cve-scanner 0.0.0 → 0.0.2

package/dist/ecosystems/java/parsers/gradleDependencyOutputParser.test.js

@@ -0,0 +1,36 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const gradleDependencyOutputParser_1 = require("./gradleDependencyOutputParser");
+(0, node_test_1.test)('parses marked dependency lines and ignores everything else', () => {
+    const text = `
+> Task :cveScannerListDependencies
+CVE_SCANNER_DEP:org.apache.logging.log4j:log4j-core:2.14.1
+some other gradle noise
+CVE_SCANNER_DEP:com.google.guava:guava:31.1-jre
+
+BUILD SUCCESSFUL in 1s
+`;
+    strict_1.default.deepEqual((0, gradleDependencyOutputParser_1.gradleDependencyOutputParser)(text), [
+        {
+            group: 'org.apache.logging.log4j',
+            name: 'log4j-core',
+            version: '2.14.1',
+        },
+        { group: 'com.google.guava', name: 'guava', version: '31.1-jre' },
+    ]);
+});
+(0, node_test_1.test)('deduplicates identical lines', () => {
+    const text = `
+CVE_SCANNER_DEP:a:b:1.0
+CVE_SCANNER_DEP:a:b:1.0
+`;
+    strict_1.default.deepEqual((0, gradleDependencyOutputParser_1.gradleDependencyOutputParser)(text), [
+        { group: 'a', name: 'b', version: '1.0' },
+    ]);
+});
+//# sourceMappingURL=gradleDependencyOutputParser.test.js.map

package/dist/ecosystems/java/parsers/gradleDependencyOutputParser.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gradleDependencyOutputParser.test.js","sourceRoot":"","sources":["../../../../src/ecosystems/java/parsers/gradleDependencyOutputParser.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AACjC,iFAA8E;AAE9E,IAAA,gBAAI,EAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,IAAI,GAAG;;;;;;;CAOd,CAAC;IAEA,gBAAM,CAAC,SAAS,CAAC,IAAA,2DAA4B,EAAC,IAAI,CAAC,EAAE;QACnD;YACE,KAAK,EAAE,0BAA0B;YACjC,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,QAAQ;SAClB;QACD,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE;KAClE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,8BAA8B,EAAE,GAAG,EAAE;IACxC,MAAM,IAAI,GAAG;;;CAGd,CAAC;IACA,gBAAM,CAAC,SAAS,CAAC,IAAA,2DAA4B,EAAC,IAAI,CAAC,EAAE;QACnD,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;KAC1C,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/ecosystems/java/parsers/mavenDependencyListParser.d.ts

@@ -0,0 +1,11 @@
+export interface MavenCoordinate {
+    groupId: string;
+    artifactId: string;
+    version: string;
+}
+/**
+ * Parses the text written by `mvn dependency:list -DoutputFile=<file>`.
+ * Typical line: "   com.fasterxml.jackson.core:jackson-databind:jar:2.9.8:compile"
+ * See specs/30-java-detector.md.
+ */
+export declare function mavenDependencyListParser(text: string): MavenCoordinate[];

package/dist/ecosystems/java/parsers/mavenDependencyListParser.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mavenDependencyListParser = mavenDependencyListParser;
+/**
+ * Parses the text written by `mvn dependency:list -DoutputFile=<file>`.
+ * Typical line: "   com.fasterxml.jackson.core:jackson-databind:jar:2.9.8:compile"
+ * See specs/30-java-detector.md.
+ */
+function mavenDependencyListParser(text) {
+    const results = [];
+    const seen = new Set();
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        const parts = line.split(':');
+        if (parts.length < 4)
+            continue;
+        const [groupId, artifactId, , version] = parts;
+        if (!groupId || !artifactId || !version)
+            continue;
+        if (!/^[A-Za-z0-9._-]+$/.test(groupId) ||
+            !/^[A-Za-z0-9._-]+$/.test(artifactId))
+            continue;
+        const key = `${groupId}:${artifactId}:${version}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        results.push({ groupId, artifactId, version });
+    }
+    return results;
+}
+//# sourceMappingURL=mavenDependencyListParser.js.map

package/dist/ecosystems/java/parsers/mavenDependencyListParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mavenDependencyListParser.js","sourceRoot":"","sources":["../../../../src/ecosystems/java/parsers/mavenDependencyListParser.ts"],"names":[],"mappings":";;;AAMA;;;;GAIG;AACH,mCAA0C,IAAY;IACpD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAE/B,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,AAAD,EAAG,OAAO,CAAC,GAAG,KAAK,CAAC;QAC/C,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO;YAAE,SAAS;QAClD,IACE,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;YAClC,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;YAErC,SAAS;QAEX,MAAM,GAAG,GAAG,GAAG,OAAO,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/ecosystems/java/parsers/mavenDependencyListParser.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ecosystems/java/parsers/mavenDependencyListParser.test.js

@@ -0,0 +1,37 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const mavenDependencyListParser_1 = require("./mavenDependencyListParser");
+(0, node_test_1.test)('parses a typical mvn dependency:list output file', () => {
+    const text = `
+The following files have been resolved:
+   com.fasterxml.jackson.core:jackson-databind:jar:2.9.8:compile
+   junit:junit:jar:4.13.2:test
+`;
+    strict_1.default.deepEqual((0, mavenDependencyListParser_1.mavenDependencyListParser)(text), [
+        {
+            groupId: 'com.fasterxml.jackson.core',
+            artifactId: 'jackson-databind',
+            version: '2.9.8',
+        },
+        { groupId: 'junit', artifactId: 'junit', version: '4.13.2' },
+    ]);
+});
+(0, node_test_1.test)('ignores blank lines and banners', () => {
+    const text = '\n\nThe following files have been resolved:\n\n';
+    strict_1.default.deepEqual((0, mavenDependencyListParser_1.mavenDependencyListParser)(text), []);
+});
+(0, node_test_1.test)('deduplicates identical coordinate:version lines', () => {
+    const text = `
+   com.example:lib:jar:1.0.0:compile
+   com.example:lib:jar:1.0.0:compile
+`;
+    strict_1.default.deepEqual((0, mavenDependencyListParser_1.mavenDependencyListParser)(text), [
+        { groupId: 'com.example', artifactId: 'lib', version: '1.0.0' },
+    ]);
+});
+//# sourceMappingURL=mavenDependencyListParser.test.js.map

package/dist/ecosystems/java/parsers/mavenDependencyListParser.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mavenDependencyListParser.test.js","sourceRoot":"","sources":["../../../../src/ecosystems/java/parsers/mavenDependencyListParser.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AACjC,2EAAwE;AAExE,IAAA,gBAAI,EAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,MAAM,IAAI,GAAG;;;;CAId,CAAC;IAEA,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAAyB,EAAC,IAAI,CAAC,EAAE;QAChD;YACE,OAAO,EAAE,4BAA4B;YACrC,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,OAAO;SACjB;QACD,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,iCAAiC,EAAE,GAAG,EAAE;IAC3C,MAAM,IAAI,GAAG,iDAAiD,CAAC;IAC/D,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAAyB,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,iDAAiD,EAAE,GAAG,EAAE;IAC3D,MAAM,IAAI,GAAG;;;CAGd,CAAC;IACA,gBAAM,CAAC,SAAS,CAAC,IAAA,qDAAyB,EAAC,IAAI,CAAC,EAAE;QAChD,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;KAChE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/ecosystems/java/resolveExecutable.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Prefer the project's own wrapper script (e.g. ./mvnw, ./gradlew) if checked
+ * in, otherwise fall back to a global executable resolved via PATH. On
+ * Windows, prefers the platform's own wrapper variant (e.g. mvnw.cmd,
+ * gradlew.bat) over the Unix shell script, since cmd.exe can't run the
+ * latter directly. See specs/30-java-detector.md.
+ */
+export declare function resolveExecutable(scanDir: string, wrapperName: string, globalName: string, windowsWrapperName?: string): string;

package/dist/ecosystems/java/resolveExecutable.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExecutable = resolveExecutable;
+const fs_1 = require("fs");
+const path_1 = require("path");
+/**
+ * Prefer the project's own wrapper script (e.g. ./mvnw, ./gradlew) if checked
+ * in, otherwise fall back to a global executable resolved via PATH. On
+ * Windows, prefers the platform's own wrapper variant (e.g. mvnw.cmd,
+ * gradlew.bat) over the Unix shell script, since cmd.exe can't run the
+ * latter directly. See specs/30-java-detector.md.
+ */
+function resolveExecutable(scanDir, wrapperName, globalName, windowsWrapperName) {
+    if (process.platform === 'win32' && windowsWrapperName) {
+        const windowsWrapperPath = (0, path_1.join)(scanDir, windowsWrapperName);
+        if ((0, fs_1.existsSync)(windowsWrapperPath))
+            return windowsWrapperPath;
+    }
+    const wrapperPath = (0, path_1.join)(scanDir, wrapperName);
+    return (0, fs_1.existsSync)(wrapperPath) ? wrapperPath : globalName;
+}
+//# sourceMappingURL=resolveExecutable.js.map

package/dist/ecosystems/java/resolveExecutable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveExecutable.js","sourceRoot":"","sources":["../../../src/ecosystems/java/resolveExecutable.ts"],"names":[],"mappings":";;;AAAA,2BAAgC;AAChC,+BAA4B;AAE5B;;;;;;GAMG;AACH,2BACE,OAAe,EACf,WAAmB,EACnB,UAAkB,EAClB,kBAA2B;IAE3B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACvD,MAAM,kBAAkB,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAC7D,IAAI,IAAA,eAAU,EAAC,kBAAkB,CAAC;YAAE,OAAO,kBAAkB,CAAC;IAChE,CAAC;IAED,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/C,OAAO,IAAA,eAAU,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;AAC5D,CAAC"}

package/dist/ecosystems/java/resolveExecutable.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ecosystems/java/resolveExecutable.test.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_test_1 = require("node:test");
+const resolveExecutable_1 = require("./resolveExecutable");
+function makeScanDir() {
+    return (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'cve-scanner-exec-'));
+}
+(0, node_test_1.test)('falls back to the global command when no wrapper is checked in', () => {
+    const dir = makeScanDir();
+    strict_1.default.equal((0, resolveExecutable_1.resolveExecutable)(dir, 'mvnw', 'mvn', 'mvnw.cmd'), 'mvn');
+});
+(0, node_test_1.test)('prefers the checked-in Unix wrapper when not on Windows', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'mvnw'), '#!/bin/sh');
+    strict_1.default.equal((0, resolveExecutable_1.resolveExecutable)(dir, 'mvnw', 'mvn', 'mvnw.cmd'), (0, node_path_1.join)(dir, 'mvnw'));
+});
+(0, node_test_1.test)('ignores the windows variant when not given one', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'gradlew'), '#!/bin/sh');
+    strict_1.default.equal((0, resolveExecutable_1.resolveExecutable)(dir, 'gradlew', 'gradle'), (0, node_path_1.join)(dir, 'gradlew'));
+});
+(0, node_test_1.test)('prefers the windows wrapper variant over the Unix one when running on win32', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'gradlew'), '#!/bin/sh');
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'gradlew.bat'), '@echo off');
+    const originalPlatform = process.platform;
+    Object.defineProperty(process, 'platform', { value: 'win32' });
+    try {
+        strict_1.default.equal((0, resolveExecutable_1.resolveExecutable)(dir, 'gradlew', 'gradle', 'gradlew.bat'), (0, node_path_1.join)(dir, 'gradlew.bat'));
+    }
+    finally {
+        Object.defineProperty(process, 'platform', { value: originalPlatform });
+    }
+});
+//# sourceMappingURL=resolveExecutable.test.js.map

package/dist/ecosystems/java/resolveExecutable.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveExecutable.test.js","sourceRoot":"","sources":["../../../src/ecosystems/java/resolveExecutable.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,qCAAqD;AACrD,qCAAiC;AACjC,yCAAiC;AACjC,yCAAiC;AACjC,2DAAwD;AAExD,SAAS,WAAW;IAClB,OAAO,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,IAAA,gBAAI,EAAC,gEAAgE,EAAE,GAAG,EAAE;IAC1E,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,gBAAM,CAAC,KAAK,CAAC,IAAA,qCAAiB,EAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;IAC9C,gBAAM,CAAC,KAAK,CACV,IAAA,qCAAiB,EAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,EACjD,IAAA,gBAAI,EAAC,GAAG,EAAE,MAAM,CAAC,CAClB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,gDAAgD,EAAE,GAAG,EAAE;IAC1D,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;IACjD,gBAAM,CAAC,KAAK,CACV,IAAA,qCAAiB,EAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,EAC3C,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,CAAC,CACrB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,6EAA6E,EAAE,GAAG,EAAE;IACvF,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;IACjD,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC;IAErD,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC1C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,gBAAM,CAAC,KAAK,CACV,IAAA,qCAAiB,EAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,EAC1D,IAAA,gBAAI,EAAC,GAAG,EAAE,aAAa,CAAC,CACzB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/ecosystems/npm/NpmDetector.d.ts

@@ -0,0 +1,6 @@
+import { DetectedArtifact, Detector, ScanOptions } from '../../core/types';
+export declare class NpmDetector implements Detector {
+    readonly ecosystem: 'npm';
+    isApplicable(options: ScanOptions): Promise<boolean>;
+    detect(options: ScanOptions): Promise<DetectedArtifact[]>;
+}

package/dist/ecosystems/npm/NpmDetector.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NpmDetector = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const PackageLockParser_1 = require("./PackageLockParser");
+const LOCKFILE_NAMES = ['package-lock.json', 'npm-shrinkwrap.json'];
+class NpmDetector {
+    constructor() {
+        this.ecosystem = 'npm';
+    }
+    async isApplicable(options) {
+        return LOCKFILE_NAMES.some((name) => (0, fs_1.existsSync)((0, path_1.join)(options.scanDir, name)));
+    }
+    async detect(options) {
+        const lockfileName = LOCKFILE_NAMES.find((name) => (0, fs_1.existsSync)((0, path_1.join)(options.scanDir, name)));
+        if (!lockfileName)
+            return [];
+        const raw = (0, fs_1.readFileSync)((0, path_1.join)(options.scanDir, lockfileName), 'utf8');
+        const packages = (0, PackageLockParser_1.parsePackageLock)(JSON.parse(raw));
+        return packages.map((pkg) => ({
+            ecosystem: this.ecosystem,
+            coordinate: pkg.name,
+            version: pkg.version,
+            source: lockfileName,
+            projectRoot: options.scanDir,
+        }));
+    }
+}
+exports.NpmDetector = NpmDetector;
+//# sourceMappingURL=NpmDetector.js.map

package/dist/ecosystems/npm/NpmDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NpmDetector.js","sourceRoot":"","sources":["../../../src/ecosystems/npm/NpmDetector.ts"],"names":[],"mappings":";;;AAAA,2BAA8C;AAC9C,+BAA4B;AAE5B,2DAAuD;AAEvD,MAAM,cAAc,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;AAEpE;IAAA;QACW,cAAS,GAAG,KAAc,CAAC;IAyBtC,CAAC;IAvBC,KAAK,CAAC,YAAY,CAAC,OAAoB;QACrC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAoB;QAC/B,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAChD,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CACxC,CAAC;QACF,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,CAAC;QAE7B,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAA,oCAAgB,EAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAEnD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,GAAG,CAAC,IAAI;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,YAAY;YACpB,WAAW,EAAE,OAAO,CAAC,OAAO;SAC7B,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/ecosystems/npm/PackageLockParser.d.ts

@@ -0,0 +1,11 @@
+export interface NpmPackage {
+    name: string;
+    version: string;
+    integrity?: string;
+}
+/**
+ * Parses package-lock.json / npm-shrinkwrap.json, supporting both the v1
+ * nested `dependencies` tree and the v2/v3 flat `packages` map.
+ * See specs/40-npm-detector.md.
+ */
+export declare function parsePackageLock(lockfile: unknown): NpmPackage[];

package/dist/ecosystems/npm/PackageLockParser.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePackageLock = parsePackageLock;
+function packageNameFromNodeModulesPath(pathKey) {
+    const idx = pathKey.lastIndexOf('node_modules/');
+    if (idx === -1)
+        return undefined;
+    const afterNodeModules = pathKey.slice(idx + 'node_modules/'.length);
+    if (afterNodeModules.startsWith('@')) {
+        const [scope, name] = afterNodeModules.split('/');
+        return name ? `${scope}/${name}` : undefined;
+    }
+    return afterNodeModules.split('/')[0];
+}
+function walkV1(dependencies, results) {
+    if (!dependencies)
+        return;
+    for (const [name, entry] of Object.entries(dependencies)) {
+        if (entry.version) {
+            results.push({
+                name,
+                version: entry.version,
+                integrity: entry.integrity,
+            });
+        }
+        walkV1(entry.dependencies, results);
+    }
+}
+/**
+ * Parses package-lock.json / npm-shrinkwrap.json, supporting both the v1
+ * nested `dependencies` tree and the v2/v3 flat `packages` map.
+ * See specs/40-npm-detector.md.
+ */
+function parsePackageLock(lockfile) {
+    const results = [];
+    const asV2V3 = lockfile;
+    if (asV2V3.packages) {
+        for (const [pathKey, entry] of Object.entries(asV2V3.packages)) {
+            if (pathKey === '')
+                continue; // the project itself
+            if (!entry.version)
+                continue;
+            const name = packageNameFromNodeModulesPath(pathKey);
+            if (!name)
+                continue;
+            results.push({
+                name,
+                version: entry.version,
+                integrity: entry.integrity,
+            });
+        }
+    }
+    else {
+        walkV1(lockfile.dependencies, results);
+    }
+    const seen = new Set();
+    return results.filter((pkg) => {
+        const key = `${pkg.name}:${pkg.version}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+//# sourceMappingURL=PackageLockParser.js.map

package/dist/ecosystems/npm/PackageLockParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PackageLockParser.js","sourceRoot":"","sources":["../../../src/ecosystems/npm/PackageLockParser.ts"],"names":[],"mappings":";;;AA0BA,SAAS,8BAA8B,CAAC,OAAe;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrE,IAAI,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CACb,YAAqD,EACrD,OAAqB;IAErB,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,0BAAiC,QAAiB;IAChD,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,QAAwB,CAAC;IAExC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,KAAK,EAAE;gBAAE,SAAS,CAAC,qBAAqB;YACnD,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,SAAS;YAC7B,MAAM,IAAI,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAE,QAAuB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/ecosystems/npm/PackageLockParser.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ecosystems/npm/PackageLockParser.test.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const PackageLockParser_1 = require("./PackageLockParser");
+(0, node_test_1.test)('parses a v1 nested dependencies tree, including nested duplicates', () => {
+    const lockfile = {
+        lockfileVersion: 1,
+        dependencies: {
+            lodash: { version: '4.17.11', integrity: 'sha512-a' },
+            a: {
+                version: '1.0.0',
+                integrity: 'sha512-b',
+                dependencies: {
+                    lodash: { version: '3.10.1', integrity: 'sha512-c' },
+                },
+            },
+        },
+    };
+    const result = (0, PackageLockParser_1.parsePackageLock)(lockfile);
+    strict_1.default.deepEqual(result.sort((x, y) => x.version.localeCompare(y.version)), [
+        { name: 'lodash', version: '3.10.1', integrity: 'sha512-c' },
+        { name: 'a', version: '1.0.0', integrity: 'sha512-b' },
+        { name: 'lodash', version: '4.17.11', integrity: 'sha512-a' },
+    ].sort((x, y) => x.version.localeCompare(y.version)));
+});
+(0, node_test_1.test)('parses a v2/v3 flat packages map, including scoped packages and nested node_modules', () => {
+    const lockfile = {
+        lockfileVersion: 3,
+        packages: {
+            '': { name: 'my-app', version: '1.0.0' },
+            'node_modules/lodash': { version: '4.17.21', integrity: 'sha512-x' },
+            'node_modules/@scope/pkg': { version: '2.0.0', integrity: 'sha512-y' },
+            'node_modules/a/node_modules/b': { version: '0.1.0' },
+        },
+    };
+    const result = (0, PackageLockParser_1.parsePackageLock)(lockfile);
+    strict_1.default.deepEqual(result.sort((x, y) => x.name.localeCompare(y.name)), [
+        { name: '@scope/pkg', version: '2.0.0', integrity: 'sha512-y' },
+        { name: 'b', version: '0.1.0', integrity: undefined },
+        { name: 'lodash', version: '4.17.21', integrity: 'sha512-x' },
+    ]);
+});
+(0, node_test_1.test)('deduplicates identical name+version pairs', () => {
+    const lockfile = {
+        packages: {
+            '': {},
+            'node_modules/lodash': { version: '4.17.21' },
+            'node_modules/a/node_modules/lodash': { version: '4.17.21' },
+        },
+    };
+    strict_1.default.deepEqual((0, PackageLockParser_1.parsePackageLock)(lockfile), [
+        { name: 'lodash', version: '4.17.21', integrity: undefined },
+    ]);
+});
+//# sourceMappingURL=PackageLockParser.test.js.map

package/dist/ecosystems/npm/PackageLockParser.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PackageLockParser.test.js","sourceRoot":"","sources":["../../../src/ecosystems/npm/PackageLockParser.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AACjC,2DAAuD;AAEvD,IAAA,gBAAI,EAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,MAAM,QAAQ,GAAG;QACf,eAAe,EAAE,CAAC;QAClB,YAAY,EAAE;YACZ,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE;YACrD,CAAC,EAAE;gBACD,OAAO,EAAE,OAAO;gBAChB,SAAS,EAAE,UAAU;gBACrB,YAAY,EAAE;oBACZ,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE;iBACrD;aACF;SACF;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,IAAA,oCAAgB,EAAC,QAAQ,CAAC,CAAC;IAC1C,gBAAM,CAAC,SAAS,CACd,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EACzD;QACE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE;QAC5D,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE;QACtD,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE;KAC9D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,qFAAqF,EAAE,GAAG,EAAE;IAC/F,MAAM,QAAQ,GAAG;QACf,eAAe,EAAE,CAAC;QAClB,QAAQ,EAAE;YACR,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE;YACxC,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE;YACpE,yBAAyB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE;YACtE,+BAA+B,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;SACtD;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,IAAA,oCAAgB,EAAC,QAAQ,CAAC,CAAC;IAC1C,gBAAM,CAAC,SAAS,CACd,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EACnD;QACE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE;QAC/D,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE;QACrD,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE;KAC9D,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,2CAA2C,EAAE,GAAG,EAAE;IACrD,MAAM,QAAQ,GAAG;QACf,QAAQ,EAAE;YACR,EAAE,EAAE,EAAE;YACN,qBAAqB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;YAC7C,oCAAoC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;SAC7D;KACF,CAAC;IAEF,gBAAM,CAAC,SAAS,CAAC,IAAA,oCAAgB,EAAC,QAAQ,CAAC,EAAE;QAC3C,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/CveScannerApi.d.ts

@@ -0,0 +1,13 @@
+import { ScanOptions, ScanResult } from '../core/types';
+export interface CveScannerApiOptions extends ScanOptions {
+    cveDataDownload?: boolean;
+    aiEndpoint?: string;
+    aiApiKey?: string;
+    aiModel?: string;
+}
+export declare class CveScannerApi {
+    private opts;
+    private datasetPath;
+    constructor(opts: CveScannerApiOptions, datasetPath?: string);
+    scan(): Promise<ScanResult>;
+}

package/dist/lib/CveScannerApi.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CveScannerApi = void 0;
+const path_1 = require("path");
+const AiAssistant_1 = require("../ai/AiAssistant");
+const PromptBuilder_1 = require("../ai/PromptBuilder");
+const ProjectManifestReader_1 = require("../ai/ProjectManifestReader");
+const DatasetLoader_1 = require("../core/DatasetLoader");
+const Scanner_1 = require("../core/Scanner");
+const CveListCache_1 = require("../ecosystems/enrichment/CveListCache");
+const CveOrgDatasetReader_1 = require("../ecosystems/enrichment/CveOrgDatasetReader");
+const GradleDependencyDetector_1 = require("../ecosystems/java/GradleDependencyDetector");
+const MavenDependencyDetector_1 = require("../ecosystems/java/MavenDependencyDetector");
+const NpmDetector_1 = require("../ecosystems/npm/NpmDetector");
+// dist/lib -> dist -> package root -> data/dataset.json
+const DEFAULT_DATASET_PATH = (0, path_1.join)(__dirname, '..', '..', 'data', 'dataset.json');
+class CveScannerApi {
+    constructor(opts, datasetPath = DEFAULT_DATASET_PATH) {
+        this.opts = opts;
+        this.datasetPath = datasetPath;
+    }
+    async scan() {
+        const dataset = DatasetLoader_1.DatasetLoader.fromFile(this.datasetPath);
+        const scanner = new Scanner_1.Scanner([
+            new MavenDependencyDetector_1.MavenDependencyDetector(),
+            new GradleDependencyDetector_1.GradleDependencyDetector(),
+            new NpmDetector_1.NpmDetector(),
+        ], dataset);
+        const findings = await scanner.scan(this.opts);
+        const cveDataDir = this.opts.cveDataDownload
+            ? await (0, CveListCache_1.ensureCveListCache)()
+            : this.opts.cveDataDir;
+        const enricher = new CveOrgDatasetReader_1.CveOrgDatasetReader(cveDataDir);
+        for (const finding of findings) {
+            finding.enrichment = enricher.read(finding.cve.id);
+        }
+        const manifestsByEcosystem = new Map();
+        for (const finding of findings) {
+            const ecosystem = finding.artifact.ecosystem;
+            if (!manifestsByEcosystem.has(ecosystem)) {
+                manifestsByEcosystem.set(ecosystem, (0, ProjectManifestReader_1.readProjectManifest)(this.opts.scanDir, ecosystem));
+            }
+            finding.projectManifest = manifestsByEcosystem.get(ecosystem);
+        }
+        if (this.opts.aiEndpoint && this.opts.aiApiKey && this.opts.aiModel) {
+            const assistant = new AiAssistant_1.AiAssistant(this.opts.aiEndpoint, this.opts.aiApiKey, this.opts.aiModel);
+            for (const finding of findings) {
+                finding.aiAnalysis = await assistant.analyze((0, PromptBuilder_1.buildInvestigationPrompt)(finding));
+            }
+        }
+        return { datasetGeneratedAt: dataset.generatedAt, findings };
+    }
+}
+exports.CveScannerApi = CveScannerApi;
+//# sourceMappingURL=CveScannerApi.js.map

package/dist/lib/CveScannerApi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CveScannerApi.js","sourceRoot":"","sources":["../../src/lib/CveScannerApi.ts"],"names":[],"mappings":";;;AAAA,+BAA4B;AAC5B,mDAAgD;AAChD,uDAA+D;AAC/D,uEAAkE;AAClE,yDAAsD;AACtD,6CAA0C;AAO1C,wEAA2E;AAC3E,sFAAmF;AACnF,0FAAuF;AACvF,wFAAqF;AACrF,+DAA4D;AAE5D,wDAAwD;AACxD,MAAM,oBAAoB,GAAG,IAAA,WAAI,EAC/B,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,cAAc,CACf,CAAC;AASF;IACE,YACU,IAA0B,EAC1B,WAAW,GAAW,oBAAoB;oBAD1C,IAAI;2BACJ,WAAW;IAClB,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GAAG,6BAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,iBAAO,CACzB;YACE,IAAI,iDAAuB,EAAE;YAC7B,IAAI,mDAAwB,EAAE;YAC9B,IAAI,yBAAW,EAAE;SAClB,EACD,OAAO,CACR,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe;YAC1C,CAAC,CAAC,MAAM,IAAA,iCAAkB,GAAE;YAC5B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,yCAAmB,CAAC,UAAU,CAAC,CAAC;QACrD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;QACJ,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC7C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzC,oBAAoB,CAAC,GAAG,CACtB,SAAS,EACT,IAAA,2CAAmB,EAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAClD,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,eAAe,GAAG,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACpE,MAAM,SAAS,GAAG,IAAI,yBAAW,CAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAClB,IAAI,CAAC,IAAI,CAAC,OAAO,CAClB,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,OAAO,CAAC,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAC1C,IAAA,wCAAwB,EAAC,OAAO,CAAC,CAClC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,kBAAkB,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC/D,CAAC;CACF"}

package/dist/lib/report.d.ts

@@ -0,0 +1,4 @@
+import { ScanResult } from '../core/types';
+export type ReportFormat = 'table' | 'json';
+export declare function formatReport(result: ScanResult, format: ReportFormat, scanDir: string): string;
+export declare function computeExitCode(result: ScanResult, failOnScore?: number): number;

package/dist/lib/report.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatReport = formatReport;
+exports.computeExitCode = computeExitCode;
+const path_1 = require("path");
+function projectLabel(scanDir, projectRoot) {
+    const rel = (0, path_1.relative)(scanDir, projectRoot);
+    return rel === '' ? '' : `:${rel}`;
+}
+function formatReport(result, format, scanDir) {
+    const { findings, datasetGeneratedAt } = result;
+    if (format === 'json') {
+        return JSON.stringify({ datasetGeneratedAt, findings }, null, 2);
+    }
+    const lines = [
+        `Vulnerability dataset generated: ${datasetGeneratedAt}`,
+        '',
+    ];
+    if (findings.length === 0) {
+        lines.push('No known vulnerabilities found.');
+        return lines.join('\n');
+    }
+    for (const finding of findings) {
+        const { artifact, cve, enrichment, aiAnalysis } = finding;
+        lines.push(`[${artifact.ecosystem}${projectLabel(scanDir, artifact.projectRoot)}] ${artifact.coordinate}@${artifact.version} - ${cve.id} (score ${cve.score})`);
+        lines.push(`  ${cve.title}`);
+        if (enrichment?.description) {
+            lines.push(`  ${enrichment.description}`);
+        }
+        if (aiAnalysis) {
+            lines.push('  AI analysis:');
+            for (const line of aiAnalysis.split('\n'))
+                lines.push(`    ${line}`);
+        }
+        lines.push('');
+    }
+    return lines.join('\n').trimEnd();
+}
+function computeExitCode(result, failOnScore) {
+    const { findings } = result;
+    if (findings.length === 0)
+        return 0;
+    if (failOnScore === undefined)
+        return 1;
+    return findings.some((f) => f.cve.score >= failOnScore) ? 1 : 0;
+}
+//# sourceMappingURL=report.js.map

package/dist/lib/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/lib/report.ts"],"names":[],"mappings":";;;;AAAA,+BAAgC;AAKhC,SAAS,YAAY,CAAC,OAAe,EAAE,WAAmB;IACxD,MAAM,GAAG,GAAG,IAAA,eAAQ,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC3C,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;AACrC,CAAC;AAED,sBACE,MAAkB,EAClB,MAAoB,EACpB,OAAe;IAEf,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IAEhD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,oCAAoC,kBAAkB,EAAE;QACxD,EAAE;KACH,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,IAAI,QAAQ,CAAC,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,OAAO,MAAM,GAAG,CAAC,EAAE,WAAW,GAAG,CAAC,KAAK,GAAG,CACpJ,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7B,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,yBACE,MAAkB,EAClB,WAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/pipeline/dedupeEntries.d.ts

@@ -0,0 +1,8 @@
+import { VulnerableEntry } from '../core/types';
+/**
+ * Drops exact-duplicate VulnerableEntry rows (same ecosystem, cpe, version
+ * bounds, and CVEs) that can arise when more than one `affected[]` block
+ * across the OSV corpus describes the same package+range+CVE combination.
+ * Preserves the first occurrence's position. See specs/60-data-pipeline.md.
+ */
+export declare function dedupeEntries(entries: VulnerableEntry[]): VulnerableEntry[];

package/dist/pipeline/dedupeEntries.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dedupeEntries = dedupeEntries;
+/**
+ * Drops exact-duplicate VulnerableEntry rows (same ecosystem, cpe, version
+ * bounds, and CVEs) that can arise when more than one `affected[]` block
+ * across the OSV corpus describes the same package+range+CVE combination.
+ * Preserves the first occurrence's position. See specs/60-data-pipeline.md.
+ */
+function dedupeEntries(entries) {
+    const seen = new Set();
+    return entries.filter((entry) => {
+        const key = JSON.stringify(entry);
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+//# sourceMappingURL=dedupeEntries.js.map

package/dist/pipeline/dedupeEntries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedupeEntries.js","sourceRoot":"","sources":["../../src/pipeline/dedupeEntries.ts"],"names":[],"mappings":";;;AAEA;;;;;GAKG;AACH,uBAA8B,OAA0B;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/pipeline/dedupeEntries.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/pipeline/dedupeEntries.test.js

@@ -0,0 +1,27 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const dedupeEntries_1 = require("./dedupeEntries");
+const entry = {
+    ecosystem: 'npm',
+    cpe: 'cpe:2.3:a:lodash:lodash:*:*:*:*:*:*:*:*',
+    versionEndExcluding: '4.17.12',
+    cves: [{ id: 'CVE-1', score: 5, title: 'test' }],
+};
+(0, node_test_1.test)('drops exact duplicates, keeping the first occurrence', () => {
+    const result = (0, dedupeEntries_1.dedupeEntries)([entry, { ...entry }, entry]);
+    strict_1.default.equal(result.length, 1);
+    strict_1.default.deepEqual(result[0], entry);
+});
+(0, node_test_1.test)('keeps entries that differ in any field', () => {
+    const other = { ...entry, versionEndExcluding: '4.17.21' };
+    strict_1.default.deepEqual((0, dedupeEntries_1.dedupeEntries)([entry, other]), [entry, other]);
+});
+(0, node_test_1.test)('handles an empty list', () => {
+    strict_1.default.deepEqual((0, dedupeEntries_1.dedupeEntries)([]), []);
+});
+//# sourceMappingURL=dedupeEntries.test.js.map