@ceon-oy/monitor-sdk 1.5.2 → 1.5.3

package/dist/index.d.mts

@@ -261,6 +261,21 @@ declare class MonitorClient {
     flush(): Promise<void>;
     private getErrorKey;
     close(): Promise<void>;
+    /**
+     * Node's fetch() (undici) wraps network-level failures (ECONNREFUSED, DNS lookup
+     * failures, TLS errors, ...) in a generic `TypeError: fetch failed`, with the real
+     * reason attached via the standard `cause` chain. Without unwrapping it, every
+     * network failure across the SDK is reported as the same opaque "fetch failed"
+     * message, with no way to diagnose it from the dashboard.
+     */
+    private describeErrorCause;
+    private truncateDescription;
+    /**
+     * Run `fn`, swallowing any throw and returning undefined instead. Used to read
+     * possibly-hostile Error fields (a throwing message/stack/cause getter) without
+     * losing whatever else was already read — each call degrades independently.
+     */
+    private safe;
     /**
      * Queue an SDK error to be reported to the server's system errors page.
      * Fire-and-forget — never throws. If reporting itself fails, logs to console only.
@@ -325,6 +340,55 @@ declare class MonitorClient {
     private startFlushTimer;
     private stopFlushTimer;
     syncDependencies(): Promise<void>;
+    /**
+     * How many sequential registry batches a version-fetch over this many packages
+     * will take, given the shared concurrency limit. Shared by fetchLatestVersions
+     * (which does the batching) and calculateSyncTimeoutMs (which budgets for it),
+     * so the two can't drift out of sync with each other.
+     */
+    private registryBatchCount;
+    /**
+     * Estimate a timeout budget that scales with how many roughly-equal-cost units of
+     * sequential work will run (registry batches, audit paths, ...), clamped to a
+     * floor/ceiling. Shared by calculateSyncTimeoutMs and calculateMultiPathAuditTimeoutMs
+     * so the two scaling formulas can't drift apart. At count=0 this always collapses to
+     * floorMs, since overheadMs alone never exceeds a floor sized for real work.
+     */
+    private estimateScaledTimeoutMs;
+    /**
+     * Scale the dependency sync timeout with how many registry lookups AND how many
+     * sequential POSTs (one per source, via sendTechnologiesWithEnvironment) it will
+     * make, so large dependency lists, many dependencySources, or a large requestTimeoutMs
+     * don't spuriously time out against a fixed budget.
+     *
+     * The POST-phase term (sources.length * requestTimeoutMs) is included even when
+     * version checking is off: performDependencySync still does one sequential POST per
+     * source regardless, so a flat overhead that ignores source count would under-budget
+     * that phase exactly the way a flat registry-batch estimate would under-budget large
+     * dependency lists.
+     *
+     * Registry batches are summed PER SOURCE (not over the combined total) because
+     * performDependencySync/fetchLatestVersions batch each source independently and
+     * sequentially — ceil(a/n) + ceil(b/n) can be larger than ceil((a+b)/n), so a
+     * single batch count over the combined total would under-estimate the real
+     * number of sequential registry round-trips when many small sources are configured.
+     */
+    private calculateSyncTimeoutMs;
+    /**
+     * Reads happen before syncDependencies' timeout/AbortSignal exists (see comment
+     * there), so this phase bounds itself with a wall-clock deadline on a budget that
+     * scales with how many sources are configured (mirroring calculateSyncTimeoutMs's
+     * scaling principle for the network phase). A plain deadline timestamp — not an
+     * AbortController — is enough here: readPackageJsonFromPath does purely synchronous,
+     * non-cancelable fs calls, so there is nothing for a signal to actually interrupt;
+     * it can only ever be checked between iterations, exactly like a deadline check.
+     * Once the budget is spent, stop reading further sources rather than always paying
+     * the full read cost for every configured dependencySource regardless of how long
+     * it's already taken — and report it via reportError, not just a console.warn, so a
+     * truncated sync isn't silently indistinguishable from a fully successful one on
+     * the dashboard.
+     */
+    private loadDependencySources;
     private performDependencySync;
     /**
      * Enrich technologies with latest version information from npm registry.
@@ -424,6 +488,13 @@ declare class MonitorClient {
      * Only works in Node.js environment (not browser/bundled).
      */
     private runCommandWithTimeout;
+    /**
+     * `npm audit --json` can exit without emitting valid JSON on stdout — e.g. the
+     * registry is unreachable, or a fatal npm error is written to stderr instead.
+     * Treat that as a soft failure (like a timeout) rather than throwing, so it
+     * doesn't surface as a confusing "Unexpected end of JSON input" SDK_ERROR.
+     */
+    private parseNpmAuditJson;
     /**
      * Run npm audit and send results to the monitoring server.
      * This scans the project for known vulnerabilities in dependencies.
@@ -446,6 +517,13 @@ declare class MonitorClient {
      * @returns Combined summary of all audit results
      */
     auditMultiplePaths(): Promise<MultiAuditSummary | null>;
+    /**
+     * Scale the multi-path audit timeout with how many paths it will scan, so
+     * configuring many auditPaths (or a large per-path auditTimeoutMs) doesn't
+     * spuriously time out the whole batch against a fixed budget — the same
+     * failure mode calculateSyncTimeoutMs fixes for dependency sync.
+     */
+    private calculateMultiPathAuditTimeoutMs;
     private performMultiPathAudit;
     /**
      * Parse npm audit JSON output into vulnerability items

package/dist/index.d.ts

@@ -261,6 +261,21 @@ declare class MonitorClient {
     flush(): Promise<void>;
     private getErrorKey;
     close(): Promise<void>;
+    /**
+     * Node's fetch() (undici) wraps network-level failures (ECONNREFUSED, DNS lookup
+     * failures, TLS errors, ...) in a generic `TypeError: fetch failed`, with the real
+     * reason attached via the standard `cause` chain. Without unwrapping it, every
+     * network failure across the SDK is reported as the same opaque "fetch failed"
+     * message, with no way to diagnose it from the dashboard.
+     */
+    private describeErrorCause;
+    private truncateDescription;
+    /**
+     * Run `fn`, swallowing any throw and returning undefined instead. Used to read
+     * possibly-hostile Error fields (a throwing message/stack/cause getter) without
+     * losing whatever else was already read — each call degrades independently.
+     */
+    private safe;
     /**
      * Queue an SDK error to be reported to the server's system errors page.
      * Fire-and-forget — never throws. If reporting itself fails, logs to console only.
@@ -325,6 +340,55 @@ declare class MonitorClient {
     private startFlushTimer;
     private stopFlushTimer;
     syncDependencies(): Promise<void>;
+    /**
+     * How many sequential registry batches a version-fetch over this many packages
+     * will take, given the shared concurrency limit. Shared by fetchLatestVersions
+     * (which does the batching) and calculateSyncTimeoutMs (which budgets for it),
+     * so the two can't drift out of sync with each other.
+     */
+    private registryBatchCount;
+    /**
+     * Estimate a timeout budget that scales with how many roughly-equal-cost units of
+     * sequential work will run (registry batches, audit paths, ...), clamped to a
+     * floor/ceiling. Shared by calculateSyncTimeoutMs and calculateMultiPathAuditTimeoutMs
+     * so the two scaling formulas can't drift apart. At count=0 this always collapses to
+     * floorMs, since overheadMs alone never exceeds a floor sized for real work.
+     */
+    private estimateScaledTimeoutMs;
+    /**
+     * Scale the dependency sync timeout with how many registry lookups AND how many
+     * sequential POSTs (one per source, via sendTechnologiesWithEnvironment) it will
+     * make, so large dependency lists, many dependencySources, or a large requestTimeoutMs
+     * don't spuriously time out against a fixed budget.
+     *
+     * The POST-phase term (sources.length * requestTimeoutMs) is included even when
+     * version checking is off: performDependencySync still does one sequential POST per
+     * source regardless, so a flat overhead that ignores source count would under-budget
+     * that phase exactly the way a flat registry-batch estimate would under-budget large
+     * dependency lists.
+     *
+     * Registry batches are summed PER SOURCE (not over the combined total) because
+     * performDependencySync/fetchLatestVersions batch each source independently and
+     * sequentially — ceil(a/n) + ceil(b/n) can be larger than ceil((a+b)/n), so a
+     * single batch count over the combined total would under-estimate the real
+     * number of sequential registry round-trips when many small sources are configured.
+     */
+    private calculateSyncTimeoutMs;
+    /**
+     * Reads happen before syncDependencies' timeout/AbortSignal exists (see comment
+     * there), so this phase bounds itself with a wall-clock deadline on a budget that
+     * scales with how many sources are configured (mirroring calculateSyncTimeoutMs's
+     * scaling principle for the network phase). A plain deadline timestamp — not an
+     * AbortController — is enough here: readPackageJsonFromPath does purely synchronous,
+     * non-cancelable fs calls, so there is nothing for a signal to actually interrupt;
+     * it can only ever be checked between iterations, exactly like a deadline check.
+     * Once the budget is spent, stop reading further sources rather than always paying
+     * the full read cost for every configured dependencySource regardless of how long
+     * it's already taken — and report it via reportError, not just a console.warn, so a
+     * truncated sync isn't silently indistinguishable from a fully successful one on
+     * the dashboard.
+     */
+    private loadDependencySources;
     private performDependencySync;
     /**
      * Enrich technologies with latest version information from npm registry.
@@ -424,6 +488,13 @@ declare class MonitorClient {
      * Only works in Node.js environment (not browser/bundled).
      */
     private runCommandWithTimeout;
+    /**
+     * `npm audit --json` can exit without emitting valid JSON on stdout — e.g. the
+     * registry is unreachable, or a fatal npm error is written to stderr instead.
+     * Treat that as a soft failure (like a timeout) rather than throwing, so it
+     * doesn't surface as a confusing "Unexpected end of JSON input" SDK_ERROR.
+     */
+    private parseNpmAuditJson;
     /**
      * Run npm audit and send results to the monitoring server.
      * This scans the project for known vulnerabilities in dependencies.
@@ -446,6 +517,13 @@ declare class MonitorClient {
      * @returns Combined summary of all audit results
      */
     auditMultiplePaths(): Promise<MultiAuditSummary | null>;
+    /**
+     * Scale the multi-path audit timeout with how many paths it will scan, so
+     * configuring many auditPaths (or a large per-path auditTimeoutMs) doesn't
+     * spuriously time out the whole batch against a fixed budget — the same
+     * failure mode calculateSyncTimeoutMs fixes for dependency sync.
+     */
+    private calculateMultiPathAuditTimeoutMs;
     private performMultiPathAudit;
     /**
      * Parse npm audit JSON output into vulnerability items

package/dist/index.js

@@ -64,9 +64,17 @@ var CONFIG_LIMITS = {
   TECH_VERSION_FETCH_TIMEOUT_MS: 3e4,
   // 30 seconds max for all version fetches
   SYNC_DEPENDENCIES_TIMEOUT_MS: 6e4,
-  // 60 seconds max for all dependency syncs
+  // floor: minimum timeout for all dependency syncs
+  MAX_SYNC_DEPENDENCIES_TIMEOUT_MS: 3e5,
+  // ceiling: 5 minutes, even for very large dependency lists
+  SYNC_FIXED_OVERHEAD_MS: 1e4,
+  // buffer per sync for local reads + POSTs to the server
   AUDIT_MULTI_PATH_TIMEOUT_MS: 18e4,
-  // 3 minutes max for all audit paths
+  // floor: minimum timeout for all audit paths
+  MAX_AUDIT_MULTI_PATH_TIMEOUT_MS: 18e5,
+  // ceiling: 30 minutes, even for many audit paths
+  AUDIT_MULTI_PATH_FIXED_OVERHEAD_MS: 1e4,
+  // buffer per multi-path audit for local reads + POSTs to the server
   REGISTRY_CONCURRENCY_LIMIT: 5,
   // Limit parallel requests to avoid rate limiting
   HEALTH_CHECK_FETCH_INTERVAL_MS: 6e4,
@@ -341,6 +349,46 @@ var MonitorClient = class {
     await this.flushHealthResults();
     await this.flushSdkErrors();
   }
+  /**
+   * Node's fetch() (undici) wraps network-level failures (ECONNREFUSED, DNS lookup
+   * failures, TLS errors, ...) in a generic `TypeError: fetch failed`, with the real
+   * reason attached via the standard `cause` chain. Without unwrapping it, every
+   * network failure across the SDK is reported as the same opaque "fetch failed"
+   * message, with no way to diagnose it from the dashboard.
+   */
+  describeErrorCause(err, depth = 0) {
+    if (depth > 3) return void 0;
+    const cause = err.cause;
+    if (cause === void 0 || cause === null) return void 0;
+    const aggregateErrors = cause.errors;
+    if (Array.isArray(aggregateErrors)) {
+      const childSummary = aggregateErrors.map((e) => e instanceof Error ? e.message : String(e)).join("; ");
+      const summary = cause instanceof Error && cause.message ? `${cause.message} (${childSummary})` : childSummary;
+      return this.truncateDescription(summary);
+    }
+    if (cause instanceof Error) {
+      const nested = this.describeErrorCause(cause, depth + 1);
+      const description = nested ? `${cause.message} (${nested})` : cause.message;
+      return this.truncateDescription(description);
+    }
+    return this.truncateDescription(String(cause));
+  }
+  truncateDescription(description) {
+    const limit = 500;
+    return description.length > limit ? `${description.slice(0, limit)}...` : description;
+  }
+  /**
+   * Run `fn`, swallowing any throw and returning undefined instead. Used to read
+   * possibly-hostile Error fields (a throwing message/stack/cause getter) without
+   * losing whatever else was already read — each call degrades independently.
+   */
+  safe(fn) {
+    try {
+      return fn();
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Queue an SDK error to be reported to the server's system errors page.
    * Fire-and-forget — never throws. If reporting itself fails, logs to console only.
@@ -349,8 +397,16 @@ var MonitorClient = class {
   reportError(category, message, err) {
     if (this.sdkErrorsInCurrentWindow >= 20) return;
     this.sdkErrorsInCurrentWindow++;
-    const errorMessage = err instanceof Error ? `${message}: ${err.message}` : message;
-    const stack = err instanceof Error ? err.stack : void 0;
+    let errorMessage = message;
+    let stack;
+    if (err instanceof Error) {
+      errorMessage = this.safe(() => `${message}: ${err.message}`) ?? message;
+      const causeDescription = this.safe(() => this.describeErrorCause(err));
+      if (causeDescription) {
+        errorMessage += ` (cause: ${causeDescription})`;
+      }
+      stack = this.safe(() => err.stack);
+    }
     this.sdkErrorQueue.push({ category, message: errorMessage, stack });
     if (this.sdkErrorQueue.length >= 20) {
       this.flushSdkErrors().catch(() => {
@@ -653,9 +709,11 @@ var MonitorClient = class {
   async syncDependencies() {
     console.log("[MonitorClient] Starting technology sync...");
     try {
+      const sources = await this.loadDependencySources();
+      const timeoutMs = this.calculateSyncTimeoutMs(sources);
       await this.withTimeout(
-        (signal) => this.performDependencySync(signal),
-        CONFIG_LIMITS.SYNC_DEPENDENCIES_TIMEOUT_MS,
+        (signal) => this.performDependencySync(sources, signal),
+        timeoutMs,
         "Technology sync timed out"
       );
       console.log("[MonitorClient] Technology sync completed successfully");
@@ -663,25 +721,100 @@ var MonitorClient = class {
       this.reportError("DEPENDENCY_SYNC", "Technology sync failed", err);
     }
   }
-  async performDependencySync(signal) {
+  /**
+   * How many sequential registry batches a version-fetch over this many packages
+   * will take, given the shared concurrency limit. Shared by fetchLatestVersions
+   * (which does the batching) and calculateSyncTimeoutMs (which budgets for it),
+   * so the two can't drift out of sync with each other.
+   */
+  registryBatchCount(itemCount) {
+    return Math.ceil(itemCount / CONFIG_LIMITS.REGISTRY_CONCURRENCY_LIMIT);
+  }
+  /**
+   * Estimate a timeout budget that scales with how many roughly-equal-cost units of
+   * sequential work will run (registry batches, audit paths, ...), clamped to a
+   * floor/ceiling. Shared by calculateSyncTimeoutMs and calculateMultiPathAuditTimeoutMs
+   * so the two scaling formulas can't drift apart. At count=0 this always collapses to
+   * floorMs, since overheadMs alone never exceeds a floor sized for real work.
+   */
+  estimateScaledTimeoutMs(count, perItemMs, overheadMs, floorMs, ceilingMs) {
+    const estimatedMs = count * perItemMs + overheadMs;
+    return Math.min(ceilingMs, Math.max(floorMs, estimatedMs));
+  }
+  /**
+   * Scale the dependency sync timeout with how many registry lookups AND how many
+   * sequential POSTs (one per source, via sendTechnologiesWithEnvironment) it will
+   * make, so large dependency lists, many dependencySources, or a large requestTimeoutMs
+   * don't spuriously time out against a fixed budget.
+   *
+   * The POST-phase term (sources.length * requestTimeoutMs) is included even when
+   * version checking is off: performDependencySync still does one sequential POST per
+   * source regardless, so a flat overhead that ignores source count would under-budget
+   * that phase exactly the way a flat registry-batch estimate would under-budget large
+   * dependency lists.
+   *
+   * Registry batches are summed PER SOURCE (not over the combined total) because
+   * performDependencySync/fetchLatestVersions batch each source independently and
+   * sequentially — ceil(a/n) + ceil(b/n) can be larger than ceil((a+b)/n), so a
+   * single batch count over the combined total would under-estimate the real
+   * number of sequential registry round-trips when many small sources are configured.
+   */
+  calculateSyncTimeoutMs(sources) {
+    const postPhaseMs = sources.length * this.requestTimeoutMs;
+    const batches = this.versionCheckEnabled ? sources.reduce((sum, source) => sum + this.registryBatchCount(source.technologies.length), 0) : 0;
+    return this.estimateScaledTimeoutMs(
+      batches,
+      this.registryTimeoutMs,
+      CONFIG_LIMITS.SYNC_FIXED_OVERHEAD_MS + postPhaseMs,
+      CONFIG_LIMITS.SYNC_DEPENDENCIES_TIMEOUT_MS,
+      CONFIG_LIMITS.MAX_SYNC_DEPENDENCIES_TIMEOUT_MS
+    );
+  }
+  /**
+   * Reads happen before syncDependencies' timeout/AbortSignal exists (see comment
+   * there), so this phase bounds itself with a wall-clock deadline on a budget that
+   * scales with how many sources are configured (mirroring calculateSyncTimeoutMs's
+   * scaling principle for the network phase). A plain deadline timestamp — not an
+   * AbortController — is enough here: readPackageJsonFromPath does purely synchronous,
+   * non-cancelable fs calls, so there is nothing for a signal to actually interrupt;
+   * it can only ever be checked between iterations, exactly like a deadline check.
+   * Once the budget is spent, stop reading further sources rather than always paying
+   * the full read cost for every configured dependencySource regardless of how long
+   * it's already taken — and report it via reportError, not just a console.warn, so a
+   * truncated sync isn't silently indistinguishable from a fully successful one on
+   * the dashboard.
+   */
+  async loadDependencySources() {
     if (this.dependencySources && this.dependencySources.length > 0) {
+      const sources = [];
+      const readBudgetMs = CONFIG_LIMITS.SYNC_FIXED_OVERHEAD_MS * this.dependencySources.length;
+      const deadline = Date.now() + readBudgetMs;
       for (const source of this.dependencySources) {
-        if (signal?.aborted) {
-          console.log("[MonitorClient] Technology sync cancelled");
-          return;
+        if (Date.now() >= deadline) {
+          const skippedCount = this.dependencySources.length - sources.length;
+          const warning = `Dependency source reads exceeded ${readBudgetMs}ms, skipping remaining ${skippedCount} source(s)`;
+          console.warn(`[MonitorClient] ${warning}`);
+          this.reportError("DEPENDENCY_SYNC", warning);
+          break;
         }
-        const technologies = await this.readPackageJsonFromPath(source.path);
-        if (technologies.length === 0) continue;
-        const enrichedTechnologies = await this.enrichWithLatestVersions(technologies, signal);
-        await this.sendTechnologiesWithEnvironment(enrichedTechnologies, source.environment);
-        console.log(`[MonitorClient] Technology sync completed for ${source.environment}`);
+        const technologies2 = await this.readPackageJsonFromPath(source.path);
+        sources.push({ environment: source.environment, technologies: technologies2 });
       }
-    } else {
-      const technologies = await this.readPackageJson();
-      if (technologies.length === 0) return;
-      const enrichedTechnologies = await this.enrichWithLatestVersions(technologies, signal);
-      await this.sendTechnologies(enrichedTechnologies);
-      console.log(`[MonitorClient] Technology sync completed for ${this.environment}`);
+      return sources;
+    }
+    const technologies = await this.readPackageJson();
+    return [{ environment: this.environment, technologies }];
+  }
+  async performDependencySync(sources, signal) {
+    for (const source of sources) {
+      if (signal?.aborted) {
+        console.log("[MonitorClient] Technology sync cancelled");
+        return;
+      }
+      if (source.technologies.length === 0) continue;
+      const enrichedTechnologies = await this.enrichWithLatestVersions(source.technologies, signal);
+      await this.sendTechnologiesWithEnvironment(enrichedTechnologies, source.environment);
+      console.log(`[MonitorClient] Technology sync completed for ${source.environment}`);
     }
   }
   /**
@@ -795,13 +928,22 @@ var MonitorClient = class {
     try {
       if (signal?.aborted) return null;
       const encodedName = encodeURIComponent(packageName).replace("%40", "@");
-      const response = await fetch(`${this.npmRegistryUrl}/${encodedName}`, {
-        headers: { "Accept": "application/json" },
-        signal: signal ?? AbortSignal.timeout(this.registryTimeoutMs)
-      });
-      if (!response.ok) return null;
-      const data = await response.json();
-      return data["dist-tags"]?.latest || null;
+      const requestController = new AbortController();
+      const timeoutId = setTimeout(() => requestController.abort(), this.registryTimeoutMs);
+      const onOuterAbort = () => requestController.abort();
+      signal?.addEventListener("abort", onOuterAbort);
+      try {
+        const response = await fetch(`${this.npmRegistryUrl}/${encodedName}`, {
+          headers: { "Accept": "application/json" },
+          signal: requestController.signal
+        });
+        if (!response.ok) return null;
+        const data = await response.json();
+        return data["dist-tags"]?.latest || null;
+      } finally {
+        clearTimeout(timeoutId);
+        signal?.removeEventListener("abort", onOuterAbort);
+      }
     } catch {
       return null;
     }
@@ -814,7 +956,7 @@ var MonitorClient = class {
   async fetchLatestVersions(packageNames, signal) {
     const results = /* @__PURE__ */ new Map();
     const concurrencyLimit = CONFIG_LIMITS.REGISTRY_CONCURRENCY_LIMIT;
-    const totalBatches = Math.ceil(packageNames.length / concurrencyLimit);
+    const totalBatches = this.registryBatchCount(packageNames.length);
     for (let i = 0; i < packageNames.length; i += concurrencyLimit) {
       if (signal?.aborted) {
         console.log("[MonitorClient] Version fetch cancelled");
@@ -1015,7 +1157,7 @@ var MonitorClient = class {
       });
       proc.on("close", () => {
         clearTimeout(timeoutId);
-        resolve({ stdout, timedOut });
+        resolve({ stdout, stderr, timedOut });
       });
       proc.on("error", (err) => {
         clearTimeout(timeoutId);
@@ -1023,6 +1165,30 @@ var MonitorClient = class {
       });
     });
   }
+  /**
+   * `npm audit --json` can exit without emitting valid JSON on stdout — e.g. the
+   * registry is unreachable, or a fatal npm error is written to stderr instead.
+   * Treat that as a soft failure (like a timeout) rather than throwing, so it
+   * doesn't surface as a confusing "Unexpected end of JSON input" SDK_ERROR.
+   */
+  parseNpmAuditJson(auditOutput, stderr) {
+    const stderrSuffix = () => {
+      const trimmedStderr = stderr.trim();
+      return trimmedStderr ? ` (stderr: ${this.truncateDescription(trimmedStderr)})` : "";
+    };
+    if (!auditOutput || auditOutput.trim().length === 0) {
+      console.error(`[MonitorClient] npm audit produced no output${stderrSuffix()}`);
+      return null;
+    }
+    try {
+      return JSON.parse(auditOutput);
+    } catch (err) {
+      console.error(
+        `[MonitorClient] npm audit produced invalid JSON: ${err instanceof Error ? err.message : String(err)}${stderrSuffix()}`
+      );
+      return null;
+    }
+  }
   /**
    * Run npm audit and send results to the monitoring server.
    * This scans the project for known vulnerabilities in dependencies.
@@ -1099,6 +1265,13 @@ var MonitorClient = class {
           return null;
         }
         auditOutput = result2.stdout;
+        if (!auditOutput || auditOutput.trim().length === 0) {
+          const trimmedStderr = result2.stderr.trim();
+          console.error(
+            `[MonitorClient] yarn audit produced no output${trimmedStderr ? ` (stderr: ${this.truncateDescription(trimmedStderr)})` : ""}`
+          );
+          return null;
+        }
         vulnerabilities = this.parseYarnAuditOutput(auditOutput);
         const lines = auditOutput.trim().split("\n");
         for (const line of lines) {
@@ -1111,22 +1284,10 @@ var MonitorClient = class {
           } catch {
           }
         }
-      } else if (packageManager === "pnpm") {
-        console.log("[MonitorClient] pnpm detected, using npm audit (pnpm compatible)");
-        const result2 = await this.runCommandWithTimeout("npm", ["audit", "--json"], {
-          cwd: projectPath,
-          timeout: this.auditTimeoutMs,
-          maxBuffer: CONFIG_LIMITS.AUDIT_MAX_BUFFER
-        });
-        if (result2.timedOut) {
-          console.error(`[MonitorClient] npm audit timed out after ${this.auditTimeoutMs}ms`);
-          return null;
-        }
-        auditOutput = result2.stdout;
-        const auditData = JSON.parse(auditOutput);
-        vulnerabilities = this.parseNpmAuditOutput(auditData);
-        totalDeps = auditData.metadata?.dependencies?.total || 0;
       } else {
+        if (packageManager === "pnpm") {
+          console.log("[MonitorClient] pnpm detected, using npm audit (pnpm compatible)");
+        }
         const result2 = await this.runCommandWithTimeout("npm", ["audit", "--json"], {
           cwd: projectPath,
           timeout: this.auditTimeoutMs,
@@ -1137,7 +1298,8 @@ var MonitorClient = class {
           return null;
         }
         auditOutput = result2.stdout;
-        const auditData = JSON.parse(auditOutput);
+        const auditData = this.parseNpmAuditJson(auditOutput, result2.stderr);
+        if (!auditData) return null;
         vulnerabilities = this.parseNpmAuditOutput(auditData);
         totalDeps = auditData.metadata?.dependencies?.total || 0;
       }
@@ -1182,9 +1344,10 @@ var MonitorClient = class {
     }
     console.log(`[MonitorClient] Starting multi-path audit (${this.auditPaths.length} paths)...`);
     try {
+      const timeoutMs = this.calculateMultiPathAuditTimeoutMs(this.auditPaths.length);
       const result = await this.withTimeout(
         () => this.performMultiPathAudit(),
-        CONFIG_LIMITS.AUDIT_MULTI_PATH_TIMEOUT_MS,
+        timeoutMs,
         "Multi-path audit timed out"
       );
       if (result) {
@@ -1196,6 +1359,21 @@ var MonitorClient = class {
       return null;
     }
   }
+  /**
+   * Scale the multi-path audit timeout with how many paths it will scan, so
+   * configuring many auditPaths (or a large per-path auditTimeoutMs) doesn't
+   * spuriously time out the whole batch against a fixed budget — the same
+   * failure mode calculateSyncTimeoutMs fixes for dependency sync.
+   */
+  calculateMultiPathAuditTimeoutMs(pathCount) {
+    return this.estimateScaledTimeoutMs(
+      pathCount,
+      this.auditTimeoutMs,
+      CONFIG_LIMITS.AUDIT_MULTI_PATH_FIXED_OVERHEAD_MS,
+      CONFIG_LIMITS.AUDIT_MULTI_PATH_TIMEOUT_MS,
+      CONFIG_LIMITS.MAX_AUDIT_MULTI_PATH_TIMEOUT_MS
+    );
+  }
   async performMultiPathAudit() {
     if (!this.auditPaths) return null;
     const results = [];

package/dist/index.mjs

@@ -28,9 +28,17 @@ var CONFIG_LIMITS = {
   TECH_VERSION_FETCH_TIMEOUT_MS: 3e4,
   // 30 seconds max for all version fetches
   SYNC_DEPENDENCIES_TIMEOUT_MS: 6e4,
-  // 60 seconds max for all dependency syncs
+  // floor: minimum timeout for all dependency syncs
+  MAX_SYNC_DEPENDENCIES_TIMEOUT_MS: 3e5,
+  // ceiling: 5 minutes, even for very large dependency lists
+  SYNC_FIXED_OVERHEAD_MS: 1e4,
+  // buffer per sync for local reads + POSTs to the server
   AUDIT_MULTI_PATH_TIMEOUT_MS: 18e4,
-  // 3 minutes max for all audit paths
+  // floor: minimum timeout for all audit paths
+  MAX_AUDIT_MULTI_PATH_TIMEOUT_MS: 18e5,
+  // ceiling: 30 minutes, even for many audit paths
+  AUDIT_MULTI_PATH_FIXED_OVERHEAD_MS: 1e4,
+  // buffer per multi-path audit for local reads + POSTs to the server
   REGISTRY_CONCURRENCY_LIMIT: 5,
   // Limit parallel requests to avoid rate limiting
   HEALTH_CHECK_FETCH_INTERVAL_MS: 6e4,
@@ -305,6 +313,46 @@ var MonitorClient = class {
     await this.flushHealthResults();
     await this.flushSdkErrors();
   }
+  /**
+   * Node's fetch() (undici) wraps network-level failures (ECONNREFUSED, DNS lookup
+   * failures, TLS errors, ...) in a generic `TypeError: fetch failed`, with the real
+   * reason attached via the standard `cause` chain. Without unwrapping it, every
+   * network failure across the SDK is reported as the same opaque "fetch failed"
+   * message, with no way to diagnose it from the dashboard.
+   */
+  describeErrorCause(err, depth = 0) {
+    if (depth > 3) return void 0;
+    const cause = err.cause;
+    if (cause === void 0 || cause === null) return void 0;
+    const aggregateErrors = cause.errors;
+    if (Array.isArray(aggregateErrors)) {
+      const childSummary = aggregateErrors.map((e) => e instanceof Error ? e.message : String(e)).join("; ");
+      const summary = cause instanceof Error && cause.message ? `${cause.message} (${childSummary})` : childSummary;
+      return this.truncateDescription(summary);
+    }
+    if (cause instanceof Error) {
+      const nested = this.describeErrorCause(cause, depth + 1);
+      const description = nested ? `${cause.message} (${nested})` : cause.message;
+      return this.truncateDescription(description);
+    }
+    return this.truncateDescription(String(cause));
+  }
+  truncateDescription(description) {
+    const limit = 500;
+    return description.length > limit ? `${description.slice(0, limit)}...` : description;
+  }
+  /**
+   * Run `fn`, swallowing any throw and returning undefined instead. Used to read
+   * possibly-hostile Error fields (a throwing message/stack/cause getter) without
+   * losing whatever else was already read — each call degrades independently.
+   */
+  safe(fn) {
+    try {
+      return fn();
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Queue an SDK error to be reported to the server's system errors page.
    * Fire-and-forget — never throws. If reporting itself fails, logs to console only.
@@ -313,8 +361,16 @@ var MonitorClient = class {
   reportError(category, message, err) {
     if (this.sdkErrorsInCurrentWindow >= 20) return;
     this.sdkErrorsInCurrentWindow++;
-    const errorMessage = err instanceof Error ? `${message}: ${err.message}` : message;
-    const stack = err instanceof Error ? err.stack : void 0;
+    let errorMessage = message;
+    let stack;
+    if (err instanceof Error) {
+      errorMessage = this.safe(() => `${message}: ${err.message}`) ?? message;
+      const causeDescription = this.safe(() => this.describeErrorCause(err));
+      if (causeDescription) {
+        errorMessage += ` (cause: ${causeDescription})`;
+      }
+      stack = this.safe(() => err.stack);
+    }
     this.sdkErrorQueue.push({ category, message: errorMessage, stack });
     if (this.sdkErrorQueue.length >= 20) {
       this.flushSdkErrors().catch(() => {
@@ -617,9 +673,11 @@ var MonitorClient = class {
   async syncDependencies() {
     console.log("[MonitorClient] Starting technology sync...");
     try {
+      const sources = await this.loadDependencySources();
+      const timeoutMs = this.calculateSyncTimeoutMs(sources);
       await this.withTimeout(
-        (signal) => this.performDependencySync(signal),
-        CONFIG_LIMITS.SYNC_DEPENDENCIES_TIMEOUT_MS,
+        (signal) => this.performDependencySync(sources, signal),
+        timeoutMs,
         "Technology sync timed out"
       );
       console.log("[MonitorClient] Technology sync completed successfully");
@@ -627,25 +685,100 @@ var MonitorClient = class {
       this.reportError("DEPENDENCY_SYNC", "Technology sync failed", err);
     }
   }
-  async performDependencySync(signal) {
+  /**
+   * How many sequential registry batches a version-fetch over this many packages
+   * will take, given the shared concurrency limit. Shared by fetchLatestVersions
+   * (which does the batching) and calculateSyncTimeoutMs (which budgets for it),
+   * so the two can't drift out of sync with each other.
+   */
+  registryBatchCount(itemCount) {
+    return Math.ceil(itemCount / CONFIG_LIMITS.REGISTRY_CONCURRENCY_LIMIT);
+  }
+  /**
+   * Estimate a timeout budget that scales with how many roughly-equal-cost units of
+   * sequential work will run (registry batches, audit paths, ...), clamped to a
+   * floor/ceiling. Shared by calculateSyncTimeoutMs and calculateMultiPathAuditTimeoutMs
+   * so the two scaling formulas can't drift apart. At count=0 this always collapses to
+   * floorMs, since overheadMs alone never exceeds a floor sized for real work.
+   */
+  estimateScaledTimeoutMs(count, perItemMs, overheadMs, floorMs, ceilingMs) {
+    const estimatedMs = count * perItemMs + overheadMs;
+    return Math.min(ceilingMs, Math.max(floorMs, estimatedMs));
+  }
+  /**
+   * Scale the dependency sync timeout with how many registry lookups AND how many
+   * sequential POSTs (one per source, via sendTechnologiesWithEnvironment) it will
+   * make, so large dependency lists, many dependencySources, or a large requestTimeoutMs
+   * don't spuriously time out against a fixed budget.
+   *
+   * The POST-phase term (sources.length * requestTimeoutMs) is included even when
+   * version checking is off: performDependencySync still does one sequential POST per
+   * source regardless, so a flat overhead that ignores source count would under-budget
+   * that phase exactly the way a flat registry-batch estimate would under-budget large
+   * dependency lists.
+   *
+   * Registry batches are summed PER SOURCE (not over the combined total) because
+   * performDependencySync/fetchLatestVersions batch each source independently and
+   * sequentially — ceil(a/n) + ceil(b/n) can be larger than ceil((a+b)/n), so a
+   * single batch count over the combined total would under-estimate the real
+   * number of sequential registry round-trips when many small sources are configured.
+   */
+  calculateSyncTimeoutMs(sources) {
+    const postPhaseMs = sources.length * this.requestTimeoutMs;
+    const batches = this.versionCheckEnabled ? sources.reduce((sum, source) => sum + this.registryBatchCount(source.technologies.length), 0) : 0;
+    return this.estimateScaledTimeoutMs(
+      batches,
+      this.registryTimeoutMs,
+      CONFIG_LIMITS.SYNC_FIXED_OVERHEAD_MS + postPhaseMs,
+      CONFIG_LIMITS.SYNC_DEPENDENCIES_TIMEOUT_MS,
+      CONFIG_LIMITS.MAX_SYNC_DEPENDENCIES_TIMEOUT_MS
+    );
+  }
+  /**
+   * Reads happen before syncDependencies' timeout/AbortSignal exists (see comment
+   * there), so this phase bounds itself with a wall-clock deadline on a budget that
+   * scales with how many sources are configured (mirroring calculateSyncTimeoutMs's
+   * scaling principle for the network phase). A plain deadline timestamp — not an
+   * AbortController — is enough here: readPackageJsonFromPath does purely synchronous,
+   * non-cancelable fs calls, so there is nothing for a signal to actually interrupt;
+   * it can only ever be checked between iterations, exactly like a deadline check.
+   * Once the budget is spent, stop reading further sources rather than always paying
+   * the full read cost for every configured dependencySource regardless of how long
+   * it's already taken — and report it via reportError, not just a console.warn, so a
+   * truncated sync isn't silently indistinguishable from a fully successful one on
+   * the dashboard.
+   */
+  async loadDependencySources() {
     if (this.dependencySources && this.dependencySources.length > 0) {
+      const sources = [];
+      const readBudgetMs = CONFIG_LIMITS.SYNC_FIXED_OVERHEAD_MS * this.dependencySources.length;
+      const deadline = Date.now() + readBudgetMs;
       for (const source of this.dependencySources) {
-        if (signal?.aborted) {
-          console.log("[MonitorClient] Technology sync cancelled");
-          return;
+        if (Date.now() >= deadline) {
+          const skippedCount = this.dependencySources.length - sources.length;
+          const warning = `Dependency source reads exceeded ${readBudgetMs}ms, skipping remaining ${skippedCount} source(s)`;
+          console.warn(`[MonitorClient] ${warning}`);
+          this.reportError("DEPENDENCY_SYNC", warning);
+          break;
         }
-        const technologies = await this.readPackageJsonFromPath(source.path);
-        if (technologies.length === 0) continue;
-        const enrichedTechnologies = await this.enrichWithLatestVersions(technologies, signal);
-        await this.sendTechnologiesWithEnvironment(enrichedTechnologies, source.environment);
-        console.log(`[MonitorClient] Technology sync completed for ${source.environment}`);
+        const technologies2 = await this.readPackageJsonFromPath(source.path);
+        sources.push({ environment: source.environment, technologies: technologies2 });
       }
-    } else {
-      const technologies = await this.readPackageJson();
-      if (technologies.length === 0) return;
-      const enrichedTechnologies = await this.enrichWithLatestVersions(technologies, signal);
-      await this.sendTechnologies(enrichedTechnologies);
-      console.log(`[MonitorClient] Technology sync completed for ${this.environment}`);
+      return sources;
+    }
+    const technologies = await this.readPackageJson();
+    return [{ environment: this.environment, technologies }];
+  }
+  async performDependencySync(sources, signal) {
+    for (const source of sources) {
+      if (signal?.aborted) {
+        console.log("[MonitorClient] Technology sync cancelled");
+        return;
+      }
+      if (source.technologies.length === 0) continue;
+      const enrichedTechnologies = await this.enrichWithLatestVersions(source.technologies, signal);
+      await this.sendTechnologiesWithEnvironment(enrichedTechnologies, source.environment);
+      console.log(`[MonitorClient] Technology sync completed for ${source.environment}`);
     }
   }
   /**
@@ -759,13 +892,22 @@ var MonitorClient = class {
     try {
       if (signal?.aborted) return null;
       const encodedName = encodeURIComponent(packageName).replace("%40", "@");
-      const response = await fetch(`${this.npmRegistryUrl}/${encodedName}`, {
-        headers: { "Accept": "application/json" },
-        signal: signal ?? AbortSignal.timeout(this.registryTimeoutMs)
-      });
-      if (!response.ok) return null;
-      const data = await response.json();
-      return data["dist-tags"]?.latest || null;
+      const requestController = new AbortController();
+      const timeoutId = setTimeout(() => requestController.abort(), this.registryTimeoutMs);
+      const onOuterAbort = () => requestController.abort();
+      signal?.addEventListener("abort", onOuterAbort);
+      try {
+        const response = await fetch(`${this.npmRegistryUrl}/${encodedName}`, {
+          headers: { "Accept": "application/json" },
+          signal: requestController.signal
+        });
+        if (!response.ok) return null;
+        const data = await response.json();
+        return data["dist-tags"]?.latest || null;
+      } finally {
+        clearTimeout(timeoutId);
+        signal?.removeEventListener("abort", onOuterAbort);
+      }
     } catch {
       return null;
     }
@@ -778,7 +920,7 @@ var MonitorClient = class {
   async fetchLatestVersions(packageNames, signal) {
     const results = /* @__PURE__ */ new Map();
     const concurrencyLimit = CONFIG_LIMITS.REGISTRY_CONCURRENCY_LIMIT;
-    const totalBatches = Math.ceil(packageNames.length / concurrencyLimit);
+    const totalBatches = this.registryBatchCount(packageNames.length);
     for (let i = 0; i < packageNames.length; i += concurrencyLimit) {
       if (signal?.aborted) {
         console.log("[MonitorClient] Version fetch cancelled");
@@ -979,7 +1121,7 @@ var MonitorClient = class {
       });
       proc.on("close", () => {
         clearTimeout(timeoutId);
-        resolve({ stdout, timedOut });
+        resolve({ stdout, stderr, timedOut });
       });
       proc.on("error", (err) => {
         clearTimeout(timeoutId);
@@ -987,6 +1129,30 @@ var MonitorClient = class {
       });
     });
   }
+  /**
+   * `npm audit --json` can exit without emitting valid JSON on stdout — e.g. the
+   * registry is unreachable, or a fatal npm error is written to stderr instead.
+   * Treat that as a soft failure (like a timeout) rather than throwing, so it
+   * doesn't surface as a confusing "Unexpected end of JSON input" SDK_ERROR.
+   */
+  parseNpmAuditJson(auditOutput, stderr) {
+    const stderrSuffix = () => {
+      const trimmedStderr = stderr.trim();
+      return trimmedStderr ? ` (stderr: ${this.truncateDescription(trimmedStderr)})` : "";
+    };
+    if (!auditOutput || auditOutput.trim().length === 0) {
+      console.error(`[MonitorClient] npm audit produced no output${stderrSuffix()}`);
+      return null;
+    }
+    try {
+      return JSON.parse(auditOutput);
+    } catch (err) {
+      console.error(
+        `[MonitorClient] npm audit produced invalid JSON: ${err instanceof Error ? err.message : String(err)}${stderrSuffix()}`
+      );
+      return null;
+    }
+  }
   /**
    * Run npm audit and send results to the monitoring server.
    * This scans the project for known vulnerabilities in dependencies.
@@ -1063,6 +1229,13 @@ var MonitorClient = class {
           return null;
         }
         auditOutput = result2.stdout;
+        if (!auditOutput || auditOutput.trim().length === 0) {
+          const trimmedStderr = result2.stderr.trim();
+          console.error(
+            `[MonitorClient] yarn audit produced no output${trimmedStderr ? ` (stderr: ${this.truncateDescription(trimmedStderr)})` : ""}`
+          );
+          return null;
+        }
         vulnerabilities = this.parseYarnAuditOutput(auditOutput);
         const lines = auditOutput.trim().split("\n");
         for (const line of lines) {
@@ -1075,22 +1248,10 @@ var MonitorClient = class {
           } catch {
           }
         }
-      } else if (packageManager === "pnpm") {
-        console.log("[MonitorClient] pnpm detected, using npm audit (pnpm compatible)");
-        const result2 = await this.runCommandWithTimeout("npm", ["audit", "--json"], {
-          cwd: projectPath,
-          timeout: this.auditTimeoutMs,
-          maxBuffer: CONFIG_LIMITS.AUDIT_MAX_BUFFER
-        });
-        if (result2.timedOut) {
-          console.error(`[MonitorClient] npm audit timed out after ${this.auditTimeoutMs}ms`);
-          return null;
-        }
-        auditOutput = result2.stdout;
-        const auditData = JSON.parse(auditOutput);
-        vulnerabilities = this.parseNpmAuditOutput(auditData);
-        totalDeps = auditData.metadata?.dependencies?.total || 0;
       } else {
+        if (packageManager === "pnpm") {
+          console.log("[MonitorClient] pnpm detected, using npm audit (pnpm compatible)");
+        }
         const result2 = await this.runCommandWithTimeout("npm", ["audit", "--json"], {
           cwd: projectPath,
           timeout: this.auditTimeoutMs,
@@ -1101,7 +1262,8 @@ var MonitorClient = class {
           return null;
         }
         auditOutput = result2.stdout;
-        const auditData = JSON.parse(auditOutput);
+        const auditData = this.parseNpmAuditJson(auditOutput, result2.stderr);
+        if (!auditData) return null;
         vulnerabilities = this.parseNpmAuditOutput(auditData);
         totalDeps = auditData.metadata?.dependencies?.total || 0;
       }
@@ -1146,9 +1308,10 @@ var MonitorClient = class {
     }
     console.log(`[MonitorClient] Starting multi-path audit (${this.auditPaths.length} paths)...`);
     try {
+      const timeoutMs = this.calculateMultiPathAuditTimeoutMs(this.auditPaths.length);
       const result = await this.withTimeout(
         () => this.performMultiPathAudit(),
-        CONFIG_LIMITS.AUDIT_MULTI_PATH_TIMEOUT_MS,
+        timeoutMs,
         "Multi-path audit timed out"
       );
       if (result) {
@@ -1160,6 +1323,21 @@ var MonitorClient = class {
       return null;
     }
   }
+  /**
+   * Scale the multi-path audit timeout with how many paths it will scan, so
+   * configuring many auditPaths (or a large per-path auditTimeoutMs) doesn't
+   * spuriously time out the whole batch against a fixed budget — the same
+   * failure mode calculateSyncTimeoutMs fixes for dependency sync.
+   */
+  calculateMultiPathAuditTimeoutMs(pathCount) {
+    return this.estimateScaledTimeoutMs(
+      pathCount,
+      this.auditTimeoutMs,
+      CONFIG_LIMITS.AUDIT_MULTI_PATH_FIXED_OVERHEAD_MS,
+      CONFIG_LIMITS.AUDIT_MULTI_PATH_TIMEOUT_MS,
+      CONFIG_LIMITS.MAX_AUDIT_MULTI_PATH_TIMEOUT_MS
+    );
+  }
   async performMultiPathAudit() {
     if (!this.auditPaths) return null;
     const results = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ceon-oy/monitor-sdk",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "Client SDK for Ceon Monitor - Error tracking, health monitoring, security events, and vulnerability scanning",
   "author": "Ceon",
   "license": "MIT",