dependency-radar 0.6.1 → 0.8.0

package/dist/nodeEngine.js

@@ -0,0 +1,181 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNodeEngineTargetCompatible = isNodeEngineTargetCompatible;
+function parseVersionParts(value) {
+    const match = value.trim().match(/^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?$/);
+    if (!match)
+        return undefined;
+    return {
+        version: [Number(match[1]), Number(match[2] || 0), Number(match[3] || 0)],
+        parts: match[3] ? 3 : match[2] ? 2 : 1,
+    };
+}
+function parseVersion(value) {
+    var _a;
+    return (_a = parseVersionParts(value)) === null || _a === void 0 ? void 0 : _a.version;
+}
+function compare(a, b) {
+    for (let i = 0; i < 3; i += 1)
+        if (a[i] !== b[i])
+            return a[i] - b[i];
+    return 0;
+}
+function satisfiesComparator(target, comparator) {
+    const match = comparator.trim().match(/^(<=|>=|<|>|=)?\s*v?(\d+(?:\.\d+){0,2})$/);
+    if (!match)
+        return false;
+    const version = parseVersion(match[2]);
+    if (!version)
+        return false;
+    const diff = compare(target, version);
+    const op = match[1] || '=';
+    if (op === '<')
+        return diff < 0;
+    if (op === '<=')
+        return diff <= 0;
+    if (op === '>')
+        return diff > 0;
+    if (op === '>=')
+        return diff >= 0;
+    return diff === 0;
+}
+function comparatorAllowsTargetMajor(comparator, minTarget, maxTarget) {
+    const bounds = boundsForComparator(comparator);
+    return Boolean(bounds && intervalsOverlap(bounds, { lower: minTarget, lowerInclusive: true, upper: maxTarget, upperInclusive: false }));
+}
+function boundsForComparator(comparator) {
+    const match = comparator.trim().match(/^(<=|>=|<|>|=)?\s*v?(\d+(?:\.\d+){0,2})$/);
+    if (!match)
+        return undefined;
+    const parsed = parseVersionParts(match[2]);
+    if (!parsed)
+        return undefined;
+    const version = parsed.version;
+    const nextMajor = [version[0] + 1, 0, 0];
+    const op = match[1] || '=';
+    if (op === '<')
+        return { lowerInclusive: true, upper: version, upperInclusive: false };
+    if (op === '<=' && parsed.parts === 1)
+        return { lowerInclusive: true, upper: nextMajor, upperInclusive: false };
+    if (op === '<=')
+        return { lowerInclusive: true, upper: version, upperInclusive: true };
+    if (op === '>' && parsed.parts === 1)
+        return { lower: nextMajor, lowerInclusive: true, upperInclusive: true };
+    if (op === '>')
+        return { lower: version, lowerInclusive: false, upperInclusive: true };
+    if (op === '>=')
+        return { lower: version, lowerInclusive: true, upperInclusive: true };
+    return { lower: version, lowerInclusive: true, upper: version, upperInclusive: true };
+}
+function laterLower(a, b) {
+    if (!a.lower)
+        return { lower: b.lower, lowerInclusive: b.lowerInclusive };
+    if (!b.lower)
+        return { lower: a.lower, lowerInclusive: a.lowerInclusive };
+    const diff = compare(a.lower, b.lower);
+    if (diff > 0)
+        return { lower: a.lower, lowerInclusive: a.lowerInclusive };
+    if (diff < 0)
+        return { lower: b.lower, lowerInclusive: b.lowerInclusive };
+    return { lower: a.lower, lowerInclusive: a.lowerInclusive && b.lowerInclusive };
+}
+function earlierUpper(a, b) {
+    if (!a.upper)
+        return { upper: b.upper, upperInclusive: b.upperInclusive };
+    if (!b.upper)
+        return { upper: a.upper, upperInclusive: a.upperInclusive };
+    const diff = compare(a.upper, b.upper);
+    if (diff < 0)
+        return { upper: a.upper, upperInclusive: a.upperInclusive };
+    if (diff > 0)
+        return { upper: b.upper, upperInclusive: b.upperInclusive };
+    return { upper: a.upper, upperInclusive: a.upperInclusive && b.upperInclusive };
+}
+function intervalsOverlap(a, b) {
+    const lower = laterLower(a, b);
+    const upper = earlierUpper(a, b);
+    if (!lower.lower || !upper.upper)
+        return true;
+    const diff = compare(lower.lower, upper.upper);
+    if (diff < 0)
+        return true;
+    if (diff > 0)
+        return false;
+    return lower.lowerInclusive && upper.upperInclusive;
+}
+function comparatorsOverlapTargetMajor(comparators, targetMajor) {
+    const target = {
+        lower: [targetMajor, 0, 0],
+        lowerInclusive: true,
+        upper: [targetMajor + 1, 0, 0],
+        upperInclusive: false,
+    };
+    let interval = {
+        lowerInclusive: true,
+        upperInclusive: true,
+    };
+    for (const comparator of comparators) {
+        if (!comparatorAllowsTargetMajor(comparator, target.lower, target.upper))
+            return false;
+        const bounds = boundsForComparator(comparator);
+        if (!bounds)
+            continue;
+        const lower = laterLower(interval, bounds);
+        const upper = earlierUpper(interval, bounds);
+        interval = { ...lower, ...upper };
+        if (!intervalsOverlap(interval, target))
+            return false;
+    }
+    return intervalsOverlap(interval, target);
+}
+function expandToken(token) {
+    var _a, _b;
+    const trimmed = token.trim();
+    if (!trimmed || trimmed === '*' || /^[xX]$/.test(trimmed))
+        return [];
+    const xRange = trimmed.match(/^v?(\d+)(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?$/);
+    if (xRange && (((_a = xRange[2]) === null || _a === void 0 ? void 0 : _a.match(/^[xX*]$/)) || ((_b = xRange[3]) === null || _b === void 0 ? void 0 : _b.match(/^[xX*]$/)))) {
+        const major = Number(xRange[1]);
+        if (!xRange[2] || /^[xX*]$/.test(xRange[2]))
+            return [`>=${major}.0.0`, `<${major + 1}.0.0`];
+        const minor = Number(xRange[2]);
+        return [`>=${major}.${minor}.0`, `<${major}.${minor + 1}.0`];
+    }
+    const caret = trimmed.match(/^\^\s*v?(\d+)(?:\.(\d+))?(?:\.(\d+))?$/);
+    if (caret) {
+        const major = Number(caret[1]);
+        return [`>=${major}.${caret[2] || 0}.${caret[3] || 0}`, `<${major + 1}.0.0`];
+    }
+    const tilde = trimmed.match(/^~\s*v?(\d+)(?:\.(\d+))?(?:\.(\d+))?$/);
+    if (tilde) {
+        const major = Number(tilde[1]);
+        if (!tilde[2])
+            return [`>=${major}.0.0`, `<${major + 1}.0.0`];
+        const minor = Number(tilde[2]);
+        return [`>=${major}.${minor}.${tilde[3] || 0}`, `<${major}.${minor + 1}.0`];
+    }
+    const bare = trimmed.match(/^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?$/);
+    if (bare) {
+        const major = Number(bare[1]);
+        if (!bare[2])
+            return [`>=${major}.0.0`, `<${major + 1}.0.0`];
+        const minor = Number(bare[2]);
+        if (!bare[3])
+            return [`>=${major}.${minor}.0`, `<${major}.${minor + 1}.0`];
+        return [`=${major}.${minor}.${bare[3]}`];
+    }
+    return [trimmed];
+}
+function isNodeEngineTargetCompatible(range, targetMajor) {
+    if (!range || !range.trim())
+        return undefined;
+    const clauses = range.split('||').map((clause) => clause.trim()).filter(Boolean);
+    if (clauses.length === 0)
+        return undefined;
+    return clauses.some((clause) => {
+        const hyphen = clause.match(/^\s*v?(\d+(?:\.\d+){0,2})\s+-\s+v?(\d+(?:\.\d+){0,2})\s*$/);
+        const tokens = hyphen ? [`>=${hyphen[1]}`, `<=${hyphen[2]}`] : clause.split(/\s+/);
+        const comparators = tokens.flatMap(expandToken);
+        return comparators.length === 0 || comparatorsOverlapTargetMajor(comparators, targetMajor);
+    });
+}

package/dist/outputFormats.js

@@ -0,0 +1,185 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderSarif = renderSarif;
+exports.renderCycloneDx = renderCycloneDx;
+exports.renderSpdx = renderSpdx;
+exports.defaultOutputName = defaultOutputName;
+const crypto_1 = require("crypto");
+function purl(dep) {
+    const encodedName = dep.package.name.startsWith('@')
+        ? `%40${dep.package.name
+            .slice(1)
+            .split('/')
+            .map(encodeURIComponent)
+            .join('/')}`
+        : encodeURIComponent(dep.package.name);
+    return `pkg:npm/${encodedName}@${encodeURIComponent(dep.package.version)}`;
+}
+function findingLevel(finding) {
+    if (finding.severity === 'error')
+        return 'error';
+    if (finding.severity === 'warning')
+        return 'warning';
+    return 'note';
+}
+function renderSarif(data) {
+    const findings = data.findings || [];
+    const rules = new Map();
+    for (const finding of findings) {
+        if (rules.has(finding.category))
+            continue;
+        rules.set(finding.category, {
+            id: finding.category,
+            name: finding.category,
+            shortDescription: { text: `Dependency Radar ${finding.category} finding` },
+            helpUri: 'https://www.dependency-radar.com'
+        });
+    }
+    return JSON.stringify({
+        version: '2.1.0',
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'Dependency Radar',
+                        informationUri: 'https://www.dependency-radar.com',
+                        semanticVersion: data.dependencyRadarVersion,
+                        rules: Array.from(rules.values())
+                    }
+                },
+                results: findings.map((finding) => ({
+                    ruleId: finding.category,
+                    level: findingLevel(finding),
+                    message: { text: `${finding.title}: ${finding.message}` },
+                    properties: {
+                        dependencyRadarFindingId: finding.id,
+                        packageId: finding.packageId,
+                        packageName: finding.packageName,
+                        packageVersion: finding.packageVersion,
+                        recommendation: finding.recommendation,
+                        evidence: finding.evidence
+                    },
+                    locations: [sarifLocation(finding)]
+                }))
+            }
+        ]
+    }, null, 2);
+}
+function sarifLocation(finding) {
+    const extra = finding;
+    return {
+        physicalLocation: {
+            artifactLocation: { uri: extra.sourceFile || extra.sourcePath || 'package.json' },
+            region: { startLine: extra.startLine || 1 }
+        }
+    };
+}
+function licenseIds(dep) {
+    const declared = dep.compliance.license.declared;
+    const inferred = dep.compliance.license.inferred;
+    if ((declared === null || declared === void 0 ? void 0 : declared.valid) && declared.spdxId)
+        return [{ license: { id: declared.spdxId } }];
+    if (inferred === null || inferred === void 0 ? void 0 : inferred.spdxId)
+        return [{ license: { id: inferred.spdxId } }];
+    return [{ license: { name: 'UNKNOWN' } }];
+}
+function renderCycloneDx(data) {
+    const dependencies = Object.values(data.dependencies || {});
+    return JSON.stringify({
+        bomFormat: 'CycloneDX',
+        specVersion: '1.5',
+        version: 1,
+        metadata: {
+            timestamp: data.generatedAt,
+            tools: [{ vendor: 'Dependency Radar', name: 'dependency-radar', version: data.dependencyRadarVersion }],
+            component: {
+                type: 'application',
+                name: data.project.name || data.project.projectDir,
+                version: data.project.version || '0.0.0'
+            }
+        },
+        components: dependencies.map((dep) => ({
+            type: 'library',
+            'bom-ref': dep.package.id,
+            name: dep.package.name,
+            version: dep.package.version,
+            purl: purl(dep),
+            licenses: licenseIds(dep),
+            externalReferences: [
+                { type: 'distribution', url: dep.package.links.npm },
+                ...(dep.package.links.repository ? [{ type: 'vcs', url: dep.package.links.repository }] : []),
+                ...(dep.package.links.homepage ? [{ type: 'website', url: dep.package.links.homepage }] : [])
+            ]
+        })),
+        dependencies: dependencies.map((dep) => ({
+            ref: dep.package.id,
+            dependsOn: subDependencyRefs(dep)
+        }))
+    }, null, 2);
+}
+function subDependencyRefs(dep) {
+    return Object.values(dep.graph.subDeps || {})
+        .flatMap((group) => Object.values(group || {}))
+        .filter((entry) => Array.isArray(entry) && entry.length >= 2 && (entry[1] === null || typeof entry[1] === 'string'))
+        .map((entry) => entry[1])
+        .filter((resolved) => Boolean(resolved));
+}
+function spdxNamespace(data) {
+    const stable = JSON.stringify({
+        name: data.project.name || 'dependency-radar',
+        version: data.project.version || '0.0.0',
+        generatedAt: data.generatedAt,
+        dependencies: Object.keys(data.dependencies || {}).sort()
+    });
+    return `https://www.dependency-radar.com/spdx/${(0, crypto_1.createHash)('sha256').update(stable).digest('hex').slice(0, 24)}`;
+}
+function renderSpdx(data) {
+    const dependencies = Object.values(data.dependencies || {});
+    const packages = dependencies.map((dep) => {
+        const declared = dep.compliance.license.declared;
+        const inferred = dep.compliance.license.inferred;
+        const license = (declared === null || declared === void 0 ? void 0 : declared.valid) && declared.spdxId
+            ? declared.spdxId
+            : (inferred === null || inferred === void 0 ? void 0 : inferred.spdxId) || 'NOASSERTION';
+        return {
+            SPDXID: `SPDXRef-Package-${dep.package.id.replace(/[^A-Za-z0-9.-]/g, '-')}`,
+            name: dep.package.name,
+            versionInfo: dep.package.version,
+            downloadLocation: dep.package.links.npm,
+            filesAnalyzed: false,
+            licenseConcluded: license,
+            licenseDeclared: license,
+            externalRefs: [
+                {
+                    referenceCategory: 'PACKAGE-MANAGER',
+                    referenceType: 'purl',
+                    referenceLocator: purl(dep)
+                }
+            ]
+        };
+    });
+    return JSON.stringify({
+        spdxVersion: 'SPDX-2.3',
+        dataLicense: 'CC0-1.0',
+        SPDXID: 'SPDXRef-DOCUMENT',
+        name: `${data.project.name || 'dependency-radar'} dependency report`,
+        documentNamespace: spdxNamespace(data),
+        creationInfo: {
+            created: data.generatedAt,
+            creators: [`Tool: dependency-radar-${data.dependencyRadarVersion}`]
+        },
+        packages
+    }, null, 2);
+}
+function defaultOutputName(format) {
+    if (format === 'html')
+        return 'dependency-radar.html';
+    if (format === 'json')
+        return 'dependency-radar.json';
+    if (format === 'sarif')
+        return 'dependency-radar.sarif';
+    if (format === 'cyclonedx')
+        return 'dependency-radar.cdx.json';
+    return 'dependency-radar.spdx.json';
+}