC;AAAA,QAChD;AAAA,QACA;AAAA,MACF;AACA,yBAAmB,UAAU,gBAAgB,MAAM,MAAM,CAAC;AAE1D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,eAAe,EAAE,aAAa,CAAC;AAC1C,YAAM,WAAW,IAAI,gBAAgB,KAAK,OAAK,EAAE,OAAO,gBAAgB;AACxE,YAAM,cAAc,IAAI,gBAAgB,KAAK,OAAK,EAAE,OAAO,gBAAgB;AAC3E,gCAAO,UAAU,UAAU,KAAK,EAAE,KAAK,UAAU;AACjD,gCAAO,aAAa,UAAU,KAAK,EAAE,KAAK,cAAc;AAAA,IAC1D,CAAC;AAED,0BAAG,2EAA2E,MAAM;AAClF,YAAM,QAAQ,GAAG,SAAS;AAE1B,SAAG,WAAW;AAAA,QACZ,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,QACN,eAAe;AAAA,QACf,UAAU;AAAA,QACV,UAAU;AAAA,QACV,WAAW;AAAA,QACX,SAAS;AAAA,QACT,aAAa;AAAA,QACb,WAAW;AAAA,QACX,WAAW,KAAK,IAAI;AAAA,MACtB,CAAC;AAED,YAAM;AAAA,QACJ;AAAA;AAAA;AAAA,MAGF;AACA,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D,yBAAmB,UAAU,gBAAgB,MAAM,MAAM,CAAC;AAE1D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,KAAK,uBAAuB,CAAC,CAAC;AAAA,IAClF,CAAC;AAED,0BAAG,sDAAsD,MAAM;AAC7D,uBAAiB,SAAS,MAAM,4BAA4B,OAAO;AACnE,0BAAoB,UAAU,kBAAkB,SAAS,IAAI;AAC7D,yBAAmB,UAAU,gBAAgB,MAAM,MAAM,CAAC;AAE1D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,gCAAO,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,cAAc;AAAA,IACvD,CAAC;AAED,0BAAG,qEAAqE,MAAM;AAC5E,uBAAiB,SAAS,OAAO,YAAY,OAAO;AACpD,0BAAoB,UAAU,kBAAkB,SAAS,GAAG;AAC5D,yBAAmB,UAAU,uBAAuB,MAAM,CAAC,GAAG,CAAC;AAE/D,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,MAAM,SAAS,OAAO;AAE5B,YAAM,IAAI,IAAI,gBAAgB,CAAC;AAC/B,gCAAO,EAAE,UAAU,KAAK,EAAE,KAAK,qBAAqB;AACpD,gCAAO,EAAE,UAAU,MAAM,EAAE,KAAK,gCAAgC;AAAA,IAClE,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,gBAAgB,MAAM;AAC7B,0BAAG,4CAA4C,MAAM;AACnD,YAAM,WAAW,IAAI,uBAAY,IAAI,MAAM;AAC3C,YAAM,OAAO,SAAS,WAAW;AAEjC,gCAAO,MAAM,KAAK,MAAM,IAAI,CAAC,EAAE,IAAI,QAAQ;AAE3C,gCAAO,IAAI,EAAE,UAAU,IAAI;AAE3B,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,gCAAO,OAAO,SAAS,EAAE,KAAK,WAAW;AACzC,gCAAO,OAAO,WAAW,EAAE,KAAK,KAAK;AAAA,IACvC,CAAC;AAAA,EACH,CAAC;AACH,CAAC;",
-  "names": []
-}