@securecode-ai/mcp 0.5.5 → 0.5.7

package/dist/audit/scanAuditLog.js

@@ -0,0 +1,404 @@
+"use strict";
+/**
+ * Metadata-only scan audit log — samples per-scan metadata (no source code,
+ * no evidence strings) for quality auditing and regression tracking.
+ *
+ * Privacy contract (same as agentTrace.ts):
+ *   - Source code NEVER leaves the machine.
+ *   - Evidence strings, `why` explanations, fix code, and file content are
+ *     NOT recorded. Only hashes, counts, verdicts, cost, steps, and action
+ *     type histograms are stored.
+ *   - The audit log is per-workspace, stored at
+ *     `<workspaceRoot>/.securecode/scan-audit.jsonl`.
+ *
+ * Sampling:
+ *   - Not every scan is recorded — a configurable sampling rate (default 1.0
+ *     = 100% for local audit; the caller can lower it) gates which scans
+ *     are persisted. Sampling is deterministic per scan (hash of file path
+ *     + timestamp) so the same scan re-run doesn't double-count.
+ *
+ * Reuses metric vocabulary from agentEvalScoring.ts for aggregation:
+ *   - provenRate, inconclusiveRate, meanSteps, meanCostUsd
+ *
+ * Retention:
+ *   - 90-day TTL (longer than trace's 7 days — audit is long-term quality).
+ *   - 1000 entries per workspace (3x the approval audit cap).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordScanAuditSample = recordScanAuditSample;
+exports.readScanAuditLog = readScanAuditLog;
+exports.summarizeScanAuditLog = summarizeScanAuditLog;
+exports.clearScanAuditLog = clearScanAuditLog;
+exports.formatAuditSummary = formatAuditSummary;
+exports.validateProvenInvariant = validateProvenInvariant;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const AUDIT_DIR = '.securecode';
+const AUDIT_FILE = 'scan-audit.jsonl';
+const MAX_ENTRIES = 1000;
+const RETENTION_MS = 90 * 24 * 60 * 60 * 1000; // 90 days
+function ensureAuditDir(workspaceRoot) {
+    const dir = path.join(workspaceRoot, AUDIT_DIR);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+function getAuditPath(workspaceRoot) {
+    return path.join(ensureAuditDir(workspaceRoot), AUDIT_FILE);
+}
+function shouldSample(filePath, timestamp, samplingRate) {
+    if (samplingRate >= 1.0)
+        return true;
+    if (samplingRate <= 0.0)
+        return false;
+    const hash = crypto.createHash('sha256').update(`${filePath}:${timestamp}`).digest('hex');
+    const value = parseInt(hash.substring(0, 8), 16) / 0xffffffff;
+    return value < samplingRate;
+}
+function buildActionHistogram(transcript) {
+    const hist = {};
+    for (const step of transcript) {
+        const type = step?.action?.type;
+        if (!type)
+            continue;
+        hist[type] = (hist[type] || 0) + 1;
+    }
+    return hist;
+}
+function recordScanAuditSample(workspaceRoot, scanResult, options) {
+    const samplingRate = options?.samplingRate ?? 1.0;
+    const timestamp = Date.now();
+    if (!shouldSample(scanResult.filePath, timestamp, samplingRate)) {
+        return false;
+    }
+    const findings = (scanResult.agentFindings || []).map((f) => ({
+        type: f.type || 'unknown',
+        severity: f.severity || 'unknown',
+        line: f.line || 0,
+        confidence: f.confidence ?? 0,
+        proven: f.proven || 'UNKNOWN',
+        evidenceLevel: f.evidenceLevel,
+        verificationLevel: f.verificationLevel,
+    }));
+    const findingCounts = {
+        total: findings.length,
+        proven: findings.filter(f => f.proven === 'PROVEN').length,
+        unproven: findings.filter(f => f.proven === 'UNPROVEN').length,
+        inconclusive: findings.filter(f => f.proven === 'INCONCLUSIVE').length,
+        notReproducible: findings.filter(f => f.proven === 'NOT_REPRODUCIBLE').length,
+        skipped: findings.filter(f => f.proven === 'SKIPPED').length,
+    };
+    const verificationLevelDistribution = {};
+    for (const f of findings) {
+        const vl = f.verificationLevel || 'unspecified';
+        verificationLevelDistribution[vl] = (verificationLevelDistribution[vl] || 0) + 1;
+    }
+    const rootCauseIds = new Set();
+    for (const f of scanResult.agentFindings || []) {
+        if (f.rootCause?.rootCauseId)
+            rootCauseIds.add(f.rootCause.rootCauseId);
+    }
+    const proofGateFailures = {};
+    let provenStrictCount = 0;
+    let provenRejectedByGate = 0;
+    let syntheticProofCount = 0;
+    let realImportProofCount = 0;
+    let flakyProofCount = 0;
+    for (const f of scanResult.agentFindings || []) {
+        if (f.proven === 'PROVEN' && f.proofGateResult?.eligibleForProven)
+            provenStrictCount++;
+        if (f.proofGateResult && !f.proofGateResult.eligibleForProven && f.proven !== 'PROVEN')
+            provenRejectedByGate++;
+        if (f.proofEvidence?.sourceMode === 'synthetic')
+            syntheticProofCount++;
+        if (f.proofEvidence?.sourceMode === 'real-import')
+            realImportProofCount++;
+        if (f.proofGateResult?.failedGates.includes('flaky-proof'))
+            flakyProofCount++;
+        if (f.proofGateResult) {
+            for (const gate of f.proofGateResult.failedGates) {
+                proofGateFailures[gate] = (proofGateFailures[gate] || 0) + 1;
+            }
+        }
+    }
+    const precisionMetrics = {
+        investigationNotesCount: scanResult.investigationNotes?.length ?? 0,
+        coverageGapsCount: scanResult.coverageGaps?.length ?? 0,
+        verificationLevelDistribution,
+        rootCauseCount: rootCauseIds.size,
+        hasArchitectureContext: scanResult.hasArchitectureContext ?? false,
+        stepsGranted: scanResult.stepsGranted,
+        extensionsGranted: scanResult.extensionsGranted,
+        terminationReason: scanResult.terminationReason,
+        provenStrictCount,
+        provenRejectedByGate,
+        proofGateFailures,
+        syntheticProofCount,
+        realImportProofCount,
+        flakyProofCount,
+    };
+    const sample = {
+        timestamp: new Date(timestamp).toISOString(),
+        filePath: scanResult.filePath,
+        fileHash: scanResult.fileHash,
+        language: scanResult.language,
+        scanStatus: scanResult.scanStatus,
+        stepsUsed: scanResult.stepsUsed,
+        costSpentUsd: scanResult.costSpentUsd,
+        findings,
+        findingCounts,
+        precisionMetrics,
+        verifyUsage: scanResult.verifyUsage,
+        actionHistogram: buildActionHistogram(scanResult.transcript || []),
+        cached: scanResult.cached,
+        scope: scanResult.scope ? {
+            changedFiles: scanResult.scope.changedFiles?.length || 0,
+            blastRadius: scanResult.scope.blastRadius?.length || 0,
+            baseRef: scanResult.scope.baseRef,
+        } : undefined,
+    };
+    try {
+        const auditPath = getAuditPath(workspaceRoot);
+        const line = JSON.stringify(sample) + '\n';
+        fs.appendFileSync(auditPath, line, { encoding: 'utf8', mode: 0o600 });
+        pruneOldEntries(workspaceRoot);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function pruneOldEntries(workspaceRoot) {
+    try {
+        const auditPath = getAuditPath(workspaceRoot);
+        if (!fs.existsSync(auditPath))
+            return;
+        const content = fs.readFileSync(auditPath, 'utf8');
+        const lines = content.trim().split('\n').filter(Boolean);
+        if (lines.length <= MAX_ENTRIES)
+            return;
+        const cutoff = Date.now() - RETENTION_MS;
+        const kept = [];
+        for (const line of lines) {
+            try {
+                const entry = JSON.parse(line);
+                const ts = new Date(entry.timestamp).getTime();
+                if (ts >= cutoff)
+                    kept.push(line);
+            }
+            catch {
+                // keep unparseable lines (don't lose data on corruption)
+                kept.push(line);
+            }
+        }
+        if (kept.length > MAX_ENTRIES) {
+            kept.splice(0, kept.length - MAX_ENTRIES);
+        }
+        fs.writeFileSync(auditPath, kept.join('\n') + '\n', { encoding: 'utf8', mode: 0o600 });
+    }
+    catch {
+        // best-effort
+    }
+}
+function readScanAuditLog(workspaceRoot, limit = 100) {
+    try {
+        const auditPath = getAuditPath(workspaceRoot);
+        if (!fs.existsSync(auditPath))
+            return [];
+        const content = fs.readFileSync(auditPath, 'utf8');
+        const lines = content.trim().split('\n').filter(Boolean);
+        const samples = [];
+        for (const line of lines.slice(-limit)) {
+            try {
+                samples.push(JSON.parse(line));
+            }
+            catch {
+                // skip corrupt
+            }
+        }
+        return samples;
+    }
+    catch {
+        return [];
+    }
+}
+function summarizeScanAuditLog(workspaceRoot) {
+    const samples = readScanAuditLog(workspaceRoot, MAX_ENTRIES);
+    const summary = {
+        totalScans: samples.length,
+        cachedScans: samples.filter(s => s.cached).length,
+        freshScans: samples.filter(s => !s.cached).length,
+        totalFindings: 0,
+        byProven: {},
+        bySeverity: {},
+        byType: {},
+        provenRate: 0,
+        inconclusiveRate: 0,
+        meanSteps: 0,
+        meanCostUsd: 0,
+        meanFindingsPerScan: 0,
+        actionTypeUsage: {},
+        oldestEntry: null,
+        newestEntry: null,
+    };
+    if (samples.length === 0)
+        return summary;
+    let totalSteps = 0;
+    let totalCost = 0;
+    let totalFindings = 0;
+    let totalProven = 0;
+    let totalInconclusive = 0;
+    for (const s of samples) {
+        totalSteps += s.stepsUsed;
+        totalCost += s.costSpentUsd;
+        totalFindings += s.findingCounts.total;
+        totalProven += s.findingCounts.proven;
+        totalInconclusive += s.findingCounts.inconclusive;
+        for (const f of s.findings) {
+            summary.byProven[f.proven] = (summary.byProven[f.proven] || 0) + 1;
+            summary.bySeverity[f.severity] = (summary.bySeverity[f.severity] || 0) + 1;
+            summary.byType[f.type] = (summary.byType[f.type] || 0) + 1;
+        }
+        for (const [action, count] of Object.entries(s.actionHistogram)) {
+            summary.actionTypeUsage[action] = (summary.actionTypeUsage[action] || 0) + count;
+        }
+        if (!summary.oldestEntry || s.timestamp < summary.oldestEntry) {
+            summary.oldestEntry = s.timestamp;
+        }
+        if (!summary.newestEntry || s.timestamp > summary.newestEntry) {
+            summary.newestEntry = s.timestamp;
+        }
+    }
+    summary.totalFindings = totalFindings;
+    summary.meanSteps = totalSteps / samples.length;
+    summary.meanCostUsd = totalCost / samples.length;
+    summary.meanFindingsPerScan = totalFindings / samples.length;
+    summary.provenRate = totalFindings > 0 ? totalProven / totalFindings : 0;
+    summary.inconclusiveRate = totalFindings > 0 ? totalInconclusive / totalFindings : 0;
+    return summary;
+}
+function clearScanAuditLog(workspaceRoot) {
+    try {
+        const auditPath = getAuditPath(workspaceRoot);
+        if (fs.existsSync(auditPath))
+            fs.unlinkSync(auditPath);
+    }
+    catch {
+        // best-effort
+    }
+}
+function formatAuditSummary(summary) {
+    if (summary.totalScans === 0) {
+        return 'No scan audit data available.';
+    }
+    const lines = [
+        `Scan Audit Summary (${summary.totalScans} scans, ${summary.cachedScans} cached, ${summary.freshScans} fresh):`,
+        '',
+        `Findings: ${summary.totalFindings} total (${summary.meanFindingsPerScan.toFixed(1)}/scan)`,
+        `  Proven: ${summary.byProven.PROVEN || 0} (${(summary.provenRate * 100).toFixed(1)}%)`,
+        `  Inconclusive: ${summary.byProven.INCONCLUSIVE || 0} (${(summary.inconclusiveRate * 100).toFixed(1)}%)`,
+        `  Unproven: ${summary.byProven.UNPROVEN || 0}`,
+        `  Not Reproducible: ${summary.byProven.NOT_REPRODUCIBLE || 0}`,
+        `  Skipped: ${summary.byProven.SKIPPED || 0}`,
+        '',
+        `Cost: $${summary.meanCostUsd.toFixed(4)}/scan (avg), $${(summary.meanCostUsd * summary.totalScans).toFixed(4)} total`,
+        `Steps: ${summary.meanSteps.toFixed(1)}/scan (avg)`,
+        '',
+        'By severity:',
+    ];
+    for (const [sev, count] of Object.entries(summary.bySeverity).sort((a, b) => b[1] - a[1])) {
+        lines.push(`  ${sev}: ${count}`);
+    }
+    lines.push('', 'By type:');
+    for (const [type, count] of Object.entries(summary.byType).sort((a, b) => b[1] - a[1])) {
+        lines.push(`  ${type}: ${count}`);
+    }
+    lines.push('', 'Tool usage:');
+    for (const [action, count] of Object.entries(summary.actionTypeUsage).sort((a, b) => b[1] - a[1])) {
+        lines.push(`  ${action}: ${count}`);
+    }
+    if (summary.oldestEntry && summary.newestEntry) {
+        lines.push('', `Range: ${summary.oldestEntry} → ${summary.newestEntry}`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Validate the PROVEN invariant: every PROVEN finding must have:
+ *   - proofEvidence
+ *   - proofGateResult.eligibleForProven === true
+ *   - sourceMode = real-import or real-server
+ *   - repeatedRuns >= 3
+ *   - repeatPasses === repeatedRuns
+ *   - mutation discrimination passed
+ *
+ * Returns an array of violations per finding. An empty array means all
+ * PROVEN findings satisfy the invariant.
+ */
+function validateProvenInvariant(findings) {
+    const checks = [];
+    findings.forEach((finding, i) => {
+        if (finding.proven !== 'PROVEN' && finding.verdict !== 'PROVEN')
+            return;
+        const violations = [];
+        if (!finding.proofEvidence) {
+            violations.push('missing proofEvidence');
+        }
+        if (!finding.proofGateResult || !finding.proofGateResult.eligibleForProven) {
+            violations.push('proofGateResult.eligibleForProven is not true');
+        }
+        const sourceMode = finding.proofEvidence?.sourceMode;
+        if (sourceMode && sourceMode !== 'real-import' && sourceMode !== 'real-server') {
+            violations.push(`sourceMode is ${sourceMode}, must be real-import or real-server`);
+        }
+        const repeatedRuns = finding.proofEvidence?.repeatedRuns ?? 0;
+        if (repeatedRuns < 3) {
+            violations.push(`repeatedRuns is ${repeatedRuns}, must be >= 3`);
+        }
+        const repeatPasses = finding.proofEvidence?.repeatPasses ?? 0;
+        if (repeatPasses !== repeatedRuns) {
+            violations.push(`repeatPasses (${repeatPasses}) !== repeatedRuns (${repeatedRuns}) — proof is flaky`);
+        }
+        if (finding.proofEvidence?.assumptions?.some((a) => a.includes('mutation-test'))) {
+            violations.push('mutation discrimination not passed');
+        }
+        if (violations.length > 0) {
+            checks.push({ findingIndex: i, violations });
+        }
+    });
+    return checks;
+}
+//# sourceMappingURL=scanAuditLog.js.map

package/dist/audit/scanAuditLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanAuditLog.js","sourceRoot":"","sources":["../../src/audit/scanAuditLog.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsGH,sDAiIC;AAmDD,4CAkBC;AAED,sDA6DC;AAED,8CAOC;AAED,gDAwCC;AAoCD,0DAyCC;AAzeD,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAiC;AAEjC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAiEzD,SAAS,cAAc,CAAC,aAAqB;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,aAAqB;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,SAAiB,EAAE,YAAoB;IAC3E,IAAI,YAAY,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,YAAY,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC;IAC9D,OAAO,KAAK,GAAG,YAAY,CAAC;AAChC,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAiB;IAC3C,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAgB,qBAAqB,CACjC,aAAqB,EACrB,UAkBC,EACD,OAEC;IAED,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,GAAG,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAgC,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;QAC5F,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;QACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;QACjC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QACjB,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;QAC7B,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;KACzC,CAAC,CAAC,CAAC;IAEJ,MAAM,aAAa,GAAG;QAClB,KAAK,EAAE,QAAQ,CAAC,MAAM;QACtB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM;QAC1D,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;QAC9D,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM;QACtE,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,MAAM;QAC7E,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;KAC/D,CAAC;IAEF,MAAM,6BAA6B,GAA2B,EAAE,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,CAAC,CAAC,iBAAiB,IAAI,aAAa,CAAC;QAChD,6BAA6B,CAAC,EAAE,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,iBAAiB,GAA2B,EAAE,CAAC;IACrD,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,eAAe,EAAE,iBAAiB;YAAE,iBAAiB,EAAE,CAAC;QACvF,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,iBAAiB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,oBAAoB,EAAE,CAAC;QAC/G,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,KAAK,WAAW;YAAE,mBAAmB,EAAE,CAAC;QACvE,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,KAAK,aAAa;YAAE,oBAAoB,EAAE,CAAC;QAC1E,IAAI,CAAC,CAAC,eAAe,EAAE,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,eAAe,EAAE,CAAC;QAC9E,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;gBAC/C,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACjE,CAAC;QACL,CAAC;IACL,CAAC;IAED,MAAM,gBAAgB,GAAG;QACrB,uBAAuB,EAAE,UAAU,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC;QACnE,iBAAiB,EAAE,UAAU,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;QACvD,6BAA6B;QAC7B,cAAc,EAAE,YAAY,CAAC,IAAI;QACjC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB,IAAI,KAAK;QAClE,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,iBAAiB;QACjB,oBAAoB;QACpB,iBAAiB;QACjB,mBAAmB;QACnB,oBAAoB;QACpB,eAAe;KAClB,CAAC;IAEF,MAAM,MAAM,GAAoB;QAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAC5C,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,QAAQ;QACR,aAAa;QACb,gBAAgB;QAChB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,eAAe,EAAE,oBAAoB,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC;QAClE,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YACtB,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;YACxD,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC;YACtD,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;SACpC,CAAC,CAAC,CAAC,SAAS;KAChB,CAAC;IAEF,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QAC3C,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,eAAe,CAAC,aAAa,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,aAAqB;IAC1C,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QACtC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,IAAI,WAAW;YAAE,OAAO;QAExC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QACzC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC/B,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC/C,IAAI,EAAE,IAAI,MAAM;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACL,yDAAyD;gBACzD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;QAC9C,CAAC;QAED,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACL,cAAc;IAClB,CAAC;AACL,CAAC;AAoBD,SAAgB,gBAAgB,CAAC,aAAqB,EAAE,QAAgB,GAAG;IACvE,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACL,eAAe;YACnB,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC;AAED,SAAgB,qBAAqB,CAAC,aAAqB;IACvD,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAqB;QAC9B,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;QACjD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;QACjD,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,EAAE;QACd,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,CAAC;QACb,gBAAgB,EAAE,CAAC;QACnB,SAAS,EAAE,CAAC;QACZ,WAAW,EAAE,CAAC;QACd,mBAAmB,EAAE,CAAC;QACtB,eAAe,EAAE,EAAE;QACnB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;KACpB,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAEzC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACtB,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC;QAC1B,SAAS,IAAI,CAAC,CAAC,YAAY,CAAC;QAC5B,aAAa,IAAI,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;QACvC,WAAW,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC;QACtC,iBAAiB,IAAI,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC;QAElD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACnE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3E,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9D,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QACrF,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAC5D,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,SAAS,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAC5D,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,SAAS,CAAC;QACtC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,aAAa,GAAG,aAAa,CAAC;IACtC,OAAO,CAAC,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAChD,OAAO,CAAC,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IACjD,OAAO,CAAC,mBAAmB,GAAG,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7D,OAAO,CAAC,UAAU,GAAG,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,gBAAgB,GAAG,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAErF,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,SAAgB,iBAAiB,CAAC,aAAqB;IACnD,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACL,cAAc;IAClB,CAAC;AACL,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAyB;IACxD,IAAI,OAAO,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,+BAA+B,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAa;QACpB,uBAAuB,OAAO,CAAC,UAAU,WAAW,OAAO,CAAC,WAAW,YAAY,OAAO,CAAC,UAAU,UAAU;QAC/G,EAAE;QACF,aAAa,OAAO,CAAC,aAAa,WAAW,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;QAC3F,aAAa,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QACvF,mBAAmB,OAAO,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QACzG,eAAe,OAAO,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,EAAE;QAC/C,uBAAuB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,EAAE;QAC/D,cAAc,OAAO,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE;QAC7C,EAAE;QACF,UAAU,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;QACtH,UAAU,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;QACnD,EAAE;QACF,cAAc;KACjB,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,OAAO,CAAC,WAAW,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAwBD;;;;;;;;;;;GAWG;AACH,SAAgB,uBAAuB,CAAC,QAAe;IACnD,MAAM,MAAM,GAA0B,EAAE,CAAC;IAEzC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO;QAExE,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACzB,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC;YACzE,UAAU,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC;QACrD,IAAI,UAAU,IAAI,UAAU,KAAK,aAAa,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YAC7E,UAAU,CAAC,IAAI,CAAC,iBAAiB,UAAU,sCAAsC,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,YAAY,IAAI,CAAC,CAAC;QAC9D,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,CAAC,mBAAmB,YAAY,gBAAgB,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,YAAY,IAAI,CAAC,CAAC;QAC9D,IAAI,YAAY,KAAK,YAAY,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CAAC,iBAAiB,YAAY,uBAAuB,YAAY,oBAAoB,CAAC,CAAC;QAC1G,CAAC;QAED,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACvF,UAAU,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QACjD,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/dependency/dependencyChecker.js

@@ -4,6 +4,7 @@ exports.scanDependencies = scanDependencies;
 const resolver_1 = require("./resolver");
 const osvClient_1 = require("./osvClient");
 const minSafeVersion_1 = require("./minSafeVersion");
+const exploitPriority_1 = require("./exploitPriority");
 const licensePolicy_1 = require("./licensePolicy");
 /**
  * Run the full dependency vulnerability check.
@@ -72,22 +73,34 @@ async function scanDependencies(opts) {
             }
         }
     }
-    // 6. Merge OSV + GHSA per package key, dedupe by vuln id.
+    // 6. Merge OSV + GHSA per package key, dedupe by vuln id, track provenance.
     const matches = new Map();
     const allKeys = new Set([...osvMap.keys(), ...ghsaMap.keys()]);
     for (const key of allKeys) {
         const osvList = osvMap.get(key) || [];
         const ghsaList = ghsaMap.get(key) || [];
         const merged = [];
-        const seenIds = new Set();
+        const seenIds = new Map();
         for (const v of [...osvList, ...ghsaList]) {
-            if (seenIds.has(v.id))
+            const existing = seenIds.get(v.id);
+            if (existing) {
+                existing.add(v.source);
                 continue;
-            seenIds.add(v.id);
-            merged.push(v);
+            }
+            const sources = new Set([v.source]);
+            seenIds.set(v.id, sources);
+            merged.push({ ...v, sources: [v.source] });
+        }
+        for (const v of merged) {
+            const srcs = seenIds.get(v.id);
+            if (srcs)
+                v.sources = Array.from(srcs);
         }
-        // NVD enrichment (cached).
         await (0, osvClient_1.enrichWithNvd)(merged, opts.state);
+        for (const v of merged) {
+            if (!v.sources || v.sources.length === 0)
+                v.sources = [v.source];
+        }
         matches.set(key, merged);
     }
     // 7. Compute min-safe-version and build vulnerability findings.
@@ -106,12 +119,17 @@ async function scanDependencies(opts) {
         const sortedVulns = vulns.slice().sort((a, b) => (b.cvssScore ?? 0) - (a.cvssScore ?? 0));
         const worst = sortedVulns[0];
         const minSafe = (0, minSafeVersion_1.computeMinSafeVersion)(pkg, sortedVulns);
-        const severity = (worst.cvssScore ?? 0) >= 7 ? 'ERROR' : 'WARNING';
+        const priority = (0, exploitPriority_1.computeExploitPriority)(sortedVulns, pkg);
+        const sevLabel = (0, exploitPriority_1.priorityLabel)(priority.score);
+        const severity = priority.score >= 50 ? 'ERROR' : 'WARNING';
         const vulnCount = sortedVulns.length;
         const cveList = sortedVulns.map(v => v.id).slice(0, 5).join(', ');
+        const sourceTag = priority.sourceCount >= 2 ? ` [confirmed by ${priority.sourceCount} sources]` : '';
+        const exploitTag = priority.knownExploited ? ' [KEV — known exploited]' : priority.exploitAvailable ? ' [exploit available]' : '';
+        const priorityTag = ` [priority: ${sevLabel}]`;
         const message = minSafe
-            ? `${(0, minSafeVersion_1.upgradeSuggestion)(pkg, minSafe)} — ${vulnCount} vulnerable ${vulnCount === 1 ? 'advisory' : 'advisories'}: ${cveList}`
-            : `${pkg.name}@${pkg.version} has ${vulnCount} vulnerable ${vulnCount === 1 ? 'advisory' : 'advisories'} with NO known fix: ${cveList}`;
+            ? `${(0, minSafeVersion_1.upgradeSuggestion)(pkg, minSafe)} — ${vulnCount} vulnerable ${vulnCount === 1 ? 'advisory' : 'advisories'}: ${cveList}${sourceTag}${exploitTag}${priorityTag}`
+            : `${pkg.name}@${pkg.version} has ${vulnCount} vulnerable ${vulnCount === 1 ? 'advisory' : 'advisories'} with NO known fix: ${cveList}${sourceTag}${exploitTag}${priorityTag}`;
         findings.push({
             check_id: `dep.${worst.id}`,
             severity,
@@ -127,6 +145,14 @@ async function scanDependencies(opts) {
                 license: pkg.license,
                 manifestPath: pkg.manifestPath,
                 unresolved: pkg.unresolved,
+                sourceCount: priority.sourceCount,
+                confirmedBy: priority.confirmedBy,
+                exploitPriority: priority.score,
+                knownExploited: priority.knownExploited,
+                exploitAvailable: priority.exploitAvailable,
+                epssPercentile: priority.epssPercentile,
+                isDirect: priority.isDirect,
+                advisoryCount: vulnCount,
             },
         });
     }

package/dist/dependency/dependencyChecker.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependencyChecker.js","sourceRoot":"","sources":["../../src/dependency/dependencyChecker.ts"],"names":[],"mappings":";;AAyDA,4CAoKC;AA3ND,yCAA0F;AAC1F,2CAA4F;AAC5F,qDAA4E;AAC5E,mDAIyB;AA8BzB;;;;;;;;;;;;;;;;;GAiBG;AACI,KAAK,UAAU,gBAAgB,CAAC,IAA2B;IAC9D,MAAM,MAAM,GAAsB,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;IAEvC,0EAA0E;IAC1E,kCAAkC;IAClC,MAAM,iBAAiB,GAAG,CAAC,CAAY,EAAkB,EAAE,CACvD,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAEnD,qBAAqB;IACrB,MAAM,KAAK,GAAuB,IAAA,wBAAa,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG;QAClB,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG;KAC5E,CAAC;IAEF,YAAY;IACZ,MAAM,MAAM,GAAG,aAAa;SACvB,GAAG,CAAC,wBAAa,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAE3D,uBAAuB;IACvB,MAAM,QAAQ,GAAG,IAAA,qBAAU,EAAC,MAAM,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAEtD,gBAAgB;IAChB,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAC;IAE9C,iDAAiD;IACjD,kEAAkE;IAClE,kEAAkE;IAClE,+DAA+D;IAC/D,qCAAqC;IACrC,IAAI,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,EAAE,CAAC;QACV,uDAAuD;QACvD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,MAAM,IAAA,0BAAc,GAAE,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACD,OAAO,GAAG,MAAM,IAAA,2BAAe,EAAC,UAAU,CAAC,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACL,oEAAoE;gBACxE,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,WAAW,GAAG,IAAI,CAAC;YACvB,CAAC;QACL,CAAC;IACL,CAAC;IAED,0DAA0D;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,SAAS;YAChC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,2BAA2B;QAC3B,MAAM,IAAA,yBAAa,EAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,gEAAgE;IAChE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,0BAA0B;IAE1B,qEAAqE;IACrE,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE3C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAA,sCAAqB,EAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAwB,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO;YACnB,CAAC,CAAC,GAAG,IAAA,kCAAiB,EAAC,GAAG,EAAE,OAAO,CAAC,MAAM,SAAS,eAAe,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,KAAK,OAAO,EAAE;YAC3H,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,QAAQ,SAAS,eAAe,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,uBAAuB,OAAO,EAAE,CAAC;QAE5I,QAAQ,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO,KAAK,CAAC,EAAE,EAAE;YAC3B,QAAQ;YACR,OAAO;YACP,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YACxB,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE;gBACR,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,gBAAgB,EAAE,GAAG,CAAC,OAAO;gBAC7B,YAAY,EAAE,OAAO;gBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;aAC7B;SACJ,CAAC,CAAC;IACP,CAAC;IAED,sEAAsE;IACtE,2DAA2D;IAC3D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,kBAAkB,GAAG,CAAC,IAAI,EAAE;YACtC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,kBAAkB,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,YAAY,IAAI,cAAc,6DAA6D;YACnJ,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YACxB,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE;gBACR,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,gBAAgB,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;gBACnC,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,IAAI;aACnB;SACJ,CAAC,CAAC;IACP,CAAC;IAED,qBAAqB;IACrB,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,cAAkC,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACtB,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,EAAE,CAAC,cAAc,CAAC;YACnC,MAAM;QACV,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,IAAA,6BAAa,EAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACxE,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACH,QAAQ;QACR,OAAO;QACP,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,eAAe,EAAE,UAAU,CAAC,MAAM;QAClC,SAAS,EAAE,aAAa;QACxB,QAAQ;QACR,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACN,CAAC;AAED,SAAS,2BAA2B,CAAC,EAAkB;IACnD,OAAO;QACH,QAAQ,EAAE,eAAe,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;QAC1C,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACvD,OAAO,EAAE,EAAE,CAAC,MAAM;QAClB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;QACxB,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE;YACR,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS;YAC/B,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI;YACrB,gBAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO;YACpC,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY;YACrC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU;SACpC;KACJ,CAAC;AACN,CAAC"}
+{"version":3,"file":"dependencyChecker.js","sourceRoot":"","sources":["../../src/dependency/dependencyChecker.ts"],"names":[],"mappings":";;AA0DA,4CA6LC;AArPD,yCAA0F;AAC1F,2CAA4F;AAC5F,qDAA4E;AAC5E,uDAA0E;AAC1E,mDAIyB;AA8BzB;;;;;;;;;;;;;;;;;GAiBG;AACI,KAAK,UAAU,gBAAgB,CAAC,IAA2B;IAC9D,MAAM,MAAM,GAAsB,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;IAEvC,0EAA0E;IAC1E,kCAAkC;IAClC,MAAM,iBAAiB,GAAG,CAAC,CAAY,EAAkB,EAAE,CACvD,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAEnD,qBAAqB;IACrB,MAAM,KAAK,GAAuB,IAAA,wBAAa,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG;QAClB,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG;KAC5E,CAAC;IAEF,YAAY;IACZ,MAAM,MAAM,GAAG,aAAa;SACvB,GAAG,CAAC,wBAAa,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAE3D,uBAAuB;IACvB,MAAM,QAAQ,GAAG,IAAA,qBAAU,EAAC,MAAM,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAEtD,gBAAgB;IAChB,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAC;IAE9C,iDAAiD;IACjD,kEAAkE;IAClE,kEAAkE;IAClE,+DAA+D;IAC/D,qCAAqC;IACrC,IAAI,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,EAAE,CAAC;QACV,uDAAuD;QACvD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,MAAM,IAAA,0BAAc,GAAE,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACD,OAAO,GAAG,MAAM,IAAA,2BAAe,EAAC,UAAU,CAAC,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACL,oEAAoE;gBACxE,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,WAAW,GAAG,IAAI,CAAC;YACvB,CAAC;QACL,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,QAAQ,EAAE,CAAC;gBACX,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACvB,SAAS;YACb,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,IAAI;gBAAE,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAQ,CAAC;QAClD,CAAC;QACD,MAAM,IAAA,yBAAa,EAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,gEAAgE;IAChE,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,0BAA0B;IAE1B,qEAAqE;IACrE,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE3C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAA,sCAAqB,EAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,IAAA,wCAAsB,EAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAA,+BAAa,EAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAwB,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjF,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,QAAQ,CAAC,WAAW,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,UAAU,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QAClI,MAAM,WAAW,GAAG,eAAe,QAAQ,GAAG,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO;YACnB,CAAC,CAAC,GAAG,IAAA,kCAAiB,EAAC,GAAG,EAAE,OAAO,CAAC,MAAM,SAAS,eAAe,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,KAAK,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,EAAE;YAClK,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,QAAQ,SAAS,eAAe,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,uBAAuB,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,EAAE,CAAC;QAEnL,QAAQ,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,OAAO,KAAK,CAAC,EAAE,EAAE;YAC3B,QAAQ;YACR,OAAO;YACP,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YACxB,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE;gBACR,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,gBAAgB,EAAE,GAAG,CAAC,OAAO;gBAC7B,YAAY,EAAE,OAAO;gBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,eAAe,EAAE,QAAQ,CAAC,KAAK;gBAC/B,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;gBAC3C,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,aAAa,EAAE,SAAS;aAC3B;SACJ,CAAC,CAAC;IACP,CAAC;IAED,sEAAsE;IACtE,2DAA2D;IAC3D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,kBAAkB,GAAG,CAAC,IAAI,EAAE;YACtC,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,kBAAkB,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,YAAY,IAAI,cAAc,6DAA6D;YACnJ,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;YACxB,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE;gBACR,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,gBAAgB,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;gBACnC,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,UAAU,EAAE,IAAI;aACnB;SACJ,CAAC,CAAC;IACP,CAAC;IAED,qBAAqB;IACrB,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,cAAkC,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACtB,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,EAAE,CAAC,cAAc,CAAC;YACnC,MAAM;QACV,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,IAAA,6BAAa,EAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IACxE,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACH,QAAQ;QACR,OAAO;QACP,YAAY,EAAE,SAAS,CAAC,MAAM;QAC9B,eAAe,EAAE,UAAU,CAAC,MAAM;QAClC,SAAS,EAAE,aAAa;QACxB,QAAQ;QACR,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACN,CAAC;AAED,SAAS,2BAA2B,CAAC,EAAkB;IACnD,OAAO;QACH,QAAQ,EAAE,eAAe,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;QAC1C,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACvD,OAAO,EAAE,EAAE,CAAC,MAAM;QAClB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE;QACxB,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE;YACR,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS;YAC/B,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI;YACrB,gBAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO;YACpC,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,YAAY,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY;YACrC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU;SACpC;KACJ,CAAC;AACN,CAAC"}

package/dist/dependency/exploitPriority.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Exploit-priority scoring for dependency vulnerabilities.
+ *
+ * Computes a 0-100 priority score that helps users fix the most dangerous
+ * issues first. The score combines:
+ *
+ *   - CVSS base score (0-10 → 0-40 points)
+ *   - EPSS percentile (0-100 → 0-25 points) — exploit probability
+ *   - CISA KEV catalog (known exploited → +20 points)
+ *   - Public exploit/PoC available (+10 points)
+ *   - Direct dependency (+5 points) — you can fix it directly
+ *
+ * The score is capped at 100. The intent is NOT to be a perfect risk model
+ * — it's a triage signal that says "fix this before that".
+ *
+ * Confidence levels:
+ *   - 3/3 sources (OSV + GHSA + NVD) → "high confidence"
+ *   - 2/3 → "medium confidence"
+ *   - 1/3 → "low confidence"
+ */
+import type { Vulnerability, ResolvedPackage } from './types';
+export interface ExploitPriorityResult {
+    score: number;
+    knownExploited: boolean;
+    exploitAvailable: boolean;
+    epssPercentile: number;
+    isDirect: boolean;
+    sourceCount: number;
+    confirmedBy: string;
+    confidence: 'high' | 'medium' | 'low';
+}
+export declare function computeExploitPriority(vulns: Vulnerability[], pkg: ResolvedPackage): ExploitPriorityResult;
+export declare function priorityLabel(score: number): 'critical' | 'high' | 'medium' | 'low';

package/dist/dependency/exploitPriority.js

@@ -0,0 +1,78 @@
+"use strict";
+/**
+ * Exploit-priority scoring for dependency vulnerabilities.
+ *
+ * Computes a 0-100 priority score that helps users fix the most dangerous
+ * issues first. The score combines:
+ *
+ *   - CVSS base score (0-10 → 0-40 points)
+ *   - EPSS percentile (0-100 → 0-25 points) — exploit probability
+ *   - CISA KEV catalog (known exploited → +20 points)
+ *   - Public exploit/PoC available (+10 points)
+ *   - Direct dependency (+5 points) — you can fix it directly
+ *
+ * The score is capped at 100. The intent is NOT to be a perfect risk model
+ * — it's a triage signal that says "fix this before that".
+ *
+ * Confidence levels:
+ *   - 3/3 sources (OSV + GHSA + NVD) → "high confidence"
+ *   - 2/3 → "medium confidence"
+ *   - 1/3 → "low confidence"
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeExploitPriority = computeExploitPriority;
+exports.priorityLabel = priorityLabel;
+const ALL_SOURCES = ['osv', 'ghsa', 'nvd'];
+function computeExploitPriority(vulns, pkg) {
+    const worst = vulns.reduce((acc, v) => {
+        const score = v.cvssScore ?? 0;
+        return score > acc.maxScore ? { maxScore: score, v } : acc;
+    }, { maxScore: 0, v: vulns[0] });
+    if (!worst.v) {
+        return {
+            score: 0,
+            knownExploited: false,
+            exploitAvailable: false,
+            epssPercentile: 0,
+            isDirect: false,
+            sourceCount: 0,
+            confirmedBy: '',
+            confidence: 'low',
+        };
+    }
+    const allSources = new Set();
+    for (const v of vulns) {
+        for (const s of v.sources || [v.source]) {
+            allSources.add(s);
+        }
+    }
+    const cvssComponent = Math.min((worst.maxScore / 10) * 40, 40);
+    const epssComponent = Math.min((worst.v.epssPercentile ?? 0) / 100 * 25, 25);
+    const kevComponent = worst.v.knownExploited ? 20 : 0;
+    const exploitComponent = worst.v.exploitAvailable ? 10 : 0;
+    const directComponent = pkg.direct ? 5 : 0;
+    const score = Math.min(Math.round(cvssComponent + epssComponent + kevComponent + exploitComponent + directComponent), 100);
+    const sourceCount = allSources.size;
+    const confirmedBy = ALL_SOURCES.filter(s => allSources.has(s)).join(', ');
+    const confidence = sourceCount >= 3 ? 'high' : sourceCount === 2 ? 'medium' : 'low';
+    return {
+        score,
+        knownExploited: worst.v.knownExploited ?? false,
+        exploitAvailable: worst.v.exploitAvailable ?? false,
+        epssPercentile: worst.v.epssPercentile ?? 0,
+        isDirect: pkg.direct ?? false,
+        sourceCount,
+        confirmedBy,
+        confidence,
+    };
+}
+function priorityLabel(score) {
+    if (score >= 75)
+        return 'critical';
+    if (score >= 50)
+        return 'high';
+    if (score >= 25)
+        return 'medium';
+    return 'low';
+}
+//# sourceMappingURL=exploitPriority.js.map