v11y-check 0.0.0 → 0.7.0

package/dist/esm/run-audit.js

@@ -0,0 +1,166 @@
+import { spawnSync } from "node:child_process";
+import process from "node:process";
+function resolveAuditCiBin() {
+  try {
+    const resolved = import.meta.resolve("audit-ci");
+    const modulePath = new URL(resolved).pathname;
+    const pkgDir = modulePath.replace(/\/dist\/.*$/, "");
+    return `${pkgDir}/dist/bin.js`;
+  } catch {
+    return "audit-ci";
+  }
+}
+function parseAuditCiOutput(jsonString) {
+  const warnings = [];
+  let parsed;
+  try {
+    parsed = JSON.parse(jsonString);
+  } catch {
+    if (jsonString.trim().length > 0) {
+      warnings.push(`Failed to parse audit-ci output as JSON (${jsonString.length} bytes)`);
+    }
+    return { results: [], warnings };
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return { results: [], warnings };
+  }
+  const advisories = extractAdvisories(parsed);
+  const results = [];
+  for (const advisory of advisories) {
+    const paths = extractPaths(advisory);
+    const firstPath = paths[0] ?? advisory.module_name;
+    const result = {
+      id: String(advisory.id),
+      path: firstPath,
+      paths,
+      url: advisory.url
+    };
+    if (typeof advisory.github_advisory_id === "string") {
+      result.ghsaId = advisory.github_advisory_id;
+    }
+    if (typeof advisory.severity === "string") {
+      result.severity = advisory.severity;
+    }
+    if (typeof advisory.title === "string") {
+      result.title = advisory.title;
+    }
+    if (typeof advisory.overview === "string") {
+      result.description = advisory.overview;
+    }
+    if (advisory.cvss !== void 0) {
+      result.cvss = advisory.cvss;
+    }
+    results.push(result);
+  }
+  return { results, warnings };
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+function isAuditCiAdvisory(value) {
+  if (!isObject(value)) return false;
+  return "id" in value && "url" in value && "findings" in value;
+}
+function collectAdvisories(obj) {
+  if (!("advisories" in obj) || typeof obj.advisories !== "object" || obj.advisories === null) {
+    return [];
+  }
+  return Object.values(obj.advisories).filter(isAuditCiAdvisory);
+}
+function extractAdvisories(parsed) {
+  if (typeof parsed !== "object" || parsed === null) return [];
+  if ("advisories" in parsed) {
+    return collectAdvisories(parsed);
+  }
+  if (Array.isArray(parsed)) {
+    const advisories = [];
+    for (const item of parsed) {
+      if (isObject(item)) {
+        advisories.push(...collectAdvisories(item));
+      }
+    }
+    return advisories;
+  }
+  return [];
+}
+function extractPaths(advisory) {
+  const seen = /* @__PURE__ */ new Set();
+  const ordered = [];
+  for (const finding of advisory.findings) {
+    for (const pathValue of finding.paths) {
+      if (!seen.has(pathValue)) {
+        seen.add(pathValue);
+        ordered.push(pathValue);
+      }
+    }
+  }
+  return ordered;
+}
+function extractStaleEntries(jsonString) {
+  const warnings = [];
+  let parsed;
+  try {
+    parsed = JSON.parse(jsonString);
+  } catch {
+    if (jsonString.trim().length > 0) {
+      warnings.push(`Failed to parse audit-ci output as JSON for stale entry detection (${jsonString.length} bytes)`);
+    }
+    return { entries: [], warnings };
+  }
+  if (typeof parsed !== "object" || parsed === null) return { entries: [], warnings };
+  if (!("allowlistedAdvisoriesNotFound" in parsed)) return { entries: [], warnings };
+  const notFound = parsed.allowlistedAdvisoriesNotFound;
+  if (Array.isArray(notFound)) {
+    return { entries: notFound.filter((item) => typeof item === "string"), warnings };
+  }
+  return { entries: [], warnings };
+}
+function runAudit({ configPath, cwd, json }) {
+  const bin = resolveAuditCiBin();
+  const outputFormat = json ? "json" : "text";
+  const args = ["--config", configPath, "--output-format", outputFormat];
+  const result = spawnSync(process.execPath, [bin, ...args], {
+    cwd: cwd ?? process.cwd(),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.error) {
+    throw new Error(`Failed to launch audit-ci: ${result.error.message}`);
+  }
+  const stdout = result.stdout;
+  const stderr = result.stderr;
+  const staleResult = json ? extractStaleEntries(stdout) : { entries: [], warnings: [] };
+  return {
+    exitCode: result.status ?? 1,
+    staleEntries: staleResult.entries,
+    stdout,
+    stderr,
+    warnings: staleResult.warnings
+  };
+}
+function runReport({ configPath, cwd, reportType }) {
+  const bin = resolveAuditCiBin();
+  const args = ["--config", configPath, "--output-format", "json"];
+  if (reportType === "full") {
+    args.push("--report-type", "full");
+  }
+  const result = spawnSync(process.execPath, [bin, ...args], {
+    cwd: cwd ?? process.cwd(),
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.error) {
+    throw new Error(`Failed to launch audit-ci: ${result.error.message}`);
+  }
+  const stdout = result.stdout;
+  const stderr = result.stderr;
+  const parseResult = parseAuditCiOutput(stdout);
+  return { results: parseResult.results, stdout, stderr, warnings: parseResult.warnings };
+}
+export {
+  extractStaleEntries,
+  parseAuditCiOutput,
+  resolveAuditCiBin,
+  runAudit,
+  runReport
+};

package/dist/esm/sync.d.ts

@@ -0,0 +1,20 @@
+import type { AllowlistEntry, AuditResult, AuditScope, V11yCheckConfig } from './types.ts';
+export declare function formatUtcDatetime(date: Date): string;
+export declare function formatFriendlyUtc(date: Date): string;
+export interface SyncResult {
+    added: AllowlistEntry[];
+    kept: AllowlistEntry[];
+    removed: AllowlistEntry[];
+    scope: AuditScope;
+}
+export declare function computeSyncDiff(currentAllowlist: AllowlistEntry[], auditResults: AuditResult[], date?: Date): {
+    added: AllowlistEntry[];
+    kept: AllowlistEntry[];
+    removed: AllowlistEntry[];
+};
+export declare function buildUpdatedConfig(config: V11yCheckConfig, scope: AuditScope, newAllowlist: AllowlistEntry[]): V11yCheckConfig;
+export declare function serializeConfig(config: V11yCheckConfig): string;
+export declare function syncAllowlist(config: V11yCheckConfig, scope: AuditScope, auditResults: AuditResult[], configFilePath: string, date?: Date): Promise<{
+    syncResult: SyncResult;
+    updatedConfig: V11yCheckConfig;
+}>;

package/dist/esm/sync.js

@@ -0,0 +1,95 @@
+import { writeFile } from "node:fs/promises";
+function formatUtcDatetime(date) {
+  return date.toISOString();
+}
+function formatFriendlyUtc(date) {
+  const iso = date.toISOString();
+  return iso.slice(0, 10) + " " + iso.slice(11, 19) + " UTC";
+}
+function serializeEntry(entry) {
+  return {
+    ...entry.addedAt !== void 0 && { addedAt: entry.addedAt },
+    id: entry.id,
+    path: entry.path,
+    ...entry.reason !== void 0 && { reason: entry.reason },
+    url: entry.url
+  };
+}
+function serializeScopeConfig(scopeConfig) {
+  const result = {};
+  if (scopeConfig.severityThreshold !== void 0) {
+    result.severityThreshold = scopeConfig.severityThreshold;
+  }
+  result.allowlist = scopeConfig.allowlist.map(serializeEntry);
+  return result;
+}
+function computeSyncDiff(currentAllowlist, auditResults, date) {
+  const now = date ?? /* @__PURE__ */ new Date();
+  const currentById = new Map(currentAllowlist.map((entry) => [entry.id, entry]));
+  const auditById = new Map(auditResults.map((result) => [result.id, result]));
+  const added = [];
+  const kept = [];
+  const removed = [];
+  const nowIso = formatUtcDatetime(now);
+  for (const [id, result] of auditById) {
+    const existing = currentById.get(id);
+    if (existing !== void 0) {
+      kept.push(existing);
+    } else {
+      added.push({
+        addedAt: nowIso,
+        id: result.id,
+        path: result.path,
+        reason: `Added by v11y sync at ${formatFriendlyUtc(now)}`,
+        url: result.url
+      });
+    }
+  }
+  for (const [id, entry] of currentById) {
+    if (!auditById.has(id)) {
+      removed.push(entry);
+    }
+  }
+  return { added, kept, removed };
+}
+function buildUpdatedConfig(config, scope, newAllowlist) {
+  const sorted = [...newAllowlist].sort((a, b) => a.id.localeCompare(b.id));
+  return {
+    ...config,
+    [scope]: {
+      ...config[scope],
+      allowlist: sorted
+    }
+  };
+}
+function serializeConfig(config) {
+  const serializable = {};
+  if (config.$schema !== void 0) {
+    serializable.$schema = config.$schema;
+  }
+  serializable.dev = serializeScopeConfig(config.dev);
+  serializable.prod = serializeScopeConfig(config.prod);
+  return JSON.stringify(serializable, null, 2) + "\n";
+}
+async function syncAllowlist(config, scope, auditResults, configFilePath, date) {
+  const { added, kept, removed } = computeSyncDiff(config[scope].allowlist, auditResults, date);
+  const updatedConfig = buildUpdatedConfig(config, scope, [...kept, ...added]);
+  try {
+    await writeFile(configFilePath, serializeConfig(updatedConfig), "utf8");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Failed to write config file '${configFilePath}': ${message}`);
+  }
+  return {
+    syncResult: { added, kept, removed, scope },
+    updatedConfig
+  };
+}
+export {
+  buildUpdatedConfig,
+  computeSyncDiff,
+  formatFriendlyUtc,
+  formatUtcDatetime,
+  serializeConfig,
+  syncAllowlist
+};

package/dist/esm/tmp.d.ts

@@ -0,0 +1 @@
+export declare function withTempDir<T>(fn: (tempDir: string) => Promise<T>): Promise<T>;

package/dist/esm/tmp.js

@@ -0,0 +1,14 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+async function withTempDir(fn) {
+  const dir = await mkdtemp(path.join(tmpdir(), "v11y-check-"));
+  try {
+    return await fn(dir);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+export {
+  withTempDir
+};

package/dist/esm/types.d.ts

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+export type AuditScope = 'dev' | 'prod';
+export declare const AUDIT_SCOPES: readonly AuditScope[];
+export declare const SEVERITY_THRESHOLDS: readonly ["low", "moderate", "high", "critical"];
+export type SeverityThreshold = (typeof SEVERITY_THRESHOLDS)[number];
+export interface AllowlistEntry {
+    addedAt?: string | undefined;
+    id: string;
+    path: string;
+    reason?: string | undefined;
+    url: string;
+}
+export declare const allowlistEntrySchema: z.ZodObject<{
+    addedAt: z.ZodOptional<z.ZodString>;
+    id: z.ZodString;
+    path: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+    url: z.ZodString;
+}, z.core.$strip>;
+export interface ScopeConfig {
+    allowlist: AllowlistEntry[];
+    severityThreshold?: SeverityThreshold | undefined;
+}
+export declare const scopeConfigSchema: z.ZodObject<{
+    allowlist: z.ZodArray<z.ZodObject<{
+        addedAt: z.ZodOptional<z.ZodString>;
+        id: z.ZodString;
+        path: z.ZodString;
+        reason: z.ZodOptional<z.ZodString>;
+        url: z.ZodString;
+    }, z.core.$strip>>;
+    severityThreshold: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        moderate: "moderate";
+        high: "high";
+        critical: "critical";
+    }>>;
+}, z.core.$strict>;
+export interface V11yCheckConfig {
+    $schema?: string | undefined;
+    dev: ScopeConfig;
+    prod: ScopeConfig;
+}
+export declare const v11yCheckConfigSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    dev: z.ZodObject<{
+        allowlist: z.ZodArray<z.ZodObject<{
+            addedAt: z.ZodOptional<z.ZodString>;
+            id: z.ZodString;
+            path: z.ZodString;
+            reason: z.ZodOptional<z.ZodString>;
+            url: z.ZodString;
+        }, z.core.$strip>>;
+        severityThreshold: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            moderate: "moderate";
+            high: "high";
+            critical: "critical";
+        }>>;
+    }, z.core.$strict>;
+    prod: z.ZodObject<{
+        allowlist: z.ZodArray<z.ZodObject<{
+            addedAt: z.ZodOptional<z.ZodString>;
+            id: z.ZodString;
+            path: z.ZodString;
+            reason: z.ZodOptional<z.ZodString>;
+            url: z.ZodString;
+        }, z.core.$strip>>;
+        severityThreshold: z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            moderate: "moderate";
+            high: "high";
+            critical: "critical";
+        }>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const DEFAULT_CONFIG: V11yCheckConfig;
+export interface AuditResult {
+    cvss?: {
+        score?: number;
+        vectorString?: string;
+    } | undefined;
+    description?: string | undefined;
+    ghsaId?: string | undefined;
+    id: string;
+    path: string;
+    paths: string[];
+    severity?: string | undefined;
+    title?: string | undefined;
+    url: string;
+}
+export interface CommandOptions {
+    configPath?: string | undefined;
+    json: boolean;
+    scopes: AuditScope[];
+    verbose: boolean;
+}
+export declare function isSeverityAtOrAbove(severity: string | undefined, threshold: SeverityThreshold): boolean;

package/dist/esm/types.js

@@ -0,0 +1,40 @@
+import { z } from "zod";
+const AUDIT_SCOPES = ["dev", "prod"];
+const SEVERITY_THRESHOLDS = ["low", "moderate", "high", "critical"];
+const allowlistEntrySchema = z.object({
+  addedAt: z.string().optional(),
+  id: z.string(),
+  path: z.string(),
+  reason: z.string().optional(),
+  url: z.string()
+});
+const scopeConfigSchema = z.object({
+  allowlist: z.array(allowlistEntrySchema),
+  severityThreshold: z.enum(SEVERITY_THRESHOLDS).optional()
+}).strict();
+const v11yCheckConfigSchema = z.object({
+  $schema: z.string().optional(),
+  dev: scopeConfigSchema,
+  prod: scopeConfigSchema
+}).strict();
+const DEFAULT_CONFIG = {
+  dev: { allowlist: [], severityThreshold: "moderate" },
+  prod: { allowlist: [], severityThreshold: "low" }
+};
+function isSeverityAtOrAbove(severity, threshold) {
+  if (severity === void 0) return true;
+  const levels = SEVERITY_THRESHOLDS;
+  const severityIndex = levels.indexOf(severity);
+  const thresholdIndex = SEVERITY_THRESHOLDS.indexOf(threshold);
+  if (severityIndex === -1) return true;
+  return severityIndex >= thresholdIndex;
+}
+export {
+  AUDIT_SCOPES,
+  DEFAULT_CONFIG,
+  SEVERITY_THRESHOLDS,
+  allowlistEntrySchema,
+  isSeverityAtOrAbove,
+  scopeConfigSchema,
+  v11yCheckConfigSchema
+};

package/package.json

@@ -1,4 +1,54 @@
 {
   "name": "v11y-check",
-  "version": "0.0.0"
-}
+  "version": "0.7.0",
+  "private": false,
+  "description": "Wrap audit-ci with a richer config model, typed JSON source of truth, and sync workflow",
+  "keywords": [
+    "audit",
+    "audit-ci",
+    "dependencies",
+    "security",
+    "vulnerabilities"
+  ],
+  "homepage": "https://github.com/williamthorsen/node-monorepo-tools/tree/main/packages/v11y-check#readme",
+  "bugs": {
+    "url": "https://github.com/williamthorsen/node-monorepo-tools/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/williamthorsen/node-monorepo-tools.git",
+    "directory": "packages/v11y-check"
+  },
+  "license": "ISC",
+  "author": "William Thorsen <william@thorsen.dev> (https://github.com/williamthorsen)",
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": "./dist/esm/index.js",
+      "types": "./dist/esm/index.d.ts"
+    }
+  },
+  "bin": {
+    "v11y": "bin/v11y.js",
+    "v11y-check": "bin/v11y.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "templates"
+  ],
+  "dependencies": {
+    "audit-ci": "7.1.0",
+    "zod": "4.4.3",
+    "@williamthorsen/nmr-core": "0.3.1"
+  },
+  "engines": {
+    "node": ">=18.17.0"
+  },
+  "scripts": {
+    "test": "pnpm exec vitest --config=vitest.standalone.config.ts",
+    "test:coverage": "pnpm exec vitest --config=vitest.standalone.config.ts --coverage",
+    "test:integration": "pnpm exec vitest --config=vitest.integration.config.ts",
+    "test:watch": "pnpm exec vitest --config=vitest.standalone.config.ts --watch"
+  }
+}

package/templates/audit.yaml.template

@@ -0,0 +1,27 @@
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+name: Dependency audit
+
+on:
+  pull_request:
+    branches:
+      - main
+      - next
+
+  # Daily schedule — adjust cron expression per repo if a different cadence is desired.
+  schedule:
+    - cron: '0 8 * * *'
+
+  workflow_dispatch: {}
+
+# Permissions must be declared here. The GITHUB_TOKEN scope passed to the called
+# reusable workflow is bounded by this caller's permissions block; when omitted,
+# the repository's default workflow permissions apply (read-only here), which would
+# silently deny the issues/pull-requests writes the reusable workflow needs.
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  audit:
+    uses: williamthorsen/node-monorepo-tools/.github/workflows/audit.reusable.yaml@workflow/audit-v1