@cyanheads/nist-nvd-mcp-server 0.1.3

package/dist/services/nvd-cve/nvd-cve-service.js

@@ -0,0 +1,345 @@
+/**
+ * @fileoverview Service for the NIST NVD CVE API 2.0 and CVE History API.
+ * Provides normalized CVE records, search, audit-by-CPE, and change history.
+ * @module services/nvd-cve/nvd-cve-service
+ */
+import { JsonRpcErrorCode, McpError, validationError } from '@cyanheads/mcp-ts-core/errors';
+import { getNvdHttpClient } from '../nvd-http/nvd-http-client.js';
+const CVE_ID_REGEX = /^CVE-\d{4}-\d{4,}$/i;
+/**
+ * Derive a CVSS v2.0 severity label from the numeric base score.
+ * NVD omits `baseSeverity` from v2.0 responses; v3.x and v4.0 always include it.
+ * CVSS v2 ranges: 0.0 → NONE, 0.1–3.9 → LOW, 4.0–6.9 → MEDIUM, 7.0–10.0 → HIGH.
+ * CVSS v2 has no CRITICAL tier.
+ */
+function deriveV2Severity(score) {
+    if (score === undefined || score === null)
+        return 'UNKNOWN';
+    if (score === 0)
+        return 'NONE';
+    if (score < 4.0)
+        return 'LOW';
+    if (score < 7.0)
+        return 'MEDIUM';
+    return 'HIGH';
+}
+/** Validate CVE ID format. Returns the uppercase form or throws. */
+function validateCveId(id) {
+    const trimmed = id.trim();
+    if (!CVE_ID_REGEX.test(trimmed)) {
+        throw validationError(`Invalid CVE ID format: "${trimmed}". Expected format: CVE-YYYY-NNNNN.`, {
+            reason: 'invalid_cve_id_format',
+            cveId: trimmed,
+        });
+    }
+    return trimmed.toUpperCase();
+}
+/** Extract and normalize all CVSS scores from a raw CVE item. */
+function extractCvssScores(metrics) {
+    if (!metrics)
+        return [];
+    const scores = [];
+    const addMetrics = (list, version, isV2) => {
+        for (const m of list ?? []) {
+            if (!m.cvssData?.baseScore)
+                continue;
+            // NVD omits baseSeverity for CVSS v2.0 — derive it from the numeric score range.
+            const severity = m.cvssData.baseSeverity ?? (isV2 ? deriveV2Severity(m.cvssData.baseScore) : 'UNKNOWN');
+            const entry = {
+                version,
+                sourceType: m.type ?? 'Primary',
+                baseScore: m.cvssData.baseScore,
+                severity,
+            };
+            if (m.cvssData.vectorString)
+                entry.vectorString = m.cvssData.vectorString;
+            scores.push(entry);
+        }
+    };
+    addMetrics(metrics.cvssMetricV2, '2.0', true);
+    addMetrics(metrics.cvssMetricV30, '3.0', false);
+    addMetrics(metrics.cvssMetricV31, '3.1', false);
+    addMetrics(metrics.cvssMetricV40, '4.0', false);
+    return scores;
+}
+/** Derive top severity from all available CVSS scores. */
+function deriveTopSeverity(scores) {
+    if (scores.length === 0)
+        return;
+    const sorted = [...scores].sort((a, b) => b.baseScore - a.baseScore);
+    const top = sorted[0];
+    if (!top)
+        return;
+    return {
+        label: top.severity,
+        score: top.baseScore,
+        fromVersion: top.version,
+    };
+}
+/** Normalize a raw CVE item to a full CveRecord. */
+function normalizeCve(raw, includeReferences) {
+    const cvssScores = extractCvssScores(raw.metrics);
+    const severity = deriveTopSeverity(cvssScores);
+    const weaknesses = (raw.weaknesses ?? []).map((w) => ({
+        source: w.source ?? '',
+        cweIds: (w.description ?? [])
+            .filter((d) => d.lang === 'en' && d.value)
+            .map((d) => d.value),
+    }));
+    const configurations = (raw.configurations ?? []).map((cfg) => ({
+        nodes: (cfg.nodes ?? []).map((node) => ({
+            ...(node.operator && { operator: node.operator }),
+            cpeMatch: (node.cpeMatch ?? []).map((m) => ({
+                vulnerable: m.vulnerable ?? false,
+                criteria: m.criteria ?? '',
+                ...(m.versionStartIncluding && { versionStartIncluding: m.versionStartIncluding }),
+                ...(m.versionStartExcluding && { versionStartExcluding: m.versionStartExcluding }),
+                ...(m.versionEndIncluding && { versionEndIncluding: m.versionEndIncluding }),
+                ...(m.versionEndExcluding && { versionEndExcluding: m.versionEndExcluding }),
+            })),
+        })),
+    }));
+    let cisaKev;
+    if (raw.cisaExploitAdd &&
+        raw.cisaActionDue &&
+        raw.cisaRequiredAction &&
+        raw.cisaVulnerabilityName) {
+        cisaKev = {
+            exploitAddDate: raw.cisaExploitAdd,
+            actionDueDate: raw.cisaActionDue,
+            requiredAction: raw.cisaRequiredAction,
+            vulnerabilityName: raw.cisaVulnerabilityName,
+        };
+    }
+    return {
+        cveId: raw.id ?? '',
+        vulnStatus: raw.vulnStatus ?? '',
+        published: raw.published ?? '',
+        lastModified: raw.lastModified ?? '',
+        descriptions: (raw.descriptions ?? [])
+            .filter((d) => d.lang && d.value)
+            .map((d) => ({ lang: d.lang, value: d.value })),
+        cvssScores,
+        ...(severity && { severity }),
+        weaknesses,
+        configurations,
+        ...(includeReferences && {
+            references: (raw.references ?? []).map((r) => ({
+                url: r.url ?? '',
+                ...(r.source && { source: r.source }),
+                ...(r.tags?.length && { tags: r.tags }),
+            })),
+        }),
+        ...(cisaKev && { cisaKev }),
+    };
+}
+/** Trim a full CVE to a BriefCveRecord. */
+function toBriefCve(record) {
+    return {
+        cveId: record.cveId,
+        vulnStatus: record.vulnStatus,
+        published: record.published,
+        ...(record.severity && { severity: record.severity }),
+        ...(record.cisaKev && { cisaVulnerabilityName: record.cisaKev.vulnerabilityName }),
+    };
+}
+/** Severity order for filtering. */
+const SEVERITY_ORDER = {
+    LOW: 0,
+    MEDIUM: 1,
+    HIGH: 2,
+    CRITICAL: 3,
+};
+export class NvdCveService {
+    // biome-ignore lint/complexity/noUselessConstructor: preserves framework init-pattern signature
+    constructor(_config, _storage) { }
+    /**
+     * Fetch one or more CVEs by ID (up to 100).
+     * Returns full records. Throws `invalid_cve_id_format` for malformed IDs (HTTP 404 from NVD)
+     * and `cve_not_found` when NVD returns empty results for a valid-format ID.
+     */
+    async fetchById(rawIds, includeReferences, ctx) {
+        // Validate all IDs before making the request
+        const cveIds = rawIds.map(validateCveId);
+        const client = getNvdHttpClient();
+        let response;
+        try {
+            response = await client.get('cves/2.0', { cveIds: cveIds.join(',') }, ctx);
+        }
+        catch (err) {
+            // NVD 404 for malformed IDs: re-throw as invalid_cve_id_format
+            if (err.message?.includes('HTTP 404')) {
+                throw validationError(`One or more CVE IDs may be malformed (NVD returned HTTP 404). Verify the IDs: ${cveIds.join(', ')}.`, { reason: 'invalid_cve_id_format', cveIds });
+            }
+            throw err;
+        }
+        const items = (response.vulnerabilities ?? [])
+            .map((v) => v.cve)
+            .filter((c) => !!c);
+        if (items.length === 0 && cveIds.length === 1) {
+            throw new McpError(JsonRpcErrorCode.NotFound, `CVE ${cveIds[0]} not found in NVD.`, {
+                reason: 'cve_not_found',
+                cveId: cveIds[0],
+            });
+        }
+        const cves = items.map((item) => normalizeCve(item, includeReferences));
+        // Identify any requested IDs not returned by NVD.
+        const returnedIds = new Set(cves.map((c) => c.cveId.toUpperCase()));
+        const missingIds = cveIds.filter((id) => !returnedIds.has(id.toUpperCase()));
+        ctx.log.info('Fetched CVEs by ID', {
+            requested: cveIds.length,
+            returned: cves.length,
+            ...(missingIds.length > 0 ? { missingIds } : {}),
+        });
+        return { cves, returned: cves.length, requested: cveIds.length, missingIds };
+    }
+    /**
+     * Search CVEs using various filters. Always returns brief records.
+     */
+    async searchCves(params, ctx) {
+        const client = getNvdHttpClient();
+        const apiParams = {
+            resultsPerPage: Math.min(params.limit ?? 20, 2000),
+            startIndex: params.offset ?? 0,
+        };
+        if (params.keyword)
+            apiParams.keywordSearch = params.keyword;
+        if (params.cweId)
+            apiParams.cweId = params.cweId;
+        if (params.pubStartDate)
+            apiParams.pubStartDate = params.pubStartDate;
+        if (params.pubEndDate)
+            apiParams.pubEndDate = params.pubEndDate;
+        if (params.lastModStartDate)
+            apiParams.lastModStartDate = params.lastModStartDate;
+        if (params.lastModEndDate)
+            apiParams.lastModEndDate = params.lastModEndDate;
+        if (params.kevOnly)
+            apiParams.hasKev = true;
+        if (params.noRejected)
+            apiParams.noRejected = true;
+        if (params.severityParam) {
+            const ver = params.severityVersion ?? 'v3';
+            if (ver === 'v2') {
+                apiParams.cvssV2Severity = params.severityParam;
+            }
+            else if (ver === 'v4') {
+                apiParams.cvssV4Severity = params.severityParam;
+            }
+            else {
+                apiParams.cvssV3Severity = params.severityParam;
+            }
+        }
+        const response = await client.get('cves/2.0', apiParams, ctx);
+        const items = (response.vulnerabilities ?? [])
+            .map((v) => v.cve)
+            .filter((c) => !!c);
+        const cves = items.map((item) => normalizeCve(item, false)).map(toBriefCve);
+        const totalResults = response.totalResults ?? 0;
+        ctx.log.info('CVE search completed', { totalResults, returned: cves.length });
+        return {
+            cves,
+            totalResults,
+            returned: cves.length,
+            offset: params.offset ?? 0,
+        };
+    }
+    /**
+     * Find CVEs affecting a specific CPE (by name or virtual match string with version range).
+     */
+    async auditCpe(params, ctx) {
+        const client = getNvdHttpClient();
+        const apiParams = {
+            resultsPerPage: Math.min(params.limit ?? 20, 2000),
+            startIndex: 0,
+        };
+        if (params.cpeName) {
+            apiParams.cpeName = params.cpeName;
+            apiParams.isVulnerable = true;
+        }
+        else if (params.virtualMatchString) {
+            apiParams.virtualMatchString = params.virtualMatchString;
+            if (params.versionStart) {
+                apiParams.versionStart = params.versionStart;
+                apiParams.versionStartType = params.versionStartType ?? 'including';
+            }
+            if (params.versionEnd) {
+                apiParams.versionEnd = params.versionEnd;
+                apiParams.versionEndType = params.versionEndType ?? 'including';
+            }
+        }
+        const response = await client.get('cves/2.0', apiParams, ctx);
+        let items = (response.vulnerabilities ?? [])
+            .map((v) => v.cve)
+            .filter((c) => !!c);
+        // Client-side severity filter
+        if (params.severityMin) {
+            const minLevel = SEVERITY_ORDER[params.severityMin.toUpperCase()] ?? 0;
+            items = items.filter((item) => {
+                const scores = extractCvssScores(item.metrics);
+                const top = deriveTopSeverity(scores);
+                if (!top)
+                    return false;
+                return (SEVERITY_ORDER[top.label.toUpperCase()] ?? -1) >= minLevel;
+            });
+        }
+        const cves = items.map((item) => normalizeCve(item, true));
+        const totalResults = response.totalResults ?? 0;
+        if (cves.length === 0 && params.cpeName) {
+            throw new McpError(JsonRpcErrorCode.NotFound, `No CVEs found for CPE "${params.cpeName}". The CPE may be misspelled or not in NVD.`, { reason: 'cpe_not_found', cpeName: params.cpeName });
+        }
+        ctx.log.info('CPE audit completed', { totalResults, returned: cves.length });
+        return {
+            cves,
+            totalResults,
+            returned: cves.length,
+            ...(params.cpeName && { cpeName: params.cpeName }),
+            ...(params.virtualMatchString && { virtualMatchString: params.virtualMatchString }),
+        };
+    }
+    /**
+     * Retrieve the change history for a CVE.
+     */
+    async getCveHistory(rawId, limit, offset, ctx) {
+        const cveId = validateCveId(rawId);
+        const client = getNvdHttpClient();
+        let response;
+        try {
+            response = await client.get('cvehistory/2.0', { cveId, resultsPerPage: Math.min(limit, 2000), startIndex: offset }, ctx);
+        }
+        catch (err) {
+            if (err.message?.includes('HTTP 404')) {
+                throw validationError(`CVE ID "${cveId}" appears to be malformed (NVD returned HTTP 404).`, { reason: 'invalid_cve_id_format', cveId });
+            }
+            throw err;
+        }
+        const changes = (response.cveChanges ?? [])
+            .map((c) => c.change)
+            .filter((c) => !!c)
+            .map((c) => ({
+            changeDate: c.created ?? '',
+            ...(c.eventName ? { eventName: c.eventName } : {}),
+            details: (c.details ?? []).map((d) => ({
+                ...(d.action ? { action: d.action } : {}),
+                ...(d.type ? { type: d.type } : {}),
+                ...(d.oldValue ? { oldValue: d.oldValue } : {}),
+                ...(d.newValue ? { newValue: d.newValue } : {}),
+            })),
+        }));
+        const totalResults = response.totalResults ?? 0;
+        ctx.log.info('CVE history fetched', { cveId, totalResults, returned: changes.length });
+        return { cveId, changes, totalResults, returned: changes.length, offset };
+    }
+}
+// --- Init/accessor pattern ---
+let _service;
+export function initNvdCveService(config, storage) {
+    _service = new NvdCveService(config, storage);
+}
+export function getNvdCveService() {
+    if (!_service) {
+        throw new Error('NvdCveService not initialized — call initNvdCveService() in setup()');
+    }
+    return _service;
+}
+//# sourceMappingURL=nvd-cve-service.js.map

package/dist/services/nvd-cve/nvd-cve-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-cve-service.js","sourceRoot":"","sources":["../../../src/services/nvd-cve/nvd-cve-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAE5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAclE,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAE3C;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,QAAQ,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oEAAoE;AACpE,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,eAAe,CAAC,2BAA2B,OAAO,qCAAqC,EAAE;YAC7F,MAAM,EAAE,uBAAuB;YAC/B,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;AAC/B,CAAC;AAED,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,OAA8B;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,MAAM,UAAU,GAAG,CAAC,IAAiC,EAAE,OAAe,EAAE,IAAa,EAAE,EAAE;QACvF,KAAK,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS;gBAAE,SAAS;YACrC,iFAAiF;YACjF,MAAM,QAAQ,GACZ,CAAC,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACzF,MAAM,KAAK,GAAc;gBACvB,OAAO;gBACP,UAAU,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;gBAC/B,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS;gBAC/B,QAAQ;aACT,CAAC;YACF,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY;gBAAE,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAEF,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAChD,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAChD,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAEhD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0DAA0D;AAC1D,SAAS,iBAAiB,CAAC,MAAmB;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,QAAQ;QACnB,KAAK,EAAE,GAAG,CAAC,SAAS;QACpB,WAAW,EAAE,GAAG,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,SAAS,YAAY,CAAC,GAAe,EAAE,iBAA0B;IAC/D,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE/C,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;QACtB,MAAM,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC;aACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAe,CAAC;KACjC,CAAC,CAAC,CAAC;IAEJ,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9D,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjD,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1C,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,KAAK;gBACjC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;gBAC1B,GAAG,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC,qBAAqB,EAAE,CAAC;gBAClF,GAAG,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC,qBAAqB,EAAE,CAAC;gBAClF,GAAG,CAAC,CAAC,CAAC,mBAAmB,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC;gBAC5E,GAAG,CAAC,CAAC,CAAC,mBAAmB,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC;aAC7E,CAAC,CAAC;SACJ,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,IAAI,OAA4B,CAAC;IACjC,IACE,GAAG,CAAC,cAAc;QAClB,GAAG,CAAC,aAAa;QACjB,GAAG,CAAC,kBAAkB;QACtB,GAAG,CAAC,qBAAqB,EACzB,CAAC;QACD,OAAO,GAAG;YACR,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,cAAc,EAAE,GAAG,CAAC,kBAAkB;YACtC,iBAAiB,EAAE,GAAG,CAAC,qBAAqB;SAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE;QACnB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;QAChC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;QAC9B,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE;QACpC,YAAY,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;aACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,EAAE,KAAK,EAAE,CAAC,CAAC,KAAe,EAAE,CAAC,CAAC;QACrE,UAAU;QACV,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7B,UAAU;QACV,cAAc;QACd,GAAG,CAAC,iBAAiB,IAAI;YACvB,UAAU,EAAE,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7C,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;gBAChB,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;gBACrC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aACxC,CAAC,CAAC;SACJ,CAAC;QACF,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,SAAS,UAAU,CAAC,MAAiB;IACnC,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrD,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;KACnF,CAAC;AACJ,CAAC;AA4BD,oCAAoC;AACpC,MAAM,cAAc,GAA2B;IAC7C,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,OAAO,aAAa;IACxB,gGAAgG;IAChG,YAAY,OAAkB,EAAE,QAAwB,IAAG,CAAC;IAE5D;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACb,MAAgB,EAChB,iBAA0B,EAC1B,GAAY;QAEZ,6CAA6C;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAiB,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,IAAK,GAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjD,MAAM,eAAe,CACnB,iFAAiF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACrG,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAC5C,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;aACjB,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,MAAM,CAAC,CAAC,CAAC,oBAAoB,EAAE;gBAClF,MAAM,EAAE,eAAe;gBACvB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAExE,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAE7E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACjC,SAAS,EAAE,MAAM,CAAC,MAAM;YACxB,QAAQ,EAAE,IAAI,CAAC,MAAM;YACrB,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;IAC/E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,MAAwB,EACxB,GAAY;QAOZ,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,MAAM,SAAS,GAA0D;YACvE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC;YAClD,UAAU,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;SAC/B,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO;YAAE,SAAS,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7D,IAAI,MAAM,CAAC,KAAK;YAAE,SAAS,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACjD,IAAI,MAAM,CAAC,YAAY;YAAE,SAAS,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACtE,IAAI,MAAM,CAAC,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QAChE,IAAI,MAAM,CAAC,gBAAgB;YAAE,SAAS,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAClF,IAAI,MAAM,CAAC,cAAc;YAAE,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5E,IAAI,MAAM,CAAC,OAAO;YAAE,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;QAC5C,IAAI,MAAM,CAAC,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;QAEnD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC;YAC3C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;YAClD,CAAC;iBAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACxB,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;YAClD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAiB,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAE9E,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;aAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;aACjB,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE5E,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9E,OAAO;YACL,IAAI;YACJ,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;SAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CACZ,MAAsB,EACtB,GAAY;QAQZ,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,MAAM,SAAS,GAA0D;YACvE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC;YAClD,UAAU,EAAE,CAAC;SACd,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACnC,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC;QAChC,CAAC;aAAM,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACrC,SAAS,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACzD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxB,SAAS,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;gBAC7C,SAAS,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,WAAW,CAAC;YACtE,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,SAAS,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBACzC,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,WAAW,CAAC;YAClE,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAiB,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAE9E,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;aACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;aACjB,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvC,8BAA8B;QAC9B,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YACvE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,GAAG;oBAAE,OAAO,KAAK,CAAC;gBACvB,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;YACrE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC;QAEhD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,QAAQ,CAChB,gBAAgB,CAAC,QAAQ,EACzB,0BAA0B,MAAM,CAAC,OAAO,6CAA6C,EACrF,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CACrD,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAE7E,OAAO;YACL,IAAI;YACJ,YAAY;YACZ,QAAQ,EAAE,IAAI,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAClD,GAAG,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC;SACpF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,KAAa,EACb,MAAc,EACd,GAAY;QAQZ,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAElC,IAAI,QAA+B,CAAC;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CACzB,gBAAgB,EAChB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EACpE,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjD,MAAM,eAAe,CACnB,WAAW,KAAK,oDAAoD,EACpE,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAC3C,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAqB,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;aAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,UAAU,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;YAC3B,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAC;SACJ,CAAC,CAAC,CAAC;QAEN,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5E,CAAC;CACF;AAED,gCAAgC;AAEhC,IAAI,QAAmC,CAAC;AAExC,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,OAAuB;IAC1E,QAAQ,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/services/nvd-cve/types.d.ts

@@ -0,0 +1,185 @@
+/**
+ * @fileoverview Domain types for the NVD CVE API 2.0 response shapes and normalized domain objects.
+ * @module services/nvd-cve/types
+ */
+/** Raw CVSS metric from the NVD API response. */
+export interface RawCvssMetric {
+    cvssData?: {
+        version?: string;
+        vectorString?: string;
+        baseScore?: number;
+        baseSeverity?: string;
+    };
+    exploitabilityScore?: number;
+    impactScore?: number;
+    source?: string;
+    type?: string;
+}
+/** Raw CVE item from the NVD API response. */
+export interface RawCveItem {
+    cisaActionDue?: string;
+    cisaExploitAdd?: string;
+    cisaRequiredAction?: string;
+    cisaVulnerabilityName?: string;
+    configurations?: Array<{
+        nodes?: Array<{
+            operator?: string;
+            negate?: boolean;
+            cpeMatch?: Array<{
+                vulnerable?: boolean;
+                criteria?: string;
+                versionStartIncluding?: string;
+                versionStartExcluding?: string;
+                versionEndIncluding?: string;
+                versionEndExcluding?: string;
+                matchCriteriaId?: string;
+            }>;
+        }>;
+    }>;
+    descriptions?: Array<{
+        lang?: string;
+        value?: string;
+    }>;
+    id?: string;
+    lastModified?: string;
+    metrics?: {
+        cvssMetricV2?: RawCvssMetric[];
+        cvssMetricV30?: RawCvssMetric[];
+        cvssMetricV31?: RawCvssMetric[];
+        cvssMetricV40?: RawCvssMetric[];
+    };
+    published?: string;
+    references?: Array<{
+        url?: string;
+        source?: string;
+        tags?: string[];
+    }>;
+    sourceIdentifier?: string;
+    vulnStatus?: string;
+    weaknesses?: Array<{
+        source?: string;
+        type?: string;
+        description?: Array<{
+            lang?: string;
+            value?: string;
+        }>;
+    }>;
+}
+/** Raw NVD CVE search response. */
+export interface RawCveResponse {
+    format?: string;
+    resultsPerPage?: number;
+    startIndex?: number;
+    timestamp?: string;
+    totalResults?: number;
+    version?: string;
+    vulnerabilities?: Array<{
+        cve?: RawCveItem;
+    }>;
+}
+/** Raw NVD CVE History response. */
+export interface RawCveHistoryResponse {
+    cveChanges?: Array<{
+        change?: {
+            cveId?: string;
+            eventName?: string;
+            cveChangeId?: string;
+            sourceIdentifier?: string;
+            created?: string;
+            details?: Array<{
+                action?: string;
+                type?: string;
+                oldValue?: string;
+                newValue?: string;
+            }>;
+        };
+    }>;
+    resultsPerPage?: number;
+    startIndex?: number;
+    totalResults?: number;
+}
+/** Normalized CVSS score entry. */
+export interface CvssScore {
+    /** Base score (0.0–10.0). */
+    baseScore: number;
+    /** Severity label (e.g., "CRITICAL", "HIGH", "MEDIUM", "LOW"). */
+    severity: string;
+    /** Score source type ("Primary" = NVD, "Secondary" = CNA). */
+    sourceType: string;
+    /** CVSS vector string. */
+    vectorString?: string;
+    /** CVSS version (e.g., "2.0", "3.1", "4.0"). */
+    version: string;
+}
+/** Normalized top severity derived from all available CVSS scores. */
+export interface TopSeverity {
+    /** Which CVSS version this came from. */
+    fromVersion: string;
+    /** Severity label. */
+    label: string;
+    /** Base score. */
+    score: number;
+}
+/** Normalized CISA KEV fields — only present when CVE is in the KEV catalog. */
+export interface CisaKev {
+    actionDueDate: string;
+    exploitAddDate: string;
+    requiredAction: string;
+    vulnerabilityName: string;
+}
+/** Full CVE record (normalized from raw API response). */
+export interface CveRecord {
+    cisaKev?: CisaKev;
+    configurations: Array<{
+        nodes: Array<{
+            operator?: string;
+            cpeMatch: Array<{
+                vulnerable: boolean;
+                criteria: string;
+                versionStartIncluding?: string;
+                versionStartExcluding?: string;
+                versionEndIncluding?: string;
+                versionEndExcluding?: string;
+            }>;
+        }>;
+    }>;
+    cveId: string;
+    cvssScores: CvssScore[];
+    descriptions: Array<{
+        lang: string;
+        value: string;
+    }>;
+    lastModified: string;
+    published: string;
+    references?: Array<{
+        url: string;
+        source?: string;
+        tags?: string[];
+    }>;
+    severity?: TopSeverity;
+    vulnStatus: string;
+    weaknesses: Array<{
+        source: string;
+        cweIds: string[];
+    }>;
+}
+/** Brief CVE record for search results and bulk lookups. */
+export interface BriefCveRecord {
+    cisaVulnerabilityName?: string;
+    cveId: string;
+    published: string;
+    severity?: TopSeverity;
+    vulnStatus: string;
+}
+/** CVE change event from the history API. */
+export interface CveChangeEvent {
+    changeDate: string;
+    details: Array<{
+        action?: string;
+        type?: string;
+        oldValue?: string;
+        newValue?: string;
+    }>;
+    eventName?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/services/nvd-cve/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/nvd-cve/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,8CAA8C;AAC9C,MAAM,WAAW,UAAU;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,CAAC,EAAE,KAAK,CAAC;QACrB,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,MAAM,CAAC,EAAE,OAAO,CAAC;YACjB,QAAQ,CAAC,EAAE,KAAK,CAAC;gBACf,UAAU,CAAC,EAAE,OAAO,CAAC;gBACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAClB,qBAAqB,CAAC,EAAE,MAAM,CAAC;gBAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;gBAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;gBAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;gBAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;aAC1B,CAAC,CAAC;SACJ,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;QAC/B,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;QAChC,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;QAChC,aAAa,CAAC,EAAE,aAAa,EAAE,CAAC;KACjC,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACxD,CAAC,CAAC;CACJ;AAED,mCAAmC;AACnC,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,CAAC,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CAC/C;AAED,oCAAoC;AACpC,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,MAAM,CAAC,EAAE;YACP,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,OAAO,CAAC,EAAE,KAAK,CAAC;gBACd,MAAM,CAAC,EAAE,MAAM,CAAC;gBAChB,IAAI,CAAC,EAAE,MAAM,CAAC;gBACd,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;aACnB,CAAC,CAAC;SACJ,CAAC;KACH,CAAC,CAAC;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,mCAAmC;AACnC,MAAM,WAAW,SAAS;IACxB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,KAAK,CAAC;QACpB,KAAK,EAAE,KAAK,CAAC;YACX,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,KAAK,CAAC;gBACd,UAAU,EAAE,OAAO,CAAC;gBACpB,QAAQ,EAAE,MAAM,CAAC;gBACjB,qBAAqB,CAAC,EAAE,MAAM,CAAC;gBAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;gBAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;gBAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;aAC9B,CAAC,CAAC;SACJ,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtE,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzD;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,KAAK,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/services/nvd-cve/types.js

@@ -0,0 +1,6 @@
+/**
+ * @fileoverview Domain types for the NVD CVE API 2.0 response shapes and normalized domain objects.
+ * @module services/nvd-cve/types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/services/nvd-cve/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/nvd-cve/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/services/nvd-http/nvd-http-client.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @fileoverview HTTP client for the NIST NVD API 2.0 with token-bucket rate limiting.
+ * Manages API key injection, queue-based rate limiting, retry with backoff, and Retry-After header parsing.
+ * @module services/nvd-http/nvd-http-client
+ */
+import type { Context } from '@cyanheads/mcp-ts-core';
+export declare class NvdHttpClient {
+    private readonly apiKey;
+    private readonly timeoutMs;
+    private lastRequestAt;
+    private queue;
+    private draining;
+    constructor(apiKey: string | undefined, timeoutMs: number);
+    /**
+     * Enqueue and execute a request to the NVD API.
+     * Enforces minimum inter-request gap to stay within NVD rate limits.
+     */
+    get<T>(endpoint: string, params: Record<string, string | number | boolean | undefined>, ctx: Context): Promise<T>;
+    private drainNext;
+    private executeRequest;
+    private buildUrl;
+    private buildHeaders;
+}
+export declare function initNvdHttpClient(apiKey: string | undefined, timeoutMs: number): void;
+export declare function getNvdHttpClient(): NvdHttpClient;
+//# sourceMappingURL=nvd-http-client.d.ts.map

package/dist/services/nvd-http/nvd-http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd-http-client.d.ts","sourceRoot":"","sources":["../../../src/services/nvd-http/nvd-http-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAqBtD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,QAAQ,CAAS;gBAEb,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM;IAKzD;;;OAGG;IAEG,GAAG,CAAC,CAAC,EACT,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,EAC7D,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,CAAC,CAAC;IAab,OAAO,CAAC,SAAS;YAyBH,cAAc;IAyF5B,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,YAAY;CASrB;AAMD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAErF;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD"}