@vyuhlabs/dxkit 1.6.0 → 2.0.0

package/dist/languages/capabilities/descriptors.js

@@ -0,0 +1,250 @@
+"use strict";
+/**
+ * Capability descriptors.
+ *
+ * Each capability the dispatcher knows about has one descriptor. The
+ * descriptor bundles the capability's stable id with its aggregate
+ * function — how to combine multiple providers' results into one
+ * envelope. Aggregation is bespoke per capability rather than a generic
+ * 'sum' / 'append' / 'last' strategy because the merge semantics
+ * legitimately differ (depVulns sums counts AND concats findings AND
+ * joins tool names AND prefers any provider that did osv enrichment),
+ * and a 5-strategy enum would lie about that.
+ *
+ * The dispatcher never calls aggregate() with an empty array — that
+ * case is handled upstream by returning null.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CAPABILITY_REGISTRY = exports.GLOBAL_REGISTRY = exports.PER_PACK_REGISTRY = exports.IMPORTS = exports.STRUCTURAL = exports.DUPLICATION = exports.CODE_PATTERNS = exports.SECRETS = exports.TEST_FRAMEWORK = exports.COVERAGE = exports.LINT = exports.DEP_VULNS = void 0;
+function uniqueJoin(values, sep = ', ') {
+    const seen = new Set();
+    for (const v of values)
+        seen.add(v);
+    return [...seen].join(sep);
+}
+exports.DEP_VULNS = {
+    id: 'depVulns',
+    aggregate(results) {
+        let critical = 0;
+        let high = 0;
+        let medium = 0;
+        let low = 0;
+        const findings = [];
+        let enrichment = null;
+        for (const r of results) {
+            critical += r.counts.critical;
+            high += r.counts.high;
+            medium += r.counts.medium;
+            low += r.counts.low;
+            if (r.findings)
+                findings.push(...r.findings);
+            if (r.enrichment)
+                enrichment = r.enrichment;
+        }
+        return {
+            schemaVersion: 1,
+            tool: uniqueJoin(results.map((r) => r.tool)),
+            enrichment,
+            counts: { critical, high, medium, low },
+            findings: findings.length > 0 ? findings : undefined,
+        };
+    },
+};
+exports.LINT = {
+    id: 'lint',
+    aggregate(results) {
+        let critical = 0;
+        let high = 0;
+        let medium = 0;
+        let low = 0;
+        for (const r of results) {
+            critical += r.counts.critical;
+            high += r.counts.high;
+            medium += r.counts.medium;
+            low += r.counts.low;
+        }
+        return {
+            schemaVersion: 1,
+            tool: uniqueJoin(results.map((r) => r.tool)),
+            counts: { critical, high, medium, low },
+        };
+    },
+};
+exports.COVERAGE = {
+    id: 'coverage',
+    aggregate(results) {
+        // Multiple coverage providers in one repo are uncommon (mono-repos with
+        // mixed stacks would hit this). Last-wins is the deterministic-but-lossy
+        // choice; a smarter merge needs per-language file weighting — future
+        // work when a real multi-pack case surfaces.
+        return results[results.length - 1];
+    },
+};
+exports.TEST_FRAMEWORK = {
+    id: 'testFramework',
+    aggregate(results) {
+        // Last-wins. Mixed-stack repos resolve to a single framework name
+        // deterministically by provider-registration order; per-language
+        // reporting is future work (see Phase 10f roadmap).
+        return results[results.length - 1];
+    },
+};
+exports.SECRETS = {
+    id: 'secrets',
+    aggregate(results) {
+        // Multiple providers only appear if a future global scanner joins
+        // gitleaks (e.g. trufflehog). Concat findings, sum suppression
+        // counts, unique-join tool names — identical strategy to DEP_VULNS.
+        const findings = [];
+        let suppressedCount = 0;
+        for (const r of results) {
+            findings.push(...r.findings);
+            suppressedCount += r.suppressedCount;
+        }
+        return {
+            schemaVersion: 1,
+            tool: uniqueJoin(results.map((r) => r.tool)),
+            findings,
+            suppressedCount,
+        };
+    },
+};
+exports.CODE_PATTERNS = {
+    id: 'codePatterns',
+    aggregate(results) {
+        // Same union strategy as SECRETS — multiple providers only enter the
+        // picture if a future SAST scanner (codeql, opengrep) joins semgrep.
+        const findings = [];
+        let suppressedCount = 0;
+        for (const r of results) {
+            findings.push(...r.findings);
+            suppressedCount += r.suppressedCount;
+        }
+        return {
+            schemaVersion: 1,
+            tool: uniqueJoin(results.map((r) => r.tool)),
+            findings,
+            suppressedCount,
+        };
+    },
+};
+exports.DUPLICATION = {
+    id: 'duplication',
+    aggregate(results) {
+        // Multiple providers would appear if a future detector (pmd-cpd,
+        // sonar-cpd) joins jscpd. Sum the numerics; concat + re-sort
+        // topClones by line-count. Percentage is recomputed from summed
+        // totals rather than averaged (line counts may overlap across
+        // detectors, but a re-weighted mean would lie; summing totals is
+        // conservative).
+        let totalLines = 0;
+        let duplicatedLines = 0;
+        let cloneCount = 0;
+        const allClones = [];
+        for (const r of results) {
+            totalLines += r.totalLines;
+            duplicatedLines += r.duplicatedLines;
+            cloneCount += r.cloneCount;
+            allClones.push(...r.topClones);
+        }
+        const percentage = totalLines > 0 ? Math.round((duplicatedLines / totalLines) * 10000) / 100 : 0;
+        // De-dupe identical clone pairs by stable key, keep largest-first.
+        const seen = new Set();
+        const merged = [];
+        for (const c of allClones.sort((a, b) => b.lines - a.lines)) {
+            const key = `${c.a.file}:${c.a.startLine}-${c.a.endLine}|${c.b.file}:${c.b.startLine}-${c.b.endLine}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            merged.push(c);
+        }
+        return {
+            schemaVersion: 1,
+            tool: uniqueJoin(results.map((r) => r.tool)),
+            totalLines,
+            duplicatedLines,
+            percentage,
+            cloneCount,
+            topClones: merged.slice(0, 15),
+        };
+    },
+};
+exports.STRUCTURAL = {
+    id: 'structural',
+    aggregate(results) {
+        // Last-wins — same strategy as COVERAGE and TEST_FRAMEWORK. Every
+        // field is a repo-level scalar produced by one graph pass; summing
+        // across providers would double-count the same functions/modules,
+        // and averaging would lie about the source of truth. If a second
+        // structural tool ever joins graphify, a proper merge would need
+        // per-tool weighting — out of scope until that exists.
+        return results[results.length - 1];
+    },
+};
+exports.IMPORTS = {
+    id: 'imports',
+    aggregate(results) {
+        // Keys are disjoint between packs (each pack owns its source extensions),
+        // so plain-union merge is sound. We still defensively skip later-writer
+        // collisions so an accidental overlap would be visible in logs rather
+        // than silently dropping edges.
+        const extensions = new Set();
+        const extracted = new Map();
+        const edges = new Map();
+        for (const r of results) {
+            for (const ext of r.sourceExtensions)
+                extensions.add(ext);
+            for (const [file, specs] of r.extracted) {
+                if (!extracted.has(file))
+                    extracted.set(file, specs);
+            }
+            for (const [file, targets] of r.edges) {
+                if (!edges.has(file))
+                    edges.set(file, targets);
+            }
+        }
+        return {
+            schemaVersion: 1,
+            tool: uniqueJoin(results.map((r) => r.tool)),
+            sourceExtensions: [...extensions],
+            extracted,
+            edges,
+        };
+    },
+};
+/**
+ * Per-language capabilities — one provider registered per language pack.
+ * Keys must match `keyof LanguagePackCapabilities`; the contract test
+ * enforces that symmetry.
+ */
+exports.PER_PACK_REGISTRY = {
+    depVulns: exports.DEP_VULNS,
+    lint: exports.LINT,
+    coverage: exports.COVERAGE,
+    testFramework: exports.TEST_FRAMEWORK,
+    imports: exports.IMPORTS,
+};
+/**
+ * Global capabilities — tools that run once per repo (gitleaks, semgrep,
+ * jscpd, graphify), not per pack. Keys must match `keyof GlobalCapabilities`.
+ * Pack-dependent inputs (e.g. semgrep's rulesets from each active pack's
+ * `semgrepRulesets` declaration) are read by the provider itself via
+ * `detectActiveLanguages(cwd)` — the provider interface is uniform.
+ */
+exports.GLOBAL_REGISTRY = {
+    secrets: exports.SECRETS,
+    codePatterns: exports.CODE_PATTERNS,
+    duplication: exports.DUPLICATION,
+    structural: exports.STRUCTURAL,
+};
+/**
+ * Union of both registries — kept as the canonical "every descriptor"
+ * surface for tests and for callers that don't care about per-pack vs
+ * global distinction. `providersFor()` (src/languages/capabilities/index.ts)
+ * is the routing layer that picks the right source.
+ */
+exports.CAPABILITY_REGISTRY = {
+    ...exports.PER_PACK_REGISTRY,
+    ...exports.GLOBAL_REGISTRY,
+};
+//# sourceMappingURL=descriptors.js.map

package/dist/languages/capabilities/descriptors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descriptors.js","sourceRoot":"","sources":["../../../src/languages/capabilities/descriptors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAqBH,SAAS,UAAU,CAAC,MAA6B,EAAE,GAAG,GAAG,IAAI;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAEY,QAAA,SAAS,GAAwC;IAC5D,EAAE,EAAE,UAAU;IACd,SAAS,CAAC,OAAO;QACf,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,MAAM,QAAQ,GAA8B,EAAE,CAAC;QAC/C,IAAI,UAAU,GAAgC,IAAI,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC9B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACtB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YAC1B,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACpB,IAAI,CAAC,CAAC,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,CAAC,CAAC,UAAU;gBAAE,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QAC9C,CAAC;QACD,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,UAAU;YACV,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;YACvC,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACrD,CAAC;IACJ,CAAC;CACF,CAAC;AAEW,QAAA,IAAI,GAAqC;IACpD,EAAE,EAAE,MAAM;IACV,SAAS,CAAC,OAAO;QACf,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC9B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACtB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YAC1B,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACtB,CAAC;QACD,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE;SACxC,CAAC;IACJ,CAAC;CACF,CAAC;AAEW,QAAA,QAAQ,GAAyC;IAC5D,EAAE,EAAE,UAAU;IACd,SAAS,CAAC,OAAO;QACf,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,6CAA6C;QAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;CACF,CAAC;AAEW,QAAA,cAAc,GAA8C;IACvE,EAAE,EAAE,eAAe;IACnB,SAAS,CAAC,OAAO;QACf,kEAAkE;QAClE,iEAAiE;QACjE,oDAAoD;QACpD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;CACF,CAAC;AAEW,QAAA,OAAO,GAAwC;IAC1D,EAAE,EAAE,SAAS;IACb,SAAS,CAAC,OAAO;QACf,kEAAkE;QAClE,+DAA+D;QAC/D,oEAAoE;QACpE,MAAM,QAAQ,GAAwC,EAAE,CAAC;QACzD,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC7B,eAAe,IAAI,CAAC,CAAC,eAAe,CAAC;QACvC,CAAC;QACD,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,QAAQ;YACR,eAAe;SAChB,CAAC;IACJ,CAAC;CACF,CAAC;AAEW,QAAA,aAAa,GAA6C;IACrE,EAAE,EAAE,cAAc;IAClB,SAAS,CAAC,OAAO;QACf,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,QAAQ,GAA6C,EAAE,CAAC;QAC9D,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC7B,eAAe,IAAI,CAAC,CAAC,eAAe,CAAC;QACvC,CAAC;QACD,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,QAAQ;YACR,eAAe;SAChB,CAAC;IACJ,CAAC;CACF,CAAC;AAEW,QAAA,WAAW,GAA4C;IAClE,EAAE,EAAE,aAAa;IACjB,SAAS,CAAC,OAAO;QACf,iEAAiE;QACjE,6DAA6D;QAC7D,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,iBAAiB;QACjB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,SAAS,GAA6C,EAAE,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC;YAC3B,eAAe,IAAI,CAAC,CAAC,eAAe,CAAC;YACrC,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,UAAU,GACd,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,GAAG,UAAU,CAAC,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,mEAAmE;QACnE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,MAAM,GAA6C,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACtG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,UAAU;YACV,eAAe;YACf,UAAU;YACV,UAAU;YACV,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SAC/B,CAAC;IACJ,CAAC;CACF,CAAC;AAEW,QAAA,UAAU,GAA2C;IAChE,EAAE,EAAE,YAAY;IAChB,SAAS,CAAC,OAAO;QACf,kEAAkE;QAClE,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,uDAAuD;QACvD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;CACF,CAAC;AAEW,QAAA,OAAO,GAAwC;IAC1D,EAAE,EAAE,SAAS;IACb,SAAS,CAAC,OAAO;QACf,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,gBAAgB;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBACxC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvD,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,gBAAgB,EAAE,CAAC,GAAG,UAAU,CAAC;YACjC,SAAS;YACT,KAAK;SACN,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACU,QAAA,iBAAiB,GAAG;IAC/B,QAAQ,EAAE,iBAAS;IACnB,IAAI,EAAE,YAAI;IACV,QAAQ,EAAE,gBAAQ;IAClB,aAAa,EAAE,sBAAc;IAC7B,OAAO,EAAE,eAAO;CACR,CAAC;AAEX;;;;;;GAMG;AACU,QAAA,eAAe,GAAG;IAC7B,OAAO,EAAE,eAAO;IAChB,YAAY,EAAE,qBAAa;IAC3B,WAAW,EAAE,mBAAW;IACxB,UAAU,EAAE,kBAAU;CACd,CAAC;AAEX;;;;;GAKG;AACU,QAAA,mBAAmB,GAAG;IACjC,GAAG,yBAAiB;IACpB,GAAG,uBAAe;CACV,CAAC"}

package/dist/languages/capabilities/global.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Global capabilities — registered providers for tools that run once per
+ * repo rather than per language pack (gitleaks, grep-secrets fallback,
+ * semgrep, jscpd, graphify).
+ *
+ * The provider interface is identical to per-pack (`CapabilityProvider<T>`).
+ * What makes these "global" is only the registration site: providers are
+ * looked up by capability id rather than by iterating `LANGUAGES`. When a
+ * global provider needs per-pack input (semgrep's rulesets come from each
+ * active pack's `semgrepRulesets` declaration), it calls
+ * `detectActiveLanguages(cwd)` inside its own `gather()` — no interface
+ * extension needed.
+ *
+ * Each slot is an **array of providers** (Phase 10e.C.7.5). Multi-provider
+ * merge is handled by the descriptor's `aggregate` function: SECRETS +
+ * CODE_PATTERNS union findings and unique-join tool names; DUPLICATION
+ * sums totals + re-weights percentage; STRUCTURAL is last-wins. That lets
+ * us register a fallback provider alongside the primary (e.g. grep-secrets
+ * behind gitleaks) or layer an opt-in commercial scanner (Snyk for
+ * DEP_VULNS, Phase 10h.4) without structural change at the dispatch
+ * layer.
+ */
+import type { CapabilityProvider } from './provider';
+import type { CodePatternsResult, DuplicationResult, SecretsResult, StructuralResult } from './types';
+export interface GlobalCapabilities {
+    secrets?: ReadonlyArray<CapabilityProvider<SecretsResult>>;
+    codePatterns?: ReadonlyArray<CapabilityProvider<CodePatternsResult>>;
+    duplication?: ReadonlyArray<CapabilityProvider<DuplicationResult>>;
+    structural?: ReadonlyArray<CapabilityProvider<StructuralResult>>;
+}
+/**
+ * Registered providers per capability. Providers live in their tool file
+ * under `src/analyzers/tools/*.ts` and are imported here. Each is a
+ * free-standing module — they don't extend any class or know about each
+ * other, so adding one is a pure registration edit.
+ *
+ * `secrets` stacks gitleaks with a grep-based fallback (`grep-secrets`)
+ * that returns null whenever gitleaks is installed. The fallback only
+ * contributes on environments without gitleaks, preserving pre-C.7
+ * "gitleaks dominates" semantics while still covering degraded setups.
+ */
+export declare const GLOBAL_CAPABILITIES: GlobalCapabilities;
+//# sourceMappingURL=global.d.ts.map

package/dist/languages/capabilities/global.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"global.d.ts","sourceRoot":"","sources":["../../../src/languages/capabilities/global.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3D,YAAY,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrE,WAAW,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACnE,UAAU,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC;CAClE;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,EAAE,kBAKjC,CAAC"}

package/dist/languages/capabilities/global.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * Global capabilities — registered providers for tools that run once per
+ * repo rather than per language pack (gitleaks, grep-secrets fallback,
+ * semgrep, jscpd, graphify).
+ *
+ * The provider interface is identical to per-pack (`CapabilityProvider<T>`).
+ * What makes these "global" is only the registration site: providers are
+ * looked up by capability id rather than by iterating `LANGUAGES`. When a
+ * global provider needs per-pack input (semgrep's rulesets come from each
+ * active pack's `semgrepRulesets` declaration), it calls
+ * `detectActiveLanguages(cwd)` inside its own `gather()` — no interface
+ * extension needed.
+ *
+ * Each slot is an **array of providers** (Phase 10e.C.7.5). Multi-provider
+ * merge is handled by the descriptor's `aggregate` function: SECRETS +
+ * CODE_PATTERNS union findings and unique-join tool names; DUPLICATION
+ * sums totals + re-weights percentage; STRUCTURAL is last-wins. That lets
+ * us register a fallback provider alongside the primary (e.g. grep-secrets
+ * behind gitleaks) or layer an opt-in commercial scanner (Snyk for
+ * DEP_VULNS, Phase 10h.4) without structural change at the dispatch
+ * layer.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GLOBAL_CAPABILITIES = void 0;
+const gitleaks_1 = require("../../analyzers/tools/gitleaks");
+const graphify_1 = require("../../analyzers/tools/graphify");
+const grep_secrets_1 = require("../../analyzers/tools/grep-secrets");
+const jscpd_1 = require("../../analyzers/tools/jscpd");
+const semgrep_1 = require("../../analyzers/tools/semgrep");
+/**
+ * Registered providers per capability. Providers live in their tool file
+ * under `src/analyzers/tools/*.ts` and are imported here. Each is a
+ * free-standing module — they don't extend any class or know about each
+ * other, so adding one is a pure registration edit.
+ *
+ * `secrets` stacks gitleaks with a grep-based fallback (`grep-secrets`)
+ * that returns null whenever gitleaks is installed. The fallback only
+ * contributes on environments without gitleaks, preserving pre-C.7
+ * "gitleaks dominates" semantics while still covering degraded setups.
+ */
+exports.GLOBAL_CAPABILITIES = {
+    secrets: [gitleaks_1.gitleaksProvider, grep_secrets_1.grepSecretsProvider],
+    codePatterns: [semgrep_1.semgrepProvider],
+    duplication: [jscpd_1.jscpdProvider],
+    structural: [graphify_1.graphifyProvider],
+};
+//# sourceMappingURL=global.js.map

package/dist/languages/capabilities/global.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global.js","sourceRoot":"","sources":["../../../src/languages/capabilities/global.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAEH,6DAAkE;AAClE,6DAAkE;AAClE,qEAAyE;AACzE,uDAA4D;AAC5D,2DAAgE;AAgBhE;;;;;;;;;;GAUG;AACU,QAAA,mBAAmB,GAAuB;IACrD,OAAO,EAAE,CAAC,2BAAgB,EAAE,kCAAmB,CAAC;IAChD,YAAY,EAAE,CAAC,yBAAe,CAAC;IAC/B,WAAW,EAAE,CAAC,qBAAa,CAAC;IAC5B,UAAU,EAAE,CAAC,2BAAgB,CAAC;CAC/B,CAAC"}

package/dist/languages/capabilities/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Capability barrel + provider resolver.
+ *
+ * Analyzers call `providersFor(SECRETS)` rather than hand-iterating
+ * `LANGUAGES` or reading `GLOBAL_CAPABILITIES` directly. One lookup
+ * function hides the per-pack vs global split so analyzer code reads
+ * identically regardless of which registry hosts the capability.
+ */
+import { type CapabilityDescriptor } from './descriptors';
+import type { CapabilityProvider } from './provider';
+import type { CapabilityEnvelope } from './types';
+/**
+ * Resolve the concrete provider list for a capability descriptor.
+ *
+ * For per-pack capabilities (depVulns, lint, coverage, testFramework,
+ * imports): collected from every LanguageSupport that declared a provider
+ * in `capabilities.<id>`. Inactive packs (detect() returns false for this
+ * repo) still contribute — each provider is responsible for returning
+ * null when it has nothing to do. The dispatcher filters nulls before
+ * aggregating.
+ *
+ * For global capabilities (secrets, codePatterns, duplication, structural):
+ * the registered provider array (Phase 10e.C.7.5). A slot may carry
+ * multiple providers — SECRETS stacks gitleaks + grep-secrets fallback,
+ * DEP_VULNS is set up for a future Snyk opt-in (Phase 10h.4). The
+ * descriptor's `aggregate` function merges envelopes across providers.
+ * Returns `[]` when the capability id isn't in either registry.
+ */
+export declare function providersFor<T extends CapabilityEnvelope>(cap: CapabilityDescriptor<T>): ReadonlyArray<CapabilityProvider<T>>;
+export { GLOBAL_CAPABILITIES, type GlobalCapabilities } from './global';
+//# sourceMappingURL=index.d.ts.map

package/dist/languages/capabilities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/languages/capabilities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,KAAK,oBAAoB,EAAsC,MAAM,eAAe,CAAC;AAE9F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAGlD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,kBAAkB,EACvD,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC3B,aAAa,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAmBtC;AAED,OAAO,EAAE,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,UAAU,CAAC"}

package/dist/languages/capabilities/index.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * Capability barrel + provider resolver.
+ *
+ * Analyzers call `providersFor(SECRETS)` rather than hand-iterating
+ * `LANGUAGES` or reading `GLOBAL_CAPABILITIES` directly. One lookup
+ * function hides the per-pack vs global split so analyzer code reads
+ * identically regardless of which registry hosts the capability.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GLOBAL_CAPABILITIES = void 0;
+exports.providersFor = providersFor;
+const index_1 = require("../index");
+const descriptors_1 = require("./descriptors");
+const global_1 = require("./global");
+/**
+ * Resolve the concrete provider list for a capability descriptor.
+ *
+ * For per-pack capabilities (depVulns, lint, coverage, testFramework,
+ * imports): collected from every LanguageSupport that declared a provider
+ * in `capabilities.<id>`. Inactive packs (detect() returns false for this
+ * repo) still contribute — each provider is responsible for returning
+ * null when it has nothing to do. The dispatcher filters nulls before
+ * aggregating.
+ *
+ * For global capabilities (secrets, codePatterns, duplication, structural):
+ * the registered provider array (Phase 10e.C.7.5). A slot may carry
+ * multiple providers — SECRETS stacks gitleaks + grep-secrets fallback,
+ * DEP_VULNS is set up for a future Snyk opt-in (Phase 10h.4). The
+ * descriptor's `aggregate` function merges envelopes across providers.
+ * Returns `[]` when the capability id isn't in either registry.
+ */
+function providersFor(cap) {
+    // The casts through `unknown` are safe at runtime because PER_PACK_REGISTRY
+    // and GLOBAL_REGISTRY are typed such that `cap.id` being in a registry
+    // implies the providers under that key produce exactly T. TypeScript can't
+    // prove that across the two branches without heavier type-level machinery.
+    if (cap.id in descriptors_1.GLOBAL_REGISTRY) {
+        const slot = global_1.GLOBAL_CAPABILITIES[cap.id];
+        return (slot ?? []);
+    }
+    if (cap.id in descriptors_1.PER_PACK_REGISTRY) {
+        const key = cap.id;
+        const providers = [];
+        for (const lang of index_1.LANGUAGES) {
+            const p = lang.capabilities?.[key];
+            if (p)
+                providers.push(p);
+        }
+        return providers;
+    }
+    return [];
+}
+var global_2 = require("./global");
+Object.defineProperty(exports, "GLOBAL_CAPABILITIES", { enumerable: true, get: function () { return global_2.GLOBAL_CAPABILITIES; } });
+//# sourceMappingURL=index.js.map

package/dist/languages/capabilities/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/languages/capabilities/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AA0BH,oCAqBC;AA7CD,oCAAqC;AACrC,+CAA8F;AAC9F,qCAAwE;AAKxE;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,YAAY,CAC1B,GAA4B;IAE5B,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,GAAG,CAAC,EAAE,IAAI,6BAAe,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,4BAAmB,CAAC,GAAG,CAAC,EAA8B,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAoD,CAAC;IACzE,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,IAAI,+BAAiB,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,EAAoC,CAAC;QACrD,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,iBAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAqC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,mCAAwE;AAA/D,6GAAA,mBAAmB,OAAA"}

package/dist/languages/capabilities/provider.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Capability provider contract.
+ *
+ * Anything that can produce a capability result implements this — language
+ * packs (`LanguageSupport.capabilities.depVulns`, …) and global gatherers
+ * (`gitleaks`, `semgrep`, …) alike. Returning `null` means "this provider
+ * has nothing to contribute for this cwd" (e.g. the Python pack on a
+ * Go-only repo); the dispatcher filters nulls before aggregating.
+ */
+import type { CapabilityEnvelope } from './types';
+export interface CapabilityProvider<T extends CapabilityEnvelope> {
+    /** Source name for attribution in logs and errors (usually the language id). */
+    readonly source: string;
+    gather(cwd: string): Promise<T | null>;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/languages/capabilities/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/languages/capabilities/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,kBAAkB;IAC9D,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CACxC"}

package/dist/languages/capabilities/provider.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * Capability provider contract.
+ *
+ * Anything that can produce a capability result implements this — language
+ * packs (`LanguageSupport.capabilities.depVulns`, …) and global gatherers
+ * (`gitleaks`, `semgrep`, …) alike. Returning `null` means "this provider
+ * has nothing to contribute for this cwd" (e.g. the Python pack on a
+ * Go-only repo); the dispatcher filters nulls before aggregating.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=provider.js.map

package/dist/languages/capabilities/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/languages/capabilities/provider.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG"}