@dzhechkov/harness-core 0.8.46 → 0.8.48

package/dist/sbom.js

@@ -1,120 +0,0 @@
-// SPDX-2.3 (Software Package Data Exchange) SBOM (Software Bill of Materials) generator for a pack.
-//
-// Ported from `agent-harness-generator/scripts/sbom.mjs` (RuvNet, MIT). Emits an SPDX-2.3 dependency inventory
-// from a `package-lock.json` (npm v1 or v2/v3), falling back to `package.json` dependency ranges when no lockfile
-// is present. PURE: operates over injected JSON + an injected `created` timestamp (no wall-clock → deterministic;
-// packages sorted by name). The CLI (`dz sbom`) reads the files and writes the output.
-/** A valid SPDXID tail is `[a-zA-Z0-9.-]+`; map `@scope/name` → `scope-name`. */
-function spdxId(name) {
-    return 'SPDXRef-Package-' + name.replace(/^@/, '').replace(/[^a-zA-Z0-9.-]+/g, '-');
-}
-/** purl (package URL) for an npm dep: scope becomes a url-encoded namespace. */
-function npmPurl(name, version) {
-    const v = version && version !== 'NOASSERTION' ? `@${version}` : '';
-    if (name.startsWith('@')) {
-        const slash = name.indexOf('/');
-        if (slash > 0) {
-            const scope = encodeURIComponent(name.slice(0, slash)); // %40scope
-            return `pkg:npm/${scope}/${name.slice(slash + 1)}${v}`;
-        }
-    }
-    return `pkg:npm/${name}${v}`;
-}
-function licenseOf(v) {
-    if (typeof v === 'string' && v.length > 0)
-        return v;
-    if (v && typeof v === 'object' && typeof v.type === 'string')
-        return v.type;
-    return 'NOASSERTION';
-}
-/** Extract deps from a lockfile (npm v2/v3 `packages` map, or v1 `dependencies` tree) or a package.json. */
-function extractDeps(input) {
-    const out = new Map();
-    const add = (name, version, license, dev) => {
-        if (!name)
-            return;
-        const key = `${name}@${version}`;
-        if (!out.has(key))
-            out.set(key, { name, version, license, dev });
-    };
-    const lock = input.lock;
-    // npm v2/v3: flat `packages` map keyed by node_modules path ("" = root, skip it).
-    if (lock && lock.packages && typeof lock.packages === 'object') {
-        for (const [path, meta] of Object.entries(lock.packages)) {
-            if (path === '' || !path.includes('node_modules/'))
-                continue;
-            const m = meta;
-            if (m.dev && !input.includeDev)
-                continue;
-            const name = path.slice(path.lastIndexOf('node_modules/') + 'node_modules/'.length);
-            add(name, typeof m.version === 'string' ? m.version : 'NOASSERTION', licenseOf(m.license), !!m.dev);
-        }
-        return [...out.values()];
-    }
-    // npm v1: nested `dependencies` tree.
-    if (lock && lock.dependencies && typeof lock.dependencies === 'object') {
-        const walk = (deps) => {
-            for (const [name, meta] of Object.entries(deps)) {
-                const m = meta;
-                if (m.dev && !input.includeDev)
-                    continue;
-                add(name, typeof m.version === 'string' ? m.version : 'NOASSERTION', licenseOf(m.license), !!m.dev);
-                if (m.dependencies)
-                    walk(m.dependencies);
-            }
-        };
-        walk(lock.dependencies);
-        return [...out.values()];
-    }
-    // fallback: package.json ranges (no resolved versions).
-    const pkg = input.pkg;
-    if (pkg) {
-        for (const [name, range] of Object.entries(pkg.dependencies ?? {}))
-            add(name, String(range), 'NOASSERTION', false);
-        if (input.includeDev)
-            for (const [name, range] of Object.entries(pkg.devDependencies ?? {}))
-                add(name, String(range), 'NOASSERTION', true);
-    }
-    return [...out.values()];
-}
-/** Build an SPDX-2.3 SBOM document. Pure + deterministic (injected `created`; packages sorted by name+version). */
-export function buildSbom(input) {
-    const deps = extractDeps({ lock: input.lock, pkg: input.pkg, includeDev: !!input.includeDev })
-        .sort((a, b) => (a.name === b.name ? (a.version < b.version ? -1 : 1) : a.name < b.name ? -1 : 1));
-    const packages = deps.map((d) => ({
-        SPDXID: spdxId(`${d.name}-${d.version}`),
-        name: d.name,
-        versionInfo: d.version,
-        downloadLocation: 'NOASSERTION',
-        licenseConcluded: d.license,
-        licenseDeclared: d.license,
-        externalRefs: [{ referenceCategory: 'PACKAGE-MANAGER', referenceType: 'purl', referenceLocator: npmPurl(d.name, d.version) }],
-    }));
-    return {
-        spdxVersion: 'SPDX-2.3',
-        dataLicense: 'CC0-1.0',
-        SPDXID: 'SPDXRef-DOCUMENT',
-        name: `${input.name}-sbom`,
-        documentNamespace: input.namespace ?? `urn:dz:sbom:${input.name.replace(/^@/, '').replace(/[^a-zA-Z0-9.-]+/g, '-')}`,
-        creationInfo: { created: input.created, creators: ['Tool: dz-sbom'] },
-        packages,
-        relationships: packages.map((p) => ({ spdxElementId: 'SPDXRef-DOCUMENT', relationshipType: 'DESCRIBES', relatedSpdxElement: p.SPDXID })),
-    };
-}
-/** Shape check for `--validate-only`: returns the problems (empty ⇒ valid SPDX-2.3 skeleton). */
-export function validateSbom(doc) {
-    const problems = [];
-    const d = doc;
-    if (!d || typeof d !== 'object')
-        return ['not an object'];
-    if (d.spdxVersion !== 'SPDX-2.3')
-        problems.push('spdxVersion must be SPDX-2.3');
-    if (d.SPDXID !== 'SPDXRef-DOCUMENT')
-        problems.push('SPDXID must be SPDXRef-DOCUMENT');
-    if (!Array.isArray(d.packages))
-        problems.push('packages must be an array');
-    if (!d.creationInfo || typeof d.creationInfo.created !== 'string')
-        problems.push('creationInfo.created missing');
-    return problems;
-}
-//# sourceMappingURL=sbom.js.map

package/dist/sbom.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../src/sbom.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,EAAE;AACF,+GAA+G;AAC/G,kHAAkH;AAClH,kHAAkH;AAClH,uFAAuF;AA8BvF,iFAAiF;AACjF,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,gFAAgF;AAChF,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe;IAC5C,MAAM,CAAC,GAAG,OAAO,IAAI,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW;YACnE,OAAO,WAAW,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,WAAW,IAAI,GAAG,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAQ,CAAsB,CAAC,IAAI,CAAC;IAC1H,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,4GAA4G;AAC5G,SAAS,WAAW,CAAC,KAA6D;IAChF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAe,CAAC;IACnC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;QAC3E,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAkG,CAAC;IAEtH,kFAAkF;IAClF,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAAE,SAAS;YAC7D,MAAM,CAAC,GAAG,IAAkF,CAAC;YAC7F,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU;gBAAE,SAAS;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACpF,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,CAAC,IAA6B,EAAE,EAAE;YAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,GAAG,IAAsG,CAAC;gBACjH,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU;oBAAE,SAAS;gBACzC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACpG,IAAI,CAAC,CAAC,YAAY;oBAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,YAAuC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,wDAAwD;IACxD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAsG,CAAC;IACzH,IAAI,GAAG,EAAE,CAAC;QACR,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACnH,IAAI,KAAK,CAAC,UAAU;YAAE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAC7I,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,SAAS,CAAC,KAOzB;IACC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;SAC3F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErG,MAAM,QAAQ,GAAkB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,OAAO;QACtB,gBAAgB,EAAE,aAAa;QAC/B,gBAAgB,EAAE,CAAC,CAAC,OAAO;QAC3B,eAAe,EAAE,CAAC,CAAC,OAAO;QAC1B,YAAY,EAAE,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC9H,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,kBAAkB;QAC1B,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,OAAO;QAC1B,iBAAiB,EAAE,KAAK,CAAC,SAAS,IAAI,eAAe,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE;QACpH,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,eAAe,CAAC,EAAE;QACrE,QAAQ;QACR,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KACzI,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,CAAC,GAAG,GAAmC,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,WAAW,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAAE,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,KAAK,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACjH,OAAO,QAAQ,CAAC;AAClB,CAAC"}