kirograph 0.17.0 → 0.20.0

package/dist/security/vuln/epss-client.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/vuln/epss-client.ts"],
+  "sourcesContent": ["/**\n * EPSS (Exploit Prediction Scoring System) Client\n *\n * Fetches exploit prediction scores from the FIRST.org EPSS API for CVE IDs.\n * EPSS is non-critical: on error, an empty map is returned so the caller can\n * continue without scores.\n *\n * API: https://api.first.org/data/v1/epss\n */\n\nimport { logWarn, logError } from '../../errors';\n\nconst EPSS_API_URL = 'https://api.first.org/data/v1/epss';\nconst CHUNK_SIZE = 500;\nconst TIMEOUT_MS = 30000;\n\ninterface EpssApiResponse {\n  status: string;\n  status_code: number;\n  data: Array<{\n    cve: string;\n    epss: string;\n    percentile: string;\n    date: string;\n  }>;\n}\n\nexport class EpssClient {\n  /**\n   * Fetch EPSS scores for a list of CVE IDs.\n   *\n   * CVEs are batched into chunks of 500 per request. Missing CVEs simply do\n   * not appear in the response and are omitted from the returned map.\n   *\n   * @param cveIds - List of CVE identifiers (e.g. [\"CVE-2021-44228\", ...])\n   * @returns Map from CVE ID to { score, percentile } (floats in [0, 1])\n   */\n  async fetchScores(cveIds: string[]): Promise<Map<string, { score: number; percentile: number }>> {\n    const result = new Map<string, { score: number; percentile: number }>();\n\n    if (cveIds.length === 0) {\n      return result;\n    }\n\n    for (let i = 0; i < cveIds.length; i += CHUNK_SIZE) {\n      const chunk = cveIds.slice(i, i + CHUNK_SIZE);\n      try {\n        const chunkResult = await this.fetchChunk(chunk);\n        for (const [cve, scores] of chunkResult) {\n          result.set(cve, scores);\n        }\n      } catch (error: unknown) {\n        const msg = error instanceof Error ? error.message : String(error);\n        logWarn(`[sec:epss] Failed to fetch EPSS scores for chunk of ${chunk.length} CVEs: ${msg}`);\n        // EPSS is non-critical \u2014 continue with partial results\n      }\n    }\n\n    return result;\n  }\n\n  private async fetchChunk(\n    cveIds: string[],\n  ): Promise<Map<string, { score: number; percentile: number }>> {\n    const result = new Map<string, { score: number; percentile: number }>();\n\n    const controller = new AbortController();\n    const timeout = setTimeout(() => controller.abort(), TIMEOUT_MS);\n\n    try {\n      const cveParam = cveIds.join(',');\n      const url = `${EPSS_API_URL}?cve=${encodeURIComponent(cveParam)}`;\n\n      const response = await fetch(url, { signal: controller.signal });\n\n      if (!response.ok) {\n        logWarn(`[sec:epss] EPSS API returned HTTP ${response.status}`);\n        return result;\n      }\n\n      const json = (await response.json()) as EpssApiResponse;\n\n      if (json.status !== 'OK' || !Array.isArray(json.data)) {\n        logWarn(`[sec:epss] Unexpected EPSS API response structure`);\n        return result;\n      }\n\n      for (const entry of json.data) {\n        const score = parseFloat(entry.epss);\n        const percentile = parseFloat(entry.percentile);\n        if (!isNaN(score) && !isNaN(percentile)) {\n          result.set(entry.cve, { score, percentile });\n        }\n      }\n    } catch (error: unknown) {\n      const msg = error instanceof Error ? error.message : String(error);\n      logError(`[sec:epss] Error fetching EPSS chunk: ${msg}`);\n      throw error;\n    } finally {\n      clearTimeout(timeout);\n    }\n\n    return result;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,oBAAkC;AAElC,MAAM,eAAe;AACrB,MAAM,aAAa;AACnB,MAAM,aAAa;AAaZ,MAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUtB,MAAM,YAAY,QAA+E;AAC/F,UAAM,SAAS,oBAAI,IAAmD;AAEtE,QAAI,OAAO,WAAW,GAAG;AACvB,aAAO;AAAA,IACT;AAEA,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,YAAY;AAClD,YAAM,QAAQ,OAAO,MAAM,GAAG,IAAI,UAAU;AAC5C,UAAI;AACF,cAAM,cAAc,MAAM,KAAK,WAAW,KAAK;AAC/C,mBAAW,CAAC,KAAK,MAAM,KAAK,aAAa;AACvC,iBAAO,IAAI,KAAK,MAAM;AAAA,QACxB;AAAA,MACF,SAAS,OAAgB;AACvB,cAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,mCAAQ,uDAAuD,MAAM,MAAM,UAAU,GAAG,EAAE;AAAA,MAE5F;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,WACZ,QAC6D;AAC7D,UAAM,SAAS,oBAAI,IAAmD;AAEtE,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,UAAU;AAE/D,QAAI;AACF,YAAM,WAAW,OAAO,KAAK,GAAG;AAChC,YAAM,MAAM,GAAG,YAAY,QAAQ,mBAAmB,QAAQ,CAAC;AAE/D,YAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,WAAW,OAAO,CAAC;AAE/D,UAAI,CAAC,SAAS,IAAI;AAChB,mCAAQ,qCAAqC,SAAS,MAAM,EAAE;AAC9D,eAAO;AAAA,MACT;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAElC,UAAI,KAAK,WAAW,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAAI,GAAG;AACrD,mCAAQ,mDAAmD;AAC3D,eAAO;AAAA,MACT;AAEA,iBAAW,SAAS,KAAK,MAAM;AAC7B,cAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,cAAM,aAAa,WAAW,MAAM,UAAU;AAC9C,YAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,UAAU,GAAG;AACvC,iBAAO,IAAI,MAAM,KAAK,EAAE,OAAO,WAAW,CAAC;AAAA,QAC7C;AAAA,MACF;AAAA,IACF,SAAS,OAAgB;AACvB,YAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,kCAAS,yCAAyC,GAAG,EAAE;AACvD,YAAM;AAAA,IACR,UAAE;AACA,mBAAa,OAAO;AAAA,IACtB;AAEA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/security/vuln/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Vulnerability database subsystem exports.
+ */
+export { VulnerabilityDatabaseClient } from './client';
+export type { VulnDatabaseAdapter } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/vuln/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/vuln/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC"}

package/dist/security/vuln/index.js

@@ -0,0 +1,29 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var vuln_exports = {};
+__export(vuln_exports, {
+  VulnerabilityDatabaseClient: () => import_client.VulnerabilityDatabaseClient
+});
+module.exports = __toCommonJS(vuln_exports);
+var import_client = require("./client");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  VulnerabilityDatabaseClient
+});
+//# sourceMappingURL=index.js.map

package/dist/security/vuln/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/vuln/index.ts"],
+  "sourcesContent": ["/**\n * Vulnerability database subsystem exports.\n */\n\nexport { VulnerabilityDatabaseClient } from './client';\nexport type { VulnDatabaseAdapter } from './types';\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,oBAA4C;",
+  "names": []
+}

package/dist/security/vuln/osv-adapter.d.ts

@@ -0,0 +1,58 @@
+/**
+ * OSV API Adapter
+ *
+ * Queries the OSV (Open Source Vulnerabilities) database for known CVEs
+ * affecting project dependencies. Implements the VulnDatabaseAdapter interface.
+ */
+import { CVERecord } from '../types';
+import type { VulnDatabaseAdapter, BatchQuery } from './types';
+export type { VulnDatabaseAdapter, BatchQuery };
+export declare class OsvAdapter implements VulnDatabaseAdapter {
+    readonly name = "OSV";
+    private readonly apiUrl;
+    private readonly batchApiUrl;
+    private readonly timeoutMs;
+    constructor(options?: {
+        apiUrl?: string;
+        batchApiUrl?: string;
+        timeoutMs?: number;
+    });
+    /**
+     * Batch query up to OSV_BATCH_MAX_QUERIES packages in a single HTTP request.
+     * Results are returned in the same order as the input queries.
+     * Queries for unsupported ecosystems produce empty results without an HTTP call.
+     */
+    queryBatch(queries: BatchQuery[], signal?: AbortSignal): Promise<Array<CVERecord[]>>;
+    query(ecosystem: string, packageName: string, version: string, signal?: AbortSignal): Promise<CVERecord[]>;
+    /**
+     * Parse the OSV API response into CVERecord objects.
+     */
+    private parseResponse;
+    /**
+     * Extract CVE ID from the vulnerability's aliases or use the OSV ID.
+     * Prefers CVE-* identifiers from the aliases array.
+     */
+    private extractCveId;
+    /**
+     * Extract CVSS v3.1 base score from the severity array.
+     * Returns 0 if no CVSS score is available.
+     */
+    private extractSeverity;
+    /**
+     * Parse a CVSS vector string or numeric score.
+     * CVSS vectors look like: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+     * The base score is not directly in the vector — we extract it if it's a plain number,
+     * or return null if we can't parse it.
+     */
+    private parseCvssScore;
+    /**
+     * Extract affected version ranges and the first fixed version from the vulnerability.
+     */
+    private extractAffectedRanges;
+    /**
+     * Extract and truncate the summary from the vulnerability.
+     * Prefers the summary field, falls back to details.
+     */
+    private extractSummary;
+}
+//# sourceMappingURL=osv-adapter.d.ts.map

package/dist/security/vuln/osv-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv-adapter.d.ts","sourceRoot":"","sources":["../../../src/security/vuln/osv-adapter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAgB,MAAM,UAAU,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI/D,YAAY,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC;AAsEhD,qBAAa,UAAW,YAAW,mBAAmB;IACpD,SAAgB,IAAI,SAAS;IAE7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;IAMnF;;;;OAIG;IACG,UAAU,CACd,OAAO,EAAE,UAAU,EAAE,EACrB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IA6ExB,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,SAAS,EAAE,CAAC;IAkEvB;;OAEG;IACH,OAAO,CAAC,aAAa;IA8BrB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAapB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAyBvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAYtB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAiD7B;;;OAGG;IACH,OAAO,CAAC,cAAc;CAOvB"}

package/dist/security/vuln/osv-adapter.js

@@ -0,0 +1,321 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var osv_adapter_exports = {};
+__export(osv_adapter_exports, {
+  OsvAdapter: () => OsvAdapter
+});
+module.exports = __toCommonJS(osv_adapter_exports);
+var import_errors = require("../errors");
+var import_errors2 = require("../../errors");
+const ECOSYSTEM_MAP = {
+  npm: "npm",
+  maven: "Maven",
+  go: "Go",
+  pypi: "PyPI",
+  cargo: "crates.io",
+  pyproject: "PyPI",
+  // pyproject.toml (Poetry/Hatch/PDM/PEP 621)
+  nuget: "NuGet",
+  gradle: "Maven",
+  // Gradle projects use Maven Central
+  rubygems: "RubyGems",
+  composer: "Packagist",
+  swift: "SwiftURL",
+  pub: "Pub",
+  hex: "Hex"
+};
+const OSV_API_URL = "https://api.osv.dev/v1/query";
+const OSV_BATCH_API_URL = "https://api.osv.dev/v1/querybatch";
+const DEFAULT_TIMEOUT_MS = 3e4;
+const OSV_BATCH_MAX_QUERIES = 1e3;
+const MAX_SUMMARY_LENGTH = 500;
+class OsvAdapter {
+  constructor(options) {
+    this.name = "OSV";
+    this.apiUrl = options?.apiUrl ?? OSV_API_URL;
+    this.batchApiUrl = options?.batchApiUrl ?? OSV_BATCH_API_URL;
+    this.timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  }
+  /**
+   * Batch query up to OSV_BATCH_MAX_QUERIES packages in a single HTTP request.
+   * Results are returned in the same order as the input queries.
+   * Queries for unsupported ecosystems produce empty results without an HTTP call.
+   */
+  async queryBatch(queries, signal) {
+    if (queries.length === 0) return [];
+    const osvQueries = [];
+    const indexMap = [];
+    for (const q of queries) {
+      const osvEcosystem = ECOSYSTEM_MAP[q.ecosystem.toLowerCase()];
+      if (!osvEcosystem) {
+        (0, import_errors2.logWarn)(`OSV adapter: unsupported ecosystem "${q.ecosystem}", skipping batch entry`);
+        indexMap.push(null);
+      } else {
+        indexMap.push(osvQueries.length);
+        osvQueries.push({
+          package: { name: q.packageName, ecosystem: osvEcosystem },
+          version: q.version
+        });
+      }
+    }
+    if (osvQueries.length === 0) {
+      return queries.map(() => []);
+    }
+    const timeoutController = new AbortController();
+    const timeoutId = setTimeout(() => timeoutController.abort(), this.timeoutMs);
+    const combinedSignal = signal ? combineAbortSignals(signal, timeoutController.signal) : timeoutController.signal;
+    let batchResults;
+    try {
+      const response = await fetch(this.batchApiUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ queries: osvQueries }),
+        signal: combinedSignal
+      });
+      if (!response.ok) {
+        throw new import_errors.VulnDatabaseError(
+          `OSV batch API returned HTTP ${response.status}: ${response.statusText}`,
+          "OSV",
+          response.status
+        );
+      }
+      const data = await response.json();
+      batchResults = data.results ?? [];
+    } catch (error) {
+      if (error instanceof import_errors.VulnDatabaseError) throw error;
+      if (isAbortError(error)) {
+        const msg2 = timeoutController.signal.aborted ? `OSV batch query timed out after ${this.timeoutMs}ms (${osvQueries.length} packages)` : `OSV batch query aborted`;
+        (0, import_errors2.logError)(msg2);
+        throw new import_errors.VulnDatabaseError(msg2, "OSV");
+      }
+      const msg = error instanceof Error ? error.message : String(error);
+      (0, import_errors2.logError)(`OSV batch query failed: ${msg}`);
+      throw new import_errors.VulnDatabaseError(`Network error in OSV batch query: ${msg}`, "OSV");
+    } finally {
+      clearTimeout(timeoutId);
+    }
+    return queries.map((_, i) => {
+      const osvIdx = indexMap[i];
+      if (osvIdx === null) return [];
+      const resultEntry = batchResults[osvIdx];
+      if (!resultEntry) return [];
+      return this.parseResponse({ vulns: resultEntry.vulns });
+    });
+  }
+  async query(ecosystem, packageName, version, signal) {
+    const osvEcosystem = ECOSYSTEM_MAP[ecosystem.toLowerCase()];
+    if (!osvEcosystem) {
+      (0, import_errors2.logWarn)(`OSV adapter: unsupported ecosystem "${ecosystem}", skipping query`);
+      return [];
+    }
+    const body = JSON.stringify({
+      package: {
+        name: packageName,
+        ecosystem: osvEcosystem
+      },
+      version
+    });
+    const timeoutController = new AbortController();
+    const timeoutId = setTimeout(() => timeoutController.abort(), this.timeoutMs);
+    const combinedSignal = signal ? combineAbortSignals(signal, timeoutController.signal) : timeoutController.signal;
+    try {
+      const response = await fetch(this.apiUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body,
+        signal: combinedSignal
+      });
+      if (!response.ok) {
+        throw new import_errors.VulnDatabaseError(
+          `OSV API returned HTTP ${response.status}: ${response.statusText}`,
+          "OSV",
+          response.status
+        );
+      }
+      const data = await response.json();
+      return this.parseResponse(data);
+    } catch (error) {
+      if (error instanceof import_errors.VulnDatabaseError) {
+        throw error;
+      }
+      if (isAbortError(error)) {
+        const isTimeout = timeoutController.signal.aborted;
+        const message = isTimeout ? `OSV query timed out after ${this.timeoutMs}ms for ${packageName}@${version}` : `OSV query aborted for ${packageName}@${version}`;
+        (0, import_errors2.logError)(message);
+        throw new import_errors.VulnDatabaseError(message, "OSV");
+      }
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      (0, import_errors2.logError)(`OSV query failed for ${packageName}@${version}: ${errorMessage}`);
+      throw new import_errors.VulnDatabaseError(
+        `Network error querying OSV for ${packageName}@${version}: ${errorMessage}`,
+        "OSV"
+      );
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
+  /**
+   * Parse the OSV API response into CVERecord objects.
+   */
+  parseResponse(data) {
+    if (!data.vulns || data.vulns.length === 0) {
+      return [];
+    }
+    const records = [];
+    for (const vuln of data.vulns) {
+      const cveId = this.extractCveId(vuln);
+      if (!cveId) {
+        continue;
+      }
+      const severity = this.extractSeverity(vuln);
+      const { ranges, fixedVersion } = this.extractAffectedRanges(vuln);
+      const summary = this.extractSummary(vuln);
+      records.push({
+        id: cveId,
+        severity,
+        affectedVersionRanges: ranges,
+        fixedVersion,
+        summary
+      });
+    }
+    return records;
+  }
+  /**
+   * Extract CVE ID from the vulnerability's aliases or use the OSV ID.
+   * Prefers CVE-* identifiers from the aliases array.
+   */
+  extractCveId(vuln) {
+    if (vuln.aliases) {
+      const cveAlias = vuln.aliases.find((alias) => alias.startsWith("CVE-"));
+      if (cveAlias) {
+        return cveAlias;
+      }
+    }
+    return vuln.id;
+  }
+  /**
+   * Extract CVSS v3.1 base score from the severity array.
+   * Returns 0 if no CVSS score is available.
+   */
+  extractSeverity(vuln) {
+    if (!vuln.severity || vuln.severity.length === 0) {
+      return 0;
+    }
+    for (const sev of vuln.severity) {
+      if (sev.type === "CVSS_V3") {
+        const score = this.parseCvssScore(sev.score);
+        if (score !== null) {
+          return score;
+        }
+      }
+    }
+    for (const sev of vuln.severity) {
+      const score = this.parseCvssScore(sev.score);
+      if (score !== null) {
+        return score;
+      }
+    }
+    return 0;
+  }
+  /**
+   * Parse a CVSS vector string or numeric score.
+   * CVSS vectors look like: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+   * The base score is not directly in the vector — we extract it if it's a plain number,
+   * or return null if we can't parse it.
+   */
+  parseCvssScore(scoreStr) {
+    const num = parseFloat(scoreStr);
+    if (!isNaN(num) && num >= 0 && num <= 10) {
+      return num;
+    }
+    return null;
+  }
+  /**
+   * Extract affected version ranges and the first fixed version from the vulnerability.
+   */
+  extractAffectedRanges(vuln) {
+    const ranges = [];
+    let fixedVersion;
+    if (!vuln.affected) {
+      return { ranges, fixedVersion };
+    }
+    for (const affected of vuln.affected) {
+      if (!affected.ranges) {
+        continue;
+      }
+      for (const range of affected.ranges) {
+        if (!range.events || range.events.length === 0) {
+          continue;
+        }
+        const versionRange = {};
+        for (const event of range.events) {
+          if (event.introduced) {
+            versionRange.introduced = event.introduced;
+          }
+          if (event.fixed) {
+            versionRange.fixed = event.fixed;
+            if (!fixedVersion) {
+              fixedVersion = event.fixed;
+            }
+          }
+          if (event.last_affected) {
+            versionRange.lastAffected = event.last_affected;
+          }
+        }
+        if (versionRange.introduced || versionRange.fixed || versionRange.lastAffected) {
+          ranges.push(versionRange);
+        }
+      }
+    }
+    return { ranges, fixedVersion };
+  }
+  /**
+   * Extract and truncate the summary from the vulnerability.
+   * Prefers the summary field, falls back to details.
+   */
+  extractSummary(vuln) {
+    const text = vuln.summary || vuln.details || "";
+    if (text.length <= MAX_SUMMARY_LENGTH) {
+      return text;
+    }
+    return text.slice(0, MAX_SUMMARY_LENGTH - 3) + "...";
+  }
+}
+function combineAbortSignals(...signals) {
+  const controller = new AbortController();
+  for (const signal of signals) {
+    if (signal.aborted) {
+      controller.abort(signal.reason);
+      return controller.signal;
+    }
+    signal.addEventListener("abort", () => controller.abort(signal.reason), { once: true });
+  }
+  return controller.signal;
+}
+function isAbortError(error) {
+  if (error instanceof Error) {
+    return error.name === "AbortError" || error.name === "TimeoutError";
+  }
+  return false;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OsvAdapter
+});
+//# sourceMappingURL=osv-adapter.js.map

package/dist/security/vuln/osv-adapter.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/vuln/osv-adapter.ts"],
+  "sourcesContent": ["/**\n * OSV API Adapter\n *\n * Queries the OSV (Open Source Vulnerabilities) database for known CVEs\n * affecting project dependencies. Implements the VulnDatabaseAdapter interface.\n */\n\nimport { CVERecord, VersionRange } from '../types';\nimport type { VulnDatabaseAdapter, BatchQuery } from './types';\nimport { VulnDatabaseError } from '../errors';\nimport { logWarn, logError } from '../../errors';\n\nexport type { VulnDatabaseAdapter, BatchQuery };\n\n// \u2500\u2500 Ecosystem Mapping \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst ECOSYSTEM_MAP: Record<string, string> = {\n  npm: 'npm',\n  maven: 'Maven',\n  go: 'Go',\n  pypi: 'PyPI',\n  cargo: 'crates.io',\n  pyproject: 'PyPI',  // pyproject.toml (Poetry/Hatch/PDM/PEP 621)\n  nuget: 'NuGet',\n  gradle: 'Maven',    // Gradle projects use Maven Central\n  rubygems: 'RubyGems',\n  composer: 'Packagist',\n  swift: 'SwiftURL',\n  pub: 'Pub',\n  hex: 'Hex',\n};\n\n// \u2500\u2500 OSV Request/Response Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ninterface OsvSeverity {\n  type: string;\n  score: string;\n}\n\ninterface OsvAffectedRange {\n  type: string;\n  events: Array<{ introduced?: string; fixed?: string; last_affected?: string }>;\n}\n\ninterface OsvAffected {\n  package?: { name?: string; ecosystem?: string };\n  ranges?: OsvAffectedRange[];\n  versions?: string[];\n}\n\ninterface OsvVulnerability {\n  id: string;\n  aliases?: string[];\n  summary?: string;\n  details?: string;\n  severity?: OsvSeverity[];\n  affected?: OsvAffected[];\n}\n\ninterface OsvQueryResponse {\n  vulns?: OsvVulnerability[];\n}\n\ninterface OsvBatchQueryItem {\n  package: { name: string; ecosystem: string };\n  version: string;\n}\n\ninterface OsvBatchResponse {\n  results: Array<{ vulns?: OsvVulnerability[] }>;\n}\n\n// \u2500\u2500 Constants \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst OSV_API_URL = 'https://api.osv.dev/v1/query';\nconst OSV_BATCH_API_URL = 'https://api.osv.dev/v1/querybatch';\nconst DEFAULT_TIMEOUT_MS = 30_000;\nconst OSV_BATCH_MAX_QUERIES = 1000;\nconst MAX_SUMMARY_LENGTH = 500;\n\n// \u2500\u2500 OsvAdapter Implementation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport class OsvAdapter implements VulnDatabaseAdapter {\n  public readonly name = 'OSV';\n\n  private readonly apiUrl: string;\n  private readonly batchApiUrl: string;\n  private readonly timeoutMs: number;\n\n  constructor(options?: { apiUrl?: string; batchApiUrl?: string; timeoutMs?: number }) {\n    this.apiUrl = options?.apiUrl ?? OSV_API_URL;\n    this.batchApiUrl = options?.batchApiUrl ?? OSV_BATCH_API_URL;\n    this.timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  }\n\n  /**\n   * Batch query up to OSV_BATCH_MAX_QUERIES packages in a single HTTP request.\n   * Results are returned in the same order as the input queries.\n   * Queries for unsupported ecosystems produce empty results without an HTTP call.\n   */\n  async queryBatch(\n    queries: BatchQuery[],\n    signal?: AbortSignal,\n  ): Promise<Array<CVERecord[]>> {\n    if (queries.length === 0) return [];\n\n    // Map each query to its OSV ecosystem \u2014 track indices of unsupported ones\n    const osvQueries: OsvBatchQueryItem[] = [];\n    const indexMap: Array<number | null> = []; // index into osvQueries, or null if unsupported\n\n    for (const q of queries) {\n      const osvEcosystem = ECOSYSTEM_MAP[q.ecosystem.toLowerCase()];\n      if (!osvEcosystem) {\n        logWarn(`OSV adapter: unsupported ecosystem \"${q.ecosystem}\", skipping batch entry`);\n        indexMap.push(null);\n      } else {\n        indexMap.push(osvQueries.length);\n        osvQueries.push({\n          package: { name: q.packageName, ecosystem: osvEcosystem },\n          version: q.version,\n        });\n      }\n    }\n\n    if (osvQueries.length === 0) {\n      return queries.map(() => []);\n    }\n\n    const timeoutController = new AbortController();\n    const timeoutId = setTimeout(() => timeoutController.abort(), this.timeoutMs);\n    const combinedSignal = signal\n      ? combineAbortSignals(signal, timeoutController.signal)\n      : timeoutController.signal;\n\n    let batchResults: Array<{ vulns?: OsvVulnerability[] }>;\n\n    try {\n      const response = await fetch(this.batchApiUrl, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ queries: osvQueries }),\n        signal: combinedSignal,\n      });\n\n      if (!response.ok) {\n        throw new VulnDatabaseError(\n          `OSV batch API returned HTTP ${response.status}: ${response.statusText}`,\n          'OSV',\n          response.status,\n        );\n      }\n\n      const data = (await response.json()) as OsvBatchResponse;\n      batchResults = data.results ?? [];\n    } catch (error: unknown) {\n      if (error instanceof VulnDatabaseError) throw error;\n      if (isAbortError(error)) {\n        const msg = timeoutController.signal.aborted\n          ? `OSV batch query timed out after ${this.timeoutMs}ms (${osvQueries.length} packages)`\n          : `OSV batch query aborted`;\n        logError(msg);\n        throw new VulnDatabaseError(msg, 'OSV');\n      }\n      const msg = error instanceof Error ? error.message : String(error);\n      logError(`OSV batch query failed: ${msg}`);\n      throw new VulnDatabaseError(`Network error in OSV batch query: ${msg}`, 'OSV');\n    } finally {\n      clearTimeout(timeoutId);\n    }\n\n    // Rebuild full results array aligned with input queries\n    return queries.map((_, i) => {\n      const osvIdx = indexMap[i];\n      if (osvIdx === null) return [];\n      const resultEntry = batchResults[osvIdx];\n      if (!resultEntry) return [];\n      return this.parseResponse({ vulns: resultEntry.vulns });\n    });\n  }\n\n  async query(\n    ecosystem: string,\n    packageName: string,\n    version: string,\n    signal?: AbortSignal,\n  ): Promise<CVERecord[]> {\n    const osvEcosystem = ECOSYSTEM_MAP[ecosystem.toLowerCase()];\n    if (!osvEcosystem) {\n      logWarn(`OSV adapter: unsupported ecosystem \"${ecosystem}\", skipping query`);\n      return [];\n    }\n\n    const body = JSON.stringify({\n      package: {\n        name: packageName,\n        ecosystem: osvEcosystem,\n      },\n      version,\n    });\n\n    // Create a timeout abort signal and combine with any external signal\n    const timeoutController = new AbortController();\n    const timeoutId = setTimeout(() => timeoutController.abort(), this.timeoutMs);\n\n    const combinedSignal = signal\n      ? combineAbortSignals(signal, timeoutController.signal)\n      : timeoutController.signal;\n\n    try {\n      const response = await fetch(this.apiUrl, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body,\n        signal: combinedSignal,\n      });\n\n      if (!response.ok) {\n        throw new VulnDatabaseError(\n          `OSV API returned HTTP ${response.status}: ${response.statusText}`,\n          'OSV',\n          response.status,\n        );\n      }\n\n      const data = (await response.json()) as OsvQueryResponse;\n      return this.parseResponse(data);\n    } catch (error: unknown) {\n      if (error instanceof VulnDatabaseError) {\n        throw error;\n      }\n\n      if (isAbortError(error)) {\n        const isTimeout = timeoutController.signal.aborted;\n        const message = isTimeout\n          ? `OSV query timed out after ${this.timeoutMs}ms for ${packageName}@${version}`\n          : `OSV query aborted for ${packageName}@${version}`;\n        logError(message);\n        throw new VulnDatabaseError(message, 'OSV');\n      }\n\n      const errorMessage = error instanceof Error ? error.message : String(error);\n      logError(`OSV query failed for ${packageName}@${version}: ${errorMessage}`);\n      throw new VulnDatabaseError(\n        `Network error querying OSV for ${packageName}@${version}: ${errorMessage}`,\n        'OSV',\n      );\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n\n  /**\n   * Parse the OSV API response into CVERecord objects.\n   */\n  private parseResponse(data: OsvQueryResponse): CVERecord[] {\n    if (!data.vulns || data.vulns.length === 0) {\n      return [];\n    }\n\n    const records: CVERecord[] = [];\n\n    for (const vuln of data.vulns) {\n      const cveId = this.extractCveId(vuln);\n      if (!cveId) {\n        // Skip vulnerabilities without a CVE identifier\n        continue;\n      }\n\n      const severity = this.extractSeverity(vuln);\n      const { ranges, fixedVersion } = this.extractAffectedRanges(vuln);\n      const summary = this.extractSummary(vuln);\n\n      records.push({\n        id: cveId,\n        severity,\n        affectedVersionRanges: ranges,\n        fixedVersion,\n        summary,\n      });\n    }\n\n    return records;\n  }\n\n  /**\n   * Extract CVE ID from the vulnerability's aliases or use the OSV ID.\n   * Prefers CVE-* identifiers from the aliases array.\n   */\n  private extractCveId(vuln: OsvVulnerability): string | undefined {\n    // Look for a CVE alias first\n    if (vuln.aliases) {\n      const cveAlias = vuln.aliases.find((alias) => alias.startsWith('CVE-'));\n      if (cveAlias) {\n        return cveAlias;\n      }\n    }\n\n    // Fall back to the OSV ID (e.g., GHSA-xxxx-xxxx-xxxx)\n    return vuln.id;\n  }\n\n  /**\n   * Extract CVSS v3.1 base score from the severity array.\n   * Returns 0 if no CVSS score is available.\n   */\n  private extractSeverity(vuln: OsvVulnerability): number {\n    if (!vuln.severity || vuln.severity.length === 0) {\n      return 0;\n    }\n\n    for (const sev of vuln.severity) {\n      if (sev.type === 'CVSS_V3') {\n        const score = this.parseCvssScore(sev.score);\n        if (score !== null) {\n          return score;\n        }\n      }\n    }\n\n    // Try any severity type as fallback\n    for (const sev of vuln.severity) {\n      const score = this.parseCvssScore(sev.score);\n      if (score !== null) {\n        return score;\n      }\n    }\n\n    return 0;\n  }\n\n  /**\n   * Parse a CVSS vector string or numeric score.\n   * CVSS vectors look like: \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"\n   * The base score is not directly in the vector \u2014 we extract it if it's a plain number,\n   * or return null if we can't parse it.\n   */\n  private parseCvssScore(scoreStr: string): number | null {\n    // If it's a plain number\n    const num = parseFloat(scoreStr);\n    if (!isNaN(num) && num >= 0 && num <= 10) {\n      return num;\n    }\n\n    // CVSS vector strings don't contain the base score directly.\n    // OSV sometimes provides the score as a plain number in the score field.\n    return null;\n  }\n\n  /**\n   * Extract affected version ranges and the first fixed version from the vulnerability.\n   */\n  private extractAffectedRanges(vuln: OsvVulnerability): {\n    ranges: VersionRange[];\n    fixedVersion?: string;\n  } {\n    const ranges: VersionRange[] = [];\n    let fixedVersion: string | undefined;\n\n    if (!vuln.affected) {\n      return { ranges, fixedVersion };\n    }\n\n    for (const affected of vuln.affected) {\n      if (!affected.ranges) {\n        continue;\n      }\n\n      for (const range of affected.ranges) {\n        if (!range.events || range.events.length === 0) {\n          continue;\n        }\n\n        const versionRange: VersionRange = {};\n\n        for (const event of range.events) {\n          if (event.introduced) {\n            versionRange.introduced = event.introduced;\n          }\n          if (event.fixed) {\n            versionRange.fixed = event.fixed;\n            // Capture the first fixed version we encounter\n            if (!fixedVersion) {\n              fixedVersion = event.fixed;\n            }\n          }\n          if (event.last_affected) {\n            versionRange.lastAffected = event.last_affected;\n          }\n        }\n\n        // Only add ranges that have at least one meaningful field\n        if (versionRange.introduced || versionRange.fixed || versionRange.lastAffected) {\n          ranges.push(versionRange);\n        }\n      }\n    }\n\n    return { ranges, fixedVersion };\n  }\n\n  /**\n   * Extract and truncate the summary from the vulnerability.\n   * Prefers the summary field, falls back to details.\n   */\n  private extractSummary(vuln: OsvVulnerability): string {\n    const text = vuln.summary || vuln.details || '';\n    if (text.length <= MAX_SUMMARY_LENGTH) {\n      return text;\n    }\n    return text.slice(0, MAX_SUMMARY_LENGTH - 3) + '...';\n  }\n}\n\n// \u2500\u2500 Utility Functions \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Combine multiple AbortSignals into one that aborts when any of them aborts.\n */\nfunction combineAbortSignals(...signals: AbortSignal[]): AbortSignal {\n  const controller = new AbortController();\n\n  for (const signal of signals) {\n    if (signal.aborted) {\n      controller.abort(signal.reason);\n      return controller.signal;\n    }\n\n    signal.addEventListener('abort', () => controller.abort(signal.reason), { once: true });\n  }\n\n  return controller.signal;\n}\n\n/**\n * Check if an error is an abort/timeout error.\n */\nfunction isAbortError(error: unknown): boolean {\n  if (error instanceof Error) {\n    return error.name === 'AbortError' || error.name === 'TimeoutError';\n  }\n  return false;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AASA,oBAAkC;AAClC,IAAAA,iBAAkC;AAMlC,MAAM,gBAAwC;AAAA,EAC5C,KAAK;AAAA,EACL,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,OAAO;AAAA,EACP,WAAW;AAAA;AAAA,EACX,OAAO;AAAA,EACP,QAAQ;AAAA;AAAA,EACR,UAAU;AAAA,EACV,UAAU;AAAA,EACV,OAAO;AAAA,EACP,KAAK;AAAA,EACL,KAAK;AACP;AA4CA,MAAM,cAAc;AACpB,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,wBAAwB;AAC9B,MAAM,qBAAqB;AAIpB,MAAM,WAA0C;AAAA,EAOrD,YAAY,SAAyE;AANrF,SAAgB,OAAO;AAOrB,SAAK,SAAS,SAAS,UAAU;AACjC,SAAK,cAAc,SAAS,eAAe;AAC3C,SAAK,YAAY,SAAS,aAAa;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WACJ,SACA,QAC6B;AAC7B,QAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAGlC,UAAM,aAAkC,CAAC;AACzC,UAAM,WAAiC,CAAC;AAExC,eAAW,KAAK,SAAS;AACvB,YAAM,eAAe,cAAc,EAAE,UAAU,YAAY,CAAC;AAC5D,UAAI,CAAC,cAAc;AACjB,oCAAQ,uCAAuC,EAAE,SAAS,yBAAyB;AACnF,iBAAS,KAAK,IAAI;AAAA,MACpB,OAAO;AACL,iBAAS,KAAK,WAAW,MAAM;AAC/B,mBAAW,KAAK;AAAA,UACd,SAAS,EAAE,MAAM,EAAE,aAAa,WAAW,aAAa;AAAA,UACxD,SAAS,EAAE;AAAA,QACb,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,WAAW,WAAW,GAAG;AAC3B,aAAO,QAAQ,IAAI,MAAM,CAAC,CAAC;AAAA,IAC7B;AAEA,UAAM,oBAAoB,IAAI,gBAAgB;AAC9C,UAAM,YAAY,WAAW,MAAM,kBAAkB,MAAM,GAAG,KAAK,SAAS;AAC5E,UAAM,iBAAiB,SACnB,oBAAoB,QAAQ,kBAAkB,MAAM,IACpD,kBAAkB;AAEtB,QAAI;AAEJ,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAAA,QAC7C,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,WAAW,CAAC;AAAA,QAC5C,QAAQ;AAAA,MACV,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI;AAAA,UACR,+BAA+B,SAAS,MAAM,KAAK,SAAS,UAAU;AAAA,UACtE;AAAA,UACA,SAAS;AAAA,QACX;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,qBAAe,KAAK,WAAW,CAAC;AAAA,IAClC,SAAS,OAAgB;AACvB,UAAI,iBAAiB,gCAAmB,OAAM;AAC9C,UAAI,aAAa,KAAK,GAAG;AACvB,cAAMC,OAAM,kBAAkB,OAAO,UACjC,mCAAmC,KAAK,SAAS,OAAO,WAAW,MAAM,eACzE;AACJ,qCAASA,IAAG;AACZ,cAAM,IAAI,gCAAkBA,MAAK,KAAK;AAAA,MACxC;AACA,YAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,mCAAS,2BAA2B,GAAG,EAAE;AACzC,YAAM,IAAI,gCAAkB,qCAAqC,GAAG,IAAI,KAAK;AAAA,IAC/E,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAGA,WAAO,QAAQ,IAAI,CAAC,GAAG,MAAM;AAC3B,YAAM,SAAS,SAAS,CAAC;AACzB,UAAI,WAAW,KAAM,QAAO,CAAC;AAC7B,YAAM,cAAc,aAAa,MAAM;AACvC,UAAI,CAAC,YAAa,QAAO,CAAC;AAC1B,aAAO,KAAK,cAAc,EAAE,OAAO,YAAY,MAAM,CAAC;AAAA,IACxD,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MACJ,WACA,aACA,SACA,QACsB;AACtB,UAAM,eAAe,cAAc,UAAU,YAAY,CAAC;AAC1D,QAAI,CAAC,cAAc;AACjB,kCAAQ,uCAAuC,SAAS,mBAAmB;AAC3E,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,SAAS;AAAA,QACP,MAAM;AAAA,QACN,WAAW;AAAA,MACb;AAAA,MACA;AAAA,IACF,CAAC;AAGD,UAAM,oBAAoB,IAAI,gBAAgB;AAC9C,UAAM,YAAY,WAAW,MAAM,kBAAkB,MAAM,GAAG,KAAK,SAAS;AAE5E,UAAM,iBAAiB,SACnB,oBAAoB,QAAQ,kBAAkB,MAAM,IACpD,kBAAkB;AAEtB,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,KAAK,QAAQ;AAAA,QACxC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI;AAAA,UACR,yBAAyB,SAAS,MAAM,KAAK,SAAS,UAAU;AAAA,UAChE;AAAA,UACA,SAAS;AAAA,QACX;AAAA,MACF;AAEA,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO,KAAK,cAAc,IAAI;AAAA,IAChC,SAAS,OAAgB;AACvB,UAAI,iBAAiB,iCAAmB;AACtC,cAAM;AAAA,MACR;AAEA,UAAI,aAAa,KAAK,GAAG;AACvB,cAAM,YAAY,kBAAkB,OAAO;AAC3C,cAAM,UAAU,YACZ,6BAA6B,KAAK,SAAS,UAAU,WAAW,IAAI,OAAO,KAC3E,yBAAyB,WAAW,IAAI,OAAO;AACnD,qCAAS,OAAO;AAChB,cAAM,IAAI,gCAAkB,SAAS,KAAK;AAAA,MAC5C;AAEA,YAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1E,mCAAS,wBAAwB,WAAW,IAAI,OAAO,KAAK,YAAY,EAAE;AAC1E,YAAM,IAAI;AAAA,QACR,kCAAkC,WAAW,IAAI,OAAO,KAAK,YAAY;AAAA,QACzE;AAAA,MACF;AAAA,IACF,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAc,MAAqC;AACzD,QAAI,CAAC,KAAK,SAAS,KAAK,MAAM,WAAW,GAAG;AAC1C,aAAO,CAAC;AAAA,IACV;AAEA,UAAM,UAAuB,CAAC;AAE9B,eAAW,QAAQ,KAAK,OAAO;AAC7B,YAAM,QAAQ,KAAK,aAAa,IAAI;AACpC,UAAI,CAAC,OAAO;AAEV;AAAA,MACF;AAEA,YAAM,WAAW,KAAK,gBAAgB,IAAI;AAC1C,YAAM,EAAE,QAAQ,aAAa,IAAI,KAAK,sBAAsB,IAAI;AAChE,YAAM,UAAU,KAAK,eAAe,IAAI;AAExC,cAAQ,KAAK;AAAA,QACX,IAAI;AAAA,QACJ;AAAA,QACA,uBAAuB;AAAA,QACvB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,MAA4C;AAE/D,QAAI,KAAK,SAAS;AAChB,YAAM,WAAW,KAAK,QAAQ,KAAK,CAAC,UAAU,MAAM,WAAW,MAAM,CAAC;AACtE,UAAI,UAAU;AACZ,eAAO;AAAA,MACT;AAAA,IACF;AAGA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,gBAAgB,MAAgC;AACtD,QAAI,CAAC,KAAK,YAAY,KAAK,SAAS,WAAW,GAAG;AAChD,aAAO;AAAA,IACT;AAEA,eAAW,OAAO,KAAK,UAAU;AAC/B,UAAI,IAAI,SAAS,WAAW;AAC1B,cAAM,QAAQ,KAAK,eAAe,IAAI,KAAK;AAC3C,YAAI,UAAU,MAAM;AAClB,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAGA,eAAW,OAAO,KAAK,UAAU;AAC/B,YAAM,QAAQ,KAAK,eAAe,IAAI,KAAK;AAC3C,UAAI,UAAU,MAAM;AAClB,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,eAAe,UAAiC;AAEtD,UAAM,MAAM,WAAW,QAAQ;AAC/B,QAAI,CAAC,MAAM,GAAG,KAAK,OAAO,KAAK,OAAO,IAAI;AACxC,aAAO;AAAA,IACT;AAIA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,sBAAsB,MAG5B;AACA,UAAM,SAAyB,CAAC;AAChC,QAAI;AAEJ,QAAI,CAAC,KAAK,UAAU;AAClB,aAAO,EAAE,QAAQ,aAAa;AAAA,IAChC;AAEA,eAAW,YAAY,KAAK,UAAU;AACpC,UAAI,CAAC,SAAS,QAAQ;AACpB;AAAA,MACF;AAEA,iBAAW,SAAS,SAAS,QAAQ;AACnC,YAAI,CAAC,MAAM,UAAU,MAAM,OAAO,WAAW,GAAG;AAC9C;AAAA,QACF;AAEA,cAAM,eAA6B,CAAC;AAEpC,mBAAW,SAAS,MAAM,QAAQ;AAChC,cAAI,MAAM,YAAY;AACpB,yBAAa,aAAa,MAAM;AAAA,UAClC;AACA,cAAI,MAAM,OAAO;AACf,yBAAa,QAAQ,MAAM;AAE3B,gBAAI,CAAC,cAAc;AACjB,6BAAe,MAAM;AAAA,YACvB;AAAA,UACF;AACA,cAAI,MAAM,eAAe;AACvB,yBAAa,eAAe,MAAM;AAAA,UACpC;AAAA,QACF;AAGA,YAAI,aAAa,cAAc,aAAa,SAAS,aAAa,cAAc;AAC9E,iBAAO,KAAK,YAAY;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,QAAQ,aAAa;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,eAAe,MAAgC;AACrD,UAAM,OAAO,KAAK,WAAW,KAAK,WAAW;AAC7C,QAAI,KAAK,UAAU,oBAAoB;AACrC,aAAO;AAAA,IACT;AACA,WAAO,KAAK,MAAM,GAAG,qBAAqB,CAAC,IAAI;AAAA,EACjD;AACF;AAOA,SAAS,uBAAuB,SAAqC;AACnE,QAAM,aAAa,IAAI,gBAAgB;AAEvC,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,SAAS;AAClB,iBAAW,MAAM,OAAO,MAAM;AAC9B,aAAO,WAAW;AAAA,IACpB;AAEA,WAAO,iBAAiB,SAAS,MAAM,WAAW,MAAM,OAAO,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,EACxF;AAEA,SAAO,WAAW;AACpB;AAKA,SAAS,aAAa,OAAyB;AAC7C,MAAI,iBAAiB,OAAO;AAC1B,WAAO,MAAM,SAAS,gBAAgB,MAAM,SAAS;AAAA,EACvD;AACA,SAAO;AACT;",
+  "names": ["import_errors", "msg"]
+}

package/dist/security/vuln/types.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Shared types for the vulnerability database subsystem.
+ */
+import type { CVERecord } from '../types';
+/** A single entry in a batch vulnerability query. */
+export interface BatchQuery {
+    ecosystem: string;
+    packageName: string;
+    version: string;
+}
+/**
+ * Adapter interface for querying a vulnerability database.
+ * Each supported database (OSV, NVD, etc.) implements this interface.
+ */
+export interface VulnDatabaseAdapter {
+    /** Human-readable name of the database (e.g. "OSV") */
+    name: string;
+    /**
+     * Query for vulnerabilities affecting a specific package version.
+     */
+    query(ecosystem: string, packageName: string, version: string, signal?: AbortSignal): Promise<CVERecord[]>;
+    /**
+     * Batch query — results[i] corresponds to queries[i].
+     * Implementing this is optional but strongly recommended for performance:
+     * a single HTTP request replaces N sequential requests.
+     */
+    queryBatch?(queries: BatchQuery[], signal?: AbortSignal): Promise<Array<CVERecord[]>>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/vuln/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/security/vuln/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAExB;;;;OAIG;IACH,UAAU,CAAC,CACT,OAAO,EAAE,UAAU,EAAE,EACrB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;CAChC"}

package/dist/security/vuln/types.js

@@ -0,0 +1,17 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);
+//# sourceMappingURL=types.js.map

package/dist/security/vuln/types.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/security/vuln/types.ts"],
+  "sourcesContent": ["/**\n * Shared types for the vulnerability database subsystem.\n */\n\nimport type { CVERecord } from '../types';\n\n/** A single entry in a batch vulnerability query. */\nexport interface BatchQuery {\n  ecosystem: string;\n  packageName: string;\n  version: string;\n}\n\n/**\n * Adapter interface for querying a vulnerability database.\n * Each supported database (OSV, NVD, etc.) implements this interface.\n */\nexport interface VulnDatabaseAdapter {\n  /** Human-readable name of the database (e.g. \"OSV\") */\n  name: string;\n\n  /**\n   * Query for vulnerabilities affecting a specific package version.\n   */\n  query(\n    ecosystem: string,\n    packageName: string,\n    version: string,\n    signal?: AbortSignal,\n  ): Promise<CVERecord[]>;\n\n  /**\n   * Batch query \u2014 results[i] corresponds to queries[i].\n   * Implementing this is optional but strongly recommended for performance:\n   * a single HTTP request replaces N sequential requests.\n   */\n  queryBatch?(\n    queries: BatchQuery[],\n    signal?: AbortSignal,\n  ): Promise<Array<CVERecord[]>>;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;AAAA;AAAA;",
+  "names": []
+}

package/dist/sync/index.d.ts

@@ -16,12 +16,14 @@ export declare function shouldIncludeFile(relPath: string, config: KiroGraphConf
 export declare function hashContent(content: Buffer | string): string;
 /**
  * Returns absolute paths of all indexable files under root.
- * Uses git ls-files fast-path when available; falls back to filesystem walk.
+ * Handles monorepos with multiple nested git roots by running git ls-files
+ * from each sub-repo root independently, then merging results.
+ * Falls back to filesystem walk if no git roots found.
  * Respects AbortSignal.
  */
 export declare function scanDirectory(root: string, config: KiroGraphConfig, signal?: AbortSignal): Promise<string[]>;
 /**
- * Classifies git-changed files into added / modified / removed.
+ * Classifies git-changed files into added / modified / removed across all nested git roots.
  * Returns absolute paths. Returns empty arrays if git is unavailable.
  * Excludes paths whose detected language is 'unknown'.
  */

package/dist/sync/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAsFjD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAUnF;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAwBnB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAoCrE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AA+GjD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAUnF;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CA8BnB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAmCrE"}

package/dist/types.d.ts

@@ -1,9 +1,9 @@
 /**
  * KiroGraph Type Definitions
  */
-export type NodeKind = 'file' | 'module' | 'class' | 'struct' | 'interface' | 'trait' | 'protocol' | 'function' | 'method' | 'property' | 'field' | 'variable' | 'constant' | 'enum' | 'enum_member' | 'type_alias' | 'namespace' | 'parameter' | 'import' | 'export' | 'route' | 'component';
-export type EdgeKind = 'contains' | 'calls' | 'imports' | 'exports' | 'extends' | 'implements' | 'references' | 'type_of' | 'returns' | 'instantiates' | 'overrides' | 'decorates';
-export type Language = 'typescript' | 'javascript' | 'tsx' | 'jsx' | 'python' | 'go' | 'rust' | 'java' | 'c' | 'cpp' | 'csharp' | 'php' | 'ruby' | 'swift' | 'kotlin' | 'dart' | 'svelte' | 'pascal' | 'liquid' | 'unknown';
+export type NodeKind = 'file' | 'module' | 'class' | 'struct' | 'interface' | 'trait' | 'protocol' | 'function' | 'method' | 'property' | 'field' | 'variable' | 'constant' | 'enum' | 'enum_member' | 'type_alias' | 'namespace' | 'parameter' | 'import' | 'export' | 'route' | 'component' | 'dependency' | 'vulnerability';
+export type EdgeKind = 'contains' | 'calls' | 'imports' | 'exports' | 'extends' | 'implements' | 'references' | 'type_of' | 'returns' | 'instantiates' | 'overrides' | 'decorates' | 'has_vulnerability' | 'depends_on' | 'declared_in';
+export type Language = 'typescript' | 'javascript' | 'tsx' | 'jsx' | 'python' | 'go' | 'rust' | 'java' | 'c' | 'cpp' | 'csharp' | 'php' | 'ruby' | 'swift' | 'kotlin' | 'dart' | 'svelte' | 'pascal' | 'liquid' | 'elixir' | 'scala' | 'lua' | 'zig' | 'bash' | 'ocaml' | 'elm' | 'solidity' | 'vue' | 'objc' | 'yaml' | 'hcl' | 'css' | 'scss' | 'html' | 'jupyter' | 'rescript' | 'sql' | 'r' | 'julia' | 'powershell' | 'perl' | 'astro' | 'gdscript' | 'nix' | 'verilog' | 'unknown';
 export interface Node {
     id: string;
     kind: NodeKind;
@@ -33,6 +33,8 @@ export interface Edge {
     metadata?: Record<string, unknown>;
     line?: number;
     column?: number;
+    confidence?: 'extracted' | 'inferred' | 'ambiguous';
+    confidenceScore?: number;
 }
 export interface FileRecord {
     path: string;
@@ -104,7 +106,7 @@ export interface TaskContext {
     summary: string;
 }
 export interface IndexProgress {
-    phase: 'scanning' | 'parsing' | 'storing' | 'resolving' | 'detecting frameworks' | 'embeddings' | 'architecture';
+    phase: 'scanning' | 'parsing' | 'storing' | 'resolving' | 'detecting frameworks' | 'embeddings' | 'architecture' | 'security' | 'docs' | 'data' | 'patterns' | 'retrying';
     current: number;
     total: number;
     currentFile?: string;
@@ -123,7 +125,11 @@ export interface SyncResult {
     modified: string[];
     removed: string[];
     nodesCreated: number;
+    nodesUpdated: number;
     nodesRemoved: number;
+    edgesCreated: number;
+    edgesRemoved: number;
+    filesScanned: number;
     errors: string[];
     duration: number;
 }