kirograph 0.28.0 → 0.28.1

package/dist/security/manifest/plugins/rubygems.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rubygems.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/rubygems.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAqE7B"}

package/dist/security/manifest/plugins/swift.d.ts

@@ -1,11 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a Package.swift manifest and extract package dependencies with
- * version constraints and resolved versions from Package.resolved.
- *
- * @param manifestPath - Absolute path to the Package.swift file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parseSwiftManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=swift.d.ts.map

package/dist/security/manifest/plugins/swift.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"swift.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/swift.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAkBpD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA6B7B"}

package/dist/security/owasp.d.ts

@@ -1,16 +0,0 @@
-/**
- * OWASP Top 10 (2021) Mapping Utility
- *
- * Maps CVE findings to OWASP categories and provides associated CWE IDs.
- */
-export type OwaspCategory = 'A01' | 'A02' | 'A03' | 'A04' | 'A05' | 'A06' | 'A07' | 'A08' | 'A09' | 'A10';
-export interface OwaspMapping {
-    category: OwaspCategory;
-    name: string;
-    description: string;
-    cweIds: number[];
-}
-export declare const OWASP_TOP_10: Record<OwaspCategory, OwaspMapping>;
-/** Map a CVE's summary/description to the most likely OWASP category. */
-export declare function mapCveToOwasp(summary: string, packageName: string): OwaspCategory;
-//# sourceMappingURL=owasp.d.ts.map

package/dist/security/owasp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"owasp.d.ts","sourceRoot":"","sources":["../../src/security/owasp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAE1G,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,YAAY,CA6D5D,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,CAWjF"}

package/dist/security/pipeline.d.ts

@@ -1,37 +0,0 @@
-/**
- * SecurityPipeline — Orchestrates the security analysis phases.
- *
- * Phases (in order):
- *   1. Manifest parsing — discover and parse dependency manifests
- *   2. Dependency integration — link dependencies to code symbols
- *   3. Vulnerability enrichment — query databases for CVEs (if securityAutoEnrich)
- *   4. Reachability analysis — determine if vulnerable code is reachable
- *
- * Reports progress via callback and returns a SecurityResult with counts and duration.
- *
- * Requirements: 9.3, 9.5
- */
-import type { GraphDatabase } from '../db/database';
-import type { KiroGraphConfig } from '../config';
-import type { SecurityResult } from './types';
-/**
- * SecurityPipeline orchestrates the full security analysis workflow.
- */
-export declare class SecurityPipeline {
-    private readonly db;
-    private readonly config;
-    private readonly projectRoot;
-    constructor(db: GraphDatabase, config: KiroGraphConfig, projectRoot: string);
-    /**
-     * Run the full security analysis pipeline.
-     *
-     * @param onProgress - Optional callback reporting (phase, current, total)
-     * @returns SecurityResult with counts and duration
-     */
-    run(onProgress?: (phase: string, current: number, total: number) => void): Promise<SecurityResult>;
-    /**
-     * Create vulnerability database adapters based on config.
-     */
-    private createVulnAdapters;
-}
-//# sourceMappingURL=pipeline.d.ts.map

package/dist/security/pipeline.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/security/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAQ9C;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM;IAM3E;;;;;OAKG;IACG,GAAG,CACP,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GACnE,OAAO,CAAC,cAAc,CAAC;IAmF1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAqB3B"}

package/dist/security/reachability.d.ts

@@ -1,67 +0,0 @@
-/**
- * KiroGraph-Sec Reachability Analyzer
- *
- * Traverses the knowledge graph from application entry points to determine
- * whether vulnerable dependencies are reachable through actual code paths.
- * Produces reachability verdicts and impact summaries enriched with
- * architectural layer context.
- *
- * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6, 5.1, 5.2, 5.3, 5.4, 5.5
- */
-import type { GraphDatabase } from '../db/database';
-import type { KiroGraphConfig } from '../config';
-import type { ReachabilityResult, ImpactSummary } from './types';
-/**
- * ReachabilityAnalyzer traverses the knowledge graph from entry points
- * toward affected dependency nodes to determine reachability verdicts.
- */
-export declare class ReachabilityAnalyzer {
-    private readonly db;
-    private readonly config;
-    constructor(db: GraphDatabase, config: KiroGraphConfig);
-    /**
-     * Analyze reachability for a single Vulnerability_Node.
-     *
-     * 1. Find the Dependency_Node linked via `has_vulnerability` edge
-     * 2. Find all Entry_Points in the graph
-     * 3. BFS from each entry point toward the dependency node
-     * 4. Assign verdict based on path existence and unresolved imports
-     *
-     * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6
-     */
-    analyze(vulnerabilityNodeId: string): Promise<ReachabilityResult>;
-    /**
-     * Produce impact summary for an affected vulnerability.
-     *
-     * Returns null if the vulnerability is not affected.
-     * Reads layer assignments from `arch_file_layers` table.
-     *
-     * Requirements: 5.1, 5.2, 5.3, 5.4, 5.5
-     */
-    getImpactSummary(vulnerabilityNodeId: string): Promise<ImpactSummary | null>;
-    /**
-     * Analyze all Vulnerability_Nodes in the graph.
-     *
-     * Iterates all vulnerability nodes and calls analyze() for each.
-     */
-    analyzeAll(): Promise<Map<string, ReachabilityResult>>;
-    /**
-     * BFS from a single entry point toward the dependency node.
-     *
-     * Uses outgoing edges of types: calls, imports, references.
-     * Visits each node at most once (handles cycles).
-     * Tracks unresolved imports encountered during traversal.
-     *
-     * Returns the shortest path if found, plus any unresolved symbols encountered.
-     */
-    private bfsFromEntryPoint;
-    /**
-     * Store reachability result in sec_reachability table.
-     */
-    private storeReachabilityResult;
-    /**
-     * Store impact summary in sec_impact table.
-     */
-    private storeImpactSummary;
-}
-//# sourceMappingURL=reachability.d.ts.map

package/dist/security/reachability.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reachability.d.ts","sourceRoot":"","sources":["../../src/security/reachability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAGV,kBAAkB,EAClB,aAAa,EACd,MAAM,SAAS,CAAC;AAWjB;;;GAGG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;gBAE7B,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe;IAKtD;;;;;;;;;OASG;IACG,OAAO,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmFvE;;;;;;;OAOG;IACG,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA2FlF;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAgB5D;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IA2DzB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAoB/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAkB3B"}

package/dist/security/remediation.d.ts

@@ -1,51 +0,0 @@
-/**
- * Remediation SLA Tracker
- *
- * Tracks how long open vulnerabilities have been known, when a fix became
- * available, and whether remediation is overdue based on severity-based SLA
- * thresholds.
- *
- * SLA thresholds:
- *   critical (CVSS ≥ 9)  → 7 days
- *   high     (CVSS ≥ 7)  → 30 days
- *   medium   (CVSS ≥ 4)  → 90 days
- *   low / unknown        → 180 days
- */
-import type { GraphDatabase } from '../db/database';
-export interface RemediationStatus {
-    cveId: string;
-    packageName: string;
-    severity: number | null;
-    riskScore: number | null;
-    firstDetectedAt: number | null;
-    daysOpen: number | null;
-    fixAvailableSince: number | null;
-    daysWithFixAvailable: number | null;
-    isOverdue: boolean;
-    slaStatus: 'ok' | 'warning' | 'overdue' | 'no_fix';
-    slaDeadline: number | null;
-}
-export declare class RemediationTracker {
-    private readonly db;
-    constructor(db: GraphDatabase);
-    /**
-     * Called when a vulnerability is first inserted.
-     * Sets first_detected_at if not already set, and fix_available_since if a
-     * fixed_version is provided and fix_available_since is not yet recorded.
-     */
-    markDetected(vulnNodeId: string, fixedVersion: string | null): void;
-    /**
-     * Get remediation status for all open (non-remediated, non-suppressed)
-     * vulnerabilities that have been detected.
-     */
-    getStatus(): RemediationStatus[];
-    /**
-     * SLA thresholds by CVSS severity:
-     *   critical (≥ 9)  → 7 days
-     *   high (≥ 7)      → 30 days
-     *   medium (≥ 4)    → 90 days
-     *   low / unknown   → 180 days
-     */
-    getSlaThresholdDays(severity: number | null): number;
-}
-//# sourceMappingURL=remediation.d.ts.map

package/dist/security/remediation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../src/security/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACnD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAID,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAE9C;;;;OAIG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAuBnE;;;OAGG;IACH,SAAS,IAAI,iBAAiB,EAAE;IAgFhC;;;;;;OAMG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM;CAOrD"}

package/dist/security/secrets.d.ts

@@ -1,38 +0,0 @@
-/**
- * KiroGraph-Sec Secrets Scanner
- *
- * Regex-based secret detection that scans source files and enriches findings
- * with call graph context (containing function + reachability from entry points).
- */
-import type { GraphDatabase } from '../db/database';
-export interface SecretFinding {
-    filePath: string;
-    line: number;
-    column: number;
-    type: string;
-    severity: 'critical' | 'high' | 'medium' | 'low';
-    /** Redacted: first 4 chars of the matched value + "****" */
-    snippet: string;
-    nodeId?: string;
-    nodeName?: string;
-    reachableFromEntryPoints: string[];
-    entryPointCount: number;
-}
-export interface SecretsResult {
-    findings: SecretFinding[];
-    filesScanned: number;
-    totalFindings: number;
-    criticalCount: number;
-    highCount: number;
-}
-export declare class SecretsScanner {
-    private readonly db;
-    private readonly projectRoot;
-    constructor(db: GraphDatabase, projectRoot: string);
-    scan(options?: {
-        includeTests?: boolean;
-    }): Promise<SecretsResult>;
-    private findContainingNode;
-    private findEntryPoints;
-}
-//# sourceMappingURL=secrets.d.ts.map

package/dist/security/secrets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/security/secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AA0DD,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,EAAE,EAAE,aAAa,EACjB,WAAW,EAAE,MAAM;IAGhC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAgGxE,OAAO,CAAC,kBAAkB;IAkB1B,OAAO,CAAC,eAAe;CAoBxB"}

package/dist/security/staleness.d.ts

@@ -1,43 +0,0 @@
-/**
- * Dependency Staleness Checker
- *
- * Queries public package registries (npm, PyPI, crates.io, RubyGems, Packagist)
- * to determine the latest published version and compute a staleness score for
- * each dependency tracked in sec_dependencies.
- *
- * Score formula:
- *   score = min(majorVersionsBehind * 0.2, 0.6)   // up to 0.6 for version lag
- *         + min(monthsSinceLatest / 36, 0.4)        // up to 0.4 for time lag
- *   score = min(score, 1.0)
- */
-import type { GraphDatabase } from '../db/database';
-export interface StalenessResult {
-    packageName: string;
-    ecosystem: string;
-    resolvedVersion: string;
-    latestVersion: string;
-    latestPublished: number;
-    stalenessScore: number;
-    majorVersionsBehind: number;
-    monthsSinceLatest: number;
-}
-export declare class StalenessChecker {
-    private readonly db;
-    constructor(db: GraphDatabase);
-    /**
-     * Check all dependencies in sec_dependencies that have a supported ecosystem.
-     * Returns a summary of checked/stale counts and any errors encountered.
-     */
-    checkAll(): Promise<{
-        checked: number;
-        stale: number;
-        errors: string[];
-    }>;
-    /**
-     * Check a single dependency by node_id. Returns null if the ecosystem is
-     * not supported or the dependency is not found.
-     */
-    checkOne(nodeId: string): Promise<StalenessResult | null>;
-    private _checkRow;
-}
-//# sourceMappingURL=staleness.d.ts.map

package/dist/security/staleness.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"staleness.d.ts","sourceRoot":"","sources":["../../src/security/staleness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAqJD,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAE9C;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA+B/E;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAqBjD,SAAS;CAkDxB"}

package/dist/security/supply-chain.d.ts

@@ -1,34 +0,0 @@
-/**
- * Supply Chain Health Checker
- *
- * Queries OpenSSF Scorecard and registry APIs to assess the health of
- * dependencies: maintenance activity, maintainer count, package age, and
- * overall supply-chain risk level.
- */
-import type { GraphDatabase } from '../db/database';
-export interface SupplyChainRisk {
-    packageName: string;
-    ecosystem: string;
-    nodeId: string;
-    scorecardScore: number | null;
-    scorecardChecks: Record<string, number> | null;
-    daysSinceLastCommit: number | null;
-    isAbandoned: boolean;
-    maintainerCount: number | null;
-    isSingleMaintainer: boolean;
-    publishedAt: string | null;
-    isVeryNew: boolean;
-    riskLevel: 'critical' | 'high' | 'medium' | 'low' | 'unknown';
-    riskReasons: string[];
-}
-export declare class SupplyChainChecker {
-    private readonly db;
-    constructor(db: GraphDatabase);
-    checkAll(): Promise<{
-        results: SupplyChainRisk[];
-        errors: string[];
-    }>;
-    checkOne(packageName: string, ecosystem: string): Promise<SupplyChainRisk | null>;
-    private _check;
-}
-//# sourceMappingURL=supply-chain.d.ts.map

package/dist/security/supply-chain.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"supply-chain.d.ts","sourceRoot":"","sources":["../../src/security/supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IAEf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAE/C,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,OAAO,CAAC;IAE5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IAEnB,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;IAC9D,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAuQD,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,QAAQ,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA2BrE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAUzE,MAAM;CAgErB"}

package/dist/security/suppressions.d.ts

@@ -1,18 +0,0 @@
-export interface Suppression {
-    cveId: string;
-    reason?: string;
-    suppressedAt: string;
-    expiresAt?: string;
-}
-export declare class SuppressionManager {
-    private readonly projectRoot;
-    constructor(projectRoot: string);
-    private get filePath();
-    load(): Suppression[];
-    save(suppressions: Suppression[]): void;
-    add(cveId: string, reason?: string, expiresAt?: string): void;
-    remove(cveId: string): boolean;
-    isSuppressed(cveId: string): boolean;
-    getActive(): Suppression[];
-}
-//# sourceMappingURL=suppressions.d.ts.map

package/dist/security/suppressions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/security/suppressions.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,MAAM;IAEhD,OAAO,KAAK,QAAQ,GAEnB;IAED,IAAI,IAAI,WAAW,EAAE;IA2BrB,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI;IAQvC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAoB7D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAS9B,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIpC,SAAS,IAAI,WAAW,EAAE;CAG3B"}

package/dist/security/types.d.ts

@@ -1,144 +0,0 @@
-/**
- * KiroGraph-Sec Type Definitions
- *
- * Interfaces for the security analysis module including manifest parsing,
- * vulnerability detection, reachability analysis, and CycloneDX export.
- */
-export interface ParsedDependency {
-    name: string;
-    declaredConstraint: string;
-    resolvedVersion?: string;
-    scope: 'production' | 'development' | 'optional';
-    ecosystem: string;
-    sourceManifest: string;
-    license?: string;
-}
-export interface ManifestParseResult {
-    dependenciesCreated: number;
-    manifestsParsed: number;
-    warnings: Array<{
-        file: string;
-        line?: number;
-        message: string;
-    }>;
-    errors: Array<{
-        file: string;
-        message: string;
-    }>;
-}
-export interface IntegrationResult {
-    importsEdgesCreated: number;
-    referencesEdgesCreated: number;
-}
-export interface TransitiveResult {
-    dependsOnEdgesCreated: number;
-    incompleteNodes: string[];
-}
-export interface CleanupResult {
-    nodesRemoved: number;
-    edgesRemoved: number;
-}
-export interface CVERecord {
-    id: string;
-    severity: number;
-    affectedVersionRanges: VersionRange[];
-    fixedVersion?: string;
-    summary: string;
-}
-export interface VersionRange {
-    introduced?: string;
-    fixed?: string;
-    lastAffected?: string;
-}
-export interface EnrichmentResult {
-    vulnerabilitiesFound: number;
-    dependenciesChecked: number;
-    errors: Array<{
-        dependency: string;
-        database: string;
-        error: string;
-    }>;
-    staleNodes: string[];
-}
-export type ReachabilityVerdict = 'affected' | 'not_affected' | 'under_investigation';
-export interface ReachabilityPath {
-    entryPoint: string;
-    path: string[];
-}
-export interface ReachabilityResult {
-    verdict: ReachabilityVerdict;
-    paths: ReachabilityPath[];
-    unresolvedSymbols: string[];
-    reachingEntryPointCount: number;
-}
-export interface ImpactSummary {
-    affectedLayers: string[];
-    affectedEntryPoints: string[];
-    distinctPathCount: number;
-}
-export interface SecurityResult {
-    manifestsDiscovered: number;
-    dependenciesCreated: number;
-    vulnerabilitiesFound: number;
-    affectedCount: number;
-    notAffectedCount: number;
-    underInvestigationCount: number;
-    duration: number;
-}
-export interface SBOMMetadata {
-    toolName: string;
-    toolVersion: string;
-    timestamp: string;
-    projectName: string;
-}
-export interface CycloneDXSBOM {
-    bomFormat: 'CycloneDX';
-    specVersion: '1.5';
-    version: number;
-    metadata: Record<string, unknown>;
-    components: CycloneDXComponent[];
-    dependencies: CycloneDXDependencyEntry[];
-}
-export interface CycloneDXComponent {
-    type: 'library';
-    name: string;
-    version: string;
-    purl: string;
-    scope?: 'required' | 'optional';
-    properties?: Array<{
-        name: string;
-        value: string;
-    }>;
-}
-export interface CycloneDXDependencyEntry {
-    ref: string;
-    dependsOn?: string[];
-}
-export interface CycloneDXVEX {
-    bomFormat: 'CycloneDX';
-    specVersion: '1.5';
-    version: number;
-    metadata: Record<string, unknown>;
-    vulnerabilities: CycloneDXVulnerability[];
-}
-export interface CycloneDXVulnerability {
-    id: string;
-    source?: {
-        name: string;
-        url?: string;
-    };
-    ratings?: Array<{
-        score: number;
-        severity?: string;
-        method?: string;
-    }>;
-    analysis?: {
-        state: 'affected' | 'not_affected' | 'under_investigation';
-        justification?: string;
-        detail?: string;
-    };
-    affects?: Array<{
-        ref: string;
-    }>;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/security/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,YAAY,GAAG,aAAa,GAAG,UAAU,CAAC;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAID,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAID,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,YAAY,EAAE,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,cAAc,GAAG,qBAAqB,CAAC;AAEtF,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,cAAc;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,YAAY,EAAE,wBAAwB,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAChC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,eAAe,EAAE,sBAAsB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,QAAQ,CAAC,EAAE;QACT,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,qBAAqB,CAAC;QAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClC"}

package/dist/security/vuln/client.d.ts

@@ -1,90 +0,0 @@
-/**
- * VulnerabilityDatabaseClient
- *
- * Orchestrates vulnerability enrichment by querying configured databases,
- * merging and deduplicating results by CVE identifier, creating Vulnerability_Nodes
- * linked to affected Dependency_Nodes, and handling unreachable databases gracefully.
- *
- * Requirements: 3.1, 3.2, 3.3, 3.4, 3.5, 3.7
- */
-import type { GraphDatabase } from '../../db/database';
-import type { CVERecord, EnrichmentResult } from '../types';
-import type { VulnDatabaseAdapter } from './types';
-/**
- * Compute a combined risk score (0.0–10.0) for a vulnerability.
- *
- * Formula:
- *   risk = reachability_factor × (0.4 × cvss_normalized + 0.6 × epss) × staleness_bonus
- *   scaled to 0–10: min(risk × 10, 10.0)
- *
- * @param cvss        - CVSS base score (0.0–10.0), null treated as 5.0
- * @param epss        - EPSS exploitation probability (0.0–1.0), null treated as 0.0
- * @param verdict     - Reachability verdict or null/undefined
- * @param staleness   - Dependency staleness score (0.0–1.0), null treated as 0.0
- */
-export declare function computeRiskScore(cvss: number | null | undefined, epss: number | null | undefined, verdict: string | null | undefined, staleness: number | null | undefined): number;
-export declare class VulnerabilityDatabaseClient {
-    private readonly adapters;
-    private readonly db;
-    private readonly timeoutMs;
-    constructor(adapters: VulnDatabaseAdapter[], db: GraphDatabase, timeoutMs?: number);
-    /**
-     * Enrich all Dependency_Nodes with vulnerability data.
-     *
-     * Uses batch queries (up to 1000 per HTTP request) when the adapter supports
-     * `queryBatch`. Falls back to sequential single queries per dependency if batch
-     * is unavailable or fails. Results are deduplicated by CVE ID across adapters.
-     */
-    enrichAll(): Promise<EnrichmentResult>;
-    /**
-     * Fetch EPSS scores for all stored vulnerabilities and update the database.
-     */
-    private enrichEpss;
-    /**
-     * Compute and persist combined risk scores for all stored vulnerabilities.
-     * Called after EPSS enrichment so epss_score values are up to date.
-     */
-    private computeRiskScores;
-    /**
-     * Batch enrichment path: groups deps into chunks of BATCH_CHUNK_SIZE and sends
-     * one HTTP request per chunk. Falls back to sequential on batch failure.
-     */
-    private enrichAllBatch;
-    /**
-     * Sequential enrichment path: queries one dependency at a time.
-     * Used when the adapter does not support queryBatch, or as a fallback.
-     */
-    private enrichAllSequential;
-    /**
-     * Enrich a single Dependency_Node with vulnerability data.
-     *
-     * @param dependencyNodeId - The node ID of the dependency to enrich
-     * @returns Array of CVE records found for this dependency
-     */
-    enrichOne(dependencyNodeId: string): Promise<CVERecord[]>;
-    /**
-     * Query a set of adapters for a single dependency.
-     * Handles timeouts and unreachable databases gracefully.
-     * Defaults to all configured adapters when adapterList is omitted.
-     */
-    private queryAdaptersForDependency;
-    /**
-     * Mark a dependency node as having stale vulnerability data.
-     * Retains cached data but sets the stale flag with timestamp.
-     */
-    private markDependencyStale;
-    /**
-     * Deduplicate CVE records by their ID.
-     * When the same CVE is reported by multiple databases, keep the first occurrence.
-     */
-    private deduplicateByCveId;
-    /**
-     * Create or update a Vulnerability_Node and link it to the affected dependency.
-     *
-     * - Creates a node in `nodes` table with kind='vulnerability', ID format `vuln:<cve_id>`
-     * - Inserts a row in `sec_vulnerabilities` with CVE metadata
-     * - Creates a `has_vulnerability` edge from the Dependency_Node to the Vulnerability_Node
-     */
-    private upsertVulnerabilityNode;
-}
-//# sourceMappingURL=client.d.ts.map

package/dist/security/vuln/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/security/vuln/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAc,MAAM,SAAS,CAAC;AAM/D;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,MAAM,CAoBR;AAaD,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGjC,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,EAAE,EAAE,aAAa,EACjB,SAAS,GAAE,MAAc;IAO3B;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA4C5C;;OAEG;YACW,UAAU;IA+BxB;;;OAGG;YACW,iBAAiB;IAsB/B;;;OAGG;YACW,cAAc;IA4C5B;;;OAGG;YACW,mBAAmB;IAkBjC;;;;;OAKG;IACG,SAAS,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAiD/D;;;;OAIG;YACW,0BAA0B;IA6CxC;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;CAuDhC"}

package/dist/security/vuln/epss-client.d.ts

@@ -1,26 +0,0 @@
-/**
- * EPSS (Exploit Prediction Scoring System) Client
- *
- * Fetches exploit prediction scores from the FIRST.org EPSS API for CVE IDs.
- * EPSS is non-critical: on error, an empty map is returned so the caller can
- * continue without scores.
- *
- * API: https://api.first.org/data/v1/epss
- */
-export declare class EpssClient {
-    /**
-     * Fetch EPSS scores for a list of CVE IDs.
-     *
-     * CVEs are batched into chunks of 500 per request. Missing CVEs simply do
-     * not appear in the response and are omitted from the returned map.
-     *
-     * @param cveIds - List of CVE identifiers (e.g. ["CVE-2021-44228", ...])
-     * @returns Map from CVE ID to { score, percentile } (floats in [0, 1])
-     */
-    fetchScores(cveIds: string[]): Promise<Map<string, {
-        score: number;
-        percentile: number;
-    }>>;
-    private fetchChunk;
-}
-//# sourceMappingURL=epss-client.d.ts.map

package/dist/security/vuln/epss-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"epss-client.d.ts","sourceRoot":"","sources":["../../../src/security/vuln/epss-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmBH,qBAAa,UAAU;IACrB;;;;;;;;OAQG;IACG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;YAwBlF,UAAU;CA2CzB"}

package/dist/security/vuln/index.d.ts

@@ -1,6 +0,0 @@
-/**
- * Vulnerability database subsystem exports.
- */
-export { VulnerabilityDatabaseClient } from './client';
-export type { VulnDatabaseAdapter } from './types';
-//# sourceMappingURL=index.d.ts.map

package/dist/security/vuln/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/vuln/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC"}