kirograph 0.16.1 → 0.19.0

package/dist/security/vuln/osv-adapter.js

@@ -0,0 +1,321 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var osv_adapter_exports = {};
+__export(osv_adapter_exports, {
+  OsvAdapter: () => OsvAdapter
+});
+module.exports = __toCommonJS(osv_adapter_exports);
+var import_errors = require("../errors");
+var import_errors2 = require("../../errors");
+const ECOSYSTEM_MAP = {
+  npm: "npm",
+  maven: "Maven",
+  go: "Go",
+  pypi: "PyPI",
+  cargo: "crates.io",
+  pyproject: "PyPI",
+  // pyproject.toml (Poetry/Hatch/PDM/PEP 621)
+  nuget: "NuGet",
+  gradle: "Maven",
+  // Gradle projects use Maven Central
+  rubygems: "RubyGems",
+  composer: "Packagist",
+  swift: "SwiftURL",
+  pub: "Pub",
+  hex: "Hex"
+};
+const OSV_API_URL = "https://api.osv.dev/v1/query";
+const OSV_BATCH_API_URL = "https://api.osv.dev/v1/querybatch";
+const DEFAULT_TIMEOUT_MS = 3e4;
+const OSV_BATCH_MAX_QUERIES = 1e3;
+const MAX_SUMMARY_LENGTH = 500;
+class OsvAdapter {
+  constructor(options) {
+    this.name = "OSV";
+    this.apiUrl = options?.apiUrl ?? OSV_API_URL;
+    this.batchApiUrl = options?.batchApiUrl ?? OSV_BATCH_API_URL;
+    this.timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  }
+  /**
+   * Batch query up to OSV_BATCH_MAX_QUERIES packages in a single HTTP request.
+   * Results are returned in the same order as the input queries.
+   * Queries for unsupported ecosystems produce empty results without an HTTP call.
+   */
+  async queryBatch(queries, signal) {
+    if (queries.length === 0) return [];
+    const osvQueries = [];
+    const indexMap = [];
+    for (const q of queries) {
+      const osvEcosystem = ECOSYSTEM_MAP[q.ecosystem.toLowerCase()];
+      if (!osvEcosystem) {
+        (0, import_errors2.logWarn)(`OSV adapter: unsupported ecosystem "${q.ecosystem}", skipping batch entry`);
+        indexMap.push(null);
+      } else {
+        indexMap.push(osvQueries.length);
+        osvQueries.push({
+          package: { name: q.packageName, ecosystem: osvEcosystem },
+          version: q.version
+        });
+      }
+    }
+    if (osvQueries.length === 0) {
+      return queries.map(() => []);
+    }
+    const timeoutController = new AbortController();
+    const timeoutId = setTimeout(() => timeoutController.abort(), this.timeoutMs);
+    const combinedSignal = signal ? combineAbortSignals(signal, timeoutController.signal) : timeoutController.signal;
+    let batchResults;
+    try {
+      const response = await fetch(this.batchApiUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ queries: osvQueries }),
+        signal: combinedSignal
+      });
+      if (!response.ok) {
+        throw new import_errors.VulnDatabaseError(
+          `OSV batch API returned HTTP ${response.status}: ${response.statusText}`,
+          "OSV",
+          response.status
+        );
+      }
+      const data = await response.json();
+      batchResults = data.results ?? [];
+    } catch (error) {
+      if (error instanceof import_errors.VulnDatabaseError) throw error;
+      if (isAbortError(error)) {
+        const msg2 = timeoutController.signal.aborted ? `OSV batch query timed out after ${this.timeoutMs}ms (${osvQueries.length} packages)` : `OSV batch query aborted`;
+        (0, import_errors2.logError)(msg2);
+        throw new import_errors.VulnDatabaseError(msg2, "OSV");
+      }
+      const msg = error instanceof Error ? error.message : String(error);
+      (0, import_errors2.logError)(`OSV batch query failed: ${msg}`);
+      throw new import_errors.VulnDatabaseError(`Network error in OSV batch query: ${msg}`, "OSV");
+    } finally {
+      clearTimeout(timeoutId);
+    }
+    return queries.map((_, i) => {
+      const osvIdx = indexMap[i];
+      if (osvIdx === null) return [];
+      const resultEntry = batchResults[osvIdx];
+      if (!resultEntry) return [];
+      return this.parseResponse({ vulns: resultEntry.vulns });
+    });
+  }
+  async query(ecosystem, packageName, version, signal) {
+    const osvEcosystem = ECOSYSTEM_MAP[ecosystem.toLowerCase()];
+    if (!osvEcosystem) {
+      (0, import_errors2.logWarn)(`OSV adapter: unsupported ecosystem "${ecosystem}", skipping query`);
+      return [];
+    }
+    const body = JSON.stringify({
+      package: {
+        name: packageName,
+        ecosystem: osvEcosystem
+      },
+      version
+    });
+    const timeoutController = new AbortController();
+    const timeoutId = setTimeout(() => timeoutController.abort(), this.timeoutMs);
+    const combinedSignal = signal ? combineAbortSignals(signal, timeoutController.signal) : timeoutController.signal;
+    try {
+      const response = await fetch(this.apiUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body,
+        signal: combinedSignal
+      });
+      if (!response.ok) {
+        throw new import_errors.VulnDatabaseError(
+          `OSV API returned HTTP ${response.status}: ${response.statusText}`,
+          "OSV",
+          response.status
+        );
+      }
+      const data = await response.json();
+      return this.parseResponse(data);
+    } catch (error) {
+      if (error instanceof import_errors.VulnDatabaseError) {
+        throw error;
+      }
+      if (isAbortError(error)) {
+        const isTimeout = timeoutController.signal.aborted;
+        const message = isTimeout ? `OSV query timed out after ${this.timeoutMs}ms for ${packageName}@${version}` : `OSV query aborted for ${packageName}@${version}`;
+        (0, import_errors2.logError)(message);
+        throw new import_errors.VulnDatabaseError(message, "OSV");
+      }
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      (0, import_errors2.logError)(`OSV query failed for ${packageName}@${version}: ${errorMessage}`);
+      throw new import_errors.VulnDatabaseError(
+        `Network error querying OSV for ${packageName}@${version}: ${errorMessage}`,
+        "OSV"
+      );
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Parse the OSV API response into CVERecord objects.
+   */
+  parseResponse(data) {
+    if (!data.vulns || data.vulns.length === 0) {
+      return [];
+    }
+    const records = [];
+    for (const vuln of data.vulns) {
+      const cveId = this.extractCveId(vuln);
+      if (!cveId) {
+        continue;
+      }
+      const severity = this.extractSeverity(vuln);
+      const { ranges, fixedVersion } = this.extractAffectedRanges(vuln);
+      const summary = this.extractSummary(vuln);
+      records.push({
+        id: cveId,
+        severity,
+        affectedVersionRanges: ranges,
+        fixedVersion,
+        summary
+      });
+    }
+    return records;
+  }
+  /**
+   * Extract CVE ID from the vulnerability's aliases or use the OSV ID.
+   * Prefers CVE-* identifiers from the aliases array.
+   */
+  extractCveId(vuln) {
+    if (vuln.aliases) {
+      const cveAlias = vuln.aliases.find((alias) => alias.startsWith("CVE-"));
+      if (cveAlias) {
+        return cveAlias;
+      }
+    }
+    return vuln.id;
+  }
+  /**
+   * Extract CVSS v3.1 base score from the severity array.
+   * Returns 0 if no CVSS score is available.
+   */
+  extractSeverity(vuln) {
+    if (!vuln.severity || vuln.severity.length === 0) {
+      return 0;
+    }
+    for (const sev of vuln.severity) {
+      if (sev.type === "CVSS_V3") {
+        const score = this.parseCvssScore(sev.score);
+        if (score !== null) {
+          return score;
+        }
+      }
+    }
+    for (const sev of vuln.severity) {
+      const score = this.parseCvssScore(sev.score);
+      if (score !== null) {
+        return score;
+      }
+    }
+    return 0;
+  }
+  /**
+   * Parse a CVSS vector string or numeric score.
+   * CVSS vectors look like: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+   * The base score is not directly in the vector — we extract it if it's a plain number,
+   * or return null if we can't parse it.
+   */
+  parseCvssScore(scoreStr) {
+    const num = parseFloat(scoreStr);
+    if (!isNaN(num) && num >= 0 && num <= 10) {
+      return num;
+    }
+    return null;
+  }
+  /**
+   * Extract affected version ranges and the first fixed version from the vulnerability.
+   */
+  extractAffectedRanges(vuln) {
+    const ranges = [];
+    let fixedVersion;
+    if (!vuln.affected) {
+      return { ranges, fixedVersion };
+    }
+    for (const affected of vuln.affected) {
+      if (!affected.ranges) {
+        continue;
+      }
+      for (const range of affected.ranges) {
+        if (!range.events || range.events.length === 0) {
+          continue;
+        }
+        const versionRange = {};
+        for (const event of range.events) {
+          if (event.introduced) {
+            versionRange.introduced = event.introduced;
+          }
+          if (event.fixed) {
+            versionRange.fixed = event.fixed;
+            if (!fixedVersion) {
+              fixedVersion = event.fixed;
+            }
+          }
+          if (event.last_affected) {
+            versionRange.lastAffected = event.last_affected;
+          }
+        }
+        if (versionRange.introduced || versionRange.fixed || versionRange.lastAffected) {
+          ranges.push(versionRange);
+        }
+      }
+    }
+    return { ranges, fixedVersion };
+  }
+  /**
+   * Extract and truncate the summary from the vulnerability.
+   * Prefers the summary field, falls back to details.
+   */
+  extractSummary(vuln) {
+    const text = vuln.summary || vuln.details || "";
+    if (text.length <= MAX_SUMMARY_LENGTH) {
+      return text;
+    }
+    return text.slice(0, MAX_SUMMARY_LENGTH - 3) + "...";
+  }
+}
+function combineAbortSignals(...signals) {
+  const controller = new AbortController();
+  for (const signal of signals) {
+    if (signal.aborted) {
+      controller.abort(signal.reason);
+      return controller.signal;
+    }
+    signal.addEventListener("abort", () => controller.abort(signal.reason), { once: true });
+  }
+  return controller.signal;
+}
+function isAbortError(error) {
+  if (error instanceof Error) {
+    return error.name === "AbortError" || error.name === "TimeoutError";
+  }
+  return false;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OsvAdapter
+});
+//# sourceMappingURL=osv-adapter.js.map

package/dist/security/vuln/osv-adapter.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/vuln/osv-adapter.ts"],
+  "sourcesContent": ["/**\n * OSV API Adapter\n *\n * Queries the OSV (Open Source Vulnerabilities) database for known CVEs\n * affecting project dependencies. Implements the VulnDatabaseAdapter interface.\n */\n\nimport { CVERecord, VersionRange } from '../types';\nimport type { VulnDatabaseAdapter, BatchQuery } from './types';\nimport { VulnDatabaseError } from '../errors';\nimport { logWarn, logError } from '../../errors';\n\nexport type { VulnDatabaseAdapter, BatchQuery };\n\n// \u2500\u2500 Ecosystem Mapping \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst ECOSYSTEM_MAP: Record<string, string> = {\n  npm: 'npm',\n  maven: 'Maven',\n  go: 'Go',\n  pypi: 'PyPI',\n  cargo: 'crates.io',\n  pyproject: 'PyPI',  // pyproject.toml (Poetry/Hatch/PDM/PEP 621)\n  nuget: 'NuGet',\n  gradle: 'Maven',    // Gradle projects use Maven Central\n  rubygems: 'RubyGems',\n  composer: 'Packagist',\n  swift: 'SwiftURL',\n  pub: 'Pub',\n  hex: 'Hex',\n};\n\n// \u2500\u2500 OSV Request/Response Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface OsvSeverity {\n  type: string;\n  score: string;\n}\n\ninterface OsvAffectedRange {\n  type: string;\n  events: Array<{ introduced?: string; fixed?: string; last_affected?: string }>;\n}\n\ninterface OsvAffected {\n  package?: { name?: string; ecosystem?: string };\n  ranges?: OsvAffectedRange[];\n  versions?: string[];\n}\n\ninterface OsvVulnerability {\n  id: string;\n  aliases?: string[];\n  summary?: string;\n  details?: string;\n  severity?: OsvSeverity[];\n  affected?: OsvAffected[];\n}\n\ninterface OsvQueryResponse {\n  vulns?: OsvVulnerability[];\n}\n\ninterface OsvBatchQueryItem {\n  package: { name: string; ecosystem: string };\n  version: string;\n}\n\ninterface OsvBatchResponse {\n  results: Array<{ vulns?: OsvVulnerability[] }>;\n}\n\n// \u2500\u2500 Constants \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst OSV_API_URL = 'https://api.osv.dev/v1/query';\nconst OSV_BATCH_API_URL = 'https://api.osv.dev/v1/querybatch';\nconst DEFAULT_TIMEOUT_MS = 30_000;\nconst OSV_BATCH_MAX_QUERIES = 1000;\nconst MAX_SUMMARY_LENGTH = 500;\n\n// \u2500\u2500 OsvAdapter Implementation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class OsvAdapter implements VulnDatabaseAdapter {\n  public readonly name = 'OSV';\n\n  private readonly apiUrl: string;\n  private readonly batchApiUrl: string;\n  private readonly timeoutMs: number;\n\n  constructor(options?: { apiUrl?: string; batchApiUrl?: string; timeoutMs?: number }) {\n    this.apiUrl = options?.apiUrl ?? OSV_API_URL;\n    this.batchApiUrl = options?.batchApiUrl ?? OSV_BATCH_API_URL;\n    this.timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  }\n\n  /**\n   * Batch query up to OSV_BATCH_MAX_QUERIES packages in a single HTTP request.\n   * Results are returned in the same order as the input queries.\n   * Queries for unsupported ecosystems produce empty results without an HTTP call.\n   */\n  async queryBatch(\n    queries: BatchQuery[],\n    signal?: AbortSignal,\n  ): Promise<Array<CVERecord[]>> {\n    if (queries.length === 0) return [];\n\n    // Map each query to its OSV ecosystem \u2014 track indices of unsupported ones\n    const osvQueries: OsvBatchQueryItem[] = [];\n    const indexMap: Array<number | null> = []; // index into osvQueries, or null if unsupported\n\n    for (const q of queries) {\n      const osvEcosystem = ECOSYSTEM_MAP[q.ecosystem.toLowerCase()];\n      if (!osvEcosystem) {\n        logWarn(`OSV adapter: unsupported ecosystem \"${q.ecosystem}\", skipping batch entry`);\n        indexMap.push(null);\n      } else {\n        indexMap.push(osvQueries.length);\n        osvQueries.push({\n          package: { name: q.packageName, ecosystem: osvEcosystem },\n          version: q.version,\n        });\n      }\n    }\n\n    if (osvQueries.length === 0) {\n      return queries.map(() => []);\n    }\n\n    const timeoutController = new AbortController();\n    const timeoutId = setTimeout(() => timeoutController.abort(), this.timeoutMs);\n    const combinedSignal = signal\n      ? combineAbortSignals(signal, timeoutController.signal)\n      : timeoutController.signal;\n\n    let batchResults: Array<{ vulns?: OsvVulnerability[] }>;\n\n    try {\n      const response = await fetch(this.batchApiUrl, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ queries: osvQueries }),\n        signal: combinedSignal,\n      });\n\n      if (!response.ok) {\n        throw new VulnDatabaseError(\n          `OSV batch API returned HTTP ${response.status}: ${response.statusText}`,\n          'OSV',\n          response.status,\n        );\n      }\n\n      const data = (await response.json()) as OsvBatchResponse;\n      batchResults = data.results ?? [];\n    } catch (error: unknown) {\n      if (error instanceof VulnDatabaseError) throw error;\n      if (isAbortError(error)) {\n        const msg = timeoutController.signal.aborted\n          ? `OSV batch query timed out after ${this.timeoutMs}ms (${osvQueries.length} packages)`\n          : `OSV batch query aborted`;\n        logError(msg);\n        throw new VulnDatabaseError(msg, 'OSV');\n      }\n      const msg = error instanceof Error ? error.message : String(error);\n      logError(`OSV batch query failed: ${msg}`);\n      throw new VulnDatabaseError(`Network error in OSV batch query: ${msg}`, 'OSV');\n    } finally {\n      clearTimeout(timeoutId);\n    }\n\n    // Rebuild full results array aligned with input queries\n    return queries.map((_, i) => {\n      const osvIdx = indexMap[i];\n      if (osvIdx === null) return [];\n      const resultEntry = batchResults[osvIdx];\n      if (!resultEntry) return [];\n      return this.parseResponse({ vulns: resultEntry.vulns });\n    });\n  }\n\n  async query(\n    ecosystem: string,\n    packageName: string,\n    version: string,\n    signal?: AbortSignal,\n  ): Promise<CVERecord[]> {\n    const osvEcosystem = ECOSYSTEM_MAP[ecosystem.toLowerCase()];\n    if (!osvEcosystem) {\n      logWarn(`OSV adapter: unsupported ecosystem \"${ecosystem}\", skipping query`);\n      return [];\n    }\n\n    const body = JSON.stringify({\n      package: {\n        name: packageName,\n        ecosystem: osvEcosystem,\n      },\n      version,\n    });\n\n    // Create a timeout abort signal and combine with any external signal\n    const timeoutController = new AbortController();\n    const timeoutId = setTimeout(() => timeoutController.abort(), this.timeoutMs);\n\n    const combinedSignal = signal\n      ? combineAbortSignals(signal, timeoutController.signal)\n      : timeoutController.signal;\n\n    try {\n      const response = await fetch(this.apiUrl, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body,\n        signal: combinedSignal,\n      });\n\n      if (!response.ok) {\n        throw new VulnDatabaseError(\n          `OSV API returned HTTP ${response.status}: ${response.statusText}`,\n          'OSV',\n          response.status,\n        );\n      }\n\n      const data = (await response.json()) as OsvQueryResponse;\n      return this.parseResponse(data);\n    } catch (error: unknown) {\n      if (error instanceof VulnDatabaseError) {\n        throw error;\n      }\n\n      if (isAbortError(error)) {\n        const isTimeout = timeoutController.signal.aborted;\n        const message = isTimeout\n          ? `OSV query timed out after ${this.timeoutMs}ms for ${packageName}@${version}`\n          : `OSV query aborted for ${packageName}@${version}`;\n        logError(message);\n        throw new VulnDatabaseError(message, 'OSV');\n      }\n\n      const errorMessage = error instanceof Error ? error.message : String(error);\n      logError(`OSV query failed for ${packageName}@${version}: ${errorMessage}`);\n      throw new VulnDatabaseError(\n        `Network error querying OSV for ${packageName}@${version}: ${errorMessage}`,\n        'OSV',\n      );\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n\n  /**\n   * Parse the OSV API response into CVERecord objects.\n   */\n  private parseResponse(data: OsvQueryResponse): CVERecord[] {\n    if (!data.vulns || data.vulns.length === 0) {\n      return [];\n    }\n\n    const records: CVERecord[] = [];\n\n    for (const vuln of data.vulns) {\n      const cveId = this.extractCveId(vuln);\n      if (!cveId) {\n        // Skip vulnerabilities without a CVE identifier\n        continue;\n      }\n\n      const severity = this.extractSeverity(vuln);\n      const { ranges, fixedVersion } = this.extractAffectedRanges(vuln);\n      const summary = this.extractSummary(vuln);\n\n      records.push({\n        id: cveId,\n        severity,\n        affectedVersionRanges: ranges,\n        fixedVersion,\n        summary,\n      });\n    }\n\n    return records;\n  }\n\n  /**\n   * Extract CVE ID from the vulnerability's aliases or use the OSV ID.\n   * Prefers CVE-* identifiers from the aliases array.\n   */\n  private extractCveId(vuln: OsvVulnerability): string | undefined {\n    // Look for a CVE alias first\n    if (vuln.aliases) {\n      const cveAlias = vuln.aliases.find((alias) => alias.startsWith('CVE-'));\n      if (cveAlias) {\n        return cveAlias;\n      }\n    }\n\n    // Fall back to the OSV ID (e.g., GHSA-xxxx-xxxx-xxxx)\n    return vuln.id;\n  }\n\n  /**\n   * Extract CVSS v3.1 base score from the severity array.\n   * Returns 0 if no CVSS score is available.\n   */\n  private extractSeverity(vuln: OsvVulnerability): number {\n    if (!vuln.severity || vuln.severity.length === 0) {\n      return 0;\n    }\n\n    for (const sev of vuln.severity) {\n      if (sev.type === 'CVSS_V3') {\n        const score = this.parseCvssScore(sev.score);\n        if (score !== null) {\n          return score;\n        }\n      }\n    }\n\n    // Try any severity type as fallback\n    for (const sev of vuln.severity) {\n      const score = this.parseCvssScore(sev.score);\n      if (score !== null) {\n        return score;\n      }\n    }\n\n    return 0;\n  }\n\n  /**\n   * Parse a CVSS vector string or numeric score.\n   * CVSS vectors look like: \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"\n   * The base score is not directly in the vector \u2014 we extract it if it's a plain number,\n   * or return null if we can't parse it.\n   */\n  private parseCvssScore(scoreStr: string): number | null {\n    // If it's a plain number\n    const num = parseFloat(scoreStr);\n    if (!isNaN(num) && num >= 0 && num <= 10) {\n      return num;\n    }\n\n    // CVSS vector strings don't contain the base score directly.\n    // OSV sometimes provides the score as a plain number in the score field.\n    return null;\n  }\n\n  /**\n   * Extract affected version ranges and the first fixed version from the vulnerability.\n   */\n  private extractAffectedRanges(vuln: OsvVulnerability): {\n    ranges: VersionRange[];\n    fixedVersion?: string;\n  } {\n    const ranges: VersionRange[] = [];\n    let fixedVersion: string | undefined;\n\n    if (!vuln.affected) {\n      return { ranges, fixedVersion };\n    }\n\n    for (const affected of vuln.affected) {\n      if (!affected.ranges) {\n        continue;\n      }\n\n      for (const range of affected.ranges) {\n        if (!range.events || range.events.length === 0) {\n          continue;\n        }\n\n        const versionRange: VersionRange = {};\n\n        for (const event of range.events) {\n          if (event.introduced) {\n            versionRange.introduced = event.introduced;\n          }\n          if (event.fixed) {\n            versionRange.fixed = event.fixed;\n            // Capture the first fixed version we encounter\n            if (!fixedVersion) {\n              fixedVersion = event.fixed;\n            }\n          }\n          if (event.last_affected) {\n            versionRange.lastAffected = event.last_affected;\n          }\n        }\n\n        // Only add ranges that have at least one meaningful field\n        if (versionRange.introduced || versionRange.fixed || versionRange.lastAffected) {\n          ranges.push(versionRange);\n        }\n      }\n    }\n\n    return { ranges, fixedVersion };\n  }\n\n  /**\n   * Extract and truncate the summary from the vulnerability.\n   * Prefers the summary field, falls back to details.\n   */\n  private extractSummary(vuln: OsvVulnerability): string {\n    const text = vuln.summary || vuln.details || '';\n    if (text.length <= MAX_SUMMARY_LENGTH) {\n      return text;\n    }\n    return text.slice(0, MAX_SUMMARY_LENGTH - 3) + '...';\n  }\n}\n\n// \u2500\u2500 Utility Functions \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Combine multiple AbortSignals into one that aborts when any of them aborts.\n */\nfunction combineAbortSignals(...signals: AbortSignal[]): AbortSignal {\n  const controller = new AbortController();\n\n  for (const signal of signals) {\n    if (signal.aborted) {\n      controller.abort(signal.reason);\n      return controller.signal;\n    }\n\n    signal.addEventListener('abort', () => controller.abort(signal.reason), { once: true });\n  }\n\n  return controller.signal;\n}\n\n/**\n * Check if an error is an abort/timeout error.\n */\nfunction isAbortError(error: unknown): boolean {\n  if (error instanceof Error) {\n    return error.name === 'AbortError' || error.name === 'TimeoutError';\n  }\n  return false;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,oBAAkC;AAClC,IAAAA,iBAAkC;AAMlC,MAAM,gBAAwC;AAAA,EAC5C,KAAK;AAAA,EACL,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,OAAO;AAAA,EACP,WAAW;AAAA;AAAA,EACX,OAAO;AAAA,EACP,QAAQ;AAAA;AAAA,EACR,UAAU;AAAA,EACV,UAAU;AAAA,EACV,OAAO;AAAA,EACP,KAAK;AAAA,EACL,KAAK;AACP;AA4CA,MAAM,cAAc;AACpB,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,wBAAwB;AAC9B,MAAM,qBAAqB;AAIpB,MAAM,WAA0C;AAAA,EAOrD,YAAY,SAAyE;AANrF,SAAgB,OAAO;AAOrB,SAAK,SAAS,SAAS,UAAU;AACjC,SAAK,cAAc,SAAS,eAAe;AAC3C,SAAK,YAAY,SAAS,aAAa;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WACJ,SACA,QAC6B;AAC7B,QAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAGlC,UAAM,aAAkC,CAAC;AACzC,UAAM,WAAiC,CAAC;AAExC,eAAW,KAAK,SAAS;AACvB,YAAM,eAAe,cAAc,EAAE,UAAU,YAAY,CAAC;AAC5D,UAAI,CAAC,cAAc;AACjB,oCAAQ,uCAAuC,EAAE,SAAS,yBAAyB;AACnF,iBAAS,KAAK,IAAI;AAAA,MACpB,OAAO;AACL,iBAAS,KAAK,WAAW,MAAM;AAC/B,mBAAW,KAAK;AAAA,UACd,SAAS,EAAE,MAAM,EAAE,aAAa,WAAW,aAAa;AAAA,UACxD,SAAS,EAAE;AAAA,QACb,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,WAAW,WAAW,GAAG;AAC3B,aAAO,QAAQ,IAAI,MAAM,CAAC,CAAC;AAAA,IAC7B;AAEA,UAAM,oBAAoB,IAAI,gBAAgB;AAC9C,UAAM,YAAY,WAAW,MAAM,kBAAkB,MAAM,GAAG,KAAK,SAAS;AAC5E,UAAM,iBAAiB,SACnB,oBAAoB,QAAQ,kBAAkB,MAAM,IACpD,kBAAkB;AAEtB,QAAI;AAEJ,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAAA,QAC7C,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,WAAW,CAAC;AAAA,QAC5C,QAAQ;AAAA,MACV,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI;AAAA,UACR,+BAA+B,SAAS,MAAM,KAAK,SAAS,UAAU;AAAA,UACtE;AAAA,UACA,SAAS;AAAA,QACX;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,qBAAe,KAAK,WAAW,CAAC;AAAA,IAClC,SAAS,OAAgB;AACvB,UAAI,iBAAiB,gCAAmB,OAAM;AAC9C,UAAI,aAAa,KAAK,GAAG;AACvB,cAAMC,OAAM,kBAAkB,OAAO,UACjC,mCAAmC,KAAK,SAAS,OAAO,WAAW,MAAM,eACzE;AACJ,qCAASA,IAAG;AACZ,cAAM,IAAI,gCAAkBA,MAAK,KAAK;AAAA,MACxC;AACA,YAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,mCAAS,2BAA2B,GAAG,EAAE;AACzC,YAAM,IAAI,gCAAkB,qCAAqC,GAAG,IAAI,KAAK;AAAA,IAC/E,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAGA,WAAO,QAAQ,IAAI,CAAC,GAAG,MAAM;AAC3B,YAAM,SAAS,SAAS,CAAC;AACzB,UAAI,WAAW,KAAM,QAAO,CAAC;AAC7B,YAAM,cAAc,aAAa,MAAM;AACvC,UAAI,CAAC,YAAa,QAAO,CAAC;AAC1B,aAAO,KAAK,cAAc,EAAE,OAAO,YAAY,MAAM,CAAC;AAAA,IACxD,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MACJ,WACA,aACA,SACA,QACsB;AACtB,UAAM,eAAe,cAAc,UAAU,YAAY,CAAC;AAC1D,QAAI,CAAC,cAAc;AACjB,kCAAQ,uCAAuC,SAAS,mBAAmB;AAC3E,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,SAAS;AAAA,QACP,MAAM;AAAA,QACN,WAAW;AAAA,MACb;AAAA,MACA;AAAA,IACF,CAAC;AAGD,UAAM,oBAAoB,IAAI,gBAAgB;AAC9C,UAAM,YAAY,WAAW,MAAM,kBAAkB,MAAM,GAAG,KAAK,SAAS;AAE5E,UAAM,iBAAiB,SACnB,oBAAoB,QAAQ,kBAAkB,MAAM,IACpD,kBAAkB;AAEtB,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,KAAK,QAAQ;AAAA,QACxC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI;AAAA,UACR,yBAAyB,SAAS,MAAM,KAAK,SAAS,UAAU;AAAA,UAChE;AAAA,UACA,SAAS;AAAA,QACX;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO,KAAK,cAAc,IAAI;AAAA,IAChC,SAAS,OAAgB;AACvB,UAAI,iBAAiB,iCAAmB;AACtC,cAAM;AAAA,MACR;AAEA,UAAI,aAAa,KAAK,GAAG;AACvB,cAAM,YAAY,kBAAkB,OAAO;AAC3C,cAAM,UAAU,YACZ,6BAA6B,KAAK,SAAS,UAAU,WAAW,IAAI,OAAO,KAC3E,yBAAyB,WAAW,IAAI,OAAO;AACnD,qCAAS,OAAO;AAChB,cAAM,IAAI,gCAAkB,SAAS,KAAK;AAAA,MAC5C;AAEA,YAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1E,mCAAS,wBAAwB,WAAW,IAAI,OAAO,KAAK,YAAY,EAAE;AAC1E,YAAM,IAAI;AAAA,QACR,kCAAkC,WAAW,IAAI,OAAO,KAAK,YAAY;AAAA,QACzE;AAAA,MACF;AAAA,IACF,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,MAAqC;AACzD,QAAI,CAAC,KAAK,SAAS,KAAK,MAAM,WAAW,GAAG;AAC1C,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,UAAuB,CAAC;AAE9B,eAAW,QAAQ,KAAK,OAAO;AAC7B,YAAM,QAAQ,KAAK,aAAa,IAAI;AACpC,UAAI,CAAC,OAAO;AAEV;AAAA,MACF;AAEA,YAAM,WAAW,KAAK,gBAAgB,IAAI;AAC1C,YAAM,EAAE,QAAQ,aAAa,IAAI,KAAK,sBAAsB,IAAI;AAChE,YAAM,UAAU,KAAK,eAAe,IAAI;AAExC,cAAQ,KAAK;AAAA,QACX,IAAI;AAAA,QACJ;AAAA,QACA,uBAAuB;AAAA,QACvB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,MAA4C;AAE/D,QAAI,KAAK,SAAS;AAChB,YAAM,WAAW,KAAK,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,MAAM,CAAC;AACtE,UAAI,UAAU;AACZ,eAAO;AAAA,MACT;AAAA,IACF;AAGA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,gBAAgB,MAAgC;AACtD,QAAI,CAAC,KAAK,YAAY,KAAK,SAAS,WAAW,GAAG;AAChD,aAAO;AAAA,IACT;AAEA,eAAW,OAAO,KAAK,UAAU;AAC/B,UAAI,IAAI,SAAS,WAAW;AAC1B,cAAM,QAAQ,KAAK,eAAe,IAAI,KAAK;AAC3C,YAAI,UAAU,MAAM;AAClB,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAGA,eAAW,OAAO,KAAK,UAAU;AAC/B,YAAM,QAAQ,KAAK,eAAe,IAAI,KAAK;AAC3C,UAAI,UAAU,MAAM;AAClB,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,eAAe,UAAiC;AAEtD,UAAM,MAAM,WAAW,QAAQ;AAC/B,QAAI,CAAC,MAAM,GAAG,KAAK,OAAO,KAAK,OAAO,IAAI;AACxC,aAAO;AAAA,IACT;AAIA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,sBAAsB,MAG5B;AACA,UAAM,SAAyB,CAAC;AAChC,QAAI;AAEJ,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,EAAE,QAAQ,aAAa;AAAA,IAChC;AAEA,eAAW,YAAY,KAAK,UAAU;AACpC,UAAI,CAAC,SAAS,QAAQ;AACpB;AAAA,MACF;AAEA,iBAAW,SAAS,SAAS,QAAQ;AACnC,YAAI,CAAC,MAAM,UAAU,MAAM,OAAO,WAAW,GAAG;AAC9C;AAAA,QACF;AAEA,cAAM,eAA6B,CAAC;AAEpC,mBAAW,SAAS,MAAM,QAAQ;AAChC,cAAI,MAAM,YAAY;AACpB,yBAAa,aAAa,MAAM;AAAA,UAClC;AACA,cAAI,MAAM,OAAO;AACf,yBAAa,QAAQ,MAAM;AAE3B,gBAAI,CAAC,cAAc;AACjB,6BAAe,MAAM;AAAA,YACvB;AAAA,UACF;AACA,cAAI,MAAM,eAAe;AACvB,yBAAa,eAAe,MAAM;AAAA,UACpC;AAAA,QACF;AAGA,YAAI,aAAa,cAAc,aAAa,SAAS,aAAa,cAAc;AAC9E,iBAAO,KAAK,YAAY;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,QAAQ,aAAa;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,eAAe,MAAgC;AACrD,UAAM,OAAO,KAAK,WAAW,KAAK,WAAW;AAC7C,QAAI,KAAK,UAAU,oBAAoB;AACrC,aAAO;AAAA,IACT;AACA,WAAO,KAAK,MAAM,GAAG,qBAAqB,CAAC,IAAI;AAAA,EACjD;AACF;AAOA,SAAS,uBAAuB,SAAqC;AACnE,QAAM,aAAa,IAAI,gBAAgB;AAEvC,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,SAAS;AAClB,iBAAW,MAAM,OAAO,MAAM;AAC9B,aAAO,WAAW;AAAA,IACpB;AAEA,WAAO,iBAAiB,SAAS,MAAM,WAAW,MAAM,OAAO,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,EACxF;AAEA,SAAO,WAAW;AACpB;AAKA,SAAS,aAAa,OAAyB;AAC7C,MAAI,iBAAiB,OAAO;AAC1B,WAAO,MAAM,SAAS,gBAAgB,MAAM,SAAS;AAAA,EACvD;AACA,SAAO;AACT;",
+  "names": ["import_errors", "msg"]
+}