@loomhelix/deptrail 0.1.0

package/dist/enrich/http.js

@@ -0,0 +1,201 @@
+export class HttpError extends Error {
+    kind;
+    constructor(kind) {
+        super(`http request failed: ${kind}`);
+        this.name = 'HttpError';
+        this.kind = kind;
+    }
+}
+export const HTTP_DEFAULTS = {
+    timeoutMs: 30_000,
+    retryDelaysMs: [1000, 4000],
+    maxRetryAfterMs: 30_000,
+    maxBytes: 52_428_800,
+    concurrencyPerOrigin: 16,
+    maxRedirects: 5,
+};
+const REDIRECT_STATUSES = [301, 302, 303, 307, 308];
+const RETRYABLE_STATUS = (status) => status === 429 || status >= 500;
+const AUTHORIZATION_HEADER = /^authorization$/i;
+function retryDelayMs(headers, attempt) {
+    const retryAfterSeconds = Number(headers.get('retry-after'));
+    const headerValid = headers.get('retry-after') !== null && Number.isFinite(retryAfterSeconds) && retryAfterSeconds >= 0;
+    return headerValid
+        ? Math.min(retryAfterSeconds * 1000, HTTP_DEFAULTS.maxRetryAfterMs)
+        : HTTP_DEFAULTS.retryDelaysMs[attempt];
+}
+function nextHop(current, response) {
+    const location = response.headers.get('location');
+    if (!REDIRECT_STATUSES.includes(response.status) || location === null)
+        return undefined;
+    const url = new URL(location, current.url).href;
+    if (response.status === 303)
+        return { url, method: 'GET', body: undefined };
+    return { ...current, url };
+}
+export function createHttpClient(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const sleep = options.sleep ?? sleepUnlessAborted;
+    const timeoutMs = options.timeoutMs ?? HTTP_DEFAULTS.timeoutMs;
+    const maxBytes = options.maxBytes ?? HTTP_DEFAULTS.maxBytes;
+    const concurrencyPerOrigin = options.concurrencyPerOrigin ?? HTTP_DEFAULTS.concurrencyPerOrigin;
+    const gates = new Map();
+    function throwIfAborted() {
+        if (options.signal?.aborted)
+            throw new HttpError('aborted');
+    }
+    function sleepUnlessAborted(ms) {
+        return new Promise((resolve) => {
+            const finish = () => {
+                clearTimeout(timer);
+                options.signal?.removeEventListener('abort', finish);
+                resolve();
+            };
+            const timer = setTimeout(finish, ms);
+            options.signal?.addEventListener('abort', finish);
+            if (options.signal?.aborted)
+                finish();
+        });
+    }
+    async function acquire(origin) {
+        throwIfAborted();
+        const gate = gates.get(origin) ?? { active: 0, waiting: [] };
+        gates.set(origin, gate);
+        if (gate.active >= concurrencyPerOrigin) {
+            await new Promise((resolve, reject) => {
+                const grant = () => {
+                    options.signal?.removeEventListener('abort', giveUp);
+                    resolve();
+                };
+                const giveUp = () => {
+                    gate.waiting.splice(gate.waiting.indexOf(grant), 1);
+                    reject(new HttpError('aborted'));
+                };
+                gate.waiting.push(grant);
+                options.signal?.addEventListener('abort', giveUp);
+            });
+        }
+        else
+            gate.active++;
+        return () => {
+            const next = gate.waiting.shift();
+            if (next)
+                next();
+            else
+                gate.active--;
+        };
+    }
+    async function readBodyWithin(response) {
+        const reader = response.body?.getReader();
+        if (!reader)
+            return '';
+        const chunks = [];
+        let total = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                throw new HttpError('too-large');
+            }
+            chunks.push(value);
+        }
+        return Buffer.concat(chunks).toString('utf8');
+    }
+    function headersFor(request, hop, withholdAuthorization) {
+        const headers = {};
+        for (const [name, value] of Object.entries(request.headers ?? {})) {
+            if (!AUTHORIZATION_HEADER.test(name))
+                headers[name] = value;
+        }
+        headers['User-Agent'] = options.userAgent;
+        const authorization = withholdAuthorization ? undefined : request.authorizationFor?.(hop.url);
+        if (authorization !== undefined)
+            headers['Authorization'] = authorization;
+        return headers;
+    }
+    async function attempt(request, hop, withholdAuthorization, lastAttempt) {
+        const release = await acquire(new URL(hop.url).origin);
+        const controller = new AbortController();
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, timeoutMs);
+        const abortFromOutside = () => controller.abort();
+        options.signal?.addEventListener('abort', abortFromOutside);
+        try {
+            throwIfAborted();
+            const response = await fetchImpl(hop.url, {
+                method: hop.method,
+                headers: headersFor(request, hop, withholdAuthorization),
+                body: hop.body,
+                redirect: 'manual',
+                signal: controller.signal,
+            });
+            const bodyIsIrrelevant = nextHop(hop, response) !== undefined || (RETRYABLE_STATUS(response.status) && !lastAttempt);
+            if (bodyIsIrrelevant) {
+                await response.body?.cancel();
+                return { response, text: '' };
+            }
+            return { response, text: await readBodyWithin(response) };
+        }
+        catch (error) {
+            if (error instanceof HttpError)
+                throw error;
+            if (options.signal?.aborted)
+                throw new HttpError('aborted');
+            throw new HttpError(timedOut ? 'timeout' : 'network');
+        }
+        finally {
+            release();
+            clearTimeout(timer);
+            options.signal?.removeEventListener('abort', abortFromOutside);
+        }
+    }
+    async function fetchHop(request, hop, withholdAuthorization) {
+        const retries = HTTP_DEFAULTS.retryDelaysMs.length;
+        for (let attemptIndex = 0;; attemptIndex++) {
+            const lastAttempt = attemptIndex === retries;
+            let outcome;
+            try {
+                outcome = await attempt(request, hop, withholdAuthorization, lastAttempt);
+            }
+            catch (error) {
+                if (!(error instanceof HttpError) || error.kind !== 'network' || lastAttempt)
+                    throw error;
+                await sleep(HTTP_DEFAULTS.retryDelaysMs[attemptIndex]);
+                throwIfAborted();
+                continue;
+            }
+            const { response, text } = outcome;
+            if (RETRYABLE_STATUS(response.status) && !lastAttempt) {
+                await sleep(retryDelayMs(response.headers, attemptIndex));
+                throwIfAborted();
+                continue;
+            }
+            const redirectTo = nextHop(hop, response);
+            if (redirectTo !== undefined)
+                return { redirectTo };
+            return { response: { status: response.status, headers: response.headers, text } };
+        }
+    }
+    async function request(httpRequest) {
+        throwIfAborted();
+        let hop = { url: httpRequest.url, method: httpRequest.method ?? 'GET', body: httpRequest.body };
+        let httpsSeen = false;
+        for (let redirects = 0;; redirects++) {
+            const hopProtocol = new URL(hop.url).protocol;
+            const result = await fetchHop(httpRequest, hop, httpsSeen && hopProtocol === 'http:');
+            httpsSeen = httpsSeen || hopProtocol === 'https:';
+            if ('response' in result)
+                return result.response;
+            if (redirects === HTTP_DEFAULTS.maxRedirects)
+                throw new HttpError('redirects');
+            hop = result.redirectTo;
+        }
+    }
+    return { request };
+}

package/dist/enrich/on-demand.js

@@ -0,0 +1,220 @@
+import { advisoriesOfMatch, worstSeverity } from "../query/enrichment-lookup.js";
+import { isFresh } from "./enrichment-cache.js";
+import { hasKnownVersion, inPrivateScope, registryKeyOf, registryUrlOf } from "./enrichment-keys.js";
+import { ADVISORIES_VIEWS, advisoriesCover, isCachedAdvisories, isCachedMatch, isCachedRegistry, registryOk, } from "./enrichment-store.js";
+import { queryPackageAdvisories, queryVersions, versionKey } from "./osv-client.js";
+import { failureReason, fetchPackageMeta } from "./registry-client.js";
+const OFFLINE_REASON = 'deptrail was started with --offline';
+const NOT_SCANNED_REASON = 'the root is not scanned';
+const NOT_FOUND_REASON = 'not found in the registry';
+const NOT_MODIFIED_WITHOUT_VALIDATOR = 'responded with HTTP 304';
+const MISSING_OSV_RESULT = 'returned a malformed response';
+const PRIVATE_SCOPE_NOTE = 'private scope';
+const UNKNOWN_VERSION_NOTE = 'unknown version';
+const OSV_LABEL = 'OSV';
+const PENDING = { state: 'pending' };
+function isConfigured(root) {
+    return root.config !== undefined;
+}
+function isMatched(state) {
+    return state?.state === 'ok' || state?.state === 'stale';
+}
+function publishedOf(record) {
+    return record.state === 'ok' ? { state: 'ok', meta: record.meta } : { state: 'failed', reason: NOT_FOUND_REASON };
+}
+function failedOrExpired(reason, expired) {
+    return expired?.state === 'ok' ? { state: 'ok', meta: expired.meta } : { state: 'failed', reason };
+}
+function distinctQueries(packages) {
+    const byKey = new Map();
+    for (const { name, version } of packages) {
+        const key = versionKey(name, version);
+        if (!byKey.has(key))
+            byKey.set(key, { name, version });
+    }
+    return [...byKey.values()];
+}
+function skipNoteOf(target, privateScopes) {
+    if (inPrivateScope(target.name, privateScopes))
+        return PRIVATE_SCOPE_NOTE;
+    return hasKnownVersion(target.version) ? undefined : UNKNOWN_VERSION_NOTE;
+}
+function failedBatch(queries, reason) {
+    return { matches: new Map(), failed: new Map(queries.map(({ name, version }) => [versionKey(name, version), reason])) };
+}
+function reportedByName(targets, matches) {
+    const reported = new Map();
+    for (const { name, version } of targets) {
+        const match = matches.get(versionKey(name, version));
+        if (!isMatched(match) || match.vulns.length === 0)
+            continue;
+        reported.set(name, [...(reported.get(name) ?? []), ...match.vulns]);
+    }
+    return reported;
+}
+function unmatchedNote(match) {
+    return `${OSV_LABEL} ${match?.state === 'failed' ? match.reason : MISSING_OSV_RESULT}`;
+}
+function vulnerabilityFields(target, findings) {
+    const match = findings.matches.get(versionKey(target.name, target.version));
+    if (!isMatched(match))
+        return { vulnIds: [], notChecked: unmatchedNote(match) };
+    const advisories = advisoriesOfMatch(findings.view, target.name, match);
+    const severity = worstSeverity(advisories.map((advisory) => advisory.severity));
+    return { vulnIds: advisories.map((advisory) => advisory.id), ...(severity === undefined ? {} : { severity }) };
+}
+export function createOnDemandLookups(dependencies) {
+    const { http, osvUrl, offline, cache, now } = dependencies;
+    const versionsRecords = new Map();
+    const versionsLoads = new Map();
+    const nowIso = () => new Date(now()).toISOString();
+    const isFreshNow = (fetchedAt) => isFresh(fetchedAt, now());
+    async function fetchVersionsRecord(target, known) {
+        const validator = known?.state === 'ok' ? known : undefined;
+        const { authorizationFor } = await dependencies.credentialsOf(target.root);
+        const result = await dependencies.registryLimiterOf(target.registryUrl)(() => fetchPackageMeta(http, {
+            registry: target.registryUrl,
+            name: target.name,
+            etag: validator?.etag,
+            versionsInUse: [],
+            allManifests: true,
+            authorizationFor,
+        }));
+        const fetchedAt = nowIso();
+        if (result.state === 'ok')
+            return { record: registryOk(result.meta, fetchedAt, result.etag) };
+        if (result.state === 'not-found')
+            return { record: { state: 'not-found', fetchedAt } };
+        if (result.state === 'not-modified' && validator !== undefined) {
+            return { record: registryOk(validator.meta, fetchedAt, validator.etag) };
+        }
+        return { failure: result.state === 'failed' ? result.reason : NOT_MODIFIED_WITHOUT_VALIDATOR };
+    }
+    async function loadVersions(target) {
+        const keyParts = [target.registryUrl, target.name];
+        let known = versionsRecords.get(target.key);
+        try {
+            const cached = await cache.read('registry-versions', keyParts, isCachedRegistry);
+            if (cached !== undefined && isFreshNow(cached.fetchedAt)) {
+                versionsRecords.set(target.key, cached);
+                return publishedOf(cached);
+            }
+            known = cached ?? known;
+            const fetched = await fetchVersionsRecord(target, known);
+            if ('failure' in fetched)
+                return failedOrExpired(fetched.failure, known);
+            versionsRecords.set(target.key, fetched.record);
+            await cache.write('registry-versions', keyParts, fetched.record);
+            return publishedOf(fetched.record);
+        }
+        catch (error) {
+            return failedOrExpired(failureReason(error), known);
+        }
+    }
+    async function publishedVersions(root, name) {
+        if (offline)
+            return { state: 'failed', reason: OFFLINE_REASON };
+        if (!isConfigured(root))
+            return { state: 'failed', reason: NOT_SCANNED_REASON };
+        const registryUrl = registryUrlOf(root.config, name);
+        const key = registryKeyOf(registryUrl, name);
+        const remembered = versionsRecords.get(key);
+        if (remembered !== undefined && isFreshNow(remembered.fetchedAt))
+            return publishedOf(remembered);
+        const loading = versionsLoads.get(key);
+        if (loading !== undefined)
+            return loading;
+        const load = loadVersions({ key, registryUrl, name, root }).finally(() => versionsLoads.delete(key));
+        versionsLoads.set(key, load);
+        return load;
+    }
+    async function queryMatches(unresolved, matches) {
+        if (unresolved.length === 0)
+            return;
+        const outcome = await queryVersions(http, osvUrl, unresolved).catch((error) => failedBatch(unresolved, failureReason(error)));
+        const fetchedAt = nowIso();
+        const writes = unresolved.map(({ name, version }) => {
+            const key = versionKey(name, version);
+            const vulns = outcome.matches.get(key);
+            if (vulns === undefined) {
+                matches.set(key, { state: 'failed', reason: outcome.failed.get(key) ?? MISSING_OSV_RESULT });
+                return undefined;
+            }
+            const record = { state: 'ok', vulns, fetchedAt };
+            matches.set(key, record);
+            return cache.write('osv-matches', [key], record);
+        });
+        await Promise.all(writes);
+    }
+    async function matchesOf(targets) {
+        const matches = new Map();
+        await Promise.all(targets.map(async ({ name, version }) => {
+            const key = versionKey(name, version);
+            const stored = dependencies.storedMatchOf(key);
+            if (isMatched(stored)) {
+                matches.set(key, stored);
+                return;
+            }
+            const cached = await cache.read('osv-matches', [key], isCachedMatch);
+            if (cached !== undefined && isFreshNow(cached.fetchedAt))
+                matches.set(key, cached);
+        }));
+        await queryMatches(targets.filter(({ name, version }) => !matches.has(versionKey(name, version))), matches);
+        return matches;
+    }
+    async function advisoriesOf(name, reported) {
+        const stored = dependencies.storedAdvisoriesOf(name);
+        if ((stored?.state === 'ok' || stored?.state === 'stale') && advisoriesCover(stored.advisories, reported))
+            return stored;
+        const cached = await cache.read('osv-packages', [name], isCachedAdvisories);
+        if (cached !== undefined && isFreshNow(cached.fetchedAt) && advisoriesCover(cached.advisories, reported)) {
+            return ADVISORIES_VIEWS.ofSuccess(cached);
+        }
+        const result = await dependencies
+            .limitPackageQueries(() => queryPackageAdvisories(http, osvUrl, name))
+            .catch((error) => ({ state: 'failed', reason: failureReason(error) }));
+        if (result.state === 'failed')
+            return ADVISORIES_VIEWS.ofFailure(result.reason, undefined);
+        const record = { fetchedAt: nowIso(), advisories: result.advisories };
+        await cache.write('osv-packages', [name], record);
+        return ADVISORIES_VIEWS.ofSuccess(record);
+    }
+    async function findingsOf(targets) {
+        const matches = await matchesOf(targets);
+        const loaded = await Promise.all([...reportedByName(targets, matches)].map(async ([name, reported]) => [name, await advisoriesOf(name, reported)]));
+        const advisoriesByName = new Map(loaded);
+        return { matches, view: { advisoriesOf: (name) => advisoriesByName.get(name) ?? PENDING } };
+    }
+    async function deprecationsOf(root, targets) {
+        const known = targets.filter(({ version }) => hasKnownVersion(version));
+        const names = [...new Set(known.map(({ name }) => name))];
+        const published = new Map(await Promise.all(names.map(async (name) => [name, await publishedVersions(root, name)])));
+        const deprecations = new Map();
+        for (const { name, version } of known) {
+            const loaded = published.get(name);
+            const message = loaded?.state === 'ok' ? loaded.meta.deprecated[version] : undefined;
+            if (message !== undefined)
+                deprecations.set(versionKey(name, version), message);
+        }
+        return deprecations;
+    }
+    async function assess(root, packages) {
+        const targets = distinctQueries(packages);
+        const privateScopes = new Set([...dependencies.privateScopes(), ...Object.keys(root.config?.scopedRegistries ?? {})]);
+        if (offline) {
+            return targets.map((target) => ({ ...target, vulnIds: [], notChecked: skipNoteOf(target, privateScopes) ?? OFFLINE_REASON }));
+        }
+        const checked = targets.filter((target) => skipNoteOf(target, privateScopes) === undefined);
+        const [findings, deprecations] = await Promise.all([findingsOf(checked), deprecationsOf(root, targets)]);
+        return targets.map((target) => {
+            const skipNote = skipNoteOf(target, privateScopes);
+            const deprecated = deprecations.get(versionKey(target.name, target.version));
+            return {
+                ...target,
+                ...(skipNote === undefined ? vulnerabilityFields(target, findings) : { vulnIds: [], notChecked: skipNote }),
+                ...(deprecated === undefined ? {} : { deprecated }),
+            };
+        });
+    }
+    return { publishedVersions, assess };
+}

package/dist/enrich/osv-client.js

@@ -0,0 +1,260 @@
+import semver from 'semver';
+import { failureReason } from "./registry-client.js";
+export const OSV_DEFAULT_URL = 'https://api.osv.dev';
+export const OSV_BATCH_SIZE = 1000;
+export const OSV_PARALLEL_BATCHES = 2;
+export const OSV_MAX_PAGES = 50;
+const ECOSYSTEM = 'npm';
+const MALFORMED_REASON = 'returned a malformed response';
+const TOO_MANY_PAGES_REASON = 'returned too many pages';
+const ADVISORY_URL_PREFIX = 'https://osv.dev/vulnerability/';
+const MALICIOUS_ID_PREFIX = 'MAL-';
+const GITHUB_ID_PREFIX = 'GHSA-';
+const SUPPORTED_RANGE_TYPES = ['SEMVER', 'ECOSYSTEM'];
+const CVSS_TYPES_BY_PREFERENCE = ['CVSS_V4', 'CVSS_V3', 'CVSS_V2'];
+const SEVERITY_BY_LABEL = new Map([
+    ['LOW', 'low'],
+    ['MODERATE', 'moderate'],
+    ['MEDIUM', 'moderate'],
+    ['HIGH', 'high'],
+    ['CRITICAL', 'critical'],
+]);
+export function versionKey(name, version) {
+    return `${name}@${version}`;
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function stringsOf(value) {
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === 'string') : [];
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function chunk(items, size) {
+    const chunks = [];
+    for (let start = 0; start < items.length; start += size)
+        chunks.push(items.slice(start, start + size));
+    return chunks;
+}
+async function postJson(http, osvUrl, path, payload) {
+    let response;
+    try {
+        response = await http.request({
+            url: `${osvUrl.replace(/\/+$/, '')}${path}`,
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(payload),
+        });
+    }
+    catch (error) {
+        return { ok: false, reason: failureReason(error) };
+    }
+    if (response.status < 200 || response.status >= 300) {
+        return { ok: false, reason: `responded with HTTP ${response.status}` };
+    }
+    const body = parseJson(response.text);
+    return isPlainObject(body) ? { ok: true, body } : { ok: false, reason: MALFORMED_REASON };
+}
+function toVulnRef(value) {
+    if (!isPlainObject(value) || typeof value.id !== 'string')
+        return undefined;
+    return { id: value.id, modified: typeof value.modified === 'string' ? value.modified : '' };
+}
+function nextPageTokenOf(value) {
+    return isPlainObject(value) && typeof value.next_page_token === 'string' && value.next_page_token !== ''
+        ? value.next_page_token
+        : undefined;
+}
+function batchPayload(pending) {
+    return {
+        queries: pending.map(({ query, pageToken }) => ({
+            package: { name: query.name, ecosystem: ECOSYSTEM },
+            version: query.version,
+            ...(pageToken === undefined ? {} : { page_token: pageToken }),
+        })),
+    };
+}
+async function resolveChunk(http, osvUrl, chunkQueries) {
+    const matches = new Map(chunkQueries.map(({ key }) => [key, []]));
+    const sentTokens = new Map();
+    let pending = chunkQueries;
+    let followUpPages = 0;
+    while (pending.length > 0) {
+        const page = await postJson(http, osvUrl, '/v1/querybatch', batchPayload(pending));
+        const results = page.ok && isPlainObject(page.body) ? page.body.results : undefined;
+        if (!page.ok || !Array.isArray(results) || results.length !== pending.length) {
+            const reason = page.ok ? MALFORMED_REASON : page.reason;
+            return { matches: new Map(), failed: new Map(chunkQueries.map(({ key }) => [key, reason])) };
+        }
+        const following = [];
+        let repeatedToken = false;
+        pending.forEach((entry, index) => {
+            const result = results[index];
+            const vulns = isPlainObject(result) && Array.isArray(result.vulns) ? result.vulns : [];
+            matches.get(entry.key)?.push(...vulns.map(toVulnRef).filter((ref) => ref !== undefined));
+            const pageToken = nextPageTokenOf(result);
+            if (pageToken === undefined)
+                return;
+            const tokens = sentTokens.get(entry.key) ?? new Set();
+            sentTokens.set(entry.key, tokens);
+            if (tokens.has(pageToken))
+                repeatedToken = true;
+            tokens.add(pageToken);
+            following.push({ ...entry, pageToken });
+        });
+        followUpPages += following.length > 0 ? 1 : 0;
+        if (repeatedToken || followUpPages > OSV_MAX_PAGES) {
+            return { matches: new Map(), failed: new Map(chunkQueries.map(({ key }) => [key, TOO_MANY_PAGES_REASON])) };
+        }
+        pending = following;
+    }
+    return { matches, failed: new Map() };
+}
+export async function queryVersions(http, osvUrl, queries) {
+    const uniqueQueries = new Map();
+    for (const query of queries) {
+        const key = versionKey(query.name, query.version);
+        if (!uniqueQueries.has(key))
+            uniqueQueries.set(key, { key, query });
+    }
+    const chunks = chunk([...uniqueQueries.values()], OSV_BATCH_SIZE);
+    const outcome = { matches: new Map(), failed: new Map() };
+    let nextChunk = 0;
+    async function worker() {
+        while (nextChunk < chunks.length) {
+            const chunkOutcome = await resolveChunk(http, osvUrl, chunks[nextChunk++]);
+            for (const [key, refs] of chunkOutcome.matches)
+                outcome.matches.set(key, refs);
+            for (const [key, reason] of chunkOutcome.failed)
+                outcome.failed.set(key, reason);
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(OSV_PARALLEL_BATCHES, chunks.length) }, worker));
+    return outcome;
+}
+export function severityOf(record) {
+    if (typeof record.id === 'string' && record.id.startsWith(MALICIOUS_ID_PREFIX)) {
+        return { severity: 'critical', malicious: true };
+    }
+    const label = isPlainObject(record.database_specific) ? record.database_specific.severity : undefined;
+    const severity = typeof label === 'string' ? SEVERITY_BY_LABEL.get(label) : undefined;
+    return { severity: severity ?? 'unknown', malicious: false };
+}
+function cvssOf(record) {
+    const entries = Array.isArray(record.severity) ? record.severity.filter(isPlainObject) : [];
+    for (const type of CVSS_TYPES_BY_PREFERENCE) {
+        const match = entries.find((entry) => entry.type === type && typeof entry.score === 'string');
+        if (match !== undefined)
+            return match.score;
+    }
+    return undefined;
+}
+function toRangeEvent(value) {
+    if (!isPlainObject(value))
+        return undefined;
+    if (typeof value.introduced === 'string')
+        return { introduced: value.introduced };
+    if (typeof value.fixed === 'string')
+        return { fixed: value.fixed };
+    if (typeof value.last_affected === 'string')
+        return { last_affected: value.last_affected };
+    return undefined;
+}
+function toAffectedEntry(value, name) {
+    if (!isPlainObject(value) || !isPlainObject(value.package))
+        return undefined;
+    if (value.package.ecosystem !== ECOSYSTEM || value.package.name !== name)
+        return undefined;
+    const ranges = (Array.isArray(value.ranges) ? value.ranges : [])
+        .filter(isPlainObject)
+        .filter((range) => typeof range.type === 'string' && SUPPORTED_RANGE_TYPES.includes(range.type))
+        .map((range) => ({
+        events: (Array.isArray(range.events) ? range.events : [])
+            .map(toRangeEvent)
+            .filter((event) => event !== undefined),
+    }));
+    return { versions: stringsOf(value.versions), ranges };
+}
+function fixedVersionsOf(affected) {
+    const fixed = new Set();
+    for (const entry of affected) {
+        for (const range of entry.ranges) {
+            for (const event of range.events) {
+                if ('fixed' in event && semver.valid(event.fixed) !== null)
+                    fixed.add(event.fixed);
+            }
+        }
+    }
+    return [...fixed].sort(semver.compare);
+}
+export function toAdvisory(record, name) {
+    if (!isPlainObject(record) || typeof record.id !== 'string' || record.id === '')
+        return null;
+    if (record.withdrawn !== undefined && record.withdrawn !== null)
+        return null;
+    const affected = (Array.isArray(record.affected) ? record.affected : [])
+        .map((entry) => toAffectedEntry(entry, name))
+        .filter((entry) => entry !== undefined);
+    const cvss = cvssOf(record);
+    return {
+        id: record.id,
+        aliases: stringsOf(record.aliases),
+        summary: typeof record.summary === 'string' ? record.summary : '',
+        ...severityOf(record),
+        url: `${ADVISORY_URL_PREFIX}${record.id}`,
+        fixedIn: fixedVersionsOf(affected),
+        ...(cvss === undefined ? {} : { cvss }),
+        modified: typeof record.modified === 'string' ? record.modified : '',
+        affected,
+    };
+}
+function areSameVulnerability(first, second) {
+    return first.aliases.includes(second.id) || second.aliases.includes(first.id);
+}
+export function dedupeAdvisories(advisories) {
+    const kept = [];
+    for (const candidate of advisories) {
+        const duplicateIndex = kept.findIndex((existing) => areSameVulnerability(existing, candidate));
+        if (duplicateIndex === -1) {
+            kept.push(candidate);
+            continue;
+        }
+        const candidateIsGithub = candidate.id.startsWith(GITHUB_ID_PREFIX);
+        const existingIsGithub = kept[duplicateIndex].id.startsWith(GITHUB_ID_PREFIX);
+        if (candidateIsGithub && !existingIsGithub)
+            kept[duplicateIndex] = candidate;
+    }
+    return kept;
+}
+export async function queryPackageAdvisories(http, osvUrl, name) {
+    const advisories = [];
+    const sentTokens = new Set();
+    let pageToken;
+    let pagesFetched = 0;
+    do {
+        const payload = { package: { name, ecosystem: ECOSYSTEM }, ...(pageToken === undefined ? {} : { page_token: pageToken }) };
+        const page = await postJson(http, osvUrl, '/v1/query', payload);
+        if (!page.ok)
+            return { state: 'failed', reason: page.reason };
+        const body = page.body;
+        for (const record of Array.isArray(body.vulns) ? body.vulns : []) {
+            const converted = toAdvisory(record, name);
+            if (converted !== null)
+                advisories.push(converted);
+        }
+        pageToken = nextPageTokenOf(body);
+        pagesFetched += 1;
+        if (pageToken !== undefined && (sentTokens.has(pageToken) || pagesFetched > OSV_MAX_PAGES)) {
+            return { state: 'failed', reason: TOO_MANY_PAGES_REASON };
+        }
+        if (pageToken !== undefined)
+            sentTokens.add(pageToken);
+    } while (pageToken !== undefined);
+    return { state: 'ok', advisories: dedupeAdvisories(advisories) };
+}