@absolutejs/vulnerabilities-postgres 0.1.1 → 0.3.0

package/README.md

@@ -14,10 +14,11 @@ const osvSnapshots = persistence.snapshots();
 ```
 
 The package stores complete provider snapshots and records, appendable sync
-history, tenant-scoped managed findings, and expiring distributed refresh
-leases. Snapshot replacement is one Postgres statement, so readers never see a
-half-replaced record set. Schema creation is lazy and idempotent, or can be
-disabled when application migrations own the tables.
+history, tenant-scoped managed findings, correlation observations, risk
+assessments, and expiring distributed refresh leases. Snapshot replacement is
+one Postgres statement, so readers never see a half-replaced record set. Schema
+creation is lazy and idempotent, or can be disabled when application migrations
+own the tables.
 
 The SQL surface is compatible with postgres.js and Neon-style tagged-template
 clients. Table prefixes are strictly validated before identifiers are included

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { type FeedSnapshotStore, type FeedSyncRunStore, type ManagedFindingStore } from "@absolutejs/vulnerabilities";
+import { type FeedSnapshotStore, type FeedSyncRunStore, type ManagedFindingStore, type VulnerabilityObservationStore, type VulnerabilityRiskAssessmentStore } from "@absolutejs/vulnerabilities";
 export type PostgresTag = {
     (strings: TemplateStringsArray, ...values: never[]): PromiseLike<unknown[]>;
     unsafe: (sql: string, ...args: never[]) => PromiseLike<unknown[]>;
@@ -17,6 +17,8 @@ export type PostgresVulnerabilityStore = {
     ensureSchema: () => Promise<void>;
     findings: ManagedFindingStore;
     leases: FeedLeaseStore;
+    observations: VulnerabilityObservationStore;
+    riskAssessments: VulnerabilityRiskAssessmentStore;
     snapshots: <T>() => FeedSnapshotStore<T>;
     syncRuns: FeedSyncRunStore;
 };

package/dist/index.js

@@ -1,7 +1,9 @@
 // @bun
 // src/index.ts
 import {
-  ManagedVulnerabilityFindingSchema
+  ManagedVulnerabilityFindingSchema,
+  VulnerabilityObservationSchema,
+  VulnerabilityRiskAssessmentSchema
 } from "@absolutejs/vulnerabilities";
 import { Value } from "@sinclair/typebox/value";
 var IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
@@ -56,6 +58,8 @@ var normalizeCursor = (value) => {
 var prefixTables = (prefix) => ({
   findings: `${prefix}_findings`,
   leases: `${prefix}_feed_leases`,
+  observations: `${prefix}_observations`,
+  riskAssessments: `${prefix}_risk_assessments`,
   records: `${prefix}_feed_records`,
   runs: `${prefix}_feed_sync_runs`,
   snapshots: `${prefix}_feed_snapshots`
@@ -116,6 +120,35 @@ var vulnerabilityPostgresSchemaSql = (tablePrefix = "vulnerability") => {
       ON ${table.findings} (tenant_id, severity, last_seen_at DESC);
     CREATE INDEX IF NOT EXISTS ${table.findings}_tenant_asset_idx
       ON ${table.findings} (tenant_id, asset_id, last_seen_at DESC);
+    CREATE TABLE IF NOT EXISTS ${table.observations} (
+      tenant_id text NOT NULL,
+      observation_id text NOT NULL,
+      asset_id text NOT NULL,
+      component_id text NOT NULL,
+      observed_at timestamptz NOT NULL,
+      value jsonb NOT NULL,
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (tenant_id, observation_id)
+    );
+    CREATE INDEX IF NOT EXISTS ${table.observations}_tenant_asset_idx
+      ON ${table.observations} (tenant_id, asset_id, observed_at DESC);
+    CREATE INDEX IF NOT EXISTS ${table.observations}_tenant_component_idx
+      ON ${table.observations} (tenant_id, component_id, observed_at DESC);
+    CREATE TABLE IF NOT EXISTS ${table.riskAssessments} (
+      tenant_id text NOT NULL,
+      finding_id text NOT NULL,
+      priority text NOT NULL,
+      assessed_at timestamptz NOT NULL,
+      remediate_by timestamptz,
+      value jsonb NOT NULL,
+      updated_at timestamptz NOT NULL DEFAULT now(),
+      PRIMARY KEY (tenant_id, finding_id)
+    );
+    CREATE INDEX IF NOT EXISTS ${table.riskAssessments}_tenant_priority_idx
+      ON ${table.riskAssessments} (tenant_id, priority, assessed_at DESC);
+    CREATE INDEX IF NOT EXISTS ${table.riskAssessments}_tenant_due_idx
+      ON ${table.riskAssessments} (tenant_id, remediate_by)
+      WHERE remediate_by IS NOT NULL;
     CREATE TABLE IF NOT EXISTS ${table.leases} (
       feed_id text PRIMARY KEY,
       owner_id text NOT NULL,
@@ -378,6 +411,147 @@ var createPostgresVulnerabilityStore = (options) => {
     save: async (finding) => saveFindings([finding]),
     saveMany: saveFindings
   };
+  const parseObservation = (value) => {
+    const observation = json(value, "Vulnerability observation");
+    if (!Value.Check(VulnerabilityObservationSchema, observation))
+      throw new Error("Stored vulnerability observation is invalid");
+    return observation;
+  };
+  const saveObservations = async (tenantId, observations2) => {
+    await ensureSchema();
+    const normalizedTenantId = requiredText(tenantId, "Tenant id");
+    if (observations2.length === 0)
+      return;
+    for (const observation of observations2) {
+      const observationId = observation.id;
+      if (!Value.Check(VulnerabilityObservationSchema, observation))
+        throw new Error(`Vulnerability observation ${observationId} is invalid`);
+    }
+    const payload = JSON.stringify(observations2.map((observation) => ({
+      asset_id: observation.assetId,
+      component_id: observation.componentId,
+      observation_id: observation.id,
+      observed_at: observation.observedAt,
+      value: observation
+    })));
+    await sql`
+      INSERT INTO ${sql.unsafe(table.observations)} (
+        tenant_id, observation_id, asset_id, component_id, observed_at, value,
+        updated_at
+      )
+      SELECT
+        ${normalizedTenantId}, item.observation_id, item.asset_id,
+        item.component_id, item.observed_at::timestamptz, item.value, now()
+      FROM jsonb_to_recordset(${payload}::jsonb) AS item(
+        observation_id text, asset_id text, component_id text,
+        observed_at text, value jsonb
+      )
+      ON CONFLICT (tenant_id, observation_id) DO UPDATE SET
+        asset_id = EXCLUDED.asset_id,
+        component_id = EXCLUDED.component_id,
+        observed_at = EXCLUDED.observed_at,
+        value = EXCLUDED.value,
+        updated_at = now()
+    `;
+  };
+  const observations = {
+    get: async (tenantId, observationId) => {
+      await ensureSchema();
+      const rows = await sql`
+        SELECT value FROM ${sql.unsafe(table.observations)}
+        WHERE tenant_id = ${requiredText(tenantId, "Tenant id")}
+          AND observation_id = ${requiredText(observationId, "Observation id")}
+      `;
+      return rows[0] ? parseObservation(rows[0].value) : null;
+    },
+    list: async (filter) => {
+      await ensureSchema();
+      const tenantId = requiredText(filter.tenantId, "Tenant id");
+      const assetId = filter.assetId?.trim() || null;
+      const componentId = filter.componentId?.trim() || null;
+      const rows = await sql`
+        SELECT value FROM ${sql.unsafe(table.observations)}
+        WHERE tenant_id = ${tenantId}
+          AND (${assetId}::text IS NULL OR asset_id = ${assetId})
+          AND (${componentId}::text IS NULL OR component_id = ${componentId})
+        ORDER BY observed_at DESC, observation_id
+        LIMIT ${limit(filter.limit)}
+      `;
+      return rows.map(({ value }) => parseObservation(value));
+    },
+    save: async (tenantId, observation) => saveObservations(tenantId, [observation]),
+    saveMany: saveObservations
+  };
+  const parseRiskAssessment = (value) => {
+    const assessment = json(value, "Vulnerability risk assessment");
+    if (!Value.Check(VulnerabilityRiskAssessmentSchema, assessment))
+      throw new Error("Stored vulnerability risk assessment is invalid");
+    return assessment;
+  };
+  const saveRiskAssessments = async (tenantId, assessments) => {
+    await ensureSchema();
+    const normalizedTenantId = requiredText(tenantId, "Tenant id");
+    if (assessments.length === 0)
+      return;
+    for (const assessment of assessments) {
+      const findingId = assessment.findingId;
+      if (!Value.Check(VulnerabilityRiskAssessmentSchema, assessment))
+        throw new Error(`Vulnerability risk assessment ${findingId} is invalid`);
+    }
+    const payload = JSON.stringify(assessments.map((assessment) => ({
+      assessed_at: assessment.assessedAt,
+      finding_id: assessment.findingId,
+      priority: assessment.priority,
+      remediate_by: assessment.remediateBy,
+      value: assessment
+    })));
+    await sql`
+      INSERT INTO ${sql.unsafe(table.riskAssessments)} (
+        tenant_id, finding_id, priority, assessed_at, remediate_by, value,
+        updated_at
+      )
+      SELECT
+        ${normalizedTenantId}, item.finding_id, item.priority,
+        item.assessed_at::timestamptz, item.remediate_by::timestamptz,
+        item.value, now()
+      FROM jsonb_to_recordset(${payload}::jsonb) AS item(
+        finding_id text, priority text, assessed_at text, remediate_by text,
+        value jsonb
+      )
+      ON CONFLICT (tenant_id, finding_id) DO UPDATE SET
+        priority = EXCLUDED.priority,
+        assessed_at = EXCLUDED.assessed_at,
+        remediate_by = EXCLUDED.remediate_by,
+        value = EXCLUDED.value,
+        updated_at = now()
+    `;
+  };
+  const riskAssessments = {
+    get: async (tenantId, findingId) => {
+      await ensureSchema();
+      const rows = await sql`
+        SELECT value FROM ${sql.unsafe(table.riskAssessments)}
+        WHERE tenant_id = ${requiredText(tenantId, "Tenant id")}
+          AND finding_id = ${requiredText(findingId, "Finding id")}
+      `;
+      return rows[0] ? parseRiskAssessment(rows[0].value) : null;
+    },
+    list: async (filter) => {
+      await ensureSchema();
+      const tenantId = requiredText(filter.tenantId, "Tenant id");
+      const priority = filter.priority ?? null;
+      const rows = await sql`
+        SELECT value FROM ${sql.unsafe(table.riskAssessments)}
+        WHERE tenant_id = ${tenantId}
+          AND (${priority}::text IS NULL OR priority = ${priority})
+        ORDER BY assessed_at DESC, finding_id
+        LIMIT ${limit(filter.limit)}
+      `;
+      return rows.map(({ value }) => parseRiskAssessment(value));
+    },
+    save: async (tenantId, assessment) => saveRiskAssessments(tenantId, [assessment]),
+    saveMany: saveRiskAssessments
+  };
   const leases = {
     acquire: async (request) => {
       await ensureSchema();
@@ -415,7 +589,15 @@ var createPostgresVulnerabilityStore = (options) => {
       return rows.length > 0;
     }
   };
-  return { ensureSchema, findings, leases, snapshots, syncRuns };
+  return {
+    ensureSchema,
+    findings,
+    leases,
+    observations,
+    riskAssessments,
+    snapshots,
+    syncRuns
+  };
 };
 export {
   vulnerabilityPostgresSchemaSql,

package/dist/manifest.js

@@ -9,7 +9,7 @@ var manifest = defineManifest()({
     intents: [
       "persist vulnerability intelligence",
       "retain vulnerability sync history",
-      "store managed vulnerability findings"
+      "store managed vulnerability findings, observations, and risk assessments"
     ],
     keywords: ["vulnerabilities", "Postgres", "CVE", "feed-history"],
     protocols: ["PostgreSQL", "AbsoluteJS vulnerability contracts"]
@@ -17,7 +17,7 @@ var manifest = defineManifest()({
   identity: {
     accent: "#336791",
     category: "operations",
-    description: "Durable Postgres snapshots, records, sync history, managed findings, and distributed refresh leases.",
+    description: "Durable Postgres snapshots, sync history, findings, observations, risk assessments, and distributed refresh leases.",
     docsUrl: "https://github.com/absolutejs/vulnerabilities-postgres",
     name: "@absolutejs/vulnerabilities-postgres",
     tagline: "Keep vulnerability intelligence durable and auditable."
@@ -30,7 +30,7 @@ var manifest = defineManifest()({
       requires: {
         env: [
           {
-            description: "Postgres connection string for vulnerability intelligence and findings",
+            description: "Postgres connection string for vulnerability intelligence, findings, observations, and risk assessments",
             example: "postgres://user:pass@host/db",
             key: "DATABASE_URL",
             secret: true
@@ -45,7 +45,7 @@ var manifest = defineManifest()({
         ],
         services: [
           {
-            description: "Stores vulnerability intelligence, history, findings, and leases",
+            description: "Stores vulnerability intelligence, findings, observations, risk assessments, and leases",
             id: "postgres"
           }
         ]

package/dist/manifest.json

@@ -8,7 +8,7 @@
 		"intents": [
 			"persist vulnerability intelligence",
 			"retain vulnerability sync history",
-			"store managed vulnerability findings"
+			"store managed vulnerability findings, observations, and risk assessments"
 		],
 		"keywords": [
 			"vulnerabilities",
@@ -24,7 +24,7 @@
 	"identity": {
 		"accent": "#336791",
 		"category": "operations",
-		"description": "Durable Postgres snapshots, records, sync history, managed findings, and distributed refresh leases.",
+		"description": "Durable Postgres snapshots, sync history, findings, observations, risk assessments, and distributed refresh leases.",
 		"docsUrl": "https://github.com/absolutejs/vulnerabilities-postgres",
 		"name": "@absolutejs/vulnerabilities-postgres",
 		"tagline": "Keep vulnerability intelligence durable and auditable."
@@ -37,7 +37,7 @@
 			"requires": {
 				"env": [
 					{
-						"description": "Postgres connection string for vulnerability intelligence and findings",
+						"description": "Postgres connection string for vulnerability intelligence, findings, observations, and risk assessments",
 						"example": "postgres://user:pass@host/db",
 						"key": "DATABASE_URL",
 						"secret": true
@@ -52,7 +52,7 @@
 				],
 				"services": [
 					{
-						"description": "Stores vulnerability intelligence, history, findings, and leases",
+						"description": "Stores vulnerability intelligence, findings, observations, risk assessments, and leases",
 						"id": "postgres"
 					}
 				]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@absolutejs/vulnerabilities-postgres",
-  "version": "0.1.1",
-  "description": "Durable Postgres feed snapshots, sync history, managed findings, and refresh leases for AbsoluteJS vulnerability management.",
+  "version": "0.3.0",
+  "description": "Durable Postgres feeds, findings, observations, risk assessments, and refresh leases for AbsoluteJS vulnerability management.",
   "type": "module",
   "license": "BSL-1.1",
   "author": "Alex Kahn",
@@ -53,7 +53,7 @@
   ],
   "dependencies": {
     "@absolutejs/manifest": "0.3.0",
-    "@absolutejs/vulnerabilities": "0.6.0",
+    "@absolutejs/vulnerabilities": "0.7.0",
     "@sinclair/typebox": "0.34.52"
   },
   "peerDependencies": {