kirograph 0.17.0 → 0.19.0

package/dist/security/vuln/client.test.js

@@ -0,0 +1,288 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_vitest = require("vitest");
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var os = __toESM(require("os"));
+var import_client = require("./client");
+var import_database = require("../../db/database");
+(0, import_vitest.describe)("VulnerabilityDatabaseClient", () => {
+  let db;
+  let tmpDir;
+  (0, import_vitest.beforeEach)(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "kirograph-vuln-client-test-"));
+    db = new import_database.GraphDatabase(tmpDir);
+    db.applySecuritySchema();
+  });
+  (0, import_vitest.afterEach)(() => {
+    db.close();
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+  function createDependencyNode(name, ecosystem, version) {
+    const nodeId = `dep:${ecosystem}:${name}`;
+    const rawDb = db.getRawDb();
+    const node = {
+      id: nodeId,
+      kind: "dependency",
+      name,
+      qualifiedName: `${ecosystem}/${name}`,
+      filePath: "",
+      language: "unknown",
+      startLine: 0,
+      endLine: 0,
+      startColumn: 0,
+      endColumn: 0,
+      isExported: false,
+      isAsync: false,
+      isStatic: false,
+      isAbstract: false,
+      updatedAt: Date.now()
+    };
+    db.upsertNode(node);
+    rawDb.run(
+      `INSERT OR REPLACE INTO sec_dependencies
+        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      [nodeId, ecosystem, name, `^${version}`, version, "production", JSON.stringify(["package.json"])]
+    );
+    return nodeId;
+  }
+  function createMockAdapter(name, results) {
+    return {
+      name,
+      async query(ecosystem, packageName, version) {
+        const key = `${ecosystem}:${packageName}:${version}`;
+        return results.get(key) ?? [];
+      }
+    };
+  }
+  function createFailingAdapter(name, errorMessage) {
+    return {
+      name,
+      async query() {
+        throw new Error(errorMessage);
+      }
+    };
+  }
+  const sampleCve = {
+    id: "CVE-2023-12345",
+    severity: 7.5,
+    affectedVersionRanges: [{ introduced: "1.0.0", fixed: "1.2.0" }],
+    fixedVersion: "1.2.0",
+    summary: "A critical vulnerability in express"
+  };
+  const sampleCve2 = {
+    id: "CVE-2023-67890",
+    severity: 5,
+    affectedVersionRanges: [{ introduced: "0.9.0", fixed: "1.1.0" }],
+    fixedVersion: "1.1.0",
+    summary: "A moderate vulnerability"
+  };
+  (0, import_vitest.describe)("enrichAll()", () => {
+    (0, import_vitest.it)("should return zero counts when no dependencies exist", async () => {
+      const adapter = createMockAdapter("OSV", /* @__PURE__ */ new Map());
+      const client = new import_client.VulnerabilityDatabaseClient([adapter], db);
+      const result = await client.enrichAll();
+      (0, import_vitest.expect)(result.vulnerabilitiesFound).toBe(0);
+      (0, import_vitest.expect)(result.dependenciesChecked).toBe(0);
+      (0, import_vitest.expect)(result.errors).toHaveLength(0);
+      (0, import_vitest.expect)(result.staleNodes).toHaveLength(0);
+    });
+    (0, import_vitest.it)("should create Vulnerability_Nodes for matching CVEs", async () => {
+      const depNodeId = createDependencyNode("express", "npm", "1.0.5");
+      const results = /* @__PURE__ */ new Map();
+      results.set("npm:express:1.0.5", [sampleCve]);
+      const adapter = createMockAdapter("OSV", results);
+      const client = new import_client.VulnerabilityDatabaseClient([adapter], db);
+      const result = await client.enrichAll();
+      (0, import_vitest.expect)(result.vulnerabilitiesFound).toBe(1);
+      (0, import_vitest.expect)(result.dependenciesChecked).toBe(1);
+      const vulnNode = db.getNode("vuln:CVE-2023-12345");
+      (0, import_vitest.expect)(vulnNode).not.toBeNull();
+      (0, import_vitest.expect)(vulnNode.kind).toBe("vulnerability");
+      (0, import_vitest.expect)(vulnNode.name).toBe("CVE-2023-12345");
+      const rawDb = db.getRawDb();
+      const vulnRow = rawDb.get(
+        "SELECT * FROM sec_vulnerabilities WHERE cve_id = ?",
+        ["CVE-2023-12345"]
+      );
+      (0, import_vitest.expect)(vulnRow).not.toBeNull();
+      (0, import_vitest.expect)(vulnRow.severity_score).toBe(7.5);
+      (0, import_vitest.expect)(vulnRow.fixed_version).toBe("1.2.0");
+      (0, import_vitest.expect)(vulnRow.source_database).toBe("OSV");
+      const edges = db.getEdgesForNodes([depNodeId]);
+      const vulnEdge = edges.find(
+        (e) => e.source === depNodeId && e.target === "vuln:CVE-2023-12345" && e.kind === "has_vulnerability"
+      );
+      (0, import_vitest.expect)(vulnEdge).toBeDefined();
+    });
+    (0, import_vitest.it)("should update last_vuln_check timestamp on queried dependencies", async () => {
+      createDependencyNode("express", "npm", "1.0.5");
+      const adapter = createMockAdapter("OSV", /* @__PURE__ */ new Map());
+      const client = new import_client.VulnerabilityDatabaseClient([adapter], db);
+      const before = Date.now();
+      await client.enrichAll();
+      const after = Date.now();
+      const rawDb = db.getRawDb();
+      const row = rawDb.get(
+        "SELECT last_vuln_check FROM sec_dependencies WHERE package_name = ?",
+        ["express"]
+      );
+      (0, import_vitest.expect)(row.last_vuln_check).toBeGreaterThanOrEqual(before);
+      (0, import_vitest.expect)(row.last_vuln_check).toBeLessThanOrEqual(after);
+    });
+    (0, import_vitest.it)("should deduplicate CVEs by ID across multiple databases", async () => {
+      createDependencyNode("express", "npm", "1.0.5");
+      const results1 = /* @__PURE__ */ new Map();
+      results1.set("npm:express:1.0.5", [sampleCve]);
+      const results2 = /* @__PURE__ */ new Map();
+      results2.set("npm:express:1.0.5", [
+        { ...sampleCve, summary: "Different summary from DB2" }
+      ]);
+      const adapter1 = createMockAdapter("OSV", results1);
+      const adapter2 = createMockAdapter("NVD", results2);
+      const client = new import_client.VulnerabilityDatabaseClient([adapter1, adapter2], db);
+      const result = await client.enrichAll();
+      (0, import_vitest.expect)(result.vulnerabilitiesFound).toBe(1);
+      const rawDb = db.getRawDb();
+      const vulnRows = rawDb.all("SELECT * FROM sec_vulnerabilities WHERE cve_id = ?", ["CVE-2023-12345"]);
+      (0, import_vitest.expect)(vulnRows).toHaveLength(1);
+    });
+    (0, import_vitest.it)("should handle multiple unique CVEs from multiple databases", async () => {
+      createDependencyNode("express", "npm", "1.0.5");
+      const results1 = /* @__PURE__ */ new Map();
+      results1.set("npm:express:1.0.5", [sampleCve]);
+      const results2 = /* @__PURE__ */ new Map();
+      results2.set("npm:express:1.0.5", [sampleCve2]);
+      const adapter1 = createMockAdapter("OSV", results1);
+      const adapter2 = createMockAdapter("NVD", results2);
+      const client = new import_client.VulnerabilityDatabaseClient([adapter1, adapter2], db);
+      const result = await client.enrichAll();
+      (0, import_vitest.expect)(result.vulnerabilitiesFound).toBe(2);
+      (0, import_vitest.expect)(db.getNode("vuln:CVE-2023-12345")).not.toBeNull();
+      (0, import_vitest.expect)(db.getNode("vuln:CVE-2023-67890")).not.toBeNull();
+    });
+    (0, import_vitest.it)("should handle unreachable databases: set vulnDataStale flag", async () => {
+      const depNodeId = createDependencyNode("express", "npm", "1.0.5");
+      const failingAdapter = createFailingAdapter("OSV", "Network error");
+      const client = new import_client.VulnerabilityDatabaseClient([failingAdapter], db);
+      const result = await client.enrichAll();
+      (0, import_vitest.expect)(result.errors).toHaveLength(1);
+      (0, import_vitest.expect)(result.errors[0].dependency).toBe("express");
+      (0, import_vitest.expect)(result.errors[0].database).toBe("OSV");
+      (0, import_vitest.expect)(result.errors[0].error).toBe("Network error");
+      (0, import_vitest.expect)(result.staleNodes).toContain(depNodeId);
+      const rawDb = db.getRawDb();
+      const row = rawDb.get(
+        "SELECT vuln_data_stale, vuln_data_stale_since FROM sec_dependencies WHERE node_id = ?",
+        [depNodeId]
+      );
+      (0, import_vitest.expect)(row.vuln_data_stale).toBe(1);
+      (0, import_vitest.expect)(row.vuln_data_stale_since).toBeGreaterThan(0);
+    });
+    (0, import_vitest.it)("should continue processing other dependencies when one adapter fails", async () => {
+      createDependencyNode("express", "npm", "1.0.5");
+      createDependencyNode("lodash", "npm", "4.17.21");
+      const adapter = {
+        name: "OSV",
+        async query(_eco, pkg) {
+          if (pkg === "express") throw new Error("Timeout");
+          return [];
+        }
+      };
+      const client = new import_client.VulnerabilityDatabaseClient([adapter], db);
+      const result = await client.enrichAll();
+      (0, import_vitest.expect)(result.dependenciesChecked).toBe(2);
+      (0, import_vitest.expect)(result.errors).toHaveLength(1);
+    });
+    (0, import_vitest.it)("should truncate summary to 500 characters", async () => {
+      createDependencyNode("express", "npm", "1.0.5");
+      const longSummary = "A".repeat(600);
+      const cveWithLongSummary = {
+        ...sampleCve,
+        summary: longSummary
+      };
+      const results = /* @__PURE__ */ new Map();
+      results.set("npm:express:1.0.5", [cveWithLongSummary]);
+      const adapter = createMockAdapter("OSV", results);
+      const client = new import_client.VulnerabilityDatabaseClient([adapter], db);
+      await client.enrichAll();
+      const rawDb = db.getRawDb();
+      const row = rawDb.get(
+        "SELECT summary FROM sec_vulnerabilities WHERE cve_id = ?",
+        ["CVE-2023-12345"]
+      );
+      (0, import_vitest.expect)(row.summary).toHaveLength(500);
+    });
+  });
+  (0, import_vitest.describe)("enrichOne()", () => {
+    (0, import_vitest.it)("should return empty array for non-existent dependency", async () => {
+      const adapter = createMockAdapter("OSV", /* @__PURE__ */ new Map());
+      const client = new import_client.VulnerabilityDatabaseClient([adapter], db);
+      const result = await client.enrichOne("dep:npm:nonexistent");
+      (0, import_vitest.expect)(result).toHaveLength(0);
+    });
+    (0, import_vitest.it)("should enrich a single dependency and return CVE records", async () => {
+      const depNodeId = createDependencyNode("express", "npm", "1.0.5");
+      const results = /* @__PURE__ */ new Map();
+      results.set("npm:express:1.0.5", [sampleCve, sampleCve2]);
+      const adapter = createMockAdapter("OSV", results);
+      const client = new import_client.VulnerabilityDatabaseClient([adapter], db);
+      const cves = await client.enrichOne(depNodeId);
+      (0, import_vitest.expect)(cves).toHaveLength(2);
+      (0, import_vitest.expect)(cves[0].id).toBe("CVE-2023-12345");
+      (0, import_vitest.expect)(cves[1].id).toBe("CVE-2023-67890");
+      (0, import_vitest.expect)(db.getNode("vuln:CVE-2023-12345")).not.toBeNull();
+      (0, import_vitest.expect)(db.getNode("vuln:CVE-2023-67890")).not.toBeNull();
+    });
+    (0, import_vitest.it)("should update last_vuln_check for the single dependency", async () => {
+      const depNodeId = createDependencyNode("express", "npm", "1.0.5");
+      const adapter = createMockAdapter("OSV", /* @__PURE__ */ new Map());
+      const client = new import_client.VulnerabilityDatabaseClient([adapter], db);
+      const before = Date.now();
+      await client.enrichOne(depNodeId);
+      const after = Date.now();
+      const rawDb = db.getRawDb();
+      const row = rawDb.get(
+        "SELECT last_vuln_check FROM sec_dependencies WHERE node_id = ?",
+        [depNodeId]
+      );
+      (0, import_vitest.expect)(row.last_vuln_check).toBeGreaterThanOrEqual(before);
+      (0, import_vitest.expect)(row.last_vuln_check).toBeLessThanOrEqual(after);
+    });
+    (0, import_vitest.it)("should deduplicate CVEs when enriching a single dependency", async () => {
+      const depNodeId = createDependencyNode("express", "npm", "1.0.5");
+      const results1 = /* @__PURE__ */ new Map();
+      results1.set("npm:express:1.0.5", [sampleCve]);
+      const results2 = /* @__PURE__ */ new Map();
+      results2.set("npm:express:1.0.5", [sampleCve]);
+      const adapter1 = createMockAdapter("OSV", results1);
+      const adapter2 = createMockAdapter("NVD", results2);
+      const client = new import_client.VulnerabilityDatabaseClient([adapter1, adapter2], db);
+      const cves = await client.enrichOne(depNodeId);
+      (0, import_vitest.expect)(cves).toHaveLength(1);
+    });
+  });
+});
+//# sourceMappingURL=client.test.js.map

package/dist/security/vuln/client.test.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/vuln/client.test.ts"],
+  "sourcesContent": ["/**\n * Tests for VulnerabilityDatabaseClient\n *\n * Verifies:\n * - Querying configured databases and creating Vulnerability_Nodes\n * - Deduplication by CVE identifier across multiple databases\n * - Recording lastVulnCheck timestamp on queried Dependency_Nodes\n * - Handling unreachable databases: log error, set vulnDataStale flag\n * - enrichOne() for single dependency enrichment\n */\nimport { describe, it, expect, beforeEach, afterEach } from 'vitest';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport * as os from 'os';\nimport { VulnerabilityDatabaseClient } from './client';\nimport type { VulnDatabaseAdapter } from './types';\nimport { GraphDatabase } from '../../db/database';\nimport type { Node, Edge } from '../../types';\nimport type { CVERecord } from '../types';\n\ndescribe('VulnerabilityDatabaseClient', () => {\n  let db: GraphDatabase;\n  let tmpDir: string;\n\n  beforeEach(() => {\n    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'kirograph-vuln-client-test-'));\n    db = new GraphDatabase(tmpDir);\n    db.applySecuritySchema();\n  });\n\n  afterEach(() => {\n    db.close();\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  });\n\n  function createDependencyNode(\n    name: string,\n    ecosystem: string,\n    version: string,\n  ): string {\n    const nodeId = `dep:${ecosystem}:${name}`;\n    const rawDb = db.getRawDb();\n\n    const node: Node = {\n      id: nodeId,\n      kind: 'dependency',\n      name,\n      qualifiedName: `${ecosystem}/${name}`,\n      filePath: '',\n      language: 'unknown',\n      startLine: 0,\n      endLine: 0,\n      startColumn: 0,\n      endColumn: 0,\n      isExported: false,\n      isAsync: false,\n      isStatic: false,\n      isAbstract: false,\n      updatedAt: Date.now(),\n    };\n\n    db.upsertNode(node);\n\n    rawDb.run(\n      `INSERT OR REPLACE INTO sec_dependencies\n        (node_id, ecosystem, package_name, declared_constraint, resolved_version, scope, source_manifests)\n       VALUES (?, ?, ?, ?, ?, ?, ?)`,\n      [nodeId, ecosystem, name, `^${version}`, version, 'production', JSON.stringify(['package.json'])],\n    );\n\n    return nodeId;\n  }\n\n  function createMockAdapter(\n    name: string,\n    results: Map<string, CVERecord[]>,\n  ): VulnDatabaseAdapter {\n    return {\n      name,\n      async query(ecosystem: string, packageName: string, version: string): Promise<CVERecord[]> {\n        const key = `${ecosystem}:${packageName}:${version}`;\n        return results.get(key) ?? [];\n      },\n    };\n  }\n\n  function createFailingAdapter(name: string, errorMessage: string): VulnDatabaseAdapter {\n    return {\n      name,\n      async query(): Promise<CVERecord[]> {\n        throw new Error(errorMessage);\n      },\n    };\n  }\n\n  const sampleCve: CVERecord = {\n    id: 'CVE-2023-12345',\n    severity: 7.5,\n    affectedVersionRanges: [{ introduced: '1.0.0', fixed: '1.2.0' }],\n    fixedVersion: '1.2.0',\n    summary: 'A critical vulnerability in express',\n  };\n\n  const sampleCve2: CVERecord = {\n    id: 'CVE-2023-67890',\n    severity: 5.0,\n    affectedVersionRanges: [{ introduced: '0.9.0', fixed: '1.1.0' }],\n    fixedVersion: '1.1.0',\n    summary: 'A moderate vulnerability',\n  };\n\n  describe('enrichAll()', () => {\n    it('should return zero counts when no dependencies exist', async () => {\n      const adapter = createMockAdapter('OSV', new Map());\n      const client = new VulnerabilityDatabaseClient([adapter], db);\n\n      const result = await client.enrichAll();\n\n      expect(result.vulnerabilitiesFound).toBe(0);\n      expect(result.dependenciesChecked).toBe(0);\n      expect(result.errors).toHaveLength(0);\n      expect(result.staleNodes).toHaveLength(0);\n    });\n\n    it('should create Vulnerability_Nodes for matching CVEs', async () => {\n      const depNodeId = createDependencyNode('express', 'npm', '1.0.5');\n\n      const results = new Map<string, CVERecord[]>();\n      results.set('npm:express:1.0.5', [sampleCve]);\n\n      const adapter = createMockAdapter('OSV', results);\n      const client = new VulnerabilityDatabaseClient([adapter], db);\n\n      const result = await client.enrichAll();\n\n      expect(result.vulnerabilitiesFound).toBe(1);\n      expect(result.dependenciesChecked).toBe(1);\n\n      // Verify Vulnerability_Node was created\n      const vulnNode = db.getNode('vuln:CVE-2023-12345');\n      expect(vulnNode).not.toBeNull();\n      expect(vulnNode!.kind).toBe('vulnerability');\n      expect(vulnNode!.name).toBe('CVE-2023-12345');\n\n      // Verify sec_vulnerabilities row\n      const rawDb = db.getRawDb();\n      const vulnRow = rawDb.get(\n        'SELECT * FROM sec_vulnerabilities WHERE cve_id = ?',\n        ['CVE-2023-12345'],\n      );\n      expect(vulnRow).not.toBeNull();\n      expect(vulnRow.severity_score).toBe(7.5);\n      expect(vulnRow.fixed_version).toBe('1.2.0');\n      expect(vulnRow.source_database).toBe('OSV');\n\n      // Verify has_vulnerability edge\n      const edges = db.getEdgesForNodes([depNodeId]);\n      const vulnEdge = edges.find(\n        e => e.source === depNodeId && e.target === 'vuln:CVE-2023-12345' && e.kind === 'has_vulnerability',\n      );\n      expect(vulnEdge).toBeDefined();\n    });\n\n    it('should update last_vuln_check timestamp on queried dependencies', async () => {\n      createDependencyNode('express', 'npm', '1.0.5');\n\n      const adapter = createMockAdapter('OSV', new Map());\n      const client = new VulnerabilityDatabaseClient([adapter], db);\n\n      const before = Date.now();\n      await client.enrichAll();\n      const after = Date.now();\n\n      const rawDb = db.getRawDb();\n      const row = rawDb.get(\n        'SELECT last_vuln_check FROM sec_dependencies WHERE package_name = ?',\n        ['express'],\n      );\n      expect(row.last_vuln_check).toBeGreaterThanOrEqual(before);\n      expect(row.last_vuln_check).toBeLessThanOrEqual(after);\n    });\n\n    it('should deduplicate CVEs by ID across multiple databases', async () => {\n      createDependencyNode('express', 'npm', '1.0.5');\n\n      // Both adapters return the same CVE\n      const results1 = new Map<string, CVERecord[]>();\n      results1.set('npm:express:1.0.5', [sampleCve]);\n\n      const results2 = new Map<string, CVERecord[]>();\n      results2.set('npm:express:1.0.5', [\n        { ...sampleCve, summary: 'Different summary from DB2' },\n      ]);\n\n      const adapter1 = createMockAdapter('OSV', results1);\n      const adapter2 = createMockAdapter('NVD', results2);\n      const client = new VulnerabilityDatabaseClient([adapter1, adapter2], db);\n\n      const result = await client.enrichAll();\n\n      // Only one Vulnerability_Node should be created despite two databases reporting it\n      expect(result.vulnerabilitiesFound).toBe(1);\n\n      const rawDb = db.getRawDb();\n      const vulnRows = rawDb.all('SELECT * FROM sec_vulnerabilities WHERE cve_id = ?', ['CVE-2023-12345']);\n      expect(vulnRows).toHaveLength(1);\n    });\n\n    it('should handle multiple unique CVEs from multiple databases', async () => {\n      createDependencyNode('express', 'npm', '1.0.5');\n\n      const results1 = new Map<string, CVERecord[]>();\n      results1.set('npm:express:1.0.5', [sampleCve]);\n\n      const results2 = new Map<string, CVERecord[]>();\n      results2.set('npm:express:1.0.5', [sampleCve2]);\n\n      const adapter1 = createMockAdapter('OSV', results1);\n      const adapter2 = createMockAdapter('NVD', results2);\n      const client = new VulnerabilityDatabaseClient([adapter1, adapter2], db);\n\n      const result = await client.enrichAll();\n\n      expect(result.vulnerabilitiesFound).toBe(2);\n\n      expect(db.getNode('vuln:CVE-2023-12345')).not.toBeNull();\n      expect(db.getNode('vuln:CVE-2023-67890')).not.toBeNull();\n    });\n\n    it('should handle unreachable databases: set vulnDataStale flag', async () => {\n      const depNodeId = createDependencyNode('express', 'npm', '1.0.5');\n\n      const failingAdapter = createFailingAdapter('OSV', 'Network error');\n      const client = new VulnerabilityDatabaseClient([failingAdapter], db);\n\n      const result = await client.enrichAll();\n\n      expect(result.errors).toHaveLength(1);\n      expect(result.errors[0].dependency).toBe('express');\n      expect(result.errors[0].database).toBe('OSV');\n      expect(result.errors[0].error).toBe('Network error');\n\n      expect(result.staleNodes).toContain(depNodeId);\n\n      // Verify vuln_data_stale flag is set\n      const rawDb = db.getRawDb();\n      const row = rawDb.get(\n        'SELECT vuln_data_stale, vuln_data_stale_since FROM sec_dependencies WHERE node_id = ?',\n        [depNodeId],\n      );\n      expect(row.vuln_data_stale).toBe(1);\n      expect(row.vuln_data_stale_since).toBeGreaterThan(0);\n    });\n\n    it('should continue processing other dependencies when one adapter fails', async () => {\n      createDependencyNode('express', 'npm', '1.0.5');\n      createDependencyNode('lodash', 'npm', '4.17.21');\n\n      // Adapter that fails for express but succeeds for lodash\n      const adapter: VulnDatabaseAdapter = {\n        name: 'OSV',\n        async query(_eco: string, pkg: string): Promise<CVERecord[]> {\n          if (pkg === 'express') throw new Error('Timeout');\n          return [];\n        },\n      };\n\n      const client = new VulnerabilityDatabaseClient([adapter], db);\n      const result = await client.enrichAll();\n\n      // Both dependencies should be checked\n      expect(result.dependenciesChecked).toBe(2);\n      expect(result.errors).toHaveLength(1);\n    });\n\n    it('should truncate summary to 500 characters', async () => {\n      createDependencyNode('express', 'npm', '1.0.5');\n\n      const longSummary = 'A'.repeat(600);\n      const cveWithLongSummary: CVERecord = {\n        ...sampleCve,\n        summary: longSummary,\n      };\n\n      const results = new Map<string, CVERecord[]>();\n      results.set('npm:express:1.0.5', [cveWithLongSummary]);\n\n      const adapter = createMockAdapter('OSV', results);\n      const client = new VulnerabilityDatabaseClient([adapter], db);\n\n      await client.enrichAll();\n\n      const rawDb = db.getRawDb();\n      const row = rawDb.get(\n        'SELECT summary FROM sec_vulnerabilities WHERE cve_id = ?',\n        ['CVE-2023-12345'],\n      );\n      expect(row.summary).toHaveLength(500);\n    });\n  });\n\n  describe('enrichOne()', () => {\n    it('should return empty array for non-existent dependency', async () => {\n      const adapter = createMockAdapter('OSV', new Map());\n      const client = new VulnerabilityDatabaseClient([adapter], db);\n\n      const result = await client.enrichOne('dep:npm:nonexistent');\n\n      expect(result).toHaveLength(0);\n    });\n\n    it('should enrich a single dependency and return CVE records', async () => {\n      const depNodeId = createDependencyNode('express', 'npm', '1.0.5');\n\n      const results = new Map<string, CVERecord[]>();\n      results.set('npm:express:1.0.5', [sampleCve, sampleCve2]);\n\n      const adapter = createMockAdapter('OSV', results);\n      const client = new VulnerabilityDatabaseClient([adapter], db);\n\n      const cves = await client.enrichOne(depNodeId);\n\n      expect(cves).toHaveLength(2);\n      expect(cves[0].id).toBe('CVE-2023-12345');\n      expect(cves[1].id).toBe('CVE-2023-67890');\n\n      // Verify nodes were created\n      expect(db.getNode('vuln:CVE-2023-12345')).not.toBeNull();\n      expect(db.getNode('vuln:CVE-2023-67890')).not.toBeNull();\n    });\n\n    it('should update last_vuln_check for the single dependency', async () => {\n      const depNodeId = createDependencyNode('express', 'npm', '1.0.5');\n\n      const adapter = createMockAdapter('OSV', new Map());\n      const client = new VulnerabilityDatabaseClient([adapter], db);\n\n      const before = Date.now();\n      await client.enrichOne(depNodeId);\n      const after = Date.now();\n\n      const rawDb = db.getRawDb();\n      const row = rawDb.get(\n        'SELECT last_vuln_check FROM sec_dependencies WHERE node_id = ?',\n        [depNodeId],\n      );\n      expect(row.last_vuln_check).toBeGreaterThanOrEqual(before);\n      expect(row.last_vuln_check).toBeLessThanOrEqual(after);\n    });\n\n    it('should deduplicate CVEs when enriching a single dependency', async () => {\n      const depNodeId = createDependencyNode('express', 'npm', '1.0.5');\n\n      const results1 = new Map<string, CVERecord[]>();\n      results1.set('npm:express:1.0.5', [sampleCve]);\n\n      const results2 = new Map<string, CVERecord[]>();\n      results2.set('npm:express:1.0.5', [sampleCve]);\n\n      const adapter1 = createMockAdapter('OSV', results1);\n      const adapter2 = createMockAdapter('NVD', results2);\n      const client = new VulnerabilityDatabaseClient([adapter1, adapter2], db);\n\n      const cves = await client.enrichOne(depNodeId);\n\n      expect(cves).toHaveLength(1);\n    });\n  });\n});\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAUA,oBAA4D;AAC5D,SAAoB;AACpB,WAAsB;AACtB,SAAoB;AACpB,oBAA4C;AAE5C,sBAA8B;AAAA,IAI9B,wBAAS,+BAA+B,MAAM;AAC5C,MAAI;AACJ,MAAI;AAEJ,gCAAW,MAAM;AACf,aAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,6BAA6B,CAAC;AAC7E,SAAK,IAAI,8BAAc,MAAM;AAC7B,OAAG,oBAAoB;AAAA,EACzB,CAAC;AAED,+BAAU,MAAM;AACd,OAAG,MAAM;AACT,OAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACpD,CAAC;AAED,WAAS,qBACP,MACA,WACA,SACQ;AACR,UAAM,SAAS,OAAO,SAAS,IAAI,IAAI;AACvC,UAAM,QAAQ,GAAG,SAAS;AAE1B,UAAM,OAAa;AAAA,MACjB,IAAI;AAAA,MACJ,MAAM;AAAA,MACN;AAAA,MACA,eAAe,GAAG,SAAS,IAAI,IAAI;AAAA,MACnC,UAAU;AAAA,MACV,UAAU;AAAA,MACV,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,MACX,YAAY;AAAA,MACZ,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW,KAAK,IAAI;AAAA,IACtB;AAEA,OAAG,WAAW,IAAI;AAElB,UAAM;AAAA,MACJ;AAAA;AAAA;AAAA,MAGA,CAAC,QAAQ,WAAW,MAAM,IAAI,OAAO,IAAI,SAAS,cAAc,KAAK,UAAU,CAAC,cAAc,CAAC,CAAC;AAAA,IAClG;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,kBACP,MACA,SACqB;AACrB,WAAO;AAAA,MACL;AAAA,MACA,MAAM,MAAM,WAAmB,aAAqB,SAAuC;AACzF,cAAM,MAAM,GAAG,SAAS,IAAI,WAAW,IAAI,OAAO;AAClD,eAAO,QAAQ,IAAI,GAAG,KAAK,CAAC;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,WAAS,qBAAqB,MAAc,cAA2C;AACrF,WAAO;AAAA,MACL;AAAA,MACA,MAAM,QAA8B;AAClC,cAAM,IAAI,MAAM,YAAY;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAuB;AAAA,IAC3B,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,uBAAuB,CAAC,EAAE,YAAY,SAAS,OAAO,QAAQ,CAAC;AAAA,IAC/D,cAAc;AAAA,IACd,SAAS;AAAA,EACX;AAEA,QAAM,aAAwB;AAAA,IAC5B,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,uBAAuB,CAAC,EAAE,YAAY,SAAS,OAAO,QAAQ,CAAC;AAAA,IAC/D,cAAc;AAAA,IACd,SAAS;AAAA,EACX;AAEA,8BAAS,eAAe,MAAM;AAC5B,0BAAG,wDAAwD,YAAY;AACrE,YAAM,UAAU,kBAAkB,OAAO,oBAAI,IAAI,CAAC;AAClD,YAAM,SAAS,IAAI,0CAA4B,CAAC,OAAO,GAAG,EAAE;AAE5D,YAAM,SAAS,MAAM,OAAO,UAAU;AAEtC,gCAAO,OAAO,oBAAoB,EAAE,KAAK,CAAC;AAC1C,gCAAO,OAAO,mBAAmB,EAAE,KAAK,CAAC;AACzC,gCAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AACpC,gCAAO,OAAO,UAAU,EAAE,aAAa,CAAC;AAAA,IAC1C,CAAC;AAED,0BAAG,uDAAuD,YAAY;AACpE,YAAM,YAAY,qBAAqB,WAAW,OAAO,OAAO;AAEhE,YAAM,UAAU,oBAAI,IAAyB;AAC7C,cAAQ,IAAI,qBAAqB,CAAC,SAAS,CAAC;AAE5C,YAAM,UAAU,kBAAkB,OAAO,OAAO;AAChD,YAAM,SAAS,IAAI,0CAA4B,CAAC,OAAO,GAAG,EAAE;AAE5D,YAAM,SAAS,MAAM,OAAO,UAAU;AAEtC,gCAAO,OAAO,oBAAoB,EAAE,KAAK,CAAC;AAC1C,gCAAO,OAAO,mBAAmB,EAAE,KAAK,CAAC;AAGzC,YAAM,WAAW,GAAG,QAAQ,qBAAqB;AACjD,gCAAO,QAAQ,EAAE,IAAI,SAAS;AAC9B,gCAAO,SAAU,IAAI,EAAE,KAAK,eAAe;AAC3C,gCAAO,SAAU,IAAI,EAAE,KAAK,gBAAgB;AAG5C,YAAM,QAAQ,GAAG,SAAS;AAC1B,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA,CAAC,gBAAgB;AAAA,MACnB;AACA,gCAAO,OAAO,EAAE,IAAI,SAAS;AAC7B,gCAAO,QAAQ,cAAc,EAAE,KAAK,GAAG;AACvC,gCAAO,QAAQ,aAAa,EAAE,KAAK,OAAO;AAC1C,gCAAO,QAAQ,eAAe,EAAE,KAAK,KAAK;AAG1C,YAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC;AAC7C,YAAM,WAAW,MAAM;AAAA,QACrB,OAAK,EAAE,WAAW,aAAa,EAAE,WAAW,yBAAyB,EAAE,SAAS;AAAA,MAClF;AACA,gCAAO,QAAQ,EAAE,YAAY;AAAA,IAC/B,CAAC;AAED,0BAAG,mEAAmE,YAAY;AAChF,2BAAqB,WAAW,OAAO,OAAO;AAE9C,YAAM,UAAU,kBAAkB,OAAO,oBAAI,IAAI,CAAC;AAClD,YAAM,SAAS,IAAI,0CAA4B,CAAC,OAAO,GAAG,EAAE;AAE5D,YAAM,SAAS,KAAK,IAAI;AACxB,YAAM,OAAO,UAAU;AACvB,YAAM,QAAQ,KAAK,IAAI;AAEvB,YAAM,QAAQ,GAAG,SAAS;AAC1B,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA,CAAC,SAAS;AAAA,MACZ;AACA,gCAAO,IAAI,eAAe,EAAE,uBAAuB,MAAM;AACzD,gCAAO,IAAI,eAAe,EAAE,oBAAoB,KAAK;AAAA,IACvD,CAAC;AAED,0BAAG,2DAA2D,YAAY;AACxE,2BAAqB,WAAW,OAAO,OAAO;AAG9C,YAAM,WAAW,oBAAI,IAAyB;AAC9C,eAAS,IAAI,qBAAqB,CAAC,SAAS,CAAC;AAE7C,YAAM,WAAW,oBAAI,IAAyB;AAC9C,eAAS,IAAI,qBAAqB;AAAA,QAChC,EAAE,GAAG,WAAW,SAAS,6BAA6B;AAAA,MACxD,CAAC;AAED,YAAM,WAAW,kBAAkB,OAAO,QAAQ;AAClD,YAAM,WAAW,kBAAkB,OAAO,QAAQ;AAClD,YAAM,SAAS,IAAI,0CAA4B,CAAC,UAAU,QAAQ,GAAG,EAAE;AAEvE,YAAM,SAAS,MAAM,OAAO,UAAU;AAGtC,gCAAO,OAAO,oBAAoB,EAAE,KAAK,CAAC;AAE1C,YAAM,QAAQ,GAAG,SAAS;AAC1B,YAAM,WAAW,MAAM,IAAI,sDAAsD,CAAC,gBAAgB,CAAC;AACnG,gCAAO,QAAQ,EAAE,aAAa,CAAC;AAAA,IACjC,CAAC;AAED,0BAAG,8DAA8D,YAAY;AAC3E,2BAAqB,WAAW,OAAO,OAAO;AAE9C,YAAM,WAAW,oBAAI,IAAyB;AAC9C,eAAS,IAAI,qBAAqB,CAAC,SAAS,CAAC;AAE7C,YAAM,WAAW,oBAAI,IAAyB;AAC9C,eAAS,IAAI,qBAAqB,CAAC,UAAU,CAAC;AAE9C,YAAM,WAAW,kBAAkB,OAAO,QAAQ;AAClD,YAAM,WAAW,kBAAkB,OAAO,QAAQ;AAClD,YAAM,SAAS,IAAI,0CAA4B,CAAC,UAAU,QAAQ,GAAG,EAAE;AAEvE,YAAM,SAAS,MAAM,OAAO,UAAU;AAEtC,gCAAO,OAAO,oBAAoB,EAAE,KAAK,CAAC;AAE1C,gCAAO,GAAG,QAAQ,qBAAqB,CAAC,EAAE,IAAI,SAAS;AACvD,gCAAO,GAAG,QAAQ,qBAAqB,CAAC,EAAE,IAAI,SAAS;AAAA,IACzD,CAAC;AAED,0BAAG,+DAA+D,YAAY;AAC5E,YAAM,YAAY,qBAAqB,WAAW,OAAO,OAAO;AAEhE,YAAM,iBAAiB,qBAAqB,OAAO,eAAe;AAClE,YAAM,SAAS,IAAI,0CAA4B,CAAC,cAAc,GAAG,EAAE;AAEnE,YAAM,SAAS,MAAM,OAAO,UAAU;AAEtC,gCAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AACpC,gCAAO,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,KAAK,SAAS;AAClD,gCAAO,OAAO,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,KAAK;AAC5C,gCAAO,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,eAAe;AAEnD,gCAAO,OAAO,UAAU,EAAE,UAAU,SAAS;AAG7C,YAAM,QAAQ,GAAG,SAAS;AAC1B,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA,CAAC,SAAS;AAAA,MACZ;AACA,gCAAO,IAAI,eAAe,EAAE,KAAK,CAAC;AAClC,gCAAO,IAAI,qBAAqB,EAAE,gBAAgB,CAAC;AAAA,IACrD,CAAC;AAED,0BAAG,wEAAwE,YAAY;AACrF,2BAAqB,WAAW,OAAO,OAAO;AAC9C,2BAAqB,UAAU,OAAO,SAAS;AAG/C,YAAM,UAA+B;AAAA,QACnC,MAAM;AAAA,QACN,MAAM,MAAM,MAAc,KAAmC;AAC3D,cAAI,QAAQ,UAAW,OAAM,IAAI,MAAM,SAAS;AAChD,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM,SAAS,IAAI,0CAA4B,CAAC,OAAO,GAAG,EAAE;AAC5D,YAAM,SAAS,MAAM,OAAO,UAAU;AAGtC,gCAAO,OAAO,mBAAmB,EAAE,KAAK,CAAC;AACzC,gCAAO,OAAO,MAAM,EAAE,aAAa,CAAC;AAAA,IACtC,CAAC;AAED,0BAAG,6CAA6C,YAAY;AAC1D,2BAAqB,WAAW,OAAO,OAAO;AAE9C,YAAM,cAAc,IAAI,OAAO,GAAG;AAClC,YAAM,qBAAgC;AAAA,QACpC,GAAG;AAAA,QACH,SAAS;AAAA,MACX;AAEA,YAAM,UAAU,oBAAI,IAAyB;AAC7C,cAAQ,IAAI,qBAAqB,CAAC,kBAAkB,CAAC;AAErD,YAAM,UAAU,kBAAkB,OAAO,OAAO;AAChD,YAAM,SAAS,IAAI,0CAA4B,CAAC,OAAO,GAAG,EAAE;AAE5D,YAAM,OAAO,UAAU;AAEvB,YAAM,QAAQ,GAAG,SAAS;AAC1B,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA,CAAC,gBAAgB;AAAA,MACnB;AACA,gCAAO,IAAI,OAAO,EAAE,aAAa,GAAG;AAAA,IACtC,CAAC;AAAA,EACH,CAAC;AAED,8BAAS,eAAe,MAAM;AAC5B,0BAAG,yDAAyD,YAAY;AACtE,YAAM,UAAU,kBAAkB,OAAO,oBAAI,IAAI,CAAC;AAClD,YAAM,SAAS,IAAI,0CAA4B,CAAC,OAAO,GAAG,EAAE;AAE5D,YAAM,SAAS,MAAM,OAAO,UAAU,qBAAqB;AAE3D,gCAAO,MAAM,EAAE,aAAa,CAAC;AAAA,IAC/B,CAAC;AAED,0BAAG,4DAA4D,YAAY;AACzE,YAAM,YAAY,qBAAqB,WAAW,OAAO,OAAO;AAEhE,YAAM,UAAU,oBAAI,IAAyB;AAC7C,cAAQ,IAAI,qBAAqB,CAAC,WAAW,UAAU,CAAC;AAExD,YAAM,UAAU,kBAAkB,OAAO,OAAO;AAChD,YAAM,SAAS,IAAI,0CAA4B,CAAC,OAAO,GAAG,EAAE;AAE5D,YAAM,OAAO,MAAM,OAAO,UAAU,SAAS;AAE7C,gCAAO,IAAI,EAAE,aAAa,CAAC;AAC3B,gCAAO,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,gBAAgB;AACxC,gCAAO,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,gBAAgB;AAGxC,gCAAO,GAAG,QAAQ,qBAAqB,CAAC,EAAE,IAAI,SAAS;AACvD,gCAAO,GAAG,QAAQ,qBAAqB,CAAC,EAAE,IAAI,SAAS;AAAA,IACzD,CAAC;AAED,0BAAG,2DAA2D,YAAY;AACxE,YAAM,YAAY,qBAAqB,WAAW,OAAO,OAAO;AAEhE,YAAM,UAAU,kBAAkB,OAAO,oBAAI,IAAI,CAAC;AAClD,YAAM,SAAS,IAAI,0CAA4B,CAAC,OAAO,GAAG,EAAE;AAE5D,YAAM,SAAS,KAAK,IAAI;AACxB,YAAM,OAAO,UAAU,SAAS;AAChC,YAAM,QAAQ,KAAK,IAAI;AAEvB,YAAM,QAAQ,GAAG,SAAS;AAC1B,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA,CAAC,SAAS;AAAA,MACZ;AACA,gCAAO,IAAI,eAAe,EAAE,uBAAuB,MAAM;AACzD,gCAAO,IAAI,eAAe,EAAE,oBAAoB,KAAK;AAAA,IACvD,CAAC;AAED,0BAAG,8DAA8D,YAAY;AAC3E,YAAM,YAAY,qBAAqB,WAAW,OAAO,OAAO;AAEhE,YAAM,WAAW,oBAAI,IAAyB;AAC9C,eAAS,IAAI,qBAAqB,CAAC,SAAS,CAAC;AAE7C,YAAM,WAAW,oBAAI,IAAyB;AAC9C,eAAS,IAAI,qBAAqB,CAAC,SAAS,CAAC;AAE7C,YAAM,WAAW,kBAAkB,OAAO,QAAQ;AAClD,YAAM,WAAW,kBAAkB,OAAO,QAAQ;AAClD,YAAM,SAAS,IAAI,0CAA4B,CAAC,UAAU,QAAQ,GAAG,EAAE;AAEvE,YAAM,OAAO,MAAM,OAAO,UAAU,SAAS;AAE7C,gCAAO,IAAI,EAAE,aAAa,CAAC;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/security/vuln/epss-client.js

@@ -0,0 +1,95 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var epss_client_exports = {};
+__export(epss_client_exports, {
+  EpssClient: () => EpssClient
+});
+module.exports = __toCommonJS(epss_client_exports);
+var import_errors = require("../../errors");
+const EPSS_API_URL = "https://api.first.org/data/v1/epss";
+const CHUNK_SIZE = 500;
+const TIMEOUT_MS = 3e4;
+class EpssClient {
+  /**
+   * Fetch EPSS scores for a list of CVE IDs.
+   *
+   * CVEs are batched into chunks of 500 per request. Missing CVEs simply do
+   * not appear in the response and are omitted from the returned map.
+   *
+   * @param cveIds - List of CVE identifiers (e.g. ["CVE-2021-44228", ...])
+   * @returns Map from CVE ID to { score, percentile } (floats in [0, 1])
+   */
+  async fetchScores(cveIds) {
+    const result = /* @__PURE__ */ new Map();
+    if (cveIds.length === 0) {
+      return result;
+    }
+    for (let i = 0; i < cveIds.length; i += CHUNK_SIZE) {
+      const chunk = cveIds.slice(i, i + CHUNK_SIZE);
+      try {
+        const chunkResult = await this.fetchChunk(chunk);
+        for (const [cve, scores] of chunkResult) {
+          result.set(cve, scores);
+        }
+      } catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        (0, import_errors.logWarn)(`[sec:epss] Failed to fetch EPSS scores for chunk of ${chunk.length} CVEs: ${msg}`);
+      }
+    }
+    return result;
+  }
+  async fetchChunk(cveIds) {
+    const result = /* @__PURE__ */ new Map();
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), TIMEOUT_MS);
+    try {
+      const cveParam = cveIds.join(",");
+      const url = `${EPSS_API_URL}?cve=${encodeURIComponent(cveParam)}`;
+      const response = await fetch(url, { signal: controller.signal });
+      if (!response.ok) {
+        (0, import_errors.logWarn)(`[sec:epss] EPSS API returned HTTP ${response.status}`);
+        return result;
+      }
+      const json = await response.json();
+      if (json.status !== "OK" || !Array.isArray(json.data)) {
+        (0, import_errors.logWarn)(`[sec:epss] Unexpected EPSS API response structure`);
+        return result;
+      }
+      for (const entry of json.data) {
+        const score = parseFloat(entry.epss);
+        const percentile = parseFloat(entry.percentile);
+        if (!isNaN(score) && !isNaN(percentile)) {
+          result.set(entry.cve, { score, percentile });
+        }
+      }
+    } catch (error) {
+      const msg = error instanceof Error ? error.message : String(error);
+      (0, import_errors.logError)(`[sec:epss] Error fetching EPSS chunk: ${msg}`);
+      throw error;
+    } finally {
+      clearTimeout(timeout);
+    }
+    return result;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  EpssClient
+});
+//# sourceMappingURL=epss-client.js.map

package/dist/security/vuln/epss-client.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/vuln/epss-client.ts"],
+  "sourcesContent": ["/**\n * EPSS (Exploit Prediction Scoring System) Client\n *\n * Fetches exploit prediction scores from the FIRST.org EPSS API for CVE IDs.\n * EPSS is non-critical: on error, an empty map is returned so the caller can\n * continue without scores.\n *\n * API: https://api.first.org/data/v1/epss\n */\n\nimport { logWarn, logError } from '../../errors';\n\nconst EPSS_API_URL = 'https://api.first.org/data/v1/epss';\nconst CHUNK_SIZE = 500;\nconst TIMEOUT_MS = 30000;\n\ninterface EpssApiResponse {\n  status: string;\n  status_code: number;\n  data: Array<{\n    cve: string;\n    epss: string;\n    percentile: string;\n    date: string;\n  }>;\n}\n\nexport class EpssClient {\n  /**\n   * Fetch EPSS scores for a list of CVE IDs.\n   *\n   * CVEs are batched into chunks of 500 per request. Missing CVEs simply do\n   * not appear in the response and are omitted from the returned map.\n   *\n   * @param cveIds - List of CVE identifiers (e.g. [\"CVE-2021-44228\", ...])\n   * @returns Map from CVE ID to { score, percentile } (floats in [0, 1])\n   */\n  async fetchScores(cveIds: string[]): Promise<Map<string, { score: number; percentile: number }>> {\n    const result = new Map<string, { score: number; percentile: number }>();\n\n    if (cveIds.length === 0) {\n      return result;\n    }\n\n    for (let i = 0; i < cveIds.length; i += CHUNK_SIZE) {\n      const chunk = cveIds.slice(i, i + CHUNK_SIZE);\n      try {\n        const chunkResult = await this.fetchChunk(chunk);\n        for (const [cve, scores] of chunkResult) {\n          result.set(cve, scores);\n        }\n      } catch (error: unknown) {\n        const msg = error instanceof Error ? error.message : String(error);\n        logWarn(`[sec:epss] Failed to fetch EPSS scores for chunk of ${chunk.length} CVEs: ${msg}`);\n        // EPSS is non-critical \u2014 continue with partial results\n      }\n    }\n\n    return result;\n  }\n\n  private async fetchChunk(\n    cveIds: string[],\n  ): Promise<Map<string, { score: number; percentile: number }>> {\n    const result = new Map<string, { score: number; percentile: number }>();\n\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), TIMEOUT_MS);\n\n    try {\n      const cveParam = cveIds.join(',');\n      const url = `${EPSS_API_URL}?cve=${encodeURIComponent(cveParam)}`;\n\n      const response = await fetch(url, { signal: controller.signal });\n\n      if (!response.ok) {\n        logWarn(`[sec:epss] EPSS API returned HTTP ${response.status}`);\n        return result;\n      }\n\n      const json = (await response.json()) as EpssApiResponse;\n\n      if (json.status !== 'OK' || !Array.isArray(json.data)) {\n        logWarn(`[sec:epss] Unexpected EPSS API response structure`);\n        return result;\n      }\n\n      for (const entry of json.data) {\n        const score = parseFloat(entry.epss);\n        const percentile = parseFloat(entry.percentile);\n        if (!isNaN(score) && !isNaN(percentile)) {\n          result.set(entry.cve, { score, percentile });\n        }\n      }\n    } catch (error: unknown) {\n      const msg = error instanceof Error ? error.message : String(error);\n      logError(`[sec:epss] Error fetching EPSS chunk: ${msg}`);\n      throw error;\n    } finally {\n      clearTimeout(timeout);\n    }\n\n    return result;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,oBAAkC;AAElC,MAAM,eAAe;AACrB,MAAM,aAAa;AACnB,MAAM,aAAa;AAaZ,MAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUtB,MAAM,YAAY,QAA+E;AAC/F,UAAM,SAAS,oBAAI,IAAmD;AAEtE,QAAI,OAAO,WAAW,GAAG;AACvB,aAAO;AAAA,IACT;AAEA,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,YAAY;AAClD,YAAM,QAAQ,OAAO,MAAM,GAAG,IAAI,UAAU;AAC5C,UAAI;AACF,cAAM,cAAc,MAAM,KAAK,WAAW,KAAK;AAC/C,mBAAW,CAAC,KAAK,MAAM,KAAK,aAAa;AACvC,iBAAO,IAAI,KAAK,MAAM;AAAA,QACxB;AAAA,MACF,SAAS,OAAgB;AACvB,cAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,mCAAQ,uDAAuD,MAAM,MAAM,UAAU,GAAG,EAAE;AAAA,MAE5F;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,WACZ,QAC6D;AAC7D,UAAM,SAAS,oBAAI,IAAmD;AAEtE,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAE/D,QAAI;AACF,YAAM,WAAW,OAAO,KAAK,GAAG;AAChC,YAAM,MAAM,GAAG,YAAY,QAAQ,mBAAmB,QAAQ,CAAC;AAE/D,YAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,WAAW,OAAO,CAAC;AAE/D,UAAI,CAAC,SAAS,IAAI;AAChB,mCAAQ,qCAAqC,SAAS,MAAM,EAAE;AAC9D,eAAO;AAAA,MACT;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAElC,UAAI,KAAK,WAAW,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAAI,GAAG;AACrD,mCAAQ,mDAAmD;AAC3D,eAAO;AAAA,MACT;AAEA,iBAAW,SAAS,KAAK,MAAM;AAC7B,cAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,cAAM,aAAa,WAAW,MAAM,UAAU;AAC9C,YAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,UAAU,GAAG;AACvC,iBAAO,IAAI,MAAM,KAAK,EAAE,OAAO,WAAW,CAAC;AAAA,QAC7C;AAAA,MACF;AAAA,IACF,SAAS,OAAgB;AACvB,YAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,kCAAS,yCAAyC,GAAG,EAAE;AACvD,YAAM;AAAA,IACR,UAAE;AACA,mBAAa,OAAO;AAAA,IACtB;AAEA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/security/vuln/index.js

@@ -0,0 +1,29 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var vuln_exports = {};
+__export(vuln_exports, {
+  VulnerabilityDatabaseClient: () => import_client.VulnerabilityDatabaseClient
+});
+module.exports = __toCommonJS(vuln_exports);
+var import_client = require("./client");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  VulnerabilityDatabaseClient
+});
+//# sourceMappingURL=index.js.map

package/dist/security/vuln/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/vuln/index.ts"],
+  "sourcesContent": ["/**\n * Vulnerability database subsystem exports.\n */\n\nexport { VulnerabilityDatabaseClient } from './client';\nexport type { VulnDatabaseAdapter } from './types';\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,oBAA4C;",
+  "names": []
+}