@vyuhlabs/dxkit 2.4.4 → 2.4.5

package/dist/languages/java.js

@@ -0,0 +1,419 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.java = void 0;
+exports.extractJavaImportsRaw = extractJavaImportsRaw;
+exports.mapPmdRuleSeverity = mapPmdRuleSeverity;
+exports.parsePmdOutput = parsePmdOutput;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const exclusions_1 = require("../analyzers/tools/exclusions");
+const jacoco_1 = require("../analyzers/tools/jacoco");
+const osv_scanner_maven_1 = require("../analyzers/tools/osv-scanner-maven");
+const runner_1 = require("../analyzers/tools/runner");
+const tool_registry_1 = require("../analyzers/tools/tool-registry");
+// ─── Detection ──────────────────────────────────────────────────────────────
+/**
+ * Walk the project tree looking for a `.java` source file. Java's
+ * standard layout (`src/main/java/com/example/...`) is much deeper
+ * than Kotlin's `src/main/kotlin/`, so this walk uses a deeper bound
+ * than the kotlin pack's depth-3 — package hierarchies of 4-5
+ * segments are common in real-world Java projects. Stops short of
+ * a full filesystem scan (build/, target/, .gradle/, node_modules/
+ * are pruned).
+ */
+function hasJavaSourceWithinDepth(cwd, maxDepth = 5) {
+    function search(dir, depth) {
+        if (depth > maxDepth)
+            return false;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return false;
+        }
+        for (const e of entries) {
+            if (e.name.startsWith('.') ||
+                ['node_modules', 'build', '.gradle', 'target', 'out'].includes(e.name)) {
+                continue;
+            }
+            if (e.isFile() && e.name.endsWith('.java'))
+                return true;
+            if (e.isDirectory() && search(path.join(dir, e.name), depth + 1))
+                return true;
+        }
+        return false;
+    }
+    return search(cwd, 0);
+}
+/**
+ * Java pack detection. Strict: requires evidence of actual Java SOURCE,
+ * not just a JVM build manifest. `pom.xml` alone is NOT a Java signal —
+ * Kotlin (incl. our own `test/fixtures/benchmarks/kotlin/pom.xml` for
+ * osv-scanner) and Scala projects also ship Maven POMs. The two
+ * unambiguous signals:
+ *
+ *   1. `src/main/java/` directory exists — the path itself is the
+ *      Maven/Gradle convention for Java sources.
+ *   2. A `.java` file lives within depth 5 of cwd (Java package
+ *      hierarchies are routinely 4-5 segments under `src/`).
+ *
+ * Mixed Kotlin+Java projects (legacy Android migrations, polyglot
+ * monorepos) activate BOTH packs — correct, the project genuinely is
+ * both. Pure Kotlin/Scala/Groovy projects with `pom.xml` but no
+ * `.java` source no longer false-trigger Java (10k.1.3 fix).
+ */
+function detectJava(cwd) {
+    // Standard Maven/Gradle Java layout — directory name is the signal.
+    if (fs.existsSync(path.join(cwd, 'src', 'main', 'java')))
+        return true;
+    // Otherwise require actual `.java` source presence.
+    return hasJavaSourceWithinDepth(cwd, 5);
+}
+// ─── Imports (regex extraction, no resolver) ───────────────────────────────
+/**
+ * Extract `import com.foo.Bar;` paths from a Java source string. Handles:
+ *   - regular imports:   `import com.foo.Bar;`
+ *   - static imports:    `import static com.foo.Bar.method;`
+ *   - wildcard imports:  `import com.foo.*;`
+ * Strips line + block comments first so commented-out imports don't
+ * false-match.
+ *
+ * Exported for unit tests; consumed by `gatherJavaImportsResult`.
+ */
+function extractJavaImportsRaw(content) {
+    const out = [];
+    // Strip block comments first (they may span multiple lines and contain
+    // `import` text), then line comments.
+    const stripped = content.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
+    // Match `import` at line start (after optional whitespace), optionally
+    // `static`, then a dotted path with optional trailing `*`, then `;`.
+    // The `as` aliasing Kotlin allows isn't valid Java syntax.
+    const re = /^\s*import\s+(?:static\s+)?([\w.*]+)\s*;/gm;
+    let m;
+    while ((m = re.exec(stripped)) !== null) {
+        out.push(m[1]);
+    }
+    return out;
+}
+/**
+ * Enumerate `.java` files under cwd and capture per-file imports. Java
+ * package paths don't 1:1 map to filesystem paths in all build layouts
+ * (a single package can span `src/main/java/com/foo/` *and*
+ * `src/test/java/com/foo/`, plus IDE-generated extras), so we don't
+ * produce `edges` — the resolution would be heuristic. Mirrors the
+ * kotlin/rust pack choice.
+ */
+function gatherJavaImportsResult(cwd) {
+    const excludes = (0, exclusions_1.getFindExcludeFlags)(cwd);
+    const raw = (0, runner_1.run)(`find . -type f -name "*.java" ${excludes} 2>/dev/null`, cwd);
+    if (!raw)
+        return null;
+    const extracted = new Map();
+    for (const line of raw.split('\n')) {
+        const p = line.trim();
+        if (!p)
+            continue;
+        const rel = p.replace(/^\.\//, '');
+        let content;
+        try {
+            content = fs.readFileSync(path.join(cwd, rel), 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        extracted.set(rel, extractJavaImportsRaw(content));
+    }
+    if (extracted.size === 0)
+        return null;
+    return {
+        schemaVersion: 1,
+        tool: 'java-imports',
+        sourceExtensions: ['.java'],
+        extracted,
+        edges: new Map(),
+    };
+}
+const javaImportsProvider = {
+    source: 'java',
+    async gather(cwd) {
+        return gatherJavaImportsResult(cwd);
+    },
+};
+// ─── Test framework detection (build-file substring scan) ──────────────────
+/**
+ * Detect which test framework a Java project uses by scanning Maven and
+ * Gradle build files for the canonical artifact substrings. Order of
+ * preference matches what coexisting projects most likely standardize
+ * on:
+ *   - JUnit 5 (Jupiter) — modern default; `junit-jupiter` artifact
+ *   - Spock — `org.spockframework` / `spock-core`
+ *   - TestNG — `org.testng` / `:testng:`
+ *   - JUnit 4 — `junit:junit` or any other `junit` mention as last
+ *     resort, since `junit-jupiter` already matched JUnit 5
+ *
+ * Substring matching is intentional — same approach as the kotlin pack.
+ * Robust to syntactic variation across pom.xml (XML <artifactId>) and
+ * build.gradle{,.kts} (Groovy/Kotlin DSL string literals).
+ */
+function gatherJavaTestFrameworkResult(cwd) {
+    const buildFiles = ['pom.xml', 'build.gradle.kts', 'build.gradle'];
+    let combined = '';
+    for (const rel of buildFiles) {
+        if (!(0, runner_1.fileExists)(cwd, rel))
+            continue;
+        try {
+            combined += fs.readFileSync(path.join(cwd, rel), 'utf-8') + '\n';
+        }
+        catch {
+            /* ignore unreadable */
+        }
+    }
+    if (!combined)
+        return null;
+    if (combined.includes('junit-jupiter')) {
+        return { schemaVersion: 1, tool: 'java', name: 'junit5' };
+    }
+    if (combined.includes('org.spockframework') || combined.includes('spock-core')) {
+        return { schemaVersion: 1, tool: 'java', name: 'spock' };
+    }
+    if (combined.includes('org.testng') || combined.includes(':testng:')) {
+        return { schemaVersion: 1, tool: 'java', name: 'testng' };
+    }
+    if (combined.toLowerCase().includes('junit')) {
+        return { schemaVersion: 1, tool: 'java', name: 'junit4' };
+    }
+    return null;
+}
+const javaTestFrameworkProvider = {
+    source: 'java',
+    async gather(cwd) {
+        return gatherJavaTestFrameworkResult(cwd);
+    },
+};
+// ─── Lint (PMD JSON output) ────────────────────────────────────────────────
+/**
+ * Map PMD's 1-5 priority scale to dxkit's 4-tier severity. PMD's
+ * priority semantics (per official docs):
+ *   1 = High         → critical
+ *   2 = Medium High  → high
+ *   3 = Medium       → medium
+ *   4 = Medium Low   → low
+ *   5 = Low          → low
+ *
+ * Defensive: unknown / missing priorities tier as 'medium' — visibility
+ * tilts toward "developer sees it" rather than "silently dropped". Same
+ * defensive-default approach as detekt / mapDetektSeverity.
+ *
+ * Exported for unit tests.
+ */
+function mapPmdRuleSeverity(priority) {
+    if (priority === 1)
+        return 'critical';
+    if (priority === 2)
+        return 'high';
+    if (priority === 3)
+        return 'medium';
+    if (priority === 4 || priority === 5)
+        return 'low';
+    return 'medium';
+}
+/**
+ * Parse PMD 7.x JSON output (`pmd check -f json`) into a tiered
+ * SeverityCounts. Shape:
+ *
+ *   {
+ *     "formatVersion": 0,
+ *     "pmdVersion": "7.24.0",
+ *     "files": [
+ *       {
+ *         "filename": "<path>",
+ *         "violations": [
+ *           {
+ *             "beginline": N, "begincolumn": N,
+ *             "endline": N, "endcolumn": N,
+ *             "description": "...",
+ *             "rule": "<ruleName>",
+ *             "ruleset": "<rulesetCategory>",
+ *             "priority": 1-5,
+ *             "externalInfoUrl": "..."
+ *           }
+ *         ]
+ *       }
+ *     ],
+ *     "suppressedViolations": [],
+ *     "processingErrors": [],
+ *     "configurationErrors": []
+ *   }
+ *
+ * Tolerates malformed JSON (returns empty counts) and missing
+ * `files`/`violations` arrays. Real-fixture tests live in
+ * `test/languages-java.test.ts` against
+ * `test/fixtures/raw/java/pmd-output.json`.
+ *
+ * Exported for unit tests; consumed by `gatherJavaLintResult`.
+ */
+function parsePmdOutput(raw) {
+    const counts = { critical: 0, high: 0, medium: 0, low: 0 };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return counts;
+    }
+    for (const file of parsed.files ?? []) {
+        for (const v of file.violations ?? []) {
+            counts[mapPmdRuleSeverity(v.priority)]++;
+        }
+    }
+    return counts;
+}
+/**
+ * Single source of truth for the java pack's lint gathering. Consumed
+ * by `javaLintProvider`.
+ *
+ * PMD 7.x switched to subcommand syntax (`pmd check -d <dir> -R
+ * <ruleset> -f <format>`). We use the built-in
+ * `rulesets/java/quickstart.xml` — the curated subset PMD recommends
+ * for general scanning across rule categories (Best Practices, Code
+ * Style, Design, Documentation, Error Prone, Multithreading,
+ * Performance, Security). Projects that ship their own
+ * `pmd-ruleset.xml` aren't honored yet — Recipe v3 candidate if
+ * customer-need surfaces.
+ *
+ * Exit codes: PMD exits 0 (no violations), 4 (violations found),
+ * other (error). Our `run` helper captures stdout regardless of exit
+ * code, so violations-found doesn't block parsing.
+ */
+function gatherJavaLintResult(cwd) {
+    // Activation gate — match detectJava (no pom.xml-alone trigger).
+    if (!fs.existsSync(path.join(cwd, 'src', 'main', 'java')) && !hasJavaSourceWithinDepth(cwd, 5)) {
+        return { kind: 'unavailable', reason: 'no java source' };
+    }
+    const pmd = (0, tool_registry_1.findTool)(tool_registry_1.TOOL_DEFS.pmd, cwd);
+    if (!pmd.available || !pmd.path) {
+        return { kind: 'unavailable', reason: 'not installed' };
+    }
+    const cmd = `${pmd.path} check -d . -R rulesets/java/quickstart.xml -f json 2>/dev/null`;
+    const raw = (0, runner_1.run)(cmd, cwd, 120000);
+    if (!raw)
+        return { kind: 'unavailable', reason: 'no pmd output' };
+    const counts = parsePmdOutput(raw);
+    const envelope = { schemaVersion: 1, tool: 'pmd', counts };
+    return { kind: 'success', envelope };
+}
+const javaLintProvider = {
+    source: 'java',
+    async gather(cwd) {
+        const outcome = gatherJavaLintResult(cwd);
+        return outcome.kind === 'success' ? outcome.envelope : null;
+    },
+};
+// ─── Coverage (JaCoCo XML — shared with kotlin pack) ───────────────────────
+//
+// Per CLAUDE.md rule #2 ("Each tool has ONE gather function"), the
+// JaCoCo parser + locator + gather glue all live in
+// `src/analyzers/tools/jacoco.ts`. Both kotlin and java packs delegate.
+// Java's Maven paths (`target/site/jacoco/jacoco.xml`) and Gradle paths
+// share the same candidate list because they're mutually exclusive on
+// any given project root.
+const javaCoverageProvider = {
+    source: 'java',
+    async gather(cwd) {
+        return (0, jacoco_1.gatherJaCoCoCoverageResult)(cwd);
+    },
+};
+// ─── DepVulns (osv-scanner against Maven — shared with kotlin pack) ────────
+//
+// Same shape as coverage above — parser + manifest discovery + tool
+// invocation + CVSS resolution all live in
+// `src/analyzers/tools/osv-scanner-maven.ts` (extracted from kotlin
+// pack in 10k.1.4 for SSOT). Java contributes the same Maven manifest
+// candidates (pom.xml, gradle.lockfile, gradle/verification-metadata.xml)
+// — JVM ecosystem manifests are language-agnostic.
+const javaDepVulnsProvider = {
+    source: 'java',
+    async gather(cwd) {
+        const outcome = await (0, osv_scanner_maven_1.gatherOsvScannerMavenDepVulnsResult)(cwd, 'java');
+        return outcome.kind === 'success' ? outcome.envelope : null;
+    },
+};
+// ─── Pack export ────────────────────────────────────────────────────────────
+exports.java = {
+    id: 'java',
+    displayName: 'Java',
+    sourceExtensions: ['.java'],
+    // JUnit 4/5, TestNG, Spock all converge on these naming conventions.
+    // *IT.java is the Maven Failsafe convention for integration tests.
+    testFilePatterns: ['*Test.java', '*Tests.java', '*IT.java'],
+    // Build artifact dirs across Maven (target), Gradle (build, .gradle,
+    // out). Universal exclusions live in src/analyzers/tools/exclusions.ts.
+    extraExcludes: ['target', 'build', '.gradle', 'out'],
+    detect: detectJava,
+    tools: ['pmd', 'osv-scanner'],
+    // Semgrep ships a Java ruleset under p/java.
+    semgrepRulesets: ['p/java'],
+    capabilities: {
+        imports: javaImportsProvider,
+        testFramework: javaTestFrameworkProvider,
+        coverage: javaCoverageProvider,
+        lint: javaLintProvider,
+        depVulns: javaDepVulnsProvider,
+    },
+    // ─── LP-recipe metadata ────────────────────────────────────────────────
+    permissions: [
+        'Bash(mvn:*)',
+        'Bash(./gradlew:*)',
+        'Bash(gradle:*)',
+        'Bash(java:*)',
+        'Bash(javac:*)',
+    ],
+    ruleFile: 'java.md',
+    templateFiles: [],
+    // doctor checks the runtime + build tool + linter. `java` is the
+    // JVM runtime PMD/JaCoCo wrappers shell into; `mvn` is the dominant
+    // build tool; `pmd` is the canonical linter wired in 10k.1.3.
+    cliBinaries: ['java', 'mvn', 'pmd'],
+    // Java 17 is current LTS as of 2026-04 with very wide deployment.
+    defaultVersion: '17',
+    projectYamlBlock: ({ config, enabled }) => [
+        `  java:`,
+        `    enabled: ${enabled}`,
+        `    version: "${config.versions['java'] ?? '17'}"`,
+    ].join('\n'),
+};
+//# sourceMappingURL=java.js.map

package/dist/languages/java.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"java.js","sourceRoot":"","sources":["../../src/languages/java.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2FA,sDAcC;AAkHD,gDAMC;AAqCD,wCAcC;AApRD,uCAAyB;AACzB,2CAA6B;AAE7B,8DAAoE;AACpE,sDAAuE;AACvE,4EAA2F;AAC3F,sDAA4D;AAC5D,oEAAuE;AAavE,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,GAAW,EAAE,QAAQ,GAAG,CAAC;IACzD,SAAS,MAAM,CAAC,GAAW,EAAE,KAAa;QACxC,IAAI,KAAK,GAAG,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IACE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBACtB,CAAC,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EACtE,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxD,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAChF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,oEAAoE;IACpE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,oDAAoD;IACpD,OAAO,wBAAwB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAgB,qBAAqB,CAAC,OAAe;IACnD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,uEAAuE;IACvE,sCAAsC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACrF,uEAAuE;IACvE,qEAAqE;IACrE,2DAA2D;IAC3D,MAAM,EAAE,GAAG,4CAA4C,CAAC;IACxD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,GAAW;IAC1C,MAAM,QAAQ,GAAG,IAAA,gCAAmB,EAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,iCAAiC,QAAQ,cAAc,EAAE,GAAG,CAAC,CAAC;IAC9E,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACnC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,cAAc;QACpB,gBAAgB,EAAE,CAAC,OAAO,CAAC;QAC3B,SAAS;QACT,KAAK,EAAE,IAAI,GAAG,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAsC;IAC7D,MAAM,EAAE,MAAM;IACd,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;CACF,CAAC;AAEF,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,SAAS,6BAA6B,CAAC,GAAW;IAChD,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;IACnE,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,GAAG,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC;YACH,QAAQ,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,yBAAyB,GAA4C;IACzE,MAAM,EAAE,MAAM;IACd,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;CACF,CAAC;AAEF,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,SAAgB,kBAAkB,CAAC,QAAmC;IACpE,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IACtC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,SAAgB,cAAc,CAAC,GAAW;IACxC,MAAM,MAAM,GAAmB,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC3E,IAAI,MAAwE,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,iEAAiE;IACjE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/F,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,wBAAQ,EAAC,yBAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,iEAAiE,CAAC;IACzF,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAe,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,gBAAgB,GAAmC;IACvD,MAAM,EAAE,MAAM;IACd,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;CACF,CAAC;AAEF,8EAA8E;AAC9E,EAAE;AACF,mEAAmE;AACnE,oDAAoD;AACpD,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,0BAA0B;AAE1B,MAAM,oBAAoB,GAAuC;IAC/D,MAAM,EAAE,MAAM;IACd,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,OAAO,IAAA,mCAA0B,EAAC,GAAG,CAAC,CAAC;IACzC,CAAC;CACF,CAAC;AAEF,8EAA8E;AAC9E,EAAE;AACF,oEAAoE;AACpE,2CAA2C;AAC3C,oEAAoE;AACpE,sEAAsE;AACtE,0EAA0E;AAC1E,mDAAmD;AAEnD,MAAM,oBAAoB,GAAsC;IAC9D,MAAM,EAAE,MAAM;IACd,KAAK,CAAC,MAAM,CAAC,GAAG;QACd,MAAM,OAAO,GAAG,MAAM,IAAA,uDAAmC,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;CACF,CAAC;AAEF,+EAA+E;AAElE,QAAA,IAAI,GAAoB;IACnC,EAAE,EAAE,MAAM;IACV,WAAW,EAAE,MAAM;IAEnB,gBAAgB,EAAE,CAAC,OAAO,CAAC;IAE3B,qEAAqE;IACrE,mEAAmE;IACnE,gBAAgB,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;IAE3D,qEAAqE;IACrE,wEAAwE;IACxE,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC;IAEpD,MAAM,EAAE,UAAU;IAElB,KAAK,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC;IAE7B,6CAA6C;IAC7C,eAAe,EAAE,CAAC,QAAQ,CAAC;IAE3B,YAAY,EAAE;QACZ,OAAO,EAAE,mBAAmB;QAC5B,aAAa,EAAE,yBAAyB;QACxC,QAAQ,EAAE,oBAAoB;QAC9B,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,oBAAoB;KAC/B;IAED,0EAA0E;IAE1E,WAAW,EAAE;QACX,aAAa;QACb,mBAAmB;QACnB,gBAAgB;QAChB,cAAc;QACd,eAAe;KAChB;IAED,QAAQ,EAAE,SAAS;IAEnB,aAAa,EAAE,EAAE;IAEjB,iEAAiE;IACjE,oEAAoE;IACpE,8DAA8D;IAC9D,WAAW,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;IAEnC,kEAAkE;IAClE,cAAc,EAAE,IAAI;IAEpB,gBAAgB,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CACxC;QACE,SAAS;QACT,gBAAgB,OAAO,EAAE;QACzB,iBAAiB,MAAM,CAAC,QAAQ,CAAC,MAAsC,CAAC,IAAI,IAAI,GAAG;KACpF,CAAC,IAAI,CAAC,IAAI,CAAC;CACf,CAAC"}

package/dist/languages/kotlin.d.ts

@@ -1,5 +1,4 @@
-import { type Coverage } from '../analyzers/tools/coverage';
-import type { DepVulnFinding, SeverityCounts } from './capabilities/types';
+import type { SeverityCounts } from './capabilities/types';
 import type { LanguageSupport, LintSeverity } from './types';
 /**
  * Map detekt's lowercased Severity enum to dxkit's four-tier scheme.
@@ -38,56 +37,6 @@ export declare function mapDetektSeverity(severity: string): LintSeverity;
  * Exported for unit tests; consumed by `gatherKotlinLintResult`.
  */
 export declare function parseDetektCheckstyleXml(raw: string): SeverityCounts;
-/**
- * Pure parser for JaCoCo's XML report (DTD: `report.dtd`). The structure:
- *
- *   <report name="...">
- *     <package name="com/example">
- *       <class name="com/example/Foo" sourcefilename="Foo.kt">...</class>
- *       <sourcefile name="Foo.kt">
- *         <line nr="N" mi="..." ci="..." mb="..." cb="..."/>
- *         <counter type="LINE" missed="X" covered="Y"/>
- *       </sourcefile>
- *       <counter type="LINE" missed="X" covered="Y"/>
- *     </package>
- *     <counter type="LINE" missed="X" covered="Y"/>
- *   </report>
- *
- * Per-file coverage comes from `<sourcefile>` blocks: their LINE counter
- * holds the file's missed/covered totals. Project-level total comes from
- * the top-level `<counter type="LINE">` (last in the document).
- *
- * Path attribution joins `<package name>` (forward-slashed, JVM-style)
- * with `<sourcefile name>` to produce the canonical relative path the
- * downstream consumers expect (`com/example/Foo.kt`). JVM bytecode
- * namespacing isn't 1:1 with on-disk source paths in multi-module
- * projects — accepted limitation (matches C#'s cobertura attribution).
- *
- * Returns null when no `<counter type="LINE">` exists at the top level
- * — that's JaCoCo's "no coverage data" signal, distinct from "0%
- * coverage" (where the counter exists with covered=0).
- *
- * Exported for unit tests; consumed by `gatherKotlinCoverageResult`.
- */
-export declare function parseJaCoCoXml(raw: string, sourceFile: string, _cwd: string): Coverage | null;
-/**
- * Pure parser for osv-scanner v2.x JSON output, scoped to Maven
- * findings only. Other ecosystems (npm, PyPI, Go) are filtered out so
- * polyglot repos don't double-count: the typescript pack handles npm,
- * the python pack handles PyPI, etc. The kotlin pack owns Maven.
- *
- * Returns counts + findings + the raw OSV vuln records for downstream
- * CVSS resolution. Exported for unit tests.
- */
-export declare function parseOsvScannerMavenFindings(raw: string): {
-    counts: SeverityCounts;
-    findings: DepVulnFinding[];
-    vulnsForCvss: Array<{
-        primaryId: string;
-        embeddedCvss: number | null;
-        aliases: string[];
-    }>;
-};
 /**
  * Capture Kotlin import specifiers from source text. Handles both
  * `import com.foo.Bar` (single) and `import com.foo.*` (wildcard) plus

package/dist/languages/kotlin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kotlin.d.ts","sourceRoot":"","sources":["../../src/languages/kotlin.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,QAAQ,EAA6B,MAAM,6BAA6B,CAAC;AAWvF,OAAO,KAAK,EAEV,cAAc,EAMd,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAmE7D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAMhE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAWpE;AA2DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAmE7F;AAqED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG;IACzD,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,YAAY,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC5F,CAiEA;AAkFD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAYjE;AA8FD,eAAO,MAAM,MAAM,EAAE,eA6DpB,CAAC"}
+{"version":3,"file":"kotlin.d.ts","sourceRoot":"","sources":["../../src/languages/kotlin.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAMV,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAmE7D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAMhE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAWpE;AAuFD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAYjE;AA8FD,eAAO,MAAM,MAAM,EAAE,eA6DpB,CAAC"}