kubeagent 0.1.35 → 0.1.36

package/README.md

@@ -29,6 +29,7 @@ kubeagent watch
 | `watch` | Continuous monitoring with auto-remediation |
 | `diagnose <resource>` | One-shot diagnosis of a pod/deployment/service |
 | `scan <directory>` | Match local project directories to cluster deployments |
+| `scan-apps` | Detect OSS apps in the cluster, list affected workloads + ingress domains, check for CVEs / EOL (`--report` for AI-prioritized remediation) |
 | `notify` | Manage notification channels (`list`, `add`, `remove`, `test`) |
 | `login` | Log in to KubeAgent (browser or `--device` for headless) |
 | `account` | Show account info and token balance |
@@ -52,6 +53,7 @@ KubeAgent builds a per-cluster knowledge base at `~/.kubeagent/clusters/<context
   clusters/
     hetzner-prod/
       cluster.md           # Nodes, namespaces, deployments, services
+      applications.md      # Detected OSS apps with CVE / EOL status
       projects/
         api.md             # Tech stack, dependencies, notes
       runbooks/            # Custom runbooks (manually added)

package/dist/cli.js

@@ -328,6 +328,114 @@ program
         }
     }
 });
+program
+    .command("scan-apps")
+    .description("Detect open-source apps in the cluster and check for CVEs / EOL versions")
+    .option("-c, --context <context>", "Kubernetes context")
+    .option("--no-cache", "Force refresh of CVE/EOL data")
+    .option("--json", "Print JSON result instead of writing the knowledge base")
+    .option("--report", "Also generate an AI-prioritized remediation report (uses tokens)")
+    .action(async (opts) => {
+    const { detectApplications, formatApplicationsMarkdown } = await import("./detector/index.js");
+    const { writeApplicationsKb, ensureKbDir } = await import("./kb/writer.js");
+    const contextName = opts.context ?? "default";
+    const spinner = ora("Scanning cluster for OSS applications...").start();
+    let result;
+    try {
+        result = await detectApplications({
+            context: opts.context,
+            noCache: opts.cache === false,
+            onProgress: (step) => {
+                spinner.text = `Scanning cluster for OSS applications — ${step}...`;
+            },
+        });
+    }
+    catch (err) {
+        spinner.fail(`Scan failed: ${err.message}`);
+        process.exit(1);
+    }
+    const eolCount = result.apps.filter((a) => a.eol?.eol).length;
+    const cveCount = result.apps.filter((a) => a.cves.length > 0).length;
+    spinner.succeed(`Inventoried ${result.apps.length} app${result.apps.length === 1 ? "" : "s"} ` +
+        `(${eolCount} EOL, ${cveCount} with CVEs, ${result.unknowns.length} unmatched)`);
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    const kbDir = join(configDir(), "clusters", contextName);
+    ensureKbDir(kbDir);
+    writeApplicationsKb(kbDir, formatApplicationsMarkdown(result));
+    console.log(chalk.dim(`Inventory written to ${join(kbDir, "applications.md")}`));
+    if (result.apps.length === 0 && result.unknowns.length === 0) {
+        console.log(chalk.dim("No detectable OSS applications found."));
+        return;
+    }
+    const renderWorkloads = (workloads) => {
+        for (const w of workloads) {
+            const hosts = w.hosts && w.hosts.length > 0 ? chalk.cyan(`  ${w.hosts.join(", ")}`) : "";
+            console.log(chalk.dim(`           ↳ ${w.kind}/${w.namespace}/${w.name}`) + hosts);
+        }
+    };
+    console.log();
+    for (const a of result.apps) {
+        if (a.eol?.eol) {
+            const since = a.eol.eolDate ? ` since ${a.eol.eolDate}` : "";
+            const latest = a.eol.latest ? chalk.dim(` (latest: ${a.eol.latest})`) : "";
+            console.log(chalk.red(`[critical] ${a.display} ${a.version} — EOL${since}`) +
+                latest +
+                chalk.dim(`  ${a.workloads.length} workload(s)`));
+            renderWorkloads(a.workloads);
+        }
+        else if (a.cves.length > 0) {
+            const ids = a.cves.slice(0, 3).map((c) => c.id).join(", ");
+            const more = a.cves.length > 3 ? ` + ${a.cves.length - 3} more` : "";
+            console.log(chalk.yellow(`[warning]  ${a.display} ${a.version} — ${a.cves.length} CVE(s): ${ids}${more}`) +
+                chalk.dim(`  ${a.workloads.length} workload(s)`));
+            renderWorkloads(a.workloads);
+        }
+        else {
+            console.log(chalk.green(`[info]     ${a.display} ${a.version} — no known CVEs`) +
+                chalk.dim(`  ${a.workloads.length} workload(s)`));
+            renderWorkloads(a.workloads);
+        }
+    }
+    if (opts.report) {
+        if (result.apps.length === 0) {
+            console.log(chalk.dim("\nNo apps to analyze — skipping report."));
+            return;
+        }
+        const auth = loadAuth();
+        if (!auth?.apiKey) {
+            console.error(chalk.red("\n--report requires login. Run: kubeagent login"));
+            process.exit(1);
+        }
+        const { generateReport } = await import("./detector/report.js");
+        const { writeFileSync } = await import("node:fs");
+        const reportSpinner = ora("Generating remediation report...").start();
+        let report;
+        try {
+            report = await generateReport(result, auth, {
+                onProgress: (s) => { reportSpinner.text = `Generating remediation report — ${s}...`; },
+            });
+        }
+        catch (err) {
+            const e = err;
+            if (e.status === 402 || e.code === "token_exhausted") {
+                reportSpinner.fail("Token balance exhausted. Run: kubeagent account");
+            }
+            else {
+                reportSpinner.fail(`Report failed: ${e.message.replace("KubeAgent proxy: ", "")}`);
+            }
+            return;
+        }
+        reportSpinner.succeed("Remediation report ready");
+        const reportPath = join(kbDir, "report.md");
+        writeFileSync(reportPath, report);
+        console.log(chalk.dim(`Report written to ${reportPath}`));
+        console.log();
+        console.log(report);
+    }
+});
 // Notify commands
 const notifyCmd = program.command("notify").description("Manage notification channels");
 notifyCmd

package/dist/detector/cache.d.ts

@@ -0,0 +1,6 @@
+export declare function readCache<T>(kind: string, key: string): T | null;
+export declare function readStaleCache<T>(kind: string, key: string): {
+    data: T;
+    fetchedAt: number;
+} | null;
+export declare function writeCache<T>(kind: string, key: string, data: T): void;

package/dist/detector/cache.js

@@ -0,0 +1,44 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { configDir } from "../config.js";
+const TTL_MS = 24 * 60 * 60 * 1000;
+function cacheFile(kind, key) {
+    const safe = key.replace(/[^a-z0-9_.@+-]/gi, "_");
+    return join(configDir(), "cache", kind, `${safe}.json`);
+}
+export function readCache(kind, key) {
+    const path = cacheFile(kind, key);
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = readFileSync(path, "utf-8");
+        const entry = JSON.parse(raw);
+        if (Date.now() - entry.fetchedAt > TTL_MS)
+            return null;
+        return entry.data;
+    }
+    catch {
+        return null;
+    }
+}
+export function readStaleCache(kind, key) {
+    const path = cacheFile(kind, key);
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = readFileSync(path, "utf-8");
+        const entry = JSON.parse(raw);
+        return { data: entry.data, fetchedAt: entry.fetchedAt };
+    }
+    catch {
+        return null;
+    }
+}
+export function writeCache(kind, key, data) {
+    const path = cacheFile(kind, key);
+    const dir = dirname(path);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const entry = { fetchedAt: Date.now(), data };
+    writeFileSync(path, JSON.stringify(entry));
+}

package/dist/detector/cache.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/detector/cache.test.js

@@ -0,0 +1,54 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, rmSync, existsSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+let tmpHome;
+let originalHome;
+beforeEach(() => {
+    originalHome = process.env.HOME;
+    tmpHome = mkdtempSync(join(tmpdir(), "kubeagent-cache-test-"));
+    process.env.HOME = tmpHome;
+});
+afterEach(() => {
+    if (originalHome !== undefined)
+        process.env.HOME = originalHome;
+    else
+        delete process.env.HOME;
+    rmSync(tmpHome, { recursive: true, force: true });
+});
+describe("cache", () => {
+    it("round-trips data within the TTL", async () => {
+        const { readCache, writeCache } = await import("./cache.js");
+        writeCache("osv", "redis@7.0.5", [{ id: "CVE-1" }]);
+        const got = readCache("osv", "redis@7.0.5");
+        expect(got).toEqual([{ id: "CVE-1" }]);
+    });
+    it("returns null for a missing entry", async () => {
+        const { readCache } = await import("./cache.js");
+        expect(readCache("osv", "nope")).toBeNull();
+    });
+    it("creates the cache directory on write", async () => {
+        const { writeCache } = await import("./cache.js");
+        writeCache("eol", "postgres", [{ cycle: "15" }]);
+        expect(existsSync(join(tmpHome, ".kubeagent", "cache", "eol", "postgres.json"))).toBe(true);
+    });
+    it("sanitizes unsafe characters in cache keys", async () => {
+        const { writeCache } = await import("./cache.js");
+        writeCache("osv", "foo/../bar@1.0", { x: 1 });
+        expect(existsSync(join(tmpHome, ".kubeagent", "cache", "osv", "foo_.._bar@1.0.json"))).toBe(true);
+    });
+    it("readStaleCache returns data and a fetchedAt timestamp", async () => {
+        const { writeCache, readStaleCache } = await import("./cache.js");
+        writeCache("osv", "k", "v");
+        const stale = readStaleCache("osv", "k");
+        expect(stale?.data).toBe("v");
+        expect(typeof stale?.fetchedAt).toBe("number");
+    });
+    it("treats a malformed cache file as a miss", async () => {
+        const { writeCache, readCache } = await import("./cache.js");
+        writeCache("osv", "k", "v");
+        const path = join(tmpHome, ".kubeagent", "cache", "osv", "k.json");
+        writeFileSync(path, "not json");
+        expect(readCache("osv", "k")).toBeNull();
+    });
+});

package/dist/detector/catalog.d.ts

@@ -0,0 +1,17 @@
+export interface OsvLookup {
+    name: string;
+    ecosystem?: string;
+}
+export interface ProductEntry {
+    display: string;
+    eolProduct?: string;
+    osv?: OsvLookup;
+}
+export declare const PRODUCTS: Record<string, ProductEntry>;
+export declare const ALIASES: Record<string, string>;
+export interface CatalogMatch {
+    canonical: string;
+    entry: ProductEntry;
+}
+export declare function lookupCatalog(repository: string, name: string): CatalogMatch | null;
+export declare function lookupChart(chartName: string): CatalogMatch | null;

package/dist/detector/catalog.js

@@ -0,0 +1,88 @@
+export const PRODUCTS = {
+    postgres: { display: "PostgreSQL", eolProduct: "postgres", osv: { name: "postgresql" } },
+    mysql: { display: "MySQL", eolProduct: "mysql", osv: { name: "mysql" } },
+    mariadb: { display: "MariaDB", eolProduct: "mariadb", osv: { name: "mariadb" } },
+    redis: { display: "Redis", eolProduct: "redis", osv: { name: "redis" } },
+    mongodb: { display: "MongoDB", eolProduct: "mongodb", osv: { name: "mongodb" } },
+    nginx: { display: "nginx", eolProduct: "nginx", osv: { name: "nginx" } },
+    traefik: { display: "Traefik", eolProduct: "traefik" },
+    haproxy: { display: "HAProxy", eolProduct: "haproxy" },
+    rabbitmq: { display: "RabbitMQ", eolProduct: "rabbitmq", osv: { name: "rabbitmq-server" } },
+    kafka: { display: "Apache Kafka", eolProduct: "apache-kafka" },
+    elasticsearch: { display: "Elasticsearch", eolProduct: "elasticsearch", osv: { name: "elasticsearch" } },
+    kibana: { display: "Kibana", eolProduct: "kibana" },
+    grafana: { display: "Grafana", eolProduct: "grafana", osv: { name: "grafana" } },
+    prometheus: { display: "Prometheus", eolProduct: "prometheus" },
+    etcd: { display: "etcd", eolProduct: "etcd", osv: { name: "etcd" } },
+    kubernetes: { display: "Kubernetes", eolProduct: "kubernetes", osv: { name: "kubernetes" } },
+    node: { display: "Node.js", eolProduct: "nodejs" },
+    python: { display: "Python", eolProduct: "python", osv: { name: "python" } },
+    php: { display: "PHP", eolProduct: "php", osv: { name: "php" } },
+    ruby: { display: "Ruby", eolProduct: "ruby", osv: { name: "ruby" } },
+};
+export const ALIASES = {
+    postgresql: "postgres",
+    "library/postgres": "postgres",
+    "library/postgresql": "postgres",
+    "bitnami/postgresql": "postgres",
+    "bitnami/postgresql-repmgr": "postgres",
+    "library/mysql": "mysql",
+    "bitnami/mysql": "mysql",
+    "library/mariadb": "mariadb",
+    "bitnami/mariadb": "mariadb",
+    "library/redis": "redis",
+    "bitnami/redis": "redis",
+    "redis-stack": "redis",
+    "redis-stack-server": "redis",
+    "library/mongo": "mongodb",
+    mongo: "mongodb",
+    "library/mongodb": "mongodb",
+    "bitnami/mongodb": "mongodb",
+    "library/nginx": "nginx",
+    "bitnami/nginx": "nginx",
+    "nginxinc/nginx-unprivileged": "nginx",
+    "library/traefik": "traefik",
+    "library/haproxy": "haproxy",
+    "haproxytech/haproxy-alpine": "haproxy",
+    "library/rabbitmq": "rabbitmq",
+    "bitnami/rabbitmq": "rabbitmq",
+    "confluentinc/cp-kafka": "kafka",
+    "bitnami/kafka": "kafka",
+    "docker.elastic.co/elasticsearch/elasticsearch": "elasticsearch",
+    "docker.elastic.co/kibana/kibana": "kibana",
+    "grafana/grafana": "grafana",
+    "grafana/grafana-oss": "grafana",
+    "prom/prometheus": "prometheus",
+    "quay.io/prometheus/prometheus": "prometheus",
+    "library/etcd": "etcd",
+    "etcd": "etcd",
+    "registry.k8s.io/etcd": "etcd",
+    "library/node": "node",
+    "library/python": "python",
+    "library/php": "php",
+    "library/ruby": "ruby",
+};
+export function lookupCatalog(repository, name) {
+    const keys = [repository.toLowerCase(), name.toLowerCase()];
+    for (const key of keys) {
+        const aliased = ALIASES[key];
+        if (aliased && PRODUCTS[aliased]) {
+            return { canonical: aliased, entry: PRODUCTS[aliased] };
+        }
+        if (PRODUCTS[key]) {
+            return { canonical: key, entry: PRODUCTS[key] };
+        }
+    }
+    return null;
+}
+export function lookupChart(chartName) {
+    const key = chartName.toLowerCase();
+    const aliased = ALIASES[key];
+    if (aliased && PRODUCTS[aliased]) {
+        return { canonical: aliased, entry: PRODUCTS[aliased] };
+    }
+    if (PRODUCTS[key]) {
+        return { canonical: key, entry: PRODUCTS[key] };
+    }
+    return null;
+}

package/dist/detector/catalog.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/detector/catalog.test.js

@@ -0,0 +1,33 @@
+import { describe, it, expect } from "vitest";
+import { lookupCatalog, lookupChart } from "./catalog.js";
+describe("lookupCatalog", () => {
+    it("matches bare image names from the products map", () => {
+        const m = lookupCatalog("library/postgres", "postgres");
+        expect(m?.canonical).toBe("postgres");
+        expect(m?.entry.display).toBe("PostgreSQL");
+    });
+    it("resolves aliases for bitnami charts", () => {
+        const m = lookupCatalog("bitnami/postgresql", "postgresql");
+        expect(m?.canonical).toBe("postgres");
+    });
+    it("resolves quay.io prometheus", () => {
+        const m = lookupCatalog("prometheus/prometheus", "prometheus");
+        expect(m?.canonical).toBe("prometheus");
+    });
+    it("handles case-insensitive lookups", () => {
+        const m = lookupCatalog("Library/PostgreSQL", "PostgreSQL");
+        expect(m?.canonical).toBe("postgres");
+    });
+    it("returns null for unknown repositories", () => {
+        expect(lookupCatalog("acme/internal-app", "internal-app")).toBeNull();
+    });
+});
+describe("lookupChart", () => {
+    it("matches chart names to canonical products", () => {
+        expect(lookupChart("postgresql")?.canonical).toBe("postgres");
+        expect(lookupChart("redis")?.canonical).toBe("redis");
+    });
+    it("returns null for unknown charts", () => {
+        expect(lookupChart("unknown-chart")).toBeNull();
+    });
+});

package/dist/detector/eol.d.ts

@@ -0,0 +1,13 @@
+export interface EolStatus {
+    product: string;
+    cycle: string;
+    eol: boolean;
+    eolDate?: string;
+    latest?: string;
+    releaseDate?: string;
+    lts: boolean;
+}
+export declare function queryEol(product: string, version: string, opts?: {
+    noCache?: boolean;
+    timeoutMs?: number;
+}): Promise<EolStatus | null>;

package/dist/detector/eol.js

@@ -0,0 +1,64 @@
+import { readCache, readStaleCache, writeCache } from "./cache.js";
+import { major, majorMinor } from "./image-parser.js";
+function pickCycle(cycles, version) {
+    const mm = majorMinor(version);
+    const m = major(version);
+    return (cycles.find((c) => c.cycle === version) ??
+        cycles.find((c) => c.cycle === mm) ??
+        cycles.find((c) => c.cycle === m) ??
+        null);
+}
+function interpretCycle(product, cycle) {
+    let eol = false;
+    let eolDate;
+    if (typeof cycle.eol === "string") {
+        eolDate = cycle.eol;
+        eol = new Date(cycle.eol).getTime() < Date.now();
+    }
+    else if (cycle.eol === true) {
+        eol = true;
+    }
+    return {
+        product,
+        cycle: cycle.cycle,
+        eol,
+        eolDate,
+        latest: cycle.latest,
+        releaseDate: cycle.releaseDate,
+        lts: cycle.lts === true || (typeof cycle.lts === "string" && cycle.lts.length > 0),
+    };
+}
+export async function queryEol(product, version, opts = {}) {
+    if (!version)
+        return null;
+    if (!opts.noCache) {
+        const cached = readCache("eol", product);
+        if (cached) {
+            const cycle = pickCycle(cached, version);
+            return cycle ? interpretCycle(product, cycle) : null;
+        }
+    }
+    try {
+        const res = await fetch(`https://endoflife.date/api/${product}.json`, {
+            signal: AbortSignal.timeout(opts.timeoutMs ?? 8000),
+        });
+        if (!res.ok) {
+            const stale = readStaleCache("eol", product);
+            if (!stale)
+                return null;
+            const cycle = pickCycle(stale.data, version);
+            return cycle ? interpretCycle(product, cycle) : null;
+        }
+        const data = (await res.json());
+        writeCache("eol", product, data);
+        const cycle = pickCycle(data, version);
+        return cycle ? interpretCycle(product, cycle) : null;
+    }
+    catch {
+        const stale = readStaleCache("eol", product);
+        if (!stale)
+            return null;
+        const cycle = pickCycle(stale.data, version);
+        return cycle ? interpretCycle(product, cycle) : null;
+    }
+}

package/dist/detector/eol.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/detector/eol.test.js

@@ -0,0 +1,78 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+vi.mock("./cache.js", () => ({
+    readCache: vi.fn(),
+    readStaleCache: vi.fn(),
+    writeCache: vi.fn(),
+}));
+import { readCache, readStaleCache, writeCache } from "./cache.js";
+import { queryEol } from "./eol.js";
+const mockFetch = vi.fn();
+vi.stubGlobal("fetch", mockFetch);
+const cacheRead = vi.mocked(readCache);
+const cacheStale = vi.mocked(readStaleCache);
+const cacheWrite = vi.mocked(writeCache);
+const POSTGRES_FIXTURE = [
+    { cycle: "16", releaseDate: "2023-09-14", eol: "2028-11-09", latest: "16.2", lts: false },
+    { cycle: "15", releaseDate: "2022-10-13", eol: "2027-11-11", latest: "15.6", lts: false },
+    { cycle: "11", releaseDate: "2018-10-18", eol: "2023-11-09", latest: "11.22", lts: false },
+];
+describe("queryEol", () => {
+    beforeEach(() => {
+        mockFetch.mockReset();
+        cacheRead.mockReset();
+        cacheStale.mockReset();
+        cacheWrite.mockReset();
+        cacheRead.mockReturnValue(null);
+        cacheStale.mockReturnValue(null);
+    });
+    it("hits endoflife.date and picks the matching cycle by major version", async () => {
+        mockFetch.mockResolvedValue({ ok: true, json: async () => POSTGRES_FIXTURE });
+        const status = await queryEol("postgres", "15.2", { noCache: true });
+        expect(mockFetch.mock.calls[0][0]).toBe("https://endoflife.date/api/postgres.json");
+        expect(status).toMatchObject({
+            product: "postgres",
+            cycle: "15",
+            eol: false,
+            eolDate: "2027-11-11",
+            latest: "15.6",
+        });
+        expect(cacheWrite).toHaveBeenCalledOnce();
+    });
+    it("flags a cycle as EOL when its date is in the past", async () => {
+        mockFetch.mockResolvedValue({ ok: true, json: async () => POSTGRES_FIXTURE });
+        const status = await queryEol("postgres", "11.18", { noCache: true });
+        expect(status?.cycle).toBe("11");
+        expect(status?.eol).toBe(true);
+        expect(status?.eolDate).toBe("2023-11-09");
+    });
+    it("returns null when no cycle matches", async () => {
+        mockFetch.mockResolvedValue({ ok: true, json: async () => POSTGRES_FIXTURE });
+        const status = await queryEol("postgres", "99.0", { noCache: true });
+        expect(status).toBeNull();
+    });
+    it("returns null on network error with no cache", async () => {
+        mockFetch.mockRejectedValue(new Error("network down"));
+        const status = await queryEol("postgres", "15.2", { noCache: true });
+        expect(status).toBeNull();
+    });
+    it("serves a fresh cached entry without hitting the network", async () => {
+        cacheRead.mockReturnValue(POSTGRES_FIXTURE);
+        const status = await queryEol("postgres", "15.2");
+        expect(mockFetch).not.toHaveBeenCalled();
+        expect(status?.cycle).toBe("15");
+    });
+    it("falls back to stale cache on network error", async () => {
+        cacheStale.mockReturnValue({ data: POSTGRES_FIXTURE, fetchedAt: 1 });
+        mockFetch.mockRejectedValue(new Error("offline"));
+        const status = await queryEol("postgres", "11.18", { noCache: true });
+        expect(status?.eol).toBe(true);
+    });
+    it("treats eol: true as EOL regardless of date", async () => {
+        mockFetch.mockResolvedValue({
+            ok: true,
+            json: async () => [{ cycle: "1.0", eol: true, latest: "1.0.5" }],
+        });
+        const status = await queryEol("oldthing", "1.0", { noCache: true });
+        expect(status?.eol).toBe(true);
+    });
+});

package/dist/detector/image-parser.d.ts

@@ -0,0 +1,11 @@
+export interface ParsedImage {
+    registry: string;
+    repository: string;
+    name: string;
+    tag: string;
+    digest?: string;
+}
+export declare function parseImage(image: string): ParsedImage;
+export declare function normalizeVersion(tag: string): string;
+export declare function majorMinor(version: string): string;
+export declare function major(version: string): string;

package/dist/detector/image-parser.js

@@ -0,0 +1,59 @@
+const DOCKER_HUB = "docker.io";
+export function parseImage(image) {
+    const trimmed = image.trim();
+    let refPart = trimmed;
+    let digest;
+    const atIdx = trimmed.indexOf("@");
+    if (atIdx >= 0) {
+        digest = trimmed.slice(atIdx + 1);
+        refPart = trimmed.slice(0, atIdx);
+    }
+    const firstSlash = refPart.indexOf("/");
+    let registry = DOCKER_HUB;
+    let path = refPart;
+    if (firstSlash > 0) {
+        const maybeHost = refPart.slice(0, firstSlash);
+        if (maybeHost === "localhost" ||
+            maybeHost.includes(".") ||
+            maybeHost.includes(":")) {
+            registry = maybeHost;
+            path = refPart.slice(firstSlash + 1);
+        }
+    }
+    const lastSlash = path.lastIndexOf("/");
+    const tagIdx = path.indexOf(":", lastSlash + 1);
+    let tag;
+    let repository;
+    if (tagIdx >= 0) {
+        tag = path.slice(tagIdx + 1);
+        repository = path.slice(0, tagIdx);
+    }
+    else {
+        repository = path;
+        tag = digest ? "" : "latest";
+    }
+    if (registry === DOCKER_HUB && !repository.includes("/")) {
+        repository = `library/${repository}`;
+    }
+    const name = repository.split("/").pop() ?? repository;
+    return { registry, repository, name, tag, digest };
+}
+const SEMVER_PREFIX_RE = /^v(?=\d)/;
+export function normalizeVersion(tag) {
+    if (!tag || tag === "latest" || tag === "stable")
+        return "";
+    const dashIdx = tag.indexOf("-");
+    const core = dashIdx >= 0 ? tag.slice(0, dashIdx) : tag;
+    return core.replace(SEMVER_PREFIX_RE, "");
+}
+export function majorMinor(version) {
+    const parts = version.split(".");
+    if (parts.length === 0)
+        return version;
+    if (parts.length === 1)
+        return parts[0];
+    return `${parts[0]}.${parts[1]}`;
+}
+export function major(version) {
+    return version.split(".")[0] ?? version;
+}

package/dist/detector/image-parser.test.d.ts

@@ -0,0 +1 @@
+export {};