@vyuhlabs/dxkit 2.0.1 → 2.2.0

package/CHANGELOG.md

@@ -7,6 +7,229 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.2.0] - 2026-04-23
+
+Minor release adding Snyk-style top-level dep attribution across every
+language pack. Answers "which direct manifest dep do I upgrade to fix
+the most advisories" alongside the existing per-leaf-package reporting.
+Drop-in upgrade — additive `topLevelDep?: string[]` field, no schema
+bump required.
+
+### Added — top-level dep attribution (Phase 10h.4)
+
+- **`DepVulnFinding.topLevelDep?: string[]`** — per-advisory list of
+  root manifest entries (direct + dev deps) that transitively pull the
+  vulnerable package. Coarse name-level attribution (unions across
+  multiple parents when the package is reachable from more than one
+  top-level). Enables Snyk-style grouping: one advisory against
+  `tar@7.5.9` surfaces as "under `@loopback/cli`" rather than just
+  "tar has a CVE".
+
+- **TypeScript pack** — BFS over `package-lock.json` (v2/v3) from
+  each root `dependencies` / `devDependencies` entry. Pure parser
+  `buildTsTopLevelDepIndex` unit-tested; benchmark on
+  `vyuhlabs-platform`: 71/71 findings attributed across 31 vulnerable
+  packages, `@loopback/cli` rollup = 29 advisories (matches Snyk UI).
+
+- **Python pack** — BFS over `pip show` graph from packages with empty
+  `Required-by`. Pure parsers `parsePipShowOutput` +
+  `buildPyTopLevelDepIndex`. Venv detection now includes poetry
+  (`poetry env info --path`), pipenv (`pipenv --venv`), and
+  `$VIRTUAL_ENV` env var alongside the existing `.venv`/`venv` fast
+  path — poetry with default `virtualenvs.in-project = false` now
+  resolves.
+
+- **Go pack** — BFS over `go mod graph` output, with `go.mod`'s
+  `// indirect` markers filtering the seed set so only user-declared
+  direct deps become top-levels. Pure parsers `parseGoModDirectDeps` +
+  `buildGoTopLevelDepIndex`.
+
+- **Rust pack** — BFS over `cargo metadata --format-version 1` resolve
+  graph from each direct dep of `resolve.root`. Pure parser
+  `buildRustTopLevelDepIndex`; maps package ids → names, collapses
+  version variants.
+
+- **C# pack** — **two-part expansion**. First,
+  `dotnet list package --vulnerable` now uses `--include-transitive`,
+  so transitive vulns (previously invisible) are surfaced. Second,
+  attribution comes from walking `obj/project.assets.json` — pure
+  parsers `parseProjectAssetsJson` + `buildCsharpTopLevelDepIndex`.
+  Direct findings carry self-attribution; transitive findings gain
+  `topLevelDep` from the assets-json graph. Degrades gracefully when
+  the lockfile is absent (user hasn't run `dotnet restore`).
+
+### Added — bom render surfaces top-level grouping
+
+- **`BomReport.summary.byTopLevelDep: Record<string, BomTopLevelRollup>`**
+  where `BomTopLevelRollup = { advisoryCount, maxSeverity, packages[] }`.
+  Multi-parent advisories increment counters for each top-level they
+  list, matching Snyk's rollup semantics.
+
+- **Markdown "Top-Level Dep Groups" section** in `bom-<date>.md` —
+  sorted by severity then advisory count. First row is the single
+  upgrade that resolves the most critical/highest-volume issues. Caps
+  at 30 top-levels, packages list truncated at 8 with "+N more".
+
+- **Xlsx col 12 annotation** — each advisory line gains
+  ` via <parent>` (single top-level) or ` via <parent> (+N more)`
+  (multi-parent). Reviewer sees upgrade guidance directly in the
+  spreadsheet cell. No suffix when `topLevelDep` is unset.
+
+### Fixed — TS dep-vuln finding dedupe
+
+- `gatherTsDepVulnsResult` now de-duplicates findings by
+  `(package, installedVersion, id)`. npm-audit inlines the same
+  advisory on every consumer's `via[]` across the vulnerability tree
+  (e.g. minimatch's ReDoS appearing on `@loopback/cli`, `glob-parent`,
+  `picomatch` simultaneously); the advisory-emission loop previously
+  pushed N copies of one logical finding. Platform count 94 → 71,
+  14 distinct dupe pairs → 0. Pre-existing from 2.1.0; caught during
+  10h.4 evaluation.
+
+### Notes
+
+- Every pack degrades gracefully when its dep-graph source is missing:
+  TS without `package-lock.json`, Python without a venv, Go without
+  `go.mod`, Rust without `cargo metadata`, C# without
+  `obj/project.assets.json`. Findings still emit; `topLevelDep` stays
+  unset.
+
+- Release validated against `vyuhlabs-platform` TypeScript benchmark.
+  Python/Go/Rust/C# packs exercised via fixture-based unit tests
+  (+53 new tests across the 4 non-TS language test files); real-world
+  validation lands with 2.3.0's cross-ecosystem benchmark fixtures.
+
+## [2.1.0] - 2026-04-23
+
+Minor release adding two new analyzers and a shared XLSX converter.
+Schema-compatible with 2.0.x for all pre-existing reports; introduces
+two new report kinds (`licenses`, `bom`) and a schema v11 → v12 bump on
+the detailed security report. Drop-in upgrade — no existing consumer
+breaks.
+
+### Added — license inventory
+
+- **`vyuh-dxkit licenses [path]`** — per-pack dependency license
+  inventory across TypeScript (license-checker-rseidelsohn), Python
+  (pip-licenses), Go (go-licenses), Rust (cargo-license), and C#
+  (nuget-license). Populates 11 fields per package (name, version,
+  description, license type, license text, source URL, supplier,
+  release date, etc.). Writes `.ai/reports/licenses-<date>.md`; with
+  `--detailed` also a risk-categorized JSON + markdown flagging
+  strong-copyleft, weak-copyleft, unknown-license, missing-attribution
+  packages. TypeScript provider normalizes source URLs through
+  `hosted-git-info` so `git+`/SCP/RFC-SSH variants collapse to canonical
+  HTTPS.
+- **`vyuh-dxkit bom [path]`** — Bill of Materials joining `licenses`
+  with dependency vulnerabilities on `(package, version)`. One row per
+  installed package-version with license metadata (cols 1-9, 15 per
+  customer spec) AND per-package vulnerability rollup: max severity
+  (col 11), per-advisory list with CVSS scores (col 12), and derived
+  Tier-1 resolution proposal (col 13 — "Upgrade X to Y" when every
+  advisory has a fixedVersion, "Upgrade <parent> (transitive fix)" when
+  the fix is in a parent dep, "No fix available" otherwise). Detailed
+  mode (`--detailed`) emits a risk-review markdown with 6 triage
+  buckets (critical/high × no-fix/actionable, medium, low, license-
+  scanner-gap). `--xlsx` / `to-xlsx` produce the 15-column workbook
+  the customer's spreadsheet workflow expects, byte-identical headers.
+- **`vyuh-dxkit to-xlsx <json>`** — shared converter. Reads any
+  licenses or bom detailed JSON and emits the canonical 15-col XLSX.
+  Lets downstream tooling stash JSON and render on demand without re-
+  running the analyzer.
+
+### Added — dependency-vulnerability per-advisory detail
+
+- Every language pack's `depVulns` provider now populates
+  `DepVulnFinding[]` alongside the existing per-severity counts. Counts
+  remain per-package (for `vulnerabilities` command parity); findings
+  are per-advisory with id (GHSA/CVE/PYSEC/GO/RUSTSEC), installed +
+  fixed versions, CVSS score, aliases, summary, references, and tool
+  attribution. `gatherDepVulns` forwards findings into
+  `SecurityReport.summary.dependencies.findings` so the
+  `vulnerabilities --detailed` command renders per-advisory inventory
+  (previously: counts only).
+- `DepVulnFinding` extended with nine optional fields for tier-layered
+  enrichment: `tool` (denormalized producer, renamed from unused
+  `source`), `cvssScore`, `upgradeAdvice`, `reachable`, `epssScore`,
+  `kev`, `riskScore`, `breakingUpgrade`, `aliases`, `summary`,
+  `references`. Per-pack Tier-1 providers populate what their native
+  tools emit; Tier-2/3/4 enrichment lands in later 10h sub-phases.
+- Cross-pack OSV enhancement: `enrichOsv` (renamed from
+  `enrichSeverities`) now returns `{severity, cvssScore}` pairs, and
+  a new `resolveCvssScores` helper does batched alias-fallback
+  lookups. Fills the CVSS gap for GO-\* records (bulk of which carry
+  no severity but whose CVE aliases do) and PYSEC-\* records. TS pack
+  is a no-op via this path (npm-audit already ships CVSS at ~100%);
+  Python cvssScore coverage jumped from 0% → 100% on the fixture,
+  Go from 0% → 55% on vyuhlabs/Tickit.
+- **Go pack parser fix** — `govulncheck -json` emits pretty-printed
+  multi-line JSON, not single-line ndjson. Previous `split('\n')`
+  parser silently failed on every invocation; new balanced-brace
+  `parseJsonStream` helper in `runner.ts` handles both shapes and
+  string-literal escapes. Reusable for any future tool that
+  pretty-prints.
+- **Python pack manifest gating** — previously `pip-audit` ran with
+  no project context and silently scanned dxkit's own graphify-venv.
+  Now routes by manifest: `pip-audit <cwd>` for pyproject.toml/setup.py
+  projects, `pip-audit -r requirements.txt` for requirements projects,
+  null otherwise. Corrected platform audit: 97 → 94 dep vulns (3
+  phantom graphify-venv pip findings removed).
+
+### Added — tool registry
+
+- TypeScript pack: `license-checker-rseidelsohn` (license inventory)
+- Python pack: `pip-licenses` (license inventory)
+- Go pack: `go-licenses` (license inventory, `go install golang.org/...`)
+- Rust pack: `cargo-license` (license inventory, `cargo install`)
+- C# pack: `nuget-license` (license inventory, `dotnet tool install`)
+
+All bundled into per-pack provider commits so `findTool` + provider
+invocation land together (CLAUDE.md rule 1).
+
+### Changed
+
+- **Vulnerability report labelling** — Executive Summary now cleanly
+  separates "Code Findings" (your team patches source) from
+  "Dependency Vulnerabilities" (upgrade the dep) into two tables with
+  a combined total. Previously a single table labelled just "Severity
+  / Count" implied dep vulns were included, which they weren't. The
+  shallow report also now renders a worst-first per-advisory dep-vuln
+  table (50-row cap), so `vulnerabilities` without `--detailed` is
+  already actionable.
+- **Security detailed schema** — bumps from `"11"` → `"12"` for the
+  new `summary.dependencies.findings: DepVulnFinding[]` field in the
+  JSON output. Additive — consumers reading just the old keys stay
+  compatible.
+- **`DepVulnFinding.source` repurposed to `DepVulnFinding.tool`**.
+  The former `'osv.dev' | 'tool-default' | 'tool-reported'` enum was
+  dead code (declared, never written or read). Field now holds the
+  producer tool name (`npm-audit` / `pip-audit` / `govulncheck` /
+  `cargo-audit` / `dotnet-vulnerable`) so per-finding attribution
+  survives merges across multiple providers.
+
+### Fixed
+
+- **npm-audit `fixAvailable` misinterpretation** — `fix.name` is the
+  top-level upgrade target, not the vulnerable package itself. Prior
+  code blindly assigned `fix.version` as `fixedVersion` on every
+  advisory, producing absurd output like "uuid@13.0.0 → Upgrade to
+  3.2.1". Now branches on `fix.name === pkgName`: direct fix sets
+  `fixedVersion`; transitive fix sets `upgradeAdvice` with parent-
+  package guidance ("Upgrade @loopback/cli to 5.0.0 [major]
+  (transitive fix)"). Surfaced ~20 false positives on platform audit
+  covering uuid/octokit/tar/undici/underscore.
+- **bom xlsx col 11/12/13 fill on non-vulnerable rows** — previously
+  blank, creating "scanned-clean vs not-scanned" ambiguity. Now fills
+  "None" / "No action required" so reviewers see at a glance which
+  rows dxkit actually processed.
+
+### Runtime dependencies added
+
+- `exceljs ^4.4.0` — XLSX writer. Adds ~80 transitive deps (bumps
+  dxkit's own license-checker count 242 → ~325).
+- `hosted-git-info ^9.0.2` + `@types/hosted-git-info ^3.0.5` — URL
+  canonicalisation (source URL column of licenses/bom).
+
 ## [2.0.1] - 2026-04-22
 
 Patch release following the 2.0.0 smoke-test. No API or schema changes —

package/README.md

@@ -32,25 +32,31 @@ The two modes are complementary. The analyzers run anywhere; the scaffolder writ
 
 ## Analyzer CLI (`vyuh-dxkit <command>`)
 
-Five deterministic analyzers. Each emits a markdown report to `.ai/reports/` and optional structured JSON.
+Seven deterministic analyzers. Each emits a markdown report to `.ai/reports/` and optional structured JSON.
 
-| Command           | What it does                                                    | Runtime | Output                                     |
-| ----------------- | --------------------------------------------------------------- | ------- | ------------------------------------------ |
-| `health`          | 6-dimension score (Testing, Quality, Docs, Security, Maint, DX) | 10–20s  | `.ai/reports/health-audit-<date>.md`       |
-| `vulnerabilities` | gitleaks + semgrep + `npm audit` / `pip-audit`                  | 5–30s   | `.ai/reports/vulnerability-scan-<date>.md` |
-| `test-gaps`       | Coverage artifact → import-graph → filename (strongest wins)    | <1s     | `.ai/reports/test-gaps-<date>.md`          |
-| `quality`         | Slop score + jscpd duplication + eslint/ruff + hygiene          | 5–15s   | `.ai/reports/quality-review-<date>.md`     |
-| `dev-report`      | Commits, contributors, hot files, velocity, conventional %      | <1s     | `.ai/reports/developer-report-<date>.md`   |
+| Command           | What it does                                                                                                                                | Runtime | Output                                     |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ------------------------------------------ |
+| `health`          | 6-dimension score (Testing, Quality, Docs, Security, Maint, DX)                                                                             | 10–20s  | `.ai/reports/health-audit-<date>.md`       |
+| `vulnerabilities` | gitleaks + semgrep + per-pack dep-audit (per-advisory detail in `--detailed`)                                                               | 5–30s   | `.ai/reports/vulnerability-scan-<date>.md` |
+| `test-gaps`       | Coverage artifact → import-graph → filename (strongest wins)                                                                                | <1s     | `.ai/reports/test-gaps-<date>.md`          |
+| `quality`         | Slop score + jscpd duplication + eslint/ruff + hygiene                                                                                      | 5–15s   | `.ai/reports/quality-review-<date>.md`     |
+| `dev-report`      | Commits, contributors, hot files, velocity, conventional %                                                                                  | <1s     | `.ai/reports/developer-report-<date>.md`   |
+| `licenses`        | Dependency license inventory across every active pack (TS/Python/Go/Rust/C#)                                                                | 5–20s   | `.ai/reports/licenses-<date>.md`           |
+| `bom`             | **Bill of Materials** — joins licenses + vulnerabilities per package, 15-col XLSX; groups advisories by top-level manifest dep (Snyk-style) | 10–40s  | `.ai/reports/bom-<date>.{md,xlsx}`         |
+
+Plus a converter: `vyuh-dxkit to-xlsx <json-file>` renders any `licenses` or `bom` detailed JSON as the canonical 15-column XLSX.
 
 ### Flags (apply to all analyzer commands)
 
-| Flag             | Effect                                                                                |
-| ---------------- | ------------------------------------------------------------------------------------- |
-| `--detailed`     | Also writes `<name>-detailed.md` + `.json` with evidence + ranked remediation actions |
-| `--json`         | Emit pure JSON on stdout. Logs go to stderr so pipes stay clean                       |
-| `--verbose`      | Print per-tool timing to stderr                                                       |
-| `--no-save`      | Skip writing markdown; useful with `--json`                                           |
-| `--since <date>` | (`dev-report` only) Analyze commits on or after `YYYY-MM-DD`                          |
+| Flag             | Effect                                                                                 |
+| ---------------- | -------------------------------------------------------------------------------------- |
+| `--detailed`     | Also writes `<name>-detailed.md` + `.json` with evidence + ranked remediation actions  |
+| `--json`         | Emit pure JSON on stdout. Logs go to stderr so pipes stay clean                        |
+| `--verbose`      | Print per-tool timing to stderr                                                        |
+| `--no-save`      | Skip writing markdown; useful with `--json`                                            |
+| `--xlsx`         | (`licenses`, `bom` only) Also write 15-col `.xlsx` — drop-in for spreadsheet workflows |
+| `-o <file>`      | (`licenses`, `bom`, `to-xlsx`) Override output path for xlsx / converted file          |
+| `--since <date>` | (`dev-report` only) Analyze commits on or after `YYYY-MM-DD`                           |
 
 ### Detailed mode — evidence + ranked fixes
 

package/dist/analyzers/bom/detailed.d.ts

@@ -0,0 +1,26 @@
+/**
+ * BOM analyzer — detailed report.
+ *
+ * Extends the base BomReport with risk-categorized buckets so the
+ * reader can triage the inventory by what needs action first.
+ * Mirrors the licenses/detailed pattern (10h.2.2) but the categories
+ * are vuln-driven rather than license-driven, since BOM exists
+ * primarily to surface upgrade work.
+ */
+import type { BomEntry, BomReport, BomSeverity } from './types';
+export interface BomRiskCategory {
+    /** Severity tier for ordering. */
+    readonly priority: BomSeverity;
+    /** Stable category key — for programmatic filtering / dashboards. */
+    readonly id: 'critical-no-fix' | 'critical-actionable' | 'high-no-fix' | 'high-actionable' | 'medium-vulns' | 'low-vulns' | 'vuln-only-license-gap';
+    readonly title: string;
+    readonly rationale: string;
+    readonly recommendation: string;
+    readonly affected: ReadonlyArray<BomEntry>;
+}
+export interface BomDetailedReport extends BomReport {
+    riskCategories: ReadonlyArray<BomRiskCategory>;
+}
+export declare function buildBomDetailed(report: BomReport): BomDetailedReport;
+export declare function formatBomDetailedMarkdown(detailed: BomDetailedReport, elapsed: string): string;
+//# sourceMappingURL=detailed.d.ts.map

package/dist/analyzers/bom/detailed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detailed.d.ts","sourceRoot":"","sources":["../../../src/analyzers/bom/detailed.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EACP,iBAAiB,GACjB,qBAAqB,GACrB,aAAa,GACb,iBAAiB,GACjB,cAAc,GACd,WAAW,GACX,uBAAuB,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,cAAc,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAChD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,iBAAiB,CA8HrE;AASD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CA6G9F"}

package/dist/analyzers/bom/detailed.js

@@ -0,0 +1,227 @@
+"use strict";
+/**
+ * BOM analyzer — detailed report.
+ *
+ * Extends the base BomReport with risk-categorized buckets so the
+ * reader can triage the inventory by what needs action first.
+ * Mirrors the licenses/detailed pattern (10h.2.2) but the categories
+ * are vuln-driven rather than license-driven, since BOM exists
+ * primarily to surface upgrade work.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildBomDetailed = buildBomDetailed;
+exports.formatBomDetailedMarkdown = formatBomDetailedMarkdown;
+function buildBomDetailed(report) {
+    const categories = [];
+    // Buckets keyed by (severity, has-fix). The `actionable` axis matters
+    // because "critical with no fix" is qualitatively different from
+    // "critical with a one-line upgrade" — same severity, different
+    // remediation cost.
+    const buckets = new Map();
+    for (const e of report.entries) {
+        if (!e.maxSeverity)
+            continue;
+        const actionable = e.upgradeAdvice.startsWith('PROPOSAL:');
+        const key = `${e.maxSeverity}|${actionable ? 'fix' : 'nofix'}`;
+        const arr = buckets.get(key) ?? [];
+        arr.push(e);
+        buckets.set(key, arr);
+    }
+    const criticalNoFix = buckets.get('critical|nofix') ?? [];
+    if (criticalNoFix.length > 0) {
+        categories.push({
+            priority: 'critical',
+            id: 'critical-no-fix',
+            title: 'Critical vulns with no published fix',
+            rationale: 'These packages have one or more critical-severity advisories ' +
+                'with no upstream fix version. Upgrading the dep does not resolve ' +
+                'them — replacement or vendor pressure is the only remediation path.',
+            recommendation: 'Evaluate replacement packages, contact maintainers, or accept ' +
+                'and document the risk. Do not ship to production untreated.',
+            affected: criticalNoFix,
+        });
+    }
+    const criticalActionable = buckets.get('critical|fix') ?? [];
+    if (criticalActionable.length > 0) {
+        categories.push({
+            priority: 'critical',
+            id: 'critical-actionable',
+            title: 'Critical vulns with an upgrade path',
+            rationale: 'These packages have critical advisories AND a published fixed ' +
+                'version. The upgrade is the highest-leverage security action ' +
+                'available for this codebase right now.',
+            recommendation: 'Schedule the upgrades immediately. Prefer the Tier-1 PROPOSAL ' +
+                'target unless a major-version bump introduces compat risk.',
+            affected: criticalActionable,
+        });
+    }
+    const highNoFix = buckets.get('high|nofix') ?? [];
+    if (highNoFix.length > 0) {
+        categories.push({
+            priority: 'high',
+            id: 'high-no-fix',
+            title: 'High-severity vulns with no published fix',
+            rationale: 'High-severity advisories without an upstream fix. Less urgent ' +
+                'than critical-no-fix but still warrants a documented decision.',
+            recommendation: 'Plan replacement evaluation alongside critical-no-fix items. ' +
+                'Track the upstream advisory for fix availability.',
+            affected: highNoFix,
+        });
+    }
+    const highActionable = buckets.get('high|fix') ?? [];
+    if (highActionable.length > 0) {
+        categories.push({
+            priority: 'high',
+            id: 'high-actionable',
+            title: 'High-severity vulns with an upgrade path',
+            rationale: 'High-severity advisories with a published fixed version.',
+            recommendation: 'Schedule upgrades within the next sprint.',
+            affected: highActionable,
+        });
+    }
+    const mediumVulns = [
+        ...(buckets.get('medium|fix') ?? []),
+        ...(buckets.get('medium|nofix') ?? []),
+    ];
+    if (mediumVulns.length > 0) {
+        categories.push({
+            priority: 'medium',
+            id: 'medium-vulns',
+            title: 'Medium-severity vulnerabilities',
+            rationale: 'Medium-severity advisories. Plan into routine dep maintenance.',
+            recommendation: 'Batch into a recurring "dependency upgrade week" cadence. ' +
+                'Watch for severity bumps — OSV/CVSS revisions can promote ' +
+                'these into the high bucket.',
+            affected: mediumVulns,
+        });
+    }
+    const lowVulns = [...(buckets.get('low|fix') ?? []), ...(buckets.get('low|nofix') ?? [])];
+    if (lowVulns.length > 0) {
+        categories.push({
+            priority: 'low',
+            id: 'low-vulns',
+            title: 'Low-severity vulnerabilities',
+            rationale: 'Low-severity advisories. Track but not blocking.',
+            recommendation: 'Bundle into routine maintenance; no urgency.',
+            affected: lowVulns,
+        });
+    }
+    const vulnOnly = report.entries.filter((e) => !e.joinedFromBoth);
+    if (vulnOnly.length > 0) {
+        categories.push({
+            priority: 'medium',
+            id: 'vuln-only-license-gap',
+            title: 'License-scanner gap (vuln-only entries)',
+            rationale: 'These packages were reported by a vulnerability scanner but ' +
+                'not by the license scanner. The license is shown as UNKNOWN; ' +
+                'the most likely cause is a workspace / sub-package the license ' +
+                'tool did not traverse.',
+            recommendation: 'Verify the licenses manually before shipping. If the package ' +
+                'lives in a workspace, surface it in the root manifest or use ' +
+                'the workspace-aware license tool flag.',
+            affected: vulnOnly,
+        });
+    }
+    return { ...report, riskCategories: categories };
+}
+const SEV_LABEL = {
+    critical: 'CRITICAL',
+    high: 'HIGH',
+    medium: 'MEDIUM',
+    low: 'LOW',
+};
+function formatBomDetailedMarkdown(detailed, elapsed) {
+    const L = [];
+    const s = detailed.summary;
+    L.push('# Bill of Materials (BOM) — Detailed');
+    L.push('');
+    L.push(`**Date:** ${detailed.analyzedAt.slice(0, 10)}`);
+    L.push(`**Repository:** ${detailed.repo}`);
+    L.push(`**Branch:** ${detailed.branch} (${detailed.commitSha})`);
+    L.push(`**Schema version:** ${detailed.schemaVersion}`);
+    L.push('');
+    L.push('---');
+    L.push('');
+    L.push('## Summary');
+    L.push('');
+    L.push(`- **Total packages:** ${s.totalPackages}`);
+    L.push(`- **Vulnerable packages:** ${s.vulnerablePackages}`);
+    L.push(`- **Total advisories:** ${s.totalAdvisories} (one package can have many)`);
+    L.push(`- **Actionable upgrades (Tier-1 proposals):** ${s.actionableVulns}`);
+    if (s.vulnOnlyPackages > 0) {
+        L.push(`- **Vuln-only entries (license gap):** ${s.vulnOnlyPackages}`);
+    }
+    L.push('');
+    L.push(`> Reconciles with \`vyuh-dxkit vulnerabilities\`: that command counts ` +
+        `per-advisory (${s.totalAdvisories}); bom collapses per-package ` +
+        `(${s.vulnerablePackages}) so each xlsx row is one upgrade decision.`);
+    L.push('');
+    L.push('---');
+    L.push('');
+    L.push('## Risk Review');
+    L.push('');
+    if (detailed.riskCategories.length === 0) {
+        L.push('No vulnerable packages — nothing to triage.');
+    }
+    else {
+        for (const cat of detailed.riskCategories) {
+            L.push(`### ${SEV_LABEL[cat.priority]}: ${cat.title} (${cat.affected.length})`);
+            L.push('');
+            L.push(`**Why this matters:** ${cat.rationale}`);
+            L.push('');
+            L.push(`**Recommendation:** ${cat.recommendation}`);
+            L.push('');
+            L.push('| Package@Version | License | # Vulns | Resolution |');
+            L.push('|-----------------|---------|--------:|------------|');
+            for (const e of cat.affected) {
+                const advice = e.upgradeAdvice.replace(/\|/g, '\\|');
+                L.push(`| \`${e.package}@${e.version}\` | ${e.licenseType} | ${e.vulns.length} | ${advice} |`);
+            }
+            L.push('');
+        }
+    }
+    L.push('---');
+    L.push('');
+    // Per-advisory inventory across every vuln in every entry. Lets the
+    // reader drill from "this package has 3 vulns" up to the actual CVE
+    // ids without leaving the markdown.
+    L.push('## Per-Advisory Inventory');
+    L.push('');
+    const SEV_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
+    const flat = detailed.entries
+        .filter((e) => e.vulns.length > 0)
+        .flatMap((e) => e.vulns.map((v) => ({
+        severity: v.severity,
+        package: e.package,
+        version: e.version,
+        id: v.id,
+        fixedVersion: v.fixedVersion,
+        cvssScore: v.cvssScore,
+        tool: v.tool,
+        summary: v.summary,
+    })))
+        .sort((a, b) => SEV_RANK[a.severity] - SEV_RANK[b.severity] || a.package.localeCompare(b.package));
+    if (flat.length === 0) {
+        L.push('No vulnerabilities — empty inventory.');
+    }
+    else {
+        L.push(`${flat.length} advisories total.`);
+        L.push('');
+        L.push('| Severity | Package@Version | ID | Fix | CVSS | Tool | Summary |');
+        L.push('|----------|-----------------|----|-----|-----:|------|---------|');
+        for (const v of flat) {
+            const summary = (v.summary || '').replace(/\|/g, '\\|').replace(/\n/g, ' ').slice(0, 100);
+            const cvss = v.cvssScore !== undefined ? v.cvssScore.toFixed(1) : '—';
+            L.push(`| ${SEV_LABEL[v.severity]} | \`${v.package}@${v.version}\` | \`${v.id}\` | ${v.fixedVersion ?? '—'} | ${cvss} | ${v.tool} | ${summary} |`);
+        }
+    }
+    L.push('');
+    L.push('---');
+    L.push('');
+    L.push(`**Tools used:** ${detailed.toolsUsed.join(', ') || '(none)'}`);
+    L.push(`**Analysis time:** ${elapsed}s`);
+    L.push('');
+    L.push('*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit) — detailed mode*');
+    return L.join('\n');
+}
+//# sourceMappingURL=detailed.js.map

package/dist/analyzers/bom/detailed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detailed.js","sourceRoot":"","sources":["../../../src/analyzers/bom/detailed.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA0BH,4CA8HC;AASD,8DA6GC;AApPD,SAAgB,gBAAgB,CAAC,MAAiB;IAChD,MAAM,UAAU,GAAsB,EAAE,CAAC;IAEzC,sEAAsE;IACtE,iEAAiE;IACjE,gEAAgE;IAChE,oBAAoB;IACpB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,SAAS;QAC7B,MAAM,UAAU,GAAG,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,UAAU;YACpB,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,sCAAsC;YAC7C,SAAS,EACP,+DAA+D;gBAC/D,mEAAmE;gBACnE,qEAAqE;YACvE,cAAc,EACZ,gEAAgE;gBAChE,6DAA6D;YAC/D,QAAQ,EAAE,aAAa;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,UAAU;YACpB,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,qCAAqC;YAC5C,SAAS,EACP,gEAAgE;gBAChE,+DAA+D;gBAC/D,wCAAwC;YAC1C,cAAc,EACZ,gEAAgE;gBAChE,4DAA4D;YAC9D,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,MAAM;YAChB,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,2CAA2C;YAClD,SAAS,EACP,gEAAgE;gBAChE,gEAAgE;YAClE,cAAc,EACZ,+DAA+D;gBAC/D,mDAAmD;YACrD,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,MAAM;YAChB,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,0CAA0C;YACjD,SAAS,EAAE,0DAA0D;YACrE,cAAc,EAAE,2CAA2C;YAC3D,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG;QAClB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;KACvC,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,QAAQ;YAClB,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,iCAAiC;YACxC,SAAS,EAAE,gEAAgE;YAC3E,cAAc,EACZ,4DAA4D;gBAC5D,4DAA4D;gBAC5D,6BAA6B;YAC/B,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,KAAK;YACf,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,8BAA8B;YACrC,SAAS,EAAE,kDAAkD;YAC7D,cAAc,EAAE,8CAA8C;YAC9D,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC;YACd,QAAQ,EAAE,QAAQ;YAClB,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,yCAAyC;YAChD,SAAS,EACP,8DAA8D;gBAC9D,+DAA+D;gBAC/D,iEAAiE;gBACjE,wBAAwB;YAC1B,cAAc,EACZ,+DAA+D;gBAC/D,+DAA+D;gBAC/D,wCAAwC;YAC1C,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,SAAS,GAAgC;IAC7C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,SAAgB,yBAAyB,CAAC,QAA2B,EAAE,OAAe;IACpF,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;IAE3B,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,eAAe,8BAA8B,CAAC,CAAC;IACnF,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,wEAAwE;QACtE,iBAAiB,CAAC,CAAC,eAAe,+BAA+B;QACjE,IAAI,CAAC,CAAC,kBAAkB,6CAA6C,CACxE,CAAC;IACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAChF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,yBAAyB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,uBAAuB,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC/D,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACrD,CAAC,CAAC,IAAI,CACJ,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,MAAM,MAAM,IAAI,CACvF,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,oEAAoE;IACpE,oEAAoE;IACpE,oCAAoC;IACpC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACpC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,QAAQ,GAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC1F,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACb,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC,CAAC,CACJ;SACA,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAC5F,CAAC;IAEJ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,oBAAoB,CAAC,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAC5E,CAAC,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAC5E,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1F,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACtE,CAAC,CAAC,IAAI,CACJ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,YAAY,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,IAAI,MAAM,OAAO,IAAI,CAC3I,CAAC;QACJ,CAAC;IACH,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CACJ,gGAAgG,CACjG,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/analyzers/bom/gather.d.ts

@@ -0,0 +1,63 @@
+/**
+ * BOM analyzer data-gather. Joins LICENSES + DEP_VULNS via the
+ * existing capability gather functions — no new tool invocation logic
+ * (CLAUDE.md rule 2). The gather just calls each, then walks both
+ * result sets to build a per-package join keyed by `package@version`.
+ */
+import type { DepVulnFinding } from '../../languages/capabilities/types';
+import type { BomEntry, BomTopLevelRollup } from './types';
+/**
+ * Compare two version strings as semver triples. Strips a leading
+ * 'v' (Go-pack convention) and compares dot-separated numeric
+ * components. Falls back to lexicographic comparison when either
+ * input isn't a parseable triple — preserves a deterministic
+ * ordering for non-semver versions (e.g. cargo's "0.10.55+echo.1").
+ */
+export declare function compareSemver(a: string, b: string): number;
+/** Highest version in `versions` per compareSemver. Returns the input
+ *  unchanged when only one version is supplied. */
+export declare function maxSemver(versions: string[]): string;
+/**
+ * Tier-1 resolution proposal derived purely from `fixedVersion`
+ * data shipped by each pack's depVulns provider. Per checkpoint §9:
+ *   - no vulns → empty
+ *   - every vuln has fixedVersion → "PROPOSAL: Upgrade to <maxFix> (resolves N)"
+ *   - some vuln lacks fixedVersion → "No fix available — evaluate replacement"
+ *
+ * Higher tiers (10h.4 Snyk, 10h.6 osv-scanner fix) populate
+ * `upgradeAdvice` directly on each finding; the bom render layer
+ * picks the richest available value per package.
+ */
+export declare function deriveTier1Resolution(vulns: DepVulnFinding[]): string;
+/**
+ * Build the per-top-level-dep rollup from a flat list of entries.
+ * Walks every advisory under every entry; increments the counter for
+ * each top-level the advisory lists (a vuln reachable from two
+ * top-levels increments both, matching Snyk's grouping semantics).
+ *
+ * Entries with no topLevelDep attribution contribute nothing — the
+ * rollup is best-effort based on what each pack populates. Pure
+ * function; unit-testable.
+ */
+export declare function buildByTopLevelDep(entries: BomEntry[]): Record<string, BomTopLevelRollup>;
+/**
+ * Join LICENSES + DEP_VULNS by (package, version). Strategy:
+ *   - Primary index: package@version. Both LicenseFinding and
+ *     DepVulnFinding usually carry both — match exact.
+ *   - Fallback: package only. DepVulnFindings without
+ *     installedVersion fall back to package-name match against
+ *     the licenses list (joins to the single matching version
+ *     when unambiguous, all matching versions when not).
+ *
+ * License-only packages emit BomEntry with empty `vulns`. Vuln-only
+ * packages (rare — license scanner gap) emit a row with empty
+ * license fields and `joinedFromBoth: false` so the detailed report
+ * can flag the gap.
+ */
+export interface BomGatherResult {
+    entries: BomEntry[];
+    toolsUsed: string[];
+    toolsUnavailable: string[];
+}
+export declare function gatherBomEntries(cwd: string): Promise<BomGatherResult>;
+//# sourceMappingURL=gather.d.ts.map

package/dist/analyzers/bom/gather.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../../src/analyzers/bom/gather.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,oCAAoC,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAe,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAIxE;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAgB1D;AAED;mDACmD;AACnD,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAGpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,MAAM,CAQrE;AAYD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAkCzF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAiF5E"}