#!/usr/bin/env bash
set -euo pipefail

RUN_ID="${PENTEST_RUN_ID:-manual}"
ARTIFACT_DIR="${PENTEST_ARTIFACT_DIR:-.paqad/pentest/runs/${RUN_ID}/artifacts}"
DEPENDENCY_DIR="${ARTIFACT_DIR}/dependencies"

mkdir -p "${DEPENDENCY_DIR}"

if [ -f "package.json" ] && [ -f "package-lock.json" ] && command -v npm >/dev/null 2>&1; then
  npm audit --json > "${DEPENDENCY_DIR}/npm-audit.json" 2>"${DEPENDENCY_DIR}/npm-audit.stderr" || true
fi

if [ -f "package.json" ] && [ -f "pnpm-lock.yaml" ] && command -v pnpm >/dev/null 2>&1; then
  pnpm audit --json > "${DEPENDENCY_DIR}/pnpm-audit.json" 2>"${DEPENDENCY_DIR}/pnpm-audit.stderr" || true
fi

if [ -f "composer.json" ] && command -v composer >/dev/null 2>&1; then
  composer audit --format=json > "${DEPENDENCY_DIR}/composer-audit.json" 2>"${DEPENDENCY_DIR}/composer-audit.stderr" || true
fi

if [ -f "package.json" ] && command -v node >/dev/null 2>&1; then
  node - <<'NODE' > "${DEPENDENCY_DIR}/package-inventory.json"
const fs = require('fs');
const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
console.log(JSON.stringify({
  dependencies: pkg.dependencies ?? {},
  devDependencies: pkg.devDependencies ?? {},
}, null, 2));
NODE
fi

echo "dependency audits complete"