pnpm-audit-hook 1.0.0

package/dist/utils/output-formatter.js

@@ -0,0 +1,286 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSummary = buildSummary;
+exports.formatHumanReadable = formatHumanReadable;
+exports.formatAzureDevOps = formatAzureDevOps;
+exports.formatJson = formatJson;
+exports.getOutputFormat = getOutputFormat;
+exports.outputResults = outputResults;
+function buildSummary(totalPackages, findings, decisions, sourceStatus) {
+    const packagesWithFindings = new Set(findings.map((f) => `${f.packageName}@${f.packageVersion}`));
+    const vulnerabilitiesBySeverity = {
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0,
+        unknown: 0,
+    };
+    for (const finding of findings) {
+        vulnerabilitiesBySeverity[finding.severity]++;
+    }
+    let blockedCount = 0;
+    let warnCount = 0;
+    let allowedCount = 0;
+    let allowlistedCount = 0;
+    for (const decision of decisions) {
+        switch (decision.action) {
+            case "block":
+                blockedCount++;
+                break;
+            case "warn":
+                warnCount++;
+                break;
+            case "allow":
+                if (decision.source === "allowlist") {
+                    allowlistedCount++;
+                }
+                else {
+                    allowedCount++;
+                }
+                break;
+        }
+    }
+    const totalDurationMs = Object.values(sourceStatus).reduce((sum, s) => sum + (s.durationMs ?? 0), 0);
+    return {
+        totalPackages,
+        scannedPackages: totalPackages,
+        safePackages: totalPackages - packagesWithFindings.size,
+        packagesWithVulnerabilities: packagesWithFindings.size,
+        vulnerabilitiesBySeverity,
+        blockedCount,
+        warnCount,
+        allowedCount,
+        allowlistedCount,
+        sourceStatus,
+        totalDurationMs,
+    };
+}
+const SEVERITY_ORDER = ["critical", "high", "medium", "low", "unknown"];
+function severityColor(severity) {
+    switch (severity) {
+        case "critical":
+            return "\x1b[31m"; // red
+        case "high":
+            return "\x1b[91m"; // bright red
+        case "medium":
+            return "\x1b[33m"; // yellow
+        case "low":
+            return "\x1b[36m"; // cyan
+        default:
+            return "\x1b[90m"; // gray
+    }
+}
+const RESET = "\x1b[0m";
+const BOLD = "\x1b[1m";
+const GREEN = "\x1b[32m";
+const RED = "\x1b[31m";
+const YELLOW = "\x1b[33m";
+function formatHumanReadable(data) {
+    const { summary, findings, decisions, blocked } = data;
+    const lines = [];
+    // Header banner
+    lines.push("");
+    lines.push(`${BOLD}===============================================${RESET}`);
+    lines.push(`${BOLD}           PNPM AUDIT SECURITY REPORT          ${RESET}`);
+    lines.push(`${BOLD}===============================================${RESET}`);
+    lines.push("");
+    // Source status group
+    lines.push(`${BOLD}Source Status:${RESET}`);
+    for (const [name, status] of Object.entries(summary.sourceStatus)) {
+        const icon = status.ok ? `${GREEN}OK${RESET}` : `${RED}FAILED${RESET}`;
+        const duration = status.durationMs ? ` (${status.durationMs}ms)` : "";
+        const error = status.error ? ` - ${status.error}` : "";
+        lines.push(`  ${name}: ${icon}${duration}${error}`);
+    }
+    lines.push("");
+    // Package summary
+    lines.push(`${BOLD}Package Summary:${RESET}`);
+    lines.push(`  Total packages scanned: ${summary.scannedPackages}`);
+    lines.push(`  Safe packages: ${GREEN}${summary.safePackages}${RESET}`);
+    lines.push(`  Packages with vulnerabilities: ${summary.packagesWithVulnerabilities > 0 ? RED : GREEN}${summary.packagesWithVulnerabilities}${RESET}`);
+    lines.push("");
+    // Vulnerability breakdown by severity
+    lines.push(`${BOLD}Vulnerabilities by Severity:${RESET}`);
+    for (const severity of SEVERITY_ORDER) {
+        const count = summary.vulnerabilitiesBySeverity[severity];
+        if (count > 0) {
+            lines.push(`  ${severityColor(severity)}${severity.toUpperCase()}${RESET}: ${count}`);
+        }
+    }
+    const totalVulns = Object.values(summary.vulnerabilitiesBySeverity).reduce((a, b) => a + b, 0);
+    if (totalVulns === 0) {
+        lines.push(`  ${GREEN}No vulnerabilities found${RESET}`);
+    }
+    lines.push("");
+    // Detailed vulnerability list
+    if (findings.length > 0) {
+        lines.push(`${BOLD}Vulnerability Details:${RESET}`);
+        for (const finding of findings) {
+            const color = severityColor(finding.severity);
+            lines.push(`  ${color}[${finding.severity.toUpperCase()}]${RESET} ${finding.id}`);
+            lines.push(`    Package: ${finding.packageName}@${finding.packageVersion}`);
+            if (finding.title) {
+                lines.push(`    Title: ${finding.title}`);
+            }
+            if (finding.url) {
+                lines.push(`    URL: ${finding.url}`);
+            }
+            if (finding.affectedRange) {
+                lines.push(`    Affected: ${finding.affectedRange}`);
+            }
+            if (finding.fixedVersion) {
+                lines.push(`    Fixed in: ${finding.fixedVersion}`);
+            }
+            lines.push("");
+        }
+    }
+    // Policy decision summary
+    lines.push(`${BOLD}Policy Decisions:${RESET}`);
+    lines.push(`  ${RED}Blocked${RESET}: ${summary.blockedCount}`);
+    lines.push(`  ${YELLOW}Warnings${RESET}: ${summary.warnCount}`);
+    lines.push(`  ${GREEN}Allowed${RESET}: ${summary.allowedCount}`);
+    lines.push(`  Allowlisted: ${summary.allowlistedCount}`);
+    lines.push("");
+    // Show blocked decisions
+    const blockedDecisions = decisions.filter((d) => d.action === "block");
+    if (blockedDecisions.length > 0) {
+        lines.push(`${BOLD}${RED}Blocked Items:${RESET}`);
+        for (const d of blockedDecisions) {
+            const pkg = d.packageName ? `${d.packageName}@${d.packageVersion}` : "";
+            const finding = d.findingId ? ` (${d.findingId})` : "";
+            lines.push(`  - ${pkg}${finding}: ${d.reason}`);
+        }
+        lines.push("");
+    }
+    // Final status line
+    lines.push(`${BOLD}===============================================${RESET}`);
+    if (blocked) {
+        lines.push(`${BOLD}${RED}AUDIT FAILED - Installation blocked${RESET}`);
+    }
+    else if (data.warnings) {
+        lines.push(`${BOLD}${YELLOW}AUDIT PASSED WITH WARNINGS${RESET}`);
+    }
+    else {
+        lines.push(`${BOLD}${GREEN}AUDIT PASSED - No issues found${RESET}`);
+    }
+    lines.push(`${BOLD}===============================================${RESET}`);
+    lines.push(`Total time: ${summary.totalDurationMs}ms`);
+    lines.push("");
+    return lines.join("\n");
+}
+function formatAzureDevOps(data) {
+    const { summary, findings, decisions, blocked } = data;
+    const lines = [];
+    // Source status group
+    lines.push("##[group]Source Status");
+    for (const [name, status] of Object.entries(summary.sourceStatus)) {
+        const icon = status.ok ? "OK" : "FAILED";
+        const duration = status.durationMs ? ` (${status.durationMs}ms)` : "";
+        const error = status.error ? ` - ${status.error}` : "";
+        if (!status.ok) {
+            lines.push(`##[warning]${name}: ${icon}${duration}${error}`);
+        }
+        else {
+            lines.push(`${name}: ${icon}${duration}${error}`);
+        }
+    }
+    lines.push("##[endgroup]");
+    // Package summary group
+    lines.push("##[group]Package Summary");
+    lines.push(`Total packages scanned: ${summary.scannedPackages}`);
+    lines.push(`Safe packages: ${summary.safePackages}`);
+    lines.push(`Packages with vulnerabilities: ${summary.packagesWithVulnerabilities}`);
+    lines.push("##[endgroup]");
+    // Vulnerability breakdown group
+    lines.push("##[group]Vulnerabilities by Severity");
+    for (const severity of SEVERITY_ORDER) {
+        const count = summary.vulnerabilitiesBySeverity[severity];
+        lines.push(`${severity.toUpperCase()}: ${count}`);
+    }
+    lines.push("##[endgroup]");
+    // Vulnerability details group
+    if (findings.length > 0) {
+        lines.push("##[group]Vulnerability Details");
+        for (const finding of findings) {
+            const msg = `[${finding.severity.toUpperCase()}] ${finding.id} in ${finding.packageName}@${finding.packageVersion}`;
+            if (finding.severity === "critical" || finding.severity === "high") {
+                lines.push(`##[error]${msg}`);
+            }
+            else {
+                lines.push(`##[warning]${msg}`);
+            }
+            if (finding.title) {
+                lines.push(`  Title: ${finding.title}`);
+            }
+            if (finding.url) {
+                lines.push(`  URL: ${finding.url}`);
+            }
+        }
+        lines.push("##[endgroup]");
+    }
+    // Policy decisions group
+    lines.push("##[group]Policy Decisions");
+    lines.push(`Blocked: ${summary.blockedCount}`);
+    lines.push(`Warnings: ${summary.warnCount}`);
+    lines.push(`Allowed: ${summary.allowedCount}`);
+    lines.push(`Allowlisted: ${summary.allowlistedCount}`);
+    const blockedDecisions = decisions.filter((d) => d.action === "block");
+    for (const d of blockedDecisions) {
+        const pkg = d.packageName ? `${d.packageName}@${d.packageVersion}` : "";
+        const finding = d.findingId ? ` (${d.findingId})` : "";
+        lines.push(`##[error]BLOCKED: ${pkg}${finding} - ${d.reason}`);
+    }
+    lines.push("##[endgroup]");
+    // Set pipeline variables
+    lines.push(`##vso[task.setvariable variable=AUDIT_BLOCKED]${blocked ? "true" : "false"}`);
+    lines.push(`##vso[task.setvariable variable=AUDIT_VULNERABILITY_COUNT]${findings.length}`);
+    lines.push(`##vso[task.setvariable variable=AUDIT_CRITICAL_COUNT]${summary.vulnerabilitiesBySeverity.critical}`);
+    lines.push(`##vso[task.setvariable variable=AUDIT_HIGH_COUNT]${summary.vulnerabilitiesBySeverity.high}`);
+    // Final status
+    if (blocked) {
+        lines.push("##[error]AUDIT FAILED - Installation blocked");
+    }
+    else if (data.warnings) {
+        lines.push("##[warning]AUDIT PASSED WITH WARNINGS");
+    }
+    else {
+        lines.push("AUDIT PASSED - No issues found");
+    }
+    lines.push(`Total time: ${summary.totalDurationMs}ms`);
+    return lines.join("\n");
+}
+function formatJson(data) {
+    return JSON.stringify({
+        summary: data.summary,
+        findings: data.findings,
+        decisions: data.decisions,
+        blocked: data.blocked,
+        warnings: data.warnings,
+        exitCode: data.exitCode,
+    }, null, 2);
+}
+function getOutputFormat(env) {
+    if (env.PNPM_AUDIT_JSON === "true") {
+        return "json";
+    }
+    if (env.PNPM_AUDIT_FORMAT === "azure" || env.TF_BUILD === "True") {
+        return "azure";
+    }
+    return "human";
+}
+function outputResults(data, env) {
+    const format = getOutputFormat(env);
+    let output;
+    switch (format) {
+        case "json":
+            output = formatJson(data);
+            break;
+        case "azure":
+            output = formatAzureDevOps(data);
+            break;
+        default:
+            output = formatHumanReadable(data);
+    }
+    console.log(output);
+}
+//# sourceMappingURL=output-formatter.js.map

package/dist/utils/output-formatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-formatter.js","sourceRoot":"","sources":["../../src/utils/output-formatter.ts"],"names":[],"mappings":";;AA8BA,oCA+DC;AAyBD,kDAwGC;AAED,8CA8FC;AAED,gCAaC;AAID,0CAQC;AAED,sCAmBC;AAhVD,SAAgB,YAAY,CAC1B,aAAqB,EACrB,QAAgC,EAChC,SAA2B,EAC3B,YAA0C;IAE1C,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,CAC5D,CAAC;IAEF,MAAM,yBAAyB,GAA6B;QAC1D,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,OAAO,EAAE,CAAC;KACX,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,yBAAyB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IAEzB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxB,KAAK,OAAO;gBACV,YAAY,EAAE,CAAC;gBACf,MAAM;YACR,KAAK,MAAM;gBACT,SAAS,EAAE,CAAC;gBACZ,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBACpC,gBAAgB,EAAE,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,YAAY,EAAE,CAAC;gBACjB,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CACxD,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,EACrC,CAAC,CACF,CAAC;IAEF,OAAO;QACL,aAAa;QACb,eAAe,EAAE,aAAa;QAC9B,YAAY,EAAE,aAAa,GAAG,oBAAoB,CAAC,IAAI;QACvD,2BAA2B,EAAE,oBAAoB,CAAC,IAAI;QACtD,yBAAyB;QACzB,YAAY;QACZ,SAAS;QACT,YAAY;QACZ,gBAAgB;QAChB,YAAY;QACZ,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAEpF,SAAS,aAAa,CAAC,QAAkB;IACvC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC,CAAC,MAAM;QAC3B,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,CAAC,aAAa;QAClC,KAAK,QAAQ;YACX,OAAO,UAAU,CAAC,CAAC,SAAS;QAC9B,KAAK,KAAK;YACR,OAAO,UAAU,CAAC,CAAC,OAAO;QAC5B;YACE,OAAO,UAAU,CAAC,CAAC,OAAO;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,SAAS,CAAC;AACxB,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,KAAK,GAAG,UAAU,CAAC;AACzB,MAAM,GAAG,GAAG,UAAU,CAAC;AACvB,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,SAAgB,mBAAmB,CAAC,IAAqB;IACvD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,gBAAgB;IAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sBAAsB;IACtB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,KAAK,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,GAAG,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,kBAAkB;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,6BAA6B,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,GAAG,OAAO,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CACR,oCAAoC,OAAO,CAAC,2BAA2B,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,2BAA2B,GAAG,KAAK,EAAE,CAC1I,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sCAAsC;IACtC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,KAAK,EAAE,CAAC,CAAC;IAC1D,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,MAAM,CACxE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EACf,CAAC,CACF,CAAC;IACF,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,8BAA8B;IAC9B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,yBAAyB,KAAK,EAAE,CAAC,CAAC;QACpD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,KAAK,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YAC5E,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,KAAK,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,UAAU,KAAK,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,WAAW,KAAK,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,KAAK,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACzD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,yBAAyB;IACzB,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IACvE,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,GAAG,iBAAiB,KAAK,EAAE,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,OAAO,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,oBAAoB;IACpB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC,CAAC;IAC7E,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,GAAG,sCAAsC,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,MAAM,6BAA6B,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,iCAAiC,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,kDAAkD,KAAK,EAAE,CAAC,CAAC;IAC7E,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,iBAAiB,CAAC,IAAqB;IACrD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,sBAAsB;IACtB,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,KAAK,IAAI,GAAG,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE3B,wBAAwB;IACxB,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,2BAA2B,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,kCAAkC,OAAO,CAAC,2BAA2B,EAAE,CAAC,CAAC;IACpF,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE3B,gCAAgC;IAChC,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IACnD,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE3B,8BAA8B;IAC9B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,EAAE,OAAO,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACpH,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACnE,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEvD,MAAM,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,qBAAqB,GAAG,GAAG,OAAO,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE3B,yBAAyB;IACzB,KAAK,CAAC,IAAI,CACR,iDAAiD,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAC9E,CAAC;IACF,KAAK,CAAC,IAAI,CACR,6DAA6D,QAAQ,CAAC,MAAM,EAAE,CAC/E,CAAC;IACF,KAAK,CAAC,IAAI,CACR,wDAAwD,OAAO,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CACrG,CAAC;IACF,KAAK,CAAC,IAAI,CACR,oDAAoD,OAAO,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAC7F,CAAC;IAEF,eAAe;IACf,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC7D,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;IAEvD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAgB,UAAU,CAAC,IAAqB;IAC9C,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAID,SAAgB,eAAe,CAAC,GAAuC;IACrE,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,aAAa,CAC3B,IAAqB,EACrB,GAAuC;IAEvC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,MAAc,CAAC;IACnB,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM;QACR,KAAK,OAAO;YACV,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM;QACR;YACE,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC"}

package/dist/utils/semver.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Safe semver.satisfies wrapper - returns true on invalid versions or ranges
+ * (fail-closed for security).
+ */
+export declare function satisfies(version: string, range: string): boolean;
+/**
+ * Strict semver.satisfies wrapper - returns false on invalid versions or ranges.
+ * Useful for allowlist matching, where we don't want to allow on ambiguity.
+ */
+export declare function satisfiesStrict(version: string, range: string): boolean;
+/** OSV affected range evaluation (SEMVER type). Returns true if version is within any [introduced, fixed) interval. */
+export declare function isVersionAffectedByOsvSemverRange(version: string, events: Array<{
+    introduced?: string;
+    fixed?: string;
+    last_affected?: string;
+}>): boolean;
+/** Builds a best-effort purl for npm packages. */
+export declare function npmPurl(name: string, version?: string): string;
+//# sourceMappingURL=semver.d.ts.map

package/dist/utils/semver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.d.ts","sourceRoot":"","sources":["../../src/utils/semver.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAgBjE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAcvE;AAOD,uHAAuH;AACvH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,KAAK,CAAC;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7E,OAAO,CAuBT;AAED,kDAAkD;AAClD,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAO9D"}

package/dist/utils/semver.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.satisfies = satisfies;
+exports.satisfiesStrict = satisfiesStrict;
+exports.isVersionAffectedByOsvSemverRange = isVersionAffectedByOsvSemverRange;
+exports.npmPurl = npmPurl;
+const semver_1 = __importDefault(require("semver"));
+const logger_1 = require("./logger");
+const error_1 = require("./error");
+const normalizeRange = (range) => range.replace(/,\s*/g, " ");
+/**
+ * Safe semver.satisfies wrapper - returns true on invalid versions or ranges
+ * (fail-closed for security).
+ */
+function satisfies(version, range) {
+    const v = semver_1.default.valid(version);
+    if (!v)
+        return true;
+    // Normalize GitHub Advisory's comma-separated ranges to space-separated
+    // GitHub returns: ">= 1.0.0, < 1.2.6" but semver expects ">=1.0.0 <1.2.6"
+    const normalizedRange = normalizeRange(range);
+    try {
+        return semver_1.default.satisfies(v, normalizedRange, { includePrerelease: true });
+    }
+    catch (e) {
+        logger_1.logger.warn(`Invalid semver range "${range}" for version "${v}", treating as potentially affected (fail-closed): ${(0, error_1.errorMessage)(e)}`);
+        return true;
+    }
+}
+/**
+ * Strict semver.satisfies wrapper - returns false on invalid versions or ranges.
+ * Useful for allowlist matching, where we don't want to allow on ambiguity.
+ */
+function satisfiesStrict(version, range) {
+    const v = semver_1.default.valid(version);
+    if (!v)
+        return false;
+    const normalizedRange = normalizeRange(range);
+    try {
+        return semver_1.default.satisfies(v, normalizedRange, { includePrerelease: true });
+    }
+    catch (e) {
+        logger_1.logger.warn(`Invalid semver range "${range}" for version "${v}", treating as non-matching (strict): ${(0, error_1.errorMessage)(e)}`);
+        return false;
+    }
+}
+const cmp = (fn) => (a, b) => !!(semver_1.default.valid(a) && semver_1.default.valid(b) && fn(a, b));
+const lt = cmp(semver_1.default.lt), lte = cmp(semver_1.default.lte), gte = cmp(semver_1.default.gte);
+/** OSV affected range evaluation (SEMVER type). Returns true if version is within any [introduced, fixed) interval. */
+function isVersionAffectedByOsvSemverRange(version, events) {
+    const v = semver_1.default.valid(version);
+    if (!v)
+        return false;
+    const normalize = (s) => (s === "0" ? "0.0.0" : s);
+    let intro = null;
+    for (const ev of events) {
+        if (ev.introduced !== undefined) {
+            intro = normalize(ev.introduced);
+        }
+        if (ev.fixed !== undefined && intro && gte(v, intro) && lt(v, ev.fixed)) {
+            return true;
+        }
+        if (ev.last_affected !== undefined && intro && gte(v, intro) && lte(v, ev.last_affected)) {
+            return true;
+        }
+        if (ev.fixed !== undefined || ev.last_affected !== undefined) {
+            intro = null;
+        }
+    }
+    return intro !== null && gte(v, intro);
+}
+/** Builds a best-effort purl for npm packages. */
+function npmPurl(name, version) {
+    const suffix = version ? `@${encodeURIComponent(version)}` : "";
+    if (name.startsWith("@")) {
+        const [scope, pkg = ""] = name.split("/");
+        return `pkg:npm/${encodeURIComponent(scope)}/${encodeURIComponent(pkg)}${suffix}`;
+    }
+    return `pkg:npm/${encodeURIComponent(name)}${suffix}`;
+}
+//# sourceMappingURL=semver.js.map

package/dist/utils/semver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.js","sourceRoot":"","sources":["../../src/utils/semver.ts"],"names":[],"mappings":";;;;;AAUA,8BAgBC;AAMD,0CAcC;AAQD,8EA0BC;AAGD,0BAOC;AA1FD,oDAA4B;AAC5B,qCAAkC;AAClC,mCAAuC;AAEvC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAEtE;;;GAGG;AACH,SAAgB,SAAS,CAAC,OAAe,EAAE,KAAa;IACtD,MAAM,CAAC,GAAG,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpB,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAE9C,IAAI,CAAC;QACH,OAAO,gBAAM,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,eAAM,CAAC,IAAI,CACT,yBAAyB,KAAK,kBAAkB,CAAC,sDAAsD,IAAA,oBAAY,EAAC,CAAC,CAAC,EAAE,CACzH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,OAAe,EAAE,KAAa;IAC5D,MAAM,CAAC,GAAG,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAErB,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAE9C,IAAI,CAAC;QACH,OAAO,gBAAM,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,eAAM,CAAC,IAAI,CACT,yBAAyB,KAAK,kBAAkB,CAAC,yCAAyC,IAAA,oBAAY,EAAC,CAAC,CAAC,EAAE,CAC5G,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,EAAoB,EAAE,EAAE,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAC7D,CAAC,CAAC,CAAC,gBAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,gBAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAErD,MAAM,EAAE,GAAG,GAAG,CAAC,gBAAM,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,gBAAM,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,gBAAM,CAAC,GAAG,CAAC,CAAC;AAExE,uHAAuH;AACvH,SAAgB,iCAAiC,CAC/C,OAAe,EACf,MAA8E;IAE9E,MAAM,CAAC,GAAG,gBAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAErB,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,GAAkB,IAAI,CAAC;IAEhC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChC,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,EAAE,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;YACzF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC7D,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,kDAAkD;AAClD,SAAgB,OAAO,CAAC,IAAY,EAAE,OAAgB;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,EAAE,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,WAAW,kBAAkB,CAAC,KAAM,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,WAAW,kBAAkB,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;AACxD,CAAC"}

package/dist/utils/severity.d.ts

@@ -0,0 +1,7 @@
+import type { Severity } from "../types";
+/** Map a string severity to canonical Severity type (handles 'moderate' -> 'medium'). */
+export declare const mapSeverity: (sev: string | undefined) => Severity;
+/** Severity ranking for comparison (higher = more severe). */
+export declare const SEVERITY_RANK: Record<Severity, number>;
+export declare const severityRank: (s: Severity) => number;
+//# sourceMappingURL=severity.d.ts.map

package/dist/utils/severity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity.d.ts","sourceRoot":"","sources":["../../src/utils/severity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAMzC,yFAAyF;AACzF,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,QACL,CAAC;AAElD,8DAA8D;AAC9D,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAA2D,CAAC;AAE/G,eAAO,MAAM,YAAY,GAAI,GAAG,QAAQ,WAA0B,CAAC"}

package/dist/utils/severity.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.severityRank = exports.SEVERITY_RANK = exports.mapSeverity = void 0;
+const SEV_MAP = {
+    critical: "critical", high: "high", medium: "medium", moderate: "medium", low: "low",
+};
+/** Map a string severity to canonical Severity type (handles 'moderate' -> 'medium'). */
+const mapSeverity = (sev) => SEV_MAP[(sev ?? "").toLowerCase()] ?? "unknown";
+exports.mapSeverity = mapSeverity;
+/** Severity ranking for comparison (higher = more severe). */
+exports.SEVERITY_RANK = { critical: 4, high: 3, medium: 2, low: 1, unknown: 0 };
+const severityRank = (s) => exports.SEVERITY_RANK[s] ?? 0;
+exports.severityRank = severityRank;
+//# sourceMappingURL=severity.js.map

package/dist/utils/severity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"severity.js","sourceRoot":"","sources":["../../src/utils/severity.ts"],"names":[],"mappings":";;;AAEA,MAAM,OAAO,GAA6B;IACxC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK;CACrF,CAAC;AAEF,yFAAyF;AAClF,MAAM,WAAW,GAAG,CAAC,GAAuB,EAAY,EAAE,CAC/D,OAAO,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,SAAS,CAAC;AADrC,QAAA,WAAW,eAC0B;AAElD,8DAA8D;AACjD,QAAA,aAAa,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAExG,MAAM,YAAY,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,qBAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAAtD,QAAA,YAAY,gBAA0C"}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "pnpm-audit-hook",
+  "version": "1.0.0",
+  "description": "pnpm hook that blocks vulnerable packages before download. Uses GitHub Advisory Database with offline static DB fallback.",
+  "license": "MIT",
+  "author": "asx8678",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/asx8678/pnpm-audit-hook.git"
+  },
+  "homepage": "https://github.com/asx8678/pnpm-audit-hook#readme",
+  "bugs": {
+    "url": "https://github.com/asx8678/pnpm-audit-hook/issues"
+  },
+  "keywords": [
+    "pnpm",
+    "security",
+    "audit",
+    "vulnerability",
+    "hook",
+    "pnpmfile",
+    "npm",
+    "dependencies",
+    "supply-chain",
+    "ghsa",
+    "cve"
+  ],
+  "type": "commonjs",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "pnpm-audit-setup": "bin/setup.js"
+  },
+  "files": [
+    "dist",
+    "bin",
+    ".pnpmfile.cjs",
+    ".pnpm-audit.yaml",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node scripts/copy-static-db.js && node scripts/bundle.js",
+    "test": "node --import tsx --test 'test/**/*.test.ts'",
+    "prepare": "npm run build",
+    "update-vuln-db": "tsx scripts/update-vuln-db.ts --since=2021-01-01",
+    "update-vuln-db:incremental": "tsx scripts/update-vuln-db.ts --incremental",
+    "update-vuln-db:full": "tsx scripts/update-vuln-db.ts"
+  },
+  "devDependencies": {
+    "@types/node": "^24.10.9",
+    "@types/semver": "^7.7.1",
+    "esbuild": "^0.27.2",
+    "semver": "^7.7.3",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
+    "yaml": "^2.8.2"
+  }
+}