@thomasminh1995/depverdict 0.6.0-alpha.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +518 -0
- package/bin/depverdict.js +7 -0
- package/bin/upgradelens.js +7 -0
- package/docs/GR-01-Semantic-Grounding-Failure-Analysis.md +309 -0
- package/docs/GR-02-Versioned-Action-Evaluation-Criteria.md +187 -0
- package/docs/GR-03-Extractive-Contract-Safety-Experiment.md +242 -0
- package/docs/GR-04-Versioned-Production-Extractive-Contract.md +154 -0
- package/docs/IA-01-Repository-Usage-Discovery.md +122 -0
- package/docs/IA-02-Repository-Impact-Analysis.md +118 -0
- package/docs/IA-03-Repository-Impact-Evidence.md +160 -0
- package/docs/IA-04-CLI-Orchestration.md +235 -0
- package/docs/IA-05-Real-Provider-Validation.md +235 -0
- package/docs/IA-05-VinGrade-Validation.md +339 -0
- package/docs/MVP-01.md +48 -0
- package/docs/MVP-02-Architecture.md +536 -0
- package/docs/MVP-02-CLI-HTTP-Runtime.md +50 -0
- package/docs/MVP-02-HTTP-Lifecycle.md +37 -0
- package/docs/MVP-02-Knowledge-Manifest-Generation.md +75 -0
- package/docs/MVP-02-Knowledge-Manifest.md +279 -0
- package/docs/MVP-02-Knowledge-Research-Orchestration.md +62 -0
- package/docs/MVP-02-Knowledge-Store.md +87 -0
- package/docs/MVP-02-PyPI-Registry-Adapter.md +97 -0
- package/docs/MVP-02-Research-Planning.md +196 -0
- package/docs/MVP-02-Source-Provenance.md +81 -0
- package/docs/MVP-02-npm-Registry-Adapter.md +99 -0
- package/docs/RR-01-End-to-End-and-Real-Provider-Validation.md +393 -0
- package/docs/RR-01-RERUN-Extractive-Contract-Validation.md +566 -0
- package/docs/RR-02-Full-Product-Workflow-and-Developer-CLI-UX-Review.md +35 -0
- package/docs/RR02-FIX-01-Persistent-Qualification-Resolution.md +32 -0
- package/docs/RR02-FIX-02-Stage-aware-CLI-Progress-and-Heartbeat.md +28 -0
- package/docs/RR02-FIX-03-npm-Capture-Evidence-Exclusion.md +33 -0
- package/docs/RR02-FIX-03A-Complete-Package-Exclusion-and-Evidence-Commit.md +223 -0
- package/docs/RR02-FIX-04-Event-loop-safe-Heartbeat.md +393 -0
- package/docs/RR02-FIX-05-Materialize-Persisted-Qualification.md +207 -0
- package/docs/RR02-RERUN-CLI-Qualification-Progress-UX-and-Package-Validation.md +342 -0
- package/docs/VinGrade-MVP-02-Validation.md +480 -0
- package/docs/VinGrade-RC02-Live-Validation.md +273 -0
- package/docs/ai-capability-discovery.md +573 -0
- package/docs/ai-engineering-production-readiness.md +390 -0
- package/docs/ai-engineering-review.md +251 -0
- package/docs/ai-runtime-governance-discovery.md +754 -0
- package/docs/architecture-overview.md +78 -0
- package/docs/cli-progress.md +111 -0
- package/docs/decisions/diff-01-brand-distribution-identity.md +450 -0
- package/docs/decisions/diff-02-identity-compatibility-contract.md +274 -0
- package/docs/decisions/diff-03-repository-docs-community-migration.md +165 -0
- package/docs/decisions/diff-04-release-evidence-gap-acceptance.md +110 -0
- package/docs/discovery/mvp-05-ai-migration-planning-discovery.md +350 -0
- package/docs/gateway-runtime-discovery.md +614 -0
- package/docs/live-ai-validation.md +299 -0
- package/docs/migration-planning-qualification-resolution.md +99 -0
- package/docs/migrations/upgradelens-to-depverdict.md +97 -0
- package/docs/mp-r03-deterministic-upgrade-decision-architecture.md +135 -0
- package/docs/mp-r04-evidence-bounded-migration-handoff-architecture.md +116 -0
- package/docs/mp-r05-product-completion-and-decision-first-cli-architecture.md +162 -0
- package/docs/mvp-05-deterministic-context-runtime.md +127 -0
- package/docs/mvp-05-migration-checklist-contract.md +166 -0
- package/docs/mvp-05-migration-checklist-orchestration.md +105 -0
- package/docs/mvp-05-migration-evaluation-and-qualification.md +135 -0
- package/docs/mvp-05-provider-neutral-generator.md +79 -0
- package/docs/ollama-local-smoke-validation.md +156 -0
- package/docs/openai-compatible-runtime-discovery.md +789 -0
- package/docs/openrouter-one-dependency-validation.md +205 -0
- package/docs/oss-02-package-guard-hardening-architecture.md +131 -0
- package/docs/oss-04-public-ci-package-metadata-architecture.md +142 -0
- package/docs/package-content-policy.md +98 -0
- package/docs/releases/v0.5.0-technical-preview.md +114 -0
- package/docs/releases/v0.6.0-alpha.1-depverdict-preview.md +101 -0
- package/docs/reviews/diff-02-identity-contract-compatibility.md +413 -0
- package/docs/reviews/diff-03-repository-docs-community-migration.md +364 -0
- package/docs/reviews/diff-04-depverdict-distribution-identity-readiness-rereview.md +453 -0
- package/docs/reviews/diff-04-fix-post-rename-identity-release-remediation.md +310 -0
- package/docs/reviews/diff-05-final-preview-distribution-qualification.md +561 -0
- package/docs/reviews/mvp-05-final-product-value-workflow-rereview.md +471 -0
- package/docs/reviews/mvp-05-product-workflow-review.md +605 -0
- package/docs/reviews/oss-01-duplicate-artifact-investigation-cleanup.md +411 -0
- package/docs/reviews/oss-02-package-guard-hardening.md +303 -0
- package/docs/reviews/oss-03-community-scaffolding.md +378 -0
- package/docs/reviews/oss-04-public-ci-package-metadata.md +439 -0
- package/docs/reviews/oss-05-technical-preview-qualification.md +482 -0
- package/docs/reviews/upgradelens-vs-upgradedepdetective-source-comparison.md +355 -0
- package/docs/reviews/v0.5.0-pre-release-smoke.md +263 -0
- package/docs/reviews/v0.5.0-version-bump-release-verification.md +306 -0
- package/docs/runtime-contract-discovery.md +521 -0
- package/docs/structured-output-compatibility-report.md +100 -0
- package/docs/ts-fix-01-exact-duplicate-occurrence-target-selection-architecture.md +111 -0
- package/docs/version-analysis-architecture.md +827 -0
- package/eval/README.md +86 -0
- package/eval/datasets/generic/declared-constraint.json +59 -0
- package/eval/datasets/generic/evidence-conflict.json +73 -0
- package/eval/datasets/generic/major-breaking-release.json +66 -0
- package/eval/datasets/generic/missing-evidence.json +46 -0
- package/eval/datasets/generic/patch-release-low.json +59 -0
- package/eval/datasets/node/axios-patch-low.json +59 -0
- package/eval/datasets/node/react-major-breaking.json +66 -0
- package/eval/datasets/node/react-minor-compatibility.json +66 -0
- package/eval/datasets/python/fastapi-deprecation.json +66 -0
- package/eval/datasets/python/pydantic-major-breaking.json +66 -0
- package/eval/migration-planning/golden-dataset-v2.json +306 -0
- package/eval/migration-planning/golden-dataset.json +214 -0
- package/eval/schemas/expected-result.schema.json +88 -0
- package/eval/schemas/golden-case.schema.json +181 -0
- package/package.json +57 -0
- package/schemas/ai-scorecard.schema.json +132 -0
- package/schemas/benchmark-report.schema.json +189 -0
- package/schemas/benchmark.schema.json +55 -0
- package/schemas/capability-profile.schema.json +44 -0
- package/schemas/conformance-report.schema.json +150 -0
- package/schemas/deployment-profile.schema.json +64 -0
- package/schemas/evaluation-report.schema.json +158 -0
- package/schemas/knowledge-evidence-bundle.schema.json +150 -0
- package/schemas/knowledge-manifest.schema.json +548 -0
- package/schemas/metrics.schema.json +178 -0
- package/schemas/migration-checklist-extractive-candidate.schema.json +42 -0
- package/schemas/migration-checklist.schema.json +706 -0
- package/schemas/migration-evaluation-dataset-v2.schema.json +208 -0
- package/schemas/migration-evaluation-dataset.schema.json +204 -0
- package/schemas/migration-planning-qualification-record.schema.json +234 -0
- package/schemas/project-manifest.schema.json +308 -0
- package/schemas/qualification-record.schema.json +56 -0
- package/schemas/repository-impact-evidence.schema.json +232 -0
- package/schemas/repository-impact.schema.json +202 -0
- package/schemas/upgrade-decision.schema.json +273 -0
- package/schemas/usage-index.schema.json +179 -0
- package/schemas/version-analysis.schema.json +449 -0
- package/src/ai-runtime-debug.js +325 -0
- package/src/ai-runtime-error.js +42 -0
- package/src/ai-runtime.js +174 -0
- package/src/ai-scorecard.js +204 -0
- package/src/ai-version-analysis.js +484 -0
- package/src/artifact-root-compatibility.js +91 -0
- package/src/benchmark-report.js +111 -0
- package/src/benchmark-runner.js +191 -0
- package/src/canonical-json.js +69 -0
- package/src/cli.js +1299 -0
- package/src/conformance-report.js +158 -0
- package/src/conformance-runner.js +253 -0
- package/src/constants.js +73 -0
- package/src/cooperative-scheduler.js +79 -0
- package/src/dependencies.js +44 -0
- package/src/dependency-ai-context.js +625 -0
- package/src/detectors.js +253 -0
- package/src/discovery.js +234 -0
- package/src/ecosystem-version-adapter.js +294 -0
- package/src/environment-compatibility.js +77 -0
- package/src/evaluation-comparator.js +158 -0
- package/src/evaluation-report.js +76 -0
- package/src/evaluation-runner.js +248 -0
- package/src/evidence-source-adapter.js +472 -0
- package/src/files.js +89 -0
- package/src/governance-diagnostics.js +64 -0
- package/src/governance-loader.js +63 -0
- package/src/governance-metadata.js +346 -0
- package/src/governance-validator.js +360 -0
- package/src/http/bounded-fetch.js +278 -0
- package/src/http/cli-http-runtime.js +44 -0
- package/src/impact/input-loader.js +157 -0
- package/src/impact/matcher.js +40 -0
- package/src/impact/repository-impact.js +199 -0
- package/src/impact/runtime.js +24 -0
- package/src/impact/status.js +62 -0
- package/src/impact/writer.js +30 -0
- package/src/impact-evidence/input-loader.js +202 -0
- package/src/impact-evidence/repository-impact-evidence.js +234 -0
- package/src/impact-evidence/runtime.js +16 -0
- package/src/impact-evidence/writer.js +30 -0
- package/src/index.js +563 -0
- package/src/installed-version-baseline.js +196 -0
- package/src/knowledge-cache.js +324 -0
- package/src/knowledge-evidence-bundle.js +101 -0
- package/src/knowledge-evidence-producer.js +233 -0
- package/src/knowledge-manifest-builder.js +188 -0
- package/src/knowledge-manifest-writer.js +32 -0
- package/src/knowledge-manifest.js +255 -0
- package/src/knowledge-research.js +615 -0
- package/src/metrics-engine.js +205 -0
- package/src/migration-checklist/ai-candidate.js +320 -0
- package/src/migration-checklist/assembler.js +37 -0
- package/src/migration-checklist/context-runtime.js +828 -0
- package/src/migration-checklist/evaluation/action-criteria.js +244 -0
- package/src/migration-checklist/evaluation/comparator-v2.js +332 -0
- package/src/migration-checklist/evaluation/comparator.js +279 -0
- package/src/migration-checklist/evaluation/dataset-v2.js +227 -0
- package/src/migration-checklist/evaluation/dataset.js +336 -0
- package/src/migration-checklist/evaluation/extractive-fixtures-v2.js +148 -0
- package/src/migration-checklist/evaluation/metrics-v2.js +226 -0
- package/src/migration-checklist/evaluation/metrics.js +158 -0
- package/src/migration-checklist/evaluation/qualification-v2.js +321 -0
- package/src/migration-checklist/evaluation/qualification.js +239 -0
- package/src/migration-checklist/evaluation/runner-v2.js +294 -0
- package/src/migration-checklist/evaluation/runner.js +194 -0
- package/src/migration-checklist/evaluation/scorecard-v2.js +106 -0
- package/src/migration-checklist/evaluation/scorecard.js +86 -0
- package/src/migration-checklist/extractive-candidate.js +166 -0
- package/src/migration-checklist/extractive-prompt.js +62 -0
- package/src/migration-checklist/generator.js +702 -0
- package/src/migration-checklist/grounding-policy.js +117 -0
- package/src/migration-checklist/input-loader.js +613 -0
- package/src/migration-checklist/migration-checklist.js +635 -0
- package/src/migration-checklist/presentation.js +292 -0
- package/src/migration-checklist/progress.js +96 -0
- package/src/migration-checklist/prompt.js +83 -0
- package/src/migration-checklist/qualification-guard.js +462 -0
- package/src/migration-checklist/qualification-resolution.js +122 -0
- package/src/migration-checklist/qualification-store.js +225 -0
- package/src/migration-checklist/runtime.js +205 -0
- package/src/migration-checklist/verification.js +134 -0
- package/src/migration-checklist/writer.js +35 -0
- package/src/openai-compatible-provider.js +451 -0
- package/src/orchestration/failure-log.js +32 -0
- package/src/orchestration/pipeline.js +200 -0
- package/src/orchestration/progress-events.js +337 -0
- package/src/orchestration/progress-reporter.js +131 -0
- package/src/orchestration/text-writer.js +22 -0
- package/src/portable.js +13 -0
- package/src/product-completion.js +249 -0
- package/src/project-manifest-input.js +90 -0
- package/src/project-manifest.js +141 -0
- package/src/python-requirements.js +137 -0
- package/src/registry/npm-packument.js +256 -0
- package/src/registry/npm-registry-adapter.js +262 -0
- package/src/registry/pypi-project.js +300 -0
- package/src/registry/pypi-registry-adapter.js +235 -0
- package/src/registry/sanitize-registry-body.js +51 -0
- package/src/renderers/console.js +160 -0
- package/src/renderers/impact-presentation.js +278 -0
- package/src/renderers/markdown.js +172 -0
- package/src/research-plan.js +455 -0
- package/src/runtime-conformance.js +275 -0
- package/src/source-provenance.js +393 -0
- package/src/source-url.js +62 -0
- package/src/structured-output-schema.js +66 -0
- package/src/target-selector.js +306 -0
- package/src/upgrade-decision/input-loader.js +107 -0
- package/src/upgrade-decision/presentation.js +43 -0
- package/src/upgrade-decision/runtime.js +21 -0
- package/src/upgrade-decision/upgrade-decision.js +626 -0
- package/src/upgrade-decision/writer.js +30 -0
- package/src/usage/analyzer-registry.js +63 -0
- package/src/usage/coverage.js +116 -0
- package/src/usage/input-loader.js +139 -0
- package/src/usage/js/analyzer.js +240 -0
- package/src/usage/js/parser.js +21 -0
- package/src/usage/runtime.js +187 -0
- package/src/usage/scope.js +44 -0
- package/src/usage/source-files.js +50 -0
- package/src/usage/usage-index.js +217 -0
- package/src/usage/writer.js +31 -0
- package/src/version-analysis-loader.js +203 -0
- package/src/version-analysis-manifest.js +314 -0
- package/src/version-analysis-writer.js +30 -0
|
@@ -0,0 +1,449 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
+
"$id": "https://raw.githubusercontent.com/thomasMinh1995/UpgradeLens/main/schemas/version-analysis.schema.json",
|
|
4
|
+
"title": "UpgradeLens Version Analysis Manifest",
|
|
5
|
+
"description": "Portable output produced by UpgradeLens AI Version Analysis.",
|
|
6
|
+
"type": "object",
|
|
7
|
+
"additionalProperties": false,
|
|
8
|
+
"required": [
|
|
9
|
+
"schemaVersion",
|
|
10
|
+
"generatedAt",
|
|
11
|
+
"generator",
|
|
12
|
+
"input",
|
|
13
|
+
"analysis",
|
|
14
|
+
"summary",
|
|
15
|
+
"results"
|
|
16
|
+
],
|
|
17
|
+
"properties": {
|
|
18
|
+
"schemaVersion": { "const": "1.0.0" },
|
|
19
|
+
"generatedAt": { "type": "string", "format": "date-time" },
|
|
20
|
+
"generator": { "$ref": "#/$defs/generator" },
|
|
21
|
+
"input": { "$ref": "#/$defs/input" },
|
|
22
|
+
"analysis": { "$ref": "#/$defs/analysis" },
|
|
23
|
+
"summary": { "$ref": "#/$defs/summary" },
|
|
24
|
+
"results": {
|
|
25
|
+
"type": "array",
|
|
26
|
+
"items": { "$ref": "#/$defs/result" }
|
|
27
|
+
}
|
|
28
|
+
},
|
|
29
|
+
"$defs": {
|
|
30
|
+
"digest": {
|
|
31
|
+
"type": "string",
|
|
32
|
+
"pattern": "^sha256:[a-f0-9]{64}$"
|
|
33
|
+
},
|
|
34
|
+
"relativePath": {
|
|
35
|
+
"type": "string",
|
|
36
|
+
"minLength": 1,
|
|
37
|
+
"pattern": "^(?!/)(?![A-Za-z]:)(?!.*(?:^|/)\\.\\.(?:/|$))[^\\\\]+$"
|
|
38
|
+
},
|
|
39
|
+
"httpsUrl": {
|
|
40
|
+
"type": "string",
|
|
41
|
+
"format": "uri",
|
|
42
|
+
"pattern": "^https://(?![^/?#]*@)"
|
|
43
|
+
},
|
|
44
|
+
"nullableString": {
|
|
45
|
+
"type": ["string", "null"]
|
|
46
|
+
},
|
|
47
|
+
"installedVersionSource": {
|
|
48
|
+
"type": "object",
|
|
49
|
+
"additionalProperties": false,
|
|
50
|
+
"required": ["type", "path", "lockfileVersion", "packagePath"],
|
|
51
|
+
"properties": {
|
|
52
|
+
"type": { "const": "package-lock" },
|
|
53
|
+
"path": { "$ref": "#/$defs/relativePath" },
|
|
54
|
+
"lockfileVersion": { "enum": [1, 2, 3] },
|
|
55
|
+
"packagePath": { "$ref": "#/$defs/relativePath" }
|
|
56
|
+
}
|
|
57
|
+
},
|
|
58
|
+
"installedVersionReason": {
|
|
59
|
+
"enum": [
|
|
60
|
+
"INVALID_LOCKFILE",
|
|
61
|
+
"LOCKFILE_NOT_FOUND",
|
|
62
|
+
"LOCKFILE_UNSUPPORTED",
|
|
63
|
+
"NON_REGISTRY_DEPENDENCY",
|
|
64
|
+
"PACKAGE_NOT_RESOLVED",
|
|
65
|
+
"RESOLVED_VERSION_UNAVAILABLE",
|
|
66
|
+
"WORKSPACE_RESOLUTION_AMBIGUOUS"
|
|
67
|
+
]
|
|
68
|
+
},
|
|
69
|
+
"generator": {
|
|
70
|
+
"type": "object",
|
|
71
|
+
"additionalProperties": false,
|
|
72
|
+
"required": ["name", "version"],
|
|
73
|
+
"properties": {
|
|
74
|
+
"name": { "const": "UpgradeLens" },
|
|
75
|
+
"version": { "type": "string", "minLength": 1 }
|
|
76
|
+
}
|
|
77
|
+
},
|
|
78
|
+
"projectManifestLineage": {
|
|
79
|
+
"type": "object",
|
|
80
|
+
"additionalProperties": false,
|
|
81
|
+
"required": ["schemaVersion", "artifact", "artifactDigest", "repository"],
|
|
82
|
+
"properties": {
|
|
83
|
+
"schemaVersion": { "const": "2.0.0" },
|
|
84
|
+
"artifact": { "$ref": "#/$defs/relativePath" },
|
|
85
|
+
"artifactDigest": { "$ref": "#/$defs/digest" },
|
|
86
|
+
"repository": {
|
|
87
|
+
"type": "object",
|
|
88
|
+
"additionalProperties": false,
|
|
89
|
+
"required": ["name", "root"],
|
|
90
|
+
"properties": {
|
|
91
|
+
"name": { "type": "string", "minLength": 1 },
|
|
92
|
+
"root": { "const": "." }
|
|
93
|
+
}
|
|
94
|
+
}
|
|
95
|
+
}
|
|
96
|
+
},
|
|
97
|
+
"knowledgeManifestLineage": {
|
|
98
|
+
"type": "object",
|
|
99
|
+
"additionalProperties": false,
|
|
100
|
+
"required": ["schemaVersion", "artifact", "artifactDigest", "researchId"],
|
|
101
|
+
"properties": {
|
|
102
|
+
"schemaVersion": { "const": "1.0.0" },
|
|
103
|
+
"artifact": { "$ref": "#/$defs/relativePath" },
|
|
104
|
+
"artifactDigest": { "$ref": "#/$defs/digest" },
|
|
105
|
+
"researchId": { "$ref": "#/$defs/digest" }
|
|
106
|
+
}
|
|
107
|
+
},
|
|
108
|
+
"evidenceArtifactLineage": {
|
|
109
|
+
"type": "object",
|
|
110
|
+
"additionalProperties": false,
|
|
111
|
+
"required": ["schemaVersion", "artifact", "artifactDigest"],
|
|
112
|
+
"properties": {
|
|
113
|
+
"schemaVersion": { "const": "1.0.0" },
|
|
114
|
+
"artifact": { "$ref": "#/$defs/relativePath" },
|
|
115
|
+
"artifactDigest": { "$ref": "#/$defs/digest" }
|
|
116
|
+
}
|
|
117
|
+
},
|
|
118
|
+
"input": {
|
|
119
|
+
"type": "object",
|
|
120
|
+
"additionalProperties": false,
|
|
121
|
+
"required": ["projectManifest", "knowledgeManifest", "evidenceArtifact"],
|
|
122
|
+
"properties": {
|
|
123
|
+
"projectManifest": { "$ref": "#/$defs/projectManifestLineage" },
|
|
124
|
+
"knowledgeManifest": { "$ref": "#/$defs/knowledgeManifestLineage" },
|
|
125
|
+
"evidenceArtifact": { "$ref": "#/$defs/evidenceArtifactLineage" }
|
|
126
|
+
}
|
|
127
|
+
},
|
|
128
|
+
"analysis": {
|
|
129
|
+
"type": "object",
|
|
130
|
+
"additionalProperties": false,
|
|
131
|
+
"required": ["promptVersion", "contextVersion", "resultCount"],
|
|
132
|
+
"properties": {
|
|
133
|
+
"promptVersion": { "type": "string", "minLength": 1 },
|
|
134
|
+
"contextVersion": { "type": "string", "minLength": 1 },
|
|
135
|
+
"resultCount": { "type": "integer", "minimum": 0 }
|
|
136
|
+
}
|
|
137
|
+
},
|
|
138
|
+
"summary": {
|
|
139
|
+
"type": "object",
|
|
140
|
+
"additionalProperties": false,
|
|
141
|
+
"required": [
|
|
142
|
+
"resultCount",
|
|
143
|
+
"analyzedCount",
|
|
144
|
+
"skippedCount",
|
|
145
|
+
"failedCount",
|
|
146
|
+
"requiresHumanReviewCount",
|
|
147
|
+
"riskCounts"
|
|
148
|
+
],
|
|
149
|
+
"properties": {
|
|
150
|
+
"resultCount": { "type": "integer", "minimum": 0 },
|
|
151
|
+
"analyzedCount": { "type": "integer", "minimum": 0 },
|
|
152
|
+
"skippedCount": { "type": "integer", "minimum": 0 },
|
|
153
|
+
"failedCount": { "type": "integer", "minimum": 0 },
|
|
154
|
+
"requiresHumanReviewCount": { "type": "integer", "minimum": 0 },
|
|
155
|
+
"riskCounts": {
|
|
156
|
+
"type": "object",
|
|
157
|
+
"additionalProperties": false,
|
|
158
|
+
"required": ["low", "medium", "high", "unknown"],
|
|
159
|
+
"properties": {
|
|
160
|
+
"low": { "type": "integer", "minimum": 0 },
|
|
161
|
+
"medium": { "type": "integer", "minimum": 0 },
|
|
162
|
+
"high": { "type": "integer", "minimum": 0 },
|
|
163
|
+
"unknown": { "type": "integer", "minimum": 0 }
|
|
164
|
+
}
|
|
165
|
+
}
|
|
166
|
+
}
|
|
167
|
+
},
|
|
168
|
+
"dependency": {
|
|
169
|
+
"type": "object",
|
|
170
|
+
"additionalProperties": false,
|
|
171
|
+
"required": [
|
|
172
|
+
"projectId",
|
|
173
|
+
"packageId",
|
|
174
|
+
"declaredName",
|
|
175
|
+
"normalizedName",
|
|
176
|
+
"ecosystem",
|
|
177
|
+
"registry",
|
|
178
|
+
"packageManager",
|
|
179
|
+
"dependencyType",
|
|
180
|
+
"manifest"
|
|
181
|
+
],
|
|
182
|
+
"properties": {
|
|
183
|
+
"projectId": { "type": "string", "minLength": 1 },
|
|
184
|
+
"packageId": { "type": "string", "minLength": 1 },
|
|
185
|
+
"declaredName": { "type": "string", "minLength": 1 },
|
|
186
|
+
"normalizedName": { "type": "string", "minLength": 1 },
|
|
187
|
+
"ecosystem": { "type": "string", "minLength": 1 },
|
|
188
|
+
"registry": { "type": "string", "minLength": 1 },
|
|
189
|
+
"packageManager": { "$ref": "#/$defs/nullableString" },
|
|
190
|
+
"dependencyType": { "type": "string", "minLength": 1 },
|
|
191
|
+
"manifest": { "$ref": "#/$defs/relativePath" }
|
|
192
|
+
}
|
|
193
|
+
},
|
|
194
|
+
"versions": {
|
|
195
|
+
"type": "object",
|
|
196
|
+
"additionalProperties": false,
|
|
197
|
+
"required": [
|
|
198
|
+
"analysisMode",
|
|
199
|
+
"declaredVersion",
|
|
200
|
+
"currentVersion",
|
|
201
|
+
"currentVersionSource",
|
|
202
|
+
"targetVersion",
|
|
203
|
+
"targetPolicy",
|
|
204
|
+
"delta"
|
|
205
|
+
],
|
|
206
|
+
"properties": {
|
|
207
|
+
"analysisMode": { "enum": ["exactBaseline", "declaredConstraint", "unsupportedBaseline"] },
|
|
208
|
+
"declaredVersion": { "$ref": "#/$defs/nullableString" },
|
|
209
|
+
"installedVersion": { "$ref": "#/$defs/nullableString" },
|
|
210
|
+
"installedVersionStatus": { "enum": ["resolved", "unresolved"] },
|
|
211
|
+
"installedVersionSource": {
|
|
212
|
+
"anyOf": [
|
|
213
|
+
{ "$ref": "#/$defs/installedVersionSource" },
|
|
214
|
+
{ "type": "null" }
|
|
215
|
+
]
|
|
216
|
+
},
|
|
217
|
+
"installedVersionReason": {
|
|
218
|
+
"anyOf": [
|
|
219
|
+
{ "$ref": "#/$defs/installedVersionReason" },
|
|
220
|
+
{ "type": "null" }
|
|
221
|
+
]
|
|
222
|
+
},
|
|
223
|
+
"currentVersion": { "$ref": "#/$defs/nullableString" },
|
|
224
|
+
"currentVersionSource": {
|
|
225
|
+
"anyOf": [
|
|
226
|
+
{ "enum": ["explicit", "exactDeclaration", "resolvedArtifact"] },
|
|
227
|
+
{ "type": "null" }
|
|
228
|
+
]
|
|
229
|
+
},
|
|
230
|
+
"targetVersion": { "$ref": "#/$defs/nullableString" },
|
|
231
|
+
"targetPolicy": { "enum": ["explicit", "registryLatest"] },
|
|
232
|
+
"delta": {
|
|
233
|
+
"type": "object",
|
|
234
|
+
"additionalProperties": false,
|
|
235
|
+
"required": ["direction", "classification"],
|
|
236
|
+
"properties": {
|
|
237
|
+
"direction": { "enum": ["upgrade", "same", "downgrade", "unknown"] },
|
|
238
|
+
"classification": { "enum": ["major", "minor", "patch", "prerelease", "other", "unknown"] }
|
|
239
|
+
}
|
|
240
|
+
}
|
|
241
|
+
},
|
|
242
|
+
"allOf": [
|
|
243
|
+
{
|
|
244
|
+
"if": {
|
|
245
|
+
"anyOf": [
|
|
246
|
+
{ "required": ["installedVersion"] },
|
|
247
|
+
{ "required": ["installedVersionStatus"] },
|
|
248
|
+
{ "required": ["installedVersionSource"] },
|
|
249
|
+
{ "required": ["installedVersionReason"] }
|
|
250
|
+
]
|
|
251
|
+
},
|
|
252
|
+
"then": {
|
|
253
|
+
"required": [
|
|
254
|
+
"installedVersion",
|
|
255
|
+
"installedVersionStatus",
|
|
256
|
+
"installedVersionSource",
|
|
257
|
+
"installedVersionReason"
|
|
258
|
+
]
|
|
259
|
+
}
|
|
260
|
+
},
|
|
261
|
+
{
|
|
262
|
+
"if": {
|
|
263
|
+
"properties": { "installedVersionStatus": { "const": "resolved" } },
|
|
264
|
+
"required": ["installedVersionStatus"]
|
|
265
|
+
},
|
|
266
|
+
"then": {
|
|
267
|
+
"properties": {
|
|
268
|
+
"installedVersion": { "type": "string", "minLength": 1 },
|
|
269
|
+
"installedVersionSource": { "$ref": "#/$defs/installedVersionSource" },
|
|
270
|
+
"installedVersionReason": { "type": "null" }
|
|
271
|
+
}
|
|
272
|
+
}
|
|
273
|
+
},
|
|
274
|
+
{
|
|
275
|
+
"if": {
|
|
276
|
+
"properties": { "installedVersionStatus": { "const": "unresolved" } },
|
|
277
|
+
"required": ["installedVersionStatus"]
|
|
278
|
+
},
|
|
279
|
+
"then": {
|
|
280
|
+
"properties": {
|
|
281
|
+
"installedVersion": { "type": "null" },
|
|
282
|
+
"installedVersionSource": { "type": "null" },
|
|
283
|
+
"installedVersionReason": { "$ref": "#/$defs/installedVersionReason" }
|
|
284
|
+
}
|
|
285
|
+
}
|
|
286
|
+
}
|
|
287
|
+
]
|
|
288
|
+
},
|
|
289
|
+
"evidence": {
|
|
290
|
+
"type": "object",
|
|
291
|
+
"additionalProperties": false,
|
|
292
|
+
"required": [
|
|
293
|
+
"id",
|
|
294
|
+
"kind",
|
|
295
|
+
"sourceId",
|
|
296
|
+
"sourceUrl",
|
|
297
|
+
"authority",
|
|
298
|
+
"trust",
|
|
299
|
+
"retrievedAt",
|
|
300
|
+
"contentDigest",
|
|
301
|
+
"locator",
|
|
302
|
+
"releaseVersions"
|
|
303
|
+
],
|
|
304
|
+
"properties": {
|
|
305
|
+
"id": { "$ref": "#/$defs/digest" },
|
|
306
|
+
"kind": { "type": "string", "minLength": 1 },
|
|
307
|
+
"sourceId": { "type": "string", "minLength": 1 },
|
|
308
|
+
"sourceUrl": { "$ref": "#/$defs/httpsUrl" },
|
|
309
|
+
"authority": { "type": "string", "minLength": 1 },
|
|
310
|
+
"trust": { "type": "string", "minLength": 1 },
|
|
311
|
+
"retrievedAt": { "type": "string", "format": "date-time" },
|
|
312
|
+
"contentDigest": { "$ref": "#/$defs/digest" },
|
|
313
|
+
"locator": { "type": "string", "minLength": 1 },
|
|
314
|
+
"releaseVersions": {
|
|
315
|
+
"type": "array",
|
|
316
|
+
"uniqueItems": true,
|
|
317
|
+
"items": { "type": "string", "minLength": 1 }
|
|
318
|
+
}
|
|
319
|
+
}
|
|
320
|
+
},
|
|
321
|
+
"finding": {
|
|
322
|
+
"type": "object",
|
|
323
|
+
"additionalProperties": false,
|
|
324
|
+
"required": ["id", "kind", "summary", "appliesToVersions", "evidenceRefs"],
|
|
325
|
+
"properties": {
|
|
326
|
+
"id": { "type": "string", "minLength": 1 },
|
|
327
|
+
"kind": { "enum": ["breakingChange", "deprecation", "compatibility"] },
|
|
328
|
+
"summary": { "type": "string", "minLength": 1 },
|
|
329
|
+
"appliesToVersions": {
|
|
330
|
+
"type": "array",
|
|
331
|
+
"uniqueItems": true,
|
|
332
|
+
"items": { "type": "string", "minLength": 1 }
|
|
333
|
+
},
|
|
334
|
+
"evidenceRefs": {
|
|
335
|
+
"type": "array",
|
|
336
|
+
"uniqueItems": true,
|
|
337
|
+
"items": { "$ref": "#/$defs/digest" }
|
|
338
|
+
}
|
|
339
|
+
}
|
|
340
|
+
},
|
|
341
|
+
"validation": {
|
|
342
|
+
"type": "object",
|
|
343
|
+
"additionalProperties": false,
|
|
344
|
+
"required": ["status", "warningCodes"],
|
|
345
|
+
"properties": {
|
|
346
|
+
"status": { "enum": ["valid", "validWithWarnings", "invalid"] },
|
|
347
|
+
"warningCodes": {
|
|
348
|
+
"type": "array",
|
|
349
|
+
"uniqueItems": true,
|
|
350
|
+
"items": { "type": "string", "minLength": 1 }
|
|
351
|
+
}
|
|
352
|
+
}
|
|
353
|
+
},
|
|
354
|
+
"limitation": {
|
|
355
|
+
"type": "object",
|
|
356
|
+
"additionalProperties": false,
|
|
357
|
+
"required": ["code", "message"],
|
|
358
|
+
"properties": {
|
|
359
|
+
"code": { "type": "string", "minLength": 1 },
|
|
360
|
+
"message": { "type": "string", "minLength": 1 }
|
|
361
|
+
}
|
|
362
|
+
},
|
|
363
|
+
"confidence": {
|
|
364
|
+
"type": "object",
|
|
365
|
+
"additionalProperties": false,
|
|
366
|
+
"required": ["evidenceCoverage", "validationStatus", "requiresHumanReview"],
|
|
367
|
+
"properties": {
|
|
368
|
+
"evidenceCoverage": { "enum": ["none", "partial", "sufficient"] },
|
|
369
|
+
"validationStatus": { "enum": ["valid", "validWithWarnings", "invalid"] },
|
|
370
|
+
"requiresHumanReview": { "type": "boolean" }
|
|
371
|
+
}
|
|
372
|
+
},
|
|
373
|
+
"result": {
|
|
374
|
+
"type": "object",
|
|
375
|
+
"additionalProperties": false,
|
|
376
|
+
"required": [
|
|
377
|
+
"id",
|
|
378
|
+
"status",
|
|
379
|
+
"contextId",
|
|
380
|
+
"dependency",
|
|
381
|
+
"versions",
|
|
382
|
+
"summary",
|
|
383
|
+
"summaryEvidenceRefs",
|
|
384
|
+
"riskLevel",
|
|
385
|
+
"riskEvidenceRefs",
|
|
386
|
+
"findings",
|
|
387
|
+
"evidence",
|
|
388
|
+
"evidenceCoverage",
|
|
389
|
+
"confidence",
|
|
390
|
+
"validation",
|
|
391
|
+
"requiresHumanReview",
|
|
392
|
+
"humanReviewReasons",
|
|
393
|
+
"nextAction",
|
|
394
|
+
"limitations"
|
|
395
|
+
],
|
|
396
|
+
"properties": {
|
|
397
|
+
"id": { "$ref": "#/$defs/digest" },
|
|
398
|
+
"status": { "enum": ["analyzed", "skipped", "failed"] },
|
|
399
|
+
"contextId": { "$ref": "#/$defs/digest" },
|
|
400
|
+
"dependency": { "$ref": "#/$defs/dependency" },
|
|
401
|
+
"versions": { "$ref": "#/$defs/versions" },
|
|
402
|
+
"summary": { "type": "string", "minLength": 1 },
|
|
403
|
+
"summaryEvidenceRefs": {
|
|
404
|
+
"type": "array",
|
|
405
|
+
"uniqueItems": true,
|
|
406
|
+
"items": { "$ref": "#/$defs/digest" }
|
|
407
|
+
},
|
|
408
|
+
"riskLevel": { "enum": ["low", "medium", "high", "unknown"] },
|
|
409
|
+
"riskEvidenceRefs": {
|
|
410
|
+
"type": "array",
|
|
411
|
+
"uniqueItems": true,
|
|
412
|
+
"items": { "$ref": "#/$defs/digest" }
|
|
413
|
+
},
|
|
414
|
+
"findings": {
|
|
415
|
+
"type": "array",
|
|
416
|
+
"items": { "$ref": "#/$defs/finding" }
|
|
417
|
+
},
|
|
418
|
+
"evidence": {
|
|
419
|
+
"type": "array",
|
|
420
|
+
"items": { "$ref": "#/$defs/evidence" }
|
|
421
|
+
},
|
|
422
|
+
"evidenceCoverage": { "enum": ["none", "partial", "sufficient"] },
|
|
423
|
+
"confidence": { "$ref": "#/$defs/confidence" },
|
|
424
|
+
"validation": { "$ref": "#/$defs/validation" },
|
|
425
|
+
"requiresHumanReview": { "type": "boolean" },
|
|
426
|
+
"humanReviewReasons": {
|
|
427
|
+
"type": "array",
|
|
428
|
+
"uniqueItems": true,
|
|
429
|
+
"items": { "type": "string", "minLength": 1 }
|
|
430
|
+
},
|
|
431
|
+
"nextAction": {
|
|
432
|
+
"enum": [
|
|
433
|
+
"collectEvidence",
|
|
434
|
+
"provideExplicitTarget",
|
|
435
|
+
"resolveCurrentVersion",
|
|
436
|
+
"reviewBeforeImpactAnalysis",
|
|
437
|
+
"proceedToImpactAnalysis",
|
|
438
|
+
"noUpgradeNeeded",
|
|
439
|
+
"retryAnalysis"
|
|
440
|
+
]
|
|
441
|
+
},
|
|
442
|
+
"limitations": {
|
|
443
|
+
"type": "array",
|
|
444
|
+
"items": { "$ref": "#/$defs/limitation" }
|
|
445
|
+
}
|
|
446
|
+
}
|
|
447
|
+
}
|
|
448
|
+
}
|
|
449
|
+
}
|