@bryan-thompson/inspector-assessment 1.42.3 → 1.43.1

package/README.md

@@ -93,7 +93,7 @@ For complete CLI documentation, see [CLI Assessment Guide](docs/CLI_ASSESSMENT_G
 
 ---
 
-## Assessment Modules (18 Total: 16 Active + 2 Opt-In)
+## Assessment Modules (19 Total: 16 Active + 3 Opt-In)
 
 ### Active Modules (16)
 
@@ -118,12 +118,13 @@ For complete CLI documentation, see [CLI Assessment Guide](docs/CLI_ASSESSMENT_G
 
 > **v1.25.2+**: Protocol Compliance is a unified module combining MCP Spec Compliance and Protocol Conformance. See [CLI Guide](docs/CLI_ASSESSMENT_GUIDE.md) for details.
 
-### Opt-In Modules (2)
+### Opt-In Modules (3)
 
-| Module                      | Purpose                        | Requirement                                            |
-| --------------------------- | ------------------------------ | ------------------------------------------------------ |
-| **File Modularization**     | Code organization quality      | `--source` flag (source code analysis)                 |
-| **MCP Conformance Testing** | Official conformance scenarios | HTTP/SSE transport + @modelcontextprotocol/conformance |
+| Module                       | Purpose                        | Requirement                                            |
+| ---------------------------- | ------------------------------ | ------------------------------------------------------ |
+| **Dependency Vulnerability** | npm/yarn/pnpm audit scanning   | `--source` flag (requires shell execution)             |
+| **File Modularization**      | Code organization quality      | `--source` flag (source code analysis)                 |
+| **MCP Conformance Testing**  | Official conformance scenarios | HTTP/SSE transport + @modelcontextprotocol/conformance |
 
 For detailed module documentation, see [Assessment Catalog](docs/ASSESSMENT_CATALOG.md).
 
@@ -208,10 +209,10 @@ mcp-assess-full --server my-server --output ./results.json
 cat /tmp/inspector-full-assessment-my-server.json | jq '.overallStatus'
 
 # List security vulnerabilities
-cat /tmp/inspector-full-assessment-my-server.json | jq '.security.vulnerabilities'
+cat /tmp/inspector-full-assessment-my-server.json | jq '.modules.security.vulnerabilities'
 
 # Check broken tools
-cat /tmp/inspector-full-assessment-my-server.json | jq '.functionality.brokenTools'
+cat /tmp/inspector-full-assessment-my-server.json | jq '.modules.functionality.brokenTools'
 
 # Get module scores
 cat /tmp/inspector-full-assessment-my-server.json | jq '.moduleSummary'

package/cli/build/lib/assessment-runner/tools-with-hints.js

@@ -85,6 +85,19 @@ export async function getToolsWithPreservedHints(client) {
             }
             // Start with SDK tool
             const enrichedTool = { ...sdkTool };
+            // Issue #207: Preserve complete annotations object from raw response
+            // This ensures runtime-defined annotations are not lost when SDK strips them
+            if (rawTool.annotations && Object.keys(rawTool.annotations).length > 0) {
+                enrichedTool.annotations = {
+                    ...sdkTool.annotations, // Keep any SDK-preserved annotations
+                    ...rawTool.annotations, // Override with raw response annotations
+                };
+                // Debug logging when DEBUG_ANNOTATIONS env var is set
+                if (process.env.DEBUG_ANNOTATIONS) {
+                    // eslint-disable-next-line no-console
+                    console.log(`[DEBUG-HINTS] ${rawTool.name}: Preserved annotations object:`, JSON.stringify(enrichedTool.annotations));
+                }
+            }
             // Preserve hint properties from raw response (priority order)
             for (const hint of HINT_PROPERTIES) {
                 // Skip if SDK already has it via annotations

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bryan-thompson/inspector-assessment-cli",
-  "version": "1.42.3",
+  "version": "1.43.1",
   "description": "CLI for the Enhanced MCP Inspector with assessment capabilities",
   "license": "MIT",
   "author": "Bryan Thompson <bryan@triepod.ai>",

package/client/dist/assets/{OAuthCallback-H5nh9rjO.js → OAuthCallback-ngu_aFUO.js}

@@ -1,4 +1,4 @@
-import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-nFJkXyWc.js";
+import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-97IA_LWd.js";
 const OAuthCallback = ({ onConnect }) => {
   const { toast } = useToast();
   const hasProcessedRef = reactExports.useRef(false);

package/client/dist/assets/{OAuthDebugCallback-Drqf42qG.js → OAuthDebugCallback-CsGYu8op.js}

@@ -1,4 +1,4 @@
-import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-nFJkXyWc.js";
+import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-97IA_LWd.js";
 const OAuthDebugCallback = ({ onConnect }) => {
   reactExports.useEffect(() => {
     let isProcessed = false;

package/client/dist/assets/{index-nFJkXyWc.js → index-97IA_LWd.js}

@@ -16373,7 +16373,7 @@ object({
   token_type_hint: string().optional()
 }).strip();
 const name = "@bryan-thompson/inspector-assessment-client";
-const version$1 = "1.42.3";
+const version$1 = "1.43.1";
 const packageJson = {
   name,
   version: version$1
@@ -49456,7 +49456,7 @@ const useTheme = () => {
     [theme, setThemeWithSideEffect]
   );
 };
-const version = "1.42.3";
+const version = "1.43.1";
 var [createTooltipContext] = createContextScope("Tooltip", [
   createPopperScope
 ]);
@@ -52799,13 +52799,13 @@ const App = () => {
   };
   if (window.location.pathname === "/oauth/callback") {
     const OAuthCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthCallback-H5nh9rjO.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthCallback-ngu_aFUO.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthCallback, { onConnect: onOAuthConnect }) });
   }
   if (window.location.pathname === "/oauth/callback/debug") {
     const OAuthDebugCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthDebugCallback-Drqf42qG.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthDebugCallback-CsGYu8op.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthDebugCallback, { onConnect: onOAuthDebugConnect }) });
   }

package/client/dist/index.html

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-nFJkXyWc.js"></script>
+    <script type="module" crossorigin src="/assets/index-97IA_LWd.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-BoUA5OL1.css">
   </head>
   <body>

package/client/lib/lib/assessment/configSchemas.d.ts

@@ -184,6 +184,7 @@ export declare const AssessmentCategoriesSchema: z.ZodObject<{
     aupCompliance: z.ZodOptional<z.ZodBoolean>;
     toolAnnotations: z.ZodOptional<z.ZodBoolean>;
     prohibitedLibraries: z.ZodOptional<z.ZodBoolean>;
+    dependencyVulnerability: z.ZodOptional<z.ZodBoolean>;
     manifestValidation: z.ZodOptional<z.ZodBoolean>;
     portability: z.ZodOptional<z.ZodBoolean>;
     externalAPIScanner: z.ZodOptional<z.ZodBoolean>;
@@ -216,6 +217,7 @@ export declare const AssessmentCategoriesSchema: z.ZodObject<{
     protocolConformance?: boolean;
     protocolCompliance?: boolean;
     fileModularization?: boolean;
+    dependencyVulnerability?: boolean;
 }, {
     functionality?: boolean;
     security?: boolean;
@@ -237,6 +239,7 @@ export declare const AssessmentCategoriesSchema: z.ZodObject<{
     protocolConformance?: boolean;
     protocolCompliance?: boolean;
     fileModularization?: boolean;
+    dependencyVulnerability?: boolean;
 }>;
 /**
  * Schema for documentation verbosity level.
@@ -396,6 +399,7 @@ export declare const AssessmentConfigurationSchema: z.ZodObject<{
         aupCompliance: z.ZodOptional<z.ZodBoolean>;
         toolAnnotations: z.ZodOptional<z.ZodBoolean>;
         prohibitedLibraries: z.ZodOptional<z.ZodBoolean>;
+        dependencyVulnerability: z.ZodOptional<z.ZodBoolean>;
         manifestValidation: z.ZodOptional<z.ZodBoolean>;
         portability: z.ZodOptional<z.ZodBoolean>;
         externalAPIScanner: z.ZodOptional<z.ZodBoolean>;
@@ -428,6 +432,7 @@ export declare const AssessmentConfigurationSchema: z.ZodObject<{
         protocolConformance?: boolean;
         protocolCompliance?: boolean;
         fileModularization?: boolean;
+        dependencyVulnerability?: boolean;
     }, {
         functionality?: boolean;
         security?: boolean;
@@ -449,6 +454,7 @@ export declare const AssessmentConfigurationSchema: z.ZodObject<{
         protocolConformance?: boolean;
         protocolCompliance?: boolean;
         fileModularization?: boolean;
+        dependencyVulnerability?: boolean;
     }>>;
 }, "strip", z.ZodTypeAny, {
     mcpProtocolVersion?: string;
@@ -473,6 +479,7 @@ export declare const AssessmentConfigurationSchema: z.ZodObject<{
         protocolConformance?: boolean;
         protocolCompliance?: boolean;
         fileModularization?: boolean;
+        dependencyVulnerability?: boolean;
     };
     configVersion?: number;
     testTimeout?: number;
@@ -539,6 +546,7 @@ export declare const AssessmentConfigurationSchema: z.ZodObject<{
         protocolConformance?: boolean;
         protocolCompliance?: boolean;
         fileModularization?: boolean;
+        dependencyVulnerability?: boolean;
     };
     configVersion?: number;
     testTimeout?: number;
@@ -636,6 +644,7 @@ export declare function safeParseAssessmentConfig(config: unknown): z.SafeParseR
         protocolConformance?: boolean;
         protocolCompliance?: boolean;
         fileModularization?: boolean;
+        dependencyVulnerability?: boolean;
     };
     configVersion?: number;
     testTimeout?: number;
@@ -702,6 +711,7 @@ export declare function safeParseAssessmentConfig(config: unknown): z.SafeParseR
         protocolConformance?: boolean;
         protocolCompliance?: boolean;
         fileModularization?: boolean;
+        dependencyVulnerability?: boolean;
     };
     configVersion?: number;
     testTimeout?: number;

package/client/lib/lib/assessment/configSchemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configSchemas.d.ts","sourceRoot":"","sources":["../../../src/lib/assessment/configSchemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;AAM9C;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAI9B,CAAC;AAMH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;EAIpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;EAKnC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBhC,CAAC;AAMJ;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;IAMrC,iDAAiD;;;;;;;;;;;;;;IAcjD,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGjD,CAAC;AAMH;;GAEG;AACH,eAAO,MAAM,4BAA4B,+CAIvC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;IAYxC,sDAAsD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA/CtD,iDAAiD;;;;;;;;;;;;;;QAcjD,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8CjD,CAAC;AAMH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,0BAA0B,CAClC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,6BAA6B,CACrC,CAAC;AAMF;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,GACd,6BAA6B,CAE/B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAExD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAWlE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAWlE"}
+{"version":3,"file":"configSchemas.d.ts","sourceRoot":"","sources":["../../../src/lib/assessment/configSchemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;AAM9C;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAI9B,CAAC;AAMH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;EAIpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;EAKnC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBhC,CAAC;AAMJ;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;IAMrC,iDAAiD;;;;;;;;;;;;;;;IAejD,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGjD,CAAC;AAMH;;GAEG;AACH,eAAO,MAAM,4BAA4B,+CAIvC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;IAYxC,sDAAsD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAhDtD,iDAAiD;;;;;;;;;;;;;;;QAejD,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8CjD,CAAC;AAMH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,0BAA0B,CAClC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,6BAA6B,CACrC,CAAC;AAMF;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,OAAO,GACd,6BAA6B,CAE/B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAExD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAWlE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAWlE"}

package/client/lib/lib/assessment/configSchemas.js

@@ -79,6 +79,7 @@ export const AssessmentCategoriesSchema = z.object({
     aupCompliance: z.boolean().optional(),
     toolAnnotations: z.boolean().optional(),
     prohibitedLibraries: z.boolean().optional(),
+    dependencyVulnerability: z.boolean().optional(),
     manifestValidation: z.boolean().optional(),
     portability: z.boolean().optional(),
     externalAPIScanner: z.boolean().optional(),

package/client/lib/lib/assessment/configTypes.d.ts

@@ -86,6 +86,7 @@ export interface AssessmentConfiguration {
         aupCompliance?: boolean;
         toolAnnotations?: boolean;
         prohibitedLibraries?: boolean;
+        dependencyVulnerability?: boolean;
         manifestValidation?: boolean;
         portability?: boolean;
         externalAPIScanner?: boolean;

package/client/lib/lib/assessment/configTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configTypes.d.ts","sourceRoot":"","sources":["../../../src/lib/assessment/configTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,QAAQ,EACR,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,sDAAsD;AACtD,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AACxC,4CAA4C;AAC5C,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAElC;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE;QACR,yBAAyB,EAAE,OAAO,CAAC;QACnC,mBAAmB,EAAE,OAAO,CAAC;QAC7B,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oBAAoB,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,6GAA6G;IAC7G,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IAEzB,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC,sBAAsB,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAI5D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,4FAA4F;IAC5F,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,oBAAoB,CAAC,EAAE;QACrB,aAAa,EAAE,OAAO,CAAC;QACvB,QAAQ,EAAE,OAAO,CAAC;QAClB,aAAa,EAAE,OAAO,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC;QACvB,SAAS,EAAE,OAAO,CAAC;QACnB,6EAA6E;QAC7E,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAE5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,eAAe,CAAC,EAAE,OAAO,CAAC;QAE1B,6EAA6E;QAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,uBAuCvC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,uBAwClC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,uBAuCnC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,uBAuC/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,uBAkD1C,CAAC"}
+{"version":3,"file":"configTypes.d.ts","sourceRoot":"","sources":["../../../src/lib/assessment/configTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,QAAQ,EACR,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,sDAAsD;AACtD,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AACxC,4CAA4C;AAC5C,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAElC;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE;QACR,yBAAyB,EAAE,OAAO,CAAC;QACnC,mBAAmB,EAAE,OAAO,CAAC;QAC7B,mBAAmB,EAAE,OAAO,CAAC;QAC7B,oBAAoB,EAAE,OAAO,CAAC;KAC/B,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,6GAA6G;IAC7G,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IAEzB,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC,sBAAsB,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAI5D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,4FAA4F;IAC5F,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kDAAkD;IAClD,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,oBAAoB,CAAC,EAAE;QACrB,aAAa,EAAE,OAAO,CAAC;QACvB,QAAQ,EAAE,OAAO,CAAC;QAClB,aAAa,EAAE,OAAO,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC;QACvB,SAAS,EAAE,OAAO,CAAC;QACnB,6EAA6E;QAC7E,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAE5B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,uBAAuB,CAAC,EAAE,OAAO,CAAC;QAClC,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,eAAe,CAAC,EAAE,OAAO,CAAC;QAE1B,6EAA6E;QAC7E,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,kBAAkB,CAAC,EAAE,OAAO,CAAC;QAE7B,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC;IACF;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,uBAwCvC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,uBAwClC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,uBAuCnC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,uBAuC/B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,uBAkD1C,CAAC"}

package/client/lib/lib/assessment/configTypes.js

@@ -42,6 +42,7 @@ export const DEFAULT_ASSESSMENT_CONFIG = {
         aupCompliance: false,
         toolAnnotations: false,
         prohibitedLibraries: false,
+        dependencyVulnerability: false, // Issue #193 - npm/yarn/pnpm audit (opt-in, requires shell)
         manifestValidation: false,
         portability: false,
         externalAPIScanner: false,

package/client/lib/lib/assessment/dependencyVulnerabilityTypes.d.ts

@@ -0,0 +1,227 @@
+/**
+ * Dependency Vulnerability Assessment Types
+ *
+ * Types for npm/yarn/pnpm dependency vulnerability detection via package manager audits.
+ * Implements Issue #193: Add npm/yarn dependency vulnerability detection module.
+ *
+ * @module assessment/dependencyVulnerabilityTypes
+ */
+import type { AssessmentStatus } from "./coreTypes.js";
+/**
+ * Severity level for dependency vulnerabilities.
+ * Matches npm audit severity levels.
+ */
+export type VulnerabilitySeverity = "critical" | "high" | "moderate" | "low";
+/**
+ * Package manager detected and used for audit.
+ */
+export type PackageManager = "npm" | "yarn" | "pnpm" | "unknown";
+/**
+ * Lock file type mapping to package manager.
+ */
+export type LockFileType = "package-lock.json" | "yarn.lock" | "pnpm-lock.yaml" | "none";
+/**
+ * Individual vulnerability finding from audit.
+ */
+export interface DependencyVulnerability {
+    /** Package name with vulnerability */
+    packageName: string;
+    /** Current installed version */
+    version: string;
+    /** Severity level */
+    severity: VulnerabilitySeverity;
+    /** Advisory title/description */
+    advisory: string;
+    /** CVE identifier if available */
+    cve?: string;
+    /** Fixed version if available */
+    fixedIn?: string;
+    /** Dependency path (direct or transitive) */
+    dependencyPath: string[];
+    /** Whether a fix is available */
+    fixAvailable: boolean;
+    /** Whether this is a direct or transitive dependency */
+    isDirect: boolean;
+}
+/**
+ * Summary counts by severity level.
+ */
+export interface VulnerabilityCounts {
+    critical: number;
+    high: number;
+    moderate: number;
+    low: number;
+}
+/**
+ * Audit execution metadata.
+ */
+export interface AuditExecutionInfo {
+    /** Package manager used */
+    packageManager: PackageManager;
+    /** Lock file detected */
+    lockFilePresent: boolean;
+    /** Lock file type (package-lock.json, yarn.lock, pnpm-lock.yaml) */
+    lockFileType: LockFileType;
+    /** Audit command executed */
+    auditCommand: string;
+    /** Execution time in ms */
+    executionTimeMs: number;
+    /** Whether audit completed successfully */
+    auditCompleted: boolean;
+    /** Error message if audit failed */
+    auditError?: string;
+}
+/**
+ * Main assessment result interface.
+ * Field name matches Issue #193 spec: dependencyVulnerability
+ */
+export interface DependencyVulnerabilityAssessment {
+    /** Whether a package manager was detected */
+    hasPackageManager: boolean;
+    /** Audit execution information */
+    auditInfo: AuditExecutionInfo;
+    /** Summary counts by severity */
+    vulnerabilities: VulnerabilityCounts;
+    /** Total number of advisories found */
+    totalAdvisories: number;
+    /** Individual vulnerability details */
+    findings: DependencyVulnerability[];
+    /** Computed score penalty (based on severity scoring) */
+    scorePenalty: number;
+    /** Assessment status */
+    status: AssessmentStatus;
+    /** Human-readable explanation */
+    explanation: string;
+    /** Actionable recommendations */
+    recommendations: string[];
+    /** Whether assessment was skipped */
+    skipped?: boolean;
+    /** Reason for skipping if applicable */
+    skipReason?: string;
+    /** Stage B enrichment data for Claude validation (future) */
+    enrichmentData?: DependencyVulnerabilityEnrichmentData;
+}
+/**
+ * Enrichment data for Stage B Claude validation.
+ * Can be used for more sophisticated analysis in future releases.
+ */
+export interface DependencyVulnerabilityEnrichmentData {
+    /** Top critical/high vulnerabilities for review */
+    topVulnerabilities: DependencyVulnerability[];
+    /** Summary metrics */
+    metrics: {
+        /** Total packages scanned */
+        totalPackages: number;
+        /** Number of packages with vulnerabilities */
+        vulnerablePackages: number;
+        /** Vulnerabilities in direct dependencies */
+        directDependencyVulns: number;
+        /** Vulnerabilities in transitive dependencies */
+        transitiveDependencyVulns: number;
+    };
+}
+/**
+ * npm vulnerability entry structure
+ */
+export interface NpmVulnerabilityEntry {
+    name: string;
+    severity: string;
+    via: Array<string | {
+        title?: string;
+        url?: string;
+        source?: number;
+    }>;
+    effects?: string[];
+    range?: string;
+    nodes?: string[];
+    fixAvailable?: boolean | {
+        name: string;
+        version: string;
+        isSemVerMajor: boolean;
+    };
+}
+/**
+ * npm audit --json output structure (npm v7+).
+ * Used internally for parsing.
+ */
+export interface NpmAuditOutput {
+    vulnerabilities?: Record<string, NpmVulnerabilityEntry>;
+    metadata?: {
+        vulnerabilities?: VulnerabilityCounts;
+        dependencies?: {
+            prod: number;
+            dev: number;
+            optional: number;
+            peer: number;
+            peerOptional: number;
+            total: number;
+        };
+    };
+}
+/**
+ * yarn audit --json output structure.
+ * Yarn emits newline-delimited JSON objects.
+ */
+export interface YarnAuditEntry {
+    type: "auditAdvisory" | "auditSummary";
+    data: {
+        resolution: {
+            id: number;
+            path: string;
+            dev: boolean;
+            optional: boolean;
+            bundled: boolean;
+        };
+        advisory: {
+            module_name: string;
+            severity: string;
+            title: string;
+            url?: string;
+            cves?: string[];
+            patched_versions?: string;
+            vulnerable_versions?: string;
+        };
+    } | {
+        vulnerabilities: {
+            info: number;
+            low: number;
+            moderate: number;
+            high: number;
+            critical: number;
+        };
+        dependencies: number;
+        devDependencies: number;
+        optionalDependencies: number;
+        totalDependencies: number;
+    };
+}
+/**
+ * pnpm advisory entry structure
+ */
+export interface PnpmAdvisoryEntry {
+    module_name: string;
+    severity: string;
+    title: string;
+    url?: string;
+    cves?: string[];
+    vulnerable_versions?: string;
+    patched_versions?: string;
+    findings?: Array<{
+        version: string;
+        paths: string[];
+    }>;
+}
+/**
+ * pnpm audit --json output structure.
+ * Similar to npm but with some differences.
+ */
+export interface PnpmAuditOutput {
+    advisories?: Record<string, PnpmAdvisoryEntry>;
+    metadata?: {
+        vulnerabilities?: VulnerabilityCounts;
+        dependencies?: number;
+        devDependencies?: number;
+        totalDependencies?: number;
+    };
+}
+//# sourceMappingURL=dependencyVulnerabilityTypes.d.ts.map

package/client/lib/lib/assessment/dependencyVulnerabilityTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencyVulnerabilityTypes.d.ts","sourceRoot":"","sources":["../../../src/lib/assessment/dependencyVulnerabilityTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAMpD;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;AAE7E;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAEjE;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,mBAAmB,GACnB,WAAW,GACX,gBAAgB,GAChB,MAAM,CAAC;AAMX;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iCAAiC;IACjC,YAAY,EAAE,OAAO,CAAC;IACtB,wDAAwD;IACxD,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,2BAA2B;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,yBAAyB;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,YAAY,EAAE,YAAY,CAAC;IAC3B,6BAA6B;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,2BAA2B;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,cAAc,EAAE,OAAO,CAAC;IACxB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,iCAAiC;IAChD,6CAA6C;IAC7C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kCAAkC;IAClC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,iCAAiC;IACjC,eAAe,EAAE,mBAAmB,CAAC;IACrC,uCAAuC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,EAAE,uBAAuB,EAAE,CAAC;IACpC,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,MAAM,EAAE,gBAAgB,CAAC;IACzB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,qCAAqC;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,qCAAqC,CAAC;CACxD;AAMD;;;GAGG;AACH,MAAM,WAAW,qCAAqC;IACpD,mDAAmD;IACnD,kBAAkB,EAAE,uBAAuB,EAAE,CAAC;IAC9C,sBAAsB;IACtB,OAAO,EAAE;QACP,6BAA6B;QAC7B,aAAa,EAAE,MAAM,CAAC;QACtB,8CAA8C;QAC9C,kBAAkB,EAAE,MAAM,CAAC;QAC3B,6CAA6C;QAC7C,qBAAqB,EAAE,MAAM,CAAC;QAC9B,iDAAiD;QACjD,yBAAyB,EAAE,MAAM,CAAC;KACnC,CAAC;CACH;AAMD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EACT,OAAO,GACP;QACE,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;CACP;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE;QACT,eAAe,CAAC,EAAE,mBAAmB,CAAC;QACtC,YAAY,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,EAAE,MAAM,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC;YACb,YAAY,EAAE,MAAM,CAAC;YACrB,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;KACH,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,eAAe,GAAG,cAAc,CAAC;IACvC,IAAI,EACA;QACE,UAAU,EAAE;YACV,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,OAAO,CAAC;YACb,QAAQ,EAAE,OAAO,CAAC;YAClB,OAAO,EAAE,OAAO,CAAC;SAClB,CAAC;QACF,QAAQ,EAAE;YACR,WAAW,EAAE,MAAM,CAAC;YACpB,QAAQ,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE,MAAM,CAAC;YACd,GAAG,CAAC,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;YAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;SAC9B,CAAC;KACH,GACD;QACE,eAAe,EAAE;YACf,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,EAAE,MAAM,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;QACF,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC;QACxB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;CACP;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE;QACT,eAAe,CAAC,EAAE,mBAAmB,CAAC;QACtC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH"}

package/client/lib/lib/assessment/dependencyVulnerabilityTypes.js

@@ -0,0 +1,9 @@
+/**
+ * Dependency Vulnerability Assessment Types
+ *
+ * Types for npm/yarn/pnpm dependency vulnerability detection via package manager audits.
+ * Implements Issue #193: Add npm/yarn dependency vulnerability detection module.
+ *
+ * @module assessment/dependencyVulnerabilityTypes
+ */
+export {};

package/client/lib/lib/assessment/extendedTypes.d.ts

@@ -25,4 +25,5 @@ export * from "./policyComplianceTypes.js";
 export * from "./externalServicesTypes.js";
 export * from "./temporalSecurityTypes.js";
 export * from "./capabilityAssessmentTypes.js";
+export * from "./dependencyVulnerabilityTypes.js";
 //# sourceMappingURL=extendedTypes.d.ts.map

package/client/lib/lib/assessment/extendedTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extendedTypes.d.ts","sourceRoot":"","sources":["../../../src/lib/assessment/extendedTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"extendedTypes.d.ts","sourceRoot":"","sources":["../../../src/lib/assessment/extendedTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC"}

package/client/lib/lib/assessment/extendedTypes.js

@@ -26,3 +26,4 @@ export * from "./policyComplianceTypes.js";
 export * from "./externalServicesTypes.js";
 export * from "./temporalSecurityTypes.js";
 export * from "./capabilityAssessmentTypes.js";
+export * from "./dependencyVulnerabilityTypes.js";

package/client/lib/lib/assessment/index.d.ts

@@ -20,6 +20,7 @@ export * from "./configTypes.js";
 export * from "./aupComplianceTypes.js";
 export * from "./toolAnnotationTypes.js";
 export * from "./policyComplianceTypes.js";
+export * from "./dependencyVulnerabilityTypes.js";
 export * from "./externalServicesTypes.js";
 export * from "./temporalSecurityTypes.js";
 export * from "./capabilityAssessmentTypes.js";

package/client/lib/lib/assessment/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/assessment/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgCH,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAG9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAGhC,cAAc,eAAe,CAAC;AAG9B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/assessment/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgCH,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAG9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAGhC,cAAc,eAAe,CAAC;AAG9B,cAAc,aAAa,CAAC"}

package/client/lib/lib/assessment/index.js

@@ -50,6 +50,7 @@ export * from "./configTypes.js";
 export * from "./aupComplianceTypes.js";
 export * from "./toolAnnotationTypes.js";
 export * from "./policyComplianceTypes.js";
+export * from "./dependencyVulnerabilityTypes.js";
 export * from "./externalServicesTypes.js";
 export * from "./temporalSecurityTypes.js";
 export * from "./capabilityAssessmentTypes.js";

package/client/lib/lib/assessment/resultTypes.d.ts

@@ -8,7 +8,7 @@
  */
 import type { AssessmentStatus, SecurityRiskLevel, NamespaceDetectionResult } from "./coreTypes.js";
 export type { NamespaceDetectionResult };
-import type { AUPComplianceAssessment, ToolAnnotationAssessment, ProhibitedLibrariesAssessment, ManifestValidationAssessment, PortabilityAssessment, ExternalAPIScannerAssessment, AuthenticationAssessment, TemporalAssessment, ResourceAssessment, PromptAssessment, CrossCapabilitySecurityAssessment, ProtocolConformanceAssessment, FileModularizationAssessment, ConformanceAssessment, DeveloperExperienceAssessment } from "./extendedTypes.js";
+import type { AUPComplianceAssessment, ToolAnnotationAssessment, ProhibitedLibrariesAssessment, ManifestValidationAssessment, PortabilityAssessment, ExternalAPIScannerAssessment, AuthenticationAssessment, TemporalAssessment, ResourceAssessment, PromptAssessment, CrossCapabilitySecurityAssessment, ProtocolConformanceAssessment, FileModularizationAssessment, ConformanceAssessment, DeveloperExperienceAssessment, DependencyVulnerabilityAssessment } from "./extendedTypes.js";
 export interface TestInputMetadata {
     toolCategory: string;
     generationStrategy: string;
@@ -177,7 +177,17 @@ export interface DocumentationQualityChecks {
     hasInstallation: boolean;
     hasConfiguration: boolean;
     hasExamples: boolean;
+    /**
+     * @deprecated Use hasLicenseFile for file-based check. Kept for backward compatibility.
+     * True if either license file exists OR declaration exists (legacy behavior)
+     */
     hasLicense: boolean;
+    /** Issue #208: True only if actual LICENSE file exists (LICENSE, LICENSE.md, etc.) */
+    hasLicenseFile: boolean;
+    /** Issue #208: True if license declared in package.json/manifest or README section (but no file) */
+    hasLicenseDeclaration: boolean;
+    /** Issue #208: Actual license file name if found */
+    licenseFile?: string;
     licenseType?: string;
 }
 /**
@@ -803,6 +813,8 @@ export interface MCPDirectoryAssessment {
     aupCompliance?: AUPComplianceAssessment;
     toolAnnotations?: ToolAnnotationAssessment;
     prohibitedLibraries?: ProhibitedLibrariesAssessment;
+    /** Dependency vulnerability audit results (npm/yarn/pnpm audit) - Issue #193 */
+    dependencyVulnerability?: DependencyVulnerabilityAssessment;
     manifestValidation?: ManifestValidationAssessment;
     portability?: PortabilityAssessment;
     externalAPIScanner?: ExternalAPIScannerAssessment;