codegate-ai 0.8.0 → 0.9.1

package/dist/layer2-static/engine.js

@@ -7,6 +7,41 @@ import { detectIdeSettingsIssues } from "./detectors/ide-settings.js";
 import { detectPluginManifestIssues } from "./detectors/plugin-manifest.js";
 import { detectRuleFileIssues } from "./detectors/rule-file.js";
 import { detectSymlinkEscapes } from "./detectors/symlink.js";
+import { detectWorkflowExcessivePermissions } from "./detectors/workflow-excessive-permissions.js";
+import { detectWorkflowDangerousTriggers } from "./detectors/workflow-dangerous-triggers.js";
+import { detectWorkflowTemplateInjection } from "./detectors/workflow-template-injection.js";
+import { detectWorkflowKnownVulnAction } from "./detectors/workflow-known-vuln-action.js";
+import { detectWorkflowUnpinnedUses } from "./detectors/workflow-unpinned-uses.js";
+import { detectWorkflowArtipacked } from "./detectors/workflow-artipacked.js";
+import { detectWorkflowCachePoisoning } from "./detectors/workflow-cache-poisoning.js";
+import { detectWorkflowGithubEnv } from "./detectors/workflow-github-env.js";
+import { detectWorkflowInsecureCommands } from "./detectors/workflow-insecure-commands.js";
+import { detectWorkflowSelfHostedRunner } from "./detectors/workflow-self-hosted-runner.js";
+import { detectWorkflowOverprovisionedSecrets } from "./detectors/workflow-overprovisioned-secrets.js";
+import { detectWorkflowSecretsOutsideEnv } from "./detectors/workflow-secrets-outside-env.js";
+import { detectWorkflowSecretsInherit } from "./detectors/workflow-secrets-inherit.js";
+import { detectWorkflowUndocumentedPermissions } from "./detectors/workflow-undocumented-permissions.js";
+import { detectWorkflowUseTrustedPublishing } from "./detectors/workflow-use-trusted-publishing.js";
+import { detectWorkflowArchivedUses } from "./detectors/workflow-archived-uses.js";
+import { detectWorkflowStaleActionRefs } from "./detectors/workflow-stale-action-refs.js";
+import { detectWorkflowForbiddenUses } from "./detectors/workflow-forbidden-uses.js";
+import { detectWorkflowRefConfusion } from "./detectors/workflow-ref-confusion.js";
+import { detectWorkflowRefVersionMismatch } from "./detectors/workflow-ref-version-mismatch.js";
+import { detectWorkflowImpostorCommit } from "./detectors/workflow-impostor-commit.js";
+import { detectWorkflowUnpinnedImages } from "./detectors/workflow-unpinned-images.js";
+import { detectWorkflowAnonymousDefinition } from "./detectors/workflow-anonymous-definition.js";
+import { detectWorkflowConcurrencyLimits } from "./detectors/workflow-concurrency-limits.js";
+import { detectWorkflowSuperfluousActions } from "./detectors/workflow-superfluous-actions.js";
+import { detectWorkflowMisfeature } from "./detectors/workflow-misfeature.js";
+import { detectWorkflowObfuscation } from "./detectors/workflow-obfuscation.js";
+import { detectWorkflowUnsoundCondition } from "./detectors/workflow-unsound-condition.js";
+import { detectWorkflowUnsoundContains } from "./detectors/workflow-unsound-contains.js";
+import { detectDependabotCooldown } from "./detectors/dependabot-cooldown.js";
+import { detectDependabotExecution } from "./detectors/dependabot-execution.js";
+import { detectWorkflowHardcodedContainerCredentials } from "./detectors/workflow-hardcoded-container-credentials.js";
+import { detectWorkflowUnredactedSecrets } from "./detectors/workflow-unredacted-secrets.js";
+import { detectWorkflowBotConditions } from "./detectors/workflow-bot-conditions.js";
+import { filterRegisteredAudits } from "./audits/registry.js";
 import { FINDING_CATEGORIES } from "../types/finding.js";
 import { buildFindingEvidence } from "./evidence.js";
 import { evaluateRule, loadRulePacks } from "./rule-engine.js";
@@ -41,6 +76,18 @@ function remediationActionsForRule(rule) {
     }
     return ["remove_field", "replace_with_default"];
 }
+function resolveDisabledAuditIds(policies) {
+    if (!policies) {
+        return [];
+    }
+    return Object.entries(policies)
+        .filter(([, policy]) => policy?.disable === true)
+        .map(([ruleId]) => ruleId);
+}
+function findRulePolicyConfig(policies, ruleId) {
+    const config = policies?.[ruleId]?.config;
+    return config && typeof config === "object" ? config : undefined;
+}
 function findingFromRulePackMatch(file, rule) {
     const locationField = rule.query_type === "text_pattern" ? "content" : rule.query;
     const evidence = buildFindingEvidence({
@@ -103,61 +150,453 @@ function dedupeFindings(findings) {
     }
     return Array.from(deduped.values());
 }
-export function runStaticEngine(input) {
+function buildFileAudits() {
+    return [
+        {
+            id: "env-overrides",
+            run: ({ file, input }) => detectEnvOverrides({
+                filePath: file.filePath,
+                parsed: file.parsed,
+                textContent: file.textContent,
+                trustedApiDomains: input.config.trustedApiDomains,
+            }),
+        },
+        {
+            id: "consent-bypass",
+            run: ({ file, input }) => detectConsentBypass({
+                filePath: file.filePath,
+                parsed: file.parsed,
+                textContent: file.textContent,
+                trustedApiDomains: input.config.trustedApiDomains,
+            }),
+        },
+        {
+            id: "command-execution",
+            run: ({ file, input }) => detectCommandExecution({
+                filePath: file.filePath,
+                parsed: file.parsed,
+                textContent: file.textContent,
+                knownSafeMcpServers: input.config.knownSafeMcpServers,
+                knownSafeFormatters: input.config.knownSafeFormatters,
+                knownSafeLspServers: input.config.knownSafeLspServers,
+                blockedCommands: input.config.blockedCommands,
+            }),
+        },
+        {
+            id: "ide-settings",
+            run: ({ file, input }) => input.config.checkIdeSettings
+                ? detectIdeSettingsIssues({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                    projectRoot: input.projectRoot,
+                })
+                : [],
+        },
+        {
+            id: "plugin-manifest",
+            run: ({ file, input }) => detectPluginManifestIssues({
+                filePath: file.filePath,
+                parsed: file.parsed,
+                textContent: file.textContent,
+                trustedApiDomains: input.config.trustedApiDomains,
+                blockedCommands: input.config.blockedCommands,
+            }),
+        },
+        {
+            id: "advisory-intelligence",
+            run: ({ file }) => detectAdvisoryIntelligence({
+                filePath: file.filePath,
+                parsed: file.parsed,
+                textContent: file.textContent,
+            }),
+        },
+        {
+            id: "rule-file",
+            run: ({ file, input }) => file.format === "text" || file.format === "markdown"
+                ? detectRuleFileIssues({
+                    filePath: file.filePath,
+                    textContent: file.textContent,
+                    unicodeAnalysis: input.config.unicodeAnalysis,
+                })
+                : [],
+        },
+        {
+            id: "workflow-unpinned-uses",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowUnpinnedUses({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-dangerous-triggers",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowDangerousTriggers({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                })
+                : [],
+        },
+        {
+            id: "workflow-excessive-permissions",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowExcessivePermissions({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                })
+                : [],
+        },
+        {
+            id: "workflow-template-injection",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowTemplateInjection({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                })
+                : [],
+        },
+        {
+            id: "workflow-known-vuln-action",
+            onlineRequired: true,
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowKnownVulnAction({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    runtimeMode: input.config.runtimeMode,
+                })
+                : [],
+        },
+        {
+            id: "workflow-artipacked",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowArtipacked({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-cache-poisoning",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowCachePoisoning({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-github-env",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowGithubEnv({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-insecure-commands",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowInsecureCommands({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-self-hosted-runner",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowSelfHostedRunner({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-overprovisioned-secrets",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowOverprovisionedSecrets({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-secrets-outside-env",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowSecretsOutsideEnv({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-secrets-inherit",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowSecretsInherit({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-undocumented-permissions",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowUndocumentedPermissions({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-use-trusted-publishing",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowUseTrustedPublishing({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-archived-uses",
+            onlineRequired: true,
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowArchivedUses({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-stale-action-refs",
+            onlineRequired: true,
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowStaleActionRefs({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-forbidden-uses",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowForbiddenUses({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                    config: findRulePolicyConfig(input.config.rulePolicies, "workflow-forbidden-uses"),
+                })
+                : [],
+        },
+        {
+            id: "workflow-ref-confusion",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowRefConfusion({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-ref-version-mismatch",
+            onlineRequired: true,
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowRefVersionMismatch({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                    runtimeMode: input.config.runtimeMode,
+                })
+                : [],
+        },
+        {
+            id: "workflow-impostor-commit",
+            onlineRequired: true,
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowImpostorCommit({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                    runtimeMode: input.config.runtimeMode,
+                })
+                : [],
+        },
+        {
+            id: "workflow-unpinned-images",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowUnpinnedImages({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-anonymous-definition",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowAnonymousDefinition({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-concurrency-limits",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowConcurrencyLimits({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-superfluous-actions",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowSuperfluousActions({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-misfeature",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowMisfeature({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-obfuscation",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowObfuscation({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-unsound-condition",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowUnsoundCondition({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "workflow-unsound-contains",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowUnsoundContains({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "dependabot-cooldown",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectDependabotCooldown({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "dependabot-execution",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectDependabotExecution({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "hardcoded-container-credentials",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowHardcodedContainerCredentials({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "unredacted-secrets",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowUnredactedSecrets({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+        {
+            id: "bot-conditions",
+            run: ({ file, input }) => input.config.workflowAuditsEnabled
+                ? detectWorkflowBotConditions({
+                    filePath: file.filePath,
+                    parsed: file.parsed,
+                    textContent: file.textContent,
+                })
+                : [],
+        },
+    ];
+}
+function buildGlobalAudits() {
+    return [
+        {
+            id: "symlink-escapes",
+            run: ({ input }) => detectSymlinkEscapes({ symlinkEscapes: input.symlinkEscapes }),
+        },
+        {
+            id: "git-hooks",
+            run: ({ input }) => detectGitHookIssues({ hooks: input.hooks, knownSafeHooks: input.config.knownSafeHooks }),
+        },
+    ];
+}
+export async function runStaticEngine(input) {
     const findings = [];
+    const runtimeSelection = {
+        persona: input.config.persona,
+        runtimeMode: input.config.runtimeMode,
+        disabledAuditIds: resolveDisabledAuditIds(input.config.rulePolicies),
+    };
+    const activeFileAudits = filterRegisteredAudits(buildFileAudits(), runtimeSelection);
+    const activeGlobalAudits = filterRegisteredAudits(buildGlobalAudits(), runtimeSelection);
     const rulePackRules = loadRulePacks({
         rule_pack_paths: input.config.rulePackPaths ?? [],
         allowed_rules: input.config.allowedRules ?? [],
         skip_rules: input.config.skipRules ?? [],
     });
     for (const file of input.files) {
-        findings.push(...detectEnvOverrides({
-            filePath: file.filePath,
-            parsed: file.parsed,
-            textContent: file.textContent,
-            trustedApiDomains: input.config.trustedApiDomains,
-        }));
-        findings.push(...detectConsentBypass({
-            filePath: file.filePath,
-            parsed: file.parsed,
-            textContent: file.textContent,
-            trustedApiDomains: input.config.trustedApiDomains,
-        }));
-        findings.push(...detectCommandExecution({
-            filePath: file.filePath,
-            parsed: file.parsed,
-            textContent: file.textContent,
-            knownSafeMcpServers: input.config.knownSafeMcpServers,
-            knownSafeFormatters: input.config.knownSafeFormatters,
-            knownSafeLspServers: input.config.knownSafeLspServers,
-            blockedCommands: input.config.blockedCommands,
-        }));
-        if (input.config.checkIdeSettings) {
-            findings.push(...detectIdeSettingsIssues({
-                filePath: file.filePath,
-                parsed: file.parsed,
-                textContent: file.textContent,
-                projectRoot: input.projectRoot,
-            }));
-        }
-        findings.push(...detectPluginManifestIssues({
-            filePath: file.filePath,
-            parsed: file.parsed,
-            textContent: file.textContent,
-            trustedApiDomains: input.config.trustedApiDomains,
-            blockedCommands: input.config.blockedCommands,
-        }));
-        findings.push(...detectAdvisoryIntelligence({
-            filePath: file.filePath,
-            parsed: file.parsed,
-            textContent: file.textContent,
-        }));
-        if (file.format === "text" || file.format === "markdown") {
-            findings.push(...detectRuleFileIssues({
-                filePath: file.filePath,
-                textContent: file.textContent,
-                unicodeAnalysis: input.config.unicodeAnalysis,
-            }));
+        for (const audit of activeFileAudits) {
+            findings.push(...(await audit.run({ file, input })));
         }
         for (const rule of rulePackRules) {
             if (!evaluateRule(rule, {
@@ -174,7 +613,8 @@ export function runStaticEngine(input) {
             }
         }
     }
-    findings.push(...detectSymlinkEscapes({ symlinkEscapes: input.symlinkEscapes }));
-    findings.push(...detectGitHookIssues({ hooks: input.hooks, knownSafeHooks: input.config.knownSafeHooks }));
+    for (const audit of activeGlobalAudits) {
+        findings.push(...(await audit.run({ input })));
+    }
     return dedupeFindings(findings);
 }

package/dist/layer2-static/github/cache.d.ts

@@ -0,0 +1,8 @@
+export interface AdvisoryPayload {
+    generatedAt: number;
+    advisories: Record<string, string[]>;
+}
+export declare const GITHUB_METADATA_CACHE_FILE = "gha-advisories.json";
+export declare function resolveGithubMetadataCachePath(cacheDir: string): string;
+export declare function loadCachedAdvisoryPayload(cacheDir: string, maxAgeMs: number, now?: number): AdvisoryPayload | null;
+export declare function saveCachedAdvisoryPayload(cacheDir: string, payload: AdvisoryPayload): void;

package/dist/layer2-static/github/cache.js

@@ -0,0 +1,41 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+export const GITHUB_METADATA_CACHE_FILE = "gha-advisories.json";
+export function resolveGithubMetadataCachePath(cacheDir) {
+    return join(cacheDir, GITHUB_METADATA_CACHE_FILE);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAdvisoryPayload(value) {
+    if (!isRecord(value) || typeof value.generatedAt !== "number") {
+        return false;
+    }
+    if (!isRecord(value.advisories)) {
+        return false;
+    }
+    return Object.values(value.advisories).every((entry) => Array.isArray(entry) && entry.every((item) => typeof item === "string"));
+}
+export function loadCachedAdvisoryPayload(cacheDir, maxAgeMs, now = Date.now()) {
+    const path = resolveGithubMetadataCachePath(cacheDir);
+    if (!existsSync(path)) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (!isAdvisoryPayload(parsed)) {
+            return null;
+        }
+        if (now - parsed.generatedAt > maxAgeMs) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveCachedAdvisoryPayload(cacheDir, payload) {
+    mkdirSync(cacheDir, { recursive: true });
+    writeFileSync(resolveGithubMetadataCachePath(cacheDir), JSON.stringify(payload, null, 2), "utf8");
+}

package/dist/layer2-static/github/client.d.ts

@@ -0,0 +1,17 @@
+import type { RuntimeMode } from "../../config.js";
+import { type AdvisoryPayload } from "./cache.js";
+export interface GithubMetadataClientOptions {
+    runtimeMode?: RuntimeMode;
+    cacheDir?: string;
+    cacheMaxAgeMs?: number;
+    now?: number;
+}
+export interface GithubMetadataClient {
+    runtimeMode: RuntimeMode;
+    cacheDir: string;
+    cacheMaxAgeMs: number;
+    isOnlineEnabled(): boolean;
+    loadKnownVulnerableActions(bundle: Record<string, string[]>): AdvisoryPayload;
+}
+export declare function createGithubMetadataClient(options?: GithubMetadataClientOptions): GithubMetadataClient;
+export declare function loadBundledGithubAdvisories(options?: GithubMetadataClientOptions): AdvisoryPayload;

package/dist/layer2-static/github/client.js

@@ -0,0 +1,43 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import bundledAdvisories from "../advisories/gha-known-vulnerable-actions.json" with { type: "json" };
+import { loadCachedAdvisoryPayload, saveCachedAdvisoryPayload, } from "./cache.js";
+function normalizeAdvisoryMap(value) {
+    const normalized = {};
+    for (const [action, versions] of Object.entries(value)) {
+        normalized[action.toLowerCase()] = versions.map((version) => version.toLowerCase());
+    }
+    return normalized;
+}
+export function createGithubMetadataClient(options = {}) {
+    const runtimeMode = options.runtimeMode ?? "offline";
+    const cacheDir = options.cacheDir ?? join(homedir(), ".codegate", "cache");
+    const cacheMaxAgeMs = options.cacheMaxAgeMs ?? 24 * 60 * 60 * 1000;
+    const now = options.now ?? Date.now();
+    return {
+        runtimeMode,
+        cacheDir,
+        cacheMaxAgeMs,
+        isOnlineEnabled() {
+            return runtimeMode === "online";
+        },
+        loadKnownVulnerableActions(bundle) {
+            const payload = {
+                generatedAt: now,
+                advisories: normalizeAdvisoryMap(bundle),
+            };
+            if (!runtimeMode || runtimeMode !== "online") {
+                return payload;
+            }
+            const cached = loadCachedAdvisoryPayload(cacheDir, cacheMaxAgeMs, now);
+            if (cached) {
+                return cached;
+            }
+            saveCachedAdvisoryPayload(cacheDir, payload);
+            return payload;
+        },
+    };
+}
+export function loadBundledGithubAdvisories(options = {}) {
+    return createGithubMetadataClient(options).loadKnownVulnerableActions(bundledAdvisories);
+}