@vyuhlabs/dxkit 2.1.0 → 2.2.0

package/dist/analyzers/tools/python.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatherPythonMetrics = gatherPythonMetrics;
+const runner_1 = require("./runner");
+const tool_registry_1 = require("./tool-registry");
+/** Gather Python-specific metrics. */
+function gatherPythonMetrics(cwd) {
+    const metrics = {
+        toolsUsed: [],
+        toolsUnavailable: [],
+    };
+    // ruff (lint)
+    const ruff = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.ruff, cwd);
+    if (ruff.available && ruff.path) {
+        const raw = (0, runner_1.run)(`${ruff.path} check . --output-format json 2>/dev/null`, cwd, 60000);
+        if (raw) {
+            try {
+                const results = JSON.parse(raw);
+                if (Array.isArray(results)) {
+                    // ruff doesn't distinguish error/warning by default — all are errors
+                    metrics.lintErrors = results.length;
+                    metrics.lintWarnings = 0;
+                    metrics.lintTool = 'ruff';
+                    metrics.toolsUsed.push('ruff');
+                }
+            }
+            catch {
+                metrics.toolsUnavailable.push('ruff (parse error)');
+            }
+        }
+        else {
+            // Empty output = no errors
+            metrics.lintErrors = 0;
+            metrics.lintWarnings = 0;
+            metrics.lintTool = 'ruff';
+            metrics.toolsUsed.push('ruff');
+        }
+    }
+    else {
+        metrics.toolsUnavailable.push('ruff');
+    }
+    // pip-audit (dependency vulnerabilities)
+    const pipAudit = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['pip-audit'], cwd);
+    if (pipAudit.available && pipAudit.path) {
+        const raw = (0, runner_1.run)(`${pipAudit.path} --format json 2>/dev/null`, cwd, 120000);
+        if (raw) {
+            try {
+                const data = JSON.parse(raw);
+                let medium = 0;
+                for (const dep of data.dependencies || []) {
+                    // pip-audit doesn't provide severity — count all as medium
+                    medium += (dep.vulns || []).length;
+                }
+                const critical = 0;
+                const high = 0;
+                const low = 0;
+                metrics.depVulnCritical = critical;
+                metrics.depVulnHigh = high;
+                metrics.depVulnMedium = medium;
+                metrics.depVulnLow = low;
+                metrics.depAuditTool = 'pip-audit';
+                metrics.toolsUsed.push('pip-audit');
+            }
+            catch {
+                metrics.toolsUnavailable.push('pip-audit (parse error)');
+            }
+        }
+    }
+    else {
+        metrics.toolsUnavailable.push('pip-audit');
+    }
+    // Test framework detection (don't run tests — just detect)
+    if ((0, runner_1.fileExists)(cwd, 'pytest.ini', 'conftest.py') || (0, runner_1.fileExists)(cwd, 'pyproject.toml')) {
+        const pyproject = (0, runner_1.run)('cat pyproject.toml 2>/dev/null', cwd);
+        if (pyproject?.includes('[tool.pytest') || (0, runner_1.fileExists)(cwd, 'pytest.ini', 'conftest.py')) {
+            metrics.testFramework = 'pytest';
+        }
+    }
+    return metrics;
+}
+//# sourceMappingURL=python.js.map

package/dist/analyzers/tools/python.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../../src/analyzers/tools/python.ts"],"names":[],"mappings":";;AAeA,kDA0EC;AApFD,qCAA2C;AAC3C,mDAAsD;AAQtD,sCAAsC;AACtC,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,MAAM,OAAO,GAA2B;QACtC,SAAS,EAAE,EAAE;QACb,gBAAgB,EAAE,EAAE;KACrB,CAAC;IAEF,cAAc;IACd,MAAM,IAAI,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,GAAG,IAAI,CAAC,IAAI,2CAA2C,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACrF,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;gBAChD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,qEAAqE;oBACrE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;oBACpC,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC;oBACzB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC;oBAC1B,OAAO,CAAC,SAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,gBAAiB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,2BAA2B;YAC3B,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;YACvB,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC;YACzB,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC;YAC1B,OAAO,CAAC,SAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,gBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,GAAG,QAAQ,CAAC,IAAI,4BAA4B,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE1B,CAAC;gBACF,IAAI,MAAM,GAAG,CAAC,CAAC;gBACf,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;oBAC1C,2DAA2D;oBAC3D,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACrC,CAAC;gBACD,MAAM,QAAQ,GAAG,CAAC,CAAC;gBACnB,MAAM,IAAI,GAAG,CAAC,CAAC;gBACf,MAAM,GAAG,GAAG,CAAC,CAAC;gBACd,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC;gBACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC3B,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC;gBAC/B,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC;gBACzB,OAAO,CAAC,YAAY,GAAG,WAAW,CAAC;gBACnC,OAAO,CAAC,SAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,gBAAiB,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,gBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,2DAA2D;IAC3D,IAAI,IAAA,mBAAU,EAAC,GAAG,EAAE,YAAY,EAAE,aAAa,CAAC,IAAI,IAAA,mBAAU,EAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACtF,MAAM,SAAS,GAAG,IAAA,YAAG,EAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;QAC7D,IAAI,SAAS,EAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,IAAA,mBAAU,EAAC,GAAG,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC;YACxF,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/analyzers/tools/rust.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Rust tool runner — clippy, cargo-audit.
+ * Layer 1: language-specific tools for Rust projects.
+ */
+import { HealthMetrics } from '../types';
+/** Gather Rust-specific metrics. */
+export declare function gatherRustMetrics(cwd: string): Partial<HealthMetrics>;
+//# sourceMappingURL=rust.d.ts.map

package/dist/analyzers/tools/rust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rust.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/rust.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAoBzC,oCAAoC;AACpC,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA0ErE"}

package/dist/analyzers/tools/rust.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatherRustMetrics = gatherRustMetrics;
+const runner_1 = require("./runner");
+const tool_registry_1 = require("./tool-registry");
+/** Gather Rust-specific metrics. */
+function gatherRustMetrics(cwd) {
+    const metrics = {
+        toolsUsed: [],
+        toolsUnavailable: [],
+    };
+    // clippy
+    const clippy = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.clippy, cwd);
+    if (clippy.available) {
+        const raw = (0, runner_1.run)('cargo clippy --message-format json 2>/dev/null', cwd, 120000);
+        if (raw) {
+            let errors = 0;
+            let warnings = 0;
+            for (const line of raw.split('\n')) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const msg = JSON.parse(line);
+                    if (msg.reason === 'compiler-message' && msg.message) {
+                        if (msg.message.level === 'error')
+                            errors++;
+                        else if (msg.message.level === 'warning')
+                            warnings++;
+                    }
+                }
+                catch {
+                    /* skip non-JSON lines */
+                }
+            }
+            metrics.lintErrors = errors;
+            metrics.lintWarnings = warnings;
+            metrics.lintTool = 'clippy';
+            metrics.toolsUsed.push('clippy');
+        }
+    }
+    else {
+        metrics.toolsUnavailable.push('clippy');
+    }
+    // cargo-audit
+    const audit = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS['cargo-audit'], cwd);
+    if (audit.available && audit.path) {
+        const raw = (0, runner_1.run)(`${audit.path} audit --json 2>/dev/null`, cwd, 60000);
+        if (raw) {
+            try {
+                const data = JSON.parse(raw);
+                if (data.vulnerabilities) {
+                    let critical = 0, high = 0, medium = 0, low = 0;
+                    for (const v of data.vulnerabilities.list || []) {
+                        const sev = v.advisory?.severity?.toLowerCase();
+                        if (sev === 'critical')
+                            critical++;
+                        else if (sev === 'high')
+                            high++;
+                        else if (sev === 'medium')
+                            medium++;
+                        else
+                            low++;
+                    }
+                    metrics.depVulnCritical = critical;
+                    metrics.depVulnHigh = high;
+                    metrics.depVulnMedium = medium;
+                    metrics.depVulnLow = low;
+                    metrics.depAuditTool = 'cargo-audit';
+                    metrics.toolsUsed.push('cargo-audit');
+                }
+            }
+            catch {
+                metrics.toolsUnavailable.push('cargo-audit (parse error)');
+            }
+        }
+    }
+    else {
+        metrics.toolsUnavailable.push('cargo-audit');
+    }
+    // Test framework detection
+    if ((0, runner_1.fileExists)(cwd, 'Cargo.toml')) {
+        metrics.testFramework = 'cargo-test';
+    }
+    return metrics;
+}
+//# sourceMappingURL=rust.js.map

package/dist/analyzers/tools/rust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rust.js","sourceRoot":"","sources":["../../../src/analyzers/tools/rust.ts"],"names":[],"mappings":";;AAyBA,8CA0EC;AA9FD,qCAA2C;AAC3C,mDAAsD;AAkBtD,oCAAoC;AACpC,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,OAAO,GAA2B;QACtC,SAAS,EAAE,EAAE;QACb,gBAAgB,EAAE,EAAE;KACrB,CAAC;IAEF,SAAS;IACT,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,gDAAgD,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/E,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;oBAAE,SAAS;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;oBAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,kBAAkB,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;wBACrD,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO;4BAAE,MAAM,EAAE,CAAC;6BACvC,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS;4BAAE,QAAQ,EAAE,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,yBAAyB;gBAC3B,CAAC;YACH,CAAC;YACD,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC;YAC5B,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC;YAChC,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC5B,OAAO,CAAC,SAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,gBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc;IACd,MAAM,KAAK,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,GAAG,KAAK,CAAC,IAAI,2BAA2B,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;gBACjD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBACzB,IAAI,QAAQ,GAAG,CAAC,EACd,IAAI,GAAG,CAAC,EACR,MAAM,GAAG,CAAC,EACV,GAAG,GAAG,CAAC,CAAC;oBACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;wBAChD,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;wBAChD,IAAI,GAAG,KAAK,UAAU;4BAAE,QAAQ,EAAE,CAAC;6BAC9B,IAAI,GAAG,KAAK,MAAM;4BAAE,IAAI,EAAE,CAAC;6BAC3B,IAAI,GAAG,KAAK,QAAQ;4BAAE,MAAM,EAAE,CAAC;;4BAC/B,GAAG,EAAE,CAAC;oBACb,CAAC;oBACD,OAAO,CAAC,eAAe,GAAG,QAAQ,CAAC;oBACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;oBAC3B,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC;oBAC/B,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC;oBACzB,OAAO,CAAC,YAAY,GAAG,aAAa,CAAC;oBACrC,OAAO,CAAC,SAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,gBAAiB,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,gBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC;IAED,2BAA2B;IAC3B,IAAI,IAAA,mBAAU,EAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC;IACvC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/analyzers/xlsx/bom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bom.d.ts","sourceRoot":"","sources":["../../../src/analyzers/xlsx/bom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,cAAc,CAAC;AAqC3D;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CA0ElE"}
+{"version":3,"file":"bom.d.ts","sourceRoot":"","sources":["../../../src/analyzers/xlsx/bom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,cAAc,CAAC;AAqC3D;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAkFlE"}

package/dist/analyzers/xlsx/bom.js

@@ -95,7 +95,17 @@ async function toBomXlsx(report) {
         const vulnLines = sortedVulns.map((v) => {
             const title = (v.summary ?? '').replace(/\s+/g, ' ').trim().slice(0, ADVISORY_SUMMARY_MAX);
             const cvss = v.cvssScore !== undefined ? ` [CVSS ${v.cvssScore.toFixed(1)}]` : '';
-            return title ? `${v.id}${cvss}: ${title}` : `${v.id}${cvss}`;
+            // Top-level attribution: tells the reviewer which direct manifest
+            // dep to upgrade. Missing when the pack couldn't parse the graph
+            // (e.g. TS repo with no lockfile) — silent in that case so the
+            // column stays clean.
+            const tops = v.topLevelDep ?? [];
+            let via = '';
+            if (tops.length === 1)
+                via = ` via ${tops[0]}`;
+            else if (tops.length > 1)
+                via = ` via ${tops[0]} (+${tops.length - 1} more)`;
+            return title ? `${v.id}${cvss}${via}: ${title}` : `${v.id}${cvss}${via}`;
         });
         const vulnerabilityIssues = e.vulns.length === 0 ? NO_VULNS_ISSUES : vulnLines.join('; ');
         const resolution = e.vulns.length === 0 ? NO_VULNS_RESOLUTION : e.upgradeAdvice;

package/dist/analyzers/xlsx/bom.js.map

@@ -1 +1 @@
-{"version":3,"file":"bom.js","sourceRoot":"","sources":["../../../src/analyzers/xlsx/bom.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;AA8CH,8BA0EC;AAtHD,sDAA8B;AAG9B,yCAAyC;AAEzC;;2CAE2C;AAC3C,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B;yEACyE;AACzE,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;wCAEwC;AACxC,SAAS,QAAQ,CAAC,CAAqB;IACrC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC7E,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,wEAAwE,CAAC;QACxF,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,SAAS,GAAgC;IAC7C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF;;;;GAIG;AACI,KAAK,UAAU,SAAS,CAAC,MAAiB;IAC/C,MAAM,EAAE,GAAG,IAAI,iBAAO,CAAC,QAAQ,EAAE,CAAC;IAClC,EAAE,CAAC,OAAO,GAAG,YAAY,CAAC;IAC1B,EAAE,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEzC,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,EAAE,CAAC,MAAM,CAAC,sBAAuB,CAAC,CAAC;IACnC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEnC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpF,yEAAyE;IACzE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,oBAAoB,GAAG,MAAM,CAAC;IACpC,MAAM,eAAe,GAAG,MAAM,CAAC;IAC/B,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;IAEjD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,6DAA6D;QAC7D,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW;YAC/B,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;YAC1F,CAAC,CAAC,oBAAoB,CAAC;QAEzB,kEAAkE;QAClE,+DAA+D;QAC/D,yDAAyD;QACzD,MAAM,QAAQ,GAAgC;YAC5C,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,GAAG,EAAE,CAAC;SACP,CAAC;QACF,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAClF,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;YAC3F,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1F,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QAEhF,EAAE,CAAC,MAAM,CAAC;YACR,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ;YAC7B,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ;YAC7B,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ;YACjC,YAAY,EAAE,iBAAiB;YAC/B,YAAY,UAAU,EAAE,EAAE,0BAA0B;YACpD,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ;YAC/B,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ;YACjC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ;YACjC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ;YAC9B,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,wCAAwC;YACjE,uDAAuD;YACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB;YAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,oBAAoB;YACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB;YAC1C,EAAE,EAAE,gEAAgE;YACpE,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS;SACvC,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5E,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAkB,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"bom.js","sourceRoot":"","sources":["../../../src/analyzers/xlsx/bom.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;AA8CH,8BAkFC;AA9HD,sDAA8B;AAG9B,yCAAyC;AAEzC;;2CAE2C;AAC3C,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B;yEACyE;AACzE,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;wCAEwC;AACxC,SAAS,QAAQ,CAAC,CAAqB;IACrC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC7E,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,wEAAwE,CAAC;QACxF,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,SAAS,GAAgC;IAC7C,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF;;;;GAIG;AACI,KAAK,UAAU,SAAS,CAAC,MAAiB;IAC/C,MAAM,EAAE,GAAG,IAAI,iBAAO,CAAC,QAAQ,EAAE,CAAC;IAClC,EAAE,CAAC,OAAO,GAAG,YAAY,CAAC;IAC1B,EAAE,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEzC,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,EAAE,CAAC,MAAM,CAAC,sBAAuB,CAAC,CAAC;IACnC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEnC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpF,yEAAyE;IACzE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,oBAAoB,GAAG,MAAM,CAAC;IACpC,MAAM,eAAe,GAAG,MAAM,CAAC;IAC/B,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;IAEjD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,6DAA6D;QAC7D,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW;YAC/B,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;YAC1F,CAAC,CAAC,oBAAoB,CAAC;QAEzB,kEAAkE;QAClE,+DAA+D;QAC/D,yDAAyD;QACzD,MAAM,QAAQ,GAAgC;YAC5C,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,GAAG,EAAE,CAAC;SACP,CAAC;QACF,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAClF,CAAC;QACF,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;YAC3F,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,kEAAkE;YAClE,iEAAiE;YACjE,+DAA+D;YAC/D,sBAAsB;YACtB,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;YACjC,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC;YAC7E,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1F,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QAEhF,EAAE,CAAC,MAAM,CAAC;YACR,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ;YAC7B,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ;YAC7B,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ;YACjC,YAAY,EAAE,iBAAiB;YAC/B,YAAY,UAAU,EAAE,EAAE,0BAA0B;YACpD,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ;YAC/B,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ;YACjC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ;YACjC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ;YAC9B,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,wCAAwC;YACjE,uDAAuD;YACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB;YAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,oBAAoB;YACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB;YAC1C,EAAE,EAAE,gEAAgE;YACpE,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS;SACvC,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5E,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAkB,CAAC,CAAC;AACzC,CAAC"}

package/dist/languages/capabilities/types.d.ts

@@ -69,6 +69,7 @@ export interface DepVulnFinding {
     aliases?: string[];
     summary?: string;
     references?: string[];
+    topLevelDep?: string[];
 }
 /** Dependency vulnerabilities, the depVulns capability. */
 export interface DepVulnResult extends CapabilityEnvelope {

package/dist/languages/capabilities/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/languages/capabilities/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE/D,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAE7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAI1B,IAAI,EAAE,MAAM,CAAC;IAIb,QAAQ,EAAE,MAAM,cAAc,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IAInB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAK1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAInB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,6DAA6D;IAC7D,MAAM,EAAE,cAAc,CAAC;IACvB,sEAAsE;IACtE,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;CAC7B;AAED,kGAAkG;AAClG,MAAM,WAAW,UAAW,SAAQ,kBAAkB;IACpD,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAe,SAAQ,kBAAkB;IACxD,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,0DAA0D;AAC1D,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CAC1D;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAe,SAAQ,kBAAkB;IACxD,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACzC;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,cAAc,CAAC;IAC/B,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,cAAc,CAAC;IAC/B,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,EAAE,oBAAoB,CAAC;IACxB,CAAC,EAAE,oBAAoB,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,UAAU,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/languages/capabilities/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE/D,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAE7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAI1B,IAAI,EAAE,MAAM,CAAC;IAIb,QAAQ,EAAE,MAAM,cAAc,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IAInB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAK1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAInB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAWtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,2DAA2D;AAC3D,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,6DAA6D;IAC7D,MAAM,EAAE,cAAc,CAAC;IACvB,sEAAsE;IACtE,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;CAC7B;AAED,kGAAkG;AAClG,MAAM,WAAW,UAAW,SAAQ,kBAAkB;IACpD,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAe,SAAQ,kBAAkB;IACxD,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,0DAA0D;AAC1D,MAAM,WAAW,mBAAoB,SAAQ,kBAAkB;IAC7D,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CAC1D;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAe,SAAQ,kBAAkB;IACxD,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACzC;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,cAAc,CAAC;IAC/B,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,cAAc,CAAC;IAC/B,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,QAAQ,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,EAAE,oBAAoB,CAAC;IACxB,CAAC,EAAE,oBAAoB,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,UAAU,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/languages/csharp.d.ts

@@ -3,17 +3,52 @@ import type { DepVulnFinding, SeverityCounts } from './capabilities/types';
 import type { LanguageSupport } from './types';
 export declare function parseCoberturaXml(raw: string, sourceFile: string, cwd: string): Coverage | null;
 /**
- * Pure parser for `dotnet list package --vulnerable --format json`.
- * Extracted from the gather function so it can be unit-tested without
- * a real .NET SDK on the dev machine (10h.5 release-time validation
- * runs the full pipeline). Returns null when the input is malformed;
- * otherwise returns counts + findings ready for downstream alias
- * enrichment.
+ * Pure parser for `dotnet list package --vulnerable --include-transitive
+ * --format json`. Extracted from the gather function so it can be
+ * unit-tested without a real .NET SDK on the dev machine (10h.5
+ * release-time validation runs the full pipeline). Returns null when
+ * the input is malformed; otherwise returns counts + findings ready
+ * for downstream alias enrichment + top-level attribution.
+ *
+ * Both top-level and transitive packages are iterated. Top-level
+ * findings carry `topLevelDep = [self]` (they ARE manifest deps);
+ * transitive findings emit with `topLevelDep` unset — the gather
+ * function then fills it from `project.assets.json` if available.
+ * Leaving attribution unset on transitives when assets.json is absent
+ * matches Python's venv-missing behavior: degrade gracefully rather
+ * than invent false parents.
  */
 export declare function parseDotnetVulnerableOutput(raw: string): {
     counts: SeverityCounts;
     findings: DepVulnFinding[];
 } | null;
+/**
+ * Pure parser for `obj/project.assets.json`. Extracts the forward
+ * dep graph keyed by package name (collapsing versions — same as
+ * TS/Go/Rust packs) plus the set of top-level (direct manifest)
+ * package names across every target framework declared in `project`.
+ *
+ * Multi-framework projects: graphs are merged across target
+ * frameworks into a single name-level edge map. Top-level set is
+ * the union of declared direct deps across frameworks. This
+ * over-attributes slightly if a package is direct in netstandard2.0
+ * but transitive in net8.0 — it gets listed as a top-level — but the
+ * simplification beats per-framework multi-reporting complexity.
+ */
+export declare function parseProjectAssetsJson(raw: string): {
+    topLevels: string[];
+    edges: Map<string, Set<string>>;
+} | null;
+/**
+ * BFS the parsed asset graph to produce a per-package-name index of
+ * its top-level ancestors. Mirrors `buildTsTopLevelDepIndex` /
+ * `buildRustTopLevelDepIndex` in shape and semantics; attribution is
+ * coarse (name-level) and unions across multiple reachable parents.
+ */
+export declare function buildCsharpTopLevelDepIndex(parsed: {
+    topLevels: ReadonlyArray<string>;
+    edges: ReadonlyMap<string, ReadonlySet<string>>;
+}): Map<string, string[]>;
 /**
  * Capture C# `using` directives from source text, including
  * `using static Foo`, aliased (`using X = Foo.Bar`), and plain forms.

package/dist/languages/csharp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csharp.d.ts","sourceRoot":"","sources":["../../src/languages/csharp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAgB,MAAM,6BAA6B,CAAC;AAM1E,OAAO,KAAK,EAEV,cAAc,EAQd,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAwD/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAoC/F;AAkED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,GACV;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,GAAG,IAAI,CA4C/D;AAoJD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQjE;AAsKD,eAAO,MAAM,MAAM,EAAE,eAsCpB,CAAC"}
+{"version":3,"file":"csharp.d.ts","sourceRoot":"","sources":["../../src/languages/csharp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAgB,MAAM,6BAA6B,CAAC;AAM1E,OAAO,KAAK,EAEV,cAAc,EAQd,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAwD/C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAoC/F;AAuGD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,GACV;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,GAAG,IAAI,CA0D/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,GACV;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;CAAE,GAAG,IAAI,CAqCjE;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;CACjD,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAsBxB;AAgPD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQjE;AAsKD,eAAO,MAAM,MAAM,EAAE,eAsCpB,CAAC"}

package/dist/languages/csharp.js

@@ -36,6 +36,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.csharp = void 0;
 exports.parseCoberturaXml = parseCoberturaXml;
 exports.parseDotnetVulnerableOutput = parseDotnetVulnerableOutput;
+exports.parseProjectAssetsJson = parseProjectAssetsJson;
+exports.buildCsharpTopLevelDepIndex = buildCsharpTopLevelDepIndex;
 exports.extractCsharpImportsRaw = extractCsharpImportsRaw;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -168,12 +170,20 @@ function extractGhsaIdFromUrl(url) {
     return m ? m[0].toUpperCase() : null;
 }
 /**
- * Pure parser for `dotnet list package --vulnerable --format json`.
- * Extracted from the gather function so it can be unit-tested without
- * a real .NET SDK on the dev machine (10h.5 release-time validation
- * runs the full pipeline). Returns null when the input is malformed;
- * otherwise returns counts + findings ready for downstream alias
- * enrichment.
+ * Pure parser for `dotnet list package --vulnerable --include-transitive
+ * --format json`. Extracted from the gather function so it can be
+ * unit-tested without a real .NET SDK on the dev machine (10h.5
+ * release-time validation runs the full pipeline). Returns null when
+ * the input is malformed; otherwise returns counts + findings ready
+ * for downstream alias enrichment + top-level attribution.
+ *
+ * Both top-level and transitive packages are iterated. Top-level
+ * findings carry `topLevelDep = [self]` (they ARE manifest deps);
+ * transitive findings emit with `topLevelDep` unset — the gather
+ * function then fills it from `project.assets.json` if available.
+ * Leaving attribution unset on transitives when assets.json is absent
+ * matches Python's venv-missing behavior: degrade gracefully rather
+ * than invent false parents.
  */
 function parseDotnetVulnerableOutput(raw) {
     let data;
@@ -188,44 +198,202 @@ function parseDotnetVulnerableOutput(raw) {
     let medium = 0;
     let low = 0;
     const findings = [];
+    const emit = (pkgId, resolvedVersion, advisories, topLevelDep) => {
+        for (const adv of advisories) {
+            const severity = normalizeDotnetSeverity(adv.severity);
+            if (severity === 'critical')
+                critical++;
+            else if (severity === 'high')
+                high++;
+            else if (severity === 'medium')
+                medium++;
+            else
+                low++;
+            const ghsa = extractGhsaIdFromUrl(adv.advisoryUrl);
+            const id = ghsa ?? `nuget-${pkgId}@${resolvedVersion ?? 'unknown'}`;
+            const finding = {
+                id,
+                package: pkgId,
+                installedVersion: resolvedVersion,
+                tool: 'dotnet-vulnerable',
+                severity,
+            };
+            if (topLevelDep && topLevelDep.length > 0)
+                finding.topLevelDep = topLevelDep;
+            if (ghsa)
+                finding.aliases = [ghsa];
+            if (adv.advisoryUrl)
+                finding.references = [adv.advisoryUrl];
+            findings.push(finding);
+        }
+    };
     for (const proj of data.projects ?? []) {
         for (const fw of proj.frameworks ?? []) {
             for (const pkg of fw.topLevelPackages ?? []) {
                 if (!pkg.id)
                     continue;
-                for (const adv of pkg.advisories ?? []) {
-                    const severity = normalizeDotnetSeverity(adv.severity);
-                    if (severity === 'critical')
-                        critical++;
-                    else if (severity === 'high')
-                        high++;
-                    else if (severity === 'medium')
-                        medium++;
-                    else
-                        low++;
-                    const ghsa = extractGhsaIdFromUrl(adv.advisoryUrl);
-                    // No GHSA URL means we have nothing addressable — fall back
-                    // to a synthetic id so the finding is still emitted (the
-                    // counts already incremented, and bom render needs a row).
-                    const id = ghsa ?? `nuget-${pkg.id}@${pkg.resolvedVersion ?? 'unknown'}`;
-                    const finding = {
-                        id,
-                        package: pkg.id,
-                        installedVersion: pkg.resolvedVersion,
-                        tool: 'dotnet-vulnerable',
-                        severity,
-                    };
-                    if (ghsa)
-                        finding.aliases = [ghsa];
-                    if (adv.advisoryUrl)
-                        finding.references = [adv.advisoryUrl];
-                    findings.push(finding);
-                }
+                emit(pkg.id, pkg.resolvedVersion, pkg.advisories ?? [], [pkg.id]);
+            }
+            for (const pkg of fw.transitivePackages ?? []) {
+                if (!pkg.id)
+                    continue;
+                // topLevelDep stays unset; `attachCsharpTopLevelAttribution`
+                // downstream fills it from project.assets.json when available.
+                emit(pkg.id, pkg.resolvedVersion, pkg.advisories ?? [], undefined);
             }
         }
     }
     return { counts: { critical, high, medium, low }, findings };
 }
+/**
+ * Pure parser for `obj/project.assets.json`. Extracts the forward
+ * dep graph keyed by package name (collapsing versions — same as
+ * TS/Go/Rust packs) plus the set of top-level (direct manifest)
+ * package names across every target framework declared in `project`.
+ *
+ * Multi-framework projects: graphs are merged across target
+ * frameworks into a single name-level edge map. Top-level set is
+ * the union of declared direct deps across frameworks. This
+ * over-attributes slightly if a package is direct in netstandard2.0
+ * but transitive in net8.0 — it gets listed as a top-level — but the
+ * simplification beats per-framework multi-reporting complexity.
+ */
+function parseProjectAssetsJson(raw) {
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!data.targets && !data.project)
+        return null;
+    const nameOf = (key) => {
+        // Keys are `Pkg/Version` — split on '/' and take the package part.
+        const slash = key.indexOf('/');
+        return slash < 0 ? key : key.slice(0, slash);
+    };
+    const edges = new Map();
+    for (const target of Object.values(data.targets ?? {})) {
+        for (const [pkgVerKey, pkgEntry] of Object.entries(target)) {
+            const srcName = nameOf(pkgVerKey);
+            const deps = pkgEntry?.dependencies;
+            if (!deps)
+                continue;
+            const bucket = edges.get(srcName) ?? new Set();
+            for (const depName of Object.keys(deps)) {
+                bucket.add(depName);
+            }
+            edges.set(srcName, bucket);
+        }
+    }
+    const topLevels = new Set();
+    for (const fw of Object.values(data.project?.frameworks ?? {})) {
+        for (const name of Object.keys(fw?.dependencies ?? {})) {
+            topLevels.add(name);
+        }
+    }
+    return { topLevels: [...topLevels].sort(), edges };
+}
+/**
+ * BFS the parsed asset graph to produce a per-package-name index of
+ * its top-level ancestors. Mirrors `buildTsTopLevelDepIndex` /
+ * `buildRustTopLevelDepIndex` in shape and semantics; attribution is
+ * coarse (name-level) and unions across multiple reachable parents.
+ */
+function buildCsharpTopLevelDepIndex(parsed) {
+    const result = new Map();
+    for (const top of parsed.topLevels) {
+        const visited = new Set();
+        const queue = [top];
+        while (queue.length > 0) {
+            const name = queue.shift();
+            if (visited.has(name))
+                continue;
+            visited.add(name);
+            const bucket = result.get(name) ?? new Set();
+            bucket.add(top);
+            result.set(name, bucket);
+            for (const child of parsed.edges.get(name) ?? []) {
+                if (!visited.has(child))
+                    queue.push(child);
+            }
+        }
+    }
+    const sorted = new Map();
+    for (const [name, parents] of result) {
+        sorted.set(name, [...parents].sort());
+    }
+    return sorted;
+}
+/**
+ * Locate the nearest `obj/project.assets.json` under cwd (NuGet's
+ * lockfile equivalent, created by `dotnet restore`). Unlike the
+ * shared `findMatchingRecursive`, we cannot skip `obj/` here —
+ * that's literally where the file lives. Walks up to 4 levels deep
+ * to handle solutions with nested projects. Returns the absolute
+ * path of the first match, or null.
+ *
+ * Multi-project solutions currently use the first-found file's
+ * graph — noted as a known limitation in the phase commit.
+ */
+function findProjectAssetsJson(cwd, maxDepth = 4) {
+    function search(dir, depth) {
+        if (depth > maxDepth)
+            return null;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return null;
+        }
+        // Direct-child shortcut: if this directory is `obj`, check for
+        // the file right here before recursing.
+        for (const e of entries) {
+            if (e.isFile() && e.name === 'project.assets.json') {
+                // Only accept if parent directory is `obj`.
+                if (path.basename(dir) === 'obj')
+                    return path.join(dir, e.name);
+            }
+        }
+        for (const e of entries) {
+            if (e.name.startsWith('.') ||
+                ['node_modules', 'bin', 'TestResults', 'packages'].includes(e.name)) {
+                continue;
+            }
+            if (e.isDirectory()) {
+                const nested = search(path.join(dir, e.name), depth + 1);
+                if (nested)
+                    return nested;
+            }
+        }
+        return null;
+    }
+    return search(cwd, 0);
+}
+/**
+ * Read + parse `obj/project.assets.json` and build the top-level
+ * attribution index. Returns an empty map on any failure — transitive
+ * findings simply ship without attribution rather than blocking the
+ * scan. Matches Python pack's missing-venv semantics.
+ */
+function loadCsharpTopLevelDepIndex(cwd) {
+    const assetsPath = findProjectAssetsJson(cwd);
+    if (!assetsPath)
+        return new Map();
+    let raw;
+    try {
+        raw = fs.readFileSync(assetsPath, 'utf-8');
+    }
+    catch {
+        return new Map();
+    }
+    const parsed = parseProjectAssetsJson(raw);
+    if (!parsed)
+        return new Map();
+    return buildCsharpTopLevelDepIndex(parsed);
+}
 /**
  * Single source of truth for the csharp pack's dep-vuln gathering.
  * Consumed by `csharpDepVulnsProvider` (capability dispatcher). Runs
@@ -240,13 +408,35 @@ function parseDotnetVulnerableOutput(raw) {
 async function gatherCsharpDepVulnsResult(cwd) {
     if (!hasCsharpProject(cwd))
         return { kind: 'tool-missing' };
-    const vulnRaw = (0, runner_1.run)('dotnet list package --vulnerable --format json 2>/dev/null', cwd, 120000);
+    // `--include-transitive` (10h.4.4.c) extends the scan to indirect
+    // deps; without it NuGet would only report vulns where the
+    // vulnerable package is itself declared in .csproj. Transitive
+    // attribution lands via `project.assets.json` below.
+    const vulnRaw = (0, runner_1.run)('dotnet list package --vulnerable --include-transitive --format json 2>/dev/null', cwd, 120000);
     if (!vulnRaw)
         return { kind: 'no-output' };
     const parsed = parseDotnetVulnerableOutput(vulnRaw);
     if (!parsed)
         return { kind: 'parse-error' };
     const { counts, findings } = parsed;
+    // Attach top-level attribution to transitive findings (top-level
+    // findings already carry self-attribution from the parser). Skipped
+    // when project.assets.json is absent — user hasn't run
+    // `dotnet restore`, or the obj/ dir was cleaned. Findings ship with
+    // `topLevelDep` unset in that case, matching Python's no-venv path.
+    const transitiveNeedsAttribution = findings.some((f) => !f.topLevelDep || f.topLevelDep.length === 0);
+    if (transitiveNeedsAttribution) {
+        const topLevelIndex = loadCsharpTopLevelDepIndex(cwd);
+        if (topLevelIndex.size > 0) {
+            for (const f of findings) {
+                if (f.topLevelDep && f.topLevelDep.length > 0)
+                    continue;
+                const parents = topLevelIndex.get(f.package);
+                if (parents && parents.length > 0)
+                    f.topLevelDep = parents;
+            }
+        }
+    }
     // Alias-fallback CVSS pass: dotnet --vulnerable ships zero CVSS data
     // per advisory; the GHSA id (extracted from advisoryUrl) is the only
     // anchor. resolveCvssScores looks up via GHSA → CVE alias chain.