echelongraph-mcp 3.0.2 → 3.1.0

package/dist/tools/cve_intel.js

@@ -42,6 +42,7 @@
 import * as z from "zod";
 import { ANNOTATIONS, CVE_ID, NOT_A_FINDING, SHOWN_BASE, api, badInput, boolAt, checked, crashed, envelopeSchema, failed, failure, field, numAt, okHead, opt, strAt, succeeded, } from "../index.js";
 import { answering, FULL_ARG, TEXT_BUDGET_DESCRIPTION } from "../textBudget.js";
+import { ONE_PACKAGE_RULE, packagesListedTwice } from "./packageRecords.js";
 const TOOL = "cve_intel";
 // The sections relayed, in the answer's order, and the keys each failed_sections name covers.
 const LISTS = ["cwes", "exploits", "affected_packages", "fixed_versions", "timeline"];
@@ -73,8 +74,52 @@ const LEFT_OUT = ["vendor_advisories", "patches", "ai", "trending", "historical_
 // Per-CVE row limits of the API (core-backend cve/enrichment_store.go): a list this long may be cut.
 const API_ROW_LIMIT = { exploits: 10, affected_packages: 50, fixed_versions: 200, timeline: 100 };
 const TIMELINE_RELAYED = 20;
-const CVE_INTEL_METHOD = "EchelonGraph's per-CVE enrichment (GET /api/v1/public/cves/:id/enrichment). cwes: CWE classifications stored from NVD, GitHub (GHSA) and CVE.org records, each with the source that gave it, named from the MITRE CWE catalog EchelonGraph embeds. exploits: EchelonGraph's cve_exploits records, whose data model holds public exploit code, namely Metasploit modules (metasploit), Exploit-DB entries (exploit_db), GitHub proof-of-concept repositories (github_poc) and vendor proofs of concept (vendor_poc), and Nuclei detection templates (nuclei_template), which check whether a system is affected and are not necessarily exploit code, filled by a curated seed and by one poller per automated source, each run only where it is enabled, so which sources are current depends on the deployment. affected_packages and fixed_versions: package-ecosystem advisory data, each row naming its source. timeline: EchelonGraph's enrichment history for the CVE, newest first.";
-const VERIFIED_STATUS_DESCRIPTION = "verified_status is the label stored with each reference: verified for a Metasploit module, for an Exploit-DB entry Exploit-DB marks verified, and for curated seed rows marked so; reported for a public artefact nothing has confirmed works (nuclei templates, GitHub proofs of concept, unverified Exploit-DB entries); unconfirmed where a curated row says so. It is a label from the source, not a guarantee that the exploit works against a given system.";
+const VERIFIED_STATUS_DESCRIPTION = "verified_status is the label stored with each reference: verified for a Metasploit module, for an Exploit-DB entry Exploit-DB marks verified, and for curated seed rows marked so; reported for a public artefact nothing has confirmed works (nuclei templates, GitHub proofs of concept and checker repositories, unverified Exploit-DB entries); unconfirmed where a curated row says so. It is a label from the source, not a guarantee that the exploit works against a given system.";
+// #3267: the exploit kinds this server classifies, both lists by name, as core-backend's
+// egkev.ExploitCodeKinds lists exploit code ("the one definition of exploit code", #1213, #3038)
+// and every other kind core-backend holds (exploits.Kind* constants) is a detection kind there.
+// Until #3267 this server named only the detection kinds and counted every other kind as exploit
+// code, the inverse of the backend's list: the two failed in opposite directions. core-backend fails
+// closed (egkev/backfill_exploit_poc_available.sql raises on a kind ExploitCodeKinds does not
+// classify); this server failed open, so a kind core-backend added after a release (another scanner
+// or template source) would have reached every client of that release as "N public exploit
+// references", the claim #3039 removed, with nothing erroring. github_checker did exactly that
+// from #3040 (2026-10-12) to #3221. A kind on neither list is now counted as neither: the note
+// names it as a kind this server does not classify (exploitSentences). test/cve_intel.test.mjs holds both
+// lists to core-backend's source in the monorepo, and the kind field's text to the note everywhere.
+const EXPLOIT_CODE_KINDS = ["metasploit", "exploit_db", "github_poc", "vendor_poc"];
+const DETECTION_KINDS = ["nuclei_template", "github_checker"];
+const DETECTION_GLOSS = {
+    nuclei_template: "a Nuclei detection template",
+    github_checker: "a GitHub repository named or described as a checker or scanner",
+};
+const isExploitCodeKind = (k) => EXPLOIT_CODE_KINDS.includes(k);
+const isDetectionKind = (k) => DETECTION_KINDS.includes(k);
+const orList = (xs) => (xs.length <= 1 ? (xs[0] ?? "") : `${xs.slice(0, -1).join(", ")} or ${xs.at(-1)}`);
+const andList = (xs) => (xs.length <= 1 ? (xs[0] ?? "") : `${xs.slice(0, -1).join(", ")} and ${xs.at(-1)}`);
+// #3267's review: the method and exploits_by_kind name the kinds from the same two lists, so neither
+// can name a kind the note counts otherwise; each kind's words are a Record over its list, so a kind
+// added to a list without them does not compile.
+const CODE_NOUN = {
+    metasploit: "Metasploit modules",
+    exploit_db: "Exploit-DB entries",
+    github_poc: "GitHub proof-of-concept repositories",
+    vendor_poc: "vendor proofs of concept",
+};
+const DETECTION_NOUN_METHOD = {
+    nuclei_template: "Nuclei detection templates (nuclei_template)",
+    github_checker: "GitHub checker repositories (github_checker: GitHub repositories named or described as a checker or scanner)",
+};
+const UNCLASSIFIED_KIND = "A kind on neither list is one this server does not classify: the note counts it as neither.";
+const CVE_INTEL_METHOD = `EchelonGraph's per-CVE enrichment (GET /api/v1/public/cves/:id/enrichment). cwes: CWE classifications stored from NVD, GitHub (GHSA) and CVE.org records, each with the source that gave it, named from the MITRE CWE catalog EchelonGraph embeds. exploits: EchelonGraph's cve_exploits records, whose data model holds public exploit code, namely ${andList(EXPLOIT_CODE_KINDS.map((k) => `${CODE_NOUN[k]} (${k})`))}, and detection checks, namely ${andList(DETECTION_KINDS.map((k) => DETECTION_NOUN_METHOD[k]))}, which check whether a system is affected and are not necessarily exploit code, filled by a curated seed and by one poller per automated source, each run only where it is enabled, so which sources are current depends on the deployment. ${UNCLASSIFIED_KIND} affected_packages and fixed_versions: package-ecosystem advisory data, each row naming its source. timeline: EchelonGraph's enrichment history for the CVE, newest first.`;
+// #3221: the kinds, split as egkev.ExploitCodeKinds splits them (#3038, #3040) and /pulse shows
+// them: exploit code, and the two detection kinds. Until #3221 the field listed nuclei_template
+// beside the exploit-code kinds, and not github_checker, a kind core-backend's data model has held
+// since #3040 (exploits.KindGitHubChecker). The text says what each kind is, not which rows carry
+// it. #3267: built from the two lists the note counts by, so the field cannot name a kind the note
+// counts otherwise, and it says what the note does with any other kind.
+const EXPLOIT_KIND_DESCRIPTION = `Exploit code: ${orList(EXPLOIT_CODE_KINDS)}. A detection check, which checks whether a system is affected and is not necessarily exploit code: ${orList(DETECTION_KINDS.map((k) => `${k} (${DETECTION_GLOSS[k]})`))}. A kind not named here is one this server does not classify: the note counts it as neither.`;
+const EXPLOITS_BY_KIND_DESCRIPTION = `Every reference on record counted by kind (the values of each exploit's kind), past the 10 listed; the counts under ${andList(DETECTION_KINDS)} are detection checks, not exploit code, those under ${andList(EXPLOIT_CODE_KINDS)} are exploit code, and those under any other kind are of a kind this server does not classify, counted as neither.`;
 const FIXED_BRANCHES_DESCRIPTION = 'fixed_branches lists each affected range of the package on record: introduced, and fixed (the range\'s fix) or last_affected (its last affected version, where no fix is on record), each null when absent, with advisory_id (the OSV record that published the range) and source (the loader\'s label for that record), both null on a row loaded before they were stored. Ranges with an advisory_id are in the order their record lists them (records in id order); ranges without one are oldest first. To pick the range for an installed version, compare in the ecosystem\'s version order (release numbers part by part, as numbers: 2.4 is below 2.13.0): the version is in a range when it is at or above introduced ("0" is the first version) and below fixed, or at or below last_affected; its fix is that range\'s fixed, or, while another range still holds that, the other range\'s fixed (none past a range without one); a version in no range is outside every range on record. fixed_branches is null where the package\'s ranges were never loaded, and [] where no version range is on record (the advisory gives none, only commit ranges, or more than are stored), which is not a finding that no fix exists: fixed_version can still name one. fixed_version is one range\'s fix, kept for compatibility (one per package: the range the loader kept, the advisory\'s last as a rule), not the fix for every affected range: for CVE-2021-44228, its advisory gives log4j-core three ranges, and fixed_version 2.12.2 is the fix for the one from 2.4, while the range holding 2.14.1 (from 2.13.0) is fixed in 2.15.0.';
 // #3039: a Nuclei template is a detection check, not necessarily exploit code (core-backend
 // egkev.ExploitCodeKinds, #3038; /pulse words it so since #3022). The head says "exploit code,
@@ -88,7 +133,10 @@ const FIXED_BRANCHES_DESCRIPTION = 'fixed_branches lists each affected range of
 // still-affected 4.17.21 (ranges [0, 4.17.21) and [4.0.0, 4.18.0); the fix is 4.18.0). It now
 // states the walk FIXED_BRANCHES_DESCRIPTION and branchSentences state, in fewer characters than
 // the old rule (a range's bounds folded into the list of its fields), so the headroom holds.
-export const CVE_INTEL_DESCRIPTION = `Weakness, exploit code, detection templates, affected packages and fixed versions for one CVE, from EchelonGraph's per-CVE enrichment. Returns cwes (each cwe_id with name and source), exploits (each with kind, source_name, source_url, source_published_at (the source's date, null if none), eg_first_seen_at (when EchelonGraph recorded it) and verified_status; at most 10, verified first) with exploits_total, exploits_capped, exploits_by_kind and exploits_by_status, affected_packages (ecosystem, package_name, version_range, fixed_version, fixed_branches), fixed_versions (each fixed version with the vulnerable_range it fixes) and timeline (newest enrichment-history rows, with timeline_total). fixed_branches lists each affected range on record (from introduced ("0" is the first version) to below fixed, or through last_affected, with advisory_id (its OSV record) and source); in the ecosystem's version order, an affected version's fix is the first fixed above it that no range of its row holds (none past a range with no fixed). fixed_version is one range's fix, kept for compatibility, not the fix for every affected range. fixed_branches [] is not a finding that no fix exists. verified_status is the source's label, not a guarantee the exploit works on a given system. An empty exploits list is not evidence that no public exploit exists: it covers only the sources EchelonGraph ingests, and which are polled depends on the deployment. A section the API could not read is named in coverage.sections_failed and left out of data, never relayed as an empty list. Its structured result carries notes, with data, which the first text block holds whole up to 30,000 characters; its coverage names the sections relayed, failed and left out. ${TEXT_BUDGET_DESCRIPTION}`;
+// #3221: "detection checks", /pulse's word for Nuclei templates and GitHub checker repositories
+// together (ExploitWatch.tsx DETECTION_CHECKS_HEADING), where the head said "detection templates",
+// which a checker repository is not; 3 characters shorter. The kinds are the outputSchema's.
+export const CVE_INTEL_DESCRIPTION = `Weakness, exploit code, detection checks, affected packages and fixed versions for one CVE, from EchelonGraph's per-CVE enrichment. Returns cwes (each cwe_id with name and source), exploits (each with kind, source_name, source_url, source_published_at (the source's date, null if none), eg_first_seen_at (when EchelonGraph recorded it) and verified_status; at most 10, verified first) with exploits_total, exploits_capped, exploits_by_kind and exploits_by_status, affected_packages (ecosystem, package_name, version_range, fixed_version, fixed_branches), fixed_versions (each fixed version with the vulnerable_range it fixes) and timeline (newest enrichment-history rows, with timeline_total). fixed_branches lists each affected range on record (from introduced ("0" is the first version) to below fixed, or through last_affected, with advisory_id (its OSV record) and source); in the ecosystem's version order, an affected version's fix is the first fixed above it that no range of its row holds (none past a range with no fixed). fixed_version is one range's fix, kept for compatibility, not the fix for every affected range. fixed_branches [] is not a finding that no fix exists. verified_status is the source's label, not a guarantee the exploit works on a given system. An empty exploits list is not evidence that no public exploit exists: it covers only the sources EchelonGraph ingests, and which are polled depends on the deployment. A section the API could not read is named in coverage.sections_failed and left out of data, never relayed as an empty list. Its structured result carries notes, with data, which the first text block holds whole up to 30,000 characters; its coverage names the sections relayed, failed and left out. ${TEXT_BUDGET_DESCRIPTION}`;
 // ── outputSchema ──
 const Rows = (shape) => z.array(z.looseObject(shape));
 const CountMap = z.record(z.string(), z.number());
@@ -101,7 +149,7 @@ function schemas() {
         cve_id: z.string(),
         cwes: Rows({ cwe_id: opt(z.string()), name: opt(z.string()), source: opt(z.string()) }).optional(),
         exploits: Rows({
-            kind: opt(z.string()).describe("metasploit, exploit_db, nuclei_template, github_poc or vendor_poc."),
+            kind: opt(z.string()).describe(EXPLOIT_KIND_DESCRIPTION),
             source_name: opt(z.string()),
             source_url: opt(z.string()),
             description: opt(z.string()),
@@ -114,7 +162,7 @@ function schemas() {
         }).optional(),
         exploits_total: z.number().int().nullable().optional().describe("Every exploit reference on record for the CVE, not only those listed in exploits."),
         exploits_capped: z.boolean().optional().describe("true: exploits lists fewer references than exploits_total."),
-        exploits_by_kind: CountMap.optional(),
+        exploits_by_kind: CountMap.optional().describe(EXPLOITS_BY_KIND_DESCRIPTION),
         exploits_by_status: CountMap.optional(),
         affected_packages: Rows({
             ecosystem: opt(z.string()),
@@ -182,24 +230,70 @@ function cweSentence(cve, cwes) {
     });
     return `${cve} is classified under ${listed(named)}.`;
 }
-// #3039: exploit code and detection templates are counted apart. A Nuclei template
-// (nuclei_template) checks whether a system is affected; it is not necessarily exploit code
-// (core-backend egkev.ExploitCodeKinds, #3038), and until #3039 the note called a Nuclei-only CVE's
-// one template "1 public exploit reference" (CVE-2026-42018 on the hosted endpoint, 2026-10-10;
-// 2,800 production CVEs hold only Nuclei rows). The kind counts are exploits_by_kind's, and where
-// the answer carries none, the listed rows' when they are every reference on record.
-const DETECTION_KIND = "nuclei_template";
+const DETECTION_NOUN = {
+    nuclei_template: ["Nuclei detection template", "Nuclei detection templates"],
+    github_checker: ["GitHub checker repository", "GitHub checker repositories"],
+};
+// /pulse's DETECTION_TEMPLATE_NOTE and CHECKER_REPOSITORY_NOTE, each lower-cased and without its
+// period, to follow a colon, a semicolon or an opening parenthesis.
 const DETECTION_NOTE = "a detection template checks whether a system is affected; it is not necessarily exploit code";
+const CHECKER_NOTE = "a GitHub repository named or described as a checker or scanner checks whether a system is affected; it is not necessarily exploit code";
+// Both kinds: /pulse's two notes in sequence, as the page prints them, never one merged sentence.
+const BOTH_DETECTION_NOTES = `${DETECTION_NOTE}. ${CHECKER_NOTE[0].toUpperCase()}${CHECKER_NOTE.slice(1)}`;
 const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
-// The number of Nuclei detection templates among the references: exploits_by_kind's count where
-// the answer carries the map, the listed rows' where they are all of them, undefined otherwise.
-function templateCount(d, rows, total) {
+const detectedTotal = (c) => DETECTION_KINDS.reduce((s, k) => s + c[k], 0);
+// "1 Nuclei detection template", "3 GitHub checker repositories": each detection kind present.
+const detectionParts = (c) => DETECTION_KINDS.filter((k) => c[k] > 0).map((k) => plural(c[k], ...DETECTION_NOUN[k]));
+// What the detection kinds present are: the template's note, the checker's, or both in sequence.
+const detectionNote = (c) => c.nuclei_template > 0 && c.github_checker > 0 ? BOTH_DETECTION_NOTES : c.github_checker > 0 ? CHECKER_NOTE : DETECTION_NOTE;
+// #3267: a kind on neither list. The note names it only when it reads as a kind (a lower-case
+// identifier, as every exploits.Kind* value is), so the note never carries other text the API sent.
+const UNCLASSIFIED_NOUN = ["reference of a kind this server does not classify", "references of a kind this server does not classify"];
+const KIND_TOKEN = /^[a-z][a-z0-9_]{0,63}$/;
+const unknownKindsOf = (kinds) => [...new Set(kinds.filter((k) => k !== undefined && KIND_TOKEN.test(k) && !isExploitCodeKind(k) && !isDetectionKind(k)))].sort();
+const unclassifiedNote = (kinds) => kinds.length === 0
+    ? "a reference of no kind this server classifies is counted as neither exploit code nor a detection check"
+    : kinds.length === 1
+        ? `the kind ${kinds[0]} is one this server does not classify: it is counted as neither exploit code nor a detection check, and a newer release of this server may classify it`
+        : `the kinds ${listed(kinds)} are ones this server does not classify: they are counted as neither exploit code nor a detection check, and a newer release of this server may classify them`;
+const capitalized = (s) => `${s[0].toUpperCase()}${s.slice(1)}`;
+// The listed rows by class.
+function countsIn(rows) {
+    const kinds = rows.map((r) => strAt(r, "kind"));
+    const detections = Object.fromEntries(DETECTION_KINDS.map((k) => [k, kinds.filter((x) => x === k).length]));
+    const code = kinds.filter(isExploitCodeKind).length;
+    return { code, detections, unclassified: rows.length - code - detectedTotal(detections), unknownKinds: unknownKindsOf(kinds) };
+}
+// Every reference on record by class: exploits_by_kind's counts where the answer carries the map,
+// the listed rows' where they are all of them, undefined otherwise. With the map, what its
+// exploit-code and detection kinds do not account for of exploits_total is unclassified.
+function kindCounts(d, rows, total) {
     const byKind = field(d, "exploits_by_kind");
-    if (byKind !== null && typeof byKind === "object" && !Array.isArray(byKind))
-        return numAt(d, "exploits_by_kind", DETECTION_KIND) ?? 0;
-    const listed = rows.filter((r) => strAt(r, "kind") === DETECTION_KIND).length;
-    return total === undefined || rows.length === total ? listed : undefined;
+    if (byKind !== null && typeof byKind === "object" && !Array.isArray(byKind)) {
+        const at = (k) => numAt(d, "exploits_by_kind", k) ?? 0;
+        const detections = Object.fromEntries(DETECTION_KINDS.map((k) => [k, at(k)]));
+        const code = EXPLOIT_CODE_KINDS.reduce((s, k) => s + at(k), 0);
+        return {
+            code,
+            detections,
+            unclassified: Math.max(0, total - code - detectedTotal(detections)),
+            unknownKinds: unknownKindsOf(Object.keys(byKind).filter((k) => at(k) > 0)),
+        };
+    }
+    return rows.length === total ? countsIn(rows) : undefined;
 }
+// "1 public exploit reference, 1 Nuclei detection template and 1 reference of a kind this server
+// does not classify": each class present, exploit code first.
+const classParts = (c) => [
+    ...(c.code > 0 ? [plural(c.code, "public exploit reference", "public exploit references")] : []),
+    ...detectionParts(c.detections),
+    ...(c.unclassified > 0 ? [plural(c.unclassified, ...UNCLASSIFIED_NOUN)] : []),
+];
+// What the classes present beside exploit code are: the detection note(s), then the unclassified
+// kind's, each its own sentence.
+const classNotes = (c) => [...(detectedTotal(c.detections) > 0 ? [detectionNote(c.detections)] : []), ...(c.unclassified > 0 ? [unclassifiedNote(c.unknownKinds)] : [])]
+    .map((n, i) => (i === 0 ? n : capitalized(n)))
+    .join(". ");
 function exploitSentences(cve, d, rows) {
     const total = numAt(d, "exploits_total");
     const verified = numAt(d, "exploits_by_status", "verified");
@@ -213,13 +307,12 @@ function exploitSentences(cve, d, rows) {
                 `exploits is empty and the answer carries no exploits_total, so it does not count the references on record for ${cve}; an empty list is not evidence that no public exploit exists.`,
             ];
         }
-        const listedTemplates = rows.filter((r) => strAt(r, "kind") === DETECTION_KIND).length;
-        const code = rows.length - listedTemplates;
-        const what = listedTemplates === 0
+        const shown = countsIn(rows);
+        const what = shown.code === rows.length
             ? `${plural(rows.length, "public exploit reference", "public exploit references")}`
-            : code === 0
-                ? `${plural(rows.length, "Nuclei detection template", "Nuclei detection templates")} and nothing else (${DETECTION_NOTE})`
-                : `${plural(rows.length, "reference", "references")}: ${plural(code, "public exploit reference", "public exploit references")} and ${plural(listedTemplates, "Nuclei detection template", "Nuclei detection templates")} (${DETECTION_NOTE})`;
+            : shown.code === 0 && shown.unclassified === 0
+                ? `${listed([...detectionParts(shown.detections), "nothing else"])} (${classNotes(shown)})`
+                : `${plural(rows.length, "reference", "references")}: ${listed(classParts(shown))} (${classNotes(shown)})`;
         return [`exploits lists ${what} for ${cve}, ${verifiedRows} with verified_status verified; the answer carries no exploits_total, so it does not say how many are on record.${cut}`];
     }
     if (total === 0) {
@@ -229,23 +322,23 @@ function exploitSentences(cve, d, rows) {
     }
     const v = verified === undefined ? "" : `, ${verified} of them with verified_status verified`;
     const cut = capped === true ? ` exploits_capped is true: exploits lists ${rows.length} of the ${total}, verified first.` : "";
-    const templates = templateCount(d, rows, total);
-    if (templates === undefined) {
+    const counts = kindCounts(d, rows, total);
+    if (counts === undefined) {
         return [
-            `EchelonGraph holds ${plural(total, "reference", "references")} for ${cve} (exploits_total)${v}; the answer carries no exploits_by_kind, so it does not say how many are exploit code and how many Nuclei detection templates (${DETECTION_NOTE}).${cut}`,
+            `EchelonGraph holds ${plural(total, "reference", "references")} for ${cve} (exploits_total)${v}; the answer carries no exploits_by_kind, so it does not say how many are exploit code and how many detection checks, Nuclei detection templates or GitHub checker repositories (${BOTH_DETECTION_NOTES}).${cut}`,
         ];
     }
-    if (templates === 0) {
+    const detected = detectedTotal(counts.detections);
+    if (detected === 0 && counts.unclassified === 0) {
         return [`EchelonGraph holds ${plural(total, "public exploit reference", "public exploit references")} for ${cve} (exploits_total)${v}.${cut}`];
     }
-    if (templates >= total) {
+    // Only detection checks: no exploit code, and no kind this server cannot vouch for.
+    if (counts.code === 0 && counts.unclassified === 0) {
         return [
-            `EchelonGraph holds ${plural(total, "Nuclei detection template", "Nuclei detection templates")} for ${cve} and nothing else in exploits (exploits_total ${total}): ${DETECTION_NOTE}. It holds no Metasploit module, Exploit-DB entry or proof of concept for ${cve}, which is not evidence that none exists.${cut}`,
+            `EchelonGraph holds ${listed(detectionParts(counts.detections))} for ${cve} and nothing else in exploits (exploits_total ${total}): ${detectionNote(counts.detections)}. It holds no Metasploit module, Exploit-DB entry or proof of concept for ${cve}, which is not evidence that none exists.${cut}`,
         ];
     }
-    return [
-        `EchelonGraph holds ${plural(total, "reference", "references")} for ${cve} (exploits_total)${v}: ${plural(total - templates, "public exploit reference", "public exploit references")} and ${plural(templates, "Nuclei detection template", "Nuclei detection templates")}; ${DETECTION_NOTE}.${cut}`,
-    ];
+    return [`EchelonGraph holds ${plural(total, "reference", "references")} for ${cve} (exploits_total)${v}: ${listed(classParts(counts))}; ${classNotes(counts)}.${cut}`];
 }
 function listSentence(name, rows) {
     const limit = API_ROW_LIMIT[name] ?? 0;
@@ -254,6 +347,15 @@ function listSentence(name, rows) {
     const cut = rows.length >= limit ? `, the most the API returns per CVE, so there may be more` : "";
     return `${name} lists ${rows.length} row${rows.length === 1 ? "" : "s"}${cut}.`;
 }
+// #3285 (3.1.0's lane P): affected_packages lists a package once per stored ecosystem string, as
+// cve_remediation's fixed_branches does, so CVE-2025-48013 has two rows for
+// drupal/quick_node_block, under Packagist:https://packages.drupal.org/8 ([0, 2.0.1)) and Packagist
+// ([0, 2.0.0)), each of one range, and "no range of the row holds", read row by row, gave a
+// Packagist 1.0.0 the fix 2.0.0, which the Drupal row still holds affected. Rows the matcher reads
+// as one package (packageRecords.ts, core-backend registryRecordKey: Packagist or Maven, bare or
+// with a repository URL; a release suffix never) are now said of together, with the walk over all
+// their ranges, which gives 2.0.1, the matcher's fixed_in, and the sentence on rows of several
+// ranges names the others.
 // #2817: where fixed_version is not the whole answer. A row with more than one range in
 // fixed_branches has a fix per range; a row with fixed_branches null has only fixed_version on
 // record, and so does a row with fixed_branches [] and a fixed_version (no version range on
@@ -277,9 +379,12 @@ function branchSentences(rows) {
     const multi = [];
     const unknown = [];
     const noRange = [];
+    // #3285: rows the matcher reads as one package (packageRecords.ts) are said of together, below.
+    const { twice } = packagesListedTwice(rows);
+    const together = new Set(twice.flatMap((g) => g.rows));
     rows.forEach((r, i) => {
         const fb = field(r, "fixed_branches");
-        if (Array.isArray(fb) && fb.length > 1)
+        if (Array.isArray(fb) && fb.length > 1 && !together.has(i))
             multi.push(named(r, i));
         if (fb === null)
             unknown.push(named(r, i));
@@ -290,6 +395,11 @@ function branchSentences(rows) {
     if (multi.length) {
         out.push(`${multi.length} affected_packages row${multi.length === 1 ? " lists" : "s list"} more than one affected range in fixed_branches (${few(multi)}): there, fixed_version is one range's fix, and an installed version's fix is the first fixed above it that no range of the row holds: the fixed of the range that holds it, or, while another range still holds that version, that range's fixed (none where a range on the way has no fixed).`);
     }
+    if (twice.length) {
+        const rowsOf = twice.reduce((t, g) => t + g.rows.length, 0);
+        const pkgs = twice.map((g) => `${g.name} (${listed(g.ecosystems)})`);
+        out.push(`${rowsOf} affected_packages rows are ${twice.length} package${twice.length === 1 ? "" : "s"} (${few(pkgs)}): ${ONE_PACKAGE_RULE("Rows")}, so there an installed version's fix is the first fixed above it that no range of those rows holds: the fixed of the range that holds it, or, while another range of them still holds that version, that range's fixed (none where a range on the way has no fixed); each row's fixed_version is one range's fix.`);
+    }
     if (unknown.length) {
         out.push(`${unknown.length} affected_packages row${unknown.length === 1 ? " carries" : "s carry"} fixed_branches null (${few(unknown)}): ${unknown.length === 1 ? "its" : "their"} ranges are not on record, so fixed_version, one range's fix, is all the answer holds, and it need not be the fix for a given installed version.`);
     }

package/dist/tools/cve_remediation.js

@@ -40,6 +40,7 @@ import { ANNOTATIONS, CVE_ID, SHOWN_BASE, api, badInput, checked, crashed, envel
 import { answering, FULL_ARG, TEXT_BUDGET_DESCRIPTION } from "../textBudget.js";
 import { fixStatusSchema } from "../fixStatus.js";
 import { MATCH_HEADERS } from "./check_affected.js";
+import { ONE_PACKAGE_RULE, packagesListedTwice } from "./packageRecords.js";
 const TOOL = "cve_remediation";
 const SECTIONS = ["cisa", "fixed_branches", "vendor_remediations", "fix_references", "patches"];
 const KINDS = ["vendor_fix", "workaround", "mitigation", "no_fix_planned", "none_available", "other"];
@@ -152,15 +153,6 @@ function schemas() {
 }
 let built;
 const schemasOnce = () => (built ??= schemas());
-// The text cut: vendor texts go first, the kinds, states and URLs stay.
-const CUT = {
-    rows: "vendor_remediations",
-    levels: [
-        { keep: ["vendor", "vendor_advisory_id", "withdrawn", "remediation_state", "remediation_kinds", "items_total", ["items", ["kind", "source_category", "text", "url", "fixed_build"]]], clip: 400, cap: 16 },
-        { keep: ["vendor", "vendor_advisory_id", "remediation_state", "remediation_kinds", ["items", ["kind", "url"]]], clip: 2048, cap: 8 },
-    ],
-    whole: "get_vendor_advisory returns any one of these advisories by its vendor and vendor_advisory_id, whole in its structuredContent.data with full: true, with every remediation item it lists.",
-};
 // #3013: the structured result's cut. CVE-2021-44228's answer is 75,963 characters of structured
 // result, 61,248 of them its 20 vendor_remediations, whose items carry the vendor's text (about 550
 // characters an item, the payload) and its product_ids (about 550, the vendor's own identifiers).
@@ -215,6 +207,21 @@ const CUT = {
 const ADVISORY_FIELDS = ["vendor", "vendor_display_name", "vendor_advisory_id", "vendor_published_at", "withdrawn", "remediation_state", "remediation_kinds", "items_total"];
 const ITEM_TEXT_ELSEWHERE = "No item in data keeps its text, the vendor's own wording of the step (a workaround or mitigation among them): get_vendor_advisory, given an advisory's vendor and its vendor_advisory_id as advisory_id, returns it among that advisory's remediations, whole in its structuredContent.data with full: true.";
 const FIXED_BRANCHES_THIN = ["ecosystem", "package_name", "version_range", "fixed_version", ["fixed_branches", ["introduced", "fixed", "last_affected"]]];
+// A package whose ranges a cut keeps the first `cap` of: fixed_branches_truncated with its total
+// and returned. The structured cut's step 2 marks them so, and (3.1.0's phase A review) the text's.
+const rangesTruncated = (row, cap) => {
+    const n = Array.isArray(row.fixed_branches) ? row.fixed_branches.length : 0;
+    return n > cap ? { fixed_branches_truncated: { total: n, returned: cap } } : {};
+};
+// 3.1.0's phase C review: the note's fix walk ("the first fixed above it that no range of its
+// package holds", branchSentence below), over a capped package's kept ranges alone, can name a
+// version a range left out still holds (test/cve_remediation.test.mjs: a package whose every fix
+// the next range holds walks to c.0.0 over its first c ranges, to N.0.0 over all N). Both notes say
+// so of a capped package, and where its fix is read: data with full: true (the text beside a cut
+// data, and data itself), or data as it is (the text beside a data the call asked whole).
+const CAPPED_FIX_DATA = "its fix, walked over its kept ranges alone, can be wrong (read that package's fix with full: true)";
+const cappedFixText = (full) => `A capped package's fix, walked over its kept ranges alone, can be wrong: read that package's fix ${full ? "with full: true" : "from structuredContent.data"}.`;
+const PATCHES_THIN = ["vendor", "patch_url", "published_at"];
 const CVE_REMEDIATION_DATA = {
     steps: [
         {
@@ -233,11 +240,8 @@ const CVE_REMEDIATION_DATA = {
                     keep: FIXED_BRANCHES_THIN,
                     capped: "fixed_branches",
                     least: 1,
-                    mark: (row, cap) => {
-                        const n = Array.isArray(row.fixed_branches) ? row.fixed_branches.length : 0;
-                        return n > cap ? { fixed_branches_truncated: { total: n, returned: cap } } : {};
-                    },
-                    said: (cap) => `each package's fixed_branches keeping at most its first ${cap} ranges, a package with more carrying fixed_branches_truncated with its total and returned`,
+                    mark: rangesTruncated,
+                    said: (cap) => `each package's fixed_branches keeping at most its first ${cap} range${cap === 1 ? "" : "s"}, a package with more carrying fixed_branches_truncated with its total and returned, and ${CAPPED_FIX_DATA}`,
                 },
             ],
             keepAll: true,
@@ -246,20 +250,76 @@ const CVE_REMEDIATION_DATA = {
         // #3139 round 3: every patch row stays, thinned (keepAll), while the step after it (any other
         // list at the top of data: fix_references) is cut; patch rows leave only after that, and
         // before any fixed_branches row or advisory (the last keepAll step's entries leave first).
-        { lists: ["patches"], thin: [["vendor", "patch_url", "published_at"]], keepAll: true },
+        { lists: ["patches"], thin: [PATCHES_THIN], keepAll: true },
     ],
     // Said where the advisories kept are thinned to a level whose items keep no text, and (#3139)
     // wherever an advisory is left out.
     page: (t, _d, at) => {
         const items = at.keeps.vendor_remediations?.find((x) => typeof x !== "string" && x[0] === "items");
         const v = t.vendor_remediations;
-        return [items && !items[1].includes("text") ? ITEM_TEXT_ELSEWHERE : "", v && v.returned < v.total ? advisoriesElsewhere(v.total - v.returned) : ""].filter(Boolean).join(" ");
+        return [items && !items[1].includes("text") ? ITEM_TEXT_ELSEWHERE : "", v && v.returned < v.total ? advisoriesElsewhere(v.total - v.returned, "data") : ""].filter(Boolean).join(" ");
     },
 };
 // #3139: where the advisories a cut leaves out are read. vendor_advisories_for_cve lists every one
 // naming the CVE, with its vendor and vendor_advisory_id (CVE-2023-44487's 20 at 15,505
-// characters on hosted 3.0.0), and get_vendor_advisory then returns any one whole.
-const advisoriesElsewhere = (n) => `vendor_advisories_for_cve, given this CVE, lists every vendor advisory naming it, the ${n} left out of data among them, each with its vendor and vendor_advisory_id.`;
+// characters on hosted 3.0.0), and get_vendor_advisory then returns any one whole. #3272: the
+// first text block's cut says it too, of the advisories it leaves out.
+const advisoriesElsewhere = (n, of) => `vendor_advisories_for_cve, given this CVE, lists every vendor advisory naming it, the ${n} left out of ${of} among them, each with its vendor and vendor_advisory_id.`;
+// The text cut: vendor texts go first, the kinds, states and URLs stay.
+// #3272: through 3.0.2 the first text block was still cut the 3.0.0 way, which #3139 fixed only in
+// structuredContent.data: CUT named no list beside the advisories, so once its leanest level did not
+// fit, advisories left the text from the end while fixed_branches, patches and fix_references stayed
+// whole beside them. On the recorded CVE-2023-44487 answer (test/fixtures/cve_remediation-
+// CVE-2023-44487.json) the text kept 19 of 20 advisories beside 50/50 fixed_branches and 30/30
+// patches, and the same answer with 1, 5, 10 and 16 more fixed_branches packages 18, 13, 8 and 2
+// (from 18 more, the text fell through to step 4's every-list cap and kept 20 again); the TEXT CUT
+// note named get_vendor_advisory, which needs the advisory's ID, and never vendor_advisories_for_cve.
+// Now the text follows the structured cut's order (beforeRows, textBudget.ts step 3): the advisories
+// are cut level by level with every list beside them whole; once the leanest level does not fit,
+// fixed_branches is cut to FIXED_BRANCHES_THIN's fields, then patches to PATCHES_THIN's, every row
+// kept; then fix_references, then patches, then fixed_branches lose rows from the end, each emptied
+// before the next loses any; only then do advisories leave, from the end, and the note names
+// vendor_advisories_for_cve as where the rest are. The recorded answer now keeps all 20 advisories
+// beside every fixed_branches row (thinned), patch and fix_reference.
+// 3.1.0's phase A review: the text kept every range of each fixed_branches row it kept, capping no
+// package's ranges as the structured cut's step 2 does, so a package too long to fit alone left the
+// text with every package after it, and the lists emptied before it stayed empty: CVE-2023-44487's
+// answer with one package of N ranges put first among 51 kept 11 of 20 references at 150 ranges, 51
+// packages, 14 patches and no reference at 200, 43 packages and no patch at 250, and, from 400
+// ranges, no package, patch or reference in 6,347 characters, where 3.0.2's every-list cap kept 32
+// packages, 30 patches and 20 references at every size. Now, once fixed_branches and patches are
+// thinned and the text still does not fit, each package's ranges are cut to its first c, the most
+// that fit with patches and references as they stand (at least 1), every package kept and marked
+// fixed_branches_truncated as data marks it; only if 1 does not fit do references, then patches,
+// then packages leave from the end, and the room they leave goes back to c. The note names the
+// packages so cut and says data holds every range.
+const CUT = {
+    rows: "vendor_remediations",
+    levels: [
+        { keep: ["vendor", "vendor_advisory_id", "withdrawn", "remediation_state", "remediation_kinds", "items_total", ["items", ["kind", "source_category", "text", "url", "fixed_build"]]], clip: 400, cap: 16 },
+        { keep: ["vendor", "vendor_advisory_id", "remediation_state", "remediation_kinds", ["items", ["kind", "url"]]], clip: 2048, cap: 8 },
+    ],
+    sides: [
+        {
+            list: "fixed_branches",
+            keep: FIXED_BRANCHES_THIN,
+            beforeRows: true,
+            capped: {
+                list: "fixed_branches",
+                least: 1,
+                mark: rangesTruncated,
+                name: (e) => `${strAt(e, "package_name") ?? "?"} (${strAt(e, "ecosystem") ?? "?"})`,
+                said: (cap, names, full) => `In it, each package's fixed_branches keeps at most its first ${cap} range${cap === 1 ? "" : "s"}: ${names.length <= 3 ? listed(names) : `${names.slice(0, 3).join(", ")} and ${names.length - 3} more`} ${names.length === 1 ? "has more, carrying" : "have more, each carrying"} fixed_branches_truncated with its total and returned, and structuredContent.data holds every range${full ? " with full: true" : ""}. ${cappedFixText(full)}`,
+            },
+        },
+        { list: "patches", keep: PATCHES_THIN, beforeRows: true },
+        { list: "fix_references", beforeRows: true },
+    ],
+    whole: "get_vendor_advisory returns any one of these advisories by its vendor and vendor_advisory_id, whole in its structuredContent.data with full: true, with every remediation item it lists.",
+    page: (inText, rows) => advisoriesElsewhere(rows - inText, "the first text block"),
+};
+// The text cut, for the tests that replay it (test/cve_remediation.test.mjs).
+export { CUT as CVE_REMEDIATION_TEXT_CUT };
 const listed = (xs) => (xs.length <= 1 ? (xs[0] ?? "") : `${xs.slice(0, -1).join(", ")} and ${xs.at(-1)}`);
 const arr = (v) => (Array.isArray(v) ? v : null);
 const strs = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === "string") : null);
@@ -293,6 +353,21 @@ function vendorSentences(cve, rows) {
         out.push(`${few(states.withdrawn)} ${states.withdrawn.length === 1 ? "was" : "were"} withdrawn by ${states.withdrawn.length === 1 ? "its" : "their"} vendor: ${states.withdrawn.length === 1 ? "its" : "their"} remediation is not relayed.`);
     return out;
 }
+// #3285: the ecosystems whose ":" suffix is a repository, not a release (core-backend
+// cve/pkgecosystem.go baseTokenMatchableEcosystems): an entry of one package_name under
+// "Packagist:https://packages.drupal.org/8" and one under "Packagist" are one package to the
+// matcher (cve/pkgmatch_fixedin.go registryRecordKey), which walks their ranges together; a
+// release suffix (Debian:12, Alpine:v3.20) is never folded. CVE-2025-48013's fixed_branches lists
+// drupal/quick_node_block under both (fixed 2.0.1 and fixed 2.0.0, each from 0): read entry by
+// entry, the rule gave a Packagist 1.0.0 the fix 2.0.0, which the Drupal advisory still holds
+// affected; as one package it gives 2.0.1, the matcher's fixed_in. packageRecords.ts holds the
+// reading, which cve_intel's note states of affected_packages too.
+// The packages fixed_branches lists under more than one such ecosystem, each as its package_name
+// with the ecosystems it is listed under, and how many entries fold into another so.
+function onePackageListedTwice(rows) {
+    const { twice, folded } = packagesListedTwice(rows);
+    return { named: twice.map((g) => `${g.name} (${listed(g.ecosystems)})`), folded };
+}
 function branchSentence(rows) {
     if (rows.length === 0)
         return "fixed_branches is empty: no affected package range is on record, which is not a finding that no fix exists.";
@@ -305,7 +380,14 @@ function branchSentence(rows) {
                 fixed++;
         }
     }
-    return `fixed_branches lists ${rows.length} affected package${rows.length === 1 ? "" : "s"} with ${ranges} affected range${ranges === 1 ? "" : "s"}, ${fixed} with a fix on record; an installed version's fix is the first fixed above it that no range of its package holds (the fixed of the range that holds it, or, while another range still holds that version, that range's fixed), compared in the ecosystem's version order.`;
+    const twice = onePackageListedTwice(rows);
+    const packages = rows.length - twice.folded;
+    const listedAs = twice.folded === 0 ? `${rows.length} affected package${rows.length === 1 ? "" : "s"}` : `${rows.length} entries, ${packages} affected package${packages === 1 ? "" : "s"},`;
+    const rule = `fixed_branches lists ${listedAs} with ${ranges} affected range${ranges === 1 ? "" : "s"}, ${fixed} with a fix on record; an installed version's fix is the first fixed above it that no range of its package holds (the fixed of the range that holds it, or, while another range still holds that version, that range's fixed), compared in the ecosystem's version order.`;
+    if (twice.named.length === 0)
+        return rule;
+    const few = twice.named.length <= 3 ? listed(twice.named) : `${twice.named.slice(0, 3).join(", ")} and ${twice.named.length - 3} more`;
+    return `${rule} ${ONE_PACKAGE_RULE("Entries")}: here ${few}.`;
 }
 // fix_status's sentence: what the API's rule says, relayed. Nothing about the fix is inferred here.
 function fixStatusSentence(cve, fs) {

package/dist/tools/epss_history.js

@@ -27,10 +27,11 @@ const ApiCoverage = (instant) => z.looseObject({
     first_day: opt(Day).describe("The earliest score date in the run log."),
     last_day: opt(Day).describe("The latest score date in the run log."),
     days_held: opt(z.number().int().min(0)).describe("Score dates from first_day to last_day that a refresh applied completely."),
-    days_partial: opt(z.array(Day)).describe("Score dates whose refreshes all failed part-way: some CVEs hold that day, some do not."),
+    days_partial: opt(z.array(Day)).describe("Score dates no refresh completed and one failed part-way: some CVEs hold that day, some do not. Also in days_in_progress while a retry of it has not finished."),
     days_missing: opt(z.array(Day)).describe("Score dates from first_day to last_day that no refresh applied."),
-    runs_undated: opt(z.number().int().min(0)),
-    refresh_runs_truncated: opt(z.boolean()),
+    days_in_progress: opt(z.array(Day)).describe("Score dates no refresh completed and one that has not finished is applying: some CVEs hold that day so far. Not counted held or missing; also in days_partial when an earlier refresh of it failed part-way."),
+    runs_undated: opt(z.number().int().min(0)).describe("Logged refreshes with no score date: the days they applied are not counted held, partial or in progress, and their points carry no score_date."),
+    refresh_runs_truncated: opt(z.boolean()).describe("True when only the newest refreshes of the run log were read, so the earliest score dates are not listed."),
 });
 const data = (instant) => z.looseObject({
     cve_id: z.string(),
@@ -62,13 +63,28 @@ export function epssHistoryOutput(kit) {
             first_day: z.string().nullable().describe("The earliest FIRST score date the run log lists; null when it lists none."),
             last_day: z.string().nullable(),
             days_held: z.number().int().min(0).nullable().describe("Score dates from first_day to last_day the record holds; null when none are listed."),
-            days_partial: z.array(z.string()).describe("Score dates held for some CVEs only."),
+            days_partial: z.array(z.string()).describe("Score dates held for some CVEs only, because their refreshes failed part-way."),
             days_missing: z.array(z.string()).describe("Score dates from first_day to last_day the record does not hold."),
+            days_in_progress: z
+                .array(z.string())
+                .nullable()
+                .describe("Score dates a refresh that has not finished is applying (#3143): held for some CVEs so far. A date an earlier refresh failed part-way on is in days_partial too. Null when the API did not say."),
+            runs_undated: z
+                .number()
+                .int()
+                .min(0)
+                .nullable()
+                .describe("Logged refreshes with no score date (#3143): the days they applied are not counted, so a day in days_missing may be held for the CVEs they changed, and their points carry no score_date. Null when the API did not say."),
+            refresh_runs_truncated: z
+                .boolean()
+                .nullable()
+                .describe("True when only the newest refreshes of the run log were read, so the earliest score dates are not listed; null when the API did not say."),
         }),
         freshness: null,
     });
 }
 const isNum = (v) => typeof v === "number" && Number.isFinite(v);
+const isCount = (v) => Number.isInteger(v) && v >= 0;
 const isObj = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
 const realInstant = (v) => typeof v === "string" && Date.parse(v) > 0;
 const isDay = (v) => typeof v === "string" && /^\d{4}-\d{2}-\d{2}$/.test(v);
@@ -96,7 +112,10 @@ function completeness(d, points) {
         daysHeld: firstDay && isNum(cov.days_held) ? cov.days_held : undefined,
         daysPartial: dayList(cov.days_partial),
         daysMissing: dayList(cov.days_missing),
+        daysInProgress: Array.isArray(cov.days_in_progress) ? dayList(cov.days_in_progress) : undefined,
         runLogSince: realInstant(cov.run_log_since) ? cov.run_log_since : undefined,
+        runsUndated: isCount(cov.runs_undated) ? cov.runs_undated : undefined,
+        runsTruncated: typeof cov.refresh_runs_truncated === "boolean" ? cov.refresh_runs_truncated : undefined,
         hasCoverage: isObj(d.coverage),
     };
 }
@@ -146,12 +165,26 @@ function note(head, id, d, c) {
         const held = c.daysHeld === undefined ? "" : `, ${c.daysHeld} held`;
         const missing = c.daysMissing.length ? `; not held: ${sayDays(c.daysMissing, "days_missing")}` : "; none missing";
         const partial = c.daysPartial.length ? `; held for some CVEs only (a refresh failed part-way): ${sayDays(c.daysPartial, "days_partial")}` : "";
+        // #3143: never "nothing failed". A retry of a date whose earlier refresh failed part-way is in
+        // days_partial too, so it is named in both clauses, each true of it.
+        const applying = c.daysInProgress?.length
+            ? `; being applied by a refresh that has not finished, so held for some CVEs so far: ${sayDays(c.daysInProgress, "days_in_progress")}`
+            : "";
         const since = c.runLogSince ? ` (run log since ${c.runLogSince}; earlier dates are not listed)` : "";
-        s.push(`FIRST score dates in EchelonGraph's run log${since}: ${c.firstDay} to ${c.lastDay}${held}${missing}${partial}.`);
+        s.push(`FIRST score dates in EchelonGraph's run log${since}: ${c.firstDay} to ${c.lastDay}${held}${missing}${partial}${applying}.`);
     }
     else if (c.hasCoverage) {
         s.push("The run log lists no FIRST score date yet, so this answer does not say which days the record holds, and no point carries a score_date.");
     }
+    // #3143: said only when non-zero; coverage carries the value either way. "Not counted": in no
+    // list, held, partial or in progress.
+    if (c.runsUndated) {
+        const one = c.runsUndated === 1;
+        s.push(`${c.runsUndated} logged refresh${one ? " has" : "es have"} no FIRST score date (coverage.runs_undated: ${one ? "its file named none, or it" : "their files named none, or they"} stopped before recording it). The day${one ? " it" : "s they"} applied ${one ? "is" : "are"} not counted, so a day listed missing, or not listed, may be held for the CVEs ${one ? "it" : "they"} changed, and the points ${one ? "it" : "they"} wrote carry no score_date.`);
+    }
+    if (c.runsTruncated) {
+        s.push("refresh_runs_truncated is true: only the newest refreshes of the run log were read, so first_day is not where the run log starts, and earlier score dates are not listed.");
+    }
     if (d.points_truncated === true)
         s.push("points_truncated is true: only the newest records were read, so the earliest changes are missing from this series.");
     if (d.latest_point_matches_current === false) {
@@ -193,6 +226,9 @@ export async function epssHistory(kit, cve_id) {
                 days_held: c.daysHeld ?? null,
                 days_partial: c.daysPartial,
                 days_missing: c.daysMissing,
+                days_in_progress: c.daysInProgress ?? null,
+                runs_undated: c.runsUndated ?? null,
+                refresh_runs_truncated: c.runsTruncated ?? null,
             },
             freshness: null,
             notes: [