verimu 0.0.4 → 0.0.5

package/dist/cli.mjs

@@ -2,6 +2,7 @@
 
 // src/cli.ts
 import { resolve } from "path";
+import { createRequire } from "module";
 
 // src/scan.ts
 import { writeFile } from "fs/promises";
@@ -23,7 +24,7 @@ var VerimuError = class extends Error {
 var NoLockfileError = class extends VerimuError {
   constructor(projectPath) {
     super(
-      `No supported lockfile found in ${projectPath}. Supported: package-lock.json (npm), packages.lock.json (NuGet), Cargo.lock (Rust), requirements.txt / Pipfile.lock (Python), pom.xml (Maven), go.sum (Go), Gemfile.lock (Ruby)`,
+      `No supported lockfile found in ${projectPath}. Supported: package-lock.json (npm), packages.lock.json (NuGet), Cargo.lock (Rust), requirements.txt / Pipfile.lock (Python), pom.xml (Maven), go.sum (Go), Gemfile.lock (Ruby), composer.lock (Composer)`,
       "NO_LOCKFILE"
     );
     this.name = "NoLockfileError";
@@ -58,11 +59,11 @@ var NpmScanner = class {
     const directNames = /* @__PURE__ */ new Set();
     if (packageJsonRaw) {
       try {
-        const pkg = JSON.parse(packageJsonRaw);
-        for (const name of Object.keys(pkg.dependencies ?? {})) {
+        const pkg2 = JSON.parse(packageJsonRaw);
+        for (const name of Object.keys(pkg2.dependencies ?? {})) {
           directNames.add(name);
         }
-        for (const name of Object.keys(pkg.devDependencies ?? {})) {
+        for (const name of Object.keys(pkg2.devDependencies ?? {})) {
           directNames.add(name);
         }
       } catch {
@@ -230,14 +231,14 @@ var CargoScanner = class {
     const directNames = cargoTomlRaw ? this.parseCargoToml(cargoTomlRaw) : /* @__PURE__ */ new Set();
     const rootName = packages.length > 0 ? packages[0].name : null;
     const dependencies = [];
-    for (const pkg of packages) {
-      if (pkg.name === rootName && pkg.source === void 0) continue;
+    for (const pkg2 of packages) {
+      if (pkg2.name === rootName && pkg2.source === void 0) continue;
       dependencies.push({
-        name: pkg.name,
-        version: pkg.version,
-        direct: directNames.has(pkg.name),
+        name: pkg2.name,
+        version: pkg2.version,
+        direct: directNames.has(pkg2.name),
         ecosystem: "cargo",
-        purl: this.buildPurl(pkg.name, pkg.version)
+        purl: this.buildPurl(pkg2.name, pkg2.version)
       });
     }
     return {
@@ -811,6 +812,75 @@ var RubyScanner = class {
   }
 };
 
+// src/scanners/composer/composer-scanner.ts
+import { readFile as readFile8 } from "fs/promises";
+import { existsSync as existsSync8 } from "fs";
+import path8 from "path";
+var ComposerScanner = class {
+  ecosystem = "composer";
+  lockfileNames = ["composer.lock"];
+  async detect(projectPath) {
+    const lockfilePath = path8.join(projectPath, "composer.lock");
+    return existsSync8(lockfilePath) ? lockfilePath : null;
+  }
+  async scan(projectPath, lockfilePath) {
+    const [lockRaw, manifestRaw] = await Promise.all([
+      readFile8(lockfilePath, "utf-8"),
+      readFile8(path8.join(projectPath, "composer.json"), "utf-8").catch(() => null)
+    ]);
+    const directNames = manifestRaw ? this.parseComposerManifest(manifestRaw) : null;
+    const dependencies = this.parseComposerLock(lockRaw, lockfilePath, directNames);
+    return {
+      projectPath,
+      ecosystem: "composer",
+      dependencies,
+      lockfilePath,
+      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  parseComposerLock(content, lockfilePath, directNames) {
+    let lock;
+    try {
+      lock = JSON.parse(content);
+    } catch {
+      throw new LockfileParseError(lockfilePath, "Invalid JSON in composer.lock");
+    }
+    const allPackages = [...lock.packages ?? [], ...lock["packages-dev"] ?? []];
+    if (allPackages.length === 0) {
+      throw new LockfileParseError(lockfilePath, "No packages found in composer.lock");
+    }
+    return allPackages.filter((pkg2) => pkg2.name && pkg2.version).map((pkg2) => ({
+      name: pkg2.name,
+      version: this.normalizeVersion(pkg2.version),
+      direct: directNames ? directNames.has(pkg2.name) : true,
+      ecosystem: "composer",
+      purl: this.buildPurl(pkg2.name, this.normalizeVersion(pkg2.version))
+    }));
+  }
+  parseComposerManifest(content) {
+    let manifest;
+    try {
+      manifest = JSON.parse(content);
+    } catch {
+      return /* @__PURE__ */ new Set();
+    }
+    const names = /* @__PURE__ */ new Set();
+    for (const section of [manifest.require ?? {}, manifest["require-dev"] ?? {}]) {
+      for (const name of Object.keys(section)) {
+        if (name === "php" || name.startsWith("ext-") || name.startsWith("lib-")) continue;
+        names.add(name);
+      }
+    }
+    return names;
+  }
+  normalizeVersion(version) {
+    return version.trim();
+  }
+  buildPurl(name, version) {
+    return `pkg:composer/${name}@${version}`;
+  }
+};
+
 // src/scanners/registry.ts
 var ScannerRegistry = class {
   scanners;
@@ -822,7 +892,8 @@ var ScannerRegistry = class {
       new PipScanner(),
       new MavenScanner(),
       new GoScanner(),
-      new RubyScanner()
+      new RubyScanner(),
+      new ComposerScanner()
     ];
   }
   /**
@@ -1118,7 +1189,8 @@ var OsvSource = class {
       maven: "Maven",
       pip: "PyPI",
       go: "Go",
-      ruby: "RubyGems"
+      ruby: "RubyGems",
+      composer: "Packagist"
     };
     return map[ecosystem] ?? ecosystem;
   }
@@ -1347,7 +1419,8 @@ var VerimuApiClient = class {
       nuget: "nuget",
       go: "gomod",
       cargo: "cargo",
-      ruby: "bundler"
+      ruby: "bundler",
+      composer: "composer"
     };
     return map[eco] ?? eco;
   }
@@ -1441,7 +1514,9 @@ function shouldFailCi(report, threshold) {
 }
 
 // src/cli.ts
-var VERSION = "0.0.3";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var VERSION = pkg.version ?? "0.0.0";
 var BRAND = `
   \u2566  \u2566\u250C\u2500\u2510\u252C\u2500\u2510\u252C\u250C\u252C\u2510\u252C \u252C
   \u255A\u2557\u2554\u255D\u251C\u2524 \u251C\u252C\u2518\u2502\u2502\u2502\u2502\u2502 \u2502
@@ -1603,7 +1678,7 @@ function printHelp() {
     npm (package-lock.json)         pip (requirements.txt)
     Maven (pom.xml)                 NuGet (packages.lock.json)
     Cargo (Cargo.lock)              Go (go.sum)
-    Ruby (Gemfile.lock)
+    Ruby (Gemfile.lock)             Composer (composer.lock)
 
   Learn more: https://verimu.com
   Dashboard: https://app.verimu.com