kirograph 0.27.2 → 0.28.1

package/dist/security/data-flows.d.ts

@@ -1,33 +0,0 @@
-/**
- * KiroGraph SAST-lite: Dangerous Data Flow Detection
- *
- * Detects dangerous patterns by analysing call edges in the graph database.
- * Uses symbol names and callee chains rather than full AST traversal.
- */
-import type { GraphDatabase } from '../db/database';
-import type { OwaspCategory } from './owasp';
-export interface DataFlowFinding {
-    type: 'sql-injection' | 'path-traversal' | 'xss' | 'dangerous-eval' | 'unsafe-deserialize' | 'hardcoded-crypto';
-    severity: 'critical' | 'high' | 'medium';
-    owaspCategory: OwaspCategory;
-    filePath: string;
-    line: number;
-    symbol: string;
-    description: string;
-    recommendation: string;
-}
-export declare class DataFlowAnalyzer {
-    private readonly db;
-    constructor(db: GraphDatabase);
-    analyze(): Promise<DataFlowFinding[]>;
-    private analyzeFromPatternMatches;
-    private _patternIdToType;
-    private _findEnclosingSymbol;
-    private _getRecommendation;
-    private _detectDangerousEval;
-    private _detectUnsafeDeserialize;
-    private _detectHardcodedCrypto;
-    private _detectSqlInjection;
-    private _detectPathTraversal;
-}
-//# sourceMappingURL=data-flows.d.ts.map

package/dist/security/data-flows.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"data-flows.d.ts","sourceRoot":"","sources":["../../src/security/data-flows.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAI7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,eAAe,GAAG,gBAAgB,GAAG,KAAK,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;IAChH,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAyBD,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,OAAO,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAwB3C,OAAO,CAAC,yBAAyB;IA8BjC,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,oBAAoB;IAyB5B,OAAO,CAAC,wBAAwB;IA8BhC,OAAO,CAAC,sBAAsB;IA0C9B,OAAO,CAAC,mBAAmB;IAoE3B,OAAO,CAAC,oBAAoB;CA8C7B"}

package/dist/security/dep-confusion.d.ts

@@ -1,23 +0,0 @@
-/**
- * Dependency Confusion Checker
- *
- * Detects internal packages whose names exist in public registries
- * (a supply chain attack vector), and flags typosquatting candidates.
- */
-import type { GraphDatabase } from '../db/database';
-export interface DepConfusionFinding {
-    packageName: string;
-    ecosystem: string;
-    internalSource: string;
-    publicExists: boolean;
-    publicVersion: string | null;
-    publicPublishedAt: string | null;
-    riskLevel: 'critical' | 'high' | 'medium';
-    explanation: string;
-}
-export declare class DepConfusionChecker {
-    private readonly db;
-    constructor(db: GraphDatabase);
-    check(): Promise<DepConfusionFinding[]>;
-}
-//# sourceMappingURL=dep-confusion.d.ts.map

package/dist/security/dep-confusion.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dep-confusion.d.ts","sourceRoot":"","sources":["../../src/security/dep-confusion.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;CACrB;AAoKD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,KAAK,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;CA0G9C"}

package/dist/security/errors.d.ts

@@ -1,16 +0,0 @@
-/**
- * KiroGraph-Sec Error Classes
- *
- * Security-specific error types extending the base KiroGraphError.
- */
-import { KiroGraphError } from '../errors';
-export declare class SecurityError extends KiroGraphError {
-    constructor(message: string, context?: Record<string, unknown>);
-}
-export declare class ManifestParseError extends KiroGraphError {
-    constructor(message: string, filePath: string, line?: number);
-}
-export declare class VulnDatabaseError extends KiroGraphError {
-    constructor(message: string, database: string, httpStatus?: number);
-}
-//# sourceMappingURL=errors.d.ts.map

package/dist/security/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/security/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,qBAAa,aAAc,SAAQ,cAAc;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED,qBAAa,kBAAmB,SAAQ,cAAc;gBACxC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;CAI7D;AAED,qBAAa,iBAAkB,SAAQ,cAAc;gBACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAInE"}

package/dist/security/export/fix-suggestions.d.ts

@@ -1,21 +0,0 @@
-/**
- * Fix Suggestion Builder
- *
- * Generates ecosystem-appropriate upgrade commands for vulnerabilities
- * that have a known fixed version. Reusable by CLI and MCP tools.
- */
-/**
- * Build an ecosystem-appropriate fix suggestion command.
- *
- * @param ecosystem - The package ecosystem (npm, maven, go, pypi, cargo)
- * @param packageName - The package name (for maven: groupId:artifactId)
- * @param fixedVersion - The version that fixes the vulnerability
- * @returns A formatted fix command string, or empty string if ecosystem is unknown
- */
-export declare function buildFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string): string;
-/**
- * Format a fix suggestion line for display.
- * Returns the formatted line with the 💡 prefix, or empty string if no fixed version.
- */
-export declare function formatFixSuggestion(ecosystem: string, packageName: string, fixedVersion: string | null | undefined): string;
-//# sourceMappingURL=fix-suggestions.d.ts.map

package/dist/security/export/fix-suggestions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fix-suggestions.d.ts","sourceRoot":"","sources":["../../../src/security/export/fix-suggestions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAuBvG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAI3H"}

package/dist/security/export/sbom.d.ts

@@ -1,33 +0,0 @@
-/**
- * SBOMExporter — CycloneDX 1.5 SBOM Generation
- *
- * Generates a CycloneDX 1.5 JSON Software Bill of Materials from the
- * Dependency_Graph stored in the KiroGraph database. Each Dependency_Node
- * becomes a component of type "library" with purl, scope, and
- * direct/transitive classification.
- *
- * Requirements: 6.1, 6.2, 6.3, 6.4, 6.5, 6.6, 6.7
- */
-import type { GraphDatabase } from '../../db/database';
-import type { CycloneDXSBOM } from '../types';
-/**
- * Generates CycloneDX 1.5 SBOM documents from the dependency graph.
- */
-export declare class SBOMExporter {
-    private readonly db;
-    private readonly projectRoot;
-    constructor(db: GraphDatabase, projectRoot: string);
-    /**
-     * Generate a CycloneDX 1.5 SBOM object.
-     */
-    export(): CycloneDXSBOM;
-    /**
-     * Export the SBOM as a pretty-printed JSON string.
-     */
-    exportJSON(): string;
-    /**
-     * Build CycloneDX metadata section.
-     */
-    private buildMetadata;
-}
-//# sourceMappingURL=sbom.d.ts.map

package/dist/security/export/sbom.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sbom.d.ts","sourceRoot":"","sources":["../../../src/security/export/sbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EACV,aAAa,EAId,MAAM,UAAU,CAAC;AAiHlB;;GAEG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAKlD;;OAEG;IACH,MAAM,IAAI,aAAa;IAsGvB;;OAEG;IACH,UAAU,IAAI,MAAM;IAKpB;;OAEG;IACH,OAAO,CAAC,aAAa;CA8BtB"}

package/dist/security/export/serialization.d.ts

@@ -1,62 +0,0 @@
-/**
- * CycloneDX serialization utilities for Dependency_Nodes.
- *
- * Provides serialize/deserialize between DependencyRow (sec_dependencies table)
- * and CycloneDX JSON component format, with partial failure resilience.
- *
- * Requirements: 8.2, 8.3, 8.4
- */
-import type { CycloneDXComponent } from '../types';
-/**
- * Represents a row from the sec_dependencies table.
- */
-export interface DependencyRow {
-    node_id: string;
-    ecosystem: string;
-    package_name: string;
-    declared_constraint: string;
-    resolved_version: string | null;
-    scope: 'production' | 'development' | 'optional';
-    transitive_status: 'complete' | 'incomplete';
-    last_vuln_check: number | null;
-    vuln_data_stale: number;
-    vuln_data_stale_since: number | null;
-    source_manifests: string;
-}
-/**
- * Error reported when a single node fails serialization/deserialization.
- */
-export interface SerializationError {
-    name: string;
-    reason: string;
-}
-/**
- * Converts a dependency database row to a CycloneDX component object.
- * Stores the declared constraint in a `properties` array entry with
- * name "kirograph:declaredConstraint".
- *
- * The purl format is: pkg:<ecosystem>/<name>@<version>
- */
-export declare function serializeDependencyToComponent(dep: DependencyRow): CycloneDXComponent;
-/**
- * Converts a CycloneDX component back to a dependency row.
- * Extracts the constraint from the properties array.
- */
-export declare function deserializeComponentToDependency(component: CycloneDXComponent): DependencyRow;
-/**
- * Serializes all dependencies, collecting errors for any that fail
- * without aborting the batch.
- */
-export declare function serializeAll(deps: DependencyRow[]): {
-    components: CycloneDXComponent[];
-    errors: SerializationError[];
-};
-/**
- * Deserializes all components back to dependency rows,
- * collecting errors for any that fail without aborting the batch.
- */
-export declare function deserializeAll(components: CycloneDXComponent[]): {
-    deps: DependencyRow[];
-    errors: SerializationError[];
-};
-//# sourceMappingURL=serialization.d.ts.map

package/dist/security/export/serialization.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serialization.d.ts","sourceRoot":"","sources":["../../../src/security/export/serialization.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAInD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,YAAY,GAAG,aAAa,GAAG,UAAU,CAAC;IACjD,iBAAiB,EAAE,UAAU,GAAG,YAAY,CAAC;IAC7C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAsBD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,aAAa,GAAG,kBAAkB,CAgCrF;AAID;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,SAAS,EAAE,kBAAkB,GAAG,aAAa,CA+C7F;AAID;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG;IACnD,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B,CAiBA;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG;IAChE,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B,CAiBA"}

package/dist/security/export/vex.d.ts

@@ -1,58 +0,0 @@
-/**
- * KiroGraph-Sec VEX Exporter
- *
- * Generates CycloneDX 1.5 VEX (Vulnerability Exploitability eXchange) documents
- * with reachability-informed vulnerability status. Each Vulnerability_Node is
- * mapped to a VEX entry with an analysis state derived from the reachability verdict.
- *
- * Requirements: 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 7.8
- */
-import type { GraphDatabase } from '../../db/database';
-import type { CycloneDXVEX } from '../types';
-/**
- * VEXExporter serializes vulnerability assessments with reachability verdicts
- * into CycloneDX 1.5 VEX format.
- */
-export declare class VEXExporter {
-    private readonly db;
-    private readonly projectRoot;
-    constructor(db: GraphDatabase, projectRoot: string);
-    /**
-     * Generate CycloneDX 1.5 VEX JSON object.
-     *
-     * Queries all Vulnerability_Nodes and their reachability verdicts,
-     * producing one VEX entry per vulnerability.
-     */
-    export(): CycloneDXVEX;
-    /**
-     * Export to pretty-printed JSON string.
-     */
-    exportJSON(): string;
-    /**
-     * Build a single CycloneDX vulnerability entry from a Vulnerability_Node.
-     *
-     * Maps reachability verdicts to CycloneDX analysis states:
-     * - affected → "affected" with path summary detail
-     * - not_affected → "not_affected" with justification "code_not_reachable"
-     * - under_investigation → "under_investigation" with unresolved symbols detail
-     * - no reachability data → "under_investigation" with pending analysis detail
-     */
-    private buildVulnerabilityEntry;
-    /**
-     * Build the analysis section based on the reachability verdict.
-     */
-    private buildAnalysis;
-    /**
-     * Build analysis detail for "affected" verdict.
-     *
-     * Includes: entry point count, layer count, shortest path length.
-     */
-    private buildAffectedAnalysis;
-    /**
-     * Build analysis detail for "under_investigation" verdict.
-     *
-     * Lists unresolved symbols or states pending analysis reason.
-     */
-    private buildUnderInvestigationAnalysis;
-}
-//# sourceMappingURL=vex.d.ts.map

package/dist/security/export/vex.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vex.d.ts","sourceRoot":"","sources":["../../../src/security/export/vex.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAA4C,MAAM,UAAU,CAAC;AAMvF;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAKlD;;;;;OAKG;IACH,MAAM,IAAI,YAAY;IAiDtB;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;;;;;;;OAQG;IACH,OAAO,CAAC,uBAAuB;IA6D/B;;OAEG;IACH,OAAO,CAAC,aAAa;IAgCrB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAuC7B;;;;OAIG;IACH,OAAO,CAAC,+BAA+B;CAoBxC"}

package/dist/security/index.d.ts

@@ -1,21 +0,0 @@
-/**
- * KiroGraph-Sec Module Index
- *
- * Exports all public interfaces, classes, and types for the security module.
- * Used by MCP tools, CLI commands, and pipeline integration.
- */
-export { SecurityPipeline } from './pipeline';
-export { ManifestParser } from './manifest/parser';
-export { DependencyGraphIntegrator } from './integrator';
-export { VulnerabilityDatabaseClient } from './vuln/client';
-export { OsvAdapter } from './vuln/osv-adapter';
-export type { VulnDatabaseAdapter } from './vuln/types';
-export { ReachabilityAnalyzer } from './reachability';
-export { SBOMExporter } from './export/sbom';
-export { VEXExporter } from './export/vex';
-export { buildFixSuggestion, formatFixSuggestion } from './export/fix-suggestions';
-export { getSecurityWarningsForNodes, formatSecurityWarnings } from './context-warnings';
-export type { SecurityWarning } from './context-warnings';
-export type { ParsedDependency, ManifestParseResult, IntegrationResult, TransitiveResult, CleanupResult, CVERecord, VersionRange, EnrichmentResult, ReachabilityVerdict, ReachabilityPath, ReachabilityResult, ImpactSummary, SecurityResult, SBOMMetadata, CycloneDXSBOM, CycloneDXComponent, CycloneDXDependencyEntry, CycloneDXVEX, CycloneDXVulnerability, } from './types';
-export { SecurityError, ManifestParseError, VulnDatabaseError } from './errors';
-//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAG9C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAGzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGnF,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACzF,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,wBAAwB,EACxB,YAAY,EACZ,sBAAsB,GACvB,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/security/integrator.d.ts

@@ -1,63 +0,0 @@
-import type { GraphDatabase } from '../db/database';
-import type { IntegrationResult, TransitiveResult, CleanupResult } from './types';
-export declare class DependencyGraphIntegrator {
-    private readonly db;
-    private readonly projectRoot;
-    constructor(db: GraphDatabase, projectRoot: string);
-    /**
-     * Create import/reference edges between code symbols and Dependency_Nodes.
-     *
-     * Per Requirement 2.1: creates `imports` edges from file nodes that contain
-     * import statements resolving to a dependency → the Dependency_Node.
-     *
-     * Per Requirement 2.2: creates `references` edges from code symbols that
-     * reference classes/functions from a dependency → the Dependency_Node.
-     */
-    integrate(): Promise<IntegrationResult>;
-    /**
-     * Find the file node ID for a given file path.
-     * File nodes have kind='file' and their file_path matches.
-     */
-    private findFileNodeId;
-    /**
-     * Match an import specifier to a dependency node ID.
-     *
-     * Handles:
-     * - Exact match: `express` → dep:npm:express
-     * - Scoped packages: `@scope/pkg` → dep:npm:@scope/pkg
-     * - Subpath imports: `express/Router` → dep:npm:express
-     * - Scoped subpath: `@angular/core/testing` → dep:npm:@angular/core
-     * - Go modules: `github.com/gin-gonic/gin` → dep:go:github.com/gin-gonic/gin
-     * - Go subpath: `github.com/gin-gonic/gin/internal` → dep:go:github.com/gin-gonic/gin
-     */
-    private matchImportToDependency;
-    /**
-     * Resolve transitive dependencies up to maxDepth levels.
-     *
-     * For each ecosystem with a lock file:
-     * 1. Parse the lock file to extract dependency relationships
-     * 2. Create `depends_on` edges between Dependency_Nodes
-     * 3. Traverse up to maxDepth levels of transitive depth
-     *
-     * If a lock file is missing for an ecosystem, mark all dependencies of that
-     * ecosystem with `transitive_status: 'incomplete'` and log a warning.
-     *
-     * @param maxDepth - Maximum levels of transitive depth to resolve (default: 10)
-     */
-    resolveTransitives(maxDepth?: number): Promise<TransitiveResult>;
-    /**
-     * Remove orphaned Dependency_Nodes and their edges.
-     *
-     * A Dependency_Node is orphaned if:
-     * 1. It has no `declared_in` edges (manifest no longer declares it), OR
-     * 2. None of its source manifests still exist on disk
-     *
-     * Also removes transitive Dependency_Nodes that are no longer reachable from
-     * any remaining direct dependency via `depends_on` edges.
-     *
-     * @param manifestExists - Optional function to check if a manifest path exists.
-     *   Defaults to fs.existsSync. Useful for testing.
-     */
-    cleanup(manifestExists?: (absolutePath: string) => boolean): Promise<CleanupResult>;
-}
-//# sourceMappingURL=integrator.d.ts.map

package/dist/security/integrator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"integrator.d.ts","sourceRoot":"","sources":["../../src/security/integrator.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAmNlF,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAKlD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAwG7C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,uBAAuB;IAmD/B;;;;;;;;;;;;OAYG;IACG,kBAAkB,CAAC,QAAQ,GAAE,MAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAmI1E;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;CA2G1F"}

package/dist/security/license.d.ts

@@ -1,33 +0,0 @@
-/**
- * License Compliance Checker for KiroGraph-Sec
- *
- * Checks project dependencies against a license policy (deny/warn lists).
- * Supports case-insensitive matching and wildcard patterns (e.g. GPL-* matches
- * GPL-2.0, GPL-3.0-only, etc.).
- */
-export interface LicenseViolation {
-    packageName: string;
-    ecosystem: string;
-    license: string;
-    severity: 'deny' | 'warn';
-}
-/**
- * Check a list of dependencies against a license policy.
- *
- * Dependencies with no license are skipped (no violation).
- * A license matched in `deny` produces a 'deny' violation.
- * A license matched in `warn` (and not in `deny`) produces a 'warn' violation.
- *
- * @param deps - Array of dependency rows from sec_dependencies
- * @param policy - The license policy with deny and warn lists
- * @returns Array of violations sorted by severity (deny first) then package name
- */
-export declare function checkLicensePolicy(deps: Array<{
-    package_name: string;
-    ecosystem: string;
-    license: string | null;
-}>, policy: {
-    deny: string[];
-    warn: string[];
-}): LicenseViolation[];
-//# sourceMappingURL=license.d.ts.map

package/dist/security/license.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../../src/security/license.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AAmCD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,KAAK,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,EAChF,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GACzC,gBAAgB,EAAE,CAkCpB"}

package/dist/security/manifest/adapter.d.ts

@@ -1,92 +0,0 @@
-import type { ManifestParser as ArchManifestParser } from '../../architecture/types';
-import type { ParsedDependency, ManifestParseResult } from '../types';
-/**
- * A version extraction plugin provides ecosystem-specific logic to extract
- * version constraints and scopes from manifest files. Each plugin corresponds
- * to one or more architecture parsers and enhances their output with security-
- * relevant metadata.
- */
-export interface VersionExtractionPlugin {
-    /** Ecosystem identifier matching the architecture parser name (e.g. 'npm', 'maven', 'go') */
-    ecosystem: string;
-    /** Manifest filenames this plugin handles (should match the architecture parser's manifestFiles) */
-    manifestFiles: string[];
-    /** Returns true if this plugin can handle the given manifest file path */
-    canExtract(manifestPath: string): boolean;
-    /**
-     * Extract version constraints and scopes from a manifest file.
-     * This is called AFTER the architecture parser has already discovered the manifest.
-     * The plugin receives the manifest path and project root, and returns detailed
-     * dependency information including versions and scopes.
-     */
-    extract(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-}
-export declare class SecurityManifestAdapter {
-    private readonly archParsers;
-    private readonly plugins;
-    /** Standalone plugins have no corresponding architecture parser — they own their own discovery. */
-    private readonly standalonePlugins;
-    private readonly projectRoot;
-    constructor(projectRoot: string);
-    /**
-     * Register a version extraction plugin for an ecosystem that has a
-     * corresponding architecture parser. The plugin's `ecosystem` field
-     * must equal the architecture parser's `name` for the lookup to work.
-     */
-    registerPlugin(plugin: VersionExtractionPlugin): void;
-    /**
-     * Register a standalone version extraction plugin for an ecosystem that
-     * has NO corresponding architecture parser. The plugin's `manifestFiles`
-     * list drives discovery — the adapter will scan for those filenames and
-     * invoke the plugin directly when found.
-     */
-    registerStandalonePlugin(plugin: VersionExtractionPlugin): void;
-    /**
-     * Get all registered version extraction plugins (wrapped + standalone).
-     */
-    getPlugins(): VersionExtractionPlugin[];
-    /**
-     * Get the architecture parsers being wrapped.
-     */
-    getArchParsers(): ArchManifestParser[];
-    /**
-     * Discover all manifest files in the project tree.
-     * Includes files known to architecture parsers AND files from standalone plugins.
-     * Returns absolute paths.
-     */
-    discoverManifests(): string[];
-    /**
-     * Run full discovery and extraction:
-     * 1. Discover manifest files (reusing architecture's SKIP_DIRS logic)
-     * 2. For each manifest, find the matching architecture parser
-     * 3. If a version extraction plugin is registered for that ecosystem,
-     *    use it to extract detailed version/scope information
-     * 4. Otherwise, fall back to basic extraction from the architecture parser's
-     *    ArchPackage.externalDeps (names only, no version info)
-     */
-    extractAll(): Promise<ManifestParseResult>;
-    /**
-     * Extract dependencies for a single manifest file.
-     * Tries standalone plugins first (when there is no arch parser), then
-     * wrapped plugins, then falls back to arch parser output.
-     */
-    extractFromManifest(manifestPath: string): Promise<ParsedDependency[]>;
-    /**
-     * Get the ecosystem name for a given manifest file path.
-     * Returns undefined if no parser handles this file.
-     */
-    getEcosystem(manifestPath: string): string | undefined;
-    /**
-     * Fallback extraction: converts ArchPackage.externalDeps (names only) into
-     * ParsedDependency records with empty version constraints and default scope.
-     */
-    private _fallbackExtract;
-    /**
-     * Walk the project directory tree looking for manifest files.
-     * Mirrors the architecture module's _findManifests() logic, respecting SKIP_DIRS.
-     * Includes manifest filenames from standalone plugins in addition to arch parsers.
-     */
-    private _findManifests;
-    private _walkDir;
-}
-//# sourceMappingURL=adapter.d.ts.map

package/dist/security/manifest/adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../src/security/manifest/adapter.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,IAAI,kBAAkB,EAAe,MAAM,0BAA0B,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAItE;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,0EAA0E;IAC1E,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1C;;;;;OAKG;IACH,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CACjF;AAYD,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmD;IAC3E,mGAAmG;IACnG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmD;IACrF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,WAAW,EAAE,MAAM;IAK/B;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAIrD;;;;;OAKG;IACH,wBAAwB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAI/D;;OAEG;IACH,UAAU,IAAI,uBAAuB,EAAE;IAIvC;;OAEG;IACH,cAAc,IAAI,kBAAkB,EAAE;IAItC;;;;OAIG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAI7B;;;;;;;;OAQG;IACG,UAAU,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAqDhD;;;;OAIG;IACG,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyB5E;;;OAGG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAOtD;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAqBxB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,QAAQ;CAsBjB"}

package/dist/security/manifest/parser.d.ts

@@ -1,73 +0,0 @@
-/**
- * ManifestParser Orchestrator
- *
- * Orchestrates manifest discovery, version extraction, deduplication, and
- * database persistence. Uses the SecurityManifestAdapter for discovery and
- * extraction, registers all 12 version extraction plugins:
- *   Wrapped (arch parser exists): npm, maven, go, pip, cargo, nuget, gradle
- *   Standalone (no arch parser):  rubygems, composer, swift, pubspec, hex
- *
- * Node ID format: `dep:<ecosystem>:<name>` (e.g. `dep:npm:express`)
- */
-import { SecurityManifestAdapter } from './adapter';
-import type { GraphDatabase } from '../../db/database';
-import type { ParsedDependency, ManifestParseResult } from '../types';
-/**
- * Compare two version strings. Returns:
- *  - positive if a > b
- *  - negative if a < b
- *  - 0 if equal
- *
- * Handles semver-like versions (1.2.3), Go pseudo-versions, and constraint
- * strings. Falls back to lexicographic comparison for non-numeric versions.
- */
-export declare function compareVersions(a: string, b: string): number;
-/**
- * A deduplicated dependency entry combining data from multiple manifests.
- */
-interface DeduplicatedDependency {
-    name: string;
-    ecosystem: string;
-    /** The highest declared constraint across all manifests */
-    declaredConstraint: string;
-    /** The highest resolved version across all manifests (if any) */
-    resolvedVersion?: string;
-    /** Scope from the manifest with the highest version */
-    scope: ParsedDependency['scope'];
-    /** All source manifests that declared this dependency */
-    sourceManifests: string[];
-    /** License from manifest, if available */
-    license?: string;
-}
-/**
- * Deduplicate dependencies by (name, ecosystem) pair, keeping the entry
- * with the highest version and collecting all source manifests.
- */
-export declare function deduplicateDependencies(deps: ParsedDependency[]): DeduplicatedDependency[];
-/**
- * ManifestParser orchestrates manifest discovery, parsing, deduplication,
- * and database persistence for the security module.
- */
-export declare class ManifestParser {
-    private readonly adapter;
-    private readonly db;
-    private readonly projectRoot;
-    constructor(db: GraphDatabase, projectRoot: string);
-    /**
-     * Get the underlying adapter (useful for testing).
-     */
-    getAdapter(): SecurityManifestAdapter;
-    /**
-     * Run full manifest discovery, parsing, deduplication, and database persistence.
-     *
-     * Steps:
-     * 1. Discover manifest files via the adapter (reuses architecture parsers)
-     * 2. Extract dependencies with version/scope data via registered plugins
-     * 3. Deduplicate: same (name, ecosystem) → single entry with highest version
-     * 4. Create Dependency_Nodes in the database (nodes + sec_dependencies tables)
-     * 5. Create `declared_in` edges linking dependencies to their source manifests
-     */
-    parseAll(): Promise<ManifestParseResult>;
-}
-export {};
-//# sourceMappingURL=parser.d.ts.map

package/dist/security/manifest/parser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../../src/security/manifest/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,uBAAuB,EAAgC,MAAM,WAAW,CAAC;AAclF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAiLtE;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAyC5D;AAYD;;GAEG;AACH,UAAU,sBAAsB;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACjC,yDAAyD;IACzD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,sBAAsB,EAAE,CA2C1F;AAID;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM;IAuBlD;;OAEG;IACH,UAAU,IAAI,uBAAuB;IAIrC;;;;;;;;;OASG;IACG,QAAQ,IAAI,OAAO,CAAC,mBAAmB,CAAC;CAkH/C"}

package/dist/security/manifest/plugins/cargo.d.ts

@@ -1,11 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a Cargo.toml manifest and extract dependency declarations
- * with version constraints, scopes, and resolved versions from Cargo.lock.
- *
- * @param manifestPath - Absolute path to the Cargo.toml file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parseCargoManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=cargo.d.ts.map

package/dist/security/manifest/plugins/cargo.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cargo.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/cargo.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAkBpD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuC7B"}

package/dist/security/manifest/plugins/composer.d.ts

@@ -1,11 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a composer.json manifest and extract package declarations with
- * version constraints, scopes, and resolved versions from composer.lock.
- *
- * @param manifestPath - Absolute path to the composer.json file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parseComposerManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=composer.d.ts.map

package/dist/security/manifest/plugins/composer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"composer.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/composer.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAoE7B"}

package/dist/security/manifest/plugins/go.d.ts

@@ -1,12 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a go.mod manifest and extract dependency declarations with version
- * information. In Go modules, the version declared in go.mod is the resolved
- * version (pinned), so declaredConstraint and resolvedVersion are the same.
- *
- * @param manifestPath - Absolute path to the go.mod file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version information
- */
-export declare function parseGoManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=go.d.ts.map

package/dist/security/manifest/plugins/go.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/go.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA0C7B"}