cve-scanner 0.0.0 → 0.0.2

package/dist/ai/AiAssistant.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Calls any OpenAI-chat-completions-compatible endpoint. No SDK dependency —
+ * uses Node's built-in global fetch. See specs/90-ai-assistance.md.
+ */
+export declare class AiAssistant {
+    private endpoint;
+    private apiKey;
+    private model;
+    constructor(endpoint: string, apiKey: string, model: string);
+    analyze(prompt: string): Promise<string>;
+}

package/dist/ai/AiAssistant.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiAssistant = void 0;
+/**
+ * Calls any OpenAI-chat-completions-compatible endpoint. No SDK dependency —
+ * uses Node's built-in global fetch. See specs/90-ai-assistance.md.
+ */
+class AiAssistant {
+    constructor(endpoint, apiKey, model) {
+        this.endpoint = endpoint;
+        this.apiKey = apiKey;
+        this.model = model;
+    }
+    async analyze(prompt) {
+        const res = await fetch(`${this.endpoint}/chat/completions`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${this.apiKey}`,
+            },
+            body: JSON.stringify({
+                model: this.model,
+                messages: [{ role: 'user', content: prompt }],
+            }),
+        });
+        if (!res.ok) {
+            throw new Error(`AI endpoint returned ${res.status}: ${await res.text()}`);
+        }
+        const body = (await res.json());
+        return body.choices[0].message.content;
+    }
+}
+exports.AiAssistant = AiAssistant;
+//# sourceMappingURL=AiAssistant.js.map

package/dist/ai/AiAssistant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AiAssistant.js","sourceRoot":"","sources":["../../src/ai/AiAssistant.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH;IACE,YACU,QAAgB,EAChB,MAAc,EACd,KAAa;wBAFb,QAAQ;sBACR,MAAM;qBACN,KAAK;IACZ,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,mBAAmB,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;aAC9C,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,wBAAwB,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACzC,CAAC;CACF"}

package/dist/ai/ProjectManifestReader.d.ts

@@ -0,0 +1,8 @@
+import { Ecosystem, ProjectManifest } from '../core/types';
+/**
+ * Reads the project manifest file for an ecosystem (pom.xml, build.gradle(.kts),
+ * package.json) from scanDir, so the AI investigation prompt can tell what kind
+ * of software this actually is. Best-effort: returns undefined if none of the
+ * candidate files exist. See specs/90-ai-assistance.md.
+ */
+export declare function readProjectManifest(scanDir: string, ecosystem: Ecosystem): ProjectManifest | undefined;

package/dist/ai/ProjectManifestReader.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readProjectManifest = readProjectManifest;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const MANIFEST_CANDIDATES = {
+    maven: ['pom.xml'],
+    gradle: ['build.gradle', 'build.gradle.kts'],
+    npm: ['package.json'],
+};
+const MAX_CONTENT_LENGTH = 8000;
+/**
+ * Reads the project manifest file for an ecosystem (pom.xml, build.gradle(.kts),
+ * package.json) from scanDir, so the AI investigation prompt can tell what kind
+ * of software this actually is. Best-effort: returns undefined if none of the
+ * candidate files exist. See specs/90-ai-assistance.md.
+ */
+function readProjectManifest(scanDir, ecosystem) {
+    for (const fileName of MANIFEST_CANDIDATES[ecosystem]) {
+        const filePath = (0, path_1.join)(scanDir, fileName);
+        if (!(0, fs_1.existsSync)(filePath))
+            continue;
+        const content = (0, fs_1.readFileSync)(filePath, 'utf8');
+        const truncated = content.length > MAX_CONTENT_LENGTH;
+        return {
+            fileName,
+            content: truncated
+                ? `${content.slice(0, MAX_CONTENT_LENGTH)}\n... (truncated)`
+                : content,
+        };
+    }
+    return undefined;
+}
+//# sourceMappingURL=ProjectManifestReader.js.map

package/dist/ai/ProjectManifestReader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectManifestReader.js","sourceRoot":"","sources":["../../src/ai/ProjectManifestReader.ts"],"names":[],"mappings":";;;AAAA,2BAA8C;AAC9C,+BAA4B;AAG5B,MAAM,mBAAmB,GAAgC;IACvD,KAAK,EAAE,CAAC,SAAS,CAAC;IAClB,MAAM,EAAE,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,GAAG,EAAE,CAAC,cAAc,CAAC;CACtB,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;GAKG;AACH,6BACE,OAAe,EACf,SAAoB;IAEpB,KAAK,MAAM,QAAQ,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,IAAA,eAAU,EAAC,QAAQ,CAAC;YAAE,SAAS;QAEpC,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC;QACtD,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,SAAS;gBAChB,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,mBAAmB;gBAC5D,CAAC,CAAC,OAAO;SACZ,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/ai/ProjectManifestReader.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ai/ProjectManifestReader.test.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_test_1 = require("node:test");
+const ProjectManifestReader_1 = require("./ProjectManifestReader");
+function makeScanDir() {
+    return (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'cve-scanner-manifest-'));
+}
+(0, node_test_1.test)('reads pom.xml for maven', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'pom.xml'), '<project></project>');
+    strict_1.default.deepEqual((0, ProjectManifestReader_1.readProjectManifest)(dir, 'maven'), {
+        fileName: 'pom.xml',
+        content: '<project></project>',
+    });
+});
+(0, node_test_1.test)('reads build.gradle.kts for gradle when build.gradle is absent', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'build.gradle.kts'), 'plugins { }');
+    strict_1.default.deepEqual((0, ProjectManifestReader_1.readProjectManifest)(dir, 'gradle'), {
+        fileName: 'build.gradle.kts',
+        content: 'plugins { }',
+    });
+});
+(0, node_test_1.test)('prefers build.gradle over build.gradle.kts when both exist', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'build.gradle'), 'groovy');
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'build.gradle.kts'), 'kotlin');
+    strict_1.default.deepEqual((0, ProjectManifestReader_1.readProjectManifest)(dir, 'gradle'), {
+        fileName: 'build.gradle',
+        content: 'groovy',
+    });
+});
+(0, node_test_1.test)('reads package.json for npm', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'package.json'), '{"name":"fixture"}');
+    strict_1.default.deepEqual((0, ProjectManifestReader_1.readProjectManifest)(dir, 'npm'), {
+        fileName: 'package.json',
+        content: '{"name":"fixture"}',
+    });
+});
+(0, node_test_1.test)('returns undefined when no candidate file exists', () => {
+    const dir = makeScanDir();
+    strict_1.default.equal((0, ProjectManifestReader_1.readProjectManifest)(dir, 'maven'), undefined);
+});
+(0, node_test_1.test)('truncates very large manifest files', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'package.json'), 'x'.repeat(10000));
+    const manifest = (0, ProjectManifestReader_1.readProjectManifest)(dir, 'npm');
+    strict_1.default.ok(manifest.content.endsWith('... (truncated)'));
+    strict_1.default.ok(manifest.content.length < 10000);
+});
+//# sourceMappingURL=ProjectManifestReader.test.js.map

package/dist/ai/ProjectManifestReader.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectManifestReader.test.js","sourceRoot":"","sources":["../../src/ai/ProjectManifestReader.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,qCAAqD;AACrD,qCAAiC;AACjC,yCAAiC;AACjC,yCAAiC;AACjC,mEAA8D;AAE9D,SAAS,WAAW;IAClB,OAAO,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,IAAA,gBAAI,EAAC,yBAAyB,EAAE,GAAG,EAAE;IACnC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC3D,gBAAM,CAAC,SAAS,CAAC,IAAA,2CAAmB,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE;QAClD,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,qBAAqB;KAC/B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,aAAa,CAAC,CAAC;IAC5D,gBAAM,CAAC,SAAS,CAAC,IAAA,2CAAmB,EAAC,GAAG,EAAE,QAAQ,CAAC,EAAE;QACnD,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,aAAa;KACvB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAC;IACvD,gBAAM,CAAC,SAAS,CAAC,IAAA,2CAAmB,EAAC,GAAG,EAAE,QAAQ,CAAC,EAAE;QACnD,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,4BAA4B,EAAE,GAAG,EAAE;IACtC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,cAAc,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC/D,gBAAM,CAAC,SAAS,CAAC,IAAA,2CAAmB,EAAC,GAAG,EAAE,KAAK,CAAC,EAAE;QAChD,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,oBAAoB;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,iDAAiD,EAAE,GAAG,EAAE;IAC3D,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,gBAAM,CAAC,KAAK,CAAC,IAAA,2CAAmB,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,qCAAqC,EAAE,GAAG,EAAE;IAC/C,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAA,2CAAmB,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACjD,gBAAM,CAAC,EAAE,CAAC,QAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzD,gBAAM,CAAC,EAAE,CAAC,QAAS,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC"}

package/dist/ai/PromptBuilder.d.ts

@@ -0,0 +1,5 @@
+import { Finding } from '../core/types';
+/**
+ * Pure function, no I/O. See specs/90-ai-assistance.md.
+ */
+export declare function buildInvestigationPrompt(finding: Finding): string;

package/dist/ai/PromptBuilder.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildInvestigationPrompt = buildInvestigationPrompt;
+/**
+ * Pure function, no I/O. See specs/90-ai-assistance.md.
+ */
+function buildInvestigationPrompt(finding) {
+    const { artifact, cve, enrichment, projectManifest } = finding;
+    const lines = [
+        'I found a potentially vulnerable dependency in my project. Please help me assess the risk and suggest remediation.',
+        '',
+        `- Ecosystem: ${artifact.ecosystem}`,
+        `- Artifact: ${artifact.coordinate}`,
+        `- Version in use: ${artifact.version}`,
+        `- Vulnerability: ${cve.id} (CVSS score ${cve.score})`,
+        `- Title: ${cve.title}`,
+    ];
+    if (enrichment) {
+        lines.push(`- Description: ${enrichment.description}`);
+        if (enrichment.cvssVector)
+            lines.push(`- CVSS vector: ${enrichment.cvssVector}`);
+        if (enrichment.cwe && enrichment.cwe.length > 0)
+            lines.push(`- CWE: ${enrichment.cwe.join(', ')}`);
+        if (enrichment.references.length > 0) {
+            lines.push('- References:');
+            for (const ref of enrichment.references)
+                lines.push(`  - ${ref}`);
+        }
+    }
+    else {
+        lines.push('- No further detail available locally — please answer based on general knowledge of this CVE if you have it.');
+    }
+    if (projectManifest) {
+        lines.push('', `Here is my project's ${projectManifest.fileName}, for context on what kind of software this actually is:`, '', '```', projectManifest.content, '```');
+    }
+    else {
+        lines.push('', `I don't have my project's manifest file (e.g. pom.xml, build.gradle, package.json) available to attach — ask me to paste relevant parts of it if that would help.`);
+    }
+    lines.push('', 'My goal is to decide whether this can be safely ignored or needs a real fix, based on how my project actually uses this dependency — not just the CVE in the abstract. Please:', '1. Suggest concrete commands I can run in this project (e.g. grep/search for specific APIs, classes, or config flags related to the vulnerable code path) to check whether the vulnerable functionality is actually reachable from my code.', '2. If there is a lightweight way to try to reproduce or exploit the vulnerability locally (a crafted input, a minimal test script, a known proof-of-concept pattern), give me the exact command(s) or script to run.', "3. Tell me what results from those commands would indicate it's safe to ignore, versus results that mean I need to upgrade or otherwise fix it.");
+    return lines.join('\n');
+}
+//# sourceMappingURL=PromptBuilder.js.map

package/dist/ai/PromptBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PromptBuilder.js","sourceRoot":"","sources":["../../src/ai/PromptBuilder.ts"],"names":[],"mappings":";;;AAEA;;GAEG;AACH,kCAAyC,OAAgB;IACvD,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,KAAK,GAAG;QACZ,oHAAoH;QACpH,EAAE;QACF,gBAAgB,QAAQ,CAAC,SAAS,EAAE;QACpC,eAAe,QAAQ,CAAC,UAAU,EAAE;QACpC,qBAAqB,QAAQ,CAAC,OAAO,EAAE;QACvC,oBAAoB,GAAG,CAAC,EAAE,gBAAgB,GAAG,CAAC,KAAK,GAAG;QACtD,YAAY,GAAG,CAAC,KAAK,EAAE;KACxB,CAAC;IAEF,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,UAAU,CAAC,UAAU;YACvB,KAAK,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;QACxD,IAAI,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,wBAAwB,eAAe,CAAC,QAAQ,0DAA0D,EAC1G,EAAE,EACF,KAAK,EACL,eAAe,CAAC,OAAO,EACvB,KAAK,CACN,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,EAAE,EACF,mKAAmK,CACpK,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,EAAE,EACF,gLAAgL,EAChL,6OAA6O,EAC7O,sNAAsN,EACtN,iJAAiJ,CAClJ,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/ai/PromptBuilder.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ai/PromptBuilder.test.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const PromptBuilder_1 = require("./PromptBuilder");
+const baseFinding = {
+    artifact: {
+        ecosystem: 'npm',
+        coordinate: 'lodash',
+        version: '4.17.11',
+        source: 'package-lock.json',
+        projectRoot: '/project',
+    },
+    cve: { id: 'CVE-2019-10744', score: 9.1, title: 'prototype pollution' },
+};
+(0, node_test_1.test)('includes core finding details without enrichment', () => {
+    const prompt = (0, PromptBuilder_1.buildInvestigationPrompt)(baseFinding);
+    strict_1.default.match(prompt, /Ecosystem: npm/);
+    strict_1.default.match(prompt, /Artifact: lodash/);
+    strict_1.default.match(prompt, /Version in use: 4\.17\.11/);
+    strict_1.default.match(prompt, /CVE-2019-10744/);
+    strict_1.default.match(prompt, /No further detail available locally/);
+});
+(0, node_test_1.test)('includes enrichment detail when present', () => {
+    const prompt = (0, PromptBuilder_1.buildInvestigationPrompt)({
+        ...baseFinding,
+        enrichment: {
+            description: 'Prototype pollution via defaultsDeep.',
+            cvssVector: 'CVSS:3.1/AV:N',
+            cwe: ['CWE-1321'],
+            references: ['https://example.com/ref'],
+        },
+    });
+    strict_1.default.match(prompt, /Prototype pollution via defaultsDeep\./);
+    strict_1.default.match(prompt, /CVSS:3\.1\/AV:N/);
+    strict_1.default.match(prompt, /CWE-1321/);
+    strict_1.default.match(prompt, /https:\/\/example\.com\/ref/);
+    strict_1.default.doesNotMatch(prompt, /No further detail available locally/);
+});
+(0, node_test_1.test)('asks for investigation/exploit commands instead of the old fixed questions', () => {
+    const prompt = (0, PromptBuilder_1.buildInvestigationPrompt)(baseFinding);
+    strict_1.default.match(prompt, /commands I can run in this project/);
+    strict_1.default.match(prompt, /reproduce or exploit the vulnerability locally/);
+    strict_1.default.match(prompt, /safe to ignore/);
+    strict_1.default.doesNotMatch(prompt, /What is the minimum version I should upgrade to\?/);
+});
+(0, node_test_1.test)('mentions the manifest is unavailable when projectManifest is not set', () => {
+    const prompt = (0, PromptBuilder_1.buildInvestigationPrompt)(baseFinding);
+    strict_1.default.match(prompt, /don't have my project's manifest file/);
+});
+(0, node_test_1.test)('includes the project manifest content when present', () => {
+    const prompt = (0, PromptBuilder_1.buildInvestigationPrompt)({
+        ...baseFinding,
+        projectManifest: {
+            fileName: 'package.json',
+            content: '{"name":"my-app","dependencies":{"lodash":"^4.17.11"}}',
+        },
+    });
+    strict_1.default.match(prompt, /my project's package\.json/);
+    strict_1.default.match(prompt, /"name":"my-app"/);
+    strict_1.default.doesNotMatch(prompt, /don't have my project's manifest file/);
+});
+//# sourceMappingURL=PromptBuilder.test.js.map

package/dist/ai/PromptBuilder.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PromptBuilder.test.js","sourceRoot":"","sources":["../../src/ai/PromptBuilder.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AAEjC,mDAA2D;AAE3D,MAAM,WAAW,GAAY;IAC3B,QAAQ,EAAE;QACR,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,mBAAmB;QAC3B,WAAW,EAAE,UAAU;KACxB;IACD,GAAG,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAE;CACxE,CAAC;AAEF,IAAA,gBAAI,EAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,MAAM,MAAM,GAAG,IAAA,wCAAwB,EAAC,WAAW,CAAC,CAAC;IACrD,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACvC,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACzC,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IAClD,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACvC,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,yCAAyC,EAAE,GAAG,EAAE;IACnD,MAAM,MAAM,GAAG,IAAA,wCAAwB,EAAC;QACtC,GAAG,WAAW;QACd,UAAU,EAAE;YACV,WAAW,EAAE,uCAAuC;YACpD,UAAU,EAAE,eAAe;YAC3B,GAAG,EAAE,CAAC,UAAU,CAAC;YACjB,UAAU,EAAE,CAAC,yBAAyB,CAAC;SACxC;KACF,CAAC,CAAC;IACH,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,wCAAwC,CAAC,CAAC;IAC/D,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACxC,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjC,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACpD,gBAAM,CAAC,YAAY,CAAC,MAAM,EAAE,qCAAqC,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,MAAM,MAAM,GAAG,IAAA,wCAAwB,EAAC,WAAW,CAAC,CAAC;IACrD,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;IAC3D,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;IACvE,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACvC,gBAAM,CAAC,YAAY,CACjB,MAAM,EACN,mDAAmD,CACpD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,MAAM,GAAG,IAAA,wCAAwB,EAAC,WAAW,CAAC,CAAC;IACrD,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,MAAM,GAAG,IAAA,wCAAwB,EAAC;QACtC,GAAG,WAAW;QACd,eAAe,EAAE;YACf,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,wDAAwD;SAClE;KACF,CAAC,CAAC;IACH,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IACnD,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACxC,gBAAM,CAAC,YAAY,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC"}

package/dist/cmd/cve-scanner.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cmd/cve-scanner.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const PromptBuilder_1 = require("../ai/PromptBuilder");
+const CveScannerApi_1 = require("../lib/CveScannerApi");
+const report_1 = require("../lib/report");
+const program = new commander_1.Command()
+    .option('-s, --scan-dir <dir>', 'Directory to scan.', process.cwd())
+    .option('-f, --format <table|json>', 'Report output format.', 'table')
+    .option('-c, --cve-data-dir <dir>', 'Path to an extracted full CVE.org bulk download (https://www.cve.org/Downloads), used to enrich findings.')
+    .option('-d, --cve-data-download', 'Download the full CVE List (github.com/CVEProject/cvelistV5) and use it to enrich findings, instead of --cve-data-dir. Cached locally for 12 hours.', false)
+    .option('-p, --print-prompt', 'Print a ready-to-paste AI investigation prompt per finding, for manual use in a web AI chat UI.', false)
+    .option('-e, --ai-endpoint <url>', "OpenAI-compatible base URL. When set, sends each finding's details to this endpoint and prints its response. Opt-in only.")
+    .option('-k, --ai-api-key <key>', 'API key for --ai-endpoint. Prefer the CVE_SCANNER_AI_API_KEY env var instead of this flag.')
+    .option('-m, --ai-model <name>', 'Model name, required when --ai-endpoint is set.')
+    .option('-x, --fail-on-score <number>', "Only exit with a failure code if a finding's score is >= this value.")
+    .option('-v, --version', 'Display version', false)
+    .parse(process.argv);
+const options = program.opts();
+if (options.version) {
+    const pkg = require('../../package.json');
+    console.log(`${pkg.name}@${pkg.version}`);
+    process.exit(0);
+}
+const aiApiKey = options.aiApiKey ?? process.env.CVE_SCANNER_AI_API_KEY;
+if (options.aiEndpoint && (!options.aiModel || !aiApiKey)) {
+    console.error('--ai-endpoint requires --ai-model and an API key (--ai-api-key or CVE_SCANNER_AI_API_KEY).');
+    process.exit(2);
+}
+if (options.cveDataDir && options.cveDataDownload) {
+    console.error('Specify either --cve-data-dir or --cve-data-download, not both.');
+    process.exit(2);
+}
+const failOnScore = options.failOnScore !== undefined ? Number(options.failOnScore) : undefined;
+async function main() {
+    const api = new CveScannerApi_1.CveScannerApi({
+        scanDir: options.scanDir,
+        cveDataDir: options.cveDataDir,
+        cveDataDownload: options.cveDataDownload,
+        aiEndpoint: options.aiEndpoint,
+        aiApiKey,
+        aiModel: options.aiModel,
+    });
+    const result = await api.scan();
+    console.log((0, report_1.formatReport)(result, options.format, options.scanDir));
+    if (options.printPrompt) {
+        for (const finding of result.findings) {
+            console.log('\n---');
+            console.log(`Prompt for ${finding.artifact.coordinate}@${finding.artifact.version} (${finding.cve.id}):\n`);
+            console.log((0, PromptBuilder_1.buildInvestigationPrompt)(finding));
+        }
+    }
+    process.exit((0, report_1.computeExitCode)(result, failOnScore));
+}
+main().catch((err) => {
+    console.error(err instanceof Error ? err.message : err);
+    process.exit(2);
+});
+//# sourceMappingURL=cve-scanner.js.map

package/dist/cmd/cve-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-scanner.js","sourceRoot":"","sources":["../../src/cmd/cve-scanner.ts"],"names":[],"mappings":";;;AAEA,yCAAoC;AACpC,uDAA+D;AAC/D,wDAAqD;AACrD,0CAA4E;AAE5E,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE;KAC1B,MAAM,CAAC,sBAAsB,EAAE,oBAAoB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;KACnE,MAAM,CAAC,2BAA2B,EAAE,uBAAuB,EAAE,OAAO,CAAC;KACrE,MAAM,CACL,0BAA0B,EAC1B,2GAA2G,CAC5G;KACA,MAAM,CACL,yBAAyB,EACzB,qJAAqJ,EACrJ,KAAK,CACN;KACA,MAAM,CACL,oBAAoB,EACpB,iGAAiG,EACjG,KAAK,CACN;KACA,MAAM,CACL,yBAAyB,EACzB,2HAA2H,CAC5H;KACA,MAAM,CACL,wBAAwB,EACxB,4FAA4F,CAC7F;KACA,MAAM,CACL,uBAAuB,EACvB,iDAAiD,CAClD;KACA,MAAM,CACL,8BAA8B,EAC9B,sEAAsE,CACvE;KACA,MAAM,CAAC,eAAe,EAAE,iBAAiB,EAAE,KAAK,CAAC;KACjD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEvB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;AAE/B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;AAExE,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1D,OAAO,CAAC,KAAK,CACX,4FAA4F,CAC7F,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAClD,OAAO,CAAC,KAAK,CACX,iEAAiE,CAClE,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE9E,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,IAAI,6BAAa,CAAC;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAEhC,OAAO,CAAC,GAAG,CACT,IAAA,qBAAY,EAAC,MAAM,EAAE,OAAO,CAAC,MAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,CACtE,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,CAAC,GAAG,CACT,cAAc,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAC/F,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAA,wCAAwB,EAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,IAAA,wBAAe,EAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/core/CommandRunner.d.ts

@@ -0,0 +1,6 @@
+export interface CommandRunner {
+    run(cmd: string, workingDir: string): Promise<string>;
+}
+export declare class RealCommandRunner implements CommandRunner {
+    run(cmd: string, workingDir: string): Promise<string>;
+}

package/dist/core/CommandRunner.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RealCommandRunner = void 0;
+const util = require('util');
+const exec = util.promisify(require('child_process').exec);
+class RealCommandRunner {
+    async run(cmd, workingDir) {
+        const { stdout } = await exec(cmd, {
+            cwd: workingDir,
+            maxBuffer: 1024 * 1024 * 32,
+        });
+        return stdout;
+    }
+}
+exports.RealCommandRunner = RealCommandRunner;
+//# sourceMappingURL=CommandRunner.js.map

package/dist/core/CommandRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommandRunner.js","sourceRoot":"","sources":["../../src/core/CommandRunner.ts"],"names":[],"mappings":";;;AAAA,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC;AAM3D;IACE,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,UAAkB;QACvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE;YACjC,GAAG,EAAE,UAAU;YACf,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/core/DatasetLoader.d.ts

@@ -0,0 +1,14 @@
+import { Ecosystem, VulnerabilityDataset, VulnerableEntry } from './types';
+export declare class DatasetLoader {
+    private byVendorProduct;
+    readonly generatedAt: string;
+    constructor(dataset: VulnerabilityDataset);
+    static fromFile(filePath: string): DatasetLoader;
+    private key;
+    /**
+     * `coordinate` is "groupId:artifactId" for maven/gradle, or just the package
+     * name for npm (which has no vendor/product split). "gradle" artifacts are
+     * matched against "maven"-keyed entries — see specs/20-data-format.md.
+     */
+    findEntries(ecosystem: Ecosystem, coordinate: string): VulnerableEntry[];
+}

package/dist/core/DatasetLoader.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatasetLoader = void 0;
+const fs_1 = require("fs");
+const cpe_1 = require("./cpe");
+class DatasetLoader {
+    constructor(dataset) {
+        this.byVendorProduct = new Map();
+        this.generatedAt = dataset.generatedAt;
+        for (const entry of dataset.entries) {
+            const key = this.key((0, cpe_1.datasetEcosystem)(entry.ecosystem), (0, cpe_1.vendorProductFromCpe)(entry.cpe));
+            const existing = this.byVendorProduct.get(key) ?? [];
+            existing.push(entry);
+            this.byVendorProduct.set(key, existing);
+        }
+    }
+    static fromFile(filePath) {
+        if (!(0, fs_1.existsSync)(filePath)) {
+            throw new Error(`Vulnerability dataset not found at ${filePath}. If you're developing this tool from a clone ` +
+                `(rather than running it via npx), build it first: npm run refresh-dataset ` +
+                '(see specs/60-data-pipeline.md).');
+        }
+        const raw = (0, fs_1.readFileSync)(filePath, 'utf8');
+        return new DatasetLoader(JSON.parse(raw));
+    }
+    key(ecosystem, vendorProduct) {
+        return `${ecosystem}:${vendorProduct.toLowerCase()}`;
+    }
+    /**
+     * `coordinate` is "groupId:artifactId" for maven/gradle, or just the package
+     * name for npm (which has no vendor/product split). "gradle" artifacts are
+     * matched against "maven"-keyed entries — see specs/20-data-format.md.
+     */
+    findEntries(ecosystem, coordinate) {
+        const normalizedEcosystem = (0, cpe_1.datasetEcosystem)(ecosystem);
+        const vendorProduct = normalizedEcosystem === 'npm'
+            ? `${coordinate}:${coordinate}`
+            : coordinate;
+        return (this.byVendorProduct.get(this.key(normalizedEcosystem, vendorProduct)) ??
+            []);
+    }
+}
+exports.DatasetLoader = DatasetLoader;
+//# sourceMappingURL=DatasetLoader.js.map

package/dist/core/DatasetLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DatasetLoader.js","sourceRoot":"","sources":["../../src/core/DatasetLoader.ts"],"names":[],"mappings":";;;AAAA,2BAA8C;AAC9C,+BAA+D;AAG/D;IAIE,YAAY,OAA6B;QAHjC,oBAAe,GAAG,IAAI,GAAG,EAA6B,CAAC;QAI7D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,IAAA,sBAAgB,EAAC,KAAK,CAAC,SAAS,CAAC,EACjC,IAAA,0BAAoB,EAAC,KAAK,CAAC,GAAG,CAAC,CAChC,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,QAAgB;QAC9B,IAAI,CAAC,IAAA,eAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,gDAAgD;gBAC5F,4EAA4E;gBAC5E,kCAAkC,CACrC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC,CAAC;IACpE,CAAC;IAEO,GAAG,CAAC,SAA0B,EAAE,aAAqB;QAC3D,OAAO,GAAG,SAAS,IAAI,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,SAAoB,EAAE,UAAkB;QAClD,MAAM,mBAAmB,GAAG,IAAA,sBAAgB,EAAC,SAAS,CAAC,CAAC;QACxD,MAAM,aAAa,GACjB,mBAAmB,KAAK,KAAK;YAC3B,CAAC,CAAC,GAAG,UAAU,IAAI,UAAU,EAAE;YAC/B,CAAC,CAAC,UAAU,CAAC;QACjB,OAAO,CACL,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC;YACtE,EAAE,CACH,CAAC;IACJ,CAAC;CACF"}

package/dist/core/DatasetLoader.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/DatasetLoader.test.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_test_1 = require("node:test");
+const DatasetLoader_1 = require("./DatasetLoader");
+const dataset = {
+    generatedAt: '2026-01-01T00:00:00.000Z',
+    entries: [],
+};
+(0, node_test_1.test)('exposes the dataset generatedAt timestamp', () => {
+    strict_1.default.equal(new DatasetLoader_1.DatasetLoader(dataset).generatedAt, '2026-01-01T00:00:00.000Z');
+});
+(0, node_test_1.test)('fromFile round-trips generatedAt and entries', () => {
+    const dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'cve-scanner-dataset-'));
+    const filePath = (0, node_path_1.join)(dir, 'dataset.json');
+    (0, node_fs_1.writeFileSync)(filePath, JSON.stringify({
+        generatedAt: '2026-02-02T12:00:00.000Z',
+        entries: [
+            {
+                ecosystem: 'npm',
+                cpe: 'cpe:2.3:a:left-pad:left-pad:*:*:*:*:*:*:*:*',
+                versionExact: '1.0.0',
+                cves: [{ id: 'CVE-1', score: 5, title: 'test' }],
+            },
+        ],
+    }));
+    const loader = DatasetLoader_1.DatasetLoader.fromFile(filePath);
+    strict_1.default.equal(loader.generatedAt, '2026-02-02T12:00:00.000Z');
+    strict_1.default.equal(loader.findEntries('npm', 'left-pad').length, 1);
+});
+(0, node_test_1.test)('fromFile gives a friendly error pointing at npm run refresh-dataset when the file is missing', () => {
+    const dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'cve-scanner-dataset-'));
+    strict_1.default.throws(() => DatasetLoader_1.DatasetLoader.fromFile((0, node_path_1.join)(dir, 'does-not-exist.json')), /npm run refresh-dataset/);
+});
+//# sourceMappingURL=DatasetLoader.test.js.map

package/dist/core/DatasetLoader.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DatasetLoader.test.js","sourceRoot":"","sources":["../../src/core/DatasetLoader.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,qCAAqD;AACrD,qCAAiC;AACjC,yCAAiC;AACjC,yCAAiC;AACjC,mDAAgD;AAGhD,MAAM,OAAO,GAAyB;IACpC,WAAW,EAAE,0BAA0B;IACvC,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,IAAA,gBAAI,EAAC,2CAA2C,EAAE,GAAG,EAAE;IACrD,gBAAM,CAAC,KAAK,CACV,IAAI,6BAAa,CAAC,OAAO,CAAC,CAAC,WAAW,EACtC,0BAA0B,CAC3B,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,8CAA8C,EAAE,GAAG,EAAE;IACxD,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC3C,IAAA,uBAAa,EACX,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC;QACb,WAAW,EAAE,0BAA0B;QACvC,OAAO,EAAE;YACP;gBACE,SAAS,EAAE,KAAK;gBAChB,GAAG,EAAE,6CAA6C;gBAClD,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;aACjD;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,MAAM,GAAG,6BAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;IAC7D,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,8FAA8F,EAAE,GAAG,EAAE;IACxG,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,gBAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,6BAAa,CAAC,QAAQ,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,EAC9D,yBAAyB,CAC1B,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/core/ProjectRootDiscovery.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Recursively discovers independent project roots under `scanDir` — every
+ * directory containing at least one supported manifest file. A directory
+ * that qualifies is not descended into further (that project's own tooling
+ * already resolves everything nested below it — e.g. a Maven multi-module
+ * build, or an npm workspaces root lockfile), and common noise directories
+ * are skipped outright. See specs/35-project-discovery.md.
+ */
+export declare function findProjectRoots(scanDir: string): string[];

package/dist/core/ProjectRootDiscovery.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findProjectRoots = findProjectRoots;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const MANIFEST_FILENAMES = [
+    'pom.xml',
+    'build.gradle',
+    'build.gradle.kts',
+    'package-lock.json',
+    'npm-shrinkwrap.json',
+];
+const SKIP_DIRECTORY_NAMES = new Set([
+    'node_modules',
+    '.git',
+    'target',
+    'build',
+    'dist',
+    'out',
+    '.gradle',
+    '.mvn',
+    'vendor',
+    'venv',
+    '.venv',
+]);
+function hasManifest(dir) {
+    return MANIFEST_FILENAMES.some((name) => (0, fs_1.existsSync)((0, path_1.join)(dir, name)));
+}
+/**
+ * Recursively discovers independent project roots under `scanDir` — every
+ * directory containing at least one supported manifest file. A directory
+ * that qualifies is not descended into further (that project's own tooling
+ * already resolves everything nested below it — e.g. a Maven multi-module
+ * build, or an npm workspaces root lockfile), and common noise directories
+ * are skipped outright. See specs/35-project-discovery.md.
+ */
+function findProjectRoots(scanDir) {
+    const roots = [];
+    function walk(dir) {
+        if (hasManifest(dir)) {
+            roots.push(dir);
+            return;
+        }
+        let entries;
+        try {
+            entries = (0, fs_1.readdirSync)(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            if (SKIP_DIRECTORY_NAMES.has(entry.name))
+                continue;
+            walk((0, path_1.join)(dir, entry.name));
+        }
+    }
+    walk(scanDir);
+    return roots;
+}
+//# sourceMappingURL=ProjectRootDiscovery.js.map

package/dist/core/ProjectRootDiscovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectRootDiscovery.js","sourceRoot":"","sources":["../../src/core/ProjectRootDiscovery.ts"],"names":[],"mappings":";;;AAAA,2BAA6C;AAC7C,+BAA4B;AAE5B,MAAM,kBAAkB,GAAG;IACzB,SAAS;IACT,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,qBAAqB;CACtB,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,cAAc;IACd,MAAM;IACN,QAAQ;IACR,OAAO;IACP,MAAM;IACN,KAAK;IACL,SAAS;IACT,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;CACR,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;GAOG;AACH,0BAAiC,OAAe;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,SAAS,IAAI,CAAC,GAAW;QACvB,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,gBAAW,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnD,IAAI,CAAC,IAAA,WAAI,EAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/ProjectRootDiscovery.test.d.ts

@@ -0,0 +1 @@
+export {};