vibecodedshit 0.0.0-stage → 0.3.0

package/dist/measure/deps/declared.js

@@ -0,0 +1,195 @@
+import path from 'node:path';
+import semver from 'semver';
+import { isValidSpecifier, normalizeName, poetryToPep440 } from '../../util/pep440.js';
+import { readToml } from '../../util/toml.js';
+import { joinRel, readTrackedText, trackedIn, trackedSet } from './files.js';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+// ---- npm --------------------------------------------------------------------------------
+function npmManifest(repoPath, pkg) {
+    const file = joinRel(pkg, 'package.json');
+    const text = readTrackedText(repoPath, file);
+    if (text === null)
+        return undefined;
+    const warnings = [];
+    let json;
+    try {
+        json = record(JSON.parse(text));
+    }
+    catch {
+        warnings.push(`${file}: invalid JSON, ignored`);
+    }
+    const deps = [];
+    const sections = [
+        ['dependencies', false],
+        ['devDependencies', true],
+        ['optionalDependencies', false],
+    ];
+    for (const [section, dev] of sections) {
+        const optional = section === 'optionalDependencies';
+        for (const [name, spec] of Object.entries(record(json?.[section]) ?? {})) {
+            if (typeof spec !== 'string')
+                continue;
+            deps.push({ name, spec, dev, registry: semver.validRange(spec) !== null, ...(optional ? { optional } : {}) });
+        }
+    }
+    return { file, kind: 'package.json', deps, warnings };
+}
+// ---- Python -----------------------------------------------------------------------------
+/** One PEP 508 requirement string, or undefined when it is not a requirement. */
+function parseRequirement(line, dev) {
+    const withoutMarker = (line.split(';')[0] ?? '').trim();
+    const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*(.*)$/.exec(withoutMarker);
+    if (!m?.[1])
+        return undefined;
+    let rest = (m[2] ?? '').trim();
+    if (rest.startsWith('@'))
+        return { name: normalizeName(m[1]), spec: '', dev, registry: false };
+    if (rest.startsWith('(') && rest.endsWith(')'))
+        rest = rest.slice(1, -1).trim();
+    rest = rest.replace(/\s+/g, '');
+    if (!isValidSpecifier(rest))
+        return undefined;
+    return { name: normalizeName(m[1]), spec: rest, dev, registry: true };
+}
+function requirementList(value, dev) {
+    if (!Array.isArray(value))
+        return [];
+    const found = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string')
+            continue; // include-group tables are skipped
+        const dep = parseRequirement(entry, dev);
+        if (dep)
+            found.push(dep);
+    }
+    return found;
+}
+function groupedLists(value, dev) {
+    return Object.values(record(value) ?? {}).flatMap((list) => requirementList(list, dev));
+}
+function poetryTable(value, dev) {
+    const found = [];
+    for (const [rawName, entry] of Object.entries(record(value) ?? {})) {
+        if (rawName.toLowerCase() === 'python')
+            continue;
+        const name = normalizeName(rawName);
+        const first = Array.isArray(entry) ? entry[0] : entry;
+        if (typeof first === 'string') {
+            found.push({ name, spec: poetryToPep440(first), dev, registry: true });
+            continue;
+        }
+        const table = record(first);
+        const version = table?.version;
+        const nonRegistry = table === undefined || table.git !== undefined || table.path !== undefined || table.url !== undefined;
+        if (nonRegistry || typeof version !== 'string')
+            found.push({ name, spec: '', dev, registry: false });
+        else
+            found.push({ name, spec: poetryToPep440(version), dev, registry: true });
+    }
+    return found;
+}
+function pyprojectDeps(doc) {
+    const project = record(doc.project);
+    const tool = record(doc.tool);
+    const poetry = record(tool?.poetry);
+    const uv = record(tool?.uv);
+    const pdm = record(tool?.pdm);
+    const sections = [];
+    let present = false;
+    const take = (value, make) => {
+        if (value !== undefined) {
+            present = true;
+            sections.push(make());
+        }
+    };
+    take(project?.dependencies, () => requirementList(project?.dependencies, false));
+    take(project?.['optional-dependencies'], () => groupedLists(project?.['optional-dependencies'], true));
+    take(doc['dependency-groups'], () => groupedLists(doc['dependency-groups'], true));
+    take(uv?.['dev-dependencies'], () => requirementList(uv?.['dev-dependencies'], true));
+    take(poetry?.dependencies, () => poetryTable(poetry?.dependencies, false));
+    take(poetry?.['dev-dependencies'], () => poetryTable(poetry?.['dev-dependencies'], true));
+    for (const group of Object.values(record(poetry?.group) ?? {})) {
+        take(record(group)?.dependencies, () => poetryTable(record(group)?.dependencies, true));
+    }
+    take(pdm?.['dev-dependencies'], () => groupedLists(pdm?.['dev-dependencies'], true));
+    return present ? sections.flat() : undefined;
+}
+function pipfileDeps(doc) {
+    const found = [];
+    for (const [section, dev] of [['packages', false], ['dev-packages', true]]) {
+        for (const [rawName, entry] of Object.entries(record(doc[section]) ?? {})) {
+            const name = normalizeName(rawName);
+            if (typeof entry === 'string') {
+                found.push({ name, spec: entry === '*' ? '' : entry.replace(/\s+/g, ''), dev, registry: isValidSpecifier(entry === '*' ? '' : entry.replace(/\s+/g, '')) });
+                continue;
+            }
+            const version = record(entry)?.version;
+            if (typeof version === 'string') {
+                const spec = version === '*' ? '' : version.replace(/\s+/g, '');
+                found.push({ name, spec, dev, registry: isValidSpecifier(spec) });
+            }
+            else
+                found.push({ name, spec: '', dev, registry: false });
+        }
+    }
+    return found;
+}
+/** Requirement lines of a requirements file: comments, options and hash continuations removed. */
+export function requirementLines(text) {
+    const joined = text.replace(/\\\r?\n/g, ' ');
+    const lines = [];
+    for (const raw of joined.split(/\r?\n/)) {
+        const line = raw.replace(/(^|\s)#.*$/, '').trim();
+        if (line === '' || line.startsWith('-'))
+            continue;
+        const hashed = /--hash[=\s]/.test(line);
+        const clean = line.replace(/\s--\S+(?:[= ]\S+)?/g, '').trim();
+        lines.push({ line: clean, hashed });
+    }
+    return lines;
+}
+export function requirementFiles(repoPath, pkg) {
+    return trackedIn(repoPath, pkg === '.' ? '' : pkg).filter((f) => /^requirements.*\.txt$/.test(path.posix.basename(f)));
+}
+function pythonManifest(repoPath, pkg) {
+    const warnings = [];
+    const dir = pkg === '.' ? '' : pkg;
+    const pyprojectFile = joinRel(dir, 'pyproject.toml');
+    const requirements = () => {
+        const found = new Map();
+        for (const file of requirementFiles(repoPath, pkg)) {
+            const text = readTrackedText(repoPath, file) ?? '';
+            for (const { line } of requirementLines(text)) {
+                const dep = parseRequirement(line, false);
+                if (dep && !found.has(dep.name))
+                    found.set(dep.name, dep);
+            }
+        }
+        return [...found.values()];
+    };
+    if (trackedSet(repoPath).has(pyprojectFile)) {
+        const doc = readToml(path.join(path.resolve(repoPath), pyprojectFile));
+        if (doc === undefined)
+            warnings.push(`${pyprojectFile}: invalid TOML, ignored`);
+        const deps = doc ? pyprojectDeps(doc) : undefined;
+        return { file: pyprojectFile, kind: 'pyproject.toml', deps: deps ?? requirements(), warnings };
+    }
+    const pipfile = joinRel(dir, 'Pipfile');
+    if (trackedSet(repoPath).has(pipfile)) {
+        const doc = readToml(path.join(path.resolve(repoPath), pipfile));
+        if (doc === undefined)
+            warnings.push(`${pipfile}: invalid TOML, ignored`);
+        return { file: pipfile, kind: 'Pipfile', deps: pipfileDeps(doc ?? {}), warnings };
+    }
+    const files = requirementFiles(repoPath, pkg);
+    const first = files[0];
+    if (first === undefined)
+        return undefined;
+    return { file: first, kind: 'requirements', deps: requirements(), warnings };
+}
+/** The unit's declared direct dependencies, or undefined when its package directory has no manifest. */
+export function readManifest(repoPath, pkg, group) {
+    return group === 'python' ? pythonManifest(repoPath, pkg) : npmManifest(repoPath, pkg);
+}

package/dist/measure/deps/files.js

@@ -0,0 +1,40 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { trackedPaths } from '../../scope/tracked.js';
+const sets = new Map();
+export function trackedSet(repoPath) {
+    const key = path.resolve(repoPath);
+    const cached = sets.get(key);
+    if (cached)
+        return cached;
+    const made = new Set(trackedPaths(key));
+    sets.set(key, made);
+    return made;
+}
+export function joinRel(...parts) {
+    return parts.filter((p) => p !== '' && p !== '.').join('/');
+}
+/** Text of a tracked file of any size, or null when it is not tracked or unreadable. */
+export function readTrackedText(repoPath, rel) {
+    if (!trackedSet(repoPath).has(rel))
+        return null;
+    try {
+        return readFileSync(path.join(path.resolve(repoPath), rel), 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/** Tracked files that sit directly in `dir` ('' for the repository root). */
+export function trackedIn(repoPath, dir) {
+    const prefix = dir === '' ? '' : `${dir}/`;
+    const found = [];
+    for (const file of trackedSet(repoPath)) {
+        if (!file.startsWith(prefix))
+            continue;
+        if (file.slice(prefix.length).includes('/'))
+            continue;
+        found.push(file);
+    }
+    return found.sort();
+}

package/dist/measure/deps/lockfiles.js

@@ -0,0 +1,308 @@
+import path from 'node:path';
+import semver from 'semver';
+import ts from 'typescript';
+import { parse as parseYaml } from 'yaml';
+import { normalizeName, satisfies as pySatisfies } from '../../util/pep440.js';
+import { readToml } from '../../util/toml.js';
+import { requirementLines } from './declared.js';
+import { readTrackedText, trackedIn } from './files.js';
+export function kindGroup(kind) {
+    return ['uv', 'poetry', 'pdm', 'pipfile', 'requirements'].includes(kind) ? 'python' : 'typescript_javascript';
+}
+const NAMED = {
+    'package-lock.json': 'package-lock',
+    'npm-shrinkwrap.json': 'npm-shrinkwrap',
+    'pnpm-lock.yaml': 'pnpm',
+    'yarn.lock': 'yarn',
+    'bun.lock': 'bun',
+    'uv.lock': 'uv',
+    'poetry.lock': 'poetry',
+    'pdm.lock': 'pdm',
+    'Pipfile.lock': 'pipfile',
+};
+/**
+ * JS lockfiles in the install step's preference order. With several in one directory, the first one
+ * present is the one that gets installed, so D5 reads that one too. `bun.lockb` is binary: install
+ * uses it, D5 cannot read it.
+ */
+const JS_LOCK_ORDER = ['pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb', 'npm-shrinkwrap.json', 'package-lock.json'];
+/** The JS lockfile names among `names`, in preference order. */
+export function jsLockfiles(names) {
+    const present = new Set(names);
+    return JS_LOCK_ORDER.filter((name) => present.has(name));
+}
+/** The one JS lockfile the install step and D5 use, among the file names of one directory. */
+export function chooseJsLockfile(names) {
+    return jsLockfiles(names)[0];
+}
+const MISSING = { present: false, versions: [], specifierOk: true };
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function str(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+function found(version, specifierOk = true) {
+    return { present: true, versions: version === undefined ? [] : [version], specifierOk };
+}
+// ---- npm --------------------------------------------------------------------------------
+function npmReader(json) {
+    const packages = record(json.packages);
+    const tree = record(json.dependencies);
+    return {
+        lookup(dep, pkgDir) {
+            if (packages) {
+                let dir = pkgDir;
+                for (;;) {
+                    const entry = record(packages[dir === '' ? `node_modules/${dep.name}` : `${dir}/node_modules/${dep.name}`]);
+                    if (entry) {
+                        const target = entry.link === true ? record(packages[str(entry.resolved) ?? '']) : undefined;
+                        return found(str(target?.version) ?? str(entry.version));
+                    }
+                    if (dir === '')
+                        break;
+                    dir = dir.includes('/') ? dir.slice(0, dir.lastIndexOf('/')) : '';
+                }
+                return MISSING;
+            }
+            const entry = record(tree?.[dep.name]);
+            return entry ? found(str(entry.version)) : MISSING;
+        },
+    };
+}
+// ---- pnpm -------------------------------------------------------------------------------
+function pnpmVersion(raw) {
+    if (raw.startsWith('link:') || raw.startsWith('file:'))
+        return undefined;
+    return raw.replace(/\(.*$/, '').replace(/_.*$/, '');
+}
+function pnpmReader(doc) {
+    const importers = record(doc.importers);
+    return {
+        lookup(dep, pkgDir) {
+            const section = importers ? record(importers[pkgDir === '' ? '.' : pkgDir]) : doc;
+            if (!section)
+                return MISSING;
+            const specifiers = record(section.specifiers);
+            for (const key of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+                const entry = record(section[key])?.[dep.name];
+                if (entry === undefined)
+                    continue;
+                if (typeof entry === 'string')
+                    return found(pnpmVersion(entry), str(specifiers?.[dep.name]) === dep.spec);
+                const table = record(entry);
+                const version = str(table?.version);
+                return found(version === undefined ? undefined : pnpmVersion(version), str(table?.specifier) === dep.spec);
+            }
+            return MISSING;
+        },
+    };
+}
+// ---- yarn -------------------------------------------------------------------------------
+function yarnReader(text) {
+    const entries = new Map();
+    const names = new Set();
+    let keys = [];
+    for (const line of text.split(/\r?\n/)) {
+        if (line === '' || line.startsWith('#'))
+            continue;
+        if (!/^\s/.test(line)) {
+            keys = [];
+            if (!line.endsWith(':') || line.startsWith('__metadata'))
+                continue;
+            for (const part of line.slice(0, -1).split(',')) {
+                const key = part.trim().replace(/^"|"$/g, '');
+                const at = key.indexOf('@', 1);
+                if (at === -1)
+                    continue;
+                const name = key.slice(0, at);
+                const range = key.slice(at + 1).replace(/^npm:/, '');
+                names.add(name);
+                keys.push(`${name}@${range}`);
+                entries.set(`${name}@${range}`, undefined);
+            }
+            continue;
+        }
+        const m = /^\s+version:?\s+"?([^"\s]+)"?\s*$/.exec(line);
+        if (m?.[1])
+            for (const key of keys)
+                entries.set(key, m[1]);
+    }
+    return {
+        lookup(dep) {
+            if (!dep.registry)
+                return names.has(dep.name) ? found(undefined) : MISSING;
+            const key = `${dep.name}@${dep.spec}`;
+            return entries.has(key) ? found(entries.get(key)) : MISSING;
+        },
+    };
+}
+// ---- bun --------------------------------------------------------------------------------
+function bunReader(doc) {
+    const workspaces = record(doc.workspaces);
+    const packages = record(doc.packages);
+    return {
+        lookup(dep, pkgDir) {
+            const workspace = record(workspaces?.[pkgDir]);
+            let specifier;
+            for (const key of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+                specifier ??= str(record(workspace?.[key])?.[dep.name]);
+            }
+            const tuple = packages?.[dep.name];
+            if (specifier === undefined && tuple === undefined)
+                return MISSING;
+            const id = Array.isArray(tuple) ? str(tuple[0]) : undefined;
+            const version = id !== undefined && id.lastIndexOf('@') > 0 ? id.slice(id.lastIndexOf('@') + 1) : undefined;
+            return found(version, specifier === undefined || specifier === dep.spec);
+        },
+    };
+}
+// ---- Python -----------------------------------------------------------------------------
+function tomlReader(absPath) {
+    const doc = readToml(absPath);
+    if (!doc || !Array.isArray(doc.package))
+        return undefined;
+    const byName = new Map();
+    for (const entry of doc.package) {
+        const table = record(entry);
+        const name = str(table?.name);
+        if (name === undefined)
+            continue;
+        const version = str(table?.version);
+        const list = byName.get(normalizeName(name)) ?? [];
+        if (version !== undefined)
+            list.push(version);
+        byName.set(normalizeName(name), list);
+    }
+    return {
+        lookup(dep) {
+            const versions = byName.get(dep.name);
+            return versions === undefined ? MISSING : { present: true, versions, specifierOk: true };
+        },
+    };
+}
+function pipfileLockReader(json) {
+    return {
+        lookup(dep) {
+            for (const section of ['default', 'develop']) {
+                for (const [rawName, entry] of Object.entries(record(json[section]) ?? {})) {
+                    if (normalizeName(rawName) !== dep.name)
+                        continue;
+                    const version = str(record(entry)?.version)?.replace(/^==/, '');
+                    return found(version);
+                }
+            }
+            return MISSING;
+        },
+    };
+}
+/** `name==version` for every requirement of a hashed, fully pinned requirements file, else undefined. */
+function pinnedRequirements(text) {
+    const lines = requirementLines(text);
+    if (lines.length === 0)
+        return undefined;
+    const pinned = new Map();
+    for (const { line, hashed } of lines) {
+        const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[[^\]]*\])?\s*==\s*([^\s;=!<>~,]+)\s*(?:;.*)?$/.exec(line);
+        if (!hashed || !m?.[1] || !m[2] || m[2].endsWith('.*'))
+            return undefined;
+        pinned.set(normalizeName(m[1]), m[2]);
+    }
+    return pinned;
+}
+function requirementsReader(pinned) {
+    return {
+        lookup(dep) {
+            const version = pinned.get(dep.name);
+            return version === undefined ? MISSING : found(version);
+        },
+    };
+}
+// ---- search and parse -------------------------------------------------------------------
+/**
+ * Lockfiles of the unit's group in the nearest directory (the package directory, then each
+ * ancestor) that holds any. Every kind found in that directory is a candidate.
+ */
+export function findLockfiles(repoPath, pkg, group) {
+    let dir = pkg === '.' ? '' : pkg;
+    for (;;) {
+        const candidates = [];
+        for (const file of trackedIn(repoPath, dir)) {
+            const base = path.posix.basename(file);
+            const kind = NAMED[base];
+            if (kind !== undefined && kindGroup(kind) === group)
+                candidates.push({ path: file, dir, kind });
+            else if (group === 'python' && /^requirements.*\.txt$/.test(base)) {
+                const text = readTrackedText(repoPath, file);
+                if (text !== null && pinnedRequirements(text) !== undefined)
+                    candidates.push({ path: file, dir, kind: 'requirements' });
+            }
+        }
+        if (candidates.length > 0)
+            return candidates;
+        if (dir === '')
+            return [];
+        dir = dir.includes('/') ? dir.slice(0, dir.lastIndexOf('/')) : '';
+    }
+}
+function parseJson(text) {
+    try {
+        return record(JSON.parse(text));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Parse a lockfile. Undefined when it cannot be read or parsed (it then counts as out of sync). */
+export function readLockfile(repoPath, ref) {
+    const text = readTrackedText(repoPath, ref.path);
+    if (text === null)
+        return undefined;
+    const abs = path.join(path.resolve(repoPath), ref.path);
+    switch (ref.kind) {
+        case 'package-lock':
+        case 'npm-shrinkwrap': {
+            const json = parseJson(text);
+            return json ? npmReader(json) : undefined;
+        }
+        case 'pnpm': {
+            try {
+                const doc = record(parseYaml(text));
+                return doc ? pnpmReader(doc) : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        }
+        case 'yarn':
+            return yarnReader(text);
+        case 'bun': {
+            const parsed = ts.parseConfigFileTextToJson(ref.path, text);
+            const doc = record(parsed.config);
+            return doc ? bunReader(doc) : undefined;
+        }
+        case 'uv':
+        case 'poetry':
+        case 'pdm':
+            return tomlReader(abs);
+        case 'pipfile': {
+            const json = parseJson(text);
+            return json ? pipfileLockReader(json) : undefined;
+        }
+        case 'requirements': {
+            const pinned = pinnedRequirements(text);
+            return pinned ? requirementsReader(pinned) : undefined;
+        }
+    }
+}
+export function entrySatisfies(dep, entry, group) {
+    if (!entry.present)
+        return false;
+    if (!dep.registry)
+        return true;
+    if (!entry.specifierOk)
+        return false;
+    if (group === 'python')
+        return entry.versions.some((v) => pySatisfies(v, dep.spec));
+    return entry.versions.some((v) => semver.satisfies(v, dep.spec, { includePrerelease: true }));
+}

package/dist/measure/deps/osv.js

@@ -0,0 +1,122 @@
+import { band, cvss3BaseScore } from './cvss.js';
+const POINTS = { critical: 10, high: 5, moderate: 2, low: 0.5, none: 0 };
+const LABELS = {
+    CRITICAL: 'critical',
+    HIGH: 'high',
+    MODERATE: 'moderate',
+    MEDIUM: 'moderate',
+    LOW: 'low',
+};
+export function endOfDay(asOf) {
+    return Date.parse(`${asOf}T23:59:59.999Z`);
+}
+/** Published at or before the end of the as-of day (no `published` is kept) and not withdrawn. */
+function counts(record, asOf) {
+    if (record.withdrawn !== undefined && record.withdrawn !== '')
+        return false;
+    if (record.published === undefined)
+        return true;
+    const published = Date.parse(record.published);
+    return Number.isNaN(published) || published <= endOfDay(asOf);
+}
+const ORDER = ['none', 'low', 'moderate', 'high', 'critical'];
+function highest(values) {
+    return values.reduce((top, v) => (top === undefined || ORDER.indexOf(v) > ORDER.indexOf(top) ? v : top), undefined);
+}
+/** Methodology 5.1 order: GHSA label, then CVSS v3.x base score band, then moderate. */
+function groupSeverity(records) {
+    const labelled = records
+        .map((r) => LABELS[(r.database_specific?.severity ?? '').toUpperCase()])
+        .filter((s) => s !== undefined);
+    const label = highest(labelled);
+    if (label !== undefined)
+        return label;
+    const scored = [];
+    for (const record of records) {
+        for (const entry of record.severity ?? []) {
+            if (entry.type !== 'CVSS_V3' || !entry.score?.startsWith('CVSS:3.'))
+                continue;
+            const score = cvss3BaseScore(entry.score);
+            if (score !== undefined)
+                scored.push(band(score));
+        }
+    }
+    return highest(scored) ?? 'moderate';
+}
+/** Group the records of one package into advisories by alias closure. */
+function advisories(records) {
+    const parent = new Map();
+    const find = (x) => {
+        let root = parent.get(x) ?? x;
+        while ((parent.get(root) ?? root) !== root)
+            root = parent.get(root) ?? root;
+        parent.set(x, root);
+        return root;
+    };
+    const union = (a, b) => {
+        const ra = find(a);
+        const rb = find(b);
+        if (ra !== rb)
+            parent.set(ra, rb);
+    };
+    for (const r of records) {
+        find(r.id);
+        for (const alias of r.aliases ?? [])
+            union(r.id, alias);
+    }
+    const groups = new Map();
+    for (const r of records) {
+        const root = find(r.id);
+        groups.set(root, [...(groups.get(root) ?? []), r]);
+    }
+    return [...groups.values()];
+}
+/** Severity points of the advisories that count at the as-of date. Each advisory counts once per package. */
+export function severityPoints(packages, asOf) {
+    const found = [];
+    for (const pkg of packages) {
+        const records = pkg.vulnerabilities.filter((r) => counts(r, asOf));
+        for (const group of advisories(records)) {
+            const severity = groupSeverity(group);
+            const first = group[0];
+            if (!first)
+                continue;
+            found.push({ name: pkg.name, version: pkg.version, dev: pkg.dev, id: first.id, severity, points: POINTS[severity] });
+        }
+    }
+    return { points: found.reduce((sum, a) => sum + a.points, 0), advisories: found };
+}
+/** Packages of an osv-scanner JSON report. Undefined when the shape is not recognised. */
+export function parseOsvReport(text) {
+    let json;
+    try {
+        json = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    const results = json?.results;
+    if (results === null || results === undefined)
+        return [];
+    if (!Array.isArray(results))
+        return undefined;
+    const found = [];
+    for (const result of results) {
+        if (!Array.isArray(result?.packages))
+            continue;
+        for (const entry of result.packages) {
+            const { name, version, ecosystem } = entry.package ?? {};
+            if (typeof name !== 'string' || typeof version !== 'string')
+                return undefined;
+            const groups = Array.isArray(entry.dependency_groups) ? entry.dependency_groups : [];
+            found.push({
+                name,
+                version,
+                ecosystem: typeof ecosystem === 'string' ? ecosystem : '',
+                dev: groups.includes('dev'),
+                vulnerabilities: Array.isArray(entry.vulnerabilities) ? entry.vulnerabilities : [],
+            });
+        }
+    }
+    return found;
+}