kirograph 0.16.1 → 0.19.0

package/dist/security/vuln/osv-adapter.test.js

@@ -0,0 +1,391 @@
+"use strict";
+var import_vitest = require("vitest");
+var import_osv_adapter = require("./osv-adapter");
+var import_errors = require("../errors");
+(0, import_vitest.describe)("OsvAdapter", () => {
+  let adapter;
+  (0, import_vitest.beforeEach)(() => {
+    adapter = new import_osv_adapter.OsvAdapter({ apiUrl: "https://api.osv.dev/v1/query" });
+    import_vitest.vi.stubGlobal("fetch", import_vitest.vi.fn());
+  });
+  (0, import_vitest.afterEach)(() => {
+    import_vitest.vi.restoreAllMocks();
+  });
+  (0, import_vitest.it)('has name "OSV"', () => {
+    (0, import_vitest.expect)(adapter.name).toBe("OSV");
+  });
+  (0, import_vitest.it)("returns empty array for unsupported ecosystem", async () => {
+    const result = await adapter.query("unsupported", "pkg", "1.0.0");
+    (0, import_vitest.expect)(result).toEqual([]);
+    (0, import_vitest.expect)(fetch).not.toHaveBeenCalled();
+  });
+  (0, import_vitest.it)("maps npm ecosystem correctly and sends proper request", async () => {
+    const mockResponse = { vulns: [] };
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify(mockResponse), { status: 200 })
+    );
+    await adapter.query("npm", "express", "4.18.2");
+    (0, import_vitest.expect)(fetch).toHaveBeenCalledWith(
+      "https://api.osv.dev/v1/query",
+      import_vitest.expect.objectContaining({
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          package: { name: "express", ecosystem: "npm" },
+          version: "4.18.2"
+        })
+      })
+    );
+  });
+  (0, import_vitest.it)("maps maven ecosystem to Maven", async () => {
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify({ vulns: [] }), { status: 200 })
+    );
+    await adapter.query("maven", "log4j-core", "2.14.0");
+    (0, import_vitest.expect)(fetch).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
+      import_vitest.expect.objectContaining({
+        body: import_vitest.expect.stringContaining('"ecosystem":"Maven"')
+      })
+    );
+  });
+  (0, import_vitest.it)("maps go ecosystem to Go", async () => {
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify({ vulns: [] }), { status: 200 })
+    );
+    await adapter.query("go", "github.com/gin-gonic/gin", "1.9.1");
+    (0, import_vitest.expect)(fetch).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
+      import_vitest.expect.objectContaining({
+        body: import_vitest.expect.stringContaining('"ecosystem":"Go"')
+      })
+    );
+  });
+  (0, import_vitest.it)("maps pypi ecosystem to PyPI", async () => {
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify({ vulns: [] }), { status: 200 })
+    );
+    await adapter.query("pypi", "django", "4.2.0");
+    (0, import_vitest.expect)(fetch).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
+      import_vitest.expect.objectContaining({
+        body: import_vitest.expect.stringContaining('"ecosystem":"PyPI"')
+      })
+    );
+  });
+  (0, import_vitest.it)("maps cargo ecosystem to crates.io", async () => {
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify({ vulns: [] }), { status: 200 })
+    );
+    await adapter.query("cargo", "serde", "1.0.188");
+    (0, import_vitest.expect)(fetch).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
+      import_vitest.expect.objectContaining({
+        body: import_vitest.expect.stringContaining('"ecosystem":"crates.io"')
+      })
+    );
+  });
+  (0, import_vitest.it)("returns empty array when no vulnerabilities found", async () => {
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify({}), { status: 200 })
+    );
+    const result = await adapter.query("npm", "express", "4.18.2");
+    (0, import_vitest.expect)(result).toEqual([]);
+  });
+  (0, import_vitest.it)("parses CVE records from OSV response", async () => {
+    const osvResponse = {
+      vulns: [
+        {
+          id: "GHSA-xxxx-yyyy-zzzz",
+          aliases: ["CVE-2023-12345"],
+          summary: "A critical vulnerability in express",
+          severity: [{ type: "CVSS_V3", score: "9.8" }],
+          affected: [
+            {
+              package: { name: "express", ecosystem: "npm" },
+              ranges: [
+                {
+                  type: "ECOSYSTEM",
+                  events: [
+                    { introduced: "4.0.0" },
+                    { fixed: "4.18.3" }
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    };
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify(osvResponse), { status: 200 })
+    );
+    const result = await adapter.query("npm", "express", "4.18.2");
+    (0, import_vitest.expect)(result).toHaveLength(1);
+    (0, import_vitest.expect)(result[0]).toEqual({
+      id: "CVE-2023-12345",
+      severity: 9.8,
+      affectedVersionRanges: [{ introduced: "4.0.0", fixed: "4.18.3" }],
+      fixedVersion: "4.18.3",
+      summary: "A critical vulnerability in express"
+    });
+  });
+  (0, import_vitest.it)("uses OSV ID when no CVE alias exists", async () => {
+    const osvResponse = {
+      vulns: [
+        {
+          id: "GHSA-abcd-efgh-ijkl",
+          aliases: ["PYSEC-2023-001"],
+          summary: "Some vulnerability",
+          severity: [{ type: "CVSS_V3", score: "7.5" }],
+          affected: [
+            {
+              ranges: [
+                {
+                  type: "ECOSYSTEM",
+                  events: [{ introduced: "1.0.0" }, { fixed: "1.2.0" }]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    };
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify(osvResponse), { status: 200 })
+    );
+    const result = await adapter.query("npm", "some-pkg", "1.1.0");
+    (0, import_vitest.expect)(result).toHaveLength(1);
+    (0, import_vitest.expect)(result[0].id).toBe("GHSA-abcd-efgh-ijkl");
+  });
+  (0, import_vitest.it)("truncates summary to 500 characters", async () => {
+    const longSummary = "A".repeat(600);
+    const osvResponse = {
+      vulns: [
+        {
+          id: "GHSA-test-test-test",
+          aliases: ["CVE-2023-99999"],
+          summary: longSummary,
+          severity: [{ type: "CVSS_V3", score: "5.0" }],
+          affected: [
+            {
+              ranges: [
+                {
+                  type: "ECOSYSTEM",
+                  events: [{ introduced: "0" }]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    };
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify(osvResponse), { status: 200 })
+    );
+    const result = await adapter.query("npm", "pkg", "1.0.0");
+    (0, import_vitest.expect)(result[0].summary.length).toBe(500);
+    (0, import_vitest.expect)(result[0].summary.endsWith("...")).toBe(true);
+  });
+  (0, import_vitest.it)("returns severity 0 when no severity data available", async () => {
+    const osvResponse = {
+      vulns: [
+        {
+          id: "GHSA-no-severity",
+          aliases: ["CVE-2023-00001"],
+          summary: "No severity info",
+          affected: [
+            {
+              ranges: [
+                {
+                  type: "ECOSYSTEM",
+                  events: [{ introduced: "0" }]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    };
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify(osvResponse), { status: 200 })
+    );
+    const result = await adapter.query("npm", "pkg", "1.0.0");
+    (0, import_vitest.expect)(result[0].severity).toBe(0);
+  });
+  (0, import_vitest.it)("extracts multiple affected ranges", async () => {
+    const osvResponse = {
+      vulns: [
+        {
+          id: "GHSA-multi-range",
+          aliases: ["CVE-2023-55555"],
+          summary: "Multiple ranges",
+          severity: [{ type: "CVSS_V3", score: "8.0" }],
+          affected: [
+            {
+              ranges: [
+                {
+                  type: "ECOSYSTEM",
+                  events: [
+                    { introduced: "1.0.0" },
+                    { fixed: "1.5.0" }
+                  ]
+                },
+                {
+                  type: "ECOSYSTEM",
+                  events: [
+                    { introduced: "2.0.0" },
+                    { fixed: "2.1.0" }
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    };
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify(osvResponse), { status: 200 })
+    );
+    const result = await adapter.query("npm", "pkg", "2.0.1");
+    (0, import_vitest.expect)(result[0].affectedVersionRanges).toHaveLength(2);
+    (0, import_vitest.expect)(result[0].affectedVersionRanges[0]).toEqual({
+      introduced: "1.0.0",
+      fixed: "1.5.0"
+    });
+    (0, import_vitest.expect)(result[0].affectedVersionRanges[1]).toEqual({
+      introduced: "2.0.0",
+      fixed: "2.1.0"
+    });
+    (0, import_vitest.expect)(result[0].fixedVersion).toBe("1.5.0");
+  });
+  (0, import_vitest.it)("handles last_affected in version ranges", async () => {
+    const osvResponse = {
+      vulns: [
+        {
+          id: "GHSA-last-affected",
+          aliases: ["CVE-2023-77777"],
+          summary: "Last affected test",
+          severity: [{ type: "CVSS_V3", score: "6.0" }],
+          affected: [
+            {
+              ranges: [
+                {
+                  type: "ECOSYSTEM",
+                  events: [
+                    { introduced: "1.0.0" },
+                    { last_affected: "1.9.9" }
+                  ]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    };
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify(osvResponse), { status: 200 })
+    );
+    const result = await adapter.query("npm", "pkg", "1.5.0");
+    (0, import_vitest.expect)(result[0].affectedVersionRanges[0]).toEqual({
+      introduced: "1.0.0",
+      lastAffected: "1.9.9"
+    });
+    (0, import_vitest.expect)(result[0].fixedVersion).toBeUndefined();
+  });
+  (0, import_vitest.it)("throws VulnDatabaseError on HTTP error response", async () => {
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response("Internal Server Error", { status: 500, statusText: "Internal Server Error" })
+    );
+    await (0, import_vitest.expect)(adapter.query("npm", "express", "4.18.2")).rejects.toThrow(import_errors.VulnDatabaseError);
+    await (0, import_vitest.expect)(adapter.query("npm", "express", "4.18.2")).rejects.toThrow(/HTTP 500/);
+  });
+  (0, import_vitest.it)("throws VulnDatabaseError on network error", async () => {
+    import_vitest.vi.mocked(fetch).mockRejectedValue(new TypeError("fetch failed"));
+    await (0, import_vitest.expect)(adapter.query("npm", "express", "4.18.2")).rejects.toThrow(import_errors.VulnDatabaseError);
+    await (0, import_vitest.expect)(adapter.query("npm", "express", "4.18.2")).rejects.toThrow(/Network error/);
+  });
+  (0, import_vitest.it)("throws VulnDatabaseError on abort/timeout", async () => {
+    const abortError = new Error("The operation was aborted");
+    abortError.name = "AbortError";
+    import_vitest.vi.mocked(fetch).mockRejectedValue(abortError);
+    await (0, import_vitest.expect)(adapter.query("npm", "express", "4.18.2")).rejects.toThrow(import_errors.VulnDatabaseError);
+  });
+  (0, import_vitest.it)("respects external abort signal", async () => {
+    const controller = new AbortController();
+    controller.abort();
+    const abortError = new Error("The operation was aborted");
+    abortError.name = "AbortError";
+    import_vitest.vi.mocked(fetch).mockRejectedValue(abortError);
+    await (0, import_vitest.expect)(
+      adapter.query("npm", "express", "4.18.2", controller.signal)
+    ).rejects.toThrow(import_errors.VulnDatabaseError);
+  });
+  (0, import_vitest.it)("uses details as fallback when summary is missing", async () => {
+    const osvResponse = {
+      vulns: [
+        {
+          id: "GHSA-details-only",
+          aliases: ["CVE-2023-88888"],
+          details: "Detailed description of the vulnerability",
+          severity: [{ type: "CVSS_V3", score: "4.0" }],
+          affected: [
+            {
+              ranges: [
+                {
+                  type: "ECOSYSTEM",
+                  events: [{ introduced: "0" }]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    };
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify(osvResponse), { status: 200 })
+    );
+    const result = await adapter.query("npm", "pkg", "1.0.0");
+    (0, import_vitest.expect)(result[0].summary).toBe("Detailed description of the vulnerability");
+  });
+  (0, import_vitest.it)("handles case-insensitive ecosystem mapping", async () => {
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify({ vulns: [] }), { status: 200 })
+    );
+    await adapter.query("NPM", "express", "4.18.2");
+    (0, import_vitest.expect)(fetch).toHaveBeenCalledWith(
+      import_vitest.expect.any(String),
+      import_vitest.expect.objectContaining({
+        body: import_vitest.expect.stringContaining('"ecosystem":"npm"')
+      })
+    );
+  });
+  (0, import_vitest.it)("skips vulnerabilities without any identifiable ID", async () => {
+    const osvResponse = {
+      vulns: [
+        {
+          id: "CVE-2023-11111",
+          summary: "Has CVE directly as ID",
+          severity: [{ type: "CVSS_V3", score: "7.0" }],
+          affected: [
+            {
+              ranges: [
+                {
+                  type: "ECOSYSTEM",
+                  events: [{ introduced: "0" }]
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    };
+    import_vitest.vi.mocked(fetch).mockResolvedValue(
+      new Response(JSON.stringify(osvResponse), { status: 200 })
+    );
+    const result = await adapter.query("npm", "pkg", "1.0.0");
+    (0, import_vitest.expect)(result).toHaveLength(1);
+    (0, import_vitest.expect)(result[0].id).toBe("CVE-2023-11111");
+  });
+});
+//# sourceMappingURL=osv-adapter.test.js.map

package/dist/security/vuln/osv-adapter.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/vuln/osv-adapter.test.ts"],
+  "sourcesContent": ["/**\n * Unit tests for the OSV API adapter.\n */\n\nimport { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';\nimport { OsvAdapter } from './osv-adapter';\nimport { VulnDatabaseError } from '../errors';\n\ndescribe('OsvAdapter', () => {\n  let adapter: OsvAdapter;\n\n  beforeEach(() => {\n    adapter = new OsvAdapter({ apiUrl: 'https://api.osv.dev/v1/query' });\n    vi.stubGlobal('fetch', vi.fn());\n  });\n\n  afterEach(() => {\n    vi.restoreAllMocks();\n  });\n\n  it('has name \"OSV\"', () => {\n    expect(adapter.name).toBe('OSV');\n  });\n\n  it('returns empty array for unsupported ecosystem', async () => {\n    const result = await adapter.query('unsupported', 'pkg', '1.0.0');\n    expect(result).toEqual([]);\n    expect(fetch).not.toHaveBeenCalled();\n  });\n\n  it('maps npm ecosystem correctly and sends proper request', async () => {\n    const mockResponse = { vulns: [] };\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify(mockResponse), { status: 200 }),\n    );\n\n    await adapter.query('npm', 'express', '4.18.2');\n\n    expect(fetch).toHaveBeenCalledWith(\n      'https://api.osv.dev/v1/query',\n      expect.objectContaining({\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({\n          package: { name: 'express', ecosystem: 'npm' },\n          version: '4.18.2',\n        }),\n      }),\n    );\n  });\n\n  it('maps maven ecosystem to Maven', async () => {\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify({ vulns: [] }), { status: 200 }),\n    );\n\n    await adapter.query('maven', 'log4j-core', '2.14.0');\n\n    expect(fetch).toHaveBeenCalledWith(\n      expect.any(String),\n      expect.objectContaining({\n        body: expect.stringContaining('\"ecosystem\":\"Maven\"'),\n      }),\n    );\n  });\n\n  it('maps go ecosystem to Go', async () => {\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify({ vulns: [] }), { status: 200 }),\n    );\n\n    await adapter.query('go', 'github.com/gin-gonic/gin', '1.9.1');\n\n    expect(fetch).toHaveBeenCalledWith(\n      expect.any(String),\n      expect.objectContaining({\n        body: expect.stringContaining('\"ecosystem\":\"Go\"'),\n      }),\n    );\n  });\n\n  it('maps pypi ecosystem to PyPI', async () => {\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify({ vulns: [] }), { status: 200 }),\n    );\n\n    await adapter.query('pypi', 'django', '4.2.0');\n\n    expect(fetch).toHaveBeenCalledWith(\n      expect.any(String),\n      expect.objectContaining({\n        body: expect.stringContaining('\"ecosystem\":\"PyPI\"'),\n      }),\n    );\n  });\n\n  it('maps cargo ecosystem to crates.io', async () => {\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify({ vulns: [] }), { status: 200 }),\n    );\n\n    await adapter.query('cargo', 'serde', '1.0.188');\n\n    expect(fetch).toHaveBeenCalledWith(\n      expect.any(String),\n      expect.objectContaining({\n        body: expect.stringContaining('\"ecosystem\":\"crates.io\"'),\n      }),\n    );\n  });\n\n  it('returns empty array when no vulnerabilities found', async () => {\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify({}), { status: 200 }),\n    );\n\n    const result = await adapter.query('npm', 'express', '4.18.2');\n    expect(result).toEqual([]);\n  });\n\n  it('parses CVE records from OSV response', async () => {\n    const osvResponse = {\n      vulns: [\n        {\n          id: 'GHSA-xxxx-yyyy-zzzz',\n          aliases: ['CVE-2023-12345'],\n          summary: 'A critical vulnerability in express',\n          severity: [{ type: 'CVSS_V3', score: '9.8' }],\n          affected: [\n            {\n              package: { name: 'express', ecosystem: 'npm' },\n              ranges: [\n                {\n                  type: 'ECOSYSTEM',\n                  events: [\n                    { introduced: '4.0.0' },\n                    { fixed: '4.18.3' },\n                  ],\n                },\n              ],\n            },\n          ],\n        },\n      ],\n    };\n\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify(osvResponse), { status: 200 }),\n    );\n\n    const result = await adapter.query('npm', 'express', '4.18.2');\n\n    expect(result).toHaveLength(1);\n    expect(result[0]).toEqual({\n      id: 'CVE-2023-12345',\n      severity: 9.8,\n      affectedVersionRanges: [{ introduced: '4.0.0', fixed: '4.18.3' }],\n      fixedVersion: '4.18.3',\n      summary: 'A critical vulnerability in express',\n    });\n  });\n\n  it('uses OSV ID when no CVE alias exists', async () => {\n    const osvResponse = {\n      vulns: [\n        {\n          id: 'GHSA-abcd-efgh-ijkl',\n          aliases: ['PYSEC-2023-001'],\n          summary: 'Some vulnerability',\n          severity: [{ type: 'CVSS_V3', score: '7.5' }],\n          affected: [\n            {\n              ranges: [\n                {\n                  type: 'ECOSYSTEM',\n                  events: [{ introduced: '1.0.0' }, { fixed: '1.2.0' }],\n                },\n              ],\n            },\n          ],\n        },\n      ],\n    };\n\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify(osvResponse), { status: 200 }),\n    );\n\n    const result = await adapter.query('npm', 'some-pkg', '1.1.0');\n\n    expect(result).toHaveLength(1);\n    expect(result[0].id).toBe('GHSA-abcd-efgh-ijkl');\n  });\n\n  it('truncates summary to 500 characters', async () => {\n    const longSummary = 'A'.repeat(600);\n    const osvResponse = {\n      vulns: [\n        {\n          id: 'GHSA-test-test-test',\n          aliases: ['CVE-2023-99999'],\n          summary: longSummary,\n          severity: [{ type: 'CVSS_V3', score: '5.0' }],\n          affected: [\n            {\n              ranges: [\n                {\n                  type: 'ECOSYSTEM',\n                  events: [{ introduced: '0' }],\n                },\n              ],\n            },\n          ],\n        },\n      ],\n    };\n\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify(osvResponse), { status: 200 }),\n    );\n\n    const result = await adapter.query('npm', 'pkg', '1.0.0');\n\n    expect(result[0].summary.length).toBe(500);\n    expect(result[0].summary.endsWith('...')).toBe(true);\n  });\n\n  it('returns severity 0 when no severity data available', async () => {\n    const osvResponse = {\n      vulns: [\n        {\n          id: 'GHSA-no-severity',\n          aliases: ['CVE-2023-00001'],\n          summary: 'No severity info',\n          affected: [\n            {\n              ranges: [\n                {\n                  type: 'ECOSYSTEM',\n                  events: [{ introduced: '0' }],\n                },\n              ],\n            },\n          ],\n        },\n      ],\n    };\n\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify(osvResponse), { status: 200 }),\n    );\n\n    const result = await adapter.query('npm', 'pkg', '1.0.0');\n\n    expect(result[0].severity).toBe(0);\n  });\n\n  it('extracts multiple affected ranges', async () => {\n    const osvResponse = {\n      vulns: [\n        {\n          id: 'GHSA-multi-range',\n          aliases: ['CVE-2023-55555'],\n          summary: 'Multiple ranges',\n          severity: [{ type: 'CVSS_V3', score: '8.0' }],\n          affected: [\n            {\n              ranges: [\n                {\n                  type: 'ECOSYSTEM',\n                  events: [\n                    { introduced: '1.0.0' },\n                    { fixed: '1.5.0' },\n                  ],\n                },\n                {\n                  type: 'ECOSYSTEM',\n                  events: [\n                    { introduced: '2.0.0' },\n                    { fixed: '2.1.0' },\n                  ],\n                },\n              ],\n            },\n          ],\n        },\n      ],\n    };\n\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify(osvResponse), { status: 200 }),\n    );\n\n    const result = await adapter.query('npm', 'pkg', '2.0.1');\n\n    expect(result[0].affectedVersionRanges).toHaveLength(2);\n    expect(result[0].affectedVersionRanges[0]).toEqual({\n      introduced: '1.0.0',\n      fixed: '1.5.0',\n    });\n    expect(result[0].affectedVersionRanges[1]).toEqual({\n      introduced: '2.0.0',\n      fixed: '2.1.0',\n    });\n    expect(result[0].fixedVersion).toBe('1.5.0');\n  });\n\n  it('handles last_affected in version ranges', async () => {\n    const osvResponse = {\n      vulns: [\n        {\n          id: 'GHSA-last-affected',\n          aliases: ['CVE-2023-77777'],\n          summary: 'Last affected test',\n          severity: [{ type: 'CVSS_V3', score: '6.0' }],\n          affected: [\n            {\n              ranges: [\n                {\n                  type: 'ECOSYSTEM',\n                  events: [\n                    { introduced: '1.0.0' },\n                    { last_affected: '1.9.9' },\n                  ],\n                },\n              ],\n            },\n          ],\n        },\n      ],\n    };\n\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify(osvResponse), { status: 200 }),\n    );\n\n    const result = await adapter.query('npm', 'pkg', '1.5.0');\n\n    expect(result[0].affectedVersionRanges[0]).toEqual({\n      introduced: '1.0.0',\n      lastAffected: '1.9.9',\n    });\n    expect(result[0].fixedVersion).toBeUndefined();\n  });\n\n  it('throws VulnDatabaseError on HTTP error response', async () => {\n    vi.mocked(fetch).mockResolvedValue(\n      new Response('Internal Server Error', { status: 500, statusText: 'Internal Server Error' }),\n    );\n\n    await expect(adapter.query('npm', 'express', '4.18.2')).rejects.toThrow(VulnDatabaseError);\n    await expect(adapter.query('npm', 'express', '4.18.2')).rejects.toThrow(/HTTP 500/);\n  });\n\n  it('throws VulnDatabaseError on network error', async () => {\n    vi.mocked(fetch).mockRejectedValue(new TypeError('fetch failed'));\n\n    await expect(adapter.query('npm', 'express', '4.18.2')).rejects.toThrow(VulnDatabaseError);\n    await expect(adapter.query('npm', 'express', '4.18.2')).rejects.toThrow(/Network error/);\n  });\n\n  it('throws VulnDatabaseError on abort/timeout', async () => {\n    const abortError = new Error('The operation was aborted');\n    abortError.name = 'AbortError';\n    vi.mocked(fetch).mockRejectedValue(abortError);\n\n    await expect(adapter.query('npm', 'express', '4.18.2')).rejects.toThrow(VulnDatabaseError);\n  });\n\n  it('respects external abort signal', async () => {\n    const controller = new AbortController();\n    controller.abort();\n\n    const abortError = new Error('The operation was aborted');\n    abortError.name = 'AbortError';\n    vi.mocked(fetch).mockRejectedValue(abortError);\n\n    await expect(\n      adapter.query('npm', 'express', '4.18.2', controller.signal),\n    ).rejects.toThrow(VulnDatabaseError);\n  });\n\n  it('uses details as fallback when summary is missing', async () => {\n    const osvResponse = {\n      vulns: [\n        {\n          id: 'GHSA-details-only',\n          aliases: ['CVE-2023-88888'],\n          details: 'Detailed description of the vulnerability',\n          severity: [{ type: 'CVSS_V3', score: '4.0' }],\n          affected: [\n            {\n              ranges: [\n                {\n                  type: 'ECOSYSTEM',\n                  events: [{ introduced: '0' }],\n                },\n              ],\n            },\n          ],\n        },\n      ],\n    };\n\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify(osvResponse), { status: 200 }),\n    );\n\n    const result = await adapter.query('npm', 'pkg', '1.0.0');\n\n    expect(result[0].summary).toBe('Detailed description of the vulnerability');\n  });\n\n  it('handles case-insensitive ecosystem mapping', async () => {\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify({ vulns: [] }), { status: 200 }),\n    );\n\n    await adapter.query('NPM', 'express', '4.18.2');\n\n    expect(fetch).toHaveBeenCalledWith(\n      expect.any(String),\n      expect.objectContaining({\n        body: expect.stringContaining('\"ecosystem\":\"npm\"'),\n      }),\n    );\n  });\n\n  it('skips vulnerabilities without any identifiable ID', async () => {\n    const osvResponse = {\n      vulns: [\n        {\n          id: 'CVE-2023-11111',\n          summary: 'Has CVE directly as ID',\n          severity: [{ type: 'CVSS_V3', score: '7.0' }],\n          affected: [\n            {\n              ranges: [\n                {\n                  type: 'ECOSYSTEM',\n                  events: [{ introduced: '0' }],\n                },\n              ],\n            },\n          ],\n        },\n      ],\n    };\n\n    vi.mocked(fetch).mockResolvedValue(\n      new Response(JSON.stringify(osvResponse), { status: 200 }),\n    );\n\n    const result = await adapter.query('npm', 'pkg', '1.0.0');\n\n    expect(result).toHaveLength(1);\n    expect(result[0].id).toBe('CVE-2023-11111');\n  });\n});\n"],
+  "mappings": ";AAIA,oBAAgE;AAChE,yBAA2B;AAC3B,oBAAkC;AAAA,IAElC,wBAAS,cAAc,MAAM;AAC3B,MAAI;AAEJ,gCAAW,MAAM;AACf,cAAU,IAAI,8BAAW,EAAE,QAAQ,+BAA+B,CAAC;AACnE,qBAAG,WAAW,SAAS,iBAAG,GAAG,CAAC;AAAA,EAChC,CAAC;AAED,+BAAU,MAAM;AACd,qBAAG,gBAAgB;AAAA,EACrB,CAAC;AAED,wBAAG,kBAAkB,MAAM;AACzB,8BAAO,QAAQ,IAAI,EAAE,KAAK,KAAK;AAAA,EACjC,CAAC;AAED,wBAAG,iDAAiD,YAAY;AAC9D,UAAM,SAAS,MAAM,QAAQ,MAAM,eAAe,OAAO,OAAO;AAChE,8BAAO,MAAM,EAAE,QAAQ,CAAC,CAAC;AACzB,8BAAO,KAAK,EAAE,IAAI,iBAAiB;AAAA,EACrC,CAAC;AAED,wBAAG,yDAAyD,YAAY;AACtE,UAAM,eAAe,EAAE,OAAO,CAAC,EAAE;AACjC,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5D;AAEA,UAAM,QAAQ,MAAM,OAAO,WAAW,QAAQ;AAE9C,8BAAO,KAAK,EAAE;AAAA,MACZ;AAAA,MACA,qBAAO,iBAAiB;AAAA,QACtB,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,SAAS,EAAE,MAAM,WAAW,WAAW,MAAM;AAAA,UAC7C,SAAS;AAAA,QACX,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,wBAAG,iCAAiC,YAAY;AAC9C,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,SAAS,cAAc,QAAQ;AAEnD,8BAAO,KAAK,EAAE;AAAA,MACZ,qBAAO,IAAI,MAAM;AAAA,MACjB,qBAAO,iBAAiB;AAAA,QACtB,MAAM,qBAAO,iBAAiB,qBAAqB;AAAA,MACrD,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,wBAAG,2BAA2B,YAAY;AACxC,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,MAAM,4BAA4B,OAAO;AAE7D,8BAAO,KAAK,EAAE;AAAA,MACZ,qBAAO,IAAI,MAAM;AAAA,MACjB,qBAAO,iBAAiB;AAAA,QACtB,MAAM,qBAAO,iBAAiB,kBAAkB;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,wBAAG,+BAA+B,YAAY;AAC5C,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,UAAU,OAAO;AAE7C,8BAAO,KAAK,EAAE;AAAA,MACZ,qBAAO,IAAI,MAAM;AAAA,MACjB,qBAAO,iBAAiB;AAAA,QACtB,MAAM,qBAAO,iBAAiB,oBAAoB;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,wBAAG,qCAAqC,YAAY;AAClD,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,SAAS,SAAS,SAAS;AAE/C,8BAAO,KAAK,EAAE;AAAA,MACZ,qBAAO,IAAI,MAAM;AAAA,MACjB,qBAAO,iBAAiB;AAAA,QACtB,MAAM,qBAAO,iBAAiB,yBAAyB;AAAA,MACzD,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,wBAAG,qDAAqD,YAAY;AAClE,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,CAAC,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClD;AAEA,UAAM,SAAS,MAAM,QAAQ,MAAM,OAAO,WAAW,QAAQ;AAC7D,8BAAO,MAAM,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC3B,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,QACL;AAAA,UACE,IAAI;AAAA,UACJ,SAAS,CAAC,gBAAgB;AAAA,UAC1B,SAAS;AAAA,UACT,UAAU,CAAC,EAAE,MAAM,WAAW,OAAO,MAAM,CAAC;AAAA,UAC5C,UAAU;AAAA,YACR;AAAA,cACE,SAAS,EAAE,MAAM,WAAW,WAAW,MAAM;AAAA,cAC7C,QAAQ;AAAA,gBACN;AAAA,kBACE,MAAM;AAAA,kBACN,QAAQ;AAAA,oBACN,EAAE,YAAY,QAAQ;AAAA,oBACtB,EAAE,OAAO,SAAS;AAAA,kBACpB;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,SAAS,MAAM,QAAQ,MAAM,OAAO,WAAW,QAAQ;AAE7D,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,CAAC,EAAE,QAAQ;AAAA,MACxB,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,uBAAuB,CAAC,EAAE,YAAY,SAAS,OAAO,SAAS,CAAC;AAAA,MAChE,cAAc;AAAA,MACd,SAAS;AAAA,IACX,CAAC;AAAA,EACH,CAAC;AAED,wBAAG,wCAAwC,YAAY;AACrD,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,QACL;AAAA,UACE,IAAI;AAAA,UACJ,SAAS,CAAC,gBAAgB;AAAA,UAC1B,SAAS;AAAA,UACT,UAAU,CAAC,EAAE,MAAM,WAAW,OAAO,MAAM,CAAC;AAAA,UAC5C,UAAU;AAAA,YACR;AAAA,cACE,QAAQ;AAAA,gBACN;AAAA,kBACE,MAAM;AAAA,kBACN,QAAQ,CAAC,EAAE,YAAY,QAAQ,GAAG,EAAE,OAAO,QAAQ,CAAC;AAAA,gBACtD;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,SAAS,MAAM,QAAQ,MAAM,OAAO,YAAY,OAAO;AAE7D,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,qBAAqB;AAAA,EACjD,CAAC;AAED,wBAAG,uCAAuC,YAAY;AACpD,UAAM,cAAc,IAAI,OAAO,GAAG;AAClC,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,QACL;AAAA,UACE,IAAI;AAAA,UACJ,SAAS,CAAC,gBAAgB;AAAA,UAC1B,SAAS;AAAA,UACT,UAAU,CAAC,EAAE,MAAM,WAAW,OAAO,MAAM,CAAC;AAAA,UAC5C,UAAU;AAAA,YACR;AAAA,cACE,QAAQ;AAAA,gBACN;AAAA,kBACE,MAAM;AAAA,kBACN,QAAQ,CAAC,EAAE,YAAY,IAAI,CAAC;AAAA,gBAC9B;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,SAAS,MAAM,QAAQ,MAAM,OAAO,OAAO,OAAO;AAExD,8BAAO,OAAO,CAAC,EAAE,QAAQ,MAAM,EAAE,KAAK,GAAG;AACzC,8BAAO,OAAO,CAAC,EAAE,QAAQ,SAAS,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,EACrD,CAAC;AAED,wBAAG,sDAAsD,YAAY;AACnE,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,QACL;AAAA,UACE,IAAI;AAAA,UACJ,SAAS,CAAC,gBAAgB;AAAA,UAC1B,SAAS;AAAA,UACT,UAAU;AAAA,YACR;AAAA,cACE,QAAQ;AAAA,gBACN;AAAA,kBACE,MAAM;AAAA,kBACN,QAAQ,CAAC,EAAE,YAAY,IAAI,CAAC;AAAA,gBAC9B;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,SAAS,MAAM,QAAQ,MAAM,OAAO,OAAO,OAAO;AAExD,8BAAO,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC;AAAA,EACnC,CAAC;AAED,wBAAG,qCAAqC,YAAY;AAClD,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,QACL;AAAA,UACE,IAAI;AAAA,UACJ,SAAS,CAAC,gBAAgB;AAAA,UAC1B,SAAS;AAAA,UACT,UAAU,CAAC,EAAE,MAAM,WAAW,OAAO,MAAM,CAAC;AAAA,UAC5C,UAAU;AAAA,YACR;AAAA,cACE,QAAQ;AAAA,gBACN;AAAA,kBACE,MAAM;AAAA,kBACN,QAAQ;AAAA,oBACN,EAAE,YAAY,QAAQ;AAAA,oBACtB,EAAE,OAAO,QAAQ;AAAA,kBACnB;AAAA,gBACF;AAAA,gBACA;AAAA,kBACE,MAAM;AAAA,kBACN,QAAQ;AAAA,oBACN,EAAE,YAAY,QAAQ;AAAA,oBACtB,EAAE,OAAO,QAAQ;AAAA,kBACnB;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,SAAS,MAAM,QAAQ,MAAM,OAAO,OAAO,OAAO;AAExD,8BAAO,OAAO,CAAC,EAAE,qBAAqB,EAAE,aAAa,CAAC;AACtD,8BAAO,OAAO,CAAC,EAAE,sBAAsB,CAAC,CAAC,EAAE,QAAQ;AAAA,MACjD,YAAY;AAAA,MACZ,OAAO;AAAA,IACT,CAAC;AACD,8BAAO,OAAO,CAAC,EAAE,sBAAsB,CAAC,CAAC,EAAE,QAAQ;AAAA,MACjD,YAAY;AAAA,MACZ,OAAO;AAAA,IACT,CAAC;AACD,8BAAO,OAAO,CAAC,EAAE,YAAY,EAAE,KAAK,OAAO;AAAA,EAC7C,CAAC;AAED,wBAAG,2CAA2C,YAAY;AACxD,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,QACL;AAAA,UACE,IAAI;AAAA,UACJ,SAAS,CAAC,gBAAgB;AAAA,UAC1B,SAAS;AAAA,UACT,UAAU,CAAC,EAAE,MAAM,WAAW,OAAO,MAAM,CAAC;AAAA,UAC5C,UAAU;AAAA,YACR;AAAA,cACE,QAAQ;AAAA,gBACN;AAAA,kBACE,MAAM;AAAA,kBACN,QAAQ;AAAA,oBACN,EAAE,YAAY,QAAQ;AAAA,oBACtB,EAAE,eAAe,QAAQ;AAAA,kBAC3B;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,SAAS,MAAM,QAAQ,MAAM,OAAO,OAAO,OAAO;AAExD,8BAAO,OAAO,CAAC,EAAE,sBAAsB,CAAC,CAAC,EAAE,QAAQ;AAAA,MACjD,YAAY;AAAA,MACZ,cAAc;AAAA,IAChB,CAAC;AACD,8BAAO,OAAO,CAAC,EAAE,YAAY,EAAE,cAAc;AAAA,EAC/C,CAAC;AAED,wBAAG,mDAAmD,YAAY;AAChE,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,yBAAyB,EAAE,QAAQ,KAAK,YAAY,wBAAwB,CAAC;AAAA,IAC5F;AAEA,cAAM,sBAAO,QAAQ,MAAM,OAAO,WAAW,QAAQ,CAAC,EAAE,QAAQ,QAAQ,+BAAiB;AACzF,cAAM,sBAAO,QAAQ,MAAM,OAAO,WAAW,QAAQ,CAAC,EAAE,QAAQ,QAAQ,UAAU;AAAA,EACpF,CAAC;AAED,wBAAG,6CAA6C,YAAY;AAC1D,qBAAG,OAAO,KAAK,EAAE,kBAAkB,IAAI,UAAU,cAAc,CAAC;AAEhE,cAAM,sBAAO,QAAQ,MAAM,OAAO,WAAW,QAAQ,CAAC,EAAE,QAAQ,QAAQ,+BAAiB;AACzF,cAAM,sBAAO,QAAQ,MAAM,OAAO,WAAW,QAAQ,CAAC,EAAE,QAAQ,QAAQ,eAAe;AAAA,EACzF,CAAC;AAED,wBAAG,6CAA6C,YAAY;AAC1D,UAAM,aAAa,IAAI,MAAM,2BAA2B;AACxD,eAAW,OAAO;AAClB,qBAAG,OAAO,KAAK,EAAE,kBAAkB,UAAU;AAE7C,cAAM,sBAAO,QAAQ,MAAM,OAAO,WAAW,QAAQ,CAAC,EAAE,QAAQ,QAAQ,+BAAiB;AAAA,EAC3F,CAAC;AAED,wBAAG,kCAAkC,YAAY;AAC/C,UAAM,aAAa,IAAI,gBAAgB;AACvC,eAAW,MAAM;AAEjB,UAAM,aAAa,IAAI,MAAM,2BAA2B;AACxD,eAAW,OAAO;AAClB,qBAAG,OAAO,KAAK,EAAE,kBAAkB,UAAU;AAE7C,cAAM;AAAA,MACJ,QAAQ,MAAM,OAAO,WAAW,UAAU,WAAW,MAAM;AAAA,IAC7D,EAAE,QAAQ,QAAQ,+BAAiB;AAAA,EACrC,CAAC;AAED,wBAAG,oDAAoD,YAAY;AACjE,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,QACL;AAAA,UACE,IAAI;AAAA,UACJ,SAAS,CAAC,gBAAgB;AAAA,UAC1B,SAAS;AAAA,UACT,UAAU,CAAC,EAAE,MAAM,WAAW,OAAO,MAAM,CAAC;AAAA,UAC5C,UAAU;AAAA,YACR;AAAA,cACE,QAAQ;AAAA,gBACN;AAAA,kBACE,MAAM;AAAA,kBACN,QAAQ,CAAC,EAAE,YAAY,IAAI,CAAC;AAAA,gBAC9B;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,SAAS,MAAM,QAAQ,MAAM,OAAO,OAAO,OAAO;AAExD,8BAAO,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,2CAA2C;AAAA,EAC5E,CAAC;AAED,wBAAG,8CAA8C,YAAY;AAC3D,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,OAAO,WAAW,QAAQ;AAE9C,8BAAO,KAAK,EAAE;AAAA,MACZ,qBAAO,IAAI,MAAM;AAAA,MACjB,qBAAO,iBAAiB;AAAA,QACtB,MAAM,qBAAO,iBAAiB,mBAAmB;AAAA,MACnD,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,wBAAG,qDAAqD,YAAY;AAClE,UAAM,cAAc;AAAA,MAClB,OAAO;AAAA,QACL;AAAA,UACE,IAAI;AAAA,UACJ,SAAS;AAAA,UACT,UAAU,CAAC,EAAE,MAAM,WAAW,OAAO,MAAM,CAAC;AAAA,UAC5C,UAAU;AAAA,YACR;AAAA,cACE,QAAQ;AAAA,gBACN;AAAA,kBACE,MAAM;AAAA,kBACN,QAAQ,CAAC,EAAE,YAAY,IAAI,CAAC;AAAA,gBAC9B;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,qBAAG,OAAO,KAAK,EAAE;AAAA,MACf,IAAI,SAAS,KAAK,UAAU,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3D;AAEA,UAAM,SAAS,MAAM,QAAQ,MAAM,OAAO,OAAO,OAAO;AAExD,8BAAO,MAAM,EAAE,aAAa,CAAC;AAC7B,8BAAO,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,gBAAgB;AAAA,EAC5C,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/security/vuln/types.js

@@ -0,0 +1,17 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);
+//# sourceMappingURL=types.js.map

package/dist/security/vuln/types.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/vuln/types.ts"],
+  "sourcesContent": ["/**\n * Shared types for the vulnerability database subsystem.\n */\n\nimport type { CVERecord } from '../types';\n\n/** A single entry in a batch vulnerability query. */\nexport interface BatchQuery {\n  ecosystem: string;\n  packageName: string;\n  version: string;\n}\n\n/**\n * Adapter interface for querying a vulnerability database.\n * Each supported database (OSV, NVD, etc.) implements this interface.\n */\nexport interface VulnDatabaseAdapter {\n  /** Human-readable name of the database (e.g. \"OSV\") */\n  name: string;\n\n  /**\n   * Query for vulnerabilities affecting a specific package version.\n   */\n  query(\n    ecosystem: string,\n    packageName: string,\n    version: string,\n    signal?: AbortSignal,\n  ): Promise<CVERecord[]>;\n\n  /**\n   * Batch query \u2014 results[i] corresponds to queries[i].\n   * Implementing this is optional but strongly recommended for performance:\n   * a single HTTP request replaces N sequential requests.\n   */\n  queryBatch?(\n    queries: BatchQuery[],\n    signal?: AbortSignal,\n  ): Promise<Array<CVERecord[]>>;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;",
+  "names": []
+}

package/dist/types.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["/**\n * KiroGraph Type Definitions\n */\n\nexport type NodeKind =\n  | 'file' | 'module' | 'class' | 'struct' | 'interface' | 'trait' | 'protocol'\n  | 'function' | 'method' | 'property' | 'field' | 'variable' | 'constant'\n  | 'enum' | 'enum_member' | 'type_alias' | 'namespace' | 'parameter'\n  | 'import' | 'export' | 'route' | 'component';\n\nexport type EdgeKind =\n  | 'contains' | 'calls' | 'imports' | 'exports' | 'extends' | 'implements'\n  | 'references' | 'type_of' | 'returns' | 'instantiates' | 'overrides' | 'decorates';\n\nexport type Language =\n  | 'typescript' | 'javascript' | 'tsx' | 'jsx' | 'python' | 'go' | 'rust'\n  | 'java' | 'c' | 'cpp' | 'csharp' | 'php' | 'ruby' | 'swift' | 'kotlin'\n  | 'dart' | 'svelte' | 'pascal' | 'liquid' | 'elixir'\n  | 'scala' | 'lua' | 'zig' | 'bash' | 'ocaml' | 'elm' | 'solidity' | 'vue' | 'objc'\n  | 'yaml' | 'hcl' | 'css' | 'scss' | 'html'\n  | 'unknown';\n\nexport interface Node {\n  id: string;\n  kind: NodeKind;\n  name: string;\n  qualifiedName: string;\n  filePath: string;\n  language: Language;\n  startLine: number;\n  endLine: number;\n  startColumn: number;\n  endColumn: number;\n  docstring?: string;\n  signature?: string;\n  visibility?: 'public' | 'private' | 'protected' | 'internal';\n  isExported?: boolean;\n  isAsync?: boolean;\n  isStatic?: boolean;\n  isAbstract?: boolean;\n  decorators?: string[];\n  typeParameters?: string[];\n  updatedAt: number;\n}\n\nexport interface Edge {\n  source: string;\n  target: string;\n  kind: EdgeKind;\n  metadata?: Record<string, unknown>;\n  line?: number;\n  column?: number;\n}\n\nexport interface FileRecord {\n  path: string;\n  contentHash: string;\n  language: Language;\n  fileSize: number;\n  symbolCount: number;\n  indexedAt: number;\n}\n\nexport interface SearchResult {\n  node: Node;\n  score: number;\n  matchType: 'exact' | 'prefix' | 'fuzzy' | 'semantic';\n}\n\nexport interface SearchOptions {\n  kinds?: NodeKind[];\n  languages?: Language[];\n  limit?: number;\n  minScore?: number;\n}\n\nexport interface Subgraph {\n  nodes: Node[];\n  edges: Edge[];\n  entryPoints: string[];\n}\n\nexport interface NodeContext {\n  node: Node;\n  ancestors: Node[];\n  children: Node[];\n  callers: Node[];\n  callees: Node[];\n}\n\nexport interface NodeMetrics {\n  incomingEdgeCount: number;\n  outgoingEdgeCount: number;\n  callCount: number;\n  callerCount: number;\n  childCount: number;\n}\n\nexport interface GraphStats {\n  files: number;\n  nodes: number;\n  edges: number;\n  nodesByKind: Record<string, number>;\n  filesByLanguage: Record<string, number>;\n  dbSizeBytes: number;\n  embeddingCount: number;\n  embeddableNodeCount: number;\n  embeddingsEnabled: boolean;\n  embeddingModel: string;\n  useVecIndex: boolean;\n  semanticEngine: 'cosine' | 'sqlite-vec' | 'orama' | 'pglite' | 'lancedb' | 'qdrant' | 'typesense';\n  vecIndexCount: number;\n  engineFallback: string | null;\n  frameworks: string[];\n  architectureEnabled: boolean;\n  architectureStats?: { packages: number; layers: number; packageDeps: number };\n}\n\nexport interface TaskContext {\n  task: string;\n  entryPoints: Node[];\n  relatedNodes: Node[];\n  edges: Edge[];\n  codeSnippets: Map<string, string>;\n  summary: string;\n}\n\nexport interface IndexProgress {\n  phase: 'scanning' | 'parsing' | 'storing' | 'resolving' | 'detecting frameworks' | 'embeddings' | 'architecture' | 'retrying';\n  current: number;\n  total: number;\n  currentFile?: string;\n  meta?: Record<string, unknown>;\n}\n\nexport interface IndexResult {\n  success: boolean;\n  filesIndexed: number;\n  nodesCreated: number;\n  edgesCreated: number;\n  errors: string[];\n  duration: number;\n}\n\nexport interface SyncResult {\n  added: string[];\n  modified: string[];\n  removed: string[];\n  nodesCreated: number;\n  nodesUpdated: number;\n  nodesRemoved: number;\n  edgesCreated: number;\n  edgesRemoved: number;\n  filesScanned: number;\n  errors: string[];\n  duration: number;\n}\n\n// \u2500\u2500 Error Classes (re-exported from src/errors.ts for backward compatibility) \u2500\u2500\n\nexport {\n  KiroGraphError,\n  FileError,\n  ParseError,\n  DatabaseError,\n  ConfigError,\n} from './errors';\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgKA,oBAMO;",
+  "sourcesContent": ["/**\n * KiroGraph Type Definitions\n */\n\nexport type NodeKind =\n  | 'file' | 'module' | 'class' | 'struct' | 'interface' | 'trait' | 'protocol'\n  | 'function' | 'method' | 'property' | 'field' | 'variable' | 'constant'\n  | 'enum' | 'enum_member' | 'type_alias' | 'namespace' | 'parameter'\n  | 'import' | 'export' | 'route' | 'component'\n  | 'dependency' | 'vulnerability';\n\nexport type EdgeKind =\n  | 'contains' | 'calls' | 'imports' | 'exports' | 'extends' | 'implements'\n  | 'references' | 'type_of' | 'returns' | 'instantiates' | 'overrides' | 'decorates'\n  | 'has_vulnerability' | 'depends_on' | 'declared_in';\n\nexport type Language =\n  | 'typescript' | 'javascript' | 'tsx' | 'jsx' | 'python' | 'go' | 'rust'\n  | 'java' | 'c' | 'cpp' | 'csharp' | 'php' | 'ruby' | 'swift' | 'kotlin'\n  | 'dart' | 'svelte' | 'pascal' | 'liquid' | 'elixir'\n  | 'scala' | 'lua' | 'zig' | 'bash' | 'ocaml' | 'elm' | 'solidity' | 'vue' | 'objc'\n  | 'yaml' | 'hcl' | 'css' | 'scss' | 'html'\n  | 'jupyter'\n  | 'rescript' | 'sql' | 'r' | 'julia' | 'powershell' | 'perl' | 'astro' | 'gdscript' | 'nix' | 'verilog'\n  | 'unknown';\n\nexport interface Node {\n  id: string;\n  kind: NodeKind;\n  name: string;\n  qualifiedName: string;\n  filePath: string;\n  language: Language;\n  startLine: number;\n  endLine: number;\n  startColumn: number;\n  endColumn: number;\n  docstring?: string;\n  signature?: string;\n  visibility?: 'public' | 'private' | 'protected' | 'internal';\n  isExported?: boolean;\n  isAsync?: boolean;\n  isStatic?: boolean;\n  isAbstract?: boolean;\n  decorators?: string[];\n  typeParameters?: string[];\n  updatedAt: number;\n}\n\nexport interface Edge {\n  source: string;\n  target: string;\n  kind: EdgeKind;\n  metadata?: Record<string, unknown>;\n  line?: number;\n  column?: number;\n  confidence?: 'extracted' | 'inferred' | 'ambiguous';\n  confidenceScore?: number;\n}\n\nexport interface FileRecord {\n  path: string;\n  contentHash: string;\n  language: Language;\n  fileSize: number;\n  symbolCount: number;\n  indexedAt: number;\n}\n\nexport interface SearchResult {\n  node: Node;\n  score: number;\n  matchType: 'exact' | 'prefix' | 'fuzzy' | 'semantic';\n}\n\nexport interface SearchOptions {\n  kinds?: NodeKind[];\n  languages?: Language[];\n  limit?: number;\n  minScore?: number;\n}\n\nexport interface Subgraph {\n  nodes: Node[];\n  edges: Edge[];\n  entryPoints: string[];\n}\n\nexport interface NodeContext {\n  node: Node;\n  ancestors: Node[];\n  children: Node[];\n  callers: Node[];\n  callees: Node[];\n}\n\nexport interface NodeMetrics {\n  incomingEdgeCount: number;\n  outgoingEdgeCount: number;\n  callCount: number;\n  callerCount: number;\n  childCount: number;\n}\n\nexport interface GraphStats {\n  files: number;\n  nodes: number;\n  edges: number;\n  nodesByKind: Record<string, number>;\n  filesByLanguage: Record<string, number>;\n  dbSizeBytes: number;\n  embeddingCount: number;\n  embeddableNodeCount: number;\n  embeddingsEnabled: boolean;\n  embeddingModel: string;\n  useVecIndex: boolean;\n  semanticEngine: 'cosine' | 'sqlite-vec' | 'orama' | 'pglite' | 'lancedb' | 'qdrant' | 'typesense';\n  vecIndexCount: number;\n  engineFallback: string | null;\n  frameworks: string[];\n  architectureEnabled: boolean;\n  architectureStats?: { packages: number; layers: number; packageDeps: number };\n}\n\nexport interface TaskContext {\n  task: string;\n  entryPoints: Node[];\n  relatedNodes: Node[];\n  edges: Edge[];\n  codeSnippets: Map<string, string>;\n  summary: string;\n}\n\nexport interface IndexProgress {\n  phase: 'scanning' | 'parsing' | 'storing' | 'resolving' | 'detecting frameworks' | 'embeddings' | 'architecture' | 'security' | 'docs' | 'data' | 'retrying';\n  current: number;\n  total: number;\n  currentFile?: string;\n  meta?: Record<string, unknown>;\n}\n\nexport interface IndexResult {\n  success: boolean;\n  filesIndexed: number;\n  nodesCreated: number;\n  edgesCreated: number;\n  errors: string[];\n  duration: number;\n}\n\nexport interface SyncResult {\n  added: string[];\n  modified: string[];\n  removed: string[];\n  nodesCreated: number;\n  nodesUpdated: number;\n  nodesRemoved: number;\n  edgesCreated: number;\n  edgesRemoved: number;\n  filesScanned: number;\n  errors: string[];\n  duration: number;\n}\n\n// \u2500\u2500 Error Classes (re-exported from src/errors.ts for backward compatibility) \u2500\u2500\n\nexport {\n  KiroGraphError,\n  FileError,\n  ParseError,\n  DatabaseError,\n  ConfigError,\n} from './errors';\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsKA,oBAMO;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kirograph",
-  "version": "0.16.1",
+  "version": "0.19.0",
   "description": "Semantic code knowledge graph for Kiro: fewer tool calls, instant symbol lookups, 100% local.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -18,6 +18,7 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest --run",
     "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "release": "./scripts/release.sh",
     "docs": "npx serve docs"
   },
   "keywords": [
@@ -33,9 +34,11 @@
     "commander": "^14.0.2",
     "figlet": "^1.11.0",
     "node-sqlite3-wasm": "^0.8.30",
+    "parquetjs-lite": "^0.8.7",
     "picomatch": "^4.0.3",
     "tree-sitter-wasms": "^0.1.11",
-    "web-tree-sitter": "^0.25.3"
+    "web-tree-sitter": "^0.25.3",
+    "xlsx": "^0.18.5"
   },
   "optionalDependencies": {
     "@electric-sql/pglite": "^0.2.17",