@vyuhlabs/dxkit 2.0.1 → 2.2.0

package/dist/analyzers/bom/gather.js

@@ -0,0 +1,229 @@
+"use strict";
+/**
+ * BOM analyzer data-gather. Joins LICENSES + DEP_VULNS via the
+ * existing capability gather functions — no new tool invocation logic
+ * (CLAUDE.md rule 2). The gather just calls each, then walks both
+ * result sets to build a per-package join keyed by `package@version`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareSemver = compareSemver;
+exports.maxSemver = maxSemver;
+exports.deriveTier1Resolution = deriveTier1Resolution;
+exports.buildByTopLevelDep = buildByTopLevelDep;
+exports.gatherBomEntries = gatherBomEntries;
+const gather_1 = require("../licenses/gather");
+const gather_2 = require("../security/gather");
+const SEV_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
+/**
+ * Compare two version strings as semver triples. Strips a leading
+ * 'v' (Go-pack convention) and compares dot-separated numeric
+ * components. Falls back to lexicographic comparison when either
+ * input isn't a parseable triple — preserves a deterministic
+ * ordering for non-semver versions (e.g. cargo's "0.10.55+echo.1").
+ */
+function compareSemver(a, b) {
+    const norm = (v) => v.replace(/^v/, '');
+    const pa = norm(a)
+        .split('.')
+        .map((p) => parseInt(p, 10));
+    const pb = norm(b)
+        .split('.')
+        .map((p) => parseInt(p, 10));
+    if (pa.some(isNaN) || pb.some(isNaN))
+        return norm(a).localeCompare(norm(b));
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+        const xa = pa[i] ?? 0;
+        const xb = pb[i] ?? 0;
+        if (xa !== xb)
+            return xa - xb;
+    }
+    return 0;
+}
+/** Highest version in `versions` per compareSemver. Returns the input
+ *  unchanged when only one version is supplied. */
+function maxSemver(versions) {
+    if (versions.length === 0)
+        return '';
+    return versions.reduce((acc, v) => (compareSemver(v, acc) > 0 ? v : acc));
+}
+/**
+ * Tier-1 resolution proposal derived purely from `fixedVersion`
+ * data shipped by each pack's depVulns provider. Per checkpoint §9:
+ *   - no vulns → empty
+ *   - every vuln has fixedVersion → "PROPOSAL: Upgrade to <maxFix> (resolves N)"
+ *   - some vuln lacks fixedVersion → "No fix available — evaluate replacement"
+ *
+ * Higher tiers (10h.4 Snyk, 10h.6 osv-scanner fix) populate
+ * `upgradeAdvice` directly on each finding; the bom render layer
+ * picks the richest available value per package.
+ */
+function deriveTier1Resolution(vulns) {
+    if (vulns.length === 0)
+        return '';
+    const fixes = vulns.map((v) => v.fixedVersion).filter((v) => !!v);
+    if (fixes.length !== vulns.length) {
+        return 'No fix available — evaluate replacement';
+    }
+    const target = maxSemver(fixes);
+    return `PROPOSAL: Upgrade to ${target} (resolves ${vulns.length} vuln${vulns.length === 1 ? '' : 's'})`;
+}
+/** Highest severity across the supplied vulns. */
+function maxSeverityOf(vulns) {
+    if (vulns.length === 0)
+        return null;
+    let best = 'low';
+    for (const v of vulns) {
+        if (SEV_RANK[v.severity] < SEV_RANK[best])
+            best = v.severity;
+    }
+    return best;
+}
+/**
+ * Build the per-top-level-dep rollup from a flat list of entries.
+ * Walks every advisory under every entry; increments the counter for
+ * each top-level the advisory lists (a vuln reachable from two
+ * top-levels increments both, matching Snyk's grouping semantics).
+ *
+ * Entries with no topLevelDep attribution contribute nothing — the
+ * rollup is best-effort based on what each pack populates. Pure
+ * function; unit-testable.
+ */
+function buildByTopLevelDep(entries) {
+    const accum = new Map();
+    for (const e of entries) {
+        for (const v of e.vulns) {
+            const tops = v.topLevelDep;
+            if (!tops || tops.length === 0)
+                continue;
+            for (const top of tops) {
+                const cur = accum.get(top);
+                if (!cur) {
+                    accum.set(top, {
+                        advisoryCount: 1,
+                        maxSeverity: v.severity,
+                        packages: new Set([e.package]),
+                    });
+                }
+                else {
+                    cur.advisoryCount++;
+                    if (SEV_RANK[v.severity] < SEV_RANK[cur.maxSeverity])
+                        cur.maxSeverity = v.severity;
+                    cur.packages.add(e.package);
+                }
+            }
+        }
+    }
+    const out = {};
+    for (const [top, data] of accum) {
+        out[top] = {
+            advisoryCount: data.advisoryCount,
+            maxSeverity: data.maxSeverity,
+            packages: [...data.packages].sort(),
+        };
+    }
+    return out;
+}
+async function gatherBomEntries(cwd) {
+    const [licensesEnv, depVulns] = await Promise.all([
+        (0, gather_1.gatherLicensesResult)(cwd),
+        (0, gather_2.gatherDepVulns)(cwd),
+    ]);
+    const licenseFindings = licensesEnv?.findings ?? [];
+    const vulnFindings = depVulns.findings;
+    // Index vulns by package@version (primary) and package (fallback).
+    const vulnByPkgVer = new Map();
+    const vulnByPkg = new Map();
+    for (const v of vulnFindings) {
+        if (v.installedVersion) {
+            const key = `${v.package}@${v.installedVersion}`;
+            const arr = vulnByPkgVer.get(key) ?? [];
+            arr.push(v);
+            vulnByPkgVer.set(key, arr);
+        }
+        const arr = vulnByPkg.get(v.package) ?? [];
+        arr.push(v);
+        vulnByPkg.set(v.package, arr);
+    }
+    const entries = [];
+    const matchedVulnKeys = new Set();
+    for (const lic of licenseFindings) {
+        const exactKey = `${lic.package}@${lic.version}`;
+        let attached = vulnByPkgVer.get(exactKey);
+        if (attached) {
+            matchedVulnKeys.add(exactKey);
+        }
+        else {
+            // Version-less vuln entries fall back to package-name match.
+            // Filter to only those that lacked installedVersion to avoid
+            // double-counting against other version rows.
+            const byPkg = vulnByPkg.get(lic.package) ?? [];
+            const versionless = byPkg.filter((v) => !v.installedVersion);
+            attached = versionless.length > 0 ? versionless : [];
+        }
+        entries.push(buildEntry(lic, attached, true));
+    }
+    // Vuln-only entries: vulns whose package@version did not match a
+    // license row AND whose package is absent from every license entry
+    // (versionless fallback is consumed above).
+    const licensePackages = new Set(licenseFindings.map((l) => l.package));
+    const vulnOnlyByPkgVer = new Map();
+    for (const [key, vulns] of vulnByPkgVer) {
+        if (matchedVulnKeys.has(key))
+            continue;
+        const pkg = vulns[0].package;
+        if (licensePackages.has(pkg))
+            continue; // already attached via versionless or other version
+        const arr = vulnOnlyByPkgVer.get(key) ?? [];
+        arr.push(...vulns);
+        vulnOnlyByPkgVer.set(key, arr);
+    }
+    for (const [, vulns] of vulnOnlyByPkgVer) {
+        const v0 = vulns[0];
+        const synthLicense = {
+            package: v0.package,
+            version: v0.installedVersion ?? 'unknown',
+            licenseType: 'UNKNOWN',
+        };
+        entries.push(buildEntry(synthLicense, vulns, false));
+    }
+    // Stable sort: package alphabetical, then version.
+    entries.sort((a, b) => a.package.localeCompare(b.package) || compareSemver(a.version, b.version));
+    const toolsUsed = new Set();
+    if (licensesEnv?.tool) {
+        for (const t of licensesEnv.tool.split(', '))
+            if (t)
+                toolsUsed.add(t);
+    }
+    if (depVulns.tool) {
+        for (const t of depVulns.tool.split(', '))
+            if (t)
+                toolsUsed.add(t);
+    }
+    return {
+        entries,
+        toolsUsed: [...toolsUsed],
+        toolsUnavailable: [],
+    };
+}
+function buildEntry(lic, vulns, joinedFromBoth) {
+    // Tier 2/4 fields on individual findings outrank Tier-1 derivation.
+    // Pick the first non-empty `upgradeAdvice` from any finding; fall
+    // back to derived advice when all vulns are Tier-1 only.
+    const tieredAdvice = vulns.map((v) => v.upgradeAdvice).find((a) => a && a.length > 0);
+    return {
+        package: lic.package,
+        version: lic.version,
+        licenseType: lic.licenseType,
+        licenseText: lic.licenseText,
+        sourceUrl: lic.sourceUrl,
+        description: lic.description,
+        supplier: lic.supplier,
+        releaseDate: lic.releaseDate,
+        vulns,
+        maxSeverity: maxSeverityOf(vulns),
+        upgradeAdvice: tieredAdvice ?? deriveTier1Resolution(vulns),
+        joinedFromBoth,
+    };
+}
+//# sourceMappingURL=gather.js.map

package/dist/analyzers/bom/gather.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.js","sourceRoot":"","sources":["../../../src/analyzers/bom/gather.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAgBH,sCAgBC;AAID,8BAGC;AAaD,sDAQC;AAsBD,gDAkCC;AAsBD,4CAiFC;AAzND,+CAA0D;AAC1D,+CAAoD;AAIpD,MAAM,QAAQ,GAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAE1F;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/B,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;mDACmD;AACnD,SAAgB,SAAS,CAAC,QAAkB;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CAAC,KAAuB;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAClC,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,wBAAwB,MAAM,cAAc,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;AAC1G,CAAC;AAED,kDAAkD;AAClD,SAAS,aAAa,CAAC,KAAuB;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,IAAI,GAAgB,KAAK,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAAC,OAAmB;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAGlB,CAAC;IACJ,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC;YAC3B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;wBACb,aAAa,EAAE,CAAC;wBAChB,WAAW,EAAE,CAAC,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;qBAC/B,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,aAAa,EAAE,CAAC;oBACpB,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;wBAAE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC;oBACnF,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,GAAG;YACT,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;SACpC,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAsBM,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,IAAA,6BAAoB,EAAC,GAAG,CAAC;QACzB,IAAA,uBAAc,EAAC,GAAG,CAAC;KACpB,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC;IACpD,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAEvC,mEAAmE;IACnE,MAAM,YAAY,GAAG,IAAI,GAAG,EAA4B,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACjD,IAAI,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,QAAQ,EAAE,CAAC;YACb,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,6DAA6D;YAC7D,6DAA6D;YAC7D,8CAA8C;YAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/C,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;YAC7D,QAAQ,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,iEAAiE;IACjE,mEAAmE;IACnE,4CAA4C;IAC5C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7B,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,oDAAoD;QAC5F,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACnB,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,YAAY,GAAmB;YACnC,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,OAAO,EAAE,EAAE,CAAC,gBAAgB,IAAI,SAAS;YACzC,WAAW,EAAE,SAAS;SACvB,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,mDAAmD;IACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAElG,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,WAAW,EAAE,IAAI,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO;QACL,OAAO;QACP,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;QACzB,gBAAgB,EAAE,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,GAAmB,EACnB,KAAuB,EACvB,cAAuB;IAEvB,oEAAoE;IACpE,kEAAkE;IAClE,yDAAyD;IACzD,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtF,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,KAAK;QACL,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC;QACjC,aAAa,EAAE,YAAY,IAAI,qBAAqB,CAAC,KAAK,CAAC;QAC3D,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/analyzers/bom/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * BOM (Bill of Materials) analyzer — public API.
+ *
+ * Joins the LICENSES and DEP_VULNS capabilities by `package@version`
+ * to produce one row per installed package with both license inventory
+ * data (cols 1-9, 15) and per-package vulnerability rollup
+ * (cols 11-13). Output formats:
+ *
+ *   - `formatBomReport(report)` — markdown summary for
+ *     `.ai/reports/bom-<date>.md` and PR comments.
+ *   - JSON via the CLI's `--json` flag (10h.3.9) — schema-versioned
+ *     pass-through with the added summary + repo metadata.
+ *   - XLSX via the shared converter (10h.3.9) — drop-in replacement
+ *     for the customer's spreadsheet workflow with cols 11-13 filled.
+ */
+import type { BomReport } from './types';
+export type { BomReport, BomEntry } from './types';
+export interface AnalyzeBomOptions {
+    verbose?: boolean;
+}
+export declare function analyzeBom(repoPath: string, _options?: AnalyzeBomOptions): Promise<BomReport>;
+export declare function formatBomReport(report: BomReport, elapsed: string): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/analyzers/bom/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analyzers/bom/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,EAAY,SAAS,EAAe,MAAM,SAAS,CAAC;AAEhE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,iBAAsB,GAC/B,OAAO,CAAC,SAAS,CAAC,CAsCpB;AASD,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CA8I1E"}

package/dist/analyzers/bom/index.js

@@ -0,0 +1,220 @@
+"use strict";
+/**
+ * BOM (Bill of Materials) analyzer — public API.
+ *
+ * Joins the LICENSES and DEP_VULNS capabilities by `package@version`
+ * to produce one row per installed package with both license inventory
+ * data (cols 1-9, 15) and per-package vulnerability rollup
+ * (cols 11-13). Output formats:
+ *
+ *   - `formatBomReport(report)` — markdown summary for
+ *     `.ai/reports/bom-<date>.md` and PR comments.
+ *   - JSON via the CLI's `--json` flag (10h.3.9) — schema-versioned
+ *     pass-through with the added summary + repo metadata.
+ *   - XLSX via the shared converter (10h.3.9) — drop-in replacement
+ *     for the customer's spreadsheet workflow with cols 11-13 filled.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeBom = analyzeBom;
+exports.formatBomReport = formatBomReport;
+const path = __importStar(require("path"));
+const detect_1 = require("../../detect");
+const runner_1 = require("../tools/runner");
+const gather_1 = require("./gather");
+async function analyzeBom(repoPath, _options = {}) {
+    const stack = (0, detect_1.detect)(repoPath);
+    const { entries, toolsUsed, toolsUnavailable } = await (0, gather_1.gatherBomEntries)(repoPath);
+    const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
+    let vulnerablePackages = 0;
+    let actionableVulns = 0;
+    let totalAdvisories = 0;
+    let vulnOnlyPackages = 0;
+    for (const e of entries) {
+        if (e.maxSeverity) {
+            bySeverity[e.maxSeverity]++;
+            vulnerablePackages++;
+            if (e.upgradeAdvice.startsWith('PROPOSAL:'))
+                actionableVulns++;
+        }
+        totalAdvisories += e.vulns.length;
+        if (!e.joinedFromBoth)
+            vulnOnlyPackages++;
+    }
+    return {
+        repo: stack.projectName || path.basename(repoPath),
+        analyzedAt: new Date().toISOString(),
+        commitSha: (0, runner_1.run)('git rev-parse --short HEAD 2>/dev/null', repoPath),
+        branch: (0, runner_1.run)('git rev-parse --abbrev-ref HEAD 2>/dev/null', repoPath),
+        schemaVersion: '1',
+        summary: {
+            totalPackages: entries.length,
+            bySeverity,
+            vulnerablePackages,
+            actionableVulns,
+            totalAdvisories,
+            vulnOnlyPackages,
+            byTopLevelDep: (0, gather_1.buildByTopLevelDep)(entries),
+        },
+        entries,
+        toolsUsed,
+        toolsUnavailable,
+    };
+}
+const SEV_BADGE = {
+    critical: 'CRITICAL',
+    high: 'HIGH',
+    medium: 'MEDIUM',
+    low: 'LOW',
+};
+function formatBomReport(report, elapsed) {
+    const L = [];
+    L.push('# Bill of Materials (BOM) Report');
+    L.push('');
+    L.push(`**Date:** ${report.analyzedAt.slice(0, 10)}`);
+    L.push(`**Repository:** ${report.repo}`);
+    L.push(`**Branch:** ${report.branch} (${report.commitSha})`);
+    L.push('');
+    L.push('---');
+    L.push('');
+    // Summary
+    const s = report.summary;
+    L.push('## Summary');
+    L.push('');
+    L.push(`**${s.totalPackages} packages** indexed across the active language pack(s).`);
+    L.push('');
+    if (s.vulnerablePackages > 0) {
+        L.push(`**${s.vulnerablePackages} packages** carry known vulnerabilities — ` +
+            `**${s.totalAdvisories} advisories** in total ` +
+            `(one package can have many advisories, e.g. multiple CVEs against ` +
+            `the same installed version). ` +
+            `**${s.actionableVulns}** of those packages have a Tier-1 upgrade proposal.`);
+        L.push('');
+        L.push(`> The numbers reconcile with \`vyuh-dxkit vulnerabilities\`: ` +
+            `that command reports per-advisory (${s.totalAdvisories}); bom collapses ` +
+            `them per-package (${s.vulnerablePackages}) so each row of the ` +
+            `xlsx is one upgrade decision.`);
+        L.push('');
+        L.push('| Severity (worst-of-package) | Vulnerable Packages |');
+        L.push('|-----------------------------|--------------------:|');
+        L.push(`| CRITICAL | ${s.bySeverity.critical} |`);
+        L.push(`| HIGH     | ${s.bySeverity.high} |`);
+        L.push(`| MEDIUM   | ${s.bySeverity.medium} |`);
+        L.push(`| LOW      | ${s.bySeverity.low} |`);
+        L.push('');
+    }
+    if (s.vulnOnlyPackages > 0) {
+        L.push(`> ⚠️ ${s.vulnOnlyPackages} package(s) reported only by the vulnerability scanner — ` +
+            `the license scanner missed them (likely a workspace / sub-package). ` +
+            `These rows show "UNKNOWN" license; verify manually before shipping.`);
+        L.push('');
+    }
+    L.push('---');
+    L.push('');
+    // Snyk-style top-level dep rollup — upgrade-oriented view answering
+    // "which single `npm install X` / `go get Y` resolves the most
+    // advisories". Only rendered when at least one finding carried
+    // topLevelDep attribution (packs that can't parse a lockfile/graph
+    // simply don't populate it).
+    const topLevelEntries = Object.entries(s.byTopLevelDep);
+    if (topLevelEntries.length > 0) {
+        L.push('## Top-Level Dep Groups');
+        L.push('');
+        L.push('Grouped by direct manifest dep so each row is one upgrade decision. ' +
+            'Sorted by severity, then advisory count — the top row is the single ' +
+            'upgrade that resolves the most critical/highest-volume issues.');
+        L.push('');
+        const SEV_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
+        const sorted = topLevelEntries.sort((a, b) => SEV_RANK[a[1].maxSeverity] - SEV_RANK[b[1].maxSeverity] ||
+            b[1].advisoryCount - a[1].advisoryCount ||
+            a[0].localeCompare(b[0]));
+        const cap = 30;
+        const shown = sorted.slice(0, cap);
+        L.push('| Worst Severity | Top-Level Dep | Advisories | Vulnerable Packages |');
+        L.push('|----------------|---------------|-----------:|---------------------|');
+        for (const [top, r] of shown) {
+            const pkgCap = 8;
+            const pkgList = r.packages.length > pkgCap
+                ? `${r.packages.slice(0, pkgCap).join(', ')}, +${r.packages.length - pkgCap} more`
+                : r.packages.join(', ');
+            L.push(`| ${SEV_BADGE[r.maxSeverity]} | \`${top}\` | ${r.advisoryCount} | ${pkgList} |`);
+        }
+        if (sorted.length > cap) {
+            L.push('');
+            L.push(`_Showing ${cap} of ${sorted.length} top-level deps with rolled-up advisories._`);
+        }
+        L.push('');
+        L.push('---');
+        L.push('');
+    }
+    // Vulnerable packages section — worst-first, one row per package
+    if (s.vulnerablePackages > 0) {
+        L.push('## Vulnerable Packages');
+        L.push('');
+        L.push('Sorted by severity (worst-first), then alphabetical. ');
+        L.push('Resolution column shows the Tier-1 derived upgrade target ');
+        L.push('(or "No fix available" when an advisory has no published patch).');
+        L.push('');
+        const SEV_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
+        const vuln = report.entries
+            .filter((e) => e.maxSeverity)
+            .sort((a, b) => SEV_RANK[a.maxSeverity] - SEV_RANK[b.maxSeverity] || a.package.localeCompare(b.package));
+        const cap = 50;
+        const shown = vuln.slice(0, cap);
+        L.push('| Severity | Package@Version | License | # Vulns | Resolution |');
+        L.push('|----------|-----------------|---------|--------:|------------|');
+        for (const e of shown) {
+            const advice = e.upgradeAdvice.replace(/\|/g, '\\|');
+            L.push(`| ${SEV_BADGE[e.maxSeverity]} | \`${e.package}@${e.version}\` | ${e.licenseType} | ${e.vulns.length} | ${advice} |`);
+        }
+        if (vuln.length > cap) {
+            L.push('');
+            L.push(`_Showing ${cap} of ${vuln.length} vulnerable packages. Run with \`--detailed\` for the full inventory + per-advisory CVE list._`);
+        }
+        L.push('');
+        L.push('---');
+        L.push('');
+    }
+    // Footer
+    L.push(`**Tools used:** ${report.toolsUsed.join(', ') || '(none)'}`);
+    if (report.toolsUnavailable.length > 0) {
+        L.push(`**Tools unavailable:** ${report.toolsUnavailable.join(', ')}`);
+    }
+    L.push(`**Analysis time:** ${elapsed}s`);
+    L.push('');
+    L.push('*Generated by [VyuhLabs DXKit](https://www.npmjs.com/package/@vyuhlabs/dxkit)*');
+    return L.join('\n');
+}
+//# sourceMappingURL=index.js.map

package/dist/analyzers/bom/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyzers/bom/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcH,gCAyCC;AASD,0CA8IC;AA5MD,2CAA6B;AAC7B,yCAAsC;AACtC,4CAAsC;AACtC,qCAAgE;AASzD,KAAK,UAAU,UAAU,CAC9B,QAAgB,EAChB,WAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAA,yBAAgB,EAAC,QAAQ,CAAC,CAAC;IAElF,MAAM,UAAU,GAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC5F,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAClB,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,kBAAkB,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC;gBAAE,eAAe,EAAE,CAAC;QACjE,CAAC;QACD,eAAe,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,cAAc;YAAE,gBAAgB,EAAE,CAAC;IAC5C,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,IAAA,YAAG,EAAC,wCAAwC,EAAE,QAAQ,CAAC;QAClE,MAAM,EAAE,IAAA,YAAG,EAAC,6CAA6C,EAAE,QAAQ,CAAC;QACpE,aAAa,EAAE,GAAG;QAClB,OAAO,EAAE;YACP,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,UAAU;YACV,kBAAkB;YAClB,eAAe;YACf,eAAe;YACf,gBAAgB;YAChB,aAAa,EAAE,IAAA,2BAAkB,EAAC,OAAO,CAAC;SAC3C;QACD,OAAO;QACP,SAAS;QACT,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAgC;IAC7C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,SAAgB,eAAe,CAAC,MAAiB,EAAE,OAAe;IAChE,MAAM,CAAC,GAAa,EAAE,CAAC;IAEvB,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7D,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,UAAU;IACV,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,yDAAyD,CAAC,CAAC;IACtF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,IAAI,CAAC,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC7B,CAAC,CAAC,IAAI,CACJ,KAAK,CAAC,CAAC,kBAAkB,4CAA4C;YACnE,KAAK,CAAC,CAAC,eAAe,yBAAyB;YAC/C,oEAAoE;YACpE,+BAA+B;YAC/B,KAAK,CAAC,CAAC,eAAe,sDAAsD,CAC/E,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CACJ,+DAA+D;YAC7D,sCAAsC,CAAC,CAAC,eAAe,mBAAmB;YAC1E,qBAAqB,CAAC,CAAC,kBAAkB,uBAAuB;YAChE,+BAA+B,CAClC,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAChE,CAAC,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAChE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;QAChD,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,CACJ,QAAQ,CAAC,CAAC,gBAAgB,2DAA2D;YACnF,sEAAsE;YACtE,qEAAqE,CACxE,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEX,oEAAoE;IACpE,+DAA+D;IAC/D,+DAA+D;IAC/D,mEAAmE;IACnE,6BAA6B;IAC7B,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACxD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CACJ,sEAAsE;YACpE,sEAAsE;YACtE,gEAAgE,CACnE,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,MAAM,QAAQ,GAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1F,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YACvD,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;YACvC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3B,CAAC;QACF,MAAM,GAAG,GAAG,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QAChF,CAAC,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QAChF,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,CAAC,CAAC;YACjB,MAAM,OAAO,GACX,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM;gBACxB,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,OAAO;gBAClF,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC,aAAa,MAAM,OAAO,IAAI,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACxB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,YAAY,GAAG,OAAO,MAAM,CAAC,MAAM,6CAA6C,CAAC,CAAC;QAC3F,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IAED,iEAAiE;IACjE,IAAI,CAAC,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAChE,CAAC,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACrE,CAAC,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,MAAM,QAAQ,GAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,GAAe,MAAM,CAAC,OAAO;aACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;aAC5B,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,QAAQ,CAAC,CAAC,CAAC,WAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAY,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAC5F,CAAC;QACJ,MAAM,GAAG,GAAG,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACrD,CAAC,CAAC,IAAI,CACJ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAY,CAAC,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,MAAM,MAAM,IAAI,CACtH,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC,CAAC,IAAI,CACJ,YAAY,GAAG,OAAO,IAAI,CAAC,MAAM,gGAAgG,CAClI,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IAED,SAAS;IACT,CAAC,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,sBAAsB,OAAO,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAEzF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/analyzers/bom/types.d.ts

@@ -0,0 +1,91 @@
+/**
+ * BOM (Bill of Materials) analyzer report shape.
+ *
+ * Joins the LICENSES and DEP_VULNS capabilities on (package, version)
+ * to produce one row per installed package with both the license
+ * inventory data the customer's spreadsheet needs (cols 1-9, 15) and
+ * the per-package vulnerability rollup (cols 11-13). Per-advisory
+ * detail stays attached to each row so the xlsx writer (10h.3.9)
+ * can render col 12 (Vulnerability Issues) as an enumerated list.
+ */
+import type { DepVulnFinding } from '../../languages/capabilities/types';
+export type BomSeverity = 'critical' | 'high' | 'medium' | 'low';
+export interface BomEntry {
+    package: string;
+    version: string;
+    licenseType: string;
+    licenseText?: string;
+    sourceUrl?: string;
+    description?: string;
+    supplier?: string;
+    releaseDate?: string;
+    vulns: DepVulnFinding[];
+    /** Highest severity across `vulns`; null when the package has no
+     *  known vulnerabilities. Drives col 11 "Criticality of usage". */
+    maxSeverity: BomSeverity | null;
+    /** Tier-1 resolution proposal derived from `vulns[].fixedVersion`
+     *  at gather time. Empty string when no vulns. Drives col 13
+     *  "Resolution". Higher tiers (10h.4 snyk, 10h.6 osv-scanner fix)
+     *  may overwrite this in future commits. */
+    upgradeAdvice: string;
+    /** Whether the package was reported by both the licenses scanner
+     *  AND a dep-vuln scanner. False = vuln-only entry (license scanner
+     *  didn't see it), which usually indicates a workspace/sub-package
+     *  the license tool missed; surfaced in the detailed report so the
+     *  user can decide whether to trust the license=UNKNOWN row. */
+    joinedFromBoth: boolean;
+}
+/**
+ * Per-top-level-dep aggregation. A single advisory may roll up under
+ * multiple top-levels (e.g. lodash reachable from 20 loopback packages),
+ * in which case each top-level's `advisoryCount` increments by one.
+ * Matches Snyk's UI rollup: "@loopback/cli has 49 advisories".
+ */
+export interface BomTopLevelRollup {
+    /** Total advisories rolled up under this top-level. */
+    advisoryCount: number;
+    /** Highest severity across all rolled-up advisories. */
+    maxSeverity: BomSeverity;
+    /** Distinct vulnerable package names reachable under this top-level.
+     *  Rendered in markdown as a comma-joined list; cap in renderer. */
+    packages: string[];
+}
+export interface BomReport {
+    repo: string;
+    analyzedAt: string;
+    commitSha: string;
+    branch: string;
+    /** Bumps when the report shape changes incompatibly. */
+    schemaVersion: '1';
+    summary: {
+        totalPackages: number;
+        /** Per-severity package count (one increment per package's
+         *  maxSeverity, not per advisory). Matches what bom xlsx
+         *  col 11 will summarize. */
+        bySeverity: Record<BomSeverity, number>;
+        /** Number of packages with at least one known vulnerability.
+         *  Note: a single package may carry many advisories — see
+         *  totalAdvisories for the per-vuln count. */
+        vulnerablePackages: number;
+        /** Number of vulnerable packages where every vuln has a
+         *  fixedVersion (Tier-1 upgrade proposal is actionable). */
+        actionableVulns: number;
+        /** Total advisories across every vulnerable package (each row's
+         *  vulns.length, summed). Reconciles with the count surfaced by
+         *  `vyuh-dxkit vulnerabilities` — that command shows one tick
+         *  per advisory; bom shows one row per package. */
+        totalAdvisories: number;
+        /** Packages found only by a vuln scanner — license scanner
+         *  missed them. See BomEntry.joinedFromBoth. */
+        vulnOnlyPackages: number;
+        /** Snyk-style upgrade-oriented grouping: per-top-level-dep rollup
+         *  built from `vulns[].topLevelDep`. Empty when no findings carry
+         *  topLevelDep attribution (e.g. pre-10h.4 packs or projects
+         *  without a parseable dep graph). */
+        byTopLevelDep: Record<string, BomTopLevelRollup>;
+    };
+    entries: ReadonlyArray<BomEntry>;
+    toolsUsed: string[];
+    toolsUnavailable: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/analyzers/bom/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/analyzers/bom/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEjE,MAAM,WAAW,QAAQ;IAEvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAGhB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,KAAK,EAAE,cAAc,EAAE,CAAC;IAExB;uEACmE;IACnE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAEhC;;;gDAG4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IAEtB;;;;oEAIgE;IAChE,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,WAAW,EAAE,WAAW,CAAC;IACzB;wEACoE;IACpE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,aAAa,EAAE,GAAG,CAAC;IACnB,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAC;QACtB;;qCAE6B;QAC7B,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACxC;;sDAE8C;QAC9C,kBAAkB,EAAE,MAAM,CAAC;QAC3B;oEAC4D;QAC5D,eAAe,EAAE,MAAM,CAAC;QACxB;;;2DAGmD;QACnD,eAAe,EAAE,MAAM,CAAC;QACxB;wDACgD;QAChD,gBAAgB,EAAE,MAAM,CAAC;QACzB;;;8CAGsC;QACtC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;KAClD,CAAC;IACF,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B"}

package/dist/analyzers/bom/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/analyzers/bom/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/analyzers/bom/types.ts"],"names":[],"mappings":""}

package/dist/analyzers/licenses/detailed.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Licenses analyzer — detailed report.
+ *
+ * Extends the base LicensesReport with risk-categorized findings and a
+ * ranked action list. Unlike security/test-gaps, licenses aren't
+ * graded — there's no "license score" — so actions are prioritized by
+ * legal risk tier (unknown → strong-copyleft → weak-copyleft →
+ * missing-attribution) rather than by projected score delta.
+ *
+ * Both the markdown formatter and the XLSX converter (Phase 10h.2.3)
+ * can consume this same `LicensesDetailedReport` shape.
+ */
+import type { LicenseFinding } from '../../languages/capabilities/types';
+import type { LicensesReport } from './types';
+export interface LicenseRiskCategory {
+    /** Severity tier for ordering and display. */
+    readonly priority: 'critical' | 'high' | 'medium' | 'low';
+    /** Short category key — stable across runs for programmatic filtering. */
+    readonly id: 'unknown-license' | 'strong-copyleft' | 'weak-copyleft' | 'missing-license-text' | 'missing-supplier';
+    readonly title: string;
+    readonly rationale: string;
+    readonly recommendation: string;
+    readonly affected: ReadonlyArray<LicenseFinding>;
+}
+export interface LicensesDetailedReport extends LicensesReport {
+    riskCategories: ReadonlyArray<LicenseRiskCategory>;
+}
+export declare function buildLicensesDetailed(report: LicensesReport): LicensesDetailedReport;
+export declare function formatLicensesDetailedMarkdown(detailed: LicensesDetailedReport, elapsed: string): string;
+//# sourceMappingURL=detailed.d.ts.map

package/dist/analyzers/licenses/detailed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detailed.d.ts","sourceRoot":"","sources":["../../../src/analyzers/licenses/detailed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AA6B9C,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC1D,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,EACP,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,GACf,sBAAsB,GACtB,kBAAkB,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAC5D,cAAc,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;CACpD;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,sBAAsB,CAwFpF;AASD,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,MAAM,GACd,MAAM,CA4FR"}