@vyuhlabs/dxkit 1.6.1 → 2.0.1

package/dist/languages/capabilities/types.d.ts

@@ -0,0 +1,226 @@
+/**
+ * Capability result envelopes.
+ *
+ * Phase 10e introduces a capabilities model: language packs (and global
+ * gatherers) expose typed *capabilities* that the dispatcher collects,
+ * runs, and aggregates. Each capability returns a strongly-typed envelope
+ * that extends `CapabilityEnvelope` so every result carries:
+ *
+ *   - `schemaVersion`: pinned literal so downstream consumers can detect
+ *     wire-format changes without inspecting fields.
+ *   - `tool`: which underlying tool produced this result. Required for
+ *     attribution in reports and for the `toolsUsed` aggregation.
+ *
+ * `ImportsResult` landed in Phase 10e.B.4 — a pack pre-computes the full
+ * per-pack import graph (extracted specifiers + resolved edges) for every
+ * source file matching its `sourceExtensions`, and the dispatcher unions
+ * the per-pack graphs so `buildReachable` can BFS over the unified edge
+ * map. Global-gatherer envelopes (`SecretsResult`, `CodePatternsResult`,
+ * ...) land in Phase 10e.B.6+.
+ */
+import type { Coverage } from '../../analyzers/tools/coverage';
+/** Four-tier severity counts, the project-wide convention. */
+export interface SeverityCounts {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+}
+/** Common shape every capability envelope carries. */
+export interface CapabilityEnvelope {
+    /** Pinned literal — bump when the shape changes incompatibly. */
+    readonly schemaVersion: 1;
+    /** Underlying tool name (e.g. 'pip-audit', 'eslint', 'govulncheck'). */
+    readonly tool: string;
+}
+/** Per-finding detail for dep-vuln reports that need more than counts. */
+export interface DepVulnFinding {
+    id: string;
+    package: string;
+    installedVersion?: string;
+    fixedVersion?: string;
+    severity: keyof SeverityCounts;
+    source: 'osv.dev' | 'tool-default' | 'tool-reported';
+}
+/** Dependency vulnerabilities, the depVulns capability. */
+export interface DepVulnResult extends CapabilityEnvelope {
+    /** Severity-tier counts. Always populated; zeros allowed. */
+    counts: SeverityCounts;
+    /** Source of severity classification, when enrichment is involved. */
+    enrichment: 'osv.dev' | null;
+    /** Optional per-finding detail. Deep-mode reports populate this. */
+    findings?: DepVulnFinding[];
+}
+/** Lint output, the lint capability. Tier counts collapse to errors/warnings in legacy fields. */
+export interface LintResult extends CapabilityEnvelope {
+    counts: SeverityCounts;
+}
+/** Coverage data, the coverage capability. Wraps the existing Coverage type. */
+export interface CoverageResult extends CapabilityEnvelope {
+    coverage: Coverage;
+}
+/** Detected test runner, the testFramework capability. */
+export interface TestFrameworkResult extends CapabilityEnvelope {
+    /** Lower-case framework id: 'vitest', 'jest', 'pytest', 'go-test', 'cargo-test', 'dotnet-test'. */
+    name: string;
+}
+/**
+ * Pre-computed import graph for one language pack, the imports capability.
+ *
+ * Every key in `extracted` and `edges` is a project-relative source file
+ * path matching one of `sourceExtensions`. Keys are disjoint across packs
+ * (a pack only owns files whose extension it declares), so the descriptor
+ * aggregates by plain union.
+ *
+ * `extracted` carries the raw specifiers captured from each file (e.g.
+ * `'./foo'`, `'lodash'`, `'../bar/baz'`). `edges` carries only the
+ * specifiers the pack could resolve to an in-project file; external
+ * packages and unresolvable specifiers are dropped. `buildReachable`
+ * consumes `edges`; future analyses (unused-imports, dead-code) can
+ * consume `extracted` without re-parsing source.
+ *
+ * Packs whose language has no file-based import resolution (Rust uses
+ * `mod`/crate paths, C# uses namespaces) still emit a result: `extracted`
+ * is populated for completeness and `edges` is empty. The union of an
+ * empty edges map is a no-op.
+ */
+export interface ImportsResult extends CapabilityEnvelope {
+    readonly sourceExtensions: ReadonlyArray<string>;
+    readonly extracted: ReadonlyMap<string, ReadonlyArray<string>>;
+    readonly edges: ReadonlyMap<string, ReadonlySet<string>>;
+}
+/** Per-finding detail for the secrets capability. */
+export interface SecretFinding {
+    file: string;
+    line: number;
+    rule: string;
+    severity: keyof SeverityCounts;
+    /** Human-readable description from the scanner (e.g. gitleaks' `Description` field). */
+    title?: string;
+}
+/**
+ * Hardcoded-secret findings, the secrets capability. Produced by global
+ * scanners (gitleaks today, trufflehog-compatible in the future) that
+ * run once per repo rather than per language pack. `suppressedCount`
+ * is the count of findings the repo's `.dxkit-suppressions.json`
+ * acknowledged and dropped — reported separately so the UI can
+ * distinguish "zero findings" from "zero visible findings after
+ * suppression."
+ */
+export interface SecretsResult extends CapabilityEnvelope {
+    findings: ReadonlyArray<SecretFinding>;
+    suppressedCount: number;
+}
+/** Per-finding detail for the codePatterns capability. */
+export interface CodePatternFinding {
+    file: string;
+    line: number;
+    rule: string;
+    severity: keyof SeverityCounts;
+    /** Human-readable summary from the scanner (first line of semgrep's `message`). */
+    title: string;
+    /** CWE identifier when the scanner supplies one (e.g. `CWE-79`). Empty otherwise. */
+    cwe: string;
+}
+/**
+ * Code-pattern findings, the codePatterns capability. Produced by static
+ * analysis scanners (semgrep today) that consume rulesets per active
+ * language pack (`LanguageSupport.semgrepRulesets`). Running once per
+ * repo rather than per pack: the scanner takes a union of rulesets and
+ * emits findings attributed by file path.
+ *
+ * `suppressedCount` mirrors `SecretsResult` — the count dropped by
+ * `.dxkit-suppressions.json` so the UI can report "zero visible after
+ * suppression" separately from "zero real findings."
+ */
+export interface CodePatternsResult extends CapabilityEnvelope {
+    findings: ReadonlyArray<CodePatternFinding>;
+    suppressedCount: number;
+}
+/** One side of a duplicate block reported by a clone detector. */
+export interface DuplicationCloneSide {
+    file: string;
+    startLine: number;
+    endLine: number;
+}
+/** A single clone pair (two locations with matching content). */
+export interface DuplicationClone {
+    lines: number;
+    tokens: number;
+    a: DuplicationCloneSide;
+    b: DuplicationCloneSide;
+}
+/**
+ * Duplication metrics, the duplication capability. Produced by clone
+ * detectors (jscpd today) that tokenize every source file and emit
+ * pair-wise matches above configured thresholds. `topClones` is
+ * bounded (the detector sorts + truncates) so the envelope is safe
+ * to keep in reports.
+ */
+export interface DuplicationResult extends CapabilityEnvelope {
+    totalLines: number;
+    duplicatedLines: number;
+    /** Rounded to 2 decimal places. */
+    percentage: number;
+    /** Total clone pairs found (may exceed topClones.length after truncation). */
+    cloneCount: number;
+    /** Largest clone pairs first; typically capped at ~15. */
+    topClones: ReadonlyArray<DuplicationClone>;
+}
+/**
+ * Structural metrics, the structural capability. Produced by AST
+ * graph-builders (graphify today) that walk every source file via
+ * tree-sitter, build a call-graph, detect communities, and derive
+ * cohesion / dead-import / orphan signals.
+ *
+ * Every field is a repo-level scalar produced by one graph pass —
+ * summing them across providers would double-count the same real
+ * functions/modules, so the descriptor aggregate is last-wins
+ * (matches COVERAGE's strategy for the same reason).
+ */
+export interface StructuralResult extends CapabilityEnvelope {
+    functionCount: number;
+    classCount: number;
+    maxFunctionsInFile: number;
+    maxFunctionsFilePath: string;
+    godNodeCount: number;
+    communityCount: number;
+    /** Mean cohesion score across communities, 0-1 range, 3 decimal places. */
+    avgCohesion: number;
+    orphanModuleCount: number;
+    deadImportCount: number;
+    /** Share of source files with zero AST nodes — proxy for "mostly-commented" files. */
+    commentedCodeRatio: number;
+}
+/**
+ * Internal outcome shape used by language packs' `gatherDepVulnsResult`
+ * helpers. The pack's `capabilities.depVulns` provider unwraps the
+ * envelope (returning null for every non-success kind) so the dispatcher
+ * surface stays `T | null`; keeping the richer outcome here lets the
+ * pack's own code distinguish e.g. "tool missing" from "tool ran but
+ * produced no output" if a future caller needs that detail.
+ */
+export type DepVulnGatherOutcome = {
+    kind: 'success';
+    envelope: DepVulnResult;
+} | {
+    kind: 'tool-missing';
+} | {
+    kind: 'parse-error';
+} | {
+    kind: 'no-output';
+};
+/**
+ * Internal outcome shape for the lint capability. Simpler than depVulns:
+ * either the linter ran and we have tier counts, or it didn't and we
+ * have a reason. The pack's `capabilities.lint` provider unwraps
+ * `success` into the envelope and returns null otherwise.
+ */
+export type LintGatherOutcome = {
+    kind: 'success';
+    envelope: LintResult;
+} | {
+    kind: 'unavailable';
+    reason: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/languages/capabilities/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/languages/capabilities/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE/D,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,cAAc,CAAC;IAC/B,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,eAAe,CAAC;CACtD;AAED,2DAA2D;AAC3D,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,6DAA6D;IAC7D,MAAM,EAAE,cAAc,CAAC;IACvB,sEAAsE;IACtE,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;CAC7B;AAED,kGAAkG;AAClG,MAAM,WAAW,UAAW,SAAQ,kBAAkB;IACpD,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAe,SAAQ,kBAAkB;IACxD,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,0DAA0D;AAC1D,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CAC1D;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,cAAc,CAAC;IAC/B,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,cAAc,CAAC;IAC/B,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,EAAE,oBAAoB,CAAC;IACxB,CAAC,EAAE,oBAAoB,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,UAAU,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/languages/capabilities/types.js

@@ -0,0 +1,23 @@
+"use strict";
+/**
+ * Capability result envelopes.
+ *
+ * Phase 10e introduces a capabilities model: language packs (and global
+ * gatherers) expose typed *capabilities* that the dispatcher collects,
+ * runs, and aggregates. Each capability returns a strongly-typed envelope
+ * that extends `CapabilityEnvelope` so every result carries:
+ *
+ *   - `schemaVersion`: pinned literal so downstream consumers can detect
+ *     wire-format changes without inspecting fields.
+ *   - `tool`: which underlying tool produced this result. Required for
+ *     attribution in reports and for the `toolsUsed` aggregation.
+ *
+ * `ImportsResult` landed in Phase 10e.B.4 — a pack pre-computes the full
+ * per-pack import graph (extracted specifiers + resolved edges) for every
+ * source file matching its `sourceExtensions`, and the dispatcher unions
+ * the per-pack graphs so `buildReachable` can BFS over the unified edge
+ * map. Global-gatherer envelopes (`SecretsResult`, `CodePatternsResult`,
+ * ...) land in Phase 10e.B.6+.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/languages/capabilities/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/languages/capabilities/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG"}

package/dist/languages/csharp.d.ts

@@ -1,5 +1,13 @@
 import type { Coverage } from '../analyzers/tools/coverage';
 import type { LanguageSupport } from './types';
 export declare function parseCoberturaXml(raw: string, sourceFile: string, cwd: string): Coverage | null;
+/**
+ * Capture C# `using` directives from source text, including
+ * `using static Foo`, aliased (`using X = Foo.Bar`), and plain forms.
+ * C# has no deterministic file-level resolver (namespaces aren't files),
+ * so this is the only raw helper the imports capability needs. Exported
+ * for unit tests.
+ */
+export declare function extractCsharpImportsRaw(content: string): string[];
 export declare const csharp: LanguageSupport;
 //# sourceMappingURL=csharp.d.ts.map

package/dist/languages/csharp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csharp.d.ts","sourceRoot":"","sources":["../../src/languages/csharp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAgB,MAAM,6BAA6B,CAAC;AAI1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAwD/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAoC/F;AAED,eAAO,MAAM,MAAM,EAAE,eAoJpB,CAAC"}
+{"version":3,"file":"csharp.d.ts","sourceRoot":"","sources":["../../src/languages/csharp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAgB,MAAM,6BAA6B,CAAC;AAc1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAwD/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAoC/F;AA+HD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQjE;AAqED,eAAO,MAAM,MAAM,EAAE,eAqCpB,CAAC"}

package/dist/languages/csharp.js

@@ -35,8 +35,10 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.csharp = void 0;
 exports.parseCoberturaXml = parseCoberturaXml;
+exports.extractCsharpImportsRaw = extractCsharpImportsRaw;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const exclusions_1 = require("../analyzers/tools/exclusions");
 const runner_1 = require("../analyzers/tools/runner");
 const tool_registry_1 = require("../analyzers/tools/tool-registry");
 function dirHasMatching(dir, regex) {
@@ -133,6 +135,201 @@ function parseCoberturaXml(raw, sourceFile, cwd) {
     const rel = path.relative(cwd, path.resolve(cwd, sourceFile)).split(path.sep).join('/');
     return { source: 'cobertura', sourceFile: rel || sourceFile, linePercent, files };
 }
+/**
+ * Single source of truth for the csharp pack's dep-vuln gathering.
+ * Consumed by `csharpDepVulnsProvider` (capability dispatcher). Runs
+ * independently of `dotnet-format` availability — historical bug where
+ * projects with `dotnet` but no `dotnet-format` saw zero vuln data.
+ */
+async function gatherCsharpDepVulnsResult(cwd) {
+    const vulnRaw = (0, runner_1.run)('dotnet list package --vulnerable --format json 2>/dev/null', cwd, 120000);
+    if (!vulnRaw)
+        return { kind: 'no-output' };
+    try {
+        const data = JSON.parse(vulnRaw);
+        let critical = 0;
+        let high = 0;
+        let medium = 0;
+        let low = 0;
+        for (const proj of data.projects || []) {
+            for (const fw of proj.frameworks || []) {
+                for (const pkg of fw.topLevelPackages || []) {
+                    for (const adv of pkg.advisories || []) {
+                        const sev = adv.severity?.toLowerCase();
+                        if (sev === 'critical')
+                            critical++;
+                        else if (sev === 'high')
+                            high++;
+                        else if (sev === 'moderate' || sev === 'medium')
+                            medium++;
+                        else
+                            low++;
+                    }
+                }
+            }
+        }
+        if (critical + high + medium + low === 0)
+            return { kind: 'no-output' };
+        const envelope = {
+            schemaVersion: 1,
+            tool: 'dotnet-vulnerable',
+            enrichment: null,
+            counts: { critical, high, medium, low },
+        };
+        return { kind: 'success', envelope };
+    }
+    catch {
+        return { kind: 'parse-error' };
+    }
+}
+const csharpDepVulnsProvider = {
+    source: 'csharp',
+    async gather(cwd) {
+        const outcome = await gatherCsharpDepVulnsResult(cwd);
+        return outcome.kind === 'success' ? outcome.envelope : null;
+    },
+};
+/**
+ * Single source of truth for the csharp pack's lint gathering.
+ * Consumed by `csharpLintProvider` (capability dispatcher).
+ *
+ * dotnet-format is a formatter, not a tiered linter — it emits binary
+ * pass/fail per file. Violations are formatting issues (indentation,
+ * spacing), not correctness. This helper reports them at `low` tier so
+ * they don't inflate the Quality/Slop score.
+ */
+function gatherCsharpLintResult(cwd) {
+    const dotnet = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['dotnet-format'], cwd);
+    if (!dotnet.available) {
+        return { kind: 'unavailable', reason: 'not installed' };
+    }
+    const exitCode = (0, runner_1.runExitCode)('dotnet format --verify-no-changes 2>/dev/null', cwd, 120000);
+    let violations = 0;
+    if (exitCode !== 0) {
+        const raw = (0, runner_1.run)('dotnet format --verify-no-changes 2>&1', cwd, 120000);
+        violations = raw ? raw.split('\n').filter((l) => l.includes('Formatted')).length : 1;
+    }
+    const envelope = {
+        schemaVersion: 1,
+        tool: 'dotnet-format',
+        counts: { critical: 0, high: 0, medium: 0, low: violations },
+    };
+    return { kind: 'success', envelope };
+}
+const csharpLintProvider = {
+    source: 'csharp',
+    async gather(cwd) {
+        const outcome = gatherCsharpLintResult(cwd);
+        return outcome.kind === 'success' ? outcome.envelope : null;
+    },
+};
+/**
+ * Single source of truth for the csharp pack's coverage gathering.
+ * Locates the Cobertura artifact across known layouts (explicit `coverage/`
+ * dir or `dotnet test --collect`'s TestResults/<guid>/ subtree). Consumed
+ * by `csharpCoverageProvider` (capability dispatcher).
+ */
+function gatherCsharpCoverageResult(cwd) {
+    const artifact = findCoberturaArtifact(cwd);
+    if (!artifact)
+        return null;
+    let raw;
+    try {
+        raw = fs.readFileSync(artifact, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    const rel = path.relative(cwd, artifact).split(path.sep).join('/');
+    const coverage = parseCoberturaXml(raw, rel, cwd);
+    if (!coverage)
+        return null;
+    return { schemaVersion: 1, tool: `coverage:${coverage.source}`, coverage };
+}
+const csharpCoverageProvider = {
+    source: 'csharp',
+    async gather(cwd) {
+        return gatherCsharpCoverageResult(cwd);
+    },
+};
+/**
+ * Capture C# `using` directives from source text, including
+ * `using static Foo`, aliased (`using X = Foo.Bar`), and plain forms.
+ * C# has no deterministic file-level resolver (namespaces aren't files),
+ * so this is the only raw helper the imports capability needs. Exported
+ * for unit tests.
+ */
+function extractCsharpImportsRaw(content) {
+    const out = [];
+    const re = /^\s*using\s+(?:static\s+)?(?:[A-Za-z_]\w*\s*=\s*)?([A-Za-z_][\w.]*)\s*;/gm;
+    let m;
+    while ((m = re.exec(content)) !== null) {
+        out.push(m[1]);
+    }
+    return out;
+}
+/**
+ * Enumerate .cs source files and capture the pack's per-file imports.
+ * C# has no `resolveImport` (namespaces don't map to file paths
+ * deterministically), so `edges` is always empty.
+ */
+function gatherCsharpImportsResult(cwd) {
+    const excludes = (0, exclusions_1.getFindExcludeFlags)(cwd);
+    const raw = (0, runner_1.run)(`find . -type f -name "*.cs" ${excludes} 2>/dev/null`, cwd);
+    if (!raw)
+        return null;
+    const extracted = new Map();
+    for (const line of raw.split('\n')) {
+        const p = line.trim();
+        if (!p)
+            continue;
+        const rel = p.replace(/^\.\//, '');
+        let content;
+        try {
+            content = fs.readFileSync(path.join(cwd, rel), 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        extracted.set(rel, extractCsharpImportsRaw(content));
+    }
+    if (extracted.size === 0)
+        return null;
+    return {
+        schemaVersion: 1,
+        tool: 'csharp-imports',
+        sourceExtensions: ['.cs'],
+        extracted,
+        edges: new Map(),
+    };
+}
+const csharpImportsProvider = {
+    source: 'csharp',
+    async gather(cwd) {
+        return gatherCsharpImportsResult(cwd);
+    },
+};
+/**
+ * Detect C# test projects by the runner package referenced in the
+ * project's `.csproj` file — xunit, NUnit, and MSTest cover the
+ * dominant majority of .NET test projects. A repo without any
+ * `.csproj` referencing these returns null.
+ */
+function gatherCsharpTestFrameworkResult(cwd) {
+    const hasCsproj = (0, runner_1.fileExists)(cwd, '*.csproj') || !!findMatchingRecursive(cwd, /\.csproj$/, 3);
+    if (!hasCsproj)
+        return null;
+    const csproj = (0, runner_1.run)("find . -name '*.csproj' -exec grep -l 'xunit\\|nunit\\|MSTest' {} \\; 2>/dev/null | head -1", cwd);
+    if (!csproj)
+        return null;
+    return { schemaVersion: 1, tool: 'csharp', name: 'dotnet-test' };
+}
+const csharpTestFrameworkProvider = {
+    source: 'csharp',
+    async gather(cwd) {
+        return gatherCsharpTestFrameworkResult(cwd);
+    },
+};
 exports.csharp = {
     id: 'csharp',
     displayName: 'C#',
@@ -147,35 +344,13 @@ exports.csharp = {
     tools: ['dotnet-format'],
     // p/csharp semgrep ruleset is sparse — skip until it matures.
     semgrepRulesets: [],
-    parseCoverage(cwd) {
-        const artifact = findCoberturaArtifact(cwd);
-        if (!artifact)
-            return null;
-        let raw;
-        try {
-            raw = fs.readFileSync(artifact, 'utf-8');
-        }
-        catch {
-            return null;
-        }
-        const rel = path.relative(cwd, artifact).split(path.sep).join('/');
-        return parseCoberturaXml(raw, rel, cwd);
+    capabilities: {
+        depVulns: csharpDepVulnsProvider,
+        lint: csharpLintProvider,
+        coverage: csharpCoverageProvider,
+        imports: csharpImportsProvider,
+        testFramework: csharpTestFrameworkProvider,
     },
-    extractImports(content) {
-        // `using System;`, `using System.IO;`, `using static System.Math;`,
-        // `using Alias = Foo.Bar;`. Captures the fully-qualified namespace.
-        const out = [];
-        const re = /^\s*using\s+(?:static\s+)?(?:[A-Za-z_]\w*\s*=\s*)?([A-Za-z_][\w.]*)\s*;/gm;
-        let m;
-        while ((m = re.exec(content)) !== null) {
-            out.push(m[1]);
-        }
-        return out;
-    },
-    // resolveImport intentionally omitted: C# namespaces don't map to file
-    // paths deterministically — one namespace can span many files, one file
-    // can declare many namespaces. Internal edges are best inferred via the
-    // project assembly graph, which is out of scope here.
     // mapLintSeverity intentionally omitted: dotnet-format is a formatter,
     // not a tiered linter. It emits binary pass/fail per file and doesn't
     // expose per-rule codes that could be categorized into
@@ -186,80 +361,5 @@ exports.csharp = {
     // mapping each to a tier. That's deferred until a C# test project
     // is available to validate the integration; see architecture-redesign
     // plan for the capability-based approach this will live in.
-    async gatherMetrics(cwd) {
-        const metrics = {
-            toolsUsed: [],
-            toolsUnavailable: [],
-        };
-        const dotnet = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['dotnet-format'], cwd);
-        if (dotnet.available) {
-            const exitCode = (0, runner_1.runExitCode)('dotnet format --verify-no-changes 2>/dev/null', cwd, 120000);
-            if (exitCode === 0) {
-                metrics.lintErrors = 0;
-                metrics.lintWarnings = 0;
-            }
-            else {
-                const raw = (0, runner_1.run)('dotnet format --verify-no-changes 2>&1', cwd, 120000);
-                const violations = raw ? raw.split('\n').filter((l) => l.includes('Formatted')).length : 1;
-                // dotnet-format findings are formatting violations (indentation,
-                // spacing) — style issues, not correctness errors. Report them as
-                // warnings so they don't inflate the "lint errors" count that
-                // drives Quality/Slop scoring. A future upgrade to parse
-                // `dotnet build` diagnostics can populate lintErrors properly.
-                metrics.lintErrors = 0;
-                metrics.lintWarnings = violations;
-            }
-            metrics.lintTool = 'dotnet-format';
-            metrics.toolsUsed.push('dotnet-format');
-            const vulnRaw = (0, runner_1.run)('dotnet list package --vulnerable --format json 2>/dev/null', cwd, 120000);
-            if (vulnRaw) {
-                try {
-                    const data = JSON.parse(vulnRaw);
-                    let critical = 0;
-                    let high = 0;
-                    let medium = 0;
-                    let low = 0;
-                    for (const proj of data.projects || []) {
-                        for (const fw of proj.frameworks || []) {
-                            for (const pkg of fw.topLevelPackages || []) {
-                                for (const adv of pkg.advisories || []) {
-                                    const sev = adv.severity?.toLowerCase();
-                                    if (sev === 'critical')
-                                        critical++;
-                                    else if (sev === 'high')
-                                        high++;
-                                    else if (sev === 'moderate' || sev === 'medium')
-                                        medium++;
-                                    else
-                                        low++;
-                                }
-                            }
-                        }
-                    }
-                    if (critical + high + medium + low > 0) {
-                        metrics.depVulnCritical = critical;
-                        metrics.depVulnHigh = high;
-                        metrics.depVulnMedium = medium;
-                        metrics.depVulnLow = low;
-                        metrics.depAuditTool = 'dotnet-vulnerable';
-                        metrics.toolsUsed.push('dotnet-vulnerable');
-                    }
-                }
-                catch {
-                    metrics.toolsUnavailable.push('dotnet-vulnerable (parse error)');
-                }
-            }
-        }
-        else {
-            metrics.toolsUnavailable.push('dotnet-format');
-        }
-        if ((0, runner_1.fileExists)(cwd, '*.csproj') || findMatchingRecursive(cwd, /\.csproj$/, 3)) {
-            const csproj = (0, runner_1.run)("find . -name '*.csproj' -exec grep -l 'xunit\\|nunit\\|MSTest' {} \\; 2>/dev/null | head -1", cwd);
-            if (csproj) {
-                metrics.testFramework = 'dotnet-test';
-            }
-        }
-        return metrics;
-    },
 };
 //# sourceMappingURL=csharp.js.map