@nexus_js/audit 0.7.0 → 0.7.2

package/dist/engine.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Nexus Audit Engine — CVE Database via OSV (Open Source Vulnerabilities).
+ *
+ * Uses the free, open Google OSV API (https://osv.dev) — no API key required.
+ * Responses are cached locally in ~/.nexus/cache/ for offline operation.
+ *
+ * API reference: https://google.github.io/osv.dev/api/
+ *
+ * Cache strategy:
+ *  - Queries are cached per package@version for 24h (TTL configurable)
+ *  - On offline: stale cache is used transparently (no error)
+ *  - Cache location: ~/.nexus/cache/osv/{pkg-name}.json
+ *
+ * OSV severity mapping to Nexus levels:
+ *   CRITICAL → critical  (CVSS ≥ 9.0 or explicit CRITICAL)
+ *   HIGH     → high      (CVSS 7.0–8.9)
+ *   MEDIUM   → medium    (CVSS 4.0–6.9)
+ *   LOW      → low       (CVSS < 4.0)
+ */
+export type VulnSeverity = 'critical' | 'high' | 'medium' | 'low' | 'unknown';
+export interface Vulnerability {
+    id: string;
+    summary: string;
+    severity: VulnSeverity;
+    cvss?: number | undefined;
+    aliases: string[];
+    affectedVersions: string;
+    fixedIn?: string | undefined;
+    references: string[];
+    published: string;
+}
+export interface AuditResult {
+    package: string;
+    version: string;
+    status: 'safe' | 'vulnerable' | 'unknown';
+    vulns: Vulnerability[];
+    /** True if result came from local cache */
+    cached: boolean;
+    /** True if result is stale (TTL expired) but used because offline */
+    stale: boolean;
+    checkedAt: number;
+}
+/**
+ * Audits a single package for known CVEs using the OSV database.
+ * Results are cached locally for 24h.
+ *
+ * @param pkg      Package name (e.g. 'lodash' or '@angular/core')
+ * @param version  Specific version to check (e.g. '4.17.20'). If omitted, checks all versions.
+ */
+export declare function auditPackage(pkg: string, version?: string): Promise<AuditResult>;
+/**
+ * Audits all dependencies in a package.json.
+ * Runs queries in parallel (max 6 concurrent) to avoid rate limiting.
+ */
+export declare function auditDependencies(deps: Record<string, string>): Promise<Map<string, AuditResult>>;
+/** Returns only vulnerable packages, sorted by severity. */
+export declare function filterVulnerable(results: Map<string, AuditResult>): AuditResult[];
+/** Invalidates the local cache for a specific package (forces re-fetch). */
+export declare function invalidateCache(pkg: string): Promise<void>;
+/** Clears the entire OSV cache (all packages). */
+export declare function clearCache(): Promise<void>;
+//# sourceMappingURL=engine.d.ts.map

package/dist/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAgB,MAAM,CAAC;IACzB,OAAO,EAAW,MAAM,CAAC;IACzB,QAAQ,EAAU,YAAY,CAAC;IAC/B,IAAI,CAAC,EAAa,MAAM,GAAG,SAAS,CAAC;IACrC,OAAO,EAAW,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAU,MAAM,GAAG,SAAS,CAAC;IACrC,UAAU,EAAQ,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAS,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAM,MAAM,CAAC;IACpB,OAAO,EAAM,MAAM,CAAC;IACpB,MAAM,EAAO,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IAC/C,KAAK,EAAQ,aAAa,EAAE,CAAC;IAC7B,2CAA2C;IAC3C,MAAM,EAAO,OAAO,CAAC;IACrB,qEAAqE;IACrE,KAAK,EAAQ,OAAO,CAAC;IACrB,SAAS,EAAI,MAAM,CAAC;CACrB;AA+ID;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA0DtF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAuBnC;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,WAAW,EAAE,CASjF;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhE;AAED,kDAAkD;AAClD,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAKhD"}

package/dist/engine.js

@@ -0,0 +1,261 @@
+/**
+ * Nexus Audit Engine — CVE Database via OSV (Open Source Vulnerabilities).
+ *
+ * Uses the free, open Google OSV API (https://osv.dev) — no API key required.
+ * Responses are cached locally in ~/.nexus/cache/ for offline operation.
+ *
+ * API reference: https://google.github.io/osv.dev/api/
+ *
+ * Cache strategy:
+ *  - Queries are cached per package@version for 24h (TTL configurable)
+ *  - On offline: stale cache is used transparently (no error)
+ *  - Cache location: ~/.nexus/cache/osv/{pkg-name}.json
+ *
+ * OSV severity mapping to Nexus levels:
+ *   CRITICAL → critical  (CVSS ≥ 9.0 or explicit CRITICAL)
+ *   HIGH     → high      (CVSS 7.0–8.9)
+ *   MEDIUM   → medium    (CVSS 4.0–6.9)
+ *   LOW      → low       (CVSS < 4.0)
+ */
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const OSV_API = 'https://api.osv.dev/v1/query';
+const CACHE_DIR = join(homedir(), '.nexus', 'cache', 'osv');
+const CACHE_TTL_MS = 24 * 60 * 60 * 1_000; // 24h
+// ── Cache helpers ─────────────────────────────────────────────────────────────
+async function ensureCacheDir() {
+    try {
+        await mkdir(CACHE_DIR, { recursive: true });
+    }
+    catch { /* already exists */ }
+}
+function cacheKey(pkg) {
+    return pkg.replace(/\//g, '__').replace(/@/g, '_at_');
+}
+async function readCache(pkg) {
+    try {
+        const raw = await readFile(join(CACHE_DIR, `${cacheKey(pkg)}.json`), 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+async function writeCache(pkg, entry) {
+    await ensureCacheDir();
+    try {
+        await writeFile(join(CACHE_DIR, `${cacheKey(pkg)}.json`), JSON.stringify(entry, null, 2));
+    }
+    catch { /* cache write failure is non-fatal */ }
+}
+// ── OSV API ───────────────────────────────────────────────────────────────────
+function parseSeverity(vuln) {
+    const severityBlock = vuln.severity ?? [];
+    // Look for CVSS v3 score first
+    for (const s of severityBlock) {
+        if (s.type === 'CVSS_V3' || s.type === 'CVSS_V4') {
+            // Extract numeric score from vector string (e.g. "CVSS:3.1/AV:N/AC:L/...")
+            // OSV also sometimes provides the numeric score directly
+            const scoreMatch = s.score.match(/^(\d+\.\d+)$/) ??
+                s.score.match(/\/(\d+\.\d+)$/);
+            const score = scoreMatch ? parseFloat(scoreMatch[1] ?? '0') : 0;
+            let sev = 'unknown';
+            if (score >= 9.0)
+                sev = 'critical';
+            else if (score >= 7.0)
+                sev = 'high';
+            else if (score >= 4.0)
+                sev = 'medium';
+            else if (score > 0)
+                sev = 'low';
+            return { severity: sev, cvss: score };
+        }
+    }
+    // Fall back to explicit severity labels in the ID
+    const id = vuln.id.toUpperCase();
+    if (id.includes('CRITICAL'))
+        return { severity: 'critical' };
+    if (id.includes('HIGH'))
+        return { severity: 'high' };
+    if (id.includes('MEDIUM'))
+        return { severity: 'medium' };
+    if (id.includes('LOW'))
+        return { severity: 'low' };
+    return { severity: 'unknown' };
+}
+function parseFixedVersion(vuln) {
+    for (const affected of vuln.affected ?? []) {
+        for (const range of affected.ranges ?? []) {
+            for (const event of range.events ?? []) {
+                if (event.fixed)
+                    return event.fixed;
+            }
+        }
+    }
+    return undefined;
+}
+function parseAffectedVersions(vuln) {
+    const parts = [];
+    for (const affected of vuln.affected ?? []) {
+        for (const range of affected.ranges ?? []) {
+            let intro;
+            let fixed;
+            for (const event of range.events ?? []) {
+                if (event.introduced)
+                    intro = event.introduced;
+                if (event.fixed)
+                    fixed = event.fixed;
+            }
+            if (intro && fixed)
+                parts.push(`>=${intro} <${fixed}`);
+            else if (intro)
+                parts.push(`>=${intro}`);
+            else if (fixed)
+                parts.push(`<${fixed}`);
+        }
+        // Direct version list
+        if (affected.versions?.length) {
+            parts.push(affected.versions.slice(0, 5).join(', ') + (affected.versions.length > 5 ? '...' : ''));
+        }
+    }
+    return parts.join('; ') || 'all versions';
+}
+async function fetchFromOSV(pkg, version) {
+    const body = {
+        package: { name: pkg, ecosystem: 'npm' },
+    };
+    if (version)
+        body['version'] = version;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 8_000);
+    try {
+        const res = await fetch(OSV_API, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            return null;
+        return await res.json();
+    }
+    catch {
+        return null; // network error — caller falls back to cache
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+// ── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Audits a single package for known CVEs using the OSV database.
+ * Results are cached locally for 24h.
+ *
+ * @param pkg      Package name (e.g. 'lodash' or '@angular/core')
+ * @param version  Specific version to check (e.g. '4.17.20'). If omitted, checks all versions.
+ */
+export async function auditPackage(pkg, version) {
+    const cached = await readCache(pkg);
+    const now = Date.now();
+    // Fresh cache hit
+    if (cached && now < cached.expiresAt) {
+        return { ...cached.result, cached: true, stale: false };
+    }
+    // Try to fetch from OSV
+    const osvData = await fetchFromOSV(pkg, version);
+    if (!osvData) {
+        // Offline or API error — use stale cache if available
+        if (cached) {
+            return { ...cached.result, cached: true, stale: true };
+        }
+        // No cache at all
+        return {
+            package: pkg, version: version ?? '*',
+            status: 'unknown', vulns: [],
+            cached: false, stale: false,
+            checkedAt: now,
+        };
+    }
+    // Parse OSV response
+    const vulns = (osvData.vulns ?? []).map((v) => {
+        const { severity, cvss } = parseSeverity(v);
+        return {
+            id: v.id,
+            summary: v.summary ?? 'No summary available',
+            severity,
+            cvss,
+            aliases: v.aliases ?? [],
+            affectedVersions: parseAffectedVersions(v),
+            fixedIn: parseFixedVersion(v),
+            references: (v.references ?? []).map((r) => r.url),
+            published: v.published,
+        };
+    });
+    // Sort by severity
+    const SORDER = { critical: 0, high: 1, medium: 2, low: 3, unknown: 4 };
+    vulns.sort((a, b) => SORDER[a.severity] - SORDER[b.severity]);
+    const result = {
+        package: pkg,
+        version: version ?? '*',
+        status: vulns.length > 0 ? 'vulnerable' : 'safe',
+        vulns,
+        cached: false,
+        stale: false,
+        checkedAt: now,
+    };
+    await writeCache(pkg, { result, expiresAt: now + CACHE_TTL_MS, version: version ?? '*' });
+    return result;
+}
+/**
+ * Audits all dependencies in a package.json.
+ * Runs queries in parallel (max 6 concurrent) to avoid rate limiting.
+ */
+export async function auditDependencies(deps) {
+    const results = new Map();
+    const entries = Object.entries(deps);
+    const BATCH = 6;
+    for (let i = 0; i < entries.length; i += BATCH) {
+        const batch = entries.slice(i, i + BATCH);
+        const settled = await Promise.allSettled(batch.map(async ([name, versionRange]) => {
+            // Strip semver range prefix for OSV query
+            const version = versionRange.replace(/^[\^~>=<]/, '').split(' ')[0];
+            const result = await auditPackage(name, version);
+            return [name, result];
+        }));
+        for (const s of settled) {
+            if (s.status === 'fulfilled') {
+                results.set(s.value[0], s.value[1]);
+            }
+        }
+    }
+    return results;
+}
+/** Returns only vulnerable packages, sorted by severity. */
+export function filterVulnerable(results) {
+    const SORDER = { critical: 0, high: 1, medium: 2, low: 3, unknown: 4 };
+    return [...results.values()]
+        .filter((r) => r.status === 'vulnerable')
+        .sort((a, b) => {
+        const as = a.vulns[0]?.severity ?? 'unknown';
+        const bs = b.vulns[0]?.severity ?? 'unknown';
+        return SORDER[as] - SORDER[bs];
+    });
+}
+/** Invalidates the local cache for a specific package (forces re-fetch). */
+export async function invalidateCache(pkg) {
+    const { unlink } = await import('node:fs/promises');
+    try {
+        await unlink(join(CACHE_DIR, `${cacheKey(pkg)}.json`));
+    }
+    catch { /* file may not exist */ }
+}
+/** Clears the entire OSV cache (all packages). */
+export async function clearCache() {
+    const { rm } = await import('node:fs/promises');
+    try {
+        await rm(CACHE_DIR, { recursive: true, force: true });
+    }
+    catch { /* ignore */ }
+}
+//# sourceMappingURL=engine.js.map

package/dist/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,OAAO,GAAQ,8BAA8B,CAAC;AACpD,MAAM,SAAS,GAAM,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC/D,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM;AAsDjD,iFAAiF;AAEjF,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,KAAiB;IACtD,MAAM,cAAc,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;AACpD,CAAC;AAED,iFAAiF;AAEjF,SAAS,aAAa,CAAC,IAAa;IAClC,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAE1C,+BAA+B;IAC/B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACjD,2EAA2E;YAC3E,yDAAyD;YACzD,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC7B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,IAAI,GAAG,GAAiB,SAAS,CAAC;YAClC,IAAI,KAAK,IAAI,GAAG;gBAAE,GAAG,GAAG,UAAU,CAAC;iBAC9B,IAAI,KAAK,IAAI,GAAG;gBAAE,GAAG,GAAG,MAAM,CAAC;iBAC/B,IAAI,KAAK,IAAI,GAAG;gBAAE,GAAG,GAAG,QAAQ,CAAC;iBACjC,IAAI,KAAK,GAAG,CAAC;gBAAK,GAAG,GAAG,KAAK,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAC7D,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAM,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACzD,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAI,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC3D,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAO,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBACvC,IAAI,KAAK,CAAC,KAAK;oBAAE,OAAO,KAAK,CAAC,KAAK,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAa;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC1C,IAAI,KAAyB,CAAC;YAC9B,IAAI,KAAyB,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBACvC,IAAI,KAAK,CAAC,UAAU;oBAAE,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC;gBAC/C,IAAI,KAAK,CAAC,KAAK;oBAAO,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC5C,CAAC;YACD,IAAI,KAAK,IAAI,KAAK;gBAAI,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;iBACpD,IAAI,KAAK;gBAAQ,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;iBAC1C,IAAI,KAAK;gBAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,sBAAsB;QACtB,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,OAAgB;IACvD,MAAM,IAAI,GAA4B;QACpC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE;KACzC,CAAC;IACF,IAAI,OAAO;QAAE,IAAI,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;IAEvC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YAC/B,MAAM,EAAG,MAAM;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC7B,MAAM,EAAG,UAAU,CAAC,MAAM;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,MAAM,GAAG,CAAC,IAAI,EAAiB,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,6CAA6C;IAC5D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,OAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAM,IAAI,CAAC,GAAG,EAAE,CAAC;IAE1B,kBAAkB;IAClB,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,wBAAwB;IACxB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,sDAAsD;QACtD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzD,CAAC;QACD,kBAAkB;QAClB,OAAO;YACL,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,GAAG;YACrC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;YAC3B,SAAS,EAAE,GAAG;SACf,CAAC;IACJ,CAAC;IAED,qBAAqB;IACrB,MAAM,KAAK,GAAoB,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7D,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC5C,OAAO;YACL,EAAE,EAAgB,CAAC,CAAC,EAAE;YACtB,OAAO,EAAW,CAAC,CAAC,OAAO,IAAI,sBAAsB;YACrD,QAAQ;YACR,IAAI;YACJ,OAAO,EAAW,CAAC,CAAC,OAAO,IAAI,EAAE;YACjC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,CAAC;YAC1C,OAAO,EAAW,iBAAiB,CAAC,CAAC,CAAC;YACtC,UAAU,EAAQ,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,SAAS,EAAS,CAAC,CAAC,SAAS;SAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,mBAAmB;IACnB,MAAM,MAAM,GAAiC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACrG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAgB;QAC1B,OAAO,EAAI,GAAG;QACd,OAAO,EAAI,OAAO,IAAI,GAAG;QACzB,MAAM,EAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM;QACnD,KAAK;QACL,MAAM,EAAK,KAAK;QAChB,KAAK,EAAM,KAAK;QAChB,SAAS,EAAE,GAAG;KACf,CAAC;IAEF,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,YAAY,EAAE,OAAO,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAK,CAAC,CAAC;IAElB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE;YACvC,0CAA0C;YAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,MAAM,MAAM,GAAI,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,EAAE,MAAM,CAA0B,CAAC;QACjD,CAAC,CAAC,CACH,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,OAAiC;IAChE,MAAM,MAAM,GAAiC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACrG,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,SAAS,CAAC;QAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,SAAS,CAAC;QAC7C,OAAO,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;AACtC,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AAC1B,CAAC"}

package/{src/index.ts → dist/index.d.ts}

@@ -9,34 +9,12 @@
  *  - Build-time blocking for critical vulnerabilities
  *  - `nexus fix` auto-remediation data
  */
-
-export {
-  auditPackage,
-  auditDependencies,
-  filterVulnerable,
-  invalidateCache,
-  clearCache,
-} from './engine.js';
+export { auditPackage, auditDependencies, filterVulnerable, invalidateCache, clearCache, } from './engine.js';
 export type { AuditResult, Vulnerability, VulnSeverity } from './engine.js';
-
-export {
-  checkSupplyChain,
-  auditSupplyChain,
-  MFA_NOTE,
-} from './supply-chain.js';
+export { checkSupplyChain, auditSupplyChain, MFA_NOTE, } from './supply-chain.js';
 export type { SupplyChainResult, SupplyChainFlag, SupplyChainRiskLevel } from './supply-chain.js';
-
-export {
-  validateOverride,
-  findOverride,
-  formatOverrides,
-  maxOverrideDate,
-} from './override.js';
+export { validateOverride, findOverride, formatOverrides, maxOverrideDate, } from './override.js';
 export type { VulnerabilityOverride, AllowVulnerableConfig } from './override.js';
-
-export {
-  scanProject,
-  NexusSecurityError,
-  auditPackage as auditSinglePackage,
-} from './scanner.js';
+export { scanProject, NexusSecurityError, auditPackage as auditSinglePackage, } from './scanner.js';
 export type { ScanOptions, ScanResult } from './scanner.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,GACT,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAElG,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAElF,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,IAAI,kBAAkB,GACnC,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,16 @@
+/**
+ * @nexus_js/audit — Dependency Auditing & Supply Chain Security
+ *
+ * Provides:
+ *  - CVE scanning via Google OSV (open, no API key)
+ *  - Supply chain risk analysis via npm registry
+ *  - Offline-first local cache (~/.nexus/cache/)
+ *  - Override policy with automatic expiry
+ *  - Build-time blocking for critical vulnerabilities
+ *  - `nexus fix` auto-remediation data
+ */
+export { auditPackage, auditDependencies, filterVulnerable, invalidateCache, clearCache, } from './engine.js';
+export { checkSupplyChain, auditSupplyChain, MFA_NOTE, } from './supply-chain.js';
+export { validateOverride, findOverride, formatOverrides, maxOverrideDate, } from './override.js';
+export { scanProject, NexusSecurityError, auditPackage as auditSinglePackage, } from './scanner.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,UAAU,GACX,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,GACT,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,IAAI,kBAAkB,GACnC,MAAM,cAAc,CAAC"}

package/dist/override.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Nexus Security Override Policy — "Ghost Wall" exceptions.
+ *
+ * Sometimes a library is vulnerable but:
+ *  - The patch isn't yet on a stable release
+ *  - You only use the affected function in a build-time context (never in production)
+ *  - Your organization has an accepted risk decision documented elsewhere
+ *
+ * Overrides are explicit, time-limited exceptions that:
+ *  1. Require a documented reason
+ *  2. Expire automatically — the build fails again after the date
+ *  3. Are logged in every audit report
+ *  4. Do NOT suppress warnings (only prevent build failure)
+ *
+ * Usage in nexus.config.ts:
+ *
+ * ```ts
+ * import { defineNexusConfig } from '@nexus_js/core';
+ *
+ * export default defineNexusConfig({
+ *   security: {
+ *     hardened: true,
+ *     allowVulnerable: {
+ *       'pdfkit': {
+ *         cve: 'CVE-2024-29415',
+ *         reason: 'Used in build-time PDF generation only. Not in the client bundle. ' +
+ *                 'Patched version releases 2026-05-15 according to maintainer.',
+ *         expires: '2026-06-01',
+ *       },
+ *     },
+ *   },
+ * });
+ * ```
+ *
+ * After `expires`, the build fails again, forcing re-evaluation.
+ * If the patch is available, update the dependency. If not, extend the override with a new reason.
+ */
+export interface VulnerabilityOverride {
+    /** CVE ID or OSV ID being overridden */
+    cve: string;
+    /** REQUIRED: human-readable business justification */
+    reason: string;
+    /**
+     * ISO date string (YYYY-MM-DD). After this date, the override expires
+     * and the build will fail again. Maximum: 180 days from today.
+     */
+    expires: string;
+}
+export type AllowVulnerableConfig = Record<string, VulnerabilityOverride>;
+export interface OverrideValidation {
+    valid: boolean;
+    expired: boolean;
+    daysLeft: number;
+    message: string;
+}
+/**
+ * Validates an override at build time.
+ * Returns { valid: false } if expired or malformed.
+ */
+export declare function validateOverride(pkg: string, override: VulnerabilityOverride): OverrideValidation;
+/**
+ * Checks if a package+CVE combination is covered by an active override.
+ * Returns null if no override applies (build should fail on critical CVE).
+ */
+export declare function findOverride(pkg: string, cveId: string, overrides: AllowVulnerableConfig): OverrideValidation | null;
+/**
+ * Formats all active overrides for display in audit output.
+ * Groups by status: active, expiring soon, expired.
+ */
+export declare function formatOverrides(overrides: AllowVulnerableConfig): {
+    active: string[];
+    expiringSoon: string[];
+    expired: string[];
+};
+/**
+ * Returns the maximum safe override duration (180 days from now).
+ * Overrides beyond this are rejected to prevent permanent exceptions.
+ */
+export declare function maxOverrideDate(): string;
+//# sourceMappingURL=override.d.ts.map

package/dist/override.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"override.d.ts","sourceRoot":"","sources":["../src/override.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,GAAG,EAAM,MAAM,CAAC;IAChB,sDAAsD;IACtD,MAAM,EAAG,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAE1E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAM,OAAO,CAAC;IACnB,OAAO,EAAI,OAAO,CAAC;IACnB,QAAQ,EAAG,MAAM,CAAC;IAClB,OAAO,EAAI,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAO,MAAM,EAChB,QAAQ,EAAE,qBAAqB,GAC9B,kBAAkB,CA2CpB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAO,MAAM,EAChB,KAAK,EAAK,MAAM,EAChB,SAAS,EAAE,qBAAqB,GAC/B,kBAAkB,GAAG,IAAI,CAa3B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,qBAAqB,GAC/B;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAiBjE;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAIxC"}

package/dist/override.js

@@ -0,0 +1,127 @@
+/**
+ * Nexus Security Override Policy — "Ghost Wall" exceptions.
+ *
+ * Sometimes a library is vulnerable but:
+ *  - The patch isn't yet on a stable release
+ *  - You only use the affected function in a build-time context (never in production)
+ *  - Your organization has an accepted risk decision documented elsewhere
+ *
+ * Overrides are explicit, time-limited exceptions that:
+ *  1. Require a documented reason
+ *  2. Expire automatically — the build fails again after the date
+ *  3. Are logged in every audit report
+ *  4. Do NOT suppress warnings (only prevent build failure)
+ *
+ * Usage in nexus.config.ts:
+ *
+ * ```ts
+ * import { defineNexusConfig } from '@nexus_js/core';
+ *
+ * export default defineNexusConfig({
+ *   security: {
+ *     hardened: true,
+ *     allowVulnerable: {
+ *       'pdfkit': {
+ *         cve: 'CVE-2024-29415',
+ *         reason: 'Used in build-time PDF generation only. Not in the client bundle. ' +
+ *                 'Patched version releases 2026-05-15 according to maintainer.',
+ *         expires: '2026-06-01',
+ *       },
+ *     },
+ *   },
+ * });
+ * ```
+ *
+ * After `expires`, the build fails again, forcing re-evaluation.
+ * If the patch is available, update the dependency. If not, extend the override with a new reason.
+ */
+/**
+ * Validates an override at build time.
+ * Returns { valid: false } if expired or malformed.
+ */
+export function validateOverride(pkg, override) {
+    const expiry = new Date(override.expires);
+    if (isNaN(expiry.getTime())) {
+        return {
+            valid: false,
+            expired: false,
+            daysLeft: 0,
+            message: `[Nexus Security] Override for "${pkg}" has an invalid expiry date: "${override.expires}". Use YYYY-MM-DD format.`,
+        };
+    }
+    const now = new Date();
+    const daysLeft = Math.ceil((expiry.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
+    const expired = daysLeft <= 0;
+    if (expired) {
+        return {
+            valid: false,
+            expired: true,
+            daysLeft: 0,
+            message: `[Nexus Security] ⛔ Override for "${pkg}" (${override.cve}) EXPIRED on ${override.expires}.\n` +
+                `  Original reason: "${override.reason}"\n` +
+                `  The vulnerability must now be addressed. Options:\n` +
+                `    1. Update "${pkg}" to a patched version\n` +
+                `    2. Replace "${pkg}" with a safe alternative\n` +
+                `    3. Extend the override with a new expiry date (requires fresh justification)`,
+        };
+    }
+    // Warn when approaching expiry
+    const warningDays = 14;
+    const warning = daysLeft <= warningDays
+        ? `\n  ⚠️  Override for "${pkg}" expires in ${daysLeft} day${daysLeft === 1 ? '' : 's'} (${override.expires}).`
+        : '';
+    return {
+        valid: true,
+        expired: false,
+        daysLeft,
+        message: `[Nexus Security] ⚠️  OVERRIDE ACTIVE for "${pkg}" (${override.cve}).${warning}\n  Reason: "${override.reason}"`,
+    };
+}
+/**
+ * Checks if a package+CVE combination is covered by an active override.
+ * Returns null if no override applies (build should fail on critical CVE).
+ */
+export function findOverride(pkg, cveId, overrides) {
+    const override = overrides[pkg];
+    if (!override)
+        return null;
+    // Check if the CVE matches (direct or alias)
+    const configCve = override.cve.toUpperCase().trim();
+    const queryCve = cveId.toUpperCase().trim();
+    if (configCve !== queryCve && !queryCve.includes(configCve) && !configCve.includes(queryCve)) {
+        return null;
+    }
+    return validateOverride(pkg, override);
+}
+/**
+ * Formats all active overrides for display in audit output.
+ * Groups by status: active, expiring soon, expired.
+ */
+export function formatOverrides(overrides) {
+    const active = [];
+    const expiringSoon = [];
+    const expired = [];
+    for (const [pkg, override] of Object.entries(overrides)) {
+        const v = validateOverride(pkg, override);
+        if (v.expired) {
+            expired.push(`${pkg} (${override.cve}) — expired ${override.expires}`);
+        }
+        else if (v.daysLeft <= 14) {
+            expiringSoon.push(`${pkg} (${override.cve}) — expires in ${v.daysLeft} days`);
+        }
+        else {
+            active.push(`${pkg} (${override.cve}) — ${v.daysLeft} days left`);
+        }
+    }
+    return { active, expiringSoon, expired };
+}
+/**
+ * Returns the maximum safe override duration (180 days from now).
+ * Overrides beyond this are rejected to prevent permanent exceptions.
+ */
+export function maxOverrideDate() {
+    const d = new Date();
+    d.setDate(d.getDate() + 180);
+    return d.toISOString().split('T')[0];
+}
+//# sourceMappingURL=override.js.map

package/dist/override.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"override.js","sourceRoot":"","sources":["../src/override.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAuBH;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAgB,EAChB,QAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,KAAK,EAAK,KAAK;YACf,OAAO,EAAG,KAAK;YACf,QAAQ,EAAE,CAAC;YACX,OAAO,EAAG,kCAAkC,GAAG,kCAAkC,QAAQ,CAAC,OAAO,2BAA2B;SAC7H,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAQ,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAI,QAAQ,IAAI,CAAC,CAAC;IAE/B,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,KAAK,EAAK,KAAK;YACf,OAAO,EAAG,IAAI;YACd,QAAQ,EAAE,CAAC;YACX,OAAO,EACL,oCAAoC,GAAG,MAAM,QAAQ,CAAC,GAAG,gBAAgB,QAAQ,CAAC,OAAO,KAAK;gBAC9F,uBAAuB,QAAQ,CAAC,MAAM,KAAK;gBAC3C,uDAAuD;gBACvD,kBAAkB,GAAG,0BAA0B;gBAC/C,mBAAmB,GAAG,6BAA6B;gBACnD,kFAAkF;SACrF,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAO,QAAQ,IAAI,WAAW;QACzC,CAAC,CAAC,yBAAyB,GAAG,gBAAgB,QAAQ,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,OAAO,IAAI;QAC/G,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,KAAK,EAAK,IAAI;QACd,OAAO,EAAG,KAAK;QACf,QAAQ;QACR,OAAO,EAAE,6CAA6C,GAAG,MAAM,QAAQ,CAAC,GAAG,KAAK,OAAO,gBAAgB,QAAQ,CAAC,MAAM,GAAG;KAC1H,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAgB,EAChB,KAAgB,EAChB,SAAgC;IAEhC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,6CAA6C;IAC7C,MAAM,SAAS,GAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAK,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAE9C,IAAI,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAgC;IAEhC,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,QAAQ,CAAC,GAAG,eAAe,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC5B,YAAY,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,QAAQ,CAAC,GAAG,kBAAkB,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,YAAY,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAC;AACjD,CAAC"}