@vyuhlabs/dxkit 2.3.1 → 2.4.0

package/dist/analyzers/bom/pm-signals.js

@@ -0,0 +1,200 @@
+"use strict";
+/**
+ * PM-oriented derived signals for bom renderers (2.3.2).
+ *
+ * Pure helpers that project raw finding fields into categorical
+ * signals a non-technical reviewer can sort/filter/decide on without
+ * domain expertise:
+ *
+ *   - `licenseClass(licenseType)` — SPDX-id → permissive / copyleft-
+ *     weak / copyleft-strong / proprietary / unknown. Lets a PM
+ *     filter the inventory for "anything I need a lawyer to sign off".
+ *
+ *   - `stalenessTier(releaseDate)` — ISO date → fresh (< 1y) / aging
+ *     (1–3y) / stale (≥ 3y). Lets a PM see deps that may no longer
+ *     be maintained without knowing semver or npm-registry API.
+ *
+ *   - `effortEstimate(entry)` — packs the entry's upgrade path into
+ *     trivial / moderate / major / blocked. Derived from
+ *     installedVersion → fixedVersion semver delta or "no fix available".
+ *     Helps scope sprint commitments.
+ *
+ * These deliberately live OUTSIDE `capabilities/types.ts` so the
+ * finding types stay the analyzer contract and these are strictly
+ * rendering helpers. If downstream consumers later need them in the
+ * JSON output, they can be promoted to type fields in a minor bump.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.licenseClass = licenseClass;
+exports.stalenessTier = stalenessTier;
+exports.effortEstimate = effortEstimate;
+/** Known-permissive SPDX ids. Matching is forgiving — `MIT`, `MIT license`,
+ *  `MIT (fork)` all map to the same class. Bench xlsx was full of
+ *  human-readable suffixes; this logic normalises them away. */
+const PERMISSIVE = new Set([
+    'mit',
+    'mit-0',
+    'apache-2.0',
+    'apache 2.0',
+    'apache-1.1',
+    'bsd',
+    'bsd-2-clause',
+    'bsd-3-clause',
+    'bsd-3-clause-clear',
+    '0bsd',
+    'isc',
+    'zlib',
+    'unlicense',
+    'cc0-1.0',
+    'wtfpl',
+    'python-2.0',
+    'python',
+    'psf-2.0',
+    'artistic-2.0',
+    'artistic-1.0',
+    'boost',
+    'bsl-1.0',
+    'upl-1.0', // Universal Permissive License
+]);
+const COPYLEFT_STRONG = new Set([
+    'gpl-2.0',
+    'gpl-3.0',
+    'gpl',
+    'agpl-3.0',
+    'agpl-1.0',
+    'agpl',
+    'sspl-1.0',
+]);
+const COPYLEFT_WEAK = new Set([
+    'lgpl-2.1',
+    'lgpl-3.0',
+    'lgpl',
+    'mpl-1.1',
+    'mpl-2.0',
+    'epl-1.0',
+    'epl-2.0',
+    'cddl-1.0',
+    'cddl-1.1',
+]);
+const PROPRIETARY_MARKERS = ['UNLICENSED', 'SEE LICENSE IN', 'PROPRIETARY', 'COMMERCIAL'];
+/**
+ * Classify a license string from a `LicenseFinding`. Accepts raw SPDX
+ * ids, compound expressions (`"MIT OR Apache-2.0"` — classifies by the
+ * first recognised token), and human-readable variants. Unrecognised
+ * input returns `'unknown'` so the caller can surface the raw string
+ * for human review.
+ */
+function licenseClass(licenseType) {
+    if (!licenseType || licenseType === 'UNKNOWN' || licenseType.trim().length === 0) {
+        return 'unknown';
+    }
+    const upper = licenseType.toUpperCase();
+    for (const marker of PROPRIETARY_MARKERS) {
+        if (upper.includes(marker))
+            return 'proprietary';
+    }
+    // Compound expressions: split on OR/AND, classify each, take the
+    // strictest class (copyleft > permissive > unknown). Prevents an
+    // `MIT OR GPL-3.0` from reading as harmless MIT when the user can
+    // also be tied to GPL obligations. Strip surrounding punctuation
+    // (parens/brackets) that license-checker sometimes emits on
+    // compound expressions like `(Apache-2.0 OR UPL-1.0)`.
+    const cleaned = licenseType.replace(/[()[\]{}]/g, ' ').trim();
+    const tokens = cleaned
+        .split(/\s+(?:OR|AND|\/|\|)\s+|\s+license\s*$/i)
+        .map((t) => t
+        .trim()
+        .toLowerCase()
+        .replace(/^apache\s+/, 'apache-')
+        .replace(/\s+/g, '-'))
+        .filter(Boolean);
+    let worst = 'unknown';
+    for (const norm of tokens) {
+        if (COPYLEFT_STRONG.has(norm))
+            return 'copyleft-strong';
+        if (COPYLEFT_WEAK.has(norm))
+            worst = 'copyleft-weak';
+        else if (PERMISSIVE.has(norm) && worst === 'unknown')
+            worst = 'permissive';
+    }
+    return worst;
+}
+const YEAR_MS = 365 * 24 * 60 * 60 * 1000;
+/**
+ * Classify package freshness from an ISO-8601 release date. Threshold
+ * picked for PM sensibility: "< 1 year" is current, "1–3 years" starts
+ * getting stale, "≥ 3 years" warrants a "still maintained?" conversation.
+ *
+ * `now` is injectable so tests don't drift over time.
+ */
+function stalenessTier(releaseDate, now = new Date()) {
+    if (!releaseDate)
+        return 'unknown';
+    const t = Date.parse(releaseDate);
+    if (Number.isNaN(t))
+        return 'unknown';
+    const ageMs = now.getTime() - t;
+    if (ageMs < YEAR_MS)
+        return 'fresh';
+    if (ageMs < 3 * YEAR_MS)
+        return 'aging';
+    return 'stale';
+}
+/**
+ * Estimate the effort to remediate a vulnerable package.
+ *
+ *   - `blocked`: no advisory has a `fixedVersion` → requires a drop-in
+ *     replacement or living-with-it exception.
+ *   - `trivial`: every advisory's fix is a patch-version bump (same
+ *     major+minor). Low-risk npm install away.
+ *   - `moderate`: fix is a minor-version bump (same major). API-additive;
+ *     contract-stable but light testing warranted.
+ *   - `major`: fix is a major-version bump. Potential breaking changes;
+ *     read the changelog before committing.
+ *
+ * Extracts semver by numeric parse of the first three dotted components
+ * (strips a leading `v` Go-style). Non-parseable or multi-vuln mixtures
+ * escalate to the highest effort tier seen.
+ */
+function effortEstimate(entry) {
+    if (entry.vulns.length === 0)
+        return 'trivial'; // unreachable under normal rendering
+    const installed = parseSemverTriple(entry.version);
+    let worst = 'trivial';
+    let anyFixMissing = false;
+    for (const v of entry.vulns) {
+        if (!v.fixedVersion) {
+            anyFixMissing = true;
+            continue;
+        }
+        const fix = parseSemverTriple(v.fixedVersion);
+        if (!installed || !fix) {
+            worst = worstOf(worst, 'major');
+            continue;
+        }
+        if (fix[0] > installed[0])
+            worst = worstOf(worst, 'major');
+        else if (fix[1] > installed[1])
+            worst = worstOf(worst, 'moderate');
+        // patch bumps or lower stay 'trivial'
+    }
+    if (anyFixMissing)
+        return 'blocked';
+    return worst;
+}
+function parseSemverTriple(v) {
+    const stripped = v.replace(/^v/, '');
+    const parts = stripped.split(/[.+-]/).slice(0, 3).map(Number);
+    if (parts.length < 3 || parts.some(Number.isNaN))
+        return null;
+    return parts;
+}
+function worstOf(a, b) {
+    const rank = {
+        trivial: 0,
+        moderate: 1,
+        major: 2,
+    };
+    return rank[a] >= rank[b] ? a : b;
+}
+//# sourceMappingURL=pm-signals.js.map

package/dist/analyzers/bom/pm-signals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pm-signals.js","sourceRoot":"","sources":["../../../src/analyzers/bom/pm-signals.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;AAyEH,oCAgCC;AAeD,sCAWC;AAsBD,wCAqBC;AAjKD;;gEAEgE;AAChE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,KAAK;IACL,OAAO;IACP,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,cAAc;IACd,cAAc;IACd,oBAAoB;IACpB,MAAM;IACN,KAAK;IACL,MAAM;IACN,WAAW;IACX,SAAS;IACT,OAAO;IACP,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,cAAc;IACd,cAAc;IACd,OAAO;IACP,SAAS;IACT,SAAS,EAAE,+BAA+B;CAC3C,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,SAAS;IACT,SAAS;IACT,KAAK;IACL,UAAU;IACV,UAAU;IACV,MAAM;IACN,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,UAAU;IACV,UAAU;IACV,MAAM;IACN,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AAE1F;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,WAA+B;IAC1D,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACxC,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,aAAa,CAAC;IACnD,CAAC;IACD,iEAAiE;IACjE,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,4DAA4D;IAC5D,uDAAuD;IACvD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO;SACnB,KAAK,CAAC,wCAAwC,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC;SACE,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC;SAChC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CACxB;SACA,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,KAAK,GAAiB,SAAS,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,iBAAiB,CAAC;QACxD,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,GAAG,eAAe,CAAC;aAChD,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,GAAG,YAAY,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAMD,MAAM,OAAO,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C;;;;;;GAMG;AACH,SAAgB,aAAa,CAC3B,WAA+B,EAC/B,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,OAAO;QAAE,OAAO,OAAO,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,GAAG,OAAO;QAAE,OAAO,OAAO,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,cAAc,CAAC,KAAe;IAC5C,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,qCAAqC;IACrF,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,GAAqC,SAAS,CAAC;IACxD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;YACpB,aAAa,GAAG,IAAI,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;YAAE,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;aACtD,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;YAAE,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACnE,sCAAsC;IACxC,CAAC;IACD,IAAI,aAAa;QAAE,OAAO,SAAS,CAAC;IACpC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,KAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,OAAO,CAA6C,CAAI,EAAE,CAAI;IACrE,MAAM,IAAI,GAAqD;QAC7D,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,CAAC;QACX,KAAK,EAAE,CAAC;KACT,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/analyzers/bom/types.d.ts

@@ -115,6 +115,17 @@ export interface BomReport {
          *  distinct. When nested scan is disabled or only one root was
          *  found, this is `["."]` so consumers can treat it uniformly. */
         projectRoots: string[];
+        /** Sorted, deduplicated list of every advisory `fingerprint`
+         *  covered by this report. Each fingerprint is a stable hash of
+         *  `(package, installedVersion, id)` stamped by the cross-pack
+         *  dep-vuln aggregator. Consumers diff two reports by set
+         *  difference on this list — added fingerprints are new
+         *  advisories, removed ones are resolved. The per-finding
+         *  fingerprint also lives on each `BomEntry.vulns[].fingerprint`
+         *  for attribution; this field is a convenience manifest so
+         *  external tooling (suppressions, CI gates, upgrade bots) can
+         *  diff without walking every entry. */
+        fingerprints: string[];
     };
     entries: ReadonlyArray<BomEntry>;
     toolsUsed: string[];

package/dist/analyzers/bom/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/analyzers/bom/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEjE,MAAM,WAAW,QAAQ;IAEvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAGhB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,KAAK,EAAE,cAAc,EAAE,CAAC;IAExB;uEACmE;IACnE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAEhC;;;gDAG4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IAEtB;;;;oEAIgE;IAChE,cAAc,EAAE,OAAO,CAAC;IAExB;;;;;mEAK+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;mBAQe;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,WAAW,EAAE,WAAW,CAAC;IACzB;wEACoE;IACpE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,aAAa,EAAE,GAAG,CAAC;IACnB,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAC;QACtB;;qCAE6B;QAC7B,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACxC;;sDAE8C;QAC9C,kBAAkB,EAAE,MAAM,CAAC;QAC3B;oEAC4D;QAC5D,eAAe,EAAE,MAAM,CAAC;QACxB;;;2DAGmD;QACnD,eAAe,EAAE,MAAM,CAAC;QACxB;wDACgD;QAChD,gBAAgB,EAAE,MAAM,CAAC;QACzB;;;;;oEAK4D;QAC5D,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACjD;wEACgE;QAChE,MAAM,EAAE,KAAK,GAAG,WAAW,CAAC;QAC5B;;;mCAG2B;QAC3B,uBAAuB,EAAE,MAAM,CAAC;QAChC;;;0EAGkE;QAClE,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/analyzers/bom/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEjE,MAAM,WAAW,QAAQ;IAEvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAGhB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,KAAK,EAAE,cAAc,EAAE,CAAC;IAExB;uEACmE;IACnE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAEhC;;;gDAG4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IAEtB;;;;oEAIgE;IAChE,cAAc,EAAE,OAAO,CAAC;IAExB;;;;;mEAK+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;mBAQe;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,WAAW,EAAE,WAAW,CAAC;IACzB;wEACoE;IACpE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,aAAa,EAAE,GAAG,CAAC;IACnB,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAC;QACtB;;qCAE6B;QAC7B,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACxC;;sDAE8C;QAC9C,kBAAkB,EAAE,MAAM,CAAC;QAC3B;oEAC4D;QAC5D,eAAe,EAAE,MAAM,CAAC;QACxB;;;2DAGmD;QACnD,eAAe,EAAE,MAAM,CAAC;QACxB;wDACgD;QAChD,gBAAgB,EAAE,MAAM,CAAC;QACzB;;;;;oEAK4D;QAC5D,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACjD;wEACgE;QAChE,MAAM,EAAE,KAAK,GAAG,WAAW,CAAC;QAC5B;;;mCAG2B;QAC3B,uBAAuB,EAAE,MAAM,CAAC;QAChC;;;0EAGkE;QAClE,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB;;;;;;;;;gDASwC;QACxC,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B"}

package/dist/analyzers/security/gather.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/gather.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAe1D;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACxD,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAeD;AAID,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAuCjE;AAID;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7D,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAeD;AAcD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAyFzE"}
+{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/gather.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAe1D;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACxD,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAeD;AAID,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAuCjE;AAID;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7D,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC,CAeD;AAcD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAuGzE"}

package/dist/analyzers/security/gather.js

@@ -15,10 +15,12 @@ exports.gatherDepVulns = gatherDepVulns;
  */
 const runner_1 = require("../tools/runner");
 const epss_1 = require("../tools/epss");
+const fingerprint_1 = require("../tools/fingerprint");
 const kev_1 = require("../tools/kev");
 const osv_1 = require("../tools/osv");
 const reachability_1 = require("../tools/reachability");
 const risk_score_1 = require("../tools/risk-score");
+const upgrade_plan_resolver_1 = require("../tools/upgrade-plan-resolver");
 const exclusions_1 = require("../tools/exclusions");
 const dispatcher_1 = require("../dispatcher");
 const languages_1 = require("../../languages");
@@ -154,6 +156,11 @@ async function gatherDepVulns(cwd) {
     // alias list including the CVE. One OSV roundtrip resolves the
     // whole batch; one EPSS roundtrip scores them all.
     const findings = envelope.findings ?? [];
+    // Stamp durable identity on every finding before enrichment. The hash
+    // inputs are package/version/id only, so stamping is independent of
+    // EPSS/KEV/reachability results — keeps `fingerprint` stable across
+    // runs even if enrichment tooling changes underneath.
+    (0, fingerprint_1.stampFingerprints)(findings);
     if (findings.length > 0) {
         const cveByFinding = new Map();
         const needsAliasLookup = [];
@@ -204,6 +211,14 @@ async function gatherDepVulns(cwd) {
                 (0, reachability_1.markReachable)(findings, reachable);
             }
         }
+        // Cross-pack upgrade-plan resolver (Phase 10h.6.4). Runs after
+        // per-pack Tier-2 tools have stamped what they can, and before
+        // risk scoring so the composite riskScore can factor in the
+        // "actionable" bit (future 10h.9.2 CI gate uses it too). Fills
+        // gaps by (a) reconciling advisories across plans' `patches[]`
+        // lists and (b) parsing the npm-audit transitive-fix free-text
+        // template into a structured plan when no tool produced one.
+        (0, upgrade_plan_resolver_1.resolveTransitiveUpgradePlans)(findings);
         // Composite riskScore = f(cvss, epss, kev, reachable). Runs last
         // so every signal is populated. Formula is documented in
         // risk-score.ts; skipped for findings without CVSS so we don't

package/dist/analyzers/security/gather.js.map

@@ -1 +1 @@
-{"version":3,"file":"gather.js","sourceRoot":"","sources":["../../../src/analyzers/security/gather.ts"],"names":[],"mappings":";;AAsCA,sCAkBC;AAID,gDAuCC;AAWD,gDAkBC;AAuBD,wCAyFC;AAhPD;;;;;;;;GAQG;AACH,4CAAsC;AACtC,wCAAyD;AACzD,sCAAyC;AACzC,sCAA8C;AAC9C,wDAAgF;AAChF,oDAAoD;AACpD,oDAA0D;AAE1D,8CAAkD;AAClD,+CAAwD;AACxD,0EAKkD;AAClD,+DAA4D;AAI5D,gFAAgF;AAEhF;;;;;;GAMG;AACI,KAAK,UAAU,aAAa,CAAC,GAAW;IAI7C,MAAM,MAAM,GAAG,MAAM,8BAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAO,EAAE,IAAA,2BAAY,EAAC,qBAAO,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAsB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,QAAiB;QAC3B,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC,IAAI,EAAE;QAC9C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAE/E,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,IAAA,gCAAmB,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,mDAAmD;IAEpG,mCAAmC;IACnC,MAAM,QAAQ,GAAG,IAAA,YAAG,EAAC,iDAAiD,OAAO,cAAc,EAAE,GAAG,CAAC,CAAC;IAClG,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,oCAAoC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;gBAChE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gBACzB,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,QAAQ,GAAG,IAAA,YAAG,EAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,6BAA6B,CAAC,EAAE;gBACvC,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAIlD,MAAM,MAAM,GAAG,MAAM,8BAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,2BAAa,EAAE,IAAA,2BAAY,EAAC,2BAAa,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAsB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,MAAe;QACzB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAE/E,MAAM,eAAe,GAAmB;IACtC,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,EAAE;CACb,CAAC;AAEF;;;;;;;;GAQG;AACI,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,MAAM,SAAS,GAAwC,EAAE,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,IAAA,iCAAqB,EAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,YAAY,EAAE,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,8BAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAS,EAAE,SAAS,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ;QAAE,OAAO,eAAe,CAAC;IAEtC,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,iEAAiE;IACjE,mEAAmE;IACnE,kEAAkE;IAClE,gDAAgD;IAChD,EAAE;IACF,gEAAgE;IAChE,+DAA+D;IAC/D,kEAAkE;IAClE,+DAA+D;IAC/D,mDAAmD;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC/C,MAAM,gBAAgB,GAA4C,EAAE,CAAC;QACrE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAA,mBAAY,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAc,EAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE,CAAC;gBAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtD,IAAI,GAAG;oBAAE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvD,+DAA+D;YAC/D,8DAA8D;YAC9D,gEAAgE;YAChE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAA,iBAAU,EAAC,UAAU,CAAC,EAAE,IAAA,eAAS,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7F,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,KAAK,KAAK,SAAS;oBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC;gBACzD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC;YACjD,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,kEAAkE;QAClE,+DAA+D;QAC/D,2DAA2D;QAC3D,gEAAgE;QAChE,uBAAuB;QACvB,MAAM,gBAAgB,GAAG,IAAA,2BAAY,EAAC,qBAAO,CAAC,CAAC;QAC/C,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,eAAe,GAAG,MAAM,8BAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAO,EAAE,gBAAgB,CAAC,CAAC;YACvF,IAAI,eAAe,IAAI,eAAe,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,SAAS,GAAG,IAAA,uCAAwB,EAAC,eAAe,CAAC,CAAC;gBAC5D,IAAA,4BAAa,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,yDAAyD;QACzD,+DAA+D;QAC/D,wCAAwC;QACxC,IAAA,0BAAa,EAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC;IACxD,OAAO;QACL,QAAQ;QACR,IAAI;QACJ,MAAM;QACN,GAAG;QACH,KAAK,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,GAAG;QACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ;KACT,CAAC;AACJ,CAAC"}
+{"version":3,"file":"gather.js","sourceRoot":"","sources":["../../../src/analyzers/security/gather.ts"],"names":[],"mappings":";;AAwCA,sCAkBC;AAID,gDAuCC;AAWD,gDAkBC;AAuBD,wCAuGC;AAhQD;;;;;;;;GAQG;AACH,4CAAsC;AACtC,wCAAyD;AACzD,sDAAyD;AACzD,sCAAyC;AACzC,sCAA8C;AAC9C,wDAAgF;AAChF,oDAAoD;AACpD,0EAA+E;AAC/E,oDAA0D;AAE1D,8CAAkD;AAClD,+CAAwD;AACxD,0EAKkD;AAClD,+DAA4D;AAI5D,gFAAgF;AAEhF;;;;;;GAMG;AACI,KAAK,UAAU,aAAa,CAAC,GAAW;IAI7C,MAAM,MAAM,GAAG,MAAM,8BAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAO,EAAE,IAAA,2BAAY,EAAC,qBAAO,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAsB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,QAAiB;QAC3B,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC,IAAI,EAAE;QAC9C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAE/E,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,IAAA,gCAAmB,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,mDAAmD;IAEpG,mCAAmC;IACnC,MAAM,QAAQ,GAAG,IAAA,YAAG,EAAC,iDAAiD,OAAO,cAAc,EAAE,GAAG,CAAC,CAAC;IAClG,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,oCAAoC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;gBAChE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gBACzB,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,MAAM,QAAQ,GAAG,IAAA,YAAG,EAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,QAAQ;gBAClB,GAAG,EAAE,SAAS;gBACd,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,6BAA6B,CAAC,EAAE;gBACvC,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAIlD,MAAM,MAAM,GAAG,MAAM,8BAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,2BAAa,EAAE,IAAA,2BAAY,EAAC,2BAAa,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,QAAQ,GAAsB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,MAAe;QACzB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAE/E,MAAM,eAAe,GAAmB;IACtC,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,EAAE;CACb,CAAC;AAEF;;;;;;;;GAQG;AACI,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,MAAM,SAAS,GAAwC,EAAE,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,IAAA,iCAAqB,EAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,YAAY,EAAE,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC;IAEnD,MAAM,QAAQ,GAAG,MAAM,8BAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAS,EAAE,SAAS,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ;QAAE,OAAO,eAAe,CAAC;IAEtC,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,iEAAiE;IACjE,mEAAmE;IACnE,kEAAkE;IAClE,gDAAgD;IAChD,EAAE;IACF,gEAAgE;IAChE,+DAA+D;IAC/D,kEAAkE;IAClE,+DAA+D;IAC/D,mDAAmD;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;IACzC,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,sDAAsD;IACtD,IAAA,+BAAiB,EAAC,QAAQ,CAAC,CAAC;IAC5B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC/C,MAAM,gBAAgB,GAA4C,EAAE,CAAC;QACrE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAA,mBAAY,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,gBAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAc,EAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE,CAAC;gBAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtD,IAAI,GAAG;oBAAE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACvD,+DAA+D;YAC/D,8DAA8D;YAC9D,gEAAgE;YAChE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAA,iBAAU,EAAC,UAAU,CAAC,EAAE,IAAA,eAAS,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7F,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,KAAK,KAAK,SAAS;oBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC;gBACzD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC;YACjD,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,kEAAkE;QAClE,+DAA+D;QAC/D,2DAA2D;QAC3D,gEAAgE;QAChE,uBAAuB;QACvB,MAAM,gBAAgB,GAAG,IAAA,2BAAY,EAAC,qBAAO,CAAC,CAAC;QAC/C,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,eAAe,GAAG,MAAM,8BAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAO,EAAE,gBAAgB,CAAC,CAAC;YACvF,IAAI,eAAe,IAAI,eAAe,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,SAAS,GAAG,IAAA,uCAAwB,EAAC,eAAe,CAAC,CAAC;gBAC5D,IAAA,4BAAa,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,4DAA4D;QAC5D,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,6DAA6D;QAC7D,IAAA,qDAA6B,EAAC,QAAQ,CAAC,CAAC;QAExC,iEAAiE;QACjE,yDAAyD;QACzD,+DAA+D;QAC/D,wCAAwC;QACxC,IAAA,0BAAa,EAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC;IACxD,OAAO;QACL,QAAQ;QACR,IAAI;QACJ,MAAM;QACN,GAAG;QACH,KAAK,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,GAAG;QACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/analyzers/tools/fingerprint.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Advisory fingerprints — durable per-finding identity across runs.
+ *
+ * The dispatcher's dep-vuln aggregator (src/analyzers/security/gather.ts)
+ * stamps every finding with a stable hash of `(package, installedVersion,
+ * id)` before scoring + reporting. The same advisory against the same
+ * installed version produces the same fingerprint on every run, so
+ * consumers (agent-driven upgrade bots, suppressions, CI gates) can diff
+ * a current bom against a stored prior to detect:
+ *
+ *   - new advisories (fingerprint present now, absent before)
+ *   - resolved advisories (fingerprint absent now, present before)
+ *   - unchanged advisories (fingerprint in both sets)
+ *
+ * Excluded from the hash:
+ *   - severity / cvssScore — re-scoring the same advisory against the
+ *     same install must not mint a new identity
+ *   - enrichment fields (epssScore, kev, reachable, riskScore) — same
+ *     reason; these are signals about the advisory, not part of it
+ *   - producer `tool` — the same advisory hit by two producers (e.g.
+ *     npm-audit + snyk) should collapse to one identity
+ *   - `upgradeAdvice` / `upgradePlan` — resolution suggestions change
+ *     across releases of the fix tooling; identity must outlive them
+ *
+ * Format: 16-char lowercase hex (first 8 bytes of SHA-1). Short enough
+ * to embed inline in reports, long enough to make collisions between
+ * non-identical tuples effectively impossible for repo-scale sets.
+ */
+import type { DepVulnFinding } from '../../languages/capabilities/types';
+/**
+ * Stable 16-char hex fingerprint for one DepVulnFinding. Input tuple
+ * is NUL-separated (not present in any legal package / version / id)
+ * so distinct tuples can never collide via concatenation tricks.
+ *
+ * `installedVersion` is normalized to the empty string when absent so
+ * version-less findings (rare — some providers omit it when the lock
+ * file is missing) still get a deterministic fingerprint instead of
+ * mixing an ambient `undefined` into the hash input.
+ */
+export declare function computeFingerprint(finding: Pick<DepVulnFinding, 'package' | 'installedVersion' | 'id'>): string;
+/**
+ * Stamp `fingerprint` on every finding in place. Called once in
+ * `gatherDepVulns` after cross-pack merge + enrichment so every
+ * downstream consumer (bom, security/detailed, JSON export) sees a
+ * fully-stamped finding.
+ *
+ * Idempotent: re-stamping a finding that already has a fingerprint
+ * overwrites it with the same value. Safe to call multiple times,
+ * though the gather path only invokes it once.
+ */
+export declare function stampFingerprints(findings: DepVulnFinding[]): void;
+/**
+ * Sorted, deduplicated fingerprint list for a set of findings. Used by
+ * `analyzeBom` to populate `BomReport.summary.fingerprints` — a single
+ * manifest of every advisory identity the report covers, convenient
+ * for external diff tooling without walking `entries[].vulns[]`.
+ *
+ * Silently skips findings missing a fingerprint (should not happen
+ * post-gather, but a safety net against a future producer that emits
+ * findings outside the `gatherDepVulns` path).
+ */
+export declare function collectFingerprints(findings: ReadonlyArray<DepVulnFinding>): string[];
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/analyzers/tools/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,kBAAkB,GAAG,IAAI,CAAC,GACnE,MAAM,CAGR;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI,CAIlE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,GAAG,MAAM,EAAE,CAMrF"}

package/dist/analyzers/tools/fingerprint.js

@@ -0,0 +1,82 @@
+"use strict";
+/**
+ * Advisory fingerprints — durable per-finding identity across runs.
+ *
+ * The dispatcher's dep-vuln aggregator (src/analyzers/security/gather.ts)
+ * stamps every finding with a stable hash of `(package, installedVersion,
+ * id)` before scoring + reporting. The same advisory against the same
+ * installed version produces the same fingerprint on every run, so
+ * consumers (agent-driven upgrade bots, suppressions, CI gates) can diff
+ * a current bom against a stored prior to detect:
+ *
+ *   - new advisories (fingerprint present now, absent before)
+ *   - resolved advisories (fingerprint absent now, present before)
+ *   - unchanged advisories (fingerprint in both sets)
+ *
+ * Excluded from the hash:
+ *   - severity / cvssScore — re-scoring the same advisory against the
+ *     same install must not mint a new identity
+ *   - enrichment fields (epssScore, kev, reachable, riskScore) — same
+ *     reason; these are signals about the advisory, not part of it
+ *   - producer `tool` — the same advisory hit by two producers (e.g.
+ *     npm-audit + snyk) should collapse to one identity
+ *   - `upgradeAdvice` / `upgradePlan` — resolution suggestions change
+ *     across releases of the fix tooling; identity must outlive them
+ *
+ * Format: 16-char lowercase hex (first 8 bytes of SHA-1). Short enough
+ * to embed inline in reports, long enough to make collisions between
+ * non-identical tuples effectively impossible for repo-scale sets.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeFingerprint = computeFingerprint;
+exports.stampFingerprints = stampFingerprints;
+exports.collectFingerprints = collectFingerprints;
+const crypto_1 = require("crypto");
+/**
+ * Stable 16-char hex fingerprint for one DepVulnFinding. Input tuple
+ * is NUL-separated (not present in any legal package / version / id)
+ * so distinct tuples can never collide via concatenation tricks.
+ *
+ * `installedVersion` is normalized to the empty string when absent so
+ * version-less findings (rare — some providers omit it when the lock
+ * file is missing) still get a deterministic fingerprint instead of
+ * mixing an ambient `undefined` into the hash input.
+ */
+function computeFingerprint(finding) {
+    const input = `${finding.package}\0${finding.installedVersion ?? ''}\0${finding.id}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+/**
+ * Stamp `fingerprint` on every finding in place. Called once in
+ * `gatherDepVulns` after cross-pack merge + enrichment so every
+ * downstream consumer (bom, security/detailed, JSON export) sees a
+ * fully-stamped finding.
+ *
+ * Idempotent: re-stamping a finding that already has a fingerprint
+ * overwrites it with the same value. Safe to call multiple times,
+ * though the gather path only invokes it once.
+ */
+function stampFingerprints(findings) {
+    for (const f of findings) {
+        f.fingerprint = computeFingerprint(f);
+    }
+}
+/**
+ * Sorted, deduplicated fingerprint list for a set of findings. Used by
+ * `analyzeBom` to populate `BomReport.summary.fingerprints` — a single
+ * manifest of every advisory identity the report covers, convenient
+ * for external diff tooling without walking `entries[].vulns[]`.
+ *
+ * Silently skips findings missing a fingerprint (should not happen
+ * post-gather, but a safety net against a future producer that emits
+ * findings outside the `gatherDepVulns` path).
+ */
+function collectFingerprints(findings) {
+    const set = new Set();
+    for (const f of findings) {
+        if (f.fingerprint)
+            set.add(f.fingerprint);
+    }
+    return [...set].sort();
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/analyzers/tools/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../src/analyzers/tools/fingerprint.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;AAeH,gDAKC;AAYD,8CAIC;AAYD,kDAMC;AApDD,mCAAoC;AAGpC;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAChC,OAAoE;IAEpE,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,gBAAgB,IAAI,EAAE,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;IACrF,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAAC,QAA0B;IAC1D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,WAAW,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CAAC,QAAuC;IACzE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/analyzers/tools/osv-scanner-fix.d.ts

@@ -0,0 +1,63 @@
+/**
+ * osv-scanner fix — Tier-2 upgrade-plan enricher for the TypeScript pack.
+ *
+ * `npm audit` (Tier-1, typescript pack's primary dep-vuln source) produces
+ * per-advisory findings with `fixedVersion` and, for transitive advisories,
+ * a free-text `upgradeAdvice` like "Upgrade vitest to 4.1.5 [major]
+ * (transitive fix)". That's good for humans reading markdown but leaves
+ * autonomous upgrade bots to re-parse the string.
+ *
+ * `osv-scanner fix --format json --manifest <pkg.json> --lockfile <lock>`
+ * produces a structured plan: for each proposed patch, which top-level
+ * package to bump (`packageUpdates[]`) and which advisories it would
+ * resolve (`fixed[]`). This module wraps that call and stamps the
+ * structured result onto each matching `DepVulnFinding.upgradePlan` —
+ * the typed sibling to the free-text `upgradeAdvice` that 10h.6.6 added.
+ *
+ * Degradation: if osv-scanner isn't installed, runs fine but returns
+ * zero enrichments. The underlying npm-audit flow populates
+ * `upgradeAdvice` either way. Downstream consumers that want the
+ * structured form check `upgradePlan` presence.
+ */
+import type { DepVulnFinding, DepVulnUpgradePlan } from '../../languages/capabilities/types';
+/**
+ * Run osv-scanner against a TypeScript project and return a map keyed on
+ * the `(package, installedVersion, advisoryId)` tuple → upgradePlan. Caller
+ * iterates findings and copies the plan onto each match.
+ *
+ * Returns an empty map when:
+ *   - osv-scanner binary is not available (tool missing — soft-fail)
+ *   - package.json or package-lock.json is absent (osv-scanner fix needs both)
+ *   - osv-scanner exits with parse-breaking output (log and degrade)
+ *
+ * Never throws. `gatherTsDepVulnsResult` calls this unconditionally and
+ * treats the empty map as "no enrichment available".
+ */
+export declare function gatherOsvScannerFixPlans(cwd: string): Promise<Map<string, DepVulnUpgradePlan>>;
+/**
+ * Parse raw `osv-scanner fix --format json` stdout into a plan-lookup map.
+ *
+ * The command prefixes JSON with a warning line when it falls back to
+ * `npm install --legacy-peer-deps` (seen on 2026-04-24's dxkit sample
+ * capture); skip anything before the first `{`. On parse failure,
+ * returns an empty map rather than throwing — enrichment is best-effort.
+ *
+ * Exported for test coverage.
+ */
+export declare function parseOsvScannerFixOutput(raw: string): Map<string, DepVulnUpgradePlan>;
+/**
+ * Stamp upgradePlan on every finding with a matching `(package,
+ * installedVersion, id)` tuple in the provided plan map. In-place;
+ * finds with no matching plan are left unchanged. Idempotent.
+ */
+export declare function enrichWithUpgradePlans(findings: DepVulnFinding[], plans: Map<string, DepVulnUpgradePlan>): number;
+/** Shared key between plan-map construction and finding lookup.
+ *
+ *  GHSA/CVE/SNYK IDs are case-insensitive per their respective specs but
+ *  producers disagree in practice — npm-audit emits uppercase
+ *  (`GHSA-W5HQ-...`), osv-scanner emits lowercase (`GHSA-w5hq-...`).
+ *  Lowercasing the ID component keeps plan lookups hit-or-miss-free when
+ *  the two merge. Package names in npm are already lowercase; version
+ *  strings have no case. */
+export declare function planKey(pkg: string, version: string, advisoryId: string): string;
+//# sourceMappingURL=osv-scanner-fix.d.ts.map

package/dist/analyzers/tools/osv-scanner-fix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv-scanner-fix.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/osv-scanner-fix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAqC7F;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CA+B1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAwCrF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EAAE,EAC1B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GACrC,MAAM,CAaR;AAED;;;;;;;4BAO4B;AAC5B,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF"}