0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-SVJEDVYK.js

@@ -0,0 +1,808 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  homeStateDir
+} from "./chunk-6L26OBWI.js";
+
+// packages/core/dist/cve/artifact-scraper.js
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+function normaliseCveId(input) {
+  const trimmed = input.trim().toUpperCase();
+  if (!/^CVE-\d{4}-\d{4,}$/.test(trimmed)) {
+    throw new Error(`invalid CVE id: ${JSON.stringify(input)}`);
+  }
+  return trimmed;
+}
+var DEFAULT_TTL_MS = 24 * 60 * 60 * 1e3;
+function defaultCacheDir() {
+  return join(homeStateDir(), "cve-cache");
+}
+function cacheKey(source, query) {
+  const h = createHash("sha256").update(query).digest("hex").slice(0, 24);
+  return `${source}/${h}.json`;
+}
+function readCache(cacheDir, source, query, now, ttlMs) {
+  const file = join(cacheDir, cacheKey(source, query));
+  if (!existsSync(file))
+    return void 0;
+  try {
+    const raw = readFileSync(file, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.savedAt !== "number")
+      return void 0;
+    if (now - parsed.savedAt > ttlMs)
+      return void 0;
+    return parsed.payload;
+  } catch {
+    return void 0;
+  }
+}
+function writeCache(cacheDir, source, query, now, payload) {
+  const file = join(cacheDir, cacheKey(source, query));
+  try {
+    mkdirSync(dirname(file), { recursive: true, mode: 448 });
+    writeFileSync(file, JSON.stringify({ savedAt: now, payload }), {
+      mode: 384
+    });
+  } catch {
+  }
+}
+async function fetchJsonWithRetry(url, opts) {
+  const treat404AsMiss = opts.treat404AsMiss ?? true;
+  if (opts.cacheDir && !opts.noCache) {
+    const hit = readCache(opts.cacheDir, opts.source, opts.cacheQuery, opts.now(), opts.ttlMs);
+    if (hit !== void 0) {
+      return { data: hit, ok: true, status: 200, cached: true, durationMs: 0 };
+    }
+  }
+  let lastErr;
+  let lastStatus = 0;
+  let attempt = 0;
+  const start = opts.now();
+  while (attempt <= opts.retries) {
+    attempt += 1;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), opts.timeoutMs);
+    try {
+      const res = await opts.fetchImpl(url, {
+        ...opts.init ?? {},
+        // AbortSignal isn't part of the FetchLike contract above, but
+        // the real fetch honours it; for mock fetches it's a no-op.
+        ...{ signal: controller.signal }
+      });
+      clearTimeout(timer);
+      lastStatus = res.status;
+      if (treat404AsMiss && res.status === 404) {
+        return {
+          ok: false,
+          status: 404,
+          durationMs: opts.now() - start
+        };
+      }
+      if (res.status === 429) {
+        return {
+          ok: false,
+          status: 429,
+          rateLimited: true,
+          error: "rate limited",
+          durationMs: opts.now() - start
+        };
+      }
+      if (res.status === 403) {
+        const remaining = res.headers?.get?.("x-ratelimit-remaining");
+        if (remaining === "0") {
+          return {
+            ok: false,
+            status: 403,
+            rateLimited: true,
+            error: "GitHub API rate limit (set GITHUB_TOKEN to lift)",
+            durationMs: opts.now() - start
+          };
+        }
+      }
+      if (res.status >= 500 && res.status < 600) {
+        lastErr = `HTTP ${res.status}`;
+        if (attempt <= opts.retries) {
+          await delay(opts.backoffMs * Math.pow(2, attempt - 1));
+          continue;
+        }
+        return {
+          ok: false,
+          status: res.status,
+          error: lastErr,
+          durationMs: opts.now() - start
+        };
+      }
+      if (!res.ok) {
+        return {
+          ok: false,
+          status: res.status,
+          error: `HTTP ${res.status}`,
+          durationMs: opts.now() - start
+        };
+      }
+      const data = await res.json();
+      if (opts.cacheDir && !opts.noCache) {
+        writeCache(opts.cacheDir, opts.source, opts.cacheQuery, opts.now(), data);
+      }
+      return {
+        data,
+        ok: true,
+        status: res.status,
+        durationMs: opts.now() - start
+      };
+    } catch (err) {
+      clearTimeout(timer);
+      lastErr = err instanceof Error ? err.message : String(err);
+      if (attempt <= opts.retries) {
+        await delay(opts.backoffMs * Math.pow(2, attempt - 1));
+        continue;
+      }
+      return {
+        ok: false,
+        status: lastStatus,
+        error: lastErr,
+        durationMs: opts.now() - start
+      };
+    }
+  }
+  return {
+    ok: false,
+    status: lastStatus,
+    error: lastErr ?? "exhausted retries",
+    durationMs: opts.now() - start
+  };
+}
+function delay(ms) {
+  return new Promise((resolve) => {
+    if (ms <= 0)
+      resolve();
+    else
+      setTimeout(resolve, ms);
+  });
+}
+function parseNvdResponse(json, cveId) {
+  const item = (json.vulnerabilities ?? []).find((v) => v.cve?.id?.toUpperCase() === cveId);
+  if (!item?.cve) {
+    return { references: [], affected: [] };
+  }
+  const description = (item.cve.descriptions ?? []).find((d) => d.lang === "en")?.value;
+  const references = item.cve.references ?? [];
+  const affected = [];
+  for (const cfg of item.cve.configurations ?? []) {
+    for (const node of cfg.nodes ?? []) {
+      for (const m of node.cpeMatch ?? []) {
+        if (m.vulnerable === false)
+          continue;
+        const range = renderCpeRange(m);
+        if (!range)
+          continue;
+        const parsed = parseCpeUri(m.criteria);
+        affected.push({
+          vendor: parsed?.vendor,
+          product: parsed?.product,
+          range,
+          source: "nvd"
+        });
+      }
+    }
+  }
+  return {
+    description,
+    published: item.cve.published,
+    references,
+    affected
+  };
+}
+function renderCpeRange(m) {
+  const parts = [];
+  if (m.versionStartIncluding)
+    parts.push(`>=${m.versionStartIncluding}`);
+  if (m.versionStartExcluding)
+    parts.push(`>${m.versionStartExcluding}`);
+  if (m.versionEndIncluding)
+    parts.push(`<=${m.versionEndIncluding}`);
+  if (m.versionEndExcluding)
+    parts.push(`<${m.versionEndExcluding}`);
+  if (parts.length === 0 && m.criteria) {
+    return m.criteria;
+  }
+  return parts.join(",");
+}
+function parseCpeUri(uri) {
+  if (!uri)
+    return void 0;
+  const parts = uri.split(":");
+  if (parts.length < 6)
+    return void 0;
+  return { vendor: parts[3] ?? "", product: parts[4] ?? "" };
+}
+async function fetchNvd(cveId, plumbing, log) {
+  const url = `https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=${encodeURIComponent(cveId)}`;
+  const result = await fetchJsonWithRetry(url, {
+    ...plumbing,
+    source: "nvd",
+    cacheQuery: `GET ${url}`
+  });
+  log.push({
+    source: "nvd",
+    url,
+    status: result.cached ? "cached" : result.ok ? "ok" : result.status === 404 ? "miss" : result.rateLimited ? "rate-limited" : "error",
+    httpStatus: result.status || void 0,
+    error: result.error,
+    durationMs: result.durationMs
+  });
+  if (!result.ok || !result.data) {
+    return { references: [], affected: [] };
+  }
+  return parseNvdResponse(result.data, cveId);
+}
+function parseGhsaResponse(json, cveId) {
+  const items = Array.isArray(json) ? json : json && typeof json === "object" && "advisories" in json ? json.advisories ?? [] : [];
+  if (items.length === 0)
+    return { references: [], affected: [] };
+  const adv = items.find((it) => (it.cve_id ?? "").toUpperCase() === cveId) ?? items[0];
+  const references = normaliseGhsaRefs(adv.references);
+  const affected = [];
+  for (const v of adv.vulnerabilities ?? []) {
+    if (!v.vulnerable_version_range)
+      continue;
+    affected.push({
+      product: v.package?.name,
+      range: v.vulnerable_version_range,
+      source: "ghsa"
+    });
+  }
+  return {
+    description: adv.summary ?? adv.description,
+    published: adv.published_at,
+    references,
+    affected
+  };
+}
+function normaliseGhsaRefs(refs) {
+  if (!refs)
+    return [];
+  if (Array.isArray(refs)) {
+    return refs.map((r) => typeof r === "string" ? r : r?.url ?? "").filter((s) => s.length > 0);
+  }
+  return [];
+}
+async function fetchGhsa(cveId, plumbing, githubToken, log) {
+  const url = `https://api.github.com/advisories?cve_id=${encodeURIComponent(cveId)}`;
+  const headers = {
+    accept: "application/vnd.github+json",
+    "user-agent": "0sec-cve-scraper"
+  };
+  if (githubToken)
+    headers.authorization = `Bearer ${githubToken}`;
+  const result = await fetchJsonWithRetry(url, {
+    ...plumbing,
+    source: "ghsa",
+    cacheQuery: `GET ${url}`,
+    init: { method: "GET", headers }
+  });
+  log.push({
+    source: "ghsa",
+    url,
+    status: result.cached ? "cached" : result.ok ? "ok" : result.status === 404 ? "miss" : result.rateLimited ? "rate-limited" : "error",
+    httpStatus: result.status || void 0,
+    error: result.error,
+    durationMs: result.durationMs
+  });
+  if (!result.ok || !result.data) {
+    return { references: [], affected: [] };
+  }
+  return parseGhsaResponse(result.data, cveId);
+}
+function parseOsvResponse(json) {
+  const references = (json.references ?? []).map((r) => r.url).filter((u) => typeof u === "string" && u.length > 0);
+  const affected = [];
+  for (const aff of json.affected ?? []) {
+    for (const rng of aff.ranges ?? []) {
+      const parts = [];
+      for (const ev of rng.events ?? []) {
+        if (ev.introduced && ev.introduced !== "0")
+          parts.push(`>=${ev.introduced}`);
+        if (ev.fixed)
+          parts.push(`<${ev.fixed}`);
+        if (ev.last_affected)
+          parts.push(`<=${ev.last_affected}`);
+      }
+      if (parts.length === 0)
+        continue;
+      affected.push({
+        product: aff.package?.name,
+        range: parts.join(","),
+        source: "osv"
+      });
+    }
+  }
+  return {
+    description: json.summary ?? json.details,
+    published: json.published,
+    references,
+    affected
+  };
+}
+async function fetchOsv(cveId, plumbing, log) {
+  const url = `https://api.osv.dev/v1/vulns/${encodeURIComponent(cveId)}`;
+  const result = await fetchJsonWithRetry(url, {
+    ...plumbing,
+    source: "osv",
+    cacheQuery: `GET ${url}`
+  });
+  log.push({
+    source: "osv",
+    url,
+    status: result.cached ? "cached" : result.ok ? "ok" : result.status === 404 ? "miss" : result.rateLimited ? "rate-limited" : "error",
+    httpStatus: result.status || void 0,
+    error: result.error,
+    durationMs: result.durationMs
+  });
+  if (!result.ok || !result.data) {
+    return { references: [], affected: [] };
+  }
+  return parseOsvResponse(result.data);
+}
+function findUbuntuTrackerUrls(refs) {
+  const out = /* @__PURE__ */ new Set();
+  for (const ref of refs) {
+    const m = ref.match(/ubuntu\.com\/security\/notices\/(USN-[A-Z0-9-]+)/i);
+    if (m)
+      out.add(`https://ubuntu.com/security/notices/${m[1]}.json`);
+  }
+  return [...out];
+}
+function findRedHatTrackerUrls(refs, cveId) {
+  const out = /* @__PURE__ */ new Set();
+  for (const ref of refs) {
+    const m = ref.match(/access\.redhat\.com\/security\/cve\/(CVE-[\d-]+)/i);
+    if (m) {
+      out.add(`https://access.redhat.com/hydra/rest/securitydata/cve/${m[1]}.json`);
+    }
+  }
+  if (out.size === 0) {
+    out.add(`https://access.redhat.com/hydra/rest/securitydata/cve/${cveId}.json`);
+  }
+  return [...out];
+}
+function parseUbuntuTracker(json) {
+  const refs = (json.references ?? []).filter((s) => typeof s === "string" && s.length > 0);
+  const affected = [];
+  for (const [release, payload] of Object.entries(json.releases ?? {})) {
+    for (const [pkg, info] of Object.entries(payload?.sources ?? {})) {
+      if (!info?.version)
+        continue;
+      affected.push({
+        product: pkg,
+        vendor: `ubuntu/${release}`,
+        range: `<${info.version}`,
+        source: "ubuntu"
+      });
+    }
+  }
+  return { references: refs, affected };
+}
+function parseRedHatTracker(json) {
+  const refs = /* @__PURE__ */ new Set();
+  if (json.bugzilla?.url)
+    refs.add(json.bugzilla.url);
+  for (const u of json.references ?? []) {
+    if (typeof u === "string" && u.length > 0)
+      refs.add(u);
+  }
+  const affected = [];
+  for (const rel of json.affected_release ?? []) {
+    if (!rel.package)
+      continue;
+    affected.push({
+      product: rel.package,
+      vendor: rel.product_name ?? "redhat",
+      range: `fixed in ${rel.package}`,
+      source: "redhat"
+    });
+  }
+  return { references: [...refs], affected };
+}
+async function fetchUbuntu(url, plumbing, log) {
+  const result = await fetchJsonWithRetry(url, {
+    ...plumbing,
+    source: "ubuntu",
+    cacheQuery: `GET ${url}`
+  });
+  log.push({
+    source: "ubuntu",
+    url,
+    status: result.cached ? "cached" : result.ok ? "ok" : result.status === 404 ? "miss" : result.rateLimited ? "rate-limited" : "error",
+    httpStatus: result.status || void 0,
+    error: result.error,
+    durationMs: result.durationMs
+  });
+  if (!result.ok || !result.data)
+    return { references: [], affected: [] };
+  return parseUbuntuTracker(result.data);
+}
+async function fetchRedHat(url, plumbing, log) {
+  const result = await fetchJsonWithRetry(url, {
+    ...plumbing,
+    source: "redhat",
+    cacheQuery: `GET ${url}`
+  });
+  log.push({
+    source: "redhat",
+    url,
+    status: result.cached ? "cached" : result.ok ? "ok" : result.status === 404 ? "miss" : result.rateLimited ? "rate-limited" : "error",
+    httpStatus: result.status || void 0,
+    error: result.error,
+    durationMs: result.durationMs
+  });
+  if (!result.ok || !result.data)
+    return { references: [], affected: [] };
+  return parseRedHatTracker(result.data);
+}
+function scoreRepoCandidate(repo, cveId) {
+  const stars = repo.stargazers_count ?? 0;
+  let score = 0;
+  score += Math.min(0.5, Math.log10(stars + 1) / 4);
+  const name = (repo.full_name ?? "").toLowerCase();
+  const desc = (repo.description ?? "").toLowerCase();
+  const cveLower = cveId.toLowerCase();
+  if (name.includes(cveLower))
+    score += 0.35;
+  else if (desc.includes(cveLower))
+    score += 0.15;
+  if (/poc|exploit|reproducer/.test(name))
+    score += 0.12;
+  else if (/poc|exploit|reproducer/.test(desc))
+    score += 0.06;
+  if (repo.fork)
+    score -= 0.2;
+  if (repo.pushed_at) {
+    const updated = Date.parse(repo.pushed_at);
+    if (Number.isFinite(updated)) {
+      const ageDays = (Date.now() - updated) / 864e5;
+      if (ageDays < 30)
+        score += 0.08;
+      else if (ageDays < 365)
+        score += 0.04;
+      else if (ageDays > 365 * 3)
+        score -= 0.05;
+    }
+  }
+  const language = languageFromHint(repo.language);
+  return { confidence: clamp01(score), language };
+}
+function scoreCodeCandidate(item, cveId) {
+  const name = (item.name ?? "").toLowerCase();
+  const path = (item.path ?? "").toLowerCase();
+  const cveLower = cveId.toLowerCase();
+  let score = 0;
+  if (name === "poc.c" || name === "exploit.c")
+    score += 0.4;
+  if (name === `${cveLower}.c`)
+    score += 0.5;
+  if (name.includes(cveLower))
+    score += 0.2;
+  if (/poc|exploit/.test(path))
+    score += 0.1;
+  const stars = item.repository?.stargazers_count ?? 0;
+  score += Math.min(0.3, Math.log10(stars + 1) / 5);
+  if (item.repository?.fork)
+    score -= 0.2;
+  return {
+    confidence: clamp01(score),
+    language: languageFromFilename(name) ?? "c"
+  };
+}
+function languageFromHint(lang) {
+  if (!lang)
+    return void 0;
+  const l = lang.toLowerCase();
+  if (l === "c" || l === "c++")
+    return "c";
+  if (l === "python")
+    return "python";
+  if (l === "shell" || l === "sh" || l === "bash")
+    return "shell";
+  return "unknown";
+}
+function languageFromFilename(name) {
+  if (name.endsWith(".c") || name.endsWith(".cpp") || name.endsWith(".cc"))
+    return "c";
+  if (name.endsWith(".py"))
+    return "python";
+  if (name.endsWith(".syz") || name.endsWith(".syzprog"))
+    return "syz";
+  if (name.endsWith(".sh") || name.endsWith(".bash"))
+    return "shell";
+  return void 0;
+}
+function clamp01(n) {
+  if (!Number.isFinite(n))
+    return 0;
+  if (n < 0)
+    return 0;
+  if (n > 1)
+    return 1;
+  return n;
+}
+async function fetchGithubPocSearch(cveId, plumbing, githubToken, log) {
+  const headers = {
+    accept: "application/vnd.github+json",
+    "user-agent": "0sec-cve-scraper"
+  };
+  if (githubToken)
+    headers.authorization = `Bearer ${githubToken}`;
+  const candidates = [];
+  const reposUrl = `https://api.github.com/search/repositories?q=${encodeURIComponent(cveId)}`;
+  const repos = await fetchJsonWithRetry(reposUrl, {
+    ...plumbing,
+    source: "github-search",
+    cacheQuery: `GET ${reposUrl}`,
+    init: { method: "GET", headers }
+  });
+  log.push({
+    source: "github-search",
+    url: reposUrl,
+    status: repos.cached ? "cached" : repos.ok ? "ok" : repos.rateLimited ? "rate-limited" : repos.status === 404 ? "miss" : "error",
+    httpStatus: repos.status || void 0,
+    error: repos.error,
+    durationMs: repos.durationMs
+  });
+  if (repos.ok && repos.data) {
+    for (const r of repos.data.items ?? []) {
+      const { confidence, language } = scoreRepoCandidate(r, cveId);
+      if (confidence <= 0 || !r.html_url)
+        continue;
+      candidates.push({
+        url: r.html_url,
+        source: "github",
+        confidence,
+        language,
+        label: r.full_name,
+        stars: r.stargazers_count,
+        updatedAt: r.pushed_at ?? r.updated_at
+      });
+    }
+  }
+  const codeUrl = `https://api.github.com/search/code?q=${encodeURIComponent(`${cveId} in:file filename:*.c`)}`;
+  if (githubToken) {
+    const code = await fetchJsonWithRetry(codeUrl, {
+      ...plumbing,
+      source: "github-search",
+      cacheQuery: `GET ${codeUrl}`,
+      init: { method: "GET", headers }
+    });
+    log.push({
+      source: "github-search",
+      url: codeUrl,
+      status: code.cached ? "cached" : code.ok ? "ok" : code.rateLimited ? "rate-limited" : code.status === 404 ? "miss" : "error",
+      httpStatus: code.status || void 0,
+      error: code.error,
+      durationMs: code.durationMs
+    });
+    if (code.ok && code.data) {
+      for (const item of code.data.items ?? []) {
+        const { confidence, language } = scoreCodeCandidate(item, cveId);
+        if (confidence <= 0 || !item.html_url)
+          continue;
+        candidates.push({
+          url: item.html_url,
+          source: "github",
+          confidence,
+          language,
+          label: `${item.repository?.full_name ?? ""}:${item.path ?? item.name ?? ""}`,
+          stars: item.repository?.stargazers_count,
+          updatedAt: item.repository?.pushed_at
+        });
+      }
+    }
+  } else {
+    log.push({
+      source: "github-search",
+      url: codeUrl,
+      status: "skipped",
+      durationMs: 0,
+      error: "code search requires GITHUB_TOKEN"
+    });
+  }
+  return candidates;
+}
+function classifyReferences(refs, source = "inline-writeup") {
+  const pocs = [];
+  const writeups = [];
+  for (const refRaw of refs) {
+    const url = typeof refRaw === "string" ? refRaw : refRaw.url;
+    if (!url)
+      continue;
+    const tags = typeof refRaw === "string" ? [] : refRaw.tags ?? [];
+    const lowered = url.toLowerCase();
+    if (/^https?:\/\/(www\.)?github\.com\/[^/]+\/[^/]+/.test(url)) {
+      const isPatch = /\/(commit|pull|blob|security|advisories)\//i.test(url);
+      if (!isPatch || tags.includes("Exploit")) {
+        pocs.push({
+          url,
+          source: "github",
+          confidence: tags.includes("Exploit") ? 0.85 : 0.5,
+          language: languageFromFilename(url.toLowerCase()) ?? void 0
+        });
+      }
+      writeups.push(url);
+      continue;
+    }
+    if (/^https?:\/\/gist\.github\.com\//.test(url)) {
+      pocs.push({
+        url,
+        source: "gist",
+        confidence: tags.includes("Exploit") ? 0.8 : 0.55
+      });
+      writeups.push(url);
+      continue;
+    }
+    if (tags.includes("Exploit")) {
+      pocs.push({ url, source, confidence: 0.7 });
+    }
+    writeups.push(url);
+    void lowered;
+  }
+  return { pocs, writeups };
+}
+async function findCveArtifacts(cveIdInput, opts = {}) {
+  const cveId = normaliseCveId(cveIdInput);
+  const cache = opts.cache !== false;
+  const cacheDir = cache ? opts.cacheDir ?? defaultCacheDir() : void 0;
+  const ttlMs = opts.cacheTtlMs ?? DEFAULT_TTL_MS;
+  const timeoutMs = opts.timeoutMs ?? 1e4;
+  const retries = opts.retries ?? 2;
+  const backoffMs = opts.backoffMs ?? 250;
+  const now = opts.now ?? (() => Date.now());
+  const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+  if (!fetchImpl) {
+    return {
+      cve_id: cveId,
+      writeup_urls: [],
+      poc_urls: [],
+      affected: [],
+      sources: [
+        {
+          source: "nvd",
+          url: "",
+          status: "error",
+          error: "no fetch impl available",
+          durationMs: 0
+        }
+      ]
+    };
+  }
+  const githubToken = opts.githubToken ?? process.env.GITHUB_TOKEN;
+  const log = [];
+  const plumbing = {
+    fetchImpl,
+    timeoutMs,
+    retries,
+    backoffMs,
+    now,
+    cacheDir,
+    ttlMs,
+    noCache: !cache
+  };
+  const nvd = await fetchNvd(cveId, plumbing, log);
+  const ghsa = await fetchGhsa(cveId, plumbing, githubToken, log);
+  let osvOut = { references: [], affected: [] };
+  if (ghsa.references.length === 0 && ghsa.affected.length === 0) {
+    osvOut = await fetchOsv(cveId, plumbing, log);
+  } else {
+    log.push({
+      source: "osv",
+      url: `https://api.osv.dev/v1/vulns/${cveId}`,
+      status: "skipped",
+      durationMs: 0,
+      error: "GHSA had hits \u2014 OSV fallback skipped"
+    });
+  }
+  const allRefsNvd = nvd.references;
+  const allRefsString = [...ghsa.references, ...osvOut.references];
+  const nvdSplit = classifyReferences(allRefsNvd, "inline-writeup");
+  const otherSplit = classifyReferences(allRefsString, "inline-writeup");
+  const flatRefs = [
+    ...allRefsString,
+    ...allRefsNvd.map((r) => r.url)
+  ];
+  const ubuntuUrls = findUbuntuTrackerUrls(flatRefs);
+  const redHatUrls = findRedHatTrackerUrls(flatRefs, cveId);
+  const distroResults = await Promise.all([
+    ...ubuntuUrls.map((u) => fetchUbuntu(u, plumbing, log)),
+    ...redHatUrls.map((u) => fetchRedHat(u, plumbing, log))
+  ]);
+  const ghSearchCandidates = opts.skipGithubPocSearch ? [] : await fetchGithubPocSearch(cveId, plumbing, githubToken, log);
+  const description = nvd.description ?? ghsa.description ?? osvOut.description;
+  const published = nvd.published ?? ghsa.published ?? osvOut.published;
+  const writeup_urls = uniqueStrings([
+    ...nvdSplit.writeups,
+    ...otherSplit.writeups,
+    ...distroResults.flatMap((d) => d.references)
+  ]);
+  const allPocs = [
+    ...nvdSplit.pocs.map((p) => ({ ...p, source: p.source })),
+    ...otherSplit.pocs,
+    ...ghSearchCandidates
+  ];
+  const poc_urls = dedupePocs(allPocs).sort((a, b) => b.confidence - a.confidence);
+  const affected = dedupeAffected([
+    ...nvd.affected,
+    ...ghsa.affected,
+    ...osvOut.affected,
+    ...distroResults.flatMap((d) => d.affected)
+  ]);
+  return {
+    cve_id: cveId,
+    description,
+    published,
+    writeup_urls,
+    poc_urls,
+    affected,
+    sources: log
+  };
+}
+function uniqueStrings(arr) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const s of arr) {
+    if (!s || seen.has(s))
+      continue;
+    seen.add(s);
+    out.push(s);
+  }
+  return out;
+}
+function dedupePocs(pocs) {
+  const byUrl = /* @__PURE__ */ new Map();
+  for (const p of pocs) {
+    const existing = byUrl.get(p.url);
+    if (!existing) {
+      byUrl.set(p.url, p);
+      continue;
+    }
+    const merged = {
+      ...existing,
+      confidence: Math.max(existing.confidence, p.confidence),
+      language: existing.language ?? p.language,
+      label: existing.label ?? p.label,
+      stars: existing.stars ?? p.stars,
+      updatedAt: existing.updatedAt ?? p.updatedAt
+    };
+    byUrl.set(p.url, merged);
+  }
+  return [...byUrl.values()];
+}
+function dedupeAffected(rows) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const r of rows) {
+    const key = `${r.source}|${r.vendor ?? ""}|${r.product ?? ""}|${r.range}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    out.push(r);
+  }
+  return out;
+}
+
+export {
+  normaliseCveId,
+  parseNvdResponse,
+  parseGhsaResponse,
+  parseOsvResponse,
+  findUbuntuTrackerUrls,
+  findRedHatTrackerUrls,
+  parseUbuntuTracker,
+  parseRedHatTracker,
+  scoreRepoCandidate,
+  scoreCodeCandidate,
+  classifyReferences,
+  findCveArtifacts
+};