brainblast 0.5.2 → 0.6.0

package/dist/chunk-SC6RNNDW.js

@@ -0,0 +1,160 @@
+// src/osv.ts
+function mapSeverity(vuln) {
+  const severities = vuln["severity"] ?? [];
+  for (const sev of severities) {
+    if (sev.type === "CVSS_V3") {
+      const score = parseFloat(sev.score);
+      if (!isNaN(score)) {
+        if (score >= 9) return "critical";
+        if (score >= 7) return "high";
+        if (score >= 4) return "medium";
+        return "low";
+      }
+    }
+  }
+  const dbSpec = vuln["database_specific"] ?? {};
+  const ghsa = (dbSpec["severity"] ?? "").toUpperCase();
+  const map = {
+    CRITICAL: "critical",
+    HIGH: "high",
+    MODERATE: "medium",
+    LOW: "low"
+  };
+  return map[ghsa] ?? "high";
+}
+async function queryOsv(ecosystem, name, version) {
+  const body = JSON.stringify({ version, package: { name, ecosystem } });
+  let res;
+  try {
+    res = await fetch("https://api.osv.dev/v1/query", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body,
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch (e) {
+    throw new Error(`OSV API request failed: ${e.message ?? String(e)}`);
+  }
+  if (!res.ok) throw new Error(`OSV API error: ${res.status} ${res.statusText}`);
+  const data = await res.json();
+  return (data.vulns ?? []).map((v) => {
+    const id = v["id"];
+    const rawSummary = v["summary"] ?? "";
+    const rawDetails = v["details"] ?? "";
+    return {
+      id,
+      severity: mapSeverity(v),
+      summary: rawSummary || rawDetails.slice(0, 200),
+      url: `https://osv.dev/vulnerability/${id}`
+    };
+  });
+}
+
+// src/diff.ts
+async function diffVersions(ecosystem, packageName, fromVersion, toVersion) {
+  const [fromAdvisories, toAdvisories] = await Promise.all([
+    queryOsv(ecosystem, packageName, fromVersion),
+    queryOsv(ecosystem, packageName, toVersion)
+  ]);
+  const fromIds = new Set(fromAdvisories.map((a) => a.id));
+  const toIds = new Set(toAdvisories.map((a) => a.id));
+  return {
+    package: packageName,
+    ecosystem,
+    fromVersion,
+    toVersion,
+    resolved: fromAdvisories.filter((a) => !toIds.has(a.id)),
+    introduced: toAdvisories.filter((a) => !fromIds.has(a.id)),
+    unchanged: fromAdvisories.filter((a) => toIds.has(a.id))
+  };
+}
+var SEV_WEIGHT = { critical: 8, high: 4, medium: 2, low: 1 };
+function riskScore(result) {
+  const sum = (list) => list.reduce((n, a) => n + (SEV_WEIGHT[a.severity] ?? 0), 0);
+  return sum(result.introduced) - sum(result.resolved);
+}
+function badge(sev) {
+  return { critical: "[CRITICAL]", high: "[HIGH]", medium: "[MEDIUM]", low: "[LOW]" }[sev] ?? `[${sev.toUpperCase()}]`;
+}
+function renderDiffText(result) {
+  const lines = [];
+  lines.push(`brainblast diff: ${result.package} ${result.fromVersion} \u2192 ${result.toVersion} (${result.ecosystem})
+`);
+  const total = result.introduced.length + result.resolved.length + result.unchanged.length;
+  if (total === 0) {
+    lines.push("  No known OSV advisories for either version.");
+    return lines.join("\n");
+  }
+  if (result.introduced.length > 0) {
+    lines.push(`  INTRODUCED (${result.introduced.length}):`);
+    for (const a of result.introduced) {
+      lines.push(`    + ${badge(a.severity)} ${a.id} \u2014 ${a.summary}`);
+      lines.push(`      ${a.url}`);
+    }
+  }
+  if (result.resolved.length > 0) {
+    lines.push(`  RESOLVED (${result.resolved.length}):`);
+    for (const a of result.resolved) {
+      lines.push(`    - ${badge(a.severity)} ${a.id} \u2014 ${a.summary}`);
+      lines.push(`      ${a.url}`);
+    }
+  }
+  if (result.unchanged.length > 0) {
+    lines.push(`  UNCHANGED (${result.unchanged.length}):`);
+    for (const a of result.unchanged) {
+      lines.push(`    ~ ${badge(a.severity)} ${a.id} \u2014 ${a.summary}`);
+    }
+  }
+  return lines.join("\n");
+}
+function renderDiffMd(result) {
+  const lines = [];
+  lines.push(`## brainblast diff: \`${result.package}\` ${result.fromVersion} \u2192 ${result.toVersion} (${result.ecosystem})
+`);
+  const total = result.introduced.length + result.resolved.length + result.unchanged.length;
+  if (total === 0) {
+    lines.push("No known OSV advisories for either version.");
+    return lines.join("\n");
+  }
+  if (result.introduced.length > 0) {
+    lines.push(`### \u26A0\uFE0F Introduced (${result.introduced.length})
+`);
+    for (const a of result.introduced) {
+      lines.push(`- **${badge(a.severity)}** [${a.id}](${a.url}) \u2014 ${a.summary}`);
+    }
+    lines.push("");
+  }
+  if (result.resolved.length > 0) {
+    lines.push(`### \u2705 Resolved (${result.resolved.length})
+`);
+    for (const a of result.resolved) {
+      lines.push(`- **${badge(a.severity)}** [${a.id}](${a.url}) \u2014 ${a.summary}`);
+    }
+    lines.push("");
+  }
+  if (result.unchanged.length > 0) {
+    lines.push(`### ~ Unchanged (${result.unchanged.length})
+`);
+    for (const a of result.unchanged) {
+      lines.push(`- **${badge(a.severity)}** [${a.id}](${a.url}) \u2014 ${a.summary}`);
+    }
+    lines.push("");
+  }
+  const score = riskScore(result);
+  if (score > 0) {
+    lines.push(`> **\u26D4 Upgrade increases risk (score +${score}). Review introduced advisories before bumping.**`);
+  } else if (score < 0) {
+    lines.push(`> **\u2705 Upgrade decreases risk (score ${score}). Upgrade recommended.**`);
+  } else if (result.unchanged.length > 0) {
+    lines.push(`> **~ Risk profile unchanged (${result.unchanged.length} advisory${result.unchanged.length !== 1 ? "ies" : ""} persist).**`);
+  }
+  return lines.join("\n");
+}
+
+export {
+  queryOsv,
+  diffVersions,
+  riskScore,
+  renderDiffText,
+  renderDiffMd
+};