kirograph 0.28.0 → 1.0.0

package/dist/security/manifest/plugins/gradle.d.ts

@@ -1,12 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a Gradle build script (`build.gradle` or `build.gradle.kts`) and extract
- * dependency declarations with version constraints, scopes, and resolved versions
- * from `gradle.lockfile`.
- *
- * @param manifestPath - Absolute path to the build.gradle or build.gradle.kts file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parseGradleManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=gradle.d.ts.map

package/dist/security/manifest/plugins/gradle.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gradle.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/gradle.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA0CpD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAmD7B"}

package/dist/security/manifest/plugins/hex.d.ts

@@ -1,11 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a mix.exs manifest and extract package declarations with
- * version constraints, scopes, and resolved versions from mix.lock.
- *
- * @param manifestPath - Absolute path to the mix.exs file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parseHexManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=hex.d.ts.map

package/dist/security/manifest/plugins/hex.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hex.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/hex.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAiC7B"}

package/dist/security/manifest/plugins/maven.d.ts

@@ -1,11 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a Maven pom.xml manifest and extract dependency declarations
- * with groupId, artifactId, version constraints, and scopes.
- *
- * @param manifestPath - Absolute path to the pom.xml file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parseMavenManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=maven.d.ts.map

package/dist/security/manifest/plugins/maven.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"maven.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/maven.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAyCpD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA8E7B"}

package/dist/security/manifest/plugins/npm.d.ts

@@ -1,11 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse an npm package.json manifest and extract dependency declarations
- * with version constraints, scopes, and resolved versions from lock files.
- *
- * @param manifestPath - Absolute path to the package.json file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parseNpmManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=npm.d.ts.map

package/dist/security/manifest/plugins/npm.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/npm.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAgBpD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAsG7B"}

package/dist/security/manifest/plugins/nuget.d.ts

@@ -1,12 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a .csproj manifest and extract NuGet dependency declarations
- * with version constraints, scopes, and resolved versions from packages.lock.json.
- * Also parses a packages.config in the same directory if present.
- *
- * @param manifestPath - Absolute path to the .csproj file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parseNugetManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=nuget.d.ts.map

package/dist/security/manifest/plugins/nuget.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"nuget.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/nuget.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA6D7B"}

package/dist/security/manifest/plugins/pip.d.ts

@@ -1,11 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a pip requirements.txt manifest and extract dependency declarations
- * with version constraints.
- *
- * @param manifestPath - Absolute path to the requirements.txt file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parsePipManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=pip.d.ts.map

package/dist/security/manifest/plugins/pip.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pip.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/pip.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAyBpD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAwC7B"}

package/dist/security/manifest/plugins/pubspec.d.ts

@@ -1,11 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a pubspec.yaml manifest and extract package declarations with
- * version constraints, scopes, and resolved versions from pubspec.lock.
- *
- * @param manifestPath - Absolute path to the pubspec.yaml file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parsePubspecManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=pubspec.d.ts.map

package/dist/security/manifest/plugins/pubspec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pubspec.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/pubspec.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA4C7B"}

package/dist/security/manifest/plugins/pyproject.d.ts

@@ -1,3 +0,0 @@
-import type { ParsedDependency } from '../../types';
-export declare function parsePyprojectManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=pyproject.d.ts.map

package/dist/security/manifest/plugins/pyproject.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pyproject.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/pyproject.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAOpD,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAiE7B"}

package/dist/security/manifest/plugins/rubygems.d.ts

@@ -1,11 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a Gemfile manifest and extract gem declarations with version constraints,
- * scopes, and resolved versions from Gemfile.lock.
- *
- * @param manifestPath - Absolute path to the Gemfile
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parseRubygemsManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=rubygems.d.ts.map

package/dist/security/manifest/plugins/rubygems.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rubygems.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/rubygems.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AASpD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAqE7B"}

package/dist/security/manifest/plugins/swift.d.ts

@@ -1,11 +0,0 @@
-import type { ParsedDependency } from '../../types';
-/**
- * Parse a Package.swift manifest and extract package dependencies with
- * version constraints and resolved versions from Package.resolved.
- *
- * @param manifestPath - Absolute path to the Package.swift file
- * @param projectRoot - Absolute path to the project root directory
- * @returns Array of parsed dependencies with version and scope information
- */
-export declare function parseSwiftManifest(manifestPath: string, projectRoot: string): Promise<ParsedDependency[]>;
-//# sourceMappingURL=swift.d.ts.map

package/dist/security/manifest/plugins/swift.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"swift.d.ts","sourceRoot":"","sources":["../../../../src/security/manifest/plugins/swift.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAkBpD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA6B7B"}

package/dist/security/owasp.d.ts

@@ -1,16 +0,0 @@
-/**
- * OWASP Top 10 (2021) Mapping Utility
- *
- * Maps CVE findings to OWASP categories and provides associated CWE IDs.
- */
-export type OwaspCategory = 'A01' | 'A02' | 'A03' | 'A04' | 'A05' | 'A06' | 'A07' | 'A08' | 'A09' | 'A10';
-export interface OwaspMapping {
-    category: OwaspCategory;
-    name: string;
-    description: string;
-    cweIds: number[];
-}
-export declare const OWASP_TOP_10: Record<OwaspCategory, OwaspMapping>;
-/** Map a CVE's summary/description to the most likely OWASP category. */
-export declare function mapCveToOwasp(summary: string, packageName: string): OwaspCategory;
-//# sourceMappingURL=owasp.d.ts.map

package/dist/security/owasp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"owasp.d.ts","sourceRoot":"","sources":["../../src/security/owasp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;AAE1G,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,YAAY,CA6D5D,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,CAWjF"}

package/dist/security/pipeline.d.ts

@@ -1,37 +0,0 @@
-/**
- * SecurityPipeline — Orchestrates the security analysis phases.
- *
- * Phases (in order):
- *   1. Manifest parsing — discover and parse dependency manifests
- *   2. Dependency integration — link dependencies to code symbols
- *   3. Vulnerability enrichment — query databases for CVEs (if securityAutoEnrich)
- *   4. Reachability analysis — determine if vulnerable code is reachable
- *
- * Reports progress via callback and returns a SecurityResult with counts and duration.
- *
- * Requirements: 9.3, 9.5
- */
-import type { GraphDatabase } from '../db/database';
-import type { KiroGraphConfig } from '../config';
-import type { SecurityResult } from './types';
-/**
- * SecurityPipeline orchestrates the full security analysis workflow.
- */
-export declare class SecurityPipeline {
-    private readonly db;
-    private readonly config;
-    private readonly projectRoot;
-    constructor(db: GraphDatabase, config: KiroGraphConfig, projectRoot: string);
-    /**
-     * Run the full security analysis pipeline.
-     *
-     * @param onProgress - Optional callback reporting (phase, current, total)
-     * @returns SecurityResult with counts and duration
-     */
-    run(onProgress?: (phase: string, current: number, total: number) => void): Promise<SecurityResult>;
-    /**
-     * Create vulnerability database adapters based on config.
-     */
-    private createVulnAdapters;
-}
-//# sourceMappingURL=pipeline.d.ts.map

package/dist/security/pipeline.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/security/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAQ9C;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM;IAM3E;;;;;OAKG;IACG,GAAG,CACP,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GACnE,OAAO,CAAC,cAAc,CAAC;IAmF1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAqB3B"}

package/dist/security/reachability.d.ts

@@ -1,67 +0,0 @@
-/**
- * KiroGraph-Sec Reachability Analyzer
- *
- * Traverses the knowledge graph from application entry points to determine
- * whether vulnerable dependencies are reachable through actual code paths.
- * Produces reachability verdicts and impact summaries enriched with
- * architectural layer context.
- *
- * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6, 5.1, 5.2, 5.3, 5.4, 5.5
- */
-import type { GraphDatabase } from '../db/database';
-import type { KiroGraphConfig } from '../config';
-import type { ReachabilityResult, ImpactSummary } from './types';
-/**
- * ReachabilityAnalyzer traverses the knowledge graph from entry points
- * toward affected dependency nodes to determine reachability verdicts.
- */
-export declare class ReachabilityAnalyzer {
-    private readonly db;
-    private readonly config;
-    constructor(db: GraphDatabase, config: KiroGraphConfig);
-    /**
-     * Analyze reachability for a single Vulnerability_Node.
-     *
-     * 1. Find the Dependency_Node linked via `has_vulnerability` edge
-     * 2. Find all Entry_Points in the graph
-     * 3. BFS from each entry point toward the dependency node
-     * 4. Assign verdict based on path existence and unresolved imports
-     *
-     * Requirements: 4.1, 4.2, 4.3, 4.4, 4.6
-     */
-    analyze(vulnerabilityNodeId: string): Promise<ReachabilityResult>;
-    /**
-     * Produce impact summary for an affected vulnerability.
-     *
-     * Returns null if the vulnerability is not affected.
-     * Reads layer assignments from `arch_file_layers` table.
-     *
-     * Requirements: 5.1, 5.2, 5.3, 5.4, 5.5
-     */
-    getImpactSummary(vulnerabilityNodeId: string): Promise<ImpactSummary | null>;
-    /**
-     * Analyze all Vulnerability_Nodes in the graph.
-     *
-     * Iterates all vulnerability nodes and calls analyze() for each.
-     */
-    analyzeAll(): Promise<Map<string, ReachabilityResult>>;
-    /**
-     * BFS from a single entry point toward the dependency node.
-     *
-     * Uses outgoing edges of types: calls, imports, references.
-     * Visits each node at most once (handles cycles).
-     * Tracks unresolved imports encountered during traversal.
-     *
-     * Returns the shortest path if found, plus any unresolved symbols encountered.
-     */
-    private bfsFromEntryPoint;
-    /**
-     * Store reachability result in sec_reachability table.
-     */
-    private storeReachabilityResult;
-    /**
-     * Store impact summary in sec_impact table.
-     */
-    private storeImpactSummary;
-}
-//# sourceMappingURL=reachability.d.ts.map

package/dist/security/reachability.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reachability.d.ts","sourceRoot":"","sources":["../../src/security/reachability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAGV,kBAAkB,EAClB,aAAa,EACd,MAAM,SAAS,CAAC;AAWjB;;;GAGG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;gBAE7B,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe;IAKtD;;;;;;;;;OASG;IACG,OAAO,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmFvE;;;;;;;OAOG;IACG,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IA2FlF;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAgB5D;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IA2DzB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAoB/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAkB3B"}

package/dist/security/remediation.d.ts

@@ -1,51 +0,0 @@
-/**
- * Remediation SLA Tracker
- *
- * Tracks how long open vulnerabilities have been known, when a fix became
- * available, and whether remediation is overdue based on severity-based SLA
- * thresholds.
- *
- * SLA thresholds:
- *   critical (CVSS ≥ 9)  → 7 days
- *   high     (CVSS ≥ 7)  → 30 days
- *   medium   (CVSS ≥ 4)  → 90 days
- *   low / unknown        → 180 days
- */
-import type { GraphDatabase } from '../db/database';
-export interface RemediationStatus {
-    cveId: string;
-    packageName: string;
-    severity: number | null;
-    riskScore: number | null;
-    firstDetectedAt: number | null;
-    daysOpen: number | null;
-    fixAvailableSince: number | null;
-    daysWithFixAvailable: number | null;
-    isOverdue: boolean;
-    slaStatus: 'ok' | 'warning' | 'overdue' | 'no_fix';
-    slaDeadline: number | null;
-}
-export declare class RemediationTracker {
-    private readonly db;
-    constructor(db: GraphDatabase);
-    /**
-     * Called when a vulnerability is first inserted.
-     * Sets first_detected_at if not already set, and fix_available_since if a
-     * fixed_version is provided and fix_available_since is not yet recorded.
-     */
-    markDetected(vulnNodeId: string, fixedVersion: string | null): void;
-    /**
-     * Get remediation status for all open (non-remediated, non-suppressed)
-     * vulnerabilities that have been detected.
-     */
-    getStatus(): RemediationStatus[];
-    /**
-     * SLA thresholds by CVSS severity:
-     *   critical (≥ 9)  → 7 days
-     *   high (≥ 7)      → 30 days
-     *   medium (≥ 4)    → 90 days
-     *   low / unknown   → 180 days
-     */
-    getSlaThresholdDays(severity: number | null): number;
-}
-//# sourceMappingURL=remediation.d.ts.map

package/dist/security/remediation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../src/security/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACnD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAID,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAE9C;;;;OAIG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAuBnE;;;OAGG;IACH,SAAS,IAAI,iBAAiB,EAAE;IAgFhC;;;;;;OAMG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM;CAOrD"}

package/dist/security/secrets.d.ts

@@ -1,38 +0,0 @@
-/**
- * KiroGraph-Sec Secrets Scanner
- *
- * Regex-based secret detection that scans source files and enriches findings
- * with call graph context (containing function + reachability from entry points).
- */
-import type { GraphDatabase } from '../db/database';
-export interface SecretFinding {
-    filePath: string;
-    line: number;
-    column: number;
-    type: string;
-    severity: 'critical' | 'high' | 'medium' | 'low';
-    /** Redacted: first 4 chars of the matched value + "****" */
-    snippet: string;
-    nodeId?: string;
-    nodeName?: string;
-    reachableFromEntryPoints: string[];
-    entryPointCount: number;
-}
-export interface SecretsResult {
-    findings: SecretFinding[];
-    filesScanned: number;
-    totalFindings: number;
-    criticalCount: number;
-    highCount: number;
-}
-export declare class SecretsScanner {
-    private readonly db;
-    private readonly projectRoot;
-    constructor(db: GraphDatabase, projectRoot: string);
-    scan(options?: {
-        includeTests?: boolean;
-    }): Promise<SecretsResult>;
-    private findContainingNode;
-    private findEntryPoints;
-}
-//# sourceMappingURL=secrets.d.ts.map

package/dist/security/secrets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/security/secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AA0DD,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,EAAE,EAAE,aAAa,EACjB,WAAW,EAAE,MAAM;IAGhC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAgGxE,OAAO,CAAC,kBAAkB;IAkB1B,OAAO,CAAC,eAAe;CAoBxB"}

package/dist/security/staleness.d.ts

@@ -1,43 +0,0 @@
-/**
- * Dependency Staleness Checker
- *
- * Queries public package registries (npm, PyPI, crates.io, RubyGems, Packagist)
- * to determine the latest published version and compute a staleness score for
- * each dependency tracked in sec_dependencies.
- *
- * Score formula:
- *   score = min(majorVersionsBehind * 0.2, 0.6)   // up to 0.6 for version lag
- *         + min(monthsSinceLatest / 36, 0.4)        // up to 0.4 for time lag
- *   score = min(score, 1.0)
- */
-import type { GraphDatabase } from '../db/database';
-export interface StalenessResult {
-    packageName: string;
-    ecosystem: string;
-    resolvedVersion: string;
-    latestVersion: string;
-    latestPublished: number;
-    stalenessScore: number;
-    majorVersionsBehind: number;
-    monthsSinceLatest: number;
-}
-export declare class StalenessChecker {
-    private readonly db;
-    constructor(db: GraphDatabase);
-    /**
-     * Check all dependencies in sec_dependencies that have a supported ecosystem.
-     * Returns a summary of checked/stale counts and any errors encountered.
-     */
-    checkAll(): Promise<{
-        checked: number;
-        stale: number;
-        errors: string[];
-    }>;
-    /**
-     * Check a single dependency by node_id. Returns null if the ecosystem is
-     * not supported or the dependency is not found.
-     */
-    checkOne(nodeId: string): Promise<StalenessResult | null>;
-    private _checkRow;
-}
-//# sourceMappingURL=staleness.d.ts.map

package/dist/security/staleness.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"staleness.d.ts","sourceRoot":"","sources":["../../src/security/staleness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAqJD,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAE9C;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA+B/E;;;OAGG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAqBjD,SAAS;CAkDxB"}

package/dist/security/supply-chain.d.ts

@@ -1,34 +0,0 @@
-/**
- * Supply Chain Health Checker
- *
- * Queries OpenSSF Scorecard and registry APIs to assess the health of
- * dependencies: maintenance activity, maintainer count, package age, and
- * overall supply-chain risk level.
- */
-import type { GraphDatabase } from '../db/database';
-export interface SupplyChainRisk {
-    packageName: string;
-    ecosystem: string;
-    nodeId: string;
-    scorecardScore: number | null;
-    scorecardChecks: Record<string, number> | null;
-    daysSinceLastCommit: number | null;
-    isAbandoned: boolean;
-    maintainerCount: number | null;
-    isSingleMaintainer: boolean;
-    publishedAt: string | null;
-    isVeryNew: boolean;
-    riskLevel: 'critical' | 'high' | 'medium' | 'low' | 'unknown';
-    riskReasons: string[];
-}
-export declare class SupplyChainChecker {
-    private readonly db;
-    constructor(db: GraphDatabase);
-    checkAll(): Promise<{
-        results: SupplyChainRisk[];
-        errors: string[];
-    }>;
-    checkOne(packageName: string, ecosystem: string): Promise<SupplyChainRisk | null>;
-    private _check;
-}
-//# sourceMappingURL=supply-chain.d.ts.map

package/dist/security/supply-chain.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"supply-chain.d.ts","sourceRoot":"","sources":["../../src/security/supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IAEf,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAE/C,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,OAAO,CAAC;IAE5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IAEnB,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;IAC9D,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAuQD,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa;IAExC,QAAQ,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA2BrE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAUzE,MAAM;CAgErB"}

package/dist/security/suppressions.d.ts

@@ -1,18 +0,0 @@
-export interface Suppression {
-    cveId: string;
-    reason?: string;
-    suppressedAt: string;
-    expiresAt?: string;
-}
-export declare class SuppressionManager {
-    private readonly projectRoot;
-    constructor(projectRoot: string);
-    private get filePath();
-    load(): Suppression[];
-    save(suppressions: Suppression[]): void;
-    add(cveId: string, reason?: string, expiresAt?: string): void;
-    remove(cveId: string): boolean;
-    isSuppressed(cveId: string): boolean;
-    getActive(): Suppression[];
-}
-//# sourceMappingURL=suppressions.d.ts.map

package/dist/security/suppressions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/security/suppressions.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,MAAM;IAEhD,OAAO,KAAK,QAAQ,GAEnB;IAED,IAAI,IAAI,WAAW,EAAE;IA2BrB,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,GAAG,IAAI;IAQvC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;IAoB7D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAS9B,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIpC,SAAS,IAAI,WAAW,EAAE;CAG3B"}

package/dist/security/types.d.ts

@@ -1,144 +0,0 @@
-/**
- * KiroGraph-Sec Type Definitions
- *
- * Interfaces for the security analysis module including manifest parsing,
- * vulnerability detection, reachability analysis, and CycloneDX export.
- */
-export interface ParsedDependency {
-    name: string;
-    declaredConstraint: string;
-    resolvedVersion?: string;
-    scope: 'production' | 'development' | 'optional';
-    ecosystem: string;
-    sourceManifest: string;
-    license?: string;
-}
-export interface ManifestParseResult {
-    dependenciesCreated: number;
-    manifestsParsed: number;
-    warnings: Array<{
-        file: string;
-        line?: number;
-        message: string;
-    }>;
-    errors: Array<{
-        file: string;
-        message: string;
-    }>;
-}
-export interface IntegrationResult {
-    importsEdgesCreated: number;
-    referencesEdgesCreated: number;
-}
-export interface TransitiveResult {
-    dependsOnEdgesCreated: number;
-    incompleteNodes: string[];
-}
-export interface CleanupResult {
-    nodesRemoved: number;
-    edgesRemoved: number;
-}
-export interface CVERecord {
-    id: string;
-    severity: number;
-    affectedVersionRanges: VersionRange[];
-    fixedVersion?: string;
-    summary: string;
-}
-export interface VersionRange {
-    introduced?: string;
-    fixed?: string;
-    lastAffected?: string;
-}
-export interface EnrichmentResult {
-    vulnerabilitiesFound: number;
-    dependenciesChecked: number;
-    errors: Array<{
-        dependency: string;
-        database: string;
-        error: string;
-    }>;
-    staleNodes: string[];
-}
-export type ReachabilityVerdict = 'affected' | 'not_affected' | 'under_investigation';
-export interface ReachabilityPath {
-    entryPoint: string;
-    path: string[];
-}
-export interface ReachabilityResult {
-    verdict: ReachabilityVerdict;
-    paths: ReachabilityPath[];
-    unresolvedSymbols: string[];
-    reachingEntryPointCount: number;
-}
-export interface ImpactSummary {
-    affectedLayers: string[];
-    affectedEntryPoints: string[];
-    distinctPathCount: number;
-}
-export interface SecurityResult {
-    manifestsDiscovered: number;
-    dependenciesCreated: number;
-    vulnerabilitiesFound: number;
-    affectedCount: number;
-    notAffectedCount: number;
-    underInvestigationCount: number;
-    duration: number;
-}
-export interface SBOMMetadata {
-    toolName: string;
-    toolVersion: string;
-    timestamp: string;
-    projectName: string;
-}
-export interface CycloneDXSBOM {
-    bomFormat: 'CycloneDX';
-    specVersion: '1.5';
-    version: number;
-    metadata: Record<string, unknown>;
-    components: CycloneDXComponent[];
-    dependencies: CycloneDXDependencyEntry[];
-}
-export interface CycloneDXComponent {
-    type: 'library';
-    name: string;
-    version: string;
-    purl: string;
-    scope?: 'required' | 'optional';
-    properties?: Array<{
-        name: string;
-        value: string;
-    }>;
-}
-export interface CycloneDXDependencyEntry {
-    ref: string;
-    dependsOn?: string[];
-}
-export interface CycloneDXVEX {
-    bomFormat: 'CycloneDX';
-    specVersion: '1.5';
-    version: number;
-    metadata: Record<string, unknown>;
-    vulnerabilities: CycloneDXVulnerability[];
-}
-export interface CycloneDXVulnerability {
-    id: string;
-    source?: {
-        name: string;
-        url?: string;
-    };
-    ratings?: Array<{
-        score: number;
-        severity?: string;
-        method?: string;
-    }>;
-    analysis?: {
-        state: 'affected' | 'not_affected' | 'under_investigation';
-        justification?: string;
-        detail?: string;
-    };
-    affects?: Array<{
-        ref: string;
-    }>;
-}
-//# sourceMappingURL=types.d.ts.map