@vyuhlabs/dxkit 1.5.0 → 1.6.0

package/dist/analyzers/tools/gitleaks.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Gitleaks integration -- secret scanning with 800+ patterns.
+ * Layer 2 (optional): requires `gitleaks` binary.
+ */
+import { HealthMetrics } from '../types';
+/** Gather secret scanning metrics via gitleaks. */
+export declare function gatherGitleaksMetrics(cwd: string): Partial<HealthMetrics>;
+//# sourceMappingURL=gitleaks.d.ts.map

package/dist/analyzers/tools/gitleaks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/gitleaks.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAczC,mDAAmD;AACnD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA4DzE"}

package/dist/analyzers/tools/gitleaks.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatherGitleaksMetrics = gatherGitleaksMetrics;
+const runner_1 = require("./runner");
+const tool_registry_1 = require("./tool-registry");
+const exclusions_1 = require("./exclusions");
+const suppressions_1 = require("./suppressions");
+/** Gather secret scanning metrics via gitleaks. */
+function gatherGitleaksMetrics(cwd) {
+    const gitleaksCmd = findGitleaks(cwd);
+    if (!gitleaksCmd) {
+        return { toolsUnavailable: ['gitleaks'] };
+    }
+    // Run gitleaks with JSON report (--no-git scans files, not git history)
+    const reportPath = `/tmp/dxkit-gitleaks-${Date.now()}.json`;
+    (0, runner_1.run)(`${gitleaksCmd} detect --source '${cwd}' --report-format json --report-path '${reportPath}' --no-git --exit-code 0 2>/dev/null`, cwd, 120000);
+    // Read report file
+    const reportRaw = (0, runner_1.run)(`cat '${reportPath}' 2>/dev/null`, cwd);
+    // Clean up
+    (0, runner_1.run)(`rm -f '${reportPath}'`, cwd);
+    if (!reportRaw) {
+        return { toolsUnavailable: ['gitleaks (no output)'] };
+    }
+    try {
+        const findings = JSON.parse(reportRaw);
+        if (!Array.isArray(findings)) {
+            return { toolsUsed: ['gitleaks'] };
+        }
+        const secretDetails = findings.map((f) => ({
+            file: f.File.replace(cwd + '/', '').replace(cwd, ''),
+            line: f.StartLine,
+            rule: f.RuleID,
+            severity: f.RuleID.includes('private-key') ? 'critical' : 'high',
+        }));
+        // Post-filter using project exclusions. Gitleaks --no-git scans everything
+        // on disk (ignores .gitignore), so we re-apply the resolved exclusion set
+        // via the centralized isExcludedPath() predicate.
+        const filtered = secretDetails.filter((d) => !(0, exclusions_1.isExcludedPath)(cwd, d.file));
+        // Apply user-defined suppressions from `.dxkit-suppressions.json` so
+        // known-false positives (test fixtures, approved exceptions) don't count.
+        const suppressions = (0, suppressions_1.loadSuppressions)(cwd);
+        const { kept, suppressed } = (0, suppressions_1.applySuppressions)(filtered, suppressions.gitleaks, (d) => d.rule, (d) => d.file);
+        return {
+            secretFindings: kept.length,
+            secretDetails: kept,
+            secretSuppressed: suppressed.length,
+            toolsUsed: ['gitleaks'],
+        };
+    }
+    catch {
+        return { toolsUnavailable: ['gitleaks (parse error)'] };
+    }
+}
+function findGitleaks(cwd) {
+    const status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.gitleaks, cwd);
+    return status.available ? status.path : null;
+}
+//# sourceMappingURL=gitleaks.js.map

package/dist/analyzers/tools/gitleaks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../../src/analyzers/tools/gitleaks.ts"],"names":[],"mappings":";;AAmBA,sDA4DC;AA1ED,qCAA+B;AAC/B,mDAAsD;AACtD,6CAA8C;AAC9C,iDAAqE;AAUrE,mDAAmD;AACnD,SAAgB,qBAAqB,CAAC,GAAW;IAC/C,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,gBAAgB,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,wEAAwE;IACxE,MAAM,UAAU,GAAG,uBAAuB,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;IAC5D,IAAA,YAAG,EACD,GAAG,WAAW,qBAAqB,GAAG,yCAAyC,UAAU,sCAAsC,EAC/H,GAAG,EACH,MAAM,CACP,CAAC;IAEF,mBAAmB;IACnB,MAAM,SAAS,GAAG,IAAA,YAAG,EAAC,QAAQ,UAAU,eAAe,EAAE,GAAG,CAAC,CAAC;IAC9D,WAAW;IACX,IAAA,YAAG,EAAC,UAAU,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,gBAAgB,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,aAAa,GAAmC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;YACpD,IAAI,EAAE,CAAC,CAAC,SAAS;YACjB,IAAI,EAAE,CAAC,CAAC,MAAM;YACd,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;SACjE,CAAC,CAAC,CAAC;QAEJ,2EAA2E;QAC3E,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,2BAAc,EAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAE3E,qEAAqE;QACrE,0EAA0E;QAC1E,MAAM,YAAY,GAAG,IAAA,+BAAgB,EAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,IAAA,gCAAiB,EAC5C,QAAQ,EACR,YAAY,CAAC,QAAQ,EACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EACb,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAC;QAEF,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,UAAU,CAAC,MAAM;YACnC,SAAS,EAAE,CAAC,UAAU,CAAC;SACxB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC"}

package/dist/analyzers/tools/graphify.d.ts

@@ -0,0 +1,4 @@
+import { HealthMetrics } from '../types';
+/** Gather AST-derived metrics via graphify. */
+export declare function gatherGraphifyMetrics(cwd: string): Partial<HealthMetrics>;
+//# sourceMappingURL=graphify.d.ts.map

package/dist/analyzers/tools/graphify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphify.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/graphify.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAyIzC,+CAA+C;AAC/C,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAqDzE"}

package/dist/analyzers/tools/graphify.js

@@ -0,0 +1,222 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatherGraphifyMetrics = gatherGraphifyMetrics;
+/**
+ * Graphify integration -- deterministic AST extraction via tree-sitter.
+ * Layer 2 (optional): requires `pip install graphifyy`.
+ *
+ * Runs graphify's Python API via subprocess, parses structured JSON output.
+ * All metrics are derived from EXTRACTED confidence edges only (no LLM).
+ */
+const fs = __importStar(require("fs"));
+const runner_1 = require("./runner");
+const tool_registry_1 = require("./tool-registry");
+const exclusions_1 = require("./exclusions");
+/** Build the graphify Python script with cwd-specific exclusions baked in. */
+function buildGraphifyScript(cwd) {
+    return `# Exclusion set derived from src/analyzers/tools/exclusions.ts
+import json, sys, os, tempfile
+from pathlib import Path
+from collections import Counter
+
+# Redirect graphify cache to /tmp so we don't pollute the target repo
+_cache_dir = Path(tempfile.mkdtemp(prefix='dxkit-graphify-'))
+
+try:
+    from graphify.extract import extract, collect_files
+    from graphify.build import build
+    from graphify.cluster import cluster, score_all
+    from graphify.analyze import god_nodes
+except ImportError:
+    print(json.dumps({"error": "graphify not installed"}))
+    sys.exit(0)
+
+target = Path(sys.argv[1])
+
+# collect_files doesn't exclude node_modules etc, so filter manually
+EXCLUDE_DIRS = ${(0, exclusions_1.getPythonExcludeSet)(cwd)}
+all_files = collect_files(target)
+files = [f for f in all_files if not any(ex in f.parts for ex in EXCLUDE_DIRS)]
+if not files:
+    print(json.dumps({"error": "no files found"}))
+    sys.exit(0)
+
+# Monkey-patch cache to use /tmp instead of target repo
+import graphify.cache as _gc
+_gc.cache_dir = lambda root=None: _cache_dir / "cache"
+(_cache_dir / "cache").mkdir(parents=True, exist_ok=True)
+
+# Suppress progress output by redirecting stdout during extraction
+import io
+_real_stdout = sys.stdout
+sys.stdout = io.StringIO()
+result = extract(files)
+sys.stdout = _real_stdout
+G = build([result], directed=True)
+communities = cluster(G)
+
+# Functions vs modules
+nodes = list(G.nodes(data=True))
+functions = [(n, d) for n, d in nodes if "()" in d.get("label", "")]
+modules = [(n, d) for n, d in nodes if "()" not in d.get("label", "")]
+
+# Functions per file
+file_funcs = Counter()
+for n, d in functions:
+    sf = d.get("source_file", "")
+    file_funcs[sf] += 1
+
+max_file = file_funcs.most_common(1)[0] if file_funcs else ("", 0)
+
+# God nodes (degree > 15)
+gods = god_nodes(G, top_n=50)
+god_count = sum(1 for g in gods if g["edges"] > 15)
+
+# Cohesion
+scores = score_all(G, communities) if communities else {}
+avg_cohesion = sum(scores.values()) / len(scores) if scores else 0.0
+
+# Orphan modules (no inbound imports)
+import_targets = set()
+for u, v, data in G.edges(data=True):
+    if data.get("relation") == "imports_from":
+        import_targets.add(v)
+module_ids = set(n for n, d in modules)
+orphans = module_ids - import_targets
+
+# Dead imports (imported but never called)
+call_targets = set()
+for u, v, data in G.edges(data=True):
+    if data.get("relation") == "calls":
+        call_targets.add(v)
+dead = import_targets - call_targets - module_ids
+
+# Commented code ratio: source files with 0 function/class AST nodes
+source_files_set = set()
+files_with_nodes = set()
+for n, d in nodes:
+    sf = d.get("source_file", "")
+    if sf:
+        source_files_set.add(sf)
+        if "()" in d.get("label", "") or any(
+            data.get("relation") == "method"
+            for _, _, data in G.edges(n, data=True)
+        ):
+            files_with_nodes.add(sf)
+
+total_src = len(source_files_set)
+empty_files = total_src - len(files_with_nodes)
+commented_ratio = empty_files / total_src if total_src > 0 else 0.0
+
+# Clean up temp cache
+import shutil
+shutil.rmtree(str(_cache_dir), ignore_errors=True)
+
+print(json.dumps({
+    "functionCount": len(functions),
+    "classCount": len([n for n, d in modules if any(
+        data.get("relation") == "method" for _, _, data in G.edges(n, data=True)
+    )]),
+    "maxFunctionsInFile": max_file[1] if max_file else 0,
+    "maxFunctionsFilePath": str(max_file[0]) if max_file else "",
+    "godNodeCount": god_count,
+    "communityCount": len(communities),
+    "avgCohesion": round(avg_cohesion, 3),
+    "orphanModuleCount": len(orphans),
+    "deadImportCount": len(dead),
+    "commentedCodeRatio": round(commented_ratio, 3),
+    "sourceFilesInGraph": total_src,
+}))
+`;
+}
+/** Gather AST-derived metrics via graphify. */
+function gatherGraphifyMetrics(cwd) {
+    // findPython already verifies graphify is importable
+    const pythonCmd = findPython(cwd);
+    if (!pythonCmd) {
+        return { toolsUnavailable: ['graphify (not installed)'] };
+    }
+    // Write script to temp file to avoid shell escaping issues
+    const scriptPath = `/tmp/dxkit-graphify-${Date.now()}.py`;
+    fs.writeFileSync(scriptPath, buildGraphifyScript(cwd));
+    // Redirect stderr to suppress progress output, run from /tmp to avoid writing to target
+    const output = (0, runner_1.run)(`cd /tmp && ${pythonCmd} '${scriptPath}' '${cwd}' 2>/dev/null`, cwd, 120000);
+    try {
+        fs.unlinkSync(scriptPath);
+    }
+    catch {
+        /* ignore */
+    }
+    if (!output) {
+        return { toolsUnavailable: ['graphify (failed to run)'] };
+    }
+    // Graphify prints progress to stdout before the JSON — extract only the JSON line
+    const jsonLine = output
+        .split('\n')
+        .filter((l) => l.startsWith('{'))
+        .pop();
+    if (!jsonLine) {
+        return { toolsUnavailable: ['graphify (no JSON output)'] };
+    }
+    try {
+        const data = JSON.parse(jsonLine);
+        if (data.error) {
+            return { toolsUnavailable: [`graphify (${data.error})`] };
+        }
+        return {
+            functionCount: data.functionCount,
+            classCount: data.classCount,
+            maxFunctionsInFile: data.maxFunctionsInFile,
+            maxFunctionsFilePath: data.maxFunctionsFilePath,
+            godNodeCount: data.godNodeCount,
+            communityCount: data.communityCount,
+            avgCohesion: data.avgCohesion,
+            orphanModuleCount: data.orphanModuleCount,
+            deadImportCount: data.deadImportCount,
+            commentedCodeRatio: data.commentedCodeRatio,
+            toolsUsed: ['graphify'],
+        };
+    }
+    catch {
+        return { toolsUnavailable: ['graphify (parse error)'] };
+    }
+}
+/** Find a working python3 that has graphify installed. Delegates to tool-registry. */
+function findPython(cwd) {
+    const status = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.graphify, cwd);
+    return status.available ? status.path : null;
+}
+//# sourceMappingURL=graphify.js.map

package/dist/analyzers/tools/graphify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphify.js","sourceRoot":"","sources":["../../../src/analyzers/tools/graphify.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkJA,sDAqDC;AAvMD;;;;;;GAMG;AACH,uCAAyB;AAEzB,qCAA+B;AAC/B,mDAAsD;AACtD,6CAAmD;AAgBnD,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO;;;;;;;;;;;;;;;;;;;;iBAoBQ,IAAA,gCAAmB,EAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6FxC,CAAC;AACF,CAAC;AAED,+CAA+C;AAC/C,SAAgB,qBAAqB,CAAC,GAAW;IAC/C,qDAAqD;IACrD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,gBAAgB,EAAE,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,2DAA2D;IAC3D,MAAM,UAAU,GAAG,uBAAuB,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,wFAAwF;IACxF,MAAM,MAAM,GAAG,IAAA,YAAG,EAAC,cAAc,SAAS,KAAK,UAAU,MAAM,GAAG,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAChG,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,gBAAgB,EAAE,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,kFAAkF;IAClF,MAAM,QAAQ,GAAG,MAAM;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAChC,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,gBAAgB,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAwC,CAAC;QACzE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,gBAAgB,EAAE,CAAC,aAAa,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC5D,CAAC;QAED,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,SAAS,EAAE,CAAC,UAAU,CAAC;SACxB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,gBAAgB,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC"}

package/dist/analyzers/tools/osv.d.ts

@@ -0,0 +1,51 @@
+/**
+ * OSV.dev severity enrichment.
+ *
+ * Several dependency scanners (pip-audit, govulncheck) report vulnerabilities
+ * without per-finding severity tiers. This module looks up the vulnerability
+ * IDs against https://api.osv.dev/v1/vulns/{id} and classifies them into
+ * critical/high/medium/low buckets.
+ *
+ * Offline safety: if the API is unreachable or an ID is unknown, the caller
+ * falls back to a default bucket (pip-audit → medium, govulncheck → high).
+ * The analyzer must never fail because OSV was slow.
+ */
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'unknown';
+export interface OsvVuln {
+    id?: string;
+    severity?: Array<{
+        type: string;
+        score: string;
+    }>;
+    database_specific?: {
+        severity?: string;
+    };
+    affected?: Array<{
+        severity?: Array<{
+            type: string;
+            score: string;
+        }>;
+    }>;
+}
+/** NVD CVSS 3.x base-score bands. */
+export declare function scoreToTier(score: number): Severity;
+/**
+ * Minimal CVSS v3.0/3.1 base-score calculator.
+ * Spec: https://www.first.org/cvss/v3.1/specification-document#7-1-Base-Metrics-Equations
+ * Returns null if the vector is malformed or missing required metrics.
+ */
+export declare function parseCvssV3BaseScore(vector: string): number | null;
+/** Classify a single OSV record. Prefers CVSS vector, then database_specific string. */
+export declare function classifyOsvSeverity(vuln: OsvVuln): Severity;
+/** Signature of the fetcher — swapped in tests to avoid real network. */
+export type OsvFetcher = (id: string) => Promise<OsvVuln | null>;
+/**
+ * Look up severities for a batch of vuln IDs.
+ * Runs requests in parallel, session-caches results, returns a map keyed by ID.
+ * IDs that fail (network error, 404, unparseable) map to 'unknown' — caller
+ * uses a per-scanner default bucket for those.
+ */
+export declare function enrichSeverities(ids: string[], fetcher?: OsvFetcher): Promise<Map<string, Severity>>;
+/** Test-only — reset the process cache between tests. */
+export declare function __clearOsvCache(): void;
+//# sourceMappingURL=osv.d.ts.map

package/dist/analyzers/tools/osv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/osv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAE1E,MAAM,WAAW,OAAO;IACtB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,iBAAiB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,QAAQ,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACnD,CAAC,CAAC;CACJ;AAKD,qCAAqC;AACrC,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAMnD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2ClE;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAiC3D;AAED,yEAAyE;AACzE,MAAM,MAAM,UAAU,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAwBjE;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,GAAE,UAA4B,GACpC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CA2BhC;AAED,yDAAyD;AACzD,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/analyzers/tools/osv.js

@@ -0,0 +1,188 @@
+"use strict";
+/**
+ * OSV.dev severity enrichment.
+ *
+ * Several dependency scanners (pip-audit, govulncheck) report vulnerabilities
+ * without per-finding severity tiers. This module looks up the vulnerability
+ * IDs against https://api.osv.dev/v1/vulns/{id} and classifies them into
+ * critical/high/medium/low buckets.
+ *
+ * Offline safety: if the API is unreachable or an ID is unknown, the caller
+ * falls back to a default bucket (pip-audit → medium, govulncheck → high).
+ * The analyzer must never fail because OSV was slow.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scoreToTier = scoreToTier;
+exports.parseCvssV3BaseScore = parseCvssV3BaseScore;
+exports.classifyOsvSeverity = classifyOsvSeverity;
+exports.enrichSeverities = enrichSeverities;
+exports.__clearOsvCache = __clearOsvCache;
+const cvss_v4_1 = require("./cvss-v4");
+/** Process-scoped cache so repeated lookups in a session don't re-query. */
+const cache = new Map();
+/** NVD CVSS 3.x base-score bands. */
+function scoreToTier(score) {
+    if (score >= 9.0)
+        return 'critical';
+    if (score >= 7.0)
+        return 'high';
+    if (score >= 4.0)
+        return 'medium';
+    if (score > 0.0)
+        return 'low';
+    return 'unknown';
+}
+/**
+ * Minimal CVSS v3.0/3.1 base-score calculator.
+ * Spec: https://www.first.org/cvss/v3.1/specification-document#7-1-Base-Metrics-Equations
+ * Returns null if the vector is malformed or missing required metrics.
+ */
+function parseCvssV3BaseScore(vector) {
+    if (!vector.startsWith('CVSS:3.'))
+        return null;
+    const parts = new Map();
+    for (const kv of vector.split('/').slice(1)) {
+        const [k, v] = kv.split(':');
+        if (k && v)
+            parts.set(k, v);
+    }
+    // Required base metrics
+    const AV = parts.get('AV');
+    const AC = parts.get('AC');
+    const PR = parts.get('PR');
+    const UI = parts.get('UI');
+    const S = parts.get('S');
+    const C = parts.get('C');
+    const I = parts.get('I');
+    const A = parts.get('A');
+    if (!AV || !AC || !PR || !UI || !S || !C || !I || !A)
+        return null;
+    const avWeights = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
+    const acWeights = { L: 0.77, H: 0.44 };
+    const prUnchanged = { N: 0.85, L: 0.62, H: 0.27 };
+    const prChanged = { N: 0.85, L: 0.68, H: 0.5 };
+    const uiWeights = { N: 0.85, R: 0.62 };
+    const ciaWeights = { H: 0.56, L: 0.22, N: 0 };
+    const av = avWeights[AV];
+    const ac = acWeights[AC];
+    const pr = S === 'C' ? prChanged[PR] : prUnchanged[PR];
+    const ui = uiWeights[UI];
+    const conf = ciaWeights[C];
+    const integ = ciaWeights[I];
+    const avail = ciaWeights[A];
+    if ([av, ac, pr, ui, conf, integ, avail].some((x) => x === undefined))
+        return null;
+    const iss = 1 - (1 - conf) * (1 - integ) * (1 - avail);
+    const impact = S === 'C' ? 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15) : 6.42 * iss;
+    if (impact <= 0)
+        return 0;
+    const exploitability = 8.22 * av * ac * pr * ui;
+    const raw = S === 'C' ? 1.08 * (impact + exploitability) : impact + exploitability;
+    const base = Math.min(raw, 10);
+    // CVSS "round up to one decimal" (ceil to nearest 0.1)
+    return Math.ceil(base * 10) / 10;
+}
+/** Classify a single OSV record. Prefers CVSS vector, then database_specific string. */
+function classifyOsvSeverity(vuln) {
+    // Collect CVSS_V4 + CVSS_V3 entries (top level and inside affected[].severity[]).
+    // V4 is preferred when available since modern CVEs (2025+) increasingly use V4 only.
+    const v4 = [];
+    const v3 = [];
+    const collect = (entries) => {
+        for (const s of entries ?? []) {
+            if (!s.score)
+                continue;
+            if (s.type === 'CVSS_V4')
+                v4.push(s.score);
+            else if (s.type === 'CVSS_V3')
+                v3.push(s.score);
+        }
+    };
+    collect(vuln.severity);
+    for (const a of vuln.affected ?? [])
+        collect(a.severity);
+    let maxScore = -1;
+    for (const vec of v4) {
+        const score = (0, cvss_v4_1.parseCvssV4BaseScore)(vec);
+        if (score !== null && score > maxScore)
+            maxScore = score;
+    }
+    for (const vec of v3) {
+        const score = parseCvssV3BaseScore(vec);
+        if (score !== null && score > maxScore)
+            maxScore = score;
+    }
+    if (maxScore >= 0)
+        return scoreToTier(maxScore);
+    // Fallback: database_specific.severity string (common on GHSA records)
+    const ds = vuln.database_specific?.severity?.toUpperCase();
+    if (ds === 'CRITICAL')
+        return 'critical';
+    if (ds === 'HIGH')
+        return 'high';
+    if (ds === 'MEDIUM' || ds === 'MODERATE')
+        return 'medium';
+    if (ds === 'LOW')
+        return 'low';
+    return 'unknown';
+}
+/**
+ * Per-request timeout. Must be generous enough that concurrent analyzer tools
+ * (gitleaks, semgrep, cloc) don't starve the fetches — 5s proved too aggressive
+ * under full-analyzer load. Unreachable hosts still fail fast via AbortSignal.
+ */
+const OSV_REQUEST_TIMEOUT_MS = 10000;
+const DEFAULT_FETCHER = async (id) => {
+    try {
+        const res = await fetch(`https://api.osv.dev/v1/vulns/${encodeURIComponent(id)}`, {
+            signal: AbortSignal.timeout(OSV_REQUEST_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        return (await res.json());
+    }
+    catch (err) {
+        if (process.env.DXKIT_DEBUG_OSV) {
+            process.stderr.write(`[dxkit-osv] ${id}: ${err.message}\n`);
+        }
+        return null;
+    }
+};
+/**
+ * Look up severities for a batch of vuln IDs.
+ * Runs requests in parallel, session-caches results, returns a map keyed by ID.
+ * IDs that fail (network error, 404, unparseable) map to 'unknown' — caller
+ * uses a per-scanner default bucket for those.
+ */
+async function enrichSeverities(ids, fetcher = DEFAULT_FETCHER) {
+    const result = new Map();
+    const toFetch = [];
+    for (const id of ids) {
+        if (cache.has(id)) {
+            result.set(id, cache.get(id));
+        }
+        else if (!toFetch.includes(id)) {
+            toFetch.push(id);
+        }
+    }
+    if (toFetch.length === 0)
+        return result;
+    const settled = await Promise.allSettled(toFetch.map(async (id) => {
+        const vuln = await fetcher(id);
+        const sev = vuln ? classifyOsvSeverity(vuln) : 'unknown';
+        return [id, sev];
+    }));
+    for (const p of settled) {
+        if (p.status === 'fulfilled') {
+            const [id, sev] = p.value;
+            cache.set(id, sev);
+            result.set(id, sev);
+        }
+    }
+    return result;
+}
+/** Test-only — reset the process cache between tests. */
+function __clearOsvCache() {
+    cache.clear();
+}
+//# sourceMappingURL=osv.js.map

package/dist/analyzers/tools/osv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv.js","sourceRoot":"","sources":["../../../src/analyzers/tools/osv.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAmBH,kCAMC;AAOD,oDA2CC;AAGD,kDAiCC;AAiCD,4CA8BC;AAGD,0CAEC;AAjLD,uCAAiD;AAajD,4EAA4E;AAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C,qCAAqC;AACrC,SAAgB,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,UAAU,CAAC;IACpC,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,QAAQ,CAAC;IAClC,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,MAAc;IACjD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,wBAAwB;IACxB,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAElE,MAAM,SAAS,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;IAChF,MAAM,SAAS,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/D,MAAM,WAAW,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1E,MAAM,SAAS,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;IACvE,MAAM,SAAS,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/D,MAAM,UAAU,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAEtE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnF,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;IAC/F,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,cAAc,CAAC;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/B,uDAAuD;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AACnC,CAAC;AAED,wFAAwF;AACxF,SAAgB,mBAAmB,CAAC,IAAa;IAC/C,kFAAkF;IAClF,qFAAqF;IACrF,MAAM,EAAE,GAAa,EAAE,CAAC;IACxB,MAAM,EAAE,GAAa,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,CAAC,OAAgD,EAAE,EAAE;QACnE,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,SAAS;YACvB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;iBACtC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;QAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEzD,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,EAAE,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAA,8BAAoB,EAAC,GAAG,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,QAAQ;YAAE,QAAQ,GAAG,KAAK,CAAC;IAC3D,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,EAAE,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,QAAQ;YAAE,QAAQ,GAAG,KAAK,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;IAEhD,uEAAuE;IACvE,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC3D,IAAI,EAAE,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACzC,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC;IAC1D,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,SAAS,CAAC;AACnB,CAAC;AAKD;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,MAAM,eAAe,GAAe,KAAK,EAAE,EAAE,EAAE,EAAE;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;YAChF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,sBAAsB,CAAC;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAY,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,KAAM,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACI,KAAK,UAAU,gBAAgB,CACpC,GAAa,EACb,UAAsB,eAAe;IAErC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAExC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAa,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAU,CAAC;IAC5B,CAAC,CAAC,CACH,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACnB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yDAAyD;AACzD,SAAgB,eAAe;IAC7B,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/dist/analyzers/tools/parallel.d.ts

@@ -0,0 +1,8 @@
+import { HealthMetrics } from '../types';
+/**
+ * Run cloc + gitleaks + graphify gather functions in parallel child processes.
+ * Each child calls the real gather function from the existing tool module.
+ * Falls back to sequential on low memory (<1GB free).
+ */
+export declare function gatherLayer2Parallel(cwd: string, verbose?: boolean): Partial<HealthMetrics>;
+//# sourceMappingURL=parallel.d.ts.map

package/dist/analyzers/tools/parallel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parallel.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/parallel.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AASzC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CAoFzF"}