@absolutejs/vulnerabilities-postgres 0.1.0

package/LICENSE

@@ -0,0 +1,91 @@
+# Business Source License 1.1
+
+**Licensor:** Alex Kahn
+
+**Licensed Work:** @absolutejs/vulnerabilities-postgres (https://github.com/absolutejs/vulnerabilities-postgres)
+
+**Change Date:** July 18, 2030
+
+**Change License:** Apache License, Version 2.0
+
+---
+
+## Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, permitting limited production use.
+
+### Additional Use Grant
+
+You may use the Licensed Work in production, provided your use does not include
+any of the following:
+
+1. **Offering a Competing Service.** You may not offer the Licensed Work, or
+   any derivative or substantial portion of it, to third parties as a hosted or
+   managed vulnerability-management, exposure-management, container-security,
+   cloud-security-posture-management, or attack-surface-management service.
+   This includes any product whose primary value to its users is the
+   functionality the Licensed Work provides.
+
+2. **Resale or Redistribution as a Standalone Product.** You may not sell,
+   license, or distribute the Licensed Work, or any derivative or fork of it,
+   as a standalone commercial product.
+
+3. **Removal of Attribution.** Any derivative work, fork, or redistribution of
+   the Licensed Work must prominently credit AbsoluteJS and include a link to
+   the original project repository
+   (https://github.com/absolutejs/vulnerabilities-postgres).
+
+For clarity, the following uses are expressly permitted:
+
+- Using the Licensed Work to scan, inventory, gate, remediate, or report on
+  vulnerabilities in your own applications, websites, internal tools, or SaaS
+  products, so long as vulnerability management itself is not the primary
+  product you are selling.
+- Using the Licensed Work as a dependency in commercial software you build and
+  sell, as long as that software is not a competing hosted security service of
+  the kind described in clause 1.
+- Providing consulting, development, or professional services to clients using
+  the Licensed Work.
+- Forking and modifying the Licensed Work for your own internal use, provided
+  attribution is maintained.
+
+### Change Date and Change License
+
+On the Change Date specified above, or on such other date as the Licensor may
+specify by written notice, the Licensed Work will be made available under the
+Change License (Apache License, Version 2.0). Until the Change Date, the terms
+of this Business Source License 1.1 apply.
+
+### Trademark
+
+This license does not grant you any rights to use the "AbsoluteJS" or
+"@absolutejs" name, logo, or any related trademarks. Forks and derivative works
+must not be named or branded in a manner that suggests endorsement by or
+affiliation with AbsoluteJS or the Licensor.
+
+### Notices
+
+You must not remove or obscure any licensing, copyright, or other notices
+included in the Licensed Work.
+
+### No Warranty
+
+THE LICENSED WORK IS PROVIDED "AS IS". THE LICENSOR HEREBY DISCLAIMS ALL
+WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY,
+WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR
+IN CONNECTION WITH THE LICENSED WORK OR THE USE OR OTHER DEALINGS IN THE
+LICENSED WORK.
+
+---
+
+## Contact
+
+For commercial licensing inquiries or additional permissions, contact:
+
+- **Alex Kahn**
+- alexkahndev@gmail.com
+- alexkahndev.github.io

package/README.md

@@ -0,0 +1,24 @@
+# @absolutejs/vulnerabilities-postgres
+
+Durable Postgres persistence for `@absolutejs/vulnerabilities`.
+
+```ts
+import { createPostgresVulnerabilityStore } from "@absolutejs/vulnerabilities-postgres";
+import postgres from "postgres";
+
+const persistence = createPostgresVulnerabilityStore({
+  sql: postgres(process.env.DATABASE_URL!),
+});
+
+const osvSnapshots = persistence.snapshots();
+```
+
+The package stores complete provider snapshots and records, appendable sync
+history, tenant-scoped managed findings, and expiring distributed refresh
+leases. Snapshot replacement is one Postgres statement, so readers never see a
+half-replaced record set. Schema creation is lazy and idempotent, or can be
+disabled when application migrations own the tables.
+
+The SQL surface is compatible with postgres.js and Neon-style tagged-template
+clients. Table prefixes are strictly validated before identifiers are included
+in SQL.

package/dist/index.d.ts

@@ -0,0 +1,29 @@
+import { type FeedSnapshotStore, type FeedSyncRunStore, type ManagedFindingStore } from "@absolutejs/vulnerabilities";
+export type PostgresTag = {
+    (strings: TemplateStringsArray, ...values: never[]): PromiseLike<unknown[]>;
+    unsafe: (sql: string, ...args: never[]) => PromiseLike<unknown[]>;
+};
+export type FeedLeaseRequest = {
+    feedId: string;
+    now?: Date;
+    ownerId: string;
+    ttlMs: number;
+};
+export type FeedLeaseStore = {
+    acquire: (request: FeedLeaseRequest) => Promise<boolean>;
+    release: (feedId: string, ownerId: string) => Promise<boolean>;
+};
+export type PostgresVulnerabilityStore = {
+    ensureSchema: () => Promise<void>;
+    findings: ManagedFindingStore;
+    leases: FeedLeaseStore;
+    snapshots: <T>() => FeedSnapshotStore<T>;
+    syncRuns: FeedSyncRunStore;
+};
+export type CreatePostgresVulnerabilityStoreOptions = {
+    ensureSchema?: boolean;
+    sql: PostgresTag;
+    tablePrefix?: string;
+};
+export declare const vulnerabilityPostgresSchemaSql: (tablePrefix?: string) => string;
+export declare const createPostgresVulnerabilityStore: (options: CreatePostgresVulnerabilityStoreOptions) => PostgresVulnerabilityStore;

package/dist/index.js

@@ -0,0 +1,423 @@
+// @bun
+// src/index.ts
+import {
+  ManagedVulnerabilityFindingSchema
+} from "@absolutejs/vulnerabilities";
+import { Value } from "@sinclair/typebox/value";
+var IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+var SYNC_STATUSES = new Set([
+  "failed",
+  "not_modified",
+  "stale",
+  "updated"
+]);
+var requiredText = (value, label) => {
+  const normalized = value.trim();
+  if (normalized.length === 0)
+    throw new Error(`${label} is required`);
+  return normalized;
+};
+var limit = (value, fallback = 100) => {
+  const normalized = value ?? fallback;
+  if (!Number.isInteger(normalized) || normalized < 1 || normalized > 1000)
+    throw new Error("Postgres query limit must be an integer from 1 through 1000");
+  return normalized;
+};
+var timestamp = (value, label) => {
+  if (value instanceof Date)
+    return value.toISOString();
+  if (typeof value !== "string" || !Number.isFinite(Date.parse(value)))
+    throw new Error(`${label} must be a valid timestamp`);
+  return new Date(value).toISOString();
+};
+var json = (value, label) => {
+  if (typeof value === "string") {
+    try {
+      return JSON.parse(value);
+    } catch {
+      throw new Error(`${label} must contain valid JSON`);
+    }
+  }
+  return value;
+};
+var normalizeCursor = (value) => {
+  const cursor = json(value, "Feed cursor");
+  const nullable = (entry, label) => {
+    if (entry === null || typeof entry === "string")
+      return entry;
+    throw new Error(`${label} must be a string or null`);
+  };
+  return {
+    etag: nullable(cursor.etag, "Feed cursor etag"),
+    lastModified: nullable(cursor.lastModified, "Feed cursor lastModified"),
+    token: nullable(cursor.token, "Feed cursor token")
+  };
+};
+var prefixTables = (prefix) => ({
+  findings: `${prefix}_findings`,
+  leases: `${prefix}_feed_leases`,
+  records: `${prefix}_feed_records`,
+  runs: `${prefix}_feed_sync_runs`,
+  snapshots: `${prefix}_feed_snapshots`
+});
+var vulnerabilityPostgresSchemaSql = (tablePrefix = "vulnerability") => {
+  if (!IDENTIFIER.test(tablePrefix))
+    throw new Error(`[vulnerabilities-postgres] invalid tablePrefix "${tablePrefix}"; must match ${IDENTIFIER.source}`);
+  const table = prefixTables(tablePrefix);
+  return `
+    CREATE TABLE IF NOT EXISTS ${table.snapshots} (
+      feed_id text PRIMARY KEY,
+      feed_name text NOT NULL,
+      feed_url text NOT NULL,
+      cursor jsonb NOT NULL,
+      fetched_at timestamptz NOT NULL,
+      revision text,
+      updated_at timestamptz NOT NULL DEFAULT now()
+    );
+    CREATE TABLE IF NOT EXISTS ${table.records} (
+      feed_id text NOT NULL REFERENCES ${table.snapshots}(feed_id) ON DELETE CASCADE,
+      record_id text NOT NULL,
+      modified_at timestamptz NOT NULL,
+      value jsonb NOT NULL,
+      PRIMARY KEY (feed_id, record_id)
+    );
+    CREATE INDEX IF NOT EXISTS ${table.records}_modified_idx
+      ON ${table.records} (feed_id, modified_at DESC);
+    CREATE TABLE IF NOT EXISTS ${table.runs} (
+      id text PRIMARY KEY,
+      feed_id text NOT NULL,
+      started_at timestamptz NOT NULL,
+      completed_at timestamptz NOT NULL,
+      status text NOT NULL CHECK (status IN ('failed', 'not_modified', 'stale', 'updated')),
+      error text,
+      records integer NOT NULL CHECK (records >= 0),
+      revision text
+    );
+    CREATE INDEX IF NOT EXISTS ${table.runs}_feed_started_idx
+      ON ${table.runs} (feed_id, started_at DESC);
+    CREATE INDEX IF NOT EXISTS ${table.runs}_status_started_idx
+      ON ${table.runs} (status, started_at DESC);
+    CREATE TABLE IF NOT EXISTS ${table.findings} (
+      tenant_id text NOT NULL,
+      finding_id text NOT NULL,
+      asset_id text NOT NULL,
+      component_id text NOT NULL,
+      severity text NOT NULL,
+      status text NOT NULL,
+      first_seen_at timestamptz NOT NULL,
+      last_seen_at timestamptz NOT NULL,
+      value jsonb NOT NULL,
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (tenant_id, finding_id)
+    );
+    CREATE INDEX IF NOT EXISTS ${table.findings}_tenant_status_idx
+      ON ${table.findings} (tenant_id, status, last_seen_at DESC);
+    CREATE INDEX IF NOT EXISTS ${table.findings}_tenant_severity_idx
+      ON ${table.findings} (tenant_id, severity, last_seen_at DESC);
+    CREATE INDEX IF NOT EXISTS ${table.findings}_tenant_asset_idx
+      ON ${table.findings} (tenant_id, asset_id, last_seen_at DESC);
+    CREATE TABLE IF NOT EXISTS ${table.leases} (
+      feed_id text PRIMARY KEY,
+      owner_id text NOT NULL,
+      expires_at timestamptz NOT NULL,
+      updated_at timestamptz NOT NULL DEFAULT now()
+    );
+  `;
+};
+var createPostgresVulnerabilityStore = (options) => {
+  const tablePrefix = options.tablePrefix ?? "vulnerability";
+  const ddl = vulnerabilityPostgresSchemaSql(tablePrefix);
+  const table = prefixTables(tablePrefix);
+  const sql = options.sql;
+  const shouldEnsureSchema = options.ensureSchema ?? true;
+  let schemaPromise;
+  const ensureSchema = () => {
+    if (!shouldEnsureSchema)
+      return Promise.resolve();
+    if (schemaPromise)
+      return schemaPromise;
+    schemaPromise = Promise.resolve(sql.unsafe(ddl)).then(() => {
+      return;
+    });
+    return schemaPromise;
+  };
+  const snapshots = () => ({
+    load: async (feedId) => {
+      await ensureSchema();
+      const id = requiredText(feedId, "Feed id");
+      const rows = await sql`
+        SELECT
+          snapshot.feed_id,
+          snapshot.feed_name,
+          snapshot.feed_url,
+          snapshot.cursor,
+          snapshot.fetched_at,
+          snapshot.revision,
+          COALESCE((
+            SELECT jsonb_agg(
+              jsonb_build_object(
+                'id', record.record_id,
+                'modifiedAt', record.modified_at,
+                'value', record.value
+              ) ORDER BY record.record_id
+            )
+            FROM ${sql.unsafe(table.records)} record
+            WHERE record.feed_id = snapshot.feed_id
+          ), '[]'::jsonb) AS records
+        FROM ${sql.unsafe(table.snapshots)} snapshot
+        WHERE snapshot.feed_id = ${id}
+      `;
+      const row = rows[0];
+      if (!row)
+        return null;
+      const records = json(row.records, "Feed records");
+      if (!Array.isArray(records))
+        throw new Error("Feed records must be an array");
+      return {
+        cursor: normalizeCursor(row.cursor),
+        feed: {
+          id: row.feed_id,
+          name: row.feed_name,
+          url: row.feed_url
+        },
+        fetchedAt: timestamp(row.fetched_at, "Feed fetchedAt"),
+        records: records.map((record) => ({
+          id: requiredText(record.id, "Feed record id"),
+          modifiedAt: timestamp(record.modifiedAt, "Feed record modifiedAt"),
+          value: record.value
+        })),
+        revision: row.revision
+      };
+    },
+    save: async (snapshot) => {
+      await ensureSchema();
+      const records = JSON.stringify(snapshot.records.map((record) => ({
+        id: requiredText(record.id, "Feed record id"),
+        modified_at: timestamp(record.modifiedAt, "Feed record modifiedAt"),
+        value: record.value
+      })));
+      const cursor = JSON.stringify(snapshot.cursor);
+      await sql`
+        WITH saved_snapshot AS (
+          INSERT INTO ${sql.unsafe(table.snapshots)} (
+            feed_id, feed_name, feed_url, cursor, fetched_at, revision, updated_at
+          ) VALUES (
+            ${requiredText(snapshot.feed.id, "Feed id")},
+            ${requiredText(snapshot.feed.name, "Feed name")},
+            ${requiredText(snapshot.feed.url, "Feed URL")},
+            ${cursor}::jsonb,
+            ${timestamp(snapshot.fetchedAt, "Feed fetchedAt")}::timestamptz,
+            ${snapshot.revision},
+            now()
+          )
+          ON CONFLICT (feed_id) DO UPDATE SET
+            feed_name = EXCLUDED.feed_name,
+            feed_url = EXCLUDED.feed_url,
+            cursor = EXCLUDED.cursor,
+            fetched_at = EXCLUDED.fetched_at,
+            revision = EXCLUDED.revision,
+            updated_at = now()
+          RETURNING feed_id
+        ), incoming AS (
+          SELECT item.id, item.modified_at::timestamptz, item.value
+          FROM jsonb_to_recordset(${records}::jsonb)
+            AS item(id text, modified_at text, value jsonb)
+        ), removed AS (
+          DELETE FROM ${sql.unsafe(table.records)} record
+          WHERE record.feed_id = ${snapshot.feed.id}
+            AND NOT EXISTS (
+              SELECT 1 FROM incoming WHERE incoming.id = record.record_id
+            )
+          RETURNING record_id
+        ), written AS (
+          INSERT INTO ${sql.unsafe(table.records)} (
+            feed_id, record_id, modified_at, value
+          )
+          SELECT saved_snapshot.feed_id, incoming.id, incoming.modified_at, incoming.value
+          FROM saved_snapshot CROSS JOIN incoming
+          ON CONFLICT (feed_id, record_id) DO UPDATE SET
+            modified_at = EXCLUDED.modified_at,
+            value = EXCLUDED.value
+          RETURNING record_id
+        )
+        SELECT
+          (SELECT count(*) FROM removed) AS removed,
+          (SELECT count(*) FROM written) AS written
+      `;
+    }
+  });
+  const syncRuns = {
+    append: async (run) => {
+      await ensureSchema();
+      if (!SYNC_STATUSES.has(run.status))
+        throw new Error(`Unsupported feed sync status: ${run.status}`);
+      if (!Number.isInteger(run.records) || run.records < 0)
+        throw new Error("Feed sync records must be a non-negative integer");
+      await sql`
+        INSERT INTO ${sql.unsafe(table.runs)} (
+          id, feed_id, started_at, completed_at, status, error, records, revision
+        ) VALUES (
+          ${requiredText(run.id, "Feed sync run id")},
+          ${requiredText(run.feedId, "Feed sync feed id")},
+          ${timestamp(run.startedAt, "Feed sync startedAt")}::timestamptz,
+          ${timestamp(run.completedAt, "Feed sync completedAt")}::timestamptz,
+          ${run.status}, ${run.error}, ${run.records}, ${run.revision}
+        )
+        ON CONFLICT (id) DO UPDATE SET
+          feed_id = EXCLUDED.feed_id,
+          started_at = EXCLUDED.started_at,
+          completed_at = EXCLUDED.completed_at,
+          status = EXCLUDED.status,
+          error = EXCLUDED.error,
+          records = EXCLUDED.records,
+          revision = EXCLUDED.revision
+      `;
+    },
+    list: async (filter = {}) => {
+      await ensureSchema();
+      const feedId = filter.feedId?.trim() || null;
+      const status = filter.status ?? null;
+      const rows = await sql`
+        SELECT id, feed_id, started_at, completed_at, status, error, records, revision
+        FROM ${sql.unsafe(table.runs)}
+        WHERE (${feedId}::text IS NULL OR feed_id = ${feedId})
+          AND (${status}::text IS NULL OR status = ${status})
+        ORDER BY started_at DESC, id DESC
+        LIMIT ${limit(filter.limit)}
+      `;
+      return rows.map((row) => ({
+        completedAt: timestamp(row.completed_at, "Feed sync completedAt"),
+        error: row.error,
+        feedId: row.feed_id,
+        id: row.id,
+        records: Number(row.records),
+        revision: row.revision,
+        startedAt: timestamp(row.started_at, "Feed sync startedAt"),
+        status: row.status
+      }));
+    }
+  };
+  const saveFindings = async (findings2) => {
+    await ensureSchema();
+    if (findings2.length === 0)
+      return;
+    for (const finding of findings2) {
+      const findingId = finding.id;
+      if (!Value.Check(ManagedVulnerabilityFindingSchema, finding))
+        throw new Error(`Managed finding ${findingId} is invalid`);
+    }
+    const payload = JSON.stringify(findings2.map((finding) => ({
+      asset_id: finding.assetId,
+      component_id: finding.componentId,
+      finding_id: finding.id,
+      first_seen_at: finding.firstSeenAt,
+      last_seen_at: finding.lastSeenAt,
+      severity: finding.severity,
+      status: finding.status,
+      tenant_id: finding.tenantId,
+      value: finding
+    })));
+    await sql`
+      INSERT INTO ${sql.unsafe(table.findings)} (
+        tenant_id, finding_id, asset_id, component_id, severity, status,
+        first_seen_at, last_seen_at, value, updated_at
+      )
+      SELECT
+        item.tenant_id, item.finding_id, item.asset_id, item.component_id,
+        item.severity, item.status, item.first_seen_at::timestamptz,
+        item.last_seen_at::timestamptz, item.value, now()
+      FROM jsonb_to_recordset(${payload}::jsonb) AS item(
+        tenant_id text, finding_id text, asset_id text, component_id text,
+        severity text, status text, first_seen_at text, last_seen_at text,
+        value jsonb
+      )
+      ON CONFLICT (tenant_id, finding_id) DO UPDATE SET
+        asset_id = EXCLUDED.asset_id,
+        component_id = EXCLUDED.component_id,
+        severity = EXCLUDED.severity,
+        status = EXCLUDED.status,
+        first_seen_at = LEAST(${sql.unsafe(table.findings)}.first_seen_at, EXCLUDED.first_seen_at),
+        last_seen_at = GREATEST(${sql.unsafe(table.findings)}.last_seen_at, EXCLUDED.last_seen_at),
+        value = EXCLUDED.value,
+        updated_at = now()
+    `;
+  };
+  const parseFinding = (value) => {
+    const finding = json(value, "Managed finding");
+    if (!Value.Check(ManagedVulnerabilityFindingSchema, finding))
+      throw new Error("Stored managed finding is invalid");
+    return finding;
+  };
+  const findings = {
+    get: async (tenantId, findingId) => {
+      await ensureSchema();
+      const rows = await sql`
+        SELECT value FROM ${sql.unsafe(table.findings)}
+        WHERE tenant_id = ${requiredText(tenantId, "Tenant id")}
+          AND finding_id = ${requiredText(findingId, "Finding id")}
+      `;
+      return rows[0] ? parseFinding(rows[0].value) : null;
+    },
+    list: async (filter) => {
+      await ensureSchema();
+      const tenantId = requiredText(filter.tenantId, "Tenant id");
+      const assetId = filter.assetId?.trim() || null;
+      const severity = filter.severity ?? null;
+      const status = filter.status ?? null;
+      const rows = await sql`
+        SELECT value FROM ${sql.unsafe(table.findings)}
+        WHERE tenant_id = ${tenantId}
+          AND (${assetId}::text IS NULL OR asset_id = ${assetId})
+          AND (${severity}::text IS NULL OR severity = ${severity})
+          AND (${status}::text IS NULL OR status = ${status})
+        ORDER BY last_seen_at DESC, finding_id
+        LIMIT ${limit(filter.limit)}
+      `;
+      return rows.map(({ value }) => parseFinding(value));
+    },
+    save: async (finding) => saveFindings([finding]),
+    saveMany: saveFindings
+  };
+  const leases = {
+    acquire: async (request) => {
+      await ensureSchema();
+      if (!Number.isFinite(request.ttlMs) || request.ttlMs <= 0)
+        throw new Error("Feed lease ttlMs must be positive and finite");
+      const now = request.now ?? new Date;
+      const expiresAt = new Date(now.getTime() + request.ttlMs);
+      const rows = await sql`
+        INSERT INTO ${sql.unsafe(table.leases)} (
+          feed_id, owner_id, expires_at, updated_at
+        ) VALUES (
+          ${requiredText(request.feedId, "Feed lease feed id")},
+          ${requiredText(request.ownerId, "Feed lease owner id")},
+          ${expiresAt.toISOString()}::timestamptz,
+          ${now.toISOString()}::timestamptz
+        )
+        ON CONFLICT (feed_id) DO UPDATE SET
+          owner_id = EXCLUDED.owner_id,
+          expires_at = EXCLUDED.expires_at,
+          updated_at = EXCLUDED.updated_at
+        WHERE ${sql.unsafe(table.leases)}.expires_at <= ${now.toISOString()}::timestamptz
+          OR ${sql.unsafe(table.leases)}.owner_id = EXCLUDED.owner_id
+        RETURNING owner_id
+      `;
+      return rows[0]?.owner_id === request.ownerId.trim();
+    },
+    release: async (feedId, ownerId) => {
+      await ensureSchema();
+      const rows = await sql`
+        DELETE FROM ${sql.unsafe(table.leases)}
+        WHERE feed_id = ${requiredText(feedId, "Feed lease feed id")}
+          AND owner_id = ${requiredText(ownerId, "Feed lease owner id")}
+        RETURNING feed_id
+      `;
+      return rows.length > 0;
+    }
+  };
+  return { ensureSchema, findings, leases, snapshots, syncRuns };
+};
+export {
+  vulnerabilityPostgresSchemaSql,
+  createPostgresVulnerabilityStore
+};

package/dist/manifest.d.ts

@@ -0,0 +1,2 @@
+import type { CreatePostgresVulnerabilityStoreOptions } from "./index";
+export declare const manifest: import("@absolutejs/manifest").PackageManifest<CreatePostgresVulnerabilityStoreOptions, never>;

package/dist/manifest.js

@@ -0,0 +1,84 @@
+// @bun
+// src/manifest.ts
+import { defineImplementation, defineManifest } from "@absolutejs/manifest";
+import { Type } from "@sinclair/typebox";
+var manifest = defineManifest()({
+  contract: 2,
+  discovery: {
+    audiences: ["platform-operators", "security-teams"],
+    intents: [
+      "persist vulnerability intelligence",
+      "retain vulnerability sync history",
+      "store managed vulnerability findings"
+    ],
+    keywords: ["vulnerabilities", "Postgres", "CVE", "feed-history"],
+    protocols: ["PostgreSQL", "AbsoluteJS vulnerability contracts"]
+  },
+  identity: {
+    accent: "#336791",
+    category: "operations",
+    description: "Durable Postgres snapshots, records, sync history, managed findings, and distributed refresh leases.",
+    docsUrl: "https://github.com/absolutejs/vulnerabilities-postgres",
+    name: "@absolutejs/vulnerabilities-postgres",
+    tagline: "Keep vulnerability intelligence durable and auditable."
+  },
+  implements: [
+    defineImplementation()({
+      contract: "vulnerabilities/persistence",
+      factory: "createPostgresVulnerabilityStore",
+      from: "@absolutejs/vulnerabilities-postgres",
+      requires: {
+        env: [
+          {
+            description: "Postgres connection string for vulnerability intelligence and findings",
+            example: "postgres://user:pass@host/db",
+            key: "DATABASE_URL",
+            secret: true
+          }
+        ],
+        peers: [
+          {
+            name: "@neondatabase/serverless",
+            range: ">=0.10.0",
+            reason: "HTTP Postgres client for serverless environments"
+          }
+        ],
+        services: [
+          {
+            description: "Stores vulnerability intelligence, history, findings, and leases",
+            id: "postgres"
+          }
+        ]
+      },
+      settings: Type.Object({
+        ensureSchema: Type.Optional(Type.Boolean({
+          default: true,
+          description: "Create vulnerability tables automatically on first use.",
+          title: "Create tables automatically"
+        })),
+        tablePrefix: Type.Optional(Type.String({
+          default: "vulnerability",
+          description: "Prefix for all vulnerability persistence tables.",
+          pattern: "^[a-zA-Z_][a-zA-Z0-9_]*$",
+          title: "Table prefix"
+        }))
+      }),
+      title: "Your Postgres database (durable vulnerability intelligence)",
+      wiring: {
+        code: "createPostgresVulnerabilityStore({ sql: neon(${env.DATABASE_URL} ?? ''), ...${settings} })",
+        imports: [
+          { from: "@neondatabase/serverless", names: ["neon"] },
+          {
+            from: "@absolutejs/vulnerabilities-postgres",
+            names: ["createPostgresVulnerabilityStore"]
+          }
+        ]
+      }
+    })
+  ],
+  settings: Type.Object({}),
+  wiring: []
+});
+export {
+  manifest
+};

package/dist/manifest.json

@@ -0,0 +1,103 @@
+{
+	"contract": 2,
+	"discovery": {
+		"audiences": [
+			"platform-operators",
+			"security-teams"
+		],
+		"intents": [
+			"persist vulnerability intelligence",
+			"retain vulnerability sync history",
+			"store managed vulnerability findings"
+		],
+		"keywords": [
+			"vulnerabilities",
+			"Postgres",
+			"CVE",
+			"feed-history"
+		],
+		"protocols": [
+			"PostgreSQL",
+			"AbsoluteJS vulnerability contracts"
+		]
+	},
+	"identity": {
+		"accent": "#336791",
+		"category": "operations",
+		"description": "Durable Postgres snapshots, records, sync history, managed findings, and distributed refresh leases.",
+		"docsUrl": "https://github.com/absolutejs/vulnerabilities-postgres",
+		"name": "@absolutejs/vulnerabilities-postgres",
+		"tagline": "Keep vulnerability intelligence durable and auditable."
+	},
+	"implements": [
+		{
+			"contract": "vulnerabilities/persistence",
+			"factory": "createPostgresVulnerabilityStore",
+			"from": "@absolutejs/vulnerabilities-postgres",
+			"requires": {
+				"env": [
+					{
+						"description": "Postgres connection string for vulnerability intelligence and findings",
+						"example": "postgres://user:pass@host/db",
+						"key": "DATABASE_URL",
+						"secret": true
+					}
+				],
+				"peers": [
+					{
+						"name": "@neondatabase/serverless",
+						"range": ">=0.10.0",
+						"reason": "HTTP Postgres client for serverless environments"
+					}
+				],
+				"services": [
+					{
+						"description": "Stores vulnerability intelligence, history, findings, and leases",
+						"id": "postgres"
+					}
+				]
+			},
+			"settings": {
+				"type": "object",
+				"properties": {
+					"ensureSchema": {
+						"default": true,
+						"description": "Create vulnerability tables automatically on first use.",
+						"title": "Create tables automatically",
+						"type": "boolean"
+					},
+					"tablePrefix": {
+						"default": "vulnerability",
+						"description": "Prefix for all vulnerability persistence tables.",
+						"pattern": "^[a-zA-Z_][a-zA-Z0-9_]*$",
+						"title": "Table prefix",
+						"type": "string"
+					}
+				}
+			},
+			"title": "Your Postgres database (durable vulnerability intelligence)",
+			"wiring": {
+				"code": "createPostgresVulnerabilityStore({ sql: neon(${env.DATABASE_URL} ?? ''), ...${settings} })",
+				"imports": [
+					{
+						"from": "@neondatabase/serverless",
+						"names": [
+							"neon"
+						]
+					},
+					{
+						"from": "@absolutejs/vulnerabilities-postgres",
+						"names": [
+							"createPostgresVulnerabilityStore"
+						]
+					}
+				]
+			}
+		}
+	],
+	"settings": {
+		"type": "object",
+		"properties": {}
+	},
+	"wiring": []
+}

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@absolutejs/vulnerabilities-postgres",
+  "version": "0.1.0",
+  "description": "Durable Postgres feed snapshots, sync history, managed findings, and refresh leases for AbsoluteJS vulnerability management.",
+  "type": "module",
+  "license": "BSL-1.1",
+  "author": "Alex Kahn",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/absolutejs/vulnerabilities-postgres.git"
+  },
+  "homepage": "https://github.com/absolutejs/vulnerabilities-postgres",
+  "bugs": {
+    "url": "https://github.com/absolutejs/vulnerabilities-postgres/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "absolutejs": {
+    "manifestContract": 2
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./manifest": {
+      "types": "./dist/manifest.d.ts",
+      "import": "./dist/manifest.js"
+    },
+    "./manifest.json": "./dist/manifest.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "format": "prettier --write \"./**/*.{ts,json,md}\"",
+    "typecheck": "tsc --noEmit",
+    "test": "bun test",
+    "build": "rm -rf dist && bun build src/index.ts src/manifest.ts --outdir dist --target=bun --external @absolutejs/manifest --external @absolutejs/vulnerabilities --external @sinclair/typebox --external postgres --external @neondatabase/serverless && tsc -p tsconfig.build.json && absolute-manifest emit",
+    "check:package": "bun run format && bun run typecheck && bun run test && bun run build"
+  },
+  "keywords": [
+    "absolutejs",
+    "cve",
+    "postgres",
+    "security",
+    "vulnerability-management"
+  ],
+  "dependencies": {
+    "@absolutejs/manifest": "0.3.0",
+    "@absolutejs/vulnerabilities": "0.5.0",
+    "@sinclair/typebox": "0.34.52"
+  },
+  "peerDependencies": {
+    "@neondatabase/serverless": ">=0.10.0",
+    "postgres": ">=3.4.0"
+  },
+  "peerDependenciesMeta": {
+    "@neondatabase/serverless": {
+      "optional": true
+    },
+    "postgres": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@electric-sql/pglite": "0.3.14",
+    "@types/bun": "1.3.14",
+    "prettier": "3.8.1",
+    "typescript": "5.9.3"
+  }
+}