@blamejs/exceptd-skills 0.19.33 → 0.19.34

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (119) hide show
  1. package/CHANGELOG.md +10 -0
  2. package/bin/exceptd.js +896 -2824
  3. package/data/_indexes/_meta.json +2 -2
  4. package/lib/auto-discovery.js +56 -286
  5. package/lib/canonical-eq.js +7 -40
  6. package/lib/citation-resolve.js +22 -70
  7. package/lib/collectors/ai-api.js +20 -54
  8. package/lib/collectors/cicd-pipeline-compromise.js +40 -108
  9. package/lib/collectors/citation-hygiene.js +72 -210
  10. package/lib/collectors/containers.js +41 -130
  11. package/lib/collectors/cred-stores.js +31 -115
  12. package/lib/collectors/crypto-codebase.js +55 -138
  13. package/lib/collectors/crypto.js +24 -54
  14. package/lib/collectors/hardening.js +20 -78
  15. package/lib/collectors/kernel.js +16 -46
  16. package/lib/collectors/library-author.js +57 -206
  17. package/lib/collectors/mcp.js +24 -70
  18. package/lib/collectors/runtime.js +24 -86
  19. package/lib/collectors/sbom.js +34 -106
  20. package/lib/collectors/scan-excludes.js +31 -138
  21. package/lib/collectors/secrets.js +62 -178
  22. package/lib/cross-ref-api.js +39 -123
  23. package/lib/currency-severity.js +8 -27
  24. package/lib/cve-batch.js +13 -21
  25. package/lib/cve-cli.js +13 -20
  26. package/lib/cve-curation.js +72 -239
  27. package/lib/cve-regression-watcher.js +29 -152
  28. package/lib/cvss.js +13 -54
  29. package/lib/doctor-bucketing.js +3 -19
  30. package/lib/exit-codes.js +10 -42
  31. package/lib/flag-suggest.js +7 -25
  32. package/lib/framework-gap.js +35 -114
  33. package/lib/gap-detectors.js +37 -159
  34. package/lib/id-validation.js +9 -30
  35. package/lib/job-queue.js +13 -36
  36. package/lib/lint-skills.js +64 -232
  37. package/lib/playbook-runner.js +693 -2095
  38. package/lib/prefetch.js +100 -376
  39. package/lib/refresh-external.js +199 -627
  40. package/lib/refresh-network.js +75 -307
  41. package/lib/rfc-cli.js +23 -68
  42. package/lib/scoring.js +77 -145
  43. package/lib/sign.js +43 -229
  44. package/lib/source-advisories.js +43 -194
  45. package/lib/source-ghsa.js +37 -120
  46. package/lib/source-osv.js +94 -266
  47. package/lib/ttp-mapper.js +14 -24
  48. package/lib/upstream-check-cli.js +10 -28
  49. package/lib/upstream-check.js +19 -44
  50. package/lib/validate-catalog-meta.js +17 -61
  51. package/lib/validate-cve-catalog.js +43 -119
  52. package/lib/validate-indexes.js +25 -76
  53. package/lib/validate-package.js +16 -62
  54. package/lib/validate-playbooks.js +69 -275
  55. package/lib/validate-vendor.js +16 -49
  56. package/lib/verify.js +56 -286
  57. package/lib/version-pins.js +5 -34
  58. package/lib/worker-pool.js +11 -30
  59. package/lib/xml-tokenizer.js +47 -152
  60. package/manifest.json +53 -53
  61. package/orchestrator/dispatcher.js +17 -68
  62. package/orchestrator/event-bus.js +11 -74
  63. package/orchestrator/index.js +138 -412
  64. package/orchestrator/pipeline.js +28 -85
  65. package/orchestrator/scanner.js +34 -138
  66. package/orchestrator/scheduler.js +20 -84
  67. package/package.json +1 -1
  68. package/sbom.cdx.json +241 -241
  69. package/scripts/audit-catalog-gaps.js +9 -62
  70. package/scripts/audit-cross-skill.js +5 -31
  71. package/scripts/audit-perf.js +6 -16
  72. package/scripts/backfill-theater-test.js +7 -64
  73. package/scripts/bootstrap.js +12 -44
  74. package/scripts/build-indexes.js +40 -154
  75. package/scripts/builders/activity-feed.js +4 -14
  76. package/scripts/builders/catalog-summaries.js +3 -10
  77. package/scripts/builders/currency.js +7 -20
  78. package/scripts/builders/cwe-chains.js +7 -30
  79. package/scripts/builders/did-ladders.js +6 -13
  80. package/scripts/builders/frequency.js +5 -19
  81. package/scripts/builders/jurisdiction-clocks.js +6 -25
  82. package/scripts/builders/recipes.js +6 -14
  83. package/scripts/builders/section-offsets.js +13 -51
  84. package/scripts/builders/stale-content.js +7 -28
  85. package/scripts/builders/summary-cards.js +8 -29
  86. package/scripts/builders/theater-fingerprints.js +12 -27
  87. package/scripts/builders/token-budget.js +4 -31
  88. package/scripts/check-agents-md-collectors.js +11 -54
  89. package/scripts/check-catalog-gap-budget.js +15 -32
  90. package/scripts/check-changelog-extract.js +18 -48
  91. package/scripts/check-codebase-patterns-currency.js +6 -22
  92. package/scripts/check-codebase-patterns.js +50 -143
  93. package/scripts/check-epss-consistency.js +9 -64
  94. package/scripts/check-framework-gap-coverage.js +13 -31
  95. package/scripts/check-manifest-snapshot.js +13 -73
  96. package/scripts/check-sbom-currency.js +44 -142
  97. package/scripts/check-test-count.js +15 -52
  98. package/scripts/check-test-coverage.js +66 -197
  99. package/scripts/check-test-subjects.js +21 -62
  100. package/scripts/check-ttp-references.js +14 -38
  101. package/scripts/check-ttp-upstream.js +8 -40
  102. package/scripts/check-version-bump.js +9 -61
  103. package/scripts/check-version-tags.js +20 -121
  104. package/scripts/predeploy.js +38 -184
  105. package/scripts/refresh-manifest-snapshot.js +16 -38
  106. package/scripts/refresh-mitre-atlas.js +3 -8
  107. package/scripts/refresh-mitre-attack.js +1 -8
  108. package/scripts/refresh-mitre-d3fend.js +3 -9
  109. package/scripts/refresh-mitre-ics-attack.js +3 -8
  110. package/scripts/refresh-reverse-refs.js +27 -94
  111. package/scripts/refresh-rfc-index.js +2 -10
  112. package/scripts/refresh-sbom.js +31 -161
  113. package/scripts/refresh-upstream-catalogs.js +40 -137
  114. package/scripts/release.js +69 -232
  115. package/scripts/run-e2e-scenarios.js +24 -71
  116. package/scripts/sync-manifest-metadata.js +10 -34
  117. package/scripts/sync-package-description.js +8 -17
  118. package/scripts/validate-vendor-online.js +13 -44
  119. package/scripts/verify-shipped-tarball.js +35 -140
@@ -1,22 +1,12 @@
1
1
  'use strict';
2
2
 
3
3
  /**
4
- * Event bus for trigger-driven skill updates.
5
- *
6
- * Events are typed and carry structured payloads. Handlers are registered per
7
- * event type. This bus is in-process only; the event log is held in a bounded
8
- * ring buffer in memory and is NOT persisted across process restarts. For
9
- * production deployments where event history must survive restarts, swap the
10
- * internal emitter for a durable queue (Redis Streams, SQS, NATS JetStream,
11
- * etc.) without changing the event schema.
12
- *
13
- * Bounded log policy:
14
- * - The in-memory log is capped at EVENT_LOG_MAX_SIZE entries to prevent
15
- * unbounded memory growth on long-running `watch` processes.
16
- * - Default cap is 1000 entries; override at process start via the
17
- * EXCEPTD_EVENT_LOG_MAX_SIZE env var (positive integer).
18
- * - When the cap is reached, the oldest entry is shifted off on each new
19
- * emit (FIFO ring buffer semantics).
4
+ * Event bus for trigger-driven skill updates. This bus is in-process only: the
5
+ * event log is a bounded in-memory FIFO ring buffer and is NOT persisted across
6
+ * restarts, so a deployment needing durable history swaps the emitter for a
7
+ * queue without changing the event schema. The cap keeps a long-running `watch`
8
+ * from growing without bound — 1000 entries, overridden at process start by
9
+ * EXCEPTD_EVENT_LOG_MAX_SIZE (positive integer).
20
10
  */
21
11
 
22
12
  const { EventEmitter } = require('events');
@@ -46,7 +36,6 @@ const EVENT_TYPES = {
46
36
  SKILL_CURRENCY_LOW_AGGREGATE: 'skill.currency.low.aggregate'
47
37
  };
48
38
 
49
- // Maps event types to the skills they should trigger for review
50
39
  const EVENT_SKILL_MAP = {
51
40
  [EVENT_TYPES.CISA_KEV_ADDED]: ['kernel-lpe-triage', 'exploit-scoring', 'compliance-theater', 'skill-update-loop'],
52
41
  [EVENT_TYPES.ATLAS_VERSION_RELEASED]: ['ai-attack-surface', 'mcp-agent-trust', 'rag-pipeline-security', 'ai-c2-detection', 'skill-update-loop'],
@@ -70,12 +59,8 @@ class ExceptdEventBus extends EventEmitter {
70
59
  this.maxLogSize = cap;
71
60
  }
72
61
 
73
- /**
74
- * Emit a typed event with structured payload.
75
- *
76
- * @param {string} eventType - One of EVENT_TYPES
77
- * @param {object} payload - Event-specific data
78
- */
62
+ // Overrides EventEmitter.emit: `eventType` is one of EVENT_TYPES, and the
63
+ // return is the constructed event record, not the listener-present boolean.
79
64
  emit(eventType, payload) {
80
65
  const event = {
81
66
  event_id: `evt_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
@@ -86,9 +71,8 @@ class ExceptdEventBus extends EventEmitter {
86
71
  };
87
72
 
88
73
  this.eventLog.push(event);
89
- // Bounded ring buffer — shift the oldest entry off when over cap. Loop
90
- // rather than `if` so a runtime mutation of maxLogSize (or a burst that
91
- // exceeds the cap in a single tick) still leaves the buffer at-cap.
74
+ // A loop rather than an `if`: a lowered maxLogSize or a burst that clears
75
+ // the cap in one tick must still leave the buffer at-cap.
92
76
  while (this.eventLog.length > this.maxLogSize) {
93
77
  this.eventLog.shift();
94
78
  }
@@ -97,89 +81,42 @@ class ExceptdEventBus extends EventEmitter {
97
81
  return event;
98
82
  }
99
83
 
100
- /**
101
- * Register a handler for an event type.
102
- *
103
- * @param {string} eventType
104
- * @param {function} handler - (event) => void
105
- */
106
84
  on(eventType, handler) {
107
85
  super.on(eventType, handler);
108
86
  return this;
109
87
  }
110
88
 
111
- /**
112
- * Register a handler for all events.
113
- *
114
- * @param {function} handler - (event) => void
115
- */
116
89
  onAny(handler) {
117
90
  return this.on('*', handler);
118
91
  }
119
92
 
120
- /**
121
- * Detach a handler previously registered via onAny().
122
- *
123
- * @param {function} handler
124
- */
125
93
  offAny(handler) {
126
94
  this.removeListener('*', handler);
127
95
  return this;
128
96
  }
129
97
 
130
- /**
131
- * Get all events that affected a specific skill.
132
- *
133
- * @param {string} skillName
134
- * @returns {object[]}
135
- */
136
98
  getSkillEvents(skillName) {
137
99
  return this.eventLog.filter(e => e.affected_skills.includes(skillName));
138
100
  }
139
101
 
140
- /**
141
- * Get the event log, optionally filtered by type.
142
- *
143
- * @param {string} [eventType]
144
- * @returns {object[]}
145
- */
102
+ // Always a fresh array; mutating it does not touch the live log.
146
103
  getLog(eventType) {
147
104
  if (eventType) return this.eventLog.filter(e => e.type === eventType);
148
105
  return [...this.eventLog];
149
106
  }
150
107
 
151
- /**
152
- * Fire a CISA KEV addition event.
153
- *
154
- * @param {{ cve_id: string, kev_date: string, rwep_score: number }} params
155
- */
156
108
  kevAdded({ cve_id, kev_date, rwep_score }) {
157
109
  return this.emit(EVENT_TYPES.CISA_KEV_ADDED, { cve_id, kev_date, rwep_score });
158
110
  }
159
111
 
160
- /**
161
- * Fire an ATLAS version release event.
162
- *
163
- * @param {{ old_version: string, new_version: string, release_date: string }} params
164
- */
165
112
  atlasReleased({ old_version, new_version, release_date }) {
166
113
  return this.emit(EVENT_TYPES.ATLAS_VERSION_RELEASED, { old_version, new_version, release_date });
167
114
  }
168
115
 
169
- /**
170
- * Fire an exploit status change event.
171
- *
172
- * @param {{ cve_id: string, old_status: string, new_status: string }} params
173
- */
174
116
  exploitStatusChanged({ cve_id, old_status, new_status }) {
175
117
  return this.emit(EVENT_TYPES.EXPLOIT_STATUS_CHANGE, { cve_id, old_status, new_status });
176
118
  }
177
119
 
178
- /**
179
- * Fire a skill currency low event (emitted by scheduler).
180
- *
181
- * @param {{ skill_name: string, currency_score: number, days_since_review: number }} params
182
- */
183
120
  skillCurrencyLow({ skill_name, currency_score, days_since_review }) {
184
121
  return this.emit(EVENT_TYPES.SKILL_CURRENCY_LOW, { skill_name, currency_score, days_since_review });
185
122
  }