circle-ir 4.17.0 → 4.18.1

package/dist/analysis/advisories.d.ts

@@ -0,0 +1,186 @@
+/**
+ * Known-vulnerability matching of a resolved dependency set against advisory
+ * records in the OSV schema (https://ossf.github.io/osv-schema/).
+ *
+ * The library ships no advisory data and fetches none: the caller parses the
+ * records of a snapshot it chose (for example the unzipped per-ecosystem
+ * export of OSV.dev) and passes them in, so the same set, records and engine
+ * version always give the same answer. Facts only: which advisory affects
+ * which coordinate, by which range, and which later versions are fixed.
+ * Severity is copied from the record; nothing is ranked or scored here.
+ *
+ * Ecosystems with an ordering (see {@link ADVISORY_ECOSYSTEMS}): `Maven`
+ * (Maven's `ComparableVersion` order, `ECOSYSTEM` ranges) and `npm` (SemVer
+ * 2.0 precedence, `SEMVER` ranges). Any other ecosystem name keeps the
+ * original behaviour: Maven order over `ECOSYSTEM` ranges, names as given.
+ */
+import type { Dependency, Ecosystem } from './sbom.js';
+/** How one OSV ecosystem orders versions and names packages. */
+export interface AdvisoryEcosystem {
+    /** OSV's ecosystem name (`affected[].package.ecosystem`). */
+    osv: string;
+    /** The `Dependency.ecosystem` it matches. */
+    dependency: Ecosystem;
+    /** Version order for ranges, fixed lists and deltas. */
+    compare: (a: string, b: string) => number;
+    /** OSV range types evaluated (others are ignored). */
+    rangeTypes: readonly string[];
+    /** A version the matcher may place in that order. */
+    isVersion: (version: string) => boolean;
+    /** Canonical package name, applied to OSV names and dependency names alike. */
+    normalizeName: (name: string) => string;
+}
+/** The ecosystems this library can order, keyed by OSV name. */
+export declare const ADVISORY_ECOSYSTEMS: Readonly<Record<string, AdvisoryEcosystem>>;
+export interface OsvEvent {
+    introduced?: string;
+    fixed?: string;
+    last_affected?: string;
+    limit?: string;
+}
+export interface OsvRange {
+    type: string;
+    events: OsvEvent[];
+}
+export interface OsvAffected {
+    package: {
+        ecosystem: string;
+        name: string;
+        purl?: string;
+    };
+    ranges?: OsvRange[];
+    versions?: string[];
+}
+export interface OsvRecord {
+    id: string;
+    aliases?: string[];
+    summary?: string;
+    published?: string;
+    modified: string;
+    withdrawn?: string;
+    severity?: Array<{
+        type: string;
+        score: string;
+    }>;
+    affected?: OsvAffected[];
+    references?: Array<{
+        type: string;
+        url: string;
+    }>;
+    database_specific?: {
+        severity?: string;
+    } & Record<string, unknown>;
+}
+/**
+ * Read one OSV record from JSON text or an already-parsed value. Returns null
+ * for anything that is not a record (no string `id` or `modified`), so a
+ * stray file in a snapshot directory is skipped rather than fatal.
+ */
+export declare function parseOsvRecord(input: string | unknown): OsvRecord | null;
+/** One vulnerability after alias merge: the records that describe it. */
+export interface AdvisoryGroup {
+    /** The group's id: its `GHSA-…` id if any, else the lowest id. */
+    id: string;
+    /** Every other id and alias of the group, CVE ids first. */
+    aliases: string[];
+    records: OsvRecord[];
+}
+export interface AdvisoryIndex {
+    /** Ecosystem the index was built for (OSV name, e.g. `Maven`). */
+    ecosystem: string;
+    /** Live (non-withdrawn) records read. */
+    records: number;
+    /** The greatest `modified` across all records read: the data's own date. */
+    snapshotDate: string | null;
+    /** Withdrawn records, never matched: id, aliases and withdrawal time. */
+    withdrawn: Array<{
+        id: string;
+        aliases: string[];
+        withdrawnAt: string;
+    }>;
+    /** Package name → groups with an `affected` entry for it. */
+    byPackage: Map<string, AdvisoryGroup[]>;
+}
+/**
+ * Build the matching index for one ecosystem. Records whose ids or aliases
+ * intersect are merged into one group, so a vulnerability published under two
+ * ids is reported once. Withdrawn records are listed and never matched.
+ */
+export declare function buildAdvisoryIndex(records: OsvRecord[], ecosystem?: string): AdvisoryIndex;
+export interface AffectedInterval {
+    /** Inclusive lower bound; `"0"` means from the first version. */
+    introduced: string;
+    /** Exclusive upper bound. */
+    fixed?: string;
+    /** Inclusive upper bound. */
+    lastAffected?: string;
+}
+/**
+ * Turn one range's events into intervals, in version order (Maven order unless
+ * another `compare` is given).
+ */
+export declare function rangeIntervals(range: OsvRange, compare?: (a: string, b: string) => number): AffectedInterval[];
+export interface AdvisoryRef {
+    id: string;
+    aliases: string[];
+    summary?: string;
+    published?: string;
+    modified: string;
+    /** Copied from the records (CVSS vectors and the like), never computed. */
+    severity: Array<{
+        type: string;
+        score: string;
+    }>;
+    /** The record's own `database_specific.severity` (e.g. GHSA's HIGH), copied. */
+    databaseSeverity?: string;
+    references: string[];
+}
+export interface AdvisoryMatch {
+    dependency: Dependency;
+    advisory: AdvisoryRef;
+    affected: {
+        ranges: AffectedInterval[];
+        viaVersionsList: boolean;
+    };
+    /** Every `fixed` bound above the dependency's version, ascending. */
+    fixedIn: string[];
+}
+/**
+ * Match each dependency against the index. A dependency whose version is not
+ * concrete (`unknown`, a range, an unresolved property) is never matched: the
+ * caller reports it as unresolved. One match per (dependency, vulnerability).
+ */
+export declare function matchAdvisories(deps: Dependency[], index: AdvisoryIndex): AdvisoryMatch[];
+/** A version the matcher may compare: one token, no range or unresolved reference. */
+export declare function isConcreteVersion(version: string): boolean;
+export interface DeltaMatch extends AdvisoryMatch {
+    baselineVersions: string[];
+    headVersions: string[];
+}
+export interface AdvisoryDelta {
+    /** Matched at baseline, not at head (keyed by package name and advisory id). */
+    removed: DeltaMatch[];
+    /** Matched at head, not at baseline. */
+    added: DeltaMatch[];
+    /** Matched at both. */
+    persisting: DeltaMatch[];
+}
+export interface DependencyDelta {
+    added: Dependency[];
+    removed: Dependency[];
+    changed: Array<{
+        name: string;
+        from: string[];
+        to: string[];
+        head: Dependency[];
+    }>;
+}
+/**
+ * Advisory delta between two pins matched under the same records. Each entry
+ * is a full match (the head side for `added` and `persisting`, the baseline
+ * side for `removed`) carrying the versions seen on both sides.
+ */
+export declare function diffAdvisoryMatches(baseline: AdvisoryMatch[], head: AdvisoryMatch[]): AdvisoryDelta;
+/** Resolved-set drift between two pins, by package name. */
+export declare function diffDependencySets(baseline: Dependency[], head: Dependency[]): DependencyDelta;
+//# sourceMappingURL=advisories.d.ts.map

package/dist/analysis/advisories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisories.d.ts","sourceRoot":"","sources":["../../src/analysis/advisories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAQvD,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,UAAU,EAAE,SAAS,CAAC;IACtB,wDAAwD;IACxD,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1C,sDAAsD;IACtD,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,qDAAqD;IACrD,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,+EAA+E;IAC/E,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACzC;AAID,gEAAgE;AAChE,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAiB3E,CAAC;AAmBF,MAAM,WAAW,QAAQ;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,iBAAiB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,CAaxE;AAMD,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,4DAA4D;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,SAAS,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,yEAAyE;IACzE,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,6DAA6D;IAC7D,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;CACzC;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,SAAU,GAAG,aAAa,CA0E3F;AAMD,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,KAAK,MAAY,GAAG,gBAAgB,EAAE,CAyBnH;AAaD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE;QAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,CAAC;IACnE,qEAAqE;IACrE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAqCD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,aAAa,GAAG,aAAa,EAAE,CAkDzF;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE1D;AAMD,MAAM,WAAW,UAAW,SAAQ,aAAa;IAC/C,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,wCAAwC;IACxC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,uBAAuB;IACvB,UAAU,EAAE,UAAU,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,EAAE,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC,CAAC;CACpF;AAkBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,aAAa,CAenG;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,eAAe,CAyB9F"}

package/dist/analysis/advisories.js

@@ -0,0 +1,391 @@
+/**
+ * Known-vulnerability matching of a resolved dependency set against advisory
+ * records in the OSV schema (https://ossf.github.io/osv-schema/).
+ *
+ * The library ships no advisory data and fetches none: the caller parses the
+ * records of a snapshot it chose (for example the unzipped per-ecosystem
+ * export of OSV.dev) and passes them in, so the same set, records and engine
+ * version always give the same answer. Facts only: which advisory affects
+ * which coordinate, by which range, and which later versions are fixed.
+ * Severity is copied from the record; nothing is ranked or scored here.
+ *
+ * Ecosystems with an ordering (see {@link ADVISORY_ECOSYSTEMS}): `Maven`
+ * (Maven's `ComparableVersion` order, `ECOSYSTEM` ranges) and `npm` (SemVer
+ * 2.0 precedence, `SEMVER` ranges). Any other ecosystem name keeps the
+ * original behaviour: Maven order over `ECOSYSTEM` ranges, names as given.
+ */
+import { compareMavenVersions } from './maven-version.js';
+import { compareSemver, parseSemver } from './semver-version.js';
+const asIs = (n) => n;
+/** The ecosystems this library can order, keyed by OSV name. */
+export const ADVISORY_ECOSYSTEMS = {
+    Maven: {
+        osv: 'Maven',
+        dependency: 'maven',
+        compare: compareMavenVersions,
+        rangeTypes: ['ECOSYSTEM'],
+        isVersion: () => true,
+        normalizeName: asIs,
+    },
+    npm: {
+        osv: 'npm',
+        dependency: 'npm',
+        compare: compareSemver,
+        rangeTypes: ['SEMVER', 'ECOSYSTEM'],
+        isVersion: (v) => parseSemver(v) !== null,
+        normalizeName: asIs,
+    },
+};
+/** Rules for an index; unknown ecosystems keep the original Maven behaviour. */
+function rulesFor(ecosystem) {
+    const known = ADVISORY_ECOSYSTEMS[ecosystem];
+    if (known)
+        return { ...known, filterDependencies: known.osv !== 'Maven' };
+    return { ...ADVISORY_ECOSYSTEMS.Maven, osv: ecosystem, filterDependencies: false };
+}
+/** Version order for a dependency's ecosystem (Maven order when unknown). */
+function compareForDependency(eco) {
+    for (const r of Object.values(ADVISORY_ECOSYSTEMS))
+        if (r.dependency === eco)
+            return r.compare;
+    return compareMavenVersions;
+}
+/**
+ * Read one OSV record from JSON text or an already-parsed value. Returns null
+ * for anything that is not a record (no string `id` or `modified`), so a
+ * stray file in a snapshot directory is skipped rather than fatal.
+ */
+export function parseOsvRecord(input) {
+    let value = input;
+    if (typeof input === 'string') {
+        try {
+            value = JSON.parse(input);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!value || typeof value !== 'object')
+        return null;
+    const r = value;
+    if (typeof r.id !== 'string' || typeof r.modified !== 'string')
+        return null;
+    return r;
+}
+function aliasOrder(a, b) {
+    const rank = (s) => (s.startsWith('CVE-') ? 0 : s.startsWith('GHSA-') ? 1 : 2);
+    return rank(a) - rank(b) || (a < b ? -1 : a > b ? 1 : 0);
+}
+/**
+ * Build the matching index for one ecosystem. Records whose ids or aliases
+ * intersect are merged into one group, so a vulnerability published under two
+ * ids is reported once. Withdrawn records are listed and never matched.
+ */
+export function buildAdvisoryIndex(records, ecosystem = 'Maven') {
+    const rules = rulesFor(ecosystem);
+    let snapshotDate = null;
+    const withdrawn = [];
+    const live = [];
+    for (const r of records) {
+        if (snapshotDate === null || r.modified > snapshotDate)
+            snapshotDate = r.modified;
+        if (r.withdrawn) {
+            withdrawn.push({ id: r.id, aliases: [...(r.aliases ?? [])].sort(aliasOrder), withdrawnAt: r.withdrawn });
+            continue;
+        }
+        if (r.affected?.some((a) => a.package?.ecosystem === ecosystem))
+            live.push(r);
+    }
+    withdrawn.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    // Union-find over every id and alias.
+    const parent = new Map();
+    const find = (x) => {
+        let root = x;
+        while (parent.get(root) !== root)
+            root = parent.get(root);
+        let cur = x;
+        while (parent.get(cur) !== root) {
+            const next = parent.get(cur);
+            parent.set(cur, root);
+            cur = next;
+        }
+        return root;
+    };
+    const add = (x) => {
+        if (!parent.has(x))
+            parent.set(x, x);
+    };
+    const union = (a, b) => {
+        add(a);
+        add(b);
+        const ra = find(a);
+        const rb = find(b);
+        if (ra !== rb)
+            parent.set(ra, rb);
+    };
+    for (const r of live) {
+        add(r.id);
+        for (const al of r.aliases ?? [])
+            union(r.id, al);
+    }
+    const groups = new Map();
+    for (const r of live) {
+        const root = find(r.id);
+        const list = groups.get(root) ?? [];
+        list.push(r);
+        groups.set(root, list);
+    }
+    const byPackage = new Map();
+    for (const recs of groups.values()) {
+        recs.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+        const ids = new Set();
+        for (const r of recs) {
+            ids.add(r.id);
+            for (const al of r.aliases ?? [])
+                ids.add(al);
+        }
+        const sorted = [...ids].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+        const recordIds = new Set(recs.map((r) => r.id));
+        const id = sorted.find((x) => x.startsWith('GHSA-') && recordIds.has(x)) ?? [...recordIds].sort()[0];
+        const group = { id, aliases: sorted.filter((x) => x !== id).sort(aliasOrder), records: recs };
+        const names = new Set();
+        for (const r of recs)
+            for (const a of r.affected ?? [])
+                if (a.package.ecosystem === ecosystem)
+                    names.add(rules.normalizeName(a.package.name));
+        for (const n of names) {
+            const list = byPackage.get(n) ?? [];
+            list.push(group);
+            byPackage.set(n, list);
+        }
+    }
+    for (const list of byPackage.values())
+        list.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    return { ecosystem, records: live.length, snapshotDate, withdrawn, byPackage };
+}
+const cmp = compareMavenVersions;
+/**
+ * Turn one range's events into intervals, in version order (Maven order unless
+ * another `compare` is given).
+ */
+export function rangeIntervals(range, compare = cmp) {
+    const events = range.events
+        .filter((e) => e.introduced !== undefined || e.fixed !== undefined || e.last_affected !== undefined)
+        .map((e) => {
+        const v = (e.introduced ?? e.fixed ?? e.last_affected);
+        return { e, v };
+    })
+        .sort((a, b) => {
+        if (a.v === '0' || b.v === '0')
+            return a.v === b.v ? 0 : a.v === '0' ? -1 : 1;
+        return compare(a.v, b.v);
+    });
+    const out = [];
+    let open = null;
+    for (const { e, v } of events) {
+        if (e.introduced !== undefined) {
+            if (!open)
+                open = { introduced: v };
+        }
+        else if (open) {
+            if (e.fixed !== undefined)
+                open.fixed = v;
+            else
+                open.lastAffected = v;
+            out.push(open);
+            open = null;
+        }
+    }
+    if (open)
+        out.push(open);
+    return out;
+}
+function inInterval(version, iv, compare) {
+    if (iv.introduced !== '0' && compare(version, iv.introduced) < 0)
+        return false;
+    if (iv.fixed !== undefined)
+        return compare(version, iv.fixed) < 0;
+    if (iv.lastAffected !== undefined)
+        return compare(version, iv.lastAffected) <= 0;
+    return true;
+}
+function advisoryRef(g) {
+    const first = g.records[0];
+    const severity = [];
+    const seenSev = new Set();
+    let databaseSeverity;
+    let modified = first.modified;
+    let published;
+    let summary;
+    const references = new Set();
+    for (const r of g.records) {
+        for (const s of r.severity ?? []) {
+            const k = `${s.type}|${s.score}`;
+            if (!seenSev.has(k)) {
+                seenSev.add(k);
+                severity.push({ type: s.type, score: s.score });
+            }
+        }
+        if (!databaseSeverity && typeof r.database_specific?.severity === 'string')
+            databaseSeverity = r.database_specific.severity;
+        if (r.modified > modified)
+            modified = r.modified;
+        if (r.published && (!published || r.published < published))
+            published = r.published;
+        if (!summary && r.summary)
+            summary = r.summary;
+        for (const ref of r.references ?? [])
+            references.add(ref.url);
+    }
+    return {
+        id: g.id,
+        aliases: g.aliases,
+        ...(summary ? { summary } : {}),
+        ...(published ? { published } : {}),
+        modified,
+        severity,
+        ...(databaseSeverity ? { databaseSeverity } : {}),
+        references: [...references].sort(),
+    };
+}
+/**
+ * Match each dependency against the index. A dependency whose version is not
+ * concrete (`unknown`, a range, an unresolved property) is never matched: the
+ * caller reports it as unresolved. One match per (dependency, vulnerability).
+ */
+export function matchAdvisories(deps, index) {
+    const rules = rulesFor(index.ecosystem);
+    const c = rules.compare;
+    const out = [];
+    for (const d of deps) {
+        if (rules.filterDependencies && d.ecosystem !== rules.dependency)
+            continue;
+        if (!isConcreteVersion(d.version) || !rules.isVersion(d.version))
+            continue;
+        const name = rules.normalizeName(d.name);
+        const groups = index.byPackage.get(name);
+        if (!groups)
+            continue;
+        for (const g of groups) {
+            const ranges = [];
+            const fixed = new Set();
+            let hitRange = false;
+            let hitList = false;
+            for (const r of g.records) {
+                for (const a of r.affected ?? []) {
+                    if (a.package.ecosystem !== index.ecosystem || rules.normalizeName(a.package.name) !== name)
+                        continue;
+                    if (a.versions?.includes(d.version))
+                        hitList = true;
+                    for (const range of a.ranges ?? []) {
+                        if (!rules.rangeTypes.includes(range.type))
+                            continue;
+                        for (const iv of rangeIntervals(range, c)) {
+                            if (!inInterval(d.version, iv, c))
+                                continue;
+                            hitRange = true;
+                            if (!ranges.some((x) => x.introduced === iv.introduced && x.fixed === iv.fixed && x.lastAffected === iv.lastAffected))
+                                ranges.push(iv);
+                            if (iv.fixed !== undefined)
+                                fixed.add(iv.fixed);
+                        }
+                    }
+                }
+            }
+            if (!hitRange && !hitList)
+                continue;
+            // Later fixed bounds of the same package (other branches) are fix candidates too.
+            for (const r of g.records) {
+                for (const a of r.affected ?? []) {
+                    if (a.package.ecosystem !== index.ecosystem || rules.normalizeName(a.package.name) !== name)
+                        continue;
+                    for (const range of a.ranges ?? []) {
+                        if (!rules.rangeTypes.includes(range.type))
+                            continue;
+                        for (const iv of rangeIntervals(range, c))
+                            if (iv.fixed !== undefined && c(iv.fixed, d.version) > 0)
+                                fixed.add(iv.fixed);
+                    }
+                }
+            }
+            out.push({
+                dependency: d,
+                advisory: advisoryRef(g),
+                affected: { ranges, viaVersionsList: hitList && !hitRange },
+                fixedIn: [...fixed].filter((f) => c(f, d.version) > 0).sort(c),
+            });
+        }
+    }
+    return out;
+}
+/** A version the matcher may compare: one token, no range or unresolved reference. */
+export function isConcreteVersion(version) {
+    return /^[0-9A-Za-z][\w.+-]*$/.test(version) && version !== 'unknown';
+}
+const byKey = (m) => `${m.dependency.ecosystem}\u0000${m.dependency.name}\u0000${m.advisory.id}`;
+function group(matches) {
+    const out = new Map();
+    for (const m of matches) {
+        const k = byKey(m);
+        const list = out.get(k) ?? [];
+        list.push(m);
+        out.set(k, list);
+    }
+    return out;
+}
+const versionsOf = (ms) => ms ? [...new Set(ms.map((m) => m.dependency.version))].sort(compareForDependency(ms[0].dependency.ecosystem)) : [];
+/**
+ * Advisory delta between two pins matched under the same records. Each entry
+ * is a full match (the head side for `added` and `persisting`, the baseline
+ * side for `removed`) carrying the versions seen on both sides.
+ */
+export function diffAdvisoryMatches(baseline, head) {
+    const b = group(baseline);
+    const h = group(head);
+    const delta = { removed: [], added: [], persisting: [] };
+    const keys = [...new Set([...b.keys(), ...h.keys()])].sort();
+    for (const k of keys) {
+        const bs = b.get(k);
+        const hs = h.get(k);
+        const base = (hs ?? bs);
+        const entry = { ...base[0], baselineVersions: versionsOf(bs), headVersions: versionsOf(hs) };
+        if (bs && hs)
+            delta.persisting.push(entry);
+        else if (bs)
+            delta.removed.push(entry);
+        else
+            delta.added.push(entry);
+    }
+    return delta;
+}
+/** Resolved-set drift between two pins, by package name. */
+export function diffDependencySets(baseline, head) {
+    const index = (deps) => {
+        const m = new Map();
+        for (const d of deps) {
+            const k = `${d.ecosystem}\u0000${d.name}`;
+            m.set(k, [...(m.get(k) ?? []), d]);
+        }
+        return m;
+    };
+    const b = index(baseline);
+    const h = index(head);
+    const out = { added: [], removed: [], changed: [] };
+    for (const key of [...new Set([...b.keys(), ...h.keys()])].sort()) {
+        const bs = b.get(key);
+        const hs = h.get(key);
+        if (!bs)
+            out.added.push(...hs);
+        else if (!hs)
+            out.removed.push(...bs);
+        else {
+            const order = compareForDependency(hs[0].ecosystem);
+            const from = [...new Set(bs.map((d) => d.version))].sort(order);
+            const to = [...new Set(hs.map((d) => d.version))].sort(order);
+            if (from.join('\u0000') !== to.join('\u0000'))
+                out.changed.push({ name: hs[0].name, from, to, head: hs });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=advisories.js.map

package/dist/analysis/advisories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisories.js","sourceRoot":"","sources":["../../src/analysis/advisories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAsBjE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC;AAEtC,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAgD;IAC9E,KAAK,EAAE;QACL,GAAG,EAAE,OAAO;QACZ,UAAU,EAAE,OAAO;QACnB,OAAO,EAAE,oBAAoB;QAC7B,UAAU,EAAE,CAAC,WAAW,CAAC;QACzB,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;QACrB,aAAa,EAAE,IAAI;KACpB;IACD,GAAG,EAAE;QACH,GAAG,EAAE,KAAK;QACV,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;QACnC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI;QACzC,aAAa,EAAE,IAAI;KACpB;CACF,CAAC;AAEF,gFAAgF;AAChF,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,KAAK;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,kBAAkB,EAAE,KAAK,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;IAC1E,OAAO,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;AACrF,CAAC;AAED,6EAA6E;AAC7E,SAAS,oBAAoB,CAAC,GAAc;IAC1C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAAE,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IAC/F,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAqCD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAuB;IACpD,IAAI,KAAK,GAAY,KAAK,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,CAAyB,CAAC;AACnC,CAAC;AA4BD,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE,SAAS,GAAG,OAAO;IAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,MAAM,SAAS,GAA+B,EAAE,CAAC;IACjD,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,GAAG,YAAY;YAAE,YAAY,GAAG,CAAC,CAAC,QAAQ,CAAC;QAClF,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAChB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACzG,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnE,sCAAsC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE;QACjC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAW,CAAC;QACpE,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAW,CAAC;YACvC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtB,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE;QAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,CAAS,EAAQ,EAAE;QAC3C,GAAG,CAAC,CAAC,CAAC,CAAC;QACP,GAAG,CAAC,CAAC,CAAC,CAAC;QACP,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACd,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrG,MAAM,KAAK,GAAkB,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7G,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE;gBAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;oBAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9I,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErG,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACjF,CAAC;AAeD,MAAM,GAAG,GAAG,oBAAoB,CAAC;AAEjC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAe,EAAE,OAAO,GAAqC,GAAG;IAC7F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC;SACnG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,aAAa,CAAW,CAAC;QACjE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAClB,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACL,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,IAAI,IAAI,GAA4B,IAAI,CAAC;IACzC,KAAK,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI;gBAAE,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QACtC,CAAC;aAAM,IAAI,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;;gBACrC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,EAAoB,EAAE,OAAyC;IAClG,IAAI,EAAE,CAAC,UAAU,KAAK,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,EAAE,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AA2BD,SAAS,WAAW,CAAC,CAAgB;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,gBAAoC,CAAC;IACzC,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,IAAI,SAA6B,CAAC;IAClC,IAAI,OAA2B,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,gBAAgB,IAAI,OAAO,CAAC,CAAC,iBAAiB,EAAE,QAAQ,KAAK,QAAQ;YAAE,gBAAgB,GAAG,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAC5H,IAAI,CAAC,CAAC,QAAQ,GAAG,QAAQ;YAAE,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QACjD,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC;YAAE,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,QAAQ;QACR,QAAQ;QACR,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAkB,EAAE,KAAoB;IACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxB,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,UAAU;YAAE,SAAS;QAC3E,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,MAAM,GAAuB,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACjC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;wBAAE,SAAS;oBACtG,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;wBAAE,OAAO,GAAG,IAAI,CAAC;oBACpD,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;wBACnC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;4BAAE,SAAS;wBACrD,KAAK,MAAM,EAAE,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;4BAC1C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;gCAAE,SAAS;4BAC5C,QAAQ,GAAG,IAAI,CAAC;4BAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,YAAY,CAAC;gCAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;4BACvI,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS;gCAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;wBAClD,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;gBAAE,SAAS;YACpC,kFAAkF;YAClF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACjC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;wBAAE,SAAS;oBACtG,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;wBACnC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;4BAAE,SAAS;wBACrD,KAAK,MAAM,EAAE,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;4BAAE,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;gCAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;oBAC3H,CAAC;gBACH,CAAC;YACH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACP,UAAU,EAAE,CAAC;gBACb,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;gBACxB,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE;gBAC3D,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,SAAS,CAAC;AACxE,CAAC;AA0BD,MAAM,KAAK,GAAG,CAAC,CAAgB,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,SAAS,CAAC,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;AAExH,SAAS,KAAK,CAAC,OAAwB;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,EAA+B,EAAY,EAAE,CAC/D,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAErH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAyB,EAAE,IAAqB;IAClF,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,KAAK,GAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAoB,CAAC;QAC3C,MAAM,KAAK,GAAe,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACzG,IAAI,EAAE,IAAI,EAAE;YAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aACtC,IAAI,EAAE;YAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAClC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB,CAAC,QAAsB,EAAE,IAAkB;IAC3E,MAAM,KAAK,GAAG,CAAC,IAAkB,EAA6B,EAAE;QAC9D,MAAM,CAAC,GAAG,IAAI,GAAG,EAAwB,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,GAAG,GAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAClE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAI,EAAmB,CAAC,CAAC;aAC5C,IAAI,CAAC,EAAE;YAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;aACjC,CAAC;YACJ,MAAM,KAAK,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/analysis/comment-lines.d.ts

@@ -0,0 +1,14 @@
+/**
+ * cognium-dev#999 — security results on lines that are only a comment.
+ *
+ * Several passes scan source text line by line (LanguageSourcesPass,
+ * mass-assignment, tls-verify-disabled), so a doc comment such as
+ * ` * JSON.parse(req.body)` produced a high-severity finding. This answers,
+ * from the syntax tree, whether a line holds nothing but comment text: the
+ * first non-blank column sits inside a comment node that runs to the end of
+ * the line's content. Mixed lines (`foo(x); // note`) are code and keep their
+ * results. String literals are not comments and are untouched.
+ */
+import type { Node } from 'web-tree-sitter';
+export declare function makeCommentOnlyLineTest(root: Node, code: string): (line: number) => boolean;
+//# sourceMappingURL=comment-lines.d.ts.map

package/dist/analysis/comment-lines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment-lines.d.ts","sourceRoot":"","sources":["../../src/analysis/comment-lines.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE5C,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAiC3F"}

package/dist/analysis/comment-lines.js

@@ -0,0 +1,34 @@
+export function makeCommentOnlyLineTest(root, code) {
+    const lines = code.split('\n');
+    const cache = new Map();
+    return (line) => {
+        const hit = cache.get(line);
+        if (hit !== undefined)
+            return hit;
+        let result = false;
+        const text = lines[line - 1];
+        if (text !== undefined) {
+            const first = text.search(/\S/);
+            if (first >= 0) {
+                const end = text.trimEnd().length;
+                const node = root.descendantForPosition({ row: line - 1, column: first });
+                let n = node;
+                // Climb to the comment node itself (some grammars nest a content child).
+                while (n && !/comment/.test(n.type) && n.startPosition.row === line - 1 &&
+                    n.startPosition.column === first && n.parent) {
+                    n = n.parent;
+                }
+                if (n && /comment/.test(n.type)) {
+                    const startsBefore = n.startPosition.row < line - 1 ||
+                        (n.startPosition.row === line - 1 && n.startPosition.column <= first);
+                    const endsAfter = n.endPosition.row > line - 1 ||
+                        (n.endPosition.row === line - 1 && n.endPosition.column >= end);
+                    result = startsBefore && endsAfter;
+                }
+            }
+        }
+        cache.set(line, result);
+        return result;
+    };
+}
+//# sourceMappingURL=comment-lines.js.map