@cogenta/agents-builtin 0.1.0

package/dist/performance/diagnosis.js

@@ -0,0 +1,48 @@
+const MODERN_FORMATS = new Set(['webp', 'avif']);
+const LARGE_IMAGE_BYTES = 200_000;
+const MAX_THIRD_PARTY_SCRIPTS = 5;
+/**
+ * "Identification de la cause probable (image non optimisée, script tiers,
+ * bloc coûteux, requête lente)." CrUX is aggregate field data with no
+ * resource-level breakdown, so it cannot itself name a cause — this scans
+ * structural page metadata (already available via `content.read`) for
+ * known, well-established risk factors instead of profiling anything at
+ * runtime.
+ *
+ * "Bloc coûteux" (an expensive render block) and "requête lente" (a slow
+ * request) are deliberately not checked here: neither has a principled
+ * signal derivable from structural metadata alone — the first would need
+ * real DOM/render-cost data, the second real per-resource timing/waterfall
+ * data. Inventing a proxy for either would produce a finding this module
+ * cannot actually back, which is worse than not checking at all.
+ */
+export function diagnosePerformanceRisks(page) {
+    const findings = [];
+    const missingDimensions = page.images.filter((image) => image.width === undefined || image.height === undefined);
+    if (missingDimensions.length > 0) {
+        findings.push({
+            check: 'image_dimensions',
+            severity: 'warning',
+            message: `${missingDimensions.length} image(s) missing explicit width/height — a known cause of layout shift (CLS).`,
+        });
+    }
+    const unoptimized = page.images.filter((image) => image.sizeBytes !== undefined &&
+        image.sizeBytes > LARGE_IMAGE_BYTES &&
+        (image.format === undefined || !MODERN_FORMATS.has(image.format.toLowerCase())));
+    if (unoptimized.length > 0) {
+        findings.push({
+            check: 'image_optimization',
+            severity: 'warning',
+            message: `${unoptimized.length} image(s) over ${LARGE_IMAGE_BYTES / 1000}KB with no modern format (webp/avif) — likely hurting LCP and bandwidth.`,
+        });
+    }
+    if (page.thirdPartyScriptUrls.length > MAX_THIRD_PARTY_SCRIPTS) {
+        findings.push({
+            check: 'third_party_scripts',
+            severity: 'warning',
+            message: `${page.thirdPartyScriptUrls.length} third-party scripts — likely main-thread contention (INP) and extra connection overhead (TTFB).`,
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=diagnosis.js.map

package/dist/performance/diagnosis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnosis.js","sourceRoot":"","sources":["../../src/performance/diagnosis.ts"],"names":[],"mappings":"AAEA,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAChD,MAAM,iBAAiB,GAAG,OAAO,CAAA;AACjC,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAEjC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAA0B;IAE1B,MAAM,QAAQ,GAAyB,EAAE,CAAA;IAEzC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAC1C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CACnE,CAAA;IACD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,iBAAiB,CAAC,MAAM,gFAAgF;SACrH,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CACpC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,SAAS,KAAK,SAAS;QAC7B,KAAK,CAAC,SAAS,GAAG,iBAAiB;QACnC,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAClF,CAAA;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,oBAAoB;YAC3B,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,WAAW,CAAC,MAAM,kBAAkB,iBAAiB,GAAG,IAAI,0EAA0E;SACnJ,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,qBAAqB;YAC5B,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,kGAAkG;SAC/I,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/performance/median.d.ts

@@ -0,0 +1,11 @@
+import type { CruxMetrics } from './types.js';
+export declare function medianOf(values: readonly number[]): number | undefined;
+/**
+ * "Les mesures de performance sont bruitées. Une seule mesure ne prouve
+ * rien. Médiane sur plusieurs exécutions." Combines several `CruxMetrics`
+ * samples (e.g. repeated `queryCrux` calls) into one before it is ever
+ * compared to a budget or a baseline — a field missing from some samples is
+ * simply excluded from that field's median, not treated as zero.
+ */
+export declare function medianMetrics(samples: readonly CruxMetrics[]): CruxMetrics;
+//# sourceMappingURL=median.d.ts.map

package/dist/performance/median.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"median.d.ts","sourceRoot":"","sources":["../../src/performance/median.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAStE;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,CAU1E"}

package/dist/performance/median.js

@@ -0,0 +1,34 @@
+export function medianOf(values) {
+    if (values.length === 0)
+        return undefined;
+    const sorted = [...values].sort((a, b) => a - b);
+    const middle = Math.floor(sorted.length / 2);
+    if (sorted.length % 2 === 1)
+        return sorted[middle];
+    const lower = sorted[middle - 1];
+    const upper = sorted[middle];
+    if (lower === undefined || upper === undefined)
+        return undefined;
+    return (lower + upper) / 2;
+}
+const METRIC_FIELDS = ['lcpP75Ms', 'clsP75', 'inpP75Ms', 'ttfbP75Ms'];
+/**
+ * "Les mesures de performance sont bruitées. Une seule mesure ne prouve
+ * rien. Médiane sur plusieurs exécutions." Combines several `CruxMetrics`
+ * samples (e.g. repeated `queryCrux` calls) into one before it is ever
+ * compared to a budget or a baseline — a field missing from some samples is
+ * simply excluded from that field's median, not treated as zero.
+ */
+export function medianMetrics(samples) {
+    const result = {};
+    for (const field of METRIC_FIELDS) {
+        const values = samples
+            .map((sample) => sample[field])
+            .filter((value) => value !== undefined);
+        const median = medianOf(values);
+        if (median !== undefined)
+            result[field] = median;
+    }
+    return result;
+}
+//# sourceMappingURL=median.js.map

package/dist/performance/median.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"median.js","sourceRoot":"","sources":["../../src/performance/median.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,QAAQ,CAAC,MAAyB;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAChE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAU,CAAA;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAA+B;IAC3D,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO;aACnB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aAC9B,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;QAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAA;IAClD,CAAC;IACD,OAAO,MAAqB,CAAA;AAC9B,CAAC"}

package/dist/performance/regression.d.ts

@@ -0,0 +1,16 @@
+import type { CruxMetrics, PerformanceFinding } from './types.js';
+export interface DetectRegressionOptions {
+    readonly thresholdRatio?: number;
+}
+/**
+ * "Les mesures de performance sont bruitées. Une seule mesure ne prouve
+ * rien... seuil de régression assez large pour ne pas crier à chaque
+ * déploiement." A 15% default threshold — deliberately generous — is why
+ * this only fires on a real, sustained regression rather than normal
+ * field-data jitter between two measurement windows. Every metric here is
+ * "higher is worse" (LCP/INP/TTFB are durations, CLS is a shift score), so
+ * the comparison direction is the same for all four. A metric missing from
+ * either side is skipped, never flagged.
+ */
+export declare function detectRegression(current: CruxMetrics, baseline: CruxMetrics, options?: DetectRegressionOptions): readonly PerformanceFinding[];
+//# sourceMappingURL=regression.d.ts.map

package/dist/performance/regression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regression.d.ts","sourceRoot":"","sources":["../../src/performance/regression.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAkBjE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,GAAE,uBAA4B,GACpC,SAAS,kBAAkB,EAAE,CAqB/B"}

package/dist/performance/regression.js

@@ -0,0 +1,39 @@
+const DEFAULT_THRESHOLD_RATIO = 0.15;
+const CHECKS = [
+    { check: 'lcp_regression', metric: 'lcpP75Ms', label: 'LCP', unit: 'ms' },
+    { check: 'cls_regression', metric: 'clsP75', label: 'CLS', unit: '' },
+    { check: 'inp_regression', metric: 'inpP75Ms', label: 'INP', unit: 'ms' },
+    { check: 'ttfb_regression', metric: 'ttfbP75Ms', label: 'TTFB', unit: 'ms' },
+];
+/**
+ * "Les mesures de performance sont bruitées. Une seule mesure ne prouve
+ * rien... seuil de régression assez large pour ne pas crier à chaque
+ * déploiement." A 15% default threshold — deliberately generous — is why
+ * this only fires on a real, sustained regression rather than normal
+ * field-data jitter between two measurement windows. Every metric here is
+ * "higher is worse" (LCP/INP/TTFB are durations, CLS is a shift score), so
+ * the comparison direction is the same for all four. A metric missing from
+ * either side is skipped, never flagged.
+ */
+export function detectRegression(current, baseline, options = {}) {
+    const thresholdRatio = options.thresholdRatio ?? DEFAULT_THRESHOLD_RATIO;
+    const findings = [];
+    for (const { check, metric, label, unit } of CHECKS) {
+        const currentValue = current[metric];
+        const baselineValue = baseline[metric];
+        if (currentValue === undefined || baselineValue === undefined)
+            continue;
+        if (baselineValue <= 0)
+            continue;
+        const ratio = (currentValue - baselineValue) / baselineValue;
+        if (ratio > thresholdRatio) {
+            findings.push({
+                check,
+                severity: 'warning',
+                message: `${label} regressed from ${baselineValue}${unit} to ${currentValue}${unit} (+${(ratio * 100).toFixed(0)}%).`,
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=regression.js.map

package/dist/performance/regression.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regression.js","sourceRoot":"","sources":["../../src/performance/regression.ts"],"names":[],"mappings":"AAEA,MAAM,uBAAuB,GAAG,IAAI,CAAA;AASpC,MAAM,MAAM,GAA+B;IACzC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;IACzE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;IACrE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;IACzE,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;CAC7E,CAAA;AAMD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAoB,EACpB,QAAqB,EACrB,OAAO,GAA4B,EAAE;IAErC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAA;IACxE,MAAM,QAAQ,GAAyB,EAAE,CAAA;IAEzC,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;QACpD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QACpC,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;QACtC,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS;YAAE,SAAQ;QACvE,IAAI,aAAa,IAAI,CAAC;YAAE,SAAQ;QAEhC,MAAM,KAAK,GAAG,CAAC,YAAY,GAAG,aAAa,CAAC,GAAG,aAAa,CAAA;QAC5D,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK;gBACL,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,KAAK,mBAAmB,aAAa,GAAG,IAAI,OAAO,YAAY,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;aACtH,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/performance/types.d.ts

@@ -0,0 +1,39 @@
+/** p75 Core Web Vitals from CrUX field data — a field absent means CrUX has no data for that metric (not enough real-user traffic), not an error. */
+export interface CruxMetrics {
+    readonly lcpP75Ms?: number;
+    readonly clsP75?: number;
+    readonly inpP75Ms?: number;
+    readonly ttfbP75Ms?: number;
+}
+export type PerformanceSeverity = 'error' | 'warning' | 'info';
+/** Kept decoupled from `SeoFinding` — same severity-tagged-finding shape, different domain, no cross-domain coupling for its own sake. */
+export interface PerformanceFinding {
+    readonly check: string;
+    readonly severity: PerformanceSeverity;
+    readonly message: string;
+}
+export interface PerformanceBudget {
+    readonly lcpMs?: number;
+    readonly clsScore?: number;
+    readonly inpMs?: number;
+    readonly ttfbMs?: number;
+}
+export interface PerformanceImage {
+    readonly width?: number;
+    readonly height?: number;
+    readonly sizeBytes?: number;
+    /** e.g. 'jpeg' | 'png' | 'webp' | 'avif' — whatever the media store reports. */
+    readonly format?: string;
+}
+/**
+ * Deliberately not `@cogenta/blocks`' own entry/media types — same
+ * narrow-structural-interface reasoning as `ContentServiceLike` (L4 task 5)
+ * and `SeoPageInput` (L5 task 5). Only the fields a structural risk scan can
+ * honestly use.
+ */
+export interface PerformancePageInput {
+    readonly url: string;
+    readonly images: readonly PerformanceImage[];
+    readonly thirdPartyScriptUrls: readonly string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/performance/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/performance/types.ts"],"names":[],"mappings":"AAAA,qJAAqJ;AACrJ,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;AAE9D,0IAA0I;AAC1I,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC5C,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CACjD"}

package/dist/performance/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/performance/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/performance/types.ts"],"names":[],"mappings":""}

package/dist/security/agent.d.ts

@@ -0,0 +1,14 @@
+import { type AgentDeclaration } from '@cogenta/agents';
+/**
+ * "Autonomie par défaut : `deps.scan` autonome, `deps.patch` en
+ * proposition." `deps.scan` is read-only (task 3) so autonomous execution
+ * never touches anything; `deps.patch` opens a PR (task 4) and stays at the
+ * agent's `default` level (`propose`) by never being named in `overrides`.
+ * "Le mode autonome sur `deps.patch` est désactivé à l'installation et
+ * exige une confirmation avec avertissement" is a deployment-time
+ * configuration control, not something this declaration can enforce at
+ * runtime (same scoping the autonomy decorator itself documents, L4 task 9)
+ * — the safeguard here is simply that nothing in this file grants it.
+ */
+export declare const securityAgent: AgentDeclaration;
+//# sourceMappingURL=agent.d.ts.map

package/dist/security/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/security/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAe,MAAM,iBAAiB,CAAA;AAEpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,EAAE,gBAsB1B,CAAA"}

package/dist/security/agent.js

@@ -0,0 +1,36 @@
+import { defineAgent } from '@cogenta/agents';
+/**
+ * "Autonomie par défaut : `deps.scan` autonome, `deps.patch` en
+ * proposition." `deps.scan` is read-only (task 3) so autonomous execution
+ * never touches anything; `deps.patch` opens a PR (task 4) and stays at the
+ * agent's `default` level (`propose`) by never being named in `overrides`.
+ * "Le mode autonome sur `deps.patch` est désactivé à l'installation et
+ * exige une confirmation avec avertissement" is a deployment-time
+ * configuration control, not something this declaration can enforce at
+ * runtime (same scoping the autonomy decorator itself documents, L4 task 9)
+ * — the safeguard here is simply that nothing in this file grants it.
+ */
+export const securityAgent = defineAgent({
+    name: 'security',
+    identity: './identity.md',
+    model: { preferred: 'claude-sonnet', fallback: 'local' },
+    tools: [
+        'deps.scan',
+        'deps.patch',
+        'content.read',
+        'site.config_read',
+        'http.fetch',
+        'channel.send',
+        'build.trigger',
+    ],
+    skills: ['cve-triage', 'security-report'],
+    autonomy: { default: 'propose', overrides: { 'deps.scan': 'autonomous' } },
+    budget: { tokensPerDay: 200_000, eurPerMonth: 10, callsPerHour: 30 },
+    memory: { episodic: true, semantic: true, procedural: true, scope: 'site' },
+    triggers: [
+        { on: 'cve.published' },
+        { on: 'schedule', cron: '0 6 * * *' },
+        { on: 'dependency.installed' },
+    ],
+});
+//# sourceMappingURL=agent.js.map

package/dist/security/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../src/security/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEpE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAqB,WAAW,CAAC;IACzD,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE;IACxD,KAAK,EAAE;QACL,WAAW;QACX,YAAY;QACZ,cAAc;QACd,kBAAkB;QAClB,YAAY;QACZ,cAAc;QACd,eAAe;KAChB;IACD,MAAM,EAAE,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE;IAC1E,MAAM,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;IACpE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE;IAC3E,QAAQ,EAAE;QACR,EAAE,EAAE,EAAE,eAAe,EAAE;QACvB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE;QACrC,EAAE,EAAE,EAAE,sBAAsB,EAAE;KAC/B;CACF,CAAC,CAAA"}

package/dist/security/bump-version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * A targeted string replace, not a JSON parse/re-stringify — a real
+ * `package.json` has formatting (indentation, key order, trailing newline)
+ * a round trip through `JSON.stringify` would blow away, turning a
+ * one-line security fix into a noisy, hard-to-review diff.
+ */
+export declare function bumpDependencyVersion(fileContent: string, packageName: string, newVersion: string): string;
+//# sourceMappingURL=bump-version.d.ts.map

package/dist/security/bump-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bump-version.d.ts","sourceRoot":"","sources":["../../src/security/bump-version.ts"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAUR"}

package/dist/security/bump-version.js

@@ -0,0 +1,22 @@
+import { CogentaError } from '@cogenta/core';
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * A targeted string replace, not a JSON parse/re-stringify — a real
+ * `package.json` has formatting (indentation, key order, trailing newline)
+ * a round trip through `JSON.stringify` would blow away, turning a
+ * one-line security fix into a noisy, hard-to-review diff.
+ */
+export function bumpDependencyVersion(fileContent, packageName, newVersion) {
+    const pattern = new RegExp(`("${escapeRegExp(packageName)}"\\s*:\\s*")([^"]+)(")`);
+    if (!pattern.test(fileContent)) {
+        throw new CogentaError({
+            code: 'SECURITY_DEPENDENCY_NOT_FOUND',
+            message: `"${packageName}" was not found in the given dependency file.`,
+            hint: 'Check the package name and that the right file content was passed.',
+        });
+    }
+    return fileContent.replace(pattern, `$1${newVersion}$3`);
+}
+//# sourceMappingURL=bump-version.js.map

package/dist/security/bump-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bump-version.js","sourceRoot":"","sources":["../../src/security/bump-version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAE5C,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAmB,EACnB,WAAmB,EACnB,UAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,KAAK,YAAY,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAA;IAClF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,IAAI,WAAW,+CAA+C;YACvE,IAAI,EAAE,oEAAoE;SAC3E,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,UAAU,IAAI,CAAC,CAAA;AAC1D,CAAC"}

package/dist/security/deps-patch-tool.d.ts

@@ -0,0 +1,34 @@
+import { type ToolDefinition } from '@cogenta/agents';
+import { z } from 'zod';
+import type { PrClient } from './pr-client.js';
+export interface DepsPatchToolOptions {
+    readonly prClient: PrClient;
+    readonly baseBranch?: string;
+}
+declare const DepsPatchInputSchema: z.ZodObject<{
+    package: z.ZodString;
+    currentVersion: z.ZodString;
+    fixedVersion: z.ZodString;
+    dependencyFilePath: z.ZodString;
+    dependencyFileContent: z.ZodString;
+    findingSummary: z.ZodString;
+}, z.core.$strip>;
+export type DepsPatchInput = z.infer<typeof DepsPatchInputSchema>;
+declare const DepsPatchOutputSchema: z.ZodObject<{
+    prUrl: z.ZodString;
+    prNumber: z.ZodNumber;
+}, z.core.$strip>;
+export type DepsPatchOutput = z.infer<typeof DepsPatchOutputSchema>;
+/**
+ * `deps.patch` — "Le correctif est une PR, jamais une modification
+ * directe." `execute` never touches the branch it targets; it computes the
+ * new file content and hands it to `PrClient.open`, which is the only
+ * thing that can actually reach GitHub (or whichever forge). `reversible:
+ * true` — `revert` closes the PR without merging it, the only safe
+ * "undo" of having proposed a change. Autonomy default for this tool is
+ * `propose` (set on the agent declaration, not here) — a patch always
+ * waits for a human, `deps.scan` is the only autonomous step.
+ */
+export declare function createDepsPatchTool(options: DepsPatchToolOptions): ToolDefinition<DepsPatchInput, DepsPatchOutput>;
+export {};
+//# sourceMappingURL=deps-patch-tool.d.ts.map

package/dist/security/deps-patch-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps-patch-tool.d.ts","sourceRoot":"","sources":["../../src/security/deps-patch-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,QAAA,MAAM,oBAAoB;;;;;;;iBAOxB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEjE,QAAA,MAAM,qBAAqB;;;iBAAwD,CAAA;AACnF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAcnE;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,GAC5B,cAAc,CAAC,cAAc,EAAE,eAAe,CAAC,CA+BjD"}

package/dist/security/deps-patch-tool.js

@@ -0,0 +1,61 @@
+import { defineTool } from '@cogenta/agents';
+import { z } from 'zod';
+import { bumpDependencyVersion } from './bump-version.js';
+const DepsPatchInputSchema = z.object({
+    package: z.string(),
+    currentVersion: z.string(),
+    fixedVersion: z.string(),
+    dependencyFilePath: z.string(),
+    dependencyFileContent: z.string(),
+    findingSummary: z.string(),
+});
+const DepsPatchOutputSchema = z.object({ prUrl: z.string(), prNumber: z.number() });
+function buildPrBody(input) {
+    return [
+        `Bumps \`${input.package}\` from \`${input.currentVersion}\` to \`${input.fixedVersion}\`.`,
+        '',
+        '## Pourquoi',
+        input.findingSummary,
+        '',
+        '## Vérification',
+        'Les tests existants sont joués par la CI sur cette PR — aucune modification directe n’a été faite.',
+    ].join('\n');
+}
+/**
+ * `deps.patch` — "Le correctif est une PR, jamais une modification
+ * directe." `execute` never touches the branch it targets; it computes the
+ * new file content and hands it to `PrClient.open`, which is the only
+ * thing that can actually reach GitHub (or whichever forge). `reversible:
+ * true` — `revert` closes the PR without merging it, the only safe
+ * "undo" of having proposed a change. Autonomy default for this tool is
+ * `propose` (set on the agent declaration, not here) — a patch always
+ * waits for a human, `deps.scan` is the only autonomous step.
+ */
+export function createDepsPatchTool(options) {
+    return defineTool({
+        name: 'deps.patch',
+        version: '1.0.0',
+        description: 'Opens a pull request bumping one dependency to a fixed version — never modifies anything directly.',
+        input: DepsPatchInputSchema,
+        output: DepsPatchOutputSchema,
+        permissions: ['deps.patch'],
+        sideEffects: true,
+        reversible: true,
+        cost: 'medium',
+        async execute(input) {
+            const updatedContent = bumpDependencyVersion(input.dependencyFileContent, input.package, input.fixedVersion);
+            const result = await options.prClient.open({
+                baseBranch: options.baseBranch ?? 'main',
+                branchName: `security/${input.package}-${input.fixedVersion}`,
+                title: `security: bump ${input.package} to ${input.fixedVersion}`,
+                body: buildPrBody(input),
+                files: [{ path: input.dependencyFilePath, content: updatedContent }],
+            });
+            return { prUrl: result.url, prNumber: result.number };
+        },
+        async revert(receipt) {
+            await options.prClient.close(receipt.prNumber);
+        },
+    });
+}
+//# sourceMappingURL=deps-patch-tool.js.map

package/dist/security/deps-patch-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps-patch-tool.js","sourceRoot":"","sources":["../../src/security/deps-patch-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAuB,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAQzD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC,CAAA;AAGF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAGnF,SAAS,WAAW,CAAC,KAAqB;IACxC,OAAO;QACL,WAAW,KAAK,CAAC,OAAO,aAAa,KAAK,CAAC,cAAc,WAAW,KAAK,CAAC,YAAY,KAAK;QAC3F,EAAE;QACF,aAAa;QACb,KAAK,CAAC,cAAc;QACpB,EAAE;QACF,iBAAiB;QACjB,oGAAoG;KACrG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,OAAO;QAChB,WAAW,EACT,oGAAoG;QACtG,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,qBAAqB;QAC7B,WAAW,EAAE,CAAC,YAAY,CAAC;QAC3B,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,cAAc,GAAG,qBAAqB,CAC1C,KAAK,CAAC,qBAAqB,EAC3B,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,YAAY,CACnB,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACzC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,MAAM;gBACxC,UAAU,EAAE,YAAY,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,YAAY,EAAE;gBAC7D,KAAK,EAAE,kBAAkB,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,YAAY,EAAE;gBACjE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC;gBACxB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;aACrE,CAAC,CAAA;YACF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;QACvD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAChD,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/security/deps-scan-tool.d.ts

@@ -0,0 +1,56 @@
+import { type ToolDefinition } from '@cogenta/agents';
+import { z } from 'zod';
+export interface DepsScanToolOptions {
+    readonly fetchImpl?: typeof fetch;
+    readonly osvBaseUrl?: string;
+    readonly epssBaseUrl?: string;
+    readonly now?: () => number;
+}
+declare const DepsScanInputSchema: z.ZodObject<{
+    dependencies: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>;
+export type DepsScanInput = z.infer<typeof DepsScanInputSchema>;
+declare const DepsScanOutputSchema: z.ZodObject<{
+    entries: z.ZodArray<z.ZodObject<{
+        finding: z.ZodObject<{
+            package: z.ZodString;
+            version: z.ZodString;
+            vulnerability: z.ZodObject<{
+                id: z.ZodString;
+                summary: z.ZodOptional<z.ZodString>;
+                details: z.ZodOptional<z.ZodString>;
+                aliases: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                cvssScore: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>;
+            assessment: z.ZodObject<{
+                cvss: z.ZodOptional<z.ZodNumber>;
+                epss: z.ZodOptional<z.ZodNumber>;
+                urgency: z.ZodEnum<{
+                    critical: "critical";
+                    high: "high";
+                    low: "low";
+                    medium: "medium";
+                }>;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        whatIsAffected: z.ZodString;
+        whatAnAttackerCouldDo: z.ZodString;
+        isTheSiteExposed: z.ZodString;
+        whatIsProposed: z.ZodString;
+        whatHappensIfNothingIsDone: z.ZodString;
+    }, z.core.$strip>>;
+    generatedAt: z.ZodString;
+}, z.core.$strip>;
+export type DepsScanOutput = z.infer<typeof DepsScanOutputSchema>;
+/**
+ * `deps.scan` — SBOM → OSV correlation (only versions genuinely installed
+ * and affected) → EPSS → exploitability → imposed-format report, in one
+ * call. Read-only (`sideEffects: false`): it never patches anything, that
+ * is `deps.patch`'s job (a later task). No side-effecting HTTP call goes
+ * unrestricted through the generic `http.fetch` tool here — OSV/EPSS access
+ * is baked into this tool's own implementation, testable with an injected
+ * `fetchImpl` exactly like `http.fetch` itself.
+ */
+export declare function createDepsScanTool(options?: DepsScanToolOptions): ToolDefinition<DepsScanInput, DepsScanOutput>;
+export {};
+//# sourceMappingURL=deps-scan-tool.d.ts.map

package/dist/security/deps-scan-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps-scan-tool.d.ts","sourceRoot":"","sources":["../../src/security/deps-scan-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAOvB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,QAAA,MAAM,mBAAmB;;iBAGvB,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AA0B/D,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGxB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEjE;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,mBAAwB,GAChC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CA8C/C"}

package/dist/security/deps-scan-tool.js

@@ -0,0 +1,89 @@
+import { defineTool } from '@cogenta/agents';
+import { z } from 'zod';
+import { queryEpss } from './epss-client.js';
+import { assessExploitability } from './exploitability.js';
+import { queryOsv } from './osv-client.js';
+import { buildSecurityReport } from './report.js';
+import { buildSbom } from './sbom.js';
+const DepsScanInputSchema = z.object({
+    /** Exact, resolved versions — from a lockfile, not `package.json` ranges. */
+    dependencies: z.record(z.string(), z.string()),
+});
+const SecurityReportEntrySchema = z.object({
+    finding: z.object({
+        package: z.string(),
+        version: z.string(),
+        vulnerability: z.object({
+            id: z.string(),
+            summary: z.string().optional(),
+            details: z.string().optional(),
+            aliases: z.array(z.string()).optional(),
+            cvssScore: z.number().optional(),
+        }),
+        assessment: z.object({
+            cvss: z.number().optional(),
+            epss: z.number().optional(),
+            urgency: z.enum(['low', 'medium', 'high', 'critical']),
+        }),
+    }),
+    whatIsAffected: z.string(),
+    whatAnAttackerCouldDo: z.string(),
+    isTheSiteExposed: z.string(),
+    whatIsProposed: z.string(),
+    whatHappensIfNothingIsDone: z.string(),
+});
+const DepsScanOutputSchema = z.object({
+    entries: z.array(SecurityReportEntrySchema),
+    generatedAt: z.string(),
+});
+/**
+ * `deps.scan` — SBOM → OSV correlation (only versions genuinely installed
+ * and affected) → EPSS → exploitability → imposed-format report, in one
+ * call. Read-only (`sideEffects: false`): it never patches anything, that
+ * is `deps.patch`'s job (a later task). No side-effecting HTTP call goes
+ * unrestricted through the generic `http.fetch` tool here — OSV/EPSS access
+ * is baked into this tool's own implementation, testable with an injected
+ * `fetchImpl` exactly like `http.fetch` itself.
+ */
+export function createDepsScanTool(options = {}) {
+    return defineTool({
+        name: 'deps.scan',
+        version: '1.0.0',
+        description: 'Scans the resolved dependency set for vulnerabilities genuinely affecting the installed versions, cross-referenced with real-world exploitation likelihood.',
+        input: DepsScanInputSchema,
+        output: DepsScanOutputSchema,
+        permissions: ['deps.scan'],
+        sideEffects: false,
+        reversible: false,
+        cost: 'medium',
+        async execute(input) {
+            const sbom = buildSbom(input.dependencies);
+            const matches = await queryOsv(sbom, {
+                ...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),
+                ...(options.osvBaseUrl === undefined ? {} : { baseUrl: options.osvBaseUrl }),
+            });
+            const allCveIds = matches
+                .flatMap((match) => match.vulnerabilities)
+                .flatMap((vuln) => vuln.aliases ?? [])
+                .filter((alias) => alias.startsWith('CVE-'));
+            const epssScores = await queryEpss(allCveIds, {
+                ...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),
+                ...(options.epssBaseUrl === undefined ? {} : { baseUrl: options.epssBaseUrl }),
+            });
+            const findings = matches.flatMap((match) => match.vulnerabilities.map((vulnerability) => {
+                const cveAlias = vulnerability.aliases?.find((alias) => alias.startsWith('CVE-'));
+                const epss = cveAlias === undefined ? undefined : epssScores.get(cveAlias);
+                return {
+                    package: match.entry.name,
+                    version: match.entry.version,
+                    vulnerability,
+                    assessment: assessExploitability(vulnerability, epss),
+                };
+            }));
+            return buildSecurityReport(findings, {
+                ...(options.now === undefined ? {} : { now: options.now }),
+            });
+        },
+    });
+}
+//# sourceMappingURL=deps-scan-tool.js.map

package/dist/security/deps-scan-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps-scan-tool.js","sourceRoot":"","sources":["../../src/security/deps-scan-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAuB,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AASrC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,6EAA6E;IAC7E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;CAC/C,CAAC,CAAA;AAGF,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC9B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACjC,CAAC;QACF,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;SACvD,CAAC;KACH,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;CACvC,CAAC,CAAA;AAEF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAA;AAGF;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAO,GAAwB,EAAE;IAEjC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,OAAO;QAChB,WAAW,EACT,6JAA6J;QAC/J,KAAK,EAAE,mBAAmB;QAC1B,MAAM,EAAE,oBAAoB;QAC5B,WAAW,EAAE,CAAC,WAAW,CAAC;QAC1B,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;YAC1C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE;gBACnC,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC5E,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;aAC7E,CAAC,CAAA;YAEF,MAAM,SAAS,GAAG,OAAO;iBACtB,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC;iBACzC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;iBACrC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;YAC9C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE;gBAC5C,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC5E,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;aAC/E,CAAC,CAAA;YAEF,MAAM,QAAQ,GAAsB,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5D,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE;gBAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;gBACjF,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAC1E,OAAO;oBACL,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;oBACzB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;oBAC5B,aAAa;oBACb,UAAU,EAAE,oBAAoB,CAAC,aAAa,EAAE,IAAI,CAAC;iBACtD,CAAA;YACH,CAAC,CAAC,CACH,CAAA;YAED,OAAO,mBAAmB,CAAC,QAAQ,EAAE;gBACnC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;aAC3D,CAAmB,CAAA;QACtB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/security/epss-client.d.ts

@@ -0,0 +1,18 @@
+export interface EpssScore {
+    readonly cve: string;
+    /** Probability of exploitation in the next 30 days, 0–1. */
+    readonly epss: number;
+    readonly percentile: number;
+}
+export interface QueryEpssOptions {
+    readonly fetchImpl?: typeof fetch;
+    readonly baseUrl?: string;
+}
+/**
+ * "Croiser CVSS et EPSS (probabilité d'exploitation réelle)." FIRST.org's
+ * EPSS API takes a comma-separated CVE list and returns a score per CVE it
+ * recognises — a CVE it has no data for is simply absent from the result,
+ * not an error.
+ */
+export declare function queryEpss(cveIds: readonly string[], options?: QueryEpssOptions): Promise<ReadonlyMap<string, EpssScore>>;
+//# sourceMappingURL=epss-client.d.ts.map

package/dist/security/epss-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"epss-client.d.ts","sourceRoot":"","sources":["../../src/security/epss-client.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CA6BzC"}