json-from-llm 0.1.1 → 0.1.3

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.3] - 2026-06-05
+
+### Added
+
+- Added a public reasoning-output fixture corpus covering `<think>` /
+  `<reasoning>` blocks, fenced JSON, prose wrappers, trailing commas, type
+  expectations and no-JSON failures.
+- Added tests that read the published fixture corpus and verify `tryExtractJson`
+  results.
+- Published the `fixtures/` directory in the npm package for downstream parser
+  and agent-loop tests.
+
+## [0.1.2] - 2026-06-04
+
+### Changed
+
+- Updated vulnerable development tooling and added CodeQL, OpenSSF Scorecard,
+  pinned GitHub Actions, least-privilege workflow permissions, Dependabot config
+  and a Scorecard README badge.
+
 ## [0.1.1] - 2026-06-04
 
 ### Changed

package/README.md

@@ -3,11 +3,15 @@
 [![npm version](https://img.shields.io/npm/v/json-from-llm.svg)](https://www.npmjs.com/package/json-from-llm)
 [![npm downloads](https://img.shields.io/npm/dm/json-from-llm.svg)](https://www.npmjs.com/package/json-from-llm)
 [![CI](https://github.com/slegarraga/json-from-llm/actions/workflows/ci.yml/badge.svg)](https://github.com/slegarraga/json-from-llm/actions/workflows/ci.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/slegarraga/json-from-llm/badge)](https://scorecard.dev/viewer/?uri=github.com/slegarraga/json-from-llm)
 [![license](https://img.shields.io/npm/l/json-from-llm.svg)](./LICENSE)
 [![zero dependencies](https://img.shields.io/badge/dependencies-0-brightgreen.svg)](./package.json)
 
 > Extract valid JSON from an LLM response — even when it's wrapped in reasoning/thinking tags, markdown fences or prose. **Zero dependencies.**
 
+Security posture is tracked in [docs/security-posture.md](./docs/security-posture.md),
+including CodeQL, OpenSSF Scorecard, Dependabot and branch rules.
+
 You asked for JSON. The model gave you:
 
 ````text
@@ -35,6 +39,7 @@ const data = extractJson<{ score: number }>(modelOutput);
 - **Handles the real wrappers.** Markdown fences (`json` and bare ```), conversational prose before/after, and the JSON sitting bare in the text.
 - **String-aware, never corrupts.** The scanner and the trailing-comma repair both respect string contents — a `}` or `,` inside `"a string value"` is left alone.
 - **Conservative repair.** Removes trailing commas (the most common malformation); it will never rewrite your data.
+- **Fixture-backed edge cases.** Public fixtures cover reasoning tags, fenced JSON, prose wrappers, trailing commas, top-level type expectations and no-JSON failures.
 - **Two entry points.** `extractJson` throws on failure; `tryExtractJson` returns `{ found }`.
 - **Zero dependencies**, ESM + CJS, fully typed.
 
@@ -78,6 +83,21 @@ extractJson('[1,2] then the answer {"a":1}', { expect: 'object' }); // { a: 1 }
 
 The low-level pieces (`stripReasoning`, `fencedBlocks`, `balancedSpans`, `removeTrailingCommas`) are exported too.
 
+## Fixture corpus
+
+The package includes a small public corpus under [`fixtures/`](./fixtures):
+
+- `deepseek-thinking-object.txt`
+- `gemini-reasoning-array.txt`
+- `prose-trailing-commas.txt`
+- `expect-object-skips-array.txt`
+- `no-json.txt`
+- expected `tryExtractJson` outputs under `fixtures/expected/`
+
+The tests read these files directly, so parser changes are checked against
+stable, reusable examples. The fixtures are synthetic and safe for public CI:
+they contain no prompts, secrets, user data or live provider responses.
+
 ## Related
 
 - [`tool-schema`](https://www.npmjs.com/package/tool-schema) — turn a JSON Schema into a provider tool/function schema (define the shape you then extract).

package/fixtures/README.md

@@ -0,0 +1,14 @@
+# Reasoning Output Fixture Corpus
+
+This corpus contains deterministic model-output examples that commonly break
+plain `JSON.parse`:
+
+- reasoning/thinking tags with brace-laden prose
+- fenced JSON blocks inside conversational text
+- trailing commas in otherwise valid JSON
+- competing arrays/objects when callers expect a specific top-level type
+- negative text with no recoverable JSON
+
+Each `.txt` file has a matching expected JSON file under `fixtures/expected/`.
+The fixtures are synthetic and safe for public CI: they contain no prompts,
+secrets, user data or live provider responses.

package/fixtures/deepseek-thinking-object.txt

@@ -0,0 +1,13 @@
+<think>
+The user asked for a risk score. I might draft {score: maybe 6}, but that is
+not JSON and should not be selected.
+</think>
+
+Final answer:
+```json
+{
+  "score": 8,
+  "reason": "clear evidence",
+  "tags": ["portable", "safe"]
+}
+```

package/fixtures/expect-object-skips-array.txt

@@ -0,0 +1,7 @@
+First, a quick list: ["draft", "ignore"].
+
+The object you asked for:
+{
+  "city": "Santiago",
+  "units": "metric"
+}

package/fixtures/expected/deepseek-thinking-object.json

@@ -0,0 +1,9 @@
+{
+  "found": true,
+  "expect": "object",
+  "value": {
+    "score": 8,
+    "reason": "clear evidence",
+    "tags": ["portable", "safe"]
+  }
+}

package/fixtures/expected/expect-object-skips-array.json

@@ -0,0 +1,8 @@
+{
+  "found": true,
+  "expect": "object",
+  "value": {
+    "city": "Santiago",
+    "units": "metric"
+  }
+}

package/fixtures/expected/gemini-reasoning-array.json

@@ -0,0 +1,8 @@
+{
+  "found": true,
+  "expect": "array",
+  "value": [
+    { "id": "alpha", "score": 0.91 },
+    { "id": "beta", "score": 0.72 }
+  ]
+}

package/fixtures/expected/no-json.json

@@ -0,0 +1,4 @@
+{
+  "found": false,
+  "expect": "any"
+}

package/fixtures/expected/prose-trailing-commas.json

@@ -0,0 +1,8 @@
+{
+  "found": true,
+  "expect": "object",
+  "value": {
+    "providers": ["openai", "anthropic", "gemini"],
+    "ok": true
+  }
+}

package/fixtures/gemini-reasoning-array.txt

@@ -0,0 +1,12 @@
+<reasoning>
+Need to rank the candidates. The scratch list [bad, draft] is only prose.
+</reasoning>
+
+Here is the JSON:
+
+```json
+[
+  { "id": "alpha", "score": 0.91 },
+  { "id": "beta", "score": 0.72 }
+]
+```

package/fixtures/no-json.txt

@@ -0,0 +1 @@
+I cannot produce a structured result from the supplied input.

package/fixtures/prose-trailing-commas.txt

@@ -0,0 +1,8 @@
+Sure — I normalized the provider names below.
+
+{
+  "providers": ["openai", "anthropic", "gemini",],
+  "ok": true,
+}
+
+Let me know if you want CSV too.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "json-from-llm",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Extract valid JSON from an LLM response, even when it is wrapped in reasoning/thinking tags, markdown fences or prose. Zero dependencies.",
   "keywords": [
     "llm",
@@ -42,6 +42,7 @@
   },
   "files": [
     "dist",
+    "fixtures",
     "README.md",
     "LICENSE",
     "CHANGELOG.md"
@@ -69,6 +70,6 @@
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
     "typescript-eslint": "^8.60.0",
-    "vitest": "^2.1.8"
+    "vitest": "^4.1.8"
   }
 }