@vyuhlabs/dxkit 2.0.1 → 2.1.0

package/dist/analyzers/licenses/detailed.js

@@ -0,0 +1,194 @@
+"use strict";
+/**
+ * Licenses analyzer — detailed report.
+ *
+ * Extends the base LicensesReport with risk-categorized findings and a
+ * ranked action list. Unlike security/test-gaps, licenses aren't
+ * graded — there's no "license score" — so actions are prioritized by
+ * legal risk tier (unknown → strong-copyleft → weak-copyleft →
+ * missing-attribution) rather than by projected score delta.
+ *
+ * Both the markdown formatter and the XLSX converter (Phase 10h.2.3)
+ * can consume this same `LicensesDetailedReport` shape.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildLicensesDetailed = buildLicensesDetailed;
+exports.formatLicensesDetailedMarkdown = formatLicensesDetailedMarkdown;
+/**
+ * Strong-copyleft SPDX families. Prefix match covers `-or-later` /
+ * `-only` / version variants (`GPL-2.0`, `GPL-2.0-or-later`, etc.).
+ * Distribution/linking typically requires exposing downstream source,
+ * which is disqualifying for most proprietary products.
+ */
+const STRONG_COPYLEFT_PREFIXES = ['GPL-', 'AGPL-'];
+/**
+ * Weak-copyleft SPDX families. File-level or module-level restrictions
+ * — less restrictive than strong copyleft but still require review
+ * before shipping in a proprietary binary.
+ */
+const WEAK_COPYLEFT_PREFIXES = ['LGPL-', 'MPL-', 'EPL-', 'CDDL-'];
+function matchesAny(licenseType, prefixes) {
+    // license-checker may emit "GPL-3.0 OR MIT" compound expressions.
+    // Split and test any term so a dual-licensed package still gets flagged.
+    const terms = licenseType.split(/\s+OR\s+|\s+AND\s+|,\s*/);
+    for (const term of terms) {
+        for (const p of prefixes) {
+            if (term.startsWith(p))
+                return true;
+        }
+    }
+    return false;
+}
+function buildLicensesDetailed(report) {
+    const unknown = report.findings.filter((f) => f.licenseType === 'UNKNOWN' || f.licenseType.length === 0);
+    const strongCopyleft = report.findings.filter((f) => matchesAny(f.licenseType, STRONG_COPYLEFT_PREFIXES));
+    const weakCopyleft = report.findings.filter((f) => matchesAny(f.licenseType, WEAK_COPYLEFT_PREFIXES));
+    const missingText = report.findings.filter((f) => (f.licenseType !== 'UNKNOWN' && !f.licenseText) ||
+        (f.licenseText !== undefined && f.licenseText.length === 0));
+    const missingSupplier = report.findings.filter((f) => !f.supplier || f.supplier.length === 0);
+    const categories = [];
+    if (unknown.length > 0) {
+        categories.push({
+            priority: 'critical',
+            id: 'unknown-license',
+            title: 'Unknown or unresolved licenses',
+            rationale: 'Packages with no detected license may not be safe to redistribute. Their absence of license metadata blocks any licensing guarantee.',
+            recommendation: 'Audit each package individually. Contact maintainers, check the source repository directly, or replace with a license-known alternative.',
+            affected: unknown,
+        });
+    }
+    if (strongCopyleft.length > 0) {
+        categories.push({
+            priority: 'high',
+            id: 'strong-copyleft',
+            title: 'Strong-copyleft licenses (GPL / AGPL)',
+            rationale: 'GPL/AGPL licenses typically require derivative works to be distributed under the same license, including source code. Shipping these inside proprietary products can trigger the copyleft clause.',
+            recommendation: 'For each package, determine whether it is linked statically/dynamically into a distributable artifact. Consult legal before shipping; consider MIT/Apache alternatives.',
+            affected: strongCopyleft,
+        });
+    }
+    if (weakCopyleft.length > 0) {
+        categories.push({
+            priority: 'medium',
+            id: 'weak-copyleft',
+            title: 'Weak-copyleft licenses (LGPL / MPL / EPL / CDDL)',
+            rationale: 'Weak-copyleft licenses apply only to modifications of the licensed files themselves, not to derivative works linking to them. Still subject to attribution and in some cases source-disclosure for modifications.',
+            recommendation: 'Safe to use unmodified in proprietary products; any modifications must be published under the same license. Document intent so a future reviewer doesn’t re-audit unchanged deps.',
+            affected: weakCopyleft,
+        });
+    }
+    if (missingText.length > 0) {
+        categories.push({
+            priority: 'medium',
+            id: 'missing-license-text',
+            title: 'Missing license text',
+            rationale: 'License type is known but the full text is absent. Attribution clauses typically require the license text be distributed with the binary or notice file.',
+            recommendation: 'Locate each package’s LICENSE file from its source repository and bundle in NOTICE / THIRD-PARTY.md. Most ecosystems ship the file in the package directory.',
+            affected: missingText,
+        });
+    }
+    if (missingSupplier.length > 0) {
+        categories.push({
+            priority: 'low',
+            id: 'missing-supplier',
+            title: 'Missing supplier or author metadata',
+            rationale: 'Provenance information is useful during security review (who published this? when?), compliance audits, and vulnerability triage.',
+            recommendation: 'Manual lookup via each ecosystem’s registry (npm view, PyPI, crates.io). Consider dropping packages with no identifiable maintainer.',
+            affected: missingSupplier,
+        });
+    }
+    return {
+        ...report,
+        riskCategories: categories,
+    };
+}
+const PRIORITY_LABELS = {
+    critical: '🔴 Critical',
+    high: '🟠 High',
+    medium: '🟡 Medium',
+    low: '🔵 Low',
+};
+function formatLicensesDetailedMarkdown(detailed, elapsed) {
+    const L = [];
+    L.push('# License Inventory — Detailed');
+    L.push('');
+    L.push(`**Date:** ${detailed.analyzedAt.slice(0, 10)}`);
+    L.push(`**Repository:** ${detailed.repo}`);
+    L.push(`**Branch:** ${detailed.branch} (${detailed.commitSha})`);
+    L.push(`**Schema version:** ${detailed.schemaVersion}`);
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Summary
+    L.push('## Summary');
+    L.push('');
+    L.push(`**${detailed.summary.totalPackages} packages** across ${Object.keys(detailed.summary.byLicense).length} distinct license types.`);
+    if (detailed.riskCategories.length > 0) {
+        L.push('');
+        const n = detailed.riskCategories.length;
+        L.push(`**${n} risk categor${n === 1 ? 'y' : 'ies'} flagged** — see below.`);
+    }
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Risk categories
+    L.push('## Risk Review');
+    L.push('');
+    if (detailed.riskCategories.length === 0) {
+        L.push('No licensing risks flagged. Every package has a known license, full text, and supplier metadata.');
+    }
+    else {
+        L.push('Categories are ranked by legal risk tier. Review top-to-bottom.');
+        L.push('');
+        L.push('| # | Category | Priority | Affected |');
+        L.push('|---|----------|----------|---------:|');
+        detailed.riskCategories.forEach((c, i) => {
+            L.push(`| ${i + 1} | ${c.title} | ${PRIORITY_LABELS[c.priority]} | ${c.affected.length} |`);
+        });
+        L.push('');
+        for (const c of detailed.riskCategories) {
+            L.push(`### ${PRIORITY_LABELS[c.priority]} — ${c.title} (${c.affected.length})`);
+            L.push('');
+            L.push(`**Why:** ${c.rationale}`);
+            L.push('');
+            L.push(`**What to do:** ${c.recommendation}`);
+            L.push('');
+            L.push('| Package | Version | License |');
+            L.push('|---------|---------|---------|');
+            const rows = [...c.affected].sort((a, b) => a.package.localeCompare(b.package));
+            for (const f of rows) {
+                L.push(`| \`${f.package}\` | ${f.version} | ${f.licenseType || 'UNKNOWN'} |`);
+            }
+            L.push('');
+        }
+    }
+    L.push('---');
+    L.push('');
+    // Full inventory — every field
+    L.push('## Full Inventory');
+    L.push('');
+    if (detailed.findings.length === 0) {
+        L.push('_No packages detected._');
+    }
+    else {
+        L.push('| Package | Version | License | Supplier | Description | Source URL |');
+        L.push('|---------|---------|---------|----------|-------------|------------|');
+        const rows = [...detailed.findings].sort((a, b) => a.package.localeCompare(b.package));
+        for (const f of rows) {
+            const supplier = (f.supplier || '').replace(/\|/g, '\\|');
+            const desc = (f.description || '').replace(/\|/g, '\\|').replace(/\n/g, ' ').slice(0, 120);
+            const url = f.sourceUrl || '';
+            L.push(`| \`${f.package}\` | ${f.version} | ${f.licenseType} | ${supplier} | ${desc} | ${url} |`);
+        }
+    }
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Footer
+    L.push(`**Tools used:** ${detailed.toolsUsed.join(', ') || '(none)'}`);
+    L.push(`**Analysis time:** ${elapsed}s`);
+    L.push('');
+    L.push('*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*');
+    return L.join('\n');
+}
+//# sourceMappingURL=detailed.js.map

package/dist/analyzers/licenses/detailed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detailed.js","sourceRoot":"","sources":["../../../src/analyzers/licenses/detailed.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAoDH,sDAwFC;AASD,wEA+FC;AA/OD;;;;;GAKG;AACH,MAAM,wBAAwB,GAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,sBAAsB,GAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAEzF,SAAS,UAAU,CAAC,WAAmB,EAAE,QAA+B;IACtE,kEAAkE;IAClE,yEAAyE;IACzE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAsBD,SAAgB,qBAAqB,CAAC,MAAsB;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CACjE,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAClD,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,wBAAwB,CAAC,CACpD,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAChD,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAClD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/C,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAC9D,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAE9F,MAAM,UAAU,GAA0B,EAAE,CAAC;IAE7C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,UAAU;YACpB,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,gCAAgC;YACvC,SAAS,EACP,sIAAsI;YACxI,cAAc,EACZ,0IAA0I;YAC5I,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,MAAM;YAChB,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,uCAAuC;YAC9C,SAAS,EACP,mMAAmM;YACrM,cAAc,EACZ,yKAAyK;YAC3K,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,QAAQ;YAClB,EAAE,EAAE,eAAe;YACnB,KAAK,EAAE,kDAAkD;YACzD,SAAS,EACP,mNAAmN;YACrN,cAAc,EACZ,mLAAmL;YACrL,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,QAAQ;YAClB,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,sBAAsB;YAC7B,SAAS,EACP,0JAA0J;YAC5J,cAAc,EACZ,8JAA8J;YAChK,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,KAAK;YACf,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,qCAAqC;YAC5C,SAAS,EACP,mIAAmI;YACrI,cAAc,EACZ,sIAAsI;YACxI,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE,UAAU;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAoD;IACvE,QAAQ,EAAE,aAAa;IACvB,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,WAAW;IACnB,GAAG,EAAE,QAAQ;CACd,CAAC;AAEF,SAAgB,8BAA8B,CAC5C,QAAgC,EAChC,OAAe;IAEf,MAAM,CAAC,GAAa,EAAE,CAAC;IAEvB,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,UAAU;IACV,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,KAAK,QAAQ,CAAC,OAAO,CAAC,aAAa,sBAAsB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,0BAA0B,CAClI,CAAC;IACF,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,MAAM,CAAC,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC;IAC/E,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,kBAAkB;IAClB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,CAAC,CAAC,IAAI,CACJ,kGAAkG,CACnG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACjD,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACjF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAChF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,WAAW,IAAI,SAAS,IAAI,CAAC,CAAC;YAChF,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,+BAA+B;IAC/B,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QAChF,CAAC,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3F,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YAC9B,CAAC,CAAC,IAAI,CACJ,OAAO,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,WAAW,MAAM,QAAQ,MAAM,IAAI,MAAM,GAAG,IAAI,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,SAAS;IACT,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAEzF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/analyzers/licenses/gather.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Licenses analyzer data-gather — a thin wrapper around the capability
+ * dispatcher. The work of invoking per-pack license tools lives in
+ * `src/languages/{typescript,python,go,rust,csharp}.ts`; this module
+ * just routes through the dispatcher and unpacks the aggregated
+ * envelope so the analyzer index can compute its cross-report summary.
+ */
+import type { LicensesResult } from '../../languages/capabilities/types';
+/**
+ * Dispatch the LICENSES capability against `cwd`. Returns null when no
+ * pack contributed (e.g. a polyglot-negative repo) so the caller can
+ * emit an empty-but-shaped report rather than fabricating data.
+ */
+export declare function gatherLicensesResult(cwd: string): Promise<LicensesResult | null>;
+//# sourceMappingURL=gather.d.ts.map

package/dist/analyzers/licenses/gather.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../../src/analyzers/licenses/gather.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAItF"}

package/dist/analyzers/licenses/gather.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * Licenses analyzer data-gather — a thin wrapper around the capability
+ * dispatcher. The work of invoking per-pack license tools lives in
+ * `src/languages/{typescript,python,go,rust,csharp}.ts`; this module
+ * just routes through the dispatcher and unpacks the aggregated
+ * envelope so the analyzer index can compute its cross-report summary.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatherLicensesResult = gatherLicensesResult;
+const dispatcher_1 = require("../dispatcher");
+const descriptors_1 = require("../../languages/capabilities/descriptors");
+const capabilities_1 = require("../../languages/capabilities");
+/**
+ * Dispatch the LICENSES capability against `cwd`. Returns null when no
+ * pack contributed (e.g. a polyglot-negative repo) so the caller can
+ * emit an empty-but-shaped report rather than fabricating data.
+ */
+async function gatherLicensesResult(cwd) {
+    const descriptor = descriptors_1.PER_PACK_REGISTRY.licenses;
+    const providers = (0, capabilities_1.providersFor)(descriptor);
+    return dispatcher_1.defaultDispatcher.gather(cwd, descriptor, providers);
+}
+//# sourceMappingURL=gather.js.map

package/dist/analyzers/licenses/gather.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.js","sourceRoot":"","sources":["../../../src/analyzers/licenses/gather.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAYH,oDAIC;AAdD,8CAAkD;AAClD,0EAA6E;AAC7E,+DAA4D;AAG5D;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CAAC,GAAW;IACpD,MAAM,UAAU,GAAG,+BAAiB,CAAC,QAAQ,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAA,2BAAY,EAAC,UAAU,CAAC,CAAC;IAC3C,OAAO,8BAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAC9D,CAAC"}

package/dist/analyzers/licenses/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Licenses analyzer — public API.
+ *
+ * Produces a per-package license inventory by dispatching the LICENSES
+ * capability across every active language pack. Output formats:
+ *
+ *   - `formatLicensesMarkdown(report)` — table markdown for
+ *     `.ai/reports/licenses-<date>.md` and PR comments.
+ *   - JSON via the CLI's `--json` flag — envelope pass-through with
+ *     the added summary + repo metadata.
+ *   - XLSX — 15-column drop-in for the customer's spreadsheet
+ *     workflow; lands in Phase 10h.2.2 via `exceljs`.
+ */
+import type { LicensesReport } from './types';
+export type { LicensesReport } from './types';
+export interface AnalyzeLicensesOptions {
+    verbose?: boolean;
+}
+export declare function analyzeLicenses(repoPath: string, _options?: AnalyzeLicensesOptions): Promise<LicensesReport>;
+export declare function formatLicensesReport(report: LicensesReport, elapsed: string): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/analyzers/licenses/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analyzers/licenses/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,sBAA2B,GACpC,OAAO,CAAC,cAAc,CAAC,CA6BzB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CA2EpF"}

package/dist/analyzers/licenses/index.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * Licenses analyzer — public API.
+ *
+ * Produces a per-package license inventory by dispatching the LICENSES
+ * capability across every active language pack. Output formats:
+ *
+ *   - `formatLicensesMarkdown(report)` — table markdown for
+ *     `.ai/reports/licenses-<date>.md` and PR comments.
+ *   - JSON via the CLI's `--json` flag — envelope pass-through with
+ *     the added summary + repo metadata.
+ *   - XLSX — 15-column drop-in for the customer's spreadsheet
+ *     workflow; lands in Phase 10h.2.2 via `exceljs`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeLicenses = analyzeLicenses;
+exports.formatLicensesReport = formatLicensesReport;
+const path = __importStar(require("path"));
+const detect_1 = require("../../detect");
+const runner_1 = require("../tools/runner");
+const gather_1 = require("./gather");
+async function analyzeLicenses(repoPath, _options = {}) {
+    const stack = (0, detect_1.detect)(repoPath);
+    const envelope = await (0, gather_1.gatherLicensesResult)(repoPath);
+    const findings = envelope?.findings ?? [];
+    const byLicense = {};
+    let unknownCount = 0;
+    for (const f of findings) {
+        byLicense[f.licenseType] = (byLicense[f.licenseType] ?? 0) + 1;
+        if (f.licenseType === 'UNKNOWN' || f.licenseType.length === 0)
+            unknownCount++;
+    }
+    const toolsUsed = envelope ? envelope.tool.split(', ').filter((t) => t.length > 0) : [];
+    return {
+        repo: stack.projectName || path.basename(repoPath),
+        analyzedAt: new Date().toISOString(),
+        commitSha: (0, runner_1.run)('git rev-parse --short HEAD 2>/dev/null', repoPath),
+        branch: (0, runner_1.run)('git rev-parse --abbrev-ref HEAD 2>/dev/null', repoPath),
+        schemaVersion: '1',
+        summary: {
+            totalPackages: findings.length,
+            byLicense,
+            unknownCount,
+        },
+        findings,
+        toolsUsed,
+        toolsUnavailable: [],
+    };
+}
+function formatLicensesReport(report, elapsed) {
+    const L = [];
+    L.push('# License Inventory Report');
+    L.push('');
+    L.push(`**Date:** ${report.analyzedAt.slice(0, 10)}`);
+    L.push(`**Repository:** ${report.repo}`);
+    L.push(`**Branch:** ${report.branch} (${report.commitSha})`);
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Summary
+    L.push('## Summary');
+    L.push('');
+    L.push(`**${report.summary.totalPackages} packages** across ${Object.keys(report.summary.byLicense).length} distinct license types.`);
+    if (report.summary.unknownCount > 0) {
+        L.push('');
+        L.push(`> ⚠️ ${report.summary.unknownCount} package(s) have no detected license — review before shipping.`);
+    }
+    L.push('');
+    // Breakdown by license
+    L.push('## License Distribution');
+    L.push('');
+    L.push('| License | Count |');
+    L.push('|---------|-------|');
+    const sorted = Object.entries(report.summary.byLicense).sort((a, b) => b[1] - a[1]);
+    for (const [lic, count] of sorted) {
+        L.push(`| ${lic} | ${count} |`);
+    }
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Findings table — capped at 50 rows for readability; full list in *-detailed.md
+    L.push('## Packages');
+    L.push('');
+    if (report.findings.length === 0) {
+        L.push('_No packages detected. Ensure the project has a resolved dependency tree (e.g. `npm install`, `pip install`, `go mod download`, `cargo build`, `dotnet restore`) before running this analyzer._');
+    }
+    else {
+        const cap = 50;
+        const rows = [...report.findings].sort((a, b) => a.package.localeCompare(b.package));
+        const shown = rows.slice(0, cap);
+        L.push('| Package | Version | License | Description | Source URL |');
+        L.push('|---------|---------|---------|-------------|------------|');
+        for (const f of shown) {
+            const desc = (f.description || '').replace(/\|/g, '\\|').replace(/\n/g, ' ').slice(0, 80);
+            const url = f.sourceUrl || '';
+            L.push(`| \`${f.package}\` | ${f.version} | ${f.licenseType} | ${desc} | ${url} |`);
+        }
+        if (rows.length > cap) {
+            L.push('');
+            L.push(`_Showing ${cap} of ${rows.length} packages alphabetically. Run with \`--detailed\` for full inventory + risk review._`);
+        }
+    }
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Footer
+    L.push(`**Tools used:** ${report.toolsUsed.join(', ') || '(none)'}`);
+    L.push(`**Analysis time:** ${elapsed}s`);
+    L.push('');
+    L.push('*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*');
+    return L.join('\n');
+}
+//# sourceMappingURL=index.js.map

package/dist/analyzers/licenses/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyzers/licenses/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcH,0CAgCC;AAED,oDA2EC;AAzHD,2CAA6B;AAC7B,yCAAsC;AACtC,4CAAsC;AACtC,qCAAgD;AASzC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,WAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,IAAA,6BAAoB,EAAC,QAAQ,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC1C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,YAAY,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAExF,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,IAAA,YAAG,EAAC,wCAAwC,EAAE,QAAQ,CAAC;QAClE,MAAM,EAAE,IAAA,YAAG,EAAC,6CAA6C,EAAE,QAAQ,CAAC;QACpE,aAAa,EAAE,GAAG;QAClB,OAAO,EAAE;YACP,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,SAAS;YACT,YAAY;SACb;QACD,QAAQ;QACR,SAAS;QACT,gBAAgB,EAAE,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,MAAsB,EAAE,OAAe;IAC1E,MAAM,CAAC,GAAa,EAAE,CAAC;IAEvB,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACrC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,UAAU;IACV,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,KAAK,MAAM,CAAC,OAAO,CAAC,aAAa,sBAAsB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,0BAA0B,CAC9H,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QACpC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CACJ,QAAQ,MAAM,CAAC,OAAO,CAAC,YAAY,gEAAgE,CACpG,CAAC;IACJ,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,uBAAuB;IACvB,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAClC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC9B,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,iFAAiF;IACjF,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,CAAC,CAAC,IAAI,CACJ,iMAAiM,CAClM,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACrE,CAAC,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1F,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;YAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,WAAW,MAAM,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CACJ,YAAY,GAAG,OAAO,IAAI,CAAC,MAAM,sFAAsF,CACxH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,SAAS;IACT,CAAC,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAEzF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/analyzers/licenses/types.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Licenses analyzer report shape.
+ *
+ * Thin wrapper over the LICENSES capability envelope (one per active
+ * language pack, aggregated by the dispatcher's descriptor). Adds the
+ * cross-report metadata every vyuh-dxkit analyzer ships (repo, commit,
+ * timestamps, toolsUsed/Unavailable) plus a small summary pre-computed
+ * at gather time so consumers don't have to walk the full findings
+ * array just to pick a grade.
+ */
+import type { LicenseFinding } from '../../languages/capabilities/types';
+export interface LicensesReport {
+    repo: string;
+    analyzedAt: string;
+    commitSha: string;
+    branch: string;
+    /** Bumps when the report shape changes incompatibly. */
+    schemaVersion: '1';
+    summary: {
+        totalPackages: number;
+        /** Count per canonical SPDX identifier — e.g. { 'MIT': 45, 'Apache-2.0': 23, 'UNKNOWN': 2 }. */
+        byLicense: Record<string, number>;
+        /** Count of packages lacking a license field (or reported as 'UNKNOWN'). */
+        unknownCount: number;
+    };
+    findings: ReadonlyArray<LicenseFinding>;
+    toolsUsed: string[];
+    toolsUnavailable: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/analyzers/licenses/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/analyzers/licenses/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,aAAa,EAAE,GAAG,CAAC;IACnB,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAC;QACtB,gGAAgG;QAChG,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,4EAA4E;QAC5E,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IACxC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B"}

package/dist/analyzers/licenses/types.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Licenses analyzer report shape.
+ *
+ * Thin wrapper over the LICENSES capability envelope (one per active
+ * language pack, aggregated by the dispatcher's descriptor). Adds the
+ * cross-report metadata every vyuh-dxkit analyzer ships (repo, commit,
+ * timestamps, toolsUsed/Unavailable) plus a small summary pre-computed
+ * at gather time so consumers don't have to walk the full findings
+ * array just to pick a grade.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/analyzers/licenses/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/analyzers/licenses/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG"}

package/dist/analyzers/security/detailed.d.ts

@@ -1,6 +1,3 @@
-/**
- * Detailed security report — JSON schema + markdown formatter.
- */
 import { SecurityReport } from './types';
 import { RankedAction } from '../remediation';
 import { SecurityCounts } from './scoring';

package/dist/analyzers/security/detailed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detailed.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/detailed.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,cAAc,EAA6B,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,YAAY,EAAQ,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAEhE,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;CAC9C;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,sBAAsB,CASpF;AAID,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,MAAM,GACd,MAAM,CAmHR"}
+{"version":3,"file":"detailed.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/detailed.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAA6B,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,YAAY,EAAQ,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAEhE,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;CAC9C;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,sBAAsB,CAUpF;AAID,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,MAAM,GACd,MAAM,CAuJR"}

package/dist/analyzers/security/detailed.js

@@ -10,7 +10,8 @@ function buildSecurityDetailed(report) {
     const actions = (0, remediation_1.rank)((0, actions_1.buildSecurityActions)(report), counts, scoring_1.scoreSecurityCounts);
     return {
         ...report,
-        schemaVersion: '11',
+        // v12 adds per-advisory dep-vuln detail under summary.dependencies.findings.
+        schemaVersion: '12',
         securityScore: (0, scoring_1.scoreSecurityCounts)(counts).score,
         actions,
     };
@@ -30,13 +31,27 @@ function formatSecurityDetailedMarkdown(detailed, elapsed) {
     L.push('');
     L.push('---');
     L.push('');
-    // Summary
+    // Summary — two independent axes (see formatSecurityReport in
+    // index.ts for the same rationale). Code findings vs dependency
+    // vulnerabilities are NOT summed naïvely; each has its own
+    // remediation owner (your team patches code, you upgrade deps).
     L.push('## Summary');
     L.push('');
-    L.push(`Code findings: ${s.critical}C ${s.high}H ${s.medium}M ${s.low}L (${s.total} total). ` +
-        (d.tool
-            ? `Dependency vulns: ${d.critical}C ${d.high}H ${d.medium}M ${d.low}L (${d.total}, via ${d.tool}).`
-            : 'No dependency audit data.'));
+    L.push('Two independent axes:');
+    L.push('- **Code findings** — vulnerabilities in source your team owns. Fix by patching code.');
+    L.push('- **Dependency vulnerabilities** — vulnerabilities in third-party packages. Fix by upgrading the dep.');
+    L.push('');
+    L.push(`**Code findings:** ${s.critical}C ${s.high}H ${s.medium}M ${s.low}L (${s.total} total)`);
+    if (d.tool) {
+        L.push(`**Dependency vulns:** ${d.critical}C ${d.high}H ${d.medium}M ${d.low}L (${d.total} total, via ${d.tool})`);
+        L.push('');
+        L.push(`**Combined signals:** ${s.total + d.total} (${s.total} code + ${d.total} dependency)`);
+    }
+    else {
+        L.push('**Dependency vulns:** no audit data');
+        L.push('');
+        L.push(`**Combined signals:** ${s.total} (code only)`);
+    }
     L.push('');
     L.push('---');
     L.push('');
@@ -109,6 +124,22 @@ function formatSecurityDetailedMarkdown(detailed, elapsed) {
         L.push(`| Low      | ${d.low} |`);
         L.push(`| **Total** | **${d.total}** |`);
         L.push('');
+        if (d.findings.length > 0) {
+            // Per-advisory inventory. Sorted by (severity, package, id) so the
+            // table reads top-down from worst-first within each pack's output.
+            const sortedDeps = [...d.findings].sort((a, b) => SEV_ORDER[a.severity] - SEV_ORDER[b.severity] ||
+                a.package.localeCompare(b.package) ||
+                a.id.localeCompare(b.id));
+            L.push(`Per-advisory detail (${sortedDeps.length} findings):`);
+            L.push('');
+            L.push('| Severity | ID | Package | Installed | Fixed | CVSS | Tool |');
+            L.push('|----------|----|---------|-----------|-------|-----:|------|');
+            for (const f of sortedDeps) {
+                const cvss = f.cvssScore !== undefined ? f.cvssScore.toFixed(1) : '—';
+                L.push(`| ${f.severity.toUpperCase()} | \`${f.id}\` | \`${f.package}\` | ${f.installedVersion ?? '—'} | ${f.fixedVersion ?? '—'} | ${cvss} | ${f.tool} |`);
+            }
+            L.push('');
+        }
         L.push('---');
         L.push('');
     }

package/dist/analyzers/security/detailed.js.map

@@ -1 +1 @@
-{"version":3,"file":"detailed.js","sourceRoot":"","sources":["../../../src/analyzers/security/detailed.ts"],"names":[],"mappings":";;AAcA,sDASC;AAID,wEAsHC;AA7ID,gDAAoD;AACpD,uCAAmE;AACnE,uCAAgE;AAQhE,SAAgB,qBAAqB,CAAC,MAAsB;IAC1D,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAA,kBAAI,EAAC,IAAA,8BAAoB,EAAC,MAAM,CAAC,EAAE,MAAM,EAAE,6BAAmB,CAAC,CAAC;IAChF,OAAO;QACL,GAAG,MAAM;QACT,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,IAAA,6BAAmB,EAAC,MAAM,CAAC,CAAC,KAAK;QAChD,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAExF,SAAgB,8BAA8B,CAC5C,QAAgC,EAChC,OAAe;IAEf,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;IAExC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC1C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,aAAa,MAAM,CAAC,CAAC;IAC5D,CAAC,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,UAAU;IACV,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,kBAAkB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,WAAW;QACpF,CAAC,CAAC,CAAC,IAAI;YACL,CAAC,CAAC,qBAAqB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,IAAI;YACnG,CAAC,CAAC,2BAA2B,CAAC,CACnC,CAAC;IACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,iBAAiB;IACjB,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC/C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAChC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,aAAa,MAAM,CAAC,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,cAAc,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,CAAC,SAAS;gBAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACtB,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,GAAG,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAC3B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,0BAA0B;IAC1B,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,MAAM,GAAsB,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC3D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CACxF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,IAAI,CACJ,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAC7H,CAAC;QACJ,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,eAAe;IACf,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IAED,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,gGAAgG,CACjG,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}
+{"version":3,"file":"detailed.js","sourceRoot":"","sources":["../../../src/analyzers/security/detailed.ts"],"names":[],"mappings":";;AAeA,sDAUC;AAID,wEA0JC;AAlLD,gDAAoD;AACpD,uCAAmE;AACnE,uCAAgE;AAQhE,SAAgB,qBAAqB,CAAC,MAAsB;IAC1D,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAA,kBAAI,EAAC,IAAA,8BAAoB,EAAC,MAAM,CAAC,EAAE,MAAM,EAAE,6BAAmB,CAAC,CAAC;IAChF,OAAO;QACL,GAAG,MAAM;QACT,6EAA6E;QAC7E,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE,IAAA,6BAAmB,EAAC,MAAM,CAAC,CAAC,KAAK;QAChD,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAExF,SAAgB,8BAA8B,CAC5C,QAAgC,EAChC,OAAe;IAEf,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;IACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;IAExC,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC1C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,aAAa,MAAM,CAAC,CAAC;IAC5D,CAAC,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,8DAA8D;IAC9D,gEAAgE;IAChE,2DAA2D;IAC3D,gEAAgE;IAChE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChC,CAAC,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;IAChG,CAAC,CAAC,IAAI,CACJ,uGAAuG,CACxG,CAAC;IACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACjG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,CAAC,CAAC,IAAI,CACJ,yBAAyB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,IAAI,GAAG,CAC3G,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;IACjG,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;IACzD,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,iBAAiB;IACjB,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAC7D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC/C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAChC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,aAAa,MAAM,CAAC,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,cAAc,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,CAAC,SAAS;gBAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACtB,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,GAAG,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAC3B,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,0BAA0B;IAC1B,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,MAAM,GAAsB,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC3D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CACxF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,IAAI,CACJ,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAC7H,CAAC;QACJ,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,eAAe;IACf,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,mEAAmE;YACnE,mEAAmE;YACnE,MAAM,UAAU,GAAqB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CACvD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC7C,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;gBAClC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAC3B,CAAC;YACF,CAAC,CAAC,IAAI,CAAC,wBAAwB,UAAU,CAAC,MAAM,aAAa,CAAC,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;YACxE,CAAC,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;YACxE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBACtE,CAAC,CAAC,IAAI,CACJ,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,gBAAgB,IAAI,GAAG,MAAM,CAAC,CAAC,YAAY,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,IAAI,IAAI,CACnJ,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IAED,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,gGAAgG,CACjG,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/analyzers/security/gather.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/gather.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAU1D;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACxD,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAeD;AAID,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAuCjE;AAID;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7D,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAeD;AAaD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmBzE"}
+{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/gather.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAU1D;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACxD,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAeD;AAID,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAuCjE;AAID;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7D,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAeD;AAcD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAoBzE"}

package/dist/analyzers/security/gather.js

@@ -113,6 +113,7 @@ const EMPTY_DEP_VULNS = {
     low: 0,
     total: 0,
     tool: null,
+    findings: [],
 };
 /**
  * Aggregates dependency vulnerabilities across every active language pack
@@ -142,6 +143,7 @@ async function gatherDepVulns(cwd) {
         low,
         total: critical + high + medium + low,
         tool: envelope.tool,
+        findings: envelope.findings ?? [],
     };
 }
 //# sourceMappingURL=gather.js.map