pnpm-audit-hook 1.0.0

package/dist/cache/file-cache.js

@@ -0,0 +1,195 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileCache = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const hash_1 = require("../utils/hash");
+const logger_1 = require("../utils/logger");
+/** Type guard for NodeJS.ErrnoException */
+function isNodeError(e) {
+    return e instanceof Error && "code" in e;
+}
+/**
+ * Type guard to validate a parsed JSON object as a CacheEntry.
+ * Returns true if the object has the required structure.
+ */
+function isCacheEntry(parsed) {
+    if (!parsed || typeof parsed !== "object")
+        return false;
+    const obj = parsed;
+    return (typeof obj.expiresAt === "number" &&
+        typeof obj.storedAt === "number" &&
+        "value" in obj);
+}
+class FileCache {
+    dir;
+    // In-memory cache for key-to-path mappings (SHA256 is CPU intensive)
+    pathCache = new Map();
+    maxPathCacheEntries;
+    constructor(opts) {
+        this.dir = opts.dir;
+        this.maxPathCacheEntries = Math.max(0, opts.maxPathCacheEntries ?? 10000);
+    }
+    filePathForKey(key) {
+        const cached = this.pathCache.get(key);
+        if (cached) {
+            if (this.maxPathCacheEntries > 0) {
+                this.pathCache.delete(key);
+                this.pathCache.set(key, cached);
+            }
+            return cached;
+        }
+        const h = (0, hash_1.sha256Hex)(key);
+        // Two-level fanout to avoid too many files in one directory
+        const filePath = node_path_1.default.join(this.dir, h.slice(0, 2), `${h}.json`);
+        if (this.maxPathCacheEntries > 0) {
+            this.pathCache.set(key, filePath);
+            if (this.pathCache.size > this.maxPathCacheEntries) {
+                let toEvict = this.pathCache.size - this.maxPathCacheEntries;
+                for (const staleKey of this.pathCache.keys()) {
+                    this.pathCache.delete(staleKey);
+                    if (--toEvict <= 0)
+                        break;
+                }
+            }
+        }
+        return filePath;
+    }
+    async isSymlink(filePath) {
+        try {
+            const stat = await promises_1.default.lstat(filePath);
+            return stat.isSymbolicLink();
+        }
+        catch {
+            return false;
+        }
+    }
+    async get(key) {
+        const filePath = this.filePathForKey(key);
+        try {
+            // Protect against symlink attacks
+            if (await this.isSymlink(filePath)) {
+                logger_1.logger.warn(`Symlink detected at cache path, ignoring: ${filePath}`);
+                return null;
+            }
+            const raw = await promises_1.default.readFile(filePath, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (!isCacheEntry(parsed)) {
+                await this.deleteCorruptedFile(filePath);
+                return null;
+            }
+            if (parsed.expiresAt > Date.now())
+                return parsed;
+            return null;
+        }
+        catch (e) {
+            // Log non-ENOENT errors as they may indicate real problems
+            if (isNodeError(e) && e.code !== "ENOENT") {
+                logger_1.logger.error(`Cache read error for ${key}: ${e.message}`);
+                // Delete corrupted cache file to prevent repeated failures
+                await this.deleteCorruptedFile(filePath);
+            }
+            return null;
+        }
+    }
+    async deleteCorruptedFile(filePath) {
+        try {
+            await promises_1.default.unlink(filePath);
+            logger_1.logger.debug(`Deleted corrupted cache file: ${filePath}`);
+        }
+        catch (unlinkErr) {
+            if (!isNodeError(unlinkErr) || unlinkErr.code !== "ENOENT") {
+                logger_1.logger.debug(`Failed to delete corrupted cache file: ${filePath}`);
+            }
+        }
+    }
+    async set(key, value, ttlSeconds) {
+        if (ttlSeconds <= 0 || !Number.isFinite(ttlSeconds)) {
+            throw new Error(`Invalid TTL: ${ttlSeconds}`);
+        }
+        const filePath = this.filePathForKey(key);
+        const dir = node_path_1.default.dirname(filePath);
+        // Protect against symlink attacks on parent directory
+        if (await this.isSymlink(dir)) {
+            throw new Error(`Symlink detected at cache directory: ${dir}`);
+        }
+        await promises_1.default.mkdir(dir, { recursive: true, mode: 0o700 });
+        const now = Date.now();
+        const entry = {
+            value,
+            storedAt: now,
+            expiresAt: now + ttlSeconds * 1000,
+        };
+        // Atomic-ish write: write temp then rename
+        // Use crypto.randomBytes for secure temp file names
+        const randomSuffix = node_crypto_1.default.randomBytes(16).toString("hex");
+        const tmp = `${filePath}.${process.pid}.${randomSuffix}.tmp`;
+        try {
+            await promises_1.default.writeFile(tmp, JSON.stringify(entry), { encoding: "utf-8", mode: 0o600 });
+            await promises_1.default.rename(tmp, filePath);
+        }
+        catch (e) {
+            // Clean up temp file on failure
+            try {
+                await promises_1.default.unlink(tmp);
+            }
+            catch (cleanupErr) {
+                logger_1.logger.debug(`Failed to clean up temp file ${tmp}: ${cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)}`);
+            }
+            throw e;
+        }
+    }
+    async prune() {
+        let pruned = 0;
+        let failed = 0;
+        try {
+            const subdirs = await promises_1.default.readdir(this.dir);
+            for (const subdir of subdirs) {
+                const subdirPath = node_path_1.default.join(this.dir, subdir);
+                // Use lstat to prevent symlink traversal attacks
+                const stat = await promises_1.default.lstat(subdirPath);
+                if (!stat.isDirectory() || stat.isSymbolicLink())
+                    continue;
+                const files = await promises_1.default.readdir(subdirPath);
+                for (const file of files) {
+                    if (!file.endsWith(".json"))
+                        continue;
+                    const filePath = node_path_1.default.join(subdirPath, file);
+                    try {
+                        const raw = await promises_1.default.readFile(filePath, "utf-8");
+                        const parsed = JSON.parse(raw);
+                        if (!isCacheEntry(parsed) || parsed.expiresAt <= Date.now()) {
+                            await promises_1.default.unlink(filePath);
+                            pruned++;
+                        }
+                    }
+                    catch (readErr) {
+                        // If we can't read/parse, try to delete the corrupted file
+                        logger_1.logger.warn(`Cache file unreadable, attempting deletion: ${filePath}`);
+                        try {
+                            await promises_1.default.unlink(filePath);
+                            pruned++;
+                        }
+                        catch (unlinkErr) {
+                            failed++;
+                            logger_1.logger.error(`Failed to delete corrupted cache file ${filePath}: ${unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr)}`);
+                        }
+                    }
+                }
+            }
+        }
+        catch (e) {
+            // Cache directory may not exist yet, which is not an error
+            if (isNodeError(e) && e.code !== "ENOENT") {
+                logger_1.logger.error(`Cache prune error: ${e.message}`);
+            }
+        }
+        return { pruned, failed };
+    }
+}
+exports.FileCache = FileCache;
+//# sourceMappingURL=file-cache.js.map

package/dist/cache/file-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-cache.js","sourceRoot":"","sources":["../../src/cache/file-cache.ts"],"names":[],"mappings":";;;;;;AAAA,8DAAiC;AACjC,gEAAkC;AAClC,0DAA6B;AAC7B,wCAA0C;AAC1C,4CAAyC;AASzC,2CAA2C;AAC3C,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO,CAAC,YAAY,KAAK,IAAI,MAAM,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAI,MAAe;IACtC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,OAAO,CACL,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,OAAO,IAAI,GAAG,CACf,CAAC;AACJ,CAAC;AAED,MAAa,SAAS;IACH,GAAG,CAAS;IAC7B,qEAAqE;IACpD,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,mBAAmB,CAAS;IAE7C,YAAY,IAAsB;QAChC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,IAAI,KAAK,CAAC,CAAC;IAC5E,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC3B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,CAAC,GAAG,IAAA,gBAAS,EAAC,GAAG,CAAC,CAAC;QACzB,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,IAAI,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACnD,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC;gBAC7D,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC7C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAChC,IAAI,EAAE,OAAO,IAAI,CAAC;wBAAE,MAAM;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAgB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,kCAAkC;YAClC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,eAAM,CAAC,IAAI,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,YAAY,CAAI,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;gBACzC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,MAAM,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,2DAA2D;YAC3D,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1C,eAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,2DAA2D;gBAC3D,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,QAAgB;QAChD,IAAI,CAAC;YACH,MAAM,kBAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,eAAM,CAAC,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3D,eAAM,CAAC,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAQ,EAAE,UAAkB;QACjD,IAAI,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,mBAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEnC,sDAAsD;QACtD,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,kBAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAkB;YAC3B,KAAK;YACL,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI;SACnC,CAAC;QAEF,2CAA2C;QAC3C,oDAAoD;QACpD,MAAM,YAAY,GAAG,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,YAAY,MAAM,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,kBAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnF,MAAM,kBAAE,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,gCAAgC;YAChC,IAAI,CAAC;gBACH,MAAM,kBAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,eAAM,CAAC,KAAK,CAAC,gCAAgC,GAAG,KAAK,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChI,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC/C,iDAAiD;gBACjD,MAAM,IAAI,GAAG,MAAM,kBAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;oBAAE,SAAS;gBAE3D,MAAM,KAAK,GAAG,MAAM,kBAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;wBAAE,SAAS;oBACtC,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBACjD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBACxC,IAAI,CAAC,YAAY,CAAU,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;4BACrE,MAAM,kBAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;4BAC1B,MAAM,EAAE,CAAC;wBACX,CAAC;oBACH,CAAC;oBAAC,OAAO,OAAO,EAAE,CAAC;wBACjB,2DAA2D;wBAC3D,eAAM,CAAC,IAAI,CAAC,+CAA+C,QAAQ,EAAE,CAAC,CAAC;wBACvE,IAAI,CAAC;4BACH,MAAM,kBAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;4BAC1B,MAAM,EAAE,CAAC;wBACX,CAAC;wBAAC,OAAO,SAAS,EAAE,CAAC;4BACnB,MAAM,EAAE,CAAC;4BACT,eAAM,CAAC,KAAK,CACV,yCAAyC,QAAQ,KAAK,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAC3H,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,2DAA2D;YAC3D,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1C,eAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;CACF;AAzKD,8BAyKC"}

package/dist/cache/ttl.d.ts

@@ -0,0 +1,3 @@
+import type { VulnerabilityFinding } from "../types";
+export declare function ttlForFindings(baseTtlSeconds: number, findings: VulnerabilityFinding[]): number;
+//# sourceMappingURL=ttl.d.ts.map

package/dist/cache/ttl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ttl.d.ts","sourceRoot":"","sources":["../../src/cache/ttl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAe/D,wBAAgB,cAAc,CAC5B,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,oBAAoB,EAAE,GAC/B,MAAM,CAOR"}

package/dist/cache/ttl.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ttlForFindings = ttlForFindings;
+const severity_1 = require("../utils/severity");
+/**
+ * Choose an effective TTL based on the most severe finding.
+ *
+ * Rationale: critical/high vulns can change quickly during incident response; keep cache fresher.
+ * This is a best-effort heuristic and can be overridden by setting a smaller base TTL in config.
+ */
+const SEVERITY_TTL = {
+    critical: 15 * 60,
+    high: 30 * 60,
+    medium: 60 * 60,
+};
+function ttlForFindings(baseTtlSeconds, findings) {
+    const maxSeverity = findings.reduce((max, f) => ((0, severity_1.severityRank)(f.severity) > (0, severity_1.severityRank)(max) ? f.severity : max), "unknown");
+    const ttl = SEVERITY_TTL[maxSeverity];
+    return ttl ? Math.max(60, Math.min(baseTtlSeconds, ttl)) : baseTtlSeconds;
+}
+//# sourceMappingURL=ttl.js.map

package/dist/cache/ttl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ttl.js","sourceRoot":"","sources":["../../src/cache/ttl.ts"],"names":[],"mappings":";;AAeA,wCAUC;AAxBD,gDAAiD;AAEjD;;;;;GAKG;AACH,MAAM,YAAY,GAAsC;IACtD,QAAQ,EAAE,EAAE,GAAG,EAAE;IACjB,IAAI,EAAE,EAAE,GAAG,EAAE;IACb,MAAM,EAAE,EAAE,GAAG,EAAE;CAChB,CAAC;AAEF,SAAgB,cAAc,CAC5B,cAAsB,EACtB,QAAgC;IAEhC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,uBAAY,EAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAA,uBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAC7E,SAAS,CACV,CAAC;IACF,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;AAC5E,CAAC"}

package/dist/cache/types.d.ts

@@ -0,0 +1,12 @@
+export interface CacheEntry<T> {
+    value: T;
+    /** unix epoch milliseconds */
+    expiresAt: number;
+    /** unix epoch milliseconds */
+    storedAt: number;
+}
+export interface Cache<T = unknown> {
+    get(key: string): Promise<CacheEntry<T> | null>;
+    set(key: string, value: T, ttlSeconds: number): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/cache/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/cache/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC;IACT,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,KAAK,CAAC,CAAC,GAAG,OAAO;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D"}

package/dist/cache/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/cache/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/cache/types.ts"],"names":[],"mappings":""}

package/dist/config.d.ts

@@ -0,0 +1,17 @@
+import type { AuditConfig, StaticBaselineConfig } from "./types";
+/** Default cutoff date for static baseline */
+export declare const DEFAULT_CUTOFF_DATE = "2025-12-31";
+/**
+ * Check if a published date is before the cutoff date.
+ * Both dates should be ISO date strings (YYYY-MM-DD or full ISO timestamp).
+ * Returns true if publishedDate is before cutoffDate.
+ */
+export declare function isBeforeCutoff(publishedDate: string, cutoffDate: string): boolean;
+export declare const DEFAULT_STATIC_BASELINE: StaticBaselineConfig;
+export declare const DEFAULT_CONFIG: AuditConfig;
+export interface LoadConfigOptions {
+    cwd: string;
+    env: Record<string, string | undefined>;
+}
+export declare function loadConfig(opts: LoadConfigOptions): Promise<AuditConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAkB,WAAW,EAAY,oBAAoB,EAAE,MAAM,SAAS,CAAC;AA0F3F,8CAA8C;AAC9C,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAcjF;AAED,eAAO,MAAM,uBAAuB,EAAE,oBAIrC,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,WAe5B,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACzC;AAaD,wBAAsB,UAAU,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CA2H9E"}

package/dist/config.js

@@ -0,0 +1,258 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CONFIG = exports.DEFAULT_STATIC_BASELINE = exports.DEFAULT_CUTOFF_DATE = void 0;
+exports.isBeforeCutoff = isBeforeCutoff;
+exports.loadConfig = loadConfig;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const yaml_1 = __importDefault(require("yaml"));
+const error_1 = require("./utils/error");
+const logger_1 = require("./utils/logger");
+/** Maximum allowed timeout in milliseconds (5 minutes) */
+const MAX_TIMEOUT_MS = 300000;
+/** Maximum allowed cache TTL in seconds (24 hours) */
+const MAX_CACHE_TTL_SECONDS = 86400;
+/** Type guard for NodeJS.ErrnoException */
+function isNodeError(e) {
+    return e instanceof Error && "code" in e;
+}
+/** Type guard for unknown object access */
+function hasStringProp(obj, key) {
+    return key in obj && typeof obj[key] === "string";
+}
+/** Get optional string property from object, returns undefined if not a string */
+function getOptionalString(obj, key) {
+    const value = obj[key];
+    return typeof value === "string" ? value : undefined;
+}
+/** Validate an allowlist entry from user config, logging warnings for invalid entries */
+function validateAllowlistEntry(e) {
+    if (!e || typeof e !== "object") {
+        logger_1.logger.warn(`Allowlist entry filtered: not an object`);
+        return null;
+    }
+    const obj = e;
+    // Must have either id or package as a string
+    const hasId = hasStringProp(e, "id");
+    const hasPackage = hasStringProp(e, "package");
+    if (!hasId && !hasPackage) {
+        logger_1.logger.warn(`Allowlist entry filtered: missing required 'id' or 'package' field`);
+        return null;
+    }
+    // Optional fields must be strings if present
+    if (obj.version !== undefined && typeof obj.version !== "string") {
+        logger_1.logger.warn(`Allowlist entry filtered: 'version' must be a string (got ${typeof obj.version})`);
+        return null;
+    }
+    if (obj.reason !== undefined && typeof obj.reason !== "string") {
+        logger_1.logger.warn(`Allowlist entry filtered: 'reason' must be a string (got ${typeof obj.reason})`);
+        return null;
+    }
+    // expires must be a valid date string if present
+    if (obj.expires !== undefined) {
+        if (typeof obj.expires !== "string") {
+            logger_1.logger.warn(`Allowlist entry filtered: 'expires' must be a string (got ${typeof obj.expires})`);
+            return null;
+        }
+        if (isNaN(Date.parse(obj.expires))) {
+            logger_1.logger.warn(`Allowlist entry filtered: 'expires' is not a valid date ("${obj.expires}")`);
+            return null;
+        }
+    }
+    // Build the validated entry explicitly to avoid type assertions
+    const version = getOptionalString(e, "version");
+    const reason = getOptionalString(e, "reason");
+    const expires = getOptionalString(e, "expires");
+    // Construct base entry with validated required fields
+    const baseEntry = {};
+    if (version)
+        baseEntry.version = version;
+    if (reason)
+        baseEntry.reason = reason;
+    if (expires)
+        baseEntry.expires = expires;
+    if (hasId) {
+        return {
+            id: obj.id,
+            ...(hasPackage ? { package: obj.package } : {}),
+            ...baseEntry,
+        };
+    }
+    // hasPackage must be true at this point
+    return {
+        package: obj.package,
+        ...baseEntry,
+    };
+}
+/** Default cutoff date for static baseline */
+exports.DEFAULT_CUTOFF_DATE = "2025-12-31";
+/**
+ * Check if a published date is before the cutoff date.
+ * Both dates should be ISO date strings (YYYY-MM-DD or full ISO timestamp).
+ * Returns true if publishedDate is before cutoffDate.
+ */
+function isBeforeCutoff(publishedDate, cutoffDate) {
+    const published = new Date(publishedDate);
+    const cutoff = new Date(cutoffDate);
+    // Invalid dates return false (fail-closed)
+    if (isNaN(published.getTime()) || isNaN(cutoff.getTime())) {
+        logger_1.logger.debug(`Invalid date in isBeforeCutoff: publishedDate="${publishedDate}" (valid=${!isNaN(published.getTime())}), ` +
+            `cutoffDate="${cutoffDate}" (valid=${!isNaN(cutoff.getTime())})`);
+        return false;
+    }
+    return published.getTime() < cutoff.getTime();
+}
+exports.DEFAULT_STATIC_BASELINE = {
+    enabled: true,
+    cutoffDate: exports.DEFAULT_CUTOFF_DATE,
+    dataPath: undefined,
+};
+exports.DEFAULT_CONFIG = {
+    policy: {
+        block: ["critical", "high"],
+        warn: ["medium", "low", "unknown"],
+        allowlist: [],
+    },
+    sources: {
+        github: { enabled: true },
+        nvd: { enabled: true },
+    },
+    performance: { timeoutMs: 15000 },
+    cache: { ttlSeconds: 3600 },
+    failOnNoSources: true,
+    failOnSourceError: true,
+    staticBaseline: exports.DEFAULT_STATIC_BASELINE,
+};
+/**
+ * Validate a path to prevent path traversal attacks.
+ * Rejects absolute paths or any path containing ".." segments.
+ */
+function isValidRelativePath(p) {
+    if (node_path_1.default.isAbsolute(p))
+        return false;
+    const normalized = node_path_1.default.posix.normalize(p.replace(/\\/g, "/"));
+    const segments = normalized.split("/");
+    return !segments.includes("..");
+}
+async function loadConfig(opts) {
+    let configPath;
+    if (opts.env.PNPM_AUDIT_CONFIG_PATH) {
+        if (!isValidRelativePath(opts.env.PNPM_AUDIT_CONFIG_PATH)) {
+            throw new Error(`Invalid PNPM_AUDIT_CONFIG_PATH: path traversal or absolute paths not allowed`);
+        }
+        configPath = node_path_1.default.resolve(opts.cwd, opts.env.PNPM_AUDIT_CONFIG_PATH);
+    }
+    else {
+        configPath = node_path_1.default.resolve(opts.cwd, ".pnpm-audit.yaml");
+    }
+    let raw = {};
+    try {
+        raw = yaml_1.default.parse(await promises_1.default.readFile(configPath, "utf-8")) ?? {};
+    }
+    catch (e) {
+        if (isNodeError(e) && e.code === "ENOENT") {
+            logger_1.logger.debug(`No config file found at ${configPath}, using defaults`);
+        }
+        else {
+            throw new Error(`Failed to read config: ${(0, error_1.errorMessage)(e)}`);
+        }
+    }
+    const validSeverities = new Set(["critical", "high", "medium", "low", "unknown"]);
+    const asSeverities = (v, fallback) => {
+        if (!Array.isArray(v))
+            return fallback;
+        const normalized = v.map((s) => String(s).toLowerCase());
+        const invalid = normalized.filter((s) => !validSeverities.has(s));
+        if (invalid.length > 0) {
+            logger_1.logger.warn(`Invalid severity values ignored: ${invalid.join(", ")}`);
+        }
+        return normalized.filter((s) => validSeverities.has(s));
+    };
+    const policy = raw.policy;
+    const sources = raw.sources;
+    const cache = raw.cache;
+    const performance = raw.performance;
+    const staticBaselineRaw = raw.staticBaseline;
+    const parseStaticBaseline = (v) => {
+        if (!v)
+            return exports.DEFAULT_STATIC_BASELINE;
+        const enabled = v.enabled !== false; // default true
+        // Validate cutoffDate: must be valid ISO date and not in the future
+        let cutoffDate = exports.DEFAULT_CUTOFF_DATE;
+        if (typeof v.cutoffDate === "string") {
+            const parsed = Date.parse(v.cutoffDate);
+            const now = Date.now();
+            if (isNaN(parsed)) {
+                logger_1.logger.warn(`Invalid staticBaseline.cutoffDate format: "${v.cutoffDate}", using default: ${exports.DEFAULT_CUTOFF_DATE}`);
+            }
+            else if (parsed > now) {
+                logger_1.logger.warn(`staticBaseline.cutoffDate "${v.cutoffDate}" is in the future, using default: ${exports.DEFAULT_CUTOFF_DATE}`);
+            }
+            else {
+                cutoffDate = v.cutoffDate;
+            }
+        }
+        let dataPath = undefined;
+        if (typeof v.dataPath === "string" && v.dataPath.length > 0) {
+            if (!isValidRelativePath(v.dataPath)) {
+                logger_1.logger.warn(`Invalid staticBaseline.dataPath: path traversal or absolute paths not allowed, ignoring`);
+            }
+            else {
+                dataPath = v.dataPath;
+            }
+        }
+        return { enabled, cutoffDate, dataPath };
+    };
+    const asAllowlist = (v) => {
+        if (!Array.isArray(v))
+            return [];
+        const validEntries = [];
+        for (const item of v) {
+            const entry = validateAllowlistEntry(item);
+            if (entry)
+                validEntries.push(entry);
+        }
+        return validEntries;
+    };
+    const isSourceEnabled = (v) => {
+        if (v === false)
+            return false;
+        if (typeof v === "object" && v !== null && "enabled" in v) {
+            return v.enabled !== false;
+        }
+        return true; // default enabled
+    };
+    return {
+        ...exports.DEFAULT_CONFIG,
+        policy: {
+            block: asSeverities(policy?.block, exports.DEFAULT_CONFIG.policy.block),
+            warn: asSeverities(policy?.warn, exports.DEFAULT_CONFIG.policy.warn),
+            allowlist: asAllowlist(policy?.allowlist),
+        },
+        sources: {
+            github: { enabled: isSourceEnabled(sources?.github) },
+            nvd: { enabled: isSourceEnabled(sources?.nvd) },
+        },
+        performance: {
+            timeoutMs: typeof performance?.timeoutMs === "number" &&
+                performance.timeoutMs > 0 &&
+                performance.timeoutMs <= MAX_TIMEOUT_MS
+                ? performance.timeoutMs
+                : 15000,
+        },
+        cache: {
+            ttlSeconds: typeof cache?.ttlSeconds === "number" &&
+                cache.ttlSeconds > 0 &&
+                cache.ttlSeconds <= MAX_CACHE_TTL_SECONDS
+                ? cache.ttlSeconds
+                : 3600,
+        },
+        failOnNoSources: raw.failOnNoSources !== false,
+        failOnSourceError: raw.failOnSourceError !== false,
+        staticBaseline: parseStaticBaseline(staticBaselineRaw),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;;;;AAqGA,wCAcC;AAyCD,gCA2HC;AAvRD,gEAAkC;AAClC,0DAA6B;AAC7B,gDAAwB;AAExB,yCAA6C;AAC7C,2CAAwC;AAExC,0DAA0D;AAC1D,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,sDAAsD;AACtD,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,2CAA2C;AAC3C,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO,CAAC,YAAY,KAAK,IAAI,MAAM,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,2CAA2C;AAC3C,SAAS,aAAa,CAAC,GAAW,EAAE,GAAW;IAC7C,OAAO,GAAG,IAAI,GAAG,IAAI,OAAQ,GAA+B,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;AACjF,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,GAAW,EAAE,GAAW;IACjD,MAAM,KAAK,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,yFAAyF;AACzF,SAAS,sBAAsB,CAAC,CAAU;IACxC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChC,eAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,CAA4B,CAAC;IAEzC,6CAA6C;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,eAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6CAA6C;IAC7C,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjE,eAAM,CAAC,IAAI,CAAC,6DAA6D,OAAO,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,eAAM,CAAC,IAAI,CAAC,4DAA4D,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iDAAiD;IACjD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpC,eAAM,CAAC,IAAI,CAAC,6DAA6D,OAAO,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;YAChG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACnC,eAAM,CAAC,IAAI,CAAC,6DAA6D,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAEhD,sDAAsD;IACtD,MAAM,SAAS,GAA4D,EAAE,CAAC;IAC9E,IAAI,OAAO;QAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;IACzC,IAAI,MAAM;QAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;IACtC,IAAI,OAAO;QAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;IAEzC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAY;YACpB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,SAAS;SACb,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAiB;QAC9B,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,8CAA8C;AACjC,QAAA,mBAAmB,GAAG,YAAY,CAAC;AAEhD;;;;GAIG;AACH,SAAgB,cAAc,CAAC,aAAqB,EAAE,UAAkB;IACtE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IAEpC,2CAA2C;IAC3C,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC1D,eAAM,CAAC,KAAK,CACV,kDAAkD,aAAa,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK;YAC3G,eAAe,UAAU,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,GAAG,CACjE,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;AAChD,CAAC;AAEY,QAAA,uBAAuB,GAAyB;IAC3D,OAAO,EAAE,IAAI;IACb,UAAU,EAAE,2BAAmB;IAC/B,QAAQ,EAAE,SAAS;CACpB,CAAC;AAEW,QAAA,cAAc,GAAgB;IACzC,MAAM,EAAE;QACN,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;QAC3B,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;QAClC,SAAS,EAAE,EAAE;KACd;IACD,OAAO,EAAE;QACP,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACzB,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;KACvB;IACD,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;IACjC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IAC3B,eAAe,EAAE,IAAI;IACrB,iBAAiB,EAAE,IAAI;IACvB,cAAc,EAAE,+BAAuB;CACxC,CAAC;AAOF;;;GAGG;AACH,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,mBAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,UAAU,GAAG,mBAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAuB;IACtD,IAAI,UAAkB,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACpC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,mBAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,cAAI,CAAC,KAAK,CAAC,MAAM,kBAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,eAAM,CAAC,KAAK,CAAC,2BAA2B,UAAU,kBAAkB,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAA,oBAAY,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,CAAC,CAAU,EAAE,QAAoB,EAAc,EAAE;QACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,eAAM,CAAC,IAAI,CAAC,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAG,CAAC,MAA6C,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG,CAAC,OAA8C,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,KAA4C,CAAC;IAC/D,MAAM,WAAW,GAAG,GAAG,CAAC,WAAkD,CAAC;IAC3E,MAAM,iBAAiB,GAAG,GAAG,CAAC,cAAqD,CAAC;IAEpF,MAAM,mBAAmB,GAAG,CAAC,CAAsC,EAAwB,EAAE;QAC3F,IAAI,CAAC,CAAC;YAAE,OAAO,+BAAuB,CAAC;QAEvC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,eAAe;QAEpD,oEAAoE;QACpE,IAAI,UAAU,GAAG,2BAAmB,CAAC;QACrC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClB,eAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,UAAU,qBAAqB,2BAAmB,EAAE,CAAC,CAAC;YACpH,CAAC;iBAAM,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBACxB,eAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,UAAU,sCAAsC,2BAAmB,EAAE,CAAC,CAAC;YACrH,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,GAAuB,SAAS,CAAC;QAC7C,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,eAAM,CAAC,IAAI,CACT,yFAAyF,CAC1F,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,CAAU,EAAoB,EAAE;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,YAAY,GAAqB,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,KAAK;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,CAAC,CAAU,EAAW,EAAE;QAC9C,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YAC1D,OAAQ,CAA2B,CAAC,OAAO,KAAK,KAAK,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,kBAAkB;IACjC,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,sBAAc;QACjB,MAAM,EAAE;YACN,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,sBAAc,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,sBAAc,CAAC,MAAM,CAAC,IAAI,CAAC;YAC5D,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;SAC1C;QACD,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE;YACrD,GAAG,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;SAChD;QACD,WAAW,EAAE;YACX,SAAS,EACP,OAAO,WAAW,EAAE,SAAS,KAAK,QAAQ;gBAC1C,WAAW,CAAC,SAAS,GAAG,CAAC;gBACzB,WAAW,CAAC,SAAS,IAAI,cAAc;gBACrC,CAAC,CAAC,WAAW,CAAC,SAAS;gBACvB,CAAC,CAAC,KAAK;SACZ;QACD,KAAK,EAAE;YACL,UAAU,EACR,OAAO,KAAK,EAAE,UAAU,KAAK,QAAQ;gBACrC,KAAK,CAAC,UAAU,GAAG,CAAC;gBACpB,KAAK,CAAC,UAAU,IAAI,qBAAqB;gBACvC,CAAC,CAAC,KAAK,CAAC,UAAU;gBAClB,CAAC,CAAC,IAAI;SACX;QACD,eAAe,EAAE,GAAG,CAAC,eAAe,KAAK,KAAK;QAC9C,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,KAAK,KAAK;QAClD,cAAc,EAAE,mBAAmB,CAAC,iBAAiB,CAAC;KACvD,CAAC;AACJ,CAAC"}

package/dist/databases/aggregator.d.ts

@@ -0,0 +1,24 @@
+import type { AuditConfig, PackageRef, VulnerabilityFinding } from "../types";
+import type { Cache } from "../cache/types";
+import type { StaticDbReader } from "../static-db/reader";
+export interface AggregateContext {
+    cfg: AuditConfig;
+    env: Record<string, string | undefined>;
+    cache: Cache;
+    registryUrl: string;
+    /** Pre-initialized static DB reader (optional, will be created if not provided) */
+    staticDb?: StaticDbReader | null;
+}
+export interface AggregateResult {
+    findings: VulnerabilityFinding[];
+    sources: Record<string, {
+        ok: boolean;
+        error?: string;
+        durationMs: number;
+    }>;
+}
+/**
+ * Query multiple vulnerability sources and aggregate findings.
+ */
+export declare function aggregateVulnerabilities(pkgs: PackageRef[], ctx: AggregateContext): Promise<AggregateResult>;
+//# sourceMappingURL=aggregator.d.ts.map

package/dist/databases/aggregator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../src/databases/aggregator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAC9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAQ1D,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9E;AAiBD;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,UAAU,EAAE,EAClB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,eAAe,CAAC,CAmG1B"}