/** * Shared parse/validation helpers for LLM scan providers. * * This module extracts the JSON-parsing, finding-validation, and report- * assembly helpers that are common to every OpenAI-compatible LLM provider * (OpenAI, Gemini, Anthropic, …) so each provider can reuse them instead of * duplicating logic. */ import { FindingCategory, Severity, type LlmScanReport, type ScanFinding } from "../scanner/types.js"; /** * Error thrown when an LLM provider request or response is invalid. */ export declare class LlmProviderError extends Error { readonly statusCode?: number | undefined; constructor(message: string, statusCode?: number | undefined); } /** * System prompt instructing the model to act as an npm package security * analyst and return a JSON object with a fixed shape. */ export declare const SYSTEM_PROMPT = "You are an npm package security analyst. Analyze the supplied package metadata and README for semantic risks that static rules may miss. Return only a JSON object with this exact shape:\n{\"summary\":\"string\",\"functionalMatch\":true,\"suspiciousScore\":0,\"findings\":[{\"ruleId\":\"llm-...\",\"ruleName\":\"string\",\"severity\":\"low|medium|high|critical\",\"message\":\"string\",\"recommendation\":\"string\",\"category\":\"informational|known-malicious|suspicious-dependency|sensitive-exposure|code-obfuscation|binary-download|install-script|typosquatting|homograph-attack|registry-mismatch\"}]}\nsuspiciousScore is 0-100, where higher means more suspicious. Do not invent evidence that is not present in the input. Use an empty findings array when no concern is found."; /** * Parse a raw LLM response string into a JSON object. * * Strips ```json fences, parses the content, and rejects non-object values * (arrays, primitives, or invalid JSON) by throwing {@link LlmProviderError}. * * @param content - Raw text returned by the LLM. * @returns The parsed JSON object. * @throws {LlmProviderError} When the content is not a valid JSON object. */ export declare function parseJsonObject(content: string): Record; /** * Parse an unknown value into a list of validated scan findings. * * Non-array inputs yield an empty array. Items that are not objects or that * lack a `message` field are dropped. Each surviving item is mapped to a * {@link ScanFinding} with normalized severity and category. * * @param value - The `findings` field of a parsed LLM response. * @returns A readonly array of validated findings. */ export declare function parseFindings(value: unknown): readonly ScanFinding[]; /** * Coerce an unknown value into a {@link Severity}, defaulting to Medium. * * @param value - The `severity` field of a finding. * @returns The validated severity, or `Severity.Medium` if invalid. */ export declare function readSeverity(value: unknown): Severity; /** * Coerce an unknown value into a {@link FindingCategory}, defaulting to * Informational. * * @param value - The `category` field of a finding. * @returns The validated category, or `FindingCategory.Informational` if invalid. */ export declare function readCategory(value: unknown): FindingCategory; /** * Return the value if it is a string, otherwise `undefined`. * * @param value - An arbitrary unknown value. * @returns The string value, or `undefined`. */ export declare function readOptionalString(value: unknown): string | undefined; /** * Return the value if it is a boolean, otherwise `undefined`. * * @param value - An arbitrary unknown value. * @returns The boolean value, or `undefined`. */ export declare function readOptionalBoolean(value: unknown): boolean | undefined; /** * Return the value if it is a finite number, otherwise `undefined`. * * @param value - An arbitrary unknown value. * @returns The finite number, or `undefined`. */ export declare function readOptionalNumber(value: unknown): number | undefined; /** * Clamp a numeric score to the 0-100 range, rounding to the nearest integer. * * @param value - The raw numeric score. * @returns The clamped integer score between 0 and 100. */ export declare function clampScore(value: number): number; /** * Assemble the final {@link LlmScanReport} from a parsed LLM JSON object. * * @param parsed - The JSON object returned by {@link parseJsonObject}. * @param scannedAt - ISO 8601 timestamp marking when the scan ran. * @returns A populated LLM scan report with `enabled: true`. */ export declare function buildReport(parsed: Record, scannedAt: string): LlmScanReport; //# sourceMappingURL=parse.d.ts.map