v11y-check 0.9.0 → 0.10.0

package/dist/esm/cli.js

@@ -1,5 +1,5 @@
-import process from "node:process";
-import { reportError } from "@williamthorsen/nmr-core";
+import process from 'node:process';
+import { reportError } from '@williamthorsen/nmr-core';
 import { loadConfig } from "./config.js";
 import { formatCheckJson, formatCheckText } from "./format-check.js";
 import { formatCheckVerboseText } from "./format-verbose.js";
@@ -9,217 +9,219 @@ import { parseAuditCiOutput, runAudit, runReport } from "./run-audit.js";
 import { syncAllowlist } from "./sync.js";
 import { withTempDir } from "./tmp.js";
 import { AUDIT_SCOPES, isSeverityAtOrAbove } from "./types.js";
-function extractMessage(error) {
-  return error instanceof Error ? error.message : String(error);
+export function extractMessage(error) {
+    return error instanceof Error ? error.message : String(error);
 }
-async function auditCommand(options) {
-  let loaded;
-  try {
-    loaded = await loadConfig(options.configPath);
-  } catch (error) {
-    reportError(extractMessage(error));
-    return 1;
-  }
-  const { config } = loaded;
-  const scopes = options.scopes.length > 0 ? options.scopes : [...AUDIT_SCOPES];
-  try {
-    return await withTempDir(async (tempDir) => {
-      let exitCode = 0;
-      const allResults = [];
-      for (const scope of scopes) {
-        const configPath = await generateAuditCiConfig(config[scope], scope, tempDir);
-        const result = runAudit({ configPath, json: options.json });
-        for (const warning of result.warnings) {
-          process.stderr.write(`warning: ${warning}
-`);
-        }
-        if (result.staleEntries.length > 0) {
-          process.stderr.write(`warning: stale allowlist entries in ${scope}: ${result.staleEntries.join(", ")}
-`);
-        }
-        if (options.json) {
-          const parsed = parseAuditCiOutput(result.stdout);
-          for (const warning of parsed.warnings) {
-            process.stderr.write(`warning: ${warning}
-`);
-          }
-          for (const r of parsed.results) {
-            if (!allResults.some((existing) => existing.id === r.id)) {
-              allResults.push(r);
+export async function auditCommand(options) {
+    let loaded;
+    try {
+        loaded = await loadConfig(options.configPath);
+    }
+    catch (error) {
+        reportError(extractMessage(error));
+        return 1;
+    }
+    const { config } = loaded;
+    const scopes = options.scopes.length > 0 ? options.scopes : [...AUDIT_SCOPES];
+    try {
+        return await withTempDir(async (tempDir) => {
+            let exitCode = 0;
+            const allResults = [];
+            for (const scope of scopes) {
+                const configPath = await generateAuditCiConfig(config[scope], scope, tempDir);
+                const result = runAudit({ configPath, json: options.json });
+                for (const warning of result.warnings) {
+                    process.stderr.write(`warning: ${warning}\n`);
+                }
+                if (result.staleEntries.length > 0) {
+                    process.stderr.write(`warning: stale allowlist entries in ${scope}: ${result.staleEntries.join(', ')}\n`);
+                }
+                if (options.json) {
+                    const parsed = parseAuditCiOutput(result.stdout);
+                    for (const warning of parsed.warnings) {
+                        process.stderr.write(`warning: ${warning}\n`);
+                    }
+                    for (const r of parsed.results) {
+                        if (!allResults.some((existing) => existing.id === r.id)) {
+                            allResults.push(r);
+                        }
+                    }
+                }
+                else {
+                    if (result.stdout.length > 0) {
+                        process.stdout.write(result.stdout);
+                    }
+                    if (result.stderr.length > 0) {
+                        process.stderr.write(result.stderr);
+                    }
+                }
+                if (result.exitCode !== 0) {
+                    exitCode = result.exitCode;
+                }
             }
-          }
-        } else {
-          if (result.stdout.length > 0) {
-            process.stdout.write(result.stdout);
-          }
-          if (result.stderr.length > 0) {
-            process.stderr.write(result.stderr);
-          }
-        }
-        if (result.exitCode !== 0) {
-          exitCode = result.exitCode;
-        }
-      }
-      if (options.json) {
-        process.stdout.write(JSON.stringify(allResults, null, 2) + "\n");
-      }
-      return exitCode;
-    });
-  } catch (error) {
-    reportError(extractMessage(error));
-    return 1;
-  }
+            if (options.json) {
+                process.stdout.write(JSON.stringify(allResults, null, 2) + '\n');
+            }
+            return exitCode;
+        });
+    }
+    catch (error) {
+        reportError(extractMessage(error));
+        return 1;
+    }
 }
-const CHECK_SCOPE_ORDER = ["prod", "dev"];
-async function checkCommand(options) {
-  let loaded;
-  try {
-    loaded = await loadConfig(options.configPath);
-  } catch (error) {
-    reportError(extractMessage(error));
-    return 1;
-  }
-  const { config } = loaded;
-  const requestedScopes = options.scopes.length > 0 ? options.scopes : [...CHECK_SCOPE_ORDER];
-  const scopes = CHECK_SCOPE_ORDER.filter((s) => requestedScopes.includes(s));
-  try {
-    return await withTempDir(async (tempDir) => {
-      const checkResult = {
-        dev: { allowed: [], belowThreshold: [], stale: [], unallowed: [] },
-        prod: { allowed: [], belowThreshold: [], stale: [], unallowed: [] }
-      };
-      const thresholds = {};
-      for (const scope of scopes) {
-        const scopeConfig = config[scope];
-        const effectiveThreshold = scopeConfig.severityThreshold ?? "low";
-        thresholds[scope] = effectiveThreshold;
-        const strippedScope = { ...scopeConfig, allowlist: [], severityThreshold: "low" };
-        const strippedConfigPath = await generateAuditCiConfig(strippedScope, scope, tempDir);
-        const reportOptions = { configPath: strippedConfigPath };
-        if (options.verbose) {
-          reportOptions.reportType = "full";
-        }
-        const report = runReport(reportOptions);
-        for (const warning of report.warnings) {
-          process.stderr.write(`warning: ${warning}
-`);
-        }
-        if (report.stderr.length > 0) {
-          process.stderr.write(report.stderr);
-        }
-        const allowedIds = new Set(scopeConfig.allowlist.map((entry) => entry.id));
-        const foundIds = new Set(report.results.map((r) => r.id));
-        const allowlistById = new Map(scopeConfig.allowlist.map((entry) => [entry.id, entry]));
-        const scopeResult = { allowed: [], belowThreshold: [], stale: [], unallowed: [] };
-        for (const result of report.results) {
-          if (!isSeverityAtOrAbove(result.severity, effectiveThreshold)) {
-            scopeResult.belowThreshold.push(result);
-          } else if (allowedIds.has(result.id)) {
-            const entry = allowlistById.get(result.id);
-            scopeResult.allowed.push(buildAllowedVuln(result, entry));
-          } else {
-            scopeResult.unallowed.push(result);
-          }
-        }
-        for (const entry of scopeConfig.allowlist) {
-          if (!foundIds.has(entry.id)) {
-            scopeResult.stale.push({ id: entry.id });
-          }
-        }
-        checkResult[scope] = scopeResult;
-      }
-      if (options.verbose && !options.json) {
-        process.stdout.write(formatCheckVerboseText(checkResult, scopes, void 0, thresholds));
-      } else if (options.json) {
-        process.stdout.write(formatCheckJson(checkResult, scopes));
-      } else {
-        process.stdout.write(formatCheckText(checkResult, scopes, void 0, thresholds));
-      }
-      const hasUnallowed = scopes.some((s) => checkResult[s].unallowed.length > 0);
-      return hasUnallowed ? 1 : 0;
-    });
-  } catch (error) {
-    reportError(extractMessage(error));
-    return 1;
-  }
+const CHECK_SCOPE_ORDER = ['prod', 'dev'];
+export async function checkCommand(options) {
+    let loaded;
+    try {
+        loaded = await loadConfig(options.configPath);
+    }
+    catch (error) {
+        reportError(extractMessage(error));
+        return 1;
+    }
+    const { config } = loaded;
+    const requestedScopes = options.scopes.length > 0 ? options.scopes : [...CHECK_SCOPE_ORDER];
+    const scopes = CHECK_SCOPE_ORDER.filter((s) => requestedScopes.includes(s));
+    try {
+        return await withTempDir(async (tempDir) => {
+            const checkResult = {
+                dev: { allowed: [], belowThreshold: [], stale: [], unallowed: [] },
+                prod: { allowed: [], belowThreshold: [], stale: [], unallowed: [] },
+            };
+            const thresholds = {};
+            for (const scope of scopes) {
+                const scopeConfig = config[scope];
+                const effectiveThreshold = scopeConfig.severityThreshold ?? 'low';
+                thresholds[scope] = effectiveThreshold;
+                const strippedScope = { ...scopeConfig, allowlist: [], severityThreshold: 'low' };
+                const strippedConfigPath = await generateAuditCiConfig(strippedScope, scope, tempDir);
+                const reportOptions = { configPath: strippedConfigPath };
+                if (options.verbose) {
+                    reportOptions.reportType = 'full';
+                }
+                const report = runReport(reportOptions);
+                for (const warning of report.warnings) {
+                    process.stderr.write(`warning: ${warning}\n`);
+                }
+                if (report.stderr.length > 0) {
+                    process.stderr.write(report.stderr);
+                }
+                const allowedIds = new Set(scopeConfig.allowlist.map((entry) => entry.id));
+                const foundIds = new Set(report.results.map((r) => r.id));
+                const allowlistById = new Map(scopeConfig.allowlist.map((entry) => [entry.id, entry]));
+                const scopeResult = { allowed: [], belowThreshold: [], stale: [], unallowed: [] };
+                for (const result of report.results) {
+                    if (!isSeverityAtOrAbove(result.severity, effectiveThreshold)) {
+                        scopeResult.belowThreshold.push(result);
+                    }
+                    else if (allowedIds.has(result.id)) {
+                        const entry = allowlistById.get(result.id);
+                        scopeResult.allowed.push(buildAllowedVuln(result, entry));
+                    }
+                    else {
+                        scopeResult.unallowed.push(result);
+                    }
+                }
+                for (const entry of scopeConfig.allowlist) {
+                    if (!foundIds.has(entry.id)) {
+                        scopeResult.stale.push({ id: entry.id });
+                    }
+                }
+                checkResult[scope] = scopeResult;
+            }
+            if (options.verbose && !options.json) {
+                process.stdout.write(formatCheckVerboseText(checkResult, scopes, undefined, thresholds));
+            }
+            else if (options.json) {
+                process.stdout.write(formatCheckJson(checkResult, scopes));
+            }
+            else {
+                process.stdout.write(formatCheckText(checkResult, scopes, undefined, thresholds));
+            }
+            const hasUnallowed = scopes.some((s) => checkResult[s].unallowed.length > 0);
+            return hasUnallowed ? 1 : 0;
+        });
+    }
+    catch (error) {
+        reportError(extractMessage(error));
+        return 1;
+    }
 }
-async function syncCommand(options) {
-  let loaded;
-  try {
-    loaded = await loadConfig(options.configPath);
-  } catch (error) {
-    reportError(extractMessage(error));
-    return 1;
-  }
-  const { configSource } = loaded;
-  if (configSource === "defaults") {
-    const { configResult } = scaffoldConfig({ dryRun: false, force: false });
-    if (configResult.outcome === "failed") {
-      reportError("Failed to create config file");
-      return 1;
+export async function syncCommand(options) {
+    let loaded;
+    try {
+        loaded = await loadConfig(options.configPath);
     }
-    loaded = await loadConfig(options.configPath);
-  }
-  let { config } = loaded;
-  const { configFilePath } = loaded;
-  const scopes = options.scopes.length > 0 ? options.scopes : [...AUDIT_SCOPES];
-  try {
-    return await withTempDir(async (tempDir) => {
-      for (const scope of scopes) {
-        const strippedScope = { ...config[scope], allowlist: [] };
-        const strippedConfigPath = await generateAuditCiConfig(strippedScope, scope, tempDir);
-        const report = runReport({ configPath: strippedConfigPath });
-        for (const warning of report.warnings) {
-          process.stderr.write(`warning: ${warning}
-`);
-        }
-        const { syncResult, updatedConfig } = await syncAllowlist(config, scope, report.results, configFilePath);
-        config = updatedConfig;
-        if (options.json) {
-          process.stdout.write(JSON.stringify(syncResult, null, 2) + "\n");
-        } else {
-          process.stdout.write(`
---- ${scope} ---
-`);
-          process.stdout.write(`  added: ${syncResult.added.length}
-`);
-          process.stdout.write(`  kept: ${syncResult.kept.length}
-`);
-          process.stdout.write(`  removed: ${syncResult.removed.length}
-`);
+    catch (error) {
+        reportError(extractMessage(error));
+        return 1;
+    }
+    const { configSource } = loaded;
+    if (configSource === 'defaults') {
+        const { configResult } = scaffoldConfig({ dryRun: false, force: false });
+        if (configResult.outcome === 'failed') {
+            reportError('Failed to create config file');
+            return 1;
         }
-      }
-      if (configSource === "defaults") {
-        const totalEntries = config.dev.allowlist.length + config.prod.allowlist.length;
-        process.stdout.write(`Created config at ${configFilePath} with ${totalEntries} allowed entries.
-`);
-      }
-      return 0;
-    });
-  } catch (error) {
-    reportError(extractMessage(error));
-    return 1;
-  }
+        loaded = await loadConfig(options.configPath);
+    }
+    let { config } = loaded;
+    const { configFilePath } = loaded;
+    const scopes = options.scopes.length > 0 ? options.scopes : [...AUDIT_SCOPES];
+    try {
+        return await withTempDir(async (tempDir) => {
+            for (const scope of scopes) {
+                const strippedScope = { ...config[scope], allowlist: [] };
+                const strippedConfigPath = await generateAuditCiConfig(strippedScope, scope, tempDir);
+                const report = runReport({ configPath: strippedConfigPath });
+                for (const warning of report.warnings) {
+                    process.stderr.write(`warning: ${warning}\n`);
+                }
+                const { syncResult, updatedConfig } = await syncAllowlist(config, scope, report.results, configFilePath);
+                config = updatedConfig;
+                if (options.json) {
+                    process.stdout.write(JSON.stringify(syncResult, null, 2) + '\n');
+                }
+                else {
+                    process.stdout.write(`\n--- ${scope} ---\n`);
+                    process.stdout.write(`  added: ${syncResult.added.length}\n`);
+                    process.stdout.write(`  kept: ${syncResult.kept.length}\n`);
+                    process.stdout.write(`  removed: ${syncResult.removed.length}\n`);
+                }
+            }
+            if (configSource === 'defaults') {
+                const totalEntries = config.dev.allowlist.length + config.prod.allowlist.length;
+                process.stdout.write(`Created config at ${configFilePath} with ${totalEntries} allowed entries.\n`);
+            }
+            return 0;
+        });
+    }
+    catch (error) {
+        reportError(extractMessage(error));
+        return 1;
+    }
 }
 function buildAllowedVuln(result, entry) {
-  const allowed = {
-    id: result.id,
-    path: result.path,
-    paths: result.paths,
-    url: result.url
-  };
-  if (result.ghsaId !== void 0) allowed.ghsaId = result.ghsaId;
-  if (result.severity !== void 0) allowed.severity = result.severity;
-  if (result.title !== void 0) allowed.title = result.title;
-  if (result.description !== void 0) allowed.description = result.description;
-  if (result.cvss !== void 0) allowed.cvss = result.cvss;
-  if (entry?.reason !== void 0) allowed.reason = entry.reason;
-  if (entry?.addedAt !== void 0) allowed.addedAt = entry.addedAt;
-  return allowed;
+    const allowed = {
+        id: result.id,
+        path: result.path,
+        paths: result.paths,
+        url: result.url,
+    };
+    if (result.ghsaId !== undefined)
+        allowed.ghsaId = result.ghsaId;
+    if (result.severity !== undefined)
+        allowed.severity = result.severity;
+    if (result.title !== undefined)
+        allowed.title = result.title;
+    if (result.description !== undefined)
+        allowed.description = result.description;
+    if (result.cvss !== undefined)
+        allowed.cvss = result.cvss;
+    if (entry?.reason !== undefined)
+        allowed.reason = entry.reason;
+    if (entry?.addedAt !== undefined)
+        allowed.addedAt = entry.addedAt;
+    return allowed;
 }
-export {
-  auditCommand,
-  checkCommand,
-  extractMessage,
-  syncCommand
-};

package/dist/esm/config.d.ts

@@ -1,4 +1,4 @@
-import type { V11yCheckConfig } from './types.ts';
+import type { V11yCheckConfig } from './types.js';
 export declare const DEFAULT_CONFIG_PATH = ".config/v11y-check.config.json";
 export type ConfigSource = 'defaults' | 'file';
 export interface LoadConfigResult {

package/dist/esm/config.js

@@ -1,41 +1,38 @@
-import { existsSync } from "node:fs";
-import { readFile } from "node:fs/promises";
-import path from "node:path";
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
 import { DEFAULT_CONFIG, v11yCheckConfigSchema } from "./types.js";
-const DEFAULT_CONFIG_PATH = ".config/v11y-check.config.json";
-async function loadConfig(configPath, cwd) {
-  const resolvedCwd = cwd ?? process.cwd();
-  const filePath = path.resolve(resolvedCwd, configPath ?? DEFAULT_CONFIG_PATH);
-  const configDir = path.dirname(filePath);
-  if (configPath === void 0 && !existsSync(filePath)) {
-    return {
-      config: DEFAULT_CONFIG,
-      configDir,
-      configFilePath: filePath,
-      configSource: "defaults"
-    };
-  }
-  let raw;
-  try {
-    raw = await readFile(filePath, "utf8");
-  } catch {
-    throw new Error(`Config file not found: ${filePath}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error(`Config file is not valid JSON: ${filePath}`);
-  }
-  const result = v11yCheckConfigSchema.safeParse(parsed);
-  if (!result.success) {
-    const issues = result.error.issues.map((issue) => `  - ${issue.path.join(".")}: ${issue.message}`).join("\n");
-    throw new Error(`Invalid config in ${filePath}:
-${issues}`);
-  }
-  return { config: result.data, configDir, configFilePath: filePath, configSource: "file" };
+export const DEFAULT_CONFIG_PATH = '.config/v11y-check.config.json';
+export async function loadConfig(configPath, cwd) {
+    const resolvedCwd = cwd ?? process.cwd();
+    const filePath = path.resolve(resolvedCwd, configPath ?? DEFAULT_CONFIG_PATH);
+    const configDir = path.dirname(filePath);
+    if (configPath === undefined && !existsSync(filePath)) {
+        return {
+            config: DEFAULT_CONFIG,
+            configDir,
+            configFilePath: filePath,
+            configSource: 'defaults',
+        };
+    }
+    let raw;
+    try {
+        raw = await readFile(filePath, 'utf8');
+    }
+    catch {
+        throw new Error(`Config file not found: ${filePath}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Config file is not valid JSON: ${filePath}`);
+    }
+    const result = v11yCheckConfigSchema.safeParse(parsed);
+    if (!result.success) {
+        const issues = result.error.issues.map((issue) => `  - ${issue.path.join('.')}: ${issue.message}`).join('\n');
+        throw new Error(`Invalid config in ${filePath}:\n${issues}`);
+    }
+    return { config: result.data, configDir, configFilePath: filePath, configSource: 'file' };
 }
-export {
-  DEFAULT_CONFIG_PATH,
-  loadConfig
-};

package/dist/esm/format-actions.d.ts

@@ -1,3 +1,3 @@
-import type { CheckResult } from './format-check.ts';
-import type { AuditScope } from './types.ts';
+import type { CheckResult } from './format-check.js';
+import type { AuditScope } from './types.js';
 export declare function formatActionHints(result: CheckResult, scopes: AuditScope[]): string;

package/dist/esm/format-actions.js

@@ -1,34 +1,33 @@
-const HINT_ADD = "Run `v11y sync` to add the listed vulnerabilities to the allowlist.";
-const HINT_REMOVE = "Run `v11y sync` to remove stale allowlist entries.";
-const HINT_BOTH = "Run `v11y sync` to add the listed vulnerabilities to the allowlist and remove stale entries.";
+const HINT_ADD = 'Run `v11y sync` to add the listed vulnerabilities to the allowlist.';
+const HINT_REMOVE = 'Run `v11y sync` to remove stale allowlist entries.';
+const HINT_BOTH = 'Run `v11y sync` to add the listed vulnerabilities to the allowlist and remove stale entries.';
 function buildVerboseFlag(scopes) {
-  if (scopes.length === 1) {
-    return `--${scopes[0]} --verbose`;
-  }
-  return "--verbose";
+    if (scopes.length === 1) {
+        return `--${scopes[0]} --verbose`;
+    }
+    return '--verbose';
 }
 function selectSyncHint(hasUnallowed, hasStale) {
-  if (hasUnallowed && hasStale) return HINT_BOTH;
-  if (hasUnallowed) return HINT_ADD;
-  return HINT_REMOVE;
+    if (hasUnallowed && hasStale)
+        return HINT_BOTH;
+    if (hasUnallowed)
+        return HINT_ADD;
+    return HINT_REMOVE;
 }
-function formatActionHints(result, scopes) {
-  const hasUnallowed = scopes.some((scope) => result[scope].unallowed.length > 0);
-  const hasAllowed = scopes.some((scope) => result[scope].allowed.length > 0);
-  const hasStale = scopes.some((scope) => result[scope].stale.length > 0);
-  const hasVulns = hasUnallowed || hasAllowed;
-  const needsSync = hasUnallowed || hasStale;
-  if (!hasVulns && !needsSync) return "";
-  const bullets = [];
-  if (hasVulns) {
-    bullets.push(`  \u2022 Run \`v11y check ${buildVerboseFlag(scopes)}\` for full report`);
-  }
-  if (needsSync) {
-    bullets.push(`  \u2022 ${selectSyncHint(hasUnallowed, hasStale)}`);
-  }
-  return `  Actions:
-${bullets.join("\n")}`;
+export function formatActionHints(result, scopes) {
+    const hasUnallowed = scopes.some((scope) => result[scope].unallowed.length > 0);
+    const hasAllowed = scopes.some((scope) => result[scope].allowed.length > 0);
+    const hasStale = scopes.some((scope) => result[scope].stale.length > 0);
+    const hasVulns = hasUnallowed || hasAllowed;
+    const needsSync = hasUnallowed || hasStale;
+    if (!hasVulns && !needsSync)
+        return '';
+    const bullets = [];
+    if (hasVulns) {
+        bullets.push(`  \u{2022} Run \`v11y check ${buildVerboseFlag(scopes)}\` for full report`);
+    }
+    if (needsSync) {
+        bullets.push(`  \u{2022} ${selectSyncHint(hasUnallowed, hasStale)}`);
+    }
+    return `  Actions:\n${bullets.join('\n')}`;
 }
-export {
-  formatActionHints
-};

package/dist/esm/format-check.d.ts

@@ -1,4 +1,4 @@
-import type { AuditResult, AuditScope, SeverityThreshold } from './types.ts';
+import type { AuditResult, AuditScope, SeverityThreshold } from './types.js';
 export interface AllowedVuln {
     addedAt?: string | undefined;
     cvss?: {