@weave_protocol/mund 0.2.3 → 0.3.0

package/dist/osv.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Mund - The Guardian Protocol
+ * OSV.dev dependency vulnerability lookups with an offline fallback
+ *
+ * Live path: POST /v1/querybatch for every name@version in a lockfile,
+ * then GET /v1/vulns/{id} once per unique advisory for details.
+ *
+ * Offline path: every successful live lookup is written to an on-disk
+ * cache. When the network is unavailable (or MUND_OFFLINE=1 / --offline),
+ * results come from that cache and are reported with source "cache", so
+ * callers can tell a clean result from an unchecked one. Packages that
+ * were never looked up are reported as unchecked, never as clean.
+ */
+import type { SecurityIssue, Severity } from './types.js';
+export interface LockedPackage {
+    name: string;
+    version: string;
+    /** Lockfile key, e.g. "node_modules/qs", used to locate the finding. */
+    path?: string;
+}
+export interface OsvAdvisory {
+    id: string;
+    summary: string;
+    severity: Severity;
+    aliases: string[];
+    fixed?: string;
+    url: string;
+}
+export type OsvSource = 'live' | 'cache' | 'unavailable';
+export interface OsvLookupResult {
+    source: OsvSource;
+    /** Keyed by "name@version". */
+    advisories: Map<string, OsvAdvisory[]>;
+    /** name@version keys with no live or cached answer. */
+    unchecked: string[];
+    /** Why the live lookup did not run or failed, if it didn't. */
+    error?: string;
+}
+export interface OsvClientOptions {
+    offline?: boolean;
+    cachePath?: string;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+}
+interface OsvVuln {
+    id: string;
+    summary?: string;
+    details?: string;
+    aliases?: string[];
+    severity?: Array<{
+        type: string;
+        score: string;
+    }>;
+    database_specific?: {
+        severity?: string;
+    };
+    affected?: Array<{
+        package?: {
+            name: string;
+            ecosystem: string;
+        };
+        ranges?: Array<{
+            events: Array<{
+                introduced?: string;
+                fixed?: string;
+            }>;
+        }>;
+    }>;
+}
+export declare function defaultCachePath(): string;
+/** Parse an npm package-lock.json (lockfileVersion 1, 2 or 3). */
+export declare function parseNpmLockfile(content: string): LockedPackage[];
+export declare class OsvClient {
+    private readonly offline;
+    private readonly cachePath;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    constructor(options?: OsvClientOptions);
+    lookup(packages: LockedPackage[], ecosystem?: string): Promise<OsvLookupResult>;
+    private lookupLive;
+    private lookupCached;
+    private request;
+    private readCache;
+    private writeCache;
+}
+/**
+ * OSV `severity[].score` is usually a CVSS *vector* string, not a number,
+ * so prefer the database's own label (GHSA sets it for npm advisories).
+ */
+export declare function parseSeverity(vuln: Pick<OsvVuln, 'severity' | 'database_specific'>): Severity;
+/** Turn lookup results into SecurityIssues located in the lockfile. */
+export declare function advisoriesToIssues(packages: LockedPackage[], result: OsvLookupResult, lockfileContent: string): SecurityIssue[];
+export {};
+//# sourceMappingURL=osv.d.ts.map

package/dist/osv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv.d.ts","sourceRoot":"","sources":["../src/osv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAM1D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,+BAA+B;IAC/B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACvC,uDAAuD;IACvD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAOD,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,iBAAiB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,OAAO,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAC9C,MAAM,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,KAAK,CAAC;gBAAE,UAAU,CAAC,EAAE,MAAM,CAAC;gBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC,CAAC;KAC5E,CAAC,CAAC;CACJ;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAMD,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CA6BjE;AAWD,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,GAAE,gBAAqB;IAOpC,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,SAAS,SAAQ,GAAG,OAAO,CAAC,eAAe,CAAC;YAgBtE,UAAU;YA8BV,YAAY;YAeZ,OAAO;YAUP,SAAS;YAST,UAAU;CAWzB;AAqBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,mBAAmB,CAAC,GAAG,QAAQ,CAiB7F;AAMD,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,EAAE,EACzB,MAAM,EAAE,eAAe,EACvB,eAAe,EAAE,MAAM,GACtB,aAAa,EAAE,CAyBjB"}

package/dist/osv.js

@@ -0,0 +1,239 @@
+/**
+ * Mund - The Guardian Protocol
+ * OSV.dev dependency vulnerability lookups with an offline fallback
+ *
+ * Live path: POST /v1/querybatch for every name@version in a lockfile,
+ * then GET /v1/vulns/{id} once per unique advisory for details.
+ *
+ * Offline path: every successful live lookup is written to an on-disk
+ * cache. When the network is unavailable (or MUND_OFFLINE=1 / --offline),
+ * results come from that cache and are reported with source "cache", so
+ * callers can tell a clean result from an unchecked one. Packages that
+ * were never looked up are reported as unchecked, never as clean.
+ */
+import { readFile, writeFile, mkdir } from 'fs/promises';
+import { homedir } from 'os';
+import { dirname, join } from 'path';
+const OSV_API = 'https://api.osv.dev/v1';
+const BATCH_SIZE = 1000;
+const DETAIL_CONCURRENCY = 8;
+export function defaultCachePath() {
+    if (process.env.MUND_OSV_CACHE)
+        return process.env.MUND_OSV_CACHE;
+    const base = process.env.XDG_CACHE_HOME || join(homedir(), '.cache');
+    return join(base, 'mund', 'osv-cache.json');
+}
+// ============================================================================
+// Lockfile parsing
+// ============================================================================
+/** Parse an npm package-lock.json (lockfileVersion 1, 2 or 3). */
+export function parseNpmLockfile(content) {
+    const lock = JSON.parse(content);
+    const seen = new Map();
+    const add = (pkg) => {
+        const key = `${pkg.name}@${pkg.version}`;
+        if (!seen.has(key))
+            seen.set(key, pkg);
+    };
+    if (lock.packages) {
+        for (const [path, entry] of Object.entries(lock.packages)) {
+            if (!path || entry.link || !entry.version)
+                continue;
+            const idx = path.lastIndexOf('node_modules/');
+            if (idx === -1)
+                continue; // workspace package, not a dependency
+            add({ name: entry.name ?? path.slice(idx + 'node_modules/'.length), version: entry.version, path });
+        }
+    }
+    else if (lock.dependencies) {
+        const walk = (deps) => {
+            for (const [name, dep] of Object.entries(deps)) {
+                if (dep.version && !dep.version.startsWith('file:'))
+                    add({ name, version: dep.version });
+                if (dep.dependencies)
+                    walk(dep.dependencies);
+            }
+        };
+        walk(lock.dependencies);
+    }
+    return [...seen.values()];
+}
+// ============================================================================
+// Client
+// ============================================================================
+export class OsvClient {
+    offline;
+    cachePath;
+    timeoutMs;
+    fetchImpl;
+    constructor(options = {}) {
+        this.offline = options.offline ?? process.env.MUND_OFFLINE === '1';
+        this.cachePath = options.cachePath ?? defaultCachePath();
+        this.timeoutMs = options.timeoutMs ?? 15000;
+        this.fetchImpl = options.fetch ?? fetch;
+    }
+    async lookup(packages, ecosystem = 'npm') {
+        const keys = packages.map(p => `${p.name}@${p.version}`);
+        if (packages.length === 0)
+            return { source: 'live', advisories: new Map(), unchecked: [] };
+        if (!this.offline) {
+            try {
+                const advisories = await this.lookupLive(packages, ecosystem);
+                await this.writeCache(advisories);
+                return { source: 'live', advisories, unchecked: [] };
+            }
+            catch (error) {
+                return this.lookupCached(keys, `OSV.dev unreachable: ${error.message}`);
+            }
+        }
+        return this.lookupCached(keys, 'offline mode');
+    }
+    async lookupLive(packages, ecosystem) {
+        const idsByKey = new Map();
+        for (let i = 0; i < packages.length; i += BATCH_SIZE) {
+            const chunk = packages.slice(i, i + BATCH_SIZE);
+            const body = { queries: chunk.map(p => ({ package: { name: p.name, ecosystem }, version: p.version })) };
+            const data = await this.request(`${OSV_API}/querybatch`, { method: 'POST', body: JSON.stringify(body) });
+            chunk.forEach((p, j) => {
+                idsByKey.set(`${p.name}@${p.version}`, (data.results[j]?.vulns ?? []).map(v => v.id));
+            });
+        }
+        const uniqueIds = [...new Set([...idsByKey.values()].flat())];
+        const details = new Map();
+        for (let i = 0; i < uniqueIds.length; i += DETAIL_CONCURRENCY) {
+            const batch = uniqueIds.slice(i, i + DETAIL_CONCURRENCY);
+            const fetched = await Promise.all(batch.map(id => this.request(`${OSV_API}/vulns/${encodeURIComponent(id)}`)));
+            fetched.forEach(v => details.set(v.id, v));
+        }
+        const advisories = new Map();
+        for (const [key, ids] of idsByKey) {
+            const name = key.slice(0, key.lastIndexOf('@'));
+            advisories.set(key, ids.map(id => toAdvisory(details.get(id) ?? { id }, name)));
+        }
+        return advisories;
+    }
+    async lookupCached(keys, reason) {
+        const cache = await this.readCache();
+        const advisories = new Map();
+        const unchecked = [];
+        for (const key of keys) {
+            const hit = cache?.packages[key];
+            if (hit)
+                advisories.set(key, hit.advisories);
+            else
+                unchecked.push(key);
+        }
+        const source = advisories.size > 0 ? 'cache' : 'unavailable';
+        return { source, advisories, unchecked, error: reason };
+    }
+    async request(url, init = {}) {
+        const res = await this.fetchImpl(url, {
+            ...init,
+            headers: { 'Content-Type': 'application/json' },
+            signal: AbortSignal.timeout(this.timeoutMs),
+        });
+        if (!res.ok)
+            throw new Error(`${res.status} ${res.statusText} from ${url}`);
+        return (await res.json());
+    }
+    async readCache() {
+        try {
+            const cache = JSON.parse(await readFile(this.cachePath, 'utf8'));
+            return cache.version === 1 && cache.packages ? cache : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async writeCache(advisories) {
+        const cache = (await this.readCache()) ?? { version: 1, packages: {} };
+        const checkedAt = new Date().toISOString();
+        for (const [key, list] of advisories)
+            cache.packages[key] = { checkedAt, advisories: list };
+        try {
+            await mkdir(dirname(this.cachePath), { recursive: true });
+            await writeFile(this.cachePath, JSON.stringify(cache));
+        }
+        catch {
+            // A read-only cache dir shouldn't fail the scan; we just lose the fallback.
+        }
+    }
+}
+function toAdvisory(vuln, packageName) {
+    let fixed;
+    for (const affected of vuln.affected ?? []) {
+        if (affected.package && affected.package.name !== packageName)
+            continue;
+        for (const range of affected.ranges ?? []) {
+            for (const event of range.events)
+                if (event.fixed)
+                    fixed = event.fixed;
+        }
+    }
+    return {
+        id: vuln.id,
+        summary: vuln.summary || vuln.details?.split('\n')[0]?.slice(0, 200) || 'No summary available',
+        severity: parseSeverity(vuln),
+        aliases: vuln.aliases ?? [],
+        fixed,
+        url: `https://osv.dev/vulnerability/${encodeURIComponent(vuln.id)}`,
+    };
+}
+/**
+ * OSV `severity[].score` is usually a CVSS *vector* string, not a number,
+ * so prefer the database's own label (GHSA sets it for npm advisories).
+ */
+export function parseSeverity(vuln) {
+    const label = vuln.database_specific?.severity?.toLowerCase();
+    if (label === 'critical')
+        return 'critical';
+    if (label === 'high')
+        return 'high';
+    if (label === 'moderate' || label === 'medium')
+        return 'medium';
+    if (label === 'low')
+        return 'low';
+    for (const s of vuln.severity ?? []) {
+        const score = Number(s.score);
+        if (!Number.isNaN(score)) {
+            if (score >= 9)
+                return 'critical';
+            if (score >= 7)
+                return 'high';
+            if (score >= 4)
+                return 'medium';
+            if (score > 0)
+                return 'low';
+        }
+    }
+    return 'medium';
+}
+// ============================================================================
+// Findings
+// ============================================================================
+/** Turn lookup results into SecurityIssues located in the lockfile. */
+export function advisoriesToIssues(packages, result, lockfileContent) {
+    const issues = [];
+    for (const pkg of packages) {
+        const key = `${pkg.name}@${pkg.version}`;
+        for (const adv of result.advisories.get(key) ?? []) {
+            const needle = pkg.path ? `"${pkg.path}"` : `"${pkg.name}"`;
+            const start = Math.max(0, lockfileContent.indexOf(needle));
+            const before = lockfileContent.slice(0, start).split('\n');
+            issues.push({
+                rule_id: adv.id,
+                rule_name: `${key}: ${adv.summary}`,
+                type: 'dependency',
+                severity: adv.severity,
+                action: 'alert',
+                match: key,
+                location: { start, end: start + needle.length, line: before.length, column: before[before.length - 1].length + 1 },
+                suggestion: adv.fixed
+                    ? `Upgrade ${pkg.name} to ${adv.fixed} or later. ${adv.url}`
+                    : `No fixed version published yet. ${adv.url}`,
+            });
+        }
+    }
+    return issues;
+}
+//# sourceMappingURL=osv.js.map

package/dist/osv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv.js","sourceRoot":"","sources":["../src/osv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGrC,MAAM,OAAO,GAAG,wBAAwB,CAAC;AACzC,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAuD7B,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAC9C,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAG9B,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,MAAM,GAAG,GAAG,CAAC,GAAkB,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,SAAS;YACpD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAC9C,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,SAAS,CAAC,sCAAsC;YAChE,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,IAA2B,EAAE,EAAE;YAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/C,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;oBAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACzF,IAAI,GAAG,CAAC,YAAY;oBAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAOD,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E,MAAM,OAAO,SAAS;IACH,OAAO,CAAU;IACjB,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,SAAS,CAAe;IAEzC,YAAY,UAA4B,EAAE;QACxC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC;QACnE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAyB,EAAE,SAAS,GAAG,KAAK;QACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAE3F,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAC9D,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBAClC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,wBAAyB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,QAAyB,EAAE,SAAiB;QACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QAE7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,GAAG,OAAO,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACxE,CAAC;YACF,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACxF,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,kBAAkB,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAU,GAAG,OAAO,UAAU,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACxH,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;QACpD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAChD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAc,EAAE,MAAc;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;QACpD,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,GAAG;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;;gBACxC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAc,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QACxE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,GAAW,EAAE,OAAoB,EAAE;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACpC,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,SAAS,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAc,CAAC;YAC9E,OAAO,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,UAAsC;QAC7D,MAAM,KAAK,GAAc,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,UAAU;YAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC5F,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC;CACF;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,WAAmB;IACpD,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACxE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM;gBAAE,IAAI,KAAK,CAAC,KAAK;oBAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,sBAAsB;QAC9F,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;QAC3B,KAAK;QACL,GAAG,EAAE,iCAAiC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;KACpE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAqD;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC9D,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC5C,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAChE,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,IAAI,CAAC;gBAAE,OAAO,UAAU,CAAC;YAClC,IAAI,KAAK,IAAI,CAAC;gBAAE,OAAO,MAAM,CAAC;YAC9B,IAAI,KAAK,IAAI,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAChC,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,WAAW;AACX,+EAA+E;AAE/E,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,MAAuB,EACvB,eAAuB;IAEvB,MAAM,MAAM,GAAoB,EAAE,CAAC;IAEnC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC;YAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAE3D,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,GAAG,CAAC,EAAE;gBACf,SAAS,EAAE,GAAG,GAAG,KAAK,GAAG,CAAC,OAAO,EAAE;gBACnC,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,GAAG;gBACV,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;gBAClH,UAAU,EAAE,GAAG,CAAC,KAAK;oBACnB,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,KAAK,cAAc,GAAG,CAAC,GAAG,EAAE;oBAC5D,CAAC,CAAC,mCAAmC,GAAG,CAAC,GAAG,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/sarif.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Mund - The Guardian Protocol
+ * SARIF 2.1.0 output - for GitHub code scanning and other SARIF consumers
+ *
+ * https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html
+ * GitHub-specific: rules carry `security-severity` (0.0-10.0) so code
+ * scanning ranks alerts as critical/high/medium/low.
+ */
+import type { SecurityIssue } from './types.js';
+export interface SarifTarget {
+    /** Path relative to the repository root, using forward slashes. */
+    uri: string;
+    issues: SecurityIssue[];
+}
+export interface SarifOptions {
+    toolVersion: string;
+    informationUri?: string;
+}
+export declare function toSarif(targets: SarifTarget[], options: SarifOptions): object;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,YAAY,CAAC;AAG1D,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAqBD,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,YAAY,GAAG,MAAM,CAyE7E"}

package/dist/sarif.js

@@ -0,0 +1,122 @@
+/**
+ * Mund - The Guardian Protocol
+ * SARIF 2.1.0 output - for GitHub code scanning and other SARIF consumers
+ *
+ * https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html
+ * GitHub-specific: rules carry `security-severity` (0.0-10.0) so code
+ * scanning ranks alerts as critical/high/medium/low.
+ */
+import { createHash } from 'crypto';
+import { computeRiskScore } from './scoring.js';
+const LEVELS = {
+    critical: 'error',
+    high: 'error',
+    medium: 'warning',
+    low: 'note',
+    info: 'note',
+};
+/** GitHub maps >=9.0 critical, >=7.0 high, >=4.0 medium, >0.1 low. */
+const SECURITY_SEVERITY = {
+    critical: '9.5',
+    high: '8.0',
+    medium: '5.5',
+    low: '3.0',
+    info: '0.0',
+};
+export function toSarif(targets, options) {
+    const rules = new Map();
+    const results = [];
+    const allIssues = [];
+    for (const target of targets) {
+        for (const issue of target.issues) {
+            allIssues.push(issue);
+            let rule = rules.get(issue.rule_id);
+            if (!rule) {
+                rule = { issue, index: rules.size };
+                rules.set(issue.rule_id, rule);
+            }
+            else if (severityRank(issue.severity) < severityRank(rule.issue.severity)) {
+                // A rule's descriptor takes the worst severity seen for it.
+                rule.issue = issue;
+            }
+            results.push({
+                ruleId: issue.rule_id,
+                ruleIndex: rule.index,
+                level: LEVELS[issue.severity] ?? 'warning',
+                message: { text: issue.suggestion ? `${issue.rule_name}. ${issue.suggestion}` : issue.rule_name },
+                locations: [{
+                        physicalLocation: {
+                            artifactLocation: { uri: target.uri },
+                            ...(issue.location?.line ? { region: toRegion(issue) } : {}),
+                        },
+                    }],
+                partialFingerprints: {
+                    'mundFinding/v1': fingerprint(target.uri, issue),
+                },
+                properties: {
+                    severity: issue.severity,
+                    type: issue.type,
+                },
+            });
+        }
+    }
+    const risk = computeRiskScore(allIssues);
+    return {
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [{
+                tool: {
+                    driver: {
+                        name: 'Mund',
+                        fullName: 'Mund - The Guardian Protocol',
+                        version: options.toolVersion,
+                        semanticVersion: options.toolVersion,
+                        informationUri: options.informationUri ?? 'https://github.com/Tyox-all/Weave_Protocol/tree/main/mund',
+                        rules: [...rules.values()].map(({ issue }) => ({
+                            id: issue.rule_id,
+                            name: toPascalCase(issue.rule_name),
+                            shortDescription: { text: issue.rule_name },
+                            ...(issue.suggestion ? { help: { text: issue.suggestion } } : {}),
+                            defaultConfiguration: { level: LEVELS[issue.severity] ?? 'warning' },
+                            properties: {
+                                'security-severity': SECURITY_SEVERITY[issue.severity] ?? '5.5',
+                                tags: ['security', issue.type],
+                            },
+                        })),
+                    },
+                },
+                results,
+                properties: {
+                    riskScore: risk.score,
+                    riskLabel: risk.label,
+                },
+            }],
+    };
+}
+function toRegion(issue) {
+    const loc = issue.location;
+    const region = { startLine: loc.line };
+    if (loc.column) {
+        region.startColumn = loc.column;
+        const length = loc.end - loc.start;
+        // Only emit endColumn for single-line matches; multi-line spans would
+        // need the source text to compute endLine.
+        if (length > 0 && !issue.match.includes('\n'))
+            region.endColumn = loc.column + length;
+    }
+    return region;
+}
+function fingerprint(uri, issue) {
+    return createHash('sha256')
+        .update(`${uri}\0${issue.rule_id}\0${issue.location?.line ?? 0}\0${issue.match}`)
+        .digest('hex')
+        .slice(0, 32);
+}
+function severityRank(severity) {
+    return ['critical', 'high', 'medium', 'low', 'info'].indexOf(severity);
+}
+function toPascalCase(text) {
+    return text.replace(/[^A-Za-z0-9]+(.)?/g, (_, c) => (c ? c.toUpperCase() : ''))
+        .replace(/^./, c => c.toUpperCase());
+}
+//# sourceMappingURL=sarif.js.map

package/dist/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAehD,MAAM,MAAM,GAAiC;IAC3C,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;IACjB,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,sEAAsE;AACtE,MAAM,iBAAiB,GAA6B;IAClD,QAAQ,EAAE,KAAK;IACf,IAAI,EAAE,KAAK;IACX,MAAM,EAAE,KAAK;IACb,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,KAAK;CACZ,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,OAAsB,EAAE,OAAqB;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmD,CAAC;IACzE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAoB,EAAE,CAAC;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEtB,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;gBACpC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5E,4DAA4D;gBAC5D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,KAAK,CAAC,OAAO;gBACrB,SAAS,EAAE,IAAI,CAAC,KAAK;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS;gBAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE;gBACjG,SAAS,EAAE,CAAC;wBACV,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;4BACrC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC7D;qBACF,CAAC;gBACF,mBAAmB,EAAE;oBACnB,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC;iBACjD;gBACD,UAAU,EAAE;oBACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAEzC,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC;gBACL,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,MAAM;wBACZ,QAAQ,EAAE,8BAA8B;wBACxC,OAAO,EAAE,OAAO,CAAC,WAAW;wBAC5B,eAAe,EAAE,OAAO,CAAC,WAAW;wBACpC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,2DAA2D;wBACrG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;4BAC7C,EAAE,EAAE,KAAK,CAAC,OAAO;4BACjB,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC;4BACnC,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE;4BAC3C,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACjE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE;4BACpE,UAAU,EAAE;gCACV,mBAAmB,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK;gCAC/D,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC;6BAC/B;yBACF,CAAC,CAAC;qBACJ;iBACF;gBACD,OAAO;gBACP,UAAU,EAAE;oBACV,SAAS,EAAE,IAAI,CAAC,KAAK;oBACrB,SAAS,EAAE,IAAI,CAAC,KAAK;iBACtB;aACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAoB;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAS,CAAC;IAC5B,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,GAAG,CAAC,IAAK,EAAE,CAAC;IAChE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;QACnC,sEAAsE;QACtE,2CAA2C;QAC3C,IAAI,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,KAAoB;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,GAAG,KAAK,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;SAChF,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,QAAkB;IACtC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAChG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACzC,CAAC"}

package/dist/scoring.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Mund - The Guardian Protocol
+ * Risk Scoring - collapse a set of findings into a 0-100 score + label
+ *
+ * Each finding independently "consumes" a fraction of the remaining
+ * headroom, so the score rises quickly with severe findings, has
+ * diminishing returns for many minor ones, and never exceeds 100:
+ *
+ *   score = 100 * (1 - Π (1 - weight_i))
+ *
+ * One critical finding alone lands in the critical band; one high in the
+ * high band; it takes many low findings to escalate past "low".
+ */
+import type { SecurityIssue, Severity } from './types.js';
+export type RiskLabel = 'none' | 'low' | 'medium' | 'high' | 'critical';
+export interface RiskScore {
+    score: number;
+    label: RiskLabel;
+    counts: Record<Severity, number>;
+}
+export declare const SEVERITY_WEIGHTS: Record<Severity, number>;
+/** Lower bound (inclusive) of each label band. */
+export declare const RISK_BANDS: Array<[RiskLabel, number]>;
+export declare function labelForScore(score: number): RiskLabel;
+export declare function computeRiskScore(issues: Array<Pick<SecurityIssue, 'severity'>>): RiskScore;
+//# sourceMappingURL=scoring.d.ts.map

package/dist/scoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../src/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAExE,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAMrD,CAAC;AAEF,kDAAkD;AAClD,eAAO,MAAM,UAAU,EAAE,KAAK,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAKjD,CAAC;AAEF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAKtD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,GAAG,SAAS,CAgB1F"}

package/dist/scoring.js

@@ -0,0 +1,49 @@
+/**
+ * Mund - The Guardian Protocol
+ * Risk Scoring - collapse a set of findings into a 0-100 score + label
+ *
+ * Each finding independently "consumes" a fraction of the remaining
+ * headroom, so the score rises quickly with severe findings, has
+ * diminishing returns for many minor ones, and never exceeds 100:
+ *
+ *   score = 100 * (1 - Π (1 - weight_i))
+ *
+ * One critical finding alone lands in the critical band; one high in the
+ * high band; it takes many low findings to escalate past "low".
+ */
+export const SEVERITY_WEIGHTS = {
+    critical: 0.8,
+    high: 0.4,
+    medium: 0.15,
+    low: 0.05,
+    info: 0,
+};
+/** Lower bound (inclusive) of each label band. */
+export const RISK_BANDS = [
+    ['critical', 80],
+    ['high', 40],
+    ['medium', 15],
+    ['low', 1],
+];
+export function labelForScore(score) {
+    for (const [label, min] of RISK_BANDS) {
+        if (score >= min)
+            return label;
+    }
+    return 'none';
+}
+export function computeRiskScore(issues) {
+    const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    let headroom = 1;
+    for (const issue of issues) {
+        const severity = issue.severity in SEVERITY_WEIGHTS ? issue.severity : 'info';
+        counts[severity]++;
+        headroom *= 1 - SEVERITY_WEIGHTS[severity];
+    }
+    // Any non-info finding scores at least 1 so it never reads as "none".
+    const raw = Math.round(100 * (1 - headroom));
+    const hasFinding = counts.critical + counts.high + counts.medium + counts.low > 0;
+    const score = hasFinding ? Math.max(1, raw) : 0;
+    return { score, label: labelForScore(score), counts };
+}
+//# sourceMappingURL=scoring.js.map

package/dist/scoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../src/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,MAAM,CAAC,MAAM,gBAAgB,GAA6B;IACxD,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,IAAI;IACZ,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAA+B;IACpD,CAAC,UAAU,EAAE,EAAE,CAAC;IAChB,CAAC,MAAM,EAAE,EAAE,CAAC;IACZ,CAAC,QAAQ,EAAE,EAAE,CAAC;IACd,CAAC,KAAK,EAAE,CAAC,CAAC;CACX,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,IAAI,KAAK,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAA8C;IAC7E,MAAM,MAAM,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC9F,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9E,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnB,QAAQ,IAAI,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,sEAAsE;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AACxD,CAAC"}

package/dist/threat-intel-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"threat-intel-manager.d.ts","sourceRoot":"","sources":["../src/threat-intel-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,aAAa,EAEb,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,EACT,MAAM,yBAAyB,CAAC;AAoXjC,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAyC;IACzD,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,gBAAgB,CAAC,CAAO;;IAMhC,OAAO,CAAC,UAAU;IAmBlB,WAAW,CAAC,OAAO,CAAC,EAAE;QACpB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,QAAQ,CAAC,EAAE,aAAa,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,QAAQ,CAAC;KACxB,GAAG,aAAa,EAAE;IAwBnB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIjD,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAgBjF,UAAU,IAAI,WAAW,EAAE;IAI3B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAI9C,SAAS,CAAC,MAAM,EAAE,iBAAiB,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAuB1E,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAyBxD,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,OAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmLlF,gBAAgB,CAAC,KAAK,GAAE,OAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAwBzE,OAAO,CAAC,sBAAsB;IAQ9B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB;IA8FlE,SAAS,IAAI,WAAW;CAqFzB;AAMD,eAAO,MAAM,WAAW,oBAA2B,CAAC"}
+{"version":3,"file":"threat-intel-manager.d.ts","sourceRoot":"","sources":["../src/threat-intel-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,aAAa,EAEb,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,EACT,MAAM,yBAAyB,CAAC;AAqXjC,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAyC;IACzD,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,gBAAgB,CAAC,CAAO;;IAMhC,OAAO,CAAC,UAAU;IAmBlB,WAAW,CAAC,OAAO,CAAC,EAAE;QACpB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,QAAQ,CAAC,EAAE,aAAa,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,QAAQ,CAAC;KACxB,GAAG,aAAa,EAAE;IAwBnB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIjD,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAgBjF,UAAU,IAAI,WAAW,EAAE;IAI3B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAI9C,SAAS,CAAC,MAAM,EAAE,iBAAiB,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAuB1E,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAyBxD,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,OAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmLlF,gBAAgB,CAAC,KAAK,GAAE,OAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAwBzE,OAAO,CAAC,sBAAsB;IAQ9B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,GAAG,gBAAgB;IA8FlE,SAAS,IAAI,WAAW;CAqFzB;AAMD,eAAO,MAAM,WAAW,oBAA2B,CAAC"}

package/dist/threat-intel-manager.js

@@ -2,6 +2,7 @@
  * Threat Intelligence Manager
  * @weave_protocol/mund
  */
+import { compileRulePattern } from './analyzers/regex.js';
 // ============================================================================
 // Built-in Threat Patterns
 // ============================================================================
@@ -664,7 +665,7 @@ export class ThreatIntelManager {
                 continue;
             // Check pattern
             try {
-                const regex = new RegExp(pattern.pattern, 'gi');
+                const regex = compileRulePattern(pattern.pattern, 'gi');
                 let match;
                 while ((match = regex.exec(content)) !== null) {
                     matches.push({