agentic-qe 3.15.6 → 3.15.7

package/dist/shared/security/osv-client.js

@@ -5,168 +5,359 @@
  * OSV provides vulnerability information for npm, PyPI, Go, Maven, and more.
  * API Documentation: https://google.github.io/osv.dev/api/
  */
+import { isIP } from 'node:net';
 import { HttpClient } from '../http/index.js';
-const DEFAULT_CONFIG = {
-    baseUrl: 'https://api.osv.dev',
-    timeout: 30000,
-    enableCache: true,
-    cacheTtl: 60 * 60 * 1000, // 1 hour
-};
+import { OSVLookupError, advisoryAffectsVersion, boundedList, classifyNpmSpec, exactNpmVersion, isAdvisoryRecord, isConcreteVersion, lookupKey, lookupStatus, parseBatchBody, } from './osv-lookup.js';
+export { OSVLookupError } from './osv-lookup.js';
+const DEFAULT_BASE_URL = 'https://api.osv.dev';
+/**
+ * A loopback host: exactly `localhost`, an IPv4 literal in 127.0.0.0/8, or the
+ * IPv6 literal ::1. A DNS name that merely starts with "127." (e.g.
+ * 127.evil.com, 127.0.0.1.nip.io) is not loopback.
+ */
+function isLoopbackHost(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (host === 'localhost')
+        return true;
+    if (isIP(host) === 4)
+        return host.startsWith('127.');
+    return isIP(host) === 6 && (host === '::1' || host === '0:0:0:0:0:0:0:1');
+}
+/**
+ * The OSV endpoint: `AQE_OSV_API_URL` or the public API. https is required,
+ * except plain http on a loopback host (local mirrors and test stubs).
+ * @throws Error naming AQE_OSV_API_URL when the value is not acceptable.
+ */
+export function resolveOSVBaseUrl(env = process.env) {
+    const configured = env.AQE_OSV_API_URL?.trim();
+    if (!configured)
+        return DEFAULT_BASE_URL;
+    if (configured.length > MAX_OSV_URL_LENGTH) {
+        throw new Error(`AQE_OSV_API_URL is longer than ${MAX_OSV_URL_LENGTH} characters (expected https://host)`);
+    }
+    let url;
+    try {
+        url = new URL(configured);
+    }
+    catch {
+        throw new Error(`AQE_OSV_API_URL is not a URL: "${configured.slice(0, 200)}" (expected https://host)`);
+    }
+    const loopback = isLoopbackHost(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) {
+        throw new Error(`AQE_OSV_API_URL must use https (http only for localhost/loopback): "${configured.slice(0, 200)}"`);
+    }
+    // A plain loop, not /\/+$/ (CodeQL js/polynomial-redos).
+    let base = configured;
+    while (base.endsWith('/'))
+        base = base.slice(0, -1);
+    return base;
+}
+/** Longest accepted AQE_OSV_API_URL; a longer value is invalid. */
+export const MAX_OSV_URL_LENGTH = 2048;
 /**
  * OSV API Client
- * Queries the Open Source Vulnerabilities database for dependency vulnerabilities
+ * Queries the Open Source Vulnerabilities database for dependency vulnerabilities.
+ *
+ * #1049: a failed or partial lookup is never reported as "no vulnerabilities".
+ * `lookupBatch` returns the packages it could not check; the list-returning
+ * methods throw `OSVLookupError` instead of returning `[]`.
  */
 export class OSVClient {
     config;
+    configuredBaseUrl;
+    endpoint = null;
     http;
-    cache = new Map();
+    detailCache = new Map();
     constructor(config = {}) {
-        this.config = { ...DEFAULT_CONFIG, ...config };
+        this.configuredBaseUrl = config.baseUrl;
+        this.config = {
+            timeout: config.timeout ?? 30000,
+            retries: config.retries ?? 2,
+            batchSize: Math.max(1, Math.min(1000, config.batchSize ?? 500)),
+            detailConcurrency: Math.max(1, config.detailConcurrency ?? 8),
+            enableCache: config.enableCache ?? true,
+            cacheTtl: config.cacheTtl ?? 60 * 60 * 1000,
+        };
         this.http = new HttpClient();
     }
-    /**
-     * Query OSV for vulnerabilities affecting a package
-     */
-    async queryPackage(packageName, ecosystem, version) {
-        const cacheKey = `${ecosystem}:${packageName}:${version || 'all'}`;
-        // Check cache
-        if (this.config.enableCache) {
-            const cached = this.cache.get(cacheKey);
-            if (cached && Date.now() - cached.timestamp < this.config.cacheTtl) {
-                return this.parseVulnerabilities(cached.data.vulns);
-            }
-        }
-        try {
-            const result = await this.http.post(`${this.config.baseUrl}/v1/query`, {
-                package: {
-                    name: packageName,
-                    ecosystem,
-                    ...(version && { version }),
-                },
-            }, { timeout: this.config.timeout });
-            if (!result.success) {
-                console.error(`OSV query failed for ${ecosystem}:${packageName}:`, result.error);
-                return [];
+    /** The endpoint this client queries, or null when the configured URL is invalid. */
+    get baseUrl() {
+        const endpoint = this.resolveEndpoint();
+        return 'url' in endpoint ? endpoint.url : null;
+    }
+    /** Resolve (once) the endpoint; an invalid value is a reason, never a throw. */
+    resolveEndpoint() {
+        if (!this.endpoint) {
+            try {
+                this.endpoint = { url: this.configuredBaseUrl !== undefined
+                        ? resolveOSVBaseUrl({ AQE_OSV_API_URL: this.configuredBaseUrl })
+                        : resolveOSVBaseUrl() };
             }
-            const response = await result.value.json();
-            // Cache successful response
-            if (this.config.enableCache && response.vulns) {
-                this.cache.set(cacheKey, {
-                    data: response,
-                    timestamp: Date.now(),
-                });
+            catch (error) {
+                this.endpoint = { reason: error instanceof Error ? error.message : String(error) };
             }
-            return this.parseVulnerabilities(response.vulns || []);
-        }
-        catch (error) {
-            // Return empty on error (non-blocking)
-            console.error(`OSV query failed for ${ecosystem}:${packageName}:`, error);
-            return [];
         }
+        return this.endpoint;
+    }
+    get base() {
+        const endpoint = this.resolveEndpoint();
+        if ('reason' in endpoint)
+            throw new OSVLookupError(endpoint.reason);
+        return endpoint.url;
     }
     /**
-     * Batch query multiple packages
+     * Look up advisories for packages, reporting every package that could not be
+     * checked. Only `status: 'complete'` may be read as a clean/measured result.
      */
-    async queryBatch(packages) {
+    async lookupBatch(packages) {
         const results = new Map();
-        if (packages.length === 0) {
-            return results;
+        const unchecked = [];
+        const errors = [];
+        const queryable = [];
+        let checked = 0;
+        const endpoint = this.resolveEndpoint();
+        if ('reason' in endpoint) {
+            return {
+                status: lookupStatus(packages.length, 0), results, packagesRequested: packages.length, packagesChecked: 0,
+                unchecked: packages.map((pkg) => ({ ...pkg, reason: endpoint.reason })), errors: [endpoint.reason],
+            };
         }
-        try {
-            const queries = packages.map((pkg) => ({
-                package: {
-                    name: pkg.name,
-                    ecosystem: pkg.ecosystem,
-                    ...(pkg.version && { version: pkg.version }),
-                },
-            }));
-            const result = await this.http.post(`${this.config.baseUrl}/v1/querybatch`, { queries }, { timeout: this.config.timeout });
-            if (!result.success) {
-                console.error('OSV batch query failed:', result.error);
-                for (const pkg of packages) {
-                    results.set(`${pkg.ecosystem}:${pkg.name}`, []);
-                }
-                return results;
+        for (const pkg of packages) {
+            if (pkg.version && isConcreteVersion(pkg.version)) {
+                queryable.push(pkg);
             }
-            const response = await result.value.json();
-            // Map results back to packages
-            for (let i = 0; i < packages.length; i++) {
-                const pkg = packages[i];
-                const key = `${pkg.ecosystem}:${pkg.name}`;
-                const vulns = response.results[i]?.vulns || [];
-                results.set(key, this.parseVulnerabilities(vulns));
+            else {
+                unchecked.push({ ...pkg, reason: pkg.version
+                        ? `version "${pkg.version}" is a range or tag, not a concrete version (no lockfile resolution)`
+                        : 'no version declared; advisories cannot be matched' });
             }
         }
-        catch (error) {
-            console.error('OSV batch query failed:', error);
-            // Return empty results for all packages
-            for (const pkg of packages) {
-                results.set(`${pkg.ecosystem}:${pkg.name}`, []);
+        const pending = [];
+        for (let start = 0; start < queryable.length; start += this.config.batchSize) {
+            const chunk = queryable.slice(start, start + this.config.batchSize);
+            const outcome = await this.postBatch(chunk);
+            if ('reason' in outcome) {
+                errors.push(`querybatch for ${chunk.length} package(s) failed: ${outcome.reason}`);
+                for (const pkg of chunk)
+                    unchecked.push({ ...pkg, reason: outcome.reason });
+                continue;
+            }
+            outcome.entries.forEach((entry, i) => {
+                if ('reason' in entry)
+                    unchecked.push({ ...chunk[i], reason: entry.reason });
+                else
+                    pending.push({ pkg: chunk[i], ids: entry.ids });
+            });
+        }
+        const details = await this.fetchDetails([...new Set(pending.flatMap((p) => p.ids))]);
+        for (const { pkg, ids } of pending) {
+            const missing = ids.filter((id) => 'reason' in details.get(id));
+            if (missing.length > 0) {
+                const why = details.get(missing[0]).reason;
+                unchecked.push({ ...pkg, reason: `advisory details unavailable for ${boundedList(missing)}: ${why}` });
+                continue;
             }
+            // querybatch can over-match; keep only advisories whose own ranges do not exclude the version.
+            const vulns = ids.map((id) => details.get(id).vuln)
+                .filter((vuln) => advisoryAffectsVersion(vuln, { name: pkg.name, ecosystem: pkg.ecosystem, version: pkg.version }));
+            results.set(lookupKey(pkg), this.parseVulnerabilities(vulns).map((v) => ({ ...v, affectedPackage: pkg.name })));
+            checked++;
         }
-        return results;
+        const detailFailures = [...details.values()].filter((d) => 'reason' in d);
+        if (detailFailures.length > 0) {
+            errors.push(`${detailFailures.length} advisory detail request(s) failed: ${detailFailures[0].reason}`);
+        }
+        return {
+            status: lookupStatus(packages.length, checked),
+            results,
+            packagesRequested: packages.length,
+            packagesChecked: checked,
+            unchecked,
+            errors,
+        };
     }
     /**
-     * Query vulnerabilities by CVE ID
+     * Look up npm `package.json` dependencies (`name -> version spec`).
+     *
+     * A dependency is checked at its lockfile-resolved version when one is given,
+     * else only when the spec is an exact version ("1.2.3", "=1.2.3", "v1.2.3").
+     * Ranges, tags and non-registry specs are reported unchecked, never guessed:
+     * checking a range's bound (e.g. "<4.17.12" as 4.17.12) can miss advisories
+     * that affect the versions the range allows (#1049).
      */
-    async queryByCVE(cveId) {
-        try {
-            const result = await this.http.get(`${this.config.baseUrl}/v1/vulns/${cveId}`, { timeout: this.config.timeout });
-            if (!result.success) {
-                console.error(`OSV CVE query failed for ${cveId}:`, result.error);
-                return [];
+    async lookupNpmDependencies(dependencies, lockedVersions = {}) {
+        const queries = [];
+        const unresolved = [];
+        for (const [name, spec] of Object.entries(dependencies)) {
+            const kind = classifyNpmSpec(spec);
+            if (kind.kind === 'local' || kind.kind === 'remote') {
+                unresolved.push({ name, ecosystem: 'npm', version: spec, reason: kind.kind === 'local'
+                        ? `local package ("${spec}"); not an OSV subject`
+                        : `not a registry dependency ("${spec}": git/URL/tarball source); OSV advisories cannot be matched` });
+                continue;
             }
-            const vuln = await result.value.json();
-            return this.parseVulnerabilities([vuln]);
+            // An `npm:<real>@<range>` alias is the registry package <real>.
+            const packageName = kind.kind === 'alias' ? kind.name : name;
+            const locked = lockedVersions[name] !== undefined ? exactNpmVersion(lockedVersions[name]) : null;
+            const version = locked ?? exactNpmVersion(kind.spec);
+            if (version)
+                queries.push({ name: packageName, ecosystem: 'npm', version });
+            else
+                unresolved.push({ name, ecosystem: 'npm', version: spec, reason: `version range "${spec}", no lockfile resolution` });
         }
-        catch (error) {
-            console.error(`OSV CVE query failed for ${cveId}:`, error);
+        const lookup = await this.lookupBatch(queries);
+        const requested = queries.length + unresolved.length;
+        return {
+            ...lookup,
+            status: lookupStatus(requested, lookup.packagesChecked),
+            packagesRequested: requested,
+            unchecked: [...unresolved, ...lookup.unchecked],
+        };
+    }
+    /**
+     * Query OSV for vulnerabilities affecting a package.
+     * @throws OSVLookupError when the advisory lookup did not complete.
+     */
+    async queryPackage(packageName, ecosystem, version) {
+        const result = await this.http.post(`${this.base}/v1/query`, 
+        // OSV reads `version` at the top level of a query; inside `package` it is ignored (#1049).
+        { package: { name: packageName, ecosystem }, ...(version && { version }) }, this.requestOptions());
+        const body = await this.readJson(result);
+        if ('reason' in body)
+            throw new OSVLookupError(`OSV query for ${ecosystem}:${packageName} failed: ${body.reason}`);
+        const vulns = body.value?.vulns;
+        if (vulns === undefined && body.value && typeof body.value === 'object')
             return [];
+        if (!Array.isArray(vulns) || !vulns.every(isAdvisoryRecord)) {
+            throw new OSVLookupError(`OSV query for ${ecosystem}:${packageName} failed: malformed response`);
         }
+        return this.parseVulnerabilities(vulns);
     }
     /**
-     * Parse npm package.json dependencies for vulnerabilities
+     * Batch query multiple packages.
+     * @throws OSVLookupError when any package could not be checked.
+     */
+    async queryBatch(packages) {
+        const lookup = await this.lookupBatch(packages);
+        if (lookup.status !== 'complete')
+            throw OSVLookupError.fromLookup(lookup);
+        return lookup.results;
+    }
+    /**
+     * Query vulnerabilities by advisory/CVE id. An id OSV does not know (404) is [].
+     * @throws OSVLookupError on any other failure.
+     */
+    async queryByCVE(cveId) {
+        void this.base; // an invalid endpoint throws OSVLookupError
+        const outcome = await this.fetchDetail(cveId);
+        if ('vuln' in outcome)
+            return this.parseVulnerabilities([outcome.vuln]);
+        if (outcome.reason === 'HTTP 404')
+            return [];
+        throw new OSVLookupError(`OSV lookup for ${cveId} failed: ${outcome.reason}`);
+    }
+    /**
+     * Scan npm dependencies for vulnerabilities.
+     * @throws OSVLookupError when any dependency could not be checked; use
+     *   `lookupNpmDependencies` to get partial results with the unchecked list.
      */
     async scanNpmDependencies(dependencies) {
-        const packages = Object.entries(dependencies).map(([name, version]) => ({
-            name,
-            ecosystem: 'npm',
-            version: this.cleanVersion(version),
-        }));
-        const results = await this.queryBatch(packages);
-        const allVulns = [];
-        for (const vulns of results.values()) {
-            allVulns.push(...vulns);
-        }
-        return allVulns;
+        const lookup = await this.lookupNpmDependencies(dependencies);
+        if (lookup.status !== 'complete')
+            throw OSVLookupError.fromLookup(lookup);
+        return [...lookup.results.values()].flat();
     }
     /**
-     * Scan a Python requirements.txt file content
+     * Scan a Python requirements.txt file content. Only `==` pins are concrete
+     * versions; other requirements are reported as unchecked.
+     * @throws OSVLookupError when any requirement could not be checked.
      */
     async scanPythonRequirements(requirements) {
-        const lines = requirements.split('\n').filter((line) => {
-            const trimmed = line.trim();
-            return trimmed && !trimmed.startsWith('#') && !trimmed.startsWith('-');
-        });
-        const packages = lines
-            .map((line) => {
-            // Parse package==version or package>=version etc.
-            const match = line.match(/^([a-zA-Z0-9_-]+)(?:[=<>!~]+([^\s;#]+))?/);
-            if (!match)
-                return null;
-            return {
-                name: match[1],
-                ecosystem: 'PyPI',
-                version: match[2],
-            };
-        })
-            .filter((pkg) => pkg !== null);
-        const results = await this.queryBatch(packages);
-        const allVulns = [];
-        for (const vulns of results.values()) {
-            allVulns.push(...vulns);
+        const packages = requirements.split('\n')
+            .map((line) => line.trim())
+            .filter((line) => line && !line.startsWith('#') && !line.startsWith('-'))
+            .map((line) => line.match(/^([a-zA-Z0-9_.-]+)(?:\s*==\s*([^\s;#,]+))?/))
+            .filter((m) => m !== null)
+            .map((m) => ({ name: m[1], ecosystem: 'PyPI', version: m[2] }));
+        const lookup = await this.lookupBatch(packages);
+        if (lookup.status !== 'complete')
+            throw OSVLookupError.fromLookup(lookup);
+        return [...lookup.results.values()].flat();
+    }
+    /** Clear the advisory-detail cache. */
+    clearCache() {
+        this.detailCache.clear();
+    }
+    // ==========================================================================
+    // Private
+    // ==========================================================================
+    requestOptions() {
+        return { timeout: this.config.timeout, retries: this.config.retries };
+    }
+    /** Read a JSON body; any transport failure, non-2xx status or parse failure is a reason. */
+    async readJson(result) {
+        if (!result.success)
+            return { reason: `${result.error.code}: ${result.error.message}` };
+        const response = result.value;
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
+            return { reason: `HTTP ${response.status}${response.status === 429 ? ' (rate limited)' : ''}` };
+        }
+        let text;
+        try {
+            text = await response.text();
+        }
+        catch (error) {
+            const timedOut = error instanceof Error && (error.name === 'TimeoutError' || error.name === 'AbortError');
+            return { reason: `${timedOut ? 'TIMEOUT' : 'BODY_READ_FAILED'}: response body could not be read` };
         }
-        return allVulns;
+        try {
+            return { value: JSON.parse(text) };
+        }
+        catch {
+            return { reason: 'malformed JSON response' };
+        }
+    }
+    async postBatch(chunk) {
+        const queries = chunk.map((pkg) => ({
+            // OSV reads `version` at the top level of a query; inside `package` it is ignored (#1049).
+            package: { name: pkg.name, ecosystem: pkg.ecosystem },
+            ...(pkg.version ? { version: pkg.version } : {}),
+        }));
+        const result = await this.http.post(`${this.base}/v1/querybatch`, { queries }, this.requestOptions());
+        const body = await this.readJson(result);
+        if ('reason' in body)
+            return body;
+        const entries = parseBatchBody(body.value, chunk.length);
+        return entries ? { entries } : { reason: 'malformed OSV querybatch response (results do not match the queries)' };
+    }
+    /** Fetch full advisory records (querybatch returns only ids) with bounded concurrency. */
+    async fetchDetails(ids) {
+        const out = new Map();
+        let next = 0;
+        const worker = async () => {
+            while (next < ids.length) {
+                const id = ids[next++];
+                out.set(id, await this.fetchDetail(id));
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(this.config.detailConcurrency, ids.length) }, worker));
+        return out;
+    }
+    async fetchDetail(id) {
+        const cached = this.config.enableCache ? this.detailCache.get(id) : undefined;
+        if (cached && Date.now() - cached.timestamp < this.config.cacheTtl)
+            return { vuln: cached.data };
+        const result = await this.http.get(`${this.base}/v1/vulns/${encodeURIComponent(id)}`, this.requestOptions());
+        const body = await this.readJson(result);
+        if ('reason' in body)
+            return body;
+        if (!isAdvisoryRecord(body.value))
+            return { reason: 'malformed OSV advisory record' };
+        const vuln = body.value;
+        if (this.config.enableCache)
+            this.detailCache.set(id, { data: vuln, timestamp: Date.now() });
+        return { vuln };
     }
     /**
      * Parse vulnerabilities into a more usable format
@@ -174,55 +365,54 @@ export class OSVClient {
     parseVulnerabilities(vulns) {
         return vulns.map((vuln) => {
             const cvssScore = this.extractCVSSScore(vuln.severity);
-            const severity = this.scoreSeverity(cvssScore);
-            const fixedVersions = this.extractFixedVersions(vuln.affected);
             return {
                 id: vuln.id,
                 cveIds: vuln.aliases?.filter((a) => a.startsWith('CVE-')) || [],
                 summary: vuln.summary || 'No summary available',
                 details: vuln.details || '',
-                severity,
+                severity: this.scoreSeverity(cvssScore, vuln.database_specific),
                 cvssScore,
-                affectedPackage: vuln.affected[0]?.package?.name || 'unknown',
-                affectedVersions: vuln.affected[0]?.versions || [],
-                fixedVersions,
+                affectedPackage: vuln.affected?.[0]?.package?.name || 'unknown',
+                affectedVersions: vuln.affected?.[0]?.versions || [],
+                fixedVersions: this.extractFixedVersions(vuln.affected ?? []),
                 publishedDate: vuln.published ? new Date(vuln.published) : null,
                 references: vuln.references?.map((r) => r.url) || [],
             };
         });
     }
     /**
-     * Extract CVSS score from severity array
+     * Extract a numeric CVSS score. OSV usually carries a CVSS vector string
+     * ("CVSS:3.1/AV:N/..."), which holds no base score: that yields null.
      */
     extractCVSSScore(severity) {
         if (!severity || severity.length === 0)
             return null;
-        // Prefer CVSS v3
-        const v3 = severity.find((s) => s.type === 'CVSS_V3');
-        if (v3) {
-            const score = parseFloat(v3.score.split('/')[0]);
-            return isNaN(score) ? null : score;
-        }
-        const v2 = severity.find((s) => s.type === 'CVSS_V2');
-        if (v2) {
-            const score = parseFloat(v2.score.split('/')[0]);
-            return isNaN(score) ? null : score;
-        }
-        return null;
+        const entry = severity.find((s) => s.type === 'CVSS_V3') ?? severity.find((s) => s.type === 'CVSS_V2');
+        if (!entry || typeof entry.score !== 'string' || entry.score.startsWith('CVSS:'))
+            return null;
+        const score = parseFloat(entry.score.split('/')[0]);
+        return isNaN(score) ? null : score;
     }
     /**
-     * Convert CVSS score to severity level
+     * Severity from a numeric CVSS score, else the advisory's own severity label
+     * (GitHub advisories carry `database_specific.severity`), else unknown.
      */
-    scoreSeverity(cvss) {
-        if (cvss === null)
-            return 'unknown';
-        if (cvss >= 9.0)
-            return 'critical';
-        if (cvss >= 7.0)
-            return 'high';
-        if (cvss >= 4.0)
+    scoreSeverity(cvss, databaseSpecific) {
+        if (cvss !== null) {
+            if (cvss >= 9.0)
+                return 'critical';
+            if (cvss >= 7.0)
+                return 'high';
+            if (cvss >= 4.0)
+                return 'medium';
+            return 'low';
+        }
+        const label = typeof databaseSpecific?.severity === 'string' ? databaseSpecific.severity.toLowerCase() : '';
+        if (label === 'critical' || label === 'high' || label === 'low')
+            return label;
+        if (label === 'medium' || label === 'moderate')
             return 'medium';
-        return 'low';
+        return 'unknown';
     }
     /**
      * Extract fixed versions from affected ranges
@@ -231,26 +421,13 @@ export class OSVClient {
         const fixed = [];
         for (const aff of affected) {
             for (const range of aff.ranges || []) {
-                for (const event of range.events) {
-                    if (event.fixed) {
+                for (const event of range.events || []) {
+                    if (event.fixed)
                         fixed.push(event.fixed);
-                    }
                 }
             }
         }
         return [...new Set(fixed)];
     }
-    /**
-     * Clean version string (remove ^ ~ etc.)
-     */
-    cleanVersion(version) {
-        return version.replace(/^[\^~>=<]/, '').split(' ')[0];
-    }
-    /**
-     * Clear the cache
-     */
-    clearCache() {
-        this.cache.clear();
-    }
 }
 //# sourceMappingURL=osv-client.js.map