pnpm-audit-hook 1.0.0

package/dist/databases/aggregator.js

@@ -0,0 +1,118 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aggregateVulnerabilities = aggregateVulnerabilities;
+const node_path_1 = __importDefault(require("node:path"));
+const http_1 = require("../utils/http");
+const github_advisory_1 = require("./github-advisory");
+const nvd_1 = require("./nvd");
+const logger_1 = require("../utils/logger");
+const error_1 = require("../utils/error");
+const reader_1 = require("../static-db/reader");
+/**
+ * Deduplicate findings by (packageName, packageVersion, id).
+ * Keeps the first occurrence from each source for richer data.
+ */
+function dedupeFindings(findings) {
+    const seen = new Map();
+    for (const f of findings) {
+        const key = `${f.packageName}@${f.packageVersion}:${f.id}`;
+        if (!seen.has(key)) {
+            seen.set(key, f);
+        }
+    }
+    return [...seen.values()];
+}
+/**
+ * Query multiple vulnerability sources and aggregate findings.
+ */
+async function aggregateVulnerabilities(pkgs, ctx) {
+    const http = new http_1.HttpClient({
+        timeoutMs: ctx.cfg.performance?.timeoutMs ?? 15000,
+        userAgent: "pnpm-audit-hook",
+        retries: 2,
+    });
+    const queryCtx = {
+        cfg: ctx.cfg,
+        env: ctx.env,
+        http,
+        cache: ctx.cache,
+        registryUrl: ctx.registryUrl,
+    };
+    const sourceStatus = {};
+    // Initialize static DB if enabled and not provided
+    let staticDb = ctx.staticDb ?? null;
+    const staticBaselineCfg = ctx.cfg.staticBaseline;
+    if (staticBaselineCfg?.enabled && !staticDb) {
+        try {
+            // Path is relative to dist/ directory where index.js lives
+            // Static DB data is at dist/static-db/data/
+            const defaultDataPath = node_path_1.default.resolve(__dirname, "static-db", "data");
+            staticDb = await (0, reader_1.createStaticDbReader)({
+                dataPath: staticBaselineCfg.dataPath ?? defaultDataPath,
+                cutoffDate: staticBaselineCfg.cutoffDate,
+            });
+            if (staticDb) {
+                logger_1.logger.debug(`Static DB loaded, cutoff date: ${staticDb.getCutoffDate()}`);
+            }
+            else {
+                logger_1.logger.warn("Static baseline enabled but database could not be loaded");
+            }
+        }
+        catch (e) {
+            logger_1.logger.warn(`Failed to load static DB: ${(0, error_1.errorMessage)(e)}`);
+        }
+    }
+    // GitHub Advisory is the primary (and only) vulnerability source
+    // Pass static DB for hybrid lookup if available
+    const githubSource = new github_advisory_1.GitHubAdvisorySource({
+        staticDb,
+        cutoffDate: staticBaselineCfg?.cutoffDate,
+    });
+    const githubEnabled = githubSource.isEnabled(ctx.cfg, ctx.env);
+    if (!githubEnabled) {
+        logger_1.logger.warn("GitHub Advisory source is disabled - no vulnerability checks will be performed");
+        sourceStatus[githubSource.id] = { ok: true, error: "disabled by configuration", durationMs: 0 };
+        // Fail-closed: block when no sources are enabled (default behavior for security)
+        if (ctx.cfg.failOnNoSources !== false) {
+            throw new Error("All vulnerability sources are disabled. Set failOnNoSources: false to allow this.");
+        }
+        return { findings: [], sources: sourceStatus };
+    }
+    let findings = [];
+    try {
+        const result = await githubSource.query(pkgs, queryCtx);
+        findings = result.findings;
+        sourceStatus[githubSource.id] = { ok: result.ok, error: result.error, durationMs: result.durationMs };
+        // Fail-closed on partial failure (default: true for security)
+        if (!result.ok && ctx.cfg.failOnSourceError !== false) {
+            throw new Error(`GitHub Advisory source failed: ${result.error}`);
+        }
+    }
+    catch (e) {
+        const errMsg = (0, error_1.errorMessage)(e);
+        logger_1.logger.error(`GitHub Advisory source failed: ${errMsg}`);
+        sourceStatus[githubSource.id] = { ok: false, error: errMsg, durationMs: 0 };
+        // Fail-closed on exception (default: true for security)
+        if (ctx.cfg.failOnSourceError !== false) {
+            throw e;
+        }
+    }
+    // Deduplicate findings (in case of duplicates within GitHub response)
+    const dedupedFindings = dedupeFindings(findings);
+    // NVD enrichment - adds CVSS data and fills in missing severity for CVE IDs
+    // Skip if disabled, no findings, or no findings with unknown severity needing enrichment
+    const needsNvdEnrichment = ctx.cfg.sources?.nvd?.enabled !== false &&
+        dedupedFindings.some((f) => f.severity === "unknown");
+    if (needsNvdEnrichment) {
+        const nvdResult = await (0, nvd_1.enrichFindingsWithNvd)(dedupedFindings, queryCtx);
+        sourceStatus["nvd"] = { ok: nvdResult.ok, error: nvdResult.error, durationMs: nvdResult.durationMs };
+    }
+    return {
+        findings: dedupedFindings,
+        sources: sourceStatus,
+    };
+}
+//# sourceMappingURL=aggregator.js.map

package/dist/databases/aggregator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregator.js","sourceRoot":"","sources":["../../src/databases/aggregator.ts"],"names":[],"mappings":";;;;;AA4CA,4DAsGC;AAlJD,0DAA6B;AAK7B,wCAA2C;AAC3C,uDAAyD;AACzD,+BAA8C;AAC9C,4CAAyC;AACzC,0CAA8C;AAC9C,gDAA2D;AAgB3D;;;GAGG;AACH,SAAS,cAAc,CAAC,QAAgC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAgC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,wBAAwB,CAC5C,IAAkB,EAClB,GAAqB;IAErB,MAAM,IAAI,GAAG,IAAI,iBAAU,CAAC;QAC1B,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,IAAI,KAAK;QAClD,SAAS,EAAE,iBAAiB;QAC5B,OAAO,EAAE,CAAC;KACX,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAkB;QAC9B,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,IAAI;QACJ,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC;IAEF,MAAM,YAAY,GAAwE,EAAE,CAAC;IAE7F,mDAAmD;IACnD,IAAI,QAAQ,GAA0B,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC3D,MAAM,iBAAiB,GAAG,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;IAEjD,IAAI,iBAAiB,EAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,2DAA2D;YAC3D,4CAA4C;YAC5C,MAAM,eAAe,GAAG,mBAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;YACrE,QAAQ,GAAG,MAAM,IAAA,6BAAoB,EAAC;gBACpC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,IAAI,eAAe;gBACvD,UAAU,EAAE,iBAAiB,CAAC,UAAU;aACzC,CAAC,CAAC;YACH,IAAI,QAAQ,EAAE,CAAC;gBACb,eAAM,CAAC,KAAK,CAAC,kCAAkC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,eAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,eAAM,CAAC,IAAI,CAAC,6BAA6B,IAAA,oBAAY,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,gDAAgD;IAChD,MAAM,YAAY,GAAG,IAAI,sCAAoB,CAAC;QAC5C,QAAQ;QACR,UAAU,EAAE,iBAAiB,EAAE,UAAU;KAC1C,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAE/D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,eAAM,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAC9F,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,2BAA2B,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAEhG,iFAAiF;QACjF,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACvG,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,QAAQ,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;QAEtG,8DAA8D;QAC9D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,IAAA,oBAAY,EAAC,CAAC,CAAC,CAAC;QAC/B,eAAM,CAAC,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;QACzD,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAE5E,wDAAwD;QACxD,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YACxC,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEjD,4EAA4E;IAC5E,yFAAyF;IACzF,MAAM,kBAAkB,GACtB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,KAAK;QACvC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAExD,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,IAAA,2BAAqB,EAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QACzE,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC;IACvG,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,eAAe;QACzB,OAAO,EAAE,YAAY;KACtB,CAAC;AACJ,CAAC"}

package/dist/databases/connector.d.ts

@@ -0,0 +1,36 @@
+import type { PackageRef, VulnerabilityFinding, FindingSource } from "../types";
+import type { Cache } from "../cache/types";
+import type { HttpClient } from "../utils/http";
+import type { AuditConfig } from "../types";
+export interface SourceContext {
+    cfg: AuditConfig;
+    env: Record<string, string | undefined>;
+    http: HttpClient;
+    cache: Cache;
+    registryUrl: string;
+}
+/**
+ * Options for filtering vulnerability queries.
+ */
+export interface VulnerabilitySourceOptions {
+    /**
+     * Only return vulnerabilities published after this date.
+     * Format: ISO 8601 date string (YYYY-MM-DD), e.g., "2025-01-01"
+     *
+     * For GitHub Advisory API, this translates to: published=>YYYY-MM-DD
+     */
+    publishedAfter?: string;
+}
+export interface SourceResult {
+    source: FindingSource;
+    ok: boolean;
+    error?: string;
+    durationMs: number;
+    findings: VulnerabilityFinding[];
+}
+export interface VulnerabilitySource {
+    id: FindingSource;
+    isEnabled(cfg: AuditConfig, env: Record<string, string | undefined>): boolean;
+    query(pkgs: PackageRef[], ctx: SourceContext, options?: VulnerabilitySourceOptions): Promise<SourceResult>;
+}
+//# sourceMappingURL=connector.d.ts.map

package/dist/databases/connector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.d.ts","sourceRoot":"","sources":["../../src/databases/connector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,aAAa,CAAC;IAClB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC;IAC9E,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC5G"}

package/dist/databases/connector.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=connector.js.map

package/dist/databases/connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector.js","sourceRoot":"","sources":["../../src/databases/connector.ts"],"names":[],"mappings":""}

package/dist/databases/github-advisory.d.ts

@@ -0,0 +1,48 @@
+import type { VulnerabilitySource, SourceContext, SourceResult, VulnerabilitySourceOptions } from "./connector";
+import type { AuditConfig, FindingSource, PackageRef } from "../types";
+import type { StaticDbReader } from "../static-db/reader";
+/**
+ * Options for configuring the GitHub Advisory source.
+ */
+export interface GitHubAdvisoryOptions {
+    /** Static database reader for historical vulnerabilities */
+    staticDb?: StaticDbReader | null;
+    /** Cutoff date for static DB (ISO date string, e.g., "2025-12-31") */
+    cutoffDate?: string;
+}
+export declare class GitHubAdvisorySource implements VulnerabilitySource {
+    id: FindingSource;
+    private staticDb;
+    private cutoffDate;
+    constructor(options?: GitHubAdvisoryOptions);
+    isEnabled(cfg: AuditConfig, env: Record<string, string | undefined>): boolean;
+    private cacheKey;
+    /**
+     * Query GitHub Advisory Database for vulnerabilities affecting the given packages.
+     *
+     * Uses a hybrid approach when static DB is available:
+     * 1. Query static DB for historical vulnerabilities
+     * 2. Query GitHub API for recent vulnerabilities (after cutoff date)
+     * 3. Merge and deduplicate results (API data preferred over static DB)
+     *
+     * Falls back to full API query if static DB is not available.
+     *
+     * @param pkgs - Packages to check for vulnerabilities
+     * @param ctx - Source context with configuration, HTTP client, and cache
+     * @param options - Optional query filters
+     * @param options.publishedAfter - Only return advisories published after this ISO 8601 date (YYYY-MM-DD)
+     *                                  Uses GitHub API's `published=>YYYY-MM-DD` parameter
+     * @returns Source result with findings and status
+     */
+    query(pkgs: PackageRef[], ctx: SourceContext, options?: VulnerabilitySourceOptions): Promise<SourceResult>;
+    /**
+     * Query static database for historical vulnerabilities.
+     */
+    private queryStaticDb;
+    /**
+     * Query GitHub API for vulnerabilities.
+     * Returns array of error messages for failed packages.
+     */
+    private queryGitHubApi;
+}
+//# sourceMappingURL=github-advisory.d.ts.map

package/dist/databases/github-advisory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-advisory.d.ts","sourceRoot":"","sources":["../../src/databases/github-advisory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,YAAY,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAChH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAiD,MAAM,UAAU,CAAC;AACtH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA8B1D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,EAAE,EAAE,aAAa,CAAY;IAC7B,OAAO,CAAC,QAAQ,CAAwB;IACxC,OAAO,CAAC,UAAU,CAAgB;gBAEtB,OAAO,GAAE,qBAA0B;IAK/C,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO;IAI7E,OAAO,CAAC,QAAQ;IAIhB;;;;;;;;;;;;;;;;OAgBG;IACG,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,YAAY,CAAC;IAuIhH;;OAEG;YACW,aAAa;IA0C3B;;;OAGG;YACW,cAAc;CA+J7B"}

package/dist/databases/github-advisory.js

@@ -0,0 +1,332 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitHubAdvisorySource = void 0;
+const ttl_1 = require("../cache/ttl");
+const semver_1 = require("../utils/semver");
+const severity_1 = require("../utils/severity");
+const logger_1 = require("../utils/logger");
+const error_1 = require("../utils/error");
+const concurrency_1 = require("../utils/concurrency");
+const CACHE_READ_CONCURRENCY = 50;
+const CACHE_WRITE_CONCURRENCY = 25;
+const STATIC_DB_CONCURRENCY = 10;
+class GitHubAdvisorySource {
+    id = "github";
+    staticDb;
+    cutoffDate;
+    constructor(options = {}) {
+        this.staticDb = options.staticDb ?? null;
+        this.cutoffDate = options.cutoffDate ?? null;
+    }
+    isEnabled(cfg, env) {
+        return cfg.sources?.github?.enabled !== false && env.PNPM_AUDIT_DISABLE_GITHUB !== "true";
+    }
+    cacheKey(ctx, pkg) {
+        return `github:${ctx.registryUrl}:${pkg.name}@${pkg.version}`;
+    }
+    /**
+     * Query GitHub Advisory Database for vulnerabilities affecting the given packages.
+     *
+     * Uses a hybrid approach when static DB is available:
+     * 1. Query static DB for historical vulnerabilities
+     * 2. Query GitHub API for recent vulnerabilities (after cutoff date)
+     * 3. Merge and deduplicate results (API data preferred over static DB)
+     *
+     * Falls back to full API query if static DB is not available.
+     *
+     * @param pkgs - Packages to check for vulnerabilities
+     * @param ctx - Source context with configuration, HTTP client, and cache
+     * @param options - Optional query filters
+     * @param options.publishedAfter - Only return advisories published after this ISO 8601 date (YYYY-MM-DD)
+     *                                  Uses GitHub API's `published=>YYYY-MM-DD` parameter
+     * @returns Source result with findings and status
+     */
+    async query(pkgs, ctx, options) {
+        const start = Date.now();
+        const findings = [];
+        // Check cache first (parallel reads)
+        const targets = [];
+        const cacheResults = await (0, concurrency_1.mapWithConcurrency)(pkgs, CACHE_READ_CONCURRENCY, (p) => ctx.cache.get(this.cacheKey(ctx, p)));
+        pkgs.forEach((p, i) => {
+            const cached = cacheResults[i];
+            if (cached?.value) {
+                findings.push(...cached.value);
+            }
+            else {
+                targets.push(p);
+            }
+        });
+        if (targets.length === 0) {
+            return { source: this.id, ok: true, durationMs: Date.now() - start, findings };
+        }
+        // Track findings per package for caching
+        const perPkg = {};
+        for (const p of targets)
+            perPkg[`${p.name}@${p.version}`] = [];
+        const errors = [];
+        const seen = new Set();
+        // Step 1: Query static DB for historical vulnerabilities (if available)
+        const staticDbAvailable = this.staticDb?.isReady() ?? false;
+        if (staticDbAvailable) {
+            try {
+                const staticFindings = await this.queryStaticDb(targets, seen, perPkg);
+                logger_1.logger.debug(`Static DB returned ${staticFindings.length} findings for ${targets.length} packages`);
+            }
+            catch (e) {
+                logger_1.logger.warn(`Static DB query failed, falling back to full API: ${(0, error_1.errorMessage)(e)}`);
+                // Continue with API query - don't fail the entire operation
+            }
+        }
+        else if (ctx.cfg.staticBaseline?.enabled) {
+            logger_1.logger.warn("Static DB was expected but is not available, falling back to full API query");
+        }
+        // Step 2: Query GitHub API for vulnerabilities
+        // If static DB is available, only query for recent vulnerabilities (after cutoff)
+        // Otherwise, query for all vulnerabilities
+        const apiQueryStart = Date.now();
+        // Determine API query options
+        // Use publishedAfter from options, or from cutoff date if static DB is available
+        const apiOptions = { ...options };
+        if (staticDbAvailable && this.cutoffDate && !apiOptions.publishedAfter) {
+            apiOptions.publishedAfter = this.cutoffDate;
+        }
+        const apiErrors = await this.queryGitHubApi(targets, ctx, seen, perPkg, apiOptions);
+        errors.push(...apiErrors);
+        logger_1.logger.debug(`GitHub API query took ${Date.now() - apiQueryStart}ms`);
+        // Cache and collect results (parallel writes with dynamic TTL)
+        const baseTtl = ctx.cfg.cache?.ttlSeconds ?? 3600;
+        const perTarget = targets.map((p) => {
+            const key = `${p.name}@${p.version}`;
+            const pkgFindings = perPkg[key] ?? [];
+            return { pkg: p, findings: pkgFindings };
+        });
+        for (const entry of perTarget) {
+            findings.push(...entry.findings);
+        }
+        const cacheWriteResults = await (0, concurrency_1.mapWithConcurrency)(perTarget, CACHE_WRITE_CONCURRENCY, async (entry) => {
+            try {
+                await ctx.cache.set(this.cacheKey(ctx, entry.pkg), entry.findings, (0, ttl_1.ttlForFindings)(baseTtl, entry.findings));
+                return { status: "fulfilled" };
+            }
+            catch (reason) {
+                return { status: "rejected", reason };
+            }
+        });
+        // Log cache write failures (non-fatal, but useful for debugging)
+        for (let i = 0; i < cacheWriteResults.length; i++) {
+            const result = cacheWriteResults[i];
+            if (result?.status === "rejected") {
+                const target = perTarget[i]?.pkg;
+                const reason = (0, error_1.errorMessage)(result.reason);
+                logger_1.logger.warn(`Cache write failed for github:${target?.name}@${target?.version}: ${reason}`);
+            }
+        }
+        if (errors.length > 0) {
+            // When static DB is available and was queried successfully, API failures are less critical
+            // because the static DB covers historical vulnerabilities. The API is primarily needed
+            // for very recent vulnerabilities published after the cutoff date.
+            const hasStaticDbFindings = findings.length > 0 && staticDbAvailable;
+            if (errors.length === targets.length) {
+                // All API queries failed
+                if (hasStaticDbFindings) {
+                    // Static DB returned findings, so we have coverage for historical vulnerabilities
+                    // Log warning but return success with static DB findings
+                    logger_1.logger.warn(`GitHub API failed for all packages, but static DB returned ${findings.length} findings`);
+                    return { source: this.id, ok: true, durationMs: Date.now() - start, findings };
+                }
+                return { source: this.id, ok: false, error: errors[0], durationMs: Date.now() - start, findings };
+            }
+            // Partial failure - some queries succeeded
+            if (hasStaticDbFindings) {
+                // Static DB has findings, treat API partial failure as non-fatal
+                logger_1.logger.warn(`GitHub API partial failure: ${errors.length}/${targets.length} packages failed, but static DB has findings`);
+                return { source: this.id, ok: true, durationMs: Date.now() - start, findings };
+            }
+            // No static DB findings - fail-closed for security
+            return {
+                source: this.id,
+                ok: false,
+                error: `Partial failure: ${errors.length}/${targets.length} packages failed`,
+                durationMs: Date.now() - start,
+                findings,
+            };
+        }
+        return { source: this.id, ok: true, durationMs: Date.now() - start, findings };
+    }
+    /**
+     * Query static database for historical vulnerabilities.
+     */
+    async queryStaticDb(targets, seen, perPkg) {
+        if (!this.staticDb)
+            return [];
+        const allFindings = [];
+        const db = this.staticDb;
+        // Parallelize static DB queries with a concurrency cap to avoid I/O spikes
+        const staticResults = await (0, concurrency_1.mapWithConcurrency)(targets, STATIC_DB_CONCURRENCY, async (p) => ({
+            pkg: p,
+            findings: await db.queryPackageWithOptions(p.name, { version: p.version }),
+        }));
+        for (const { pkg: p, findings: staticFindings } of staticResults) {
+            for (const finding of staticFindings) {
+                const key = `${p.name}@${p.version}`;
+                const dedupKey = `${key}:${finding.id}`;
+                if (seen.has(dedupKey))
+                    continue;
+                seen.add(dedupKey);
+                // Ensure the finding has the correct package info
+                const adjustedFinding = {
+                    ...finding,
+                    packageName: p.name,
+                    packageVersion: p.version,
+                };
+                (perPkg[key] ??= []).push(adjustedFinding);
+                allFindings.push(adjustedFinding);
+            }
+        }
+        return allFindings;
+    }
+    /**
+     * Query GitHub API for vulnerabilities.
+     * Returns array of error messages for failed packages.
+     */
+    async queryGitHubApi(targets, ctx, seen, perPkg, options) {
+        const token = ctx.env.GITHUB_TOKEN || ctx.env.GH_TOKEN;
+        const headers = {
+            Accept: "application/vnd.github+json",
+            "X-GitHub-Api-Version": "2022-11-28",
+            ...(token && { Authorization: `Bearer ${token}` }),
+        };
+        const errors = [];
+        // Query each package individually - GitHub API returns incomplete results
+        // when multiple `affects` parameters are used in a single request
+        const configured = Number(ctx.env.PNPM_AUDIT_GITHUB_CONCURRENCY);
+        const defaultConcurrency = token ? 10 : 3;
+        const MAX_CONCURRENT = Number.isFinite(configured) && configured > 0
+            ? Math.min(50, Math.floor(configured))
+            : defaultConcurrency;
+        const queryPackage = async (p) => {
+            try {
+                let page = 1;
+                let hasNextPage = true;
+                while (hasNextPage) {
+                    const params = new URLSearchParams({
+                        ecosystem: "npm",
+                        per_page: "100",
+                        page: String(page),
+                        affects: `${p.name}@${p.version}`,
+                    });
+                    // Add date filtering if publishedAfter is specified
+                    // GitHub API uses `published=>YYYY-MM-DD` format for "after" date filtering
+                    if (options?.publishedAfter) {
+                        params.set("published", `>${options.publishedAfter}`);
+                    }
+                    const url = `https://api.github.com/advisories?${params}`;
+                    const response = await ctx.http.getRaw(url, headers);
+                    let data;
+                    try {
+                        data = (await response.json());
+                    }
+                    catch (parseError) {
+                        throw new Error(`GitHub API returned invalid JSON response: ${parseError instanceof Error ? parseError.message : String(parseError)}`);
+                    }
+                    if (!Array.isArray(data)) {
+                        const errorMsg = data?.message;
+                        throw new Error(errorMsg ? String(errorMsg) : "GitHub API returned invalid response format");
+                    }
+                    if (data.length === 0) {
+                        hasNextPage = false;
+                        break;
+                    }
+                    for (const adv of data) {
+                        const severity = (0, severity_1.mapSeverity)(adv.severity);
+                        const validIdTypes = new Set(["CVE", "GHSA", "OSV", "OTHER"]);
+                        const identifiers = (adv.identifiers ?? [])
+                            .map((x) => {
+                            const t = String(x.type ?? "OTHER").toUpperCase();
+                            return {
+                                type: (validIdTypes.has(t) ? t : "OTHER"),
+                                value: String(x.value ?? ""),
+                            };
+                        })
+                            .filter((x) => x.value);
+                        const cveId = adv.cve_id ?? identifiers.find((i) => i.type === "CVE")?.value;
+                        const ghsaId = adv.ghsa_id ?? identifiers.find((i) => i.type === "GHSA")?.value;
+                        const canonicalId = (cveId ?? ghsaId ?? `GH:${adv.id ?? ""}`).toUpperCase();
+                        for (const v of adv.vulnerabilities ?? []) {
+                            const pkg = v?.package;
+                            if (!pkg || String(pkg.ecosystem ?? "").toLowerCase() !== "npm")
+                                continue;
+                            const name = String(pkg.name ?? "");
+                            const range = v.vulnerable_version_range;
+                            if (p.name !== name)
+                                continue;
+                            if (range && !(0, semver_1.satisfies)(p.version, range))
+                                continue;
+                            const key = `${p.name}@${p.version}`;
+                            const dedupKey = `${key}:${canonicalId}`;
+                            // Deduplication: prefer API data over static DB (more recent)
+                            // If we've already seen this from static DB, replace it
+                            if (seen.has(dedupKey)) {
+                                // Check if this is from static DB by looking for it in perPkg
+                                const pkgFindings = perPkg[key] ?? [];
+                                const existingIdx = pkgFindings.findIndex(f => f.id === canonicalId);
+                                const existingFinding = existingIdx >= 0 ? pkgFindings[existingIdx] : undefined;
+                                if (existingIdx >= 0 && existingFinding) {
+                                    // Replace static DB entry with API data (more recent)
+                                    pkgFindings[existingIdx] = {
+                                        id: canonicalId,
+                                        source: "github",
+                                        packageName: p.name,
+                                        packageVersion: p.version,
+                                        title: adv.summary,
+                                        url: adv.html_url,
+                                        severity,
+                                        affectedRange: range,
+                                        fixedVersion: typeof v.first_patched_version === "string"
+                                            ? v.first_patched_version
+                                            : v.first_patched_version?.identifier,
+                                        publishedAt: adv.published_at,
+                                        modifiedAt: adv.updated_at,
+                                    };
+                                }
+                                continue;
+                            }
+                            seen.add(dedupKey);
+                            (perPkg[key] ??= []).push({
+                                id: canonicalId,
+                                source: "github",
+                                packageName: p.name,
+                                packageVersion: p.version,
+                                title: adv.summary,
+                                url: adv.html_url,
+                                severity,
+                                affectedRange: range,
+                                fixedVersion: typeof v.first_patched_version === "string"
+                                    ? v.first_patched_version
+                                    : v.first_patched_version?.identifier,
+                                publishedAt: adv.published_at,
+                                modifiedAt: adv.updated_at,
+                            });
+                        }
+                    }
+                    if (data.length < 100) {
+                        hasNextPage = false;
+                    }
+                    else {
+                        page++;
+                    }
+                }
+            }
+            catch (e) {
+                errors.push(`${p.name}@${p.version}: ${(0, error_1.errorMessage)(e)}`);
+            }
+        };
+        // Run queries with limited concurrency
+        for (let i = 0; i < targets.length; i += MAX_CONCURRENT) {
+            await Promise.all(targets.slice(i, i + MAX_CONCURRENT).map(queryPackage));
+        }
+        return errors;
+    }
+}
+exports.GitHubAdvisorySource = GitHubAdvisorySource;
+//# sourceMappingURL=github-advisory.js.map

package/dist/databases/github-advisory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-advisory.js","sourceRoot":"","sources":["../../src/databases/github-advisory.ts"],"names":[],"mappings":";;;AAGA,sCAA8C;AAC9C,4CAA4C;AAC5C,gDAAgD;AAChD,4CAAyC;AACzC,0CAA8C;AAC9C,sDAA0D;AAE1D,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AA8BjC,MAAa,oBAAoB;IAC/B,EAAE,GAAkB,QAAQ,CAAC;IACrB,QAAQ,CAAwB;IAChC,UAAU,CAAgB;IAElC,YAAY,UAAiC,EAAE;QAC7C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC/C,CAAC;IAED,SAAS,CAAC,GAAgB,EAAE,GAAuC;QACjE,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,yBAAyB,KAAK,MAAM,CAAC;IAC5F,CAAC;IAEO,QAAQ,CAAC,GAAkB,EAAE,GAAe;QAClD,OAAO,UAAU,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,KAAK,CAAC,IAAkB,EAAE,GAAkB,EAAE,OAAoC;QACtF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAE5C,qCAAqC;QACrC,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,MAAM,IAAA,gCAAkB,EAC3C,IAAI,EACJ,sBAAsB,EACtB,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAC5C,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACpB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC;gBAClB,QAAQ,CAAC,IAAI,CAAC,GAAI,MAAM,CAAC,KAAgC,CAAC,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC;QACjF,CAAC;QAED,yCAAyC;QACzC,MAAM,MAAM,GAA2C,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC;QAE/D,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAE/B,wEAAwE;QACxE,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,KAAK,CAAC;QAC5D,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACvE,eAAM,CAAC,KAAK,CAAC,sBAAsB,cAAc,CAAC,MAAM,iBAAiB,OAAO,CAAC,MAAM,WAAW,CAAC,CAAC;YACtG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,eAAM,CAAC,IAAI,CAAC,qDAAqD,IAAA,oBAAY,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACpF,4DAA4D;YAC9D,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC;YAC3C,eAAM,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC7F,CAAC;QAED,+CAA+C;QAC/C,kFAAkF;QAClF,2CAA2C;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEjC,8BAA8B;QAC9B,iFAAiF;QACjF,MAAM,UAAU,GAA+B,EAAE,GAAG,OAAO,EAAE,CAAC;QAC9D,IAAI,iBAAiB,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;YACvE,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC;QAC9C,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAC1B,eAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,IAAI,CAAC,CAAC;QAEtE,+DAA+D;QAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,IAAI,IAAI,CAAC;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAClC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAC3C,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,iBAAiB,GAAG,MAAM,IAAA,gCAAkB,EAChD,SAAS,EACT,uBAAuB,EACvB,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CACjB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAC7B,KAAK,CAAC,QAAQ,EACd,IAAA,oBAAc,EAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CACxC,CAAC;gBACF,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,CAAC;YAC1C,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,OAAO,EAAE,MAAM,EAAE,UAAmB,EAAE,MAAM,EAAE,CAAC;YACjD,CAAC;QACH,CAAC,CACF,CAAC;QAEF,iEAAiE;QACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,MAAM,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;gBACjC,MAAM,MAAM,GAAG,IAAA,oBAAY,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC3C,eAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,2FAA2F;YAC3F,uFAAuF;YACvF,mEAAmE;YACnE,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC;YAErE,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;gBACrC,yBAAyB;gBACzB,IAAI,mBAAmB,EAAE,CAAC;oBACxB,kFAAkF;oBAClF,yDAAyD;oBACzD,eAAM,CAAC,IAAI,CAAC,8DAA8D,QAAQ,CAAC,MAAM,WAAW,CAAC,CAAC;oBACtG,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC;gBACjF,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC;YACpG,CAAC;YAED,2CAA2C;YAC3C,IAAI,mBAAmB,EAAE,CAAC;gBACxB,iEAAiE;gBACjE,eAAM,CAAC,IAAI,CAAC,+BAA+B,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,8CAA8C,CAAC,CAAC;gBAC1H,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC;YACjF,CAAC;YAED,mDAAmD;YACnD,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,oBAAoB,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,kBAAkB;gBAC5E,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,QAAQ;aACT,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC;IACjF,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CACzB,OAAqB,EACrB,IAAiB,EACjB,MAA8C;QAE9C,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAE9B,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAEzB,2EAA2E;QAC3E,MAAM,aAAa,GAAG,MAAM,IAAA,gCAAkB,EAC5C,OAAO,EACP,qBAAqB,EACrB,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACZ,GAAG,EAAE,CAAC;YACN,QAAQ,EAAE,MAAM,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC3E,CAAC,CACH,CAAC;QAEF,KAAK,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,aAAa,EAAE,CAAC;YACjE,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACxC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAEnB,kDAAkD;gBAClD,MAAM,eAAe,GAAyB;oBAC5C,GAAG,OAAO;oBACV,WAAW,EAAE,CAAC,CAAC,IAAI;oBACnB,cAAc,EAAE,CAAC,CAAC,OAAO;iBAC1B,CAAC;gBAEF,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC3C,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc,CAC1B,OAAqB,EACrB,GAAkB,EAClB,IAAiB,EACjB,MAA8C,EAC9C,OAAoC;QAEpC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvD,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,6BAA6B;YACrC,sBAAsB,EAAE,YAAY;YACpC,GAAG,CAAC,KAAK,IAAI,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;SACnD,CAAC;QAEF,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACjE,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;YAC3C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACtC,CAAC,CAAC,kBAAkB,CAAC;QACzB,MAAM,YAAY,GAAG,KAAK,EAAE,CAAa,EAAE,EAAE;YAC3C,IAAI,CAAC;gBACH,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,IAAI,WAAW,GAAG,IAAI,CAAC;gBAEvB,OAAO,WAAW,EAAE,CAAC;oBACnB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;wBACjC,SAAS,EAAE,KAAK;wBAChB,QAAQ,EAAE,KAAK;wBACf,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;wBAClB,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE;qBAClC,CAAC,CAAC;oBAEH,oDAAoD;oBACpD,4EAA4E;oBAC5E,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;wBAC5B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;oBACxD,CAAC;oBAED,MAAM,GAAG,GAAG,qCAAqC,MAAM,EAAE,CAAC;oBAC1D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBACrD,IAAI,IAAsB,CAAC;oBAC3B,IAAI,CAAC;wBACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;oBACrD,CAAC;oBAAC,OAAO,UAAU,EAAE,CAAC;wBACpB,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBACzI,CAAC;oBAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBACzB,MAAM,QAAQ,GAAI,IAAgC,EAAE,OAAO,CAAC;wBAC5D,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC;oBAC/F,CAAC;oBAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACtB,WAAW,GAAG,KAAK,CAAC;wBACpB,MAAM;oBACR,CAAC;oBAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,MAAM,QAAQ,GAAG,IAAA,sBAAW,EAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;wBAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;wBAC9D,MAAM,WAAW,GAA8B,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;6BACnE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;4BACT,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;4BAClD,OAAO;gCACL,IAAI,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAoC;gCAC5E,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;6BAC7B,CAAC;wBACJ,CAAC,CAAC;6BACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;wBAE1B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC;wBAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC;wBAChF,MAAM,WAAW,GAAG,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;wBAE5E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;4BAC1C,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,CAAC;4BACvB,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;gCAAE,SAAS;4BAE1E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;4BACpC,MAAM,KAAK,GAAG,CAAC,CAAC,wBAAwB,CAAC;4BAEzC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gCAAE,SAAS;4BAC9B,IAAI,KAAK,IAAI,CAAC,IAAA,kBAAS,EAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC;gCAAE,SAAS;4BAEpD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;4BACrC,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;4BAEzC,8DAA8D;4BAC9D,wDAAwD;4BACxD,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gCACvB,8DAA8D;gCAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gCACtC,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;gCACrE,MAAM,eAAe,GAAG,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gCAChF,IAAI,WAAW,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC;oCACxC,sDAAsD;oCACtD,WAAW,CAAC,WAAW,CAAC,GAAG;wCACzB,EAAE,EAAE,WAAW;wCACf,MAAM,EAAE,QAAQ;wCAChB,WAAW,EAAE,CAAC,CAAC,IAAI;wCACnB,cAAc,EAAE,CAAC,CAAC,OAAO;wCACzB,KAAK,EAAE,GAAG,CAAC,OAAO;wCAClB,GAAG,EAAE,GAAG,CAAC,QAAQ;wCACjB,QAAQ;wCACR,aAAa,EAAE,KAAK;wCACpB,YAAY,EACV,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ;4CACzC,CAAC,CAAC,CAAC,CAAC,qBAAqB;4CACzB,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,UAAU;wCACzC,WAAW,EAAE,GAAG,CAAC,YAAY;wCAC7B,UAAU,EAAE,GAAG,CAAC,UAAU;qCAC3B,CAAC;gCACJ,CAAC;gCACD,SAAS;4BACX,CAAC;4BAED,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;4BACnB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;gCACxB,EAAE,EAAE,WAAW;gCACf,MAAM,EAAE,QAAQ;gCAChB,WAAW,EAAE,CAAC,CAAC,IAAI;gCACnB,cAAc,EAAE,CAAC,CAAC,OAAO;gCACzB,KAAK,EAAE,GAAG,CAAC,OAAO;gCAClB,GAAG,EAAE,GAAG,CAAC,QAAQ;gCACjB,QAAQ;gCACR,aAAa,EAAE,KAAK;gCACpB,YAAY,EACV,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ;oCACzC,CAAC,CAAC,CAAC,CAAC,qBAAqB;oCACzB,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,UAAU;gCACzC,WAAW,EAAE,GAAG,CAAC,YAAY;gCAC7B,UAAU,EAAE,GAAG,CAAC,UAAU;6BAC3B,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAED,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;wBACtB,WAAW,GAAG,KAAK,CAAC;oBACtB,CAAC;yBAAM,CAAC;wBACN,IAAI,EAAE,CAAC;oBACT,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,IAAA,oBAAY,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC;QAEF,uCAAuC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;YACxD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AA1XD,oDA0XC"}

package/dist/databases/nvd.d.ts

@@ -0,0 +1,21 @@
+import type { Severity, VulnerabilityFinding } from "../types";
+import type { SourceContext } from "./connector";
+export interface NvdCveDetail {
+    id: string;
+    baseScore?: number;
+    baseSeverity?: Severity;
+    published?: string;
+    lastModified?: string;
+    url?: string;
+}
+/**
+ * NVD enrichment: OSV/npm/GitHub often lack consistent scoring.
+ * NVD provides canonical CVSS data for CVE IDs.
+ * This enriches findings that have severity "unknown" with NVD data.
+ */
+export declare function enrichFindingsWithNvd(findings: VulnerabilityFinding[], ctx: SourceContext): Promise<{
+    ok: boolean;
+    error?: string;
+    durationMs: number;
+}>;
+//# sourceMappingURL=nvd.d.ts.map

package/dist/databases/nvd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvd.d.ts","sourceRoot":"","sources":["../../src/databases/nvd.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA4DjD,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,QAAQ,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA6CD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,oBAAoB,EAAE,EAChC,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA2E9D"}